5.10.227-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.10.227-rc1 review
This is the start of the stable review cycle for the 5.10.227 release. There are 518 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 17 Oct 2024 12:37:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.227-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.227-rc1
Yixing Liu <[email protected]>
RDMA/hns: Fix uninitialized variable
Jan Kara <[email protected]>
ext4: fix warning in ext4_dio_write_end_io()
Phil Sutter <[email protected]>
netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
Antoine Tenart <[email protected]>
net: vrf: determine the dst using the original ifindex for multicast
Andrea Mayer <[email protected]>
net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev
David Ahern <[email protected]>
net: Handle l3mdev in ip_tunnel_init_flow
David Ahern <[email protected]>
xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup
Eyal Birger <[email protected]>
net: geneve: add missing netlink policy and size for IFLA_GENEVE_INNER_PROTO_INHERIT
Yonatan Maman <[email protected]>
nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
Anatolij Gustschin <[email protected]>
net: dsa: lan9303: ensure chip reset and wait for READY status
Anastasia Kovaleva <[email protected]>
net: Fix an unsafe loop on the list
SurajSonawane2415 <[email protected]>
hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma
Icenowy Zheng <[email protected]>
usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
Jose Alberto Reguero <[email protected]>
usb: xhci: Fix problem with xhci resume from suspend
Selvarasu Ganesan <[email protected]>
usb: dwc3: core: Stop processing of pending events if controller is halted
Oliver Neukum <[email protected]>
Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
Wade Wang <[email protected]>
HID: plantronics: Workaround for an unexcepted opposite volume key
Javier Carrasco <[email protected]>
hwmon: (adm9240) Add missing dependency on REGMAP_I2C
Guenter Roeck <[email protected]>
hwmon: (tmp513) Add missing dependency on REGMAP_I2C
Huang Ying <[email protected]>
resource: fix region_intersects() vs add_memory_driver_managed()
Eric Dumazet <[email protected]>
slip: make slhc_remember() more robust against malicious packets
Eric Dumazet <[email protected]>
ppp: fix ppp_async_encode() illegal access
Florian Westphal <[email protected]>
netfilter: fib: check correct rtable in vrf setups
Guillaume Nault <[email protected]>
netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces.
Phil Sutter <[email protected]>
netfilter: rpfilter/fib: Populate flowic_l3mdev field
David Ahern <[email protected]>
net: Add l3mdev index to flow struct and avoid oif reset for port devices
Xin Long <[email protected]>
sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
Rosen Penev <[email protected]>
net: ibm: emac: mal: fix wrong goto
Eric Dumazet <[email protected]>
net/sched: accept TCA_STAB only for root qdisc
Mohamed Khalfella <[email protected]>
igb: Do not bring the device up after non-fatal error
Billy Tsai <[email protected]>
gpio: aspeed: Use devm_clk api to manage clock source
Billy Tsai <[email protected]>
gpio: aspeed: Add the flush write to ensure the write complete.
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frames on 10/100 ports
Jonas Gorski <[email protected]>
net: dsa: b53: allow lower MTUs on BCM5325/5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for BCM5325/BCM5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for 1g switches
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frame mtu check
Christophe JAILLET <[email protected]>
net: phy: bcm84881: Fix some error handling paths
Luiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
Andy Roulin <[email protected]>
netfilter: br_netfilter: fix panic with metadata_dst skb
Neal Cardwell <[email protected]>
tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
Neal Cardwell <[email protected]>
tcp: fix to allow timestamp undo if no retransmits were sent
Ingo van Lil <[email protected]>
net: phy: dp83869: fix memory corruption when enabling fiber
Yanjun Zhang <[email protected]>
NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
Dan Carpenter <[email protected]>
SUNRPC: Fix integer overflow in decode_rc_list()
Dave Ertman <[email protected]>
ice: fix VLAN replay after reset
Chuck Lever <[email protected]>
NFSD: Mark filecache "down" if init fails
Bob Pearson <[email protected]>
RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
Andrey Shumilin <[email protected]>
fbdev: sisfb: Fix strbuf array overflow
Alex Hung <[email protected]>
drm/amd/display: Check null pointer before dereferencing se
Zijun Hu <[email protected]>
driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
Zhu Jun <[email protected]>
tools/iio: Add memory allocation failure check for trigger_name
Philip Chen <[email protected]>
virtio_pmem: Check device status before requesting flush
Shawn Shao <[email protected]>
usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
Xu Yang <[email protected]>
usb: chipidea: udc: enable suspend interrupt after usb reset
Peng Fan <[email protected]>
clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
Yunke Cao <[email protected]>
media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
Kaixin Wang <[email protected]>
ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
Alex Williamson <[email protected]>
PCI: Mark Creative Labs EMU20k2 INTx masking as broken
Hans de Goede <[email protected]>
i2c: i801: Use a different adapter-name for IDF adapters
Subramanian Ananthanarayanan <[email protected]>
PCI: Add ACS quirk for Qualcomm SA8775P
Krzysztof Kozlowski <[email protected]>
clk: bcm: bcm53573: fix OF node leak in init
WangYuli <[email protected]>
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
Saravanan Vajravel <[email protected]>
RDMA/mad: Improve handling of timed out WRs of mad agent
Daniel Jordan <[email protected]>
ktest.pl: Avoid false positives with grub2 skip regex
Thomas Richter <[email protected]>
s390/cpum_sf: Remove WARN_ON_ONCE statements
Wojciech Gładysz <[email protected]>
ext4: nested locking for xattr inode
Gerald Schaefer <[email protected]>
s390/mm: Add cond_resched() to cmm_alloc/free_pages()
Heiko Carstens <[email protected]>
s390/facility: Disable compile time optimization for decompressor code
Tao Chen <[email protected]>
bpf: Check percpu map value size first
Mathias Krause <[email protected]>
Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
Andrii Nakryiko <[email protected]>
tracing/kprobes: Fix symbol counting logic by looking at modules as well
Francis Laniel <[email protected]>
tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
Jiri Olsa <[email protected]>
kallsyms: Make module_kallsyms_on_each_symbol generally available
Jiri Olsa <[email protected]>
kallsyms: Make kallsyms_on_each_symbol generally available
Michael S. Tsirkin <[email protected]>
virtio_console: fix misc probe bugs
Steven Rostedt (Google) <[email protected]>
tracing: Have saved_cmdlines arrays all in one allocation
Alexander Egorenkov <[email protected]>
s390/zcore: release dump save area on restart or power down
Alexander Egorenkov <[email protected]>
s390/zcore: no need to check return value of debugfs_create functions
Rob Clark <[email protected]>
drm/crtc: fix uninitialized variable use even harder
Steven Rostedt (Google) <[email protected]>
tracing: Remove precision vsnprintf() check from print event
Linus Walleij <[email protected]>
net: ethernet: cortina: Drop TSO support
Gabriel Krisman Bertazi <[email protected]>
unicode: Don't special case ignorable code points
Haoran Zhang <[email protected]>
vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
zhanchengbin <[email protected]>
ext4: fix inode tree inconsistency caused by ENOMEM
Armin Wolf <[email protected]>
ACPI: battery: Fix possible crash when unregistering a battery hook
Armin Wolf <[email protected]>
ACPI: battery: Simplify battery hook locking
Heiner Kallweit <[email protected]>
r8169: add tally counter fields added with RTL8125
Colin Ian King <[email protected]>
r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
Val Packett <[email protected]>
drm/rockchip: vop: clear DMA stop bit on RK3066
Hugh Cole-Baker <[email protected]>
drm/rockchip: support gamma control on RK3399
Hugh Cole-Baker <[email protected]>
drm/rockchip: define gamma registers for RK3399
Oleg Nesterov <[email protected]>
uprobes: fix kernel info leak via "[uprobes]" vma
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround once more
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-N3 definitions
Anshuman Khandual <[email protected]>
arm64: Add Cortex-715 CPU part definition
Zhihao Cheng <[email protected]>
ext4: dax: fix overflowing extents beyond inode size when partially writing
Jan Kara <[email protected]>
ext4: properly sync file size update after O_SYNC direct IO
Jinjie Ruan <[email protected]>
i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
Andi Shyti <[email protected]>
i2c: xiic: Use devm_clk_get_enabled()
Krzysztof Kozlowski <[email protected]>
i2c: xiic: Simplify with dev_err_probe()
Masahiro Yamada <[email protected]>
kconfig: qconf: fix buffer overflow in debug links
Tvrtko Ursulin <[email protected]>
drm/sched: Add locking to drm_sched_entity_modify_sched
Emanuele Ghidoli <[email protected]>
gpio: davinci: fix lazy disable
Filipe Manana <[email protected]>
btrfs: wait for fixup workers before stopping cleaner kthread during umount
Qu Wenruo <[email protected]>
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
Hans de Goede <[email protected]>
ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
Nuno Sa <[email protected]>
Input: adp5589-keys - fix adp5589_gpio_get_value()
Krzysztof Kozlowski <[email protected]>
rtc: at91sam9: fix OF node leak in probe() error path
KhaiWenTan <[email protected]>
net: stmmac: Fix zero-division error when disabling tc cbs
Tetsuo Handa <[email protected]>
tomoyo: fallback to realpath if symlink's pathname does not exist
Barnabás Czémán <[email protected]>
iio: magnetometer: ak8975: Fix reading for ak099xx sensors
Manivannan Sadhasivam <[email protected]>
clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
Zheng Wang <[email protected]>
media: venus: fix use after free bug in venus_remove due to race condition
Mike Tipton <[email protected]>
clk: qcom: clk-rpmh: Fix overflow in BCM vote
Hans Verkuil <[email protected]>
media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
Laurent Pinchart <[email protected]>
media: sun4i_csi: Implement link validate for sun4i_csi subdev
Sebastian Reichel <[email protected]>
clk: rockchip: fix error for unknown clocks
Chun-Yi Lee <[email protected]>
aoe: fix the potential use-after-free problem in more places
Chuck Lever <[email protected]>
NFSD: Fix NFSv4's PUTPUBFH operation
Li Lingfeng <[email protected]>
nfsd: map the EBADMSG to nfserr_io to avoid warning
NeilBrown <[email protected]>
nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
Yuezhang Mo <[email protected]>
exfat: fix memory leak in exfat_load_bitmap()
Jisheng Zhang <[email protected]>
riscv: define ILLEGAL_POINTER_VALUE for 64bit
Lizhi Xu <[email protected]>
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
Julian Sun <[email protected]>
ocfs2: fix null-ptr-deref when journal load failed.
Lizhi Xu <[email protected]>
ocfs2: remove unreasonable unlock in ocfs2_read_blocks
Joseph Qi <[email protected]>
ocfs2: cancel dqi_sync_work before freeing oinfo
Gautham Ananthakrishna <[email protected]>
ocfs2: reserve space for inline xattr before attaching reflink tree
Joseph Qi <[email protected]>
ocfs2: fix uninit-value in ocfs2_get_block()
Heming Zhao <[email protected]>
ocfs2: fix the la space leak when unmounting an ocfs2 volume
Danilo Krummrich <[email protected]>
mm: krealloc: consider spare memory for __GFP_ZERO
Kemeng Shi <[email protected]>
jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
Baokun Li <[email protected]>
jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
Ma Ke <[email protected]>
drm: omapdrm: Add missing check for alloc_ordered_workqueue
Andrew Jones <[email protected]>
of/irq: Support #msi-cells=<0> in of_msi_get_domain
Helge Deller <[email protected]>
parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
Helge Deller <[email protected]>
parisc: Fix 64-bit userspace syscall path
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
Baokun Li <[email protected]>
ext4: update orig_path in ext4_find_extent()
Baokun Li <[email protected]>
ext4: fix double brelse() the buffer of the extents path
Baokun Li <[email protected]>
ext4: aovid use-after-free in ext4_ext_insert_extent()
Baokun Li <[email protected]>
ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
Baokun Li <[email protected]>
ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
Baokun Li <[email protected]>
ext4: fix slab-use-after-free in ext4_split_extent_at()
Edward Adam Davis <[email protected]>
ext4: no need to continue when the number of entries is 1
Ai Chao <[email protected]>
ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
Hans P. Moller <[email protected]>
ALSA: line6: add hw monitor volume control to POD HD500X
Jaroslav Kysela <[email protected]>
ALSA: core: add isascii() check to card ID generator
Thomas Zimmermann <[email protected]>
drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
Helge Deller <[email protected]>
parisc: Fix itlb miss handler for 64-bit programs
Luo Gengkun <[email protected]>
perf/core: Fix small negative period being ignored
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix module autoloading
Krzysztof Kozlowski <[email protected]>
firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
Robert Hancock <[email protected]>
i2c: xiic: Wait for TX empty to avoid missed TX NAKs
Jinjie Ruan <[email protected]>
i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
Marek Vasut <[email protected]>
i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
David Hildenbrand <[email protected]>
selftests/mm: fix charge_reserved_hugetlb.sh test
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO symbols lookup for powerpc64
Yifei Liu <[email protected]>
selftests: breakpoints: use remaining time to check if suspend succeed
Ben Dooks <[email protected]>
spi: s3c64xx: fix timeout counters in flush_fifo
Jinjie Ruan <[email protected]>
spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
Artem Sadovnikov <[email protected]>
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
Baokun Li <[email protected]>
ext4: avoid use-after-free in ext4_ext_show_leaf()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: ext4_search_dir should return a proper error
Geert Uytterhoeven <[email protected]>
of/irq: Refer to actual buffer size in of_irq_parse_one()
Tim Huang <[email protected]>
drm/amd/pm: ensure the fw_info is not null before using it
Geert Uytterhoeven <[email protected]>
drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
Kees Cook <[email protected]>
scsi: aacraid: Rearrange order of struct aac_srb_unit
Matthew Brost <[email protected]>
drm/printer: Allow NULL data in devcoredump printer
Alex Hung <[email protected]>
drm/amd/display: Initialize get_bytes_per_element's default to 1
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 color transformation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in degamma hardware format translation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
Alex Hung <[email protected]>
drm/amd/display: Check stream before comparing them
Ckath <[email protected]>
platform/x86: touchscreen_dmi: add nanote-next quirk
Peng Liu <[email protected]>
drm/amdgpu: enable gfxoff quirk on HP 705G4
Peng Liu <[email protected]>
drm/amdgpu: add raven1 gfxoff quirk
Zhao Mengmeng <[email protected]>
jfs: Fix uninit-value access of new_ea in ea_buffer
Edward Adam Davis <[email protected]>
jfs: check if leafidx greater than num leaves per dmap tree
Edward Adam Davis <[email protected]>
jfs: Fix uaf in dbFreeBits
Remington Brasga <[email protected]>
jfs: UBSAN: shift-out-of-bounds in dbFindBits
Alex Hung <[email protected]>
drm/amd/display: Check null pointers before using dc->clk_mgr
Damien Le Moal <[email protected]>
ata: sata_sil: Rename sil_blacklist to sil_quirks
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
Sanjay K Kumar <[email protected]>
iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
Lu Baolu <[email protected]>
iommu/vt-d: Always reserve a domain ID for identity setup
Andrew Davis <[email protected]>
power: reset: brcmstb: Do not go into infinite loop if reset fails
Marc Gonzalez <[email protected]>
iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
Paul E. McKenney <[email protected]>
rcuscale: Provide clear error when async specified without primitives
Kaixin Wang <[email protected]>
fbdev: pxafb: Fix possible use after free in pxafb_task()
Kees Cook <[email protected]>
x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
Takashi Iwai <[email protected]>
ALSA: hdsp: Break infinite MIDI input flush loop
Takashi Iwai <[email protected]>
ALSA: asihpi: Fix potential OOB array access
Joshua Pius <[email protected]>
ALSA: usb-audio: Add logitech Audio profile quirk
Takashi Iwai <[email protected]>
ALSA: usb-audio: Define macros for quirk table entries
Thomas Gleixner <[email protected]>
signal: Replace BUG_ON()s
Jinjie Ruan <[email protected]>
nfp: Use IRQF_NO_AUTOEN flag in request_irq()
Gustavo A. R. Silva <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
Adrian Ratiu <[email protected]>
proc: add config & param to block forcing mem writes
Aleksandrs Vinarskis <[email protected]>
ACPICA: iasl: handle empty connection_node
Jason Xing <[email protected]>
tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
Simon Horman <[email protected]>
net: atlantic: Avoid warning about potential string truncation
Ido Schimmel <[email protected]>
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
Kuniyuki Iwashima <[email protected]>
ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
Simon Horman <[email protected]>
net: mvpp2: Increase size of queue_name buffer
Simon Horman <[email protected]>
tipc: guard against string buffer overrun
Pei Xiao <[email protected]>
ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
Rafael J. Wysocki <[email protected]>
ACPI: EC: Do not release locks during operation region accesses
Zong-Zhe Yang <[email protected]>
wifi: rtw88: select WANT_DEV_COREDUMP
Karthikeyan Periyasamy <[email protected]>
wifi: ath11k: fix array out-of-bound access in SoC stats
Konstantin Ovsepian <[email protected]>
blk_iocost: fix more out of bound shifts
Dmitry Antipov <[email protected]>
net: sched: consistently use rcu_replace_pointer() in taprio_change()
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_mdio: fix OF node leak in probe()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hip04: fix OF node leak in probe()
Jeongjun Park <[email protected]>
net/xen-netback: prevent UAF in xenvif_flush_hash()
Aleksandr Mishin <[email protected]>
ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
Dmitry Kandybka <[email protected]>
wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
Jann Horn <[email protected]>
f2fs: Require FMODE_WRITE for atomic write ioctls
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
Takashi Iwai <[email protected]>
ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
Oder Chiou <[email protected]>
ALSA: hda/realtek: Fix the push button function for the ALC257
Christophe JAILLET <[email protected]>
ALSA: mixer_oss: Remove some incorrect kfree_const() usages
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not validating setsockopt user input
Benjamin Gaignard <[email protected]>
media: usbtv: Remove useless locks in usbtv_video_free()
Robert Hancock <[email protected]>
i2c: xiic: Try re-initialization on bus busy timeout
Marc Ferland <[email protected]>
i2c: xiic: improve error message when transfer fails to start
Lars-Peter Clausen <[email protected]>
i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path
Marek Vasut <[email protected]>
i2c: xiic: Fix RX IRQ busy check
Marek Vasut <[email protected]>
i2c: xiic: Switch from waitqueue to completion
Marek Vasut <[email protected]>
i2c: xiic: Fix broken locking on tx_msg
Xin Long <[email protected]>
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
Anton Danilov <[email protected]>
ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
Eric Dumazet <[email protected]>
net: add more sanity checks to qdisc_pkt_len_init()
Eric Dumazet <[email protected]>
net: avoid potential underflow in qdisc_pkt_len_init() with UFO
Aleksander Jan Bajkowski <[email protected]>
net: ethernet: lantiq_etop: fix memory disclosure
Jinjie Ruan <[email protected]>
Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
Eric Dumazet <[email protected]>
netfilter: nf_tables: prevent nf_skb_duplicated corruption
Jinjie Ruan <[email protected]>
net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
Phil Sutter <[email protected]>
netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
Mohamed Khalfella <[email protected]>
net/mlx5: Added cond_resched() to crdump collection
Gerd Bayer <[email protected]>
net/mlx5: Fix error path in multi-packet WQE transmit
Jinjie Ruan <[email protected]>
ieee802154: Fix build error
Xiubo Li <[email protected]>
ceph: remove the incorrect Fw reference check when dirtying pages
Stefan Wahren <[email protected]>
mailbox: bcm2835: Fix timeout during suspend mode
Liao Chen <[email protected]>
mailbox: rockchip: fix a typo in module autoloading
Christophe JAILLET <[email protected]>
spi: lpspi: Simplify some error message
Harshit Mogalapalli <[email protected]>
usb: yurex: Fix inconsistent locking bug in yurex_read()
Andy Shevchenko <[email protected]>
i2c: isch: Add missed 'else'
Tommy Huang <[email protected]>
i2c: aspeed: Update the stop sw state when the bus recovery occurs
David Gow <[email protected]>
mm: only enforce minimum stack gap size if it's sensible
Zhiguo Niu <[email protected]>
lockdep: fix deadlock issue between lockdep and rcu
Felix Moessbauer <[email protected]>
io_uring/sqpoll: do not allow pinning outside of cpuset
Mathias Nyman <[email protected]>
xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
Moritz Fischer <[email protected]>
usb: renesas-xhci: Remove renesas_xhci_pci_exit()
Ma Ke <[email protected]>
pps: add an error check in parport_attach
Christophe JAILLET <[email protected]>
pps: remove usage of the deprecated ida_simple_xx() API
Oliver Neukum <[email protected]>
USB: misc: yurex: fix race between read and write
Lee Jones <[email protected]>
usb: yurex: Replace snprintf() with the safer scnprintf() variant
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix soc_dev leak during device remove
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix memory leak during device remove
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
Thomas Gleixner <[email protected]>
PCI: xilinx-nwl: Use irq_data_get_irq_chip_data()
VanGiang Nguyen <[email protected]>
padata: use integer wrap around to prevent deadlock on seq_nr overflow
Li Lingfeng <[email protected]>
nfs: fix memory leak in error path of nfs4_do_reclaim
Mickaël Salaün <[email protected]>
fs: Fix file_set_fowner LSM hook inconsistencies
Julian Sun <[email protected]>
vfs: fix race between evice_inodes() and find_inode()&iput()
Dragan Simic <[email protected]>
arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
Dragan Simic <[email protected]>
arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
Gaosheng Cui <[email protected]>
hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
Guoqing Jiang <[email protected]>
hwrng: mtk - Use devm_pm_runtime_enable
Nikita Zhandarovich <[email protected]>
f2fs: avoid potential int overflow in sanity_check_area_boundary()
Nikita Zhandarovich <[email protected]>
f2fs: prevent possible int overflow in dir_block_index()
Zhen Lei <[email protected]>
debugobjects: Fix conditions in fill_pool()
Bitterblue Smith <[email protected]>
wifi: rtw88: 8822c: Fix reported RX band width
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix sampling synchronization
Ard Biesheuvel <[email protected]>
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
Werner Sembach <[email protected]>
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
Thomas Weißschuh <[email protected]>
ACPI: sysfs: validate return type of _STR method
Mikhail Lobanov <[email protected]>
drbd: Add NULL check for net_conf to prevent dereference in state validation
Qiu-ji Chen <[email protected]>
drbd: Fix atomicity violation in drbd_uuid_set_bm()
Pavan Kumar Paluri <[email protected]>
crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
Florian Fainelli <[email protected]>
tty: rp2: Fix reset with non forgiving PCIe host bridges
Jann Horn <[email protected]>
firmware_loader: Block path traversal
Krzysztof Kozlowski <[email protected]>
bus: integrator-lm: fix OF node leak in probe()
Oliver Neukum <[email protected]>
USB: class: CDC-ACM: fix race between get_serial and set_serial
Oliver Neukum <[email protected]>
USB: misc: cypress_cy7c63: check for short transfer
Oliver Neukum <[email protected]>
USB: appledisplay: close race between probe and completion handler
Robin Chen <[email protected]>
drm/amd/display: Round calculated vtotal
Werner Sembach <[email protected]>
Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
Krzysztof Kozlowski <[email protected]>
soc: versatile: integrator: fix OF node leak in probe() error path
Ma Ke <[email protected]>
ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
Laurent Pinchart <[email protected]>
Remove *.orig pattern from .gitignore
Matthieu Baerts (NGI0) <[email protected]>
mptcp: fix sometimes-uninitialized warning
Scott Mayhew <[email protected]>
selinux,smack: don't bypass permissions check in inode_setsecctx hook
Toke Høiland-Jørgensen <[email protected]>
bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
Pu Lehui <[email protected]>
Revert "bpf: Eliminate rlimit-based memory accounting for devmap maps"
Pu Lehui <[email protected]>
Revert "bpf: Fix DEVMAP_HASH overflow check on 32-bit arches"
Tony Luck <[email protected]>
x86/mm: Switch to new Intel CPU model defines
Sumeet Pawnikar <[email protected]>
powercap: RAPL: fix invalid initialization for pl4_supported field
Hans de Goede <[email protected]>
Input: goodix - use the new soc_intel_is_byt() helper
Fangzhi Zuo <[email protected]>
drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
Simon Horman <[email protected]>
netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
Phil Sutter <[email protected]>
netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
Youssef Samir <[email protected]>
net: qrtr: Update packets cloning when broadcasting
Josh Hunt <[email protected]>
tcp: check skb is non-NULL in tcp_rto_delta_us()
Thomas Weißschuh <[email protected]>
net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
Kaixin Wang <[email protected]>
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
Eric Dumazet <[email protected]>
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
Mikulas Patocka <[email protected]>
Revert "dm: requeue IO if mapping table not yet available"
Jason Wang <[email protected]>
vhost_vdpa: assign irq bypass producer token correctly
Xie Yongji <[email protected]>
vdpa: Add eventfd for the vdpa callback
Konrad Dybcio <[email protected]>
interconnect: qcom: sm8250: Enable sync_state
Suzuki K Poulose <[email protected]>
coresight: tmc: sg: Do not leak sg_table
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix standby gpio state to match the documentation
Guillaume Stols <[email protected]>
iio: adc: ad7606: fix oversampling gpio array
Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
Alexander Stein <[email protected]>
spi: lpspi: release requested DMA channels
Alexander Stein <[email protected]>
spi: lpspi: Silence error message upon deferred probe
Chao Yu <[email protected]>
f2fs: reduce expensive checkpoint trigger frequency
Chao Yu <[email protected]>
f2fs: remove unneeded check condition in __f2fs_setxattr()
Chao Yu <[email protected]>
f2fs: fix to update i_ctime in __f2fs_setxattr()
Yonggil Song <[email protected]>
f2fs: fix typo
Chao Yu <[email protected]>
f2fs: enhance to update i_mode and acl atomically in f2fs_setattr()
Li Lingfeng <[email protected]>
nfsd: return -EINVAL when namelen is 0
Guoqing Jiang <[email protected]>
nfsd: call cache_put if xdr_reserve_space returns NULL
Max Hawking <[email protected]>
ntb_perf: Fix printk format
Jinjie Ruan <[email protected]>
ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
Mikhail Lobanov <[email protected]>
RDMA/cxgb4: Added NULL check for lookup_atid
Jinjie Ruan <[email protected]>
riscv: Fix fp alignment bug in perf_callchain_user()
Junxian Huang <[email protected]>
RDMA/hns: Optimize hem allocation performance
Chengchang Tang <[email protected]>
RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
wenglianfa <[email protected]>
RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
Xi Wang <[email protected]>
RDMA/hns: Refactor root BT allocation for MTR
Xi Wang <[email protected]>
RDMA/hns: Add mapped page count checking for MTR
Jonas Blixt <[email protected]>
watchdog: imx_sc_wdt: Don't disable WDT in suspend
Wang Jianzheng <[email protected]>
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
Yangtao Li <[email protected]>
pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
Jeff Layton <[email protected]>
nfsd: fix refcount leak when file is unhashed after being found
Jeff Layton <[email protected]>
nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
David Lechner <[email protected]>
clk: ti: dra7-atl: Fix leak of of_nodes
Yang Yingliang <[email protected]>
pinctrl: single: fix missing error code in pcs_probe()
Zhu Yanjun <[email protected]>
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix register misspelling
Dan Carpenter <[email protected]>
PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
Jonas Karlman <[email protected]>
clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
Zhipeng Wang <[email protected]>
clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
Ian Rogers <[email protected]>
perf time-utils: Fix 32-bit nsec parsing
Yang Jihong <[email protected]>
perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
Yang Jihong <[email protected]>
perf sched timehist: Fix missing free of session in perf_sched__timehist()
Daniel Borkmann <[email protected]>
bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
Ryusuke Konishi <[email protected]>
nilfs2: fix potential oob read in nilfs_btree_check_delete()
Ryusuke Konishi <[email protected]>
nilfs2: determine empty node blocks as corrupted
Ryusuke Konishi <[email protected]>
nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: avoid OOB when system.data xattr changes underneath the filesystem
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: return error on ext4_find_inline_entry
Kemeng Shi <[email protected]>
ext4: avoid negative min_clusters in find_group_orlov()
Kemeng Shi <[email protected]>
ext4: avoid potential buffer_head leak in __ext4_new_inode()
Kemeng Shi <[email protected]>
ext4: avoid buffer_head leak in ext4_mark_inode_used()
Jiawei Ye <[email protected]>
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
yangerkun <[email protected]>
ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
Chen Yu <[email protected]>
kthread: fix task state in kthread worker if being frozen
Rob Clark <[email protected]>
kthread: add kthread_work tracepoints
Lasse Collin <[email protected]>
xz: cleanup CRC32 edits from 2018
Tony Ambardar <[email protected]>
selftests/bpf: Fix C++ compile error from missing _Bool type
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling test_lru_map.c
Tony Ambardar <[email protected]>
selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling flow_dissector.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix compiling kfree_skb.c with musl-libc
Tony Ambardar <[email protected]>
selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
Tony Ambardar <[email protected]>
selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
Jonathan McDowell <[email protected]>
tpm: Clean up TPM space after command failure
Juergen Gross <[email protected]>
xen/swiotlb: add alignment check for dma buffers
Juergen Gross <[email protected]>
xen: use correct end address of kernel for conflict checking
Yuesong Li <[email protected]>
drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
Sherry Yang <[email protected]>
drm/msm: fix %s null argument error
Wolfram Sang <[email protected]>
ipmi: docs: don't advertise deprecated sysfs entries
Vladimir Lypak <[email protected]>
drm/msm/a5xx: workaround early ring-buffer emptiness check
Rob Clark <[email protected]>
drm/msm: Drop priv->lastctx
Rob Clark <[email protected]>
drm/msm: Add priv->mm_lock to protect active/inactive lists
Vladimir Lypak <[email protected]>
drm/msm/a5xx: fix races in preemption evaluation stage
Vladimir Lypak <[email protected]>
drm/msm/a5xx: properly clear preemption records on resume
Vladimir Lypak <[email protected]>
drm/msm/a5xx: disable preemption in submits by default
Aleksandr Mishin <[email protected]>
drm/msm: Fix incorrect file name output in adreno_request_fw()
Jeongjun Park <[email protected]>
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
Nikita Zhandarovich <[email protected]>
drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
Jonas Karlman <[email protected]>
drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
Alex Bee <[email protected]>
drm/rockchip: vop: Allow 4096px width scaling
Alex Deucher <[email protected]>
drm/radeon: properly handle vbios fake edid sizing
Paulo Miguel Almeida <[email protected]>
drm/radeon: Replace one-element array with flexible-array member
Alex Deucher <[email protected]>
drm/amdgpu: properly handle vbios fake edid sizing
Paulo Miguel Almeida <[email protected]>
drm/amdgpu: Replace one-element array with flexible-array member
Christophe JAILLET <[email protected]>
drm/stm: Fix an error handling path in stm_drm_platform_probe()
Charles Han <[email protected]>
mtd: powernv: Add check devm_kasprintf() returned value
Christophe JAILLET <[email protected]>
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
Artur Weber <[email protected]>
power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
Chris Morgan <[email protected]>
power: supply: axp20x_battery: Remove design from min and max voltage
Hermann Lauer <[email protected]>
power: supply: axp20x_battery: allow disabling battery charging
Yuntao Liu <[email protected]>
hwmon: (ntc_thermistor) fix module autoloading
Mirsad Todorovac <[email protected]>
mtd: slram: insert break after errors in parsing the map
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix alarm attributes
Andrew Davis <[email protected]>
hwmon: (max16065) Remove use of i2c_match_id()
Biju Das <[email protected]>
i2c: Add i2c_get_match_data()
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix overflows seen when writing limits
Finn Thain <[email protected]>
m68k: Fix kernel_clone_args.flags in m68k_clone()
Ankit Agrawal <[email protected]>
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
Krzysztof Kozlowski <[email protected]>
reset: berlin: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
ARM: versatile: fix OF node leak in CPUs prepare
Krzysztof Kozlowski <[email protected]>
ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
Alexander Dahl <[email protected]>
ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
Andy Shevchenko <[email protected]>
spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
Ma Ke <[email protected]>
spi: ppc4xx: handle irq_of_parse_and_map() errors
Riyan Dhiman <[email protected]>
block: fix potential invalid pointer dereference in blk_add_partition
Christian Heusel <[email protected]>
block: print symbolic error name instead of error code
Yu Kuai <[email protected]>
block, bfq: don't break merge chain in bfq_split_bfqq()
Yu Kuai <[email protected]>
block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
Yu Kuai <[email protected]>
block, bfq: fix possible UAF for bfqq->bic with merge chain
Su Hui <[email protected]>
net: tipc: avoid possible garbage value
Justin Iurman <[email protected]>
net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
Heiner Kallweit <[email protected]>
r8169: disable ALDPS per default for RTL8125
Jinjie Ruan <[email protected]>
net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header on xmit.
Gal Pressman <[email protected]>
geneve: Fix incorrect inner network header offset when innerprotoinherit is set
Eyal Birger <[email protected]>
net: geneve: support IPv4/IPv6 as inner protocol
Guillaume Nault <[email protected]>
bareudp: Pull inner IP header in bareudp_udp_encap_recv().
