5.15.168-rc1 review
Greg Kroah-Hartman
maintainercover 5.15.168-rc1 review
This is the start of the stable review cycle for the 5.15.168 release. There are 691 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 17 Oct 2024 11:22:41 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.168-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.168-rc1
Sean Anderson <[email protected]>
net: xilinx: axienet: Schedule NAPI in two steps
Paolo Abeni <[email protected]>
selftests: net: more strict check in net_helper
Andy Chiu <[email protected]>
net: axienet: start napi before enabling Rx/Tx
Jan Kara <[email protected]>
ext4: fix warning in ext4_dio_write_end_io()
Phil Sutter <[email protected]>
netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
Antoine Tenart <[email protected]>
net: vrf: determine the dst using the original ifindex for multicast
Andrea Mayer <[email protected]>
net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev
David Ahern <[email protected]>
net: Handle l3mdev in ip_tunnel_init_flow
David Ahern <[email protected]>
xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup
Eyal Birger <[email protected]>
net: geneve: add missing netlink policy and size for IFLA_GENEVE_INNER_PROTO_INHERIT
Andy Shevchenko <[email protected]>
i2c: smbus: Check for parent device before dereference
Thomas Richter <[email protected]>
perf test sample-parsing: Fix branch_stack entry endianness check
Yu Kuai <[email protected]>
block, bfq: fix uaf for accessing waker_bfqq after splitting
Frederic Weisbecker <[email protected]>
kthread: unpark only parked kthread
Yonatan Maman <[email protected]>
nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: do not remove closing subflows
Anatolij Gustschin <[email protected]>
net: dsa: lan9303: ensure chip reset and wait for READY status
Anastasia Kovaleva <[email protected]>
net: Fix an unsafe loop on the list
Ignat Korchagin <[email protected]>
net: explicitly clear the sk pointer, when pf->create fails
Maíra Canal <[email protected]>
drm/v3d: Stop the active perfmon before being destroyed
SurajSonawane2415 <[email protected]>
hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma
Icenowy Zheng <[email protected]>
usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
Jose Alberto Reguero <[email protected]>
usb: xhci: Fix problem with xhci resume from suspend
Selvarasu Ganesan <[email protected]>
usb: dwc3: core: Stop processing of pending events if controller is halted
Oliver Neukum <[email protected]>
Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
Wade Wang <[email protected]>
HID: plantronics: Workaround for an unexcepted opposite volume key
Huang Ying <[email protected]>
resource: fix region_intersects() vs add_memory_driver_managed()
Basavaraj Natikar <[email protected]>
HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
Javier Carrasco <[email protected]>
hwmon: (adt7470) Add missing dependency on REGMAP_I2C
Javier Carrasco <[email protected]>
hwmon: (adm9240) Add missing dependency on REGMAP_I2C
Guenter Roeck <[email protected]>
hwmon: (tmp513) Add missing dependency on REGMAP_I2C
Mitchell Levy <[email protected]>
x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported
Chengchang Tang <[email protected]>
RDMA/hns: Fix UAF for cq async event
Eric Dumazet <[email protected]>
slip: make slhc_remember() more robust against malicious packets
Eric Dumazet <[email protected]>
ppp: fix ppp_async_encode() illegal access
Kuniyuki Iwashima <[email protected]>
mctp: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: add msg kind names
Florian Westphal <[email protected]>
netfilter: fib: check correct rtable in vrf setups
Guillaume Nault <[email protected]>
netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces.
Phil Sutter <[email protected]>
netfilter: rpfilter/fib: Populate flowic_l3mdev field
David Ahern <[email protected]>
net: Add l3mdev index to flow struct and avoid oif reset for port devices
Florian Westphal <[email protected]>
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
Xin Long <[email protected]>
sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
Rosen Penev <[email protected]>
net: ibm: emac: mal: fix wrong goto
Eric Dumazet <[email protected]>
net/sched: accept TCA_STAB only for root qdisc
Mohamed Khalfella <[email protected]>
igb: Do not bring the device up after non-fatal error
Aleksandr Loktionov <[email protected]>
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
Marcin Szycik <[email protected]>
ice: Fix netif_is_ice() in Safe Mode
Billy Tsai <[email protected]>
gpio: aspeed: Use devm_clk api to manage clock source
Billy Tsai <[email protected]>
gpio: aspeed: Add the flush write to ensure the write complete.
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frames on 10/100 ports
Jonas Gorski <[email protected]>
net: dsa: b53: allow lower MTUs on BCM5325/5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for BCM5325/BCM5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for 1g switches
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frame mtu check
Zhang Rui <[email protected]>
thermal: intel: int340x: processor: Fix warning during module unload
Srinivas Pandruvada <[email protected]>
thermal: int340x: processor_thermal: Set feature mask before proc_thermal_add
Christophe JAILLET <[email protected]>
net: phy: bcm84881: Fix some error handling paths
Luiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
Andy Roulin <[email protected]>
netfilter: br_netfilter: fix panic with metadata_dst skb
Neal Cardwell <[email protected]>
tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
Neal Cardwell <[email protected]>
tcp: fix to allow timestamp undo if no retransmits were sent
Ingo van Lil <[email protected]>
net: phy: dp83869: fix memory corruption when enabling fiber
Yanjun Zhang <[email protected]>
NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
Dan Carpenter <[email protected]>
SUNRPC: Fix integer overflow in decode_rc_list()
Dave Ertman <[email protected]>
ice: fix VLAN replay after reset
Chuck Lever <[email protected]>
NFSD: Mark filecache "down" if init fails
Bob Pearson <[email protected]>
RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
Andrey Shumilin <[email protected]>
fbdev: sisfb: Fix strbuf array overflow
Alex Hung <[email protected]>
drm/amd/display: Check null pointer before dereferencing se
Zijun Hu <[email protected]>
driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
Zhu Jun <[email protected]>
tools/iio: Add memory allocation failure check for trigger_name
Philip Chen <[email protected]>
virtio_pmem: Check device status before requesting flush
Ruffalo Lavoisier <[email protected]>
comedi: ni_routing: tools: Check when the file could not be opened
Shawn Shao <[email protected]>
usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
Xu Yang <[email protected]>
usb: chipidea: udc: enable suspend interrupt after usb reset
Peng Fan <[email protected]>
clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
Peng Fan <[email protected]>
remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
Yunke Cao <[email protected]>
media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
Kaixin Wang <[email protected]>
ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
Alex Williamson <[email protected]>
PCI: Mark Creative Labs EMU20k2 INTx masking as broken
Hans de Goede <[email protected]>
i2c: i801: Use a different adapter-name for IDF adapters
Subramanian Ananthanarayanan <[email protected]>
PCI: Add ACS quirk for Qualcomm SA8775P
Krzysztof Kozlowski <[email protected]>
clk: bcm: bcm53573: fix OF node leak in init
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Avoid null pointer deref during path establishment
WangYuli <[email protected]>
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
Saravanan Vajravel <[email protected]>
RDMA/mad: Improve handling of timed out WRs of mad agent
Daniel Jordan <[email protected]>
ktest.pl: Avoid false positives with grub2 skip regex
Thomas Richter <[email protected]>
s390/cpum_sf: Remove WARN_ON_ONCE statements
Wojciech Gładysz <[email protected]>
ext4: nested locking for xattr inode
Jan Kara <[email protected]>
ext4: don't set SB_RDONLY after filesystem errors
Yonghong Song <[email protected]>
bpf, x64: Fix a jit convergence issue
Gerald Schaefer <[email protected]>
s390/mm: Add cond_resched() to cmm_alloc/free_pages()
Heiko Carstens <[email protected]>
s390/facility: Disable compile time optimization for decompressor code
Tao Chen <[email protected]>
bpf: Check percpu map value size first
Mathias Krause <[email protected]>
Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
Michael S. Tsirkin <[email protected]>
virtio_console: fix misc probe bugs
Konstantin Komarov <[email protected]>
fs/ntfs3: Refactor enum_rstbl to suppress static checker
Benjamin Poirier <[email protected]>
selftests: net: Remove executable bits from library scripts
Lucas Karpinski <[email protected]>
selftests/net: synchronize udpgro tests' tx and rx connection
Adrien Thierry <[email protected]>
selftests/net: give more time to udpgro bg processes to complete startup
Steven Rostedt (Google) <[email protected]>
tracing: Have saved_cmdlines arrays all in one allocation
Rob Clark <[email protected]>
drm/crtc: fix uninitialized variable use even harder
Steven Rostedt (Google) <[email protected]>
tracing: Remove precision vsnprintf() check from print event
Linus Walleij <[email protected]>
net: ethernet: cortina: Drop TSO support
Gabriel Krisman Bertazi <[email protected]>
unicode: Don't special case ignorable code points
Jaroslav Kysela <[email protected]>
ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate()
Namhyung Kim <[email protected]>
perf report: Fix segfault when 'sym' sort key is not used
Haoran Zhang <[email protected]>
vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
Dominique Martinet <[email protected]>
9p: add missing locking around taking dentry fid list
zhanchengbin <[email protected]>
ext4: fix inode tree inconsistency caused by ENOMEM
Sumit Semwal <[email protected]>
Revert "arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings"
Armin Wolf <[email protected]>
ACPI: battery: Fix possible crash when unregistering a battery hook
Armin Wolf <[email protected]>
ACPI: battery: Simplify battery hook locking
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sc8180x: Add GPLL9 support
Heiner Kallweit <[email protected]>
r8169: add tally counter fields added with RTL8125
Colin Ian King <[email protected]>
r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
Satya Priya Kakitapalli <[email protected]>
dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
Manivannan Sadhasivam <[email protected]>
dt-bindings: clock: qcom: Add missing UFS QREF clocks
Umang Jain <[email protected]>
media: imx335: Fix reset-gpio handling
Kieran Bingham <[email protected]>
media: i2c: imx335: Enable regulator supplies
Val Packett <[email protected]>
drm/rockchip: vop: clear DMA stop bit on RK3066
Hugh Cole-Baker <[email protected]>
drm/rockchip: support gamma control on RK3399
Hugh Cole-Baker <[email protected]>
drm/rockchip: define gamma registers for RK3399
Andrii Nakryiko <[email protected]>
lib/buildid: harden build ID parsing logic
Alexey Dobriyan <[email protected]>
build-id: require program headers to be right after ELF header
Mario Limonciello <[email protected]>
drm/amd/display: Allow backlight to go below AMDGPU_DM_DEFAULT_MIN_BACKLIGHT
Oleg Nesterov <[email protected]>
uprobes: fix kernel info leak via "[uprobes]" vma
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround once more
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-N3 definitions
Anshuman Khandual <[email protected]>
arm64: Add Cortex-715 CPU part definition
Zhihao Cheng <[email protected]>
ext4: dax: fix overflowing extents beyond inode size when partially writing
Jan Kara <[email protected]>
ext4: properly sync file size update after O_SYNC direct IO
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix missing pm_runtime_disable()
Jinjie Ruan <[email protected]>
i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
Andi Shyti <[email protected]>
i2c: xiic: Use devm_clk_get_enabled()
Heiner Kallweit <[email protected]>
i2c: core: Lock address during client device instantiation
Wolfram Sang <[email protected]>
i2c: create debugfs entry per adapter
Akhil R <[email protected]>
i2c: smbus: Use device_*() functions instead of of_*()
Akhil R <[email protected]>
device property: Add fwnode_irq_get_byname
Anand Ashok Dumbre <[email protected]>
device property: Add fwnode_iomap()
Masahiro Yamada <[email protected]>
kconfig: qconf: fix buffer overflow in debug links
Tom Chung <[email protected]>
drm/amd/display: Fix system hang while resume with TBT monitor
Tvrtko Ursulin <[email protected]>
drm/sched: Add locking to drm_sched_entity_modify_sched
Al Viro <[email protected]>
close_range(): fix the logics in descriptor table trimming
Wei Li <[email protected]>
tracing/timerlat: Fix a race during cpuhp processing
Wei Li <[email protected]>
tracing/hwlat: Fix a race during cpuhp processing
Emanuele Ghidoli <[email protected]>
gpio: davinci: fix lazy disable
Filipe Manana <[email protected]>
btrfs: wait for fixup workers before stopping cleaner kthread during umount
Qu Wenruo <[email protected]>
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
Hans de Goede <[email protected]>
ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
Nuno Sa <[email protected]>
Input: adp5589-keys - fix adp5589_gpio_get_value()
Nuno Sa <[email protected]>
Input: adp5589-keys - fix NULL pointer dereference
Krzysztof Kozlowski <[email protected]>
rtc: at91sam9: fix OF node leak in probe() error path
KhaiWenTan <[email protected]>
net: stmmac: Fix zero-division error when disabling tc cbs
Tetsuo Handa <[email protected]>
tomoyo: fallback to realpath if symlink's pathname does not exist
Barnabás Czémán <[email protected]>
iio: magnetometer: ak8975: Fix reading for ak099xx sensors
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table
Manivannan Sadhasivam <[email protected]>
clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
Zheng Wang <[email protected]>
media: venus: fix use after free bug in venus_remove due to race condition
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src
Mike Tipton <[email protected]>
clk: qcom: clk-rpmh: Fix overflow in BCM vote
Hans Verkuil <[email protected]>
media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
Laurent Pinchart <[email protected]>
media: sun4i_csi: Implement link validate for sun4i_csi subdev
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
Sebastian Reichel <[email protected]>
clk: rockchip: fix error for unknown clocks
Chun-Yi Lee <[email protected]>
aoe: fix the potential use-after-free problem in more places
Chuck Lever <[email protected]>
NFSD: Fix NFSv4's PUTPUBFH operation
Li Lingfeng <[email protected]>
nfsd: map the EBADMSG to nfserr_io to avoid warning
NeilBrown <[email protected]>
nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
Matt Fleming <[email protected]>
perf hist: Update hist symbol when updating maps
Yuezhang Mo <[email protected]>
exfat: fix memory leak in exfat_load_bitmap()
Jisheng Zhang <[email protected]>
riscv: define ILLEGAL_POINTER_VALUE for 64bit
Luis Henriques (SUSE) <[email protected]>
ext4: mark fc as ineligible using an handle in ext4_xattr_set()
Luis Henriques (SUSE) <[email protected]>
ext4: use handle to mark fc as ineligible in __track_dentry_update()
Luis Henriques (SUSE) <[email protected]>
ext4: fix fast commit inode enqueueing during a full journal commit
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list()
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
Baokun Li <[email protected]>
ext4: update orig_path in ext4_find_extent()
Baokun Li <[email protected]>
ext4: fix double brelse() the buffer of the extents path
Baokun Li <[email protected]>
ext4: aovid use-after-free in ext4_ext_insert_extent()
Baokun Li <[email protected]>
ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
Baokun Li <[email protected]>
ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
Baokun Li <[email protected]>
ext4: fix slab-use-after-free in ext4_split_extent_at()
yao.ly <[email protected]>
ext4: correct encrypted dentry name hash when not casefolded
Edward Adam Davis <[email protected]>
ext4: no need to continue when the number of entries is 1
Ai Chao <[email protected]>
ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
Hans P. Moller <[email protected]>
ALSA: line6: add hw monitor volume control to POD HD500X
Jan Lalinsky <[email protected]>
ALSA: usb-audio: Add native DSD support for Luxman D-08u
Lianqin Hu <[email protected]>
ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
Jaroslav Kysela <[email protected]>
ALSA: core: add isascii() check to card ID generator
Thomas Zimmermann <[email protected]>
drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
Helge Deller <[email protected]>
parisc: Fix itlb miss handler for 64-bit programs
Luo Gengkun <[email protected]>
perf/core: Fix small negative period being ignored
Hans de Goede <[email protected]>
power: supply: hwmon: Fix missing temp1_max_alarm attribute
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix module autoloading
Krzysztof Kozlowski <[email protected]>
firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
Robert Hancock <[email protected]>
i2c: xiic: Wait for TX empty to avoid missed TX NAKs
Jinjie Ruan <[email protected]>
i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
Marek Vasut <[email protected]>
i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
Zach Wade <[email protected]>
platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
Heiko Carstens <[email protected]>
selftests: vDSO: fix vdso_config for s390
Jens Remus <[email protected]>
selftests: vDSO: fix ELF hash table entry size for s390x
David Hildenbrand <[email protected]>
selftests/mm: fix charge_reserved_hugetlb.sh test
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO symbols lookup for powerpc64
Christophe Leroy <[email protected]>
selftests: vDSO: fix vdso_config for powerpc
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO name for powerpc
Yifei Liu <[email protected]>
selftests: breakpoints: use remaining time to check if suspend succeed
Ben Dooks <[email protected]>
spi: s3c64xx: fix timeout counters in flush_fifo
Jinjie Ruan <[email protected]>
spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Check for port partner validity before consuming it
Thomas Weißschuh <[email protected]>
blk-integrity: register sysfs attributes on struct device
Thomas Weißschuh <[email protected]>
blk-integrity: convert to struct device_attribute
Thomas Weißschuh <[email protected]>
blk-integrity: use sysfs_emit
Artem Sadovnikov <[email protected]>
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
Baokun Li <[email protected]>
ext4: avoid use-after-free in ext4_ext_show_leaf()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: ext4_search_dir should return a proper error
Geert Uytterhoeven <[email protected]>
of/irq: Refer to actual buffer size in of_irq_parse_one()
Tim Huang <[email protected]>
drm/amd/pm: ensure the fw_info is not null before using it
Geert Uytterhoeven <[email protected]>
drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
Kees Cook <[email protected]>
scsi: aacraid: Rearrange order of struct aac_srb_unit
Matthew Brost <[email protected]>
drm/printer: Allow NULL data in devcoredump printer
Alex Hung <[email protected]>
drm/amd/display: Initialize get_bytes_per_element's default to 1
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 color transformation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in degamma hardware format translation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
Alex Hung <[email protected]>
drm/amd/display: Check stream before comparing them
Ckath <[email protected]>
platform/x86: touchscreen_dmi: add nanote-next quirk
Vishnu Sankar <[email protected]>
HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
Peng Liu <[email protected]>
drm/amdgpu: enable gfxoff quirk on HP 705G4
Peng Liu <[email protected]>
drm/amdgpu: add raven1 gfxoff quirk
Zhao Mengmeng <[email protected]>
jfs: Fix uninit-value access of new_ea in ea_buffer
Mahesh Rajashekhara <[email protected]>
scsi: smartpqi: correct stream detection
Edward Adam Davis <[email protected]>
jfs: check if leafidx greater than num leaves per dmap tree
Edward Adam Davis <[email protected]>
jfs: Fix uaf in dbFreeBits
Remington Brasga <[email protected]>
jfs: UBSAN: shift-out-of-bounds in dbFindBits
Alex Hung <[email protected]>
drm/amd/display: Check null pointers before using dc->clk_mgr
Damien Le Moal <[email protected]>
ata: sata_sil: Rename sil_blacklist to sil_quirks
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
Sanjay K Kumar <[email protected]>
iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
Lu Baolu <[email protected]>
iommu/vt-d: Always reserve a domain ID for identity setup
Andrew Davis <[email protected]>
power: reset: brcmstb: Do not go into infinite loop if reset fails
Marc Gonzalez <[email protected]>
iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
Paul E. McKenney <[email protected]>
rcuscale: Provide clear error when async specified without primitives
Kaixin Wang <[email protected]>
fbdev: pxafb: Fix possible use after free in pxafb_task()
Kees Cook <[email protected]>
x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
Takashi Iwai <[email protected]>
ALSA: hdsp: Break infinite MIDI input flush loop
Takashi Iwai <[email protected]>
ALSA: asihpi: Fix potential OOB array access
Ahmed S. Darwish <[email protected]>
tools/x86/kcpuid: Protect against faulty "max subleaf" values
Joshua Pius <[email protected]>
ALSA: usb-audio: Add logitech Audio profile quirk
Takashi Iwai <[email protected]>
ALSA: usb-audio: Define macros for quirk table entries
Thomas Gleixner <[email protected]>
x86/ioapic: Handle allocation failures gracefully
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add input value sanity checks for standard types
Thomas Gleixner <[email protected]>
signal: Replace BUG_ON()s
Jinjie Ruan <[email protected]>
nfp: Use IRQF_NO_AUTOEN flag in request_irq()
Gustavo A. R. Silva <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
Felix Fietkau <[email protected]>
wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
Adrian Ratiu <[email protected]>
proc: add config & param to block forcing mem writes
Aleksandrs Vinarskis <[email protected]>
ACPICA: iasl: handle empty connection_node
Jason Xing <[email protected]>
tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
Simon Horman <[email protected]>
net: atlantic: Avoid warning about potential string truncation
Ido Schimmel <[email protected]>
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
Kuniyuki Iwashima <[email protected]>
ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
Simon Horman <[email protected]>
net: mvpp2: Increase size of queue_name buffer
Simon Horman <[email protected]>
tipc: guard against string buffer overrun
Pei Xiao <[email protected]>
ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
Rafael J. Wysocki <[email protected]>
ACPI: EC: Do not release locks during operation region accesses
Zong-Zhe Yang <[email protected]>
wifi: rtw88: select WANT_DEV_COREDUMP
Karthikeyan Periyasamy <[email protected]>
wifi: ath11k: fix array out-of-bound access in SoC stats
Keith Busch <[email protected]>
nvme-pci: qdepth 1 quirk
Konstantin Ovsepian <[email protected]>
blk_iocost: fix more out of bound shifts
Dmitry Antipov <[email protected]>
net: sched: consistently use rcu_replace_pointer() in taprio_change()
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
Seiji Nishikawa <[email protected]>
ACPI: PAD: fix crash in exit_round_robin()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_mdio: fix OF node leak in probe()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hip04: fix OF node leak in probe()
Jeongjun Park <[email protected]>
net/xen-netback: prevent UAF in xenvif_flush_hash()
Aleksandr Mishin <[email protected]>
ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
Dmitry Kandybka <[email protected]>
wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
Jann Horn <[email protected]>
f2fs: Require FMODE_WRITE for atomic write ioctls
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
Hui Wang <[email protected]>
ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
Takashi Iwai <[email protected]>
ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
Oder Chiou <[email protected]>
ALSA: hda/realtek: Fix the push button function for the ALC257
Christophe JAILLET <[email protected]>
ALSA: mixer_oss: Remove some incorrect kfree_const() usages
Benjamin Gaignard <[email protected]>
media: usbtv: Remove useless locks in usbtv_video_free()
Robert Hancock <[email protected]>
i2c: xiic: Try re-initialization on bus busy timeout
Marc Ferland <[email protected]>
i2c: xiic: improve error message when transfer fails to start
Lars-Peter Clausen <[email protected]>
i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path
Marek Vasut <[email protected]>
i2c: xiic: Fix RX IRQ busy check
Marek Vasut <[email protected]>
i2c: xiic: Switch from waitqueue to completion
Marek Vasut <[email protected]>
i2c: xiic: Fix broken locking on tx_msg
Xin Long <[email protected]>
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
Eric Dumazet <[email protected]>
ppp: do not assume bh is held in ppp_channel_bridge_input()
Anton Danilov <[email protected]>
ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
Shenwei Wang <[email protected]>
net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
Kurt Kanzenbach <[email protected]>
net: stmmac: Disable automatic FCS/Pad stripping
Zekun Shen <[email protected]>
stmmac_pci: Fix underflow size in stmmac_rx
Eric Dumazet <[email protected]>
net: add more sanity checks to qdisc_pkt_len_init()
Eric Dumazet <[email protected]>
net: avoid potential underflow in qdisc_pkt_len_init() with UFO
Aleksander Jan Bajkowski <[email protected]>
net: ethernet: lantiq_etop: fix memory disclosure
Jinjie Ruan <[email protected]>
Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
Eric Dumazet <[email protected]>
netfilter: nf_tables: prevent nf_skb_duplicated corruption
Jinjie Ruan <[email protected]>
net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
Phil Sutter <[email protected]>
netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
Elena Salomatkina <[email protected]>
net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
Mohamed Khalfella <[email protected]>
net/mlx5: Added cond_resched() to crdump collection
Gerd Bayer <[email protected]>
net/mlx5: Fix error path in multi-packet WQE transmit
Jinjie Ruan <[email protected]>
ieee802154: Fix build error
Xiubo Li <[email protected]>
ceph: remove the incorrect Fw reference check when dirtying pages
Stefan Wahren <[email protected]>
mailbox: bcm2835: Fix timeout during suspend mode
Liao Chen <[email protected]>
mailbox: rockchip: fix a typo in module autoloading
Thomas Gleixner <[email protected]>
static_call: Replace pointless WARN_ON() in static_call_module_notify()
Thomas Gleixner <[email protected]>
static_call: Handle module init failure correctly in static_call_del_module()
Christophe JAILLET <[email protected]>
spi: lpspi: Simplify some error message
Harshit Mogalapalli <[email protected]>
usb: yurex: Fix inconsistent locking bug in yurex_read()
Andy Shevchenko <[email protected]>
i2c: isch: Add missed 'else'
Tommy Huang <[email protected]>
i2c: aspeed: Update the stop sw state when the bus recovery occurs
David Gow <[email protected]>
mm: only enforce minimum stack gap size if it's sensible
Zhiguo Niu <[email protected]>
lockdep: fix deadlock issue between lockdep and rcu
Song Liu <[email protected]>
bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0
Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not allow pinning outside of cpuset
Dmitry Vyukov <[email protected]>
x86/entry: Remove unwanted instrumentation in common_interrupt()
Xin Li <[email protected]>
x86/idtentry: Incorporate definitions/declarations of the FRED entries
Ma Ke <[email protected]>
pps: add an error check in parport_attach
Christophe JAILLET <[email protected]>
pps: remove usage of the deprecated ida_simple_xx() API
Pawel Laszczak <[email protected]>
usb: xhci: fix loss of data on Cadence xHC
Daehwan Jung <[email protected]>
xhci: Add a quirk for writing ERST in high-low order
Lukas Wunner <[email protected]>
xhci: Preserve RsvdP bits in ERSTBA register correctly
Mathias Nyman <[email protected]>
xhci: Refactor interrupter code for initial multi interrupter support.
Mathias Nyman <[email protected]>
xhci: remove xhci_test_trb_in_td_math early development check
Mathias Nyman <[email protected]>
xhci: fix event ring segment table related masks and variables in header
Oliver Neukum <[email protected]>
USB: misc: yurex: fix race between read and write
Lee Jones <[email protected]>
usb: yurex: Replace snprintf() with the safer scnprintf() variant
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix soc_dev leak during device remove
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix memory leak during device remove
VanGiang Nguyen <[email protected]>
padata: use integer wrap around to prevent deadlock on seq_nr overflow
Qiuxu Zhuo <[email protected]>
EDAC/igen6: Fix conversion of system address to physical memory address
Li Lingfeng <[email protected]>
nfs: fix memory leak in error path of nfs4_do_reclaim
Mickaël Salaün <[email protected]>
fs: Fix file_set_fowner LSM hook inconsistencies
Julian Sun <[email protected]>
vfs: fix race between evice_inodes() and find_inode()&iput()
Dragan Simic <[email protected]>
arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
Dragan Simic <[email protected]>
arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
Gaosheng Cui <[email protected]>
hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
Gaosheng Cui <[email protected]>
hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init
Guoqing Jiang <[email protected]>
hwrng: mtk - Use devm_pm_runtime_enable
Nikita Zhandarovich <[email protected]>
f2fs: avoid potential int overflow in sanity_check_area_boundary()
Nikita Zhandarovich <[email protected]>
f2fs: prevent possible int overflow in dir_block_index()
Zhen Lei <[email protected]>
debugobjects: Fix conditions in fill_pool()
Ma Ke <[email protected]>
wifi: mt76: mt7615: check devm_kasprintf() returned value
Bitterblue Smith <[email protected]>
wifi: rtw88: 8822c: Fix reported RX band width
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix sampling synchronization
Ard Biesheuvel <[email protected]>
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
Werner Sembach <[email protected]>
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
Thomas Weißschuh <[email protected]>
ACPI: sysfs: validate return type of _STR method
Mikhail Lobanov <[email protected]>
drbd: Add NULL check for net_conf to prevent dereference in state validation
Qiu-ji Chen <[email protected]>
drbd: Fix atomicity violation in drbd_uuid_set_bm()
Pavan Kumar Paluri <[email protected]>
crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
Mathias Nyman <[email protected]>
xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
Florian Fainelli <[email protected]>
tty: rp2: Fix reset with non forgiving PCIe host bridges
Jann Horn <[email protected]>
firmware_loader: Block path traversal
Krzysztof Kozlowski <[email protected]>
bus: integrator-lm: fix OF node leak in probe()
Tomas Marek <[email protected]>
usb: dwc2: drd: fix clock gating on USB role switch
Pawel Laszczak <[email protected]>
usb: cdnsp: Fix incorrect usb_request status
Oliver Neukum <[email protected]>
USB: class: CDC-ACM: fix race between get_serial and set_serial
Oliver Neukum <[email protected]>
USB: misc: cypress_cy7c63: check for short transfer
Oliver Neukum <[email protected]>
USB: appledisplay: close race between probe and completion handler
Oliver Neukum <[email protected]>
usbnet: fix cyclical race on disconnect with work queue
Finn Thain <[email protected]>
scsi: mac_scsi: Disallow bus errors during PDMA send
Finn Thain <[email protected]>
scsi: mac_scsi: Refactor polling loop
Finn Thain <[email protected]>
scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messages
Mario Limonciello <[email protected]>
drm/amd/display: Validate backlight caps are sane
Robin Chen <[email protected]>
drm/amd/display: Round calculated vtotal
Werner Sembach <[email protected]>
Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
Roman Smirnov <[email protected]>
Revert "media: tuners: fix error return code of hybrid_tuner_request_state()"
Krzysztof Kozlowski <[email protected]>
soc: versatile: integrator: fix OF node leak in probe() error path
Ma Ke <[email protected]>
ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
Laurent Pinchart <[email protected]>
Remove *.orig pattern from .gitignore
Scott Mayhew <[email protected]>
selinux,smack: don't bypass permissions check in inode_setsecctx hook
Ye Bin <[email protected]>
vfio/pci: fix potential memory leak in vfio_intx_enable()
Tony Luck <[email protected]>
x86/mm: Switch to new Intel CPU model defines
Sumeet Pawnikar <[email protected]>
powercap: RAPL: fix invalid initialization for pl4_supported field
Hans de Goede <[email protected]>
Input: goodix - use the new soc_intel_is_byt() helper
Fangzhi Zuo <[email protected]>
drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
Simon Horman <[email protected]>
netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
Phil Sutter <[email protected]>
netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
Jiwon Kim <[email protected]>
bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
Youssef Samir <[email protected]>
net: qrtr: Update packets cloning when broadcasting
Josh Hunt <[email protected]>
tcp: check skb is non-NULL in tcp_rto_delta_us()
Thomas Weißschuh <[email protected]>
net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
Kaixin Wang <[email protected]>
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
Eric Dumazet <[email protected]>
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
Sean Anderson <[email protected]>
net: xilinx: axienet: Fix packet counting
Robert Hancock <[email protected]>
net: axienet: Switch to 64-bit RX/TX statistics
Robert Hancock <[email protected]>
net: axienet: Use NAPI for TX completion path
Robert Hancock <[email protected]>
net: axienet: Be more careful about updating tx_bd_tail
Robert Hancock <[email protected]>
net: axienet: add coalesce timer ethtool configuration
Robert Hancock <[email protected]>
net: axienet: reduce default RX interrupt threshold to 1
Robert Hancock <[email protected]>
net: axienet: implement NAPI and GRO receive
Robert Hancock <[email protected]>
net: axienet: don't set IRQ timer when IRQ delay not used
Robert Hancock <[email protected]>
net: axienet: Clean up DMA start/stop and error handling
Robert Hancock <[email protected]>
net: axienet: Clean up device used for DMA calls
Mikulas Patocka <[email protected]>
Revert "dm: requeue IO if mapping table not yet available"
Jason Wang <[email protected]>
vhost_vdpa: assign irq bypass producer token correctly
Xie Yongji <[email protected]>
vdpa: Add eventfd for the vdpa callback
Konrad Dybcio <[email protected]>
interconnect: qcom: sm8250: Enable sync_state
Suzuki K Poulose <[email protected]>
coresight: tmc: sg: Do not leak sg_table
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix standby gpio state to match the documentation
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix oversampling gpio array
Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
Alexander Stein <[email protected]>
spi: lpspi: release requested DMA channels
Alexander Stein <[email protected]>
spi: lpspi: Silence error message upon deferred probe
Chao Yu <[email protected]>
f2fs: get rid of online repaire on corrupted directory
Chao Yu <[email protected]>
f2fs: clean up w/ dotdot_name
Chao Yu <[email protected]>
f2fs: introduce F2FS_IPU_HONOR_OPU_WRITE ipu policy
Chao Yu <[email protected]>
f2fs: fix to wait page writeback before setting gcing flag
Jack Qiu <[email protected]>
f2fs: optimize error handling in redirty_blocks
Chao Yu <[email protected]>
f2fs: reduce expensive checkpoint trigger frequency
Chao Yu <[email protected]>
f2fs: remove unneeded check condition in __f2fs_setxattr()
Chao Yu <[email protected]>
f2fs: fix to update i_ctime in __f2fs_setxattr()
Yonggil Song <[email protected]>
f2fs: fix typo
Li Lingfeng <[email protected]>
nfsd: return -EINVAL when namelen is 0
Guoqing Jiang <[email protected]>
nfsd: call cache_put if xdr_reserve_space returns NULL
Max Hawking <[email protected]>
ntb_perf: Fix printk format
Jinjie Ruan <[email protected]>
ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
Vitaliy Shevtsov <[email protected]>
RDMA/irdma: fix error message in irdma_modify_qp_roce()
Mikhail Lobanov <[email protected]>
RDMA/cxgb4: Added NULL check for lookup_atid
Jinjie Ruan <[email protected]>
riscv: Fix fp alignment bug in perf_callchain_user()
Junxian Huang <[email protected]>
RDMA/hns: Optimize hem allocation performance
Junxian Huang <[email protected]>
RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
Haoyue Xu <[email protected]>
RDMA/hns: Refactor the abnormal interrupt handler function
Haoyue Xu <[email protected]>
RDMA/hns: Fix the wrong type of return value of the interrupt handler
Haoyue Xu <[email protected]>
RDMA/hns: Remove unused abnormal interrupt of type RAS
Chengchang Tang <[email protected]>
RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
wenglianfa <[email protected]>
RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
Junxian Huang <[email protected]>
RDMA/hns: Don't modify rq next block addr in HIP09 QPC
Jonas Blixt <[email protected]>
watchdog: imx_sc_wdt: Don't disable WDT in suspend
Patrisious Haddad <[email protected]>
IB/core: Fix ib_cache_setup_one error flow cleanup
Wang Jianzheng <[email protected]>
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
Yangtao Li <[email protected]>
pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
Jeff Layton <[email protected]>
nfsd: fix refcount leak when file is unhashed after being found
Jeff Layton <[email protected]>
nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
David Lechner <[email protected]>
clk: ti: dra7-atl: Fix leak of of_nodes
Md Haris Iqbal <[email protected]>
RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
Jack Wang <[email protected]>
RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer
Yang Yingliang <[email protected]>
pinctrl: single: fix missing error code in pcs_probe()
Zhu Yanjun <[email protected]>
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Clean up clock on probe failure/removal
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix register misspelling
Dan Carpenter <[email protected]>
PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - add report id message validation
Emanuele Ghidoli <[email protected]>
Input: ilitek_ts_i2c - avoid wrong input subsystem sync
Jonas Karlman <[email protected]>
clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
Peng Fan <[email protected]>
remoteproc: imx_rproc: Initialize workqueue earlier
Peng Fan <[email protected]>
remoteproc: imx_rproc: Correct ddr alias for i.MX8M
Peng Fan <[email protected]>
clk: imx: imx8qxp: Parent should be initialized earlier than the clock
Peng Fan <[email protected]>
clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
Zhipeng Wang <[email protected]>
clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
Ian Rogers <[email protected]>
perf time-utils: Fix 32-bit nsec parsing
Yang Jihong <[email protected]>
perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
Yang Jihong <[email protected]>
perf sched timehist: Fix missing free of session in perf_sched__timehist()
Ian Rogers <[email protected]>
perf inject: Fix leader sampling inserting additional samples
Namhyung Kim <[email protected]>
perf tools: Support reading PERF_FORMAT_LOST
Ian Rogers <[email protected]>
perf evsel: Rename variable cpu to index
Ian Rogers <[email protected]>
perf evsel: Reduce scope of evsel__ignore_missing_thread
Madhavan Srinivasan <[email protected]>
perf test sample-parsing: Add endian test for struct branch_flags
Namhyung Kim <[email protected]>
perf mem: Free the allocated sort string, fixing a leak
Daniel Borkmann <[email protected]>
bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
Ryusuke Konishi <[email protected]>
nilfs2: fix potential oob read in nilfs_btree_check_delete()
Ryusuke Konishi <[email protected]>
nilfs2: determine empty node blocks as corrupted
Ryusuke Konishi <[email protected]>
nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: avoid OOB when system.data xattr changes underneath the filesystem
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: return error on ext4_find_inline_entry
Kemeng Shi <[email protected]>
ext4: avoid negative min_clusters in find_group_orlov()
Kemeng Shi <[email protected]>
ext4: avoid potential buffer_head leak in __ext4_new_inode()
Kemeng Shi <[email protected]>
ext4: avoid buffer_head leak in ext4_mark_inode_used()
Jiawei Ye <[email protected]>
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
yangerkun <[email protected]>
ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
Chen Yu <[email protected]>
kthread: fix task state in kthread worker if being frozen
Lasse Collin <[email protected]>
xz: cleanup CRC32 edits from 2018
Tony Ambardar <[email protected]>
selftests/bpf: Fix C++ compile error from missing _Bool type
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling test_lru_map.c
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling core_reloc.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling flow_dissector.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling kfree_skb.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
Jonathan McDowell <[email protected]>
tpm: Clean up TPM space after command failure
Juergen Gross <[email protected]>
xen/swiotlb: add alignment check for dma buffers
Juergen Gross <[email protected]>
xen: use correct end address of kernel for conflict checking
Yuesong Li <[email protected]>
drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
Sherry Yang <[email protected]>
drm/msm: fix %s null argument error
Wolfram Sang <[email protected]>
ipmi: docs: don't advertise deprecated sysfs entries
Vladimir Lypak <[email protected]>
drm/msm/a5xx: workaround early ring-buffer emptiness check
Rob Clark <[email protected]>
drm/msm: Drop priv->lastctx
Vladimir Lypak <[email protected]>
drm/msm/a5xx: fix races in preemption evaluation stage
Vladimir Lypak <[email protected]>
drm/msm/a5xx: properly clear preemption records on resume
Vladimir Lypak <[email protected]>
drm/msm/a5xx: disable preemption in submits by default
Aleksandr Mishin <[email protected]>
drm/msm: Fix incorrect file name output in adreno_request_fw()
Christophe Leroy <[email protected]>
powerpc/8xx: Fix kernel vs user address comparison
Christophe Leroy <[email protected]>
powerpc/8xx: Fix initial memory mapping
Christophe Leroy <[email protected]>
powerpc/32: Remove 'noltlbs' kernel parameter
Christophe Leroy <[email protected]>
powerpc/32: Remove the 'nobats' kernel parameter
Fei Shao <[email protected]>
drm/mediatek: Use spin_lock_irqsave() for CRTC event lock
Jeongjun Park <[email protected]>
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
Dan Carpenter <[email protected]>
scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
Liu Ying <[email protected]>
drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid()
Nikita Zhandarovich <[email protected]>
drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
Jonas Karlman <[email protected]>
drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
Alex Bee <[email protected]>
drm/rockchip: vop: Allow 4096px width scaling
Finn Thain <[email protected]>
scsi: NCR5380: Check for phase match during PDMA fixup
Finn Thain <[email protected]>
scsi: NCR5380: Add SCp members to struct NCR5380_cmd
Alex Deucher <[email protected]>
drm/radeon: properly handle vbios fake edid sizing
Paulo Miguel Almeida <[email protected]>
drm/radeon: Replace one-element array with flexible-array member
Alex Deucher <[email protected]>
drm/amdgpu: properly handle vbios fake edid sizing
Paulo Miguel Almeida <[email protected]>
drm/amdgpu: Replace one-element array with flexible-array member
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
Christophe JAILLET <[email protected]>
drm/stm: Fix an error handling path in stm_drm_platform_probe()
Geert Uytterhoeven <[email protected]>
pmdomain: core: Harden inter-column space in debug summary
Charles Han <[email protected]>
mtd: powernv: Add check devm_kasprintf() returned value
Christophe JAILLET <[email protected]>
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
Artur Weber <[email protected]>
power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
Chris Morgan <[email protected]>
power: supply: axp20x_battery: Remove design from min and max voltage
Yuntao Liu <[email protected]>
hwmon: (ntc_thermistor) fix module autoloading
Mirsad Todorovac <[email protected]>
mtd: slram: insert break after errors in parsing the map
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix alarm attributes
Andrew Davis <[email protected]>
hwmon: (max16065) Remove use of i2c_match_id()
Biju Das <[email protected]>
i2c: Add i2c_get_match_data()
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix overflows seen when writing limits
Finn Thain <[email protected]>
m68k: Fix kernel_clone_args.flags in m68k_clone()
Ankit Agrawal <[email protected]>
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
Krzysztof Kozlowski <[email protected]>
reset: k210: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
reset: berlin: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
ARM: versatile: fix OF node leak in CPUs prepare
Krzysztof Kozlowski <[email protected]>
ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
Alexander Dahl <[email protected]>
ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
Lad Prabhakar <[email protected]>
arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
Andy Shevchenko <[email protected]>
spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
Ma Ke <[email protected]>
spi: ppc4xx: handle irq_of_parse_and_map() errors
Riyan Dhiman <[email protected]>
block: fix potential invalid pointer dereference in blk_add_partition
Christian Heusel <[email protected]>
block: print symbolic error name instead of error code
Yu Kuai <[email protected]>
block, bfq: don't break merge chain in bfq_split_bfqq()
Yu Kuai <[email protected]>
block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
Yu Kuai <[email protected]>
block, bfq: fix possible UAF for bfqq->bic with merge chain
Su Hui <[email protected]>
net: tipc: avoid possible garbage value
Justin Iurman <[email protected]>
net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
Heiner Kallweit <[email protected]>
r8169: disable ALDPS per default for RTL8125
Jinjie Ruan <[email protected]>
net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header on xmit.
