5.10.231-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 133/459 drm/etnaviv: rework linear window offset calculation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
[ Upstream commit 4bfdd2aa67fbfba09d7c32a4c7fd4c5eb1052bce ]
The current calculation based on the required_dma mask can be significantly off, so that the linear window only overlaps a small part of the DRAM address space. This can lead to the command buffer being unmappable, which is obviously bad.
Rework the linear window offset calculation to be based on the command buffer physical address, making sure that the command buffer is always mappable.
Stable-dep-of: 13c96ac9a3f0 ("drm/etnaviv: Request pages from DMA32 zone on addressing_limited")
--- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 52 +++++++++++++-------------- 1 file changed, 26 insertions(+), 26 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_gpu.c +26 -26
@@ -27,10 +27,6 @@#include "state_hi.xml.h" #include "cmdstream.xml.h" -#ifndef PHYS_OFFSET -#define PHYS_OFFSET 0 -#endif -static const struct platform_device_id gpu_ids[] = { { .name ="etnaviv-gpu,2d" }, { },
@@ -741,6 +737,7 @@ static void etnaviv_gpu_hw_init(struct etnaviv_gpu *gpu)int etnaviv_gpu_init (struct etnaviv_gpu *gpu) {struct etnaviv_drm_private *priv = gpu->drm->dev_private; +dma_addr_t cmdbuf_paddr;int ret, i; ret =pm_runtime_get_sync (gpu->dev);
@@ -783,28 +780,6 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)if (ret) goto fail; -/* -* Set the GPU linear window to be at the end of the DMA window, where -* the CMA area is likely to reside. This ensures that we are able to -* map the command buffers while having the linear window overlap as -* much RAM as possible, so we can optimize mappings for other buffers. -* -* For 3D cores only do this if MC2.0 is present, as with MC1.0 it leads -* to different views of the memory on the individual engines. -*/ -if (!(gpu->identity.features & chipFeatures_PIPE_3D) || - (gpu->identity.minor_features0 & chipMinorFeatures0_MC20)) { -u32 dma_mask = (u32 )dma_get_required_mask (gpu->dev); -if (dma_mask <PHYS_OFFSET +SZ_2G ) - priv->mmu_global->memory_base =PHYS_OFFSET ; -else - priv->mmu_global->memory_base = dma_mask -SZ_2G +1 ; - }else if (PHYS_OFFSET >=SZ_2G ) { -dev_info (gpu->dev,"Need to move linear window on MC1.0, disabling TS\n" ); - priv->mmu_global->memory_base =PHYS_OFFSET ; - gpu->identity.features &= ~chipFeatures_FAST_CLEAR; - } -/* * If the GPU is part of a system with DMA addressing limitations, * request pages for our SHM backend buffers from the DMA32 zone to
@@ -821,6 +796,31 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu) goto fail; } +/* +* Set the GPU linear window to cover the cmdbuf region, as the GPU +* won't be able to start execution otherwise. The alignment to 128M is +* chosen arbitrarily but helps in debugging, as the MMU offset +* calculations are much more straight forward this way. +* +* On MC1.0 cores the linear window offset is ignored by the TS engine, +* leading to inconsistent memory views. Avoid using the offset on those +* cores if possible, otherwise disable the TS feature. +*/ + cmdbuf_paddr =ALIGN_DOWN (etnaviv_cmdbuf_get_pa (&gpu->buffer),SZ_128M ); + +if (!(gpu->identity.features & chipFeatures_PIPE_3D) || + (gpu->identity.minor_features0 & chipMinorFeatures0_MC20)) { +if (cmdbuf_paddr >=SZ_2G ) + priv->mmu_global->memory_base =SZ_2G ; +else + priv->mmu_global->memory_base = cmdbuf_paddr; + }else if (cmdbuf_paddr +SZ_128M >=SZ_2G ) { +dev_info (gpu->dev, +"Need to move linear window on MC1.0, disabling TS\n" ); + gpu->identity.features &= ~chipFeatures_FAST_CLEAR; + priv->mmu_global->memory_base =SZ_2G ; + } +/* Setup event management */ spin_lock_init (&gpu->event_spinlock);init_completion (&gpu->event_free);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/459 drm/etnaviv: Request pages from DMA32 zone on addressing_limited
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
[ Upstream commit 13c96ac9a3f0f1c7ba1ff0656ea508e7fa065e7e ]
Remove __GFP_HIGHMEM when requesting a page from DMA32 zone, and since all vivante GPUs in the system will share the same DMA constraints, move the check of whether to get a page from DMA32 to etnaviv_bind().
--- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 ++++++++++ drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 8 -------- 2 files changed, 10 insertions(+), 8 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_drv.c +10 -0
@@ -543,6 +543,16 @@ static int etnaviv_bind(struct device *dev) priv->num_gpus =0 ; priv->shm_gfp_mask =GFP_HIGHUSER | __GFP_RETRY_MAYFAIL | __GFP_NOWARN; +/* +* If the GPU is part of a system with DMA addressing limitations, +* request pages for our SHM backend buffers from the DMA32 zone to +* hopefully avoid performance killing SWIOTLB bounce buffering. +*/ +if (dma_addressing_limited (dev)) { + priv->shm_gfp_mask |=GFP_DMA32 ; + priv->shm_gfp_mask &= ~__GFP_HIGHMEM; + } + priv->cmdbuf_suballoc =etnaviv_cmdbuf_suballoc_new (drm->dev);if (IS_ERR (priv->cmdbuf_suballoc)) {dev_err (drm->dev,"Failed to create cmdbuf suballocator\n" );
drivers/gpu/drm/etnaviv/etnaviv_gpu.c +0 -8
@@ -780,14 +780,6 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)if (ret) goto fail; -/* -* If the GPU is part of a system with DMA addressing limitations, -* request pages for our SHM backend buffers from the DMA32 zone to -* hopefully avoid performance killing SWIOTLB bounce buffering. -*/ -if (dma_addressing_limited (gpu->dev)) - priv->shm_gfp_mask |=GFP_DMA32 ; -/* Create buffer: */ ret =etnaviv_cmdbuf_init (priv->cmdbuf_suballoc, &gpu->buffer,PAGE_SIZE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/459 drm/etnaviv: dump: fix sparse warnings
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 03a2753936e85beb8239fd20ae3fb2ce90209212 ]
This patch fixes the following sparse warnings, by adding the missing endianess conversion functions.
| etnaviv/etnaviv_dump.c:78:26: warning: restricted __le32 degrades to integer | etnaviv/etnaviv_dump.c:88:26: warning: incorrect type in assignment (different base types) | etnaviv/etnaviv_dump.c:88:26: expected restricted __le32 [usertype] reg | etnaviv/etnaviv_dump.c:88:26: got unsigned short const | etnaviv/etnaviv_dump.c:89:28: warning: incorrect type in assignment (different base types) | etnaviv/etnaviv_dump.c:89:28: expected restricted __le32 [usertype] value | etnaviv/etnaviv_dump.c:89:28: got unsigned int | etnaviv/etnaviv_dump.c:210:43: warning: incorrect type in assignment (different base types) | etnaviv/etnaviv_dump.c:210:43: expected restricted __le32 | etnaviv/etnaviv_dump.c:210:43: got long
Stable-dep-of: 37dc4737447a ("drm/etnaviv: hold GPU lock across perfmon sampling")
--- drivers/gpu/drm/etnaviv/etnaviv_dump.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_dump.c +4 -4
@@ -75,7 +75,7 @@ static void etnaviv_core_dump_header(struct core_dump_iterator *iter, hdr->file_size =cpu_to_le32 (data_end - iter->data); iter->hdr++; - iter->data += hdr->file_size; + iter->data +=le32_to_cpu (hdr->file_size); } static void etnaviv_core_dump_registers(struct core_dump_iterator *iter,
@@ -85,8 +85,8 @@ static void etnaviv_core_dump_registers(struct core_dump_iterator *iter,unsigned int i;for (i =0 ; i <ARRAY_SIZE (etnaviv_dump_registers); i++, reg++) { - reg->reg = etnaviv_dump_registers[i]; - reg->value =gpu_read (gpu, etnaviv_dump_registers[i]); + reg->reg =cpu_to_le32 (etnaviv_dump_registers[i]); + reg->value =cpu_to_le32 (gpu_read (gpu, etnaviv_dump_registers[i])); }etnaviv_core_dump_header (iter,ETDUMP_BUF_REG , reg);
@@ -207,7 +207,7 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit)if (!IS_ERR (pages)) {int j; - iter.hdr->data[0 ] = bomap - bomap_start; + iter.hdr->data[0 ] =cpu_to_le32 ((bomap - bomap_start));for (j =0 ; j < obj->base.size >>PAGE_SHIFT ; j++) *bomap++ =cpu_to_le64 (page_to_phys (*pages++));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/459 drm/etnaviv: fix power register offset on GC300
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Brown <[email protected]>
[ Upstream commit 61a6920bb604df3a0e389a2a9479e1e233e4461d ]
Older GC300 revisions have their power registers at an offset of 0x200 rather than 0x100. Add new gpu_read_power and gpu_write_power functions to encapsulate accesses to the power addresses and fix the addresses.
Stable-dep-of: 37dc4737447a ("drm/etnaviv: hold GPU lock across perfmon sampling")
--- drivers/gpu/drm/etnaviv/etnaviv_dump.c | 7 ++++++- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 20 ++++++++++---------- drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 21 +++++++++++++++++++++ 3 files changed, 37 insertions(+), 11 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_dump.c +6 -1
@@ -83,10 +83,15 @@ static void etnaviv_core_dump_registers(struct core_dump_iterator *iter, {struct etnaviv_dump_registers *reg = iter->data;unsigned int i; +u32 read_addr;for (i =0 ; i <ARRAY_SIZE (etnaviv_dump_registers); i++, reg++) { + read_addr = etnaviv_dump_registers[i]; +if (read_addr >=VIVS_PM_POWER_CONTROLS && + read_addr <=VIVS_PM_PULSE_EATER ) + read_addr =gpu_fix_power_address (gpu, read_addr); reg->reg =cpu_to_le32 (etnaviv_dump_registers[i]); - reg->value =cpu_to_le32 (gpu_read (gpu, etnaviv_dump_registers[i])); + reg->value =cpu_to_le32 (gpu_read (gpu, read_addr)); }etnaviv_core_dump_header (iter,ETDUMP_BUF_REG , reg);
drivers/gpu/drm/etnaviv/etnaviv_gpu.c +10 -10
@@ -578,7 +578,7 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu)u32 pmc, ppc;/* enable clock gating */ - ppc =gpu_read (gpu,VIVS_PM_POWER_CONTROLS ); + ppc =gpu_read_power (gpu,VIVS_PM_POWER_CONTROLS ); ppc |=VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING ;/* Disable stall module clock gating for 4.3.0.1 and 4.3.0.2 revs */
@@ -586,9 +586,9 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu) gpu->identity.revision == 0x4302) ppc |=VIVS_PM_POWER_CONTROLS_DISABLE_STALL_MODULE_CLOCK_GATING ; -gpu_write (gpu,VIVS_PM_POWER_CONTROLS , ppc); +gpu_write_power (gpu,VIVS_PM_POWER_CONTROLS , ppc); - pmc =gpu_read (gpu,VIVS_PM_MODULE_CONTROLS ); + pmc =gpu_read_power (gpu,VIVS_PM_MODULE_CONTROLS );/* Disable PA clock gating for GC400+ without bugfix except for GC420 */ if (gpu->identity.model >= chipModel_GC400 &&
@@ -617,7 +617,7 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu) pmc |=VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_RA_HZ ; pmc |=VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_RA_EZ ; -gpu_write (gpu,VIVS_PM_MODULE_CONTROLS , pmc); +gpu_write_power (gpu,VIVS_PM_MODULE_CONTROLS , pmc); }void etnaviv_gpu_start_fe (struct etnaviv_gpu *gpu,u32 address,u16 prefetch)
@@ -677,11 +677,11 @@ static void etnaviv_gpu_setup_pulse_eater(struct etnaviv_gpu *gpu) (gpu->identity.features & chipFeatures_PIPE_3D)) {/* Performance fix: disable internal DFS */ - pulse_eater =gpu_read (gpu,VIVS_PM_PULSE_EATER ); + pulse_eater =gpu_read_power (gpu,VIVS_PM_PULSE_EATER ); pulse_eater |=BIT (18 ); } -gpu_write (gpu,VIVS_PM_PULSE_EATER , pulse_eater); +gpu_write_power (gpu,VIVS_PM_PULSE_EATER , pulse_eater); }static void etnaviv_gpu_hw_init (struct etnaviv_gpu *gpu)
@@ -1275,9 +1275,9 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu,u32 val;/* disable clock gating */ - val =gpu_read (gpu,VIVS_PM_POWER_CONTROLS ); + val =gpu_read_power (gpu,VIVS_PM_POWER_CONTROLS ); val &= ~VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING ; -gpu_write (gpu,VIVS_PM_POWER_CONTROLS , val); +gpu_write_power (gpu,VIVS_PM_POWER_CONTROLS , val);/* enable debug register */ val =gpu_read (gpu,VIVS_HI_CLOCK_CONTROL );
@@ -1308,9 +1308,9 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,gpu_write (gpu,VIVS_HI_CLOCK_CONTROL , val);/* enable clock gating */ - val =gpu_read (gpu,VIVS_PM_POWER_CONTROLS ); + val =gpu_read_power (gpu,VIVS_PM_POWER_CONTROLS ); val |=VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING ; -gpu_write (gpu,VIVS_PM_POWER_CONTROLS , val); +gpu_write_power (gpu,VIVS_PM_POWER_CONTROLS , val); }
drivers/gpu/drm/etnaviv/etnaviv_gpu.h +21 -0
@@ -10,6 +10,7 @@#include "etnaviv_gem.h" #include "etnaviv_mmu.h" #include "etnaviv_drv.h" +#include "common.xml.h" struct etnaviv_gem_submit ;struct etnaviv_vram_mapping ;
@@ -159,6 +160,26 @@ static inline u32 gpu_read(struct etnaviv_gpu *gpu, u32 reg)return readl (gpu->mmio + reg); } +static inline u32 gpu_fix_power_address (struct etnaviv_gpu *gpu,u32 reg) +{ +/* Power registers in GC300 < 2.0 are offset by 0x100 */ +if (gpu->identity.model == chipModel_GC300 && + gpu->identity.revision <0x2000 ) + reg +=0x100 ; + +return reg; +} + +static inline void gpu_write_power (struct etnaviv_gpu *gpu,u32 reg,u32 data) +{ +writel (data, gpu->mmio +gpu_fix_power_address (gpu, reg)); +} + +static inline u32 gpu_read_power (struct etnaviv_gpu *gpu,u32 reg) +{ +return readl (gpu->mmio +gpu_fix_power_address (gpu, reg)); +} +int etnaviv_gpu_get_param (struct etnaviv_gpu *gpu,u32 param,u64 *value);int etnaviv_gpu_init (struct etnaviv_gpu *gpu);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/459 drm/etnaviv: hold GPU lock across perfmon sampling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
[ Upstream commit 37dc4737447a7667f8e9ec790dac251da057eb27 ]
The perfmon sampling mutates shared GPU state (e.g. VIVS_HI_CLOCK_CONTROL to select the pipe for the perf counter reads). To avoid clashing with other functions mutating the same state (e.g. etnaviv_gpu_update_clock) the perfmon sampling needs to hold the GPU lock.
--- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_gpu.c +14 -6
@@ -1274,6 +1274,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu, {u32 val; +mutex_lock (&gpu->lock); +/* disable clock gating */ val =gpu_read_power (gpu,VIVS_PM_POWER_CONTROLS ); val &= ~VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING ;
@@ -1285,6 +1287,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu,gpu_write (gpu,VIVS_HI_CLOCK_CONTROL , val);sync_point_perfmon_sample (gpu, event,ETNA_PM_PROCESS_PRE ); + +mutex_unlock (&gpu->lock); } static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,
@@ -1294,13 +1298,9 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,unsigned int i;u32 val; -sync_point_perfmon_sample (gpu, event,ETNA_PM_PROCESS_POST ); - -for (i =0 ; i < submit->nr_pmrs; i++) { -const struct etnaviv_perfmon_request *pmr = submit->pmrs + i; +mutex_lock (&gpu->lock); - *pmr->bo_vma = pmr->sequence; - } +sync_point_perfmon_sample (gpu, event,ETNA_PM_PROCESS_POST );/* disable debug register */ val =gpu_read (gpu,VIVS_HI_CLOCK_CONTROL );
@@ -1311,6 +1311,14 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu, val =gpu_read_power (gpu,VIVS_PM_POWER_CONTROLS ); val |=VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING ;gpu_write_power (gpu,VIVS_PM_POWER_CONTROLS , val); + +mutex_unlock (&gpu->lock); + +for (i =0 ; i < submit->nr_pmrs; i++) { +const struct etnaviv_perfmon_request *pmr = submit->pmrs + i; + + *pmr->bo_vma = pmr->sequence; + } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/459 wifi: wfx: Fix error handling in wfx_core_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 3b88a9876779b55478a4dde867e73f7a100ffa23 ]
The wfx_core_init() returns without checking the retval from sdio_register_driver().
If the sdio_register_driver() failed, the module failed to install, leaving the wfx_spi_driver not unregistered.
--- drivers/staging/wfx/main.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/staging/wfx/main.c +15 -2
@@ -477,10 +477,23 @@ static int __init wfx_core_init(void) {int ret =0 ; -if (IS_ENABLED (CONFIG_SPI )) +if (IS_ENABLED (CONFIG_SPI )) { ret =spi_register_driver (&wfx_spi_driver); -if (IS_ENABLED (CONFIG_MMC ) && !ret) +if (ret) + goto out; + } +if (IS_ENABLED (CONFIG_MMC )) { ret =sdio_register_driver (&wfx_sdio_driver); +if (ret) + goto unregister_spi; + } + +return 0 ; + +unregister_spi: +if (IS_ENABLED (CONFIG_SPI )) +spi_unregister_driver (&wfx_spi_driver); +out:return ret; }module_init (wfx_core_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/459 drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zichen Xie <[email protected]>
[ Upstream commit 20c7b42d9dbd048019bfe0af39229e3014007a98 ]
There may be a potential integer overflow issue in _dpu_core_perf_calc_clk(). crtc_clk is defined as u64, while mode->vtotal, mode->hdisplay, and drm_mode_vrefresh(mode) are defined as a smaller data type. The result of the calculation will be limited to "int" in this case without correct casting. In screen with high resolution and high refresh rate, integer overflow may happen. So, we recommend adding an extra cast to prevent potential integer overflow.
Patchwork: https://patchwork.freedesktop.org/patch/622206/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c +1 -1
@@ -79,7 +79,7 @@ static u64 _dpu_core_perf_calc_clk(struct dpu_kms *kms, mode = &state->adjusted_mode; - crtc_clk = mode->vtotal * mode->hdisplay *drm_mode_vrefresh (mode); + crtc_clk = (u64 )mode->vtotal * mode->hdisplay *drm_mode_vrefresh (mode);drm_atomic_crtc_for_each_plane (plane, crtc) { pstate =to_dpu_plane_state (plane->state);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/459 netlink: typographical error in nlmsg_type constants definition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurice Lambert <[email protected]>
[ Upstream commit 84bfbfbbd32aee136afea4b6bf82581dce79c305 ]
This commit fix a typographical error in netlink nlmsg_type constants definition in the include/uapi/linux/rtnetlink.h at line 177. The definition is RTM_NEWNVLAN RTM_NEWVLAN instead of RTM_NEWVLAN RTM_NEWVLAN.
--- include/uapi/linux/rtnetlink.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/rtnetlink.h +1 -1
@@ -172,7 +172,7 @@ enum {#define RTM_GETLINKPROP RTM_GETLINKPROP RTM_NEWVLAN = 112, -#define RTM_NEWNVLAN RTM_NEWVLAN +#define RTM_NEWVLAN RTM_NEWVLAN RTM_DELVLAN,#define RTM_DELVLAN RTM_DELVLAN RTM_GETVLAN,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/459 selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 66c54c20408d994be34be2c070fba08472f69eee ]
Add txmsg_pass to test_txmsg_pull/push/pop. If txmsg_pass is missing, tx_prog will be NULL, and no program will be attached to the sockmap. As a result, pull/push/pop are never invoked.
--- tools/testing/selftests/bpf/test_sockmap.c | 7 +++++++ 1 file changed, 7 insertions(+)
tools/testing/selftests/bpf/test_sockmap.c +7 -0
@@ -1547,11 +1547,13 @@ static void test_txmsg_cork_hangs(int cgrp, struct sockmap_options *opt)static void test_txmsg_pull (int cgrp,struct sockmap_options *opt) {/* Test basic start/end */ + txmsg_pass =1 ; txmsg_start =1 ; txmsg_end =2 ;test_send (opt, cgrp);/* Test >4k pull */ + txmsg_pass =1 ; txmsg_start =4096 ; txmsg_end =9182 ;test_send_large (opt, cgrp);
@@ -1580,11 +1582,13 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)static void test_txmsg_pop (int cgrp,struct sockmap_options *opt) {/* Test basic pop */ + txmsg_pass =1 ; txmsg_start_pop =1 ; txmsg_pop =2 ;test_send_many (opt, cgrp);/* Test pop with >4k */ + txmsg_pass =1 ; txmsg_start_pop =4096 ; txmsg_pop =4096 ;test_send_large (opt, cgrp);
@@ -1613,11 +1617,13 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt)static void test_txmsg_push (int cgrp,struct sockmap_options *opt) {/* Test basic push */ + txmsg_pass =1 ; txmsg_start_push =1 ; txmsg_end_push =1 ;test_send (opt, cgrp);/* Test push 4kB >4k */ + txmsg_pass =1 ; txmsg_start_push =4096 ; txmsg_end_push =4096 ;test_send_large (opt, cgrp);
@@ -1638,6 +1644,7 @@ static void test_txmsg_push(int cgrp, struct sockmap_options *opt)static void test_txmsg_push_pop (int cgrp,struct sockmap_options *opt) { + txmsg_pass =1 ; txmsg_start_push =1 ; txmsg_end_push =10 ; txmsg_start_pop =5 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/459 selftests/bpf: Fix SENDPAGE data logic in test_sockmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 4095031463d4e99b534d2cd82035a417295764ae ]
In the SENDPAGE test, "opt->iov_length * cnt" size of data will be sent cnt times by sendfile.
1. In push/pop tests, they will be invoked cnt times, for the simplicity of msg_verify_data, change chunk_sz to iov_length
2. Change iov_length in test_send_large from 1024 to 8192. We have pop test where txmsg_start_pop is 4096. 4096 > 1024, an error will be returned.
--- tools/testing/selftests/bpf/test_sockmap.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +11 -7
@@ -419,16 +419,18 @@ static int msg_loop_sendpage(int fd, int iov_length, int cnt, {bool drop = opt->drop_expected;unsigned char k =0 ; +int i, j, fp;FILE *file; -int i, fp; file =tmpfile ();if (!file) {perror ("create file for sendpage" );return 1 ; } -for (i =0 ; i < iov_length * cnt; i++, k++) -fwrite (&k,sizeof (char ),1 , file); +for (i =0 ; i < cnt; i++, k =0 ) { +for (j =0 ; j < iov_length; j++, k++) +fwrite (&k,sizeof (char ),1 , file); + }fflush (file);fseek (file,0 ,SEEK_SET );
@@ -614,7 +616,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,* This is really only useful for testing edge cases in code * paths. */ - total_bytes = (float )iov_count * (float )iov_length * (float )cnt; + total_bytes = (float )iov_length * (float )cnt; +if (!opt->sendpage) + total_bytes *= (float )iov_count;if (txmsg_apply) txmsg_pop_total = txmsg_pop * (total_bytes / txmsg_apply);else
@@ -676,7 +680,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,if (data) {int chunk_sz = opt->sendpage ? - iov_length * cnt : + iov_length : iov_length * iov_count; errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt);
@@ -1425,8 +1429,8 @@ static void test_send_many(struct sockmap_options *opt, int cgrp)static void test_send_large (struct sockmap_options *opt,int cgrp) { - opt->iov_length =256 ; - opt->iov_count =1024 ; + opt->iov_length =8192 ; + opt->iov_count =32 ; opt->rate =2 ;test_exec (cgrp, opt); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/459 selftests, bpf: Add one test for sockmap with strparser
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Jian <[email protected]>
[ Upstream commit d69672147faa2a7671c0779fa5b9ad99e4fca4e3 ]
Add the test to check sockmap with strparser is working well.