Guillaume Nault <[email protected]>
bareudp: allow redirecting bareudp packets to eth devices
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix not handling ZPL/short-transfer
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_close(): stop clocks after device has been shut down
Faiz Abbas <[email protected]>
can: m_can: Add support for transceiver as phy
Kuniyuki Iwashima <[email protected]>
can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
Eric Dumazet <[email protected]>
sock_map: Add a cond_resched() in sock_hash_free()
Jiawei Ye <[email protected]>
wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
Dmitry Antipov <[email protected]>
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
Howard Hsu <[email protected]>
wifi: mt76: mt7915: fix rx filter setting for bfee functionality
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
Nishanth Menon <[email protected]>
cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject expiration higher than timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject element expiration with no timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
Zhang Changzhong <[email protected]>
can: j1939: use correct function name in comment
Kamlesh Gurudasani <[email protected]>
padata: Honor the caller's alignment in case of chunk_size 0
Olaf Hering <[email protected]>
mount: handle OOM on mnt_warn_timestamp_expiry
Andy Shevchenko <[email protected]>
fs/namespace: fnic: Switch to use %ptTd
Anthony Iliopoulos <[email protected]>
mount: warn only once about timestamp range expiration
Christoph Hellwig <[email protected]>
fs: explicitly unregister per-superblock BDIs
Aleksandr Mishin <[email protected]>
ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
Dmitry Antipov <[email protected]>
wifi: rtw88: always wait for both firmware loading attempts
Edward Adam Davis <[email protected]>
USB: usbtmc: prevent kernel-usb-infoleak
Junhao Xie <[email protected]>
USB: serial: pl2303: add device id for Macrosilicon MS3020
Vincenzo Palazzo <[email protected]>
usb: dwc3: Fix a typo in field name
Waiman Long <[email protected]>
cgroup: Move rcu_head up near the top of cgroup_root
Kent Gibson <[email protected]>
gpiolib: cdev: Ignore reconfiguration without direction
Zheng Yejian <[email protected]>
ftrace: Fix possible use-after-free issue in ftrace_location()
Peter Zijlstra <[email protected]>
x86/ibt,ftrace: Search for __fentry__ location
Florian Westphal <[email protected]>
inet: inet_defrag: prevent sk release while still in use
Edward Adam Davis <[email protected]>
mptcp: pm: Fix uaf in __timer_delete_sync
Davide Caratti <[email protected]>
mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
Geliang Tang <[email protected]>
mptcp: export lookup_anno_list_by_saddr
Hagar Hemdan <[email protected]>
gpio: prevent potential speculation leaks in gpio_device_get_desc()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: missing iterator type in lookup walk
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: walk over current view on netlink dump
Yafang Shao <[email protected]>
cgroup: Make operations on the cgroup root_list RCU safe
Ferry Meng <[email protected]>
ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
Ferry Meng <[email protected]>
ocfs2: add bounds checking to ocfs2_xattr_find_entry()
Michael Kelley <[email protected]>
x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
Liao Chen <[email protected]>
spi: bcm63xx: Enable module autoloading
hongchi.peng <[email protected]>
drm: komeda: Fix an issue related to normalized zpos
Liao Chen <[email protected]>
ASoC: tda7419: fix module autoloading
Liao Chen <[email protected]>
ASoC: intel: fix module autoloading
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
Benjamin Berg <[email protected]>
wifi: iwlwifi: lower message level for FW buffer destination
Jacky Chou <[email protected]>
net: ftgmac100: Ensure tx descriptor updates are visible
Mike Rapoport <[email protected]>
microblaze: don't treat zero reserved memory regions as error
Thomas Blocher <[email protected]>
pinctrl: at91: make it work with current gpiolib
Kailang Yang <[email protected]>
ALSA: hda/realtek - FIxed ALC285 headphone no sound
Kailang Yang <[email protected]>
ALSA: hda/realtek - Fixed ALC256 headphone no sound
Hongbo Li <[email protected]>
ASoC: allow module autoloading for table db1200_pids
T.J. Mercier <[email protected]>
dma-buf: heaps: Fix off-by-one in CMA heap fault handler
Arseniy Krasnov <[email protected]>
ASoC: meson: axg-card: fix 'use-after-free'
Krzysztof Kozlowski <[email protected]>
soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
Han Xu <[email protected]>
spi: nxp-fspi: fix the KASAN report out-of-bounds bug
Sean Anderson <[email protected]>
net: dpaa: Pad packets to ETH_ZLEN
Jacky Chou <[email protected]>
net: ftgmac100: Enable TX interrupt to avoid TX timeout
Muhammad Usama Anjum <[email protected]>
fou: fix initialization of grc
Shahar Shitrit <[email protected]>
net/mlx5e: Add missing link modes to ptys2ethtool_map
Meir Lichtinger <[email protected]>
net/mlx5: Update the list of the PCI supported devices
Jacob Keller <[email protected]>
ice: fix accounting for filters shared by multiple VSIs
Patryk Biel <[email protected]>
hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2
Mårten Lindahl <[email protected]>
hwmon: (pmbus) Introduce and use write_byte_data callback
Lorenzo Stoakes <[email protected]>
minmax: reduce min/max macro expansion in atomisp driver
Quentin Schulz <[email protected]>
arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma
Trond Myklebust <[email protected]>
NFS: Avoid unnecessary rescanning of the per-server delegation list
Takashi Iwai <[email protected]>
Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
Rob Clark <[email protected]>
drm/msm/adreno: Fix error return if missing firmware-name
Anders Roxell <[email protected]>
scripts: kconfig: merge_config: config files: add a trailing newline
Jonathan Denose <[email protected]>
Input: synaptics - enable SMBus for HP Elitebook 840 G2
Marek Vasut <[email protected]>
Input: ads7846 - ratelimit the spi_sync error message
Jeff Layton <[email protected]>
btrfs: update target inode's ctime on unlink
Christophe Leroy <[email protected]>
powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
Pawel Dembicki <[email protected]>
net: phy: vitesse: repair vsc73xx autonegotiation
Moon Yeounsu <[email protected]>
net: ethernet: use ip_hdrlen() instead of bit shift
Foster Snowhill <[email protected]>
usbnet: ipheth: fix carrier detection in modes 1 and 4
Faisal Hassan <[email protected]>
usb: dwc3: core: update LC timer as per USB Spec V3.2
Piyush Mehta <[email protected]>
usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug
Jack Pham <[email protected]>
usb: dwc3: Decouple USB 2.0 L1 & L2 events
-------------
Diffstat:
.gitignore | 1 - Documentation/admin-guide/kernel-parameters.txt | 10 + Documentation/arm64/silicon-errata.rst | 4 + Documentation/driver-api/ipmi.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/imx7d-zii-rmu2.dts | 2 +- arch/arm/boot/dts/sam9x60.dtsi | 4 +- arch/arm/mach-realview/platsmp-dt.c | 1 + arch/arm64/Kconfig | 2 + .../boot/dts/rockchip/rk3399-pinebook-pro.dts | 4 +- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 23 +- arch/arm64/include/asm/cputype.h | 4 + arch/arm64/kernel/cpu_errata.c | 2 + arch/m68k/kernel/process.c | 2 +- arch/microblaze/mm/init.c | 5 - arch/parisc/kernel/entry.S | 6 +- arch/parisc/kernel/syscall.S | 14 +- arch/powerpc/kernel/setup-common.c | 1 + arch/powerpc/mm/mem.c | 2 - arch/riscv/Kconfig | 5 + arch/riscv/kernel/perf_callchain.c | 2 +- arch/s390/include/asm/facility.h | 6 +- arch/s390/kernel/perf_cpum_sf.c | 12 +- arch/s390/mm/cmm.c | 18 +- arch/x86/events/intel/pt.c | 15 +- arch/x86/include/asm/syscall.h | 7 +- arch/x86/kernel/cpu/mshyperv.c | 1 + arch/x86/kernel/kprobes/core.c | 11 +- arch/x86/mm/init.c | 16 +- arch/x86/xen/setup.c | 2 +- block/bfq-iosched.c | 13 +- block/blk-iocost.c | 8 +- block/partitions/core.c | 8 +- drivers/acpi/acpica/dbconvert.c | 2 + drivers/acpi/acpica/exprep.c | 3 + drivers/acpi/acpica/psargs.c | 47 + drivers/acpi/battery.c | 28 +- drivers/acpi/device_sysfs.c | 5 +- drivers/acpi/ec.c | 55 +- drivers/acpi/pmic/tps68470_pmic.c | 6 +- drivers/acpi/resource.c | 20 + drivers/ata/sata_sil.c | 12 +- drivers/base/bus.c | 6 +- drivers/base/firmware_loader/main.c | 30 + drivers/block/aoe/aoecmd.c | 13 +- drivers/block/drbd/drbd_main.c | 8 +- drivers/block/drbd/drbd_state.c | 2 +- drivers/bluetooth/btmrvl_sdio.c | 3 +- drivers/bluetooth/btusb.c | 5 +- drivers/bus/arm-integrator-lm.c | 1 + drivers/char/hw_random/cctrng.c | 1 + drivers/char/hw_random/mtk-rng.c | 2 +- drivers/char/tpm/tpm-dev-common.c | 2 + drivers/char/tpm/tpm2-space.c | 3 + drivers/char/virtio_console.c | 18 +- drivers/clk/bcm/clk-bcm53573-ilp.c | 2 +- drivers/clk/imx/clk-imx7d.c | 4 +- drivers/clk/imx/clk-imx8mp.c | 4 +- drivers/clk/qcom/clk-rpmh.c | 2 + drivers/clk/qcom/dispcc-sm8250.c | 3 + drivers/clk/qcom/gcc-sm8250.c | 6 +- drivers/clk/rockchip/clk-rk3228.c | 2 +- drivers/clk/rockchip/clk.c | 3 +- drivers/clk/ti/clk-dra7-atl.c | 1 + drivers/clocksource/timer-qcom.c | 7 +- drivers/cpufreq/ti-cpufreq.c | 10 +- drivers/crypto/ccp/sev-dev.c | 2 + drivers/dma-buf/heaps/heap-helpers.c | 2 +- drivers/firmware/efi/libstub/tpm.c | 2 +- drivers/firmware/tegra/bpmp.c | 6 - drivers/gpio/gpio-aspeed.c | 4 +- drivers/gpio/gpio-davinci.c | 8 +- drivers/gpio/gpiolib-cdev.c | 13 +- drivers/gpio/gpiolib.c | 3 +- drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 26 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 + .../gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 + .../gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 4 + .../dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 2 +- .../display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 2 +- .../drm/amd/display/modules/freesync/freesync.c | 2 +- drivers/gpu/drm/amd/include/atombios.h | 2 +- .../drm/amd/pm/powerplay/hwmgr/processpptables.c | 2 + drivers/gpu/drm/arm/display/komeda/komeda_kms.c | 10 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 +- drivers/gpu/drm/drm_crtc.c | 1 + drivers/gpu/drm/drm_print.c | 13 +- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +- drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 3 +- drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 3 +- drivers/gpu/drm/msm/adreno/a4xx_gpu.c | 3 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 20 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 2 + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 30 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 9 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 10 - drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c | 2 +- drivers/gpu/drm/msm/msm_debugfs.c | 7 + drivers/gpu/drm/msm/msm_drv.c | 13 +- drivers/gpu/drm/msm/msm_drv.h | 15 +- drivers/gpu/drm/msm/msm_gem.c | 28 +- drivers/gpu/drm/msm/msm_gem_shrinker.c | 12 + drivers/gpu/drm/msm/msm_gpu.c | 2 +- drivers/gpu/drm/msm/msm_gpu.h | 16 +- drivers/gpu/drm/nouveau/nouveau_dmem.c | 2 +- drivers/gpu/drm/omapdrm/omap_drv.c | 5 + drivers/gpu/drm/radeon/atombios.h | 2 +- drivers/gpu/drm/radeon/evergreen_cs.c | 62 +- drivers/gpu/drm/radeon/r100.c | 70 +- drivers/gpu/drm/radeon/radeon_atombios.c | 26 +- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 113 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 3 + drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 25 +- drivers/gpu/drm/rockchip/rockchip_vop_reg.h | 1 + drivers/gpu/drm/scheduler/sched_entity.c | 2 + drivers/gpu/drm/stm/drv.c | 4 +- drivers/hid/hid-ids.h | 2 + drivers/hid/hid-plantronics.c | 23 + drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 2 +- drivers/hwmon/Kconfig | 2 + drivers/hwmon/max16065.c | 27 +- drivers/hwmon/ntc_thermistor.c | 1 + drivers/hwmon/pmbus/pmbus.h | 8 + drivers/hwmon/pmbus/pmbus_core.c | 39 +- drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- drivers/i2c/busses/i2c-aspeed.c | 16 +- drivers/i2c/busses/i2c-i801.c | 9 +- drivers/i2c/busses/i2c-isch.c | 3 +- drivers/i2c/busses/i2c-qcom-geni.c | 4 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-xiic.c | 145 +- drivers/i2c/i2c-core-base.c | 19 + drivers/iio/adc/ad7606.c | 8 +- drivers/iio/adc/ad7606_spi.c | 5 +- drivers/iio/magnetometer/ak8975.c | 32 +- drivers/infiniband/core/iwcm.c | 2 +- drivers/infiniband/core/mad.c | 14 +- drivers/infiniband/hw/cxgb4/cm.c | 5 + drivers/infiniband/hw/hns/hns_roce_hem.c | 257 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 56 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 +- drivers/infiniband/sw/rxe/rxe_comp.c | 6 +- drivers/input/keyboard/adp5589-keys.c | 13 +- drivers/input/mouse/synaptics.c | 1 + drivers/input/rmi4/rmi_driver.c | 6 +- drivers/input/serio/i8042-acpipnpio.h | 46 + drivers/input/touchscreen/ads7846.c | 2 +- drivers/input/touchscreen/goodix.c | 18 +- drivers/interconnect/qcom/sm8250.c | 1 + drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 7 + drivers/iommu/intel/dmar.c | 16 +- drivers/iommu/intel/iommu.c | 6 +- drivers/mailbox/bcm2835-mailbox.c | 3 +- drivers/mailbox/rockchip-mailbox.c | 2 +- drivers/md/dm-rq.c | 4 +- drivers/md/dm.c | 11 +- drivers/media/common/videobuf2/videobuf2-core.c | 8 +- drivers/media/dvb-frontends/rtl2830.c | 2 +- drivers/media/dvb-frontends/rtl2832.c | 2 +- drivers/media/platform/qcom/venus/core.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c | 5 + drivers/media/usb/usbtv/usbtv-video.c | 7 - drivers/mtd/devices/powernv_flash.c | 3 + drivers/mtd/devices/slram.c | 2 + drivers/net/bareudp.c | 25 +- drivers/net/can/m_can/m_can.c | 13 +- drivers/net/can/m_can/m_can.h | 2 + drivers/net/can/m_can/m_can_platform.c | 13 + drivers/net/dsa/b53/b53_common.c | 17 +- drivers/net/dsa/lan9303-core.c | 29 + .../net/ethernet/aquantia/atlantic/aq_ethtool.c | 4 +- drivers/net/ethernet/cortina/gemini.c | 15 +- drivers/net/ethernet/faraday/ftgmac100.c | 26 +- drivers/net/ethernet/faraday/ftgmac100.h | 2 +- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 +- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +- drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + drivers/net/ethernet/ibm/emac/mal.c | 2 +- drivers/net/ethernet/intel/ice/ice_sched.c | 6 +- drivers/net/ethernet/intel/ice/ice_switch.c | 4 +- drivers/net/ethernet/intel/igb/igb_main.c | 4 + drivers/net/ethernet/jme.c | 10 +- drivers/net/ethernet/lantiq_etop.c | 4 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - .../net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c | 10 + drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + .../net/ethernet/mellanox/mlxsw/spectrum_span.c | 2 +- .../net/ethernet/netronome/nfp/nfp_net_common.c | 5 +- drivers/net/ethernet/realtek/r8169_main.c | 31 +- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 + drivers/net/ethernet/seeq/ether3.c | 2 + drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + drivers/net/geneve.c | 91 +- drivers/net/ieee802154/Kconfig | 1 + drivers/net/ieee802154/mcr20a.c | 5 +- drivers/net/phy/bcm84881.c | 4 +- drivers/net/phy/dp83869.c | 1 - drivers/net/phy/vitesse.c | 14 - drivers/net/ppp/ppp_async.c | 2 +- drivers/net/slip/slhc.c | 57 +- drivers/net/usb/ipheth.c | 5 +- drivers/net/vrf.c | 13 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- drivers/net/wireless/ath/ath9k/debug.c | 4 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 +- .../wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 3 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/scan.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +- drivers/net/wireless/realtek/rtw88/Kconfig | 1 + drivers/net/wireless/realtek/rtw88/main.c | 7 +- drivers/net/wireless/realtek/rtw88/rtw8822c.c | 12 +- drivers/net/xen-netback/hash.c | 5 +- drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + drivers/ntb/test/ntb_perf.c | 2 +- drivers/nvdimm/nd_virtio.c | 9 + drivers/of/irq.c | 38 +- drivers/pci/controller/dwc/pci-keystone.c | 2 +- drivers/pci/controller/pcie-xilinx-nwl.c | 24 +- drivers/pci/quirks.c | 8 + drivers/pinctrl/mvebu/pinctrl-dove.c | 45 +- drivers/pinctrl/pinctrl-at91.c | 5 +- drivers/pinctrl/pinctrl-single.c | 3 +- drivers/platform/x86/touchscreen_dmi.c | 26 + drivers/power/reset/brcmstb-reboot.c | 3 - drivers/power/supply/axp20x_battery.c | 29 +- drivers/power/supply/max17042_battery.c | 5 +- drivers/powercap/intel_rapl_msr.c | 2 +- drivers/pps/clients/pps_parport.c | 14 +- drivers/reset/reset-berlin.c | 3 +- drivers/rtc/rtc-at91sam9.c | 1 + drivers/s390/char/zcore.c | 44 +- drivers/scsi/aacraid/aacraid.h | 2 +- drivers/soc/versatile/soc-integrator.c | 1 + drivers/soc/versatile/soc-realview.c | 20 +- drivers/soundwire/stream.c | 8 +- drivers/spi/spi-bcm63xx.c | 2 + drivers/spi/spi-fsl-lpspi.c | 9 +- drivers/spi/spi-imx.c | 2 +- drivers/spi/spi-nxp-fspi.c | 5 +- drivers/spi/spi-ppc4xx.c | 7 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/staging/media/atomisp/pci/sh_css_frac.h | 26 +- drivers/tty/serial/rp2.c | 2 +- drivers/usb/chipidea/udc.c | 8 +- drivers/usb/class/cdc-acm.c | 2 + drivers/usb/class/usbtmc.c | 2 +- drivers/usb/dwc2/platform.c | 26 +- drivers/usb/dwc3/core.c | 63 +- drivers/usb/dwc3/core.h | 15 +- drivers/usb/dwc3/gadget.c | 11 - drivers/usb/host/xhci-pci-renesas.c | 5 - drivers/usb/host/xhci-pci.c | 17 +- drivers/usb/host/xhci-pci.h | 3 - drivers/usb/misc/appledisplay.c | 15 +- drivers/usb/misc/cypress_cy7c63.c | 4 + drivers/usb/misc/yurex.c | 5 +- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 4 + drivers/usb/storage/unusual_devs.h | 11 + drivers/vhost/scsi.c | 25 +- drivers/vhost/vdpa.c | 18 +- drivers/video/fbdev/hpfb.c | 1 + drivers/video/fbdev/pxafb.c | 1 + drivers/video/fbdev/sis/sis_main.c | 2 +- drivers/virtio/virtio_vdpa.c | 1 + drivers/watchdog/imx_sc_wdt.c | 24 - drivers/xen/swiotlb-xen.c | 6 + fs/btrfs/disk-io.c | 11 + fs/btrfs/inode.c | 1 + fs/btrfs/relocation.c | 2 +- fs/ceph/addr.c | 1 - fs/exec.c | 3 +- fs/exfat/balloc.c | 10 +- fs/ext4/extents.c | 57 +- fs/ext4/file.c | 155 +- fs/ext4/ialloc.c | 14 +- fs/ext4/inline.c | 35 +- fs/ext4/inode.c | 11 +- fs/ext4/mballoc.c | 10 +- fs/ext4/migrate.c | 2 +- fs/ext4/move_extent.c | 1 - fs/ext4/namei.c | 14 +- fs/ext4/xattr.c | 4 +- fs/f2fs/acl.c | 23 +- fs/f2fs/dir.c | 3 +- fs/f2fs/f2fs.h | 4 +- fs/f2fs/file.c | 24 +- fs/f2fs/super.c | 4 +- fs/f2fs/xattr.c | 29 +- fs/fcntl.c | 14 +- fs/inode.c | 4 + fs/jbd2/checkpoint.c | 14 +- fs/jbd2/journal.c | 2 +- fs/jfs/jfs_discard.c | 11 +- fs/jfs/jfs_dmap.c | 11 +- fs/jfs/jfs_imap.c | 2 +- fs/jfs/xattr.c | 2 + fs/namespace.c | 23 +- fs/nfs/callback_xdr.c | 2 + fs/nfs/client.c | 1 + fs/nfs/delegation.c | 15 +- fs/nfs/nfs42proc.c | 2 +- fs/nfs/nfs4state.c | 3 +- fs/nfsd/filecache.c | 7 +- fs/nfsd/nfs4idmap.c | 13 +- fs/nfsd/nfs4recover.c | 8 + fs/nfsd/nfs4state.c | 5 +- fs/nfsd/nfs4xdr.c | 10 +- fs/nfsd/vfs.c | 1 + fs/nilfs2/btree.c | 12 +- fs/ocfs2/aops.c | 5 +- fs/ocfs2/buffer_head_io.c | 4 +- fs/ocfs2/journal.c | 7 +- fs/ocfs2/localalloc.c | 19 + fs/ocfs2/quota_local.c | 8 +- fs/ocfs2/refcounttree.c | 26 +- fs/ocfs2/xattr.c | 38 +- fs/proc/base.c | 61 +- fs/super.c | 3 + fs/unicode/mkutf8data.c | 70 - fs/unicode/utf8data.h_shipped | 6703 ++++++++++---------- include/drm/drm_print.h | 54 +- include/linux/cgroup-defs.h | 7 +- include/linux/fs.h | 2 + include/linux/i2c.h | 2 + include/linux/kallsyms.h | 7 +- include/linux/module.h | 9 + include/linux/nfs_fs_sb.h | 1 + include/linux/pci_ids.h | 2 + include/linux/skbuff.h | 5 +- include/linux/vdpa.h | 6 + include/net/flow.h | 6 +- include/net/ip_tunnels.h | 16 +- include/net/netfilter/nf_tables.h | 13 + include/net/sch_generic.h | 1 - include/net/sock.h | 2 + include/net/tcp.h | 21 +- include/trace/events/f2fs.h | 3 +- include/trace/events/sched.h | 84 + include/uapi/linux/cec.h | 6 +- include/uapi/linux/if_link.h | 1 + include/uapi/linux/netfilter/nf_tables.h | 2 +- io_uring/io_uring.c | 5 +- kernel/bpf/arraymap.c | 3 + kernel/bpf/devmap.c | 20 +- kernel/bpf/hashtab.c | 3 + kernel/bpf/helpers.c | 4 +- kernel/bpf/trampoline.c | 20 +- kernel/cgroup/cgroup-internal.h | 3 +- kernel/cgroup/cgroup.c | 14 +- kernel/events/core.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/kallsyms.c | 2 - kernel/kprobes.c | 8 +- kernel/kthread.c | 19 +- kernel/locking/lockdep.c | 50 +- kernel/module.c | 2 - kernel/padata.c | 6 +- kernel/rcu/rcuscale.c | 4 +- kernel/resource.c | 58 +- kernel/signal.c | 11 +- kernel/trace/ftrace.c | 71 +- kernel/trace/trace.c | 18 +- kernel/trace/trace_kprobe.c | 76 + kernel/trace/trace_output.c | 6 +- kernel/trace/trace_probe.h | 1 + lib/debugobjects.c | 5 +- lib/xz/xz_crc32.c | 2 +- lib/xz/xz_private.h | 4 - mm/slab_common.c | 7 + mm/util.c | 2 +- net/bluetooth/l2cap_sock.c | 52 +- net/bluetooth/rfcomm/sock.c | 2 - net/bridge/br_netfilter_hooks.c | 5 + net/can/bcm.c | 4 +- net/can/j1939/transport.c | 8 +- net/core/dev.c | 12 +- net/core/sock_destructor.h | 12 + net/core/sock_map.c | 1 + net/ipv4/devinet.c | 6 +- net/ipv4/fib_frontend.c | 9 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/fib_trie.c | 7 +- net/ipv4/fou.c | 4 +- net/ipv4/inet_fragment.c | 70 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_gre.c | 10 +- net/ipv4/ip_tunnel.c | 9 +- net/ipv4/netfilter/ipt_rpfilter.c | 3 +- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +- net/ipv4/netfilter/nft_fib_ipv4.c | 5 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_input.c | 31 +- net/ipv4/tcp_ipv4.c | 3 + net/ipv4/xfrm4_policy.c | 4 +- net/ipv6/Kconfig | 1 + net/ipv6/ip6_output.c | 3 +- net/ipv6/netfilter/ip6t_rpfilter.c | 6 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +- net/ipv6/netfilter/nf_reject_ipv6.c | 14 +- net/ipv6/netfilter/nft_fib_ipv6.c | 8 +- net/ipv6/route.c | 12 - net/ipv6/rpl_iptunnel.c | 12 +- net/ipv6/seg6_local.c | 1 + net/ipv6/xfrm6_policy.c | 3 +- net/l3mdev/l3mdev.c | 43 +- net/mac80211/iface.c | 17 +- net/mptcp/options.c | 2 +- net/mptcp/pm_netlink.c | 27 +- net/mptcp/protocol.h | 5 +- net/mptcp/subflow.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 7 +- net/netfilter/nf_tables_api.c | 15 +- net/netfilter/nft_lookup.c | 1 + net/netfilter/nft_set_pipapo.c | 6 +- net/netlink/af_netlink.c | 3 +- net/qrtr/af_qrtr.c | 2 +- net/sched/sch_api.c | 7 +- net/sched/sch_taprio.c | 4 +- net/sctp/socket.c | 20 +- net/tipc/bcast.c | 2 +- net/tipc/bearer.c | 8 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 6 +- net/wireless/sme.c | 3 +- net/xfrm/xfrm_policy.c | 4 +- scripts/kconfig/merge_config.sh | 2 + scripts/kconfig/qconf.cc | 2 +- security/Kconfig | 32 + security/selinux/hooks.c | 3 +- security/smack/smack_lsm.c | 3 +- security/smack/smackfs.c | 2 +- security/tomoyo/domain.c | 9 +- sound/core/init.c | 14 +- sound/core/oss/mixer_oss.c | 4 +- sound/pci/asihpi/hpimsgx.c | 2 +- sound/pci/hda/hda_generic.c | 4 +- sound/pci/hda/hda_intel.c | 2 +- sound/pci/hda/patch_conexant.c | 24 +- sound/pci/hda/patch_realtek.c | 78 +- sound/pci/rme9652/hdsp.c | 6 +- sound/pci/rme9652/hdspm.c | 6 +- sound/soc/au1x/db1200.c | 1 + sound/soc/codecs/rt5682.c | 4 +- sound/soc/codecs/tda7419.c | 1 + sound/soc/intel/keembay/kmb_platform.c | 1 + sound/soc/meson/axg-card.c | 3 +- sound/usb/card.c | 6 + sound/usb/line6/podhd.c | 2 +- sound/usb/quirks-table.h | 77 + tools/iio/iio_generic_buffer.c | 4 + tools/perf/builtin-sched.c | 8 +- tools/perf/util/time-utils.c | 4 +- tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/bpf/bench.c | 1 + .../selftests/bpf/map_tests/sk_storage_map.c | 2 +- .../selftests/bpf/prog_tests/flow_dissector.c | 1 + tools/testing/selftests/bpf/prog_tests/kfree_skb.c | 1 + tools/testing/selftests/bpf/prog_tests/tcp_rtt.c | 1 + .../testing/selftests/bpf/progs/cg_storage_multi.h | 2 - tools/testing/selftests/bpf/test_cpp.cpp | 4 + tools/testing/selftests/bpf/test_lru_map.c | 3 +- .../breakpoints/step_after_suspend_test.c | 5 +- tools/testing/selftests/net/fcnal-test.sh | 2 +- tools/testing/selftests/vDSO/parse_vdso.c | 3 +- .../selftests/vm/charge_reserved_hugetlb.sh | 2 +- tools/testing/selftests/vm/write_to_hugetlbfs.c | 23 +- 481 files changed, 7117 insertions(+), 5133 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/518 usb: dwc3: Decouple USB 2.0 L1 & L2 events
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Pham <[email protected]>
[ Upstream commit 843714bb37d9a3780160d7b4a4a72b8077a77589 ]
On DWC_usb3 revisions 3.00a and newer (including DWC_usb31 and DWC_usb32) the GUCTL1 register gained the DEV_DECOUPLE_L1L2_EVT field (bit 31) which when enabled allows the controller in device mode to treat USB 2.0 L1 LPM & L2 events separately.
After commit d1d90dd27254 ("usb: dwc3: gadget: Enable suspend events") the controller will now receive events (and therefore interrupts) for every state change when entering/exiting either L1 or L2 states. Since L1 is handled entirely by the hardware and requires no software intervention, there is no need to even enable these events and unnecessarily notify the gadget driver. Enable the aforementioned bit to help reduce the overall interrupt count for these L1 events that don't need to be handled while retaining the events for full L2 suspend/wakeup.
Stable-dep-of: 9149c9b0c7e0 ("usb: dwc3: core: update LC timer as per USB Spec V3.2")
--- drivers/usb/dwc3/core.c | 9 +++++++++ drivers/usb/dwc3/core.h | 5 +++-- 2 files changed, 12 insertions(+), 2 deletions(-)
drivers/usb/dwc3/core.c +9 -0
@@ -1064,6 +1064,15 @@ static int dwc3_core_init(struct dwc3 *dwc) if (!DWC3_VER_IS_PRIOR(DWC3, 290A)) reg |=DWC3_GUCTL1_DEV_L1_EXIT_BY_HW ; +/* +* Decouple USB 2.0 L1 & L2 events which will allow for +* gadget driver to only receive U3/L2 suspend & wakeup +* events and prevent the more frequent L1 LPM transitions +* from interrupting the driver. +*/ + if (!DWC3_VER_IS_PRIOR(DWC3, 300A)) + reg |=DWC3_GUCTL1_DEV_DECOUPLE_L1L2_EVT ; +if (dwc->dis_tx_ipgap_linecheck_quirk) reg |=DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS ;
drivers/usb/dwc3/core.h +3 -2
@@ -250,9 +250,10 @@#define DWC3_GCTL_DSBLCLKGTNG BIT(0)/* Global User Control 1 Register */ -#define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17) +#define DWC3_GUCTL1_DEV_DECOUPLE_L1L2_EVT BIT(31)#define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS BIT(28) -#define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW BIT(24) +#define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW BIT(24) +#define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17)/* Global Status Register */ #define DWC3_GSTS_OTG_IP BIT(10)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/518 usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piyush Mehta <[email protected]>
[ Upstream commit 63d7f9810a38102cdb8cad214fac98682081e1a7 ]
When configured in HOST mode, after issuing U3/L2 exit controller fails to send proper CRC checksum in CRC5 field. Because of this behavior Transaction Error is generated, resulting in reset and re-enumeration of usb device attached. Enabling chicken bit 10 of GUCTL1 will correct this problem.
When this bit is set to '1', the UTMI/ULPI opmode will be changed to "normal" along with HS terminations, term, and xcvr signals after EOR. This option is to support certain legacy UTMI/ULPI PHYs.
Added "snps,resume-hs-terminations" quirk to resolved the above issue.
Stable-dep-of: 9149c9b0c7e0 ("usb: dwc3: core: update LC timer as per USB Spec V3.2")
--- drivers/usb/dwc3/core.c | 17 +++++++++++++++++ drivers/usb/dwc3/core.h | 4 ++++ 2 files changed, 21 insertions(+)
drivers/usb/dwc3/core.c +17 -0
@@ -1054,6 +1054,21 @@ static int dwc3_core_init(struct dwc3 *dwc)dwc3_writel (dwc->regs,DWC3_GUCTL2 , reg); } +/* +* When configured in HOST mode, after issuing U3/L2 exit controller +* fails to send proper CRC checksum in CRC5 feild. Because of this +* behaviour Transaction Error is generated, resulting in reset and +* re-enumeration of usb device attached. All the termsel, xcvrsel, +* opmode becomes 0 during end of resume. Enabling bit 10 of GUCTL1 +* will correct this problem. This option is to support certain +* legacy ULPI PHYs. +*/ +if (dwc->resume_hs_terminations) { + reg =dwc3_readl (dwc->regs,DWC3_GUCTL1 ); + reg |=DWC3_GUCTL1_RESUME_OPMODE_HS_HOST ; +dwc3_writel (dwc->regs,DWC3_GUCTL1 , reg); + } + if (!DWC3_VER_IS_PRIOR(DWC3, 250A)) { reg =dwc3_readl (dwc->regs,DWC3_GUCTL1 );
@@ -1378,6 +1393,8 @@ static void dwc3_get_properties(struct dwc3 *dwc) "snps,dis-del-phy-power-chg-quirk"); dwc->dis_tx_ipgap_linecheck_quirk =device_property_read_bool (dev,"snps,dis-tx-ipgap-linecheck-quirk" ); + dwc->resume_hs_terminations =device_property_read_bool (dev, +"snps,resume-hs-terminations" ); dwc->parkmode_disable_ss_quirk =device_property_read_bool (dev,"snps,parkmode-disable-ss-quirk" );
drivers/usb/dwc3/core.h +4 -0
@@ -254,6 +254,7 @@#define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS BIT(28)#define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW BIT(24)#define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17) +#define DWC3_GUCTL1_RESUME_OPMODE_HS_HOST BIT(10)/* Global Status Register */ #define DWC3_GSTS_OTG_IP BIT(10)
@@ -1051,6 +1052,8 @@ struct dwc3_scratchpad_array {* change quirk. * @dis_tx_ipgap_linecheck_quirk: set if we disable u2mac linestate * check during HS transmit. +* @resume-hs-terminations: Set if we enable quirk for fixing improper crc +* generation after resume from suspend. * @parkmode_disable_ss_quirk: set if we need to disable all SuperSpeed * instances in park mode. * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk
@@ -1252,6 +1255,7 @@ struct dwc3 { unsigned dis_u2_freeclk_exists_quirk:1; unsigned dis_del_phy_power_chg_quirk:1; unsigned dis_tx_ipgap_linecheck_quirk:1; + unsigned resume_hs_terminations:1; unsigned parkmode_disable_ss_quirk:1; unsigned tx_de_emphasis_quirk:1;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/518 usb: dwc3: core: update LC timer as per USB Spec V3.2
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Faisal Hassan <[email protected]>
[ Upstream commit 9149c9b0c7e046273141e41eebd8a517416144ac ]
This fix addresses STAR 9001285599, which only affects DWC_usb3 version 3.20a. The timer value for PM_LC_TIMER in DWC_usb3 3.20a for the Link ECN changes is incorrect. If the PM TIMER ECN is enabled via GUCTL2[19], the link compliance test (TD7.21) may fail. If the ECN is not enabled (GUCTL2[19] = 0), the controller will use the old timer value (5us), which is still acceptable for the link compliance test. Therefore, clear GUCTL2[19] to pass the USB link compliance test: TD 7.21.
--- drivers/usb/dwc3/core.c | 15 +++++++++++++++ drivers/usb/dwc3/core.h | 2 ++ 2 files changed, 17 insertions(+)
drivers/usb/dwc3/core.c +15 -0
@@ -1054,6 +1054,21 @@ static int dwc3_core_init(struct dwc3 *dwc)dwc3_writel (dwc->regs,DWC3_GUCTL2 , reg); } +/* +* STAR 9001285599: This issue affects DWC_usb3 version 3.20a +* only. If the PM TIMER ECM is enabled through GUCTL2[19], the +* link compliance test (TD7.21) may fail. If the ECN is not +* enabled (GUCTL2[19] = 0), the controller will use the old timer +* value (5us), which is still acceptable for the link compliance +* test. Therefore, do not enable PM TIMER ECM in 3.20a by +* setting GUCTL2[19] by default; instead, use GUCTL2[19] = 0. +*/ + if (DWC3_VER_IS(DWC3, 320A)) { + reg =dwc3_readl (dwc->regs,DWC3_GUCTL2 ); + reg &= ~DWC3_GUCTL2_LC_TIMER ; +dwc3_writel (dwc->regs,DWC3_GUCTL2 , reg); + } +/* * When configured in HOST mode, after issuing U3/L2 exit controller * fails to send proper CRC checksum in CRC5 feild. Because of this
drivers/usb/dwc3/core.h +2 -0
@@ -381,6 +381,7 @@/* Global User Control Register 2 */ #define DWC3_GUCTL2_RST_ACTBITLATER BIT(14) +#define DWC3_GUCTL2_LC_TIMER BIT(19)/* Global User Control Register 3 */ #define DWC3_GUCTL3_SPLITDISABLE BIT(14)
@@ -1166,6 +1167,7 @@ struct dwc3 {#define DWC3_REVISION_290A 0x5533290a#define DWC3_REVISION_300A 0x5533300a#define DWC3_REVISION_310A 0x5533310a +#define DWC3_REVISION_320A 0x5533320a#define DWC3_REVISION_330A 0x5533330a#define DWC31_REVISION_ANY 0x0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/518 usbnet: ipheth: fix carrier detection in modes 1 and 4
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <[email protected]>
[ Upstream commit 67927a1b255d883881be9467508e0af9a5e0be9d ]
Apart from the standard "configurations", "interfaces" and "alternate interface settings" in USB, iOS devices also have a notion of "modes". In different modes, the device exposes a different set of available configurations.
Depending on the iOS version, and depending on the current mode, the length and contents of the carrier state control message differs:
* 1 byte (seen on iOS 4.2.1, 8.4):
* 03: carrier off (mode 0)
* 04: carrier on (mode 0)
* 3 bytes (seen on iOS 10.3.4, 15.7.6):
* 03 03 03: carrier off (mode 0)
* 04 04 03: carrier on (mode 0)
* 4 bytes (seen on iOS 16.5, 17.6):
* 03 03 03 00: carrier off (mode 0)
* 04 03 03 00: carrier off (mode 1)
* 06 03 03 00: carrier off (mode 4)
* 04 04 03 04: carrier on (mode 0 and 1)
* 06 04 03 04: carrier on (mode 4)
Before this change, the driver always used the first byte of the response to determine carrier state.
Quoted 1 line
From this larger sample, the first byte seems to indicate the number of
available USB configurations in the current mode (with the exception of the default mode 0), and in some cases (namely mode 1 and 4) does not correlate with the carrier state.
Previous logic erroneously counted 04 03 03 00 as "carrier on" and 06 04 03 04 as "carrier off" on iOS versions that support mode 1 and mode 4 respectively.
Only modes 0, 1 and 4 expose the USB Ethernet interfaces necessary for the ipheth driver.
Check the second byte of the control message where possible, and fall back to checking the first byte on older iOS versions.
--- drivers/net/usb/ipheth.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/usb/ipheth.c +3 -2
@@ -253,13 +253,14 @@ static int ipheth_carrier_set(struct ipheth_device *dev)0x02 ,/* index */ dev->ctrl_buf,IPHETH_CTRL_BUF_SIZE , IPHETH_CTRL_TIMEOUT); -if (retval <0 ) { +if (retval <=0 ) {dev_err (&dev->intf->dev,"%s: usb_control_msg: %d\n" , __func__, retval);return retval; } -if (dev->ctrl_buf[0 ] ==IPHETH_CARRIER_ON ) { +if ((retval ==1 && dev->ctrl_buf[0 ] ==IPHETH_CARRIER_ON ) || + (retval >=2 && dev->ctrl_buf[1 ] ==IPHETH_CARRIER_ON )) {netif_carrier_on (dev->net);if (dev->tx_urb->status != -EINPROGRESS )netif_wake_queue (dev->net);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/518 net: ethernet: use ip_hdrlen() instead of bit shift
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Yeounsu <[email protected]>
[ Upstream commit 9a039eeb71a42c8b13408a1976e300f3898e1be0 ]
ip_hdr(skb)->ihl << 2 is the same as ip_hdrlen(skb) Therefore, we should use a well-defined function not a bit shift to find the header length.
It also compresses two lines to a single line.
--- drivers/net/ethernet/jme.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/net/ethernet/jme.c +4 -6
@@ -947,15 +947,13 @@ jme_udpsum(struct sk_buff *skb)if (skb->protocol !=htons (ETH_P_IP ))return csum;skb_set_network_header (skb,ETH_HLEN ); -if ((ip_hdr (skb)->protocol !=IPPROTO_UDP ) || - (skb->len < (ETH_HLEN + - (ip_hdr (skb)->ihl <<2 ) + -sizeof (struct udphdr )))) { + +if (ip_hdr (skb)->protocol !=IPPROTO_UDP || + skb->len < (ETH_HLEN +ip_hdrlen (skb) +sizeof (struct udphdr ))) {skb_reset_network_header (skb);return csum; } -skb_set_transport_header (skb, -ETH_HLEN + (ip_hdr (skb)->ihl <<2 )); +skb_set_transport_header (skb,ETH_HLEN +ip_hdrlen (skb)); csum =udp_hdr (skb)->check;skb_reset_transport_header (skb);skb_reset_network_header (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/518 net: phy: vitesse: repair vsc73xx autonegotiation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Dembicki <[email protected]>
[ Upstream commit de7a670f8defe4ed2115552ad23dea0f432f7be4 ]
When the vsc73xx mdio bus work properly, the generic autonegotiation configuration works well.
--- drivers/net/phy/vitesse.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/net/phy/vitesse.c +0 -14
@@ -232,16 +232,6 @@ static int vsc739x_config_init(struct phy_device *phydev)return 0 ; } -static int vsc73xx_config_aneg (struct phy_device *phydev) -{ -/* The VSC73xx switches does not like to be instructed to -* do autonegotiation in any way, it prefers that you just go -* with the power-on/reset defaults. Writing some registers will -* just make autonegotiation permanently fail. -*/ -return 0 ; -} -/* This adds a skew for both TX and RX clocks, so the skew should only be * applied to "rgmii-id" interfaces. It may not work as expected * on "rgmii-txid", "rgmii-rxid" or "rgmii" interfaces. */
@@ -424,7 +414,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, /* PHY_GBIT_FEATURES */ .config_init = vsc738x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
@@ -433,7 +422,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, /* PHY_GBIT_FEATURES */ .config_init = vsc738x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
@@ -442,7 +430,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, /* PHY_GBIT_FEATURES */ .config_init = vsc739x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
@@ -451,7 +438,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, /* PHY_GBIT_FEATURES */ .config_init = vsc739x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/518 powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit e7e846dc6c73fbc94ae8b4ec20d05627646416f2 ]
Booting with CONFIG_DEBUG_VIRTUAL leads to following warning when passing hugepage reservation on command line:
Kernel command line: hugepagesz=1g hugepages=1 hugepagesz=64m hugepages=1 hugepagesz=256m hugepages=1 noreboot
HugeTLB: allocating 1 of page size 1.00 GiB failed. Only allocated 0 hugepages.
------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at arch/powerpc/include/asm/io.h:948 __alloc_bootmem_huge_page+0xd4/0x284 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.10.0-rc6-00396-g6b0e82791bd0-dirty #936 Hardware name: MPC8544DS e500v2 0x80210030 MPC8544 DS NIP: c1020240 LR: c10201d0 CTR: 00000000 REGS: c13fdd30 TRAP: 0700 Not tainted (6.10.0-rc6-00396-g6b0e82791bd0-dirty) MSR: 00021000 <CE,ME> CR: 44084288 XER: 20000000
GPR00: c10201d0 c13fde20 c130b560 e8000000 e8001000 00000000 00000000 c1420000
GPR08: 00000000 00028001 00000000 00000004 44084282 01066ac0 c0eb7c9c efffe149
GPR16: c0fc4228 0000005f ffffffff c0eb7d0c c0eb7cc0 c0eb7ce0 ffffffff 00000000
GPR24: c1441cec efffe153 e8001000 c14240c0 00000000 c1441d64 00000000 e8000000 NIP [c1020240] __alloc_bootmem_huge_page+0xd4/0x284
LR [c10201d0] __alloc_bootmem_huge_page+0x64/0x284
Call Trace: [c13fde20] [c10201d0] __alloc_bootmem_huge_page+0x64/0x284 (unreliable) [c13fde50] [c10207b8] hugetlb_hstate_alloc_pages+0x8c/0x3e8 [c13fdeb0] [c1021384] hugepages_setup+0x240/0x2cc [c13fdef0] [c1000574] unknown_bootoption+0xfc/0x280 [c13fdf30] [c0078904] parse_args+0x200/0x4c4 [c13fdfa0] [c1000d9c] start_kernel+0x238/0x7d0 [c13fdff0] [c0000434] set_ivor+0x12c/0x168 Code: 554aa33e 7c042840 3ce0c142 80a7427c 5109a016 50caa016 7c9a2378 7fdcf378 4180000c 7c052040 41810160 7c095040 <0fe00000> 38c00000 40800108 3c60c0eb ---[ end trace 0000000000000000 ]---
This is due to virt_addr_valid() using high_memory before it is set.
high_memory is set in mem_init() using max_low_pfn, but max_low_pfn is available long before, it is set in mem_topology_setup(). So just like commit daa9ada2093e ("powerpc/mm: Fix boot crash with FLATMEM") moved the setting of max_mapnr immediately after the call to mem_topology_setup(), the same can be done for high_memory.