Gal Pressman <[email protected]>
geneve: Fix incorrect inner network header offset when innerprotoinherit is set
Eyal Birger <[email protected]>
net: geneve: support IPv4/IPv6 as inner protocol
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header in bareudp_udp_encap_recv().
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix not handling ZPL/short-transfer
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_close(): stop clocks after device has been shut down
Kuniyuki Iwashima <[email protected]>
can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
Eric Dumazet <[email protected]>
sock_map: Add a cond_resched() in sock_hash_free()
Jiawei Ye <[email protected]>
wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
Dmitry Antipov <[email protected]>
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
Howard Hsu <[email protected]>
wifi: mt76: mt7915: fix rx filter setting for bfee functionality
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
Aaron Lu <[email protected]>
x86/sgx: Fix deadlock in SGX NUMA node search
Nishanth Menon <[email protected]>
cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: remove annotation to access set timeout while holding lock
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject expiration higher than timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject element expiration with no timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
Clément Léger <[email protected]>
ACPI: CPPC: Fix MASK_VAL() usage
Rafael J. Wysocki <[email protected]>
ACPI: bus: Avoid using CPPC if not supported by firmware
Zhang Changzhong <[email protected]>
can: j1939: use correct function name in comment
Kamlesh Gurudasani <[email protected]>
padata: Honor the caller's alignment in case of chunk_size 0
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: increase the time between ranging measurements
Olaf Hering <[email protected]>
mount: handle OOM on mnt_warn_timestamp_expiry
Andy Shevchenko <[email protected]>
fs/namespace: fnic: Switch to use %ptTd
Anthony Iliopoulos <[email protected]>
mount: warn only once about timestamp range expiration
Christoph Hellwig <[email protected]>
fs: explicitly unregister per-superblock BDIs
Dmitry Kandybka <[email protected]>
wifi: rtw88: remove CPT execution branch never used
Yanteng Si <[email protected]>
net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k: Remove error checks when creating debugfs entries
Minjie Du <[email protected]>
wifi: ath9k: fix parameter check in ath9k_init_debug()
Aleksandr Mishin <[email protected]>
ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
Helge Deller <[email protected]>
crypto: xor - fix template benchmarking
Dmitry Antipov <[email protected]>
wifi: rtw88: always wait for both firmware loading attempts
Shubhrajyoti Datta <[email protected]>
EDAC/synopsys: Fix error injection on Zynq UltraScale+
Serge Semin <[email protected]>
EDAC/synopsys: Fix ECC status and IRQ control race condition
Sherry Sun <[email protected]>
EDAC/synopsys: Re-enable the error interrupts on v3 hw
Sherry Sun <[email protected]>
EDAC/synopsys: Use the correct register to disable the error interrupt on v3 hw
Dinh Nguyen <[email protected]>
EDAC/synopsys: Add support for version 3 of the Synopsys EDAC DDR
Edward Adam Davis <[email protected]>
USB: usbtmc: prevent kernel-usb-infoleak
Junhao Xie <[email protected]>
USB: serial: pl2303: add device id for Macrosilicon MS3020
Waiman Long <[email protected]>
cgroup: Move rcu_head up near the top of cgroup_root
Kent Gibson <[email protected]>
gpiolib: cdev: Ignore reconfiguration without direction
Florian Westphal <[email protected]>
inet: inet_defrag: prevent sk release while still in use
Hagar Hemdan <[email protected]>
gpio: prevent potential speculation leaks in gpio_device_get_desc()
Ping-Ke Shih <[email protected]>
Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex"
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: missing iterator type in lookup walk
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: walk over current view on netlink dump
Yafang Shao <[email protected]>
cgroup: Make operations on the cgroup root_list RCU safe
Ferry Meng <[email protected]>
ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
Ferry Meng <[email protected]>
ocfs2: add bounds checking to ocfs2_xattr_find_entry()
Geert Uytterhoeven <[email protected]>
spi: spidev: Add missing spi_device_id for jg10309-01
Michael Kelley <[email protected]>
x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
Liao Chen <[email protected]>
spi: bcm63xx: Enable module autoloading
hongchi.peng <[email protected]>
drm: komeda: Fix an issue related to normalized zpos
Fabio Estevam <[email protected]>
spi: spidev: Add an entry for elgin,jg10309-01
Liao Chen <[email protected]>
ASoC: tda7419: fix module autoloading
Liao Chen <[email protected]>
ASoC: intel: fix module autoloading
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: clear trans->state earlier upon error
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
Daniel Gabay <[email protected]>
wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
Benjamin Berg <[email protected]>
wifi: iwlwifi: lower message level for FW buffer destination
Jacky Chou <[email protected]>
net: ftgmac100: Ensure tx descriptor updates are visible
Mike Rapoport <[email protected]>
microblaze: don't treat zero reserved memory regions as error
Thomas Blocher <[email protected]>
pinctrl: at91: make it work with current gpiolib
Sherry Yang <[email protected]>
scsi: lpfc: Fix overflow build issue
Kailang Yang <[email protected]>
ALSA: hda/realtek - FIxed ALC285 headphone no sound
Kailang Yang <[email protected]>
ALSA: hda/realtek - Fixed ALC256 headphone no sound
Hongbo Li <[email protected]>
ASoC: allow module autoloading for table db1200_pids
Arseniy Krasnov <[email protected]>
ASoC: meson: axg-card: fix 'use-after-free'
T.J. Mercier <[email protected]>
dma-buf: heaps: Fix off-by-one in CMA heap fault handler
Krzysztof Kozlowski <[email protected]>
soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
Han Xu <[email protected]>
spi: nxp-fspi: fix the KASAN report out-of-bounds bug
Sean Anderson <[email protected]>
net: dpaa: Pad packets to ETH_ZLEN
Florian Westphal <[email protected]>
netfilter: nft_socket: fix sk refcount leaks
Jacky Chou <[email protected]>
net: ftgmac100: Enable TX interrupt to avoid TX timeout
Naveen Mamindlapalli <[email protected]>
octeontx2-af: Modify SMQ flush sequence to drop packets
Naveen Mamindlapalli <[email protected]>
octeontx2-af: Set XOFF on other child transmit schedulers during SMQ flush
Muhammad Usama Anjum <[email protected]>
fou: fix initialization of grc
Carolina Jubran <[email protected]>
net/mlx5: Add missing masks and QoS bit masks for scheduling elements
Jianbo Liu <[email protected]>
net/mlx5: Add IFC bits and enums for flow meter
Maor Gottlieb <[email protected]>
net/mlx5: Add support to create match definer
Carolina Jubran <[email protected]>
net/mlx5: Explicitly set scheduling element and TSAR type
Shahar Shitrit <[email protected]>
net/mlx5e: Add missing link modes to ptys2ethtool_map
Sriram Yagnaraman <[email protected]>
igb: Always call igb_xdp_ring_update_tail() under Tx lock
Jacob Keller <[email protected]>
ice: fix accounting for filters shared by multiple VSIs
Patryk Biel <[email protected]>
hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2
Mårten Lindahl <[email protected]>
hwmon: (pmbus) Introduce and use write_byte_data callback
Michal Luczaj <[email protected]>
selftests/bpf: Support SOCK_STREAM in unix_inet_redir_to_connected()
Andy Shevchenko <[email protected]>
eeprom: digsy_mtc: Fix 93xx46 driver probe failure
FUKAUMI Naoki <[email protected]>
arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E
Konstantin Komarov <[email protected]>
fs/ntfs3: Use kvfree to free memory allocated by kvmalloc
Linus Torvalds <[email protected]>
mm: avoid leaving partial pfn mappings around in error case
Willem de Bruijn <[email protected]>
net: tighten bad gso csum offset check in virtio_net_hdr
Lorenzo Stoakes <[email protected]>
minmax: reduce min/max macro expansion in atomisp driver
Quentin Schulz <[email protected]>
arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma
Edward Adam Davis <[email protected]>
mptcp: pm: Fix uaf in __timer_delete_sync
Hans de Goede <[email protected]>
platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array
Hans de Goede <[email protected]>
platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
Trond Myklebust <[email protected]>
NFS: Avoid unnecessary rescanning of the per-server delegation list
Trond Myklebust <[email protected]>
NFSv4: Fix clearing of layout segments in layoutreturn
Takashi Iwai <[email protected]>
Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
Rob Clark <[email protected]>
drm/msm/adreno: Fix error return if missing firmware-name
Maximilian Luz <[email protected]>
platform/surface: aggregator_registry: Add support for Surface Laptop Go 3
Anders Roxell <[email protected]>
scripts: kconfig: merge_config: config files: add a trailing newline
Dmitry Savin <[email protected]>
HID: multitouch: Add support for GT7868Q
Jonathan Denose <[email protected]>
Input: synaptics - enable SMBus for HP Elitebook 840 G2
Marek Vasut <[email protected]>
Input: ads7846 - ratelimit the spi_sync error message
Jeff Layton <[email protected]>
btrfs: update target inode's ctime on unlink
Christophe Leroy <[email protected]>
powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
Pawel Dembicki <[email protected]>
net: phy: vitesse: repair vsc73xx autonegotiation
Moon Yeounsu <[email protected]>
net: ethernet: use ip_hdrlen() instead of bit shift
Foster Snowhill <[email protected]>
usbnet: ipheth: fix carrier detection in modes 1 and 4
Lizhi Xu <[email protected]>
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
Julian Sun <[email protected]>
ocfs2: fix null-ptr-deref when journal load failed.
Lizhi Xu <[email protected]>
ocfs2: remove unreasonable unlock in ocfs2_read_blocks
Joseph Qi <[email protected]>
ocfs2: cancel dqi_sync_work before freeing oinfo
Gautham Ananthakrishna <[email protected]>
ocfs2: reserve space for inline xattr before attaching reflink tree
Joseph Qi <[email protected]>
ocfs2: fix uninit-value in ocfs2_get_block()
Heming Zhao <[email protected]>
ocfs2: fix the la space leak when unmounting an ocfs2 volume
Danilo Krummrich <[email protected]>
mm: krealloc: consider spare memory for __GFP_ZERO
Kemeng Shi <[email protected]>
jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
Baokun Li <[email protected]>
jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
Ma Ke <[email protected]>
drm: omapdrm: Add missing check for alloc_ordered_workqueue
Andrew Jones <[email protected]>
of/irq: Support #msi-cells=<0> in of_msi_get_domain
Helge Deller <[email protected]>
parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
Helge Deller <[email protected]>
parisc: Fix 64-bit userspace syscall path
-------------
Diffstat:
.gitignore | 1 - Documentation/ABI/testing/sysfs-fs-f2fs | 3 +- Documentation/admin-guide/kernel-parameters.txt | 16 +- Documentation/arm64/silicon-errata.rst | 4 + Documentation/driver-api/ipmi.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/imx7d-zii-rmu2.dts | 2 +- arch/arm/boot/dts/sam9x60.dtsi | 4 +- arch/arm/mach-realview/platsmp-dt.c | 1 + arch/arm64/Kconfig | 2 + arch/arm64/boot/dts/qcom/sm8250.dtsi | 20 +- arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 4 +- arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts | 2 +- .../boot/dts/rockchip/rk3399-pinebook-pro.dts | 4 +- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 23 +- arch/arm64/include/asm/cputype.h | 4 + arch/arm64/kernel/cpu_errata.c | 2 + arch/m68k/kernel/process.c | 2 +- arch/microblaze/mm/init.c | 5 - arch/parisc/kernel/entry.S | 6 +- arch/parisc/kernel/syscall.S | 14 +- arch/powerpc/kernel/head_8xx.S | 6 +- arch/powerpc/kernel/setup-common.c | 1 + arch/powerpc/mm/book3s32/mmu.c | 2 +- arch/powerpc/mm/init_32.c | 14 - arch/powerpc/mm/mem.c | 2 - arch/powerpc/mm/mmu_decl.h | 1 - arch/powerpc/mm/nohash/8xx.c | 13 +- arch/powerpc/platforms/83xx/misc.c | 14 +- arch/riscv/Kconfig | 5 + arch/riscv/kernel/perf_callchain.c | 2 +- arch/s390/include/asm/facility.h | 6 +- arch/s390/kernel/perf_cpum_sf.c | 12 +- arch/s390/mm/cmm.c | 18 +- arch/x86/events/intel/pt.c | 15 +- arch/x86/include/asm/fpu/xstate.h | 5 +- arch/x86/include/asm/hardirq.h | 8 +- arch/x86/include/asm/idtentry.h | 73 +- arch/x86/include/asm/syscall.h | 7 +- arch/x86/kernel/apic/io_apic.c | 46 +- arch/x86/kernel/cpu/mshyperv.c | 1 + arch/x86/kernel/cpu/sgx/main.c | 27 +- arch/x86/kernel/fpu/xstate.c | 7 + arch/x86/mm/init.c | 16 +- arch/x86/net/bpf_jit_comp.c | 54 +- arch/x86/xen/setup.c | 2 +- block/bfq-iosched.c | 44 +- block/blk-integrity.c | 175 +- block/blk-iocost.c | 8 +- block/blk.h | 10 +- block/genhd.c | 12 +- block/partitions/core.c | 8 +- crypto/xor.c | 31 +- drivers/acpi/acpi_pad.c | 6 +- drivers/acpi/acpica/dbconvert.c | 2 + drivers/acpi/acpica/exprep.c | 3 + drivers/acpi/acpica/psargs.c | 47 + drivers/acpi/battery.c | 28 +- drivers/acpi/bus.c | 8 + drivers/acpi/cppc_acpi.c | 46 +- drivers/acpi/device_sysfs.c | 5 +- drivers/acpi/ec.c | 55 +- drivers/acpi/pmic/tps68470_pmic.c | 6 +- drivers/acpi/resource.c | 20 + drivers/ata/sata_sil.c | 12 +- drivers/base/bus.c | 6 +- drivers/base/firmware_loader/main.c | 30 + drivers/base/power/domain.c | 2 +- drivers/base/property.c | 45 + drivers/block/aoe/aoecmd.c | 13 +- drivers/block/drbd/drbd_main.c | 8 +- drivers/block/drbd/drbd_state.c | 2 +- drivers/bluetooth/btmrvl_sdio.c | 3 +- drivers/bluetooth/btusb.c | 5 +- drivers/bus/arm-integrator-lm.c | 1 + drivers/char/hw_random/bcm2835-rng.c | 4 +- drivers/char/hw_random/cctrng.c | 1 + drivers/char/hw_random/mtk-rng.c | 2 +- drivers/char/tpm/tpm-dev-common.c | 2 + drivers/char/tpm/tpm2-space.c | 3 + drivers/char/virtio_console.c | 18 +- drivers/clk/bcm/clk-bcm53573-ilp.c | 2 +- drivers/clk/imx/clk-imx7d.c | 4 +- drivers/clk/imx/clk-imx8mp.c | 4 +- drivers/clk/imx/clk-imx8qxp.c | 10 +- drivers/clk/qcom/clk-rpmh.c | 2 + drivers/clk/qcom/dispcc-sm8250.c | 3 + drivers/clk/qcom/gcc-sc8180x.c | 88 +- drivers/clk/qcom/gcc-sm8250.c | 6 +- drivers/clk/rockchip/clk-rk3228.c | 2 +- drivers/clk/rockchip/clk.c | 3 +- drivers/clk/ti/clk-dra7-atl.c | 1 + drivers/clocksource/timer-qcom.c | 7 +- .../drivers/ni_routing/tools/convert_c_to_py.c | 5 + drivers/cpufreq/ti-cpufreq.c | 10 +- drivers/crypto/ccp/sev-dev.c | 2 + drivers/dma-buf/heaps/cma_heap.c | 2 +- drivers/edac/igen6_edac.c | 2 +- drivers/edac/synopsys_edac.c | 146 +- drivers/firmware/efi/libstub/tpm.c | 2 +- drivers/firmware/tegra/bpmp.c | 6 - drivers/gpio/gpio-aspeed.c | 4 +- drivers/gpio/gpio-davinci.c | 8 +- drivers/gpio/gpiolib-cdev.c | 13 +- drivers/gpio/gpiolib.c | 3 +- drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 26 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 22 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 + .../gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 + .../gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 4 + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +- .../dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 2 +- .../display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 2 +- .../drm/amd/display/modules/freesync/freesync.c | 2 +- drivers/gpu/drm/amd/include/atombios.h | 2 +- .../drm/amd/pm/powerplay/hwmgr/processpptables.c | 2 + drivers/gpu/drm/arm/display/komeda/komeda_kms.c | 10 +- drivers/gpu/drm/bridge/lontium-lt8912b.c | 35 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 +- drivers/gpu/drm/drm_crtc.c | 1 + drivers/gpu/drm/drm_print.c | 13 +- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 5 +- drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 3 +- drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 3 +- drivers/gpu/drm/msm/adreno/a4xx_gpu.c | 3 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 20 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 2 + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 30 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 9 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 10 - drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c | 2 +- drivers/gpu/drm/msm/msm_drv.c | 6 - drivers/gpu/drm/msm/msm_drv.h | 2 +- drivers/gpu/drm/msm/msm_gpu.c | 2 +- drivers/gpu/drm/msm/msm_gpu.h | 11 + drivers/gpu/drm/nouveau/nouveau_dmem.c | 2 +- drivers/gpu/drm/omapdrm/omap_drv.c | 5 + drivers/gpu/drm/radeon/atombios.h | 2 +- drivers/gpu/drm/radeon/evergreen_cs.c | 62 +- drivers/gpu/drm/radeon/r100.c | 70 +- drivers/gpu/drm/radeon/radeon_atombios.c | 26 +- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 113 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 3 + drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 25 +- drivers/gpu/drm/rockchip/rockchip_vop_reg.h | 1 + drivers/gpu/drm/scheduler/sched_entity.c | 2 + drivers/gpu/drm/stm/drv.c | 4 +- drivers/gpu/drm/v3d/v3d_perfmon.c | 9 +- drivers/hid/amd-sfh-hid/amd_sfh_client.c | 14 +- drivers/hid/hid-ids.h | 5 + drivers/hid/hid-multitouch.c | 39 + drivers/hid/hid-plantronics.c | 23 + drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 2 +- drivers/hwmon/Kconfig | 3 + drivers/hwmon/max16065.c | 27 +- drivers/hwmon/ntc_thermistor.c | 1 + drivers/hwmon/pmbus/pmbus.h | 8 + drivers/hwmon/pmbus/pmbus_core.c | 39 +- drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- drivers/i2c/busses/i2c-aspeed.c | 16 +- drivers/i2c/busses/i2c-i801.c | 9 +- drivers/i2c/busses/i2c-isch.c | 3 +- drivers/i2c/busses/i2c-qcom-geni.c | 4 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-xiic.c | 138 +- drivers/i2c/i2c-core-base.c | 60 +- drivers/i2c/i2c-core-smbus.c | 15 +- drivers/i2c/i2c-smbus.c | 5 +- drivers/iio/adc/ad7606.c | 8 +- drivers/iio/adc/ad7606_spi.c | 5 +- drivers/iio/magnetometer/ak8975.c | 32 +- drivers/infiniband/core/cache.c | 4 +- drivers/infiniband/core/iwcm.c | 2 +- drivers/infiniband/core/mad.c | 14 +- drivers/infiniband/hw/cxgb4/cm.c | 5 + drivers/infiniband/hw/hns/hns_roce_cq.c | 25 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 22 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 93 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 - drivers/infiniband/hw/hns/hns_roce_qp.c | 16 +- drivers/infiniband/hw/irdma/verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_comp.c | 6 +- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 9 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 14 +- drivers/input/keyboard/adp5589-keys.c | 22 +- drivers/input/mouse/synaptics.c | 1 + drivers/input/rmi4/rmi_driver.c | 6 +- drivers/input/serio/i8042-acpipnpio.h | 46 + drivers/input/touchscreen/ads7846.c | 2 +- drivers/input/touchscreen/goodix.c | 18 +- drivers/input/touchscreen/ilitek_ts_i2c.c | 18 +- drivers/interconnect/qcom/sm8250.c | 1 + drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 7 + drivers/iommu/intel/dmar.c | 16 +- drivers/iommu/intel/iommu.c | 6 +- drivers/mailbox/bcm2835-mailbox.c | 3 +- drivers/mailbox/rockchip-mailbox.c | 2 +- drivers/md/dm-rq.c | 4 +- drivers/md/dm.c | 11 +- drivers/media/common/videobuf2/videobuf2-core.c | 8 +- drivers/media/dvb-frontends/rtl2830.c | 2 +- drivers/media/dvb-frontends/rtl2832.c | 2 +- drivers/media/i2c/imx335.c | 43 +- drivers/media/platform/qcom/venus/core.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c | 5 + drivers/media/tuners/tuner-i2c.h | 4 +- drivers/media/usb/usbtv/usbtv-video.c | 7 - drivers/misc/eeprom/digsy_mtc_eeprom.c | 2 +- drivers/mtd/devices/powernv_flash.c | 3 + drivers/mtd/devices/slram.c | 2 + drivers/net/bareudp.c | 26 +- drivers/net/bonding/bond_main.c | 6 +- drivers/net/can/m_can/m_can.c | 2 +- drivers/net/dsa/b53/b53_common.c | 17 +- drivers/net/dsa/lan9303-core.c | 29 + .../net/ethernet/aquantia/atlantic/aq_ethtool.c | 4 +- drivers/net/ethernet/cortina/gemini.c | 15 +- drivers/net/ethernet/faraday/ftgmac100.c | 26 +- drivers/net/ethernet/faraday/ftgmac100.h | 2 +- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 +- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +- drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + drivers/net/ethernet/ibm/emac/mal.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 + drivers/net/ethernet/intel/ice/ice_main.c | 3 +- drivers/net/ethernet/intel/ice/ice_sched.c | 6 +- drivers/net/ethernet/intel/ice/ice_switch.c | 4 +- drivers/net/ethernet/intel/igb/igb_main.c | 21 +- drivers/net/ethernet/jme.c | 10 +- drivers/net/ethernet/lantiq_etop.c | 4 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 15 + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 177 +- drivers/net/ethernet/mellanox/mlx5/core/en/tir.c | 3 + .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c | 7 + drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c | 57 + drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h | 4 + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 46 + drivers/net/ethernet/mellanox/mlx5/core/fs_core.h | 5 + .../net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c | 10 + .../ethernet/mellanox/mlx5/core/steering/fs_dr.c | 15 + .../net/ethernet/mellanox/mlxsw/spectrum_span.c | 2 +- .../net/ethernet/netronome/nfp/nfp_net_common.c | 5 +- drivers/net/ethernet/realtek/r8169_main.c | 31 +- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 + drivers/net/ethernet/seeq/ether3.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 + drivers/net/ethernet/stmicro/stmmac/dwmac100.h | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac1000.h | 2 +- .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 9 - .../net/ethernet/stmicro/stmmac/dwmac100_core.c | 8 - drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 19 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 33 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + drivers/net/ethernet/xilinx/xilinx_axienet.h | 78 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 596 +- drivers/net/geneve.c | 91 +- drivers/net/ieee802154/Kconfig | 1 + drivers/net/ieee802154/mcr20a.c | 5 +- drivers/net/phy/bcm84881.c | 4 +- drivers/net/phy/dp83869.c | 1 - drivers/net/phy/vitesse.c | 14 - drivers/net/ppp/ppp_async.c | 2 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/slip/slhc.c | 57 +- drivers/net/usb/ipheth.c | 5 +- drivers/net/usb/usbnet.c | 37 +- drivers/net/vrf.c | 13 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- drivers/net/wireless/ath/ath9k/debug.c | 6 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 +- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 - drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/constants.h | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 23 +- .../wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 3 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/scan.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7615/init.c | 3 + drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +- drivers/net/wireless/realtek/rtw88/Kconfig | 1 + drivers/net/wireless/realtek/rtw88/coex.c | 38 +- drivers/net/wireless/realtek/rtw88/main.c | 7 +- drivers/net/wireless/realtek/rtw88/rtw8822c.c | 12 +- drivers/net/xen-netback/hash.c | 5 +- drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + drivers/ntb/test/ntb_perf.c | 2 +- drivers/nvdimm/nd_virtio.c | 9 + drivers/nvme/host/nvme.h | 5 + drivers/nvme/host/pci.c | 18 +- drivers/of/irq.c | 38 +- drivers/pci/controller/dwc/pci-keystone.c | 2 +- drivers/pci/controller/pcie-xilinx-nwl.c | 39 +- drivers/pci/quirks.c | 8 + drivers/pinctrl/mvebu/pinctrl-dove.c | 45 +- drivers/pinctrl/pinctrl-at91.c | 5 +- drivers/pinctrl/pinctrl-single.c | 3 +- .../platform/surface/surface_aggregator_registry.c | 3 + .../x86/intel/speed_select_if/isst_if_common.c | 4 +- drivers/platform/x86/panasonic-laptop.c | 58 +- drivers/platform/x86/touchscreen_dmi.c | 26 + drivers/power/reset/brcmstb-reboot.c | 3 - drivers/power/supply/axp20x_battery.c | 16 +- drivers/power/supply/max17042_battery.c | 5 +- drivers/power/supply/power_supply_hwmon.c | 3 +- drivers/powercap/intel_rapl_msr.c | 6 +- drivers/pps/clients/pps_parport.c | 14 +- drivers/remoteproc/imx_rproc.c | 19 +- drivers/reset/reset-berlin.c | 3 +- drivers/reset/reset-k210.c | 3 +- drivers/rtc/rtc-at91sam9.c | 1 + drivers/scsi/NCR5380.c | 170 +- drivers/scsi/NCR5380.h | 11 + drivers/scsi/aacraid/aacraid.h | 2 +- drivers/scsi/atari_scsi.c | 4 +- drivers/scsi/elx/libefc/efc_nport.c | 2 +- drivers/scsi/g_NCR5380.c | 4 +- drivers/scsi/lpfc/lpfc_bsg.c | 2 +- drivers/scsi/mac_scsi.c | 173 +- drivers/scsi/smartpqi/smartpqi_init.c | 2 +- drivers/scsi/sun3_scsi.c | 2 +- drivers/soc/versatile/soc-integrator.c | 1 + drivers/soc/versatile/soc-realview.c | 20 +- drivers/soundwire/stream.c | 8 +- drivers/spi/spi-bcm63xx.c | 10 +- drivers/spi/spi-fsl-lpspi.c | 9 +- drivers/spi/spi-imx.c | 2 +- drivers/spi/spi-nxp-fspi.c | 5 +- drivers/spi/spi-ppc4xx.c | 7 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spidev.c | 2 + drivers/staging/media/atomisp/pci/sh_css_frac.h | 26 +- .../int340x_thermal/processor_thermal_device_pci.c | 23 +- drivers/tty/serial/rp2.c | 2 +- drivers/usb/cdns3/cdnsp-ring.c | 6 +- drivers/usb/cdns3/host.c | 4 +- drivers/usb/chipidea/udc.c | 8 +- drivers/usb/class/cdc-acm.c | 2 + drivers/usb/class/usbtmc.c | 2 +- drivers/usb/dwc2/drd.c | 9 + drivers/usb/dwc2/platform.c | 26 +- drivers/usb/dwc3/core.c | 22 +- drivers/usb/dwc3/core.h | 4 - drivers/usb/dwc3/gadget.c | 11 - drivers/usb/host/xhci-debugfs.c | 2 +- drivers/usb/host/xhci-mem.c | 331 +- drivers/usb/host/xhci-pci.c | 22 +- drivers/usb/host/xhci-ring.c | 82 +- drivers/usb/host/xhci.c | 54 +- drivers/usb/host/xhci.h | 32 +- drivers/usb/misc/appledisplay.c | 15 +- drivers/usb/misc/cypress_cy7c63.c | 4 + drivers/usb/misc/yurex.c | 5 +- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 4 + drivers/usb/storage/unusual_devs.h | 11 + drivers/usb/typec/tcpm/tcpm.c | 28 +- drivers/vfio/pci/vfio_pci_intrs.c | 4 +- drivers/vhost/scsi.c | 25 +- drivers/vhost/vdpa.c | 18 +- drivers/video/fbdev/hpfb.c | 1 + drivers/video/fbdev/pxafb.c | 1 + drivers/video/fbdev/sis/sis_main.c | 2 +- drivers/virtio/virtio_vdpa.c | 1 + drivers/watchdog/imx_sc_wdt.c | 24 - drivers/xen/swiotlb-xen.c | 6 + fs/9p/vfs_dentry.c | 9 +- fs/btrfs/disk-io.c | 11 + fs/btrfs/inode.c | 1 + fs/btrfs/relocation.c | 2 +- fs/ceph/addr.c | 1 - fs/exec.c | 3 +- fs/exfat/balloc.c | 10 +- fs/ext4/dir.c | 14 +- fs/ext4/extents.c | 57 +- fs/ext4/fast_commit.c | 34 +- fs/ext4/file.c | 155 +- fs/ext4/ialloc.c | 14 +- fs/ext4/inline.c | 35 +- fs/ext4/inode.c | 11 +- fs/ext4/mballoc.c | 10 +- fs/ext4/migrate.c | 2 +- fs/ext4/move_extent.c | 1 - fs/ext4/namei.c | 14 +- fs/ext4/super.c | 9 +- fs/ext4/xattr.c | 7 +- fs/f2fs/data.c | 18 +- fs/f2fs/dir.c | 3 +- fs/f2fs/f2fs.h | 18 +- fs/f2fs/file.c | 48 +- fs/f2fs/namei.c | 69 - fs/f2fs/segment.h | 5 +- fs/f2fs/super.c | 7 +- fs/f2fs/xattr.c | 18 +- fs/fcntl.c | 14 +- fs/file.c | 93 +- fs/inode.c | 4 + fs/jbd2/checkpoint.c | 21 +- fs/jbd2/journal.c | 4 +- fs/jfs/jfs_discard.c | 11 +- fs/jfs/jfs_dmap.c | 11 +- fs/jfs/jfs_imap.c | 2 +- fs/jfs/xattr.c | 2 + fs/namespace.c | 23 +- fs/nfs/callback_xdr.c | 2 + fs/nfs/client.c | 1 + fs/nfs/delegation.c | 15 +- fs/nfs/nfs42proc.c | 2 +- fs/nfs/nfs4proc.c | 9 +- fs/nfs/nfs4state.c | 3 +- fs/nfs/pnfs.c | 5 +- fs/nfsd/filecache.c | 7 +- fs/nfsd/nfs4idmap.c | 13 +- fs/nfsd/nfs4recover.c | 8 + fs/nfsd/nfs4state.c | 5 +- fs/nfsd/nfs4xdr.c | 10 +- fs/nfsd/vfs.c | 1 + fs/nilfs2/btree.c | 12 +- fs/ntfs3/attrlist.c | 4 +- fs/ntfs3/bitmap.c | 4 +- fs/ntfs3/frecord.c | 4 +- fs/ntfs3/fslog.c | 19 +- fs/ntfs3/super.c | 2 +- fs/ocfs2/aops.c | 5 +- fs/ocfs2/buffer_head_io.c | 4 +- fs/ocfs2/journal.c | 7 +- fs/ocfs2/localalloc.c | 19 + fs/ocfs2/quota_local.c | 8 +- fs/ocfs2/refcounttree.c | 26 +- fs/ocfs2/xattr.c | 38 +- fs/proc/base.c | 61 +- fs/super.c | 3 + fs/unicode/mkutf8data.c | 70 - fs/unicode/utf8data.h_shipped | 6703 ++++++++++---------- include/acpi/cppc_acpi.h | 2 + include/drm/drm_print.h | 54 +- include/dt-bindings/clock/qcom,gcc-sc8180x.h | 3 + include/linux/acpi.h | 1 + include/linux/cgroup-defs.h | 7 +- include/linux/f2fs_fs.h | 2 +- include/linux/fdtable.h | 8 +- include/linux/fs.h | 2 + include/linux/genhd.h | 3 - include/linux/i2c-smbus.h | 6 +- include/linux/i2c.h | 7 + include/linux/mlx5/device.h | 1 + include/linux/mlx5/fs.h | 8 + include/linux/mlx5/mlx5_ifc.h | 392 +- include/linux/nfs_fs_sb.h | 1 + include/linux/pci_ids.h | 2 + include/linux/property.h | 3 + include/linux/skbuff.h | 7 +- include/linux/usb/usbnet.h | 15 + include/linux/vdpa.h | 6 + include/linux/virtio_net.h | 3 +- include/net/flow.h | 6 +- include/net/ip_tunnels.h | 16 +- include/net/mctp.h | 2 +- include/net/netfilter/nf_tables.h | 13 + include/net/rtnetlink.h | 24 + include/net/sch_generic.h | 1 - include/net/sock.h | 2 + include/net/tcp.h | 21 +- include/trace/events/f2fs.h | 3 +- include/uapi/linux/cec.h | 6 +- include/uapi/linux/if_link.h | 1 + include/uapi/linux/netfilter/nf_tables.h | 2 +- io_uring/io_uring.c | 5 +- kernel/bpf/arraymap.c | 3 + kernel/bpf/hashtab.c | 3 + kernel/bpf/helpers.c | 4 +- kernel/cgroup/cgroup-internal.h | 3 +- kernel/cgroup/cgroup.c | 14 +- kernel/events/core.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/fork.c | 30 +- kernel/kthread.c | 12 +- kernel/locking/lockdep.c | 50 +- kernel/padata.c | 6 +- kernel/rcu/rcuscale.c | 4 +- kernel/resource.c | 58 +- kernel/signal.c | 11 +- kernel/static_call_inline.c | 13 +- kernel/trace/trace.c | 18 +- kernel/trace/trace_hwlat.c | 2 + kernel/trace/trace_osnoise.c | 2 + kernel/trace/trace_output.c | 6 +- lib/buildid.c | 88 +- lib/debugobjects.c | 5 +- lib/xz/xz_crc32.c | 2 +- lib/xz/xz_private.h | 4 - mm/memory.c | 27 +- mm/slab_common.c | 7 + mm/util.c | 2 +- net/bluetooth/rfcomm/sock.c | 2 - net/bridge/br_netfilter_hooks.c | 5 + net/can/bcm.c | 4 +- net/can/j1939/transport.c | 8 +- net/core/dev.c | 12 +- net/core/rtnetlink.c | 35 +- net/core/sock_map.c | 1 + net/ipv4/devinet.c | 6 +- net/ipv4/fib_frontend.c | 9 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/fib_trie.c | 7 +- net/ipv4/fou.c | 4 +- net/ipv4/inet_fragment.c | 70 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_gre.c | 10 +- net/ipv4/ip_tunnel.c | 9 +- net/ipv4/netfilter/ipt_rpfilter.c | 3 +- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +- net/ipv4/netfilter/nft_fib_ipv4.c | 5 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_input.c | 31 +- net/ipv4/tcp_ipv4.c | 3 + net/ipv4/xfrm4_policy.c | 4 +- net/ipv6/Kconfig | 1 + net/ipv6/ip6_output.c | 3 +- net/ipv6/netfilter/ip6t_rpfilter.c | 6 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +- net/ipv6/netfilter/nf_reject_ipv6.c | 14 +- net/ipv6/netfilter/nft_fib_ipv6.c | 8 +- net/ipv6/route.c | 12 - net/ipv6/rpl_iptunnel.c | 12 +- net/ipv6/seg6_local.c | 1 + net/ipv6/xfrm6_policy.c | 3 +- net/l3mdev/l3mdev.c | 43 +- net/mac80211/iface.c | 17 +- net/mctp/af_mctp.c | 6 +- net/mctp/device.c | 32 +- net/mctp/neigh.c | 29 +- net/mctp/route.c | 33 +- net/mptcp/pm_netlink.c | 16 +- net/netfilter/nf_conntrack_netlink.c | 7 +- net/netfilter/nf_tables_api.c | 19 +- net/netfilter/nft_lookup.c | 1 + net/netfilter/nft_set_pipapo.c | 6 +- net/netfilter/nft_socket.c | 7 +- net/netfilter/xt_CHECKSUM.c | 33 +- net/netfilter/xt_CLASSIFY.c | 16 +- net/netfilter/xt_CONNSECMARK.c | 36 +- net/netfilter/xt_CT.c | 148 +- net/netfilter/xt_IDLETIMER.c | 59 +- net/netfilter/xt_LED.c | 39 +- net/netfilter/xt_NFLOG.c | 36 +- net/netfilter/xt_RATEEST.c | 39 +- net/netfilter/xt_SECMARK.c | 27 +- net/netfilter/xt_TRACE.c | 35 +- net/netfilter/xt_addrtype.c | 15 +- net/netfilter/xt_cluster.c | 33 +- net/netfilter/xt_connbytes.c | 4 +- net/netfilter/xt_connlimit.c | 39 +- net/netfilter/xt_connmark.c | 28 +- net/netfilter/xt_mark.c | 42 +- net/netlink/af_netlink.c | 3 +- net/qrtr/af_qrtr.c | 2 +- net/sched/sch_api.c | 7 +- net/sched/sch_taprio.c | 4 +- net/sctp/socket.c | 20 +- net/socket.c | 7 +- net/tipc/bcast.c | 2 +- net/tipc/bearer.c | 8 +- net/wireless/core.h | 8 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 6 +- net/wireless/sme.c | 3 +- net/xfrm/xfrm_policy.c | 4 +- scripts/kconfig/merge_config.sh | 2 + scripts/kconfig/qconf.cc | 2 +- security/Kconfig | 32 + security/bpf/hooks.c | 1 - security/selinux/hooks.c | 4 +- security/smack/smack_lsm.c | 4 +- security/smack/smackfs.c | 2 +- security/tomoyo/domain.c | 9 +- sound/core/init.c | 14 +- sound/core/oss/mixer_oss.c | 4 +- sound/pci/asihpi/hpimsgx.c | 2 +- sound/pci/hda/hda_generic.c | 4 +- sound/pci/hda/hda_intel.c | 2 +- sound/pci/hda/patch_conexant.c | 24 +- sound/pci/hda/patch_realtek.c | 78 +- sound/pci/rme9652/hdsp.c | 6 +- sound/pci/rme9652/hdspm.c | 6 +- sound/soc/au1x/db1200.c | 1 + sound/soc/codecs/rt5682.c | 4 +- sound/soc/codecs/tda7419.c | 1 + sound/soc/fsl/imx-card.c | 1 + sound/soc/intel/keembay/kmb_platform.c | 1 + sound/soc/meson/axg-card.c | 3 +- sound/usb/card.c | 6 + sound/usb/line6/podhd.c | 2 +- sound/usb/mixer.c | 35 +- sound/usb/mixer.h | 1 + sound/usb/pcm.c | 3 +- sound/usb/quirks-table.h | 77 + sound/usb/quirks.c | 4 + tools/arch/x86/kcpuid/kcpuid.c | 12 +- tools/iio/iio_generic_buffer.c | 4 + tools/perf/builtin-inject.c | 1 + tools/perf/builtin-mem.c | 1 + tools/perf/builtin-sched.c | 8 +- tools/perf/tests/sample-parsing.c | 57 +- tools/perf/util/event.h | 21 +- tools/perf/util/evsel.c | 112 +- tools/perf/util/evsel.h | 10 +- tools/perf/util/hist.c | 7 +- .../util/scripting-engines/trace-event-python.c | 19 +- tools/perf/util/session.c | 38 +- tools/perf/util/stat.c | 4 +- tools/perf/util/stat.h | 2 +- tools/perf/util/synthetic-events.c | 32 +- tools/perf/util/time-utils.c | 4 +- tools/perf/util/tool.h | 1 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/bpf/bench.c | 1 + .../selftests/bpf/map_tests/sk_storage_map.c | 2 +- .../selftests/bpf/prog_tests/bpf_iter_setsockopt.c | 2 +- .../testing/selftests/bpf/prog_tests/core_reloc.c | 1 + .../selftests/bpf/prog_tests/flow_dissector.c | 1 + tools/testing/selftests/bpf/prog_tests/kfree_skb.c | 1 + .../selftests/bpf/prog_tests/sockmap_listen.c | 3 +- tools/testing/selftests/bpf/prog_tests/tcp_rtt.c | 1 + .../testing/selftests/bpf/progs/cg_storage_multi.h | 2 - tools/testing/selftests/bpf/test_cpp.cpp | 4 + tools/testing/selftests/bpf/test_lru_map.c | 3 +- .../breakpoints/step_after_suspend_test.c | 5 +- tools/testing/selftests/net/fcnal-test.sh | 2 +- tools/testing/selftests/net/net_helper.sh | 25 + tools/testing/selftests/net/setup_loopback.sh | 0 tools/testing/selftests/net/udpgro.sh | 13 +- tools/testing/selftests/net/udpgro_bench.sh | 5 +- tools/testing/selftests/vDSO/parse_vdso.c | 17 +- tools/testing/selftests/vDSO/vdso_config.h | 10 +- .../testing/selftests/vDSO/vdso_test_correctness.c | 6 + .../selftests/vm/charge_reserved_hugetlb.sh | 2 +- tools/testing/selftests/vm/write_to_hugetlbfs.c | 23 +- 656 files changed, 10222 insertions(+), 6971 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/691 parisc: Fix 64-bit userspace syscall path
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit d24449864da5838936669618356b0e30ca2999c3 upstream.
