6.6.64-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.6.64-rc1 review
This is the start of the stable review cycle for the 6.6.64 release. There are 676 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.64-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.64-rc1
Frederic Weisbecker <[email protected]>
posix-timers: Target group sigqueue to current task only if not exiting
Umio Yasuno <[email protected]>
drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7
Vitaly Prosyak <[email protected]>
drm/amdgpu: fix usage slab after free
Lijo Lazar <[email protected]>
drm/amdkfd: Use the correct wptr size
Steffen Dirkwinkel <[email protected]>
drm: xlnx: zynqmp_dpsub: fix hotplug detection
Lucas Stach <[email protected]>
drm/etnaviv: flush shader L1 cache after user commandstream
Javier Carrasco <[email protected]>
drm/mediatek: Fix child node refcount handling in early exit
Ma Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers
Ma Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
Ma Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
Vivek Kasireddy <[email protected]>
udmabuf: use vmf_insert_pfn and VM_PFNMAP for handling mmap
Jarkko Sakkinen <[email protected]>
tpm: Lock TPM chip in tpm_pm_suspend() first
Josef Bacik <[email protected]>
btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
Nathan Chancellor <[email protected]>
powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang
Nathan Chancellor <[email protected]>
powerpc: Fix stack protector Kconfig test for clang
Zicheng Qu <[email protected]>
iio: gts: fix infinite loop for gain_to_scaletables()
Nuno Sa <[email protected]>
iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
Zicheng Qu <[email protected]>
iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
Matti Vaittinen <[email protected]>
iio: accel: kx022a: Fix raw read format
Yang Erkun <[email protected]>
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
Yang Erkun <[email protected]>
nfsd: make sure exp active before svc_export_show
Damien Le Moal <[email protected]>
PCI: rockchip-ep: Fix address translation unit programming
Andrea della Porta <[email protected]>
PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes
Yuan Can <[email protected]>
dm thin: Add missing destroy_work_on_stack()
Ssuhung Yeh <[email protected]>
dm: Fix typo in error message
Oleksandr Tymoshenko <[email protected]>
ovl: properly handle large files in ovl_security_fileattr
Javier Carrasco <[email protected]>
leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths
Srinivas Pandruvada <[email protected]>
thermal: int3400: Fix reading of current_uuid for active policy
Jiri Olsa <[email protected]>
fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero
Zijun Hu <[email protected]>
PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf()
Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Add link up check to ks_pcie_other_map_bus()
Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible
Frank Li <[email protected]>
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
Jinjie Ruan <[email protected]>
i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
Peter Griffin <[email protected]>
scsi: ufs: exynos: Fix hibern8 notify callbacks
Alexandru Ardelean <[email protected]>
util_macros.h: fix/rework find_closest() macros
Patrick Donnelly <[email protected]>
ceph: extract entity name from device id
yuan.gao <[email protected]>
mm/slub: Avoid list corruption when removing a slab from the full list
Linus Walleij <[email protected]>
ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()
Linus Walleij <[email protected]>
ARM: 9430/1: entry: Do a dummy read from VMAP shadow
Vasily Gorbik <[email protected]>
s390/entry: Mark IRQ entries to fix stack depot warnings
Linus Walleij <[email protected]>
ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow
Zicheng Qu <[email protected]>
ad7780: fix division by zero in ad7780_write_raw()
Gabor Juhos <[email protected]>
clk: qcom: gcc-qcs404: fix initial rate of GPLL3
Michal Vokáč <[email protected]>
leds: lp55xx: Remove redundant test for invalid channel number
Mostafa Saleh <[email protected]>
iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
Sergey Senozhatsky <[email protected]>
zram: clear IDLE flag after recompression
MengEn Sun <[email protected]>
vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
guoweikang <[email protected]>
ftrace: Fix regression with module command in stack_trace_filter
Wei Yang <[email protected]>
maple_tree: refine mas_store_root() on storing NULL
Vasiliy Kovalev <[email protected]>
ovl: Filter invalid inodes with missing lookup function
Thadeu Lima de Souza Cascardo <[email protected]>
media: uvcvideo: Require entities to have a non-zero unique ID
Ricardo Ribalda <[email protected]>
media: uvcvideo: Stop stream during unregister
Gaosheng Cui <[email protected]>
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
Jinjie Ruan <[email protected]>
media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
Jinjie Ruan <[email protected]>
media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
Jinjie Ruan <[email protected]>
media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled
Ard Biesheuvel <[email protected]>
efi/libstub: Free correct pointer on failure
Joe Hattori <[email protected]>
media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available
Li Zetao <[email protected]>
media: ts2020: fix null-ptr-deref in ts2020_probe()
Benjamin Gaignard <[email protected]>
media: verisilicon: av1: Fix reference video buffer pointer assignment
Ming Qian <[email protected]>
media: imx-jpeg: Ensure power suppliers be suspended before detach them
Alexander Shiyan <[email protected]>
media: i2c: tc358743: Fix crash in the probe error path when using polling
Francesco Dolcini <[email protected]>
arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
Jinjie Ruan <[email protected]>
media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
Guoqing Jiang <[email protected]>
media: mtk-jpeg: Fix null-ptr-deref during unload module
Ming Qian <[email protected]>
media: imx-jpeg: Set video drvdata before register video device
Ming Qian <[email protected]>
media: amphion: Set video drvdata before register video device
Francesco Dolcini <[email protected]>
arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
Francesco Dolcini <[email protected]>
arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
Dragan Simic <[email protected]>
arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
Yuan Can <[email protected]>
md/md-bitmap: Add missing destroy_work_on_stack()
Filipe Manana <[email protected]>
btrfs: ref-verify: fix use-after-free after invalid ref action
Lizhi Xu <[email protected]>
btrfs: add a sanity check for btrfs root in btrfs_search_slot()
Filipe Manana <[email protected]>
btrfs: don't loop for nowait writes when checking for cross references
Ojaswin Mujoo <[email protected]>
quota: flush quota_release_work upon quota writeback
Long Li <[email protected]>
xfs: remove unknown compat feature check in superblock write validation
Dan Carpenter <[email protected]>
sh: intc: Fix use-after-free bug in register_intc_controller()
Yu Kuai <[email protected]>
block, bfq: fix bfqq uaf in bfq_limit_depth()
Liu Jian <[email protected]>
sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
Benjamin Coddington <[email protected]>
SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT
Liu Jian <[email protected]>
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
Li Lingfeng <[email protected]>
nfs: ignore SB_RDONLY when mounting nfs
Dan Carpenter <[email protected]>
cifs: unlock on error in smb3_reconfigure()
Shyam Prasad N <[email protected]>
cifs: during remount, make sure passwords are in sync
Masahiro Yamada <[email protected]>
modpost: remove incorrect code in do_eisa_entry()
Paul Aurich <[email protected]>
smb: Initialize cfid->tcon before performing network ops
Masahiro Yamada <[email protected]>
Rename .data.once to .data..once to fix resetting WARN*_ONCE
Masahiro Yamada <[email protected]>
Rename .data.unlikely to .data..unlikely
Masahiro Yamada <[email protected]>
init/modpost: conditionally check section mismatch to __meminit*
Masahiro Yamada <[email protected]>
modpost: squash ALL_{INIT,EXIT}_TEXT_SECTIONS to ALL_TEXT_SECTIONS
Masahiro Yamada <[email protected]>
modpost: use ALL_INIT_SECTIONS for the section check from DATA_SECTIONS
Masahiro Yamada <[email protected]>
modpost: disallow the combination of EXPORT_SYMBOL and __meminit*
Masahiro Yamada <[email protected]>
modpost: remove EXIT_SECTIONS macro
Masahiro Yamada <[email protected]>
modpost: remove MEM_INIT_SECTIONS macro
Masahiro Yamada <[email protected]>
modpost: disallow *driver to reference .meminit* sections
Masahiro Yamada <[email protected]>
modpost: remove ALL_EXIT_DATA_SECTIONS macro
Maxime Chevallier <[email protected]>
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
Pali Rohár <[email protected]>
cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session
Pali Rohár <[email protected]>
cifs: Fix parsing native symlinks relative to the export
Henrique Carvalho <[email protected]>
smb: client: disable directory caching when dir_cache_timeout is zero
Namhyung Kim <[email protected]>
perf/arm-cmn: Ensure port and device id bits are set properly
Chun-Tse Shao <[email protected]>
perf/arm-smmuv3: Fix lockdep assert in ->event_init()
Alex Zenla <[email protected]>
9p/xen: fix release of IRQ
Alex Zenla <[email protected]>
9p/xen: fix init sequence
Christoph Hellwig <[email protected]>
block: return unsigned int from bdev_io_min
Breno Leitao <[email protected]>
nvme/multipath: Fix RCU list traversal to use SRCU primitive
Hannes Reinecke <[email protected]>
nvme-multipath: avoid hang on inaccessible namespaces
Thomas Song <[email protected]>
nvme-multipath: implement "queue-depth" iopolicy
John Meneghini <[email protected]>
nvme-multipath: prepare for "queue-depth" iopolicy
Wolfram Sang <[email protected]>
rtc: rzn1: fix BCD to rtc_time conversion errors
Qingfang Deng <[email protected]>
jffs2: fix use of uninitialized variable
Waqar Hameed <[email protected]>
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
Zhihao Cheng <[email protected]>
ubi: fastmap: Fix duplicate slab cache names while attaching
Zhihao Cheng <[email protected]>
ubifs: Correct the total block count by deducting journal reservation
Zhihao Cheng <[email protected]>
ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
Yongliang Gao <[email protected]>
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
Nobuhiro Iwamatsu <[email protected]>
rtc: abx80x: Fix WDT bit position of the status register
Jinjie Ruan <[email protected]>
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
Trond Myklebust <[email protected]>
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
Tiwei Bie <[email protected]>
um: Always dump trace for specified task in show_stack
Tiwei Bie <[email protected]>
um: Fix the return value of elf_core_copy_task_fpregs
Tiwei Bie <[email protected]>
um: Fix potential integer overflow during physmem setup
Yang Erkun <[email protected]>
SUNRPC: make sure cache entry active before cache_show
Chuck Lever <[email protected]>
NFSD: Prevent a potential integer overflow
Ma Wupeng <[email protected]>
ipc: fix memleak if msg_init_ns failed in create_ipc_ns
Chao Yu <[email protected]>
f2fs: fix to do sanity check on node blkaddr in truncate_node()
Bartosz Golaszewski <[email protected]>
lib: string_helpers: silence snprintf() output truncation warning
Ming Lei <[email protected]>
ublk: fix error code for unsupported command
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix looping of queued SG entries
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix checking for number of TRBs left
Hubert Wiśniewski <[email protected]>
usb: musb: Fix hardware lockup on first Rx endpoint request
Paul Aurich <[email protected]>
smb: During unmount, ensure all cached dir instances drop their dentry
Paul Aurich <[email protected]>
smb: prevent use-after-free due to open_cached_dir error paths
Paul Aurich <[email protected]>
smb: Don't leak cfid when reconnect races with open_cached_dir
Paulo Alcantara <[email protected]>
smb: client: handle max length for SMB symlinks
Steve French <[email protected]>
smb3: request handle caching when caching directories
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Apply quirk for Medion E15433
Dinesh Kumar <[email protected]>
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
Kailang Yang <[email protected]>
ALSA: hda/realtek: Set PCBeep to default value for ALC274
Kailang Yang <[email protected]>
ALSA: hda/realtek: Update ALC225 depop procedure
Takashi Iwai <[email protected]>
ALSA: pcm: Add sanity NULL check for the default mmap fault handler
Takashi Iwai <[email protected]>
ALSA: ump: Fix evaluation of MIDI 1.0 FB info
Hans Verkuil <[email protected]>
media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
Javier Carrasco <[email protected]>
soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting()
Qiu-ji Chen <[email protected]>
media: wl128x: Fix atomicity violation in fmc_send_cmd()
Jason Gerecke <[email protected]>
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
Bart Van Assche <[email protected]>
blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long
Muchun Song <[email protected]>
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
Muchun Song <[email protected]>
block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding
Muchun Song <[email protected]>
block: fix missing dispatching request when queue is started or unquiesced
Will Deacon <[email protected]>
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
Ming Lei <[email protected]>
ublk: fix ublk_ch_mmap() for 64K page size
Zicheng Qu <[email protected]>
iio: gts: Fix uninitialized symbol 'ret'
Huacai Chen <[email protected]>
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
Tiwei Bie <[email protected]>
um: vector: Do not use drvdata in release
Bin Liu <[email protected]>
serial: 8250: omap: Move pm_runtime_get_sync
Filip Brozovic <[email protected]>
serial: 8250_fintek: Add support for F81216E
Michal Simek <[email protected]>
dt-bindings: serial: rs485: Fix rs485-rts-delay property
Tiwei Bie <[email protected]>
um: net: Do not use drvdata in release
Tiwei Bie <[email protected]>
um: ubd: Do not use drvdata in release
Zhihao Cheng <[email protected]>
ubi: wl: Put source PEB into correct list if trying locking LEB failed
Javier Carrasco <[email protected]>
platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
Paulo Alcantara <[email protected]>
smb: client: fix NULL ptr deref in crypto_aead_setkey()
Yunseong Kim <[email protected]>
ksmbd: fix use-after-free in SMB request handling
Josh Poimboeuf <[email protected]>
parisc/ftrace: Fix function graph tracing disablement
Meetakshi Setiya <[email protected]>
cifs: support mounting with alternate password to allow password rotation
Jinjie Ruan <[email protected]>
cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power()
Cheng Ming Lin <[email protected]>
mtd: spi-nor: core: replace dummy buswidth from addr to data
Stanislaw Gruszka <[email protected]>
spi: Fix acpi deferred irq probe
Jeongjun Park <[email protected]>
netfilter: ipset: add missing range check in bitmap_ip_uadt
Sai Kumar Cholleti <[email protected]>
gpio: exar: set value when external pull-up or pull-down is present
Greg Kroah-Hartman <[email protected]>
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
Claudiu Beznea <[email protected]>
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Michal Vrastil <[email protected]>
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
Javier Carrasco <[email protected]>
wifi: brcmfmac: release 'root' node in all execution paths
Jose Ignacio Tornos Martinez <[email protected]>
wifi: ath12k: fix crash when unbinding
Guilherme G. Piccoli <[email protected]>
wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures
Jose Ignacio Tornos Martinez <[email protected]>
wifi: ath12k: fix warning when unbinding
Andreas Kemnade <[email protected]>
ARM: dts: omap36xx: declare 1GHz OPP as turbo again
Michal Pecio <[email protected]>
usb: xhci: Fix TD invalidation under pending Set TR Dequeue
Jan Hendrik Farr <[email protected]>
Compiler Attributes: disable __counted_by for clang < 19.1.3
Andrej Shadura <[email protected]>
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
Namjae Jeon <[email protected]>
exfat: fix uninit-value in __exfat_get_dentry_set
Angelo Dureghello <[email protected]>
dt-bindings: iio: dac: ad3552r: fix maximum spi speed
Johan Hovold <[email protected]>
pinctrl: qcom: spmi: fix debugfs drive strength
Thomas Weißschuh <[email protected]>
tools/nolibc: s390: include std.h
Ahmed Ehab <[email protected]>
locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass()
Nicolas Bouchinet <[email protected]>
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
Jinjie Ruan <[email protected]>
apparmor: test: Fix memory leak for aa_unpack_strdup()
Jann Horn <[email protected]>
comedi: Flush partial mappings in error case
Amir Goldstein <[email protected]>
fsnotify: fix sending inotify event with unexpected filename
Lukas Wunner <[email protected]>
PCI: Fix use-after-free of slot->bus on hot remove
Kunkun Jiang <[email protected]>
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
Jing Zhang <[email protected]>
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
Raghavendra Rao Ananta <[email protected]>
KVM: arm64: Get rid of userspace_irqchip_in_use
Kunkun Jiang <[email protected]>
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
Raghavendra Rao Ananta <[email protected]>
KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
Marc Zyngier <[email protected]>
KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR
Gautam Menghani <[email protected]>
powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector
Sean Christopherson <[email protected]>
KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE
Eric Biggers <[email protected]>
crypto: x86/aegis128 - access 32-bit arguments as 32-bit
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix buffer full but size is 0 case
Qiu-ji Chen <[email protected]>
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
Ilya Zverev <[email protected]>
ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00
Artem Sadovnikov <[email protected]>
jfs: xattr: check invalid xattr size more strictly
Theodore Ts'o <[email protected]>
ext4: fix FS_IOC_GETFSMAP handling
Jeongjun Park <[email protected]>
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
Manikanta Mylavarapu <[email protected]>
soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
Hans de Goede <[email protected]>
ASoC: Intel: sst: Fix used of uninitialized ctx to log an error
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled
Chen-Yu Tsai <[email protected]>
Revert "arm64: dts: mediatek: mt8195-cherry: Mark USB 3.0 on xhci1 as disabled"
Benoît Sevens <[email protected]>
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Filipe Manana <[email protected]>
btrfs: do not BUG_ON() when freeing tree block after error
Daejun Park <[email protected]>
f2fs: fix null reference error when checking end of zone
Kan Liang <[email protected]>
perf/x86/intel: Hide Topdown metrics events if the feature is not enumerated
Mikulas Patocka <[email protected]>
dm-bufio: fix warnings about duplicate slab caches
Hersen Wu <[email protected]>
drm/amd/display: Add NULL pointer check for kzalloc
Alex Hung <[email protected]>
drm/amd/display: Check phantom_stream before it is used
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
Rodrigo Siqueira <[email protected]>
drm/amd/display: Check null pointer before try to access it
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
Mikulas Patocka <[email protected]>
dm-cache: fix warnings about duplicate slab caches
Kent Overstreet <[email protected]>
closures: Change BUG_ON() to WARN_ON()
Vitalii Mordan <[email protected]>
usb: ehci-spear: fix call balance of sehci clk handling routines
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
Qiu-ji Chen <[email protected]>
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
lei lu <[email protected]>
xfs: add bounds checking to xlog_recover_process_data
Puranjay Mohan <[email protected]>
nvme: fix metadata handling in nvme-passthrough
Justin Tee <[email protected]>
scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
Jason-JH.Lin <[email protected]>
mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()
Xiuhong Wang <[email protected]>
f2fs: fix fiemap failure issue when page size is 16KB
Andreas Gruenbacher <[email protected]>
gfs2: Remove and replace gfs2_glock_queue_work
Andreas Gruenbacher <[email protected]>
gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru
Venkata Prasad Potturu <[email protected]>
ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry
chao liu <[email protected]>
apparmor: fix 'Do simple duplicate message elimination'
Zicheng Qu <[email protected]>
drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp
Steven 'Steve' Kendall <[email protected]>
drm/radeon: Fix spurious unplug event on radeon HDMI
Wu Hoi Pok <[email protected]>
drm/radeon: change rdev->ddev to rdev_to_drm(rdev)
Wu Hoi Pok <[email protected]>
drm/radeon: add helper rdev_to_drm(rdev)
Kailang Yang <[email protected]>
ALSA: hda/realtek: Update ALC256 depop procedure
Gaosheng Cui <[email protected]>
firmware_loader: Fix possible resource leak in fw_log_firmware_info()
Jiasheng Jiang <[email protected]>
counter: ti-ecap-capture: Add check for clk_enable()
Jiasheng Jiang <[email protected]>
counter: stm32-timer-cnt: Add check for clk_enable()
Jinjie Ruan <[email protected]>
misc: apds990x: Fix missing pm_runtime_disable()
Edward Adam Davis <[email protected]>
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
Oliver Neukum <[email protected]>
USB: chaoskey: fail open after removal
Oliver Neukum <[email protected]>
usb: yurex: make waiting on yurex_write interruptible
Jeongjun Park <[email protected]>
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
Christophe JAILLET <[email protected]>
iio: light: al3010: Fix an error handling path in al3010_probe()
Paolo Abeni <[email protected]>
ipmr: fix tables suspicious RCU usage
Paolo Abeni <[email protected]>
ip6mr: fix tables suspicious RCU usage
Kuniyuki Iwashima <[email protected]>
tcp: Fix use-after-free of nreq in reqsk_timer_handler().
Michal Luczaj <[email protected]>
rxrpc: Improve setsockopt() handling of malformed user input
Michal Luczaj <[email protected]>
llc: Improve setsockopt() handling of malformed user input
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix possible deadlocks
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
Michael Chan <[email protected]>
bnxt_en: Unregister PTP during PCI shutdown and suspend
Michael Chan <[email protected]>
bnxt_en: Refactor bnxt_ptp_init()
Saravanan Vajravel <[email protected]>
bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
Eric Dumazet <[email protected]>
net: hsr: fix hsr_init_sk() vs network/transport headers.
Csókás, Bence <[email protected]>
spi: atmel-quadspi: Fix register name in verbose logging function
Hariprasad Kelam <[email protected]>
octeontx2-af: Quiesce traffic before NIX block reset
Hariprasad Kelam <[email protected]>
octeontx2-af: RPM: fix stale FCFEC counters
Hariprasad Kelam <[email protected]>
octeontx2-af: RPM: fix stale RSFEC counters
Sai Krishna <[email protected]>
octeontx2-pf: Reset MAC stats during probe
Hariprasad Kelam <[email protected]>
octeontx2-af: RPM: Fix low network performance
Hariprasad Kelam <[email protected]>
octeontx2-af: RPM: Fix mismatch in lmac type
Maxime Chevallier <[email protected]>
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
Vitalii Mordan <[email protected]>
marvell: pxa168_eth: fix call balance of pep->clk handling routines
Rosen Penev <[email protected]>
net: mdio-ipq4019: add missing error check
Hangbin Liu <[email protected]>
net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged
Sidraya Jayagond <[email protected]>
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
Guenter Roeck <[email protected]>
net: microchip: vcap: Add typegroup table terminators in kunit tests
Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
Pavan Chebbi <[email protected]>
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
ChiYuan Huang <[email protected]>
power: supply: rt9471: Use IC status regfield to report real charger status
ChiYuan Huang <[email protected]>
power: supply: rt9471: Fix wrong WDT function regfield declaration
Barnabás Czémán <[email protected]>
power: supply: bq27xxx: Fix registers of bq27426
Bart Van Assche <[email protected]>
power: supply: core: Remove might_sleep() from power_supply_put()
Tiezhu Yang <[email protected]>
LoongArch: BPF: Sign-extend return values
Tiezhu Yang <[email protected]>
LoongArch: Fix build failure with GCC 15 (-std=gnu23)
Randy Dunlap <[email protected]>
fs_parser: update mount_api doc to match function signature
Avihai Horon <[email protected]>
vfio/pci: Properly hide first-in-list PCIe extended capability
Andy Shevchenko <[email protected]>
gpio: zevio: Add missed label initialisation
Michael Ellerman <[email protected]>
selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels
Si-Wei Liu <[email protected]>
vdpa/mlx5: Fix suboptimal range on iotlb iteration
Murad Masimov <[email protected]>
hwmon: (tps23861) Fix reporting of negative temperatures
Chuck Lever <[email protected]>
NFSD: Fix nfsd4_shutdown_copy()
Ye Bin <[email protected]>
svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
Yang Erkun <[email protected]>
nfsd: release svc_expkey/svc_export with rcu_work
Chuck Lever <[email protected]>
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
Chuck Lever <[email protected]>
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
Zhongqiu Han <[email protected]>
PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio'
Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
Jonathan Marek <[email protected]>
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
Dmitry Baryshkov <[email protected]>
remoteproc: qcom: pas: add minidump_id to SM8350 resources
Benjamin Peterson <[email protected]>
perf trace: Avoid garbage when not printing a syscall's arguments
Benjamin Peterson <[email protected]>
perf trace: Do not lose last events in a race
Howard Chu <[email protected]>
perf trace: Fix tracing itself, creating feedback loops
Jean-Philippe Romain <[email protected]>
perf list: Fix topic and pmu_name argument order
Chuck Lever <[email protected]>
svcrdma: Address an integer overflow
Antonio Quartulli <[email protected]>
m68k: coldfire/device.c: only build FEC when HW macros are defined
Jean-Michel Hautbois <[email protected]>
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
Benjamin Peterson <[email protected]>
perf trace: avoid garbage when not printing a trace event's arguments
Chao Yu <[email protected]>
f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode
Long Li <[email protected]>
f2fs: fix race in concurrent f2fs_stop_gc_thread
Siddharth Vadapalli <[email protected]>
PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds
Théo Lebrun <[email protected]>
PCI: j721e: Add suspend and resume support
Thomas Richard <[email protected]>
PCI: j721e: Use T_PERST_CLK_US macro
Théo Lebrun <[email protected]>
PCI: j721e: Add reset GPIO to struct j721e_pcie
Thomas Richard <[email protected]>
PCI: cadence: Set cdns_pcie_host_init() global
Thomas Richard <[email protected]>
PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup()
Matt Ranostay <[email protected]>
PCI: j721e: Add PCIe 4x lane selection support
Matt Ranostay <[email protected]>
PCI: j721e: Add per platform maximum lane settings
Yoshihiro Shimoda <[email protected]>
PCI: Add T_PVPERL macro
Zhiguo Niu <[email protected]>
f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID
Chao Yu <[email protected]>
f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()
Yongpeng Yang <[email protected]>
f2fs: check curseg->inited before write_sum_page in change_curseg
LongPing Wei <[email protected]>
f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
Arnaldo Carvalho de Melo <[email protected]>
perf ftrace latency: Fix unit on histogram first entry when using --use-nsec
Ilpo Järvinen <[email protected]>
PCI: cpqphp: Fix PCIBIOS_* return value confusion
weiyufeng <[email protected]>
PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
Paolo Bonzini <[email protected]>
rust: macros: fix documentation of the paste! macro
Leo Yan <[email protected]>
perf probe: Correct demangled symbols in C++ program
Ian Rogers <[email protected]>
perf probe: Fix libdw memory leak
Chao Yu <[email protected]>
f2fs: fix to account dirty data in __get_secs_required()
Qi Han <[email protected]>
f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks
Veronika Molnarova <[email protected]>
perf test attr: Add back missing topdown events
Michael Petlan <[email protected]>
perf trace: Keep exited threads for summary
Ian Rogers <[email protected]>
perf stat: Fix affinity memory leaks on error path
Levi Yun <[email protected]>
perf stat: Close cork_fd when create_perf_stat_counter() failed
Todd Kjos <[email protected]>
PCI: Fix reset_method_store() memory leak
Andreas Gruenbacher <[email protected]>
gfs2: Fix unlinked inode cleanup
Andreas Gruenbacher <[email protected]>
gfs2: Allow immediate GLF_VERIFY_DELETE work
Andreas Gruenbacher <[email protected]>
gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE
Andreas Gruenbacher <[email protected]>
gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async
Andreas Gruenbacher <[email protected]>
gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw
James Clark <[email protected]>
perf cs-etm: Don't flush when packet_queue fills up
Dan Carpenter <[email protected]>
mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()
Paul Aurich <[email protected]>
smb: cached directories can be more than root file handle
zhang jiao <[email protected]>
pinctrl: k210: Undef K210_PC_DEFAULT
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw
Nuno Sa <[email protected]>
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
Nuno Sa <[email protected]>
dt-bindings: clock: axi-clkgen: include AXI clk
Sergio Paracuellos <[email protected]>
clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs
Sergio Paracuellos <[email protected]>
clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
Charles Han <[email protected]>
clk: clk-apple-nco: Add NULL check in applnco_probe
Patrisious Haddad <[email protected]>
RDMA/mlx5: Move events notifier registration to be after device registration
Jianbo Liu <[email protected]>
IB/mlx5: Allocate resources just before first QP/SRQ is created
Zhen Lei <[email protected]>
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
Zhang Zekun <[email protected]>
powerpc/kexec: Fix return of uninitialized variable
Michal Suchanek <[email protected]>
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
Gautam Menghani <[email protected]>
KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells
Gautam Menghani <[email protected]>
KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests
Harshit Mogalapalli <[email protected]>
dax: delete a stale directory pmem
Dmitry Antipov <[email protected]>
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
Jinjie Ruan <[email protected]>
cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()
Jinjie Ruan <[email protected]>
cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()
Junxian Huang <[email protected]>
RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
Junxian Huang <[email protected]>
RDMA/hns: Fix out-of-order issue of requester when setting FENCE
Kirill A. Shutemov <[email protected]>
x86/tdx: Dynamically disable SEPT violations from causing #VEs
Kirill A. Shutemov <[email protected]>
x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup()
Kirill A. Shutemov <[email protected]>
x86/tdx: Introduce wrappers to read and write TD metadata
Kai Huang <[email protected]>
x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure
Kai Huang <[email protected]>
x86/tdx: Rename __tdx_module_call() to __tdcall()
Kai Huang <[email protected]>
x86/tdx: Make macros of TDCALLs consistent with the spec
Kai Huang <[email protected]>
x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid
Bart Van Assche <[email protected]>
scsi: sg: Enable runtime power management
Zhen Lei <[email protected]>
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
Zhen Lei <[email protected]>
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
Zeng Heng <[email protected]>
scsi: fusion: Remove unused variable 'rc'
Ye Bin <[email protected]>
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
Mirsad Todorovac <[email protected]>
fs/proc/kcore.c: fix coccinelle reported ERROR instances
Zhang Changzhong <[email protected]>
mfd: rt5033: Fix missing regmap_del_irq_chip()
Tamir Duberstein <[email protected]>
checkpatch: always parse orig_commit in fixes tag
Dan Carpenter <[email protected]>
checkpatch: check for missing Fixes tags
Zhenzhong Duan <[email protected]>
iommu/vt-d: Fix checks and print in pgtable_walk()
Zhenzhong Duan <[email protected]>
iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes()
Yang Yingliang <[email protected]>
clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains()
Dong Aisheng <[email protected]>
clk: imx: clk-scu: fix clk enable state save and restore
Peng Fan <[email protected]>
clk: imx: fracn-gppll: fix pll power up
Peng Fan <[email protected]>
clk: imx: fracn-gppll: correct PLL initialization flow
Peng Fan <[email protected]>
clk: imx: lpcg-scu: SW workaround for errata (e10858)
Yong-Xuan Wang <[email protected]>
RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation
Liu Jian <[email protected]>
RDMA/rxe: Set queue pair cur_qp_state when being queried
Biju Das <[email protected]>
clk: renesas: rzg2l: Fix FOUTPOSTDIV clk
Andre Przywara <[email protected]>
clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix the qp flush warnings in req
wenglianfa <[email protected]>
RDMA/hns: Fix cpu stuck caused by printings during reset
Junxian Huang <[email protected]>
RDMA/hns: Use dev_* printings in hem code instead of ibdev_*
wenglianfa <[email protected]>
RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci
Jinjie Ruan <[email protected]>
cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
Jinjie Ruan <[email protected]>
cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
Michael Ellerman <[email protected]>
powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP
Ritesh Harjani (IBM) <[email protected]>
powerpc/mm/fault: Fix kfence page fault reporting
Miquel Raynal <[email protected]>
mtd: rawnand: atmel: Fix possible memory leak
Biju Das <[email protected]>
mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE
Uwe Kleine-König <[email protected]>
mtd: hyperbus: rpc-if: Convert to platform remove callback returning void
Ritesh Harjani (IBM) <[email protected]>
powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
Ritesh Harjani (IBM) <[email protected]>
powerpc/fadump: Refactor and prepare fadump_cma_init for late init
Yuan Can <[email protected]>
cpufreq: loongson2: Unregister platform_driver on failure
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
Marcus Folkesson <[email protected]>
mfd: da9052-spi: Change read-mask to write-mask
Jinjie Ruan <[email protected]>
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
Christophe Leroy <[email protected]>
powerpc/vdso: Flag VDSO64 entry points as functions
Yihang Li <[email protected]>
scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset
Bartosz Golaszewski <[email protected]>
pinctrl: zynqmp: drop excess struct member description
Levi Yun <[email protected]>
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
Lukas Bulwahn <[email protected]>
clk: mediatek: drop two dead config options
Jie Zhan <[email protected]>
cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged
André Almeida <[email protected]>
unicode: Fix utf8_load() error path
Jiayuan Chen <[email protected]>
bpf: fix recursive lock when verdict program return SK_PASS
Hangbin Liu <[email protected]>
wireguard: selftests: load nf_conntrack if not present
Breno Leitao <[email protected]>
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
Gao Xiang <[email protected]>
erofs: handle NONHEAD !delta[1] lclusters gracefully
Dmitry Antipov <[email protected]>
Bluetooth: fix use-after-free in device_for_each_child()
Takashi Iwai <[email protected]>
ALSA: 6fire: Release resources at card release
Takashi Iwai <[email protected]>
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
Takashi Iwai <[email protected]>
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
Takashi Iwai <[email protected]>
ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
Mingwei Zheng <[email protected]>
net: rfkill: gpio: Add check for clk_enable()
Jiri Olsa <[email protected]>
bpf: Force uprobe bpf program to always return 0
Yuan Can <[email protected]>
drm/amdkfd: Fix wrong usage of INIT_WORK()
Paolo Abeni <[email protected]>
selftests: net: really check for bg process completion
Paolo Abeni <[email protected]>
ipv6: release nexthop on device removal
Eric Dumazet <[email protected]>
net: use unrcu_pointer() helper
Eric Dumazet <[email protected]>
sock_diag: allow concurrent operation in sock_diag_rcv_msg()
Eric Dumazet <[email protected]>
sock_diag: allow concurrent operations
Eric Dumazet <[email protected]>
sock_diag: add module pointer to "struct sock_diag_handler"
Zijian Zhang <[email protected]>
bpf, sockmap: Fix sk_msg_reset_curr
Zijian Zhang <[email protected]>
bpf, sockmap: Several fixes to bpf_msg_pop_data
Zijian Zhang <[email protected]>
bpf, sockmap: Several fixes to bpf_msg_push_data
Zijian Zhang <[email protected]>
selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Fix SENDPAGE data logic in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
Maurice Lambert <[email protected]>
netlink: typographical error in nlmsg_type constants definition
Florian Westphal <[email protected]>
netfilter: nf_tables: must hold rcu read lock while iterating object type list
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip transaction if update object is not implemented
Florian Westphal <[email protected]>
netfilter: nf_tables: must hold rcu read lock while iterating expression type list
Florian Westphal <[email protected]>
netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion
Phil Sutter <[email protected]>
netfilter: nf_tables: Introduce nf_tables_getrule_single()
Phil Sutter <[email protected]>
netfilter: nf_tables: Open-code audit log call in nf_tables_getrule()
Jonathan Gray <[email protected]>
drm: use ATOMIC64_INIT() for atomic64_t
José Expósito <[email protected]>
drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
Leon Hwang <[email protected]>
bpf, bpftool: Fix incorrect disasm pc
Zichen Xie <[email protected]>
drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
Yuan Can <[email protected]>
wifi: wfx: Fix error handling in wfx_core_init()
Sean Anderson <[email protected]>
drm: zynqmp_kms: Unplug DRM device before removal
Li Huafei <[email protected]>
drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
Lucas Stach <[email protected]>
drm/etnaviv: hold GPU lock across perfmon sampling
Xiaolei Wang <[email protected]>
drm/etnaviv: Request pages from DMA32 zone on addressing_limited
Lukasz Luba <[email protected]>
drm/msm/gpu: Check the status of registration to PM QoS
Jinjie Ruan <[email protected]>
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
Xu Kuohai <[email protected]>
bpf, arm64: Remove garbage frame for struct_ops trampoline
Steven Price <[email protected]>
drm/panfrost: Remove unused id_mask from struct panfrost_model
Andrii Nakryiko <[email protected]>
selftests/bpf: fix test_spin_lock_fail.c's global vars usage
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: drop LM_3 / LM_4 on SDM845
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
Matthias Schiffer <[email protected]>
drm: fsl-dcu: enable PIXCLK on LS1021A
Alper Nebi Yasak <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
Zijian Zhang <[email protected]>
selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Fix msg_verify_data in test_sockmap
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: Fix link properties discovery
Hangbin Liu <[email protected]>
netdevsim: copy addresses for both in and out paths
Andrii Nakryiko <[email protected]>
libbpf: never interpret subprogs in .text as entry programs
Everest K.C <[email protected]>
ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c
Andrii Nakryiko <[email protected]>
libbpf: fix sym_is_subprog() logic for weak global subprogs
Dave Stevenson <[email protected]>
drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush
Jacob Keller <[email protected]>
ice: consistently use q_idx in ice_vc_cfg_qs_msg()
Haiyue Wang <[email protected]>
ice: Support FCS/CRC strip disable for VF
Paul M Stillwell Jr <[email protected]>
virtchnl: Add CRC stripping capability
Balaji Pothunoori <[email protected]>
wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR
Yuan Chen <[email protected]>
bpf: Fix the xdp_adjust_tail sample prog issue
Tony Ambardar <[email protected]>
libbpf: Fix output .symtab byte-order during linking
Tao Chen <[email protected]>
libbpf: Fix expected_attach_type set handling in program load callback
Pin-yen Lin <[email protected]>
drm/bridge: it6505: Drop EDID cache on bridge power off
Pin-yen Lin <[email protected]>
drm/bridge: anx7625: Drop EDID cache on bridge power off
Macpaul Lin <[email protected]>
ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: fix regmap_write_bits usage
Igor Prusov <[email protected]>
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
Ramya Gnanasekar <[email protected]>
wifi: ath12k: Skip Rx TID cleanup for self peer
Baochen Qiang <[email protected]>
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
Baochen Qiang <[email protected]>
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
Maíra Canal <[email protected]>
drm/v3d: Address race-condition in MMU flush
Jinjie Ruan <[email protected]>
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
Tomi Valkeinen <[email protected]>
drm/omap: Fix locking in omap_gem_new_dmabuf()
Tomi Valkeinen <[email protected]>
drm/omap: Fix possible NULL dereference
Jeongjun Park <[email protected]>
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
Dave Stevenson <[email protected]>
drm/vc4: hvs: Correct logic on stopping an HVS channel
Dave Stevenson <[email protected]>
drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function
Dave Stevenson <[email protected]>
drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer
Dom Cobley <[email protected]>
drm/vc4: hdmi: Avoid hang with debug registers when suspended
Dave Stevenson <[email protected]>
drm/vc4: hvs: Don't write gamma luts on 2711
Andy Shevchenko <[email protected]>
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
Yao Zi <[email protected]>
platform/x86: panasonic-laptop: Return errno correctly in show callback
Vitaly Kuznetsov <[email protected]>
HID: hyperv: streamline driver probe to avoid devres issues
Chris Morgan <[email protected]>
arm64: dts: rockchip: correct analog audio name on Indiedroid Nova
Li Huafei <[email protected]>
media: atomisp: Add check for rgby_data memory allocation failure
Luo Qiu <[email protected]>
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
Reinette Chatre <[email protected]>
selftests/resctrl: Protect against array overrun during iMC config parsing
Reinette Chatre <[email protected]>
selftests/resctrl: Fix memory overflow due to unhandled wraparound
Ilpo Järvinen <[email protected]>
selftests/resctrl: Refactor fill_buf functions
Ilpo Järvinen <[email protected]>
selftests/resctrl: Split fill_buf to allow tests finer-grained control
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names
Macpaul Lin <[email protected]>
arm64: dts: mediatek: mt6358: fix dtbs_check error
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: Add ADC node on MT6357, MT6358, MT6359 PMICs
Lad Prabhakar <[email protected]>
arm64: dts: renesas: hihope: Drop #sound-dai-cells
Andy Shevchenko <[email protected]>
regmap: irq: Set lockdep class for hierarchical IRQ domains
Jinjie Ruan <[email protected]>
spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time
Breno Leitao <[email protected]>
spi: tegra210-quad: Avoid shift-out-of-bounds
Zhang Zekun <[email protected]>
pmdomain: ti-sci: Add missing of_node_put() for args.np
Usama Arif <[email protected]>
of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify
Stephen Boyd <[email protected]>
x86/of: Unconditionally call unflatten_and_copy_device_tree()
Stephen Boyd <[email protected]>
um: Unconditionally call unflatten_device_tree()
Anurag Dutta <[email protected]>
arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances
Anurag Dutta <[email protected]>
arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances
Anurag Dutta <[email protected]>
arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances
Jared McArthur <[email protected]>
arm64: dts: ti: k3-j7200: Fix register map for main domain pmx
Thomas Richard <[email protected]>
arm64: dts: ti: k3-j7200: use ti,j7200-padconf compatible
Andre Przywara <[email protected]>
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
Clark Wang <[email protected]>
pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
Daolong Zhu <[email protected]>
arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns
Daolong Zhu <[email protected]>
arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns
Daolong Zhu <[email protected]>
arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns
Daolong Zhu <[email protected]>
arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns
Dragan Simic <[email protected]>
regulator: rk808: Restrict DVS GPIOs to the RK808 variant only
Chen Ridong <[email protected]>
cgroup/bpf: only cgroup v2 can be attached by bpf programs
Chen Ridong <[email protected]>
Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
Hsin-Te Yuan <[email protected]>
arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
Hsin-Te Yuan <[email protected]>
arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
Colin Ian King <[email protected]>
media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call
Gregory Price <[email protected]>
tpm: fix signed/unsigned bug when checking event logs
Jonathan Marek <[email protected]>
efi/libstub: fix efi_parse_options() ignoring the default command line
Stafford Horne <[email protected]>
openrisc: Implement fixmap to fix earlycon
Bartosz Golaszewski <[email protected]>
mmc: mmc_spi: drop buggy snprintf()
Andrei Simion <[email protected]>
ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode
Luca Weiss <[email protected]>
arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins
Dan Carpenter <[email protected]>
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
Jinjie Ruan <[email protected]>
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
Macpaul Lin <[email protected]>
arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node
Macpaul Lin <[email protected]>
arm64: dts: mt8195: Fix dtbs_check error for mutex node
Michal Simek <[email protected]>
microblaze: Export xmb_manager functions
Gaosheng Cui <[email protected]>
drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
Javier Carrasco <[email protected]>
clocksource/drivers/timer-ti-dm: Fix child node refcount handling
Mark Brown <[email protected]>
clocksource/drivers:sp804: Make user selectable
Marco Elver <[email protected]>
kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
Marco Elver <[email protected]>
kcsan, seqlock: Support seqcount_latch_t
Miguel Ojeda <[email protected]>
time: Fix references to _msecs_to_jiffies() handling of values
Miguel Ojeda <[email protected]>
time: Partially revert cleanup on msecs_to_jiffies() documentation
Zheng Yejian <[email protected]>
x86/unwind/orc: Fix unwind for newly forked tasks
Daniel Lezcano <[email protected]>
thermal/lib: Fix memory leak on error in thermal_genl_auto()
Daniel Lezcano <[email protected]>
tools/lib/thermal: Make more generic the command encoding function
Uladzislau Rezki (Sony) <[email protected]>
rcuscale: Do a proper cleanup if kfree_scale_init() fails
Christophe JAILLET <[email protected]>
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
Chen Ridong <[email protected]>
crypto: bcm - add error check in the ahash_hmac_init function
Chen Ridong <[email protected]>
crypto: caam - add error check to caam_rsa_set_priv_key_form
Lifeng Zheng <[email protected]>
ACPI: CPPC: Fix _CPC register setting issue
Pei Xiao <[email protected]>
hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
Jerome Brunet <[email protected]>
hwmon: (pmbus/core) clear faults after setting smbalert mask
Patrick Rudolph <[email protected]>
hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK
Uladzislau Rezki (Sony) <[email protected]>
rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
Baruch Siach <[email protected]>
doc: rcu: update printed dynticks counter bits
Li Huafei <[email protected]>
crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init()
Orange Kao <[email protected]>
EDAC/igen6: Avoid segmentation fault on module unload
Weili Qian <[email protected]>
crypto: hisilicon/qm - disable same error report before resetting
Gautham R. Shenoy <[email protected]>
amd-pstate: Set min_perf to nominal_perf for active mode performance gov
Everest K.C <[email protected]>
crypto: cavium - Fix the if condition to exit loop after timeout
Yi Yang <[email protected]>
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
Qiuxu Zhuo <[email protected]>
EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator
Qiuxu Zhuo <[email protected]>
EDAC/skx_common: Differentiate memory error sources
Priyanka Singh <[email protected]>
EDAC/fsl_ddr: Fix bad bit shift operations
Rafael J. Wysocki <[email protected]>
thermal: core: Initialize thermal zones before registering them
Ahsan Atta <[email protected]>
crypto: qat - remove faulty arbiter config reset
David Thompson <[email protected]>
EDAC/bluefield: Fix potential integer overflow
Yuan Can <[email protected]>
firmware: google: Unregister driver_info on failure
Dan Carpenter <[email protected]>
crypto: qat/qat_4xxx - fix off by one in uof_get_name()
Cabiddu, Giovanni <[email protected]>
crypto: qat - remove check after debugfs_create_dir()
Christophe JAILLET <[email protected]>
crypto: caam - Fix the pointer passed to caam_qi_shutdown()
Christoph Hellwig <[email protected]>
virtio_blk: reverse request order in virtio_queue_rqs
Christoph Hellwig <[email protected]>
nvme-pci: reverse request order in nvme_queue_rqs
Long Li <[email protected]>
ext4: fix race in buffer_head read fault injection
Matthew Wilcox (Oracle) <[email protected]>
ext4: remove array of buffer_heads from mext_page_mkuptodate()
Matthew Wilcox (Oracle) <[email protected]>
ext4: pipeline buffer reads in mext_page_mkuptodate()
Matthew Wilcox (Oracle) <[email protected]>
ext4: remove calls to to set/clear the folio error flag
Thadeu Lima de Souza Cascardo <[email protected]>
hfsplus: don't query the device logical block size multiple times
Masahiro Yamada <[email protected]>
s390/syscalls: Avoid creation of arch/arch/ directory
Christoph Hellwig <[email protected]>
block: fix bio_split_rw_at to take zone_write_granularity into account
Zizhi Wo <[email protected]>
netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING
Zizhi Wo <[email protected]>
cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter()
Aleksandr Mishin <[email protected]>
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
Masahiro Yamada <[email protected]>
arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
Daniel Palmer <[email protected]>
m68k: mvme147: Reinstate early console
Geert Uytterhoeven <[email protected]>
m68k: mvme16x: Add and use "mvme16x.h"
Daniel Palmer <[email protected]>
m68k: mvme147: Fix SCSI controller IRQ numbers
Christoph Hellwig <[email protected]>
nvme-pci: fix freeing of the HMB descriptor table
David Disseldorp <[email protected]>
initramfs: avoid filename buffer overrun
Jonas Gorski <[email protected]>
mips: asm: fix warning when disabling MIPS_FP_SUPPORT
Jan Kara <[email protected]>
ext4: avoid remount errors with 'abort' mount option
Yang Erkun <[email protected]>
brd: defer automatic disk creation until module initialization succeeds
Ard Biesheuvel <[email protected]>
x86/pvh: Call C code via the kernel virtual mapping
Jason Andryuk <[email protected]>
x86/pvh: Set phys_base when calling xen_prepare_pvh()
Heiko Carstens <[email protected]>
s390/pageattr: Implement missing kernel_page_present()
Vineeth Vijayan <[email protected]>
s390/cio: Do not unregister the subchannel based on DNV
Andre Przywara <[email protected]>
kselftest/arm64: mte: fix printf type warnings about longs
Andre Przywara <[email protected]>
kselftest/arm64: mte: fix printf type warnings about __u64
Kristina Martsenko <[email protected]>
arm64: probes: Disable kprobes/uprobes on MOPS instructions
Andrii Nakryiko <[email protected]>
bpf: support non-r10 register spill/fill to/from stack in precision tracking
Dmitry Kandybka <[email protected]>
mptcp: fix possible integer overflow in mptcp_reset_tout_timer
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
Hans de Goede <[email protected]>
platform/x86: x86-android-tablets: Unregister devices in reverse order
Keith Busch <[email protected]>
nvme: apple: fix device reference counting
Oleg Nesterov <[email protected]>
fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
Wayne Lin <[email protected]>
drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute
Alex Hung <[email protected]>
drm/amd/display: Check null-initialized variables
Li Zhijian <[email protected]>
fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
Alex Hung <[email protected]>
drm/amd/display: Initialize denominators' default to 1
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func
Ard Biesheuvel <[email protected]>
x86/stackprotector: Work around strict Clang TLS symbol requirements
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: fix invalid FIFO access with special register set
Holger Dengler <[email protected]>
s390/pkey: Wipe copies of clear-key structures on failure
Alexander Stein <[email protected]>
i2c: lpi2c: Avoid calling clk_get_rate during transfer
Breno Leitao <[email protected]>
ipmr: Fix access to mfc_cache_list without lock held
Harith G <[email protected]>
ARM: 9420/1: smp: Fix SMP for xip kernels
Eryk Zagorski <[email protected]>
ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
Yuli Wang <[email protected]>
LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS
John Watts <[email protected]>
ASoC: audio-graph-card2: Purge absent supplies for device tree nodes
David Wang <[email protected]>
proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
Hans de Goede <[email protected]>
drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict
Luo Yifan <[email protected]>
ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
Luo Yifan <[email protected]>
ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
Markus Petri <[email protected]>
ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6
Vishnu Sankar <[email protected]>
platform/x86: thinkpad_acpi: Fix for ThinkPad's with ECFW showing incorrect fan speed
Alexander Hölzl <[email protected]>
can: j1939: fix error in J1939 documentation.
