6.12.4-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.12.4-rc1 review
This is the start of the stable review cycle for the 6.12.4 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.4-rc1
Frederic Weisbecker <[email protected]>
posix-timers: Target group sigqueue to current task only if not exiting
Ovidiu Bunea <[email protected]>
drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto
Yihan Zhu <[email protected]>
drm/amd/display: update pipe selection policy to check head pipe
Joshua Aberback <[email protected]>
drm/amd/display: Fix handling of plane refcount
Lijo Lazar <[email protected]>
drm/amd/pm: Remove arcturus min power limit
Kenneth Feng <[email protected]>
drm/amd/pm: disable pcie speed switching on Intel platform for smu v14.0.2/3
Umio Yasuno <[email protected]>
drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7
Mario Limonciello <[email protected]>
drm/amd: Fix initialization mistake for NBIO 7.11 devices
Kenneth Feng <[email protected]>
drm/amd/pm: skip setting the power source on smu v14.0.2/3
Vitaly Prosyak <[email protected]>
drm/amdgpu: fix usage slab after free
Mario Limonciello <[email protected]>
drm/amd: Add some missing straps from NBIO 7.11.0
Kenneth Feng <[email protected]>
drm/amdgpu/pm: add gen5 display to the user on smu v14.0.2/3
Lijo Lazar <[email protected]>
drm/amdkfd: Use the correct wptr size
Matthew Auld <[email protected]>
drm/xe/guc_submit: fix race around suspend_pending
Matthew Auld <[email protected]>
drm/xe/migrate: use XE_BO_FLAG_PAGETABLE
Alex Deucher <[email protected]>
Revert "drm/radeon: Delay Connector detecting when HPD singals is unstable"
Matthew Auld <[email protected]>
drm/xe/migrate: fix pat index usage
Jonathan Cavitt <[email protected]>
drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
Steffen Dirkwinkel <[email protected]>
drm: xlnx: zynqmp_dpsub: fix hotplug detection
Lucas Stach <[email protected]>
drm/etnaviv: flush shader L1 cache after user commandstream
Chen-Yu Tsai <[email protected]>
drm/bridge: it6505: Fix inverted reset polarity
Javier Carrasco <[email protected]>
drm/mediatek: Fix child node refcount handling in early exit
Thomas Zimmermann <[email protected]>
drm/fbdev-dma: Select FB_DEFERRED_IO
Ma Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers
Hugo Villeneuve <[email protected]>
drm: panel: jd9365da-h3: Remove unused num_init_cmds structure member
Ma Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
Ma Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
Lyude Paul <[email protected]>
drm/panic: Fix uninitialized spinlock acquisition with CONFIG_DRM_PANIC=n
Francesco Dolcini <[email protected]>
net: fec: make PPS channel configurable
Francesco Dolcini <[email protected]>
net: fec: refactor PPS channel configuration
Francesco Dolcini <[email protected]>
dt-bindings: net: fec: add pps channel property
Carlos Llamas <[email protected]>
binder: add delivered_freeze to debugfs output
Carlos Llamas <[email protected]>
binder: fix memleak of proc->delivered_freeze
Carlos Llamas <[email protected]>
binder: allow freeze notification for dead nodes
Carlos Llamas <[email protected]>
binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs
Carlos Llamas <[email protected]>
binder: fix BINDER_WORK_FROZEN_BINDER debug logs
Carlos Llamas <[email protected]>
binder: fix freeze UAF in binder_release_work()
Carlos Llamas <[email protected]>
binder: fix OOB in binder_add_freeze_work()
Carlos Llamas <[email protected]>
binder: fix node UAF in binder_add_freeze_work()
Nathan Chancellor <[email protected]>
powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang
Nathan Chancellor <[email protected]>
powerpc: Fix stack protector Kconfig test for clang
Zicheng Qu <[email protected]>
iio: gts: fix infinite loop for gain_to_scaletables()
Nuno Sa <[email protected]>
iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
Zicheng Qu <[email protected]>
iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
Jean-Baptiste Maneyrol <[email protected]>
iio: invensense: fix multiple odr switch when FIFO is off
Matti Vaittinen <[email protected]>
iio: accel: kx022a: Fix raw read format
Yang Erkun <[email protected]>
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
Yang Erkun <[email protected]>
nfsd: make sure exp active before svc_export_show
Damien Le Moal <[email protected]>
PCI: rockchip-ep: Fix address translation unit programming
Andrea della Porta <[email protected]>
PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes
Niklas Cassel <[email protected]>
PCI: dwc: ep: Fix advertised resizable BAR size regression
Yuan Can <[email protected]>
dm thin: Add missing destroy_work_on_stack()
Ssuhung Yeh <[email protected]>
dm: Fix typo in error message
Adrian Huang <[email protected]>
mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation
Oleksandr Tymoshenko <[email protected]>
ovl: properly handle large files in ovl_security_fileattr
Javier Carrasco <[email protected]>
leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths
Srinivas Pandruvada <[email protected]>
thermal: int3400: Fix reading of current_uuid for active policy
Jiri Olsa <[email protected]>
fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero
Geert Uytterhoeven <[email protected]>
slab: Fix too strict alignment check in create_cache()
Zijun Hu <[email protected]>
PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf()
Zijun Hu <[email protected]>
PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()
Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Add link up check to ks_pcie_other_map_bus()
Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible
Frank Li <[email protected]>
i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter
Frank Li <[email protected]>
i3c: master: svc: fix possible assignment of the same address to two devices
Frank Li <[email protected]>
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
Jinjie Ruan <[email protected]>
i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
Peter Griffin <[email protected]>
scsi: ufs: exynos: Fix hibern8 notify callbacks
Peter Griffin <[email protected]>
scsi: ufs: exynos: Add check inside exynos_ufs_config_smu()
Heiko Carstens <[email protected]>
s390/stacktrace: Use break instead of return statement
Alexandru Ardelean <[email protected]>
util_macros.h: fix/rework find_closest() macros
Miquel Raynal <[email protected]>
mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
Miquel Raynal <[email protected]>
mtd: spinand: winbond: Fix 512GW and 02JW OOB layout
Max Kellermann <[email protected]>
ceph: fix cred leak in ceph_mds_check_access()
Max Kellermann <[email protected]>
ceph: pass cred pointer to ceph_mds_auth_match()
Patrick Donnelly <[email protected]>
ceph: extract entity name from device id
Chao Yu <[email protected]>
f2fs: fix to drop all discards after creating snapshot on lvm device
yuan.gao <[email protected]>
mm/slub: Avoid list corruption when removing a slab from the full list
Stefan Eichenberger <[email protected]>
PCI: imx6: Fix suspend/resume support on i.MX6QDL
Balaji Pothunoori <[email protected]>
remoteproc: qcom_q6v5_pas: disable auto boot for wpss
Xu Yang <[email protected]>
perf jevents: fix breakage when do perf stat on system metric
Qiang Yu <[email protected]>
PCI: qcom: Disable ASPM L0s for X1E80100
Giovanni Cabiddu <[email protected]>
vfio/qat: fix overflow check in qat_vf_resume_write()
Choong Yong Liang <[email protected]>
net: stmmac: set initial EEE policy configuration
Linus Walleij <[email protected]>
ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()
Linus Walleij <[email protected]>
ARM: 9430/1: entry: Do a dummy read from VMAP shadow
Vasily Gorbik <[email protected]>
s390/entry: Mark IRQ entries to fix stack depot warnings
Linus Walleij <[email protected]>
ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow
Javier Carrasco <[email protected]>
spmi: pmic-arb: fix return path in for_each_available_child_of_node()
Saravana Kannan <[email protected]>
driver core: fw_devlink: Stop trying to optimize cycle detection logic
Marek Vasut <[email protected]>
nvmem: core: Check read_only flag for force_ro in bin_attr_nvmem_write()
Zicheng Qu <[email protected]>
ad7780: fix division by zero in ad7780_write_raw()
Gabor Juhos <[email protected]>
clk: qcom: gcc-qcs404: fix initial rate of GPLL3
Sibi Sankar <[email protected]>
cpufreq: scmi: Fix cleanup path when boost enablement fails
Nathan Chancellor <[email protected]>
powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang
Zheng Yejian <[email protected]>
mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
Michal Vokáč <[email protected]>
leds: lp55xx: Remove redundant test for invalid channel number
Pratyush Brahma <[email protected]>
iommu/arm-smmu: Defer probe of clients after smmu device bound
Mostafa Saleh <[email protected]>
iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
Sergey Senozhatsky <[email protected]>
zram: clear IDLE flag after recompression
MengEn Sun <[email protected]>
vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
guoweikang <[email protected]>
ftrace: Fix regression with module command in stack_trace_filter
Wei Yang <[email protected]>
maple_tree: refine mas_store_root() on storing NULL
Vasiliy Kovalev <[email protected]>
ovl: Filter invalid inodes with missing lookup function
Jinjie Ruan <[email protected]>
kunit: string-stream: Fix a UAF bug in kunit_init_suite()
Zichen Xie <[email protected]>
kunit: Fix potential null dereference in kunit_device_driver_test()
Masami Hiramatsu (Google) <[email protected]>
tracing: Fix function timing profiler to initialize hashtable
Thadeu Lima de Souza Cascardo <[email protected]>
media: uvcvideo: Require entities to have a non-zero unique ID
Ricardo Ribalda <[email protected]>
media: uvcvideo: Stop stream during unregister
Gaosheng Cui <[email protected]>
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
Bryan O'Donoghue <[email protected]>
media: ov08x40: Fix burst write sequence
Jinjie Ruan <[email protected]>
media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
Jinjie Ruan <[email protected]>
media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
Jinjie Ruan <[email protected]>
media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled
Romain Gantois <[email protected]>
net: phy: dp83869: fix status reporting for 1000base-x autonegotiation
Ard Biesheuvel <[email protected]>
efi/libstub: Free correct pointer on failure
Joe Hattori <[email protected]>
media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available
Li Zetao <[email protected]>
media: ts2020: fix null-ptr-deref in ts2020_probe()
Benjamin Gaignard <[email protected]>
media: verisilicon: av1: Fix reference video buffer pointer assignment
John Keeping <[email protected]>
media: platform: rga: fix 32-bit DMA limitation
Ming Qian <[email protected]>
media: imx-jpeg: Ensure power suppliers be suspended before detach them
Alexander Shiyan <[email protected]>
media: i2c: tc358743: Fix crash in the probe error path when using polling
Francesco Dolcini <[email protected]>
arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
Jinjie Ruan <[email protected]>
media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
Guoqing Jiang <[email protected]>
media: mtk-jpeg: Fix null-ptr-deref during unload module
Ming Qian <[email protected]>
media: imx-jpeg: Set video drvdata before register video device
Ming Qian <[email protected]>
media: amphion: Set video drvdata before register video device
Vladimir Zapolskiy <[email protected]>
media: qcom: camss: fix error path on configuration of power domains
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarity
Francesco Dolcini <[email protected]>
arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
Francesco Dolcini <[email protected]>
arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spread
Dragan Simic <[email protected]>
arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
Yuan Can <[email protected]>
md/md-bitmap: Add missing destroy_work_on_stack()
Xiao Ni <[email protected]>
md/raid5: Wait sync io to finish before changing group cnt
Daniel Borkmann <[email protected]>
netkit: Add option for scrubbing skb meta data
Will Deacon <[email protected]>
iommu/tegra241-cmdqv: Fix unused variable warning
Filipe Manana <[email protected]>
btrfs: ref-verify: fix use-after-free after invalid ref action
Lizhi Xu <[email protected]>
btrfs: add a sanity check for btrfs root in btrfs_search_slot()
Filipe Manana <[email protected]>
btrfs: don't loop for nowait writes when checking for cross references
Johannes Thumshirn <[email protected]>
btrfs: fix use-after-free in btrfs_encoded_read_endio()
Mark Harmstone <[email protected]>
btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages()
Mark Harmstone <[email protected]>
btrfs: change btrfs_encoded_read() so that reading of extent is done by caller
David Sterba <[email protected]>
btrfs: drop unused parameter file_offset from btrfs_encoded_read_regular_fill_pages()
Ojaswin Mujoo <[email protected]>
quota: flush quota_release_work upon quota writeback
Long Li <[email protected]>
xfs: remove unknown compat feature check in superblock write validation
-------------
Diffstat:
Documentation/devicetree/bindings/net/fsl,fec.yaml | 7 ++ Makefile | 4 +- arch/arm/kernel/entry-armv.S | 8 ++ arch/arm/mm/ioremap.c | 35 ++++++- .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 6 +- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +- arch/powerpc/Kconfig | 4 +- arch/powerpc/Makefile | 13 +-- arch/powerpc/kernel/vdso/Makefile | 8 +- arch/s390/kernel/entry.S | 4 + arch/s390/kernel/kprobes.c | 6 ++ arch/s390/kernel/stacktrace.c | 2 +- drivers/android/binder.c | 64 ++++++++++--- drivers/base/core.c | 55 +++++------ drivers/block/zram/zram_drv.c | 7 ++ drivers/clk/qcom/gcc-qcs404.c | 1 + drivers/cpufreq/scmi-cpufreq.c | 4 +- drivers/firmware/efi/libstub/efi-stub.c | 2 +- drivers/gpu/drm/Kconfig | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 +- drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c | 9 ++ drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 + .../gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c | 15 +-- .../amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 23 ++++- .../amd/include/asic_reg/nbio/nbio_7_11_0_offset.h | 2 + .../include/asic_reg/nbio/nbio_7_11_0_sh_mask.h | 13 +++ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 6 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 37 ++++++-- drivers/gpu/drm/bridge/ite-it6505.c | 8 +- drivers/gpu/drm/drm_atomic_helper.c | 2 +- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +- drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c | 1 - drivers/gpu/drm/radeon/radeon_connectors.c | 10 -- drivers/gpu/drm/sti/sti_cursor.c | 3 + drivers/gpu/drm/sti/sti_gdp.c | 3 + drivers/gpu/drm/sti/sti_hqvdp.c | 3 + drivers/gpu/drm/xe/xe_guc_ads.c | 14 +++ drivers/gpu/drm/xe/xe_guc_submit.c | 17 +++- drivers/gpu/drm/xe/xe_migrate.c | 6 +- drivers/gpu/drm/xlnx/zynqmp_kms.c | 4 +- drivers/i3c/master.c | 2 +- drivers/i3c/master/svc-i3c-master.c | 39 +++++--- drivers/iio/accel/kionix-kx022a.c | 2 +- drivers/iio/adc/ad7780.c | 2 +- drivers/iio/adc/ad7923.c | 4 +- .../iio/common/inv_sensors/inv_sensors_timestamp.c | 4 + drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 - drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 3 - drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 1 - drivers/iio/industrialio-gts-helper.c | 2 +- drivers/iio/inkern.c | 2 +- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 2 + drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 +++ drivers/iommu/io-pgtable-arm.c | 18 +++- drivers/leds/flash/leds-mt6360.c | 3 +- drivers/leds/leds-lp55xx-common.c | 3 - drivers/md/dm-thin.c | 1 + drivers/md/md-bitmap.c | 1 + drivers/md/persistent-data/dm-space-map-common.c | 2 +- drivers/md/raid5.c | 4 + drivers/media/dvb-frontends/ts2020.c | 8 +- drivers/media/i2c/dw9768.c | 10 +- drivers/media/i2c/ov08x40.c | 33 ++++++- drivers/media/i2c/tc358743.c | 4 +- drivers/media/platform/allegro-dvt/allegro-core.c | 4 +- drivers/media/platform/amphion/vpu_drv.c | 2 +- drivers/media/platform/amphion/vpu_v4l2.c | 2 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 10 ++ .../media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 11 --- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 +- drivers/media/platform/qcom/camss/camss.c | 19 ++-- drivers/media/platform/qcom/venus/core.c | 2 +- drivers/media/platform/rockchip/rga/rga.c | 2 +- .../media/platform/samsung/exynos4-is/media-dev.h | 5 +- .../verisilicon/rockchip_vpu981_hw_av1_dec.c | 3 +- drivers/media/usb/gspca/ov534.c | 2 +- drivers/media/usb/uvc/uvc_driver.c | 102 +++++++++++++++------ drivers/mtd/nand/spi/winbond.c | 16 ++-- drivers/net/ethernet/freescale/fec_ptp.c | 11 ++- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 + drivers/net/netkit.c | 68 +++++++++++--- drivers/net/phy/dp83869.c | 20 +++- drivers/nvmem/core.c | 2 +- drivers/pci/controller/dwc/pci-imx6.c | 57 +++++++++--- drivers/pci/controller/dwc/pci-keystone.c | 12 +++ drivers/pci/controller/dwc/pcie-designware-ep.c | 2 +- drivers/pci/controller/dwc/pcie-qcom.c | 2 +- drivers/pci/controller/pcie-rockchip-ep.c | 16 +++- drivers/pci/controller/pcie-rockchip.h | 4 + drivers/pci/endpoint/pci-epc-core.c | 11 +-- drivers/pci/of_property.c | 2 +- drivers/remoteproc/qcom_q6v5_pas.c | 2 +- drivers/spmi/spmi-pmic-arb.c | 3 +- .../intel/int340x_thermal/int3400_thermal.c | 2 +- drivers/ufs/host/ufs-exynos.c | 23 +++-- drivers/vfio/pci/qat/main.c | 2 +- fs/btrfs/btrfs_inode.h | 12 ++- fs/btrfs/ctree.c | 6 +- fs/btrfs/extent-tree.c | 2 +- fs/btrfs/inode.c | 94 ++++++++++--------- fs/btrfs/ioctl.c | 32 ++++++- fs/btrfs/ref-verify.c | 1 + fs/btrfs/send.c | 2 +- fs/ceph/mds_client.c | 7 +- fs/ceph/super.c | 10 +- fs/f2fs/segment.c | 16 ++-- fs/f2fs/super.c | 12 +++ fs/nfsd/export.c | 5 +- fs/nfsd/nfs4state.c | 19 ++++ fs/overlayfs/inode.c | 7 +- fs/overlayfs/util.c | 3 + fs/proc/kcore.c | 1 + fs/quota/dquot.c | 2 + fs/xfs/libxfs/xfs_sb.c | 7 -- include/drm/drm_panic.h | 14 +++ include/linux/kasan.h | 12 ++- include/linux/util_macros.h | 56 +++++++---- include/uapi/linux/if_link.h | 15 +++ kernel/signal.c | 9 +- kernel/trace/ftrace.c | 7 ++ lib/kunit/debugfs.c | 5 +- lib/kunit/kunit-test.c | 2 + lib/maple_tree.c | 13 ++- mm/damon/tests/vaddr-kunit.h | 1 + mm/damon/vaddr.c | 4 +- mm/kasan/shadow.c | 14 ++- mm/slab.h | 5 + mm/slab_common.c | 2 +- mm/slub.c | 9 +- mm/vmalloc.c | 34 +++++-- mm/vmstat.c | 1 + tools/perf/pmu-events/empty-pmu-events.c | 12 +-- tools/perf/pmu-events/jevents.py | 12 +-- 143 files changed, 1071 insertions(+), 434 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/146 xfs: remove unknown compat feature check in superblock write validation
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit 652f03db897ba24f9c4b269e254ccc6cc01ff1b7 ]
Compat features are new features that older kernels can safely ignore, allowing read-write mounts without issues. The current sb write validation implementation returns -EFSCORRUPTED for unknown compat features, preventing filesystem write operations and contradicting the feature's definition.
Additionally, if the mounted image is unclean, the log recovery may need to write to the superblock. Returning an error for unknown compat features during sb write validation can cause mount failures.
Although XFS currently does not use compat feature flags, this issue affects current kernels' ability to mount images that may use compat feature flags in the future.
Since superblock read validation already warns about unknown compat features, it's unnecessary to repeat this warning during write validation. Therefore, the relevant code in write validation is being removed.
--- fs/xfs/libxfs/xfs_sb.c | 7 ------- 1 file changed, 7 deletions(-)
fs/xfs/libxfs/xfs_sb.c +0 -7
@@ -297,13 +297,6 @@ xfs_validate_sb_write(* the kernel cannot support since we checked for unsupported bits in * the read verifier, which means that memory is corrupt. */ -if (xfs_sb_has_compat_feature (sbp,XFS_SB_FEAT_COMPAT_UNKNOWN )) { -xfs_warn (mp, -"Corruption detected in superblock compatible features (0x%x)!" , - (sbp->sb_features_compat &XFS_SB_FEAT_COMPAT_UNKNOWN )); -return -EFSCORRUPTED ; - } -if (!xfs_is_readonly (mp) &&xfs_sb_has_ro_compat_feature (sbp,XFS_SB_FEAT_RO_COMPAT_UNKNOWN )) { xfs_alert(mp,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/146 quota: flush quota_release_work upon quota writeback
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <[email protected]>
[ Upstream commit ac6f420291b3fee1113f21d612fa88b628afab5b ]
One of the paths quota writeback is called from is:
freeze_super()
sync_filesystem()
ext4_sync_fs()
dquot_writeback_dquots()Since we currently don't always flush the quota_release_work queue in this path, we can end up with the following race:
1. dquot are added to releasing_dquots list during regular operations.
2. FS Freeze starts, however, this does not flush the quota_release_work queue.
3. Freeze completes.
4. Kernel eventually tries to flush the workqueue while FS is frozen which hits a WARN_ON since transaction gets started during frozen state:
ext4_journal_check_start+0x28/0x110 [ext4] (unreliable) __ext4_journal_start_sb+0x64/0x1c0 [ext4] ext4_release_dquot+0x90/0x1d0 [ext4] quota_release_workfn+0x43c/0x4d0
Which is the following line:
WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE);
Which ultimately results in generic/390 failing due to dmesg noise. This was detected on powerpc machine 15 cores.
To avoid this, make sure to flush the workqueue during dquot_writeback_dquots() so we dont have any pending workitems after freeze.
--- fs/quota/dquot.c | 2 ++ 1 file changed, 2 insertions(+)
fs/quota/dquot.c +2 -0
@@ -689,6 +689,8 @@ int dquot_writeback_dquots(struct super_block *sb, int type)WARN_ON_ONCE (!rwsem_is_locked (&sb->s_umount)); +flush_delayed_work ("a_release_work); +for (cnt =0 ; cnt <MAXQUOTAS ; cnt++) {if (type !=-1 && cnt != type)continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/146 btrfs: drop unused parameter file_offset from btrfs_encoded_read_regular_fill_pages()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
[ Upstream commit 590168edbe6317ca9f4066215fb099f43ffe745c ]
The file_offset parameter used to be passed to encoded read struct but was removed in commit b665affe93d8 ("btrfs: remove unused members from struct btrfs_encoded_read_private").
Stable-dep-of: 05b36b04d74a ("btrfs: fix use-after-free in btrfs_encoded_read_endio()")
--- fs/btrfs/btrfs_inode.h | 3 +-- fs/btrfs/inode.c | 6 +++--- fs/btrfs/send.c | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-)
fs/btrfs/btrfs_inode.h +1 -2
@@ -613,8 +613,7 @@ int btrfs_writepage_cow_fixup(struct folio *folio);int btrfs_encoded_io_compression_from_extent (struct btrfs_fs_info *fs_info,int compress_type);int btrfs_encoded_read_regular_fill_pages (struct btrfs_inode *inode, -u64 file_offset,u64 disk_bytenr, -u64 disk_io_size, +u64 disk_bytenr,u64 disk_io_size,struct page **pages);ssize_t btrfs_encoded_read (struct kiocb *iocb,struct iov_iter *iter,struct btrfs_ioctl_encoded_io_args *encoded);
fs/btrfs/inode.c +3 -3
@@ -9132,8 +9132,8 @@ static void btrfs_encoded_read_endio(struct btrfs_bio *bbio) }int btrfs_encoded_read_regular_fill_pages (struct btrfs_inode *inode, -u64 file_offset,u64 disk_bytenr, -u64 disk_io_size,struct page **pages) +u64 disk_bytenr,u64 disk_io_size, +struct page **pages) {struct btrfs_fs_info *fs_info = inode->root->fs_info;struct btrfs_encoded_read_private priv = {
@@ -9203,7 +9203,7 @@ static ssize_t btrfs_encoded_read_regular(struct kiocb *iocb, goto out; } - ret =btrfs_encoded_read_regular_fill_pages (inode, start, disk_bytenr, + ret =btrfs_encoded_read_regular_fill_pages (inode, disk_bytenr, disk_io_size, pages);if (ret) goto out;
fs/btrfs/send.c +1 -1
@@ -5677,7 +5677,7 @@ static int send_encoded_extent(struct send_ctx *sctx, struct btrfs_path *path,* Note that send_buf is a mapping of send_buf_pages, so this is really * reading into send_buf. */ - ret =btrfs_encoded_read_regular_fill_pages (BTRFS_I (inode), offset, + ret =btrfs_encoded_read_regular_fill_pages (BTRFS_I (inode), disk_bytenr, disk_num_bytes, sctx->send_buf_pages + (data_offset >>PAGE_SHIFT ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/146 btrfs: change btrfs_encoded_read() so that reading of extent is done by caller
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <[email protected]>
[ Upstream commit 26efd44796c6dd7a64f039a0dda6d558eac97a3e ]
Change the behaviour of btrfs_encoded_read() so that if it needs to read an extent from disk, it leaves the extent and inode locked and returns -EIOCBQUEUED. The caller is then responsible for doing the I/O via btrfs_encoded_read_regular() and unlocking the extent and inode.
Stable-dep-of: 05b36b04d74a ("btrfs: fix use-after-free in btrfs_encoded_read_endio()")
--- fs/btrfs/btrfs_inode.h | 9 ++++++- fs/btrfs/inode.c | 57 ++++++++++++++++++++---------------------- fs/btrfs/ioctl.c | 32 +++++++++++++++++++++++- 3 files changed, 66 insertions(+), 32 deletions(-)
fs/btrfs/btrfs_inode.h +8 -1
@@ -616,7 +616,14 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode, u64 disk_bytenr, u64 disk_io_size, struct page **pages);ssize_t btrfs_encoded_read (struct kiocb *iocb,struct iov_iter *iter, -struct btrfs_ioctl_encoded_io_args *encoded); +struct btrfs_ioctl_encoded_io_args *encoded, +struct extent_state **cached_state, +u64 *disk_bytenr,u64 *disk_io_size); +ssize_t btrfs_encoded_read_regular (struct kiocb *iocb,struct iov_iter *iter, +u64 start,u64 lockend, +struct extent_state **cached_state, +u64 disk_bytenr,u64 disk_io_size, +size_t count,bool compressed,bool *unlocked);ssize_t btrfs_do_encoded_write (struct kiocb *iocb,struct iov_iter *from,const struct btrfs_ioctl_encoded_io_args *encoded);
fs/btrfs/inode.c +27 -30
139 lines not on this page · raw message
fs/btrfs/ioctl.c +31 -1
@@ -4514,12 +4514,17 @@ static int btrfs_ioctl_encoded_read(struct file *file, void __user *argp, size_t copy_end_kernel = offsetofend(struct btrfs_ioctl_encoded_io_args, flags);size_t copy_end; +struct btrfs_inode *inode =BTRFS_I (file_inode (file)); +struct btrfs_fs_info *fs_info = inode->root->fs_info; +struct extent_io_tree *io_tree = &inode->io_tree;struct iovec iovstack[UIO_FASTIOV ];struct iovec *iov = iovstack;struct iov_iter iter;loff_t pos;struct kiocb kiocb;ssize_t ret; +u64 disk_bytenr, disk_io_size; +struct extent_state *cached_state =NULL ;if (!capable (CAP_SYS_ADMIN )) { ret = -EPERM ;
@@ -4572,7 +4577,32 @@ static int btrfs_ioctl_encoded_read(struct file *file, void __user *argp,init_sync_kiocb (&kiocb, file); kiocb.ki_pos = pos; - ret =btrfs_encoded_read (&kiocb, &iter, &args); + ret =btrfs_encoded_read (&kiocb, &iter, &args, &cached_state, + &disk_bytenr, &disk_io_size); + +if (ret == -EIOCBQUEUED ) { +bool unlocked = false; +u64 start, lockend, count; + + start =ALIGN_DOWN (kiocb.ki_pos, fs_info->sectorsize); + lockend = start +BTRFS_MAX_UNCOMPRESSED -1 ; + +if (args.compression) + count = disk_io_size; +else + count = args.len; + + ret =btrfs_encoded_read_regular (&kiocb, &iter, start, lockend, + &cached_state, disk_bytenr, + disk_io_size, count, + args.compression, &unlocked); + +if (!unlocked) { +unlock_extent (io_tree, start, lockend, &cached_state); +btrfs_inode_unlock (inode,BTRFS_ILOCK_SHARED ); + } + } +if (ret >=0 ) {fsnotify_access (file); if (copy_to_user(argp + copy_end,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/146 btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <[email protected]>
[ Upstream commit 68d3b27e05c7ca5545e88465f5e2be6eda0e11df ]
Change btrfs_encoded_read_regular_fill_pages() so that the priv struct is allocated rather than stored on the stack, in preparation for adding an asynchronous mode to the function.
Stable-dep-of: 05b36b04d74a ("btrfs: fix use-after-free in btrfs_encoded_read_endio()")
--- fs/btrfs/inode.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
fs/btrfs/inode.c +18 -11
@@ -9136,16 +9136,21 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode, struct page **pages) {struct btrfs_fs_info *fs_info = inode->root->fs_info; -struct btrfs_encoded_read_private priv = { - .pending =ATOMIC_INIT (1 ), - }; +struct btrfs_encoded_read_private *priv;unsigned long i =0 ;struct btrfs_bio *bbio; +int ret; -init_waitqueue_head (&priv.wait); + priv =kmalloc (sizeof (struct btrfs_encoded_read_private ),GFP_NOFS ); +if (!priv) +return -ENOMEM ; + +init_waitqueue_head (&priv->wait); +atomic_set (&priv->pending,1 ); + priv->status =0 ; bbio =btrfs_bio_alloc (BIO_MAX_VECS ,REQ_OP_READ , fs_info, - btrfs_encoded_read_endio, &priv); + btrfs_encoded_read_endio, priv); bbio->bio.bi_iter.bi_sector = disk_bytenr >>SECTOR_SHIFT ; bbio->inode = inode;
@@ -9153,11 +9158,11 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,size_t bytes =min_t (u64, disk_io_size,PAGE_SIZE );if (bio_add_page (&bbio->bio, pages[i], bytes,0 ) < bytes) { -atomic_inc (&priv.pending); +atomic_inc (&priv->pending);btrfs_submit_bbio (bbio,0 ); bbio =btrfs_bio_alloc (BIO_MAX_VECS ,REQ_OP_READ , fs_info, - btrfs_encoded_read_endio, &priv); + btrfs_encoded_read_endio, priv); bbio->bio.bi_iter.bi_sector = disk_bytenr >>SECTOR_SHIFT ; bbio->inode = inode;continue ;
@@ -9168,13 +9173,15 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode, disk_io_size -= bytes; }while (disk_io_size); -atomic_inc (&priv.pending); +atomic_inc (&priv->pending);btrfs_submit_bbio (bbio,0 ); -if (atomic_dec_return (&priv.pending)) -io_wait_event (priv.wait, !atomic_read (&priv.pending)); +if (atomic_dec_return (&priv->pending)) +io_wait_event (priv->wait, !atomic_read (&priv->pending));/* See btrfs_encoded_read_endio() for ordering. */ -return blk_status_to_errno (READ_ONCE (priv.status)); + ret =blk_status_to_errno (READ_ONCE (priv->status)); +kfree (priv); +return ret; } ssize_t btrfs_encoded_read_regular(struct kiocb *iocb, struct iov_iter *iter,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/146 btrfs: fix use-after-free in btrfs_encoded_read_endio()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit 05b36b04d74a517d6675bf2f90829ff1ac7e28dc ]
Shinichiro reported the following use-after free that sometimes is happening in our CI system when running fstests' btrfs/284 on a TCMU runner device:
BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780
Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219
CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15
Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020
Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]
Call Trace:
<TASK>
dump_stack_lvl+0x6e/0xa0
? lock_release+0x708/0x780
print_report+0x174/0x505
? lock_release+0x708/0x780
? __virt_addr_valid+0x224/0x410
? lock_release+0x708/0x780
kasan_report+0xda/0x1b0
? lock_release+0x708/0x780
? __wake_up+0x44/0x60
lock_release+0x708/0x780
? __pfx_lock_release+0x10/0x10
? __pfx_do_raw_spin_lock+0x10/0x10
? lock_is_held_type+0x9a/0x110
_raw_spin_unlock_irqrestore+0x1f/0x60
__wake_up+0x44/0x60
btrfs_encoded_read_endio+0x14b/0x190 [btrfs]
btrfs_check_read_bio+0x8d9/0x1360 [btrfs]
? lock_release+0x1b0/0x780
? trace_lock_acquire+0x12f/0x1a0
? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs]
? process_one_work+0x7e3/0x1460
? lock_acquire+0x31/0xc0
? process_one_work+0x7e3/0x1460
process_one_work+0x85c/0x1460
? __pfx_process_one_work+0x10/0x10
? assign_work+0x16c/0x240
worker_thread+0x5e6/0xfc0
? __pfx_worker_thread+0x10/0x10
kthread+0x2c3/0x3a0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x31/0x70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 3661:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs]
send_extent_data+0xf0f/0x24a0 [btrfs]
process_extent+0x48a/0x1830 [btrfs]
changed_cb+0x178b/0x2ea0 [btrfs]
btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]
_btrfs_ioctl_send+0x117/0x330 [btrfs]
btrfs_ioctl+0x184a/0x60a0 [btrfs]
__x64_sys_ioctl+0x12e/0x1a0
do_syscall_64+0x95/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 3661:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x70
__kasan_slab_free+0x4f/0x70
kfree+0x143/0x490
btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs]
send_extent_data+0xf0f/0x24a0 [btrfs]
process_extent+0x48a/0x1830 [btrfs]
changed_cb+0x178b/0x2ea0 [btrfs]
btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]
_btrfs_ioctl_send+0x117/0x330 [btrfs]
btrfs_ioctl+0x184a/0x60a0 [btrfs]
__x64_sys_ioctl+0x12e/0x1a0
do_syscall_64+0x95/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The buggy address belongs to the object at ffff888106a83f00
which belongs to the cache kmalloc-rnd-07-96 of size 96
The buggy address is located 24 bytes inside of
freed 96-byte region [ffff888106a83f00, ffff888106a83f60)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83
flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
page_type: f5(slab)
raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004
raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================Further analyzing the trace and the crash dump's vmcore file shows that the wake_up() call in btrfs_encoded_read_endio() is calling wake_up() on the wait_queue that is in the private data passed to the end_io handler.
Commit 4ff47df40447 ("btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages()") moved 'struct btrfs_encoded_read_private' off the stack.
Before that commit one can see a corruption of the private data when analyzing the vmcore after a crash:
*(struct btrfs_encoded_read_private *)0xffff88815626eec8 = {
.wait = (wait_queue_head_t){
.lock = (spinlock_t){
.rlock = (struct raw_spinlock){
.raw_lock = (arch_spinlock_t){
.val = (atomic_t){
.counter = (int)-2005885696,
},
.locked = (u8)0,
.pending = (u8)157,
.locked_pending = (u16)40192,
.tail = (u16)34928,
},
.magic = (unsigned int)536325682,
.owner_cpu = (unsigned int)29,
.owner = (void *)__SCT__tp_func_btrfs_transaction_commit+0x0 = 0x0,
.dep_map = (struct lockdep_map){
.key = (struct lock_class_key *)0xffff8881575a3b6c,
.class_cache = (struct lock_class *[2]){ 0xffff8882a71985c0, 0xffffea00066f5d40 },
.name = (const char *)0xffff88815626f100 = "",
.wait_type_outer = (u8)37,
.wait_type_inner = (u8)178,
.lock_type = (u8)154,
},
},
.__padding = (u8 [24]){ 0, 157, 112, 136, 50, 174, 247, 31, 29 },
.dep_map = (struct lockdep_map){
.key = (struct lock_class_key *)0xffff8881575a3b6c,
.class_cache = (struct lock_class *[2]){ 0xffff8882a71985c0, 0xffffea00066f5d40 },
.name = (const char *)0xffff88815626f100 = "",
.wait_type_outer = (u8)37,
.wait_type_inner = (u8)178,
.lock_type = (u8)154,
},
},
.head = (struct list_head){
.next = (struct list_head *)0x112cca,
.prev = (struct list_head *)0x47,
},
},
.pending = (atomic_t){
.counter = (int)-1491499288,
},
.status = (blk_status_t)130,
}Here we can see several indicators of in-memory data corruption, e.g. the large negative atomic values of ->pending or ->wait->lock->rlock->raw_lock->val, as well as the bogus spinlock magic 0x1ff7ae32 (decimal 536325682 above) instead of 0xdead4ead or the bogus pointer values for ->wait->head.
To fix this, change atomic_dec_return() to atomic_dec_and_test() to fix the corruption, as atomic_dec_return() is defined as two instructions on x86_64, whereas atomic_dec_and_test() is defined as a single atomic operation. This can lead to a situation where counter value is already decremented but the if statement in btrfs_encoded_read_endio() is not completely processed, i.e. the 0 test has not completed. If another thread continues executing btrfs_encoded_read_regular_fill_pages() the atomic_dec_return() there can see an already updated ->pending counter and continues by freeing the private data. Continuing in the endio handler the test for 0 succeeds and the wait_queue is woken up, resulting in a use-after-free.
--- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode.c +1 -1
@@ -9126,7 +9126,7 @@ static void btrfs_encoded_read_endio(struct btrfs_bio *bbio)*/ WRITE_ONCE (priv->status, bbio->bio.bi_status); } -if (!atomic_dec_return (&priv->pending)) +if (atomic_dec_and_test (&priv->pending))wake_up (&priv->wait);bio_put (&bbio->bio); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/146 btrfs: dont loop for nowait writes when checking for cross references
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit ed67f2a913a4f0fc505db29805c41dd07d3cb356 ]
When checking for delayed refs when verifying if there are cross references for a data extent, we stop if the path has nowait set and we can't try lock the delayed ref head's mutex, returning -EAGAIN with the goal of making a write fallback to a blocking context. However we ignore the -EAGAIN at btrfs_cross_ref_exist() when check_delayed_ref() returns it, and keep looping instead of immediately returning the -EAGAIN to the caller.
Fix this by not looping if we get -EAGAIN and we have a nowait path.
--- fs/btrfs/extent-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/extent-tree.c +1 -1
@@ -2446,7 +2446,7 @@ int btrfs_cross_ref_exist(struct btrfs_root *root, u64 objectid, u64 offset, goto out; ret =check_delayed_ref (root, path, objectid, offset, bytenr); - }while (ret == -EAGAIN ); + }while (ret == -EAGAIN && !path->nowait); out:btrfs_release_path (path);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/146 btrfs: add a sanity check for btrfs root in btrfs_search_slot()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit 3ed51857a50f530ac7a1482e069dfbd1298558d4 ]
Syzbot reports a null-ptr-deref in btrfs_search_slot().
The reproducer is using rescue=ibadroots, and the extent tree root is corrupted thus the extent tree is NULL.
When scrub tries to search the extent tree to gather the needed extent info, btrfs_search_slot() doesn't check if the target root is NULL or not, resulting the null-ptr-deref.
Add sanity check for btrfs root before using it in btrfs_search_slot().
--- fs/btrfs/ctree.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/btrfs/ctree.c +5 -1
@@ -2010,7 +2010,7 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root, const struct btrfs_key *key, struct btrfs_path *p, int ins_len, int cow) { - struct btrfs_fs_info *fs_info = root->fs_info; + struct btrfs_fs_info *fs_info;struct extent_buffer *b;int slot;int ret;
@@ -2023,6 +2023,10 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,int min_write_lock_level;int prev_cmp; +if (!root) +return -EINVAL ; + + fs_info = root->fs_info;might_sleep (); lowest_level = p->lowest_level;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/146 btrfs: ref-verify: fix use-after-free after invalid ref action
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f ]
At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it.
Syzbot report this with the following stack traces:
BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314
btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline]
btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23
btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482
btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293
vfs_unlink+0x365/0x650 fs/namei.c:4469
do_unlinkat+0x4ae/0x830 fs/namei.c:4533
__do_sys_unlinkat fs/namei.c:4576 [inline]
__se_sys_unlinkat fs/namei.c:4569 [inline]
__x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1
__btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521
update_ref_for_cow+0x96a/0x11f0
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
==================================================================
BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473
Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329
CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
rb_first+0x69/0x70 lib/rbtree.c:473
free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248
btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917
btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898
btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f996df7e719
RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719
RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004
RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68
</TASK>
Allocated by task 5329:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701
btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5329:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2342 [inline]
slab_free mm/slub.c:4579 [inline]
kfree+0x1a0/0x440 mm/slub.c:4727
btrfs_ref_tree_mod+0x136c/0x15e0
btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888042d1af00
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 56 bytes inside of
freed 64-byte region [ffff888042d1af00, ffff888042d1af40)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a
anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541
prep_new_page mm/page_alloc.c:1549 [inline]
get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x140 mm/slub.c:2412
allocate_slab+0x5a/0x2f0 mm/slub.c:2578
new_slab mm/slub.c:2631 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818
__slab_alloc+0x58/0xa0 mm/slub.c:3908
__slab_alloc_node mm/slub.c:3961 [inline]
slab_alloc_node mm/slub.c:4122 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x25a/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80
tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771
security_file_open+0x777/0x990 security/security.c:3109
do_dentry_open+0x369/0x1460 fs/open.c:945
vfs_open+0x3e/0x330 fs/open.c:1088
do_open fs/namei.c:3774 [inline]
path_openat+0x2c84/0x3590 fs/namei.c:3933
page last free pid 5055 tgid 5055 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1112 [inline]
free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642
free_pipe_info+0x300/0x390 fs/pipe.c:860
put_pipe_info fs/pipe.c:719 [inline]
pipe_release+0x245/0x320 fs/pipe.c:742
__fput+0x23f/0x880 fs/file_table.c:431
__do_sys_close fs/open.c:1567 [inline]
__se_sys_close fs/open.c:1552 [inline]
__x64_sys_close+0x7f/0x110 fs/open.c:1552
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
>ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00--- fs/btrfs/ref-verify.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/ref-verify.c +1 -0
@@ -857,6 +857,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info, "dropping a ref for a root that doesn't have a ref on the block");dump_block_entry (fs_info, be);dump_ref_action (fs_info, ra); +rb_erase (&ref->node, &be->refs);kfree (ref);kfree (ra); goto out_unlock;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/146 iommu/tegra241-cmdqv: Fix unused variable warning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 5492f0c4085a8fb8820ff974f17b83a7d6dab5a5 upstream.
While testing some io-pgtable changes, I ran into a compiler warning from the Tegra CMDQ driver:
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c:803:23: warning: unused variable 'cmdqv_debugfs_dir' [-Wunused-variable]
803 | static struct dentry *cmdqv_debugfs_dir;
| ^~~~~~~~~~~~~~~~~1 warning generated.
