6.6.60-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.6.60-rc1 review
This is the start of the stable review cycle for the 6.6.60 release. There are 151 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 08 Nov 2024 12:02:47 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.60-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.60-rc1
Konstantin Komarov <[email protected]>
fs/ntfs3: Sequential field availability check in mi_enum_attr()
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-control: Add support for ALSA enum control
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-control: Add support for ALSA switch control
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Add definition for generic switch/enum control
Chuck Lever <[email protected]>
SUNRPC: Remove BUG_ON call sites
Michael Walle <[email protected]>
mtd: spi-nor: winbond: fix w25q128 regression
David Hildenbrand <[email protected]>
mm: don't install PMD mappings when THPs are disabled by the hw/process/vma
Kefeng Wang <[email protected]>
mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw()
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: fix 6 GHz scan construction
Ryusuke Konishi <[email protected]>
nilfs2: fix kernel bug due to missing clearing of checked flag
Zong-Zhe Yang <[email protected]>
wifi: mac80211: fix NULL dereference at band check in starting tx ba session
Pavel Begunkov <[email protected]>
io_uring: always lock __io_cqring_overflow_flush
Haibo Chen <[email protected]>
arm64: dts: imx8ulp: correct the flexspi compatible string
Gregory Price <[email protected]>
vmscan,migrate: fix page count imbalance on node stats when demoting pages
Jens Axboe <[email protected]>
io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
Andrey Konovalov <[email protected]>
kasan: remove vmalloc_percpu test
Vitaliy Shevtsov <[email protected]>
nvmet-auth: assign dh_key to NULL after kfree_sensitive
Christoffer Sandberg <[email protected]>
ALSA: hda/realtek: Fix headset mic on TUXEDO Stellaris 16 Gen6 mb1
Christoffer Sandberg <[email protected]>
ALSA: hda/realtek: Fix headset mic on TUXEDO Gemini 17 Gen3
Christoph Hellwig <[email protected]>
xfs: fix finding a last resort AG in xfs_filestream_pick_ag
Matt Johnston <[email protected]>
mctp i2c: handle NULL header address
Edward Adam Davis <[email protected]>
ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
Sabyrzhan Tasbolatov <[email protected]>
x86/traps: move kmsan check after instrumentation_begin
Gatlin Newhouse <[email protected]>
x86/traps: Enable UBSAN traps on x86
Matt Fleming <[email protected]>
mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves
Alexander Usyskin <[email protected]>
mei: use kvmalloc for read buffer
Matthieu Baerts (NGI0) <[email protected]>
mptcp: init: protect sched with rcu_read_lock
Hugh Dickins <[email protected]>
iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP
Shawn Wang <[email protected]>
sched/numa: Fix the potential null pointer dereference in task_numa_work()
Dan Williams <[email protected]>
cxl/acpi: Ensure ports ready at cxl_acpi_probe() return
Dan Williams <[email protected]>
cxl/port: Fix cxl_bus_rescan() vs bus_rescan_devices()
Chunyan Zhang <[email protected]>
riscv: Remove duplicated GET_RM
Chunyan Zhang <[email protected]>
riscv: Remove unused GENERATING_ASM_OFFSETS
WangYuli <[email protected]>
riscv: Use '%u' to format the output of 'cpu'
Heinrich Schuchardt <[email protected]>
riscv: efi: Set NX compat flag in PE/COFF header
Kailang Yang <[email protected]>
ALSA: hda/realtek: Limit internal Mic boost on Dell platform
Dmitry Torokhov <[email protected]>
Input: edt-ft5x06 - fix regmap leak when probe fails
Alexandre Ghiti <[email protected]>
riscv: vdso: Prevent the compiler from inserting calls to memset()
Frank Li <[email protected]>
spi: spi-fsl-dspi: Fix crash when not using GPIO chip select
Richard Zhu <[email protected]>
phy: freescale: imx8m-pcie: Do CMN_RST just before PHY PLL lock check
Chen Ridong <[email protected]>
cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
Xinyu Zhang <[email protected]>
block: fix sanity checks in blk_rq_map_user_bvec
Ben Chuang <[email protected]>
mmc: sdhci-pci-gli: GL9767: Fix low power mode in the SD Express process
Ben Chuang <[email protected]>
mmc: sdhci-pci-gli: GL9767: Fix low power mode on the set clock function
Dan Williams <[email protected]>
cxl/port: Fix use-after-free, permit out-of-order decoder shutdown
Gil Fine <[email protected]>
thunderbolt: Honor TMU requirements in the domain when setting TMU mode
Wladislav Wiebe <[email protected]>
tools/mm: -Werror fixes in page-types/slabinfo
Jeongjun Park <[email protected]>
mm: shmem: fix data-race in shmem_getattr()
Yunhui Cui <[email protected]>
RISC-V: ACPI: fix early_ioremap to early_memremap
Ryusuke Konishi <[email protected]>
nilfs2: fix potential deadlock with newly created symlinks
Javier Carrasco <[email protected]>
iio: light: veml6030: fix microlux value calculation
Jinjie Ruan <[email protected]>
iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()
Jinjie Ruan <[email protected]>
iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()
Zicheng Qu <[email protected]>
iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()
Zicheng Qu <[email protected]>
staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
Ville Syrjälä <[email protected]>
wifi: iwlegacy: Clear stale interrupts before resuming device
Johannes Berg <[email protected]>
wifi: cfg80211: clear wdev->cqm_config pointer on free
Manikanta Pubbisetty <[email protected]>
wifi: ath10k: Fix memory leak in management tx
Felix Fietkau <[email protected]>
wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
Edward Liaw <[email protected]>
Revert "selftests/mm: replace atomic_bool with pthread_barrier_t"
Edward Liaw <[email protected]>
Revert "selftests/mm: fix deadlock for fork after pthread_create on ARM"
Greg Kroah-Hartman <[email protected]>
Revert "driver core: Fix uevent_show() vs driver detach race"
Basavaraj Natikar <[email protected]>
xhci: Use pm_runtime_get to prevent RPM on unsupported systems
Faisal Hassan <[email protected]>
xhci: Fix Link TRB DMA in command ring stopped completion event
Johan Hovold <[email protected]>
phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend
Johan Hovold <[email protected]>
phy: qcom: qmp-usb: fix NULL-deref on runtime suspend
Javier Carrasco <[email protected]>
usb: typec: qcom-pmic-typec: use fwnode_handle_put() to release fwnodes
Javier Carrasco <[email protected]>
usb: typec: fix unreleased fwnode_handle in typec_port_register_altmodes()
Zijun Hu <[email protected]>
usb: phy: Fix API devm_usb_put_phy() can not release the phy
Zongmin Zhou <[email protected]>
usbip: tools: Fix detach_port() invalid port error path
Jan Schär <[email protected]>
ALSA: usb-audio: Add quirks for Dell WD19 dock
Zqiang <[email protected]>
rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()
Paul E. McKenney <[email protected]>
rcu-tasks: Initialize data to eliminate RCU-tasks/do_exit() deadlocks
Paul E. McKenney <[email protected]>
rcu-tasks: Add data to eliminate RCU-tasks/do_exit() deadlocks
Paul E. McKenney <[email protected]>
rcu-tasks: Pull sampling of ->percpu_dequeue_lim out of loop
Alan Stern <[email protected]>
USB: gadget: dummy-hcd: Fix "task hung" problem
Andrey Konovalov <[email protected]>
usb: gadget: dummy_hcd: execute hrtimer callback in softirq context
Marcello Sylvester Bauer <[email protected]>
usb: gadget: dummy_hcd: Set transfer interval to 1 microframe
Marcello Sylvester Bauer <[email protected]>
usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler
Dimitri Sivanich <[email protected]>
misc: sgi-gru: Don't disable preemption in GRU driver
Dai Ngo <[email protected]>
NFS: remove revoked delegation from server's delegation list
Daniel Palmer <[email protected]>
net: amd: mvme147: Fix probe banner message
Zhang Rui <[email protected]>
thermal: intel: int340x: processor: Add MMIO RAPL PL4 support
Zhang Rui <[email protected]>
thermal: intel: int340x: processor: Remove MMIO RAPL CPU hotplug support
Pali Rohár <[email protected]>
cifs: Fix creating native symlinks pointing to current or parent directory
Pali Rohár <[email protected]>
cifs: Improve creating native symlinks pointing to directory
Benjamin Marzinski <[email protected]>
scsi: scsi_transport_fc: Allow setting rport state to current state
Konstantin Komarov <[email protected]>
fs/ntfs3: Additional check in ntfs_file_release
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix general protection fault in run_is_mapped_full
Konstantin Komarov <[email protected]>
fs/ntfs3: Additional check in ni_clear()
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix possible deadlock in mi_read
Konstantin Komarov <[email protected]>
fs/ntfs3: Add rough attr alloc_size check
Konstantin Komarov <[email protected]>
fs/ntfs3: Stale inode instead of bad
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix warning possible deadlock in ntfs_set_state
Andrew Ballance <[email protected]>
fs/ntfs3: Check if more than chunk-size bytes are written
lei lu <[email protected]>
ntfs3: Add bounds checking to mi_enum_attr()
Shiju Jose <[email protected]>
cxl/events: Fix Trace DRAM Event Record
Paulo Alcantara <[email protected]>
smb: client: set correct device number on nfs reparse points
Paulo Alcantara <[email protected]>
smb: client: fix parsing of device numbers
Pierre Gondois <[email protected]>
ACPI: CPPC: Make rmw_lock a raw_spin_lock
David Howells <[email protected]>
afs: Fix missing subdir edit when renamed between parent dirs
David Howells <[email protected]>
afs: Automatically generate trace tag enums
Xiongfeng Wang <[email protected]>
firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
Marco Elver <[email protected]>
kasan: Fix Software Tag-Based KASAN with GCC
Christoph Hellwig <[email protected]>
iomap: turn iomap_want_unshare_iter into an inline function
Darrick J. Wong <[email protected]>
fsdax: dax_unshare_iter needs to copy entire blocks
Darrick J. Wong <[email protected]>
fsdax: remove zeroing code from dax_unshare_iter
Darrick J. Wong <[email protected]>
iomap: share iomap_unshare_iter predicate code with fsdax
Darrick J. Wong <[email protected]>
iomap: don't bother unsharing delalloc extents
Christoph Hellwig <[email protected]>
iomap: improve shared block detection in iomap_unshare_iter
Toke Høiland-Jørgensen <[email protected]>
bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled
Pablo Neira Ayuso <[email protected]>
netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
Ido Schimmel <[email protected]>
mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address
Amit Cohen <[email protected]>
mlxsw: spectrum_ptp: Add missing verification before pushing Tx header
Benoît Monin <[email protected]>
net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
Sungwoo Kim <[email protected]>
Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs
Eric Dumazet <[email protected]>
netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
Dong Chenchen <[email protected]>
netfilter: Fix use-after-free in get_info()
Wang Liang <[email protected]>
net: fix crash when config small gso_max_size/gso_ipv4_max_size
Byeonguk Jeong <[email protected]>
bpf: Fix out-of-bounds write in trie_get_next_key()
Zichen Xie <[email protected]>
netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write()
Eduard Zingerman <[email protected]>
bpf: Force checkpoint when jmp history is too long
Yonghong Song <[email protected]>
selftests/bpf: Add bpf_percpu_obj_{new,drop}() macro in bpf_experimental.h
Pedro Tammela <[email protected]>
net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
Pablo Neira Ayuso <[email protected]>
gtp: allow -1 to be specified as file description from userspace
Ido Schimmel <[email protected]>
ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()
Wander Lairson Costa <[email protected]>
igb: Disable threaded IRQ for igb_msix_other
Furong Xu <[email protected]>
net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data
Ley Foon Tan <[email protected]>
net: stmmac: dwmac4: Fix high address display by updating reg_space[] from register values
Jianbo Liu <[email protected]>
macsec: Fix use-after-free while sending the offloading packet
Christophe JAILLET <[email protected]>
ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: don't add default link in fw restart flow
Daniel Gabay <[email protected]>
wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
Selvin Xavier <[email protected]>
RDMA/bnxt_re: synchronize the qp-handle table array
Selvin Xavier <[email protected]>
RDMA/bnxt_re: Fix the usage of control path spin locks
Patrisious Haddad <[email protected]>
RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down
Leon Romanovsky <[email protected]>
RDMA/cxgb4: Dump vendor specific QP details
Geert Uytterhoeven <[email protected]>
wifi: brcm80211: BRCM_TRACING should depend on TRACING
Remi Pommarel <[email protected]>
wifi: ath11k: Fix invalid ring usage in full monitor mode
Felix Fietkau <[email protected]>
wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
Geert Uytterhoeven <[email protected]>
mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING
Ben Hutchings <[email protected]>
wifi: iwlegacy: Fix "field-spanning write" warning in il_enqueue_hcmd()
Georgi Djakov <[email protected]>
spi: geni-qcom: Fix boot warning related to pm_runtime and devres
Xiu Jianfeng <[email protected]>
cgroup: Fix potential overflow issue when checking max_depth
Stefan Kerkmann <[email protected]>
Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller
Brenton Simpson <[email protected]>
Input: xpad - sort xpad_device by vendor and product ID
Rafael J. Wysocki <[email protected]>
thermal: core: Free tzp copy along with the thermal zone
Rafael J. Wysocki <[email protected]>
thermal: core: Rework thermal zone availability check
Rafael J. Wysocki <[email protected]>
thermal: core: Make thermal_zone_device_unregister() return after freeing the zone
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/freescale/imx8ulp.dtsi | 2 +- arch/riscv/kernel/acpi.c | 4 +- arch/riscv/kernel/asm-offsets.c | 2 - arch/riscv/kernel/cpu-hotplug.c | 2 +- arch/riscv/kernel/efi-header.S | 2 +- arch/riscv/kernel/traps_misaligned.c | 2 - arch/riscv/kernel/vdso/Makefile | 1 + arch/x86/include/asm/bug.h | 12 ++ arch/x86/kernel/traps.c | 71 +++++- block/blk-map.c | 4 +- drivers/acpi/cppc_acpi.c | 9 +- drivers/base/core.c | 48 ++++- drivers/base/module.c | 4 - drivers/cxl/acpi.c | 7 + drivers/cxl/core/hdm.c | 50 ++++- drivers/cxl/core/port.c | 13 +- drivers/cxl/core/region.c | 48 ++--- drivers/cxl/core/trace.h | 17 +- drivers/cxl/cxl.h | 3 +- drivers/firmware/arm_sdei.c | 2 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 3 + drivers/iio/adc/ad7124.c | 2 +- drivers/iio/industrialio-gts-helper.c | 4 +- drivers/iio/light/veml6030.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 4 + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 38 ++-- drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 2 + drivers/infiniband/hw/cxgb4/provider.c | 1 + drivers/infiniband/hw/mlx5/qp.c | 4 +- drivers/input/joystick/xpad.c | 12 +- drivers/input/touchscreen/edt-ft5x06.c | 19 +- drivers/misc/mei/client.c | 4 +- drivers/misc/sgi-gru/grukservices.c | 2 - drivers/misc/sgi-gru/grumain.c | 4 - drivers/misc/sgi-gru/grutlbpurge.c | 2 - drivers/mmc/host/sdhci-pci-gli.c | 38 ++-- drivers/mtd/spi-nor/winbond.c | 7 +- drivers/net/ethernet/amd/mvme147.c | 7 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- .../net/ethernet/mellanox/mlxsw/spectrum_ipip.c | 26 ++- drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c | 7 + drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 8 + drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h | 2 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 22 +- drivers/net/gtp.c | 22 +- drivers/net/macsec.c | 3 +- drivers/net/mctp/mctp-i2c.c | 3 + drivers/net/netdevsim/fib.c | 4 +- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 7 +- drivers/net/wireless/ath/ath10k/wmi.c | 2 + drivers/net/wireless/ath/ath11k/dp_rx.c | 7 +- drivers/net/wireless/broadcom/brcm80211/Kconfig | 1 + drivers/net/wireless/intel/iwlegacy/common.c | 15 +- drivers/net/wireless/intel/iwlegacy/common.h | 12 ++ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 22 +- .../net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 24 ++- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 3 +- drivers/nvme/target/auth.c | 1 + drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 10 +- drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c | 1 + drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 1 + drivers/scsi/scsi_transport_fc.c | 4 +- drivers/spi/spi-fsl-dspi.c | 6 +- drivers/spi/spi-geni-qcom.c | 8 +- drivers/staging/iio/frequency/ad9832.c | 7 +- .../intel/int340x_thermal/processor_thermal_rapl.c | 70 +++--- drivers/thermal/thermal_core.c | 25 ++- drivers/thunderbolt/tb.c | 48 ++++- drivers/usb/gadget/udc/dummy_hcd.c | 57 +++-- drivers/usb/host/xhci-pci.c | 6 +- drivers/usb/host/xhci-ring.c | 16 +- drivers/usb/phy/phy.c | 2 +- drivers/usb/typec/class.c | 1 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c | 4 +- fs/afs/dir.c | 25 +++ fs/afs/dir_edit.c | 91 +++++++- fs/afs/internal.h | 2 + fs/dax.c | 49 +++-- fs/iomap/buffered-io.c | 7 +- fs/nfs/delegation.c | 5 + fs/nilfs2/namei.c | 3 + fs/nilfs2/page.c | 1 + fs/ntfs3/file.c | 9 +- fs/ntfs3/frecord.c | 4 +- fs/ntfs3/inode.c | 15 +- fs/ntfs3/lznt.c | 3 + fs/ntfs3/namei.c | 2 +- fs/ntfs3/ntfs_fs.h | 2 +- fs/ntfs3/record.c | 31 ++- fs/ocfs2/file.c | 8 + fs/smb/client/cifs_unicode.c | 17 +- fs/smb/client/reparse.c | 174 ++++++++++++++- fs/smb/client/reparse.h | 9 +- fs/smb/client/smb2inode.c | 3 +- fs/smb/client/smb2proto.h | 1 + fs/xfs/xfs_filestream.c | 23 +- fs/xfs/xfs_trace.h | 15 +- include/acpi/cppc_acpi.h | 2 +- include/linux/compiler-gcc.h | 4 + include/linux/device.h | 3 + include/linux/huge_mm.h | 18 ++ include/linux/iomap.h | 19 ++ include/linux/sched.h | 2 + include/linux/thermal.h | 2 + include/linux/ubsan.h | 5 + include/net/ip_tunnels.h | 2 +- include/trace/events/afs.h | 240 +++------------------ init/init_task.c | 1 + io_uring/io_uring.c | 13 +- io_uring/rw.c | 23 +- kernel/bpf/cgroup.c | 19 +- kernel/bpf/lpm_trie.c | 2 +- kernel/bpf/verifier.c | 9 +- kernel/cgroup/cgroup.c | 4 +- kernel/fork.c | 1 + kernel/rcu/tasks.h | 90 +++++--- kernel/sched/fair.c | 4 +- lib/Kconfig.ubsan | 4 +- lib/iov_iter.c | 6 +- mm/huge_memory.c | 13 +- mm/kasan/kasan_test.c | 27 --- mm/memory.c | 9 + mm/migrate.c | 2 +- mm/page_alloc.c | 10 +- mm/shmem.c | 2 + net/bluetooth/hci_sync.c | 18 +- net/bpf/test_run.c | 1 + net/core/dev.c | 4 + net/core/rtnetlink.c | 4 +- net/ipv6/netfilter/nf_reject_ipv6.c | 15 +- net/mac80211/Kconfig | 2 +- net/mac80211/agg-tx.c | 4 +- net/mac80211/cfg.c | 3 +- net/mac80211/key.c | 42 ++-- net/mptcp/protocol.c | 2 + net/netfilter/nft_payload.c | 3 + net/netfilter/x_tables.c | 2 +- net/sched/sch_api.c | 2 +- net/sunrpc/svc.c | 9 +- net/wireless/core.c | 1 + sound/pci/hda/patch_realtek.c | 23 +- sound/soc/codecs/cs42l51.c | 7 +- sound/soc/sof/ipc4-control.c | 175 ++++++++++++++- sound/soc/sof/ipc4-topology.c | 49 ++++- sound/soc/sof/ipc4-topology.h | 19 +- sound/usb/mixer_quirks.c | 3 + tools/mm/page-types.c | 9 +- tools/mm/slabinfo.c | 4 +- tools/testing/cxl/test/cxl.c | 14 +- tools/testing/selftests/bpf/bpf_experimental.h | 31 +++ tools/testing/selftests/mm/uffd-common.c | 5 +- tools/testing/selftests/mm/uffd-common.h | 3 +- tools/testing/selftests/mm/uffd-unit-tests.c | 21 +- tools/usb/usbip/src/usbip_detach.c | 1 + 155 files changed, 1657 insertions(+), 775 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/151 thermal: core: Make thermal_zone_device_unregister() return after freeing the zone
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 4649620d9404d3aceb25891c24bab77143e3f21c ]
Make thermal_zone_device_unregister() wait until all of the references to the given thermal zone object have been dropped and free it before returning.
This guarantees that when thermal_zone_device_unregister() returns, there is no leftover activity regarding the thermal zone in question which is required by some of its callers (for instance, modular driver code that wants to know when it is safe to let the module go away).
Subsequently, this will allow some confusing device_is_registered() checks to be dropped from the thermal sysfs and core code.
Stable-dep-of: 827a07525c09 ("thermal: core: Free tzp copy along with the thermal zone")
--- drivers/thermal/thermal_core.c | 6 +++++- include/linux/thermal.h | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/thermal/thermal_core.c +5 -1
@@ -800,7 +800,7 @@ static void thermal_release(struct device *dev) tz =to_thermal_zone (dev);thermal_zone_destroy_device_groups (tz);mutex_destroy (&tz->lock); -kfree (tz); +complete (&tz->removal); }else if (!strncmp (dev_name (dev),"cooling_device" ,sizeof ("cooling_device" ) -1 )) { cdev =to_cooling_device (dev);
@@ -1294,6 +1294,7 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *tINIT_LIST_HEAD (&tz->thermal_instances);ida_init (&tz->ida);mutex_init (&tz->lock); +init_completion (&tz->removal); id =ida_alloc (&thermal_tz_ida,GFP_KERNEL );if (id <0 ) { result = id;
@@ -1480,6 +1481,9 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)put_device (&tz->device);thermal_notify_tz_delete (tz_id); + +wait_for_completion (&tz->removal); +kfree (tz); }EXPORT_SYMBOL_GPL (thermal_zone_device_unregister);
include/linux/thermal.h +2 -0
@@ -115,6 +115,7 @@ struct thermal_cooling_device {* @id: unique id number for each thermal zone * @type: the thermal zone device type * @device: &struct device for this thermal zone +* @removal: removal completion * @trip_temp_attrs: attributes for trip points for sysfs: trip temperature * @trip_type_attrs: attributes for trip points for sysfs: trip type * @trip_hyst_attrs: attributes for trip points for sysfs: trip hysteresis
@@ -156,6 +157,7 @@ struct thermal_zone_device {int id;char type[THERMAL_NAME_LENGTH ];struct device device; +struct completion removal;struct attribute_group trips_attribute_group;struct thermal_attr *trip_temp_attrs;struct thermal_attr *trip_type_attrs;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/151 thermal: core: Rework thermal zone availability check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit b38aa87f67931e23ebc32c0ca00a86dfa4688719 ]
In order to avoid running __thermal_zone_device_update() for thermal zones going away, the thermal zone lock is held around device_del() in thermal_zone_device_unregister() and thermal_zone_device_update() passes the given thermal zone device to device_is_registered(). This allows thermal_zone_device_update() to skip the __thermal_zone_device_update() if device_del() has already run for the thermal zone at hand.
However, instead of looking at driver core internals, the thermal subsystem may as well rely on its own data structures for this purpose. Namely, if the thermal zone is not present in thermal_tz_list, it can be regarded as unavailable, which in fact is already the case in thermal_zone_device_unregister(). Accordingly, the device_is_registered() check in thermal_zone_device_update() can be replaced with checking whether or not the node list_head in struct thermal_zone_device is empty, in which case it is not there in thermal_tz_list.
To make this work, though, it is necessary to initialize tz->node in thermal_zone_device_register_with_trips() before registering the thermal zone device and it needs to be added to thermal_tz_list and deleted from it under its zone lock.
After the above modifications, the zone lock does not need to be held around device_del() in thermal_zone_device_unregister() any more.
Stable-dep-of: 827a07525c09 ("thermal: core: Free tzp copy along with the thermal zone")
--- drivers/thermal/thermal_core.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/thermal/thermal_core.c +12 -3
@@ -487,11 +487,16 @@ int thermal_zone_device_is_enabled(struct thermal_zone_device *tz)return tz->mode ==THERMAL_DEVICE_ENABLED ; } +static bool thermal_zone_is_present (struct thermal_zone_device *tz) +{ +return !list_empty (&tz->node); +} +void thermal_zone_device_update (struct thermal_zone_device *tz,enum thermal_notify_event event) {mutex_lock (&tz->lock); -if (device_is_registered (&tz->device)) +if (thermal_zone_is_present (tz))__thermal_zone_device_update (tz, event);mutex_unlock (&tz->lock); }
@@ -1292,6 +1297,7 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *t }INIT_LIST_HEAD (&tz->thermal_instances); +INIT_LIST_HEAD (&tz->node);ida_init (&tz->ida);mutex_init (&tz->lock);init_completion (&tz->removal);
@@ -1365,7 +1371,9 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *t }mutex_lock (&thermal_list_lock); +mutex_lock (&tz->lock);list_add_tail (&tz->node, &thermal_tz_list); +mutex_unlock (&tz->lock);mutex_unlock (&thermal_list_lock);/* Bind cooling devices for this zone */
@@ -1455,7 +1463,10 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)mutex_unlock (&thermal_list_lock);return ; } + +mutex_lock (&tz->lock);list_del (&tz->node); +mutex_unlock (&tz->lock);/* Unbind all cdevs associated with 'this' thermal zone */ list_for_each_entry (cdev, &thermal_cdev_list, node)
@@ -1472,9 +1483,7 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)ida_free (&thermal_tz_ida, tz->id);ida_destroy (&tz->ida); -mutex_lock (&tz->lock);device_del (&tz->device); -mutex_unlock (&tz->lock);kfree (tz->tzp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/151 thermal: core: Free tzp copy along with the thermal zone
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 827a07525c099f54d3b15110408824541ec66b3c ]
The object pointed to by tz->tzp may still be accessed after being freed in thermal_zone_device_unregister(), so move the freeing of it to the point after the removal completion has been completed at which it cannot be accessed any more.
--- drivers/thermal/thermal_core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/thermal/thermal_core.c +1 -3
@@ -1484,14 +1484,12 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)ida_destroy (&tz->ida);device_del (&tz->device); - -kfree (tz->tzp); -put_device (&tz->device);thermal_notify_tz_delete (tz_id);wait_for_completion (&tz->removal); +kfree (tz->tzp);kfree (tz); }EXPORT_SYMBOL_GPL (thermal_zone_device_unregister);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/151 Input: xpad - sort xpad_device by vendor and product ID
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brenton Simpson <[email protected]>
[ Upstream commit 18970d4f6317a3595cc592c3c7815f63d1818932 ]
This helps making sure there are no duplicate entries in the tables.
Stable-dep-of: ea330429a04b ("Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller")
--- drivers/input/joystick/xpad.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/input/joystick/xpad.c +8 -3
@@ -127,6 +127,7 @@ static const struct xpad_device {u8 mapping;u8 xtype; } xpad_device[] = { +/* Please keep this list sorted by vendor and product ID. */ { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 }, { 0x03eb, 0xff01, "Wooting One (Legacy)", 0, XTYPE_XBOX360 }, { 0x03eb, 0xff02, "Wooting Two (Legacy)", 0, XTYPE_XBOX360 },
@@ -152,9 +153,9 @@ static const struct xpad_device { { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE }, { 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE }, { 0x045e, 0x02e3, "Microsoft X-Box One Elite pad", MAP_PADDLES, XTYPE_XBOXONE }, - { 0x045e, 0x0b00, "Microsoft X-Box One Elite 2 pad", MAP_PADDLES, XTYPE_XBOXONE }, { 0x045e, 0x02ea, "Microsoft X-Box One S pad", 0, XTYPE_XBOXONE }, { 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, + { 0x045e, 0x0b00, "Microsoft X-Box One Elite 2 pad", MAP_PADDLES, XTYPE_XBOXONE }, { 0x045e, 0x0b0a, "Microsoft X-Box Adaptive Controller", MAP_PROFILE_BUTTON, XTYPE_XBOXONE }, { 0x045e, 0x0b12, "Microsoft Xbox Series S|X Controller", MAP_SELECT_BUTTON, XTYPE_XBOXONE }, { 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 },
@@ -343,7 +344,6 @@ static const struct xpad_device { { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE }, { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE }, { 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 }, - { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 }, { 0x24c6, 0x5303, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
@@ -358,9 +358,9 @@ static const struct xpad_device { { 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x5503, "Hori Fighting Edge", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 }, - { 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 }, { 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE }, { 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE }, { 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
@@ -373,6 +373,7 @@ static const struct xpad_device { { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, { 0x2dc8, 0x3106, "8BitDo Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, + { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 }, { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 },
@@ -470,6 +471,10 @@ static const signed short xpad_btn_paddles[] = { { XPAD_XBOXONE_VENDOR_PROTOCOL((vend), 208) }static const struct usb_device_id xpad_table[] = { +/* +* Please keep this list sorted by vendor ID. Note that there are 2 +* macros - XPAD_XBOX360_VENDOR and XPAD_XBOXONE_VENDOR. +*/ {USB_INTERFACE_INFO ('X' ,'B' ,0 ) },/* Xbox USB-IF not-approved class */ XPAD_XBOX360_VENDOR (0x0079 ),/* GPD Win 2 controller */ XPAD_XBOX360_VENDOR (0x03eb ),/* Wooting Keyboards (Legacy) */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/151 Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Kerkmann <[email protected]>
[ Upstream commit ea330429a04b383bd319c66261a5eca4798801e4 ]
This XBOX360 compatible gamepad uses the new product id 0x310a under the 8BitDo's vendor id 0x2dc8. The change was tested using the gamepad in a wired and wireless dongle configuration.
--- drivers/input/joystick/xpad.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/xpad.c +1 -0
@@ -373,6 +373,7 @@ static const struct xpad_device { { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, { 0x2dc8, 0x3106, "8BitDo Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, + { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 }, { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/151 cgroup: Fix potential overflow issue when checking max_depth
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiu Jianfeng <[email protected]>
[ Upstream commit 3cc4e13bb1617f6a13e5e6882465984148743cf4 ]
cgroup.max.depth is the maximum allowed descent depth below the current cgroup. If the actual descent depth is equal or larger, an attempt to create a new child cgroup will fail. However due to the cgroup->max_depth is of int type and having the default value INT_MAX, the condition 'level > cgroup->max_depth' will never be satisfied, and it will cause an overflow of the level after it reaches to INT_MAX.
Fix it by starting the level from 0 and using '>=' instead.
It's worth mentioning that this issue is unlikely to occur in reality, as it's impossible to have a depth of INT_MAX hierarchy, but should be be avoided logically.
--- kernel/cgroup/cgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/cgroup/cgroup.c +2 -2
@@ -5697,7 +5697,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent) {struct cgroup *cgroup;int ret = false; -int level =1 ; +int level =0 ;lockdep_assert_held (&cgroup_mutex);
@@ -5705,7 +5705,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent)if (cgroup->nr_descendants >= cgroup->max_descendants) goto fail; -if (level > cgroup->max_depth) +if (level >= cgroup->max_depth) goto fail; level++;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/151 spi: geni-qcom: Fix boot warning related to pm_runtime and devres
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georgi Djakov <[email protected]>
[ Upstream commit d0ccf760a405d243a49485be0a43bd5b66ed17e2 ]
During boot, users sometimes observe the following warning:
[7.841431] WARNING: CPU: 4 PID: 492 at drivers/interconnect/core.c:685 __icc_enable (drivers/interconnect/core.c:685 (discriminator 7)) [..] [7.841541] Call trace: [7.841542] __icc_enable (drivers/interconnect/core.c:685 (discriminator 7)) [7.841545] icc_disable (drivers/interconnect/core.c:708) [7.841547] geni_icc_disable (drivers/soc/qcom/qcom-geni-se.c:862) [7.841553] spi_geni_runtime_suspend+0x3c/0x4c spi_geni_qcom
This occurs when the spi-geni driver receives an -EPROBE_DEFER error from spi_geni_grab_gpi_chan(), causing devres to start releasing all resources as shown below:
[7.138679] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_icc_release (8 bytes) [7.138751] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_icc_release (8 bytes) [7.138827] geni_spi 880000.spi: DEVRES REL ffff800081443800 pm_runtime_disable_action (16 bytes) [7.139494] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_pm_opp_config_release (16 bytes) [7.139512] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_spi_release_controller (8 bytes) [7.139516] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_clk_release (16 bytes) [7.139519] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_ioremap_release (8 bytes) [7.139524] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_region_release (24 bytes) [7.139527] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_kzalloc_release (22 bytes) [7.139530] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_pinctrl_release (8 bytes) [7.139539] geni_spi 880000.spi: DEVRES REL ffff800081443800 devm_kzalloc_release (40 bytes)
The issue here is that pm_runtime_disable_action() results in a call to spi_geni_runtime_suspend(), which attempts to suspend the device and disable an interconnect path that devm_icc_release() has just released.
Resolve this by calling geni_icc_get() before enabling runtime PM. This approach ensures that when devres releases resources in reverse order, it will start with pm_runtime_disable_action(), suspending the device, and then proceed to free the remaining resources.
--- drivers/spi/spi-geni-qcom.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/spi/spi-geni-qcom.c +5 -3
@@ -1108,6 +1108,11 @@ static int spi_geni_probe(struct platform_device *pdev)init_completion (&mas->tx_reset_done);init_completion (&mas->rx_reset_done);spin_lock_init (&mas->lock); + + ret =geni_icc_get (&mas->se,NULL ); +if (ret) +return ret; +pm_runtime_use_autosuspend (&pdev->dev);pm_runtime_set_autosuspend_delay (&pdev->dev,250 ); ret =devm_pm_runtime_enable (dev);
@@ -1117,9 +1122,6 @@ static int spi_geni_probe(struct platform_device *pdev)if (device_property_read_bool (&pdev->dev,"spi-slave" )) spi->slave = true; - ret =geni_icc_get (&mas->se,NULL ); -if (ret) -return ret;/* Set the bus quota to a reasonable value for register access */ mas->se.icc_paths[GENI_TO_CORE ].avg_bw =Bps_to_icc (CORE_2X_50_MHZ ); mas->se.icc_paths[CPU_TO_GENI ].avg_bw =GENI_DEFAULT_BW ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/151 wifi: iwlegacy: Fix "field-spanning write" warning in il_enqueue_hcmd()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit d4cdc46ca16a5c78b36c5b9b6ad8cac09d6130a0 ]
iwlegacy uses command buffers with a payload size of 320 bytes (default) or 4092 bytes (huge). The struct il_device_cmd type describes the default buffers and there is no separate type describing the huge buffers.
The il_enqueue_hcmd() function works with both default and huge buffers, and has a memcpy() to the buffer payload. The size of this copy may exceed 320 bytes when using a huge buffer, which now results in a run-time warning:
memcpy: detected field-spanning write (size 1014) of single field "&out_cmd->cmd.payload" at drivers/net/wireless/intel/iwlegacy/common.c:3170 (size 320)
To fix this:
- Define a new struct type for huge buffers, with a correctly sized payload field
- When using a huge buffer in il_enqueue_hcmd(), cast the command buffer pointer to that type when looking up the payload field
References: https://bugs.debian.org/1062421
References: https://bugzilla.kernel.org/show_bug.cgi?id=219124
--- drivers/net/wireless/intel/iwlegacy/common.c | 13 ++++++++++++- drivers/net/wireless/intel/iwlegacy/common.h | 12 ++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlegacy/common.c +12 -1
@@ -3119,6 +3119,7 @@ il_enqueue_hcmd(struct il_priv *il, struct il_host_cmd *cmd)struct il_cmd_meta *out_meta;dma_addr_t phys_addr;unsigned long flags; +u8 *out_payload;u32 idx;u16 fix_size;
@@ -3154,6 +3155,16 @@ il_enqueue_hcmd(struct il_priv *il, struct il_host_cmd *cmd) out_cmd = txq->cmd[idx]; out_meta = &txq->meta[idx]; +/* The payload is in the same place in regular and huge +* command buffers, but we need to let the compiler know when +* we're using a larger payload buffer to avoid "field- +* spanning write" warnings at run-time for huge commands. +*/ +if (cmd->flags &CMD_SIZE_HUGE ) + out_payload = ((struct il_device_cmd_huge *)out_cmd)->cmd.payload; +else + out_payload = out_cmd->cmd.payload; +if (WARN_ON (out_meta->flags &CMD_MAPPED )) {spin_unlock_irqrestore (&il->hcmd_lock, flags);return -ENOSPC ;
@@ -3167,7 +3178,7 @@ il_enqueue_hcmd(struct il_priv *il, struct il_host_cmd *cmd) out_meta->callback = cmd->callback; out_cmd->hdr.cmd = cmd->id; -memcpy (&out_cmd->cmd.payload, cmd->data, cmd->len); +memcpy (out_payload, cmd->data, cmd->len);/* At this point, the out_cmd now has all of the incoming cmd * information */
drivers/net/wireless/intel/iwlegacy/common.h +12 -0
@@ -560,6 +560,18 @@ struct il_device_cmd {#define TFD_MAX_PAYLOAD_SIZE (sizeof(struct il_device_cmd)) +/** +* struct il_device_cmd_huge +* +* For use when sending huge commands. +*/ +struct il_device_cmd_huge { +struct il_cmd_header hdr;/* uCode API */ +union { +u8 payload[IL_MAX_CMD_SIZE -sizeof (struct il_cmd_header )]; + } __packed cmd; +} __packed; +struct il_host_cmd {const void *data; unsigned long reply_page;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/151 mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit b3e046c31441d182b954fc2f57b2dc38c71ad4bc ]
When tracing is disabled, there is no point in asking the user about enabling tracing of all mac80211 debug messages.
--- net/mac80211/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/Kconfig +1 -1
@@ -86,7 +86,7 @@ config MAC80211_DEBUGFS config MAC80211_MESSAGE_TRACING bool "Trace all mac80211 debug messages" - depends on MAC80211 + depends on MAC80211 && TRACING help Select this option to have mac80211 register the mac80211_msg trace subsystem with tracepoints to
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/151 wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 52009b419355195912a628d0a9847922e90c348c ]
Sync iterator conditions with ieee80211_iter_keys_rcu.
--- net/mac80211/key.c | 42 +++++++++++++++++++++++++----------------- 1 file changed, 25 insertions(+), 17 deletions(-)
net/mac80211/key.c +25 -17
@@ -989,6 +989,26 @@ void ieee80211_reenable_keys(struct ieee80211_sub_if_data *sdata)mutex_unlock (&sdata->local->key_mtx); } +static void +ieee80211_key_iter (struct ieee80211_hw *hw, +struct ieee80211_vif *vif, +struct ieee80211_key *key, +void (*iter)(struct ieee80211_hw *hw, +struct ieee80211_vif *vif, +struct ieee80211_sta *sta, +struct ieee80211_key_conf *key, +void *data), +void *iter_data) +{ +/* skip keys of station in removal process */ +if (key->sta && key->sta->removed) +return ; +if (!(key->flags &KEY_FLAG_UPLOADED_TO_HARDWARE )) +return ; +iter (hw, vif, key->sta ? &key->sta->sta :NULL , + &key->conf, iter_data); +} + void ieee80211_iter_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif, void (*iter)(struct ieee80211_hw *hw,
@@ -1008,16 +1028,13 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,if (vif) { sdata =vif_to_sdata (vif);list_for_each_entry_safe (key, tmp, &sdata->key_list, list) -iter (hw, &sdata->vif, - key->sta ? &key->sta->sta :NULL , - &key->conf, iter_data); +ieee80211_key_iter (hw, vif, key, iter, iter_data); }else {list_for_each_entry (sdata, &local->interfaces, list)list_for_each_entry_safe (key, tmp, &sdata->key_list, list) -iter (hw, &sdata->vif, - key->sta ? &key->sta->sta :NULL , - &key->conf, iter_data); +ieee80211_key_iter (hw, &sdata->vif, key, + iter, iter_data); }mutex_unlock (&local->key_mtx); }
@@ -1035,17 +1052,8 @@ _ieee80211_iter_keys_rcu(struct ieee80211_hw *hw, {struct ieee80211_key *key; -list_for_each_entry_rcu (key, &sdata->key_list, list) { -/* skip keys of station in removal process */ -if (key->sta && key->sta->removed) -continue ; -if (!(key->flags &KEY_FLAG_UPLOADED_TO_HARDWARE )) -continue ; - -iter (hw, &sdata->vif, - key->sta ? &key->sta->sta :NULL , - &key->conf, iter_data); - } +list_for_each_entry_rcu (key, &sdata->key_list, list) +ieee80211_key_iter (hw, &sdata->vif, key, iter, iter_data); } void ieee80211_iter_keys_rcu(struct ieee80211_hw *hw,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/151 wifi: ath11k: Fix invalid ring usage in full monitor mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
[ Upstream commit befd716ed429b26eca7abde95da6195c548470de ]
On full monitor HW the monitor destination rxdma ring does not have the same descriptor format as in the "classical" mode. The full monitor destination entries are of hal_sw_monitor_ring type and fetched using ath11k_dp_full_mon_process_rx while the classical ones are of type hal_reo_entrance_ring and fetched with ath11k_dp_rx_mon_dest_process.
Although both hal_sw_monitor_ring and hal_reo_entrance_ring are of same size, the offset to useful info (such as sw_cookie, paddr, etc) are different. Thus if ath11k_dp_rx_mon_dest_process gets called on full monitor destination ring, invalid skb buffer id will be fetched from DMA ring causing issues such as the following rcu_sched stall:
rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (1 GPs behind) idle=c67/0/0x7 softirq=45768/45769 fqs=1012 (t=2100 jiffies g=14817 q=8703) Task dump for CPU 0: task:swapper/0 state:R running task stack: 0 pid: 0 ppid: 0 flags:0x0000000a Call trace: dump_backtrace+0x0/0x160 show_stack+0x14/0x20 sched_show_task+0x158/0x184 dump_cpu_task+0x40/0x4c rcu_dump_cpu_stacks+0xec/0x12c rcu_sched_clock_irq+0x6c8/0x8a0 update_process_times+0x88/0xd0 tick_sched_timer+0x74/0x1e0 __hrtimer_run_queues+0x150/0x204 hrtimer_interrupt+0xe4/0x240 arch_timer_handler_phys+0x30/0x40 handle_percpu_devid_irq+0x80/0x130 handle_domain_irq+0x5c/0x90 gic_handle_irq+0x8c/0xb4 do_interrupt_handler+0x30/0x54 el1_interrupt+0x2c/0x4c el1h_64_irq_handler+0x14/0x1c el1h_64_irq+0x74/0x78 do_raw_spin_lock+0x60/0x100 _raw_spin_lock_bh+0x1c/0x2c ath11k_dp_rx_mon_mpdu_pop.constprop.0+0x174/0x650 ath11k_dp_rx_process_mon_status+0x8b4/0xa80 ath11k_dp_rx_process_mon_rings+0x244/0x510 ath11k_dp_service_srng+0x190/0x300 ath11k_pcic_ext_grp_napi_poll+0x30/0xc0 __napi_poll+0x34/0x174 net_rx_action+0xf8/0x2a0 _stext+0x12c/0x2ac irq_exit+0x94/0xc0 handle_domain_irq+0x60/0x90 gic_handle_irq+0x8c/0xb4 call_on_irq_stack+0x28/0x44 do_interrupt_handler+0x4c/0x54 el1_interrupt+0x2c/0x4c el1h_64_irq_handler+0x14/0x1c el1h_64_irq+0x74/0x78 arch_cpu_idle+0x14/0x20 do_idle+0xf0/0x130 cpu_startup_entry+0x24/0x50 rest_init+0xf8/0x104 arch_call_rest_init+0xc/0x14 start_kernel+0x56c/0x58c __primary_switched+0xa0/0xa8
Thus ath11k_dp_rx_mon_dest_process(), which use classical destination entry format, should no be called on full monitor capable HW.
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +5 -2
@@ -5240,8 +5240,11 @@ int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id, hal_status == HAL_TLV_STATUS_PPDU_DONE) { rx_mon_stats->status_ppdu_done++; pmon->mon_ppdu_status =DP_PPDU_STATUS_DONE ; -ath11k_dp_rx_mon_dest_process (ar, mac_id, budget, napi); - pmon->mon_ppdu_status =DP_PPDU_STATUS_START ; +if (!ab->hw_params.full_monitor_mode) { +ath11k_dp_rx_mon_dest_process (ar, mac_id, + budget, napi); + pmon->mon_ppdu_status =DP_PPDU_STATUS_START ; + } } if (ppdu_info->peer_id == HAL_INVALID_PEERID ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/151 wifi: brcm80211: BRCM_TRACING should depend on TRACING
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit b73b2069528f90ec49d5fa1010a759baa2c2be05 ]
When tracing is disabled, there is no point in asking the user about enabling Broadcom wireless device tracing.
--- drivers/net/wireless/broadcom/brcm80211/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/broadcom/brcm80211/Kconfig +1 -0
@@ -27,6 +27,7 @@ source "drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig" config BRCM_TRACING bool "Broadcom device tracing" depends on BRCMSMAC || BRCMFMAC + depends on TRACING help If you say Y here, the Broadcom wireless drivers will register with ftrace to dump event information into the trace ringbuffer.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/151 RDMA/cxgb4: Dump vendor specific QP details
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 89f8c6f197f480fe05edf91eb9359d5425869d04 ]
Restore the missing functionality to dump vendor specific QP details, which was mistakenly removed in the commit mentioned in Fixes line.
--- drivers/infiniband/hw/cxgb4/provider.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/cxgb4/provider.c +1 -0
@@ -474,6 +474,7 @@ static const struct ib_device_ops c4iw_dev_ops = { .fill_res_cq_entry = c4iw_fill_res_cq_entry, .fill_res_cm_id_entry = c4iw_fill_res_cm_id_entry, .fill_res_mr_entry = c4iw_fill_res_mr_entry, + .fill_res_qp_entry = c4iw_fill_res_qp_entry, .get_dev_fw_str = get_dev_fw_str, .get_dma_mr = c4iw_get_dma_mr, .get_hw_stats = c4iw_get_mib,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/151 RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 78ed28e08e74da6265e49e19206e1bcb8b9a7f0d ]
After the cited commit below max_dest_rd_atomic and max_rd_atomic values are being rounded down to the next power of 2. As opposed to the old behavior and mlx4 driver where they used to be rounded up instead.
In order to stay consistent with older code and other drivers, revert to using fls round function which rounds up to the next power of 2.