zhang jiao <[email protected]>
tools/lib/thermal: Remove the thermal.h soft link when doing make clean
Shenghao Ding <[email protected]>
ASoC: tas2781: Add new driver version for tas2563 & tas2781 qfn chip
Kurt Borja <[email protected]>
platform/x86: dell-wmi-base: Handle META key Lock/Unlock events
Kurt Borja <[email protected]>
platform/x86: dell-smbios-base: Extends support to Alienware products
Mikhail Rudenko <[email protected]>
regulator: rk808: Add apply_bit for BUCK3 on RK809
Cristian Marussi <[email protected]>
firmware: arm_scmi: Reject clear channel request on A2P
Charles Han <[email protected]>
soc: qcom: Add check devm_kasprintf() returned value
Benoît Monin <[email protected]>
net: usb: qmi_wwan: add Quectel RG650V
Jiayuan Chen <[email protected]>
bpf: fix filed access without lock
Arnd Bergmann <[email protected]>
x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
Piyush Raj Chouhan <[email protected]>
ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
Li Zhijian <[email protected]>
selftests/watchdog-test: Fix system accidentally reset after watchdog-test
Javier Carrasco <[email protected]>
usb: typec: use cleanup facility for 'altmodes_node'
Benjamin Große <[email protected]>
usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver
Ben Greear <[email protected]>
mac80211: fix user-power when emulating chanctx
Daniel Gabay <[email protected]>
wifi: iwlwifi: mvm: Use the sync timepoint API in suspend
Hans de Goede <[email protected]>
ASoC: Intel: sst: Support LPE0F28 ACPI HID
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec
Hans de Goede <[email protected]>
ASoC: codecs: rt5640: Always disable IRQs from rt5640_cancel_work()
Gustavo A. R. Silva <[email protected]>
wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings
-------------
Diffstat:
Documentation/ABI/testing/sysfs-fs-f2fs | 7 +- Documentation/RCU/stallwarn.rst | 2 +- .../devicetree/bindings/clock/adi,axi-clkgen.yaml | 22 +- .../devicetree/bindings/iio/dac/adi,ad3552r.yaml | 2 +- .../devicetree/bindings/serial/rs485.yaml | 19 +- .../devicetree/bindings/sound/mt6359.yaml | 10 +- .../devicetree/bindings/vendor-prefixes.yaml | 2 + Documentation/filesystems/mount_api.rst | 3 +- Documentation/locking/seqlock.rst | 2 +- Documentation/networking/j1939.rst | 2 +- Makefile | 4 +- arch/arc/kernel/devtree.c | 2 +- .../boot/dts/allwinner/sun9i-a80-cubieboard4.dts | 4 +- arch/arm/boot/dts/microchip/sam9x60.dtsi | 12 ++ arch/arm/boot/dts/ti/omap/omap36xx.dtsi | 1 + arch/arm/kernel/devtree.c | 2 +- arch/arm/kernel/entry-armv.S | 8 + arch/arm/kernel/head.S | 4 + arch/arm/kernel/psci_smp.c | 7 + arch/arm/mm/idmap.c | 7 + arch/arm/mm/ioremap.c | 35 +++- .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt6357.dtsi | 5 + arch/arm64/boot/dts/mediatek/mt6358.dtsi | 9 +- arch/arm64/boot/dts/mediatek/mt6359.dtsi | 5 + arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 + .../dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts | 3 + .../dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts | 2 + .../dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 3 + .../dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi | 3 + .../boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 30 +-- .../boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 +- .../boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 +- .../boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 +- arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 4 +- arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +- arch/arm64/boot/dts/qcom/sm6350.dtsi | 14 +- arch/arm64/boot/dts/renesas/hihope-rev2.dtsi | 3 - arch/arm64/boot/dts/renesas/hihope-rev4.dtsi | 3 - .../boot/dts/rockchip/rk3588s-indiedroid-nova.dts | 2 +- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +- .../boot/dts/ti/k3-j7200-common-proc-board.dts | 2 +- arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 46 +++-- arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 18 +- arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi | 6 +- arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi | 16 +- arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi | 6 +- arch/arm64/include/asm/insn.h | 1 + arch/arm64/include/asm/kvm_host.h | 2 - arch/arm64/kernel/probes/decode-insn.c | 7 +- arch/arm64/kernel/process.c | 2 +- arch/arm64/kernel/setup.c | 6 +- arch/arm64/kernel/vmlinux.lds.S | 6 +- arch/arm64/kvm/arch_timer.c | 3 +- arch/arm64/kvm/arm.c | 18 +- arch/arm64/kvm/pmu-emul.c | 1 - arch/arm64/kvm/vgic/vgic-its.c | 32 +-- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 7 +- arch/arm64/kvm/vgic/vgic.h | 23 +++ arch/arm64/net/bpf_jit_comp.c | 47 +++-- arch/csky/kernel/setup.c | 4 +- arch/loongarch/include/asm/page.h | 5 +- arch/loongarch/kernel/setup.c | 2 +- arch/loongarch/net/bpf_jit.c | 2 +- arch/loongarch/vdso/Makefile | 2 +- arch/m68k/coldfire/device.c | 8 +- arch/m68k/include/asm/mcfgpio.h | 2 +- arch/m68k/include/asm/mvme147hw.h | 4 +- arch/m68k/kernel/early_printk.c | 9 +- arch/m68k/mvme147/config.c | 30 +++ arch/m68k/mvme147/mvme147.h | 6 + arch/m68k/mvme16x/config.c | 2 + arch/m68k/mvme16x/mvme16x.h | 6 + arch/microblaze/kernel/microblaze_ksyms.c | 10 + arch/microblaze/kernel/prom.c | 2 +- arch/mips/include/asm/switch_to.h | 2 +- arch/mips/kernel/prom.c | 2 +- arch/mips/kernel/relocate.c | 2 +- arch/nios2/kernel/prom.c | 4 +- arch/openrisc/Kconfig | 3 + arch/openrisc/include/asm/fixmap.h | 21 +- arch/openrisc/kernel/prom.c | 2 +- arch/openrisc/mm/init.c | 37 ++++ arch/parisc/kernel/ftrace.c | 2 +- arch/powerpc/Kconfig | 4 +- arch/powerpc/Makefile | 13 +- arch/powerpc/include/asm/dtl.h | 4 +- arch/powerpc/include/asm/fadump.h | 7 + arch/powerpc/include/asm/sstep.h | 5 - arch/powerpc/include/asm/vdso.h | 1 + arch/powerpc/kernel/dt_cpu_ftrs.c | 2 +- arch/powerpc/kernel/fadump.c | 23 +-- arch/powerpc/kernel/prom.c | 2 +- arch/powerpc/kernel/setup-common.c | 6 +- arch/powerpc/kernel/setup_64.c | 1 + arch/powerpc/kernel/vmlinux.lds.S | 2 - arch/powerpc/kexec/file_load_64.c | 9 +- arch/powerpc/kvm/book3s_hv.c | 10 +- arch/powerpc/kvm/book3s_hv_nested.c | 14 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/fault.c | 10 +- arch/powerpc/platforms/pseries/dtl.c | 8 +- arch/powerpc/platforms/pseries/lpar.c | 8 +- arch/powerpc/platforms/pseries/plpks.c | 2 +- arch/riscv/kernel/setup.c | 2 +- arch/riscv/kvm/aia_aplic.c | 3 +- arch/s390/include/asm/set_memory.h | 1 + arch/s390/kernel/entry.S | 4 + arch/s390/kernel/kprobes.c | 6 + arch/s390/kernel/syscalls/Makefile | 2 +- arch/s390/mm/pageattr.c | 15 ++ arch/sh/kernel/cpu/proc.c | 2 +- arch/sh/kernel/setup.c | 2 +- arch/um/drivers/net_kern.c | 2 +- arch/um/drivers/ubd_kern.c | 2 +- arch/um/drivers/vector_kern.c | 3 +- arch/um/kernel/dtb.c | 14 +- arch/um/kernel/physmem.c | 6 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/sysrq.c | 2 +- arch/x86/Makefile | 3 +- arch/x86/coco/tdx/tdcall.S | 60 +++--- arch/x86/coco/tdx/tdx-shared.c | 8 +- arch/x86/coco/tdx/tdx.c | 145 +++++++++---- arch/x86/crypto/aegis128-aesni-asm.S | 29 +-- arch/x86/entry/entry.S | 15 ++ arch/x86/events/intel/core.c | 34 ++- arch/x86/events/intel/pt.c | 11 +- arch/x86/events/intel/pt.h | 2 + arch/x86/include/asm/amd_nb.h | 5 +- arch/x86/include/asm/asm-prototypes.h | 3 + arch/x86/include/asm/shared/tdx.h | 29 ++- arch/x86/kernel/asm-offsets.c | 12 +- arch/x86/kernel/cpu/common.c | 2 + arch/x86/kernel/devicetree.c | 24 ++- arch/x86/kernel/unwind_orc.c | 2 +- arch/x86/kernel/vmlinux.lds.S | 3 + arch/x86/kvm/mmu/spte.c | 18 +- arch/x86/platform/pvh/head.S | 22 +- arch/x86/virt/vmx/tdx/tdxcall.S | 104 +++++----- arch/xtensa/kernel/setup.c | 2 +- block/bfq-iosched.c | 37 ++-- block/blk-merge.c | 10 +- block/blk-mq.c | 58 ++++-- block/blk-mq.h | 13 ++ crypto/pcrypt.c | 12 +- drivers/acpi/arm64/gtdt.c | 2 +- drivers/acpi/cppc_acpi.c | 1 - drivers/base/firmware_loader/main.c | 5 +- drivers/base/regmap/regmap-irq.c | 4 + drivers/block/brd.c | 66 ++++-- drivers/block/ublk_drv.c | 17 +- drivers/block/virtio_blk.c | 46 ++--- drivers/block/zram/zram_drv.c | 7 + drivers/char/tpm/tpm-chip.c | 4 - drivers/char/tpm/tpm-interface.c | 29 ++- drivers/clk/clk-apple-nco.c | 3 + drivers/clk/clk-axi-clkgen.c | 22 +- drivers/clk/imx/clk-fracn-gppll.c | 10 +- drivers/clk/imx/clk-imx8-acm.c | 4 +- drivers/clk/imx/clk-lpcg-scu.c | 37 +++- drivers/clk/imx/clk-scu.c | 2 +- drivers/clk/mediatek/Kconfig | 15 -- drivers/clk/qcom/gcc-qcs404.c | 1 + drivers/clk/ralink/clk-mtmips.c | 26 ++- drivers/clk/renesas/rzg2l-cpg.c | 11 +- drivers/clk/sunxi-ng/ccu-sun20i-d1.c | 2 +- drivers/clocksource/Kconfig | 3 +- drivers/clocksource/timer-ti-dm-systimer.c | 4 +- drivers/comedi/comedi_fops.c | 12 ++ drivers/counter/stm32-timer-cnt.c | 16 +- drivers/counter/ti-ecap-capture.c | 7 +- drivers/cpufreq/amd-pstate.c | 2 +- drivers/cpufreq/cppc_cpufreq.c | 63 +++++- drivers/cpufreq/loongson2_cpufreq.c | 4 +- drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- drivers/crypto/bcm/cipher.c | 5 +- drivers/crypto/caam/caampkc.c | 11 +- drivers/crypto/caam/qi.c | 2 +- drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/crypto/hisilicon/hpre/hpre_main.c | 35 +++- drivers/crypto/hisilicon/qm.c | 47 ++--- drivers/crypto/hisilicon/sec2/sec_main.c | 35 +++- drivers/crypto/hisilicon/zip/zip_main.c | 35 +++- drivers/crypto/inside-secure/safexcel_hash.c | 2 +- .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_dbgfs.c | 13 +- .../crypto/intel/qat/qat_common/adf_hw_arbiter.c | 4 - drivers/dax/pmem/Makefile | 7 - drivers/dax/pmem/pmem.c | 10 - drivers/dma-buf/udmabuf.c | 8 +- drivers/edac/bluefield_edac.c | 2 +- drivers/edac/fsl_ddr_edac.c | 22 +- drivers/edac/i10nm_base.c | 1 + drivers/edac/igen6_edac.c | 2 + drivers/edac/skx_common.c | 57 +++-- drivers/edac/skx_common.h | 8 + drivers/firmware/arm_scmi/common.h | 2 + drivers/firmware/arm_scmi/driver.c | 6 + drivers/firmware/arm_scpi.c | 3 + drivers/firmware/efi/libstub/efi-stub.c | 4 +- drivers/firmware/efi/tpm.c | 17 +- drivers/firmware/google/gsmi.c | 6 +- drivers/gpio/gpio-exar.c | 10 +- drivers/gpio/gpio-zevio.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 5 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 4 + .../amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c | 8 + .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 8 + .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 3 + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 31 ++- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 7 +- .../gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 3 + .../gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 5 + .../drm/amd/display/dc/dcn314/dcn314_resource.c | 5 + .../drm/amd/display/dc/dcn315/dcn315_resource.c | 2 + .../drm/amd/display/dc/dcn316/dcn316_resource.c | 2 + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 11 +- .../gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 8 + .../drm/amd/display/dc/dcn321/dcn321_resource.c | 2 + .../display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 7 +- .../amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 + drivers/gpu/drm/bridge/analogix/anx7625.c | 2 + drivers/gpu/drm/bridge/ite-it6505.c | 2 + drivers/gpu/drm/bridge/tc358767.c | 7 + drivers/gpu/drm/drm_file.c | 2 +- drivers/gpu/drm/drm_mm.c | 2 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 1 - drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 + drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 28 +-- drivers/gpu/drm/fsl-dcu/Kconfig | 1 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 ++ drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 + drivers/gpu/drm/imx/dcss/dcss-crtc.c | 6 +- drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +- .../drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h | 12 -- .../gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 14 +- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 +- drivers/gpu/drm/msm/msm_gpu_devfreq.c | 9 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 + drivers/gpu/drm/omapdrm/dss/base.c | 25 +-- drivers/gpu/drm/omapdrm/dss/omapdss.h | 3 +- drivers/gpu/drm/omapdrm/omap_drv.c | 4 +- drivers/gpu/drm/omapdrm/omap_gem.c | 10 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 - drivers/gpu/drm/radeon/atombios_encoders.c | 2 +- drivers/gpu/drm/radeon/cik.c | 14 +- drivers/gpu/drm/radeon/dce6_afmt.c | 2 +- drivers/gpu/drm/radeon/evergreen.c | 12 +- drivers/gpu/drm/radeon/ni.c | 2 +- drivers/gpu/drm/radeon/r100.c | 24 +-- drivers/gpu/drm/radeon/r300.c | 6 +- drivers/gpu/drm/radeon/r420.c | 6 +- drivers/gpu/drm/radeon/r520.c | 2 +- drivers/gpu/drm/radeon/r600.c | 12 +- drivers/gpu/drm/radeon/r600_cs.c | 2 +- drivers/gpu/drm/radeon/r600_dpm.c | 4 +- drivers/gpu/drm/radeon/r600_hdmi.c | 2 +- drivers/gpu/drm/radeon/radeon.h | 5 + drivers/gpu/drm/radeon/radeon_acpi.c | 10 +- drivers/gpu/drm/radeon/radeon_agp.c | 2 +- drivers/gpu/drm/radeon/radeon_atombios.c | 2 +- drivers/gpu/drm/radeon/radeon_audio.c | 14 +- drivers/gpu/drm/radeon/radeon_combios.c | 12 +- drivers/gpu/drm/radeon/radeon_device.c | 10 +- drivers/gpu/drm/radeon/radeon_display.c | 74 +++---- drivers/gpu/drm/radeon/radeon_fbdev.c | 26 +-- drivers/gpu/drm/radeon/radeon_fence.c | 8 +- drivers/gpu/drm/radeon/radeon_gem.c | 2 +- drivers/gpu/drm/radeon/radeon_i2c.c | 2 +- drivers/gpu/drm/radeon/radeon_ib.c | 2 +- drivers/gpu/drm/radeon/radeon_irq_kms.c | 12 +- drivers/gpu/drm/radeon/radeon_object.c | 2 +- drivers/gpu/drm/radeon/radeon_pm.c | 20 +- drivers/gpu/drm/radeon/radeon_ring.c | 2 +- drivers/gpu/drm/radeon/radeon_ttm.c | 6 +- drivers/gpu/drm/radeon/rs400.c | 6 +- drivers/gpu/drm/radeon/rs600.c | 14 +- drivers/gpu/drm/radeon/rs690.c | 2 +- drivers/gpu/drm/radeon/rv515.c | 4 +- drivers/gpu/drm/radeon/rv770.c | 2 +- drivers/gpu/drm/radeon/si.c | 4 +- drivers/gpu/drm/sti/sti_cursor.c | 3 + drivers/gpu/drm/sti/sti_gdp.c | 3 + drivers/gpu/drm/sti/sti_hqvdp.c | 3 + drivers/gpu/drm/v3d/v3d_mmu.c | 29 +-- drivers/gpu/drm/vc4/vc4_drv.h | 1 + drivers/gpu/drm/vc4/vc4_hdmi.c | 4 + drivers/gpu/drm/vc4/vc4_hvs.c | 23 ++- drivers/gpu/drm/vkms/vkms_output.c | 5 +- drivers/gpu/drm/xlnx/zynqmp_kms.c | 6 +- drivers/hid/hid-hyperv.c | 58 ++++-- drivers/hid/wacom_wac.c | 4 +- drivers/hwmon/nct6775-core.c | 7 +- drivers/hwmon/pmbus/pmbus_core.c | 12 +- drivers/hwmon/tps23861.c | 2 +- drivers/i2c/busses/i2c-imx-lpi2c.c | 10 +- drivers/i3c/master.c | 2 +- drivers/i3c/master/svc-i3c-master.c | 2 +- drivers/iio/accel/kionix-kx022a.c | 2 +- drivers/iio/adc/ad7780.c | 2 +- drivers/iio/adc/ad7923.c | 4 +- drivers/iio/industrialio-gts-helper.c | 4 +- drivers/iio/inkern.c | 2 +- drivers/iio/light/al3010.c | 11 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 4 +- drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_hem.c | 48 ++--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 150 ++++++++------ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 6 + drivers/infiniband/hw/hns/hns_roce_mr.c | 11 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 56 +++-- drivers/infiniband/hw/hns/hns_roce_srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 193 +++++++++++------ drivers/infiniband/hw/mlx5/mlx5_ib.h | 6 +- drivers/infiniband/hw/mlx5/qp.c | 4 + drivers/infiniband/hw/mlx5/srq.c | 4 + drivers/infiniband/sw/rxe/rxe_qp.c | 1 + drivers/infiniband/sw/rxe/rxe_req.c | 6 +- drivers/iommu/intel/iommu.c | 40 ++-- drivers/iommu/io-pgtable-arm.c | 18 +- drivers/leds/flash/leds-mt6360.c | 3 +- drivers/leds/leds-lp55xx-common.c | 3 - drivers/mailbox/arm_mhuv2.c | 8 +- drivers/mailbox/mtk-cmdq-mailbox.c | 12 +- drivers/md/bcache/closure.c | 10 +- drivers/md/dm-bufio.c | 12 +- drivers/md/dm-cache-background-tracker.c | 25 +-- drivers/md/dm-cache-background-tracker.h | 8 + drivers/md/dm-cache-target.c | 25 ++- drivers/md/dm-thin.c | 1 + drivers/md/md-bitmap.c | 1 + drivers/md/persistent-data/dm-space-map-common.c | 2 +- drivers/media/dvb-frontends/ts2020.c | 8 +- drivers/media/i2c/adv7604.c | 5 +- drivers/media/i2c/adv7842.c | 13 +- drivers/media/i2c/ds90ub960.c | 2 +- drivers/media/i2c/dw9768.c | 10 +- drivers/media/i2c/tc358743.c | 4 +- drivers/media/platform/allegro-dvt/allegro-core.c | 4 +- drivers/media/platform/amphion/vpu_drv.c | 2 +- drivers/media/platform/amphion/vpu_v4l2.c | 2 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 10 + .../media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 11 - drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 +- drivers/media/platform/qcom/venus/core.c | 2 +- .../media/platform/samsung/exynos4-is/media-dev.h | 5 +- .../verisilicon/rockchip_vpu981_hw_av1_dec.c | 3 +- drivers/media/radio/wl128x/fmdrv_common.c | 3 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 15 +- drivers/media/usb/gspca/ov534.c | 2 +- drivers/media/usb/uvc/uvc_driver.c | 102 ++++++--- drivers/media/v4l2-core/v4l2-dv-timings.c | 132 ++++++------ drivers/message/fusion/mptsas.c | 4 +- drivers/mfd/da9052-spi.c | 2 +- drivers/mfd/intel_soc_pmic_bxtwc.c | 138 ++++++++----- drivers/mfd/rt5033.c | 4 +- drivers/mfd/tps65010.c | 8 +- drivers/misc/apds990x.c | 12 +- drivers/misc/lkdtm/bugs.c | 4 +- drivers/mmc/host/mmc_spi.c | 9 +- drivers/mtd/hyperbus/rpc-if.c | 13 +- drivers/mtd/nand/raw/atmel/pmecc.c | 8 +- drivers/mtd/nand/raw/atmel/pmecc.h | 2 - drivers/mtd/spi-nor/core.c | 2 +- drivers/mtd/spi-nor/spansion.c | 1 + drivers/mtd/ubi/attach.c | 12 +- drivers/mtd/ubi/fastmap-wl.c | 19 +- drivers/mtd/ubi/wl.c | 11 +- drivers/mtd/ubi/wl.h | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 20 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h | 3 +- drivers/net/ethernet/broadcom/tg3.c | 3 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 28 ++- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 97 ++++++++- drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 6 + .../ethernet/marvell/octeontx2/af/lmac_common.h | 8 +- drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 104 ++++++++-- drivers/net/ethernet/marvell/octeontx2/af/rpm.h | 21 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 74 ++++++- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 5 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 4 + .../ethernet/marvell/octeontx2/nic/otx2_common.h | 1 + .../ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 5 + .../ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c | 9 + .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 10 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 20 ++ drivers/net/ethernet/marvell/pxa168_eth.c | 14 +- .../net/ethernet/microchip/vcap/vcap_api_kunit.c | 17 +- .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 + drivers/net/mdio/mdio-ipq4019.c | 5 +- drivers/net/netdevsim/ipsec.c | 11 +- drivers/net/usb/lan78xx.c | 42 ++-- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/r8152.c | 1 + drivers/net/wireless/ath/ath10k/mac.c | 4 +- drivers/net/wireless/ath/ath11k/qmi.c | 3 + drivers/net/wireless/ath/ath12k/dp.c | 5 +- drivers/net/wireless/ath/ath12k/mac.c | 5 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 3 + drivers/net/wireless/ath/wil6210/txrx.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/of.c | 3 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2200.h | 2 +- drivers/net/wireless/intel/iwlwifi/fw/init.c | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 + drivers/net/wireless/intersil/p54/p54spi.c | 4 +- drivers/net/wireless/marvell/libertas/radiotap.h | 4 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/main.c | 4 +- drivers/net/wireless/microchip/wilc1000/mon.c | 4 +- drivers/net/wireless/realtek/rtlwifi/efuse.c | 11 +- drivers/net/wireless/silabs/wfx/main.c | 17 +- drivers/net/wireless/virtual/mac80211_hwsim.c | 4 +- drivers/nvme/host/apple.c | 27 ++- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/ioctl.c | 8 +- drivers/nvme/host/multipath.c | 134 ++++++++++-- drivers/nvme/host/nvme.h | 4 + drivers/nvme/host/pci.c | 55 +++-- drivers/of/fdt.c | 14 +- drivers/of/kexec.c | 2 +- drivers/of/unittest.c | 4 - drivers/pci/controller/cadence/pci-j721e.c | 123 +++++++++-- drivers/pci/controller/cadence/pcie-cadence-host.c | 44 ++-- drivers/pci/controller/cadence/pcie-cadence.h | 12 ++ drivers/pci/controller/dwc/pci-keystone.c | 12 ++ drivers/pci/controller/pcie-rockchip-ep.c | 16 +- drivers/pci/controller/pcie-rockchip.h | 4 + drivers/pci/endpoint/functions/pci-epf-mhi.c | 6 + drivers/pci/endpoint/pci-epc-core.c | 6 +- drivers/pci/hotplug/cpqphp_pci.c | 19 +- drivers/pci/of_property.c | 2 +- drivers/pci/pci.c | 5 +- drivers/pci/pci.h | 3 + drivers/pci/slot.c | 4 +- drivers/perf/arm-cmn.c | 4 +- drivers/perf/arm_smmuv3_pmu.c | 19 +- drivers/pinctrl/pinctrl-k210.c | 2 +- drivers/pinctrl/pinctrl-zynqmp.c | 1 - drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 +- drivers/platform/chrome/cros_ec_typec.c | 1 + drivers/platform/x86/dell/dell-smbios-base.c | 1 + drivers/platform/x86/dell/dell-wmi-base.c | 6 + drivers/platform/x86/intel/bxtwc_tmu.c | 22 +- drivers/platform/x86/panasonic-laptop.c | 10 +- drivers/platform/x86/thinkpad_acpi.c | 28 ++- drivers/platform/x86/x86-android-tablets/core.c | 6 +- drivers/pmdomain/ti/ti_sci_pm_domains.c | 4 + drivers/power/supply/bq27xxx_battery.c | 37 +++- drivers/power/supply/power_supply_core.c | 2 - drivers/power/supply/rt9471.c | 52 +++-- drivers/pwm/pwm-imx27.c | 98 ++++++++- drivers/regulator/rk808-regulator.c | 17 +- drivers/remoteproc/qcom_q6v5_mss.c | 6 +- drivers/remoteproc/qcom_q6v5_pas.c | 2 + drivers/rpmsg/qcom_glink_native.c | 3 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-ab-eoz9.c | 7 - drivers/rtc/rtc-abx80x.c | 2 +- drivers/rtc/rtc-rzn1.c | 8 +- drivers/rtc/rtc-st-lpc.c | 5 +- drivers/s390/cio/cio.c | 6 +- drivers/s390/cio/device.c | 18 +- drivers/s390/crypto/pkey_api.c | 16 +- drivers/scsi/bfa/bfad.c | 3 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 3 +- drivers/scsi/lpfc/lpfc_scsi.c | 13 +- drivers/scsi/lpfc/lpfc_sli.c | 11 + drivers/scsi/qedf/qedf_main.c | 1 + drivers/scsi/qedi/qedi_main.c | 1 + drivers/scsi/sg.c | 9 +- drivers/sh/intc/core.c | 2 +- drivers/soc/fsl/rcpm.c | 1 + drivers/soc/qcom/qcom-geni-se.c | 3 +- drivers/soc/qcom/socinfo.c | 8 +- drivers/soc/ti/smartreflex.c | 4 +- drivers/soc/xilinx/xlnx_event_manager.c | 4 +- drivers/spi/atmel-quadspi.c | 2 +- drivers/spi/spi-fsl-lpspi.c | 12 +- drivers/spi/spi-tegra210-quad.c | 2 +- drivers/spi/spi-zynqmp-gqspi.c | 2 + drivers/spi/spi.c | 13 +- drivers/staging/media/atomisp/pci/sh_css_params.c | 2 + .../intel/int340x_thermal/int3400_thermal.c | 2 +- drivers/thermal/thermal_core.c | 2 +- drivers/tty/serial/8250/8250_fintek.c | 14 +- drivers/tty/serial/8250/8250_omap.c | 4 +- drivers/tty/serial/sc16is7xx.c | 4 + drivers/tty/tty_io.c | 2 +- drivers/ufs/host/ufs-exynos.c | 16 +- drivers/usb/dwc3/gadget.c | 15 +- drivers/usb/gadget/composite.c | 18 +- drivers/usb/host/ehci-spear.c | 7 +- drivers/usb/host/xhci-ring.c | 18 +- drivers/usb/misc/chaoskey.c | 35 +++- drivers/usb/misc/iowarrior.c | 50 +++-- drivers/usb/misc/yurex.c | 5 +- drivers/usb/musb/musb_gadget.c | 13 +- drivers/usb/typec/class.c | 6 +- drivers/usb/typec/tcpm/wcove.c | 4 - drivers/vdpa/mlx5/core/mr.c | 4 +- drivers/vfio/pci/vfio_pci_config.c | 16 +- drivers/video/fbdev/sh7760fb.c | 3 +- drivers/xen/xenbus/xenbus_probe.c | 8 +- fs/btrfs/ctree.c | 57 ++++- fs/btrfs/extent-tree.c | 25 ++- fs/btrfs/extent-tree.h | 8 +- fs/btrfs/free-space-tree.c | 10 +- fs/btrfs/ioctl.c | 6 +- fs/btrfs/qgroup.c | 6 +- fs/btrfs/ref-verify.c | 1 + fs/cachefiles/ondemand.c | 4 +- fs/ceph/super.c | 10 +- fs/erofs/zmap.c | 17 +- fs/exfat/namei.c | 1 + fs/ext4/balloc.c | 4 +- fs/ext4/ext4.h | 12 +- fs/ext4/extents.c | 2 +- fs/ext4/fsmap.c | 54 ++++- fs/ext4/ialloc.c | 5 +- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 4 +- fs/ext4/mballoc.c | 18 +- fs/ext4/mballoc.h | 1 + fs/ext4/mmp.c | 2 +- fs/ext4/move_extent.c | 47 +++-- fs/ext4/page-io.c | 3 - fs/ext4/readpage.c | 1 - fs/ext4/resize.c | 2 +- fs/ext4/super.c | 42 ++-- fs/f2fs/checkpoint.c | 2 +- fs/f2fs/data.c | 26 +-- fs/f2fs/f2fs.h | 3 +- fs/f2fs/file.c | 17 +- fs/f2fs/gc.c | 2 + fs/f2fs/node.c | 10 + fs/f2fs/segment.c | 5 +- fs/f2fs/segment.h | 35 +++- fs/f2fs/super.c | 13 +- fs/fscache/volume.c | 3 +- fs/gfs2/glock.c | 82 ++++---- fs/gfs2/glock.h | 3 +- fs/gfs2/incore.h | 2 +- fs/gfs2/log.c | 2 +- fs/gfs2/rgrp.c | 2 +- fs/gfs2/super.c | 6 +- fs/gfs2/util.c | 2 +- fs/hfsplus/hfsplus_fs.h | 3 +- fs/hfsplus/wrapper.c | 2 + fs/inode.c | 10 +- fs/jffs2/erase.c | 7 +- fs/jfs/xattr.c | 2 +- fs/nfs/internal.h | 2 +- fs/nfs/nfs4proc.c | 8 +- fs/nfsd/export.c | 36 +++- fs/nfsd/export.h | 4 +- fs/nfsd/nfs4callback.c | 16 +- fs/nfsd/nfs4proc.c | 7 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 19 ++ fs/notify/fsnotify.c | 23 ++- fs/ocfs2/aops.h | 2 + fs/ocfs2/file.c | 4 + fs/overlayfs/inode.c | 7 +- fs/overlayfs/util.c | 3 + fs/proc/array.c | 57 ++--- fs/proc/kcore.c | 11 +- fs/proc/softirqs.c | 2 +- fs/quota/dquot.c | 2 + fs/smb/client/cached_dir.c | 229 ++++++++++++++------- fs/smb/client/cached_dir.h | 6 +- fs/smb/client/cifsfs.c | 12 +- fs/smb/client/cifsglob.h | 4 +- fs/smb/client/cifsproto.h | 1 + fs/smb/client/connect.c | 59 +++++- fs/smb/client/fs_context.c | 85 +++++++- fs/smb/client/fs_context.h | 1 + fs/smb/client/inode.c | 4 +- fs/smb/client/reparse.c | 95 +++++++-- fs/smb/client/reparse.h | 6 +- fs/smb/client/smb1ops.c | 4 +- fs/smb/client/smb2file.c | 21 +- fs/smb/client/smb2inode.c | 6 +- fs/smb/client/smb2ops.c | 2 +- fs/smb/client/smb2pdu.c | 4 +- fs/smb/client/smb2proto.h | 9 +- fs/smb/client/trace.h | 3 + fs/smb/server/server.c | 4 + fs/ubifs/super.c | 6 +- fs/ubifs/tnc_commit.c | 2 + fs/unicode/utf8-core.c | 2 +- fs/xfs/libxfs/xfs_sb.c | 7 - fs/xfs/xfs_log_recover.c | 5 +- include/asm-generic/vmlinux.lds.h | 22 +- include/linux/avf/virtchnl.h | 11 +- include/linux/blkdev.h | 2 +- include/linux/bpf_verifier.h | 33 ++- include/linux/compiler_attributes.h | 13 -- include/linux/compiler_types.h | 19 ++ include/linux/hisi_acc_qm.h | 8 +- include/linux/init.h | 14 +- include/linux/jiffies.h | 2 +- include/linux/lockdep.h | 2 +- include/linux/mmdebug.h | 6 +- include/linux/netpoll.h | 2 +- include/linux/of_fdt.h | 5 +- include/linux/once.h | 4 +- include/linux/once_lite.h | 2 +- include/linux/rcupdate.h | 2 +- include/linux/seqlock.h | 98 ++++++--- include/linux/sock_diag.h | 10 +- include/linux/util_macros.h | 56 +++-- include/media/v4l2-dv-timings.h | 18 +- include/net/ieee80211_radiotap.h | 37 ++-- include/net/net_debug.h | 2 +- include/net/sock.h | 2 +- include/uapi/linux/rtnetlink.h | 2 +- init/Kconfig | 9 + init/initramfs.c | 15 ++ ipc/namespace.c | 4 +- kernel/bpf/verifier.c | 175 +++++++++------- kernel/cgroup/cgroup.c | 21 +- kernel/rcu/rcuscale.c | 6 +- kernel/rcu/tree.c | 14 +- kernel/signal.c | 9 +- kernel/time/time.c | 4 +- kernel/trace/bpf_trace.c | 5 +- kernel/trace/ftrace.c | 3 + kernel/trace/trace_event_perf.c | 6 + lib/maple_tree.c | 13 +- lib/string_helpers.c | 2 +- mm/internal.h | 2 +- mm/slab.h | 5 + mm/slub.c | 9 +- mm/vmstat.c | 1 + net/9p/trans_xen.c | 9 +- net/bluetooth/hci_sysfs.c | 15 +- net/bluetooth/mgmt.c | 38 +++- net/bluetooth/rfcomm/sock.c | 10 +- net/core/filter.c | 88 ++++---- net/core/gen_estimator.c | 2 +- net/core/skmsg.c | 4 +- net/core/sock_diag.c | 114 +++++----- net/hsr/hsr_device.c | 4 +- net/ipv4/cipso_ipv4.c | 2 +- net/ipv4/inet_connection_sock.c | 2 +- net/ipv4/inet_diag.c | 11 +- net/ipv4/ipmr.c | 44 ++-- net/ipv4/ipmr_base.c | 3 +- net/ipv4/tcp.c | 2 +- net/ipv4/tcp_bpf.c | 7 +- net/ipv4/tcp_fastopen.c | 7 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 41 ++-- net/ipv6/af_inet6.c | 2 +- net/ipv6/ip6_fib.c | 2 +- net/ipv6/ip6mr.c | 40 ++-- net/ipv6/ipv6_sockglue.c | 3 +- net/ipv6/route.c | 10 +- net/iucv/af_iucv.c | 26 ++- net/llc/af_llc.c | 2 +- net/mac80211/main.c | 2 + net/mptcp/protocol.c | 4 +- net/netfilter/ipset/ip_set_bitmap_ip.c | 7 +- net/netfilter/nf_tables_api.c | 161 +++++++++------ net/netlink/diag.c | 1 + net/packet/diag.c | 1 + net/rfkill/rfkill-gpio.c | 8 +- net/rxrpc/af_rxrpc.c | 7 +- net/sched/act_api.c | 2 +- net/smc/smc_diag.c | 1 + net/sunrpc/cache.c | 4 +- net/sunrpc/svcsock.c | 4 + net/sunrpc/xprtrdma/svc_rdma.c | 19 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtsock.c | 17 +- net/tipc/diag.c | 1 + net/unix/diag.c | 1 + net/vmw_vsock/diag.c | 1 + net/xdp/xsk_diag.c | 1 + rust/macros/lib.rs | 2 +- samples/bpf/xdp_adjust_tail_kern.c | 1 + scripts/checkpatch.pl | 61 ++++-- scripts/mod/file2alias.c | 5 +- scripts/mod/modpost.c | 45 +--- security/apparmor/capability.c | 2 + security/apparmor/policy_unpack_test.c | 6 + sound/core/pcm_native.c | 6 +- sound/core/ump.c | 5 +- sound/hda/intel-dsp-config.c | 4 + sound/pci/hda/patch_realtek.c | 155 +++++++------- sound/soc/amd/yc/acp6x-mach.c | 32 ++- sound/soc/codecs/da7219.c | 9 +- sound/soc/codecs/rt5640.c | 27 +-- sound/soc/codecs/rt722-sdca.c | 8 +- sound/soc/codecs/tas2781-fmwlib.c | 1 + sound/soc/fsl/fsl_micfil.c | 4 +- sound/soc/generic/audio-graph-card2.c | 3 + sound/soc/intel/atom/sst/sst_acpi.c | 64 +++++- sound/soc/intel/boards/bytcr_rt5640.c | 48 ++++- sound/soc/stm/stm32_sai_sub.c | 6 +- sound/usb/6fire/chip.c | 10 +- sound/usb/caiaq/audio.c | 10 +- sound/usb/caiaq/audio.h | 1 + sound/usb/caiaq/device.c | 19 +- sound/usb/caiaq/input.c | 12 +- sound/usb/caiaq/input.h | 1 + sound/usb/clock.c | 24 ++- sound/usb/quirks-table.h | 14 +- sound/usb/quirks.c | 27 ++- sound/usb/usx2y/us122l.c | 5 +- sound/usb/usx2y/usbusx2y.c | 2 +- tools/bpf/bpftool/jit_disasm.c | 40 +++- tools/include/nolibc/arch-s390.h | 1 + tools/lib/bpf/libbpf.c | 16 +- tools/lib/bpf/linker.c | 2 + tools/lib/thermal/Makefile | 4 +- tools/lib/thermal/commands.c | 52 +++-- tools/perf/builtin-ftrace.c | 2 +- tools/perf/builtin-list.c | 4 +- tools/perf/builtin-stat.c | 52 +++-- tools/perf/builtin-trace.c | 23 ++- tools/perf/tests/attr/test-stat-default | 94 ++++++--- tools/perf/tests/attr/test-stat-detailed-1 | 110 +++++++--- tools/perf/tests/attr/test-stat-detailed-2 | 134 ++++++++---- tools/perf/tests/attr/test-stat-detailed-3 | 142 ++++++++----- tools/perf/util/cs-etm.c | 25 ++- tools/perf/util/evlist.c | 19 +- tools/perf/util/evlist.h | 1 + tools/perf/util/pfm.c | 4 +- tools/perf/util/pmus.c | 2 +- tools/perf/util/probe-finder.c | 21 +- tools/perf/util/probe-finder.h | 4 +- .../selftests/arm64/mte/check_tags_inclusion.c | 4 +- .../testing/selftests/arm64/mte/mte_common_util.c | 4 +- .../selftests/bpf/progs/test_spin_lock_fail.c | 4 +- .../bpf/progs/verifier_subprog_precision.c | 23 ++- tools/testing/selftests/bpf/test_sockmap.c | 165 ++++++++++++--- tools/testing/selftests/bpf/verifier/precise.c | 38 ++-- .../selftests/mount_setattr/mount_setattr_test.c | 2 +- tools/testing/selftests/net/pmtu.sh | 2 +- tools/testing/selftests/resctrl/fill_buf.c | 74 +++---- tools/testing/selftests/resctrl/resctrl.h | 2 +- tools/testing/selftests/resctrl/resctrl_val.c | 3 +- tools/testing/selftests/vDSO/parse_vdso.c | 3 +- tools/testing/selftests/watchdog/watchdog-test.c | 6 + tools/testing/selftests/wireguard/netns.sh | 1 + 767 files changed, 7277 insertions(+), 3528 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/676 wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 57be3d3562ca4aa62b8047bc681028cc402af8ce ]
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally.