Currently the glibc isn't yet ported to 64-bit for hppa, so there is no usable userspace available yet.
But it's possible to manually build a static 64-bit binary and run that for testing. One such 64-bit test program is available at http://ftp.parisc-linux.org/src/64bit.tar.gz
and it shows various issues with the existing 64-bit syscall path in the kernel.
This patch fixes those issues.
--- arch/parisc/kernel/syscall.S | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
arch/parisc/kernel/syscall.S +8 -6
@@ -217,10 +217,10 @@ linux_gateway_entry: #ifdef CONFIG_64BIT ldil L%sys_call_table, %r1 - or,= %r2,%r2,%r2 - addil L%(sys_call_table64-sys_call_table), %r1 + or,ev %r2,%r2,%r2 + ldil L%sys_call_table64, %r1 ldo R%sys_call_table(%r1), %r19 - or,= %r2,%r2,%r2 + or,ev %r2,%r2,%r2 ldo R%sys_call_table64(%r1), %r19 #else load32 sys_call_table, %r19
@@ -355,10 +355,10 @@ tracesys_next: extrd,u %r19,63,1,%r2 /* W hidden in bottom bit */ ldil L%sys_call_table, %r1 - or,= %r2,%r2,%r2 - addil L%(sys_call_table64-sys_call_table), %r1 + or,ev %r2,%r2,%r2 + ldil L%sys_call_table64, %r1 ldo R%sys_call_table(%r1), %r19 - or,= %r2,%r2,%r2 + or,ev %r2,%r2,%r2 ldo R%sys_call_table64(%r1), %r19 #else load32 sys_call_table, %r19
@@ -932,6 +932,8 @@ ENTRY(sys_call_table) END(sys_call_table) #ifdef CONFIG_64BIT +#undef __SYSCALL_WITH_COMPAT +#define __SYSCALL_WITH_COMPAT(nr, native, compat) __SYSCALL(nr, native) .align 8 ENTRY(sys_call_table64) #include <asm/syscall_table_64.h> /* 64-bit syscalls */
Greg Kroah-Hartman
maintainerPATCH 2/691 parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit f31b256994acec6929306dfa86ac29716e7503d6 upstream.
Fix the stack start address calculation for the parisc architecture in setup_arg_pages() when address randomization is disabled. When the ADDR_NO_RANDOMIZE process personality is disabled there is no need to add additional space for the stack.
Note that this patch touches code inside an #ifdef CONFIG_STACK_GROWSUP hunk, which is why only the parisc architecture is affected since it's the only Linux architecture where the stack grows upwards.
Without this patch you will find the stack in the middle of some mapped libaries and suddenly limited to 6MB instead of 8MB:
root@parisc:~# setarch -R /bin/bash -c "cat /proc/self/maps" 00010000-00019000 r-xp 00000000 08:05 1182034 /usr/bin/cat 00019000-0001a000 rwxp 00009000 08:05 1182034 /usr/bin/cat 0001a000-0003b000 rwxp 00000000 00:00 0 [heap] f90c4000-f9283000 r-xp 00000000 08:05 1573004 /usr/lib/hppa-linux-gnu/libc.so.6 f9283000-f9285000 r--p 001bf000 08:05 1573004 /usr/lib/hppa-linux-gnu/libc.so.6 f9285000-f928a000 rwxp 001c1000 08:05 1573004 /usr/lib/hppa-linux-gnu/libc.so.6 f928a000-f9294000 rwxp 00000000 00:00 0 f9301000-f9323000 rwxp 00000000 00:00 0 [stack] f98b4000-f98e4000 r-xp 00000000 08:05 1572869 /usr/lib/hppa-linux-gnu/ld.so.1 f98e4000-f98e5000 r--p 00030000 08:05 1572869 /usr/lib/hppa-linux-gnu/ld.so.1 f98e5000-f98e9000 rwxp 00031000 08:05 1572869 /usr/lib/hppa-linux-gnu/ld.so.1 f9ad8000-f9b00000 rw-p 00000000 00:00 0 f9b00000-f9b01000 r-xp 00000000 00:00 0 [vdso]
With the patch the stack gets correctly mapped at the end of the process memory map:
root@panama:~# setarch -R /bin/bash -c "cat /proc/self/maps" 00010000-00019000 r-xp 00000000 08:13 16385582 /usr/bin/cat 00019000-0001a000 rwxp 00009000 08:13 16385582 /usr/bin/cat 0001a000-0003b000 rwxp 00000000 00:00 0 [heap] fef29000-ff0eb000 r-xp 00000000 08:13 16122400 /usr/lib/hppa-linux-gnu/libc.so.6 ff0eb000-ff0ed000 r--p 001c2000 08:13 16122400 /usr/lib/hppa-linux-gnu/libc.so.6 ff0ed000-ff0f2000 rwxp 001c4000 08:13 16122400 /usr/lib/hppa-linux-gnu/libc.so.6 ff0f2000-ff0fc000 rwxp 00000000 00:00 0 ff4b4000-ff4e4000 r-xp 00000000 08:13 16121913 /usr/lib/hppa-linux-gnu/ld.so.1 ff4e4000-ff4e6000 r--p 00030000 08:13 16121913 /usr/lib/hppa-linux-gnu/ld.so.1 ff4e6000-ff4ea000 rwxp 00032000 08:13 16121913 /usr/lib/hppa-linux-gnu/ld.so.1 ff6d7000-ff6ff000 rw-p 00000000 00:00 0 ff6ff000-ff700000 r-xp 00000000 00:00 0 [vdso] ff700000-ff722000 rwxp 00000000 00:00 0 [stack]
--- fs/exec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/exec.c +2 -1
@@ -766,7 +766,8 @@ int setup_arg_pages(struct linux_binprm stack_base =calc_max_stack_size (stack_base);/* Add space for stack randomization. */ - stack_base += (STACK_RND_MASK <<PAGE_SHIFT ); +if (current->flags &PF_RANDOMIZE ) + stack_base += (STACK_RND_MASK <<PAGE_SHIFT );/* Make sure we didn't let the argument array grow too large. */ if (vma->vm_end - vma->vm_start > stack_base)
Greg Kroah-Hartman
maintainerPATCH 3/691 of/irq: Support #msi-cells=<0> in of_msi_get_domain
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Jones <[email protected]>
commit db8e81132cf051843c9a59b46fa5a071c45baeb3 upstream.
An 'msi-parent' property with a single entry and no accompanying '#msi-cells' property is considered the legacy definition as opposed to its definition after being expanded with commit 126b16e2ad98 ("Docs: dt: add generic MSI bindings"). However, the legacy definition is completely compatible with the current definition and, since of_phandle_iterator_next() tolerates missing and present-but- zero *cells properties since commit e42ee61017f5 ("of: Let of_for_each_phandle fallback to non-negative cell_count"), there's no need anymore to special case the legacy definition in of_msi_get_domain().
Indeed, special casing has turned out to be harmful, because, as of commit 7c025238b47a ("dt-bindings: irqchip: Describe the IMX MU block as a MSI controller"), MSI controller DT bindings have started specifying '#msi-cells' as a required property (even when the value must be zero) as an effort to make the bindings more explicit. But, since the special casing of 'msi-parent' only uses the existence of '#msi-cells' for its heuristic, and not whether or not it's also nonzero, the legacy path is not taken. Furthermore, the path to support the new, broader definition isn't taken either since that path has been restricted to the platform-msi bus.
But, neither the definition of 'msi-parent' nor the definition of '#msi-cells' is platform-msi-specific (the platform-msi bus was just the first bus that needed '#msi-cells'), so remove both the special casing and the restriction. The code removal also requires changing to of_parse_phandle_with_optional_args() in order to ensure the legacy (but compatible) use of 'msi-parent' remains supported. This not only simplifies the code but also resolves an issue with PCI devices finding their MSI controllers on riscv, as the riscv,imsics binding requires '#msi-cells=<0>'.
--- drivers/of/irq.c | 34 +++++++--------------------------- 1 file changed, 7 insertions(+), 27 deletions(-)
drivers/of/irq.c +7 -27
@@ -642,8 +642,7 @@ struct irq_domain *of_msi_map_get_device* @np: device node for @dev * @token: bus type for this domain * -* Parse the msi-parent property (both the simple and the complex -* versions), and returns the corresponding MSI domain. +* Parse the msi-parent property and returns the corresponding MSI domain. * * Returns: the MSI domain for this device (or NULL on failure). */
@@ -651,33 +650,14 @@ struct irq_domain *of_msi_get_domain(strstruct device_node *np, enum irq_domain_bus_token token) { - struct device_node *msi_np; + struct of_phandle_iterator it;struct irq_domain *d; +int err; -/* Check for a single msi-parent property */ - msi_np =of_parse_phandle (np,"msi-parent" ,0 ); -if (msi_np && !of_property_read_bool (msi_np,"#msi-cells" )) { - d =irq_find_matching_host (msi_np, token); -if (!d) -of_node_put (msi_np); -return d; - } - -if (token ==DOMAIN_BUS_PLATFORM_MSI ) { -/* Check for the complex msi-parent version */ -struct of_phandle_args args; -int index =0 ; - -while (!of_parse_phandle_with_args (np,"msi-parent" , -"#msi-cells" , - index, &args)) { - d =irq_find_matching_host (args.np, token); -if (d) -return d; - -of_node_put (args.np); - index++; - } +of_for_each_phandle (&it, err, np,"msi-parent" ,"#msi-cells" ,0 ) { + d =irq_find_matching_host (it.node, token); +if (d) +return d; }return NULL ;
Greg Kroah-Hartman
maintainerPATCH 4/691 drm: omapdrm: Add missing check for alloc_ordered_workqueue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit e794b7b9b92977365c693760a259f8eef940c536 upstream.
As it may return NULL pointer and cause NULL pointer dereference. Add check for the return value of alloc_ordered_workqueue.
--- drivers/gpu/drm/omapdrm/omap_drv.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/omapdrm/omap_drv.c +5 -0
@@ -573,6 +573,10 @@ static int omapdrm_init(struct omap_drm_ soc =soc_device_match (omapdrm_soc_devices); priv->omaprev = soc ? (unsigned int )soc->data :0 ; priv->wq =alloc_ordered_workqueue ("omapdrm" ,0 ); +if (!priv->wq) { + ret = -ENOMEM ; + goto err_alloc_workqueue; + }mutex_init (&priv->list_lock);INIT_LIST_HEAD (&priv->obj_list);
@@ -620,6 +624,7 @@ err_cleanup_modeset: err_gem_deinit:omap_gem_deinit (ddev);destroy_workqueue (priv->wq); +err_alloc_workqueue:omap_disconnect_pipelines (ddev);drm_dev_put (ddev);return ret;
Greg Kroah-Hartman
maintainerPATCH 5/691 jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit f5cacdc6f2bb2a9bf214469dd7112b43dd2dd68a upstream.
In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain:
============================================
JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8
------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70
[...]
============================================
So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways.
Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code.
--- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/jbd2/checkpoint.c +5 -2
@@ -98,8 +98,11 @@ __releases(&journal->j_state_lock)write_unlock (&journal->j_state_lock);if (chkpt) {jbd2_log_do_checkpoint (journal); - }else if (jbd2_cleanup_journal_tail (journal) ==0 ) { -/* We were able to recover space; yay! */ + }else if (jbd2_cleanup_journal_tail (journal) <=0 ) { +/* +* We were able to recover space or the +* journal was aborted due to an error. +*/ ; }else if (tid) {/*
Greg Kroah-Hartman
maintainerPATCH 6/691 jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
commit f0e3c14802515f60a47e6ef347ea59c2733402aa upstream.
Use tid_geq to compare tids to work over sequence number wraps.
--- fs/jbd2/journal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jbd2/journal.c +1 -1
@@ -740,7 +740,7 @@ int jbd2_fc_begin_commit(journal_t *jourreturn -EINVAL ;write_lock (&journal->j_state_lock); -if (tid <= journal->j_commit_sequence) { +if (tid_geq (journal->j_commit_sequence, tid)) {write_unlock (&journal->j_state_lock);return -EALREADY ; }
Greg Kroah-Hartman
maintainerPATCH 7/691 mm: krealloc: consider spare memory for __GFP_ZERO
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
commit 1a83a716ec233990e1fd5b6fbb1200ade63bf450 upstream.
As long as krealloc() is called with __GFP_ZERO consistently, starting with the initial memory allocation, __GFP_ZERO should be fully honored.
However, if for an existing allocation krealloc() is called with a decreased size, it is not ensured that the spare portion the allocation is zeroed. Thus, if krealloc() is subsequently called with a larger size again, __GFP_ZERO can't be fully honored, since we don't know the previous size, but only the bucket size.
Example:
buf = kzalloc(64, GFP_KERNEL); memset(buf, 0xff, 64); buf = krealloc(buf, 48, GFP_KERNEL | __GFP_ZERO); /* After this call the last 16 bytes are still 0xff. */ buf = krealloc(buf, 64, GFP_KERNEL | __GFP_ZERO);
Fix this, by explicitly setting spare memory to zero, when shrinking an allocation with __GFP_ZERO flag set or init_on_alloc enabled.
--- mm/slab_common.c | 7 +++++++ 1 file changed, 7 insertions(+)
mm/slab_common.c +7 -0
@@ -1210,6 +1210,13 @@ static __always_inline void *__do_kreall/* If the object still fits, repoison it precisely. */ if (ks >= new_size) { +/* Zero out spare memory. */ +if (want_init_on_alloc (flags)) { +kasan_disable_current (); +memset ((void *)p + new_size,0 , ks - new_size); +kasan_enable_current (); + } + p =kasan_krealloc ((void *)p, new_size, flags);return (void *)p; }
Greg Kroah-Hartman
maintainerPATCH 8/691 ocfs2: fix the la space leak when unmounting an ocfs2 volume
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heming Zhao <[email protected]>
commit dfe6c5692fb525e5e90cefe306ee0dffae13d35f upstream.
This bug has existed since the initial OCFS2 code. The code logic in ocfs2_sync_local_to_main() is wrong, as it ignores the last contiguous free bits, which causes an OCFS2 volume to lose the last free clusters of LA window on each umount command.
--- fs/ocfs2/localalloc.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
fs/ocfs2/localalloc.c +19 -0
@@ -1008,6 +1008,25 @@ static int ocfs2_sync_local_to_main(stru start = bit_off +1 ; } +/* clear the contiguous bits until the end boundary */ +if (count) { + blkno = la_start_blk + +ocfs2_clusters_to_blocks (osb->sb, + start - count); + +trace_ocfs2_sync_local_to_main_free ( + count, start - count, + (unsigned long long )la_start_blk, + (unsigned long long )blkno); + + status =ocfs2_release_clusters (handle, + main_bm_inode, + main_bm_bh, blkno, + count); +if (status <0 ) +mlog_errno (status); + } + bail:if (status)mlog_errno (status);
Greg Kroah-Hartman
maintainerPATCH 9/691 ocfs2: fix uninit-value in ocfs2_get_block()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit 2af148ef8549a12f8025286b8825c2833ee6bcb8 upstream.
syzbot reported an uninit-value BUG:
BUG: KMSAN: uninit-value in ocfs2_get_block+0xed2/0x2710 fs/ocfs2/aops.c:159 ocfs2_get_block+0xed2/0x2710 fs/ocfs2/aops.c:159 do_mpage_readpage+0xc45/0x2780 fs/mpage.c:225 mpage_readahead+0x43f/0x840 fs/mpage.c:374 ocfs2_readahead+0x269/0x320 fs/ocfs2/aops.c:381 read_pages+0x193/0x1110 mm/readahead.c:160 page_cache_ra_unbounded+0x901/0x9f0 mm/readahead.c:273 do_page_cache_ra mm/readahead.c:303 [inline] force_page_cache_ra+0x3b1/0x4b0 mm/readahead.c:332 force_page_cache_readahead mm/internal.h:347 [inline] generic_fadvise+0x6b0/0xa90 mm/fadvise.c:106 vfs_fadvise mm/fadvise.c:185 [inline] ksys_fadvise64_64 mm/fadvise.c:199 [inline] __do_sys_fadvise64 mm/fadvise.c:214 [inline] __se_sys_fadvise64 mm/fadvise.c:212 [inline] __x64_sys_fadvise64+0x1fb/0x3a0 mm/fadvise.c:212 x64_sys_call+0xe11/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:222 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
This is because when ocfs2_extent_map_get_blocks() fails, p_blkno is uninitialized. So the error log will trigger the above uninit-value access.
The error log is out-of-date since get_blocks() was removed long time ago. And the error code will be logged in ocfs2_extent_map_get_blocks() once ocfs2_get_cluster() fails, so fix this by only logging inode and block.
--- fs/ocfs2/aops.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/ocfs2/aops.c +2 -3
@@ -156,9 +156,8 @@ int ocfs2_get_block(struct inode *inode, err =ocfs2_extent_map_get_blocks (inode, iblock, &p_blkno, &count, &ext_flags);if (err) { -mlog (ML_ERROR ,"Error %d from get_blocks(0x%p, %llu, 1, " -"%llu, NULL)\n" , err, inode, (unsigned long long )iblock, - (unsigned long long )p_blkno); +mlog (ML_ERROR ,"get_blocks() failed, inode: 0x%p, " +"block: %llu\n" , inode, (unsigned long long )iblock); goto bail; }
Greg Kroah-Hartman
maintainerPATCH 10/691 ocfs2: reserve space for inline xattr before attaching reflink tree
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham Ananthakrishna <[email protected]>
commit 5ca60b86f57a4d9648f68418a725b3a7de2816b0 upstream.
One of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption. Upon troubleshooting, the fsck -fn output showed the below corruption
[EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record, but fsck believes the largest valid value is 227. Clamp the next record value? n
The stat output from the debugfs.ocfs2 showed the following corruption where the "Next Free Rec:" had overshot the "Count:" in the root metadata block.
Inode: 33080590 Mode: 0640 Generation: 2619713622 (0x9c25a856)
FS Generation: 904309833 (0x35e6ac49)
CRC32: 00000000 ECC: 0000
Type: Regular Attr: 0x0 Flags: Valid
Dynamic Features: (0x16) HasXattr InlineXattr Refcounted
Extended Attributes Block: 0 Extended Attributes Inline Size: 256
User: 0 (root) Group: 0 (root) Size: 281320357888
Links: 1 Clusters: 141738
ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024
atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024
mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024
dtime: 0x0 -- Wed Dec 31 17:00:00 1969
Refcount Block: 2777346
Last Extblk: 2886943 Orphan Slot: 0
Sub Alloc Slot: 0 Sub Alloc Bit: 14
Tree Depth: 1 Count: 227 Next Free Rec: 230
## Offset Clusters Block#
0 0 2310 2776351
1 2310 2139 2777375
2 4449 1221 2778399
3 5670 731 2779423
4 6401 566 2780447
....... .... .......
....... .... .......The issue was in the reflink workfow while reserving space for inline xattr. The problematic function is ocfs2_reflink_xattr_inline(). By the time this function is called the reflink tree is already recreated at the destination inode from the source inode. At this point, this function reserves space for inline xattrs at the destination inode without even checking if there is space at the root metadata block. It simply reduces the l_count from 243 to 227 thereby making space of 256 bytes for inline xattr whereas the inode already has extents beyond this index (in this case up to 230), thereby causing corruption.
The fix for this is to reserve space for inline metadata at the destination inode before the reflink tree gets recreated. The customer has verified the fix.
--- fs/ocfs2/refcounttree.c | 26 ++++++++++++++++++++++++-- fs/ocfs2/xattr.c | 11 +---------- 2 files changed, 25 insertions(+), 12 deletions(-)
fs/ocfs2/refcounttree.c +24 -2
@@ -25,6 +25,7 @@#include "namei.h" #include "ocfs2_trace.h" #include "file.h" +#include "symlink.h" #include <linux/bio.h> #include <linux/blkdev.h>
@@ -4182,8 +4183,9 @@ static int __ocfs2_reflink(struct dentryint ret;struct inode *inode =d_inode (old_dentry);struct buffer_head *new_bh =NULL ; +struct ocfs2_inode_info *oi =OCFS2_I (inode); -if (OCFS2_I (inode)->ip_flags &OCFS2_INODE_SYSTEM_FILE ) { +if (oi->ip_flags &OCFS2_INODE_SYSTEM_FILE ) { ret = -EINVAL ;mlog_errno (ret); goto out;
@@ -4209,6 +4211,26 @@ static int __ocfs2_reflink(struct dentry goto out_unlock; } +if ((oi->ip_dyn_features &OCFS2_HAS_XATTR_FL ) && + (oi->ip_dyn_features &OCFS2_INLINE_XATTR_FL )) { +/* +* Adjust extent record count to reserve space for extended attribute. +* Inline data count had been adjusted in ocfs2_duplicate_inline_data(). +*/ +struct ocfs2_inode_info *new_oi =OCFS2_I (new_inode); + +if (!(new_oi->ip_dyn_features &OCFS2_INLINE_DATA_FL ) && + !(ocfs2_inode_is_fast_symlink (new_inode))) { +struct ocfs2_dinode *new_di = (struct ocfs2_dinode *)new_bh->b_data; +struct ocfs2_dinode *old_di = (struct ocfs2_dinode *)old_bh->b_data; +struct ocfs2_extent_list *el = &new_di->id2.i_list; +int inline_size =le16_to_cpu (old_di->i_xattr_inline_size); + +le16_add_cpu (&el->l_count, -(inline_size / +sizeof (struct ocfs2_extent_rec ))); + } + } + ret =ocfs2_create_reflink_node (inode, old_bh, new_inode, new_bh, preserve);if (ret) {
@@ -4216,7 +4238,7 @@ static int __ocfs2_reflink(struct dentry goto inode_unlock; } -if (OCFS2_I (inode)->ip_dyn_features &OCFS2_HAS_XATTR_FL ) { +if (oi->ip_dyn_features &OCFS2_HAS_XATTR_FL ) { ret =ocfs2_reflink_xattrs (inode, old_bh, new_inode, new_bh, preserve);
fs/ocfs2/xattr.c +1 -10
@@ -6515,16 +6515,7 @@ static int ocfs2_reflink_xattr_inline(st } new_oi =OCFS2_I (args->new_inode); -/* -* Adjust extent record count to reserve space for extended attribute. -* Inline data count had been adjusted in ocfs2_duplicate_inline_data(). -*/ -if (!(new_oi->ip_dyn_features &OCFS2_INLINE_DATA_FL ) && - !(ocfs2_inode_is_fast_symlink (args->new_inode))) { -struct ocfs2_extent_list *el = &new_di->id2.i_list; -le16_add_cpu (&el->l_count, -(inline_size / -sizeof (struct ocfs2_extent_rec ))); - } +spin_lock (&new_oi->ip_lock); new_oi->ip_dyn_features |=OCFS2_HAS_XATTR_FL |OCFS2_INLINE_XATTR_FL ; new_di->i_dyn_features =cpu_to_le16 (new_oi->ip_dyn_features);
Greg Kroah-Hartman
maintainerPATCH 11/691 ocfs2: cancel dqi_sync_work before freeing oinfo
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit 35fccce29feb3706f649726d410122dd81b92c18 upstream.
ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the end, if error occurs after successfully reading global quota, it will trigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled:
ODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c
This reports that there is an active delayed work when freeing oinfo in error handling, so cancel dqi_sync_work first. BTW, return status instead of -1 when .read_file_info fails.
--- fs/ocfs2/quota_local.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ocfs2/quota_local.c +6 -2
@@ -689,7 +689,7 @@ static int ocfs2_local_read_info(structint status;struct buffer_head *bh =NULL ;struct ocfs2_quota_recovery *rec; -int locked =0 ; +int locked =0 , global_read =0 ; info->dqi_max_spc_limit =0x7fffffffffffffffLL ; info->dqi_max_ino_limit =0x7fffffffffffffffLL ;
@@ -697,6 +697,7 @@ static int ocfs2_local_read_info(structif (!oinfo) {mlog (ML_ERROR ,"failed to allocate memory for ocfs2 quota" " info." ); + status = -ENOMEM ; goto out_err; } info->dqi_priv = oinfo;
@@ -709,6 +710,7 @@ static int ocfs2_local_read_info(struct status =ocfs2_global_read_info (sb, type);if (status <0 ) goto out_err; + global_read =1 ; status =ocfs2_inode_lock (lqinode, &oinfo->dqi_lqi_bh,1 );if (status <0 ) {
@@ -779,10 +781,12 @@ out_err:if (locked)ocfs2_inode_unlock (lqinode,1 );ocfs2_release_local_quota_bitmaps (&oinfo->dqi_chunk); +if (global_read) +cancel_delayed_work_sync (&oinfo->dqi_sync_work);kfree (oinfo); }brelse (bh); -return -1 ; +return status; }/* Write local info to quota file */
Greg Kroah-Hartman
maintainerPATCH 12/691 ocfs2: remove unreasonable unlock in ocfs2_read_blocks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
commit c03a82b4a0c935774afa01fd6d128b444fd930a1 upstream.
Patch series "Misc fixes for ocfs2_read_blocks", v5.
This series contains 2 fixes for ocfs2_read_blocks(). The first patch fix the issue reported by syzbot, which detects bad unlock balance in ocfs2_read_blocks(). The second patch fixes an issue reported by Heming Zhao when reviewing above fix.
This patch (of 2):
There was a lock release before exiting, so remove the unreasonable unlock.
--- fs/ocfs2/buffer_head_io.c | 1 - 1 file changed, 1 deletion(-)
fs/ocfs2/buffer_head_io.c +0 -1
@@ -235,7 +235,6 @@ int ocfs2_read_blocks(struct ocfs2_cachiif (bhs[i] ==NULL ) { bhs[i] =sb_getblk (sb, block++);if (bhs[i] ==NULL ) { -ocfs2_metadata_cache_io_unlock (ci); status = -ENOMEM ;mlog_errno (status);/* Don't forget to put previous bh! */
Greg Kroah-Hartman
maintainerPATCH 13/691 ocfs2: fix null-ptr-deref when journal load failed.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Sun <[email protected]>
commit 5784d9fcfd43bd853654bb80c87ef293b9e8e80a upstream.
During the mounting process, if journal_reset() fails because of too short journal, then lead to jbd2_journal_load() fails with NULL j_sb_buffer. Subsequently, ocfs2_journal_shutdown() calls jbd2_journal_flush()->jbd2_cleanup_journal_tail()-> __jbd2_update_log_tail()->jbd2_journal_update_sb_log_tail() ->lock_buffer(journal->j_sb_buffer), resulting in a null-pointer dereference error.
To resolve this issue, we should check the JBD2_LOADED flag to ensure the journal was properly loaded. Additionally, use journal instead of osb->journal directly to simplify the code.
--- fs/ocfs2/journal.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/ocfs2/journal.c +4 -3
@@ -994,7 +994,7 @@ void ocfs2_journal_shutdown(struct ocfs2if (!igrab (inode))BUG (); - num_running_trans =atomic_read (&(osb->journal->j_num_trans)); + num_running_trans =atomic_read (&(journal->j_num_trans));trace_ocfs2_journal_shutdown (num_running_trans);/* Do a commit_cache here. It will flush our journal, *and*
@@ -1013,9 +1013,10 @@ void ocfs2_journal_shutdown(struct ocfs2 osb->commit_task =NULL ; } -BUG_ON (atomic_read (&(osb->journal->j_num_trans)) !=0 ); +BUG_ON (atomic_read (&(journal->j_num_trans)) !=0 ); -if (ocfs2_mount_local (osb)) { +if (ocfs2_mount_local (osb) && + (journal->j_journal->j_flags &JBD2_LOADED )) {jbd2_journal_lock_updates (journal->j_journal); status =jbd2_journal_flush (journal->j_journal,0 );jbd2_journal_unlock_updates (journal->j_journal);
Greg Kroah-Hartman
maintainerPATCH 14/691 ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
commit 33b525cef4cff49e216e4133cc48452e11c0391e upstream.
When doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL.
--- fs/ocfs2/buffer_head_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ocfs2/buffer_head_io.c +2 -1
@@ -388,7 +388,8 @@ read_failure:/* Always set the buffer in the cache, even if it was * a forced read, or read-ahead which hasn't yet * completed. */ -ocfs2_set_buffer_uptodate (ci, bh); +if (bh) +ocfs2_set_buffer_uptodate (ci, bh); }ocfs2_metadata_cache_io_unlock (ci);
Greg Kroah-Hartman
maintainerPATCH 15/691 usbnet: ipheth: fix carrier detection in modes 1 and 4
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <[email protected]>
[ Upstream commit 67927a1b255d883881be9467508e0af9a5e0be9d ]
Apart from the standard "configurations", "interfaces" and "alternate interface settings" in USB, iOS devices also have a notion of "modes". In different modes, the device exposes a different set of available configurations.
Depending on the iOS version, and depending on the current mode, the length and contents of the carrier state control message differs:
* 1 byte (seen on iOS 4.2.1, 8.4):
* 03: carrier off (mode 0)
* 04: carrier on (mode 0)
* 3 bytes (seen on iOS 10.3.4, 15.7.6):
* 03 03 03: carrier off (mode 0)
* 04 04 03: carrier on (mode 0)
* 4 bytes (seen on iOS 16.5, 17.6):
* 03 03 03 00: carrier off (mode 0)
* 04 03 03 00: carrier off (mode 1)
* 06 03 03 00: carrier off (mode 4)
* 04 04 03 04: carrier on (mode 0 and 1)
* 06 04 03 04: carrier on (mode 4)
Before this change, the driver always used the first byte of the response to determine carrier state.
Quoted 1 line
From this larger sample, the first byte seems to indicate the number of
available USB configurations in the current mode (with the exception of the default mode 0), and in some cases (namely mode 1 and 4) does not correlate with the carrier state.
Previous logic erroneously counted 04 03 03 00 as "carrier on" and 06 04 03 04 as "carrier off" on iOS versions that support mode 1 and mode 4 respectively.
Only modes 0, 1 and 4 expose the USB Ethernet interfaces necessary for the ipheth driver.
Check the second byte of the control message where possible, and fall back to checking the first byte on older iOS versions.
--- drivers/net/usb/ipheth.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/usb/ipheth.c +3 -2
@@ -253,13 +253,14 @@ static int ipheth_carrier_set(struct ipheth_device *dev)0x02 ,/* index */ dev->ctrl_buf,IPHETH_CTRL_BUF_SIZE , IPHETH_CTRL_TIMEOUT); -if (retval <0 ) { +if (retval <=0 ) {dev_err (&dev->intf->dev,"%s: usb_control_msg: %d\n" , __func__, retval);return retval; } -if (dev->ctrl_buf[0 ] ==IPHETH_CARRIER_ON ) { +if ((retval ==1 && dev->ctrl_buf[0 ] ==IPHETH_CARRIER_ON ) || + (retval >=2 && dev->ctrl_buf[1 ] ==IPHETH_CARRIER_ON )) {netif_carrier_on (dev->net);if (dev->tx_urb->status != -EINPROGRESS )netif_wake_queue (dev->net);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/691 net: ethernet: use ip_hdrlen() instead of bit shift
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Yeounsu <[email protected]>
[ Upstream commit 9a039eeb71a42c8b13408a1976e300f3898e1be0 ]
ip_hdr(skb)->ihl << 2 is the same as ip_hdrlen(skb) Therefore, we should use a well-defined function not a bit shift to find the header length.
It also compresses two lines to a single line.
--- drivers/net/ethernet/jme.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/net/ethernet/jme.c +4 -6
@@ -945,15 +945,13 @@ jme_udpsum(struct sk_buff *skb)if (skb->protocol !=htons (ETH_P_IP ))return csum;skb_set_network_header (skb,ETH_HLEN ); -if ((ip_hdr (skb)->protocol !=IPPROTO_UDP ) || - (skb->len < (ETH_HLEN + - (ip_hdr (skb)->ihl <<2 ) + -sizeof (struct udphdr )))) { + +if (ip_hdr (skb)->protocol !=IPPROTO_UDP || + skb->len < (ETH_HLEN +ip_hdrlen (skb) +sizeof (struct udphdr ))) {skb_reset_network_header (skb);return csum; } -skb_set_transport_header (skb, -ETH_HLEN + (ip_hdr (skb)->ihl <<2 )); +skb_set_transport_header (skb,ETH_HLEN +ip_hdrlen (skb)); csum =udp_hdr (skb)->check;skb_reset_transport_header (skb);skb_reset_network_header (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/691 net: phy: vitesse: repair vsc73xx autonegotiation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Dembicki <[email protected]>
[ Upstream commit de7a670f8defe4ed2115552ad23dea0f432f7be4 ]
When the vsc73xx mdio bus work properly, the generic autonegotiation configuration works well.
--- drivers/net/phy/vitesse.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/net/phy/vitesse.c +0 -14
@@ -237,16 +237,6 @@ static int vsc739x_config_init(struct phy_device *phydev)return 0 ; } -static int vsc73xx_config_aneg (struct phy_device *phydev) -{ -/* The VSC73xx switches does not like to be instructed to -* do autonegotiation in any way, it prefers that you just go -* with the power-on/reset defaults. Writing some registers will -* just make autonegotiation permanently fail. -*/ -return 0 ; -} -/* This adds a skew for both TX and RX clocks, so the skew should only be * applied to "rgmii-id" interfaces. It may not work as expected * on "rgmii-txid", "rgmii-rxid" or "rgmii" interfaces.
@@ -444,7 +434,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, /* PHY_GBIT_FEATURES */ .config_init = vsc738x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
@@ -453,7 +442,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, /* PHY_GBIT_FEATURES */ .config_init = vsc738x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
@@ -462,7 +450,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, /* PHY_GBIT_FEATURES */ .config_init = vsc739x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
@@ -471,7 +458,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, /* PHY_GBIT_FEATURES */ .config_init = vsc739x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/691 powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit e7e846dc6c73fbc94ae8b4ec20d05627646416f2 ]
Booting with CONFIG_DEBUG_VIRTUAL leads to following warning when passing hugepage reservation on command line:
Kernel command line: hugepagesz=1g hugepages=1 hugepagesz=64m hugepages=1 hugepagesz=256m hugepages=1 noreboot
HugeTLB: allocating 1 of page size 1.00 GiB failed. Only allocated 0 hugepages.
------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at arch/powerpc/include/asm/io.h:948 __alloc_bootmem_huge_page+0xd4/0x284 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.10.0-rc6-00396-g6b0e82791bd0-dirty #936 Hardware name: MPC8544DS e500v2 0x80210030 MPC8544 DS NIP: c1020240 LR: c10201d0 CTR: 00000000 REGS: c13fdd30 TRAP: 0700 Not tainted (6.10.0-rc6-00396-g6b0e82791bd0-dirty) MSR: 00021000 <CE,ME> CR: 44084288 XER: 20000000
GPR00: c10201d0 c13fde20 c130b560 e8000000 e8001000 00000000 00000000 c1420000
GPR08: 00000000 00028001 00000000 00000004 44084282 01066ac0 c0eb7c9c efffe149
GPR16: c0fc4228 0000005f ffffffff c0eb7d0c c0eb7cc0 c0eb7ce0 ffffffff 00000000
GPR24: c1441cec efffe153 e8001000 c14240c0 00000000 c1441d64 00000000 e8000000 NIP [c1020240] __alloc_bootmem_huge_page+0xd4/0x284
LR [c10201d0] __alloc_bootmem_huge_page+0x64/0x284
Call Trace: [c13fde20] [c10201d0] __alloc_bootmem_huge_page+0x64/0x284 (unreliable) [c13fde50] [c10207b8] hugetlb_hstate_alloc_pages+0x8c/0x3e8 [c13fdeb0] [c1021384] hugepages_setup+0x240/0x2cc [c13fdef0] [c1000574] unknown_bootoption+0xfc/0x280 [c13fdf30] [c0078904] parse_args+0x200/0x4c4 [c13fdfa0] [c1000d9c] start_kernel+0x238/0x7d0 [c13fdff0] [c0000434] set_ivor+0x12c/0x168 Code: 554aa33e 7c042840 3ce0c142 80a7427c 5109a016 50caa016 7c9a2378 7fdcf378 4180000c 7c052040 41810160 7c095040 <0fe00000> 38c00000 40800108 3c60c0eb ---[ end trace 0000000000000000 ]---
This is due to virt_addr_valid() using high_memory before it is set.
high_memory is set in mem_init() using max_low_pfn, but max_low_pfn is available long before, it is set in mem_topology_setup(). So just like commit daa9ada2093e ("powerpc/mm: Fix boot crash with FLATMEM") moved the setting of max_mapnr immediately after the call to mem_topology_setup(), the same can be done for high_memory.
--- arch/powerpc/kernel/setup-common.c | 1 + arch/powerpc/mm/mem.c | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-)
arch/powerpc/kernel/setup-common.c +1 -0
@@ -889,6 +889,7 @@ void __init setup_arch(char **cmdline_p)mem_topology_setup ();/* Set max_mapnr before paging_init() */ set_max_mapnr (max_pfn); + high_memory = (void *)__va (max_low_pfn *PAGE_SIZE );/* * Release secondary cpus out of their spinloops at 0x60 now that
arch/powerpc/mm/mem.c +0 -2
@@ -287,8 +287,6 @@ void __init mem_init(void)swiotlb_init (0 );#endif - high_memory = (void *)__va (max_low_pfn *PAGE_SIZE ); -kasan_late_init ();memblock_free_all ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/691 btrfs: update target inodes ctime on unlink
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 3bc2ac2f8f0b78a13140fc72022771efe0c9b778 ]
Unlink changes the link count on the target inode. POSIX mandates that the ctime must also change when this occurs.
According to https://pubs.opengroup.org/onlinepubs/9699919799/functions/unlink.html:
"Upon successful completion, unlink() shall mark for update the last data
modification and last file status change timestamps of the parent directory. Also, if the file's link count is not 0, the last file status change timestamp of the file shall be marked for update."
--- fs/btrfs/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/inode.c +1 -0
@@ -4199,6 +4199,7 @@ static int __btrfs_unlink_inode(struct btrfs_trans_handle *trans,btrfs_i_size_write (dir, dir->vfs_inode.i_size - name_len *2 );inode_inc_iversion (&inode->vfs_inode); +inode_set_ctime_current (&inode->vfs_inode);inode_inc_iversion (&dir->vfs_inode); inode->vfs_inode.i_ctime = dir->vfs_inode.i_mtime = dir->vfs_inode.i_ctime =current_time (&inode->vfs_inode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/691 Input: ads7846 - ratelimit the spi_sync error message
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit ccbfea78adf75d3d9e87aa739dab83254f5333fa ]
In case the touch controller is not connected, this message keeps scrolling on the console indefinitelly. Ratelimit it to avoid filling kernel logs.
"
ads7846 spi2.1: spi_sync --> -22
"
--- drivers/input/touchscreen/ads7846.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/touchscreen/ads7846.c +1 -1
@@ -818,7 +818,7 @@ static void ads7846_read_state(struct ads7846 *ts) m = &ts->msg[msg_idx]; error =spi_sync (ts->spi, m);if (error) { -dev_err (&ts->spi->dev,"spi_sync --> %d\n" , error); +dev_err_ratelimited (&ts->spi->dev,"spi_sync --> %d\n" , error); packet->ignore = true;return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/691 Input: synaptics - enable SMBus for HP Elitebook 840 G2
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Denose <[email protected]>
[ Upstream commit da897484557b34a54fabb81f6c223c19a69e546d ]
The kernel reports that the touchpad for this device can support a different bus.