--- drivers/infiniband/hw/mlx5/qp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/qp.c +2 -2
@@ -4272,14 +4272,14 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,MLX5_SET (qpc, qpc, retry_count, attr->retry_cnt);if (attr_mask &IB_QP_MAX_QP_RD_ATOMIC && attr->max_rd_atomic) -MLX5_SET (qpc, qpc, log_sra_max,ilog2 (attr->max_rd_atomic)); +MLX5_SET (qpc, qpc, log_sra_max,fls (attr->max_rd_atomic -1 ));if (attr_mask &IB_QP_SQ_PSN )MLX5_SET (qpc, qpc, next_send_psn, attr->sq_psn);if (attr_mask &IB_QP_MAX_DEST_RD_ATOMIC && attr->max_dest_rd_atomic)MLX5_SET (qpc, qpc, log_rra_max, -ilog2 (attr->max_dest_rd_atomic)); +fls (attr->max_dest_rd_atomic -1 ));if (attr_mask & (IB_QP_ACCESS_FLAGS |IB_QP_MAX_DEST_RD_ATOMIC )) { err =set_qpc_atomic_flags (qp, attr, attr_mask, qpc);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/151 RDMA/bnxt_re: Fix the usage of control path spin locks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <[email protected]>
[ Upstream commit d71f4acd584cc861f54b3cb3ac07875f06550a05 ]
Control path completion processing always runs in tasklet context. To synchronize with the posting thread, there is no need to use the irq variant of spin lock. Use spin_lock_bh instead.
--- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 25 +++++++++------------- 1 file changed, 10 insertions(+), 15 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +10 -15
@@ -290,7 +290,6 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw,struct bnxt_qplib_hwq *hwq;u32 sw_prod, cmdq_prod;struct pci_dev *pdev; -unsigned long flags;u16 cookie;u8 *preq;
@@ -301,7 +300,7 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw,/* Cmdq are in 16-byte units, each request can consume 1 or more * cmdqe */ -spin_lock_irqsave (&hwq->lock, flags); +spin_lock_bh (&hwq->lock); required_slots =bnxt_qplib_get_cmd_slots (msg->req); free_slots =HWQ_FREE_SLOTS (hwq); cookie = cmdq->seq_num &RCFW_MAX_COOKIE_VALUE ;
@@ -311,7 +310,7 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw,dev_info_ratelimited (&pdev->dev,"CMDQ is full req/free %d/%d!" , required_slots, free_slots); -spin_unlock_irqrestore (&hwq->lock, flags); +spin_unlock_bh (&hwq->lock);return -EAGAIN ; }if (msg->block)
@@ -367,7 +366,7 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw,wmb ();writel (cmdq_prod, cmdq->cmdq_mbox.prod);writel (RCFW_CMDQ_TRIG_VAL , cmdq->cmdq_mbox.db); -spin_unlock_irqrestore (&hwq->lock, flags); +spin_unlock_bh (&hwq->lock);/* Return the CREQ response pointer */ return 0 ; }
@@ -486,7 +485,6 @@ static int __bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw, {struct creq_qp_event *evnt = (struct creq_qp_event *)msg->resp;struct bnxt_qplib_crsqe *crsqe; -unsigned long flags;u16 cookie;int rc;u8 opcode;
@@ -512,12 +510,12 @@ static int __bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw, rc =__poll_for_resp (rcfw, cookie);if (rc) { -spin_lock_irqsave (&rcfw->cmdq.hwq.lock, flags); +spin_lock_bh (&rcfw->cmdq.hwq.lock); crsqe = &rcfw->crsqe_tbl[cookie]; crsqe->is_waiter_alive = false;if (rc == -ENODEV )set_bit (FIRMWARE_STALL_DETECTED , &rcfw->cmdq.flags); -spin_unlock_irqrestore (&rcfw->cmdq.hwq.lock, flags); +spin_unlock_bh (&rcfw->cmdq.hwq.lock);return -ETIMEDOUT ; }
@@ -628,7 +626,6 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,u16 cookie, blocked =0 ;bool is_waiter_alive;struct pci_dev *pdev; -unsigned long flags;u32 wait_cmds =0 ;int rc =0 ;
@@ -659,8 +656,7 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,* */ -spin_lock_irqsave_nested (&hwq->lock, flags, -SINGLE_DEPTH_NESTING ); +spin_lock_nested (&hwq->lock,SINGLE_DEPTH_NESTING ); cookie =le16_to_cpu (qp_event->cookie); blocked = cookie &RCFW_CMD_IS_BLOCKING ; cookie &=RCFW_MAX_COOKIE_VALUE ;
@@ -672,7 +668,7 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,dev_info (&pdev->dev,"rcfw timedout: cookie = %#x, free_slots = %d" , cookie, crsqe->free_slots); -spin_unlock_irqrestore (&hwq->lock, flags); +spin_unlock (&hwq->lock);return rc; }
@@ -720,7 +716,7 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,__destroy_timedout_ah (rcfw, (struct creq_create_ah_resp *) qp_event); -spin_unlock_irqrestore (&hwq->lock, flags); +spin_unlock (&hwq->lock); } *num_wait += wait_cmds;return rc;
@@ -734,12 +730,11 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t)u32 type, budget =CREQ_ENTRY_POLL_BUDGET ;struct bnxt_qplib_hwq *hwq = &creq->hwq;struct creq_base *creqe; -unsigned long flags;u32 num_wakeup =0 ;u32 hw_polled =0 ;/* Service the CREQ until budget is over */ -spin_lock_irqsave (&hwq->lock, flags); +spin_lock_bh (&hwq->lock);while (budget >0 ) { creqe =bnxt_qplib_get_qe (hwq, hwq->cons,NULL );if (!CREQ_CMP_VALID (creqe, creq->creq_db.dbinfo.flags))
@@ -782,7 +777,7 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t)if (hw_polled)bnxt_qplib_ring_nq_db (&creq->creq_db.dbinfo, rcfw->res->cctx, true); -spin_unlock_irqrestore (&hwq->lock, flags); +spin_unlock_bh (&hwq->lock);if (num_wakeup)wake_up_nr (&rcfw->cmdq.waitq, num_wakeup); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/151 RDMA/bnxt_re: synchronize the qp-handle table array
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <[email protected]>
[ Upstream commit 76d3ddff7153cc0bcc14a63798d19f5d0693ea71 ]
There is a race between the CREQ tasklet and destroy qp when accessing the qp-handle table. There is a chance of reading a valid qp-handle in the CREQ tasklet handler while the QP is already moving ahead with the destruction.
Fixing this race by implementing a table-lock to synchronize the access.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 4 ++++ drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 13 +++++++++---- drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 2 ++ 3 files changed, 15 insertions(+), 4 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +4 -0
@@ -1513,9 +1513,11 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,u32 tbl_indx;int rc; +spin_lock_bh (&rcfw->tbl_lock); tbl_indx =map_qp_id_to_tbl_indx (qp->id, rcfw); rcfw->qp_tbl[tbl_indx].qp_id =BNXT_QPLIB_QP_ID_INVALID ; rcfw->qp_tbl[tbl_indx].qp_handle =NULL ; +spin_unlock_bh (&rcfw->tbl_lock); bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, CMDQ_BASE_OPCODE_DESTROY_QP,
@@ -1526,8 +1528,10 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res, sizeof(resp), 0); rc =bnxt_qplib_rcfw_send_message (rcfw, &msg);if (rc) { +spin_lock_bh (&rcfw->tbl_lock); rcfw->qp_tbl[tbl_indx].qp_id = qp->id; rcfw->qp_tbl[tbl_indx].qp_handle = qp; +spin_unlock_bh (&rcfw->tbl_lock);return rc; }
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +9 -4
@@ -634,17 +634,21 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,case CREQ_QP_EVENT_EVENT_QP_ERROR_NOTIFICATION : err_event = (struct creq_qp_error_notification *)qp_event; qp_id =le32_to_cpu (err_event->xid); +spin_lock (&rcfw->tbl_lock); tbl_indx =map_qp_id_to_tbl_indx (qp_id, rcfw); qp = rcfw->qp_tbl[tbl_indx].qp_handle; +if (!qp) { +spin_unlock (&rcfw->tbl_lock); +break ; + } +bnxt_qplib_mark_qp_error (qp); + rc = rcfw->creq.aeq_handler (rcfw, qp_event, qp); +spin_unlock (&rcfw->tbl_lock);dev_dbg (&pdev->dev,"Received QP error notification\n" );dev_dbg (&pdev->dev,"qpid 0x%x, req_err=0x%x, resp_err=0x%x\n" , qp_id, err_event->req_err_state_reason, err_event->res_err_state_reason); -if (!qp) -break ; -bnxt_qplib_mark_qp_error (qp); - rc = rcfw->creq.aeq_handler (rcfw, qp_event, qp);break ;default :/*
@@ -973,6 +977,7 @@ int bnxt_qplib_alloc_rcfw_channel(struct bnxt_qplib_res *res, GFP_KERNEL);if (!rcfw->qp_tbl) goto fail; +spin_lock_init (&rcfw->tbl_lock); rcfw->max_timeout = res->cctx->hwrm_cmd_max_timeout;
drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +2 -0
@@ -224,6 +224,8 @@ struct bnxt_qplib_rcfw {struct bnxt_qplib_crsqe *crsqe_tbl;int qp_tbl_size;struct bnxt_qplib_qp_node *qp_tbl; +/* To synchronize the qp-handle hash table */ +spinlock_t tbl_lock;u64 oos_prev;u32 init_oos_stats;u32 cmdq_depth;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/151 wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit e50a88e5cb8792cc416866496288c5f4d1eb4b1f ]
This will allow to reconnect immediately instead of leaving the connection in a limbo state.
Stable-dep-of: 07a6e3b78a65 ("wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()")
--- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/fw.c +13 -1
@@ -1394,6 +1394,13 @@ void iwl_mvm_get_acpi_tables(struct iwl_mvm *mvm)#endif /* CONFIG_ACPI */ +static void iwl_mvm_disconnect_iterator (void *data,u8 *mac, +struct ieee80211_vif *vif) +{ +if (vif->type ==NL80211_IFTYPE_STATION ) +ieee80211_hw_restart_disconnect (vif); +} +void iwl_mvm_send_recovery_cmd (struct iwl_mvm *mvm,u32 flags) {u32 error_log_size = mvm->fw->ucode_capa.error_log_size;
@@ -1438,10 +1445,15 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)/* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */ if (flags &ERROR_RECOVERY_UPDATE_DB ) { resp =le32_to_cpu (*(__le32 *)host_cmd.resp_pkt->data); -if (resp) +if (resp) {IWL_ERR (mvm,"Failed to send recovery cmd blob was invalid %d\n" , resp); + +ieee80211_iterate_interfaces (mvm->hw,0 , + iwl_mvm_disconnect_iterator, + mvm); + } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/151 wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gabay <[email protected]>
[ Upstream commit 07a6e3b78a65f4b2796a8d0d4adb1a15a81edead ]
1. The size of the response packet is not validated.
2. The response buffer is not freed.
Resolve these issues by switching to iwl_mvm_send_cmd_status(), which handles both size validation and frees the buffer.
--- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/fw.c +4 -6
@@ -1404,8 +1404,8 @@ static void iwl_mvm_disconnect_iterator(void *data, u8 *mac,void iwl_mvm_send_recovery_cmd (struct iwl_mvm *mvm,u32 flags) {u32 error_log_size = mvm->fw->ucode_capa.error_log_size; +u32 status =0 ;int ret; -u32 resp;struct iwl_fw_error_recovery_cmd recovery_cmd = { .flags =cpu_to_le32 (flags),
@@ -1413,7 +1413,6 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) };struct iwl_host_cmd host_cmd = { .id =WIDE_ID (SYSTEM_GROUP ,FW_ERROR_RECOVERY_CMD ), - .flags =CMD_WANT_SKB , .data = {&recovery_cmd, }, .len = {sizeof (recovery_cmd), }, };
@@ -1433,7 +1432,7 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) recovery_cmd.buf_size =cpu_to_le32 (error_log_size); } - ret =iwl_mvm_send_cmd (mvm, &host_cmd); + ret =iwl_mvm_send_cmd_status (mvm, &host_cmd, &status);kfree (mvm->error_recovery_buf); mvm->error_recovery_buf =NULL ;
@@ -1444,11 +1443,10 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)/* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */ if (flags &ERROR_RECOVERY_UPDATE_DB ) { - resp =le32_to_cpu (*(__le32 *)host_cmd.resp_pkt->data); -if (resp) { +if (status) {IWL_ERR (mvm,"Failed to send recovery cmd blob was invalid %d\n" , - resp); + status); ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_disconnect_iterator,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/151 wifi: iwlwifi: mvm: dont add default link in fw restart flow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 734a377e1eacc5153bae0ccd4423365726876e93 ]
When we add the vif (and its default link) in fw restart we may override the link that already exists. We take care of this but if link 0 is a valid MLO link, then we will re-create a default link on mvmvif->link[0] and we'll loose the real link we had there.
In non-MLO, we need to re-create the default link upon the interface creation, this is fine. In MLO, we'll just wait for change_vif_links() to re-build the links.
--- .../wireless/intel/iwlwifi/mvm/mld-mac80211.c | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c +18 -6
@@ -39,8 +39,6 @@ static int iwl_mvm_mld_mac_add_interface(struct ieee80211_hw *hw,/* reset deflink MLO parameters */ mvmvif->deflink.fw_link_id =IWL_MVM_FW_LINK_ID_INVALID ; mvmvif->deflink.active =0 ; -/* the first link always points to the default one */ - mvmvif->link[0 ] = &mvmvif->deflink; ret =iwl_mvm_mld_mac_ctxt_add (mvm, vif);if (ret)
@@ -58,9 +56,19 @@ static int iwl_mvm_mld_mac_add_interface(struct ieee80211_hw *hw,IEEE80211_VIF_SUPPORTS_CQM_RSSI ; } - ret =iwl_mvm_add_link (mvm, vif, &vif->bss_conf); -if (ret) - goto out_free_bf; +/* We want link[0] to point to the default link, unless we have MLO and +* in this case this will be modified later by .change_vif_links() +* If we are in the restart flow with an MLD connection, we will wait +* to .change_vif_links() to setup the links. +*/ +if (!test_bit (IWL_MVM_STATUS_IN_HW_RESTART , &mvm->status) || + !ieee80211_vif_is_mld (vif)) { + mvmvif->link[0 ] = &mvmvif->deflink; + + ret =iwl_mvm_add_link (mvm, vif, &vif->bss_conf); +if (ret) + goto out_free_bf; + }/* Save a pointer to p2p device vif, so it can later be used to * update the p2p device MAC when a GO is started/stopped
@@ -1015,7 +1023,11 @@ iwl_mvm_mld_change_vif_links(struct ieee80211_hw *hw,mutex_lock (&mvm->mutex); -if (old_links ==0 ) { +/* If we're in RESTART flow, the default link wasn't added in +* drv_add_interface(), and link[0] doesn't point to it. +*/ +if (old_links ==0 && !test_bit (IWL_MVM_STATUS_IN_HW_RESTART , + &mvm->status)) { err =iwl_mvm_disable_link (mvm, vif, &vif->bss_conf);if (err) goto out_err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/151 ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit d221b844ee79823ffc29b7badc4010bdb0960224 ]
If devm_gpiod_get_optional() fails, we need to disable previously enabled regulators, as done in the other error handling path of the function.
Also, gpiod_set_value_cansleep(, 1) needs to be called to undo a potential gpiod_set_value_cansleep(, 0).
If the "reset" gpio is not defined, this additional call is just a no-op.
This behavior is the same as the one already in the .remove() function.
--- sound/soc/codecs/cs42l51.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/soc/codecs/cs42l51.c +5 -2
@@ -747,8 +747,10 @@ int cs42l51_probe(struct device *dev, struct regmap *regmap) cs42l51->reset_gpio =devm_gpiod_get_optional (dev,"reset" ,GPIOD_OUT_LOW ); -if (IS_ERR (cs42l51->reset_gpio)) -return PTR_ERR (cs42l51->reset_gpio); +if (IS_ERR (cs42l51->reset_gpio)) { + ret =PTR_ERR (cs42l51->reset_gpio); + goto error; + }if (cs42l51->reset_gpio) {dev_dbg (dev,"Release reset gpio\n" );
@@ -780,6 +782,7 @@ int cs42l51_probe(struct device *dev, struct regmap *regmap)return 0 ; error: +gpiod_set_value_cansleep (cs42l51->reset_gpio,1 );regulator_bulk_disable (ARRAY_SIZE (cs42l51->supplies), cs42l51->supplies);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/151 macsec: Fix use-after-free while sending the offloading packet
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit f1e54d11b210b53d418ff1476c6b58a2f434dfc0 ]
KASAN reports the following UAF. The metadata_dst, which is used to store the SCI value for macsec offload, is already freed by metadata_dst_free() in macsec_free_netdev(), while driver still use it for sending the packet.
To fix this issue, dst_release() is used instead to release metadata_dst. So it is not freed instantly in macsec_free_netdev() if still referenced by skb.
BUG: KASAN: slab-use-after-free in mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] Read of size 2 at addr ffff88813e42e038 by task kworker/7:2/714 [...] Workqueue: mld mld_ifc_work Call Trace: <TASK> dump_stack_lvl+0x51/0x60 print_report+0xc1/0x600 kasan_report+0xab/0xe0 mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] dev_hard_start_xmit+0x120/0x530 sch_direct_xmit+0x149/0x11e0 __qdisc_run+0x3ad/0x1730 __dev_queue_xmit+0x1196/0x2ed0 vlan_dev_hard_start_xmit+0x32e/0x510 [8021q] dev_hard_start_xmit+0x120/0x530 __dev_queue_xmit+0x14a7/0x2ed0 macsec_start_xmit+0x13e9/0x2340 dev_hard_start_xmit+0x120/0x530 __dev_queue_xmit+0x14a7/0x2ed0 ip6_finish_output2+0x923/0x1a70 ip6_finish_output+0x2d7/0x970 ip6_output+0x1ce/0x3a0 NF_HOOK.constprop.0+0x15f/0x190 mld_sendpack+0x59a/0xbd0 mld_ifc_work+0x48a/0xa80 process_one_work+0x5aa/0xe50 worker_thread+0x79c/0x1290 kthread+0x28f/0x350 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x11/0x20 </TASK> Allocated by task 3922: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x77/0x90 __kmalloc_noprof+0x188/0x400 metadata_dst_alloc+0x1f/0x4e0 macsec_newlink+0x914/0x1410 __rtnl_newlink+0xe08/0x15b0 rtnl_newlink+0x5f/0x90 rtnetlink_rcv_msg+0x667/0xa80 netlink_rcv_skb+0x12c/0x360 netlink_unicast+0x551/0x770 netlink_sendmsg+0x72d/0xbd0 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x52e/0x6a0 ___sys_sendmsg+0xeb/0x170 __sys_sendmsg+0xb5/0x140 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 4011: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x50 poison_slab_object+0x10c/0x190 __kasan_slab_free+0x11/0x30 kfree+0xe0/0x290 macsec_free_netdev+0x3f/0x140 netdev_run_todo+0x450/0xc70 rtnetlink_rcv_msg+0x66f/0xa80 netlink_rcv_skb+0x12c/0x360 netlink_unicast+0x551/0x770 netlink_sendmsg+0x72d/0xbd0 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x52e/0x6a0 ___sys_sendmsg+0xeb/0x170 __sys_sendmsg+0xb5/0x140 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53
--- drivers/net/macsec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/macsec.c +1 -2
@@ -3715,8 +3715,7 @@ static void macsec_free_netdev(struct net_device *dev) {struct macsec_dev *macsec =macsec_priv (dev); -if (macsec->secy.tx_sc.md_dst) -metadata_dst_free (macsec->secy.tx_sc.md_dst); +dst_release (&macsec->secy.tx_sc.md_dst->dst);free_percpu (macsec->stats);free_percpu (macsec->secy.tx_sc.stats);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/151 net: stmmac: dwmac4: Fix high address display by updating reg_space[] from register values
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ley Foon Tan <[email protected]>
[ Upstream commit f84ef58e553206b02d06e02158c98fbccba25d19 ]
The high address will display as 0 if the driver does not set the reg_space[]. To fix this, read the high address registers and update the reg_space[] accordingly.
--- drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 8 ++++++++ drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h | 2 ++ 2 files changed, 10 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c +8 -0
@@ -203,8 +203,12 @@ static void _dwmac4_dump_dma_regs(struct stmmac_priv *priv,readl (ioaddr +DMA_CHAN_TX_CONTROL (dwmac4_addrs, channel)); reg_space[DMA_CHAN_RX_CONTROL (default_addrs, channel) /4 ] =readl (ioaddr +DMA_CHAN_RX_CONTROL (dwmac4_addrs, channel)); + reg_space[DMA_CHAN_TX_BASE_ADDR_HI (default_addrs, channel) /4 ] = +readl (ioaddr +DMA_CHAN_TX_BASE_ADDR_HI (dwmac4_addrs, channel)); reg_space[DMA_CHAN_TX_BASE_ADDR (default_addrs, channel) /4 ] =readl (ioaddr +DMA_CHAN_TX_BASE_ADDR (dwmac4_addrs, channel)); + reg_space[DMA_CHAN_RX_BASE_ADDR_HI (default_addrs, channel) /4 ] = +readl (ioaddr +DMA_CHAN_RX_BASE_ADDR_HI (dwmac4_addrs, channel)); reg_space[DMA_CHAN_RX_BASE_ADDR (default_addrs, channel) /4 ] =readl (ioaddr +DMA_CHAN_RX_BASE_ADDR (dwmac4_addrs, channel)); reg_space[DMA_CHAN_TX_END_ADDR(default_addrs, channel) / 4] =
@@ -225,8 +229,12 @@ static void _dwmac4_dump_dma_regs(struct stmmac_priv *priv,readl (ioaddr +DMA_CHAN_CUR_TX_DESC (dwmac4_addrs, channel)); reg_space[DMA_CHAN_CUR_RX_DESC (default_addrs, channel) /4 ] =readl (ioaddr +DMA_CHAN_CUR_RX_DESC (dwmac4_addrs, channel)); + reg_space[DMA_CHAN_CUR_TX_BUF_ADDR_HI (default_addrs, channel) /4 ] = +readl (ioaddr +DMA_CHAN_CUR_TX_BUF_ADDR_HI (dwmac4_addrs, channel)); reg_space[DMA_CHAN_CUR_TX_BUF_ADDR (default_addrs, channel) /4 ] =readl (ioaddr +DMA_CHAN_CUR_TX_BUF_ADDR (dwmac4_addrs, channel)); + reg_space[DMA_CHAN_CUR_RX_BUF_ADDR_HI (default_addrs, channel) /4 ] = +readl (ioaddr +DMA_CHAN_CUR_RX_BUF_ADDR_HI (dwmac4_addrs, channel)); reg_space[DMA_CHAN_CUR_RX_BUF_ADDR (default_addrs, channel) /4 ] =readl (ioaddr +DMA_CHAN_CUR_RX_BUF_ADDR (dwmac4_addrs, channel)); reg_space[DMA_CHAN_STATUS(default_addrs, channel) / 4] =
drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h +2 -0
@@ -127,7 +127,9 @@ static inline u32 dma_chanx_base_addr(const struct dwmac4_addrs *addrs,#define DMA_CHAN_SLOT_CTRL_STATUS (addrs, x) (dma_chanx_base_addr(addrs, x) + 0x3c)#define DMA_CHAN_CUR_TX_DESC (addrs, x) (dma_chanx_base_addr(addrs, x) + 0x44)#define DMA_CHAN_CUR_RX_DESC (addrs, x) (dma_chanx_base_addr(addrs, x) + 0x4c) +#define DMA_CHAN_CUR_TX_BUF_ADDR_HI (addrs, x) (dma_chanx_base_addr(addrs, x) + 0x50)#define DMA_CHAN_CUR_TX_BUF_ADDR (addrs, x) (dma_chanx_base_addr(addrs, x) + 0x54) +#define DMA_CHAN_CUR_RX_BUF_ADDR_HI (addrs, x) (dma_chanx_base_addr(addrs, x) + 0x58)#define DMA_CHAN_CUR_RX_BUF_ADDR (addrs, x) (dma_chanx_base_addr(addrs, x) + 0x5c)#define DMA_CHAN_STATUS (addrs, x) (dma_chanx_base_addr(addrs, x) + 0x60)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/151 net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Furong Xu <[email protected]>
[ Upstream commit 66600fac7a984dea4ae095411f644770b2561ede ]
In case the non-paged data of a SKB carries protocol header and protocol payload to be transmitted on a certain platform that the DMA AXI address width is configured to 40-bit/48-bit, or the size of the non-paged data is bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI address width is configured to 32-bit, then this SKB requires at least two DMA transmit descriptors to serve it.
For example, three descriptors are allocated to split one DMA buffer mapped from one piece of non-paged data:
dma_desc[N + 0],
dma_desc[N + 1],
dma_desc[N + 2].
Then three elements of tx_q->tx_skbuff_dma[] will be allocated to hold
extra information to be reused in stmmac_tx_clean():
tx_q->tx_skbuff_dma[N + 0],
tx_q->tx_skbuff_dma[N + 1],
tx_q->tx_skbuff_dma[N + 2].Now we focus on tx_q->tx_skbuff_dma[entry].buf, which is the DMA buffer address returned by DMA mapping call. stmmac_tx_clean() will try to unmap the DMA buffer _ONLY_IF_ tx_q->tx_skbuff_dma[entry].buf is a valid buffer address.
The expected behavior that saves DMA buffer address of this non-paged data to tx_q->tx_skbuff_dma[entry].buf is:
tx_q->tx_skbuff_dma[N + 0].buf = NULL;
tx_q->tx_skbuff_dma[N + 1].buf = NULL;
tx_q->tx_skbuff_dma[N + 2].buf = dma_map_single();
Unfortunately, the current code misbehaves like this:
tx_q->tx_skbuff_dma[N + 0].buf = dma_map_single();
tx_q->tx_skbuff_dma[N + 1].buf = NULL;
tx_q->tx_skbuff_dma[N + 2].buf = NULL;On the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the DMA engine, tx_q->tx_skbuff_dma[N + 0].buf is a valid buffer address obviously, then the DMA buffer will be unmapped immediately. There may be a rare case that the DMA engine does not finish the pending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go horribly wrong, DMA is going to access a unmapped/unreferenced memory region, corrupted data will be transmited or iommu fault will be triggered :(
In contrast, the for-loop that maps SKB fragments behaves perfectly as expected, and that is how the driver should do for both non-paged data and paged frags actually.
This patch corrects DMA map/unmap sequences by fixing the array index for tx_q->tx_skbuff_dma[entry].buf when assigning DMA buffer address.
Tested and verified on DWXGMAC CORE 3.20a
--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 22 ++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +17 -5
@@ -4196,11 +4196,6 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)if (dma_mapping_error (priv->device, des)) goto dma_map_err; - tx_q->tx_skbuff_dma[first_entry].buf = des; - tx_q->tx_skbuff_dma[first_entry].len =skb_headlen (skb); - tx_q->tx_skbuff_dma[first_entry].map_as_page = false; - tx_q->tx_skbuff_dma[first_entry].buf_type =STMMAC_TXBUF_T_SKB ; -if (priv->dma_cap.addr64 <=32 ) { first->des0 =cpu_to_le32 (des);
@@ -4219,6 +4214,23 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)stmmac_tso_allocator (priv, des, tmp_pay_len, (nfrags ==0 ), queue); +/* In case two or more DMA transmit descriptors are allocated for this +* non-paged SKB data, the DMA buffer address should be saved to +* tx_q->tx_skbuff_dma[].buf corresponding to the last descriptor, +* and leave the other tx_q->tx_skbuff_dma[].buf as NULL to guarantee +* that stmmac_tx_clean() does not unmap the entire DMA buffer too early +* since the tail areas of the DMA buffer can be accessed by DMA engine +* sooner or later. +* By saving the DMA buffer address to tx_q->tx_skbuff_dma[].buf +* corresponding to the last descriptor, stmmac_tx_clean() will unmap +* this DMA buffer right after the DMA engine completely finishes the +* full buffer transmission. +*/ + tx_q->tx_skbuff_dma[tx_q->cur_tx].buf = des; + tx_q->tx_skbuff_dma[tx_q->cur_tx].len =skb_headlen (skb); + tx_q->tx_skbuff_dma[tx_q->cur_tx].map_as_page = false; + tx_q->tx_skbuff_dma[tx_q->cur_tx].buf_type =STMMAC_TXBUF_T_SKB ; +/* Prepare fragments */ for (i =0 ; i < nfrags; i++) {const skb_frag_t *frag = &skb_shinfo (skb)->frags[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/151 igb: Disable threaded IRQ for igb_msix_other
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wander Lairson Costa <[email protected]>
[ Upstream commit 338c4d3902feb5be49bfda530a72c7ab860e2c9f ]
During testing of SR-IOV, Red Hat QE encountered an issue where the ip link up command intermittently fails for the igbvf interfaces when using the PREEMPT_RT variant. Investigation revealed that e1000_write_posted_mbx returns an error due to the lack of an ACK from e1000_poll_for_ack.
The underlying issue arises from the fact that IRQs are threaded by default under PREEMPT_RT. While the exact hardware details are not available, it appears that the IRQ handled by igb_msix_other must be processed before e1000_poll_for_ack times out. However, e1000_write_posted_mbx is called with preemption disabled, leading to a scenario where the IRQ is serviced only after the failure of e1000_write_posted_mbx.
To resolve this, we set IRQF_NO_THREAD for the affected interrupt, ensuring that the kernel handles it immediately, thereby preventing the aforementioned error.
Reproducer:
#!/bin/bash
# echo 2 > /sys/class/net/ens14f0/device/sriov_numvfs
ipaddr_vlan=3
nic_test=ens14f0
vf=${nic_test}v0
while true; do
ip link set ${nic_test} mtu 1500
ip link set ${vf} mtu 1500
ip link set $vf up
ip link set ${nic_test} vf 0 vlan ${ipaddr_vlan}
ip addr add 172.30.${ipaddr_vlan}.1/24 dev ${vf}
ip addr add 2021:db8:${ipaddr_vlan}::1/64 dev ${vf}
if ! ip link show $vf | grep 'state UP'; then
echo 'Error found'
break
fi
ip link set $vf down
done--- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/igb/igb_main.c +1 -1
@@ -935,7 +935,7 @@ static int igb_request_msix(struct igb_adapter *adapter)int i, err =0 , vector =0 , free_vector =0 ; err =request_irq (adapter->msix_entries[vector].vector, - igb_msix_other,0 , netdev->name, adapter); + igb_msix_other,IRQF_NO_THREAD , netdev->name, adapter);if (err) goto err_out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/151 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit ad4a3ca6a8e886f6491910a3ae5d53595e40597d ]
There are code paths from which the function is called without holding the RCU read lock, resulting in a suspicious RCU usage warning [1].
Fix by using l3mdev_master_upper_ifindex_by_index() which will acquire the RCU read lock before calling l3mdev_master_upper_ifindex_by_index_rcu().
[1]
WARNING: suspicious RCU usage 6.12.0-rc3-custom-gac8f72681cf2 #141 Not tainted
-----------------------------net/core/dev.c:876 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/361:
#0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60
stack backtrace: CPU: 3 UID: 0 PID: 361 Comm: ip Not tainted 6.12.0-rc3-custom-gac8f72681cf2 #141 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0xba/0x110 lockdep_rcu_suspicious.cold+0x4f/0xd6 dev_get_by_index_rcu+0x1d3/0x210 l3mdev_master_upper_ifindex_by_index_rcu+0x2b/0xf0 ip_tunnel_bind_dev+0x72f/0xa00 ip_tunnel_newlink+0x368/0x7a0 ipgre_newlink+0x14c/0x170 __rtnl_newlink+0x1173/0x19c0 rtnl_newlink+0x6c/0xa0 rtnetlink_rcv_msg+0x3cc/0xf60 netlink_rcv_skb+0x171/0x450 netlink_unicast+0x539/0x7f0 netlink_sendmsg+0x8c1/0xd80 ____sys_sendmsg+0x8f9/0xc20 ___sys_sendmsg+0x197/0x1e0 __sys_sendmsg+0x122/0x1f0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- include/net/ip_tunnels.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/ip_tunnels.h +1 -1
@@ -260,7 +260,7 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4,memset (fl4,0 ,sizeof (*fl4));if (oif) { - fl4->flowi4_l3mdev =l3mdev_master_upper_ifindex_by_index_rcu (net, oif); + fl4->flowi4_l3mdev =l3mdev_master_upper_ifindex_by_index (net, oif);/* Legacy VRF/l3mdev use case */ fl4->flowi4_oif = fl4->flowi4_l3mdev ?0 : oif; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/151 gtp: allow -1 to be specified as file description from userspace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 7515e37bce5c428a56a9b04ea7e96b3f53f17150 ]
Existing user space applications maintained by the Osmocom project are breaking since a recent fix that addresses incorrect error checking.
Restore operation for user space programs that specify -1 as file descriptor to skip GTPv0 or GTPv1 only sockets.
--- drivers/net/gtp.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
drivers/net/gtp.c +13 -9
@@ -1263,20 +1263,24 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[])return -EINVAL ;if (data[IFLA_GTP_FD0 ]) { -u32 fd0 =nla_get_u32 (data[IFLA_GTP_FD0 ]); +int fd0 =nla_get_u32 (data[IFLA_GTP_FD0 ]); - sk0 =gtp_encap_enable_socket (fd0,UDP_ENCAP_GTP0 , gtp); -if (IS_ERR (sk0)) -return PTR_ERR (sk0); +if (fd0 >=0 ) { + sk0 =gtp_encap_enable_socket (fd0,UDP_ENCAP_GTP0 , gtp); +if (IS_ERR (sk0)) +return PTR_ERR (sk0); + } }if (data[IFLA_GTP_FD1 ]) { -u32 fd1 =nla_get_u32 (data[IFLA_GTP_FD1 ]); +int fd1 =nla_get_u32 (data[IFLA_GTP_FD1 ]); - sk1u =gtp_encap_enable_socket (fd1,UDP_ENCAP_GTP1U , gtp); -if (IS_ERR (sk1u)) { -gtp_encap_disable_sock (sk0); -return PTR_ERR (sk1u); +if (fd1 >=0 ) { + sk1u =gtp_encap_enable_socket (fd1,UDP_ENCAP_GTP1U , gtp); +if (IS_ERR (sk1u)) { +gtp_encap_disable_sock (sk0); +return PTR_ERR (sk1u); + } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/151 net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Tammela <[email protected]>
[ Upstream commit 2e95c4384438adeaa772caa560244b1a2efef816 ]
In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff:
Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer.
In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT).
In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop.
net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_api.c +1 -1
@@ -791,7 +791,7 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) drops =max_t (int, n,0 );rcu_read_lock ();while ((parentid = sch->parent)) { -if (TC_H_MAJ (parentid) ==TC_H_MAJ (TC_H_INGRESS )) +if (parentid ==TC_H_ROOT )break ;if (sch->flags &TCQ_F_NOPARENT )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/151 selftests/bpf: Add bpf_percpu_obj_{new,drop}() macro in bpf_experimental.h
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit 968c76cb3dc6cc86e8099ecaa5c30dc0d4738a30 ]
The new macro bpf_percpu_obj_{new/drop}() is very similar to bpf_obj_{new,drop}() as they both take a type as the argument.
Stable-dep-of: aa30eb3260b2 ("bpf: Force checkpoint when jmp history is too long")
--- .../testing/selftests/bpf/bpf_experimental.h | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+)
tools/testing/selftests/bpf/bpf_experimental.h +31 -0
@@ -131,4 +131,35 @@ extern int bpf_rbtree_add_impl(struct bpf_rb_root *root, struct bpf_rb_node *nod*/ extern struct bpf_rb_node *bpf_rbtree_first (struct bpf_rb_root *root) __ksym; +/* Description +* Allocates a percpu object of the type represented by 'local_type_id' in +* program BTF. User may use the bpf_core_type_id_local macro to pass the +* type ID of a struct in program BTF. +* +* The 'local_type_id' parameter must be a known constant. +* The 'meta' parameter is rewritten by the verifier, no need for BPF +* program to set it. +* Returns +* A pointer to a percpu object of the type corresponding to the passed in +* 'local_type_id', or NULL on failure. +*/ +extern void *bpf_percpu_obj_new_impl (__u64 local_type_id,void *meta) __ksym; + +/* Convenience macro to wrap over bpf_percpu_obj_new_impl */ +#define bpf_percpu_obj_new (type) ((type __percpu_kptr *)bpf_percpu_obj_new_impl(bpf_core_type_id_local(type), NULL)) + +/* Description +* Free an allocated percpu object. All fields of the object that require +* destruction will be destructed before the storage is freed. +* +* The 'meta' parameter is rewritten by the verifier, no need for BPF +* program to set it. +* Returns +* Void. +*/ +extern void bpf_percpu_obj_drop_impl(void *kptr, void *meta) __ksym; + +/* Convenience macro to wrap over bpf_obj_drop_impl */ +#define bpf_percpu_obj_drop (kptr) bpf_percpu_obj_drop_impl(kptr, NULL) +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/151 bpf: Force checkpoint when jmp history is too long
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit aa30eb3260b2dea3a68d3c42a39f9a09c5e99cee ]
A specifically crafted program might trick verifier into growing very long jump history within a single bpf_verifier_state instance. Very long jump history makes mark_chain_precision() unreasonably slow, especially in case if verifier processes a loop.
Mitigate this by forcing new state in is_state_visited() in case if current state's jump history is too long.
Use same constant as in skip_inf_loop_check, but multiply it by arbitrarily chosen value 2 to account for jump history containing not only information about jumps, but also information about stack access.
For an example of problematic program consider the code below, w/o this patch the example is processed by verifier for ~15 minutes, before failing to allocate big-enough chunk for jmp_history.
0: r7 = *(u16 *)(r1 +0);"
1: r7 += 0x1ab064b9;"
2: if r7 & 0x702000 goto 1b;
3: r7 &= 0x1ee60e;"
4: r7 += r1;"
5: if r7 s> 0x37d2 goto +0;"
6: r0 = 0;"
7: exit;"Perf profiling shows that most of the time is spent in mark_chain_precision() ~95%.
The easiest way to explain why this program causes problems is to apply the following patch:
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 0c216e71cec7..4b4823961abe 100644
\--- a/include/linux/bpf.h
\+++ b/include/linux/bpf.h
\@@ -1926,7 +1926,7 @@ struct bpf_array {
};
};
-#define BPF_COMPLEXITY_LIMIT_INSNS 1000000 /* yes. 1M insns */
+#define BPF_COMPLEXITY_LIMIT_INSNS 256 /* yes. 1M insns */
#define MAX_TAIL_CALL_CNT 33
/* Maximum number of loops for bpf_loop and bpf_iter_num.
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f514247ba8ba..75e88be3bb3e 100644
\--- a/kernel/bpf/verifier.c
\+++ b/kernel/bpf/verifier.c
\@@ -18024,8 +18024,13 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
skip_inf_loop_check:
if (!force_new_state &&
env->jmps_processed - env->prev_jmps_processed < 20 &&
- env->insn_processed - env->prev_insn_processed < 100)
+ env->insn_processed - env->prev_insn_processed < 100) {
+ verbose(env, "is_state_visited: suppressing checkpoint at %d, %d jmps processed, cur->jmp_history_cnt is %d\n",
+ env->insn_idx,
+ env->jmps_processed - env->prev_jmps_processed,
+ cur->jmp_history_cnt);
add_new_state = false;
+ }
goto miss;
}
/* If sl->state is a part of a loop and this loop's entry is a part of
\@@ -18142,6 +18147,9 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
if (!add_new_state)
return 0;
+ verbose(env, "is_state_visited: new checkpoint at %d, resetting env->jmps_processed\n",
+ env->insn_idx);
+
/* There were no equivalent states, remember the current one.
* Technically the current state is not proven to be safe yet,
* but it will either reach outer most bpf_exit (which means it's safe)And observe verification log:
...
is_state_visited: new checkpoint at 5, resetting env->jmps_processed
5: R1=ctx() R7=ctx(...)
5: (65) if r7 s> 0x37d2 goto pc+0 ; R7=ctx(...)
6: (b7) r0 = 0 ; R0_w=0
7: (95) exit
from 5 to 6: R1=ctx() R7=ctx(...) R10=fp0
6: R1=ctx() R7=ctx(...) R10=fp0
6: (b7) r0 = 0 ; R0_w=0
7: (95) exit
is_state_visited: suppressing checkpoint at 1, 3 jmps processed, cur->jmp_history_cnt is 74
from 2 to 1: R1=ctx() R7_w=scalar(...) R10=fp0
1: R1=ctx() R7_w=scalar(...) R10=fp0
1: (07) r7 += 447767737
is_state_visited: suppressing checkpoint at 2, 3 jmps processed, cur->jmp_history_cnt is 75
2: R7_w=scalar(...)
2: (45) if r7 & 0x702000 goto pc-2
... mark_precise 152 steps for r7 ...
2: R7_w=scalar(...)
is_state_visited: suppressing checkpoint at 1, 4 jmps processed, cur->jmp_history_cnt is 75
1: (07) r7 += 447767737
is_state_visited: suppressing checkpoint at 2, 4 jmps processed, cur->jmp_history_cnt is 76
2: R7_w=scalar(...)
2: (45) if r7 & 0x702000 goto pc-2
...
BPF program is too large. Processed 257 insnThe log output shows that checkpoint at label (1) is never created, because it is suppressed by skip_inf_loop_check logic:
a. When 'if' at (2) is processed it pushes a state with insn_idx (1)
onto stack and proceeds to (3);
b. At (5) checkpoint is created, and this resets
env->{jmps,insns}_processed.
c. Verification proceeds and reaches exit;
d. State saved at step (a) is popped from stack and is_state_visited()
considers if checkpoint needs to be added, but because env->{jmps,insns}_processed had been just reset at step (b) the skip_inf_loop_check logic forces add_new_state to false.
e. Verifier proceeds with current state, which slowly accumulates
more and more entries in the jump history.
The accumulation of entries in the jump history is a problem because of two factors:
- it eventually exhausts memory available for kmalloc() allocation;
- mark_chain_precision() traverses the jump history of a state, meaning that if r7 is marked precise, verifier would iterate ever growing jump history until parent state boundary is reached.
(note: the log also shows a REG INVARIANTS VIOLATION warning
upon jset processing, but that's another bug to fix).
With this patch applied, the example above is rejected by verifier under 1s of time, reaching 1M instructions limit.
The program is a simplified reproducer from syzbot report. Previous discussion could be found at [1].
The patch does not cause any changes in verification performance, when tested on selftests from veristat.cfg and cilium programs taken from [2].
[1] https://lore.kernel.org/bpf/[email protected]/
[2] https://github.com/anakryiko/cilium
Changelog:
- v1 -> v2:
- moved patch to bpf tree;
- moved force_new_state variable initialization after declaration and shortened the comment.
v1: https://lore.kernel.org/bpf/[email protected]/
--- kernel/bpf/verifier.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
kernel/bpf/verifier.c +6 -3
@@ -16580,9 +16580,11 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)struct bpf_verifier_state_list *sl, **pprev;struct bpf_verifier_state *cur = env->cur_state, *new, *loop_entry;int i, j, n, err, states_cnt =0 ; -bool force_new_state = env->test_state_freq ||is_force_checkpoint (env, insn_idx); -bool add_new_state = force_new_state; -bool force_exact; +bool force_new_state, add_new_state, force_exact; + + force_new_state = env->test_state_freq ||is_force_checkpoint (env, insn_idx) || +/* Avoid accumulating infinitely long jmp history */ + cur->jmp_history_cnt >40 ;/* bpf progs typically have pruning point every 4 instructions * http://vger.kernel.org/bpfconf2019.html#session-1
@@ -16592,6 +16594,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)* In tests that amounts to up to 50% reduction into total verifier * memory consumption and 20% verifier time speedup. */ + add_new_state = force_new_state;if (env->jmps_processed - env->prev_jmps_processed >=2 && env->insn_processed - env->prev_insn_processed >=8 ) add_new_state = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/151 netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zichen Xie <[email protected]>
[ Upstream commit 4ce1f56a1eaced2523329bef800d004e30f2f76c ]
This was found by a static analyzer.
We should not forget the trailing zero after copy_from_user() if we will further do some string operations, sscanf() in this case. Adding a trailing zero will ensure that the function performs properly.
--- drivers/net/netdevsim/fib.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/netdevsim/fib.c +3 -1
@@ -1377,10 +1377,12 @@ static ssize_t nsim_nexthop_bucket_activity_write(struct file *file,if (pos !=0 )return -EINVAL ; -if (size >sizeof (buf)) +if (size >sizeof (buf) -1 )return -EINVAL ;if (copy_from_user (buf, user_buf, size))return -EFAULT ; + buf[size] =0 ; +if (sscanf (buf,"%u %hu" , &nhid, &bucket_index) !=2 )return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/151 bpf: Fix out-of-bounds write in trie_get_next_key()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Byeonguk Jeong <[email protected]>
[ Upstream commit 13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21 ]
trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8.
--- kernel/bpf/lpm_trie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/lpm_trie.c +1 -1
@@ -647,7 +647,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key)if (!key || key->prefixlen > trie->max_prefixlen) goto find_leftmost; - node_stack =kmalloc_array (trie->max_prefixlen, + node_stack =kmalloc_array (trie->max_prefixlen +1 ,sizeof (struct lpm_trie_node *),GFP_ATOMIC | __GFP_NOWARN);if (!node_stack)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/151 net: fix crash when config small gso_max_size/gso_ipv4_max_size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit 9ab5cf19fb0e4680f95e506d6c544259bf1111c4 ]
Config a small gso_max_size/gso_ipv4_max_size will lead to an underflow in sk_dst_gso_max_size(), which may trigger a BUG_ON crash, because sk->sk_gso_max_size would be much bigger than device limits.
Call Trace:
tcp_write_xmit
tso_segs = tcp_init_tso_segs(skb, mss_now);
tcp_set_skb_tso_segs
tcp_skb_pcount_set
// skb->len = 524288, mss_now = 8
// u16 tso_segs = 524288/8 = 65535 -> 0
tso_segs = DIV_ROUND_UP(skb->len, mss_now)
BUG_ON(!tso_segs)Add check for the minimum value of gso_max_size and gso_ipv4_max_size.