So, in order to avoid ending up with a flexible-array member in the middle of multiple other structs, we use the __struct_group() helper to create a new tagged struct ieee80211_radiotap_header_fixed. This structure groups together all the members of the flexible struct ieee80211_radiotap_header except the flexible array.
As a result, the array is effectively separated from the rest of the members without modifying the memory layout of the flexible structure. We then change the type of the middle struct members currently causing trouble from struct ieee80211_radiotap_header to struct ieee80211_radiotap_header_fixed.
We also want to ensure that in case new members need to be added to the flexible structure, they are always included within the newly created tagged struct. For this, we use static_assert(). This ensures that the memory layout for both the flexible structure and the new tagged struct is the same after any changes.
This approach avoids having to implement struct ieee80211_radiotap_header_fixed as a completely separate structure, thus preventing having to maintain two independent but basically identical structures, closing the door to potential bugs in the future.
So, with these changes, fix the following warnings:drivers/net/wireless/ath/wil6210/txrx.c:309:50: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/ipw2x00/ipw2100.c:2521:50: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/ipw2x00/ipw2200.h:1146:42: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/ipw2x00/libipw.h:595:36: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/marvell/libertas/radiotap.h:34:42: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/marvell/libertas/radiotap.h:5:42: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/microchip/wilc1000/mon.c:10:42: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/microchip/wilc1000/mon.c:15:42: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/virtual/mac80211_hwsim.c:758:42: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/virtual/mac80211_hwsim.c:767:42: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
--- drivers/net/wireless/ath/wil6210/txrx.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2200.h | 2 +- .../net/wireless/marvell/libertas/radiotap.h | 4 +- drivers/net/wireless/microchip/wilc1000/mon.c | 4 +- drivers/net/wireless/virtual/mac80211_hwsim.c | 4 +- include/net/ieee80211_radiotap.h | 43 +++++++++++-------- 7 files changed, 33 insertions(+), 28 deletions(-)
drivers/net/wireless/ath/wil6210/txrx.c +1 -1
@@ -306,7 +306,7 @@ static void wil_rx_add_radiotap_header(struct wil6210_priv *wil, struct sk_buff *skb) {struct wil6210_rtap { -struct ieee80211_radiotap_header rthdr; +struct ieee80211_radiotap_header_fixed rthdr;/* fields should be in the order of bits in rthdr.it_present */ /* flags */ u8 flags;
drivers/net/wireless/intel/ipw2x00/ipw2100.c +1 -1
@@ -2520,7 +2520,7 @@ static void isr_rx_monitor(struct ipw2100_priv *priv, int i,* to build this manually element by element, we can write it much * more efficiently than we can parse it. ORDER MATTERS HERE */ struct ipw_rt_hdr { -struct ieee80211_radiotap_header rt_hdr; +struct ieee80211_radiotap_header_fixed rt_hdr;s8 rt_dbmsignal;/* signal in dbM, kluged to signed */ } *ipw_rt;
drivers/net/wireless/intel/ipw2x00/ipw2200.h +1 -1
@@ -1143,7 +1143,7 @@ struct ipw_prom_priv {* structure is provided regardless of any bits unset. */ struct ipw_rt_hdr { -struct ieee80211_radiotap_header rt_hdr; +struct ieee80211_radiotap_header_fixed rt_hdr;u64 rt_tsf;/* TSF */ /* XXX */ u8 rt_flags;/* radiotap packet flags */ u8 rt_rate;/* rate in 500kb/s */
drivers/net/wireless/marvell/libertas/radiotap.h +2 -2
@@ -2,7 +2,7 @@#include <net/ieee80211_radiotap.h> struct tx_radiotap_hdr { -struct ieee80211_radiotap_header hdr; +struct ieee80211_radiotap_header_fixed hdr;u8 rate;u8 txpower;u8 rts_retries;
@@ -31,7 +31,7 @@ struct tx_radiotap_hdr {#define IEEE80211_FC_DSTODS 0x0300struct rx_radiotap_hdr { -struct ieee80211_radiotap_header hdr; +struct ieee80211_radiotap_header_fixed hdr;u8 flags;u8 rate;u8 antsignal;
drivers/net/wireless/microchip/wilc1000/mon.c +2 -2
@@ -7,12 +7,12 @@#include "cfg80211.h" struct wilc_wfi_radiotap_hdr { -struct ieee80211_radiotap_header hdr; +struct ieee80211_radiotap_header_fixed hdr;u8 rate; } __packed;struct wilc_wfi_radiotap_cb_hdr { -struct ieee80211_radiotap_header hdr; +struct ieee80211_radiotap_header_fixed hdr;u8 rate;u8 dump;u16 tx_flags;
drivers/net/wireless/virtual/mac80211_hwsim.c +2 -2
@@ -736,7 +736,7 @@ static const struct rhashtable_params hwsim_rht_params = { };struct hwsim_radiotap_hdr { -struct ieee80211_radiotap_header hdr; +struct ieee80211_radiotap_header_fixed hdr;__le64 rt_tsft;u8 rt_flags;u8 rt_rate;
@@ -745,7 +745,7 @@ struct hwsim_radiotap_hdr { } __packed;struct hwsim_radiotap_ack_hdr { -struct ieee80211_radiotap_header hdr; +struct ieee80211_radiotap_header_fixed hdr;u8 rt_flags;u8 pad;__le16 rt_channel;
include/net/ieee80211_radiotap.h +24 -19
55 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/676 ASoC: codecs: rt5640: Always disable IRQs from rt5640_cancel_work()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 032532f91a1d06d0750f16c49a9698ef5374a68f ]
Disable IRQs from rt5640_cancel_work(), this fixes a crash caused by the IRQ never getting freed when the driver is unbound from the i2c_client with jack-detection active:
[ 193.138780] rt5640 i2c-rt5640: ASoC: unknown pin LDO2 [ 193.138830] rt5640 i2c-rt5640: ASoC: unknown pin MICBIAS1 [ 193.671218] BUG: kernel NULL pointer dereference, address: 0000000000000078 [ 193.671239] #PF: supervisor read access in kernel mode [ 193.671248] #PF: error_code(0x0000) - not-present page ... [ 193.671531] ? asm_exc_page_fault+0x22/0x30 [ 193.671551] ? rt5640_jack_inserted+0x10/0x80 [snd_soc_rt5640] [ 193.671574] rt5640_detect_headset+0x93/0x130 [snd_soc_rt5640] [ 193.671596] rt5640_jack_work+0x93/0x355 [snd_soc_rt5640]
--- sound/soc/codecs/rt5640.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
sound/soc/codecs/rt5640.c +15 -12
@@ -2422,10 +2422,20 @@ static irqreturn_t rt5640_jd_gpio_irq(int irq, void *data)return IRQ_HANDLED ; } -static void rt5640_cancel_work (void *data) +static void rt5640_disable_irq_and_cancel_work (void *data) {struct rt5640_priv *rt5640 = data; +if (rt5640->jd_gpio_irq_requested) { +free_irq (rt5640->jd_gpio_irq, rt5640); + rt5640->jd_gpio_irq_requested = false; + } + +if (rt5640->irq_requested) { +free_irq (rt5640->irq, rt5640); + rt5640->irq_requested = false; + } +cancel_delayed_work_sync (&rt5640->jack_work);cancel_delayed_work_sync (&rt5640->bp_work); }
@@ -2466,13 +2476,7 @@ static void rt5640_disable_jack_detect(struct snd_soc_component *component)if (!rt5640->jack)return ; -if (rt5640->jd_gpio_irq_requested) -free_irq (rt5640->jd_gpio_irq, rt5640); - -if (rt5640->irq_requested) -free_irq (rt5640->irq, rt5640); - -rt5640_cancel_work (rt5640); +rt5640_disable_irq_and_cancel_work (rt5640);if (rt5640->jack->status &SND_JACK_MICROPHONE ) {rt5640_disable_micbias1_ovcd_irq (component);
@@ -2480,8 +2484,6 @@ static void rt5640_disable_jack_detect(struct snd_soc_component *component)snd_soc_jack_report (rt5640->jack,0 ,SND_JACK_BTN_0 ); } - rt5640->jd_gpio_irq_requested = false; - rt5640->irq_requested = false; rt5640->jd_gpio =NULL ; rt5640->jack =NULL ; }
@@ -2801,7 +2803,8 @@ static int rt5640_suspend(struct snd_soc_component *component)if (rt5640->jack) {/* disable jack interrupts during system suspend */ disable_irq (rt5640->irq); -rt5640_cancel_work (rt5640); +cancel_delayed_work_sync (&rt5640->jack_work); +cancel_delayed_work_sync (&rt5640->bp_work); }snd_soc_component_force_bias_level (component,SND_SOC_BIAS_OFF );
@@ -3035,7 +3038,7 @@ static int rt5640_i2c_probe(struct i2c_client *i2c)INIT_DELAYED_WORK (&rt5640->jack_work, rt5640_jack_work);/* Make sure work is stopped on probe-error / remove */ - ret =devm_add_action_or_reset (&i2c->dev, rt5640_cancel_work, rt5640); + ret =devm_add_action_or_reset (&i2c->dev, rt5640_disable_irq_and_cancel_work, rt5640);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/676 ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit d48696b915527b5bcdd207a299aec03fb037eb17 ]
On some x86 Bay Trail tablets which shipped with Android as factory OS, the DSDT is so broken that the codec needs to be manually instantatiated by the special x86-android-tablets.ko "fixup" driver for cases like this.
This means that the codec-dev cannot be retrieved through its ACPI fwnode, add support to the bytcr_rt5640 machine driver for such manually instantiated rt5640 i2c_clients.
An example of a tablet which needs this is the Vexia EDU ATLA 10 tablet, which has been distributed to schools in the Spanish Andalucía region.
--- sound/soc/intel/boards/bytcr_rt5640.c | 33 ++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-)
sound/soc/intel/boards/bytcr_rt5640.c +30 -3
@@ -17,6 +17,7 @@#include <linux/acpi.h> #include <linux/clk.h> #include <linux/device.h> +#include <linux/device/bus.h> #include <linux/dmi.h> #include <linux/gpio/consumer.h> #include <linux/gpio/machine.h>
@@ -32,6 +33,8 @@#include "../atom/sst-atom-controls.h" #include "../common/soc-intel-quirks.h" +#define BYT_RT5640_FALLBACK_CODEC_DEV_NAME "i2c-rt5640" +enum {BYT_RT5640_DMIC1_MAP ,BYT_RT5640_DMIC2_MAP ,
@@ -1697,9 +1700,33 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) codec_dev =acpi_get_first_physical_node (adev);acpi_dev_put (adev); -if (!codec_dev) -return -EPROBE_DEFER ; - priv->codec_dev =get_device (codec_dev); + +if (codec_dev) { + priv->codec_dev =get_device (codec_dev); + }else { +/* +* Special case for Android tablets where the codec i2c_client +* has been manually instantiated by x86_android_tablets.ko due +* to a broken DSDT. +*/ + codec_dev =bus_find_device_by_name (&i2c_bus_type,NULL , +BYT_RT5640_FALLBACK_CODEC_DEV_NAME ); +if (!codec_dev) +return -EPROBE_DEFER ; + +if (!i2c_verify_client (codec_dev)) { +dev_err (dev,"Error '%s' is not an i2c_client\n" , +BYT_RT5640_FALLBACK_CODEC_DEV_NAME ); +put_device (codec_dev); + } + +/* fixup codec name */ +strscpy (byt_rt5640_codec_name,BYT_RT5640_FALLBACK_CODEC_DEV_NAME , +sizeof (byt_rt5640_codec_name)); + +/* bus_find_device() returns a reference no need to get() */ + priv->codec_dev = codec_dev; + }/* * swap SSP0 if bytcr is detected
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/676 ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 0107f28f135231da22a9ad5756bb16bd5cada4d5 ]
The Vexia Edu Atla 10 tablet mostly uses the BYTCR tablet defaults, but as happens on more models it is using IN1 instead of IN3 for its internal mic and JD_SRC_JD2_IN4N instead of JD_SRC_JD1_IN4P for jack-detection.
Add a DMI quirk for this to fix the internal-mic and jack-detection.
--- sound/soc/intel/boards/bytcr_rt5640.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +15 -0
@@ -1132,6 +1132,21 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_SSP0_AIF2 | BYT_RT5640_MCLK_EN), }, + { /* Vexia Edu Atla 10 tablet */ + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"AMI Corporation" ), +DMI_MATCH (DMI_BOARD_NAME ,"Aptio CRB" ), +/* Above strings are too generic, also match on BIOS date */ + DMI_MATCH(DMI_BIOS_DATE, "08/25/2014"), + }, + .driver_data = (void *)(BYT_RT5640_IN1_MAP | +BYT_RT5640_JD_SRC_JD2_IN4N | +BYT_RT5640_OVCD_TH_2000UA | +BYT_RT5640_OVCD_SF_0P75 | +BYT_RT5640_DIFF_MIC | +BYT_RT5640_SSP0_AIF2 | + BYT_RT5640_MCLK_EN), + }, { /* Voyo Winpad A15 */ .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/676 ASoC: Intel: sst: Support LPE0F28 ACPI HID
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 6668610b4d8ce9a3ee3ed61a9471f62fb5f05bf9 ]
Some old Bay Trail tablets which shipped with Android as factory OS have the SST/LPE audio engine described by an ACPI device with a HID (Hardware-ID) of LPE0F28 instead of 80860F28.
Add support for this. Note this uses a new sst_res_info for just the LPE0F28 case because it has a different layout for the IO-mem ACPI resources then the 80860F28.
An example of a tablet which needs this is the Vexia EDU ATLA 10 tablet, which has been distributed to schools in the Spanish Andalucía region.
--- sound/hda/intel-dsp-config.c | 4 ++ sound/soc/intel/atom/sst/sst_acpi.c | 64 +++++++++++++++++++++++++---- 2 files changed, 59 insertions(+), 9 deletions(-)
sound/hda/intel-dsp-config.c +4 -0
@@ -721,6 +721,10 @@ static const struct config_entry acpi_config_table[] = { #if IS_ENABLED(CONFIG_SND_SST_ATOM_HIFI2_PLATFORM_ACPI) || \ IS_ENABLED(CONFIG_SND_SOC_SOF_BAYTRAIL) /* BayTrail */ + { + .flags = FLAG_SST_OR_SOF_BYT, + .acpi_hid = "LPE0F28", + }, { .flags = FLAG_SST_OR_SOF_BYT, .acpi_hid = "80860F28",
sound/soc/intel/atom/sst/sst_acpi.c +55 -9
88 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/676 wifi: iwlwifi: mvm: Use the sync timepoint API in suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gabay <[email protected]>
[ Upstream commit 9715246ca0bfc9feaec1b4ff5b3d38de65a7025d ]
When starting the suspend flow, HOST_D3_START triggers an _async_ firmware dump collection for debugging purposes. The async worker may race with suspend flow and fail to get NIC access, resulting in the following warning:
"Timeout waiting for hardware access (CSR_GP_CNTRL 0xffffffff)"
Fix this by switching to the sync version to ensure the dump completes before proceeding with the suspend flow, avoiding potential race issues.
--- drivers/net/wireless/intel/iwlwifi/fw/init.c | 4 +++- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/fw/init.c +3 -1
@@ -39,10 +39,12 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans, }IWL_EXPORT_SYMBOL (iwl_fw_runtime_init); +/* Assumes the appropriate lock is held by the caller */ void iwl_fw_runtime_suspend (struct iwl_fw_runtime *fwrt) {iwl_fw_suspend_timestamp (fwrt); -iwl_dbg_tlv_time_point (fwrt,IWL_FW_INI_TIME_POINT_HOST_D3_START ,NULL ); +iwl_dbg_tlv_time_point_sync (fwrt,IWL_FW_INI_TIME_POINT_HOST_D3_START , +NULL ); }IWL_EXPORT_SYMBOL (iwl_fw_runtime_suspend);
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +2 -0
@@ -1382,7 +1382,9 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)iwl_mvm_pause_tcm (mvm, true); +mutex_lock (&mvm->mutex);iwl_fw_runtime_suspend (&mvm->fwrt); +mutex_unlock (&mvm->mutex);return __iwl_mvm_suspend (hw, wowlan, false); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/676 mac80211: fix user-power when emulating chanctx
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Greear <[email protected]>
[ Upstream commit 9b15c6cf8d2e82c8427cd06f535d8de93b5b995c ]
ieee80211_calc_hw_conf_chan was ignoring the configured user_txpower. If it is set, use it to potentially decrease txpower as requested.
--- net/mac80211/main.c | 2 ++ 1 file changed, 2 insertions(+)
net/mac80211/main.c +2 -0
@@ -145,6 +145,8 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local) } power =ieee80211_chandef_max_power (&chandef); +if (local->user_power_level !=IEEE80211_UNSET_POWER_LEVEL ) + power =min (local->user_power_level, power);rcu_read_lock ();list_for_each_entry_rcu (sdata, &local->interfaces, list) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/676 usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Große <[email protected]>
[ Upstream commit 94c11e852955b2eef5c4f0b36cfeae7dcf11a759 ]
This patch adds support for another Lenovo Mini dock 0x17EF:0x3098 to the r8152 driver. The device has been tested on NixOS, hotplugging and sleep included.
--- drivers/net/usb/r8152.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/r8152.c +1 -0
@@ -10016,6 +10016,7 @@ static const struct usb_device_id rtl8152_table[] = { { USB_DEVICE(VENDOR_ID_LENOVO, 0x3062) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x3069) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x3082) }, + { USB_DEVICE(VENDOR_ID_LENOVO, 0x3098) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x7205) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x720c) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x7214) },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/676 usb: typec: use cleanup facility for altmodes_node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 1ab0b9ae587373f9f800b6fda01b8faf02b3530b ]
Use the __free() macro for 'altmodes_node' to automatically release the node when it goes out of scope, removing the need for explicit calls to fwnode_handle_put().
--- drivers/usb/typec/class.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/typec/class.c +4 -2
@@ -2147,14 +2147,16 @@ void typec_port_register_altmodes(struct typec_port *port, const struct typec_altmode_ops *ops, void *drvdata, struct typec_altmode **altmodes, size_t n) { - struct fwnode_handle *altmodes_node, *child; + struct fwnode_handle *child;struct typec_altmode_desc desc;struct typec_altmode *alt;size_t index =0 ;u32 svid, vdo;int ret; - altmodes_node =device_get_named_child_node (&port->dev,"altmodes" ); + struct fwnode_handle *altmodes_node __free(fwnode_handle) = +device_get_named_child_node (&port->dev,"altmodes" ); +if (!altmodes_node)return ;/* No altmodes specified */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/676 selftests/watchdog-test: Fix system accidentally reset after watchdog-test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit dc1308bee1ed03b4d698d77c8bd670d399dcd04d ]
When running watchdog-test with 'make run_tests', the watchdog-test will be terminated by a timeout signal(SIGTERM) due to the test timemout.
And then, a system reboot would happen due to watchdog not stop. see the dmesg as below:
``` [ 1367.185172] watchdog: watchdog0: watchdog did not stop! ```
Fix it by registering more signals(including SIGTERM) in watchdog-test, where its signal handler will stop the watchdog.
After that
# timeout 1 ./watchdog-test Watchdog Ticking Away! . Stopping watchdog ticks...
--- tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/watchdog/watchdog-test.c +6 -0
@@ -334,7 +334,13 @@ int main(int argc, char *argv[])printf ("Watchdog Ticking Away!\n" ); +/* +* Register the signals +*/ signal (SIGINT , term); +signal (SIGTERM , term); +signal (SIGKILL , term); +signal (SIGQUIT , term);while (1 ) {keep_alive ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/676 ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piyush Raj Chouhan <[email protected]>
[ Upstream commit ef5fbdf732a158ec27eeba69d8be851351f29f73 ]
Infinix ZERO BOOK 13 has a 2+2 speaker system which isn't probed correctly. This patch adds a quirk with the proper pin connections.
Also The mic in this laptop suffers too high gain resulting in mostly fan noise being recorded,
This patch Also limit mic boost.
HW Probe for device; https://linux-hardware.org/?probe=a2e892c47b
Test: All 4 speaker works, Mic has low noise.
--- sound/pci/hda/patch_realtek.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/pci/hda/patch_realtek.c +12 -0
@@ -7265,6 +7265,7 @@ enum {ALC290_FIXUP_SUBWOOFER_HSJACK ,ALC269_FIXUP_THINKPAD_ACPI ,ALC269_FIXUP_DMIC_THINKPAD_ACPI , +ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13 ,ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ,ALC255_FIXUP_ACER_MIC_NO_PRESENCE , ALC255_FIXUP_ASUS_MIC_NO_PRESENCE,
@@ -7644,6 +7645,16 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc269_fixup_pincfg_U7x7_headset_mic, }, + [ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x14 ,0x90170151 },/* use as internal speaker (LFE) */ + {0x1b ,0x90170152 },/* use as internal speaker (back) */ + { } + }, + .chained = true, + .chain_id =ALC269_FIXUP_LIMIT_INT_MIC_BOOST + }, [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -10412,6 +10423,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ),SND_PCI_QUIRK (0x2782 ,0x0214 ,"VAIO VJFE-CL" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), +SND_PCI_QUIRK (0x2782 ,0x0228 ,"Infinix ZERO BOOK 13" ,ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13 ),SND_PCI_QUIRK (0x2782 ,0x0232 ,"CHUWI CoreBook XPro" ,ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ),SND_PCI_QUIRK (0x2782 ,0x1707 ,"Vaio VJFE-ADL" ,ALC298_FIXUP_SPK_VOLUME ), SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/676 x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit fce9642c765a18abd1db0339a7d832c29b68456a ]
node_to_amd_nb() is defined to NULL in non-AMD configs:
drivers/platform/x86/amd/hsmp/plat.c: In function 'init_platform_device':
drivers/platform/x86/amd/hsmp/plat.c:165:68: error: dereferencing 'void *' pointer [-Werror]
165 | sock->root = node_to_amd_nb(i)->root;
| ^~ drivers/platform/x86/amd/hsmp/plat.c:165:68: error: request for member 'root' in something not a structure or union
Users of the interface who also allow COMPILE_TEST will cause the above build error so provide an inline stub to fix that.
[ bp: Massage commit message. ]
--- arch/x86/include/asm/amd_nb.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/include/asm/amd_nb.h +4 -1
@@ -116,7 +116,10 @@ static inline bool amd_gart_present(void)#define amd_nb_num (x) 0#define amd_nb_has_feature (x) false -#define node_to_amd_nb (x) NULL +static inline struct amd_northbridge *node_to_amd_nb (int node) +{ +return NULL ; +}#define amd_gart_present (x) false#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/676 bpf: fix filed access without lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit a32aee8f0d987a7cba7fcc28002553361a392048 ]
The tcp_bpf_recvmsg_parser() function, running in user context, retrieves seq_copied from tcp_sk without holding the socket lock, and stores it in a local variable seq. However, the softirq context can modify tcp_sk->seq_copied concurrently, for example, n tcp_read_sock().
As a result, the seq value is stale when it is assigned back to tcp_sk->copied_seq at the end of tcp_bpf_recvmsg_parser(), leading to incorrect behavior.
Due to concurrency, the copied_seq field in tcp_bpf_recvmsg_parser() might be set to an incorrect value (less than the actual copied_seq) at the end of function: 'WRITE_ONCE(tcp->copied_seq, seq)'. This causes the 'offset' to be negative in tcp_read_sock()->tcp_recv_skb() when processing new incoming packets (sk->copied_seq - skb->seq becomes less than 0), and all subsequent packets will be dropped.
--- net/ipv4/tcp_bpf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/ipv4/tcp_bpf.c +4 -3
@@ -221,11 +221,11 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk,int flags, int *addr_len) { - struct tcp_sock *tcp = tcp_sk(sk); int peek = flags & MSG_PEEK; -u32 seq = tcp->copied_seq;struct sk_psock *psock; +struct tcp_sock *tcp;int copied =0 ; +u32 seq;if (unlikely (flags &MSG_ERRQUEUE ))return inet_recv_error (sk, msg, len, addr_len);
@@ -238,7 +238,8 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk,return tcp_recvmsg (sk, msg, len, flags, addr_len);lock_sock (sk); - + tcp =tcp_sk (sk); + seq = tcp->copied_seq;/* We may have received data on the sk_receive_queue pre-accept and * then we can not use read_skb in this context because we haven't * assigned a sk_socket yet so have no link to the ops. The work-around
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/676 net: usb: qmi_wwan: add Quectel RG650V
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Monin <[email protected]>
[ Upstream commit 6b3f18a76be6bbd237c7594cf0bf2912b68084fe ]
Add support for Quectel RG650V which is based on Qualcomm SDX65 chip. The composition is DIAG / NMEA / AT / AT / QMI.
T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=2c7c ProdID=0122 Rev=05.15
S: Manufacturer=Quectel
S: Product=RG650V-EU
S: SerialNumber=xxxxxxx
C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA
I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=9ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=9ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=9ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1084,6 +1084,7 @@ static const struct usb_device_id products[] = { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7), .driver_info = (unsigned long )&qmi_wwan_info, }, + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0122)}, /* Quectel RG650V */ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/676 soc: qcom: Add check devm_kasprintf() returned value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit e694d2b5c58ba2d1e995d068707c8d966e7f5f2a ]
devm_kasprintf() can return a NULL pointer on failure but this returned value in qcom_socinfo_probe() is not checked.
--- drivers/soc/qcom/socinfo.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/soc/qcom/socinfo.c +7 -1
@@ -757,10 +757,16 @@ static int qcom_socinfo_probe(struct platform_device *pdev) qs->attr.revision =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%u.%u" ,SOCINFO_MAJOR (le32_to_cpu (info->ver)),SOCINFO_MINOR (le32_to_cpu (info->ver))); -if (offsetof(struct socinfo , serial_num) <= item_size) +if (!qs->attr.soc_id || qs->attr.revision) +return -ENOMEM ; + +if (offsetof(struct socinfo , serial_num) <= item_size) { qs->attr.serial_number =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%u" ,le32_to_cpu (info->serial_num)); +if (!qs->attr.serial_number) +return -ENOMEM ; + } qs->soc_dev =soc_device_register (&qs->attr);if (IS_ERR (qs->soc_dev))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/676 firmware: arm_scmi: Reject clear channel request on A2P
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit a0a18e91eb3a6ef75a6de69dc00f206b913e3848 ]
The clear channel transport operation is supposed to be called exclusively on the P2A channel from the agent, since it relinquishes the ownership of the channel to the platform, after this latter has initiated some sort of P2A communication.
Make sure that, if it is ever called on a A2P, is logged and ignored.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/common.h | 2 ++ drivers/firmware/arm_scmi/driver.c | 6 ++++++ 2 files changed, 8 insertions(+)
drivers/firmware/arm_scmi/common.h +2 -0
@@ -163,6 +163,7 @@ void scmi_protocol_release(const struct scmi_handle *handle, u8 protocol_id);* used to initialize this channel * @dev: Reference to device in the SCMI hierarchy corresponding to this * channel +* @is_p2a: A flag to identify a channel as P2A (RX) * @rx_timeout_ms: The configured RX timeout in milliseconds. * @handle: Pointer to SCMI entity handle * @no_completion_irq: Flag to indicate that this channel has no completion
@@ -174,6 +175,7 @@ void scmi_protocol_release(const struct scmi_handle *handle, u8 protocol_id);struct scmi_chan_info {int id;struct device *dev; +bool is_p2a;unsigned int rx_timeout_ms;struct scmi_handle *handle;bool no_completion_irq;
drivers/firmware/arm_scmi/driver.c +6 -0
@@ -855,6 +855,11 @@ static inline void scmi_xfer_command_release(struct scmi_info *info,static inline void scmi_clear_channel (struct scmi_info *info,struct scmi_chan_info *cinfo) { +if (!cinfo->is_p2a) { +dev_warn (cinfo->dev,"Invalid clear on A2P channel !\n" ); +return ; + } +if (info->desc->ops->clear_channel) info->desc->ops->clear_channel (cinfo); }
@@ -2319,6 +2324,7 @@ static int scmi_chan_setup(struct scmi_info *info, struct device_node *of_node,if (!cinfo)return -ENOMEM ; + cinfo->is_p2a = !tx; cinfo->rx_timeout_ms = info->desc->max_rx_timeout_ms;/* Create a unique name for this transport device */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/676 regulator: rk808: Add apply_bit for BUCK3 on RK809
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Rudenko <[email protected]>
[ Upstream commit 5e53e4a66bc7430dd2d11c18a86410e3a38d2940 ]
Currently, RK809's BUCK3 regulator is modelled in the driver as a configurable regulator with 0.5-2.4V voltage range. But the voltage setting is not actually applied, because when bit 6 of PMIC_POWER_CONFIG register is set to 0 (default), BUCK3 output voltage is determined by the external feedback resistor. Fix this, by setting bit 6 when voltage selection is set. Existing users which do not specify voltage constraints in their device trees will not be affected by this change, since no voltage setting is applied in those cases, and bit 6 is not enabled.
--- drivers/regulator/rk808-regulator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/regulator/rk808-regulator.c +2 -0
@@ -1286,6 +1286,8 @@ static const struct regulator_desc rk809_reg[] = { .n_linear_ranges = ARRAY_SIZE(rk817_buck1_voltage_ranges), .vsel_reg = RK817_BUCK3_ON_VSEL_REG, .vsel_mask = RK817_BUCK_VSEL_MASK, + .apply_reg = RK817_POWER_CONFIG, + .apply_bit = RK817_BUCK3_FB_RES_INTER, .enable_reg = RK817_POWER_EN_REG(0), .enable_mask = ENABLE_MASK(RK817_ID_DCDC3), .enable_val = ENABLE_MASK(RK817_ID_DCDC3),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/676 platform/x86: dell-smbios-base: Extends support to Alienware products
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
[ Upstream commit a36b8b84ac4327b90ef5a22bc97cc96a92073330 ]
Fixes the following error:
dell_smbios: Unable to run on non-Dell system
Which is triggered after dell-wmi driver fails to initialize on Alienware systems, as it depends on dell-smbios.
This effectively extends dell-wmi, dell-smbios and dcdbas support to Alienware devices, that might share some features of the SMBIOS intereface calling interface with other Dell products.
Tested on an Alienware X15 R1.
--- drivers/platform/x86/dell/dell-smbios-base.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/dell/dell-smbios-base.c +1 -0
@@ -544,6 +544,7 @@ static int __init dell_smbios_init(void)int ret, wmi, smm;if (!dmi_find_device (DMI_DEV_TYPE_OEM_STRING ,"Dell System" ,NULL ) && + !dmi_find_device (DMI_DEV_TYPE_OEM_STRING ,"Alienware" ,NULL ) && !dmi_find_device (DMI_DEV_TYPE_OEM_STRING ,"www.dell.com" ,NULL )) {pr_err ("Unable to run on non-Dell system\n" );return -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/676 platform/x86: dell-wmi-base: Handle META key Lock/Unlock events
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
[ Upstream commit ec61f0bb4feec3345626a2b93b970b6719743997 ]
Some Alienware devices have a key that locks/unlocks the Meta key. This key triggers a WMI event that should be ignored by the kernel, as it's handled by internally the firmware.
There is no known way of changing this default behavior. The firmware would lock/unlock the Meta key, regardless of how the event is handled.
Tested on an Alienware x15 R1.
--- drivers/platform/x86/dell/dell-wmi-base.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/platform/x86/dell/dell-wmi-base.c +6 -0
@@ -80,6 +80,12 @@ static const struct dmi_system_id dell_wmi_smbios_list[] __initconst = {static const struct key_entry dell_wmi_keymap_type_0000[] = { {KE_IGNORE ,0x003a , {KEY_CAPSLOCK } }, +/* Meta key lock */ + {KE_IGNORE ,0xe000 , {KEY_RIGHTMETA } }, + +/* Meta key unlock */ + {KE_IGNORE ,0xe001 , {KEY_RIGHTMETA } }, +/* Key code is followed by brightness level */ {KE_KEY ,0xe005 , {KEY_BRIGHTNESSDOWN } }, {KE_KEY ,0xe006 , {KEY_BRIGHTNESSUP } },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/676 ASoC: tas2781: Add new driver version for tas2563 & tas2781 qfn chip
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <[email protected]>
[ Upstream commit fe09de2db2365eed8b44b572cff7d421eaf1754a ]
Add new driver version to support tas2563 & tas2781 qfn chip
--- sound/soc/codecs/tas2781-fmwlib.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/tas2781-fmwlib.c +1 -0
@@ -2022,6 +2022,7 @@ static int tasdevice_dspfw_ready(const struct firmware *fmw,break ;case 0x202 :case 0x400 : +case 0x401 : tas_priv->fw_parse_variable_header = fw_parse_variable_header_git; tas_priv->fw_parse_program_data =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/676 tools/lib/thermal: Remove the thermal.h soft link when doing make clean
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhang jiao <[email protected]>
[ Upstream commit c5426dcc5a3a064bbd2de383e29035a14fe933e0 ]
Run "make -C tools thermal" can create a soft link for thermal.h in tools/include/uapi/linux. Just rm it when make clean.
--- tools/lib/thermal/Makefile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/lib/thermal/Makefile +3 -1
@@ -121,7 +121,9 @@ all: fixdep clean: $(call QUIET_CLEAN, libthermal) $(RM) $(LIBTHERMAL_A) \ - *.o *~ *.a *.so *.so.$(VERSION) *.so.$(LIBTHERMAL_VERSION) .*.d .*.cmd LIBTHERMAL-CFLAGS $(LIBTHERMAL_PC) + *.o *~ *.a *.so *.so.$(VERSION) *.so.$(LIBTHERMAL_VERSION) \ + .*.d .*.cmd LIBTHERMAL-CFLAGS $(LIBTHERMAL_PC) \ + $(srctree)/tools/$(THERMAL_UAPI) $(LIBTHERMAL_PC): $(QUIET_GEN)sed -e "s|@PREFIX@|$(prefix)|" \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/676 can: j1939: fix error in J1939 documentation.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Hölzl <[email protected]>
[ Upstream commit b6ec62e01aa4229bc9d3861d1073806767ea7838 ]
The description of PDU1 format usage mistakenly referred to PDU2 format.
--- Documentation/networking/j1939.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/networking/j1939.rst +1 -1
@@ -121,7 +121,7 @@ format, the Group Extension is set in the PS-field. On the other hand, when using PDU1 format, the PS-field contains a so-called Destination Address, which is _not_ part of the PGN. When communicating a PGN -from user space to kernel (or vice versa) and PDU2 format is used, the PS-field +from user space to kernel (or vice versa) and PDU1 format is used, the PS-field of the PGN shall be set to zero. The Destination Address shall be set elsewhere.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/676 platform/x86: thinkpad_acpi: Fix for ThinkPads with ECFW showing incorrect fan speed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Sankar <[email protected]>
[ Upstream commit 1be765b292577c752e0b87bf8c0e92aff6699d8e ]
Fix for Thinkpad's with ECFW showing incorrect fan speed. Some models use decimal instead of hexadecimal for the speed stored in the EC registers. For example the rpm register will have 0x4200 instead of 0x1068, here the actual RPM is "4200" in decimal.
Add a quirk to handle this.