Stable-dep-of: 523dffccbade ("selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap")
--- tools/testing/selftests/bpf/test_sockmap.c | 33 ++++++++++++++++++++-- 1 file changed, 30 insertions(+), 3 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +30 -3
@@ -141,6 +141,7 @@ struct sockmap_options {bool sendpage;bool data_test;bool drop_expected; +bool check_recved_len;int iov_count;int iov_length;int rate;
@@ -564,8 +565,12 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,int err, i, flags =MSG_NOSIGNAL ;bool drop = opt->drop_expected;bool data = opt->data_test; +int iov_alloc_length = iov_length; - err =msg_alloc_iov (&msg, iov_count, iov_length, data, tx); +if (!tx && opt->check_recved_len) + iov_alloc_length *=2 ; + + err =msg_alloc_iov (&msg, iov_count, iov_alloc_length, data, tx);if (err) goto out_errno;if (peek_flag) {
@@ -678,6 +683,13 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,if (recv >0 ) s->bytes_recvd += recv; +if (opt->check_recved_len && s->bytes_recvd > total_bytes) { + errno =EMSGSIZE ; +fprintf (stderr,"recv failed(), bytes_recvd:%zd, total_bytes:%f\n" , + s->bytes_recvd, total_bytes); + goto out_errno; + } +if (data) {int chunk_sz = opt->sendpage ? iov_length :
@@ -759,7 +771,8 @@ static int sendmsg_test(struct sockmap_options *opt) rxpid =fork ();if (rxpid ==0 ) { - iov_buf -= (txmsg_pop - txmsg_start_pop +1 ); +if (txmsg_pop || txmsg_start_pop) + iov_buf -= (txmsg_pop - txmsg_start_pop +1 );if (opt->drop_expected || txmsg_ktls_skb_drop)_exit (0 );
@@ -1708,6 +1721,19 @@ static void test_txmsg_ingress_parser(int cgrp, struct sockmap_options *opt)test_exec (cgrp, opt); } +static void test_txmsg_ingress_parser2 (int cgrp,struct sockmap_options *opt) +{ +if (ktls ==1 ) +return ; + skb_use_parser =10 ; + opt->iov_length =20 ; + opt->iov_count =1 ; + opt->rate =1 ; + opt->check_recved_len = true; +test_exec (cgrp, opt); + opt->check_recved_len = false; +} +char *map_names[] = {"sock_map" ,"sock_map_txmsg" ,
@@ -1802,7 +1828,8 @@ struct _test test[] = { {"txmsg test pull-data", test_txmsg_pull}, {"txmsg test pop-data", test_txmsg_pop}, {"txmsg test push/pop data", test_txmsg_push_pop}, - {"txmsg text ingress parser", test_txmsg_ingress_parser}, + {"txmsg test ingress parser", test_txmsg_ingress_parser}, + {"txmsg test ingress parser2", test_txmsg_ingress_parser2}, };static int check_whitelist (struct _test *t,struct sockmap_options *opt)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/459 selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 523dffccbadea0cfd65f1ff04944b864c558c4a8 ]
total_bytes in msg_loop_rx should also take push into account, otherwise total_bytes will be a smaller value, which makes the msg_loop_rx end early.
Besides, total_bytes has already taken pop into account, so we don't need to subtract some bytes from iov_buf in sendmsg_test. The additional subtraction may make total_bytes a negative number, and msg_loop_rx will just end without checking anything.
--- tools/testing/selftests/bpf/test_sockmap.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +7 -5
@@ -602,8 +602,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, }clock_gettime (CLOCK_MONOTONIC , &s->end); }else { +float total_bytes, txmsg_pop_total, txmsg_push_total;int slct, recvp =0 , recv, max_fd = fd; -float total_bytes, txmsg_pop_total;int fd_flags =O_NONBLOCK ;struct timeval timeout;unsigned char k =0 ;
@@ -624,10 +624,14 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, total_bytes = (float )iov_length * (float )cnt;if (!opt->sendpage) total_bytes *= (float )iov_count; -if (txmsg_apply) +if (txmsg_apply) { + txmsg_push_total = txmsg_end_push * (total_bytes / txmsg_apply); txmsg_pop_total = txmsg_pop * (total_bytes / txmsg_apply); -else + }else { + txmsg_push_total = txmsg_end_push * cnt; txmsg_pop_total = txmsg_pop * cnt; + } + total_bytes += txmsg_push_total; total_bytes -= txmsg_pop_total; err =clock_gettime (CLOCK_MONOTONIC , &s->start);if (err <0 )
@@ -771,8 +775,6 @@ static int sendmsg_test(struct sockmap_options *opt) rxpid =fork ();if (rxpid ==0 ) { -if (txmsg_pop || txmsg_start_pop) - iov_buf -= (txmsg_pop - txmsg_start_pop +1 );if (opt->drop_expected || txmsg_ktls_skb_drop)_exit (0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/459 selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 862087c3d36219ed44569666eb263efc97f00c9a ]
Add push/pop checking for msg_verify_data in test_sockmap, except for pop/push with cork tests, in these tests the logic will be different.
1. With corking, pop/push might not be invoked in each sendmsg, it makes the layout of the received data difficult
2. It makes it hard to calculate the total_bytes in the recvmsg Temporarily skip the data integrity test for these cases now, added a TODO
--- tools/testing/selftests/bpf/test_sockmap.c | 106 ++++++++++++++++++++- 1 file changed, 101 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +101 -5
@@ -89,6 +89,10 @@ int ktls;int peek_flag;int skb_use_parser;int txmsg_omit_skb_parser; +int verify_push_start; +int verify_push_len; +int verify_pop_start; +int verify_pop_len;static const struct option long_options[] = { {"help" , no_argument,NULL ,'h' },
@@ -514,12 +518,41 @@ static int msg_alloc_iov(struct msghdr *msg,return -ENOMEM ; } -/* TODO: Add verification logic for push, pull and pop data */ +/* In push or pop test, we need to do some calculations for msg_verify_data */ +static void msg_verify_date_prep (void ) +{ +int push_range_end = txmsg_start_push + txmsg_end_push -1 ; +int pop_range_end = txmsg_start_pop + txmsg_pop -1 ; + +if (txmsg_end_push && txmsg_pop && + txmsg_start_push <= pop_range_end && txmsg_start_pop <= push_range_end) { +/* The push range and the pop range overlap */ +int overlap_len; + + verify_push_start = txmsg_start_push; + verify_pop_start = txmsg_start_pop; +if (txmsg_start_push < txmsg_start_pop) + overlap_len =min (push_range_end - txmsg_start_pop +1 , txmsg_pop); +else + overlap_len =min (pop_range_end - txmsg_start_push +1 , txmsg_end_push); + verify_push_len =max (txmsg_end_push - overlap_len,0 ); + verify_pop_len =max (txmsg_pop - overlap_len,0 ); + }else { +/* Otherwise */ + verify_push_start = txmsg_start_push; + verify_pop_start = txmsg_start_pop; + verify_push_len = txmsg_end_push; + verify_pop_len = txmsg_pop; + } +} +static int msg_verify_data (struct msghdr *msg,int size,int chunk_sz, -unsigned char *k_p,int *bytes_cnt_p) +unsigned char *k_p,int *bytes_cnt_p, +int *check_cnt_p,int *push_p) { -int i, j, bytes_cnt = *bytes_cnt_p; +int bytes_cnt = *bytes_cnt_p, check_cnt = *check_cnt_p, push = *push_p;unsigned char k = *k_p; +int i, j;for (i =0 , j =0 ; i < msg->msg_iovlen && size; i++, j =0 ) {unsigned char *d = msg->msg_iov[i].iov_base;
@@ -538,6 +571,37 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz, }for (; j < msg->msg_iov[i].iov_len && size; j++) { +if (push >0 && + check_cnt == verify_push_start + verify_push_len - push) { +int skipped; +revisit_push: + skipped = push; +if (j + push >= msg->msg_iov[i].iov_len) + skipped = msg->msg_iov[i].iov_len - j; + push -= skipped; + size -= skipped; + j += skipped -1 ; + check_cnt += skipped; +continue ; + } + +if (verify_pop_len >0 && check_cnt == verify_pop_start) { + bytes_cnt += verify_pop_len; + check_cnt += verify_pop_len; + k += verify_pop_len; + +if (bytes_cnt == chunk_sz) { + k =0 ; + bytes_cnt =0 ; + check_cnt =0 ; + push = verify_push_len; + } + +if (push >0 && + check_cnt == verify_push_start + verify_push_len - push) + goto revisit_push; + } +if (d[j] != k++) { fprintf(stderr, "detected data corruption @iov[%i]:%i %02x != %02x, %02x ?= %02x\n",
@@ -545,15 +609,20 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz,return -EDATAINTEGRITY ; } bytes_cnt++; + check_cnt++;if (bytes_cnt == chunk_sz) { k =0 ; bytes_cnt =0 ; + check_cnt =0 ; + push = verify_push_len; } size--; } } *k_p = k; *bytes_cnt_p = bytes_cnt; + *check_cnt_p = check_cnt; + *push_p = push;return 0 ; }
@@ -608,6 +677,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,struct timeval timeout;unsigned char k =0 ;int bytes_cnt =0 ; +int check_cnt =0 ; +int push =0 ;fd_set w;fcntl (fd, fd_flags);
@@ -633,6 +704,10 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, } total_bytes += txmsg_push_total; total_bytes -= txmsg_pop_total; +if (data) { +msg_verify_date_prep (); + push = verify_push_len; + } err =clock_gettime (CLOCK_MONOTONIC , &s->start);if (err <0 )perror ("recv start time" );
@@ -699,7 +774,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, iov_length :iov_length * iov_count; - errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt); + errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt, + &check_cnt, &push);if (errno) {perror ("data verify msg failed" ); goto out_errno;
@@ -709,7 +785,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, recvp, chunk_sz, &k, - &bytes_cnt); + &bytes_cnt, + &check_cnt, + &push);if (errno) {perror ("data verify msg_peek failed" ); goto out_errno;
@@ -1600,6 +1678,8 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)static void test_txmsg_pop (int cgrp,struct sockmap_options *opt) { +bool data = opt->data_test; +/* Test basic pop */ txmsg_pass =1 ; txmsg_start_pop =1 ;
@@ -1618,6 +1698,12 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt) txmsg_pop =2 ;test_send_many (opt, cgrp); +/* TODO: Test for pop + cork should be different, +* - It makes the layout of the received data difficult +* - It makes it hard to calculate the total_bytes in the recvmsg +* Temporarily skip the data integrity test for this case now. +*/ + opt->data_test = false;/* Test pop + cork */ txmsg_redir =0 ; txmsg_cork =512 ;
@@ -1631,10 +1717,13 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt) txmsg_start_pop =1 ; txmsg_pop =2 ;test_send_many (opt, cgrp); + opt->data_test = data; }static void test_txmsg_push (int cgrp,struct sockmap_options *opt) { +bool data = opt->data_test; +/* Test basic push */ txmsg_pass =1 ; txmsg_start_push =1 ;
@@ -1653,12 +1742,19 @@ static void test_txmsg_push(int cgrp, struct sockmap_options *opt) txmsg_end_push =2 ;test_send_many (opt, cgrp); +/* TODO: Test for push + cork should be different, +* - It makes the layout of the received data difficult +* - It makes it hard to calculate the total_bytes in the recvmsg +* Temporarily skip the data integrity test for this case now. +*/ + opt->data_test = false;/* Test push + cork */ txmsg_redir =0 ; txmsg_cork =512 ; txmsg_start_push =1 ; txmsg_end_push =2 ;test_send_many (opt, cgrp); + opt->data_test = data; }static void test_txmsg_push_pop (int cgrp,struct sockmap_options *opt)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/459 bpf, sockmap: Several fixes to bpf_msg_push_data
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 15ab0548e3107665c34579ae523b2b6e7c22082a ]
Several fixes to bpf_msg_push_data,
1. test_sockmap has tests where bpf_msg_push_data is invoked to push some data at the end of a message, but -EINVAL is returned. In this case, in bpf_msg_push_data, after the first loop, i will be set to msg->sg.end, add the logic to handle it.
2. In the code block of "if (start - offset)", it's possible that "i" points to the last of sk_msg_elem. In this case, "sk_msg_iter_next(msg, end)" might still be called twice, another invoking is in "if (!copy)" code block, but actually only one is needed. Add the logic to handle it, and reconstruct the code to make the logic more clear.
--- net/core/filter.c | 53 +++++++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 20 deletions(-)
net/core/filter.c +33 -20
@@ -2774,7 +2774,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,sk_msg_iter_var_next (i); }while (i != msg->sg.end); -if (start >= offset + l) +if (start > offset + l)return -EINVAL ; space =MAX_MSG_FRAGS -sk_msg_elem_used (msg);
@@ -2799,6 +2799,8 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, raw =page_address (page); +if (i == msg->sg.end) +sk_msg_iter_var_prev (i); psge =sk_msg_elem (msg, i); front = start - offset; back = psge->length - front;
@@ -2815,7 +2817,13 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, }put_page (sg_page (psge)); - }else if (start - offset) { + new = i; + goto place_new; + } + +if (start - offset) { +if (i == msg->sg.end) +sk_msg_iter_var_prev (i); psge =sk_msg_elem (msg, i); rsge =sk_msg_elem_cpy (msg, i);
@@ -2826,39 +2834,44 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,sk_msg_iter_var_next (i);sg_unmark_end (psge);sg_unmark_end (&rsge); -sk_msg_iter_next (msg, end); }/* Slot(s) to place newly allocated data */ +sk_msg_iter_next (msg, end); new = i; +sk_msg_iter_var_next (i); + +if (i == msg->sg.end) { +if (!rsge.length) + goto place_new; +sk_msg_iter_next (msg, end); + goto place_new; + }/* Shift one or two slots as needed */ -if (!copy) { - sge =sk_msg_elem_cpy (msg, i); + sge =sk_msg_elem_cpy (msg, new); +sg_unmark_end (&sge); + nsge =sk_msg_elem_cpy (msg, i); +if (rsge.length) {sk_msg_iter_var_next (i); -sg_unmark_end (&sge); + nnsge =sk_msg_elem_cpy (msg, i);sk_msg_iter_next (msg, end); + } - nsge =sk_msg_elem_cpy (msg, i); +while (i != msg->sg.end) { + msg->sg.data[i] = sge; + sge = nsge; +sk_msg_iter_var_next (i);if (rsge.length) { -sk_msg_iter_var_next (i); + nsge = nnsge; nnsge =sk_msg_elem_cpy (msg, i); - } - -while (i != msg->sg.end) { - msg->sg.data[i] = sge; - sge = nsge; -sk_msg_iter_var_next (i); -if (rsge.length) { - nsge = nnsge; - nnsge =sk_msg_elem_cpy (msg, i); - }else { - nsge =sk_msg_elem_cpy (msg, i); - } + }else { + nsge =sk_msg_elem_cpy (msg, i); } } +place_new:/* Place newly allocated data buffer */ sk_mem_charge (msg->sk, len); msg->sg.size += len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/459 bpf, sockmap: Several fixes to bpf_msg_pop_data
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 5d609ba262475db450ba69b8e8a557bd768ac07a ]
Several fixes to bpf_msg_pop_data,
1. In sk_msg_shift_left, we should put_page
2. if (len == 0), return early is better
3. pop the entire sk_msg (last == msg->sg.size) should be supported
4. Fix for the value of variable "a"
5. In sk_msg_shift_left, after shifting, i has already pointed to the next element. Addtional sk_msg_iter_var_next may result in BUG.
--- net/core/filter.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/core/filter.c +9 -6
@@ -2900,8 +2900,10 @@ static const struct bpf_func_proto bpf_msg_push_data_proto = {static void sk_msg_shift_left (struct sk_msg *msg,int i) { +struct scatterlist *sge =sk_msg_elem (msg, i);int prev; +put_page (sg_page (sge)); do { prev = i; sk_msg_iter_var_next(i);
@@ -2938,6 +2940,9 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,if (unlikely (flags))return -EINVAL ; +if (unlikely (len ==0 )) +return 0 ; +/* First find the starting scatterlist element */ i = msg->sg.start; do {
@@ -2950,7 +2955,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, }while (i != msg->sg.end);/* Bounds checks: start and pop must be inside message */ -if (start >= offset + l || last >= msg->sg.size) +if (start >= offset + l || last > msg->sg.size)return -EINVAL ; space =MAX_MSG_FRAGS -sk_msg_elem_used (msg);
@@ -2979,12 +2984,12 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,*/ if (start != offset) {struct scatterlist *nsge, *sge =sk_msg_elem (msg, i); -int a = start; +int a = start - offset;int b = sge->length - pop - a;sk_msg_iter_var_next (i); -if (pop < sge->length - a) { +if (b >0 ) {if (space) { sge->length = a;sk_msg_shift_right (msg, i);
@@ -3003,7 +3008,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,if (unlikely (!page))return -ENOMEM ; - sge->length = a; orig =sg_page (sge); from =sg_virt (sge); to =page_address (page);
@@ -3013,7 +3017,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,put_page (orig); } pop =0 ; - }else if (pop >= sge->length - a) { + }else { pop -= (sge->length - a); sge->length = a; }
@@ -3047,7 +3051,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, pop -= sge->length;sk_msg_shift_left (msg, i); } -sk_msg_iter_var_next (i); }sk_mem_uncharge (msg->sk, len - pop);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/459 bpf, sockmap: Fix sk_msg_reset_curr
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 955afd57dc4bf7e8c620a0a9e3af3c881c2c6dff ]
Found in the test_txmsg_pull in test_sockmap,
``` txmsg_cork = 512; // corking is importrant here opt->iov_length = 3; opt->iov_count = 1; opt->rate = 512; // sendmsg will be invoked 512 times ```
The first sendmsg will send an sk_msg with size 3, and bpf_msg_pull_data will be invoked the first time. sk_msg_reset_curr will reset the copybreak from 3 to 0. In the second sendmsg, since we are in the stage of corking, psock->cork will be reused in func sk_msg_alloc. msg->sg.copybreak is 0 now, the second msg will overwrite the first msg. As a result, we could not pass the data integrity test.
The same problem happens in push and pop test. Thus, fix sk_msg_reset_curr to restore the correct copybreak.
--- net/core/filter.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
net/core/filter.c +9 -11
@@ -2600,18 +2600,16 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes)static void sk_msg_reset_curr (struct sk_msg *msg) { -u32 i = msg->sg.start; -u32 len =0 ; - -do { - len +=sk_msg_elem (msg, i)->length; -sk_msg_iter_var_next (i); -if (len >= msg->sg.size) -break ; - }while (i != msg->sg.end); +if (!msg->sg.size) { + msg->sg.curr = msg->sg.start; + msg->sg.copybreak =0 ; + }else { +u32 i = msg->sg.end; - msg->sg.curr = i; - msg->sg.copybreak =0 ; +sk_msg_iter_var_prev (i); + msg->sg.curr = i; + msg->sg.copybreak = msg->sg.data[i].length; + } }static const struct bpf_func_proto bpf_msg_cork_bytes_proto = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/459 selftests: net: really check for bg process completion
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 52ed077aa6336dbef83a2d6d21c52d1706fb7f16 ]
A recent refactor transformed the check for process completion in a true statement, due to a typo.
As a result, the relevant test-case is unable to catch the regression it was supposed to detect.
Restore the correct condition.
--- tools/testing/selftests/net/pmtu.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/pmtu.sh +1 -1
@@ -1587,7 +1587,7 @@ check_running() { pid=${1} cmd=${2} - [ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "{cmd}" ] + [ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "${cmd}" ] } test_cleanup_vxlanX_exception() {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/459 drm/amdkfd: Fix wrong usage of INIT_WORK()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 21cae8debc6a1d243f64fa82cd1b41cb612b5c61 ]
In kfd_procfs_show(), the sdma_activity_work_handler is a local variable and the sdma_activity_work_handler.sdma_activity_work should initialize with INIT_WORK_ONSTACK() instead of INIT_WORK().
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +3 -2
@@ -312,8 +312,8 @@ static ssize_t kfd_procfs_show(struct kobject *kobj, struct attribute *attr, attr_sdma);struct kfd_sdma_activity_handler_workarea sdma_activity_work_handler; -INIT_WORK (&sdma_activity_work_handler.sdma_activity_work, - kfd_sdma_activity_worker); +INIT_WORK_ONSTACK (&sdma_activity_work_handler.sdma_activity_work, + kfd_sdma_activity_worker); sdma_activity_work_handler.pdd = pdd; sdma_activity_work_handler.sdma_activity_counter =0 ;
@@ -321,6 +321,7 @@ static ssize_t kfd_procfs_show(struct kobject *kobj, struct attribute *attr,schedule_work (&sdma_activity_work_handler.sdma_activity_work);flush_work (&sdma_activity_work_handler.sdma_activity_work); +destroy_work_on_stack (&sdma_activity_work_handler.sdma_activity_work); return snprintf(buffer, PAGE_SIZE, "%llu\n", (sdma_activity_work_handler.sdma_activity_counter)/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/459 net: rfkill: gpio: Add check for clk_enable()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingwei Zheng <[email protected]>
[ Upstream commit 8251e7621b25ccdb689f1dd9553b8789e3745ea1 ]
Add check for the return value of clk_enable() to catch the potential error.
--- net/rfkill/rfkill-gpio.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/rfkill/rfkill-gpio.c +6 -2
@@ -30,8 +30,12 @@ static int rfkill_gpio_set_power(void *data, bool blocked) {struct rfkill_gpio_data *rfkill = data; -if (!blocked && !IS_ERR (rfkill->clk) && !rfkill->clk_enabled) -clk_enable (rfkill->clk); +if (!blocked && !IS_ERR (rfkill->clk) && !rfkill->clk_enabled) { +int ret =clk_enable (rfkill->clk); + +if (ret) +return ret; + }gpiod_set_value_cansleep (rfkill->shutdown_gpio, !blocked);gpiod_set_value_cansleep (rfkill->reset_gpio, !blocked);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/459 ALSA: usx2y: Fix spaces
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 4c0a58ef36f3de1be0d1c8565ca854bcabd37e2b ]
This patch corrects merely the spaces in the usx2y code, including the superfluous trailing space in the debug prints and a slight reformat of some comment lines. Nothing really touches about the code itself.