--- net/core/rtnetlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/rtnetlink.c +2 -2
@@ -1984,7 +1984,7 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = { [IFLA_NUM_TX_QUEUES] = { .type = NLA_U32 }, [IFLA_NUM_RX_QUEUES] = { .type = NLA_U32 }, [IFLA_GSO_MAX_SEGS] = { .type = NLA_U32 }, - [IFLA_GSO_MAX_SIZE] = { .type = NLA_U32 }, + [IFLA_GSO_MAX_SIZE] = NLA_POLICY_MIN(NLA_U32, MAX_TCP_HEADER + 1), [IFLA_PHYS_PORT_ID] = { .type = NLA_BINARY, .len = MAX_PHYS_ITEM_ID_LEN }, [IFLA_CARRIER_CHANGES] = { .type = NLA_U32 }, /* ignored */ [IFLA_PHYS_SWITCH_ID] = { .type = NLA_BINARY, .len = MAX_PHYS_ITEM_ID_LEN },
@@ -2009,7 +2009,7 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = { [IFLA_TSO_MAX_SIZE] = { .type = NLA_REJECT }, [IFLA_TSO_MAX_SEGS] = { .type = NLA_REJECT }, [IFLA_ALLMULTI] = { .type = NLA_REJECT }, - [IFLA_GSO_IPV4_MAX_SIZE] = { .type = NLA_U32 }, + [IFLA_GSO_IPV4_MAX_SIZE] = NLA_POLICY_MIN(NLA_U32, MAX_TCP_HEADER + 1), [IFLA_GRO_IPV4_MAX_SIZE] = { .type = NLA_U32 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/151 netfilter: Fix use-after-free in get_info()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dong Chenchen <[email protected]>
[ Upstream commit f48d258f0ac540f00fa617dac496c4c18b5dc2fa ]
ip6table_nat module unload has refcnt warning for UAF. call trace is:
WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80 Modules linked in: ip6table_nat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:module_put+0x6f/0x80 Call Trace: <TASK> get_info+0x128/0x180 do_ip6t_get_ctl+0x6a/0x430 nf_getsockopt+0x46/0x80 ipv6_getsockopt+0xb9/0x100 rawv6_getsockopt+0x42/0x190 do_sock_getsockopt+0xaa/0x180 __sys_getsockopt+0x70/0xc0 __x64_sys_getsockopt+0x20/0x30 do_syscall_64+0xa2/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Concurrent execution of module unload and get_info() trigered the warning. The root cause is as follows:
cpu0 cpu1module_exit
//mod->state = MODULE_STATE_GOING
ip6table_nat_exit
xt_unregister_template
kfree(t)
//removed from templ_list
getinfo()
t = xt_find_table_lock
list_for_each_entry(tmpl, &xt_templates[af]...)
if (strcmp(tmpl->name, name))
continue; //table not found
try_module_get
list_for_each_entry(t, &xt_net->tables[af]...)
return t; //not get refcnt
module_put(t->me) //uaf
unregister_pernet_subsys
//remove table from xt_net listWhile xt_table module was going away and has been removed from xt_templates list, we couldnt get refcnt of xt_table->me. Check module in xt_net->tables list re-traversal to fix it.
--- net/netfilter/x_tables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/x_tables.c +1 -1
@@ -1268,7 +1268,7 @@ struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,/* and once again: */ list_for_each_entry (t, &xt_net->tables[af], list) -if (strcmp (t->name, name) ==0 ) +if (strcmp (t->name, name) ==0 && owner == t->me)return t;module_put (owner);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/151 netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4ed234fe793f27a3b151c43d2106df2ff0d81aac ]
I got a syzbot report without a repro [1] crashing in nf_send_reset6()
I think the issue is that dev->hard_header_len is zero, and we attempt later to push an Ethernet header.
Use LL_MAX_HEADER, as other functions in net/ipv6/netfilter/nf_reject_ipv6.c.
[1]
skbuff: skb_under_panic: text:ffffffff89b1d008 len:74 put:14 head:ffff88803123aa00 data:ffff88803123a9f2 tail:0x3c end:0x140 dev:syz_tun
kernel BUG at net/core/skbuff.c:206 !
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 7373 Comm: syz.1.568 Not tainted 6.12.0-rc2-syzkaller-00631-g6d858708d465 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:skb_panic net/core/skbuff.c:206 [inline] RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216 Code: 0d 8d 48 c7 c6 60 a6 29 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 ba 30 38 02 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc900045269b0 EFLAGS: 00010282 RAX: 0000000000000088 RBX: dffffc0000000000 RCX: cd66dacdc5d8e800 RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000 RBP: ffff88802d39a3d0 R08: ffffffff8174afec R09: 1ffff920008a4ccc R10: dffffc0000000000 R11: fffff520008a4ccd R12: 0000000000000140 R13: ffff88803123aa00 R14: ffff88803123a9f2 R15: 000000000000003c FS: 00007fdbee5ff6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000005d322000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> skb_push+0xe5/0x100 net/core/skbuff.c:2636 eth_header+0x38/0x1f0 net/ethernet/eth.c:83 dev_hard_header include/linux/netdevice.h:3208 [inline] nf_send_reset6+0xce6/0x1270 net/ipv6/netfilter/nf_reject_ipv6.c:358 nft_reject_inet_eval+0x3b9/0x690 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x418/0x6b0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] br_nf_pre_routing_ipv6+0x63e/0x770 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_bridge_pre net/bridge/br_input.c:277 [inline] br_handle_frame+0x9fd/0x1530 net/bridge/br_input.c:424 __netif_receive_skb_core+0x13e8/0x4570 net/core/dev.c:5562 __netif_receive_skb_one_core net/core/dev.c:5666 [inline] __netif_receive_skb+0x12f/0x650 net/core/dev.c:5781 netif_receive_skb_internal net/core/dev.c:5867 [inline] netif_receive_skb+0x1e8/0x890 net/core/dev.c:5926 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550 tun_get_user+0x3056/0x47e0 drivers/net/tun.c:2007 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053 new_sync_write fs/read_write.c:590 [inline] vfs_write+0xa6d/0xc90 fs/read_write.c:683 ksys_write+0x183/0x2b0 fs/read_write.c:736 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdbeeb7d1ff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48 RSP: 002b:00007fdbee5ff000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fdbeed36058 RCX: 00007fdbeeb7d1ff RDX: 000000000000008e RSI: 0000000020000040 RDI: 00000000000000c8 RBP: 00007fdbeebf12be R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000008e R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fdbeed36058 R15: 00007ffc38de06e8 </TASK>
--- net/ipv6/netfilter/nf_reject_ipv6.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
net/ipv6/netfilter/nf_reject_ipv6.c +7 -8
@@ -268,12 +268,12 @@ static int nf_reject6_fill_skb_dst(struct sk_buff *skb_in)void nf_send_reset6 (struct net *net,struct sock *sk,struct sk_buff *oldskb,int hook) { -struct sk_buff *nskb; -struct tcphdr _otcph; -const struct tcphdr *otcph; -unsigned int otcplen, hh_len;const struct ipv6hdr *oip6h =ipv6_hdr (oldskb);struct dst_entry *dst =NULL ; +const struct tcphdr *otcph; +struct sk_buff *nskb; +struct tcphdr _otcph; +unsigned int otcplen;struct flowi6 fl6; if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
@@ -312,9 +312,8 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,if (IS_ERR (dst))return ; - hh_len = (dst->dev->hard_header_len +15 )&~15 ; - nskb =alloc_skb (hh_len +15 + dst->header_len +sizeof (struct ipv6hdr ) - +sizeof (struct tcphdr ) + dst->trailer_len, + nskb =alloc_skb (LL_MAX_HEADER +sizeof (struct ipv6hdr ) + +sizeof (struct tcphdr ) + dst->trailer_len,GFP_ATOMIC );if (!nskb) {
@@ -327,7 +326,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, nskb->mark = fl6.flowi6_mark; -skb_reserve (nskb, hh_len + dst->header_len); +skb_reserve (nskb,LL_MAX_HEADER );nf_reject_ip6hdr_put (nskb, oldskb,IPPROTO_TCP ,ip6_dst_hoplimit (dst));nf_reject_ip6_tcphdr_put (nskb, oldskb, otcph, otcplen);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/151 Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungwoo Kim <[email protected]>
[ Upstream commit 1e67d8641813f1876a42eeb4f532487b8a7fb0a8 ]
Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes.
__hci_cmd_sync_sk() returns NULL if a command returns a status event. However, it also returns NULL where an opcode doesn't exist in the hci_cc table because hci_cmd_complete_evt() assumes status = skb->data[0] for unknown opcodes.
This leads to null-ptr-deref in cmd_sync for HCI_OP_READ_LOCAL_CODECS as there is no hci_cc for HCI_OP_READ_LOCAL_CODECS, which always assumes status = skb->data[0].
KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 2000 Comm: kworker/u9:5 Not tainted 6.9.0-ga6bcb805883c-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci7 hci_power_on RIP: 0010:hci_read_supported_codecs+0xb9/0x870 net/bluetooth/hci_codec.c:138 Code: 08 48 89 ef e8 b8 c1 8f fd 48 8b 75 00 e9 96 00 00 00 49 89 c6 48 ba 00 00 00 00 00 fc ff df 4c 8d 60 70 4c 89 e3 48 c1 eb 03 <0f> b6 04 13 84 c0 0f 85 82 06 00 00 41 83 3c 24 02 77 0a e8 bf 78 RSP: 0018:ffff888120bafac8 EFLAGS: 00010212 RAX: 0000000000000000 RBX: 000000000000000e RCX: ffff8881173f0040 RDX: dffffc0000000000 RSI: ffffffffa58496c0 RDI: ffff88810b9ad1e4 RBP: ffff88810b9ac000 R08: ffffffffa77882a7 R09: 1ffffffff4ef1054 R10: dffffc0000000000 R11: fffffbfff4ef1055 R12: 0000000000000070 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88810b9ac000 FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6ddaa3439e CR3: 0000000139764003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> hci_read_local_codecs_sync net/bluetooth/hci_sync.c:4546 [inline] hci_init_stage_sync net/bluetooth/hci_sync.c:3441 [inline] hci_init4_sync net/bluetooth/hci_sync.c:4706 [inline] hci_init_sync net/bluetooth/hci_sync.c:4742 [inline] hci_dev_init_sync net/bluetooth/hci_sync.c:4912 [inline] hci_dev_open_sync+0x19a9/0x2d30 net/bluetooth/hci_sync.c:4994 hci_dev_do_open net/bluetooth/hci_core.c:483 [inline] hci_power_on+0x11e/0x560 net/bluetooth/hci_core.c:1015 process_one_work kernel/workqueue.c:3267 [inline] process_scheduled_works+0x8ef/0x14f0 kernel/workqueue.c:3348 worker_thread+0x91f/0xe50 kernel/workqueue.c:3429 kthread+0x2cb/0x360 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
--- net/bluetooth/hci_sync.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
net/bluetooth/hci_sync.c +11 -7
@@ -201,6 +201,12 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen,return ERR_PTR (err); } +/* If command return a status event skb will be set to NULL as there are +* no parameters. +*/ +if (!skb) +return ERR_PTR (-ENODATA ); +return skb; }EXPORT_SYMBOL (__hci_cmd_sync_sk);
@@ -250,6 +256,11 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen,u8 status; skb =__hci_cmd_sync_sk (hdev, opcode, plen, param, event, timeout, sk); + +/* If command return a status event, skb will be set to -ENODATA */ +if (skb ==ERR_PTR (-ENODATA )) +return 0 ; +if (IS_ERR (skb)) {if (!event) bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode,
@@ -257,13 +268,6 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen,return PTR_ERR (skb); } -/* If command return a status event skb will be set to NULL as there are -* no parameters, in case of failure IS_ERR(skb) would have be set to -* the actual error would be found with PTR_ERR(skb). -*/ -if (!skb) -return 0 ; - status = skb->data[0 ];kfree_skb (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/151 net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Monin <[email protected]>
[ Upstream commit 04c20a9356f283da623903e81e7c6d5df7e4dc3c ]
As documented in skbuff.h, devices with NETIF_F_IPV6_CSUM capability can only checksum TCP and UDP over IPv6 if the IP header does not contains extension.
This is enforced for UDP packets emitted from user-space to an IPv6 address as they go through ip6_make_skb(), which calls __ip6_append_data() where a check is done on the header size before setting CHECKSUM_PARTIAL.
But the introduction of UDP encapsulation with fou6 added a code-path where it is possible to get an skb with a partial UDP checksum and an IPv6 header with extension:
* fou6 adds a UDP header with a partial checksum if the inner packet does not contains a valid checksum.
* ip6_tunnel adds an IPv6 header with a destination option extension header if encap_limit is non-zero (the default value is 4).
The thread linked below describes in more details how to reproduce the problem with GRE-in-UDP tunnel.
Add a check on the network header size in skb_csum_hwoffload_help() to make sure no IPv6 packet with extension header is handed to a network device with NETIF_F_IPV6_CSUM capability.
--- net/core/dev.c | 4 ++++ 1 file changed, 4 insertions(+)
net/core/dev.c +4 -0
@@ -3627,6 +3627,9 @@ int skb_csum_hwoffload_help(struct sk_buff *skb,return 0 ;if (features & (NETIF_F_IP_CSUM |NETIF_F_IPV6_CSUM )) { +if (vlan_get_protocol (skb) ==htons (ETH_P_IPV6 ) && +skb_network_header_len (skb) !=sizeof (struct ipv6hdr )) + goto sw_checksum;switch (skb->csum_offset) {case offsetof(struct tcphdr , check):case offsetof(struct udphdr , check):
@@ -3634,6 +3637,7 @@ int skb_csum_hwoffload_help(struct sk_buff *skb, } } +sw_checksum:return skb_checksum_help (skb); }EXPORT_SYMBOL (skb_csum_hwoffload_help);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/151 mlxsw: spectrum_ptp: Add missing verification before pushing Tx header
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <[email protected]>
[ Upstream commit 0a66e5582b5102c4d7b866b977ff7c850c1174ce ]
Tx header should be pushed for each packet which is transmitted via Spectrum ASICs. The cited commit moved the call to skb_cow_head() from mlxsw_sp_port_xmit() to functions which handle Tx header.
In case that mlxsw_sp->ptp_ops->txhdr_construct() is used to handle Tx header, and txhdr_construct() is mlxsw_sp_ptp_txhdr_construct(), there is no call for skb_cow_head() before pushing Tx header size to SKB. This flow is relevant for Spectrum-1 and Spectrum-4, for PTP packets.
Add the missing call to skb_cow_head() to make sure that there is both enough room to push the Tx header and that the SKB header is not cloned and can be modified.
An additional set will be sent to net-next to centralize the handling of the Tx header by pushing it to every packet just before transmission.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c +7 -0
@@ -16,6 +16,7 @@#include "spectrum.h" #include "spectrum_ptp.h" #include "core.h" +#include "txheader.h" #define MLXSW_SP1_PTP_CLOCK_CYCLES_SHIFT 29#define MLXSW_SP1_PTP_CLOCK_FREQ_KHZ 156257/* 6.4nSec */
@@ -1684,6 +1685,12 @@ int mlxsw_sp_ptp_txhdr_construct(struct mlxsw_core *mlxsw_core,struct sk_buff *skb, const struct mlxsw_tx_info *tx_info) { + if (skb_cow_head(skb, MLXSW_TXHDR_LEN)) { + this_cpu_inc(mlxsw_sp_port->pcpu_stats->tx_dropped); +dev_kfree_skb_any (skb); +return -ENOMEM ; + } +mlxsw_sp_txhdr_construct (skb, tx_info);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/151 mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 12ae97c531fcd3bfd774d4dfeaeac23eafe24280 ]
The device stores IPv6 addresses that are used for encapsulation in linear memory that is managed by the driver.
Changing the remote address of an ip6gre net device never worked properly, but since cited commit the following reproducer [1] would result in a warning [2] and a memory leak [3]. The problem is that the new remote address is never added by the driver to its hash table (and therefore the device) and the old address is never removed from it.
Fix by programming the new address when the configuration of the ip6gre net device changes and removing the old one. If the address did not change, then the above would result in increasing the reference count of the address and then decreasing it.
[1]
# ip link add name bla up type ip6gre local 2001:db8:1::1 remote 2001:db8:2::1 tos inherit ttl inherit # ip link set dev bla type ip6gre remote 2001:db8:3::1 # ip link del dev bla # devlink dev reload pci/0000:01:00.0
[2]
WARNING: CPU: 0 PID: 1682 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3002 mlxsw_sp_ipv6_addr_put+0x140/0x1d0 Modules linked in: CPU: 0 UID: 0 PID: 1682 Comm: ip Not tainted 6.12.0-rc3-custom-g86b5b55bc835 #151 Hardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023 RIP: 0010:mlxsw_sp_ipv6_addr_put+0x140/0x1d0 [...] Call Trace: <TASK> mlxsw_sp_router_netdevice_event+0x55f/0x1240 notifier_call_chain+0x5a/0xd0 call_netdevice_notifiers_info+0x39/0x90 unregister_netdevice_many_notify+0x63e/0x9d0 rtnl_dellink+0x16b/0x3a0 rtnetlink_rcv_msg+0x142/0x3f0 netlink_rcv_skb+0x50/0x100 netlink_unicast+0x242/0x390 netlink_sendmsg+0x1de/0x420 ____sys_sendmsg+0x2bd/0x320 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xd0 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
[3]
unreferenced object 0xffff898081f597a0 (size 32):
comm "ip", pid 1626, jiffies 4294719324
hex dump (first 32 bytes):
20 01 0d b8 00 02 00 00 00 00 00 00 00 00 00 01 ...............
21 49 61 83 80 89 ff ff 00 00 00 00 01 00 00 00 !Ia.............
backtrace (crc fd9be911):
[<00000000df89c55d>] __kmalloc_cache_noprof+0x1da/0x260
[<00000000ff2a1ddb>] mlxsw_sp_ipv6_addr_kvdl_index_get+0x281/0x340
[<000000009ddd445d>] mlxsw_sp_router_netdevice_event+0x47b/0x1240
[<00000000743e7757>] notifier_call_chain+0x5a/0xd0
[<000000007c7b9e13>] call_netdevice_notifiers_info+0x39/0x90
[<000000002509645d>] register_netdevice+0x5f7/0x7a0
[<00000000c2e7d2a9>] ip6gre_newlink_common.isra.0+0x65/0x130
[<0000000087cd6d8d>] ip6gre_newlink+0x72/0x120
[<000000004df7c7cc>] rtnl_newlink+0x471/0xa20
[<0000000057ed632a>] rtnetlink_rcv_msg+0x142/0x3f0
[<0000000032e0d5b5>] netlink_rcv_skb+0x50/0x100
[<00000000908bca63>] netlink_unicast+0x242/0x390
[<00000000cdbe1c87>] netlink_sendmsg+0x1de/0x420
[<0000000011db153e>] ____sys_sendmsg+0x2bd/0x320
[<000000003b6d53eb>] ___sys_sendmsg+0x9a/0xe0
[<00000000cae27c62>] __sys_sendmsg+0x7a/0xd0--- .../ethernet/mellanox/mlxsw/spectrum_ipip.c | 26 +++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c +24 -2
@@ -471,11 +471,33 @@ mlxsw_sp_ipip_ol_netdev_change_gre6(struct mlxsw_sp *mlxsw_sp,struct mlxsw_sp_ipip_entry *ipip_entry, struct netlink_ext_ack *extack) { + u32 new_kvdl_index, old_kvdl_index = ipip_entry->dip_kvdl_index; +struct in6_addr old_addr6 = ipip_entry->parms.daddr.addr6;struct mlxsw_sp_ipip_parms new_parms; +int err; new_parms =mlxsw_sp_ipip_netdev_parms_init_gre6 (ipip_entry->ol_dev); -return mlxsw_sp_ipip_ol_netdev_change_gre (mlxsw_sp, ipip_entry, - &new_parms, extack); + + err =mlxsw_sp_ipv6_addr_kvdl_index_get (mlxsw_sp, + &new_parms.daddr.addr6, + &new_kvdl_index); +if (err) +return err; + ipip_entry->dip_kvdl_index = new_kvdl_index; + + err =mlxsw_sp_ipip_ol_netdev_change_gre (mlxsw_sp, ipip_entry, + &new_parms, extack); +if (err) + goto err_change_gre; + +mlxsw_sp_ipv6_addr_put (mlxsw_sp, &old_addr6); + +return 0 ; + +err_change_gre: + ipip_entry->dip_kvdl_index = old_kvdl_index; +mlxsw_sp_ipv6_addr_put (mlxsw_sp, &new_parms.daddr.addr6); +return err; } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/151 netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit d5953d680f7e96208c29ce4139a0e38de87a57fe ]
If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON().
skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed.
--- net/netfilter/nft_payload.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nft_payload.c +3 -0
@@ -904,6 +904,9 @@ static void nft_payload_set_eval(const struct nft_expr *expr, ((priv->base != NFT_PAYLOAD_TRANSPORT_HEADER && priv->base != NFT_PAYLOAD_INNER_HEADER) || skb->ip_summed != CHECKSUM_PARTIAL)) { +if (offset + priv->len > skb->len) + goto err; + fsum =skb_checksum (skb, offset, priv->len,0 ); tsum =csum_partial (src, priv->len,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/151 bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit c40dd8c4732551605712985bc5b7045094c6458d ]
The test_run code detects whether a page has been modified and re-initialises the xdp_frame structure if it has, using xdp_update_frame_from_buff(). However, xdp_update_frame_from_buff() doesn't touch frame->mem, so that wasn't correctly re-initialised, which led to the pages from page_pool not being returned correctly. Syzbot noticed this as a memory leak.
Fix this by also copying the frame->mem structure when re-initialising the frame, like we do on initialisation of a new page from page_pool.
--- net/bpf/test_run.c | 1 + 1 file changed, 1 insertion(+)
net/bpf/test_run.c +1 -0
@@ -244,6 +244,7 @@ static void reset_ctx(struct xdp_page_head *head) head->ctx.data_meta = head->orig_ctx.data_meta; head->ctx.data_end = head->orig_ctx.data_end;xdp_update_frame_from_buff (&head->ctx, head->frame); + head->frame->mem = head->orig_ctx.rxq->mem; } static int xdp_recv_frames(struct xdp_frame **frames, int nframes,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/151 iomap: improve shared block detection in iomap_unshare_iter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit b53fdb215d13f8e9c29541434bf2d14dac8bcbdc ]
Currently iomap_unshare_iter relies on the IOMAP_F_SHARED flag to detect blocks to unshare. This is reasonable, but IOMAP_F_SHARED is also useful for the file system to do internal book keeping for out of place writes. XFS used to that, until it got removed in commit 72a048c1056a ("xfs: only set IOMAP_F_SHARED when providing a srcmap to a write") because unshare for incorrectly unshare such blocks.
Add an extra safeguard by checking the explicitly provided srcmap instead of the fallback to the iomap for valid data, as that catches the case where we'd just copy from the same place we'd write to easily, allowing to reinstate setting IOMAP_F_SHARED for all XFS writes that go to the COW fork.
Stable-dep-of: 50793801fc7f ("fsdax: dax_unshare_iter needs to copy entire blocks")
--- fs/iomap/buffered-io.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
fs/iomap/buffered-io.c +13 -4
@@ -1273,16 +1273,25 @@ EXPORT_SYMBOL_GPL(iomap_file_buffered_write_punch_delalloc);static loff_t iomap_unshare_iter (struct iomap_iter *iter) {struct iomap *iomap = &iter->iomap; -const struct iomap *srcmap =iomap_iter_srcmap (iter);loff_t pos = iter->pos;loff_t length =iomap_length (iter);loff_t written =0 ; -/* don't bother with blocks that are not shared to start with */ +/* Don't bother with blocks that are not shared to start with. */ if (!(iomap->flags &IOMAP_F_SHARED ))return length; -/* don't bother with holes or unwritten extents */ -if (srcmap->type ==IOMAP_HOLE || srcmap->type ==IOMAP_UNWRITTEN ) + +/* +* Don't bother with holes or unwritten extents. +* +* Note that we use srcmap directly instead of iomap_iter_srcmap as +* unsharing requires providing a separate source map, and the presence +* of one is a good indicator that unsharing is needed, unlike +* IOMAP_F_SHARED which can be set for any data that goes into the COW +* fork for XFS. +*/ +if (iter->srcmap.type ==IOMAP_HOLE || + iter->srcmap.type ==IOMAP_UNWRITTEN )return length; do {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/151 iomap: dont bother unsharing delalloc extents
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
[ Upstream commit f7a4874d977bf4202ad575031222e78809a36292 ]
If unshare encounters a delalloc reservation in the srcmap, that means that the file range isn't shared because delalloc reservations cannot be reflinked. Therefore, don't try to unshare them.
Stable-dep-of: 50793801fc7f ("fsdax: dax_unshare_iter needs to copy entire blocks")
--- fs/iomap/buffered-io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/iomap/buffered-io.c +2 -1
@@ -1282,7 +1282,7 @@ static loff_t iomap_unshare_iter(struct iomap_iter *iter)return length;/* -* Don't bother with holes or unwritten extents. +* Don't bother with delalloc reservations, holes or unwritten extents. * * Note that we use srcmap directly instead of iomap_iter_srcmap as * unsharing requires providing a separate source map, and the presence
@@ -1291,6 +1291,7 @@ static loff_t iomap_unshare_iter(struct iomap_iter *iter)* fork for XFS. */ if (iter->srcmap.type ==IOMAP_HOLE || + iter->srcmap.type ==IOMAP_DELALLOC || iter->srcmap.type ==IOMAP_UNWRITTEN )return length;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/151 iomap: share iomap_unshare_iter predicate code with fsdax
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
[ Upstream commit 6ef6a0e821d3dad6bf8a5d5508762dba9042c84b ]
The predicate code that iomap_unshare_iter uses to decide if it's really needs to unshare a file range mapping should be shared with the fsdax version, because right now they're opencoded and inconsistent.
Note that we simplify the predicate logic a bit -- we no longer allow unsharing of inline data mappings, but there aren't any filesystems that allow shared inline data currently.
This is a fix in the sense that it should have been ported to fsdax.
Stable-dep-of: 50793801fc7f ("fsdax: dax_unshare_iter needs to copy entire blocks")
--- fs/dax.c | 3 +-- fs/iomap/buffered-io.c | 30 ++++++++++++++++-------------- include/linux/iomap.h | 1 + 3 files changed, 18 insertions(+), 16 deletions(-)
fs/dax.c +1 -2
@@ -1268,8 +1268,7 @@ static s64 dax_unshare_iter(struct iomap_iter *iter)s64 ret =0 ;void *daddr =NULL , *saddr =NULL ; -/* don't bother with blocks that are not shared to start with */ -if (!(iomap->flags &IOMAP_F_SHARED )) +if (!iomap_want_unshare_iter (iter))return length; id =dax_read_lock ();
fs/iomap/buffered-io.c +16 -14
@@ -1270,19 +1270,12 @@ int iomap_file_buffered_write_punch_delalloc(struct inode *inode, }EXPORT_SYMBOL_GPL (iomap_file_buffered_write_punch_delalloc); -static loff_t iomap_unshare_iter (struct iomap_iter *iter) +bool iomap_want_unshare_iter (const struct iomap_iter *iter) { -struct iomap *iomap = &iter->iomap; -loff_t pos = iter->pos; -loff_t length =iomap_length (iter); -loff_t written =0 ; - -/* Don't bother with blocks that are not shared to start with. */ -if (!(iomap->flags &IOMAP_F_SHARED )) -return length; -/* -* Don't bother with delalloc reservations, holes or unwritten extents. +* Don't bother with blocks that are not shared to start with; or +* mappings that cannot be shared, such as inline data, delalloc +* reservations, holes or unwritten extents. * * Note that we use srcmap directly instead of iomap_iter_srcmap as * unsharing requires providing a separate source map, and the presence
@@ -1290,9 +1283,18 @@ static loff_t iomap_unshare_iter(struct iomap_iter *iter)* IOMAP_F_SHARED which can be set for any data that goes into the COW * fork for XFS. */ -if (iter->srcmap.type ==IOMAP_HOLE || - iter->srcmap.type ==IOMAP_DELALLOC || - iter->srcmap.type ==IOMAP_UNWRITTEN ) +return (iter->iomap.flags &IOMAP_F_SHARED ) && + iter->srcmap.type ==IOMAP_MAPPED ; +} + +static loff_t iomap_unshare_iter (struct iomap_iter *iter) +{ +struct iomap *iomap = &iter->iomap; +loff_t pos = iter->pos; +loff_t length =iomap_length (iter); +loff_t written =0 ; + +if (!iomap_want_unshare_iter (iter))return length; do {
include/linux/iomap.h +1 -0
@@ -271,6 +271,7 @@ void iomap_invalidate_folio(struct folio *folio, size_t offset, size_t len);bool iomap_dirty_folio (struct address_space *mapping,struct folio *folio);int iomap_file_unshare (struct inode *inode,loff_t pos,loff_t len,const struct iomap_ops *ops); +bool iomap_want_unshare_iter (const struct iomap_iter *iter);int iomap_zero_range (struct inode *inode,loff_t pos,loff_t len,bool *did_zero,const struct iomap_ops *ops); int iomap_truncate_page(struct inode *inode, loff_t pos, bool *did_zero,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/151 fsdax: remove zeroing code from dax_unshare_iter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
[ Upstream commit 95472274b6fed8f2d30fbdda304e12174b3d4099 ]
Remove the code in dax_unshare_iter that zeroes the destination memory because it's not necessary.
If srcmap is unwritten, we don't have to do anything because that unwritten extent came from the regular file mapping, and unwritten extents cannot be shared. The same applies to holes.
Furthermore, zeroing to unshare a mapping is just plain wrong because unsharing means copy on write, and we should be copying data.
This is effectively a revert of commit 13dd4e04625f ("fsdax: unshare:
zero destination if srcmap is HOLE or UNWRITTEN")
Stable-dep-of: 50793801fc7f ("fsdax: dax_unshare_iter needs to copy entire blocks")
--- fs/dax.c | 8 -------- 1 file changed, 8 deletions(-)
fs/dax.c +0 -8
@@ -1276,14 +1276,6 @@ static s64 dax_unshare_iter(struct iomap_iter *iter)if (ret <0 ) goto out_unlock; -/* zero the distance if srcmap is HOLE or UNWRITTEN */ -if (srcmap->flags &IOMAP_F_SHARED || srcmap->type ==IOMAP_UNWRITTEN ) { -memset (daddr,0 , length); -dax_flush (iomap->dax_dev, daddr, length); - ret = length; - goto out_unlock; - } - ret =dax_iomap_direct_access (srcmap, pos, length, &saddr,NULL );if (ret <0 ) goto out_unlock;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/151 fsdax: dax_unshare_iter needs to copy entire blocks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
[ Upstream commit 50793801fc7f6d08def48754fb0f0706b0cfc394 ]
The code that copies data from srcmap to iomap in dax_unshare_iter is very very broken, which bfoster's recent fsx changes have exposed.
If the pos and len passed to dax_file_unshare are not aligned to an fsblock boundary, the iter pos and length in the _iter function will reflect this unalignment.
dax_iomap_direct_access always returns a pointer to the start of the kmapped fsdax page, even if its pos argument is in the middle of that page. This is catastrophic for data integrity when iter->pos is not aligned to a page, because daddr/saddr do not point to the same byte in the file as iter->pos. Hence we corrupt user data by copying it to the wrong place.
If iter->pos + iomap_length() in the _iter function not aligned to a page, then we fail to copy a full block, and only partially populate the destination block. This is catastrophic for data confidentiality because we expose stale pmem contents.
Fix both of these issues by aligning copy_pos/copy_len to a page boundary (remember, this is fsdax so 1 fsblock == 1 base page) so that we always copy full blocks.
We're not done yet -- there's no call to invalidate_inode_pages2_range, so programs that have the file range mmap'd will continue accessing the old memory mapping after the file metadata updates have completed.
Be careful with the return value -- if the unshare succeeds, we still need to return the number of bytes that the iomap iter thinks we're operating on.
--- fs/dax.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-)
fs/dax.c +27 -7
@@ -1262,26 +1262,46 @@ static s64 dax_unshare_iter(struct iomap_iter *iter) {struct iomap *iomap = &iter->iomap;const struct iomap *srcmap =iomap_iter_srcmap (iter); -loff_t pos = iter->pos; -loff_t length =iomap_length (iter); +loff_t copy_pos = iter->pos; +u64 copy_len =iomap_length (iter); +u32 mod;int id =0 ;s64 ret =0 ;void *daddr =NULL , *saddr =NULL ;if (!iomap_want_unshare_iter (iter)) -return length; +return iomap_length (iter); + +/* +* Extend the file range to be aligned to fsblock/pagesize, because +* we need to copy entire blocks, not just the byte range specified. +* Invalidate the mapping because we're about to CoW. +*/ + mod =offset_in_page (copy_pos); +if (mod) { + copy_len += mod; + copy_pos -= mod; + } + + mod =offset_in_page (copy_pos + copy_len); +if (mod) + copy_len +=PAGE_SIZE - mod; + +invalidate_inode_pages2_range (iter->inode->i_mapping, + copy_pos >>PAGE_SHIFT , + (copy_pos + copy_len -1 ) >>PAGE_SHIFT ); id =dax_read_lock (); - ret =dax_iomap_direct_access (iomap, pos, length, &daddr,NULL ); + ret =dax_iomap_direct_access (iomap, copy_pos, copy_len, &daddr,NULL );if (ret <0 ) goto out_unlock; - ret =dax_iomap_direct_access (srcmap, pos, length, &saddr,NULL ); + ret =dax_iomap_direct_access (srcmap, copy_pos, copy_len, &saddr,NULL );if (ret <0 ) goto out_unlock; -if (copy_mc_to_kernel (daddr, saddr, length) ==0 ) - ret = length; +if (copy_mc_to_kernel (daddr, saddr, copy_len) ==0 ) + ret =iomap_length (iter);else ret = -EIO ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/151 iomap: turn iomap_want_unshare_iter into an inline function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 6db388585e486c0261aeef55f8bc63a9b45756c0 ]
iomap_want_unshare_iter currently sits in fs/iomap/buffered-io.c, which depends on CONFIG_BLOCK. It is also in used in fs/dax.c whіch has no such dependency. Given that it is a trivial check turn it into an inline in include/linux/iomap.h to fix the DAX && !BLOCK build.
--- fs/iomap/buffered-io.c | 17 ----------------- include/linux/iomap.h | 20 +++++++++++++++++++- 2 files changed, 19 insertions(+), 18 deletions(-)
fs/iomap/buffered-io.c +0 -17
@@ -1270,23 +1270,6 @@ int iomap_file_buffered_write_punch_delalloc(struct inode *inode, }EXPORT_SYMBOL_GPL (iomap_file_buffered_write_punch_delalloc); -bool iomap_want_unshare_iter (const struct iomap_iter *iter) -{ -/* -* Don't bother with blocks that are not shared to start with; or -* mappings that cannot be shared, such as inline data, delalloc -* reservations, holes or unwritten extents. -* -* Note that we use srcmap directly instead of iomap_iter_srcmap as -* unsharing requires providing a separate source map, and the presence -* of one is a good indicator that unsharing is needed, unlike -* IOMAP_F_SHARED which can be set for any data that goes into the COW -* fork for XFS. -*/ -return (iter->iomap.flags &IOMAP_F_SHARED ) && - iter->srcmap.type ==IOMAP_MAPPED ; -} -static loff_t iomap_unshare_iter (struct iomap_iter *iter) {struct iomap *iomap = &iter->iomap;
include/linux/iomap.h +19 -1
@@ -256,6 +256,25 @@ static inline const struct iomap *iomap_iter_srcmap(const struct iomap_iter *i)return &i->iomap; } +/* +* Check if the range needs to be unshared for a FALLOC_FL_UNSHARE_RANGE +* operation. +* +* Don't bother with blocks that are not shared to start with; or mappings that +* cannot be shared, such as inline data, delalloc reservations, holes or +* unwritten extents. +* +* Note that we use srcmap directly instead of iomap_iter_srcmap as unsharing +* requires providing a separate source map, and the presence of one is a good +* indicator that unsharing is needed, unlike IOMAP_F_SHARED which can be set +* for any data that goes into the COW fork for XFS. +*/ +static inline bool iomap_want_unshare_iter (const struct iomap_iter *iter) +{ +return (iter->iomap.flags &IOMAP_F_SHARED ) && + iter->srcmap.type ==IOMAP_MAPPED ; +} +ssize_t iomap_file_buffered_write (struct kiocb *iocb,struct iov_iter *from,const struct iomap_ops *ops); int iomap_file_buffered_write_punch_delalloc(struct inode *inode,
@@ -271,7 +290,6 @@ void iomap_invalidate_folio(struct folio *folio, size_t offset, size_t len);bool iomap_dirty_folio (struct address_space *mapping,struct folio *folio);int iomap_file_unshare (struct inode *inode,loff_t pos,loff_t len,const struct iomap_ops *ops); -bool iomap_want_unshare_iter (const struct iomap_iter *iter);int iomap_zero_range (struct inode *inode,loff_t pos,loff_t len,bool *did_zero,const struct iomap_ops *ops); int iomap_truncate_page(struct inode *inode, loff_t pos, bool *did_zero,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/151 kasan: Fix Software Tag-Based KASAN with GCC
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit 894b00a3350c560990638bdf89bdf1f3d5491950 ]
Per [1], -fsanitize=kernel-hwaddress with GCC currently does not disable instrumentation in functions with __attribute__((no_sanitize_address)).
However, __attribute__((no_sanitize("hwaddress"))) does correctly disable instrumentation. Use it instead.
--- include/linux/compiler-gcc.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/compiler-gcc.h +4 -0
@@ -102,7 +102,11 @@#define __noscs __attribute__((__no_sanitize__("shadow-call-stack")))#endif +#ifdef __SANITIZE_HWADDRESS__ +#define __no_sanitize_address __attribute__((__no_sanitize__("hwaddress"))) +#else #define __no_sanitize_address __attribute__((__no_sanitize_address__)) +#endif #if defined(__SANITIZE_THREAD__)#define __no_sanitize_thread __attribute__((__no_sanitize_thread__))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/151 firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiongfeng Wang <[email protected]>
[ Upstream commit c83212d79be2c9886d3e6039759ecd388fd5fed1 ]
In sdei_device_freeze(), the input parameter of cpuhp_remove_state() is passed as 'sdei_entry_point' by mistake. Change it to 'sdei_hp_state'.
--- drivers/firmware/arm_sdei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_sdei.c +1 -1
@@ -763,7 +763,7 @@ static int sdei_device_freeze(struct device *dev)int err;/* unregister private events */ -cpuhp_remove_state (sdei_entry_point); +cpuhp_remove_state (sdei_hp_state); err =sdei_unregister_shared ();if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/151 afs: Automatically generate trace tag enums
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 2daa6404fd2f00985d5bfeb3c161f4630b46b6bf ]
Automatically generate trace tag enums from the symbol -> string mapping tables rather than having the enums as well, thereby reducing duplicated data.
Stable-dep-of: 247d65fb122a ("afs: Fix missing subdir edit when renamed between parent dirs")
--- include/trace/events/afs.h | 233 +++++-------------------------------- 1 file changed, 27 insertions(+), 206 deletions(-)
include/trace/events/afs.h +27 -206
@@ -18,97 +18,6 @@#ifndef __AFS_DECLARE_TRACE_ENUMS_ONCE_ONLY#define __AFS_DECLARE_TRACE_ENUMS_ONCE_ONLY -enum afs_call_trace { - afs_call_trace_alloc, - afs_call_trace_free, - afs_call_trace_get, - afs_call_trace_put, - afs_call_trace_wake, - afs_call_trace_work, -}; - -enum afs_server_trace { - afs_server_trace_alloc, - afs_server_trace_callback, - afs_server_trace_destroy, - afs_server_trace_free, - afs_server_trace_gc, - afs_server_trace_get_by_addr, - afs_server_trace_get_by_uuid, - afs_server_trace_get_caps, - afs_server_trace_get_install, - afs_server_trace_get_new_cbi, - afs_server_trace_get_probe, - afs_server_trace_give_up_cb, - afs_server_trace_purging, - afs_server_trace_put_call, - afs_server_trace_put_cbi, - afs_server_trace_put_find_rsq, - afs_server_trace_put_probe, - afs_server_trace_put_slist, - afs_server_trace_put_slist_isort, - afs_server_trace_put_uuid_rsq, - afs_server_trace_update, -}; - - -enum afs_volume_trace { - afs_volume_trace_alloc, - afs_volume_trace_free, - afs_volume_trace_get_alloc_sbi, - afs_volume_trace_get_cell_insert, - afs_volume_trace_get_new_op, - afs_volume_trace_get_query_alias, - afs_volume_trace_put_cell_dup, - afs_volume_trace_put_cell_root, - afs_volume_trace_put_destroy_sbi, - afs_volume_trace_put_free_fc, - afs_volume_trace_put_put_op, - afs_volume_trace_put_query_alias, - afs_volume_trace_put_validate_fc, - afs_volume_trace_remove, -}; - -enum afs_cell_trace { - afs_cell_trace_alloc, - afs_cell_trace_free, - afs_cell_trace_get_queue_dns, - afs_cell_trace_get_queue_manage, - afs_cell_trace_get_queue_new, - afs_cell_trace_get_vol, - afs_cell_trace_insert, - afs_cell_trace_manage, - afs_cell_trace_put_candidate, - afs_cell_trace_put_destroy, - afs_cell_trace_put_queue_fail, - afs_cell_trace_put_queue_work, - afs_cell_trace_put_vol, - afs_cell_trace_see_source, - afs_cell_trace_see_ws, - afs_cell_trace_unuse_alias, - afs_cell_trace_unuse_check_alias, - afs_cell_trace_unuse_delete, - afs_cell_trace_unuse_fc, - afs_cell_trace_unuse_lookup, - afs_cell_trace_unuse_mntpt, - afs_cell_trace_unuse_no_pin, - afs_cell_trace_unuse_parse, - afs_cell_trace_unuse_pin, - afs_cell_trace_unuse_probe, - afs_cell_trace_unuse_sbi, - afs_cell_trace_unuse_ws, - afs_cell_trace_use_alias, - afs_cell_trace_use_check_alias, - afs_cell_trace_use_fc, - afs_cell_trace_use_fc_alias, - afs_cell_trace_use_lookup, - afs_cell_trace_use_mntpt, - afs_cell_trace_use_pin, - afs_cell_trace_use_probe, - afs_cell_trace_use_sbi, - afs_cell_trace_wait, -}; -enum afs_fs_operation { afs_FS_FetchData =130 ,/* AFS Fetch file data */ afs_FS_FetchACL = 131, /* AFS Fetch file ACL */
@@ -202,121 +111,6 @@ enum yfs_cm_operation { yfs_CB_CallBack = 64204, }; -enum afs_edit_dir_op { - afs_edit_dir_create, - afs_edit_dir_create_error, - afs_edit_dir_create_inval, - afs_edit_dir_create_nospc, - afs_edit_dir_delete, - afs_edit_dir_delete_error, - afs_edit_dir_delete_inval, - afs_edit_dir_delete_noent, -}; - -enum afs_edit_dir_reason { - afs_edit_dir_for_create, - afs_edit_dir_for_link, - afs_edit_dir_for_mkdir, - afs_edit_dir_for_rename_0, - afs_edit_dir_for_rename_1, - afs_edit_dir_for_rename_2, - afs_edit_dir_for_rmdir, - afs_edit_dir_for_silly_0, - afs_edit_dir_for_silly_1, - afs_edit_dir_for_symlink, - afs_edit_dir_for_unlink, -}; - -enum afs_eproto_cause { - afs_eproto_bad_status, - afs_eproto_cb_count, - afs_eproto_cb_fid_count, - afs_eproto_cellname_len, - afs_eproto_file_type, - afs_eproto_ibulkst_cb_count, - afs_eproto_ibulkst_count, - afs_eproto_motd_len, - afs_eproto_offline_msg_len, - afs_eproto_volname_len, - afs_eproto_yvl_fsendpt4_len, - afs_eproto_yvl_fsendpt6_len, - afs_eproto_yvl_fsendpt_num, - afs_eproto_yvl_fsendpt_type, - afs_eproto_yvl_vlendpt4_len, - afs_eproto_yvl_vlendpt6_len, - afs_eproto_yvl_vlendpt_type, -}; - -enum afs_io_error { - afs_io_error_cm_reply, - afs_io_error_extract, - afs_io_error_fs_probe_fail, - afs_io_error_vl_lookup_fail, - afs_io_error_vl_probe_fail, -}; - -enum afs_file_error { - afs_file_error_dir_bad_magic, - afs_file_error_dir_big, - afs_file_error_dir_missing_page, - afs_file_error_dir_name_too_long, - afs_file_error_dir_over_end, - afs_file_error_dir_small, - afs_file_error_dir_unmarked_ext, - afs_file_error_mntpt, - afs_file_error_writeback_fail, -}; - -enum afs_flock_event { - afs_flock_acquired, - afs_flock_callback_break, - afs_flock_defer_unlock, - afs_flock_extend_fail, - afs_flock_fail_other, - afs_flock_fail_perm, - afs_flock_no_lockers, - afs_flock_release_fail, - afs_flock_silly_delete, - afs_flock_timestamp, - afs_flock_try_to_lock, - afs_flock_vfs_lock, - afs_flock_vfs_locking, - afs_flock_waited, - afs_flock_waiting, - afs_flock_work_extending, - afs_flock_work_retry, - afs_flock_work_unlocking, - afs_flock_would_block, -}; - -enum afs_flock_operation { - afs_flock_op_copy_lock, - afs_flock_op_flock, - afs_flock_op_grant, - afs_flock_op_lock, - afs_flock_op_release_lock, - afs_flock_op_return_ok, - afs_flock_op_return_eagain, - afs_flock_op_return_edeadlk, - afs_flock_op_return_error, - afs_flock_op_set_lock, - afs_flock_op_unlock, - afs_flock_op_wake, -}; - -enum afs_cb_break_reason { - afs_cb_break_no_break, - afs_cb_break_no_promise, - afs_cb_break_for_callback, - afs_cb_break_for_deleted, - afs_cb_break_for_lapsed, - afs_cb_break_for_s_reinit, - afs_cb_break_for_unlink, - afs_cb_break_for_v_break, - afs_cb_break_for_volume_callback, - afs_cb_break_for_zap, -}; -#endif /* end __AFS_DECLARE_TRACE_ENUMS_ONCE_ONLY */ /*
@@ -391,6 +185,7 @@ enum afs_cb_break_reason { EM(afs_cell_trace_unuse_fc, "UNU fc ") \ EM(afs_cell_trace_unuse_lookup, "UNU lookup") \ EM(afs_cell_trace_unuse_mntpt, "UNU mntpt ") \ + EM(afs_cell_trace_unuse_no_pin, "UNU no-pin") \ EM(afs_cell_trace_unuse_parse, "UNU parse ") \ EM(afs_cell_trace_unuse_pin, "UNU pin ") \EM (afs_cell_trace_unuse_probe,"UNU probe " ) \
@@ -614,6 +409,32 @@ enum afs_cb_break_reason { EM(afs_cb_break_for_volume_callback, "break-v-cb") \E_ (afs_cb_break_for_zap,"break-zap" ) +/* +* Generate enums for tracing information. + */ +#ifndef __AFS_GENERATE_TRACE_ENUMS_ONCE_ONLY +#define __AFS_GENERATE_TRACE_ENUMS_ONCE_ONLY + +#undef EM +#undef E_ +#define EM (a, b) a, +#define E_ (a, b) a + +enum afs_call_trace { afs_call_traces }__mode (byte ); +enum afs_cb_break_reason { afs_cb_break_reasons }__mode (byte ); +enum afs_cell_trace { afs_cell_traces }__mode (byte ); +enum afs_edit_dir_op { afs_edit_dir_ops }__mode (byte ); +enum afs_edit_dir_reason { afs_edit_dir_reasons }__mode (byte ); +enum afs_eproto_cause { afs_eproto_causes }__mode (byte ); +enum afs_file_error { afs_file_errors }__mode (byte ); +enum afs_flock_event { afs_flock_events }__mode (byte ); +enum afs_flock_operation { afs_flock_operations }__mode (byte ); +enum afs_io_error { afs_io_errors }__mode (byte ); +enum afs_server_trace { afs_server_traces }__mode (byte ); +enum afs_volume_trace { afs_volume_traces }__mode (byte ); + +#endif /* end __AFS_GENERATE_TRACE_ENUMS_ONCE_ONLY */ +/* * Export enum symbols via userspace. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/151 afs: Fix missing subdir edit when renamed between parent dirs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 247d65fb122ad560be1c8c4d87d7374fb28b0770 ]
When rename moves an AFS subdirectory between parent directories, the subdir also needs a bit of editing: the ".." entry needs updating to point to the new parent (though I don't make use of the info) and the DV needs incrementing by 1 to reflect the change of content. The server also sends a callback break notification on the subdirectory if we have one, but we can take care of recovering the promise next time we access the subdir.