--- arch/powerpc/kernel/setup-common.c | 1 + arch/powerpc/mm/mem.c | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-)
arch/powerpc/kernel/setup-common.c +1 -0
@@ -908,6 +908,7 @@ void __init setup_arch(char **cmdline_p)mem_topology_setup ();/* Set max_mapnr before paging_init() */ set_max_mapnr (max_pfn); + high_memory = (void *)__va (max_low_pfn *PAGE_SIZE );/* * Release secondary cpus out of their spinloops at 0x60 now that
arch/powerpc/mm/mem.c +0 -2
@@ -292,8 +292,6 @@ void __init mem_init(void)swiotlb_init (0 );#endif - high_memory = (void *)__va (max_low_pfn *PAGE_SIZE ); -kasan_late_init ();memblock_free_all ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/518 btrfs: update target inodes ctime on unlink
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 3bc2ac2f8f0b78a13140fc72022771efe0c9b778 ]
Unlink changes the link count on the target inode. POSIX mandates that the ctime must also change when this occurs.
According to https://pubs.opengroup.org/onlinepubs/9699919799/functions/unlink.html:
"Upon successful completion, unlink() shall mark for update the last data
modification and last file status change timestamps of the parent directory. Also, if the file's link count is not 0, the last file status change timestamp of the file shall be marked for update."
--- fs/btrfs/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/inode.c +1 -0
@@ -3704,6 +3704,7 @@ static int __btrfs_unlink_inode(struct btrfs_trans_handle *trans,btrfs_i_size_write (dir, dir->vfs_inode.i_size - name_len *2 );inode_inc_iversion (&inode->vfs_inode); +inode_set_ctime_current (&inode->vfs_inode);inode_inc_iversion (&dir->vfs_inode); inode->vfs_inode.i_ctime = dir->vfs_inode.i_mtime = dir->vfs_inode.i_ctime =current_time (&inode->vfs_inode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/518 Input: ads7846 - ratelimit the spi_sync error message
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit ccbfea78adf75d3d9e87aa739dab83254f5333fa ]
In case the touch controller is not connected, this message keeps scrolling on the console indefinitelly. Ratelimit it to avoid filling kernel logs.
"
ads7846 spi2.1: spi_sync --> -22
"
--- drivers/input/touchscreen/ads7846.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/touchscreen/ads7846.c +1 -1
@@ -819,7 +819,7 @@ static void ads7846_read_state(struct ads7846 *ts) m = &ts->msg[msg_idx]; error =spi_sync (ts->spi, m);if (error) { -dev_err (&ts->spi->dev,"spi_sync --> %d\n" , error); +dev_err_ratelimited (&ts->spi->dev,"spi_sync --> %d\n" , error); packet->ignore = true;return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/518 Input: synaptics - enable SMBus for HP Elitebook 840 G2
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Denose <[email protected]>
[ Upstream commit da897484557b34a54fabb81f6c223c19a69e546d ]
The kernel reports that the touchpad for this device can support a different bus.
With SMBus enabled the touchpad movement is smoother and three-finger gestures are recognized.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -187,6 +187,7 @@ static const char * const smbus_pnp_ids[] = {"LEN2054" ,/* E480 */ "LEN2055" ,/* E580 */ "LEN2068" ,/* T14 Gen 1 */ +"SYN3015" ,/* HP EliteBook 840 G2 */ "SYN3052" ,/* HP EliteBook 840 G4 */ "SYN3221" ,/* HP 15-ay000 */ "SYN323d", /* HP Spectre X360 13-w013dx */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/518 scripts: kconfig: merge_config: config files: add a trailing newline
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anders Roxell <[email protected]>
[ Upstream commit 33330bcf031818e60a816db0cfd3add9eecc3b28 ]
When merging files without trailing newlines at the end of the file, two config fragments end up at the same row if file1.config doens't have a trailing newline at the end of the file.
file1.config "CONFIG_1=y"
file2.config "CONFIG_2=y"./scripts/kconfig/merge_config.sh -m .config file1.config file2.config
This will generate a .config looking like this.
cat .config
...CONFIG_1=yCONFIG_2=y"
Making sure so we add a newline at the end of every config file that is passed into the script.
--- scripts/kconfig/merge_config.sh | 2 ++ 1 file changed, 2 insertions(+)
scripts/kconfig/merge_config.sh +2 -0
@@ -150,6 +150,8 @@ for ORIG_MERGE_FILE in $MERGE_LIST ; do sed -i "/$CFG[ =]/d" $MERGE_FILE fi done + # In case the previous file lacks a new line at the end + echo >> $TMP_FILE cat $MERGE_FILE >> $TMP_FILE done
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/518 drm/msm/adreno: Fix error return if missing firmware-name
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 624ab9cde26a9f150b4fd268b0f3dae3184dc40c ]
-ENODEV is used to signify that there is no zap shader for the platform, and the CPU can directly take the GPU out of secure mode. We want to use this return code when there is no zap-shader node. But not when there is, but without a firmware-name property. This case we want to treat as-if the needed fw is not found.
Patchwork: https://patchwork.freedesktop.org/patch/604564/
--- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.c +1 -1
@@ -93,7 +93,7 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname,* was a bad idea, and is only provided for backwards * compatibility for older targets. */ -return -ENODEV ; +return -ENOENT ; }if (IS_ERR (fw)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/518 Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7ce7c2283fa6843ab3c2adfeb83dcc504a107858 ]
Yet another quirk entry for Fujitsu laptop. Lifebook E756 requires i8041.nomux for keeping the touchpad working after suspend/resume.
--- drivers/input/serio/i8042-acpipnpio.h | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +9 -0
@@ -617,6 +617,15 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { }, .driver_data = (void *)(SERIO_QUIRK_NOMUX) }, + { +/* Fujitsu Lifebook E756 */ +/* https://bugzilla.suse.com/show_bug.cgi?id=1229056 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E756"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) + }, {/* Fujitsu Lifebook E5411 */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/518 NFS: Avoid unnecessary rescanning of the per-server delegation list
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit f92214e4c312f6ea9d78650cc6291d200f17abb6 ]
If the call to nfs_delegation_grab_inode() fails, we will not have dropped any locks that require us to rescan the list.
--- fs/nfs/delegation.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
fs/nfs/delegation.c +5 -10
@@ -609,6 +609,9 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server, prev = delegation;continue ; } + inode =nfs_delegation_grab_inode (delegation); +if (inode ==NULL ) +continue ;if (prev) {struct inode *tmp =nfs_delegation_grab_inode (prev);
@@ -619,12 +622,6 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server, } } - inode =nfs_delegation_grab_inode (delegation); -if (inode ==NULL ) { -rcu_read_unlock (); -iput (to_put); - goto restart; - } delegation =nfs_start_delegation_return_locked (NFS_I (inode));rcu_read_unlock ();
@@ -1140,7 +1137,6 @@ static int nfs_server_reap_unclaimed_delegations(struct nfs_server *server,struct inode *inode; restart:rcu_read_lock (); -restart_locked:list_for_each_entry_rcu (delegation, &server->delegations, super_list) { if (test_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags) ||
@@ -1151,7 +1147,7 @@ static int nfs_server_reap_unclaimed_delegations(struct nfs_server *server,continue ; inode =nfs_delegation_grab_inode (delegation);if (inode ==NULL ) - goto restart_locked; +continue ; delegation =nfs_start_delegation_return_locked (NFS_I (inode));rcu_read_unlock ();if (delegation !=NULL ) {
@@ -1272,7 +1268,6 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server,nfs4_stateid stateid; restart:rcu_read_lock (); -restart_locked:list_for_each_entry_rcu (delegation, &server->delegations, super_list) { if (test_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags) ||
@@ -1283,7 +1278,7 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server,continue ; inode =nfs_delegation_grab_inode (delegation);if (inode ==NULL ) - goto restart_locked; +continue ;spin_lock (&delegation->lock); cred =get_cred_rcu (delegation->cred);nfs4_stateid_copy (&stateid, &delegation->stateid);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/518 arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
commit 741f5ba7ccba5d7ae796dd11c320e28045524771 upstream.
The Qseven BIOS_DISABLE signal on the RK3399-Q7 keeps the on-module eMMC and SPI flash powered-down initially (in fact it keeps the reset signal asserted). BIOS_DISABLE_OVERRIDE pin allows to override that signal so that eMMC and SPI can be used regardless of the state of the signal.
Let's make this GPIO a hog so that it's reserved and locked in the proper state.
At the same time, make sure the pin is reserved for the hog and cannot be requested by another node.
--- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +22 -1
@@ -148,6 +148,22 @@ drive-impedance-ohm = <33>; }; +&gpio3 { + /* + * The Qseven BIOS_DISABLE signal on the RK3399-Q7 keeps the on-module + * eMMC and SPI flash powered-down initially (in fact it keeps the + * reset signal asserted). BIOS_DISABLE_OVERRIDE pin allows to override + * that signal so that eMMC and SPI can be used regardless of the state + * of the signal. + */ + bios-disable-override-hog { + gpios = <RK_PD5 GPIO_ACTIVE_LOW>; + gpio-hog; + line-name = "bios_disable_override"; + output-high; + }; +}; + &gmac { assigned-clocks = <&cru SCLK_RMII_SRC>; assigned-clock-parents = <&clkin_gmac>;
@@ -437,9 +453,14 @@ &pinctrl { pinctrl-names = "default"; - pinctrl-0 = <&q7_thermal_pin>; + pinctrl-0 = <&q7_thermal_pin &bios_disable_override_hog_pin>; gpios { + bios_disable_override_hog_pin: bios-disable-override-hog-pin { + rockchip,pins = + <3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_down>; + }; + q7_thermal_pin: q7-thermal-pin { rockchip,pins = <0 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>;
Greg Kroah-Hartman
maintainerPATCH 16/518 minmax: reduce min/max macro expansion in atomisp driver
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
commit 7c6a3a65ace70f12b27b1a27c9a69cb791dc6e91 upstream.
Avoid unnecessary nested min()/max() which results in egregious macro expansion.
Use clamp_t() as this introduces the least possible expansion, and turn the {s,u}DIGIT_FITTING() macros into inline functions to avoid the nested expansion.
This resolves an issue with slackware 15.0 32-bit compilation as reported by Richard Narron.
Presumably the min/max fixups would be difficult to backport, this patch should be easier and fix's Richard's problem in 5.15.
--- drivers/staging/media/atomisp/pci/sh_css_frac.h | 26 +++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
drivers/staging/media/atomisp/pci/sh_css_frac.h +19 -7
@@ -30,12 +30,24 @@#define uISP_VAL_MAX ((unsigned int)((1 << uISP_REG_BIT) - 1))/* a:fraction bits for 16bit precision, b:fraction bits for ISP precision */ -#define sDIGIT_FITTING (v, a, b) \ - min_t(int, max_t(int, (((v) >> sSHIFT) >> max(sFRACTION_BITS_FITTING(a) - (b), 0)), \ - sISP_VAL_MIN), sISP_VAL_MAX) -#define uDIGIT_FITTING (v, a, b) \ - min((unsigned int)max((unsigned)(((v) >> uSHIFT) \ - >> max((int)(uFRACTION_BITS_FITTING(a) - (b)), 0)), \ - uISP_VAL_MIN), uISP_VAL_MAX) +static inline int sDIGIT_FITTING (int v,int a,int b) +{ +int fit_shift =sFRACTION_BITS_FITTING (a) - b; + + v >>= sSHIFT; + v >>= fit_shift >0 ? fit_shift :0 ; + +return clamp_t (int, v, sISP_VAL_MIN, sISP_VAL_MAX); +} + +static inline unsigned int uDIGIT_FITTING (unsigned int v,int a,int b) +{ +int fit_shift =uFRACTION_BITS_FITTING (a) - b; + + v >>= uSHIFT; + v >>= fit_shift >0 ? fit_shift :0 ; + + return clamp_t(unsigned int, v, uISP_VAL_MIN, uISP_VAL_MAX); +}#endif /* __SH_CSS_FRAC_H */
Greg Kroah-Hartman
maintainerPATCH 17/518 hwmon: (pmbus) Introduce and use write_byte_data callback
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mårten Lindahl <[email protected]>
[ Upstream commit 5de3e13f7f6b496bd7bd9ff4d2b915b7d3e67cda ]
Some of the pmbus core functions uses pmbus_write_byte_data, which does not support driver callbacks for chip specific write operations. This could potentially influence some specific regulator chips that for example need a time delay before each data access.
Lets add support for driver callback with _pmbus_write_byte_data.
Stable-dep-of: 20471071f198 ("hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2")
--- drivers/hwmon/pmbus/pmbus.h | 2 ++ drivers/hwmon/pmbus/pmbus_core.c | 24 +++++++++++++++++++++--- 2 files changed, 23 insertions(+), 3 deletions(-)
drivers/hwmon/pmbus/pmbus.h +2 -0
@@ -438,6 +438,8 @@ struct pmbus_driver_info {int (*read_byte_data)(struct i2c_client *client,int page,int reg);int (*read_word_data)(struct i2c_client *client,int page,int phase,int reg); +int (*write_byte_data)(struct i2c_client *client,int page,int reg, +u8 byte);int (*write_word_data)(struct i2c_client *client,int page,int reg,u16 word);int (*write_byte)(struct i2c_client *client,int page,u8 value);
drivers/hwmon/pmbus/pmbus_core.c +21 -3
@@ -265,6 +265,24 @@ static int _pmbus_write_word_data(struct i2c_client *client, int page, int reg,return pmbus_write_word_data (client, page, reg, word); } +/* +* _pmbus_write_byte_data() is similar to pmbus_write_byte_data(), but checks if +* a device specific mapping function exists and calls it if necessary. +*/ +static int _pmbus_write_byte_data (struct i2c_client *client,int page,int reg,u8 value) +{ +struct pmbus_data *data =i2c_get_clientdata (client); +const struct pmbus_driver_info *info = data->info; +int status; + +if (info->write_byte_data) { + status = info->write_byte_data (client, page, reg, value); +if (status != -ENODATA ) +return status; + } +return pmbus_write_byte_data (client, page, reg, value); +} +int pmbus_update_fan (struct i2c_client *client,int page,int id,u8 config,u8 mask,u16 command) {
@@ -279,7 +297,7 @@ int pmbus_update_fan(struct i2c_client *client, int page, int id, to = (from & ~mask) | (config & mask);if (to != from) { - rv =pmbus_write_byte_data (client, page, + rv =_pmbus_write_byte_data (client, page, pmbus_fan_config_registers[id], to);if (rv <0 )return rv;
@@ -386,7 +404,7 @@ int pmbus_update_byte_data(struct i2c_client *client, int page, u8 reg, tmp = (rv & ~mask) | (value & mask);if (tmp != rv) - rv =pmbus_write_byte_data (client, page, reg, tmp); + rv =_pmbus_write_byte_data (client, page, reg, tmp);return rv; }
@@ -899,7 +917,7 @@ static int pmbus_get_boolean(struct i2c_client *client, struct pmbus_boolean *b, regval = status & mask;if (regval) { - ret =pmbus_write_byte_data (client, page, reg, regval); + ret =_pmbus_write_byte_data (client, page, reg, regval);if (ret) goto unlock; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/518 hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patryk Biel <[email protected]>
[ Upstream commit 20471071f198c8626dbe3951ac9834055b387844 ]
The current implementation of pmbus_show_boolean assumes that all devices support write-back operation of status register to clear pending warnings or faults. Since clearing individual bits in the status registers was only introduced in PMBus specification 1.2, this operation may not be supported by some older devices. This can result in an error while reading boolean attributes such as temp1_max_alarm.
Fetch PMBus revision supported by the device and modify pmbus_show_boolean so that it only tries to clear individual status bits if the device is compliant with PMBus specs >= 1.2. Otherwise clear all fault indicators on the current page after a fault status was reported.
Message-ID: <[email protected]> [groeck:
Rewrote description
Moved revision detection code ahead of clear faults command Assigned revision if return value from PMBUS_REVISION command is 0 Improved return value check from calling _pmbus_write_byte_data()]
--- drivers/hwmon/pmbus/pmbus.h | 6 ++++++ drivers/hwmon/pmbus/pmbus_core.c | 17 ++++++++++++++--- 2 files changed, 20 insertions(+), 3 deletions(-)
drivers/hwmon/pmbus/pmbus.h +6 -0
@@ -409,6 +409,12 @@ enum pmbus_sensor_classes {enum pmbus_data_format { linear =0 , direct, vid };enum vrm_version { vr11 =0 , vr12, vr13, imvp9, amd625mv }; +/* PMBus revision identifiers */ +#define PMBUS_REV_10 0x00/* PMBus revision 1.0 */ +#define PMBUS_REV_11 0x11/* PMBus revision 1.1 */ +#define PMBUS_REV_12 0x22/* PMBus revision 1.2 */ +#define PMBUS_REV_13 0x33/* PMBus revision 1.3 */ +struct pmbus_driver_info {int pages;/* Total number of pages */ u8 phases[PMBUS_PAGES ];/* Number of phases per page */
drivers/hwmon/pmbus/pmbus_core.c +14 -3
@@ -82,6 +82,8 @@ struct pmbus_data {u32 flags;/* from platform data */ +u8 revision;/* The PMBus revision the device is compliant with */ +int exponent[PMBUS_PAGES ];/* linear mode: exponent for output voltages */
@@ -917,9 +919,14 @@ static int pmbus_get_boolean(struct i2c_client *client, struct pmbus_boolean *b, regval = status & mask;if (regval) { - ret =_pmbus_write_byte_data (client, page, reg, regval); -if (ret) - goto unlock; +if (data->revision >=PMBUS_REV_12 ) { + ret =_pmbus_write_byte_data (client, page, reg, regval); +if (ret) + goto unlock; + }else { +pmbus_clear_fault_page (client, page); + } + }if (s1 && s2) {s64 v1, v2;
@@ -2240,6 +2247,10 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data,if (ret >0 && (ret &PB_WP_ANY )) data->flags |=PMBUS_WRITE_PROTECTED |PMBUS_SKIP_STATUS_CHECK ; + ret =i2c_smbus_read_byte_data (client,PMBUS_REVISION ); +if (ret >=0 ) + data->revision = ret; +if (data->info->pages)pmbus_clear_faults (client);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/518 ice: fix accounting for filters shared by multiple VSIs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit e843cf7b34fe2e0c1afc55e1f3057375c9b77a14 ]
When adding a switch filter (such as a MAC or VLAN filter), it is expected that the driver will detect the case where the filter already exists, and return -EEXIST. This is used by calling code such as ice_vc_add_mac_addr, and ice_vsi_add_vlan to avoid incrementing the accounting fields such as vsi->num_vlan or vf->num_mac.
This logic works correctly for the case where only a single VSI has added a given switch filter.
When a second VSI adds the same switch filter, the driver converts the existing filter from an ICE_FWD_TO_VSI filter into an ICE_FWD_TO_VSI_LIST filter. This saves switch resources, by ensuring that multiple VSIs can re-use the same filter.
The ice_add_update_vsi_list() function is responsible for doing this conversion. When first converting a filter from the FWD_TO_VSI into FWD_TO_VSI_LIST, it checks if the VSI being added is the same as the existing rule's VSI. In such a case it returns -EEXIST.
However, when the switch rule has already been converted to a FWD_TO_VSI_LIST, the logic is different. Adding a new VSI in this case just requires extending the VSI list entry. The logic for checking if the rule already exists in this case returns 0 instead of -EEXIST.
This breaks the accounting logic mentioned above, so the counters for how many MAC and VLAN filters exist for a given VF or VSI no longer accurately reflect the actual count. This breaks other code which relies on these counts.
In typical usage this primarily affects such filters generally shared by multiple VSIs such as VLAN 0, or broadcast and multicast MAC addresses.
Fix this by correctly reporting -EEXIST in the case of adding the same VSI to a switch rule already converted to ICE_FWD_TO_VSI_LIST.
--- drivers/net/ethernet/intel/ice/ice_switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_switch.c +1 -1
@@ -1259,7 +1259,7 @@ ice_add_update_vsi_list(struct ice_hw *hw,/* A rule already exists with the new VSI being added */ if (test_bit (vsi_handle, m_entry->vsi_list_info->vsi_map)) -return 0 ; +return -EEXIST ;/* Update the previously created VSI list set with * the new VSI ID passed in
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/518 net/mlx5: Update the list of the PCI supported devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meir Lichtinger <[email protected]>
[ Upstream commit dd8595eabeb486d41ad9994e6cece36e0e25e313 ]
Add the upcoming BlueField-3 device ID.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/main.c +1 -0
@@ -1600,6 +1600,7 @@ static const struct pci_device_id mlx5_core_pci_table[] = { { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */ { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */ { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */ + { PCI_VDEVICE(MELLANOX, 0xa2dc) }, /* BlueField-3 integrated ConnectX-7 network controller */ { 0, } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/518 net/mlx5e: Add missing link modes to ptys2ethtool_map
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Shitrit <[email protected]>
[ Upstream commit 7617d62cba4a8a3ff3ed3fda0171c43f135c142e ]
Add MLX5E_1000BASE_T and MLX5E_100BASE_TX to the legacy modes in ptys2legacy_ethtool_table, since they were missing.
--- drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +4 -0
@@ -127,6 +127,10 @@ void mlx5e_build_ptys2ethtool_map(void) ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT);MLX5_BUILD_PTYS2ETHTOOL_CONFIG (MLX5E_100GBASE_LR4 , legacy, ETHTOOL_LINK_MODE_100000baseLR4_ER4_Full_BIT); +MLX5_BUILD_PTYS2ETHTOOL_CONFIG (MLX5E_100BASE_TX , legacy, + ETHTOOL_LINK_MODE_100baseT_Full_BIT); +MLX5_BUILD_PTYS2ETHTOOL_CONFIG (MLX5E_1000BASE_T , legacy, + ETHTOOL_LINK_MODE_1000baseT_Full_BIT);MLX5_BUILD_PTYS2ETHTOOL_CONFIG (MLX5E_10GBASE_T , legacy, ETHTOOL_LINK_MODE_10000baseT_Full_BIT); MLX5_BUILD_PTYS2ETHTOOL_CONFIG(MLX5E_25GBASE_CR, legacy,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/518 fou: fix initialization of grc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
[ Upstream commit 4c8002277167125078e6b9b90137bdf443ebaa08 ]
The grc must be initialize first. There can be a condition where if fou is NULL, goto out will be executed and grc would be used uninitialized.
--- net/ipv4/fou.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv4/fou.c +2 -2
@@ -334,11 +334,11 @@ static struct sk_buff *gue_gro_receive(struct sock *sk,struct gro_remcsum grc;u8 proto; +skb_gro_remcsum_init (&grc); +if (!fou) goto out; -skb_gro_remcsum_init (&grc); - off =skb_gro_offset (skb); len = off +sizeof (*guehdr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/518 net: ftgmac100: Enable TX interrupt to avoid TX timeout
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Chou <[email protected]>
[ Upstream commit fef2843bb49f414d1523ca007d088071dee0e055 ]
Currently, the driver only enables RX interrupt to handle RX packets and TX resources. Sometimes there is not RX traffic, so the TX resource needs to wait for RX interrupt to free. This situation will toggle the TX timeout watchdog when the MAC TX ring has no more resources to transmit packets. Therefore, enable TX interrupt to release TX resources at any time.
When I am verifying iperf3 over UDP, the network hangs. Like the log below.
root# iperf3 -c 192.168.100.100 -i1 -t10 -u -b0
Connecting to host 192.168.100.100, port 5201
[ 4] local 192.168.100.101 port 35773 connected to 192.168.100.100 port 5201
[ ID] Interval Transfer Bandwidth Total Datagrams [ 4] 0.00-20.42 sec 160 KBytes 64.2 Kbits/sec 20 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bandwidth Jitter Lost/Total Datagrams
[ 4] 0.00-20.42 sec 160 KBytes 64.2 Kbits/sec 0.000 ms 0/20 (0%)
[ 4] Sent 20 datagrams
iperf3: error - the server has terminated
The network topology is FTGMAC connects directly to a PC.
UDP does not need to wait for ACK, unlike TCP.
Therefore, FTGMAC needs to enable TX interrupt to release TX resources instead of waiting for the RX interrupt.
--- drivers/net/ethernet/faraday/ftgmac100.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/faraday/ftgmac100.h +1 -1
@@ -84,7 +84,7 @@ FTGMAC100_INT_RPKT_BUF)/* All the interrupts we care about */ -#define FTGMAC100_INT_ALL (FTGMAC100_INT_RPKT_BUF | \ +#define FTGMAC100_INT_ALL (FTGMAC100_INT_RXTX | \ FTGMAC100_INT_BAD)/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/518 net: dpaa: Pad packets to ETH_ZLEN
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 ]
When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running
$ ping -s 11 destination
--- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +8 -1
@@ -2155,12 +2155,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); -bool nonlinear =skb_is_nonlinear (skb);struct rtnl_link_stats64 *percpu_stats;struct dpaa_percpu_priv *percpu_priv;struct netdev_queue *txq;struct dpaa_priv *priv;struct qm_fd fd; +bool nonlinear;int offset =0 ;int err =0 ;
@@ -2170,6 +2170,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)qm_fd_clear_fd (&fd); +/* Packet data is always read as 32-bit words, so zero out any part of +* the skb which might be sent if we have to pad the packet +*/ +if (__skb_put_padto (skb,ETH_ZLEN , false)) + goto enomem; + + nonlinear =skb_is_nonlinear (skb);if (!nonlinear) {/* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/518 spi: nxp-fspi: fix the KASAN report out-of-bounds bug
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Xu <[email protected]>
commit 2a8787c1cdc7be24fdd8953ecd1a8743a1006235 upstream.
Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO.
To reproduce the issue, write 3 bytes data to NOR chip.
dd if=3b of=/dev/mtd0
[ 36.926103] ================================================================== [ 36.933409] BUG: KASAN: slab-out-of-bounds in nxp_fspi_exec_op+0x26ec/0x2838 [ 36.940514] Read of size 4 at addr ffff00081037c2a0 by task dd/455 [ 36.946721] [ 36.948235] CPU: 3 UID: 0 PID: 455 Comm: dd Not tainted 6.11.0-rc5-gc7b0e37c8434 #1070 [ 36.956185] Hardware name: Freescale i.MX8QM MEK (DT) [ 36.961260] Call trace: [ 36.963723] dump_backtrace+0x90/0xe8 [ 36.967414] show_stack+0x18/0x24 [ 36.970749] dump_stack_lvl+0x78/0x90 [ 36.974451] print_report+0x114/0x5cc [ 36.978151] kasan_report+0xa4/0xf0 [ 36.981670] __asan_report_load_n_noabort+0x1c/0x28 [ 36.986587] nxp_fspi_exec_op+0x26ec/0x2838 [ 36.990800] spi_mem_exec_op+0x8ec/0xd30 [ 36.994762] spi_mem_no_dirmap_read+0x190/0x1e0 [ 36.999323] spi_mem_dirmap_write+0x238/0x32c [ 37.003710] spi_nor_write_data+0x220/0x374 [ 37.007932] spi_nor_write+0x110/0x2e8 [ 37.011711] mtd_write_oob_std+0x154/0x1f0 [ 37.015838] mtd_write_oob+0x104/0x1d0 [ 37.019617] mtd_write+0xb8/0x12c [ 37.022953] mtdchar_write+0x224/0x47c [ 37.026732] vfs_write+0x1e4/0x8c8 [ 37.030163] ksys_write+0xec/0x1d0 [ 37.033586] __arm64_sys_write+0x6c/0x9c [ 37.037539] invoke_syscall+0x6c/0x258 [ 37.041327] el0_svc_common.constprop.0+0x160/0x22c [ 37.046244] do_el0_svc+0x44/0x5c [ 37.049589] el0_svc+0x38/0x78 [ 37.052681] el0t_64_sync_handler+0x13c/0x158 [ 37.057077] el0t_64_sync+0x190/0x194 [ 37.060775] [ 37.062274] Allocated by task 455: [ 37.065701] kasan_save_stack+0x2c/0x54 [ 37.069570] kasan_save_track+0x20/0x3c [ 37.073438] kasan_save_alloc_info+0x40/0x54 [ 37.077736] __kasan_kmalloc+0xa0/0xb8 [ 37.081515] __kmalloc_noprof+0x158/0x2f8 [ 37.085563] mtd_kmalloc_up_to+0x120/0x154 [ 37.089690] mtdchar_write+0x130/0x47c [ 37.093469] vfs_write+0x1e4/0x8c8 [ 37.096901] ksys_write+0xec/0x1d0 [ 37.100332] __arm64_sys_write+0x6c/0x9c [ 37.104287] invoke_syscall+0x6c/0x258 [ 37.108064] el0_svc_common.constprop.0+0x160/0x22c [ 37.112972] do_el0_svc+0x44/0x5c [ 37.116319] el0_svc+0x38/0x78 [ 37.119401] el0t_64_sync_handler+0x13c/0x158 [ 37.123788] el0t_64_sync+0x190/0x194 [ 37.127474] [ 37.128977] The buggy address belongs to the object at ffff00081037c2a0 [ 37.128977] which belongs to the cache kmalloc-8 of size 8 [ 37.141177] The buggy address is located 0 bytes inside of [ 37.141177] allocated 3-byte region [ffff00081037c2a0, ffff00081037c2a3) [ 37.153465] [ 37.154971] The buggy address belongs to the physical page: [ 37.160559] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89037c [ 37.168596] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 37.175149] page_type: 0xfdffffff(slab) [ 37.179021] raw: 0bfffe0000000000 ffff000800002500 dead000000000122 0000000000000000 [ 37.186788] raw: 0000000000000000 0000000080800080 00000001fdffffff 0000000000000000 [ 37.194553] page dumped because: kasan: bad access detected [ 37.200144] [ 37.201647] Memory state around the buggy address: [ 37.206460] ffff00081037c180: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 37.213701] ffff00081037c200: fa fc fc fc 05 fc fc fc 03 fc fc fc 02 fc fc fc [ 37.220946] >ffff00081037c280: 06 fc fc fc 03 fc fc fc fc fc fc fc fc fc fc fc [ 37.228186] ^ [ 37.232473] ffff00081037c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.239718] ffff00081037c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.246962] ================================================================== [ 37.254394] Disabling lock debugging due to kernel taint
0+1 records in
0+1 records out
3 bytes copied, 0.335911 s, 0.0 kB/s
--- drivers/spi/spi-nxp-fspi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/spi/spi-nxp-fspi.c +3 -2
@@ -731,14 +731,15 @@ static void nxp_fspi_fill_txfifo(structif (i < op->data.nbytes) {u32 data =0 ;int j; +int remaining = op->data.nbytes - i;/* Wait for TXFIFO empty */ ret =fspi_readl_poll_tout (f, f->iobase +FSPI_INTR ,FSPI_INTR_IPTXWE ,0 ,POLL_TOUT , true);WARN_ON (ret); -for (j =0 ; j <ALIGN (op->data.nbytes - i,4 ); j +=4 ) { -memcpy (&data, buf + i + j,4 ); +for (j =0 ; j <ALIGN (remaining,4 ); j +=4 ) { +memcpy (&data, buf + i + j,min_t (int,4 , remaining - j));fspi_writel (f, data, base +FSPI_TFDR + j); }fspi_writel (f,FSPI_INTR_IPTXWE , base +FSPI_INTR );
Greg Kroah-Hartman
maintainerPATCH 26/518 soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 233a95fd574fde1c375c486540a90304a2d2d49f upstream.
This reverts commit ab8d66d132bc8f1992d3eb6cab8d32dda6733c84 because it breaks codecs using non-continuous masks in source and sink ports. The commit missed the point that port numbers are not used as indices for iterating over prop.sink_ports or prop.source_ports.
Soundwire core and existing codecs expect that the array passed as prop.sink_ports and prop.source_ports is continuous. The port mask still might be non-continuous, but that's unrelated.
--- drivers/soundwire/stream.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soundwire/stream.c +4 -4
@@ -1425,18 +1425,18 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_p unsigned int port_num) {struct sdw_dpn_prop *dpn_prop; -unsigned long mask; +u8 num_ports;int i;if (direction ==SDW_DATA_DIR_TX ) { - mask = slave->prop.source_ports; + num_ports =hweight32 (slave->prop.source_ports); dpn_prop = slave->prop.src_dpn_prop; }else { - mask = slave->prop.sink_ports; + num_ports =hweight32 (slave->prop.sink_ports); dpn_prop = slave->prop.sink_dpn_prop; } -for_each_set_bit (i, &mask,32 ) { +for (i =0 ; i < num_ports; i++) {if (dpn_prop[i].num == port_num)return &dpn_prop[i]; }
Greg Kroah-Hartman
maintainerPATCH 27/518 ASoC: meson: axg-card: fix use-after-free
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <[email protected]>
commit 4f9a71435953f941969a4f017e2357db62d85a86 upstream.
Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()', so move 'pad' pointer initialization after this function when memory is already reallocated.
Kasan bug report:
==================================================================
BUG: KASAN: slab-use-after-free in axg_card_add_link+0x76c/0x9bc Read of size 8 at addr ffff000000e8b260 by task modprobe/356 CPU: 0 PID: 356 Comm: modprobe Tainted: G O 6.9.12-sdkernel #1 Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x78/0x90 print_report+0xfc/0x5c0 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 axg_card_add_link+0x76c/0x9bc [snd_soc_meson_axg_sound_card] meson_card_probe+0x344/0x3b8 [snd_soc_meson_card_utils] platform_probe+0x8c/0xf4 really_probe+0x110/0x39c __driver_probe_device+0xb8/0x18c driver_probe_device+0x108/0x1d8 __driver_attach+0xd0/0x25c bus_for_each_dev+0xe0/0x154 driver_attach+0x34/0x44 bus_add_driver+0x134/0x294 driver_register+0xa8/0x1e8 __platform_driver_register+0x44/0x54 axg_card_pdrv_init+0x20/0x1000 [snd_soc_meson_axg_sound_card] do_one_initcall+0xdc/0x25c do_init_module+0x10c/0x334 load_module+0x24c4/0x26cc init_module_from_file+0xd4/0x128 __arm64_sys_finit_module+0x1f4/0x41c invoke_syscall+0x60/0x188 el0_svc_common.constprop.0+0x78/0x13c do_el0_svc+0x30/0x40 el0_svc+0x38/0x78 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194
--- sound/soc/meson/axg-card.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/meson/axg-card.c +2 -1
@@ -104,7 +104,7 @@ static int axg_card_add_tdm_loopback(str int *index) {struct meson_card *priv =snd_soc_card_get_drvdata (card); -struct snd_soc_dai_link *pad = &card->dai_link[*index]; +struct snd_soc_dai_link *pad;struct snd_soc_dai_link *lb;struct snd_soc_dai_link_component *dlc;int ret;
@@ -114,6 +114,7 @@ static int axg_card_add_tdm_loopback(strif (ret)return ret; + pad = &card->dai_link[*index]; lb = &card->dai_link[*index +1 ]; lb->name =devm_kasprintf (card->dev,GFP_KERNEL ,"%s-lb" , pad->name);
Greg Kroah-Hartman
maintainerPATCH 28/518 dma-buf: heaps: Fix off-by-one in CMA heap fault handler
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: T.J. Mercier <[email protected]>
commit ea5ff5d351b520524019f7ff7f9ce418de2dad87 upstream.
Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps:
Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma_buf_mmap_internal. When using such a mapping to attempt to fault past the end of the buffer, the CMA heap fault handler also checks the fault offset against the buffer size, but gets the boundary wrong by
1. Fix the boundary check so that we don't read off the end of the pages array and insert an arbitrary page in the mapping.
[ TJ: Backport to 5.10. On this kernel the bug is located in
dma_heap_vm_fault which is used by both the CMA and system heaps. ]
--- drivers/dma-buf/heaps/heap-helpers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma-buf/heaps/heap-helpers.c +1 -1
@@ -161,7 +161,7 @@ static vm_fault_t dma_heap_vm_fault(strustruct vm_area_struct *vma = vmf->vma;struct heap_helper_buffer *buffer = vma->vm_private_data; -if (vmf->pgoff > buffer->pagecount) +if (vmf->pgoff >= buffer->pagecount)return VM_FAULT_SIGBUS ; vmf->page = buffer->pages[vmf->pgoff];
Greg Kroah-Hartman
maintainerPATCH 29/518 ASoC: allow module autoloading for table db1200_pids
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongbo Li <[email protected]>
[ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table.
--- sound/soc/au1x/db1200.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/au1x/db1200.c +1 -0
@@ -44,6 +44,7 @@ static const struct platform_device_id db1200_pids[] = { }, {}, }; +MODULE_DEVICE_TABLE (platform, db1200_pids);/*------------------------- AC97 PART ---------------------------*/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/518 ALSA: hda/realtek - Fixed ALC256 headphone no sound
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit 9b82ff1362f50914c8292902e07be98a9f59d33d ]
Dell platform, plug headphone or headset, it had a chance to get no sound from headphone.
Replace depop procedure will solve this issue.
--- sound/pci/hda/patch_realtek.c | 50 ++++++++++++++++++++++++++--------- 1 file changed, 37 insertions(+), 13 deletions(-)
sound/pci/hda/patch_realtek.c +37 -13
@@ -4846,6 +4846,30 @@ static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec, } } +static void alc_hp_mute_disable (struct hda_codec *codec,unsigned int delay) +{ +if (delay <=0 ) + delay =75 ; +snd_hda_codec_write (codec,0x21 ,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); +msleep (delay); +snd_hda_codec_write (codec,0x21 ,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); +msleep (delay); +} + +static void alc_hp_enable_unmute (struct hda_codec *codec,unsigned int delay) +{ +if (delay <=0 ) + delay =75 ; +snd_hda_codec_write (codec,0x21 ,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); +msleep (delay); +snd_hda_codec_write (codec,0x21 ,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE ); +msleep (delay); +} +static const struct coef_fw alc225_pre_hsmode[] = {UPDATE_COEF (0x4a ,1 <<8 ,0 ),UPDATE_COEFEX (0x57 ,0x05 ,1 <<14 ,0 ),
@@ -4947,6 +4971,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)case 0x10ec0236 :case 0x10ec0256 :case 0x19e58326 : +alc_hp_mute_disable (codec,75 );alc_process_coef_fw (codec, coef0256);break ;case 0x10ec0234 :
@@ -5218,6 +5243,7 @@ static void alc_headset_mode_default(struct hda_codec *codec)alc_write_coef_idx (codec,0x45 ,0xc089 );msleep (50 );alc_process_coef_fw (codec, coef0256); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0234 :case 0x10ec0274 :
@@ -5315,6 +5341,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)case 0x10ec0256 :case 0x19e58326 :alc_process_coef_fw (codec, coef0256); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0234 :case 0x10ec0274 :
@@ -5430,6 +5457,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)case 0x10ec0256 :case 0x19e58326 :alc_process_coef_fw (codec, coef0256); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0234 :case 0x10ec0274 :
@@ -5535,25 +5563,21 @@ static void alc_determine_headset_type(struct hda_codec *codec)alc_write_coef_idx (codec,0x06 ,0x6104 );alc_write_coefex_idx (codec,0x57 ,0x3 ,0x09a3 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); -msleep (80 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); -alc_process_coef_fw (codec, coef0255);msleep (300 ); val =alc_read_coef_idx (codec,0x46 ); is_ctia = (val &0x0070 ) ==0x0070 ; - +if (!is_ctia) { +alc_write_coef_idx (codec,0x45 ,0xe089 ); +msleep (100 ); + val =alc_read_coef_idx (codec,0x46 ); +if ((val &0x0070 ) ==0x0070 ) + is_ctia = false; +else + is_ctia = true; + }alc_write_coefex_idx (codec,0x57 ,0x3 ,0x0da3 );alc_update_coefex_idx (codec,0x57 ,0x5 ,1 <<14 ,0 ); - -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); -msleep (80 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE );break ;case 0x10ec0234 :case 0x10ec0274 :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/518 ALSA: hda/realtek - FIxed ALC285 headphone no sound
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit 1fa7b099d60ad64f559bd3b8e3f0d94b2e015514 ]
Dell platform with ALC215 ALC285 ALC289 ALC225 ALC295 ALC299, plug headphone or headset.