Guard the variable declaration with CONFIG_IOMMU_DEBUGFS to silence the warning.
--- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +2 -0
@@ -801,7 +801,9 @@ out_fallback:return 0 ; } +#ifdef CONFIG_IOMMU_DEBUGFS static struct dentry *cmdqv_debugfs_dir; +#endif static struct arm_smmu_device * __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
Greg Kroah-Hartman
maintainerPATCH 11/146 netkit: Add option for scrubbing skb meta data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit 83134ef4609388f6b9ca31a384f531155196c2a7 upstream.
Jordan reported that when running Cilium with netkit in per-endpoint-routes mode, network policy misclassifies traffic. In this direct routing mode of Cilium which is used in case of GKE/EKS/AKS, the Pod's BPF program to enforce policy sits on the netkit primary device's egress side.
The issue here is that in case of netkit's netkit_prep_forward(), it will clear meta data such as skb->mark and skb->priority before executing the BPF program. Thus, identity data stored in there from earlier BPF programs (e.g. from tcx ingress on the physical device) gets cleared instead of being made available for the primary's program to process. While for traffic egressing the Pod via the peer device this might be desired, this is different for the primary one where compared to tcx egress on the host veth this information would be available.
To address this, add a new parameter for the device orchestration to allow control of skb->mark and skb->priority scrubbing, to make the two accessible from BPF (and eventually leave it up to the program to scrub). By default, the current behavior is retained. For netkit peer this also enables the use case where applications could cooperate/signal intent to the BPF program.
Note that struct netkit has a 4 byte hole between policy and bundle which is used here, in other words, struct netkit's first cacheline content used in fast-path does not get moved around.
--- drivers/net/netkit.c | 68 ++++++++++++++++++++++++++++++++++--------- include/uapi/linux/if_link.h | 15 +++++++++ 2 files changed, 70 insertions(+), 13 deletions(-)
drivers/net/netkit.c +55 -13
@@ -20,6 +20,7 @@ struct netkit {struct net_device __rcu *peer;struct bpf_mprog_entry __rcu *active;enum netkit_action policy; +enum netkit_scrub scrub;struct bpf_mprog_bundle bundle;/* Needed in slow-path */
@@ -50,12 +51,24 @@ netkit_run(const struct bpf_mprog_entryreturn ret; } -static void netkit_prep_forward (struct sk_buff *skb,bool xnet) +static void netkit_xnet (struct sk_buff *skb) { -skb_scrub_packet (skb, xnet); skb->priority =0 ; + skb->mark =0 ; +} + +static void netkit_prep_forward (struct sk_buff *skb, +bool xnet,bool xnet_scrub) +{ +skb_scrub_packet (skb, false);nf_skip_egress (skb, true);skb_reset_mac_header (skb); +if (!xnet) +return ; +ipvs_reset (skb); +skb_clear_tstamp (skb); +if (xnet_scrub) +netkit_xnet (skb); }static struct netkit *netkit_priv (const struct net_device *dev)
@@ -80,7 +93,8 @@ static netdev_tx_t netkit_xmit(struct sk !pskb_may_pull(skb, ETH_HLEN) || skb_orphan_frags(skb, GFP_ATOMIC))) goto drop; -netkit_prep_forward (skb, !net_eq (dev_net (dev),dev_net (peer))); +netkit_prep_forward (skb, !net_eq (dev_net (dev),dev_net (peer)), + nk->scrub);eth_skb_pkt_type (skb, peer); skb->dev = peer; entry =rcu_dereference (nk->active);
@@ -332,8 +346,10 @@ static int netkit_new_link(struct net *s struct netlink_ext_ack *extack) {struct nlattr *peer_tb[IFLA_MAX +1 ], **tbp = tb, *attr; -enum netkit_action default_prim =NETKIT_PASS ; -enum netkit_action default_peer =NETKIT_PASS ; +enum netkit_action policy_prim =NETKIT_PASS ; +enum netkit_action policy_peer =NETKIT_PASS ; +enum netkit_scrub scrub_prim =NETKIT_SCRUB_DEFAULT ; +enum netkit_scrub scrub_peer =NETKIT_SCRUB_DEFAULT ;enum netkit_mode mode =NETKIT_L3 ;unsigned char ifname_assign_type;struct ifinfomsg *ifmp =NULL ;
@@ -362,17 +378,21 @@ static int netkit_new_link(struct net *sreturn err; tbp = peer_tb; } +if (data[IFLA_NETKIT_SCRUB ]) + scrub_prim =nla_get_u32 (data[IFLA_NETKIT_SCRUB ]); +if (data[IFLA_NETKIT_PEER_SCRUB ]) + scrub_peer =nla_get_u32 (data[IFLA_NETKIT_PEER_SCRUB ]);if (data[IFLA_NETKIT_POLICY ]) { attr = data[IFLA_NETKIT_POLICY ]; - default_prim =nla_get_u32 (attr); - err =netkit_check_policy (default_prim, attr, extack); + policy_prim =nla_get_u32 (attr); + err =netkit_check_policy (policy_prim, attr, extack);if (err <0 )return err; }if (data[IFLA_NETKIT_PEER_POLICY ]) { attr = data[IFLA_NETKIT_PEER_POLICY ]; - default_peer =nla_get_u32 (attr); - err =netkit_check_policy (default_peer, attr, extack); + policy_peer =nla_get_u32 (attr); + err =netkit_check_policy (policy_peer, attr, extack);if (err <0 )return err; }
@@ -409,7 +429,8 @@ static int netkit_new_link(struct net *s nk =netkit_priv (peer); nk->primary = false; - nk->policy = default_peer; + nk->policy = policy_peer; + nk->scrub = scrub_peer; nk->mode = mode;bpf_mprog_bundle_init (&nk->bundle);
@@ -434,7 +455,8 @@ static int netkit_new_link(struct net *s nk =netkit_priv (dev); nk->primary = true; - nk->policy = default_prim; + nk->policy = policy_prim; + nk->scrub = scrub_prim; nk->mode = mode;bpf_mprog_bundle_init (&nk->bundle);
@@ -874,6 +896,18 @@ static int netkit_change_link(struct netreturn -EACCES ; } +if (data[IFLA_NETKIT_SCRUB ]) { +NL_SET_ERR_MSG_ATTR (extack, data[IFLA_NETKIT_SCRUB ], +"netkit scrubbing cannot be changed after device creation" ); +return -EACCES ; + } + +if (data[IFLA_NETKIT_PEER_SCRUB ]) { +NL_SET_ERR_MSG_ATTR (extack, data[IFLA_NETKIT_PEER_SCRUB ], +"netkit scrubbing cannot be changed after device creation" ); +return -EACCES ; + } +if (data[IFLA_NETKIT_PEER_INFO ]) {NL_SET_ERR_MSG_ATTR (extack, data[IFLA_NETKIT_PEER_INFO ],"netkit peer info cannot be changed after device creation" );
@@ -908,8 +942,10 @@ static size_t netkit_get_size(const stru {return nla_total_size (sizeof (u32)) +/* IFLA_NETKIT_POLICY */ nla_total_size (sizeof (u32)) +/* IFLA_NETKIT_PEER_POLICY */ -nla_total_size (sizeof (u8)) +/* IFLA_NETKIT_PRIMARY */ +nla_total_size (sizeof (u32)) +/* IFLA_NETKIT_SCRUB */ +nla_total_size (sizeof (u32)) +/* IFLA_NETKIT_PEER_SCRUB */ nla_total_size (sizeof (u32)) +/* IFLA_NETKIT_MODE */ +nla_total_size (sizeof (u8)) +/* IFLA_NETKIT_PRIMARY */ 0 ; }
@@ -924,11 +960,15 @@ static int netkit_fill_info(struct sk_bureturn -EMSGSIZE ;if (nla_put_u32 (skb,IFLA_NETKIT_MODE , nk->mode))return -EMSGSIZE ; +if (nla_put_u32 (skb,IFLA_NETKIT_SCRUB , nk->scrub)) +return -EMSGSIZE ;if (peer) { nk =netkit_priv (peer);if (nla_put_u32 (skb,IFLA_NETKIT_PEER_POLICY , nk->policy))return -EMSGSIZE ; +if (nla_put_u32 (skb,IFLA_NETKIT_PEER_SCRUB , nk->scrub)) +return -EMSGSIZE ; }return 0 ;
@@ -936,9 +976,11 @@ static int netkit_fill_info(struct sk_bustatic const struct nla_policy netkit_policy[IFLA_NETKIT_MAX +1 ] = { [IFLA_NETKIT_PEER_INFO ] = { .len =sizeof (struct ifinfomsg ) }, - [IFLA_NETKIT_POLICY ] = { .type =NLA_U32 }, [IFLA_NETKIT_MODE ] = { .type =NLA_U32 }, + [IFLA_NETKIT_POLICY ] = { .type =NLA_U32 }, [IFLA_NETKIT_PEER_POLICY ] = { .type =NLA_U32 }, + [IFLA_NETKIT_SCRUB ] =NLA_POLICY_MAX (NLA_U32 ,NETKIT_SCRUB_DEFAULT ), + [IFLA_NETKIT_PEER_SCRUB ] =NLA_POLICY_MAX (NLA_U32 ,NETKIT_SCRUB_DEFAULT ), [IFLA_NETKIT_PRIMARY ] = { .type =NLA_REJECT , .reject_message ="Primary attribute is read-only" }, };
include/uapi/linux/if_link.h +15 -0
@@ -1292,6 +1292,19 @@ enum netkit_mode { NETKIT_L3, }; +/* NETKIT_SCRUB_NONE leaves clearing skb->{mark,priority} up to +* the BPF program if attached. This also means the latter can +* consume the two fields if they were populated earlier. +* +* NETKIT_SCRUB_DEFAULT zeroes skb->{mark,priority} fields before +* invoking the attached BPF program when the peer device resides +* in a different network namespace. This is the default behavior. +*/ +enum netkit_scrub { +NETKIT_SCRUB_NONE , +NETKIT_SCRUB_DEFAULT , +}; +enum {IFLA_NETKIT_UNSPEC ,IFLA_NETKIT_PEER_INFO ,
@@ -1299,6 +1312,8 @@ enum {IFLA_NETKIT_POLICY ,IFLA_NETKIT_PEER_POLICY ,IFLA_NETKIT_MODE , +IFLA_NETKIT_SCRUB , +IFLA_NETKIT_PEER_SCRUB , __IFLA_NETKIT_MAX, };#define IFLA_NETKIT_MAX (__IFLA_NETKIT_MAX - 1)
Greg Kroah-Hartman
maintainerPATCH 12/146 md/raid5: Wait sync io to finish before changing group cnt
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Ni <[email protected]>
commit fa1944bbe6220eb929e2c02e5e8706b908565711 upstream.
One customer reports a bug: raid5 is hung when changing thread cnt while resync is running. The stripes are all in conf->handle_list and new threads can't handle them.
Commit b39f35ebe86d ("md: don't quiesce in mddev_suspend()") removes pers->quiesce from mddev_suspend/resume. Before this patch, mddev_suspend needs to wait for all ios including sync io to finish. Now it's used to only wait normal io.
Fix this by calling raid5_quiesce from raid5_store_group_thread_cnt directly to wait all sync requests to finish before changing the group cnt.
--- drivers/md/raid5.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/md/raid5.c +4 -0
@@ -7177,6 +7177,8 @@ raid5_store_group_thread_cnt(struct mdde err =mddev_suspend_and_lock (mddev);if (err)return err; +raid5_quiesce (mddev, true); + conf = mddev->private;if (!conf) err = -ENODEV ;
@@ -7198,6 +7200,8 @@ raid5_store_group_thread_cnt(struct mddekfree (old_groups); } } + +raid5_quiesce (mddev, false);mddev_unlock_and_resume (mddev);return err ?: len;
Greg Kroah-Hartman
maintainerPATCH 13/146 md/md-bitmap: Add missing destroy_work_on_stack()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
commit 6012169e8aae9c0eda38bbedcd7a1540a81220ae upstream.
This commit add missed destroy_work_on_stack() operations for unplug_work.work in bitmap_unplug_async().
--- drivers/md/md-bitmap.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/md-bitmap.c +1 -0
@@ -1285,6 +1285,7 @@ static void bitmap_unplug_async(struct bqueue_work (md_bitmap_wq, &unplug_work.work);wait_for_completion (&done); +destroy_work_on_stack (&unplug_work.work); }static void bitmap_unplug (struct mddev *mddev,bool sync)
Greg Kroah-Hartman
maintainerPATCH 14/146 arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
commit 2496b2aaacf137250f4ca449f465e2cadaabb0e8 upstream.
The way InvenSense MPU-6050 accelerometer is mounted on the user-facing side of the Pine64 PinePhone mainboard, which makes it rotated 90 degrees counter- clockwise, [1] requires the accelerometer's x- and y-axis to be swapped, and the direction of the accelerometer's y-axis to be inverted.
Rectify this by adding a mount-matrix to the accelerometer definition in the Pine64 PinePhone dtsi file.
--- arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi +3 -0
@@ -212,6 +212,9 @@ interrupts = <7 5 IRQ_TYPE_EDGE_RISING>; /* PH5 */ vdd-supply = <®_dldo1>; vddio-supply = <®_dldo1>; + mount-matrix = "0", "1", "0", + "-1", "0", "0", + "0", "0", "1"; }; };
Greg Kroah-Hartman
maintainerPATCH 15/146 arm64: dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spread
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
commit 2f1aab0cb0661d533f008e4975325080351cdfc8 upstream.
The GPU SRAM supply is supposed to be always at least 0.1V higher than the GPU supply. However when the DT was upstreamed, the spread was incorrectly set to 0.01V.
--- arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi +2 -2
@@ -1336,7 +1336,7 @@ mt6366_vgpu_reg: vgpu { regulator-allowed-modes = <MT6397_BUCK_MODE_AUTO MT6397_BUCK_MODE_FORCE_PWM>; regulator-coupled-with = <&mt6366_vsram_gpu_reg>; - regulator-coupled-max-spread = <10000>; + regulator-coupled-max-spread = <100000>; }; mt6366_vproc11_reg: vproc11 {
@@ -1545,7 +1545,7 @@ mt6366_vsram_gpu_reg: vsram-gpu { regulator-ramp-delay = <6250>; regulator-enable-ramp-delay = <240>; regulator-coupled-with = <&mt6366_vgpu_reg>; - regulator-coupled-max-spread = <10000>; + regulator-coupled-max-spread = <100000>; }; mt6366_vsram_others_reg: vsram-others {
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 16/146 arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit 0ca7699c376743b633b6419a42888dba386d5351 upstream.
The power switch used to power the SD card interface might have more than 2ms turn-on time, increase the startup delay to 20ms to prevent failures.
--- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +1 -1
@@ -162,7 +162,7 @@ regulator-max-microvolt = <3300000>; regulator-min-microvolt = <3300000>; regulator-name = "+V3.3_SD"; - startup-delay-us = <2000>; + startup-delay-us = <20000>; }; reserved-memory {
Greg Kroah-Hartman
maintainerPATCH 17/146 arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit 2213ca51998fef61d3df4ca156054cdcc37c42b8 upstream.
The power switch used to power the SD card interface might have more than 2ms turn-on time, increase the startup delay to 20ms to prevent failures.
--- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi +1 -1
@@ -160,7 +160,7 @@ regulator-max-microvolt = <3300000>; regulator-min-microvolt = <3300000>; regulator-name = "+V3.3_SD"; - startup-delay-us = <2000>; + startup-delay-us = <20000>; }; reg_sdhc1_vqmmc: regulator-sdhci1-vqmmc {
Greg Kroah-Hartman
maintainerPATCH 18/146 arm64: dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarity
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
commit fbcc95fceb6d179dd150df2dc613dfd9b013052c upstream.
The reset line of the IT6505 bridge chip is active low, not active high. It was incorrectly inverted in the device tree as the implementation at the time incorrectly inverted the polarity in its driver, due to a prior device having an inline inverting level shifter.
Fix the polarity now while the external display pipeline is incomplete, thereby avoiding any impact to running systems.
A matching fix for the driver should be included if this change is backported.
--- arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi +1 -1
@@ -423,7 +423,7 @@ #sound-dai-cells = <0>; ovdd-supply = <&mt6366_vsim2_reg>; pwr18-supply = <&pp1800_dpbrdg_dx>; - reset-gpios = <&pio 177 GPIO_ACTIVE_HIGH>; + reset-gpios = <&pio 177 GPIO_ACTIVE_LOW>; ports { #address-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 19/146 media: qcom: camss: fix error path on configuration of power domains
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit 4f45d65b781499d2a79eca12155532739c876aa2 upstream.
There is a chance to meet runtime issues during configuration of CAMSS power domains, because on the error path dev_pm_domain_detach() is unexpectedly called with NULL or error pointer.
One of the simplest ways to reproduce the problem is to probe CAMSS driver before registration of CAMSS power domains, for instance if a platform CAMCC driver is simply not built.
Warning backtrace example:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a2
<snip>
pc : dev_pm_domain_detach+0x8/0x48
lr : camss_probe+0x374/0x9c0
<snip>
Call trace:
dev_pm_domain_detach+0x8/0x48
platform_probe+0x70/0xf0
really_probe+0xc4/0x2a8
__driver_probe_device+0x80/0x140
driver_probe_device+0x48/0x170
__device_attach_driver+0xc0/0x148
bus_for_each_drv+0x88/0xf0
__device_attach+0xb0/0x1c0
device_initial_probe+0x1c/0x30
bus_probe_device+0xb4/0xc0
deferred_probe_work_func+0x90/0xd0
process_one_work+0x164/0x3e0
worker_thread+0x310/0x420
kthread+0x120/0x130
ret_from_fork+0x10/0x20--- drivers/media/platform/qcom/camss/camss.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)
drivers/media/platform/qcom/camss/camss.c +8 -11
@@ -2130,10 +2130,8 @@ static int camss_configure_pd(struct camif (camss->res->pd_name) { camss->genpd =dev_pm_domain_attach_by_name (camss->dev, camss->res->pd_name); -if (IS_ERR (camss->genpd)) { - ret =PTR_ERR (camss->genpd); - goto fail_pm; - } +if (IS_ERR (camss->genpd)) +return PTR_ERR (camss->genpd); }if (!camss->genpd) {
@@ -2143,14 +2141,13 @@ static int camss_configure_pd(struct cam*/ camss->genpd =dev_pm_domain_attach_by_id (camss->dev, camss->genpd_num -1 ); +if (IS_ERR (camss->genpd)) +return PTR_ERR (camss->genpd); } -if (IS_ERR_OR_NULL (camss->genpd)) { -if (!camss->genpd) - ret = -ENODEV ; -else - ret =PTR_ERR (camss->genpd); - goto fail_pm; - } + +if (!camss->genpd) +return -ENODEV ; + camss->genpd_link =device_link_add (camss->dev, camss->genpd,DL_FLAG_STATELESS |DL_FLAG_PM_RUNTIME |DL_FLAG_RPM_ACTIVE );
Greg Kroah-Hartman
maintainerPATCH 20/146 media: amphion: Set video drvdata before register video device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit 8cbb1a7bd5973b57898b26eb804fe44af440bb63 upstream.
The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() file ops, and led to oops.
--- drivers/media/platform/amphion/vpu_v4l2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/amphion/vpu_v4l2.c +1 -1
@@ -841,6 +841,7 @@ int vpu_add_func(struct vpu_dev *vpu, st vfd->fops =vdec_get_fops (); vfd->ioctl_ops =vdec_get_ioctl_ops (); } +video_set_drvdata (vfd, vpu); ret =video_register_device (vfd,VFL_TYPE_VIDEO ,-1 );if (ret) {
@@ -848,7 +849,6 @@ int vpu_add_func(struct vpu_dev *vpu, stv4l2_m2m_release (func->m2m_dev);return ret; } -video_set_drvdata (vfd, vpu); func->vfd = vfd; ret =v4l2_m2m_register_media_controller (func->m2m_dev, func->vfd, func->function);
Greg Kroah-Hartman
maintainerPATCH 21/146 media: imx-jpeg: Set video drvdata before register video device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit d2b7ecc26bd5406d5ba927be1748aa99c568696c upstream.
The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() file ops, and led to oops.
--- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +1 -1
@@ -2842,6 +2842,7 @@ static int mxc_jpeg_probe(struct platfor jpeg->dec_vdev->vfl_dir =VFL_DIR_M2M ; jpeg->dec_vdev->device_caps =V4L2_CAP_STREAMING |V4L2_CAP_VIDEO_M2M_MPLANE ; +video_set_drvdata (jpeg->dec_vdev, jpeg);if (mode ==MXC_JPEG_ENCODE ) {v4l2_disable_ioctl (jpeg->dec_vdev,VIDIOC_DECODER_CMD );v4l2_disable_ioctl (jpeg->dec_vdev,VIDIOC_TRY_DECODER_CMD );
@@ -2854,7 +2855,6 @@ static int mxc_jpeg_probe(struct platfordev_err (dev,"failed to register video device\n" ); goto err_vdev_register; } -video_set_drvdata (jpeg->dec_vdev, jpeg);if (mode ==MXC_JPEG_ENCODE ) v4l2_info(&jpeg->v4l2_dev, "encoder device registered as /dev/video%d (%d,%d)\n",
Greg Kroah-Hartman
maintainerPATCH 22/146 media: mtk-jpeg: Fix null-ptr-deref during unload module
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <[email protected]>
commit 17af2b39daf12870cac61ffc360e62bc35798afb upstream.
The workqueue should be destroyed in mtk_jpeg_core.c since commit 09aea13ecf6f ("media: mtk-jpeg: refactor some variables"), otherwise the below calltrace can be easily triggered.
[ 677.862514] Unable to handle kernel paging request at virtual address dfff800000000023 [ 677.863633] KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] ... [ 677.879654] CPU: 6 PID: 1071 Comm: modprobe Tainted: G O 6.8.12-mtk+gfa1a78e5d24b+ #17 ... [ 677.882838] pc : destroy_workqueue+0x3c/0x770 [ 677.883413] lr : mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw] [ 677.884314] sp : ffff80008ad974f0 [ 677.884744] x29: ffff80008ad974f0 x28: ffff0000d7115580 x27: ffff0000dd691070 [ 677.885669] x26: ffff0000dd691408 x25: ffff8000844af3e0 x24: ffff80008ad97690 [ 677.886592] x23: ffff0000e051d400 x22: ffff0000dd691010 x21: dfff800000000000 [ 677.887515] x20: 0000000000000000 x19: 0000000000000000 x18: ffff800085397ac0 [ 677.888438] x17: 0000000000000000 x16: ffff8000801b87c8 x15: 1ffff000115b2e10 [ 677.889361] x14: 00000000f1f1f1f1 x13: 0000000000000000 x12: ffff7000115b2e4d [ 677.890285] x11: 1ffff000115b2e4c x10: ffff7000115b2e4c x9 : ffff80000aa43e90 [ 677.891208] x8 : 00008fffeea4d1b4 x7 : ffff80008ad97267 x6 : 0000000000000001 [ 677.892131] x5 : ffff80008ad97260 x4 : ffff7000115b2e4d x3 : 0000000000000000 [ 677.893054] x2 : 0000000000000023 x1 : dfff800000000000 x0 : 0000000000000118 [ 677.893977] Call trace: [ 677.894297] destroy_workqueue+0x3c/0x770 [ 677.894826] mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw] [ 677.895677] devm_action_release+0x50/0x90 [ 677.896211] release_nodes+0xe8/0x170 [ 677.896688] devres_release_all+0xf8/0x178 [ 677.897219] device_unbind_cleanup+0x24/0x170 [ 677.897785] device_release_driver_internal+0x35c/0x480 [ 677.898461] device_release_driver+0x20/0x38 ... [ 677.912665] ---[ end trace 0000000000000000 ]---
--- drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 10 ++++++++++ drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 11 ----------- 2 files changed, 10 insertions(+), 11 deletions(-)
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +10 -0
@@ -1293,6 +1293,11 @@ static int mtk_jpeg_single_core_init(strreturn 0 ; } +static void mtk_jpeg_destroy_workqueue (void *data) +{ +destroy_workqueue (data); +} +static int mtk_jpeg_probe (struct platform_device *pdev) {struct mtk_jpeg_dev *jpeg;
@@ -1337,6 +1342,11 @@ static int mtk_jpeg_probe(struct platfor | WQ_FREEZABLE);if (!jpeg->workqueue)return -EINVAL ; + ret =devm_add_action_or_reset (&pdev->dev, + mtk_jpeg_destroy_workqueue, + jpeg->workqueue); +if (ret) +return ret; } ret =v4l2_device_register (&pdev->dev, &jpeg->v4l2_dev);
drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c +0 -11
@@ -578,11 +578,6 @@ static int mtk_jpegdec_hw_init_irq(strucreturn 0 ; } -static void mtk_jpegdec_destroy_workqueue (void *data) -{ -destroy_workqueue (data); -} -static int mtk_jpegdec_hw_probe (struct platform_device *pdev) {struct mtk_jpegdec_clk *jpegdec_clk;
@@ -606,12 +601,6 @@ static int mtk_jpegdec_hw_probe(struct p dev->plat_dev = pdev; dev->dev = &pdev->dev; - ret =devm_add_action_or_reset (&pdev->dev, - mtk_jpegdec_destroy_workqueue, - master_dev->workqueue); -if (ret) -return ret; -spin_lock_init (&dev->hw_lock); dev->hw_state =MTK_JPEG_HW_IDLE ;
Greg Kroah-Hartman
maintainerPATCH 23/146 media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit d6594d50761728d09f23238cf9c368bab6260ef3 upstream.
It is not valid to call pm_runtime_set_suspended() and pm_runtime_set_active() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, adjust the order to fix it.
--- drivers/media/i2c/dw9768.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/media/i2c/dw9768.c +5 -5
@@ -471,10 +471,9 @@ static int dw9768_probe(struct i2c_clien* to be powered on in an ACPI system. Similarly for power off in * remove. */ -pm_runtime_enable (dev); full_power = (is_acpi_node (dev_fwnode (dev)) &&acpi_dev_state_d0 (dev)) || - (is_of_node (dev_fwnode (dev)) && !pm_runtime_enabled (dev)); + (is_of_node (dev_fwnode (dev)) && !IS_ENABLED (CONFIG_PM ));if (full_power) { ret =dw9768_runtime_resume (dev);if (ret <0 ) {
@@ -484,6 +483,7 @@ static int dw9768_probe(struct i2c_clienpm_runtime_set_active (dev); } +pm_runtime_enable (dev); ret =v4l2_async_register_subdev (&dw9768->sd);if (ret <0 ) {dev_err (dev,"failed to register V4L2 subdev: %d" , ret);
@@ -495,12 +495,12 @@ static int dw9768_probe(struct i2c_clienreturn 0 ; err_power_off: +pm_runtime_disable (dev);if (full_power) {dw9768_runtime_suspend (dev);pm_runtime_set_suspended (dev); } err_clean_entity: -pm_runtime_disable (dev);media_entity_cleanup (&dw9768->sd.entity); err_free_handler:v4l2_ctrl_handler_free (&dw9768->ctrls);
@@ -517,12 +517,12 @@ static void dw9768_remove(struct i2c_cliv4l2_async_unregister_subdev (&dw9768->sd);v4l2_ctrl_handler_free (&dw9768->ctrls);media_entity_cleanup (&dw9768->sd.entity); +pm_runtime_disable (dev);if ((is_acpi_node (dev_fwnode (dev)) &&acpi_dev_state_d0 (dev)) || - (is_of_node (dev_fwnode (dev)) && !pm_runtime_enabled (dev))) { + (is_of_node (dev_fwnode (dev)) && !IS_ENABLED (CONFIG_PM ))) {dw9768_runtime_suspend (dev);pm_runtime_set_suspended (dev); } -pm_runtime_disable (dev); }static const struct of_device_id dw9768_of_table[] = {
Greg Kroah-Hartman
maintainerPATCH 24/146 arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit 6c5789c9d2c06968532243daa235f6ff809ad71e upstream.
The power switch used to power the SD card interface might have more than 2ms turn-on time, increase the startup delay to 20ms to prevent failures.
--- arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi +1 -1
@@ -175,7 +175,7 @@ regulator-max-microvolt = <3300000>; regulator-min-microvolt = <3300000>; regulator-name = "+V3.3_SD"; - startup-delay-us = <2000>; + startup-delay-us = <20000>; }; reserved-memory {
Greg Kroah-Hartman
maintainerPATCH 25/146 media: i2c: tc358743: Fix crash in the probe error path when using polling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <[email protected]>
commit 869f38ae07f7df829da4951c3d1f7a2be09c2e9a upstream.
If an error occurs in the probe() function, we should remove the polling timer that was alarmed earlier, otherwise the timer is called with arguments that are already freed, which results in a crash.
------------[ cut here ]------------ WARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268 Modules linked in: CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226 Hardware name: Diasom DS-RK3568-SOM-EVB (DT) pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __run_timers+0x244/0x268 lr : __run_timers+0x1d4/0x268
sp : ffffff80eff2baf0
x29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00
x26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00
x23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000
x20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff
x17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e
x14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000
x11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009 x8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480 x5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240 x2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0
Call trace: __run_timers+0x244/0x268 timer_expire_remote+0x50/0x68 tmigr_handle_remote+0x388/0x39c run_timer_softirq+0x38/0x44 handle_softirqs+0x138/0x298 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x1c call_on_irq_stack+0x24/0x4c do_softirq_own_stack+0x1c/0x2c irq_exit_rcu+0x9c/0xcc el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x7c/0x80 default_idle_call+0x34/0x68 do_idle+0x23c/0x294 cpu_startup_entry+0x38/0x3c secondary_start_kernel+0x128/0x160 __secondary_switched+0xb8/0xbc ---[ end trace 0000000000000000 ]---
--- drivers/media/i2c/tc358743.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/i2c/tc358743.c +3 -1
@@ -2168,8 +2168,10 @@ static int tc358743_probe(struct i2c_cli err_work_queues:cec_unregister_adapter (state->cec_adap); -if (!state->i2c_client->irq) +if (!state->i2c_client->irq) { +del_timer (&state->timer);flush_work (&state->work_i2c_poll); + }cancel_delayed_work (&state->delayed_work_enable_hotplug);mutex_destroy (&state->confctl_mutex); err_hdl:
Greg Kroah-Hartman
maintainerPATCH 26/146 media: imx-jpeg: Ensure power suppliers be suspended before detach them
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit fd0af4cd35da0eb550ef682b71cda70a4e36f6b9 upstream.
The power suppliers are always requested to suspend asynchronously, dev_pm_domain_detach() requires the caller to ensure proper synchronization of this function with power management callbacks. otherwise the detach may led to kernel panic, like below:
[ 1457.107934] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040 [ 1457.116777] Mem abort info: [ 1457.119589] ESR = 0x0000000096000004 [ 1457.123358] EC = 0x25: DABT (current EL), IL = 32 bits [ 1457.128692] SET = 0, FnV = 0 [ 1457.131764] EA = 0, S1PTW = 0 [ 1457.134920] FSC = 0x04: level 0 translation fault [ 1457.139812] Data abort info: [ 1457.142707] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 1457.148196] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1457.153256] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1457.158563] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001138b6000 [ 1457.165000] [0000000000000040] pgd=0000000000000000, p4d=0000000000000000 [ 1457.171792] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 1457.178045] Modules linked in: v4l2_jpeg wave6_vpu_ctrl(-) [last unloaded: mxc_jpeg_encdec] [ 1457.186383] CPU: 0 PID: 51938 Comm: kworker/0:3 Not tainted 6.6.36-gd23d64eea511 #66 [ 1457.194112] Hardware name: NXP i.MX95 19X19 board (DT) [ 1457.199236] Workqueue: pm pm_runtime_work [ 1457.203247] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1457.210188] pc : genpd_runtime_suspend+0x20/0x290 [ 1457.214886] lr : __rpm_callback+0x48/0x1d8 [ 1457.218968] sp : ffff80008250bc50 [ 1457.222270] x29: ffff80008250bc50 x28: 0000000000000000 x27: 0000000000000000 [ 1457.229394] x26: 0000000000000000 x25: 0000000000000008 x24: 00000000000f4240 [ 1457.236518] x23: 0000000000000000 x22: ffff00008590f0e4 x21: 0000000000000008 [ 1457.243642] x20: ffff80008099c434 x19: ffff00008590f000 x18: ffffffffffffffff [ 1457.250766] x17: 5300326563697665 x16: 645f676e696c6f6f x15: 63343a6d726f6674 [ 1457.257890] x14: 0000000000000004 x13: 00000000000003a4 x12: 0000000000000002 [ 1457.265014] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff80008250bbb0 [ 1457.272138] x8 : ffff000092937200 x7 : ffff0003fdf6af80 x6 : 0000000000000000 [ 1457.279262] x5 : 00000000410fd050 x4 : 0000000000200000 x3 : 0000000000000000 [ 1457.286386] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008590f000 [ 1457.293510] Call trace: [ 1457.295946] genpd_runtime_suspend+0x20/0x290 [ 1457.300296] __rpm_callback+0x48/0x1d8 [ 1457.304038] rpm_callback+0x6c/0x78 [ 1457.307515] rpm_suspend+0x10c/0x570 [ 1457.311077] pm_runtime_work+0xc4/0xc8 [ 1457.314813] process_one_work+0x138/0x248 [ 1457.318816] worker_thread+0x320/0x438 [ 1457.322552] kthread+0x110/0x114 [ 1457.325767] ret_from_fork+0x10/0x20
--- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +2 -0
@@ -2679,6 +2679,8 @@ static void mxc_jpeg_detach_pm_domains(sint i;for (i =0 ; i < jpeg->num_domains; i++) { +if (jpeg->pd_dev[i] && !pm_runtime_suspended (jpeg->pd_dev[i])) +pm_runtime_force_suspend (jpeg->pd_dev[i]);if (jpeg->pd_link[i] && !IS_ERR (jpeg->pd_link[i]))device_link_del (jpeg->pd_link[i]);if (jpeg->pd_dev[i] && !IS_ERR (jpeg->pd_dev[i]))
Greg Kroah-Hartman
maintainerPATCH 27/146 media: platform: rga: fix 32-bit DMA limitation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
commit 953c03d8cb41d08fe6994f5d94c4393ac9da2f13 upstream.
The destination buffer flags are assigned twice but source is not set in what looks like a copy+paste mistake. Assign the source queue flags so the 32-bit DMA limitation is handled consistently.
--- drivers/media/platform/rockchip/rga/rga.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/rockchip/rga/rga.c +1 -1
@@ -102,7 +102,7 @@ queue_init(void *priv, struct vb2_queue src_vq->drv_priv = ctx; src_vq->ops = &rga_qops; src_vq->mem_ops = &vb2_dma_sg_memops; - dst_vq->gfp_flags = __GFP_DMA32; + src_vq->gfp_flags = __GFP_DMA32; src_vq->buf_struct_size =sizeof (struct rga_vb_buffer ); src_vq->timestamp_flags =V4L2_BUF_FLAG_TIMESTAMP_COPY ; src_vq->lock = &ctx->rga->mutex;
Greg Kroah-Hartman
maintainerPATCH 28/146 media: verisilicon: av1: Fix reference video buffer pointer assignment
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gaignard <[email protected]>
commit 672f24ed6ebcd986688c6674a6d994a265fefc25 upstream.
Always get new destination buffer for reference frame because nothing garantees the one set previously is still valid or unused.
Fixes this chromium test suite:
https://chromium.googlesource.com/chromium/src/media/+/refs/heads/main/test/data/test-25fps.av1.ivf
--- drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c +1 -2
@@ -161,8 +161,7 @@ static int rockchip_vpu981_av1_dec_frame av1_dec->frame_refs[i].timestamp = timestamp; av1_dec->frame_refs[i].frame_type = frame->frame_type; av1_dec->frame_refs[i].order_hint = frame->order_hint; -if (!av1_dec->frame_refs[i].vb2_ref) - av1_dec->frame_refs[i].vb2_ref =hantro_get_dst_buf (ctx); + av1_dec->frame_refs[i].vb2_ref =hantro_get_dst_buf (ctx);for (j =0 ; j <V4L2_AV1_TOTAL_REFS_PER_FRAME ; j++) av1_dec->frame_refs[i].order_hints[j] = frame->order_hints[j];
Greg Kroah-Hartman
maintainerPATCH 29/146 media: ts2020: fix null-ptr-deref in ts2020_probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zetao <[email protected]>
commit 4a058b34b52ed3feb1f3ff6fd26aefeeeed20cba upstream.
KASAN reported a null-ptr-deref issue when executing the following command:
# echo ts2020 0x20 > /sys/bus/i2c/devices/i2c-0/new_device
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 53 UID: 0 PID: 970 Comm: systemd-udevd Not tainted 6.12.0-rc2+ #24
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
RIP: 0010:ts2020_probe+0xad/0xe10 [ts2020]
RSP: 0018:ffffc9000abbf598 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffffc0714809
RDX: 0000000000000002 RSI: ffff88811550be00 RDI: 0000000000000010
RBP: ffff888109868800 R08: 0000000000000001 R09: fffff52001577eb6
R10: 0000000000000000 R11: ffffc9000abbff50 R12: ffffffffc0714790
R13: 1ffff92001577eb8 R14: ffffffffc07190d0 R15: 0000000000000001
FS: 00007f95f13b98c0(0000) GS:ffff888149280000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555d2634b000 CR3: 0000000152236000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ts2020_probe+0xad/0xe10 [ts2020]
i2c_device_probe+0x421/0xb40
really_probe+0x266/0x850
...The cause of the problem is that when using sysfs to dynamically register an i2c device, there is no platform data, but the probe process of ts2020 needs to use platform data, resulting in a null pointer being accessed.
Solve this problem by adding checks to platform data.
--- drivers/media/dvb-frontends/ts2020.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/ts2020.c +7 -1
@@ -553,13 +553,19 @@ static void ts2020_regmap_unlock(void *_static int ts2020_probe (struct i2c_client *client) {struct ts2020_config *pdata = client->dev.platform_data; -struct dvb_frontend *fe = pdata->fe; +struct dvb_frontend *fe;struct ts2020_priv *dev;int ret;u8 u8tmp;unsigned int utmp;char *chip_str; +if (!pdata) { +dev_err (&client->dev,"platform data is mandatory\n" ); +return -EINVAL ; + } + + fe = pdata->fe; dev =kzalloc (sizeof (*dev),GFP_KERNEL );if (!dev) { ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 30/146 media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
commit 8964eb23408243ae0016d1f8473c76f64ff25d20 upstream.
In fimc_md_is_isp_available(), of_get_child_by_name() is called to check if FIMC-IS is available. Current code does not decrement the refcount of the returned device node, which causes an OF node reference leak. Fix it by calling of_node_put() at the end of the variable scope.
--- drivers/media/platform/samsung/exynos4-is/media-dev.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/platform/samsung/exynos4-is/media-dev.h +3 -2
@@ -178,8 +178,9 @@ int fimc_md_set_camclk(struct v4l2_subde#ifdef CONFIG_OF static inline bool fimc_md_is_isp_available (struct device_node *node) { - node =of_get_child_by_name (node,FIMC_IS_OF_NODE_NAME ); -return node ?of_device_is_available (node) : false; + struct device_node *child __free(device_node) = +of_get_child_by_name (node,FIMC_IS_OF_NODE_NAME ); +return child ?of_device_is_available (child) : false; }#else #define fimc_md_is_isp_available (node) (false)
Greg Kroah-Hartman
maintainerPATCH 31/146 efi/libstub: Free correct pointer on failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 06d39d79cbd5a91a33707951ebf2512d0e759847 upstream.
cmdline_ptr is an out parameter, which is not allocated by the function itself, and likely points into the caller's stack.
cmdline refers to the pool allocation that should be freed when cleaning up after a failure, so pass this instead to free_pool().
--- drivers/firmware/efi/libstub/efi-stub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/libstub/efi-stub.c +1 -1
@@ -149,7 +149,7 @@ efi_status_t efi_handle_cmdline(efi_loadreturn EFI_SUCCESS ; fail_free_cmdline: -efi_bs_call (free_pool, cmdline_ptr); +efi_bs_call (free_pool, cmdline);return status; }
Greg Kroah-Hartman
maintainerPATCH 32/146 net: phy: dp83869: fix status reporting for 1000base-x autonegotiation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Gantois <[email protected]>
commit 378e8feea9a70d37a5dc1678b7ec27df21099fa5 upstream.
The DP83869 PHY transceiver supports converting from RGMII to 1000base-x. In this operation mode, autonegotiation can be performed, as described in IEEE802.3.
The DP83869 has a set of fiber-specific registers located at offset 0xc00. When the transceiver is configured in RGMII-to-1000base-x mode, these registers are mapped onto offset 0, which should make reading the autonegotiation status transparent.
However, the fiber registers at offset 0xc04 and 0xc05 follow the bit layout specified in Clause 37, and genphy_read_status() assumes a Clause 22 layout. Thus, genphy_read_status() doesn't properly read the capabilities advertised by the link partner, resulting in incorrect link parameters.
Similarly, genphy_config_aneg() doesn't properly write advertised capabilities.
Fix the 1000base-x autonegotiation procedure by replacing genphy_read_status() and genphy_config_aneg() with their Clause 37 equivalents.
--- drivers/net/phy/dp83869.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
drivers/net/phy/dp83869.c +17 -3
@@ -153,19 +153,32 @@ struct dp83869_private {int mode; }; +static int dp83869_config_aneg (struct phy_device *phydev) +{ +struct dp83869_private *dp83869 = phydev->priv; + +if (dp83869->mode !=DP83869_RGMII_1000_BASE ) +return genphy_config_aneg (phydev); + +return genphy_c37_config_aneg (phydev); +} +static int dp83869_read_status (struct phy_device *phydev) {struct dp83869_private *dp83869 = phydev->priv; +bool changed;int ret; +if (dp83869->mode ==DP83869_RGMII_1000_BASE ) +return genphy_c37_read_status (phydev, &changed); + ret =genphy_read_status (phydev);if (ret)return ret; -if (linkmode_test_bit (ETHTOOL_LINK_MODE_FIBRE_BIT , phydev->supported)) { +if (dp83869->mode ==DP83869_RGMII_100_BASE ) {if (phydev->link) { -if (dp83869->mode ==DP83869_RGMII_100_BASE ) - phydev->speed =SPEED_100 ; + phydev->speed =SPEED_100 ; }else { phydev->speed =SPEED_UNKNOWN ; phydev->duplex =DUPLEX_UNKNOWN ;
@@ -898,6 +911,7 @@ static int dp83869_phy_reset(struct phy_ .soft_reset = dp83869_phy_reset, \ .config_intr = dp83869_config_intr, \ .handle_interrupt = dp83869_handle_interrupt, \ + .config_aneg = dp83869_config_aneg, \ .read_status = dp83869_read_status, \ .get_tunable = dp83869_get_tunable, \ .set_tunable = dp83869_set_tunable, \
Greg Kroah-Hartman
maintainerPATCH 33/146 media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 316e74500d1c6589cba28cebe2864a0bceeb2396 upstream.