This can be triggered by something like:
mount -t afs %example.com:xfstest.test20 /xfstest.test/
mkdir /xfstest.test/{aaa,bbb,aaa/ccc}
touch /xfstest.test/bbb/ccc/d
mv /xfstest.test/{aaa/ccc,bbb/ccc}
touch /xfstest.test/bbb/ccc/eWhen the pathwalk for the second touch hits "ccc", kafs spots that the DV is incorrect and downloads it again (so the fix is not critical).
Fix this, if the rename target is a directory and the old and new parents are different, by:
(1) Incrementing the DV number of the target locally.
(2) Editing the ".." entry in the target to refer to its new parent's vnode ID and uniquifier.
--- fs/afs/dir.c | 25 +++++++++++ fs/afs/dir_edit.c | 91 +++++++++++++++++++++++++++++++++++++- fs/afs/internal.h | 2 + include/trace/events/afs.h | 7 ++- 4 files changed, 122 insertions(+), 3 deletions(-)
fs/afs/dir.c +25 -0
@@ -12,6 +12,7 @@#include <linux/swap.h> #include <linux/ctype.h> #include <linux/sched.h> +#include <linux/iversion.h> #include <linux/task_io_accounting_ops.h> #include "internal.h" #include "afs_fs.h"
@@ -1809,6 +1810,8 @@ static int afs_symlink(struct mnt_idmap *idmap, struct inode *dir,static void afs_rename_success (struct afs_operation *op) { +struct afs_vnode *vnode =AFS_FS_I (d_inode (op->dentry)); +_enter ("op=%08x" , op->debug_id); op->ctime = op->file[0 ].scb.status.mtime_client;
@@ -1818,6 +1821,22 @@ static void afs_rename_success(struct afs_operation *op) op->ctime = op->file[1 ].scb.status.mtime_client;afs_vnode_commit_status (op, &op->file[1 ]); } + +/* If we're moving a subdir between dirs, we need to update +* its DV counter too as the ".." will be altered. +*/ +if (S_ISDIR (vnode->netfs.inode.i_mode) && + op->file[0 ].vnode != op->file[1 ].vnode) { +u64 new_dv; + +write_seqlock (&vnode->cb_lock); + + new_dv = vnode->status.data_version +1 ; + vnode->status.data_version = new_dv; +inode_set_iversion_raw (&vnode->netfs.inode, new_dv); + +write_sequnlock (&vnode->cb_lock); + } }static void afs_rename_edit_dir (struct afs_operation *op)
@@ -1859,6 +1878,12 @@ static void afs_rename_edit_dir(struct afs_operation *op) &vnode->fid, afs_edit_dir_for_rename_2); } +if (S_ISDIR (vnode->netfs.inode.i_mode) && + new_dvnode != orig_dvnode && +test_bit (AFS_VNODE_DIR_VALID , &vnode->flags)) +afs_edit_dir_update_dotdot (vnode, new_dvnode, + afs_edit_dir_for_rename_sub); + new_inode =d_inode (new_dentry);if (new_inode) {spin_lock (&new_inode->i_lock);
fs/afs/dir_edit.c +89 -2
102 lines not on this page · raw message
fs/afs/internal.h +2 -0
@@ -1037,6 +1037,8 @@ extern void afs_check_for_remote_deletion(struct afs_operation *);extern void afs_edit_dir_add (struct afs_vnode *,struct qstr *,struct afs_fid *,enum afs_edit_dir_reason );extern void afs_edit_dir_remove (struct afs_vnode *,struct qstr *,enum afs_edit_dir_reason ); +void afs_edit_dir_update_dotdot (struct afs_vnode *vnode,struct afs_vnode *new_dvnode, +enum afs_edit_dir_reason why);/* * dir_silly.c
include/trace/events/afs.h +6 -1
@@ -295,7 +295,11 @@ enum yfs_cm_operation { EM(afs_edit_dir_delete, "delete") \ EM(afs_edit_dir_delete_error, "d_err ") \ EM(afs_edit_dir_delete_inval, "d_invl") \ - E_(afs_edit_dir_delete_noent, "d_nent") + EM(afs_edit_dir_delete_noent, "d_nent") \ + EM(afs_edit_dir_update_dd, "u_ddot") \ + EM(afs_edit_dir_update_error, "u_fail") \ + EM(afs_edit_dir_update_inval, "u_invl") \ + E_(afs_edit_dir_update_nodd, "u_nodd")#define afs_edit_dir_reasons \ EM(afs_edit_dir_for_create, "Create") \
@@ -304,6 +308,7 @@ enum yfs_cm_operation { EM(afs_edit_dir_for_rename_0, "Renam0") \ EM(afs_edit_dir_for_rename_1, "Renam1") \ EM(afs_edit_dir_for_rename_2, "Renam2") \ + EM(afs_edit_dir_for_rename_sub, "RnmSub") \ EM(afs_edit_dir_for_rmdir, "RmDir ") \ EM(afs_edit_dir_for_silly_0, "S_Ren0") \EM (afs_edit_dir_for_silly_1,"S_Ren1" ) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/151 ACPI: CPPC: Make rmw_lock a raw_spin_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
[ Upstream commit 1c10941e34c5fdc0357e46a25bd130d9cf40b925 ]
The following BUG was triggered:
=============================
[ BUG: Invalid wait context ]
6.12.0-rc2-XXX #406 Not tainted
-----------------------------
kworker/1:1/62 is trying to lock:ffffff8801593030 (&cpc_ptr->rmw_lock){+.+.}-{3:3}, at: cpc_write+0xcc/0x370 other info that might help us debug this:
context-{5:5}
2 locks held by kworker/1:1/62:
#0: ffffff897ef5ec98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x50 #1: ffffff880154e238 (&sg_policy->update_lock){....}-{2:2}, at: sugov_update_shared+0x3c/0x280
stack backtrace: CPU: 1 UID: 0 PID: 62 Comm: kworker/1:1 Not tainted 6.12.0-rc2-g9654bd3e8806 #406 Workqueue: 0x0 (events) Call trace: dump_backtrace+0xa4/0x130 show_stack+0x20/0x38 dump_stack_lvl+0x90/0xd0 dump_stack+0x18/0x28 __lock_acquire+0x480/0x1ad8 lock_acquire+0x114/0x310 _raw_spin_lock+0x50/0x70 cpc_write+0xcc/0x370 cppc_set_perf+0xa0/0x3a8 cppc_cpufreq_fast_switch+0x40/0xc0 cpufreq_driver_fast_switch+0x4c/0x218 sugov_update_shared+0x234/0x280 update_load_avg+0x6ec/0x7b8 dequeue_entities+0x108/0x830 dequeue_task_fair+0x58/0x408 __schedule+0x4f0/0x1070 schedule+0x54/0x130 worker_thread+0xc0/0x2e8 kthread+0x130/0x148 ret_from_fork+0x10/0x20
sugov_update_shared() locks a raw_spinlock while cpc_write() locks a spinlock.
To have a correct wait-type order, update rmw_lock to a raw spinlock and ensure that interrupts will be disabled on the CPU holding it.
--- drivers/acpi/cppc_acpi.c | 9 +++++---- include/acpi/cppc_acpi.h | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-)
drivers/acpi/cppc_acpi.c +5 -4
@@ -863,7 +863,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)/* Store CPU Logical ID */ cpc_ptr->cpu_id = pr->id; -spin_lock_init (&cpc_ptr->rmw_lock); +raw_spin_lock_init (&cpc_ptr->rmw_lock);/* Parse PSD data for this CPU */ ret =acpi_get_psd (cpc_ptr, handle);
@@ -1083,6 +1083,7 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu);struct cpc_reg *reg = ®_res->cpc_entry.reg;struct cpc_desc *cpc_desc; +unsigned long flags; size =GET_BIT_WIDTH (reg);
@@ -1122,7 +1123,7 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)return -ENODEV ; } -spin_lock (&cpc_desc->rmw_lock); +raw_spin_lock_irqsave (&cpc_desc->rmw_lock, flags);switch (size) {case 8 : prev_val =readb_relaxed (vaddr);
@@ -1137,7 +1138,7 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val) prev_val =readq_relaxed (vaddr);break ;default : -spin_unlock (&cpc_desc->rmw_lock); +raw_spin_unlock_irqrestore (&cpc_desc->rmw_lock, flags);return -EFAULT ; } val =MASK_VAL_WRITE (reg, prev_val, val);
@@ -1170,7 +1171,7 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val) }if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) -spin_unlock (&cpc_desc->rmw_lock); +raw_spin_unlock_irqrestore (&cpc_desc->rmw_lock, flags);return ret_val; }
include/acpi/cppc_acpi.h +1 -1
@@ -65,7 +65,7 @@ struct cpc_desc {int write_cmd_status;int write_cmd_id;/* Lock used for RMW operations in cpc_write() */ -spinlock_t rmw_lock; +raw_spinlock_t rmw_lock;struct cpc_register_resource cpc_regs[MAX_CPC_REG_ENT ];struct acpi_psd_package domain_info;struct kobject kobj;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/151 smb: client: fix parsing of device numbers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 663f295e35594f4c2584fc68c28546b747b637cd ]
Report correct major and minor numbers from special files created with NFS reparse points.
--- fs/smb/client/reparse.c | 6 +++--- fs/smb/client/reparse.h | 9 +-------- 2 files changed, 4 insertions(+), 11 deletions(-)
fs/smb/client/reparse.c +3 -3
@@ -497,7 +497,7 @@ static void wsl_to_fattr(struct cifs_open_info_data *data,else if (!strncmp (name,SMB2_WSL_XATTR_MODE , nlen)) fattr->cf_mode = (umode_t )le32_to_cpu (*(__le32 *)v);else if (!strncmp (name,SMB2_WSL_XATTR_DEV , nlen)) - fattr->cf_rdev =wsl_mkdev (v); + fattr->cf_rdev =reparse_mkdev (v); }while (next); out: fattr->cf_dtype =S_DT (fattr->cf_mode);
@@ -518,13 +518,13 @@ bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,if (le16_to_cpu (buf->ReparseDataLength) !=sizeof (buf->InodeType) +8 )return false; fattr->cf_mode |=S_IFCHR ; - fattr->cf_rdev =reparse_nfs_mkdev (buf); + fattr->cf_rdev =reparse_mkdev (buf->DataBuffer);break ;case NFS_SPECFILE_BLK :if (le16_to_cpu (buf->ReparseDataLength) !=sizeof (buf->InodeType) +8 )return false; fattr->cf_mode |=S_IFBLK ; - fattr->cf_rdev =reparse_nfs_mkdev (buf); + fattr->cf_rdev =reparse_mkdev (buf->DataBuffer);break ;case NFS_SPECFILE_FIFO : fattr->cf_mode |=S_IFIFO ;
fs/smb/client/reparse.h +1 -8
@@ -18,14 +18,7 @@*/ #define IO_REPARSE_TAG_INTERNAL ((__u32)~0U) -static inline dev_t reparse_nfs_mkdev (struct reparse_posix_data *buf) -{ -u64 v =le64_to_cpu (*(__le64 *)buf->DataBuffer); - -return MKDEV (v >>32 , v &0xffffffff ); -} - -static inline dev_t wsl_mkdev (void *ptr) +static inline dev_t reparse_mkdev (void *ptr) {u64 v =le64_to_cpu (*(__le64 *)ptr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/151 smb: client: set correct device number on nfs reparse points
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit a9de67336a4aa3ff2e706ba023fb5f7ff681a954 ]
Fix major and minor numbers set on special files created with NFS reparse points.
--- fs/smb/client/reparse.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/smb/client/reparse.c +2 -2
@@ -108,8 +108,8 @@ static int nfs_set_reparse_buf(struct reparse_posix_data *buf, buf->InodeType =cpu_to_le64 (type); buf->ReparseDataLength =cpu_to_le16 (len + dlen -sizeof (struct reparse_data_buffer )); - *(__le64 *)buf->DataBuffer =cpu_to_le64 (((u64 )MAJOR (dev) <<32 ) | -MINOR (dev)); + *(__le64 *)buf->DataBuffer =cpu_to_le64 (((u64 )MINOR (dev) <<32 ) | +MAJOR (dev)); iov->iov_base = buf; iov->iov_len = len + dlen;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/151 cxl/events: Fix Trace DRAM Event Record
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiju Jose <[email protected]>
[ Upstream commit 53ab8678e7180834be29cf56cd52825fc3427c02 ]
CXL spec rev 3.0 section 8.2.9.2.1.2 defines the DRAM Event Record.
Fix decode memory event type field of DRAM Event Record.
For e.g. if value is 0x1 it will be reported as an Invalid Address (General Media Event Record - Memory Event Type) instead of Scrub Media ECC Error (DRAM Event Record - Memory Event Type) and so on.
--- drivers/cxl/core/trace.h | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
drivers/cxl/core/trace.h +14 -3
@@ -278,7 +278,7 @@ TRACE_EVENT(cxl_generic_event,#define CXL_GMER_MEM_EVT_TYPE_ECC_ERROR 0x00#define CXL_GMER_MEM_EVT_TYPE_INV_ADDR 0x01#define CXL_GMER_MEM_EVT_TYPE_DATA_PATH_ERROR 0x02 -#define show_mem_event_type (type) __print_symbolic(type, \ +#define show_gmer_mem_event_type (type) __print_symbolic(type, \ { CXL_GMER_MEM_EVT_TYPE_ECC_ERROR, "ECC Error" }, \ { CXL_GMER_MEM_EVT_TYPE_INV_ADDR, "Invalid Address" }, \ { CXL_GMER_MEM_EVT_TYPE_DATA_PATH_ERROR, "Data Path Error" } \
@@ -359,7 +359,7 @@ TRACE_EVENT(cxl_general_media,"device=%x comp_id=%s validity_flags='%s'" , __entry->dpa,show_dpa_flags (__entry->dpa_flags),show_event_desc_flags (__entry->descriptor), -show_mem_event_type (__entry->type), +show_gmer_mem_event_type (__entry->type),show_trans_type (__entry->transaction_type), __entry->channel, __entry->rank, __entry->device, __print_hex(__entry->comp_id, CXL_EVENT_GEN_MED_COMP_ID_SIZE),
@@ -376,6 +376,17 @@ TRACE_EVENT(cxl_general_media,* DRAM Event Record defines many fields the same as the General Media Event * Record. Reuse those definitions as appropriate. */ +#define CXL_DER_MEM_EVT_TYPE_ECC_ERROR 0x00 +#define CXL_DER_MEM_EVT_TYPE_SCRUB_MEDIA_ECC_ERROR 0x01 +#define CXL_DER_MEM_EVT_TYPE_INV_ADDR 0x02 +#define CXL_DER_MEM_EVT_TYPE_DATA_PATH_ERROR 0x03 +#define show_dram_mem_event_type (type) __print_symbolic(type, \ + { CXL_DER_MEM_EVT_TYPE_ECC_ERROR, "ECC Error" }, \ + { CXL_DER_MEM_EVT_TYPE_SCRUB_MEDIA_ECC_ERROR, "Scrub Media ECC Error" }, \ + { CXL_DER_MEM_EVT_TYPE_INV_ADDR, "Invalid Address" }, \ + { CXL_DER_MEM_EVT_TYPE_DATA_PATH_ERROR, "Data Path Error" } \ +) +#define CXL_DER_VALID_CHANNEL BIT(0)#define CXL_DER_VALID_RANK BIT(1)#define CXL_DER_VALID_NIBBLE BIT(2)
@@ -449,7 +460,7 @@ TRACE_EVENT(cxl_dram,"validity_flags='%s'" , __entry->dpa,show_dpa_flags (__entry->dpa_flags),show_event_desc_flags (__entry->descriptor), -show_mem_event_type (__entry->type), +show_dram_mem_event_type (__entry->type),show_trans_type (__entry->transaction_type), __entry->channel, __entry->rank, __entry->nibble_mask, __entry->bank_group, __entry->bank,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/151 ntfs3: Add bounds checking to mi_enum_attr()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: lei lu <[email protected]>
[ Upstream commit 556bdf27c2dd5c74a9caacbe524b943a6cd42d99 ]
Added bounds checking to make sure that every attr don't stray beyond valid memory region.
--- fs/ntfs3/record.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
fs/ntfs3/record.c +10 -13
@@ -223,28 +223,19 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) prev_type =0 ; attr =Add2Ptr (rec, off); }else { -/* Check if input attr inside record. */ +/* +* We don't need to check previous attr here. There is +* a bounds checking in the previous round. +*/ off =PtrOffset (rec, attr); -if (off >= used) -return NULL ; asize =le32_to_cpu (attr->size); -if (asize <SIZEOF_RESIDENT ) { -/* Impossible 'cause we should not return such attribute. */ -return NULL ; - } - -/* Overflow check. */ -if (off + asize < off) -return NULL ; prev_type =le32_to_cpu (attr->type); attr =Add2Ptr (attr, asize); off += asize; } - asize =le32_to_cpu (attr->size); -/* Can we use the first field (attr->type). */ if (off +8 > used) {static_assert (ALIGN (sizeof (enum ATTR_TYPE ),8 ) ==8 );
@@ -265,6 +256,12 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)if (t32 < prev_type)return NULL ; + asize =le32_to_cpu (attr->size); +if (asize <SIZEOF_RESIDENT ) { +/* Impossible 'cause we should not return such attribute. */ +return NULL ; + } +/* Check overflow and boundary. */ if (off + asize < off || off + asize > used)return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/151 fs/ntfs3: Check if more than chunk-size bytes are written
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Ballance <[email protected]>
[ Upstream commit 9931122d04c6d431b2c11b5bb7b10f28584067f0 ]
A incorrectly formatted chunk may decompress into more than LZNT_CHUNK_SIZE bytes and a index out of bounds will occur in s_max_off.
--- fs/ntfs3/lznt.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ntfs3/lznt.c +3 -0
@@ -236,6 +236,9 @@ static inline ssize_t decompress_chunk(u8 *unc, u8 *unc_end, const u8 *cmpr,/* Do decompression until pointers are inside range. */ while (up < unc_end && cmpr < cmpr_end) { +// return err if more than LZNT_CHUNK_SIZE bytes are written +if (up - unc >LZNT_CHUNK_SIZE ) +return -EINVAL ;/* Correct index */ while (unc + s_max_off[index] < up) index +=1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/151 fs/ntfs3: Fix warning possible deadlock in ntfs_set_state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 5b2db723455a89dc96743d34d8bdaa23a402db2f ]
Use non-zero subkey to skip analyzer warnings.
--- fs/ntfs3/ntfs_fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ntfs3/ntfs_fs.h +1 -1
@@ -334,7 +334,7 @@ struct mft_inode {/* Nested class for ntfs_inode::ni_lock. */ enum ntfs_inode_mutex_lock_class { -NTFS_INODE_MUTEX_DIRTY , +NTFS_INODE_MUTEX_DIRTY =1 ,NTFS_INODE_MUTEX_SECURITY ,NTFS_INODE_MUTEX_OBJID ,NTFS_INODE_MUTEX_REPARSE ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/151 fs/ntfs3: Stale inode instead of bad
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 1fd21919de6de245b63066b8ee3cfba92e36f0e9 ]
Fixed the logic of processing inode with wrong sequence number.
--- fs/ntfs3/inode.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/ntfs3/inode.c +7 -3
@@ -532,11 +532,15 @@ struct inode *ntfs_iget5(struct super_block *sb, const struct MFT_REF *ref,if (inode->i_state &I_NEW ) inode =ntfs_read_mft (inode, name, ref);else if (ref->seq !=ntfs_i (inode)->mi.mrec->seq) { -/* Inode overlaps? */ -_ntfs_bad_inode (inode); +/* +* Sequence number is not expected. +* Looks like inode was reused but caller uses the old reference +*/ +iput (inode); + inode =ERR_PTR (-ESTALE ); } -if (IS_ERR (inode) && name) +if (IS_ERR (inode))ntfs_set_state (sb->s_fs_info,NTFS_DIRTY_ERROR );return inode;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/151 fs/ntfs3: Add rough attr alloc_size check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit c4a8ba334262e9a5c158d618a4820e1b9c12495c ]
--- fs/ntfs3/record.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ntfs3/record.c +3 -0
@@ -331,6 +331,9 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)if (attr->nres.c_unit)return NULL ; + +if (alloc_size > mi->sbi->volume.size) +return NULL ; }return attr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/151 fs/ntfs3: Fix possible deadlock in mi_read
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 03b097099eef255fbf85ea6a786ae3c91b11f041 ]
Mutex lock with another subclass used in ni_lock_dir().
--- fs/ntfs3/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ntfs3/namei.c +1 -1
@@ -81,7 +81,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,if (err <0 ) inode =ERR_PTR (err);else { -ni_lock (ni); +ni_lock_dir (ni); inode =dir_search_u (dir, uni,NULL );ni_unlock (ni); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/151 fs/ntfs3: Additional check in ni_clear()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit d178944db36b3369b78a08ba520de109b89bf2a9 ]
Checking of NTFS_FLAGS_LOG_REPLAYING added to prevent access to uninitialized bitmap during replay process.
--- fs/ntfs3/frecord.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ntfs3/frecord.c +3 -1
@@ -102,7 +102,9 @@ void ni_clear(struct ntfs_inode *ni) {struct rb_node *node; -if (!ni->vfs_inode.i_nlink && ni->mi.mrec &&is_rec_inuse (ni->mi.mrec)) +if (!ni->vfs_inode.i_nlink && ni->mi.mrec && +is_rec_inuse (ni->mi.mrec) && + !(ni->mi.sbi->flags &NTFS_FLAGS_LOG_REPLAYING ))ni_delete_all (ni);al_destroy (ni);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/151 fs/ntfs3: Fix general protection fault in run_is_mapped_full
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit a33fb016e49e37aafab18dc3c8314d6399cb4727 ]
Fixed deleating of a non-resident attribute in ntfs_create_inode() rollback.
--- fs/ntfs3/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ntfs3/inode.c +4 -1
@@ -1703,7 +1703,10 @@ struct inode *ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, attr =ni_find_attr (ni,NULL ,NULL ,ATTR_EA ,NULL ,0 ,NULL ,NULL );if (attr && attr->non_res) {/* Delete ATTR_EA, if non-resident. */ -attr_set_size (ni,ATTR_EA ,NULL ,0 ,NULL ,0 ,NULL , false,NULL ); +struct runs_tree run; +run_init (&run); +attr_set_size (ni,ATTR_EA ,NULL ,0 , &run,0 ,NULL , false,NULL ); +run_close (&run); }if (rp_inserted)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/151 fs/ntfs3: Additional check in ntfs_file_release
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 031d6f608290c847ba6378322d0986d08d1a645a ]
--- fs/ntfs3/file.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/ntfs3/file.c +8 -1
@@ -1173,7 +1173,14 @@ static int ntfs_file_release(struct inode *inode, struct file *file)/* If we are last writer on the inode, drop the block reservation. */ if (sbi->options->prealloc && ((file->f_mode &FMODE_WRITE ) && -atomic_read (&inode->i_writecount) ==1 )) { +atomic_read (&inode->i_writecount) ==1 ) +/* +* The only file when inode->i_fop = &ntfs_file_operations and +* init_rwsem(&ni->file.run_lock) is not called explicitly is MFT. +* +* Add additional check here. +*/ + && inode->i_ino !=MFT_REC_MFT ) {ni_lock (ni);down_write (&ni->file.run_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/151 scsi: scsi_transport_fc: Allow setting rport state to current state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Marzinski <[email protected]>
[ Upstream commit d539a871ae47a1f27a609a62e06093fa69d7ce99 ]
The only input fc_rport_set_marginal_state() currently accepts is "Marginal" when port_state is "Online", and "Online" when the port_state is "Marginal". It should also allow setting port_state to its current state, either "Marginal or "Online".
--- drivers/scsi/scsi_transport_fc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/scsi_transport_fc.c +2 -2
@@ -1255,7 +1255,7 @@ static ssize_t fc_rport_set_marginal_state(struct device *dev,*/ if (rport->port_state ==FC_PORTSTATE_ONLINE ) rport->port_state = port_state; -else +else if (port_state != rport->port_state)return -EINVAL ; }else if (port_state ==FC_PORTSTATE_ONLINE ) {/*
@@ -1265,7 +1265,7 @@ static ssize_t fc_rport_set_marginal_state(struct device *dev,*/ if (rport->port_state ==FC_PORTSTATE_MARGINAL ) rport->port_state = port_state; -else +else if (port_state != rport->port_state)return -EINVAL ; }else return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/151 cifs: Improve creating native symlinks pointing to directory
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit 3eb40512530e4f64f819d8e723b6f41695dace5a ]
SMB protocol for native symlinks distinguish between symlink to directory and symlink to file. These two symlink types cannot be exchanged, which means that symlink of file type pointing to directory cannot be resolved at all (and vice-versa).
Windows follows this rule for local filesystems (NTFS) and also for SMB.
Linux SMB client currenly creates all native symlinks of file type. Which means that Windows (and some other SMB clients) cannot resolve symlinks pointing to directory created by Linux SMB client.
As Linux system does not distinguish between directory and file symlinks, its API does not provide enough information for Linux SMB client during creating of native symlinks.
Add some heuristic into the Linux SMB client for choosing the correct symlink type during symlink creation. Check if the symlink target location ends with slash, or last path component is dot or dot-dot, and check if the target location on SMB share exists and is a directory. If at least one condition is truth then create a new SMB symlink of directory type. Otherwise create it as file type symlink.
This change improves interoperability with Windows systems. Windows systems would be able to resolve more SMB symlinks created by Linux SMB client which points to existing directory.
--- fs/smb/client/reparse.c | 164 +++++++++++++++++++++++++++++++++++++- fs/smb/client/smb2inode.c | 3 +- fs/smb/client/smb2proto.h | 1 + 3 files changed, 164 insertions(+), 4 deletions(-)
fs/smb/client/reparse.c +161 -3
@@ -14,6 +14,12 @@#include "fs_context.h" #include "reparse.h" +static int detect_directory_symlink_target (struct cifs_sb_info *cifs_sb, +const unsigned int xid, +const char *full_path, +const char *symname, +bool *directory); +int smb2_create_reparse_symlink (const unsigned int xid,struct inode *inode,struct dentry *dentry,struct cifs_tcon *tcon,const char *full_path,const char *symname)
@@ -24,6 +30,7 @@ int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode,struct inode *new;struct kvec iov;__le16 *path; +bool directory;char *sym, sep =CIFS_DIR_SEP (cifs_sb);u16 len, plen;int rc =0 ;
@@ -45,6 +52,18 @@ int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode, goto out; } +/* +* SMB distinguish between symlink to directory and symlink to file. +* They cannot be exchanged (symlink of file type which points to +* directory cannot be resolved and vice-versa). Try to detect if +* the symlink target could be a directory or not. When detection +* fails then treat symlink as a file (non-directory) symlink. +*/ + directory = false; + rc =detect_directory_symlink_target (cifs_sb, xid, full_path, symname, &directory); +if (rc <0 ) + goto out; + plen =2 *UniStrnlen ((wchar_t *)path,PATH_MAX ); len =sizeof (*buf) + plen *2 ; buf =kzalloc (len,GFP_KERNEL );
@@ -69,7 +88,8 @@ int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode, iov.iov_base = buf; iov.iov_len = len; new =smb2_get_reparse_inode (&data, inode->i_sb, xid, - tcon, full_path, &iov,NULL ); + tcon, full_path, directory, + &iov,NULL );if (!IS_ERR (new))d_instantiate (dentry, new);else
@@ -81,6 +101,144 @@ int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode,return rc; } +static int detect_directory_symlink_target (struct cifs_sb_info *cifs_sb, +const unsigned int xid, +const char *full_path, +const char *symname, +bool *directory) +{ +char sep =CIFS_DIR_SEP (cifs_sb); +struct cifs_open_parms oparms; +struct tcon_link *tlink; +struct cifs_tcon *tcon; +const char *basename; +struct cifs_fid fid; +char *resolved_path; +int full_path_len; +int basename_len; +int symname_len; +char *path_sep; +__u32 oplock; +int open_rc; + +/* +* First do some simple check. If the original Linux symlink target ends +* with slash, or last path component is dot or dot-dot then it is for +* sure symlink to the directory. +*/ + basename =kbasename (symname); + basename_len =strlen (basename); +if (basename_len ==0 ||/* symname ends with slash */ + (basename_len ==1 && basename[0 ] =='.' ) ||/* last component is "." */ + (basename_len ==2 && basename[0 ] =='.' && basename[1 ] =='.' )) {/* or ".." */ + *directory = true; +return 0 ; + } + +/* +* For absolute symlinks it is not possible to determinate +* if it should point to directory or file. +*/ +if (symname[0 ] =='/' ) { +cifs_dbg (FYI , +"%s: cannot determinate if the symlink target path '%s' " +"is directory or not, creating '%s' as file symlink\n" , + __func__, symname, full_path); +return 0 ; + } + +/* +* If it was not detected as directory yet and the symlink is relative +* then try to resolve the path on the SMB server, check if the path +* exists and determinate if it is a directory or not. +*/ + + full_path_len =strlen (full_path); + symname_len =strlen (symname); + + tlink =cifs_sb_tlink (cifs_sb); +if (IS_ERR (tlink)) +return PTR_ERR (tlink); + + resolved_path =kzalloc (full_path_len + symname_len +1 ,GFP_KERNEL ); +if (!resolved_path) { +cifs_put_tlink (tlink); +return -ENOMEM ; + } + +/* +* Compose the resolved SMB symlink path from the SMB full path +* and Linux target symlink path. +*/ +memcpy (resolved_path, full_path, full_path_len+1 ); + path_sep =strrchr (resolved_path, sep); +if (path_sep) + path_sep++; +else + path_sep = resolved_path; +memcpy (path_sep, symname, symname_len+1 ); +if (sep =='\\' ) +convert_delimiter (path_sep, sep); + + tcon =tlink_tcon (tlink); + oparms =CIFS_OPARMS (cifs_sb, tcon, resolved_path, +FILE_READ_ATTRIBUTES ,FILE_OPEN ,0 ,ACL_NO_MODE ); + oparms.fid = &fid; + +/* Try to open as a directory (NOT_FILE) */ + oplock =0 ; + oparms.create_options =cifs_create_options (cifs_sb, +CREATE_NOT_FILE |OPEN_REPARSE_POINT ); + open_rc = tcon->ses->server->ops->open (xid, &oparms, &oplock,NULL ); +if (open_rc ==0 ) { +/* Successful open means that the target path is definitely a directory. */ + *directory = true; + tcon->ses->server->ops->close (xid, tcon, &fid); + }else if (open_rc == -ENOTDIR ) { +/* -ENOTDIR means that the target path is definitely a file. */ + *directory = false; + }else if (open_rc == -ENOENT ) { +/* -ENOENT means that the target path does not exist. */ +cifs_dbg (FYI , +"%s: symlink target path '%s' does not exist, " +"creating '%s' as file symlink\n" , + __func__, symname, full_path); + }else { +/* Try to open as a file (NOT_DIR) */ + oplock =0 ; + oparms.create_options =cifs_create_options (cifs_sb, +CREATE_NOT_DIR |OPEN_REPARSE_POINT ); + open_rc = tcon->ses->server->ops->open (xid, &oparms, &oplock,NULL ); +if (open_rc ==0 ) { +/* Successful open means that the target path is definitely a file. */ + *directory = false; + tcon->ses->server->ops->close (xid, tcon, &fid); + }else if (open_rc == -EISDIR ) { +/* -EISDIR means that the target path is definitely a directory. */ + *directory = true; + }else { +/* +* This code branch is called when we do not have a permission to +* open the resolved_path or some other client/process denied +* opening the resolved_path. +* +* TODO: Try to use ops->query_dir_first on the parent directory +* of resolved_path, search for basename of resolved_path and +* check if the ATTR_DIRECTORY is set in fi.Attributes. In some +* case this could work also when opening of the path is denied. +*/ +cifs_dbg (FYI , +"%s: cannot determinate if the symlink target path '%s' " +"is directory or not, creating '%s' as file symlink\n" , + __func__, symname, full_path); + } + } + +kfree (resolved_path); +cifs_put_tlink (tlink); +return 0 ; +} +static int nfs_set_reparse_buf (struct reparse_posix_data *buf,mode_t mode,dev_t dev,struct kvec *iov)
@@ -137,7 +295,7 @@ static int mknod_nfs(unsigned int xid, struct inode *inode, }; new =smb2_get_reparse_inode (&data, inode->i_sb, xid, - tcon, full_path, &iov,NULL ); + tcon, full_path, false, &iov,NULL );if (!IS_ERR (new))d_instantiate (dentry, new);else
@@ -283,7 +441,7 @@ static int mknod_wsl(unsigned int xid, struct inode *inode, data.wsl.eas_len = len; new =smb2_get_reparse_inode (&data, inode->i_sb, - xid, tcon, full_path, + xid, tcon, full_path, false, &reparse_iov, &xattr_iov);if (!IS_ERR (new))d_instantiate (dentry, new);
fs/smb/client/smb2inode.c +2 -1
@@ -1198,6 +1198,7 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,const unsigned int xid, struct cifs_tcon *tcon, const char *full_path, + bool directory, struct kvec *reparse_iov, struct kvec *xattr_iov) {
@@ -1217,7 +1218,7 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,FILE_READ_ATTRIBUTES |FILE_WRITE_ATTRIBUTES ,FILE_CREATE , -CREATE_NOT_DIR |OPEN_REPARSE_POINT , + (directory ?CREATE_NOT_FILE :CREATE_NOT_DIR ) |OPEN_REPARSE_POINT , ACL_NO_MODE);if (xattr_iov) oparms.ea_cctx = xattr_iov;
fs/smb/client/smb2proto.h +1 -0
@@ -61,6 +61,7 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,const unsigned int xid, struct cifs_tcon *tcon, const char *full_path, + bool directory, struct kvec *reparse_iov, struct kvec *xattr_iov); int smb2_query_reparse_point(const unsigned int xid,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/151 cifs: Fix creating native symlinks pointing to current or parent directory
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit 63271b7d569fbe924bccc7dadc17d3d07a4e5f7a ]
Calling 'ln -s . symlink' or 'ln -s .. symlink' creates symlink pointing to some object name which ends with U+F029 unicode codepoint. This is because trailing dot in the object name is replaced by non-ASCII unicode codepoint.
So Linux SMB client currently is not able to create native symlink pointing to current or parent directory on Windows SMB server which can be read by either on local Windows server or by any other SMB client which does not implement compatible-reverse character replacement.
Fix this problem in cifsConvertToUTF16() function which is doing that character replacement. Function comment already says that it does not need to handle special cases '.' and '..', but after introduction of native symlinks in reparse point form, this handling is needed.
Note that this change depends on the previous change "cifs: Improve creating native symlinks pointing to directory".
--- fs/smb/client/cifs_unicode.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
fs/smb/client/cifs_unicode.c +14 -3
@@ -484,10 +484,21 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,/** * Remap spaces and periods found at the end of every * component of the path. The special cases of '.' and -* '..' do not need to be dealt with explicitly because -* they are addressed in namei.c:link_path_walk(). +* '..' are need to be handled because of symlinks. +* They are treated as non-end-of-string to avoid +* remapping and breaking symlinks pointing to . or .. **/ -if ((i == srclen -1 ) || (source[i+1 ] =='\\' )) +if ((i ==0 || source[i-1 ] =='\\' ) && + source[i] =='.' && + (i == srclen-1 || source[i+1 ] =='\\' )) + end_of_string = false;/* "." case */ +else if (i >=1 && + (i ==1 || source[i-2 ] =='\\' ) && + source[i-1 ] =='.' && + source[i] =='.' && + (i == srclen-1 || source[i+1 ] =='\\' )) + end_of_string = false;/* ".." case */ +else if ((i == srclen -1 ) || (source[i+1 ] =='\\' )) end_of_string = true;else end_of_string = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/151 thermal: intel: int340x: processor: Remove MMIO RAPL CPU hotplug support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
[ Upstream commit bfc6819e4bf56a55df6178f93241b5845ad672eb ]
CPU0/package0 is always online and the MMIO RAPL driver runs on single package systems only, so there is no need to handle CPU hotplug in it.
Always register a RAPL package device for package 0 and remove the unnecessary CPU hotplug support.
--- .../int340x_thermal/processor_thermal_rapl.c | 66 +++++++------------ 1 file changed, 22 insertions(+), 44 deletions(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.c +22 -44
@@ -19,42 +19,6 @@ static const struct rapl_mmio_regs rapl_mmio_default = { .limits[RAPL_DOMAIN_DRAM] = BIT(POWER_LIMIT2), }; -static int rapl_mmio_cpu_online (unsigned int cpu) -{ -struct rapl_package *rp; - -/* mmio rapl supports package 0 only for now */ -if (topology_physical_package_id (cpu)) -return 0 ; - - rp =rapl_find_package_domain_cpuslocked (cpu, &rapl_mmio_priv, true); -if (!rp) { - rp =rapl_add_package_cpuslocked (cpu, &rapl_mmio_priv, true); -if (IS_ERR (rp)) -return PTR_ERR (rp); - } -cpumask_set_cpu (cpu, &rp->cpumask); -return 0 ; -} - -static int rapl_mmio_cpu_down_prep (unsigned int cpu) -{ -struct rapl_package *rp; -int lead_cpu; - - rp =rapl_find_package_domain_cpuslocked (cpu, &rapl_mmio_priv, true); -if (!rp) -return 0 ; - -cpumask_clear_cpu (cpu, &rp->cpumask); - lead_cpu =cpumask_first (&rp->cpumask); -if (lead_cpu >= nr_cpu_ids) -rapl_remove_package_cpuslocked (rp); -else if (rp->lead_cpu == cpu) - rp->lead_cpu = lead_cpu; -return 0 ; -} -static int rapl_mmio_read_raw (int cpu,struct reg_action *ra) {if (!ra->reg.mmio)
@@ -82,6 +46,7 @@ static int rapl_mmio_write_raw(int cpu, struct reg_action *ra)int proc_thermal_rapl_add (struct pci_dev *pdev,struct proc_thermal_device *proc_priv) {const struct rapl_mmio_regs *rapl_regs = &rapl_mmio_default; +struct rapl_package *rp;enum rapl_domain_reg_id reg;enum rapl_domain_type domain;int ret;
@@ -109,25 +74,38 @@ int proc_thermal_rapl_add(struct pci_dev *pdev, struct proc_thermal_device *procreturn PTR_ERR (rapl_mmio_priv.control_type); } - ret =cpuhp_setup_state (CPUHP_AP_ONLINE_DYN ,"powercap/rapl:online" , - rapl_mmio_cpu_online, rapl_mmio_cpu_down_prep); -if (ret <0 ) { -powercap_unregister_control_type (rapl_mmio_priv.control_type); - rapl_mmio_priv.control_type =NULL ; -return ret; +/* Register a RAPL package device for package 0 which is always online */ + rp =rapl_find_package_domain (0 , &rapl_mmio_priv, false); +if (rp) { + ret = -EEXIST ; + goto err; + } + + rp =rapl_add_package (0 , &rapl_mmio_priv, false); +if (IS_ERR (rp)) { + ret =PTR_ERR (rp); + goto err; } - rapl_mmio_priv.pcap_rapl_online = ret;return 0 ; + +err: +powercap_unregister_control_type (rapl_mmio_priv.control_type); + rapl_mmio_priv.control_type =NULL ; +return ret; }EXPORT_SYMBOL_GPL (proc_thermal_rapl_add);void proc_thermal_rapl_remove (void ) { +struct rapl_package *rp; +if (IS_ERR_OR_NULL (rapl_mmio_priv.control_type))return ; -cpuhp_remove_state (rapl_mmio_priv.pcap_rapl_online); + rp =rapl_find_package_domain (0 , &rapl_mmio_priv, false); +if (rp) +rapl_remove_package (rp);powercap_unregister_control_type (rapl_mmio_priv.control_type); }EXPORT_SYMBOL_GPL (proc_thermal_rapl_remove);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/151 thermal: intel: int340x: processor: Add MMIO RAPL PL4 support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
[ Upstream commit 3fb0eea8a1c4be5884e0731ea76cbd3ce126e1f3 ]
Similar to the MSR RAPL interface, MMIO RAPL supports PL4 too, so add MMIO RAPL PL4d support to the processor_thermal driver.
As a result, the powercap sysfs for MMIO RAPL will show a new "peak power" constraint.
--- .../thermal/intel/int340x_thermal/processor_thermal_rapl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.c +2 -2
@@ -13,9 +13,9 @@ static struct rapl_if_priv rapl_mmio_priv;static const struct rapl_mmio_regs rapl_mmio_default = { .reg_unit =0x5938 , - .regs[RAPL_DOMAIN_PACKAGE ] = {0x59a0 ,0x593c ,0x58f0 ,0 ,0x5930 }, + .regs[RAPL_DOMAIN_PACKAGE ] = {0x59a0 ,0x593c ,0x58f0 ,0 ,0x5930 ,0x59b0 }, .regs[RAPL_DOMAIN_DRAM ] = {0x58e0 ,0x58e8 ,0x58ec ,0 ,0 }, - .limits[RAPL_DOMAIN_PACKAGE ] =BIT (POWER_LIMIT2 ), + .limits[RAPL_DOMAIN_PACKAGE ] =BIT (POWER_LIMIT2 ) |BIT (POWER_LIMIT4 ), .limits[RAPL_DOMAIN_DRAM ] =BIT (POWER_LIMIT2 ), };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/151 net: amd: mvme147: Fix probe banner message
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 82c5b53140faf89c31ea2b3a0985a2f291694169 ]
Currently this driver prints this line with what looks like a rogue format specifier when the device is probed:
[ 2.840000] eth%d: MVME147 at 0xfffe1800, irq 12, Hardware Address xx:xx:xx:xx:xx:xx
Change the printk() for netdev_info() and move it after the registration has completed so it prints out the name of the interface properly.
--- drivers/net/ethernet/amd/mvme147.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/ethernet/amd/mvme147.c +3 -4
@@ -105,10 +105,6 @@ static struct net_device * __init mvme147lance_probe(void) macaddr[3 ] = address&0xff ;eth_hw_addr_set (dev, macaddr); -printk ("%s: MVME147 at 0x%08lx, irq %d, Hardware Address %pM\n" , - dev->name, dev->base_addr,MVME147_LANCE_IRQ , - dev->dev_addr); - lp =netdev_priv (dev); lp->ram =__get_dma_pages (GFP_ATOMIC ,3 );/* 32K */ if (!lp->ram) {
@@ -138,6 +134,9 @@ static struct net_device * __init mvme147lance_probe(void)return ERR_PTR (err); } +netdev_info (dev,"MVME147 at 0x%08lx, irq %d, Hardware Address %pM\n" , + dev->base_addr,MVME147_LANCE_IRQ , dev->dev_addr); +return dev; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/151 NFS: remove revoked delegation from servers delegation list
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
[ Upstream commit 7ef60108069b7e3cc66432304e1dd197d5c0a9b5 ]
After the delegation is returned to the NFS server remove it from the server's delegations list to reduce the time it takes to scan this list.
Network trace captured while running the below script shows the time taken to service the CB_RECALL increases gradually due to the overhead of traversing the delegation list in nfs_delegation_find_inode_server.
The NFS server in this test is a Solaris server which issues CB_RECALL when receiving the all-zero stateid in the SETATTR.
mount=/mnt/data
for i in $(seq 1 20)
do
echo $i
mkdir $mount/testtarfile$i
time tar -C $mount/testtarfile$i -xf 5000_files.tar
done
--- fs/nfs/delegation.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nfs/delegation.c +5 -0
@@ -981,6 +981,11 @@ void nfs_delegation_mark_returned(struct inode *inode, }nfs_mark_delegation_revoked (delegation); +clear_bit (NFS_DELEGATION_RETURNING , &delegation->flags); +spin_unlock (&delegation->lock); +if (nfs_detach_delegation (NFS_I (inode), delegation,NFS_SERVER (inode))) +nfs_put_delegation (delegation); + goto out_rcu_unlock; out_clear_returning:clear_bit (NFS_DELEGATION_RETURNING , &delegation->flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/151 misc: sgi-gru: Dont disable preemption in GRU driver
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dimitri Sivanich <[email protected]>
[ Upstream commit b983b271662bd6104d429b0fd97af3333ba760bf ]
Disabling preemption in the GRU driver is unnecessary, and clashes with sleeping locks in several code paths. Remove preempt_disable and preempt_enable from the GRU driver.
--- drivers/misc/sgi-gru/grukservices.c | 2 -- drivers/misc/sgi-gru/grumain.c | 4 ---- drivers/misc/sgi-gru/grutlbpurge.c | 2 -- 3 files changed, 8 deletions(-)
drivers/misc/sgi-gru/grukservices.c +0 -2
@@ -258,7 +258,6 @@ static int gru_get_cpu_resources(int dsr_bytes, void **cb, void **dsr)int lcpu;BUG_ON (dsr_bytes >GRU_NUM_KERNEL_DSR_BYTES ); -preempt_disable (); bs =gru_lock_kernel_context (-1 ); lcpu =uv_blade_processor_id (); *cb = bs->kernel_cb + lcpu *GRU_HANDLE_STRIDE ;
@@ -272,7 +271,6 @@ static int gru_get_cpu_resources(int dsr_bytes, void **cb, void **dsr)static void gru_free_cpu_resources (void *cb,void *dsr) {gru_unlock_kernel_context (uv_numa_blade_id ()); -preempt_enable (); }/*
drivers/misc/sgi-gru/grumain.c +0 -4
@@ -941,10 +941,8 @@ vm_fault_t gru_fault(struct vm_fault *vmf) again:mutex_lock (>s->ts_ctxlock); -preempt_disable ();if (gru_check_context_placement (gts)) { -preempt_enable ();mutex_unlock (>s->ts_ctxlock);gru_unload_context (gts,1 );return VM_FAULT_NOPAGE ;
@@ -953,7 +951,6 @@ vm_fault_t gru_fault(struct vm_fault *vmf)if (!gts->ts_gru) {STAT (load_user_context);if (!gru_assign_gru_context (gts)) { -preempt_enable ();mutex_unlock (>s->ts_ctxlock);set_current_state (TASK_INTERRUPTIBLE );schedule_timeout (GRU_ASSIGN_DELAY );/* true hack ZZZ */
@@ -969,7 +966,6 @@ vm_fault_t gru_fault(struct vm_fault *vmf) vma->vm_page_prot); } -preempt_enable ();mutex_unlock (>s->ts_ctxlock);return VM_FAULT_NOPAGE ;
drivers/misc/sgi-gru/grutlbpurge.c +0 -2
@@ -65,7 +65,6 @@ static struct gru_tlb_global_handle *get_lock_tgh_handle(struct gru_statestruct gru_tlb_global_handle *tgh;int n; -preempt_disable ();if (uv_numa_blade_id () == gru->gs_blade_id) n =get_on_blade_tgh (gru);else
@@ -79,7 +78,6 @@ static struct gru_tlb_global_handle *get_lock_tgh_handle(struct gru_statestatic void get_unlock_tgh_handle (struct gru_tlb_global_handle *tgh) {unlock_tgh_handle (tgh); -preempt_enable (); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/151 usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcello Sylvester Bauer <[email protected]>
[ Upstream commit a7f3813e589fd8e2834720829a47b5eb914a9afe ]
The dummy_hcd transfer scheduler assumes that the internal kernel timer frequency is set to 1000Hz to give a polling interval of 1ms. Reducing the timer frequency will result in an anti-proportional reduction in transfer performance. Switch to a hrtimer to decouple this association.