It had a chance to get no sound from headphone.
Replace depop procedure will solve this issue.
--- sound/pci/hda/patch_realtek.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
sound/pci/hda/patch_realtek.c +14 -12
@@ -5006,6 +5006,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)case 0x10ec0295 :case 0x10ec0289 :case 0x10ec0299 : +alc_hp_mute_disable (codec,75 );alc_process_coef_fw (codec, alc225_pre_hsmode);alc_process_coef_fw (codec, coef0225);break ;
@@ -5231,6 +5232,7 @@ static void alc_headset_mode_default(struct hda_codec *codec)case 0x10ec0299 :alc_process_coef_fw (codec, alc225_pre_hsmode);alc_process_coef_fw (codec, coef0225); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0255 :alc_process_coef_fw (codec, coef0255);
@@ -5390,6 +5392,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)alc_process_coef_fw (codec, coef0225_2); elsealc_process_coef_fw (codec ,coef0225_1 ); +alc_hp_enable_unmute (codec,75 );break ;case 0x10ec0867 :alc_update_coefex_idx (codec,0x57 ,0x5 ,1 <<14 ,0 );
@@ -5495,6 +5498,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)case 0x10ec0289 :case 0x10ec0299 :alc_process_coef_fw (codec, coef0225); +alc_hp_enable_unmute (codec,75 );break ; }codec_dbg (codec,"Headset jack set to Nokia-style headset mode.\n" );
@@ -5654,12 +5658,6 @@ static void alc_determine_headset_type(struct hda_codec *codec)case 0x10ec0295 :case 0x10ec0289 :case 0x10ec0299 : -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); -msleep (80 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); -alc_process_coef_fw (codec, alc225_pre_hsmode);alc_update_coef_idx (codec,0x67 ,0xf000 ,0x1000 ); val =alc_read_coef_idx (codec,0x45 );
@@ -5676,15 +5674,19 @@ static void alc_determine_headset_type(struct hda_codec *codec) val =alc_read_coef_idx (codec,0x46 ); is_ctia = (val &0x00f0 ) ==0x00f0 ; } +if (!is_ctia) { +alc_update_coef_idx (codec,0x45 ,0x3f <<10 ,0x38 <<10 ); +alc_update_coef_idx (codec,0x49 ,3 <<8 ,1 <<8 ); +msleep (100 ); + val =alc_read_coef_idx (codec,0x46 ); +if ((val &0x00f0 ) ==0x00f0 ) + is_ctia = false; +else + is_ctia = true; + }alc_update_coef_idx (codec,0x4a ,7 <<6 ,7 <<6 );alc_update_coef_idx (codec,0x4a ,3 <<4 ,3 <<4 );alc_update_coef_idx (codec,0x67 ,0xf000 ,0x3000 ); - -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); -msleep (80 ); -snd_hda_codec_write (codec,0x21 ,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE );break ;case 0x10ec0867 : is_ctia = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/518 pinctrl: at91: make it work with current gpiolib
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Blocher <[email protected]>
[ Upstream commit 752f387faaae0ae2e84d3f496922524785e77d60 ]
pinctrl-at91 currently does not support the gpio-groups devicetree property and has no pin-range.
Because of this at91 gpios stopped working since patch
commit 2ab73c6d8323fa1e ("gpio: Support GPIO controllers without pin-ranges") This was discussed in the patches
commit fc328a7d1fcce263 ("gpio: Revert regression in sysfs-gpio (gpiolib.c)") commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"")
As a workaround manually set pin-range via gpiochip_add_pin_range() until
a) pinctrl-at91 is reworked to support devicetree gpio-groups
b) another solution as mentioned in
commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"") is found
--- drivers/pinctrl/pinctrl-at91.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-at91.c +4 -1
@@ -1401,8 +1401,11 @@ static int at91_pinctrl_probe(struct platform_device *pdev)/* We will handle a range of GPIO pins */ for (i =0 ; i < gpio_banks; i++) -if (gpio_chips[i]) +if (gpio_chips[i]) {pinctrl_add_gpio_range (info->pctl, &gpio_chips[i]->range); +gpiochip_add_pin_range (&gpio_chips[i]->chip,dev_name (info->pctl->dev),0 , + gpio_chips[i]->range.pin_base, gpio_chips[i]->range.npins); + }dev_info (&pdev->dev,"initialized AT91 pinctrl driver\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/518 microblaze: dont treat zero reserved memory regions as error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport <[email protected]>
[ Upstream commit 0075df288dd8a7abfe03b3766176c393063591dd ]
Before commit 721f4a6526da ("mm/memblock: remove empty dummy entry") the check for non-zero of memblock.reserved.cnt in mmu_init() would always be true either because memblock.reserved.cnt is initialized to 1 or because there were memory reservations earlier.
The removal of dummy empty entry in memblock caused this check to fail because now memblock.reserved.cnt is initialized to 0.
Remove the check for non-zero of memblock.reserved.cnt because it's perfectly fine to have an empty memblock.reserved array that early in boot.
--- arch/microblaze/mm/init.c | 5 ----- 1 file changed, 5 deletions(-)
arch/microblaze/mm/init.c +0 -5
@@ -245,11 +245,6 @@ asmlinkage void __init mmu_init(void) {unsigned int kstart, ksize; -if (!memblock.reserved.cnt) { -pr_emerg ("Error memory count\n" ); -machine_restart (NULL ); - } -if ((u32 ) memblock.memory.regions[0 ].size <0x400000 ) {pr_emerg ("Memory must be greater than 4MB\n" );machine_restart (NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/518 net: ftgmac100: Ensure tx descriptor updates are visible
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Chou <[email protected]>
[ Upstream commit 4186c8d9e6af57bab0687b299df10ebd47534a0a ]
The driver must ensure TX descriptor updates are visible before updating TX pointer and TX clear pointer.
This resolves TX hangs observed on AST2600 when running iperf3.
--- drivers/net/ethernet/faraday/ftgmac100.c | 26 ++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/net/ethernet/faraday/ftgmac100.c +18 -8
@@ -569,7 +569,7 @@ static bool ftgmac100_rx_packet(struct ftgmac100 *priv, int *processed) (*processed)++;return true; - drop: +drop:/* Clean rxdes0 (which resets own bit) */ rxdes->rxdes0 =cpu_to_le32 (status & priv->rxdes0_edorr_mask); priv->rx_pointer =ftgmac100_next_rx_pointer (priv, pointer);
@@ -653,6 +653,11 @@ static bool ftgmac100_tx_complete_packet(struct ftgmac100 *priv)ftgmac100_free_tx_packet (priv, pointer, skb, txdes, ctl_stat); txdes->txdes0 =cpu_to_le32 (ctl_stat & priv->txdes0_edotr_mask); +/* Ensure the descriptor config is visible before setting the tx +* pointer. +*/ +smp_wmb (); + priv->tx_clean_pointer =ftgmac100_next_tx_pointer (priv, pointer);return true;
@@ -806,6 +811,11 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,dma_wmb (); first->txdes0 =cpu_to_le32 (f_ctl_stat); +/* Ensure the descriptor config is visible before setting the tx +* pointer. +*/ +smp_wmb (); +/* Update next TX pointer */ priv->tx_pointer = pointer;
@@ -826,7 +836,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,return NETDEV_TX_OK ; - dma_err: +dma_err:if (net_ratelimit ())netdev_err (netdev,"map tx fragment failed\n" );
@@ -848,7 +858,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,* last fragment, so we know ftgmac100_free_tx_packet() * hasn't freed the skb yet. */ - drop: +drop:/* Drop the packet */ dev_kfree_skb_any (skb); netdev->stats.tx_dropped++;
@@ -1419,7 +1429,7 @@ static void ftgmac100_reset_task(struct work_struct *work)ftgmac100_init_all (priv, true);netdev_dbg (netdev,"Reset done !\n" ); - bail: +bail:if (priv->mii_bus)mutex_unlock (&priv->mii_bus->mdio_lock);if (netdev->phydev)
@@ -1490,15 +1500,15 @@ static int ftgmac100_open(struct net_device *netdev)return 0 ; - err_ncsi: +err_ncsi:napi_disable (&priv->napi);netif_stop_queue (netdev); - err_alloc: +err_alloc:ftgmac100_free_buffers (priv);free_irq (netdev->irq, netdev); - err_irq: +err_irq:netif_napi_del (&priv->napi); - err_hw: +err_hw:iowrite32 (0 , priv->base +FTGMAC100_OFFSET_IER );ftgmac100_free_rings (priv);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/518 wifi: iwlwifi: lower message level for FW buffer destination
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit f8a129c1e10256c785164ed5efa5d17d45fbd81b ]
An invalid buffer destination is not a problem for the driver and it does not make sense to report it with the KERN_ERR message level. As such, change the message to use IWL_DEBUG_FW.
--- drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c +2 -1
@@ -111,7 +111,8 @@ iwl_pcie_ctxt_info_dbg_enable(struct iwl_trans *trans, }break ;default : -IWL_ERR (trans,"WRT: Invalid buffer destination\n" ); +IWL_DEBUG_FW (trans,"WRT: Invalid buffer destination (%d)\n" , +le32_to_cpu (fw_mon_cfg->buf_location)); } out:if (dbg_flags)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/518 wifi: iwlwifi: mvm: dont wait for tx queues if firmware is dead
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ]
There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was recently converted from just a message), that can be hit if we wait for TX queues to become empty after firmware died. Clearly, we can't expect anything from the firmware after it's declared dead.
Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could be a good idea to stop the flow earlier, the flush functions do some maintenance work that is not related to the firmware, so keep that part of the code running even when the firmware is not running.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +8 -1
@@ -4747,6 +4747,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)int i;if (!iwl_mvm_has_new_tx_api (mvm)) { +/* we can't ask the firmware anything if it is dead */ +if (test_bit (IWL_MVM_STATUS_HW_RESTART_REQUESTED , + &mvm->status)) +return ;if (drop) {mutex_lock (&mvm->mutex); iwl_mvm_flush_tx_path(mvm,
@@ -4828,8 +4832,11 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,/* this can take a while, and we may need/want other operations * to succeed while doing this, so do it without the mutex held +* If the firmware is dead, this can't work... */ -if (!drop && !iwl_mvm_has_new_tx_api (mvm)) +if (!drop && !iwl_mvm_has_new_tx_api (mvm) && + !test_bit (IWL_MVM_STATUS_HW_RESTART_REQUESTED , + &mvm->status))iwl_trans_wait_tx_queues_empty (mvm->trans, msk); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/518 ASoC: intel: fix module autoloading
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit ae61a3391088d29aa8605c9f2db84295ab993a49 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- sound/soc/intel/keembay/kmb_platform.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/keembay/kmb_platform.c +1 -0
@@ -634,6 +634,7 @@ static const struct of_device_id kmb_plat_of_match[] = { { .compatible = "intel,keembay-tdm", .data = &intel_kmb_tdm_dai}, {} }; +MODULE_DEVICE_TABLE (of, kmb_plat_of_match);static int kmb_plat_dai_probe (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/518 ASoC: tda7419: fix module autoloading
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit 934b44589da9aa300201a00fe139c5c54f421563 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- sound/soc/codecs/tda7419.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/tda7419.c +1 -0
@@ -624,6 +624,7 @@ static const struct of_device_id tda7419_of_match[] = { { .compatible = "st,tda7419" }, { }, }; +MODULE_DEVICE_TABLE (of, tda7419_of_match);static struct i2c_driver tda7419_driver = { .driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/518 drm: komeda: Fix an issue related to normalized zpos
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: hongchi.peng <[email protected]>
[ Upstream commit 258905cb9a6414be5c9ca4aa20ef855f8dc894d4 ]
We use komeda_crtc_normalize_zpos to normalize zpos of affected planes to their blending zorder in CU. If there's only one slave plane in affected planes and its layer_split property is enabled, order++ for its split layer, so that when calculating the normalized_zpos of master planes, the split layer of the slave plane is included, but the max_slave_zorder does not include the split layer and keep zero because there's only one slave plane in affacted planes, although we actually use two slave layers in this commit.
In most cases, this bug does not result in a commit failure, but assume the following situation:
slave_layer 0: zpos = 0, layer split enabled, normalized_zpos = 0;(use slave_layer 2 as its split layer)
master_layer 0: zpos = 2, layer_split enabled, normalized_zpos = 2;(use master_layer 2 as its split layer)
master_layer 1: zpos = 4, normalized_zpos = 4; master_layer 3: zpos = 5, normalized_zpos = 5; kcrtc_st->max_slave_zorder = 0;
When we use master_layer 3 as a input of CU in function komeda_compiz_set_input and check it with function komeda_component_check_input, the parameter idx is equal to normailzed_zpos minus max_slave_zorder, the value of idx is 5 and is euqal to CU's max_active_inputs, so that komeda_component_check_input returns a -EINVAL value.
To fix the bug described above, when calculating the max_slave_zorder with the layer_split enabled, count the split layer in this calculation directly.
--- drivers/gpu/drm/arm/display/komeda/komeda_kms.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/arm/display/komeda/komeda_kms.c +7 -3
@@ -142,6 +142,7 @@ static int komeda_crtc_normalize_zpos(struct drm_crtc *crtc,struct drm_plane *plane;struct list_head zorder_list;int order =0 , err; +u32 slave_zpos =0 ;DRM_DEBUG_ATOMIC ("[CRTC:%d:%s] calculating normalized zpos values\n" , crtc->base.id, crtc->name);
@@ -181,10 +182,13 @@ static int komeda_crtc_normalize_zpos(struct drm_crtc *crtc, plane_st->zpos, plane_st->normalized_zpos);/* calculate max slave zorder */ -if (has_bit (drm_plane_index (plane), kcrtc->slave_planes)) +if (has_bit (drm_plane_index (plane), kcrtc->slave_planes)) { + slave_zpos = plane_st->normalized_zpos; +if (to_kplane_st (plane_st)->layer_split) + slave_zpos++; kcrtc_st->max_slave_zorder = -max (plane_st->normalized_zpos, - kcrtc_st->max_slave_zorder); +max (slave_zpos, kcrtc_st->max_slave_zorder); + } } crtc_st->zpos_changed = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/518 spi: bcm63xx: Enable module autoloading
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit 709df70a20e990d262c473ad9899314039e8ec82 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- drivers/spi/spi-bcm63xx.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-bcm63xx.c +1 -0
@@ -482,6 +482,7 @@ static const struct of_device_id bcm63xx_spi_of_match[] = { { .compatible = "brcm,bcm6358-spi", .data = &bcm6358_spi_reg_offsets }, { }, }; +MODULE_DEVICE_TABLE (of, bcm63xx_spi_of_match);static int bcm63xx_spi_probe (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/518 x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 8fcc514809de41153b43ccbe1a0cdf7f72b78e7e ]
A Linux guest on Hyper-V gets the TSC frequency from a synthetic MSR, if available. In this case, set X86_FEATURE_TSC_KNOWN_FREQ so that Linux doesn't unnecessarily do refined TSC calibration when setting up the TSC clocksource.
With this change, a message such as this is no longer output during boot when the TSC is used as the clocksource:
[ 1.115141] tsc: Refined TSC clocksource calibration: 2918.408 MHz
Furthermore, the guest and host will have exactly the same view of the TSC frequency, which is important for features such as the TSC deadline timer that are emulated by the Hyper-V host.
Message-ID: <[email protected]>
--- arch/x86/kernel/cpu/mshyperv.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/cpu/mshyperv.c +1 -0
@@ -275,6 +275,7 @@ static void __init ms_hyperv_init_platform(void) ms_hyperv.misc_features & HV_FEATURE_FREQUENCY_MSRS_AVAILABLE) { x86_platform.calibrate_tsc = hv_get_tsc_khz; x86_platform.calibrate_cpu = hv_get_tsc_khz; +setup_force_cpu_cap (X86_FEATURE_TSC_KNOWN_FREQ ); }if (ms_hyperv.hints &HV_X64_ENLIGHTENED_VMCS_RECOMMENDED ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/518 ocfs2: add bounds checking to ocfs2_xattr_find_entry()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ferry Meng <[email protected]>
[ Upstream commit 9e3041fecdc8f78a5900c3aa51d3d756e73264d6 ]
Add a paranoia check to make sure it doesn't stray beyond valid memory region containing ocfs2 xattr entries when scanning for a match. It will prevent out-of-bound access in case of crafted images.
Stable-dep-of: af77c4fc1871 ("ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()")
--- fs/ocfs2/xattr.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
fs/ocfs2/xattr.c +8 -4
@@ -1068,7 +1068,7 @@ ssize_t ocfs2_listxattr(struct dentry *dentry,return i_ret + b_ret; } -static int ocfs2_xattr_find_entry (int name_index, +static int ocfs2_xattr_find_entry (struct inode *inode,int name_index,const char *name,struct ocfs2_xattr_search *xs) {
@@ -1082,6 +1082,10 @@ static int ocfs2_xattr_find_entry(int name_index, name_len =strlen (name); entry = xs->here;for (i =0 ; i <le16_to_cpu (xs->header->xh_count); i++) { +if ((void *)entry >= xs->end) { +ocfs2_error (inode->i_sb,"corrupted xattr entries" ); +return -EFSCORRUPTED ; + } cmp = name_index -ocfs2_xattr_get_type (entry);if (!cmp) cmp = name_len - entry->xe_name_len;
@@ -1172,7 +1176,7 @@ static int ocfs2_xattr_ibody_get(struct inode *inode, xs->base = (void *)xs->header; xs->here = xs->header->xh_entries; - ret =ocfs2_xattr_find_entry (name_index, name, xs); + ret =ocfs2_xattr_find_entry (inode, name_index, name, xs);if (ret)return ret; size =le64_to_cpu (xs->here->xe_value_size);
@@ -2704,7 +2708,7 @@ static int ocfs2_xattr_ibody_find(struct inode *inode,/* Find the named attribute. */ if (oi->ip_dyn_features &OCFS2_INLINE_XATTR_FL ) { - ret =ocfs2_xattr_find_entry (name_index, name, xs); + ret =ocfs2_xattr_find_entry (inode, name_index, name, xs);if (ret && ret != -ENODATA )return ret; xs->not_found = ret;
@@ -2839,7 +2843,7 @@ static int ocfs2_xattr_block_find(struct inode *inode, xs->end = (void *)(blk_bh->b_data) + blk_bh->b_size; xs->here = xs->header->xh_entries; - ret =ocfs2_xattr_find_entry (name_index, name, xs); + ret =ocfs2_xattr_find_entry (inode, name_index, name, xs); }else ret = ocfs2_xattr_index_block_find(inode, blk_bh, name_index,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/518 ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ferry Meng <[email protected]>
[ Upstream commit af77c4fc1871847b528d58b7fdafb4aa1f6a9262 ]
xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images.
--- fs/ocfs2/xattr.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
fs/ocfs2/xattr.c +10 -5
@@ -1074,7 +1074,7 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, {struct ocfs2_xattr_entry *entry;size_t name_len; -int i, cmp =1 ; +int i, name_offset, cmp =1 ;if (name ==NULL )return -EINVAL ;
@@ -1089,10 +1089,15 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, cmp = name_index -ocfs2_xattr_get_type (entry);if (!cmp) cmp = name_len - entry->xe_name_len; -if (!cmp) - cmp =memcmp (name, (xs->base + -le16_to_cpu (entry->xe_name_offset)), - name_len); +if (!cmp) { + name_offset =le16_to_cpu (entry->xe_name_offset); +if ((xs->base + name_offset + name_len) > xs->end) { +ocfs2_error (inode->i_sb, +"corrupted xattr entries" ); +return -EFSCORRUPTED ; + } + cmp =memcmp (name, (xs->base + name_offset), name_len); + }if (cmp ==0 )break ; entry +=1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/518 cgroup: Make operations on the cgroup root_list RCU safe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
[ Upstream commit d23b5c577715892c87533b13923306acc6243f93 ]
At present, when we perform operations on the cgroup root_list, we must hold the cgroup_mutex, which is a relatively heavyweight lock. In reality, we can make operations on this list RCU-safe, eliminating the need to hold the cgroup_mutex during traversal. Modifications to the list only occur in the cgroup root setup and destroy paths, which should be infrequent in a production environment. In contrast, traversal may occur frequently. Therefore, making it RCU-safe would be beneficial.
--- include/linux/cgroup-defs.h | 1 + kernel/cgroup/cgroup-internal.h | 3 ++- kernel/cgroup/cgroup.c | 14 +++++++------- 3 files changed, 10 insertions(+), 8 deletions(-)
include/linux/cgroup-defs.h +1 -0
@@ -512,6 +512,7 @@ struct cgroup_root {/* A list running through the active hierarchies */ struct list_head root_list; +struct rcu_head rcu;/* Hierarchy-specific flags */ unsigned int flags;
kernel/cgroup/cgroup-internal.h +2 -1
@@ -172,7 +172,8 @@ extern struct list_head cgroup_roots;/* iterate across the hierarchies */ #define for_each_root (root) \ - list_for_each_entry((root), &cgroup_roots, root_list) + list_for_each_entry_rcu((root), &cgroup_roots, root_list, \ + lockdep_is_held(&cgroup_mutex))/** * for_each_subsys - iterate all enabled cgroup subsystems
kernel/cgroup/cgroup.c +7 -7
@@ -1304,7 +1304,7 @@ static void cgroup_exit_root_id(struct cgroup_root *root)void cgroup_free_root (struct cgroup_root *root) { -kfree (root); +kfree_rcu (root, rcu); }static void cgroup_destroy_root (struct cgroup_root *root)
@@ -1337,7 +1337,7 @@ static void cgroup_destroy_root(struct cgroup_root *root)spin_unlock_irq (&css_set_lock);if (!list_empty (&root->root_list)) { -list_del (&root->root_list); +list_del_rcu (&root->root_list); cgroup_root_count--; }
@@ -1382,7 +1382,6 @@ current_cgns_cgroup_from_root(struct cgroup_root *root) }rcu_read_unlock (); -BUG_ON (!res);return res; }
@@ -1392,7 +1391,6 @@ static struct cgroup *cset_cgroup_from_root(struct css_set *cset, {struct cgroup *res =NULL ; -lockdep_assert_held (&cgroup_mutex);lockdep_assert_held (&css_set_lock);if (cset == &init_css_set) {
@@ -1418,7 +1416,9 @@ static struct cgroup *cset_cgroup_from_root(struct css_set *cset,/* * Return the cgroup for "task" from the given hierarchy. Must be -* called with cgroup_mutex and css_set_lock held. +* called with css_set_lock held to prevent task's groups from being modified. +* Must be called with either cgroup_mutex or rcu read lock to prevent the +* cgroup root from being destroyed. */ struct cgroup *task_cgroup_from_root (struct task_struct *task,struct cgroup_root *root)
@@ -1950,7 +1950,7 @@ void init_cgroup_root(struct cgroup_fs_context *ctx)struct cgroup_root *root = ctx->root;struct cgroup *cgrp = &root->cgrp; -INIT_LIST_HEAD (&root->root_list); +INIT_LIST_HEAD_RCU (&root->root_list);atomic_set (&root->nr_cgrps,1 ); cgrp->root = root;init_cgroup_housekeeping (cgrp);
@@ -2028,7 +2028,7 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)* care of subsystems' refcounts, which are explicitly dropped in * the failure exit path. */ -list_add (&root->root_list, &cgroup_roots); +list_add_rcu (&root->root_list, &cgroup_roots); cgroup_root_count++;/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/518 netfilter: nft_set_pipapo: walk over current view on netlink dump
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 29b359cf6d95fd60730533f7f10464e95bd17c73 upstream.
The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it to infer what view of the datastructure is to be used. Add notation to specify if user wants to read/update the set.
Based on patch from Florian Westphal.
--- include/net/netfilter/nf_tables.h | 13 +++++++++++++ net/netfilter/nf_tables_api.c | 5 +++++ net/netfilter/nft_set_pipapo.c | 5 +++-- 3 files changed, 21 insertions(+), 2 deletions(-)
include/net/netfilter/nf_tables.h +13 -0
@@ -262,9 +262,22 @@ struct nft_set_elem {void *priv; }; +/** +* enum nft_iter_type - nftables set iterator type +* +* @NFT_ITER_READ: read-only iteration over set elements +* @NFT_ITER_UPDATE: iteration under mutex to update set element state +*/ +enum nft_iter_type { +NFT_ITER_UNSPEC , +NFT_ITER_READ , +NFT_ITER_UPDATE , +}; +struct nft_set ;struct nft_set_iter {u8 genmask; +enum nft_iter_type type:8 ;unsigned int count;unsigned int skip;int err;
net/netfilter/nf_tables_api.c +5 -0
@@ -594,6 +594,7 @@ static void nft_map_deactivate(const str {struct nft_set_iter iter = { .genmask =nft_genmask_next (ctx->net), + .type =NFT_ITER_UPDATE , .fn = nft_mapelem_deactivate, };
@@ -4777,6 +4778,7 @@ int nf_tables_bind_set(const struct nft_ } iter.genmask =nft_genmask_next (ctx->net); + iter.type =NFT_ITER_UPDATE ; iter.skip =0 ; iter.count =0 ; iter.err =0 ;
@@ -4830,6 +4832,7 @@ static void nft_map_activate(const struc {struct nft_set_iter iter = { .genmask =nft_genmask_next (ctx->net), + .type =NFT_ITER_UPDATE , .fn = nft_mapelem_activate, };
@@ -5142,6 +5145,7 @@ static int nf_tables_dump_set(struct sk_ args.cb = cb; args.skb = skb; args.iter.genmask =nft_genmask_cur (net); + args.iter.type =NFT_ITER_READ ; args.iter.skip = cb->args[0 ]; args.iter.count =0 ; args.iter.err =0 ;
@@ -6065,6 +6069,7 @@ static int nf_tables_delsetelem(struct nif (nla[NFTA_SET_ELEM_LIST_ELEMENTS ] ==NULL ) {struct nft_set_iter iter = { .genmask = genmask, + .type =NFT_ITER_UPDATE , .fn = nft_flush_set, }; set->ops->walk (&ctx, set, &iter);
net/netfilter/nft_set_pipapo.c +3 -2
@@ -2026,13 +2026,14 @@ static void nft_pipapo_walk(const struct struct nft_set_iter *iter) {struct nft_pipapo *priv =nft_set_priv (set); -struct net *net =read_pnet (&set->net);struct nft_pipapo_match *m;struct nft_pipapo_field *f;int i, r; +WARN_ON_ONCE (iter->type ==NFT_ITER_UNSPEC ); +rcu_read_lock (); -if (iter->genmask ==nft_genmask_cur (net)) +if (iter->type ==NFT_ITER_READ ) m =rcu_dereference (priv->match);else m = priv->clone;
Greg Kroah-Hartman
maintainerPATCH 46/518 netfilter: nf_tables: missing iterator type in lookup walk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit efefd4f00c967d00ad7abe092554ffbb70c1a793 upstream.
Add missing decorator type to lookup expression and tighten WARN_ON_ONCE check in pipapo to spot earlier that this is unset.
--- net/netfilter/nft_lookup.c | 1 + net/netfilter/nft_set_pipapo.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nft_lookup.c +1 -0
@@ -207,6 +207,7 @@ static int nft_lookup_validate(const strreturn 0 ; iter.genmask =nft_genmask_next (ctx->net); + iter.type =NFT_ITER_UPDATE ; iter.skip =0 ; iter.count =0 ; iter.err =0 ;
net/netfilter/nft_set_pipapo.c +2 -1
@@ -2030,7 +2030,8 @@ static void nft_pipapo_walk(const structstruct nft_pipapo_field *f;int i, r; -WARN_ON_ONCE (iter->type ==NFT_ITER_UNSPEC ); +WARN_ON_ONCE (iter->type !=NFT_ITER_READ && + iter->type !=NFT_ITER_UPDATE );rcu_read_lock ();if (iter->type ==NFT_ITER_READ )
Greg Kroah-Hartman
maintainerPATCH 47/518 gpio: prevent potential speculation leaks in gpio_device_get_desc()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hagar Hemdan <[email protected]>
commit d795848ecce24a75dfd46481aee066ae6fe39775 upstream.
Userspace may trigger a speculative read of an address outside the gpio descriptor array.
Users can do that by calling gpio_ioctl() with an offset out of range. Offset is copied from user and then used as an array index to get the gpio descriptor without sanitization in gpio_device_get_desc().
This change ensures that the offset is sanitized by using array_index_nospec() to mitigate any possibility of speculative information leaks.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
--- drivers/gpio/gpiolib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpio/gpiolib.c +2 -1
@@ -4,6 +4,7 @@#include <linux/module.h> #include <linux/interrupt.h> #include <linux/irq.h> +#include <linux/nospec.h> #include <linux/spinlock.h> #include <linux/list.h> #include <linux/device.h>
@@ -143,7 +144,7 @@ struct gpio_desc *gpiochip_get_desc(struif (hwnum >= gdev->ngpio)return ERR_PTR (-EINVAL ); -return &gdev->descs[hwnum]; +return &gdev->descs[array_index_nospec (hwnum, gdev->ngpio)]; }EXPORT_SYMBOL_GPL (gpiochip_get_desc);
Greg Kroah-Hartman
maintainerPATCH 48/518 mptcp: export lookup_anno_list_by_saddr
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
commit d88c476f4a7dd69a2588470f6c4f8b663efa16c6 upstream.
This patch exported the static function lookup_anno_list_by_saddr, and renamed it to mptcp_lookup_anno_list_by_saddr.
Stable-dep-of: b4cd80b03389 ("mptcp: pm: Fix uaf in __timer_delete_sync")
--- net/mptcp/pm_netlink.c | 10 +++++----- net/mptcp/protocol.h | 3 +++ 2 files changed, 8 insertions(+), 5 deletions(-)
net/mptcp/pm_netlink.c +5 -5
@@ -194,9 +194,9 @@ static void check_work_pending(struct mpWRITE_ONCE (msk->pm.work_pending, false); } -static struct mptcp_pm_add_entry * -lookup_anno_list_by_saddr (struct mptcp_sock *msk, -struct mptcp_addr_info *addr) +struct mptcp_pm_add_entry * +mptcp_lookup_anno_list_by_saddr (struct mptcp_sock *msk, +struct mptcp_addr_info *addr) {struct mptcp_pm_add_entry *entry;
@@ -255,7 +255,7 @@ mptcp_pm_del_add_timer(struct mptcp_sockstruct sock *sk = (struct sock *)msk;spin_lock_bh (&msk->pm.lock); - entry =lookup_anno_list_by_saddr (msk, addr); + entry =mptcp_lookup_anno_list_by_saddr (msk, addr);if (entry) entry->retrans_times =ADD_ADDR_RETRANS_MAX ;spin_unlock_bh (&msk->pm.lock);
@@ -272,7 +272,7 @@ static bool mptcp_pm_alloc_anno_list(strstruct mptcp_pm_add_entry *add_entry =NULL ;struct sock *sk = (struct sock *)msk; -if (lookup_anno_list_by_saddr (msk, &entry->addr)) +if (mptcp_lookup_anno_list_by_saddr (msk, &entry->addr))return false; add_entry =kmalloc (sizeof (*add_entry),GFP_ATOMIC );
net/mptcp/protocol.h +3 -0
@@ -451,6 +451,9 @@ void mptcp_pm_free_anno_list(struct mptcstruct mptcp_pm_add_entry *mptcp_pm_del_add_timer (struct mptcp_sock *msk,struct mptcp_addr_info *addr); +struct mptcp_pm_add_entry * +mptcp_lookup_anno_list_by_saddr (struct mptcp_sock *msk, +struct mptcp_addr_info *addr); int mptcp_pm_announce_addr(struct mptcp_sock *msk, const struct mptcp_addr_info *addr,
Greg Kroah-Hartman
maintainerPATCH 49/518 mptcp: validate id when stopping the ADD_ADDR retransmit timer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <[email protected]>
commit d58300c3185b78ab910092488126b97f0abe3ae2 upstream.
when Linux receives an echo-ed ADD_ADDR, it checks the IP address against the list of "announced" addresses. In case of a positive match, the timer that handles retransmissions is stopped regardless of the 'Address Id' in the received packet: this behaviour does not comply with RFC8684 3.4.1.
Fix it by validating the 'Address Id' in received echo-ed ADD_ADDRs. Tested using packetdrill, with the following captured output:
unpatched kernel:
Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0xfd2e62517888fe29,mptcp dss ack 3007449509], length 0 In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 1 1.2.3.4,mptcp dss ack 3013740213], length 0 Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0xfd2e62517888fe29,mptcp dss ack 3007449509], length 0 In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 90 198.51.100.2,mptcp dss ack 3013740213], length 0
^^^ retransmission is stopped here, but 'Address Id' is 90
patched kernel:
Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0x1cf372d59e05f4b8,mptcp dss ack 3007449509], length 0 In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 1 1.2.3.4,mptcp dss ack 1672384568], length 0 Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0x1cf372d59e05f4b8,mptcp dss ack 3007449509], length 0 In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 90 198.51.100.2,mptcp dss ack 1672384568], length 0 Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0x1cf372d59e05f4b8,mptcp dss ack 3007449509], length 0 In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 1 198.51.100.2,mptcp dss ack 1672384568], length 0
^^^ retransmission is stopped here, only when both 'Address Id' and 'IP Address' match
Stable-dep-of: b4cd80b03389 ("mptcp: pm: Fix uaf in __timer_delete_sync") [ Conflicts in options.c, because some features are missing in this
version, e.g. commit 557963c383e8 ("mptcp: move to next addr when subflow creation fail") and commit f7dafee18538 ("mptcp: use mptcp_addr_info in mptcp_options_received"). ]
--- net/mptcp/options.c | 2 +- net/mptcp/pm_netlink.c | 8 ++++---- net/mptcp/protocol.h | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-)
net/mptcp/options.c +1 -1
@@ -915,7 +915,7 @@ void mptcp_incoming_options(struct sockmptcp_pm_add_addr_received (msk, &addr);MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_ADDADDR ); }else { -mptcp_pm_del_add_timer (msk, &addr); +mptcp_pm_del_add_timer (msk, &addr, true);MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_ECHOADD ); } mp_opt.add_addr =0 ;
net/mptcp/pm_netlink.c +4 -4
@@ -249,18 +249,18 @@ out:struct mptcp_pm_add_entry *mptcp_pm_del_add_timer (struct mptcp_sock *msk, -struct mptcp_addr_info *addr) +struct mptcp_addr_info *addr,bool check_id) {struct mptcp_pm_add_entry *entry;struct sock *sk = (struct sock *)msk;spin_lock_bh (&msk->pm.lock); entry =mptcp_lookup_anno_list_by_saddr (msk, addr); -if (entry) +if (entry && (!check_id || entry->addr.id == addr->id)) entry->retrans_times =ADD_ADDR_RETRANS_MAX ;spin_unlock_bh (&msk->pm.lock); -if (entry) +if (entry && (!check_id || entry->addr.id == addr->id))sk_stop_timer_sync (sk, &entry->add_timer);return entry;
@@ -764,7 +764,7 @@ static bool remove_anno_list_by_saddr(st {struct mptcp_pm_add_entry *entry; - entry =mptcp_pm_del_add_timer (msk, addr); + entry =mptcp_pm_del_add_timer (msk, addr, false);if (entry) {list_del (&entry->list);kfree (entry);
net/mptcp/protocol.h +1 -1
@@ -450,7 +450,7 @@ void mptcp_pm_rm_addr_received(struct mpvoid mptcp_pm_free_anno_list (struct mptcp_sock *msk);struct mptcp_pm_add_entry *mptcp_pm_del_add_timer (struct mptcp_sock *msk, -struct mptcp_addr_info *addr); +struct mptcp_addr_info *addr,bool check_id);struct mptcp_pm_add_entry *mptcp_lookup_anno_list_by_saddr (struct mptcp_sock *msk,struct mptcp_addr_info *addr);
Greg Kroah-Hartman
maintainerPATCH 50/518 mptcp: pm: Fix uaf in __timer_delete_sync
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
There are two paths to access mptcp_pm_del_add_timer, result in a race condition:
CPU1 CPU2
==== ====
net_rx_action
napi_poll netlink_sendmsg
__napi_poll netlink_unicast
process_backlog netlink_unicast_kernel
__netif_receive_skb genl_rcv
__netif_receive_skb_one_core netlink_rcv_skb
NF_HOOK genl_rcv_msg
ip_local_deliver_finish genl_family_rcv_msg
ip_protocol_deliver_rcu genl_family_rcv_msg_doit
tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit
tcp_v4_do_rcv mptcp_nl_remove_addrs_list
tcp_rcv_established mptcp_pm_remove_addrs_and_subflows
tcp_data_queue remove_anno_list_by_saddr
mptcp_incoming_options mptcp_pm_del_add_timer
mptcp_pm_del_add_timer kfree(entry)In remove_anno_list_by_saddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).
Keeping a reference to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer".
Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock, do not directly access any members of the entry outside the pm lock, which can avoid similar "entry->x" uaf.
--- net/mptcp/pm_netlink.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/mptcp/pm_netlink.c +9 -4
@@ -253,15 +253,21 @@ mptcp_pm_del_add_timer(struct mptcp_sock {struct mptcp_pm_add_entry *entry;struct sock *sk = (struct sock *)msk; +struct timer_list *add_timer =NULL ;spin_lock_bh (&msk->pm.lock); entry =mptcp_lookup_anno_list_by_saddr (msk, addr); -if (entry && (!check_id || entry->addr.id == addr->id)) +if (entry && (!check_id || entry->addr.id == addr->id)) { entry->retrans_times =ADD_ADDR_RETRANS_MAX ; + add_timer = &entry->add_timer; + } +if (!check_id && entry) +list_del (&entry->list);spin_unlock_bh (&msk->pm.lock); -if (entry && (!check_id || entry->addr.id == addr->id)) -sk_stop_timer_sync (sk, &entry->add_timer); +/* no lock, because sk_stop_timer_sync() is calling del_timer_sync() */ +if (add_timer) +sk_stop_timer_sync (sk, add_timer);return entry; }
@@ -766,7 +772,6 @@ static bool remove_anno_list_by_saddr(st entry =mptcp_pm_del_add_timer (msk, addr, false);if (entry) { -list_del (&entry->list);kfree (entry);return true; }
Greg Kroah-Hartman
maintainerPATCH 51/518 inet: inet_defrag: prevent sk release while still in use
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 18685451fc4e546fc0e718580d32df3c0e5c8272 upstream.
ip_local_out() and other functions can pass skb->sk as function argument.
If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released.
This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.
Eric Dumazet made an initial analysis of this bug. Quoting Eric:
Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing.
A relevant old patch about the issue was :
8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")
[..]
net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one.
If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly.
We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used.
Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this:
If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow.
This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered.
This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue.
In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine.
In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.