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/media/platform/amphion/vpu_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/amphion/vpu_drv.c +1 -1
@@ -151,8 +151,8 @@ err_add_decoder:media_device_cleanup (&vpu->mdev);v4l2_device_unregister (&vpu->v4l2_dev); err_vpu_deinit: -pm_runtime_set_suspended (dev);pm_runtime_disable (dev); +pm_runtime_set_suspended (dev);return ret; }
Greg Kroah-Hartman
maintainerPATCH 34/146 media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 2a20869f7d798aa2b69e45b863eaf1b1ecf98278 upstream.
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/media/platform/qcom/venus/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/qcom/venus/core.c +1 -1
@@ -412,8 +412,8 @@ err_of_depopulate:of_platform_depopulate (dev); err_runtime_disable:pm_runtime_put_noidle (dev); -pm_runtime_set_suspended (dev);pm_runtime_disable (dev); +pm_runtime_set_suspended (dev);hfi_destroy (core); err_core_deinit:hfi_core_deinit (core, false);
Greg Kroah-Hartman
maintainerPATCH 35/146 media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit d2842dec577900031826dc44e9bf0c66416d7173 upstream.
In set_frame_rate(), select a rate in rate_0 or rate_1 by checking sd->frame_rate >= r->fps in a loop, but the loop condition terminates when the index reaches zero, which fails to check the last elememt in rate_0 or rate_1.
Check for >= 0 so that the last one in rate_0 or rate_1 is also checked.
--- drivers/media/usb/gspca/ov534.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/gspca/ov534.c +1 -1
@@ -847,7 +847,7 @@ static void set_frame_rate(struct gspca_ r = rate_1; i =ARRAY_SIZE (rate_1); } -while (--i >0 ) { +while (--i >=0 ) {if (sd->frame_rate >= r->fps)break ; r++;
Greg Kroah-Hartman
maintainerPATCH 36/146 media: ov08x40: Fix burst write sequence
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan O'Donoghue <[email protected]>
commit d0fef6de4f1b957e35a05a5ba4aab2a2576d6686 upstream.
It is necessary to account for I2C quirks in the burst mode path of this driver. Not all I2C controllers can accept arbitrarily long writes and this is represented in the quirks field of the adapter structure.
Prior to this patch the following error message is seen on a Qualcomm X1E80100 CRD.
[ 38.773524] i2c i2c-2: adapter quirk: msg too long (addr 0x0036, size 290, write) [ 38.781454] ov08x40 2-0036: Failed regs transferred: -95 [ 38.787076] ov08x40 2-0036: ov08x40_start_streaming failed to set regs
Fix the error by breaking up the write sequence into the advertised maximum write size of the quirks field if the quirks field is populated.
--- drivers/media/i2c/ov08x40.c | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-)
drivers/media/i2c/ov08x40.c +28 -5
@@ -1339,15 +1339,13 @@ static int ov08x40_read_reg(struct ov08xreturn 0 ; } -static int ov08x40_burst_fill_regs (struct ov08x40 *ov08x,u16 first_reg, -u16 last_reg,u8 val) +static int __ov08x40_burst_fill_regs (struct i2c_client *client,u16 first_reg, +u16 last_reg,size_t num_regs,u8 val) { -struct i2c_client *client =v4l2_get_subdevdata (&ov08x->sd);struct i2c_msg msgs; -size_t i, num_regs; +size_t i;int ret; - num_regs = last_reg - first_reg +1 ; msgs.addr = client->addr; msgs.flags =0 ; msgs.len =2 + num_regs;
@@ -1371,6 +1369,31 @@ static int ov08x40_burst_fill_regs(struc }return 0 ; +} + +static int ov08x40_burst_fill_regs (struct ov08x40 *ov08x,u16 first_reg, +u16 last_reg,u8 val) +{ +struct i2c_client *client =v4l2_get_subdevdata (&ov08x->sd); +size_t num_regs, num_write_regs; +int ret; + + num_regs = last_reg - first_reg +1 ; + num_write_regs = num_regs; + +if (client->adapter->quirks && client->adapter->quirks->max_write_len) + num_write_regs = client->adapter->quirks->max_write_len -2 ; + +while (first_reg < last_reg) { + ret =__ov08x40_burst_fill_regs (client, first_reg, last_reg, + num_write_regs, val); +if (ret) +return ret; + + first_reg += num_write_regs; + } + +return 0 ; }/* Write registers up to 4 at a time */
Greg Kroah-Hartman
maintainerPATCH 37/146 media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <[email protected]>
commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47 upstream.
The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here.
To mitigate this, free the buffer when allegro_alloc_buffer fails.
--- drivers/media/platform/allegro-dvt/allegro-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/allegro-dvt/allegro-core.c +3 -1
@@ -1509,8 +1509,10 @@ static int allocate_buffers_internal(strINIT_LIST_HEAD (&buffer->head); err =allegro_alloc_buffer (dev, buffer, size); -if (err) +if (err) { +kfree (buffer); goto err; + }list_add (&buffer->head, list); }
Greg Kroah-Hartman
maintainerPATCH 38/146 media: uvcvideo: Stop stream during unregister
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
commit c9ec6f1736363b2b2bb4e266997389740f628441 upstream.
uvc_unregister_video() can be called asynchronously from uvc_disconnect(). If the device is still streaming when that happens, a plethora of race conditions can occur.
Make sure that the device has stopped streaming before exiting this function.
If the user still holds handles to the driver's file descriptors, any ioctl will return -ENODEV from the v4l2 core.
This change makes uvc more consistent with the rest of the v4l2 drivers using the vb2_fop_* and vb2_ioctl_* helpers.
This driver (and many other usb drivers) always had this problem, but it wasn't possible to easily fix this until the vb2_video_unregister_device() helper was added. So the Fixes tag points to the creation of that helper.
--- drivers/media/usb/uvc/uvc_driver.c | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_driver.c +31 -1
@@ -1919,11 +1919,41 @@ static void uvc_unregister_video(structstruct uvc_streaming *stream;list_for_each_entry (stream, &dev->streams, list) { +/* Nothing to do here, continue. */ if (!video_is_registered (&stream->vdev))continue ; +/* +* For stream->vdev we follow the same logic as: +* vb2_video_unregister_device(). +*/ + +/* 1. Take a reference to vdev */ +get_device (&stream->vdev.dev); + +/* 2. Ensure that no new ioctls can be called. */ video_unregister_device (&stream->vdev); -video_unregister_device (&stream->meta.vdev); + +/* 3. Wait for old ioctls to finish. */ +mutex_lock (&stream->mutex); + +/* 4. Stop streaming. */ +uvc_queue_release (&stream->queue); + +mutex_unlock (&stream->mutex); + +put_device (&stream->vdev.dev); + +/* +* For stream->meta.vdev we can directly call: +* vb2_video_unregister_device(). +*/ +vb2_video_unregister_device (&stream->meta.vdev); + +/* +* Now both vdevs are not streaming and all the ioctls will +* return -ENODEV. +*/ uvc_debugfs_cleanup_stream (stream); }
Greg Kroah-Hartman
maintainerPATCH 39/146 media: uvcvideo: Require entities to have a non-zero unique ID
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit 3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195 upstream.
Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID.
``` Each Unit and Terminal within the video function is assigned a unique identification number, the Unit ID (UID) or Terminal ID (TID), contained in the bUnitID or bTerminalID field of the descriptor. The value 0x00 is reserved for undefined ID, ```
So, deny allocating an entity with ID 0 or an ID that belongs to a unit that is already added to the list of entities.
This also prevents some syzkaller reproducers from triggering warnings due to a chain of entities referring to themselves. In one particular case, an Output Unit is connected to an Input Unit, both with the same ID of 1. But when looking up for the source ID of the Output Unit, that same entity is found instead of the input entity, which leads to such warnings.
In another case, a backward chain was considered finished as the source ID was 0. Later on, that entity was found, but its pads were not valid.
Here is a sample stack trace for one of those cases.
[ 20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 20.830206] usb 1-1: Using ep0 maxpacket: 8 [ 20.833501] usb 1-1: config 0 descriptor?? [ 21.038518] usb 1-1: string descriptor 0 read error: -71 [ 21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201) [ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized! [ 21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized! [ 21.042218] ------------[ cut here ]------------ [ 21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0 [ 21.043195] Modules linked in: [ 21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444 [ 21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 21.044639] Workqueue: usb_hub_wq hub_event [ 21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0 [ 21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00 [ 21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246 [ 21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1 [ 21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290 [ 21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000 [ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003 [ 21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000 [ 21.049648] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000 [ 21.050271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0 [ 21.051136] PKRU: 55555554 [ 21.051331] Call Trace: [ 21.051480] <TASK> [ 21.051611] ? __warn+0xc4/0x210 [ 21.051861] ? media_create_pad_link+0x2c4/0x2e0 [ 21.052252] ? report_bug+0x11b/0x1a0 [ 21.052540] ? trace_hardirqs_on+0x31/0x40 [ 21.052901] ? handle_bug+0x3d/0x70 [ 21.053197] ? exc_invalid_op+0x1a/0x50 [ 21.053511] ? asm_exc_invalid_op+0x1a/0x20 [ 21.053924] ? media_create_pad_link+0x91/0x2e0 [ 21.054364] ? media_create_pad_link+0x2c4/0x2e0 [ 21.054834] ? media_create_pad_link+0x91/0x2e0 [ 21.055131] ? _raw_spin_unlock+0x1e/0x40 [ 21.055441] ? __v4l2_device_register_subdev+0x202/0x210 [ 21.055837] uvc_mc_register_entities+0x358/0x400 [ 21.056144] uvc_register_chains+0x1fd/0x290 [ 21.056413] uvc_probe+0x380e/0x3dc0 [ 21.056676] ? __lock_acquire+0x5aa/0x26e0 [ 21.056946] ? find_held_lock+0x33/0xa0 [ 21.057196] ? kernfs_activate+0x70/0x80 [ 21.057533] ? usb_match_dynamic_id+0x1b/0x70 [ 21.057811] ? find_held_lock+0x33/0xa0 [ 21.058047] ? usb_match_dynamic_id+0x55/0x70 [ 21.058330] ? lock_release+0x124/0x260 [ 21.058657] ? usb_match_one_id_intf+0xa2/0x100 [ 21.058997] usb_probe_interface+0x1ba/0x330 [ 21.059399] really_probe+0x1ba/0x4c0 [ 21.059662] __driver_probe_device+0xb2/0x180 [ 21.059944] driver_probe_device+0x5a/0x100 [ 21.060170] __device_attach_driver+0xe9/0x160 [ 21.060427] ? __pfx___device_attach_driver+0x10/0x10 [ 21.060872] bus_for_each_drv+0xa9/0x100 [ 21.061312] __device_attach+0xed/0x190 [ 21.061812] device_initial_probe+0xe/0x20 [ 21.062229] bus_probe_device+0x4d/0xd0 [ 21.062590] device_add+0x308/0x590 [ 21.062912] usb_set_configuration+0x7b6/0xaf0 [ 21.063403] usb_generic_driver_probe+0x36/0x80 [ 21.063714] usb_probe_device+0x7b/0x130 [ 21.063936] really_probe+0x1ba/0x4c0 [ 21.064111] __driver_probe_device+0xb2/0x180 [ 21.064577] driver_probe_device+0x5a/0x100 [ 21.065019] __device_attach_driver+0xe9/0x160 [ 21.065403] ? __pfx___device_attach_driver+0x10/0x10 [ 21.065820] bus_for_each_drv+0xa9/0x100 [ 21.066094] __device_attach+0xed/0x190 [ 21.066535] device_initial_probe+0xe/0x20 [ 21.066992] bus_probe_device+0x4d/0xd0 [ 21.067250] device_add+0x308/0x590 [ 21.067501] usb_new_device+0x347/0x610 [ 21.067817] hub_event+0x156b/0x1e30 [ 21.068060] ? process_scheduled_works+0x48b/0xaf0 [ 21.068337] process_scheduled_works+0x5a3/0xaf0 [ 21.068668] worker_thread+0x3cf/0x560 [ 21.068932] ? kthread+0x109/0x1b0 [ 21.069133] kthread+0x197/0x1b0 [ 21.069343] ? __pfx_worker_thread+0x10/0x10 [ 21.069598] ? __pfx_kthread+0x10/0x10 [ 21.069908] ret_from_fork+0x32/0x40 [ 21.070169] ? __pfx_kthread+0x10/0x10 [ 21.070424] ret_from_fork_asm+0x1a/0x30 [ 21.070737] </TASK>
--- drivers/media/usb/uvc/uvc_driver.c | 70 ++++++++++++++++++++++--------------- 1 file changed, 43 insertions(+), 27 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +43 -27
@@ -775,14 +775,27 @@ static const u8 uvc_media_transport_inpuUVC_GUID_UVC_MEDIA_TRANSPORT_INPUT ;static const u8 uvc_processing_guid[16 ] =UVC_GUID_UVC_PROCESSING ; -static struct uvc_entity *uvc_alloc_entity (u16 type,u16 id, -unsigned int num_pads,unsigned int extra_size) +static struct uvc_entity *uvc_alloc_new_entity (struct uvc_device *dev,u16 type, +u16 id,unsigned int num_pads, +unsigned int extra_size) {struct uvc_entity *entity;unsigned int num_inputs;unsigned int size;unsigned int i; +/* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */ +if (id ==0 ) { +dev_err (&dev->udev->dev,"Found Unit with invalid ID 0.\n" ); +return ERR_PTR (-EINVAL ); + } + +/* Per UVC 1.1+ spec 3.7.2, the ID is unique. */ +if (uvc_entity_by_id (dev, id)) { +dev_err (&dev->udev->dev,"Found multiple Units with ID %u\n" , id); +return ERR_PTR (-EINVAL ); + } + extra_size =roundup (extra_size,sizeof (*entity->pads));if (num_pads) num_inputs = type &UVC_TERM_OUTPUT ? num_pads : num_pads -1 ;
@@ -792,7 +805,7 @@ static struct uvc_entity *uvc_alloc_enti + num_inputs; entity =kzalloc (size,GFP_KERNEL );if (entity ==NULL ) -return NULL ; +return ERR_PTR (-ENOMEM ); entity->id = id; entity->type = type;
@@ -904,10 +917,10 @@ static int uvc_parse_vendor_control(strubreak ; } - unit =uvc_alloc_entity (UVC_VC_EXTENSION_UNIT , buffer[3 ], - p +1 ,2 *n); -if (unit ==NULL ) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev,UVC_VC_EXTENSION_UNIT , + buffer[3 ], p +1 ,2 * n); +if (IS_ERR (unit)) +return PTR_ERR (unit);memcpy (unit->guid, &buffer[4 ],16 ); unit->extension.bNumControls = buffer[20 ];
@@ -1016,10 +1029,10 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } - term =uvc_alloc_entity (type |UVC_TERM_INPUT , buffer[3 ], -1 , n + p); -if (term ==NULL ) -return -ENOMEM ; + term =uvc_alloc_new_entity (dev, type |UVC_TERM_INPUT , + buffer[3 ],1 , n + p); +if (IS_ERR (term)) +return PTR_ERR (term);if (UVC_ENTITY_TYPE (term) ==UVC_ITT_CAMERA ) { term->camera.bControlSize = n;
@@ -1075,10 +1088,10 @@ static int uvc_parse_standard_control(streturn 0 ; } - term =uvc_alloc_entity (type |UVC_TERM_OUTPUT , buffer[3 ], -1 ,0 ); -if (term ==NULL ) -return -ENOMEM ; + term =uvc_alloc_new_entity (dev, type |UVC_TERM_OUTPUT , + buffer[3 ],1 ,0 ); +if (IS_ERR (term)) +return PTR_ERR (term);memcpy (term->baSourceID, &buffer[7 ],1 );
@@ -1097,9 +1110,10 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } - unit =uvc_alloc_entity (buffer[2 ], buffer[3 ], p +1 ,0 ); -if (unit ==NULL ) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev, buffer[2 ], buffer[3 ], + p +1 ,0 ); +if (IS_ERR (unit)) +return PTR_ERR (unit);memcpy (unit->baSourceID, &buffer[5 ], p);
@@ -1119,9 +1133,9 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } - unit =uvc_alloc_entity (buffer[2 ], buffer[3 ],2 , n); -if (unit ==NULL ) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev, buffer[2 ], buffer[3 ],2 , n); +if (IS_ERR (unit)) +return PTR_ERR (unit);memcpy (unit->baSourceID, &buffer[4 ],1 ); unit->processing.wMaxMultiplier =
@@ -1148,9 +1162,10 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } - unit =uvc_alloc_entity (buffer[2 ], buffer[3 ], p +1 , n); -if (unit ==NULL ) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev, buffer[2 ], buffer[3 ], + p +1 , n); +if (IS_ERR (unit)) +return PTR_ERR (unit);memcpy (unit->guid, &buffer[4 ],16 ); unit->extension.bNumControls = buffer[20 ];
@@ -1290,9 +1305,10 @@ static int uvc_gpio_parse(struct uvc_devreturn dev_err_probe (&dev->udev->dev, irq,"No IRQ for privacy GPIO\n" ); - unit =uvc_alloc_entity (UVC_EXT_GPIO_UNIT ,UVC_EXT_GPIO_UNIT_ID ,0 ,1 ); -if (!unit) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev,UVC_EXT_GPIO_UNIT , +UVC_EXT_GPIO_UNIT_ID ,0 ,1 ); +if (IS_ERR (unit)) +return PTR_ERR (unit); unit->gpio.gpio_privacy = gpio_privacy; unit->gpio.irq = irq;
Greg Kroah-Hartman
maintainerPATCH 40/146 tracing: Fix function timing profiler to initialize hashtable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit c54a1a06daa78613519b4d24495b0d175b8af63f upstream.
Since the new fgraph requires to initialize fgraph_ops.ops.func_hash before calling register_ftrace_graph(), initialize it with default (tracing all functions) parameter.
--- kernel/trace/ftrace.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/trace/ftrace.c +4 -0
@@ -883,6 +883,10 @@ static void profile_graph_return(struct }static struct fgraph_ops fprofiler_ops = { + .ops = { + .flags =FTRACE_OPS_FL_INITIALIZED , +INIT_OPS_HASH (fprofiler_ops.ops) + }, .entryfunc = &profile_graph_entry, .retfunc = &profile_graph_return, };
Greg Kroah-Hartman
maintainerPATCH 41/146 kunit: Fix potential null dereference in kunit_device_driver_test()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zichen Xie <[email protected]>
commit 435c20eed572a95709b1536ff78832836b2f91b1 upstream.
kunit_kzalloc() may return a NULL pointer, dereferencing it without NULL check may lead to NULL dereference.
Add a NULL check for test_state.
--- lib/kunit/kunit-test.c | 2 ++ 1 file changed, 2 insertions(+)
lib/kunit/kunit-test.c +2 -0
@@ -805,6 +805,8 @@ static void kunit_device_driver_test(struct kunit *test)struct device *test_device;struct driver_test_state *test_state =kunit_kzalloc (test,sizeof (*test_state),GFP_KERNEL ); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, test_state); + test->priv = test_state; test_driver =kunit_driver_create (test,"my_driver" );
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 42/146 kunit: string-stream: Fix a UAF bug in kunit_init_suite()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 39e21403c978862846fa68b7f6d06f9cca235194 upstream.
In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the kunit_suite_for_each_test_case() loop, the "suite->log = stream" has assigned before, and the error path only free the suite->log's stream memory but not set it to NULL, so the later string_stream_clear() of suite->log in kunit_init_suite() will cause below UAF bug.
Set stream pointer to NULL after free to fix it.
Unable to handle kernel paging request at virtual address 006440150000030d Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [006440150000030d] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: iio_test_gts industrialio_gts_helper cfg80211 rfkill ipv6 [last unloaded: iio_test_gts] CPU: 5 UID: 0 PID: 6253 Comm: modprobe Tainted: G B W N 6.12.0-rc4+ #458 Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST Hardware name: linux,dummy-virt (DT) pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : string_stream_clear+0x54/0x1ac lr : string_stream_clear+0x1a8/0x1ac sp : ffffffc080b47410 x29: ffffffc080b47410 x28: 006440550000030d x27: ffffff80c96b5e98 x26: ffffff80c96b5e80 x25: ffffffe461b3f6c0 x24: 0000000000000003 x23: ffffff80c96b5e88 x22: 1ffffff019cdf4fc x21: dfffffc000000000 x20: ffffff80ce6fa7e0 x19: 032202a80000186d x18: 0000000000001840 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffe45c355cb4 x14: ffffffe45c35589c x13: ffffffe45c03da78 x12: ffffffb810168e75 x11: 1ffffff810168e74 x10: ffffffb810168e74 x9 : dfffffc000000000 x8 : 0000000000000004 x7 : 0000000000000003 x6 : 0000000000000001 x5 : ffffffc080b473a0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000001 x1 : ffffffe462fbf620 x0 : dfffffc000000000 Call trace: string_stream_clear+0x54/0x1ac __kunit_test_suites_init+0x108/0x1d8 kunit_exec_run_tests+0xb8/0x100 kunit_module_notify+0x400/0x55c notifier_call_chain+0xfc/0x3b4 blocking_notifier_call_chain+0x68/0x9c do_init_module+0x24c/0x5c8 load_module+0x4acc/0x4e90 init_module_from_file+0xd4/0x128 idempotent_init_module+0x2d4/0x57c __arm64_sys_finit_module+0xac/0x100 invoke_syscall+0x6c/0x258 el0_svc_common.constprop.0+0x160/0x22c do_el0_svc+0x44/0x5c el0_svc+0x48/0xb8 el0t_64_sync_handler+0x13c/0x158 el0t_64_sync+0x190/0x194 Code: f9400753 d2dff800 f2fbffe0 d343fe7c (38e06b80) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception
--- lib/kunit/debugfs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
lib/kunit/debugfs.c +4 -1
@@ -212,8 +212,11 @@ void kunit_debugfs_create_suite(struct k err:string_stream_destroy (suite->log); -kunit_suite_for_each_test_case (suite, test_case) + suite->log =NULL ; +kunit_suite_for_each_test_case (suite, test_case) {string_stream_destroy (test_case->log); + test_case->log =NULL ; + } }void kunit_debugfs_destroy_suite (struct kunit_suite *suite)
Greg Kroah-Hartman
maintainerPATCH 43/146 ovl: Filter invalid inodes with missing lookup function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit c8b359dddb418c60df1a69beea01d1b3322bfe83 upstream.
Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack.
--- fs/overlayfs/util.c | 3 +++ 1 file changed, 3 insertions(+)
fs/overlayfs/util.c +3 -0
@@ -197,6 +197,9 @@ void ovl_dentry_init_flags(struct dentrybool ovl_dentry_weird (struct dentry *dentry) { +if (!d_can_lookup (dentry) && !d_is_file (dentry) && !d_is_symlink (dentry)) +return true; + return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | DCACHE_MANAGE_TRANSIT | DCACHE_OP_HASH |
Greg Kroah-Hartman
maintainerPATCH 44/146 maple_tree: refine mas_store_root() on storing NULL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
commit 0ea120b278ad7f7cfeeb606e150ad04b192df60b upstream.
Currently, when storing NULL on mas_store_root(), the behavior could be improved.
Storing NULLs over the entire tree may result in a node being used to store a single range. Further stores of NULL may cause the node and tree to be corrupt and cause incorrect behaviour. Fixing the store to the root null fixes the issue by ensuring that a range of 0 - ULONG_MAX results in an empty tree.
Users of the tree may experience incorrect values returned if the tree was expanded to store values, then overwritten by all NULLS, then continued to store NULLs over the empty area.
For example possible cases are:
* store NULL at any range result a new node
* store NULL at range [m, n] where m > 0 to a single entry tree result a new node with range [m, n] set to NULL
* store NULL at range [m, n] where m > 0 to an empty tree result consecutive NULL slot
* it allows for multiple NULL entries by expanding root
to store NULLs to an empty tree
This patch tries to improve in:
* memory efficient by setting to empty tree instead of using a node
* remove the possibility of consecutive NULL slot which will prohibit extended null in later operation
--- lib/maple_tree.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
lib/maple_tree.c +12 -1
@@ -3439,9 +3439,20 @@ static inline int mas_root_expand(structreturn slot; } +/* +* mas_store_root() - Storing value into root. +* @mas: The maple state +* @entry: The entry to store. +* +* There is no root node now and we are storing a value into the root - this +* function either assigns the pointer or expands into a node. +*/ static inline void mas_store_root (struct ma_state *mas,void *entry) { -if (likely ((mas->last !=0 ) || (mas->index !=0 ))) +if (!entry) { +if (!mas->index) +rcu_assign_pointer (mas->tree->ma_root,NULL ); + }else if (likely ((mas->last !=0 ) || (mas->index !=0 )))mas_root_expand (mas, entry);else if (((unsigned long ) (entry) &3 ) ==2 )mas_root_expand (mas, entry);
Greg Kroah-Hartman
maintainerPATCH 45/146 ftrace: Fix regression with module command in stack_trace_filter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: guoweikang <[email protected]>
commit 45af52e7d3b8560f21d139b3759735eead8b1653 upstream.
When executing the following command:
# echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter
The current mod command causes a null pointer dereference. While commit 0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter") has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash.
--- kernel/trace/ftrace.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/trace/ftrace.c +3 -0
@@ -5080,6 +5080,9 @@ ftrace_mod_callback(struct trace_array *char *func;int ret; +if (!tr) +return -ENODEV ; +/* match_records() modifies func, and we need the original */ func =kstrdup (func_orig,GFP_KERNEL );if (!func)
Greg Kroah-Hartman
maintainerPATCH 46/146 vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: MengEn Sun <[email protected]>
commit 2ea80b039b9af0b71c00378523b71c254fb99c23 upstream.
Since 5.14-rc1, NUMA events will only be folded from per-CPU statistics to per zone and global statistics when the user actually needs it.
Currently, the kernel has performs the fold operation when reading /proc/vmstat, but does not perform the fold operation in /proc/zoneinfo. This can lead to inaccuracies in the following statistics in zoneinfo:
- numa_hit
- numa_miss
- numa_foreign
- numa_interleave
- numa_local
- numa_other
Therefore, before printing per-zone vm_numa_event when reading /proc/zoneinfo, we should also perform the fold operation.
--- mm/vmstat.c | 1 + 1 file changed, 1 insertion(+)
mm/vmstat.c +1 -0
@@ -1780,6 +1780,7 @@ static void zoneinfo_show_print(struct s zone_page_state(zone, i));#ifdef CONFIG_NUMA +fold_vm_zone_numa_events (zone);for (i =0 ; i <NR_VM_NUMA_EVENT_ITEMS ; i++)seq_printf (m,"\n %-12s %lu" ,numa_stat_name (i),zone_numa_event_state (zone, i));
Greg Kroah-Hartman
maintainerPATCH 47/146 zram: clear IDLE flag after recompression
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
commit f85219096648b251a81e9fe24a1974590cfc417d upstream.
Patch series "zram: IDLE flag handling fixes", v2.
zram can wrongly preserve ZRAM_IDLE flag on its entries which can result in premature post-processing (writeback and recompression) of such entries.
This patch (of 2)
Recompression should clear ZRAM_IDLE flag on the entries it has accessed, because otherwise some entries, specifically those for which recompression has failed, become immediate candidate entries for another post-processing (e.g. writeback).
Consider the following case:
- recompression marks entries IDLE every 4 hours and attempts to recompress them
- some entries are incompressible, so we keep them intact and hence preserve IDLE flag
- writeback marks entries IDLE every 8 hours and writebacks IDLE entries, however we have IDLE entries left from recompression, so writeback prematurely writebacks those entries.
The bug was reported by Shin Kawamura.
--- drivers/block/zram/zram_drv.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/block/zram/zram_drv.c +7 -0
@@ -1692,6 +1692,13 @@ static int zram_recompress(struct zram *if (ret)return ret; +/* +* We touched this entry so mark it as non-IDLE. This makes sure that +* we don't preserve IDLE flag and don't incorrectly pick this entry +* for different post-processing type (e.g. writeback). +*/ +zram_clear_flag (zram, index,ZRAM_IDLE ); + class_index_old =zs_lookup_class_index (zram->mem_pool, comp_len_old);/* * Iterate the secondary comp algorithms list (in order of priority)
Greg Kroah-Hartman
maintainerPATCH 48/146 iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mostafa Saleh <[email protected]>
commit d71fa842d33c48ac2809ae11d2379b5a788792cb upstream.
ARM_LPAE_LVL_IDX() takes into account concatenated PGDs and can return an index spanning multiple page-table pages given a sufficiently large input address. However, when the resulting index is used to calculate the number of remaining entries in the page, the possibility of concatenation is ignored and we end up computing a negative upper bound:
max_entries = ARM_LPAE_PTES_PER_TABLE(data) - map_idx_start;
On the map path, this results in a negative 'mapped' value being returned but on the unmap path we can leak child tables if they are skipped in __arm_lpae_free_pgtable().
Introduce an arm_lpae_max_entries() helper to convert a table index into the remaining number of entries within a single page-table page.
--- drivers/iommu/io-pgtable-arm.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/iommu/io-pgtable-arm.c +15 -3
@@ -199,6 +199,18 @@ static phys_addr_t iopte_to_paddr(arm_lpreturn (paddr | (paddr << (48 -12 ))) & (ARM_LPAE_PTE_ADDR_MASK <<4 ); } +/* +* Convert an index returned by ARM_LPAE_PGD_IDX(), which can point into +* a concatenated PGD, into the maximum number of entries that can be +* mapped in the same table page. +*/ +static inline int arm_lpae_max_entries (int i,struct arm_lpae_io_pgtable *data) +{ +int ptes_per_table =ARM_LPAE_PTES_PER_TABLE (data); + +return ptes_per_table - (i & (ptes_per_table -1 )); +} +static bool selftest_running = false;static dma_addr_t __arm_lpae_dma_addr (void *pages)
@@ -390,7 +402,7 @@ static int __arm_lpae_map(struct arm_lpa/* If we can install a leaf entry at this level, then do so */ if (size == block_size) { - max_entries =ARM_LPAE_PTES_PER_TABLE (data) - map_idx_start; + max_entries =arm_lpae_max_entries (map_idx_start, data); num_entries =min_t (int, pgcount, max_entries); ret =arm_lpae_init_pte (data, iova, paddr, prot, lvl, num_entries, ptep);if (!ret)
@@ -592,7 +604,7 @@ static size_t arm_lpae_split_blk_unmap(sif (size == split_sz) { unmap_idx_start =ARM_LPAE_LVL_IDX (iova, lvl, data); - max_entries = ptes_per_table - unmap_idx_start; + max_entries =arm_lpae_max_entries (unmap_idx_start, data); num_entries =min_t (int, pgcount, max_entries); }
@@ -650,7 +662,7 @@ static size_t __arm_lpae_unmap(struct ar/* If the size matches this level, we're in the right place */ if (size ==ARM_LPAE_BLOCK_SIZE (lvl, data)) { - max_entries =ARM_LPAE_PTES_PER_TABLE (data) - unmap_idx_start; + max_entries =arm_lpae_max_entries (unmap_idx_start, data); num_entries =min_t (int, pgcount, max_entries);/* Find and handle non-leaf entries */
Greg Kroah-Hartman
maintainerPATCH 49/146 iommu/arm-smmu: Defer probe of clients after smmu device bound
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Brahma <[email protected]>
commit 229e6ee43d2a160a1592b83aad620d6027084aad upstream.
Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for client is called after the iommu_device_register() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called.
Following is how the race occurs:
T1:Smmu device probe T2: Client device probe
really_probe()arm_smmu_device_probe()iommu_device_register()
really_probe() platform_dma_configure() of_dma_configure() of_dma_configure_id() of_iommu_configure() iommu_probe_device() iommu_init_device() arm_smmu_probe_device() arm_smmu_get_by_fwnode() driver_find_device_by_fwnode() driver_find_device() next_device() klist_next() /* null ptr assigned to smmu */ /* null ptr dereference while smmu->streamid_mask */
driver_bound()
klist_add_tail()
When this null smmu pointer is dereferenced later in arm_smmu_probe_device, the device crashes.
Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver.
--- drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/iommu/arm/arm-smmu/arm-smmu.c +11 -0
@@ -1437,6 +1437,17 @@ static struct iommu_device *arm_smmu_pro goto out_free; }else { smmu =arm_smmu_get_by_fwnode (fwspec->iommu_fwnode); + +/* +* Defer probe if the relevant SMMU instance hasn't finished +* probing yet. This is a fragile hack and we'd ideally +* avoid this race in the core code. Until that's ironed +* out, however, this is the most pragmatic option on the +* table. +*/ +if (!smmu) +return ERR_PTR (dev_err_probe (dev, -EPROBE_DEFER , +"smmu dev has not bound yet\n" )); } ret = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 50/146 leds: lp55xx: Remove redundant test for invalid channel number
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Vokáč <[email protected]>
commit 09b1ef9813a0742674f7efe26104403ca94a1b4a upstream.
Since commit 92a81562e695 ("leds: lp55xx: Add multicolor framework support to lp55xx") there are two subsequent tests if the chan_nr (reg property) is in valid range. One in the lp55xx_init_led() function and one in the lp55xx_parse_common_child() function that was added with the mentioned commit.
There are two issues with that.
First is in the lp55xx_parse_common_child() function where the reg property is tested right after it is read from the device tree. Test for the upper range is not correct though. Valid reg values are 0 to (max_channel - 1) so it should be >=.
Second issue is that in case the parsed value is out of the range the probe just fails and no error message is shown as the code never reaches the second test that prints and error message.
Remove the test form lp55xx_parse_common_child() function completely and keep the one in lp55xx_init_led() function to deal with it.
--- drivers/leds/leds-lp55xx-common.c | 3 --- 1 file changed, 3 deletions(-)
drivers/leds/leds-lp55xx-common.c +0 -3
@@ -1132,9 +1132,6 @@ static int lp55xx_parse_common_child(strif (ret)return ret; -if (*chan_nr <0 || *chan_nr > cfg->max_channel) -return -EINVAL ; -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 51/146 mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
commit f3c7a1ede435e2e45177d7a490a85fb0a0ec96d1 upstream.
Patch series "mm/damon/vaddr: Fix issue indamon_va_evenly_split_region()". v2.
According to the logic of damon_va_evenly_split_region(), currently following split case would not meet the expectation:
Suppose DAMON_MIN_REGION=0x1000,
Case: Split [0x0, 0x3000) into 2 pieces, then the result would be
acutually 3 regions:
[0x0, 0x1000), [0x1000, 0x2000), [0x2000, 0x3000)
but NOT the expected 2 regions:
[0x0, 0x1000), [0x1000, 0x3000) !!!
The root cause is that when calculating size of each split piece in damon_va_evenly_split_region():
sz_piece = ALIGN_DOWN(sz_orig / nr_pieces, DAMON_MIN_REGION);
both the dividing and the ALIGN_DOWN may cause loss of precision, then each time split one piece of size 'sz_piece' from origin 'start' to 'end' would cause more pieces are split out than expected!!!
To fix it, count for each piece split and make sure no more than 'nr_pieces'. In addition, add above case into damon_test_split_evenly().
And add 'nr_piece == 1' check in damon_va_evenly_split_region() for better code readability and add a corresponding kunit testcase.
This patch (of 2):
According to the logic of damon_va_evenly_split_region(), currently following split case would not meet the expectation:
Suppose DAMON_MIN_REGION=0x1000,
Case: Split [0x0, 0x3000) into 2 pieces, then the result would be
acutually 3 regions:
[0x0, 0x1000), [0x1000, 0x2000), [0x2000, 0x3000)
but NOT the expected 2 regions:
[0x0, 0x1000), [0x1000, 0x3000) !!!
The root cause is that when calculating size of each split piece in damon_va_evenly_split_region():
sz_piece = ALIGN_DOWN(sz_orig / nr_pieces, DAMON_MIN_REGION);
both the dividing and the ALIGN_DOWN may cause loss of precision, then each time split one piece of size 'sz_piece' from origin 'start' to 'end' would cause more pieces are split out than expected!!!
To fix it, count for each piece split and make sure no more than 'nr_pieces'. In addition, add above case into damon_test_split_evenly().
After this patch, damon-operations test passed:
# ./tools/testing/kunit/kunit.py run damon-operations [...] ============== damon-operations (6 subtests) =============== [PASSED] damon_test_three_regions_in_vmas [PASSED] damon_test_apply_three_regions1 [PASSED] damon_test_apply_three_regions2 [PASSED] damon_test_apply_three_regions3 [PASSED] damon_test_apply_three_regions4 [PASSED] damon_test_split_evenly ================ [PASSED] damon-operations =================
--- mm/damon/tests/vaddr-kunit.h | 1 + mm/damon/vaddr.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-)
mm/damon/tests/vaddr-kunit.h +1 -0
@@ -300,6 +300,7 @@ static void damon_test_split_evenly(strudamon_test_split_evenly_fail (test,0 ,100 ,0 );damon_test_split_evenly_succ (test,0 ,100 ,10 );damon_test_split_evenly_succ (test,5 ,59 ,5 ); +damon_test_split_evenly_succ (test,0 ,3 ,2 );damon_test_split_evenly_fail (test,5 ,6 ,2 ); }
mm/damon/vaddr.c +2 -2
@@ -67,6 +67,7 @@ static int damon_va_evenly_split_region(unsigned long sz_orig, sz_piece, orig_end;struct damon_region *n =NULL , *next;unsigned long start; +unsigned int i;if (!r || !nr_pieces)return -EINVAL ;
@@ -80,8 +81,7 @@ static int damon_va_evenly_split_region( r->ar.end = r->ar.start + sz_piece; next =damon_next_region (r); -for (start = r->ar.end; start + sz_piece <= orig_end; - start += sz_piece) { +for (start = r->ar.end, i =1 ; i < nr_pieces; start += sz_piece, i++) { n =damon_new_region (start, start + sz_piece);if (!n)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 52/146 powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit d677ce521334d8f1f327cafc8b1b7854b0833158 upstream.
Under certain conditions, the 64-bit '-mstack-protector-guard' flags may end up in the 32-bit vDSO flags, resulting in build failures due to the structure of clang's argument parsing of the stack protector options, which validates the arguments of the stack protector guard flags unconditionally in the frontend, choking on the 64-bit values when targeting 32-bit:
clang: error: invalid value 'r13' in 'mstack-protector-guard-reg=', expected one of: r2
clang: error: invalid value 'r13' in 'mstack-protector-guard-reg=', expected one of: r2 make[3]: *** [arch/powerpc/kernel/vdso/Makefile:85: arch/powerpc/kernel/vdso/vgettimeofday-32.o] Error 1 make[3]: *** [arch/powerpc/kernel/vdso/Makefile:87: arch/powerpc/kernel/vdso/vgetrandom-32.o] Error 1
Remove these flags by adding them to the CC32FLAGSREMOVE variable, which already handles situations similar to this. Additionally, reformat and align a comment better for the expanding CONFIG_CC_IS_CLANG block.
--- arch/powerpc/kernel/vdso/Makefile | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/powerpc/kernel/vdso/Makefile +6 -2
@@ -54,10 +54,14 @@ ldflags-y += $(filter-out $(CC_AUTO_VAR_ CC32FLAGS := -m32 CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc - # This flag is supported by clang for 64-bit but not 32-bit so it will cause - # an unused command line flag warning for this file. ifdef CONFIG_CC_IS_CLANG +# This flag is supported by clang for 64-bit but not 32-bit so it will cause +# an unused command line flag warning for this file. CC32FLAGSREMOVE += -fno-stack-clash-protection +# -mstack-protector-guard values from the 64-bit build are not valid for the +# 32-bit one. clang validates the values passed to these arguments during +# parsing, even when -fno-stack-protector is passed afterwards. +CC32FLAGSREMOVE += -mstack-protector-guard% endif LD32FLAGS := -Wl,-soname=linux-vdso32.so.1 AS32FLAGS := -D__VDSO32__
Greg Kroah-Hartman
maintainerPATCH 53/146 cpufreq: scmi: Fix cleanup path when boost enablement fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sibi Sankar <[email protected]>
commit 8c776a54d9ef3e945db2fe407ad6ad4525422943 upstream.
Include free_cpufreq_table in the cleanup path when boost enablement fails.
--- drivers/cpufreq/scmi-cpufreq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/cpufreq/scmi-cpufreq.c +3 -1
@@ -287,7 +287,7 @@ static int scmi_cpufreq_init(struct cpuf ret =cpufreq_enable_boost_support ();if (ret) {dev_warn (cpu_dev,"failed to enable boost: %d\n" , ret); - goto out_free_opp; + goto out_free_table; }else { scmi_cpufreq_hw_attr[1 ] = &cpufreq_freq_attr_scaling_boost_freqs; scmi_cpufreq_driver.boost_enabled = true;
@@ -296,6 +296,8 @@ static int scmi_cpufreq_init(struct cpufreturn 0 ; +out_free_table: +dev_pm_opp_free_cpufreq_table (cpu_dev, &freq_table); out_free_opp:dev_pm_opp_remove_all_dynamic (cpu_dev);
Greg Kroah-Hartman
maintainerPATCH 54/146 clk: qcom: gcc-qcs404: fix initial rate of GPLL3
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit 36d202241d234fa4ac50743510d098ad52bd193a upstream.
The comment before the config of the GPLL3 PLL says that the PLL should run at 930 MHz. In contrary to this, calculating the frequency from the current configuration values by using 19.2 MHz as input frequency defined in 'qcs404.dtsi', it gives 921.6 MHz:
$ xo=19200000; l=48; alpha=0x0; alpha_hi=0x0 $ echo "$xo * ($((l)) + $(((alpha_hi << 32 | alpha) >> 8)) / 2^32)" | bc -l 921600000.00000000000000000000
Set 'alpha_hi' in the configuration to a value used in downstream kernels [1][2] in order to get the correct output rate:
$ xo=19200000; l=48; alpha=0x0; alpha_hi=0x70 $ echo "$xo * ($((l)) + $(((alpha_hi << 32 | alpha) >> 8)) / 2^32)" | bc -l 930000000.00000000000000000000
The change is based on static code analysis, compile tested only.
[1] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/kernel.lnx.5.4.r56-rel/drivers/clk/qcom/gcc-qcs404.c?ref_type=heads#L335
[2} https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/blob/kernel.lnx.5.15.r49-rel/drivers/clk/qcom/gcc-qcs404.c?ref_type=heads#L127
--- drivers/clk/qcom/gcc-qcs404.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/gcc-qcs404.c +1 -0
@@ -131,6 +131,7 @@ static struct clk_alpha_pll gpll1_out_ma/* 930MHz configuration */ static const struct alpha_pll_config gpll3_config = { .l =48 , + .alpha_hi =0x70 , .alpha =0x0 , .alpha_en_mask =BIT (24 ), .post_div_mask =0xf <<8 ,
Greg Kroah-Hartman
maintainerPATCH 55/146 ad7780: fix division by zero in ad7780_write_raw()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit c174b53e95adf2eece2afc56cd9798374919f99a upstream.