--- drivers/usb/gadget/udc/dummy_hcd.c | 35 +++++++++++++++++------------- 1 file changed, 20 insertions(+), 15 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +20 -15
@@ -30,7 +30,7 @@#include <linux/slab.h> #include <linux/errno.h> #include <linux/init.h> -#include <linux/timer.h> +#include <linux/hrtimer.h> #include <linux/list.h> #include <linux/interrupt.h> #include <linux/platform_device.h>
@@ -240,7 +240,7 @@ enum dummy_rh_state {struct dummy_hcd {struct dummy *dum;enum dummy_rh_state rh_state; -struct timer_list timer; +struct hrtimer timer;u32 port_status;u32 old_status;unsigned long re_timeout;
@@ -1301,8 +1301,8 @@ static int dummy_urb_enqueue( urb->error_count =1 ;/* mark as a new urb */ /* kick the scheduler, it'll do the rest */ -if (!timer_pending (&dum_hcd->timer)) -mod_timer (&dum_hcd->timer, jiffies +1 ); +if (!hrtimer_active (&dum_hcd->timer)) +hrtimer_start (&dum_hcd->timer,ms_to_ktime (1 ),HRTIMER_MODE_REL ); done:spin_unlock_irqrestore (&dum_hcd->dum->lock, flags);
@@ -1323,7 +1323,7 @@ static int dummy_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) rc =usb_hcd_check_unlink_urb (hcd, urb, status);if (!rc && dum_hcd->rh_state !=DUMMY_RH_RUNNING && !list_empty (&dum_hcd->urbp_list)) -mod_timer (&dum_hcd->timer, jiffies); +hrtimer_start (&dum_hcd->timer,ns_to_ktime (0 ),HRTIMER_MODE_REL );spin_unlock_irqrestore (&dum_hcd->dum->lock, flags);return rc;
@@ -1777,7 +1777,7 @@ static int handle_control_request(struct dummy_hcd *dum_hcd, struct urb *urb,* drivers except that the callbacks are invoked from soft interrupt * context. */ -static void dummy_timer (struct timer_list *t) +static enum hrtimer_restart dummy_timer (struct hrtimer *t) {struct dummy_hcd *dum_hcd =from_timer (dum_hcd, t, timer);struct dummy *dum = dum_hcd->dum;
@@ -1808,8 +1808,6 @@ static void dummy_timer(struct timer_list *t)break ; } -/* FIXME if HZ != 1000 this will probably misbehave ... */ -/* look at each urb queued by the host side driver */ spin_lock_irqsave (&dum->lock, flags);
@@ -1817,7 +1815,7 @@ static void dummy_timer(struct timer_list *t)dev_err (dummy_dev (dum_hcd),"timer fired with no URBs pending?\n" );spin_unlock_irqrestore (&dum->lock, flags); -return ; +return HRTIMER_NORESTART ; } dum_hcd->next_frame_urbp =NULL ;
@@ -1995,10 +1993,12 @@ static void dummy_timer(struct timer_list *t) dum_hcd->udev =NULL ; }else if (dum_hcd->rh_state ==DUMMY_RH_RUNNING ) {/* want a 1 msec delay here */ -mod_timer (&dum_hcd->timer, jiffies +msecs_to_jiffies (1 )); +hrtimer_start (&dum_hcd->timer,ms_to_ktime (1 ),HRTIMER_MODE_REL ); }spin_unlock_irqrestore (&dum->lock, flags); + +return HRTIMER_NORESTART ; }/*-------------------------------------------------------------------------*/
@@ -2387,7 +2387,7 @@ static int dummy_bus_resume(struct usb_hcd *hcd) dum_hcd->rh_state =DUMMY_RH_RUNNING ;set_link_state (dum_hcd);if (!list_empty (&dum_hcd->urbp_list)) -mod_timer (&dum_hcd->timer, jiffies); +hrtimer_start (&dum_hcd->timer,ns_to_ktime (0 ),HRTIMER_MODE_REL ); hcd->state =HC_STATE_RUNNING ; }spin_unlock_irq (&dum_hcd->dum->lock);
@@ -2465,7 +2465,8 @@ static DEVICE_ATTR_RO(urbs);static int dummy_start_ss (struct dummy_hcd *dum_hcd) { -timer_setup (&dum_hcd->timer, dummy_timer,0 ); +hrtimer_init (&dum_hcd->timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL ); + dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state =DUMMY_RH_RUNNING ; dum_hcd->stream_en_ep =0 ;INIT_LIST_HEAD (&dum_hcd->urbp_list);
@@ -2494,7 +2495,8 @@ static int dummy_start(struct usb_hcd *hcd)return dummy_start_ss (dum_hcd);spin_lock_init (&dum_hcd->dum->lock); -timer_setup (&dum_hcd->timer, dummy_timer,0 ); +hrtimer_init (&dum_hcd->timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL ); + dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state =DUMMY_RH_RUNNING ;INIT_LIST_HEAD (&dum_hcd->urbp_list);
@@ -2513,8 +2515,11 @@ static int dummy_start(struct usb_hcd *hcd)static void dummy_stop (struct usb_hcd *hcd) { -device_remove_file (dummy_dev (hcd_to_dummy_hcd (hcd)), &dev_attr_urbs); -dev_info (dummy_dev (hcd_to_dummy_hcd (hcd)),"stopped\n" ); +struct dummy_hcd *dum_hcd =hcd_to_dummy_hcd (hcd); + +hrtimer_cancel (&dum_hcd->timer); +device_remove_file (dummy_dev (dum_hcd), &dev_attr_urbs); +dev_info (dummy_dev (dum_hcd),"stopped\n" ); }/*-------------------------------------------------------------------------*/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/151 usb: gadget: dummy_hcd: Set transfer interval to 1 microframe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcello Sylvester Bauer <[email protected]>
[ Upstream commit 0a723ed3baa941ca4f51d87bab00661f41142835 ]
Currently, the transfer polling interval is set to 1ms, which is the frame rate of full-speed and low-speed USB. The USB 2.0 specification introduces microframes (125 microseconds) to improve the timing precision of data transfers.
Reducing the transfer interval to 1 microframe increases data throughput for high-speed and super-speed USB communication
--- drivers/usb/gadget/udc/dummy_hcd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +4 -2
@@ -50,6 +50,8 @@#define POWER_BUDGET 500/* in mA; use 8 for low-power port testing */ #define POWER_BUDGET_3 900/* in mA */ +#define DUMMY_TIMER_INT_NSECS 125000/* 1 microframe */ +static const char driver_name[] ="dummy_hcd" ;static const char driver_desc[] ="USB Host+Gadget Emulator" ;
@@ -1302,7 +1304,7 @@ static int dummy_urb_enqueue(/* kick the scheduler, it'll do the rest */ if (!hrtimer_active (&dum_hcd->timer)) -hrtimer_start (&dum_hcd->timer,ms_to_ktime (1 ),HRTIMER_MODE_REL ); +hrtimer_start (&dum_hcd->timer,ns_to_ktime (DUMMY_TIMER_INT_NSECS ),HRTIMER_MODE_REL ); done:spin_unlock_irqrestore (&dum_hcd->dum->lock, flags);
@@ -1993,7 +1995,7 @@ static enum hrtimer_restart dummy_timer(struct hrtimer *t) dum_hcd->udev =NULL ; }else if (dum_hcd->rh_state ==DUMMY_RH_RUNNING ) {/* want a 1 msec delay here */ -hrtimer_start (&dum_hcd->timer,ms_to_ktime (1 ),HRTIMER_MODE_REL ); +hrtimer_start (&dum_hcd->timer,ns_to_ktime (DUMMY_TIMER_INT_NSECS ),HRTIMER_MODE_REL ); }spin_unlock_irqrestore (&dum->lock, flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/151 usb: gadget: dummy_hcd: execute hrtimer callback in softirq context
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Konovalov <[email protected]>
[ Upstream commit 9313d139aa25e572d860f6f673b73a20f32d7f93 ]
Commit a7f3813e589f ("usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler") switched dummy_hcd to use hrtimer and made the timer's callback be executed in the hardirq context.
With that change, __usb_hcd_giveback_urb now gets executed in the hardirq context, which causes problems for KCOV and KMSAN.
One problem is that KCOV now is unable to collect coverage from the USB code that gets executed from the dummy_hcd's timer callback, as KCOV cannot collect coverage in the hardirq context.
Another problem is that the dummy_hcd hrtimer might get triggered in the middle of a softirq with KCOV remote coverage collection enabled, and that causes a WARNING in KCOV, as reported by syzbot. (I sent a separate patch to shut down this WARNING, but that doesn't fix the other two issues.)
Finally, KMSAN appears to ignore tracking memory copying operations that happen in the hardirq context, which causes false positive kernel-infoleaks, as reported by syzbot.
Change the hrtimer in dummy_hcd to execute the callback in the softirq context.
--- drivers/usb/gadget/udc/dummy_hcd.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +8 -6
@@ -1304,7 +1304,8 @@ static int dummy_urb_enqueue(/* kick the scheduler, it'll do the rest */ if (!hrtimer_active (&dum_hcd->timer)) -hrtimer_start (&dum_hcd->timer,ns_to_ktime (DUMMY_TIMER_INT_NSECS ),HRTIMER_MODE_REL ); +hrtimer_start (&dum_hcd->timer,ns_to_ktime (DUMMY_TIMER_INT_NSECS ), +HRTIMER_MODE_REL_SOFT ); done:spin_unlock_irqrestore (&dum_hcd->dum->lock, flags);
@@ -1325,7 +1326,7 @@ static int dummy_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) rc =usb_hcd_check_unlink_urb (hcd, urb, status);if (!rc && dum_hcd->rh_state !=DUMMY_RH_RUNNING && !list_empty (&dum_hcd->urbp_list)) -hrtimer_start (&dum_hcd->timer,ns_to_ktime (0 ),HRTIMER_MODE_REL ); +hrtimer_start (&dum_hcd->timer,ns_to_ktime (0 ),HRTIMER_MODE_REL_SOFT );spin_unlock_irqrestore (&dum_hcd->dum->lock, flags);return rc;
@@ -1995,7 +1996,8 @@ static enum hrtimer_restart dummy_timer(struct hrtimer *t) dum_hcd->udev =NULL ; }else if (dum_hcd->rh_state ==DUMMY_RH_RUNNING ) {/* want a 1 msec delay here */ -hrtimer_start (&dum_hcd->timer,ns_to_ktime (DUMMY_TIMER_INT_NSECS ),HRTIMER_MODE_REL ); +hrtimer_start (&dum_hcd->timer,ns_to_ktime (DUMMY_TIMER_INT_NSECS ), +HRTIMER_MODE_REL_SOFT ); }spin_unlock_irqrestore (&dum->lock, flags);
@@ -2389,7 +2391,7 @@ static int dummy_bus_resume(struct usb_hcd *hcd) dum_hcd->rh_state =DUMMY_RH_RUNNING ;set_link_state (dum_hcd);if (!list_empty (&dum_hcd->urbp_list)) -hrtimer_start (&dum_hcd->timer,ns_to_ktime (0 ),HRTIMER_MODE_REL ); +hrtimer_start (&dum_hcd->timer,ns_to_ktime (0 ),HRTIMER_MODE_REL_SOFT ); hcd->state =HC_STATE_RUNNING ; }spin_unlock_irq (&dum_hcd->dum->lock);
@@ -2467,7 +2469,7 @@ static DEVICE_ATTR_RO(urbs);static int dummy_start_ss (struct dummy_hcd *dum_hcd) { -hrtimer_init (&dum_hcd->timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL ); +hrtimer_init (&dum_hcd->timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state =DUMMY_RH_RUNNING ; dum_hcd->stream_en_ep =0 ;
@@ -2497,7 +2499,7 @@ static int dummy_start(struct usb_hcd *hcd)return dummy_start_ss (dum_hcd);spin_lock_init (&dum_hcd->dum->lock); -hrtimer_init (&dum_hcd->timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL ); +hrtimer_init (&dum_hcd->timer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state =DUMMY_RH_RUNNING ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/151 USB: gadget: dummy-hcd: Fix "task hung" problem
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
[ Upstream commit 5189df7b8088268012882c220d6aca4e64981348 ]
The syzbot fuzzer has been encountering "task hung" problems ever since the dummy-hcd driver was changed to use hrtimers instead of regular timers. It turns out that the problems are caused by a subtle difference between the timer_pending() and hrtimer_active() APIs.
The changeover blindly replaced the first by the second. However, timer_pending() returns True when the timer is queued but not when its callback is running, whereas hrtimer_active() returns True when the hrtimer is queued _or_ its callback is running. This difference occasionally caused dummy_urb_enqueue() to think that the callback routine had not yet started when in fact it was almost finished. As a result the hrtimer was not restarted, which made it impossible for the driver to dequeue later the URB that was just enqueued. This caused usb_kill_urb() to hang, and things got worse from there.
Since hrtimers have no API for telling when they are queued and the callback isn't running, the driver must keep track of this for itself. That's what this patch does, adding a new "timer_pending" flag and setting or clearing it at the appropriate times.
--- drivers/usb/gadget/udc/dummy_hcd.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +15 -5
@@ -254,6 +254,7 @@ struct dummy_hcd {u32 stream_en_ep;u8 num_stream[30 /2 ]; + unsigned timer_pending:1; unsigned active:1; unsigned old_active:1; unsigned resuming:1;
@@ -1303,9 +1304,11 @@ static int dummy_urb_enqueue( urb->error_count =1 ;/* mark as a new urb */ /* kick the scheduler, it'll do the rest */ -if (!hrtimer_active (&dum_hcd->timer)) +if (!dum_hcd->timer_pending) { + dum_hcd->timer_pending =1 ;hrtimer_start (&dum_hcd->timer,ns_to_ktime (DUMMY_TIMER_INT_NSECS ),HRTIMER_MODE_REL_SOFT ); + } done:spin_unlock_irqrestore (&dum_hcd->dum->lock, flags);
@@ -1324,9 +1327,10 @@ static int dummy_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)spin_lock_irqsave (&dum_hcd->dum->lock, flags); rc =usb_hcd_check_unlink_urb (hcd, urb, status); -if (!rc && dum_hcd->rh_state !=DUMMY_RH_RUNNING && - !list_empty (&dum_hcd->urbp_list)) +if (rc ==0 && !dum_hcd->timer_pending) { + dum_hcd->timer_pending =1 ;hrtimer_start (&dum_hcd->timer,ns_to_ktime (0 ),HRTIMER_MODE_REL_SOFT ); + }spin_unlock_irqrestore (&dum_hcd->dum->lock, flags);return rc;
@@ -1813,6 +1817,7 @@ static enum hrtimer_restart dummy_timer(struct hrtimer *t)/* look at each urb queued by the host side driver */ spin_lock_irqsave (&dum->lock, flags); + dum_hcd->timer_pending =0 ;if (!dum_hcd->udev) { dev_err(dummy_dev(dum_hcd),
@@ -1994,8 +1999,10 @@ static enum hrtimer_restart dummy_timer(struct hrtimer *t)if (list_empty (&dum_hcd->urbp_list)) {usb_put_dev (dum_hcd->udev); dum_hcd->udev =NULL ; - }else if (dum_hcd->rh_state ==DUMMY_RH_RUNNING ) { + }else if (!dum_hcd->timer_pending && + dum_hcd->rh_state ==DUMMY_RH_RUNNING ) {/* want a 1 msec delay here */ + dum_hcd->timer_pending =1 ;hrtimer_start (&dum_hcd->timer,ns_to_ktime (DUMMY_TIMER_INT_NSECS ),HRTIMER_MODE_REL_SOFT ); }
@@ -2390,8 +2397,10 @@ static int dummy_bus_resume(struct usb_hcd *hcd) }else { dum_hcd->rh_state =DUMMY_RH_RUNNING ;set_link_state (dum_hcd); -if (!list_empty (&dum_hcd->urbp_list)) +if (!list_empty (&dum_hcd->urbp_list)) { + dum_hcd->timer_pending =1 ;hrtimer_start (&dum_hcd->timer,ns_to_ktime (0 ),HRTIMER_MODE_REL_SOFT ); + } hcd->state =HC_STATE_RUNNING ; }spin_unlock_irq (&dum_hcd->dum->lock);
@@ -2522,6 +2531,7 @@ static void dummy_stop(struct usb_hcd *hcd)struct dummy_hcd *dum_hcd =hcd_to_dummy_hcd (hcd);hrtimer_cancel (&dum_hcd->timer); + dum_hcd->timer_pending =0 ;device_remove_file (dummy_dev (dum_hcd), &dev_attr_urbs);dev_info (dummy_dev (dum_hcd),"stopped\n" ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/151 rcu-tasks: Pull sampling of ->percpu_dequeue_lim out of loop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit e62d8ae4620865411d1b2347980aa28ccf891a3d ]
The rcu_tasks_need_gpcb() samples ->percpu_dequeue_lim as part of the condition clause of a "for" loop, which is a bit confusing. This commit therefore hoists this sampling out of the loop, using the result loaded in the condition clause.
So why does this work in the face of a concurrent switch from single-CPU queueing to per-CPU queueing?
o The call_rcu_tasks_generic() that makes the change has already
enqueued its callback, which means that all of the other CPU's callback queues are empty.
o For the call_rcu_tasks_generic() that first notices
the switch to per-CPU queues, the smp_store_release() used to update ->percpu_enqueue_lim pairs with the raw_spin_trylock_rcu_node()'s full barrier that is between the READ_ONCE(rtp->percpu_enqueue_shift) and the rcu_segcblist_enqueue() that enqueues the callback.
o Because this CPU's queue is empty (unless it happens to
be the original single queue, in which case there is no need for synchronization), this call_rcu_tasks_generic() will do an irq_work_queue() to schedule a handler for the
needed rcuwait_wake_up() call. This call will be ordered
after the first call_rcu_tasks_generic() function's change to ->percpu_dequeue_lim.
o This rcuwait_wake_up() will either happen before or after the
set_current_state() in rcuwait_wait_event(). If it happens before, the "condition" argument's call to rcu_tasks_need_gpcb() will be ordered after the original change, and all callbacks on all CPUs will be visible. Otherwise, if it happens after, then the grace-period kthread's state will be set back to running, which will result in a later call to rcuwait_wait_event() and thus to rcu_tasks_need_gpcb(), which will again see the change.
So it all works out.
Stable-dep-of: fd70e9f1d85f ("rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()")
--- kernel/rcu/tasks.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/rcu/tasks.h +3 -1
@@ -432,6 +432,7 @@ static void rcu_barrier_tasks_generic(struct rcu_tasks *rtp)static int rcu_tasks_need_gpcb (struct rcu_tasks *rtp) {int cpu; +int dequeue_limit;unsigned long flags;bool gpdone =poll_state_synchronize_rcu (rtp->percpu_dequeue_gpseq);long n;
@@ -439,7 +440,8 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp)long ncbsnz =0 ;int needgpcb =0 ; -for (cpu =0 ; cpu <smp_load_acquire (&rtp->percpu_dequeue_lim); cpu++) { + dequeue_limit =smp_load_acquire (&rtp->percpu_dequeue_lim); +for (cpu =0 ; cpu < dequeue_limit; cpu++) {struct rcu_tasks_percpu *rtpcp =per_cpu_ptr (rtp->rtpcpu, cpu);/* Advance and accelerate any new callbacks. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/151 rcu-tasks: Add data to eliminate RCU-tasks/do_exit() deadlocks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit bfe93930ea1ea3c6c115a7d44af6e4fea609067e ]
Holding a mutex across synchronize_rcu_tasks() and acquiring that same mutex in code called from do_exit() after its call to exit_tasks_rcu_start() but before its call to exit_tasks_rcu_stop() results in deadlock. This is by design, because tasks that are far enough into do_exit() are no longer present on the tasks list, making it a bit difficult for RCU Tasks to find them, let alone wait on them to do a voluntary context switch. However, such deadlocks are becoming more frequent. In addition, lockdep currently does not detect such deadlocks and they can be difficult to reproduce.
In addition, if a task voluntarily context switches during that time (for example, if it blocks acquiring a mutex), then this task is in an RCU Tasks quiescent state. And with some adjustments, RCU Tasks could just as well take advantage of that fact.
This commit therefore adds the data structures that will be needed to rely on these quiescent states and to eliminate these deadlocks.
Stable-dep-of: fd70e9f1d85f ("rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()")
--- include/linux/sched.h | 2 ++ kernel/rcu/tasks.h | 2 ++ 2 files changed, 4 insertions(+)
include/linux/sched.h +2 -0
@@ -854,6 +854,8 @@ struct task_struct {u8 rcu_tasks_idx;int rcu_tasks_idle_cpu;struct list_head rcu_tasks_holdout_list; +int rcu_tasks_exit_cpu; +struct list_head rcu_tasks_exit_list;#endif /* #ifdef CONFIG_TASKS_RCU */ #ifdef CONFIG_TASKS_TRACE_RCU
kernel/rcu/tasks.h +2 -0
@@ -32,6 +32,7 @@ typedef void (*postgp_func_t)(struct rcu_tasks *rtp);* @rtp_irq_work: IRQ work queue for deferred wakeups. * @barrier_q_head: RCU callback for barrier operation. * @rtp_blkd_tasks: List of tasks blocked as readers. +* @rtp_exit_list: List of tasks in the latter portion of do_exit(). * @cpu: CPU number corresponding to this entry. * @rtpp: Pointer to the rcu_tasks structure. */
@@ -46,6 +47,7 @@ struct rcu_tasks_percpu {struct irq_work rtp_irq_work;struct rcu_head barrier_q_head;struct list_head rtp_blkd_tasks; +struct list_head rtp_exit_list;int cpu;struct rcu_tasks *rtpp; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/151 rcu-tasks: Initialize data to eliminate RCU-tasks/do_exit() deadlocks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit 46faf9d8e1d52e4a91c382c6c72da6bd8e68297b ]
Holding a mutex across synchronize_rcu_tasks() and acquiring that same mutex in code called from do_exit() after its call to exit_tasks_rcu_start() but before its call to exit_tasks_rcu_stop() results in deadlock. This is by design, because tasks that are far enough into do_exit() are no longer present on the tasks list, making it a bit difficult for RCU Tasks to find them, let alone wait on them to do a voluntary context switch. However, such deadlocks are becoming more frequent. In addition, lockdep currently does not detect such deadlocks and they can be difficult to reproduce.
In addition, if a task voluntarily context switches during that time (for example, if it blocks acquiring a mutex), then this task is in an RCU Tasks quiescent state. And with some adjustments, RCU Tasks could just as well take advantage of that fact.
This commit therefore initializes the data structures that will be needed to rely on these quiescent states and to eliminate these deadlocks.
Stable-dep-of: fd70e9f1d85f ("rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()")
--- init/init_task.c | 1 + kernel/fork.c | 1 + kernel/rcu/tasks.h | 2 ++ 3 files changed, 4 insertions(+)
init/init_task.c +1 -0
@@ -152,6 +152,7 @@ struct task_struct init_task .rcu_tasks_holdout = false, .rcu_tasks_holdout_list = LIST_HEAD_INIT(init_task.rcu_tasks_holdout_list), .rcu_tasks_idle_cpu = -1, + .rcu_tasks_exit_list = LIST_HEAD_INIT(init_task.rcu_tasks_exit_list),#endif #ifdef CONFIG_TASKS_TRACE_RCU .trc_reader_nesting = 0,
kernel/fork.c +1 -0
@@ -1973,6 +1973,7 @@ static inline void rcu_copy_process(struct task_struct *p) p->rcu_tasks_holdout = false;INIT_LIST_HEAD (&p->rcu_tasks_holdout_list); p->rcu_tasks_idle_cpu =-1 ; +INIT_LIST_HEAD (&p->rcu_tasks_exit_list);#endif /* #ifdef CONFIG_TASKS_RCU */ #ifdef CONFIG_TASKS_TRACE_RCU p->trc_reader_nesting =0 ;
kernel/rcu/tasks.h +2 -0
@@ -277,6 +277,8 @@ static void cblist_init_generic(struct rcu_tasks *rtp) rtpcp->rtpp = rtp;if (!rtpcp->rtp_blkd_tasks.next)INIT_LIST_HEAD (&rtpcp->rtp_blkd_tasks); +if (!rtpcp->rtp_exit_list.next) +INIT_LIST_HEAD (&rtpcp->rtp_exit_list); } pr_info("%s: Setting shift to %d and lim to %d rcu_task_cb_adjust=%d.\n", rtp->name,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/151 rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit fd70e9f1d85f5323096ad313ba73f5fe3d15ea41 ]
For kernels built with CONFIG_FORCE_NR_CPUS=y, the nr_cpu_ids is defined as NR_CPUS instead of the number of possible cpus, this will cause the following system panic:
smpboot: Allowing 4 CPUs, 0 hotplug CPUs
...setup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:512 nr_node_ids:1
...
BUG: unable to handle page fault for address: ffffffff9911c8c8 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 15 Comm: rcu_tasks_trace Tainted: G W 6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6 RIP: 0010:rcu_tasks_need_gpcb+0x25d/0x2c0 RSP: 0018:ffffa371c00a3e60 EFLAGS: 00010082 CR2: ffffffff9911c8c8 CR3: 000000040fa20005 CR4: 00000000001706f0 Call Trace: <TASK> ? __die+0x23/0x80 ? page_fault_oops+0xa4/0x180 ? exc_page_fault+0x152/0x180 ? asm_exc_page_fault+0x26/0x40 ? rcu_tasks_need_gpcb+0x25d/0x2c0 ? __pfx_rcu_tasks_kthread+0x40/0x40 rcu_tasks_one_gp+0x69/0x180 rcu_tasks_kthread+0x94/0xc0 kthread+0xe8/0x140 ? __pfx_kthread+0x40/0x40 ret_from_fork+0x34/0x80 ? __pfx_kthread+0x40/0x40 ret_from_fork_asm+0x1b/0x80 </TASK>
Considering that there may be holes in the CPU numbers, use the maximum possible cpu number, instead of nr_cpu_ids, for configuring enqueue and dequeue limits.
[ neeraj.upadhyay: Fix htmldocs build error reported by Stephen Rothwell ]
--- kernel/rcu/tasks.h | 82 ++++++++++++++++++++++++++++++---------------- 1 file changed, 53 insertions(+), 29 deletions(-)
kernel/rcu/tasks.h +53 -29
@@ -34,6 +34,7 @@ typedef void (*postgp_func_t)(struct rcu_tasks *rtp);* @rtp_blkd_tasks: List of tasks blocked as readers. * @rtp_exit_list: List of tasks in the latter portion of do_exit(). * @cpu: CPU number corresponding to this entry. +* @index: Index of this CPU in rtpcp_array of the rcu_tasks structure. * @rtpp: Pointer to the rcu_tasks structure. */ struct rcu_tasks_percpu {
@@ -49,6 +50,7 @@ struct rcu_tasks_percpu {struct list_head rtp_blkd_tasks;struct list_head rtp_exit_list;int cpu; +int index;struct rcu_tasks *rtpp; };
@@ -75,6 +77,7 @@ struct rcu_tasks_percpu {* @postgp_func: This flavor's post-grace-period function (optional). * @call_func: This flavor's call_rcu()-equivalent function. * @rtpcpu: This flavor's rcu_tasks_percpu structure. +* @rtpcp_array: Array of pointers to rcu_tasks_percpu structure of CPUs in cpu_possible_mask. * @percpu_enqueue_shift: Shift down CPU ID this much when enqueuing callbacks. * @percpu_enqueue_lim: Number of per-CPU callback queues in use for enqueuing. * @percpu_dequeue_lim: Number of per-CPU callback queues in use for dequeuing.
@@ -108,6 +111,7 @@ struct rcu_tasks {postgp_func_t postgp_func;call_rcu_func_t call_func;struct rcu_tasks_percpu __percpu *rtpcpu; +struct rcu_tasks_percpu **rtpcp_array;int percpu_enqueue_shift;int percpu_enqueue_lim;int percpu_dequeue_lim;
@@ -181,6 +185,8 @@ module_param(rcu_task_collapse_lim, int, 0444);static int rcu_task_lazy_lim__read_mostly =32 ;module_param (rcu_task_lazy_lim, int,0444 ); +static int rcu_task_cpu_ids; +/* RCU tasks grace-period state for debugging. */ #define RTGS_INIT 0#define RTGS_WAIT_WAIT_CBS 1
@@ -245,6 +251,8 @@ static void cblist_init_generic(struct rcu_tasks *rtp)unsigned long flags;int lim;int shift; +int maxcpu; +int index =0 ;if (rcu_task_enqueue_lim <0 ) { rcu_task_enqueue_lim =1 ;
@@ -254,14 +262,9 @@ static void cblist_init_generic(struct rcu_tasks *rtp) } lim = rcu_task_enqueue_lim; -if (lim > nr_cpu_ids) - lim = nr_cpu_ids; - shift =ilog2 (nr_cpu_ids / lim); -if (((nr_cpu_ids -1 ) >> shift) >= lim) - shift++; -WRITE_ONCE (rtp->percpu_enqueue_shift, shift); -WRITE_ONCE (rtp->percpu_dequeue_lim, lim); -smp_store_release (&rtp->percpu_enqueue_lim, lim); + rtp->rtpcp_array =kcalloc (num_possible_cpus (),sizeof (struct rcu_tasks_percpu *),GFP_KERNEL ); +BUG_ON (!rtp->rtpcp_array); +for_each_possible_cpu (cpu) {struct rcu_tasks_percpu *rtpcp =per_cpu_ptr (rtp->rtpcpu, cpu);
@@ -275,14 +278,29 @@ static void cblist_init_generic(struct rcu_tasks *rtp)INIT_WORK (&rtpcp->rtp_work, rcu_tasks_invoke_cbs_wq); rtpcp->cpu = cpu; rtpcp->rtpp = rtp; + rtpcp->index = index; + rtp->rtpcp_array[index] = rtpcp; + index++;if (!rtpcp->rtp_blkd_tasks.next)INIT_LIST_HEAD (&rtpcp->rtp_blkd_tasks);if (!rtpcp->rtp_exit_list.next)INIT_LIST_HEAD (&rtpcp->rtp_exit_list); + maxcpu = cpu; } -pr_info ("%s: Setting shift to %d and lim to %d rcu_task_cb_adjust=%d.\n" , rtp->name, -data_race (rtp->percpu_enqueue_shift),data_race (rtp->percpu_enqueue_lim), rcu_task_cb_adjust); + rcu_task_cpu_ids = maxcpu +1 ; +if (lim > rcu_task_cpu_ids) + lim = rcu_task_cpu_ids; + shift =ilog2 (rcu_task_cpu_ids / lim); +if (((rcu_task_cpu_ids -1 ) >> shift) >= lim) + shift++; +WRITE_ONCE (rtp->percpu_enqueue_shift, shift); +WRITE_ONCE (rtp->percpu_dequeue_lim, lim); +smp_store_release (&rtp->percpu_enqueue_lim, lim); + +pr_info ("%s: Setting shift to %d and lim to %d rcu_task_cb_adjust=%d rcu_task_cpu_ids=%d.\n" , + rtp->name,data_race (rtp->percpu_enqueue_shift),data_race (rtp->percpu_enqueue_lim), + rcu_task_cb_adjust, rcu_task_cpu_ids); }// Compute wakeup time for lazy callback timer.
@@ -350,7 +368,7 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func, rtpcp->rtp_n_lock_retries =0 ; }if (rcu_task_cb_adjust && ++rtpcp->rtp_n_lock_retries > rcu_task_contend_lim && -READ_ONCE (rtp->percpu_enqueue_lim) != nr_cpu_ids) +READ_ONCE (rtp->percpu_enqueue_lim) != rcu_task_cpu_ids) needadjust = true;// Defer adjustment to avoid deadlock. }// Queuing callbacks before initialization not yet supported.
@@ -370,10 +388,10 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func,raw_spin_unlock_irqrestore_rcu_node (rtpcp, flags);if (unlikely (needadjust)) {raw_spin_lock_irqsave (&rtp->cbs_gbl_lock, flags); -if (rtp->percpu_enqueue_lim != nr_cpu_ids) { +if (rtp->percpu_enqueue_lim != rcu_task_cpu_ids) {WRITE_ONCE (rtp->percpu_enqueue_shift,0 ); -WRITE_ONCE (rtp->percpu_dequeue_lim, nr_cpu_ids); -smp_store_release (&rtp->percpu_enqueue_lim, nr_cpu_ids); +WRITE_ONCE (rtp->percpu_dequeue_lim, rcu_task_cpu_ids); +smp_store_release (&rtp->percpu_enqueue_lim, rcu_task_cpu_ids);pr_info ("Switching %s to per-CPU callback queuing.\n" , rtp->name); }raw_spin_unlock_irqrestore (&rtp->cbs_gbl_lock, flags);
@@ -446,6 +464,8 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp) dequeue_limit =smp_load_acquire (&rtp->percpu_dequeue_lim);for (cpu =0 ; cpu < dequeue_limit; cpu++) { +if (!cpu_possible (cpu)) +continue ;struct rcu_tasks_percpu *rtpcp =per_cpu_ptr (rtp->rtpcpu, cpu);/* Advance and accelerate any new callbacks. */
@@ -483,7 +503,7 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp)if (rcu_task_cb_adjust && ncbs <= rcu_task_collapse_lim) {raw_spin_lock_irqsave (&rtp->cbs_gbl_lock, flags);if (rtp->percpu_enqueue_lim >1 ) { -WRITE_ONCE (rtp->percpu_enqueue_shift,order_base_2 (nr_cpu_ids)); +WRITE_ONCE (rtp->percpu_enqueue_shift,order_base_2 (rcu_task_cpu_ids));smp_store_release (&rtp->percpu_enqueue_lim,1 ); rtp->percpu_dequeue_gpseq =get_state_synchronize_rcu (); gpdone = false;
@@ -498,7 +518,9 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp)pr_info ("Completing switch %s to CPU-0 callback queuing.\n" , rtp->name); }if (rtp->percpu_dequeue_lim ==1 ) { -for (cpu = rtp->percpu_dequeue_lim; cpu < nr_cpu_ids; cpu++) { +for (cpu = rtp->percpu_dequeue_lim; cpu < rcu_task_cpu_ids; cpu++) { +if (!cpu_possible (cpu)) +continue ;struct rcu_tasks_percpu *rtpcp =per_cpu_ptr (rtp->rtpcpu, cpu);WARN_ON_ONCE (rcu_segcblist_n_cbs (&rtpcp->cblist));
@@ -513,30 +535,32 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp)// Advance callbacks and invoke any that are ready. static void rcu_tasks_invoke_cbs (struct rcu_tasks *rtp,struct rcu_tasks_percpu *rtpcp) { -int cpu; -int cpunext;int cpuwq;unsigned long flags;int len; +int index;struct rcu_head *rhp;struct rcu_cblist rcl =RCU_CBLIST_INITIALIZER (rcl);struct rcu_tasks_percpu *rtpcp_next; - cpu = rtpcp->cpu; - cpunext = cpu *2 +1 ; -if (cpunext <smp_load_acquire (&rtp->percpu_dequeue_lim)) { - rtpcp_next =per_cpu_ptr (rtp->rtpcpu, cpunext); - cpuwq =rcu_cpu_beenfullyonline (cpunext) ? cpunext :WORK_CPU_UNBOUND ; -queue_work_on (cpuwq, system_wq, &rtpcp_next->rtp_work); - cpunext++; -if (cpunext <smp_load_acquire (&rtp->percpu_dequeue_lim)) { - rtpcp_next =per_cpu_ptr (rtp->rtpcpu, cpunext); - cpuwq =rcu_cpu_beenfullyonline (cpunext) ? cpunext :WORK_CPU_UNBOUND ; + index = rtpcp->index *2 +1 ; +if (index <num_possible_cpus ()) { + rtpcp_next = rtp->rtpcp_array[index]; +if (rtpcp_next->cpu <smp_load_acquire (&rtp->percpu_dequeue_lim)) { + cpuwq =rcu_cpu_beenfullyonline (rtpcp_next->cpu) ? rtpcp_next->cpu :WORK_CPU_UNBOUND ;queue_work_on (cpuwq, system_wq, &rtpcp_next->rtp_work); + index++; +if (index <num_possible_cpus ()) { + rtpcp_next = rtp->rtpcp_array[index]; +if (rtpcp_next->cpu <smp_load_acquire (&rtp->percpu_dequeue_lim)) { + cpuwq =rcu_cpu_beenfullyonline (rtpcp_next->cpu) ? rtpcp_next->cpu :WORK_CPU_UNBOUND ; +queue_work_on (cpuwq, system_wq, &rtpcp_next->rtp_work); + } + } } } -if (rcu_segcblist_empty (&rtpcp->cblist) || !cpu_possible (cpu)) +if (rcu_segcblist_empty (&rtpcp->cblist))return ;raw_spin_lock_irqsave_rcu_node (rtpcp, flags);rcu_segcblist_advance (&rtpcp->cblist,rcu_seq_current (&rtp->tasks_gp_seq));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/151 ALSA: usb-audio: Add quirks for Dell WD19 dock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Schär <[email protected]>
commit 4413665dd6c528b31284119e3571c25f371e1c36 upstream.
The WD19 family of docks has the same audio chipset as the WD15. This change enables jack detection on the WD19.
We don't need the dell_dock_mixer_init quirk for the WD19. It is only needed because of the dell_alc4020_map quirk for the WD15 in mixer_maps.c, which disables the volume controls. Even for the WD15, this quirk was apparently only needed when the dock firmware was not updated.
--- sound/usb/mixer_quirks.c | 3 +++ 1 file changed, 3 insertions(+)
sound/usb/mixer_quirks.c +3 -0
@@ -3465,6 +3465,9 @@ int snd_usb_mixer_apply_create_quirk(strbreak ; err =dell_dock_mixer_init (mixer);break ; +case USB_ID (0x0bda ,0x402e ):/* Dell WD19 dock */ + err =dell_dock_mixer_create (mixer); +break ;case USB_ID (0x2a39 ,0x3fd2 ):/* RME ADI-2 Pro */ case USB_ID (0x2a39 ,0x3fd3 ):/* RME ADI-2 DAC */
Greg Kroah-Hartman
maintainerPATCH 81/151 usbip: tools: Fix detach_port() invalid port error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zongmin Zhou <[email protected]>
commit e7cd4b811c9e019f5acbce85699c622b30194c24 upstream.
The detach_port() doesn't return error
when detach is attempted on an invalid port.
--- tools/usb/usbip/src/usbip_detach.c | 1 + 1 file changed, 1 insertion(+)
tools/usb/usbip/src/usbip_detach.c +1 -0
@@ -68,6 +68,7 @@ static int detach_port(char *port) }if (!found) { + ret =-1 ;err ("Invalid port %s > maxports %d" , port, vhci_driver->nports); goto call_driver_close;
Greg Kroah-Hartman
maintainerPATCH 82/151 usb: phy: Fix API devm_usb_put_phy() can not release the phy
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
commit fdce49b5da6e0fb6d077986dec3e90ef2b094b50 upstream.
For devm_usb_put_phy(), its comment says it needs to invoke usb_put_phy() to release the phy, but it does not do that actually, so it can not fully undo what the API devm_usb_get_phy() does, that is wrong, fixed by using devres_release() instead of devres_destroy() within the API.
--- drivers/usb/phy/phy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/phy/phy.c +1 -1
@@ -628,7 +628,7 @@ void devm_usb_put_phy(struct device *dev {int r; - r =devres_destroy (dev, devm_usb_phy_release, devm_usb_phy_match, phy); + r =devres_release (dev, devm_usb_phy_release, devm_usb_phy_match, phy);dev_WARN_ONCE (dev, r,"couldn't find PHY resource\n" ); }EXPORT_SYMBOL_GPL (devm_usb_put_phy);
Greg Kroah-Hartman
maintainerPATCH 83/151 usb: typec: fix unreleased fwnode_handle in typec_port_register_altmodes()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 9581acb91eaf5bbe70086bbb6fca808220d358ba upstream.
The 'altmodes_node' fwnode_handle is never released after it is no longer required, which leaks the resource.
Add the required call to fwnode_handle_put() when 'altmodes_node' is no longer required.
--- drivers/usb/typec/class.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/typec/class.c +1 -0
@@ -2194,6 +2194,7 @@ void typec_port_register_altmodes(struct altmodes[index] = alt; index++; } +fwnode_handle_put (altmodes_node); }EXPORT_SYMBOL_GPL (typec_port_register_altmodes);
Greg Kroah-Hartman
maintainerPATCH 84/151 usb: typec: qcom-pmic-typec: use fwnode_handle_put() to release fwnodes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 7f02b8a5b602098f2901166e7e4d583acaed872a upstream.
The right function to release a fwnode acquired via device_get_named_child_node() is fwnode_handle_put(), and not fwnode_remove_software_node(), as no software node is being handled.
Replace the calls to fwnode_remove_software_node() with fwnode_handle_put() in qcom_pmic_typec_probe() and qcom_pmic_typec_remove().
--- drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c +2 -2
@@ -268,7 +268,7 @@ static int qcom_pmic_typec_probe(structreturn 0 ; fwnode_remove: -fwnode_remove_software_node (tcpm->tcpc.fwnode); +fwnode_handle_put (tcpm->tcpc.fwnode);return ret; }
@@ -280,7 +280,7 @@ static void qcom_pmic_typec_remove(strucqcom_pmic_typec_pdphy_stop (tcpm->pmic_typec_pdphy);qcom_pmic_typec_port_stop (tcpm->pmic_typec_port);tcpm_unregister_port (tcpm->tcpm_port); -fwnode_remove_software_node (tcpm->tcpc.fwnode); +fwnode_handle_put (tcpm->tcpc.fwnode); }static struct pmic_typec_pdphy_resources pm8150b_pdphy_res = {
Greg Kroah-Hartman
maintainerPATCH 85/151 phy: qcom: qmp-usb: fix NULL-deref on runtime suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit bd9e4d4a3b127686efc60096271b0a44c3100061 upstream.
Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation") removed most users of the platform device driver data, but mistakenly also removed the initialisation despite the data still being used in the runtime PM callbacks.
Restore the driver data initialisation at probe to avoid a NULL-pointer dereference on runtime suspend.
Apparently no one uses runtime PM, which currently needs to be enabled manually through sysfs, with this driver.
--- drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/phy/qualcomm/phy-qcom-qmp-usb.c +1 -0
@@ -2173,6 +2173,7 @@ static int qmp_usb_probe(struct platformreturn -ENOMEM ; qmp->dev = dev; +dev_set_drvdata (dev, qmp); qmp->cfg =of_device_get_match_data (dev);if (!qmp->cfg)
Greg Kroah-Hartman
maintainerPATCH 86/151 phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 29240130ab77c80bea1464317ae2a5fd29c16a0c upstream.
Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation") removed most users of the platform device driver data from the qcom-qmp-usb driver, but mistakenly also removed the initialisation despite the data still being used in the runtime PM callbacks. This bug was later reproduced when the driver was copied to create the qmp-usb-legacy driver.
Restore the driver data initialisation at probe to avoid a NULL-pointer dereference on runtime suspend.
Apparently no one uses runtime PM, which currently needs to be enabled manually through sysfs, with these drivers.
--- drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c | 1 + 1 file changed, 1 insertion(+)
drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c +1 -0
@@ -1302,6 +1302,7 @@ static int qmp_usb_legacy_probe(struct preturn -ENOMEM ; qmp->dev = dev; +dev_set_drvdata (dev, qmp); qmp->cfg =of_device_get_match_data (dev);if (!qmp->cfg)
Greg Kroah-Hartman
maintainerPATCH 87/151 xhci: Fix Link TRB DMA in command ring stopped completion event
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Faisal Hassan <[email protected]>
commit 075919f6df5dd82ad0b1894898b315fbb3c29b84 upstream.
During the aborting of a command, the software receives a command completion event for the command ring stopped, with the TRB pointing to the next TRB after the aborted command.
If the command we abort is located just before the Link TRB in the command ring, then during the 'command ring stopped' completion event, the xHC gives the Link TRB in the event's cmd DMA, which causes a mismatch in handling command completion event.
To address this situation, move the 'command ring stopped' completion event check slightly earlier, since the specific command it stopped on isn't of significant concern.
--- drivers/usb/host/xhci-ring.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/usb/host/xhci-ring.c +8 -8
@@ -1734,6 +1734,14 @@ static void handle_cmd_completion(structtrace_xhci_handle_command (xhci->cmd_ring, &cmd_trb->generic); + cmd_comp_code =GET_COMP_CODE (le32_to_cpu (event->status)); + +/* If CMD ring stopped we own the trbs between enqueue and dequeue */ +if (cmd_comp_code ==COMP_COMMAND_RING_STOPPED ) { +complete_all (&xhci->cmd_ring_stop_completion); +return ; + } + cmd_dequeue_dma =xhci_trb_virt_to_dma (xhci->cmd_ring->deq_seg, cmd_trb);/*
@@ -1750,14 +1758,6 @@ static void handle_cmd_completion(structcancel_delayed_work (&xhci->cmd_timer); - cmd_comp_code =GET_COMP_CODE (le32_to_cpu (event->status)); - -/* If CMD ring stopped we own the trbs between enqueue and dequeue */ -if (cmd_comp_code ==COMP_COMMAND_RING_STOPPED ) { -complete_all (&xhci->cmd_ring_stop_completion); -return ; - } -if (cmd->command_trb != xhci->cmd_ring->dequeue) {xhci_err (xhci,"Command completion event does not match command\n" );
Greg Kroah-Hartman
maintainerPATCH 88/151 xhci: Use pm_runtime_get to prevent RPM on unsupported systems
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Basavaraj Natikar <[email protected]>
commit 31004740e42846a6f0bb255e6348281df3eb8032 upstream.
Use pm_runtime_put in the remove function and pm_runtime_get to disable RPM on platforms that don't support runtime D3, as re-enabling it through sysfs auto power control may cause the controller to malfunction. This can lead to issues such as hotplug devices not being detected due to failed interrupt generation.
