5.10.227-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 143/518 selftests/bpf: Fix C++ compile error from missing _Bool type
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit aa95073fd290b5b3e45f067fa22bb25e59e1ff7c ]
While building, bpftool makes a skeleton from test_core_extern.c, which itself includes <stdbool.h> and uses the 'bool' type. However, the skeleton test_core_extern.skel.h generated *does not* include <stdbool.h> or use the 'bool' type, instead using the C-only '_Bool' type. Compiling test_cpp.cpp with g++ 12.3 for mips64el/musl-libc then fails with error:
In file included from test_cpp.cpp:9:
test_core_extern.skel.h:45:17: error: '_Bool' does not name a type
45 | _Bool CONFIG_BOOL;
| ^~~~~This was likely missed previously because glibc uses a GNU extension for <stdbool.h> with C++ (#define _Bool bool), not supported by musl libc.
Normally, a C fragment would include <stdbool.h> and use the 'bool' type, and thus cleanly work after import by C++. The ideal fix would be for 'bpftool gen skeleton' to output the correct type/include supporting C++, but in the meantime add a conditional define as above.
--- tools/testing/selftests/bpf/test_cpp.cpp | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/bpf/test_cpp.cpp +4 -0
@@ -3,6 +3,10 @@ #include <bpf/libbpf.h> #include <bpf/bpf.h> #include <bpf/btf.h> + +#ifndef _Bool +#define _Bool bool +#endif #include "test_core_extern.skel.h" /* do nothing, just make sure we can link successfully */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/518 xz: cleanup CRC32 edits from 2018
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lasse Collin <[email protected]>
[ Upstream commit 2ee96abef214550d9e92f5143ee3ac1fd1323e67 ]
In 2018, a dependency on <linux/crc32poly.h> was added to avoid duplicating the same constant in multiple files. Two months later it was found to be a bad idea and the definition of CRC32_POLY_LE macro was moved into xz_private.h to avoid including <linux/crc32poly.h>.
xz_private.h is a wrong place for it too. Revert back to the upstream version which has the poly in xz_crc32_init() in xz_crc32.c.
--- lib/xz/xz_crc32.c | 2 +- lib/xz/xz_private.h | 4 ---- 2 files changed, 1 insertion(+), 5 deletions(-)
lib/xz/xz_crc32.c +1 -1
@@ -29,7 +29,7 @@ STATIC_RW_DATA uint32_t xz_crc32_table[256]; XZ_EXTERN void xz_crc32_init(void) { -const uint32_t poly =CRC32_POLY_LE ; +const uint32_t poly =0xEDB88320 ;uint32_t i;uint32_t j;
lib/xz/xz_private.h +0 -4
@@ -102,10 +102,6 @@# endif #endif -#ifndef CRC32_POLY_LE -#define CRC32_POLY_LE 0xedb88320 -#endif -/* * Allocate memory for LZMA2 decoder. xz_dec_lzma2_reset() must be used * before calling xz_dec_lzma2_run().
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/518 kthread: add kthread_work tracepoints
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit f630c7c6f10546ebff15c3a856e7949feb7a2372 ]
While migrating some code from wq to kthread_worker, I found that I missed the execute_start/end tracepoints. So add similar tracepoints for kthread_work. And for completeness, queue_work tracepoint (although this one differs slightly from the matching workqueue tracepoint).
Stable-dep-of: e16c7b07784f ("kthread: fix task state in kthread worker if being frozen")
--- include/trace/events/sched.h | 84 ++++++++++++++++++++++++++++++++++++ kernel/kthread.c | 9 ++++ 2 files changed, 93 insertions(+)
include/trace/events/sched.h +84 -0
@@ -5,6 +5,7 @@#if !defined(_TRACE_SCHED_H) || defined(TRACE_HEADER_MULTI_READ )#define _TRACE_SCHED_H +#include <linux/kthread.h> #include <linux/sched/numa_balancing.h> #include <linux/tracepoint.h> #include <linux/binfmts.h>
@@ -51,6 +52,89 @@ TRACE_EVENT(sched_kthread_stop_ret,TP_printk ("ret=%d" , __entry->ret) ); +/** +* sched_kthread_work_queue_work - called when a work gets queued +* @worker: pointer to the kthread_worker +* @work: pointer to struct kthread_work +* +* This event occurs when a work is queued immediately or once a +* delayed work is actually queued (ie: once the delay has been +* reached). +*/ +TRACE_EVENT (sched_kthread_work_queue_work, + + TP_PROTO(struct kthread_worker *worker, + struct kthread_work *work), + +TP_ARGS (worker, work), + +TP_STRUCT__entry ( + __field( void *, work ) + __field( void *, function) + __field( void *, worker) + ), + +TP_fast_assign ( + __entry->work = work; + __entry->function = work->func; + __entry->worker = worker; + ), + +TP_printk ("work struct=%p function=%ps worker=%p" , + __entry->work, __entry->function, __entry->worker) +); + +/** +* sched_kthread_work_execute_start - called immediately before the work callback +* @work: pointer to struct kthread_work +* +* Allows to track kthread work execution. +*/ +TRACE_EVENT (sched_kthread_work_execute_start, + + TP_PROTO(struct kthread_work *work), + +TP_ARGS (work), + +TP_STRUCT__entry ( + __field( void *, work ) + __field( void *, function) + ), + +TP_fast_assign ( + __entry->work = work; + __entry->function = work->func; + ), + +TP_printk ("work struct %p: function %ps" , __entry->work, __entry->function) +); + +/** +* sched_kthread_work_execute_end - called immediately after the work callback +* @work: pointer to struct work_struct +* @function: pointer to worker function +* +* Allows to track workqueue execution. +*/ +TRACE_EVENT (sched_kthread_work_execute_end, + + TP_PROTO(struct kthread_work *work, kthread_work_func_t function), + +TP_ARGS (work, function), + +TP_STRUCT__entry ( + __field( void *, work ) + __field( void *, function) + ), + +TP_fast_assign ( + __entry->work = work; + __entry->function = function; + ), + +TP_printk ("work struct %p: function %ps" , __entry->work, __entry->function) +); +/* * Tracepoint for waking up a task: */
kernel/kthread.c +9 -0
@@ -765,8 +765,15 @@ int kthread_worker_fn(void *worker_ptr)raw_spin_unlock_irq (&worker->lock);if (work) { +kthread_work_func_t func = work->func;__set_current_state (TASK_RUNNING ); +trace_sched_kthread_work_execute_start (work); work->func (work); +/* +* Avoid dereferencing work after this point. The trace +* event only cares about the address. +*/ +trace_sched_kthread_work_execute_end (work, func); }else if (!freezing (current))schedule ();
@@ -895,6 +902,8 @@ static void kthread_insert_work(struct kthread_worker *worker, {kthread_insert_work_sanity_check (worker, work); +trace_sched_kthread_work_queue_work (worker, work); +list_add_tail (&work->node, pos); work->worker = worker;if (!worker->current_work &&likely (worker->task))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/518 kthread: fix task state in kthread worker if being frozen
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yu <[email protected]>
[ Upstream commit e16c7b07784f3fb03025939c4590b9a7c64970a7 ]
When analyzing a kernel waring message, Peter pointed out that there is a race condition when the kworker is being frozen and falls into try_to_freeze() with TASK_INTERRUPTIBLE, which could trigger a might_sleep() warning in try_to_freeze(). Although the root cause is not related to freeze()[1], it is still worthy to fix this issue ahead.
One possible race scenario:
CPU 0 CPU 1
----- -----
// kthread_worker_fn
set_current_state(TASK_INTERRUPTIBLE);
suspend_freeze_processes()
freeze_processes
static_branch_inc(&freezer_active);
freeze_kernel_threads
pm_nosig_freezing = true;
if (work) { //false
__set_current_state(TASK_RUNNING);
} else if (!freezing(current)) //false, been frozen
freezing():
if (static_branch_unlikely(&freezer_active))
if (pm_nosig_freezing)
return true;
schedule()
}
// state is still TASK_INTERRUPTIBLE
try_to_freeze()
might_sleep() <--- warningFix this by explicitly set the TASK_RUNNING before entering try_to_freeze().
--- kernel/kthread.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
kernel/kthread.c +9 -1
@@ -774,8 +774,16 @@ int kthread_worker_fn(void *worker_ptr)* event only cares about the address. */ trace_sched_kthread_work_execute_end (work, func); - }else if (!freezing (current)) + }else if (!freezing (current)) {schedule (); + }else { +/* +* Handle the case where the current remains +* TASK_INTERRUPTIBLE. try_to_freeze() expects +* the current to be TASK_RUNNING. +*/ +__set_current_state (TASK_RUNNING ); + }try_to_freeze ();cond_resched ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/518 ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: yangerkun <[email protected]>
[ Upstream commit 20cee68f5b44fdc2942d20f3172a262ec247b117 ]
Commit 3d56b8d2c74c ("ext4: Speed up FITRIM by recording flags in ext4_group_info") speed up fstrim by skipping trim trimmed group. We also has the chance to clear trimmed once there exists some block free for this group(mount without discard), and the next trim for this group will work well too.
For mount with discard, we will issue dicard when we free blocks, so leave trimmed flag keep alive to skip useless trim trigger from userspace seems reasonable. But for some case like ext4 build on dm-thinpool(ext4 blocksize 4K, pool blocksize 128K), discard from ext4 maybe unaligned for dm thinpool, and thinpool will just finish this discard(see process_discard_bio when begein equals to end) without actually process discard. For this case, trim from userspace can really help us to free some thinpool block.
So convert to clear trimmed flag for all case no matter mounted with discard or not.
--- fs/ext4/mballoc.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
fs/ext4/mballoc.c +4 -6
@@ -3176,11 +3176,8 @@ static void ext4_free_data_in_buddy(struct super_block *sb,/* * Clear the trimmed flag for the group so that the next * ext4_trim_fs can trim it. -* If the volume is mounted with -o discard, online discard -* is supported and the free blocks will be trimmed online. */ -if (!test_opt (sb,DISCARD )) -EXT4_MB_GRP_CLEAR_TRIMMED (db); +EXT4_MB_GRP_CLEAR_TRIMMED (db);if (!db->bb_free_root.rb_node) {/* No more items in the per group rb tree
@@ -5589,8 +5586,9 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode," group:%u block:%d count:%lu failed" " with %d" , block_group, bit, count, err); - }else -EXT4_MB_GRP_CLEAR_TRIMMED (e4b.bd_info); + } + +EXT4_MB_GRP_CLEAR_TRIMMED (e4b.bd_info);ext4_lock_group (sb, block_group);mb_clear_bits (bitmap_bh->b_data, bit, count_clusters);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/518 smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawei Ye <[email protected]>
[ Upstream commit 2749749afa071f8a0e405605de9da615e771a7ce ]
In the smk_set_cipso function, the skp->smk_netlabel.attr.mls.cat field is directly assigned to a new value without using the appropriate RCU pointer assignment functions. According to RCU usage rules, this is illegal and can lead to unpredictable behavior, including data inconsistencies and impossible-to-diagnose memory corruption issues.
This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues.
To address this, the assignment is now done using rcu_assign_pointer(), which ensures that the pointer assignment is done safely, with the necessary memory barriers and synchronization. This change prevents potential RCU dereference issues by ensuring that the cat field is safely updated while still adhering to RCU's requirements.
--- security/smack/smackfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/smack/smackfs.c +1 -1
@@ -920,7 +920,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, rc =smk_netlbl_mls (maplevel, mapcatset, &ncats,SMK_CIPSOLEN );if (rc >=0 ) { old_cat = skp->smk_netlabel.attr.mls.cat; - skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat; +rcu_assign_pointer (skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat); skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;synchronize_rcu ();netlbl_catmap_free (old_cat);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/518 ext4: avoid buffer_head leak in ext4_mark_inode_used()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit 5e5b2a56c57def1b41efd49596621504d7bcc61c ]
Release inode_bitmap_bh from ext4_read_inode_bitmap() in ext4_mark_inode_used() to avoid buffer_head leak.
By the way, remove unneeded goto for invalid ino when inode_bitmap_bh is NULL.
--- fs/ext4/ialloc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/ext4/ialloc.c +3 -2
@@ -754,10 +754,10 @@ int ext4_mark_inode_used(struct super_block *sb, int ino)struct ext4_group_desc *gdp;ext4_group_t group;int bit; -int err = -EFSCORRUPTED ; +int err;if (ino <EXT4_FIRST_INO (sb) || ino > max_ino) - goto out; +return -EFSCORRUPTED ; group = (ino -1 ) /EXT4_INODES_PER_GROUP (sb); bit = (ino -1 ) %EXT4_INODES_PER_GROUP (sb);
@@ -860,6 +860,7 @@ int ext4_mark_inode_used(struct super_block *sb, int ino) err =ext4_handle_dirty_metadata (NULL ,NULL , group_desc_bh);sync_dirty_buffer (group_desc_bh); out: +brelse (inode_bitmap_bh);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/518 ext4: avoid potential buffer_head leak in __ext4_new_inode()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit 227d31b9214d1b9513383cf6c7180628d4b3b61f ]
If a group is marked EXT4_GROUP_INFO_IBITMAP_CORRUPT after it's inode bitmap buffer_head was successfully verified, then __ext4_new_inode() will get a valid inode_bitmap_bh of a corrupted group from ext4_read_inode_bitmap() in which case inode_bitmap_bh misses a release. Hnadle "IS_ERR(inode_bitmap_bh)" and group corruption separately like how ext4_free_inode() does to avoid buffer_head leak.
--- fs/ext4/ialloc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/ext4/ialloc.c +4 -3
@@ -1053,12 +1053,13 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir,brelse (inode_bitmap_bh); inode_bitmap_bh =ext4_read_inode_bitmap (sb, group);/* Skip groups with suspicious inode tables */ -if (((!(sbi->s_mount_state &EXT4_FC_REPLAY )) - &&EXT4_MB_GRP_IBITMAP_CORRUPT (grp)) || -IS_ERR (inode_bitmap_bh)) { +if (IS_ERR (inode_bitmap_bh)) { inode_bitmap_bh =NULL ; goto next_group; } +if (!(sbi->s_mount_state &EXT4_FC_REPLAY ) && +EXT4_MB_GRP_IBITMAP_CORRUPT (grp)) + goto next_group; repeat_in_this_group: ret2 =find_inode_bit (sb, group, inode_bitmap_bh, &ino);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/518 ext4: avoid negative min_clusters in find_group_orlov()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit bb0a12c3439b10d88412fd3102df5b9a6e3cd6dc ]
min_clusters is signed integer and will be converted to unsigned integer when compared with unsigned number stats.free_clusters. If min_clusters is negative, it will be converted to a huge unsigned value in which case all groups may not meet the actual desired free clusters.
Set negative min_clusters to 0 to avoid unexpected behavior.
--- fs/ext4/ialloc.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ext4/ialloc.c +2 -0
@@ -513,6 +513,8 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,if (min_inodes <1 ) min_inodes =1 ; min_clusters = avefreec -EXT4_CLUSTERS_PER_GROUP (sb)*flex_size /4 ; +if (min_clusters <0 ) + min_clusters =0 ;/* * Start looking in the flex group where we last allocated an
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/518 ext4: return error on ext4_find_inline_entry
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit 4d231b91a944f3cab355fce65af5871fb5d7735b ]
In case of errors when reading an inode from disk or traversing inline directory entries, return an error-encoded ERR_PTR instead of returning NULL. ext4_find_inline_entry only caller, __ext4_find_entry already returns such encoded errors.
Stable-dep-of: c6b72f5d82b1 ("ext4: avoid OOB when system.data xattr changes underneath the filesystem")
--- fs/ext4/inline.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/ext4/inline.c +7 -3
@@ -1653,8 +1653,9 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,void *inline_start;int inline_size; -if (ext4_get_inode_loc (dir, &iloc)) -return NULL ; + ret =ext4_get_inode_loc (dir, &iloc); +if (ret) +return ERR_PTR (ret);down_read (&EXT4_I (dir)->xattr_sem);if (!ext4_has_inline_data (dir)) {
@@ -1685,7 +1686,10 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir, out:brelse (iloc.bh); - iloc.bh =NULL ; +if (ret <0 ) + iloc.bh =ERR_PTR (ret); +else + iloc.bh =NULL ; out_find:up_read (&EXT4_I (dir)->xattr_sem);return iloc.bh;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/518 ext4: avoid OOB when system.data xattr changes underneath the filesystem
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit c6b72f5d82b1017bad80f9ebf502832fc321d796 ]
When looking up for an entry in an inlined directory, if e_value_offs is changed underneath the filesystem by some change in the block device, it will lead to an out-of-bounds access that KASAN detects as an UAF.
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
loop0: detected capacity change from 2048 to 2047
==================================================================
BUG: KASAN: use-after-free in ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500 Read of size 1 at addr ffff88803e91130f by task syz-executor269/5103 CPU: 0 UID: 0 PID: 5103 Comm: syz-executor269 Not tainted 6.11.0-rc4-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500 ext4_find_inline_entry+0x4be/0x5e0 fs/ext4/inline.c:1697 __ext4_find_entry+0x2b4/0x1b30 fs/ext4/namei.c:1573 ext4_lookup_entry fs/ext4/namei.c:1727 [inline] ext4_lookup+0x15f/0x750 fs/ext4/namei.c:1795 lookup_one_qstr_excl+0x11f/0x260 fs/namei.c:1633 filename_create+0x297/0x540 fs/namei.c:3980 do_symlinkat+0xf9/0x3a0 fs/namei.c:4587 __do_sys_symlinkat fs/namei.c:4610 [inline] __se_sys_symlinkat fs/namei.c:4607 [inline] __x64_sys_symlinkat+0x95/0xb0 fs/namei.c:4607 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3e73ced469 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff4d40c258 EFLAGS: 00000246 ORIG_RAX: 000000000000010a RAX: ffffffffffffffda RBX: 0032656c69662f2e RCX: 00007f3e73ced469 RDX: 0000000020000200 RSI: 00000000ffffff9c RDI: 00000000200001c0 RBP: 0000000000000000 R08: 00007fff4d40c290 R09: 00007fff4d40c290 R10: 0023706f6f6c2f76 R11: 0000000000000246 R12: 00007fff4d40c27c R13: 0000000000000003 R14: 431bde82d7b634db R15: 00007fff4d40c2b0 </TASK>
Calling ext4_xattr_ibody_find right after reading the inode with ext4_get_inode_loc will lead to a check of the validity of the xattrs, avoiding this problem.
--- fs/ext4/inline.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-)
fs/ext4/inline.c +21 -10
@@ -1648,25 +1648,36 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,struct ext4_dir_entry_2 **res_dir, int *has_inline_data) { + struct ext4_xattr_ibody_find is = { + .s = { .not_found = -ENODATA , }, + }; +struct ext4_xattr_info i = { + .name_index =EXT4_XATTR_INDEX_SYSTEM , + .name =EXT4_XATTR_SYSTEM_DATA , + };int ret; -struct ext4_iloc iloc;void *inline_start;int inline_size; - ret =ext4_get_inode_loc (dir, &iloc); + ret =ext4_get_inode_loc (dir, &is.iloc);if (ret)return ERR_PTR (ret);down_read (&EXT4_I (dir)->xattr_sem); + + ret =ext4_xattr_ibody_find (dir, &i, &is); +if (ret) + goto out; +if (!ext4_has_inline_data (dir)) { *has_inline_data =0 ; goto out; } - inline_start = (void *)ext4_raw_inode (&iloc)->i_block + + inline_start = (void *)ext4_raw_inode (&is.iloc)->i_block +EXT4_INLINE_DOTDOT_SIZE ; inline_size =EXT4_MIN_INLINE_DATA_SIZE -EXT4_INLINE_DOTDOT_SIZE ; - ret =ext4_search_dir (iloc.bh, inline_start, inline_size, + ret =ext4_search_dir (is.iloc.bh, inline_start, inline_size, dir, fname,0 , res_dir);if (ret ==1 ) goto out_find;
@@ -1676,23 +1687,23 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,if (ext4_get_inline_size (dir) ==EXT4_MIN_INLINE_DATA_SIZE ) goto out; - inline_start =ext4_get_inline_xattr_pos (dir, &iloc); + inline_start =ext4_get_inline_xattr_pos (dir, &is.iloc); inline_size =ext4_get_inline_size (dir) -EXT4_MIN_INLINE_DATA_SIZE ; - ret =ext4_search_dir (iloc.bh, inline_start, inline_size, + ret =ext4_search_dir (is.iloc.bh, inline_start, inline_size, dir, fname,0 , res_dir);if (ret ==1 ) goto out_find; out: -brelse (iloc.bh); +brelse (is.iloc.bh);if (ret <0 ) - iloc.bh =ERR_PTR (ret); + is.iloc.bh =ERR_PTR (ret);else - iloc.bh =NULL ; + is.iloc.bh =NULL ; out_find:up_read (&EXT4_I (dir)->xattr_sem); -return iloc.bh; +return is.iloc.bh; } int ext4_delete_inline_entry(handle_t *handle,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/518 nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit 9403001ad65ae4f4c5de368bdda3a0636b51d51a ]
Patch series "nilfs2: fix potential issues with empty b-tree nodes".
This series addresses three potential issues with empty b-tree nodes that can occur with corrupted filesystem images, including one recently discovered by syzbot.
This patch (of 3):
If a b-tree is broken on the device, and the b-tree height is greater than 2 (the level of the root node is greater than 1) even if the number of child nodes of the b-tree root is 0, a NULL pointer dereference occurs in nilfs_btree_prepare_insert(), which is called from nilfs_btree_insert().
This is because, when the number of child nodes of the b-tree root is 0, nilfs_btree_do_lookup() does not set the block buffer head in any of path[x].bp_bh, leaving it as the initial value of NULL, but if the level of the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(), which accesses the buffer memory of path[x].bp_bh, is called.
Fix this issue by adding a check to nilfs_btree_root_broken(), which performs sanity checks when reading the root node from the device, to detect this inconsistency.
Thanks to Lizhi Xu for trying to solve the bug and clarifying the cause early on.
--- fs/nilfs2/btree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nilfs2/btree.c +2 -1
@@ -381,7 +381,8 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,if (unlikely (level <NILFS_BTREE_LEVEL_NODE_MIN || level >=NILFS_BTREE_LEVEL_MAX || nchildren <0 || - nchildren >NILFS_BTREE_ROOT_NCHILDREN_MAX )) { + nchildren >NILFS_BTREE_ROOT_NCHILDREN_MAX || + (nchildren ==0 && level >NILFS_BTREE_LEVEL_NODE_MIN ))) {nilfs_crit (inode->i_sb,"bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d" , inode->i_ino, level, flags, nchildren);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/518 nilfs2: determine empty node blocks as corrupted
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit 111b812d3662f3a1b831d19208f83aa711583fe6 ]
Due to the nature of b-trees, nilfs2 itself and admin tools such as mkfs.nilfs2 will never create an intermediate b-tree node block with 0 child nodes, nor will they delete (key, pointer)-entries that would result in such a state. However, it is possible that a b-tree node block is corrupted on the backing device and is read with 0 child nodes.
Because operation is not guaranteed if the number of child nodes is 0 for intermediate node blocks other than the root node, modify nilfs_btree_node_broken(), which performs sanity checks when reading a b-tree node block, so that such cases will be judged as metadata corruption.
--- fs/nilfs2/btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nilfs2/btree.c +1 -1
@@ -350,7 +350,7 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node,if (unlikely (level <NILFS_BTREE_LEVEL_NODE_MIN || level >=NILFS_BTREE_LEVEL_MAX || (flags &NILFS_BTREE_NODE_ROOT ) || - nchildren <0 || + nchildren <=0 || nchildren >NILFS_BTREE_NODE_NCHILDREN_MAX (size))) { nilfs_crit(inode->i_sb, "bad btree node (ino=%lu, blocknr=%llu): level = %d, flags = 0x%x, nchildren = %d",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/518 nilfs2: fix potential oob read in nilfs_btree_check_delete()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit f9c96351aa6718b42a9f42eaf7adce0356bdb5e8 ]
The function nilfs_btree_check_delete(), which checks whether degeneration to direct mapping occurs before deleting a b-tree entry, causes memory access outside the block buffer when retrieving the maximum key if the root node has no entries.
This does not usually happen because b-tree mappings with 0 child nodes are never created by mkfs.nilfs2 or nilfs2 itself. However, it can happen if the b-tree root node read from a device is configured that way, so fix this potential issue by adding a check for that case.
--- fs/nilfs2/btree.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/nilfs2/btree.c +5 -2
@@ -1660,13 +1660,16 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key)int nchildren, ret; root =nilfs_btree_get_root (btree); + nchildren =nilfs_btree_node_get_nchildren (root); +if (unlikely (nchildren ==0 )) +return 0 ; +switch (nilfs_btree_height (btree)) {case 2 : bh =NULL ; node = root;break ;case 3 : - nchildren =nilfs_btree_node_get_nchildren (root);if (nchildren >1 )return 0 ; ptr = nilfs_btree_node_get_ptr(root, nchildren - 1,
@@ -1675,12 +1678,12 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key)if (ret <0 )return ret; node = (struct nilfs_btree_node *)bh->b_data; + nchildren =nilfs_btree_node_get_nchildren (node);break ;default :return 0 ; } - nchildren =nilfs_btree_node_get_nchildren (node); maxkey =nilfs_btree_node_get_key (node, nchildren -1 ); nextmaxkey = (nchildren >1 ) ?nilfs_btree_node_get_key (node, nchildren -2 ) :0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/518 bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit cfe69c50b05510b24e26ccb427c7cc70beafd6c1 ]
The bpf_strtol() and bpf_strtoul() helpers are currently broken on 32bit:
The argument type ARG_PTR_TO_LONG is BPF-side "long", not kernel-side "long" and therefore always considered fixed 64bit no matter if 64 or 32bit underlying architecture.
This contract breaks in case of the two mentioned helpers since their BPF_CALL definition for the helpers was added with {unsigned,}long *res. Meaning, the transition from BPF-side "long" (BPF program) to kernel-side "long" (BPF helper) breaks here.
Both helpers call __bpf_strtoll() with "long long" correctly, but later assigning the result into 32-bit "*(long *)" on 32bit architectures. From a BPF program point of view, this means upper bits will be seen as uninitialised.
Therefore, fix both BPF_CALL signatures to {s,u}64 types to fix this situation.
Now, changing also uapi/bpf.h helper documentation which generates bpf_helper_defs.h for BPF programs is tricky: Changing signatures there to __{s,u}64 would trigger compiler warnings (incompatible pointer types passing 'long *' to parameter of type '__s64 *' (aka 'long long *')) for existing BPF programs.
Leaving the signatures as-is would be fine as from BPF program point of view it is still BPF-side "long" and thus equivalent to __{s,u}64 on 64 or 32bit underlying architectures.
Note that bpf_strtol() and bpf_strtoul() are the only helpers with this issue.
--- kernel/bpf/helpers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/bpf/helpers.c +2 -2
@@ -497,7 +497,7 @@ static int __bpf_strtoll(const char *buf, size_t buf_len, u64 flags, } BPF_CALL_4(bpf_strtol, const char *, buf, size_t, buf_len, u64, flags, - long *, res) + s64 *, res) {long long _res;int err;
@@ -522,7 +522,7 @@ const struct bpf_func_proto bpf_strtol_proto = { }; BPF_CALL_4(bpf_strtoul, const char *, buf, size_t, buf_len, u64, flags, - unsigned long *, res) + u64 *, res) {unsigned long long _res;bool is_negative;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/518 perf sched timehist: Fix missing free of session in perf_sched__timehist()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit 6bdf5168b6fb19541b0c1862bdaa596d116c7bfb ]
When perf_time__parse_str() fails in perf_sched__timehist(), need to free session that was previously created, fix it.
--- tools/perf/builtin-sched.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/perf/builtin-sched.c +2 -1
@@ -3027,7 +3027,8 @@ static int perf_sched__timehist(struct perf_sched *sched)if (perf_time__parse_str (&sched->ptime, sched->time_str) !=0 ) {pr_err ("Invalid time string\n" ); -return -EINVAL ; + err = -EINVAL ; + goto out; }if (timehist_check_attr (sched, evlist) !=0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 159/518 perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit 39c243411bdb8fb35777adf49ee32549633c4e12 ]
If sched_in event for current task is not recorded, sched_in timestamp will be set to end_time of time window interest, causing an error in timestamp show. In this case, we choose to ignore this event.
Test scenario:
perf[1229608] does not record the first sched_in event, run time and sch delay are both 0
# perf sched timehist
Samples of sched_switch event do not have callchains.
time cpu task name wait time sch delay run time
[tid/pid] (msec) (msec) (msec)
--------------- ------ ------------------------------ --------- --------- ---------
2090450.763231 [0000] perf[1229608] 0.000 0.000 0.000
2090450.763235 [0000] migration/0[15] 0.000 0.001 0.003
2090450.763263 [0001] perf[1229608] 0.000 0.000 0.000
2090450.763268 [0001] migration/1[21] 0.000 0.001 0.004
2090450.763302 [0002] perf[1229608] 0.000 0.000 0.000
2090450.763309 [0002] migration/2[27] 0.000 0.001 0.007
2090450.763338 [0003] perf[1229608] 0.000 0.000 0.000
2090450.763343 [0003] migration/3[33] 0.000 0.001 0.004Before:
arbitrarily specify a time window of interest, timestamp will be set to an incorrect value
# perf sched timehist --time 100,200
Samples of sched_switch event do not have callchains.
time cpu task name wait time sch delay run time
[tid/pid] (msec) (msec) (msec)
--------------- ------ ------------------------------ --------- --------- ---------
200.000000 [0000] perf[1229608] 0.000 0.000 0.000
200.000000 [0001] perf[1229608] 0.000 0.000 0.000
200.000000 [0002] perf[1229608] 0.000 0.000 0.000
200.000000 [0003] perf[1229608] 0.000 0.000 0.000
200.000000 [0004] perf[1229608] 0.000 0.000 0.000
200.000000 [0005] perf[1229608] 0.000 0.000 0.000
200.000000 [0006] perf[1229608] 0.000 0.000 0.000
200.000000 [0007] perf[1229608] 0.000 0.000 0.000After:
# perf sched timehist --time 100,200
Samples of sched_switch event do not have callchains.
time cpu task name wait time sch delay run time
[tid/pid] (msec) (msec) (msec)
--------------- ------ ------------------------------ --------- --------- ------------ tools/perf/builtin-sched.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/builtin-sched.c +4 -1
@@ -2577,9 +2577,12 @@ static int timehist_sched_change_event(struct perf_tool *tool,* - previous sched event is out of window - we are done * - sample time is beyond window user cares about - reset it * to close out stats for time window interest +* - If tprev is 0, that is, sched_in event for current task is +* not recorded, cannot determine whether sched_in event is +* within time window interest - ignore it */ if (ptime->end) { -if (tprev > ptime->end) +if (!tprev || tprev > ptime->end) goto out;if (t > ptime->end)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 160/518 perf time-utils: Fix 32-bit nsec parsing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 38e2648a81204c9fc5b4c87a8ffce93a6ed91b65 ]
The "time utils" test fails in 32-bit builds:
...
parse_nsec_time("18446744073.709551615")
Failed. ptime 4294967295709551615 expected 18446744073709551615
...
Switch strtoul to strtoull as an unsigned long in 32-bit build isn't 64-bits.
--- tools/perf/util/time-utils.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/time-utils.c +2 -2
@@ -20,7 +20,7 @@ int parse_nsec_time(const char *str, u64 *ptime)u64 time_sec, time_nsec;char *end; - time_sec =strtoul (str, &end,10 ); + time_sec =strtoull (str, &end,10 );if (*end !='.' && *end !='\0' )return -1 ;
@@ -38,7 +38,7 @@ int parse_nsec_time(const char *str, u64 *ptime)for (i =strlen (nsec_buf); i <9 ; i++) nsec_buf[i] ='0' ; - time_nsec =strtoul (nsec_buf, &end,10 ); + time_nsec =strtoull (nsec_buf, &end,10 );if (*end !='\0' )return -1 ; }else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 161/518 clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Wang <[email protected]>
[ Upstream commit 3d29036853b9cb07ac49e8261fca82a940be5c41 ]
On the i.MX8M*, the TF-A exposes a SiP (Silicon Provider) service for DDR frequency scaling. The imx8m-ddrc-devfreq driver calls the SiP and then does clk_set_parent on the DDR muxes to synchronize the clock tree.
since commit 936c383673b9 ("clk: imx: fix composite peripheral flags"), these TF-A managed muxes have SET_PARENT_GATE set, which results in imx8m-ddrc-devfreq's clk_set_parent after SiP failing with -EBUSY:
clk_set_parent(dram_apb_src, sys1_pll_40m);(busfreq-imx8mq.c)
commit 926bf91248dd
("clk: imx8m: fix clock tree update of TF-A managed clocks") adds this method and enables 8mm, 8mn and 8mq. i.MX8MP also needs it.
This is safe to do, because updating the Linux clock tree to reflect reality will always be glitch-free.
Another reason to this patch is that powersave image BT music requires dram to be 400MTS, so clk_set_parent(dram_alt_src, sys1_pll_800m); is required. Without this patch, it will not succeed.
--- drivers/clk/imx/clk-imx8mp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/imx/clk-imx8mp.c +2 -2
@@ -579,8 +579,8 @@ static int imx8mp_clocks_probe(struct platform_device *pdev) hws[IMX8MP_CLK_IPG_ROOT ] =imx_clk_hw_divider2 ("ipg_root" ,"ahb_root" , ccm_base +0x9080 ,0 ,1 ); hws[IMX8MP_CLK_IPG_AUDIO_ROOT ] =imx_clk_hw_divider2 ("ipg_audio_root" ,"audio_ahb" , ccm_base +0x9180 ,0 ,1 ); - hws[IMX8MP_CLK_DRAM_ALT ] =imx8m_clk_hw_composite ("dram_alt" , imx8mp_dram_alt_sels, ccm_base +0xa000 ); - hws[IMX8MP_CLK_DRAM_APB ] =imx8m_clk_hw_composite_critical ("dram_apb" , imx8mp_dram_apb_sels, ccm_base +0xa080 ); + hws[IMX8MP_CLK_DRAM_ALT ] =imx8m_clk_hw_fw_managed_composite ("dram_alt" , imx8mp_dram_alt_sels, ccm_base +0xa000 ); + hws[IMX8MP_CLK_DRAM_APB ] =imx8m_clk_hw_fw_managed_composite_critical ("dram_apb" , imx8mp_dram_apb_sels, ccm_base +0xa080 ); hws[IMX8MP_CLK_VPU_G1 ] =imx8m_clk_hw_composite ("vpu_g1" , imx8mp_vpu_g1_sels, ccm_base +0xa100 ); hws[IMX8MP_CLK_VPU_G2 ] =imx8m_clk_hw_composite ("vpu_g2" , imx8mp_vpu_g2_sels, ccm_base +0xa180 ); hws[IMX8MP_CLK_CAN1 ] =imx8m_clk_hw_composite ("can1" , imx8mp_can1_sels, ccm_base +0xa200 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 162/518 clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 1d34b9757523c1ad547bd6d040381f62d74a3189 ]
Similar to DCLK_LCDC on RK3328, the DCLK_VOP on RK3228 is typically parented by the hdmiphy clk and it is expected that the DCLK_VOP and hdmiphy clk rate are kept in sync.
Use CLK_SET_RATE_PARENT and CLK_SET_RATE_NO_REPARENT flags, same as used on RK3328, to make full use of all possible supported display modes.
--- drivers/clk/rockchip/clk-rk3228.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3228.c +1 -1
@@ -408,7 +408,7 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = { RK2928_CLKSEL_CON(29), 0, 3, DFLAGS),DIV (0 ,"sclk_vop_pre" ,"sclk_vop_src" ,0 ,RK2928_CLKSEL_CON (27 ),8 ,8 ,DFLAGS ), -MUX (DCLK_VOP ,"dclk_vop" , mux_dclk_vop_p,0 , +MUX (DCLK_VOP ,"dclk_vop" , mux_dclk_vop_p,CLK_SET_RATE_PARENT |CLK_SET_RATE_NO_REPARENT ,RK2928_CLKSEL_CON (27 ),1 ,1 ,MFLAGS ), FACTOR(0, "xin12m", "xin24m", 0, 1, 2),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 163/518 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junlin Li <[email protected]>
[ Upstream commit 8ae06f360cfaca2b88b98ca89144548b3186aab1 ]
Ensure index in rtl2832_pid_filter does not exceed 31 to prevent out-of-bounds access.
dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue.