In the ad7780_write_raw() , val2 can be zero, which might lead to a division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw() is based on iio_info's write_raw. While val is explicitly declared that can be zero (in read mode), val2 is not specified to be non-zero.
--- drivers/iio/adc/ad7780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7780.c +1 -1
@@ -152,7 +152,7 @@ static int ad7780_write_raw(struct iio_dswitch (m) {case IIO_CHAN_INFO_SCALE : -if (val !=0 ) +if (val !=0 || val2 ==0 )return -EINVAL ; vref = st->int_vref_mv *1000000LL ;
Greg Kroah-Hartman
maintainerPATCH 56/146 nvmem: core: Check read_only flag for force_ro in bin_attr_nvmem_write()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit da9596955c05966768364ab1cad2f43fcddc6f06 upstream.
The bin_attr_nvmem_write() must check the read_only flag and block writes on read-only devices, now that a nvmem device can be switched between read-write and read-only mode at runtime using the force_ro attribute. Add the missing check.
--- drivers/nvmem/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvmem/core.c +1 -1
@@ -267,7 +267,7 @@ static ssize_t bin_attr_nvmem_write(stru count =round_down (count, nvmem->word_size); -if (!nvmem->reg_write) +if (!nvmem->reg_write || nvmem->read_only)return -EPERM ; rc =nvmem_reg_write (nvmem, pos, buf, count);
Greg Kroah-Hartman
maintainerPATCH 57/146 driver core: fw_devlink: Stop trying to optimize cycle detection logic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravana Kannan <[email protected]>
commit bac3b10b78e54b7da3cede397258f75a2180609b upstream.
In attempting to optimize fw_devlink runtime, I introduced numerous cycle detection bugs by foregoing cycle detection logic under specific conditions. Each fix has further narrowed the conditions for optimization.
It's time to give up on these optimization attempts and just run the cycle detection logic every time fw_devlink tries to create a device link.
The specific bug report that triggered this fix involved a supplier fwnode that never gets a device created for it. Instead, the supplier fwnode is represented by the device that corresponds to an ancestor fwnode.
In this case, fw_devlink didn't do any cycle detection because the cycle detection logic is only run when a device link is created between the devices that correspond to the actual consumer and supplier fwnodes.
With this change, fw_devlink will run cycle detection logic even when creating SYNC_STATE_ONLY proxy device links from a device that is an ancestor of a consumer fwnode.
--- drivers/base/core.c | 55 ++++++++++++++++++++++------------------------------ 1 file changed, 24 insertions(+), 31 deletions(-)
drivers/base/core.c +24 -31
@@ -1989,10 +1989,10 @@ static struct device *fwnode_get_next_pa* * Return true if one or more cycles were found. Otherwise, return false. */ -static bool __fw_devlink_relax_cycles (struct device *con, +static bool __fw_devlink_relax_cycles (struct fwnode_handle *con_handle,struct fwnode_handle *sup_handle) { -struct device *sup_dev =NULL , *par_dev =NULL ; +struct device *sup_dev =NULL , *par_dev =NULL , *con_dev =NULL ;struct fwnode_link *link;struct device_link *dev_link;bool ret = false;
@@ -2009,22 +2009,22 @@ static bool __fw_devlink_relax_cycles(st sup_handle->flags |=FWNODE_FLAG_VISITED ; - sup_dev =get_dev_from_fwnode (sup_handle); -/* Termination condition. */ -if (sup_dev == con) { +if (sup_handle == con_handle) {pr_debug ("----- cycle: start -----\n" ); ret = true; goto out; } + sup_dev =get_dev_from_fwnode (sup_handle); + con_dev =get_dev_from_fwnode (con_handle);/* * If sup_dev is bound to a driver and @con hasn't started binding to a * driver, sup_dev can't be a consumer of @con. So, no need to check * further. */ if (sup_dev && sup_dev->links.status ==DL_DEV_DRIVER_BOUND && - con->links.status ==DL_DEV_NO_DRIVER ) { + con_dev && con_dev->links.status ==DL_DEV_NO_DRIVER ) { ret = false; goto out; }
@@ -2033,7 +2033,7 @@ static bool __fw_devlink_relax_cycles(stif (link->flags &FWLINK_FLAG_IGNORE )continue ; -if (__fw_devlink_relax_cycles (con, link->supplier)) { +if (__fw_devlink_relax_cycles (con_handle, link->supplier)) {__fwnode_link_cycle (link); ret = true; }
@@ -2048,7 +2048,7 @@ static bool __fw_devlink_relax_cycles(stelse par_dev =fwnode_get_next_parent_dev (sup_handle); -if (par_dev &&__fw_devlink_relax_cycles (con, par_dev->fwnode)) { +if (par_dev &&__fw_devlink_relax_cycles (con_handle, par_dev->fwnode)) {pr_debug ("%pfwf: cycle: child of %pfwf\n" , sup_handle, par_dev->fwnode); ret = true;
@@ -2066,7 +2066,7 @@ static bool __fw_devlink_relax_cycles(st !(dev_link->flags & DL_FLAG_CYCLE))continue ; -if (__fw_devlink_relax_cycles (con, +if (__fw_devlink_relax_cycles (con_handle, dev_link->supplier->fwnode)) {pr_debug ("%pfwf: cycle: depends on %pfwf\n" , sup_handle, dev_link->supplier->fwnode);
@@ -2114,11 +2114,6 @@ static int fw_devlink_create_devlink(strif (link->flags &FWLINK_FLAG_IGNORE )return 0 ; -if (con->fwnode == link->consumer) - flags =fw_devlink_get_flags (link->flags); -else - flags =FW_DEVLINK_FLAGS_PERMISSIVE ; -/* * In some cases, a device P might also be a supplier to its child node * C. However, this would defer the probe of C until the probe of P
@@ -2139,25 +2134,23 @@ static int fw_devlink_create_devlink(strreturn -EINVAL ;/* -* SYNC_STATE_ONLY device links don't block probing and supports cycles. -* So, one might expect that cycle detection isn't necessary for them. -* However, if the device link was marked as SYNC_STATE_ONLY because -* it's part of a cycle, then we still need to do cycle detection. This -* is because the consumer and supplier might be part of multiple cycles -* and we need to detect all those cycles. +* Don't try to optimize by not calling the cycle detection logic under +* certain conditions. There's always some corner case that won't get +* detected. */ -if (!device_link_flag_is_sync_state_only (flags) || - flags &DL_FLAG_CYCLE ) { -device_links_write_lock (); -if (__fw_devlink_relax_cycles (con, sup_handle)) { -__fwnode_link_cycle (link); - flags =fw_devlink_get_flags (link->flags); -pr_debug ("----- cycle: end -----\n" ); -dev_info (con,"Fixed dependency cycle(s) with %pfwf\n" , - sup_handle); - } -device_links_write_unlock (); +device_links_write_lock (); +if (__fw_devlink_relax_cycles (link->consumer, sup_handle)) { +__fwnode_link_cycle (link); +pr_debug ("----- cycle: end -----\n" ); +pr_info ("%pfwf: Fixed dependency cycle(s) with %pfwf\n" , + link->consumer, sup_handle); } +device_links_write_unlock (); + +if (con->fwnode == link->consumer) + flags =fw_devlink_get_flags (link->flags); +else + flags =FW_DEVLINK_FLAGS_PERMISSIVE ;if (sup_handle->flags &FWNODE_FLAG_NOT_DEVICE ) sup_dev =fwnode_get_next_parent_dev (sup_handle);
Greg Kroah-Hartman
maintainerPATCH 58/146 spmi: pmic-arb: fix return path in for_each_available_child_of_node()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 77adf4b1f3e1fdb319f7ee515e5924bb77df3916 upstream.
This loop requires explicit calls to of_node_put() upon early exits (break, goto, return) to decrement the child refcounter and avoid memory leaks if the child is not required out of the loop.
A more robust solution is using the scoped variant of the macro, which automatically calls of_node_put() when the child goes out of scope.
--- drivers/spmi/spmi-pmic-arb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/spmi/spmi-pmic-arb.c +1 -2
@@ -1763,14 +1763,13 @@ static int spmi_pmic_arb_register_buses( {struct device *dev = &pdev->dev;struct device_node *node = dev->of_node; -struct device_node *child;int ret;/* legacy mode doesn't provide child node for the bus */ if (of_device_is_compatible (node,"qcom,spmi-pmic-arb" ))return spmi_pmic_arb_bus_init (pdev, node, pmic_arb); -for_each_available_child_of_node (node, child) { +for_each_available_child_of_node_scoped (node, child) {if (of_node_name_eq (child,"spmi" )) { ret =spmi_pmic_arb_bus_init (pdev, child, pmic_arb);if (ret)
Greg Kroah-Hartman
maintainerPATCH 59/146 ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit d6e6a74d4cea853b5321eeabb69c611148eedefe upstream.
When sync:ing the VMALLOC area to other CPUs, make sure to also sync the KASAN shadow memory for the VMALLOC area, so that we don't get stale entries for the shadow memory in the top level PGD.
Since we are now copying PGDs in two instances, create a helper function named memcpy_pgd() to do the actual copying, and create a helper to map the addresses of VMALLOC_START and VMALLOC_END into the corresponding shadow memory.
--- arch/arm/mm/ioremap.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-)
arch/arm/mm/ioremap.c +29 -4
@@ -23,6 +23,7 @@*/ #include <linux/module.h> #include <linux/errno.h> +#include <linux/kasan.h> #include <linux/mm.h> #include <linux/vmalloc.h> #include <linux/io.h>
@@ -115,16 +116,40 @@ int ioremap_page(unsigned long virt, uns }EXPORT_SYMBOL (ioremap_page); +#ifdef CONFIG_KASAN +static unsigned long arm_kasan_mem_to_shadow (unsigned long addr) +{ +return (unsigned long )kasan_mem_to_shadow ((void *)addr); +} +#else +static unsigned long arm_kasan_mem_to_shadow (unsigned long addr) +{ +return 0 ; +} +#endif + +static void memcpy_pgd (struct mm_struct *mm,unsigned long start, +unsigned long end) +{ + end =ALIGN (end,PGDIR_SIZE ); +memcpy (pgd_offset (mm, start),pgd_offset_k (start), +sizeof (pgd_t) * (pgd_index (end) -pgd_index (start))); +} +void __check_vmalloc_seq (struct mm_struct *mm) {int seq; do { seq = atomic_read(&init_mm.context.vmalloc_seq); - memcpy(pgd_offset(mm, VMALLOC_START), - pgd_offset_k(VMALLOC_START), - sizeof(pgd_t) * (pgd_index(VMALLOC_END) - - pgd_index(VMALLOC_START))); + memcpy_pgd(mm, VMALLOC_START, VMALLOC_END); + if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) { + unsigned long start = + arm_kasan_mem_to_shadow(VMALLOC_START); + unsigned long end = + arm_kasan_mem_to_shadow(VMALLOC_END); + memcpy_pgd(mm, start, end); + } /* * Use a store-release so that other CPUs that observe the * counter's new value are guaranteed to see the results of the
Greg Kroah-Hartman
maintainerPATCH 60/146 s390/entry: Mark IRQ entries to fix stack depot warnings
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <[email protected]>
commit 45c9f2b856a075a34873d00788d2e8a250c1effd upstream.
The stack depot filters out everything outside of the top interrupt context as an uninteresting or irrelevant part of the stack traces. This helps with stack trace de-duplication, avoiding an explosion of saved stack traces that share the same IRQ context code path but originate from different randomly interrupted points, eventually exhausting the stack depot.
Filtering uses in_irqentry_text() to identify functions within the .irqentry.text and .softirqentry.text sections, which then become the last stack trace entries being saved.
While __do_softirq() is placed into the .softirqentry.text section by common code, populating .irqentry.text is architecture-specific.
Currently, the .irqentry.text section on s390 is empty, which prevents stack depot filtering and de-duplication and could result in warnings like:
Stack depot reached limit capacity
WARNING: CPU: 0 PID: 286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8
with PREEMPT and KASAN enabled.
Fix this by moving the IO/EXT interrupt handlers from .kprobes.text into the .irqentry.text section and updating the kprobes blacklist to include the .irqentry.text section.
This is done only for asynchronous interrupts and explicitly not for program checks, which are synchronous and where the context beyond the program check is important to preserve. Despite machine checks being somewhat in between, they are extremely rare, and preserving context when possible is also of value.
SVCs and Restart Interrupts are not relevant, one being always at the boundary to user space and the other being a one-time thing.
IRQ entries filtering is also optionally used in ftrace function graph, where the same logic applies.
--- arch/s390/kernel/entry.S | 4 ++++ arch/s390/kernel/kprobes.c | 6 ++++++ 2 files changed, 10 insertions(+)
arch/s390/kernel/entry.S +4 -0
@@ -450,9 +450,13 @@ SYM_CODE_START(\name) SYM_CODE_END(\name) .endm + .section .irqentry.text, "ax" + INT_HANDLER ext_int_handler,__LC_EXT_OLD_PSW,do_ext_irq INT_HANDLER io_int_handler,__LC_IO_OLD_PSW,do_io_irq + .section .kprobes.text, "ax" + /* * Machine check handler routines */
arch/s390/kernel/kprobes.c +6 -0
@@ -489,6 +489,12 @@ int __init arch_init_kprobes(void)return 0 ; } +int __init arch_populate_kprobe_blacklist (void ) +{ +return kprobe_add_area_blacklist ((unsigned long )__irqentry_text_start, + (unsigned long )__irqentry_text_end); +} +int arch_trampoline_kprobe (struct kprobe *p) {return 0 ;
Greg Kroah-Hartman
maintainerPATCH 61/146 ARM: 9430/1: entry: Do a dummy read from VMAP shadow
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit 44e9a3bb76e5f2eecd374c8176b2c5163c8bb2e2 upstream.
When switching task, in addition to a dummy read from the new VMAP stack, also do a dummy read from the VMAP stack's corresponding KASAN shadow memory to sync things up in the new MM context.
--- arch/arm/kernel/entry-armv.S | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm/kernel/entry-armv.S +8 -0
@@ -25,6 +25,7 @@ #include <asm/tls.h> #include <asm/system_info.h> #include <asm/uaccess-asm.h> +#include <asm/kasan_def.h> #include "entry-header.S" #include <asm/probes.h>
@@ -561,6 +562,13 @@ ENTRY(__switch_to) @ entries covering the vmalloc region. @ ldr r2, [ip] +#ifdef CONFIG_KASAN_VMALLOC + @ Also dummy read from the KASAN shadow memory for the new stack if we + @ are using KASAN + mov_l r2, KASAN_SHADOW_OFFSET + add r2, r2, ip, lsr #KASAN_SHADOW_SCALE_SHIFT + ldr r2, [r2] +#endif #endif @ When CONFIG_THREAD_INFO_IN_TASK=n, the update of SP itself is what
Greg Kroah-Hartman
maintainerPATCH 62/146 ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit 93ee385254d53849c01dd8ab9bc9d02790ee7f0e upstream.
The code for syncing vmalloc memory PGD pointers is using atomic_read() in pair with atomic_set_release() but the proper pairing is atomic_read_acquire() paired with atomic_set_release().
This is done to clearly instruct the compiler to not reorder the memcpy() or similar calls inside the section so that we do not observe changes to init_mm. memcpy() calls should be identified by the compiler as having unpredictable side effects, but let's try to be on the safe side.
--- arch/arm/mm/ioremap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mm/ioremap.c +1 -1
@@ -141,7 +141,7 @@ void __check_vmalloc_seq(struct mm_strucint seq; do { - seq = atomic_read(&init_mm.context.vmalloc_seq); + seq = atomic_read_acquire(&init_mm.context.vmalloc_seq); memcpy_pgd(mm, VMALLOC_START, VMALLOC_END); if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) { unsigned long start =
Greg Kroah-Hartman
maintainerPATCH 63/146 net: stmmac: set initial EEE policy configuration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Choong Yong Liang <[email protected]>
commit 59c5e1411a0a13ebb930f4ebba495cc4eb14f8f2 upstream.
Set the initial eee_cfg values to have 'ethtool --show-eee ' display the initial EEE configuration.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +3 -0
@@ -1205,6 +1205,9 @@ static int stmmac_init_phy(struct net_dereturn -ENODEV ; } +if (priv->dma_cap.eee) +phy_support_eee (phydev); + ret =phylink_connect_phy (priv->phylink, phydev); }else {fwnode_handle_put (phy_fwnode);
Greg Kroah-Hartman
maintainerPATCH 64/146 vfio/qat: fix overflow check in qat_vf_resume_write()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <[email protected]>
commit 9283b7392570421c22a6c8058614f5b76a46b81c upstream.
The unsigned variable size_t len is cast to the signed type loff_t when passed to the function check_add_overflow(). This function considers the type of the destination, which is of type loff_t (signed), potentially leading to an overflow. This issue is similar to the one described in the link below.
Remove the cast.
Note that even if check_add_overflow() is bypassed, by setting len to a value that is greater than LONG_MAX (which is considered as a negative value after the cast), the function copy_from_user(), invoked a few lines later, will not perform any copy and return len as (len > INT_MAX) causing qat_vf_resume_write() to fail with -EFAULT.
--- drivers/vfio/pci/qat/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vfio/pci/qat/main.c +1 -1
@@ -304,7 +304,7 @@ static ssize_t qat_vf_resume_write(struct file *filp, const char __user *buf, offs = &filp->f_pos;if (*offs <0 || -check_add_overflow ((loff_t )len, *offs, &end)) +check_add_overflow (len, *offs, &end))return -EOVERFLOW ;if (end > mig_dev->state_size)
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 65/146 PCI: qcom: Disable ASPM L0s for X1E80100
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Yu <[email protected]>
commit fba6045161d686adc102b6ef71b2fd1e5f90a616 upstream.
Currently, the cfg_1_9_0 which is being used for X1E80100 doesn't disable ASPM L0s. However, hardware team recommends to disable L0s as the PHY init sequence is not tuned support L0s. Hence reuse cfg_sc8280xp for X1E80100.
Note that the config_sid() callback is not present in cfg_sc8280xp, don't concern about this because config_sid() callback is originally a no-op for X1E80100.
--- drivers/pci/controller/dwc/pcie-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-qcom.c +1 -1
@@ -1845,7 +1845,7 @@ static const struct of_device_id qcom_pc { .compatible = "qcom,pcie-sm8450-pcie0", .data = &cfg_1_9_0 }, { .compatible = "qcom,pcie-sm8450-pcie1", .data = &cfg_1_9_0 }, { .compatible = "qcom,pcie-sm8550", .data = &cfg_1_9_0 }, - { .compatible = "qcom,pcie-x1e80100", .data = &cfg_1_9_0 }, + { .compatible = "qcom,pcie-x1e80100", .data = &cfg_sc8280xp }, { } };
Greg Kroah-Hartman
maintainerPATCH 66/146 perf jevents: fix breakage when do perf stat on system metric
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit 4a159e6049f319bef6f9e6d2ccdd322f57d24830 upstream.
When do perf stat on sys metric, perf tool output nothing now:
$ perf stat -a -M imx95_ddr_read.all -I 1000 $
This command runs on an arm64 machine and the Soc has one DDR hw pmu except one armv8_cortex_a55 pmu. Their maps show as follows:
const struct pmu_events_map pmu_events_map[] = {
{
.arch = "arm64",
.cpuid = "0x00000000410fd050",
.event_table = {
.pmus = pmu_events__arm_cortex_a55,
.num_pmus = ARRAY_SIZE(pmu_events__arm_cortex_a55)
},
.metric_table = {
.pmus = NULL,
.num_pmus = 0
}
},static const struct pmu_sys_events pmu_sys_event_tables[] = {
{
.event_table = {
.pmus = pmu_events__freescale_imx95_sys,
.num_pmus = ARRAY_SIZE(pmu_events__freescale_imx95_sys)
},
.metric_table = {
.pmus = pmu_metrics__freescale_imx95_sys,
.num_pmus = ARRAY_SIZE(pmu_metrics__freescale_imx95_sys)
},
.name = "pmu_events__freescale_imx95_sys",
},Currently, pmu_metrics_table__find() will return NULL when only do perf stat on sys metric. Then parse_groups() will never be called to parse sys metric_name, finally perf tool will exit directly. This should be a common problem.
To fix the issue, this will keep the logic before commit f20c15d13f01 ("perf pmu-events: Remember the perf_events_map for a PMU") to return a empty metric table rather than a NULL pointer.
This should be fine since the removed part just check if the table match provided metric_name. Without these code, the code in parse_groups() will also check the validity of metrci_name too.
--- tools/perf/pmu-events/empty-pmu-events.c | 12 +----------- tools/perf/pmu-events/jevents.py | 12 +----------- 2 files changed, 2 insertions(+), 22 deletions(-)
tools/perf/pmu-events/empty-pmu-events.c +1 -11
@@ -539,17 +539,7 @@ const struct pmu_metrics_table *perf_pmuif (!map)return NULL ; -if (!pmu) -return &map->metric_table; - -for (size_t i =0 ; i < map->metric_table.num_pmus; i++) { -const struct pmu_table_entry *table_pmu = &map->metric_table.pmus[i]; -const char *pmu_name = &big_c_string[table_pmu->pmu_name.offset]; - -if (pmu__name_match (pmu, pmu_name)) -return &map->metric_table; - } -return NULL ; +return &map->metric_table; }const struct pmu_events_table *find_core_events_table (const char *arch,const char *cpuid)
tools/perf/pmu-events/jevents.py +1 -11
@@ -1089,17 +1089,7 @@ const struct pmu_metrics_table *perf_pmu if (!map) return NULL; - if (!pmu) - return &map->metric_table; - - for (size_t i = 0; i < map->metric_table.num_pmus; i++) { - const struct pmu_table_entry *table_pmu = &map->metric_table.pmus[i]; - const char *pmu_name = &big_c_string[table_pmu->pmu_name.offset]; - - if (pmu__name_match(pmu, pmu_name)) - return &map->metric_table; - } - return NULL; + return &map->metric_table; } const struct pmu_events_table *find_core_events_table(const char *arch, const char *cpuid)
Greg Kroah-Hartman
maintainerPATCH 67/146 remoteproc: qcom_q6v5_pas: disable auto boot for wpss
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balaji Pothunoori <[email protected]>
commit 8a47704d64c9afda80e7f399ba2cf898cfcc45b2 upstream.
Currently, the rproc "atomic_t power" variable is incremented during:
a. WPSS rproc auto boot.
b. AHB power on for ath11k.
During AHB power off (rmmod ath11k_ahb.ko), rproc_shutdown fails to unload the WPSS firmware because the rproc->power value is '2', causing the atomic_dec_and_test(&rproc->power) condition to fail.
Consequently, during AHB power on (insmod ath11k_ahb.ko), QMI_WLANFW_HOST_CAP_REQ_V01 fails due to the host and firmware QMI states being out of sync.
--- drivers/remoteproc/qcom_q6v5_pas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/qcom_q6v5_pas.c +1 -1
@@ -1356,7 +1356,7 @@ static const struct adsp_data sc7280_wpss_resource = { .crash_reason_smem = 626, .firmware_name = "wpss.mdt", .pas_id = 6, - .auto_boot = true, + .auto_boot = false, .proxy_pd_names = (char *[]){"cx" ,"mx" ,
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 68/146 PCI: imx6: Fix suspend/resume support on i.MX6QDL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Eichenberger <[email protected]>
commit 0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3 upstream.
The suspend/resume functionality is currently broken on the i.MX6QDL platform, as documented in the NXP errata (ERR005723):
https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf
This patch addresses the issue by sharing most of the suspend/resume sequences used by other i.MX devices, while avoiding modifications to critical registers that disrupt the PCIe functionality. It targets the same problem as the following downstream commit:
https://github.com/nxp-imx/linux-imx/commit/4e92355e1f79d225ea842511fcfd42b343b32995
Unlike the downstream commit, this patch also resets the connected PCIe device if possible. Without this reset, certain drivers, such as ath10k or iwlwifi, will crash on resume. The device reset is also done by the driver on other i.MX platforms, making this patch consistent with existing practices.
Upon resuming, the kernel will hang and display an error. Here's an example of the error encountered with the ath10k driver:
ath10k_pci 0000:01:00.0: Unable to change power state from D3hot to D0, device inaccessible Unhandled fault: imprecise external abort (0x1406) at 0x0106f944
Without this patch, suspend/resume will fail on i.MX6QDL devices if a PCIe device is connected.
--- drivers/pci/controller/dwc/pci-imx6.c | 57 +++++++++++++++++++++++++++------- 1 file changed, 46 insertions(+), 11 deletions(-)
drivers/pci/controller/dwc/pci-imx6.c +46 -11
@@ -82,6 +82,11 @@ enum imx_pcie_variants {#define IMX_PCIE_FLAG_HAS_SERDES BIT(6)#define IMX_PCIE_FLAG_SUPPORT_64BIT BIT(7)#define IMX_PCIE_FLAG_CPU_ADDR_FIXUP BIT(8) +/* +* Because of ERR005723 (PCIe does not support L2 power down) we need to +* workaround suspend resume on some devices which are affected by this errata. +*/ +#define IMX_PCIE_FLAG_BROKEN_SUSPEND BIT(9)#define imx_check_flag (pci, val) (pci->drvdata->flags & val)
@@ -1237,9 +1242,19 @@ static int imx_pcie_suspend_noirq(structreturn 0 ;imx_pcie_msi_save_restore (imx_pcie, true); -imx_pcie_pm_turnoff (imx_pcie); -imx_pcie_stop_link (imx_pcie->pci); -imx_pcie_host_exit (pp); +if (imx_check_flag (imx_pcie,IMX_PCIE_FLAG_BROKEN_SUSPEND )) { +/* +* The minimum for a workaround would be to set PERST# and to +* set the PCIE_TEST_PD flag. However, we can also disable the +* clock which saves some power. +*/ +imx_pcie_assert_core_reset (imx_pcie); + imx_pcie->drvdata->enable_ref_clk (imx_pcie, false); + }else { +imx_pcie_pm_turnoff (imx_pcie); +imx_pcie_stop_link (imx_pcie->pci); +imx_pcie_host_exit (pp); + }return 0 ; }
@@ -1253,14 +1268,32 @@ static int imx_pcie_resume_noirq(structif (!(imx_pcie->drvdata->flags &IMX_PCIE_FLAG_SUPPORTS_SUSPEND ))return 0 ; - ret =imx_pcie_host_init (pp); -if (ret) -return ret; -imx_pcie_msi_save_restore (imx_pcie, false); -dw_pcie_setup_rc (pp); +if (imx_check_flag (imx_pcie,IMX_PCIE_FLAG_BROKEN_SUSPEND )) { + ret = imx_pcie->drvdata->enable_ref_clk (imx_pcie, true); +if (ret) +return ret; + ret =imx_pcie_deassert_core_reset (imx_pcie); +if (ret) +return ret; +/* +* Using PCIE_TEST_PD seems to disable MSI and powers down the +* root complex. This is why we have to setup the rc again and +* why we have to restore the MSI register. +*/ + ret =dw_pcie_setup_rc (&imx_pcie->pci->pp); +if (ret) +return ret; +imx_pcie_msi_save_restore (imx_pcie, false); + }else { + ret =imx_pcie_host_init (pp); +if (ret) +return ret; +imx_pcie_msi_save_restore (imx_pcie, false); +dw_pcie_setup_rc (pp); -if (imx_pcie->link_is_up) -imx_pcie_start_link (imx_pcie->pci); +if (imx_pcie->link_is_up) +imx_pcie_start_link (imx_pcie->pci); + }return 0 ; }
@@ -1485,7 +1518,9 @@ static const struct imx_pcie_drvdata drv [IMX6Q] = { .variant = IMX6Q, .flags =IMX_PCIE_FLAG_IMX_PHY | - IMX_PCIE_FLAG_IMX_SPEED_CHANGE, +IMX_PCIE_FLAG_IMX_SPEED_CHANGE | +IMX_PCIE_FLAG_BROKEN_SUSPEND | + IMX_PCIE_FLAG_SUPPORTS_SUSPEND, .dbi_length = 0x200, .gpr = "fsl,imx6q-iomuxc-gpr", .clk_names = imx6q_clks,
Greg Kroah-Hartman
maintainerPATCH 69/146 mm/slub: Avoid list corruption when removing a slab from the full list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: yuan.gao <[email protected]>
commit dbc16915279a548a204154368da23d402c141c81 upstream.
Boot with slub_debug=UFPZ.
If allocated object failed in alloc_consistency_checks, all objects of the slab will be marked as used, and then the slab will be removed from the partial list.
When an object belonging to the slab got freed later, the remove_full() function is called. Because the slab is neither on the partial list nor on the full list, it eventually lead to a list corruption (actually a list poison being detected).
So we need to mark and isolate the slab page with metadata corruption, do not put it back in circulation.
Because the debug caches avoid all the fastpaths, reusing the frozen bit to mark slab page with metadata corruption seems to be fine.
[ 4277.385669] list_del corruption, ffffea00044b3e50->next is LIST_POISON1 (dead000000000100) [ 4277.387023] ------------[ cut here ]------------ [ 4277.387880] kernel BUG at lib/list_debug.c:56! [ 4277.388680] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 4277.389562] CPU: 5 PID: 90 Comm: kworker/5:1 Kdump: loaded Tainted: G OE 6.6.1-1 #1 [ 4277.392113] Workqueue: xfs-inodegc/vda1 xfs_inodegc_worker [xfs] [ 4277.393551] RIP: 0010:__list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.394518] Code: 48 91 82 e8 37 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 28 49 91 82 e8 26 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 58 49 91 [ 4277.397292] RSP: 0018:ffffc90000333b38 EFLAGS: 00010082 [ 4277.398202] RAX: 000000000000004e RBX: ffffea00044b3e50 RCX: 0000000000000000 [ 4277.399340] RDX: 0000000000000002 RSI: ffffffff828f8715 RDI: 00000000ffffffff [ 4277.400545] RBP: ffffea00044b3e40 R08: 0000000000000000 R09: ffffc900003339f0 [ 4277.401710] R10: 0000000000000003 R11: ffffffff82d44088 R12: ffff888112cf9910 [ 4277.402887] R13: 0000000000000001 R14: 0000000000000001 R15: ffff8881000424c0 [ 4277.404049] FS: 0000000000000000(0000) GS:ffff88842fd40000(0000) knlGS:0000000000000000 [ 4277.405357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4277.406389] CR2: 00007f2ad0b24000 CR3: 0000000102a3a006 CR4: 00000000007706e0 [ 4277.407589] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4277.408780] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4277.410000] PKRU: 55555554 [ 4277.410645] Call Trace: [ 4277.411234] <TASK> [ 4277.411777] ? die+0x32/0x80 [ 4277.412439] ? do_trap+0xd6/0x100 [ 4277.413150] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.414158] ? do_error_trap+0x6a/0x90 [ 4277.414948] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.415915] ? exc_invalid_op+0x4c/0x60 [ 4277.416710] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.417675] ? asm_exc_invalid_op+0x16/0x20 [ 4277.418482] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.419466] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.420410] free_to_partial_list+0x515/0x5e0 [ 4277.421242] ? xfs_iext_remove+0x41a/0xa10 [xfs] [ 4277.422298] xfs_iext_remove+0x41a/0xa10 [xfs] [ 4277.423316] ? xfs_inodegc_worker+0xb4/0x1a0 [xfs] [ 4277.424383] xfs_bmap_del_extent_delay+0x4fe/0x7d0 [xfs] [ 4277.425490] __xfs_bunmapi+0x50d/0x840 [xfs] [ 4277.426445] xfs_itruncate_extents_flags+0x13a/0x490 [xfs] [ 4277.427553] xfs_inactive_truncate+0xa3/0x120 [xfs] [ 4277.428567] xfs_inactive+0x22d/0x290 [xfs] [ 4277.429500] xfs_inodegc_worker+0xb4/0x1a0 [xfs] [ 4277.430479] process_one_work+0x171/0x340 [ 4277.431227] worker_thread+0x277/0x390 [ 4277.431962] ? __pfx_worker_thread+0x10/0x10 [ 4277.432752] kthread+0xf0/0x120 [ 4277.433382] ? __pfx_kthread+0x10/0x10 [ 4277.434134] ret_from_fork+0x2d/0x50 [ 4277.434837] ? __pfx_kthread+0x10/0x10 [ 4277.435566] ret_from_fork_asm+0x1b/0x30 [ 4277.436280] </TASK>
--- mm/slab.h | 5 +++++ mm/slub.c | 9 ++++++++- 2 files changed, 13 insertions(+), 1 deletion(-)
mm/slab.h +5 -0
@@ -73,6 +73,11 @@ struct slab {struct {unsigned inuse:16 ;unsigned objects:15 ; +/* +* If slab debugging is enabled then the +* frozen bit can be reused to indicate +* that the slab was corrupted +*/ unsigned frozen:1 ; }; };
mm/slub.c +8 -1
@@ -1423,6 +1423,11 @@ static int check_slab(struct kmem_cache slab->inuse, slab->objects);return 0 ; } +if (slab->frozen) { +slab_err (s, slab,"Slab disabled since SLUB metadata consistency check failed" ); +return 0 ; + } +/* Slab_pad_check fixes things up after itself */ slab_pad_check (s, slab);return 1 ;
@@ -1603,6 +1608,7 @@ bad:slab_fix (s,"Marking all objects used" ); slab->inuse = slab->objects; slab->freelist =NULL ; + slab->frozen =1 ;/* mark consistency-failed slab as frozen */ }return false; }
@@ -2744,7 +2750,8 @@ static void *alloc_single_from_partial(s slab->inuse++;if (!alloc_debug_processing (s, slab, object, orig_size)) { -remove_partial (n, slab); +if (folio_test_slab (slab_folio (slab))) +remove_partial (n, slab);return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 70/146 f2fs: fix to drop all discards after creating snapshot on lvm device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit bc8aeb04fd80cb8cfae3058445c84410fd0beb5e upstream.
Piergiorgio reported a bug in bugzilla as below:
------------[ cut here ]------------ WARNING: CPU: 2 PID: 969 at fs/f2fs/segment.c:1330 RIP: 0010:__submit_discard_cmd+0x27d/0x400 [f2fs] Call Trace: __issue_discard_cmd+0x1ca/0x350 [f2fs] issue_discard_thread+0x191/0x480 [f2fs] kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30
w/ below testcase, it can reproduce this bug quickly:
- pvcreate /dev/vdb
- vgcreate myvg1 /dev/vdb
- lvcreate -L 1024m -n mylv1 myvg1
- mount /dev/myvg1/mylv1 /mnt/f2fs
- dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=20
- sync
- rm /mnt/f2fs/file
- sync
- lvcreate -L 1024m -s -n mylv1-snapshot /dev/myvg1/mylv1
- umount /mnt/f2fs
The root cause is: it will update discard_max_bytes of mounted lvm device to zero after creating snapshot on this lvm device, then, __submit_discard_cmd() will pass parameter @nr_sects w/ zero value to __blkdev_issue_discard(), it returns a NULL bio pointer, result in panic.
This patch changes as below for fixing:
1. Let's drop all remained discards in f2fs_unfreeze() if snapshot of lvm device is created.
2. Checking discard_max_bytes before submitting discard during __submit_discard_cmd().
--- fs/f2fs/segment.c | 16 +++++++++------- fs/f2fs/super.c | 12 ++++++++++++ 2 files changed, 21 insertions(+), 7 deletions(-)
fs/f2fs/segment.c +9 -7
@@ -1290,16 +1290,18 @@ static int __submit_discard_cmd(struct f wait_list, issued); return 0; } - -/* -* Issue discard for conventional zones only if the device -* supports discard. -*/ -if (!bdev_max_discard_sectors (bdev)) -return -EOPNOTSUPP ; }#endif +/* +* stop issuing discard for any of below cases: +* 1. device is conventional zone, but it doesn't support discard. +* 2. device is regulare device, after snapshot it doesn't support +* discard. +*/ +if (!bdev_max_discard_sectors (bdev)) +return -EOPNOTSUPP ; +trace_f2fs_issue_discard (bdev, dc->di.start, dc->di.len); lstart = dc->di.lstart;
fs/f2fs/super.c +12 -0
@@ -1748,6 +1748,18 @@ static int f2fs_freeze(struct super_blocstatic int f2fs_unfreeze (struct super_block *sb) { +struct f2fs_sb_info *sbi =F2FS_SB (sb); + +/* +* It will update discard_max_bytes of mounted lvm device to zero +* after creating snapshot on this lvm device, let's drop all +* remained discards. +* We don't need to disable real-time discard because discard_max_bytes +* will recover after removal of snapshot. +*/ +if (test_opt (sbi,DISCARD ) && !f2fs_hw_support_discard (sbi)) +f2fs_issue_discard_timeout (sbi); +clear_sbi_flag (F2FS_SB (sb),SBI_IS_FREEZING );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 71/146 ceph: extract entity name from device id
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Donnelly <[email protected]>
commit 955710afcb3bb63e21e186451ed5eba85fa14d0b upstream.
Previously, the "name" in the new device syntax "<name>@<fsid>.<fsname>" was ignored because (presumably) tests were done using mount.ceph which also passed the entity name using "-o name=foo". If mounting is done without the mount.ceph helper, the new device id syntax fails to set the name properly.
--- fs/ceph/super.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/ceph/super.c +9 -1
@@ -285,7 +285,9 @@ static int ceph_parse_new_source(const csize_t len;struct ceph_fsid fsid;struct ceph_parse_opts_ctx *pctx = fc->fs_private; +struct ceph_options *opts = pctx->copts;struct ceph_mount_options *fsopt = pctx->opts; +const char *name_start = dev_name;char *fsid_start, *fs_name_start;if (*dev_name_end !='=' ) {
@@ -296,8 +298,14 @@ static int ceph_parse_new_source(const c fsid_start =strchr (dev_name,'@' );if (!fsid_start)return invalfc (fc,"missing cluster fsid" ); - ++fsid_start;/* start of cluster fsid */ + len = fsid_start - name_start; +kfree (opts->name); + opts->name =kstrndup (name_start, len,GFP_KERNEL ); +if (!opts->name) +return -ENOMEM ; +dout ("using %s entity name" , opts->name); + ++fsid_start;/* start of cluster fsid */ fs_name_start =strchr (fsid_start,'.' );if (!fs_name_start)return invalfc (fc,"missing file system name" );
Greg Kroah-Hartman
maintainerPATCH 72/146 ceph: pass cred pointer to ceph_mds_auth_match()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
commit 23426309a4064b25a961e1c72961d8bfc7c8c990 upstream.
This eliminates a redundant get_current_cred() call, because ceph_mds_check_access() has already obtained this pointer.
As a side effect, this also fixes a reference leak in ceph_mds_auth_match(): by omitting the get_current_cred() call, no additional cred reference is taken.
--- fs/ceph/mds_client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ceph/mds_client.c +2 -2
@@ -5609,9 +5609,9 @@ void send_flush_mdlog(struct ceph_mds_sestatic int ceph_mds_auth_match (struct ceph_mds_client *mdsc,struct ceph_mds_cap_auth *auth, +const struct cred *cred,char *tpath) { -const struct cred *cred =get_current_cred ();u32 caller_uid =from_kuid (&init_user_ns, cred->fsuid);u32 caller_gid =from_kgid (&init_user_ns, cred->fsgid);struct ceph_client *cl = mdsc->fsc->client;
@@ -5734,7 +5734,7 @@ int ceph_mds_check_access(struct ceph_mdfor (i =0 ; i < mdsc->s_cap_auths_num; i++) {struct ceph_mds_cap_auth *s = &mdsc->s_cap_auths[i]; - err =ceph_mds_auth_match (mdsc, s, tpath); + err =ceph_mds_auth_match (mdsc, s, cred, tpath);if (err <0 ) {return err; }else if (err >0 ) {
Greg Kroah-Hartman
maintainerPATCH 73/146 ceph: fix cred leak in ceph_mds_check_access()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
commit c5cf420303256dcd6ff175643e9e9558543c2047 upstream.
get_current_cred() increments the reference counter, but the put_cred() call was missing.
--- fs/ceph/mds_client.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ceph/mds_client.c +3 -0
@@ -5736,6 +5736,7 @@ int ceph_mds_check_access(struct ceph_md err =ceph_mds_auth_match (mdsc, s, cred, tpath);if (err <0 ) { +put_cred (cred);return err; }else if (err >0 ) {/* always follow the last auth caps' permision */
@@ -5751,6 +5752,8 @@ int ceph_mds_check_access(struct ceph_md } } +put_cred (cred); +doutc (cl,"root_squash_perms %d, rw_perms_s %p\n" , root_squash_perms, rw_perms_s);if (root_squash_perms && rw_perms_s ==NULL ) {
Greg Kroah-Hartman
maintainerPATCH 74/146 mtd: spinand: winbond: Fix 512GW and 02JW OOB layout
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
commit c1247de51cab53fc357a73804c11fb4fba55b2d9 upstream.
Both W25N512GW and W25N02JW chips have 64 bytes of OOB and thus cannot use the layout for 128 bytes OOB. Reference the correct layout instead.
--- drivers/mtd/nand/spi/winbond.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mtd/nand/spi/winbond.c +2 -2
@@ -215,7 +215,7 @@ static const struct spinand_info winbond &write_cache_variants, &update_cache_variants), 0, - SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)), + SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)), SPINAND_INFO("W25N512GW", SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x20), NAND_MEMORG(1, 2048, 64, 64, 512, 10, 1, 1, 1),
@@ -224,7 +224,7 @@ static const struct spinand_info winbond &write_cache_variants, &update_cache_variants), 0, - SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)), + SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)), SPINAND_INFO("W25N02KWZEIR", SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x22), NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
Greg Kroah-Hartman
maintainerPATCH 75/146 mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
commit fee9b240916df82a8b07aef0fdfe96785417a164 upstream.
These four chips:
* W25N512GW
* W25N01GW
* W25N01JW
* W25N02JW
all require a single bit of ECC strength and thus feature an on-die Hamming-like ECC engine. There is no point in filling a ->get_status() callback for them because the main ECC status bytes are located in standard places, and retrieving the number of bitflips in case of corrected chunk is both useless and unsupported (if there are bitflips, then there is 1 at most, so no need to query the chip for that).
Without this change, a kernel warning triggers every time a bit flips.