--- drivers/platform/x86/thinkpad_acpi.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-)
drivers/platform/x86/thinkpad_acpi.c +25 -3
@@ -8013,6 +8013,7 @@ static u8 fan_control_resume_level;static int fan_watchdog_maxinterval;static bool fan_with_ns_addr; +static bool ecfw_with_fan_dec_rpm;static struct mutex fan_mutex;
@@ -8655,7 +8656,11 @@ static ssize_t fan_fan1_input_show(struct device *dev,if (res <0 )return res; -return sysfs_emit (buf,"%u\n" , speed); +/* Check for fan speeds displayed in hexadecimal */ +if (!ecfw_with_fan_dec_rpm) +return sysfs_emit (buf,"%u\n" , speed); +else +return sysfs_emit (buf,"%x\n" , speed); } static DEVICE_ATTR(fan1_input, S_IRUGO, fan_fan1_input_show, NULL);
@@ -8672,7 +8677,11 @@ static ssize_t fan_fan2_input_show(struct device *dev,if (res <0 )return res; -return sysfs_emit (buf,"%u\n" , speed); +/* Check for fan speeds displayed in hexadecimal */ +if (!ecfw_with_fan_dec_rpm) +return sysfs_emit (buf,"%u\n" , speed); +else +return sysfs_emit (buf,"%x\n" , speed); } static DEVICE_ATTR(fan2_input, S_IRUGO, fan_fan2_input_show, NULL);
@@ -8748,6 +8757,7 @@ static const struct attribute_group fan_driver_attr_group = {#define TPACPI_FAN_2CTL 0x0004/* selects fan2 control */ #define TPACPI_FAN_NOFAN 0x0008/* no fan available */ #define TPACPI_FAN_NS 0x0010/* For EC with non-Standard register addresses */ +#define TPACPI_FAN_DECRPM 0x0020/* For ECFW's with RPM in register as decimal */ static const struct tpacpi_quirk fan_quirk_table[]__initconst = {TPACPI_QEC_IBM ('1' ,'Y' ,TPACPI_FAN_Q1 ),
@@ -8769,6 +8779,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = {TPACPI_Q_LNV3 ('R' ,'1' ,'F' ,TPACPI_FAN_NS ),/* L13 Yoga Gen 2 */ TPACPI_Q_LNV3 ('N' ,'2' ,'U' ,TPACPI_FAN_NS ),/* X13 Yoga Gen 2*/ TPACPI_Q_LNV3 ('N' ,'1' ,'O' ,TPACPI_FAN_NOFAN ),/* X1 Tablet (2nd gen) */ + TPACPI_Q_LNV3('R', '0', 'Q', TPACPI_FAN_DECRPM),/* L480 */ };static int __init fan_init (struct ibm_init_struct *iibm)
@@ -8809,6 +8820,13 @@ static int __init fan_init(struct ibm_init_struct *iibm) tp_features.fan_ctrl_status_undef =1 ; } +/* Check for the EC/BIOS with RPM reported in decimal*/ +if (quirks &TPACPI_FAN_DECRPM ) { +pr_info ("ECFW with fan RPM as decimal in EC register\n" ); + ecfw_with_fan_dec_rpm =1 ; + tp_features.fan_ctrl_status_undef =1 ; + } +if (gfan_handle) {/* 570, 600e/x, 770e, 770x */ fan_status_access_mode =TPACPI_FAN_RD_ACPI_GFAN ;
@@ -9020,7 +9038,11 @@ static int fan_read(struct seq_file *m)if (rc <0 )return rc; -seq_printf (m,"speed:\t\t%d\n" , speed); +/* Check for fan speeds displayed in hexadecimal */ +if (!ecfw_with_fan_dec_rpm) +seq_printf (m,"speed:\t\t%d\n" , speed); +else +seq_printf (m,"speed:\t\t%x\n" , speed);if (fan_status_access_mode ==TPACPI_FAN_RD_TPEC_NS ) {/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/676 ASoC: amd: yc: Support dmic on another model of Lenovo Thinkpad E14 Gen 6
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Petri <[email protected]>
[ Upstream commit 8c21e40e1e481f7fef6e570089e317068b972c45 ]
Another model of Thinkpad E14 Gen 6 (21M4)
needs a quirk entry for the dmic to be detected.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -227,6 +227,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "21M3"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "21M4"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/676 ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Yifan <[email protected]>
[ Upstream commit 63c1c87993e0e5bb11bced3d8224446a2bc62338 ]
This patch checks if div is less than or equal to zero (div <= 0). If div is zero or negative, the function returns -EINVAL, ensuring the division operation (*prate / div) is safe to perform.
--- sound/soc/stm/stm32_sai_sub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/stm/stm32_sai_sub.c +2 -2
@@ -378,8 +378,8 @@ static long stm32_sai_mclk_round_rate(struct clk_hw *hw, unsigned long rate,int div; div =stm32_sai_get_clk_div (sai, *prate, rate); -if (div <0 ) -return div; +if (div <=0 ) +return -EINVAL ; mclk->freq = *prate / div;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/676 ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Yifan <[email protected]>
[ Upstream commit 23569c8b314925bdb70dd1a7b63cfe6100868315 ]
This patch checks if div is less than or equal to zero (div <= 0). If div is zero or negative, the function returns -EINVAL, ensuring the division operation is safe to perform.
--- sound/soc/stm/stm32_sai_sub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/stm/stm32_sai_sub.c +1 -1
@@ -317,7 +317,7 @@ static int stm32_sai_get_clk_div(struct stm32_sai_sub_data *sai,int div; div =DIV_ROUND_CLOSEST (input_rate, output_rate); -if (div >SAI_XCR1_MCKDIV_MAX (version)) { +if (div >SAI_XCR1_MCKDIV_MAX (version) || div <=0 ) {dev_err (&sai->pdev->dev,"Divider %d out of range\n" , div);return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/676 drm: panel-orientation-quirks: Make Lenovo Yoga Tab 3 X90F DMI match less strict
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 052ef642bd6c108a24f375f9ad174b97b425a50b ]
There are 2G and 4G RAM versions of the Lenovo Yoga Tab 3 X90F and it turns out that the 2G version has a DMI product name of "CHERRYVIEW D1 PLATFORM" where as the 4G version has "CHERRYVIEW C0 PLATFORM". The sys-vendor + product-version check are unique enough that the product-name check is not necessary.
Drop the product-name check so that the existing DMI match for the 4G RAM version also matches the 2G RAM version.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/drm_panel_orientation_quirks.c +0 -1
@@ -403,7 +403,6 @@ static const struct dmi_system_id orientation_data[] = { }, { /* Lenovo Yoga Tab 3 X90F */ .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Intel Corporation" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"CHERRYVIEW D1 PLATFORM" ), DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"), }, .driver_data = (void *)&lcd1600x2560_rightside_up,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/676 proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wang <[email protected]>
[ Upstream commit 84b9749a3a704dcc824a88aa8267247c801d51e4 ]
seq_printf is costy, on a system with n CPUs, reading /proc/softirqs would yield 10*n decimal values, and the extra cost parsing format string grows linearly with number of cpus. Replace seq_printf with seq_put_decimal_ull_width have significant performance improvement. On an 8CPUs system, reading /proc/softirqs show ~40% performance gain with this patch.
--- fs/proc/softirqs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/proc/softirqs.c +1 -1
@@ -20,7 +20,7 @@ static int show_softirqs(struct seq_file *p, void *v)for (i =0 ; i <NR_SOFTIRQS ; i++) {seq_printf (p,"%12s:" , softirq_to_name[i]);for_each_possible_cpu (j) -seq_printf (p," %10u" ,kstat_softirqs_cpu (i, j)); +seq_put_decimal_ull_width (p," " ,kstat_softirqs_cpu (i, j),10 );seq_putc (p,'\n' ); }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/676 ASoC: audio-graph-card2: Purge absent supplies for device tree nodes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Watts <[email protected]>
[ Upstream commit f8da001ae7af0abd9f6250c02c01a1121074ca60 ]
The audio graph card doesn't mark its subnodes such as multi {}, dpcm {} and c2c {} as not requiring any suppliers. This causes a hang as Linux waits for these phantom suppliers to show up on boot.
Make it clear these nodes have no suppliers.
Example error message:
[ 15.208558] platform 2034000.i2s: deferred probe pending: platform: wait for supplier /sound/multi [ 15.208584] platform sound: deferred probe pending: asoc-audio-graph-card2: parse error
--- sound/soc/generic/audio-graph-card2.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/generic/audio-graph-card2.c +3 -0
@@ -261,16 +261,19 @@ static enum graph_type __graph_get_type(struct device_node *lnk)if (of_node_name_eq (np,GRAPH_NODENAME_MULTI )) { ret =GRAPH_MULTI ; +fw_devlink_purge_absent_suppliers (&np->fwnode); goto out_put; }if (of_node_name_eq (np,GRAPH_NODENAME_DPCM )) { ret =GRAPH_DPCM ; +fw_devlink_purge_absent_suppliers (&np->fwnode); goto out_put; }if (of_node_name_eq (np,GRAPH_NODENAME_C2C )) { ret =GRAPH_C2C ; +fw_devlink_purge_absent_suppliers (&np->fwnode); goto out_put; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/676 LoongArch: Define a default value for VM_DATA_DEFAULT_FLAGS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuli Wang <[email protected]>
[ Upstream commit c859900a841b0a6cd9a73d16426465e44cdde29c ]
This is a trivial cleanup, commit c62da0c35d58518d ("mm/vma: define a default value for VM_DATA_DEFAULT_FLAGS") has unified default values of VM_DATA_DEFAULT_FLAGS across different platforms.
Apply the same consistency to LoongArch.
--- arch/loongarch/include/asm/page.h | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
arch/loongarch/include/asm/page.h +1 -4
@@ -94,10 +94,7 @@ typedef struct { unsigned long pgprot; } pgprot_t;extern int __virt_addr_valid (volatile void *kaddr);#define virt_addr_valid (kaddr) __virt_addr_valid((volatile void *)(kaddr)) -#define VM_DATA_DEFAULT_FLAGS \ - (VM_READ | VM_WRITE | \ - ((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \ - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) +#define VM_DATA_DEFAULT_FLAGS VM_DATA_FLAGS_TSK_EXEC#include <asm-generic/memory_model.h> #include <asm-generic/getorder.h>
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/676 ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eryk Zagorski <[email protected]>
[ Upstream commit 6f891ca15b017707840c9e7f5afd9fc6cfd7d8b1 ]
This patch switches the P-125 quirk entry to use a composite quirk as the P-125 supplies both MIDI and Audio like many of the other Yamaha keyboards
--- sound/usb/quirks-table.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
sound/usb/quirks-table.h +13 -1
@@ -324,7 +324,6 @@ YAMAHA_DEVICE(0x105a, NULL),YAMAHA_DEVICE (0x105b ,NULL ),YAMAHA_DEVICE (0x105c ,NULL ),YAMAHA_DEVICE (0x105d ,NULL ), -YAMAHA_DEVICE (0x1718 ,"P-125" ), {USB_DEVICE (0x0499 ,0x1503 ), QUIRK_DRIVER_INFO {
@@ -391,6 +390,19 @@ YAMAHA_DEVICE(0x1718, "P-125"), } } }, +{ +USB_DEVICE (0x0499 ,0x1718 ), + QUIRK_DRIVER_INFO { +/* .vendor_name = "Yamaha", */ +/* .product_name = "P-125", */ + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END + } + } +},YAMAHA_DEVICE (0x2000 ,"DGP-7" ),YAMAHA_DEVICE (0x2001 ,"DGP-5" ), YAMAHA_DEVICE(0x2002, NULL),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/676 ARM: 9420/1: smp: Fix SMP for xip kernels
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harith G <[email protected]>
[ Upstream commit 9e9b0cf9319b4db143014477b0bc4b39894248f1 ]
Fix the physical address calculation of the following to get smp working on xip kernels.
- secondary_data needed for secondary cpu bootup.
- secondary_startup address passed through psci.
- identity mapped code region needed for enabling mmu for secondary cpus.
--- arch/arm/kernel/head.S | 4 ++++ arch/arm/kernel/psci_smp.c | 7 +++++++ arch/arm/mm/idmap.c | 7 +++++++ 3 files changed, 18 insertions(+)
arch/arm/kernel/head.S +4 -0
@@ -411,7 +411,11 @@ ENTRY(secondary_startup) /* * Use the page tables supplied from __cpu_up. */ +#ifdef CONFIG_XIP_KERNEL + ldr r3, =(secondary_data + PLAT_PHYS_OFFSET - PAGE_OFFSET) +#else adr_l r3, secondary_data +#endif mov_l r12, __secondary_switched ldrd r4, r5, [r3, #0] @ get secondary_data.pgdir ARM_BE8(eor r4, r4, r5) @ Swap r5 and r4 in BE:
arch/arm/kernel/psci_smp.c +7 -0
@@ -45,8 +45,15 @@ extern void secondary_startup(void);static int psci_boot_secondary (unsigned int cpu,struct task_struct *idle) { if (psci_ops.cpu_on) +#ifdef CONFIG_XIP_KERNEL +return psci_ops.cpu_on (cpu_logical_map (cpu), + ((phys_addr_t)(&secondary_startup) + -XIP_VIRT_ADDR (CONFIG_XIP_PHYS_ADDR ) + +CONFIG_XIP_PHYS_ADDR )); +#else return psci_ops.cpu_on (cpu_logical_map (cpu),virt_to_idmap (&secondary_startup)); +#endif return -ENODEV ; }
arch/arm/mm/idmap.c +7 -0
@@ -84,8 +84,15 @@ static void identity_mapping_add(pgd_t *pgd, const char *text_start,unsigned long addr, end;unsigned long next; +#ifdef CONFIG_XIP_KERNEL + addr = (phys_addr_t)(text_start) -XIP_VIRT_ADDR (CONFIG_XIP_PHYS_ADDR ) + +CONFIG_XIP_PHYS_ADDR ; + end = (phys_addr_t)(text_end) -XIP_VIRT_ADDR (CONFIG_XIP_PHYS_ADDR ) + +CONFIG_XIP_PHYS_ADDR ; +#else addr =virt_to_idmap (text_start); end =virt_to_idmap (text_end); +#endif pr_info ("Setting up static identity map for 0x%lx - 0x%lx\n" , addr, end); prot |=PMD_TYPE_SECT |PMD_SECT_AP_WRITE |PMD_SECT_AF ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/676 ipmr: Fix access to mfc_cache_list without lock held
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit e28acc9c1ccfcb24c08e020828f69d0a915b06ae ]
Accessing mr_table->mfc_cache_list is protected by an RCU lock. In the following code flow, the RCU read lock is not held, causing the following error when RCU_PROVE is not held. The same problem might show up in the IPv6 code path.
6.12.0-rc5-kbuilder-01145-gbac17284bdcb #33 Tainted: G E N
-----------------------------
net/ipv4/ipmr_base.c:313 RCU-list traversed in non-reader section!!
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by RetransmitAggre/3519:
#0: ffff88816188c6c0 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: __netlink_dump_start+0x8a/0x290
#1: ffffffff83fcf7a8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_dumpit+0x6b/0x90
stack backtrace:
lockdep_rcu_suspicious
mr_table_dump
ipmr_rtm_dumproute
rtnl_dump_all
rtnl_dumpit
netlink_dump
__netlink_dump_start
rtnetlink_rcv_msg
netlink_rcv_skb
netlink_unicast
netlink_sendmsgThis is not a problem per see, since the RTNL lock is held here, so, it is safe to iterate in the list without the RCU read lock, as suggested by Eric.
To alleviate the concern, modify the code to use list_for_each_entry_rcu() with the RTNL-held argument.
The annotation will raise an error only if RTNL or RCU read lock are missing during iteration, signaling a legitimate problem, otherwise it will avoid this false positive.
This will solve the IPv6 case as well, since ip6mr_rtm_dumproute() calls this function as well.
--- net/ipv4/ipmr_base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/ipmr_base.c +2 -1
@@ -310,7 +310,8 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb,if (filter->filter_set) flags |=NLM_F_DUMP_FILTERED ; -list_for_each_entry_rcu (mfc, &mrt->mfc_cache_list, list) { +list_for_each_entry_rcu (mfc, &mrt->mfc_cache_list, list, +lockdep_rtnl_is_held ()) {if (e < s_e) goto next_entry; if (filter->dev &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/676 i2c: lpi2c: Avoid calling clk_get_rate during transfer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 4268254a39484fc11ba991ae148bacbe75d9cc0a ]
Instead of repeatedly calling clk_get_rate for each transfer, lock the clock rate and cache the value.
A deadlock has been observed while adding tlv320aic32x4 audio codec to the system. When this clock provider adds its clock, the clk mutex is locked already, it needs to access i2c, which in return needs the mutex for clk_get_rate as well.
--- drivers/i2c/busses/i2c-imx-lpi2c.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-imx-lpi2c.c +7 -3
@@ -99,6 +99,7 @@ struct lpi2c_imx_struct {__u8 *rx_buf;__u8 *tx_buf;struct completion complete; +unsigned long rate_per;unsigned int msglen;unsigned int delivered;unsigned int block_data;
@@ -207,9 +208,7 @@ static int lpi2c_imx_config(struct lpi2c_imx_struct *lpi2c_imx)lpi2c_imx_set_mode (lpi2c_imx); - clk_rate =clk_get_rate (lpi2c_imx->clks[0 ].clk); -if (!clk_rate) -return -EINVAL ; + clk_rate = lpi2c_imx->rate_per;if (lpi2c_imx->mode ==HS || lpi2c_imx->mode ==ULTRA_FAST ) filt =0 ;
@@ -590,6 +589,11 @@ static int lpi2c_imx_probe(struct platform_device *pdev)if (ret)return ret; + lpi2c_imx->rate_per =clk_get_rate (lpi2c_imx->clks[0 ].clk); +if (!lpi2c_imx->rate_per) +return dev_err_probe (&pdev->dev, -EINVAL , +"can't get I2C peripheral clock rate\n" ); +pm_runtime_set_autosuspend_delay (&pdev->dev,I2C_PM_TIMEOUT );pm_runtime_use_autosuspend (&pdev->dev);pm_runtime_get_noresume (&pdev->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/676 s390/pkey: Wipe copies of clear-key structures on failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Holger Dengler <[email protected]>
[ Upstream commit d65d76a44ffe74c73298ada25b0f578680576073 ]
Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key.
--- drivers/s390/crypto/pkey_api.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/s390/crypto/pkey_api.c +9 -7
@@ -1366,9 +1366,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc =cca_clr2seckey (kcs.cardnr, kcs.domain, kcs.keytype, kcs.clrkey.clrkey, kcs.seckey.seckey);DEBUG_DBG ("%s cca_clr2seckey()=%d\n" , __func__, rc); -if (rc) -break ; -if (copy_to_user (ucs, &kcs,sizeof (kcs))) +if (!rc &©_to_user (ucs, &kcs,sizeof (kcs))) rc = -EFAULT ;memzero_explicit (&kcs,sizeof (kcs));break ;
@@ -1401,9 +1399,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, kcp.protkey.protkey, &kcp.protkey.len, &kcp.protkey.type);DEBUG_DBG ("%s pkey_clr2protkey()=%d\n" , __func__, rc); -if (rc) -break ; -if (copy_to_user (ucp, &kcp,sizeof (kcp))) +if (!rc &©_to_user (ucp, &kcp,sizeof (kcp))) rc = -EFAULT ;memzero_explicit (&kcp,sizeof (kcp));break ;
@@ -1555,11 +1551,14 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,if (copy_from_user (&kcs, ucs,sizeof (kcs)))return -EFAULT ; apqns =_copy_apqns_from_user (kcs.apqns, kcs.apqn_entries); -if (IS_ERR (apqns)) +if (IS_ERR (apqns)) { +memzero_explicit (&kcs,sizeof (kcs));return PTR_ERR (apqns); + } kkey =kzalloc (klen,GFP_KERNEL );if (!kkey) {kfree (apqns); +memzero_explicit (&kcs,sizeof (kcs));return -ENOMEM ; } rc = pkey_clr2seckey2(apqns, kcs.apqn_entries,
@@ -1569,15 +1568,18 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,kfree (apqns);if (rc) {kfree (kkey); +memzero_explicit (&kcs,sizeof (kcs));break ; }if (kcs.key) {if (kcs.keylen < klen) {kfree (kkey); +memzero_explicit (&kcs,sizeof (kcs));return -EINVAL ; }if (copy_to_user (kcs.key, kkey, klen)) {kfree (kkey); +memzero_explicit (&kcs,sizeof (kcs));return -EFAULT ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/676 serial: sc16is7xx: fix invalid FIFO access with special register set
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
[ Upstream commit 7d3b793faaab1305994ce568b59d61927235f57b ]
When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading.
Call graph example:
sc16is7xx_startup(): entry
sc16is7xx_ms_proc(): entry
sc16is7xx_set_termios(): entry
sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set
sc16is7xx_port_irq() entry --> IIR is 0x0C
sc16is7xx_handle_rx() entry
sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is
mapped to DLL (LCR=LCR_CONF_MODE_A)
sc16is7xx_set_baud(): exit --> Restore access to general register setFix the problem by claiming the efr_lock mutex when accessing the Special register set.
--- drivers/tty/serial/sc16is7xx.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/tty/serial/sc16is7xx.c +4 -0
@@ -545,6 +545,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)SC16IS7XX_MCR_CLKSEL_BIT , prescaler == 1 ? 0 : SC16IS7XX_MCR_CLKSEL_BIT); +mutex_lock (&one->efr_lock); +/* Open the LCR divisors for configuration */ sc16is7xx_port_write (port,SC16IS7XX_LCR_REG ,SC16IS7XX_LCR_CONF_MODE_A );
@@ -558,6 +560,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)/* Put LCR back to the normal mode */ sc16is7xx_port_write (port,SC16IS7XX_LCR_REG , lcr); +mutex_unlock (&one->efr_lock); +return DIV_ROUND_CLOSEST ((clk / prescaler) /16 , div); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/676 x86/stackprotector: Work around strict Clang TLS symbol requirements
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
[ Upstream commit 577c134d311b9b94598d7a0c86be1f431f823003 ]
GCC and Clang both implement stack protector support based on Thread Local Storage (TLS) variables, and this is used in the kernel to implement per-task stack cookies, by copying a task's stack cookie into a per-CPU variable every time it is scheduled in.
Both now also implement -mstack-protector-guard-symbol=, which permits the TLS variable to be specified directly. This is useful because it will allow to move away from using a fixed offset of 40 bytes into the per-CPU area on x86_64, which requires a lot of special handling in the per-CPU code and the runtime relocation code.
However, while GCC is rather lax in its implementation of this command line option, Clang actually requires that the provided symbol name refers to a TLS variable (i.e., one declared with __thread), although it also permits the variable to be undeclared entirely, in which case it will use an implicit declaration of the right type.
The upshot of this is that Clang will emit the correct references to the stack cookie variable in most cases, e.g.,
10d: 64 a1 00 00 00 00 mov %fs:0x0,%eax
10f: R_386_32 __stack_chk_guard
However, if a non-TLS definition of the symbol in question is visible in the same compilation unit (which amounts to the whole of vmlinux if LTO is enabled), it will drop the per-CPU prefix and emit a load from a bogus address.
Work around this by using a symbol name that never occurs in C code, and emit it as an alias in the linker script.
--- arch/x86/Makefile | 3 ++- arch/x86/entry/entry.S | 15 +++++++++++++++ arch/x86/include/asm/asm-prototypes.h | 3 +++ arch/x86/kernel/cpu/common.c | 2 ++ arch/x86/kernel/vmlinux.lds.S | 3 +++ 5 files changed, 25 insertions(+), 1 deletion(-)
arch/x86/Makefile +2 -1
@@ -113,7 +113,8 @@ ifeq ($(CONFIG_X86_32),y) ifeq ($(CONFIG_STACKPROTECTOR),y) ifeq ($(CONFIG_SMP),y) - KBUILD_CFLAGS += -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard + KBUILD_CFLAGS += -mstack-protector-guard-reg=fs \ + -mstack-protector-guard-symbol=__ref_stack_chk_guard else KBUILD_CFLAGS += -mstack-protector-guard=global endif
arch/x86/entry/entry.S +15 -0
@@ -48,3 +48,18 @@ EXPORT_SYMBOL_GPL(mds_verw_sel); .popsection +#ifndef CONFIG_X86_64 +/* + * Clang's implementation of TLS stack cookies requires the variable in + * question to be a TLS variable. If the variable happens to be defined as an + * ordinary variable with external linkage in the same compilation unit (which + * amounts to the whole of vmlinux with LTO enabled), Clang will drop the + * segment register prefix from the references, resulting in broken code. Work + * around this by avoiding the symbol used in -mstack-protector-guard-symbol= + * entirely in the C code, and use an alias emitted by the linker script + * instead. + */ +#ifdef CONFIG_STACKPROTECTOR +EXPORT_SYMBOL(__ref_stack_chk_guard); +#endif +#endif
arch/x86/include/asm/asm-prototypes.h +3 -0
@@ -19,3 +19,6 @@extern void cmpxchg8b_emu (void );#endif +#if defined(__GENKSYMS__) && defined(CONFIG_STACKPROTECTOR ) +extern unsigned long __ref_stack_chk_guard; +#endif
arch/x86/kernel/cpu/common.c +2 -0
@@ -2159,8 +2159,10 @@ void syscall_init(void)#ifdef CONFIG_STACKPROTECTOR DEFINE_PER_CPU(unsigned long, __stack_chk_guard); +#ifndef CONFIG_SMP EXPORT_PER_CPU_SYMBOL (__stack_chk_guard);#endif +#endif #endif /* CONFIG_X86_64 */
arch/x86/kernel/vmlinux.lds.S +3 -0
@@ -496,6 +496,9 @@ SECTIONS ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") } +/* needed for Clang - see arch/x86/entry/entry.S */ +PROVIDE(__ref_stack_chk_guard = __stack_chk_guard); + /* * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility: */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/676 drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 28574b08c70e56d34d6f6379326a860b96749051 ]
This commit adds a null check for the set_output_gamma function pointer in the dcn32_set_output_transfer_func function. Previously, set_output_gamma was being checked for null, but then it was being dereferenced without any null check. This could lead to a null pointer dereference if set_output_gamma is null.
To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma.
--- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +3 -1
@@ -587,7 +587,9 @@ bool dcn32_set_output_transfer_func(struct dc *dc, } } - mpc->funcs->set_output_gamma (mpc, mpcc_id, params); +if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma (mpc, mpcc_id, params); +return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/676 drm/amd/display: Initialize denominators default to 1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit b995c0a6de6c74656a0c39cd57a0626351b13e3c ]
[WHAT & HOW]
Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0.
This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.
[Xiangyu: Bp to fix CVE: CVE-2024-49899
Discard the dml2_core/dml2_core_shared.c due to this file no exists]
--- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 2 +- drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c +1 -1
@@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib,static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c +1 -1
@@ -39,7 +39,7 @@static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/676 fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit 7f7b850689ac06a62befe26e1fd1806799e7f152 ]
It's observed that a crash occurs during hot-remove a memory device, in which user is accessing the hugetlb. See calltrace as following:
------------[ cut here ]------------ WARNING: CPU: 1 PID: 14045 at arch/x86/mm/fault.c:1278 do_user_addr_fault+0x2a0/0x790 Modules linked in: kmem device_dax cxl_mem cxl_pmem cxl_port cxl_pci dax_hmem dax_pmem nd_pmem cxl_acpi nd_btt cxl_core crc32c_intel nvme virtiofs fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc s mirror dm_region_hash dm_log dm_mod CPU: 1 PID: 14045 Comm: daxctl Not tainted 6.10.0-rc2-lizhijian+ #492 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:do_user_addr_fault+0x2a0/0x790 Code: 48 8b 00 a8 04 0f 84 b5 fe ff ff e9 1c ff ff ff 4c 89 e9 4c 89 e2 be 01 00 00 00 bf 02 00 00 00 e8 b5 ef 24 00 e9 42 fe ff ff <0f> 0b 48 83 c4 08 4c 89 ea 48 89 ee 4c 89 e7 5b 5d 41 5c 41 5d 41 RSP: 0000:ffffc90000a575f0 EFLAGS: 00010046 RAX: ffff88800c303600 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000001000 RSI: ffffffff82504162 RDI: ffffffff824b2c36 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000a57658 R13: 0000000000001000 R14: ffff88800bc2e040 R15: 0000000000000000 FS: 00007f51cb57d880(0000) GS:ffff88807fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000001000 CR3: 00000000072e2004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x8d/0x190 ? do_user_addr_fault+0x2a0/0x790 ? report_bug+0x1c3/0x1d0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? do_user_addr_fault+0x2a0/0x790 ? exc_page_fault+0x31/0x200 exc_page_fault+0x68/0x200 <...snip...> BUG: unable to handle page fault for address: 0000000000001000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI ---[ end trace 0000000000000000 ]--- BUG: unable to handle page fault for address: 0000000000001000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 14045 Comm: daxctl Kdump: loaded Tainted: G W 6.10.0-rc2-lizhijian+ #492 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:dentry_name+0x1f4/0x440 <...snip...> ? dentry_name+0x2fa/0x440 vsnprintf+0x1f3/0x4f0 vprintk_store+0x23a/0x540 vprintk_emit+0x6d/0x330 _printk+0x58/0x80 dump_mapping+0x10b/0x1a0 ? __pfx_free_object_rcu+0x10/0x10 __dump_page+0x26b/0x3e0 ? vprintk_emit+0xe0/0x330 ? _printk+0x58/0x80 ? dump_page+0x17/0x50 dump_page+0x17/0x50 do_migrate_range+0x2f7/0x7f0 ? do_migrate_range+0x42/0x7f0 ? offline_pages+0x2f4/0x8c0 offline_pages+0x60a/0x8c0 memory_subsys_offline+0x9f/0x1c0 ? lockdep_hardirqs_on+0x77/0x100 ? _raw_spin_unlock_irqrestore+0x38/0x60 device_offline+0xe3/0x110 state_store+0x6e/0xc0 kernfs_fop_write_iter+0x143/0x200 vfs_write+0x39f/0x560 ksys_write+0x65/0xf0 do_syscall_64+0x62/0x130
Previously, some sanity check have been done in dump_mapping() before the print facility parsing '%pd' though, it's still possible to run into an invalid dentry.d_name.name.
Since dump_mapping() only needs to dump the filename only, retrieve it by itself in a safer way to prevent an unnecessary crash.
Note that either retrieving the filename with '%pd' or strncpy_from_kernel_nofault(), the filename could be unreliable.
[Xiangyu: Bp to fix CVE: CVE-2024-49934, modified strscpy step due to 6.1/6.6 need pass the max len to strscpy]
--- fs/inode.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/inode.c +7 -3
@@ -593,6 +593,7 @@ void dump_mapping(const struct address_space *mapping)struct hlist_node *dentry_first;struct dentry *dentry_ptr;struct dentry dentry; +char fname[64 ] = {};unsigned long ino;/*
@@ -628,11 +629,14 @@ void dump_mapping(const struct address_space *mapping)return ; } +if (strncpy_from_kernel_nofault (fname, dentry.d_name.name,63 ) <0 ) +strscpy (fname,"<invalid>" ,63 );/* -* if dentry is corrupted, the %pd handler may still crash, -* but it's unlikely that we reach here with a corrupt mapping +* Even if strncpy_from_kernel_nofault() succeeded, +* the fname could be unreliable */ -pr_warn ("aops:%ps ino:%lx dentry name:\"%pd\"\n" , a_ops, ino, &dentry); +pr_warn ("aops:%ps ino:%lx dentry name(?):\"%s\"\n" , + a_ops, ino, fname); }void clear_inode (struct inode *inode)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/676 drm/amd/display: Check null-initialized variables
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 367cd9ceba1933b63bc1d87d967baf6d9fd241d2 ]
[WHAT & HOW]drr_timing and subvp_pipe are initialized to null and they are not always assigned new values. It is necessary to check for null before dereferencing.
This fixes 2 FORWARD_NULL issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +4 -3
@@ -932,8 +932,9 @@ static bool subvp_drr_schedulable(struct dc *dc, struct dc_state *context)* for VBLANK: (VACTIVE region of the SubVP pipe can fit the MALL prefetch, VBLANK frame time, * and the max of (VBLANK blanking time, MALL region)). */ -if (stretched_drr_us < (1 / (double )drr_timing->min_refresh_in_uhz) *1000000 *1000000 && - subvp_active_us - prefetch_us - stretched_drr_us - max_vblank_mallregion >0 ) +if (drr_timing && + stretched_drr_us < (1 / (double )drr_timing->min_refresh_in_uhz) *1000000 *1000000 && + subvp_active_us - prefetch_us - stretched_drr_us - max_vblank_mallregion >0 ) schedulable = true;return schedulable;
@@ -995,7 +996,7 @@ static bool subvp_vblank_schedulable(struct dc *dc, struct dc_state *context)if (!subvp_pipe && pipe->stream->mall_stream_config.type ==SUBVP_MAIN ) subvp_pipe = pipe; } -if (found) { +if (found && subvp_pipe) { main_timing = &subvp_pipe->stream->timing; phantom_timing = &subvp_pipe->stream->mall_stream_config.paired_stream->timing; vblank_timing = &context->res_ctx.pipe_ctx[vblank_index].stream->timing;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/676 drm/amd/display: Dont refer to dc_sink in is_dsc_need_re_compute
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
[ Upstream commit fcf6a49d79923a234844b8efe830a61f3f0584e4 ]
[Why]
When unplug one of monitors connected after mst hub, encounter null pointer dereference.
It's due to dc_sink get released immediately in early_unregister() or detect_ctx(). When commit new state which directly referring to info stored in dc_sink will cause null pointer dereference.
[how]
Remove redundant checking condition. Relevant condition should already be covered by checking if dsc_aux is null or not. Also reset dsc_aux to NULL when the connector is disconnected.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +4 -0
@@ -179,6 +179,8 @@ amdgpu_dm_mst_connector_early_unregister(struct drm_connector *connector)dc_sink_release (dc_sink); aconnector->dc_sink =NULL ; aconnector->edid =NULL ; + aconnector->dsc_aux =NULL ; + port->passthrough_aux =NULL ; } aconnector->mst_status =MST_STATUS_DEFAULT ;
@@ -487,6 +489,8 @@ dm_dp_mst_detect(struct drm_connector *connector,dc_sink_release (aconnector->dc_sink); aconnector->dc_sink =NULL ; aconnector->edid =NULL ; + aconnector->dsc_aux =NULL ; + port->passthrough_aux =NULL ; amdgpu_dm_set_mst_status(&aconnector->mst_status, MST_REMOTE_EDID | MST_ALLOCATE_NEW_PAYLOAD | MST_CLEAR_ALLOCATED_PAYLOAD,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/676 fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[ Upstream commit 7601df8031fd67310af891897ef6cc0df4209305 ]
lock_task_sighand() can trigger a hard lockup. If NR_CPUS threads call do_task_stat() at the same time and the process has NR_THREADS, it will spin with irqs disabled O(NR_CPUS * NR_THREADS) time.
Change do_task_stat() to use sig->stats_lock to gather the statistics outside of ->siglock protected section, in the likely case this code will run lockless.
--- fs/proc/array.c | 57 +++++++++++++++++++++++++++---------------------- 1 file changed, 32 insertions(+), 25 deletions(-)
fs/proc/array.c +32 -25
@@ -477,13 +477,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,int permitted;struct mm_struct *mm;unsigned long long start_time; -unsigned long cmin_flt =0 , cmaj_flt =0 ; -unsigned long min_flt =0 , maj_flt =0 ; -u64 cutime, cstime, utime, stime; -u64 cgtime, gtime; +unsigned long cmin_flt, cmaj_flt, min_flt, maj_flt; +u64 cutime, cstime, cgtime, utime, stime, gtime;unsigned long rsslim =0 ;unsigned long flags;int exit_code = task->exit_code; +struct signal_struct *sig = task->signal; +unsigned int seq =1 ; state = *get_task_state (task); vsize = eip = esp =0 ;
@@ -511,12 +511,8 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,sigemptyset (&sigign);sigemptyset (&sigcatch); - cutime = cstime =0 ; - cgtime = gtime =0 ;if (lock_task_sighand (task, &flags)) { -struct signal_struct *sig = task->signal; -if (sig->tty) {struct pid *pgrp =tty_get_pgrp (sig->tty); tty_pgrp =pid_nr_ns (pgrp, ns);
@@ -527,26 +523,9 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, num_threads =get_nr_threads (task);collect_sigign_sigcatch (task, &sigign, &sigcatch); - cmin_flt = sig->cmin_flt; - cmaj_flt = sig->cmaj_flt; - cutime = sig->cutime; - cstime = sig->cstime; - cgtime = sig->cgtime; rsslim =READ_ONCE (sig->rlim[RLIMIT_RSS ].rlim_cur); -/* add up live thread stats at the group level */ if (whole) { -struct task_struct *t = task; - do { - min_flt += t->min_flt; - maj_flt += t->maj_flt; - gtime += task_gtime(t); - } while_each_thread(task, t); - - min_flt += sig->min_flt; - maj_flt += sig->maj_flt; - gtime += sig->gtime; -if (sig->flags & (SIGNAL_GROUP_EXIT |SIGNAL_STOP_STOPPED )) exit_code = sig->group_exit_code; }
@@ -561,6 +540,34 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,if (permitted && (!whole || num_threads <2 )) wchan = !task_is_running (task); +do { + seq++;/* 2 on the 1st/lockless path, otherwise odd */ + flags =read_seqbegin_or_lock_irqsave (&sig->stats_lock, &seq); + + cmin_flt = sig->cmin_flt; + cmaj_flt = sig->cmaj_flt; + cutime = sig->cutime; + cstime = sig->cstime; + cgtime = sig->cgtime; + +if (whole) { +struct task_struct *t; + + min_flt = sig->min_flt; + maj_flt = sig->maj_flt; + gtime = sig->gtime; + +rcu_read_lock (); +__for_each_thread (sig, t) { + min_flt += t->min_flt; + maj_flt += t->maj_flt; + gtime +=task_gtime (t); + } +rcu_read_unlock (); + } + }while (need_seqretry (&sig->stats_lock, seq)); +done_seqretry_irqrestore (&sig->stats_lock, seq, flags); +if (whole) {thread_group_cputime_adjusted (task, &utime, &stime); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/676 nvme: apple: fix device reference counting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit b9ecbfa45516182cd062fecd286db7907ba84210 ]
Drivers must call nvme_uninit_ctrl after a successful nvme_init_ctrl. Split the allocation side out to make the error handling boundary easier to navigate. The apple driver had been doing this wrong, leaking the controller device memory on a tagset failure.
--- drivers/nvme/host/apple.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
drivers/nvme/host/apple.c +22 -5
@@ -1387,7 +1387,7 @@ static void devm_apple_nvme_mempool_destroy(void *data)mempool_destroy (data); } -static int apple_nvme_probe (struct platform_device *pdev) +static struct apple_nvme *apple_nvme_alloc (struct platform_device *pdev) {struct device *dev = &pdev->dev;struct apple_nvme *anv;
@@ -1395,7 +1395,7 @@ static int apple_nvme_probe(struct platform_device *pdev) anv =devm_kzalloc (dev,sizeof (*anv),GFP_KERNEL );if (!anv) -return -ENOMEM ; +return ERR_PTR (-ENOMEM ); anv->dev =get_device (dev); anv->adminq.is_adminq = true;
@@ -1515,10 +1515,26 @@ static int apple_nvme_probe(struct platform_device *pdev) goto put_dev; } +return anv; +put_dev: +put_device (anv->dev); +return ERR_PTR (ret); +} + +static int apple_nvme_probe (struct platform_device *pdev) +{ +struct apple_nvme *anv; +int ret; + + anv =apple_nvme_alloc (pdev); +if (IS_ERR (anv)) +return PTR_ERR (anv); + anv->ctrl.admin_q =blk_mq_init_queue (&anv->admin_tagset);if (IS_ERR (anv->ctrl.admin_q)) { ret = -ENOMEM ; - goto put_dev; + anv->ctrl.admin_q =NULL ; + goto out_uninit_ctrl; }nvme_reset_ctrl (&anv->ctrl);
@@ -1526,8 +1542,9 @@ static int apple_nvme_probe(struct platform_device *pdev)return 0 ; -put_dev: -put_device (anv->dev); +out_uninit_ctrl: +nvme_uninit_ctrl (&anv->ctrl); +nvme_put_ctrl (&anv->ctrl);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/676 platform/x86: x86-android-tablets: Unregister devices in reverse order
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 3de0f2627ef849735f155c1818247f58404dddfe ]
Not all subsystems support a device getting removed while there are still consumers of the device with a reference to the device.
One example of this is the regulator subsystem. If a regulator gets unregistered while there are still drivers holding a reference a WARN() at drivers/regulator/core.c:5829 triggers, e.g.:
WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015 RIP: 0010:regulator_unregister Call Trace: <TASK> regulator_unregister devres_release_group i2c_device_remove device_release_driver_internal bus_remove_device device_del device_unregister x86_android_tablet_remove
On the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides a 5V boost converter output for powering USB devices connected to the micro USB port, the bq24190-charger driver exports this as a Vbus regulator.
On the 830 (8") and 1050 ("10") models this regulator is controlled by a platform_device and x86_android_tablet_remove() removes platform_device-s before i2c_clients so the consumer gets removed first.
But on the 1380 (13") model there is a lc824206xa micro-USB switch connected over I2C and the extcon driver for that controls the regulator. The bq24190 i2c-client *must* be registered first, because that creates the regulator with the lc824206xa listed as its consumer. If the regulator has not been registered yet the lc824206xa driver will end up getting a dummy regulator.
Since in this case both the regulator provider and consumer are I2C devices, the only way to ensure that the consumer is unregistered first is to unregister the I2C devices in reverse order of in which they were created.
For consistency and to avoid similar problems in the future change x86_android_tablet_remove() to unregister all device types in reverse order.
--- drivers/platform/x86/x86-android-tablets/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/platform/x86/x86-android-tablets/core.c +3 -3
@@ -230,20 +230,20 @@ static void x86_android_tablet_remove(struct platform_device *pdev) {int i; -for (i =0 ; i < serdev_count; i++) { +for (i = serdev_count -1 ; i >=0 ; i--) {if (serdevs[i])serdev_device_remove (serdevs[i]); }kfree (serdevs); -for (i =0 ; i < pdev_count; i++) +for (i = pdev_count -1 ; i >=0 ; i--)platform_device_unregister (pdevs[i]);kfree (pdevs);kfree (buttons); -for (i =0 ; i < i2c_client_count; i++) +for (i = i2c_client_count -1 ; i >=0 ; i--)i2c_unregister_device (i2c_clients[i]);kfree (i2c_clients);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/676 drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 8e4ed3cf1642df0c4456443d865cff61a9598aa8 ]
This commit addresses a null pointer dereference issue in the dcn20_program_pipe function. The issue could occur when pipe_ctx->plane_state is null.