--- drivers/media/dvb-frontends/rtl2832.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/rtl2832.c +1 -1
@@ -982,7 +982,7 @@ static int rtl2832_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, index, pid, onoff, dev->slave_ts);/* skip invalid PIDs (0x2000) */ -if (pid >0x1fff || index >32 ) +if (pid >0x1fff || index >=32 )return 0 ;if (onoff)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 164/518 drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junlin Li <[email protected]>
[ Upstream commit 46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14 ]
Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access.
dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue.
--- drivers/media/dvb-frontends/rtl2830.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/rtl2830.c +1 -1
@@ -609,7 +609,7 @@ static int rtl2830_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, int on index, pid, onoff);/* skip invalid PIDs (0x2000) */ -if (pid >0x1fff || index >32 ) +if (pid >0x1fff || index >=32 )return 0 ;if (onoff)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 165/518 PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6188a1c762eb9bbd444f47696eda77a5eae6207a ]
This code accidentally uses && where || was intended. It potentially results in a NULL dereference.
Thus, fix the if-statement expression to use the correct condition.
--- drivers/pci/controller/dwc/pci-keystone.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/dwc/pci-keystone.c +1 -1
@@ -598,7 +598,7 @@ static void ks_pcie_quirk(struct pci_dev *dev)*/ if (pci_match_id (am6_pci_devids, bridge)) { bridge_dev =pci_get_host_bridge_device (dev); -if (!bridge_dev && !bridge_dev->parent) +if (!bridge_dev || !bridge_dev->parent)return ; ks_pcie =dev_get_drvdata (bridge_dev->parent);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 166/518 PCI: xilinx-nwl: Fix register misspelling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit a437027ae1730b8dc379c75fa0dd7d3036917400 ]
MSIC -> MISC
--- drivers/pci/controller/pcie-xilinx-nwl.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/controller/pcie-xilinx-nwl.c +6 -6
@@ -79,8 +79,8 @@#define MSGF_MISC_SR_NON_FATAL_DEV BIT(22)#define MSGF_MISC_SR_FATAL_DEV BIT(23)#define MSGF_MISC_SR_LINK_DOWN BIT(24) -#define MSGF_MSIC_SR_LINK_AUTO_BWIDTH BIT(25) -#define MSGF_MSIC_SR_LINK_BWIDTH BIT(26) +#define MSGF_MISC_SR_LINK_AUTO_BWIDTH BIT(25) +#define MSGF_MISC_SR_LINK_BWIDTH BIT(26)#define MSGF_MISC_SR_MASKALL (MSGF_MISC_SR_RXMSG_AVAIL | \ MSGF_MISC_SR_RXMSG_OVER | \
@@ -95,8 +95,8 @@ MSGF_MISC_SR_NON_FATAL_DEV | \ MSGF_MISC_SR_FATAL_DEV | \ MSGF_MISC_SR_LINK_DOWN | \ - MSGF_MSIC_SR_LINK_AUTO_BWIDTH | \ - MSGF_MSIC_SR_LINK_BWIDTH) + MSGF_MISC_SR_LINK_AUTO_BWIDTH | \ + MSGF_MISC_SR_LINK_BWIDTH)/* Legacy interrupt status mask bits */ #define MSGF_LEG_SR_INTA BIT(0)
@@ -305,10 +305,10 @@ static irqreturn_t nwl_pcie_misc_handler(int irq, void *data)if (misc_stat &MSGF_MISC_SR_FATAL_DEV )dev_err (dev,"Fatal Error Detected\n" ); -if (misc_stat &MSGF_MSIC_SR_LINK_AUTO_BWIDTH ) +if (misc_stat &MSGF_MISC_SR_LINK_AUTO_BWIDTH )dev_info (dev,"Link Autonomous Bandwidth Management Status bit set\n" ); -if (misc_stat &MSGF_MSIC_SR_LINK_BWIDTH ) +if (misc_stat &MSGF_MISC_SR_LINK_BWIDTH )dev_info (dev,"Link Bandwidth Management Status bit set\n" );/* Clear misc interrupt status */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 167/518 RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <[email protected]>
[ Upstream commit 86dfdd8288907f03c18b7fb462e0e232c4f98d89 ]
In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs"), the function flush_workqueue is invoked to flush the work queue iwcm_wq.
But at that time, the work queue iwcm_wq was created via the function alloc_ordered_workqueue without the flag WQ_MEM_RECLAIM.
Because the current process is trying to flush the whole iwcm_wq, if iwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current process is not reclaiming memory or running on a workqueue which doesn't have the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to a deadlock.
The call trace is as below:
[ 125.350876][ T1430] Call Trace: [ 125.356281][ T1430] <TASK> [ 125.361285][ T1430] ? __warn (kernel/panic.c:693) [ 125.367640][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.375689][ T1430] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 125.382505][ T1430] ? handle_bug (arch/x86/kernel/traps.c:239) [ 125.388987][ T1430] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 125.395831][ T1430] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [ 125.403125][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.410984][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.418764][ T1430] __flush_workqueue (kernel/workqueue.c:3970) [ 125.426021][ T1430] ? __pfx___might_resched (kernel/sched/core.c:10151) [ 125.433431][ T1430] ? destroy_cm_id (drivers/infiniband/core/iwcm.c:375) iw_cm [ 125.441209][ T1430] ? __pfx___flush_workqueue (kernel/workqueue.c:3910) [ 125.473900][ T1430] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) [ 125.473909][ T1430] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161) [ 125.482537][ T1430] _destroy_id (drivers/infiniband/core/cma.c:2044) rdma_cm [ 125.495072][ T1430] nvme_rdma_free_queue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvme_rdma [ 125.505827][ T1430] nvme_rdma_reset_ctrl_work (drivers/nvme/host/rdma.c:2180) nvme_rdma [ 125.505831][ T1430] process_one_work (kernel/workqueue.c:3231) [ 125.515122][ T1430] worker_thread (kernel/workqueue.c:3306 kernel/workqueue.c:3393) [ 125.515127][ T1430] ? __pfx_worker_thread (kernel/workqueue.c:3339) [ 125.531837][ T1430] kthread (kernel/kthread.c:389) [ 125.539864][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.550628][ T1430] ret_from_fork (arch/x86/kernel/process.c:147) [ 125.558840][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.558844][ T1430] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) [ 125.566487][ T1430] </TASK> [ 125.566488][ T1430] ---[ end trace 0000000000000000 ]---
--- drivers/infiniband/core/iwcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/iwcm.c +1 -1
@@ -1192,7 +1192,7 @@ static int __init iw_cm_init(void)if (ret)return ret; - iwcm_wq =alloc_ordered_workqueue ("iw_cm_wq" ,0 ); + iwcm_wq =alloc_ordered_workqueue ("iw_cm_wq" ,WQ_MEM_RECLAIM );if (!iwcm_wq) goto err_alloc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 168/518 pinctrl: single: fix missing error code in pcs_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit cacd8cf79d7823b07619865e994a7916fcc8ae91 ]
If pinctrl_enable() fails in pcs_probe(), it should return the error code.
--- drivers/pinctrl/pinctrl-single.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-single.c +2 -1
@@ -1923,7 +1923,8 @@ static int pcs_probe(struct platform_device *pdev)dev_info (pcs->dev,"%i pins, size %u\n" , pcs->desc.npins, pcs->size); -if (pinctrl_enable (pcs->pctl)) + ret =pinctrl_enable (pcs->pctl); +if (ret) goto free;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 169/518 clk: ti: dra7-atl: Fix leak of of_nodes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 9d6e9f10e2e031fb7bfb3030a7d1afc561a28fea ]
This fix leaking the of_node references in of_dra7_atl_clk_probe().
The docs for of_parse_phandle_with_args() say that the caller must call of_node_put() on the returned node. This adds the missing of_node_put() to fix the leak.
--- drivers/clk/ti/clk-dra7-atl.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/ti/clk-dra7-atl.c +1 -0
@@ -258,6 +258,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev) } clk =of_clk_get_from_provider (&clkspec); +of_node_put (clkspec.np);if (IS_ERR (clk)) {pr_err ("%s: failed to get atl clock %d from provider\n" , __func__, i);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 170/518 nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 81a95c2b1d605743220f28db04b8da13a65c4059 ]
Given that we do the search and insertion while holding the i_lock, I don't think it's possible for us to get EEXIST here. Remove this case.
--- fs/nfsd/filecache.c | 2 -- 1 file changed, 2 deletions(-)
fs/nfsd/filecache.c +0 -2
@@ -1040,8 +1040,6 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,if (likely (ret ==0 )) goto open_file; -if (ret == -EEXIST ) - goto retry;trace_nfsd_file_insert_err (rqstp, inode, may_flags, ret); status = nfserr_jukebox; goto construction_err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 171/518 nfsd: fix refcount leak when file is unhashed after being found
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 8a7926176378460e0d91e02b03f0ff20a8709a60 ]
If we wait_for_construction and find that the file is no longer hashed, and we're going to retry the open, the old nfsd_file reference is currently leaked. Put the reference before retrying.
--- fs/nfsd/filecache.c | 1 + 1 file changed, 1 insertion(+)
fs/nfsd/filecache.c +1 -0
@@ -1054,6 +1054,7 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp, status = nfserr_jukebox; goto construction_err; } +nfsd_file_put (nf); open_retry = false; goto retry; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 172/518 pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 2d357f25663ddfef47ffe26da21155302153d168 ]
Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does.
Stable-dep-of: c25478419f6f ("pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function")
--- drivers/pinctrl/mvebu/pinctrl-dove.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pinctrl/mvebu/pinctrl-dove.c +1 -2
@@ -784,8 +784,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev) }clk_prepare_enable (clk); - mpp_res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - base =devm_ioremap_resource (&pdev->dev, mpp_res); + base =devm_platform_get_and_ioremap_resource (pdev,0 , &mpp_res);if (IS_ERR (base))return PTR_ERR (base);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 173/518 pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Jianzheng <[email protected]>
[ Upstream commit c25478419f6fd3f74c324a21ec007cf14f2688d7 ]
When an error occurs during the execution of the function __devinit_dove_pinctrl_probe, the clk is not properly disabled.
Fix this by calling clk_disable_unprepare before return.
--- drivers/pinctrl/mvebu/pinctrl-dove.c | 42 +++++++++++++++++++--------- 1 file changed, 29 insertions(+), 13 deletions(-)
drivers/pinctrl/mvebu/pinctrl-dove.c +29 -13
@@ -769,7 +769,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev)of_match_device (dove_pinctrl_of_match, &pdev->dev);struct mvebu_mpp_ctrl_data *mpp_data;void __iomem *base; -int i; +int i, ret; pdev->dev.platform_data = (void *)match->data;
@@ -785,13 +785,17 @@ static int dove_pinctrl_probe(struct platform_device *pdev)clk_prepare_enable (clk); base =devm_platform_get_and_ioremap_resource (pdev,0 , &mpp_res); -if (IS_ERR (base)) -return PTR_ERR (base); +if (IS_ERR (base)) { + ret =PTR_ERR (base); + goto err_probe; + } mpp_data =devm_kcalloc (&pdev->dev, dove_pinctrl_info.ncontrols,sizeof (*mpp_data),GFP_KERNEL ); -if (!mpp_data) -return -ENOMEM ; +if (!mpp_data) { + ret = -ENOMEM ; + goto err_probe; + } dove_pinctrl_info.control_data = mpp_data;for (i =0 ; i <ARRAY_SIZE (dove_mpp_controls); i++)
@@ -810,8 +814,10 @@ static int dove_pinctrl_probe(struct platform_device *pdev) } mpp4_base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (mpp4_base)) -return PTR_ERR (mpp4_base); +if (IS_ERR (mpp4_base)) { + ret =PTR_ERR (mpp4_base); + goto err_probe; + } res =platform_get_resource (pdev,IORESOURCE_MEM ,2 );if (!res) {
@@ -822,8 +828,10 @@ static int dove_pinctrl_probe(struct platform_device *pdev) } pmu_base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (pmu_base)) -return PTR_ERR (pmu_base); +if (IS_ERR (pmu_base)) { + ret =PTR_ERR (pmu_base); + goto err_probe; + } gconfmap =syscon_regmap_lookup_by_compatible ("marvell,dove-global-config" );if (IS_ERR (gconfmap)) {
@@ -833,12 +841,17 @@ static int dove_pinctrl_probe(struct platform_device *pdev)adjust_resource (&fb_res, (mpp_res->start &INT_REGS_MASK ) +GC_REGS_OFFS ,0x14 ); gc_base =devm_ioremap_resource (&pdev->dev, &fb_res); -if (IS_ERR (gc_base)) -return PTR_ERR (gc_base); +if (IS_ERR (gc_base)) { + ret =PTR_ERR (gc_base); + goto err_probe; + } + gconfmap =devm_regmap_init_mmio (&pdev->dev, gc_base, &gc_regmap_config); -if (IS_ERR (gconfmap)) -return PTR_ERR (gconfmap); +if (IS_ERR (gconfmap)) { + ret =PTR_ERR (gconfmap); + goto err_probe; + } }/* Warn on any missing DT resource */
@@ -846,6 +859,9 @@ static int dove_pinctrl_probe(struct platform_device *pdev)dev_warn (&pdev->dev,FW_BUG "Missing pinctrl regs in DTB. Please update your firmware.\n" );return mvebu_pinctrl_probe (pdev); +err_probe: +clk_disable_unprepare (clk); +return ret; }static struct platform_driver dove_pinctrl_driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 174/518 watchdog: imx_sc_wdt: Dont disable WDT in suspend
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Blixt <[email protected]>
[ Upstream commit 2d9d6d300fb0a4ae4431bb308027ac9385746d42 ]
Parts of the suspend and resume chain is left unprotected if we disable the WDT here.
Quoted 1 line
From experiments we can see that the SCU disables and re-enables the WDT
when we enter and leave suspend to ram. By not touching the WDT here we are protected by the WDT all the way to the SCU.
--- drivers/watchdog/imx_sc_wdt.c | 24 ------------------------ 1 file changed, 24 deletions(-)
drivers/watchdog/imx_sc_wdt.c +0 -24
@@ -213,29 +213,6 @@ static int imx_sc_wdt_probe(struct platform_device *pdev)return devm_watchdog_register_device (dev, wdog); } -static int __maybe_unused imx_sc_wdt_suspend (struct device *dev) -{ -struct imx_sc_wdt_device *imx_sc_wdd =dev_get_drvdata (dev); - -if (watchdog_active (&imx_sc_wdd->wdd)) -imx_sc_wdt_stop (&imx_sc_wdd->wdd); - -return 0 ; -} - -static int __maybe_unused imx_sc_wdt_resume (struct device *dev) -{ -struct imx_sc_wdt_device *imx_sc_wdd =dev_get_drvdata (dev); - -if (watchdog_active (&imx_sc_wdd->wdd)) -imx_sc_wdt_start (&imx_sc_wdd->wdd); - -return 0 ; -} - -static SIMPLE_DEV_PM_OPS(imx_sc_wdt_pm_ops, - imx_sc_wdt_suspend, imx_sc_wdt_resume); -static const struct of_device_id imx_sc_wdt_dt_ids[] = { { .compatible ="fsl,imx-sc-wdt" , }, {/* sentinel */ }
@@ -247,7 +224,6 @@ static struct platform_driver imx_sc_wdt_driver = { .driver = { .name = "imx-sc-wdt", .of_match_table = imx_sc_wdt_dt_ids, - .pm = &imx_sc_wdt_pm_ops, }, };module_platform_driver (imx_sc_wdt_driver);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 175/518 RDMA/hns: Add mapped page count checking for MTR
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Wang <[email protected]>
[ Upstream commit 9ea9a53ea93be1cc66729ceb920f0d07285d6bfd ]
Add the mapped page count checking flow to avoid invalid page size when creating MTR.
Stable-dep-of: d586628b169d ("RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()")
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 9 ++-- drivers/infiniband/hw/hns/hns_roce_mr.c | 56 ++++++++++++++---------- 2 files changed, 40 insertions(+), 25 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +6 -3
@@ -981,9 +981,8 @@ static struct roce_hem_item *hem_list_alloc_item(struct hns_roce_dev *hr_dev,return NULL ;if (exist_bt) { - hem->addr =dma_alloc_coherent (hr_dev->dev, - count *BA_BYTE_LEN , - &hem->dma_addr,GFP_KERNEL ); + hem->addr =dma_alloc_coherent (hr_dev->dev, count *BA_BYTE_LEN , + &hem->dma_addr,GFP_KERNEL );if (!hem->addr) {kfree (hem);return NULL ;
@@ -1242,6 +1241,10 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev,if (ba_num <1 )return -ENOMEM ; +if (ba_num > unit) +return -ENOBUFS ; + + ba_num =min_t (int, ba_num, unit);INIT_LIST_HEAD (&temp_root); offset = r->offset;/* indicate to last region */
drivers/infiniband/hw/hns/hns_roce_mr.c +34 -22
105 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 176/518 RDMA/hns: Refactor root BT allocation for MTR
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Wang <[email protected]>
[ Upstream commit 1f704d8cc07269f31daf9bdafe84882ad7596a2c ]
Split the hem_list_alloc_root_bt() into serval small functions to make the code flow more clear.
Stable-dep-of: d586628b169d ("RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()")
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 230 ++++++++++++++--------- 1 file changed, 146 insertions(+), 84 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +146 -84
@@ -959,7 +959,7 @@ void hns_roce_cleanup_hem(struct hns_roce_dev *hr_dev)hns_roce_cleanup_hem_table (hr_dev, &hr_dev->mr_table.mtpt_table); } -struct roce_hem_item { +struct hns_roce_hem_item {struct list_head list;/* link all hems in the same bt level */ struct list_head sibling;/* link all hems in last hop for mtt */ void *addr;
@@ -969,12 +969,18 @@ struct roce_hem_item {int end;/* end buf offset in this hem */ }; -static struct roce_hem_item *hem_list_alloc_item (struct hns_roce_dev *hr_dev, -int start,int end, -int count,bool exist_bt, -int bt_level) +/* All HEM items are linked in a tree structure */ +struct hns_roce_hem_head { +struct list_head branch[HNS_ROCE_MAX_BT_REGION ]; +struct list_head root; +struct list_head leaf; +}; + +static struct hns_roce_hem_item * +hem_list_alloc_item (struct hns_roce_dev *hr_dev,int start,int end,int count, +bool exist_bt,int bt_level) { -struct roce_hem_item *hem; +struct hns_roce_hem_item *hem; hem =kzalloc (sizeof (*hem),GFP_KERNEL );if (!hem)
@@ -999,7 +1005,7 @@ static struct roce_hem_item *hem_list_alloc_item(struct hns_roce_dev *hr_dev, }static void hem_list_free_item (struct hns_roce_dev *hr_dev, -struct roce_hem_item *hem,bool exist_bt) +struct hns_roce_hem_item *hem,bool exist_bt) {if (exist_bt) dma_free_coherent(hr_dev->dev, hem->count * BA_BYTE_LEN,
@@ -1010,7 +1016,7 @@ static void hem_list_free_item(struct hns_roce_dev *hr_dev,static void hem_list_free_all (struct hns_roce_dev *hr_dev,struct list_head *head,bool exist_bt) { -struct roce_hem_item *hem, *temp_hem; +struct hns_roce_hem_item *hem, *temp_hem;list_for_each_entry_safe (hem, temp_hem, head, list) {list_del (&hem->list);
@@ -1026,24 +1032,24 @@ static void hem_list_link_bt(struct hns_roce_dev *hr_dev, void *base_addr,/* assign L0 table address to hem from root bt */ static void hem_list_assign_bt (struct hns_roce_dev *hr_dev, -struct roce_hem_item *hem,void *cpu_addr, +struct hns_roce_hem_item *hem,void *cpu_addr,u64 phy_addr) { hem->addr = cpu_addr; hem->dma_addr = (dma_addr_t )phy_addr; } -static inline bool hem_list_page_is_in_range (struct roce_hem_item *hem, +static inline bool hem_list_page_is_in_range (struct hns_roce_hem_item *hem,int offset) {return (hem->start <= offset && offset <= hem->end); } -static struct roce_hem_item *hem_list_search_item (struct list_head *ba_list, -int page_offset) +static struct hns_roce_hem_item *hem_list_search_item (struct list_head *ba_list, +int page_offset) { -struct roce_hem_item *hem, *temp_hem; -struct roce_hem_item *found =NULL ; +struct hns_roce_hem_item *hem, *temp_hem; +struct hns_roce_hem_item *found =NULL ;list_for_each_entry_safe (hem, temp_hem, ba_list, list) {if (hem_list_page_is_in_range (hem, page_offset)) {
@@ -1133,9 +1139,9 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, int offset, struct list_head *mid_bt, struct list_head *btm_bt) { - struct roce_hem_item *hem_ptrs[HNS_ROCE_MAX_BT_LEVEL] = { NULL }; + struct hns_roce_hem_item *hem_ptrs[HNS_ROCE_MAX_BT_LEVEL] = { NULL };struct list_head temp_list[HNS_ROCE_MAX_BT_LEVEL ]; -struct roce_hem_item *cur, *pre; +struct hns_roce_hem_item *cur, *pre;const int hopnum = r->hopnum;int start_aligned;int distance;
@@ -1213,56 +1219,96 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,return ret; } -static int hem_list_alloc_root_bt (struct hns_roce_dev *hr_dev, -struct hns_roce_hem_list *hem_list,int unit, -const struct hns_roce_buf_region *regions, -int region_cnt) +static struct hns_roce_hem_item * +alloc_root_hem (struct hns_roce_dev *hr_dev,int unit,int *max_ba_num, +const struct hns_roce_buf_region *regions,int region_cnt) { -struct list_head temp_list[HNS_ROCE_MAX_BT_REGION ]; -struct roce_hem_item *hem, *temp_hem, *root_hem;const struct hns_roce_buf_region *r; -struct list_head temp_root; -struct list_head temp_btm; -void *cpu_base; -u64 phy_base; -int ret =0 ; +struct hns_roce_hem_item *hem;int ba_num;int offset; -int total; -int step; -int i; - - r = ®ions[0 ]; - root_hem =hem_list_search_item (&hem_list->root_bt, r->offset); -if (root_hem) -return 0 ; ba_num =hns_roce_hem_list_calc_root_ba (regions, region_cnt, unit);if (ba_num <1 ) -return -ENOMEM ; +return ERR_PTR (-ENOMEM );if (ba_num > unit) -return -ENOBUFS ; +return ERR_PTR (-ENOBUFS ); - ba_num =min_t (int, ba_num, unit); -INIT_LIST_HEAD (&temp_root); - offset = r->offset; + offset = regions[0 ].offset;/* indicate to last region */ r = ®ions[region_cnt -1 ]; - root_hem =hem_list_alloc_item (hr_dev, offset, r->offset + r->count -1 , - ba_num, true,0 ); -if (!root_hem) + hem =hem_list_alloc_item (hr_dev, offset, r->offset + r->count -1 , + ba_num, true,0 ); +if (!hem) +return ERR_PTR (-ENOMEM ); + + *max_ba_num = ba_num; + +return hem; +} + +static int alloc_fake_root_bt (struct hns_roce_dev *hr_dev,void *cpu_base, +u64 phy_base,const struct hns_roce_buf_region *r, +struct list_head *branch_head, +struct list_head *leaf_head) +{ +struct hns_roce_hem_item *hem; + + hem =hem_list_alloc_item (hr_dev, r->offset, r->offset + r->count -1 , + r->count, false,0 ); +if (!hem)return -ENOMEM ; -list_add (&root_hem->list, &temp_root); - hem_list->root_ba = root_hem->dma_addr; +hem_list_assign_bt (hr_dev, hem, cpu_base, phy_base); +list_add (&hem->list, branch_head); +list_add (&hem->sibling, leaf_head); -INIT_LIST_HEAD (&temp_btm); -for (i =0 ; i < region_cnt; i++) -INIT_LIST_HEAD (&temp_list[i]); +return r->count; +} + +static int setup_middle_bt (struct hns_roce_dev *hr_dev,void *cpu_base, +int unit,const struct hns_roce_buf_region *r, +const struct list_head *branch_head) +{ +struct hns_roce_hem_item *hem, *temp_hem; +int total =0 ; +int offset; +int step; + + step =hem_list_calc_ba_range (r->hopnum,1 , unit); +if (step <1 ) +return -EINVAL ; + +/* if exist mid bt, link L1 to L0 */ +list_for_each_entry_safe (hem, temp_hem, branch_head, list) { + offset = (hem->start - r->offset) / step *BA_BYTE_LEN ; +hem_list_link_bt (hr_dev, cpu_base + offset, hem->dma_addr); + total++; + } + +return total; +} + +static int +setup_root_hem (struct hns_roce_dev *hr_dev,struct hns_roce_hem_list *hem_list, +int unit,int max_ba_num,struct hns_roce_hem_head *head, +const struct hns_roce_buf_region *regions,int region_cnt) +{ +const struct hns_roce_buf_region *r; +struct hns_roce_hem_item *root_hem; +void *cpu_base; +u64 phy_base; +int i, total; +int ret; + + root_hem =list_first_entry (&head->root, + struct hns_roce_hem_item, list); +if (!root_hem) +return -ENOMEM ; total =0 ; -for (i =0 ; i < region_cnt && total < ba_num; i++) { +for (i =0 ; i < region_cnt && total < max_ba_num; i++) { r = ®ions[i];if (!r->count)continue ;
@@ -1274,48 +1320,64 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev,/* if hopnum is 0 or 1, cut a new fake hem from the root bt * which's address share to all regions. */ -if (hem_list_is_bottom_bt (r->hopnum,0 )) { - hem =hem_list_alloc_item (hr_dev, r->offset, - r->offset + r->count -1 , - r->count, false,0 ); -if (!hem) { - ret = -ENOMEM ; - goto err_exit; - } -hem_list_assign_bt (hr_dev, hem, cpu_base, phy_base); -list_add (&hem->list, &temp_list[i]); -list_add (&hem->sibling, &temp_btm); - total += r->count; - }else { - step =hem_list_calc_ba_range (r->hopnum,1 , unit); -if (step <1 ) { - ret = -EINVAL ; - goto err_exit; - } -/* if exist mid bt, link L1 to L0 */ -list_for_each_entry_safe (hem, temp_hem, - &hem_list->mid_bt[i][1 ], list) { - offset = (hem->start - r->offset) / step * -BA_BYTE_LEN ; -hem_list_link_bt (hr_dev, cpu_base + offset, - hem->dma_addr); - total++; - } - } +if (hem_list_is_bottom_bt (r->hopnum,0 )) + ret =alloc_fake_root_bt (hr_dev, cpu_base, phy_base, r, + &head->branch[i], &head->leaf); +else + ret =setup_middle_bt (hr_dev, cpu_base, unit, r, + &hem_list->mid_bt[i][1 ]); + +if (ret <0 ) +return ret; + + total += ret; } -list_splice (&temp_btm, &hem_list->btm_bt); -list_splice (&temp_root, &hem_list->root_bt); +list_splice (&head->leaf, &hem_list->btm_bt); +list_splice (&head->root, &hem_list->root_bt);for (i =0 ; i < region_cnt; i++) -list_splice (&temp_list[i], &hem_list->mid_bt[i][0 ]); +list_splice (&head->branch[i], &hem_list->mid_bt[i][0 ]);return 0 ; +} -err_exit: +static int hem_list_alloc_root_bt (struct hns_roce_dev *hr_dev, +struct hns_roce_hem_list *hem_list,int unit, +const struct hns_roce_buf_region *regions, +int region_cnt) +{ +struct hns_roce_hem_item *root_hem; +struct hns_roce_hem_head head; +int max_ba_num; +int ret; +int i; + + root_hem =hem_list_search_item (&hem_list->root_bt, regions[0 ].offset); +if (root_hem) +return 0 ; + + max_ba_num =0 ; + root_hem =alloc_root_hem (hr_dev, unit, &max_ba_num, regions, + region_cnt); +if (IS_ERR (root_hem)) +return PTR_ERR (root_hem); + +/* List head for storing all allocated HEM items */ +INIT_LIST_HEAD (&head.root); +INIT_LIST_HEAD (&head.leaf);for (i =0 ; i < region_cnt; i++) -hem_list_free_all (hr_dev, &temp_list[i], false); +INIT_LIST_HEAD (&head.branch[i]); -hem_list_free_all (hr_dev, &temp_root, true); + hem_list->root_ba = root_hem->dma_addr; +list_add (&root_hem->list, &head.root); + ret =setup_root_hem (hr_dev, hem_list, unit, max_ba_num, &head, regions, + region_cnt); +if (ret) { +for (i =0 ; i < region_cnt; i++) +hem_list_free_all (hr_dev, &head.branch[i], false); + +hem_list_free_all (hr_dev, &head.root, true); + }return ret; }
@@ -1401,7 +1463,7 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev, int offset, int *mtt_cnt, u64 *phy_addr) { struct list_head *head = &hem_list->btm_bt; -struct roce_hem_item *hem, *temp_hem; +struct hns_roce_hem_item *hem, *temp_hem;void *cpu_base =NULL ;u64 phy_base =0 ;int nr =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 177/518 RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: wenglianfa <[email protected]>
[ Upstream commit d586628b169d14bbf36be64d2b3ec9d9d2fe0432 ]
The max value of 'unit' and 'hop_num' is 2^24 and 2, so the value of 'step' may exceed the range of u32. Change the type of 'step' to u64.
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +6 -6
@@ -1079,9 +1079,9 @@ static bool hem_list_is_bottom_bt(int hopnum, int bt_level)* @bt_level: base address table level * @unit: ba entries per bt page */ -static u32 hem_list_calc_ba_range (int hopnum,int bt_level,int unit) +static u64 hem_list_calc_ba_range (int hopnum,int bt_level,int unit) { -u32 step; +u64 step;int max;int i;
@@ -1117,7 +1117,7 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions, {struct hns_roce_buf_region *r;int total =0 ; -int step; +u64 step;int i;for (i =0 ; i < region_cnt; i++) {
@@ -1148,7 +1148,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,int ret =0 ;int max_ofs;int level; -u32 step; +u64 step;int end;if (hopnum <=1 )
@@ -1185,7 +1185,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, } start_aligned = (distance / step) * step + r->offset; - end =min_t (int, start_aligned + step -1 , max_ofs); + end =min_t (u64, start_aligned + step -1 , max_ofs); cur =hem_list_alloc_item (hr_dev, start_aligned, end, unit, true, level);if (!cur) {
@@ -1274,7 +1274,7 @@ static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base,struct hns_roce_hem_item *hem, *temp_hem;int total =0 ;int offset; -int step; +u64 step; step =hem_list_calc_ba_range (r->hopnum,1 , unit);if (step <1 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 178/518 RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 74d315b5af180220d561684d15897730135733a6 ]
Fix missuse of spin_lock_irq()/spin_unlock_irq() when spin_lock_irqsave()/spin_lock_irqrestore() was hold.
This was discovered through the lock debugging, and the corresponding log is as follows:
raw_local_irq_restore() called with IRQs enabled
WARNING: CPU: 96 PID: 2074 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40 ... Call trace: warn_bogus_irq_restore+0x30/0x40 _raw_spin_unlock_irqrestore+0x84/0xc8 add_qp_to_list+0x11c/0x148 [hns_roce_hw_v2] hns_roce_create_qp_common.constprop.0+0x240/0x780 [hns_roce_hw_v2] hns_roce_create_qp+0x98/0x160 [hns_roce_hw_v2] create_qp+0x138/0x258 ib_create_qp_kernel+0x50/0xe8 create_mad_qp+0xa8/0x128 ib_mad_port_open+0x218/0x448 ib_mad_init_device+0x70/0x1f8 add_client_context+0xfc/0x220 enable_device_and_get+0xd0/0x140 ib_register_device.part.0+0xf4/0x1c8 ib_register_device+0x34/0x50 hns_roce_register_device+0x174/0x3d0 [hns_roce_hw_v2] hns_roce_init+0xfc/0x2c0 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x7c/0x1d0 [hns_roce_hw_v2] hns_roce_hw_v2_init_instance+0x9c/0x180 [hns_roce_hw_v2]
--- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/infiniband/hw/hns/hns_roce_qp.c +8 -8
@@ -1287,19 +1287,19 @@ void hns_roce_lock_cqs(struct hns_roce_cq *send_cq, struct hns_roce_cq *recv_cq)__acquire (&send_cq->lock);__acquire (&recv_cq->lock); }else if (unlikely (send_cq !=NULL && recv_cq ==NULL )) { -spin_lock_irq (&send_cq->lock); +spin_lock (&send_cq->lock);__acquire (&recv_cq->lock); }else if (unlikely (send_cq ==NULL && recv_cq !=NULL )) { -spin_lock_irq (&recv_cq->lock); +spin_lock (&recv_cq->lock);__acquire (&send_cq->lock); }else if (send_cq == recv_cq) { -spin_lock_irq (&send_cq->lock); +spin_lock (&send_cq->lock);__acquire (&recv_cq->lock); }else if (send_cq->cqn < recv_cq->cqn) { -spin_lock_irq (&send_cq->lock); +spin_lock (&send_cq->lock);spin_lock_nested (&recv_cq->lock,SINGLE_DEPTH_NESTING ); }else { -spin_lock_irq (&recv_cq->lock); +spin_lock (&recv_cq->lock);spin_lock_nested (&send_cq->lock,SINGLE_DEPTH_NESTING ); } }
@@ -1319,13 +1319,13 @@ void hns_roce_unlock_cqs(struct hns_roce_cq *send_cq,spin_unlock (&recv_cq->lock); }else if (send_cq == recv_cq) {__release (&recv_cq->lock); -spin_unlock_irq (&send_cq->lock); +spin_unlock (&send_cq->lock); }else if (send_cq->cqn < recv_cq->cqn) {spin_unlock (&recv_cq->lock); -spin_unlock_irq (&send_cq->lock); +spin_unlock (&send_cq->lock); }else {spin_unlock (&send_cq->lock); -spin_unlock_irq (&recv_cq->lock); +spin_unlock (&recv_cq->lock); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 179/518 RDMA/hns: Optimize hem allocation performance
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit fe51f6254d81f5a69c31df16353d6539b2b51630 ]
When allocating MTT hem, for each hop level of each hem that is being allocated, the driver iterates the hem list to find out whether the bt page has been allocated in this hop level. If not, allocate a new one and splice it to the list. The time complexity is O(n^2) in worst cases.
Currently the allocation for-loop uses 'unit' as the step size. This actually has taken into account the reuse of last-hop-level MTT bt pages by multiple buffer pages. Thus pages of last hop level will never have been allocated, so there is no need to iterate the hem list in last hop level.
Removing this unnecessary iteration can reduce the time complexity to O(n).
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +6 -4
@@ -1172,10 +1172,12 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,/* config L1 bt to last bt and link them to corresponding parent */ for (level =1 ; level < hopnum; level++) { - cur =hem_list_search_item (&mid_bt[level], offset); -if (cur) { - hem_ptrs[level] = cur; -continue ; +if (!hem_list_is_bottom_bt (hopnum, level)) { + cur =hem_list_search_item (&mid_bt[level], offset); +if (cur) { + hem_ptrs[level] = cur; +continue ; + } } step =hem_list_calc_ba_range (hopnum, level, unit);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 180/518 riscv: Fix fp alignment bug in perf_callchain_user()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 22ab08955ea13be04a8efd20cc30890e0afaa49c ]
The standard RISC-V calling convention said:
"The stack grows downward and the stack pointer is always kept 16-byte aligned".
So perf_callchain_user() should check whether 16-byte aligned for fp.