--- drivers/mtd/nand/spi/winbond.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/mtd/nand/spi/winbond.c +8 -8
@@ -201,30 +201,30 @@ static const struct spinand_info winbondSPINAND_INFO ("W25N01JW" ,SPINAND_ID (SPINAND_READID_METHOD_OPCODE_DUMMY ,0xbc ,0x21 ),NAND_MEMORG (1 ,2048 ,64 ,64 ,1024 ,20 ,1 ,1 ,1 ), -NAND_ECCREQ (4 ,512 ), +NAND_ECCREQ (1 ,512 ),SPINAND_INFO_OP_VARIANTS (&read_cache_variants, &write_cache_variants, &update_cache_variants),0 , -SPINAND_ECCINFO (&w25m02gv_ooblayout, w25n02kv_ecc_get_status)), +SPINAND_ECCINFO (&w25m02gv_ooblayout,NULL )),SPINAND_INFO ("W25N02JWZEIF" ,SPINAND_ID (SPINAND_READID_METHOD_OPCODE_DUMMY ,0xbf ,0x22 ),NAND_MEMORG (1 ,2048 ,64 ,64 ,1024 ,20 ,1 ,2 ,1 ), -NAND_ECCREQ (4 ,512 ), +NAND_ECCREQ (1 ,512 ),SPINAND_INFO_OP_VARIANTS (&read_cache_variants, &write_cache_variants, &update_cache_variants),0 , -SPINAND_ECCINFO (&w25m02gv_ooblayout, w25n02kv_ecc_get_status)), +SPINAND_ECCINFO (&w25m02gv_ooblayout,NULL )),SPINAND_INFO ("W25N512GW" ,SPINAND_ID (SPINAND_READID_METHOD_OPCODE_DUMMY ,0xba ,0x20 ),NAND_MEMORG (1 ,2048 ,64 ,64 ,512 ,10 ,1 ,1 ,1 ), -NAND_ECCREQ (4 ,512 ), +NAND_ECCREQ (1 ,512 ),SPINAND_INFO_OP_VARIANTS (&read_cache_variants, &write_cache_variants, &update_cache_variants),0 , -SPINAND_ECCINFO (&w25m02gv_ooblayout, w25n02kv_ecc_get_status)), +SPINAND_ECCINFO (&w25m02gv_ooblayout,NULL )), SPINAND_INFO("W25N02KWZEIR", SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x22), NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
@@ -237,12 +237,12 @@ static const struct spinand_info winbondSPINAND_INFO ("W25N01GWZEIG" ,SPINAND_ID (SPINAND_READID_METHOD_OPCODE_DUMMY ,0xba ,0x21 ),NAND_MEMORG (1 ,2048 ,64 ,64 ,1024 ,20 ,1 ,1 ,1 ), -NAND_ECCREQ (4 ,512 ), +NAND_ECCREQ (1 ,512 ),SPINAND_INFO_OP_VARIANTS (&read_cache_variants, &write_cache_variants, &update_cache_variants),0 , -SPINAND_ECCINFO (&w25m02gv_ooblayout, w25n02kv_ecc_get_status)), +SPINAND_ECCINFO (&w25m02gv_ooblayout,NULL )), SPINAND_INFO("W25N04KV", SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa, 0x23), NAND_MEMORG(1, 2048, 128, 64, 4096, 40, 2, 1, 1),
Greg Kroah-Hartman
maintainerPATCH 76/146 util_macros.h: fix/rework find_closest() macros
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Ardelean <[email protected]>
commit bc73b4186736341ab5cd2c199da82db6e1134e13 upstream.
A bug was found in the find_closest() (find_closest_descending() is also affected after some testing), where for certain values with small progressions, the rounding (done by averaging 2 values) causes an incorrect index to be returned. The rounding issues occur for progressions of 1, 2 and 3. It goes away when the progression/interval between two values is 4 or larger.
It's particularly bad for progressions of 1. For example if there's an array of 'a = { 1, 2, 3 }', using 'find_closest(2, a ...)' would return 0 (the index of '1'), rather than returning 1 (the index of '2'). This means that for exact values (with a progression of 1), find_closest() will misbehave and return the index of the value smaller than the one we're searching for.
For progressions of 2 and 3, the exact values are obtained correctly; but values aren't approximated correctly (as one would expect). Starting with progressions of 4, all seems to be good (one gets what one would expect).
While one could argue that 'find_closest()' should not be used for arrays with progressions of 1 (i.e. '{1, 2, 3, ...}', the macro should still behave correctly.
The bug was found while testing the 'drivers/iio/adc/ad7606.c', specifically the oversampling feature.
For reference, the oversampling values are listed as:
static const unsigned int ad7606_oversampling_avail[7] = {
1, 2, 4, 8, 16, 32, 64,};
When doing:
1. $ echo 1 > /sys/bus/iio/devices/iio\:device0/oversampling_ratio
$ cat /sys/bus/iio/devices/iio\:device0/oversampling_ratio
1 # this is fine
2. $ echo 2 > /sys/bus/iio/devices/iio\:device0/oversampling_ratio
$ cat /sys/bus/iio/devices/iio\:device0/oversampling_ratio
1 # this is wrong; 2 should be returned here
3. $ echo 3 > /sys/bus/iio/devices/iio\:device0/oversampling_ratio
$ cat /sys/bus/iio/devices/iio\:device0/oversampling_ratio
2 # this is fine
4. $ echo 4 > /sys/bus/iio/devices/iio\:device0/oversampling_ratio
$ cat /sys/bus/iio/devices/iio\:device0/oversampling_ratio
4 # this is fine
And from here-on, the values are as correct (one gets what one would
expect.)While writing a kunit test for this bug, a peculiar issue was found for the array in the 'drivers/hwmon/ina2xx.c' & 'drivers/iio/adc/ina2xx-adc.c' drivers. While running the kunit test (for 'ina226_avg_tab' from these drivers):
* idx = find_closest([-1 to 2], ina226_avg_tab, ARRAY_SIZE(ina226_avg_tab));
This returns idx == 0, so value. * idx = find_closest(3, ina226_avg_tab, ARRAY_SIZE(ina226_avg_tab)); This returns idx == 0, value 1; and now one could argue whether 3 is closer to 4 or to 1. This quirk only appears for value '3' in this array, but it seems to be a another rounding issue.
* And from 4 onwards the 'find_closest'() works fine (one gets what one would expect).
This change reworks the find_closest() macros to also check the difference between the left and right elements when 'x'. If the distance to the right is smaller (than the distance to the left), the index is incremented by 1. This also makes redundant the need for using the DIV_ROUND_CLOSEST() macro.
In order to accommodate for any mix of negative + positive values, the internal variables '__fc_x', '__fc_mid_x', '__fc_left' & '__fc_right' are forced to 'long' type. This also addresses any potential bugs/issues with 'x' being of an unsigned type. In those situations any comparison between signed & unsigned would be promoted to a comparison between 2 unsigned numbers; this is especially annoying when '__fc_left' & '__fc_right' underflow.
The find_closest_descending() macro was also reworked and duplicated from the find_closest(), and it is being iterated in reverse. The main reason for this is to get the same indices as 'find_closest()' (but in reverse). The comparison for '__fc_right < __fc_left' favors going the array in ascending order.
For example for array '{ 1024, 512, 256, 128, 64, 16, 4, 1 }' and x = 3, we get:
__fc_mid_x = 2
__fc_left = -1
__fc_right = -2
Then '__fc_right < __fc_left' evaluates to true and '__fc_i++' becomes 7
which is not quite incorrect, but 3 is closer to 4 than to 1.This change has been validated with the kunit from the next patch.
--- include/linux/util_macros.h | 56 +++++++++++++++++++++++++++++++------------- 1 file changed, 40 insertions(+), 16 deletions(-)
include/linux/util_macros.h +40 -16
@@ -4,19 +4,6 @@#include <linux/math.h> -#define __find_closest (x, a, as, op) \ -({ \ - typeof(as) __fc_i, __fc_as = (as) - 1; \ - typeof(x) __fc_x = (x); \ - typeof(*a) const *__fc_a = (a); \ - for (__fc_i = 0; __fc_i < __fc_as; __fc_i++) { \ - if (__fc_x op DIV_ROUND_CLOSEST(__fc_a[__fc_i] + \ - __fc_a[__fc_i + 1], 2)) \ - break; \ - } \ - (__fc_i); \ -}) -/** * find_closest - locate the closest element in a sorted array * @x: The reference value.
@@ -25,8 +12,27 @@* @as: Size of 'a'. * * Returns the index of the element closest to 'x'. +* Note: If using an array of negative numbers (or mixed positive numbers), +* then be sure that 'x' is of a signed-type to get good results. */ -#define find_closest (x, a, as) __find_closest(x, a, as, <=) +#define find_closest (x, a, as) \ +({ \ + typeof(as) __fc_i, __fc_as = (as) - 1; \ + long __fc_mid_x, __fc_x = (x); \ + long __fc_left, __fc_right; \ + typeof(*a) const *__fc_a = (a); \ + for (__fc_i = 0; __fc_i < __fc_as; __fc_i++) { \ + __fc_mid_x = (__fc_a[__fc_i] + __fc_a[__fc_i + 1]) / 2; \ + if (__fc_x <= __fc_mid_x) { \ + __fc_left = __fc_x - __fc_a[__fc_i]; \ + __fc_right = __fc_a[__fc_i + 1] - __fc_x; \ + if (__fc_right < __fc_left) \ + __fc_i++; \ + break; \ + } \ + } \ + (__fc_i); \ +})/** * find_closest_descending - locate the closest element in a sorted array
@@ -36,9 +42,27 @@* @as: Size of 'a'. * * Similar to find_closest() but 'a' is expected to be sorted in descending -* order. +* order. The iteration is done in reverse order, so that the comparison +* of '__fc_right' & '__fc_left' also works for unsigned numbers. */ -#define find_closest_descending (x, a, as) __find_closest(x, a, as, >=) +#define find_closest_descending (x, a, as) \ +({ \ + typeof(as) __fc_i, __fc_as = (as) - 1; \ + long __fc_mid_x, __fc_x = (x); \ + long __fc_left, __fc_right; \ + typeof(*a) const *__fc_a = (a); \ + for (__fc_i = __fc_as; __fc_i >= 1; __fc_i--) { \ + __fc_mid_x = (__fc_a[__fc_i] + __fc_a[__fc_i - 1]) / 2; \ + if (__fc_x <= __fc_mid_x) { \ + __fc_left = __fc_x - __fc_a[__fc_i]; \ + __fc_right = __fc_a[__fc_i - 1] - __fc_x; \ + if (__fc_right < __fc_left) \ + __fc_i--; \ + break; \ + } \ + } \ + (__fc_i); \ +})/** * is_insidevar - check if the @ptr points inside the @var memory range.
Greg Kroah-Hartman
maintainerPATCH 77/146 s390/stacktrace: Use break instead of return statement
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 588a9836a4ef7ec3bfcffda526dfa399637e6cfc upstream.
arch_stack_walk_user_common() contains a return statement instead of a break statement in case store_ip() fails while trying to store a callchain entry of a user space process.
This may lead to a missing pagefault_enable() call.
If this happens any subsequent page fault of the process won't be resolved by the page fault handler and this in turn will lead to the process being killed.
Use a break instead of a return statement to fix this.
--- arch/s390/kernel/stacktrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/stacktrace.c +1 -1
@@ -151,7 +151,7 @@ void arch_stack_walk_user_common(stack_trace_consume_fn consume_entry, void *coobreak ; }if (!store_ip (consume_entry, cookie, entry, perf, ip)) -return ; +break ; first = false; }pagefault_enable ();
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 78/146 scsi: ufs: exynos: Add check inside exynos_ufs_config_smu()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Griffin <[email protected]>
commit c662cedea14efdcf373d8d886ec18019d50e0772 upstream.
Move the EXYNOS_UFS_OPT_UFSPR_SECURE check insideexynos_ufs_config_smu().
This way all call sites will benefit from the check. This fixes a bug currently in the exynos_ufs_resume() path on gs101 as it calls exynos_ufs_config_smu() and we end up accessing registers that can only be accessed from secure world which results in a serror.
--- drivers/ufs/host/ufs-exynos.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/ufs/host/ufs-exynos.c +5 -2
@@ -724,6 +724,9 @@ static void exynos_ufs_config_smu(struct {u32 reg, val; +if (ufs->opts &EXYNOS_UFS_OPT_UFSPR_SECURE ) +return ; +exynos_ufs_disable_auto_ctrl_hcc_save (ufs, &val);/* make encryption disabled by default */
@@ -1440,8 +1443,8 @@ static int exynos_ufs_init(struct ufs_hbif (ret) goto out;exynos_ufs_specify_phy_time_attr (ufs); -if (!(ufs->opts &EXYNOS_UFS_OPT_UFSPR_SECURE )) -exynos_ufs_config_smu (ufs); + +exynos_ufs_config_smu (ufs); hba->host->dma_alignment =DATA_UNIT_SIZE -1 ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 79/146 scsi: ufs: exynos: Fix hibern8 notify callbacks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Griffin <[email protected]>
commit ceef938bbf8b93ba3a218b4adc244cde94b582aa upstream.
v1 of the patch which introduced the ufshcd_vops_hibern8_notify() callback used a bool instead of an enum. In v2 this was updated to an enum based on the review feedback in [1].
ufs-exynos hibernate calls have always been broken upstream as it follows the v1 bool implementation.
--- drivers/ufs/host/ufs-exynos.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/ufs/host/ufs-exynos.c +8 -8
@@ -1487,12 +1487,12 @@ static void exynos_ufs_dev_hw_reset(struhci_writel (ufs,1 <<0 ,HCI_GPIO_OUT ); } -static void exynos_ufs_pre_hibern8 (struct ufs_hba *hba,u8 enter) +static void exynos_ufs_pre_hibern8 (struct ufs_hba *hba,enum uic_cmd_dme cmd) {struct exynos_ufs *ufs =ufshcd_get_variant (hba);struct exynos_ufs_uic_attr *attr = ufs->drv_data->uic_attr; -if (!enter) { +if (cmd ==UIC_CMD_DME_HIBER_EXIT ) {if (ufs->opts &EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL )exynos_ufs_disable_auto_ctrl_hcc (ufs);exynos_ufs_ungate_clks (ufs);
@@ -1520,11 +1520,11 @@ static void exynos_ufs_pre_hibern8(struc } } -static void exynos_ufs_post_hibern8 (struct ufs_hba *hba,u8 enter) +static void exynos_ufs_post_hibern8 (struct ufs_hba *hba,enum uic_cmd_dme cmd) {struct exynos_ufs *ufs =ufshcd_get_variant (hba); -if (!enter) { +if (cmd ==UIC_CMD_DME_HIBER_EXIT ) {u32 cur_mode =0 ;u32 pwrmode;
@@ -1543,7 +1543,7 @@ static void exynos_ufs_post_hibern8(struif (!(ufs->opts &EXYNOS_UFS_OPT_SKIP_CONNECTION_ESTAB ))exynos_ufs_establish_connt (ufs); - }else { + }else if (cmd ==UIC_CMD_DME_HIBER_ENTER ) { ufs->entry_hibern8_t =ktime_get ();exynos_ufs_gate_clks (ufs);if (ufs->opts &EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL )
@@ -1630,15 +1630,15 @@ static int exynos_ufs_pwr_change_notify( }static void exynos_ufs_hibern8_notify (struct ufs_hba *hba, -enum uic_cmd_dme enter, +enum uic_cmd_dme cmd,enum ufs_notify_change_status notify) {switch ((u8 )notify) {case PRE_CHANGE : -exynos_ufs_pre_hibern8 (hba, enter); +exynos_ufs_pre_hibern8 (hba, cmd);break ;case POST_CHANGE : -exynos_ufs_post_hibern8 (hba, enter); +exynos_ufs_post_hibern8 (hba, cmd);break ; } }
Greg Kroah-Hartman
maintainerPATCH 80/146 i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 18599e93e4e814ce146186026c6abf83c14d5798 upstream.
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/i3c/master/svc-i3c-master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i3c/master/svc-i3c-master.c +1 -1
@@ -1827,8 +1827,8 @@ static int svc_i3c_master_probe(struct p rpm_disable:pm_runtime_dont_use_autosuspend (&pdev->dev);pm_runtime_put_noidle (&pdev->dev); -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev); err_disable_clks:svc_i3c_master_unprepare_clks (master);
Greg Kroah-Hartman
maintainerPATCH 81/146 i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
commit 3082990592f7c6d7510a9133afa46e31bbe26533 upstream.
if (dev->boardinfo && dev->boardinfo->init_dyn_addr)
^^^ here check "init_dyn_addr" i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...) ^^^^ free "dyn_addr"
Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr".
--- drivers/i3c/master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i3c/master.c +1 -1
@@ -1417,7 +1417,7 @@ static void i3c_master_put_i3c_addrs(str I3C_ADDR_SLOT_FREE);if (dev->boardinfo && dev->boardinfo->init_dyn_addr) -i3c_bus_set_addr_slot_status (&master->bus, dev->info.dyn_addr, +i3c_bus_set_addr_slot_status (&master->bus, dev->boardinfo->init_dyn_addr,I3C_ADDR_SLOT_FREE ); }
Greg Kroah-Hartman
maintainerPATCH 82/146 i3c: master: svc: fix possible assignment of the same address to two devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
commit 3b2ac810d86eb96e882db80a3320a3848b133208 upstream.
svc_i3c_master_do_daa() {
...
for (i = 0; i < dev_nb; i++) {
ret = i3c_master_add_i3c_dev_locked(m, addrs[i]);
if (ret)
goto rpm_out;
}
}If two devices (A and B) are detected in DAA and address 0xa is assigned to device A and 0xb to device B, a failure in i3c_master_add_i3c_dev_locked() for device A (addr: 0xa) could prevent device B (addr: 0xb) from being registered on the bus. The I3C stack might still consider 0xb a free address. If a subsequent Hotjoin occurs, 0xb might be assigned to Device A, causing both devices A and B to use the same address 0xb, violating the I3C specification.
The return value for i3c_master_add_i3c_dev_locked() should not be checked because subsequent steps will scan the entire I3C bus, independent of whether i3c_master_add_i3c_dev_locked() returns success.
If device A registration fails, there is still a chance to register device B. i3c_master_add_i3c_dev_locked() can reset DAA if a failure occurs while retrieving device information.
--- drivers/i3c/master/svc-i3c-master.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-)
drivers/i3c/master/svc-i3c-master.c +21 -6
@@ -1056,12 +1056,27 @@ static int svc_i3c_master_do_daa(structif (ret) goto rpm_out; -/* Register all devices who participated to the core */ -for (i =0 ; i < dev_nb; i++) { - ret =i3c_master_add_i3c_dev_locked (m, addrs[i]); -if (ret) - goto rpm_out; - } +/* +* Register all devices who participated to the core +* +* If two devices (A and B) are detected in DAA and address 0xa is assigned to +* device A and 0xb to device B, a failure in i3c_master_add_i3c_dev_locked() +* for device A (addr: 0xa) could prevent device B (addr: 0xb) from being +* registered on the bus. The I3C stack might still consider 0xb a free +* address. If a subsequent Hotjoin occurs, 0xb might be assigned to Device A, +* causing both devices A and B to use the same address 0xb, violating the I3C +* specification. +* +* The return value for i3c_master_add_i3c_dev_locked() should not be checked +* because subsequent steps will scan the entire I3C bus, independent of +* whether i3c_master_add_i3c_dev_locked() returns success. +* +* If device A registration fails, there is still a chance to register device +* B. i3c_master_add_i3c_dev_locked() can reset DAA if a failure occurs while +* retrieving device information. +*/ +for (i =0 ; i < dev_nb; i++) +i3c_master_add_i3c_dev_locked (m, addrs[i]);/* Configure IBI auto-rules */ ret =svc_i3c_update_ibirules (master);
Greg Kroah-Hartman
maintainerPATCH 83/146 i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
commit 25bc99be5fe53853053ceeaa328068c49dc1e799 upstream.
Fix issue where disabling IBI on one device disables the entire IBI interrupt. Modify bit 7:0 of enabled_events to serve as an IBI enable counter, ensuring that the system IBI interrupt is disabled only when all I3C devices have IBI disabled.
--- drivers/i3c/master/svc-i3c-master.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/i3c/master/svc-i3c-master.c +5 -5
@@ -130,8 +130,8 @@#define SVC_I3C_PPBAUD_MAX 15#define SVC_I3C_QUICK_I2C_CLK 4170000 -#define SVC_I3C_EVENT_IBI BIT(0) -#define SVC_I3C_EVENT_HOTJOIN BIT(1) +#define SVC_I3C_EVENT_IBI GENMASK(7, 0) +#define SVC_I3C_EVENT_HOTJOIN BIT(31)struct svc_i3c_cmd {u8 addr;
@@ -214,7 +214,7 @@ struct svc_i3c_master {spinlock_t lock; } ibi;struct mutex lock; -int enabled_events; +u32 enabled_events;u32 mctrl_config; };
@@ -1639,7 +1639,7 @@ static int svc_i3c_master_enable_ibi(strreturn ret; } - master->enabled_events |=SVC_I3C_EVENT_IBI ; + master->enabled_events++;svc_i3c_master_enable_interrupts (master,SVC_I3C_MINT_SLVSTART );return i3c_master_enec_locked (m, dev->info.dyn_addr,I3C_CCC_EVENT_SIR );
@@ -1651,7 +1651,7 @@ static int svc_i3c_master_disable_ibi(ststruct svc_i3c_master *master =to_svc_i3c_master (m);int ret; - master->enabled_events &= ~SVC_I3C_EVENT_IBI ; + master->enabled_events--;if (!master->enabled_events)svc_i3c_master_disable_interrupts (master);
Greg Kroah-Hartman
maintainerPATCH 84/146 PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kishon Vijay Abraham I <[email protected]>
commit 5a938ed9481b0c06cb97aec45e722a80568256fd upstream.
commit 23284ad677a9 ("PCI: keystone: Add support for PCIe EP in AM654x Platforms") introduced configuring "enum dw_pcie_device_mode" as part of device data ("struct ks_pcie_of_data"). However it failed to set the mode for "ti,keystone-pcie" compatible.
Since the mode defaults to "DW_PCIE_UNKNOWN_TYPE", the following error message is displayed for the v3.65a controller:
"INVALID device type 0"
Despite the driver probing successfully, the controller may not be functional in the Root Complex mode of operation.
So, set the mode as Root Complex for "ti,keystone-pcie" compatible to fix this.
--- drivers/pci/controller/dwc/pci-keystone.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/controller/dwc/pci-keystone.c +1 -0
@@ -1093,6 +1093,7 @@ static int ks_pcie_am654_set_mode(structstatic const struct ks_pcie_of_data ks_pcie_rc_of_data = { .host_ops = &ks_pcie_host_ops, + .mode =DW_PCIE_RC_TYPE , .version =DW_PCIE_VER_365A , };
Greg Kroah-Hartman
maintainerPATCH 85/146 PCI: keystone: Add link up check to ks_pcie_other_map_bus()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kishon Vijay Abraham I <[email protected]>
commit 9e9ec8d8692a6f64d81ef67d4fb6255af6be684b upstream.
K2G forwards the error triggered by a link-down state (e.g., no connected endpoint device) on the system bus for PCI configuration transactions; these errors are reported as an SError at system level, which is fatal and hangs the system.
So, apply fix similar to how it was done in the DesignWare Core driver commit 15b23906347c ("PCI: dwc: Add link up check in dw_child_pcie_ops.map_bus()").
--- drivers/pci/controller/dwc/pci-keystone.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/pci/controller/dwc/pci-keystone.c +11 -0
@@ -455,6 +455,17 @@ static void __iomem *ks_pcie_other_map_bstruct keystone_pcie *ks_pcie =to_keystone_pcie (pci);u32 reg; +/* +* Checking whether the link is up here is a last line of defense +* against platforms that forward errors on the system bus as +* SError upon PCI configuration transactions issued when the link +* is down. This check is racy by definition and does not stop +* the system from triggering an SError if the link goes down +* after this check is performed. +*/ +if (!dw_pcie_link_up (pci)) +return NULL ; + reg =CFG_BUS (bus->number) |CFG_DEVICE (PCI_SLOT (devfn)) |CFG_FUNC (PCI_FUNC (devfn));if (!pci_is_root_bus (bus->parent))
Greg Kroah-Hartman
maintainerPATCH 86/146 PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
commit 4acc902ed3743edd4ac2d3846604a99d17104359 upstream.
pci_epc_destroy() invokes pci_bus_release_domain_nr() to release the PCI domain ID, but there are two issues:
- 'epc->dev' is passed to pci_bus_release_domain_nr() which was already freed by device_unregister(), leading to a use-after-free issue.
- Domain ID corresponds to the EPC device parent, so passing 'epc->dev' is also wrong.
Fix these issues by passing 'epc->dev.parent' to pci_bus_release_domain_nr() and also do it before device_unregister().
--- drivers/pci/endpoint/pci-epc-core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/pci/endpoint/pci-epc-core.c +2 -3
@@ -837,11 +837,10 @@ EXPORT_SYMBOL_GPL(pci_epc_bus_master_enavoid pci_epc_destroy (struct pci_epc *epc) {pci_ep_cfs_remove_epc_group (epc->group); -device_unregister (&epc->dev); -#ifdef CONFIG_PCI_DOMAINS_GENERIC -pci_bus_release_domain_nr (&epc->dev, epc->domain_nr); +pci_bus_release_domain_nr (epc->dev.parent, epc->domain_nr);#endif +device_unregister (&epc->dev); }EXPORT_SYMBOL_GPL (pci_epc_destroy);
Greg Kroah-Hartman
maintainerPATCH 87/146 PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
commit 688d2eb4c6fcfdcdaed0592f9df9196573ff5ce2 upstream.
In addition to a primary endpoint controller, an endpoint function may be associated with a secondary endpoint controller, epf->sec_epc, to provide NTB (non-transparent bridge) functionality.
Previously, pci_epc_remove_epf() incorrectly cleared epf->epc instead of epf->sec_epc when removing from the secondary endpoint controller.
Extend the epc->list_lock coverage and clear either epf->epc or epf->sec_epc as indicated.
--- drivers/pci/endpoint/pci-epc-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pci/endpoint/pci-epc-core.c +3 -3
@@ -660,18 +660,18 @@ void pci_epc_remove_epf(struct pci_epc *if (IS_ERR_OR_NULL (epc) || !epf)return ; +mutex_lock (&epc->list_lock);if (type ==PRIMARY_INTERFACE ) { func_no = epf->func_no; list = &epf->list; + epf->epc =NULL ; }else { func_no = epf->sec_epc_func_no; list = &epf->sec_epc_list; + epf->sec_epc =NULL ; } - -mutex_lock (&epc->list_lock);clear_bit (func_no, &epc->function_num_map);list_del (list); - epf->epc =NULL ;mutex_unlock (&epc->list_lock); }EXPORT_SYMBOL_GPL (pci_epc_remove_epf);
Greg Kroah-Hartman
maintainerPATCH 88/146 slab: Fix too strict alignment check in create_cache()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit 9008fe8fad8255edfdbecea32d7eb0485d939d0d upstream.
On m68k, where the minimum alignment of unsigned long is 2 bytes:
Kernel panic - not syncing: __kmem_cache_create_args: Failed to create slab 'io_kiocb'. Error -22
CPU: 0 UID: 0 PID: 1 Comm: swapper Not tainted 6.12.0-atari-03776-g7eaa1f99261a #1783
Stack from 0102fe5c:
0102fe5c 00514a2b 00514a2b ffffff00 00000001 0051f5ed 00425e78 00514a2b
0041eb74 ffffffea 00000310 0051f5ed ffffffea ffffffea 00601f60 00000044
0102ff20 000e7a68 0051ab8e 004383b8 0051f5ed ffffffea 000000b8 00000007
01020c00 00000000 000e77f0 0041e5f0 005f67c0 0051f5ed 000000b6 0102fef4
00000310 0102fef4 00000000 00000016 005f676c 0060a34c 00000010 00000004
00000038 0000009a 01000000 000000b8 005f668e 0102e000 00001372 0102ff88
Call Trace: [<00425e78>] dump_stack+0xc/0x10
[<0041eb74>] panic+0xd8/0x26c
[<000e7a68>] __kmem_cache_create_args+0x278/0x2e8
[<000e77f0>] __kmem_cache_create_args+0x0/0x2e8
[<0041e5f0>] memset+0x0/0x8c
[<005f67c0>] io_uring_init+0x54/0xd2The minimal alignment of an integral type may differ from its size, hence is not safe to assume that an arbitrary freeptr_t (which is basically an unsigned long) is always aligned to 4 or 8 bytes.
As nothing seems to require the additional alignment, it is safe to fix this by relaxing the check to the actual minimum alignment of freeptr_t.
--- mm/slab_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/slab_common.c +1 -1
@@ -230,7 +230,7 @@ static struct kmem_cache *create_cache(cif (args->use_freeptr_offset && (args->freeptr_offset >= object_size || !(flags &SLAB_TYPESAFE_BY_RCU ) || - !IS_ALIGNED (args->freeptr_offset,sizeof (freeptr_t)))) + !IS_ALIGNED (args->freeptr_offset, __alignof__(freeptr_t )))) goto out; err = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 89/146 fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
commit 088f294609d8f8816dc316681aef2eb61982e0da upstream.
If iov_iter_zero succeeds after failed copy_from_kernel_nofault, we need to reset the ret value to zero otherwise it will be returned as final return value of read_kcore_iter.
This fixes objdump -d dump over /proc/kcore for me.
--- fs/proc/kcore.c | 1 + 1 file changed, 1 insertion(+)
fs/proc/kcore.c +1 -0
@@ -600,6 +600,7 @@ static ssize_t read_kcore_iter(struct ki ret = -EFAULT ; goto out; } + ret =0 ;/* * We know the bounce buffer is safe to copy from, so * use _copy_to_iter() directly.
Greg Kroah-Hartman
maintainerPATCH 90/146 thermal: int3400: Fix reading of current_uuid for active policy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 7082503622986537f57bdb5ef23e69e70cfad881 upstream.
When the current_uuid attribute is set to the active policy UUID, reading back the same attribute is returning "INVALID" instead of the active policy UUID on some platforms before Ice Lake.
In platforms before Ice Lake, firmware provides a list of supported thermal policies. In this case, user space can select any of the supported thermal policies via a write to attribute "current_uuid".
In commit c7ff29763989 ("thermal: int340x: Update OS policy capability handshake")', the OS policy handshake was updated to support Ice Lake and later platforms and it treated priv->current_uuid_index=0 as invalid. However, priv->current_uuid_index=0 is for the active policy, only priv->current_uuid_index=-1 is invalid.
Fix this issue by updating the priv->current_uuid_index check.
--- drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/intel/int340x_thermal/int3400_thermal.c +1 -1
@@ -137,7 +137,7 @@ static ssize_t current_uuid_show(structstruct int3400_thermal_priv *priv =dev_get_drvdata (dev);int i, length =0 ; -if (priv->current_uuid_index >0 ) +if (priv->current_uuid_index >=0 )return sprintf (buf,"%s\n" , int3400_thermal_uuids[priv->current_uuid_index]);
Greg Kroah-Hartman
maintainerPATCH 91/146 leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 73b03b27736e440e3009fe1319cbc82d2cd1290c upstream.
The device_for_each_child_node() macro requires explicit calls to fwnode_handle_put() upon early exits to avoid memory leaks, and in this case the error paths are handled after jumping to 'out_flash_realease', which misses that required call to to decrement the refcount of the child node.
A more elegant and robust solution is using the scoped variant of the loop, which automatically handles such early exits.
Fix the child node refcounting in the error paths by using device_for_each_child_node_scoped().
--- drivers/leds/flash/leds-mt6360.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/leds/flash/leds-mt6360.c +1 -2
@@ -784,7 +784,6 @@ static void mt6360_v4l2_flash_release(ststatic int mt6360_led_probe (struct platform_device *pdev) {struct mt6360_priv *priv; -struct fwnode_handle *child;size_t count;int i =0 , ret;
@@ -811,7 +810,7 @@ static int mt6360_led_probe(struct platfreturn -ENODEV ; } -device_for_each_child_node (&pdev->dev, child) { +device_for_each_child_node_scoped (&pdev->dev, child) {struct mt6360_led *led = priv->leds + i;struct led_init_data init_data = { .fwnode = child, };u32 reg, led_color;
Greg Kroah-Hartman
maintainerPATCH 92/146 ovl: properly handle large files in ovl_security_fileattr
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Tymoshenko <[email protected]>
commit 3b6b99ef15ea37635604992ede9ebcccef38a239 upstream.
dentry_open in ovl_security_fileattr fails for any file larger than 2GB if open method of the underlying filesystem calls generic_file_open (e.g. fusefs).
The issue can be reproduce using the following script:
(passthrough_ll is an example app from libfuse).
$ D=/opt/test/mnt
$ mkdir -p ${D}/{source,base,top/uppr,top/work,ovlfs}
$ dd if=/dev/zero of=${D}/source/zero.bin bs=1G count=2
$ passthrough_ll -o source=${D}/source ${D}/base
$ mount -t overlay overlay \
-olowerdir=${D}/base,upperdir=${D}/top/uppr,workdir=${D}/top/work \
${D}/ovlfs
$ chmod 0777 ${D}/mnt/ovlfs/zero.binRunning this script results in "Value too large for defined data type" error message from chmod.
--- fs/overlayfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/overlayfs/inode.c +6 -1
@@ -616,8 +616,13 @@ static int ovl_security_fileattr(const sstruct file *file;unsigned int cmd;int err; +unsigned int flags; - file =dentry_open (realpath,O_RDONLY ,current_cred ()); + flags =O_RDONLY ; +if (force_o_largefile ()) + flags |=O_LARGEFILE ; + + file =dentry_open (realpath, flags,current_cred ());if (IS_ERR (file))return PTR_ERR (file);
Greg Kroah-Hartman
maintainerPATCH 93/146 mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Huang <[email protected]>
commit 9e9e085effe9b7e342138fde3cf8577d22509932 upstream.
When compiling kernel source 'make -j $(nproc)' with the up-and-running KASAN-enabled kernel on a 256-core machine, the following soft lockup is shown:
watchdog: BUG: soft lockup - CPU#28 stuck for 22s! [kworker/28:1:1760] CPU: 28 PID: 1760 Comm: kworker/28:1 Kdump: loaded Not tainted 6.10.0-rc5 #95 Workqueue: events drain_vmap_area_work RIP: 0010:smp_call_function_many_cond+0x1d8/0xbb0 Code: 38 c8 7c 08 84 c9 0f 85 49 08 00 00 8b 45 08 a8 01 74 2e 48 89 f1 49 89 f7 48 c1 e9 03 41 83 e7 07 4c 01 e9 41 83 c7 03 f3 90 <0f> b6 01 41 38 c7 7c 08 84 c0 0f 85 d4 06 00 00 8b 45 08 a8 01 75 RSP: 0018:ffffc9000cb3fb60 EFLAGS: 00000202 RAX: 0000000000000011 RBX: ffff8883bc4469c0 RCX: ffffed10776e9949 RDX: 0000000000000002 RSI: ffff8883bb74ca48 RDI: ffffffff8434dc50 RBP: ffff8883bb74ca40 R08: ffff888103585dc0 R09: ffff8884533a1800 R10: 0000000000000004 R11: ffffffffffffffff R12: ffffed1077888d39 R13: dffffc0000000000 R14: ffffed1077888d38 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8883bc400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005577b5c8d158 CR3: 0000000004850000 CR4: 0000000000350ef0 Call Trace: <IRQ> ? watchdog_timer_fn+0x2cd/0x390 ? __pfx_watchdog_timer_fn+0x10/0x10 ? __hrtimer_run_queues+0x300/0x6d0 ? sched_clock_cpu+0x69/0x4e0 ? __pfx___hrtimer_run_queues+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? ktime_get_update_offsets_now+0x7f/0x2a0 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? hrtimer_interrupt+0x2ca/0x760 ? __sysvec_apic_timer_interrupt+0x8c/0x2b0 ? sysvec_apic_timer_interrupt+0x6a/0x90 </IRQ> <TASK> ? asm_sysvec_apic_timer_interrupt+0x16/0x20 ? smp_call_function_many_cond+0x1d8/0xbb0 ? __pfx_do_kernel_range_flush+0x10/0x10 on_each_cpu_cond_mask+0x20/0x40 flush_tlb_kernel_range+0x19b/0x250 ? srso_return_thunk+0x5/0x5f ? kasan_release_vmalloc+0xa7/0xc0 purge_vmap_node+0x357/0x820 ? __pfx_purge_vmap_node+0x10/0x10 __purge_vmap_area_lazy+0x5b8/0xa10 drain_vmap_area_work+0x21/0x30 process_one_work+0x661/0x10b0 worker_thread+0x844/0x10e0 ? srso_return_thunk+0x5/0x5f ? __kthread_parkme+0x82/0x140 ? __pfx_worker_thread+0x10/0x10 kthread+0x2a5/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Debugging Analysis:
1. The following ftrace log shows that the lockup CPU spends too much time iterating vmap_nodes and flushing TLB when purging vm_area structures. (Some info is trimmed).
kworker: funcgraph_entry: | drain_vmap_area_work() {
kworker: funcgraph_entry: | mutex_lock() {
kworker: funcgraph_entry: 1.092 us | __cond_resched();
kworker: funcgraph_exit: 3.306 us | }
... ...
kworker: funcgraph_entry: | flush_tlb_kernel_range() {
... ...
kworker: funcgraph_exit: # 7533.649 us | }
... ...
kworker: funcgraph_entry: 2.344 us | mutex_unlock();
kworker: funcgraph_exit: $ 23871554 us | }
The drain_vmap_area_work() spends over 23 seconds.
There are 2805 flush_tlb_kernel_range() calls in the ftrace log.
* One is called in __purge_vmap_area_lazy().
* Others are called by purge_vmap_node->kasan_release_vmalloc. purge_vmap_node() iteratively releases kasan vmalloc allocations and flushes TLB for each vmap_area.
- [Rough calculation] Each flush_tlb_kernel_range() runs about 7.5ms.
-- 2804 * 7.5ms = 21.03 seconds.
-- That's why a soft lock is triggered.
2. Extending the soft lockup time can work around the issue (For example,
# echo 60 > /proc/sys/kernel/watchdog_thresh). This confirms the
above-mentioned speculation: drain_vmap_area_work() spends too much
time.If we combine all TLB flush operations of the KASAN shadow virtual address into one operation in the call path 'purge_vmap_node()->kasan_release_vmalloc()', the running time of drain_vmap_area_work() can be saved greatly. The idea is from the flush_tlb_kernel_range() call in __purge_vmap_area_lazy(). And, the soft lockup won't be triggered.
Here is the test result based on 6.10:
[6.10 wo/ the patch]
1. ftrace latency profiling (record a trace if the latency > 20s). echo 20000000 > /sys/kernel/debug/tracing/tracing_thresh echo drain_vmap_area_work > /sys/kernel/debug/tracing/set_graph_function echo function_graph > /sys/kernel/debug/tracing/current_tracer echo 1 > /sys/kernel/debug/tracing/tracing_on
2. Run make -j $(nproc) to compile the kernel source
3. Once the soft lockup is reproduced, check the ftrace log:
cat /sys/kernel/debug/tracing/trace
# tracer: function_graph
#
# CPU DURATION FUNCTION CALLS
# | | | | | | |
76) $ 50412985 us | } /* __purge_vmap_area_lazy */
76) $ 50412997 us | } /* drain_vmap_area_work */
76) $ 29165911 us | } /* __purge_vmap_area_lazy */
76) $ 29165926 us | } /* drain_vmap_area_work */
91) $ 53629423 us | } /* __purge_vmap_area_lazy */
91) $ 53629434 us | } /* drain_vmap_area_work */
91) $ 28121014 us | } /* __purge_vmap_area_lazy */
91) $ 28121026 us | } /* drain_vmap_area_work */
[6.10 w/ the patch]
1. Repeat step 1-2 in "[6.10 wo/ the patch]"
2. The soft lockup is not triggered and ftrace log is empty. cat /sys/kernel/debug/tracing/trace
# tracer: function_graph
#
# CPU DURATION FUNCTION CALLS
# | | | | | | |
3. Setting 'tracing_thresh' to 10/5 seconds does not get any ftrace log.
4. Setting 'tracing_thresh' to 1 second gets ftrace log. cat /sys/kernel/debug/tracing/trace
# tracer: function_graph
#
# CPU DURATION FUNCTION CALLS
# | | | | | | |
23) $ 1074942 us | } /* __purge_vmap_area_lazy */
23) $ 1074950 us | } /* drain_vmap_area_work */
The worst execution time of drain_vmap_area_work() is about 1 second.