--- include/linux/skbuff.h | 5 -- net/core/sock_destructor.h | 12 +++++ net/ipv4/inet_fragment.c | 70 ++++++++++++++++++++++++++------ net/ipv4/ip_fragment.c | 2 net/ipv6/netfilter/nf_conntrack_reasm.c | 2 5 files changed, 72 insertions(+), 19 deletions(-) create mode 100644 net/core/sock_destructor.h
include/linux/skbuff.h +1 -4
@@ -733,10 +733,7 @@ struct sk_buff {struct list_head list; }; -union { -struct sock *sk; -int ip_defrag_offset; - }; +struct sock *sk;union {ktime_t tstamp;
net/core/sock_destructor.h new file +12 -0
@@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +#ifndef _NET_CORE_SOCK_DESTRUCTOR_H +#define _NET_CORE_SOCK_DESTRUCTOR_H +#include <net/tcp.h> + +static inline bool is_skb_wmem (const struct sk_buff *skb) +{ +return skb->destructor == sock_wfree || + skb->destructor == __sock_wfree || + (IS_ENABLED (CONFIG_INET ) && skb->destructor == tcp_wfree); +} +#endif
net/ipv4/inet_fragment.c +57 -13
158 lines not on this page · raw message
net/ipv4/ip_fragment.c +1 -1
@@ -377,6 +377,7 @@ static int ip_frag_queue(struct ipq *qp, }skb_dst_drop (skb); +skb_orphan (skb);return -EINPROGRESS ; insert_error:
@@ -479,7 +480,6 @@ int ip_defrag(struct net *net, struct skstruct ipq *qp;__IP_INC_STATS (net,IPSTATS_MIB_REASMREQDS ); -skb_orphan (skb);/* Lookup (or create) queue header */ qp =ip_find (net,ip_hdr (skb), user, vif);
net/ipv6/netfilter/nf_conntrack_reasm.c +1 -1
@@ -296,6 +296,7 @@ static int nf_ct_frag6_queue(struct frag }skb_dst_drop (skb); +skb_orphan (skb);return -EINPROGRESS ; insert_error:
@@ -471,7 +472,6 @@ int nf_ct_frag6_gather(struct net *net, hdr =ipv6_hdr (skb); fhdr = (struct frag_hdr *)skb_transport_header (skb); -skb_orphan (skb); fq =fq_find (net, fhdr->identification, user, hdr, skb->dev ? skb->dev->ifindex :0 );if (fq ==NULL ) {
Greg Kroah-Hartman
maintainerPATCH 52/518 x86/ibt,ftrace: Search for __fentry__ location
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit aebfd12521d9c7d0b502cf6d06314cfbcdccfe3b upstream.
Currently a lot of ftrace code assumes __fentry__ is at sym+0. However with Intel IBT enabled the first instruction of a function will most likely be ENDBR.
Change ftrace_location() to not only return the __fentry__ location when called for the __fentry__ location, but also when called for the sym+0 location.
Then audit/update all callsites of this function to consistently use these new semantics.
Stable-dep-of: e60b613df8b6 ("ftrace: Fix possible use-after-free issue in ftrace_location()")
--- arch/x86/kernel/kprobes/core.c | 11 +-------- kernel/bpf/trampoline.c | 20 +++-------------- kernel/kprobes.c | 8 +----- kernel/trace/ftrace.c | 48 ++++++++++++++++++++++++++++++++++------- 4 files changed, 48 insertions(+), 39 deletions(-)
arch/x86/kernel/kprobes/core.c +2 -9
@@ -194,17 +194,10 @@ static unsigned long __recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr) {struct kprobe *kp; -unsigned long faddr; +bool faddr; kp =get_kprobe ((void *)addr); - faddr =ftrace_location (addr); -/* -* Addresses inside the ftrace location are refused by -* arch_check_ftrace_location(). Something went terribly wrong -* if such an address is checked here. -*/ -if (WARN_ON (faddr && faddr != addr)) -return 0UL ; + faddr =ftrace_location (addr) == addr;/* * Use the current code if it is not modified by Kprobe * and it cannot be modified by ftrace.
kernel/bpf/trampoline.c +4 -16
@@ -87,18 +87,6 @@ out:return tr; } -static int is_ftrace_location (void *ip) -{ -long addr; - - addr =ftrace_location ((long )ip); -if (!addr) -return 0 ; -if (WARN_ON_ONCE (addr != (long )ip)) -return -EFAULT ; -return 1 ; -} -static int unregister_fentry (struct bpf_trampoline *tr,void *old_addr) {void *ip = tr->func.addr;
@@ -127,12 +115,12 @@ static int modify_fentry(struct bpf_tramstatic int register_fentry (struct bpf_trampoline *tr,void *new_addr) {void *ip = tr->func.addr; +unsigned long faddr;int ret; - ret =is_ftrace_location (ip); -if (ret <0 ) -return ret; - tr->func.ftrace_managed = ret; + faddr =ftrace_location ((unsigned long )ip); +if (faddr) + tr->func.ftrace_managed = true;if (tr->func.ftrace_managed) ret =register_ftrace_direct ((long )ip, (long )new_addr);
kernel/kprobes.c +2 -6
@@ -1609,14 +1609,10 @@ static inline int check_kprobe_rereg(strint __weak arch_check_ftrace_location (struct kprobe *p) { -unsigned long ftrace_addr; +unsigned long addr = (unsigned long )p->addr; - ftrace_addr =ftrace_location ((unsigned long )p->addr); -if (ftrace_addr) { +if (ftrace_location (addr) == addr) {#ifdef CONFIG_KPROBES_ON_FTRACE -/* Given address is not on the instruction boundary */ -if ((unsigned long )p->addr != ftrace_addr) -return -EILSEQ ; p->flags |=KPROBE_FLAG_FTRACE ;#else /* !CONFIG_KPROBES_ON_FTRACE */ return -EINVAL ;
kernel/trace/ftrace.c +40 -8
87 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 53/518 ftrace: Fix possible use-after-free issue in ftrace_location()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
commit e60b613df8b6253def41215402f72986fee3fc8d upstream.
KASAN reports a bug:
BUG: KASAN: use-after-free in ftrace_location+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: G W 6.9.0-rc2+ [...] Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcf/0x610 kasan_report+0xb5/0xe0 ftrace_location+0x90/0x120 register_kprobe+0x14b/0xa40 kprobe_init+0x2d/0xff0 [kprobe_example] do_one_initcall+0x8f/0x2d0 do_init_module+0x13a/0x3c0 load_module+0x3082/0x33d0 init_module_from_file+0xd2/0x130 __x64_sys_finit_module+0x306/0x440 do_syscall_64+0x68/0x140 entry_SYSCALL_64_after_hwframe+0x71/0x79
The root cause is that, in lookup_rec(), ftrace record of some address is being searched in ftrace pages of some module, but those ftrace pages at the same time is being freed in ftrace_release_mod() as the corresponding module is being deleted:
CPU1 | CPU2
register_kprobes() { | delete_module() {
check_kprobe_address_safe() { |
arch_check_ftrace_location() { |
ftrace_location() { |
lookup_rec() // USE! | ftrace_release_mod() // Free!To fix this issue:
1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();
2. Use ftrace_location_range() instead of lookup_rec() in
ftrace_location();
3. Call synchronize_rcu() before freeing any ftrace pages both in ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().
--- kernel/trace/ftrace.c | 39 +++++++++++++++++++++++---------------- 1 file changed, 23 insertions(+), 16 deletions(-)
kernel/trace/ftrace.c +23 -16
@@ -1566,12 +1566,15 @@ static struct dyn_ftrace *lookup_rec(unsunsigned long ftrace_location_range (unsigned long start,unsigned long end) {struct dyn_ftrace *rec; +unsigned long ip =0 ; +rcu_read_lock (); rec =lookup_rec (start, end);if (rec) -return rec->ip; + ip = rec->ip; +rcu_read_unlock (); -return 0 ; +return ip; }/**
@@ -1584,25 +1587,22 @@ unsigned long ftrace_location_range(unsi*/ unsigned long ftrace_location (unsigned long ip) { -struct dyn_ftrace *rec; +unsigned long loc;unsigned long offset;unsigned long size; - rec =lookup_rec (ip, ip); -if (!rec) { + loc =ftrace_location_range (ip, ip); +if (!loc) {if (!kallsyms_lookup_size_offset (ip, &size, &offset)) goto out;/* map sym+0 to __fentry__ */ if (!offset) - rec =lookup_rec (ip, ip + size -1 ); + loc =ftrace_location_range (ip, ip + size -1 ); } -if (rec) -return rec->ip; - out: -return 0 ; +return loc; }/**
@@ -6331,6 +6331,8 @@ static int ftrace_process_locs(struct mo/* We should have used all pages unless we skipped some */ if (pg_unuse) {WARN_ON (!skipped); +/* Need to synchronize with ftrace_location_range() */ +synchronize_rcu ();ftrace_free_pages (pg_unuse); }return ret;
@@ -6513,6 +6515,9 @@ void ftrace_release_mod(struct module *m out_unlock:mutex_unlock (&ftrace_lock); +/* Need to synchronize with ftrace_location_range() */ +if (tmp_page) +synchronize_rcu ();for (pg = tmp_page; pg; pg = tmp_page) {/* Needs to be called outside of ftrace_lock */
@@ -6835,6 +6840,7 @@ void ftrace_free_mem(struct module *mod,unsigned long start = (unsigned long )(start_ptr);unsigned long end = (unsigned long )(end_ptr);struct ftrace_page **last_pg = &ftrace_pages_start; +struct ftrace_page *tmp_page =NULL ;struct ftrace_page *pg;struct dyn_ftrace *rec;struct dyn_ftrace key;
@@ -6878,12 +6884,8 @@ void ftrace_free_mem(struct module *mod, ftrace_update_tot_cnt--;if (!pg->index) { *last_pg = pg->next; -if (pg->records) { -free_pages ((unsigned long )pg->records, pg->order); - ftrace_number_of_pages -=1 << pg->order; - } - ftrace_number_of_groups--; -kfree (pg); + pg->next = tmp_page; + tmp_page = pg; pg = container_of(last_pg, struct ftrace_page, next);if (!(*last_pg)) ftrace_pages = pg;
@@ -6900,6 +6902,11 @@ void ftrace_free_mem(struct module *mod,clear_func_from_hashes (func);kfree (func); } +/* Need to synchronize with ftrace_location_range() */ +if (tmp_page) { +synchronize_rcu (); +ftrace_free_pages (tmp_page); + } }void __init ftrace_free_init_mem (void )
Greg Kroah-Hartman
maintainerPATCH 54/518 gpiolib: cdev: Ignore reconfiguration without direction
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kent Gibson <[email protected]>
commit b440396387418fe2feaacd41ca16080e7a8bc9ad upstream.
linereq_set_config() behaves badly when direction is not set. The configuration validation is borrowed from linereq_create(), where, to verify the intent of the user, the direction must be set to in order to effect a change to the electrical configuration of a line. But, when applied to reconfiguration, that validation does not allow for the unset direction case, making it possible to clear flags set previously without specifying the line direction.
Adding to the inconsistency, those changes are not immediately applied by linereq_set_config(), but will take effect when the line value is next get or set.
For example, by requesting a configuration with no flags set, an output line with GPIO_V2_LINE_FLAG_ACTIVE_LOW and GPIO_V2_LINE_FLAG_OPEN_DRAIN set could have those flags cleared, inverting the sense of the line and changing the line drive to push-pull on the next line value set.
Skip the reconfiguration of lines for which the direction is not set, and only reconfigure the lines for which direction is set.
--- drivers/gpio/gpiolib-cdev.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpio/gpiolib-cdev.c +8 -5
@@ -1110,15 +1110,18 @@ static long linereq_set_config_unlocked(for (i =0 ; i < lr->num_lines; i++) { desc = lr->lines[i].desc; flags =gpio_v2_line_config_flags (lc, i); +/* +* Lines not explicitly reconfigured as input or output +* are left unchanged. +*/ +if (!(flags &GPIO_V2_LINE_DIRECTION_FLAGS )) +continue ; + polarity_change = (!!test_bit (FLAG_ACTIVE_LOW , &desc->flags) != ((flags &GPIO_V2_LINE_FLAG_ACTIVE_LOW ) !=0 ));gpio_v2_line_config_flags_to_desc_flags (flags, &desc->flags); -/* -* Lines have to be requested explicitly for input -* or output, else the line will be treated "as is". -*/ if (flags &GPIO_V2_LINE_FLAG_OUTPUT ) {int val =gpio_v2_line_config_output_value (lc, i);
@@ -1126,7 +1129,7 @@ static long linereq_set_config_unlocked( ret =gpiod_direction_output (desc, val);if (ret)return ret; - }else if (flags &GPIO_V2_LINE_FLAG_INPUT ) { + }else { ret =gpiod_direction_input (desc);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 55/518 cgroup: Move rcu_head up near the top of cgroup_root
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
commit a7fb0423c201ba12815877a0b5a68a6a1710b23a upstream.
Commit d23b5c577715 ("cgroup: Make operations on the cgroup root_list RCU safe") adds a new rcu_head to the cgroup_root structure and kvfree_rcu() for freeing the cgroup_root.
The current implementation of kvfree_rcu(), however, has the limitation that the offset of the rcu_head structure within the larger data structure must be less than 4096 or the compilation will fail. See the macro definition of __is_kvfree_rcu_offset() in include/linux/rcupdate.h for more information.
By putting rcu_head below the large cgroup structure, any change to the cgroup structure that makes it larger run the risk of causing build failure under certain configurations. Commit 77070eeb8821 ("cgroup:
Avoid false cacheline sharing of read mostly rstat_cpu") happens to be the last straw that breaks it. Fix this problem by moving the rcu_head structure up before the cgroup structure.
--- include/linux/cgroup-defs.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/linux/cgroup-defs.h +4 -4
@@ -501,6 +501,10 @@ struct cgroup_root {/* Unique id for this hierarchy. */ int hierarchy_id; +/* A list running through the active hierarchies */ +struct list_head root_list; +struct rcu_head rcu;/* Must be near the top */ +/* The root cgroup. Root is destroyed on its release. */ struct cgroup cgrp;
@@ -510,10 +514,6 @@ struct cgroup_root {/* Number of cgroups in the hierarchy, used only for /proc/cgroups */ atomic_t nr_cgrps; -/* A list running through the active hierarchies */ -struct list_head root_list; -struct rcu_head rcu; -/* Hierarchy-specific flags */ unsigned int flags;
Greg Kroah-Hartman
maintainerPATCH 56/518 usb: dwc3: Fix a typo in field name
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincenzo Palazzo <[email protected]>
commit 02c1820345e795148e6b497ef85090915401698e upstream.
Fix a typo inside the dwc3 struct docs.
--- drivers/usb/dwc3/core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/core.h +1 -1
@@ -1053,7 +1053,7 @@ struct dwc3_scratchpad_array {* change quirk. * @dis_tx_ipgap_linecheck_quirk: set if we disable u2mac linestate * check during HS transmit. -* @resume-hs-terminations: Set if we enable quirk for fixing improper crc +* @resume_hs_terminations: Set if we enable quirk for fixing improper crc * generation after resume from suspend. * @parkmode_disable_ss_quirk: set if we need to disable all SuperSpeed * instances in park mode.
Greg Kroah-Hartman
maintainerPATCH 57/518 USB: serial: pl2303: add device id for Macrosilicon MS3020
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junhao Xie <[email protected]>
commit 7d47d22444bb7dc1b6d768904a22070ef35e1fc0 upstream.
Add the device id for the Macrosilicon MS3020 which is a PL2303HXN based device.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 4 ++++ 2 files changed, 5 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -118,6 +118,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) }, + { USB_DEVICE(MACROSILICON_VENDOR_ID, MACROSILICON_MS3020_PRODUCT_ID) }, { } /* Terminating entry */ };
drivers/usb/serial/pl2303.h +4 -0
@@ -171,3 +171,7 @@/* Allied Telesis VT-Kit3 */ #define AT_VENDOR_ID 0x0caa#define AT_VTKIT3_PRODUCT_ID 0x3001 + +/* Macrosilicon MS3020 */ +#define MACROSILICON_VENDOR_ID 0x345f +#define MACROSILICON_MS3020_PRODUCT_ID 0x3020
Greg Kroah-Hartman
maintainerPATCH 58/518 USB: usbtmc: prevent kernel-usb-infoleak
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad upstream.
The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields.
--- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/class/usbtmc.c +1 -1
@@ -724,7 +724,7 @@ static struct urb *usbtmc_create_urb(voiif (!urb)return NULL ; - dmabuf =kmalloc (bufsize,GFP_KERNEL ); + dmabuf =kzalloc (bufsize,GFP_KERNEL );if (!dmabuf) {usb_free_urb (urb);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 59/518 wifi: rtw88: always wait for both firmware loading attempts
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d ]
In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.
--- drivers/net/wireless/realtek/rtw88/main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/realtek/rtw88/main.c +4 -3
@@ -1007,20 +1007,21 @@ static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev) {struct rtw_chip_info *chip = rtwdev->chip;struct rtw_fw_state *fw; +int ret =0 ; fw = &rtwdev->fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ;if (chip->wow_fw_name) { fw = &rtwdev->wow_fw;wait_for_completion (&fw->completion);if (!fw->firmware) -return -EINVAL ; + ret = -EINVAL ; } -return 0 ; +return ret; }static int rtw_power_on (struct rtw_dev *rtwdev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/518 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 07442c46abad1d50ac82af5e0f9c5de2732c4592 ]
In tps68470_pmic_opregion_probe() pointer 'dev' is compared to NULL which is useless.
Fix this issue by removing unneeded check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/pmic/tps68470_pmic.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/acpi/pmic/tps68470_pmic.c +2 -4
@@ -376,10 +376,8 @@ static int tps68470_pmic_opregion_probe(struct platform_device *pdev)struct tps68470_pmic_opregion *opregion;acpi_status status; -if (!dev || !tps68470_regmap) { -dev_warn (dev,"dev or regmap is NULL\n" ); -return -EINVAL ; - } +if (!tps68470_regmap) +return dev_err_probe (dev, -EINVAL ,"regmap is missing\n" );if (!handle) {dev_warn (dev,"acpi handle is NULL\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/518 fs: explicitly unregister per-superblock BDIs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 0b3ea0926afb8dde70cfab00316ae0a70b93a7cc ]
Add a new SB_I_ flag to mark superblocks that have an ephemeral bdi associated with them, and unregister it when the superblock is shut down.
Stable-dep-of: 4bcda1eaf184 ("mount: handle OOM on mnt_warn_timestamp_expiry")
--- fs/super.c | 3 +++ include/linux/fs.h | 1 + 2 files changed, 4 insertions(+)
fs/super.c +3 -0
@@ -476,6 +476,8 @@ void generic_shutdown_super(struct super_block *sb)spin_unlock (&sb_lock);up_write (&sb->s_umount);if (sb->s_bdi != &noop_backing_dev_info) { +if (sb->s_iflags &SB_I_PERSB_BDI ) +bdi_unregister (sb->s_bdi);bdi_put (sb->s_bdi); sb->s_bdi = &noop_backing_dev_info; }
@@ -1634,6 +1636,7 @@ int super_setup_bdi_name(struct super_block *sb, char *fmt, ...) }WARN_ON (sb->s_bdi != &noop_backing_dev_info); sb->s_bdi = bdi; + sb->s_iflags |=SB_I_PERSB_BDI ;return 0 ; }
include/linux/fs.h +1 -0
@@ -1427,6 +1427,7 @@ extern int send_sigurg(struct fown_struct *fown);#define SB_I_UNTRUSTED_MOUNTER 0x00000040#define SB_I_SKIP_SYNC 0x00000100/* Skip superblock at global sync */ +#define SB_I_PERSB_BDI 0x00000200/* has a per-sb bdi */ /* Possible states of 'frozen' field */ enum {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/518 mount: warn only once about timestamp range expiration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <[email protected]>
[ Upstream commit a128b054ce029554a4a52fc3abb8c1df8bafcaef ]
Commit f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry") introduced a mount warning regarding filesystem timestamp limits, that is printed upon each writable mount or remount.
This can result in a lot of unnecessary messages in the kernel log in setups where filesystems are being frequently remounted (or mounted multiple times).
Avoid this by setting a superblock flag which indicates that the warning has been emitted at least once for any particular mount, as suggested in [1].
Stable-dep-of: 4bcda1eaf184 ("mount: handle OOM on mnt_warn_timestamp_expiry")
--- fs/namespace.c | 2 ++ include/linux/fs.h | 1 + 2 files changed, 3 insertions(+)
fs/namespace.c +2 -0
@@ -2553,6 +2553,7 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *struct super_block *sb = mnt->mnt_sb;if (!__mnt_is_readonly (mnt) && + (!(sb->s_iflags &SB_I_TS_EXPIRY_WARNED )) && (ktime_get_real_seconds () +TIME_UPTIME_SEC_MAX > sb->s_time_max)) {char *buf = (char *)__get_free_page (GFP_KERNEL );char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM );
@@ -2567,6 +2568,7 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * tm.tm_year+1900, (unsigned long long)sb->s_time_max);free_page ((unsigned long )buf); + sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ; } }
include/linux/fs.h +1 -0
@@ -1428,6 +1428,7 @@ extern int send_sigurg(struct fown_struct *fown);#define SB_I_SKIP_SYNC 0x00000100/* Skip superblock at global sync */ #define SB_I_PERSB_BDI 0x00000200/* has a per-sb bdi */ +#define SB_I_TS_EXPIRY_WARNED 0x00000400/* warned about timestamp range expiry */ /* Possible states of 'frozen' field */ enum {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/518 fs/namespace: fnic: Switch to use %ptTd
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 74e60b8b2f0fe3702710e648a31725ee8224dbdf ]
Use %ptTd instead of open-coded variant to print contents of time64_t type in human readable form.
Stable-dep-of: 4bcda1eaf184 ("mount: handle OOM on mnt_warn_timestamp_expiry")
--- fs/namespace.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
fs/namespace.c +3 -6
@@ -2557,15 +2557,12 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {char *buf = (char *)__get_free_page (GFP_KERNEL );char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM ); -struct tm tm; -time64_to_tm (sb->s_time_max,0 , &tm); - -pr_warn ("%s filesystem being %s at %s supports timestamps until %04ld (0x%llx)\n" , +pr_warn ("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n" , sb->s_type->name,is_mounted (mnt) ?"remounted" :"mounted" , - mntpath, - tm.tm_year+1900 , (unsigned long long )sb->s_time_max); + mntpath, &sb->s_time_max, + (unsigned long long )sb->s_time_max);free_page ((unsigned long )buf); sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/518 mount: handle OOM on mnt_warn_timestamp_expiry
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olaf Hering <[email protected]>
[ Upstream commit 4bcda1eaf184e308f07f9c61d3a535f9ce477ce8 ]
If no page could be allocated, an error pointer was used as format string in pr_warn.
Rearrange the code to return early in case of OOM. Also add a check for the return value of d_path.
--- fs/namespace.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/namespace.c +11 -3
@@ -2555,8 +2555,15 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *if (!__mnt_is_readonly (mnt) && (!(sb->s_iflags &SB_I_TS_EXPIRY_WARNED )) && (ktime_get_real_seconds () +TIME_UPTIME_SEC_MAX > sb->s_time_max)) { -char *buf = (char *)__get_free_page (GFP_KERNEL ); -char *mntpath = buf ?d_path (mountpoint, buf,PAGE_SIZE ) :ERR_PTR (-ENOMEM ); +char *buf, *mntpath; + + buf = (char *)__get_free_page (GFP_KERNEL ); +if (buf) + mntpath =d_path (mountpoint, buf,PAGE_SIZE ); +else + mntpath =ERR_PTR (-ENOMEM ); +if (IS_ERR (mntpath)) + mntpath ="(unknown)" ; pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n", sb->s_type->name,
@@ -2564,8 +2571,9 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount * mntpath, &sb->s_time_max, (unsigned long long)sb->s_time_max); -free_page ((unsigned long )buf); sb->s_iflags |=SB_I_TS_EXPIRY_WARNED ; +if (buf) +free_page ((unsigned long )buf); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/518 padata: Honor the callers alignment in case of chunk_size 0
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamlesh Gurudasani <[email protected]>
[ Upstream commit 24cc57d8faaa4060fd58adf810b858fcfb71a02f ]
In the case where we are forcing the ps.chunk_size to be at least 1, we are ignoring the caller's alignment.
Move the forcing of ps.chunk_size to be at least 1 before rounding it up to caller's alignment, so that caller's alignment is honored.
While at it, use max() to force the ps.chunk_size to be at least 1 to improve readability.
--- kernel/padata.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/padata.c +3 -0
@@ -516,9 +516,12 @@ void __init padata_do_multithreaded(struct padata_mt_job *job)* thread function. Load balance large jobs between threads by * increasing the number of chunks, guarantee at least the minimum * chunk size from the caller, and honor the caller's alignment. +* Ensure chunk_size is at least 1 to prevent divide-by-0 +* panic in padata_mt_helper(). */ ps.chunk_size = job->size / (ps.nworks * load_balance_factor); ps.chunk_size =max (ps.chunk_size, job->min_chunk); + ps.chunk_size =max (ps.chunk_size,1ul ); ps.chunk_size =roundup (ps.chunk_size, job->align);/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/518 can: j1939: use correct function name in comment
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Changzhong <[email protected]>
[ Upstream commit dc2ddcd136fe9b6196a7dd01f75f824beb02d43f ]
The function j1939_cancel_all_active_sessions() was renamed to j1939_cancel_active_session() but name in comment wasn't updated.
--- net/can/j1939/transport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/can/j1939/transport.c +4 -4
@@ -1171,10 +1171,10 @@ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer)break ;case -ENETDOWN :/* In this case we should get a netdev_event(), all active -* sessions will be cleared by -* j1939_cancel_all_active_sessions(). So handle this as an -* error, but let j1939_cancel_all_active_sessions() do the -* cleanup including propagation of the error to user space. +* sessions will be cleared by j1939_cancel_active_session(). +* So handle this as an error, but let +* j1939_cancel_active_session() do the cleanup including +* propagation of the error to user space. */ break ;case -EOVERFLOW :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/518 netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e0c47281723f301894c14e6f5cd5884fdfb813f9 ]
Element timeout that is below CONFIG_HZ never expires because the timeout extension is not allocated given that nf_msecs_to_jiffies64() returns 0. Set timeout to the minimum value to honor timeout.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -4026,7 +4026,7 @@ int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)return -ERANGE ; ms *=NSEC_PER_MSEC ; - *result =nsecs_to_jiffies64 (ms); + *result =nsecs_to_jiffies64 (ms) ? : !!ms;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/518 netfilter: nf_tables: reject element expiration with no timeout
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit d2dc429ecb4e79ad164028d965c00f689e6f6d06 ]
If element timeout is unset and set provides no default timeout, the element expiration is silently ignored, reject this instead to let user know this is unsupported.
Also prepare for supporting timeout that never expire, where zero timeout and expiration must be also rejected.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -5628,6 +5628,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (nla[NFTA_SET_ELEM_EXPIRATION ] !=NULL ) {if (!(set->flags &NFT_SET_TIMEOUT ))return -EINVAL ; +if (timeout ==0 ) +return -EOPNOTSUPP ; + err =nf_msecs_to_jiffies64 (nla[NFTA_SET_ELEM_EXPIRATION ], &expiration);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/518 netfilter: nf_tables: reject expiration higher than timeout
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c0f38a8c60174368aed1d0f9965d733195f15033 ]
Report ERANGE to userspace if user specifies an expiration larger than the timeout.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -5635,6 +5635,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, &expiration);if (err)return err; + +if (expiration > timeout) +return -ERANGE ; }if (nla[NFTA_SET_ELEM_EXPR ] !=NULL ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/518 cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
[ Upstream commit abc00ffda43bd4ba85896713464c7510c39f8165 ]
Commit b4bc9f9e27ed ("cpufreq: ti-cpufreq: add support for omap34xx and omap36xx") introduced special handling for OMAP3 class devices where syscon node may not be present. However, this also creates a bug where the syscon node is present, however the offset used to read is beyond the syscon defined range.
Fix this by providing a quirk option that is populated when such special handling is required. This allows proper failure for all other platforms when the syscon node and efuse offsets are mismatched.
--- drivers/cpufreq/ti-cpufreq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/cpufreq/ti-cpufreq.c +8 -2
@@ -53,6 +53,9 @@ struct ti_cpufreq_soc_data {unsigned long efuse_shift;unsigned long rev_offset;bool multi_regulator; +/* Backward compatibility hack: Might have missing syscon */ +#define TI_QUIRK_SYSCON_MAY_BE_MISSING 0x1 +u8 quirks; };struct ti_cpufreq_data {
@@ -156,6 +159,7 @@ static struct ti_cpufreq_soc_data omap34xx_soc_data = { .efuse_mask = BIT(3), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -183,6 +187,7 @@ static struct ti_cpufreq_soc_data omap36xx_soc_data = { .efuse_mask = BIT(9), .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = true, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };/*
@@ -197,6 +202,7 @@ static struct ti_cpufreq_soc_data am3517_soc_data = { .efuse_mask = 0, .rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE, .multi_regulator = false, + .quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING, };
@@ -216,7 +222,7 @@ static int ti_cpufreq_get_efuse(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->efuse_offset, &efuse); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->efuse_offset,4 );
@@ -257,7 +263,7 @@ static int ti_cpufreq_get_rev(struct ti_cpufreq_data *opp_data, ret =regmap_read (opp_data->syscon, opp_data->soc_data->rev_offset, &revision); -if (ret == -EIO ) { +if (opp_data->soc_data->quirks &TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO ) {/* not a syscon register! */ void __iomem *regs =ioremap (OMAP3_SYSCON_BASE + opp_data->soc_data->rev_offset,4 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/518 wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit a26a5107bc52922cf5f67361e307ad66547b51c7 ]
Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the following:
[ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25 [ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]' <...skipped...>
[ T4985] Call Trace:
[ T4985] <TASK> [ T4985] dump_stack_lvl+0x1c2/0x2a0 [ T4985] ? __pfx_dump_stack_lvl+0x10/0x10 [ T4985] ? __pfx__printk+0x10/0x10 [ T4985] __ubsan_handle_out_of_bounds+0x127/0x150 [ T4985] cfg80211_wext_siwscan+0x11a4/0x1260
<...the rest is not too useful...>
Even if we do 'creq->n_channels = n_channels' before 'creq->ssids = (void *)&creq->channels[n_channels]', UBSAN treats the latter as off-by-one error. Fix this by using pointer arithmetic rather than an expression with explicit array indexing and use convenient 'struct_size()' to simplify the math here and in 'kzalloc()' above.
--- net/wireless/scan.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/wireless/scan.c +3 -3
@@ -2803,8 +2803,8 @@ int cfg80211_wext_siwscan(struct net_device *dev, n_channels =ieee80211_get_num_supported_channels (wiphy); } - creq =kzalloc (sizeof (*creq) +sizeof (struct cfg80211_ssid ) + - n_channels *sizeof (void *), + creq =kzalloc (struct_size (creq, channels, n_channels) + +sizeof (struct cfg80211_ssid ),GFP_ATOMIC );if (!creq) { err = -ENOMEM ;
@@ -2814,7 +2814,7 @@ int cfg80211_wext_siwscan(struct net_device *dev, creq->wiphy = wiphy; creq->wdev = dev->ieee80211_ptr;/* SSIDs come after channels */ - creq->ssids = (void *)&creq->channels[n_channels]; + creq->ssids = (void *)creq +struct_size (creq, channels, n_channels); creq->n_channels = n_channels; creq->n_ssids =1 ; creq->scan_start = jiffies;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/518 wifi: mt76: mt7915: fix rx filter setting for bfee functionality
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit 6ac80fce713e875a316a58975b830720a3e27721 ]
Fix rx filter setting to prevent dropping NDPA frames. Without this change, bfee functionality may behave abnormally.
--- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/main.c +1 -2
@@ -401,8 +401,7 @@ static void mt7915_configure_filter(struct ieee80211_hw *hw,MT76_FILTER (CONTROL ,MT_WF_RFCR_DROP_CTS |MT_WF_RFCR_DROP_RTS | -MT_WF_RFCR_DROP_CTL_RSV | -MT_WF_RFCR_DROP_NDPA ); +MT_WF_RFCR_DROP_CTL_RSV ); *total_flags = flags;mt76_wr (dev,MT_WF_RFCR (band), phy->rxfilter);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/518 wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 15ea13b1b1fbf6364d4cd568e65e4c8479632999 ]
Although not reproduced in practice, these two cases may be considered by UBSAN as off-by-one errors. So fix them in the same way as in commit a26a5107bc52 ("wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()").
--- net/wireless/nl80211.c | 3 ++- net/wireless/sme.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/wireless/nl80211.c +2 -1
@@ -8580,7 +8580,8 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,return ERR_PTR (-ENOMEM );if (n_ssids) - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids = n_ssids;if (ie_len) {if (n_ssids)
net/wireless/sme.c +2 -1
@@ -116,7 +116,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev) n_channels = i; } request->n_channels = n_channels; - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids =1 ; memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/518 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 9d301de12da6e1bb069a9835c38359b8e8135121 ]
Since '__dev_queue_xmit()' should be called with interrupts enabled, the following backtrace:
ieee80211_do_stop()
...
spin_lock_irqsave(&local->queue_stop_reason_lock, flags)
...
ieee80211_free_txskb()
ieee80211_report_used_skb()
ieee80211_report_ack_skb()
cfg80211_mgmt_tx_status_ext()
nl80211_frame_tx_status()
genlmsg_multicast_netns()
genlmsg_multicast_netns_filtered()
nlmsg_multicast_filtered()
netlink_broadcast_filtered()
do_one_broadcast()
netlink_broadcast_deliver()
__netlink_sendskb()
netlink_deliver_tap()
__netlink_deliver_tap_skb()
dev_queue_xmit()
__dev_queue_xmit() ; with IRQS disabled ...
spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)
issues the warning (as reported by syzbot reproducer):
WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120
Fix this by implementing a two-phase skb reclamation in 'ieee80211_do_stop()', where actual work is performed outside of a section with interrupts disabled.
--- net/mac80211/iface.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/mac80211/iface.c +16 -1
@@ -370,6 +370,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, {struct ieee80211_local *local = sdata->local;unsigned long flags; +struct sk_buff_head freeq;struct sk_buff *skb, *tmp;u32 hw_reconf_flags =0 ;int i, flushed;
@@ -565,18 +566,32 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,skb_queue_purge (&sdata->skb_queue); } +/* +* Since ieee80211_free_txskb() may issue __dev_queue_xmit() +* which should be called with interrupts enabled, reclamation +* is done in two phases: +*/ +__skb_queue_head_init (&freeq); + +/* unlink from local queues... */ spin_lock_irqsave (&local->queue_stop_reason_lock, flags);for (i =0 ; i <IEEE80211_MAX_QUEUES ; i++) { skb_queue_walk_safe(&local->pending[i], skb, tmp) {struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb);if (info->control.vif == &sdata->vif) {__skb_unlink (skb, &local->pending[i]); -ieee80211_free_txskb (&local->hw, skb); +__skb_queue_tail (&freeq, skb); } } }spin_unlock_irqrestore (&local->queue_stop_reason_lock, flags); +/* ... and perform actual reclamation with interrupts enabled. */ + skb_queue_walk_safe(&freeq, skb, tmp) { +__skb_unlink (skb, &freeq); +ieee80211_free_txskb (&local->hw, skb); + } +if (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN )ieee80211_txq_remove_vlan (local, sdata);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/518 wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawei Ye <[email protected]>
[ Upstream commit 6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8 ]
In the wilc_parse_join_bss_param function, the TSF field of the ies structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free issues.
This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues.
To address this, the TSF value is now stored in a local variable ies_tsf before the RCU lock is released. The param->tsf_lo field is then assigned using this local variable, ensuring that the TSF value is safely accessed.
--- drivers/net/wireless/microchip/wilc1000/hif.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/microchip/wilc1000/hif.c +3 -1
@@ -366,6 +366,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,struct wilc_join_bss_param *param;u8 rates_len =0 ;int ies_len; +u64 ies_tsf;int ret; param =kzalloc (sizeof (*param),GFP_KERNEL );
@@ -381,6 +382,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,return NULL ; } ies_len = ies->len; + ies_tsf = ies->tsf;rcu_read_unlock (); param->beacon_period =cpu_to_le16 (bss->beacon_interval);
@@ -436,7 +438,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,IEEE80211_P2P_ATTR_ABSENCE_NOTICE , (u8 *)&noa_attr, sizeof(noa_attr));if (ret >0 ) { - param->tsf_lo =cpu_to_le32 (ies->tsf); + param->tsf_lo =cpu_to_le32 (ies_tsf); param->noa_enabled =1 ; param->idx = noa_attr.index;if (noa_attr.oppps_ctwindow &IEEE80211_P2P_OPPPS_ENABLE_BIT ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/518 sock_map: Add a cond_resched() in sock_hash_free()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b1339be951ad31947ae19bc25cb08769bf255100 ]
Several syzbot soft lockup reports all have in common sock_hash_free()
If a map with a large number of buckets is destroyed, we need to yield the cpu when needed.
--- net/core/sock_map.c | 1 + 1 file changed, 1 insertion(+)
net/core/sock_map.c +1 -0
@@ -1219,6 +1219,7 @@ static void sock_hash_free(struct bpf_map *map)sock_put (elem->sk);sock_hash_free_elem (htab, elem); } +cond_resched (); }/* wait for psock readers accessing its map link */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/518 can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 94b0818fa63555a65f6ba107080659ea6bcca63e ]
syzbot reported a warning in bcm_release(). [0]
The blamed change fixed another warning that is triggered when connect() is issued again for a socket whose connect()ed device has been unregistered.
However, if the socket is just close()d without the 2nd connect(), the remaining bo->bcm_proc_read triggers unnecessary remove_proc_entry() in bcm_release().
Let's clear bo->bcm_proc_read after remove_proc_entry() in bcm_notify().
[0]
name '4986'
WARNING: CPU: 0 PID: 5234 at fs/proc/generic.c:711 remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Modules linked in: CPU: 0 UID: 0 PID: 5234 Comm: syz-executor606 Not tainted 6.11.0-rc5-syzkaller-00178-g5517ae241919 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Code: ff eb 05 e8 cb 1e 5e ff 48 8b 5c 24 10 48 c7 c7 e0 f7 aa 8e e8 2a 38 8e 09 90 48 c7 c7 60 3a 1b 8c 48 89 de e8 da 42 20 ff 90 <0f> 0b 90 90 48 8b 44 24 18 48 c7 44 24 40 0e 36 e0 45 49 c7 04 07 RSP: 0018:ffffc9000345fa20 EFLAGS: 00010246 RAX: 2a2d0aee2eb64600 RBX: ffff888032f1f548 RCX: ffff888029431e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000345fb08 R08: ffffffff8155b2f2 R09: 1ffff1101710519a R10: dffffc0000000000 R11: ffffed101710519b R12: ffff888011d38640 R13: 0000000000000004 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcfb52722f0 CR3: 000000000e734000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> bcm_release+0x250/0x880 net/can/bcm.c:1578 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcfb51ee969 Code: Unable to access opcode bytes at 0x7fcfb51ee93f. RSP: 002b:00007ffce0109ca8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fcfb51ee969 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 00007fcfb526f3b0 R08: ffffffffffffffb8 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007fcfb526f3b0 R13: 0000000000000000 R14: 00007fcfb5271ee0 R15: 00007fcfb51bf160 </TASK>
--- net/can/bcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/can/bcm.c +3 -1
@@ -1424,8 +1424,10 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,/* remove device reference, if this is our bound device */ if (bo->bound && bo->ifindex == dev->ifindex) {#if IS_ENABLED (CONFIG_PROC_FS ) -if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) +if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) {remove_proc_entry (bo->procname,sock_net (sk)->can.bcmproc_dir); + bo->bcm_proc_read =NULL ; + }#endif bo->bound =0 ; bo->ifindex =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/518 can: m_can: Add support for transceiver as phy
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Faiz Abbas <[email protected]>
[ Upstream commit d836cb5fe045463cdab15ad6f278f7c7c194228f ]
Add support for implementing transceiver node as phy. The max_bitrate is obtained by getting a phy attribute.