The fix adds a check to ensure pipe_ctx->plane_state is not null before accessing. This prevents a null pointer dereference.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() error: we previously assumed 'pipe_ctx->plane_state' could be null (see line 1877)
[Xiangyu: BP to fix CVE: CVE-2024-49914, modified the file path from drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c to drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_hwseq.c and minor conflict resolution]
--- .../drm/amd/display/dc/dcn20/dcn20_hwseq.c | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +14 -8
@@ -1732,17 +1732,22 @@ static void dcn20_program_pipe( dc->res_pool->hubbub->funcs->program_det_size ( dc->res_pool->hubbub, pipe_ctx->plane_res.hubp->inst, pipe_ctx->det_buffer_size_kb); -if (pipe_ctx->update_flags.raw || pipe_ctx->plane_state->update_flags.raw || pipe_ctx->stream->update_flags.raw) +if (pipe_ctx->update_flags.raw || + (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.raw) || + pipe_ctx->stream->update_flags.raw)dcn20_update_dchubp_dpp (dc, pipe_ctx, context); -if (pipe_ctx->update_flags.bits.enable - || pipe_ctx->plane_state->update_flags.bits.hdr_mult) +if (pipe_ctx->update_flags.bits.enable || + (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.hdr_mult)) hws->funcs.set_hdr_multiplier (pipe_ctx);if (pipe_ctx->update_flags.bits.enable || - pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change || - pipe_ctx->plane_state->update_flags.bits.gamma_change || - pipe_ctx->plane_state->update_flags.bits.lut_3d) + (pipe_ctx->plane_state && + pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change) || + (pipe_ctx->plane_state && + pipe_ctx->plane_state->update_flags.bits.gamma_change) || + (pipe_ctx->plane_state && + pipe_ctx->plane_state->update_flags.bits.lut_3d)) hws->funcs.set_input_transfer_func (dc, pipe_ctx, pipe_ctx->plane_state);/* dcn10_translate_regamma_to_hw_format takes 750us to finish
@@ -1752,7 +1757,8 @@ static void dcn20_program_pipe(if (pipe_ctx->update_flags.bits.enable || pipe_ctx->update_flags.bits.plane_changed || pipe_ctx->stream->update_flags.bits.out_tf || - pipe_ctx->plane_state->update_flags.bits.output_tf_change) + (pipe_ctx->plane_state && + pipe_ctx->plane_state->update_flags.bits.output_tf_change)) hws->funcs.set_output_transfer_func (dc, pipe_ctx, pipe_ctx->stream);/* If the pipe has been enabled or has a different opp, we
@@ -1776,7 +1782,7 @@ static void dcn20_program_pipe( }/* Set ABM pipe after other pipe configurations done */ -if (pipe_ctx->plane_state->visible) { +if ((pipe_ctx->plane_state && pipe_ctx->plane_state->visible)) {if (pipe_ctx->stream_res.abm) { dc->hwss.set_pipe (pipe_ctx); pipe_ctx->stream_res.abm->funcs->set_abm_level(pipe_ctx->stream_res.abm,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/676 mptcp: fix possible integer overflow in mptcp_reset_tout_timer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
commit b169e76ebad22cbd055101ee5aa1a7bed0e66606 upstream.
In 'mptcp_reset_tout_timer', promote 'probe_timestamp' to unsigned long to avoid possible integer overflow. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[ Conflict in this version because commit d866ae9aaa43 ("mptcp: add a
new sysctl for make after break timeout") is not in this version, and replaced TCP_TIMEWAIT_LEN in the expression. The fix can still be applied the same way: by forcing a cast to unsigned long for the first item. ]
--- net/mptcp/protocol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mptcp/protocol.c +2 -2
@@ -2691,8 +2691,8 @@ void mptcp_reset_tout_timer(struct mptcp_sock *msk, unsigned long fail_tout)if (!fail_tout && !inet_csk (sk)->icsk_mtup.probe_timestamp)return ; - close_timeout =inet_csk (sk)->icsk_mtup.probe_timestamp - tcp_jiffies32 + jiffies + -TCP_TIMEWAIT_LEN ; + close_timeout = (unsigned long )inet_csk (sk)->icsk_mtup.probe_timestamp - + tcp_jiffies32 + jiffies +TCP_TIMEWAIT_LEN ;/* the close timeout takes precedence on the fail one, and here at least one of * them is active
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/676 bpf: support non-r10 register spill/fill to/from stack in precision tracking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 41f6f64e6999a837048b1bd13a2f8742964eca6b ]
Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it *and* potentially adjusting offset.
To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don't touch idx field for maximum performance, as it's checked most frequently during backtracking.
This change removes basically the last remaining practical limitation of precision backtracking logic in BPF verifier. It fixes known deficiencies, but also opens up new opportunities to reduce number of verified states, explored in the subsequent patches.
There are only three differences in selftests' BPF object files according to veristat, all in the positive direction (less states).
File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF) -------------------------------------- ------------- --------- --------- ------------- ---------- ---------- ------------- test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%) xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%) xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%)
Note, I avoided renaming jmp_history to more generic insn_hist to minimize number of lines changed and potential merge conflicts between bpf and bpf-next trees.
Notice also cur_hist_entry pointer reset to NULL at the beginning of instruction verification loop. This pointer avoids the problem of relying on last jump history entry's insn_idx to determine whether we already have entry for current instruction or not. It can happen that we added jump history entry because current instruction is_jmp_point(), but also we need to add instruction flags for stack access. In this case, we don't want to entries, so we need to reuse last added entry, if it is present.
Relying on insn_idx comparison has the same ambiguity problem as the one that was fixed recently in [0], so we avoid that.
[0] https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/
--- include/linux/bpf_verifier.h | 31 +++- kernel/bpf/verifier.c | 175 ++++++++++-------- .../bpf/progs/verifier_subprog_precision.c | 23 ++- .../testing/selftests/bpf/verifier/precise.c | 38 ++-- 4 files changed, 169 insertions(+), 98 deletions(-)
include/linux/bpf_verifier.h +27 -4
@@ -319,12 +319,34 @@ struct bpf_func_state {struct bpf_stack_state *stack; }; -struct bpf_idx_pair { -u32 prev_idx; +#define MAX_CALL_FRAMES 8 + +/* instruction history flags, used in bpf_jmp_history_entry.flags field */ +enum { +/* instruction references stack slot through PTR_TO_STACK register; +* we also store stack's frame number in lower 3 bits (MAX_CALL_FRAMES is 8) +* and accessed stack slot's index in next 6 bits (MAX_BPF_STACK is 512, +* 8 bytes per slot, so slot index (spi) is [0, 63]) +*/ +INSN_F_FRAMENO_MASK =0x7 ,/* 3 bits */ + +INSN_F_SPI_MASK =0x3f ,/* 6 bits */ +INSN_F_SPI_SHIFT =3 ,/* shifted 3 bits to the left */ + +INSN_F_STACK_ACCESS =BIT (9 ),/* we need 10 bits total */ +}; + +static_assert (INSN_F_FRAMENO_MASK +1 >=MAX_CALL_FRAMES ); +static_assert (INSN_F_SPI_MASK +1 >=MAX_BPF_STACK /8 ); + +struct bpf_jmp_history_entry {u32 idx; +/* insn idx can't be bigger than 1 million */ +u32 prev_idx :22 ; +/* special flags, e.g., whether insn is doing register stack spill/load */ +u32 flags :10 ; }; -#define MAX_CALL_FRAMES 8/* Maximum number of register states that can exist at once */ #define BPF_ID_MAP_SIZE ((MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE) * MAX_CALL_FRAMES)struct bpf_verifier_state {
@@ -407,7 +429,7 @@ struct bpf_verifier_state {* For most states jmp_history_cnt is [0-3]. * For loops can go up to ~40. */ -struct bpf_idx_pair *jmp_history; +struct bpf_jmp_history_entry *jmp_history;u32 jmp_history_cnt;u32 dfs_depth;u32 callback_unroll_depth;
@@ -640,6 +662,7 @@ struct bpf_verifier_env {int cur_stack; } cfg;struct backtrack_state bt; +struct bpf_jmp_history_entry *cur_hist_ent;u32 pass_cnt;/* number of times do_check() was called */ u32 subprog_cnt;/* number of instructions analyzed by the verifier */
kernel/bpf/verifier.c +102 -73
348 lines not on this page · raw message
tools/testing/selftests/bpf/progs/verifier_subprog_precision.c +18 -5
@@ -541,11 +541,24 @@ static __u64 subprog_spill_reg_precise(void) SEC("?raw_tp") __success __log_level(2) -/* precision backtracking can't currently handle stack access not through r10, -* so we won't be able to mark stack slot fp-8 as precise, and so will -* fallback to forcing all as precise -*/ -__msg("mark_precise: frame0: falling back to forcing all scalars precise") +__msg("10: (0f) r1 += r7") +__msg("mark_precise: frame0: last_idx 10 first_idx 7 subseq_idx -1") +__msg("mark_precise: frame0: regs=r7 stack= before 9: (bf) r1 = r8") +__msg("mark_precise: frame0: regs=r7 stack= before 8: (27) r7 *= 4") +__msg("mark_precise: frame0: regs=r7 stack= before 7: (79) r7 = *(u64 *)(r10 -8)") +__msg("mark_precise: frame0: parent state regs= stack=-8: R0_w=2 R6_w=1 R8_rw=map_value(map=.data.vals,ks=4,vs=16) R10=fp0 fp-8_rw=P1") +__msg("mark_precise: frame0: last_idx 18 first_idx 0 subseq_idx 7") +__msg("mark_precise: frame0: regs= stack=-8 before 18: (95) exit") +__msg("mark_precise: frame1: regs= stack= before 17: (0f) r0 += r2") +__msg("mark_precise: frame1: regs= stack= before 16: (79) r2 = *(u64 *)(r1 +0)") +__msg("mark_precise: frame1: regs= stack= before 15: (79) r0 = *(u64 *)(r10 -16)") +__msg("mark_precise: frame1: regs= stack= before 14: (7b) *(u64 *)(r10 -16) = r2") +__msg("mark_precise: frame1: regs= stack= before 13: (7b) *(u64 *)(r1 +0) = r2") +__msg("mark_precise: frame1: regs=r2 stack= before 6: (85) call pc+6") +__msg("mark_precise: frame0: regs=r2 stack= before 5: (bf) r2 = r6") +__msg("mark_precise: frame0: regs=r6 stack= before 4: (07) r1 += -8") +__msg("mark_precise: frame0: regs=r6 stack= before 3: (bf) r1 = r10") +__msg("mark_precise: frame0: regs=r6 stack= before 2: (b7) r6 = 1")__naked int subprog_spill_into_parent_stack_slot_precise (void ) { asm volatile (
tools/testing/selftests/bpf/verifier/precise.c +22 -16
@@ -140,10 +140,11 @@ .result = REJECT, }, { - "precise: ST insn causing spi > allocated_stack", + "precise: ST zero to stack insn is supported", .insns = {BPF_MOV64_REG (BPF_REG_3 ,BPF_REG_10 ),BPF_JMP_IMM (BPF_JNE ,BPF_REG_3 ,123 ,0 ), +/* not a register spill, so we stop precision propagation for R4 here */ BPF_ST_MEM (BPF_DW ,BPF_REG_3 ,-8 ,0 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_4 ,BPF_REG_10 ,-8 ), BPF_MOV64_IMM(BPF_REG_0, -1),
@@ -157,11 +158,11 @@ mark_precise: frame0: last_idx 4 first_idx 2\ mark_precise: frame0: regs=r4 stack= before 4\ mark_precise: frame0: regs=r4 stack= before 3\ - mark_precise: frame0: regs= stack=-8 before 2\ - mark_precise: frame0: falling back to forcing all scalars precise\ - force_precise: frame0: forcing r0 to be precise\ mark_precise: frame0: last_idx 5 first_idx 5\ - mark_precise: frame0: parent state regs= stack=:", + mark_precise: frame0: parent state regs=r0 stack=:\ + mark_precise: frame0: last_idx 4 first_idx 2\ + mark_precise: frame0: regs=r0 stack= before 4\ + 5: R0=-1 R4=0", .result = VERBOSE_ACCEPT, .retval = -1, },
@@ -169,6 +170,8 @@ "precise: STX insn causing spi > allocated_stack", .insns = {BPF_RAW_INSN (BPF_JMP |BPF_CALL ,0 ,0 ,0 , BPF_FUNC_get_prandom_u32), +/* make later reg spill more interesting by having somewhat known scalar */ +BPF_ALU64_IMM (BPF_AND ,BPF_REG_0 ,0xff ),BPF_MOV64_REG (BPF_REG_3 ,BPF_REG_10 ),BPF_JMP_IMM (BPF_JNE ,BPF_REG_3 ,123 ,0 ), BPF_STX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, -8),
@@ -179,18 +182,21 @@ }, .prog_type = BPF_PROG_TYPE_XDP, .flags = BPF_F_TEST_STATE_FREQ, - .errstr ="mark_precise: frame0: last_idx 6 first_idx 6\ + .errstr ="mark_precise: frame0: last_idx 7 first_idx 7\ mark_precise: frame0: parent state regs=r4 stack=:\ -mark_precise: frame0: last_idx 5 first_idx 3\ -mark_precise: frame0: regs=r4 stack= before 5\ -mark_precise: frame0: regs=r4 stack= before 4\ -mark_precise: frame0: regs= stack=-8 before 3\ -mark_precise: frame0: falling back to forcing all scalars precise\ -force_precise: frame0: forcing r0 to be precise\ -force_precise: frame0: forcing r0 to be precise\ -force_precise: frame0: forcing r0 to be precise\ -force_precise: frame0: forcing r0 to be precise\ -mark_precise: frame0: last_idx 6 first_idx 6\ +mark_precise: frame0: last_idx 6 first_idx 4\ +mark_precise: frame0: regs=r4 stack= before 6: (b7) r0 = -1\ +mark_precise: frame0: regs=r4 stack= before 5: (79) r4 = *(u64 *)(r10 -8)\ +mark_precise: frame0: regs= stack=-8 before 4: (7b) *(u64 *)(r3 -8) = r0\ +mark_precise: frame0: parent state regs=r0 stack=:\ +mark_precise: frame0: last_idx 3 first_idx 3\ +mark_precise: frame0: regs=r0 stack= before 3: (55) if r3 != 0x7b goto pc+0\ +mark_precise: frame0: regs=r0 stack= before 2: (bf) r3 = r10\ +mark_precise: frame0: regs=r0 stack= before 1: (57) r0 &= 255\ +mark_precise: frame0: parent state regs=r0 stack=:\ +mark_precise: frame0: last_idx 0 first_idx 0\ +mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7\ +mark_precise: frame0: last_idx 7 first_idx 7\ mark_precise: frame0: parent state regs= stack=:", .result = VERBOSE_ACCEPT, .retval = -1,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/676 arm64: probes: Disable kprobes/uprobes on MOPS instructions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristina Martsenko <[email protected]>
[ Upstream commit c56c599d9002d44f559be3852b371db46adac87c ]
FEAT_MOPS instructions require that all three instructions (prologue, main and epilogue) appear consecutively in memory. Placing a kprobe/uprobe on one of them doesn't work as only a single instruction gets executed out-of-line or simulated. So don't allow placing a probe on a MOPS instruction.
--- arch/arm64/include/asm/insn.h | 1 + arch/arm64/kernel/probes/decode-insn.c | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-)
arch/arm64/include/asm/insn.h +1 -0
@@ -347,6 +347,7 @@ __AARCH64_INSN_FUNCS(ldrsw_lit, 0xFF000000, 0x98000000) __AARCH64_INSN_FUNCS(exclusive, 0x3F800000, 0x08000000) __AARCH64_INSN_FUNCS(load_ex, 0x3F400000, 0x08400000) __AARCH64_INSN_FUNCS(store_ex, 0x3F400000, 0x08000000) +__AARCH64_INSN_FUNCS(mops, 0x3B200C00, 0x19000400) __AARCH64_INSN_FUNCS(stp, 0x7FC00000, 0x29000000) __AARCH64_INSN_FUNCS(ldp, 0x7FC00000, 0x29400000)__AARCH64_INSN_FUNCS (stp_post,0x7FC00000 ,0x28800000 )
arch/arm64/kernel/probes/decode-insn.c +5 -2
@@ -58,10 +58,13 @@ static bool __kprobes aarch64_insn_is_steppable(u32 insn)* Instructions which load PC relative literals are not going to work * when executed from an XOL slot. Instructions doing an exclusive * load/store are not going to complete successfully when single-step -* exception handling happens in the middle of the sequence. +* exception handling happens in the middle of the sequence. Memory +* copy/set instructions require that all three instructions be placed +* consecutively in memory. */ if (aarch64_insn_uses_literal (insn) || -aarch64_insn_is_exclusive (insn)) +aarch64_insn_is_exclusive (insn) || +aarch64_insn_is_mops (insn))return false;return true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/676 kselftest/arm64: mte: fix printf type warnings about __u64
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit 7e893dc81de3e342156389ea0b83ec7d07f25281 ]
When printing the signal context's PC, we use a "%lx" format specifier, which matches the common userland (glibc's) definition of uint64_t as an "unsigned long". However the structure in question is defined in a kernel uapi header, which uses a self defined __u64 type, and the arm64 kernel headers define this using "int-ll64.h", so it becomes an "unsigned long long". This mismatch leads to the usual compiler warning.
The common fix would be to use "PRIx64", but because this is defined by the userland's toolchain libc headers, it wouldn't match as well. Since we know the exact type of __u64, just use "%llx" here instead, to silence this warning.
This also fixes a more severe typo: "$lx" is not a valid format specifier.
--- tools/testing/selftests/arm64/mte/mte_common_util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/arm64/mte/mte_common_util.c +2 -2
@@ -38,7 +38,7 @@ void mte_default_handler(int signum, siginfo_t *si, void *uc)if (cur_mte_cxt.trig_si_code == si->si_code) cur_mte_cxt.fault_valid = true;else -ksft_print_msg ("Got unexpected SEGV_MTEAERR at pc=$lx, fault addr=%lx\n" , +ksft_print_msg ("Got unexpected SEGV_MTEAERR at pc=%llx, fault addr=%lx\n" , ((ucontext_t *)uc)->uc_mcontext.pc, addr);return ;
@@ -64,7 +64,7 @@ void mte_default_handler(int signum, siginfo_t *si, void *uc)exit (1 ); } }else if (signum ==SIGBUS ) { -ksft_print_msg ("INFO: SIGBUS signal at pc=%lx, fault addr=%lx, si_code=%lx\n" , +ksft_print_msg ("INFO: SIGBUS signal at pc=%llx, fault addr=%lx, si_code=%x\n" , ((ucontext_t *)uc)->uc_mcontext.pc, addr, si->si_code); if ((cur_mte_cxt.trig_range >= 0 && addr >= MT_CLEAR_TAG(cur_mte_cxt.trig_addr) &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/676 kselftest/arm64: mte: fix printf type warnings about longs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit 96dddb7b9406259baace9a1831e8da155311be6f ]
When checking MTE tags, we print some diagnostic messages when the tests fail. Some variables uses there are "longs", however we only use "%x" for the format specifier.
Update the format specifiers to "%lx", to match the variable types they are supposed to print.
--- tools/testing/selftests/arm64/mte/check_tags_inclusion.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/arm64/mte/check_tags_inclusion.c +2 -2
@@ -65,7 +65,7 @@ static int check_single_included_tags(int mem_type, int mode) ptr =mte_insert_tags (ptr,BUFFER_SIZE );/* Check tag value */ if (MT_FETCH_TAG ((uintptr_t )ptr) == tag) { -ksft_print_msg ("FAIL: wrong tag = 0x%x with include mask=0x%x\n" , +ksft_print_msg ("FAIL: wrong tag = 0x%lx with include mask=0x%x\n" ,MT_FETCH_TAG ((uintptr_t )ptr),MT_INCLUDE_VALID_TAG (tag)); result =KSFT_FAIL ;
@@ -97,7 +97,7 @@ static int check_multiple_included_tags(int mem_type, int mode) ptr =mte_insert_tags (ptr,BUFFER_SIZE );/* Check tag value */ if (MT_FETCH_TAG ((uintptr_t )ptr) < tag) { -ksft_print_msg ("FAIL: wrong tag = 0x%x with include mask=0x%x\n" , +ksft_print_msg ("FAIL: wrong tag = 0x%lx with include mask=0x%lx\n" ,MT_FETCH_TAG ((uintptr_t )ptr),MT_INCLUDE_VALID_TAGS (excl_mask)); result =KSFT_FAIL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/676 s390/cio: Do not unregister the subchannel based on DNV
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
[ Upstream commit 8c58a229688ce3a097b3b1a2efe1b4f5508c2123 ]
Starting with commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers"), CIO does not unregister subchannels when the attached device is invalid or unavailable. Instead, it allows subchannels to exist without a connected device. However, if the DNV value is 0, such as, when all the CHPIDs of a subchannel are configured in standby state, the subchannel is unregistered, which contradicts the current subchannel specification.
Update the logic so that subchannels are not unregistered based on the DNV value. Also update the SCHIB information even if the DNV bit is zero.
--- drivers/s390/cio/cio.c | 6 +++++- drivers/s390/cio/device.c | 18 +++++++++++++++++- 2 files changed, 22 insertions(+), 2 deletions(-)
drivers/s390/cio/cio.c +5 -1
@@ -459,10 +459,14 @@ int cio_update_schib(struct subchannel *sch) {struct schib schib; -if (stsch (sch->schid, &schib) || !css_sch_is_valid (&schib)) +if (stsch (sch->schid, &schib))return -ENODEV ;memcpy (&sch->schib, &schib,sizeof (schib)); + +if (!css_sch_is_valid (&schib)) +return -EACCES ; +return 0 ; }EXPORT_SYMBOL_GPL (cio_update_schib);
drivers/s390/cio/device.c +17 -1
@@ -1387,14 +1387,18 @@ enum io_sch_action {IO_SCH_VERIFY ,IO_SCH_DISC ,IO_SCH_NOP , + IO_SCH_ORPH_CDEV, };static enum io_sch_action sch_get_action (struct subchannel *sch) {struct ccw_device *cdev; +int rc; cdev =sch_get_cdev (sch); -if (cio_update_schib (sch)) { + rc =cio_update_schib (sch); + +if (rc == -ENODEV ) {/* Not operational. */ if (!cdev)return IO_SCH_UNREG ;
@@ -1402,6 +1406,16 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)return IO_SCH_UNREG ;return IO_SCH_ORPH_UNREG ; } + +/* Avoid unregistering subchannels without working device. */ +if (rc == -EACCES ) { +if (!cdev) +return IO_SCH_NOP ; +if (ccw_device_notify (cdev,CIO_GONE ) !=NOTIFY_OK ) +return IO_SCH_UNREG_CDEV ; +return IO_SCH_ORPH_CDEV ; + } +/* Operational. */ if (!cdev)return IO_SCH_ATTACH ;
@@ -1471,6 +1485,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process) rc =0 ; goto out_unlock;case IO_SCH_ORPH_UNREG : +case IO_SCH_ORPH_CDEV :case IO_SCH_ORPH_ATTACH :ccw_device_set_disconnected (cdev);break ;
@@ -1502,6 +1517,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)/* Handle attached ccw device. */ switch (action) {case IO_SCH_ORPH_UNREG : +case IO_SCH_ORPH_CDEV :case IO_SCH_ORPH_ATTACH :/* Move ccw device to orphanage. */ rc =ccw_device_move_to_orph (cdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/676 s390/pageattr: Implement missing kernel_page_present()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 2835f8bf5530750c3381166005934f996a83ad05 ]
kernel_page_present() was intentionally not implemented when adding ARCH_HAS_SET_DIRECT_MAP support, since it was only used for suspend/resume which is not supported anymore on s390.
A new bpf use case led to a compile error specific to s390. Even though this specific use case went away implement kernel_page_present(), so that the API is complete and potential future users won't run into this problem.
--- arch/s390/include/asm/set_memory.h | 1 + arch/s390/mm/pageattr.c | 15 +++++++++++++++ 2 files changed, 16 insertions(+)
arch/s390/include/asm/set_memory.h +1 -0
@@ -62,5 +62,6 @@ __SET_MEMORY_FUNC(set_memory_4k, SET_MEMORY_4K)int set_direct_map_invalid_noflush (struct page *page);int set_direct_map_default_noflush (struct page *page); +bool kernel_page_present (struct page *page);#endif
arch/s390/mm/pageattr.c +15 -0
@@ -406,6 +406,21 @@ int set_direct_map_default_noflush(struct page *page)return __set_memory ((unsigned long )page_to_virt (page),1 ,SET_MEMORY_DEF ); } +bool kernel_page_present (struct page *page) +{ +unsigned long addr; +unsigned int cc; + + addr = (unsigned long )page_address (page); + asmvolatile ( +" lra %[addr],0(%[addr])\n" +" ipm %[cc]\n" + : [cc]"=d" (cc), [addr]"+a" (addr) + : + :"cc" ); +return (cc >>28 ) ==0 ; +} +#if defined(CONFIG_DEBUG_PAGEALLOC ) || defined(CONFIG_KFENCE )static void ipte_range (pte_t *pte,unsigned long address,int nr)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/676 x86/pvh: Set phys_base when calling xen_prepare_pvh()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
[ Upstream commit b464b461d27d564125db760938643374864c1b1f ]
phys_base needs to be set for __pa() to work in xen_pvh_init() when finding the hypercall page. Set it before calling into xen_prepare_pvh(), which calls xen_pvh_init(). Clear it afterward to avoid __startup_64() adding to it and creating an incorrect value.
Message-ID: <[email protected]>
Stable-dep-of: e8fbc0d9cab6 ("x86/pvh: Call C code via the kernel virtual mapping")
--- arch/x86/platform/pvh/head.S | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/x86/platform/pvh/head.S +13 -0
@@ -100,7 +100,20 @@ SYM_CODE_START_LOCAL(pvh_start_xen) xor %edx, %edx wrmsr + /* + * Calculate load offset and store in phys_base. __pa() needs + * phys_base set to calculate the hypercall page in xen_pvh_init(). + */ + movq %rbp, %rbx + subq $_pa(pvh_start_xen), %rbx + movq %rbx, phys_base(%rip) call xen_prepare_pvh + /* + * Clear phys_base. __startup_64 will *add* to its value, + * so reset to 0. + */ + xor %rbx, %rbx + movq %rbx, phys_base(%rip) /* startup_64 expects boot_params in %rsi. */ mov $_pa(pvh_bootparams), %rsi
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/676 x86/pvh: Call C code via the kernel virtual mapping
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
[ Upstream commit e8fbc0d9cab6c1ee6403f42c0991b0c1d5dbc092 ]
Calling C code via a different mapping than it was linked at is problematic, because the compiler assumes that RIP-relative and absolute symbol references are interchangeable. GCC in particular may use RIP-relative per-CPU variable references even when not using -fpic.
So call xen_prepare_pvh() via its kernel virtual mapping on x86_64, so that those RIP-relative references produce the correct values. This matches the pre-existing behavior for i386, which also invokes xen_prepare_pvh() via the kernel virtual mapping before invoking startup_32 with paging disabled again.
Message-ID: <[email protected]>
--- arch/x86/platform/pvh/head.S | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
arch/x86/platform/pvh/head.S +8 -1
@@ -107,7 +107,14 @@ SYM_CODE_START_LOCAL(pvh_start_xen) movq %rbp, %rbx subq $_pa(pvh_start_xen), %rbx movq %rbx, phys_base(%rip) - call xen_prepare_pvh + + /* Call xen_prepare_pvh() via the kernel virtual mapping */ + leaq xen_prepare_pvh(%rip), %rax + subq phys_base(%rip), %rax + addq $__START_KERNEL_map, %rax + ANNOTATE_RETPOLINE_SAFE + call *%rax + /* * Clear phys_base. __startup_64 will *add* to its value, * so reset to 0.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/676 brd: defer automatic disk creation until module initialization succeeds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
[ Upstream commit 826cc42adf44930a633d11a5993676d85ddb0842 ]
My colleague Wupeng found the following problems during fault injection:
BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__asan_load8+0x4c/0xa0 ... Call Trace: <TASK> blkdev_put_whole+0x41/0x70 bdev_release+0x1a3/0x250 blkdev_release+0x11/0x20 __fput+0x1d7/0x4a0 task_work_run+0xfc/0x180 syscall_exit_to_user_mode+0x1de/0x1f0 do_syscall_64+0x6b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
loop_init() is calling loop_add() after __register_blkdev() succeeds and is ignoring disk_add() failure from loop_add(), for loop_add() failure is not fatal and successfully created disks are already visible to bdev_open().
brd_init() is currently calling brd_alloc() before __register_blkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case:
case 1:
T1:
modprobe brd
brd_init
brd_alloc(0) // success
add_disk
disk_scan_partitions
bdev_file_open_by_dev // alloc file fput // won't free until back to userspace
brd_alloc(1) // failed since mem alloc error inject
// error path for modprobe will release code segment // back to userspace
__fput
blkdev_release
bdev_release
blkdev_put_whole
bdev->bd_disk->fops->release // fops is freed now, UAF!case 2:
T1: T2:
modprobe brd
brd_init
brd_alloc(0) // success
open(/dev/ram0)
brd_alloc(1) // fail// error path for modprobe
close(/dev/ram0)
...
/* UAF! */
bdev->bd_disk->fops->releaseFix this problem by following what loop_init() does. Besides, reintroduce brd_devices_mutex to help serialize modifications to brd_list.
--- drivers/block/brd.c | 66 ++++++++++++++++++++++++++++++--------------- 1 file changed, 44 insertions(+), 22 deletions(-)
drivers/block/brd.c +44 -22
@@ -310,8 +310,40 @@ __setup("ramdisk_size=", ramdisk_size);* (should share code eventually). */ static LIST_HEAD (brd_devices); +static DEFINE_MUTEX (brd_devices_mutex);static struct dentry *brd_debugfs_dir; +static struct brd_device *brd_find_or_alloc_device (int i) +{ +struct brd_device *brd; + +mutex_lock (&brd_devices_mutex); +list_for_each_entry (brd, &brd_devices, brd_list) { +if (brd->brd_number == i) { +mutex_unlock (&brd_devices_mutex); +return ERR_PTR (-EEXIST ); + } + } + + brd =kzalloc (sizeof (*brd),GFP_KERNEL ); +if (!brd) { +mutex_unlock (&brd_devices_mutex); +return ERR_PTR (-ENOMEM ); + } + brd->brd_number = i; +list_add_tail (&brd->brd_list, &brd_devices); +mutex_unlock (&brd_devices_mutex); +return brd; +} + +static void brd_free_device (struct brd_device *brd) +{ +mutex_lock (&brd_devices_mutex); +list_del (&brd->brd_list); +mutex_unlock (&brd_devices_mutex); +kfree (brd); +} +static int brd_alloc (int i) {struct brd_device *brd;
@@ -319,14 +351,9 @@ static int brd_alloc(int i)char buf[DISK_NAME_LEN ];int err = -ENOMEM ; -list_for_each_entry (brd, &brd_devices, brd_list) -if (brd->brd_number == i) -return -EEXIST ; - brd =kzalloc (sizeof (*brd),GFP_KERNEL ); -if (!brd) -return -ENOMEM ; - brd->brd_number = i; -list_add_tail (&brd->brd_list, &brd_devices); + brd =brd_find_or_alloc_device (i); +if (IS_ERR (brd)) +return PTR_ERR (brd);xa_init (&brd->brd_pages);
@@ -369,8 +396,7 @@ static int brd_alloc(int i) out_cleanup_disk:put_disk (disk); out_free_dev: -list_del (&brd->brd_list); -kfree (brd); +brd_free_device (brd);return err; }
@@ -389,8 +415,7 @@ static void brd_cleanup(void)del_gendisk (brd->brd_disk);put_disk (brd->brd_disk);brd_free_pages (brd); -list_del (&brd->brd_list); -kfree (brd); +brd_free_device (brd); } }
@@ -417,16 +442,6 @@ static int __init brd_init(void) {int err, i; -brd_check_and_reset_par (); - - brd_debugfs_dir =debugfs_create_dir ("ramdisk_pages" ,NULL ); - -for (i =0 ; i < rd_nr; i++) { - err =brd_alloc (i); -if (err) - goto out_free; - } -/* * brd module now has a feature to instantiate underlying device * structure on-demand, provided that there is an access dev node.
@@ -442,11 +457,18 @@ static int __init brd_init(void)* dynamically. */ +brd_check_and_reset_par (); + + brd_debugfs_dir =debugfs_create_dir ("ramdisk_pages" ,NULL ); +if (__register_blkdev (RAMDISK_MAJOR ,"ramdisk" , brd_probe)) { err = -EIO ; goto out_free; } +for (i =0 ; i < rd_nr; i++) +brd_alloc (i); +pr_info ("brd: module loaded\n" );return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/676 ext4: avoid remount errors with abort mount option
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 76486b104168ae59703190566e372badf433314b ]
When we remount filesystem with 'abort' mount option while changing other mount options as well (as is LTP test doing), we can return error from the system call after commit d3476f3dad4a ("ext4: don't set SB_RDONLY after filesystem errors") because the application of mount option changes detects shutdown filesystem and refuses to do anything. The behavior of application of other mount options in presence of 'abort' mount option is currently rather arbitary as some mount option changes are handled before 'abort' and some after it.
Move aborting of the filesystem to the end of remount handling so all requested changes are properly applied before the filesystem is shutdown to have a reasonably consistent behavior.
--- fs/ext4/super.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/ext4/super.c +8 -3
@@ -6544,9 +6544,6 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb) goto restore_opts; } -if (test_opt2 (sb,ABORT )) -ext4_abort (sb,ESHUTDOWN ,"Abort forced by user" ); - sb->s_flags = (sb->s_flags & ~SB_POSIXACL ) | (test_opt (sb,POSIX_ACL ) ?SB_POSIXACL :0 );
@@ -6715,6 +6712,14 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb)if (!ext4_has_feature_mmp (sb) ||sb_rdonly (sb))ext4_stop_mmpd (sbi); +/* +* Handle aborting the filesystem as the last thing during remount to +* avoid obsure errors during remount when some option changes fail to +* apply due to shutdown filesystem. +*/ +if (test_opt2 (sb,ABORT )) +ext4_abort (sb,ESHUTDOWN ,"Abort forced by user" ); +return 0 ; restore_opts:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/676 mips: asm: fix warning when disabling MIPS_FP_SUPPORT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit da09935975c8f8c90d6f57be2422dee5557206cd ]
When MIPS_FP_SUPPORT is disabled, __sanitize_fcr31() is defined as nothing, which triggers a gcc warning:
In file included from kernel/sched/core.c:79:
kernel/sched/core.c: In function 'context_switch':
./arch/mips/include/asm/switch_to.h:114:39: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
114 | __sanitize_fcr31(next); \
| ^
kernel/sched/core.c:5316:9: note: in expansion of macro 'switch_to'
5316 | switch_to(prev, next, prev);
| ^~~~~~~~~
Fix this by providing an empty body for __sanitize_fcr31() like one is defined for __mips_mt_fpaff_switch_to().
--- arch/mips/include/asm/switch_to.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/switch_to.h +1 -1
@@ -97,7 +97,7 @@ do { \ } \ } while (0)#else -# define __sanitize_fcr31 (next) +# define __sanitize_fcr31 (next) do { (void) (next); } while (0)#endif /*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/676 initramfs: avoid filename buffer overrun
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Disseldorp <[email protected]>
[ Upstream commit e017671f534dd3f568db9e47b0583e853d2da9b5 ]
The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as:
37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data
...
55 ============= ================== =========================
56 Field name Field size Meaning
57 ============= ================== =========================
...
70 c_namesize 8 bytes Length of filename, including final \0
When extracting an initramfs cpio archive, the kernel's do_name() path handler assumes a zero-terminated path at @collected, passing it directly to filp_open() / init_mkdir() / init_mknod().
If a specially crafted cpio entry carries a non-zero-terminated filename and is followed by uninitialized memory, then a file may be created with trailing characters that represent the uninitialized memory. The ability to create an initramfs entry would imply already having full control of the system, so the buffer overrun shouldn't be considered a security vulnerability.
Append the output of the following bash script to an existing initramfs and observe any created /initramfs_test_fname_overrunAA* path. E.g.
./reproducer.sh | gzip >> /myinitramfs
It's easiest to observe non-zero uninitialized memory when the output is gzipped, as it'll overflow the heap allocated @out_buf in __gunzip(), rather than the initrd_start+initrd_size block.
---- reproducer.sh ----
nilchar="A" # change to "\0" to properly zero terminate / pad
magic="070701"
ino=1
mode=$(( 0100777 ))
uid=0
gid=0
nlink=1
mtime=1
filesize=0
devmajor=0
devminor=1
rdevmajor=0
rdevminor=0
csum=0
fname="initramfs_test_fname_overrun"
namelen=$(( ${#fname} + 1 )) # plus one to account for terminator
printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \ $magic $ino $mode $uid $gid $nlink $mtime $filesize \ $devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname
termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) printf "%.s${nilchar}" $(seq 1 $termpadlen) ---- reproducer.sh ----
Symlink filename fields handled in do_symlink() won't overrun past the data segment, due to the explicit zero-termination of the symlink target.
Fix filename buffer overrun by aborting the initramfs FSM if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset.
--- init/initramfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
init/initramfs.c +15 -0
@@ -358,6 +358,15 @@ static int __init do_name(void) { state = SkipIt; next_state = Reset; + +/* name_len > 0 && name_len <= PATH_MAX checked in do_header */ +if (collected[name_len -1 ] !='\0' ) { +pr_err ("initramfs name without nulterm: %.*s\n" , + (int )name_len, collected); +error ("malformed archive" ); +return 1 ; + } +if (strcmp (collected,"TRAILER!!!" ) ==0 ) {free_hash ();return 0 ;
@@ -422,6 +431,12 @@ static int __init do_copy(void)static int __init do_symlink (void ) { +if (collected[name_len -1 ] !='\0' ) { +pr_err ("initramfs symlink without nulterm: %.*s\n" , + (int )name_len, collected); +error ("malformed archive" ); +return 1 ; + } collected[N_ALIGN (name_len) + body_len] ='\0' ;clean_path (collected,0 );init_symlink (collected +N_ALIGN (name_len), collected);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/676 nvme-pci: fix freeing of the HMB descriptor table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a ]
The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent.
In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.
--- drivers/nvme/host/pci.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/nvme/host/pci.c +9 -7
@@ -153,6 +153,7 @@ struct nvme_dev {/* host memory buffer support: */ u64 host_mem_size;u32 nr_host_mem_descs; +u32 host_mem_descs_size;dma_addr_t host_mem_descs_dma;struct nvme_host_mem_buf_desc *host_mem_descs;void **host_mem_desc_bufs;
@@ -1929,10 +1930,10 @@ static void nvme_free_host_mem(struct nvme_dev *dev)kfree (dev->host_mem_desc_bufs); dev->host_mem_desc_bufs =NULL ; -dma_free_coherent (dev->dev, - dev->nr_host_mem_descs *sizeof (*dev->host_mem_descs), +dma_free_coherent (dev->dev, dev->host_mem_descs_size, dev->host_mem_descs, dev->host_mem_descs_dma); dev->host_mem_descs =NULL ; + dev->host_mem_descs_size =0 ; dev->nr_host_mem_descs =0 ; }
@@ -1940,7 +1941,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, u32 chunk_size) {struct nvme_host_mem_buf_desc *descs; -u32 max_entries, len; +u32 max_entries, len, descs_size;dma_addr_t descs_dma;int i =0 ;void **bufs;
@@ -1953,8 +1954,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries) max_entries = dev->ctrl.hmmaxd; - descs =dma_alloc_coherent (dev->dev, max_entries *sizeof (*descs), - &descs_dma,GFP_KERNEL ); + descs_size = max_entries *sizeof (*descs); + descs =dma_alloc_coherent (dev->dev, descs_size, &descs_dma, +GFP_KERNEL );if (!descs) goto out;
@@ -1983,6 +1985,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, dev->host_mem_size = size; dev->host_mem_descs = descs; dev->host_mem_descs_dma = descs_dma; + dev->host_mem_descs_size = descs_size; dev->host_mem_desc_bufs = bufs;return 0 ;
@@ -1997,8 +2000,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,kfree (bufs); out_free_descs: -dma_free_coherent (dev->dev, max_entries *sizeof (*descs), descs, - descs_dma); +dma_free_coherent (dev->dev, descs_size, descs, descs_dma); out: dev->host_mem_descs =NULL ;return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/676 m68k: mvme147: Fix SCSI controller IRQ numbers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 47bc874427382018fa2e3e982480e156271eee70 ]
Sometime long ago the m68k IRQ code was refactored and the interrupt numbers for SCSI controller on this board ended up wrong, and it hasn't worked since.
The PCC adds 0x40 to the vector for its interrupts so they end up in the user interrupt range. Hence, the kernel number should be the kernel offset for user interrupt range + the PCC interrupt number.
--- arch/m68k/include/asm/mvme147hw.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/m68k/include/asm/mvme147hw.h +2 -2
@@ -93,8 +93,8 @@ struct pcc_regs {#define M147_SCC_B_ADDR 0xfffe3000#define M147_SCC_PCLK 5000000 -#define MVME147_IRQ_SCSI_PORT (IRQ_USER+0x45) -#define MVME147_IRQ_SCSI_DMA (IRQ_USER+0x46) +#define MVME147_IRQ_SCSI_PORT (IRQ_USER + 5) +#define MVME147_IRQ_SCSI_DMA (IRQ_USER + 6)/* SCC interrupts, for MVME147 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/676 m68k: mvme16x: Add and use "mvme16x.h"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit dcec33c1fc4ab63983d93ffb0d82b68fc5775b88 ]
When building with W=1:
arch/m68k/mvme16x/config.c:208:6: warning: no previous prototype for ‘mvme16x_cons_write’ [-Wmissing-prototypes]
208 | void mvme16x_cons_write(struct console *co, const char *str, unsigned count)
| ^~~~~~~~~~~~~~~~~~
Fix this by introducing a new header file "mvme16x.h" for holding the prototypes of functions implemented in arch/m68k/mvme16x/.