--- arch/riscv/kernel/perf_callchain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/perf_callchain.c +1 -1
@@ -71,7 +71,7 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry,perf_callchain_store (entry, regs->epc); fp =user_backtrace (entry, fp, regs->ra); -while (fp && !(fp &0x3 ) && entry->nr < entry->max_stack) +while (fp && !(fp &0x7 ) && entry->nr < entry->max_stack) fp =user_backtrace (entry, fp,0 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 181/518 RDMA/cxgb4: Added NULL check for lookup_atid
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Lobanov <[email protected]>
[ Upstream commit e766e6a92410ca269161de059fff0843b8ddd65f ]
The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the act_establish() and act_open_rpl() functions. Add a NULL check to prevent null pointer dereferencing.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/infiniband/hw/cxgb4/cm.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/infiniband/hw/cxgb4/cm.c +5 -0
@@ -1222,6 +1222,8 @@ static int act_establish(struct c4iw_dev *dev, struct sk_buff *skb)int ret; ep =lookup_atid (t, atid); +if (!ep) +return -EINVAL ;pr_debug ("ep %p tid %u snd_isn %u rcv_isn %u\n" , ep, tid,be32_to_cpu (req->snd_isn),be32_to_cpu (req->rcv_isn));
@@ -2279,6 +2281,9 @@ static int act_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)int ret =0 ; ep =lookup_atid (t, atid); +if (!ep) +return -EINVAL ; + la = (struct sockaddr_in *)&ep->com.local_addr; ra = (struct sockaddr_in *)&ep->com.remote_addr; la6 = (struct sockaddr_in6 *)&ep->com.local_addr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 182/518 ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit e229897d373a87ee09ec5cc4ecd4bb2f895fc16b ]
The debugfs_create_dir() function returns error pointers. It never returns NULL. So use IS_ERR() to check it.
--- drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ntb/hw/intel/ntb_hw_gen1.c +1 -1
@@ -778,7 +778,7 @@ static void ndev_init_debugfs(struct intel_ntb_dev *ndev) ndev->debugfs_dir =debugfs_create_dir (pci_name (ndev->ntb.pdev), debugfs_dir); -if (!ndev->debugfs_dir) +if (IS_ERR (ndev->debugfs_dir)) ndev->debugfs_info =NULL ;else ndev->debugfs_info =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 183/518 ntb_perf: Fix printk format
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Hawking <[email protected]>
[ Upstream commit 1501ae7479c8d0f66efdbfdc9ae8d6136cefbd37 ]
The correct printk format is %pa or %pap, but not %pa[p].
--- drivers/ntb/test/ntb_perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ntb/test/ntb_perf.c +1 -1
@@ -1227,7 +1227,7 @@ static ssize_t perf_dbgfs_read_info(struct file *filep, char __user *ubuf, "\tOut buffer addr 0x%pK\n", peer->outbuf); pos +=scnprintf (buf + pos, buf_size - pos, -"\tOut buff phys addr %pa[p]\n" , &peer->out_phys_addr); +"\tOut buff phys addr %pap\n" , &peer->out_phys_addr); pos +=scnprintf (buf + pos, buf_size - pos,"\tOut buffer size %pa\n" , &peer->outbuf_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 184/518 nfsd: call cache_put if xdr_reserve_space returns NULL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <[email protected]>
[ Upstream commit d078cbf5c38de83bc31f83c47dcd2184c04a50c7 ]
If not enough buffer space available, but idmap_lookup has triggered lookup_fn which calls cache_get and returns successfully. Then we missed to call cache_put here which pairs with cache_get.
--- fs/nfsd/nfs4idmap.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/nfsd/nfs4idmap.c +9 -4
@@ -581,6 +581,7 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr, .id = id, .type = type, }; +__be32 status = nfs_ok;__be32 *p;int ret;struct nfsd_net *nn =net_generic (SVC_NET (rqstp), nfsd_net_id);
@@ -593,12 +594,16 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr,return nfserrno (ret); ret =strlen (item->name);WARN_ON_ONCE (ret >IDMAP_NAMESZ ); + p =xdr_reserve_space (xdr, ret +4 ); -if (!p) -return nfserr_resource; - p =xdr_encode_opaque (p, item->name, ret); +if (unlikely (!p)) { + status = nfserr_resource; + goto out_put; + } +xdr_encode_opaque (p, item->name, ret); +out_put:cache_put (&item->h, nn->idtoname_cache); -return 0 ; +return status; } static bool
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 185/518 nfsd: return -EINVAL when namelen is 0
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
[ Upstream commit 22451a16b7ab7debefce660672566be887db1637 ]
When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdup_user() to return ZERO_SIZE_PTR.
When we access the name.data that has been assigned the value of ZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is triggered.
[ T1205] ==================================================================
[ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260
[ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205
[ T1205]
[ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406
[ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ T1205] Call Trace:
[ T1205] dump_stack+0x9a/0xd0 [ T1205] ? nfs4_client_to_reclaim+0xe9/0x260 [ T1205] __kasan_report.cold+0x34/0x84 [ T1205] ? nfs4_client_to_reclaim+0xe9/0x260 [ T1205] kasan_report+0x3a/0x50 [ T1205] nfs4_client_to_reclaim+0xe9/0x260 [ T1205] ? nfsd4_release_lockowner+0x410/0x410 [ T1205] cld_pipe_downcall+0x5ca/0x760 [ T1205] ? nfsd4_cld_tracking_exit+0x1d0/0x1d0 [ T1205] ? down_write_killable_nested+0x170/0x170 [ T1205] ? avc_policy_seqno+0x28/0x40 [ T1205] ? selinux_file_permission+0x1b4/0x1e0 [ T1205] rpc_pipe_write+0x84/0xb0 [ T1205] vfs_write+0x143/0x520 [ T1205] ksys_write+0xc9/0x170 [ T1205] ? __ia32_sys_read+0x50/0x50 [ T1205] ? ktime_get_coarse_real_ts64+0xfe/0x110 [ T1205] ? ktime_get_coarse_real_ts64+0xa2/0x110 [ T1205] do_syscall_64+0x33/0x40 [ T1205] entry_SYSCALL_64_after_hwframe+0x67/0xd1
[ T1205] RIP: 0033:0x7fdbdb761bc7
[ T1205] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 514 [ T1205] RSP: 002b:00007fff8c4b7248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ T1205] RAX: ffffffffffffffda RBX: 000000000000042b RCX: 00007fdbdb761bc7
[ T1205] RDX: 000000000000042b RSI: 00007fff8c4b75f0 RDI: 0000000000000008
[ T1205] RBP: 00007fdbdb761bb0 R08: 0000000000000000 R09: 0000000000000001
[ T1205] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000042b
[ T1205] R13: 0000000000000008 R14: 00007fff8c4b75f0 R15: 0000000000000000
[ T1205] ==================================================================
Fix it by checking namelen.
--- fs/nfsd/nfs4recover.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/nfsd/nfs4recover.c +8 -0
@@ -806,6 +806,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, ci = &cmsg->cm_u.cm_clntinfo;if (get_user (namelen, &ci->cc_name.cn_len))return -EFAULT ; +if (!namelen) { +dprintk ("%s: namelen should not be zero" , __func__); +return -EINVAL ; + } name.data =memdup_user (&ci->cc_name.cn_id, namelen);if (IS_ERR (name.data))return PTR_ERR (name.data);
@@ -828,6 +832,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, cnm = &cmsg->cm_u.cm_name;if (get_user (namelen, &cnm->cn_len))return -EFAULT ; +if (!namelen) { +dprintk ("%s: namelen should not be zero" , __func__); +return -EINVAL ; + } name.data =memdup_user (&cnm->cn_id, namelen);if (IS_ERR (name.data))return PTR_ERR (name.data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 186/518 f2fs: enhance to update i_mode and acl atomically in f2fs_setattr()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 17232e830afb800acdcc22ae8980bf9d330393ef ]
Previously, in f2fs_setattr(), we don't update S_ISUID|S_ISGID|S_ISVTX bits with S_IRWXUGO bits and acl entries atomically, so in error path, chmod() may partially success, this patch enhances to make chmod() flow being atomical.
Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
--- fs/f2fs/acl.c | 23 ++++++++++++++++++++++- fs/f2fs/file.c | 6 ++++-- fs/f2fs/xattr.c | 15 +++++++++------ 3 files changed, 35 insertions(+), 9 deletions(-)
fs/f2fs/acl.c +22 -1
@@ -200,6 +200,27 @@ struct posix_acl *f2fs_get_acl(struct inode *inode, int type)return __f2fs_get_acl (inode, type,NULL ); } +static int f2fs_acl_update_mode (struct inode *inode,umode_t *mode_p, +struct posix_acl **acl) +{ +umode_t mode = inode->i_mode; +int error; + +if (is_inode_flag_set (inode,FI_ACL_MODE )) + mode =F2FS_I (inode)->i_acl_mode; + + error =posix_acl_equiv_mode (*acl, &mode); +if (error <0 ) +return error; +if (error ==0 ) + *acl =NULL ; +if (!in_group_p (inode->i_gid) && + !capable_wrt_inode_uidgid (inode,CAP_FSETID )) + mode &= ~S_ISGID ; + *mode_p = mode; +return 0 ; +} +static int __f2fs_set_acl (struct inode *inode,int type,struct posix_acl *acl,struct page *ipage) {
@@ -213,7 +234,7 @@ static int __f2fs_set_acl(struct inode *inode, int type,case ACL_TYPE_ACCESS : name_index =F2FS_XATTR_INDEX_POSIX_ACL_ACCESS ;if (acl && !ipage) { - error =posix_acl_update_mode (inode, &mode, &acl); + error =f2fs_acl_update_mode (inode, &mode, &acl);if (error)return error;set_acl_inode (inode, mode);
fs/f2fs/file.c +4 -2
@@ -980,8 +980,10 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)if (attr->ia_valid &ATTR_MODE ) { err =posix_acl_chmod (inode,f2fs_get_inode_mode (inode)); -if (err ||is_inode_flag_set (inode,FI_ACL_MODE )) { - inode->i_mode =F2FS_I (inode)->i_acl_mode; + +if (is_inode_flag_set (inode,FI_ACL_MODE )) { +if (!err) + inode->i_mode =F2FS_I (inode)->i_acl_mode;clear_inode_flag (inode,FI_ACL_MODE ); } }
fs/f2fs/xattr.c +9 -6
@@ -673,7 +673,7 @@ static int __f2fs_setxattr(struct inode *inode, int index, }if (value &&f2fs_xattr_value_same (here, value, size)) - goto exit; + goto same; }else if ((flags &XATTR_REPLACE )) { error = -ENODATA ; goto exit;
@@ -753,17 +753,20 @@ static int __f2fs_setxattr(struct inode *inode, int index,if (error) goto exit; -if (is_inode_flag_set (inode,FI_ACL_MODE )) { - inode->i_mode =F2FS_I (inode)->i_acl_mode; - inode->i_ctime =current_time (inode); -clear_inode_flag (inode,FI_ACL_MODE ); - }if (index ==F2FS_XATTR_INDEX_ENCRYPTION && !strcmp (name,F2FS_XATTR_NAME_ENCRYPTION_CONTEXT ))f2fs_set_encrypted_inode (inode);f2fs_mark_inode_dirty_sync (inode, true);if (!error &&S_ISDIR (inode->i_mode))set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_CP ); + +same: +if (is_inode_flag_set (inode,FI_ACL_MODE )) { + inode->i_mode =F2FS_I (inode)->i_acl_mode; + inode->i_ctime =current_time (inode); +clear_inode_flag (inode,FI_ACL_MODE ); + } + exit:kfree (base_addr);return error;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 187/518 f2fs: fix typo
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonggil Song <[email protected]>
[ Upstream commit d382e36970ecf8242921400db2afde15fb6ed49e ]
Fix typo in f2fs.h
Detected by Jaeyoon Choi
Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
--- fs/f2fs/f2fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/f2fs.h +1 -1
@@ -249,7 +249,7 @@ enum {ORPHAN_INO ,/* for orphan ino list */ APPEND_INO ,/* for append ino list */ UPDATE_INO ,/* for update ino list */ -TRANS_DIR_INO ,/* for trasactions dir ino list */ +TRANS_DIR_INO ,/* for transactions dir ino list */ FLUSH_INO ,/* for multiple device flushing */ MAX_INO_ENTRY, /* max. list */ };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 188/518 f2fs: fix to update i_ctime in __f2fs_setxattr()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 8874ad7dae8d91d24cc87c545c0073b3b2da5688 ]
generic/728 - output mismatch (see /media/fstests/results//generic/728.out.bad)
--- tests/generic/728.out 2023-07-19 07:10:48.362711407 +0000
+++ /media/fstests/results//generic/728.out.bad 2023-07-19 08:39:57.000000000 +0000
QA output created by 728
+Expected ctime to change after setxattr.
+Expected ctime to change after removexattr.
Silence is golden
...
(Run 'diff -u /media/fstests/tests/generic/728.out /media/fstests/results//generic/728.out.bad' to see the entire diff)
generic/729 1s
It needs to update i_ctime after {set,remove}xattr, fix it.
Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
--- fs/f2fs/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/xattr.c +2 -2
@@ -756,17 +756,17 @@ static int __f2fs_setxattr(struct inode *inode, int index,if (index ==F2FS_XATTR_INDEX_ENCRYPTION && !strcmp (name,F2FS_XATTR_NAME_ENCRYPTION_CONTEXT ))f2fs_set_encrypted_inode (inode); -f2fs_mark_inode_dirty_sync (inode, true);if (!error &&S_ISDIR (inode->i_mode))set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_CP ); same:if (is_inode_flag_set (inode,FI_ACL_MODE )) { inode->i_mode =F2FS_I (inode)->i_acl_mode; - inode->i_ctime =current_time (inode);clear_inode_flag (inode,FI_ACL_MODE ); } + inode->i_ctime =current_time (inode); +f2fs_mark_inode_dirty_sync (inode, true); exit:kfree (base_addr);return error;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 189/518 f2fs: remove unneeded check condition in __f2fs_setxattr()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit bc3994ffa4cf23f55171943c713366132c3ff45d ]
It has checked return value of write_all_xattrs(), remove unneeded following check condition.
Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
--- fs/f2fs/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/xattr.c +1 -1
@@ -756,7 +756,7 @@ static int __f2fs_setxattr(struct inode *inode, int index,if (index ==F2FS_XATTR_INDEX_ENCRYPTION && !strcmp (name,F2FS_XATTR_NAME_ENCRYPTION_CONTEXT ))f2fs_set_encrypted_inode (inode); -if (!error &&S_ISDIR (inode->i_mode)) +if (S_ISDIR (inode->i_mode))set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_CP ); same:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 190/518 f2fs: reduce expensive checkpoint trigger frequency
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit aaf8c0b9ae042494cb4585883b15c1332de77840 ]
We may trigger high frequent checkpoint for below case:
1. mkdir /mnt/dir1; set dir1 encrypted
2. touch /mnt/file1; fsync /mnt/file1
3. mkdir /mnt/dir2; set dir2 encrypted
4. touch /mnt/file2; fsync /mnt/file2
...
Although, newly created dir and file are not related, due to commit bbf156f7afa7 ("f2fs: fix lost xattrs of directories"), we will trigger checkpoint whenever fsync() comes after a new encrypted dir created.
In order to avoid such performance regression issue, let's record an entry including directory's ino in global cache whenever we update directory's xattr data, and then triggerring checkpoint() only if xattr metadata of target file's parent was updated.
This patch updates to cover below no encryption case as well:
1) parent is checkpointed
2) set_xattr(dir) w/ new xnid
3) create(file)
4) fsync(file)
--- fs/f2fs/f2fs.h | 2 ++ fs/f2fs/file.c | 3 +++ fs/f2fs/xattr.c | 14 ++++++++++++-- include/trace/events/f2fs.h | 3 ++- 4 files changed, 19 insertions(+), 3 deletions(-)
fs/f2fs/f2fs.h +2 -0
@@ -250,6 +250,7 @@ enum {APPEND_INO ,/* for append ino list */ UPDATE_INO ,/* for update ino list */ TRANS_DIR_INO ,/* for transactions dir ino list */ +XATTR_DIR_INO ,/* for xattr updated dir ino list */ FLUSH_INO ,/* for multiple device flushing */ MAX_INO_ENTRY, /* max. list */ };
@@ -1070,6 +1071,7 @@ enum cp_reason_type {CP_FASTBOOT_MODE ,CP_SPEC_LOG_NUM ,CP_RECOVER_DIR , + CP_XATTR_DIR, }; enum iostat_type {
fs/f2fs/file.c +3 -0
@@ -214,6 +214,9 @@ static inline enum cp_reason_type need_do_checkpoint(struct inode *inode) f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino, TRANS_DIR_INO)) cp_reason =CP_RECOVER_DIR ; + else if (f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino, +XATTR_DIR_INO )) + cp_reason =CP_XATTR_DIR ;return cp_reason; }
fs/f2fs/xattr.c +12 -2
@@ -627,6 +627,7 @@ static int __f2fs_setxattr(struct inode *inode, int index, const char *name, const void *value, size_t size, struct page *ipage, int flags) { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode);struct f2fs_xattr_entry *here, *last;void *base_addr, *last_base_addr;int found, newsize;
@@ -756,9 +757,18 @@ static int __f2fs_setxattr(struct inode *inode, int index,if (index ==F2FS_XATTR_INDEX_ENCRYPTION && !strcmp (name,F2FS_XATTR_NAME_ENCRYPTION_CONTEXT ))f2fs_set_encrypted_inode (inode); -if (S_ISDIR (inode->i_mode)) -set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_CP ); +if (!S_ISDIR (inode->i_mode)) + goto same; +/* +* In restrict mode, fsync() always try to trigger checkpoint for all +* metadata consistency, in other mode, it triggers checkpoint when +* parent's xattr metadata was updated. +*/ +if (F2FS_OPTION (sbi).fsync_mode ==FSYNC_MODE_STRICT ) +set_sbi_flag (sbi,SBI_NEED_CP ); +else +f2fs_add_ino_entry (sbi, inode->i_ino,XATTR_DIR_INO ); same:if (is_inode_flag_set (inode,FI_ACL_MODE )) { inode->i_mode =F2FS_I (inode)->i_acl_mode;
include/trace/events/f2fs.h +2 -1
@@ -145,7 +145,8 @@ TRACE_DEFINE_ENUM(CP_RESIZE); { CP_NODE_NEED_CP, "node needs cp" }, \ { CP_FASTBOOT_MODE, "fastboot mode" }, \ { CP_SPEC_LOG_NUM, "log type is 2" }, \ - { CP_RECOVER_DIR, "dir needs recovery" }) + { CP_RECOVER_DIR, "dir needs recovery" }, \ + { CP_XATTR_DIR, "dir's xattr updated" }) #define show_shutdown_mode(type) \ __print_symbolic(type, \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 191/518 spi: lpspi: Silence error message upon deferred probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 12f62a857c83b2efcbf8d9961aacd352bf81ad3d ]
Do not print error messages with error code -517. Silences the following errors upon on imx8qm:fsl_lpspi 5a000000.spi: spi_register_controller error: -517 fsl_lpspi 5a010000.spi: spi_register_controller error: -517 fsl_lpspi 5a020000.spi: spi_register_controller error: -517
Stable-dep-of: 3b577de206d5 ("spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time")
--- drivers/spi/spi-fsl-lpspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-fsl-lpspi.c +1 -1
@@ -919,7 +919,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev) ret =devm_spi_register_controller (&pdev->dev, controller);if (ret <0 ) { -dev_err (&pdev->dev,"spi_register_controller error.\n" ); +dev_err_probe (&pdev->dev, ret,"spi_register_controller error: %i\n" , ret); goto out_pm_get; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 192/518 spi: lpspi: release requested DMA channels
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit f02bff30114f385d53ae3e45141db602923bca5d ]
The requested DMA channels are never released. Do this in .remove as well as in .probe. spi_register_controller() can return -EPROBE_DEFER if cs-gpios are not probed yet.
Stable-dep-of: 3b577de206d5 ("spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time")
--- drivers/spi/spi-fsl-lpspi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/spi/spi-fsl-lpspi.c +5 -1
@@ -920,7 +920,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev) ret =devm_spi_register_controller (&pdev->dev, controller);if (ret <0 ) {dev_err_probe (&pdev->dev, ret,"spi_register_controller error: %i\n" , ret); - goto out_pm_get; + goto free_dma; }pm_runtime_mark_last_busy (fsl_lpspi->dev);
@@ -928,6 +928,8 @@ static int fsl_lpspi_probe(struct platform_device *pdev)return 0 ; +free_dma: +fsl_lpspi_dma_exit (controller); out_pm_get:pm_runtime_dont_use_autosuspend (fsl_lpspi->dev);pm_runtime_put_sync (fsl_lpspi->dev);
@@ -944,6 +946,8 @@ static int fsl_lpspi_remove(struct platform_device *pdev)struct fsl_lpspi_data *fsl_lpspi =spi_controller_get_devdata (controller); +fsl_lpspi_dma_exit (controller); +pm_runtime_disable (fsl_lpspi->dev);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 193/518 spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 3b577de206d52dbde9428664b6d823d35a803d75 ]
It's important to undo pm_runtime_use_autosuspend() with pm_runtime_dont_use_autosuspend() at driver exit time unless driver initially enabled pm_runtime with devm_pm_runtime_enable() (which handles it for you).
Hence, call pm_runtime_dont_use_autosuspend() at driver exit time to fix it.
--- drivers/spi/spi-fsl-lpspi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-fsl-lpspi.c +1 -0
@@ -948,6 +948,7 @@ static int fsl_lpspi_remove(struct platform_device *pdev)fsl_lpspi_dma_exit (controller); +pm_runtime_dont_use_autosuspend (fsl_lpspi->dev);pm_runtime_disable (fsl_lpspi->dev);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 194/518 iio: adc: ad7606: fix oversampling gpio array
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Stols <[email protected]>
[ Upstream commit 8dc4594b54dbaaba40dc8884ad3d42083de39434 ]
gpiod_set_array_value was misused here: the implementation relied on the assumption that an unsigned long was required for each gpio, while the function expects a bit array stored in "as much unsigned long as needed for storing one bit per GPIO", i.e it is using a bit field.
This leaded to incorrect parameter passed to gpiod_set_array_value, that would set 1 value instead of 3.
It also prevents to select the software mode correctly for the AD7606B.
--- drivers/iio/adc/ad7606.c | 4 ++-- drivers/iio/adc/ad7606_spi.c | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/iio/adc/ad7606.c +2 -2
@@ -238,9 +238,9 @@ static int ad7606_write_os_hw(struct iio_dev *indio_dev, int val)struct ad7606_state *st =iio_priv (indio_dev);DECLARE_BITMAP (values,3 ); - values[0 ] = val; + values[0 ] = val &GENMASK (2 ,0 ); -gpiod_set_array_value (ARRAY_SIZE (values), st->gpio_os->desc, +gpiod_set_array_value (st->gpio_os->ndescs, st->gpio_os->desc, st->gpio_os->info, values);/* AD7616 requires a reset to update value */
drivers/iio/adc/ad7606_spi.c +3 -2
@@ -249,8 +249,9 @@ static int ad7616_sw_mode_config(struct iio_dev *indio_dev)static int ad7606B_sw_mode_config (struct iio_dev *indio_dev) {struct ad7606_state *st =iio_priv (indio_dev); -unsigned long os[3 ] = {1 }; +DECLARE_BITMAP (os,3 ); +bitmap_fill (os,3 );/* * Software mode is enabled when all three oversampling * pins are set to high. If oversampling gpios are defined
@@ -258,7 +259,7 @@ static int ad7606B_sw_mode_config(struct iio_dev *indio_dev)* otherwise, they must be hardwired to VDD */ if (st->gpio_os) { -gpiod_set_array_value (ARRAY_SIZE (os), +gpiod_set_array_value (st->gpio_os->ndescs, st->gpio_os->desc, st->gpio_os->info, os); }/* OS of 128 and 256 are available only in software mode */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 195/518 iio: adc: ad7606: fix standby gpio state to match the documentation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Stols <[email protected]>
[ Upstream commit 059fe4f8bbdf5cad212e1aeeb3e8968c80b9ff3b ]
The binding's documentation specifies that "As the line is active low, it should be marked GPIO_ACTIVE_LOW". However, in the driver, it was handled the opposite way. This commit sets the driver's behaviour in sync with the documentation
--- drivers/iio/adc/ad7606.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/ad7606.c +2 -2
@@ -445,7 +445,7 @@ static int ad7606_request_gpios(struct ad7606_state *st)return PTR_ERR (st->gpio_range); st->gpio_standby =devm_gpiod_get_optional (dev,"standby" , -GPIOD_OUT_HIGH ); +GPIOD_OUT_LOW );if (IS_ERR (st->gpio_standby))return PTR_ERR (st->gpio_standby);
@@ -704,7 +704,7 @@ static int ad7606_suspend(struct device *dev)if (st->gpio_standby) {gpiod_set_value (st->gpio_range,1 ); -gpiod_set_value (st->gpio_standby,0 ); +gpiod_set_value (st->gpio_standby,1 ); }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 196/518 coresight: tmc: sg: Do not leak sg_table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
[ Upstream commit c58dc5a1f886f2fcc1133746d0cbaa1fe7fd44ff ]
Running perf with cs_etm on Juno triggers the following kmemleak warning !
:~# cat /sys/kernel/debug/kmemleak unreferenced object 0xffffff8806b6d720 (size 96): comm "perf", pid 562, jiffies 4297810960 hex dump (first 32 bytes): 38 d8 13 07 88 ff ff ff 00 d0 9e 85 c0 ff ff ff 8............... 00 10 00 88 c0 ff ff ff 00 f0 ff f7 ff 00 00 00 ................ backtrace (crc 1dbf6e00): [<ffffffc08107381c>] kmemleak_alloc+0xbc/0xd8 [<ffffffc0802f9798>] kmalloc_trace_noprof+0x220/0x2e8 [<ffffffc07bb71948>] tmc_alloc_sg_table+0x48/0x208 [coresight_tmc] [<ffffffc07bb71cbc>] tmc_etr_alloc_sg_buf+0xac/0x240 [coresight_tmc] [<ffffffc07bb72538>] tmc_alloc_etr_buf.constprop.0+0x1f0/0x260 [coresight_tmc] [<ffffffc07bb7280c>] alloc_etr_buf.constprop.0.isra.0+0x74/0xa8 [coresight_tmc] [<ffffffc07bb72950>] tmc_alloc_etr_buffer+0x110/0x260 [coresight_tmc] [<ffffffc07bb38afc>] etm_setup_aux+0x204/0x3b0 [coresight] [<ffffffc08025837c>] rb_alloc_aux+0x20c/0x318 [<ffffffc08024dd84>] perf_mmap+0x2e4/0x7a0 [<ffffffc0802cceb0>] mmap_region+0x3b0/0xa08 [<ffffffc0802cd8a8>] do_mmap+0x3a0/0x500 [<ffffffc080295328>] vm_mmap_pgoff+0x100/0x1d0 [<ffffffc0802cadf8>] ksys_mmap_pgoff+0xb8/0x110 [<ffffffc080020688>] __arm64_sys_mmap+0x38/0x58 [<ffffffc080028fc0>] invoke_syscall.constprop.0+0x58/0x100
This due to the fact that we do not free the "sg_table" itself while freeing up the SG table and data pages. Fix this by freeing the sg_table in tmc_free_sg_table().
--- drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-tmc-etr.c +1 -1
@@ -257,6 +257,7 @@ void tmc_free_sg_table(struct tmc_sg_table *sg_table) {tmc_free_table_pages (sg_table);tmc_free_data_pages (sg_table); +kfree (sg_table); }EXPORT_SYMBOL_GPL (tmc_free_sg_table);
@@ -338,7 +339,6 @@ struct tmc_sg_table *tmc_alloc_sg_table(struct device *dev, rc =tmc_alloc_table_pages (sg_table);if (rc) {tmc_free_sg_table (sg_table); -kfree (sg_table);return ERR_PTR (rc); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 197/518 interconnect: qcom: sm8250: Enable sync_state
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit bfc7db1cb94ad664546d70212699f8cc6c539e8c ]
Add the generic icc sync_state callback to ensure interconnect votes are taken into account, instead of being pegged at maximum values.
--- drivers/interconnect/qcom/sm8250.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sm8250.c +1 -0
@@ -643,6 +643,7 @@ static struct platform_driver qnoc_driver = { .driver = { .name = "qnoc-sm8250", .of_match_table = qnoc_of_match, + .sync_state = icc_sync_state, }, };module_platform_driver (qnoc_driver);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 198/518 vdpa: Add eventfd for the vdpa callback
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xie Yongji <[email protected]>
[ Upstream commit 5e68470f4e80a4120e9ecec408f6ab4ad386bd4a ]
Add eventfd for the vdpa callback so that user
can signal it directly instead of triggering the
callback. It will be used for vhost-vdpa case.
Message-Id: <[email protected]>
Stable-dep-of: 02e9e9366fef ("vhost_vdpa: assign irq bypass producer token correctly")
--- drivers/vhost/vdpa.c | 2 ++ drivers/virtio/virtio_vdpa.c | 1 + include/linux/vdpa.h | 6 ++++++ 3 files changed, 9 insertions(+)
drivers/vhost/vdpa.c +2 -0
@@ -422,9 +422,11 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,if (vq->call_ctx.ctx) { cb.callback = vhost_vdpa_virtqueue_cb; cb.private = vq; + cb.trigger = vq->call_ctx.ctx; }else { cb.callback =NULL ; cb.private =NULL ; + cb.trigger =NULL ; } ops->set_vq_cb (vdpa, idx, &cb);vhost_vdpa_setup_vq_irq (v, idx);
drivers/virtio/virtio_vdpa.c +1 -0
@@ -180,6 +180,7 @@ virtio_vdpa_setup_vq(struct virtio_device *vdev, unsigned int index,/* Setup virtqueue callback */ cb.callback = virtio_vdpa_virtqueue_cb; cb.private = info; + cb.trigger =NULL ; ops->set_vq_cb (vdpa, index, &cb); ops->set_vq_num (vdpa, index,virtqueue_get_vring_size (vq));
include/linux/vdpa.h +6 -0
@@ -11,10 +11,16 @@* vDPA callback definition. * @callback: interrupt callback function * @private: the data passed to the callback function +* @trigger: the eventfd for the callback (Optional). +* When it is set, the vDPA driver must guarantee that +* signaling it is functional equivalent to triggering +* the callback. Then vDPA parent can signal it directly +* instead of triggering the callback. */ struct vdpa_callback {irqreturn_t (*callback)(void *data);void *private; +struct eventfd_ctx *trigger; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 199/518 vhost_vdpa: assign irq bypass producer token correctly
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
[ Upstream commit 02e9e9366fefe461719da5d173385b6685f70319 ]
We used to call irq_bypass_unregister_producer() in vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the token pointer is still valid or not.
Actually, we use the eventfd_ctx as the token so the life cycle of the token should be bound to the VHOST_SET_VRING_CALL instead of vhost_vdpa_setup_vq_irq() which could be called by set_status().
Fixing this by setting up irq bypass producer's token when handling VHOST_SET_VRING_CALL and un-registering the producer before calling vhost_vring_ioctl() to prevent a possible use after free as eventfd could have been released in vhost_vring_ioctl(). And such registering and unregistering will only be done if DRIVER_OK is set.
Message-Id: <[email protected]>
--- drivers/vhost/vdpa.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/vhost/vdpa.c +13 -3
@@ -100,11 +100,9 @@ static void vhost_vdpa_setup_vq_irq(struct vhost_vdpa *v, u16 qid)if (irq <0 )return ; -irq_bypass_unregister_producer (&vq->call_ctx.producer);if (!vq->call_ctx.ctx)return ; - vq->call_ctx.producer.token = vq->call_ctx.ctx; vq->call_ctx.producer.irq = irq; ret =irq_bypass_register_producer (&vq->call_ctx.producer);if (unlikely (ret))
@@ -397,6 +395,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, vq->last_avail_idx = vq_state.avail_index;break ; +case VHOST_SET_VRING_CALL : +if (vq->call_ctx.ctx) { +if (ops->get_status (vdpa) & +VIRTIO_CONFIG_S_DRIVER_OK ) +vhost_vdpa_unsetup_vq_irq (v, idx); + vq->call_ctx.producer.token =NULL ; + } +break ; } r =vhost_vring_ioctl (&v->vdev, cmd, argp);
@@ -423,13 +429,16 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, cb.callback = vhost_vdpa_virtqueue_cb; cb.private = vq; cb.trigger = vq->call_ctx.ctx; + vq->call_ctx.producer.token = vq->call_ctx.ctx; +if (ops->get_status (vdpa) & +VIRTIO_CONFIG_S_DRIVER_OK ) +vhost_vdpa_setup_vq_irq (v, idx); }else { cb.callback =NULL ; cb.private =NULL ; cb.trigger =NULL ; } ops->set_vq_cb (vdpa, idx, &cb); -vhost_vdpa_setup_vq_irq (v, idx);break ;case VHOST_SET_VRING_NUM :
@@ -890,6 +899,7 @@ static int vhost_vdpa_open(struct inode *inode, struct file *filep)for (i =0 ; i < nvqs; i++) { vqs[i] = &v->vqs[i]; vqs[i]->handle_kick = handle_vq_kick; + vqs[i]->call_ctx.ctx =NULL ; }vhost_dev_init (dev, vqs, nvqs,0 ,0 ,0 , false, vhost_vdpa_process_iotlb_msg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 200/518 Revert "dm: requeue IO if mapping table not yet available"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit c8691cd0fc11197515ed148de0780d927bfca38b ]
This reverts commit fa247089de9936a46e290d4724cb5f0b845600f5.
The following sequence of commands causes a livelock - there will be workqueue process looping and consuming 100% CPU:
dmsetup create --notable test
truncate -s 1MiB testdata
losetup /dev/loop0 testdata
dmsetup load test --table '0 2048 linear /dev/loop0 0' dd if=/dev/zero of=/dev/dm-0 bs=16k count=1 conv=fdatasync
The livelock is caused by the commit fa247089de99. The commit claims that it fixes a race condition, however, it is unknown what the actual race condition is and what program is involved in the race condition.
When the inactive table is loaded, the nodes /dev/dm-0 and /sys/block/dm-0 are created. /dev/dm-0 has zero size at this point. When the device is suspended and resumed, the nodes /dev/mapper/test and /dev/disk/* are created.
If some program opens a block device before it is created by dmsetup or lvm, the program is buggy, so dm could just report an error as it used to do before.