Stable-dep-of: 2c09b50efcad ("can: m_can: m_can_close(): stop clocks after device has been shut down")
--- drivers/net/can/m_can/m_can.c | 11 ++++++++++- drivers/net/can/m_can/m_can.h | 2 ++ drivers/net/can/m_can/m_can_platform.c | 13 +++++++++++++ 3 files changed, 25 insertions(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +10 -1
@@ -21,6 +21,7 @@#include <linux/iopoll.h> #include <linux/can/dev.h> #include <linux/pinctrl/consumer.h> +#include <linux/phy/phy.h> #include "m_can.h"
@@ -1438,6 +1439,8 @@ static int m_can_close(struct net_device *dev)close_candev (dev);can_led_event (dev,CAN_LED_EVENT_STOP ); +phy_power_off (cdev->transceiver); +return 0 ; }
@@ -1624,10 +1627,14 @@ static int m_can_open(struct net_device *dev)struct m_can_classdev *cdev =netdev_priv (dev);int err; - err =m_can_clk_start (cdev); + err =phy_power_on (cdev->transceiver);if (err)return err; + err =m_can_clk_start (cdev); +if (err) + goto out_phy_power_off; +/* open the can device */ err =open_candev (dev);if (err) {
@@ -1679,6 +1686,8 @@ static int m_can_open(struct net_device *dev)close_candev (dev); exit_disable_clks:m_can_clk_stop (cdev); +out_phy_power_off: +phy_power_off (cdev->transceiver);return err; }
drivers/net/can/m_can/m_can.h +2 -0
@@ -27,6 +27,7 @@#include <linux/iopoll.h> #include <linux/can/dev.h> #include <linux/pinctrl/consumer.h> +#include <linux/phy/phy.h> /* m_can lec values */ enum m_can_lec_type {
@@ -80,6 +81,7 @@ struct m_can_classdev {struct workqueue_struct *tx_wq;struct work_struct tx_work;struct sk_buff *tx_skb; +struct phy *transceiver;struct can_bittiming_const *bit_timing;struct can_bittiming_const *data_timing;
drivers/net/can/m_can/m_can_platform.c +13 -0
@@ -6,6 +6,7 @@// Copyright (C) 2018-19 Texas Instruments Incorporated - http://www.ti.com/ #include <linux/platform_device.h> +#include <linux/phy/phy.h> #include "m_can.h"
@@ -60,6 +61,7 @@ static int m_can_plat_probe(struct platform_device *pdev)struct resource *res;void __iomem *addr;void __iomem *mram_addr; +struct phy *transceiver;int irq, ret =0 ; mcan_class =m_can_class_allocate_dev (&pdev->dev);
@@ -99,6 +101,16 @@ static int m_can_plat_probe(struct platform_device *pdev) goto probe_fail; } + transceiver =devm_phy_optional_get (&pdev->dev,NULL ); +if (IS_ERR (transceiver)) { + ret =PTR_ERR (transceiver); +dev_err_probe (&pdev->dev, ret,"failed to get phy\n" ); + goto probe_fail; + } + +if (transceiver) + mcan_class->can.bitrate_max = transceiver->attrs.max_link_rate; + priv->base = addr; priv->mram_base = mram_addr;
@@ -106,6 +118,7 @@ static int m_can_plat_probe(struct platform_device *pdev) mcan_class->pm_clock_support =1 ; mcan_class->can.clock.freq =clk_get_rate (mcan_class->cclk); mcan_class->dev = &pdev->dev; + mcan_class->transceiver = transceiver; mcan_class->ops = &m_can_plat_ops;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/518 can: m_can: m_can_close(): stop clocks after device has been shut down
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 2c09b50efcad985cf920ca88baa9aa52b1999dcc ]
After calling m_can_stop() an interrupt may be pending or NAPI might still be executed. This means the driver might still touch registers of the IP core after the clocks have been disabled. This is not good practice and might lead to aborts depending on the SoC integration.
To avoid these potential problems, make m_can_close() symmetric to m_can_open(), i.e. stop the clocks at the end, right before shutting down the transceiver.
--- drivers/net/can/m_can/m_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +1 -1
@@ -1427,7 +1427,6 @@ static int m_can_close(struct net_device *dev)napi_disable (&cdev->napi);m_can_stop (dev); -m_can_clk_stop (cdev);free_irq (dev->irq, dev);if (cdev->is_peripheral) {
@@ -1439,6 +1438,7 @@ static int m_can_close(struct net_device *dev)close_candev (dev);can_led_event (dev,CAN_LED_EVENT_STOP ); +m_can_clk_stop (cdev);phy_power_off (cdev->transceiver);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/518 Bluetooth: btusb: Fix not handling ZPL/short-transfer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 7b05933340f4490ef5b09e84d644d12484b05fdf ]
Requesting transfers of the exact same size of wMaxPacketSize may result in ZPL/short-transfer since the USB stack cannot handle it as we are limiting the buffer size to be the same as wMaxPacketSize.
Also, in terms of throughput this change has the same effect to interrupt endpoint as 290ba200815f "Bluetooth: Improve USB driver throughput by increasing the frame size" had for the bulk endpoint, so users of the advertisement bearer (e.g. BT Mesh) may benefit from this change.
--- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +4 -1
@@ -928,7 +928,10 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)if (!urb)return -ENOMEM ; - size =le16_to_cpu (data->intr_ep->wMaxPacketSize); +/* Use maximum HCI Event size so the USB stack handles +* ZPL/short-transfer automatically. +*/ + size =HCI_MAX_EVENT_SIZE ; buf =kmalloc (size, mem_flags);if (!buf) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/518 bareudp: allow redirecting bareudp packets to eth devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 99c8719b79814cab3fd43519591dcc41c978a48c ]
Even though bareudp transports L3 data (typically IP or MPLS), it needs to reset the mac_header pointer, so that other parts of the stack don't mistakenly access the outer header after the packet has been decapsulated.
This allows to push an Ethernet header to bareudp packets and redirect them to an Ethernet device:
$ tc filter add dev bareudp0 ingress matchall \
action vlan push_eth dst_mac 00:00:5e:00:53:01 \
src_mac 00:00:5e:00:53:00 \
action mirred egress redirect dev eth0Without this patch, push_eth refuses to add an ethernet header because the skb appears to already have a MAC header.
Stable-dep-of: 45fa29c85117 ("bareudp: Pull inner IP header in bareudp_udp_encap_recv().")
--- drivers/net/bareudp.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/bareudp.c +1 -0
@@ -139,6 +139,7 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) skb->dev = bareudp->dev; oiph =skb_network_header (skb);skb_reset_network_header (skb); +skb_reset_mac_header (skb);if (!ipv6_mod_enabled () || family ==AF_INET ) err =IP_ECN_decapsulate (oiph, skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/518 bareudp: Pull inner IP header in bareudp_udp_encap_recv().
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 45fa29c85117170b0508790f878b13ec6593c888 ]
Bareudp reads the inner IP header to get the ECN value. Therefore, it needs to ensure that it's part of the skb's linear data.
This is similar to the vxlan and geneve fixes for that same problem:
* commit f7789419137b ("vxlan: Pull inner IP header in vxlan_rcv().")
* commit 1ca1ba465e55 ("geneve: make sure to pull inner header in
geneve_rx()")
--- drivers/net/bareudp.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/net/bareudp.c +18 -2
@@ -60,6 +60,7 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)__be16 proto;void *oiph;int err; +int nh; bareudp =rcu_dereference_sk_user_data (sk);if (!bareudp)
@@ -137,10 +138,25 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) }skb_dst_set (skb, &tun_dst->dst); skb->dev = bareudp->dev; - oiph =skb_network_header (skb); -skb_reset_network_header (skb);skb_reset_mac_header (skb); +/* Save offset of outer header relative to skb->head, +* because we are going to reset the network header to the inner header +* and might change skb->head. +*/ + nh =skb_network_header (skb) - skb->head; + +skb_reset_network_header (skb); + +if (!pskb_inet_may_pull (skb)) { +DEV_STATS_INC (bareudp->dev, rx_length_errors); +DEV_STATS_INC (bareudp->dev, rx_errors); + goto drop; + } + +/* Get the outer header. */ + oiph = skb->head + nh; +if (!ipv6_mod_enabled () || family ==AF_INET ) err =IP_ECN_decapsulate (oiph, skb);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/518 net: geneve: support IPv4/IPv6 as inner protocol
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eyal Birger <[email protected]>
[ Upstream commit 435fe1c0c1f74b682dba85641406abf4337aade6 ]
This patch adds support for encapsulating IPv4/IPv6 within GENEVE.
In order to use this, a new IFLA_GENEVE_INNER_PROTO_INHERIT flag needs to be provided at device creation. This property cannot be changed for the time being.
In case IP traffic is received on a non-tun device the drop count is increased.
Stable-dep-of: c471236b2359 ("bareudp: Pull inner IP header on xmit.")
--- drivers/net/geneve.c | 82 +++++++++++++++++++++++++++--------- include/uapi/linux/if_link.h | 1 + 2 files changed, 64 insertions(+), 19 deletions(-)
drivers/net/geneve.c +63 -19
@@ -54,6 +54,7 @@ struct geneve_config {bool use_udp6_rx_checksums;bool ttl_inherit;enum ifla_geneve_df df; +bool inner_proto_inherit; };/* Pseudo network device */
@@ -249,17 +250,24 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, } } -skb_reset_mac_header (skb); - skb->protocol =eth_type_trans (skb, geneve->dev); -skb_postpull_rcsum (skb,eth_hdr (skb),ETH_HLEN ); -if (tun_dst)skb_dst_set (skb, &tun_dst->dst); -/* Ignore packet loops (and multicast echo) */ -if (ether_addr_equal (eth_hdr (skb)->h_source, geneve->dev->dev_addr)) { - geneve->dev->stats.rx_errors++; - goto drop; +if (gnvh->proto_type ==htons (ETH_P_TEB )) { +skb_reset_mac_header (skb); + skb->protocol =eth_type_trans (skb, geneve->dev); +skb_postpull_rcsum (skb,eth_hdr (skb),ETH_HLEN ); + +/* Ignore packet loops (and multicast echo) */ +if (ether_addr_equal (eth_hdr (skb)->h_source, + geneve->dev->dev_addr)) { + geneve->dev->stats.rx_errors++; + goto drop; + } + }else { +skb_reset_mac_header (skb); + skb->dev = geneve->dev; + skb->pkt_type =PACKET_HOST ; }/* Save offset of outer header relative to skb->head,
@@ -357,6 +365,7 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)struct genevehdr *geneveh;struct geneve_dev *geneve;struct geneve_sock *gs; +__be16 inner_proto;int opts_len;/* Need UDP and Geneve header to be present */
@@ -368,7 +377,11 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)if (unlikely (geneveh->ver !=GENEVE_VER )) goto drop; -if (unlikely (geneveh->proto_type !=htons (ETH_P_TEB ))) + inner_proto = geneveh->proto_type; + +if (unlikely ((inner_proto !=htons (ETH_P_TEB ) && + inner_proto !=htons (ETH_P_IP ) && + inner_proto !=htons (ETH_P_IPV6 )))) goto drop; gs =rcu_dereference_sk_user_data (sk);
@@ -379,9 +392,14 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)if (!geneve) goto drop; +if (unlikely ((!geneve->cfg.inner_proto_inherit && + inner_proto !=htons (ETH_P_TEB )))) { + geneve->dev->stats.rx_dropped++; + goto drop; + } + opts_len = geneveh->opt_len *4 ; -if (iptunnel_pull_header (skb,GENEVE_BASE_HLEN + opts_len, -htons (ETH_P_TEB ), +if (iptunnel_pull_header (skb,GENEVE_BASE_HLEN + opts_len, inner_proto, !net_eq (geneve->net,dev_net (geneve->dev)))) { geneve->dev->stats.rx_dropped++; goto drop;
@@ -728,7 +746,8 @@ static int geneve_stop(struct net_device *dev) }static void geneve_build_header (struct genevehdr *geneveh, -const struct ip_tunnel_info *info) +const struct ip_tunnel_info *info, +__be16 inner_proto) { geneveh->ver =GENEVE_VER ; geneveh->opt_len = info->options_len /4 ;
@@ -736,7 +755,7 @@ static void geneve_build_header(struct genevehdr *geneveh, geneveh->critical = !!(info->key.tun_flags &TUNNEL_CRIT_OPT ); geneveh->rsvd1 =0 ;tunnel_id_to_vni (info->key.tun_id, geneveh->vni); - geneveh->proto_type =htons (ETH_P_TEB ); + geneveh->proto_type = inner_proto; geneveh->rsvd2 =0 ;if (info->key.tun_flags &TUNNEL_GENEVE_OPT )
@@ -745,10 +764,12 @@ static void geneve_build_header(struct genevehdr *geneveh,static int geneve_build_skb (struct dst_entry *dst,struct sk_buff *skb,const struct ip_tunnel_info *info, -bool xnet,int ip_hdr_len) +bool xnet,int ip_hdr_len, +bool inner_proto_inherit) {bool udp_sum = !!(info->key.tun_flags &TUNNEL_CSUM );struct genevehdr *gnvh; +__be16 inner_proto;int min_headroom;int err;
@@ -766,8 +787,9 @@ static int geneve_build_skb(struct dst_entry *dst, struct sk_buff *skb, goto free_dst; gnvh =__skb_push (skb,sizeof (*gnvh) + info->options_len); -geneve_build_header (gnvh, info); -skb_set_inner_protocol (skb,htons (ETH_P_TEB )); + inner_proto = inner_proto_inherit ? skb->protocol :htons (ETH_P_TEB ); +geneve_build_header (gnvh, info, inner_proto); +skb_set_inner_protocol (skb, inner_proto);return 0 ; free_dst:
@@ -973,7 +995,8 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, } } - err =geneve_build_skb (&rt->dst, skb, info, xnet,sizeof (struct iphdr )); + err =geneve_build_skb (&rt->dst, skb, info, xnet,sizeof (struct iphdr ), + geneve->cfg.inner_proto_inherit);if (unlikely (err))return err;
@@ -1052,7 +1075,8 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, ttl = key->ttl; ttl = ttl ? :ip6_dst_hoplimit (dst); } - err =geneve_build_skb (dst, skb, info, xnet,sizeof (struct ipv6hdr )); + err =geneve_build_skb (dst, skb, info, xnet,sizeof (struct ipv6hdr ), + geneve->cfg.inner_proto_inherit);if (unlikely (err))return err;
@@ -1401,6 +1425,14 @@ static int geneve_configure(struct net *net, struct net_device *dev,dst_cache_reset (&geneve->cfg.info.dst_cache);memcpy (&geneve->cfg, cfg,sizeof (*cfg)); +if (geneve->cfg.inner_proto_inherit) { + dev->header_ops =NULL ; + dev->type =ARPHRD_NONE ; + dev->hard_header_len =0 ; + dev->addr_len =0 ; + dev->flags =IFF_NOARP ; + } + err =register_netdevice (dev);if (err)return err;
@@ -1574,10 +1606,18 @@ static int geneve_nl2info(struct nlattr *tb[], struct nlattr *data[],#endif } +if (data[IFLA_GENEVE_INNER_PROTO_INHERIT ]) { +if (changelink) { + attrtype =IFLA_GENEVE_INNER_PROTO_INHERIT ; + goto change_notsup; + } + cfg->inner_proto_inherit = true; + } +return 0 ; change_notsup:NL_SET_ERR_MSG_ATTR (extack, data[attrtype], -"Changing VNI, Port, endpoint IP address family, external, and UDP checksum attributes are not supported" ); +"Changing VNI, Port, endpoint IP address family, external, inner_proto_inherit, and UDP checksum attributes are not supported" );return -EOPNOTSUPP ; }
@@ -1812,6 +1852,10 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)if (nla_put_u8 (skb,IFLA_GENEVE_TTL_INHERIT , ttl_inherit)) goto nla_put_failure; +if (geneve->cfg.inner_proto_inherit && +nla_put_flag (skb,IFLA_GENEVE_INNER_PROTO_INHERIT )) + goto nla_put_failure; +return 0 ; nla_put_failure:
include/uapi/linux/if_link.h +1 -0
@@ -761,6 +761,7 @@ enum {IFLA_GENEVE_LABEL ,IFLA_GENEVE_TTL_INHERIT ,IFLA_GENEVE_DF , +IFLA_GENEVE_INNER_PROTO_INHERIT , __IFLA_GENEVE_MAX };#define IFLA_GENEVE_MAX (__IFLA_GENEVE_MAX - 1)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/518 geneve: Fix incorrect inner network header offset when innerprotoinherit is set
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit c6ae073f5903f6c6439d0ac855836a4da5c0a701 ]
When innerprotoinherit is set, the tunneled packets do not have an inner Ethernet header.
Change 'maclen' to not always assume the header length is ETH_HLEN, as there might not be a MAC header.
This resolves issues with drivers (e.g. mlx5, in mlx5e_tx_tunnel_accel()) who rely on the skb inner network header offset to be correct, and use it for TX offloads.
Stable-dep-of: c471236b2359 ("bareudp: Pull inner IP header on xmit.")
--- drivers/net/geneve.c | 10 ++++++---- include/net/ip_tunnels.h | 5 +++-- 2 files changed, 9 insertions(+), 6 deletions(-)
drivers/net/geneve.c +6 -4
@@ -912,6 +912,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,struct geneve_dev *geneve, const struct ip_tunnel_info *info) { + bool inner_proto_inherit = geneve->cfg.inner_proto_inherit;bool xnet = !net_eq (geneve->net,dev_net (geneve->dev));struct geneve_sock *gs4 =rcu_dereference (geneve->sock4);const struct ip_tunnel_key *key = &info->key;
@@ -923,7 +924,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!skb_vlan_inet_prepare (skb)) +if (!skb_vlan_inet_prepare (skb, inner_proto_inherit))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
@@ -996,7 +997,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, } err =geneve_build_skb (&rt->dst, skb, info, xnet,sizeof (struct iphdr ), - geneve->cfg.inner_proto_inherit); + inner_proto_inherit);if (unlikely (err))return err;
@@ -1012,6 +1013,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,struct geneve_dev *geneve, const struct ip_tunnel_info *info) { + bool inner_proto_inherit = geneve->cfg.inner_proto_inherit;bool xnet = !net_eq (geneve->net,dev_net (geneve->dev));struct geneve_sock *gs6 =rcu_dereference (geneve->sock6);const struct ip_tunnel_key *key = &info->key;
@@ -1021,7 +1023,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!skb_vlan_inet_prepare (skb)) +if (!skb_vlan_inet_prepare (skb, inner_proto_inherit))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
@@ -1076,7 +1078,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, ttl = ttl ? :ip6_dst_hoplimit (dst); } err =geneve_build_skb (dst, skb, info, xnet,sizeof (struct ipv6hdr ), - geneve->cfg.inner_proto_inherit); + inner_proto_inherit);if (unlikely (err))return err;
include/net/ip_tunnels.h +3 -2
@@ -335,9 +335,10 @@ static inline bool pskb_inet_may_pull(struct sk_buff *skb)/* Variant of pskb_inet_may_pull(). */ -static inline bool skb_vlan_inet_prepare (struct sk_buff *skb) +static inline bool skb_vlan_inet_prepare (struct sk_buff *skb, +bool inner_proto_inherit) { -int nhlen =0 , maclen =ETH_HLEN ; +int nhlen =0 , maclen = inner_proto_inherit ?0 :ETH_HLEN ;__be16 type = skb->protocol;/* Essentially this is skb_protocol(skb, true)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/518 bareudp: Pull inner IP header on xmit.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit c471236b2359e6b27388475dd04fff0a5e2bf922 ]
Both bareudp_xmit_skb() and bareudp6_xmit_skb() read their skb's inner IP header to get its ECN value (with ip_tunnel_ecn_encap()). Therefore we need to ensure that the inner IP header is part of the skb's linear data.
--- drivers/net/bareudp.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/bareudp.c +6 -0
@@ -311,6 +311,9 @@ static int bareudp_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be32 saddr;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
@@ -374,6 +377,9 @@ static int bareudp6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; +if (!skb_vlan_inet_prepare (skb, skb->protocol !=htons (ETH_P_TEB ))) +return -EINVAL ; +if (!sock)return -ESHUTDOWN ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/518 net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 799a9225997799f7b1b579bc50a93b78b4fb2a01 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +1 -2
@@ -1333,12 +1333,11 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv)snprintf (v->name,sizeof (v->name),"%s-rxtx%d" , priv->ndev->name, i); - err =request_irq (irq, enetc_msix,0 , v->name, v); + err =request_irq (irq, enetc_msix,IRQF_NO_AUTOEN , v->name, v);if (err) {dev_err (priv->dev,"request_irq() failed!\n" ); goto irq_err; } -disable_irq (irq); v->tbier_base = hw->reg +ENETC_BDR (TX ,0 ,ENETC_TBIER ); v->rbier = hw->reg +ENETC_BDR (RX , i,ENETC_RBIER );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/518 r8169: disable ALDPS per default for RTL8125
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit b9c7ac4fe22c608acf6153a3329df2b6b6cd416c ]
En-Wei reported that traffic breaks if cable is unplugged for more than 3s and then re-plugged. This was supposed to be fixed by 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125"). But apparently this didn't fix the issue for everybody. The 3s threshold rang a bell, as this is the delay after which ALDPS kicks in. And indeed disabling ALDPS fixes the issue for this user. Maybe this fixes the issue in general. In a follow-up step we could remove the first fix attempt and see whether anybody complains.
--- drivers/net/ethernet/realtek/r8169_phy_config.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/realtek/r8169_phy_config.c +2 -0
@@ -1263,6 +1263,7 @@ static void rtl8125a_2_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xa86 ,0x15 ,0x0001 ,0x0000 );rtl8168g_enable_gphy_10m (phydev); +rtl8168g_disable_aldps (phydev);rtl8125a_config_eee_phy (phydev); }
@@ -1302,6 +1303,7 @@ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,phy_modify_paged (phydev,0xbf8 ,0x12 ,0xe000 ,0xa000 );rtl8125_legacy_force_mode (phydev); +rtl8168g_disable_aldps (phydev);rtl8125b_config_eee_phy (phydev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/518 net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Iurman <[email protected]>
[ Upstream commit 2c84b0aa28b9e73e8c4b4ce038269469434ae372 ]
Free the skb before returning from rpl_input when skb_cow_head() fails. Use a "drop" label and goto instructions.
--- net/ipv6/rpl_iptunnel.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/ipv6/rpl_iptunnel.c +7 -5
@@ -268,10 +268,8 @@ static int rpl_input(struct sk_buff *skb) rlwt =rpl_lwt_lwtunnel (orig_dst->lwtstate); err =rpl_do_srh (skb, rlwt); -if (unlikely (err)) { -kfree_skb (skb); -return err; - } +if (unlikely (err)) + goto drop;local_bh_disable (); dst =dst_cache_get (&rlwt->cache);
@@ -292,9 +290,13 @@ static int rpl_input(struct sk_buff *skb) err =skb_cow_head (skb,LL_RESERVED_SPACE (dst->dev));if (unlikely (err)) -return err; + goto drop;return dst_input (skb); + +drop: +kfree_skb (skb); +return err; } static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/518 net: tipc: avoid possible garbage value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 99655a304e450baaae6b396cb942b9e47659d644 ]
Clang static checker (scan-build) warning:net/tipc/bcast.c:305:4:
The expression is an uninitialized value. The computed value will also be garbage [core.uninitialized.Assign]
305 | (*cong_link_cnt)++;
| ^~~~~~~~~~~~~~~~~~tipc_rcast_xmit() will increase cong_link_cnt's value, but cong_link_cnt is uninitialized. Although it won't really cause a problem, it's better to fix it.
--- net/tipc/bcast.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/bcast.c +1 -1
@@ -320,8 +320,8 @@ static int tipc_mcast_send_sync(struct net *net, struct sk_buff *skb, {struct tipc_msg *hdr, *_hdr;struct sk_buff_head tmpq; +u16 cong_link_cnt =0 ;struct sk_buff *_skb; -u16 cong_link_cnt;int rc =0 ;/* Is a cluster supporting with new capabilities ? */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/518 block, bfq: fix possible UAF for bfqq->bic with merge chain
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 18ad4df091dd5d067d2faa8fce1180b79f7041a7 ]
1) initial state, three tasks:
Process 1 Process 2 Process 3
(BIC1) (BIC2) (BIC3)
| Λ | Λ | Λ
| | | | | |
V | V | V |
bfqq1 bfqq2 bfqq3
process ref: 1 1 1
2) bfqq1 merged to bfqq2:
Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) | | | Λ \--------------\| | | V V | bfqq1--------->bfqq2 bfqq3
process ref: 0 2 1
3) bfqq2 merged to bfqq3:
Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) here -> Λ | | \--------------\ \-------------\| V V bfqq1--------->bfqq2---------->bfqq3
process ref: 0 1 3
In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then get bfqq3 through merge chain, and finially handle IO by bfqq3. Howerver, current code will think bfqq2 is owned by BIC1, like initial state, and set bfqq2->bic to BIC1.
bfq_insert_request
-> by Process 1
bfqq = bfq_init_rq(rq)
bfqq = bfq_get_bfqq_handle_split
bfqq = bic_to_bfqq
-> get bfqq2 from BIC1
bfqq->ref++
rq->elv.priv[0] = bic
rq->elv.priv[1] = bfqq
if (bfqq_process_refs(bfqq) == 1)
bfqq->bic = bic
-> record BIC1 to bfqq2
__bfq_insert_request
new_bfqq = bfq_setup_cooperator
-> get bfqq3 from bfqq2->new_bfqq
bfqq_request_freed(bfqq)
new_bfqq->ref++
rq->elv.priv[1] = new_bfqq
-> handle IO by bfqq3
Fix the problem by checking bfqq is from merge chain fist. And this might fix a following problem reported by our syzkaller(unreproducible):
==================================================================
BUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] BUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] BUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 Write of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595 CPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G L 6.6.0-07439-gba2303cacfda #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Workqueue: kblockd blk_mq_requeue_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0x10d/0x610 mm/kasan/report.c:475 kasan_report+0x8e/0xc0 mm/kasan/report.c:588 bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757 bfq_init_rq block/bfq-iosched.c:6876 [inline] bfq_insert_request block/bfq-iosched.c:6254 [inline] bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304 blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593 blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 </TASK> Allocated by task 20776: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3458 [inline] kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503 ioc_create_icq block/blk-ioc.c:370 [inline] ioc_find_get_icq+0x180/0xaa0 block/blk-ioc.c:436 bfq_prepare_request+0x39/0xf0 block/bfq-iosched.c:6812 blk_mq_rq_ctx_init.isra.7+0x6ac/0xa00 block/blk-mq.c:403 __blk_mq_alloc_requests+0xcc0/0x1070 block/blk-mq.c:517 blk_mq_get_new_requests block/blk-mq.c:2940 [inline] blk_mq_submit_bio+0x624/0x27c0 block/blk-mq.c:3042 __submit_bio+0x331/0x6f0 block/blk-core.c:624 __submit_bio_noacct_mq block/blk-core.c:703 [inline] submit_bio_noacct_nocheck+0x816/0xb40 block/blk-core.c:732 submit_bio_noacct+0x7a6/0x1b50 block/blk-core.c:826 xlog_write_iclog+0x7d5/0xa00 fs/xfs/xfs_log.c:1958 xlog_state_release_iclog+0x3b8/0x720 fs/xfs/xfs_log.c:619 xlog_cil_push_work+0x19c5/0x2270 fs/xfs/xfs_log_cil.c:1330 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 Freed by task 946: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] __kasan_slab_free+0x12c/0x1c0 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1815 [inline] slab_free_freelist_hook mm/slub.c:1841 [inline] slab_free mm/slub.c:3786 [inline] kmem_cache_free+0x118/0x6f0 mm/slub.c:3808 rcu_do_batch+0x35c/0xe30 kernel/rcu/tree.c:2189 rcu_core+0x819/0xd90 kernel/rcu/tree.c:2462 __do_softirq+0x1b0/0x7a2 kernel/softirq.c:553 Last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2712 [inline] call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2712 [inline] call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 The buggy address belongs to the object at ffff888123839d68 which belongs to the cache bfq_io_cq of size 1360
The buggy address is located 336 bytes inside of
freed 1360-byte region [ffff888123839d68, ffff88812383a2b8)
The buggy address belongs to the physical page:
page:ffffea00048e0e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88812383f588 pfn:0x123838 head:ffffea00048e0e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x17ffffc0000a40(workingset|slab|head|node=0|zone=2|lastcpupid=0x1fffff)page_type: 0xffffffff()
raw: 0017ffffc0000a40 ffff88810588c200 ffffea00048ffa10 ffff888105889488
raw: ffff88812383f588 0000000000150006 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888123839d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888123839e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888123839e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888123839f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888123839f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- block/bfq-iosched.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/bfq-iosched.c +2 -1
@@ -6194,7 +6194,8 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)* addition, if the queue has also just been split, we have to * resume its state. */ -if (likely (bfqq != &bfqd->oom_bfqq) &&bfqq_process_refs (bfqq) ==1 ) { +if (likely (bfqq != &bfqd->oom_bfqq) && !bfqq->new_bfqq && +bfqq_process_refs (bfqq) ==1 ) { bfqq->bic = bic;if (split) {/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/518 block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 0e456dba86c7f9a19792204a044835f1ca2c8dbb ]
Consider the following merge chain:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\--------------\ \-------------\ \-------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
IO from Process 1 will get bfqf2 from BIC1 first, then bfq_setup_cooperator() will found bfqq2 already merged to bfqq3 and then handle this IO from bfqq3. However, the merge chain can be much deeper and bfqq3 can be merged to other bfqq as well.
Fix this problem by iterating to the last bfqq inbfq_setup_cooperator().
--- block/bfq-iosched.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
block/bfq-iosched.c +6 -2
@@ -2616,8 +2616,12 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,struct bfq_queue *in_service_bfqq, *new_bfqq;/* if a merge has already been setup, then proceed with that first */ -if (bfqq->new_bfqq) -return bfqq->new_bfqq; + new_bfqq = bfqq->new_bfqq; +if (new_bfqq) { +while (new_bfqq->new_bfqq) + new_bfqq = new_bfqq->new_bfqq; +return new_bfqq; + }/* * Do not perform queue merging if the device is non
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/518 block, bfq: dont break merge chain in bfq_split_bfqq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 42c306ed723321af4003b2a41bb73728cab54f85 ]
Consider the following scenario:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\-------------\ \-------------\ \--------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 1 2 4
If Process 1 issue a new IO and bfqq2 is found, and then bfq_init_rq() decide to spilt bfqq2 by bfq_split_bfqq(). Howerver, procress reference of bfqq2 is 1 and bfq_split_bfqq() just clear the coop flag, which will break the merge chain.
Expected result: caller will allocate a new bfqq for BIC1
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
| | |
\-------------\ \--------------\|
V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 0 1 3
Since the condition is only used for the last bfqq4 when the previous bfqq2 and bfqq3 are already splited. Fix the problem by checking if bfqq is the last one in the merge chain as well.
--- block/bfq-iosched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bfq-iosched.c +1 -1
@@ -6013,7 +6013,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq) {bfq_log_bfqq (bfqq->bfqd, bfqq,"splitting queue" ); -if (bfqq_process_refs (bfqq) ==1 ) { +if (bfqq_process_refs (bfqq) ==1 && !bfqq->new_bfqq) { bfqq->pid = current->pid;bfq_clear_bfqq_coop (bfqq);bfq_clear_bfqq_split_coop (bfqq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/518 block: print symbolic error name instead of error code
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Heusel <[email protected]>
[ Upstream commit 25c1772a0493463408489b1fae65cf77fe46cac1 ]
Utilize the %pe print specifier to get the symbolic error name as a string (i.e "-ENOMEM") in the log message instead of the error code to increase its readablility.
This change was suggested in
https://lore.kernel.org/all/[email protected]/
Stable-dep-of: 26e197b7f924 ("block: fix potential invalid pointer dereference in blk_add_partition")
--- block/partitions/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
block/partitions/core.c +2 -2
@@ -692,8 +692,8 @@ static bool blk_add_partition(struct gendisk *disk, struct block_device *bdev, part =add_partition (disk, p, from, size, state->parts[p].flags, &state->parts[p].info);if (IS_ERR (part) &&PTR_ERR (part) != -ENXIO ) { -printk (KERN_ERR " %s: p%d could not be added: %ld\n" , - disk->disk_name, p, -PTR_ERR (part)); +printk (KERN_ERR " %s: p%d could not be added: %pe\n" , + disk->disk_name, p, part);return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/518 block: fix potential invalid pointer dereference in blk_add_partition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Riyan Dhiman <[email protected]>
[ Upstream commit 26e197b7f9240a4ac301dd0ad520c0c697c2ea7d ]
The blk_add_partition() function initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, allowing the function to proceed without logging the error in this case. However, this change unintentionally left a path where md_autodetect_dev() could be called without confirming that part is a valid pointer.
This commit separates the error handling logic by splitting the initial if-condition, improving code readability and handling specific error scenarios explicitly. The function now distinguishes the general error case from -ENXIO without altering the existing behavior of md_autodetect_dev() calls.
--- block/partitions/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
block/partitions/core.c +5 -3
@@ -691,9 +691,11 @@ static bool blk_add_partition(struct gendisk *disk, struct block_device *bdev, part =add_partition (disk, p, from, size, state->parts[p].flags, &state->parts[p].info); -if (IS_ERR (part) &&PTR_ERR (part) != -ENXIO ) { -printk (KERN_ERR " %s: p%d could not be added: %pe\n" , - disk->disk_name, p, part); +if (IS_ERR (part)) { +if (PTR_ERR (part) != -ENXIO ) { +printk (KERN_ERR " %s: p%d could not be added: %pe\n" , + disk->disk_name, p, part); + }return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/518 spi: ppc4xx: handle irq_of_parse_and_map() errors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 0f245463b01ea254ae90e1d0389e90b0e7d8dc75 ]
Zero and negative number is not a valid IRQ for in-kernel code and the irq_of_parse_and_map() function returns zero on error. So this check for valid IRQs should only accept values > 0.
--- drivers/spi/spi-ppc4xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-ppc4xx.c +3 -0
@@ -411,6 +411,9 @@ static int spi_ppc4xx_of_probe(struct platform_device *op)/* Request IRQ */ hw->irqnum =irq_of_parse_and_map (np,0 ); +if (hw->irqnum <=0 ) + goto free_host; + ret =request_irq (hw->irqnum, spi_ppc4xx_int,0 ,"spi_ppc4xx_of" , (void *)hw);if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/518 spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 7781f1d120fec8624fc654eda900fc8748262082 ]
0 is incorrect error code when failed to parse and map IRQ. Replace OF specific old API for IRQ retrieval with a generic one to fix this issue.
--- drivers/spi/spi-ppc4xx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/spi/spi-ppc4xx.c +3 -3
@@ -26,7 +26,6 @@#include <linux/errno.h> #include <linux/wait.h> #include <linux/of_address.h> -#include <linux/of_irq.h> #include <linux/of_platform.h> #include <linux/interrupt.h> #include <linux/delay.h>
@@ -410,9 +409,10 @@ static int spi_ppc4xx_of_probe(struct platform_device *op) }/* Request IRQ */ - hw->irqnum =irq_of_parse_and_map (np,0 ); -if (hw->irqnum <=0 ) + ret =platform_get_irq (op,0 ); +if (ret <0 ) goto free_host; + hw->irqnum = ret; ret =request_irq (hw->irqnum, spi_ppc4xx_int,0 ,"spi_ppc4xx_of" , (void *)hw);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/518 ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Dahl <[email protected]>
[ Upstream commit d355c895fa4ddd8bec15569eee540baeed7df8c5 ]
The RTC and RTT peripherals use the timing domain slow clock (TD_SLCK), sourced from the 32.768 kHz crystal oscillator or slow rc oscillator.
The previously used Monitoring domain slow clock (MD_SLCK) is sourced from an internal RC oscillator which is most probably not precise enough for real time clock purposes.
[claudiu.beznea: removed () around the last commit description paragraph,
removed " in front of "timing domain slow clock", described that TD_SLCK can also be sourced from slow rc oscillator]
--- arch/arm/boot/dts/sam9x60.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/sam9x60.dtsi +2 -2
@@ -692,7 +692,7 @@ rtt: rtt@fffffe20 { compatible = "microchip,sam9x60-rtt", "atmel,at91sam9260-rtt"; reg = <0xfffffe20 0x20>; interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>; - clocks = <&clk32k 0>; + clocks = <&clk32k 1>; }; pit: timer@fffffe40 {
@@ -718,7 +718,7 @@ rtc: rtc@fffffea8 { compatible = "microchip,sam9x60-rtc", "atmel,at91sam9x5-rtc"; reg = <0xfffffea8 0x100>; interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>; - clocks = <&clk32k 0>; + clocks = <&clk32k 1>; }; watchdog: watchdog@ffffff80 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/518 ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 0e49cfe364dea4345551516eb2fe53135a10432b ]
There is no "fsl,phy" property in pin controller pincfg nodes:
imx7d-zii-rmu2.dtb: pinctrl@302c0000: enet1phyinterruptgrp: 'fsl,pins' is a required property imx7d-zii-rmu2.dtb: pinctrl@302c0000: enet1phyinterruptgrp: 'fsl,phy' does not match any of the regexes: 'pinctrl-[0-9]+'
--- arch/arm/boot/dts/imx7d-zii-rmu2.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx7d-zii-rmu2.dts +1 -1
@@ -350,7 +350,7 @@ MX7D_PAD_SD3_RESET_B__SD3_RESET_B 0x59 &iomuxc_lpsr { pinctrl_enet1_phy_interrupt: enet1phyinterruptgrp { - fsl,phy = < + fsl,pins = < MX7D_PAD_LPSR_GPIO1_IO02__GPIO1_IO2 0x08 >; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/518 ARM: versatile: fix OF node leak in CPUs prepare
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f2642d97f2105ed17b2ece0c597450f2ff95d704 ]
Machine code is leaking OF node reference from of_find_matching_node() in realview_smp_prepare_cpus().
--- arch/arm/mach-realview/platsmp-dt.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-realview/platsmp-dt.c +1 -0
@@ -66,6 +66,7 @@ static void __init realview_smp_prepare_cpus(unsigned int max_cpus)return ; } map =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (map)) {pr_err ("PLATSMP: No syscon regmap\n" );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/518 reset: berlin: fix OF node leak in probe() error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5f58a88cc91075be38cec69b7cb70aaa4ba69e8b ]
Driver is leaking OF node reference on memory allocation failure. Acquire the OF node reference after memory allocation to fix this and keep it simple.
--- drivers/reset/reset-berlin.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/reset/reset-berlin.c +2 -1
@@ -68,13 +68,14 @@ static int berlin_reset_xlate(struct reset_controller_dev *rcdev,static int berlin2_reset_probe (struct platform_device *pdev) { -struct device_node *parent_np =of_get_parent (pdev->dev.of_node); +struct device_node *parent_np;struct berlin_reset_priv *priv; priv =devm_kzalloc (&pdev->dev,sizeof (*priv),GFP_KERNEL );if (!priv)return -ENOMEM ; + parent_np =of_get_parent (pdev->dev.of_node); priv->regmap =syscon_node_to_regmap (parent_np);of_node_put (parent_np);if (IS_ERR (priv->regmap))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/518 clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankit Agrawal <[email protected]>
[ Upstream commit ca140a0dc0a18acd4653b56db211fec9b2339986 ]
Add the missing iounmap() when clock frequency fails to get read by the of_property_read_u32() call, or if the call to msm_timer_init() fails.