With SMBus enabled the touchpad movement is smoother and three-finger gestures are recognized.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -187,6 +187,7 @@ static const char * const smbus_pnp_ids[] = {"LEN2054" ,/* E480 */ "LEN2055" ,/* E580 */ "LEN2068" ,/* T14 Gen 1 */ +"SYN3015" ,/* HP EliteBook 840 G2 */ "SYN3052" ,/* HP EliteBook 840 G4 */ "SYN3221" ,/* HP 15-ay000 */ "SYN323d", /* HP Spectre X360 13-w013dx */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/691 HID: multitouch: Add support for GT7868Q
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Savin <[email protected]>
[ Upstream commit c8000deb68365b461b324d68c7ea89d730f0bb85 ]
GT7868Q has incorrect data in the report and needs a fixup. The change enables haptic touchpad on Lenovo ThinkBook 13x Gen 4 and has been tested on the device.
--- drivers/hid/hid-ids.h | 2 ++ drivers/hid/hid-multitouch.c | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+)
drivers/hid/hid-ids.h +2 -0
@@ -484,6 +484,8 @@#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100#define I2C_VENDOR_ID_GOODIX 0x27c6 +#define I2C_DEVICE_ID_GOODIX_01E8 0x01e8 +#define I2C_DEVICE_ID_GOODIX_01E9 0x01e9#define I2C_DEVICE_ID_GOODIX_01F0 0x01f0#define USB_VENDOR_ID_GOODTOUCH 0x1aad
drivers/hid/hid-multitouch.c +33 -0
@@ -1442,6 +1442,30 @@ static int mt_event(struct hid_device *hid, struct hid_field *field,return 0 ; } +static __u8 *mt_report_fixup (struct hid_device *hdev,__u8 *rdesc, +unsigned int *size) +{ +if (hdev->vendor ==I2C_VENDOR_ID_GOODIX && + (hdev->product ==I2C_DEVICE_ID_GOODIX_01E8 || + hdev->product ==I2C_DEVICE_ID_GOODIX_01E9 )) { +if (rdesc[607 ] ==0x15 ) { + rdesc[607 ] =0x25 ; +dev_info ( + &hdev->dev, +"GT7868Q report descriptor fixup is applied.\n" ); + }else { +dev_info ( + &hdev->dev, +"The byte is not expected for fixing the report descriptor. \ +It's possible that the touchpad firmware is not suitable for applying the fix. \ +got: %x\n" , + rdesc[607 ]); + } + } + +return rdesc; +} +static void mt_report (struct hid_device *hid,struct hid_report *report) {struct mt_device *td =hid_get_drvdata (hid);
@@ -2036,6 +2060,14 @@ static const struct hid_device_id mt_devices[] = { MT_BT_DEVICE(USB_VENDOR_ID_FRUCTEL, USB_DEVICE_ID_GAMETEL_MT_MODE) }, +/* Goodix GT7868Q devices */ + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, +HID_DEVICE (BUS_I2C ,HID_GROUP_ANY ,I2C_VENDOR_ID_GOODIX , + I2C_DEVICE_ID_GOODIX_01E8) }, + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, +HID_DEVICE (BUS_I2C ,HID_GROUP_ANY ,I2C_VENDOR_ID_GOODIX , + I2C_DEVICE_ID_GOODIX_01E8) }, + /* GoodTouch panels */ { .driver_data = MT_CLS_NSMU, MT_USB_DEVICE(USB_VENDOR_ID_GOODTOUCH,
@@ -2271,6 +2303,7 @@ static struct hid_driver mt_driver = { .feature_mapping = mt_feature_mapping, .usage_table = mt_grabbed_usages, .event = mt_event, + .report_fixup = mt_report_fixup, .report = mt_report, #ifdef CONFIG_PM .suspend = mt_suspend,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/691 scripts: kconfig: merge_config: config files: add a trailing newline
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anders Roxell <[email protected]>
[ Upstream commit 33330bcf031818e60a816db0cfd3add9eecc3b28 ]
When merging files without trailing newlines at the end of the file, two config fragments end up at the same row if file1.config doens't have a trailing newline at the end of the file.
file1.config "CONFIG_1=y"
file2.config "CONFIG_2=y"./scripts/kconfig/merge_config.sh -m .config file1.config file2.config
This will generate a .config looking like this.
cat .config
...CONFIG_1=yCONFIG_2=y"
Making sure so we add a newline at the end of every config file that is passed into the script.
--- scripts/kconfig/merge_config.sh | 2 ++ 1 file changed, 2 insertions(+)
scripts/kconfig/merge_config.sh +2 -0
@@ -160,6 +160,8 @@ for ORIG_MERGE_FILE in $MERGE_LIST ; do sed -i "/$CFG[ =]/d" $MERGE_FILE fi done + # In case the previous file lacks a new line at the end + echo >> $TMP_FILE cat $MERGE_FILE >> $TMP_FILE done
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/691 platform/surface: aggregator_registry: Add support for Surface Laptop Go 3
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maximilian Luz <[email protected]>
[ Upstream commit ed235163c3f02329d5e37ed4485bbc39ed2568d4 ]
Add SAM client device nodes for the Surface Laptop Go 3. It seems to use the same SAM client devices as the Surface Laptop Go 1 and 2, so re-use their node group.
--- drivers/platform/surface/surface_aggregator_registry.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/surface/surface_aggregator_registry.c +3 -0
@@ -561,6 +561,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = {/* Surface Laptop Go 2 */ { "MSHW0290", (unsigned long)ssam_node_group_slg1 }, +/* Surface Laptop Go 3 */ + { "MSHW0440", (unsigned long)ssam_node_group_slg1 }, +/* Surface Laptop Studio */ { "MSHW0123", (unsigned long)ssam_node_group_sls },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/691 drm/msm/adreno: Fix error return if missing firmware-name
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 624ab9cde26a9f150b4fd268b0f3dae3184dc40c ]
-ENODEV is used to signify that there is no zap shader for the platform, and the CPU can directly take the GPU out of secure mode. We want to use this return code when there is no zap-shader node. But not when there is, but without a firmware-name property. This case we want to treat as-if the needed fw is not found.
Patchwork: https://patchwork.freedesktop.org/patch/604564/
--- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.c +1 -1
@@ -94,7 +94,7 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname,* was a bad idea, and is only provided for backwards * compatibility for older targets. */ -return -ENODEV ; +return -ENOENT ; }if (IS_ERR (fw)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/691 Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7ce7c2283fa6843ab3c2adfeb83dcc504a107858 ]
Yet another quirk entry for Fujitsu laptop. Lifebook E756 requires i8041.nomux for keeping the touchpad working after suspend/resume.
--- drivers/input/serio/i8042-acpipnpio.h | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +9 -0
@@ -617,6 +617,15 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { }, .driver_data = (void *)(SERIO_QUIRK_NOMUX) }, + { +/* Fujitsu Lifebook E756 */ +/* https://bugzilla.suse.com/show_bug.cgi?id=1229056 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E756"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) + }, {/* Fujitsu Lifebook E5411 */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/691 NFSv4: Fix clearing of layout segments in layoutreturn
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit d72b7963115bea971a28eaa2cb76722c023f9fdf ]
Make sure that we clear the layout segments in cases where we see a fatal error, and also in the case where the layout is invalid.
--- fs/nfs/nfs4proc.c | 9 ++++++--- fs/nfs/pnfs.c | 5 ++--- 2 files changed, 8 insertions(+), 6 deletions(-)
fs/nfs/nfs4proc.c +6 -3
@@ -9755,13 +9755,16 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata) fallthrough;default : task->tk_status =0 ; + lrp->res.lrs_present =0 ; fallthrough;case 0 :break ;case -NFS4ERR_DELAY : -if (nfs4_async_handle_error (task, server,NULL ,NULL ) != -EAGAIN ) -break ; - goto out_restart; +if (nfs4_async_handle_error (task, server,NULL ,NULL ) == + -EAGAIN ) + goto out_restart; + lrp->res.lrs_present =0 ; +break ; }dprintk ("<-- %s\n" , __func__);return ;
fs/nfs/pnfs.c +2 -3
@@ -1169,10 +1169,9 @@ void pnfs_layoutreturn_free_lsegs(struct pnfs_layout_hdr *lo,LIST_HEAD (freeme);spin_lock (&inode->i_lock); -if (!pnfs_layout_is_valid (lo) || - !nfs4_stateid_match_other (&lo->plh_stateid, arg_stateid)) +if (!nfs4_stateid_match_other (&lo->plh_stateid, arg_stateid)) goto out_unlock; -if (stateid) { +if (stateid &&pnfs_layout_is_valid (lo)) {u32 seq =be32_to_cpu (arg_stateid->seqid);pnfs_mark_matching_lsegs_invalid (lo, &freeme, range, seq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/691 NFS: Avoid unnecessary rescanning of the per-server delegation list
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit f92214e4c312f6ea9d78650cc6291d200f17abb6 ]
If the call to nfs_delegation_grab_inode() fails, we will not have dropped any locks that require us to rescan the list.
--- fs/nfs/delegation.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
fs/nfs/delegation.c +5 -10
@@ -627,6 +627,9 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server, prev = delegation;continue ; } + inode =nfs_delegation_grab_inode (delegation); +if (inode ==NULL ) +continue ;if (prev) {struct inode *tmp =nfs_delegation_grab_inode (prev);
@@ -637,12 +640,6 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server, } } - inode =nfs_delegation_grab_inode (delegation); -if (inode ==NULL ) { -rcu_read_unlock (); -iput (to_put); - goto restart; - } delegation =nfs_start_delegation_return_locked (NFS_I (inode));rcu_read_unlock ();
@@ -1164,7 +1161,6 @@ static int nfs_server_reap_unclaimed_delegations(struct nfs_server *server,struct inode *inode; restart:rcu_read_lock (); -restart_locked:list_for_each_entry_rcu (delegation, &server->delegations, super_list) { if (test_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags) ||
@@ -1175,7 +1171,7 @@ static int nfs_server_reap_unclaimed_delegations(struct nfs_server *server,continue ; inode =nfs_delegation_grab_inode (delegation);if (inode ==NULL ) - goto restart_locked; +continue ; delegation =nfs_start_delegation_return_locked (NFS_I (inode));rcu_read_unlock ();if (delegation !=NULL ) {
@@ -1296,7 +1292,6 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server,nfs4_stateid stateid; restart:rcu_read_lock (); -restart_locked:list_for_each_entry_rcu (delegation, &server->delegations, super_list) { if (test_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags) ||
@@ -1307,7 +1302,7 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server,continue ; inode =nfs_delegation_grab_inode (delegation);if (inode ==NULL ) - goto restart_locked; +continue ;spin_lock (&delegation->lock); cred =get_cred_rcu (delegation->cred);nfs4_stateid_copy (&stateid, &delegation->stateid);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/691 platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4 upstream.
The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough.
Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute.
Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load if the SINF array is smaller.
For higher SINF indexes hide the sysfs attributes when the SINF array does not contain an entry for that attribute, avoiding show()/store() accessing the array out of bounds and add bounds checking to the probe() and resume() code accessing these.
--- drivers/platform/x86/panasonic-laptop.c | 49 +++++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 10 deletions(-)
drivers/platform/x86/panasonic-laptop.c +39 -10
@@ -773,6 +773,24 @@ static DEVICE_ATTR_RW(dc_brightness);static DEVICE_ATTR_RW (current_brightness);static DEVICE_ATTR_RW (cdpower); +static umode_t pcc_sysfs_is_visible (struct kobject *kobj,struct attribute *attr,int idx) +{ +struct device *dev =kobj_to_dev (kobj); +struct acpi_device *acpi =to_acpi_device (dev); +struct pcc_acpi *pcc =acpi_driver_data (acpi); + +if (attr == &dev_attr_mute.attr) +return (pcc->num_sifr >SINF_MUTE ) ? attr->mode :0 ; + +if (attr == &dev_attr_eco_mode.attr) +return (pcc->num_sifr >SINF_ECO_MODE ) ? attr->mode :0 ; + +if (attr == &dev_attr_current_brightness.attr) +return (pcc->num_sifr >SINF_CUR_BRIGHT ) ? attr->mode :0 ; + +return attr->mode; +} +static struct attribute *pcc_sysfs_entries[] = { &dev_attr_numbatt.attr, &dev_attr_lcdtype.attr,
@@ -787,8 +805,9 @@ static struct attribute *pcc_sysfs_entri };static const struct attribute_group pcc_attr_group = { - .name =NULL ,/* put in device directory */ - .attrs = pcc_sysfs_entries, + .name =NULL ,/* put in device directory */ + .attrs = pcc_sysfs_entries, + .is_visible = pcc_sysfs_is_visible, };
@@ -941,12 +960,15 @@ static int acpi_pcc_hotkey_resume(structif (!pcc)return -EINVAL ; -acpi_pcc_write_sset (pcc,SINF_MUTE , pcc->mute); -acpi_pcc_write_sset (pcc,SINF_ECO_MODE , pcc->eco_mode); +if (pcc->num_sifr >SINF_MUTE ) +acpi_pcc_write_sset (pcc,SINF_MUTE , pcc->mute); +if (pcc->num_sifr >SINF_ECO_MODE ) +acpi_pcc_write_sset (pcc,SINF_ECO_MODE , pcc->eco_mode);acpi_pcc_write_sset (pcc,SINF_STICKY_KEY , pcc->sticky_key);acpi_pcc_write_sset (pcc,SINF_AC_CUR_BRIGHT , pcc->ac_brightness);acpi_pcc_write_sset (pcc,SINF_DC_CUR_BRIGHT , pcc->dc_brightness); -acpi_pcc_write_sset (pcc,SINF_CUR_BRIGHT , pcc->current_brightness); +if (pcc->num_sifr >SINF_CUR_BRIGHT ) +acpi_pcc_write_sset (pcc,SINF_CUR_BRIGHT , pcc->current_brightness);return 0 ; }
@@ -963,8 +985,12 @@ static int acpi_pcc_hotkey_add(struct ac num_sifr =acpi_pcc_get_sqty (device); -if (num_sifr <0 || num_sifr >255 ) { -pr_err ("num_sifr out of range" ); +/* +* pcc->sinf is expected to at least have the AC+DC brightness entries. +* Accesses to higher SINF entries are checked against num_sifr. +*/ +if (num_sifr <=SINF_DC_CUR_BRIGHT || num_sifr >255 ) { +pr_err ("num_sifr %d out of range %d - 255\n" , num_sifr,SINF_DC_CUR_BRIGHT +1 );return -ENODEV ; }
@@ -1016,11 +1042,14 @@ static int acpi_pcc_hotkey_add(struct acacpi_pcc_write_sset (pcc,SINF_STICKY_KEY ,0 ); pcc->sticky_key =0 ; - pcc->eco_mode = pcc->sinf[SINF_ECO_MODE ]; - pcc->mute = pcc->sinf[SINF_MUTE ]; pcc->ac_brightness = pcc->sinf[SINF_AC_CUR_BRIGHT ]; pcc->dc_brightness = pcc->sinf[SINF_DC_CUR_BRIGHT ]; - pcc->current_brightness = pcc->sinf[SINF_CUR_BRIGHT ]; +if (pcc->num_sifr >SINF_MUTE ) + pcc->mute = pcc->sinf[SINF_MUTE ]; +if (pcc->num_sifr >SINF_ECO_MODE ) + pcc->eco_mode = pcc->sinf[SINF_ECO_MODE ]; +if (pcc->num_sifr >SINF_CUR_BRIGHT ) + pcc->current_brightness = pcc->sinf[SINF_CUR_BRIGHT ];/* add sysfs attributes */ result =sysfs_create_group (&device->dev.kobj, &pcc_attr_group);
Greg Kroah-Hartman
maintainerPATCH 30/691 platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 33297cef3101d950cec0033a0dce0a2d2bd59999 upstream.
Some DSDT-s have an off-by-one bug where the SINF package count is one higher than the SQTY reported value, allocate 1 entry extra.
Also make the SQTY <-> SINF package count mismatch error more verbose to help debugging similar issues in the future.
This fixes the panasonic-laptop driver failing to probe() on some devices with the following errors:
[ 3.958887] SQTY reports bad SINF length SQTY: 37 SINF-pkg-count: 38 [ 3.958892] Couldn't retrieve BIOS data [ 3.983685] Panasonic Laptop Support - With Macros: probe of MAT0019:00 failed with error -5
--- drivers/platform/x86/panasonic-laptop.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/platform/x86/panasonic-laptop.c +8 -1
@@ -337,7 +337,8 @@ static int acpi_pcc_retrieve_biosdata(st }if (pcc->num_sifr < hkey->package.count) { -pr_err ("SQTY reports bad SINF length\n" ); +pr_err ("SQTY reports bad SINF length SQTY: %lu SINF-pkg-count: %u\n" , + pcc->num_sifr, hkey->package.count); status =AE_ERROR ; goto end; }
@@ -994,6 +995,12 @@ static int acpi_pcc_hotkey_add(struct acreturn -ENODEV ; } +/* +* Some DSDT-s have an off-by-one bug where the SINF package count is +* one higher than the SQTY reported value, allocate 1 entry extra. +*/ + num_sifr++; + pcc =kzalloc (sizeof (struct pcc_acpi ),GFP_KERNEL );if (!pcc) {pr_err ("Couldn't allocate mem for pcc" );
Greg Kroah-Hartman
maintainerPATCH 31/691 mptcp: pm: Fix uaf in __timer_delete_sync
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit b4cd80b0338945a94972ac3ed54f8338d2da2076 upstream.
There are two paths to access mptcp_pm_del_add_timer, result in a race condition:
CPU1 CPU2
==== ====
net_rx_action
napi_poll netlink_sendmsg
__napi_poll netlink_unicast
process_backlog netlink_unicast_kernel
__netif_receive_skb genl_rcv
__netif_receive_skb_one_core netlink_rcv_skb
NF_HOOK genl_rcv_msg
ip_local_deliver_finish genl_family_rcv_msg
ip_protocol_deliver_rcu genl_family_rcv_msg_doit
tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit
tcp_v4_do_rcv mptcp_nl_remove_addrs_list
tcp_rcv_established mptcp_pm_remove_addrs_and_subflows
tcp_data_queue remove_anno_list_by_saddr
mptcp_incoming_options mptcp_pm_del_add_timer
mptcp_pm_del_add_timer kfree(entry)In remove_anno_list_by_saddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).
Keeping a reference to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer".
Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock, do not directly access any members of the entry outside the pm lock, which can avoid similar "entry->x" uaf.
--- net/mptcp/pm_netlink.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/mptcp/pm_netlink.c +9 -4
@@ -361,15 +361,21 @@ mptcp_pm_del_add_timer(struct mptcp_sock {struct mptcp_pm_add_entry *entry;struct sock *sk = (struct sock *)msk; +struct timer_list *add_timer =NULL ;spin_lock_bh (&msk->pm.lock); entry =mptcp_lookup_anno_list_by_saddr (msk, addr); -if (entry && (!check_id || entry->addr.id == addr->id)) +if (entry && (!check_id || entry->addr.id == addr->id)) { entry->retrans_times =ADD_ADDR_RETRANS_MAX ; + add_timer = &entry->add_timer; + } +if (!check_id && entry) +list_del (&entry->list);spin_unlock_bh (&msk->pm.lock); -if (entry && (!check_id || entry->addr.id == addr->id)) -sk_stop_timer_sync (sk, &entry->add_timer); +/* no lock, because sk_stop_timer_sync() is calling del_timer_sync() */ +if (add_timer) +sk_stop_timer_sync (sk, add_timer);return entry; }
@@ -1357,7 +1363,6 @@ static bool remove_anno_list_by_saddr(st entry =mptcp_pm_del_add_timer (msk, addr, false);if (entry) { -list_del (&entry->list);kfree (entry);return true; }
Greg Kroah-Hartman
maintainerPATCH 32/691 arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
commit 741f5ba7ccba5d7ae796dd11c320e28045524771 upstream.
The Qseven BIOS_DISABLE signal on the RK3399-Q7 keeps the on-module eMMC and SPI flash powered-down initially (in fact it keeps the reset signal asserted). BIOS_DISABLE_OVERRIDE pin allows to override that signal so that eMMC and SPI can be used regardless of the state of the signal.
Let's make this GPIO a hog so that it's reserved and locked in the proper state.
At the same time, make sure the pin is reserved for the hog and cannot be requested by another node.
--- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +22 -1
@@ -108,6 +108,22 @@ drive-impedance-ohm = <33>; }; +&gpio3 { + /* + * The Qseven BIOS_DISABLE signal on the RK3399-Q7 keeps the on-module + * eMMC and SPI flash powered-down initially (in fact it keeps the + * reset signal asserted). BIOS_DISABLE_OVERRIDE pin allows to override + * that signal so that eMMC and SPI can be used regardless of the state + * of the signal. + */ + bios-disable-override-hog { + gpios = <RK_PD5 GPIO_ACTIVE_LOW>; + gpio-hog; + line-name = "bios_disable_override"; + output-high; + }; +}; + &gmac { assigned-clocks = <&cru SCLK_RMII_SRC>; assigned-clock-parents = <&clkin_gmac>;
@@ -397,9 +413,14 @@ &pinctrl { pinctrl-names = "default"; - pinctrl-0 = <&q7_thermal_pin>; + pinctrl-0 = <&q7_thermal_pin &bios_disable_override_hog_pin>; gpios { + bios_disable_override_hog_pin: bios-disable-override-hog-pin { + rockchip,pins = + <3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_down>; + }; + q7_thermal_pin: q7-thermal-pin { rockchip,pins = <0 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>;
Greg Kroah-Hartman
maintainerPATCH 33/691 minmax: reduce min/max macro expansion in atomisp driver
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
commit 7c6a3a65ace70f12b27b1a27c9a69cb791dc6e91 upstream.
Avoid unnecessary nested min()/max() which results in egregious macro expansion.
Use clamp_t() as this introduces the least possible expansion, and turn the {s,u}DIGIT_FITTING() macros into inline functions to avoid the nested expansion.
This resolves an issue with slackware 15.0 32-bit compilation as reported by Richard Narron.
Presumably the min/max fixups would be difficult to backport, this patch should be easier and fix's Richard's problem in 5.15.
--- drivers/staging/media/atomisp/pci/sh_css_frac.h | 26 +++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
drivers/staging/media/atomisp/pci/sh_css_frac.h +19 -7
@@ -30,12 +30,24 @@#define uISP_VAL_MAX ((unsigned int)((1 << uISP_REG_BIT) - 1))/* a:fraction bits for 16bit precision, b:fraction bits for ISP precision */ -#define sDIGIT_FITTING (v, a, b) \ - min_t(int, max_t(int, (((v) >> sSHIFT) >> max(sFRACTION_BITS_FITTING(a) - (b), 0)), \ - sISP_VAL_MIN), sISP_VAL_MAX) -#define uDIGIT_FITTING (v, a, b) \ - min((unsigned int)max((unsigned)(((v) >> uSHIFT) \ - >> max((int)(uFRACTION_BITS_FITTING(a) - (b)), 0)), \ - uISP_VAL_MIN), uISP_VAL_MAX) +static inline int sDIGIT_FITTING (int v,int a,int b) +{ +int fit_shift =sFRACTION_BITS_FITTING (a) - b; + + v >>= sSHIFT; + v >>= fit_shift >0 ? fit_shift :0 ; + +return clamp_t (int, v, sISP_VAL_MIN, sISP_VAL_MAX); +} + +static inline unsigned int uDIGIT_FITTING (unsigned int v,int a,int b) +{ +int fit_shift =uFRACTION_BITS_FITTING (a) - b; + + v >>= uSHIFT; + v >>= fit_shift >0 ? fit_shift :0 ; + + return clamp_t(unsigned int, v, uISP_VAL_MIN, uISP_VAL_MAX); +}#endif /* __SH_CSS_FRAC_H */
Greg Kroah-Hartman
maintainerPATCH 34/691 net: tighten bad gso csum offset check in virtio_net_hdr
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
commit 6513eb3d3191574b58859ef2d6dc26c0277c6f81 upstream.
The referenced commit drops bad input, but has false positives. Tighten the check to avoid these.
The check detects illegal checksum offload requests, which produce csum_start/csum_off beyond end of packet after segmentation.
But it is based on two incorrect assumptions:
1. virtio_net_hdr_to_skb with VIRTIO_NET_HDR_GSO_TCP[46] implies GSO. True in callers that inject into the tx path, such as tap. But false in callers that inject into rx, like virtio-net. Here, the flags indicate GRO, and CHECKSUM_UNNECESSARY or CHECKSUM_NONE without VIRTIO_NET_HDR_F_NEEDS_CSUM is normal.
2. TSO requires checksum offload, i.e., ip_summed == CHECKSUM_PARTIAL. False, as tcp[46]_gso_segment will fix up csum_start and offset for all other ip_summed by calling __tcp_v4_send_check.
Because of 2, we can limit the scope of the fix to virtio_net_hdr that do try to set these fields, with a bogus value.
--- include/linux/virtio_net.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/linux/virtio_net.h +2 -1
@@ -161,7 +161,8 @@ retry:break ;case SKB_GSO_TCPV4 :case SKB_GSO_TCPV6 : -if (skb->csum_offset != offsetof(struct tcphdr , check)) +if (skb->ip_summed ==CHECKSUM_PARTIAL && + skb->csum_offset != offsetof(struct tcphdr , check))return -EINVAL ;break ; }
Greg Kroah-Hartman
maintainerPATCH 35/691 mm: avoid leaving partial pfn mappings around in error case
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 79a61cc3fc0466ad2b7b89618a6157785f0293b3 upstream.
As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated with the mapping - it is just a raw mapping of PFNs with no reference counting of a 'struct page'.
That's all very much intentional, but it does mean that it's easy to mess up the cleanup in case of errors. Yes, a failed mmap() will always eventually clean up any partial mappings, but without any explicit lifetime in the page table mapping itself, it's very easy to do the error handling in the wrong order.
In particular, it's easy to mistakenly free the physical backing store before the page tables are actually cleaned up and (temporarily) have stale dangling PTE entries.
To make this situation less error-prone, just make sure that any partial pfn mapping is torn down early, before any other error handling.
--- mm/memory.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
mm/memory.c +22 -5
@@ -2380,11 +2380,7 @@ static inline int remap_p4d_range(structreturn 0 ; } -/* -* Variant of remap_pfn_range that does not call track_pfn_remap. The caller -* must have pre-validated the caching bits of the pgprot_t. -*/ -int remap_pfn_range_notrack (struct vm_area_struct *vma,unsigned long addr, +static int remap_pfn_range_internal (struct vm_area_struct *vma,unsigned long addr,unsigned long pfn,unsigned long size,pgprot_t prot) {pgd_t *pgd;
@@ -2437,6 +2433,27 @@ int remap_pfn_range_notrack(struct vm_arreturn 0 ; } +/* +* Variant of remap_pfn_range that does not call track_pfn_remap. The caller +* must have pre-validated the caching bits of the pgprot_t. +*/ +int remap_pfn_range_notrack (struct vm_area_struct *vma,unsigned long addr, +unsigned long pfn,unsigned long size,pgprot_t prot) +{ +int error =remap_pfn_range_internal (vma, addr, pfn, size, prot); + +if (!error) +return 0 ; + +/* +* A partial pfn range mapping is dangerous: it does not +* maintain page reference counts, and callers may free +* pages due to the error. So zap it early. +*/ +zap_page_range_single (vma, addr, size,NULL ); +return error; +} +/** * remap_pfn_range - remap kernel memory to userspace * @vma: user vma to map to
Greg Kroah-Hartman
maintainerPATCH 36/691 fs/ntfs3: Use kvfree to free memory allocated by kvmalloc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
commit ddb17dc880eeaac37b5a6e984de07b882de7d78d upstream.
--- fs/ntfs3/attrlist.c | 4 ++-- fs/ntfs3/bitmap.c | 4 ++-- fs/ntfs3/frecord.c | 4 ++-- fs/ntfs3/super.c | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-)
fs/ntfs3/attrlist.c +2 -2
@@ -29,7 +29,7 @@ static inline bool al_is_valid_le(constvoid al_destroy (struct ntfs_inode *ni) {run_close (&ni->attr_list.run); -kfree (ni->attr_list.le); +kvfree (ni->attr_list.le); ni->attr_list.le =NULL ; ni->attr_list.size =0 ; ni->attr_list.dirty = false;
@@ -318,7 +318,7 @@ int al_add_le(struct ntfs_inode *ni, enumemcpy (ptr, al->le, off);memcpy (Add2Ptr (ptr, off + sz), le, old_size - off); le =Add2Ptr (ptr, off); -kfree (al->le); +kvfree (al->le); al->le = ptr; }else {memmove (Add2Ptr (le, sz), le, old_size - off);
fs/ntfs3/bitmap.c +2 -2
@@ -129,7 +129,7 @@ void wnd_close(struct wnd_bitmap *wnd) {struct rb_node *node, *next; -kfree (wnd->free_bits); +kvfree (wnd->free_bits);run_close (&wnd->run); node =rb_first (&wnd->start_tree);
@@ -1340,7 +1340,7 @@ int wnd_extend(struct wnd_bitmap *wnd, s wnd->nwnd * sizeof(short));memset (new_free + wnd->nwnd,0 , (new_wnd - wnd->nwnd) *sizeof (short )); -kfree (wnd->free_bits); +kvfree (wnd->free_bits); wnd->free_bits = new_free; }
fs/ntfs3/frecord.c +2 -2
@@ -750,7 +750,7 @@ static int ni_try_remove_attr_list(strucrun_deallocate (sbi, &ni->attr_list.run, true);run_close (&ni->attr_list.run); ni->attr_list.size =0 ; -kfree (ni->attr_list.le); +kvfree (ni->attr_list.le); ni->attr_list.le =NULL ; ni->attr_list.dirty = false;
@@ -899,7 +899,7 @@ int ni_create_attr_list(struct ntfs_inod goto out; out1: -kfree (ni->attr_list.le); +kvfree (ni->attr_list.le); ni->attr_list.le =NULL ; ni->attr_list.size =0 ;return err;
fs/ntfs3/super.c +1 -1
@@ -441,7 +441,7 @@ static noinline void put_ntfs(struct ntf {kfree (sbi->new_rec);kvfree (ntfs_put_shared (sbi->upcase)); -kfree (sbi->def_table); +kvfree (sbi->def_table);wnd_close (&sbi->mft.bitmap);wnd_close (&sbi->used.bitmap);
Greg Kroah-Hartman
maintainerPATCH 37/691 arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <[email protected]>
[ Upstream commit c623e9daf60a0275d623ce054601550e54987f5b ]
use GPIO0_A2 as PMIC interrupt pin in pinctrl.
(I forgot to fix this part in previous commit.)
--- arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts +1 -1
@@ -332,7 +332,7 @@ led_pin: led-pin { pmic { pmic_int_l: pmic-int-l { - rockchip,pins = <2 RK_PA6 RK_FUNC_GPIO &pcfg_pull_up>; + rockchip,pins = <0 RK_PA2 RK_FUNC_GPIO &pcfg_pull_up>; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/691 eeprom: digsy_mtc: Fix 93xx46 driver probe failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 2b82641ad0620b2d71dc05024b20f82db7e1c0b6 ]
The update to support other (bigger) types of EEPROMs broke the driver loading due to removal of the default size.
Fix this by adding the respective (new) flag to the platform data.
--- drivers/misc/eeprom/digsy_mtc_eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/eeprom/digsy_mtc_eeprom.c +1 -1
@@ -42,7 +42,7 @@ static void digsy_mtc_op_finish(void *p) }struct eeprom_93xx46_platform_data digsy_mtc_eeprom_data = { - .flags =EE_ADDR8 , + .flags =EE_ADDR8 |EE_SIZE1K , .prepare = digsy_mtc_op_prepare, .finish = digsy_mtc_op_finish, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/691 selftests/bpf: Support SOCK_STREAM in unix_inet_redir_to_connected()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 1b0ad43177c097d38b967b99c2b71d8be28b0223 ]
Function ignores the AF_UNIX socket type argument, SOCK_DGRAM is hardcoded. Fix to respect the argument provided.
--- tools/testing/selftests/bpf/prog_tests/sockmap_listen.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
tools/testing/selftests/bpf/prog_tests/sockmap_listen.c +1 -2
@@ -1911,7 +1911,7 @@ static void unix_inet_redir_to_connected(int family, int type, int sock_mapfd,if (err)return ; -if (socketpair (AF_UNIX ,SOCK_DGRAM |SOCK_NONBLOCK ,0 , sfd)) +if (socketpair (AF_UNIX , type |SOCK_NONBLOCK ,0 , sfd)) goto close_cli0; c1 = sfd[0 ], p1 = sfd[1 ];
@@ -1946,7 +1946,6 @@ static void unix_inet_redir_to_connected(int family, int type, int sock_mapfd, close_cli0:xclose (c0);xclose (p0); - } static void unix_inet_skb_redir_to_connected(struct test_sockmap_listen *skel,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/691 hwmon: (pmbus) Introduce and use write_byte_data callback
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mårten Lindahl <[email protected]>
[ Upstream commit 5de3e13f7f6b496bd7bd9ff4d2b915b7d3e67cda ]
Some of the pmbus core functions uses pmbus_write_byte_data, which does not support driver callbacks for chip specific write operations. This could potentially influence some specific regulator chips that for example need a time delay before each data access.
Lets add support for driver callback with _pmbus_write_byte_data.
Stable-dep-of: 20471071f198 ("hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2")
--- drivers/hwmon/pmbus/pmbus.h | 2 ++ drivers/hwmon/pmbus/pmbus_core.c | 24 +++++++++++++++++++++--- 2 files changed, 23 insertions(+), 3 deletions(-)
drivers/hwmon/pmbus/pmbus.h +2 -0
@@ -438,6 +438,8 @@ struct pmbus_driver_info {int (*read_byte_data)(struct i2c_client *client,int page,int reg);int (*read_word_data)(struct i2c_client *client,int page,int phase,int reg); +int (*write_byte_data)(struct i2c_client *client,int page,int reg, +u8 byte);int (*write_word_data)(struct i2c_client *client,int page,int reg,u16 word);int (*write_byte)(struct i2c_client *client,int page,u8 value);
drivers/hwmon/pmbus/pmbus_core.c +21 -3
@@ -276,6 +276,24 @@ static int _pmbus_write_word_data(struct i2c_client *client, int page, int reg,return pmbus_write_word_data (client, page, reg, word); } +/* +* _pmbus_write_byte_data() is similar to pmbus_write_byte_data(), but checks if +* a device specific mapping function exists and calls it if necessary. +*/ +static int _pmbus_write_byte_data (struct i2c_client *client,int page,int reg,u8 value) +{ +struct pmbus_data *data =i2c_get_clientdata (client); +const struct pmbus_driver_info *info = data->info; +int status; + +if (info->write_byte_data) { + status = info->write_byte_data (client, page, reg, value); +if (status != -ENODATA ) +return status; + } +return pmbus_write_byte_data (client, page, reg, value); +} +int pmbus_update_fan (struct i2c_client *client,int page,int id,u8 config,u8 mask,u16 command) {
@@ -290,7 +308,7 @@ int pmbus_update_fan(struct i2c_client *client, int page, int id, to = (from & ~mask) | (config & mask);if (to != from) { - rv =pmbus_write_byte_data (client, page, + rv =_pmbus_write_byte_data (client, page, pmbus_fan_config_registers[id], to);if (rv <0 )return rv;
@@ -397,7 +415,7 @@ int pmbus_update_byte_data(struct i2c_client *client, int page, u8 reg, tmp = (rv & ~mask) | (value & mask);if (tmp != rv) - rv =pmbus_write_byte_data (client, page, reg, tmp); + rv =_pmbus_write_byte_data (client, page, reg, tmp);return rv; }
@@ -912,7 +930,7 @@ static int pmbus_get_boolean(struct i2c_client *client, struct pmbus_boolean *b, regval = status & mask;if (regval) { - ret =pmbus_write_byte_data (client, page, reg, regval); + ret =_pmbus_write_byte_data (client, page, reg, regval);if (ret) goto unlock; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/691 hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patryk Biel <[email protected]>
[ Upstream commit 20471071f198c8626dbe3951ac9834055b387844 ]
The current implementation of pmbus_show_boolean assumes that all devices support write-back operation of status register to clear pending warnings or faults. Since clearing individual bits in the status registers was only introduced in PMBus specification 1.2, this operation may not be supported by some older devices. This can result in an error while reading boolean attributes such as temp1_max_alarm.
Fetch PMBus revision supported by the device and modify pmbus_show_boolean so that it only tries to clear individual status bits if the device is compliant with PMBus specs >= 1.2. Otherwise clear all fault indicators on the current page after a fault status was reported.
Message-ID: <[email protected]> [groeck:
Rewrote description
Moved revision detection code ahead of clear faults command Assigned revision if return value from PMBUS_REVISION command is 0 Improved return value check from calling _pmbus_write_byte_data()]
--- drivers/hwmon/pmbus/pmbus.h | 6 ++++++ drivers/hwmon/pmbus/pmbus_core.c | 17 ++++++++++++++--- 2 files changed, 20 insertions(+), 3 deletions(-)
drivers/hwmon/pmbus/pmbus.h +6 -0
@@ -409,6 +409,12 @@ enum pmbus_sensor_classes {enum pmbus_data_format { linear =0 , direct, vid };enum vrm_version { vr11 =0 , vr12, vr13, imvp9, amd625mv }; +/* PMBus revision identifiers */ +#define PMBUS_REV_10 0x00/* PMBus revision 1.0 */ +#define PMBUS_REV_11 0x11/* PMBus revision 1.1 */ +#define PMBUS_REV_12 0x22/* PMBus revision 1.2 */ +#define PMBUS_REV_13 0x33/* PMBus revision 1.3 */ +struct pmbus_driver_info {int pages;/* Total number of pages */ u8 phases[PMBUS_PAGES ];/* Number of phases per page */
drivers/hwmon/pmbus/pmbus_core.c +14 -3
@@ -82,6 +82,8 @@ struct pmbus_data {u32 flags;/* from platform data */ +u8 revision;/* The PMBus revision the device is compliant with */ +int exponent[PMBUS_PAGES ];/* linear mode: exponent for output voltages */
@@ -930,9 +932,14 @@ static int pmbus_get_boolean(struct i2c_client *client, struct pmbus_boolean *b, regval = status & mask;if (regval) { - ret =_pmbus_write_byte_data (client, page, reg, regval); -if (ret) - goto unlock; +if (data->revision >=PMBUS_REV_12 ) { + ret =_pmbus_write_byte_data (client, page, reg, regval); +if (ret) + goto unlock; + }else { +pmbus_clear_fault_page (client, page); + } + }if (s1 && s2) {s64 v1, v2;
@@ -2370,6 +2377,10 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data, data->flags |=PMBUS_WRITE_PROTECTED |PMBUS_SKIP_STATUS_CHECK ; } + ret =i2c_smbus_read_byte_data (client,PMBUS_REVISION ); +if (ret >=0 ) + data->revision = ret; +if (data->info->pages)pmbus_clear_faults (client);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/691 ice: fix accounting for filters shared by multiple VSIs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit e843cf7b34fe2e0c1afc55e1f3057375c9b77a14 ]
When adding a switch filter (such as a MAC or VLAN filter), it is expected that the driver will detect the case where the filter already exists, and return -EEXIST. This is used by calling code such as ice_vc_add_mac_addr, and ice_vsi_add_vlan to avoid incrementing the accounting fields such as vsi->num_vlan or vf->num_mac.
This logic works correctly for the case where only a single VSI has added a given switch filter.
When a second VSI adds the same switch filter, the driver converts the existing filter from an ICE_FWD_TO_VSI filter into an ICE_FWD_TO_VSI_LIST filter. This saves switch resources, by ensuring that multiple VSIs can re-use the same filter.
The ice_add_update_vsi_list() function is responsible for doing this conversion. When first converting a filter from the FWD_TO_VSI into FWD_TO_VSI_LIST, it checks if the VSI being added is the same as the existing rule's VSI. In such a case it returns -EEXIST.
However, when the switch rule has already been converted to a FWD_TO_VSI_LIST, the logic is different. Adding a new VSI in this case just requires extending the VSI list entry. The logic for checking if the rule already exists in this case returns 0 instead of -EEXIST.
This breaks the accounting logic mentioned above, so the counters for how many MAC and VLAN filters exist for a given VF or VSI no longer accurately reflect the actual count. This breaks other code which relies on these counts.
In typical usage this primarily affects such filters generally shared by multiple VSIs such as VLAN 0, or broadcast and multicast MAC addresses.