--- drivers/md/dm-rq.c | 4 +++- drivers/md/dm.c | 11 ++++++++--- 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/md/dm-rq.c +3 -1
@@ -496,8 +496,10 @@ static blk_status_t dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx, map =dm_get_live_table (md, &srcu_idx);if (unlikely (!map)) { +DMERR_LIMIT ("%s: mapping table unavailable, erroring io" , +dm_device_name (md));dm_put_live_table (md, srcu_idx); -return BLK_STS_RESOURCE ; +return BLK_STS_IOERR ; } ti =dm_table_find_target (map,0 );dm_put_live_table (md, srcu_idx);
drivers/md/dm.c +8 -3
@@ -1696,10 +1696,15 @@ static blk_qc_t dm_submit_bio(struct bio *bio)struct dm_table *map; map =dm_get_live_table (md, &srcu_idx); +if (unlikely (!map)) { +DMERR_LIMIT ("%s: mapping table unavailable, erroring io" , +dm_device_name (md)); +bio_io_error (bio); + goto out; + } -/* If suspended, or map not yet available, queue this IO for later */ -if (unlikely (test_bit (DMF_BLOCK_IO_FOR_SUSPEND , &md->flags)) || -unlikely (!map)) { +/* If suspended, queue this IO for later */ +if (unlikely (test_bit (DMF_BLOCK_IO_FOR_SUSPEND , &md->flags))) {if (bio->bi_opf &REQ_NOWAIT )bio_wouldblock_error (bio);else if (bio->bi_opf &REQ_RAHEAD )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 201/518 netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9c778fe48d20ef362047e3376dee56d77f8500d4 ]
syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1)
Use skb_put_zero() to clear the whole TCP header,
as done in nf_reject_ip_tcphdr_put()
BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 do_softirq+0x9a/0x100 kernel/softirq.c:455 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline] __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450 dev_queue_xmit include/linux/netdevice.h:3105 [inline] neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline] ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366 inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466 tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline] tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143 tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333 __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679 inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750 __sys_connect_file net/socket.c:2061 [inline] __sys_connect+0x606/0x690 net/socket.c:2078 __do_sys_connect net/socket.c:2088 [inline] __se_sys_connect net/socket.c:2085 [inline] __x64_sys_connect+0x91/0xe0 net/socket.c:2085 x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588
Uninit was stored to memory at:
nf_reject_ip6_tcphdr_put+0x2ca/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:231 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3998 [inline] slab_alloc_node mm/slub.c:4041 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4084 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] nf_send_reset6+0x98d/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:327 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588
--- net/ipv6/netfilter/nf_reject_ipv6.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
net/ipv6/netfilter/nf_reject_ipv6.c +2 -12
@@ -89,33 +89,23 @@ void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb, const struct tcphdr *oth, unsigned int otcplen) { struct tcphdr *tcph; -int needs_ack;skb_reset_transport_header (nskb); - tcph =skb_put (nskb,sizeof (struct tcphdr )); + tcph =skb_put_zero (nskb,sizeof (struct tcphdr ));/* Truncate to length (no data) */ tcph->doff =sizeof (struct tcphdr )/4 ; tcph->source = oth->dest; tcph->dest = oth->source;if (oth->ack) { - needs_ack =0 ; tcph->seq = oth->ack_seq; - tcph->ack_seq =0 ; }else { - needs_ack =1 ; tcph->ack_seq =htonl (ntohl (oth->seq) + oth->syn + oth->fin + otcplen - (oth->doff<<2 )); - tcph->seq =0 ; + tcph->ack =1 ; } -/* Reset flags */ - ((u_int8_t *)tcph)[13 ] =0 ; tcph->rst =1 ; - tcph->ack = needs_ack; - tcph->window =0 ; - tcph->urg_ptr =0 ; - tcph->check =0 ;/* Adjust TCP checksum */ tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 202/518 net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit b5109b60ee4fcb2f2bb24f589575e10cc5283ad4 ]
In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| ether3_ledoff
ether3_remove |
free_netdev(dev); |
put_devic |
kfree(dev); |
| ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
| // use devFix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove.
--- drivers/net/ethernet/seeq/ether3.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/seeq/ether3.c +2 -0
@@ -845,9 +845,11 @@ static void ether3_remove(struct expansion_card *ec) {struct net_device *dev =ecard_get_drvdata (ec); +ether3_outw (priv (dev)->regs.config2 |=CFG2_CTRLO ,REG_CONFIG2 );ecard_set_drvdata (ec,NULL );unregister_netdev (dev); +del_timer_sync (&priv (dev)->timer);free_netdev (dev);ecard_release_resources (ec); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 203/518 net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 93c21077bb9ba08807c459982d440dbbee4c7af3 ]
The rpl sr tunnel code contains calls to dst_cache_*() which are only present when the dst cache is built.
Select DST_CACHE to build the dst cache, similar to other kconfig options in the same file.
Compiling the rpl sr tunnel without DST_CACHE will lead to linker errors.
--- net/ipv6/Kconfig | 1 + 1 file changed, 1 insertion(+)
net/ipv6/Kconfig +1 -0
@@ -322,6 +322,7 @@ config IPV6_RPL_LWTUNNEL bool "IPv6: RPL Source Routing Header support" depends on IPV6 select LWTUNNEL + select DST_CACHE help Support for RFC6554 RPL Source Routing Header using the lightweight tunnels mechanism.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 204/518 tcp: check skb is non-NULL in tcp_rto_delta_us()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Hunt <[email protected]>
[ Upstream commit c8770db2d54437a5f49417ae7b46f7de23d14db6 ]
We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also saw it getting hit from the RACK case as well. Here are examples of the oops messages we saw in each of those cases:
Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020 Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0 Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000 Jul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60 Jul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8 Jul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900 Jul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30 Jul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000 Jul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0 Jul 26 15:05:02 rx [11061395.913822] PKRU: 55555554 Jul 26 15:05:02 rx [11061395.916786] Call Trace: Jul 26 15:05:02 rx [11061395.919488] Jul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f Jul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9 Jul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380 Jul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0 Jul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50 Jul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0 Jul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20 Jul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450 Jul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140 Jul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90 Jul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0 Jul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40 Jul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220 Jul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240 Jul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0 Jul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240 Jul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130 Jul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280 Jul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10 Jul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30 Jul 26 15:05:02 rx [11061396.017718] ? lapic_next_event+0x21/0x30 Jul 26 15:05:02 rx [11061396.021984] ? clockevents_program_event+0x8f/0xe0 Jul 26 15:05:02 rx [11061396.027035] run_timer_softirq+0x2a/0x50 Jul 26 15:05:02 rx [11061396.031212] __do_softirq+0xd1/0x2c1 Jul 26 15:05:02 rx [11061396.035044] do_softirq_own_stack+0x2a/0x40 Jul 26 15:05:02 rx [11061396.039480] Jul 26 15:05:02 rx [11061396.041840] do_softirq.part.0+0x46/0x50 Jul 26 15:05:02 rx [11061396.046022] __local_bh_enable_ip+0x50/0x60 Jul 26 15:05:02 rx [11061396.050460] _raw_spin_unlock_bh+0x1e/0x20 Jul 26 15:05:02 rx [11061396.054817] nf_conntrack_tcp_packet+0x29e/0xbe0 [nf_conntrack] Jul 26 15:05:02 rx [11061396.060994] ? get_l4proto+0xe7/0x190 [nf_conntrack] Jul 26 15:05:02 rx [11061396.066220] nf_conntrack_in+0xe9/0x670 [nf_conntrack] Jul 26 15:05:02 rx [11061396.071618] ipv6_conntrack_local+0x14/0x20 [nf_conntrack] Jul 26 15:05:02 rx [11061396.077356] nf_hook_slow+0x45/0xb0 Jul 26 15:05:02 rx [11061396.081098] ip6_xmit+0x3f0/0x5d0 Jul 26 15:05:02 rx [11061396.084670] ? ipv6_anycast_cleanup+0x50/0x50 Jul 26 15:05:02 rx [11061396.089282] ? __sk_dst_check+0x38/0x70 Jul 26 15:05:02 rx [11061396.093381] ? inet6_csk_route_socket+0x13b/0x200 Jul 26 15:05:02 rx [11061396.098346] inet6_csk_xmit+0xa7/0xf0 Jul 26 15:05:02 rx [11061396.102263] __tcp_transmit_skb+0x550/0xb30 Jul 26 15:05:02 rx [11061396.106701] tcp_write_xmit+0x3c6/0xc20 Jul 26 15:05:02 rx [11061396.110792] ? __alloc_skb+0x98/0x1d0 Jul 26 15:05:02 rx [11061396.114708] __tcp_push_pending_frames+0x37/0x100 Jul 26 15:05:02 rx [11061396.119667] tcp_push+0xfd/0x100 Jul 26 15:05:02 rx [11061396.123150] tcp_sendmsg_locked+0xc70/0xdd0 Jul 26 15:05:02 rx [11061396.127588] tcp_sendmsg+0x2d/0x50 Jul 26 15:05:02 rx [11061396.131245] inet6_sendmsg+0x43/0x70 Jul 26 15:05:02 rx [11061396.135075] __sock_sendmsg+0x48/0x70 Jul 26 15:05:02 rx [11061396.138994] ____sys_sendmsg+0x212/0x280 Jul 26 15:05:02 rx [11061396.143172] ___sys_sendmsg+0x88/0xd0 Jul 26 15:05:02 rx [11061396.147098] ? __seccomp_filter+0x7e/0x6b0 Jul 26 15:05:02 rx [11061396.151446] ? __switch_to+0x39c/0x460 Jul 26 15:05:02 rx [11061396.155453] ? __switch_to_asm+0x42/0x80 Jul 26 15:05:02 rx [11061396.159636] ? __switch_to_asm+0x5a/0x80 Jul 26 15:05:02 rx [11061396.163816] __sys_sendmsg+0x5c/0xa0 Jul 26 15:05:02 rx [11061396.167647] __x64_sys_sendmsg+0x1f/0x30 Jul 26 15:05:02 rx [11061396.171832] do_syscall_64+0x57/0x190 Jul 26 15:05:02 rx [11061396.175748] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Jul 26 15:05:02 rx [11061396.181055] RIP: 0033:0x7f1ef692618d Jul 26 15:05:02 rx [11061396.184893] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48 Jul 26 15:05:02 rx [11061396.203889] RSP: 002b:00007f1ef4a26aa0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e Jul 26 15:05:02 rx [11061396.211708] RAX: ffffffffffffffda RBX: 000000000000084b RCX: 00007f1ef692618d Jul 26 15:05:02 rx [11061396.219091] RDX: 0000000000004000 RSI: 00007f1ef4a26b10 RDI: 0000000000000275 Jul 26 15:05:02 rx [11061396.226475] RBP: 0000000000004000 R08: 0000000000000000 R09: 0000000000000020 Jul 26 15:05:02 rx [11061396.233859] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000084b Jul 26 15:05:02 rx [11061396.241243] R13: 00007f1ef4a26b10 R14: 0000000000000275 R15: 000055592030f1e8 Jul 26 15:05:02 rx [11061396.248628] Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif input_leds joydev rndis_host cdc_ether usbnet mii ast drm_vram_helper ttm drm_kms_helper i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt ccp mac_hid ipmi_si ipmi_devintf ipmi_msghandler nft_ct sch_fq_codel nf_tables_set nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink ramoops reed_solomon efi_pstore drm ip_tables x_tables autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid0 multipath linear mlx5_ib ib_uverbs ib_core raid1 mlx5_core hid_generic pci_hyperv_intf crc32_pclmul tls usbhid ahci mlxfw bnxt_en libahci hid nvme i2c_piix4 nvme_core wmi Jul 26 15:05:02 rx [11061396.324334] CR2: 0000000000000020 Jul 26 15:05:02 rx [11061396.327944] ---[ end trace 68a2b679d1cfb4f1 ]--- Jul 26 15:05:02 rx [11061396.433435] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061396.438137] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061396.457144] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26 15:05:02 rx [11061396.462629] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000 Jul 26 15:05:02 rx [11061396.470012] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60 Jul 26 15:05:02 rx [11061396.477396] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8 Jul 26 15:05:02 rx [11061396.484779] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900 Jul 26 15:05:02 rx [11061396.492164] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30 Jul 26 15:05:02 rx [11061396.499547] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000 Jul 26 15:05:02 rx [11061396.507886] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 15:05:02 rx [11061396.513884] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0 Jul 26 15:05:02 rx [11061396.521267] PKRU: 55555554 Jul 26 15:05:02 rx [11061396.524230] Kernel panic - not syncing: Fatal exception in interrupt Jul 26 15:05:02 rx [11061396.530885] Kernel Offset: 0x1b200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Jul 26 15:05:03 rx [11061396.660181] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
After we hit this we disabled TLP by setting tcp_early_retrans to 0 and then hit the crash in the RACK case:
Aug 7 07:26:16 rx [1006006.265582] BUG: kernel NULL pointer dereference, address: 0000000000000020
Aug 7 07:26:16 rx [1006006.272719] #PF: supervisor read access in kernel mode
Aug 7 07:26:16 rx [1006006.278030] #PF: error_code(0x0000) - not-present page
Aug 7 07:26:16 rx [1006006.283343] PGD 0 P4D 0
Aug 7 07:26:16 rx [1006006.286057] Oops: 0000 [#1] SMP NOPTI
Aug 7 07:26:16 rx [1006006.289896] CPU: 5 PID: 0 Comm: swapper/5 Tainted: G W 5.4.0-174-generic #193-Ubuntu
Aug 7 07:26:16 rx [1006006.299107] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023
Aug 7 07:26:16 rx [1006006.309970] RIP: 0010:tcp_rearm_rto+0xe4/0x160
Aug 7 07:26:16 rx [1006006.314584] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3
Aug 7 07:26:16 rx [1006006.333499] RSP: 0018:ffffb42600a50960 EFLAGS: 00010246
Aug 7 07:26:16 rx [1006006.338895] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000
Aug 7 07:26:16 rx [1006006.346193] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff92d687ed8160
Aug 7 07:26:16 rx [1006006.353489] RBP: ffffb42600a50978 R08: 0000000000000000 R09: 00000000cd896dcc
Aug 7 07:26:16 rx [1006006.360786] R10: ffff92dc3404f400 R11: 0000000000000001 R12: ffff92d687ed8000
Aug 7 07:26:16 rx [1006006.368084] R13: ffff92d687ed8160 R14: 00000000cd896dcc R15: 00000000cd8fca81
Aug 7 07:26:16 rx [1006006.375381] FS: 0000000000000000(0000) GS:ffff93158ad40000(0000) knlGS:0000000000000000
Aug 7 07:26:16 rx [1006006.383632] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Aug 7 07:26:16 rx [1006006.389544] CR2: 0000000000000020 CR3: 0000003e775ce006 CR4: 0000000000760ee0
Aug 7 07:26:16 rx [1006006.396839] PKRU: 55555554
Aug 7 07:26:16 rx [1006006.399717] Call Trace:
Aug 7 07:26:16 rx [1006006.402335]
Aug 7 07:26:16 rx [1006006.404525] ? show_regs.cold+0x1a/0x1f
Aug 7 07:26:16 rx [1006006.408532] ? __die+0x90/0xd9
Aug 7 07:26:16 rx [1006006.411760] ? no_context+0x196/0x380
Aug 7 07:26:16 rx [1006006.415599] ? __bad_area_nosemaphore+0x50/0x1a0
Aug 7 07:26:16 rx [1006006.420392] ? _raw_spin_lock+0x1e/0x30
Aug 7 07:26:16 rx [1006006.424401] ? bad_area_nosemaphore+0x16/0x20
Aug 7 07:26:16 rx [1006006.428927] ? do_user_addr_fault+0x267/0x450
Aug 7 07:26:16 rx [1006006.433450] ? __do_page_fault+0x58/0x90
Aug 7 07:26:16 rx [1006006.437542] ? do_page_fault+0x2c/0xe0
Aug 7 07:26:16 rx [1006006.441470] ? page_fault+0x34/0x40
Aug 7 07:26:16 rx [1006006.445134] ? tcp_rearm_rto+0xe4/0x160
Aug 7 07:26:16 rx [1006006.449145] tcp_ack+0xa32/0xb30
Aug 7 07:26:16 rx [1006006.452542] tcp_rcv_established+0x13c/0x670
Aug 7 07:26:16 rx [1006006.456981] ? sk_filter_trim_cap+0x48/0x220
Aug 7 07:26:16 rx [1006006.461419] tcp_v6_do_rcv+0xdb/0x450
Aug 7 07:26:16 rx [1006006.465257] tcp_v6_rcv+0xc2b/0xd10
Aug 7 07:26:16 rx [1006006.468918] ip6_protocol_deliver_rcu+0xd3/0x4e0
Aug 7 07:26:16 rx [1006006.473706] ip6_input_finish+0x15/0x20
Aug 7 07:26:16 rx [1006006.477710] ip6_input+0xa2/0xb0
Aug 7 07:26:16 rx [1006006.481109] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0
Aug 7 07:26:16 rx [1006006.486151] ip6_sublist_rcv_finish+0x3d/0x50
Aug 7 07:26:16 rx [1006006.490679] ip6_sublist_rcv+0x1aa/0x250
Aug 7 07:26:16 rx [1006006.494779] ? ip6_rcv_finish_core.isra.0+0xa0/0xa0
Aug 7 07:26:16 rx [1006006.499828] ipv6_list_rcv+0x112/0x140
Aug 7 07:26:16 rx [1006006.503748] __netif_receive_skb_list_core+0x1a4/0x250
Aug 7 07:26:16 rx [1006006.509057] netif_receive_skb_list_internal+0x1a1/0x2b0
Aug 7 07:26:16 rx [1006006.514538] gro_normal_list.part.0+0x1e/0x40
Aug 7 07:26:16 rx [1006006.519068] napi_complete_done+0x91/0x130
Aug 7 07:26:16 rx [1006006.523352] mlx5e_napi_poll+0x18e/0x610 [mlx5_core]
Aug 7 07:26:16 rx [1006006.528481] net_rx_action+0x142/0x390
Aug 7 07:26:16 rx [1006006.532398] __do_softirq+0xd1/0x2c1
Aug 7 07:26:16 rx [1006006.536142] irq_exit+0xae/0xb0
Aug 7 07:26:16 rx [1006006.539452] do_IRQ+0x5a/0xf0
Aug 7 07:26:16 rx [1006006.542590] common_interrupt+0xf/0xf
Aug 7 07:26:16 rx [1006006.546421]
Aug 7 07:26:16 rx [1006006.548695] RIP: 0010:native_safe_halt+0xe/0x10
Aug 7 07:26:16 rx [1006006.553399] Code: 7b ff ff ff eb bd 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 36 2c 50 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 26 2c 50 00 fb f4 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 e8 dd 5e 61 ff 65
Aug 7 07:26:16 rx [1006006.572309] RSP: 0018:ffffb42600177e70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffc2
Aug 7 07:26:16 rx [1006006.580040] RAX: ffffffff8ed08b20 RBX: 0000000000000005 RCX: 0000000000000001
Aug 7 07:26:16 rx [1006006.587337] RDX: 00000000f48eeca2 RSI: 0000000000000082 RDI: 0000000000000082
Aug 7 07:26:16 rx [1006006.594635] RBP: ffffb42600177e90 R08: 0000000000000000 R09: 000000000000020f
Aug 7 07:26:16 rx [1006006.601931] R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000005
Aug 7 07:26:16 rx [1006006.609229] R13: ffff93157deb5f00 R14: 0000000000000000 R15: 0000000000000000
Aug 7 07:26:16 rx [1006006.616530] ? __cpuidle_text_start+0x8/0x8
Aug 7 07:26:16 rx [1006006.620886] ? default_idle+0x20/0x140
Aug 7 07:26:16 rx [1006006.624804] arch_cpu_idle+0x15/0x20
Aug 7 07:26:16 rx [1006006.628545] default_idle_call+0x23/0x30
Aug 7 07:26:16 rx [1006006.632640] do_idle+0x1fb/0x270
Aug 7 07:26:16 rx [1006006.636035] cpu_startup_entry+0x20/0x30
Aug 7 07:26:16 rx [1006006.640126] start_secondary+0x178/0x1d0
Aug 7 07:26:16 rx [1006006.644218] secondary_startup_64+0xa4/0xb0
Aug 7 07:26:17 rx [1006006.648568] Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 nft_ct amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif input_leds joydev rndis_host cdc_ether usbnet ast mii drm_vram_helper ttm drm_kms_helper i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt ccp mac_hid ipmi_si ipmi_devintf ipmi_msghandler sch_fq_codel nf_tables_set nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink ramoops reed_solomon efi_pstore drm ip_tables x_tables autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid0 multipath linear mlx5_ib ib_uverbs ib_core raid1 hid_generic mlx5_core pci_hyperv_intf crc32_pclmul usbhid ahci tls mlxfw bnxt_en hid libahci nvme i2c_piix4 nvme_core wmi [last unloaded: cpuid] Aug 7 07:26:17 rx [1006006.726180] CR2: 0000000000000020
Aug 7 07:26:17 rx [1006006.729718] ---[ end trace e0e2e37e4e612984 ]---
Prior to seeing the first crash and on other machines we also see the warning in tcp_send_loss_probe() where packets_out is non-zero, but both transmit and retrans queues are empty so we know the box is seeing some accounting issue in this area:
Jul 26 09:15:27 kernel: ------------[ cut here ]------------ Jul 26 09:15:27 kernel: invalid inflight: 2 state 1 cwnd 68 mss 8988 Jul 26 09:15:27 kernel: WARNING: CPU: 16 PID: 0 at net/ipv4/tcp_output.c:2605 tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 nft_ct amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif joydev input_leds rndis_host cdc_ether usbnet mii ast drm_vram_helper ttm drm_kms_he> Jul 26 09:15:27 kernel: CPU: 16 PID: 0 Comm: swapper/16 Not tainted 5.4.0-174-generic #193-Ubuntu Jul 26 09:15:27 kernel: Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 09:15:27 kernel: RIP: 0010:tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: Code: 08 26 01 00 75 e2 41 0f b6 54 24 12 41 8b 8c 24 c0 06 00 00 45 89 f0 48 c7 c7 e0 b4 20 a7 c6 05 8d 08 26 01 01 e8 4a c0 0f 00 <0f> 0b eb ba 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 Jul 26 09:15:27 kernel: RSP: 0018:ffffb7838088ce00 EFLAGS: 00010286 Jul 26 09:15:27 kernel: RAX: 0000000000000000 RBX: ffff9b84b5630430 RCX: 0000000000000006 Jul 26 09:15:27 kernel: RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff9b8e4621c8c0 Jul 26 09:15:27 kernel: RBP: ffffb7838088ce18 R08: 0000000000000927 R09: 0000000000000004 Jul 26 09:15:27 kernel: R10: 0000000000000000 R11: 0000000000000001 R12: ffff9b84b5630000 Jul 26 09:15:27 kernel: R13: 0000000000000000 R14: 000000000000231c R15: ffff9b84b5630430 Jul 26 09:15:27 kernel: FS: 0000000000000000(0000) GS:ffff9b8e46200000(0000) knlGS:0000000000000000 Jul 26 09:15:27 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 09:15:27 kernel: CR2: 000056238cec2380 CR3: 0000003e49ede005 CR4: 0000000000760ee0 Jul 26 09:15:27 kernel: PKRU: 55555554 Jul 26 09:15:27 kernel: Call Trace: Jul 26 09:15:27 kernel: <IRQ> Jul 26 09:15:27 kernel: ? show_regs.cold+0x1a/0x1f Jul 26 09:15:27 kernel: ? __warn+0x98/0xe0 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: ? report_bug+0xd1/0x100 Jul 26 09:15:27 kernel: ? do_error_trap+0x9b/0xc0 Jul 26 09:15:27 kernel: ? do_invalid_op+0x3c/0x50 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: ? invalid_op+0x1e/0x30 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: tcp_write_timer_handler+0x1b4/0x240 Jul 26 09:15:27 kernel: tcp_write_timer+0x9e/0xe0 Jul 26 09:15:27 kernel: ? tcp_write_timer_handler+0x240/0x240 Jul 26 09:15:27 kernel: call_timer_fn+0x32/0x130 Jul 26 09:15:27 kernel: __run_timers.part.0+0x180/0x280 Jul 26 09:15:27 kernel: ? timerqueue_add+0x9b/0xb0 Jul 26 09:15:27 kernel: ? enqueue_hrtimer+0x3d/0x90 Jul 26 09:15:27 kernel: ? do_error_trap+0x9b/0xc0 Jul 26 09:15:27 kernel: ? do_invalid_op+0x3c/0x50 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: ? invalid_op+0x1e/0x30 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: tcp_write_timer_handler+0x1b4/0x240 Jul 26 09:15:27 kernel: tcp_write_timer+0x9e/0xe0 Jul 26 09:15:27 kernel: ? tcp_write_timer_handler+0x240/0x240 Jul 26 09:15:27 kernel: call_timer_fn+0x32/0x130 Jul 26 09:15:27 kernel: __run_timers.part.0+0x180/0x280 Jul 26 09:15:27 kernel: ? timerqueue_add+0x9b/0xb0 Jul 26 09:15:27 kernel: ? enqueue_hrtimer+0x3d/0x90 Jul 26 09:15:27 kernel: ? recalibrate_cpu_khz+0x10/0x10 Jul 26 09:15:27 kernel: ? ktime_get+0x3e/0xa0 Jul 26 09:15:27 kernel: ? native_x2apic_icr_write+0x30/0x30 Jul 26 09:15:27 kernel: run_timer_softirq+0x2a/0x50 Jul 26 09:15:27 kernel: __do_softirq+0xd1/0x2c1 Jul 26 09:15:27 kernel: irq_exit+0xae/0xb0 Jul 26 09:15:27 kernel: smp_apic_timer_interrupt+0x7b/0x140 Jul 26 09:15:27 kernel: apic_timer_interrupt+0xf/0x20 Jul 26 09:15:27 kernel: </IRQ> Jul 26 09:15:27 kernel: RIP: 0010:native_safe_halt+0xe/0x10 Jul 26 09:15:27 kernel: Code: 7b ff ff ff eb bd 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 36 2c 50 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 26 2c 50 00 fb f4 <c3> 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 e8 dd 5e 61 ff 65 Jul 26 09:15:27 kernel: RSP: 0018:ffffb783801cfe70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 Jul 26 09:15:27 kernel: RAX: ffffffffa6908b20 RBX: 0000000000000010 RCX: 0000000000000001 Jul 26 09:15:27 kernel: RDX: 000000006fc0c97e RSI: 0000000000000082 RDI: 0000000000000082 Jul 26 09:15:27 kernel: RBP: ffffb783801cfe90 R08: 0000000000000000 R09: 0000000000000225 Jul 26 09:15:27 kernel: R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000010 Jul 26 09:15:27 kernel: R13: ffff9b8e390b0000 R14: 0000000000000000 R15: 0000000000000000 Jul 26 09:15:27 kernel: ? __cpuidle_text_start+0x8/0x8 Jul 26 09:15:27 kernel: ? default_idle+0x20/0x140 Jul 26 09:15:27 kernel: arch_cpu_idle+0x15/0x20 Jul 26 09:15:27 kernel: default_idle_call+0x23/0x30 Jul 26 09:15:27 kernel: do_idle+0x1fb/0x270 Jul 26 09:15:27 kernel: cpu_startup_entry+0x20/0x30 Jul 26 09:15:27 kernel: start_secondary+0x178/0x1d0 Jul 26 09:15:27 kernel: secondary_startup_64+0xa4/0xb0 Jul 26 09:15:27 kernel: ---[ end trace e7ac822987e33be1 ]---
The NULL ptr deref is coming from tcp_rto_delta_us() attempting to pull an skb off the head of the retransmit queue and then dereferencing that skb to get the skb_mstamp_ns value via tcp_skb_timestamp_us(skb).
The crash is the same one that was reported a # of years ago here:
https://lore.kernel.org/netdev/[email protected]/T/#t
and the kernel we're running has the fix which was added to resolve this issue.
Unfortunately we've been unsuccessful so far in reproducing this problem in the lab and do not have the luxury of pushing out a new kernel to try and test if newer kernels resolve this issue at the moment. I realize this is a report against both an Ubuntu kernel and also an older 5.4 kernel. I have reported this issue to Ubuntu here: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2077657
however I feel like since this issue has possibly cropped up again it makes sense to build in some protection in this path (even on the latest kernel versions) since the code in question just blindly assumes there's a valid skb without testing if it's NULL b/f it looks at the timestamp.
Given we have seen crashes in this path before and now this case it seems like we should protect ourselves for when packets_out accounting is incorrect. While we should fix that root cause we should also just make sure the skb is not NULL before dereferencing it. Also add a warn once here to capture some information if/when the problem case is hit again.
--- include/net/tcp.h | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
include/net/tcp.h +19 -2
@@ -2113,9 +2113,26 @@ static inline s64 tcp_rto_delta_us(const struct sock *sk) {const struct sk_buff *skb =tcp_rtx_queue_head (sk);u32 rto =inet_csk (sk)->icsk_rto; -u64 rto_time_stamp_us =tcp_skb_timestamp_us (skb) +jiffies_to_usecs (rto); -return rto_time_stamp_us -tcp_sk (sk)->tcp_mstamp; +if (likely (skb)) { +u64 rto_time_stamp_us =tcp_skb_timestamp_us (skb) +jiffies_to_usecs (rto); + +return rto_time_stamp_us -tcp_sk (sk)->tcp_mstamp; + }else { +WARN_ONCE (1 , +"rtx queue emtpy: " +"out:%u sacked:%u lost:%u retrans:%u " +"tlp_high_seq:%u sk_state:%u ca_state:%u " +"advmss:%u mss_cache:%u pmtu:%u\n" , +tcp_sk (sk)->packets_out,tcp_sk (sk)->sacked_out, +tcp_sk (sk)->lost_out,tcp_sk (sk)->retrans_out, +tcp_sk (sk)->tlp_high_seq, sk->sk_state, +inet_csk (sk)->icsk_ca_state, +tcp_sk (sk)->advmss,tcp_sk (sk)->mss_cache, +inet_csk (sk)->icsk_pmtu_cookie); +return jiffies_to_usecs (rto); + } + }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 205/518 net: qrtr: Update packets cloning when broadcasting
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youssef Samir <[email protected]>
[ Upstream commit f011b313e8ebd5b7abd8521b5119aecef403de45 ]
When broadcasting data to multiple nodes via MHI, using skb_clone() causes all nodes to receive the same header data. This can result in packets being discarded by endpoints, leading to lost data.
This issue occurs when a socket is closed, and a QRTR_TYPE_DEL_CLIENT packet is broadcasted. All nodes receive the same destination node ID, causing the node connected to the client to discard the packet and remain unaware of the client's deletion.
Replace skb_clone() with pskb_copy(), to create a separate copy of the header for each sk_buff.
--- net/qrtr/af_qrtr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/qrtr/af_qrtr.c +1 -1
@@ -863,7 +863,7 @@ static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb,mutex_lock (&qrtr_node_lock);list_for_each_entry (node, &qrtr_all_nodes, item) { - skbn =skb_clone (skb,GFP_KERNEL ); + skbn =pskb_copy (skb,GFP_KERNEL );if (!skbn)break ;skb_set_owner_w (skbn, skb->sk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 206/518 netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 642c89c475419b4d0c0d90e29d9c1a0e4351f379 ]
Documentation of list_del_rcu() warns callers to not immediately free the deleted list item. While it seems not necessary to use the RCU-variant of list_del() here in the first place, doing so seems to require calling kfree_rcu() on the deleted item as well.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -7625,7 +7625,7 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) flowtable->data.type->setup (&flowtable->data, hook->ops.dev,FLOW_BLOCK_UNBIND );list_del_rcu (&hook->list); -kfree (hook); +kfree_rcu (hook, rcu); }kfree (flowtable->name);module_put (flowtable->data.type->owner);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 207/518 netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit e1f1ee0e9ad8cbe660f5c104e791c5f1a7cf4c31 ]
Only provide ctnetlink_label_size when it is used, which is when CONFIG_NF_CONNTRACK_EVENTS is configured.
Flagged by clang-18 W=1 builds as:
.../nf_conntrack_netlink.c:385:19: warning: unused function 'ctnetlink_label_size' [-Wunused-function]
385 | static inline int ctnetlink_label_size(const struct nf_conn *ct)
| ^~~~~~~~~~~~~~~~~~~~
The condition on CONFIG_NF_CONNTRACK_LABELS being removed by this patch guards compilation of non-trivial implementations of ctnetlink_dump_labels() and ctnetlink_label_size().
However, this is not necessary as each of these functions will always return 0 if CONFIG_NF_CONNTRACK_LABELS is not defined as each function starts with the equivalent of:
struct nf_conn_labels *labels = nf_ct_labels_find(ct); if (!labels) return 0;
And nf_ct_labels_find always returns NULL if CONFIG_NF_CONNTRACK_LABELS is not enabled. So I believe that the compiler optimises the code away in such cases anyway.
Found by inspection.
Compile tested only.
Originally splitted in two patches, Pablo Neira Ayuso collapsed them and added Fixes: tag.
--- net/netfilter/nf_conntrack_netlink.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
net/netfilter/nf_conntrack_netlink.c +2 -5
@@ -365,7 +365,7 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)#define ctnetlink_dump_secctx (a, b) (0)#endif -#ifdef CONFIG_NF_CONNTRACK_LABELS +#ifdef CONFIG_NF_CONNTRACK_EVENTS static inline int ctnetlink_label_size (const struct nf_conn *ct) {struct nf_conn_labels *labels =nf_ct_labels_find (ct);
@@ -374,6 +374,7 @@ static inline int ctnetlink_label_size(const struct nf_conn *ct)return 0 ; return nla_total_size(sizeof(labels->bits)); } +#endif static int ctnetlink_dump_labels (struct sk_buff *skb,const struct nf_conn *ct)
@@ -394,10 +395,6 @@ ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)return 0 ; } -#else -#define ctnetlink_dump_labels (a, b) (0) -#define ctnetlink_label_size (a) (0) -#endif #define master_tuple (ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 208/518 drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <[email protected]>
commit 4437936c6b696b98f3fe1d8679a2788c41b4df77 upstream.
Synaptics Cascaded Panamera topology needs to unconditionally acquire root aux for dsc decoding.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +1 -1
@@ -201,7 +201,7 @@ static bool validate_dsc_caps_on_connect aconnector->dsc_aux = &aconnector->mst_port->dm_dp_aux.aux;/* synaptics cascaded MST hub case */ -if (!aconnector->dsc_aux &&is_synaptics_cascaded_panamera (aconnector->dc_link, port)) +if (is_synaptics_cascaded_panamera (aconnector->dc_link, port)) aconnector->dsc_aux = port->mgr->aux;if (!aconnector->dsc_aux)
Greg Kroah-Hartman
maintainerPATCH 209/518 Input: goodix - use the new soc_intel_is_byt() helper
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit d176708ffc20332d1c730098d2b111e0b77ece82 upstream.
Use the new soc_intel_is_byt() helper from linux/platform_data/x86/soc.h.
[Ricardo: Resolved minor cherry-pick conflict. The file linux/regulator/
consumer.h is not #included in the upstream version but it is in v5.10.y. ]
--- drivers/input/touchscreen/goodix.c | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-)
drivers/input/touchscreen/goodix.c +2 -16
@@ -23,6 +23,7 @@#include <linux/delay.h> #include <linux/irq.h> #include <linux/interrupt.h> +#include <linux/platform_data/x86/soc.h> #include <linux/regulator/consumer.h> #include <linux/slab.h> #include <linux/acpi.h>
@@ -718,21 +719,6 @@ static int goodix_reset(struct goodix_ts }#ifdef ACPI_GPIO_SUPPORT -#include <asm/cpu_device_id.h> -#include <asm/intel-family.h> - -static const struct x86_cpu_id baytrail_cpu_ids[] = { - {X86_VENDOR_INTEL ,6 ,INTEL_FAM6_ATOM_SILVERMONT ,X86_FEATURE_ANY , }, - {} -}; - -static inline bool is_byt (void ) -{ -const struct x86_cpu_id *id =x86_match_cpu (baytrail_cpu_ids); - -return !!id; -} -static const struct acpi_gpio_params first_gpio = {0 ,0 , false };static const struct acpi_gpio_params second_gpio = {1 ,0 , false };
@@ -816,7 +802,7 @@ static int goodix_add_acpi_gpio_mappingsdev_info (dev,"Using ACPI INTI and INTO methods for IRQ pin access\n" ); ts->irq_pin_access_method =IRQ_PIN_ACCESS_ACPI_METHOD ; gpio_mapping = acpi_goodix_reset_only_gpios; - }else if (is_byt () && ts->gpio_count ==2 && ts->gpio_int_idx ==-1 ) { + }else if (soc_intel_is_byt () && ts->gpio_count ==2 && ts->gpio_int_idx ==-1 ) {dev_info (dev,"No ACPI GpioInt resource, assuming that the GPIO order is reset, int\n" ); ts->irq_pin_access_method =IRQ_PIN_ACCESS_ACPI_GPIO ; gpio_mapping = acpi_goodix_int_last_gpios;
Greg Kroah-Hartman
maintainerPATCH 210/518 powercap: RAPL: fix invalid initialization for pl4_supported field
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumeet Pawnikar <[email protected]>
commit d05b5e0baf424c8c4b4709ac11f66ab726c8deaf upstream.
The current initialization of the struct x86_cpu_id via pl4_support_ids[] is partial and wrong. It is initializing "stepping" field with "X86_FEATURE_ANY" instead of "feature" field.