Stable-dep-of: dafb28f02be4 ("ALSA: usx2y: Use snd_card_free_when_closed() at disconnection")
--- sound/usb/usx2y/us122l.c | 38 ++++---- sound/usb/usx2y/usX2Yhwdep.c | 52 ++++++----- sound/usb/usx2y/usX2Yhwdep.h | 2 +- sound/usb/usx2y/usb_stream.c | 43 ++++++--- sound/usb/usx2y/usbus428ctldefs.h | 18 ++-- sound/usb/usx2y/usbusx2y.c | 78 ++++++++--------- sound/usb/usx2y/usbusx2y.h | 6 +- sound/usb/usx2y/usbusx2yaudio.c | 140 +++++++++++++++++------------- sound/usb/usx2y/usx2yhwdeppcm.c | 90 +++++++++---------- 9 files changed, 256 insertions(+), 211 deletions(-)
sound/usb/usx2y/us122l.c +22 -16
@@ -49,7 +49,7 @@ static int us122l_create_usbmidi(struct snd_card *card)static const struct snd_usb_audio_quirk quirk = { .vendor_name ="US122L" , .product_name =NAME_ALLCAPS , - .ifnum =1 , + .ifnum =1 , .type =QUIRK_MIDI_US122L , .data = &quirk_data };
@@ -71,7 +71,7 @@ static int us144_create_usbmidi(struct snd_card *card)static const struct snd_usb_audio_quirk quirk = { .vendor_name ="US144" , .product_name =NAME_ALLCAPS , - .ifnum =0 , + .ifnum =0 , .type =QUIRK_MIDI_US122L , .data = &quirk_data };
@@ -95,6 +95,7 @@ static void pt_info_set(struct usb_device *dev, u8 v)static void usb_stream_hwdep_vm_open (struct vm_area_struct *area) {struct us122l *us122l = area->vm_private_data; +atomic_inc (&us122l->mmap_count);snd_printdd (KERN_DEBUG "%i\n" ,atomic_read (&us122l->mmap_count)); }
@@ -138,6 +139,7 @@ static vm_fault_t usb_stream_hwdep_vm_fault(struct vm_fault *vmf)static void usb_stream_hwdep_vm_close (struct vm_area_struct *area) {struct us122l *us122l = area->vm_private_data; +atomic_dec (&us122l->mmap_count);snd_printdd (KERN_DEBUG "%i\n" ,atomic_read (&us122l->mmap_count)); }
@@ -148,11 +150,11 @@ static const struct vm_operations_struct usb_stream_hwdep_vm_ops = { .close = usb_stream_hwdep_vm_close, }; -static int usb_stream_hwdep_open (struct snd_hwdep *hw,struct file *file) {struct us122l *us122l = hw->private_data;struct usb_interface *iface; +snd_printdd (KERN_DEBUG "%p %p\n" , hw, file);if (hw->used >=2 )return -EBUSY ;
@@ -173,6 +175,7 @@ static int usb_stream_hwdep_release(struct snd_hwdep *hw, struct file *file) {struct us122l *us122l = hw->private_data;struct usb_interface *iface; +snd_printdd (KERN_DEBUG "%p %p\n" , hw, file);if (us122l->is_us144) {
@@ -243,6 +246,7 @@ static __poll_t usb_stream_hwdep_poll(struct snd_hwdep *hw, mask =EPOLLIN |EPOLLOUT |EPOLLWRNORM |EPOLLERR ;if (mutex_trylock (&us122l->mutex)) {struct usb_stream *s = us122l->sk.s; +if (s && s->state == usb_stream_ready) {if (us122l->first == file) polled = &s->periods_polled;
@@ -262,6 +266,7 @@ static __poll_t usb_stream_hwdep_poll(struct snd_hwdep *hw,static void us122l_stop (struct us122l *us122l) {struct list_head *p; +list_for_each (p, &us122l->midi_list)snd_usbmidi_input_stop (p);
@@ -320,13 +325,13 @@ static bool us122l_start(struct us122l *us122l, err =us122l_set_sample_rate (us122l->dev, rate);if (err <0 ) {us122l_stop (us122l); -snd_printk (KERN_ERR "us122l_set_sample_rate error \n" ); +snd_printk (KERN_ERR "us122l_set_sample_rate error\n" ); goto out; } err =usb_stream_start (&us122l->sk);if (err <0 ) {us122l_stop (us122l); -snd_printk (KERN_ERR "us122l_start error %i \n" , err); +snd_printk (KERN_ERR "us122l_start error %i\n" , err); goto out; }list_for_each (p, &us122l->midi_list)
@@ -431,7 +436,6 @@ static int usb_stream_hwdep_new(struct snd_card *card)return 0 ; } -static bool us122l_create_card (struct snd_card *card) {int err;
@@ -440,13 +444,13 @@ static bool us122l_create_card(struct snd_card *card)if (us122l->is_us144) { err =usb_set_interface (us122l->dev,0 ,1 );if (err) { -snd_printk (KERN_ERR "usb_set_interface error \n" ); +snd_printk (KERN_ERR "usb_set_interface error\n" );return false; } } err =usb_set_interface (us122l->dev,1 ,1 );if (err) { -snd_printk (KERN_ERR "usb_set_interface error \n" ); +snd_printk (KERN_ERR "usb_set_interface error\n" );return false; }
@@ -461,13 +465,14 @@ static bool us122l_create_card(struct snd_card *card)else err =us122l_create_usbmidi (card);if (err <0 ) { -snd_printk (KERN_ERR "us122l_create_usbmidi error %i \n" , err); +snd_printk (KERN_ERR "us122l_create_usbmidi error %i\n" , err); goto stop; } err =usb_stream_hwdep_new (card);if (err <0 ) { -/* release the midi resources */ +/* release the midi resources */ struct list_head *p; +list_for_each (p, &us122l->midi_list)snd_usbmidi_disconnect (p);
@@ -484,6 +489,7 @@ static void snd_us122l_free(struct snd_card *card) {struct us122l *us122l =US122L (card);int index = us122l->card_index; +if (index >=0 && index <SNDRV_CARDS ) snd_us122l_card_used[index] =0 ; }
@@ -565,7 +571,7 @@ static int snd_us122l_probe(struct usb_interface *intf,if (id->driver_info &US122L_FLAG_US144 && device->speed ==USB_SPEED_HIGH ) { -snd_printk (KERN_ERR "disable ehci-hcd to run US-144 \n" ); +snd_printk (KERN_ERR "disable ehci-hcd to run US-144\n" );return -ENODEV ; }
@@ -601,7 +607,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf)us122l_stop (us122l);mutex_unlock (&us122l->mutex); -/* release the midi resources */ +/* release the midi resources */ list_for_each (p, &us122l->midi_list) {snd_usbmidi_disconnect (p); }
@@ -661,13 +667,13 @@ static int snd_us122l_resume(struct usb_interface *intf)if (us122l->is_us144) { err =usb_set_interface (us122l->dev,0 ,1 );if (err) { -snd_printk (KERN_ERR "usb_set_interface error \n" ); +snd_printk (KERN_ERR "usb_set_interface error\n" ); goto unlock; } } err =usb_set_interface (us122l->dev,1 ,1 );if (err) { -snd_printk (KERN_ERR "usb_set_interface error \n" ); +snd_printk (KERN_ERR "usb_set_interface error\n" ); goto unlock; }
@@ -677,7 +683,7 @@ static int snd_us122l_resume(struct usb_interface *intf) err =us122l_set_sample_rate (us122l->dev, us122l->sk.s->cfg.sample_rate);if (err <0 ) { -snd_printk (KERN_ERR "us122l_set_sample_rate error \n" ); +snd_printk (KERN_ERR "us122l_set_sample_rate error\n" ); goto unlock; } err =usb_stream_start (&us122l->sk);
@@ -717,8 +723,8 @@ static const struct usb_device_id snd_us122l_usb_id_table[] = { }, {/* terminator */ } }; -MODULE_DEVICE_TABLE (usb, snd_us122l_usb_id_table); +static struct usb_driver snd_us122l_usb_driver = { .name ="snd-usb-us122l" , .probe = snd_us122l_probe,
sound/usb/usx2y/usX2Yhwdep.c +25 -27
160 lines not on this page · raw message
sound/usb/usx2y/usX2Yhwdep.h +1 -1
@@ -2,6 +2,6 @@#ifndef USX2YHWDEP_H #define USX2YHWDEP_H -int usx2y_hwdep_new (struct snd_card *card,struct usb_device * device); +int usx2y_hwdep_new (struct snd_card *card,struct usb_device *device);#endif
sound/usb/usx2y/usb_stream.c +31 -12
205 lines not on this page · raw message
sound/usb/usx2y/usbus428ctldefs.h +9 -9
@@ -39,15 +39,15 @@ enum E_IN84 {struct us428_ctls { -unsigned char fader[9 ]; -unsigned char transport; -unsigned char modifier; -unsigned char filters_elect; -unsigned char select; -unsigned char mute; -unsigned char unknown; -unsigned char wswitch; -unsigned char wheel[5 ]; +unsigned char fader[9 ]; +unsigned char transport; +unsigned char modifier; +unsigned char filters_elect; +unsigned char select; +unsigned char mute; +unsigned char unknown; +unsigned char wswitch; +unsigned char wheel[5 ]; };struct us428_set_byte {
sound/usb/usx2y/usbusx2y.c +39 -39
263 lines not on this page · raw message
sound/usb/usx2y/usbusx2y.h +3 -3
@@ -3,9 +3,9 @@#define USBUSX2Y_H #include "../usbaudio.h" #include "../midi.h" -#include "usbus428ctldefs.h" +#include "usbus428ctldefs.h" -#define NRURBS 2 +#define NRURBS 2#define URBS_ASYNC_SEQ 10
@@ -55,7 +55,7 @@ struct snd_usx2y_substream {struct usx2ydev *usx2y;struct snd_pcm_substream *pcm_substream; -int endpoint; +int endpoint;unsigned int maxpacksize;/* max packet size in bytes */ atomic_t state;
sound/usb/usx2y/usbusx2yaudio.c +80 -60
452 lines not on this page · raw message
sound/usb/usx2y/usx2yhwdeppcm.c +46 -44
373 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/459 ALSA: usx2y: Coding style fixes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a829dd5b3840fd9a24608ed73eb21ba239ae5334 ]
This patch fixes various trivial coding-style issues in usx2y code, such as:
* the assginments in if condition
* comparison order with constants
* NULL / zero checks
* unsigned -> unsigned int
* addition of braces in control blocks
* debug print with function names
* move local variables in block into function head
* reduction of too nested indentations
No functional changes.
Stable-dep-of: dafb28f02be4 ("ALSA: usx2y: Use snd_card_free_when_closed() at disconnection")
--- sound/usb/usx2y/us122l.c | 25 ++-- sound/usb/usx2y/us122l.h | 2 +- sound/usb/usx2y/usX2Yhwdep.c | 38 ++--- sound/usb/usx2y/usb_stream.c | 32 +++-- sound/usb/usx2y/usb_stream.h | 23 ++-- sound/usb/usx2y/usbusx2y.c | 122 ++++++++-------- sound/usb/usx2y/usbusx2y.h | 2 +- sound/usb/usx2y/usbusx2yaudio.c | 220 +++++++++++++++-------------- sound/usb/usx2y/usx2yhwdeppcm.c | 237 +++++++++++++++++--------------- 9 files changed, 381 insertions(+), 320 deletions(-)
sound/usb/usx2y/us122l.c +13 -12
@@ -114,9 +114,9 @@ static vm_fault_t usb_stream_hwdep_vm_fault(struct vm_fault *vmf) goto unlock; offset = vmf->pgoff <<PAGE_SHIFT ; -if (offset <PAGE_ALIGN (s->read_size)) +if (offset <PAGE_ALIGN (s->read_size)) { vaddr = (char *)s + offset; -else { + }else { offset -=PAGE_ALIGN (s->read_size);if (offset >=PAGE_ALIGN (s->write_size)) goto unlock;
@@ -238,7 +238,7 @@ static __poll_t usb_stream_hwdep_poll(struct snd_hwdep *hw, struct file *file, poll_table *wait) { struct us122l *us122l = hw->private_data; -unsigned *polled; +unsigned int *polled;__poll_t mask;poll_wait (file, &us122l->sk.sleep, wait);
@@ -255,8 +255,9 @@ static __poll_t usb_stream_hwdep_poll(struct snd_hwdep *hw,if (*polled != s->periods_done) { *polled = s->periods_done; mask =EPOLLIN |EPOLLOUT |EPOLLWRNORM ; - }else + }else { mask =0 ; + } }mutex_unlock (&us122l->mutex); }
@@ -294,11 +295,11 @@ static int us122l_set_sample_rate(struct usb_device *dev, int rate) }static bool us122l_start (struct us122l *us122l, -unsigned rate,unsigned period_frames) +unsigned int rate,unsigned int period_frames) {struct list_head *p;int err; -unsigned use_packsize =0 ; +unsigned int use_packsize =0 ;bool success = false;if (us122l->dev->speed ==USB_SPEED_HIGH ) {
@@ -331,7 +332,7 @@ static bool us122l_start(struct us122l *us122l, err =usb_stream_start (&us122l->sk);if (err <0 ) {us122l_stop (us122l); -snd_printk (KERN_ERR "us122l_start error %i\n" , err); +snd_printk (KERN_ERR "%s error %i\n" , __func__, err); goto out; }list_for_each (p, &us122l->midi_list)
@@ -342,12 +343,12 @@ static bool us122l_start(struct us122l *us122l, }static int usb_stream_hwdep_ioctl (struct snd_hwdep *hw,struct file *file, -unsigned cmd,unsigned long arg) +unsigned int cmd,unsigned long arg) {struct usb_stream_config cfg;struct us122l *us122l = hw->private_data;struct usb_stream *s; -unsigned min_period_frames; +unsigned int min_period_frames;int err =0 ;bool high_speed;
@@ -388,9 +389,9 @@ static int usb_stream_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,mutex_lock (&us122l->mutex); s = us122l->sk.s; -if (!us122l->master) +if (!us122l->master) { us122l->master = file; -else if (us122l->master != file) { + }else if (us122l->master != file) {if (!s ||memcmp (&cfg, &s->cfg,sizeof (cfg))) { err = -EIO ; goto unlock;
@@ -490,7 +491,7 @@ static void snd_us122l_free(struct snd_card *card)struct us122l *us122l =US122L (card);int index = us122l->card_index; -if (index >=0 && index <SNDRV_CARDS ) +if (index >=0 && index <SNDRV_CARDS ) snd_us122l_card_used[index] =0 ; }
sound/usb/usx2y/us122l.h +1 -1
@@ -11,7 +11,7 @@ struct us122l {struct mutex mutex;struct file *first; -unsigned second_periods_polled; +unsigned int second_periods_polled;struct file *master;struct file *slave;struct list_head midi_list;
sound/usb/usx2y/usX2Yhwdep.c +20 -18
@@ -85,7 +85,7 @@ static __poll_t snd_us428ctls_poll(struct snd_hwdep *hw, struct file *file, pollpoll_wait (file, &us428->us428ctls_wait_queue_head, wait); -if (shm !=NULL && shm->ctl_snapshot_last != shm->ctl_snapshot_red) +if (shm && shm->ctl_snapshot_last != shm->ctl_snapshot_red) mask |=EPOLLIN ;return mask;
@@ -114,7 +114,7 @@ static int snd_usx2y_hwdep_dsp_status(struct snd_hwdep *hw, id =USX2Y_TYPE_428 ;break ; } -if (0 > id) +if (id <0 )return -ENODEV ;strcpy (info->id, type_ids[id]); info->num_dsps =2 ;// 0: Prepad Data, 1: FPGA Code
@@ -158,7 +158,7 @@ static int usx2y_create_usbmidi(struct snd_card *card)le16_to_cpu (dev->descriptor.idProduct) ==USB_ID_US428 ? &quirk_2 : &quirk_1; -snd_printdd ("usx2y_create_usbmidi\n" ); +snd_printdd ("%s\n" , __func__);return snd_usbmidi_create (card, iface, &usx2y (card)->midi_list, quirk); }
@@ -166,20 +166,21 @@ static int usx2y_create_alsa_devices(struct snd_card *card) {int err; -do { -if ((err =usx2y_create_usbmidi (card)) <0 ) { -snd_printk (KERN_ERR "usx2y_create_alsa_devices: usx2y_create_usbmidi error %i\n" , err); -break ; - } -if ((err =usx2y_audio_create (card)) <0 ) -break ; -if ((err =usx2y_hwdep_pcm_new (card)) <0 ) -break ; -if ((err =snd_card_register (card)) <0 ) -break ; - }while (0 ); - -return err; + err =usx2y_create_usbmidi (card); +if (err <0 ) { +snd_printk (KERN_ERR "%s: usx2y_create_usbmidi error %i\n" , __func__, err); +return err; + } + err =usx2y_audio_create (card); +if (err <0 ) +return err; + err =usx2y_hwdep_pcm_new (card); +if (err <0 ) +return err; + err =snd_card_register (card); +if (err <0 ) +return err; +return 0 ; } static int snd_usx2y_hwdep_dsp_load(struct snd_hwdep *hw,
@@ -233,7 +234,8 @@ int usx2y_hwdep_new(struct snd_card *card, struct usb_device *device)int err;struct snd_hwdep *hw; -if ((err =snd_hwdep_new (card,SND_USX2Y_LOADER_ID ,0 , &hw)) <0 ) + err =snd_hwdep_new (card,SND_USX2Y_LOADER_ID ,0 , &hw); +if (err <0 )return err; hw->iface =SNDRV_HWDEP_IFACE_USX2Y ;
sound/usb/usx2y/usb_stream.c +18 -14
@@ -10,7 +10,7 @@/* setup */ -static unsigned usb_stream_next_packet_size (struct usb_stream_kernel *sk) +static unsigned int usb_stream_next_packet_size (struct usb_stream_kernel *sk) {struct usb_stream *s = sk->s;
@@ -44,9 +44,10 @@ static void playback_prep_freqn(struct usb_stream_kernel *sk, struct urb *urb) lb, s->period_size); } -static int init_pipe_urbs (struct usb_stream_kernel *sk,unsigned use_packsize, -struct urb **urbs,char *transfer, -struct usb_device *dev,int pipe) +static int init_pipe_urbs (struct usb_stream_kernel *sk, +unsigned int use_packsize, +struct urb **urbs,char *transfer, +struct usb_device *dev,int pipe) {int u, p; int maxpacket = use_packsize ?
@@ -82,8 +83,8 @@ static int init_pipe_urbs(struct usb_stream_kernel *sk, unsigned use_packsize,return 0 ; } -static int init_urbs (struct usb_stream_kernel *sk,unsigned use_packsize, -struct usb_device *dev,int in_pipe,int out_pipe) +static int init_urbs (struct usb_stream_kernel *sk,unsigned int use_packsize, +struct usb_device *dev,int in_pipe,int out_pipe) {struct usb_stream *s = sk->s; char *indata =
@@ -112,7 +113,7 @@ static int init_urbs(struct usb_stream_kernel *sk, unsigned use_packsize,* convert a sampling rate into our full speed format (fs/1000 in Q16.16) * this will overflow at approx 524 kHz */ -static inline unsigned get_usb_full_speed_rate (unsigned rate) +static inline unsigned int get_usb_full_speed_rate (unsigned int rate) {return ((rate <<13 ) +62 ) /125 ; }
@@ -121,7 +122,7 @@ static inline unsigned get_usb_full_speed_rate(unsigned rate)* convert a sampling rate into USB high speed format (fs/8000 in Q16.16) * this will overflow at approx 4 MHz */ -static inline unsigned get_usb_high_speed_rate (unsigned rate) +static inline unsigned int get_usb_high_speed_rate (unsigned int rate) {return ((rate <<10 ) +62 ) /125 ; }
@@ -129,7 +130,7 @@ static inline unsigned get_usb_high_speed_rate(unsigned rate)void usb_stream_free (struct usb_stream_kernel *sk) {struct usb_stream *s; -unsigned u; +unsigned int u;for (u =0 ; u <USB_STREAM_NURBS ; ++u) {usb_free_urb (sk->inurb[u]);
@@ -153,9 +154,12 @@ void usb_stream_free(struct usb_stream_kernel *sk)struct usb_stream *usb_stream_new (struct usb_stream_kernel *sk,struct usb_device *dev, -unsigned in_endpoint,unsigned out_endpoint, -unsigned sample_rate,unsigned use_packsize, -unsigned period_frames,unsigned frame_size) +unsigned int in_endpoint, +unsigned int out_endpoint, +unsigned int sample_rate, +unsigned int use_packsize, +unsigned int period_frames, +unsigned int frame_size) {int packets, max_packsize;int in_pipe, out_pipe;
@@ -531,7 +535,7 @@ static void stream_start(struct usb_stream_kernel *sk,if (s->state >= usb_stream_sync1) {int l, p, max_diff, max_diff_0;int urb_size =0 ; -unsigned frames_per_packet, min_frames =0 ; +unsigned int frames_per_packet, min_frames =0 ; frames_per_packet = (s->period_size - s->idle_insize); frames_per_packet <<=8 ;
@@ -573,7 +577,7 @@ static void stream_start(struct usb_stream_kernel *sk, (s->inpacket_head +1 ) % s->inpackets; s->next_inpacket_split_at =0 ; }else { -unsigned split = s->inpacket_head; +unsigned int split = s->inpacket_head; l = s->idle_insize;while (l > s->inpacket[split].length) {
sound/usb/usx2y/usb_stream.h +13 -10
@@ -12,7 +12,7 @@ struct usb_stream_kernel {void *write_page; -unsigned n_o_ps; +unsigned int n_o_ps;struct urb *inurb[USB_STREAM_NURBS ];struct urb *idle_inurb;
@@ -26,18 +26,21 @@ struct usb_stream_kernel {wait_queue_head_t sleep; -unsigned out_phase; -unsigned out_phase_peeked; - unsigned freqn; +unsigned int out_phase; +unsigned int out_phase_peeked; + unsigned int freqn; };struct usb_stream *usb_stream_new (struct usb_stream_kernel *sk,struct usb_device *dev, -unsigned in_endpoint,unsigned out_endpoint, -unsigned sample_rate,unsigned use_packsize, -unsigned period_frames,unsigned frame_size); -void usb_stream_free (struct usb_stream_kernel *); -int usb_stream_start (struct usb_stream_kernel *); -void usb_stream_stop (struct usb_stream_kernel *); +unsigned int in_endpoint, +unsigned int out_endpoint, +unsigned int sample_rate, +unsigned int use_packsize, +unsigned int period_frames, +unsigned int frame_size); +void usb_stream_free (struct usb_stream_kernel *sk); +int usb_stream_start (struct usb_stream_kernel *sk); +void usb_stream_stop (struct usb_stream_kernel *sk);#endif /* __USB_STREAM_H */
sound/usb/usx2y/usbusx2y.c +67 -55
229 lines not on this page · raw message
sound/usb/usx2y/usbusx2y.h +1 -1
@@ -30,7 +30,7 @@ struct usx2ydev {struct urb *in04_urb;void *in04_buf;char in04_last[24 ]; -unsigned in04_int_calls; +unsigned int in04_int_calls;struct snd_usx2y_urb_seq *us04;wait_queue_head_t in04_wait_queue;struct snd_usx2y_async_seq as04;
sound/usb/usx2y/usbusx2yaudio.c +119 -101
547 lines not on this page · raw message
sound/usb/usx2y/usx2yhwdeppcm.c +129 -108
474 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/459 ALSA: usx2y: Cleanup probe and disconnect callbacks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 2ac7a12ead2be2e31bd5e796455bef31e8516845 ]
Minor code refactoring by merging the superfluous function calls. The functions were split in the past for covering pre-history USB driver code, but this is utterly useless.
Stable-dep-of: dafb28f02be4 ("ALSA: usx2y: Use snd_card_free_when_closed() at disconnection")
--- sound/usb/usx2y/usbusx2y.c | 107 ++++++++++++++----------------------- 1 file changed, 40 insertions(+), 67 deletions(-)
sound/usb/usx2y/usbusx2y.c +40 -67
@@ -149,7 +149,6 @@ MODULE_PARM_DESC(enable, "Enable "NAME_ALLCAPS".");static int snd_usx2y_card_used[SNDRV_CARDS ]; -static void usx2y_usb_disconnect (struct usb_device *usb_device,void *ptr);static void snd_usx2y_card_private_free (struct snd_card *card);/*
@@ -363,66 +362,6 @@ static int usx2y_create_card(struct usb_device *device,return 0 ; } -static int usx2y_usb_probe (struct usb_device *device, -struct usb_interface *intf, -const struct usb_device_id *device_id, -struct snd_card **cardp) -{ -int err; -struct snd_card *card; - - *cardp =NULL ; -if (le16_to_cpu (device->descriptor.idVendor) !=0x1604 || - (le16_to_cpu (device->descriptor.idProduct) !=USB_ID_US122 && -le16_to_cpu (device->descriptor.idProduct) !=USB_ID_US224 && -le16_to_cpu (device->descriptor.idProduct) !=USB_ID_US428 )) -return -EINVAL ; - - err =usx2y_create_card (device, intf, &card); -if (err <0 ) -return err; - err =usx2y_hwdep_new (card, device); -if (err <0 ) - goto error; - err =snd_card_register (card); -if (err <0 ) - goto error; - *cardp = card; -return 0 ; - - error: -snd_card_free (card); -return err; -} - -/* -* new 2.5 USB kernel API -*/ -static int snd_usx2y_probe (struct usb_interface *intf,const struct usb_device_id *id) -{ -struct snd_card *card; -int err; - - err =usx2y_usb_probe (interface_to_usbdev (intf), intf, id, &card); -if (err <0 ) -return err; -dev_set_drvdata (&intf->dev, card); -return 0 ; -} - -static void snd_usx2y_disconnect (struct usb_interface *intf) -{ -usx2y_usb_disconnect (interface_to_usbdev (intf), -usb_get_intfdata (intf)); -} - -static struct usb_driver snd_usx2y_usb_driver = { - .name ="snd-usb-usx2y" , - .probe = snd_usx2y_probe, - .disconnect = snd_usx2y_disconnect, - .id_table = snd_usx2y_usb_id_table, -}; -static void snd_usx2y_card_private_free (struct snd_card *card) {struct usx2ydev *usx2y =usx2y (card);
@@ -436,18 +375,15 @@ static void snd_usx2y_card_private_free(struct snd_card *card) snd_usx2y_card_used[usx2y->card_index] =0 ; } -/* -* Frees the device. -*/ -static void usx2y_usb_disconnect (struct usb_device *device,void *ptr) +static void snd_usx2y_disconnect (struct usb_interface *intf) {struct snd_card *card;struct usx2ydev *usx2y;struct list_head *p; -if (!ptr) + card =usb_get_intfdata (intf); +if (!card)return ; - card = ptr; usx2y =usx2y (card); usx2y->chip_status =USX2Y_STAT_CHIP_HUP ;usx2y_unlinkseq (&usx2y->as04);
@@ -463,4 +399,41 @@ static void usx2y_usb_disconnect(struct usb_device *device, void *ptr)snd_card_free (card); } +static int snd_usx2y_probe (struct usb_interface *intf, +const struct usb_device_id *id) +{ +struct usb_device *device =interface_to_usbdev (intf); +struct snd_card *card; +int err; + +if (le16_to_cpu (device->descriptor.idVendor) !=0x1604 || + (le16_to_cpu (device->descriptor.idProduct) !=USB_ID_US122 && +le16_to_cpu (device->descriptor.idProduct) !=USB_ID_US224 && +le16_to_cpu (device->descriptor.idProduct) !=USB_ID_US428 )) +return -EINVAL ; + + err =usx2y_create_card (device, intf, &card); +if (err <0 ) +return err; + err =usx2y_hwdep_new (card, device); +if (err <0 ) + goto error; + err =snd_card_register (card); +if (err <0 ) + goto error; + +dev_set_drvdata (&intf->dev, card); +return 0 ; + + error: +snd_card_free (card); +return err; +} + +static struct usb_driver snd_usx2y_usb_driver = { + .name ="snd-usb-usx2y" , + .probe = snd_usx2y_probe, + .disconnect = snd_usx2y_disconnect, + .id_table = snd_usx2y_usb_id_table, +};module_usb_driver (snd_usx2y_usb_driver);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/459 ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit dafb28f02be407e07a6f679e922a626592b481b0 ]
The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.