--- drivers/usb/host/xhci-pci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-pci.c +4 -2
@@ -713,7 +713,7 @@ static int xhci_pci_probe(struct pci_devpm_runtime_put_noidle (&dev->dev);if (pci_choose_state (dev,PMSG_SUSPEND ) ==PCI_D0 ) -pm_runtime_forbid (&dev->dev); +pm_runtime_get (&dev->dev);else if (xhci->quirks &XHCI_DEFAULT_PM_RUNTIME_ALLOW )pm_runtime_allow (&dev->dev);
@@ -740,7 +740,9 @@ static void xhci_pci_remove(struct pci_d xhci->xhc_state |=XHCI_STATE_REMOVING ; -if (xhci->quirks &XHCI_DEFAULT_PM_RUNTIME_ALLOW ) +if (pci_choose_state (dev,PMSG_SUSPEND ) ==PCI_D0 ) +pm_runtime_put (&dev->dev); +else if (xhci->quirks &XHCI_DEFAULT_PM_RUNTIME_ALLOW )pm_runtime_forbid (&dev->dev);if (xhci->shared_hcd) {
Greg Kroah-Hartman
maintainerPATCH 89/151 Revert "driver core: Fix uevent_show() vs driver detach race"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 9a71892cbcdb9d1459c84f5a4c722b14354158a5 upstream.
This reverts commit 15fffc6a5624b13b428bb1c6e9088e32a55eb82c.
This commit causes a regression, so revert it for now until it can come back in a way that works for everyone.
--- drivers/base/core.c | 13 +++++-------- drivers/base/module.c | 4 ---- 2 files changed, 5 insertions(+), 12 deletions(-)
drivers/base/core.c +5 -8
@@ -25,7 +25,6 @@#include <linux/mutex.h> #include <linux/pm_runtime.h> #include <linux/netdevice.h> -#include <linux/rcupdate.h> #include <linux/sched/signal.h> #include <linux/sched/mm.h> #include <linux/string_helpers.h>
@@ -2566,7 +2565,6 @@ static const char *dev_uevent_name(conststatic int dev_uevent (const struct kobject *kobj,struct kobj_uevent_env *env) {const struct device *dev =kobj_to_dev (kobj); -struct device_driver *driver;int retval =0 ;/* add device node properties if present */
@@ -2595,12 +2593,8 @@ static int dev_uevent(const struct kobjeif (dev->type && dev->type->name)add_uevent_var (env,"DEVTYPE=%s" , dev->type->name); -/* Synchronize with module_remove_driver() */ -rcu_read_lock (); - driver =READ_ONCE (dev->driver); -if (driver) -add_uevent_var (env,"DRIVER=%s" , driver->name); -rcu_read_unlock (); +if (dev->driver) +add_uevent_var (env,"DRIVER=%s" , dev->driver->name);/* Add common DT information about the device */ of_device_uevent (dev, env);
@@ -2670,8 +2664,11 @@ static ssize_t uevent_show(struct deviceif (!env)return -ENOMEM ; +/* Synchronize with really_probe() */ +device_lock (dev);/* let the kset specific function add its keys */ retval = kset->uevent_ops->uevent (&dev->kobj, env); +device_unlock (dev);if (retval) goto out;
drivers/base/module.c +0 -4
@@ -7,7 +7,6 @@#include <linux/errno.h> #include <linux/slab.h> #include <linux/string.h> -#include <linux/rcupdate.h> #include "base.h" static char *make_driver_name (struct device_driver *drv)
@@ -102,9 +101,6 @@ void module_remove_driver(struct device_if (!drv)return ; -/* Synchronize with dev_uevent() */ -synchronize_rcu (); -sysfs_remove_link (&drv->p->kobj,"module" );if (drv->owner)
Greg Kroah-Hartman
maintainerPATCH 90/151 Revert "selftests/mm: fix deadlock for fork after pthread_create on ARM"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Liaw <[email protected]>
commit 5bb1f4c9340e01003b00b94d539eadb0da88f48e upstream.
Patch series "selftests/mm: revert pthread_barrier change"
On Android arm, pthread_create followed by a fork caused a deadlock in the case where the fork required work to be completed by the created thread.
The previous patches incorrectly assumed that the parent would always initialize the pthread_barrier for the child thread. This reverts the change and replaces the fix for wp-fork-with-event with the original use of atomic_bool.
This patch (of 3):
This reverts commit e142cc87ac4ec618f2ccf5f68aedcd6e28a59d9d.
fork_event_consumer may be called by other tests that do not initialize the pthread_barrier, so this approach is not correct. The subsequent patch will revert to using atomic_bool instead.
--- tools/testing/selftests/mm/uffd-unit-tests.c | 7 ------- 1 file changed, 7 deletions(-)
tools/testing/selftests/mm/uffd-unit-tests.c +0 -7
@@ -237,9 +237,6 @@ static void *fork_event_consumer(void *dfork_event_args *args = data;struct uffd_msg msg = {0 }; -/* Ready for parent thread to fork */ -pthread_barrier_wait (&ready_for_fork); -/* Read until a full msg received */ while (uffd_read_msg (args->parent_uffd, &msg));
@@ -307,12 +304,8 @@ static int pagemap_test_fork(int uffd, b/* Prepare a thread to resolve EVENT_FORK */ if (with_event) { -pthread_barrier_init (&ready_for_fork,NULL ,2 );if (pthread_create (&thread,NULL , fork_event_consumer, &args))err ("pthread_create()" ); -/* Wait for child thread to start before forking */ -pthread_barrier_wait (&ready_for_fork); -pthread_barrier_destroy (&ready_for_fork); } child =fork ();
Greg Kroah-Hartman
maintainerPATCH 91/151 Revert "selftests/mm: replace atomic_bool with pthread_barrier_t"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Liaw <[email protected]>
commit 3673167a3a07f25b3f06754d69f406edea65543a upstream.
This reverts commit e61ef21e27e8deed8c474e9f47f4aa7bc37e138c.
uffd_poll_thread may be called by other tests that do not initialize the pthread_barrier, so this approach is not correct. This will revert to using atomic_bool instead.
--- tools/testing/selftests/mm/uffd-common.c | 5 ++--- tools/testing/selftests/mm/uffd-common.h | 3 ++- tools/testing/selftests/mm/uffd-unit-tests.c | 14 ++++++-------- 3 files changed, 10 insertions(+), 12 deletions(-)
tools/testing/selftests/mm/uffd-common.c +2 -3
@@ -17,7 +17,7 @@ bool map_shared;bool test_uffdio_wp = true;unsigned long long *count_verify;uffd_test_ops_t *uffd_test_ops; -pthread_barrier_t ready_for_fork; +atomic_bool ready_for_fork;static int uffd_mem_fd_create (off_t mem_size,bool hugetlb) {
@@ -508,8 +508,7 @@ void *uffd_poll_thread(void *arg) pollfd[1 ].fd = pipefd[cpu*2 ]; pollfd[1 ].events =POLLIN ; -/* Ready for parent thread to fork */ -pthread_barrier_wait (&ready_for_fork); + ready_for_fork = true;for (;;) { ret =poll (pollfd,2 ,-1 );
tools/testing/selftests/mm/uffd-common.h +2 -1
@@ -33,6 +33,7 @@#include <inttypes.h> #include <stdint.h> #include <sys/random.h> +#include <stdatomic.h> #include "../kselftest.h" #include "vm_util.h"
@@ -98,7 +99,7 @@ extern bool map_shared;extern bool test_uffdio_wp;extern unsigned long long *count_verify;extern volatile bool test_uffdio_copy_eexist; -extern pthread_barrier_t ready_for_fork; +extern atomic_bool ready_for_fork;extern uffd_test_ops_t anon_uffd_test_ops;extern uffd_test_ops_t shmem_uffd_test_ops;
tools/testing/selftests/mm/uffd-unit-tests.c +6 -8
@@ -770,7 +770,7 @@ static void uffd_sigbus_test_common(boolchar c;struct uffd_args args = {0 }; -pthread_barrier_init (&ready_for_fork,NULL ,2 ); + ready_for_fork = false;fcntl (uffd,F_SETFL , uffd_flags |O_NONBLOCK );
@@ -787,9 +787,8 @@ static void uffd_sigbus_test_common(boolif (pthread_create (&uffd_mon,NULL , uffd_poll_thread, &args))err ("uffd_poll_thread create" ); -/* Wait for child thread to start before forking */ -pthread_barrier_wait (&ready_for_fork); -pthread_barrier_destroy (&ready_for_fork); +while (!ready_for_fork) + ;/* Wait for the poll_thread to start executing before forking */ pid =fork ();if (pid <0 )
@@ -830,7 +829,7 @@ static void uffd_events_test_common(boolchar c;struct uffd_args args = {0 }; -pthread_barrier_init (&ready_for_fork,NULL ,2 ); + ready_for_fork = false;fcntl (uffd,F_SETFL , uffd_flags |O_NONBLOCK ); if (uffd_register(uffd, area_dst, nr_pages * page_size,
@@ -841,9 +840,8 @@ static void uffd_events_test_common(boolif (pthread_create (&uffd_mon,NULL , uffd_poll_thread, &args))err ("uffd_poll_thread create" ); -/* Wait for child thread to start before forking */ -pthread_barrier_wait (&ready_for_fork); -pthread_barrier_destroy (&ready_for_fork); +while (!ready_for_fork) + ;/* Wait for the poll_thread to start executing before forking */ pid =fork ();if (pid <0 )
Greg Kroah-Hartman
maintainerPATCH 92/151 wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
commit 393b6bc174b0dd21bb2a36c13b36e62fc3474a23 upstream.
Avoid potentially crashing in the driver because of uninitialized private data
--- net/mac80211/cfg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/cfg.c +2 -1
@@ -3115,7 +3115,8 @@ static int ieee80211_get_tx_power(structstruct ieee80211_local *local =wiphy_priv (wiphy);struct ieee80211_sub_if_data *sdata =IEEE80211_WDEV_TO_SUB_IF (wdev); -if (local->ops->get_txpower) +if (local->ops->get_txpower && + (sdata->flags &IEEE80211_SDATA_IN_DRIVER ))return drv_get_txpower (local, sdata, dbm);if (!local->use_chanctx)
Greg Kroah-Hartman
maintainerPATCH 93/151 wifi: ath10k: Fix memory leak in management tx
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Pubbisetty <[email protected]>
commit e15d84b3bba187aa372dff7c58ce1fd5cb48a076 upstream.
In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during management TX completion. Similar leaks are seen in the management TX cleanup logic.
Kmemleak reports this problem as below,
unreferenced object 0xffffff80b64ed250 (size 16):
comm "kworker/u16:7", pid 148, jiffies 4294687130 (age 714.199s) hex dump (first 16 bytes):
00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00 .+.......t......
backtrace:
[<ffffffe6e7b245dc>] __kmem_cache_alloc_node+0x1e4/0x2d8
[<ffffffe6e7adde88>] kmalloc_trace+0x48/0x110
[<ffffffe6bbd765fc>] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core]
[<ffffffe6bbd3eed4>] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core]
[<ffffffe6e78d5974>] process_scheduled_works+0x1ac/0x400
[<ffffffe6e78d60b8>] worker_thread+0x208/0x328
[<ffffffe6e78dc890>] kthread+0x100/0x1c0
[<ffffffe6e78166c0>] ret_from_fork+0x10/0x20Free the memory during completion and cleanup to fix the leak.
Protect the mgmt_pending_tx idr_remove() operation in ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar->data_lock similar to other instances.
Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1
--- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 7 ++++++- drivers/net/wireless/ath/ath10k/wmi.c | 2 ++ 2 files changed, 8 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/wmi-tlv.c +6 -1
@@ -3042,9 +3042,14 @@ ath10k_wmi_tlv_op_cleanup_mgmt_tx_send(s struct sk_buff *msdu) {struct ath10k_skb_cb *cb =ATH10K_SKB_CB (msdu); +struct ath10k_mgmt_tx_pkt_addr *pkt_addr;struct ath10k_wmi *wmi = &ar->wmi; -idr_remove (&wmi->mgmt_pending_tx, cb->msdu_id); +spin_lock_bh (&ar->data_lock); + pkt_addr =idr_remove (&wmi->mgmt_pending_tx, cb->msdu_id); +spin_unlock_bh (&ar->data_lock); + +kfree (pkt_addr);return 0 ; }
drivers/net/wireless/ath/ath10k/wmi.c +2 -0
@@ -2440,6 +2440,7 @@ wmi_process_mgmt_tx_comp(struct ath10k *dma_unmap_single (ar->dev, pkt_addr->paddr, msdu->len,DMA_TO_DEVICE ); info =IEEE80211_SKB_CB (msdu); +kfree (pkt_addr);if (param->status) { info->flags &= ~IEEE80211_TX_STAT_ACK ;
@@ -9559,6 +9560,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pdma_unmap_single (ar->dev, pkt_addr->paddr, msdu->len,DMA_TO_DEVICE );ieee80211_free_txskb (ar->hw, msdu); +kfree (pkt_addr);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 94/151 wifi: cfg80211: clear wdev->cqm_config pointer on free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit d5fee261dfd9e17b08b1df8471ac5d5736070917 upstream.
When we free wdev->cqm_config when unregistering, we also need to clear out the pointer since the same wdev/netdev may get re-registered in another network namespace, then destroyed later, running this code again, which results in a double-free.
--- net/wireless/core.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/core.c +1 -0
@@ -1233,6 +1233,7 @@ static void _cfg80211_unregister_wdev(st/* deleted from the list, so can't be found from nl80211 any more */ cqm_config =rcu_access_pointer (wdev->cqm_config);kfree_rcu (cqm_config, rcu_head); +RCU_INIT_POINTER (wdev->cqm_config,NULL );/* * Ensure that all events have been processed and
Greg Kroah-Hartman
maintainerPATCH 95/151 wifi: iwlegacy: Clear stale interrupts before resuming device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
commit 07c90acb071b9954e1fecb1e4f4f13d12c544b34 upstream.
iwl4965 fails upon resume from hibernation on my laptop. The reason seems to be a stale interrupt which isn't being cleared out before interrupts are enabled. We end up with a race beween the resume trying to bring things back up, and the restart work (queued form the interrupt handler) trying to bring things down. Eventually the whole thing blows up.
Fix the problem by clearing out any stale interrupts before interrupts get enabled during resume.
Here's a debug log of the indicent:
[ 12.042589] ieee80211 phy0: il_isr ISR inta 0x00000080, enabled 0xaa00008b, fh 0x00000000 [ 12.042625] ieee80211 phy0: il4965_irq_tasklet inta 0x00000080, enabled 0x00000000, fh 0x00000000 [ 12.042651] iwl4965 0000:10:00.0: RF_KILL bit toggled to enable radio. [ 12.042653] iwl4965 0000:10:00.0: On demand firmware reload [ 12.042690] ieee80211 phy0: il4965_irq_tasklet End inta 0x00000000, enabled 0xaa00008b, fh 0x00000000, flags 0x00000282 [ 12.052207] ieee80211 phy0: il4965_mac_start enter [ 12.052212] ieee80211 phy0: il_prep_station Add STA to driver ID 31: ff:ff:ff:ff:ff:ff [ 12.052244] ieee80211 phy0: il4965_set_hw_ready hardware ready [ 12.052324] ieee80211 phy0: il_apm_init Init card's basic functions [ 12.052348] ieee80211 phy0: il_apm_init L1 Enabled; Disabling L0S [ 12.055727] ieee80211 phy0: il4965_load_bsm Begin load bsm [ 12.056140] ieee80211 phy0: il4965_verify_bsm Begin verify bsm [ 12.058642] ieee80211 phy0: il4965_verify_bsm BSM bootstrap uCode image OK [ 12.058721] ieee80211 phy0: il4965_load_bsm BSM write complete, poll 1 iterations [ 12.058734] ieee80211 phy0: __il4965_up iwl4965 is coming up [ 12.058737] ieee80211 phy0: il4965_mac_start Start UP work done. [ 12.058757] ieee80211 phy0: __il4965_down iwl4965 is going down [ 12.058761] ieee80211 phy0: il_scan_cancel_timeout Scan cancel timeout [ 12.058762] ieee80211 phy0: il_do_scan_abort Not performing scan to abort [ 12.058765] ieee80211 phy0: il_clear_ucode_stations Clearing ucode stations in driver [ 12.058767] ieee80211 phy0: il_clear_ucode_stations No active stations found to be cleared [ 12.058819] ieee80211 phy0: _il_apm_stop Stop card, put in low power state [ 12.058827] ieee80211 phy0: _il_apm_stop_master stop master [ 12.058864] ieee80211 phy0: il4965_clear_free_frames 0 frames on pre-allocated heap on clear. [ 12.058869] ieee80211 phy0: Hardware restart was requested [ 16.132299] iwl4965 0000:10:00.0: START_ALIVE timeout after 4000ms. [ 16.132303] ------------[ cut here ]------------ [ 16.132304] Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue. [ 16.132338] WARNING: CPU: 0 PID: 181 at net/mac80211/util.c:1826 ieee80211_reconfig+0x8f/0x14b0 [mac80211] [ 16.132390] Modules linked in: ctr ccm sch_fq_codel xt_tcpudp xt_multiport xt_state iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv4 ip_tables x_tables binfmt_misc joydev mousedev btusb btrtl btintel btbcm bluetooth ecdh_generic ecc iTCO_wdt i2c_dev iwl4965 iwlegacy coretemp snd_hda_codec_analog pcspkr psmouse mac80211 snd_hda_codec_generic libarc4 sdhci_pci cqhci sha256_generic sdhci libsha256 firewire_ohci snd_hda_intel snd_intel_dspcfg mmc_core snd_hda_codec snd_hwdep firewire_core led_class iosf_mbi snd_hda_core uhci_hcd lpc_ich crc_itu_t cfg80211 ehci_pci ehci_hcd snd_pcm usbcore mfd_core rfkill snd_timer snd usb_common soundcore video parport_pc parport intel_agp wmi intel_gtt backlight e1000e agpgart evdev [ 16.132456] CPU: 0 UID: 0 PID: 181 Comm: kworker/u8:6 Not tainted 6.11.0-cl+ #143 [ 16.132460] Hardware name: Hewlett-Packard HP Compaq 6910p/30BE, BIOS 68MCU Ver. F.19 07/06/2010 [ 16.132463] Workqueue: async async_run_entry_fn [ 16.132469] RIP: 0010:ieee80211_reconfig+0x8f/0x14b0 [mac80211] [ 16.132501] Code: da 02 00 00 c6 83 ad 05 00 00 00 48 89 df e8 98 1b fc ff 85 c0 41 89 c7 0f 84 e9 02 00 00 48 c7 c7 a0 e6 48 a0 e8 d1 77 c4 e0 <0f> 0b eb 2d 84 c0 0f 85 8b 01 00 00 c6 87 ad 05 00 00 00 e8 69 1b [ 16.132504] RSP: 0018:ffffc9000029fcf0 EFLAGS: 00010282 [ 16.132507] RAX: 0000000000000000 RBX: ffff8880072008e0 RCX: 0000000000000001 [ 16.132509] RDX: ffffffff81f21a18 RSI: 0000000000000086 RDI: 0000000000000001 [ 16.132510] RBP: ffff8880072003c0 R08: 0000000000000000 R09: 0000000000000003 [ 16.132512] R10: 0000000000000000 R11: ffff88807e5b0000 R12: 0000000000000001 [ 16.132514] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000ffffff92 [ 16.132515] FS: 0000000000000000(0000) GS:ffff88807c200000(0000) knlGS:0000000000000000 [ 16.132517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 16.132519] CR2: 000055dd43786c08 CR3: 000000000978f000 CR4: 00000000000006f0 [ 16.132521] Call Trace: [ 16.132525] <TASK> [ 16.132526] ? __warn+0x77/0x120 [ 16.132532] ? ieee80211_reconfig+0x8f/0x14b0 [mac80211] [ 16.132564] ? report_bug+0x15c/0x190 [ 16.132568] ? handle_bug+0x36/0x70 [ 16.132571] ? exc_invalid_op+0x13/0x60 [ 16.132573] ? asm_exc_invalid_op+0x16/0x20 [ 16.132579] ? ieee80211_reconfig+0x8f/0x14b0 [mac80211] [ 16.132611] ? snd_hdac_bus_init_cmd_io+0x24/0x200 [snd_hda_core] [ 16.132617] ? pick_eevdf+0x133/0x1c0 [ 16.132622] ? check_preempt_wakeup_fair+0x70/0x90 [ 16.132626] ? wakeup_preempt+0x4a/0x60 [ 16.132628] ? ttwu_do_activate.isra.0+0x5a/0x190 [ 16.132632] wiphy_resume+0x79/0x1a0 [cfg80211] [ 16.132675] ? wiphy_suspend+0x2a0/0x2a0 [cfg80211] [ 16.132697] dpm_run_callback+0x75/0x1b0 [ 16.132703] device_resume+0x97/0x200 [ 16.132707] async_resume+0x14/0x20 [ 16.132711] async_run_entry_fn+0x1b/0xa0 [ 16.132714] process_one_work+0x13d/0x350 [ 16.132718] worker_thread+0x2be/0x3d0 [ 16.132722] ? cancel_delayed_work_sync+0x70/0x70 [ 16.132725] kthread+0xc0/0xf0 [ 16.132729] ? kthread_park+0x80/0x80 [ 16.132732] ret_from_fork+0x28/0x40 [ 16.132735] ? kthread_park+0x80/0x80 [ 16.132738] ret_from_fork_asm+0x11/0x20 [ 16.132741] </TASK> [ 16.132742] ---[ end trace 0000000000000000 ]--- [ 16.132930] ------------[ cut here ]------------ [ 16.132932] WARNING: CPU: 0 PID: 181 at net/mac80211/driver-ops.c:41 drv_stop+0xe7/0xf0 [mac80211] [ 16.132957] Modules linked in: ctr ccm sch_fq_codel xt_tcpudp xt_multiport xt_state iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv4 ip_tables x_tables binfmt_misc joydev mousedev btusb btrtl btintel btbcm bluetooth ecdh_generic ecc iTCO_wdt i2c_dev iwl4965 iwlegacy coretemp snd_hda_codec_analog pcspkr psmouse mac80211 snd_hda_codec_generic libarc4 sdhci_pci cqhci sha256_generic sdhci libsha256 firewire_ohci snd_hda_intel snd_intel_dspcfg mmc_core snd_hda_codec snd_hwdep firewire_core led_class iosf_mbi snd_hda_core uhci_hcd lpc_ich crc_itu_t cfg80211 ehci_pci ehci_hcd snd_pcm usbcore mfd_core rfkill snd_timer snd usb_common soundcore video parport_pc parport intel_agp wmi intel_gtt backlight e1000e agpgart evdev [ 16.133014] CPU: 0 UID: 0 PID: 181 Comm: kworker/u8:6 Tainted: G W 6.11.0-cl+ #143 [ 16.133018] Tainted: [W]=WARN [ 16.133019] Hardware name: Hewlett-Packard HP Compaq 6910p/30BE, BIOS 68MCU Ver. F.19 07/06/2010 [ 16.133021] Workqueue: async async_run_entry_fn [ 16.133025] RIP: 0010:drv_stop+0xe7/0xf0 [mac80211] [ 16.133048] Code: 48 85 c0 74 0e 48 8b 78 08 89 ea 48 89 de e8 e0 87 04 00 65 ff 0d d1 de c4 5f 0f 85 42 ff ff ff e8 be 52 c2 e0 e9 38 ff ff ff <0f> 0b 5b 5d c3 0f 1f 40 00 41 54 49 89 fc 55 53 48 89 f3 2e 2e 2e [ 16.133050] RSP: 0018:ffffc9000029fc50 EFLAGS: 00010246 [ 16.133053] RAX: 0000000000000000 RBX: ffff8880072008e0 RCX: ffff88800377f6c0 [ 16.133054] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8880072008e0 [ 16.133056] RBP: 0000000000000000 R08: ffffffff81f238d8 R09: 0000000000000000 [ 16.133058] R10: ffff8880080520f0 R11: 0000000000000000 R12: ffff888008051c60 [ 16.133060] R13: ffff8880072008e0 R14: 0000000000000000 R15: ffff8880072011d8 [ 16.133061] FS: 0000000000000000(0000) GS:ffff88807c200000(0000) knlGS:0000000000000000 [ 16.133063] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 16.133065] CR2: 000055dd43786c08 CR3: 000000000978f000 CR4: 00000000000006f0 [ 16.133067] Call Trace: [ 16.133069] <TASK> [ 16.133070] ? __warn+0x77/0x120 [ 16.133075] ? drv_stop+0xe7/0xf0 [mac80211] [ 16.133098] ? report_bug+0x15c/0x190 [ 16.133100] ? handle_bug+0x36/0x70 [ 16.133103] ? exc_invalid_op+0x13/0x60 [ 16.133105] ? asm_exc_invalid_op+0x16/0x20 [ 16.133109] ? drv_stop+0xe7/0xf0 [mac80211] [ 16.133132] ieee80211_do_stop+0x55a/0x810 [mac80211] [ 16.133161] ? fq_codel_reset+0xa5/0xc0 [sch_fq_codel] [ 16.133164] ieee80211_stop+0x4f/0x180 [mac80211] [ 16.133192] __dev_close_many+0xa2/0x120 [ 16.133195] dev_close_many+0x90/0x150 [ 16.133198] dev_close+0x5d/0x80 [ 16.133200] cfg80211_shutdown_all_interfaces+0x40/0xe0 [cfg80211] [ 16.133223] wiphy_resume+0xb2/0x1a0 [cfg80211] [ 16.133247] ? wiphy_suspend+0x2a0/0x2a0 [cfg80211] [ 16.133269] dpm_run_callback+0x75/0x1b0 [ 16.133273] device_resume+0x97/0x200 [ 16.133277] async_resume+0x14/0x20 [ 16.133280] async_run_entry_fn+0x1b/0xa0 [ 16.133283] process_one_work+0x13d/0x350 [ 16.133287] worker_thread+0x2be/0x3d0 [ 16.133290] ? cancel_delayed_work_sync+0x70/0x70 [ 16.133294] kthread+0xc0/0xf0 [ 16.133296] ? kthread_park+0x80/0x80 [ 16.133299] ret_from_fork+0x28/0x40 [ 16.133302] ? kthread_park+0x80/0x80 [ 16.133304] ret_from_fork_asm+0x11/0x20 [ 16.133307] </TASK> [ 16.133308] ---[ end trace 0000000000000000 ]--- [ 16.133335] ieee80211 phy0: PM: dpm_run_callback(): wiphy_resume [cfg80211] returns -110 [ 16.133360] ieee80211 phy0: PM: failed to restore async: error -110
--- drivers/net/wireless/intel/iwlegacy/common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intel/iwlegacy/common.c +2 -0
@@ -4972,6 +4972,8 @@ il_pci_resume(struct device *device)*/ pci_write_config_byte (pdev,PCI_CFG_RETRY_TIMEOUT ,0x00 ); +_il_wr (il,CSR_INT ,0xffffffff ); +_il_wr (il,CSR_FH_INT_STATUS ,0xffffffff );il_enable_interrupts (il);if (!(_il_rd (il,CSR_GP_CNTRL ) &CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW ))
Greg Kroah-Hartman
maintainerPATCH 96/151 staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit 6bd301819f8f69331a55ae2336c8b111fc933f3d upstream.
In the ad9832_write_frequency() function, clk_get_rate() might return 0. This can lead to a division by zero when calling ad9832_calc_freqreg(). The check if (fout > (clk_get_rate(st->mclk) / 2)) does not protect against the case when fout is 0. The ad9832_write_frequency() function is called from ad9832_write(), and fout is derived from a text buffer, which can contain any value.
--- drivers/staging/iio/frequency/ad9832.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/staging/iio/frequency/ad9832.c +5 -2
@@ -129,12 +129,15 @@ static unsigned long ad9832_calc_freqregstatic int ad9832_write_frequency (struct ad9832_state *st,unsigned int addr,unsigned long fout) { +unsigned long clk_freq;unsigned long regval; -if (fout > (clk_get_rate (st->mclk) /2 )) + clk_freq =clk_get_rate (st->mclk); + +if (!clk_freq || fout > (clk_freq /2 ))return -EINVAL ; - regval =ad9832_calc_freqreg (clk_get_rate (st->mclk), fout); + regval =ad9832_calc_freqreg (clk_freq, fout); st->freq_data[0] = cpu_to_be16((AD9832_CMD_FRE8BITSW << CMD_SHIFT) | (addr << ADD_SHIFT) |
Greg Kroah-Hartman
maintainerPATCH 97/151 iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit efa353ae1b0541981bc96dbf2e586387d0392baa upstream.
In the ad7124_write_raw() function, parameter val can potentially be zero. This may lead to a division by zero when DIV_ROUND_CLOSEST() is called within ad7124_set_channel_odr(). The ad7124_write_raw() function is invoked through the sequence: iio_write_channel_raw() -> iio_write_channel_attribute() -> iio_channel_write(), with no checks in place to ensure val is non-zero.
--- drivers/iio/adc/ad7124.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7124.c +1 -1
@@ -643,7 +643,7 @@ static int ad7124_write_raw(struct iio_dswitch (info) {case IIO_CHAN_INFO_SAMP_FREQ : -if (val2 !=0 ) { +if (val2 !=0 || val ==0 ) { ret = -EINVAL ;break ; }
Greg Kroah-Hartman
maintainerPATCH 98/151 iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 369f05688911b05216cfcd6ca74473bec87948d7 upstream.
If per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loop of iio_gts_build_avail_scale_table(), the err_free_out will fail to call kfree() each time when i is reduced to 0, so all the per_time_scales[0] and per_time_gains[0] will not be freed, which will cause memory leaks.
Fix it by checking if i >= 0.
--- drivers/iio/industrialio-gts-helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/industrialio-gts-helper.c +1 -1
@@ -313,7 +313,7 @@ static int iio_gts_build_avail_scale_tabreturn 0 ; err_free_out: -for (i--; i; i--) { +for (i--; i >=0 ; i--) {kfree (per_time_scales[i]);kfree (per_time_gains[i]); }
Greg Kroah-Hartman
maintainerPATCH 99/151 iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 691e79ffc42154a9c91dc3b7e96a307037b4be74 upstream.
modprobe iio-test-gts and rmmod it, then the following memory leak occurs:
unreferenced object 0xffffff80c810be00 (size 64): comm "kunit_try_catch", pid 1654, jiffies 4294913981 hex dump (first 32 bytes): 02 00 00 00 08 00 00 00 20 00 00 00 40 00 00 00 ........ ...@... 80 00 00 00 00 02 00 00 00 04 00 00 00 08 00 00 ................ backtrace (crc a63d875e): [<0000000028c1b3c2>] kmemleak_alloc+0x34/0x40 [<000000001d6ecc87>] __kmalloc_noprof+0x2bc/0x3c0 [<00000000393795c1>] devm_iio_init_iio_gts+0x4b4/0x16f4 [<0000000071bb4b09>] 0xffffffdf052a62e0 [<000000000315bc18>] 0xffffffdf052a6488 [<00000000f9dc55b5>] kunit_try_run_case+0x13c/0x3ac [<00000000175a3fd4>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000f505065d>] kthread+0x2e8/0x374 [<00000000bbfb0e5d>] ret_from_fork+0x10/0x20 unreferenced object 0xffffff80cbfe9e70 (size 16): comm "kunit_try_catch", pid 1658, jiffies 4294914015 hex dump (first 16 bytes): 10 00 00 00 40 00 00 00 80 00 00 00 00 00 00 00 ....@........... backtrace (crc 857f0cb4): [<0000000028c1b3c2>] kmemleak_alloc+0x34/0x40 [<000000001d6ecc87>] __kmalloc_noprof+0x2bc/0x3c0 [<00000000393795c1>] devm_iio_init_iio_gts+0x4b4/0x16f4 [<0000000071bb4b09>] 0xffffffdf052a62e0 [<000000007d089d45>] 0xffffffdf052a6864 [<00000000f9dc55b5>] kunit_try_run_case+0x13c/0x3ac [<00000000175a3fd4>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000f505065d>] kthread+0x2e8/0x374 [<00000000bbfb0e5d>] ret_from_fork+0x10/0x20 ......
It includes 5*5 times "size 64" memory leaks, which correspond to 5 times test_init_iio_gain_scale() calls with gts_test_gains size 10 (10*size(int)) and gts_test_itimes size 5. It also includes 5*1 times "size 16" memory leak, which correspond to one time __test_init_iio_gain_scale() call with gts_test_gains_gain_low size 3 (3*size(int)) and gts_test_itimes size 5.
The reason is that the per_time_gains[i] is not freed which is allocated in the "gts->num_itime" for loop in iio_gts_build_avail_scale_table().
--- drivers/iio/industrialio-gts-helper.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/industrialio-gts-helper.c +2 -0
@@ -307,6 +307,8 @@ static int iio_gts_build_avail_scale_table(struct iio_gts *gts)if (ret) goto err_free_out; +for (i =0 ; i < gts->num_itime; i++) +kfree (per_time_gains[i]);kfree (per_time_gains); gts->per_time_avail_scale_tables = per_time_scales;
Signature · 1 line
2.47.0
Greg Kroah-Hartman
maintainerPATCH 100/151 iio: light: veml6030: fix microlux value calculation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 63dd163cd61dda6f38343776b42331cc6b7e56e0 upstream.
The raw value conversion to obtain a measurement in lux as INT_PLUS_MICRO does not calculate the decimal part properly to display it as micro (in this case microlux). It only calculates the module to obtain the decimal part from a resolution that is 10000 times the provided in the datasheet (0.5376 lux/cnt for the veml6030). The resulting value must still be multiplied by 100 to make it micro.
This bug was introduced with the original implementation of the driver.
Only the illuminance channel is fixed becuase the scale is non sensical for the intensity channels anyway.
--- drivers/iio/light/veml6030.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/light/veml6030.c +1 -1
@@ -522,7 +522,7 @@ static int veml6030_read_raw(struct iio_ }if (mask ==IIO_CHAN_INFO_PROCESSED ) { *val = (reg * data->cur_resolution) /10000 ; - *val2 = (reg * data->cur_resolution) %10000 ; + *val2 = (reg * data->cur_resolution) %10000 *100 ;return IIO_VAL_INT_PLUS_MICRO ; } *val = reg;
Greg Kroah-Hartman
maintainerPATCH 101/151 nilfs2: fix potential deadlock with newly created symlinks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit b3a033e3ecd3471248d474ef263aadc0059e516a upstream.
Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which can result in circular lock dependencies among the reader/writer semaphore nilfs->ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the fs_reclaim pseudo lock.
This is because after commit 21fc61c73c39 ("don't put symlink bodies in pagecache into highmem"), the gfp flags of the page cache for symbolic links are overwritten to GFP_KERNEL via inode_nohighmem().
This is not a problem for symlinks read from the backing device, because the __GFP_FS flag is dropped after inode_nohighmem() is called. However, when a new symlink is created with nilfs_symlink(), the gfp flags remain overwritten to GFP_KERNEL. Then, memory allocation called from page_symlink() etc. triggers memory reclamation including the FS layer, which may call nilfs_evict_inode() or nilfs_dirty_inode(). And these can cause a deadlock if they are called while nilfs->ns_segctor_sem is held:
Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags of newly created symlinks in the same way that nilfs_new_inode() and __nilfs_read_inode() do, as a workaround until we adopt nofs allocation scope consistently or improve the locking constraints.
--- fs/nilfs2/namei.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nilfs2/namei.c +3 -0
@@ -157,6 +157,9 @@ static int nilfs_symlink(struct mnt_idma/* slow symlink */ inode->i_op = &nilfs_symlink_inode_operations;inode_nohighmem (inode); +mapping_set_gfp_mask (inode->i_mapping, +mapping_gfp_constraint (inode->i_mapping, + ~__GFP_FS)); inode->i_mapping->a_ops = &nilfs_aops; err =page_symlink (inode, symname, l);if (err)
Greg Kroah-Hartman
maintainerPATCH 102/151 RISC-V: ACPI: fix early_ioremap to early_memremap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunhui Cui <[email protected]>
commit 1966db682f064172891275cb951aa8c98a0a809b upstream.
When SVPBMT is enabled, __acpi_map_table() will directly access the data in DDR through the IO attribute, rather than through hardware cache consistency, resulting in incorrect data in the obtained ACPI table.
The log: ACPI: [ACPI:0x18] Invalid zero length.
We do not assume whether the bootloader flushes or not. We should access in a cacheable way instead of maintaining cache consistency by software.
--- arch/riscv/kernel/acpi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kernel/acpi.c +2 -2
@@ -204,7 +204,7 @@ void __init __iomem *__acpi_map_table(unif (!size)return NULL ; -return early_ioremap (phys, size); +return early_memremap (phys, size); }void __init __acpi_unmap_table (void __iomem *map,unsigned long size)
@@ -212,7 +212,7 @@ void __init __acpi_unmap_table(void __ioif (!map || !size)return ; -early_iounmap (map, size); +early_memunmap (map, size); }void __iomem *acpi_os_ioremap (acpi_physical_address phys,acpi_size size)
Greg Kroah-Hartman
maintainerPATCH 103/151 mm: shmem: fix data-race in shmem_getattr()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit d949d1d14fa281ace388b1de978e8f2cd52875cf upstream.
I got the following KCSAN report during syzbot testing:
==================================================================
BUG: KCSAN: data-race in generic_fillattr / inode_set_ctime_current
write to 0xffff888102eb3260 of 4 bytes by task 6565 on cpu 1:
inode_set_ctime_to_ts include/linux/fs.h:1638 [inline] inode_set_ctime_current+0x169/0x1d0 fs/inode.c:2626 shmem_mknod+0x117/0x180 mm/shmem.c:3443 shmem_create+0x34/0x40 mm/shmem.c:3497 lookup_open fs/namei.c:3578 [inline] open_last_lookups fs/namei.c:3647 [inline] path_openat+0xdbc/0x1f00 fs/namei.c:3883 do_filp_open+0xf7/0x200 fs/namei.c:3913 do_sys_openat2+0xab/0x120 fs/open.c:1416 do_sys_open fs/open.c:1431 [inline] __do_sys_openat fs/open.c:1447 [inline] __se_sys_openat fs/open.c:1442 [inline] __x64_sys_openat+0xf3/0x120 fs/open.c:1442 x64_sys_call+0x1025/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:258 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e
read to 0xffff888102eb3260 of 4 bytes by task 3498 on cpu 0:
inode_get_ctime_nsec include/linux/fs.h:1623 [inline] inode_get_ctime include/linux/fs.h:1629 [inline] generic_fillattr+0x1dd/0x2f0 fs/stat.c:62 shmem_getattr+0x17b/0x200 mm/shmem.c:1157 vfs_getattr_nosec fs/stat.c:166 [inline] vfs_getattr+0x19b/0x1e0 fs/stat.c:207 vfs_statx_path fs/stat.c:251 [inline] vfs_statx+0x134/0x2f0 fs/stat.c:315 vfs_fstatat+0xec/0x110 fs/stat.c:341 __do_sys_newfstatat fs/stat.c:505 [inline] __se_sys_newfstatat+0x58/0x260 fs/stat.c:499 __x64_sys_newfstatat+0x55/0x70 fs/stat.c:499 x64_sys_call+0x141f/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:263 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e
value changed: 0x2755ae53 -> 0x27ee44d3
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3498 Comm: udevd Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 ==================================================================
When calling generic_fillattr(), if you don't hold read lock, data-race will occur in inode member variables, which can cause unexpected behavior.
Since there is no special protection when shmem_getattr() calls generic_fillattr(), data-race occurs by functions such as shmem_unlink() or shmem_mknod(). This can cause unexpected results, so commenting it out is not enough.
Therefore, when calling generic_fillattr() from shmem_getattr(), it is appropriate to protect the inode using inode_lock_shared() and inode_unlock_shared() to prevent data-race.
--- mm/shmem.c | 2 ++ 1 file changed, 2 insertions(+)
mm/shmem.c +2 -0
@@ -1158,7 +1158,9 @@ static int shmem_getattr(struct mnt_idma stat->attributes_mask |= (STATX_ATTR_APPEND |STATX_ATTR_IMMUTABLE |STATX_ATTR_NODUMP ); +inode_lock_shared (inode);generic_fillattr (idmap, request_mask, inode, stat); +inode_unlock_shared (inode);if (shmem_is_huge (inode,0 , false,NULL ,0 )) stat->blksize =HPAGE_PMD_SIZE ;
Greg Kroah-Hartman
maintainerPATCH 104/151 tools/mm: -Werror fixes in page-types/slabinfo
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wladislav Wiebe <[email protected]>
commit ece5897e5a10fcd56a317e32f2dc7219f366a5a8 upstream.
Commit e6d2c436ff693 ("tools/mm: allow users to provide additional cflags/ldflags") passes now CFLAGS to Makefile. With this, build systems with default -Werror enabled found:
slabinfo.c:1300:25: error: ignoring return value of 'chdir' declared with attribute 'warn_unused_result' [-Werror=unused-result] chdir("..");
^~~~~~~~~~~
page-types.c:397:35: error: format '%lu' expects argument of type 'long unsigned int', but argument 2 has type 'uint64_t' {aka 'long long unsigned int'} [-Werror=format=] printf("%lu\t", mapcnt0);
~~^ ~~~~~~~
..
Fix page-types by using PRIu64 for uint64_t prints and check in slabinfo for return code on chdir("..").
--- tools/mm/page-types.c | 9 +++++---- tools/mm/slabinfo.c | 4 +++- 2 files changed, 8 insertions(+), 5 deletions(-)
tools/mm/page-types.c +5 -4
@@ -22,6 +22,7 @@#include <time.h> #include <setjmp.h> #include <signal.h> +#include <inttypes.h> #include <sys/types.h> #include <sys/errno.h> #include <sys/fcntl.h>
@@ -392,9 +393,9 @@ static void show_page_range(unsigned lonif (opt_file)printf ("%lx\t" , voff);if (opt_list_cgroup) -printf ("@%llu\t" , (unsigned long long )cgroup0); +printf ("@%" PRIu64"\t" , cgroup0);if (opt_list_mapcnt) -printf ("%lu\t" , mapcnt0); +printf ("%" PRIu64"\t" , mapcnt0);printf ("%lx\t%lx\t%s\n" , index, count,page_flag_name (flags0)); }
@@ -420,9 +421,9 @@ static void show_page(unsigned long voffif (opt_file)printf ("%lx\t" , voffset);if (opt_list_cgroup) -printf ("@%llu\t" , (unsigned long long )cgroup); + printf("@%" PRIu64 "\t", cgroup)if (opt_list_mapcnt) -printf ("%lu\t" , mapcnt); +printf ("%" PRIu64"\t" , mapcnt);printf ("%lx\t%s\n" , offset,page_flag_name (flags)); }
tools/mm/slabinfo.c +3 -1
@@ -1297,7 +1297,9 @@ static void read_slab_dir(void) slab->cpu_partial_free =get_obj ("cpu_partial_free" ); slab->alloc_node_mismatch =get_obj ("alloc_node_mismatch" ); slab->deactivate_bypass =get_obj ("deactivate_bypass" ); -chdir (".." ); +if (chdir (".." )) +fatal ("Unable to chdir from slab ../%s\n" , + slab->name);if (slab->name[0 ] ==':' ) alias_targets++; slab++;
Greg Kroah-Hartman
maintainerPATCH 105/151 thunderbolt: Honor TMU requirements in the domain when setting TMU mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Fine <[email protected]>
commit 3cea8af2d1a9ae5869b47c3dabe3b20f331f3bbd upstream.
Currently, when configuring TMU (Time Management Unit) mode of a given router, we take into account only its own TMU requirements ignoring other routers in the domain. This is problematic if the router we are configuring has lower TMU requirements than what is already configured in the domain.
In the scenario below, we have a host router with two USB4 ports: A and B. Port A connected to device router #1 (which supports CL states) and existing DisplayPort tunnel, thus, the TMU mode is HiFi uni-directional.
1. Initial topology
[Host]
A/
/ [Device #1]
/
Monitor
2. Plug in device #2 (that supports CL states) to downstream port B of the host router
[Host]
A/ B\
/ \ [Device #1] [Device #2]
/
Monitor
The TMU mode on port B and port A will be configured to LowRes which is not what we want and will cause monitor to start flickering.
To address this we first scan the domain and search for any router configured to HiFi uni-directional mode, and if found, configure TMU mode of the given router to HiFi uni-directional as well.
--- drivers/thunderbolt/tb.c | 48 +++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 42 insertions(+), 6 deletions(-)
drivers/thunderbolt/tb.c +42 -6
@@ -383,6 +383,24 @@ static void tb_increase_tmu_accuracy(strdevice_for_each_child (&sw->dev,NULL , tb_increase_switch_tmu_accuracy); } +static int tb_switch_tmu_hifi_uni_required (struct device *dev,void *not_used) +{ +struct tb_switch *sw =tb_to_switch (dev); + +if (sw &&tb_switch_tmu_is_enabled (sw) && +tb_switch_tmu_is_configured (sw,TB_SWITCH_TMU_MODE_HIFI_UNI )) +return 1 ; + +return device_for_each_child (dev,NULL , + tb_switch_tmu_hifi_uni_required); +} + +static bool tb_tmu_hifi_uni_required (struct tb *tb) +{ +return device_for_each_child (&tb->dev,NULL , + tb_switch_tmu_hifi_uni_required) ==1 ; +} +static int tb_enable_tmu (struct tb_switch *sw) {int ret;
@@ -397,12 +415,30 @@ static int tb_enable_tmu(struct tb_switc ret =tb_switch_tmu_configure (sw,TB_SWITCH_TMU_MODE_MEDRES_ENHANCED_UNI );if (ret == -EOPNOTSUPP ) { -if (tb_switch_clx_is_enabled (sw,TB_CL1 )) - ret =tb_switch_tmu_configure (sw, -TB_SWITCH_TMU_MODE_LOWRES ); -else - ret =tb_switch_tmu_configure (sw, -TB_SWITCH_TMU_MODE_HIFI_BI ); +if (tb_switch_clx_is_enabled (sw,TB_CL1 )) { +/* +* Figure out uni-directional HiFi TMU requirements +* currently in the domain. If there are no +* uni-directional HiFi requirements we can put the TMU +* into LowRes mode. +* +* Deliberately skip bi-directional HiFi links +* as these work independently of other links +* (and they do not allow any CL states anyway). +*/ +if (tb_tmu_hifi_uni_required (sw->tb)) + ret =tb_switch_tmu_configure (sw, +TB_SWITCH_TMU_MODE_HIFI_UNI ); +else + ret =tb_switch_tmu_configure (sw, +TB_SWITCH_TMU_MODE_LOWRES ); + }else { + ret =tb_switch_tmu_configure (sw,TB_SWITCH_TMU_MODE_HIFI_BI ); + } + +/* If not supported, fallback to bi-directional HiFi */ +if (ret == -EOPNOTSUPP ) + ret =tb_switch_tmu_configure (sw,TB_SWITCH_TMU_MODE_HIFI_BI ); }if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 106/151 cxl/port: Fix use-after-free, permit out-of-order decoder shutdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 101c268bd2f37e965a5468353e62d154db38838e upstream.