Use X86_MATCH_INTEL_FAM6_MODEL macro instead of initializing each field of the struct x86_cpu_id for pl4_supported list of CPUs. This X86_MATCH_INTEL_FAM6_MODEL macro internally uses another macro X86_MATCH_VENDOR_FAM_MODEL_FEATURE for X86 based CPU matching with appropriate initialized values.
[ Ricardo: I only kept TIGERLAKE in pl4_support_ids as only this model is
enumerated before this changeset. ]
--- drivers/powercap/intel_rapl_msr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/powercap/intel_rapl_msr.c +1 -1
@@ -126,7 +126,7 @@ static int rapl_msr_write_raw(int cpu, s/* List of verified CPUs. */ static const struct x86_cpu_id pl4_support_ids[] = { - {X86_VENDOR_INTEL ,6 ,INTEL_FAM6_TIGERLAKE_L ,X86_FEATURE_ANY }, +X86_MATCH_INTEL_FAM6_MODEL (TIGERLAKE_L ,NULL ), {} };
Greg Kroah-Hartman
maintainerPATCH 211/518 x86/mm: Switch to new Intel CPU model defines
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
commit 2eda374e883ad297bd9fe575a16c1dc850346075 upstream.
New CPU #defines encode vendor and family as well as model.
[ dhansen: vertically align 0's in invlpg_miss_ids[] ]
[ Ricardo: I used the old match macro X86_MATCH_INTEL_FAM6_MODEL()
instead of X86_MATCH_VFM() as in the upstream commit.
I also kept the ALDERLAKE_N name instead of ATOM_GRACEMONT. Both refer to the same CPU model. ]
--- arch/x86/mm/init.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-)
arch/x86/mm/init.c +6 -10
@@ -257,21 +257,17 @@ static void __init probe_page_size_mask( } } -#define INTEL_MATCH (_model) { .vendor = X86_VENDOR_INTEL, \ - .family = 6, \ - .model = _model, \ - }/* * INVLPG may not properly flush Global entries * on these CPUs when PCIDs are enabled. */ static const struct x86_cpu_id invlpg_miss_ids[] = { -INTEL_MATCH (INTEL_FAM6_ALDERLAKE ), -INTEL_MATCH (INTEL_FAM6_ALDERLAKE_L ), -INTEL_MATCH (INTEL_FAM6_ALDERLAKE_N ), -INTEL_MATCH (INTEL_FAM6_RAPTORLAKE ), -INTEL_MATCH (INTEL_FAM6_RAPTORLAKE_P ), -INTEL_MATCH (INTEL_FAM6_RAPTORLAKE_S ), +X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE ,0 ), +X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE_L ,0 ), +X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE_N ,0 ), +X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE ,0 ), +X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_P ,0 ), +X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_S ,0 ), {} };
Greg Kroah-Hartman
maintainerPATCH 212/518 Revert "bpf: Fix DEVMAP_HASH overflow check on 32-bit arches"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <[email protected]>
This reverts commit 225da02acdc97af01b6bc6ce1a3e5362bf01d3fb which is commit 281d464a34f540de166cee74b723e97ac2515ec3 upstream.
Commit 225da02acdc9 ("bpf: fix DEVMAP_HASH overflow check on 32-bit architectures") relies on the v5.11+ base mechanism of memcg-based memory accounting[0], which is not yet supported on the 5.10 stable branch, so let's revert this commit in preparation for re-adapting it.
--- kernel/bpf/devmap.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
kernel/bpf/devmap.c +5 -6
@@ -129,14 +129,13 @@ static int dev_map_init_map(struct bpf_dbpf_map_init_from_attr (&dtab->map, attr);if (attr->map_type ==BPF_MAP_TYPE_DEVMAP_HASH ) { -/* hash table size must be power of 2; roundup_pow_of_two() can -* overflow into UB on 32-bit arches, so check that first -*/ -if (dtab->map.max_entries >1UL <<31 ) -return -EINVAL ; - dtab->n_buckets =roundup_pow_of_two (dtab->map.max_entries); +if (!dtab->n_buckets)/* Overflow check */ +return -EINVAL ; + } + +if (attr->map_type ==BPF_MAP_TYPE_DEVMAP_HASH ) { dtab->dev_index_head =dev_map_create_hash (dtab->n_buckets, dtab->map.numa_node);if (!dtab->dev_index_head)
Greg Kroah-Hartman
maintainerPATCH 213/518 Revert "bpf: Eliminate rlimit-based memory accounting for devmap maps"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <[email protected]>
This reverts commit 70294d8bc31f3b7789e5e32f757aa9344556d964 which is commit 844f157f6c0a905d039d2e20212ab3231f2e5eaf upstream.
Commit 70294d8bc31f ("bpf: Eliminate rlimit-based memory accounting for devmap maps") is part of the v5.11+ base mechanism of memcg-based memory accounting[0]. The commit cannot be independently backported to the 5.10 stable branch, otherwise the related memory when creating devmap will be unrestricted. Let's roll back to rlimit-based memory accounting mode for devmap.
--- kernel/bpf/devmap.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
kernel/bpf/devmap.c +16 -2
@@ -109,6 +109,8 @@ static inline struct hlist_head *dev_mapstatic int dev_map_init_map (struct bpf_dtab *dtab,union bpf_attr *attr) {u32 valsize = attr->value_size; +u64 cost =0 ; +int err;/* check sanity of attributes. 2 value sizes supported: * 4 bytes: ifindex
@@ -133,13 +135,21 @@ static int dev_map_init_map(struct bpf_dif (!dtab->n_buckets)/* Overflow check */ return -EINVAL ; + cost += (u64 )sizeof (struct hlist_head ) * dtab->n_buckets; + }else { + cost += (u64 ) dtab->map.max_entries *sizeof (struct bpf_dtab_netdev *); } +/* if map size is larger than memlock limit, reject it */ + err =bpf_map_charge_init (&dtab->map.memory, cost); +if (err) +return -EINVAL ; +if (attr->map_type ==BPF_MAP_TYPE_DEVMAP_HASH ) { dtab->dev_index_head =dev_map_create_hash (dtab->n_buckets, dtab->map.numa_node);if (!dtab->dev_index_head) -return -ENOMEM ; + goto free_charge;spin_lock_init (&dtab->index_lock); }else {
@@ -147,10 +157,14 @@ static int dev_map_init_map(struct bpf_dsizeof (struct bpf_dtab_netdev *), dtab->map.numa_node);if (!dtab->netdev_map) -return -ENOMEM ; + goto free_charge; }return 0 ; + +free_charge: +bpf_map_charge_finish (&dtab->map.memory); +return -ENOMEM ; }static struct bpf_map *dev_map_alloc (union bpf_attr *attr)
Greg Kroah-Hartman
maintainerPATCH 214/518 bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke H�iland-J�rgensen <[email protected]>
[ Upstream commit 281d464a34f540de166cee74b723e97ac2515ec3 ]
The devmap code allocates a number hash buckets equal to the next power of two of the max_entries value provided when creating the map. When rounding up to the next power of two, the 32-bit variable storing the number of buckets can overflow, and the code checks for overflow by checking if the truncated 32-bit value is equal to 0. However, on 32-bit arches the rounding up itself can overflow mid-way through, because it ends up doing a left-shift of 32 bits on an unsigned long value. If the size of an unsigned long is four bytes, this is undefined behaviour, so there is no guarantee that we'll end up with a nice and tidy 0-value at the end.
Syzbot managed to turn this into a crash on arm32 by creating a DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it. Fix this by moving the overflow check to before the rounding up operation.
Message-ID: <[email protected]>
--- kernel/bpf/devmap.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
kernel/bpf/devmap.c +6 -3
@@ -131,10 +131,13 @@ static int dev_map_init_map(struct bpf_dbpf_map_init_from_attr (&dtab->map, attr);if (attr->map_type ==BPF_MAP_TYPE_DEVMAP_HASH ) { - dtab->n_buckets =roundup_pow_of_two (dtab->map.max_entries); - -if (!dtab->n_buckets)/* Overflow check */ +/* hash table size must be power of 2; roundup_pow_of_two() can +* overflow into UB on 32-bit arches, so check that first +*/ +if (dtab->map.max_entries >1UL <<31 )return -EINVAL ; + + dtab->n_buckets =roundup_pow_of_two (dtab->map.max_entries); cost += (u64 )sizeof (struct hlist_head ) * dtab->n_buckets; }else { cost += (u64 ) dtab->map.max_entries *sizeof (struct bpf_dtab_netdev *);
Greg Kroah-Hartman
maintainerPATCH 215/518 selinux,smack: dont bypass permissions check in inode_setsecctx hook
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <[email protected]>
commit 76a0e79bc84f466999fa501fce5bf7a07641b8a7 upstream.
Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesystem that is exported with root squashing enabled.
The end of the kerneldoc comment for __vfs_setxattr_noperm() states:
* This function requires the caller to lock the inode's i_mutex before it * is executed. It also assumes that the caller will make the appropriate * permission checks.
nfsd_setattr() does do permissions checking via fh_verify() and nfsd_permission(), but those don't do all the same permissions checks that are done by security_inode_setxattr() and its related LSM hooks do.
Since nfsd_setattr() is the only consumer of security_inode_setsecctx(), simplest solution appears to be to replace the call to __vfs_setxattr_noperm() with a call to __vfs_setxattr_locked(). This fixes the above issue and has the added benefit of causing nfsd to recall conflicting delegations on a file when a client tries to change its security label.
--- security/selinux/hooks.c | 3 ++- security/smack/smack_lsm.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
security/selinux/hooks.c +2 -1
@@ -6570,7 +6570,8 @@ static int selinux_inode_notifysecctx(st*/ static int selinux_inode_setsecctx (struct dentry *dentry,void *ctx,u32 ctxlen) { -return __vfs_setxattr_noperm (dentry,XATTR_NAME_SELINUX , ctx, ctxlen,0 ); +return __vfs_setxattr_locked (dentry,XATTR_NAME_SELINUX , ctx, ctxlen,0 , +NULL ); }static int selinux_inode_getsecctx (struct inode *inode,void **ctx,u32 *ctxlen)
security/smack/smack_lsm.c +2 -1
@@ -4651,7 +4651,8 @@ static int smack_inode_notifysecctx(strustatic int smack_inode_setsecctx (struct dentry *dentry,void *ctx,u32 ctxlen) { -return __vfs_setxattr_noperm (dentry,XATTR_NAME_SMACK , ctx, ctxlen,0 ); +return __vfs_setxattr_locked (dentry,XATTR_NAME_SMACK , ctx, ctxlen,0 , +NULL ); }static int smack_inode_getsecctx (struct inode *inode,void **ctx,u32 *ctxlen)
Greg Kroah-Hartman
maintainerPATCH 216/518 mptcp: fix sometimes-uninitialized warning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
Nathan reported this issue:
$ make -skj"$(nproc)" ARCH=x86_64 LLVM=1 LLVM_IAS=1 mrproper allmodconfig net/mptcp/subflow.o
net/mptcp/subflow.c:877:6: warning: variable 'incr' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
877 | if (WARN_ON_ONCE(offset > skb->len))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/asm-generic/bug.h:101:33: note: expanded from macro 'WARN_ON_ONCE'
101 | #define WARN_ON_ONCE(condition) ({ \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
102 | int __ret_warn_on = !!(condition); \
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
103 | if (unlikely(__ret_warn_on)) \
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
104 | __WARN_FLAGS(BUGFLAG_ONCE | \
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
105 | BUGFLAG_TAINT(TAINT_WARN)); \
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
106 | unlikely(__ret_warn_on); \
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
107 | })
| ~~
net/mptcp/subflow.c:893:6: note: uninitialized use occurs here
893 | if (incr)
| ^~~~
net/mptcp/subflow.c:877:2: note: remove the 'if' if its condition is always false
877 | if (WARN_ON_ONCE(offset > skb->len))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
878 | goto out;
| ~~~~~~~~
net/mptcp/subflow.c:874:18: note: initialize the variable 'incr' to silence this warning
874 | u32 offset, incr, avail_len;
| ^
| = 0
1 warning generated.As mentioned by Nathan, this issue is present because 5.10 does not include commit ea4ca586b16f ("mptcp: refine MPTCP-level ack scheduling"), which removed the use of 'incr' in the error path added by this change. This other commit does not really look suitable for stable, hence this dedicated patch for 5.10.
--- net/mptcp/subflow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mptcp/subflow.c +1 -1
@@ -871,7 +871,7 @@ static void mptcp_subflow_discard_data(sstruct mptcp_subflow_context *subflow =mptcp_subflow_ctx (ssk);bool fin =TCP_SKB_CB (skb)->tcp_flags &TCPHDR_FIN ;struct tcp_sock *tp =tcp_sk (ssk); -u32 offset, incr, avail_len; +u32 offset, incr =0 , avail_len; offset = tp->copied_seq -TCP_SKB_CB (skb)->seq;if (WARN_ON_ONCE (offset > skb->len))
Greg Kroah-Hartman
maintainerPATCH 217/518 Remove *.orig pattern from .gitignore
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
commit 76be4f5a784533c71afbbb1b8f2963ef9e2ee258 upstream.
Commit 3f1b0e1f2875 (".gitignore update") added *.orig and *.rej patterns to .gitignore in v2.6.23. The commit message didn't give a rationale. Later on, commit 1f5d3a6b6532 ("Remove *.rej pattern from .gitignore") removed the *.rej pattern in v2.6.26, on the rationale that *.rej files indicated something went really wrong and should not be ignored.
The *.rej files are now shown by git status, which helps located conflicts when applying patches and lowers the probability that they will go unnoticed. It is however still easy to overlook the *.orig files which slowly polute the source tree. That's not as big of a deal as not noticing a conflict, but it's still not nice.
Drop the *.orig pattern from .gitignore to avoid this and help keep the source tree clean.
[[email protected]:
I do not have a strong opinion about this. Perhaps some people may have a different opinion.
If you are someone who wants to ignore *.orig, it is likely you would want to do so across all projects. Then, $XDG_CONFIG_HOME/git/ignore would be more suitable for your needs. gitignore(5) suggests, "Patterns which a user wants Git to ignore in all situations generally go into a file specified by core.excludesFile in the user's ~/.gitconfig".
Please note that you cannot do the opposite; if *.orig is ignored by the project's .gitignore, you cannot override the decision because $XDG_CONFIG_HOME/git/ignore has a lower priority.
If *.orig is sitting on the fence, I'd leave it to the users. ]
--- .gitignore | 1 - 1 file changed, 1 deletion(-)
.gitignore +0 -1
@@ -124,7 +124,6 @@ GTAGS # id-utils files ID -*.orig *~ \#*#
Greg Kroah-Hartman
maintainerPATCH 218/518 ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit fcca6d05ef49d5650514ea1dcfd12e4ae3ff2be6 upstream.
Return devm_of_clk_add_hw_provider() in order to transfer the error, if it fails due to resource allocation failure or device tree clock provider registration failure.
--- sound/soc/codecs/rt5682.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/codecs/rt5682.c +3 -1
@@ -2843,8 +2843,10 @@ static int rt5682_register_dai_clks(stru }if (dev->of_node) { -devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get, + ret =devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get, dai_clk_hw); +if (ret) +return ret; }else { ret = devm_clk_hw_register_clkdev(dev, dai_clk_hw, init.name,
Greg Kroah-Hartman
maintainerPATCH 219/518 soc: versatile: integrator: fix OF node leak in probe() error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 874c5b601856adbfda10846b9770a6c66c41e229 upstream.
Driver is leaking OF node reference obtained fromof_find_matching_node().
--- drivers/soc/versatile/soc-integrator.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/versatile/soc-integrator.c +1 -0
@@ -113,6 +113,7 @@ static int __init integrator_soc_init(voreturn -ENODEV ; syscon_regmap =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (syscon_regmap))return PTR_ERR (syscon_regmap);
Greg Kroah-Hartman
maintainerPATCH 220/518 Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <[email protected]>
commit e06edf96dea065dd1d9df695bf8b92784992333e upstream.
Some TongFang barebones have touchpad and/or keyboard issues after suspend, fixable with nomux + reset + noloop + nopnp. Luckily, none of them have an external PS/2 port so this can safely be set for all of them.
I'm not entirely sure if every device listed really needs all four quirks, but after testing and production use, no negative effects could be observed when setting all four.
--- drivers/input/serio/i8042-acpipnpio.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +23 -0
@@ -1119,6 +1119,29 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOLOOP) },/* +* Some TongFang barebones have touchpad and/or keyboard issues after +* suspend fixable with nomux + reset + noloop + nopnp. Luckily, none of +* them have an external PS/2 port so this can safely be set for all of +* them. +* TongFang barebones come with board_vendor and/or system_vendor set to +* a different value for each individual reseller. The only somewhat +* universal way to identify them is by board_name. +*/ + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GM6XGxX"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, +/* * A lot of modern Clevo barebones have touchpad and/or keyboard issues * after suspend fixable with nomux + reset + noloop + nopnp. Luckily, * none of them have an external PS/2 port so this can safely be set for
Greg Kroah-Hartman
maintainerPATCH 221/518 Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <[email protected]>
commit 3870e2850b56306d1d1e435c5a1ccbccd7c59291 upstream.
The Gen6 devices have the same problem and the same Solution as the Gen5 ones.
Some TongFang barebones have touchpad and/or keyboard issues after suspend, fixable with nomux + reset + noloop + nopnp. Luckily, none of them have an external PS/2 port so this can safely be set for all of them.
I'm not entirely sure if every device listed really needs all four quirks, but after testing and production use, no negative effects could be observed when setting all four.
--- drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +7 -0
@@ -1141,6 +1141,13 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, /* * A lot of modern Clevo barebones have touchpad and/or keyboard issues * after suspend fixable with nomux + reset + noloop + nopnp. Luckily,
Greg Kroah-Hartman
maintainerPATCH 222/518 Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <[email protected]>
commit 01eed86d50af9fab27d876fd677b86259ebe9de3 upstream.
There might be devices out in the wild where the board name is GMxXGxx instead of GMxXGxX.
Adding both to be on the safe side.
--- drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +7 -0
@@ -1136,6 +1136,13 @@ static const struct dmi_system_id i8042_ }, { .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, + { + .matches = { DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"), }, .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
Greg Kroah-Hartman
maintainerPATCH 223/518 drm/amd/display: Round calculated vtotal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Chen <[email protected]>
commit c03fca619fc687338a3b6511fdbed94096abdf79 upstream.
[WHY]
The calculated vtotal may has 1 line deviation. To get precisely vtotal number, round the vtotal result.
--- drivers/gpu/drm/amd/display/modules/freesync/freesync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/modules/freesync/freesync.c +1 -1
@@ -131,7 +131,7 @@ static unsigned int calc_v_total_from_re v_total =div64_u64 (div64_u64 (((unsigned long long )( frame_duration_in_ns) * (stream->timing.pix_clk_100hz /10 )), - stream->timing.h_total),1000000 ); + stream->timing.h_total) +500000 ,1000000 );/* v_total cannot be less than nominal */ if (v_total < stream->timing.v_total) {
Greg Kroah-Hartman
maintainerPATCH 224/518 USB: appledisplay: close race between probe and completion handler
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 8265d06b7794493d82c5c21a12d7ba43eccc30cb upstream.
There is a small window during probing when IO is running but the backlight is not registered. Processing events during that time will crash. The completion handler needs to check for a backlight before scheduling work.
The bug is as old as the driver.
--- drivers/usb/misc/appledisplay.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/usb/misc/appledisplay.c +11 -4
@@ -107,7 +107,12 @@ static void appledisplay_complete(structcase ACD_BTN_BRIGHT_UP :case ACD_BTN_BRIGHT_DOWN : pdata->button_pressed =1 ; -schedule_delayed_work (&pdata->work,0 ); +/* +* there is a window during which no device +* is registered +*/ +if (pdata->bd ) +schedule_delayed_work (&pdata->work,0 );break ;case ACD_BTN_NONE :default :
@@ -202,6 +207,7 @@ static int appledisplay_probe(struct usb const struct usb_device_id *id) {struct backlight_properties props; +struct backlight_device *backlight;struct appledisplay *pdata;struct usb_device *udev =interface_to_usbdev (iface);struct usb_endpoint_descriptor *endpoint;
@@ -272,13 +278,14 @@ static int appledisplay_probe(struct usbmemset (&props,0 ,sizeof (struct backlight_properties )); props.type =BACKLIGHT_RAW ; props.max_brightness =0xff ; - pdata->bd =backlight_device_register (bl_name,NULL , pdata, + backlight =backlight_device_register (bl_name,NULL , pdata, &appledisplay_bl_data, &props); -if (IS_ERR (pdata->bd)) { +if (IS_ERR (backlight)) {dev_err (&iface->dev,"Backlight registration failed\n" ); - retval =PTR_ERR (pdata->bd); + retval =PTR_ERR (backlight); goto error; } + pdata->bd = backlight;/* Try to get brightness */ brightness =appledisplay_bl_get_brightness (pdata->bd);
Greg Kroah-Hartman
maintainerPATCH 225/518 USB: misc: cypress_cy7c63: check for short transfer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 49cd2f4d747eeb3050b76245a7f72aa99dbd3310 upstream.
As we process the second byte of a control transfer, transfers of less than 2 bytes must be discarded.
This bug is as old as the driver.
--- drivers/usb/misc/cypress_cy7c63.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/misc/cypress_cy7c63.c +4 -0
@@ -88,6 +88,9 @@ static int vendor_command(struct cypressUSB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_OTHER , address, data, iobuf,CYPRESS_MAX_REQSIZE , USB_CTRL_GET_TIMEOUT); +/* we must not process garbage */ +if (retval <2 ) + goto err_buf;/* store returned data (more READs to be added) */ switch (request) {
@@ -107,6 +110,7 @@ static int vendor_command(struct cypressbreak ; } +err_buf:kfree (iobuf); error:return retval;
Greg Kroah-Hartman
maintainerPATCH 226/518 USB: class: CDC-ACM: fix race between get_serial and set_serial
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit b41c1fa155ba56d125885b0191aabaf3c508d0a3 upstream.
TIOCGSERIAL is an ioctl. Thus it must be atomic. It returns two values. Racing with set_serial it can return an inconsistent result. The mutex must be taken.
In terms of logic the bug is as old as the driver. In terms of code it goes back to the conversion to the get_serial and set_serial methods.
--- drivers/usb/class/cdc-acm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/class/cdc-acm.c +2 -0
@@ -942,10 +942,12 @@ static int get_serial_info(struct tty_ststruct acm *acm = tty->driver_data; ss->line = acm->minor; +mutex_lock (&acm->port.mutex); ss->close_delay =jiffies_to_msecs (acm->port.close_delay) /10 ; ss->closing_wait = acm->port.closing_wait ==ASYNC_CLOSING_WAIT_NONE ?ASYNC_CLOSING_WAIT_NONE :jiffies_to_msecs (acm->port.closing_wait) /10 ; +mutex_unlock (&acm->port.mutex);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 227/518 bus: integrator-lm: fix OF node leak in probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 15a62b81175885b5adfcaf49870466e3603f06c7 upstream.
Driver code is leaking OF node reference from of_find_matching_node() in probe().
--- drivers/bus/arm-integrator-lm.c | 1 + 1 file changed, 1 insertion(+)
drivers/bus/arm-integrator-lm.c +1 -0
@@ -84,6 +84,7 @@ static int integrator_ap_lm_probe(structreturn -ENODEV ; } map =syscon_node_to_regmap (syscon); +of_node_put (syscon);if (IS_ERR (map)) {dev_err (dev,"could not find Integrator/AP system controller\n" );
Greg Kroah-Hartman
maintainerPATCH 228/518 firmware_loader: Block path traversal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit f0e5311aa8022107d63c54e2f03684ec097d1394 upstream.
Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or such.
However, there are a couple codepaths in the kernel where firmware file names contain string components that are passed through from a device or semi-privileged userspace; the ones I could find (not counting interfaces that require root privileges) are:
- lpfc_sli4_request_firmware_update() seems to construct the firmware filename from "ModelName", a string that was previously parsed out of some descriptor ("Vital Product Data") in lpfc_fill_vpd()
- nfp_net_fw_find() seems to construct a firmware filename from a model name coming from nfp_hwinfo_lookup(pf->hwinfo, "nffw.partno"), which I think parses some descriptor that was read from the device. (But this case likely isn't exploitable because the format string looks like "netronome/nic_%s", and there shouldn't be any *folders* starting with "netronome/nic_". The previous case was different because there, the "%s" is *at the start* of the format string.)
- module_flash_fw_schedule() is reachable from the ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is enough to pass the privilege check), and takes a userspace-provided firmware name.
(But I think to reach this case, you need to have CAP_NET_ADMIN over a network namespace that a special kind of ethernet device is mapped into, so I think this is not a viable attack path in practice.)
Fix it by rejecting any firmware names containing ".." path components.
For what it's worth, I went looking and haven't found any USB device drivers that use the firmware loader dangerously.
--- drivers/base/firmware_loader/main.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/base/firmware_loader/main.c +30 -0
@@ -786,6 +786,26 @@ static void fw_abort_batch_reqs(struct fmutex_unlock (&fw_lock); } +/* +* Reject firmware file names with ".." path components. +* There are drivers that construct firmware file names from device-supplied +* strings, and we don't want some device to be able to tell us "I would like to +* be sent my firmware from ../../../etc/shadow, please". +* +* Search for ".." surrounded by either '/' or start/end of string. +* +* This intentionally only looks at the firmware name, not at the firmware base +* directory or at symlink contents. +*/ +static bool name_contains_dotdot (const char *name) +{ +size_t name_len =strlen (name); + +return strcmp (name,".." ) ==0 ||strncmp (name,"../" ,3 ) ==0 || +strstr (name,"/../" ) !=NULL || + (name_len >=3 &&strcmp (name+name_len-3 ,"/.." ) ==0 ); +} +/* called from request_firmware() and request_firmware_work_func() */ static int _request_firmware(const struct firmware **firmware_p, const char *name,
@@ -806,6 +826,14 @@ _request_firmware(const struct firmware goto out; } +if (name_contains_dotdot (name)) { +dev_warn (device, +"Firmware load for '%s' refused, path contains '..' component\n" , + name); + ret = -EINVAL ; + goto out; + } + ret =_request_firmware_prepare (&fw, name, device, buf, size, offset, opt_flags);if (ret <=0 )/* error or already assigned */
@@ -876,6 +904,8 @@ _request_firmware(const struct firmware* @name will be used as $FIRMWARE in the uevent environment and * should be distinctive enough not to be confused with any other * firmware image for this or any other device. +* It must not contain any ".." path components - "foo/bar..bin" is +* allowed, but "foo/../bar.bin" is not. * * Caller must hold the reference count of @device. *
Greg Kroah-Hartman
maintainerPATCH 229/518 tty: rp2: Fix reset with non forgiving PCIe host bridges
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit f16dd10ba342c429b1e36ada545fb36d4d1f0e63 upstream.
The write to RP2_GLOBAL_CMD followed by an immediate read of RP2_GLOBAL_CMD in rp2_reset_asic() is intented to flush out the write, however by then the device is already in reset and cannot respond to a memory cycle access.
On platforms such as the Raspberry Pi 4 and others using the pcie-brcmstb.c driver, any memory access to a device that cannot respond is met with a fatal system error, rather than being substituted with all 1s as is usually the case on PC platforms.
Swapping the delay and the read ensures that the device has finished resetting before we attempt to read from it.
--- drivers/tty/serial/rp2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/rp2.c +1 -1
@@ -600,8 +600,8 @@ static void rp2_reset_asic(struct rp2_cau32 clk_cfg;writew (1 , base +RP2_GLOBAL_CMD ); -readw (base +RP2_GLOBAL_CMD );msleep (100 ); +readw (base +RP2_GLOBAL_CMD );writel (0 , base +RP2_CLK_PRESCALER );/* TDM clock configuration */
Greg Kroah-Hartman
maintainerPATCH 230/518 crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavan Kumar Paluri <[email protected]>
commit ce3d2d6b150ba8528f3218ebf0cee2c2c572662d upstream.
In case of sev PLATFORM_STATUS failure, sev_get_api_version() fails resulting in sev_data field of psp_master nulled out. This later becomes a problem when unloading the ccp module because the device has not been unregistered (via misc_deregister()) before clearing the sev_data field of psp_master. As a result, on reloading the ccp module, a duplicate device issue is encountered as can be seen from the dmesg log below.
on reloading ccp module via modprobe ccp
Call Trace: <TASK> dump_stack_lvl+0xd7/0xf0 dump_stack+0x10/0x20 sysfs_warn_dup+0x5c/0x70 sysfs_create_dir_ns+0xbc/0xd kobject_add_internal+0xb1/0x2f0 kobject_add+0x7a/0xe0 ? srso_alias_return_thunk+0x5/0xfbef5 ? get_device_parent+0xd4/0x1e0 ? __pfx_klist_children_get+0x10/0x10 device_add+0x121/0x870 ? srso_alias_return_thunk+0x5/0xfbef5 device_create_groups_vargs+0xdc/0x100 device_create_with_groups+0x3f/0x60 misc_register+0x13b/0x1c0 sev_dev_init+0x1d4/0x290 [ccp] psp_dev_init+0x136/0x300 [ccp] sp_init+0x6f/0x80 [ccp] sp_pci_probe+0x2a6/0x310 [ccp] ? srso_alias_return_thunk+0x5/0xfbef5 local_pci_probe+0x4b/0xb0 work_for_cpu_fn+0x1a/0x30 process_one_work+0x203/0x600 worker_thread+0x19e/0x350 ? __pfx_worker_thread+0x10/0x10 kthread+0xeb/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> kobject: kobject_add_internal failed for sev with -EEXIST, don't try to register things with the same name in the same directory. ccp 0000:22:00.1: sev initialization failed ccp 0000:22:00.1: psp initialization failed ccp 0000:a2:00.1: no command queues available ccp 0000:a2:00.1: psp enabled
Address this issue by unregistering the /dev/sev before clearing out sev_data in case of PLATFORM_STATUS failure.
--- drivers/crypto/ccp/sev-dev.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/ccp/sev-dev.c +2 -0
@@ -1129,6 +1129,8 @@ void sev_pci_init(void)return ; err: +sev_dev_destroy (psp_master); + psp_master->sev_data =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 231/518 drbd: Fix atomicity violation in drbd_uuid_set_bm()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiu-ji Chen <[email protected]>
commit 2f02b5af3a4482b216e6a466edecf6ba8450fa45 upstream.
The violation of atomicity occurs when the drbd_uuid_set_bm function is executed simultaneously with modifying the value of device->ldev->md.uuid[UI_BITMAP]. Consider a scenario where, while device->ldev->md.uuid[UI_BITMAP] passes the validity check when its value is not zero, the value of device->ldev->md.uuid[UI_BITMAP] is written to zero. In this case, the check in drbd_uuid_set_bm might refer to the old value of device->ldev->md.uuid[UI_BITMAP] (before locking), which allows an invalid value to pass the validity check, resulting in inconsistency.
To address this issue, it is recommended to include the data validity check within the locked section of the function. This modification ensures that the value of device->ldev->md.uuid[UI_BITMAP] does not change during the validation process, thereby maintaining its integrity.
This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations.
--- drivers/block/drbd/drbd_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/block/drbd/drbd_main.c +4 -2
@@ -3429,10 +3429,12 @@ void drbd_uuid_new_current(struct drbd_dvoid drbd_uuid_set_bm (struct drbd_device *device,u64 val)__must_hold (local) {unsigned long flags; -if (device->ldev->md.uuid[UI_BITMAP ] ==0 && val ==0 ) +spin_lock_irqsave (&device->ldev->md.uuid_lock, flags); +if (device->ldev->md.uuid[UI_BITMAP ] ==0 && val ==0 ) { +spin_unlock_irqrestore (&device->ldev->md.uuid_lock, flags);return ; + } -spin_lock_irqsave (&device->ldev->md.uuid_lock, flags);if (val ==0 ) {drbd_uuid_move_history (device); device->ldev->md.uuid[UI_HISTORY_START ] = device->ldev->md.uuid[UI_BITMAP ];
Greg Kroah-Hartman
maintainerPATCH 232/518 drbd: Add NULL check for net_conf to prevent dereference in state validation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Lobanov <[email protected]>
commit a5e61b50c9f44c5edb6e134ede6fee8806ffafa9 upstream.
If the net_conf pointer is NULL and the code attempts to access its fields without a check, it will lead to a null pointer dereference. Add a NULL check before dereferencing the pointer.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/block/drbd/drbd_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/drbd/drbd_state.c +1 -1
@@ -876,7 +876,7 @@ is_valid_state(struct drbd_device *devic ns.disk == D_OUTDATED) rv =SS_CONNECTED_OUTDATES ; - else if ((ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) && + else if (nc && (ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) && (nc->verify_alg[0] == 0)) rv =SS_NO_VERIFY_ALG ;
Greg Kroah-Hartman
maintainerPATCH 233/518 ACPI: sysfs: validate return type of _STR method
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 4bb1e7d027413835b086aed35bc3f0713bc0f72b upstream.
Only buffer objects are valid return values of _STR.
If something else is returned description_show() will access invalid memory.
--- drivers/acpi/device_sysfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/acpi/device_sysfs.c +3 -2
@@ -533,8 +533,9 @@ int acpi_device_setup_files(struct acpi_* If device has _STR, 'description' file is created */ if (acpi_has_method (dev->handle,"_STR" )) { - status =acpi_evaluate_object (dev->handle,"_STR" , -NULL , &buffer); + status =acpi_evaluate_object_typed (dev->handle,"_STR" , +NULL , &buffer, +ACPI_TYPE_BUFFER );if (ACPI_FAILURE (status)) buffer.pointer =NULL ; dev->pnp.str_obj = buffer.pointer;
Greg Kroah-Hartman
maintainerPATCH 234/518 ACPI: resource: Add another DMI match for the TongFang GMxXGxx
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <[email protected]>
commit a98cfe6ff15b62f94a44d565607a16771c847bc6 upstream.
Internal documentation suggest that the TUXEDO Polaris 15 Gen5 AMD might have GMxXGxX as the board name instead of GMxXGxx.
Adding both to be on the safe side.
--- drivers/acpi/resource.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/resource.c +6 -0
@@ -456,6 +456,12 @@ static const struct dmi_system_id asus_l }, }, { +/* TongFang GMxXGxX/TUXEDO Polaris 15 Gen5 AMD */ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"), + }, + }, + {/* TongFang GMxXGxx sold as Eluktronics Inc. RP-15 */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."),
Greg Kroah-Hartman
maintainerPATCH 235/518 efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 77d48d39e99170b528e4f2e9fc5d1d64cdedd386 upstream.
The TPM event log table is a Linux specific construct, where the data produced by the GetEventLog() boot service is cached in memory, and passed on to the OS using an EFI configuration table.
The use of EFI_LOADER_DATA here results in the region being left unreserved in the E820 memory map constructed by the EFI stub, and this is the memory description that is passed on to the incoming kernel by kexec, which is therefore unaware that the region should be reserved.
Even though the utility of the TPM2 event log after a kexec is questionable, any corruption might send the parsing code off into the weeds and crash the kernel. So let's use EFI_ACPI_RECLAIM_MEMORY instead, which is always treated as reserved by the E820 conversion logic.
--- drivers/firmware/efi/libstub/tpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/libstub/tpm.c +1 -1
@@ -115,7 +115,7 @@ void efi_retrieve_tpm2_eventlog(void) }/* Allocate space for the logs and copy them. */ - status =efi_bs_call (allocate_pool,EFI_LOADER_DATA , + status =efi_bs_call (allocate_pool,EFI_ACPI_RECLAIM_MEMORY ,sizeof (*log_tbl) + log_size, (void **)&log_tbl);if (status !=EFI_SUCCESS ) {
Greg Kroah-Hartman
maintainerPATCH 236/518 perf/x86/intel/pt: Fix sampling synchronization
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit d92792a4b26e50b96ab734cbe203d8a4c932a7a9 upstream.
pt_event_snapshot_aux() uses pt->handle_nmi to determine if tracing needs to be stopped, however tracing can still be going because pt->handle_nmi is set to zero before tracing is stopped in pt_event_stop, whereas pt_event_snapshot_aux() requires that tracing must be stopped in order to copy a sample of trace from the buffer.