Stable-dep-of: 077b33b9e283 ("m68k: mvme147: Reinstate early console")
--- arch/m68k/kernel/early_printk.c | 4 ++-- arch/m68k/mvme16x/config.c | 2 ++ arch/m68k/mvme16x/mvme16x.h | 6 ++++++ 3 files changed, 10 insertions(+), 2 deletions(-) create mode 100644 arch/m68k/mvme16x/mvme16x.h
arch/m68k/kernel/early_printk.c +2 -2
@@ -12,8 +12,8 @@#include <linux/string.h> #include <asm/setup.h> -extern void mvme16x_cons_write (struct console *co, -const char *str,unsigned count); + +#include "../mvme16x/mvme16x.h" asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
arch/m68k/mvme16x/config.c +2 -0
@@ -38,6 +38,8 @@#include <asm/mvme16xhw.h> #include <asm/config.h> +#include "mvme16x.h" +extern t_bdid mvme_bdid;static MK48T08ptr_t volatile rtc = (MK48T08ptr_t )MVME_RTC_BASE ;
arch/m68k/mvme16x/mvme16x.h new file +6 -0
@@ -0,0 +1,6 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +struct console ; + +/* config.c */ +void mvme16x_cons_write (struct console *co,const char *str,unsigned count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/676 m68k: mvme147: Reinstate early console
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 077b33b9e2833ff25050d986178a2c4c4036cbac ]
Commit a38eaa07a0ce ("m68k/mvme147: config.c - Remove unused functions"), removed the console functionality for the mvme147 instead of wiring it up to an early console. Put the console write function back and wire it up like mvme16x does so it's possible to see Linux boot on this fine hardware once more.
--- arch/m68k/kernel/early_printk.c | 5 ++++- arch/m68k/mvme147/config.c | 30 ++++++++++++++++++++++++++++++ arch/m68k/mvme147/mvme147.h | 6 ++++++ 3 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 arch/m68k/mvme147/mvme147.h
arch/m68k/kernel/early_printk.c +4 -1
@@ -13,6 +13,7 @@#include <asm/setup.h> +#include "../mvme147/mvme147.h" #include "../mvme16x/mvme16x.h" asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
@@ -22,7 +23,9 @@ static void __ref debug_cons_write(struct console *c, {#if !(defined(CONFIG_SUN3 ) || defined(CONFIG_M68000 ) || \ defined(CONFIG_COLDFIRE )) -if (MACH_IS_MVME16x) +if (MACH_IS_MVME147 ) +mvme147_scc_write (c, s, n); +else if (MACH_IS_MVME16x)mvme16x_cons_write (c, s, n);else debug_cons_nputs (s, n);
arch/m68k/mvme147/config.c +30 -0
@@ -35,6 +35,7 @@#include <asm/mvme147hw.h> #include <asm/config.h> +#include "mvme147.h" static void mvme147_get_model (char *model);extern void mvme147_sched_init (void );
@@ -188,3 +189,32 @@ int mvme147_hwclk(int op, struct rtc_time *t) }return 0 ; } + +static void scc_delay (void ) +{ + __asm__ __volatile__ ("nop; nop;" ); +} + +static void scc_write (char ch) +{ +do { +scc_delay (); + }while (!(in_8 (M147_SCC_A_ADDR ) &BIT (2 ))); +scc_delay (); +out_8 (M147_SCC_A_ADDR ,8 ); +scc_delay (); +out_8 (M147_SCC_A_ADDR , ch); +} + +void mvme147_scc_write (struct console *co,const char *str,unsigned int count) +{ +unsigned long flags; + +local_irq_save (flags); +while (count--) { +if (*str =='\n' ) +scc_write ('\r' ); +scc_write (*str++); + } +local_irq_restore (flags); +}
arch/m68k/mvme147/mvme147.h new file +6 -0
@@ -0,0 +1,6 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +struct console ; + +/* config.c */ +void mvme147_scc_write (struct console *co,const char *str,unsigned int count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/676 arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 340fd66c856651d8c1d29f392dd26ad674d2db0e ]
Commit be2881824ae9 ("arm64/build: Assert for unwanted sections") introduced an assertion to ensure that the .data.rel.ro section does not exist.
However, this check does not work when CONFIG_LTO_CLANG is enabled, because .data.rel.ro matches the .data.[0-9a-zA-Z_]* pattern in the DATA_MAIN macro.
Move the ASSERT() above the RW_DATA() line.
--- arch/arm64/kernel/vmlinux.lds.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/kernel/vmlinux.lds.S +3 -3
@@ -285,6 +285,9 @@ SECTIONS __initdata_end = .; __init_end = .; + .data.rel.ro : { *(.data.rel.ro) } + ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!") + _data = .; _sdata = .; RW_DATA(L1_CACHE_BYTES, PAGE_SIZE, THREAD_ALIGN)
@@ -336,9 +339,6 @@ SECTIONS *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt) } ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!") - - .data.rel.ro : { *(.data.rel.ro) } - ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!") } #include "image-vars.h"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/676 acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 1a9de2f6fda69d5f105dd8af776856a66abdaa64 ]
In case of error in gtdt_parse_timer_block() invalid 'gtdt_frame' will be used in 'do {} while (i-- >= 0 && gtdt_frame--);' statement block because do{} block will be executed even if 'i == 0'.
Adjust error handling procedure by replacing 'i-- >= 0' with 'i-- > 0'.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/arm64/gtdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/arm64/gtdt.c +1 -1
@@ -283,7 +283,7 @@ static int __init gtdt_parse_timer_block(struct acpi_gtdt_timer_block *block,if (frame->virt_irq >0 )acpi_unregister_gsi (gtdt_frame->virtual_timer_interrupt); frame->virt_irq =0 ; - }while (i-- >=0 && gtdt_frame--); + }while (i-- >0 && gtdt_frame--);return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/676 cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zizhi Wo <[email protected]>
[ Upstream commit 56f4856b425a30e1d8b3e41e6cde8bfba90ba5f8 ]
In the erofs on-demand loading scenario, read and write operations are usually delivered through "off" and "len" contained in read req in user mode. Naturally, pwrite is used to specify a specific offset to complete write operations.
However, if the write(not pwrite) syscall is called multiple times in the read-ahead scenario, we need to manually update ki_pos after each write operation to update file->f_pos.
This step is currently missing from the cachefiles_ondemand_fd_write_iter function, added to address this issue.
--- fs/cachefiles/ondemand.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/cachefiles/ondemand.c +3 -1
@@ -78,8 +78,10 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb,trace_cachefiles_ondemand_fd_write (object,file_inode (file), pos, len); ret =__cachefiles_write (object, file, pos, iter,NULL ,NULL ); -if (!ret) +if (!ret) { ret = len; + kiocb->ki_pos += ret; + }return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/676 netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zizhi Wo <[email protected]>
[ Upstream commit 22f9400a6f3560629478e0a64247b8fcc811a24d ]
In fscache_create_volume(), there is a missing memory barrier between the bit-clearing operation and the wake-up operation. This may cause a situation where, after a wake-up, the bit-clearing operation hasn't been detected yet, leading to an indefinite wait. The triggering process is as follows:
[cookie1] [cookie2] [volume_work]fscache_perform_lookup
fscache_create_volume
fscache_perform_lookup
fscache_create_volume
fscache_create_volume_work
cachefiles_acquire_volume clear_and_wake_up_bit
test_and_set_bit
test_and_set_bit
goto maybe_wait
goto no_wait
In the above process, cookie1 and cookie2 has the same volume. When cookie1 enters the -no_wait- process, it will clear the bit and wake up the waiting process. If a barrier is missing, it may cause cookie2 to remain in the -wait- process indefinitely.
In commit 3288666c7256 ("fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()"), barriers were added to similar operations in fscache_create_volume_work(), but fscache_create_volume() was missed.
By combining the clear and wake operations into clear_and_wake_up_bit() to fix this issue.
--- fs/fscache/volume.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/fscache/volume.c +1 -2
@@ -322,8 +322,7 @@ void fscache_create_volume(struct fscache_volume *volume, bool wait) }return ; no_wait: -clear_bit_unlock (FSCACHE_VOLUME_CREATING , &volume->flags); -wake_up_bit (&volume->flags,FSCACHE_VOLUME_CREATING ); +clear_and_wake_up_bit (FSCACHE_VOLUME_CREATING , &volume->flags); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/676 block: fix bio_split_rw_at to take zone_write_granularity into account
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 7ecd2cd4fae3e8410c0a6620f3a83dcdbb254f02 ]
Otherwise it can create unaligned writes on zoned devices.
--- block/blk-merge.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
block/blk-merge.c +9 -1
@@ -256,6 +256,14 @@ static bool bvec_split_segs(const struct queue_limits *lim,return len >0 || bv->bv_len > max_len; } +static unsigned int bio_split_alignment (struct bio *bio, +const struct queue_limits *lim) +{ +if (op_is_write (bio_op (bio)) && lim->zone_write_granularity) +return lim->zone_write_granularity; +return lim->logical_block_size; +} +/** * bio_split_rw - split a bio in two bios * @bio: [in] bio to be split
@@ -326,7 +334,7 @@ struct bio *bio_split_rw(struct bio *bio, const struct queue_limits *lim,* split size so that each bio is properly block size aligned, even if * we do not use the full hardware limits. */ - bytes =ALIGN_DOWN (bytes, lim->logical_block_size); + bytes =ALIGN_DOWN (bytes,bio_split_alignment (bio, lim));/* * Bio splitting may cause subtle trouble such as hang when doing sync
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/676 s390/syscalls: Avoid creation of arch/arch/ directory
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 0708967e2d56e370231fd07defa0d69f9ad125e8 ]
Building the kernel with ARCH=s390 creates a weird arch/arch/ directory.
$ find arch/arch arch/arch arch/arch/s390 arch/arch/s390/include arch/arch/s390/include/generated arch/arch/s390/include/generated/asm arch/arch/s390/include/generated/uapi arch/arch/s390/include/generated/uapi/asm
The root cause is 'targets' in arch/s390/kernel/syscalls/Makefile, where the relative path is incorrect.
Strictly speaking, 'targets' was not necessary in the first place because this Makefile uses 'filechk' instead of 'if_changed'.
However, this commit keeps it, as it will be useful when converting 'filechk' to 'if_changed' later.
--- arch/s390/kernel/syscalls/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/syscalls/Makefile +1 -1
@@ -12,7 +12,7 @@ kapi-hdrs-y := $(kapi)/unistd_nr.h uapi-hdrs-y := $(uapi)/unistd_32.h uapi-hdrs-y += $(uapi)/unistd_64.h -targets += $(addprefix ../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y)) +targets += $(addprefix ../../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y)) PHONY += kapi uapi
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/676 hfsplus: dont query the device logical block size multiple times
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ]
Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE.
While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size.
Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized.
Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096.
The produced KASAN report before the fix looks like this:
[ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589]
--- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-)
fs/hfsplus/hfsplus_fs.h +2 -1
@@ -156,6 +156,7 @@ struct hfsplus_sb_info {/* Runtime variables */ u32 blockoffset; +u32 min_io_size;sector_t part_start;sector_t sect_count;int fs_shift;
@@ -306,7 +307,7 @@ struct hfsplus_readdir_data {*/ static inline unsigned short hfsplus_min_io_size (struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size,HFSPLUS_SECTOR_SIZE ); }
fs/hfsplus/wrapper.c +2 -0
@@ -171,6 +171,8 @@ int hfsplus_read_wrapper(struct super_block *sb)if (!blocksize) goto out; + sbi->min_io_size = blocksize; +if (hfsplus_get_last_session (sb, &part_start, &part_size)) goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/676 ext4: remove calls to to set/clear the folio error flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit ea4fd933ab4310822e244af28d22ff63785dea0e ]
Nobody checks this flag on ext4 folios, stop setting and clearing it.
Stable-dep-of: 2f3d93e210b9 ("ext4: fix race in buffer_head read fault injection")
--- fs/ext4/move_extent.c | 4 +--- fs/ext4/page-io.c | 3 --- fs/ext4/readpage.c | 1 - 3 files changed, 1 insertion(+), 7 deletions(-)
fs/ext4/move_extent.c +1 -3
@@ -200,10 +200,8 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)continue ;if (!buffer_mapped (bh)) { err =ext4_get_block (inode, block, bh,0 ); -if (err) { -folio_set_error (folio); +if (err)return err; - }if (!buffer_mapped (bh)) {folio_zero_range (folio, block_start, blocksize);set_buffer_uptodate (bh);
fs/ext4/page-io.c +0 -3
@@ -117,7 +117,6 @@ static void ext4_finish_bio(struct bio *bio)if (bio->bi_status) {int err =blk_status_to_errno (bio->bi_status); -folio_set_error (folio);mapping_set_error (folio->mapping, err); } bh = head =folio_buffers (folio);
@@ -441,8 +440,6 @@ int ext4_bio_write_folio(struct ext4_io_submit *io, struct folio *folio,BUG_ON (!folio_test_locked (folio));BUG_ON (folio_test_writeback (folio)); -folio_clear_error (folio); -/* * Comments copied from block_write_full_page: *
fs/ext4/readpage.c +0 -1
@@ -296,7 +296,6 @@ int ext4_mpage_readpages(struct inode *inode,if (ext4_map_blocks (NULL , inode, &map,0 ) <0 ) { set_error_page: -folio_set_error (folio);folio_zero_segment (folio,0 ,folio_size (folio));folio_unlock (folio);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/676 ext4: pipeline buffer reads in mext_page_mkuptodate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 368a83cebbb949adbcc20877c35367178497d9cc ]
Instead of synchronously reading one buffer at a time, submit reads as we walk the buffers in the first loop, then wait for them in the second loop. This should be significantly more efficient, particularly on HDDs, but I have not measured.
Stable-dep-of: 2f3d93e210b9 ("ext4: fix race in buffer_head read fault injection")
--- fs/ext4/move_extent.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
fs/ext4/move_extent.c +15 -8
@@ -173,7 +173,9 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)sector_t block;struct buffer_head *bh, *head, *arr[MAX_BUF_PER_PAGE ];unsigned int blocksize, block_start, block_end; -int i, err, nr =0 , partial =0 ; +int i, nr =0 ; +bool partial = false; +BUG_ON (!folio_test_locked (folio));BUG_ON (folio_test_writeback (folio));
@@ -193,13 +195,13 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to) block_end = block_start + blocksize;if (block_end <= from || block_start >= to) {if (!buffer_uptodate (bh)) - partial =1 ; + partial = true;continue ; }if (buffer_uptodate (bh))continue ;if (!buffer_mapped (bh)) { - err =ext4_get_block (inode, block, bh,0 ); +int err =ext4_get_block (inode, block, bh,0 );if (err)return err;if (!buffer_mapped (bh)) {
@@ -208,6 +210,12 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)continue ; } } +lock_buffer (bh); +if (buffer_uptodate (bh)) { +unlock_buffer (bh); +continue ; + } +ext4_read_bh_nowait (bh,0 ,NULL );BUG_ON (nr >=MAX_BUF_PER_PAGE ); arr[nr++] = bh; }
@@ -217,11 +225,10 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)for (i =0 ; i < nr; i++) { bh = arr[i]; -if (!bh_uptodate_or_lock (bh)) { - err =ext4_read_bh (bh,0 ,NULL ); -if (err) -return err; - } +wait_on_buffer (bh); +if (buffer_uptodate (bh)) +continue ; +return -EIO ; } out:if (!partial)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/676 ext4: remove array of buffer_heads from mext_page_mkuptodate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit a40759fb16ae839f8c769174fde017564ea564ff ]
Iterate the folio's list of buffer_heads twice instead of keeping an array of pointers. This solves a too-large-array-for-stack problem on architectures with a ridiculoously large PAGE_SIZE and prepares ext4 to support larger folios.
Stable-dep-of: 2f3d93e210b9 ("ext4: fix race in buffer_head read fault injection")
--- fs/ext4/move_extent.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
fs/ext4/move_extent.c +12 -10
@@ -165,15 +165,14 @@ mext_folio_double_lock(struct inode *inode1, struct inode *inode2,return 0 ; } -/* Force page buffers uptodate w/o dropping page's lock */ -static int -mext_page_mkuptodate (struct folio *folio,unsigned from,unsigned to) +/* Force folio buffers uptodate w/o dropping folio's lock */ +static int mext_page_mkuptodate (struct folio *folio,size_t from,size_t to) {struct inode *inode = folio->mapping->host;sector_t block; -struct buffer_head *bh, *head, *arr[MAX_BUF_PER_PAGE ]; +struct buffer_head *bh, *head;unsigned int blocksize, block_start, block_end; -int i, nr =0 ; +int nr =0 ;bool partial = false;BUG_ON (!folio_test_locked (folio));
@@ -216,20 +215,23 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)continue ; }ext4_read_bh_nowait (bh,0 ,NULL ); -BUG_ON (nr >=MAX_BUF_PER_PAGE ); - arr[nr++] = bh; + nr++; }/* No io required */ if (!nr) goto out; -for (i =0 ; i < nr; i++) { - bh = arr[i]; + bh = head; +do { +if (bh_offset (bh) + blocksize <= from) +continue ; +if (bh_offset (bh) > to) +break ;wait_on_buffer (bh);if (buffer_uptodate (bh))continue ;return -EIO ; - } + }while ((bh = bh->b_this_page) != head); out:if (!partial)folio_mark_uptodate (folio);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/676 ext4: fix race in buffer_head read fault injection
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit 2f3d93e210b9c2866c8b3662adae427d5bf511ec ]
When I enabled ext4 debug for fault injection testing, I encountered the following warning:
EXT4-fs error (device sda): ext4_read_inode_bitmap:201: comm fsstress:
Cannot read inode bitmap - block_group = 8, inode_bitmap = 1051
WARNING: CPU: 0 PID: 511 at fs/buffer.c:1181 mark_buffer_dirty+0x1b3/0x1d0
The root cause of the issue lies in the improper implementation of ext4's buffer_head read fault injection. The actual completion of buffer_head read and the buffer_head fault injection are not atomic, which can lead to the uptodate flag being cleared on normally used buffer_heads in race conditions.
[CPU0] [CPU1] [CPU2]ext4_read_inode_bitmap
ext4_read_bh()
<bh read complete>
ext4_read_inode_bitmap
if (buffer_uptodate(bh))
return bh
jbd2_journal_commit_transaction
__jbd2_journal_refile_buffer
__jbd2_journal_unfile_buffer
__jbd2_journal_temp_unlink_buffer
ext4_simulate_fail_bh()
clear_buffer_uptodate
mark_buffer_dirty
<report warning> WARN_ON_ONCE(!buffer_uptodate(bh))
The best approach would be to perform fault injection in the IO completion callback function, rather than after IO completion. However, the IO completion callback function cannot get the fault injection code in sb.
Fix it by passing the result of fault injection into the bh read function, we simulate faults within the bh read function itself. This requires adding an extra parameter to the bh read functions that need fault injection.
--- fs/ext4/balloc.c | 4 ++-- fs/ext4/ext4.h | 12 ++---------- fs/ext4/extents.c | 2 +- fs/ext4/ialloc.c | 5 +++-- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 4 ++-- fs/ext4/mmp.c | 2 +- fs/ext4/move_extent.c | 2 +- fs/ext4/resize.c | 2 +- fs/ext4/super.c | 23 +++++++++++++++-------- 10 files changed, 29 insertions(+), 29 deletions(-)
fs/ext4/balloc.c +2 -2
@@ -545,7 +545,8 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group,trace_ext4_read_block_bitmap_load (sb, block_group, ignore_locked);ext4_read_bh_nowait (bh,REQ_META |REQ_PRIO | (ignore_locked ?REQ_RAHEAD :0 ), - ext4_end_bitmap_read); + ext4_end_bitmap_read, +ext4_simulate_fail (sb,EXT4_SIM_BBITMAP_EIO ));return bh; verify: err =ext4_validate_block_bitmap (sb, desc, block_group, bh);
@@ -569,7 +570,6 @@ int ext4_wait_block_bitmap(struct super_block *sb, ext4_group_t block_group,if (!desc)return -EFSCORRUPTED ;wait_on_buffer (bh); -ext4_simulate_fail_bh (sb, bh,EXT4_SIM_BBITMAP_EIO );if (!buffer_uptodate (bh)) { ext4_error_err(sb, EIO, "Cannot read block bitmap - " "block_group = %u, block_bitmap = %llu",
fs/ext4/ext4.h +2 -10
@@ -1849,14 +1849,6 @@ static inline bool ext4_simulate_fail(struct super_block *sb,return false; } -static inline void ext4_simulate_fail_bh (struct super_block *sb, -struct buffer_head *bh, -unsigned long code) -{ -if (!IS_ERR (bh) &&ext4_simulate_fail (sb, code)) -clear_buffer_uptodate (bh); -} -/* * Error number codes for s_{first,last}_error_errno *
@@ -3072,9 +3064,9 @@ extern struct buffer_head *ext4_sb_bread(struct super_block *sb,extern struct buffer_head *ext4_sb_bread_unmovable (struct super_block *sb,sector_t block);extern void ext4_read_bh_nowait (struct buffer_head *bh,blk_opf_t op_flags, -bh_end_io_t *end_io); +bh_end_io_t *end_io,bool simu_fail);extern int ext4_read_bh (struct buffer_head *bh,blk_opf_t op_flags, -bh_end_io_t *end_io); +bh_end_io_t *end_io,bool simu_fail);extern int ext4_read_bh_lock (struct buffer_head *bh,blk_opf_t op_flags,bool wait);extern void ext4_sb_breadahead_unmovable (struct super_block *sb,sector_t block);extern int ext4_seq_options_show (struct seq_file *seq,void *offset);
fs/ext4/extents.c +1 -1
@@ -564,7 +564,7 @@ __read_extent_tree_block(const char *function, unsigned int line,if (!bh_uptodate_or_lock (bh)) {trace_ext4_ext_load_extent (inode, pblk, _RET_IP_); - err =ext4_read_bh (bh,0 ,NULL ); + err =ext4_read_bh (bh,0 ,NULL , false);if (err <0 ) goto errout; }
fs/ext4/ialloc.c +3 -2
@@ -194,8 +194,9 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)* submit the buffer_head for reading */ trace_ext4_load_inode_bitmap (sb, block_group); -ext4_read_bh (bh,REQ_META |REQ_PRIO , ext4_end_bitmap_read); -ext4_simulate_fail_bh (sb, bh,EXT4_SIM_IBITMAP_EIO ); +ext4_read_bh (bh,REQ_META |REQ_PRIO , + ext4_end_bitmap_read, +ext4_simulate_fail (sb,EXT4_SIM_IBITMAP_EIO ));if (!buffer_uptodate (bh)) {put_bh (bh); ext4_error_err(sb, EIO, "Cannot read inode bitmap - "
fs/ext4/indirect.c +1 -1
@@ -170,7 +170,7 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth, }if (!bh_uptodate_or_lock (bh)) { -if (ext4_read_bh (bh,0 ,NULL ) <0 ) { +if (ext4_read_bh (bh,0 ,NULL , false) <0 ) {put_bh (bh); goto failure; }
fs/ext4/inode.c +2 -2
@@ -4508,10 +4508,10 @@ static int __ext4_get_inode_loc(struct super_block *sb, unsigned long ino,* Read the block from disk. */ trace_ext4_load_inode (sb, ino); -ext4_read_bh_nowait (bh,REQ_META |REQ_PRIO ,NULL ); +ext4_read_bh_nowait (bh,REQ_META |REQ_PRIO ,NULL , +ext4_simulate_fail (sb,EXT4_SIM_INODE_EIO ));blk_finish_plug (&plug);wait_on_buffer (bh); -ext4_simulate_fail_bh (sb, bh,EXT4_SIM_INODE_EIO );if (!buffer_uptodate (bh)) {if (ret_block) *ret_block = block;
fs/ext4/mmp.c +1 -1
@@ -94,7 +94,7 @@ static int read_mmp_block(struct super_block *sb, struct buffer_head **bh, }lock_buffer (*bh); - ret =ext4_read_bh (*bh,REQ_META |REQ_PRIO ,NULL ); + ret =ext4_read_bh (*bh,REQ_META |REQ_PRIO ,NULL , false);if (ret) goto warn_exit;
fs/ext4/move_extent.c +1 -1
@@ -214,7 +214,7 @@ static int mext_page_mkuptodate(struct folio *folio, size_t from, size_t to)unlock_buffer (bh);continue ; } -ext4_read_bh_nowait (bh,0 ,NULL ); +ext4_read_bh_nowait (bh,0 ,NULL , false); nr++; }/* No io required */
fs/ext4/resize.c +1 -1
@@ -1301,7 +1301,7 @@ static struct buffer_head *ext4_get_bitmap(struct super_block *sb, __u64 block)if (unlikely (!bh))return NULL ;if (!bh_uptodate_or_lock (bh)) { -if (ext4_read_bh (bh,0 ,NULL ) <0 ) { +if (ext4_read_bh (bh,0 ,NULL , false) <0 ) {brelse (bh);return NULL ; }
fs/ext4/super.c +15 -8
@@ -161,8 +161,14 @@ MODULE_ALIAS("ext3");static inline void __ext4_read_bh (struct buffer_head *bh,blk_opf_t op_flags, -bh_end_io_t *end_io) +bh_end_io_t *end_io,bool simu_fail) { +if (simu_fail) { +clear_buffer_uptodate (bh); +unlock_buffer (bh); +return ; + } +/* * buffer's verified bit is no longer valid after reading from * disk again due to write out error, clear it to make sure we
@@ -176,7 +182,7 @@ static inline void __ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, }void ext4_read_bh_nowait (struct buffer_head *bh,blk_opf_t op_flags, -bh_end_io_t *end_io) +bh_end_io_t *end_io,bool simu_fail) {BUG_ON (!buffer_locked (bh));
@@ -184,10 +190,11 @@ void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags,unlock_buffer (bh);return ; } -__ext4_read_bh (bh, op_flags, end_io); +__ext4_read_bh (bh, op_flags, end_io, simu_fail); } -int ext4_read_bh (struct buffer_head *bh,blk_opf_t op_flags,bh_end_io_t *end_io) +int ext4_read_bh (struct buffer_head *bh,blk_opf_t op_flags, +bh_end_io_t *end_io,bool simu_fail) {BUG_ON (!buffer_locked (bh));
@@ -196,7 +203,7 @@ int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, bh_end_io_t *end_ioreturn 0 ; } -__ext4_read_bh (bh, op_flags, end_io); +__ext4_read_bh (bh, op_flags, end_io, simu_fail);wait_on_buffer (bh);if (buffer_uptodate (bh))
@@ -208,10 +215,10 @@ int ext4_read_bh_lock(struct buffer_head *bh, blk_opf_t op_flags, bool wait) {lock_buffer (bh);if (!wait) { -ext4_read_bh_nowait (bh, op_flags,NULL ); +ext4_read_bh_nowait (bh, op_flags,NULL , false);return 0 ; } -return ext4_read_bh (bh, op_flags,NULL ); +return ext4_read_bh (bh, op_flags,NULL , false); }/*
@@ -259,7 +266,7 @@ void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block)if (likely (bh)) {if (trylock_buffer (bh)) -ext4_read_bh_nowait (bh,REQ_RAHEAD ,NULL ); +ext4_read_bh_nowait (bh,REQ_RAHEAD ,NULL , false);brelse (bh); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/676 nvme-pci: reverse request order in nvme_queue_rqs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit beadf0088501d9dcf2454b05d90d5d31ea3ba55f ]
blk_mq_flush_plug_list submits requests in the reverse order that they were submitted, which leads to a rather suboptimal I/O pattern especially in rotational devices. Fix this by rewriting nvme_queue_rqs so that it always pops the requests from the passed in request list, and then adds them to the head of a local submit list. This actually simplifies the code a bit as it removes the complicated list splicing, at the cost of extra updates of the rq_next pointer. As that should be cache hot anyway it should be an easy price to pay.
--- drivers/nvme/host/pci.c | 39 +++++++++++++++++---------------------- 1 file changed, 17 insertions(+), 22 deletions(-)
drivers/nvme/host/pci.c +17 -22
@@ -905,9 +905,10 @@ static blk_status_t nvme_queue_rq(struct blk_mq_hw_ctx *hctx,static void nvme_submit_cmds (struct nvme_queue *nvmeq,struct request **rqlist) { +struct request *req; +spin_lock (&nvmeq->sq_lock); -while (!rq_list_empty (*rqlist)) { -struct request *req =rq_list_pop (rqlist); +while ((req =rq_list_pop (rqlist))) {struct nvme_iod *iod =blk_mq_rq_to_pdu (req);nvme_sq_copy_cmd (nvmeq, &iod->cmd);
@@ -933,31 +934,25 @@ static bool nvme_prep_rq_batch(struct nvme_queue *nvmeq, struct request *req)static void nvme_queue_rqs (struct request **rqlist) { -struct request *req, *next, *prev =NULL ; +struct request *submit_list =NULL ;struct request *requeue_list =NULL ; +struct request **requeue_lastp = &requeue_list; +struct nvme_queue *nvmeq =NULL ; +struct request *req; -rq_list_for_each_safe (rqlist, req, next) { -struct nvme_queue *nvmeq = req->mq_hctx->driver_data; - -if (!nvme_prep_rq_batch (nvmeq, req)) { -/* detach 'req' and add to remainder list */ -rq_list_move (rqlist, &requeue_list, req, prev); - - req = prev; -if (!req) -continue ; - } +while ((req =rq_list_pop (rqlist))) { +if (nvmeq && nvmeq != req->mq_hctx->driver_data) +nvme_submit_cmds (nvmeq, &submit_list); + nvmeq = req->mq_hctx->driver_data; -if (!next || req->mq_hctx != next->mq_hctx) { -/* detach rest of list, and submit */ - req->rq_next =NULL ; -nvme_submit_cmds (nvmeq, rqlist); - *rqlist = next; - prev =NULL ; - }else - prev = req; +if (nvme_prep_rq_batch (nvmeq, req)) +rq_list_add (&submit_list, req);/* reverse order */ +else +rq_list_add_tail (&requeue_lastp, req); } +if (nvmeq) +nvme_submit_cmds (nvmeq, &submit_list); *rqlist = requeue_list; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/676 virtio_blk: reverse request order in virtio_queue_rqs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 7f212e997edbb7a2cb85cef2ac14265dfaf88717 ]
blk_mq_flush_plug_list submits requests in the reverse order that they were submitted, which leads to a rather suboptimal I/O pattern especially in rotational devices. Fix this by rewriting virtio_queue_rqs so that it always pops the requests from the passed in request list, and then adds them to the head of a local submit list. This actually simplifies the code a bit as it removes the complicated list splicing, at the cost of extra updates of the rq_next pointer. As that should be cache hot anyway it should be an easy price to pay.
--- drivers/block/virtio_blk.c | 46 +++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 25 deletions(-)
drivers/block/virtio_blk.c +21 -25
@@ -475,18 +475,18 @@ static bool virtblk_prep_rq_batch(struct request *req)return virtblk_prep_rq (req->mq_hctx, vblk, req, vbr) ==BLK_STS_OK ; } -static bool virtblk_add_req_batch (struct virtio_blk_vq *vq, +static void virtblk_add_req_batch (struct virtio_blk_vq *vq,struct request **rqlist) { +struct request *req;unsigned long flags; -int err;bool kick;spin_lock_irqsave (&vq->lock, flags); -while (!rq_list_empty (*rqlist)) { -struct request *req =rq_list_pop (rqlist); +while ((req =rq_list_pop (rqlist))) {struct virtblk_req *vbr =blk_mq_rq_to_pdu (req); +int err; err =virtblk_add_req (vq->vq, vbr);if (err) {
@@ -499,37 +499,33 @@ static bool virtblk_add_req_batch(struct virtio_blk_vq *vq, kick =virtqueue_kick_prepare (vq->vq);spin_unlock_irqrestore (&vq->lock, flags); -return kick; +if (kick) +virtqueue_notify (vq->vq); }static void virtio_queue_rqs (struct request **rqlist) { -struct request *req, *next, *prev =NULL ; +struct request *submit_list =NULL ;struct request *requeue_list =NULL ; +struct request **requeue_lastp = &requeue_list; +struct virtio_blk_vq *vq =NULL ; +struct request *req; -rq_list_for_each_safe (rqlist, req, next) { -struct virtio_blk_vq *vq =get_virtio_blk_vq (req->mq_hctx); -bool kick; - -if (!virtblk_prep_rq_batch (req)) { -rq_list_move (rqlist, &requeue_list, req, prev); - req = prev; -if (!req) -continue ; - } +while ((req =rq_list_pop (rqlist))) { +struct virtio_blk_vq *this_vq =get_virtio_blk_vq (req->mq_hctx); -if (!next || req->mq_hctx != next->mq_hctx) { - req->rq_next =NULL ; - kick =virtblk_add_req_batch (vq, rqlist); -if (kick) -virtqueue_notify (vq->vq); +if (vq && vq != this_vq) +virtblk_add_req_batch (vq, &submit_list); + vq = this_vq; - *rqlist = next; - prev =NULL ; - }else - prev = req; +if (virtblk_prep_rq_batch (req)) +rq_list_add (&submit_list, req);/* reverse order */ +else +rq_list_add_tail (&requeue_lastp, req); } +if (vq) +virtblk_add_req_batch (vq, &submit_list); *rqlist = requeue_list; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/676 crypto: caam - Fix the pointer passed to caam_qi_shutdown()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit ad980b04f51f7fb503530bd1cb328ba5e75a250e ]
The type of the last parameter given to devm_add_action_or_reset() is "struct caam_drv_private *", but in caam_qi_shutdown(), it is casted to "struct device *".
Pass the correct parameter to devm_add_action_or_reset() so that the resources are released as expected.
--- drivers/crypto/caam/qi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/caam/qi.c +1 -1
@@ -772,7 +772,7 @@ int caam_qi_init(struct platform_device *caam_pdev)caam_debugfs_qi_init (ctrlpriv); - err =devm_add_action_or_reset (qidev, caam_qi_shutdown, ctrlpriv); + err =devm_add_action_or_reset (qidev, caam_qi_shutdown, qidev);if (err)return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/676 crypto: qat - remove check after debugfs_create_dir()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cabiddu, Giovanni <[email protected]>
[ Upstream commit 23717055a79981daf7fafa09a4b0d7566f8384aa ]
The debugfs functions are guaranteed to return a valid error code instead of NULL upon failure. Consequently, the driver can directly propagate any error returned without additional checks.
Remove the unnecessary if statement after debugfs_create_dir(). If this function fails, the error code is stored in accel_dev->debugfs_dir and utilized in subsequent debugfs calls.
Additionally, since accel_dev->debugfs_dir is assured to be non-NULL, remove the superfluous NULL pointer checks within the adf_dbgfs_add() and adf_dbgfs_rm().
--- drivers/crypto/intel/qat/qat_common/adf_dbgfs.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-)
drivers/crypto/intel/qat/qat_common/adf_dbgfs.c +1 -12
@@ -19,18 +19,13 @@void adf_dbgfs_init (struct adf_accel_dev *accel_dev) {char name[ADF_DEVICE_NAME_LENGTH ]; -void *ret;/* Create dev top level debugfs entry */ snprintf (name,sizeof (name),"%s%s_%s" ,ADF_DEVICE_NAME_PREFIX , accel_dev->hw_device->dev_class->name,pci_name (accel_dev->accel_pci_dev.pci_dev)); - ret =debugfs_create_dir (name,NULL ); -if (IS_ERR_OR_NULL (ret)) -return ; - - accel_dev->debugfs_dir = ret; + accel_dev->debugfs_dir =debugfs_create_dir (name,NULL );adf_cfg_dev_dbgfs_add (accel_dev); }
@@ -56,9 +51,6 @@ EXPORT_SYMBOL_GPL(adf_dbgfs_exit);*/ void adf_dbgfs_add (struct adf_accel_dev *accel_dev) { -if (!accel_dev->debugfs_dir) -return ; -if (!accel_dev->is_vf) {adf_fw_counters_dbgfs_add (accel_dev);adf_heartbeat_dbgfs_add (accel_dev);
@@ -71,9 +63,6 @@ void adf_dbgfs_add(struct adf_accel_dev *accel_dev)*/ void adf_dbgfs_rm (struct adf_accel_dev *accel_dev) { -if (!accel_dev->debugfs_dir) -return ; -if (!accel_dev->is_vf) {adf_heartbeat_dbgfs_rm (accel_dev);adf_fw_counters_dbgfs_rm (accel_dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/676 crypto: qat/qat_4xxx - fix off by one in uof_get_name()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 475b5098043eef6e72751aadeab687992a5b63d1 ]
The fw_objs[] array has "num_objs" elements so the > needs to be >= to prevent an out of bounds read.
--- drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c +1 -1
@@ -473,7 +473,7 @@ static const char *uof_get_name(struct adf_accel_dev *accel_dev, u32 obj_num,else id = -EINVAL ; -if (id <0 || id > num_objs) +if (id <0 || id >= num_objs)return NULL ;return fw_objs[id];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/676 firmware: google: Unregister driver_info on failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 32b0901e141f6d4cf49d820b53eb09b88b1f72f7 ]
When platform_device_register_full() returns error, the gsmi_init() returns without unregister gsmi_driver_info, fix by add missing platform_driver_unregister() when platform_device_register_full() failed.
--- drivers/firmware/google/gsmi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/firmware/google/gsmi.c +4 -2
@@ -918,7 +918,8 @@ static __init int gsmi_init(void) gsmi_dev.pdev =platform_device_register_full (&gsmi_dev_info);if (IS_ERR (gsmi_dev.pdev)) {printk (KERN_ERR "gsmi: unable to register platform device\n" ); -return PTR_ERR (gsmi_dev.pdev); + ret =PTR_ERR (gsmi_dev.pdev); + goto out_unregister; }/* SMI access needs to be serialized */
@@ -1056,10 +1057,11 @@ static __init int gsmi_init(void)gsmi_buf_free (gsmi_dev.name_buf);kmem_cache_destroy (gsmi_dev.mem_pool);platform_device_unregister (gsmi_dev.pdev); -pr_info ("gsmi: failed to load: %d\n" , ret); +out_unregister:#ifdef CONFIG_PM platform_driver_unregister (&gsmi_driver_info);#endif +pr_info ("gsmi: failed to load: %d\n" , ret);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/676 EDAC/bluefield: Fix potential integer overflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ]
The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument.
The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits.
--- drivers/edac/bluefield_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/edac/bluefield_edac.c +1 -1
@@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci)static void bluefield_edac_init_dimms (struct mem_ctl_info *mci) {struct bluefield_edac_priv *priv = mci->pvt_info; -int mem_ctrl_idx = mci->mc_idx; +u64 mem_ctrl_idx = mci->mc_idx;struct dimm_info *dimm;u64 smc_info, smc_arg;int is_empty =1 , i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/676 crypto: qat - remove faulty arbiter config reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahsan Atta <[email protected]>
[ Upstream commit 70199359902f1c7187dcb28a1be679a7081de7cc ]
Resetting the service arbiter config can cause potential issues related to response ordering and ring flow control check in the event of AER or device hang. This is because it results in changing the default response ring size from 32 bytes to 16 bytes. The service arbiter config reset also disables response ring flow control check. Thus, by removing this reset we can prevent the service arbiter from being configured inappropriately, which leads to undesired device behaviour in the event of errors.
--- drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c +0 -4
@@ -90,10 +90,6 @@ void adf_exit_arb(struct adf_accel_dev *accel_dev) hw_data->get_arb_info (&info); -/* Reset arbiter configuration */ -for (i =0 ; i <ADF_ARB_NUM ; i++) -WRITE_CSR_ARB_SARCONFIG (csr, arb_off, i,0 ); -/* Unmap worker threads to service arbiters */ for (i =0 ; i < hw_data->num_engines; i++)WRITE_CSR_ARB_WT2SAM (csr, arb_off, wt_off, i,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/676 thermal: core: Initialize thermal zones before registering them
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 662f920f7e390db5d1a6792a2b0ffa59b6c962fc ]
Since user space can start interacting with a new thermal zone as soon as device_register() called by thermal_zone_device_register_with_trips() returns, it is better to initialize the thermal zone before calling device_register() on it.
--- drivers/thermal/thermal_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/thermal_core.c +1 -1
@@ -1336,6 +1336,7 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *tthermal_zone_destroy_device_groups (tz); goto remove_id; } +thermal_zone_device_init (tz); result =device_register (&tz->device);if (result) goto release_device;
@@ -1381,7 +1382,6 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *tINIT_DELAYED_WORK (&tz->poll_queue, thermal_zone_device_check); -thermal_zone_device_init (tz);/* Update the new thermal zone and mark it as already updated. */ if (atomic_cmpxchg (&tz->need_update,1 ,0 ))thermal_zone_device_update (tz,THERMAL_EVENT_UNSPECIFIED );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/676 EDAC/fsl_ddr: Fix bad bit shift operations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Priyanka Singh <[email protected]>
[ Upstream commit 9ec22ac4fe766c6abba845290d5139a3fbe0153b ]
Fix undefined behavior caused by left-shifting a negative value in the expression:
cap_high ^ (1 << (bad_data_bit - 32))
The variable bad_data_bit ranges from 0 to 63. When it is less than 32, bad_data_bit - 32 becomes negative, and left-shifting by a negative value in C is undefined behavior.
Fix this by combining cap_high and cap_low into a 64-bit variable.