In support of investigating an initialization failure report [1], cxl_test was updated to register mock memory-devices after the mock root-port/bus device had been registered. That led to cxl_test crashing with a use-after-free bug with the following signature:
cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1
cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1
cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0
1) cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 for mem4:decoder14.0 @ 1 [..]
cxld_unregister: cxl decoder14.0:
cxl_region_decode_reset: cxl_region region3:
mock_decoder_reset: cxl_port port3: decoder3.0 reset
2) mock_decoder_reset: cxl_port port3: decoder3.0: out of order reset, expected decoder3.1
cxl_endpoint_decoder_release: cxl decoder14.0:
[..]
cxld_unregister: cxl decoder7.0:
3) cxl_region_decode_reset: cxl_region region3:
Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI
[..]
RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core]
[..]
Call Trace:
<TASK>
cxl_region_decode_reset+0x69/0x190 [cxl_core]
cxl_region_detach+0xe8/0x210 [cxl_core]
cxl_decoder_kill_region+0x27/0x40 [cxl_core]
cxld_unregister+0x5d/0x60 [cxl_core]At 1) a region has been established with 2 endpoint decoders (7.0 and 14.0). Those endpoints share a common switch-decoder in the topology (3.0). At teardown, 2), decoder14.0 is the first to be removed and hits the "out of order reset case" in the switch decoder. The effect though is that region3 cleanup is aborted leaving it in-tact and referencing decoder14.0. At 3) the second attempt to teardown region3 trips over the stale decoder14.0 object which has long since been deleted.
The fix here is to recognize that the CXL specification places no mandate on in-order shutdown of switch-decoders, the driver enforces in-order allocation, and hardware enforces in-order commit. So, rather than fail and leave objects dangling, always remove them.
In support of making cxl_region_decode_reset() always succeed, cxl_region_invalidate_memregion() failures are turned into warnings. Crashing the kernel is ok there since system integrity is at risk if caches cannot be managed around physical address mutation events like CXL region destruction.
A new device_for_each_child_reverse_from() is added to cleanup port->commit_end after all dependent decoders have been disabled. In other words if decoders are allocated 0->1->2 and disabled 1->2->0 then port->commit_end only decrements from 2 after 2 has been disabled, and it decrements all the way to zero since 1 was disabled previously.
--- drivers/base/core.c | 35 ++++++++++++++++++++++++++++++ drivers/cxl/core/hdm.c | 50 ++++++++++++++++++++++++++++++++++++------- drivers/cxl/core/region.c | 48 +++++++++++------------------------------ drivers/cxl/cxl.h | 3 +- include/linux/device.h | 3 ++ tools/testing/cxl/test/cxl.c | 14 ++++-------- 6 files changed, 100 insertions(+), 53 deletions(-)
drivers/base/core.c +35 -0
@@ -4012,6 +4012,41 @@ int device_for_each_child_reverse(structEXPORT_SYMBOL_GPL (device_for_each_child_reverse);/** +* device_for_each_child_reverse_from - device child iterator in reversed order. +* @parent: parent struct device. +* @from: optional starting point in child list +* @fn: function to be called for each device. +* @data: data for the callback. +* +* Iterate over @parent's child devices, starting at @from, and call @fn +* for each, passing it @data. This helper is identical to +* device_for_each_child_reverse() when @from is NULL. +* +* @fn is checked each iteration. If it returns anything other than 0, +* iteration stop and that value is returned to the caller of +* device_for_each_child_reverse_from(); +*/ +int device_for_each_child_reverse_from (struct device *parent, +struct device *from,const void *data, +int (*fn)(struct device *,const void *)) +{ +struct klist_iter i; +struct device *child; +int error =0 ; + +if (!parent->p) +return 0 ; + +klist_iter_init_node (&parent->p->klist_children, &i, + (from ? &from->p->knode_parent :NULL )); +while ((child =prev_device (&i)) && !error) + error =fn (child, data); +klist_iter_exit (&i); +return error; +} +EXPORT_SYMBOL_GPL (device_for_each_child_reverse_from); + +/** * device_find_child - device iterator for locating a particular device. * @parent: parent struct device * @match: Callback function to check device
drivers/cxl/core/hdm.c +42 -8
78 lines not on this page · raw message
drivers/cxl/core/region.c +13 -35
92 lines not on this page · raw message
drivers/cxl/cxl.h +2 -1
@@ -347,7 +347,7 @@ struct cxl_decoder {struct cxl_region *region;unsigned long flags;int (*commit)(struct cxl_decoder *cxld); -int (*reset)(struct cxl_decoder *cxld); +void (*reset)(struct cxl_decoder *cxld); };/*
@@ -682,6 +682,7 @@ static inline bool is_cxl_root(struct cxint cxl_num_decoders_committed (struct cxl_port *port);bool is_cxl_port (const struct device *dev);struct cxl_port *to_cxl_port (const struct device *dev); +void cxl_port_commit_reap (struct cxl_decoder *cxld);struct pci_bus ;int devm_cxl_register_pci_bus (struct device *host,struct device *uport_dev,struct pci_bus *bus);
include/linux/device.h +3 -0
@@ -1063,6 +1063,9 @@ int device_for_each_child(struct device int (*fn)(struct device *dev, void *data));int device_for_each_child_reverse (struct device *dev,void *data,int (*fn)(struct device *dev,void *data)); +int device_for_each_child_reverse_from (struct device *parent, +struct device *from,const void *data, +int (*fn)(struct device *,const void *));struct device *device_find_child (struct device *dev,void *data,int (*match)(struct device *dev,void *data)); struct device *device_find_child_by_name(struct device *parent,
tools/testing/cxl/test/cxl.c +5 -9
@@ -687,26 +687,22 @@ static int mock_decoder_commit(struct cxreturn 0 ; } -static int mock_decoder_reset (struct cxl_decoder *cxld) +static void mock_decoder_reset (struct cxl_decoder *cxld) {struct cxl_port *port =to_cxl_port (cxld->dev.parent);int id = cxld->id;if ((cxld->flags &CXL_DECODER_F_ENABLE ) ==0 ) -return 0 ; +return ;dev_dbg (&port->dev,"%s reset\n" ,dev_name (&cxld->dev)); -if (port->commit_end != id) { +if (port->commit_end == id) +cxl_port_commit_reap (cxld); +else dev_dbg (&port->dev,"%s: out of order reset, expected decoder%d.%d\n" ,dev_name (&cxld->dev), port->id, port->commit_end); -return -EBUSY ; - } - - port->commit_end--; cxld->flags &= ~CXL_DECODER_F_ENABLE ; - -return 0 ; }static void default_mock_decoder (struct cxl_decoder *cxld)
Greg Kroah-Hartman
maintainerPATCH 107/151 mmc: sdhci-pci-gli: GL9767: Fix low power mode on the set clock function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Chuang <[email protected]>
commit 8c68b5656e55e9324875881f1000eb4ee3603a87 upstream.
On sdhci_gl9767_set_clock(), the vendor header space(VHS) is read-only after calling gl9767_disable_ssc_pll() and gl9767_set_ssc_pll_205mhz(). So the low power negotiation mode cannot be enabled again. Introduce gl9767_set_low_power_negotiation() function to fix it.
The explanation process is as below.
static void sdhci_gl9767_set_clock()
{
...
gl9767_vhs_write();
...
value |= PCIE_GLI_9767_CFG_LOW_PWR_OFF;
pci_write_config_dword(pdev, PCIE_GLI_9767_CFG, value); <--- (a)
gl9767_disable_ssc_pll(); <--- (b)
sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL);
if (clock == 0)
return; <-- (I)
...
if (clock == 200000000 && ios->timing == MMC_TIMING_UHS_SDR104) {
...
gl9767_set_ssc_pll_205mhz(); <--- (c)
}
...
value &= ~PCIE_GLI_9767_CFG_LOW_PWR_OFF;
pci_write_config_dword(pdev, PCIE_GLI_9767_CFG, value); <-- (II)
gl9767_vhs_read();
}(a) disable low power negotiation mode. When return on (I), the low power mode is disabled. After (b) and (c), VHS is read-only, the low power mode cannot be enabled on (II).
Message-ID: <[email protected]>
--- drivers/mmc/host/sdhci-pci-gli.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-)
drivers/mmc/host/sdhci-pci-gli.c +21 -14
@@ -902,28 +902,40 @@ static void gl9767_disable_ssc_pll(strucgl9767_vhs_read (pdev); } +static void gl9767_set_low_power_negotiation (struct pci_dev *pdev,bool enable) +{ +u32 value; + +gl9767_vhs_write (pdev); + +pci_read_config_dword (pdev,PCIE_GLI_9767_CFG , &value); +if (enable) + value &= ~PCIE_GLI_9767_CFG_LOW_PWR_OFF ; +else + value |=PCIE_GLI_9767_CFG_LOW_PWR_OFF ; +pci_write_config_dword (pdev,PCIE_GLI_9767_CFG , value); + +gl9767_vhs_read (pdev); +} +static void sdhci_gl9767_set_clock (struct sdhci_host *host,unsigned int clock) {struct sdhci_pci_slot *slot =sdhci_priv (host);struct mmc_ios *ios = &host->mmc->ios;struct pci_dev *pdev; -u32 value;u16 clk; pdev = slot->chip->pdev; host->mmc->actual_clock =0 ; -gl9767_vhs_write (pdev); - -pci_read_config_dword (pdev,PCIE_GLI_9767_CFG , &value); - value |=PCIE_GLI_9767_CFG_LOW_PWR_OFF ; -pci_write_config_dword (pdev,PCIE_GLI_9767_CFG , value); - +gl9767_set_low_power_negotiation (pdev, false);gl9767_disable_ssc_pll (pdev);sdhci_writew (host,0 ,SDHCI_CLOCK_CONTROL ); -if (clock ==0 ) +if (clock ==0 ) { +gl9767_set_low_power_negotiation (pdev, true);return ; + } clk =sdhci_calc_clk (host, clock, &host->mmc->actual_clock);if (clock ==200000000 && ios->timing ==MMC_TIMING_UHS_SDR104 ) {
@@ -932,12 +944,7 @@ static void sdhci_gl9767_set_clock(struc }sdhci_enable_clk (host, clk); - -pci_read_config_dword (pdev,PCIE_GLI_9767_CFG , &value); - value &= ~PCIE_GLI_9767_CFG_LOW_PWR_OFF ; -pci_write_config_dword (pdev,PCIE_GLI_9767_CFG , value); - -gl9767_vhs_read (pdev); +gl9767_set_low_power_negotiation (pdev, true); }static void gli_set_9767 (struct sdhci_host *host)
Greg Kroah-Hartman
maintainerPATCH 108/151 mmc: sdhci-pci-gli: GL9767: Fix low power mode in the SD Express process
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Chuang <[email protected]>
commit c4dedaaeb3f78d3718e9c1b1e4d972a6b99073cd upstream.
When starting the SD Express process, the low power negotiation mode will be disabled, so we need to re-enable it after switching back to SD mode.
Message-ID: <[email protected]>
--- drivers/mmc/host/sdhci-pci-gli.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mmc/host/sdhci-pci-gli.c +3 -0
@@ -1078,6 +1078,9 @@ static int gl9767_init_sd_express(structsdhci_writew (host, value,SDHCI_CLOCK_CONTROL ); } +pci_read_config_dword (pdev,PCIE_GLI_9767_CFG , &value); + value &= ~PCIE_GLI_9767_CFG_LOW_PWR_OFF ; +pci_write_config_dword (pdev,PCIE_GLI_9767_CFG , value);gl9767_vhs_read (pdev);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 109/151 block: fix sanity checks in blk_rq_map_user_bvec
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xinyu Zhang <[email protected]>
[ Upstream commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd ]
blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which causes unnecessary failures in NVMe passthrough I/O, reproducible as follows:
- register a 2 page, page-aligned buffer against a ring
- use that buffer to do a 1 page io_uring NVMe passthrough read
The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to fail. This failure is unnecessary, as when the check succeeds, it means we've checked the entire buffer that will be used by the request - i.e. blk_rq_map_user_bvec should complete successfully. Therefore, terminate the loop early and return successfully when the check bytes + bv->bv_len
Quoted 1 line
nr_itersucceeds.
While we're at it, also remove the check that all segments in the bvec are single-page. While this seems to be true for all users of the function, it doesn't appear to be required anywhere downstream.
--- block/blk-map.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
block/blk-map.c +1 -3
@@ -600,9 +600,7 @@ static int blk_rq_map_user_bvec(struct request *rq, const struct iov_iter *iter)if (nsegs >= nr_segs || bytes >UINT_MAX - bv->bv_len) goto put_bio;if (bytes + bv->bv_len > nr_iter) - goto put_bio; -if (bv->bv_offset + bv->bv_len >PAGE_SIZE ) - goto put_bio; +break ; nsegs++; bytes += bv->bv_len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/151 cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit 117932eea99b729ee5d12783601a4f7f5fd58a23 ]
A hung_task problem shown below was found:
INFO: task kworker/0:0:8 blocked for more than 327 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Workqueue: events cgroup_bpf_release Call Trace: <TASK> __schedule+0x5a2/0x2050 ? find_held_lock+0x33/0x100 ? wq_worker_sleeping+0x9e/0xe0 schedule+0x9f/0x180 schedule_preempt_disabled+0x25/0x50 __mutex_lock+0x512/0x740 ? cgroup_bpf_release+0x1e/0x4d0 ? cgroup_bpf_release+0xcf/0x4d0 ? process_scheduled_works+0x161/0x8a0 ? cgroup_bpf_release+0x1e/0x4d0 ? mutex_lock_nested+0x2b/0x40 ? __pfx_delay_tsc+0x10/0x10 mutex_lock_nested+0x2b/0x40 cgroup_bpf_release+0xcf/0x4d0 ? process_scheduled_works+0x161/0x8a0 ? trace_event_raw_event_workqueue_execute_start+0x64/0xd0 ? process_scheduled_works+0x161/0x8a0 process_scheduled_works+0x23a/0x8a0 worker_thread+0x231/0x5b0 ? __pfx_worker_thread+0x10/0x10 kthread+0x14d/0x1c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x59/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
This issue can be reproduced by the following pressuse test:
1. A large number of cpuset cgroups are deleted.
2. Set cpu on and off repeatly.
3. Set watchdog_thresh repeatly.
The scripts can be obtained at LINK mentioned above the signature.
The reason for this issue is cgroup_mutex and cpu_hotplug_lock are acquired in different tasks, which may lead to deadlock.
It can lead to a deadlock through the following steps:
1. A large number of cpusets are deleted asynchronously, which puts a large number of cgroup_bpf_release works into system_wq. The max_active of system_wq is WQ_DFL_ACTIVE(256). Consequently, all active works are cgroup_bpf_release works, and many cgroup_bpf_release works will be put into inactive queue. As illustrated in the diagram, there are 256 (in the acvtive queue) + n (in the inactive queue) works.
2. Setting watchdog_thresh will hold cpu_hotplug_lock.read and put smp_call_on_cpu work into system_wq. However step 1 has already filled system_wq, 'sscs.work' is put into inactive queue. 'sscs.work' has to wait until the works that were put into the inacvtive queue earlier have executed (n cgroup_bpf_release), so it will be blocked for a while.
3. Cpu offline requires cpu_hotplug_lock.write, which is blocked by step 2.
4. Cpusets that were deleted at step 1 put cgroup_release works into cgroup_destroy_wq. They are competing to get cgroup_mutex all the time. When cgroup_metux is acqured by work at css_killed_work_fn, it will call cpuset_css_offline, which needs to acqure cpu_hotplug_lock.read. However, cpuset_css_offline will be blocked for step 3.
5. At this moment, there are 256 works in active queue that are cgroup_bpf_release, they are attempting to acquire cgroup_mutex, and as a result, all of them are blocked. Consequently, sscs.work can not be executed. Ultimately, this situation leads to four processes being blocked, forming a deadlock.
system_wq(step1) WatchDog(step2) cpu offline(step3) cgroup_destroy_wq(step4)
...
2000+ cgroups deleted asyn
256 actives + n inactives
__lockup_detector_reconfigure P(cpu_hotplug_lock.read) put sscs.work into system_wq
256 + n + 1(sscs.work)
sscs.work wait to be executed
warting sscs.work finish percpu_down_write P(cpu_hotplug_lock.write) ...blocking... css_killed_work_fn P(cgroup_mutex) cpuset_css_offline P(cpu_hotplug_lock.read) ...blocking...
256 cgroup_bpf_releasemutex_lock(&cgroup_mutex);
..blocking...
To fix the problem, place cgroup_bpf_release works on a dedicated workqueue which can break the loop and solve the problem. System wqs are for misc things which shouldn't create a large number of concurrent work items. If something is going to generate >WQ_DFL_ACTIVE(256) concurrent work items, it should use its own dedicated workqueue.
--- kernel/bpf/cgroup.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
kernel/bpf/cgroup.c +18 -1
@@ -24,6 +24,23 @@DEFINE_STATIC_KEY_ARRAY_FALSE (cgroup_bpf_enabled_key,MAX_CGROUP_BPF_ATTACH_TYPE );EXPORT_SYMBOL (cgroup_bpf_enabled_key); +/* +* cgroup bpf destruction makes heavy use of work items and there can be a lot +* of concurrent destructions. Use a separate workqueue so that cgroup bpf +* destruction work items don't end up filling up max_active of system_wq +* which may lead to deadlock. +*/ +static struct workqueue_struct *cgroup_bpf_destroy_wq; + +static int __init cgroup_bpf_wq_init (void ) +{ + cgroup_bpf_destroy_wq =alloc_workqueue ("cgroup_bpf_destroy" ,0 ,1 ); +if (!cgroup_bpf_destroy_wq) +panic ("Failed to alloc workqueue for cgroup bpf destroy.\n" ); +return 0 ; +} +core_initcall (cgroup_bpf_wq_init); +/* __always_inline is necessary to prevent indirect call through run_prog * function pointer. */
@@ -334,7 +351,7 @@ static void cgroup_bpf_release_fn(struct percpu_ref *ref) struct cgroup *cgrp = container_of(ref, struct cgroup, bpf.refcnt);INIT_WORK (&cgrp->bpf.release_work, cgroup_bpf_release); -queue_work (system_wq, &cgrp->bpf.release_work); +queue_work (cgroup_bpf_destroy_wq, &cgrp->bpf.release_work); }/* Get underlying bpf_prog of bpf_prog_list entry, regardless if it's through
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/151 phy: freescale: imx8m-pcie: Do CMN_RST just before PHY PLL lock check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Zhu <[email protected]>
[ Upstream commit f89263b69731e0144d275fff777ee0dd92069200 ]
When enable initcall_debug together with higher debug level below. CONFIG_CONSOLE_LOGLEVEL_DEFAULT=9 CONFIG_CONSOLE_LOGLEVEL_QUIET=9 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=7
The initialization of i.MX8MP PCIe PHY might be timeout failed randomly. To fix this issue, adjust the sequence of the resets refer to the power up sequence listed below.
i.MX8MP PCIe PHY power up sequence:
/---------------------------------------------
1.8v supply ---------/
/---------------------------------------------------0.8v supply ---/
---\ /--------------------------------------------------
X REFCLK Valid
Reference Clock ---/ \--------------------------------------------------
-------------------------------------------
|
i_init_restn --------------
------------------------------------
|
i_cmn_rstn ---------------------
-------------------------------
|o_pll_lock_done --------------------------
Logs:
imx6q-pcie 33800000.pcie: host bridge /soc@0/pcie@33800000 ranges: imx6q-pcie 33800000.pcie: IO 0x001ff80000..0x001ff8ffff -> 0x0000000000 imx6q-pcie 33800000.pcie: MEM 0x0018000000..0x001fefffff -> 0x0018000000
probe of clk_imx8mp_audiomix.reset.0 returned 0 after 1052 usecs
probe of 30e20000.clock-controller returned 0 after 32971 usecs
phy phy-32f00000.pcie-phy.4: phy poweron failed --> -110
probe of 30e10000.dma-controller returned 0 after 10235 usecs
imx6q-pcie 33800000.pcie: waiting for PHY ready timeout!
dwhdmi-imx 32fd8000.hdmi: Detected HDMI TX controller v2.13a with HDCP (samsung_dw_hdmi_phy2) imx6q-pcie 33800000.pcie: probe with driver imx6q-pcie failed with error -110
v2 changes:
- Rebase to latest fixes branch of linux-phy git repo.
- Richard's environment have problem and can't sent out patch. So I help post this fix patch.
--- drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/phy/freescale/phy-fsl-imx8m-pcie.c +5 -5
@@ -141,11 +141,6 @@ static int imx8_pcie_phy_power_on(struct phy *phy) IMX8MM_GPR_PCIE_REF_CLK_PLL);usleep_range (100 ,200 ); -/* Do the PHY common block reset */ -regmap_update_bits (imx8_phy->iomuxc_gpr,IOMUXC_GPR14 , -IMX8MM_GPR_PCIE_CMN_RST , -IMX8MM_GPR_PCIE_CMN_RST ); -switch (imx8_phy->drvdata->variant) {case IMX8MP :reset_control_deassert (imx8_phy->perst);
@@ -156,6 +151,11 @@ static int imx8_pcie_phy_power_on(struct phy *phy)break ; } +/* Do the PHY common block reset */ +regmap_update_bits (imx8_phy->iomuxc_gpr,IOMUXC_GPR14 , +IMX8MM_GPR_PCIE_CMN_RST , +IMX8MM_GPR_PCIE_CMN_RST ); +/* Polling to check the phy is ready or not. */ ret =readl_poll_timeout (imx8_phy->base +IMX8MM_PCIE_PHY_CMN_REG075 , val, val ==ANA_PLL_DONE ,10 ,20000 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/151 spi: spi-fsl-dspi: Fix crash when not using GPIO chip select
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 25f00a13dccf8e45441265768de46c8bf58e08f6 ]
Add check for the return value of spi_get_csgpiod() to avoid passing a NULL pointer to gpiod_direction_output(), preventing a crash when GPIO chip select is not used.
Fix below crash:
[ 4.251960] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 4.260762] Mem abort info: [ 4.263556] ESR = 0x0000000096000004 [ 4.267308] EC = 0x25: DABT (current EL), IL = 32 bits [ 4.272624] SET = 0, FnV = 0 [ 4.275681] EA = 0, S1PTW = 0 [ 4.278822] FSC = 0x04: level 0 translation fault [ 4.283704] Data abort info: [ 4.286583] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 4.292074] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 4.297130] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 4.302445] [0000000000000000] user address but active_mm is swapper [ 4.308805] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 4.315072] Modules linked in: [ 4.318124] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc4-next-20241023-00008-ga20ec42c5fc1 #359 [ 4.328130] Hardware name: LS1046A QDS Board (DT) [ 4.332832] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 4.339794] pc : gpiod_direction_output+0x34/0x5c [ 4.344505] lr : gpiod_direction_output+0x18/0x5c [ 4.349208] sp : ffff80008003b8f0 [ 4.352517] x29: ffff80008003b8f0 x28: 0000000000000000 x27: ffffc96bcc7e9068 [ 4.359659] x26: ffffc96bcc6e00b0 x25: ffffc96bcc598398 x24: ffff447400132810 [ 4.366800] x23: 0000000000000000 x22: 0000000011e1a300 x21: 0000000000020002 [ 4.373940] x20: 0000000000000000 x19: 0000000000000000 x18: ffffffffffffffff [ 4.381081] x17: ffff44740016e600 x16: 0000000500000003 x15: 0000000000000007 [ 4.388221] x14: 0000000000989680 x13: 0000000000020000 x12: 000000000000001e [ 4.395362] x11: 0044b82fa09b5a53 x10: 0000000000000019 x9 : 0000000000000008 [ 4.402502] x8 : 0000000000000002 x7 : 0000000000000007 x6 : 0000000000000000 [ 4.409641] x5 : 0000000000000200 x4 : 0000000002000000 x3 : 0000000000000000 [ 4.416781] x2 : 0000000000022202 x1 : 0000000000000000 x0 : 0000000000000000 [ 4.423921] Call trace: [ 4.426362] gpiod_direction_output+0x34/0x5c (P) [ 4.431067] gpiod_direction_output+0x18/0x5c (L) [ 4.435771] dspi_setup+0x220/0x334
--- drivers/spi/spi-fsl-dspi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/spi/spi-fsl-dspi.c +5 -1
@@ -1008,6 +1008,7 @@ static int dspi_setup(struct spi_device *spi)u32 cs_sck_delay =0 , sck_cs_delay =0 ;struct fsl_dspi_platform_data *pdata;unsigned char pasc =0 , asc =0 ; +struct gpio_desc *gpio_cs;struct chip_data *chip;unsigned long clkrate;bool cs = true;
@@ -1073,7 +1074,10 @@ static int dspi_setup(struct spi_device *spi) chip->ctar_val |=SPI_CTAR_LSBFE ; } -gpiod_direction_output (spi_get_csgpiod (spi,0 ), false); + gpio_cs =spi_get_csgpiod (spi,0 ); +if (gpio_cs) +gpiod_direction_output (gpio_cs, false); +dspi_deassert_cs (spi, &cs);spi_set_ctldata (spi, chip);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/151 riscv: vdso: Prevent the compiler from inserting calls to memset()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <[email protected]>
[ Upstream commit bf40167d54d55d4b54d0103713d86a8638fb9290 ]
The compiler is smart enough to insert a call to memset() in riscv_vdso_get_cpus(), which generates a dynamic relocation.
So prevent this by using -fno-builtin option.
--- arch/riscv/kernel/vdso/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/riscv/kernel/vdso/Makefile +1 -0
@@ -18,6 +18,7 @@ obj-vdso = $(patsubst %, %.o, $(vdso-syms)) note.o ccflags-y := -fno-stack-protector ccflags-y += -DDISABLE_BRANCH_PROFILING +ccflags-y += -fno-builtin ifneq ($(c-gettimeofday-y),) CFLAGS_vgettimeofday.o += -fPIC -include $(c-gettimeofday-y)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/151 Input: edt-ft5x06 - fix regmap leak when probe fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit bffdf9d7e51a7be8eeaac2ccf9e54a5fde01ff65 ]
The driver neglects to free the instance of I2C regmap constructed at the beginning of the edt_ft5x06_ts_probe() method when probe fails. Additionally edt_ft5x06_ts_remove() is freeing the regmap too early, before the rest of the device resources that are managed by devm are released.
Fix this by installing a custom devm action that will ensure that the regmap is released at the right time during normal teardown as well as in case of probe failure.
Note that devm_regmap_init_i2c() could not be used because the driver may replace the original regmap with a regmap specific for M06 devices in the middle of the probe, and using devm_regmap_init_i2c() would result in releasing the M06 regmap too early.
--- drivers/input/touchscreen/edt-ft5x06.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
drivers/input/touchscreen/edt-ft5x06.c +18 -1
@@ -1124,6 +1124,14 @@ static void edt_ft5x06_ts_set_regs(struct edt_ft5x06_ts_data *tsdata) } } +static void edt_ft5x06_exit_regmap (void *arg) +{ +struct edt_ft5x06_ts_data *data = arg; + +if (!IS_ERR_OR_NULL (data->regmap)) +regmap_exit (data->regmap); +} +static void edt_ft5x06_disable_regulators (void *arg) {struct edt_ft5x06_ts_data *data = arg;
@@ -1157,6 +1165,16 @@ static int edt_ft5x06_ts_probe(struct i2c_client *client)return PTR_ERR (tsdata->regmap); } +/* +* We are not using devm_regmap_init_i2c() and instead install a +* custom action because we may replace regmap with M06-specific one +* and we need to make sure that it will not be released too early. +*/ + error =devm_add_action_or_reset (&client->dev, edt_ft5x06_exit_regmap, + tsdata); +if (error) +return error; + chip_data =device_get_match_data (&client->dev);if (!chip_data) chip_data = (const struct edt_i2c_chip_data *)id->driver_data;
@@ -1354,7 +1372,6 @@ static void edt_ft5x06_ts_remove(struct i2c_client *client)struct edt_ft5x06_ts_data *tsdata =i2c_get_clientdata (client);edt_ft5x06_ts_teardown_debugfs (tsdata); -regmap_exit (tsdata->regmap); }static int edt_ft5x06_ts_suspend (struct device *dev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/151 ALSA: hda/realtek: Limit internal Mic boost on Dell platform
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit 78e7be018784934081afec77f96d49a2483f9188 ]
Dell want to limit internal Mic boost on all Dell platform.
--- sound/pci/hda/patch_realtek.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
sound/pci/hda/patch_realtek.c +18 -3
@@ -7234,6 +7234,7 @@ enum {ALC286_FIXUP_SONY_MIC_NO_PRESENCE ,ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT ,ALC269_FIXUP_DELL1_MIC_NO_PRESENCE , +ALC269_FIXUP_DELL1_LIMIT_INT_MIC_BOOST ,ALC269_FIXUP_DELL2_MIC_NO_PRESENCE ,ALC269_FIXUP_DELL3_MIC_NO_PRESENCE , ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
@@ -7268,6 +7269,7 @@ enum {ALC255_FIXUP_ACER_MIC_NO_PRESENCE ,ALC255_FIXUP_ASUS_MIC_NO_PRESENCE ,ALC255_FIXUP_DELL1_MIC_NO_PRESENCE , +ALC255_FIXUP_DELL1_LIMIT_INT_MIC_BOOST ,ALC255_FIXUP_DELL2_MIC_NO_PRESENCE ,ALC255_FIXUP_HEADSET_MODE , ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC,
@@ -7760,6 +7762,12 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id =ALC269_FIXUP_HEADSET_MODE }, + [ALC269_FIXUP_DELL1_LIMIT_INT_MIC_BOOST] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_limit_int_mic_boost, + .chained = true, + .chain_id =ALC269_FIXUP_DELL1_MIC_NO_PRESENCE + }, [ALC269_FIXUP_DELL2_MIC_NO_PRESENCE] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -8040,6 +8048,12 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id =ALC255_FIXUP_HEADSET_MODE }, + [ALC255_FIXUP_DELL1_LIMIT_INT_MIC_BOOST] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_limit_int_mic_boost, + .chained = true, + .chain_id =ALC255_FIXUP_DELL1_MIC_NO_PRESENCE + }, [ALC255_FIXUP_DELL2_MIC_NO_PRESENCE] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -10482,6 +10496,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { {.id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, .name = "dell-headset-dock"}, {.id = ALC269_FIXUP_DELL3_MIC_NO_PRESENCE, .name = "dell-headset3"}, {.id = ALC269_FIXUP_DELL4_MIC_NO_PRESENCE, .name = "dell-headset4"}, + {.id = ALC269_FIXUP_DELL4_MIC_NO_PRESENCE_QUIET, .name = "dell-headset4-quiet"}, {.id = ALC283_FIXUP_CHROME_BOOK, .name = "alc283-dac-wcaps"}, {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"}, {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
@@ -11033,16 +11048,16 @@ static const struct snd_hda_pin_quirk alc269_fallback_pin_fixup_tbl[] = {SND_HDA_PIN_QUIRK (0x10ec0289 ,0x1028 ,"Dell" ,ALC269_FIXUP_DELL4_MIC_NO_PRESENCE , {0x19, 0x40000000}, {0x1b, 0x40000000}), -SND_HDA_PIN_QUIRK (0x10ec0295 ,0x1028 ,"Dell" ,ALC269_FIXUP_DELL4_MIC_NO_PRESENCE , +SND_HDA_PIN_QUIRK (0x10ec0295 ,0x1028 ,"Dell" ,ALC269_FIXUP_DELL4_MIC_NO_PRESENCE_QUIET , {0x19, 0x40000000}, {0x1b, 0x40000000}),SND_HDA_PIN_QUIRK (0x10ec0256 ,0x1028 ,"Dell" ,ALC255_FIXUP_DELL1_MIC_NO_PRESENCE , {0x19, 0x40000000}, {0x1a, 0x40000000}), -SND_HDA_PIN_QUIRK (0x10ec0236 ,0x1028 ,"Dell" ,ALC255_FIXUP_DELL1_MIC_NO_PRESENCE , +SND_HDA_PIN_QUIRK (0x10ec0236 ,0x1028 ,"Dell" ,ALC255_FIXUP_DELL1_LIMIT_INT_MIC_BOOST , {0x19, 0x40000000}, {0x1a, 0x40000000}), -SND_HDA_PIN_QUIRK (0x10ec0274 ,0x1028 ,"Dell" ,ALC274_FIXUP_DELL_AIO_LINEOUT_VERB , +SND_HDA_PIN_QUIRK (0x10ec0274 ,0x1028 ,"Dell" ,ALC269_FIXUP_DELL1_LIMIT_INT_MIC_BOOST , {0x19, 0x40000000}, {0x1a, 0x40000000}), SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC2XX_FIXUP_HEADSET_MIC,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/151 riscv: efi: Set NX compat flag in PE/COFF header
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heinrich Schuchardt <[email protected]>
[ Upstream commit d41373a4b910961df5a5e3527d7bde6ad45ca438 ]
The IMAGE_DLLCHARACTERISTICS_NX_COMPAT informs the firmware that the EFI binary does not rely on pages that are both executable and writable.
The flag is used by some distro versions of GRUB to decide if the EFI binary may be executed.
As the Linux kernel neither has RWX sections nor needs RWX pages for relocation we should set the flag.
--- arch/riscv/kernel/efi-header.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/efi-header.S +1 -1
@@ -64,7 +64,7 @@ extra_header_fields: .long efi_header_end - _start // SizeOfHeaders .long 0 // CheckSum .short IMAGE_SUBSYSTEM_EFI_APPLICATION // Subsystem - .short 0 // DllCharacteristics + .short IMAGE_DLL_CHARACTERISTICS_NX_COMPAT // DllCharacteristics .quad 0 // SizeOfStackReserve .quad 0 // SizeOfStackCommit .quad 0 // SizeOfHeapReserve
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/151 riscv: Use %u to format the output of cpu
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
[ Upstream commit e0872ab72630dada3ae055bfa410bf463ff1d1e0 ]
'cpu' is an unsigned integer, so its conversion specifier should be %u, not %d.
--- arch/riscv/kernel/cpu-hotplug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/cpu-hotplug.c +1 -1
@@ -65,7 +65,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu)if (cpu_ops[cpu]->cpu_is_stopped) ret = cpu_ops[cpu]->cpu_is_stopped (cpu);if (ret) -pr_warn ("CPU%d may not have stopped: %d\n" , cpu, ret); +pr_warn ("CPU%u may not have stopped: %d\n" , cpu, ret); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/151 riscv: Remove unused GENERATING_ASM_OFFSETS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunyan Zhang <[email protected]>
[ Upstream commit 46d4e5ac6f2f801f97bcd0ec82365969197dc9b1 ]
The macro is not used in the current version of kernel, it looks like can be removed to avoid a build warning:
../arch/riscv/kernel/asm-offsets.c: At top level:../arch/riscv/kernel/asm-offsets.c:7: warning: macro "GENERATING_ASM_OFFSETS" is not used [-Wunused-macros]
7 | #define GENERATING_ASM_OFFSETS
--- arch/riscv/kernel/asm-offsets.c | 2 -- 1 file changed, 2 deletions(-)
arch/riscv/kernel/asm-offsets.c +0 -2
@@ -4,8 +4,6 @@* Copyright (C) 2017 SiFive */ -#define GENERATING_ASM_OFFSETS -#include <linux/kbuild.h> #include <linux/mm.h> #include <linux/sched.h>
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/151 riscv: Remove duplicated GET_RM
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunyan Zhang <[email protected]>
[ Upstream commit 164f66de6bb6ef454893f193c898dc8f1da6d18b ]
The macro GET_RM defined twice in this file, one can be removed.
--- arch/riscv/kernel/traps_misaligned.c | 2 -- 1 file changed, 2 deletions(-)
arch/riscv/kernel/traps_misaligned.c +0 -2
@@ -132,8 +132,6 @@#define REG_PTR (insn, pos, regs) \ (ulong *)((ulong)(regs) + REG_OFFSET(insn, pos)) -#define GET_RM (insn) (((insn) >> 12) & 7) -#define GET_RS1 (insn, regs) (*REG_PTR(insn, SH_RS1, regs))#define GET_RS2 (insn, regs) (*REG_PTR(insn, SH_RS2, regs))#define GET_RS1S (insn, regs) (*REG_PTR(RVC_RS1S(insn), 0, regs))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/151 cxl/port: Fix cxl_bus_rescan() vs bus_rescan_devices()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit 3d6ebf16438de5d712030fefbb4182b46373d677 ]
It turns out since its original introduction, pre-2.6.12, bus_rescan_devices() has skipped devices that might be in the process of attaching or detaching from their driver. For CXL this behavior is unwanted and expects that cxl_bus_rescan() is a probe barrier.
That behavior is simple enough to achieve with bus_for_each_dev() paired with call to device_attach(), and it is unclear why bus_rescan_devices() took the position of lockless consumption of dev->driver which is racy.
The "Fixes:" but no "Cc: stable" on this patch reflects that the issue is merely by inspection since the bug that triggered the discovery of this potential problem [1] is fixed by other means. However, a stable backport should do no harm.
--- drivers/cxl/core/port.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/cxl/core/port.c +10 -3
@@ -1969,11 +1969,18 @@ static void cxl_bus_remove(struct device *dev)static struct workqueue_struct *cxl_bus_wq; -static void cxl_bus_rescan_queue (struct work_struct *w) +static int cxl_rescan_attach (struct device *dev,void *data) { -int rc =bus_rescan_devices (&cxl_bus_type); +int rc =device_attach (dev); + +dev_vdbg (dev,"rescan: %s\n" , rc ?"attach" :"detached" ); -pr_debug ("CXL bus rescan result: %d\n" , rc); +return 0 ; +} + +static void cxl_bus_rescan_queue (struct work_struct *w) +{ +bus_for_each_dev (&cxl_bus_type,NULL ,NULL , cxl_rescan_attach); }void cxl_bus_rescan (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/151 cxl/acpi: Ensure ports ready at cxl_acpi_probe() return
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit 48f62d38a07d464a499fa834638afcfd2b68f852 ]
In order to ensure root CXL ports are enabled upon cxl_acpi_probe() when the 'cxl_port' driver is built as a module, arrange for the module to be pre-loaded or built-in.
The "Fixes:" but no "Cc: stable" on this patch reflects that the issue is merely by inspection since the bug that triggered the discovery of this potential problem [1] is fixed by other means. However, a stable backport should do no harm.
--- drivers/cxl/acpi.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/cxl/acpi.c +7 -0
@@ -768,6 +768,13 @@ static void __exit cxl_acpi_exit(void)/* load before dax_hmem sees 'Soft Reserved' CXL ranges */ subsys_initcall (cxl_acpi_init); + +/* +* Arrange for host-bridge ports to be active synchronous with +* cxl_acpi_probe() exit. +*/ +MODULE_SOFTDEP ("pre: cxl_port" ); +module_exit (cxl_acpi_exit);MODULE_LICENSE ("GPL v2" );MODULE_IMPORT_NS (CXL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/151 sched/numa: Fix the potential null pointer dereference in task_numa_work()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Wang <[email protected]>
[ Upstream commit 9c70b2a33cd2aa6a5a59c5523ef053bd42265209 ]
When running stress-ng-vm-segv test, we found a null pointer dereference error in task_numa_work(). Here is the backtrace:
[323676.066985] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ...... [323676.067108] CPU: 35 PID: 2694524 Comm: stress-ng-vm-se ...... [323676.067113] pstate: 23401009 (nzCv daif +PAN -UAO +TCO +DIT +SSBS BTYPE=--) [323676.067115] pc : vma_migratable+0x1c/0xd0 [323676.067122] lr : task_numa_work+0x1ec/0x4e0 [323676.067127] sp : ffff8000ada73d20 [323676.067128] x29: ffff8000ada73d20 x28: 0000000000000000 x27: 000000003e89f010 [323676.067130] x26: 0000000000080000 x25: ffff800081b5c0d8 x24: ffff800081b27000 [323676.067133] x23: 0000000000010000 x22: 0000000104d18cc0 x21: ffff0009f7158000 [323676.067135] x20: 0000000000000000 x19: 0000000000000000 x18: ffff8000ada73db8 [323676.067138] x17: 0001400000000000 x16: ffff800080df40b0 x15: 0000000000000035 [323676.067140] x14: ffff8000ada73cc8 x13: 1fffe0017cc72001 x12: ffff8000ada73cc8 [323676.067142] x11: ffff80008001160c x10: ffff000be639000c x9 : ffff8000800f4ba4 [323676.067145] x8 : ffff000810375000 x7 : ffff8000ada73974 x6 : 0000000000000001 [323676.067147] x5 : 0068000b33e26707 x4 : 0000000000000001 x3 : ffff0009f7158000 [323676.067149] x2 : 0000000000000041 x1 : 0000000000004400 x0 : 0000000000000000 [323676.067152] Call trace: [323676.067153] vma_migratable+0x1c/0xd0 [323676.067155] task_numa_work+0x1ec/0x4e0 [323676.067157] task_work_run+0x78/0xd8 [323676.067161] do_notify_resume+0x1ec/0x290 [323676.067163] el0_svc+0x150/0x160 [323676.067167] el0t_64_sync_handler+0xf8/0x128 [323676.067170] el0t_64_sync+0x17c/0x180 [323676.067173] Code: d2888001 910003fd f9000bf3 aa0003f3 (f9401000) [323676.067177] SMP: stopping secondary CPUs [323676.070184] Starting crashdump kernel...
stress-ng-vm-segv in stress-ng is used to stress test the SIGSEGV error handling function of the system, which tries to cause a SIGSEGV error on return from unmapping the whole address space of the child process.
Normally this program will not cause kernel crashes. But before the munmap system call returns to user mode, a potential task_numa_work() for numa balancing could be added and executed. In this scenario, since the child process has no vma after munmap, the vma_next() in task_numa_work() will return a null pointer even if the vma iterator restarts from 0.
Recheck the vma pointer before dereferencing it in task_numa_work().
--- kernel/sched/fair.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/sched/fair.c +2 -2
@@ -3314,7 +3314,7 @@ static void task_numa_work(struct callback_head *work) vma =vma_next (&vmi); } - do { +for (; vma; vma =vma_next (&vmi)) {if (!vma_migratable (vma) || !vma_policy_mof (vma) ||is_vm_hugetlb_page (vma) || (vma->vm_flags &VM_MIXEDMAP )) {trace_sched_skip_vma_numa (mm, vma,NUMAB_SKIP_UNSUITABLE );
@@ -3434,7 +3434,7 @@ static void task_numa_work(struct callback_head *work)*/ if (vma_pids_forced)break ; - }for_each_vma (vmi, vma); + }/* * If no VMAs are remaining and VMAs were skipped due to the PID
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/151 iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugh Dickins <[email protected]>
[ Upstream commit c749d9b7ebbc5716af7a95f7768634b30d9446ec ]
generic/077 on x86_32 CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP=y with highmem, on huge=always tmpfs, issues a warning and then hangs (interruptibly):
WARNING: CPU: 5 PID: 3517 at mm/highmem.c:622 kunmap_local_indexed+0x62/0xc9 CPU: 5 UID: 0 PID: 3517 Comm: cp Not tainted 6.12.0-rc4 #2 ... copy_page_from_iter_atomic+0xa6/0x5ec generic_perform_write+0xf6/0x1b4 shmem_file_write_iter+0x54/0x67
Fix copy_page_from_iter_atomic() by limiting it in that case (include/linux/skbuff.h skb_frag_must_loop() does similar).
But going forward, perhaps CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is too surprising, has outlived its usefulness, and should just be removed?
--- lib/iov_iter.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
lib/iov_iter.c +4 -2
@@ -570,6 +570,8 @@ size_t copy_page_from_iter_atomic(struct page *page, size_t offset, size_t bytes, struct iov_iter *i) { size_t n, copied = 0; +bool uses_kmap =IS_ENABLED (CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP ) || +PageHighMem (page);if (!page_copy_sane (page, offset, bytes))return 0 ;
@@ -580,7 +582,7 @@ size_t copy_page_from_iter_atomic(struct page *page, size_t offset,char *p; n = bytes - copied; -if (PageHighMem (page)) { +if (uses_kmap) { page += offset /PAGE_SIZE ; offset %=PAGE_SIZE ; n =min_t (size_t, n,PAGE_SIZE - offset);
@@ -594,7 +596,7 @@ size_t copy_page_from_iter_atomic(struct page *page, size_t offset,kunmap_atomic (p); copied += n; offset += n; - }while (PageHighMem (page) && copied != bytes && n >0 ); + }while (uses_kmap && copied != bytes && n >0 );return copied; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/151 mptcp: init: protect sched with rcu_read_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit 3deb12c788c385e17142ce6ec50f769852fcec65 ]
Enabling CONFIG_PROVE_RCU_LIST with its dependence CONFIG_RCU_EXPERT creates this splat when an MPTCP socket is created:
=============================
WARNING: suspicious RCU usage
6.12.0-rc2+ #11 Not tainted
-----------------------------
net/mptcp/sched.c:44 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
no locks held by mptcp_connect/176.
stack backtrace: CPU: 0 UID: 0 PID: 176 Comm: mptcp_connect Not tainted 6.12.0-rc2+ #11 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822) mptcp_sched_find (net/mptcp/sched.c:44 (discriminator 7)) mptcp_init_sock (net/mptcp/protocol.c:2867 (discriminator 1)) ? sock_init_data_uid (arch/x86/include/asm/atomic.h:28) inet_create.part.0.constprop.0 (net/ipv4/af_inet.c:386) ? __sock_create (include/linux/rcupdate.h:347 (discriminator 1)) __sock_create (net/socket.c:1576) __sys_socket (net/socket.c:1671) ? __pfx___sys_socket (net/socket.c:1712) ? do_user_addr_fault (arch/x86/mm/fault.c:1419 (discriminator 1)) __x64_sys_socket (net/socket.c:1728) do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
That's because when the socket is initialised, rcu_read_lock() is not used despite the explicit comment written above the declaration of mptcp_sched_find() in sched.c. Adding the missing lock/unlock avoids the warning.
--- net/mptcp/protocol.c | 2 ++ 1 file changed, 2 insertions(+)
net/mptcp/protocol.c +2 -0
@@ -2823,8 +2823,10 @@ static int mptcp_init_sock(struct sock *sk)if (unlikely (!net->mib.mptcp_statistics) && !mptcp_mib_alloc (net))return -ENOMEM ; +rcu_read_lock (); ret =mptcp_init_sched (mptcp_sk (sk),mptcp_sched_find (mptcp_get_scheduler (net))); +rcu_read_unlock ();if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/151 mei: use kvmalloc for read buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
[ Upstream commit 4adf613e01bf99e1739f6ff3e162ad5b7d578d1a ]
Read buffer is allocated according to max message size, reported by the firmware and may reach 64K in systems with pxp client. Contiguous 64k allocation may fail under memory pressure. Read buffer is used as in-driver message storage and not required to be contiguous.
Use kvmalloc to allow kernel to allocate non-contiguous memory.