--- sound/usb/usx2y/usbusx2y.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/usx2y/usbusx2y.c +1 -1
@@ -396,7 +396,7 @@ static void snd_usx2y_disconnect(struct usb_interface *intf) }if (usx2y->us428ctls_sharedmem)wake_up (&usx2y->us428ctls_wait_queue_head); -snd_card_free (card); +snd_card_free_when_closed (card); } static int snd_usx2y_probe(struct usb_interface *intf,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/459 ALSA: us122l: Use snd_card_free_when_closed() at disconnection
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b7df09bb348016943f56b09dcaafe221e3f73947 ]
The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.
The loop of us122l->mmap_count check is dropped as well. The check is useless for the asynchronous operation with *_when_closed().
--- sound/usb/usx2y/us122l.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
sound/usb/usx2y/us122l.c +1 -4
@@ -617,10 +617,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf)usb_put_intf (usb_ifnum_to_if (us122l->dev,1 ));usb_put_dev (us122l->dev); -while (atomic_read (&us122l->mmap_count)) -msleep (500 ); - -snd_card_free (card); +snd_card_free_when_closed (card); }static int snd_us122l_suspend (struct usb_interface *intf,pm_message_t message)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/459 ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c ]
The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.
This patch also splits the code to the disconnect and the free phases; the former is called immediately at the USB disconnect callback while the latter is called from the card destructor.
--- sound/usb/caiaq/audio.c | 10 ++++++++-- sound/usb/caiaq/audio.h | 1 + sound/usb/caiaq/device.c | 19 +++++++++++++++---- sound/usb/caiaq/input.c | 12 +++++++++--- sound/usb/caiaq/input.h | 1 + 5 files changed, 34 insertions(+), 9 deletions(-)
sound/usb/caiaq/audio.c +8 -2
@@ -869,14 +869,20 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev)return 0 ; } -void snd_usb_caiaq_audio_free (struct snd_usb_caiaqdev *cdev) +void snd_usb_caiaq_audio_disconnect (struct snd_usb_caiaqdev *cdev) {struct device *dev =caiaqdev_to_dev (cdev);dev_dbg (dev,"%s(%p)\n" , __func__, cdev);stream_stop (cdev); +} + +void snd_usb_caiaq_audio_free (struct snd_usb_caiaqdev *cdev) +{ +struct device *dev =caiaqdev_to_dev (cdev); + +dev_dbg (dev,"%s(%p)\n" , __func__, cdev);free_urbs (cdev->data_urbs_in);free_urbs (cdev->data_urbs_out);kfree (cdev->data_cb_info); } -
sound/usb/caiaq/audio.h +1 -0
@@ -3,6 +3,7 @@#define CAIAQ_AUDIO_H int snd_usb_caiaq_audio_init (struct snd_usb_caiaqdev *cdev); +void snd_usb_caiaq_audio_disconnect (struct snd_usb_caiaqdev *cdev);void snd_usb_caiaq_audio_free (struct snd_usb_caiaqdev *cdev);#endif /* CAIAQ_AUDIO_H */
sound/usb/caiaq/device.c +15 -4
@@ -390,6 +390,17 @@ static void setup_card(struct snd_usb_caiaqdev *cdev)dev_err (dev,"Unable to set up control system (ret=%d)\n" , ret); } +static void card_free (struct snd_card *card) +{ +struct snd_usb_caiaqdev *cdev =caiaqdev (card); + +#ifdef CONFIG_SND_USB_CAIAQ_INPUT +snd_usb_caiaq_input_free (cdev); +#endif +snd_usb_caiaq_audio_free (cdev); +usb_reset_device (cdev->chip.dev); +} +static int create_card (struct usb_device *usb_dev,struct usb_interface *intf,struct snd_card **cardp)
@@ -503,6 +514,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) cdev->vendor_name, cdev->product_name, usbpath);setup_card (cdev); + card->private_free = card_free;return 0 ; err_kill_urb:
@@ -548,15 +560,14 @@ static void snd_disconnect(struct usb_interface *intf)snd_card_disconnect (card);#ifdef CONFIG_SND_USB_CAIAQ_INPUT -snd_usb_caiaq_input_free (cdev); +snd_usb_caiaq_input_disconnect (cdev);#endif -snd_usb_caiaq_audio_free (cdev); +snd_usb_caiaq_audio_disconnect (cdev);usb_kill_urb (&cdev->ep1_in_urb);usb_kill_urb (&cdev->midi_out_urb); -snd_card_free (card); -usb_reset_device (interface_to_usbdev (intf)); +snd_card_free_when_closed (card); }
sound/usb/caiaq/input.c +9 -3
@@ -829,15 +829,21 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev)return ret; } -void snd_usb_caiaq_input_free (struct snd_usb_caiaqdev *cdev) +void snd_usb_caiaq_input_disconnect (struct snd_usb_caiaqdev *cdev) {if (!cdev || !cdev->input_dev)return ;usb_kill_urb (cdev->ep4_in_urb); +input_unregister_device (cdev->input_dev); +} + +void snd_usb_caiaq_input_free (struct snd_usb_caiaqdev *cdev) +{ +if (!cdev || !cdev->input_dev) +return ; +usb_free_urb (cdev->ep4_in_urb); cdev->ep4_in_urb =NULL ; - -input_unregister_device (cdev->input_dev); cdev->input_dev =NULL ; }
sound/usb/caiaq/input.h +1 -0
@@ -4,6 +4,7 @@void snd_usb_caiaq_input_dispatch (struct snd_usb_caiaqdev *cdev,char *buf,unsigned int len);int snd_usb_caiaq_input_init (struct snd_usb_caiaqdev *cdev); +void snd_usb_caiaq_input_disconnect (struct snd_usb_caiaqdev *cdev);void snd_usb_caiaq_input_free (struct snd_usb_caiaqdev *cdev);#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/459 ALSA: 6fire: Release resources at card release
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ]
The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()).
For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback.
--- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
sound/usb/6fire/chip.c +5 -5
@@ -62,8 +62,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy (struct sfire_chip *chip) +static void usb6fire_card_free (struct snd_card *card) { +struct sfire_chip *chip = card->private_data; +if (chip) {if (chip->pcm)usb6fire_pcm_destroy (chip);
@@ -73,8 +75,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip)usb6fire_comm_destroy (chip);if (chip->control)usb6fire_control_destroy (chip); -if (chip->card) -snd_card_free (chip->card); } }
@@ -137,6 +137,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count =1 ; chip->card = card; + card->private_free = usb6fire_card_free; ret =usb6fire_comm_init (chip);if (ret <0 )
@@ -163,7 +164,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf,return 0 ; destroy_chip: -usb6fire_chip_destroy (chip); +snd_card_free (card);return ret; }
@@ -182,7 +183,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true;usb6fire_chip_abort (chip); -usb6fire_chip_destroy (chip); } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 159/459 driver core: Introduce device_find_any_child() helper
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 82b070beae1ef55b0049768c8dc91d87565bb191 ]
There are several places in the kernel where this kind of functionality is being used. Provide a generic helper for such cases.
Stable-dep-of: 27aabf27fd01 ("Bluetooth: fix use-after-free in device_for_each_child()")
--- drivers/base/core.c | 20 ++++++++++++++++++++ include/linux/device.h | 2 ++ 2 files changed, 22 insertions(+)
drivers/base/core.c +20 -0
@@ -3419,6 +3419,26 @@ struct device *device_find_child_by_name(struct device *parent, }EXPORT_SYMBOL_GPL (device_find_child_by_name); +static int match_any (struct device *dev,void *unused) +{ +return 1 ; +} + +/** +* device_find_any_child - device iterator for locating a child device, if any. +* @parent: parent struct device +* +* This is similar to the device_find_child() function above, but it +* returns a reference to a child device, if any. +* +* NOTE: you will need to drop the reference with put_device() after use. +*/ +struct device *device_find_any_child (struct device *parent) +{ +return device_find_child (parent,NULL , match_any); +} +EXPORT_SYMBOL_GPL (device_find_any_child); +int __init devices_init (void ) { devices_kset =kset_create_and_add ("devices" , &device_uevent_ops,NULL );
include/linux/device.h +2 -0
@@ -834,6 +834,8 @@ struct device *device_find_child(struct device *dev, void *data, int (*match)(struct device *dev, void *data));struct device *device_find_child_by_name (struct device *parent,const char *name); +struct device *device_find_any_child (struct device *parent); +int device_rename (struct device *dev,const char *new_name);int device_move (struct device *dev,struct device *new_parent,enum dpm_order dpm_order);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 160/459 Bluetooth: fix use-after-free in device_for_each_child()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d ]
Syzbot has reported the following KASAN splat:
BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980 CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 ? device_for_each_child+0x18f/0x1a0 print_report+0x13a/0x4cb ? __virt_addr_valid+0x5e/0x590 ? __phys_addr+0xc6/0x150 ? device_for_each_child+0x18f/0x1a0 kasan_report+0xda/0x110 ? device_for_each_child+0x18f/0x1a0 ? __pfx_dev_memalloc_noio+0x10/0x10 device_for_each_child+0x18f/0x1a0 ? __pfx_device_for_each_child+0x10/0x10 pm_runtime_set_memalloc_noio+0xf2/0x180 netdev_unregister_kobject+0x1ed/0x270 unregister_netdevice_many_notify+0x123c/0x1d80 ? __mutex_trylock_common+0xde/0x250 ? __pfx_unregister_netdevice_many_notify+0x10/0x10 ? trace_contention_end+0xe6/0x140 ? __mutex_lock+0x4e7/0x8f0 ? __pfx_lock_acquire.part.0+0x10/0x10 ? rcu_is_watching+0x12/0xc0 ? unregister_netdev+0x12/0x30 unregister_netdevice_queue+0x30d/0x3f0 ? __pfx_unregister_netdevice_queue+0x10/0x10 ? __pfx_down_write+0x10/0x10 unregister_netdev+0x1c/0x30 bnep_session+0x1fb3/0x2ab0 ? __pfx_bnep_session+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_woken_wake_function+0x10/0x10 ? __kthread_parkme+0x132/0x200 ? __pfx_bnep_session+0x10/0x10 ? kthread+0x13a/0x370 ? __pfx_bnep_session+0x10/0x10 kthread+0x2b7/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x48/0x80 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 4974: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kmalloc_noprof+0x1d1/0x440 hci_alloc_dev_priv+0x1d/0x2820 __vhci_create_device+0xef/0x7d0 vhci_write+0x2c7/0x480 vfs_write+0x6a0/0xfc0 ksys_write+0x12f/0x260 do_syscall_64+0xc7/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 4979: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x4f/0x70 kfree+0x141/0x490 hci_release_dev+0x4d9/0x600 bt_host_release+0x6a/0xb0 device_release+0xa4/0x240 kobject_put+0x1ec/0x5a0 put_device+0x1f/0x30 vhci_release+0x81/0xf0 __fput+0x3f6/0xb30 task_work_run+0x151/0x250 do_exit+0xa79/0x2c30 do_group_exit+0xd5/0x2a0 get_signal+0x1fcd/0x2210 arch_do_signal_or_restart+0x93/0x780 syscall_exit_to_user_mode+0x140/0x290 do_syscall_64+0xd4/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f
In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly.
--- net/bluetooth/hci_sysfs.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
net/bluetooth/hci_sysfs.c +4 -11
@@ -19,16 +19,6 @@ static const struct device_type bt_link = { .release = bt_link_release, }; -/* -* The rfcomm tty device will possibly retain even when conn -* is down, and sysfs doesn't support move zombie device, -* so we should move the device before conn device is destroyed. -*/ -static int __match_tty (struct device *dev,void *data) -{ -return !strncmp (dev_name (dev),"rfcomm" ,6 ); -} -void hci_conn_init_sysfs (struct hci_conn *conn) {struct hci_dev *hdev = conn->hdev;
@@ -71,10 +61,13 @@ void hci_conn_del_sysfs(struct hci_conn *conn)return ; } +/* If there are devices using the connection as parent reset it to NULL +* before unregistering the device. +*/ while (1 ) {struct device *dev; - dev =device_find_child (&conn->dev,NULL , __match_tty); + dev =device_find_any_child (&conn->dev);if (!dev)break ;device_move (dev,NULL ,DPM_ORDER_DEV_LAST );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 161/459 netpoll: Use rcu_access_pointer() in netpoll_poll_lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit a57d5a72f8dec7db8a79d0016fb0a3bdecc82b56 ]
The ndev->npinfo pointer in netpoll_poll_lock() is RCU-protected but is being accessed directly for a NULL check. While no RCU read lock is held in this context, we should still use proper RCU primitives for consistency and correctness.
Replace the direct NULL check with rcu_access_pointer(), which is the appropriate primitive when only checking for NULL without dereferencing the pointer. This function provides the necessary ordering guarantees without requiring RCU read-side protection.
--- include/linux/netpoll.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/netpoll.h +1 -1
@@ -70,7 +70,7 @@ static inline void *netpoll_poll_lock(struct napi_struct *napi) {struct net_device *dev = napi->dev; -if (dev && dev->npinfo) { +if (dev &&rcu_access_pointer (dev->npinfo)) {int owner =smp_processor_id ();while (cmpxchg (&napi->poll_owner,-1 , owner) !=-1 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 162/459 wireguard: selftests: load nf_conntrack if not present
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 0290abc9860917f1ee8b58309c2bbd740a39ee8e ]
Some distros may not load nf_conntrack by default, which will cause subsequent nf_conntrack sets to fail. Load this module if it is not already loaded.
--- tools/testing/selftests/wireguard/netns.sh | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/wireguard/netns.sh +1 -0
@@ -320,6 +320,7 @@ waitiface $netns1 vethc waitiface $netns2 veths n0 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward' +[[ -e /proc/sys/net/netfilter/nf_conntrack_udp_timeout ]] || modprobe nf_conntrack n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout' n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream' n0 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j SNAT --to 10.0.0.1
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 163/459 trace/trace_event_perf: remove duplicate samples on the first tracepoint event
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Levi Yun <[email protected]>
[ Upstream commit afe5960dc208fe069ddaaeb0994d857b24ac19d1 ]
When a tracepoint event is created with attr.freq = 1, 'hwc->period_left' is not initialized correctly. As a result,
in the perf_swevent_overflow() function, when the first time the event occurs, it calculates the event overflow and the perf_swevent_set_period() returns 3, this leads to the event are recorded for three duplicate times.
Step to reproduce:
1. Enable the tracepoint event & starting tracing
$ echo 1 > /sys/kernel/tracing/events/module/module_free $ echo 1 > /sys/kernel/tracing/tracing_on
2. Record with perf
$ perf record -a --strict-freq -F 1 -e "module:module_free"
3. Trigger module_free event.
$ modprobe -i sunrpc
$ modprobe -r sunrpc
Result:
- Trace pipe result:
$ cat trace_pipe
modprobe-174509 [003] ..... 6504.868896: module_free: sunrpc
- perf sample:
modprobe 174509 [003] 6504.868980: module:module_free: sunrpc
modprobe 174509 [003] 6504.868980: module:module_free: sunrpc
modprobe 174509 [003] 6504.868980: module:module_free: sunrpcBy setting period_left via perf_swevent_set_period() as other sw_event did, This problem could be solved.
After patch:
- Trace pipe result:
$ cat trace_pipe
modprobe 1153096 [068] 613468.867774: module:module_free: xfs
- perf sample
modprobe 1153096 [068] 613468.867794: module:module_free: xfs
--- kernel/trace/trace_event_perf.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/trace/trace_event_perf.c +6 -0
@@ -355,10 +355,16 @@ void perf_uprobe_destroy(struct perf_event *p_event)int perf_trace_add (struct perf_event *p_event,int flags) {struct trace_event_call *tp_event = p_event->tp_event; +struct hw_perf_event *hwc = &p_event->hw;if (!(flags &PERF_EF_START )) p_event->hw.state =PERF_HES_STOPPED ; +if (is_sampling_event (p_event)) { + hwc->last_period = hwc->sample_period; +perf_swevent_set_period (p_event); + } +/* * If TRACE_REG_PERF_ADD returns false; no custom action was performed * and we need to take the default action of enqueueing our event on
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 164/459 powerpc/vdso: Flag VDSO64 entry points as functions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 0161bd38c24312853ed5ae9a425a1c41c4ac674a ]
On powerpc64 as shown below by readelf, vDSO functions symbols have type NOTYPE.
$ powerpc64-linux-gnu-readelf -a arch/powerpc/kernel/vdso/vdso64.so.dbg ELF Header: Magic: 7f 45 4c 46 02 02 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, big endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: DYN (Shared object file) Machine: PowerPC64 Version: 0x1 ...
Symbol table '.dynsym' contains 12 entries:
Num: Value Size Type Bind Vis Ndx Name
...
1: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
...
4: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
5: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15Symbol table '.symtab' contains 56 entries:
Num: Value Size Type Bind Vis Ndx Name
...
45: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
46: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __kernel_getcpu
47: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __kernel_clock_getresTo overcome that, commit ba83b3239e65 ("selftests: vDSO: fix vDSO symbols lookup for powerpc64") was applied to have selftests also look for NOTYPE symbols, but the correct fix should be to flag VDSO entry points as functions.
The original commit that brought VDSO support into powerpc/64 has the following explanation:
Note that the symbols exposed by the vDSO aren't "normal" function symbols, apps can't be expected to link against them directly, the vDSO's are both seen as if they were linked at 0 and the symbols just contain offsets to the various functions. This is done on purpose to avoid a relocation step (ppc64 functions normally have descriptors with abs addresses in them). When glibc uses those functions, it's expected to use it's own trampolines that know how to reach them.
The descriptors it's talking about are the OPD function descriptors used on ABI v1 (big endian). But it would be more correct for a text symbol to have type function, even if there's no function descriptor for it.
glibc has a special case already for handling the VDSO symbols which creates a fake opd pointing at the kernel symbol. So changing the VDSO symbol type to function shouldn't affect that.
For ABI v2, there is no function descriptors and VDSO functions can safely have function type.
So lets flag VDSO entry points as functions and revert the selftest change.
--- arch/powerpc/include/asm/vdso.h | 1 + tools/testing/selftests/vDSO/parse_vdso.c | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/vdso.h +1 -0
@@ -27,6 +27,7 @@ int vdso_getcpu_init(void);#ifdef __VDSO64__#define V_FUNCTION_BEGIN (name) \ .globl name; \ + .type name,@function; \ name: \#define V_FUNCTION_END (name) \
tools/testing/selftests/vDSO/parse_vdso.c +1 -2
@@ -216,8 +216,7 @@ void *vdso_sym(const char *version, const char *name)ELF (Sym) *sym = &vdso_info.symtab[chain];/* Check for a defined global or weak function w/ right name. */ -if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC && -ELF64_ST_TYPE (sym->st_info) !=STT_NOTYPE ) +if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC )continue ;if (ELF64_ST_BIND (sym->st_info) !=STB_GLOBAL &&ELF64_ST_BIND (sym->st_info) !=STB_WEAK )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 165/459 mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 2174f9a8c9db50f74df769edd5a4ab822c73b6d2 ]
As the comment said, disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/mfd/tps65010.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/mfd/tps65010.c +2 -6
@@ -549,17 +549,13 @@ static int tps65010_probe(struct i2c_client *client,*/ if (client->irq >0 ) { status =request_irq (client->irq, tps65010_irq, -IRQF_TRIGGER_FALLING ,DRIVER_NAME , tps); +IRQF_TRIGGER_FALLING |IRQF_NO_AUTOEN , +DRIVER_NAME , tps);if (status <0 ) {dev_dbg (&client->dev,"can't get IRQ %d, err %d\n" , client->irq, status);return status; } -/* annoying race here, ideally we'd have an option -* to claim the irq now and enable it later. -* FIXME genirq IRQF_NOAUTOEN now solves that ... -*/ -disable_irq (client->irq);set_bit (FLAG_IRQ_ENABLE , &tps->flags); }else dev_warn (&client->dev,"IRQ not configured!\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 166/459 mfd: da9052-spi: Change read-mask to write-mask
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcus Folkesson <[email protected]>
[ Upstream commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed ]
Driver has mixed up the R/W bit.
The LSB bit is set on write rather than read.
Change it to avoid nasty things to happen.
--- drivers/mfd/da9052-spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/da9052-spi.c +1 -1
@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)spi_set_drvdata (spi, da9052); config = da9052_regmap_config; - config.read_flag_mask =1 ; + config.write_flag_mask =1 ; config.reg_bits =7 ; config.pad_bits =1 ; config.val_bits =8 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 167/459 mfd: intel_soc_pmic_bxtwc: Use dev_err_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit d30e2c30a43de950cfd3690f24342a39034221c4 ]
Simplify the mux error path a bit by using dev_err_probe().