Fix this by correctly reporting -EEXIST in the case of adding the same VSI to a switch rule already converted to ICE_FWD_TO_VSI_LIST.
--- drivers/net/ethernet/intel/ice/ice_switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_switch.c +1 -1
@@ -1286,7 +1286,7 @@ ice_add_update_vsi_list(struct ice_hw *hw,/* A rule already exists with the new VSI being added */ if (test_bit (vsi_handle, m_entry->vsi_list_info->vsi_map)) -return 0 ; +return -EEXIST ;/* Update the previously created VSI list set with * the new VSI ID passed in
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/691 igb: Always call igb_xdp_ring_update_tail() under Tx lock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sriram Yagnaraman <[email protected]>
[ Upstream commit 27717f8b17c098c4373ddb8fe89e1a1899c7779d ]
Always call igb_xdp_ring_update_tail() under __netif_tx_lock, add a comment and lockdep assert to indicate that. This is needed to share the same TX ring between XDP, XSK and slow paths. Furthermore, the current XDP implementation is racy on tail updates.
--- drivers/net/ethernet/intel/igb/igb_main.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/igb/igb_main.c +13 -4
@@ -34,6 +34,7 @@#include <linux/bpf_trace.h> #include <linux/pm_runtime.h> #include <linux/etherdevice.h> +#include <linux/lockdep.h> #ifdef CONFIG_IGB_DCA #include <linux/dca.h> #endif
@@ -2893,8 +2894,11 @@ static int igb_xdp(struct net_device *dev, struct netdev_bpf *xdp) } } +/* This function assumes __netif_tx_lock is held by the caller. */ static void igb_xdp_ring_update_tail (struct igb_ring *ring) { +lockdep_assert_held (&txring_txq (ring)->_xmit_lock); +/* Force memory writes to complete before letting h/w know there * are new descriptors to fetch. */
@@ -2979,11 +2983,11 @@ static int igb_xdp_xmit(struct net_device *dev, int n, nxmit++; } -__netif_tx_unlock (nq); -if (unlikely (flags &XDP_XMIT_FLUSH ))igb_xdp_ring_update_tail (tx_ring); +__netif_tx_unlock (nq); +return nxmit; }
@@ -8703,12 +8707,14 @@ static void igb_put_rx_buffer(struct igb_ring *rx_ring,static int igb_clean_rx_irq (struct igb_q_vector *q_vector,const int budget) { +unsigned int total_bytes =0 , total_packets =0 ;struct igb_adapter *adapter = q_vector->adapter;struct igb_ring *rx_ring = q_vector->rx.ring; -struct sk_buff *skb = rx_ring->skb; -unsigned int total_bytes =0 , total_packets =0 ;u16 cleaned_count =igb_desc_unused (rx_ring); +struct sk_buff *skb = rx_ring->skb; +int cpu =smp_processor_id ();unsigned int xdp_xmit =0 ; +struct netdev_queue *nq;struct xdp_buff xdp;u32 frame_sz =0 ;int rx_buf_pgcnt;
@@ -8835,7 +8841,10 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)if (xdp_xmit &IGB_XDP_TX ) {struct igb_ring *tx_ring =igb_xdp_tx_queue_mapping (adapter); + nq =txring_txq (tx_ring); +__netif_tx_lock (nq, cpu);igb_xdp_ring_update_tail (tx_ring); +__netif_tx_unlock (nq); }u64_stats_update_begin (&rx_ring->rx_syncp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/691 net/mlx5e: Add missing link modes to ptys2ethtool_map
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Shitrit <[email protected]>
[ Upstream commit 7617d62cba4a8a3ff3ed3fda0171c43f135c142e ]
Add MLX5E_1000BASE_T and MLX5E_100BASE_TX to the legacy modes in ptys2legacy_ethtool_table, since they were missing.
--- drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +4 -0
@@ -129,6 +129,10 @@ void mlx5e_build_ptys2ethtool_map(void) ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT);MLX5_BUILD_PTYS2ETHTOOL_CONFIG (MLX5E_100GBASE_LR4 , legacy, ETHTOOL_LINK_MODE_100000baseLR4_ER4_Full_BIT); +MLX5_BUILD_PTYS2ETHTOOL_CONFIG (MLX5E_100BASE_TX , legacy, + ETHTOOL_LINK_MODE_100baseT_Full_BIT); +MLX5_BUILD_PTYS2ETHTOOL_CONFIG (MLX5E_1000BASE_T , legacy, + ETHTOOL_LINK_MODE_1000baseT_Full_BIT);MLX5_BUILD_PTYS2ETHTOOL_CONFIG (MLX5E_10GBASE_T , legacy, ETHTOOL_LINK_MODE_10000baseT_Full_BIT); MLX5_BUILD_PTYS2ETHTOOL_CONFIG(MLX5E_25GBASE_CR, legacy,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/691 net/mlx5: Explicitly set scheduling element and TSAR type
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit c88146abe4d0f8cf659b2b8883fdc33936d2e3b8 ]
Ensure the scheduling element type and TSAR type are explicitly initialized in the QoS rate group creation.
This prevents potential issues due to default values.
--- drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c +7 -0
@@ -424,6 +424,7 @@ esw_qos_create_rate_group(struct mlx5_eswitch *esw, struct netlink_ext_ack *exta {u32 tsar_ctx[MLX5_ST_SZ_DW (scheduling_context)] = {};struct mlx5_esw_rate_group *group; +__be32 *attr;u32 divider;int err;
@@ -434,6 +435,12 @@ esw_qos_create_rate_group(struct mlx5_eswitch *esw, struct netlink_ext_ack *extaif (!group)return ERR_PTR (-ENOMEM ); +MLX5_SET (scheduling_context, tsar_ctx, element_type, +SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR ); + + attr =MLX5_ADDR_OF (scheduling_context, tsar_ctx, element_attributes); + *attr =cpu_to_be32 (TSAR_ELEMENT_TSAR_TYPE_DWRR <<16 ); +MLX5_SET (scheduling_context, tsar_ctx, parent_element_id, esw->qos.root_tsar_ix); err = mlx5_create_scheduling_element_cmd(esw->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/691 net/mlx5: Add support to create match definer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maor Gottlieb <[email protected]>
[ Upstream commit e7e2519e3632396a25031b7e828ed35332e5dd07 ]
Introduce new APIs to create and destroy flow matcher for given format id.
Flow match definer object is used for defining the fields and mask used for the hash calculation. User should mask the desired fields like done in the match criteria.
This object is assigned to flow group of type hash. In this flow group type, packets lookup is done based on the hash result.
This patch also adds the required bits to create such flow group.
Stable-dep-of: 452ef7f86036 ("net/mlx5: Add missing masks and QoS bit masks for scheduling elements")
--- .../net/ethernet/mellanox/mlx5/core/fs_cmd.c | 57 ++++ .../net/ethernet/mellanox/mlx5/core/fs_cmd.h | 4 + .../net/ethernet/mellanox/mlx5/core/fs_core.c | 46 +++ .../net/ethernet/mellanox/mlx5/core/fs_core.h | 5 + .../mellanox/mlx5/core/steering/fs_dr.c | 15 + include/linux/mlx5/fs.h | 8 + include/linux/mlx5/mlx5_ifc.h | 272 ++++++++++++++++-- 7 files changed, 380 insertions(+), 27 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c +57 -0
@@ -185,6 +185,20 @@ static int mlx5_cmd_set_slave_root_fdb(struct mlx5_core_dev *master,return mlx5_cmd_exec (slave, in,sizeof (in), out,sizeof (out)); } +static int +mlx5_cmd_stub_destroy_match_definer (struct mlx5_flow_root_namespace *ns, +int definer_id) +{ +return 0 ; +} + +static int +mlx5_cmd_stub_create_match_definer (struct mlx5_flow_root_namespace *ns, +u16 format_id,u32 *match_mask) +{ +return 0 ; +} +static int mlx5_cmd_update_root_ft (struct mlx5_flow_root_namespace *ns,struct mlx5_flow_table *ft,u32 underlay_qpn,bool disconnect)
@@ -909,6 +923,45 @@ static void mlx5_cmd_modify_header_dealloc(struct mlx5_flow_root_namespace *ns,mlx5_cmd_exec_in (dev, dealloc_modify_header_context, in); } +static int mlx5_cmd_destroy_match_definer (struct mlx5_flow_root_namespace *ns, +int definer_id) +{ +u32 in[MLX5_ST_SZ_DW (general_obj_in_cmd_hdr)] = {}; +u32 out[MLX5_ST_SZ_DW (general_obj_out_cmd_hdr)]; + +MLX5_SET (general_obj_in_cmd_hdr, in, opcode, +MLX5_CMD_OP_DESTROY_GENERAL_OBJECT ); +MLX5_SET (general_obj_in_cmd_hdr, in, obj_type, +MLX5_OBJ_TYPE_MATCH_DEFINER ); +MLX5_SET (general_obj_in_cmd_hdr, in, obj_id, definer_id); + +return mlx5_cmd_exec (ns->dev, in,sizeof (in), out,sizeof (out)); +} + +static int mlx5_cmd_create_match_definer (struct mlx5_flow_root_namespace *ns, +u16 format_id,u32 *match_mask) +{ +u32 out[MLX5_ST_SZ_DW (create_match_definer_out)] = {}; +u32 in[MLX5_ST_SZ_DW (create_match_definer_in)] = {}; +struct mlx5_core_dev *dev = ns->dev; +void *ptr; +int err; + +MLX5_SET (create_match_definer_in, in, general_obj_in_cmd_hdr.opcode, +MLX5_CMD_OP_CREATE_GENERAL_OBJECT ); +MLX5_SET (create_match_definer_in, in, general_obj_in_cmd_hdr.obj_type, +MLX5_OBJ_TYPE_MATCH_DEFINER ); + + ptr =MLX5_ADDR_OF (create_match_definer_in, in, obj_context); +MLX5_SET (match_definer, ptr, format_id, format_id); + + ptr =MLX5_ADDR_OF (match_definer, ptr, match_mask); +memcpy (ptr, match_mask,MLX5_FLD_SZ_BYTES (match_definer, match_mask)); + + err =mlx5_cmd_exec_inout (dev, create_match_definer, in, out); +return err ? err :MLX5_GET (general_obj_out_cmd_hdr, out, obj_id); +} +static const struct mlx5_flow_cmds mlx5_flow_cmds = { .create_flow_table = mlx5_cmd_create_flow_table, .destroy_flow_table = mlx5_cmd_destroy_flow_table,
@@ -923,6 +976,8 @@ static const struct mlx5_flow_cmds mlx5_flow_cmds = { .packet_reformat_dealloc = mlx5_cmd_packet_reformat_dealloc, .modify_header_alloc = mlx5_cmd_modify_header_alloc, .modify_header_dealloc = mlx5_cmd_modify_header_dealloc, + .create_match_definer = mlx5_cmd_create_match_definer, + .destroy_match_definer = mlx5_cmd_destroy_match_definer, .set_peer = mlx5_cmd_stub_set_peer, .create_ns = mlx5_cmd_stub_create_ns, .destroy_ns = mlx5_cmd_stub_destroy_ns,
@@ -942,6 +997,8 @@ static const struct mlx5_flow_cmds mlx5_flow_cmd_stubs = { .packet_reformat_dealloc = mlx5_cmd_stub_packet_reformat_dealloc, .modify_header_alloc = mlx5_cmd_stub_modify_header_alloc, .modify_header_dealloc = mlx5_cmd_stub_modify_header_dealloc, + .create_match_definer = mlx5_cmd_stub_create_match_definer, + .destroy_match_definer = mlx5_cmd_stub_destroy_match_definer, .set_peer = mlx5_cmd_stub_set_peer, .create_ns = mlx5_cmd_stub_create_ns, .destroy_ns = mlx5_cmd_stub_destroy_ns,
drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h +4 -0
@@ -97,6 +97,10 @@ struct mlx5_flow_cmds {int (*create_ns)(struct mlx5_flow_root_namespace *ns);int (*destroy_ns)(struct mlx5_flow_root_namespace *ns); +int (*create_match_definer)(struct mlx5_flow_root_namespace *ns, +u16 format_id,u32 *match_mask); +int (*destroy_match_definer)(struct mlx5_flow_root_namespace *ns, +int definer_id); };int mlx5_cmd_fc_alloc (struct mlx5_core_dev *dev,u32 *id);
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +46 -0
52 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/fs_core.h +5 -0
@@ -49,6 +49,11 @@#define FDB_TC_MAX_PRIO 16#define FDB_TC_LEVELS_PER_PRIO 2 +struct mlx5_flow_definer { +enum mlx5_flow_namespace_type ns_type; +u32 id; +}; +struct mlx5_modify_hdr {enum mlx5_flow_namespace_type ns_type;union {
drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c +15 -0
@@ -626,6 +626,19 @@ static void mlx5_cmd_dr_modify_header_dealloc(struct mlx5_flow_root_namespace *nmlx5dr_action_destroy (modify_hdr->action.dr_action); } +static int +mlx5_cmd_dr_destroy_match_definer (struct mlx5_flow_root_namespace *ns, +int definer_id) +{ +return -EOPNOTSUPP ; +} + +static int mlx5_cmd_dr_create_match_definer (struct mlx5_flow_root_namespace *ns, +u16 format_id,u32 *match_mask) +{ +return -EOPNOTSUPP ; +} +static int mlx5_cmd_dr_delete_fte (struct mlx5_flow_root_namespace *ns,struct mlx5_flow_table *ft,struct fs_fte *fte)
@@ -728,6 +741,8 @@ static const struct mlx5_flow_cmds mlx5_flow_cmds_dr = { .packet_reformat_dealloc = mlx5_cmd_dr_packet_reformat_dealloc, .modify_header_alloc = mlx5_cmd_dr_modify_header_alloc, .modify_header_dealloc = mlx5_cmd_dr_modify_header_dealloc, + .create_match_definer = mlx5_cmd_dr_create_match_definer, + .destroy_match_definer = mlx5_cmd_dr_destroy_match_definer, .set_peer = mlx5_cmd_dr_set_peer, .create_ns = mlx5_cmd_dr_create_ns, .destroy_ns = mlx5_cmd_dr_destroy_ns,
include/linux/mlx5/fs.h +8 -0
@@ -97,6 +97,7 @@ enum {struct mlx5_pkt_reformat ;struct mlx5_modify_hdr ; +struct mlx5_flow_definer ;struct mlx5_flow_table ;struct mlx5_flow_group ;struct mlx5_flow_namespace ;
@@ -257,6 +258,13 @@ struct mlx5_modify_hdr *mlx5_modify_header_alloc(struct mlx5_core_dev *dev, void *modify_actions);void mlx5_modify_header_dealloc (struct mlx5_core_dev *dev,struct mlx5_modify_hdr *modify_hdr); +struct mlx5_flow_definer * +mlx5_create_match_definer (struct mlx5_core_dev *dev, +enum mlx5_flow_namespace_type ns_type,u16 format_id, +u32 *match_mask); +void mlx5_destroy_match_definer (struct mlx5_core_dev *dev, +struct mlx5_flow_definer *definer); +int mlx5_get_match_definer_id (struct mlx5_flow_definer *definer);struct mlx5_pkt_reformat_params {int type;
include/linux/mlx5/mlx5_ifc.h +245 -27
320 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/691 net/mlx5: Add IFC bits and enums for flow meter
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit f5d23ee137e51b4e5cd5d263b144d5e6719f6e52 ]
Add/extend structure layouts and defines for flow meter.
Stable-dep-of: 452ef7f86036 ("net/mlx5: Add missing masks and QoS bit masks for scheduling elements")
--- include/linux/mlx5/device.h | 1 + include/linux/mlx5/mlx5_ifc.h | 114 ++++++++++++++++++++++++++++++++-- 2 files changed, 111 insertions(+), 4 deletions(-)
include/linux/mlx5/device.h +1 -0
@@ -454,6 +454,7 @@ enum {MLX5_OPCODE_UMR =0x25 , + MLX5_OPCODE_ACCESS_ASO = 0x2d, }; enum {
include/linux/mlx5/mlx5_ifc.h +110 -4
168 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/691 net/mlx5: Add missing masks and QoS bit masks for scheduling elements
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit 452ef7f86036392005940de54228d42ca0044192 ]
Add the missing masks for supported element types and Transmit Scheduling Arbiter (TSAR) types in scheduling elements.
Also, add the corresponding bit masks for these types in the QoS capabilities of a NIC scheduler.
--- include/linux/mlx5/mlx5_ifc.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
include/linux/mlx5/mlx5_ifc.h +9 -1
@@ -891,7 +891,8 @@ struct mlx5_ifc_qos_cap_bits {u8 max_tsar_bw_share[0x20 ]; -u8 reserved_at_100[0x20 ]; +u8 nic_element_type[0x10 ]; +u8 nic_tsar_type[0x10 ];u8 reserved_at_120[0x3 ];u8 log_meter_aso_granularity[0x5 ];
@@ -3521,6 +3522,7 @@ enum {ELEMENT_TYPE_CAP_MASK_VPORT =1 <<1 ,ELEMENT_TYPE_CAP_MASK_VPORT_TC =1 <<2 ,ELEMENT_TYPE_CAP_MASK_PARA_VPORT_TC =1 <<3 , + ELEMENT_TYPE_CAP_MASK_QUEUE_GROUP = 1 << 4, }; struct mlx5_ifc_scheduling_context_bits {
@@ -4187,6 +4189,12 @@ enum { TSAR_ELEMENT_TSAR_TYPE_ETS = 0x2, }; +enum { +TSAR_TYPE_CAP_MASK_DWRR =1 <<0 , +TSAR_TYPE_CAP_MASK_ROUND_ROBIN =1 <<1 , +TSAR_TYPE_CAP_MASK_ETS =1 <<2 , +}; +struct mlx5_ifc_tsar_element_bits {u8 reserved_at_0[0x8 ];u8 tsar_type[0x8 ];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/691 fou: fix initialization of grc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
[ Upstream commit 4c8002277167125078e6b9b90137bdf443ebaa08 ]
The grc must be initialize first. There can be a condition where if fou is NULL, goto out will be executed and grc would be used uninitialized.
--- net/ipv4/fou.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv4/fou.c +2 -2
@@ -334,11 +334,11 @@ static struct sk_buff *gue_gro_receive(struct sock *sk,struct gro_remcsum grc;u8 proto; +skb_gro_remcsum_init (&grc); +if (!fou) goto out; -skb_gro_remcsum_init (&grc); - off =skb_gro_offset (skb); len = off +sizeof (*guehdr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/691 octeontx2-af: Set XOFF on other child transmit schedulers during SMQ flush
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen Mamindlapalli <[email protected]>
[ Upstream commit e18aab0470d8f6259be82282ffb3fdcfeaeff6c3 ]
When multiple transmit scheduler queues feed a TL1 transmit link, the SMQ flush initiated on a low priority queue might get stuck when a high priority queue fully subscribes the transmit link. This inturn effects interface teardown. To avoid this, temporarily XOFF all TL1's other immediate child transmit scheduler queues and also clear any rate limit configuration on all the scheduler queues in SMQ(flush) hierarchy.
Stable-dep-of: 019aba04f08c ("octeontx2-af: Modify SMQ flush sequence to drop packets")
--- .../net/ethernet/marvell/octeontx2/af/rvu.h | 16 +++ .../ethernet/marvell/octeontx2/af/rvu_nix.c | 130 +++++++++++++++++- 2 files changed, 144 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu.h +16 -0
@@ -277,6 +277,22 @@ struct nix_mark_format {u32 *cfg; }; +/* smq(flush) to tl1 cir/pir info */ +struct nix_smq_tree_ctx { +u64 cir_off; +u64 cir_val; +u64 pir_off; +u64 pir_val; +}; + +/* smq flush context */ +struct nix_smq_flush_ctx { +int smq; +u16 tl1_schq; +u16 tl2_schq; +struct nix_smq_tree_ctx smq_tree_ctx[NIX_TXSCH_LVL_CNT ]; +}; +struct npc_pkind {struct rsrc_bmap rsrc;u32 *pfchan_map;
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +128 -2
151 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/691 octeontx2-af: Modify SMQ flush sequence to drop packets
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen Mamindlapalli <[email protected]>
[ Upstream commit 019aba04f08c2102b35ce7fee9d4628d349f56c0 ]
The current implementation of SMQ flush sequence waits for the packets in the TM pipeline to be transmitted out of the link. This sequence doesn't succeed in HW when there is any issue with link such as lack of link credits, link down or any other traffic that is fully occupying the link bandwidth (QoS). This patch modifies the SMQ flush sequence to drop the packets after TL1 level (SQM) instead of polling for the packets to be sent out of RPM/CGX link.
--- .../net/ethernet/marvell/octeontx2/af/rvu.h | 3 +- .../ethernet/marvell/octeontx2/af/rvu_nix.c | 59 +++++++++++++++---- 2 files changed, 48 insertions(+), 14 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu.h +1 -2
@@ -279,6 +279,7 @@ struct nix_mark_format {/* smq(flush) to tl1 cir/pir info */ struct nix_smq_tree_ctx { +u16 schq;u64 cir_off;u64 cir_val;u64 pir_off;
@@ -288,8 +289,6 @@ struct nix_smq_tree_ctx {/* smq flush context */ struct nix_smq_flush_ctx {int smq; -u16 tl1_schq; -u16 tl2_schq;struct nix_smq_tree_ctx smq_tree_ctx[NIX_TXSCH_LVL_CNT ]; };
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +47 -12
117 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/691 net: ftgmac100: Enable TX interrupt to avoid TX timeout
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Chou <[email protected]>
[ Upstream commit fef2843bb49f414d1523ca007d088071dee0e055 ]
Currently, the driver only enables RX interrupt to handle RX packets and TX resources. Sometimes there is not RX traffic, so the TX resource needs to wait for RX interrupt to free. This situation will toggle the TX timeout watchdog when the MAC TX ring has no more resources to transmit packets. Therefore, enable TX interrupt to release TX resources at any time.
When I am verifying iperf3 over UDP, the network hangs. Like the log below.
root# iperf3 -c 192.168.100.100 -i1 -t10 -u -b0
Connecting to host 192.168.100.100, port 5201
[ 4] local 192.168.100.101 port 35773 connected to 192.168.100.100 port 5201
[ ID] Interval Transfer Bandwidth Total Datagrams [ 4] 0.00-20.42 sec 160 KBytes 64.2 Kbits/sec 20 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bandwidth Jitter Lost/Total Datagrams
[ 4] 0.00-20.42 sec 160 KBytes 64.2 Kbits/sec 0.000 ms 0/20 (0%)
[ 4] Sent 20 datagrams
iperf3: error - the server has terminated
The network topology is FTGMAC connects directly to a PC.
UDP does not need to wait for ACK, unlike TCP.
Therefore, FTGMAC needs to enable TX interrupt to release TX resources instead of waiting for the RX interrupt.
--- drivers/net/ethernet/faraday/ftgmac100.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/faraday/ftgmac100.h +1 -1
@@ -84,7 +84,7 @@ FTGMAC100_INT_RPKT_BUF)/* All the interrupts we care about */ -#define FTGMAC100_INT_ALL (FTGMAC100_INT_RPKT_BUF | \ +#define FTGMAC100_INT_ALL (FTGMAC100_INT_RXTX | \ FTGMAC100_INT_BAD)/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/691 netfilter: nft_socket: fix sk refcount leaks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c ]
We must put 'sk' reference before returning.
--- net/netfilter/nft_socket.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/netfilter/nft_socket.c +4 -3
@@ -108,13 +108,13 @@ static void nft_socket_eval(const struct nft_expr *expr, *dest = sk->sk_mark; }else { regs->verdict.code =NFT_BREAK ; -return ; + goto out_put_sk; }break ;case NFT_SOCKET_WILDCARD :if (!sk_fullsock (sk)) { regs->verdict.code =NFT_BREAK ; -return ; + goto out_put_sk; }nft_socket_wildcard (pkt, regs, sk, dest);break ;
@@ -122,7 +122,7 @@ static void nft_socket_eval(const struct nft_expr *expr,case NFT_SOCKET_CGROUPV2 :if (!nft_sock_get_eval_cgroupv2 (dest, sk, pkt, priv->level)) { regs->verdict.code =NFT_BREAK ; -return ; + goto out_put_sk; }break ;#endif
@@ -131,6 +131,7 @@ static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code =NFT_BREAK ; } +out_put_sk:if (sk != skb->sk)sock_gen_put (sk); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/691 net: dpaa: Pad packets to ETH_ZLEN
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 ]
When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running
$ ping -s 11 destination
--- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +8 -1
@@ -2269,12 +2269,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); -bool nonlinear =skb_is_nonlinear (skb);struct rtnl_link_stats64 *percpu_stats;struct dpaa_percpu_priv *percpu_priv;struct netdev_queue *txq;struct dpaa_priv *priv;struct qm_fd fd; +bool nonlinear;int offset =0 ;int err =0 ;
@@ -2284,6 +2284,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)qm_fd_clear_fd (&fd); +/* Packet data is always read as 32-bit words, so zero out any part of +* the skb which might be sent if we have to pad the packet +*/ +if (__skb_put_padto (skb,ETH_ZLEN , false)) + goto enomem; + + nonlinear =skb_is_nonlinear (skb);if (!nonlinear) {/* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/691 spi: nxp-fspi: fix the KASAN report out-of-bounds bug
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Xu <[email protected]>
commit 2a8787c1cdc7be24fdd8953ecd1a8743a1006235 upstream.
Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO.
To reproduce the issue, write 3 bytes data to NOR chip.
dd if=3b of=/dev/mtd0
[ 36.926103] ================================================================== [ 36.933409] BUG: KASAN: slab-out-of-bounds in nxp_fspi_exec_op+0x26ec/0x2838 [ 36.940514] Read of size 4 at addr ffff00081037c2a0 by task dd/455 [ 36.946721] [ 36.948235] CPU: 3 UID: 0 PID: 455 Comm: dd Not tainted 6.11.0-rc5-gc7b0e37c8434 #1070 [ 36.956185] Hardware name: Freescale i.MX8QM MEK (DT) [ 36.961260] Call trace: [ 36.963723] dump_backtrace+0x90/0xe8 [ 36.967414] show_stack+0x18/0x24 [ 36.970749] dump_stack_lvl+0x78/0x90 [ 36.974451] print_report+0x114/0x5cc [ 36.978151] kasan_report+0xa4/0xf0 [ 36.981670] __asan_report_load_n_noabort+0x1c/0x28 [ 36.986587] nxp_fspi_exec_op+0x26ec/0x2838 [ 36.990800] spi_mem_exec_op+0x8ec/0xd30 [ 36.994762] spi_mem_no_dirmap_read+0x190/0x1e0 [ 36.999323] spi_mem_dirmap_write+0x238/0x32c [ 37.003710] spi_nor_write_data+0x220/0x374 [ 37.007932] spi_nor_write+0x110/0x2e8 [ 37.011711] mtd_write_oob_std+0x154/0x1f0 [ 37.015838] mtd_write_oob+0x104/0x1d0 [ 37.019617] mtd_write+0xb8/0x12c [ 37.022953] mtdchar_write+0x224/0x47c [ 37.026732] vfs_write+0x1e4/0x8c8 [ 37.030163] ksys_write+0xec/0x1d0 [ 37.033586] __arm64_sys_write+0x6c/0x9c [ 37.037539] invoke_syscall+0x6c/0x258 [ 37.041327] el0_svc_common.constprop.0+0x160/0x22c [ 37.046244] do_el0_svc+0x44/0x5c [ 37.049589] el0_svc+0x38/0x78 [ 37.052681] el0t_64_sync_handler+0x13c/0x158 [ 37.057077] el0t_64_sync+0x190/0x194 [ 37.060775] [ 37.062274] Allocated by task 455: [ 37.065701] kasan_save_stack+0x2c/0x54 [ 37.069570] kasan_save_track+0x20/0x3c [ 37.073438] kasan_save_alloc_info+0x40/0x54 [ 37.077736] __kasan_kmalloc+0xa0/0xb8 [ 37.081515] __kmalloc_noprof+0x158/0x2f8 [ 37.085563] mtd_kmalloc_up_to+0x120/0x154 [ 37.089690] mtdchar_write+0x130/0x47c [ 37.093469] vfs_write+0x1e4/0x8c8 [ 37.096901] ksys_write+0xec/0x1d0 [ 37.100332] __arm64_sys_write+0x6c/0x9c [ 37.104287] invoke_syscall+0x6c/0x258 [ 37.108064] el0_svc_common.constprop.0+0x160/0x22c [ 37.112972] do_el0_svc+0x44/0x5c [ 37.116319] el0_svc+0x38/0x78 [ 37.119401] el0t_64_sync_handler+0x13c/0x158 [ 37.123788] el0t_64_sync+0x190/0x194 [ 37.127474] [ 37.128977] The buggy address belongs to the object at ffff00081037c2a0 [ 37.128977] which belongs to the cache kmalloc-8 of size 8 [ 37.141177] The buggy address is located 0 bytes inside of [ 37.141177] allocated 3-byte region [ffff00081037c2a0, ffff00081037c2a3) [ 37.153465] [ 37.154971] The buggy address belongs to the physical page: [ 37.160559] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89037c [ 37.168596] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 37.175149] page_type: 0xfdffffff(slab) [ 37.179021] raw: 0bfffe0000000000 ffff000800002500 dead000000000122 0000000000000000 [ 37.186788] raw: 0000000000000000 0000000080800080 00000001fdffffff 0000000000000000 [ 37.194553] page dumped because: kasan: bad access detected [ 37.200144] [ 37.201647] Memory state around the buggy address: [ 37.206460] ffff00081037c180: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 37.213701] ffff00081037c200: fa fc fc fc 05 fc fc fc 03 fc fc fc 02 fc fc fc [ 37.220946] >ffff00081037c280: 06 fc fc fc 03 fc fc fc fc fc fc fc fc fc fc fc [ 37.228186] ^ [ 37.232473] ffff00081037c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.239718] ffff00081037c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.246962] ================================================================== [ 37.254394] Disabling lock debugging due to kernel taint
0+1 records in
0+1 records out
3 bytes copied, 0.335911 s, 0.0 kB/s
--- drivers/spi/spi-nxp-fspi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/spi/spi-nxp-fspi.c +3 -2
@@ -754,14 +754,15 @@ static void nxp_fspi_fill_txfifo(structif (i < op->data.nbytes) {u32 data =0 ;int j; +int remaining = op->data.nbytes - i;/* Wait for TXFIFO empty */ ret =fspi_readl_poll_tout (f, f->iobase +FSPI_INTR ,FSPI_INTR_IPTXWE ,0 ,POLL_TOUT , true);WARN_ON (ret); -for (j =0 ; j <ALIGN (op->data.nbytes - i,4 ); j +=4 ) { -memcpy (&data, buf + i + j,4 ); +for (j =0 ; j <ALIGN (remaining,4 ); j +=4 ) { +memcpy (&data, buf + i + j,min_t (int,4 , remaining - j));fspi_writel (f, data, base +FSPI_TFDR + j); }fspi_writel (f,FSPI_INTR_IPTXWE , base +FSPI_INTR );
Greg Kroah-Hartman
maintainerPATCH 56/691 soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 233a95fd574fde1c375c486540a90304a2d2d49f upstream.
This reverts commit ab8d66d132bc8f1992d3eb6cab8d32dda6733c84 because it breaks codecs using non-continuous masks in source and sink ports. The commit missed the point that port numbers are not used as indices for iterating over prop.sink_ports or prop.source_ports.
Soundwire core and existing codecs expect that the array passed as prop.sink_ports and prop.source_ports is continuous. The port mask still might be non-continuous, but that's unrelated.
--- drivers/soundwire/stream.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soundwire/stream.c +4 -4
@@ -1445,18 +1445,18 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_p unsigned int port_num) {struct sdw_dpn_prop *dpn_prop; -unsigned long mask; +u8 num_ports;int i;if (direction ==SDW_DATA_DIR_TX ) { - mask = slave->prop.source_ports; + num_ports =hweight32 (slave->prop.source_ports); dpn_prop = slave->prop.src_dpn_prop; }else { - mask = slave->prop.sink_ports; + num_ports =hweight32 (slave->prop.sink_ports); dpn_prop = slave->prop.sink_dpn_prop; } -for_each_set_bit (i, &mask,32 ) { +for (i =0 ; i < num_ports; i++) {if (dpn_prop[i].num == port_num)return &dpn_prop[i]; }
Greg Kroah-Hartman
maintainerPATCH 57/691 dma-buf: heaps: Fix off-by-one in CMA heap fault handler
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: T.J. Mercier <[email protected]>
commit ea5ff5d351b520524019f7ff7f9ce418de2dad87 upstream.
Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps:
Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma_buf_mmap_internal. When using such a mapping to attempt to fault past the end of the buffer, the CMA heap fault handler also checks the fault offset against the buffer size, but gets the boundary wrong by
1. Fix the boundary check so that we don't read off the end of the pages array and insert an arbitrary page in the mapping.
--- drivers/dma-buf/heaps/cma_heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma-buf/heaps/cma_heap.c +1 -1
@@ -165,7 +165,7 @@ static vm_fault_t cma_heap_vm_fault(strustruct vm_area_struct *vma = vmf->vma;struct cma_heap_buffer *buffer = vma->vm_private_data; -if (vmf->pgoff > buffer->pagecount) +if (vmf->pgoff >= buffer->pagecount)return VM_FAULT_SIGBUS ; vmf->page = buffer->pages[vmf->pgoff];
Greg Kroah-Hartman
maintainerPATCH 58/691 ASoC: meson: axg-card: fix use-after-free
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <[email protected]>
commit 4f9a71435953f941969a4f017e2357db62d85a86 upstream.
Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()', so move 'pad' pointer initialization after this function when memory is already reallocated.
Kasan bug report:
==================================================================
BUG: KASAN: slab-use-after-free in axg_card_add_link+0x76c/0x9bc Read of size 8 at addr ffff000000e8b260 by task modprobe/356 CPU: 0 PID: 356 Comm: modprobe Tainted: G O 6.9.12-sdkernel #1 Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x78/0x90 print_report+0xfc/0x5c0 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 axg_card_add_link+0x76c/0x9bc [snd_soc_meson_axg_sound_card] meson_card_probe+0x344/0x3b8 [snd_soc_meson_card_utils] platform_probe+0x8c/0xf4 really_probe+0x110/0x39c __driver_probe_device+0xb8/0x18c driver_probe_device+0x108/0x1d8 __driver_attach+0xd0/0x25c bus_for_each_dev+0xe0/0x154 driver_attach+0x34/0x44 bus_add_driver+0x134/0x294 driver_register+0xa8/0x1e8 __platform_driver_register+0x44/0x54 axg_card_pdrv_init+0x20/0x1000 [snd_soc_meson_axg_sound_card] do_one_initcall+0xdc/0x25c do_init_module+0x10c/0x334 load_module+0x24c4/0x26cc init_module_from_file+0xd4/0x128 __arm64_sys_finit_module+0x1f4/0x41c invoke_syscall+0x60/0x188 el0_svc_common.constprop.0+0x78/0x13c do_el0_svc+0x30/0x40 el0_svc+0x38/0x78 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194
--- sound/soc/meson/axg-card.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/meson/axg-card.c +2 -1
@@ -104,7 +104,7 @@ static int axg_card_add_tdm_loopback(str int *index) {struct meson_card *priv =snd_soc_card_get_drvdata (card); -struct snd_soc_dai_link *pad = &card->dai_link[*index]; +struct snd_soc_dai_link *pad;struct snd_soc_dai_link *lb;struct snd_soc_dai_link_component *dlc;int ret;
@@ -114,6 +114,7 @@ static int axg_card_add_tdm_loopback(strif (ret)return ret; + pad = &card->dai_link[*index]; lb = &card->dai_link[*index +1 ]; lb->name =devm_kasprintf (card->dev,GFP_KERNEL ,"%s-lb" , pad->name);
Greg Kroah-Hartman
maintainerPATCH 59/691 ASoC: allow module autoloading for table db1200_pids
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongbo Li <[email protected]>
[ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table.
--- sound/soc/au1x/db1200.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/au1x/db1200.c +1 -0
@@ -44,6 +44,7 @@ static const struct platform_device_id db1200_pids[] = { }, {}, }; +MODULE_DEVICE_TABLE (platform, db1200_pids);/*------------------------- AC97 PART ---------------------------*/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/691 ALSA: hda/realtek - Fixed ALC256 headphone no sound
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit 9b82ff1362f50914c8292902e07be98a9f59d33d ]
Dell platform, plug headphone or headset, it had a chance to get no sound from headphone.
Replace depop procedure will solve this issue.
--- sound/pci/hda/patch_realtek.c | 50 ++++++++++++++++++++++++++--------- 1 file changed, 37 insertions(+), 13 deletions(-)
sound/pci/hda/patch_realtek.c +37 -13
@@ -4905,6 +4905,30 @@ static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec, } } +static void alc_hp_mute_disable (struct hda_codec *codec,unsigned int delay) +{ +if (delay <=0 ) + delay =75 ; +snd_hda_codec_write (codec,0x21 ,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); +msleep (delay); +snd_hda_codec_write (codec,0x21 ,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); +msleep (delay); +} + +static void alc_hp_enable_unmute (struct hda_codec *codec,unsigned int delay) +{ +if (delay <=0 ) + delay =75 ; +snd_hda_codec_write (codec,0x21 ,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); +msleep (delay); +snd_hda_codec_write (codec,0x21 ,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE ); +msleep (delay); +} +static const struct coef_fw alc225_pre_hsmode[] = {UPDATE_COEF (0x4a ,1 <<8 ,0 ),UPDATE_COEFEX (0x57 ,0x05 ,1 <<14 ,0 ),
@@ -5006,6 +5030,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)case 0x10ec0236 :case 0x10ec0256 :case 0x19e58326 : +alc_hp_mute_disable (codec,75 );alc_process_coef_fw (codec, coef0256);break ;case 0x10ec0234 :
@@ -5277,6 +5302,7 @@ static void alc_headset_mode_default(struct hda_codec *codec)alc_write_coef_idx (codec,0x45 ,0xc089 );msleep (50 );alc_process_coef_fw (codec, coef0256); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0234 :case 0x10ec0274 :
@@ -5374,6 +5400,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)case 0x10ec0256 :case 0x19e58326 :alc_process_coef_fw (codec, coef0256); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0234 :case 0x10ec0274 :
@@ -5489,6 +5516,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)case 0x10ec0256 :case 0x19e58326 :alc_process_coef_fw (codec, coef0256); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0234 :case 0x10ec0274 :
@@ -5594,25 +5622,21 @@ static void alc_determine_headset_type(struct hda_codec *codec)alc_write_coef_idx (codec,0x06 ,0x6104 );alc_write_coefex_idx (codec,0x57 ,0x3 ,0x09a3 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); -msleep (80 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); -alc_process_coef_fw (codec, coef0255);msleep (300 ); val =alc_read_coef_idx (codec,0x46 ); is_ctia = (val &0x0070 ) ==0x0070 ; - +if (!is_ctia) { +alc_write_coef_idx (codec,0x45 ,0xe089 ); +msleep (100 ); + val =alc_read_coef_idx (codec,0x46 ); +if ((val &0x0070 ) ==0x0070 ) + is_ctia = false; +else + is_ctia = true; + }alc_write_coefex_idx (codec,0x57 ,0x3 ,0x0da3 );alc_update_coefex_idx (codec,0x57 ,0x5 ,1 <<14 ,0 ); - -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); -msleep (80 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE );break ;case 0x10ec0234 :case 0x10ec0274 :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/691 ALSA: hda/realtek - FIxed ALC285 headphone no sound
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit 1fa7b099d60ad64f559bd3b8e3f0d94b2e015514 ]
Dell platform with ALC215 ALC285 ALC289 ALC225 ALC295 ALC299, plug headphone or headset.
It had a chance to get no sound from headphone.
Replace depop procedure will solve this issue.