[ bp: Massage commit message, simplify error bits handling. ]
--- drivers/edac/fsl_ddr_edac.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
drivers/edac/fsl_ddr_edac.c +13 -9
@@ -328,21 +328,25 @@ static void fsl_mc_check(struct mem_ctl_info *mci)* TODO: Add support for 32-bit wide buses */ if ((err_detect &DDR_EDE_SBE ) && (bus_width ==64 )) { +u64 cap = (u64 )cap_high <<32 | cap_low; +u32 s = syndrome; +sbe_ecc_decode (cap_high, cap_low, syndrome, &bad_data_bit, &bad_ecc_bit); -if (bad_data_bit !=-1 ) -fsl_mc_printk (mci,KERN_ERR , -"Faulty Data bit: %d\n" , bad_data_bit); -if (bad_ecc_bit !=-1 ) -fsl_mc_printk (mci,KERN_ERR , -"Faulty ECC bit: %d\n" , bad_ecc_bit); +if (bad_data_bit >=0 ) { +fsl_mc_printk (mci,KERN_ERR ,"Faulty Data bit: %d\n" , bad_data_bit); + cap ^=1ULL << bad_data_bit; + } + +if (bad_ecc_bit >=0 ) { +fsl_mc_printk (mci,KERN_ERR ,"Faulty ECC bit: %d\n" , bad_ecc_bit); + s ^=1 << bad_ecc_bit; + }fsl_mc_printk (mci,KERN_ERR ,"Expected Data / ECC:\t%#8.8x_%08x / %#2.2x\n" , - cap_high ^ (1 << (bad_data_bit -32 )), - cap_low ^ (1 << bad_data_bit), - syndrome ^ (1 << bad_ecc_bit)); +upper_32_bits (cap),lower_32_bits (cap), s); } fsl_mc_printk(mci, KERN_ERR,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/676 EDAC/skx_common: Differentiate memory error sources
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 2397f795735219caa9c2fe61e7bcdd0652e670d3 ]
The current skx_common determines whether the memory error source is the near memory of the 2LM system and then retrieves the decoded error results from the ADXL components (near-memory vs. far-memory) accordingly.
However, some memory controllers may have limitations in correctly reporting the memory error source, leading to the retrieval of incorrect decoded parts from the ADXL.
To address these limitations, instead of simply determining whether the memory error is from the near memory of the 2LM system, it is necessary to distinguish the memory error source details as follows:
Memory error from the near memory of the 2LM system. Memory error from the far memory of the 2LM system. Memory error from the 1LM system.
Not a memory error.
This will enable the i10nm_edac driver to take appropriate actions for those memory controllers that have limitations in reporting the memory error source.
--- drivers/edac/skx_common.c | 34 ++++++++++++++++------------------ drivers/edac/skx_common.h | 7 +++++++ 2 files changed, 23 insertions(+), 18 deletions(-)
drivers/edac/skx_common.c +16 -18
@@ -119,7 +119,7 @@ void skx_adxl_put(void) }EXPORT_SYMBOL_GPL (skx_adxl_put); -static bool skx_adxl_decode (struct decoded_addr *res,bool error_in_1st_level_mem) +static bool skx_adxl_decode (struct decoded_addr *res,enum error_source err_src) {struct skx_dev *d;int i, len =0 ;
@@ -136,7 +136,7 @@ static bool skx_adxl_decode(struct decoded_addr *res, bool error_in_1st_level_me } res->socket = (int )adxl_values[component_indices[INDEX_SOCKET ]]; -if (error_in_1st_level_mem) { +if (err_src ==ERR_SRC_2LM_NM ) { res->imc = (adxl_nm_bitmap &BIT_NM_MEMCTRL ) ? (int )adxl_values[component_indices[INDEX_NM_MEMCTRL ]] :-1 ; res->channel = (adxl_nm_bitmap & BIT_NM_CHANNEL) ?
@@ -620,31 +620,27 @@ static void skx_mce_output_error(struct mem_ctl_info *mci, optype, skx_msg); } -static bool skx_error_in_1st_level_mem (const struct mce *m) +static enum error_source skx_error_source (const struct mce *m) { -u32 errcode; +u32 errcode =GET_BITFIELD (m->status,0 ,15 ) &MCACOD_MEM_ERR_MASK ; -if (!skx_mem_cfg_2lm) -return false; - - errcode =GET_BITFIELD (m->status,0 ,15 ) &MCACOD_MEM_ERR_MASK ; - -return errcode ==MCACOD_EXT_MEM_ERR ; -} +if (errcode !=MCACOD_MEM_CTL_ERR && errcode !=MCACOD_EXT_MEM_ERR ) +return ERR_SRC_NOT_MEMORY ; -static bool skx_error_in_mem (const struct mce *m) -{ -u32 errcode; +if (!skx_mem_cfg_2lm) +return ERR_SRC_1LM ; - errcode =GET_BITFIELD (m->status,0 ,15 ) &MCACOD_MEM_ERR_MASK ; +if (errcode ==MCACOD_EXT_MEM_ERR ) +return ERR_SRC_2LM_NM ; -return (errcode ==MCACOD_MEM_CTL_ERR || errcode ==MCACOD_EXT_MEM_ERR ); +return ERR_SRC_2LM_FM ; }int skx_mce_check_error (struct notifier_block *nb,unsigned long val,void *data) {struct mce *mce = (struct mce *)data; +enum error_source err_src;struct decoded_addr res;struct mem_ctl_info *mci;char *type;
@@ -652,8 +648,10 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val,if (mce->kflags &MCE_HANDLED_CEC )return NOTIFY_DONE ; + err_src =skx_error_source (mce); +/* Ignore unless this is memory related with an address */ -if (!skx_error_in_mem (mce) || !(mce->status &MCI_STATUS_ADDRV )) +if (err_src ==ERR_SRC_NOT_MEMORY || !(mce->status &MCI_STATUS_ADDRV ))return NOTIFY_DONE ;memset (&res,0 ,sizeof (res));
@@ -667,7 +665,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val,/* Try driver decoder first */ if (!(driver_decode &&driver_decode (&res))) {/* Then try firmware decoder (ACPI DSM methods) */ -if (!(adxl_component_count &&skx_adxl_decode (&res,skx_error_in_1st_level_mem (mce)))) +if (!(adxl_component_count &&skx_adxl_decode (&res, err_src)))return NOTIFY_DONE ; }
drivers/edac/skx_common.h +7 -0
@@ -147,6 +147,13 @@ enum { INDEX_MAX }; +enum error_source { +ERR_SRC_1LM , +ERR_SRC_2LM_NM , +ERR_SRC_2LM_FM , +ERR_SRC_NOT_MEMORY , +}; +#define BIT_NM_MEMCTRL BIT_ULL(INDEX_NM_MEMCTRL)#define BIT_NM_CHANNEL BIT_ULL(INDEX_NM_CHANNEL)#define BIT_NM_DIMM BIT_ULL(INDEX_NM_DIMM)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/676 EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit a36667037a0c0e36c59407f8ae636295390239a5 ]
The Granite Rapids CPUs with Flat2LM memory configurations may mistakenly report near-memory errors as far-memory errors, resulting in the invalid decoded ADXL results:
EDAC skx: Bad imc -1
Fix this incorrect far-memory error source indicator by prefetching the decoded far-memory controller ID, and adjust the error source indicator to near-memory if the far-memory controller ID is invalid.
--- drivers/edac/i10nm_base.c | 1 + drivers/edac/skx_common.c | 23 +++++++++++++++++++++++ drivers/edac/skx_common.h | 1 + 3 files changed, 25 insertions(+)
drivers/edac/i10nm_base.c +1 -0
@@ -1088,6 +1088,7 @@ static int __init i10nm_init(void)return -ENODEV ; cfg = (struct res_config *)id->driver_data; +skx_set_res_cfg (cfg); res_cfg = cfg; rc =skx_get_hi_lo (0x09a2 , off, &tolm, &tohm);
drivers/edac/skx_common.c +23 -0
@@ -47,6 +47,7 @@ static skx_show_retry_log_f skx_show_retry_rd_err_log;static u64 skx_tolm, skx_tohm;static LIST_HEAD (dev_edac_list);static bool skx_mem_cfg_2lm; +static struct res_config *skx_res_cfg;int skx_adxl_get (void ) {
@@ -135,6 +136,22 @@ static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src)return false; } +/* +* GNR with a Flat2LM memory configuration may mistakenly classify +* a near-memory error(DDR5) as a far-memory error(CXL), resulting +* in the incorrect selection of decoded ADXL components. +* To address this, prefetch the decoded far-memory controller ID +* and adjust the error source to near-memory if the far-memory +* controller ID is invalid. +*/ +if (skx_res_cfg && skx_res_cfg->type ==GNR && err_src ==ERR_SRC_2LM_FM ) { + res->imc = (int )adxl_values[component_indices[INDEX_MEMCTRL ]]; +if (res->imc ==-1 ) { + err_src =ERR_SRC_2LM_NM ; +edac_dbg (0 ,"Adjust the error source to near-memory.\n" ); + } + } + res->socket = (int )adxl_values[component_indices[INDEX_SOCKET ]];if (err_src ==ERR_SRC_2LM_NM ) { res->imc = (adxl_nm_bitmap & BIT_NM_MEMCTRL) ?
@@ -191,6 +208,12 @@ void skx_set_mem_cfg(bool mem_cfg_2lm) }EXPORT_SYMBOL_GPL (skx_set_mem_cfg); +void skx_set_res_cfg (struct res_config *cfg) +{ + skx_res_cfg = cfg; +} +EXPORT_SYMBOL_GPL (skx_set_res_cfg); +void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log) { driver_decode = decode;
drivers/edac/skx_common.h +1 -0
@@ -242,6 +242,7 @@ int skx_adxl_get(void);void skx_adxl_put (void );void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log);void skx_set_mem_cfg (bool mem_cfg_2lm); +void skx_set_res_cfg (struct res_config *cfg);int skx_get_src_id (struct skx_dev *d,int off,u8 *id);int skx_get_node_id (struct skx_dev *d,u8 *id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/676 crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <[email protected]>
[ Upstream commit 662f2f13e66d3883b9238b0b96b17886179e60e2 ]
Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET"), the pcrypt encryption and decryption operations return -EAGAIN when the CPU goes online or offline. In alg_test(), a WARN is generated when pcrypt_aead_decrypt() or pcrypt_aead_encrypt() returns -EAGAIN, the unnecessary panic will occur when panic_on_warn set 1. Fix this issue by calling crypto layer directly without parallelization in that case.
--- crypto/pcrypt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
crypto/pcrypt.c +8 -4
@@ -117,8 +117,10 @@ static int pcrypt_aead_encrypt(struct aead_request *req) err =padata_do_parallel (ictx->psenc, padata, &ctx->cb_cpu);if (!err)return -EINPROGRESS ; -if (err == -EBUSY ) -return -EAGAIN ; +if (err == -EBUSY ) { +/* try non-parallel mode */ +return crypto_aead_encrypt (creq); + }return err; }
@@ -166,8 +168,10 @@ static int pcrypt_aead_decrypt(struct aead_request *req) err =padata_do_parallel (ictx->psdec, padata, &ctx->cb_cpu);if (!err)return -EINPROGRESS ; -if (err == -EBUSY ) -return -EAGAIN ; +if (err == -EBUSY ) { +/* try non-parallel mode */ +return crypto_aead_decrypt (creq); + }return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/676 crypto: cavium - Fix the if condition to exit loop after timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Everest K.C <[email protected]>
[ Upstream commit 53d91ca76b6c426c546542a44c78507b42008c9e ]
The while loop breaks in the first run because of incorrect if condition. It also causes the statements after the if to appear dead.
Fix this by changing the condition from if(timeout--) to if(!timeout--).
This bug was reported by Coverity Scan.
Report:
CID 1600859: (#1 of 1): Logically dead code (DEADCODE)dead_error_line: Execution cannot reach this statement: udelay(30UL);
--- drivers/crypto/cavium/cpt/cptpf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/cavium/cpt/cptpf_main.c +2 -2
@@ -44,7 +44,7 @@ static void cpt_disable_cores(struct cpt_device *cpt, u64 coremask,dev_err (dev,"Cores still busy %llx" , coremask); grp =cpt_read_csr64 (cpt->reg_base,CPTX_PF_EXEC_BUSY (0 )); -if (timeout--) +if (!timeout--)break ;udelay (CSR_DELAY );
@@ -394,7 +394,7 @@ static void cpt_disable_all_cores(struct cpt_device *cpt)dev_err (dev,"Cores still busy" ); grp =cpt_read_csr64 (cpt->reg_base,CPTX_PF_EXEC_BUSY (0 )); -if (timeout--) +if (!timeout--)break ;udelay (CSR_DELAY );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/676 amd-pstate: Set min_perf to nominal_perf for active mode performance gov
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 0c411b39e4f4ce8861301fa201cb4f817751311e ]
The amd-pstate driver sets CPPC_REQ.min_perf to CPPC_REQ.max_perf when in active mode with performance governor. Typically CPPC_REQ.max_perf is set to CPPC.highest_perf. This causes frequency throttling on power-limited platforms which causes performance regressions on certain classes of workloads.
Hence, set the CPPC_REQ.min_perf to the CPPC.nominal_perf or CPPC_REQ.max_perf, whichever is lower of the two.
--- drivers/cpufreq/amd-pstate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/amd-pstate.c +1 -1
@@ -1383,7 +1383,7 @@ static void amd_pstate_epp_update_limit(struct cpufreq_policy *policy) value =READ_ONCE (cpudata->cppc_req_cached);if (cpudata->policy ==CPUFREQ_POLICY_PERFORMANCE ) - min_perf = max_perf; + min_perf =min (cpudata->nominal_perf, max_perf);/* Initial min/max values for CPPC Performance Controls Register */ value &= ~AMD_CPPC_MIN_PERF (~0L );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/676 crypto: hisilicon/qm - disable same error report before resetting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <[email protected]>
[ Upstream commit c418ba6baca3ae10ffaf47b0803d2a9e6bf1af96 ]
If an error indicating that the device needs to be reset is reported, disable the error reporting before device reset is complete, enable the error reporting after the reset is complete to prevent the same error from being reported repeatedly.
--- drivers/crypto/hisilicon/hpre/hpre_main.c | 35 ++++++++++++++--- drivers/crypto/hisilicon/qm.c | 47 +++++++---------------- drivers/crypto/hisilicon/sec2/sec_main.c | 35 ++++++++++++++--- drivers/crypto/hisilicon/zip/zip_main.c | 35 ++++++++++++++--- include/linux/hisi_acc_qm.h | 8 +++- 5 files changed, 110 insertions(+), 50 deletions(-)
drivers/crypto/hisilicon/hpre/hpre_main.c +30 -5
@@ -1280,11 +1280,15 @@ static u32 hpre_get_hw_err_status(struct hisi_qm *qm)static void hpre_clear_hw_err_status (struct hisi_qm *qm,u32 err_sts) { -u32 nfe; -writel (err_sts, qm->io_base +HPRE_HAC_SOURCE_INT ); - nfe =hisi_qm_get_hw_info (qm, hpre_basic_info,HPRE_NFE_MASK_CAP , qm->cap_ver); -writel (nfe, qm->io_base +HPRE_RAS_NFE_ENB ); +} + +static void hpre_disable_error_report (struct hisi_qm *qm,u32 err_type) +{ +u32 nfe_mask; + + nfe_mask =hisi_qm_get_hw_info (qm, hpre_basic_info,HPRE_NFE_MASK_CAP , qm->cap_ver); +writel (nfe_mask & (~err_type), qm->io_base +HPRE_RAS_NFE_ENB ); }static void hpre_open_axi_master_ooo (struct hisi_qm *qm)
@@ -1298,6 +1302,27 @@ static void hpre_open_axi_master_ooo(struct hisi_qm *qm) qm->io_base + HPRE_AM_OOO_SHUTDOWN_ENB); } +static enum acc_err_result hpre_get_err_result (struct hisi_qm *qm) +{ +u32 err_status; + + err_status =hpre_get_hw_err_status (qm); +if (err_status) { +if (err_status & qm->err_info.ecc_2bits_mask) + qm->err_status.is_dev_ecc_mbit = true; +hpre_log_hw_error (qm, err_status); + +if (err_status & qm->err_info.dev_reset_mask) { +/* Disable the same error reporting until device is recovered. */ +hpre_disable_error_report (qm, err_status); +return ACC_ERR_NEED_RESET ; + } +hpre_clear_hw_err_status (qm, err_status); + } + +return ACC_ERR_RECOVERED ; +} +static void hpre_err_info_init (struct hisi_qm *qm) {struct hisi_qm_err_info *err_info = &qm->err_info;
@@ -1324,12 +1349,12 @@ static const struct hisi_qm_err_ini hpre_err_ini = { .hw_err_disable = hpre_hw_error_disable, .get_dev_hw_err_status = hpre_get_hw_err_status, .clear_dev_hw_err_status = hpre_clear_hw_err_status, - .log_dev_hw_err = hpre_log_hw_error, .open_axi_master_ooo = hpre_open_axi_master_ooo, .open_sva_prefetch = hpre_open_sva_prefetch, .close_sva_prefetch = hpre_close_sva_prefetch, .show_last_dfx_regs = hpre_show_last_dfx_regs, .err_info_init = hpre_err_info_init, + .get_err_result = hpre_get_err_result, };static int hpre_pf_probe_init (struct hpre *hpre)
drivers/crypto/hisilicon/qm.c +13 -34
77 lines not on this page · raw message
drivers/crypto/hisilicon/sec2/sec_main.c +30 -5
@@ -1006,11 +1006,15 @@ static u32 sec_get_hw_err_status(struct hisi_qm *qm)static void sec_clear_hw_err_status (struct hisi_qm *qm,u32 err_sts) { -u32 nfe; -writel (err_sts, qm->io_base +SEC_CORE_INT_SOURCE ); - nfe =hisi_qm_get_hw_info (qm, sec_basic_info,SEC_NFE_MASK_CAP , qm->cap_ver); -writel (nfe, qm->io_base +SEC_RAS_NFE_REG ); +} + +static void sec_disable_error_report (struct hisi_qm *qm,u32 err_type) +{ +u32 nfe_mask; + + nfe_mask =hisi_qm_get_hw_info (qm, sec_basic_info,SEC_NFE_MASK_CAP , qm->cap_ver); +writel (nfe_mask & (~err_type), qm->io_base +SEC_RAS_NFE_REG ); }static void sec_open_axi_master_ooo (struct hisi_qm *qm)
@@ -1022,6 +1026,27 @@ static void sec_open_axi_master_ooo(struct hisi_qm *qm)writel (val |SEC_AXI_SHUTDOWN_ENABLE , qm->io_base +SEC_CONTROL_REG ); } +static enum acc_err_result sec_get_err_result (struct hisi_qm *qm) +{ +u32 err_status; + + err_status =sec_get_hw_err_status (qm); +if (err_status) { +if (err_status & qm->err_info.ecc_2bits_mask) + qm->err_status.is_dev_ecc_mbit = true; +sec_log_hw_error (qm, err_status); + +if (err_status & qm->err_info.dev_reset_mask) { +/* Disable the same error reporting until device is recovered. */ +sec_disable_error_report (qm, err_status); +return ACC_ERR_NEED_RESET ; + } +sec_clear_hw_err_status (qm, err_status); + } + +return ACC_ERR_RECOVERED ; +} +static void sec_err_info_init (struct hisi_qm *qm) {struct hisi_qm_err_info *err_info = &qm->err_info;
@@ -1048,12 +1073,12 @@ static const struct hisi_qm_err_ini sec_err_ini = { .hw_err_disable = sec_hw_error_disable, .get_dev_hw_err_status = sec_get_hw_err_status, .clear_dev_hw_err_status = sec_clear_hw_err_status, - .log_dev_hw_err = sec_log_hw_error, .open_axi_master_ooo = sec_open_axi_master_ooo, .open_sva_prefetch = sec_open_sva_prefetch, .close_sva_prefetch = sec_close_sva_prefetch, .show_last_dfx_regs = sec_show_last_dfx_regs, .err_info_init = sec_err_info_init, + .get_err_result = sec_get_err_result, };static int sec_pf_probe_init (struct sec_dev *sec)
drivers/crypto/hisilicon/zip/zip_main.c +30 -5
@@ -1068,11 +1068,15 @@ static u32 hisi_zip_get_hw_err_status(struct hisi_qm *qm)static void hisi_zip_clear_hw_err_status (struct hisi_qm *qm,u32 err_sts) { -u32 nfe; -writel (err_sts, qm->io_base +HZIP_CORE_INT_SOURCE ); - nfe =hisi_qm_get_hw_info (qm, zip_basic_cap_info,ZIP_NFE_MASK_CAP , qm->cap_ver); -writel (nfe, qm->io_base +HZIP_CORE_INT_RAS_NFE_ENB ); +} + +static void hisi_zip_disable_error_report (struct hisi_qm *qm,u32 err_type) +{ +u32 nfe_mask; + + nfe_mask =hisi_qm_get_hw_info (qm, zip_basic_cap_info,ZIP_NFE_MASK_CAP , qm->cap_ver); +writel (nfe_mask & (~err_type), qm->io_base +HZIP_CORE_INT_RAS_NFE_ENB ); }static void hisi_zip_open_axi_master_ooo (struct hisi_qm *qm)
@@ -1102,6 +1106,27 @@ static void hisi_zip_close_axi_master_ooo(struct hisi_qm *qm) qm->io_base + HZIP_CORE_INT_SET); } +static enum acc_err_result hisi_zip_get_err_result (struct hisi_qm *qm) +{ +u32 err_status; + + err_status =hisi_zip_get_hw_err_status (qm); +if (err_status) { +if (err_status & qm->err_info.ecc_2bits_mask) + qm->err_status.is_dev_ecc_mbit = true; +hisi_zip_log_hw_error (qm, err_status); + +if (err_status & qm->err_info.dev_reset_mask) { +/* Disable the same error reporting until device is recovered. */ +hisi_zip_disable_error_report (qm, err_status); +return ACC_ERR_NEED_RESET ; + } +hisi_zip_clear_hw_err_status (qm, err_status); + } + +return ACC_ERR_RECOVERED ; +} +static void hisi_zip_err_info_init (struct hisi_qm *qm) {struct hisi_qm_err_info *err_info = &qm->err_info;
@@ -1129,13 +1154,13 @@ static const struct hisi_qm_err_ini hisi_zip_err_ini = { .hw_err_disable = hisi_zip_hw_error_disable, .get_dev_hw_err_status = hisi_zip_get_hw_err_status, .clear_dev_hw_err_status = hisi_zip_clear_hw_err_status, - .log_dev_hw_err = hisi_zip_log_hw_error, .open_axi_master_ooo = hisi_zip_open_axi_master_ooo, .close_axi_master_ooo = hisi_zip_close_axi_master_ooo, .open_sva_prefetch = hisi_zip_open_sva_prefetch, .close_sva_prefetch = hisi_zip_close_sva_prefetch, .show_last_dfx_regs = hisi_zip_show_last_dfx_regs, .err_info_init = hisi_zip_err_info_init, + .get_err_result = hisi_zip_get_err_result, };static int hisi_zip_pf_probe_init (struct hisi_zip *hisi_zip)
include/linux/hisi_acc_qm.h +7 -1
@@ -225,6 +225,12 @@ struct hisi_qm_status {struct hisi_qm ; +enum acc_err_result { +ACC_ERR_NONE , +ACC_ERR_NEED_RESET , +ACC_ERR_RECOVERED , +}; +struct hisi_qm_err_info {char *acpi_rst;u32 msi_wr_port;
@@ -253,9 +259,9 @@ struct hisi_qm_err_ini {void (*close_axi_master_ooo)(struct hisi_qm *qm);void (*open_sva_prefetch)(struct hisi_qm *qm);void (*close_sva_prefetch)(struct hisi_qm *qm); -void (*log_dev_hw_err)(struct hisi_qm *qm,u32 err_sts);void (*show_last_dfx_regs)(struct hisi_qm *qm);void (*err_info_init)(struct hisi_qm *qm); +enum acc_err_result (*get_err_result)(struct hisi_qm *qm); };struct hisi_qm_cap_info {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/676 EDAC/igen6: Avoid segmentation fault on module unload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orange Kao <[email protected]>
[ Upstream commit fefaae90398d38a1100ccd73b46ab55ff4610fba ]
The segmentation fault happens because:
During modprobe:
1. In igen6_probe(), igen6_pvt will be allocated with kzalloc()
2. In igen6_register_mci(), mci->pvt_info will point to &igen6_pvt->imc[mc]
During rmmod:
1. In mci_release() in edac_mc.c, it will kfree(mci->pvt_info)
2. In igen6_remove(), it will kfree(igen6_pvt);
Fix this issue by setting mci->pvt_info to NULL to avoid the double kfree.
--- drivers/edac/igen6_edac.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/edac/igen6_edac.c +2 -0
@@ -1075,6 +1075,7 @@ static int igen6_register_mci(int mc, u64 mchbar, struct pci_dev *pdev) imc->mci = mci;return 0 ; fail3: + mci->pvt_info =NULL ;kfree (mci->ctl_name); fail2:edac_mc_free (mci);
@@ -1099,6 +1100,7 @@ static void igen6_unregister_mcis(void)edac_mc_del_mc (mci->pdev);kfree (mci->ctl_name); + mci->pvt_info =NULL ;edac_mc_free (mci);iounmap (imc->window); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/676 crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
[ Upstream commit a10549fcce2913be7dc581562ffd8ea35653853e ]
The commit 320406cb60b6 ("crypto: inside-secure - Replace generic aes with libaes") replaced crypto_alloc_cipher() with kmalloc(), but did not modify the handling of the return value. When kmalloc() returns NULL, PTR_ERR_OR_ZERO(NULL) returns 0, but in fact, the memory allocation has failed, and -ENOMEM should be returned.
--- drivers/crypto/inside-secure/safexcel_hash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/inside-secure/safexcel_hash.c +1 -1
@@ -2093,7 +2093,7 @@ static int safexcel_xcbcmac_cra_init(struct crypto_tfm *tfm)safexcel_ahash_cra_init (tfm); ctx->aes =kmalloc (sizeof (*ctx->aes),GFP_KERNEL ); -return PTR_ERR_OR_ZERO (ctx->aes); +return ctx->aes ==NULL ? -ENOMEM :0 ; }static void safexcel_xcbcmac_cra_exit (struct crypto_tfm *tfm)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/676 doc: rcu: update printed dynticks counter bits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baruch Siach <[email protected]>
[ Upstream commit 4a09e358922381f9b258e863bcd9c910584203b9 ]
The stall warning prints 16 bits since commit 171476775d32 ("context_tracking: Convert state to atomic_t").
--- Documentation/RCU/stallwarn.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/RCU/stallwarn.rst +1 -1
@@ -249,7 +249,7 @@ ticks this GP)" indicates that this CPU has not taken any scheduling-clock interrupts during the current stalled grace period. The "idle=" portion of the message prints the dyntick-idle state. -The hex number before the first "/" is the low-order 12 bits of the +The hex number before the first "/" is the low-order 16 bits of the dynticks counter, which will have an even-numbered value if the CPU is in dyntick-idle mode and an odd-numbered value otherwise. The hex number between the two "/"s is the value of the nesting, which will be
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/676 rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uladzislau Rezki (Sony) <[email protected]>
[ Upstream commit a23da88c6c80e41e0503e0b481a22c9eea63f263 ]
KCSAN reports a data race when access the krcp->monitor_work.timer.expires variable in the schedule_delayed_monitor_work() function:
<snip>
BUG: KCSAN: data-race in __mod_timer / kvfree_call_rcu
read to 0xffff888237d1cce8 of 8 bytes by task 10149 on cpu 1:
schedule_delayed_monitor_work kernel/rcu/tree.c:3520 [inline] kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839 trie_update_elem+0x47c/0x620 kernel/bpf/lpm_trie.c:441 bpf_map_update_value+0x324/0x350 kernel/bpf/syscall.c:203 generic_map_update_batch+0x401/0x520 kernel/bpf/syscall.c:1849 bpf_map_do_batch+0x28c/0x3f0 kernel/bpf/syscall.c:5143 __sys_bpf+0x2e5/0x7a0 __do_sys_bpf kernel/bpf/syscall.c:5741 [inline] __se_sys_bpf kernel/bpf/syscall.c:5739 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5739 x64_sys_call+0x2625/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
write to 0xffff888237d1cce8 of 8 bytes by task 56 on cpu 0:
__mod_timer+0x578/0x7f0 kernel/time/timer.c:1173 add_timer_global+0x51/0x70 kernel/time/timer.c:1330 __queue_delayed_work+0x127/0x1a0 kernel/workqueue.c:2523 queue_delayed_work_on+0xdf/0x190 kernel/workqueue.c:2552 queue_delayed_work include/linux/workqueue.h:677 [inline] schedule_delayed_monitor_work kernel/rcu/tree.c:3525 [inline] kfree_rcu_monitor+0x5e8/0x660 kernel/rcu/tree.c:3643 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391 kthread+0x1d1/0x210 kernel/kthread.c:389 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 56 Comm: kworker/u8:4 Not tainted 6.12.0-rc2-syzkaller-00050-g5b7c893ed5ed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_unbound kfree_rcu_monitor
<snip>
kfree_rcu_monitor() rearms the work if a "krcp" has to be still offloaded and this is done without holding krcp->lock, whereas the kvfree_call_rcu() holds it.
Fix it by acquiring the "krcp->lock" for kfree_rcu_monitor() so both functions do not race anymore.
--- kernel/rcu/tree.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
kernel/rcu/tree.c +12 -2
@@ -3150,7 +3150,7 @@ static int krc_count(struct kfree_rcu_cpu *krcp) }static void -schedule_delayed_monitor_work (struct kfree_rcu_cpu *krcp) +__schedule_delayed_monitor_work (struct kfree_rcu_cpu *krcp) {long delay, delay_left;
@@ -3164,6 +3164,16 @@ schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp)queue_delayed_work (system_wq, &krcp->monitor_work, delay); } +static void +schedule_delayed_monitor_work (struct kfree_rcu_cpu *krcp) +{ +unsigned long flags; + +raw_spin_lock_irqsave (&krcp->lock, flags); +__schedule_delayed_monitor_work (krcp); +raw_spin_unlock_irqrestore (&krcp->lock, flags); +} +static void kvfree_rcu_drain_ready (struct kfree_rcu_cpu *krcp) {
@@ -3460,7 +3470,7 @@ void kvfree_call_rcu(struct rcu_head *head, void *ptr)// Set timer to drain after KFREE_DRAIN_JIFFIES. if (rcu_scheduler_active ==RCU_SCHEDULER_RUNNING ) -schedule_delayed_monitor_work (krcp); +__schedule_delayed_monitor_work (krcp); unlock_return:krc_this_cpu_unlock (krcp, flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/676 hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Rudolph <[email protected]>
[ Upstream commit 9c6df63a66c1fdf99d6e1ad278d140080c724120 ]
Use _pmbus_write_word_data to allow intercepting writes to PMBUS_SMBALERT_MASK in the custom chip specific code.
This is required for MP2971/MP2973 which doesn't follow the PMBUS specification for PMBUS_SMBALERT_MASK.
Stable-dep-of: 509c3a362675 ("hwmon: (pmbus/core) clear faults after setting smbalert mask")
--- drivers/hwmon/pmbus/pmbus_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/pmbus/pmbus_core.c +1 -1
@@ -3199,7 +3199,7 @@ static int pmbus_regulator_notify(struct pmbus_data *data, int page, int event)static int pmbus_write_smbalert_mask (struct i2c_client *client,u8 page,u8 reg,u8 val) { -return pmbus_write_word_data (client, page,PMBUS_SMBALERT_MASK , reg | (val <<8 )); +return _pmbus_write_word_data (client, page,PMBUS_SMBALERT_MASK , reg | (val <<8 )); }static irqreturn_t pmbus_fault_handler (int irq,void *pdata)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/676 hwmon: (pmbus/core) clear faults after setting smbalert mask
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 509c3a362675bc995771df74d545548f98e37621 ]
pmbus_write_smbalert_mask() ignores the errors if the chip can't set smbalert mask the standard way. It is not necessarily a problem for the irq support if the chip is otherwise properly setup but it may leave an uncleared fault behind.
pmbus_core will pick the fault on the next register_check(). The register check will fails regardless of the actual register support by the chip.
This leads to missing attributes or debugfs entries for chips that should provide them.
We cannot rely on register_check() as PMBUS_SMBALERT_MASK may be read-only.
Unconditionally clear the page fault after setting PMBUS_SMBALERT_MASK to avoid the problem.
Message-ID: <[email protected]>
--- drivers/hwmon/pmbus/pmbus_core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/hwmon/pmbus/pmbus_core.c +11 -1
@@ -3199,7 +3199,17 @@ static int pmbus_regulator_notify(struct pmbus_data *data, int page, int event)static int pmbus_write_smbalert_mask (struct i2c_client *client,u8 page,u8 reg,u8 val) { -return _pmbus_write_word_data (client, page,PMBUS_SMBALERT_MASK , reg | (val <<8 )); +int ret; + + ret =_pmbus_write_word_data (client, page,PMBUS_SMBALERT_MASK , reg | (val <<8 )); + +/* +* Clear fault systematically in case writing PMBUS_SMBALERT_MASK +* is not supported by the chip. +*/ +pmbus_clear_fault_page (client, page); + +return ret; }static irqreturn_t pmbus_fault_handler (int irq,void *pdata)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/676 hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit 57ee12b6c514146c19b6a159013b48727a012960 ]
DIV_ROUND_CLOSEST() after kstrtoul() results in an overflow if a large number such as 18446744073709551615 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.
Message-ID: <7d5084cea33f7c0fd0578c59adfff71f93de94d9.1731375425.git.xiaopei01@kylinos.cn>
--- drivers/hwmon/nct6775-core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/hwmon/nct6775-core.c +3 -4
@@ -2878,8 +2878,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr,if (err <0 )return err; - val =clamp_val (DIV_ROUND_CLOSEST (val,1000 ),0 , - data->target_temp_mask); + val =DIV_ROUND_CLOSEST (clamp_val (val,0 , data->target_temp_mask *1000 ),1000 );mutex_lock (&data->update_lock); data->target_temp[nr] = val;
@@ -2959,7 +2958,7 @@ store_temp_tolerance(struct device *dev, struct device_attribute *attr,return err;/* Limit tolerance as needed */ - val =clamp_val (DIV_ROUND_CLOSEST (val,1000 ),0 , data->tolerance_mask); + val =DIV_ROUND_CLOSEST (clamp_val (val,0 , data->tolerance_mask *1000 ),1000 );mutex_lock (&data->update_lock); data->temp_tolerance[index][nr] = val;
@@ -3085,7 +3084,7 @@ store_weight_temp(struct device *dev, struct device_attribute *attr,if (err <0 )return err; - val =clamp_val (DIV_ROUND_CLOSEST (val,1000 ),0 ,255 ); + val =DIV_ROUND_CLOSEST (clamp_val (val,0 ,255000 ),1000 );mutex_lock (&data->update_lock); data->weight_temp[index][nr] = val;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/676 ACPI: CPPC: Fix _CPC register setting issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 2388b266c9fcc7c9169ba85c7f9ebe325b7622d7 ]
Since commit 60949b7b8054 ("ACPI: CPPC: Fix MASK_VAL() usage"), _CPC registers cannot be changed from 1 to 0.
It turns out that there is an extra OR after MASK_VAL_WRITE(), which has already ORed prev_val with the register mask.
Remove the extra OR to fix the problem.
--- drivers/acpi/cppc_acpi.c | 1 - 1 file changed, 1 deletion(-)
drivers/acpi/cppc_acpi.c +0 -1
@@ -1142,7 +1142,6 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)return -EFAULT ; } val =MASK_VAL_WRITE (reg, prev_val, val); - val |= prev_val; }switch (size) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/676 crypto: caam - add error check to caam_rsa_set_priv_key_form
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit b64140c74e954f1db6eae5548ca3a1f41b6fad79 ]
The caam_rsa_set_priv_key_form did not check for memory allocation errors. Add the checks to the caam_rsa_set_priv_key_form functions.
--- drivers/crypto/caam/caampkc.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/crypto/caam/caampkc.c +7 -4
@@ -984,7 +984,7 @@ static int caam_rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key,return -ENOMEM ; } -static void caam_rsa_set_priv_key_form (struct caam_rsa_ctx *ctx, +static int caam_rsa_set_priv_key_form (struct caam_rsa_ctx *ctx,struct rsa_key *raw_key) {struct caam_rsa_key *rsa_key = &ctx->key;
@@ -994,7 +994,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx, rsa_key->p =caam_read_raw_data (raw_key->p, &p_sz);if (!rsa_key->p) -return ; +return -ENOMEM ; rsa_key->p_sz = p_sz; rsa_key->q =caam_read_raw_data (raw_key->q, &q_sz);
@@ -1029,7 +1029,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx, rsa_key->priv_form =FORM3 ; -return ; +return 0 ; free_dq:kfree_sensitive (rsa_key->dq);
@@ -1043,6 +1043,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,kfree_sensitive (rsa_key->q); free_p:kfree_sensitive (rsa_key->p); +return -ENOMEM ; } static int caam_rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key,
@@ -1088,7 +1089,9 @@ static int caam_rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key, rsa_key->e_sz = raw_key.e_sz; rsa_key->n_sz = raw_key.n_sz; -caam_rsa_set_priv_key_form (ctx, &raw_key); + ret =caam_rsa_set_priv_key_form (ctx, &raw_key); +if (ret) + goto err;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/676 crypto: bcm - add error check in the ahash_hmac_init function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit 19630cf57233e845b6ac57c9c969a4888925467b ]
The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example, ahash_init will return -ENOMEM when allocation memory is error.
--- drivers/crypto/bcm/cipher.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/crypto/bcm/cipher.c +4 -1
@@ -2415,6 +2415,7 @@ static int ahash_hmac_setkey(struct crypto_ahash *ahash, const u8 *key,static int ahash_hmac_init (struct ahash_request *req) { +int ret;struct iproc_reqctx_s *rctx =ahash_request_ctx (req);struct crypto_ahash *tfm =crypto_ahash_reqtfm (req);struct iproc_ctx_s *ctx =crypto_ahash_ctx (tfm);
@@ -2424,7 +2425,9 @@ static int ahash_hmac_init(struct ahash_request *req)flow_log ("ahash_hmac_init()\n" );/* init the context as a hash */ -ahash_init (req); + ret =ahash_init (req); +if (ret) +return ret;if (!spu_no_incr_hash (ctx)) {/* SPU-M can do incr hashing but needs sw for outer HMAC */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/676 crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 572b7cf08403b6c67dfe0dc3e0f2efb42443254f ]
If do_cpt_init() fails, a previous dma_alloc_coherent() call needs to be undone.
Add the needed dma_free_coherent() before returning.
--- drivers/crypto/cavium/cpt/cptpf_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/cavium/cpt/cptpf_main.c +2 -0
@@ -302,6 +302,8 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) ret =do_cpt_init (cpt, mcode);if (ret) { +dma_free_coherent (&cpt->pdev->dev, mcode->code_size, + mcode->code, mcode->phys_base);dev_err (dev,"do_cpt_init failed with ret: %d\n" , ret); goto fw_release; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/676 rcuscale: Do a proper cleanup if kfree_scale_init() fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uladzislau Rezki (Sony) <[email protected]>
[ Upstream commit 812a1c3b9f7c36d9255f0d29d0a3d324e2f52321 ]
A static analyzer for C, Smatch, reports and triggers below warnings:
kernel/rcu/rcuscale.c:1215 rcu_scale_init()
warn: inconsistent returns 'global &fullstop_mutex'.
The checker complains about, we do not unlock the "fullstop_mutex" mutex, in case of hitting below error path:
<snip>
...
if (WARN_ON_ONCE(jiffies_at_lazy_cb - jif_start < 2 * HZ)) {
pr_alert("ERROR: call_rcu() CBs are not being lazy as expected!\n");
WARN_ON_ONCE(1);
return -1;
^^^^^^^^^^...
<snip>
it happens because "-1" is returned right away instead of doing a proper unwinding.
Fix it by jumping to "unwind" label instead of returning -1.
--- kernel/rcu/rcuscale.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/rcu/rcuscale.c +4 -2
@@ -780,13 +780,15 @@ kfree_scale_init(void)if (WARN_ON_ONCE (jiffies_at_lazy_cb - jif_start <2 *HZ )) {pr_alert ("ERROR: call_rcu() CBs are not being lazy as expected!\n" );WARN_ON_ONCE (1 ); -return -1 ; + firsterr =-1 ; + goto unwind; }if (WARN_ON_ONCE (jiffies_at_lazy_cb - jif_start >3 *HZ )) {pr_alert ("ERROR: call_rcu() CBs are being too lazy!\n" );WARN_ON_ONCE (1 ); -return -1 ; + firsterr =-1 ; + goto unwind; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/676 tools/lib/thermal: Make more generic the command encoding function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit 24b216b2d13568c703a76137ef54a2a9531a71d8 ]
The thermal netlink has been extended with more commands which require an encoding with more information. The generic encoding function puts the thermal zone id with the command name. It is the unique parameters.
The next changes will provide more parameters to the command. Set the scene for those new parameters by making the encoding function more generic.