Stable-dep-of: 686fb77712a4 ("mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device")
--- drivers/mfd/intel_soc_pmic_bxtwc.c | 86 +++++++++--------------------- 1 file changed, 26 insertions(+), 60 deletions(-)
drivers/mfd/intel_soc_pmic_bxtwc.c +26 -60
@@ -410,12 +410,9 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic,int irq; irq =regmap_irq_get_virq (pdata, pirq); -if (irq <0 ) { -dev_err (pmic->dev, -"Failed to get parent vIRQ(%d) for chip %s, ret:%d\n" , - pirq, chip->name, irq); -return irq; - } +if (irq <0 ) +return dev_err_probe (pmic->dev, irq,"Failed to get parent vIRQ(%d) for chip %s\n" , + pirq, chip->name);return devm_regmap_add_irq_chip (pmic->dev, pmic->regmap, irq, irq_flags,0 , chip, data);
@@ -423,6 +420,7 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic,static int bxtwc_probe (struct platform_device *pdev) { +struct device *dev = &pdev->dev;int ret;acpi_handle handle;acpi_status status;
@@ -431,15 +429,10 @@ static int bxtwc_probe(struct platform_device *pdev) handle =ACPI_HANDLE (&pdev->dev); status =acpi_evaluate_integer (handle,"_HRV" ,NULL , &hrv); -if (ACPI_FAILURE (status)) { -dev_err (&pdev->dev,"Failed to get PMIC hardware revision\n" ); -return -ENODEV ; - } -if (hrv !=BROXTON_PMIC_WC_HRV ) { -dev_err (&pdev->dev,"Invalid PMIC hardware revision: %llu\n" , - hrv); -return -ENODEV ; - } +if (ACPI_FAILURE (status)) +return dev_err_probe (dev, -ENODEV ,"Failed to get PMIC hardware revision\n" ); +if (hrv !=BROXTON_PMIC_WC_HRV ) +return dev_err_probe (dev, -ENODEV ,"Invalid PMIC hardware revision: %llu\n" , hrv); pmic =devm_kzalloc (&pdev->dev,sizeof (*pmic),GFP_KERNEL );if (!pmic)
@@ -459,40 +452,31 @@ static int bxtwc_probe(struct platform_device *pdev) pmic->regmap =devm_regmap_init (&pdev->dev,NULL , pmic, &bxtwc_regmap_config); -if (IS_ERR (pmic->regmap)) { - ret =PTR_ERR (pmic->regmap); -dev_err (&pdev->dev,"Failed to initialise regmap: %d\n" , ret); -return ret; - } +if (IS_ERR (pmic->regmap)) +return dev_err_probe (dev,PTR_ERR (pmic->regmap),"Failed to initialise regmap\n" ); ret =devm_regmap_add_irq_chip (&pdev->dev, pmic->regmap, pmic->irq,IRQF_ONESHOT |IRQF_SHARED ,0 , &bxtwc_regmap_irq_chip, &pmic->irq_chip_data); -if (ret) { -dev_err (&pdev->dev,"Failed to add IRQ chip\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Failed to add IRQ chip\n" ); ret =bxtwc_add_chained_irq_chip (pmic, pmic->irq_chip_data,BXTWC_PWRBTN_LVL1_IRQ ,IRQF_ONESHOT , &bxtwc_regmap_irq_chip_pwrbtn, &pmic->irq_chip_data_pwrbtn); -if (ret) { -dev_err (&pdev->dev,"Failed to add PWRBTN IRQ chip\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Failed to add PWRBTN IRQ chip\n" ); ret =bxtwc_add_chained_irq_chip (pmic, pmic->irq_chip_data,BXTWC_TMU_LVL1_IRQ ,IRQF_ONESHOT , &bxtwc_regmap_irq_chip_tmu, &pmic->irq_chip_data_tmu); -if (ret) { -dev_err (&pdev->dev,"Failed to add TMU IRQ chip\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Failed to add TMU IRQ chip\n" );/* Add chained IRQ handler for BCU IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
@@ -500,12 +484,8 @@ static int bxtwc_probe(struct platform_device *pdev)IRQF_ONESHOT , &bxtwc_regmap_irq_chip_bcu, &pmic->irq_chip_data_bcu); - - -if (ret) { -dev_err (&pdev->dev,"Failed to add BUC IRQ chip\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Failed to add BUC IRQ chip\n" );/* Add chained IRQ handler for ADC IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
@@ -513,12 +493,8 @@ static int bxtwc_probe(struct platform_device *pdev)IRQF_ONESHOT , &bxtwc_regmap_irq_chip_adc, &pmic->irq_chip_data_adc); - - -if (ret) { -dev_err (&pdev->dev,"Failed to add ADC IRQ chip\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Failed to add ADC IRQ chip\n" );/* Add chained IRQ handler for CHGR IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
@@ -526,12 +502,8 @@ static int bxtwc_probe(struct platform_device *pdev)IRQF_ONESHOT , &bxtwc_regmap_irq_chip_chgr, &pmic->irq_chip_data_chgr); - - -if (ret) { -dev_err (&pdev->dev,"Failed to add CHGR IRQ chip\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Failed to add CHGR IRQ chip\n" );/* Add chained IRQ handler for CRIT IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
@@ -539,19 +511,13 @@ static int bxtwc_probe(struct platform_device *pdev)IRQF_ONESHOT , &bxtwc_regmap_irq_chip_crit, &pmic->irq_chip_data_crit); - - -if (ret) { -dev_err (&pdev->dev,"Failed to add CRIT IRQ chip\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Failed to add CRIT IRQ chip\n" ); ret =devm_mfd_add_devices (&pdev->dev,PLATFORM_DEVID_NONE , bxt_wc_dev,ARRAY_SIZE (bxt_wc_dev),NULL ,0 ,NULL ); -if (ret) { -dev_err (&pdev->dev,"Failed to add devices\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"Failed to add devices\n" ); ret =sysfs_create_group (&pdev->dev.kobj, &bxtwc_group);if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 168/459 mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 686fb77712a4bc94b76a0c5ae74c60118b7a0d79 ]
While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ).
Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them.
--- drivers/mfd/intel_soc_pmic_bxtwc.c | 57 +++++++++++++++++++++--------- drivers/usb/typec/tcpm/wcove.c | 4 --- 2 files changed, 40 insertions(+), 21 deletions(-)
drivers/mfd/intel_soc_pmic_bxtwc.c +40 -17
@@ -240,16 +240,6 @@ static struct mfd_cell bxt_wc_dev[] = { .num_resources = ARRAY_SIZE(thermal_resources), .resources = thermal_resources, }, - { - .name = "bxt_wcove_usbc", - .num_resources = ARRAY_SIZE(usbc_resources), - .resources = usbc_resources, - }, - { - .name = "bxt_wcove_ext_charger", - .num_resources = ARRAY_SIZE(charger_resources), - .resources = charger_resources, - }, { .name = "bxt_wcove_bcu", .num_resources = ARRAY_SIZE(bcu_resources),
@@ -271,6 +261,19 @@ static struct mfd_cell bxt_wc_dev[] = { }, }; +static struct mfd_cell bxt_wc_chgr_dev[] = { + { + .name ="bxt_wcove_usbc" , + .num_resources =ARRAY_SIZE (usbc_resources), + .resources = usbc_resources, + }, + { + .name ="bxt_wcove_ext_charger" , + .num_resources =ARRAY_SIZE (charger_resources), + .resources = charger_resources, + }, +}; +static int regmap_ipc_byte_reg_read (void *context,unsigned int reg,unsigned int *val) {
@@ -418,6 +421,26 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, 0, chip, data); } +static int bxtwc_add_chained_devices (struct intel_soc_pmic *pmic, +const struct mfd_cell *cells,int n_devs, +struct regmap_irq_chip_data *pdata, +int pirq,int irq_flags, +const struct regmap_irq_chip *chip, +struct regmap_irq_chip_data **data) +{ +struct device *dev = pmic->dev; +struct irq_domain *domain; +int ret; + + ret =bxtwc_add_chained_irq_chip (pmic, pdata, pirq, irq_flags, chip, data); +if (ret) +return dev_err_probe (dev, ret,"Failed to add %s IRQ chip\n" , chip->name); + + domain =regmap_irq_get_domain (*data); + +return devm_mfd_add_devices (dev,PLATFORM_DEVID_NONE , cells, n_devs,NULL ,0 , domain); +} +static int bxtwc_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -496,14 +519,14 @@ static int bxtwc_probe(struct platform_device *pdev)if (ret)return dev_err_probe (dev, ret,"Failed to add ADC IRQ chip\n" ); -/* Add chained IRQ handler for CHGR IRQs */ - ret =bxtwc_add_chained_irq_chip (pmic, pmic->irq_chip_data, -BXTWC_CHGR_LVL1_IRQ , -IRQF_ONESHOT , - &bxtwc_regmap_irq_chip_chgr, - &pmic->irq_chip_data_chgr); + ret =bxtwc_add_chained_devices (pmic, bxt_wc_chgr_dev,ARRAY_SIZE (bxt_wc_chgr_dev), + pmic->irq_chip_data, +BXTWC_CHGR_LVL1_IRQ , +IRQF_ONESHOT , + &bxtwc_regmap_irq_chip_chgr, + &pmic->irq_chip_data_chgr);if (ret) -return dev_err_probe (dev, ret,"Failed to add CHGR IRQ chip\n" ); +return ret;/* Add chained IRQ handler for CRIT IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
drivers/usb/typec/tcpm/wcove.c +0 -4
@@ -620,10 +620,6 @@ static int wcove_typec_probe(struct platform_device *pdev)if (irq <0 )return irq; - irq =regmap_irq_get_virq (pmic->irq_chip_data_chgr, irq); -if (irq <0 ) -return irq; - ret =guid_parse (WCOVE_DSM_UUID , &wcove->guid);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 169/459 mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 9b79d59e6b2b515eb9a22bc469ef7b8f0904fc73 ]
While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ).
Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them.
--- drivers/mfd/intel_soc_pmic_bxtwc.c | 31 ++++++++++++++------------ drivers/platform/x86/intel_bxtwc_tmu.c | 22 +++++------------- 2 files changed, 23 insertions(+), 30 deletions(-)
drivers/mfd/intel_soc_pmic_bxtwc.c +17 -14
@@ -245,12 +245,6 @@ static struct mfd_cell bxt_wc_dev[] = { .num_resources = ARRAY_SIZE(bcu_resources), .resources = bcu_resources, }, - { - .name = "bxt_wcove_tmu", - .num_resources = ARRAY_SIZE(tmu_resources), - .resources = tmu_resources, - }, - { .name = "bxt_wcove_gpio", .num_resources = ARRAY_SIZE(gpio_resources),
@@ -261,6 +255,14 @@ static struct mfd_cell bxt_wc_dev[] = { }, }; +static const struct mfd_cell bxt_wc_tmu_dev[] = { + { + .name ="bxt_wcove_tmu" , + .num_resources =ARRAY_SIZE (tmu_resources), + .resources = tmu_resources, + }, +}; +static struct mfd_cell bxt_wc_chgr_dev[] = { { .name ="bxt_wcove_usbc" ,
@@ -485,6 +487,15 @@ static int bxtwc_probe(struct platform_device *pdev)if (ret)return dev_err_probe (dev, ret,"Failed to add IRQ chip\n" ); + ret =bxtwc_add_chained_devices (pmic, bxt_wc_tmu_dev,ARRAY_SIZE (bxt_wc_tmu_dev), + pmic->irq_chip_data, +BXTWC_TMU_LVL1_IRQ , +IRQF_ONESHOT , + &bxtwc_regmap_irq_chip_tmu, + &pmic->irq_chip_data_tmu); +if (ret) +return ret; + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, BXTWC_PWRBTN_LVL1_IRQ, IRQF_ONESHOT,
@@ -493,14 +504,6 @@ static int bxtwc_probe(struct platform_device *pdev)if (ret)return dev_err_probe (dev, ret,"Failed to add PWRBTN IRQ chip\n" ); - ret =bxtwc_add_chained_irq_chip (pmic, pmic->irq_chip_data, -BXTWC_TMU_LVL1_IRQ , -IRQF_ONESHOT , - &bxtwc_regmap_irq_chip_tmu, - &pmic->irq_chip_data_tmu); -if (ret) -return dev_err_probe (dev, ret,"Failed to add TMU IRQ chip\n" ); -/* Add chained IRQ handler for BCU IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, BXTWC_BCU_LVL1_IRQ,
drivers/platform/x86/intel_bxtwc_tmu.c +6 -16
@@ -48,9 +48,8 @@ static irqreturn_t bxt_wcove_tmu_irq_handler(int irq, void *data)static int bxt_wcove_tmu_probe (struct platform_device *pdev) {struct intel_soc_pmic *pmic =dev_get_drvdata (pdev->dev.parent); -struct regmap_irq_chip_data *regmap_irq_chip;struct wcove_tmu *wctmu; -int ret, virq, irq; +int ret; wctmu =devm_kzalloc (&pdev->dev,sizeof (*wctmu),GFP_KERNEL );if (!wctmu)
@@ -59,27 +58,18 @@ static int bxt_wcove_tmu_probe(struct platform_device *pdev) wctmu->dev = &pdev->dev; wctmu->regmap = pmic->regmap; - irq =platform_get_irq (pdev,0 ); -if (irq <0 ) -return irq; + wctmu->irq =platform_get_irq (pdev,0 ); +if (wctmu->irq <0 ) +return wctmu->irq; - regmap_irq_chip = pmic->irq_chip_data_tmu; - virq =regmap_irq_get_virq (regmap_irq_chip, irq); -if (virq <0 ) { -dev_err (&pdev->dev, -"failed to get virtual interrupt=%d\n" , irq); -return virq; - } - - ret =devm_request_threaded_irq (&pdev->dev, virq, + ret =devm_request_threaded_irq (&pdev->dev, wctmu->irq,NULL , bxt_wcove_tmu_irq_handler,IRQF_ONESHOT ,"bxt_wcove_tmu" , wctmu);if (ret) {dev_err (&pdev->dev,"request irq failed: %d,virq: %d\n" , - ret, virq); + ret, wctmu->irq);return ret; } - wctmu->irq = virq;/* Unmask TMU second level Wake & System alarm */ regmap_update_bits(wctmu->regmap, BXTWC_MTMUIRQ_REG,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 170/459 mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 0350d783ab888cb1cb48ced36cc28b372723f1a4 ]
While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ).
Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them.
--- drivers/mfd/intel_soc_pmic_bxtwc.c | 54 +++++++++++++++++------------- 1 file changed, 30 insertions(+), 24 deletions(-)
drivers/mfd/intel_soc_pmic_bxtwc.c +30 -24
@@ -230,21 +230,11 @@ static struct resource tmu_resources[] = { };static struct mfd_cell bxt_wc_dev[] = { - { - .name ="bxt_wcove_gpadc" , - .num_resources =ARRAY_SIZE (adc_resources), - .resources = adc_resources, - }, { .name ="bxt_wcove_thermal" , .num_resources =ARRAY_SIZE (thermal_resources), .resources = thermal_resources, }, - { - .name ="bxt_wcove_bcu" , - .num_resources =ARRAY_SIZE (bcu_resources), - .resources = bcu_resources, - }, { .name ="bxt_wcove_gpio" , .num_resources =ARRAY_SIZE (gpio_resources),
@@ -263,6 +253,22 @@ static const struct mfd_cell bxt_wc_tmu_dev[] = { }, }; +static const struct mfd_cell bxt_wc_bcu_dev[] = { + { + .name ="bxt_wcove_bcu" , + .num_resources =ARRAY_SIZE (bcu_resources), + .resources = bcu_resources, + }, +}; + +static const struct mfd_cell bxt_wc_adc_dev[] = { + { + .name ="bxt_wcove_gpadc" , + .num_resources =ARRAY_SIZE (adc_resources), + .resources = adc_resources, + }, +}; +static struct mfd_cell bxt_wc_chgr_dev[] = { { .name ="bxt_wcove_usbc" ,
@@ -504,23 +510,23 @@ static int bxtwc_probe(struct platform_device *pdev)if (ret)return dev_err_probe (dev, ret,"Failed to add PWRBTN IRQ chip\n" ); -/* Add chained IRQ handler for BCU IRQs */ - ret =bxtwc_add_chained_irq_chip (pmic, pmic->irq_chip_data, -BXTWC_BCU_LVL1_IRQ , -IRQF_ONESHOT , - &bxtwc_regmap_irq_chip_bcu, - &pmic->irq_chip_data_bcu); + ret =bxtwc_add_chained_devices (pmic, bxt_wc_bcu_dev,ARRAY_SIZE (bxt_wc_bcu_dev), + pmic->irq_chip_data, +BXTWC_BCU_LVL1_IRQ , +IRQF_ONESHOT , + &bxtwc_regmap_irq_chip_bcu, + &pmic->irq_chip_data_bcu);if (ret) -return dev_err_probe (dev, ret,"Failed to add BUC IRQ chip\n" ); +return ret; -/* Add chained IRQ handler for ADC IRQs */ - ret =bxtwc_add_chained_irq_chip (pmic, pmic->irq_chip_data, -BXTWC_ADC_LVL1_IRQ , -IRQF_ONESHOT , - &bxtwc_regmap_irq_chip_adc, - &pmic->irq_chip_data_adc); + ret =bxtwc_add_chained_devices (pmic, bxt_wc_adc_dev,ARRAY_SIZE (bxt_wc_adc_dev), + pmic->irq_chip_data, +BXTWC_ADC_LVL1_IRQ , +IRQF_ONESHOT , + &bxtwc_regmap_irq_chip_adc, + &pmic->irq_chip_data_adc);if (ret) -return dev_err_probe (dev, ret,"Failed to add ADC IRQ chip\n" ); +return ret; ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev), pmic->irq_chip_data,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 171/459 cpufreq: loongson2: Unregister platform_driver on failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 5f856d71ccdf89b4bac0ff70ebb0bb582e7f7f18 ]
When cpufreq_register_driver() returns error, the cpufreq_init() returns without unregister platform_driver, fix by add missing platform_driver_unregister() when cpufreq_register_driver() failed.
--- drivers/cpufreq/loongson2_cpufreq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/cpufreq/loongson2_cpufreq.c +3 -1
@@ -155,7 +155,9 @@ static int __init cpufreq_init(void) ret =cpufreq_register_driver (&loongson2_cpufreq_driver); -if (!ret && !nowait) { +if (ret) { +platform_driver_unregister (&platform_driver); + }else if (!nowait) { saved_cpu_wait = cpu_wait; cpu_wait = loongson2_cpu_wait; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 172/459 mtd: rawnand: atmel: Fix possible memory leak
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 6d734f1bfc336aaea91313a5632f2f197608fadd ]
The pmecc "user" structure is allocated in atmel_pmecc_create_user() and was supposed to be freed with atmel_pmecc_destroy_user(), but this other helper is never called. One solution would be to find the proper location to call the destructor, but the trend today is to switch to device managed allocations, which in this case fits pretty well.
Replace kzalloc() by devm_kzalloc() and drop the destructor entirely.
--- drivers/mtd/nand/raw/atmel/pmecc.c | 8 +------- drivers/mtd/nand/raw/atmel/pmecc.h | 2 -- 2 files changed, 1 insertion(+), 9 deletions(-)
drivers/mtd/nand/raw/atmel/pmecc.c +1 -7
@@ -362,7 +362,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc, size =ALIGN (size,sizeof (s32)); size += (req->ecc.strength +1 ) *sizeof (s32) *3 ; - user =kzalloc (size,GFP_KERNEL ); + user =devm_kzalloc (pmecc->dev, size,GFP_KERNEL );if (!user)return ERR_PTR (-ENOMEM );
@@ -408,12 +408,6 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc, }EXPORT_SYMBOL_GPL (atmel_pmecc_create_user); -void atmel_pmecc_destroy_user (struct atmel_pmecc_user *user) -{ -kfree (user); -} -EXPORT_SYMBOL_GPL (atmel_pmecc_destroy_user); -static int get_strength (struct atmel_pmecc_user *user) {const int *strengths = user->pmecc->caps->strengths;
drivers/mtd/nand/raw/atmel/pmecc.h +0 -2
@@ -55,8 +55,6 @@ struct atmel_pmecc *devm_atmel_pmecc_get(struct device *dev);struct atmel_pmecc_user *atmel_pmecc_create_user (struct atmel_pmecc *pmecc,struct atmel_pmecc_user_req *req); -void atmel_pmecc_destroy_user (struct atmel_pmecc_user *user); -void atmel_pmecc_reset (struct atmel_pmecc *pmecc);int atmel_pmecc_enable (struct atmel_pmecc_user *user,int op);void atmel_pmecc_disable (struct atmel_pmecc_user *user);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 173/459 powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit cadae3a45d23aa4f6485938a67cbc47aaaa25e38 ]
The dtl_access_lock needs to be a rw_sempahore, a sleeping lock, because the code calls kmalloc() while holding it, which can sleep:
# echo 1 > /proc/powerpc/vcpudispatch_stats
BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 199, name: sh
preempt_count: 1, expected: 0
3 locks held by sh/199:
#0: c00000000a0743f8 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x324/0x438
#1: c0000000028c7058 (dtl_enable_mutex){+.+.}-{3:3}, at: vcpudispatch_stats_write+0xd4/0x5f4
#2: c0000000028c70b8 (dtl_access_lock){+.+.}-{2:2}, at: vcpudispatch_stats_write+0x220/0x5f4
CPU: 0 PID: 199 Comm: sh Not tainted 6.10.0-rc4 #152
Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries
Call Trace:
dump_stack_lvl+0x130/0x148 (unreliable)
__might_resched+0x174/0x410
kmem_cache_alloc_noprof+0x340/0x3d0
alloc_dtl_buffers+0x124/0x1ac
vcpudispatch_stats_write+0x2a8/0x5f4
proc_reg_write+0xf4/0x150
vfs_write+0xfc/0x438
ksys_write+0x88/0x148
system_call_exception+0x1c4/0x5a0
system_call_common+0xf4/0x258--- arch/powerpc/include/asm/dtl.h | 4 ++-- arch/powerpc/platforms/pseries/dtl.c | 8 ++++---- arch/powerpc/platforms/pseries/lpar.c | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-)
arch/powerpc/include/asm/dtl.h +2 -2
@@ -1,8 +1,8 @@#ifndef _ASM_POWERPC_DTL_H#define _ASM_POWERPC_DTL_H +#include <linux/rwsem.h> #include <asm/lppaca.h> -#include <linux/spinlock_types.h> /* * Layout of entries in the hypervisor's dispatch trace log buffer.
@@ -35,7 +35,7 @@ struct dtl_entry {#define DTL_LOG_ALL (DTL_LOG_CEDE | DTL_LOG_PREEMPT | DTL_LOG_FAULT)extern struct kmem_cache *dtl_cache; -extern rwlock_t dtl_access_lock; +extern struct rw_semaphore dtl_access_lock;/* * When CONFIG_VIRT_CPU_ACCOUNTING_NATIVE = y, the cpu accounting code controls
arch/powerpc/platforms/pseries/dtl.c +4 -4
@@ -181,7 +181,7 @@ static int dtl_enable(struct dtl *dtl)return -EBUSY ;/* ensure there are no other conflicting dtl users */ -if (!read_trylock (&dtl_access_lock)) +if (!down_read_trylock (&dtl_access_lock))return -EBUSY ; n_entries = dtl_buf_entries;
@@ -189,7 +189,7 @@ static int dtl_enable(struct dtl *dtl)if (!buf) {printk (KERN_WARNING "%s: buffer alloc failed for cpu %d\n" , __func__, dtl->cpu); -read_unlock (&dtl_access_lock); +up_read (&dtl_access_lock);return -ENOMEM ; }
@@ -207,7 +207,7 @@ static int dtl_enable(struct dtl *dtl)spin_unlock (&dtl->lock);if (rc) { -read_unlock (&dtl_access_lock); +up_read (&dtl_access_lock);kmem_cache_free (dtl_cache, buf); }
@@ -222,7 +222,7 @@ static void dtl_disable(struct dtl *dtl) dtl->buf =NULL ; dtl->buf_entries =0 ;spin_unlock (&dtl->lock); -read_unlock (&dtl_access_lock); +up_read (&dtl_access_lock); }/* file interface */
arch/powerpc/platforms/pseries/lpar.c +4 -4
@@ -166,7 +166,7 @@ struct vcpu_dispatch_data {*/ #define NR_CPUS_H NR_CPUS -DEFINE_RWLOCK (dtl_access_lock); +DECLARE_RWSEM (dtl_access_lock); static DEFINE_PER_CPU(struct vcpu_dispatch_data, vcpu_disp_data); static DEFINE_PER_CPU(u64, dtl_entry_ridx); static DEFINE_PER_CPU(struct dtl_worker, dtl_workers);
@@ -460,7 +460,7 @@ static int dtl_worker_enable(unsigned long *time_limit) {int rc =0 , state; -if (!write_trylock (&dtl_access_lock)) { +if (!down_write_trylock (&dtl_access_lock)) { rc = -EBUSY ; goto out; }
@@ -476,7 +476,7 @@ static int dtl_worker_enable(unsigned long *time_limit)pr_err ("vcpudispatch_stats: unable to setup workqueue for DTL processing\n" );free_dtl_buffers (time_limit);reset_global_dtl_mask (); -write_unlock (&dtl_access_lock); +up_write (&dtl_access_lock); rc = -EINVAL ; goto out; }
@@ -491,7 +491,7 @@ static void dtl_worker_disable(unsigned long *time_limit)cpuhp_remove_state (dtl_worker_state);free_dtl_buffers (time_limit);reset_global_dtl_mask (); -write_unlock (&dtl_access_lock); +up_write (&dtl_access_lock); } static ssize_t vcpudispatch_stats_write(struct file *file, const char __user *p,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 174/459 RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kashyap Desai <[email protected]>
[ Upstream commit 808ca6de989c598bc5af1ae0ad971a66077efac0 ]
Invalidate rkey is cpu endian and immediate data is in big endian format. Both immediate data and invalidate the remote key returned by HW is in little endian format.
While handling the commit in fixes tag, the difference between immediate data and invalidate rkey endianness was not considered.