--- sound/pci/hda/patch_realtek.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
sound/pci/hda/patch_realtek.c +14 -12
@@ -5065,6 +5065,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)case 0x10ec0295 :case 0x10ec0289 :case 0x10ec0299 : +alc_hp_mute_disable (codec,75 );alc_process_coef_fw (codec, alc225_pre_hsmode);alc_process_coef_fw (codec, coef0225);break ;
@@ -5290,6 +5291,7 @@ static void alc_headset_mode_default(struct hda_codec *codec)case 0x10ec0299 :alc_process_coef_fw (codec, alc225_pre_hsmode);alc_process_coef_fw (codec, coef0225); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0255 :alc_process_coef_fw (codec, coef0255);
@@ -5449,6 +5451,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)alc_process_coef_fw (codec, coef0225_2); elsealc_process_coef_fw (codec ,coef0225_1 ); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0867 :alc_update_coefex_idx (codec,0x57 ,0x5 ,1 <<14 ,0 );
@@ -5554,6 +5557,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)case 0x10ec0289 :case 0x10ec0299 :alc_process_coef_fw (codec, coef0225); +alc_hp_enable_unmute (codec,75 );break ; }codec_dbg (codec,"Headset jack set to Nokia-style headset mode.\n" );
@@ -5713,12 +5717,6 @@ static void alc_determine_headset_type(struct hda_codec *codec)case 0x10ec0295 :case 0x10ec0289 :case 0x10ec0299 : -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); -msleep (80 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); -alc_process_coef_fw (codec, alc225_pre_hsmode);alc_update_coef_idx (codec,0x67 ,0xf000 ,0x1000 ); val =alc_read_coef_idx (codec,0x45 );
@@ -5735,15 +5733,19 @@ static void alc_determine_headset_type(struct hda_codec *codec) val =alc_read_coef_idx (codec,0x46 ); is_ctia = (val &0x00f0 ) ==0x00f0 ; } +if (!is_ctia) { +alc_update_coef_idx (codec,0x45 ,0x3f <<10 ,0x38 <<10 ); +alc_update_coef_idx (codec,0x49 ,3 <<8 ,1 <<8 ); +msleep (100 ); + val =alc_read_coef_idx (codec,0x46 ); +if ((val &0x00f0 ) ==0x00f0 ) + is_ctia = false; +else + is_ctia = true; + }alc_update_coef_idx (codec,0x4a ,7 <<6 ,7 <<6 );alc_update_coef_idx (codec,0x4a ,3 <<4 ,3 <<4 );alc_update_coef_idx (codec,0x67 ,0xf000 ,0x3000 ); - -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); -msleep (80 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE );break ;case 0x10ec0867 : is_ctia = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/691 scsi: lpfc: Fix overflow build issue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Yang <[email protected]>
[ Upstream commit 3417c9574e368f0330637505f00d3814ca8854d2 ]
Build failed while enabling "CONFIG_GCOV_KERNEL=y" and "CONFIG_GCOV_PROFILE_ALL=y" with following error:
BUILDSTDERR: drivers/scsi/lpfc/lpfc_bsg.c: In function 'lpfc_get_cgnbuf_info': BUILDSTDERR: ./include/linux/fortify-string.h:114:33: error: '__builtin_memcpy' accessing 18446744073709551615 bytes at offsets 0 and 0 overlaps 9223372036854775807 bytes at offset -9223372036854775808 [-Werror=restrict] BUILDSTDERR: 114 | #define __underlying_memcpy __builtin_memcpy BUILDSTDERR: | ^ BUILDSTDERR: ./include/linux/fortify-string.h:637:9: note: in expansion of macro '__underlying_memcpy' BUILDSTDERR: 637 | __underlying_##op(p, q, __fortify_size); \ BUILDSTDERR: | ^~~~~~~~~~~~~ BUILDSTDERR: ./include/linux/fortify-string.h:682:26: note: in expansion of macro '__fortify_memcpy_chk' BUILDSTDERR: 682 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ BUILDSTDERR: | ^~~~~~~~~~~~~~~~~~~~ BUILDSTDERR: drivers/scsi/lpfc/lpfc_bsg.c:5468:9: note: in expansion of macro 'memcpy' BUILDSTDERR: 5468 | memcpy(cgn_buff, cp, cinfosz); BUILDSTDERR: | ^~~~~~
This happens from the commit 06bb7fc0feee ("kbuild: turn on -Wrestrict by default"). Address this issue by using size_t type.
--- drivers/scsi/lpfc/lpfc_bsg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_bsg.c +1 -1
@@ -5761,7 +5761,7 @@ lpfc_get_cgnbuf_info(struct bsg_job *job)struct get_cgnbuf_info_req *cgnbuf_req;struct lpfc_cgn_info *cp;uint8_t *cgn_buff; -int size, cinfosz; +size_t size, cinfosz;int rc =0 ; if (job->request_len < sizeof(struct fc_bsg_request) +
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/691 pinctrl: at91: make it work with current gpiolib
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Blocher <[email protected]>
[ Upstream commit 752f387faaae0ae2e84d3f496922524785e77d60 ]
pinctrl-at91 currently does not support the gpio-groups devicetree property and has no pin-range.
Because of this at91 gpios stopped working since patch
commit 2ab73c6d8323fa1e ("gpio: Support GPIO controllers without pin-ranges") This was discussed in the patches
commit fc328a7d1fcce263 ("gpio: Revert regression in sysfs-gpio (gpiolib.c)") commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"")
As a workaround manually set pin-range via gpiochip_add_pin_range() until
a) pinctrl-at91 is reworked to support devicetree gpio-groups
b) another solution as mentioned in
commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"") is found
--- drivers/pinctrl/pinctrl-at91.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-at91.c +4 -1
@@ -1403,8 +1403,11 @@ static int at91_pinctrl_probe(struct platform_device *pdev)/* We will handle a range of GPIO pins */ for (i =0 ; i < gpio_banks; i++) -if (gpio_chips[i]) +if (gpio_chips[i]) {pinctrl_add_gpio_range (info->pctl, &gpio_chips[i]->range); +gpiochip_add_pin_range (&gpio_chips[i]->chip,dev_name (info->pctl->dev),0 , + gpio_chips[i]->range.pin_base, gpio_chips[i]->range.npins); + }dev_info (&pdev->dev,"initialized AT91 pinctrl driver\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/691 microblaze: dont treat zero reserved memory regions as error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport <[email protected]>
[ Upstream commit 0075df288dd8a7abfe03b3766176c393063591dd ]
Before commit 721f4a6526da ("mm/memblock: remove empty dummy entry") the check for non-zero of memblock.reserved.cnt in mmu_init() would always be true either because memblock.reserved.cnt is initialized to 1 or because there were memory reservations earlier.
The removal of dummy empty entry in memblock caused this check to fail because now memblock.reserved.cnt is initialized to 0.
Remove the check for non-zero of memblock.reserved.cnt because it's perfectly fine to have an empty memblock.reserved array that early in boot.
--- arch/microblaze/mm/init.c | 5 ----- 1 file changed, 5 deletions(-)
arch/microblaze/mm/init.c +0 -5
@@ -192,11 +192,6 @@ asmlinkage void __init mmu_init(void) {unsigned int kstart, ksize; -if (!memblock.reserved.cnt) { -pr_emerg ("Error memory count\n" ); -machine_restart (NULL ); - } -if ((u32 ) memblock.memory.regions[0 ].size <0x400000 ) {pr_emerg ("Memory must be greater than 4MB\n" );machine_restart (NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/691 net: ftgmac100: Ensure tx descriptor updates are visible
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Chou <[email protected]>
[ Upstream commit 4186c8d9e6af57bab0687b299df10ebd47534a0a ]
The driver must ensure TX descriptor updates are visible before updating TX pointer and TX clear pointer.
This resolves TX hangs observed on AST2600 when running iperf3.
--- drivers/net/ethernet/faraday/ftgmac100.c | 26 ++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/net/ethernet/faraday/ftgmac100.c +18 -8
@@ -569,7 +569,7 @@ static bool ftgmac100_rx_packet(struct ftgmac100 *priv, int *processed) (*processed)++;return true; - drop: +drop:/* Clean rxdes0 (which resets own bit) */ rxdes->rxdes0 =cpu_to_le32 (status & priv->rxdes0_edorr_mask); priv->rx_pointer =ftgmac100_next_rx_pointer (priv, pointer);
@@ -653,6 +653,11 @@ static bool ftgmac100_tx_complete_packet(struct ftgmac100 *priv)ftgmac100_free_tx_packet (priv, pointer, skb, txdes, ctl_stat); txdes->txdes0 =cpu_to_le32 (ctl_stat & priv->txdes0_edotr_mask); +/* Ensure the descriptor config is visible before setting the tx +* pointer. +*/ +smp_wmb (); + priv->tx_clean_pointer =ftgmac100_next_tx_pointer (priv, pointer);return true;
@@ -806,6 +811,11 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,dma_wmb (); first->txdes0 =cpu_to_le32 (f_ctl_stat); +/* Ensure the descriptor config is visible before setting the tx +* pointer. +*/ +smp_wmb (); +/* Update next TX pointer */ priv->tx_pointer = pointer;
@@ -826,7 +836,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,return NETDEV_TX_OK ; - dma_err: +dma_err:if (net_ratelimit ())netdev_err (netdev,"map tx fragment failed\n" );
@@ -848,7 +858,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,* last fragment, so we know ftgmac100_free_tx_packet() * hasn't freed the skb yet. */ - drop: +drop:/* Drop the packet */ dev_kfree_skb_any (skb); netdev->stats.tx_dropped++;
@@ -1448,7 +1458,7 @@ static void ftgmac100_reset_task(struct work_struct *work)ftgmac100_init_all (priv, true);netdev_dbg (netdev,"Reset done !\n" ); - bail: +bail:if (priv->mii_bus)mutex_unlock (&priv->mii_bus->mdio_lock);if (netdev->phydev)
@@ -1519,15 +1529,15 @@ static int ftgmac100_open(struct net_device *netdev)return 0 ; - err_ncsi: +err_ncsi:napi_disable (&priv->napi);netif_stop_queue (netdev); - err_alloc: +err_alloc:ftgmac100_free_buffers (priv);free_irq (netdev->irq, netdev); - err_irq: +err_irq:netif_napi_del (&priv->napi); - err_hw: +err_hw:iowrite32 (0 , priv->base +FTGMAC100_OFFSET_IER );ftgmac100_free_rings (priv);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/691 wifi: iwlwifi: lower message level for FW buffer destination
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit f8a129c1e10256c785164ed5efa5d17d45fbd81b ]
An invalid buffer destination is not a problem for the driver and it does not make sense to report it with the KERN_ERR message level. As such, change the message to use IWL_DEBUG_FW.
--- drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c +2 -1
@@ -64,7 +64,8 @@ iwl_pcie_ctxt_info_dbg_enable(struct iwl_trans *trans, }break ;default : -IWL_ERR (trans,"WRT: Invalid buffer destination\n" ); +IWL_DEBUG_FW (trans,"WRT: Invalid buffer destination (%d)\n" , +le32_to_cpu (fw_mon_cfg->buf_location)); } out:if (dbg_flags)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/691 wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gabay <[email protected]>
[ Upstream commit d44162280899c3fc2c6700e21e491e71c3c96e3d ]
The calculation should consider also the 6GHz IE's len, fix that. In addition, in iwl_mvm_sched_scan_start() the scan_fits helper is called only in case non_psc_incldued is true, but it should be called regardless, fix that as well.
--- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/scan.c +12 -11
@@ -834,8 +834,8 @@ static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids,return ((n_ssids <=PROBE_OPTION_MAX ) && (n_channels <= mvm->fw->ucode_capa.n_scan_channels) & (ies->common_ie_len + - ies->len[NL80211_BAND_2GHZ ] + - ies->len[NL80211_BAND_5GHZ ] <= + ies->len[NL80211_BAND_2GHZ ] + ies->len[NL80211_BAND_5GHZ ] + + ies->len[NL80211_BAND_6GHZ ] <=iwl_mvm_max_scan_ie_fw_cmd_room (mvm))); }
@@ -2775,18 +2775,16 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm, params.n_channels = j; } -if (non_psc_included && - !iwl_mvm_scan_fits (mvm, req->n_ssids, ies, params.n_channels)) { -kfree (params.channels); -return -ENOBUFS ; +if (!iwl_mvm_scan_fits (mvm, req->n_ssids, ies, params.n_channels)) { + ret = -ENOBUFS ; + goto out; } uid =iwl_mvm_build_scan_cmd (mvm, vif, &hcmd, ¶ms, type); - -if (non_psc_included) -kfree (params.channels); -if (uid <0 ) -return uid; +if (uid <0 ) { + ret = uid; + goto out; + } ret =iwl_mvm_send_cmd (mvm, &hcmd);if (!ret) {
@@ -2803,6 +2801,9 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm, mvm->sched_scan_pass_all =SCHED_SCAN_PASS_ALL_DISABLED ; } +out: +if (non_psc_included) +kfree (params.channels);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/691 wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 0668ebc8c2282ca1e7eb96092a347baefffb5fe7 ]
Not doing so will make us send a host command to the transport while the firmware is not alive, which will trigger a WARNING.
bad state = 0
WARNING: CPU: 2 PID: 17434 at drivers/net/wireless/intel/iwlwifi/iwl-trans.c:115 iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi] RIP: 0010:iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi] Call Trace: <TASK> iwl_mvm_send_cmd+0x40/0xc0 [iwlmvm] iwl_mvm_config_scan+0x198/0x260 [iwlmvm] iwl_mvm_recalc_tcm+0x730/0x11d0 [iwlmvm] iwl_mvm_tcm_work+0x1d/0x30 [iwlmvm] process_one_work+0x29e/0x640 worker_thread+0x2df/0x690 ? rescuer_thread+0x540/0x540 kthread+0x192/0x1e0 ? set_kthread_struct+0x90/0x90 ret_from_fork+0x22/0x30
--- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/ops.c +2 -0
@@ -1018,6 +1018,8 @@ void iwl_mvm_stop_device(struct iwl_mvm *mvm)clear_bit (IWL_MVM_STATUS_FIRMWARE_RUNNING , &mvm->status); +iwl_mvm_pause_tcm (mvm, false); +iwl_fw_dbg_stop_sync (&mvm->fwrt);iwl_trans_stop_device (mvm->trans);iwl_free_fw_paging (&mvm->fwrt);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/691 wifi: iwlwifi: mvm: dont wait for tx queues if firmware is dead
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ]
There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was recently converted from just a message), that can be hit if we wait for TX queues to become empty after firmware died. Clearly, we can't expect anything from the firmware after it's declared dead.
Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could be a good idea to stop the flow earlier, the flush functions do some maintenance work that is not related to the firmware, so keep that part of the code running even when the firmware is not running.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +8 -1
@@ -4776,6 +4776,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)int i;if (!iwl_mvm_has_new_tx_api (mvm)) { +/* we can't ask the firmware anything if it is dead */ +if (test_bit (IWL_MVM_STATUS_HW_RESTART_REQUESTED , + &mvm->status)) +return ;if (drop) {mutex_lock (&mvm->mutex); iwl_mvm_flush_tx_path(mvm,
@@ -4857,8 +4861,11 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,/* this can take a while, and we may need/want other operations * to succeed while doing this, so do it without the mutex held +* If the firmware is dead, this can't work... */ -if (!drop && !iwl_mvm_has_new_tx_api (mvm)) +if (!drop && !iwl_mvm_has_new_tx_api (mvm) && + !test_bit (IWL_MVM_STATUS_HW_RESTART_REQUESTED , + &mvm->status))iwl_trans_wait_tx_queues_empty (mvm->trans, msk); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/691 wifi: iwlwifi: clear trans->state earlier upon error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 094513f8a2fbddee51b055d8035f995551f98fce ]
When the firmware crashes, we first told the op_mode and only then, changed the transport's state. This is a problem if the op_mode's nic_error() handler needs to send a host command: it'll see that the transport's state still reflects that the firmware is alive.
Today, this has no consequences since we set the STATUS_FW_ERROR bit and that will prevent sending host commands. iwl_fw_dbg_stop_restart_recording looks at this bit to know not to send a host command for example.
To fix the hibernation, we needed to reset the firmware without having an error and checking STATUS_FW_ERROR to see whether the firmware is alive will no longer hold, so this change is necessary as well.
Change the flow a bit.
Change trans->state before calling the op_mode's nic_error() method and check trans->state instead of STATUS_FW_ERROR. This will keep the current behavior of iwl_fw_dbg_stop_restart_recording upon firmware error, and it'll allow us to call iwl_fw_dbg_stop_restart_recording safely even if STATUS_FW_ERROR is clear, but yet, the firmware is not alive.
[I missed this was a dependency for the hibernation fix, changed
the commit message a bit accordingly]
--- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/dbg.c +1 -1
@@ -2862,7 +2862,7 @@ void iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt, {int ret__maybe_unused =0 ; -if (test_bit (STATUS_FW_ERROR , &fwrt->trans->status)) +if (!iwl_trans_fw_running (fwrt->trans))return ; if (fw_has_capa(&fwrt->fw->ucode_capa,
drivers/net/wireless/intel/iwlwifi/iwl-trans.h +1 -1
@@ -1393,8 +1393,8 @@ static inline void iwl_trans_fw_error(struct iwl_trans *trans, bool sync)/* prevent double restarts due to the same erroneous FW */ if (!test_and_set_bit (STATUS_FW_ERROR , &trans->status)) { -iwl_op_mode_nic_error (trans->op_mode, sync); trans->state =IWL_TRANS_NO_FW ; +iwl_op_mode_nic_error (trans->op_mode, sync); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/691 ASoC: intel: fix module autoloading
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit ae61a3391088d29aa8605c9f2db84295ab993a49 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- sound/soc/intel/keembay/kmb_platform.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/keembay/kmb_platform.c +1 -0
@@ -815,6 +815,7 @@ static const struct of_device_id kmb_plat_of_match[] = { { .compatible = "intel,keembay-tdm", .data = &intel_kmb_tdm_dai}, {} }; +MODULE_DEVICE_TABLE (of, kmb_plat_of_match);static int kmb_plat_dai_probe (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/691 ASoC: tda7419: fix module autoloading
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit 934b44589da9aa300201a00fe139c5c54f421563 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- sound/soc/codecs/tda7419.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/tda7419.c +1 -0
@@ -624,6 +624,7 @@ static const struct of_device_id tda7419_of_match[] = { { .compatible = "st,tda7419" }, { }, }; +MODULE_DEVICE_TABLE (of, tda7419_of_match);static struct i2c_driver tda7419_driver = { .driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/691 spi: spidev: Add an entry for elgin,jg10309-01
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 5f3eee1eef5d0edd23d8ac0974f56283649a1512 ]
The rv1108-elgin-r1 board has an LCD controlled via SPI in userspace. The marking on the LCD is JG10309-01.
Add the "elgin,jg10309-01" compatible string.
--- drivers/spi/spidev.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spidev.c +1 -0
@@ -712,6 +712,7 @@ static int spidev_of_check(struct device *dev)static const struct of_device_id spidev_dt_ids[] = { { .compatible ="cisco,spi-petra" , .data = &spidev_of_check }, { .compatible ="dh,dhcom-board" , .data = &spidev_of_check }, + { .compatible ="elgin,jg10309-01" , .data = &spidev_of_check }, { .compatible ="lineartechnology,ltc2488" , .data = &spidev_of_check }, { .compatible ="lwn,bk4" , .data = &spidev_of_check }, { .compatible ="menlo,m53cpld" , .data = &spidev_of_check },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/691 drm: komeda: Fix an issue related to normalized zpos
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: hongchi.peng <[email protected]>
[ Upstream commit 258905cb9a6414be5c9ca4aa20ef855f8dc894d4 ]
We use komeda_crtc_normalize_zpos to normalize zpos of affected planes to their blending zorder in CU. If there's only one slave plane in affected planes and its layer_split property is enabled, order++ for its split layer, so that when calculating the normalized_zpos of master planes, the split layer of the slave plane is included, but the max_slave_zorder does not include the split layer and keep zero because there's only one slave plane in affacted planes, although we actually use two slave layers in this commit.
In most cases, this bug does not result in a commit failure, but assume the following situation:
slave_layer 0: zpos = 0, layer split enabled, normalized_zpos = 0;(use slave_layer 2 as its split layer)
master_layer 0: zpos = 2, layer_split enabled, normalized_zpos = 2;(use master_layer 2 as its split layer)
master_layer 1: zpos = 4, normalized_zpos = 4; master_layer 3: zpos = 5, normalized_zpos = 5; kcrtc_st->max_slave_zorder = 0;
When we use master_layer 3 as a input of CU in function komeda_compiz_set_input and check it with function komeda_component_check_input, the parameter idx is equal to normailzed_zpos minus max_slave_zorder, the value of idx is 5 and is euqal to CU's max_active_inputs, so that komeda_component_check_input returns a -EINVAL value.
To fix the bug described above, when calculating the max_slave_zorder with the layer_split enabled, count the split layer in this calculation directly.
--- drivers/gpu/drm/arm/display/komeda/komeda_kms.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/arm/display/komeda/komeda_kms.c +7 -3
@@ -163,6 +163,7 @@ static int komeda_crtc_normalize_zpos(struct drm_crtc *crtc,struct drm_plane *plane;struct list_head zorder_list;int order =0 , err; +u32 slave_zpos =0 ;DRM_DEBUG_ATOMIC ("[CRTC:%d:%s] calculating normalized zpos values\n" , crtc->base.id, crtc->name);
@@ -202,10 +203,13 @@ static int komeda_crtc_normalize_zpos(struct drm_crtc *crtc, plane_st->zpos, plane_st->normalized_zpos);/* calculate max slave zorder */ -if (has_bit (drm_plane_index (plane), kcrtc->slave_planes)) +if (has_bit (drm_plane_index (plane), kcrtc->slave_planes)) { + slave_zpos = plane_st->normalized_zpos; +if (to_kplane_st (plane_st)->layer_split) + slave_zpos++; kcrtc_st->max_slave_zorder = -max (plane_st->normalized_zpos, - kcrtc_st->max_slave_zorder); +max (slave_zpos, kcrtc_st->max_slave_zorder); + } } crtc_st->zpos_changed = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/691 spi: bcm63xx: Enable module autoloading
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit 709df70a20e990d262c473ad9899314039e8ec82 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- drivers/spi/spi-bcm63xx.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-bcm63xx.c +1 -0
@@ -482,6 +482,7 @@ static const struct of_device_id bcm63xx_spi_of_match[] = { { .compatible = "brcm,bcm6358-spi", .data = &bcm6358_spi_reg_offsets }, { }, }; +MODULE_DEVICE_TABLE (of, bcm63xx_spi_of_match);static int bcm63xx_spi_probe (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/691 x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 8fcc514809de41153b43ccbe1a0cdf7f72b78e7e ]
A Linux guest on Hyper-V gets the TSC frequency from a synthetic MSR, if available. In this case, set X86_FEATURE_TSC_KNOWN_FREQ so that Linux doesn't unnecessarily do refined TSC calibration when setting up the TSC clocksource.
With this change, a message such as this is no longer output during boot when the TSC is used as the clocksource:
[ 1.115141] tsc: Refined TSC clocksource calibration: 2918.408 MHz
Furthermore, the guest and host will have exactly the same view of the TSC frequency, which is important for features such as the TSC deadline timer that are emulated by the Hyper-V host.
Message-ID: <[email protected]>
--- arch/x86/kernel/cpu/mshyperv.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/cpu/mshyperv.c +1 -0
@@ -322,6 +322,7 @@ static void __init ms_hyperv_init_platform(void) ms_hyperv.misc_features & HV_FEATURE_FREQUENCY_MSRS_AVAILABLE) { x86_platform.calibrate_tsc = hv_get_tsc_khz; x86_platform.calibrate_cpu = hv_get_tsc_khz; +setup_force_cpu_cap (X86_FEATURE_TSC_KNOWN_FREQ ); }if (ms_hyperv.priv_high &HV_ISOLATION ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/691 spi: spidev: Add missing spi_device_id for jg10309-01
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 5478a4f7b94414def7b56d2f18bc2ed9b0f3f1f2 ]
When the of_device_id entry for "elgin,jg10309-01" was added, the corresponding spi_device_id was forgotten, causing a warning message during boot-up:
SPI driver spidev has no spi_device_id for elgin,jg10309-01
Fix module autoloading and shut up the warning by adding the missing entry.
--- drivers/spi/spidev.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spidev.c +1 -0
@@ -684,6 +684,7 @@ static struct class *spidev_class;static const struct spi_device_id spidev_spi_ids[] = { { .name ="bh2228fv" }, { .name ="dh2228fv" }, + { .name ="jg10309-01" }, { .name ="ltc2488" }, { .name ="sx1301" }, { .name ="bk4" },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/691 ocfs2: add bounds checking to ocfs2_xattr_find_entry()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ferry Meng <[email protected]>
[ Upstream commit 9e3041fecdc8f78a5900c3aa51d3d756e73264d6 ]
Add a paranoia check to make sure it doesn't stray beyond valid memory region containing ocfs2 xattr entries when scanning for a match. It will prevent out-of-bound access in case of crafted images.
Stable-dep-of: af77c4fc1871 ("ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()")
--- fs/ocfs2/xattr.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
fs/ocfs2/xattr.c +8 -4
@@ -1066,7 +1066,7 @@ ssize_t ocfs2_listxattr(struct dentry *dentry,return i_ret + b_ret; } -static int ocfs2_xattr_find_entry (int name_index, +static int ocfs2_xattr_find_entry (struct inode *inode,int name_index,const char *name,struct ocfs2_xattr_search *xs) {
@@ -1080,6 +1080,10 @@ static int ocfs2_xattr_find_entry(int name_index, name_len =strlen (name); entry = xs->here;for (i =0 ; i <le16_to_cpu (xs->header->xh_count); i++) { +if ((void *)entry >= xs->end) { +ocfs2_error (inode->i_sb,"corrupted xattr entries" ); +return -EFSCORRUPTED ; + } cmp = name_index -ocfs2_xattr_get_type (entry);if (!cmp) cmp = name_len - entry->xe_name_len;
@@ -1170,7 +1174,7 @@ static int ocfs2_xattr_ibody_get(struct inode *inode, xs->base = (void *)xs->header; xs->here = xs->header->xh_entries; - ret =ocfs2_xattr_find_entry (name_index, name, xs); + ret =ocfs2_xattr_find_entry (inode, name_index, name, xs);if (ret)return ret; size =le64_to_cpu (xs->here->xe_value_size);
@@ -2702,7 +2706,7 @@ static int ocfs2_xattr_ibody_find(struct inode *inode,/* Find the named attribute. */ if (oi->ip_dyn_features &OCFS2_INLINE_XATTR_FL ) { - ret =ocfs2_xattr_find_entry (name_index, name, xs); + ret =ocfs2_xattr_find_entry (inode, name_index, name, xs);if (ret && ret != -ENODATA )return ret; xs->not_found = ret;
@@ -2837,7 +2841,7 @@ static int ocfs2_xattr_block_find(struct inode *inode, xs->end = (void *)(blk_bh->b_data) + blk_bh->b_size; xs->here = xs->header->xh_entries; - ret =ocfs2_xattr_find_entry (name_index, name, xs); + ret =ocfs2_xattr_find_entry (inode, name_index, name, xs); }else ret = ocfs2_xattr_index_block_find(inode, blk_bh, name_index,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/691 ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ferry Meng <[email protected]>
[ Upstream commit af77c4fc1871847b528d58b7fdafb4aa1f6a9262 ]
xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images.
--- fs/ocfs2/xattr.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
fs/ocfs2/xattr.c +10 -5
@@ -1072,7 +1072,7 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, {struct ocfs2_xattr_entry *entry;size_t name_len; -int i, cmp =1 ; +int i, name_offset, cmp =1 ;if (name ==NULL )return -EINVAL ;
@@ -1087,10 +1087,15 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, cmp = name_index -ocfs2_xattr_get_type (entry);if (!cmp) cmp = name_len - entry->xe_name_len; -if (!cmp) - cmp =memcmp (name, (xs->base + -le16_to_cpu (entry->xe_name_offset)), - name_len); +if (!cmp) { + name_offset =le16_to_cpu (entry->xe_name_offset); +if ((xs->base + name_offset + name_len) > xs->end) { +ocfs2_error (inode->i_sb, +"corrupted xattr entries" ); +return -EFSCORRUPTED ; + } + cmp =memcmp (name, (xs->base + name_offset), name_len); + }if (cmp ==0 )break ; entry +=1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/691 cgroup: Make operations on the cgroup root_list RCU safe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
[ Upstream commit d23b5c577715892c87533b13923306acc6243f93 ]
At present, when we perform operations on the cgroup root_list, we must hold the cgroup_mutex, which is a relatively heavyweight lock. In reality, we can make operations on this list RCU-safe, eliminating the need to hold the cgroup_mutex during traversal. Modifications to the list only occur in the cgroup root setup and destroy paths, which should be infrequent in a production environment. In contrast, traversal may occur frequently. Therefore, making it RCU-safe would be beneficial.
--- include/linux/cgroup-defs.h | 1 + kernel/cgroup/cgroup-internal.h | 3 ++- kernel/cgroup/cgroup.c | 14 +++++++------- 3 files changed, 10 insertions(+), 8 deletions(-)
include/linux/cgroup-defs.h +1 -0
@@ -516,6 +516,7 @@ struct cgroup_root {/* A list running through the active hierarchies */ struct list_head root_list; +struct rcu_head rcu;/* Hierarchy-specific flags */ unsigned int flags;
kernel/cgroup/cgroup-internal.h +2 -1
@@ -172,7 +172,8 @@ extern struct list_head cgroup_roots;/* iterate across the hierarchies */ #define for_each_root (root) \ - list_for_each_entry((root), &cgroup_roots, root_list) + list_for_each_entry_rcu((root), &cgroup_roots, root_list, \ + lockdep_is_held(&cgroup_mutex))/** * for_each_subsys - iterate all enabled cgroup subsystems
kernel/cgroup/cgroup.c +7 -7
@@ -1332,7 +1332,7 @@ static void cgroup_exit_root_id(struct cgroup_root *root)void cgroup_free_root (struct cgroup_root *root) { -kfree (root); +kfree_rcu (root, rcu); }static void cgroup_destroy_root (struct cgroup_root *root)
@@ -1365,7 +1365,7 @@ static void cgroup_destroy_root(struct cgroup_root *root)spin_unlock_irq (&css_set_lock);if (!list_empty (&root->root_list)) { -list_del (&root->root_list); +list_del_rcu (&root->root_list); cgroup_root_count--; }
@@ -1411,7 +1411,6 @@ current_cgns_cgroup_from_root(struct cgroup_root *root) }rcu_read_unlock (); -BUG_ON (!res);return res; }
@@ -1421,7 +1420,6 @@ static struct cgroup *cset_cgroup_from_root(struct css_set *cset, {struct cgroup *res =NULL ; -lockdep_assert_held (&cgroup_mutex);lockdep_assert_held (&css_set_lock);if (cset == &init_css_set) {
@@ -1447,7 +1445,9 @@ static struct cgroup *cset_cgroup_from_root(struct css_set *cset,/* * Return the cgroup for "task" from the given hierarchy. Must be -* called with cgroup_mutex and css_set_lock held. +* called with css_set_lock held to prevent task's groups from being modified. +* Must be called with either cgroup_mutex or rcu read lock to prevent the +* cgroup root from being destroyed. */ struct cgroup *task_cgroup_from_root (struct task_struct *task,struct cgroup_root *root)
@@ -1986,7 +1986,7 @@ void init_cgroup_root(struct cgroup_fs_context *ctx)struct cgroup_root *root = ctx->root;struct cgroup *cgrp = &root->cgrp; -INIT_LIST_HEAD (&root->root_list); +INIT_LIST_HEAD_RCU (&root->root_list);atomic_set (&root->nr_cgrps,1 ); cgrp->root = root;init_cgroup_housekeeping (cgrp);
@@ -2068,7 +2068,7 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)* care of subsystems' refcounts, which are explicitly dropped in * the failure exit path. */ -list_add (&root->root_list, &cgroup_roots); +list_add_rcu (&root->root_list, &cgroup_roots); cgroup_root_count++;/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/691 netfilter: nft_set_pipapo: walk over current view on netlink dump
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 29b359cf6d95fd60730533f7f10464e95bd17c73 upstream.
The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it to infer what view of the datastructure is to be used. Add notation to specify if user wants to read/update the set.
Based on patch from Florian Westphal.
--- include/net/netfilter/nf_tables.h | 13 +++++++++++++ net/netfilter/nf_tables_api.c | 5 +++++ net/netfilter/nft_set_pipapo.c | 5 +++-- 3 files changed, 21 insertions(+), 2 deletions(-)
include/net/netfilter/nf_tables.h +13 -0
@@ -283,9 +283,22 @@ struct nft_set_elem {void *priv; }; +/** +* enum nft_iter_type - nftables set iterator type +* +* @NFT_ITER_READ: read-only iteration over set elements +* @NFT_ITER_UPDATE: iteration under mutex to update set element state +*/ +enum nft_iter_type { +NFT_ITER_UNSPEC , +NFT_ITER_READ , +NFT_ITER_UPDATE , +}; +struct nft_set ;struct nft_set_iter {u8 genmask; +enum nft_iter_type type:8 ;unsigned int count;unsigned int skip;int err;
net/netfilter/nf_tables_api.c +5 -0
@@ -628,6 +628,7 @@ static void nft_map_deactivate(const str {struct nft_set_iter iter = { .genmask =nft_genmask_next (ctx->net), + .type =NFT_ITER_UPDATE , .fn = nft_mapelem_deactivate, };
@@ -5073,6 +5074,7 @@ int nf_tables_bind_set(const struct nft_ } iter.genmask =nft_genmask_next (ctx->net); + iter.type =NFT_ITER_UPDATE ; iter.skip =0 ; iter.count =0 ; iter.err =0 ;
@@ -5148,6 +5150,7 @@ static void nft_map_activate(const struc {struct nft_set_iter iter = { .genmask =nft_genmask_next (ctx->net), + .type =NFT_ITER_UPDATE , .fn = nft_mapelem_activate, };
@@ -5504,6 +5507,7 @@ static int nf_tables_dump_set(struct sk_ args.cb = cb; args.skb = skb; args.iter.genmask =nft_genmask_cur (net); + args.iter.type =NFT_ITER_READ ; args.iter.skip = cb->args[0 ]; args.iter.count =0 ; args.iter.err =0 ;
@@ -6833,6 +6837,7 @@ static int nft_set_flush(struct nft_ctx {struct nft_set_iter iter = { .genmask = genmask, + .type =NFT_ITER_UPDATE , .fn = nft_setelem_flush, };
net/netfilter/nft_set_pipapo.c +3 -2
@@ -2042,13 +2042,14 @@ static void nft_pipapo_walk(const struct struct nft_set_iter *iter) {struct nft_pipapo *priv =nft_set_priv (set); -struct net *net =read_pnet (&set->net);const struct nft_pipapo_match *m;const struct nft_pipapo_field *f;int i, r; +WARN_ON_ONCE (iter->type ==NFT_ITER_UNSPEC ); +rcu_read_lock (); -if (iter->genmask ==nft_genmask_cur (net)) +if (iter->type ==NFT_ITER_READ ) m =rcu_dereference (priv->match);else m = priv->clone;
Greg Kroah-Hartman
maintainerPATCH 82/691 netfilter: nf_tables: missing iterator type in lookup walk
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit efefd4f00c967d00ad7abe092554ffbb70c1a793 upstream.
Add missing decorator type to lookup expression and tighten WARN_ON_ONCE check in pipapo to spot earlier that this is unset.
--- net/netfilter/nft_lookup.c | 1 + net/netfilter/nft_set_pipapo.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nft_lookup.c +1 -0
@@ -211,6 +211,7 @@ static int nft_lookup_validate(const strreturn 0 ; iter.genmask =nft_genmask_next (ctx->net); + iter.type =NFT_ITER_UPDATE ; iter.skip =0 ; iter.count =0 ; iter.err =0 ;
net/netfilter/nft_set_pipapo.c +2 -1
@@ -2046,7 +2046,8 @@ static void nft_pipapo_walk(const structconst struct nft_pipapo_field *f;int i, r; -WARN_ON_ONCE (iter->type ==NFT_ITER_UNSPEC ); +WARN_ON_ONCE (iter->type !=NFT_ITER_READ && + iter->type !=NFT_ITER_UPDATE );rcu_read_lock ();if (iter->type ==NFT_ITER_READ )
Greg Kroah-Hartman
maintainerPATCH 83/691 Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
This reverts commit 89795eeba6d13b5ba432425dd43c34c66f2cebde which is commmit 1474bc87fe57deac726cc10203f73daa6c3212f7 upstream.
The reverted commit is based on implementation of wiphy locking that isn't planned to redo on a stable kernel, so revert it to avoid warning:
WARNING: CPU: 0 PID: 9 at net/wireless/core.h:231 disconnect_work+0xb8/0x144 [cfg80211] CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.6.51-00141-ga1649b6f8ed6 #7 Hardware name: Freescale i.MX6 SoloX (Device Tree) Workqueue: events disconnect_work [cfg80211] unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x70/0x1c0 __warn from warn_slowpath_fmt+0x16c/0x294 warn_slowpath_fmt from disconnect_work+0xb8/0x144 [cfg80211] disconnect_work [cfg80211] from process_one_work+0x204/0x620 process_one_work from worker_thread+0x1b0/0x474 worker_thread from kthread+0x10c/0x12c kthread from ret_from_fork+0x14/0x24
--- net/wireless/core.h | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
net/wireless/core.h +1 -7
@@ -217,7 +217,6 @@ void cfg80211_register_wdev(struct cfg80static inline void wdev_lock (struct wireless_dev *wdev)__acquires (wdev) { -lockdep_assert_held (&wdev->wiphy->mtx);mutex_lock (&wdev->mtx);__acquire (wdev->mtx); }
@@ -225,16 +224,11 @@ static inline void wdev_lock(struct wirestatic inline void wdev_unlock (struct wireless_dev *wdev)__releases (wdev) { -lockdep_assert_held (&wdev->wiphy->mtx);__release (wdev->mtx);mutex_unlock (&wdev->mtx); } -static inline void ASSERT_WDEV_LOCK (struct wireless_dev *wdev) -{ -lockdep_assert_held (&wdev->wiphy->mtx); -lockdep_assert_held (&wdev->mtx); -} +#define ASSERT_WDEV_LOCK (wdev) lockdep_assert_held(&(wdev)->mtx)static inline bool cfg80211_has_monitors_only (struct cfg80211_registered_device *rdev) {
Greg Kroah-Hartman
maintainerPATCH 84/691 gpio: prevent potential speculation leaks in gpio_device_get_desc()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hagar Hemdan <[email protected]>
commit d795848ecce24a75dfd46481aee066ae6fe39775 upstream.
Userspace may trigger a speculative read of an address outside the gpio descriptor array.
Users can do that by calling gpio_ioctl() with an offset out of range. Offset is copied from user and then used as an array index to get the gpio descriptor without sanitization in gpio_device_get_desc().
This change ensures that the offset is sanitized by using array_index_nospec() to mitigate any possibility of speculative information leaks.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
--- drivers/gpio/gpiolib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpio/gpiolib.c +2 -1
@@ -5,6 +5,7 @@#include <linux/module.h> #include <linux/interrupt.h> #include <linux/irq.h> +#include <linux/nospec.h> #include <linux/spinlock.h> #include <linux/list.h> #include <linux/device.h>
@@ -146,7 +147,7 @@ struct gpio_desc *gpiochip_get_desc(struif (hwnum >= gdev->ngpio)return ERR_PTR (-EINVAL ); -return &gdev->descs[hwnum]; +return &gdev->descs[array_index_nospec (hwnum, gdev->ngpio)]; }EXPORT_SYMBOL_GPL (gpiochip_get_desc);
Greg Kroah-Hartman
maintainerPATCH 85/691 inet: inet_defrag: prevent sk release while still in use
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 18685451fc4e546fc0e718580d32df3c0e5c8272 upstream.
ip_local_out() and other functions can pass skb->sk as function argument.
If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released.
This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.
Eric Dumazet made an initial analysis of this bug. Quoting Eric:
Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing.
A relevant old patch about the issue was :
8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")
[..]
net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one.
If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly.
We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used.
Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this:
If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow.
This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered.
This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue.
In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine.
In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.
--- include/linux/skbuff.h | 7 --- net/ipv4/inet_fragment.c | 70 ++++++++++++++++++++++++++------ net/ipv4/ip_fragment.c | 2 net/ipv6/netfilter/nf_conntrack_reasm.c | 2 4 files changed, 60 insertions(+), 21 deletions(-)
include/linux/skbuff.h +1 -6
@@ -660,8 +660,6 @@ typedef unsigned char *sk_buff_data_t;* @rbnode: RB tree node, alternative to next/prev for netem/tcp * @list: queue head * @sk: Socket we are owned by -* @ip_defrag_offset: (aka @sk) alternate use of @sk, used in -* fragmentation management * @dev: Device we arrived on/are leaving by * @dev_scratch: (aka @dev) alternate use of @dev when @dev would be %NULL * @cb: Control buffer. Free for use by every layer. Put private vars here
@@ -778,10 +776,7 @@ struct sk_buff {struct list_head list; }; -union { -struct sock *sk; -int ip_defrag_offset; - }; +struct sock *sk;union {ktime_t tstamp;
net/ipv4/inet_fragment.c +57 -13
158 lines not on this page · raw message
net/ipv4/ip_fragment.c +1 -1
@@ -377,6 +377,7 @@ static int ip_frag_queue(struct ipq *qp, }skb_dst_drop (skb); +skb_orphan (skb);return -EINPROGRESS ; insert_error:
@@ -479,7 +480,6 @@ int ip_defrag(struct net *net, struct skstruct ipq *qp;__IP_INC_STATS (net,IPSTATS_MIB_REASMREQDS ); -skb_orphan (skb);/* Lookup (or create) queue header */ qp =ip_find (net,ip_hdr (skb), user, vif);
net/ipv6/netfilter/nf_conntrack_reasm.c +1 -1
@@ -297,6 +297,7 @@ static int nf_ct_frag6_queue(struct frag }skb_dst_drop (skb); +skb_orphan (skb);return -EINPROGRESS ; insert_error:
@@ -472,7 +473,6 @@ int nf_ct_frag6_gather(struct net *net, hdr =ipv6_hdr (skb); fhdr = (struct frag_hdr *)skb_transport_header (skb); -skb_orphan (skb); fq =fq_find (net, fhdr->identification, user, hdr, skb->dev ? skb->dev->ifindex :0 );if (fq ==NULL ) {
Greg Kroah-Hartman
maintainerPATCH 86/691 gpiolib: cdev: Ignore reconfiguration without direction
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kent Gibson <[email protected]>
commit b440396387418fe2feaacd41ca16080e7a8bc9ad upstream.
linereq_set_config() behaves badly when direction is not set. The configuration validation is borrowed from linereq_create(), where, to verify the intent of the user, the direction must be set to in order to effect a change to the electrical configuration of a line. But, when applied to reconfiguration, that validation does not allow for the unset direction case, making it possible to clear flags set previously without specifying the line direction.