Stable-dep-of: 7569406e95f2 ("thermal/lib: Fix memory leak on error in thermal_genl_auto()")
--- tools/lib/thermal/commands.c | 41 ++++++++++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 9 deletions(-)
tools/lib/thermal/commands.c +32 -9
@@ -261,8 +261,23 @@ static struct genl_ops thermal_cmd_ops = { .o_ncmds = ARRAY_SIZE(thermal_cmds), }; -static thermal_error_t thermal_genl_auto (struct thermal_handler *th,int id,int cmd, -int flags,void *arg) +struct cmd_param { +int tz_id; +}; + +typedef int (*cmd_cb_t )(struct nl_msg *,struct cmd_param *); + +static int thermal_genl_tz_id_encode (struct nl_msg *msg,struct cmd_param *p) +{ +if (p->tz_id >=0 &&nla_put_u32 (msg,THERMAL_GENL_ATTR_TZ_ID , p->tz_id)) +return -1 ; + +return 0 ; +} + +static thermal_error_t thermal_genl_auto (struct thermal_handler *th,cmd_cb_t cmd_cb, +struct cmd_param *param, +int cmd,int flags,void *arg) {struct nl_msg *msg;void *hdr;
@@ -276,7 +291,7 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, int id, intif (!hdr)return THERMAL_ERROR ; -if (id >=0 &&nla_put_u32 (msg,THERMAL_GENL_ATTR_TZ_ID , id)) +if (cmd_cb &&cmd_cb (msg, param))return THERMAL_ERROR ;if (nl_send_msg (th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg))
@@ -289,30 +304,38 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, int id, intthermal_error_t thermal_cmd_get_tz (struct thermal_handler *th,struct thermal_zone **tz) { -return thermal_genl_auto (th,-1 ,THERMAL_GENL_CMD_TZ_GET_ID , +return thermal_genl_auto (th,NULL ,NULL ,THERMAL_GENL_CMD_TZ_GET_ID ,NLM_F_DUMP |NLM_F_ACK , tz); }thermal_error_t thermal_cmd_get_cdev (struct thermal_handler *th,struct thermal_cdev **tc) { -return thermal_genl_auto (th,-1 ,THERMAL_GENL_CMD_CDEV_GET , +return thermal_genl_auto (th,NULL ,NULL ,THERMAL_GENL_CMD_CDEV_GET ,NLM_F_DUMP |NLM_F_ACK , tc); }thermal_error_t thermal_cmd_get_trip (struct thermal_handler *th,struct thermal_zone *tz) { -return thermal_genl_auto (th, tz->id,THERMAL_GENL_CMD_TZ_GET_TRIP , -0 , tz); +struct cmd_param p = { .tz_id = tz->id }; + +return thermal_genl_auto (th, thermal_genl_tz_id_encode, &p, +THERMAL_GENL_CMD_TZ_GET_TRIP ,0 , tz); }thermal_error_t thermal_cmd_get_governor (struct thermal_handler *th,struct thermal_zone *tz) { -return thermal_genl_auto (th, tz->id,THERMAL_GENL_CMD_TZ_GET_GOV ,0 , tz); +struct cmd_param p = { .tz_id = tz->id }; + +return thermal_genl_auto (th, thermal_genl_tz_id_encode, &p, +THERMAL_GENL_CMD_TZ_GET_GOV ,0 , tz); }thermal_error_t thermal_cmd_get_temp (struct thermal_handler *th,struct thermal_zone *tz) { -return thermal_genl_auto (th, tz->id,THERMAL_GENL_CMD_TZ_GET_TEMP ,0 , tz); +struct cmd_param p = { .tz_id = tz->id }; + +return thermal_genl_auto (th, thermal_genl_tz_id_encode, &p, +THERMAL_GENL_CMD_TZ_GET_TEMP ,0 , tz); }thermal_error_t thermal_cmd_exit (struct thermal_handler *th)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/676 thermal/lib: Fix memory leak on error in thermal_genl_auto()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit 7569406e95f2353070d88ebc88e8c13698542317 ]
The function thermal_genl_auto() does not free the allocated message in the error path. Fix that by putting a out label and jump to it which will free the message instead of directly returning an error.
--- tools/lib/thermal/commands.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
tools/lib/thermal/commands.c +7 -4
@@ -279,6 +279,7 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cmstruct cmd_param *param, int cmd, int flags, void *arg) { + thermal_error_t ret = THERMAL_ERROR;struct nl_msg *msg;void *hdr;
@@ -289,17 +290,19 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm hdr =genlmsg_put (msg,NL_AUTO_PORT ,NL_AUTO_SEQ , thermal_cmd_ops.o_id,0 , flags, cmd,THERMAL_GENL_VERSION );if (!hdr) -return THERMAL_ERROR ; + goto out;if (cmd_cb &&cmd_cb (msg, param)) -return THERMAL_ERROR ; + goto out;if (nl_send_msg (th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg)) -return THERMAL_ERROR ; + goto out; + ret =THERMAL_SUCCESS ; +out:nlmsg_free (msg); -return THERMAL_SUCCESS ; +return ret; }thermal_error_t thermal_cmd_get_tz (struct thermal_handler *th,struct thermal_zone **tz)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/676 x86/unwind/orc: Fix unwind for newly forked tasks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit 3bf19a0fb690022ec22ce87a5afeb1030cbcb56c ]
When arch_stack_walk_reliable() is called to unwind for newly forked tasks, the return value is negative which means the call stack is unreliable. This obviously does not meet expectations.
The root cause is that after commit 3aec4ecb3d1f ("x86: Rewrite
ret_from_fork() in C"), the 'ret_addr' of newly forked task is changed
to 'ret_from_fork_asm' (see copy_thread()), then at the start of the unwind, it is incorrectly interprets not as a "signal" one because 'ret_from_fork' is still used to determine the initial "signal" (see __unwind_start()). Then the address gets incorrectly decremented in the call to orc_find() (see unwind_next_frame()) and resulting in the incorrect ORC data.
To fix it, check 'ret_from_fork_asm' rather than 'ret_from_fork' in __unwind_start().
--- arch/x86/kernel/unwind_orc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/unwind_orc.c +1 -1
@@ -723,7 +723,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, state->sp = task->thread.sp +sizeof (*frame); state->bp =READ_ONCE_NOCHECK (frame->bp); state->ip =READ_ONCE_NOCHECK (frame->ret_addr); - state->signal = (void *)state->ip == ret_from_fork; + state->signal = (void *)state->ip == ret_from_fork_asm; } if (get_stack_info((unsigned long *)state->sp, state->task,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/676 time: Partially revert cleanup on msecs_to_jiffies() documentation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit b05aefc1f5886c8aece650c9c1639c87b976191a ]
The documentation's intention is to compare msecs_to_jiffies() (first sentence) with __msecs_to_jiffies() (second sentence), which is what the original documentation did. One of the cleanups in commit f3cb80804b82 ("time: Fix various kernel-doc problems") may have thought the paragraph was talking about the latter since that is what it is being documented.
Thus revert that part of the change.
--- kernel/time/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/time.c +1 -1
@@ -558,7 +558,7 @@ EXPORT_SYMBOL(ns_to_timespec64);* handling any 32-bit overflows. * for the details see __msecs_to_jiffies() * -* __msecs_to_jiffies() checks for the passed in value being a constant +* msecs_to_jiffies() checks for the passed in value being a constant * via __builtin_constant_p() allowing gcc to eliminate most of the * code, __msecs_to_jiffies() is called if the value passed does not * allow constant folding and the actual conversion must be done at
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/676 time: Fix references to _msecs_to_jiffies() handling of values
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit 92b043fd995a63a57aae29ff85a39b6f30cd440c ]
The details about the handling of the "normal" values were moved to the _msecs_to_jiffies() helpers in commit ca42aaf0c861 ("time:
Refactor msecs_to_jiffies"). However, the same commit still mentioned __msecs_to_jiffies() in the added documentation.
Thus point to _msecs_to_jiffies() instead.
--- include/linux/jiffies.h | 2 +- kernel/time/time.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/linux/jiffies.h +1 -1
@@ -499,7 +499,7 @@ static inline unsigned long _msecs_to_jiffies(const unsigned int m)* - all other values are converted to jiffies by either multiplying * the input value by a factor or dividing it with a factor and * handling any 32-bit overflows. -* for the details see __msecs_to_jiffies() +* for the details see _msecs_to_jiffies() * * msecs_to_jiffies() checks for the passed in value being a constant * via __builtin_constant_p() allowing gcc to eliminate most of the
kernel/time/time.c +1 -1
@@ -556,7 +556,7 @@ EXPORT_SYMBOL(ns_to_timespec64);* - all other values are converted to jiffies by either multiplying * the input value by a factor or dividing it with a factor and * handling any 32-bit overflows. -* for the details see __msecs_to_jiffies() +* for the details see _msecs_to_jiffies() * * msecs_to_jiffies() checks for the passed in value being a constant * via __builtin_constant_p() allowing gcc to eliminate most of the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/676 kcsan, seqlock: Support seqcount_latch_t
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit 5c1806c41ce0a0110db5dd4c483cf2dc28b3ddf0 ]
While fuzzing an arm64 kernel, Alexander Potapenko reported:
| BUG: KCSAN: data-race in ktime_get_mono_fast_ns / timekeeping_update | | write to 0xffffffc082e74248 of 56 bytes by interrupt on cpu 0: | update_fast_timekeeper kernel/time/timekeeping.c:430 [inline] | timekeeping_update+0x1d8/0x2d8 kernel/time/timekeeping.c:768 | timekeeping_advance+0x9e8/0xb78 kernel/time/timekeeping.c:2344 | update_wall_time+0x18/0x38 kernel/time/timekeeping.c:2360 | [...] | | read to 0xffffffc082e74258 of 8 bytes by task 5260 on cpu 1: | __ktime_get_fast_ns kernel/time/timekeeping.c:372 [inline] | ktime_get_mono_fast_ns+0x88/0x174 kernel/time/timekeeping.c:489 | init_srcu_struct_fields+0x40c/0x530 kernel/rcu/srcutree.c:263 | init_srcu_struct+0x14/0x20 kernel/rcu/srcutree.c:311 | [...] | | value changed: 0x000002f875d33266 -> 0x000002f877416866 | | Reported by Kernel Concurrency Sanitizer on: | CPU: 1 UID: 0 PID: 5260 Comm: syz.2.7483 Not tainted 6.12.0-rc3-dirty #78
This is a false positive data race between a seqcount latch writer and a reader accessing stale data. Since its introduction, KCSAN has never understood the seqcount_latch interface (due to being unannotated).
Unlike the regular seqlock interface, the seqcount_latch interface for latch writers never has had a well-defined critical section, making it difficult to teach tooling where the critical section starts and ends.
Introduce an instrumentable (non-raw) seqcount_latch interface, with which we can clearly denote writer critical sections. This both helps readability and tooling like KCSAN to understand when the writer is done updating all latch copies.
--- Documentation/locking/seqlock.rst | 2 +- include/linux/seqlock.h | 86 +++++++++++++++++++++++++------ 2 files changed, 72 insertions(+), 16 deletions(-)
Documentation/locking/seqlock.rst +1 -1
@@ -153,7 +153,7 @@ Use seqcount_latch_t when the write side sections cannot be protected from interruption by readers. This is typically the case when the read side can be invoked from NMI handlers. -Check `raw_write_seqcount_latch()` for more information. +Check `write_seqcount_latch()` for more information. .. _seqlock_t:
include/linux/seqlock.h +71 -15
127 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/676 kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit 183ec5f26b2fc97a4a9871865bfe9b33c41fddb2 ]
During testing of the preceding changes, I noticed that in some cases, current->kcsan_ctx.in_flat_atomic remained true until task exit. This is obviously wrong, because _all_ accesses for the given task will be treated as atomic, resulting in false negatives i.e. missed data races.
Debugging led to fs/dcache.c, where we can see this usage of seqlock:
struct dentry *d_lookup(const struct dentry *parent, const struct qstr *name)
{
struct dentry *dentry;
unsigned seq;
do {
seq = read_seqbegin(&rename_lock);
dentry = __d_lookup(parent, name);
if (dentry)
break;
} while (read_seqretry(&rename_lock, seq));
[...]As can be seen, read_seqretry() is never called if dentry != NULL; consequently, current->kcsan_ctx.in_flat_atomic will never be reset to false by read_seqretry().
Give up on the wrong assumption of "assume closing read_seqretry()", and rely on the already-present annotations in read_seqcount_begin/retry().
--- include/linux/seqlock.h | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
include/linux/seqlock.h +1 -11
@@ -890,11 +890,7 @@ typedef struct {*/ static inline unsigned read_seqbegin (const seqlock_t *sl) { -unsigned ret =read_seqcount_begin (&sl->seqcount); - -kcsan_atomic_next (0 );/* non-raw usage, assume closing read_seqretry() */ -kcsan_flat_atomic_begin (); -return ret; +return read_seqcount_begin (&sl->seqcount); }/**
@@ -910,12 +906,6 @@ static inline unsigned read_seqbegin(const seqlock_t *sl)*/ static inline unsigned read_seqretry (const seqlock_t *sl,unsigned start) { -/* -* Assume not nested: read_seqretry() may be called multiple times when -* completing read critical section. -*/ -kcsan_flat_atomic_end (); -return read_seqcount_retry (&sl->seqcount, start); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/676 clocksource/drivers:sp804: Make user selectable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 0309f714a0908e947af1c902cf6a330cb593e75e ]
The sp804 is currently only user selectable if COMPILE_TEST, this was done by commit dfc82faad725 ("clocksource/drivers/sp804: Add COMPILE_TEST to CONFIG_ARM_TIMER_SP804") in order to avoid it being spuriously offered on platforms that won't have the hardware since it's generally only seen on Arm based platforms. This config is overly restrictive, while platforms that rely on the SP804 do select it in their Kconfig there are others such as the Arm fast models which have a SP804 available but currently unused by Linux. Relax the dependency to allow it to be user selectable on arm and arm64 to avoid surprises and in case someone comes up with a use for extra timer hardware.
--- drivers/clocksource/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/clocksource/Kconfig +2 -1
@@ -390,7 +390,8 @@ config ARM_GT_INITIAL_PRESCALER_VAL This affects CPU_FREQ max delta from the initial frequency. config ARM_TIMER_SP804 - bool "Support for Dual Timer SP804 module" if COMPILE_TEST + bool "Support for Dual Timer SP804 module" + depends on ARM || ARM64 || COMPILE_TEST depends on GENERIC_SCHED_CLOCK && HAVE_CLK select CLKSRC_MMIO select TIMER_OF if OF
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/676 clocksource/drivers/timer-ti-dm: Fix child node refcount handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit e5cfc0989d9a2849c51c720a16b90b2c061a1aeb ]
of_find_compatible_node() increments the node's refcount, and it must be decremented again with a call to of_node_put() when the pointer is no longer required to avoid leaking the resource.
Instead of adding the missing calls to of_node_put() in all execution paths, use the cleanup attribute for 'arm_timer' by means of the __free() macro, which automatically calls of_node_put() when the variable goes out of scope.
--- drivers/clocksource/timer-ti-dm-systimer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clocksource/timer-ti-dm-systimer.c +2 -2
@@ -686,9 +686,9 @@ subsys_initcall(dmtimer_percpu_timer_startup);static int __init dmtimer_percpu_quirk_init (struct device_node *np,u32 pa) { -struct device_node *arm_timer; + struct device_node *arm_timer __free(device_node) = +of_find_compatible_node (NULL ,NULL ,"arm,armv7-timer" ); - arm_timer =of_find_compatible_node (NULL ,NULL ,"arm,armv7-timer" );if (of_device_is_available (arm_timer)) {pr_warn_once ("ARM architected timer wrap issue i940 detected\n" );return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/676 spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 003c7e01916c5e2af95add9b0cbda2e6163873e8 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/spi/spi-fsl-lpspi.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/spi/spi-fsl-lpspi.c +4 -8
@@ -891,7 +891,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev)return ret; } - ret =devm_request_irq (&pdev->dev, irq, fsl_lpspi_isr,0 , + ret =devm_request_irq (&pdev->dev, irq, fsl_lpspi_isr,IRQF_NO_AUTOEN ,dev_name (&pdev->dev), fsl_lpspi);if (ret) {dev_err (&pdev->dev,"can't get irq%d: %d\n" , irq, ret);
@@ -948,14 +948,10 @@ static int fsl_lpspi_probe(struct platform_device *pdev) ret =fsl_lpspi_dma_init (&pdev->dev, fsl_lpspi, controller);if (ret == -EPROBE_DEFER ) goto out_pm_get; -if (ret <0 ) +if (ret <0 ) {dev_warn (&pdev->dev,"dma setup error %d, use pio\n" , ret); -else -/* -* disable LPSPI module IRQ when enable DMA mode successfully, -* to prevent the unexpected LPSPI module IRQ events. -*/ -disable_irq (irq); +enable_irq (irq); + } ret =devm_spi_register_controller (&pdev->dev, controller);if (ret <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/676 drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <[email protected]>
[ Upstream commit 44ed4f90a97ff6f339e50ac01db71544e0990efc ]
If we fail to allocate memory for cb_data by kmalloc, the memory allocation for eve_data is never freed, add the missing kfree() in the error handling path.
--- drivers/soc/xilinx/xlnx_event_manager.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/soc/xilinx/xlnx_event_manager.c +3 -1
@@ -174,8 +174,10 @@ static int xlnx_add_cb_for_suspend(event_cb_func_t cb_fun, void *data)INIT_LIST_HEAD (&eve_data->cb_list_head); cb_data =kmalloc (sizeof (*cb_data),GFP_KERNEL ); -if (!cb_data) +if (!cb_data) { +kfree (eve_data);return -ENOMEM ; + } cb_data->eve_cb = cb_fun; cb_data->agent_data = data;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/676 microblaze: Export xmb_manager functions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Simek <[email protected]>
[ Upstream commit badf752b5e4b17d281f93f409d4718388ff912e6 ]
When TMR_MANAGER is enabled as module there is a need to export functions which are present in architecture code.
It has been found by running:
make W=1 C=1 allmodconfig
sed -i -e 's/WERROR=y/WERROR=n/g' .config
make C=1 W=1
which errors out like this:
ERROR: modpost: "xmb_manager_register" [drivers/misc/xilinx_tmr_manager.ko] undefined!
ERROR: modpost: "xmb_inject_err" [drivers/misc/xilinx_tmr_inject.ko] undefined!
--- arch/microblaze/kernel/microblaze_ksyms.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/microblaze/kernel/microblaze_ksyms.c +10 -0
@@ -16,6 +16,7 @@#include <asm/page.h> #include <linux/ftrace.h> #include <linux/uaccess.h> +#include <asm/xilinx_mb_manager.h> #ifdef CONFIG_FUNCTION_TRACER extern void _mcount (void );
@@ -46,3 +47,12 @@ extern void __udivsi3(void);EXPORT_SYMBOL (__udivsi3);extern void __umodsi3 (void );EXPORT_SYMBOL (__umodsi3); + +#ifdef CONFIG_MB_MANAGER +extern void xmb_manager_register (uintptr_t phys_baseaddr,u32 cr_val, +void (*callback)(void *data), +void *priv,void (*reset_callback)(void *data)); +EXPORT_SYMBOL (xmb_manager_register); +extern asmlinkage void xmb_inject_err(void); +EXPORT_SYMBOL (xmb_inject_err); +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/676 arm64: dts: mt8195: Fix dtbs_check error for mutex node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Macpaul Lin <[email protected]>
[ Upstream commit 0fc557b539a1e11bdc5053a308b12d84ea754786 ]
The mutex node in mt8195.dtsi was triggering a dtbs_check error:
mutex@1c101000: 'clock-names', 'reg-names' do not match any of the
regexes: 'pinctrl-[0-9]+'
This seems no need by inspecting the DT schemas and other reference boards, so drop 'clock-names' and 'reg-names' in mt8195.dtsi.
--- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8195.dtsi +0 -2
@@ -2845,11 +2845,9 @@ &larb19 &larb21 &larb24 &larb25 mutex1: mutex@1c101000 { compatible = "mediatek,mt8195-disp-mutex"; reg = <0 0x1c101000 0 0x1000>; - reg-names = "vdo1_mutex"; interrupts = <GIC_SPI 494 IRQ_TYPE_LEVEL_HIGH 0>; power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>; clocks = <&vdosys1 CLK_VDO1_DISP_MUTEX>; - clock-names = "vdo1_mutex"; mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x1000 0x1000>; mediatek,gce-events = <CMDQ_EVENT_VDO1_STREAM_DONE_ENG_0>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/676 arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Macpaul Lin <[email protected]>
[ Upstream commit c14ab45f5d458073248ddc62d31045d5d616806f ]
The infracfg_ao node in mt8195.dtsi was causing a dtbs_check error. The error message was:
syscon@10001000: compatible: ['mediatek,mt8195-infracfg_ao', 'syscon',
'simple-mfd'] is too long
To resolve this, remove 'simple-mfd' from the 'compatible' property of the infracfg_ao node.
--- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8195.dtsi +1 -1
@@ -487,7 +487,7 @@ topckgen: syscon@10000000 { }; infracfg_ao: syscon@10001000 { - compatible = "mediatek,mt8195-infracfg_ao", "syscon", "simple-mfd"; + compatible = "mediatek,mt8195-infracfg_ao", "syscon"; reg = <0 0x10001000 0 0x1000>; #clock-cells = <1>; #reset-cells = <1>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/676 soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 16a0a69244240cfa32c525c021c40f85e090557a ]
If request_irq() fails in sr_late_init(), there is no need to enable the irq, and if it succeeds, disable_irq() after request_irq() still has a time gap in which interrupts can come.
request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/soc/ti/smartreflex.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/soc/ti/smartreflex.c +2 -2
@@ -202,10 +202,10 @@ static int sr_late_init(struct omap_sr *sr_info)if (sr_class->notify && sr_class->notify_flags && sr_info->irq) { ret =devm_request_irq (&sr_info->pdev->dev, sr_info->irq, - sr_interrupt,0 , sr_info->name, sr_info); + sr_interrupt,IRQF_NO_AUTOEN , + sr_info->name, sr_info);if (ret) goto error; -disable_irq (sr_info->irq); }return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/676 soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 78261cb08f06c93d362cab5c5034bf5899bc7552 ]
This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration. However, that check doesn't make sense on the first iteration through the loop. It leads to reading before the start of these->clk_perf_tbl[] array.
--- drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/soc/qcom/qcom-geni-se.c +2 -1
@@ -586,7 +586,8 @@ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl)for (i =0 ; i <MAX_CLK_PERF_LEVEL ; i++) { freq =clk_round_rate (se->clk, freq +1 ); -if (freq <=0 || freq == se->clk_perf_tbl[i -1 ]) +if (freq <=0 || + (i >0 && freq == se->clk_perf_tbl[i -1 ]))break ; se->clk_perf_tbl[i] = freq; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/676 arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit 600c499f8f5297c2c91e8146a8217f299e445ef6 ]
Make sure the GPU frequencies are marked as supported for the respective speedbins according to downstream msm-4.19 kernel:
* 850 MHz: Speedbins 0 + 180
* 800 MHz: Speedbins 0 + 180 + 169
* 650 MHz: Speedbins 0 + 180 + 169 + 138
* 565 MHz: Speedbins 0 + 180 + 169 + 138 + 120
* 430 MHz: Speedbins 0 + 180 + 169 + 138 + 120
* 355 MHz: Speedbins 0 + 180 + 169 + 138 + 120
* 253 MHz: Speedbins 0 + 180 + 169 + 138 + 120
--- arch/arm64/boot/dts/qcom/sm6350.dtsi | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
arch/arm64/boot/dts/qcom/sm6350.dtsi +7 -7
@@ -1351,43 +1351,43 @@ gpu_opp_table: opp-table { opp-850000000 { opp-hz = /bits/ 64 <850000000>; opp-level = <RPMH_REGULATOR_LEVEL_TURBO_L1>; - opp-supported-hw = <0x02>; + opp-supported-hw = <0x03>; }; opp-800000000 { opp-hz = /bits/ 64 <800000000>; opp-level = <RPMH_REGULATOR_LEVEL_TURBO>; - opp-supported-hw = <0x04>; + opp-supported-hw = <0x07>; }; opp-650000000 { opp-hz = /bits/ 64 <650000000>; opp-level = <RPMH_REGULATOR_LEVEL_NOM_L1>; - opp-supported-hw = <0x08>; + opp-supported-hw = <0x0f>; }; opp-565000000 { opp-hz = /bits/ 64 <565000000>; opp-level = <RPMH_REGULATOR_LEVEL_NOM>; - opp-supported-hw = <0x10>; + opp-supported-hw = <0x1f>; }; opp-430000000 { opp-hz = /bits/ 64 <430000000>; opp-level = <RPMH_REGULATOR_LEVEL_SVS_L1>; - opp-supported-hw = <0xff>; + opp-supported-hw = <0x1f>; }; opp-355000000 { opp-hz = /bits/ 64 <355000000>; opp-level = <RPMH_REGULATOR_LEVEL_SVS>; - opp-supported-hw = <0xff>; + opp-supported-hw = <0x1f>; }; opp-253000000 { opp-hz = /bits/ 64 <253000000>; opp-level = <RPMH_REGULATOR_LEVEL_LOW_SVS>; - opp-supported-hw = <0xff>; + opp-supported-hw = <0x1f>; }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/676 ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Simion <[email protected]>
[ Upstream commit 2f9d013a0c6f1b9109ada5acb28ee26eefc77c03 ]
Add the atmel,usart-mode property to the UART nodes. This ensures compliance with the atmel,at91-usart.yaml schema and resolves the errors below:
serial@200: $nodename:0: 'serial@200' does not match '^spi(@.*|-([0-9]|[1-9][0-9]+))?$'
serial@200: atmel,use-dma-rx: False schema does not allow True serial@200: atmel,use-dma-tx: False schema does not allow True serial@200: atmel,fifo-size: False schema does not allow [[16]]
These errors indicate that the property atmel,usart-mode = <AT91_USART_MODE_SERIAL> is missing for UART nodes 0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, and 12.
[claudiu.beznea: move the atmel,usart-mode close to vendor specific
properties to cope with DTS coding style]
--- arch/arm/boot/dts/microchip/sam9x60.dtsi | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/arm/boot/dts/microchip/sam9x60.dtsi +12 -0
@@ -186,6 +186,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 13>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -384,6 +385,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 32>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -433,6 +435,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 33>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -590,6 +593,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 9>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -639,6 +643,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 10>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -688,6 +693,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 11>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -737,6 +743,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 5>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -805,6 +812,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 6>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -873,6 +881,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 7>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -941,6 +950,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 8>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -1064,6 +1074,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 15>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
@@ -1113,6 +1124,7 @@ AT91_XDMAC_DT_PER_IF(1) | dma-names = "tx", "rx"; clocks = <&pmc PMC_TYPE_PERIPHERAL 16>; clock-names = "usart"; + atmel,usart-mode = <AT91_USART_MODE_SERIAL>; atmel,use-dma-rx; atmel,use-dma-tx; atmel,fifo-size = <16>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/676 mmc: mmc_spi: drop buggy snprintf()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 328bda09cc91b3d93bc64f4a4dadc44313dd8140 ]
GCC 13 complains about the truncated output of snprintf():
drivers/mmc/host/mmc_spi.c: In function ‘mmc_spi_response_get’:drivers/mmc/host/mmc_spi.c:227:64: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
227 | snprintf(tag, sizeof(tag), " ... CMD%d response SPI_%s",
| ^drivers/mmc/host/mmc_spi.c:227:9: note: ‘snprintf’ output between 26 and 43 bytes into a destination of size 32
227 | snprintf(tag, sizeof(tag), " ... CMD%d response SPI_%s",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
228 | cmd->opcode, maptype(cmd));Drop it and fold the string it generates into the only place where it's emitted - the dev_dbg() call at the end of the function.
--- drivers/mmc/host/mmc_spi.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/mmc/host/mmc_spi.c +3 -6
@@ -223,10 +223,6 @@ static int mmc_spi_response_get(struct mmc_spi_host *host,u8 leftover =0 ;unsigned short rotator;int i; -char tag[32 ]; - -snprintf (tag,sizeof (tag)," ... CMD%d response SPI_%s" , - cmd->opcode,maptype (cmd));/* Except for data block reads, the whole response will already * be stored in the scratch buffer. It's somewhere after the
@@ -379,8 +375,9 @@ static int mmc_spi_response_get(struct mmc_spi_host *host, }if (value <0 ) -dev_dbg (&host->spi->dev,"%s: resp %04x %08x\n" , - tag, cmd->resp[0 ], cmd->resp[1 ]); +dev_dbg (&host->spi->dev, +" ... CMD%d response SPI_%s: resp %04x %08x\n" , + cmd->opcode,maptype (cmd), cmd->resp[0 ], cmd->resp[1 ]);/* disable chipselect on errors and some success cases */ if (value >=0 && cs_on)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/676 openrisc: Implement fixmap to fix earlycon
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stafford Horne <[email protected]>
[ Upstream commit 1037d186edfc551fa7ba2d4336e74e7575a07a65 ]
With commit 53c98e35dcbc ("openrisc: mm: remove unneeded early ioremap code") it was commented that early ioremap was not used in OpenRISC. I acked this but was wrong, earlycon was using it. Earlycon setup now fails with the below trace:
Kernel command line: earlycon
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at mm/ioremap.c:23
generic_ioremap_prot+0x118/0x130
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted
6.11.0-rc5-00001-gce02fd891c38-dirty #141
Call trace:
[<(ptrval)>] dump_stack_lvl+0x7c/0x9c
[<(ptrval)>] dump_stack+0x1c/0x2c
[<(ptrval)>] __warn+0xb4/0x108
[<(ptrval)>] ? generic_ioremap_prot+0x118/0x130
[<(ptrval)>] warn_slowpath_fmt+0x60/0x98
[<(ptrval)>] generic_ioremap_prot+0x118/0x130
[<(ptrval)>] ioremap_prot+0x20/0x30
[<(ptrval)>] of_setup_earlycon+0xd4/0x2e0
[<(ptrval)>] early_init_dt_scan_chosen_stdout+0x18c/0x1c8
[<(ptrval)>] param_setup_earlycon+0x3c/0x60
[<(ptrval)>] do_early_param+0xb0/0x118
[<(ptrval)>] parse_args+0x184/0x4b8
[<(ptrval)>] ? start_kernel+0x0/0x78c
[<(ptrval)>] parse_early_options+0x40/0x50
[<(ptrval)>] ? do_early_param+0x0/0x118
[<(ptrval)>] parse_early_param+0x48/0x68
[<(ptrval)>] ? start_kernel+0x318/0x78c
[<(ptrval)>] ? start_kernel+0x0/0x78c
---[ end trace 0000000000000000 ]---To fix this we could either implement early_ioremap again or implement fixmap. In this patch we choose the later option of implementing basic fixmap support.
While fixing this we also remove the old FIX_IOREMAP slots that were used by early ioremap code. That code was also removed by commit 53c98e35dcbc ("openrisc: mm: remove unneeded early ioremap code") but these definitions were not cleaned up.
--- arch/openrisc/Kconfig | 3 +++ arch/openrisc/include/asm/fixmap.h | 21 ++++------------- arch/openrisc/mm/init.c | 37 ++++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+), 16 deletions(-)
arch/openrisc/Kconfig +3 -0
@@ -64,6 +64,9 @@ config STACKTRACE_SUPPORT config LOCKDEP_SUPPORT def_bool y +config FIX_EARLYCON_MEM + def_bool y + menu "Processor type and features" choice
arch/openrisc/include/asm/fixmap.h +5 -16
@@ -26,29 +26,18 @@#include <linux/bug.h> #include <asm/page.h> -/* -* On OpenRISC we use these special fixed_addresses for doing ioremap -* early in the boot process before memory initialization is complete. -* This is used, in particular, by the early serial console code. -* -* It's not really 'fixmap', per se, but fits loosely into the same -* paradigm. -*/ enum fixed_addresses { -/* -* FIX_IOREMAP entries are useful for mapping physical address -* space before ioremap() is useable, e.g. really early in boot -* before kmalloc() is working. -*/ -#define FIX_N_IOREMAPS 32 - FIX_IOREMAP_BEGIN, -FIX_IOREMAP_END =FIX_IOREMAP_BEGIN +FIX_N_IOREMAPS -1 , +FIX_EARLYCON_MEM_BASE , __end_of_fixed_addresses };#define FIXADDR_SIZE (__end_of_fixed_addresses << PAGE_SHIFT)/* FIXADDR_BOTTOM might be a better name here... */ #define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) +#define FIXMAP_PAGE_IO PAGE_KERNEL_NOCACHE + +extern void __set_fixmap (enum fixed_addresses idx, +phys_addr_t phys,pgprot_t flags);#define __fix_to_virt (x) (FIXADDR_TOP - ((x) << PAGE_SHIFT))#define __virt_to_fix (x) ((FIXADDR_TOP - ((x)&PAGE_MASK)) >> PAGE_SHIFT)
arch/openrisc/mm/init.c +37 -0
@@ -207,6 +207,43 @@ void __init mem_init(void)return ; } +static int __init map_page (unsigned long va,phys_addr_t pa,pgprot_t prot) +{ +p4d_t *p4d; +pud_t *pud; +pmd_t *pmd; +pte_t *pte; + + p4d =p4d_offset (pgd_offset_k (va), va); + pud =pud_offset (p4d, va); + pmd =pmd_offset (pud, va); + pte =pte_alloc_kernel (pmd, va); + +if (pte ==NULL ) +return -ENOMEM ; + +if (pgprot_val (prot)) +set_pte_at (&init_mm, va, pte,pfn_pte (pa >>PAGE_SHIFT , prot)); +else +pte_clear (&init_mm, va, pte); + +local_flush_tlb_page (NULL , va); +return 0 ; +} + +void __init __set_fixmap (enum fixed_addresses idx, +phys_addr_t phys,pgprot_t prot) +{ +unsigned long address =__fix_to_virt (idx); + +if (idx >= __end_of_fixed_addresses) { +BUG (); +return ; + } + +map_page (address, phys, prot); +} +static const pgprot_t protection_map[16 ] = { [VM_NONE ] =PAGE_NONE , [VM_READ ] =PAGE_READONLY_X ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/676 efi/libstub: fix efi_parse_options() ignoring the default command line
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Marek <[email protected]>
[ Upstream commit aacfa0ef247b0130b7a98bb52378f8cd727a66ca ]
efi_convert_cmdline() always returns a size of at least 1 because it counts the NUL terminator, so the "cmdline_size == 0" condition is never satisfied.
Change it to check if the string starts with a NUL character to get the intended behavior: to use CONFIG_CMDLINE when load_options_size == 0.
--- drivers/firmware/efi/libstub/efi-stub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/libstub/efi-stub.c +1 -1
@@ -129,7 +129,7 @@ efi_status_t efi_handle_cmdline(efi_loaded_image_t *image, char **cmdline_ptr)if (IS_ENABLED (CONFIG_CMDLINE_EXTEND ) ||IS_ENABLED (CONFIG_CMDLINE_FORCE ) || - cmdline_size ==0 ) { + cmdline[0 ] ==0 ) { status =efi_parse_options (CONFIG_CMDLINE );if (status !=EFI_SUCCESS ) {efi_err ("Failed to parse options\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/676 tpm: fix signed/unsigned bug when checking event logs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <[email protected]>
[ Upstream commit e6d654e9f5a97742cfe794b1c4bb5d3fb2d25e98 ]
A prior bugfix that fixes a signed/unsigned error causes another signed unsigned error.
A situation where log_tbl->size is invalid can cause the size passed to memblock_reserve to become negative.
log_size from the main event log is an unsigned int, and the code reduces to the following
u64 value = (int)unsigned_value;
This results in sign extension, and the value sent to memblock_reserve becomes effectively negative.
--- drivers/firmware/efi/tpm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/firmware/efi/tpm.c +9 -8
@@ -40,7 +40,8 @@ int __init efi_tpm_eventlog_init(void) {struct linux_efi_tpm_eventlog *log_tbl;struct efi_tcg2_final_events_table *final_tbl; -int tbl_size; +unsigned int tbl_size; +int final_tbl_size;int ret =0 ;if (efi.tpm_log ==EFI_INVALID_TABLE_ADDR ) {
@@ -80,26 +81,26 @@ int __init efi_tpm_eventlog_init(void) goto out; } - tbl_size =0 ; + final_tbl_size =0 ;if (final_tbl->nr_events !=0 ) {void *events = (void *)efi.tpm_final_log +sizeof (final_tbl->version) +sizeof (final_tbl->nr_events); - tbl_size =tpm2_calc_event_log_size (events, - final_tbl->nr_events, - log_tbl->log); + final_tbl_size =tpm2_calc_event_log_size (events, + final_tbl->nr_events, + log_tbl->log); } -if (tbl_size <0 ) { +if (final_tbl_size <0 ) {pr_err (FW_BUG "Failed to parse event in TPM Final Events Log\n" ); ret = -EINVAL ; goto out_calc; }memblock_reserve (efi.tpm_final_log, - tbl_size +sizeof (*final_tbl)); - efi_tpm_final_log_size = tbl_size; + final_tbl_size +sizeof (*final_tbl)); + efi_tpm_final_log_size = final_tbl_size; out_calc:early_memunmap (final_tbl,sizeof (*final_tbl));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/676 media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 24ad2d1f773a11f69eecec3ec37ea3d76f2e9e7d ]
The function ub960_rxport_read is being called and afterwards ret is being checked for any failures, however ret is not being assigned to the return of the function call. Fix this by assigning ret to the return of the call which appears to be missing.
--- drivers/media/i2c/ds90ub960.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/ds90ub960.c +1 -1
@@ -1286,7 +1286,7 @@ static int ub960_rxport_get_strobe_pos(struct ub960_data *priv, clk_delay += v &UB960_IR_RX_ANA_STROBE_SET_CLK_DELAY_MASK ; -ub960_rxport_read (priv, nport,UB960_RR_SFILTER_STS_1 , &v); + ret =ub960_rxport_read (priv, nport,UB960_RR_SFILTER_STS_1 , &v);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/676 arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Te Yuan <[email protected]>
[ Upstream commit e9c60c34948662b5d47573490ee538439b29e462 ]
The address of eeprom should be 50.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi +2 -2
@@ -89,9 +89,9 @@ &i2c4 { clock-frequency = <400000>; vbus-supply = <&mt6358_vcn18_reg>; - eeprom@54 { + eeprom@50 { compatible = "atmel,24c32"; - reg = <0x54>; + reg = <0x50>; pagesize = <32>; vcc-supply = <&mt6358_vcn18_reg>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/676 arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Te Yuan <[email protected]>
[ Upstream commit edbde4923f208aa83abb48d4b2463299e5fc2586 ]
The address of eeprom should be 50.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 ++-- arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi +2 -2
@@ -105,9 +105,9 @@ &i2c4 { clock-frequency = <400000>; vbus-supply = <&mt6358_vcn18_reg>; - eeprom@54 { + eeprom@50 { compatible = "atmel,24c32"; - reg = <0x54>; + reg = <0x50>; pagesize = <32>; vcc-supply = <&mt6358_vcn18_reg>; };
arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi +2 -2
@@ -80,9 +80,9 @@ &i2c4 { clock-frequency = <400000>; vbus-supply = <&mt6358_vcn18_reg>; - eeprom@54 { + eeprom@50 { compatible = "atmel,24c64"; - reg = <0x54>; + reg = <0x50>; pagesize = <32>; vcc-supply = <&mt6358_vcn18_reg>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/676 arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit f766fae08f6a2eaeb45d8d2c053724c91526835c ]
The Hana device has a second source option trackpad, but it is missing its regulator supply. It only works because the regulator is marked as always-on.
Add the regulator supply, but leave out the post-power-on delay. Instead, document the post-power-on delay along with the reason for not adding it in a comment.
--- arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi +8 -0
@@ -43,6 +43,14 @@ trackpad2: trackpad@2c { interrupts = <117 IRQ_TYPE_LEVEL_LOW>; reg = <0x2c>; hid-descr-addr = <0x0020>; + /* + * The trackpad needs a post-power-on delay of 100ms, + * but at time of writing, the power supply for it on + * this board is always on. The delay is therefore not + * added to avoid impacting the readiness of the + * trackpad. + */ + vdd-supply = <&mt6397_vgp6_reg>; wakeup-source; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/676 Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit feb301c60970bd2a1310a53ce2d6e4375397a51b ]
This reverts commit 04f8ef5643bcd8bcde25dfdebef998aea480b2ba.
Only cgroup v2 can be attached by cgroup by BPF programs. Revert this commit and cgroup_bpf_inherit and cgroup_bpf_offline won't be called in cgroup v1. The memory leak issue will be fixed with next patch.
--- kernel/cgroup/cgroup.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
kernel/cgroup/cgroup.c +1 -3
@@ -2270,10 +2270,8 @@ static void cgroup_kill_sb(struct super_block *sb)* And don't kill the default root. */ if (list_empty (&root->cgrp.self.children) && root != &cgrp_dfl_root && - !percpu_ref_is_dying (&root->cgrp.self.refcnt)) { -cgroup_bpf_offline (&root->cgrp); + !percpu_ref_is_dying (&root->cgrp.self.refcnt))percpu_ref_kill (&root->cgrp.self.refcnt); - }cgroup_put (&root->cgrp);kernfs_kill_sb (sb); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/676 cgroup/bpf: only cgroup v2 can be attached by bpf programs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit 2190df6c91373fdec6db9fc07e427084f232f57e ]
Only cgroup v2 can be attached by bpf programs, so this patch introduces that cgroup_bpf_inherit and cgroup_bpf_offline can only be called in cgroup v2, and this can fix the memleak mentioned by commit 04f8ef5643bc ("cgroup: Fix memory leak caused by missing cgroup_bpf_offline"), which has been reverted.
--- kernel/cgroup/cgroup.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
kernel/cgroup/cgroup.c +11 -6
@@ -2096,8 +2096,10 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)if (ret) goto exit_stats; - ret =cgroup_bpf_inherit (root_cgrp); -WARN_ON_ONCE (ret); +if (root == &cgrp_dfl_root) { + ret =cgroup_bpf_inherit (root_cgrp); +WARN_ON_ONCE (ret); + }trace_cgroup_setup_root (root);
@@ -5616,9 +5618,11 @@ static struct cgroup *cgroup_create(struct cgroup *parent, const char *name,if (ret) goto out_kernfs_remove; - ret =cgroup_bpf_inherit (cgrp); -if (ret) - goto out_psi_free; +if (cgrp->root == &cgrp_dfl_root) { + ret =cgroup_bpf_inherit (cgrp); +if (ret) + goto out_psi_free; + }/* * New cgroup inherits effective freeze counter, and
@@ -5936,7 +5940,8 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)cgroup1_check_for_release (parent); -cgroup_bpf_offline (cgrp); +if (cgrp->root == &cgrp_dfl_root) +cgroup_bpf_offline (cgrp);/* put the base reference */ percpu_ref_kill (&cgrp->self.refcnt);
Signature · 1 line
2.43.0