Without changes of this patch, Kernel ULP was failing while processing inv_rkey.
dmesg log snippet -
nvme nvme0: Bogus remote invalidation for rkey 0x2000019Fix in this patch
Do endianness conversion based on completion queue entry flag. Also, the HW completions are already converted to host endianness in bnxt_qplib_cq_process_res_rc and bnxt_qplib_cq_process_res_ud and there is no need to convert it again in bnxt_re_poll_cq. Modified the union to hold the correct data type.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +++++-- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +5 -2
@@ -3334,7 +3334,7 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp, wc->byte_len = orig_cqe->length; wc->qp = &gsi_qp->ib_qp; - wc->ex.imm_data =cpu_to_be32 (le32_to_cpu (orig_cqe->immdata)); + wc->ex.imm_data =cpu_to_be32 (orig_cqe->immdata); wc->src_qp = orig_cqe->src_qp;memcpy (wc->smac, orig_cqe->smac,ETH_ALEN );if (bnxt_re_is_vlan_pkt (orig_cqe, &vlan_id, &sl)) {
@@ -3474,7 +3474,10 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)continue ; } wc->qp = &qp->ib_qp; - wc->ex.imm_data =cpu_to_be32 (le32_to_cpu (cqe->immdata)); +if (cqe->flags &CQ_RES_RC_FLAGS_IMM ) + wc->ex.imm_data =cpu_to_be32 (cqe->immdata); +else + wc->ex.invalidate_rkey = cqe->invrkey; wc->src_qp = cqe->src_qp;memcpy (wc->smac, cqe->smac,ETH_ALEN ); wc->port_num =1 ;
drivers/infiniband/hw/bnxt_re/qplib_fp.h +1 -1
@@ -372,7 +372,7 @@ struct bnxt_qplib_cqe {u16 cfa_meta;u64 wr_id;union { -__le32 immdata; +u32 immdata;u32 invrkey; };u64 qp_handle;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 175/459 mfd: rt5033: Fix missing regmap_del_irq_chip()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Changzhong <[email protected]>
[ Upstream commit d256d612f47529ed0b332298e2d5ea981a4dd5b8 ]
Fix missing call to regmap_del_irq_chip() in error handling path by using devm_regmap_add_irq_chip().
--- drivers/mfd/rt5033.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mfd/rt5033.c +2 -2
@@ -82,8 +82,8 @@ static int rt5033_i2c_probe(struct i2c_client *i2c, }dev_info (&i2c->dev,"Device found Device ID: %04x\n" , dev_id); - ret =regmap_add_irq_chip (rt5033->regmap, rt5033->irq, -IRQF_TRIGGER_FALLING |IRQF_ONESHOT , + ret =devm_regmap_add_irq_chip (rt5033->dev, rt5033->regmap, + rt5033->irq,IRQF_TRIGGER_FALLING |IRQF_ONESHOT ,0 , &rt5033_irq_chip, &rt5033->irq_data);if (ret) { dev_err(&i2c->dev, "Failed to request IRQ %d: %d\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 176/459 scsi: bfa: Fix use-after-free in bfad_im_module_exit()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 178b8f38932d635e90f5f0e9af1986c6f4a89271 ]
BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: <TASK> dump_stack_lvl+0x95/0xe0 print_report+0xcb/0x620 kasan_report+0xbd/0xf0 __lock_acquire+0x2aca/0x3a20 lock_acquire+0x19b/0x520 _raw_spin_lock+0x2b/0x40 attribute_container_unregister+0x30/0x160 fc_release_transport+0x19/0x90 [scsi_transport_fc] bfad_im_module_exit+0x23/0x60 [bfa] bfad_init+0xdb/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 fc_attach_transport+0x4f/0x4740 [scsi_transport_fc] bfad_im_module_init+0x17/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x38/0x50 kfree+0x212/0x480 bfad_im_module_init+0x7e/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Above issue happens as follows:
bfad_init
error = bfad_im_module_init()
fc_release_transport(bfad_im_scsi_transport_template);
if (error)
goto ext;ext:
bfad_im_module_exit();
fc_release_transport(bfad_im_scsi_transport_template);
--> Trigger double releaseDon't call bfad_im_module_exit() if bfad_im_module_init() failed.
--- drivers/scsi/bfa/bfad.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/bfa/bfad.c +1 -2
@@ -1705,9 +1705,8 @@ bfad_init(void) error =bfad_im_module_init ();if (error) { - error = -ENOMEM ;printk (KERN_WARNING "bfad_im_module_init failure\n" ); - goto ext; +return -ENOMEM ; }if (strcmp (FCPI_NAME ," fcpim" ) ==0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 177/459 scsi: fusion: Remove unused variable rc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zeng Heng <[email protected]>
[ Upstream commit bd65694223f7ad11c790ab63ad1af87a771192ee ]
The return value of scsi_device_reprobe() is currently ignored in _scsih_reprobe_lun(). Fixing the calling code to deal with the potential error is non-trivial, so for now just WARN_ON().
The handling of scsi_device_reprobe()'s return value refers to _scsih_reprobe_lun() and the following link:
--- drivers/message/fusion/mptsas.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/message/fusion/mptsas.c +1 -3
@@ -4205,10 +4205,8 @@ mptsas_find_phyinfo_by_phys_disk_num(MPT_ADAPTER *ioc, u8 phys_disk_num,static void mptsas_reprobe_lun (struct scsi_device *sdev,void *data) { -int rc; - sdev->no_uld_attach = data ?1 :0 ; - rc =scsi_device_reprobe (sdev); +WARN_ON (scsi_device_reprobe (sdev)); } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 178/459 scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Lei <[email protected]>
[ Upstream commit c62c30429db3eb4ced35c7fcf6f04a61ce3a01bb ]
Hook "qed_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().
--- drivers/scsi/qedf/qedf_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/qedf/qedf_main.c +1 -0
@@ -2725,6 +2725,7 @@ static int qedf_alloc_and_init_sb(struct qedf_ctx *qedf, sb_id, QED_SB_TYPE_STORAGE);if (ret) { +dma_free_coherent (&qedf->pdev->dev,sizeof (*sb_virt), sb_virt, sb_phys);QEDF_ERR (&qedf->dbg_ctx,"Status block initialization failed (0x%x) for id = %d.\n" , ret, sb_id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 179/459 scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Lei <[email protected]>
[ Upstream commit 95bbdca4999bc59a72ebab01663d421d6ce5775d ]
Hook "qedi_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().
--- drivers/scsi/qedi/qedi_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/qedi/qedi_main.c +1 -0
@@ -371,6 +371,7 @@ static int qedi_alloc_and_init_sb(struct qedi_ctx *qedi, ret = qedi_ops->common->sb_init (qedi->cdev, sb_info, sb_virt, sb_phys, sb_id,QED_SB_TYPE_STORAGE );if (ret) { +dma_free_coherent (&qedi->pdev->dev,sizeof (*sb_virt), sb_virt, sb_phys);QEDI_ERR (&qedi->dbg_ctx,"Status block initialization failed for id = %d.\n" , sb_id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 180/459 RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit 6b526d17eed850352d880b93b9bf20b93006bd92 ]
ib_map_mr_sg() allows ULPs to specify NULL as the sg_offset argument. The driver needs to check whether it is a NULL pointer before dereferencing it.
--- drivers/infiniband/hw/hns/hns_roce_mr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/infiniband/hw/hns/hns_roce_mr.c +4 -3
@@ -478,15 +478,16 @@ static int hns_roce_set_page(struct ib_mr *ibmr, u64 addr) }int hns_roce_map_mr_sg (struct ib_mr *ibmr,struct scatterlist *sg,int sg_nents, -unsigned int *sg_offset) +unsigned int *sg_offset_p) { +unsigned int sg_offset = sg_offset_p ? *sg_offset_p :0 ;struct hns_roce_dev *hr_dev =to_hr_dev (ibmr->device);struct ib_device *ibdev = &hr_dev->ib_dev;struct hns_roce_mr *mr =to_hr_mr (ibmr);struct hns_roce_mtr *mtr = &mr->pbl_mtr;int ret, sg_num =0 ; -if (!IS_ALIGNED (*sg_offset,HNS_ROCE_FRMR_ALIGN_SIZE ) || +if (!IS_ALIGNED (sg_offset,HNS_ROCE_FRMR_ALIGN_SIZE ) || ibmr->page_size <HNS_HW_PAGE_SIZE || ibmr->page_size >HNS_HW_MAX_PAGE_SIZE )return sg_num;
@@ -497,7 +498,7 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,if (!mr->page_list)return sg_num; - sg_num =ib_sg_to_pages (ibmr, sg, sg_nents, sg_offset, hns_roce_set_page); + sg_num =ib_sg_to_pages (ibmr, sg, sg_nents, sg_offset_p, hns_roce_set_page);if (sg_num <1 ) {ibdev_err (ibdev,"failed to store sg pages %u %u, cnt = %d.\n" , mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, sg_num);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 181/459 ocfs2: fix uninitialized value in ocfs2_file_read_iter()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit adc77b19f62d7e80f98400b2fca9d700d2afdd6f ]
Syzbot has reported the following KMSAN splat:
BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_worker_handle_work+0xd13/0x2110 io_wq_worker+0x447/0x1410 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30
Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 alloc_pages_noprof+0x1bf/0x1e0 allocate_slab+0x33a/0x1250 ___slab_alloc+0x12ef/0x35e0 kmem_cache_alloc_bulk_noprof+0x486/0x1330 __io_alloc_req_refill+0x84/0x560 io_submit_sqes+0x172f/0x2f30 __se_sys_io_uring_enter+0x406/0x41c0 __x64_sys_io_uring_enter+0x11f/0x1a0 x64_sys_call+0x2b54/0x3ba0 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in 'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.
--- fs/ocfs2/aops.h | 2 ++ fs/ocfs2/file.c | 4 ++++ 2 files changed, 6 insertions(+)
fs/ocfs2/aops.h +2 -0
@@ -72,6 +72,8 @@ enum ocfs2_iocb_lock_bits { OCFS2_IOCB_NUM_LOCKS }; +#define ocfs2_iocb_init_rw_locked (iocb) \ + (iocb->private = NULL)#define ocfs2_iocb_clear_rw_locked (iocb) \ clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private)#define ocfs2_iocb_rw_locked_level (iocb) \
fs/ocfs2/file.c +4 -0
@@ -2401,6 +2401,8 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb, }else inode_lock (inode); +ocfs2_iocb_init_rw_locked (iocb); +/* * Concurrent O_DIRECT writes are allowed with * mount_option "coherency=buffered".
@@ -2547,6 +2549,8 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb,if (!direct_io && nowait)return -EOPNOTSUPP ; +ocfs2_iocb_init_rw_locked (iocb); +/* * buffered reads protect themselves in ->readpage(). O_DIRECT reads * need locks to protect pending reads from racing with truncate.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 182/459 powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Suchanek <[email protected]>
[ Upstream commit a26c4dbb3d9c1821cb0fc11cb2dbc32d5bf3463b ]
These functions are not used outside of sstep.c
--- arch/powerpc/include/asm/sstep.h | 5 ----- arch/powerpc/lib/sstep.c | 12 ++++-------- 2 files changed, 4 insertions(+), 13 deletions(-)
arch/powerpc/include/asm/sstep.h +0 -5
@@ -174,9 +174,4 @@ extern int emulate_step(struct pt_regs *regs, struct ppc_inst instr);*/ extern int emulate_loadstore (struct pt_regs *regs,struct instruction_op *op); -extern void emulate_vsx_load (struct instruction_op *op,union vsx_reg *reg, -const void *mem,bool cross_endian); -extern void emulate_vsx_store (struct instruction_op *op, -const union vsx_reg *reg,void *mem, -bool cross_endian);extern int emulate_dcbz (unsigned long ea,struct pt_regs *regs);
arch/powerpc/lib/sstep.c +4 -8
@@ -706,8 +706,8 @@ static nokprobe_inline int emulate_stq(struct pt_regs *regs, unsigned long ea,#endif /* __powerpc64 */ #ifdef CONFIG_VSX -void emulate_vsx_load (struct instruction_op *op,union vsx_reg *reg, -const void *mem,bool rev) +static nokprobe_inline void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg, +const void *mem,bool rev) {int size, read_size;int i, j;
@@ -787,11 +787,9 @@ void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,break ; } } -EXPORT_SYMBOL_GPL (emulate_vsx_load); -NOKPROBE_SYMBOL (emulate_vsx_load); -void emulate_vsx_store (struct instruction_op *op,const union vsx_reg *reg, -void *mem,bool rev) +static nokprobe_inline void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg, +void *mem,bool rev) {int size, write_size;int i, j;
@@ -863,8 +861,6 @@ void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,break ; } } -EXPORT_SYMBOL_GPL (emulate_vsx_store); -NOKPROBE_SYMBOL (emulate_vsx_store); static nokprobe_inline int do_vsx_load(struct instruction_op *op, unsigned long ea, struct pt_regs *regs,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 183/459 powerpc/kexec: Fix return of uninitialized variable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Zekun <[email protected]>
[ Upstream commit 83b5a407fbb73e6965adfb4bd0a803724bf87f96 ]
of_property_read_u64() can fail and leave the variable uninitialized, which will then be used. Return error if reading the property failed.
--- arch/powerpc/kexec/file_load_64.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/powerpc/kexec/file_load_64.c +7 -2
@@ -909,13 +909,18 @@ int setup_purgatory_ppc64(struct kimage *image, const void *slave_code,if (dn) {u64 val; -of_property_read_u64 (dn,"opal-base-address" , &val); + ret =of_property_read_u64 (dn,"opal-base-address" , &val); +if (ret) + goto out; + ret =kexec_purgatory_get_set_symbol (image,"opal_base" , &val,sizeof (val), false);if (ret) goto out; -of_property_read_u64 (dn,"opal-entry-address" , &val); + ret =of_property_read_u64 (dn,"opal-entry-address" , &val); +if (ret) + goto out; ret =kexec_purgatory_get_set_symbol (image,"opal_entry" , &val,sizeof (val), false); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 184/459 fbdev/sh7760fb: Alloc DMA memory from hardware device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 8404e56f4bc1d1a65bfc98450ba3dae5e653dda1 ]
Pass the hardware device to the DMA helpers dma_alloc_coherent() and dma_free_coherent(). The fbdev device that is currently being used is a software device and does not provide DMA memory. Also update the related dev_*() output statements similarly.
Stable-dep-of: f89d17ae2ac4 ("fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()")
--- drivers/video/fbdev/sh7760fb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/video/fbdev/sh7760fb.c +4 -4
@@ -359,7 +359,7 @@ static void sh7760fb_free_mem(struct fb_info *info)if (!info->screen_base)return ; -dma_free_coherent (info->dev, info->screen_size, +dma_free_coherent (info->device, info->screen_size, info->screen_base, par->fbdma); par->fbdma =0 ;
@@ -408,14 +408,14 @@ static int sh7760fb_alloc_mem(struct fb_info *info)if (vram <PAGE_SIZE ) vram =PAGE_SIZE ; - fbmem =dma_alloc_coherent (info->dev, vram, &par->fbdma,GFP_KERNEL ); + fbmem =dma_alloc_coherent (info->device, vram, &par->fbdma,GFP_KERNEL );if (!fbmem)return -ENOMEM ;if ((par->fbdma &SH7760FB_DMA_MASK ) !=SH7760FB_DMA_MASK ) {sh7760fb_free_mem (info); -dev_err (info->dev,"kernel gave me memory at 0x%08lx, which is" +dev_err (info->device,"kernel gave me memory at 0x%08lx, which is" "unusable for the LCDC\n" , (unsigned long )par->fbdma);return -ENOMEM ; }
@@ -486,7 +486,7 @@ static int sh7760fb_probe(struct platform_device *pdev) ret =sh7760fb_alloc_mem (info);if (ret) { -dev_dbg (info->dev,"framebuffer memory allocation failed!\n" ); +dev_dbg (info->device,"framebuffer memory allocation failed!\n" ); goto out_unmap; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 185/459 fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Lei <[email protected]>
[ Upstream commit f89d17ae2ac42931be2a0153fecbf8533280c927 ]
When information such as info->screen_base is not ready, calling sh7760fb_free_mem() does not release memory correctly. Call dma_free_coherent() instead.
--- drivers/video/fbdev/sh7760fb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/video/fbdev/sh7760fb.c +1 -2
@@ -409,12 +409,11 @@ static int sh7760fb_alloc_mem(struct fb_info *info) vram =PAGE_SIZE ; fbmem =dma_alloc_coherent (info->device, vram, &par->fbdma,GFP_KERNEL ); -if (!fbmem)return -ENOMEM ;if ((par->fbdma &SH7760FB_DMA_MASK ) !=SH7760FB_DMA_MASK ) { -sh7760fb_free_mem (info); +dma_free_coherent (info->device, vram, fbmem, par->fbdma);dev_err (info->device,"kernel gave me memory at 0x%08lx, which is" "unusable for the LCDC\n" , (unsigned long )par->fbdma);return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 186/459 dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Ardelean <[email protected]>
[ Upstream commit bd91abb218e0ac4a7402d6c25d383e2a706bb511 ]
This change converts the old binding for the AXI clkgen driver to a yaml format.
As maintainers, added:
- Lars-Peter Clausen <[email protected]> - as original author of driver & binding
- Michael Hennerich <[email protected]> - as supporter of Analog Devices drivers
Stable-dep-of: 47f3f5a82a31 ("dt-bindings: clock: axi-clkgen: include AXI clk")
--- .../bindings/clock/adi,axi-clkgen.yaml | 53 +++++++++++++++++++ .../devicetree/bindings/clock/axi-clkgen.txt | 25 --------- 2 files changed, 53 insertions(+), 25 deletions(-) create mode 100644 Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml delete mode 100644 Documentation/devicetree/bindings/clock/axi-clkgen.txt
Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml new file +53 -0
@@ -0,0 +1,53 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/clock/adi,axi-clkgen.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Binding for Analog Devices AXI clkgen pcore clock generator + +maintainers: + - Lars-Peter Clausen <[email protected]> + - Michael Hennerich <[email protected]> + +description: | + The axi_clkgen IP core is a software programmable clock generator, + that can be synthesized on various FPGA platforms. + + Link: https://wiki.analog.com/resources/fpga/docs/axi_clkgen + +properties: + compatible: + enum: + - adi,axi-clkgen-2.00.a + + clocks: + description: + Specifies the reference clock(s) from which the output frequency is + derived. This must either reference one clock if only the first clock + input is connected or two if both clock inputs are connected. + minItems: 1 + maxItems: 2 + + '#clock-cells': + const: 0 + + reg: + maxItems: 1 + +required: + - compatible + - reg + - clocks + - '#clock-cells' + +additionalProperties: false + +examples: + - | + clock-controller@ff000000 { + compatible = "adi,axi-clkgen-2.00.a"; + #clock-cells = <0>; + reg = <0xff000000 0x1000>; + clocks = <&osc 1>; + };
Documentation/devicetree/bindings/clock/axi-clkgen.txt deleted +0 -25
@@ -1,25 +0,0 @@ -Binding for the axi-clkgen clock generator - -This binding uses the common clock binding[1]. - -[1] Documentation/devicetree/bindings/clock/clock-bindings.txt - -Required properties: -- compatible : shall be "adi,axi-clkgen-1.00.a" or "adi,axi-clkgen-2.00.a". -- #clock-cells : from common clock binding; Should always be set to 0. -- reg : Address and length of the axi-clkgen register set. -- clocks : Phandle and clock specifier for the parent clock(s). This must - either reference one clock if only the first clock input is connected or two - if both clock inputs are connected. For the later case the clock connected - to the first input must be specified first. - -Optional properties: -- clock-output-names : From common clock binding. - -Example: - clock@ff000000 { - compatible = "adi,axi-clkgen"; - #clock-cells = <0>; - reg = <0xff000000 0x1000>; - clocks = <&osc 1>; - };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 187/459 dt-bindings: clock: axi-clkgen: include AXI clk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
[ Upstream commit 47f3f5a82a31527e027929c5cec3dd1ef5ef30f5 ]
In order to access the registers of the HW, we need to make sure that the AXI bus clock is enabled. Hence let's increase the number of clocks by one and add clock-names to differentiate between parent clocks and the bus clock.
--- .../bindings/clock/adi,axi-clkgen.yaml | 22 +++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml +18 -4
@@ -25,9 +25,21 @@ properties: description: Specifies the reference clock(s) from which the output frequency is derived. This must either reference one clock if only the first clock - input is connected or two if both clock inputs are connected. - minItems: 1 - maxItems: 2 + input is connected or two if both clock inputs are connected. The last + clock is the AXI bus clock that needs to be enabled so we can access the + core registers. + minItems: 2 + maxItems: 3 + + clock-names: + oneOf: + - items: + - const: clkin1 + - const: s_axi_aclk + - items: + - const: clkin1 + - const: clkin2 + - const: s_axi_aclk '#clock-cells': const: 0
@@ -39,6 +51,7 @@ required: - compatible - reg - clocks + - clock-names - '#clock-cells' additionalProperties: false
@@ -49,5 +62,6 @@ examples: compatible = "adi,axi-clkgen-2.00.a"; #clock-cells = <0>; reg = <0xff000000 0x1000>; - clocks = <&osc 1>; + clocks = <&osc 1>, <&clkc 15>; + clock-names = "clkin1", "s_axi_aclk"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 188/459 clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Ardelean <[email protected]>
[ Upstream commit 6ba7ea7630fb03c1ce01508bdf89f5bb39b38e54 ]
No major functional change. Noticed while checking the driver code that this could be used.
Saves two lines.
Stable-dep-of: c64ef7e4851d ("clk: clk-axi-clkgen: make sure to enable the AXI bus clock")
--- drivers/clk/clk-axi-clkgen.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/clk/clk-axi-clkgen.c +1 -3
@@ -497,7 +497,6 @@ static int axi_clkgen_probe(struct platform_device *pdev)struct clk_init_data init;const char *parent_names[2 ];const char *clk_name; -struct resource *mem;unsigned int i;int ret;
@@ -512,8 +511,7 @@ static int axi_clkgen_probe(struct platform_device *pdev)if (!axi_clkgen)return -ENOMEM ; - mem =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - axi_clkgen->base =devm_ioremap_resource (&pdev->dev, mem); + axi_clkgen->base =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (axi_clkgen->base))return PTR_ERR (axi_clkgen->base);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 189/459 clk: clk-axi-clkgen: make sure to enable the AXI bus clock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
[ Upstream commit c64ef7e4851d1a9abbb7f7833e4936973ac5ba79 ]
In order to access the registers of the HW, we need to make sure that the AXI bus clock is enabled. Hence let's increase the number of clocks by one.
In order to keep backward compatibility and make sure old DTs still work we check if clock-names is available or not. If it is, then we can disambiguate between really having the AXI clock or a parent clock and so we can enable the bus clock. If not, we fallback to what was done before and don't explicitly enable the AXI bus clock.
Note that if clock-names is given, the axi clock must be the last one in the phandle array (also enforced in the DT bindings) so that we can reuse as much code as possible.
--- drivers/clk/clk-axi-clkgen.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
drivers/clk/clk-axi-clkgen.c +20 -2
@@ -7,6 +7,7 @@*/ #include <linux/platform_device.h> +#include <linux/clk.h> #include <linux/clk-provider.h> #include <linux/slab.h> #include <linux/io.h>
@@ -497,6 +498,7 @@ static int axi_clkgen_probe(struct platform_device *pdev)struct clk_init_data init;const char *parent_names[2 ];const char *clk_name; +struct clk *axi_clk;unsigned int i;int ret;
@@ -516,8 +518,24 @@ static int axi_clkgen_probe(struct platform_device *pdev)return PTR_ERR (axi_clkgen->base); init.num_parents =of_clk_get_parent_count (pdev->dev.of_node); -if (init.num_parents <1 || init.num_parents >2 ) -return -EINVAL ; + + axi_clk =devm_clk_get_enabled (&pdev->dev,"s_axi_aclk" ); +if (!IS_ERR (axi_clk)) { +if (init.num_parents <2 || init.num_parents >3 ) +return -EINVAL ; + + init.num_parents -=1 ; + }else { +/* +* Legacy... So that old DTs which do not have clock-names still +* work. In this case we don't explicitly enable the AXI bus +* clock. +*/ +if (PTR_ERR (axi_clk) != -ENOENT ) +return PTR_ERR (axi_clk); +if (init.num_parents <1 || init.num_parents >2 ) +return -EINVAL ; + }for (i =0 ; i < init.num_parents; i++) { parent_names[i] =of_clk_get_parent_name (pdev->dev.of_node, i);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 190/459 perf cs-etm: Dont flush when packet_queue fills up
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit 5afd032961e8465808c4bc385c06e7676fbe1951 ]
cs_etm__flush(), like cs_etm__sample() is an operation that generates a sample and then swaps the current with the previous packet. Calling flush after processing the queues results in two swaps which corrupts the next sample. Therefore it wasn't appropriate to call flush here so remove it.