Adding to the inconsistency, those changes are not immediately applied by linereq_set_config(), but will take effect when the line value is next get or set.
For example, by requesting a configuration with no flags set, an output line with GPIO_V2_LINE_FLAG_ACTIVE_LOW and GPIO_V2_LINE_FLAG_OPEN_DRAIN set could have those flags cleared, inverting the sense of the line and changing the line drive to push-pull on the next line value set.
Skip the reconfiguration of lines for which the direction is not set, and only reconfigure the lines for which direction is set.
--- drivers/gpio/gpiolib-cdev.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpio/gpiolib-cdev.c +8 -5
@@ -1186,15 +1186,18 @@ static long linereq_set_config_unlocked(for (i =0 ; i < lr->num_lines; i++) { desc = lr->lines[i].desc; flags =gpio_v2_line_config_flags (lc, i); +/* +* Lines not explicitly reconfigured as input or output +* are left unchanged. +*/ +if (!(flags &GPIO_V2_LINE_DIRECTION_FLAGS )) +continue ; + polarity_change = (!!test_bit (FLAG_ACTIVE_LOW , &desc->flags) != ((flags &GPIO_V2_LINE_FLAG_ACTIVE_LOW ) !=0 ));gpio_v2_line_config_flags_to_desc_flags (flags, &desc->flags); -/* -* Lines have to be requested explicitly for input -* or output, else the line will be treated "as is". -*/ if (flags &GPIO_V2_LINE_FLAG_OUTPUT ) {int val =gpio_v2_line_config_output_value (lc, i);
@@ -1202,7 +1205,7 @@ static long linereq_set_config_unlocked( ret =gpiod_direction_output (desc, val);if (ret)return ret; - }else if (flags &GPIO_V2_LINE_FLAG_INPUT ) { + }else { ret =gpiod_direction_input (desc);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 87/691 cgroup: Move rcu_head up near the top of cgroup_root
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
commit a7fb0423c201ba12815877a0b5a68a6a1710b23a upstream.
Commit d23b5c577715 ("cgroup: Make operations on the cgroup root_list RCU safe") adds a new rcu_head to the cgroup_root structure and kvfree_rcu() for freeing the cgroup_root.
The current implementation of kvfree_rcu(), however, has the limitation that the offset of the rcu_head structure within the larger data structure must be less than 4096 or the compilation will fail. See the macro definition of __is_kvfree_rcu_offset() in include/linux/rcupdate.h for more information.
By putting rcu_head below the large cgroup structure, any change to the cgroup structure that makes it larger run the risk of causing build failure under certain configurations. Commit 77070eeb8821 ("cgroup:
Avoid false cacheline sharing of read mostly rstat_cpu") happens to be the last straw that breaks it. Fix this problem by moving the rcu_head structure up before the cgroup structure.
--- include/linux/cgroup-defs.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/linux/cgroup-defs.h +4 -4
@@ -505,6 +505,10 @@ struct cgroup_root {/* Unique id for this hierarchy. */ int hierarchy_id; +/* A list running through the active hierarchies */ +struct list_head root_list; +struct rcu_head rcu;/* Must be near the top */ +/* The root cgroup. Root is destroyed on its release. */ struct cgroup cgrp;
@@ -514,10 +518,6 @@ struct cgroup_root {/* Number of cgroups in the hierarchy, used only for /proc/cgroups */ atomic_t nr_cgrps; -/* A list running through the active hierarchies */ -struct list_head root_list; -struct rcu_head rcu; -/* Hierarchy-specific flags */ unsigned int flags;
Greg Kroah-Hartman
maintainerPATCH 88/691 USB: serial: pl2303: add device id for Macrosilicon MS3020
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junhao Xie <[email protected]>
commit 7d47d22444bb7dc1b6d768904a22070ef35e1fc0 upstream.
Add the device id for the Macrosilicon MS3020 which is a PL2303HXN based device.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 4 ++++ 2 files changed, 5 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -118,6 +118,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) }, + { USB_DEVICE(MACROSILICON_VENDOR_ID, MACROSILICON_MS3020_PRODUCT_ID) }, { } /* Terminating entry */ };
drivers/usb/serial/pl2303.h +4 -0
@@ -171,3 +171,7 @@/* Allied Telesis VT-Kit3 */ #define AT_VENDOR_ID 0x0caa#define AT_VTKIT3_PRODUCT_ID 0x3001 + +/* Macrosilicon MS3020 */ +#define MACROSILICON_VENDOR_ID 0x345f +#define MACROSILICON_MS3020_PRODUCT_ID 0x3020
Greg Kroah-Hartman
maintainerPATCH 89/691 USB: usbtmc: prevent kernel-usb-infoleak
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad upstream.
The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields.
--- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/class/usbtmc.c +1 -1
@@ -754,7 +754,7 @@ static struct urb *usbtmc_create_urb(voiif (!urb)return NULL ; - dmabuf =kmalloc (bufsize,GFP_KERNEL ); + dmabuf =kzalloc (bufsize,GFP_KERNEL );if (!dmabuf) {usb_free_urb (urb);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 90/691 EDAC/synopsys: Add support for version 3 of the Synopsys EDAC DDR
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinh Nguyen <[email protected]>
[ Upstream commit f7824ded41491d7ebc156a3a2f6fa05cd89da7c2 ]
Add support for version 3.80a of the Synopsys DDR controller. This version of the controller has the following differences:
- UE/CE are auto cleared
- Interrupts are supported by default
Stable-dep-of: 35e6dbfe1846 ("EDAC/synopsys: Fix error injection on Zynq UltraScale+")
--- drivers/edac/synopsys_edac.c | 49 ++++++++++++++++++++++++++++++------ 1 file changed, 42 insertions(+), 7 deletions(-)
drivers/edac/synopsys_edac.c +42 -7
@@ -101,6 +101,7 @@/* DDR ECC Quirks */ #define DDR_ECC_INTR_SUPPORT BIT(0)#define DDR_ECC_DATA_POISON_SUPPORT BIT(1) +#define DDR_ECC_INTR_SELF_CLEAR BIT(2)/* ZynqMP Enhanced DDR memory controller registers that are relevant to ECC */ /* ECC Configuration Registers */
@@ -176,6 +177,10 @@#define DDR_QOS_IRQ_EN_OFST 0x20208#define DDR_QOS_IRQ_DB_OFST 0x2020C +/* DDR QOS Interrupt register definitions */ +#define DDR_UE_MASK BIT(9) +#define DDR_CE_MASK BIT(8) +/* ECC Corrected Error Register Mask and Shifts*/ #define ECC_CEADDR0_RW_MASK 0x3FFFF#define ECC_CEADDR0_RNK_MASK BIT(24)
@@ -539,10 +544,16 @@ static irqreturn_t intr_handler(int irq, void *dev_id) priv = mci->pvt_info; p_data = priv->p_data; - regval =readl (priv->baseaddr +DDR_QOS_IRQ_STAT_OFST ); - regval &= (DDR_QOSCE_MASK |DDR_QOSUE_MASK ); -if (!(regval &ECC_CE_UE_INTR_MASK )) -return IRQ_NONE ; +/* +* v3.0 of the controller has the ce/ue bits cleared automatically, +* so this condition does not apply. +*/ +if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR )) { + regval =readl (priv->baseaddr +DDR_QOS_IRQ_STAT_OFST ); + regval &= (DDR_QOSCE_MASK |DDR_QOSUE_MASK ); +if (!(regval &ECC_CE_UE_INTR_MASK )) +return IRQ_NONE ; + } status = p_data->get_error_info (priv);if (status)
@@ -554,7 +565,9 @@ static irqreturn_t intr_handler(int irq, void *dev_id)edac_dbg (3 ,"Total error count CE %d UE %d\n" , priv->ce_cnt, priv->ue_cnt); -writel (regval, priv->baseaddr +DDR_QOS_IRQ_STAT_OFST ); +/* v3.0 of the controller does not have this register */ +if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR )) +writel (regval, priv->baseaddr +DDR_QOS_IRQ_STAT_OFST );return IRQ_HANDLED ; }
@@ -840,8 +853,13 @@ static void mc_init(struct mem_ctl_info *mci, struct platform_device *pdev)static void enable_intr (struct synps_edac_priv *priv) {/* Enable UE/CE Interrupts */ -writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , - priv->baseaddr +DDR_QOS_IRQ_EN_OFST ); +if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) +writel (DDR_UE_MASK |DDR_CE_MASK , + priv->baseaddr +ECC_CLR_OFST ); +else +writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , + priv->baseaddr +DDR_QOS_IRQ_EN_OFST ); + }static void disable_intr (struct synps_edac_priv *priv)
@@ -896,6 +914,19 @@ static const struct synps_platform_data zynqmp_edac_def = { ), }; +static const struct synps_platform_data synopsys_edac_def = { + .get_error_info = zynqmp_get_error_info, + .get_mtype = zynqmp_get_mtype, + .get_dtype = zynqmp_get_dtype, + .get_ecc_state = zynqmp_get_ecc_state, + .quirks = (DDR_ECC_INTR_SUPPORT |DDR_ECC_INTR_SELF_CLEAR +#ifdef CONFIG_EDAC_DEBUG + |DDR_ECC_DATA_POISON_SUPPORT +#endif + ), +}; + +static const struct of_device_id synps_edac_match[] = { { .compatible ="xlnx,zynq-ddrc-a05" ,
@@ -905,6 +936,10 @@ static const struct of_device_id synps_edac_match[] = { .compatible = "xlnx,zynqmp-ddrc-2.40a", .data = (void *)&zynqmp_edac_def }, + { + .compatible = "snps,ddrc-3.80a", + .data = (void *)&synopsys_edac_def + }, {/* end of table */ }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/691 EDAC/synopsys: Use the correct register to disable the error interrupt on v3 hw
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <[email protected]>
[ Upstream commit be76ceaf03bc04e74be5e28f608316b73c2b04ad ]
v3.x Synopsys EDAC DDR doesn't have the QOS Interrupt register. Use the ECC Clear Register to disable the error interrupts instead.
Stable-dep-of: 35e6dbfe1846 ("EDAC/synopsys: Fix error injection on Zynq UltraScale+")
--- drivers/edac/synopsys_edac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/edac/synopsys_edac.c +5 -2
@@ -865,8 +865,11 @@ static void enable_intr(struct synps_edac_priv *priv)static void disable_intr (struct synps_edac_priv *priv) {/* Disable UE/CE Interrupts */ -writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , - priv->baseaddr +DDR_QOS_IRQ_DB_OFST ); +if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) +writel (0x0 , priv->baseaddr +ECC_CLR_OFST ); +else +writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , + priv->baseaddr +DDR_QOS_IRQ_DB_OFST ); } static int setup_irq(struct mem_ctl_info *mci,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/691 EDAC/synopsys: Re-enable the error interrupts on v3 hw
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <[email protected]>
[ Upstream commit 4bcffe941758ee17becb43af3b25487f848f6512 ]
zynqmp_get_error_info() writes 0 to the ECC_CLR_OFST register after an interrupt for a {un-,}correctable error is raised, which disables the error interrupts. Then the interrupt handler will be called only once. Therefore, re-enable the error interrupt line at the end of intr_handler() for v3.x Synopsys EDAC DDR.
Stable-dep-of: 35e6dbfe1846 ("EDAC/synopsys: Fix error injection on Zynq UltraScale+")
--- drivers/edac/synopsys_edac.c | 47 +++++++++++++++++++----------------- 1 file changed, 25 insertions(+), 22 deletions(-)
drivers/edac/synopsys_edac.c +25 -22
@@ -527,6 +527,28 @@ static void handle_error(struct mem_ctl_info *mci, struct synps_ecc_status *p)memset (p,0 ,sizeof (*p)); } +static void enable_intr (struct synps_edac_priv *priv) +{ +/* Enable UE/CE Interrupts */ +if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) +writel (DDR_UE_MASK |DDR_CE_MASK , + priv->baseaddr +ECC_CLR_OFST ); +else +writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , + priv->baseaddr +DDR_QOS_IRQ_EN_OFST ); + +} + +static void disable_intr (struct synps_edac_priv *priv) +{ +/* Disable UE/CE Interrupts */ +if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) +writel (0x0 , priv->baseaddr +ECC_CLR_OFST ); +else +writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , + priv->baseaddr +DDR_QOS_IRQ_DB_OFST ); +} +/** * intr_handler - Interrupt Handler for ECC interrupts. * @irq: IRQ number.
@@ -568,6 +590,9 @@ static irqreturn_t intr_handler(int irq, void *dev_id)/* v3.0 of the controller does not have this register */ if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ))writel (regval, priv->baseaddr +DDR_QOS_IRQ_STAT_OFST ); +else +enable_intr (priv); +return IRQ_HANDLED ; }
@@ -850,28 +875,6 @@ static void mc_init(struct mem_ctl_info *mci, struct platform_device *pdev)init_csrows (mci); } -static void enable_intr (struct synps_edac_priv *priv) -{ -/* Enable UE/CE Interrupts */ -if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) -writel (DDR_UE_MASK |DDR_CE_MASK , - priv->baseaddr +ECC_CLR_OFST ); -else -writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , - priv->baseaddr +DDR_QOS_IRQ_EN_OFST ); - -} - -static void disable_intr (struct synps_edac_priv *priv) -{ -/* Disable UE/CE Interrupts */ -if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) -writel (0x0 , priv->baseaddr +ECC_CLR_OFST ); -else -writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , - priv->baseaddr +DDR_QOS_IRQ_DB_OFST ); -} -static int setup_irq (struct mem_ctl_info *mci,struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/691 EDAC/synopsys: Fix ECC status and IRQ control race condition
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit 591c946675d88dcc0ae9ff54be9d5caaee8ce1e3 ]
The race condition around the ECCCLR register access happens in the IRQ disable method called in the device remove() procedure and in the ECC IRQ handler:
1. Enable IRQ:
a. ECCCLR = EN_CE | EN_UE
2. Disable IRQ:
a. ECCCLR = 0
3. IRQ handler:
a. ECCCLR = CLR_CE | CLR_CE_CNT | CLR_CE | CLR_CE_CNT b. ECCCLR = 0
c. ECCCLR = EN_CE | EN_UE
So if the IRQ disabling procedure is called concurrently with the IRQ handler method the IRQ might be actually left enabled due to the statement 3c.
The root cause of the problem is that ECCCLR register (which since v3.10a has been called as ECCCTL) has intermixed ECC status data clear flags and the IRQ enable/disable flags. Thus the IRQ disabling (clear EN flags) and handling (write 1 to clear ECC status data) procedures must be serialised around the ECCCTL register modification to prevent the race.
So fix the problem described above by adding the spin-lock around the ECCCLR modifications and preventing the IRQ-handler from modifying the IRQs enable flags (there is no point in disabling the IRQ and then re-enabling it again within a single IRQ handler call, see the statements 3a/3b and 3c above).
Stable-dep-of: 35e6dbfe1846 ("EDAC/synopsys: Fix error injection on Zynq UltraScale+")
--- drivers/edac/synopsys_edac.c | 50 ++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 13 deletions(-)
drivers/edac/synopsys_edac.c +37 -13
@@ -22,6 +22,7 @@#include <linux/edac.h> #include <linux/module.h> #include <linux/platform_device.h> +#include <linux/spinlock.h> #include <linux/interrupt.h> #include <linux/of.h> #include <linux/of_device.h>
@@ -313,6 +314,7 @@ struct synps_ecc_status {/** * struct synps_edac_priv - DDR memory controller private instance data. * @baseaddr: Base address of the DDR controller. +* @reglock: Concurrent CSRs access lock. * @message: Buffer for framing the event specific info. * @stat: ECC status information. * @p_data: Platform data.
@@ -327,6 +329,7 @@ struct synps_ecc_status {*/ struct synps_edac_priv {void __iomem *baseaddr; +spinlock_t reglock;char message[SYNPS_EDAC_MSG_SIZE ];struct synps_ecc_status stat;const struct synps_platform_data *p_data;
@@ -422,7 +425,8 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)static int zynqmp_get_error_info (struct synps_edac_priv *priv) {struct synps_ecc_status *p; -u32 regval, clearval =0 ; +u32 regval, clearval; +unsigned long flags;void __iomem *base; base = priv->baseaddr;
@@ -466,10 +470,14 @@ static int zynqmp_get_error_info(struct synps_edac_priv *priv) p->ueinfo.blknr = (regval &ECC_CEADDR1_BLKNR_MASK ); p->ueinfo.data =readl (base +ECC_UESYND0_OFST ); out: - clearval =ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_CE_ERRCNT ; - clearval |=ECC_CTRL_CLR_UE_ERR |ECC_CTRL_CLR_UE_ERRCNT ; +spin_lock_irqsave (&priv->reglock, flags); + + clearval =readl (base +ECC_CLR_OFST ) | +ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_CE_ERRCNT | +ECC_CTRL_CLR_UE_ERR |ECC_CTRL_CLR_UE_ERRCNT ;writel (clearval, base +ECC_CLR_OFST ); -writel (0x0 , base +ECC_CLR_OFST ); + +spin_unlock_irqrestore (&priv->reglock, flags);return 0 ; }
@@ -529,24 +537,41 @@ static void handle_error(struct mem_ctl_info *mci, struct synps_ecc_status *p)static void enable_intr (struct synps_edac_priv *priv) { +unsigned long flags; +/* Enable UE/CE Interrupts */ -if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) -writel (DDR_UE_MASK |DDR_CE_MASK , - priv->baseaddr +ECC_CLR_OFST ); -else +if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR )) {writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , priv->baseaddr +DDR_QOS_IRQ_EN_OFST ); +return ; + } + +spin_lock_irqsave (&priv->reglock, flags); + +writel (DDR_UE_MASK |DDR_CE_MASK , + priv->baseaddr +ECC_CLR_OFST ); + +spin_unlock_irqrestore (&priv->reglock, flags); }static void disable_intr (struct synps_edac_priv *priv) { +unsigned long flags; +/* Disable UE/CE Interrupts */ -if (priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ) -writel (0x0 , priv->baseaddr +ECC_CLR_OFST ); -else +if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR )) {writel (DDR_QOSUE_MASK |DDR_QOSCE_MASK , priv->baseaddr +DDR_QOS_IRQ_DB_OFST ); + +return ; + } + +spin_lock_irqsave (&priv->reglock, flags); + +writel (0 , priv->baseaddr +ECC_CLR_OFST ); + +spin_unlock_irqrestore (&priv->reglock, flags); }/**
@@ -590,8 +615,6 @@ static irqreturn_t intr_handler(int irq, void *dev_id)/* v3.0 of the controller does not have this register */ if (!(priv->p_data->quirks &DDR_ECC_INTR_SELF_CLEAR ))writel (regval, priv->baseaddr +DDR_QOS_IRQ_STAT_OFST ); -else -enable_intr (priv);return IRQ_HANDLED ; }
@@ -1373,6 +1396,7 @@ static int mc_probe(struct platform_device *pdev) priv = mci->pvt_info; priv->baseaddr = baseaddr; priv->p_data = p_data; +spin_lock_init (&priv->reglock);mc_init (mci, pdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/691 EDAC/synopsys: Fix error injection on Zynq UltraScale+
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <[email protected]>
[ Upstream commit 35e6dbfe1846caeafabb49b7575adb36b0aa2269 ]
The Zynq UltraScale+ MPSoC DDR has a disjoint memory from 2GB to 32GB. The DDR host interface has a contiguous memory so while injecting errors, the driver should remove the hole else the injection fails as the address translation is incorrect.
Introduce a get_mem_info() function pointer and set it for Zynq UltraScale+ platform to return host address.
--- drivers/edac/synopsys_edac.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-)
drivers/edac/synopsys_edac.c +34 -1
@@ -23,6 +23,7 @@#include <linux/module.h> #include <linux/platform_device.h> #include <linux/spinlock.h> +#include <linux/sizes.h> #include <linux/interrupt.h> #include <linux/of.h> #include <linux/of_device.h>
@@ -351,6 +352,7 @@ struct synps_edac_priv {* @get_mtype: Get mtype. * @get_dtype: Get dtype. * @get_ecc_state: Get ECC state. +* @get_mem_info: Get EDAC memory info * @quirks: To differentiate IPs. */ struct synps_platform_data {
@@ -358,6 +360,9 @@ struct synps_platform_data {enum mem_type (*get_mtype)(const void __iomem *base);enum dev_type (*get_dtype)(const void __iomem *base);bool (*get_ecc_state)(void __iomem *base); +#ifdef CONFIG_EDAC_DEBUG +u64 (*get_mem_info)(struct synps_edac_priv *priv); +#endif int quirks; };
@@ -416,6 +421,25 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)return 0 ; } +#ifdef CONFIG_EDAC_DEBUG +/** +* zynqmp_get_mem_info - Get the current memory info. +* @priv: DDR memory controller private instance data. +* +* Return: host interface address. +*/ +static u64 zynqmp_get_mem_info (struct synps_edac_priv *priv) +{ +u64 hif_addr =0 , linear_addr; + + linear_addr = priv->poison_addr; +if (linear_addr >=SZ_32G ) + linear_addr = linear_addr -SZ_32G +SZ_2G ; + hif_addr = linear_addr >>3 ; +return hif_addr; +} +#endif +/** * zynqmp_get_error_info - Get the current ECC error info. * @priv: DDR memory controller private instance data.
@@ -936,6 +960,9 @@ static const struct synps_platform_data zynqmp_edac_def = { .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, .get_ecc_state = zynqmp_get_ecc_state, +#ifdef CONFIG_EDAC_DEBUG + .get_mem_info = zynqmp_get_mem_info, +#endif .quirks = (DDR_ECC_INTR_SUPPORT #ifdef CONFIG_EDAC_DEBUG | DDR_ECC_DATA_POISON_SUPPORT
@@ -989,10 +1016,16 @@ MODULE_DEVICE_TABLE(of, synps_edac_match);static void ddr_poison_setup (struct synps_edac_priv *priv) {int col =0 , row =0 , bank =0 , bankgrp =0 , rank =0 , regval; +const struct synps_platform_data *p_data;int index;ulong hif_addr =0 ; - hif_addr = priv->poison_addr >>3 ; + p_data = priv->p_data; + +if (p_data->get_mem_info) + hif_addr = p_data->get_mem_info (priv); +else + hif_addr = priv->poison_addr >>3 ;for (index =0 ; index <DDR_MAX_ROW_SHIFT ; index++) {if (priv->row_shift[index])
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/691 wifi: rtw88: always wait for both firmware loading attempts
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d ]
In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.
--- drivers/net/wireless/realtek/rtw88/main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/realtek/rtw88/main.c +4 -3
@@ -1153,20 +1153,21 @@ static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev) {struct rtw_chip_info *chip = rtwdev->chip;struct rtw_fw_state *fw; +int ret =0 ; fw = &rtwdev->fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ;if (chip->wow_fw_name) { fw = &rtwdev->wow_fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ; } -return 0 ; +return ret; } static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/691 crypto: xor - fix template benchmarking
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit ab9a244c396aae4aaa34b2399b82fc15ec2df8c1 ]
Commit c055e3eae0f1 ("crypto: xor - use ktime for template benchmarking") switched from using jiffies to ktime-based performance benchmarking.
This works nicely on machines which have a fine-grained ktime() clocksource as e.g. x86 machines with TSC.
But other machines, e.g. my 4-way HP PARISC server, don't have such fine-grained clocksources, which is why it seems that 800 xor loops take zero seconds, which then shows up in the logs as:
xor: measuring software checksum speed
8regs : -1018167296 MB/sec
8regs_prefetch : -1018167296 MB/sec
32regs : -1018167296 MB/sec
32regs_prefetch : -1018167296 MB/secFix this with some small modifications to the existing code to improve the algorithm to always produce correct results without introducing major delays for architectures with a fine-grained ktime() clocksource:
a) Delay start of the timing until ktime() just advanced. On machines with a fast ktime() this should be just one additional ktime() call.
b) Count the number of loops. Run at minimum 800 loops and finish earliest when the ktime() counter has progressed.
With that the throughput can now be calculated more accurately under all conditions.
v2:
- clean up coding style (noticed & suggested by Herbert Xu)
- rephrased & fixed typo in commit message
--- crypto/xor.c | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-)
crypto/xor.c +14 -17
@@ -83,33 +83,30 @@ static void __init do_xor_speed(struct xor_block_template *tmpl, void *b1, void *b2) { int speed; -int i, j; -ktime_t min, start, diff; +unsigned long reps; +ktime_t min, start, t0; tmpl->next = template_list; template_list = tmpl;preempt_disable (); - min = (ktime_t )S64_MAX ; -for (i =0 ; i <3 ; i++) { - start =ktime_get (); -for (j =0 ; j <REPS ; j++) { -mb ();/* prevent loop optimization */ - tmpl->do_2 (BENCH_SIZE , b1, b2); -mb (); - } - diff =ktime_sub (ktime_get (), start); -if (diff < min) - min = diff; - } + reps =0 ; + t0 =ktime_get (); +/* delay start until time has advanced */ +while ((start =ktime_get ()) == t0) +cpu_relax (); +do { +mb ();/* prevent loop optimization */ + tmpl->do_2 (BENCH_SIZE , b1, b2); +mb (); + }while (reps++ <REPS || (t0 =ktime_get ()) == start); + min =ktime_sub (t0, start);preempt_enable ();// bytes/ns == GB/s, multiply by 1000 to get MB/s [not MiB/s] -if (!min) - min =1 ; - speed = (1000 *REPS *BENCH_SIZE ) / (unsigned int )ktime_to_ns (min); + speed = (1000 * reps *BENCH_SIZE ) / (unsigned int )ktime_to_ns (min); tmpl->speed = speed;pr_info (" %-16s: %5d MB/sec\n" , tmpl->name, speed);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/691 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 07442c46abad1d50ac82af5e0f9c5de2732c4592 ]
In tps68470_pmic_opregion_probe() pointer 'dev' is compared to NULL which is useless.
Fix this issue by removing unneeded check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/pmic/tps68470_pmic.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/acpi/pmic/tps68470_pmic.c +2 -4
@@ -376,10 +376,8 @@ static int tps68470_pmic_opregion_probe(struct platform_device *pdev)struct tps68470_pmic_opregion *opregion;acpi_status status; -if (!dev || !tps68470_regmap) { -dev_warn (dev,"dev or regmap is NULL\n" ); -return -EINVAL ; - } +if (!tps68470_regmap) +return dev_err_probe (dev, -EINVAL ,"regmap is missing\n" );if (!handle) {dev_warn (dev,"acpi handle is NULL\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/691 wifi: ath9k: fix parameter check in ath9k_init_debug()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjie Du <[email protected]>
[ Upstream commit 6edb4ba6fb5b946d112259f54f4657f82eb71e89 ]
Make IS_ERR() judge the debugfs_create_dir() function return in ath9k_init_debug()
Stable-dep-of: f6ffe7f01847 ("wifi: ath9k: Remove error checks when creating debugfs entries")
--- drivers/net/wireless/ath/ath9k/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/debug.c +1 -1
@@ -1371,7 +1371,7 @@ int ath9k_init_debug(struct ath_hw *ah) sc->debug.debugfs_phy =debugfs_create_dir ("ath9k" , sc->hw->wiphy->debugfsdir); -if (!sc->debug.debugfs_phy) +if (IS_ERR (sc->debug.debugfs_phy))return -ENOMEM ;#ifdef CONFIG_ATH_DEBUG
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/691 wifi: ath9k: Remove error checks when creating debugfs entries
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit f6ffe7f0184792c2f99aca6ae5b916683973d7d3 ]
We should not be checking the return values from debugfs creation at all: the debugfs functions are designed to handle errors of previously called functions and just transparently abort the creation of debugfs entries when debugfs is disabled. If we check the return value and abort driver initialisation, we break the driver if debugfs is disabled (such as when booting with debugfs=off).
Earlier versions of ath9k accidentally did the right thing by checking the return value, but only for NULL, not for IS_ERR(). This was "fixed" by the two commits referenced below, breaking ath9k with debugfs=off starting from the 6.6 kernel (as reported in the Bugzilla linked below).
Restore functionality by just getting rid of the return value check entirely.
--- drivers/net/wireless/ath/ath9k/debug.c | 2 -- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 -- 2 files changed, 4 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +0 -2
@@ -1371,8 +1371,6 @@ int ath9k_init_debug(struct ath_hw *ah) sc->debug.debugfs_phy =debugfs_create_dir ("ath9k" , sc->hw->wiphy->debugfsdir); -if (IS_ERR (sc->debug.debugfs_phy)) -return -ENOMEM ;#ifdef CONFIG_ATH_DEBUG debugfs_create_file("debug", 0600, sc->debug.debugfs_phy,
drivers/net/wireless/ath/ath9k/htc_drv_debug.c +0 -2
@@ -491,8 +491,6 @@ int ath9k_htc_init_debug(struct ath_hw *ah) priv->debug.debugfs_phy =debugfs_create_dir (KBUILD_MODNAME , priv->hw->wiphy->debugfsdir); -if (IS_ERR (priv->debug.debugfs_phy)) -return -ENOMEM ;ath9k_cmn_spectral_init_debug (&priv->spec_priv, priv->debug.debugfs_phy);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/691 net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanteng Si <[email protected]>
[ Upstream commit c70f3163681381c15686bdd2fe56bf4af9b8aaaa ]
Reference and PTP clocks rate of the Loongson GMAC devices is 125MHz. (So is in the GNET devices which support is about to be added.) Set the respective plat_stmmacenet_data field up in accordance with that so to have the coalesce command and timestamping work correctly.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +3 -0
@@ -35,6 +35,9 @@ static int loongson_default_data(struct plat_stmmacenet_data *plat)/* Disable RX queues routing by default */ plat->rx_queues_cfg[0 ].pkt_route =0x0 ; + plat->clk_ref_rate =125000000 ; + plat->clk_ptp_rate =125000000 ; +/* Default to phy auto-detection */ plat->phy_addr =-1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/691 wifi: rtw88: remove CPT execution branch never used
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 77c977327dfaa9ae2e154964cdb89ceb5c7b7cf1 ]
In 'rtw_coex_action_bt_a2dp_pan', 'wl_cpt_test' and 'bt_cpt_test' are hardcoded to false, so corresponding 'table_case' and 'tdma_case' assignments are never met.
Also 'rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[1])' is never executed. Assuming that CPT was never fully implemented, remove lookalike leftovers. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/realtek/rtw88/coex.c | 38 ++++++----------------- 1 file changed, 10 insertions(+), 28 deletions(-)
drivers/net/wireless/realtek/rtw88/coex.c +10 -28
@@ -2103,7 +2103,6 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)struct rtw_efuse *efuse = &rtwdev->efuse;struct rtw_chip_info *chip = rtwdev->chip;u8 table_case, tdma_case; -bool wl_cpt_test = false, bt_cpt_test = false;rtw_dbg (rtwdev,RTW_DBG_COEX ,"[BTCoex], %s()\n" , __func__);
@@ -2111,29 +2110,16 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]);if (efuse->share_ant) {/* Shared-Ant */ -if (wl_cpt_test) { -if (coex_stat->wl_gl_busy) { - table_case =20 ; - tdma_case =17 ; - }else { - table_case =10 ; - tdma_case =15 ; - } - }else if (bt_cpt_test) { - table_case =26 ; - tdma_case =26 ; - }else { -if (coex_stat->wl_gl_busy && - coex_stat->wl_noisy_level ==0 ) - table_case =14 ; -else - table_case =10 ; +if (coex_stat->wl_gl_busy && + coex_stat->wl_noisy_level ==0 ) + table_case =14 ; +else + table_case =10 ; -if (coex_stat->wl_gl_busy) - tdma_case =15 ; -else - tdma_case =20 ; - } +if (coex_stat->wl_gl_busy) + tdma_case =15 ; +else + tdma_case =20 ; }else {/* Non-Shared-Ant */ table_case =112 ;
@@ -2144,11 +2130,7 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev) tdma_case =120 ; } -if (wl_cpt_test) -rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[1 ]); -else -rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]); - +rtw_coex_set_rf_para (rtwdev, chip->wl_rf_para_rx[0 ]);rtw_coex_table (rtwdev, false, table_case);rtw_coex_tdma (rtwdev, false, tdma_case); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/691 fs: explicitly unregister per-superblock BDIs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 0b3ea0926afb8dde70cfab00316ae0a70b93a7cc ]
Add a new SB_I_ flag to mark superblocks that have an ephemeral bdi associated with them, and unregister it when the superblock is shut down.
Stable-dep-of: 4bcda1eaf184 ("mount: handle OOM on mnt_warn_timestamp_expiry")
--- fs/super.c | 3 +++ include/linux/fs.h | 1 + 2 files changed, 4 insertions(+)
fs/super.c +3 -0
@@ -486,6 +486,8 @@ void generic_shutdown_super(struct super_block *sb)spin_unlock (&sb_lock);up_write (&sb->s_umount);if (sb->s_bdi != &noop_backing_dev_info) { +if (sb->s_iflags &SB_I_PERSB_BDI ) +bdi_unregister (sb->s_bdi);bdi_put (sb->s_bdi); sb->s_bdi = &noop_backing_dev_info; }
@@ -1592,6 +1594,7 @@ int super_setup_bdi_name(struct super_block *sb, char *fmt, ...) }WARN_ON (sb->s_bdi != &noop_backing_dev_info); sb->s_bdi = bdi; + sb->s_iflags |=SB_I_PERSB_BDI ;return 0 ; }
include/linux/fs.h +1 -0
@@ -1476,6 +1476,7 @@ extern int send_sigurg(struct fown_struct *fown);#define SB_I_UNTRUSTED_MOUNTER 0x00000040#define SB_I_SKIP_SYNC 0x00000100/* Skip superblock at global sync */ +#define SB_I_PERSB_BDI 0x00000200/* has a per-sb bdi */ /* Possible states of 'frozen' field */ enum {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/691 mount: warn only once about timestamp range expiration
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <[email protected]>
[ Upstream commit a128b054ce029554a4a52fc3abb8c1df8bafcaef ]
Commit f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry") introduced a mount warning regarding filesystem timestamp limits, that is printed upon each writable mount or remount.
This can result in a lot of unnecessary messages in the kernel log in setups where filesystems are being frequently remounted (or mounted multiple times).
Avoid this by setting a superblock flag which indicates that the warning has been emitted at least once for any particular mount, as suggested in [1].
Stable-dep-of: 4bcda1eaf184 ("mount: handle OOM on mnt_warn_timestamp_expiry")
--- fs/namespace.c | 2 ++ include/linux/fs.h | 1 + 2 files changed, 3 insertions(+)
fs/namespace.c +2 -0
@@ -2567,6 +2567,7 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *struct super_block *sb = mnt->mnt_sb;if (!__mnt_is_readonly (mnt) && + (!(sb->s_iflags &SB_I_TS_EXPIRY_WARNED )) && (ktime_get_real_seconds () +TIME_UPTIME_SEC_MAX > sb->s_time_max)) {char *buf = (char *)__get_free_page (GFP_KERNEL );char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM );
@@ -2581,6 +2582,7 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * tm.tm_year+1900, (unsigned long long)sb->s_time_max);free_page ((unsigned long )buf); + sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ; } }
include/linux/fs.h +1 -0
@@ -1477,6 +1477,7 @@ extern int send_sigurg(struct fown_struct *fown);#define SB_I_SKIP_SYNC 0x00000100/* Skip superblock at global sync */ #define SB_I_PERSB_BDI 0x00000200/* has a per-sb bdi */ +#define SB_I_TS_EXPIRY_WARNED 0x00000400/* warned about timestamp range expiry */ /* Possible states of 'frozen' field */ enum {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/691 fs/namespace: fnic: Switch to use %ptTd
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 74e60b8b2f0fe3702710e648a31725ee8224dbdf ]
Use %ptTd instead of open-coded variant to print contents of time64_t type in human readable form.
Stable-dep-of: 4bcda1eaf184 ("mount: handle OOM on mnt_warn_timestamp_expiry")
--- fs/namespace.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
fs/namespace.c +3 -6
@@ -2571,15 +2571,12 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {char *buf = (char *)__get_free_page (GFP_KERNEL );char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM ); -struct tm tm; -time64_to_tm (sb->s_time_max,0 , &tm); - -pr_warn ("%s filesystem being %s at %s supports timestamps until %04ld (0x%llx)\n" , +pr_warn ("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n" , sb->s_type->name,is_mounted (mnt) ?"remounted" :"mounted" , - mntpath, - tm.tm_year+1900 , (unsigned long long )sb->s_time_max); + mntpath, &sb->s_time_max, + (unsigned long long )sb->s_time_max);free_page ((unsigned long )buf); sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/691 mount: handle OOM on mnt_warn_timestamp_expiry
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olaf Hering <[email protected]>
[ Upstream commit 4bcda1eaf184e308f07f9c61d3a535f9ce477ce8 ]
If no page could be allocated, an error pointer was used as format string in pr_warn.
Rearrange the code to return early in case of OOM. Also add a check for the return value of d_path.
--- fs/namespace.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/namespace.c +11 -3
@@ -2569,8 +2569,15 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *if (!__mnt_is_readonly (mnt) && (!(sb->s_iflags &SB_I_TS_EXPIRY_WARNED )) && (ktime_get_real_seconds () +TIME_UPTIME_SEC_MAX > sb->s_time_max)) { -char *buf = (char *)__get_free_page (GFP_KERNEL ); -char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM ); +char *buf, *mntpath; + + buf = (char *)__get_free_page (GFP_KERNEL ); +if (buf) + mntpath =d_path (mountpoint, buf,PAGE_SIZE ); +else + mntpath =ERR_PTR (-ENOMEM ); +if (IS_ERR (mntpath)) + mntpath ="(unknown)" ; pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n", sb->s_type->name,
@@ -2578,8 +2585,9 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * mntpath, &sb->s_time_max, (unsigned long long)sb->s_time_max); -free_page ((unsigned long )buf); sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ; +if (buf) +free_page ((unsigned long )buf); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/691 wifi: iwlwifi: mvm: increase the time between ranging measurements
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit 3a7ee94559dfd640604d0265739e86dec73b64e8 ]
The algo running in fw may take a little longer than 5 milliseconds, (e.g. measurement on 80MHz while associated). Increase the minimum time between measurements to 7 milliseconds.
--- drivers/net/wireless/intel/iwlwifi/mvm/constants.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/constants.h +1 -1
@@ -103,7 +103,7 @@#define IWL_MVM_FTM_INITIATOR_SECURE_LTF false#define IWL_MVM_FTM_RESP_NDP_SUPPORT true#define IWL_MVM_FTM_RESP_LMR_FEEDBACK_SUPPORT true -#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR 5 +#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR 7#define IWL_MVM_FTM_NON_TB_MAX_TIME_BETWEEN_MSR 1000#define IWL_MVM_D3_DEBUG false#define IWL_MVM_USE_TWT true
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/691 padata: Honor the callers alignment in case of chunk_size 0
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamlesh Gurudasani <[email protected]>
[ Upstream commit 24cc57d8faaa4060fd58adf810b858fcfb71a02f ]
In the case where we are forcing the ps.chunk_size to be at least 1, we are ignoring the caller's alignment.
Move the forcing of ps.chunk_size to be at least 1 before rounding it up to caller's alignment, so that caller's alignment is honored.
While at it, use max() to force the ps.chunk_size to be at least 1 to improve readability.