--- include/linux/kasan.h | 12 +++++++++--- mm/kasan/shadow.c | 14 ++++++++++---- mm/vmalloc.c | 34 ++++++++++++++++++++++++++-------- 3 files changed, 45 insertions(+), 15 deletions(-)
include/linux/kasan.h +9 -3
@@ -29,6 +29,9 @@ typedef unsigned int __bitwise kasan_vmalloc_flags_t;#define KASAN_VMALLOC_VM_ALLOC ((__force kasan_vmalloc_flags_t)0x02u)#define KASAN_VMALLOC_PROT_NORMAL ((__force kasan_vmalloc_flags_t)0x04u) +#define KASAN_VMALLOC_PAGE_RANGE 0x1/* Apply exsiting page range */ +#define KASAN_VMALLOC_TLB_FLUSH 0x2/* TLB flush */ +#if defined(CONFIG_KASAN_GENERIC ) || defined(CONFIG_KASAN_SW_TAGS )#include <linux/pgtable.h>
@@ -564,7 +567,8 @@ void kasan_populate_early_vm_area_shadow(void *start, unsigned long size);int kasan_populate_vmalloc (unsigned long addr,unsigned long size);void kasan_release_vmalloc (unsigned long start,unsigned long end,unsigned long free_region_start, -unsigned long free_region_end); +unsigned long free_region_end, +unsigned long flags);#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
@@ -579,7 +583,8 @@ static inline int kasan_populate_vmalloc(unsigned long start,static inline void kasan_release_vmalloc (unsigned long start,unsigned long end,unsigned long free_region_start, -unsigned long free_region_end) { } +unsigned long free_region_end, +unsigned long flags) { }#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
@@ -614,7 +619,8 @@ static inline int kasan_populate_vmalloc(unsigned long start,static inline void kasan_release_vmalloc (unsigned long start,unsigned long end,unsigned long free_region_start, -unsigned long free_region_end) { } +unsigned long free_region_end, +unsigned long flags) { } static inline void *kasan_unpoison_vmalloc(const void *start, unsigned long size,
mm/kasan/shadow.c +10 -4
@@ -489,7 +489,8 @@ static int kasan_depopulate_vmalloc_pte(pte_t *ptep, unsigned long addr,*/ void kasan_release_vmalloc (unsigned long start,unsigned long end,unsigned long free_region_start, -unsigned long free_region_end) +unsigned long free_region_end, +unsigned long flags) {void *shadow_start, *shadow_end;unsigned long region_start, region_end;
@@ -522,12 +523,17 @@ void kasan_release_vmalloc(unsigned long start, unsigned long end,__memset (shadow_start,KASAN_SHADOW_INIT , shadow_end - shadow_start);return ; } -apply_to_existing_page_range (&init_mm, + + +if (flags &KASAN_VMALLOC_PAGE_RANGE ) +apply_to_existing_page_range (&init_mm, (unsigned long )shadow_start, size, kasan_depopulate_vmalloc_pte,NULL ); -flush_tlb_kernel_range ((unsigned long )shadow_start, - (unsigned long )shadow_end); + +if (flags &KASAN_VMALLOC_TLB_FLUSH ) +flush_tlb_kernel_range ((unsigned long )shadow_start, + (unsigned long )shadow_end); } }
mm/vmalloc.c +26 -8
@@ -2182,6 +2182,25 @@ decay_va_pool_node(struct vmap_node *vn, bool full_decay)reclaim_list_global (&decay_list); } +static void +kasan_release_vmalloc_node (struct vmap_node *vn) +{ +struct vmap_area *va; +unsigned long start, end; + + start = list_first_entry(&vn->purge_list, struct vmap_area, list)->va_start; + end = list_last_entry(&vn->purge_list, struct vmap_area, list)->va_end; + +list_for_each_entry (va, &vn->purge_list, list) { +if (is_vmalloc_or_module_addr ((void *) va->va_start)) +kasan_release_vmalloc (va->va_start, va->va_end, + va->va_start, va->va_end, +KASAN_VMALLOC_PAGE_RANGE ); + } + +kasan_release_vmalloc (start, end, start, end,KASAN_VMALLOC_TLB_FLUSH ); +} +static void purge_vmap_node (struct work_struct *work) { struct vmap_node *vn = container_of(work,
@@ -2190,20 +2209,17 @@ static void purge_vmap_node(struct work_struct *work)struct vmap_area *va, *n_va;LIST_HEAD (local_list); +if (IS_ENABLED (CONFIG_KASAN_VMALLOC )) +kasan_release_vmalloc_node (vn); + vn->nr_purged =0 ;list_for_each_entry_safe (va, n_va, &vn->purge_list, list) {unsigned long nr =va_size (va) >>PAGE_SHIFT ; -unsigned long orig_start = va->va_start; -unsigned long orig_end = va->va_end;unsigned int vn_id =decode_vn_id (va->flags);list_del_init (&va->list); -if (is_vmalloc_or_module_addr ((void *)orig_start)) -kasan_release_vmalloc (orig_start, orig_end, - va->va_start, va->va_end); - nr_purged_pages += nr; vn->nr_purged++;
@@ -4784,7 +4800,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, &free_vmap_area_list);if (va)kasan_release_vmalloc (orig_start, orig_end, - va->va_start, va->va_end); + va->va_start, va->va_end, +KASAN_VMALLOC_PAGE_RANGE |KASAN_VMALLOC_TLB_FLUSH ); vas[area] =NULL ; }
@@ -4834,7 +4851,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, &free_vmap_area_list);if (va)kasan_release_vmalloc (orig_start, orig_end, - va->va_start, va->va_end); + va->va_start, va->va_end, +KASAN_VMALLOC_PAGE_RANGE |KASAN_VMALLOC_TLB_FLUSH ); vas[area] =NULL ;kfree (vms[area]); }
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 94/146 dm: Fix typo in error message
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ssuhung Yeh <[email protected]>
commit 2deb70d3e66d538404d9e71bff236e6d260da66e upstream.
Remove the redundant "i" at the beginning of the error message. This "i" came from commit 1c1318866928 ("dm: prefer
'"%s...", __func__'"), the "i" is accidentally left.
--- drivers/md/persistent-data/dm-space-map-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/persistent-data/dm-space-map-common.c +1 -1
@@ -51,7 +51,7 @@ static int index_check(const struct dm_b block_size -sizeof (__le32), INDEX_CSUM_XOR));if (csum_disk != mi_le->csum) { -DMERR_LIMIT ("i%s failed: csum %u != wanted %u" , __func__, +DMERR_LIMIT ("%s failed: csum %u != wanted %u" , __func__,le32_to_cpu (csum_disk),le32_to_cpu (mi_le->csum));return -EILSEQ ; }
Greg Kroah-Hartman
maintainerPATCH 95/146 dm thin: Add missing destroy_work_on_stack()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
commit e74fa2447bf9ed03d085b6d91f0256cc1b53f1a8 upstream.
This commit add missed destroy_work_on_stack() operations for pw->worker in pool_work_wait().
--- drivers/md/dm-thin.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/dm-thin.c +1 -0
@@ -2484,6 +2484,7 @@ static void pool_work_wait(struct pool_winit_completion (&pw->complete);queue_work (pool->wq, &pw->worker);wait_for_completion (&pw->complete); +destroy_work_on_stack (&pw->worker); }/*----------------------------------------------------------------*/
Greg Kroah-Hartman
maintainerPATCH 96/146 PCI: dwc: ep: Fix advertised resizable BAR size regression
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit 118397c9baaac0b7ec81896f8d755d09aa82c485 upstream.
The advertised resizable BAR size was fixed in commit 72e34b8593e0 ("PCI:
dwc: endpoint: Fix advertised resizable BAR size").
Commit 867ab111b242 ("PCI: dwc: ep: Add a generic dw_pcie_ep_linkdown() API to handle Link Down event") was included shortly after this, and moved the code to another function. When the code was moved, this fix was mistakenly lost.
According to the spec, it is illegal to not have a bit set in PCI_REBAR_CAP, and 1 MB is the smallest size allowed.
So, set bit 4 in PCI_REBAR_CAP, so that we actually advertise support for a 1 MB BAR size.
--- drivers/pci/controller/dwc/pcie-designware-ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-designware-ep.c +1 -1
@@ -689,7 +689,7 @@ static void dw_pcie_ep_init_non_sticky_r* for 1 MB BAR size only. */ for (i =0 ; i < nbars; i++, offset +=PCI_REBAR_CTRL ) -dw_pcie_writel_dbi (pci, offset +PCI_REBAR_CAP ,0x0 ); +dw_pcie_writel_dbi (pci, offset +PCI_REBAR_CAP ,BIT (4 )); }dw_pcie_setup (pci);
Greg Kroah-Hartman
maintainerPATCH 97/146 PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea della Porta <[email protected]>
commit 5e316d34b53039346e252d0019e2f4167af2c0ef upstream.
When populating "ranges" property for a PCI bridge or endpoint, of_pci_prop_ranges() incorrectly uses the CPU address of the resource. In such PCI nodes, the window should instead be in PCI address space. Call pci_bus_address() on the resource in order to obtain the PCI bus address.
[Previous discussion at:
https://lore.kernel.org/all/8b4fa91380fc4754ea80f47330c613e4f6b6592c.1724159867.git.andrea.porta@suse.com/]
--- drivers/pci/of_property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/of_property.c +1 -1
@@ -126,7 +126,7 @@ static int of_pci_prop_ranges(struct pciif (of_pci_get_addr_flags (&res[j], &flags))continue ; - val64 = res[j].start; + val64 =pci_bus_address (pdev, &res[j] - pdev->resource);of_pci_set_address (pdev, rp[i].parent_addr, val64,0 , flags, false);if (pci_is_bridge (pdev)) {
Greg Kroah-Hartman
maintainerPATCH 98/146 PCI: rockchip-ep: Fix address translation unit programming
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 64f093c4d99d797b68b407a9d8767aadc3e3ea7a upstream.
The Rockchip PCIe endpoint controller handles PCIe transfers addresses by masking the lower bits of the programmed PCI address and using the same number of lower bits masked from the CPU address space used for the mapping. For a PCI mapping of <size> bytes starting from <pci_addr>, the number of bits masked is the number of address bits changing in the address range [pci_addr..pci_addr + size - 1].
However, rockchip_pcie_prog_ep_ob_atu() calculates num_pass_bits only using the size of the mapping, resulting in an incorrect number of mask bits depending on the value of the PCI address to map.
Fix this by introducing the helper function rockchip_pcie_ep_ob_atu_num_bits() to correctly calculate the number of mask bits to use to program the address translation unit. The number of mask bits is calculated depending on both the PCI address and size of the mapping, and clamped between 8 and 20 using the macros ROCKCHIP_PCIE_AT_MIN_NUM_BITS and ROCKCHIP_PCIE_AT_MAX_NUM_BITS. As defined in the Rockchip RK3399 TRM V1.3 Part2, Sections 17.5.5.1.1 and 17.6.8.2.1, this clamping is necessary because:
1) The lower 8 bits of the PCI address to be mapped by the outbound region are ignored. So a minimum of 8 address bits are needed and imply that the PCI address must be aligned to 256.
2) The outbound memory regions are 1MB in size. So while we can specify up to 63-bits for the PCI address (num_bits filed uses bits 0 to 5 of the outbound address region 0 register), we must limit the number of valid address bits to 20 to match the memory window maximum size (1 << 20 = 1MB).
--- drivers/pci/controller/pcie-rockchip-ep.c | 16 +++++++++++++--- drivers/pci/controller/pcie-rockchip.h | 4 ++++ 2 files changed, 17 insertions(+), 3 deletions(-)
drivers/pci/controller/pcie-rockchip-ep.c +13 -3
@@ -63,15 +63,25 @@ static void rockchip_pcie_clear_ep_ob_at ROCKCHIP_PCIE_AT_OB_REGION_DESC1(region)); } +static int rockchip_pcie_ep_ob_atu_num_bits (struct rockchip_pcie *rockchip, +u64 pci_addr,size_t size) +{ +int num_pass_bits =fls64 (pci_addr ^ (pci_addr + size -1 )); + +return clamp (num_pass_bits, +ROCKCHIP_PCIE_AT_MIN_NUM_BITS , +ROCKCHIP_PCIE_AT_MAX_NUM_BITS ); +} +static void rockchip_pcie_prog_ep_ob_atu (struct rockchip_pcie *rockchip,u8 fn,u32 r,u64 cpu_addr,u64 pci_addr,size_t size) { -int num_pass_bits =fls64 (size -1 ); +int num_pass_bits;u32 addr0, addr1, desc0; -if (num_pass_bits <8 ) - num_pass_bits =8 ; + num_pass_bits =rockchip_pcie_ep_ob_atu_num_bits (rockchip, + pci_addr, size); addr0 = ((num_pass_bits -1 ) &PCIE_CORE_OB_REGION_ADDR0_NUM_BITS ) | (lower_32_bits (pci_addr) &PCIE_CORE_OB_REGION_ADDR0_LO_ADDR );
drivers/pci/controller/pcie-rockchip.h +4 -0
@@ -245,6 +245,10 @@ (PCIE_EP_PF_CONFIG_REGS_BASE + (((fn) << 12) & GENMASK(19, 12)))#define ROCKCHIP_PCIE_EP_VIRT_FUNC_BASE (fn) \ (PCIE_EP_PF_CONFIG_REGS_BASE + 0x10000 + (((fn) << 12) & GENMASK(19, 12))) + +#define ROCKCHIP_PCIE_AT_MIN_NUM_BITS 8 +#define ROCKCHIP_PCIE_AT_MAX_NUM_BITS 20 +#define ROCKCHIP_PCIE_AT_IB_EP_FUNC_BAR_ADDR0 (fn, bar) \ (PCIE_CORE_AXI_CONF_BASE + 0x0828 + (fn) * 0x0040 + (bar) * 0x0008)#define ROCKCHIP_PCIE_AT_IB_EP_FUNC_BAR_ADDR1 (fn, bar) \
Greg Kroah-Hartman
maintainerPATCH 99/146 nfsd: make sure exp active before svc_export_show
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
commit be8f982c369c965faffa198b46060f8853e0f1f0 upstream.
The function e_show was called with protection from RCU. This only ensures that exp will not be freed. Therefore, the reference count for exp can drop to zero, which will trigger a refcount use-after-free warning when exp_get is called. To resolve this issue, use cache_get_rcu to ensure that exp remains active.
------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 819 at lib/refcount.c:25 refcount_warn_saturate+0xb1/0x120 CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb1/0x120 ... Call Trace: <TASK> e_show+0x20b/0x230 [nfsd] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- fs/nfsd/export.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/nfsd/export.c +4 -1
@@ -1425,9 +1425,12 @@ static int e_show(struct seq_file *m, voreturn 0 ; } -exp_get (exp); +if (!cache_get_rcu (&exp->h)) +return 0 ; +if (cache_check (cd, &exp->h,NULL ))return 0 ; +exp_put (exp);return svc_export_show (m, cd, cp); }
Greg Kroah-Hartman
maintainerPATCH 100/146 nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
commit 98100e88dd8865999dc6379a3356cd799795fe7b upstream.
The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files remain open. Consequently, if an action attempts to open a file, it can potentially send two rpc_task to nfs server.
NFS CLIENT
thread1 thread2open("file")
...nfs4_do_open
_nfs4_do_open
_nfs4_open_and_get_state
_nfs4_proc_open
nfs4_run_open_task
/* rpc_task1 */
rpc_run_task
rpc_wait_for_completion_task
umount -f
nfs_umount_begin
rpc_killall_tasks
rpc_signal_task
rpc_task1 been wakeup
and return -512
_nfs4_do_open // while loop
...
nfs4_run_open_task
/* rpc_task2 */
rpc_run_task
rpc_wait_for_completion_taskWhile processing an open request, nfsd will first attempt to find or allocate an nfs4_openowner. If it finds an nfs4_openowner that is not marked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since two rpc_task can attempt to open the same file simultaneously from the client to server, and because two instances of nfsd can run concurrently, this situation can lead to lots of memory leak. Additionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be triggered.
NFS SERVER
nfsd1 nfsd2 echo 0 > /proc/fs/nfsd/threads
nfsd4_open
nfsd4_process_open1
find_or_alloc_open_stateowner
// alloc oo1, stateid1
nfsd4_open
nfsd4_process_open1
find_or_alloc_open_stateowner
// find oo1, without NFS4_OO_CONFIRMED
release_openowner
unhash_openowner_locked
list_del_init(&oo->oo_perclient)
// cannot find this oo
// from client, LEAK!!!
alloc_stateowner // alloc oo2 nfsd4_process_open2
init_open_stateid
// associate oo1
// with stateid1, stateid1 LEAK!!!
nfs4_get_vfs_file
// alloc nfsd_file1 and nfsd_file_mark1
// all LEAK!!!
nfsd4_process_open2
...
write_threads
...
nfsd_destroy_serv
nfsd_shutdown_net
nfs4_state_shutdown_net
nfs4_state_destroy_net
destroy_client
__destroy_client
// won't find oo1!!!
nfsd_shutdown_generic
nfsd_file_cache_shutdown
kmem_cache_destroy
for nfsd_file_slab
and nfsd_file_mark_slab
// bark since nfsd_file1
// and nfsd_file_mark1
// still alive=======================================================================
BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown()
-----------------------------------------------------------------------
Slab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28 flags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff)
CPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xac/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1ae/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Disabling lock debugging due to kernel taint
Object 0xff11000110e2ac38 @offset=3128
Allocated in nfsd_file_do_acquire+0x20f/0xa30 [nfsd] age=1635 cpu=3 pid=800
nfsd_file_do_acquire+0x20f/0xa30 [nfsd] nfsd_file_acquire_opened+0x5f/0x90 [nfsd] nfs4_get_vfs_file+0x4c9/0x570 [nfsd] nfsd4_process_open2+0x713/0x1070 [nfsd] nfsd4_open+0x74b/0x8b0 [nfsd] nfsd4_proc_compound+0x70b/0xc20 [nfsd] nfsd_dispatch+0x1b4/0x3a0 [nfsd] svc_process_common+0x5b8/0xc50 [sunrpc] svc_process+0x2ab/0x3b0 [sunrpc] svc_handle_xprt+0x681/0xa20 [sunrpc] nfsd+0x183/0x220 [nfsd] kthread+0x199/0x1e0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30
Add nfs4_openowner_unhashed to help found unhashed nfs4_openowner, and break nfsd4_open process to fix this problem.
--- fs/nfsd/nfs4state.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
fs/nfsd/nfs4state.c +19 -0
@@ -1660,6 +1660,14 @@ static void release_open_stateid(structfree_ol_stateid_reaplist (&reaplist); } +static bool nfs4_openowner_unhashed (struct nfs4_openowner *oo) +{ +lockdep_assert_held (&oo->oo_owner.so_client->cl_lock); + +return list_empty (&oo->oo_owner.so_strhash) && +list_empty (&oo->oo_perclient); +} +static void unhash_openowner_locked (struct nfs4_openowner *oo) {struct nfs4_client *clp = oo->oo_owner.so_client;
@@ -4975,6 +4983,12 @@ retry:spin_lock (&oo->oo_owner.so_client->cl_lock);spin_lock (&fp->fi_lock); +if (nfs4_openowner_unhashed (oo)) { +mutex_unlock (&stp->st_mutex); + stp =NULL ; + goto out_unlock; + } + retstp =nfsd4_find_existing_open (fp, open);if (retstp) goto out_unlock;
@@ -6126,6 +6140,11 @@ nfsd4_process_open2(struct svc_rqst *rqsif (!stp) { stp =init_open_stateid (fp, open); +if (!stp) { + status = nfserr_jukebox; + goto out; + } +if (!open->op_stp) new_stp = true; }
Greg Kroah-Hartman
maintainerPATCH 101/146 iio: accel: kx022a: Fix raw read format
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
commit b7d2bc99b3bdc03fff9b416dd830632346d83530 upstream.
The KX022A provides the accelerometer data in two subsequent registers. The registers are laid out so that the value obtained via bulk-read of these registers can be interpreted as signed 16-bit little endian value. The read value is converted to cpu_endianes and stored into 32bit integer. The le16_to_cpu() casts value to unsigned 16-bit value, and when this is assigned to 32-bit integer the resulting value will always be positive.
This has not been a problem to users (at least not all users) of the sysfs interface, who know the data format based on the scan info and who have converted the read value back to 16-bit signed value. This isn't compliant with the ABI however.
This, however, will be a problem for those who use the in-kernel interfaces, especially the iio_read_channel_processed_scale().
The iio_read_channel_processed_scale() performs multiplications to the returned (always positive) raw value, which will cause strange results when the data from the sensor has been negative.
Fix the read_raw format by casting the result of the le_to_cpu() to signed 16-bit value before assigning it to the integer. This will make the negative readings to be correctly reported as negative.
This fix will be visible to users by changing values returned via sysfs to appear in correct (negative) format.
--- drivers/iio/accel/kionix-kx022a.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/accel/kionix-kx022a.c +1 -1
@@ -594,7 +594,7 @@ static int kx022a_get_axis(struct kx022aif (ret)return ret; - *val =le16_to_cpu (data->buffer[0 ]); + *val = (s16 )le16_to_cpu (data->buffer[0 ]);return IIO_VAL_INT ; }
Greg Kroah-Hartman
maintainerPATCH 102/146 iio: invensense: fix multiple odr switch when FIFO is off
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
commit ef5f5e7b6f73f79538892a8be3a3bee2342acc9f upstream.
When multiple ODR switch happens during FIFO off, the change could not be taken into account if you get back to previous FIFO on value. For example, if you run sensor buffer at 50Hz, stop, change to 200Hz, then back to 50Hz and restart buffer, data will be timestamped at 200Hz. This due to testing against mult and not new_mult.
To prevent this, let's just run apply_odr automatically when FIFO is off. It will also simplify driver code.
Update inv_mpu6050 and inv_icm42600 to delete now useless apply_odr.
--- drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 4 ++++ drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 -- drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 3 --- drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 1 - 4 files changed, 4 insertions(+), 6 deletions(-)
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c +4 -0
@@ -70,6 +70,10 @@ int inv_sensors_timestamp_update_odr(strif (mult != ts->mult) ts->new_mult = mult; +/* When FIFO is off, directly apply the new ODR */ +if (!fifo) +inv_sensors_timestamp_apply_odr (ts,0 ,0 ,0 ); +return 0 ; }EXPORT_SYMBOL_NS_GPL (inv_sensors_timestamp_update_odr,IIO_INV_SENSORS_TIMESTAMP );
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c +0 -2
@@ -200,7 +200,6 @@ static int inv_icm42600_accel_update_sca {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev);struct inv_icm42600_sensor_state *accel_st =iio_priv (indio_dev); -struct inv_sensors_timestamp *ts = &accel_st->ts;struct inv_icm42600_sensor_conf conf =INV_ICM42600_SENSOR_CONF_INIT ;unsigned int fifo_en =0 ;unsigned int sleep_temp =0 ;
@@ -229,7 +228,6 @@ static int inv_icm42600_accel_update_sca }/* update data FIFO write */ -inv_sensors_timestamp_apply_odr (ts,0 ,0 ,0 ); ret =inv_icm42600_buffer_set_fifo_en (st, fifo_en | st->fifo.en); out_unlock:
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c +0 -3
@@ -99,8 +99,6 @@ static int inv_icm42600_gyro_update_scan const unsigned long *scan_mask) {struct inv_icm42600_state *st =iio_device_get_drvdata (indio_dev); -struct inv_icm42600_sensor_state *gyro_st =iio_priv (indio_dev); -struct inv_sensors_timestamp *ts = &gyro_st->ts;struct inv_icm42600_sensor_conf conf =INV_ICM42600_SENSOR_CONF_INIT ;unsigned int fifo_en =0 ;unsigned int sleep_gyro =0 ;
@@ -128,7 +126,6 @@ static int inv_icm42600_gyro_update_scan }/* update data FIFO write */ -inv_sensors_timestamp_apply_odr (ts,0 ,0 ,0 ); ret =inv_icm42600_buffer_set_fifo_en (st, fifo_en | st->fifo.en); out_unlock:
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +0 -1
@@ -112,7 +112,6 @@ int inv_mpu6050_prepare_fifo(struct inv_if (enable) {/* reset timestamping */ inv_sensors_timestamp_reset (&st->timestamp); -inv_sensors_timestamp_apply_odr (&st->timestamp,0 ,0 ,0 );/* reset FIFO */ d = st->chip_config.user_ctrl |INV_MPU6050_BIT_FIFO_RST ; ret =regmap_write (st->map, st->reg->user_ctrl, d);
Greg Kroah-Hartman
maintainerPATCH 103/146 iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit 3993ca4add248f0f853f54f9273a7de850639f33 upstream.
In the fwnode_iio_channel_get_by_name(), iterating over parent nodes to acquire IIO channels via fwnode_for_each_parent_node(). The variable chan was mistakenly attempted on the original node instead of the current parent node. This patch corrects the logic to ensure that __fwnode_iio_channel_get_by_name() is called with the correct parent node.
--- drivers/iio/inkern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/inkern.c +1 -1
@@ -269,7 +269,7 @@ struct iio_channel *fwnode_iio_channel_greturn ERR_PTR (-ENODEV ); } - chan =__fwnode_iio_channel_get_by_name (fwnode, name); + chan =__fwnode_iio_channel_get_by_name (parent, name);if (!IS_ERR (chan) ||PTR_ERR (chan) != -ENODEV ) {fwnode_handle_put (parent);return chan;
Greg Kroah-Hartman
maintainerPATCH 104/146 iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
commit 3a4187ec454e19903fd15f6e1825a4b84e59a4cd upstream.
The AD7923 was updated to support devices with 8 channels, but the size of tx_buf and ring_xfer was not increased accordingly, leading to a potential buffer overflow in ad7923_update_scan_mode().
--- drivers/iio/adc/ad7923.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/ad7923.c +2 -2
@@ -48,7 +48,7 @@struct ad7923_state {struct spi_device *spi; -struct spi_transfer ring_xfer[5 ]; +struct spi_transfer ring_xfer[9 ];struct spi_transfer scan_single_xfer[2 ];struct spi_message ring_msg;struct spi_message scan_single_msg;
@@ -64,7 +64,7 @@ struct ad7923_state {* Length = 8 channels + 4 extra for 8 byte timestamp */ __be16 rx_buf[12 ]__aligned(IIO_DMA_MINALIGN) ; -__be16 tx_buf[4 ]; +__be16 tx_buf[8 ]; };struct ad7923_chip_info {
Greg Kroah-Hartman
maintainerPATCH 105/146 iio: gts: fix infinite loop for gain_to_scaletables()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit 7452f8a0814bb73f739ee0dab60f099f3361b151 upstream.
In iio_gts_build_avail_time_table(), it is checked that gts->num_itime is non-zero, but gts->num_itime is not checked in gain_to_scaletables(). The variable time_idx is initialized as gts->num_itime - 1. This implies that time_idx might initially be set to -1 (0 - 1 = -1). Consequently, using while (time_idx--) could lead to an infinite loop.
--- drivers/iio/industrialio-gts-helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/industrialio-gts-helper.c +1 -1
@@ -205,7 +205,7 @@ static int gain_to_scaletables(struct iimemcpy (all_gains, gains[time_idx], gain_bytes); new_idx = gts->num_hwgain; -while (time_idx--) { +while (time_idx-- >0 ) {for (j =0 ; j < gts->num_hwgain; j++) {int candidate = gains[time_idx][j];int chk;
Greg Kroah-Hartman
maintainerPATCH 106/146 powerpc: Fix stack protector Kconfig test for clang
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 46e1879deea22eed31e9425d58635895fc0e8040 upstream.
Clang's in-progress per-task stack protector support [1] does not work with the current Kconfig checks because '-mstack-protector-guard-offset' is not provided, unlike all other architecture Kconfig checks.
$ fd Kconfig -x rg -l mstack-protector-guard-offset ./arch/arm/Kconfig ./arch/riscv/Kconfig ./arch/arm64/Kconfig
This produces an error from clang, which is interpreted as the flags not being supported at all when they really are.
$ clang --target=powerpc64-linux-gnu \
-mstack-protector-guard=tls \
-mstack-protector-guard-reg=r13 \
-c -o /dev/null -x c /dev/null
clang: error: '-mstack-protector-guard=tls' is used without '-mstack-protector-guard-offset', and there is no defaultThis argument will always be provided by the build system, so mirror other architectures and use '-mstack-protector-guard-offset=0' for testing support, which fixes the issue for clang and does not regress support with GCC.
Even with the first problem addressed, the 32-bit test continues to fail because Kbuild uses the powerpc64le-linux-gnu target for clang and nothing flips the target to 32-bit, resulting in an error about an invalid register valid:
$ clang --target=powerpc64le-linux-gnu \
-mstack-protector-guard=tls
-mstack-protector-guard-reg=r2 \
-mstack-protector-guard-offset=0 \
-x c -c -o /dev/null /dev/null
clang: error: invalid value 'r2' in 'mstack-protector-guard-reg=', expected one of: r13While GCC allows arbitrary registers, the implementation of '-mstack-protector-guard=tls' in LLVM shares the same code path as the user space thread local storage implementation, which uses a fixed register (2 for 32-bit and 13 for 62-bit), so the command line parsing enforces this limitation.
Use the Kconfig macro '$(m32-flag)', which expands to '-m32' when supported, in the stack protector support cc-option call to properly switch the target to a 32-bit one, which matches what happens in Kbuild. While the 64-bit macro does not strictly need it, add the equivalent 64-bit option for symmetry.
--- arch/powerpc/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/Kconfig +2 -2
@@ -275,8 +275,8 @@ config PPC select HAVE_RSEQ select HAVE_SETUP_PER_CPU_AREA if PPC64 select HAVE_SOFTIRQ_ON_OWN_STACK - select HAVE_STACKPROTECTOR if PPC32 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r2) - select HAVE_STACKPROTECTOR if PPC64 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r13) + select HAVE_STACKPROTECTOR if PPC32 && $(cc-option,$(m32-flag) -mstack-protector-guard=tls -mstack-protector-guard-reg=r2 -mstack-protector-guard-offset=0) + select HAVE_STACKPROTECTOR if PPC64 && $(cc-option,$(m64-flag) -mstack-protector-guard=tls -mstack-protector-guard-reg=r13 -mstack-protector-guard-offset=0) select HAVE_STATIC_CALL if PPC32 select HAVE_SYSCALL_TRACEPOINTS select HAVE_VIRT_CPU_ACCOUNTING
Greg Kroah-Hartman
maintainerPATCH 107/146 powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit bee08a9e6ab03caf14481d97b35a258400ffab8f upstream.
After fixing the HAVE_STACKPROTECTER checks for clang's in-progress per-task stack protector support [1], the build fails during prepare0 because '-mstack-protector-guard-offset' has not been added to KBUILD_CFLAGS yet but the other '-mstack-protector-guard' flags have.
clang: error: '-mstack-protector-guard=tls' is used without '-mstack-protector-guard-offset', and there is no default
clang: error: '-mstack-protector-guard=tls' is used without '-mstack-protector-guard-offset', and there is no default make[4]: *** [scripts/Makefile.build:229: scripts/mod/empty.o] Error 1
make[4]: *** [scripts/Makefile.build:102: scripts/mod/devicetable-offsets.s] Error 1
Mirror other architectures and add all '-mstack-protector-guard' flags to KBUILD_CFLAGS atomically during stack_protector_prepare, which resolves the issue and allows clang's implementation to fully work with the kernel.
--- arch/powerpc/Makefile | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
arch/powerpc/Makefile +4 -9
@@ -100,13 +100,6 @@ KBUILD_AFLAGS += -m$(BITS) KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION) endif -cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard=tls -ifdef CONFIG_PPC64 -cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard-reg=r13 -else -cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard-reg=r2 -endif - LDFLAGS_vmlinux-y := -Bstatic LDFLAGS_vmlinux-$(CONFIG_RELOCATABLE) := -pie LDFLAGS_vmlinux-$(CONFIG_RELOCATABLE) += -z notext
@@ -402,9 +395,11 @@ prepare: stack_protector_prepare PHONY += stack_protector_prepare stack_protector_prepare: prepare0 ifdef CONFIG_PPC64 - $(eval KBUILD_CFLAGS += -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "PACA_CANARY") print $$3;}' include/generated/asm-offsets.h)) + $(eval KBUILD_CFLAGS += -mstack-protector-guard=tls -mstack-protector-guard-reg=r13 \ + -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "PACA_CANARY") print $$3;}' include/generated/asm-offsets.h)) else - $(eval KBUILD_CFLAGS += -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "TASK_CANARY") print $$3;}' include/generated/asm-offsets.h)) + $(eval KBUILD_CFLAGS += -mstack-protector-guard=tls -mstack-protector-guard-reg=r2 \ + -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "TASK_CANARY") print $$3;}' include/generated/asm-offsets.h)) endif endif
Greg Kroah-Hartman
maintainerPATCH 108/146 binder: fix node UAF in binder_add_freeze_work()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit dc8aea47b928cc153b591b3558829ce42f685074 upstream.
In binder_add_freeze_work() we iterate over the proc->nodes with the proc->inner_lock held. However, this lock is temporarily dropped in order to acquire the node->lock first (lock nesting order). This can race with binder_node_release() and trigger a use-after-free:
==================================================================
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff53c04c29dd04 by task freeze/640 CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_add_freeze_work+0x148/0x478 binder_ioctl+0x1e70/0x25ac __arm64_sys_ioctl+0x124/0x190 Allocated by task 637: __kmalloc_cache_noprof+0x12c/0x27c binder_new_node+0x50/0x700 binder_transaction+0x35ac/0x6f74 binder_thread_write+0xfb8/0x42a0 binder_ioctl+0x18f0/0x25ac __arm64_sys_ioctl+0x124/0x190 Freed by task 637: kfree+0xf0/0x330 binder_thread_read+0x1e88/0x3a68 binder_ioctl+0x16d8/0x25ac __arm64_sys_ioctl+0x124/0x190 ==================================================================
Fix the race by taking a temporary reference on the node before releasing the proc->inner lock. This ensures the node remains alive while in use.
--- drivers/android/binder.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/android/binder.c +7 -0
@@ -5552,6 +5552,7 @@ static bool binder_txns_pending_ilocked(struct binder_proc *proc)static void binder_add_freeze_work (struct binder_proc *proc,bool is_frozen) { +struct binder_node *prev =NULL ;struct rb_node *n;struct binder_ref *ref;
@@ -5560,7 +5561,10 @@ static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)struct binder_node *node; node = rb_entry(n, struct binder_node, rb_node); +binder_inc_node_tmpref_ilocked (node);binder_inner_proc_unlock (proc); +if (prev) +binder_put_node (prev);binder_node_lock (node);hlist_for_each_entry (ref, &node->refs, node_entry) {/*
@@ -5586,10 +5590,13 @@ static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen) }binder_inner_proc_unlock (ref->proc); } + prev = node;binder_node_unlock (node);binder_inner_proc_lock (proc); }binder_inner_proc_unlock (proc); +if (prev) +binder_put_node (prev); } static int binder_ioctl_freeze(struct binder_freeze_info *info,
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 109/146 binder: fix OOB in binder_add_freeze_work()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 011e69a1b23011c0db3af4b8293fdd4522cc97b0 upstream.
In binder_add_freeze_work() we iterate over the proc->nodes with the proc->inner_lock held. However, this lock is temporarily dropped to acquire the node->lock first (lock nesting order). This can race with binder_deferred_release() which removes the nodes from the proc->nodes rbtree and adds them into binder_dead_nodes list. This leads to a broken iteration in binder_add_freeze_work() as rb_next() will use data from binder_dead_nodes, triggering an out-of-bounds access:
==================================================================
BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124 Read of size 8 at addr ffffcb84285f7170 by task freeze/660 CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18 Hardware name: linux,dummy-virt (DT) Call trace: rb_next+0xfc/0x124 binder_add_freeze_work+0x344/0x534 binder_ioctl+0x1e70/0x25ac __arm64_sys_ioctl+0x124/0x190 The buggy address belongs to the variable: binder_dead_nodes+0x10/0x40 [...] ==================================================================
This is possible because proc->nodes (rbtree) and binder_dead_nodes (list) share entries in binder_node through a union:
struct binder_node {
[...]
union {
struct rb_node rb_node;
struct hlist_node dead_node;
};Fix the race by checking that the proc is still alive. If not, simply break out of the iteration.
--- drivers/android/binder.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/android/binder.c +2 -0
@@ -5593,6 +5593,8 @@ static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen) prev = node;binder_node_unlock (node);binder_inner_proc_lock (proc); +if (proc->is_dead) +break ; }binder_inner_proc_unlock (proc);if (prev)
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 110/146 binder: fix freeze UAF in binder_release_work()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 7e20434cbca814cb91a0a261ca0106815ef48e5f upstream.
When a binder reference is cleaned up, any freeze work queued in the associated process should also be removed. Otherwise, the reference is freed while its ref->freeze.work is still queued in proc->work leading to a use-after-free issue as shown by the following KASAN report:
==================================================================
BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0 Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211 CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: binder_release_work+0x398/0x3d0 binder_deferred_func+0xb60/0x109c process_one_work+0x51c/0xbd4 worker_thread+0x608/0xee8 Allocated by task 703: __kmalloc_cache_noprof+0x130/0x280 binder_thread_write+0xdb4/0x42a0 binder_ioctl+0x18f0/0x25ac __arm64_sys_ioctl+0x124/0x190 invoke_syscall+0x6c/0x254 Freed by task 211: kfree+0xc4/0x230 binder_deferred_func+0xae8/0x109c process_one_work+0x51c/0xbd4 worker_thread+0x608/0xee8 ==================================================================
This commit fixes the issue by ensuring any queued freeze work is removed when cleaning up a binder reference.
--- drivers/android/binder.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/android/binder.c +6 -0
@@ -1225,6 +1225,12 @@ static void binder_cleanup_ref_olocked(struct binder_ref *ref)binder_dequeue_work (ref->proc, &ref->death->work);binder_stats_deleted (BINDER_STAT_DEATH ); } + +if (ref->freeze) { +binder_dequeue_work (ref->proc, &ref->freeze->work); +binder_stats_deleted (BINDER_STAT_FREEZE ); + } +binder_stats_deleted (BINDER_STAT_REF ); }
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 111/146 binder: fix BINDER_WORK_FROZEN_BINDER debug logs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 830d7db744b42c693bf1db7e94db86d7efd91f0e upstream.
The BINDER_WORK_FROZEN_BINDER type is not handled in the binder_logs entries and it shows up as "unknown work" when logged:
proc 649
context binder-test
thread 649: l 00 need_return 0 tr 0
ref 13: desc 1 node 8 s 1 w 0 d 0000000053c4c0c3
unknown work: type 10This patch add the freeze work type and is now logged as such:
proc 637
context binder-test
thread 637: l 00 need_return 0 tr 0
ref 8: desc 1 node 3 s 1 w 0 d 00000000dc39e9c6
has frozen binder--- drivers/android/binder.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/android/binder.c +3 -0
@@ -6408,6 +6408,9 @@ static void print_binder_work_ilocked(stcase BINDER_WORK_CLEAR_DEATH_NOTIFICATION :seq_printf (m,"%shas cleared death notification\n" , prefix);break ; +case BINDER_WORK_FROZEN_BINDER : +seq_printf (m,"%shas frozen binder\n" , prefix); +break ;default :seq_printf (m,"%sunknown work: type %d\n" , prefix, w->type);break ;
Greg Kroah-Hartman
maintainerPATCH 112/146 binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 595ea72efff9fa65bc52b6406e0822f90841f266 upstream.
proc 699
context binder-test
thread 699: l 00 need_return 0 tr 0
ref 25: desc 1 node 20 s 1 w 0 d 00000000c03e09a3 unknown work: type 11
proc 640
context binder-test
thread 640: l 00 need_return 0 tr 0
ref 8: desc 1 node 3 s 1 w 0 d 000000002bb493e1 has cleared freeze notification
--- drivers/android/binder.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/android/binder.c +3 -0
@@ -6411,6 +6411,9 @@ static void print_binder_work_ilocked(struct seq_file *m,case BINDER_WORK_FROZEN_BINDER :seq_printf (m,"%shas frozen binder\n" , prefix);break ; +case BINDER_WORK_CLEAR_FREEZE_NOTIFICATION : +seq_printf (m,"%shas cleared freeze notification\n" , prefix); +break ;default :seq_printf (m,"%sunknown work: type %d\n" , prefix, w->type);break ;
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 113/146 binder: allow freeze notification for dead nodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit ca63c66935b978441055e3d87d30225267f99329 upstream.
Alice points out that binder_request_freeze_notification() should not return EINVAL when the relevant node is dead [1]. The node can die at any point even if the user input is valid. Instead, allow the request to be allocated but skip the initial notification for dead nodes. This avoids propagating unnecessary errors back to userspace.
--- drivers/android/binder.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/android/binder.c +13 -15
@@ -3856,7 +3856,6 @@ binder_request_freeze_notification(struct binder_proc *proc, {struct binder_ref_freeze *freeze;struct binder_ref *ref; -bool is_frozen; freeze =kzalloc (sizeof (*freeze),GFP_KERNEL );if (!freeze)
@@ -3872,32 +3871,31 @@ binder_request_freeze_notification(struct binder_proc *proc, }binder_node_lock (ref->node); - -if (ref->freeze || !ref->node->proc) { -binder_user_error ("%d:%d invalid BC_REQUEST_FREEZE_NOTIFICATION %s\n" , - proc->pid, thread->pid, - ref->freeze ?"already set" :"dead node" ); +if (ref->freeze) { +binder_user_error ("%d:%d BC_REQUEST_FREEZE_NOTIFICATION already set\n" , + proc->pid, thread->pid);binder_node_unlock (ref->node);binder_proc_unlock (proc);kfree (freeze);return -EINVAL ; } -binder_inner_proc_lock (ref->node->proc); - is_frozen = ref->node->proc->is_frozen; -binder_inner_proc_unlock (ref->node->proc);binder_stats_created (BINDER_STAT_FREEZE );INIT_LIST_HEAD (&freeze->work.entry); freeze->cookie = handle_cookie->cookie; freeze->work.type =BINDER_WORK_FROZEN_BINDER ; - freeze->is_frozen = is_frozen; - ref->freeze = freeze; -binder_inner_proc_lock (proc); -binder_enqueue_work_ilocked (&ref->freeze->work, &proc->todo); -binder_wakeup_proc_ilocked (proc); -binder_inner_proc_unlock (proc); +if (ref->node->proc) { +binder_inner_proc_lock (ref->node->proc); + freeze->is_frozen = ref->node->proc->is_frozen; +binder_inner_proc_unlock (ref->node->proc); + +binder_inner_proc_lock (proc); +binder_enqueue_work_ilocked (&freeze->work, &proc->todo); +binder_wakeup_proc_ilocked (proc); +binder_inner_proc_unlock (proc); + }binder_node_unlock (ref->node);binder_proc_unlock (proc);
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 114/146 binder: fix memleak of proc->delivered_freeze
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 1db76ec2b4b206ff943e292a0b55e68ff3443598 upstream.
If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION before calling binder_freeze_notification_done(), then it is detached from its reference (e.g. ref->freeze) but the work remains queued in proc->delivered_freeze. This leads to a memory leak when the process exits as any pending entries in proc->delivered_freeze are not freed:
unreferenced object 0xffff38e8cfa36180 (size 64):
comm "binder-util", pid 655, jiffies 4294936641
hex dump (first 32 bytes):
b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff .....8.......8..
0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00 ........<.K.....
backtrace (crc 95983b32):
[<000000000d0582cf>] kmemleak_alloc+0x34/0x40
[<000000009c99a513>] __kmalloc_cache_noprof+0x208/0x280
[<00000000313b1704>] binder_thread_write+0xdec/0x439c
[<000000000cbd33bb>] binder_ioctl+0x1b68/0x22cc
[<000000002bbedeeb>] __arm64_sys_ioctl+0x124/0x190
[<00000000b439adee>] invoke_syscall+0x6c/0x254
[<00000000173558fc>] el0_svc_common.constprop.0+0xac/0x230
[<0000000084f72311>] do_el0_svc+0x40/0x58
[<000000008b872457>] el0_svc+0x38/0x78
[<00000000ee778653>] el0t_64_sync_handler+0x120/0x12c
[<00000000a8ec61bf>] el0t_64_sync+0x190/0x194This patch fixes the leak by ensuring that any pending entries in proc->delivered_freeze are freed during binder_deferred_release().
--- drivers/android/binder.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/android/binder.c +11 -0
@@ -5155,6 +5155,16 @@ static void binder_release_work(struct binder_proc *proc, }break ;case BINDER_WORK_NODE :break ; +case BINDER_WORK_CLEAR_FREEZE_NOTIFICATION : { +struct binder_ref_freeze *freeze; + + freeze = container_of(w, struct binder_ref_freeze, work); +binder_debug (BINDER_DEBUG_DEAD_TRANSACTION , +"undelivered freeze notification, %016llx\n" , + (u64 )freeze->cookie); +kfree (freeze); +binder_stats_deleted (BINDER_STAT_FREEZE ); + }break ;default :pr_err ("unexpected work type, %d, not freed\n" , wtype);
@@ -6273,6 +6283,7 @@ static void binder_deferred_release(struct binder_proc *proc)binder_release_work (proc, &proc->todo);binder_release_work (proc, &proc->delivered_death); +binder_release_work (proc, &proc->delivered_freeze); binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d\n",
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 115/146 binder: add delivered_freeze to debugfs output
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit cb2aeb2ec25884133110ffe5a67ff3cf7dee5ceb upstream.