Flushing is still done on a discontinuity to explicitly clear the last branch buffer, but when the packet_queue fills up before reaching a timestamp, that's not a discontinuity and the call to cs_etm__process_traceid_queue() already generated samples and drained the buffers correctly.
This is visible by looking for a branch that has the same target as the previous branch and the following source is before the address of the last target, which is impossible as execution would have had to have gone backwards:
ffff800080849d40 _find_next_and_bit+0x78 => ffff80008011cadc update_sg_lb_stats+0x94
(packet_queue fills here before a timestamp, resulting in a flush and
branch target ffff80008011cadc is duplicated.)
ffff80008011cb1c update_sg_lb_stats+0xd4 => ffff80008011cadc update_sg_lb_stats+0x94 ffff8000801117c4 cpu_util+0x24 => ffff8000801117d4 cpu_util+0x34
After removing the flush the correct branch target is used for the second sample, and ffff8000801117c4 is no longer before the previous address:
ffff800080849d40 _find_next_and_bit+0x78 => ffff80008011cadc update_sg_lb_stats+0x94 ffff80008011cb1c update_sg_lb_stats+0xd4 => ffff8000801117a0 cpu_util+0x0 ffff8000801117c4 cpu_util+0x24 => ffff8000801117d4 cpu_util+0x34
Make sure that a final branch stack is output at the end of the trace by calling cs_etm__end_block(). This is already done for both the timeless decode paths.
--- tools/perf/util/cs-etm.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
tools/perf/util/cs-etm.c +18 -7
@@ -2098,12 +2098,6 @@ static void cs_etm__clear_all_traceid_queues(struct cs_etm_queue *etmq)/* Ignore return value */ cs_etm__process_traceid_queue (etmq, tidq); - -/* -* Generate an instruction sample with the remaining -* branchstack entries. -*/ -cs_etm__flush (etmq, tidq); } }
@@ -2186,7 +2180,7 @@ static int cs_etm__process_queues(struct cs_etm_auxtrace *etm)while (1 ) {if (!etm->heap.heap_cnt) - goto out; +break ;/* Take the entry at the top of the min heap */ cs_queue_nr = etm->heap.heap_array[0 ].queue_nr;
@@ -2269,6 +2263,23 @@ static int cs_etm__process_queues(struct cs_etm_auxtrace *etm) ret =auxtrace_heap__add (&etm->heap, cs_queue_nr, timestamp); } +for (i =0 ; i < etm->queues.nr_queues; i++) { +struct int_node *inode; + + etmq = etm->queues.queue_array[i].priv; +if (!etmq) +continue ; + +intlist__for_each_entry (inode, etmq->traceid_queues_list) { +int idx = (int )(intptr_t )inode->priv; + +/* Flush any remaining branch stack entries */ + tidq = etmq->traceid_queues[idx]; + ret =cs_etm__end_block (etmq, tidq); +if (ret) +return ret; + } + } out:return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 191/459 perf probe: Fix libdw memory leak
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 4585038b8e186252141ef86e9f0d8e97f11dce8d ]
Add missing dwarf_cfi_end to free memory associated with probe_finder cfi_eh which is allocated and owned via a call to dwarf_getcfi_elf. Confusingly cfi_dbg shouldn't be freed as its memory is owned by the passed in debuginfo struct. Add comments to highlight this.
This addresses leak sanitizer issues seen in:tools/perf/tests/shell/test_uprobe_from_different_cu.sh
--- tools/perf/util/probe-finder.c | 4 ++++ tools/perf/util/probe-finder.h | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-)
tools/perf/util/probe-finder.c +4 -0
@@ -1483,6 +1483,10 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,if (ret >=0 && tf.pf.skip_empty_arg) ret =fill_empty_trace_arg (pev, tf.tevs, tf.ntevs); +#if _ELFUTILS_PREREQ (0 ,142 ) +dwarf_cfi_end (tf.pf.cfi_eh); +#endif +if (ret <0 || tf.ntevs ==0 ) {for (i =0 ; i < tf.ntevs; i++)clear_probe_trace_event (&tf.tevs[i]);
tools/perf/util/probe-finder.h +2 -2
@@ -81,9 +81,9 @@ struct probe_finder {/* For variable searching */ #if _ELFUTILS_PREREQ (0 ,142 ) -/* Call Frame Information from .eh_frame */ +/* Call Frame Information from .eh_frame. Owned by this struct. */ Dwarf_CFI *cfi_eh; -/* Call Frame Information from .debug_frame */ +/* Call Frame Information from .debug_frame. Not owned. */ Dwarf_CFI *cfi_dbg;#endif Dwarf_Op *fb_ops;/* Frame base attribute */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 192/459 perf probe: Correct demangled symbols in C++ program
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 314909f13cc12d47c468602c37dace512d225eeb ]
An issue can be observed when probe C++ demangled symbol with steps:
# nm test_cpp_mangle | grep print_data
0000000000000c94 t _GLOBAL__sub_I__Z10print_datai
0000000000000afc T _Z10print_datai
0000000000000b38 T _Z10print_dataR5Point # perf probe -x /home/niayan01/test_cpp_mangle -F --demangle
...
print_data(Point&)
print_data(int)
... # perf --debug verbose=3 probe -x test_cpp_mangle --add "test=print_data(int)"
probe-definition(0): test=print_data(int)
symbol:print_data(int) file:(null) line:0 offset:0 return:0 lazy:(null)
0 arguments
Open Debuginfo file: /home/niayan01/test_cpp_mangle
Try to find probe point from debuginfo.
Symbol print_data(int) address found : afc
Matched function: print_data [2ccf]
Probe point found: print_data+0
Found 1 probe_trace_events.
Opening /sys/kernel/tracing//uprobe_events write=1
Opening /sys/kernel/tracing//README write=0
Writing event: p:probe_test_cpp_mangle/test /home/niayan01/test_cpp_mangle:0xb38
...When tried to probe symbol "print_data(int)", the log shows:
Symbol print_data(int) address found : afc
The found address is 0xafc - which is right with verifying the output result from nm. Afterwards when write event, the command uses offset 0xb38 in the last log, which is a wrong address.
The dwarf_diename() gets a common function name, in above case, it returns string "print_data". As a result, the tool parses the offset based on the common name. This leads to probe at the wrong symbol "print_data(Point&)".
To fix the issue, use the die_get_linkage_name() function to retrieve the distinct linkage name - this is the mangled name for the C++ case. Based on this unique name, the tool can get a correct offset for probing. Based on DWARF doc, it is possible the linkage name is missed in the DIE, it rolls back to use dwarf_diename().
After:
# perf --debug verbose=3 probe -x test_cpp_mangle --add "test=print_data(int)"
probe-definition(0): test=print_data(int)
symbol:print_data(int) file:(null) line:0 offset:0 return:0 lazy:(null)
0 arguments
Open Debuginfo file: /home/niayan01/test_cpp_mangle
Try to find probe point from debuginfo.
Symbol print_data(int) address found : afc
Matched function: print_data [2d06]
Probe point found: print_data+0
Found 1 probe_trace_events.
Opening /sys/kernel/tracing//uprobe_events write=1
Opening /sys/kernel/tracing//README write=0
Writing event: p:probe_test_cpp_mangle/test /home/niayan01/test_cpp_mangle:0xafc
Added new event:
probe_test_cpp_mangle:test (on print_data(int) in /home/niayan01/test_cpp_mangle)You can now use it in all perf tools, such as:
perf record -e probe_test_cpp_mangle:test -aR sleep 1
# perf --debug verbose=3 probe -x test_cpp_mangle --add "test2=print_data(Point&)"
probe-definition(0): test2=print_data(Point&)
symbol:print_data(Point&) file:(null) line:0 offset:0 return:0 lazy:(null)
0 arguments
Open Debuginfo file: /home/niayan01/test_cpp_mangle
Try to find probe point from debuginfo.
Symbol print_data(Point&) address found : b38
Matched function: print_data [2ccf]
Probe point found: print_data+0
Found 1 probe_trace_events.
Opening /sys/kernel/tracing//uprobe_events write=1
Parsing probe_events: p:probe_test_cpp_mangle/test /home/niayan01/test_cpp_mangle:0x0000000000000afc
Group:probe_test_cpp_mangle Event:test probe:p
Opening /sys/kernel/tracing//README write=0
Writing event: p:probe_test_cpp_mangle/test2 /home/niayan01/test_cpp_mangle:0xb38
Added new event:
probe_test_cpp_mangle:test2 (on print_data(Point&) in /home/niayan01/test_cpp_mangle)You can now use it in all perf tools, such as:
perf record -e probe_test_cpp_mangle:test2 -aR sleep 1
--- tools/perf/util/probe-finder.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
tools/perf/util/probe-finder.c +15 -2
@@ -1729,8 +1729,21 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr,/* Find a corresponding function (name, baseline and baseaddr) */ if (die_find_realfunc (&cudie, (Dwarf_Addr )addr, &spdie)) { -/* Get function entry information */ - func = basefunc =dwarf_diename (&spdie); +/* +* Get function entry information. +* +* As described in the document DWARF Debugging Information +* Format Version 5, section 2.22 Linkage Names, "mangled names, +* are used in various ways, ... to distinguish multiple +* entities that have the same name". +* +* Firstly try to get distinct linkage name, if fail then +* rollback to get associated name in DIE. +*/ + func = basefunc =die_get_linkage_name (&spdie); +if (!func) + func = basefunc =dwarf_diename (&spdie); +if (!func ||die_entrypc (&spdie, &baseaddr) !=0 ||dwarf_decl_line (&spdie, &baseline) !=0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 193/459 PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: weiyufeng <[email protected]>
[ Upstream commit a18a025c2fb5fbf2d1d0606ea0d7441ac90e9c39 ]
When config pci_ops.read() can detect failed PCI transactions, the data returned to the CPU is PCI_ERROR_RESPONSE (~0 or 0xffffffff).
Obviously a successful PCI config read may *also* return that data if a config register happens to contain ~0, so it doesn't definitively indicate an error unless we know the register cannot contain ~0.
Use PCI_POSSIBLE_ERROR() to check the response we get when we read data from hardware. This unifies PCI error response checking and makes error checks consistent and easier to find.
Stable-dep-of: e2226dbc4a49 ("PCI: cpqphp: Fix PCIBIOS_* return value confusion")
--- drivers/pci/hotplug/cpqphp_pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/hotplug/cpqphp_pci.c +2 -2
@@ -138,7 +138,7 @@ static int PCI_RefinedAccessConfig(struct pci_bus *bus, unsigned int devfn, u8 oif (pci_bus_read_config_dword (bus, devfn,PCI_VENDOR_ID , &vendID) ==-1 )return -1 ; -if (vendID ==0xffffffff ) +if (PCI_POSSIBLE_ERROR (vendID))return -1 ;return pci_bus_read_config_dword (bus, devfn, offset, value); }
@@ -251,7 +251,7 @@ static int PCI_GetBusDevHelper(struct controller *ctrl, u8 *bus_num, u8 *dev_num *dev_num = tdevice; ctrl->pci_bus->number = tbus;pci_bus_read_config_dword (ctrl->pci_bus, *dev_num,PCI_VENDOR_ID , &work); -if (!nobridge || (work ==0xffffffff )) +if (!nobridge ||PCI_POSSIBLE_ERROR (work))return 0 ;dbg ("bus_num %d devfn %d\n" , *bus_num, *dev_num);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 194/459 PCI: cpqphp: Fix PCIBIOS_* return value confusion
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit e2226dbc4a4919d9c8bd9293299b532090bdf020 ]
Code in and related to PCI_RefinedAccessConfig() has three types of return type confusion:
- PCI_RefinedAccessConfig() tests pci_bus_read_config_dword() return value against -1.
- PCI_RefinedAccessConfig() returns both -1 and PCIBIOS_* return codes.
- Callers of PCI_RefinedAccessConfig() only test for -1.
Make PCI_RefinedAccessConfig() return PCIBIOS_* codes consistently and adapt callers accordingly.
--- drivers/pci/hotplug/cpqphp_pci.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/pci/hotplug/cpqphp_pci.c +10 -5
@@ -135,11 +135,13 @@ int cpqhp_unconfigure_device(struct pci_func *func)static int PCI_RefinedAccessConfig (struct pci_bus *bus,unsigned int devfn,u8 offset,u32 *value) {u32 vendID =0 ; +int ret; -if (pci_bus_read_config_dword (bus, devfn,PCI_VENDOR_ID , &vendID) ==-1 ) -return -1 ; + ret =pci_bus_read_config_dword (bus, devfn,PCI_VENDOR_ID , &vendID); +if (ret !=PCIBIOS_SUCCESSFUL ) +return PCIBIOS_DEVICE_NOT_FOUND ;if (PCI_POSSIBLE_ERROR (vendID)) -return -1 ; +return PCIBIOS_DEVICE_NOT_FOUND ;return pci_bus_read_config_dword (bus, devfn, offset, value); }
@@ -200,13 +202,15 @@ static int PCI_ScanBusForNonBridge(struct controller *ctrl, u8 bus_num, u8 *dev_ {u16 tdevice;u32 work; +int ret;u8 tbus; ctrl->pci_bus->number = bus_num;for (tdevice =0 ; tdevice <0xFF ; tdevice++) {/* Scan for access first */ -if (PCI_RefinedAccessConfig (ctrl->pci_bus, tdevice,0x08 , &work) ==-1 ) + ret =PCI_RefinedAccessConfig (ctrl->pci_bus, tdevice,0x08 , &work); +if (ret)continue ;dbg ("Looking for nonbridge bus_num %d dev_num %d\n" , bus_num, tdevice);/* Yep we got one. Not a bridge ? */
@@ -218,7 +222,8 @@ static int PCI_ScanBusForNonBridge(struct controller *ctrl, u8 bus_num, u8 *dev_ }for (tdevice =0 ; tdevice <0xFF ; tdevice++) {/* Scan for access first */ -if (PCI_RefinedAccessConfig (ctrl->pci_bus, tdevice,0x08 , &work) ==-1 ) + ret =PCI_RefinedAccessConfig (ctrl->pci_bus, tdevice,0x08 , &work); +if (ret)continue ;dbg ("Looking for bridge bus_num %d dev_num %d\n" , bus_num, tdevice);/* Yep we got one. bridge ? */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 195/459 f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: LongPing Wei <[email protected]>
[ Upstream commit c3af1f13476ec23fd99c98d060a89be28c1e8871 ]
This f2fs_bug_on was introduced by commit 2c1905042c8c ("f2fs: check segment type in __f2fs_replace_block") when there were only 6 curseg types. After commit d0b9e42ab615 ("f2fs: introduce inmem curseg") was introduced, the condition should be changed to checking curseg->seg_type.
--- fs/f2fs/segment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/segment.c +1 -1
@@ -3617,8 +3617,8 @@ void f2fs_do_replace_block(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, } } -f2fs_bug_on (sbi, !IS_DATASEG (type)); curseg =CURSEG_I (sbi, type); +f2fs_bug_on (sbi, !IS_DATASEG (curseg->seg_type));mutex_lock (&curseg->curseg_mutex);down_write (&sit_i->sentry_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 196/459 f2fs: avoid using native allocate_segment_by_default()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 509f1010e4fc55e2dbfc036317afd573ccd0931c ]
As we did for other cases, in fix_curseg_write_pointer(), let's use wrapped f2fs_allocate_new_section() instead of native allocate_segment_by_default(), by this way, it fixes to cover segment allocation with curseg_lock and sentry_lock.
Stable-dep-of: 43563069e1c1 ("f2fs: check curseg->inited before write_sum_page in change_curseg")
--- fs/f2fs/f2fs.h | 2 +- fs/f2fs/file.c | 2 +- fs/f2fs/segment.c | 18 ++++++++++-------- 3 files changed, 12 insertions(+), 10 deletions(-)
fs/f2fs/f2fs.h +1 -1
@@ -3366,7 +3366,7 @@ void f2fs_get_new_segment(struct f2fs_sb_info *sbi, unsigned int *newseg, bool new_sec, int dir);void f2fs_allocate_segment_for_resize (struct f2fs_sb_info *sbi,int type,unsigned int start,unsigned int end); -void f2fs_allocate_new_section (struct f2fs_sb_info *sbi,int type); +void f2fs_allocate_new_section (struct f2fs_sb_info *sbi,int type,bool force);void f2fs_allocate_new_segments (struct f2fs_sb_info *sbi);int f2fs_trim_fs (struct f2fs_sb_info *sbi,struct fstrim_range *range); bool f2fs_exist_trim_candidates(struct f2fs_sb_info *sbi,
fs/f2fs/file.c +1 -1
@@ -1689,7 +1689,7 @@ static int expand_inode_data(struct inode *inode, loff_t offset,down_write (&sbi->pin_sem);f2fs_lock_op (sbi); -f2fs_allocate_new_section (sbi,CURSEG_COLD_DATA_PINNED ); +f2fs_allocate_new_section (sbi,CURSEG_COLD_DATA_PINNED , false);f2fs_unlock_op (sbi); map.m_seg_type =CURSEG_COLD_DATA_PINNED ;
fs/f2fs/segment.c +10 -8
@@ -2937,7 +2937,7 @@ void f2fs_allocate_segment_for_resize(struct f2fs_sb_info *sbi, int type, }static void __allocate_new_segment (struct f2fs_sb_info *sbi,int type, -bool new_sec) +bool new_sec,bool force) {struct curseg_info *curseg =CURSEG_I (sbi, type);unsigned int old_segno;
@@ -2945,7 +2945,7 @@ static void __allocate_new_segment(struct f2fs_sb_info *sbi, int type,if (!curseg->inited) goto alloc; -if (curseg->next_blkoff || +if (force || curseg->next_blkoff ||get_valid_blocks (sbi, curseg->segno, new_sec)) goto alloc;
@@ -2957,16 +2957,17 @@ static void __allocate_new_segment(struct f2fs_sb_info *sbi, int type,locate_dirty_segment (sbi, old_segno); } -static void __allocate_new_section (struct f2fs_sb_info *sbi,int type) +static void __allocate_new_section (struct f2fs_sb_info *sbi, +int type,bool force) { -__allocate_new_segment (sbi, type, true); +__allocate_new_segment (sbi, type, true, force); } -void f2fs_allocate_new_section (struct f2fs_sb_info *sbi,int type) +void f2fs_allocate_new_section (struct f2fs_sb_info *sbi,int type,bool force) {down_read (&SM_I (sbi)->curseg_lock);down_write (&SIT_I (sbi)->sentry_lock); -__allocate_new_section (sbi, type); +__allocate_new_section (sbi, type, force);up_write (&SIT_I (sbi)->sentry_lock);up_read (&SM_I (sbi)->curseg_lock); }
@@ -2978,7 +2979,7 @@ void f2fs_allocate_new_segments(struct f2fs_sb_info *sbi)down_read (&SM_I (sbi)->curseg_lock);down_write (&SIT_I (sbi)->sentry_lock);for (i =CURSEG_HOT_DATA ; i <=CURSEG_COLD_DATA ; i++) -__allocate_new_segment (sbi, i, false); +__allocate_new_segment (sbi, i, false, false);up_write (&SIT_I (sbi)->sentry_lock);up_read (&SM_I (sbi)->curseg_lock); }
@@ -4867,7 +4868,8 @@ static int fix_curseg_write_pointer(struct f2fs_sb_info *sbi, int type)f2fs_notice (sbi,"Assign new section to curseg[%d]: " "curseg[0x%x,0x%x]" , type, cs->segno, cs->next_blkoff); -allocate_segment_by_default (sbi, type, true); + +f2fs_allocate_new_section (sbi, type, true);/* check consistency of the zone curseg pointed to */ if (check_zone_write_pointer (sbi, zbd, &zone))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 197/459 f2fs: remove struct segment_allocation default_salloc_ops
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 1c8a8ec0a0e9a1176022a35c4daf04fe1594d270 ]
There is only single instance of these ops, so remove the indirection and call allocate_segment_by_default directly.
Stable-dep-of: 43563069e1c1 ("f2fs: check curseg->inited before write_sum_page in change_curseg")
--- fs/f2fs/segment.c | 11 ++--------- fs/f2fs/segment.h | 6 ------ 2 files changed, 2 insertions(+), 15 deletions(-)
fs/f2fs/segment.c +2 -9
@@ -2953,7 +2953,7 @@ static void __allocate_new_segment(struct f2fs_sb_info *sbi, int type,return ; alloc: old_segno = curseg->segno; -SIT_I (sbi)->s_ops->allocate_segment (sbi, type, true); +allocate_segment_by_default (sbi, type, true);locate_dirty_segment (sbi, old_segno); }
@@ -2984,10 +2984,6 @@ void f2fs_allocate_new_segments(struct f2fs_sb_info *sbi)up_read (&SM_I (sbi)->curseg_lock); } -static const struct segment_allocation default_salloc_ops = { - .allocate_segment = allocate_segment_by_default, -}; -bool f2fs_exist_trim_candidates (struct f2fs_sb_info *sbi,struct cp_control *cpc) {
@@ -3401,7 +3397,7 @@ void f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,get_atssr_segment (sbi, type, se->type,AT_SSR , se->mtime); else - sit_i->s_ops->allocate_segment(sbi, type, false); +allocate_segment_by_default (sbi ,type ,false ); }/* * segment dirty status should be updated after segment allocation,
@@ -4337,9 +4333,6 @@ static int build_sit_info(struct f2fs_sb_info *sbi)return -ENOMEM ;#endif -/* init SIT information */ - sit_i->s_ops = &default_salloc_ops; - sit_i->sit_base_addr =le32_to_cpu (raw_super->sit_blkaddr); sit_i->sit_blocks = sit_segs << sbi->log_blocks_per_seg; sit_i->written_valid_blocks =0 ;
fs/f2fs/segment.h +0 -6
@@ -227,10 +227,6 @@ struct sec_entry {unsigned int valid_blocks;/* # of valid blocks in a section */ }; -struct segment_allocation { -void (*allocate_segment)(struct f2fs_sb_info *,int ,bool ); -}; -#define MAX_SKIP_GC_COUNT 16struct inmem_pages {
@@ -240,8 +236,6 @@ struct inmem_pages { };struct sit_info { -const struct segment_allocation *s_ops; -block_t sit_base_addr;/* start block address of SIT area */ block_t sit_blocks;/* # of blocks used by SIT area */ block_t written_valid_blocks;/* # of valid blocks in main area */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 198/459 f2fs: open code allocate_segment_by_default
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 8442d94b8ac8d5d8300725a9ffa9def526b71170 ]
allocate_segment_by_default has just two callers, which use very different code pathes inside it based on the force paramter. Just open code the logic in the two callers using a new helper to decided if a new segment should be allocated.