--- kernel/padata.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/padata.c +3 -0
@@ -503,9 +503,12 @@ void __init padata_do_multithreaded(struct padata_mt_job *job)* thread function. Load balance large jobs between threads by * increasing the number of chunks, guarantee at least the minimum * chunk size from the caller, and honor the caller's alignment. +* Ensure chunk_size is at least 1 to prevent divide-by-0 +* panic in padata_mt_helper(). */ ps.chunk_size = job->size / (ps.nworks * load_balance_factor); ps.chunk_size =max (ps.chunk_size, job->min_chunk); + ps.chunk_size =max (ps.chunk_size,1ul ); ps.chunk_size =roundup (ps.chunk_size, job->align);/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/691 can: j1939: use correct function name in comment
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Changzhong <[email protected]>
[ Upstream commit dc2ddcd136fe9b6196a7dd01f75f824beb02d43f ]
The function j1939_cancel_all_active_sessions() was renamed to j1939_cancel_active_session() but name in comment wasn't updated.
--- net/can/j1939/transport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/can/j1939/transport.c +4 -4
@@ -1179,10 +1179,10 @@ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer)break ;case -ENETDOWN :/* In this case we should get a netdev_event(), all active -* sessions will be cleared by -* j1939_cancel_all_active_sessions(). So handle this as an -* error, but let j1939_cancel_all_active_sessions() do the -* cleanup including propagation of the error to user space. +* sessions will be cleared by j1939_cancel_active_session(). +* So handle this as an error, but let +* j1939_cancel_active_session() do the cleanup including +* propagation of the error to user space. */ break ;case -EOVERFLOW :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/691 ACPI: bus: Avoid using CPPC if not supported by firmware
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit c42fa24b44751c62c86e98430ef915c0609a2ab8 ]
If the platform firmware indicates that it does not support CPPC by clearing the OSC_SB_CPC_SUPPORT and OSC_SB_CPCV2_SUPPORT bits in the platform _OSC capabilities mask, avoid attempting to evaluate _CPC which may fail in that case.
Because the OSC_SB_CPC_SUPPORT and OSC_SB_CPCV2_SUPPORT bits are only added to the supported platform capabilities mask on x86, when X86_FEATURE_HWP is supported, allow _CPC to be evaluated regardless in the other cases.
Stable-dep-of: 60949b7b8054 ("ACPI: CPPC: Fix MASK_VAL() usage")
--- drivers/acpi/bus.c | 8 ++++++++ drivers/acpi/cppc_acpi.c | 3 +++ include/linux/acpi.h | 1 + 3 files changed, 12 insertions(+)
drivers/acpi/bus.c +8 -0
@@ -283,6 +283,8 @@ EXPORT_SYMBOL_GPL(osc_pc_lpi_support_confirmed);bool osc_sb_native_usb4_support_confirmed;EXPORT_SYMBOL_GPL (osc_sb_native_usb4_support_confirmed); +bool osc_sb_cppc_not_supported; +static u8 sb_uuid_str[] ="0811B06E-4A27-44F9-8D60-3CBBC22E7B48" ;static void acpi_bus_osc_negotiate_platform_control (void ) {
@@ -338,6 +340,12 @@ static void acpi_bus_osc_negotiate_platform_control(void)return ; } +#ifdef CONFIG_X86 +if (boot_cpu_has (X86_FEATURE_HWP )) + osc_sb_cppc_not_supported = !(capbuf_ret[OSC_SUPPORT_DWORD ] & + (OSC_SB_CPC_SUPPORT |OSC_SB_CPCV2_SUPPORT )); +#endif +/* * Now run _OSC again with query flag clear and with the caps * supported by both the OS and the platform.
drivers/acpi/cppc_acpi.c +3 -0
@@ -673,6 +673,9 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)acpi_status status;int ret = -EFAULT ; +if (osc_sb_cppc_not_supported) +return -ENODEV ; +/* Parse the ACPI _CPC table for this CPU. */ status =acpi_evaluate_object_typed (handle,"_CPC" ,NULL , &output,ACPI_TYPE_PACKAGE );
include/linux/acpi.h +1 -0
@@ -561,6 +561,7 @@ acpi_status acpi_run_osc(acpi_handle handle, struct acpi_osc_context *context);extern bool osc_sb_apei_support_acked;extern bool osc_pc_lpi_support_confirmed;extern bool osc_sb_native_usb4_support_confirmed; +extern bool osc_sb_cppc_not_supported;/* USB4 Capabilities */ #define OSC_USB_USB3_TUNNELING 0x00000001
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/691 ACPI: CPPC: Fix MASK_VAL() usage
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 60949b7b805424f21326b450ca4f1806c06d982e ]
MASK_VAL() was added as a way to handle bit_offset and bit_width for registers located in system memory address space. However, while suited for reading, it does not work for writing and result in corrupted registers when writing values with bit_offset > 0. Moreover, when a register is collocated with another one at the same address but with a different mask, the current code results in the other registers being overwritten with 0s. The write procedure for SYSTEM_MEMORY registers should actually read the value, mask it, update it and write it with the updated value. Moreover, since registers can be located in the same word, we must take care of locking the access before doing it. We should potentially use a global lock since we don't know in if register addresses aren't shared with another _CPC package but better not encourage vendors to do so. Assume that registers can use the same word inside a _CPC package and thus, use a per _CPC package lock.
--- drivers/acpi/cppc_acpi.c | 43 ++++++++++++++++++++++++++++++++++++---- include/acpi/cppc_acpi.h | 2 ++ 2 files changed, 41 insertions(+), 4 deletions(-)
drivers/acpi/cppc_acpi.c +39 -4
@@ -165,8 +165,11 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);#define GET_BIT_WIDTH (reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width)/* Shift and apply the mask for CPC reads/writes */ -#define MASK_VAL (reg, val) (((val) >> (reg)->bit_offset) & \ +#define MASK_VAL_READ (reg, val) (((val) >> (reg)->bit_offset) & \ GENMASK(((reg)->bit_width) - 1, 0)) +#define MASK_VAL_WRITE (reg, prev_val, val) \ + ((((val) & GENMASK(((reg)->bit_width) - 1, 0)) << (reg)->bit_offset) | \ + ((prev_val) & ~(GENMASK(((reg)->bit_width) - 1, 0) << (reg)->bit_offset))) \static ssize_t show_feedback_ctrs (struct kobject *kobj,struct kobj_attribute *attr,char *buf)
@@ -810,6 +813,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)/* Store CPU Logical ID */ cpc_ptr->cpu_id = pr->id; +spin_lock_init (&cpc_ptr->rmw_lock);/* Parse PSD data for this CPU */ ret =acpi_get_psd (cpc_ptr, handle);
@@ -1002,7 +1006,7 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) }if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) - *val =MASK_VAL (reg, *val); + *val =MASK_VAL_READ (reg, *val);return ret_val; }
@@ -1011,9 +1015,11 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val) {int ret_val =0 ;int size; +u64 prev_val;void __iomem *vaddr =NULL ;int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu);struct cpc_reg *reg = ®_res->cpc_entry.reg; +struct cpc_desc *cpc_desc; size =GET_BIT_WIDTH (reg);
@@ -1034,8 +1040,34 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)return acpi_os_write_memory ((acpi_physical_address )reg->address, val, size); -if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) - val =MASK_VAL (reg, val); +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) { + cpc_desc =per_cpu (cpc_desc_ptr, cpu); +if (!cpc_desc) { +pr_debug ("No CPC descriptor for CPU:%d\n" , cpu); +return -ENODEV ; + } + +spin_lock (&cpc_desc->rmw_lock); +switch (size) { +case 8 : + prev_val =readb_relaxed (vaddr); +break ; +case 16 : + prev_val =readw_relaxed (vaddr); +break ; +case 32 : + prev_val =readl_relaxed (vaddr); +break ; +case 64 : + prev_val =readq_relaxed (vaddr); +break ; +default : +spin_unlock (&cpc_desc->rmw_lock); +return -EFAULT ; + } + val =MASK_VAL_WRITE (reg, prev_val, val); + val |= prev_val; + }switch (size) {case 8 :
@@ -1062,6 +1094,9 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)break ; } +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) +spin_unlock (&cpc_desc->rmw_lock); +return ret_val; }
include/acpi/cppc_acpi.h +2 -0
@@ -64,6 +64,8 @@ struct cpc_desc {int cpu_id;int write_cmd_status;int write_cmd_id; +/* Lock used for RMW operations in cpc_write() */ +spinlock_t rmw_lock;struct cpc_register_resource cpc_regs[MAX_CPC_REG_ENT ];struct acpi_psd_package domain_info;struct kobject kobj;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/691 netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e0c47281723f301894c14e6f5cd5884fdfb813f9 ]
Element timeout that is below CONFIG_HZ never expires because the timeout extension is not allocated given that nf_msecs_to_jiffies64() returns 0. Set timeout to the minimum value to honor timeout.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -4153,7 +4153,7 @@ int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)return -ERANGE ; ms *=NSEC_PER_MSEC ; - *result =nsecs_to_jiffies64 (ms); + *result =nsecs_to_jiffies64 (ms) ? : !!ms;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/691 netfilter: nf_tables: reject element expiration with no timeout
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit d2dc429ecb4e79ad164028d965c00f689e6f6d06 ]
If element timeout is unset and set provides no default timeout, the element expiration is silently ignored, reject this instead to let user know this is unsupported.
Also prepare for supporting timeout that never expire, where zero timeout and expiration must be also rejected.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -6295,6 +6295,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (nla[NFTA_SET_ELEM_EXPIRATION ] !=NULL ) {if (!(set->flags &NFT_SET_TIMEOUT ))return -EINVAL ; +if (timeout ==0 ) +return -EOPNOTSUPP ; + err =nf_msecs_to_jiffies64 (nla[NFTA_SET_ELEM_EXPIRATION ], &expiration);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/691 netfilter: nf_tables: reject expiration higher than timeout
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c0f38a8c60174368aed1d0f9965d733195f15033 ]
Report ERANGE to userspace if user specifies an expiration larger than the timeout.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -6302,6 +6302,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, &expiration);if (err)return err; + +if (expiration > timeout) +return -ERANGE ; }if (nla[NFTA_SET_ELEM_EXPR ]) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/691 netfilter: nf_tables: remove annotation to access set timeout while holding lock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 15d8605c0cf4fc9cf4386cae658c68a0fd4bdb92 ]
Mutex is held when adding an element, no need for READ_ONCE, remove it.
--- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +2 -2
@@ -6288,7 +6288,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,return err; }else if (set->flags &NFT_SET_TIMEOUT && !(flags &NFT_SET_ELEM_INTERVAL_END )) { - timeout =READ_ONCE (set->timeout); + timeout = set->timeout; } expiration =0 ;
@@ -6395,7 +6395,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (err <0 ) goto err_parse_key_end; -if (timeout !=READ_ONCE (set->timeout)) { +if (timeout != set->timeout) { err =nft_set_ext_add (&tmpl,NFT_SET_EXT_TIMEOUT );if (err <0 ) goto err_parse_key_end;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/691 cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
[ Upstream commit abc00ffda43bd4ba85896713464c7510c39f8165 ]
Commit b4bc9f9e27ed ("cpufreq: ti-cpufreq: add support for omap34xx and omap36xx") introduced special handling for OMAP3 class devices where syscon node may not be present. However, this also creates a bug where the syscon node is present, however the offset used to read is beyond the syscon defined range.
Fix this by providing a quirk option that is populated when such special handling is required. This allows proper failure for all other platforms when the syscon node and efuse offsets are mismatched.
--- drivers/cpufreq/ti-cpufreq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/cpufreq/ti-cpufreq.c +8 -2
@@ -53,6 +53,9 @@ struct ti_cpufreq_soc_data {unsigned long efuse_shift;unsigned long rev_offset;bool multi_regulator; +/* Backward compatibility hack: Might have missing syscon */ +#define TI_QUIRK_SYSCON_MAY_BE_MISSING 0x1 +u8 quirks; };struct ti_cpufreq_data {
@@ -156,6 +159,7 @@ static struct ti_cpufreq_soc_data omap34xx_soc_data = { .efuse_mask = BIT(3), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -183,6 +187,7 @@ static struct ti_cpufreq_soc_data omap36xx_soc_data = { .efuse_mask = BIT(9), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = true, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -197,6 +202,7 @@ static struct ti_cpufreq_soc_data am3517_soc_data = { .efuse_mask = 0, .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };
@@ -216,7 +222,7 @@ static int ti_cpufreq_get_efuse(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->efuse_offset, &efuse); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->efuse_offset,4 );
@@ -257,7 +263,7 @@ static int ti_cpufreq_get_rev(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->rev_offset, &revision); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->rev_offset,4 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/691 x86/sgx: Fix deadlock in SGX NUMA node search
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Lu <[email protected]>
[ Upstream commit 9c936844010466535bd46ea4ce4656ef17653644 ]
When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask.
Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality.
Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.
--- arch/x86/kernel/cpu/sgx/main.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
arch/x86/kernel/cpu/sgx/main.c +14 -13
@@ -505,24 +505,25 @@ struct sgx_epc_page *__sgx_alloc_epc_page(void) {struct sgx_epc_page *page;int nid_of_current =numa_node_id (); -int nid = nid_of_current; +int nid_start, nid; -if (node_isset (nid_of_current, sgx_numa_mask)) { - page =__sgx_alloc_epc_page_from_node (nid_of_current); -if (page) -return page; - } - -/* Fall back to the non-local NUMA nodes: */ -while (true) { - nid =next_node_in (nid, sgx_numa_mask); -if (nid == nid_of_current) -break ; +/* +* Try local node first. If it doesn't have an EPC section, +* fall back to the non-local NUMA nodes. +*/ +if (node_isset (nid_of_current, sgx_numa_mask)) + nid_start = nid_of_current; +else + nid_start =next_node_in (nid_of_current, sgx_numa_mask); + nid = nid_start; +do { page =__sgx_alloc_epc_page_from_node (nid);if (page)return page; - } + + nid =next_node_in (nid, sgx_numa_mask); + }while (nid != nid_start);return ERR_PTR (-ENOMEM ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/691 wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit a26a5107bc52922cf5f67361e307ad66547b51c7 ]
Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the following:
[ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25 [ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]' <...skipped...>
[ T4985] Call Trace:
[ T4985] <TASK> [ T4985] dump_stack_lvl+0x1c2/0x2a0 [ T4985] ? __pfx_dump_stack_lvl+0x10/0x10 [ T4985] ? __pfx__printk+0x10/0x10 [ T4985] __ubsan_handle_out_of_bounds+0x127/0x150 [ T4985] cfg80211_wext_siwscan+0x11a4/0x1260
<...the rest is not too useful...>
Even if we do 'creq->n_channels = n_channels' before 'creq->ssids = (void *)&creq->channels[n_channels]', UBSAN treats the latter as off-by-one error. Fix this by using pointer arithmetic rather than an expression with explicit array indexing and use convenient 'struct_size()' to simplify the math here and in 'kzalloc()' above.
--- net/wireless/scan.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/wireless/scan.c +3 -3
@@ -2813,8 +2813,8 @@ int cfg80211_wext_siwscan(struct net_device *dev, n_channels =ieee80211_get_num_supported_channels (wiphy); } - creq =kzalloc (sizeof (*creq) +sizeof (struct cfg80211_ssid ) + - n_channels *sizeof (void *), + creq =kzalloc (struct_size (creq, channels, n_channels) + +sizeof (struct cfg80211_ssid ),GFP_ATOMIC );if (!creq) { err = -ENOMEM ;
@@ -2824,7 +2824,7 @@ int cfg80211_wext_siwscan(struct net_device *dev, creq->wiphy = wiphy; creq->wdev = dev->ieee80211_ptr;/* SSIDs come after channels */ - creq->ssids = (void *)&creq->channels[n_channels]; + creq->ssids = (void *)creq +struct_size (creq, channels, n_channels); creq->n_channels = n_channels; creq->n_ssids =1 ; creq->scan_start = jiffies;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/691 wifi: mt76: mt7915: fix rx filter setting for bfee functionality
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit 6ac80fce713e875a316a58975b830720a3e27721 ]
Fix rx filter setting to prevent dropping NDPA frames. Without this change, bfee functionality may behave abnormally.
--- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/main.c +1 -2
@@ -526,8 +526,7 @@ static void mt7915_configure_filter(struct ieee80211_hw *hw,MT76_FILTER (CONTROL ,MT_WF_RFCR_DROP_CTS |MT_WF_RFCR_DROP_RTS | -MT_WF_RFCR_DROP_CTL_RSV | -MT_WF_RFCR_DROP_NDPA ); +MT_WF_RFCR_DROP_CTL_RSV ); *total_flags = flags;mt76_wr (dev,MT_WF_RFCR (band), phy->rxfilter);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/691 wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 15ea13b1b1fbf6364d4cd568e65e4c8479632999 ]
Although not reproduced in practice, these two cases may be considered by UBSAN as off-by-one errors. So fix them in the same way as in commit a26a5107bc52 ("wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()").
--- net/wireless/nl80211.c | 3 ++- net/wireless/sme.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/wireless/nl80211.c +2 -1
@@ -8784,7 +8784,8 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,return ERR_PTR (-ENOMEM );if (n_ssids) - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids = n_ssids;if (ie_len) {if (n_ssids)
net/wireless/sme.c +2 -1
@@ -115,7 +115,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev) n_channels = i; } request->n_channels = n_channels; - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids =1 ; memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/691 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 9d301de12da6e1bb069a9835c38359b8e8135121 ]
Since '__dev_queue_xmit()' should be called with interrupts enabled, the following backtrace:
ieee80211_do_stop()
...
spin_lock_irqsave(&local->queue_stop_reason_lock, flags)
...
ieee80211_free_txskb()
ieee80211_report_used_skb()
ieee80211_report_ack_skb()
cfg80211_mgmt_tx_status_ext()
nl80211_frame_tx_status()
genlmsg_multicast_netns()
genlmsg_multicast_netns_filtered()
nlmsg_multicast_filtered()
netlink_broadcast_filtered()
do_one_broadcast()
netlink_broadcast_deliver()
__netlink_sendskb()
netlink_deliver_tap()
__netlink_deliver_tap_skb()
dev_queue_xmit()
__dev_queue_xmit() ; with IRQS disabled ...
spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)
issues the warning (as reported by syzbot reproducer):
WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120
Fix this by implementing a two-phase skb reclamation in 'ieee80211_do_stop()', where actual work is performed outside of a section with interrupts disabled.
--- net/mac80211/iface.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/mac80211/iface.c +16 -1
@@ -369,6 +369,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do {struct ieee80211_local *local = sdata->local;unsigned long flags; +struct sk_buff_head freeq;struct sk_buff *skb, *tmp;u32 hw_reconf_flags =0 ;int i, flushed;
@@ -555,18 +556,32 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doskb_queue_purge (&sdata->status_queue); } +/* +* Since ieee80211_free_txskb() may issue __dev_queue_xmit() +* which should be called with interrupts enabled, reclamation +* is done in two phases: +*/ +__skb_queue_head_init (&freeq); + +/* unlink from local queues... */ spin_lock_irqsave (&local->queue_stop_reason_lock, flags);for (i =0 ; i <IEEE80211_MAX_QUEUES ; i++) { skb_queue_walk_safe(&local->pending[i], skb, tmp) {struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb);if (info->control.vif == &sdata->vif) {__skb_unlink (skb, &local->pending[i]); -ieee80211_free_txskb (&local->hw, skb); +__skb_queue_tail (&freeq, skb); } } }spin_unlock_irqrestore (&local->queue_stop_reason_lock, flags); +/* ... and perform actual reclamation with interrupts enabled. */ + skb_queue_walk_safe(&freeq, skb, tmp) { +__skb_unlink (skb, &freeq); +ieee80211_free_txskb (&local->hw, skb); + } +if (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN )ieee80211_txq_remove_vlan (local, sdata);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/691 wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawei Ye <[email protected]>
[ Upstream commit 6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8 ]
In the wilc_parse_join_bss_param function, the TSF field of the ies structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free issues.
This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues.
To address this, the TSF value is now stored in a local variable ies_tsf before the RCU lock is released. The param->tsf_lo field is then assigned using this local variable, ensuring that the TSF value is safely accessed.
--- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/microchip/wilc1000/hif.c +3 -1
@@ -366,6 +366,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,struct wilc_join_bss_param *param;u8 rates_len =0 ;int ies_len; +u64 ies_tsf;int ret; param =kzalloc (sizeof (*param),GFP_KERNEL );
@@ -381,6 +382,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,return NULL ; } ies_len = ies->len; + ies_tsf = ies->tsf;rcu_read_unlock (); param->beacon_period =cpu_to_le16 (bss->beacon_interval);
@@ -436,7 +438,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,IEEE80211_P2P_ATTR_ABSENCE_NOTICE , (u8 *)&noa_attr, sizeof(noa_attr));if (ret >0 ) { - param->tsf_lo =cpu_to_le32 (ies->tsf); + param->tsf_lo =cpu_to_le32 (ies_tsf); param->noa_enabled =1 ; param->idx = noa_attr.index;if (noa_attr.oppps_ctwindow &IEEE80211_P2P_OPPPS_ENABLE_BIT ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/691 sock_map: Add a cond_resched() in sock_hash_free()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b1339be951ad31947ae19bc25cb08769bf255100 ]
Several syzbot soft lockup reports all have in common sock_hash_free()
If a map with a large number of buckets is destroyed, we need to yield the cpu when needed.
--- net/core/sock_map.c | 1 + 1 file changed, 1 insertion(+)
net/core/sock_map.c +1 -0
@@ -1177,6 +1177,7 @@ static void sock_hash_free(struct bpf_map *map)sock_put (elem->sk);sock_hash_free_elem (htab, elem); } +cond_resched (); }/* wait for psock readers accessing its map link */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/691 can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 94b0818fa63555a65f6ba107080659ea6bcca63e ]
syzbot reported a warning in bcm_release(). [0]
The blamed change fixed another warning that is triggered when connect() is issued again for a socket whose connect()ed device has been unregistered.
However, if the socket is just close()d without the 2nd connect(), the remaining bo->bcm_proc_read triggers unnecessary remove_proc_entry() in bcm_release().
Let's clear bo->bcm_proc_read after remove_proc_entry() in bcm_notify().
[0]
name '4986'
WARNING: CPU: 0 PID: 5234 at fs/proc/generic.c:711 remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Modules linked in: CPU: 0 UID: 0 PID: 5234 Comm: syz-executor606 Not tainted 6.11.0-rc5-syzkaller-00178-g5517ae241919 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Code: ff eb 05 e8 cb 1e 5e ff 48 8b 5c 24 10 48 c7 c7 e0 f7 aa 8e e8 2a 38 8e 09 90 48 c7 c7 60 3a 1b 8c 48 89 de e8 da 42 20 ff 90 <0f> 0b 90 90 48 8b 44 24 18 48 c7 44 24 40 0e 36 e0 45 49 c7 04 07 RSP: 0018:ffffc9000345fa20 EFLAGS: 00010246 RAX: 2a2d0aee2eb64600 RBX: ffff888032f1f548 RCX: ffff888029431e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000345fb08 R08: ffffffff8155b2f2 R09: 1ffff1101710519a R10: dffffc0000000000 R11: ffffed101710519b R12: ffff888011d38640 R13: 0000000000000004 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcfb52722f0 CR3: 000000000e734000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> bcm_release+0x250/0x880 net/can/bcm.c:1578 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcfb51ee969 Code: Unable to access opcode bytes at 0x7fcfb51ee93f. RSP: 002b:00007ffce0109ca8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fcfb51ee969 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 00007fcfb526f3b0 R08: ffffffffffffffb8 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007fcfb526f3b0 R13: 0000000000000000 R14: 00007fcfb5271ee0 R15: 00007fcfb51bf160 </TASK>
--- net/can/bcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/can/bcm.c +3 -1
@@ -1424,8 +1424,10 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,/* remove device reference, if this is our bound device */ if (bo->bound && bo->ifindex == dev->ifindex) {#if IS_ENABLED (CONFIG_PROC_FS ) -if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) +if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) {remove_proc_entry (bo->procname,sock_net (sk)->can.bcmproc_dir); + bo->bcm_proc_read =NULL ; + }#endif bo->bound =0 ; bo->ifindex =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/691 can: m_can: m_can_close(): stop clocks after device has been shut down
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 2c09b50efcad985cf920ca88baa9aa52b1999dcc ]
After calling m_can_stop() an interrupt may be pending or NAPI might still be executed. This means the driver might still touch registers of the IP core after the clocks have been disabled. This is not good practice and might lead to aborts depending on the SoC integration.
To avoid these potential problems, make m_can_close() symmetric to m_can_open(), i.e. stop the clocks at the end, right before shutting down the transceiver.
--- drivers/net/can/m_can/m_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +1 -1
@@ -1583,7 +1583,6 @@ static int m_can_close(struct net_device *dev)napi_disable (&cdev->napi);m_can_stop (dev); -m_can_clk_stop (cdev);free_irq (dev->irq, dev);if (cdev->is_peripheral) {
@@ -1598,6 +1597,7 @@ static int m_can_close(struct net_device *dev)close_candev (dev);can_led_event (dev,CAN_LED_EVENT_STOP ); +m_can_clk_stop (cdev);phy_power_off (cdev->transceiver);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/691 Bluetooth: btusb: Fix not handling ZPL/short-transfer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 7b05933340f4490ef5b09e84d644d12484b05fdf ]
Requesting transfers of the exact same size of wMaxPacketSize may result in ZPL/short-transfer since the USB stack cannot handle it as we are limiting the buffer size to be the same as wMaxPacketSize.
Also, in terms of throughput this change has the same effect to interrupt endpoint as 290ba200815f "Bluetooth: Improve USB driver throughput by increasing the frame size" had for the bulk endpoint, so users of the advertisement bearer (e.g. BT Mesh) may benefit from this change.
--- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +4 -1
@@ -1002,7 +1002,10 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)if (!urb)return -ENOMEM ; - size =le16_to_cpu (data->intr_ep->wMaxPacketSize); +/* Use maximum HCI Event size so the USB stack handles +* ZPL/short-transfer automatically. +*/ + size =HCI_MAX_EVENT_SIZE ; buf =kmalloc (size, mem_flags);if (!buf) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/691 bareudp: Pull inner IP header in bareudp_udp_encap_recv().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 45fa29c85117170b0508790f878b13ec6593c888 ]
Bareudp reads the inner IP header to get the ECN value. Therefore, it needs to ensure that it's part of the skb's linear data.
This is similar to the vxlan and geneve fixes for that same problem:
* commit f7789419137b ("vxlan: Pull inner IP header in vxlan_rcv().")
* commit 1ca1ba465e55 ("geneve: make sure to pull inner header in
geneve_rx()")
--- drivers/net/bareudp.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/net/bareudp.c +18 -2
@@ -60,6 +60,7 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)__be16 proto;void *oiph;int err; +int nh; bareudp =rcu_dereference_sk_user_data (sk);if (!bareudp)
@@ -137,10 +138,25 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) }skb_dst_set (skb, &tun_dst->dst); skb->dev = bareudp->dev; - oiph =skb_network_header (skb); -skb_reset_network_header (skb);skb_reset_mac_header (skb); +/* Save offset of outer header relative to skb->head, +* because we are going to reset the network header to the inner header +* and might change skb->head. +*/ + nh =skb_network_header (skb) - skb->head; + +skb_reset_network_header (skb); + +if (!pskb_inet_may_pull (skb)) { +DEV_STATS_INC (bareudp->dev, rx_length_errors); +DEV_STATS_INC (bareudp->dev, rx_errors); + goto drop; + } + +/* Get the outer header. */ + oiph = skb->head + nh; +if (!ipv6_mod_enabled () || family ==AF_INET ) err =IP_ECN_decapsulate (oiph, skb);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/691 net: geneve: support IPv4/IPv6 as inner protocol
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eyal Birger <[email protected]>
[ Upstream commit 435fe1c0c1f74b682dba85641406abf4337aade6 ]
This patch adds support for encapsulating IPv4/IPv6 within GENEVE.
In order to use this, a new IFLA_GENEVE_INNER_PROTO_INHERIT flag needs to be provided at device creation. This property cannot be changed for the time being.
In case IP traffic is received on a non-tun device the drop count is increased.
Stable-dep-of: c471236b2359 ("bareudp: Pull inner IP header on xmit.")
--- drivers/net/geneve.c | 82 +++++++++++++++++++++++++++--------- include/uapi/linux/if_link.h | 1 + 2 files changed, 64 insertions(+), 19 deletions(-)
drivers/net/geneve.c +63 -19
@@ -55,6 +55,7 @@ struct geneve_config {bool use_udp6_rx_checksums;bool ttl_inherit;enum ifla_geneve_df df; +bool inner_proto_inherit; };/* Pseudo network device */
@@ -250,17 +251,24 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, } } -skb_reset_mac_header (skb); - skb->protocol =eth_type_trans (skb, geneve->dev); -skb_postpull_rcsum (skb,eth_hdr (skb),ETH_HLEN ); -if (tun_dst)skb_dst_set (skb, &tun_dst->dst); -/* Ignore packet loops (and multicast echo) */ -if (ether_addr_equal (eth_hdr (skb)->h_source, geneve->dev->dev_addr)) { - geneve->dev->stats.rx_errors++; - goto drop; +if (gnvh->proto_type ==htons (ETH_P_TEB )) { +skb_reset_mac_header (skb); + skb->protocol =eth_type_trans (skb, geneve->dev); +skb_postpull_rcsum (skb,eth_hdr (skb),ETH_HLEN ); + +/* Ignore packet loops (and multicast echo) */ +if (ether_addr_equal (eth_hdr (skb)->h_source, + geneve->dev->dev_addr)) { + geneve->dev->stats.rx_errors++; + goto drop; + } + }else { +skb_reset_mac_header (skb); + skb->dev = geneve->dev; + skb->pkt_type =PACKET_HOST ; }/* Save offset of outer header relative to skb->head,
@@ -358,6 +366,7 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)struct genevehdr *geneveh;struct geneve_dev *geneve;struct geneve_sock *gs; +__be16 inner_proto;int opts_len;/* Need UDP and Geneve header to be present */
@@ -369,7 +378,11 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)if (unlikely (geneveh->ver !=GENEVE_VER )) goto drop; -if (unlikely (geneveh->proto_type !=htons (ETH_P_TEB ))) + inner_proto = geneveh->proto_type; + +if (unlikely ((inner_proto !=htons (ETH_P_TEB ) && + inner_proto !=htons (ETH_P_IP ) && + inner_proto !=htons (ETH_P_IPV6 )))) goto drop; gs =rcu_dereference_sk_user_data (sk);
@@ -380,9 +393,14 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)if (!geneve) goto drop; +if (unlikely ((!geneve->cfg.inner_proto_inherit && + inner_proto !=htons (ETH_P_TEB )))) { + geneve->dev->stats.rx_dropped++; + goto drop; + } + opts_len = geneveh->opt_len *4 ; -if (iptunnel_pull_header (skb,GENEVE_BASE_HLEN + opts_len, -htons (ETH_P_TEB ), +if (iptunnel_pull_header (skb,GENEVE_BASE_HLEN + opts_len, inner_proto, !net_eq (geneve->net,dev_net (geneve->dev)))) { geneve->dev->stats.rx_dropped++; goto drop;
@@ -730,7 +748,8 @@ static int geneve_stop(struct net_device *dev) }static void geneve_build_header (struct genevehdr *geneveh, -const struct ip_tunnel_info *info) +const struct ip_tunnel_info *info, +__be16 inner_proto) { geneveh->ver =GENEVE_VER ; geneveh->opt_len = info->options_len /4 ;
@@ -738,7 +757,7 @@ static void geneve_build_header(struct genevehdr *geneveh, geneveh->critical = !!(info->key.tun_flags &TUNNEL_CRIT_OPT ); geneveh->rsvd1 =0 ;tunnel_id_to_vni (info->key.tun_id, geneveh->vni); - geneveh->proto_type =htons (ETH_P_TEB ); + geneveh->proto_type = inner_proto; geneveh->rsvd2 =0 ;if (info->key.tun_flags &TUNNEL_GENEVE_OPT )
@@ -747,10 +766,12 @@ static void geneve_build_header(struct genevehdr *geneveh,static int geneve_build_skb (struct dst_entry *dst,struct sk_buff *skb,const struct ip_tunnel_info *info, -bool xnet,int ip_hdr_len) +bool xnet,int ip_hdr_len, +bool inner_proto_inherit) {bool udp_sum = !!(info->key.tun_flags &TUNNEL_CSUM );struct genevehdr *gnvh; +__be16 inner_proto;int min_headroom;int err;
@@ -768,8 +789,9 @@ static int geneve_build_skb(struct dst_entry *dst, struct sk_buff *skb, goto free_dst; gnvh =__skb_push (skb,sizeof (*gnvh) + info->options_len); -geneve_build_header (gnvh, info); -skb_set_inner_protocol (skb,htons (ETH_P_TEB )); + inner_proto = inner_proto_inherit ? skb->protocol :htons (ETH_P_TEB ); +geneve_build_header (gnvh, info, inner_proto); +skb_set_inner_protocol (skb, inner_proto);return 0 ; free_dst:
@@ -975,7 +997,8 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, } } - err =geneve_build_skb (&rt->dst, skb, info, xnet,sizeof (struct iphdr )); + err =geneve_build_skb (&rt->dst, skb, info, xnet,sizeof (struct iphdr ), + geneve->cfg.inner_proto_inherit);if (unlikely (err))return err;
@@ -1054,7 +1077,8 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, ttl = key->ttl; ttl = ttl ? :ip6_dst_hoplimit (dst); } - err =geneve_build_skb (dst, skb, info, xnet,sizeof (struct ipv6hdr )); + err =geneve_build_skb (dst, skb, info, xnet,sizeof (struct ipv6hdr ), + geneve->cfg.inner_proto_inherit);if (unlikely (err))return err;
@@ -1404,6 +1428,14 @@ static int geneve_configure(struct net *net, struct net_device *dev,dst_cache_reset (&geneve->cfg.info.dst_cache);memcpy (&geneve->cfg, cfg,sizeof (*cfg)); +if (geneve->cfg.inner_proto_inherit) { + dev->header_ops =NULL ; + dev->type =ARPHRD_NONE ; + dev->hard_header_len =0 ; + dev->addr_len =0 ; + dev->flags =IFF_NOARP ; + } + err =register_netdevice (dev);if (err)return err;
@@ -1577,10 +1609,18 @@ static int geneve_nl2info(struct nlattr *tb[], struct nlattr *data[],#endif } +if (data[IFLA_GENEVE_INNER_PROTO_INHERIT ]) { +if (changelink) { + attrtype =IFLA_GENEVE_INNER_PROTO_INHERIT ; + goto change_notsup; + } + cfg->inner_proto_inherit = true; + } +return 0 ; change_notsup:NL_SET_ERR_MSG_ATTR (extack, data[attrtype], -"Changing VNI, Port, endpoint IP address family, external, and UDP checksum attributes are not supported" ); +"Changing VNI, Port, endpoint IP address family, external, inner_proto_inherit, and UDP checksum attributes are not supported" );return -EOPNOTSUPP ; }
@@ -1815,6 +1855,10 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)if (nla_put_u8 (skb,IFLA_GENEVE_TTL_INHERIT , ttl_inherit)) goto nla_put_failure; +if (geneve->cfg.inner_proto_inherit && +nla_put_flag (skb,IFLA_GENEVE_INNER_PROTO_INHERIT )) + goto nla_put_failure; +return 0 ; nla_put_failure:
include/uapi/linux/if_link.h +1 -0
@@ -776,6 +776,7 @@ enum {IFLA_GENEVE_LABEL ,IFLA_GENEVE_TTL_INHERIT ,IFLA_GENEVE_DF , +IFLA_GENEVE_INNER_PROTO_INHERIT , __IFLA_GENEVE_MAX };#define IFLA_GENEVE_MAX (__IFLA_GENEVE_MAX - 1)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/691 geneve: Fix incorrect inner network header offset when innerprotoinherit is set
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit c6ae073f5903f6c6439d0ac855836a4da5c0a701 ]
When innerprotoinherit is set, the tunneled packets do not have an inner Ethernet header.
Change 'maclen' to not always assume the header length is ETH_HLEN, as there might not be a MAC header.
This resolves issues with drivers (e.g. mlx5, in mlx5e_tx_tunnel_accel()) who rely on the skb inner network header offset to be correct, and use it for TX offloads.
Stable-dep-of: c471236b2359 ("bareudp: Pull inner IP header on xmit.")
--- drivers/net/geneve.c | 10 ++++++---- include/net/ip_tunnels.h | 5 +++-- 2 files changed, 9 insertions(+), 6 deletions(-)
drivers/net/geneve.c +6 -4
@@ -914,6 +914,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,struct geneve_dev *geneve, const struct ip_tunnel_info *info) { + bool inner_proto_inherit = geneve->cfg.inner_proto_inherit;bool xnet = !net_eq (geneve->net,dev_net (geneve->dev));struct geneve_sock *gs4 =rcu_dereference (geneve->sock4);const struct ip_tunnel_key *key = &info->key;
@@ -925,7 +926,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!skb_vlan_inet_prepare (skb)) +if (!skb_vlan_inet_prepare (skb, inner_proto_inherit))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
@@ -998,7 +999,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, } err =geneve_build_skb (&rt->dst, skb, info, xnet,sizeof (struct iphdr ), - geneve->cfg.inner_proto_inherit); + inner_proto_inherit);if (unlikely (err))return err;
@@ -1014,6 +1015,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,struct geneve_dev *geneve, const struct ip_tunnel_info *info) { + bool inner_proto_inherit = geneve->cfg.inner_proto_inherit;bool xnet = !net_eq (geneve->net,dev_net (geneve->dev));struct geneve_sock *gs6 =rcu_dereference (geneve->sock6);const struct ip_tunnel_key *key = &info->key;
@@ -1023,7 +1025,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!skb_vlan_inet_prepare (skb)) +if (!skb_vlan_inet_prepare (skb, inner_proto_inherit))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
@@ -1078,7 +1080,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, ttl = ttl ? :ip6_dst_hoplimit (dst); } err =geneve_build_skb (dst, skb, info, xnet,sizeof (struct ipv6hdr ), - geneve->cfg.inner_proto_inherit); + inner_proto_inherit);if (unlikely (err))return err;
include/net/ip_tunnels.h +3 -2
@@ -334,9 +334,10 @@ static inline bool pskb_inet_may_pull(struct sk_buff *skb)/* Variant of pskb_inet_may_pull(). */ -static inline bool skb_vlan_inet_prepare (struct sk_buff *skb) +static inline bool skb_vlan_inet_prepare (struct sk_buff *skb, +bool inner_proto_inherit) { -int nhlen =0 , maclen =ETH_HLEN ; +int nhlen =0 , maclen = inner_proto_inherit ?0 :ETH_HLEN ;__be16 type = skb->protocol;/* Essentially this is skb_protocol(skb, true)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/691 bareudp: Pull inner IP header on xmit.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit c471236b2359e6b27388475dd04fff0a5e2bf922 ]
Both bareudp_xmit_skb() and bareudp6_xmit_skb() read their skb's inner IP header to get its ECN value (with ip_tunnel_ecn_encap()). Therefore we need to ensure that the inner IP header is part of the skb's linear data.
--- drivers/net/bareudp.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/bareudp.c +6 -0
@@ -312,6 +312,9 @@ static int bareudp_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be32 saddr;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
@@ -375,6 +378,9 @@ static int bareudp6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/691 net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 799a9225997799f7b1b579bc50a93b78b4fb2a01 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +1 -2
@@ -1883,12 +1883,11 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv)snprintf (v->name,sizeof (v->name),"%s-rxtx%d" , priv->ndev->name, i); - err =request_irq (irq, enetc_msix,0 , v->name, v); + err =request_irq (irq, enetc_msix,IRQF_NO_AUTOEN , v->name, v);if (err) {dev_err (priv->dev,"request_irq() failed!\n" ); goto irq_err; } -disable_irq (irq); v->tbier_base = hw->reg +ENETC_BDR (TX ,0 ,ENETC_TBIER ); v->rbier = hw->reg +ENETC_BDR (RX , i,ENETC_RBIER );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/691 r8169: disable ALDPS per default for RTL8125
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit b9c7ac4fe22c608acf6153a3329df2b6b6cd416c ]
En-Wei reported that traffic breaks if cable is unplugged for more than 3s and then re-plugged. This was supposed to be fixed by 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125"). But apparently this didn't fix the issue for everybody. The 3s threshold rang a bell, as this is the delay after which ALDPS kicks in. And indeed disabling ALDPS fixes the issue for this user. Maybe this fixes the issue in general. In a follow-up step we could remove the first fix attempt and see whether anybody complains.
--- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/realtek/r8169_phy_config.c +2 -0
@@ -1263,6 +1263,7 @@ static void rtl8125a_2_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xa86 ,0x15 ,0x0001 ,0x0000 );rtl8168g_enable_gphy_10m (phydev); +rtl8168g_disable_aldps (phydev);rtl8125a_config_eee_phy (phydev); }
@@ -1302,6 +1303,7 @@ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xbf8 ,0x12 ,0xe000 ,0xa000 );rtl8125_legacy_force_mode (phydev); +rtl8168g_disable_aldps (phydev);rtl8125b_config_eee_phy (phydev); }
Signature · 1 line
2.43.0