Add the pending proc->delivered_freeze work to the debugfs output. This information was omitted in the original implementation of the freeze notification and can be valuable for debugging issues.
--- drivers/android/binder.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/android/binder.c +4 -0
@@ -6569,6 +6569,10 @@ static void print_binder_proc(struct seq_file *m,seq_puts (m," has delivered dead binder\n" );break ; } +list_for_each_entry (w, &proc->delivered_freeze, entry) { +seq_puts (m," has delivered freeze binder\n" ); +break ; + }binder_inner_proc_unlock (proc);if (!print_all && m->count == header_pos) m->count = start_pos;
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 116/146 dt-bindings: net: fec: add pps channel property
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit 1aa772be0444a2bd06957f6d31865e80e6ae4244 upstream.
Add fsl,pps-channel property to select where to connect the PPS signal. This depends on the internal SoC routing and on the board, for example on the i.MX8 SoC it can be connected to an external pin (using channel 1) or to internal eDMA as DMA request (channel 0).
--- Documentation/devicetree/bindings/net/fsl,fec.yaml | 7 +++++++ 1 file changed, 7 insertions(+)
Documentation/devicetree/bindings/net/fsl,fec.yaml +7 -0
@@ -183,6 +183,13 @@ properties: description: Register bits of stop mode control, the format is <&gpr req_gpr req_bit>. + fsl,pps-channel: + $ref: /schemas/types.yaml#/definitions/uint32 + default: 0 + description: + Specifies to which timer instance the PPS signal is routed. + enum: [0, 1, 2, 3] + mdio: $ref: mdio.yaml# unevaluatedProperties: false
Greg Kroah-Hartman
maintainerPATCH 117/146 net: fec: refactor PPS channel configuration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit bf8ca67e21671e7a56e31da45360480b28f185f1 upstream.
Preparation patch to allow for PPS channel configuration, no functional change intended.
--- drivers/net/ethernet/freescale/fec_ptp.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/ethernet/freescale/fec_ptp.c +4 -5
@@ -84,8 +84,7 @@#define FEC_CC_MULT (1 << 31)#define FEC_COUNTER_PERIOD (1 << 31)#define PPS_OUPUT_RELOAD_PERIOD NSEC_PER_SEC -#define FEC_CHANNLE_0 0 -#define DEFAULT_PPS_CHANNEL FEC_CHANNLE_0 +#define DEFAULT_PPS_CHANNEL 0#define FEC_PTP_MAX_NSEC_PERIOD 4000000000ULL#define FEC_PTP_MAX_NSEC_COUNTER 0x80000000ULL
@@ -524,8 +523,9 @@ static int fec_ptp_enable(struct ptp_clounsigned long flags;int ret =0 ; + fep->pps_channel =DEFAULT_PPS_CHANNEL ; +if (rq->type ==PTP_CLK_REQ_PPS ) { - fep->pps_channel =DEFAULT_PPS_CHANNEL ; fep->reload_period =PPS_OUPUT_RELOAD_PERIOD ; ret =fec_ptp_enable_pps (fep, on);
@@ -536,10 +536,9 @@ static int fec_ptp_enable(struct ptp_cloif (rq->perout.flags)return -EOPNOTSUPP ; -if (rq->perout.index !=DEFAULT_PPS_CHANNEL ) +if (rq->perout.index != fep->pps_channel)return -EOPNOTSUPP ; - fep->pps_channel =DEFAULT_PPS_CHANNEL ; period.tv_sec = rq->perout.period.sec; period.tv_nsec = rq->perout.period.nsec; period_ns =timespec64_to_ns (&period);
Greg Kroah-Hartman
maintainerPATCH 118/146 net: fec: make PPS channel configurable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit 566c2d83887f0570056833102adc5b88e681b0c7 upstream.
Depending on the SoC where the FEC is integrated into the PPS channel might be routed to different timer instances. Make this configurable from the devicetree.
When the related DT property is not present fallback to the previous default and use channel 0.
--- drivers/net/ethernet/freescale/fec_ptp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fec_ptp.c +4 -2
@@ -523,8 +523,6 @@ static int fec_ptp_enable(struct ptp_clounsigned long flags;int ret =0 ; - fep->pps_channel =DEFAULT_PPS_CHANNEL ; -if (rq->type ==PTP_CLK_REQ_PPS ) { fep->reload_period =PPS_OUPUT_RELOAD_PERIOD ;
@@ -706,12 +704,16 @@ void fec_ptp_init(struct platform_device {struct net_device *ndev =platform_get_drvdata (pdev);struct fec_enet_private *fep =netdev_priv (ndev); +struct device_node *np = fep->pdev->dev.of_node;int irq;int ret; fep->ptp_caps.owner =THIS_MODULE ;strscpy (fep->ptp_caps.name,"fec ptp" ,sizeof (fep->ptp_caps.name)); + fep->pps_channel =DEFAULT_PPS_CHANNEL ; +of_property_read_u32 (np,"fsl,pps-channel" , &fep->pps_channel); + fep->ptp_caps.max_adj =250000000 ; fep->ptp_caps.n_alarm =0 ; fep->ptp_caps.n_ext_ts =0 ;
Greg Kroah-Hartman
maintainerPATCH 119/146 drm/panic: Fix uninitialized spinlock acquisition with CONFIG_DRM_PANIC=n
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <[email protected]>
commit 319e53f155907cf2c6dabc16ec9dce0179bc04d1 upstream.
It turns out that if you happen to have a kernel config where CONFIG_DRM_PANIC is disabled and spinlock debugging is enabled, along with KMS being enabled - we'll end up trying to acquire an uninitialized spin_lock with drm_panic_lock() when we try to do a commit:
rvkms rvkms.0: [drm:drm_atomic_commit] committing 0000000068d2ade1
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 4 PID: 1347 Comm: modprobe Not tainted 6.10.0-rc1Lyude-Test+ #272 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20240524-3.fc40 05/24/2024 Call Trace: <TASK> dump_stack_lvl+0x77/0xa0 assign_lock_key+0x114/0x120 register_lock_class+0xa8/0x2c0 __lock_acquire+0x7d/0x2bd0 ? __vmap_pages_range_noflush+0x3a8/0x550 ? drm_atomic_helper_swap_state+0x2ad/0x3a0 lock_acquire+0xec/0x290 ? drm_atomic_helper_swap_state+0x2ad/0x3a0 ? lock_release+0xee/0x310 _raw_spin_lock_irqsave+0x4e/0x70 ? drm_atomic_helper_swap_state+0x2ad/0x3a0 drm_atomic_helper_swap_state+0x2ad/0x3a0 drm_atomic_helper_commit+0xb1/0x270 drm_atomic_commit+0xaf/0xe0 ? __pfx___drm_printfn_info+0x10/0x10 drm_client_modeset_commit_atomic+0x1a1/0x250 drm_client_modeset_commit_locked+0x4b/0x180 drm_client_modeset_commit+0x27/0x50 __drm_fb_helper_restore_fbdev_mode_unlocked+0x76/0x90 drm_fb_helper_set_par+0x38/0x40 fbcon_init+0x3c4/0x690 visual_init+0xc0/0x120 do_bind_con_driver+0x409/0x4c0 do_take_over_console+0x233/0x280 do_fb_registered+0x11f/0x210 fbcon_fb_registered+0x2c/0x60 register_framebuffer+0x248/0x2a0 __drm_fb_helper_initial_config_and_unlock+0x58a/0x720 drm_fbdev_generic_client_hotplug+0x6e/0xb0 drm_client_register+0x76/0xc0 _RNvXs_CsHeezP08sTT_5rvkmsNtB4_5RvkmsNtNtCs1cdwasc6FUb_6kernel8platform6Driver5probe+0xed2/0x1060 [rvkms] ? _RNvMs_NtCs1cdwasc6FUb_6kernel8platformINtB4_7AdapterNtCsHeezP08sTT_5rvkms5RvkmsE14probe_callbackBQ_+0x2b/0x70 [rvkms] ? acpi_dev_pm_attach+0x25/0x110 ? platform_probe+0x6a/0xa0 ? really_probe+0x10b/0x400 ? __driver_probe_device+0x7c/0x140 ? driver_probe_device+0x22/0x1b0 ? __device_attach_driver+0x13a/0x1c0 ? __pfx___device_attach_driver+0x10/0x10 ? bus_for_each_drv+0x114/0x170 ? __device_attach+0xd6/0x1b0 ? bus_probe_device+0x9e/0x120 ? device_add+0x288/0x4b0 ? platform_device_add+0x75/0x230 ? platform_device_register_full+0x141/0x180 ? rust_helper_platform_device_register_simple+0x85/0xb0 ? _RNvMs2_NtCs1cdwasc6FUb_6kernel8platformNtB5_6Device13create_simple+0x1d/0x60 ? _RNvXs0_CsHeezP08sTT_5rvkmsNtB5_5RvkmsNtCs1cdwasc6FUb_6kernel6Module4init+0x11e/0x160 [rvkms] ? 0xffffffffc083f000 ? init_module+0x20/0x1000 [rvkms] ? kernfs_xattr_get+0x3e/0x80 ? do_one_initcall+0x148/0x3f0 ? __lock_acquire+0x5ef/0x2bd0 ? __lock_acquire+0x5ef/0x2bd0 ? __lock_acquire+0x5ef/0x2bd0 ? put_cpu_partial+0x51/0x1d0 ? lock_acquire+0xec/0x290 ? put_cpu_partial+0x51/0x1d0 ? lock_release+0xee/0x310 ? put_cpu_partial+0x51/0x1d0 ? fs_reclaim_acquire+0x69/0xf0 ? lock_acquire+0xec/0x290 ? fs_reclaim_acquire+0x69/0xf0 ? kfree+0x22f/0x340 ? lock_release+0xee/0x310 ? kmalloc_trace_noprof+0x48/0x340 ? do_init_module+0x22/0x240 ? kmalloc_trace_noprof+0x155/0x340 ? do_init_module+0x60/0x240 ? __se_sys_finit_module+0x2e0/0x3f0 ? do_syscall_64+0xa4/0x180 ? syscall_exit_to_user_mode+0x108/0x140 ? do_syscall_64+0xb0/0x180 ? vma_end_read+0xd0/0xe0 ? do_user_addr_fault+0x309/0x640 ? clear_bhb_loop+0x45/0xa0 ? clear_bhb_loop+0x45/0xa0 ? clear_bhb_loop+0x45/0xa0 ? entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>
Fix this by stubbing these macros out when this config option isn't enabled, along with fixing the unused variable warning that introduces.
--- drivers/gpu/drm/drm_atomic_helper.c | 2 +- include/drm/drm_panic.h | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_atomic_helper.c +1 -1
@@ -3015,7 +3015,7 @@ int drm_atomic_helper_swap_state(struct drm_atomic_state *state, bool stall) {int i, ret; -unsigned long flags; +unsigned long flags =0 ;struct drm_connector *connector;struct drm_connector_state *old_conn_state, *new_conn_state;struct drm_crtc *crtc;
include/drm/drm_panic.h +14 -0
@@ -64,6 +64,8 @@ struct drm_scanout_buffer { }; +#ifdef CONFIG_DRM_PANIC +/** * drm_panic_trylock - try to enter the panic printing critical section * @dev: struct drm_device
@@ -149,4 +151,16 @@ struct drm_scanout_buffer {#define drm_panic_unlock (dev, flags) \ raw_spin_unlock_irqrestore(&(dev)->mode_config.panic_lock, flags) +#else + +static inline bool drm_panic_trylock (struct drm_device *dev,unsigned long flags) +{ +return true; +} + +static inline void drm_panic_lock (struct drm_device *dev,unsigned long flags) {} +static inline void drm_panic_unlock (struct drm_device *dev,unsigned long flags) {} + +#endif +#endif /* __DRM_PANIC_H__ */
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 120/146 drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit c1ab40a1fdfee732c7e6ff2fb8253760293e47e8 upstream.
The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure.
--- drivers/gpu/drm/sti/sti_hqvdp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/sti/sti_hqvdp.c +3 -0
@@ -1037,6 +1037,9 @@ static int sti_hqvdp_atomic_check(structreturn 0 ; crtc_state =drm_atomic_get_crtc_state (state, crtc); +if (IS_ERR (crtc_state)) +return PTR_ERR (crtc_state); + mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y;
Greg Kroah-Hartman
maintainerPATCH 121/146 drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream.
The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure.
--- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/sti/sti_gdp.c +3 -0
@@ -638,6 +638,9 @@ static int sti_gdp_atomic_check(struct d mixer =to_sti_mixer (crtc); crtc_state =drm_atomic_get_crtc_state (state, crtc); +if (IS_ERR (crtc_state)) +return PTR_ERR (crtc_state); + mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y;
Greg Kroah-Hartman
maintainerPATCH 122/146 drm: panel: jd9365da-h3: Remove unused num_init_cmds structure member
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
commit 66ae275365be4f118abe2254a0ced1d913af93f2 upstream.
Now that the driver has been converted to use wrapped MIPI DCS functions, the num_init_cmds structure member is no longer needed, so remove it.
--- drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c +0 -1
@@ -26,7 +26,6 @@ struct jadard_panel_desc {unsigned int lanes;enum mipi_dsi_pixel_format format;int (*init)(struct jadard *jadard); -u32 num_init_cmds;bool lp11_before_reset;bool reset_before_power_off_vcioo;unsigned int vcioo_to_lp11_delay_ms;
Greg Kroah-Hartman
maintainerPATCH 123/146 drm/sti: avoid potential dereference of error pointers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 831214f77037de02afc287eae93ce97f218d8c04 upstream.
The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure.
--- drivers/gpu/drm/sti/sti_cursor.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/sti/sti_cursor.c +3 -0
@@ -200,6 +200,9 @@ static int sti_cursor_atomic_check(strucreturn 0 ; crtc_state =drm_atomic_get_crtc_state (state, crtc); +if (IS_ERR (crtc_state)) +return PTR_ERR (crtc_state); + mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y;
Greg Kroah-Hartman
maintainerPATCH 124/146 drm/fbdev-dma: Select FB_DEFERRED_IO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit 67c40c9b2ec5f375bf78274d4e9ef0e3b8315bea upstream.
Commit 808a40b69468 ("drm/fbdev-dma: Implement damage handling and deferred I/O") added deferred I/O for fbdev-dma. Also select the Kconfig symbol FB_DEFERRED_IO (via FB_DMAMEM_HELPERS_DEFERRED). Fixes build errors about missing fbdefio, such as
drivers/gpu/drm/drm_fbdev_dma.c:218:26: error: 'struct drm_fb_helper' has no member named 'fbdefio'
218 | fb_helper->fbdefio.delay = HZ / 20;
| ^~drivers/gpu/drm/drm_fbdev_dma.c:219:26: error: 'struct drm_fb_helper' has no member named 'fbdefio'
219 | fb_helper->fbdefio.deferred_io = drm_fb_helper_deferred_io;
| ^~drivers/gpu/drm/drm_fbdev_dma.c:221:21: error: 'struct fb_info' has no member named 'fbdefio'
221 | info->fbdefio = &fb_helper->fbdefio;
| ^~drivers/gpu/drm/drm_fbdev_dma.c:221:43: error: 'struct drm_fb_helper' has no member named 'fbdefio'
221 | info->fbdefio = &fb_helper->fbdefio;
| ^~
--- drivers/gpu/drm/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/Kconfig +1 -1
@@ -327,7 +327,7 @@ config DRM_TTM_HELPER config DRM_GEM_DMA_HELPER tristate depends on DRM - select FB_DMAMEM_HELPERS if DRM_FBDEV_EMULATION + select FB_DMAMEM_HELPERS_DEFERRED if DRM_FBDEV_EMULATION help Choose this if you need the GEM DMA helper functions
Greg Kroah-Hartman
maintainerPATCH 125/146 drm/mediatek: Fix child node refcount handling in early exit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit f708e8b4cfd16e5c8cd8d7fcfcb2fb2c6ed93af3 upstream.
Early exits (goto, break, return) from for_each_child_of_node() required an explicit call to of_node_put(), which was not introduced with the break if cnt == MAX_CRTC.
Add the missing of_node_put() before the break.
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +3 -1
@@ -405,8 +405,10 @@ static bool mtk_drm_get_all_drm_priv(strif (temp_drm_priv->mtk_drm_bound) cnt++; -if (cnt ==MAX_CRTC ) +if (cnt ==MAX_CRTC ) { +of_node_put (node);break ; + } }if (drm_priv->data->mmsys_dev_num == cnt) {
Greg Kroah-Hartman
maintainerPATCH 126/146 drm/bridge: it6505: Fix inverted reset polarity
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
commit c5f3f21728b069412e8072b8b1d0a3d9d3ab0265 upstream.
The IT6505 bridge chip has a active low reset line. Since it is a "reset" and not an "enable" line, the GPIO should be asserted to put it in reset and deasserted to bring it out of reset during the power on sequence.
The polarity was inverted when the driver was first introduced, likely because the device family that was targeted had an inverting level shifter on the reset line.
The MT8186 Corsola devices already have the IT6505 in their device tree, but the whole display pipeline is actually disabled and won't be enabled until some remaining issues are sorted out. The other known user is the MT8183 Kukui / Jacuzzi family; their device trees currently do not have the IT6505 included.
Fix the polarity in the driver while there are no actual users.
--- drivers/gpu/drm/bridge/ite-it6505.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/bridge/ite-it6505.c +4 -4
@@ -2614,9 +2614,9 @@ static int it6505_poweron(struct it6505/* time interval between OVDD and SYSRSTN at least be 10ms */ if (pdata->gpiod_reset) {usleep_range (10000 ,20000 ); -gpiod_set_value_cansleep (pdata->gpiod_reset,0 ); -usleep_range (1000 ,2000 );gpiod_set_value_cansleep (pdata->gpiod_reset,1 ); +usleep_range (1000 ,2000 ); +gpiod_set_value_cansleep (pdata->gpiod_reset,0 );usleep_range (25000 ,35000 ); }
@@ -2647,7 +2647,7 @@ static int it6505_poweroff(struct it6505disable_irq_nosync (it6505->irq);if (pdata->gpiod_reset) -gpiod_set_value_cansleep (pdata->gpiod_reset,0 ); +gpiod_set_value_cansleep (pdata->gpiod_reset,1 );if (pdata->pwr18) { err =regulator_disable (pdata->pwr18);
@@ -3135,7 +3135,7 @@ static int it6505_init_pdata(struct it65return PTR_ERR (pdata->ovdd); } - pdata->gpiod_reset =devm_gpiod_get (dev,"reset" ,GPIOD_OUT_LOW ); + pdata->gpiod_reset =devm_gpiod_get (dev,"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (pdata->gpiod_reset)) {dev_err (dev,"gpiod_reset gpio not found" );return PTR_ERR (pdata->gpiod_reset);
Greg Kroah-Hartman
maintainerPATCH 127/146 drm/etnaviv: flush shader L1 cache after user commandstream
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
commit 4f8dbadef085ab447a01a8d4806a3f629fea05ed upstream.
The shader L1 cache is a writeback cache for shader loads/stores and thus must be flushed before any BOs backing the shader buffers are potentially freed.
--- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/etnaviv/etnaviv_buffer.c +2 -1
@@ -482,7 +482,8 @@ void etnaviv_buffer_queue(struct etnaviv }else {CMD_LOAD_STATE (buffer,VIVS_GL_FLUSH_CACHE ,VIVS_GL_FLUSH_CACHE_DEPTH | -VIVS_GL_FLUSH_CACHE_COLOR ); +VIVS_GL_FLUSH_CACHE_COLOR | +VIVS_GL_FLUSH_CACHE_SHADER_L1 );if (has_blt) {CMD_LOAD_STATE (buffer,VIVS_BLT_ENABLE ,0x1 );CMD_LOAD_STATE (buffer,VIVS_BLT_SET_COMMAND ,0x1 );
Greg Kroah-Hartman
maintainerPATCH 128/146 drm: xlnx: zynqmp_dpsub: fix hotplug detection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Dirkwinkel <[email protected]>
commit 71ba1c9b1c717831920c3d432404ee5a707e04b4 upstream.
drm_kms_helper_poll_init needs to be called after zynqmp_dpsub_kms_init. zynqmp_dpsub_kms_init creates the connector and without it we don't enable hotplug detection.
--- drivers/gpu/drm/xlnx/zynqmp_kms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/xlnx/zynqmp_kms.c +2 -2
@@ -509,12 +509,12 @@ int zynqmp_dpsub_drm_init(struct zynqmp_if (ret)return ret; -drm_kms_helper_poll_init (drm); - ret =zynqmp_dpsub_kms_init (dpsub);if (ret <0 ) goto err_poll_fini; +drm_kms_helper_poll_init (drm); +/* Reset all components and register the DRM device. */ drm_mode_config_reset (drm);
Greg Kroah-Hartman
maintainerPATCH 129/146 drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cavitt <[email protected]>
commit 55858fa7eb2f163f7aa34339fd3399ba4ff564c6 upstream.
Several OA registers and allowlist registers were missing from the save/restore list for GuC and could be lost during an engine reset. Add them to the list.
v2:
- Fix commit message (Umesh)
- Add missing closes (Ashutosh)
v3:
- Add missing fixes (Ashutosh)
--- drivers/gpu/drm/xe/xe_guc_ads.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/xe/xe_guc_ads.c +14 -0
@@ -13,6 +13,7 @@#include "regs/xe_engine_regs.h" #include "regs/xe_gt_regs.h" #include "regs/xe_guc_regs.h" +#include "regs/xe_oa_regs.h" #include "xe_bo.h" #include "xe_gt.h" #include "xe_gt_ccs_mode.h"
@@ -601,6 +602,11 @@ static unsigned int guc_mmio_regset_writguc_mmio_regset_write_one (ads, regset_map, e->reg, count++); } +for (i =0 ; i <RING_MAX_NONPRIV_SLOTS ; i++) +guc_mmio_regset_write_one (ads, regset_map, +RING_FORCE_TO_NONPRIV (hwe->mmio_base, i), + count++); +/* Wa_1607983814 */ if (needs_wa_1607983814 (xe) && hwe->class ==XE_ENGINE_CLASS_RENDER ) {for (i =0 ; i <LNCFCMOCS_REG_COUNT ; i++) {
@@ -609,6 +615,14 @@ static unsigned int guc_mmio_regset_writ } } +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL0 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL1 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL2 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL3 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL4 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL5 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL6 , count++); +return count; }
Re: [PATCH 6.12 129/146] drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
Quoted 1 line · Greg Kroah-Hartman
Hi Greg,
Quoted 2 lines
6.12-stable review patch. If anyone has any objections, please let me know.
No this patch should *NOT* be added. It was later reverted in:
0191fddf5374 ("Revert "drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs"")
Thanks.
--
Ashutosh
Quoted 72 lines
------------------
From: Jonathan Cavitt <[email protected]>
commit
55858fa7eb2f163f7aa34339fd3399ba4ff564c6upstream.Several OA registers and allowlist registers were missing from the save/restore list for GuC and could be lost during an engine reset. Add them to the list.
v2:
- Fix commit message (Umesh)
- Add missing closes (Ashutosh)v3:
- Add missing fixes (Ashutosh)Fixes dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")Suggested-by Umesh Nerlige Ramappa <[email protected]>Suggested-by John Harrison <[email protected]>Signed-off-by Jonathan Cavitt <[email protected]>CC [email protected] # v6.11+Reviewed-by Umesh Nerlige Ramappa <[email protected]>Reviewed-by Ashutosh Dixit <[email protected]>Signed-off-by Ashutosh Dixit <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/gpu/drm/xe/xe_guc_ads.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)drivers/gpu/drm/xe/xe_guc_ads.c +14
-0@@ -13,6 +13,7 @@#include "regs/xe_engine_regs.h" #include "regs/xe_gt_regs.h" #include "regs/xe_guc_regs.h" +#include "regs/xe_oa_regs.h" #include "xe_bo.h" #include "xe_gt.h" #include "xe_gt_ccs_mode.h" @@ -601,6 +602,11 @@ static unsigned int guc_mmio_regset_writguc_mmio_regset_write_one (ads, regset_map, e->reg, count++); } +for (i =0 ; i <RING_MAX_NONPRIV_SLOTS ; i++) +guc_mmio_regset_write_one (ads, regset_map, +RING_FORCE_TO_NONPRIV (hwe->mmio_base, i), + count++); +/* Wa_1607983814 */ if (needs_wa_1607983814 (xe) && hwe->class ==XE_ENGINE_CLASS_RENDER ) {for (i =0 ; i <LNCFCMOCS_REG_COUNT ; i++) {@@ -609,6 +615,14 @@ static unsigned int guc_mmio_regset_writ } } +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL0 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL1 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL2 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL3 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL4 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL5 , count++); +guc_mmio_regset_write_one (ads, regset_map,EU_PERF_CNTL6 , count++); +return count; }
Greg Kroah-Hartman
maintainerRe: [PATCH 6.12 129/146] drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
Quoted 11 lines · Ashutosh
Quoted 1 line · Greg Kroah-Hartman
Hi Greg,
Quoted 2 lines
6.12-stable review patch. If anyone has any objections, please let me know.
No this patch should *NOT* be added. It was later reverted in:
0191fddf5374("Revert "drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs"")
Oops, I missed that, sorry. I've queued the revert up now as well.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 130/146 drm/xe/migrate: fix pat index usage
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
commit 23346f85163de83aca6dc30dde3944131cf54706 upstream.
XE_CACHE_WB must be converted into the per-platform pat index for that particular caching mode, otherwise we are just encoding whatever happens to be the value of that enum.
--- drivers/gpu/drm/xe/xe_migrate.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_migrate.c +2 -1
@@ -1350,6 +1350,7 @@ __xe_migrate_update_pgtables(struct xe_migrate *m,/* For sysmem PTE's, need to map them in our hole.. */ if (!IS_DGFX (xe)) { +u16 pat_index = xe->pat.idx[XE_CACHE_WB ];u32 ptes, ofs; ppgtt_ofs =NUM_KERNEL_PDE -1 ;
@@ -1409,7 +1410,7 @@ __xe_migrate_update_pgtables(struct xe_migrate *m, pt_bo->update_index = current_update; addr = vm->pt_ops->pte_encode_bo (pt_bo,0 , -XE_CACHE_WB ,0 ); + pat_index,0 ); bb->cs[bb->len++] =lower_32_bits (addr); bb->cs[bb->len++] =upper_32_bits (addr); }
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 131/146 Revert "drm/radeon: Delay Connector detecting when HPD singals is unstable"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 979bfe291b5b30a9132c2fd433247e677b24c6aa upstream.
This reverts commit 949658cb9b69ab9d22a42a662b2fdc7085689ed8.
This causes a blank screen on boot.
--- drivers/gpu/drm/radeon/radeon_connectors.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/gpu/drm/radeon/radeon_connectors.c +0 -10
@@ -1255,16 +1255,6 @@ radeon_dvi_detect(struct drm_connector *connector, bool force) goto exit; } } - -if (dret && radeon_connector->hpd.hpd !=RADEON_HPD_NONE && - !radeon_hpd_sense (rdev, radeon_connector->hpd.hpd) && - connector->connector_type ==DRM_MODE_CONNECTOR_HDMIA ) { -DRM_DEBUG_KMS ("EDID is readable when HPD disconnected\n" ); -schedule_delayed_work (&rdev->hotplug_work,msecs_to_jiffies (1000 )); - ret = connector_status_disconnected; - goto exit; - } -if (dret) { radeon_connector->detected_by_load = false;radeon_connector_free_edid (connector);
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 132/146 drm/xe/migrate: use XE_BO_FLAG_PAGETABLE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
commit c78f4399188369a55eed69cbf19a8aad2a65ac75 upstream.
On some HW we want to avoid the host caching PTEs, since access from GPU side can be incoherent. However here the special migrate object is mapping PTEs which are written from the host and potentially cached. Use XE_BO_FLAG_PAGETABLE to ensure that non-cached mapping is used, on platforms where this matters.
--- drivers/gpu/drm/xe/xe_migrate.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_migrate.c +2 -1
@@ -209,7 +209,8 @@ static int xe_migrate_prepare_vm(struct num_entries *XE_PAGE_SIZE , ttm_bo_type_kernel,XE_BO_FLAG_VRAM_IF_DGFX (tile) | - XE_BO_FLAG_PINNED); +XE_BO_FLAG_PINNED | + XE_BO_FLAG_PAGETABLE);if (IS_ERR (bo))return PTR_ERR (bo);
Greg Kroah-Hartman
maintainerPATCH 133/146 drm/xe/guc_submit: fix race around suspend_pending
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
commit 87651f31ae4e6e6e7e6c7270b9b469405e747407 upstream.
Currently in some testcases we can trigger:
xe 0000:03:00.0: [drm] Assertion exec_queue_destroyed(q) failed!
....
WARNING: CPU: 18 PID: 2640 at drivers/gpu/drm/xe/xe_guc_submit.c:1826 xe_guc_sched_done_handler+0xa54/0xef0 [xe]
xe 0000:03:00.0: [drm] *ERROR* GT1: DEREGISTER_DONE: Unexpected engine state 0x00a1, guc_id=57
Looking at a snippet of corresponding ftrace for this GuC id we can see:
162.673311: xe_sched_msg_add: dev=0000:03:00.0, gt=1 guc_id=57, opcode=3
162.673317: xe_sched_msg_recv: dev=0000:03:00.0, gt=1 guc_id=57, opcode=3
162.673319: xe_exec_queue_scheduling_disable: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0x29, flags=0x0
162.674089: xe_exec_queue_kill: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0x29, flags=0x0
162.674108: xe_exec_queue_close: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0xa9, flags=0x0 162.674488: xe_exec_queue_scheduling_done: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0xa9, flags=0x0 162.678452: xe_exec_queue_deregister: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0xa1, flags=0x0
It looks like we try to suspend the queue (opcode=3), setting suspend_pending and triggering a disable_scheduling. The user then closes the queue. However the close will also forcefully signal the suspend fence after killing the queue, later when the G2H response for disable_scheduling comes back we have now cleared suspend_pending when signalling the suspend fence, so the disable_scheduling now incorrectly tries to also deregister the queue. This leads to warnings since the queue has yet to even be marked for destruction. We also seem to trigger errors later with trying to double unregister the same queue.
To fix this tweak the ordering when handling the response to ensure we don't race with a disable_scheduling that didn't actually intend to perform an unregister. The destruction path should now also correctly wait for any pending_disable before marking as destroyed.
--- drivers/gpu/drm/xe/xe_guc_submit.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_guc_submit.c +15 -2
@@ -1846,16 +1846,29 @@ static void handle_sched_done(struct xe_xe_gt_assert (guc_to_gt (guc), runnable_state ==0 );xe_gt_assert (guc_to_gt (guc),exec_queue_pending_disable (q)); -clear_exec_queue_pending_disable (q);if (q->guc->suspend_pending) {suspend_fence_signal (q); +clear_exec_queue_pending_disable (q); }else {if (exec_queue_banned (q) || check_timeout) {smp_wmb ();wake_up_all (&guc->ct.wq); } -if (!check_timeout) +if (!check_timeout &&exec_queue_destroyed (q)) { +/* +* Make sure to clear the pending_disable only +* after sampling the destroyed state. We want +* to ensure we don't trigger the unregister too +* early with something intending to only +* disable scheduling. The caller doing the +* destroy must wait for an ongoing +* pending_disable before marking as destroyed. +*/ +clear_exec_queue_pending_disable (q);deregister_exec_queue (guc, q); + }else { +clear_exec_queue_pending_disable (q); + } } } }
Greg Kroah-Hartman
maintainerPATCH 134/146 drm/amdkfd: Use the correct wptr size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
commit cdc6705f98ea3f854a60ba8c9b19228e197ae384 upstream.
Write pointer could be 32-bit or 64-bit. Use the correct size during initialization.
--- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c +1 -1
@@ -125,7 +125,7 @@ static bool kq_initialize(struct kernel_memset (kq->pq_kernel_addr,0 , queue_size);memset (kq->rptr_kernel,0 ,sizeof (*kq->rptr_kernel)); -memset (kq->wptr_kernel,0 ,sizeof (*kq->wptr_kernel)); +memset (kq->wptr_kernel,0 , dev->kfd->device_info.doorbell_size); prop.queue_size = queue_size; prop.is_interop = false;
Greg Kroah-Hartman
maintainerPATCH 135/146 drm/amdgpu/pm: add gen5 display to the user on smu v14.0.2/3
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Feng <[email protected]>
commit 6719ab8234ce4b0c0e9aa93aaa94961e5b2bc852 upstream.
add gen5 display to the user on smu v14.0.2/3
--- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 ++++++-- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 6 ++++-- 4 files changed, 12 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +6 -2
@@ -1695,7 +1695,9 @@ static int smu_smc_hw_setup(struct smu_creturn ret; } -if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4 ) +if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN5 ) + pcie_gen =4 ; +else if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4 ) pcie_gen =3 ;else if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3 ) pcie_gen =2 ;
@@ -1708,7 +1710,9 @@ static int smu_smc_hw_setup(struct smu_c* Bit 15:8: PCIE GEN, 0 to 3 corresponds to GEN1 to GEN4 * Bit 7:0: PCIE lane width, 1 to 7 corresponds is x1 to x32 */ -if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 ) +if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X32 ) + pcie_width =7 ; +else if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 ) pcie_width =6 ;else if (adev->pm.pcie_mlw_mask &CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 ) pcie_width =5 ;
drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h +1 -1
@@ -53,7 +53,7 @@#define CTF_OFFSET_MEM 5extern const int decoded_link_speed[5 ]; -extern const int decoded_link_width[7 ]; +extern const int decoded_link_width[8 ];#define DECODE_GEN_SPEED (gen_speed_idx) (decoded_link_speed[gen_speed_idx])#define DECODE_LANE_WIDTH (lane_width_idx) (decoded_link_width[lane_width_idx])
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c +1 -1
@@ -49,7 +49,7 @@#define regMP1_SMN_IH_SW_INT_CTRL_mp1_14_0_0_BASE_IDX 0const int decoded_link_speed[5 ] = {1 ,2 ,3 ,4 ,5 }; -const int decoded_link_width[7 ] = {0 ,1 ,2 ,4 ,8 ,12 ,16 }; +const int decoded_link_width[8 ] = {0 ,1 ,2 ,4 ,8 ,12 ,16 ,32 };/* * DO NOT use these for err/warn/info/debug messages. * Use dev_err, dev_warn, dev_info and dev_dbg instead.
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +4 -2
@@ -1186,13 +1186,15 @@ static int smu_v14_0_2_print_clk_levels( (pcie_table->pcie_gen[i] ==0 ) ?"2.5GT/s," : (pcie_table->pcie_gen[i] ==1 ) ?"5.0GT/s," : (pcie_table->pcie_gen[i] ==2 ) ?"8.0GT/s," : - (pcie_table->pcie_gen[i] ==3 ) ?"16.0GT/s," :"" , + (pcie_table->pcie_gen[i] ==3 ) ?"16.0GT/s," : + (pcie_table->pcie_gen[i] ==4 ) ?"32.0GT/s," :"" , (pcie_table->pcie_lane[i] ==1 ) ?"x1" : (pcie_table->pcie_lane[i] ==2 ) ?"x2" : (pcie_table->pcie_lane[i] ==3 ) ?"x4" : (pcie_table->pcie_lane[i] ==4 ) ?"x8" : (pcie_table->pcie_lane[i] ==5 ) ?"x12" : - (pcie_table->pcie_lane[i] ==6 ) ?"x16" :"" , + (pcie_table->pcie_lane[i] ==6 ) ?"x16" : + (pcie_table->pcie_lane[i] ==7 ) ?"x32" :"" , pcie_table->clk_freq[i], (gen_speed ==DECODE_GEN_SPEED (pcie_table->pcie_gen[i])) && (lane_width == DECODE_LANE_WIDTH(pcie_table->pcie_lane[i])) ?
Greg Kroah-Hartman
maintainerPATCH 136/146 drm/amd: Add some missing straps from NBIO 7.11.0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 902fbbf429b8213232b18de0ddfd5c0f3851cb8f upstream.
Earlier ASICs have strap information exported, and this is missing for NBIO 7.11.0.
--- drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_offset.h | 2 + drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_sh_mask.h | 13 ++++++++++ 2 files changed, 15 insertions(+)
drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_offset.h +2 -0
@@ -7571,6 +7571,8 @@// base address: 0x10100000 #define regRCC_STRAP0_RCC_DEV0_EPF0_STRAP0 0xd000#define regRCC_STRAP0_RCC_DEV0_EPF0_STRAP0_BASE_IDX 5 +#define regRCC_DEV0_EPF5_STRAP4 0xd284 +#define regRCC_DEV0_EPF5_STRAP4_BASE_IDX 5// addressBlock: nbio_nbif0_bif_rst_bif_rst_regblk
drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_sh_mask.h +13 -0
@@ -50665,6 +50665,19 @@#define RCC_STRAP0_RCC_DEV0_EPF0_STRAP0__STRAP_D1_SUPPORT_DEV0_F0_MASK 0x40000000L#define RCC_STRAP0_RCC_DEV0_EPF0_STRAP0__STRAP_D2_SUPPORT_DEV0_F0_MASK 0x80000000L +//RCC_DEV0_EPF5_STRAP4 +#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_64BIT_EN_DEV0_F5__SHIFT 0x14 +#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_EN_DEV0_F5__SHIFT 0x15 +#define RCC_DEV0_EPF5_STRAP4__STRAP_FLR_EN_DEV0_F5__SHIFT 0x16 +#define RCC_DEV0_EPF5_STRAP4__STRAP_PME_SUPPORT_DEV0_F5__SHIFT 0x17 +#define RCC_DEV0_EPF5_STRAP4__STRAP_INTERRUPT_PIN_DEV0_F5__SHIFT 0x1c +#define RCC_DEV0_EPF5_STRAP4__STRAP_AUXPWR_SUPPORT_DEV0_F5__SHIFT 0x1f +#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_64BIT_EN_DEV0_F5_MASK 0x00100000L +#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_EN_DEV0_F5_MASK 0x00200000L +#define RCC_DEV0_EPF5_STRAP4__STRAP_FLR_EN_DEV0_F5_MASK 0x00400000L +#define RCC_DEV0_EPF5_STRAP4__STRAP_PME_SUPPORT_DEV0_F5_MASK 0x0F800000L +#define RCC_DEV0_EPF5_STRAP4__STRAP_INTERRUPT_PIN_DEV0_F5_MASK 0x70000000L +#define RCC_DEV0_EPF5_STRAP4__STRAP_AUXPWR_SUPPORT_DEV0_F5_MASK 0x80000000L// addressBlock: nbio_nbif0_bif_rst_bif_rst_regblk //HARD_RST_CTRL
Greg Kroah-Hartman
maintainerPATCH 137/146 drm/amdgpu: fix usage slab after free
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Prosyak <[email protected]>
commit b61badd20b443eabe132314669bb51a263982e5c upstream.
[ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147
[ +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0+ #1 [ +0.000016] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000016] Call Trace: [ +0.000008] <TASK> [ +0.000009] dump_stack_lvl+0x76/0xa0 [ +0.000017] print_report+0xce/0x5f0 [ +0.000017] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000019] ? srso_return_thunk+0x5/0x5f [ +0.000015] ? kasan_complete_mode_report_info+0x72/0x200 [ +0.000016] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000019] kasan_report+0xbe/0x110 [ +0.000015] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000023] __asan_report_load8_noabort+0x14/0x30 [ +0.000014] drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_write+0x14/0x30 [ +0.000016] ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched] [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_write+0x14/0x30 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? enable_work+0x124/0x220 [ +0.000015] ? __pfx_enable_work+0x10/0x10 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? free_large_kmalloc+0x85/0xf0 [ +0.000016] drm_sched_entity_destroy+0x18/0x30 [gpu_sched] [ +0.000020] amdgpu_vce_sw_fini+0x55/0x170 [amdgpu] [ +0.000735] ? __kasan_check_read+0x11/0x20 [ +0.000016] vce_v4_0_sw_fini+0x80/0x110 [amdgpu] [ +0.000726] amdgpu_device_fini_sw+0x331/0xfc0 [amdgpu] [ +0.000679] ? mutex_unlock+0x80/0xe0 [ +0.000017] ? __pfx_amdgpu_device_fini_sw+0x10/0x10 [amdgpu] [ +0.000662] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_check_write+0x14/0x30 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? mutex_unlock+0x80/0xe0 [ +0.000016] amdgpu_driver_release_kms+0x16/0x80 [amdgpu] [ +0.000663] drm_minor_release+0xc9/0x140 [drm] [ +0.000081] drm_release+0x1fd/0x390 [drm] [ +0.000082] __fput+0x36c/0xad0 [ +0.000018] __fput_sync+0x3c/0x50 [ +0.000014] __x64_sys_close+0x7d/0xe0 [ +0.000014] x64_sys_call+0x1bc6/0x2680 [ +0.000014] do_syscall_64+0x70/0x130 [ +0.000014] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? irqentry_exit_to_user_mode+0x60/0x190 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? irqentry_exit+0x43/0x50 [ +0.000012] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? exc_page_fault+0x7c/0x110 [ +0.000015] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000014] RIP: 0033:0x7ffff7b14f67 [ +0.000013] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff [ +0.000026] RSP: 002b:00007fffffffe378 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ +0.000019] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67 [ +0.000014] RDX: 0000000000000000 RSI: 00007ffff7f6f47a RDI: 0000000000000003 [ +0.000014] RBP: 00007fffffffe3a0 R08: 0000555555569890 R09: 0000000000000000 [ +0.000014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8 [ +0.000013] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040 [ +0.000020] </TASK>
[ +0.000016] Allocated by task 383 on cpu 7 at 26.880319s: [ +0.000014] kasan_save_stack+0x28/0x60 [ +0.000008] kasan_save_track+0x18/0x70 [ +0.000007] kasan_save_alloc_info+0x38/0x60 [ +0.000007] __kasan_kmalloc+0xc1/0xd0 [ +0.000007] kmalloc_trace_noprof+0x180/0x380 [ +0.000007] drm_sched_init+0x411/0xec0 [gpu_sched] [ +0.000012] amdgpu_device_init+0x695f/0xa610 [amdgpu] [ +0.000658] amdgpu_driver_load_kms+0x1a/0x120 [amdgpu] [ +0.000662] amdgpu_pci_probe+0x361/0xf30 [amdgpu] [ +0.000651] local_pci_probe+0xe7/0x1b0 [ +0.000009] pci_device_probe+0x248/0x890 [ +0.000008] really_probe+0x1fd/0x950 [ +0.000008] __driver_probe_device+0x307/0x410 [ +0.000007] driver_probe_device+0x4e/0x150 [ +0.000007] __driver_attach+0x223/0x510 [ +0.000006] bus_for_each_dev+0x102/0x1a0 [ +0.000007] driver_attach+0x3d/0x60 [ +0.000006] bus_add_driver+0x2ac/0x5f0 [ +0.000006] driver_register+0x13d/0x490 [ +0.000008] __pci_register_driver+0x1ee/0x2b0 [ +0.000007] llc_sap_close+0xb0/0x160 [llc] [ +0.000009] do_one_initcall+0x9c/0x3e0 [ +0.000008] do_init_module+0x241/0x760 [ +0.000008] load_module+0x51ac/0x6c30 [ +0.000006] __do_sys_init_module+0x234/0x270 [ +0.000007] __x64_sys_init_module+0x73/0xc0 [ +0.000006] x64_sys_call+0xe3/0x2680 [ +0.000006] do_syscall_64+0x70/0x130 [ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ +0.000015] Freed by task 2147 on cpu 6 at 160.507651s: [ +0.000013] kasan_save_stack+0x28/0x60 [ +0.000007] kasan_save_track+0x18/0x70 [ +0.000007] kasan_save_free_info+0x3b/0x60 [ +0.000007] poison_slab_object+0x115/0x1c0 [ +0.000007] __kasan_slab_free+0x34/0x60 [ +0.000007] kfree+0xfa/0x2f0 [ +0.000007] drm_sched_fini+0x19d/0x410 [gpu_sched] [ +0.000012] amdgpu_fence_driver_sw_fini+0xc4/0x2f0 [amdgpu] [ +0.000662] amdgpu_device_fini_sw+0x77/0xfc0 [amdgpu] [ +0.000653] amdgpu_driver_release_kms+0x16/0x80 [amdgpu] [ +0.000655] drm_minor_release+0xc9/0x140 [drm] [ +0.000071] drm_release+0x1fd/0x390 [drm] [ +0.000071] __fput+0x36c/0xad0 [ +0.000008] __fput_sync+0x3c/0x50 [ +0.000007] __x64_sys_close+0x7d/0xe0 [ +0.000007] x64_sys_call+0x1bc6/0x2680 [ +0.000007] do_syscall_64+0x70/0x130 [ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ +0.000014] The buggy address belongs to the object at ffff8881b8605f80
which belongs to the cache kmalloc-64 of size 64
[ +0.000020] The buggy address is located 8 bytes inside of
freed 64-byte region [ffff8881b8605f80, ffff8881b8605fc0)
[ +0.000028] The buggy address belongs to the physical page: [ +0.000011] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b8605 [ +0.000008] anon flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ +0.000007] page_type: 0xffffefff(slab) [ +0.000009] raw: 0017ffffc0000000 ffff8881000428c0 0000000000000000 dead000000000001 [ +0.000006] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 [ +0.000006] page dumped because: kasan: bad access detected
[ +0.000012] Memory state around the buggy address: [ +0.000011] ffff8881b8605e80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ +0.000015] ffff8881b8605f00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ +0.000015] >ffff8881b8605f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ +0.000013] ^ [ +0.000011] ffff8881b8606000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ +0.000014] ffff8881b8606080: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb [ +0.000013] ==================================================================
The issue reproduced on VG20 during the IGT pci_unplug test.