--- drivers/misc/mei/client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/misc/mei/client.c +2 -2
@@ -321,7 +321,7 @@ void mei_io_cb_free(struct mei_cl_cb *cb)return ;list_del (&cb->list); -kfree (cb->buf.data); +kvfree (cb->buf.data);kfree (cb->ext_hdr);kfree (cb); }
@@ -497,7 +497,7 @@ struct mei_cl_cb *mei_cl_alloc_cb(struct mei_cl *cl, size_t length,if (length ==0 )return cb; - cb->buf.data =kmalloc (roundup (length,MEI_SLOT_SIZE ),GFP_KERNEL ); + cb->buf.data =kvmalloc (roundup (length,MEI_SLOT_SIZE ),GFP_KERNEL );if (!cb->buf.data) {mei_io_cb_free (cb);return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/151 mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <[email protected]>
[ Upstream commit 281dd25c1a018261a04d1b8bf41a0674000bfe38 ]
Under memory pressure it's possible for GFP_ATOMIC order-0 allocations to fail even though free pages are available in the highatomic reserves. GFP_ATOMIC allocations cannot trigger unreserve_highatomic_pageblock() since it's only run from reclaim.
Given that such allocations will pass the watermarks in __zone_watermark_unusable_free(), it makes sense to fallback to highatomic reserves the same way that ALLOC_OOM can.
This fixes order-0 page allocation failures observed on Cloudflare's fleet when handling network packets:
kswapd1: page allocation failure: order:0, mode:0x820(GFP_ATOMIC), nodemask=(null),cpuset=/,mems_allowed=0-7
CPU: 10 PID: 696 Comm: kswapd1 Kdump: loaded Tainted: G O 6.6.43-CUSTOM #1 Hardware name: MACHINE Call Trace: <IRQ> dump_stack_lvl+0x3c/0x50 warn_alloc+0x13a/0x1c0 __alloc_pages_slowpath.constprop.0+0xc9d/0xd10 __alloc_pages+0x327/0x340 __napi_alloc_skb+0x16d/0x1f0 bnxt_rx_page_skb+0x96/0x1b0 [bnxt_en] bnxt_rx_pkt+0x201/0x15e0 [bnxt_en] __bnxt_poll_work+0x156/0x2b0 [bnxt_en] bnxt_poll+0xd9/0x1c0 [bnxt_en] __napi_poll+0x2b/0x1b0 bpf_trampoline_6442524138+0x7d/0x1000 __napi_poll+0x5/0x1b0 net_rx_action+0x342/0x740 handle_softirqs+0xcf/0x2b0 irq_exit_rcu+0x6c/0x90 sysvec_apic_timer_interrupt+0x72/0x90 </IRQ>
--- mm/page_alloc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
mm/page_alloc.c +5 -5
@@ -2658,12 +2658,12 @@ struct page *rmqueue_buddy(struct zone *preferred_zone, struct zone *zone, page =__rmqueue (zone, order, migratetype, alloc_flags);/* -* If the allocation fails, allow OOM handling access -* to HIGHATOMIC reserves as failing now is worse than -* failing a high-order atomic allocation in the -* future. +* If the allocation fails, allow OOM handling and +* order-0 (atomic) allocs access to HIGHATOMIC +* reserves as failing now is worse than failing a +* high-order atomic allocation in the future. */ -if (!page && (alloc_flags &ALLOC_OOM )) +if (!page && (alloc_flags & (ALLOC_OOM |ALLOC_NON_BLOCK ))) page =__rmqueue_smallest (zone, order,MIGRATE_HIGHATOMIC );if (!page) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/151 x86/traps: Enable UBSAN traps on x86
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gatlin Newhouse <[email protected]>
[ Upstream commit 7424fc6b86c8980a87169e005f5cd4438d18efe6 ]
Currently ARM64 extracts which specific sanitizer has caused a trap via encoded data in the trap instruction. Clang on x86 currently encodes the same data in the UD1 instruction but x86 handle_bug() and is_valid_bugaddr() currently only look at UD2.
Bring x86 to parity with ARM64, similar to commit 25b84002afb9 ("arm64:
Support Clang UBSAN trap codes for better reporting"). See the llvm links for information about the code generation.
Enable the reporting of UBSAN sanitizer details on x86 compiled with clang when CONFIG_UBSAN_TRAP=y by analysing UD1 and retrieving the type immediate which is encoded by the compiler after the UD1.
[ tglx: Simplified it by moving the printk() into handle_bug() ]
Stable-dep-of: 1db272864ff2 ("x86/traps: move kmsan check after instrumentation_begin")
--- arch/x86/include/asm/bug.h | 12 ++++++++ arch/x86/kernel/traps.c | 59 ++++++++++++++++++++++++++++++++++---- include/linux/ubsan.h | 5 ++++ lib/Kconfig.ubsan | 4 +-- 4 files changed, 73 insertions(+), 7 deletions(-)
arch/x86/include/asm/bug.h +12 -0
@@ -13,6 +13,18 @@#define INSN_UD2 0x0b0f#define LEN_UD2 2 +/* +* In clang we have UD1s reporting UBSAN failures on X86, 64 and 32bit. +*/ +#define INSN_ASOP 0x67 +#define OPCODE_ESCAPE 0x0f +#define SECOND_BYTE_OPCODE_UD1 0xb9 +#define SECOND_BYTE_OPCODE_UD2 0x0b + +#define BUG_NONE 0xffff +#define BUG_UD1 0xfffe +#define BUG_UD2 0xfffd +#ifdef CONFIG_GENERIC_BUG #ifdef CONFIG_X86_32
arch/x86/kernel/traps.c +54 -5
89 lines not on this page · raw message
include/linux/ubsan.h +5 -0
@@ -4,6 +4,11 @@#ifdef CONFIG_UBSAN_TRAP const char *report_ubsan_failure (struct pt_regs *regs,u32 check_type); +#else +static inline const char *report_ubsan_failure (struct pt_regs *regs,u32 check_type) +{ +return NULL ; +}#endif #endif
lib/Kconfig.ubsan +2 -2
@@ -28,8 +28,8 @@ config UBSAN_TRAP Also note that selecting Y will cause your kernel to Oops with an "illegal instruction" error with no further details - when a UBSAN violation occurs. (Except on arm64, which will - report which Sanitizer failed.) This may make it hard to + when a UBSAN violation occurs. (Except on arm64 and x86, which + will report which Sanitizer failed.) This may make it hard to determine whether an Oops was caused by UBSAN or to figure out the details of a UBSAN violation. It makes the kernel log output less useful for bug reports.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/151 x86/traps: move kmsan check after instrumentation_begin
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabyrzhan Tasbolatov <[email protected]>
[ Upstream commit 1db272864ff250b5e607283eaec819e1186c8e26 ]
During x86_64 kernel build with CONFIG_KMSAN, the objtool warns following:
AR built-in.a AR vmlinux.a LD vmlinux.o
vmlinux.o: warning: objtool: handle_bug+0x4: call to
kmsan_unpoison_entry_regs() leaves .noinstr.text section
OBJCOPY modules.builtin.modinfo
GEN modules.builtin
MODPOST Module.symvers
CC .vmlinux.export.o
Moving kmsan_unpoison_entry_regs() _after_ instrumentation_begin() fixes the warning.
There is decode_bug(regs->ip, &imm) is left before KMSAN unpoisoining, but it has the return condition and if we include it after instrumentation_begin() it results the warning "return with instrumentation enabled", hence, I'm concerned that regs will not be KMSAN unpoisoned if ud_type == BUG_NONE is true.
--- arch/x86/kernel/traps.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/x86/kernel/traps.c +6 -6
@@ -259,12 +259,6 @@ static noinstr bool handle_bug(struct pt_regs *regs)int ud_type;u32 imm; -/* -* Normally @regs are unpoisoned by irqentry_enter(), but handle_bug() -* is a rare case that uses @regs without passing them to -* irqentry_enter(). -*/ -kmsan_unpoison_entry_regs (regs); ud_type =decode_bug (regs->ip, &imm);if (ud_type ==BUG_NONE )return handled;
@@ -273,6 +267,12 @@ static noinstr bool handle_bug(struct pt_regs *regs)* All lies, just get the WARN/BUG out. */ instrumentation_begin (); +/* +* Normally @regs are unpoisoned by irqentry_enter(), but handle_bug() +* is a rare case that uses @regs without passing them to +* irqentry_enter(). +*/ +kmsan_unpoison_entry_regs (regs);/* * Since we're emulating a CALL with exceptions, restore the interrupt * state to what it was at the exception site.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/151 ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0 ]
Syzbot reported a kernel BUG in ocfs2_truncate_inline. There are two reasons for this: first, the parameter value passed is greater than ocfs2_max_inline_data_with_xattr, second, the start and end parameters of ocfs2_truncate_inline are "unsigned int".
So, we need to add a sanity check for byte_start and byte_len right before ocfs2_truncate_inline() in ocfs2_remove_inode_range(), if they are greater than ocfs2_max_inline_data_with_xattr return -EINVAL.
--- fs/ocfs2/file.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ocfs2/file.c +8 -0
@@ -1783,6 +1783,14 @@ int ocfs2_remove_inode_range(struct inode *inode,return 0 ;if (OCFS2_I (inode)->ip_dyn_features &OCFS2_INLINE_DATA_FL ) { +int id_count =ocfs2_max_inline_data_with_xattr (inode->i_sb, di); + +if (byte_start > id_count || byte_start + byte_len > id_count) { + ret = -EINVAL ; +mlog_errno (ret); + goto out; + } + ret =ocfs2_truncate_inline (inode, di_bh, byte_start, byte_start + byte_len,0 );if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/151 mctp i2c: handle NULL header address
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Johnston <[email protected]>
[ Upstream commit 01e215975fd80af81b5b79f009d49ddd35976c13 ]
daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped.
saddr will usually be set by MCTP core, but check for NULL in case a packet is transmitted by a different protocol.
--- drivers/net/mctp/mctp-i2c.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/mctp/mctp-i2c.c +3 -0
@@ -547,6 +547,9 @@ static int mctp_i2c_header_create(struct sk_buff *skb, struct net_device *dev,if (len >MCTP_I2C_MAXMTU )return -EMSGSIZE ; +if (!daddr || !saddr) +return -EINVAL ; + lldst = *((u8 *)daddr); llsrc = *((u8 *)saddr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/151 xfs: fix finding a last resort AG in xfs_filestream_pick_ag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit dc60992ce76fbc2f71c2674f435ff6bde2108028 ]
When the main loop in xfs_filestream_pick_ag fails to find a suitable AG it tries to just pick the online AG. But the loop for that uses args->pag as loop iterator while the later code expects pag to be set. Fix this by reusing the max_pag case for this last resort, and also add a check for impossible case of no AG just to make sure that the uninitialized pag doesn't even escape in theory.
--- fs/xfs/xfs_filestream.c | 23 ++++++++++++----------- fs/xfs/xfs_trace.h | 15 +++++---------- 2 files changed, 17 insertions(+), 21 deletions(-)
fs/xfs/xfs_filestream.c +12 -11
@@ -64,7 +64,7 @@ xfs_filestream_pick_ag(struct xfs_perag *pag;struct xfs_perag *max_pag =NULL ;xfs_extlen_t minlen = *longest; -xfs_extlen_t free =0 , minfree, maxfree =0 ; +xfs_extlen_t minfree, maxfree =0 ;xfs_agnumber_t agno;bool first_pass = true;int err;
@@ -107,7 +107,6 @@ xfs_filestream_pick_ag( !(flags & XFS_PICK_USERDATA) || (flags & XFS_PICK_LOWSPACE))) {/* Break out, retaining the reference on the AG. */ - free = pag->pagf_freeblks;break ; } }
@@ -150,23 +149,25 @@ xfs_filestream_pick_ag(* grab. */ if (!max_pag) { -for_each_perag_wrap (args->mp,0 , start_agno, args->pag) +for_each_perag_wrap (args->mp,0 , start_agno, pag) { + max_pag = pag;break ; -atomic_inc (&args->pag->pagf_fstrms); - *longest =0 ; - }else { - pag = max_pag; - free = maxfree; -atomic_inc (&pag->pagf_fstrms); + } + +/* Bail if there are no AGs at all to select from. */ +if (!max_pag) +return -ENOSPC ; } + + pag = max_pag; +atomic_inc (&pag->pagf_fstrms); }else if (max_pag) {xfs_perag_rele (max_pag); } -trace_xfs_filestream_pick (pag, pino, free); +trace_xfs_filestream_pick (pag, pino); args->pag = pag;return 0 ; - } static struct xfs_inode *
fs/xfs/xfs_trace.h +5 -10
@@ -672,8 +672,8 @@ DEFINE_FILESTREAM_EVENT(xfs_filestream_lookup);DEFINE_FILESTREAM_EVENT (xfs_filestream_scan); TRACE_EVENT(xfs_filestream_pick, - TP_PROTO(struct xfs_perag *pag, xfs_ino_t ino, xfs_extlen_t free), - TP_ARGS(pag, ino, free), + TP_PROTO(struct xfs_perag *pag, xfs_ino_t ino), + TP_ARGS(pag, ino), TP_STRUCT__entry( __field(dev_t, dev) __field(xfs_ino_t, ino)
@@ -684,14 +684,9 @@ TRACE_EVENT(xfs_filestream_pick,TP_fast_assign ( __entry->dev = pag->pag_mount->m_super->s_dev; __entry->ino = ino; -if (pag) { - __entry->agno = pag->pag_agno; - __entry->streams =atomic_read (&pag->pagf_fstrms); - }else { - __entry->agno =NULLAGNUMBER ; - __entry->streams =0 ; - } - __entry->free = free; + __entry->agno = pag->pag_agno; + __entry->streams =atomic_read (&pag->pagf_fstrms); + __entry->free = pag->pagf_freeblks; ), TP_printk("dev %d:%d ino 0x%llx agno 0x%x streams %d free %d", MAJOR(__entry->dev), MINOR(__entry->dev),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/151 ALSA: hda/realtek: Fix headset mic on TUXEDO Gemini 17 Gen3
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <[email protected]>
[ Upstream commit 0b04fbe886b4274c8e5855011233aaa69fec6e75 ]
Quirk is needed to enable headset microphone on missing pin 0x19.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10182,6 +10182,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1558 ,0x1404 ,"Clevo N150CU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x14a1 ,"Clevo L141MU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x2624 ,"Clevo L240TU" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1558 ,0x28c1 ,"Clevo V370VND" ,ALC2XX_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1558 ,0x4018 ,"Clevo NV40M[BE]" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x4019 ,"Clevo NV40MZ" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1558, 0x4020, "Clevo NV40MB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/151 ALSA: hda/realtek: Fix headset mic on TUXEDO Stellaris 16 Gen6 mb1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <[email protected]>
[ Upstream commit e49370d769e71456db3fbd982e95bab8c69f73e8 ]
Quirk is needed to enable headset microphone on missing pin 0x19.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10403,6 +10403,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1d05 ,0x115c ,"TongFang GMxTGxx" ,ALC269_FIXUP_NO_SHUTUP ),SND_PCI_QUIRK (0x1d05 ,0x121b ,"TongFang GMxAGxx" ,ALC269_FIXUP_NO_SHUTUP ),SND_PCI_QUIRK (0x1d05 ,0x1387 ,"TongFang GMxIXxx" ,ALC2XX_FIXUP_HEADSET_MIC ), +SND_PCI_QUIRK (0x1d05 ,0x1409 ,"TongFang GMxIXxx" ,ALC2XX_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1d17 ,0x3288 ,"Haier Boyue G42" ,ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS ),SND_PCI_QUIRK (0x1d72 ,0x1602 ,"RedmiBook" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ), SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/151 nvmet-auth: assign dh_key to NULL after kfree_sensitive
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit d2f551b1f72b4c508ab9298419f6feadc3b5d791 ]
ctrl->dh_key might be used across multiple calls to nvmet_setup_dhgroup() for the same controller. So it's better to nullify it after release on error path in order to avoid double free later in nvmet_destroy_auth().
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- drivers/nvme/target/auth.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/target/auth.c +1 -0
@@ -101,6 +101,7 @@ int nvmet_setup_dhgroup(struct nvmet_ctrl *ctrl, u8 dhgroup_id)pr_debug ("%s: ctrl %d failed to generate private key, err %d\n" , __func__, ctrl->cntlid, ret);kfree_sensitive (ctrl->dh_key); + ctrl->dh_key =NULL ;return ret; } ctrl->dh_keysize =crypto_kpp_maxsize (ctrl->dh_tfm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/151 kasan: remove vmalloc_percpu test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Konovalov <[email protected]>
[ Upstream commit 330d8df81f3673d6fb74550bbc9bb159d81b35f7 ]
Commit 1a2473f0cbc0 ("kasan: improve vmalloc tests") added the vmalloc_percpu KASAN test with the assumption that __alloc_percpu always uses vmalloc internally, which is tagged by KASAN.
However, __alloc_percpu might allocate memory from the first per-CPU chunk, which is not allocated via vmalloc(). As a result, the test might fail.
Remove the test until proper KASAN annotation for the per-CPU allocated are added; tracked in https://bugzilla.kernel.org/show_bug.cgi?id=215019.
--- mm/kasan/kasan_test.c | 27 --------------------------- 1 file changed, 27 deletions(-)
mm/kasan/kasan_test.c +0 -27
@@ -1381,32 +1381,6 @@ static void vm_map_ram_tags(struct kunit *test)free_pages ((unsigned long )p_ptr,1 ); } -static void vmalloc_percpu (struct kunit *test) -{ -char __percpu *ptr; -int cpu; - -/* -* This test is specifically crafted for the software tag-based mode, -* the only tag-based mode that poisons percpu mappings. -*/ -KASAN_TEST_NEEDS_CONFIG_ON (test,CONFIG_KASAN_SW_TAGS ); - - ptr =__alloc_percpu (PAGE_SIZE ,PAGE_SIZE ); - -for_each_possible_cpu (cpu) { -char *c_ptr =per_cpu_ptr (ptr, cpu); - -KUNIT_EXPECT_GE (test, (u8 )get_tag (c_ptr), (u8 )KASAN_TAG_MIN ); -KUNIT_EXPECT_LT (test, (u8 )get_tag (c_ptr), (u8 )KASAN_TAG_KERNEL ); - -/* Make sure that in-bounds accesses don't crash the kernel. */ - *c_ptr =0 ; - } - -free_percpu (ptr); -} -/* * Check that the assigned pointer tag falls within the [KASAN_TAG_MIN, * KASAN_TAG_KERNEL) range (note: excluding the match-all tag) for tag-based
@@ -1562,7 +1536,6 @@ static struct kunit_case kasan_kunit_test_cases[] = {KUNIT_CASE (vmalloc_oob),KUNIT_CASE (vmap_tags),KUNIT_CASE (vm_map_ram_tags), -KUNIT_CASE (vmalloc_percpu),KUNIT_CASE (match_all_not_assigned),KUNIT_CASE (match_all_ptr_tag), KUNIT_CASE(match_all_mem_tag),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/151 io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 1d60d74e852647255bd8e76f5a22dc42531e4389 ]
When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happening while that write is in-flight. The freeze side will grab that rwsem for writing, excluding any new writers from happening and waiting for existing writes to finish. But io_uring unconditionally uses kiocb_start_write(), which will block if someone is currently attempting to freeze the mount point. This causes a deadlock where freeze is waiting for previous writes to complete, but the previous writes cannot complete, as the task that is supposed to complete them is blocked waiting on starting a new write. This results in the following stuck trace showing that dependency with the write blocked starting a new write:
task:fio state:D stack:0 pid:886 tgid:886 ppid:876
Call trace:
__switch_to+0x1d8/0x348
__schedule+0x8e8/0x2248
schedule+0x110/0x3f0
percpu_rwsem_wait+0x1e8/0x3f8
__percpu_down_read+0xe8/0x500
io_write+0xbb8/0xff8
io_issue_sqe+0x10c/0x1020
io_submit_sqes+0x614/0x2110
__arm64_sys_io_uring_enter+0x524/0x1038
invoke_syscall+0x74/0x268
el0_svc_common.constprop.0+0x160/0x238
do_el0_svc+0x44/0x60
el0_svc+0x44/0xb0
el0t_64_sync_handler+0x118/0x128
el0t_64_sync+0x168/0x170
INFO: task fsfreeze:7364 blocked for more than 15 seconds.
Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963with the attempting freezer stuck trying to grab the rwsem:
task:fsfreeze state:D stack:0 pid:7364 tgid:7364 ppid:995
Call trace: __switch_to+0x1d8/0x348 __schedule+0x8e8/0x2248 schedule+0x110/0x3f0 percpu_down_write+0x2b0/0x680 freeze_super+0x248/0x8a8 do_vfs_ioctl+0x149c/0x1b18 __arm64_sys_ioctl+0xd0/0x1a0 invoke_syscall+0x74/0x268 el0_svc_common.constprop.0+0x160/0x238 do_el0_svc+0x44/0x60 el0_svc+0x44/0xb0 el0t_64_sync_handler+0x118/0x128 el0t_64_sync+0x168/0x170
Fix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a blocking grab of the super block rwsem if it isn't set. For normal issue where IOCB_NOWAIT would always be set, this returns -EAGAIN which will have io_uring core issue a blocking attempt of the write. That will in turn also get completions run, ensuring forward progress.
Since freezing requires CAP_SYS_ADMIN in the first place, this isn't something that can be triggered by a regular user.
--- io_uring/rw.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
io_uring/rw.c +21 -2
@@ -860,6 +860,25 @@ int io_read(struct io_kiocb *req, unsigned int issue_flags)return kiocb_done (req, ret, issue_flags); } +static bool io_kiocb_start_write (struct io_kiocb *req,struct kiocb *kiocb) +{ +struct inode *inode; +bool ret; + +if (!(req->flags &REQ_F_ISREG )) +return true; +if (!(kiocb->ki_flags &IOCB_NOWAIT )) { +kiocb_start_write (kiocb); +return true; + } + + inode =file_inode (kiocb->ki_filp); + ret =sb_start_write_trylock (inode->i_sb); +if (ret) +__sb_writers_release (inode->i_sb,SB_FREEZE_WRITE ); +return ret; +} +int io_write (struct io_kiocb *req,unsigned int issue_flags) { struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw);
@@ -913,8 +932,8 @@ int io_write(struct io_kiocb *req, unsigned int issue_flags)return ret; } -if (req->flags &REQ_F_ISREG ) -kiocb_start_write (kiocb); +if (unlikely (!io_kiocb_start_write (req, kiocb))) +return -EAGAIN ; kiocb->ki_flags |=IOCB_WRITE ;if (likely (req->file->f_op->write_iter))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/151 vmscan,migrate: fix page count imbalance on node stats when demoting pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <[email protected]>
[ Upstream commit 35e41024c4c2b02ef8207f61b9004f6956cf037b ]
When numa balancing is enabled with demotion, vmscan will call migrate_pages when shrinking LRUs. migrate_pages will decrement the the node's isolated page count, leading to an imbalanced count when invoked from (MG)LRU code.
The result is dmesg output like such:
$ cat /proc/sys/vm/stat_refresh
[77383.088417] vmstat_refresh: nr_isolated_anon -103212 [77383.088417] vmstat_refresh: nr_isolated_file -899642
This negative value may impact compaction and reclaim throttling.
The following path produces the decrement:
shrink_folio_list
demote_folio_list
migrate_pages
migrate_pages_batch
migrate_folio_move
migrate_folio_done
mod_node_page_state(-ve) <- decrement
This path happens for SUCCESSFUL migrations, not failures. Typically callers to migrate_pages are required to handle putback/accounting for failures, but this is already handled in the shrink code.
When accounting for migrations, instead do not decrement the count when the migration reason is MR_DEMOTION. As of v6.11, this demotion logic is the only source of MR_DEMOTION.
--- mm/migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/migrate.c +1 -1
@@ -1093,7 +1093,7 @@ static void migrate_folio_done(struct folio *src,* not accounted to NR_ISOLATED_*. They can be recognized * as __PageMovable */ -if (likely (!__folio_test_movable (src))) +if (likely (!__folio_test_movable (src)) && reason !=MR_DEMOTION )mod_node_page_state (folio_pgdat (src),NR_ISOLATED_ANON +folio_is_file_lru (src), -folio_nr_pages (src));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/151 arm64: dts: imx8ulp: correct the flexspi compatible string
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
commit 409dc5196d5b6eb67468a06bf4d2d07d7225a67b upstream.
The flexspi on imx8ulp only has 16 LUTs, and imx8mm flexspi has 32 LUTs, so correct the compatible string here, otherwise will meet below error:
[ 1.119072] ------------[ cut here ]------------ [ 1.123926] WARNING: CPU: 0 PID: 1 at drivers/spi/spi-nxp-fspi.c:855 nxp_fspi_exec_op+0xb04/0xb64 [ 1.133239] Modules linked in: [ 1.136448] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-rc6-next-20240902-00001-g131bf9439dd9 #69 [ 1.146821] Hardware name: NXP i.MX8ULP EVK (DT) [ 1.151647] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.158931] pc : nxp_fspi_exec_op+0xb04/0xb64 [ 1.163496] lr : nxp_fspi_exec_op+0xa34/0xb64 [ 1.168060] sp : ffff80008002b2a0 [ 1.171526] x29: ffff80008002b2d0 x28: 0000000000000000 x27: 0000000000000000 [ 1.179002] x26: ffff2eb645542580 x25: ffff800080610014 x24: ffff800080610000 [ 1.186480] x23: ffff2eb645548080 x22: 0000000000000006 x21: ffff2eb6455425e0 [ 1.193956] x20: 0000000000000000 x19: ffff80008002b5e0 x18: ffffffffffffffff [ 1.201432] x17: ffff2eb644467508 x16: 0000000000000138 x15: 0000000000000002 [ 1.208907] x14: 0000000000000000 x13: ffff2eb6400d8080 x12: 00000000ffffff00 [ 1.216378] x11: 0000000000000000 x10: ffff2eb6400d8080 x9 : ffff2eb697adca80 [ 1.223850] x8 : ffff2eb697ad3cc0 x7 : 0000000100000000 x6 : 0000000000000001 [ 1.231324] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000007a6 [ 1.238795] x2 : 0000000000000000 x1 : 00000000000001ce x0 : 00000000ffffff92 [ 1.246267] Call trace: [ 1.248824] nxp_fspi_exec_op+0xb04/0xb64 [ 1.253031] spi_mem_exec_op+0x3a0/0x430 [ 1.257139] spi_nor_read_id+0x80/0xcc [ 1.261065] spi_nor_scan+0x1ec/0xf10 [ 1.264901] spi_nor_probe+0x108/0x2fc [ 1.268828] spi_mem_probe+0x6c/0xbc [ 1.272574] spi_probe+0x84/0xe4 [ 1.275958] really_probe+0xbc/0x29c [ 1.279713] __driver_probe_device+0x78/0x12c [ 1.284277] driver_probe_device+0xd8/0x15c [ 1.288660] __device_attach_driver+0xb8/0x134 [ 1.293316] bus_for_each_drv+0x88/0xe8 [ 1.297337] __device_attach+0xa0/0x190 [ 1.301353] device_initial_probe+0x14/0x20 [ 1.305734] bus_probe_device+0xac/0xb0 [ 1.309752] device_add+0x5d0/0x790 [ 1.313408] __spi_add_device+0x134/0x204 [ 1.317606] of_register_spi_device+0x3b4/0x590 [ 1.322348] spi_register_controller+0x47c/0x754 [ 1.327181] devm_spi_register_controller+0x4c/0xa4 [ 1.332289] nxp_fspi_probe+0x1cc/0x2b0 [ 1.336307] platform_probe+0x68/0xc4 [ 1.340145] really_probe+0xbc/0x29c [ 1.343893] __driver_probe_device+0x78/0x12c [ 1.348457] driver_probe_device+0xd8/0x15c [ 1.352838] __driver_attach+0x90/0x19c [ 1.356857] bus_for_each_dev+0x7c/0xdc [ 1.360877] driver_attach+0x24/0x30 [ 1.364624] bus_add_driver+0xe4/0x208 [ 1.368552] driver_register+0x5c/0x124 [ 1.372573] __platform_driver_register+0x28/0x34 [ 1.377497] nxp_fspi_driver_init+0x1c/0x28 [ 1.381888] do_one_initcall+0x80/0x1c8 [ 1.385908] kernel_init_freeable+0x1c4/0x28c [ 1.390472] kernel_init+0x20/0x1d8 [ 1.394138] ret_from_fork+0x10/0x20 [ 1.397885] ---[ end trace 0000000000000000 ]--- [ 1.407908] ------------[ cut here ]------------
--- arch/arm64/boot/dts/freescale/imx8ulp.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8ulp.dtsi +1 -1
@@ -352,7 +352,7 @@ }; flexspi2: spi@29810000 { - compatible = "nxp,imx8mm-fspi"; + compatible = "nxp,imx8ulp-fspi"; reg = <0x29810000 0x10000>, <0x60000000 0x10000000>; reg-names = "fspi_base", "fspi_mmap"; #address-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 139/151 io_uring: always lock __io_cqring_overflow_flush
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit 8d09a88ef9d3cb7d21d45c39b7b7c31298d23998 upstream.
Conditional locking is never great, in case of __io_cqring_overflow_flush(), which is a slow path, it's not justified. Don't handle IOPOLL separately, always grab uring_lock for overflow flushing.
--- io_uring/io_uring.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
io_uring/io_uring.c +8 -5
@@ -667,6 +667,8 @@ static void io_cqring_overflow_kill(strustruct io_overflow_cqe *ocqe;LIST_HEAD (list); +lockdep_assert_held (&ctx->uring_lock); +spin_lock (&ctx->completion_lock);list_splice_init (&ctx->cq_overflow_list, &list);clear_bit (IO_CHECK_CQ_OVERFLOW_BIT , &ctx->check_cq);
@@ -683,6 +685,8 @@ static void __io_cqring_overflow_flush(s {size_t cqe_size =sizeof (struct io_uring_cqe ); +lockdep_assert_held (&ctx->uring_lock); +if (__io_cqring_events (ctx) == ctx->cq_entries)return ;
@@ -727,12 +731,9 @@ static void __io_cqring_overflow_flush(sstatic void io_cqring_do_overflow_flush (struct io_ring_ctx *ctx) { -/* iopoll syncs against uring_lock, not completion_lock */ -if (ctx->flags &IORING_SETUP_IOPOLL ) -mutex_lock (&ctx->uring_lock); +mutex_lock (&ctx->uring_lock);__io_cqring_overflow_flush (ctx); -if (ctx->flags &IORING_SETUP_IOPOLL ) -mutex_unlock (&ctx->uring_lock); +mutex_unlock (&ctx->uring_lock); }static void io_cqring_overflow_flush (struct io_ring_ctx *ctx)
@@ -1611,6 +1612,8 @@ static int io_iopoll_check(struct io_rinunsigned int nr_events =0 ;unsigned long check_cq; +lockdep_assert_held (&ctx->uring_lock); +if (!io_allowed_run_tw (ctx))return -EEXIST ;
Greg Kroah-Hartman
maintainerPATCH 140/151 wifi: mac80211: fix NULL dereference at band check in starting tx ba session
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
commit 021d53a3d87eeb9dbba524ac515651242a2a7e3b upstream.
In MLD connection, link_data/link_conf are dynamically allocated. They don't point to vif->bss_conf. So, there will be no chanreq assigned to vif->bss_conf and then the chan will be NULL. Tweak the code to check ht_supported/vht_supported/has_he/has_eht on sta deflink.
Crash log (with rtw89 version under MLO development):
[ 9890.526087] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 9890.526102] #PF: supervisor read access in kernel mode [ 9890.526105] #PF: error_code(0x0000) - not-present page [ 9890.526109] PGD 0 P4D 0 [ 9890.526114] Oops: 0000 [#1] PREEMPT SMP PTI [ 9890.526119] CPU: 2 PID: 6367 Comm: kworker/u16:2 Kdump: loaded Tainted: G OE 6.9.0 #1 [ 9890.526123] Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB3WW (2.73 ) 11/28/2018 [ 9890.526126] Workqueue: phy2 rtw89_core_ba_work [rtw89_core] [ 9890.526203] RIP: 0010:ieee80211_start_tx_ba_session (net/mac80211/agg-tx.c:618 (discriminator 1)) mac80211 [ 9890.526279] Code: f7 e8 d5 93 3e ea 48 83 c4 28 89 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 49 8b 84 24 e0 f1 ff ff 48 8b 80 90 1b 00 00 <83> 38 03 0f 84 37 fe ff ff bb ea ff ff ff eb cc 49 8b 84 24 10 f3 All code ======== 0: f7 e8 imul %eax 2: d5 (bad) 3: 93 xchg %eax,%ebx 4: 3e ea ds (bad) 6: 48 83 c4 28 add $0x28,%rsp a: 89 d8 mov %ebx,%eax c: 5b pop %rbx d: 41 5c pop %r12 f: 41 5d pop %r13 11: 41 5e pop %r14 13: 41 5f pop %r15 15: 5d pop %rbp 16: c3 retq 17: cc int3 18: cc int3 19: cc int3 1a: cc int3 1b: 49 8b 84 24 e0 f1 ff mov -0xe20(%r12),%rax 22: ff 23: 48 8b 80 90 1b 00 00 mov 0x1b90(%rax),%rax 2a:* 83 38 03 cmpl $0x3,(%rax) <-- trapping instruction 2d: 0f 84 37 fe ff ff je 0xfffffffffffffe6a 33: bb ea ff ff ff mov $0xffffffea,%ebx 38: eb cc jmp 0x6 3a: 49 rex.WB 3b: 8b .byte 0x8b 3c: 84 24 10 test %ah,(%rax,%rdx,1) 3f: f3 repz
Code starting with the faulting instruction
===========================================
0: 83 38 03 cmpl $0x3,(%rax) 3: 0f 84 37 fe ff ff je 0xfffffffffffffe40 9: bb ea ff ff ff mov $0xffffffea,%ebx e: eb cc jmp 0xffffffffffffffdc 10: 49 rex.WB 11: 8b .byte 0x8b 12: 84 24 10 test %ah,(%rax,%rdx,1) 15: f3 repz [ 9890.526285] RSP: 0018:ffffb8db09013d68 EFLAGS: 00010246 [ 9890.526291] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9308e0d656c8 [ 9890.526295] RDX: 0000000000000000 RSI: ffffffffab99460b RDI: ffffffffab9a7685 [ 9890.526300] RBP: ffffb8db09013db8 R08: 0000000000000000 R09: 0000000000000873 [ 9890.526304] R10: ffff9308e0d64800 R11: 0000000000000002 R12: ffff9308e5ff6e70 [ 9890.526308] R13: ffff930952500e20 R14: ffff9309192a8c00 R15: 0000000000000000 [ 9890.526313] FS: 0000000000000000(0000) GS:ffff930b4e700000(0000) knlGS:0000000000000000 [ 9890.526316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9890.526318] CR2: 0000000000000000 CR3: 0000000391c58005 CR4: 00000000001706f0 [ 9890.526321] Call Trace: [ 9890.526324] <TASK> [ 9890.526327] ? show_regs (arch/x86/kernel/dumpstack.c:479) [ 9890.526335] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 9890.526340] ? page_fault_oops (arch/x86/mm/fault.c:713) [ 9890.526347] ? search_module_extables (kernel/module/main.c:3256 (discriminator 3)) [ 9890.526353] ? ieee80211_start_tx_ba_session (net/mac80211/agg-tx.c:618 (discriminator 1)) mac80211
--- net/mac80211/agg-tx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mac80211/agg-tx.c +3 -1
@@ -616,7 +616,9 @@ int ieee80211_start_tx_ba_session(structreturn -EINVAL ;if (!pubsta->deflink.ht_cap.ht_supported && - sta->sdata->vif.bss_conf.chandef.chan->band !=NL80211_BAND_6GHZ ) + !pubsta->deflink.vht_cap.vht_supported && + !pubsta->deflink.he_cap.has_he && + !pubsta->deflink.eht_cap.has_eht)return -EINVAL ;if (WARN_ON_ONCE (!local->ops->ampdu_action))
Greg Kroah-Hartman
maintainerPATCH 141/151 nilfs2: fix kernel bug due to missing clearing of checked flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 41e192ad2779cae0102879612dfe46726e4396aa upstream.
Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug.
This was found to be because the "checked" flag of a page/folio was not cleared when it was discarded by nilfs2's own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded. So, fix that.
This was necessary when the use of nilfs2's own page discard routine was applied to more than just metadata files.
--- fs/nilfs2/page.c | 1 + 1 file changed, 1 insertion(+)
fs/nilfs2/page.c +1 -0
@@ -405,6 +405,7 @@ void nilfs_clear_dirty_page(struct pageClearPageUptodate (page);ClearPageMappedToDisk (page); +ClearPageChecked (page);if (page_has_buffers (page)) {struct buffer_head *bh, *head;
Greg Kroah-Hartman
maintainerPATCH 142/151 wifi: iwlwifi: mvm: fix 6 GHz scan construction
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 7245012f0f496162dd95d888ed2ceb5a35170f1a upstream.
If more than 255 colocated APs exist for the set of all APs found during 2.4/5 GHz scanning, then the 6 GHz scan construction will loop forever since the loop variable has type u8, which can never reach the number found when that's bigger than 255, and is stored in a u32 variable. Also move it into the loops to have a smaller scope.
Using a u32 there is fine, we limit the number of APs in the scan list and each has a limit on the number of RNR entries due to the frame size. With a limit of 1000 scan results, a frame size upper bound of 4096 (really it's more like ~2300) and a TBTT entry size of at least 11, we get an upper bound for the number of ~372k, well in the bounds of a u32.
--- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/scan.c +2 -1
@@ -1751,7 +1751,8 @@ iwl_mvm_umac_scan_cfg_channels_v7_6g(str &cp->channel_config[ch_cnt];u32 s_ssid_bitmap =0 , bssid_bitmap =0 , flags =0 ; -u8 j, k, s_max =0 , b_max =0 , n_used_bssid_entries; +u8 k, s_max =0 , b_max =0 , n_used_bssid_entries; +u32 j;bool force_passive, found = false, allow_passive = true, unsolicited_probe_on_chan = false, psc_no_listen = false;s8 psd_20 =IEEE80211_RNR_TBTT_PARAMS_PSD_RESERVED ;
Greg Kroah-Hartman
maintainerPATCH 143/151 mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kefeng Wang <[email protected]>
commit 963756aac1f011d904ddd9548ae82286d3a91f96 upstream.
Patch series "mm: don't install PMD mappings when THPs are disabled by the hw/process/vma".
During testing, it was found that we can get PMD mappings in processes where THP (and more precisely, PMD mappings) are supposed to be disabled. While it works as expected for anon+shmem, the pagecache is the problematic bit.
For s390 KVM this currently means that a VM backed by a file located on filesystem with large folio support can crash when KVM tries accessing the problematic page, because the readahead logic might decide to use a PMD-sized THP and faulting it into the page tables will install a PMD mapping, something that s390 KVM cannot tolerate.
This might also be a problem with HW that does not support PMD mappings, but I did not try reproducing it.
Fix it by respecting the ways to disable THPs when deciding whether we can install a PMD mapping. khugepaged should already be taking care of not collapsing if THPs are effectively disabled for the hw/process/vma.
This patch (of 2):
Add vma_thp_disabled() and thp_disabled_by_hw() helpers to be shared by shmem_allowable_huge_orders() and __thp_vma_allowable_orders().
--- include/linux/huge_mm.h | 18 ++++++++++++++++++ mm/huge_memory.c | 13 +------------ 2 files changed, 19 insertions(+), 12 deletions(-)
include/linux/huge_mm.h +18 -0
@@ -137,6 +137,24 @@ bool hugepage_vma_check(struct vm_area_s (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +static inline bool vma_thp_disabled (struct vm_area_struct *vma, +unsigned long vm_flags) +{ +/* +* Explicitly disabled through madvise or prctl, or some +* architectures may disable THP for some mappings, for +* example, s390 kvm. +*/ +return (vm_flags &VM_NOHUGEPAGE ) || +test_bit (MMF_DISABLE_THP , &vma->vm_mm->flags); +} + +static inline bool thp_disabled_by_hw (void ) +{ +/* If the hardware/firmware marked hugepage support disabled. */ +return transparent_hugepage_flags & (1 <<TRANSPARENT_HUGEPAGE_UNSUPPORTED ); +} +unsigned long thp_get_unmapped_area (struct file *filp,unsigned long addr,unsigned long len,unsigned long pgoff,unsigned long flags);
mm/huge_memory.c +1 -12
@@ -78,18 +78,7 @@ bool hugepage_vma_check(struct vm_area_sif (!vma->vm_mm)/* vdso */ return false; -/* -* Explicitly disabled through madvise or prctl, or some -* architectures may disable THP for some mappings, for -* example, s390 kvm. -* */ -if ((vm_flags &VM_NOHUGEPAGE ) || -test_bit (MMF_DISABLE_THP , &vma->vm_mm->flags)) -return false; -/* -* If the hardware/firmware marked hugepage support disabled. -*/ -if (transparent_hugepage_flags & (1 <<TRANSPARENT_HUGEPAGE_UNSUPPORTED )) +if (thp_disabled_by_hw () ||vma_thp_disabled (vma, vm_flags))return false;/* khugepaged doesn't collapse DAX vma, but page fault is fine. */
Greg Kroah-Hartman
maintainerPATCH 144/151 mm: dont install PMD mappings when THPs are disabled by the hw/process/vma
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
commit 2b0f922323ccfa76219bcaacd35cd50aeaa13592 upstream.
We (or rather, readahead logic :) ) might be allocating a THP in the pagecache and then try mapping it into a process that explicitly disabled
THP: we might end up installing PMD mappings.
This is a problem for s390x KVM, which explicitly remaps all PMD-mapped THPs to be PTE-mapped in s390_enable_sie()->thp_split_mm(), before starting the VM.
For example, starting a VM backed on a file system with large folios supported makes the VM crash when the VM tries accessing such a mapping using KVM.
Is it also a problem when the HW disabled THP using TRANSPARENT_HUGEPAGE_UNSUPPORTED? At least on x86 this would be the case without X86_FEATURE_PSE.
In the future, we might be able to do better on s390x and only disallow PMD mappings -- what s390x and likely TRANSPARENT_HUGEPAGE_UNSUPPORTED really wants. For now, fix it by essentially performing the same check as would be done in __thp_vma_allowable_orders() or in shmem code, where this works as expected, and disallow PMD mappings, making us fallback to PTE mappings.
--- mm/memory.c | 9 +++++++++ 1 file changed, 9 insertions(+)
mm/memory.c +9 -0
@@ -4293,6 +4293,15 @@ vm_fault_t do_set_pmd(struct vm_fault *vpmd_t entry;vm_fault_t ret =VM_FAULT_FALLBACK ; +/* +* It is too late to allocate a small folio, we already have a large +* folio in the pagecache: especially s390 KVM cannot tolerate any +* PMD mappings, but PTE-mapped THP are fine. So let's simply refuse any +* PMD mappings if THPs are disabled. +*/ +if (thp_disabled_by_hw () ||vma_thp_disabled (vma, vma->vm_flags)) +return ret; +if (!transhuge_vma_suitable (vma, haddr))return ret;
Greg Kroah-Hartman
maintainerPATCH 145/151 mtd: spi-nor: winbond: fix w25q128 regression
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
commit d35df77707bf5ae1221b5ba1c8a88cf4fcdd4901 upstream.
Commit 83e824a4a595 ("mtd: spi-nor: Correct flags for Winbond w25q128") removed the flags for non-SFDP devices. It was assumed that it wasn't in use anymore. This wasn't true. Add the no_sfdp_flags as well as the size again.
We add the additional flags for dual and quad read because they have been reported to work properly by Hartmut using both older and newer versions of this flash, the similar flashes with 64Mbit and 256Mbit already have these flags and because it will (luckily) trigger our legacy SFDP parsing, so newer versions with SFDP support will still get the parameters from the SFDP tables.
--- drivers/mtd/spi-nor/winbond.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/mtd/spi-nor/winbond.c +4 -3
@@ -120,9 +120,10 @@ static const struct flash_info winbond_n NO_SFDP_FLAGS(SECT_4K) }, { "w25q80bl", INFO(0xef4014, 0, 64 * 1024, 16) NO_SFDP_FLAGS(SECT_4K) }, - { "w25q128", INFO(0xef4018, 0, 0, 0) - PARSE_SFDP - FLAGS(SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB) }, + { "w25q128", INFO(0xef4018, 0, 64 * 1024, 256) + FLAGS(SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB) + NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ | + SPI_NOR_QUAD_READ) }, { "w25q256", INFO(0xef4019, 0, 64 * 1024, 512) NO_SFDP_FLAGS(SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) .fixups = &w25q256_fixups },
Greg Kroah-Hartman
maintainerPATCH 146/151 SUNRPC: Remove BUG_ON call sites
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit 789ce196a31dd13276076762204bee87df893e53 upstream.
There is no need to take down the whole system for these assertions.
I'd rather not attempt a heroic save here, as some bug has occurred that has left the transport data structures in an unknown state. Just warn and then leak the left-over resources.
--- net/sunrpc/svc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/sunrpc/svc.c +5 -4
@@ -577,11 +577,12 @@ svc_destroy(struct kref *ref)timer_shutdown_sync (&serv->sv_temptimer);/* -* The last user is gone and thus all sockets have to be destroyed to -* the point. Check this. +* Remaining transports at this point are not expected. */ -BUG_ON (!list_empty (&serv->sv_permsocks)); -BUG_ON (!list_empty (&serv->sv_tempsocks)); +WARN_ONCE (!list_empty (&serv->sv_permsocks), +"SVC: permsocks remain for %s\n" , serv->sv_program->pg_name); +WARN_ONCE (!list_empty (&serv->sv_tempsocks), +"SVC: tempsocks remain for %s\n" , serv->sv_program->pg_name);cache_clean_deferred (serv);
Greg Kroah-Hartman
maintainerPATCH 147/151 ASoC: SOF: ipc4-topology: Add definition for generic switch/enum control
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit 060a07cd9bc69eba2da33ed96b1fa69ead60bab1 upstream.
Currently IPC4 has no notion of a switch or enum type of control which is a generic concept in ALSA.
The generic support for these control types will be as follows:
- large config is used to send the channel-value par array
- param_id of a SWITCH type is 200
- param_id of an ENUM type is 201
Each module need to support a switch or/and enum must handle these universal param_ids.
The message payload is described by struct sof_ipc4_control_msg_payload.
--- sound/soc/sof/ipc4-topology.h | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
sound/soc/sof/ipc4-topology.h +18 -1
@@ -319,7 +319,7 @@ struct sof_ipc4_copier {/** * struct sof_ipc4_ctrl_value_chan: generic channel mapped value data * @channel: Channel ID -* @value: gain value +* @value: Value associated with @channel */ struct sof_ipc4_ctrl_value_chan {u32 channel;
@@ -343,6 +343,23 @@ struct sof_ipc4_control_data { }; }; +#define SOF_IPC4_SWITCH_CONTROL_PARAM_ID 200 +#define SOF_IPC4_ENUM_CONTROL_PARAM_ID 201 + +/** +* struct sof_ipc4_control_msg_payload - IPC payload for kcontrol parameters +* @id: unique id of the control +* @num_elems: Number of elements in the chanv array +* @reserved: reserved for future use, must be set to 0 +* @chanv: channel ID and value array +*/ +struct sof_ipc4_control_msg_payload { +uint16_t id; +uint16_t num_elems; +uint32_t reserved[4 ]; + DECLARE_FLEX_ARRAY(struct sof_ipc4_ctrl_value_chan, chanv); +} __packed; +/** * struct sof_ipc4_gain_params - IPC gain parameters * @channels: Channels