--- drivers/clocksource/timer-qcom.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/clocksource/timer-qcom.c +6 -1
@@ -233,6 +233,7 @@ static int __init msm_dt_timer_init(struct device_node *np) }if (of_property_read_u32 (np,"clock-frequency" , &freq)) { +iounmap (cpu0_base);pr_err ("Unknown frequency\n" );return -EINVAL ; }
@@ -243,7 +244,11 @@ static int __init msm_dt_timer_init(struct device_node *np) freq /=4 ;writel_relaxed (DGT_CLK_CTL_DIV_4 , source_base +DGT_CLK_CTL ); -return msm_timer_init (freq,32 , irq, !!percpu_offset); + ret =msm_timer_init (freq,32 , irq, !!percpu_offset); +if (ret) +iounmap (cpu0_base); + +return ret; }TIMER_OF_DECLARE (kpss_timer,"qcom,kpss-timer" , msm_dt_timer_init);TIMER_OF_DECLARE (scss_timer,"qcom,scss-timer" , msm_dt_timer_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/518 m68k: Fix kernel_clone_args.flags in m68k_clone()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 09b3d870faa7bc3e96c0978ab3cf4e96e4b15571 ]
Stan Johnson recently reported a failure from the 'dump' command:
DUMP: Date of this level 0 dump: Fri Aug 9 23:37:15 2024
DUMP: Dumping /dev/sda (an unlisted file system) to /dev/null
DUMP: Label: none
DUMP: Writing 10 Kilobyte records
DUMP: mapping (Pass I) [regular files]
DUMP: mapping (Pass II) [directories]
DUMP: estimated 3595695 blocks.
DUMP: Context save fork fails in parent 671
The dump program uses the clone syscall with the CLONE_IO flag, that is, flags == 0x80000000. When that value is promoted from long int to u64 by m68k_clone(), it undergoes sign-extension. The new value includes CLONE_INTO_CGROUP so the validation in cgroup_css_set_fork() fails and the syscall returns -EBADF. Avoid sign-extension by casting to u32.
--- arch/m68k/kernel/process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/kernel/process.c +1 -1
@@ -116,7 +116,7 @@ asmlinkage int m68k_clone(struct pt_regs *regs) {/* regs will be equal to current_pt_regs() */ struct kernel_clone_args args = { - .flags = regs->d1 & ~CSIGNAL , + .flags = (u32)(regs->d1) & ~CSIGNAL , .pidfd = (int __user *)regs->d3, .child_tid = (int __user *)regs->d4, .parent_tid = (int __user *)regs->d3,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/518 hwmon: (max16065) Fix overflows seen when writing limits
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 744ec4477b11c42e2c8de9eb8364675ae7a0bd81 ]
Writing large limits resulted in overflows as reported by module tests.
in0_lcrit: Suspected overflow: [max=5538, read 0, written 2147483647]in0_crit: Suspected overflow: [max=5538, read 0, written 2147483647]in0_min: Suspected overflow: [max=5538, read 0, written 2147483647]
Fix the problem by clamping prior to multiplications and the use of DIV_ROUND_CLOSEST, and by using consistent variable types.
--- drivers/hwmon/max16065.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hwmon/max16065.c +3 -2
@@ -114,9 +114,10 @@ static inline int LIMIT_TO_MV(int limit, int range)return limit * range /256 ; } -static inline int MV_TO_LIMIT (int mv,int range) +static inline int MV_TO_LIMIT (unsigned long mv,int range) { -return clamp_val (DIV_ROUND_CLOSEST (mv *256 , range),0 ,255 ); + mv =clamp_val (mv,0 ,ULONG_MAX /256 ); +return DIV_ROUND_CLOSEST (clamp_val (mv *256 ,0 , range *255 ), range); }static inline int ADC_TO_CURR (int adc,int gain)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/518 i2c: Add i2c_get_match_data()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 564d73c4d9201526bd976b9379d2aaf1a7133e84 ]
Add i2c_get_match_data() to get match data for I2C, ACPI and DT-based matching, so that we can optimize the driver code.
Stable-dep-of: 119abf7d1815 ("hwmon: (max16065) Fix alarm attributes")
--- drivers/i2c/i2c-core-base.c | 19 +++++++++++++++++++ include/linux/i2c.h | 2 ++ 2 files changed, 21 insertions(+)
drivers/i2c/i2c-core-base.c +19 -0
@@ -92,6 +92,25 @@ const struct i2c_device_id *i2c_match_id(const struct i2c_device_id *id, }EXPORT_SYMBOL_GPL (i2c_match_id); +const void *i2c_get_match_data (const struct i2c_client *client) +{ +struct i2c_driver *driver =to_i2c_driver (client->dev.driver); +const struct i2c_device_id *match; +const void *data; + + data =device_get_match_data (&client->dev); +if (!data) { + match =i2c_match_id (driver->id_table, client); +if (!match) +return NULL ; + + data = (const void *)match->driver_data; + } + +return data; +} +EXPORT_SYMBOL (i2c_get_match_data); +static int i2c_device_match (struct device *dev,struct device_driver *drv) {struct i2c_client *client =i2c_verify_client (dev);
include/linux/i2c.h +2 -0
@@ -342,6 +342,8 @@ struct i2c_adapter *i2c_verify_adapter(struct device *dev);const struct i2c_device_id *i2c_match_id (const struct i2c_device_id *id,const struct i2c_client *client); +const void *i2c_get_match_data (const struct i2c_client *client); +static inline struct i2c_client *kobj_to_i2c_client (struct kobject *kobj) {struct device *const dev =kobj_to_dev (kobj);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/518 hwmon: (max16065) Remove use of i2c_match_id()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit 5a71654b398e3471f0169c266a3587cf09e1200c ]
The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data().
This helper has a couple other benefits:
* It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove those or move the i2c_device_id table down to its more natural spot with the other module info.
* It also checks for device match data, which allows for OF and ACPI based probing. That means we do not have to manually check those first and can remove those checks.
Stable-dep-of: 119abf7d1815 ("hwmon: (max16065) Fix alarm attributes")
--- drivers/hwmon/max16065.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/hwmon/max16065.c +4 -6
@@ -494,8 +494,6 @@ static const struct attribute_group max16065_max_group = { .is_visible = max16065_secondary_is_visible, }; -static const struct i2c_device_id max16065_id[]; -static int max16065_probe (struct i2c_client *client) {struct i2c_adapter *adapter = client->adapter;
@@ -506,7 +504,7 @@ static int max16065_probe(struct i2c_client *client)bool have_secondary;/* true if chip has secondary limits */ bool secondary_is_max = false;/* secondary limits reflect max */ int groups =0 ; -const struct i2c_device_id *id =i2c_match_id (max16065_id, client); +enum chips chip = (uintptr_t )i2c_get_match_data (client);if (!i2c_check_functionality (adapter,I2C_FUNC_SMBUS_BYTE_DATA |I2C_FUNC_SMBUS_READ_WORD_DATA ))
@@ -519,9 +517,9 @@ static int max16065_probe(struct i2c_client *client) data->client = client;mutex_init (&data->update_lock); - data->num_adc = max16065_num_adc[id->driver_data]; - data->have_current = max16065_have_current[id->driver_data]; - have_secondary = max16065_have_secondary[id->driver_data]; + data->num_adc = max16065_num_adc[chip]; + data->have_current = max16065_have_current[chip]; + have_secondary = max16065_have_secondary[chip];if (have_secondary) { val =i2c_smbus_read_byte_data (client,MAX16065_SW_ENABLE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/518 hwmon: (max16065) Fix alarm attributes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 119abf7d1815f098f7f91ae7abc84324a19943d7 ]
Chips reporting overcurrent alarms report it in the second alarm register. That means the second alarm register has to be read, even if the chip only supports 8 or fewer ADC channels.
MAX16067 and MAX16068 report undervoltage and overvoltage alarms in separate registers. Fold register contents together to report both with the existing alarm attribute. This requires actually storing the chip type in struct max16065_data. Rename the variable 'chip' to match the variable name used in the probe function.
--- drivers/hwmon/max16065.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/hwmon/max16065.c +10 -2
@@ -79,7 +79,7 @@ static const bool max16065_have_current[] = { };struct max16065_data { -enum chips type; +enum chips chip;struct i2c_client *client;const struct attribute_group *groups[4 ];struct mutex update_lock;
@@ -162,10 +162,17 @@ static struct max16065_data *max16065_update_device(struct device *dev) MAX16065_CURR_SENSE); } -for (i =0 ; i <DIV_ROUND_UP (data->num_adc,8 ); i++) +for (i =0 ; i <2 ; i++) data->fault[i] =i2c_smbus_read_byte_data (client,MAX16065_FAULT (i)); +/* +* MAX16067 and MAX16068 have separate undervoltage and +* overvoltage alarm bits. Squash them together. +*/ +if (data->chip == max16067 || data->chip == max16068) + data->fault[0 ] |= data->fault[1 ]; + data->last_updated = jiffies; data->valid =1 ; }
@@ -514,6 +521,7 @@ static int max16065_probe(struct i2c_client *client)if (unlikely (!data))return -ENOMEM ; + data->chip = chip; data->client = client;mutex_init (&data->update_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/518 mtd: slram: insert break after errors in parsing the map
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mirsad Todorovac <[email protected]>
[ Upstream commit 336c218dd7f0588ed8a7345f367975a00a4f003f ]
GCC 12.3.0 compiler on linux-next next-20240709 tree found the execution path in which, due to lazy evaluation, devlength isn't initialised with the parsed string:
289 while (map) {
290 devname = devstart = devlength = NULL;
291
292 if (!(devname = strsep(&map, ","))) {
293 E("slram: No devicename specified.\n");
294 break;
295 }
296 T("slram: devname = %s\n", devname);
297 if ((!map) || (!(devstart = strsep(&map, ",")))) {
298 E("slram: No devicestart specified.\n");
299 }
300 T("slram: devstart = %s\n", devstart);
→ 301 if ((!map) || (!(devlength = strsep(&map, ",")))) {
302 E("slram: No devicelength / -end specified.\n");
303 }
→ 304 T("slram: devlength = %s\n", devlength);
305 if (parse_cmdline(devname, devstart, devlength) != 0) {
306 return(-EINVAL);
307 }
Parsing should be finished after map == NULL, so a break is best inserted after each E("slram: ... \n") error message.
--- drivers/mtd/devices/slram.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mtd/devices/slram.c +2 -0
@@ -296,10 +296,12 @@ static int __init init_slram(void)T ("slram: devname = %s\n" , devname);if ((!map) || (!(devstart =strsep (&map,"," )))) {E ("slram: No devicestart specified.\n" ); +break ; }T ("slram: devstart = %s\n" , devstart);if ((!map) || (!(devlength =strsep (&map,"," )))) {E ("slram: No devicelength / -end specified.\n" ); +break ; }T ("slram: devlength = %s\n" , devlength);if (parse_cmdline (devname, devstart, devlength) !=0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/518 hwmon: (ntc_thermistor) fix module autoloading
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Liu <[email protected]>
[ Upstream commit b6964d66a07a9003868e428a956949e17ab44d7e ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
Message-ID: <[email protected]>
--- drivers/hwmon/ntc_thermistor.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/ntc_thermistor.c +1 -0
@@ -58,6 +58,7 @@ static const struct platform_device_id ntc_thermistor_id[] = { [NTC_NCP21WB473] = { "ncp21wb473", TYPE_NCPXXWB473 }, [NTC_LAST ] = { }, }; +MODULE_DEVICE_TABLE (platform ,ntc_thermistor_id );/* * A compensation table should be sorted by the values of .ohm
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/518 power: supply: axp20x_battery: allow disabling battery charging
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermann Lauer <[email protected]>
[ Upstream commit 6a0fcc87c9e35191d37a8819fdab9d30e523515b ]
Allow disabling and re-enabling battery charging of an axp209 PMIC through a writable status property. With the current driver code charging is always on.
This works on the axp209 of Banana {Pi M1+,Pro} and should work on all AXP chips.
Stable-dep-of: 61978807b00f ("power: supply: axp20x_battery: Remove design from min and max voltage")
--- drivers/power/supply/axp20x_battery.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/power/supply/axp20x_battery.c +15 -2
@@ -40,6 +40,7 @@#define AXP209_FG_PERCENT GENMASK(6, 0)#define AXP22X_FG_VALID BIT(7) +#define AXP20X_CHRG_CTRL1_ENABLE BIT(7)#define AXP20X_CHRG_CTRL1_TGT_VOLT GENMASK(6, 5)#define AXP20X_CHRG_CTRL1_TGT_4_1V (0 << 5)#define AXP20X_CHRG_CTRL1_TGT_4_15V (1 << 5)
@@ -467,7 +468,18 @@ static int axp20x_battery_set_prop(struct power_supply *psy,case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX :return axp20x_set_max_constant_charge_current (axp20x_batt, val->intval); - +case POWER_SUPPLY_PROP_STATUS : +switch (val->intval) { +case POWER_SUPPLY_STATUS_CHARGING : +return regmap_update_bits (axp20x_batt->regmap,AXP20X_CHRG_CTRL1 , +AXP20X_CHRG_CTRL1_ENABLE ,AXP20X_CHRG_CTRL1_ENABLE ); + +case POWER_SUPPLY_STATUS_DISCHARGING : +case POWER_SUPPLY_STATUS_NOT_CHARGING : +return regmap_update_bits (axp20x_batt->regmap,AXP20X_CHRG_CTRL1 , +AXP20X_CHRG_CTRL1_ENABLE ,0 ); + } + fallthrough;default :return -EINVAL ; }
@@ -490,7 +502,8 @@ static enum power_supply_property axp20x_battery_props[] = {static int axp20x_battery_prop_writeable (struct power_supply *psy,enum power_supply_property psp) { -return psp ==POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN || +return psp ==POWER_SUPPLY_PROP_STATUS || + psp ==POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN || psp ==POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN || psp ==POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT || psp ==POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/518 power: supply: axp20x_battery: Remove design from min and max voltage
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <[email protected]>
[ Upstream commit 61978807b00f8a1817b0e5580981af1cd2f428a5 ]
The POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN and POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN values should be immutable properties of the battery, but for this driver they are writable values and used as the minimum and maximum values for charging. Remove the DESIGN designation from these values.
--- drivers/power/supply/axp20x_battery.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/power/supply/axp20x_battery.c +8 -8
@@ -304,11 +304,11 @@ static int axp20x_battery_get_prop(struct power_supply *psy, val->intval = reg &AXP209_FG_PERCENT ;break ; -case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MAX :return axp20x_batt->data->get_max_voltage (axp20x_batt, &val->intval); -case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MIN : ret =regmap_read (axp20x_batt->regmap,AXP20X_V_OFF , ®);if (ret)return ret;
@@ -456,10 +456,10 @@ static int axp20x_battery_set_prop(struct power_supply *psy,struct axp20x_batt_ps *axp20x_batt =power_supply_get_drvdata (psy);switch (psp) { -case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MIN :return axp20x_set_voltage_min_design (axp20x_batt, val->intval); -case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN : +case POWER_SUPPLY_PROP_VOLTAGE_MAX :return axp20x_batt->data->set_max_voltage (axp20x_batt, val->intval);case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT :
@@ -494,8 +494,8 @@ static enum power_supply_property axp20x_battery_props[] = {POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT ,POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX ,POWER_SUPPLY_PROP_HEALTH , -POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN , -POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN , +POWER_SUPPLY_PROP_VOLTAGE_MAX , +POWER_SUPPLY_PROP_VOLTAGE_MIN , POWER_SUPPLY_PROP_CAPACITY, };
@@ -503,8 +503,8 @@ static int axp20x_battery_prop_writeable(struct power_supply *psy, enum power_supply_property psp) {return psp ==POWER_SUPPLY_PROP_STATUS || - psp ==POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN || - psp ==POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN || + psp ==POWER_SUPPLY_PROP_VOLTAGE_MIN || + psp ==POWER_SUPPLY_PROP_VOLTAGE_MAX || psp ==POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT || psp ==POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/518 power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 3a3acf839b2cedf092bdd1ff65b0e9895df1656b ]
Commit 223a3b82834f ("power: supply: max17042_battery: use VFSOC for capacity when no rsns") made it so that capacity on systems without current sensing would be read from VFSOC instead of RepSOC. However, the SOC threshold calculation still read RepSOC to get the SOC regardless of the current sensing option state.
Fix this by applying the same conditional to determine which register should be read.
This also seems to be the intended behavior as per the datasheet - SOC alert config value in MiscCFG on setups without current sensing is set to a value of 0b11, indicating SOC alerts being generated based on VFSOC, instead of 0b00 which indicates SOC alerts being generated based on RepSOC.
This fixes an issue on the Galaxy S3/Midas boards, where the alert interrupt would be constantly retriggered, causing high CPU usage on idle (around ~12%-15%).
--- drivers/power/supply/max17042_battery.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/power/supply/max17042_battery.c +4 -1
@@ -851,7 +851,10 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off)/* program interrupt thesholds such that we should * get interrupt for every 'off' perc change in the soc */ -regmap_read (map, MAX17042_RepSOC, &soc); +if (chip->pdata->enable_current_sense) +regmap_read (map, MAX17042_RepSOC, &soc); +else +regmap_read (map,MAX17042_VFSOC , &soc); soc >>=8 ; soc_tr = (soc + off) <<8 ;if (off < soc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/518 fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit aa578e897520f32ae12bec487f2474357d01ca9c ]
If an error occurs after request_mem_region(), a corresponding release_mem_region() should be called, as already done in the remove function.
--- drivers/video/fbdev/hpfb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/hpfb.c +1 -0
@@ -344,6 +344,7 @@ static int hpfb_dio_probe(struct dio_dev *d, const struct dio_device_id *ent)if (hpfb_init_one (paddr, vaddr)) {if (d->scode >=DIOII_SCBASE )iounmap ((void *)vaddr); +release_mem_region (d->resource.start,resource_size (&d->resource));return -ENOMEM ; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/518 mtd: powernv: Add check devm_kasprintf() returned value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit 395999829880a106bb95f0ce34e6e4c2b43c6a5d ]
devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked.
--- drivers/mtd/devices/powernv_flash.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mtd/devices/powernv_flash.c +3 -0
@@ -204,6 +204,9 @@ static int powernv_flash_set_driver_info(struct device *dev,* get them */ mtd->name =devm_kasprintf (dev,GFP_KERNEL ,"%pOFP" , dev->of_node); +if (!mtd->name) +return -ENOMEM ; + mtd->type =MTD_NORFLASH ; mtd->flags =MTD_WRITEABLE ; mtd->size = size;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/518 drm/stm: Fix an error handling path in stm_drm_platform_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit ce7c90bfda2656418c69ba0dd8f8a7536b8928d4 ]
If drm_dev_register() fails, a call to drv_load() must be undone, as already done in the remove function.
--- drivers/gpu/drm/stm/drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/stm/drv.c +3 -1
@@ -195,12 +195,14 @@ static int stm_drm_platform_probe(struct platform_device *pdev) ret =drm_dev_register (ddev,0 );if (ret) - goto err_put; + goto err_unload;drm_fbdev_generic_setup (ddev,16 );return 0 ; +err_unload: +drv_unload (ddev); err_put:drm_dev_put (ddev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/518 drm/amdgpu: Replace one-element array with flexible-array member
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Miguel Almeida <[email protected]>
[ Upstream commit 320e2590e281d0a7865e861f50155b5b435e9813 ]
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct _ATOM_FAKE_EDID_PATCH_RECORD and refactor the rest of the code accordingly.
Important to mention is that doing a build before/after this patch results in no binary output differences.
This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1].
Stable-dep-of: 8155566a26b8 ("drm/amdgpu: properly handle vbios fake edid sizing")
--- drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 7 +++++-- drivers/gpu/drm/amd/include/atombios.h | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/atombios_encoders.c +5 -2
@@ -2113,8 +2113,11 @@ amdgpu_atombios_encoder_get_lcd_info(struct amdgpu_encoder *encoder) } } record += fake_edid_record->ucFakeEDIDLength ? - fake_edid_record->ucFakeEDIDLength +2 : -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ); +struct_size (fake_edid_record, + ucFakeEDIDString, + fake_edid_record->ucFakeEDIDLength) : +/* empty fake edid record must be 3 bytes long */ +sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
drivers/gpu/drm/amd/include/atombios.h +1 -1
@@ -4107,7 +4107,7 @@ typedef struct _ATOM_FAKE_EDID_PATCH_RECORD {UCHAR ucRecordType;UCHAR ucFakeEDIDLength;// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128 -UCHAR ucFakeEDIDString[1 ];// This actually has ucFakeEdidLength elements. +UCHAR ucFakeEDIDString[];// This actually has ucFakeEdidLength elements. }ATOM_FAKE_EDID_PATCH_RECORD ; typedef struct _ATOM_PANEL_RESOLUTION_PATCH_RECORD
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/518 drm/amdgpu: properly handle vbios fake edid sizing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 8155566a26b8d6c1dd914f06a0c652e4e2f2adf1 ]
The comment in the vbios structure says:
// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
This fake edid struct has not been used in a long time, so I'm not sure if there were actually any boards out there with a non-128 byte EDID, but align the code with the comment.
--- .../gpu/drm/amd/amdgpu/atombios_encoders.c | 29 ++++++++++--------- 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/amdgpu/atombios_encoders.c +16 -13
@@ -2098,26 +2098,29 @@ amdgpu_atombios_encoder_get_lcd_info(struct amdgpu_encoder *encoder) fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;if (fake_edid_record->ucFakeEDIDLength) {struct edid *edid; -int edid_size = -max ((int )EDID_LENGTH , (int )fake_edid_record->ucFakeEDIDLength); - edid =kmalloc (edid_size,GFP_KERNEL ); +int edid_size; + +if (fake_edid_record->ucFakeEDIDLength ==128 ) + edid_size = fake_edid_record->ucFakeEDIDLength; +else + edid_size = fake_edid_record->ucFakeEDIDLength *128 ; + edid =kmemdup (&fake_edid_record->ucFakeEDIDString[0 ], + edid_size,GFP_KERNEL );if (edid) { -memcpy ((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0 ], - fake_edid_record->ucFakeEDIDLength); -if (drm_edid_is_valid (edid)) { adev->mode_info.bios_hardcoded_edid = edid; adev->mode_info.bios_hardcoded_edid_size = edid_size; - }else + }else {kfree (edid); + } } + record +=struct_size (fake_edid_record, + ucFakeEDIDString, + edid_size); + }else { +/* empty fake edid record must be 3 bytes long */ + record +=sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ; } - record += fake_edid_record->ucFakeEDIDLength ? -struct_size (fake_edid_record, - ucFakeEDIDString, - fake_edid_record->ucFakeEDIDLength) : -/* empty fake edid record must be 3 bytes long */ -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/518 drm/radeon: Replace one-element array with flexible-array member
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Miguel Almeida <[email protected]>
[ Upstream commit c81c5bd5cf2f428867e0bcfcccd4e4d2f8c68f51 ]
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct _ATOM_FAKE_EDID_PATCH_RECORD and refactor the rest of the code accordingly.
It's worth mentioning that doing a build before/after this patch results in no binary output differences.
This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1].
Stable-dep-of: 17c6baff3d5f ("drm/radeon: properly handle vbios fake edid sizing")
--- drivers/gpu/drm/radeon/atombios.h | 2 +- drivers/gpu/drm/radeon/radeon_atombios.c | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/atombios.h +1 -1
@@ -3615,7 +3615,7 @@ typedef struct _ATOM_FAKE_EDID_PATCH_RECORD {UCHAR ucRecordType;UCHAR ucFakeEDIDLength; -UCHAR ucFakeEDIDString[1 ];// This actually has ucFakeEdidLength elements. +UCHAR ucFakeEDIDString[];// This actually has ucFakeEdidLength elements. }ATOM_FAKE_EDID_PATCH_RECORD ; typedef struct _ATOM_PANEL_RESOLUTION_PATCH_RECORD
drivers/gpu/drm/radeon/radeon_atombios.c +5 -2
@@ -1735,8 +1735,11 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct } } record += fake_edid_record->ucFakeEDIDLength ? - fake_edid_record->ucFakeEDIDLength +2 : -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ); +struct_size (fake_edid_record, + ucFakeEDIDString, + fake_edid_record->ucFakeEDIDLength) : +/* empty fake edid record must be 3 bytes long */ +sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/518 drm/radeon: properly handle vbios fake edid sizing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 17c6baff3d5f65c8da164137a58742541a060b2f ]
The comment in the vbios structure says:
// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
This fake edid struct has not been used in a long time, so I'm not sure if there were actually any boards out there with a non-128 byte EDID, but align the code with the comment.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 29 +++++++++++++----------- 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +16 -13
@@ -1720,26 +1720,29 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;if (fake_edid_record->ucFakeEDIDLength) {struct edid *edid; -int edid_size = -max ((int )EDID_LENGTH , (int )fake_edid_record->ucFakeEDIDLength); - edid =kmalloc (edid_size,GFP_KERNEL ); +int edid_size; + +if (fake_edid_record->ucFakeEDIDLength ==128 ) + edid_size = fake_edid_record->ucFakeEDIDLength; +else + edid_size = fake_edid_record->ucFakeEDIDLength *128 ; + edid =kmemdup (&fake_edid_record->ucFakeEDIDString[0 ], + edid_size,GFP_KERNEL );if (edid) { -memcpy ((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0 ], - fake_edid_record->ucFakeEDIDLength); -if (drm_edid_is_valid (edid)) { rdev->mode_info.bios_hardcoded_edid = edid; rdev->mode_info.bios_hardcoded_edid_size = edid_size; - }else + }else {kfree (edid); + } } + record +=struct_size (fake_edid_record, + ucFakeEDIDString, + edid_size); + }else { +/* empty fake edid record must be 3 bytes long */ + record +=sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ; } - record += fake_edid_record->ucFakeEDIDLength ? -struct_size (fake_edid_record, - ucFakeEDIDString, - fake_edid_record->ucFakeEDIDLength) : -/* empty fake edid record must be 3 bytes long */ -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/518 drm/rockchip: vop: Allow 4096px width scaling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <[email protected]>
[ Upstream commit 0ef968d91a20b5da581839f093f98f7a03a804f7 ]
There is no reason to limit VOP scaling to 3840px width, the limit of RK3288, when there are newer VOP versions that support 4096px width.
Change to enforce a maximum of 4096px width plane scaling, the maximum supported output width of the VOP versions supported by this driver.
--- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop.c +2 -2
@@ -370,8 +370,8 @@ static void scl_vop_cal_scl_fac(struct vop *vop, const struct vop_win_data *win,if (info->is_yuv) is_yuv = true; -if (dst_w >3840 ) { -DRM_DEV_ERROR (vop->dev,"Maximum dst width (3840) exceeded\n" ); +if (dst_w >4096 ) { +DRM_DEV_ERROR (vop->dev,"Maximum dst width (4096) exceeded\n" );return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/518 drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit a5d024541ec466f428e6c514577d511a40779c7b ]
EDID cannot be read on RK3328 until after read_hpd has been called and correct io voltage has been configured based on connection status.
When a forced mode is used, e.g. video=1920x1080@60e, the connector detect ops, that in turn normally calls the read_hpd, never gets called.
This result in reading EDID to fail in connector get_modes ops.
Call dw_hdmi_rk3328_read_hpd at end of dw_hdmi_rk3328_setup_hpd to correct io voltage and allow reading EDID after setup_hpd.
--- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c +2 -0
@@ -389,6 +389,8 @@ static void dw_hdmi_rk3328_setup_hpd(struct dw_hdmi *dw_hdmi, void *data)HIWORD_UPDATE (RK3328_HDMI_SDAIN_MSK |RK3328_HDMI_SCLIN_MSK ,RK3328_HDMI_SDAIN_MSK |RK3328_HDMI_SCLIN_MSK | RK3328_HDMI_HPD_IOE)); + +dw_hdmi_rk3328_read_hpd (dw_hdmi, data); }static const struct dw_hdmi_phy_ops rk3228_hdmi_phy_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/518 drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 3fbaf475a5b8361ebee7da18964db809e37518b7 ]
Several cs track offsets (such as 'track->db_s_read_offset') either are initialized with or plainly take big enough values that, once shifted 8 bits left, may be hit with integer overflow if the resulting values end up going over u32 limit.
Same goes for a few instances of 'surf.layer_size * mslice' multiplications that are added to 'offset' variable - they may potentially overflow as well and need to be validated properly.
While some debug prints in this code section take possible overflow issues into account, simply casting to (unsigned long) may be erroneous in its own way, as depending on CPU architecture one is liable to get different results.
Fix said problems by:
- casting 'offset' to fixed u64 data type instead of ambiguous unsigned long.
- casting one of the operands in vulnerable to integer overflow cases to u64.
- adjust format specifiers in debug prints to properly represent 'offset' values.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/gpu/drm/radeon/evergreen_cs.c | 62 +++++++++++++-------------- 1 file changed, 31 insertions(+), 31 deletions(-)
drivers/gpu/drm/radeon/evergreen_cs.c +31 -31
@@ -396,7 +396,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned istruct evergreen_cs_track *track = p->track;struct eg_surface surf;unsigned pitch, slice, mslice; -unsigned long offset; +u64 offset;int r; mslice =G_028C6C_SLICE_MAX (track->cb_color_view[id]) +1 ;
@@ -434,14 +434,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned ireturn r; } - offset = track->cb_color_bo_offset[id] <<8 ; + offset = (u64 )track->cb_color_bo_offset[id] <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d cb[%d] bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d cb[%d] bo base %llu not aligned with %ld\n" , __func__, __LINE__, id, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->cb_color_bo[id])) {/* old ddx are broken they allocate bo with w*h*bpp but * program slice with ALIGN(h, 8), catch this and patch
@@ -449,14 +449,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i*/ if (!surf.mode) {uint32_t *ib = p->ib.ptr; -unsigned long tmp, nby, bsize, size, min =0 ; +u64 tmp, nby, bsize, size, min =0 ;/* find the height the ddx wants */ if (surf.nby >8 ) { min = surf.nby -8 ; } bsize =radeon_bo_size (track->cb_color_bo[id]); - tmp = track->cb_color_bo_offset[id] <<8 ; + tmp = (u64 )track->cb_color_bo_offset[id] <<8 ;for (nby = surf.nby; nby > min; nby--) { size = nby * surf.nbx * surf.bpe * surf.nsamples;if ((tmp + size * mslice) <= bsize) {
@@ -468,7 +468,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i slice = ((nby * surf.nbx) /64 ) -1 ;if (!evergreen_surface_check (p, &surf,"cb" )) {/* check if this one works */ - tmp += surf.layer_size * mslice; + tmp += (u64 )surf.layer_size * mslice;if (tmp <= bsize) { ib[track->cb_color_slice_idx[id]] = slice; goto old_ddx_ok;
@@ -477,9 +477,9 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i } }dev_warn (p->dev,"%s:%d cb[%d] bo too small (layer size %d, " -"offset %d, max layer %d, bo size %ld, slice %d)\n" , +"offset %llu, max layer %d, bo size %ld, slice %d)\n" , __func__, __LINE__, id, surf.layer_size, - track->cb_color_bo_offset[id] <<8 , mslice, + (u64 )track->cb_color_bo_offset[id] <<8 , mslice,radeon_bo_size (track->cb_color_bo[id]), slice); dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n", __func__, __LINE__, surf.nbx, surf.nby,
@@ -563,7 +563,7 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)struct evergreen_cs_track *track = p->track;struct eg_surface surf;unsigned pitch, slice, mslice; -unsigned long offset; +u64 offset;int r; mslice =G_028008_SLICE_MAX (track->db_depth_view) +1 ;
@@ -609,18 +609,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)return r; } - offset = track->db_s_read_offset <<8 ; + offset = (u64 )track->db_s_read_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil read bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil read bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_s_read_bo)) {dev_warn (p->dev,"%s:%d stencil read bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_s_read_offset <<8 , mslice, + (u64 )track->db_s_read_offset <<8 , mslice,radeon_bo_size (track->db_s_read_bo)); dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n", __func__, __LINE__, track->db_depth_size,
@@ -628,18 +628,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)return -EINVAL ; } - offset = track->db_s_write_offset <<8 ; + offset = (u64 )track->db_s_write_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil write bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil write bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_s_write_bo)) {dev_warn (p->dev,"%s:%d stencil write bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_s_write_offset <<8 , mslice, + (u64 )track->db_s_write_offset <<8 , mslice,radeon_bo_size (track->db_s_write_bo));return -EINVAL ; }
@@ -660,7 +660,7 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)struct evergreen_cs_track *track = p->track;struct eg_surface surf;unsigned pitch, slice, mslice; -unsigned long offset; +u64 offset;int r; mslice =G_028008_SLICE_MAX (track->db_depth_view) +1 ;
@@ -707,34 +707,34 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)return r; } - offset = track->db_z_read_offset <<8 ; + offset = (u64 )track->db_z_read_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil read bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil read bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_z_read_bo)) {dev_warn (p->dev,"%s:%d depth read bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_z_read_offset <<8 , mslice, + (u64 )track->db_z_read_offset <<8 , mslice,radeon_bo_size (track->db_z_read_bo));return -EINVAL ; } - offset = track->db_z_write_offset <<8 ; + offset = (u64 )track->db_z_write_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil write bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil write bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_z_write_bo)) {dev_warn (p->dev,"%s:%d depth write bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_z_write_offset <<8 , mslice, + (u64 )track->db_z_write_offset <<8 , mslice,radeon_bo_size (track->db_z_write_bo));return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/518 jfs: fix out-of-bounds in dbNextAG() and diAlloc()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit e63866a475562810500ea7f784099bfe341e761a ]
In dbNextAG() , there is no check for the case where bmp->db_numag is greater or same than MAXAG due to a polluted image, which causes an out-of-bounds. Therefore, a bounds check should be added in dbMount().
And in dbNextAG(), a check for the case where agpref is greater than bmp->db_numag should be added, so an out-of-bounds exception should be prevented.
Additionally, a check for the case where agno is greater or same than MAXAG should be added in diAlloc() to prevent out-of-bounds.
--- fs/jfs/jfs_dmap.c | 4 ++-- fs/jfs/jfs_imap.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
fs/jfs/jfs_dmap.c +2 -2
@@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap) } bmp->db_numag =le32_to_cpu (dbmp_le->dn_numag); -if (!bmp->db_numag) { +if (!bmp->db_numag || bmp->db_numag >=MAXAG ) { err = -EINVAL ; goto err_release_metapage; }
@@ -652,7 +652,7 @@ int dbNextAG(struct inode *ipbmap)* average free space. */ for (i =0 ; i < bmp->db_numag; i++, agpref++) { -if (agpref == bmp->db_numag) +if (agpref >= bmp->db_numag) agpref =0 ;if (atomic_read (&bmp->db_active[agpref]))
fs/jfs/jfs_imap.c +1 -1
@@ -1362,7 +1362,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)/* get the ag number of this iag */ agno =BLKTOAG (JFS_IP (pip)->agstart,JFS_SBI (pip->i_sb)); dn_numag =JFS_SBI (pip->i_sb)->bmap->db_numag; -if (agno <0 || agno > dn_numag) +if (agno <0 || agno > dn_numag || agno >=MAXAG )return -EIO ;if (atomic_read (&JFS_SBI (pip->i_sb)->bmap->db_active[agno])) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/518 drm/msm: Fix incorrect file name output in adreno_request_fw()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit e19366911340c2313a1abbb09c54eaf9bdea4f58 ]
In adreno_request_fw() when debugging information is printed to the log after firmware load, an incorrect filename is printed. 'newname' is used instead of 'fwname', so prefix "qcom/" is being added to filename. Looks like "copy-paste" mistake.
Fix this mistake by replacing 'newname' with 'fwname'.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Patchwork: https://patchwork.freedesktop.org/patch/602382/
--- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.c +1 -1
@@ -308,7 +308,7 @@ adreno_request_fw(struct adreno_gpu *adreno_gpu, const char *fwname) ret =request_firmware_direct (&fw, fwname, drm->dev);if (!ret) {DRM_DEV_INFO (drm->dev,"loaded %s from legacy location\n" , - newname); + fwname); adreno_gpu->fwloc =FW_LOCATION_LEGACY ; goto out; }else if (adreno_gpu->fwloc !=FW_LOCATION_UNKNOWN ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/518 drm/msm/a5xx: disable preemption in submits by default
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Lypak <[email protected]>
[ Upstream commit db9dec2db76146d65e1cfbb6afb2e2bd5dab67f8 ]
Fine grain preemption (switching from/to points within submits) requires extra handling in command stream of those submits, especially when rendering with tiling (using GMEM). However this handling is missing at this point in mesa (and always was). For this reason we get random GPU faults and hangs if more than one priority level is used because local preemption is enabled prior to executing command stream from submit.
With that said it was ahead of time to enable local preemption by default considering the fact that even on downstream kernel it is only enabled if requested via UAPI.
Patchwork: https://patchwork.freedesktop.org/patch/612041/
--- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/adreno/a5xx_gpu.c +6 -2
@@ -143,9 +143,13 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)OUT_PKT7 (ring,CP_SET_PROTECTED_MODE ,1 );OUT_RING (ring,1 ); -/* Enable local preemption for finegrain preemption */ +/* +* Disable local preemption by default because it requires +* user-space to be aware of it and provide additional handling +* to restore rendering state or do various flushes on switch. +*/ OUT_PKT7 (ring,CP_PREEMPT_ENABLE_LOCAL ,1 ); -OUT_RING (ring,0x1 ); +OUT_RING (ring,0x0 );/* Allow CP_CONTEXT_SWITCH_YIELD packets in the IB2 */ OUT_PKT7 (ring,CP_YIELD_ENABLE ,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/518 drm/msm/a5xx: properly clear preemption records on resume
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Lypak <[email protected]>
[ Upstream commit 64fd6d01a52904bdbda0ce810a45a428c995a4ca ]
Two fields of preempt_record which are used by CP aren't reset on
resume: "data" and "info". This is the reason behind faults which happen when we try to switch to the ring that was active last before suspend. In addition those faults can't be recovered from because we use suspend and resume to do so (keeping values of those fields again).
Patchwork: https://patchwork.freedesktop.org/patch/612043/
--- drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/msm/adreno/a5xx_preempt.c +2 -0
@@ -207,6 +207,8 @@ void a5xx_preempt_hw_init(struct msm_gpu *gpu)return ;for (i =0 ; i < gpu->nr_rings; i++) { + a5xx_gpu->preempt[i]->data =0 ; + a5xx_gpu->preempt[i]->info =0 ; a5xx_gpu->preempt[i]->wptr =0 ; a5xx_gpu->preempt[i]->rptr =0 ; a5xx_gpu->preempt[i]->rbase = gpu->rb[i]->iova;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/518 drm/msm/a5xx: fix races in preemption evaluation stage
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Lypak <[email protected]>
[ Upstream commit ce050f307ad93bcc5958d0dd35fc276fd394d274 ]
On A5XX GPUs when preemption is used it's invietable to enter a soft lock-up state in which GPU is stuck at empty ring-buffer doing nothing. This appears as full UI lockup and not detected as GPU hang (because it's not). This happens due to not triggering preemption when it was needed. Sometimes this state can be recovered by some new submit but generally it won't happen because applications are waiting for old submits to retire.