The root cause of the issue is that the function drm_sched_fini is called before drm_sched_entity_kill. In drm_sched_fini, the drm_sched_rq structure is freed, but this structure is later accessed by each entity within the run queue, leading to invalid memory access.
To resolve this, the order of cleanup calls is updated:
Before:
amdgpu_fence_driver_sw_fini
amdgpu_device_ip_fini
After:
amdgpu_device_ip_fini
amdgpu_fence_driver_sw_fini
This updated order ensures that all entities in the IPs are cleaned up first, followed by proper cleanup of the schedulers.
Additional Investigation:
During debugging, another issue was identified in the amdgpu_vce_sw_fini function. The vce.vcpu_bo buffer must be freed only as the final step in the cleanup process to prevent any premature access during earlier cleanup stages.
v2: Using Christian suggestion call drm_sched_entity_destroy before drm_sched_fini.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +1 -1
@@ -4584,8 +4584,8 @@ void amdgpu_device_fini_sw(struct amdgpuint idx;bool px; -amdgpu_fence_driver_sw_fini (adev);amdgpu_device_ip_fini (adev); +amdgpu_fence_driver_sw_fini (adev);amdgpu_ucode_release (&adev->firmware.gpu_info_fw); adev->accel_working = false;dma_fence_put (rcu_dereference_protected (adev->gang_submit, true));
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +3 -3
@@ -214,15 +214,15 @@ int amdgpu_vce_sw_fini(struct amdgpu_devdrm_sched_entity_destroy (&adev->vce.entity); -amdgpu_bo_free_kernel (&adev->vce.vcpu_bo, &adev->vce.gpu_addr, - (void **)&adev->vce.cpu_addr); -for (i =0 ; i < adev->vce.num_rings; i++)amdgpu_ring_fini (&adev->vce.ring[i]);amdgpu_ucode_release (&adev->vce.fw);mutex_destroy (&adev->vce.idle_mutex); +amdgpu_bo_free_kernel (&adev->vce.vcpu_bo, &adev->vce.gpu_addr, + (void **)&adev->vce.cpu_addr); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 138/146 drm/amd/pm: skip setting the power source on smu v14.0.2/3
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Feng <[email protected]>
commit 76c7f08094767b5df3b60e18d1bdecddd4a5c844 upstream.
skip setting power source on smu v14.0.2/3
--- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +0 -1
@@ -2769,7 +2769,6 @@ static const struct pptable_funcs smu_v1 .get_unique_id = smu_v14_0_2_get_unique_id, .get_power_limit = smu_v14_0_2_get_power_limit, .set_power_limit = smu_v14_0_2_set_power_limit, - .set_power_source = smu_v14_0_set_power_source, .get_power_profile_mode = smu_v14_0_2_get_power_profile_mode, .set_power_profile_mode = smu_v14_0_2_set_power_profile_mode, .run_btc = smu_v14_0_run_btc,
Greg Kroah-Hartman
maintainerPATCH 139/146 drm/amd: Fix initialization mistake for NBIO 7.11 devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 349af06a3abd0bb3787ee2daf3ac508412fe8dcc upstream.
There is a strapping issue on NBIO 7.11.x that can lead to spurious PME events while in the D0 state.
--- drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c +9 -0
@@ -275,6 +275,15 @@ static void nbio_v7_11_init_registers(stif (def != data)WREG32_SOC15 (NBIO ,0 , regBIF_BIF256_CI256_RC3X4_USB4_PCIE_MST_CTRL_3, data); +switch (adev->ip_versions[NBIO_HWIP ][0 ]) { +case IP_VERSION (7 ,11 ,0 ): +case IP_VERSION (7 ,11 ,1 ): +case IP_VERSION (7 ,11 ,2 ): +case IP_VERSION (7 ,11 ,3 ): + data =RREG32_SOC15 (NBIO ,0 , regRCC_DEV0_EPF5_STRAP4) & ~BIT (23 ); +WREG32_SOC15 (NBIO ,0 , regRCC_DEV0_EPF5_STRAP4, data); +break ; + } } static void nbio_v7_11_update_medium_grain_clock_gating(struct amdgpu_device *adev,
Greg Kroah-Hartman
maintainerPATCH 140/146 drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Umio Yasuno <[email protected]>
commit 2abf2f7032df4c4e7f6cf7906da59d0e614897d6 upstream.
These were missed before.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +2 -0
@@ -2061,6 +2061,8 @@ static ssize_t smu_v13_0_7_get_gpu_metri gpu_metrics->average_dclk1_frequency = metrics->AverageDclk1Frequency; gpu_metrics->current_gfxclk = metrics->CurrClock[PPCLK_GFXCLK ]; + gpu_metrics->current_socclk = metrics->CurrClock[PPCLK_SOCCLK ]; + gpu_metrics->current_uclk = metrics->CurrClock[PPCLK_UCLK ]; gpu_metrics->current_vclk0 = metrics->CurrClock[PPCLK_VCLK_0 ]; gpu_metrics->current_dclk0 = metrics->CurrClock[PPCLK_DCLK_0 ]; gpu_metrics->current_vclk1 = metrics->CurrClock[PPCLK_VCLK_1 ];
Greg Kroah-Hartman
maintainerPATCH 141/146 drm/amd/pm: disable pcie speed switching on Intel platform for smu v14.0.2/3
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Feng <[email protected]>
commit b0df0e777874549c128b43f7bf4989a2ed24b37a upstream.
disable pcie speed switching on Intel platform for smu v14.0.2/3 based on Intel's requirement.
v2: align the setting with smu v13.
--- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 26 ++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +23 -3
@@ -1477,15 +1477,35 @@ static int smu_v14_0_2_update_pcie_paramstruct smu_14_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;struct smu_14_0_pcie_table *pcie_table = &dpm_context->dpm_tables.pcie_table; +int num_of_levels = pcie_table->num_of_link_levels;uint32_t smu_pcie_arg;int ret, i; -for (i =0 ; i < pcie_table->num_of_link_levels; i++) { -if (pcie_table->pcie_gen[i] > pcie_gen_cap) +if (!num_of_levels) +return 0 ; + +if (!(smu->adev->pm.pp_feature &PP_PCIE_DPM_MASK )) { +if (pcie_table->pcie_gen[num_of_levels -1 ] < pcie_gen_cap) + pcie_gen_cap = pcie_table->pcie_gen[num_of_levels -1 ]; + +if (pcie_table->pcie_lane[num_of_levels -1 ] < pcie_width_cap) + pcie_width_cap = pcie_table->pcie_lane[num_of_levels -1 ]; + +/* Force all levels to use the same settings */ +for (i =0 ; i < num_of_levels; i++) { pcie_table->pcie_gen[i] = pcie_gen_cap; -if (pcie_table->pcie_lane[i] > pcie_width_cap) pcie_table->pcie_lane[i] = pcie_width_cap; + } + }else { +for (i =0 ; i < num_of_levels; i++) { +if (pcie_table->pcie_gen[i] > pcie_gen_cap) + pcie_table->pcie_gen[i] = pcie_gen_cap; +if (pcie_table->pcie_lane[i] > pcie_width_cap) + pcie_table->pcie_lane[i] = pcie_width_cap; + } + } +for (i =0 ; i < num_of_levels; i++) { smu_pcie_arg = i <<16 ; smu_pcie_arg |= pcie_table->pcie_gen[i] <<8 ; smu_pcie_arg |= pcie_table->pcie_lane[i];
Greg Kroah-Hartman
maintainerPATCH 142/146 drm/amd/pm: Remove arcturus min power limit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
commit da868898cf4c5ddbd1f7406e356edce5d7211eb5 upstream.
As per power team, there is no need to impose a lower bound on arcturus power limit. Any unreasonable limit set will result in frequent throttling.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c +5 -1
@@ -1344,8 +1344,12 @@ static int arcturus_get_power_limit(stru *default_power_limit = power_limit;if (max_power_limit) *max_power_limit = power_limit; +/** +* No lower bound is imposed on the limit. Any unreasonable limit set +* will result in frequent throttling. +*/ if (min_power_limit) - *min_power_limit = power_limit; + *min_power_limit =0 ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 143/146 drm/amd/display: Fix handling of plane refcount
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Aberback <[email protected]>
commit 27227a234c1487cb7a684615f0749c455218833a upstream.
[Why]
The mechanism to backup and restore plane states doesn't maintain refcount, which can cause issues if the refcount of the plane changes in between backup and restore operations, such as memory leaks if the refcount was supposed to go down, or double frees / invalid memory accesses if the refcount was supposed to go up.
[How]
Cache and re-apply current refcount when restoring plane states.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc.c +3 -0
@@ -3066,7 +3066,10 @@ static void restore_planes_and_stream_streturn ;for (i =0 ; i < status->plane_count; i++) { +/* refcount will always be valid, restore everything else */ +struct kref refcount = status->plane_states[i]->refcount; *status->plane_states[i] = scratch->plane_states[i]; + status->plane_states[i]->refcount = refcount; } *stream = scratch->stream_state; }
Greg Kroah-Hartman
maintainerPATCH 144/146 drm/amd/display: update pipe selection policy to check head pipe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihan Zhu <[email protected]>
commit 8fef253c94a5312b9150b2ff8e633b331bac7e88 upstream.
[Why]
No check on head pipe during the dml to dc hw mapping will allow illegal pipe usage. This will result in a wrong pipe topology to cause mpcc tree totally mess up then cause a display hang.
[How]
Avoid to use the pipe is head in all check and avoid ODM slice during preferred pipe check.
--- drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 23 +++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c +22 -1
@@ -258,12 +258,25 @@ static unsigned int find_preferred_pipe_* However this condition comes with a caveat. We need to ignore pipes that will * require a change in OPP but still have the same stream id. For example during * an MPC to ODM transiton. +* +* Adding check to avoid pipe select on the head pipe by utilizing dc resource +* helper function resource_get_primary_dpp_pipe and comparing the pipe index. */ if (existing_state) {for (i =0 ; i < pipe_count; i++) {if (existing_state->res_ctx.pipe_ctx[i].stream && existing_state->res_ctx.pipe_ctx[i].stream->stream_id == stream_id) { +struct pipe_ctx *head_pipe = +resource_is_pipe_type (&existing_state->res_ctx.pipe_ctx[i],DPP_PIPE ) ? +resource_get_primary_dpp_pipe (&existing_state->res_ctx.pipe_ctx[i]) : +NULL ; + +// we should always respect the head pipe from selection +if (head_pipe && head_pipe->pipe_idx == i) +continue ;if (existing_state->res_ctx.pipe_ctx[i].plane_res.hubp && - existing_state->res_ctx.pipe_ctx[i].plane_res.hubp->opp_id != i) + existing_state->res_ctx.pipe_ctx[i].plane_res.hubp->opp_id != i && + (existing_state->res_ctx.pipe_ctx[i].prev_odm_pipe || + existing_state->res_ctx.pipe_ctx[i].next_odm_pipe))continue ; preferred_pipe_candidates[num_preferred_candidates++] = i;
@@ -292,6 +305,14 @@ static unsigned int find_last_resort_pip*/ if (existing_state) {for (i =0 ; i < pipe_count; i++) { +struct pipe_ctx *head_pipe = +resource_is_pipe_type (&existing_state->res_ctx.pipe_ctx[i],DPP_PIPE ) ? +resource_get_primary_dpp_pipe (&existing_state->res_ctx.pipe_ctx[i]) : +NULL ; + +// we should always respect the head pipe from selection +if (head_pipe && head_pipe->pipe_idx == i) +continue ;if ((existing_state->res_ctx.pipe_ctx[i].plane_res.hubp && existing_state->res_ctx.pipe_ctx[i].plane_res.hubp->opp_id != i) || existing_state->res_ctx.pipe_ctx[i].stream_res.tg)
Greg Kroah-Hartman
maintainerPATCH 145/146 drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Bunea <[email protected]>
commit a3e6079bd93d5c66a43bf6a5f90e5b98465dc7b3 upstream.
There are cases where an OTG is remapped from driving a regular HDMI display to a DP/eDP display. There are also cases where DTBCLK needs to be enabled for HPO, but DTBCLK DTO programming may be done while OTG is still enabled which is dangerous as the PIPE_DTO_SRC_SEL programming may change the pixel clock generator source for a mapped and running OTG and cause it to hang.
Remove the PIPE_DTO_SRC_SEL programming from this sequence since it is already done in program_pixel_clk(). Additionally, make sure that program_pixel_clk sets DTBCLK DTO as source for special HDMI cases.
--- .../drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c +9 -6
@@ -1392,10 +1392,10 @@ static void dccg35_set_dtbclk_dto(/* The recommended programming sequence to enable DTBCLK DTO to generate * valid pixel HPO DPSTREAM ENCODER, specifies that DTO source select should -* be set only after DTO is enabled +* be set only after DTO is enabled. +* PIPEx_DTO_SRC_SEL should not be programmed during DTBCLK update since OTG may still be on, and the +* programming is handled in program_pix_clk() regardless, so it can be removed from here. */ -REG_UPDATE (OTG_PIXEL_RATE_CNTL [params->otg_inst], -PIPE_DTO_SRC_SEL [params->otg_inst],2 ); }else {switch (params->otg_inst) {case 0 :
@@ -1412,9 +1412,12 @@ static void dccg35_set_dtbclk_dto(break ; } -REG_UPDATE_2 (OTG_PIXEL_RATE_CNTL [params->otg_inst], -DTBCLK_DTO_ENABLE [params->otg_inst],0 , -PIPE_DTO_SRC_SEL [params->otg_inst], params->is_hdmi ?0 :1 ); +/** +* PIPEx_DTO_SRC_SEL should not be programmed during DTBCLK update since OTG may still be on, and the +* programming is handled in program_pix_clk() regardless, so it can be removed from here. +*/ +REG_UPDATE (OTG_PIXEL_RATE_CNTL [params->otg_inst], +DTBCLK_DTO_ENABLE [params->otg_inst],0 );REG_WRITE (DTBCLK_DTO_MODULO [params->otg_inst],0 );REG_WRITE (DTBCLK_DTO_PHASE [params->otg_inst],0 );
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 146/146 posix-timers: Target group sigqueue to current task only if not exiting
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
commit 63dffecfba3eddcf67a8f76d80e0c141f93d44a5 upstream.
A sigqueue belonging to a posix timer, which target is not a specific thread but a whole thread group, is preferrably targeted to the current task if it is part of that thread group.
However nothing prevents a posix timer event from queueing such a sigqueue from a reaped yet running task. The interruptible code space between exit_notify() and the final call to schedule() is enough for posix_timer_fn() hrtimer to fire.
If that happens while the current task is part of the thread group target, it is proposed to handle it but since its sighand pointer may have been cleared already, the sigqueue is dropped even if there are other tasks running within the group that could handle it.
As a result posix timers with thread group wide target may miss signals when some of their threads are exiting.
Fix this with verifying that the current task hasn't been through exit_notify() before proposing it as a preferred target so as to ensure that its sighand is still here and stable.
complete_signal() might still reconsider the choice and find a better target within the group if current has passed retarget_shared_pending() already.
--- kernel/signal.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
kernel/signal.c +5 -4
@@ -1986,14 +1986,15 @@ int send_sigqueue(struct sigqueue *q, st* into t->pending). * * Where type is not PIDTYPE_PID, signals must be delivered to the -* process. In this case, prefer to deliver to current if it is in -* the same thread group as the target process, which avoids -* unnecessarily waking up a potentially idle task. +* process. In this case, prefer to deliver to current if it is in the +* same thread group as the target process and its sighand is stable, +* which avoids unnecessarily waking up a potentially idle task. */ t =pid_task (pid, type);if (!t) goto ret; -if (type !=PIDTYPE_PID &&same_thread_group (t, current)) +if (type !=PIDTYPE_PID && +same_thread_group (t, current) && !current->exit_state) t = current;if (!likely (lock_task_sighand (t, &flags))) goto ret;
Works as it should
AMD Ryzen 5 5600 6-Core Processor:
https://www.inet.se/produkt/5304697/amd-ryzen-5-5600-3-5-ghz-35mb on a
https://www.gigabyte.com/Motherboard/B550-AORUS-ELITE-V2-rev-12
https://www.inet.se/produkt/1903406/gigabyte-b550-aorus-elite-v2
motherboard :)
running Arch Linux with the testing repos enabled:
https://archlinux.org/ https://archboot.com/
https://wiki.archlinux.org/title/Arch_Testing_Team
Den fre 6 dec. 2024 kl 15:39 skrev Greg Kroah-Hartman <[email protected]>:
Quoted 615 lines
This is the start of the stable review cycle for the 6.12.4 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 6.12.4-rc1Frederic Weisbecker <[email protected]>
posix-timers: Target group sigqueue to current task only if not exitingOvidiu Bunea <[email protected]>
drm/amd/display: RemovePIPE_DTO_SRC_SELprogramming fromset_dtbclk_dtoYihan Zhu <[email protected]>
drm/amd/display: update pipe selection policy to check head pipeJoshua Aberback <[email protected]>
drm/amd/display: Fix handling of plane refcountLijo Lazar <[email protected]>
drm/amd/pm: Remove arcturus min power limitKenneth Feng <[email protected]>
drm/amd/pm: disable pcie speed switching on Intel platform for smu v14.0.2/3Umio Yasuno <[email protected]>
drm/amd/pm: updatecurrent_socclkandcurrent_uclkingpu_metricson smu v13.0.7Mario Limonciello <[email protected]>
drm/amd: Fix initialization mistake for NBIO 7.11 devicesKenneth Feng <[email protected]>
drm/amd/pm: skip setting the power source on smu v14.0.2/3Vitaly Prosyak <[email protected]>
drm/amdgpu: fix usage slab after freeMario Limonciello <[email protected]>
drm/amd: Add some missing straps from NBIO 7.11.0Kenneth Feng <[email protected]>
drm/amdgpu/pm: add gen5 display to the user on smu v14.0.2/3Lijo Lazar <[email protected]>
drm/amdkfd: Use the correct wptr sizeMatthew Auld <[email protected]>
drm/xe/guc_submit: fix race aroundsuspend_pendingMatthew Auld <[email protected]>
drm/xe/migrate: useXE_BO_FLAG_PAGETABLEAlex Deucher <[email protected]>
Revert "drm/radeon: Delay Connector detecting when HPD singals is unstable"Matthew Auld <[email protected]>
drm/xe/migrate: fix pat index usageJonathan Cavitt <[email protected]>
drm/xe/xe_guc_ads: save/restore OA registers and allowlist regsSteffen Dirkwinkel <[email protected]>
drm: xlnx:zynqmp_dpsub: fix hotplug detectionLucas Stach <[email protected]>
drm/etnaviv: flush shader L1 cache after user commandstreamChen-Yu Tsai <[email protected]>
drm/bridge: it6505: Fix inverted reset polarityJavier Carrasco <[email protected]>
drm/mediatek: Fix child node refcount handling in early exitThomas Zimmermann <[email protected]>
drm/fbdev-dma: SelectFB_DEFERRED_IOMa Ke <[email protected]>
drm/sti: avoid potential dereference of error pointersHugo Villeneuve <[email protected]>
drm: panel: jd9365da-h3: Remove unusednum_init_cmdsstructure memberMa Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers insti_gdp_atomic_checkMa Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers insti_hqvdp_atomic_checkLyude Paul <[email protected]>
drm/panic: Fix uninitialized spinlock acquisition withCONFIG_DRM_PANIC=nFrancesco Dolcini <[email protected]>
net: fec: make PPS channel configurableFrancesco Dolcini <[email protected]>
net: fec: refactor PPS channel configurationFrancesco Dolcini <[email protected]>
dt-bindings: net: fec: add pps channel propertyCarlos Llamas <[email protected]>
binder: adddelivered_freezeto debugfs outputCarlos Llamas <[email protected]>
binder: fix memleak of proc->delivered_freezeCarlos Llamas <[email protected]>
binder: allow freeze notification for dead nodesCarlos Llamas <[email protected]>
binder: fixBINDER_WORK_CLEAR_FREEZE_NOTIFICATIONdebug logsCarlos Llamas <[email protected]>
binder: fixBINDER_WORK_FROZEN_BINDERdebug logsCarlos Llamas <[email protected]>
binder: fix freeze UAF inbinder_release_work()Carlos Llamas <[email protected]>
binder: fix OOB inbinder_add_freeze_work()Carlos Llamas <[email protected]>
binder: fix node UAF inbinder_add_freeze_work()Nathan Chancellor <[email protected]>
powerpc: Adjust adding stack protector flags toKBUILD_CLAGSfor clangNathan Chancellor <[email protected]>
powerpc: Fix stack protectorKconfigtest for clangZicheng Qu <[email protected]>
iio: gts: fix infinite loop forgain_to_scaletables()Nuno Sa <[email protected]>
iio: adc: ad7923: Fix buffer overflow fortx_bufandring_xferZicheng Qu <[email protected]>
iio: Fixfwnode_handlein__fwnode_iio_channel_get_by_name()Jean-Baptiste Maneyrol <[email protected]>
iio: invensense: fix multiple odr switch when FIFO is offMatti Vaittinen <[email protected]>
iio: accel: kx022a: Fix raw read formatYang Erkun <[email protected]>
nfsd: fixnfs4_openownerleak when concurrentnfsd4_openoccurYang Erkun <[email protected]>
nfsd: make sure exp active beforesvc_export_showDamien Le Moal <[email protected]>
PCI: rockchip-ep: Fix address translation unit programmingAndrea della Porta <[email protected]>
PCI:of_property: Assign PCI instead of CPU bus address to dynamic PCI nodesNiklas Cassel <[email protected]>
PCI: dwc: ep: Fix advertised resizable BAR size regressionYuan Can <[email protected]>
dm thin: Add missingdestroy_work_on_stack()Ssuhung Yeh <[email protected]>
dm: Fix typo in error messageAdrian Huang <[email protected]>
mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operationOleksandr Tymoshenko <[email protected]>
ovl: properly handle large files inovl_security_fileattrJavier Carrasco <[email protected]>
leds: flash: mt6360: Fixdevice_for_each_child_node()refcounting in error pathsSrinivas Pandruvada <[email protected]>
thermal: int3400: Fix reading ofcurrent_uuidfor active policyJiri Olsa <[email protected]>
fs/proc/kcore.c: Clear ret value inread_kcore_iterafter successfuliov_iter_zeroGeert Uytterhoeven <[email protected]>
slab: Fix too strict alignment check increate_cache()Zijun Hu <[email protected]>
PCI: endpoint: Clear secondary (not primary) EPC inpci_epc_remove_epf()Zijun Hu <[email protected]>
PCI: endpoint: Fix PCI domain ID release inpci_epc_destroy()Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Add link up check toks_pcie_other_map_bus()Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatibleFrank Li <[email protected]>
i3c: master: svc: Modifyenabled_eventsbit 7:0 to act as IBI enable counterFrank Li <[email protected]>
i3c: master: svc: fix possible assignment of the same address to two devicesFrank Li <[email protected]>
i3c: master: Fix miss freeinit_dyn_addrati3c_master_put_i3c_addrs()Jinjie Ruan <[email protected]>
i3c: master: svc: Fixpm_runtime_set_suspended()with runtime pm enabledPeter Griffin <[email protected]>
scsi: ufs: exynos: Fix hibern8 notify callbacksPeter Griffin <[email protected]>
scsi: ufs: exynos: Add check insideexynos_ufs_config_smu()Heiko Carstens <[email protected]>
s390/stacktrace: Use break instead of return statementAlexandru Ardelean <[email protected]>
util_macros.h: fix/reworkfind_closest()macrosMiquel Raynal <[email protected]>
mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC informationMiquel Raynal <[email protected]>
mtd: spinand: winbond: Fix 512GW and 02JW OOB layoutMax Kellermann <[email protected]>
ceph: fix cred leak inceph_mds_check_access()Max Kellermann <[email protected]>
ceph: pass cred pointer toceph_mds_auth_match()Patrick Donnelly <[email protected]>
ceph: extract entity name from device idChao Yu <[email protected]>
f2fs: fix to drop all discards after creating snapshot on lvm deviceyuan.gao <[email protected]>
mm/slub: Avoid list corruption when removing a slab from the full listStefan Eichenberger <[email protected]>
PCI: imx6: Fix suspend/resume support on i.MX6QDLBalaji Pothunoori <[email protected]>
remoteproc:qcom_q6v5_pas: disable auto boot for wpssXu Yang <[email protected]>
perf jevents: fix breakage when do perf stat on system metricQiang Yu <[email protected]>
PCI: qcom: Disable ASPM L0s for X1E80100Giovanni Cabiddu <[email protected]>
vfio/qat: fix overflow check inqat_vf_resume_write()Choong Yong Liang <[email protected]>
net: stmmac: set initial EEE policy configurationLinus Walleij <[email protected]>
ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()Linus Walleij <[email protected]>
ARM: 9430/1: entry: Do a dummy read from VMAP shadowVasily Gorbik <[email protected]>
s390/entry: Mark IRQ entries to fix stack depot warningsLinus Walleij <[email protected]>
ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadowJavier Carrasco <[email protected]>
spmi: pmic-arb: fix return path infor_each_available_child_of_node()Saravana Kannan <[email protected]>
driver core:fw_devlink: Stop trying to optimize cycle detection logicMarek Vasut <[email protected]>
nvmem: core: Checkread_onlyflag forforce_roinbin_attr_nvmem_write()Zicheng Qu <[email protected]>
ad7780: fix division by zero in ad7780_write_raw()Gabor Juhos <[email protected]>
clk: qcom: gcc-qcs404: fix initial rate of GPLL3Sibi Sankar <[email protected]>
cpufreq: scmi: Fix cleanup path when boost enablement failsNathan Chancellor <[email protected]>
powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clangZheng Yejian <[email protected]>
mm/damon/vaddr: fix issue indamon_va_evenly_split_region()Michal Vokáč <[email protected]>
leds: lp55xx: Remove redundant test for invalid channel numberPratyush Brahma <[email protected]>
iommu/arm-smmu: Defer probe of clients after smmu device boundMostafa Saleh <[email protected]>
iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tablesSergey Senozhatsky <[email protected]>
zram: clear IDLE flag after recompressionMengEn Sun <[email protected]>
vmstat: callfold_vm_zone_numa_events()before show per zone NUMA eventguoweikang <[email protected]>
ftrace: Fix regression with module command instack_trace_filterWei Yang <[email protected]>
maple_tree: refinemas_store_root()on storing NULLVasiliy Kovalev <[email protected]>
ovl: Filter invalid inodes with missing lookup functionJinjie Ruan <[email protected]>
kunit: string-stream: Fix a UAF bug inkunit_init_suite()Zichen Xie <[email protected]>
kunit: Fix potential null dereference inkunit_device_driver_test()Masami Hiramatsu (Google) <[email protected]>
tracing: Fix function timing profiler to initialize hashtableThadeu Lima de Souza Cascardo <[email protected]>
media: uvcvideo: Require entities to have a non-zero unique IDRicardo Ribalda <[email protected]>
media: uvcvideo: Stop stream during unregisterGaosheng Cui <[email protected]>
media: platform: allegro-dvt: Fix possible memory leak inallocate_buffers_internal()Bryan O'Donoghue <[email protected]>
media: ov08x40: Fix burst write sequenceJinjie Ruan <[email protected]>
media: gspca: ov534-ov772x: Fix off-by-one error inset_frame_rate()Jinjie Ruan <[email protected]>
media: venus: Fixpm_runtime_set_suspended()with runtime pm enabledJinjie Ruan <[email protected]>
media: amphion: Fixpm_runtime_set_suspended()with runtime pm enabledRomain Gantois <[email protected]>
net: phy: dp83869: fix status reporting for 1000base-x autonegotiationArd Biesheuvel <[email protected]>
efi/libstub: Free correct pointer on failureJoe Hattori <[email protected]>
media: platform: exynos4-is: Fix an OF node reference leak infimc_md_is_isp_availableLi Zetao <[email protected]>
media: ts2020: fix null-ptr-deref in ts2020_probe()Benjamin Gaignard <[email protected]>
media: verisilicon: av1: Fix reference video buffer pointer assignmentJohn Keeping <[email protected]>
media: platform: rga: fix 32-bit DMA limitationMing Qian <[email protected]>
media: imx-jpeg: Ensure power suppliers be suspended before detach themAlexander Shiyan <[email protected]>
media: i2c: tc358743: Fix crash in the probe error path when using pollingFrancesco Dolcini <[email protected]>
arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delayJinjie Ruan <[email protected]>
media: i2c: dw9768: Fixpm_runtime_set_suspended()with runtime pm enabledGuoqing Jiang <[email protected]>
media: mtk-jpeg: Fix null-ptr-deref during unload moduleMing Qian <[email protected]>
media: imx-jpeg: Set video drvdata before register video deviceMing Qian <[email protected]>
media: amphion: Set video drvdata before register video deviceVladimir Zapolskiy <[email protected]>
media: qcom: camss: fix error path on configuration of power domainsChen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarityFrancesco Dolcini <[email protected]>
arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delayFrancesco Dolcini <[email protected]>
arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delayChen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spreadDragan Simic <[email protected]>
arm64: dts: allwinner: pinephone: Add mount matrix to accelerometerYuan Can <[email protected]>
md/md-bitmap: Add missingdestroy_work_on_stack()Xiao Ni <[email protected]>
md/raid5: Wait sync io to finish before changing group cntDaniel Borkmann <[email protected]>
netkit: Add option for scrubbing skb meta dataWill Deacon <[email protected]>
iommu/tegra241-cmdqv: Fix unused variable warningFilipe Manana <[email protected]>
btrfs: ref-verify: fix use-after-free after invalid ref actionLizhi Xu <[email protected]>
btrfs: add a sanity check for btrfs root inbtrfs_search_slot()Filipe Manana <[email protected]>
btrfs: don't loop for nowait writes when checking for cross referencesJohannes Thumshirn <[email protected]>
btrfs: fix use-after-free inbtrfs_encoded_read_endio()Mark Harmstone <[email protected]>
btrfs: move priv off stack inbtrfs_encoded_read_regular_fill_pages()Mark Harmstone <[email protected]>
btrfs: changebtrfs_encoded_read()so that reading of extent is done by callerDavid Sterba <[email protected]>
btrfs: drop unused parameterfile_offsetfrombtrfs_encoded_read_regular_fill_pages()Ojaswin Mujoo <[email protected]>
quota: flushquota_release_workupon quota writebackLong Li <[email protected]>
xfs: remove unknown compat feature check in superblock write validation-------------
Diffstat:
Documentation/devicetree/bindings/net/fsl,fec.yaml | 7 ++ Makefile | 4 +- arch/arm/kernel/entry-armv.S | 8 ++ arch/arm/mm/ioremap.c | 35 ++++++- .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 6 +- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +- arch/powerpc/Kconfig | 4 +- arch/powerpc/Makefile | 13 +-- arch/powerpc/kernel/vdso/Makefile | 8 +- arch/s390/kernel/entry.S | 4 + arch/s390/kernel/kprobes.c | 6 ++ arch/s390/kernel/stacktrace.c | 2 +- drivers/android/binder.c | 64 ++++++++++--- drivers/base/core.c | 55 +++++------ drivers/block/zram/zram_drv.c | 7 ++ drivers/clk/qcom/gcc-qcs404.c | 1 + drivers/cpufreq/scmi-cpufreq.c | 4 +- drivers/firmware/efi/libstub/efi-stub.c | 2 +- drivers/gpu/drm/Kconfig | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 +- drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c | 9 ++ drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 + .../gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c | 15 +-- .../amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 23 ++++- .../amd/include/asic_reg/nbio/nbio_7_11_0_offset.h | 2 + .../include/asic_reg/nbio/nbio_7_11_0_sh_mask.h | 13 +++ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 6 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 37 ++++++-- drivers/gpu/drm/bridge/ite-it6505.c | 8 +- drivers/gpu/drm/drm_atomic_helper.c | 2 +- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +- drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c | 1 - drivers/gpu/drm/radeon/radeon_connectors.c | 10 -- drivers/gpu/drm/sti/sti_cursor.c | 3 + drivers/gpu/drm/sti/sti_gdp.c | 3 + drivers/gpu/drm/sti/sti_hqvdp.c | 3 + drivers/gpu/drm/xe/xe_guc_ads.c | 14 +++ drivers/gpu/drm/xe/xe_guc_submit.c | 17 +++- drivers/gpu/drm/xe/xe_migrate.c | 6 +- drivers/gpu/drm/xlnx/zynqmp_kms.c | 4 +- drivers/i3c/master.c | 2 +- drivers/i3c/master/svc-i3c-master.c | 39 +++++--- drivers/iio/accel/kionix-kx022a.c | 2 +- drivers/iio/adc/ad7780.c | 2 +- drivers/iio/adc/ad7923.c | 4 +- .../iio/common/inv_sensors/inv_sensors_timestamp.c | 4 + drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 - drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 3 - drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 1 - drivers/iio/industrialio-gts-helper.c | 2 +- drivers/iio/inkern.c | 2 +- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 2 + drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 +++ drivers/iommu/io-pgtable-arm.c | 18 +++- drivers/leds/flash/leds-mt6360.c | 3 +- drivers/leds/leds-lp55xx-common.c | 3 - drivers/md/dm-thin.c | 1 + drivers/md/md-bitmap.c | 1 + drivers/md/persistent-data/dm-space-map-common.c | 2 +- drivers/md/raid5.c | 4 + drivers/media/dvb-frontends/ts2020.c | 8 +- drivers/media/i2c/dw9768.c | 10 +- drivers/media/i2c/ov08x40.c | 33 ++++++- drivers/media/i2c/tc358743.c | 4 +- drivers/media/platform/allegro-dvt/allegro-core.c | 4 +- drivers/media/platform/amphion/vpu_drv.c | 2 +- drivers/media/platform/amphion/vpu_v4l2.c | 2 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 10 ++ .../media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 11 --- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 +- drivers/media/platform/qcom/camss/camss.c | 19 ++-- drivers/media/platform/qcom/venus/core.c | 2 +- drivers/media/platform/rockchip/rga/rga.c | 2 +- .../media/platform/samsung/exynos4-is/media-dev.h | 5 +- .../verisilicon/rockchip_vpu981_hw_av1_dec.c | 3 +- drivers/media/usb/gspca/ov534.c | 2 +- drivers/media/usb/uvc/uvc_driver.c | 102 +++++++++++++++------ drivers/mtd/nand/spi/winbond.c | 16 ++-- drivers/net/ethernet/freescale/fec_ptp.c | 11 ++- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 + drivers/net/netkit.c | 68 +++++++++++--- drivers/net/phy/dp83869.c | 20 +++- drivers/nvmem/core.c | 2 +- drivers/pci/controller/dwc/pci-imx6.c | 57 +++++++++--- drivers/pci/controller/dwc/pci-keystone.c | 12 +++ drivers/pci/controller/dwc/pcie-designware-ep.c | 2 +- drivers/pci/controller/dwc/pcie-qcom.c | 2 +- drivers/pci/controller/pcie-rockchip-ep.c | 16 +++- drivers/pci/controller/pcie-rockchip.h | 4 + drivers/pci/endpoint/pci-epc-core.c | 11 +-- drivers/pci/of_property.c | 2 +- drivers/remoteproc/qcom_q6v5_pas.c | 2 +- drivers/spmi/spmi-pmic-arb.c | 3 +- .../intel/int340x_thermal/int3400_thermal.c | 2 +- drivers/ufs/host/ufs-exynos.c | 23 +++-- drivers/vfio/pci/qat/main.c | 2 +- fs/btrfs/btrfs_inode.h | 12 ++- fs/btrfs/ctree.c | 6 +- fs/btrfs/extent-tree.c | 2 +- fs/btrfs/inode.c | 94 ++++++++++--------- fs/btrfs/ioctl.c | 32 ++++++- fs/btrfs/ref-verify.c | 1 + fs/btrfs/send.c | 2 +- fs/ceph/mds_client.c | 7 +- fs/ceph/super.c | 10 +- fs/f2fs/segment.c | 16 ++-- fs/f2fs/super.c | 12 +++ fs/nfsd/export.c | 5 +- fs/nfsd/nfs4state.c | 19 ++++ fs/overlayfs/inode.c | 7 +- fs/overlayfs/util.c | 3 + fs/proc/kcore.c | 1 + fs/quota/dquot.c | 2 + fs/xfs/libxfs/xfs_sb.c | 7 -- include/drm/drm_panic.h | 14 +++ include/linux/kasan.h | 12 ++- include/linux/util_macros.h | 56 +++++++---- include/uapi/linux/if_link.h | 15 +++ kernel/signal.c | 9 +- kernel/trace/ftrace.c | 7 ++ lib/kunit/debugfs.c | 5 +- lib/kunit/kunit-test.c | 2 + lib/maple_tree.c | 13 ++- mm/damon/tests/vaddr-kunit.h | 1 + mm/damon/vaddr.c | 4 +- mm/kasan/shadow.c | 14 ++- mm/slab.h | 5 + mm/slab_common.c | 2 +- mm/slub.c | 9 +- mm/vmalloc.c | 34 +++++-- mm/vmstat.c | 1 + tools/perf/pmu-events/empty-pmu-events.c | 12 +-- tools/perf/pmu-events/jevents.py | 12 +-- 143 files changed, 1071 insertions(+), 434 deletions(-)
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.4 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.4 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Am 06.12.2024 um 15:35 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.12.4 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Hi Greg
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.4 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
6.12.4-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
Linux version 6.12.4-rc1rv (takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 14.2.1 20240910, GNU ld (GNU Binutils) 2.43.0) #1 SMP PREEMPT_DYNAMIC Sat Dec 7 13:07:21 JST 2024
Thanks
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.4 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.4 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.
Quoted 5 lines
thanks,
greg k-h
-------------
OVERVIEW
Builds: 29 passed, 0 failed
Boot tests: 70 passed, 1 failed
CI systems: maestro
REVISION
Commit
name: v6.12.3-146-ge572189f6a25
hash: 91ba615b0f093358fd3961fb76f3479193cd18f6
Checked out from
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.yBUILDS
No build failures found
BOOT TESTS
Failures
i386:(defconfig)
-hp-14b-na0052xx-zork
CI system: maestro
UBSAN: shift-out-of-bounds in drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c:1333:47
https://kcidb.kernelci.org/d/test/test?var-datasource=edquppk2ghfcwc&var-origin=maestro&var-build_architecture=$__all&var-build_config_name=$__all&var-id=maestro:6753358b6de2c3ffbb72658a&from=now-100y&to=now&timezone=browser&var-test_path=&var-issue_presence=$__allSee complete and up-to-date report at:
https://kcidb.kernelci.org/d/revision/revision?orgId=1&var-git_commit_hash=91ba615b0f093358fd3961fb76f3479193cd18f6&var-patchset_hash=
Thanks,
KernelCI team
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.4 release. There are 146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.12.4-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 91ba615b0f093358fd3961fb76f3479193cd18f6
* git describe: v6.12.3-147-g91ba615b0f09
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.12.y/build/v6.12.3-147-g91ba615b0f09
## Test Regressions (compared to v6.12.1-827-g1b3321bcbfba)
## Metric Regressions (compared to v6.12.1-827-g1b3321bcbfba)
## Test Fixes (compared to v6.12.1-827-g1b3321bcbfba)
## Metric Fixes (compared to v6.12.1-827-g1b3321bcbfba)
## Test result summary
total: 158647, pass: 131960, fail: 2855, skip: 23832, xfail: 0
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 138 total, 136 passed, 2 failed
* arm64: 52 total, 52 passed, 0 failed
* i386: 18 total, 18 passed, 0 failed
* mips: 34 total, 33 passed, 1 failed
* parisc: 4 total, 3 passed, 1 failed
* powerpc: 40 total, 39 passed, 1 failed
* riscv: 24 total, 23 passed, 1 failed
* s390: 22 total, 21 passed, 1 failed
* sh: 5 total, 5 passed, 0 failed
* sparc: 4 total, 3 passed, 1 failed
* x86_64: 44 total, 44 passed, 0 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-rust
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org