Instead call pt_config_stop() always, which anyway checks config for RTIT_CTL_TRACEEN and does nothing if it is already clear.
Note pt_event_snapshot_aux() can continue to use pt->handle_nmi to determine if the trace needs to be restarted afterwards.
--- arch/x86/events/intel/pt.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
arch/x86/events/intel/pt.c +7 -8
@@ -1586,6 +1586,7 @@ static void pt_event_stop(struct perf_ev* see comment in intel_pt_interrupt(). */ WRITE_ONCE (pt->handle_nmi,0 ); +barrier ();pt_config_stop (event);
@@ -1637,11 +1638,10 @@ static long pt_event_snapshot_aux(structreturn 0 ;/* -* Here, handle_nmi tells us if the tracing is on +* There is no PT interrupt in this mode, so stop the trace and it will +* remain stopped while the buffer is copied. */ -if (READ_ONCE (pt->handle_nmi)) -pt_config_stop (event); - +pt_config_stop (event);pt_read_offset (buf);pt_update_head (pt);
@@ -1653,11 +1653,10 @@ static long pt_event_snapshot_aux(struct ret =perf_output_copy_aux (&pt->handle, handle, from, to);/* -* If the tracing was on when we turned up, restart it. -* Compiler barrier not needed as we couldn't have been -* preempted by anything that touches pt->handle_nmi. +* Here, handle_nmi tells us if the tracing was on. +* If the tracing was on, restart it. */ -if (pt->handle_nmi) +if (READ_ONCE (pt->handle_nmi))pt_config_start (event);return ret;
Greg Kroah-Hartman
maintainerPATCH 237/518 wifi: rtw88: 8822c: Fix reported RX band width
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
commit a71ed5898dfae68262f79277915d1dfe34586bc6 upstream.
"iw dev wlp2s0 station dump" shows incorrect rx bitrate:
tx bitrate: 866.7 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 2 rx bitrate: 86.7 MBit/s VHT-MCS 9 VHT-NSS 1
This is because the RX band width is calculated incorrectly. Fix the calculation according to the phydm_rxsc_2_bw() function from the official drivers.
After:
tx bitrate: 866.7 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 2 rx bitrate: 390.0 MBit/s VHT-MCS 9 80MHz VHT-NSS 1
It also works correctly with the AP configured for 20 MHz and 40 MHz.
Tested with RTL8822CE.
--- drivers/net/wireless/realtek/rtw88/rtw8822c.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/wireless/realtek/rtw88/rtw8822c.c +6 -4
@@ -1813,12 +1813,14 @@ static void query_phy_status_page1(strucelse rxsc =GET_PHY_STAT_P1_HT_RXSC (phy_status); -if (rxsc >=9 && rxsc <=12 ) +if (rxsc ==0 ) + bw = rtwdev->hal.current_band_width; +else if (rxsc >=1 && rxsc <=8 ) + bw =RTW_CHANNEL_WIDTH_20 ; +else if (rxsc >=9 && rxsc <=12 ) bw =RTW_CHANNEL_WIDTH_40 ; -else if (rxsc >=13 ) - bw =RTW_CHANNEL_WIDTH_80 ;else - bw =RTW_CHANNEL_WIDTH_20 ; + bw =RTW_CHANNEL_WIDTH_80 ; pkt_stat->rx_power[RF_PATH_A ] =GET_PHY_STAT_P1_PWDB_A (phy_status) -110 ; pkt_stat->rx_power[RF_PATH_B ] =GET_PHY_STAT_P1_PWDB_B (phy_status) -110 ;
Greg Kroah-Hartman
maintainerPATCH 238/518 debugobjects: Fix conditions in fill_pool()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Lei <[email protected]>
commit 684d28feb8546d1e9597aa363c3bfcf52fe250b7 upstream.
fill_pool() uses 'obj_pool_min_free' to decide whether objects should be handed back to the kmem cache. But 'obj_pool_min_free' records the lowest historical value of the number of objects in the object pool and not the minimum number of objects which should be kept in the pool.
Use 'debug_objects_pool_min_level' instead, which holds the minimum number which was scaled to the number of CPUs at boot time.
[ tglx: Massage change log ]
--- lib/debugobjects.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
lib/debugobjects.c +3 -2
@@ -144,13 +144,14 @@ static void fill_pool(void)* READ_ONCE()s pair with the WRITE_ONCE()s in pool_lock critical * sections. */ -while (READ_ONCE (obj_nr_tofree) && (READ_ONCE (obj_pool_free) < obj_pool_min_free)) { +while (READ_ONCE (obj_nr_tofree) && +READ_ONCE (obj_pool_free) < debug_objects_pool_min_level) {raw_spin_lock_irqsave (&pool_lock, flags);/* * Recheck with the lock held as the worker thread might have * won the race and freed the global free list already. */ -while (obj_nr_tofree && (obj_pool_free < obj_pool_min_free)) { +while (obj_nr_tofree && (obj_pool_free < debug_objects_pool_min_level)) { obj =hlist_entry (obj_to_free.first,typeof (*obj), node);hlist_del (&obj->node);WRITE_ONCE (obj_nr_tofree, obj_nr_tofree -1 );
Greg Kroah-Hartman
maintainerPATCH 239/518 f2fs: prevent possible int overflow in dir_block_index()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 47f268f33dff4a5e31541a990dc09f116f80e61c upstream.
The result of multiplication between values derived from functions dir_buckets() and bucket_blocks() *could* technically reach 2^30 * 2^2 = 2^32.
While unlikely to happen, it is prudent to ensure that it will not lead to integer overflow. Thus, use mul_u32_u32() as it's more appropriate to mitigate the issue.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- fs/f2fs/dir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/dir.c +2 -1
@@ -183,7 +183,8 @@ static unsigned long dir_block_index(unsunsigned long bidx =0 ;for (i =0 ; i < level; i++) - bidx +=dir_buckets (i, dir_level) *bucket_blocks (i); + bidx +=mul_u32_u32 (dir_buckets (i, dir_level), +bucket_blocks (i)); bidx += idx *bucket_blocks (level);return bidx; }
Greg Kroah-Hartman
maintainerPATCH 240/518 f2fs: avoid potential int overflow in sanity_check_area_boundary()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 50438dbc483ca6a133d2bce9d5d6747bcee38371 upstream.
While calculating the end addresses of main area and segment 0, u32 may be not enough to hold the result without the danger of int overflow.
Just in case, play it safe and cast one of the operands to a wider type (u64).
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- fs/f2fs/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/super.c +2 -2
@@ -2754,9 +2754,9 @@ static inline bool sanity_check_area_bouu32 segment_count =le32_to_cpu (raw_super->segment_count);u32 log_blocks_per_seg =le32_to_cpu (raw_super->log_blocks_per_seg);u64 main_end_blkaddr = main_blkaddr + - (segment_count_main << log_blocks_per_seg); + ((u64 )segment_count_main << log_blocks_per_seg);u64 seg_end_blkaddr = segment0_blkaddr + - (segment_count << log_blocks_per_seg); + ((u64 )segment_count << log_blocks_per_seg);if (segment0_blkaddr != cp_blkaddr) { f2fs_info(sbi, "Mismatch start address, segment0(%u) cp_blkaddr(%u)",
Greg Kroah-Hartman
maintainerPATCH 241/518 hwrng: mtk - Use devm_pm_runtime_enable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <[email protected]>
commit 78cb66caa6ab5385ac2090f1aae5f3c19e08f522 upstream.
Replace pm_runtime_enable with the devres-enabled version which can trigger pm_runtime_disable.
Otherwise, the below appears during reload driver.
mtk_rng 1020f000.rng: Unbalanced pm_runtime_enable!
--- drivers/char/hw_random/mtk-rng.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/hw_random/mtk-rng.c +1 -1
@@ -142,7 +142,7 @@ static int mtk_rng_probe(struct platformdev_set_drvdata (&pdev->dev, priv);pm_runtime_set_autosuspend_delay (&pdev->dev,RNG_AUTOSUSPEND_TIMEOUT );pm_runtime_use_autosuspend (&pdev->dev); -pm_runtime_enable (&pdev->dev); +devm_pm_runtime_enable (&pdev->dev);dev_info (&pdev->dev,"registered RNG driver\n" );
Greg Kroah-Hartman
maintainerPATCH 242/518 hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <[email protected]>
commit 4b7acc85de14ee8a2236f54445dc635d47eceac0 upstream.
Add the missing clk_disable_unprepare() before return in cctrng_resume().
--- drivers/char/hw_random/cctrng.c | 1 + 1 file changed, 1 insertion(+)
drivers/char/hw_random/cctrng.c +1 -0
@@ -679,6 +679,7 @@ static int __maybe_unused cctrng_resume(/* wait for Cryptocell reset completion */ if (!cctrng_wait_for_reset_completion (drvdata)) {dev_err (dev,"Cryptocell reset not completed" ); +clk_disable_unprepare (drvdata->clk);return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 243/518 arm64: dts: rockchip: Raise Pinebook Pros panel backlight PWM frequency
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
commit 8c51521de18755d4112a77a598a348b38d0af370 upstream.
Increase the frequency of the PWM signal that drives the LED backlight of the Pinebook Pro's panel, from about 1.35 KHz (which equals to the PWM period of 740,740 ns), to exactly 8 kHz (which equals to the PWM period of 125,000 ns). Using a higher PWM frequency for the panel backlight, which reduces the flicker, can only be beneficial to the end users' eyes.
On top of that, increasing the backlight PWM signal frequency reportedly eliminates the buzzing emitted from the Pinebook Pro's built-in speakers when certain backlight levels are set, which cause some weird interference with some of the components of the Pinebook Pro's audio chain.
The old value for the backlight PWM period, i.e. 740,740 ns, is pretty much an arbitrary value that was selected during the very early bring-up of the Pinebook Pro, only because that value seemed to minimize horizontal line distortion on the display, which resulted from the old X.org drivers causing screen tearing when dragging windows around. That's no longer an issue, so there are no reasons to stick with the old PWM period value.
The lower and the upper backlight PWM frequency limits for the Pinebook Pro's panel, according to its datasheet, are 200 Hz and 10 kHz, respectively. [1] These changes still leave some headroom, which may have some positive effects on the lifetime expectancy of the panel's backlight LEDs.
[1] https://files.pine64.org/doc/datasheet/PinebookPro/NV140FHM-N49_Rev.P0_20160804_201710235838.pdf
--- arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +1 -1
@@ -25,7 +25,7 @@ backlight: edp-backlight { compatible = "pwm-backlight"; power-supply = <&vcc_12v>; - pwms = <&pwm0 0 740740 0>; + pwms = <&pwm0 0 125000 0>; }; bat: battery {
Greg Kroah-Hartman
maintainerPATCH 244/518 arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
commit def33fb1191207f5afa6dcb681d71fef2a6c1293 upstream.
All batches of the Pine64 Pinebook Pro, except the latest batch (as of 2024) whose hardware design was revised due to the component shortage, use a 1S lithium battery whose nominal/design capacity is 10,000 mAh, according to the battery datasheet. [1][2] Let's correct the design full-charge value in the Pinebook Pro board dts, to improve the accuracy of the hardware description, and to hopefully improve the accuracy of the fuel gauge a bit on all units that don't belong to the latest batch.
The above-mentioned latest batch uses a different 1S lithium battery with a slightly lower capacity, more precisely 9,600 mAh. To make the fuel gauge work reliably on the latest batch, a sample battery would need to be sent to CellWise, to obtain its proprietary battery profile, whose data goes into "cellwise,battery-profile" in the Pinebook Pro board dts. Without that data, the fuel gauge reportedly works unreliably, so changing the design capacity won't have any negative effects on the already unreliable operation of the fuel gauge in the Pinebook Pros that belong to the latest batch.
According to the battery datasheet, its voltage can go as low as 2.75 V while discharging, but it's better to leave the current 3.0 V value in the dts file, because of the associated Pinebook Pro's voltage regulation issues.
[1] https://wiki.pine64.org/index.php/Pinebook_Pro#Battery
[2] https://files.pine64.org/doc/datasheet/pinebook/40110175P%203.8V%2010000mAh%E8%A7%84%E6%A0%BC%E4%B9%A6-14.pdf
--- arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +1 -1
@@ -30,7 +30,7 @@ bat: battery { compatible = "simple-battery"; - charge-full-design-microamp-hours = <9800000>; + charge-full-design-microamp-hours = <10000000>; voltage-max-design-microvolt = <4350000>; voltage-min-design-microvolt = <3000000>; };
Greg Kroah-Hartman
maintainerPATCH 245/518 vfs: fix race between evice_inodes() and find_inode()&iput()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Sun <[email protected]>
commit 88b1afbf0f6b221f6c5bb66cc80cd3b38d696687 upstream.
Hi, all
Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs.
Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super().
cpu0: cpu1:iput() // i_count is 1
->spin_lock(inode)
->dec i_count to 0
->iput_final() generic_shutdown_super()
->__inode_add_lru() ->evict_inodes()
// cause some reason[2] ->if (atomic_read(inode->i_count)) continue;
// return before // inode 261 passed the above check
// list_lru_add_obj() // and then schedule out ->spin_unlock()
// note here: the inode 261
// was still at sb list and hash list,
// and I_FREEING|I_WILL_FREE was not been set
btrfs_iget()
// after some function calls
->find_inode()
// found the above inode 261
->spin_lock(inode)
// check I_FREEING|I_WILL_FREE
// and passed
->__iget()
->spin_unlock(inode) // schedule back
->spin_lock(inode)
// check (I_NEW|I_FREEING|I_WILL_FREE) flags,
// passed and set I_FREEINGiput() ->spin_unlock(inode)
->spin_lock(inode) ->evict()
// dec i_count to 0
->iput_final()
->spin_unlock()
->evict()Now, we have two threads simultaneously evicting
the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput().
To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced.
If there is any misunderstanding, please let me know, thanks.
[1]: https://lore.kernel.org/linux-btrfs/[email protected]/
[2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.
--- fs/inode.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/inode.c +4 -0
@@ -670,6 +670,10 @@ again:continue ;spin_lock (&inode->i_lock); +if (atomic_read (&inode->i_count)) { +spin_unlock (&inode->i_lock); +continue ; + }if (inode->i_state & (I_NEW |I_FREEING |I_WILL_FREE )) {spin_unlock (&inode->i_lock);continue ;
Greg Kroah-Hartman
maintainerPATCH 246/518 fs: Fix file_set_fowner LSM hook inconsistencies
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <[email protected]>
commit 26f204380a3c182e5adf1a798db0724d6111b597 upstream.
The fcntl's F_SETOWN command sets the process that handle SIGIO/SIGURG for the related file descriptor. Before this change, the file_set_fowner LSM hook was always called, ignoring the VFS logic which may not actually change the process that handles SIGIO (e.g. TUN, TTY, dnotify), nor update the related UID/EUID.
Moreover, because security_file_set_fowner() was called without lock (e.g. f_owner.lock), concurrent F_SETOWN commands could result to a race condition and inconsistent LSM states (e.g. SELinux's fown_sid) compared to struct fown_struct's UID/EUID.
This change makes sure the LSM states are always in sync with the VFS state by moving the security_file_set_fowner() call close to the UID/EUID updates and using the same f_owner.lock .
Rename f_modown() to __f_setown() to simplify code.
--- fs/fcntl.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
fs/fcntl.c +4 -10
@@ -84,8 +84,8 @@ static int setfl(int fd, struct file * freturn error; } -static void f_modown (struct file *filp,struct pid *pid,enum pid_type type, -int force) +void __f_setown (struct file *filp,struct pid *pid,enum pid_type type, +int force) {write_lock_irq (&filp->f_owner.lock);if (force || !filp->f_owner.pid) {
@@ -95,19 +95,13 @@ static void f_modown(struct file *filp,if (pid) {const struct cred *cred =current_cred (); +security_file_set_fowner (filp); filp->f_owner.uid = cred->uid; filp->f_owner.euid = cred->euid; } }write_unlock_irq (&filp->f_owner.lock); } - -void __f_setown (struct file *filp,struct pid *pid,enum pid_type type, -int force) -{ -security_file_set_fowner (filp); -f_modown (filp, pid, type, force); -}EXPORT_SYMBOL (__f_setown);int f_setown (struct file *filp,unsigned long arg,int force)
@@ -143,7 +137,7 @@ EXPORT_SYMBOL(f_setown);void f_delown (struct file *filp) { -f_modown (filp,NULL ,PIDTYPE_TGID ,1 ); +__f_setown (filp,NULL ,PIDTYPE_TGID ,1 ); }pid_t f_getown (struct file *filp)
Greg Kroah-Hartman
maintainerPATCH 247/518 nfs: fix memory leak in error path of nfs4_do_reclaim
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
commit 8f6a7c9467eaf39da4c14e5474e46190ab3fb529 upstream.
Commit c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") separate out the freeing of the state owners from nfs4_purge_state_owners() and finish it outside the rcu lock. However, the error path is omitted. As a result, the state owners in "freeme" will not be released.
Fix it by adding freeing in the error path.
--- fs/nfs/nfs4state.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/nfs4state.c +1 -0
@@ -1948,6 +1948,7 @@ restart:set_bit (ops->owner_flag_bit, &sp->so_flags);nfs4_put_state_owner (sp); status =nfs4_recovery_handle_error (clp, status); +nfs4_free_state_owners (&freeme);return (status !=0 ) ? status : -EAGAIN ; }
Greg Kroah-Hartman
maintainerPATCH 248/518 padata: use integer wrap around to prevent deadlock on seq_nr overflow
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: VanGiang Nguyen <[email protected]>
commit 9a22b2812393d93d84358a760c347c21939029a6 upstream.
When submitting more than 2^32 padata objects to padata_do_serial, the current sorting implementation incorrectly sorts padata objects with overflowed seq_nr, causing them to be placed before existing objects in the reorder list. This leads to a deadlock in the serialization process as padata_find_next cannot match padata->seq_nr and pd->processed because the padata instance with overflowed seq_nr will be selected next.
To fix this, we use an unsigned integer wrap around to correctly sort padata objects in scenarios with integer overflow.
--- kernel/padata.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/padata.c +2 -1
@@ -409,7 +409,8 @@ void padata_do_serial(struct padata_priv/* Sort in ascending order of sequence number. */ list_for_each_prev (pos, &reorder->list) { cur = list_entry(pos, struct padata_priv, list); -if (cur->seq_nr < padata->seq_nr) +/* Compare by difference to consider integer wrap around */ +if ((signed int )(cur->seq_nr - padata->seq_nr) <0 )break ; }list_add (&padata->list, pos);
Greg Kroah-Hartman
maintainerPATCH 249/518 PCI: xilinx-nwl: Use irq_data_get_irq_chip_data()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit e56427068a8d796bb7b8e297f2b6e947380e383f ]
Going through a full irq descriptor lookup instead of just using the proper helper function which provides direct access is suboptimal.
In fact it _is_ wrong because the chip callback needs to get the chip data which is relevant for the chip while using the irq descriptor variant returns the irq chip data of the top level chip of a hierarchy. It does not matter in this case because the chip is the top level chip, but that doesn't make it more correct.
Stable-dep-of: 0199d2f2bd8c ("PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler")
--- drivers/pci/controller/pcie-xilinx-nwl.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/pci/controller/pcie-xilinx-nwl.c +2 -6
@@ -381,13 +381,11 @@ static void nwl_pcie_msi_handler_low(struct irq_desc *desc)static void nwl_mask_leg_irq (struct irq_data *data) { -struct irq_desc *desc =irq_to_desc (data->irq); -struct nwl_pcie *pcie; +struct nwl_pcie *pcie =irq_data_get_irq_chip_data (data);unsigned long flags;u32 mask;u32 val; - pcie =irq_desc_get_chip_data (desc); mask =1 << (data->hwirq -1 );raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );
@@ -397,13 +395,11 @@ static void nwl_mask_leg_irq(struct irq_data *data)static void nwl_unmask_leg_irq (struct irq_data *data) { -struct irq_desc *desc =irq_to_desc (data->irq); -struct nwl_pcie *pcie; +struct nwl_pcie *pcie =irq_data_get_irq_chip_data (data);unsigned long flags;u32 mask;u32 val; - pcie =irq_desc_get_chip_data (desc); mask =1 << (data->hwirq -1 );raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 250/518 PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 0199d2f2bd8cd97b310f7ed82a067247d7456029 ]
MSGF_LEG_MASK is laid out with INTA in bit 0, INTB in bit 1, INTC in bit 2, and INTD in bit 3. Hardware IRQ numbers start at 0, and we register PCI_NUM_INTX IRQs. So to enable INTA (aka hwirq 0) we should set bit 0. Remove the subtraction of one.
This bug would cause INTx interrupts not to be delivered, as enabling INTB would actually enable INTA, and enabling INTA wouldn't enable anything at all. It is likely that this got overlooked for so long since most PCIe hardware uses MSIs. This fixes the following UBSAN error:
UBSAN: shift-out-of-bounds in ../drivers/pci/controller/pcie-xilinx-nwl.c:389:11 shift exponent 18446744073709551615 is too large for 32-bit type 'int' CPU: 1 PID: 61 Comm: kworker/u10:1 Not tainted 6.6.20+ #268 Hardware name: xlnx,zynqmp (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:235) show_stack (arch/arm64/kernel/stacktrace.c:242) dump_stack_lvl (lib/dump_stack.c:107) dump_stack (lib/dump_stack.c:114) __ubsan_handle_shift_out_of_bounds (lib/ubsan.c:218 lib/ubsan.c:387) nwl_unmask_leg_irq (drivers/pci/controller/pcie-xilinx-nwl.c:389 (discriminator 1)) irq_enable (kernel/irq/internals.h:234 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345) __irq_startup (kernel/irq/internals.h:239 kernel/irq/chip.c:180 kernel/irq/chip.c:250) irq_startup (kernel/irq/chip.c:270) __setup_irq (kernel/irq/manage.c:1800) request_threaded_irq (kernel/irq/manage.c:2206) pcie_pme_probe (include/linux/interrupt.h:168 drivers/pci/pcie/pme.c:348)
--- drivers/pci/controller/pcie-xilinx-nwl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-xilinx-nwl.c +2 -2
@@ -386,7 +386,7 @@ static void nwl_mask_leg_irq(struct irq_data *data)u32 mask;u32 val; - mask =1 << (data->hwirq -1 ); + mask =1 << data->hwirq;raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );nwl_bridge_writel (pcie, (val & (~mask)),MSGF_LEG_MASK );
@@ -400,7 +400,7 @@ static void nwl_unmask_leg_irq(struct irq_data *data)u32 mask;u32 val; - mask =1 << (data->hwirq -1 ); + mask =1 << data->hwirq;raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );nwl_bridge_writel (pcie, (val | mask),MSGF_LEG_MASK );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 251/518 soc: versatile: realview: fix memory leak during device remove
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 1c4f26a41f9d052f334f6ae629e01f598ed93508 ]
If device is unbound, the memory allocated for soc_dev_attr should be freed to prevent leaks.
Stable-dep-of: c774f2564c00 ("soc: versatile: realview: fix soc_dev leak during device remove")
--- drivers/soc/versatile/soc-realview.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/soc/versatile/soc-realview.c +3 -4
@@ -93,7 +93,7 @@ static int realview_soc_probe(struct platform_device *pdev)if (IS_ERR (syscon_regmap))return PTR_ERR (syscon_regmap); - soc_dev_attr =kzalloc (sizeof (*soc_dev_attr),GFP_KERNEL ); + soc_dev_attr =devm_kzalloc (&pdev->dev,sizeof (*soc_dev_attr),GFP_KERNEL );if (!soc_dev_attr)return -ENOMEM ;
@@ -106,10 +106,9 @@ static int realview_soc_probe(struct platform_device *pdev) soc_dev_attr->family ="Versatile" ; soc_dev_attr->custom_attr_group = realview_groups[0 ]; soc_dev =soc_device_register (soc_dev_attr); -if (IS_ERR (soc_dev)) { -kfree (soc_dev_attr); +if (IS_ERR (soc_dev))return -ENODEV ; - } + ret =regmap_read (syscon_regmap,REALVIEW_SYS_ID_OFFSET , &realview_coreid);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 252/518 soc: versatile: realview: fix soc_dev leak during device remove
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit c774f2564c0086c23f5269fd4691f233756bf075 ]
If device is unbound, the soc_dev should be unregistered to prevent memory leak.
--- drivers/soc/versatile/soc-realview.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/soc/versatile/soc-realview.c +13 -0
@@ -4,6 +4,7 @@* * Author: Linus Walleij <[email protected]> */ +#include <linux/device.h> #include <linux/init.h> #include <linux/io.h> #include <linux/slab.h>
@@ -81,6 +82,13 @@ static struct attribute *realview_attrs[] = {ATTRIBUTE_GROUPS (realview); +static void realview_soc_socdev_release (void *data) +{ +struct soc_device *soc_dev = data; + +soc_device_unregister (soc_dev); +} +static int realview_soc_probe (struct platform_device *pdev) {struct regmap *syscon_regmap;
@@ -109,6 +117,11 @@ static int realview_soc_probe(struct platform_device *pdev)if (IS_ERR (soc_dev))return -ENODEV ; + ret =devm_add_action_or_reset (&pdev->dev, realview_soc_socdev_release, + soc_dev); +if (ret) +return ret; + ret =regmap_read (syscon_regmap,REALVIEW_SYS_ID_OFFSET , &realview_coreid);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 253/518 usb: yurex: Replace snprintf() with the safer scnprintf() variant
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit 86b20af11e84c26ae3fde4dcc4f490948e3f8035 ]
There is a general misunderstanding amongst engineers that {v}snprintf() returns the length of the data *actually* encoded into the destination array. However, as per the C99 standard {v}snprintf() really returns the length of the data that *would have been* written if there were enough space for it. This misunderstanding has led to buffer-overruns in the past. It's generally considered safer to use the {v}scnprintf() variants in their place (or even sprintf() in simple cases). So let's do that.
Whilst we're at it, let's define some magic numbers to increase readability and ease of maintenance.
Stable-dep-of: 93907620b308 ("USB: misc: yurex: fix race between read and write")
--- drivers/usb/misc/yurex.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/usb/misc/yurex.c +7 -5
@@ -34,6 +34,8 @@#define YUREX_BUF_SIZE 8#define YUREX_WRITE_TIMEOUT (HZ*2) +#define MAX_S64_STRLEN 20/* {-}922337203685477580{7,8} */ +/* table of devices that work with this driver */ static struct usb_device_id yurex_table[] = { {USB_DEVICE (YUREX_VENDOR_ID ,YUREX_PRODUCT_ID ) },
@@ -400,7 +402,7 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, {struct usb_yurex *dev;int len =0 ; -char in_buffer[20 ]; +char in_buffer[MAX_S64_STRLEN ];unsigned long flags; dev = file->private_data;
@@ -411,14 +413,14 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,return -ENODEV ; } +if (WARN_ON_ONCE (dev->bbu >S64_MAX || dev->bbu <S64_MIN )) +return -EIO ; +spin_lock_irqsave (&dev->lock, flags); - len =snprintf (in_buffer,20 ,"%lld\n" , dev->bbu); +scnprintf (in_buffer,MAX_S64_STRLEN ,"%lld\n" , dev->bbu);spin_unlock_irqrestore (&dev->lock, flags);mutex_unlock (&dev->io_mutex); -if (WARN_ON_ONCE (len >=sizeof (in_buffer))) -return -EIO ; -return simple_read_from_buffer (buffer, count, ppos, in_buffer, len); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 254/518 USB: misc: yurex: fix race between read and write
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 93907620b308609c72ba4b95b09a6aa2658bb553 ]
The write code path touches the bbu member in a non atomic manner without taking the spinlock. Fix it.
The bug is as old as the driver.
--- drivers/usb/misc/yurex.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/usb/misc/yurex.c +6 -4
@@ -403,7 +403,6 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,struct usb_yurex *dev;int len =0 ;char in_buffer[MAX_S64_STRLEN ]; -unsigned long flags; dev = file->private_data;
@@ -416,9 +415,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,if (WARN_ON_ONCE (dev->bbu >S64_MAX || dev->bbu <S64_MIN ))return -EIO ; -spin_lock_irqsave (&dev->lock, flags); +spin_lock_irq (&dev->lock);scnprintf (in_buffer,MAX_S64_STRLEN ,"%lld\n" , dev->bbu); -spin_unlock_irqrestore (&dev->lock, flags); +spin_unlock_irq (&dev->lock);mutex_unlock (&dev->io_mutex);return simple_read_from_buffer (buffer, count, ppos, in_buffer, len);
@@ -508,8 +507,11 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, __func__, retval); goto error; } -if (set && timeout) +if (set && timeout) { +spin_lock_irq (&dev->lock); dev->bbu = c2; +spin_unlock_irq (&dev->lock); + }return timeout ? count : -EIO ; error:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 255/518 pps: remove usage of the deprecated ida_simple_xx() API
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 55dbc5b5174d0e7d1fa397d05aa4cb145e8b887e ]
ida_alloc() and ida_free() should be preferred to the deprecated ida_simple_get() and ida_simple_remove().
This is less verbose.
Stable-dep-of: 62c5a01a5711 ("pps: add an error check in parport_attach")
--- drivers/pps/clients/pps_parport.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pps/clients/pps_parport.c +3 -3
@@ -144,7 +144,7 @@ static void parport_attach(struct parport *port)return ; } - index =ida_simple_get (&pps_client_index,0 ,0 ,GFP_KERNEL ); + index =ida_alloc (&pps_client_index,GFP_KERNEL );memset (&pps_client_cb,0 ,sizeof (pps_client_cb)); pps_client_cb.private = device; pps_client_cb.irq_func = parport_irq;
@@ -184,7 +184,7 @@ static void parport_attach(struct parport *port) err_unregister_dev:parport_unregister_device (device->pardev); err_free: -ida_simple_remove (&pps_client_index, index); +ida_free (&pps_client_index, index);kfree (device); }
@@ -204,7 +204,7 @@ static void parport_detach(struct parport *port)pps_unregister_source (device->pps);parport_release (pardev);parport_unregister_device (pardev); -ida_simple_remove (&pps_client_index, device->index); +ida_free (&pps_client_index, device->index);kfree (device); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 256/518 pps: add an error check in parport_attach
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 62c5a01a5711c8e4be8ae7b6f0db663094615d48 ]
In parport_attach, the return value of ida_alloc is unchecked, witch leads to the use of an invalid index value.
To address this issue, index should be checked. When the index value is abnormal, the device should be freed.
Found by code review, compile tested only.
--- drivers/pps/clients/pps_parport.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/pps/clients/pps_parport.c +6 -2
@@ -145,6 +145,9 @@ static void parport_attach(struct parport *port) } index =ida_alloc (&pps_client_index,GFP_KERNEL ); +if (index <0 ) + goto err_free_device; +memset (&pps_client_cb,0 ,sizeof (pps_client_cb)); pps_client_cb.private = device; pps_client_cb.irq_func = parport_irq;
@@ -155,7 +158,7 @@ static void parport_attach(struct parport *port) index);if (!device->pardev) {pr_err ("couldn't register with %s\n" , port->name); - goto err_free; + goto err_free_ida; }if (parport_claim_or_block (device->pardev) <0 ) {
@@ -183,8 +186,9 @@ static void parport_attach(struct parport *port)parport_release (device->pardev); err_unregister_dev:parport_unregister_device (device->pardev); -err_free: +err_free_ida:ida_free (&pps_client_index, index); +err_free_device:kfree (device); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 257/518 usb: renesas-xhci: Remove renesas_xhci_pci_exit()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moritz Fischer <[email protected]>
[ Upstream commit 884c274408296e7e0f56545f909b3d3a671104aa ]
Remove empty function renesas_xhci_pci_exit() that does not actually do anything.
Stable-dep-of: f81dfa3b57c6 ("xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.")
--- drivers/usb/host/xhci-pci-renesas.c | 5 ----- drivers/usb/host/xhci-pci.c | 2 -- drivers/usb/host/xhci-pci.h | 3 --- 3 files changed, 10 deletions(-)
drivers/usb/host/xhci-pci-renesas.c +0 -5
@@ -631,9 +631,4 @@ int renesas_xhci_check_request_fw(struct pci_dev *pdev, }EXPORT_SYMBOL_GPL (renesas_xhci_check_request_fw); -void renesas_xhci_pci_exit (struct pci_dev *dev) -{ -} -EXPORT_SYMBOL_GPL (renesas_xhci_pci_exit); -MODULE_LICENSE ("GPL v2" );
drivers/usb/host/xhci-pci.c +0 -2
@@ -533,8 +533,6 @@ static void xhci_pci_remove(struct pci_dev *dev)struct xhci_hcd *xhci; xhci =hcd_to_xhci (pci_get_drvdata (dev)); -if (xhci->quirks &XHCI_RENESAS_FW_QUIRK ) -renesas_xhci_pci_exit (dev); xhci->xhc_state |=XHCI_STATE_REMOVING ;
drivers/usb/host/xhci-pci.h +0 -3
@@ -7,7 +7,6 @@#if IS_ENABLED (CONFIG_USB_XHCI_PCI_RENESAS )int renesas_xhci_check_request_fw (struct pci_dev *dev,const struct pci_device_id *id); -void renesas_xhci_pci_exit (struct pci_dev *dev);#else static int renesas_xhci_check_request_fw(struct pci_dev *dev,
@@ -16,8 +15,6 @@ static int renesas_xhci_check_request_fw(struct pci_dev *dev,return 0 ; } -static void renesas_xhci_pci_exit (struct pci_dev *dev) { }; -#endif struct xhci_driver_data {
Signature · 1 line
2.43.0
Re: [PATCH 5.10 257/518] usb: renesas-xhci: Remove renesas_xhci_pci_exit()
Quoted 10 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moritz Fischer <[email protected]>
[ Upstream commit
884c274408296e7e0f56545f909b3d3a671104aa]Remove empty function
renesas_xhci_pci_exit()that does not actually do anything.
Does this really belong to stable? Removing an empty function should not be ported to stable kernels right...?
Quoted 67 lines
Cc Mathias Nyman <[email protected]>Cc Greg Kroah-Hartman <[email protected]>Cc Vinod Koul <[email protected]>Signed-off-by Moritz Fischer <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Stable-dep-of:
f81dfa3b57c6("xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.")Signed-off-by Sasha Levin <[email protected]>--- drivers/usb/host/xhci-pci-renesas.c | 5 ----- drivers/usb/host/xhci-pci.c | 2 -- drivers/usb/host/xhci-pci.h | 3 --- 3 files changed, 10 deletions(-)drivers/usb/host/xhci-pci-renesas.c +0
-5@@ -631,9 +631,4 @@ int renesas_xhci_check_request_fw(struct pci_dev *pdev, }EXPORT_SYMBOL_GPL (renesas_xhci_check_request_fw); -void renesas_xhci_pci_exit (struct pci_dev *dev) -{ -} -EXPORT_SYMBOL_GPL (renesas_xhci_pci_exit); -MODULE_LICENSE ("GPL v2" );drivers/usb/host/xhci-pci.c +0
-2@@ -533,8 +533,6 @@ static void xhci_pci_remove(struct pci_dev *dev)struct xhci_hcd *xhci; xhci =hcd_to_xhci (pci_get_drvdata (dev)); -if (xhci->quirks &XHCI_RENESAS_FW_QUIRK ) -renesas_xhci_pci_exit (dev); xhci->xhc_state |=XHCI_STATE_REMOVING ;drivers/usb/host/xhci-pci.h +0
-3@@ -7,7 +7,6 @@#if IS_ENABLED (CONFIG_USB_XHCI_PCI_RENESAS )int renesas_xhci_check_request_fw (struct pci_dev *dev,const struct pci_device_id *id); -void renesas_xhci_pci_exit (struct pci_dev *dev);#else static int renesas_xhci_check_request_fw(struct pci_dev *dev,@@ -16,8 +15,6 @@ static int renesas_xhci_check_request_fw(struct pci_dev *dev,return 0 ; } -static void renesas_xhci_pci_exit (struct pci_dev *dev) { }; -#endif struct xhci_driver_data {Signature · 1 line
2.43.0
Signature · 1 line
~Vinod
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 257/518] usb: renesas-xhci: Remove renesas_xhci_pci_exit()
Quoted 7 lines · Vinod Koul
Quoted 6 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moritz Fischer <[email protected]>
Quoted 7 lines
Quoted 4 lines
[ Upstream commit
884c274408296e7e0f56545f909b3d3a671104aa]Remove empty function
renesas_xhci_pci_exit()that does not actually do anything.Does this really belong to stable? Removing an empty function should not be ported to stable kernels right...?