One of the reasons why this happens is a race between a5xx_submit and a5xx_preempt_trigger called from IRQ during submit retire. Former thread updates ring->cur of previously empty and not current ring right after latter checks it for emptiness. Then both threads can just exit because for first one preempt_state wasn't NONE yet and for second one all rings appeared to be empty.
To prevent such situations from happening we need to establish guarantee for preempt_trigger to make decision after each submit or retire. To implement this we serialize preemption initiation using spinlock. If switch is already in progress we need to re-trigger preemption when it finishes.
Patchwork: https://patchwork.freedesktop.org/patch/612045/
--- drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 1 + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 24 +++++++++++++++++++++-- 2 files changed, 23 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/adreno/a5xx_gpu.h +1 -0
@@ -36,6 +36,7 @@ struct a5xx_gpu {uint64_t preempt_iova[MSM_GPU_MAX_RINGS ];atomic_t preempt_state; +spinlock_t preempt_start_lock;struct timer_list preempt_timer;struct drm_gem_object *shadow_bo;
drivers/gpu/drm/msm/adreno/a5xx_preempt.c +22 -2
@@ -98,12 +98,19 @@ void a5xx_preempt_trigger(struct msm_gpu *gpu)if (gpu->nr_rings ==1 )return ; +/* +* Serialize preemption start to ensure that we always make +* decision on latest state. Otherwise we can get stuck in +* lower priority or empty ring. +*/ +spin_lock_irqsave (&a5xx_gpu->preempt_start_lock, flags); +/* * Try to start preemption by moving from NONE to START. If * unsuccessful, a preemption is already in flight */ if (!try_preempt_state (a5xx_gpu,PREEMPT_NONE ,PREEMPT_START )) -return ; + goto out;/* Get the next ring to preempt to */ ring =get_next_ring (gpu);
@@ -128,9 +135,11 @@ void a5xx_preempt_trigger(struct msm_gpu *gpu)set_preempt_state (a5xx_gpu,PREEMPT_ABORT );update_wptr (gpu, a5xx_gpu->cur_ring);set_preempt_state (a5xx_gpu,PREEMPT_NONE ); -return ; + goto out; } +spin_unlock_irqrestore (&a5xx_gpu->preempt_start_lock, flags); +/* Make sure the wptr doesn't update while we're in motion */ spin_lock_irqsave (&ring->preempt_lock, flags); a5xx_gpu->preempt[ring->id]->wptr =get_wptr (ring);
@@ -154,6 +163,10 @@ void a5xx_preempt_trigger(struct msm_gpu *gpu)/* And actually start the preemption */ gpu_write (gpu,REG_A5XX_CP_CONTEXT_SWITCH_CNTL ,1 ); +return ; + +out: +spin_unlock_irqrestore (&a5xx_gpu->preempt_start_lock, flags); }void a5xx_preempt_irq (struct msm_gpu *gpu)
@@ -191,6 +204,12 @@ void a5xx_preempt_irq(struct msm_gpu *gpu)update_wptr (gpu, a5xx_gpu->cur_ring);set_preempt_state (a5xx_gpu,PREEMPT_NONE ); + +/* +* Try to trigger preemption again in case there was a submit or +* retire during ring switch +*/ +a5xx_preempt_trigger (gpu); }void a5xx_preempt_hw_init (struct msm_gpu *gpu)
@@ -305,5 +324,6 @@ void a5xx_preempt_init(struct msm_gpu *gpu) } } +spin_lock_init (&a5xx_gpu->preempt_start_lock);timer_setup (&a5xx_gpu->preempt_timer, a5xx_preempt_timer,0 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/518 drm/msm: Add priv->mm_lock to protect active/inactive lists
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit d984457b31c4c53d2af374d5e78b3eb64debd483 ]
Rather than relying on the big dev->struct_mutex hammer, introduce a more specific lock for protecting the bo lists.
Stable-dep-of: a30f9f65b5ac ("drm/msm/a5xx: workaround early ring-buffer emptiness check")
--- drivers/gpu/drm/msm/msm_debugfs.c | 7 +++++++ drivers/gpu/drm/msm/msm_drv.c | 7 +++++++ drivers/gpu/drm/msm/msm_drv.h | 13 +++++++++++- drivers/gpu/drm/msm/msm_gem.c | 28 +++++++++++++++----------- drivers/gpu/drm/msm/msm_gem_shrinker.c | 12 +++++++++++ drivers/gpu/drm/msm/msm_gpu.h | 5 ++++- 6 files changed, 58 insertions(+), 14 deletions(-)
drivers/gpu/drm/msm/msm_debugfs.c +7 -0
@@ -113,6 +113,11 @@ static int msm_gem_show(struct drm_device *dev, struct seq_file *m) {struct msm_drm_private *priv = dev->dev_private;struct msm_gpu *gpu = priv->gpu; +int ret; + + ret =mutex_lock_interruptible (&priv->mm_lock); +if (ret) +return ret;if (gpu) {seq_printf (m,"Active Objects (%s):\n" , gpu->name);
@@ -122,6 +127,8 @@ static int msm_gem_show(struct drm_device *dev, struct seq_file *m)seq_printf (m,"Inactive Objects:\n" );msm_gem_describe_objects (&priv->inactive_list, m); +mutex_unlock (&priv->mm_lock); +return 0 ; }
drivers/gpu/drm/msm/msm_drv.c +7 -0
@@ -7,6 +7,7 @@#include <linux/dma-mapping.h> #include <linux/kthread.h> +#include <linux/sched/mm.h> #include <linux/uaccess.h> #include <uapi/linux/sched/types.h>
@@ -442,6 +443,12 @@ static int msm_drm_init(struct device *dev, struct drm_driver *drv)init_llist_head (&priv->free_list);INIT_LIST_HEAD (&priv->inactive_list); +mutex_init (&priv->mm_lock); + +/* Teach lockdep about lock ordering wrt. shrinker: */ +fs_reclaim_acquire (GFP_KERNEL ); +might_lock (&priv->mm_lock); +fs_reclaim_release (GFP_KERNEL );drm_mode_config_init (ddev);
drivers/gpu/drm/msm/msm_drv.h +12 -1
@@ -175,8 +175,19 @@ struct msm_drm_private {struct msm_rd_state *hangrd;/* debugfs to dump hanging submits */ struct msm_perf_state *perf; -/* list of GEM objects: */ +/* +* List of inactive GEM objects. Every bo is either in the inactive_list +* or gpu->active_list (for the gpu it is active on[1]) +* +* These lists are protected by mm_lock. If struct_mutex is involved, it +* should be aquired prior to mm_lock. One should *not* hold mm_lock in +* get_pages()/vmap()/etc paths, as they can trigger the shrinker. +* +* [1] if someone ever added support for the old 2d cores, there could be +* more than one gpu object +*/ struct list_head inactive_list; +struct mutex mm_lock;/* worker for delayed free of objects: */ struct work_struct free_work;
drivers/gpu/drm/msm/msm_gem.c +16 -12
@@ -745,13 +745,17 @@ int msm_gem_sync_object(struct drm_gem_object *obj,void msm_gem_active_get (struct drm_gem_object *obj,struct msm_gpu *gpu) {struct msm_gem_object *msm_obj =to_msm_bo (obj); -WARN_ON (!mutex_is_locked (&obj->dev->struct_mutex)); +struct msm_drm_private *priv = obj->dev->dev_private; + +might_sleep ();WARN_ON (msm_obj->madv !=MSM_MADV_WILLNEED );if (!atomic_fetch_inc (&msm_obj->active_count)) { +mutex_lock (&priv->mm_lock); msm_obj->gpu = gpu;list_del_init (&msm_obj->mm_list);list_add_tail (&msm_obj->mm_list, &gpu->active_list); +mutex_unlock (&priv->mm_lock); } }
@@ -760,12 +764,14 @@ void msm_gem_active_put(struct drm_gem_object *obj)struct msm_gem_object *msm_obj =to_msm_bo (obj);struct msm_drm_private *priv = obj->dev->dev_private; -WARN_ON (!mutex_is_locked (&obj->dev->struct_mutex)); +might_sleep ();if (!atomic_dec_return (&msm_obj->active_count)) { +mutex_lock (&priv->mm_lock); msm_obj->gpu =NULL ;list_del_init (&msm_obj->mm_list);list_add_tail (&msm_obj->mm_list, &priv->inactive_list); +mutex_unlock (&priv->mm_lock); } }
@@ -921,13 +927,16 @@ static void free_object(struct msm_gem_object *msm_obj) {struct drm_gem_object *obj = &msm_obj->base;struct drm_device *dev = obj->dev; +struct msm_drm_private *priv = dev->dev_private;WARN_ON (!mutex_is_locked (&dev->struct_mutex));/* object should not be on active list: */ WARN_ON (is_active (msm_obj)); +mutex_lock (&priv->mm_lock);list_del (&msm_obj->mm_list); +mutex_unlock (&priv->mm_lock);mutex_lock (&msm_obj->lock);
@@ -1103,14 +1112,9 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,mapping_set_gfp_mask (obj->filp->f_mapping,GFP_HIGHUSER ); } -if (struct_mutex_locked) { -WARN_ON (!mutex_is_locked (&dev->struct_mutex)); -list_add_tail (&msm_obj->mm_list, &priv->inactive_list); - }else { -mutex_lock (&dev->struct_mutex); -list_add_tail (&msm_obj->mm_list, &priv->inactive_list); -mutex_unlock (&dev->struct_mutex); - } +mutex_lock (&priv->mm_lock); +list_add_tail (&msm_obj->mm_list, &priv->inactive_list); +mutex_unlock (&priv->mm_lock);return obj;
@@ -1174,9 +1178,9 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,mutex_unlock (&msm_obj->lock); -mutex_lock (&dev->struct_mutex); +mutex_lock (&priv->mm_lock);list_add_tail (&msm_obj->mm_list, &priv->inactive_list); -mutex_unlock (&dev->struct_mutex); +mutex_unlock (&priv->mm_lock);return obj;
drivers/gpu/drm/msm/msm_gem_shrinker.c +12 -0
@@ -51,11 +51,15 @@ msm_gem_shrinker_count(struct shrinker *shrinker, struct shrink_control *sc)if (!msm_gem_shrinker_lock (dev, &unlock))return 0 ; +mutex_lock (&priv->mm_lock); +list_for_each_entry (msm_obj, &priv->inactive_list, mm_list) {if (is_purgeable (msm_obj)) count += msm_obj->base.size >>PAGE_SHIFT ; } +mutex_unlock (&priv->mm_lock); +if (unlock)mutex_unlock (&dev->struct_mutex);
@@ -75,6 +79,8 @@ msm_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc)if (!msm_gem_shrinker_lock (dev, &unlock))return SHRINK_STOP ; +mutex_lock (&priv->mm_lock); +list_for_each_entry (msm_obj, &priv->inactive_list, mm_list) {if (freed >= sc->nr_to_scan)break ;
@@ -84,6 +90,8 @@ msm_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc) } } +mutex_unlock (&priv->mm_lock); +if (unlock)mutex_unlock (&dev->struct_mutex);
@@ -106,6 +114,8 @@ msm_gem_shrinker_vmap(struct notifier_block *nb, unsigned long event, void *ptr)if (!msm_gem_shrinker_lock (dev, &unlock))return NOTIFY_DONE ; +mutex_lock (&priv->mm_lock); +list_for_each_entry (msm_obj, &priv->inactive_list, mm_list) {if (is_vunmapable (msm_obj)) {msm_gem_vunmap (&msm_obj->base,OBJ_LOCK_SHRINKER );
@@ -118,6 +128,8 @@ msm_gem_shrinker_vmap(struct notifier_block *nb, unsigned long event, void *ptr) } } +mutex_unlock (&priv->mm_lock); +if (unlock)mutex_unlock (&dev->struct_mutex);
drivers/gpu/drm/msm/msm_gpu.h +4 -1
@@ -94,7 +94,10 @@ struct msm_gpu {struct msm_ringbuffer *rb[MSM_GPU_MAX_RINGS ];int nr_rings; -/* list of GEM active objects: */ +/* +* List of GEM active objects on this gpu. Protected by +* msm_drm_private::mm_lock +*/ struct list_head active_list;/* does gpu need hw_init? */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/518 drm/msm: Drop priv->lastctx
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 1d054c9b8457b56a651109fac21f56f46ccd46b2 ]
cur_ctx_seqno already does the same thing, but handles the edge cases where a refcnt'd context can live after lastclose. So let's not have two ways to do the same thing.
Stable-dep-of: a30f9f65b5ac ("drm/msm/a5xx: workaround early ring-buffer emptiness check")
--- drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 3 +-- drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 3 +-- drivers/gpu/drm/msm/adreno/a4xx_gpu.c | 3 +-- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 8 +++----- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 9 +++------ drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 10 ---------- drivers/gpu/drm/msm/msm_drv.c | 6 ------ drivers/gpu/drm/msm/msm_drv.h | 2 +- drivers/gpu/drm/msm/msm_gpu.c | 2 +- drivers/gpu/drm/msm/msm_gpu.h | 11 +++++++++++ 10 files changed, 22 insertions(+), 35 deletions(-)
drivers/gpu/drm/msm/adreno/a2xx_gpu.c +1 -2
@@ -12,7 +12,6 @@ static bool a2xx_idle(struct msm_gpu *gpu);static void a2xx_submit (struct msm_gpu *gpu,struct msm_gem_submit *submit) { -struct msm_drm_private *priv = gpu->dev->dev_private;struct msm_ringbuffer *ring = submit->ring;unsigned int i;
@@ -23,7 +22,7 @@ static void a2xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)break ;case MSM_SUBMIT_CMD_CTX_RESTORE_BUF :/* ignore if there has not been a ctx switch: */ -if (priv->lastctx == submit->queue->ctx) +if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)break ; fallthrough;case MSM_SUBMIT_CMD_BUF :
drivers/gpu/drm/msm/adreno/a3xx_gpu.c +1 -2
@@ -30,7 +30,6 @@ static bool a3xx_idle(struct msm_gpu *gpu);static void a3xx_submit (struct msm_gpu *gpu,struct msm_gem_submit *submit) { -struct msm_drm_private *priv = gpu->dev->dev_private;struct msm_ringbuffer *ring = submit->ring;unsigned int i;
@@ -41,7 +40,7 @@ static void a3xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)break ;case MSM_SUBMIT_CMD_CTX_RESTORE_BUF :/* ignore if there has not been a ctx switch: */ -if (priv->lastctx == submit->queue->ctx) +if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)break ; fallthrough;case MSM_SUBMIT_CMD_BUF :
drivers/gpu/drm/msm/adreno/a4xx_gpu.c +1 -2
@@ -24,7 +24,6 @@ static bool a4xx_idle(struct msm_gpu *gpu);static void a4xx_submit (struct msm_gpu *gpu,struct msm_gem_submit *submit) { -struct msm_drm_private *priv = gpu->dev->dev_private;struct msm_ringbuffer *ring = submit->ring;unsigned int i;
@@ -35,7 +34,7 @@ static void a4xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)break ;case MSM_SUBMIT_CMD_CTX_RESTORE_BUF :/* ignore if there has not been a ctx switch: */ -if (priv->lastctx == submit->queue->ctx) +if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)break ; fallthrough;case MSM_SUBMIT_CMD_BUF :
drivers/gpu/drm/msm/adreno/a5xx_gpu.c +3 -5
@@ -56,7 +56,6 @@ void a5xx_flush(struct msm_gpu *gpu, struct msm_ringbuffer *ring,static void a5xx_submit_in_rb (struct msm_gpu *gpu,struct msm_gem_submit *submit) { -struct msm_drm_private *priv = gpu->dev->dev_private;struct msm_ringbuffer *ring = submit->ring;struct msm_gem_object *obj;uint32_t *ptr, dwords;
@@ -67,7 +66,7 @@ static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submitcase MSM_SUBMIT_CMD_IB_TARGET_BUF :break ;case MSM_SUBMIT_CMD_CTX_RESTORE_BUF : -if (priv->lastctx == submit->queue->ctx) +if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)break ; fallthrough;case MSM_SUBMIT_CMD_BUF :
@@ -117,12 +116,11 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit) {struct adreno_gpu *adreno_gpu =to_adreno_gpu (gpu);struct a5xx_gpu *a5xx_gpu =to_a5xx_gpu (adreno_gpu); -struct msm_drm_private *priv = gpu->dev->dev_private;struct msm_ringbuffer *ring = submit->ring;unsigned int i, ibs =0 ;if (IS_ENABLED (CONFIG_DRM_MSM_GPU_SUDO ) && submit->in_rb) { - priv->lastctx =NULL ; + gpu->cur_ctx_seqno =0 ;a5xx_submit_in_rb (gpu, submit);return ; }
@@ -161,7 +159,7 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)case MSM_SUBMIT_CMD_IB_TARGET_BUF :break ;case MSM_SUBMIT_CMD_CTX_RESTORE_BUF : -if (priv->lastctx == submit->queue->ctx) +if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)break ; fallthrough;case MSM_SUBMIT_CMD_BUF :
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +3 -6
@@ -99,7 +99,7 @@ static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,u32 asid;u64 memptr =rbmemptr (ring, ttbr0); -if (ctx->seqno == a6xx_gpu->cur_ctx_seqno) +if (ctx->seqno == a6xx_gpu->base.base.cur_ctx_seqno)return ;if (msm_iommu_pagetable_params (ctx->aspace->mmu, &ttbr, &asid))
@@ -131,14 +131,11 @@ static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,OUT_PKT7 (ring,CP_EVENT_WRITE ,1 );OUT_RING (ring,0x31 ); - - a6xx_gpu->cur_ctx_seqno = ctx->seqno; }static void a6xx_submit (struct msm_gpu *gpu,struct msm_gem_submit *submit) {unsigned int index = submit->seqno %MSM_GPU_SUBMIT_STATS_COUNT ; -struct msm_drm_private *priv = gpu->dev->dev_private;struct adreno_gpu *adreno_gpu =to_adreno_gpu (gpu);struct a6xx_gpu *a6xx_gpu =to_a6xx_gpu (adreno_gpu);struct msm_ringbuffer *ring = submit->ring;
@@ -170,7 +167,7 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)case MSM_SUBMIT_CMD_IB_TARGET_BUF :break ;case MSM_SUBMIT_CMD_CTX_RESTORE_BUF : -if (priv->lastctx == submit->queue->ctx) +if (gpu->cur_ctx_seqno == submit->queue->ctx->seqno)break ; fallthrough;case MSM_SUBMIT_CMD_BUF :
@@ -887,7 +884,7 @@ static int a6xx_hw_init(struct msm_gpu *gpu)/* Always come up on rb 0 */ a6xx_gpu->cur_ring = gpu->rb[0 ]; - a6xx_gpu->cur_ctx_seqno =0 ; + gpu->cur_ctx_seqno =0 ;/* Enable the SQE_to start the CP engine */ gpu_write (gpu,REG_A6XX_CP_SQE_CNTL ,1 );
drivers/gpu/drm/msm/adreno/a6xx_gpu.h +0 -10
@@ -20,16 +20,6 @@ struct a6xx_gpu {struct msm_ringbuffer *cur_ring; -/** -* cur_ctx_seqno: -* -* The ctx->seqno value of the context with current pgtables -* installed. Tracked by seqno rather than pointer value to -* avoid dangling pointers, and cases where a ctx can be freed -* and a new one created with the same address. -*/ -int cur_ctx_seqno; -struct a6xx_gmu gmu;struct drm_gem_object *shadow_bo;
drivers/gpu/drm/msm/msm_drv.c +0 -6
@@ -626,14 +626,8 @@ static void context_close(struct msm_file_private *ctx)static void msm_postclose (struct drm_device *dev,struct drm_file *file) { -struct msm_drm_private *priv = dev->dev_private;struct msm_file_private *ctx = file->driver_priv; -mutex_lock (&dev->struct_mutex); -if (ctx == priv->lastctx) - priv->lastctx =NULL ; -mutex_unlock (&dev->struct_mutex); -context_close (ctx); }
drivers/gpu/drm/msm/msm_drv.h +1 -1
@@ -165,7 +165,7 @@ struct msm_drm_private {/* when we have more than one 'msm_gpu' these need to be an array: */ struct msm_gpu *gpu; -struct msm_file_private *lastctx; +/* gpu is only set on open(), but we need this info earlier */ bool is_a2xx;
drivers/gpu/drm/msm/msm_gpu.c +1 -1
@@ -795,7 +795,7 @@ void msm_gpu_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit) } gpu->funcs->submit (gpu, submit); - priv->lastctx = submit->queue->ctx; + gpu->cur_ctx_seqno = submit->queue->ctx->seqno;hangcheck_timer_reset (gpu); }
drivers/gpu/drm/msm/msm_gpu.h +11 -0
@@ -94,6 +94,17 @@ struct msm_gpu {struct msm_ringbuffer *rb[MSM_GPU_MAX_RINGS ];int nr_rings; +/** +* cur_ctx_seqno: +* +* The ctx->seqno value of the last context to submit rendering, +* and the one with current pgtables installed (for generations +* that support per-context pgtables). Tracked by seqno rather +* than pointer value to avoid dangling pointers, and cases where +* a ctx can be freed and a new one created with the same address. +*/ +int cur_ctx_seqno; +/* * List of GEM active objects on this gpu. Protected by * msm_drm_private::mm_lock
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/518 drm/msm/a5xx: workaround early ring-buffer emptiness check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Lypak <[email protected]>
[ Upstream commit a30f9f65b5ac82d4390548c32ed9c7f05de7ddf5 ]
There is another cause for soft lock-up of GPU in empty ring-buffer:
race between GPU executing last commands and CPU checking ring for emptiness. On GPU side IRQ for retire is triggered by CACHE_FLUSH_TS event and RPTR shadow (which is used to check ring emptiness) is updated a bit later from CP_CONTEXT_SWITCH_YIELD. Thus if GPU is executing its last commands slow enough or we check that ring too fast we will miss a chance to trigger switch to lower priority ring because current ring isn't empty just yet. This can escalate to lock-up situation described in previous patch.
To work-around this issue we keep track of last submit sequence number for each ring and compare it with one written to memptrs from GPU during execution of CACHE_FLUSH_TS event.
Patchwork: https://patchwork.freedesktop.org/patch/612047/
--- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4 ++++ drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 1 + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 4 ++++ 3 files changed, 9 insertions(+)
drivers/gpu/drm/msm/adreno/a5xx_gpu.c +4 -0
@@ -56,6 +56,8 @@ void a5xx_flush(struct msm_gpu *gpu, struct msm_ringbuffer *ring,static void a5xx_submit_in_rb (struct msm_gpu *gpu,struct msm_gem_submit *submit) { +struct adreno_gpu *adreno_gpu =to_adreno_gpu (gpu); +struct a5xx_gpu *a5xx_gpu =to_a5xx_gpu (adreno_gpu);struct msm_ringbuffer *ring = submit->ring;struct msm_gem_object *obj;uint32_t *ptr, dwords;
@@ -100,6 +102,7 @@ static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit } } + a5xx_gpu->last_seqno[ring->id] = submit->seqno;a5xx_flush (gpu, ring, true);a5xx_preempt_trigger (gpu);
@@ -191,6 +194,7 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)/* Write the fence to the scratch register */ OUT_PKT4 (ring,REG_A5XX_CP_SCRATCH_REG (2 ),1 );OUT_RING (ring, submit->seqno); + a5xx_gpu->last_seqno[ring->id] = submit->seqno;/* * Execute a CACHE_FLUSH_TS event. This will ensure that the
drivers/gpu/drm/msm/adreno/a5xx_gpu.h +1 -0
@@ -34,6 +34,7 @@ struct a5xx_gpu {struct drm_gem_object *preempt_counters_bo[MSM_GPU_MAX_RINGS ];struct a5xx_preempt_record *preempt[MSM_GPU_MAX_RINGS ];uint64_t preempt_iova[MSM_GPU_MAX_RINGS ]; +uint32_t last_seqno[MSM_GPU_MAX_RINGS ];atomic_t preempt_state;spinlock_t preempt_start_lock;
drivers/gpu/drm/msm/adreno/a5xx_preempt.c +4 -0
@@ -55,6 +55,8 @@ static inline void update_wptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)/* Return the highest priority ringbuffer with something in it */ static struct msm_ringbuffer *get_next_ring (struct msm_gpu *gpu) { +struct adreno_gpu *adreno_gpu =to_adreno_gpu (gpu); +struct a5xx_gpu *a5xx_gpu =to_a5xx_gpu (adreno_gpu);unsigned long flags;int i;
@@ -64,6 +66,8 @@ static struct msm_ringbuffer *get_next_ring(struct msm_gpu *gpu)spin_lock_irqsave (&ring->preempt_lock, flags); empty = (get_wptr (ring) == gpu->funcs->get_rptr (gpu, ring)); +if (!empty && ring == a5xx_gpu->cur_ring) + empty = ring->memptrs->fence == a5xx_gpu->last_seqno[i];spin_unlock_irqrestore (&ring->preempt_lock, flags);if (!empty)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/518 ipmi: docs: dont advertise deprecated sysfs entries
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 64dce81f8c373c681e62d5ffe0397c45a35d48a2 ]
"i2c-adapter" class entries are deprecated since 2009. Switch to the proper location.
Message-Id: <[email protected]>
--- Documentation/driver-api/ipmi.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/driver-api/ipmi.rst +1 -1
@@ -519,7 +519,7 @@ at module load time (for a module) with:: alerts_broken The addresses are normal I2C addresses. The adapter is the string -name of the adapter, as shown in /sys/class/i2c-adapter/i2c-<n>/name. +name of the adapter, as shown in /sys/bus/i2c/devices/i2c-<n>/name. It is *NOT* i2c-<n> itself. Also, the comparison is done ignoring spaces, so if the name is "This is an I2C chip" you can say adapter_name=ThisisanI2cchip. This is because it's hard to pass in
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/518 drm/msm: fix %s null argument error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Yang <[email protected]>
[ Upstream commit 25b85075150fe8adddb096db8a4b950353045ee1 ]
The following build error was triggered because of NULL string argument:
BUILDSTDERR: drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c: In function 'mdp5_smp_dump': BUILDSTDERR: drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c:352:51: error: '%s' directive argument is null [-Werror=format-overflow=] BUILDSTDERR: 352 | drm_printf(p, "%s:%d\t%d\t%s\n", BUILDSTDERR: | ^~ BUILDSTDERR: drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c:352:51: error: '%s' directive argument is null [-Werror=format-overflow=]
This happens from the commit a61ddb4393ad ("drm: enable (most) W=1 warnings by default across the subsystem"). Using "(null)" instead to fix it.
Patchwork: https://patchwork.freedesktop.org/patch/611071/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c +1 -1
@@ -356,7 +356,7 @@ void mdp5_smp_dump(struct mdp5_smp *smp, struct drm_printer *p)drm_printf (p,"%s:%d\t%d\t%s\n" ,pipe2name (pipe), j, inuse, - plane ? plane->name :NULL ); + plane ? plane->name :"(null)" ); total += inuse; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/518 drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuesong Li <[email protected]>
[ Upstream commit 94ebc3d3235c5c516f67315059ce657e5090e94b ]
cocci reported a double assignment problem. Upon reviewing previous commits, it appears this may actually be an incorrect assignment.
--- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/exynos/exynos_drm_gsc.c +1 -1
@@ -1169,7 +1169,7 @@ static int gsc_bind(struct device *dev, struct device *master, void *data)struct exynos_drm_ipp *ipp = &ctx->ipp; ctx->drm_dev = drm_dev; - ctx->drm_dev = drm_dev; + ipp->drm_dev = drm_dev;exynos_drm_register_dma (drm_dev, dev, &ctx->dma_priv); exynos_drm_ipp_register(dev, ipp, &ipp_funcs,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/518 xen: use correct end address of kernel for conflict checking
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit fac1bceeeb04886fc2ee952672e6e6c85ce41dca ]
When running as a Xen PV dom0 the kernel is loaded by the hypervisor using a different memory map than that of the host. In order to minimize the required changes in the kernel, the kernel adapts its memory map to that of the host. In order to do that it is checking for conflicts of its load address with the host memory map.
Unfortunately the tested memory range does not include the .brk area, which might result in crashes or memory corruption when this area does conflict with the memory map of the host.
Fix the test by using the _end label instead of __bss_stop.
--- arch/x86/xen/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/xen/setup.c +1 -1
@@ -856,7 +856,7 @@ char * __init xen_memory_setup(void)* to relocating (and even reusing) pages with kernel text or data. */ if (xen_is_e820_reserved (__pa_symbol (_text), -__pa_symbol (__bss_stop) -__pa_symbol (_text))) { +__pa_symbol (_end) -__pa_symbol (_text))) {xen_raw_console_write ("Xen hypervisor allocated kernel memory conflicts with E820 map\n" );BUG (); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/518 xen/swiotlb: add alignment check for dma buffers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit 9f40ec84a7976d95c34e7cc070939deb103652b0 ]
When checking a memory buffer to be consecutive in machine memory, the alignment needs to be checked, too. Failing to do so might result in DMA memory not being aligned according to its requested size, leading to error messages like:
4xxx 0000:2b:00.0: enabling device (0140 -> 0142) 4xxx 0000:2b:00.0: Ring address not aligned
4xxx 0000:2b:00.0: Failed to initialise service qat_crypto 4xxx 0000:2b:00.0: Resetting device qat_dev0 4xxx: probe of 0000:2b:00.0 failed with error -14
--- drivers/xen/swiotlb-xen.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/xen/swiotlb-xen.c +6 -0
@@ -91,9 +91,15 @@ static inline int range_straddles_page_boundary(phys_addr_t p, size_t size) {unsigned long next_bfn, xen_pfn =XEN_PFN_DOWN (p);unsigned int i, nr_pages =XEN_PFN_UP (xen_offset_in_page (p) + size); +phys_addr_t algn =1ULL << (get_order (size) +PAGE_SHIFT ); next_bfn =pfn_to_bfn (xen_pfn); +/* If buffer is physically aligned, ensure DMA alignment. */ +if (IS_ALIGNED (p, algn) && + !IS_ALIGNED ((phys_addr_t )next_bfn <<XEN_PAGE_SHIFT , algn)) +return 1 ; +for (i =1 ; i < nr_pages; i++)if (pfn_to_bfn (++xen_pfn) != ++next_bfn)return 1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/518 tpm: Clean up TPM space after command failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan McDowell <[email protected]>
[ Upstream commit e3aaebcbb7c6b403416f442d1de70d437ce313a7 ]
tpm_dev_transmit prepares the TPM space before attempting command transmission. However if the command fails no rollback of this preparation is done. This can result in transient handles being leaked if the device is subsequently closed with no further commands performed.
Fix this by flushing the space in the event of command transmission failure.
--- drivers/char/tpm/tpm-dev-common.c | 2 ++ drivers/char/tpm/tpm2-space.c | 3 +++ 2 files changed, 5 insertions(+)
drivers/char/tpm/tpm-dev-common.c +2 -0
@@ -48,6 +48,8 @@ static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,if (!ret) ret =tpm2_commit_space (chip, space, buf, &len); +else +tpm2_flush_space (chip); out_rc:return ret ? ret : len;
drivers/char/tpm/tpm2-space.c +3 -0
@@ -166,6 +166,9 @@ void tpm2_flush_space(struct tpm_chip *chip)struct tpm_space *space = &chip->work_space;int i; +if (!space) +return ; +for (i =0 ; i <ARRAY_SIZE (space->context_tbl); i++)if (space->context_tbl[i] && ~space->context_tbl[i])tpm2_flush_context (chip, space->context_tbl[i]);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/518 selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit d393f9479d4aaab0fa4c3caf513f28685e831f13 ]
Cast 'rlim_t' argument to match expected type of printf() format and avoid compile errors seen building for mips64el/musl-libc:
In file included from map_tests/sk_storage_map.c:20:
map_tests/sk_storage_map.c: In function 'test_sk_storage_map_stress_free':
map_tests/sk_storage_map.c:414:56: error: format '%lu' expects argument of type 'long unsigned int', but argument 2 has type 'rlim_t' {aka 'long long unsigned int'} [-Werror=format=]
414 | CHECK(err, "setrlimit(RLIMIT_NOFILE)", "rlim_new:%lu errno:%d",
| ^~~~~~~~~~~~~~~~~~~~~~~
415 | rlim_new.rlim_cur, errno);
| ~~~~~~~~~~~~~~~~~
| |
| rlim_t {aka long long unsigned int}
./test_maps.h:12:24: note: in definition of macro 'CHECK'
12 | printf(format); \
| ^~~~~~
map_tests/sk_storage_map.c:414:68: note: format string is defined here
414 | CHECK(err, "setrlimit(RLIMIT_NOFILE)", "rlim_new:%lu errno:%d",
| ~~^
| |
| long unsigned int
| %llucc1: all warnings being treated as errors
--- tools/testing/selftests/bpf/map_tests/sk_storage_map.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/map_tests/sk_storage_map.c +1 -1
@@ -416,7 +416,7 @@ static void test_sk_storage_map_stress_free(void) rlim_new.rlim_max = rlim_new.rlim_cur +128 ; err =setrlimit (RLIMIT_NOFILE , &rlim_new);CHECK (err,"setrlimit(RLIMIT_NOFILE)" ,"rlim_new:%lu errno:%d" , - rlim_new.rlim_cur, errno); + (unsigned long ) rlim_new.rlim_cur, errno); } err =do_sk_storage_map_stress_free ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/518 selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit d44c93fc2f5a0c47b23fa03d374e45259abd92d2 ]
Add a "bpf_util.h" include to avoid the following error seen compiling for mips64el with musl libc:
bench.c: In function 'find_benchmark':
bench.c:590:25: error: implicit declaration of function 'ARRAY_SIZE' [-Werror=implicit-function-declaration]
590 | for (i = 0; i < ARRAY_SIZE(benchs); i++) {
| ^~~~~~~~~~cc1: all warnings being treated as errors
--- tools/testing/selftests/bpf/bench.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/bench.c +1 -0
@@ -11,6 +11,7 @@#include <sys/resource.h> #include <signal.h> #include "bench.h" +#include "bpf_util.h" #include "testing_helpers.h" struct env env = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/518 selftests/bpf: Fix compiling kfree_skb.c with musl-libc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit bae9a5ce7d3a9b3a9e07b31ab9e9c58450e3e9fd ]
The GNU version of 'struct tcphdr' with member 'doff' is not exposed by musl headers unless _GNU_SOURCE is defined. Add this definition to fix errors seen compiling for mips64el/musl-libc:
In file included from kfree_skb.c:2:
kfree_skb.c: In function 'on_sample':
kfree_skb.c:45:30: error: 'struct tcphdr' has no member named 'doff'
45 | if (CHECK(pkt_v6->tcp.doff != 5, "check_tcp",
| ^--- tools/testing/selftests/bpf/prog_tests/kfree_skb.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/prog_tests/kfree_skb.c +1 -0
@@ -1,4 +1,5 @@// SPDX-License-Identifier: GPL-2.0 +#define _GNU_SOURCE#include <test_progs.h> #include <network_helpers.h>
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/518 selftests/bpf: Fix compiling flow_dissector.c with musl-libc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit 5e4c43bcb85973243d7274e0058b6e8f5810e4f7 ]
The GNU version of 'struct tcphdr' has members 'doff', 'source' and 'dest', which are not exposed by musl libc headers unless _GNU_SOURCE is defined.
Add this definition to fix errors seen compiling for mips64el/musl-libc:
flow_dissector.c:118:30: error: 'struct tcphdr' has no member named 'doff'
118 | .tcp.doff = 5,
| ^~~~
flow_dissector.c:119:30: error: 'struct tcphdr' has no member named 'source'
119 | .tcp.source = 80,
| ^~~~~~
flow_dissector.c:120:30: error: 'struct tcphdr' has no member named 'dest'
120 | .tcp.dest = 8080,
| ^~~~--- tools/testing/selftests/bpf/prog_tests/flow_dissector.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/prog_tests/flow_dissector.c +1 -0
@@ -1,4 +1,5 @@// SPDX-License-Identifier: GPL-2.0 +#define _GNU_SOURCE#include <test_progs.h> #include <network_helpers.h> #include <error.h>
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/518 selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit 18826fb0b79c3c3cd1fe765d85f9c6f1a902c722 ]
The GNU version of 'struct tcp_info' in 'netinet/tcp.h' is not exposed by musl headers unless _GNU_SOURCE is defined.
Add this definition to fix errors seen compiling for mips64el/musl-libc:
tcp_rtt.c: In function 'wait_for_ack':
tcp_rtt.c:24:25: error: storage size of 'info' isn't known
24 | struct tcp_info info;
| ^~~~ tcp_rtt.c:24:25: error: unused variable 'info' [-Werror=unused-variable]
cc1: all warnings being treated as errors
--- tools/testing/selftests/bpf/prog_tests/tcp_rtt.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/prog_tests/tcp_rtt.c +1 -0
@@ -1,4 +1,5 @@// SPDX-License-Identifier: GPL-2.0 +#define _GNU_SOURCE#include <test_progs.h> #include "cgroup_helpers.h" #include "network_helpers.h"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/518 selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit 730561d3c08d4a327cceaabf11365958a1c00cec ]
Remove a redundant include of '<asm/types.h>', whose needed definitions are already included (via '<linux/types.h>') in cg_storage_multi_egress_only.c, cg_storage_multi_isolated.c, and cg_storage_multi_shared.c. This avoids redefinition errors seen compiling for mips64el/musl-libc like:
In file included from progs/cg_storage_multi_egress_only.c:13:
In file included from progs/cg_storage_multi.h:6:
In file included from /usr/mips64el-linux-gnuabi64/include/asm/types.h:23:
/usr/include/asm-generic/int-l64.h:29:25: error: typedef redefinition with different types ('long' vs 'long long')
29 | typedef __signed__ long __s64;
| ^
/usr/include/asm-generic/int-ll64.h:30:44: note: previous definition is here
30 | __extension__ typedef __signed__ long long __s64;
| ^--- tools/testing/selftests/bpf/progs/cg_storage_multi.h | 2 -- 1 file changed, 2 deletions(-)
tools/testing/selftests/bpf/progs/cg_storage_multi.h +0 -2
@@ -3,8 +3,6 @@ #ifndef __PROGS_CG_STORAGE_MULTI_H #define __PROGS_CG_STORAGE_MULTI_H -#include <asm/types.h> - struct cgroup_value { __u32 egress_pkts; __u32 ingress_pkts;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/518 selftests/bpf: Fix error compiling test_lru_map.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit cacf2a5a78cd1f5f616eae043ebc6f024104b721 ]
Although the post-increment in macro 'CPU_SET(next++, &cpuset)' seems safe, the sequencing can raise compile errors, so move the increment outside the macro. This avoids an error seen using gcc 12.3.0 for mips64el/musl-libc:
In file included from test_lru_map.c:11:
test_lru_map.c: In function 'sched_next_online':
test_lru_map.c:129:29: error: operation on 'next' may be undefined [-Werror=sequence-point]
129 | CPU_SET(next++, &cpuset);
| ^cc1: all warnings being treated as errors
--- tools/testing/selftests/bpf/test_lru_map.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/test_lru_map.c +2 -1
@@ -137,7 +137,8 @@ static int sched_next_online(int pid, int *next_to_try)while (next < nr_cpus) {CPU_ZERO (&cpuset); -CPU_SET (next++, &cpuset); +CPU_SET (next, &cpuset); + next++;if (!sched_setaffinity (pid,sizeof (cpuset), &cpuset)) { ret =0 ;break ;
Signature · 1 line
2.43.0