It was a dependency of:
Quoted 7 lines
Quoted 7 lines
Cc Mathias Nyman <[email protected]>Cc Greg Kroah-Hartman <[email protected]>Cc Vinod Koul <[email protected]>Signed-off-by Moritz Fischer <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Stable-dep-of:
f81dfa3b57c6("xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.")
This commit.
And as it did nothing, it's safe to remove :)
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 258/518 xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit f81dfa3b57c624c56f2bff171c431bc7f5b558f2 ]
PCI xHC host should be stopped and xhci driver memory freed before putting host to PCI D3 state during PCI remove callback.
Hosts with XHCI_SPURIOUS_WAKEUP quirk did this the wrong way around and set the host to D3 before calling usb_hcd_pci_remove(dev), which will access the host to stop it, and then free xhci.
--- drivers/usb/host/xhci-pci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-pci.c +5 -3
@@ -531,8 +531,10 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)static void xhci_pci_remove (struct pci_dev *dev) {struct xhci_hcd *xhci; +bool set_power_d3; xhci =hcd_to_xhci (pci_get_drvdata (dev)); + set_power_d3 = xhci->quirks &XHCI_SPURIOUS_WAKEUP ; xhci->xhc_state |=XHCI_STATE_REMOVING ;
@@ -545,11 +547,11 @@ static void xhci_pci_remove(struct pci_dev *dev) xhci->shared_hcd =NULL ; } +usb_hcd_pci_remove (dev); +/* Workaround for spurious wakeups at shutdown with HSW */ -if (xhci->quirks &XHCI_SPURIOUS_WAKEUP ) +if (set_power_d3)pci_set_power_state (dev, PCI_D3hot); - -usb_hcd_pci_remove (dev); }#ifdef CONFIG_PM
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 259/518 io_uring/sqpoll: do not allow pinning outside of cpuset
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Moessbauer <[email protected]>
The submit queue polling threads are userland threads that just never exit to the userland. When creating the thread with IORING_SETUP_SQ_AFF, the affinity of the poller thread is set to the cpu specified in sq_thread_cpu. However, this CPU can be outside of the cpuset defined by the cgroup cpuset controller. This violates the rules defined by the cpuset controller and is a potential issue for realtime applications.
In b7ed6d8ffd6 we fixed the default affinity of the poller thread, in case no explicit pinning is required by inheriting the one of the creating task. In case of explicit pinning, the check is more complicated, as also a cpu outside of the parent cpumask is allowed. We implemented this by using cpuset_cpus_allowed (that has support for cgroup cpusets) and testing if the requested cpu is in the set.
--- io_uring/io_uring.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
io_uring/io_uring.c +4 -1
@@ -56,6 +56,7 @@#include <linux/mm.h> #include <linux/mman.h> #include <linux/percpu.h> +#include <linux/cpuset.h> #include <linux/slab.h> #include <linux/blkdev.h> #include <linux/bvec.h>
@@ -8571,10 +8572,12 @@ static int io_sq_offload_create(struct ireturn 0 ;if (p->flags &IORING_SETUP_SQ_AFF ) { +struct cpumask allowed_mask;int cpu = p->sq_thread_cpu; ret = -EINVAL ; -if (cpu >= nr_cpu_ids || !cpu_online (cpu)) +cpuset_cpus_allowed (current, &allowed_mask); +if (!cpumask_test_cpu (cpu, &allowed_mask)) goto err_sqpoll; sqd->sq_cpu = cpu; }else {
Re: [PATCH 5.10 259/518] io_uring/sqpoll: do not allow pinning outside of cpuset
Quoted 2 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
This patch is buggy and must not be cherry-picked without also having:
a09c17240bd ("io_uring/sqpoll: retain test for whether the CPU is valid")7f44beadcc1 ("io_uring/sqpoll: do not put cpumask on stack")
Best regards,
Felix Moessbauer
Quoted 60 lines
------------------
From: Felix Moessbauer <[email protected]>
The submit queue polling threads are userland threads that just never exit to the userland. When creating the thread with
IORING_SETUP_SQ_AFF,
the affinity of the poller thread is set to the cpu specified insq_thread_cpu. However, this CPU can be outside of the cpuset defined by the cgroup cpuset controller. This violates the rules defined by the
cpuset controller and is a potential issue for realtime applications.In
b7ed6d8ffd6we fixed the default affinity of the poller thread, in case no explicit pinning is required by inheriting the one of the creating task. In case of explicit pinning, the check is more complicated, as also a cpu outside of the parent cpumask is allowed. We implemented this by usingcpuset_cpus_allowed(that has support for
cgroup cpusets) and testing if the requested cpu is in the set.Fixes 37d1e2e3642e ("io_uring: move SQPOLL thread io-wq forkedworker")
Cc [email protected] # 6.1+Signed-off-by Felix Moessbauer <[email protected]>Link:
https://lore.kernel.org/r/[email protected]Signed-off-by Jens Axboe <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>---
io_uring/io_uring.c | 5 ++++-1 file changed, 4 insertions(+), 1 deletion(-)io_uring/io_uring.c +1
-0@@ -56,6 +56,7 @@ #include <linux/mm.h> #include <linux/mman.h> #include <linux/percpu.h> +#include <linux/cpuset.h> #include <linux/slab.h> #include <linux/blkdev.h> #include <linux/bvec.h>@@ -8571,10 +8572,12 @@ static int io_sq_offload_create(struct i return 0;
if (p->flags&IORING_SETUP_SQ_AFF) {
+ struct cpumaskallowed_mask;
int cpu =p->sq_thread_cpu;
ret =-EINVAL;
- if (cpu >=nr_cpu_ids|| !cpu_online(cpu)) + cpuset_cpus_allowed(current,&allowed_mask); + if (!cpumask_test_cpu(cpu,&allowed_mask)) gotoerr_sqpoll;sqd->sq_cpu= cpu;
} else {
Signature · 2 lines
Siemens AG, Technology Linux Expert Center
[email protected]
maintainerRe: [PATCH 5.10 259/518] io_uring/sqpoll: do not allow pinning outside of cpuset
Quoted 9 lines · Felix
Quoted 2 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
This patch is buggy and must not be cherry-picked without also having:
a09c17240bd("io_uring/sqpoll: retain test for whether the CPU is valid")7f44beadcc1("io_uring/sqpoll: do not put cpumask on stack")
Ok, I'll drop this from 5.15 and 5.10 queues, can someone please send me a series of patches for both of those kernels with all of the needed io_uring patches in it?
thanks,
greg k-h
Re: [PATCH 5.10 259/518] io_uring/sqpoll: do not allow pinning outside of cpuset
Quoted 9 lines · On Thu, 2024-10-17 at 10:46 +0200, [email protected] wrote:
Quoted 8 lines · Felix
Quoted 3 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let
me know.This patch is buggy and must not be cherry-picked without also having:
Quoted 8 lines
Quoted 3 lines
a09c17240bd("io_uring/sqpoll: retain test for whether the CPU is valid")7f44beadcc1("io_uring/sqpoll: do not put cpumask on stack")Ok, I'll drop this from 5.15 and 5.10 queues, can someone please send me
a series of patches for both of those kernels with all of the neededio_uringpatches in it?
I'll send it by end of today.
Felix
Quoted 4 lines
thanks,
greg k-h
Signature · 2 lines
Siemens AG, Technology Linux Expert Center
Greg Kroah-Hartman
maintainerPATCH 260/518 lockdep: fix deadlock issue between lockdep and rcu
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiguo Niu <[email protected]>
commit a6f88ac32c6e63e69c595bfae220d8641704c9b7 upstream.
There is a deadlock scenario between lockdep and rcu when rcu nocb feature is enabled, just as following call stack:
rcuop/x
-000|queued_spin_lock_slowpath(lock = 0xFFFFFF817F2A8A80, val = ?) -001|queued_spin_lock(inline) // try to hold nocb_gp_lock -001|do_raw_spin_lock(lock = 0xFFFFFF817F2A8A80) -002|__raw_spin_lock_irqsave(inline) -002|_raw_spin_lock_irqsave(lock = 0xFFFFFF817F2A8A80) -003|wake_nocb_gp_defer(inline) -003|__call_rcu_nocb_wake(rdp = 0xFFFFFF817F30B680) -004|__call_rcu_common(inline) -004|call_rcu(head = 0xFFFFFFC082EECC28, func = ?) -005|call_rcu_zapped(inline) -005|free_zapped_rcu(ch = ?)// hold graph lock -006|rcu_do_batch(rdp = 0xFFFFFF817F245680) -007|nocb_cb_wait(inline) -007|rcu_nocb_cb_kthread(arg = 0xFFFFFF817F245680) -008|kthread(_create = 0xFFFFFF80803122C0) -009|ret_from_fork(asm)
rcuop/y
-000|queued_spin_lock_slowpath(lock = 0xFFFFFFC08291BBC8, val = 0) -001|queued_spin_lock() -001|lockdep_lock() -001|graph_lock() // try to hold graph lock -002|lookup_chain_cache_add() -002|validate_chain() -003|lock_acquire -004|_raw_spin_lock_irqsave(lock = 0xFFFFFF817F211D80) -005|lock_timer_base(inline) -006|mod_timer(inline) -006|wake_nocb_gp_defer(inline)// hold nocb_gp_lock -006|__call_rcu_nocb_wake(rdp = 0xFFFFFF817F2A8680) -007|__call_rcu_common(inline) -007|call_rcu(head = 0xFFFFFFC0822E0B58, func = ?) -008|call_rcu_hurry(inline) -008|rcu_sync_call(inline) -008|rcu_sync_func(rhp = 0xFFFFFFC0822E0B58) -009|rcu_do_batch(rdp = 0xFFFFFF817F266680) -010|nocb_cb_wait(inline) -010|rcu_nocb_cb_kthread(arg = 0xFFFFFF817F266680) -011|kthread(_create = 0xFFFFFF8080363740) -012|ret_from_fork(asm)
rcuop/x and rcuop/y are rcu nocb threads with the same nocb gp thread. This patch release the graph lock before lockdep call_rcu.
--- kernel/locking/lockdep.c | 48 +++++++++++++++++++++++++++++++---------------- 1 file changed, 32 insertions(+), 16 deletions(-)
kernel/locking/lockdep.c +32 -16
@@ -5967,25 +5967,27 @@ static struct pending_free *get_pending_static void free_zapped_rcu (struct rcu_head *cb);/* -* Schedule an RCU callback if no RCU callback is pending. Must be called with -* the graph lock held. -*/ -static void call_rcu_zapped (struct pending_free *pf) +* See if we need to queue an RCU callback, must called with +* the lockdep lock held, returns false if either we don't have +* any pending free or the callback is already scheduled. +* Otherwise, a call_rcu() must follow this function call. +*/ +static bool prepare_call_rcu_zapped (struct pending_free *pf) {WARN_ON_ONCE (inside_selftest ());if (list_empty (&pf->zapped)) -return ; +return false;if (delayed_free.scheduled) -return ; +return false; delayed_free.scheduled = true;WARN_ON_ONCE (delayed_free.pf + delayed_free.index != pf); delayed_free.index ^=1 ; -call_rcu (&delayed_free.rcu_head, free_zapped_rcu); +return true; }/* The caller must hold the graph lock. May be called from RCU context. */
@@ -6011,6 +6013,7 @@ static void free_zapped_rcu(struct rcu_h {struct pending_free *pf;unsigned long flags; +bool need_callback;if (WARN_ON_ONCE (ch != &delayed_free.rcu_head))return ;
@@ -6022,14 +6025,18 @@ static void free_zapped_rcu(struct rcu_h pf = delayed_free.pf + (delayed_free.index ^1 );__free_zapped_classes (pf); delayed_free.scheduled = false; + need_callback = +prepare_call_rcu_zapped (delayed_free.pf + delayed_free.index); +lockdep_unlock (); +raw_local_irq_restore (flags);/* -* If there's anything on the open list, close and start a new callback. -*/ -call_rcu_zapped (delayed_free.pf + delayed_free.index); +* If there's pending free and its callback has not been scheduled, +* queue an RCU callback. +*/ +if (need_callback) +call_rcu (&delayed_free.rcu_head, free_zapped_rcu); -lockdep_unlock (); -raw_local_irq_restore (flags); }/*
@@ -6069,6 +6076,7 @@ static void lockdep_free_key_range_reg(v {struct pending_free *pf;unsigned long flags; +bool need_callback;init_data_structures_once ();
@@ -6076,10 +6084,11 @@ static void lockdep_free_key_range_reg(vlockdep_lock (); pf =get_pending_free ();__lockdep_free_key_range (pf, start, size); -call_rcu_zapped (pf); + need_callback =prepare_call_rcu_zapped (pf);lockdep_unlock ();raw_local_irq_restore (flags); - +if (need_callback) +call_rcu (&delayed_free.rcu_head, free_zapped_rcu);/* * Wait for any possible iterators from look_up_lock_class() to pass * before continuing to free the memory they refer to.
@@ -6173,6 +6182,7 @@ static void lockdep_reset_lock_reg(strucstruct pending_free *pf;unsigned long flags;int locked; +bool need_callback = false;raw_local_irq_save (flags); locked =graph_lock ();
@@ -6181,11 +6191,13 @@ static void lockdep_reset_lock_reg(struc pf =get_pending_free ();__lockdep_reset_lock (pf, lock); -call_rcu_zapped (pf); + need_callback =prepare_call_rcu_zapped (pf);graph_unlock (); out_irq:raw_local_irq_restore (flags); +if (need_callback) +call_rcu (&delayed_free.rcu_head, free_zapped_rcu); }/*
@@ -6229,6 +6241,7 @@ void lockdep_unregister_key(struct lock_struct pending_free *pf;unsigned long flags;bool found = false; +bool need_callback = false;might_sleep ();
@@ -6249,11 +6262,14 @@ void lockdep_unregister_key(struct lock_if (found) { pf =get_pending_free ();__lockdep_free_key_range (pf, key,1 ); -call_rcu_zapped (pf); + need_callback =prepare_call_rcu_zapped (pf); }lockdep_unlock ();raw_local_irq_restore (flags); +if (need_callback) +call_rcu (&delayed_free.rcu_head, free_zapped_rcu); +/* Wait until is_dynamic_key() has finished accessing k->hash_entry. */ synchronize_rcu (); }
Greg Kroah-Hartman
maintainerPATCH 261/518 mm: only enforce minimum stack gap size if its sensible
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gow <[email protected]>
commit 69b50d4351ed924f29e3d46b159e28f70dfc707f upstream.
The generic mmap_base code tries to leave a gap between the top of the stack and the mmap base address, but enforces a minimum gap size (MIN_GAP) of 128MB, which is too large on some setups. In particular, on arm tasks without ADDR_LIMIT_32BIT, the STACK_TOP value is less than 128MB, so it's impossible to fit such a gap in.
Only enforce this minimum if MIN_GAP < MAX_GAP, as we'd prefer to honour MAX_GAP, which is defined proportionally, so scales better and always leaves us with both _some_ stack space and some room for mmap.
This fixes the usercopy KUnit test suite on 32-bit arm, as it doesn't set any personality flags so gets the default (in this case 26-bit) task size. This test can be run with: ./tools/testing/kunit/kunit.py run --arch arm usercopy --make_options LLVM=1
--- mm/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/util.c +1 -1
@@ -418,7 +418,7 @@ static unsigned long mmap_base(unsignedif (gap + pad > gap) gap += pad; -if (gap <MIN_GAP ) +if (gap <MIN_GAP &&MIN_GAP <MAX_GAP ) gap =MIN_GAP ;else if (gap >MAX_GAP ) gap =MAX_GAP ;
Greg Kroah-Hartman
maintainerPATCH 262/518 i2c: aspeed: Update the stop sw state when the bus recovery occurs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tommy Huang <[email protected]>
commit 93701d3b84ac5f3ea07259d4ced405c53d757985 upstream.
When the i2c bus recovery occurs, driver will send i2c stop command in the scl low condition. In this case the sw state will still keep original situation. Under multi-master usage, i2c bus recovery will be called when i2c transfer timeout occurs. Update the stop command calling with aspeed_i2c_do_stop function to update master_state.
--- drivers/i2c/busses/i2c-aspeed.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/i2c/busses/i2c-aspeed.c +8 -8
@@ -172,6 +172,13 @@ struct aspeed_i2c_bus {static int aspeed_i2c_reset (struct aspeed_i2c_bus *bus); +/* precondition: bus.lock has been acquired. */ +static void aspeed_i2c_do_stop (struct aspeed_i2c_bus *bus) +{ + bus->master_state =ASPEED_I2C_MASTER_STOP ; +writel (ASPEED_I2CD_M_STOP_CMD , bus->base +ASPEED_I2C_CMD_REG ); +} +static int aspeed_i2c_recover_bus (struct aspeed_i2c_bus *bus) {unsigned long time_left, flags;
@@ -189,7 +196,7 @@ static int aspeed_i2c_recover_bus(struct command);reinit_completion (&bus->cmd_complete); -writel (ASPEED_I2CD_M_STOP_CMD , bus->base +ASPEED_I2C_CMD_REG ); +aspeed_i2c_do_stop (bus);spin_unlock_irqrestore (&bus->lock, flags); time_left = wait_for_completion_timeout(
@@ -386,13 +393,6 @@ static void aspeed_i2c_do_start(struct a }/* precondition: bus.lock has been acquired. */ -static void aspeed_i2c_do_stop (struct aspeed_i2c_bus *bus) -{ - bus->master_state =ASPEED_I2C_MASTER_STOP ; -writel (ASPEED_I2CD_M_STOP_CMD , bus->base +ASPEED_I2C_CMD_REG ); -} - -/* precondition: bus.lock has been acquired. */ static void aspeed_i2c_next_msg_or_stop (struct aspeed_i2c_bus *bus) {if (bus->msgs_index +1 < bus->msgs_count) {
Greg Kroah-Hartman
maintainerPATCH 263/518 i2c: isch: Add missed else
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 1db4da55070d6a2754efeb3743f5312fc32f5961 upstream.
In accordance with the existing comment and code analysis it is quite likely that there is a missed 'else' when adapter times out. Add it.
--- drivers/i2c/busses/i2c-isch.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/i2c/busses/i2c-isch.c +1 -2
@@ -99,8 +99,7 @@ static int sch_transaction(void)if (retries >MAX_RETRIES ) {dev_err (&sch_adapter.dev,"SMBus Timeout!\n" ); result = -ETIMEDOUT ; - } -if (temp &0x04 ) { + }else if (temp &0x04 ) { result = -EIO ;dev_dbg (&sch_adapter.dev,"Bus collision! SMBus may be " "locked until next hard reset. (sorry!)\n" );
Greg Kroah-Hartman
maintainerPATCH 264/518 usb: yurex: Fix inconsistent locking bug in yurex_read()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
commit e7d3b9f28654dbfce7e09f8028210489adaf6a33 upstream.
Unlock before returning on the error path.
--- drivers/usb/misc/yurex.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/misc/yurex.c +3 -1
@@ -412,8 +412,10 @@ static ssize_t yurex_read(struct file *freturn -ENODEV ; } -if (WARN_ON_ONCE (dev->bbu >S64_MAX || dev->bbu <S64_MIN )) +if (WARN_ON_ONCE (dev->bbu >S64_MAX || dev->bbu <S64_MIN )) { +mutex_unlock (&dev->io_mutex);return -EIO ; + }spin_lock_irq (&dev->lock);scnprintf (in_buffer,MAX_S64_STRLEN ,"%lld\n" , dev->bbu);
Greg Kroah-Hartman
maintainerPATCH 265/518 spi: lpspi: Simplify some error message
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit 0df874c6712d9aa8f43c50ec887a21f7b86fc917 upstream.
dev_err_probe() already prints the error code in a human readable way, so there is no need to duplicate it as a numerical value at the end of the message.
--- drivers/spi/spi-fsl-lpspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-fsl-lpspi.c +1 -1
@@ -919,7 +919,7 @@ static int fsl_lpspi_probe(struct platfo ret =devm_spi_register_controller (&pdev->dev, controller);if (ret <0 ) { -dev_err_probe (&pdev->dev, ret,"spi_register_controller error: %i\n" , ret); +dev_err_probe (&pdev->dev, ret,"spi_register_controller error\n" ); goto free_dma; }
Greg Kroah-Hartman
maintainerPATCH 266/518 mailbox: rockchip: fix a typo in module autoloading
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit e92d87c9c5d769e4cb1dd7c90faa38dddd7e52e3 ]
MODULE_DEVICE_TABLE(of, rockchip_mbox_of_match) could let the module properly autoloaded based on the alias from of_device_id table. It should be 'rockchip_mbox_of_match' instead of 'rockchp_mbox_of_match', just fix it.
--- drivers/mailbox/rockchip-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mailbox/rockchip-mailbox.c +1 -1
@@ -159,7 +159,7 @@ static const struct of_device_id rockchip_mbox_of_match[] = { { .compatible = "rockchip,rk3368-mailbox", .data = &rk3368_drv_data}, { }, }; -MODULE_DEVICE_TABLE (of, rockchp_mbox_of_match); +MODULE_DEVICE_TABLE (of, rockchip_mbox_of_match);static int rockchip_mbox_probe (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 267/518 mailbox: bcm2835: Fix timeout during suspend mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit dc09f007caed3b2f6a3b6bd7e13777557ae22bfd ]
During noirq suspend phase the Raspberry Pi power driver suffer of firmware property timeouts. The reason is that the IRQ of the underlying BCM2835 mailbox is disabled and rpi_firmware_property_list() will always run into a timeout [1].
Since the VideoCore side isn't consider as a wakeup source, set the IRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled during suspend-resume cycle.
[1]
PM: late suspend of devices complete after 1.754 msecs
WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128 rpi_firmware_property_list+0x204/0x22c Firmware transaction 0x00028001 timeout Modules linked in: CPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17 Hardware name: BCM2835 Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0x88/0xec __warn from warn_slowpath_fmt+0x7c/0xb0 warn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c rpi_firmware_property from rpi_firmware_set_power+0x54/0xc0 rpi_firmware_set_power from _genpd_power_off+0xe4/0x148 _genpd_power_off from genpd_sync_power_off+0x7c/0x11c genpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0 genpd_finish_suspend from dpm_run_callback+0x78/0xd0 dpm_run_callback from device_suspend_noirq+0xc0/0x238 device_suspend_noirq from dpm_suspend_noirq+0xb0/0x168 dpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac suspend_devices_and_enter from pm_suspend+0x254/0x2e4 pm_suspend from state_store+0xa8/0xd4 state_store from kernfs_fop_write_iter+0x154/0x1a0 kernfs_fop_write_iter from vfs_write+0x12c/0x184 vfs_write from ksys_write+0x78/0xc0 ksys_write from ret_fast_syscall+0x0/0x54 Exception stack(0xcc93dfa8 to 0xcc93dff0)
[...]
PM: noirq suspend of devices complete after 3095.584 msecs
--- drivers/mailbox/bcm2835-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mailbox/bcm2835-mailbox.c +2 -1
@@ -146,7 +146,8 @@ static int bcm2835_mbox_probe(struct platform_device *pdev)spin_lock_init (&mbox->lock); ret =devm_request_irq (dev,irq_of_parse_and_map (dev->of_node,0 ), - bcm2835_mbox_irq,0 ,dev_name (dev), mbox); + bcm2835_mbox_irq,IRQF_NO_SUSPEND ,dev_name (dev), + mbox);if (ret) {dev_err (dev,"Failed to register a mailbox IRQ handler: %d\n" , ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 268/518 ceph: remove the incorrect Fw reference check when dirtying pages
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <[email protected]>
[ Upstream commit c08dfb1b49492c09cf13838c71897493ea3b424e ]
When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won't hold the Fw caps and there is case will it get the Fw reference.
--- fs/ceph/addr.c | 1 - 1 file changed, 1 deletion(-)
fs/ceph/addr.c +0 -1
@@ -91,7 +91,6 @@ static int ceph_set_page_dirty(struct page *page)/* dirty the head */ spin_lock (&ci->i_ceph_lock); -BUG_ON (ci->i_wr_ref ==0 );// caller should hold Fw reference if (__ceph_have_pending_cap_snap (ci)) {struct ceph_cap_snap *capsnap = list_last_entry(&ci->i_cap_snaps,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 269/518 ieee802154: Fix build error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit addf89774e48c992316449ffab4f29c2309ebefb ]
If REGMAP_SPI is m and IEEE802154_MCR20A is y,
mcr20a.c:(.text+0x3ed6c5b): undefined reference to `__devm_regmap_init_spi' ld: mcr20a.c:(.text+0x3ed6cb5): undefined reference to `__devm_regmap_init_spi'
Select REGMAP_SPI for IEEE802154_MCR20A to fix it.
--- drivers/net/ieee802154/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/ieee802154/Kconfig +1 -0
@@ -108,6 +108,7 @@ config IEEE802154_CA8210_DEBUGFS config IEEE802154_MCR20A tristate "MCR20A transceiver driver" + select REGMAP_SPI depends on IEEE802154_DRIVERS && MAC802154 depends on SPI help
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 270/518 net/mlx5: Fix error path in multi-packet WQE transmit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 2bcae12c795f32ddfbf8c80d1b5f1d3286341c32 ]
Remove the erroneous unmap in case no DMA mapping was established
The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can't allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq's FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state.
The erroneous behavior was seen in a stress-test environment that created memory pressure.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +0 -1
@@ -601,7 +601,6 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb,return ; err_unmap: -mlx5e_dma_unmap_wqe_err (sq,1 ); sq->stats->dropped++;dev_kfree_skb_any (skb); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 271/518 net/mlx5: Added cond_resched() to crdump collection
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamed Khalfella <[email protected]>
[ Upstream commit ec793155894140df7421d25903de2e6bc12c695b ]
Collecting crdump involves reading vsc registers from pci config space of mlx device, which can take long time to complete. This might result in starving other threads waiting to run on the cpu.
Numbers I got from testing ConnectX-5 Ex MCX516A-CDAT in the lab:
- mlx5_vsc_gw_read_block_fast() was called with length = 1310716.
- mlx5_vsc_gw_read_fast() reads 4 bytes at a time. It was not used to read the entire 1310716 bytes. It was called 53813 times because there are jumps in read_addr.
- On average mlx5_vsc_gw_read_fast() took 35284.4ns.
- In total mlx5_vsc_wait_on_flag() called vsc_read() 54707 times. The average time for each call was 17548.3ns. In some instances vsc_read() was called more than one time when the flag was not set. As expected the thread released the cpu after 16 iterations in mlx5_vsc_wait_on_flag().
- Total time to read crdump was 35284.4ns * 53813 ~= 1.898s.
It was seen in the field that crdump can take more than 5 seconds to complete. During that time mlx5_vsc_wait_on_flag() did not release the cpu because it did not complete 16 iterations. It is believed that pci config reads were slow. Adding cond_resched() every 128 register read improves the situation. In the common case the, crdump takes ~1.8989s, the thread yields the cpu every ~4.51ms. If crdump takes ~5s, the thread yields the cpu every ~18.0ms.
--- drivers/net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c +10 -0
@@ -24,6 +24,11 @@ pci_write_config_dword((dev)->pdev, (dev)->vsc_addr + (offset), (val))#define VSC_MAX_RETRIES 2048 +/* Reading VSC registers can take relatively long time. +* Yield the cpu every 128 registers read. +*/ +#define VSC_GW_READ_BLOCK_COUNT 128 +enum {VSC_CTRL_OFFSET =0x4 ,VSC_COUNTER_OFFSET =0x8 ,
@@ -269,6 +274,7 @@ int mlx5_vsc_gw_read_block_fast(struct mlx5_core_dev *dev, u32 *data, {unsigned int next_read_addr =0 ;unsigned int read_addr =0 ; +unsigned int count =0 ;while (read_addr < length) { if (mlx5_vsc_gw_read_fast(dev, read_addr, &next_read_addr,
@@ -276,6 +282,10 @@ int mlx5_vsc_gw_read_block_fast(struct mlx5_core_dev *dev, u32 *data,return read_addr; read_addr = next_read_addr; +if (++count ==VSC_GW_READ_BLOCK_COUNT ) { +cond_resched (); + count =0 ; + } }return length; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 272/518 netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 76f1ed087b562a469f2153076f179854b749c09a ]
Fix the comment which incorrectly defines it as NLA_U32.
--- include/uapi/linux/netfilter/nf_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/netfilter/nf_tables.h +1 -1
@@ -1602,7 +1602,7 @@ enum nft_flowtable_flags {* * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING) * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING) -* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) +* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED) * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64) * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 273/518 net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 09573b1cc76e7ff8f056ab29ea1cdc152ec8c653 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ieee802154/mcr20a.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ieee802154/mcr20a.c +1 -4
@@ -1311,16 +1311,13 @@ mcr20a_probe(struct spi_device *spi) irq_type =IRQF_TRIGGER_FALLING ; ret =devm_request_irq (&spi->dev, spi->irq, mcr20a_irq_isr, - irq_type,dev_name (&spi->dev), lp); + irq_type |IRQF_NO_AUTOEN ,dev_name (&spi->dev), lp);if (ret) {dev_err (&spi->dev,"could not request_irq for mcr20a\n" ); ret = -ENODEV ; goto free_dev; } -/* disable_irq by default and wait for starting hardware */ -disable_irq (spi->irq); - ret =ieee802154_register_hw (hw);if (ret) {dev_crit (&spi->dev,"ieee802154_register_hw failed\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 274/518 netfilter: nf_tables: prevent nf_skb_duplicated corruption
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 92ceba94de6fb4cee2bf40b485979c342f44a492 ]
syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1].
Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well.
[1]
BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49 nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook+0x2c4/0x450 include/linux/netfilter.h:269 NF_HOOK_COND include/linux/netfilter.h:302 [inline] ip_output+0x185/0x230 net/ipv4/ip_output.c:433 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495 udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981 udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 __do_sys_sendmmsg net/socket.c:2766 [inline] __se_sys_sendmmsg net/socket.c:2763 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68 </TASK>
--- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +++++-- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)
net/ipv4/netfilter/nf_dup_ipv4.c +5 -2
@@ -52,8 +52,9 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, {struct iphdr *iph; +local_bh_disable ();if (this_cpu_read (nf_skb_duplicated)) -return ; + goto out;/* * Copy the skb, and route the copy. Will later return %XT_CONTINUE for * the original skb, which should continue on its way as if nothing has
@@ -61,7 +62,7 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,*/ skb =pskb_copy (skb,GFP_ATOMIC );if (skb ==NULL ) -return ; + goto out;#if IS_ENABLED (CONFIG_NF_CONNTRACK )/* Avoid counting cloned packets towards the original connection. */
@@ -90,6 +91,8 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, }else {kfree_skb (skb); } +out: +local_bh_enable (); }EXPORT_SYMBOL_GPL (nf_dup_ipv4);
net/ipv6/netfilter/nf_dup_ipv6.c +5 -2
@@ -47,11 +47,12 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb,void nf_dup_ipv6 (struct net *net,struct sk_buff *skb,unsigned int hooknum,const struct in6_addr *gw,int oif) { +local_bh_disable ();if (this_cpu_read (nf_skb_duplicated)) -return ; + goto out; skb =pskb_copy (skb,GFP_ATOMIC );if (skb ==NULL ) -return ; + goto out;#if IS_ENABLED (CONFIG_NF_CONNTRACK )nf_reset_ct (skb);
@@ -69,6 +70,8 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, }else {kfree_skb (skb); } +out: +local_bh_enable (); }EXPORT_SYMBOL_GPL (nf_dup_ipv6);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 275/518 Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 7b1ab460592ca818e7b52f27cd3ec86af79220d1 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/bluetooth/btmrvl_sdio.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/bluetooth/btmrvl_sdio.c +1 -2
@@ -105,7 +105,7 @@ static int btmrvl_sdio_probe_of(struct device *dev, }else { ret =devm_request_irq (dev, cfg->irq_bt, btmrvl_wake_irq_bt, -0 ,"bt_wake" , card); +IRQF_NO_AUTOEN ,"bt_wake" , card);if (ret) { dev_err(dev, "Failed to request irq_bt %d (%d)\n",
@@ -114,7 +114,6 @@ static int btmrvl_sdio_probe_of(struct device *dev,/* Configure wakeup (enabled by default) */ device_init_wakeup (dev, true); -disable_irq (cfg->irq_bt); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 276/518 net: ethernet: lantiq_etop: fix memory disclosure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 45c0de18ff2dc9af01236380404bbd6a46502c69 ]
When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer.
In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions.
Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.
--- drivers/net/ethernet/lantiq_etop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/lantiq_etop.c +3 -1
@@ -464,7 +464,9 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)unsigned long flags;u32 byte_offset; - len = skb->len <ETH_ZLEN ?ETH_ZLEN : skb->len; +if (skb_put_padto (skb,ETH_ZLEN )) +return NETDEV_TX_OK ; + len = skb->len;if ((desc->ctl & (LTQ_DMA_OWN |LTQ_DMA_C )) || ch->skb[ch->dma.desc]) {netdev_err (dev,"tx ring full\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 277/518 net: avoid potential underflow in qdisc_pkt_len_init() with UFO
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c20029db28399ecc50e556964eaba75c43b1e2f1 ]
After commit 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user") virtio_net_hdr_to_skb() had sanity check to detect malicious attempts from user space to cook a bad GSO packet.
Then commit cf9acc90c80ec ("net: virtio_net_hdr_to_skb: count transport header in UFO") while fixing one issue, allowed user space to cook a GSO packet with the following characteristic :
IPv4 SKB_GSO_UDP, gso_size=3, skb->len = 28.
When this packet arrives in qdisc_pkt_len_init(), we end up with hdr_len = 28 (IPv4 header + UDP header), matching skb->len
Then the following sets gso_segs to 0 :
gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
shinfo->gso_size);
Then later we set qdisc_skb_cb(skb)->pkt_len to back to zero :/
qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len;
This leads to the following crash in fq_codel [1]
qdisc_pkt_len_init() is best effort, we only want an estimation of the bytes sent on the wire, not crashing the kernel.
This patch is fixing this particular issue, a following one adds more sanity checks for another potential bug.
[1]
[ 70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 70.724561] #PF: supervisor read access in kernel mode [ 70.724561] #PF: error_code(0x0000) - not-present page [ 70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0 [ 70.724561] Oops: Oops: 0000 [#1] SMP NOPTI [ 70.724561] CPU: 11 UID: 0 PID: 2163 Comm: b358537762 Not tainted 6.11.0-virtme #991 [ 70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.724561] RIP: 0010:fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [ 70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00 eb 04 39 ca 73 37 4d 8b 39 83 c7 01 <49> 8b 17 49 89 11 41 8b 57 28 45 8b 5f 34 49 c7 07 00 00 00 00 49 All code ======== 0: 24 08 and $0x8,%al 2: 49 c1 e1 06 shl $0x6,%r9 6: 44 89 7c 24 18 mov %r15d,0x18(%rsp) b: 45 31 ed xor %r13d,%r13d e: 45 31 c0 xor %r8d,%r8d 11: 31 ff xor %edi,%edi 13: 89 44 24 14 mov %eax,0x14(%rsp) 17: 4c 03 8b 90 01 00 00 add 0x190(%rbx),%r9 1e: eb 04 jmp 0x24 20: 39 ca cmp %ecx,%edx 22: 73 37 jae 0x5b 24: 4d 8b 39 mov (%r9),%r15 27: 83 c7 01 add $0x1,%edi 2a:* 49 8b 17 mov (%r15),%rdx <-- trapping instruction 2d: 49 89 11 mov %rdx,(%r9) 30: 41 8b 57 28 mov 0x28(%r15),%edx 34: 45 8b 5f 34 mov 0x34(%r15),%r11d 38: 49 c7 07 00 00 00 00 movq $0x0,(%r15)
3f: 49 rex.WB
Code starting with the faulting instruction
===========================================
0: 49 8b 17 mov (%r15),%rdx 3: 49 89 11 mov %rdx,(%r9) 6: 41 8b 57 28 mov 0x28(%r15),%edx a: 45 8b 5f 34 mov 0x34(%r15),%r11d e: 49 c7 07 00 00 00 00 movq $0x0,(%r15) 15: 49 rex.WB [ 70.724561] RSP: 0018:ffff95ae85e6fb90 EFLAGS: 00000202 [ 70.724561] RAX: 0000000002000000 RBX: ffff95ae841de000 RCX: 0000000000000000 [ 70.724561] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 70.724561] RBP: ffff95ae85e6fbf8 R08: 0000000000000000 R09: ffff95b710a30000 [ 70.724561] R10: 0000000000000000 R11: bdf289445ce31881 R12: ffff95ae85e6fc58 [ 70.724561] R13: 0000000000000000 R14: 0000000000000040 R15: 0000000000000000 [ 70.724561] FS: 000000002c5c1380(0000) GS:ffff95bd7fcc0000(0000) knlGS:0000000000000000 [ 70.724561] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 70.724561] CR2: 0000000000000000 CR3: 000000010c568000 CR4: 00000000000006f0 [ 70.724561] Call Trace: [ 70.724561] <TASK> [ 70.724561] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 70.724561] ? page_fault_oops (arch/x86/mm/fault.c:715) [ 70.724561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [ 70.724561] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [ 70.724561] ? fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [ 70.724561] dev_qdisc_enqueue (net/core/dev.c:3784) [ 70.724561] __dev_queue_xmit (net/core/dev.c:3880 (discriminator 2) net/core/dev.c:4390 (discriminator 2)) [ 70.724561] ? irqentry_enter (kernel/entry/common.c:237) [ 70.724561] ? sysvec_apic_timer_interrupt (./arch/x86/include/asm/hardirq.h:74 (discriminator 2) arch/x86/kernel/apic/apic.c:1043 (discriminator 2) arch/x86/kernel/apic/apic.c:1043 (discriminator 2)) [ 70.724561] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:58 (discriminator 4)) [ 70.724561] ? asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:702) [ 70.724561] ? virtio_net_hdr_to_skb.constprop.0 (./include/linux/virtio_net.h:129 (discriminator 1)) [ 70.724561] packet_sendmsg (net/packet/af_packet.c:3145 (discriminator 1) net/packet/af_packet.c:3177 (discriminator 1)) [ 70.724561] ? _raw_spin_lock_bh (./arch/x86/include/asm/atomic.h:107 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) ./include/asm-generic/qspinlock.h:111 (discriminator 4) ./include/linux/spinlock.h:187 (discriminator 4) ./include/linux/spinlock_api_smp.h:127 (discriminator 4) kernel/locking/spinlock.c:178 (discriminator 4)) [ 70.724561] ? netdev_name_node_lookup_rcu (net/core/dev.c:325 (discriminator 1)) [ 70.724561] __sys_sendto (net/socket.c:730 (discriminator 1) net/socket.c:745 (discriminator 1) net/socket.c:2210 (discriminator 1)) [ 70.724561] ? __sys_setsockopt (./include/linux/file.h:34 net/socket.c:2355) [ 70.724561] __x64_sys_sendto (net/socket.c:2222 (discriminator 1) net/socket.c:2218 (discriminator 1) net/socket.c:2218 (discriminator 1)) [ 70.724561] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 70.724561] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 70.724561] RIP: 0033:0x41ae09
--- net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/dev.c +1 -1
@@ -3759,7 +3759,7 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) sizeof(_tcphdr), &_tcphdr);if (likely (th)) hdr_len +=__tcp_hdrlen (th); - }else { + }else if (shinfo->gso_type &SKB_GSO_UDP_L4 ) {struct udphdr _udphdr; if (skb_header_pointer(skb, skb_transport_offset(skb),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 278/518 net: add more sanity checks to qdisc_pkt_len_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ]
One path takes care of SKB_GSO_DODGY, assumingskb->len is bigger than hdr_len.
virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.
It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.
- 20 bytes of IPv4 header
- 60 bytes TCP header
- a small gso_size like 8
virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.
We need to make detect this case to not underflow
qdisc_skb_cb(skb)->pkt_len.
--- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/core/dev.c +7 -3
@@ -3767,10 +3767,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len +=sizeof (struct udphdr ); } -if (shinfo->gso_type &SKB_GSO_DODGY ) - gso_segs =DIV_ROUND_UP (skb->len - hdr_len, - shinfo->gso_size); +if (unlikely (shinfo->gso_type &SKB_GSO_DODGY )) { +int payload = skb->len - hdr_len; +/* Malicious packet. */ +if (payload <=0 ) +return ; + gso_segs =DIV_ROUND_UP (payload, shinfo->gso_size); + }qdisc_skb_cb (skb)->pkt_len += (gso_segs -1 ) * hdr_len; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 279/518 ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Danilov <[email protected]>
[ Upstream commit c4a14f6d9d17ad1e41a36182dd3b8a5fd91efbd7 ]
Regression Description:
Depending on the options specified for the GRE tunnel device, small packets may be dropped. This occurs because the pskb_network_may_pull function fails due to the packet's insufficient length.
For example, if only the okey option is specified for the tunnel device, original (before encapsulation) packets smaller than 28 bytes (including the IPv4 header) will be dropped. This happens because the required length is calculated relative to the network header, not the skb->head.
Here is how the required length is computed and checked:
* The pull_len variable is set to 28 bytes, consisting of:
* IPv4 header: 20 bytes
* GRE header with Key field: 8 bytes
* The pskb_network_may_pull function adds the network offset, shifting the checkable space further to the beginning of the network header and extending it to the beginning of the packet. As a result, the end of the checkable space occurs beyond the actual end of the packet.
Instead of ensuring that 28 bytes are present in skb->head, the function is requesting these 28 bytes starting from the network header. For small packets, this requested length exceeds the actual packet size, causing the check to fail and the packets to be dropped.
This issue affects both locally originated and forwarded packets in DMVPN-like setups.
How to reproduce (for local originated packets):
ip link add dev gre1 type gre ikey 1.9.8.4 okey 1.9.8.4 \
local <your-ip> remote 0.0.0.0 ip link set mtu 1400 dev gre1
ip link set up dev gre1
ip address add 192.168.13.1/24 dev gre1
ip neighbor add 192.168.13.2 lladdr <remote-ip> dev gre1 ping -s 1374 -c 10 192.168.13.2
tcpdump -vni gre1
tcpdump -vni <your-ext-iface> 'ip proto 47'
ip -s -s -d link show dev gre1
Solution:
Use the pskb_may_pull function instead the pskb_network_may_pull.
--- net/ipv4/ip_gre.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv4/ip_gre.c +3 -3
@@ -639,11 +639,11 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,if (skb_cow_head (skb,0 )) goto free_skb; - tnl_params = (const struct iphdr *)skb->data; - -if (!pskb_network_may_pull (skb, pull_len)) +if (!pskb_may_pull (skb, pull_len)) goto free_skb; + tnl_params = (const struct iphdr *)skb->data; +/* ip_tunnel_xmit() needs skb->data pointing to gre header. */ skb_pull (skb, pull_len);skb_reset_mac_header (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 280/518 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 8beee4d8dee76b67c75dc91fd8185d91e845c160 ]
In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason.
Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline]
--- net/sctp/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sctp/socket.c +3 -1
@@ -8299,8 +8299,10 @@ static int sctp_listen_start(struct sock *sk, int backlog)*/ inet_sk_set_state (sk,SCTP_SS_LISTENING );if (!ep->base.bind_addr.port) { -if (sctp_autobind (sk)) +if (sctp_autobind (sk)) { +inet_sk_set_state (sk,SCTP_SS_CLOSED );return -EAGAIN ; + } }else {if (sctp_get_port (sk,inet_sk (sk)->inet_num)) {inet_sk_set_state (sk,SCTP_SS_CLOSED );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 281/518 i2c: xiic: Fix broken locking on tx_msg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit c119e7d00c916881913011e6f4c6ac349a41e4e2 ]
The tx_msg is set from multiple places, sometimes without locking, which fall apart on any SMP system. Only ever access tx_msg inside the driver mutex.
Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
--- drivers/i2c/busses/i2c-xiic.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/i2c/busses/i2c-xiic.c +16 -10
@@ -170,7 +170,7 @@ struct xiic_i2c {#define xiic_tx_space (i2c) ((i2c)->tx_msg->len - (i2c)->tx_pos)#define xiic_rx_space (i2c) ((i2c)->rx_msg->len - (i2c)->rx_pos) -static int xiic_start_xfer (struct xiic_i2c *i2c); +static int xiic_start_xfer (struct xiic_i2c *i2c,struct i2c_msg *msgs,int num);static void __xiic_start_xfer (struct xiic_i2c *i2c);/*
@@ -701,15 +701,25 @@ static void __xiic_start_xfer(struct xiic_i2c *i2c) } -static int xiic_start_xfer (struct xiic_i2c *i2c) +static int xiic_start_xfer (struct xiic_i2c *i2c,struct i2c_msg *msgs,int num) {int ret; +mutex_lock (&i2c->lock); + ret =xiic_busy (i2c); +if (ret) + goto out; + + i2c->tx_msg = msgs; + i2c->rx_msg =NULL ; + i2c->nmsgs = num; + ret =xiic_reinit (i2c);if (!ret)__xiic_start_xfer (i2c); +out:mutex_unlock (&i2c->lock);return ret;
@@ -727,14 +737,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)if (err <0 )return err; - err =xiic_busy (i2c); -if (err) - goto out; - - i2c->tx_msg = msgs; - i2c->nmsgs = num; - - err =xiic_start_xfer (i2c); + err =xiic_start_xfer (i2c, msgs, num);if (err <0 ) {dev_err (adap->dev.parent,"Error xiic_start_xfer\n" ); goto out;
@@ -742,9 +745,11 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)if (wait_event_timeout (i2c->wait, (i2c->state ==STATE_ERROR ) || (i2c->state ==STATE_DONE ),HZ )) { +mutex_lock (&i2c->lock); err = (i2c->state ==STATE_DONE ) ? num : -EIO ; goto out; }else { +mutex_lock (&i2c->lock); i2c->tx_msg =NULL ; i2c->rx_msg =NULL ; i2c->nmsgs =0 ;
@@ -752,6 +757,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) goto out; } out: +mutex_unlock (&i2c->lock);pm_runtime_mark_last_busy (i2c->dev);pm_runtime_put_autosuspend (i2c->dev);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 282/518 i2c: xiic: Switch from waitqueue to completion
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit fdacc3c7405d1fc33c1f2771699a4fc24551e480 ]
There will never be threads queueing up in the xiic_xmit(), use completion synchronization primitive to wait for the interrupt handler thread to complete instead as it is much better fit and there is no need to overload it for this purpose.
Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
--- drivers/i2c/busses/i2c-xiic.c | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-)
drivers/i2c/busses/i2c-xiic.c +18 -15
@@ -23,7 +23,7 @@#include <linux/platform_device.h> #include <linux/i2c.h> #include <linux/interrupt.h> -#include <linux/wait.h> +#include <linux/completion.h> #include <linux/platform_data/i2c-xiic.h> #include <linux/io.h> #include <linux/slab.h>
@@ -48,7 +48,7 @@ enum xiic_endian {* struct xiic_i2c - Internal representation of the XIIC I2C bus * @dev: Pointer to device structure * @base: Memory base of the HW registers -* @wait: Wait queue for callers +* @completion: Completion for callers * @adap: Kernel adapter representation * @tx_msg: Messages from above to be sent * @lock: Mutual exclusion
@@ -64,7 +64,7 @@ enum xiic_endian {struct xiic_i2c {struct device *dev;void __iomem *base; -wait_queue_head_t wait; +struct completion completion;struct i2c_adapter adap;struct i2c_msg *tx_msg;struct mutex lock;
@@ -160,6 +160,9 @@ struct xiic_i2c {#define XIIC_PM_TIMEOUT 1000/* ms */ /* timeout waiting for the controller to respond */ #define XIIC_I2C_TIMEOUT (msecs_to_jiffies(1000)) +/* timeout waiting for the controller finish transfers */ +#define XIIC_XFER_TIMEOUT (msecs_to_jiffies(10000)) +/* * The following constant is used for the device global interrupt enable * register, to enable all interrupts for the device, this is the only bit
@@ -367,7 +370,7 @@ static void xiic_wakeup(struct xiic_i2c *i2c, int code) i2c->rx_msg =NULL ; i2c->nmsgs =0 ; i2c->state = code; -wake_up (&i2c->wait); +complete (&i2c->completion); }static irqreturn_t xiic_process (int irq,void *dev_id)
@@ -714,6 +717,7 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num) i2c->tx_msg = msgs; i2c->rx_msg =NULL ; i2c->nmsgs = num; +init_completion (&i2c->completion); ret =xiic_reinit (i2c);if (!ret)
@@ -740,23 +744,23 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) err =xiic_start_xfer (i2c, msgs, num);if (err <0 ) {dev_err (adap->dev.parent,"Error xiic_start_xfer\n" ); - goto out; +return err; } -if (wait_event_timeout (i2c->wait, (i2c->state ==STATE_ERROR ) || - (i2c->state ==STATE_DONE ),HZ )) { -mutex_lock (&i2c->lock); - err = (i2c->state ==STATE_DONE ) ? num : -EIO ; - goto out; - }else { -mutex_lock (&i2c->lock); + err =wait_for_completion_timeout (&i2c->completion,XIIC_XFER_TIMEOUT ); +mutex_lock (&i2c->lock); +if (err ==0 ) {/* Timeout */ i2c->tx_msg =NULL ; i2c->rx_msg =NULL ; i2c->nmsgs =0 ; err = -ETIMEDOUT ; - goto out; + }else if (err <0 ) {/* Completion error */ + i2c->tx_msg =NULL ; + i2c->rx_msg =NULL ; + i2c->nmsgs =0 ; + }else { + err = (i2c->state ==STATE_DONE ) ? num : -EIO ; } -out:mutex_unlock (&i2c->lock);pm_runtime_mark_last_busy (i2c->dev);pm_runtime_put_autosuspend (i2c->dev);
@@ -819,7 +823,6 @@ static int xiic_i2c_probe(struct platform_device *pdev) DRIVER_NAME " %s", pdev->name);mutex_init (&i2c->lock); -init_waitqueue_head (&i2c->wait); i2c->clk =devm_clk_get (&pdev->dev,NULL );if (IS_ERR (i2c->clk)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 283/518 i2c: xiic: Fix RX IRQ busy check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 294b29f15469e90893c2b72a738a962ee02a12eb ]
In case the XIIC does TX/RX transfer, make sure no other kernel thread can start another TX transfer at the same time. This could happen since the driver only checks tx_msg for being non-NULL and returns -EBUSY in that case, however it is necessary to check also rx_msg for the same.
Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
--- drivers/i2c/busses/i2c-xiic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-xiic.c +1 -1
@@ -545,7 +545,7 @@ static int xiic_busy(struct xiic_i2c *i2c)int tries =3 ;int err; -if (i2c->tx_msg) +if (i2c->tx_msg || i2c->rx_msg)return -EBUSY ;/* In single master mode bus can only be busy, when in use by this
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 284/518 i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <[email protected]>
[ Upstream commit d663d93bb47e7ab45602b227701022d8aa16040a ]
The xiic_xfer() function gets a runtime PM reference when the function is entered. This reference is released when the function is exited. There is currently one error path where the function exits directly, which leads to a leak of the runtime PM reference.
Make sure that this error path also releases the runtime PM reference.
Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
--- drivers/i2c/busses/i2c-xiic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-xiic.c +3 -1
@@ -744,7 +744,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) err =xiic_start_xfer (i2c, msgs, num);if (err <0 ) {dev_err (adap->dev.parent,"Error xiic_start_xfer\n" ); -return err; + goto out; } err =wait_for_completion_timeout (&i2c->completion,XIIC_XFER_TIMEOUT );
@@ -762,6 +762,8 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) err = (i2c->state ==STATE_DONE ) ? num : -EIO ; }mutex_unlock (&i2c->lock); + +out:pm_runtime_mark_last_busy (i2c->dev);pm_runtime_put_autosuspend (i2c->dev);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 285/518 i2c: xiic: improve error message when transfer fails to start
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Ferland <[email protected]>
[ Upstream commit ee1691d0ae103ba7fd9439800ef454674fadad27 ]
xiic_start_xfer can fail for different reasons:
- EBUSY: bus is busy or i2c messages still in tx_msg or rx_msg
- ETIMEDOUT: timed-out trying to clear the RX fifo
- EINVAL: wrong clock settings
Both EINVAL and ETIMEDOUT will currently print a specific error message followed by a generic one, for example:
Failed to clear rx fifo
Error xiic_start_xfer
however EBUSY will simply output the generic message:
Error xiic_start_xfer
which is not really helpful.
This commit adds a new error message when a busy condition is detected and also removes the generic message since it does not provide any relevant information to the user.
Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
--- drivers/i2c/busses/i2c-xiic.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-xiic.c +5 -4
@@ -711,8 +711,11 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)mutex_lock (&i2c->lock); ret =xiic_busy (i2c); -if (ret) +if (ret) { +dev_err (i2c->adap.dev.parent, +"cannot start a transfer while busy\n" ); goto out; + } i2c->tx_msg = msgs; i2c->rx_msg =NULL ;
@@ -742,10 +745,8 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)return err; err =xiic_start_xfer (i2c, msgs, num); -if (err <0 ) { -dev_err (adap->dev.parent,"Error xiic_start_xfer\n" ); +if (err <0 ) goto out; - } err =wait_for_completion_timeout (&i2c->completion,XIIC_XFER_TIMEOUT );mutex_lock (&i2c->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 286/518 i2c: xiic: Try re-initialization on bus busy timeout
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Hancock <[email protected]>
[ Upstream commit 1d4a1adbed2582444aaf97671858b7d12915bd05 ]
In the event that the I2C bus was powered down when the I2C controller driver loads, or some spurious pulses occur on the I2C bus, it's possible that the controller detects a spurious I2C "start" condition. In this situation it may continue to report the bus is busy indefinitely and block the controller from working.
The "single-master" DT flag can be specified to disable bus busy checks entirely, but this may not be safe to use in situations where other I2C masters may potentially exist.
In the event that the controller reports "bus busy" for too long when starting a transaction, we can try reinitializing the controller to see if the busy condition clears. This allows recovering from this scenario.
--- drivers/i2c/busses/i2c-xiic.c | 41 ++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 15 deletions(-)
drivers/i2c/busses/i2c-xiic.c +26 -15
@@ -540,23 +540,11 @@ static int xiic_bus_busy(struct xiic_i2c *i2c)return (sr &XIIC_SR_BUS_BUSY_MASK ) ? -EBUSY :0 ; } -static int xiic_busy (struct xiic_i2c *i2c) +static int xiic_wait_not_busy (struct xiic_i2c *i2c) {int tries =3 ;int err; -if (i2c->tx_msg || i2c->rx_msg) -return -EBUSY ; - -/* In single master mode bus can only be busy, when in use by this -* driver. If the register indicates bus being busy for some reason we -* should ignore it, since bus will never be released and i2c will be -* stuck forever. -*/ -if (i2c->singlemaster) { -return 0 ; - } -/* for instance if previous transfer was terminated due to TX error * it might be that the bus is on it's way to become available * give it at most 3 ms to wake
@@ -710,13 +698,36 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)mutex_lock (&i2c->lock); - ret =xiic_busy (i2c); -if (ret) { +if (i2c->tx_msg || i2c->rx_msg) {dev_err (i2c->adap.dev.parent,"cannot start a transfer while busy\n" ); + ret = -EBUSY ; goto out; } +/* In single master mode bus can only be busy, when in use by this +* driver. If the register indicates bus being busy for some reason we +* should ignore it, since bus will never be released and i2c will be +* stuck forever. +*/ +if (!i2c->singlemaster) { + ret =xiic_wait_not_busy (i2c); +if (ret) { +/* If the bus is stuck in a busy state, such as due to spurious low +* pulses on the bus causing a false start condition to be detected, +* then try to recover by re-initializing the controller and check +* again if the bus is still busy. +*/ +dev_warn (i2c->adap.dev.parent,"I2C bus busy timeout, reinitializing\n" ); + ret =xiic_reinit (i2c); +if (ret) + goto out; + ret =xiic_wait_not_busy (i2c); +if (ret) + goto out; + } + } + i2c->tx_msg = msgs; i2c->rx_msg =NULL ; i2c->nmsgs = num;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 287/518 media: usbtv: Remove useless locks in usbtv_video_free()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gaignard <[email protected]>
[ Upstream commit 65e6a2773d655172143cc0b927cdc89549842895 ]
Remove locks calls in usbtv_video_free() because are useless and may led to a deadlock as reported here:
https://syzkaller.appspot.com/x/bisect.txt?x=166dc872180000
Also remove usbtv_stop() call since it will be called when unregistering the device.
Before 'c838530d230b' this issue would only be noticed if you disconnect while streaming and now it is noticeable even when disconnecting while not streaming.
--- drivers/media/usb/usbtv/usbtv-video.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/media/usb/usbtv/usbtv-video.c +0 -7
@@ -959,15 +959,8 @@ int usbtv_video_init(struct usbtv *usbtv)void usbtv_video_free (struct usbtv *usbtv) { -mutex_lock (&usbtv->vb2q_lock); -mutex_lock (&usbtv->v4l2_lock); - -usbtv_stop (usbtv);vb2_video_unregister_device (&usbtv->vdev);v4l2_device_disconnect (&usbtv->v4l2_dev); -mutex_unlock (&usbtv->v4l2_lock); -mutex_unlock (&usbtv->vb2q_lock); -v4l2_device_put (&usbtv->v4l2_dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 288/518 Bluetooth: L2CAP: Fix not validating setsockopt user input
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 4f3951242ace5efc7131932e2e01e6ac6baed846 ]
Check user input length before copying data.
--- net/bluetooth/l2cap_sock.c | 52 +++++++++++++++----------------------- 1 file changed, 20 insertions(+), 32 deletions(-)
net/bluetooth/l2cap_sock.c +20 -32
@@ -745,7 +745,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,struct sock *sk = sock->sk;struct l2cap_chan *chan =l2cap_pi (sk)->chan;struct l2cap_options opts; -int len, err =0 ; +int err =0 ;u32 opt;BT_DBG ("sk %p" , sk);
@@ -772,11 +772,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, opts.max_tx = chan->max_tx; opts.txwin_size = chan->tx_win; - len = min_t(unsigned int, sizeof(opts), optlen); -if (copy_from_sockptr (&opts, optval, len)) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&opts,sizeof (opts), optval, optlen); +if (err)break ; - }if (opts.txwin_size >L2CAP_DEFAULT_EXT_WINDOW ) { err = -EINVAL ;
@@ -819,10 +817,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,break ;case L2CAP_LM : -if (copy_from_sockptr (&opt, optval,sizeof (u32))) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&opt,sizeof (opt), optval, optlen); +if (err)break ; - }if (opt &L2CAP_LM_FIPS ) { err = -EINVAL ;
@@ -903,7 +900,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,struct bt_security sec;struct bt_power pwr;struct l2cap_conn *conn; -int len, err =0 ; +int err =0 ;u32 opt;u16 mtu;u8 mode;
@@ -929,11 +926,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, sec.level =BT_SECURITY_LOW ; - len = min_t(unsigned int, sizeof(sec), optlen); -if (copy_from_sockptr (&sec, optval, len)) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&sec,sizeof (sec), optval, optlen); +if (err)break ; - }if (sec.level <BT_SECURITY_LOW || sec.level >BT_SECURITY_FIPS ) {
@@ -978,10 +973,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,break ; } -if (copy_from_sockptr (&opt, optval,sizeof (u32))) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&opt,sizeof (opt), optval, optlen); +if (err)break ; - }if (opt) {set_bit (BT_SK_DEFER_SETUP , &bt_sk (sk)->flags);
@@ -993,10 +987,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,break ;case BT_FLUSHABLE : -if (copy_from_sockptr (&opt, optval,sizeof (u32))) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&opt,sizeof (opt), optval, optlen); +if (err)break ; - }if (opt >BT_FLUSHABLE_ON ) { err = -EINVAL ;
@@ -1028,11 +1021,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, pwr.force_active =BT_POWER_FORCE_ACTIVE_ON ; - len = min_t(unsigned int, sizeof(pwr), optlen); -if (copy_from_sockptr (&pwr, optval, len)) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&pwr,sizeof (pwr), optval, optlen); +if (err)break ; - }if (pwr.force_active)set_bit (FLAG_FORCE_ACTIVE , &chan->flags);
@@ -1041,10 +1032,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,break ;case BT_CHANNEL_POLICY : -if (copy_from_sockptr (&opt, optval,sizeof (u32))) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&opt,sizeof (opt), optval, optlen); +if (err)break ; - }if (opt >BT_CHANNEL_POLICY_AMP_PREFERRED ) { err = -EINVAL ;
@@ -1089,10 +1079,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,break ; } -if (copy_from_sockptr (&mtu, optval,sizeof (u16))) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&mtu,sizeof (mtu), optval, optlen); +if (err)break ; - }if (chan->mode ==L2CAP_MODE_EXT_FLOWCTL && sk->sk_state ==BT_CONNECTED )
@@ -1120,10 +1109,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,break ; } -if (copy_from_sockptr (&mode, optval,sizeof (u8))) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&mode,sizeof (mode), optval, optlen); +if (err)break ; - }BT_DBG ("mode %u" , mode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 289/518 ALSA: mixer_oss: Remove some incorrect kfree_const() usages
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 368e4663c557de4a33f321b44e7eeec0a21b2e4e ]
"assigned" and "assigned->name" are allocated in snd_mixer_oss_proc_write() using kmalloc() and kstrdup(), so there is no point in using kfree_const() to free these resources.
Switch to the more standard kfree() to free these resources.
This could avoid a memory leak.
--- sound/core/oss/mixer_oss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/oss/mixer_oss.c +2 -2
@@ -957,8 +957,8 @@ static void snd_mixer_oss_slot_free(struct snd_mixer_oss_slot *chn)struct slot *p = chn->private_data;if (p) {if (p->allocated && p->assigned) { -kfree_const (p->assigned->name); -kfree_const (p->assigned); +kfree (p->assigned->name); +kfree (p->assigned); }kfree (p); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 290/518 ALSA: hda/realtek: Fix the push button function for the ALC257
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oder Chiou <[email protected]>
[ Upstream commit 05df9732a0894846c46d0062d4af535c5002799d ]
The headset push button cannot work properly in case of the ALC257. This patch reverted the previous commit to correct the side effect.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -578,6 +578,7 @@ static void alc_shutup_pins(struct hda_codec *codec)switch (codec->core.vendor_id) {case 0x10ec0236 :case 0x10ec0256 : +case 0x10ec0257 :case 0x19e58326 :case 0x10ec0283 :case 0x10ec0285 :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 291/518 ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 1c801e7f77445bc56e5e1fec6191fd4503534787 ]
Some time ago, we introduced the obey_preferred_dacs flag for choosing the DAC/pin pairs specified by the driver instead of parsing the paths. This works as expected, per se, but there have been a few cases where we forgot to set this flag while preferred_dacs table is already set up. It ended up with incorrect wiring and made us wondering why it doesn't work.
Basically, when the preferred_dacs table is provided, it means that the driver really wants to wire up to follow that. That is, the presence of the preferred_dacs table itself is already a "do-it" flag.
In this patch, we simply replace the evaluation of obey_preferred_dacs flag with the presence of preferred_dacs table for fixing the misbehavior. Another patch to drop of the obsoleted flag will follow.
--- sound/pci/hda/hda_generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/hda_generic.c +2 -2
@@ -1377,7 +1377,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,struct nid_path *path;hda_nid_t pin = pins[i]; -if (!spec->obey_preferred_dacs) { +if (!spec->preferred_dacs) { path =snd_hda_get_path_from_idx (codec, path_idx[i]);if (path) { badness +=assign_out_path_ctls (codec, path);
@@ -1389,7 +1389,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,if (dacs[i]) {if (is_dac_already_used (codec, dacs[i])) badness += bad->shared_primary; - }else if (spec->obey_preferred_dacs) { + }else if (spec->preferred_dacs) { badness +=BAD_NO_PRIMARY_DAC ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 292/518 ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b3ebb007060f89d5a45c9b99f06a55e36a1945b5 ]
We received a regression report for System76 Pangolin (pang14) due to the recent fix for Tuxedo Sirius devices to support the top speaker. The reason was the conflicting PCI SSID, as often seen.
As a workaround, now the codec SSID is checked and the quirk is applied conditionally only to Sirius devices.
--- sound/pci/hda/patch_conexant.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
sound/pci/hda/patch_conexant.c +19 -5
@@ -747,6 +747,23 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = { {} }; +/* pincfg quirk for Tuxedo Sirius; +* unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14, +* which has incompatible pin setup, so we check the codec SSID (luckily +* different one!) and conditionally apply the quirk here +*/ +static void cxt_fixup_sirius_top_speaker (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +/* ignore for incorrectly picked-up pang14 */ +if (codec->core.subsystem_id ==0x278212b3 ) +return ; +/* set up the top speaker pin */ +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) +snd_hda_codec_set_pincfg (codec,0x1d ,0x82170111 ); +} +static const struct hda_fixup cxt_fixups[] = { [CXT_PINCFG_LENOVO_X200 ] = { .type =HDA_FIXUP_PINS ,
@@ -907,11 +924,8 @@ static const struct hda_fixup cxt_fixups[] = { .v.pins = cxt_pincfg_sws_js201d, }, [CXT_PINCFG_TOP_SPEAKER] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl []) { - {0x1d ,0x82170111 }, - { } - }, + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_sirius_top_speaker, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 293/518 f2fs: Require FMODE_WRITE for atomic write ioctls
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 4f5a100f87f32cb65d4bb1ad282a08c92f6f591e upstream.
The F2FS ioctls for starting and committing atomic writes check for inode_owner_or_capable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inode_owner_or_capable() immediately returns true.
There are scenarios where LSMs want to deny a process the ability to write particular files, even files that the FSUID of the process owns; but this can currently partially be bypassed using atomic write ioctls in two ways:
- F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can truncate an inode to size 0
- F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert changes another process concurrently made to a file
Fix it by requiring FMODE_WRITE for these operations, just like for F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these ioctls when intending to write into the file, that seems unlikely to break anything.
--- fs/f2fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/f2fs/file.c +15 -0
@@ -2054,6 +2054,9 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)struct f2fs_sb_info *sbi =F2FS_I_SB (inode);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
@@ -2124,6 +2127,9 @@ static int f2fs_ioc_commit_atomic_write(struct file *filp)struct inode *inode =file_inode (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
@@ -2166,6 +2172,9 @@ static int f2fs_ioc_start_volatile_write(struct file *filp)struct inode *inode =file_inode (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
@@ -2201,6 +2210,9 @@ static int f2fs_ioc_release_volatile_write(struct file *filp)struct inode *inode =file_inode (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
@@ -2230,6 +2242,9 @@ static int f2fs_ioc_abort_volatile_write(struct file *filp)struct inode *inode =file_inode (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 294/518 wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 3f66f26703093886db81f0610b97a6794511917c ]
In 'ath9k_get_et_stats()', promote TX stats counters to 'u64' to avoid possible integer overflow. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/ath/ath9k/debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +2 -2
@@ -1316,11 +1316,11 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,struct ath_softc *sc = hw->priv;int i =0 ; - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_pkts_all); - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_bytes_all);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 295/518 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 94745807f3ebd379f23865e6dab196f220664179 ]
Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call.
The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +2 -4
@@ -718,8 +718,7 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb) } resubmit: -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 );usb_anchor_urb (urb, &hif_dev->rx_submitted); ret =usb_submit_urb (urb,GFP_ATOMIC );
@@ -756,8 +755,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)case -ESHUTDOWN : goto free_skb;default : -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 ); goto resubmit; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 296/518 ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 62fdaf9e8056e9a9e6fe63aa9c816ec2122d60c6 ]
In ice_sched_add_root_node() and ice_sched_add_node() there are calls to devm_kcalloc() in order to allocate memory for array of pointers to 'ice_sched_node' structure. But incorrect types are used as sizeof() arguments in these calls (structures instead of pointers) which leads to over allocation of memory.
Adjust over allocation of memory by correcting types in devm_kcalloc() sizeof() arguments.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/intel/ice/ice_sched.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_sched.c +2 -4
@@ -27,9 +27,8 @@ ice_sched_add_root_node(struct ice_port_info *pi,if (!root)return ICE_ERR_NO_MEMORY ; -/* coverity[suspicious_sizeof] */ root->children =devm_kcalloc (ice_hw_to_dev (hw), hw->max_children[0 ], -sizeof (*root),GFP_KERNEL ); +sizeof (*root->children),GFP_KERNEL );if (!root->children) {devm_kfree (ice_hw_to_dev (hw), root);return ICE_ERR_NO_MEMORY ;
@@ -181,10 +180,9 @@ ice_sched_add_node(struct ice_port_info *pi, u8 layer,if (!node)return ICE_ERR_NO_MEMORY ;if (hw->max_children[layer]) { -/* coverity[suspicious_sizeof] */ node->children =devm_kcalloc (ice_hw_to_dev (hw), hw->max_children[layer], -sizeof (*node),GFP_KERNEL ); +sizeof (*node->children),GFP_KERNEL );if (!node->children) {devm_kfree (ice_hw_to_dev (hw), node);return ICE_ERR_NO_MEMORY ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 297/518 net/xen-netback: prevent UAF in xenvif_flush_hash()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 ]
During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free.
Therefore, to solve this, you need to change it to list_for_each_entry_safe.
--- drivers/net/xen-netback/hash.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/xen-netback/hash.c +2 -3
@@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data,static void xenvif_flush_hash (struct xenvif *vif) { -struct xenvif_hash_cache_entry *entry; +struct xenvif_hash_cache_entry *entry, *n;unsigned long flags;if (xenvif_hash_cache_size ==0 )
@@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif)spin_lock_irqsave (&vif->hash.cache.lock, flags); -list_for_each_entry_rcu (entry, &vif->hash.cache.list, link, -lockdep_is_held (&vif->hash.cache.lock)) { +list_for_each_entry_safe (entry, n, &vif->hash.cache.list, link) {list_del_rcu (&entry->link); vif->hash.cache.count--;kfree_rcu (entry, rcu);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 298/518 net: hisilicon: hip04: fix OF node leak in probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 17555297dbd5bccc93a01516117547e26a61caf1 ]
Driver is leaking OF node reference fromof_parse_phandle_with_fixed_args() in probe().
--- drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hip04_eth.c +1 -0
@@ -943,6 +943,7 @@ static int hip04_mac_probe(struct platform_device *pdev) priv->tx_coalesce_timer.function = tx_done; priv->map =syscon_node_to_regmap (arg.np); +of_node_put (arg.np);if (IS_ERR (priv->map)) {dev_warn (d,"no syscon hisilicon,hip04-ppe\n" ); ret =PTR_ERR (priv->map);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 299/518 net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5680cf8d34e1552df987e2f4bb1bff0b2a8c8b11 ]
Driver is leaking OF node reference from of_parse_phandle_with_fixed_args() in hns_mac_get_info().
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +1 -0
@@ -933,6 +933,7 @@ static int hns_mac_get_info(struct hns_mac_cb *mac_cb) mac_cb->cpld_ctrl =NULL ; }else { syscon =syscon_node_to_regmap (cpld_args.np); +of_node_put (cpld_args.np);if (IS_ERR_OR_NULL (syscon)) {dev_dbg (mac_cb->dev,"no cpld-syscon found!\n" ); mac_cb->cpld_ctrl =NULL ;
Signature · 1 line
2.43.0