Stable-dep-of: 43563069e1c1 ("f2fs: check curseg->inited before write_sum_page in change_curseg")
--- fs/f2fs/segment.c | 50 +++++++++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 26 deletions(-)
fs/f2fs/segment.c +24 -26
@@ -2876,31 +2876,20 @@ static int get_ssr_segment(struct f2fs_sb_info *sbi, int type,return 0 ; } -/* -* flush out current segment and replace it with new segment -* This function should be returned with success, otherwise BUG -*/ -static void allocate_segment_by_default (struct f2fs_sb_info *sbi, -int type,bool force) +static bool need_new_seg (struct f2fs_sb_info *sbi,int type) {struct curseg_info *curseg =CURSEG_I (sbi, type); -if (force) -new_curseg (sbi, type, true); -else if (!is_set_ckpt_flags (sbi,CP_CRC_RECOVERY_FLAG ) && - curseg->seg_type ==CURSEG_WARM_NODE ) -new_curseg (sbi, type, false); -else if (curseg->alloc_type ==LFS && -is_next_segment_free (sbi, curseg, type) && -likely (!is_sbi_flag_set (sbi,SBI_CP_DISABLED ))) -new_curseg (sbi, type, false); -else if (f2fs_need_SSR (sbi) && -get_ssr_segment (sbi, type,SSR ,0 )) -change_curseg (sbi, type, true); -else -new_curseg (sbi, type, false); - -stat_inc_seg_type (sbi, curseg); +if (!is_set_ckpt_flags (sbi,CP_CRC_RECOVERY_FLAG ) && + curseg->seg_type ==CURSEG_WARM_NODE ) +return true; +if (curseg->alloc_type ==LFS && +is_next_segment_free (sbi, curseg, type) && +likely (!is_sbi_flag_set (sbi,SBI_CP_DISABLED ))) +return true; +if (!f2fs_need_SSR (sbi) || !get_ssr_segment (sbi, type,SSR ,0 )) +return true; +return false; } void f2fs_allocate_segment_for_resize(struct f2fs_sb_info *sbi, int type,
@@ -2953,7 +2942,8 @@ static void __allocate_new_segment(struct f2fs_sb_info *sbi, int type,return ; alloc: old_segno = curseg->segno; -allocate_segment_by_default (sbi, type, true); +new_curseg (sbi, type, true); +stat_inc_seg_type (sbi, curseg);locate_dirty_segment (sbi, old_segno); }
@@ -3393,11 +3383,19 @@ void f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,update_sit_entry (sbi, old_blkaddr,-1 );if (!__has_curseg_space (sbi, curseg)) { -if (from_gc) +/* +* Flush out current segment and replace it with new segment. +*/ +if (from_gc) {get_atssr_segment (sbi, type, se->type,AT_SSR , se->mtime); -else -allocate_segment_by_default (sbi, type, false); + }else { +if (need_new_seg (sbi, type)) +new_curseg (sbi, type, false); +else +change_curseg (sbi, type, true); +stat_inc_seg_type (sbi, curseg); + } }/* * segment dirty status should be updated after segment allocation,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 199/459 f2fs: remove the unused flush argument to change_curseg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 5bcd655fffaec24e849bda1207446f5cc821713e ]
Stable-dep-of: 43563069e1c1 ("f2fs: check curseg->inited before write_sum_page in change_curseg")
--- fs/f2fs/segment.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
fs/f2fs/segment.c +7 -9
@@ -2683,7 +2683,7 @@ bool f2fs_segment_has_free_slot(struct f2fs_sb_info *sbi, int segno)* This function always allocates a used segment(from dirty seglist) by SSR * manner, so it should recover the existing segment information of valid blocks */ -static void change_curseg (struct f2fs_sb_info *sbi,int type,bool flush) +static void change_curseg (struct f2fs_sb_info *sbi,int type) {struct dirty_seglist_info *dirty_i =DIRTY_I (sbi);struct curseg_info *curseg =CURSEG_I (sbi, type);
@@ -2691,9 +2691,7 @@ static void change_curseg(struct f2fs_sb_info *sbi, int type, bool flush)struct f2fs_summary_block *sum_node;struct page *sum_page; -if (flush) -write_sum_page (sbi, curseg->sum_blk, -GET_SUM_BLOCK (sbi, curseg->segno)); +write_sum_page (sbi, curseg->sum_blk,GET_SUM_BLOCK (sbi, curseg->segno));__set_test_and_inuse (sbi, new_segno);
@@ -2732,7 +2730,7 @@ static void get_atssr_segment(struct f2fs_sb_info *sbi, int type,struct seg_entry *se =get_seg_entry (sbi, curseg->next_segno); curseg->seg_type = se->type; -change_curseg (sbi, type, true); +change_curseg (sbi, type); }else {/* allocate cold segment by default */ curseg->seg_type =CURSEG_COLD_DATA ;
@@ -2907,7 +2905,7 @@ void f2fs_allocate_segment_for_resize(struct f2fs_sb_info *sbi, int type, goto unlock;if (f2fs_need_SSR (sbi) &&get_ssr_segment (sbi, type,SSR ,0 )) -change_curseg (sbi, type, true); +change_curseg (sbi, type);else new_curseg (sbi, type, true);
@@ -3393,7 +3391,7 @@ void f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,if (need_new_seg (sbi, type))new_curseg (sbi, type, false);else -change_curseg (sbi, type, true); +change_curseg (sbi, type);stat_inc_seg_type (sbi, curseg); } }
@@ -3624,7 +3622,7 @@ void f2fs_do_replace_block(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,/* change the current segment */ if (segno != curseg->segno) { curseg->next_segno = segno; -change_curseg (sbi, type, true); +change_curseg (sbi, type); } curseg->next_blkoff =GET_BLKOFF_FROM_SEG0 (sbi, new_blkaddr);
@@ -3651,7 +3649,7 @@ void f2fs_do_replace_block(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,if (recover_curseg) {if (old_cursegno != curseg->segno) { curseg->next_segno = old_cursegno; -change_curseg (sbi, type, true); +change_curseg (sbi, type); } curseg->next_blkoff = old_blkoff; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 200/459 f2fs: check curseg->inited before write_sum_page in change_curseg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <[email protected]>
[ Upstream commit 43563069e1c1df417d2eed6eca8a22fc6b04691d ]
In the __f2fs_init_atgc_curseg->get_atssr_segment calling, curseg->segno is NULL_SEGNO, indicating that there is no summary block that needs to be written.
--- fs/f2fs/segment.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/segment.c +2 -1
@@ -2691,7 +2691,8 @@ static void change_curseg(struct f2fs_sb_info *sbi, int type)struct f2fs_summary_block *sum_node;struct page *sum_page; -write_sum_page (sbi, curseg->sum_blk,GET_SUM_BLOCK (sbi, curseg->segno)); +if (curseg->inited) +write_sum_page (sbi, curseg->sum_blk,GET_SUM_BLOCK (sbi, curseg->segno));__set_test_and_inuse (sbi, new_segno);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 201/459 perf trace: avoid garbage when not printing a trace events arguments
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Peterson <[email protected]>
[ Upstream commit 5fb8e56542a3cf469fdf25d77f50e21cbff3ae7e ]
trace__fprintf_tp_fields may not print any tracepoint arguments. E.g., if the argument values are all zero. Previously, this would result in a totally uninitialized buffer being passed to fprintf, which could lead to garbage on the console. Fix the problem by passing the number of initialized bytes fprintf.
--- tools/perf/builtin-trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-trace.c +1 -1
@@ -2748,7 +2748,7 @@ static size_t trace__fprintf_tp_fields(struct trace *trace, struct evsel *evsel, printed +=syscall_arg_fmt__scnprintf_val (arg, bf + printed, size - printed, &syscall_arg, val); } -return printed +fprintf (trace->output,"%s" , bf); +return printed +fprintf (trace->output,"%.*s" , (int )printed, bf); } static int trace__event_handler(struct trace *trace, struct evsel *evsel,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 202/459 m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Michel Hautbois <[email protected]>
[ Upstream commit f212140962c93cd5da43283a18e31681540fc23d ]
Fix a typo in the CONFIG_M5441x preprocessor condition, where the GPIO register offset was incorrectly set to 8 instead of 0. This prevented proper GPIO configuration for m5441x targets.
--- arch/m68k/include/asm/mcfgpio.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/include/asm/mcfgpio.h +1 -1
@@ -144,7 +144,7 @@ static inline void gpio_free(unsigned gpio)* read-modify-write as well as those controlled by the EPORT and GPIO modules. */ #define MCFGPIO_SCR_START 40 -#elif defined(CONFIGM5441x) +#elif defined(CONFIG_M5441x)/* The m5441x EPORT doesn't have its own GPIO port, uses PORT C */ #define MCFGPIO_SCR_START 0#else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 203/459 m68k: coldfire/device.c: only build FEC when HW macros are defined
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Quartulli <[email protected]>
[ Upstream commit 63a24cf8cc330e5a68ebd2e20ae200096974c475 ]
When CONFIG_FEC is set (due to COMPILE_TEST) along with CONFIG_M54xx, coldfire/device.c has compile errors due to missing MCFEC_* and MCF_IRQ_FEC_* symbols.
Make the whole FEC blocks dependent on having the HW macros defined, rather than on CONFIG_FEC itself.
This fix is very similar to commit e6e1e7b19fa1 ("m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined")
To: Greg Ungerer <[email protected]>
To: Geert Uytterhoeven <[email protected]>
--- arch/m68k/coldfire/device.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/m68k/coldfire/device.c +4 -4
@@ -93,7 +93,7 @@ static struct platform_device mcf_uart = { .dev.platform_data = mcf_uart_platform_data, }; -#if IS_ENABLED (CONFIG_FEC ) +#ifdef MCFFEC_BASE0 #ifdef CONFIG_M5441x#define FEC_NAME "enet-fec"
@@ -145,6 +145,7 @@ static struct platform_device mcf_fec0 = { .platform_data = FEC_PDATA, } }; +#endif /* MCFFEC_BASE0 */ #ifdef MCFFEC_BASE1 static struct resource mcf_fec1_resources[] = {
@@ -182,7 +183,6 @@ static struct platform_device mcf_fec1 = { } };#endif /* MCFFEC_BASE1 */ -#endif /* CONFIG_FEC */ #if IS_ENABLED (CONFIG_SPI_COLDFIRE_QSPI )/*
@@ -583,12 +583,12 @@ static struct platform_device mcf_esdhc = {static struct platform_device *mcf_devices[]__initdata = { &mcf_uart, -#if IS_ENABLED(CONFIG_FEC) +#ifdef MCFFEC_BASE0 &mcf_fec0, +#endif #ifdef MCFFEC_BASE1 &mcf_fec1, #endif -#endif #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) &mcf_qspi, #endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 204/459 perf trace: Do not lose last events in a race
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Peterson <[email protected]>
[ Upstream commit 3fd7c36973a250e17a4ee305a31545a9426021f4 ]
If a perf trace event selector specifies a maximum number of events to output (i.e., "/nr=N/" syntax), the event printing handler, trace__event_handler, disables the event selector after the maximum number events are printed.
Furthermore, trace__event_handler checked if the event selector was disabled before doing any work. This avoided exceeding the maximum number of events to print if more events were in the buffer before the selector was disabled.
However, the event selector can be disabled for reasons other than exceeding the maximum number of events. In particular, when the traced subprocess exits, the main loop disables all event selectors. This meant the last events of a traced subprocess might be lost to the printing handler's short-circuiting logic.
This nondeterministic problem could be seen by running the following many times:
$ perf trace -e syscalls:sys_enter_exit_group true
trace__event_handler should simply check for exceeding the maximum number of events to print rather than the state of the event selector.
--- tools/perf/builtin-trace.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
tools/perf/builtin-trace.c +2 -7
@@ -2757,13 +2757,8 @@ static int trace__event_handler(struct trace *trace, struct evsel *evsel, {struct thread *thread;int callchain_ret =0 ; -/* -* Check if we called perf_evsel__disable(evsel) due to, for instance, -* this event's max_events having been hit and this is an entry coming -* from the ring buffer that we should discard, since the max events -* have already been considered/printed. -*/ -if (evsel->disabled) + +if (evsel->nr_events_printed >= evsel->max_events)return 0 ; thread =machine__findnew_thread (trace->host, sample->pid, sample->tid);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 205/459 perf trace: Avoid garbage when not printing a syscalls arguments
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Peterson <[email protected]>
[ Upstream commit 1302e352b26f34991b619b5d0b621b76d20a3883 ]
syscall__scnprintf_args may not place anything in the output buffer (e.g., because the arguments are all zero). If that happened in trace__fprintf_sys_enter, its fprintf would receive an unitialized buffer leading to garbage output.
Fix the problem by passing the (possibly zero) bounds of the argument buffer to the output fprintf.
--- tools/perf/builtin-trace.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/perf/builtin-trace.c +3 -2
@@ -2361,6 +2361,7 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct evsel *evsel,char msg[1024 ];void *args, *augmented_args =NULL ;int augmented_args_size; +size_t printed =0 ;if (sc ==NULL )return -1 ;
@@ -2376,8 +2377,8 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct evsel *evsel, args =perf_evsel__sc_tp_ptr (evsel, args, sample); augmented_args =syscall__augmented_args (sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size); -syscall__scnprintf_args (sc, msg,sizeof (msg), args, augmented_args, augmented_args_size, trace, thread); -fprintf (trace->output,"%s" , msg); + printed +=syscall__scnprintf_args (sc, msg,sizeof (msg), args, augmented_args, augmented_args_size, trace, thread); +fprintf (trace->output,"%.*s" , (int )printed, msg); err =0 ; out_put:thread__put (thread);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 206/459 rpmsg: glink: Add TX_DATA_CONT command while sending
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun Kumar Neelakantam <[email protected]>
[ Upstream commit 8956927faed366b60b0355f4a4317a10e281ced7 ]
With current design the transport can send packets of size upto FIFO_SIZE which is 16k and return failure for all packets above 16k.
Add TX_DATA_CONT command to send packets greater than 16k by splitting into 8K chunks.
Stable-dep-of: 06c59d97f63c ("rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length")
--- drivers/rpmsg/qcom_glink_native.c | 38 +++++++++++++++++++++++++++---- 1 file changed, 34 insertions(+), 4 deletions(-)
drivers/rpmsg/qcom_glink_native.c +34 -4
@@ -1276,6 +1276,8 @@ static int __qcom_glink_send(struct glink_channel *channel, }__packed req;int ret;unsigned long flags; +int chunk_size = len; +int left_size =0 ;if (!glink->intentless) {while (!intent) {
@@ -1309,18 +1311,46 @@ static int __qcom_glink_send(struct glink_channel *channel, iid = intent->id; } +if (wait && chunk_size >SZ_8K ) { + chunk_size =SZ_8K ; + left_size = len - chunk_size; + } req.msg.cmd =cpu_to_le16 (RPM_CMD_TX_DATA ); req.msg.param1 =cpu_to_le16 (channel->lcid); req.msg.param2 =cpu_to_le32 (iid); - req.chunk_size =cpu_to_le32 (len); - req.left_size =cpu_to_le32 (0 ); + req.chunk_size =cpu_to_le32 (chunk_size); + req.left_size =cpu_to_le32 (left_size); - ret =qcom_glink_tx (glink, &req,sizeof (req), data, len, wait); + ret =qcom_glink_tx (glink, &req,sizeof (req), data, chunk_size, wait);/* Mark intent available if we failed */ -if (ret && intent) +if (ret && intent) { intent->in_use = false; +return ret; + } +while (left_size >0 ) { + data = (void *)((char *)data + chunk_size); + chunk_size = left_size; +if (chunk_size >SZ_8K ) + chunk_size =SZ_8K ; + left_size -= chunk_size; + + req.msg.cmd =cpu_to_le16 (RPM_CMD_TX_DATA_CONT ); + req.msg.param1 =cpu_to_le16 (channel->lcid); + req.msg.param2 =cpu_to_le32 (iid); + req.chunk_size =cpu_to_le32 (chunk_size); + req.left_size =cpu_to_le32 (left_size); + + ret =qcom_glink_tx (glink, &req,sizeof (req), data, + chunk_size, wait); + +/* Mark intent available if we failed */ +if (ret && intent) { + intent->in_use = false; +break ; + } + }return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 207/459 rpmsg: glink: Send READ_NOTIFY command in FIFO full case
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun Kumar Neelakantam <[email protected]>
[ Upstream commit b16a37e1846c9573a847a56fa2f31ba833dae45a ]
The current design sleeps unconditionally in TX FIFO full case and wakeup only after sleep timer expires which adds random delays in clients TX path.
Avoid sleep and use READ_NOTIFY command so that writer can be woken up when remote notifies about read completion by sending IRQ.
Stable-dep-of: 06c59d97f63c ("rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length")
--- drivers/rpmsg/qcom_glink_native.c | 36 ++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-)
drivers/rpmsg/qcom_glink_native.c +35 -1
@@ -92,6 +92,8 @@ struct glink_core_rx_intent {* @rcids: idr of all channels with a known remote channel id * @features: remote features * @intentless: flag to indicate that there is no intent +* @tx_avail_notify: Waitqueue for pending tx tasks +* @sent_read_notify: flag to check cmd sent or not */ struct qcom_glink {struct device *dev;
@@ -118,6 +120,8 @@ struct qcom_glink {unsigned long features;bool intentless; +wait_queue_head_t tx_avail_notify; +bool sent_read_notify; };enum {
@@ -305,6 +309,20 @@ static void qcom_glink_tx_write(struct qcom_glink *glink, glink->tx_pipe->write (glink->tx_pipe, hdr, hlen, data, dlen); } +static void qcom_glink_send_read_notify (struct qcom_glink *glink) +{ +struct glink_msg msg; + + msg.cmd =cpu_to_le16 (RPM_CMD_READ_NOTIF ); + msg.param1 =0 ; + msg.param2 =0 ; + +qcom_glink_tx_write (glink, &msg,sizeof (msg),NULL ,0 ); + +mbox_send_message (glink->mbox_chan,NULL ); +mbox_client_txdone (glink->mbox_chan,0 ); +} +static int qcom_glink_tx (struct qcom_glink *glink,const void *hdr,size_t hlen,const void *data,size_t dlen,bool wait)
@@ -325,12 +343,21 @@ static int qcom_glink_tx(struct qcom_glink *glink, goto out; } +if (!glink->sent_read_notify) { + glink->sent_read_notify = true; +qcom_glink_send_read_notify (glink); + } +/* Wait without holding the tx_lock */ spin_unlock_irqrestore (&glink->tx_lock, flags); -usleep_range (10000 ,15000 ); +wait_event_timeout (glink->tx_avail_notify, +qcom_glink_tx_avail (glink) >= tlen,10 *HZ );spin_lock_irqsave (&glink->tx_lock, flags); + +if (qcom_glink_tx_avail (glink) >= tlen) + glink->sent_read_notify = false; }qcom_glink_tx_write (glink, hdr, hlen, data, dlen);
@@ -991,6 +1018,9 @@ static irqreturn_t qcom_glink_native_intr(int irq, void *data)unsigned int cmd;int ret =0 ; +/* To wakeup any blocking writers */ +wake_up_all (&glink->tx_avail_notify); +for (;;) { avail =qcom_glink_rx_avail (glink);if (avail <sizeof (msg))
@@ -1530,6 +1560,9 @@ static void qcom_glink_rx_close_ack(struct qcom_glink *glink, unsigned int lcid)struct glink_channel *channel;unsigned long flags; +/* To wakeup any blocking writers */ +wake_up_all (&glink->tx_avail_notify); +spin_lock_irqsave (&glink->idr_lock, flags); channel =idr_find (&glink->lcids, lcid);if (WARN (!channel,"close ack on unknown channel\n" )) {
@@ -1691,6 +1724,7 @@ struct qcom_glink *qcom_glink_native_probe(struct device *dev,spin_lock_init (&glink->rx_lock);INIT_LIST_HEAD (&glink->rx_queue);INIT_WORK (&glink->rx_work, qcom_glink_work); +init_waitqueue_head (&glink->tx_avail_notify);spin_lock_init (&glink->idr_lock);idr_init (&glink->lcids);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 208/459 rpmsg: glink: Fix GLINK command prefix
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <[email protected]>
[ Upstream commit 4e816d0318fdfe8932da80dbf04ba318b13e4b3a ]
The upstream GLINK driver was first introduced to communicate with the RPM on MSM8996, presumably as an artifact from that era the command defines was prefixed RPM_CMD, while they actually are GLINK_CMDs.
Let's rename these, to keep things tidy. No functional change.
Stable-dep-of: 06c59d97f63c ("rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length")
--- drivers/rpmsg/qcom_glink_native.c | 98 +++++++++++++++---------------- 1 file changed, 49 insertions(+), 49 deletions(-)
drivers/rpmsg/qcom_glink_native.c +49 -49
@@ -191,20 +191,20 @@ struct glink_channel {static const struct rpmsg_endpoint_ops glink_endpoint_ops; -#define RPM_CMD_VERSION 0 -#define RPM_CMD_VERSION_ACK 1 -#define RPM_CMD_OPEN 2 -#define RPM_CMD_CLOSE 3 -#define RPM_CMD_OPEN_ACK 4 -#define RPM_CMD_INTENT 5 -#define RPM_CMD_RX_DONE 6 -#define RPM_CMD_RX_INTENT_REQ 7 -#define RPM_CMD_RX_INTENT_REQ_ACK 8 -#define RPM_CMD_TX_DATA 9 -#define RPM_CMD_CLOSE_ACK 11 -#define RPM_CMD_TX_DATA_CONT 12 -#define RPM_CMD_READ_NOTIF 13 -#define RPM_CMD_RX_DONE_W_REUSE 14 +#define GLINK_CMD_VERSION 0 +#define GLINK_CMD_VERSION_ACK 1 +#define GLINK_CMD_OPEN 2 +#define GLINK_CMD_CLOSE 3 +#define GLINK_CMD_OPEN_ACK 4 +#define GLINK_CMD_INTENT 5 +#define GLINK_CMD_RX_DONE 6 +#define GLINK_CMD_RX_INTENT_REQ 7 +#define GLINK_CMD_RX_INTENT_REQ_ACK 8 +#define GLINK_CMD_TX_DATA 9 +#define GLINK_CMD_CLOSE_ACK 11 +#define GLINK_CMD_TX_DATA_CONT 12 +#define GLINK_CMD_READ_NOTIF 13 +#define GLINK_CMD_RX_DONE_W_REUSE 14#define GLINK_FEATURE_INTENTLESS BIT(1)
@@ -313,7 +313,7 @@ static void qcom_glink_send_read_notify(struct qcom_glink *glink) {struct glink_msg msg; - msg.cmd =cpu_to_le16 (RPM_CMD_READ_NOTIF ); + msg.cmd =cpu_to_le16 (GLINK_CMD_READ_NOTIF ); msg.param1 =0 ; msg.param2 =0 ;
@@ -375,7 +375,7 @@ static int qcom_glink_send_version(struct qcom_glink *glink) {struct glink_msg msg; - msg.cmd =cpu_to_le16 (RPM_CMD_VERSION ); + msg.cmd =cpu_to_le16 (GLINK_CMD_VERSION ); msg.param1 =cpu_to_le16 (GLINK_VERSION_1 ); msg.param2 =cpu_to_le32 (glink->features);
@@ -386,7 +386,7 @@ static void qcom_glink_send_version_ack(struct qcom_glink *glink) {struct glink_msg msg; - msg.cmd =cpu_to_le16 (RPM_CMD_VERSION_ACK ); + msg.cmd =cpu_to_le16 (GLINK_CMD_VERSION_ACK ); msg.param1 =cpu_to_le16 (GLINK_VERSION_1 ); msg.param2 =cpu_to_le32 (glink->features);
@@ -398,7 +398,7 @@ static void qcom_glink_send_open_ack(struct qcom_glink *glink, {struct glink_msg msg; - msg.cmd =cpu_to_le16 (RPM_CMD_OPEN_ACK ); + msg.cmd =cpu_to_le16 (GLINK_CMD_OPEN_ACK ); msg.param1 =cpu_to_le16 (channel->rcid); msg.param2 =cpu_to_le32 (0 );
@@ -424,11 +424,11 @@ static void qcom_glink_handle_intent_req_ack(struct qcom_glink *glink, }/** -* qcom_glink_send_open_req() - send a RPM_CMD_OPEN request to the remote +* qcom_glink_send_open_req() - send a GLINK_CMD_OPEN request to the remote * @glink: Ptr to the glink edge * @channel: Ptr to the channel that the open req is sent * -* Allocates a local channel id and sends a RPM_CMD_OPEN message to the remote. +* Allocates a local channel id and sends a GLINK_CMD_OPEN message to the remote. * Will return with refcount held, regardless of outcome. * * Returns 0 on success, negative errno otherwise.
@@ -457,7 +457,7 @@ static int qcom_glink_send_open_req(struct qcom_glink *glink, channel->lcid = ret; - req.msg.cmd =cpu_to_le16 (RPM_CMD_OPEN ); + req.msg.cmd =cpu_to_le16 (GLINK_CMD_OPEN ); req.msg.param1 =cpu_to_le16 (channel->lcid); req.msg.param2 =cpu_to_le32 (name_len);strcpy (req.name, channel->name);
@@ -482,7 +482,7 @@ static void qcom_glink_send_close_req(struct qcom_glink *glink, {struct glink_msg req; - req.cmd =cpu_to_le16 (RPM_CMD_CLOSE ); + req.cmd =cpu_to_le16 (GLINK_CMD_CLOSE ); req.param1 =cpu_to_le16 (channel->lcid); req.param2 =0 ;
@@ -494,7 +494,7 @@ static void qcom_glink_send_close_ack(struct qcom_glink *glink, {struct glink_msg req; - req.cmd =cpu_to_le16 (RPM_CMD_CLOSE_ACK ); + req.cmd =cpu_to_le16 (GLINK_CMD_CLOSE_ACK ); req.param1 =cpu_to_le16 (rcid); req.param2 =0 ;
@@ -525,7 +525,7 @@ static void qcom_glink_rx_done_work(struct work_struct *work) iid = intent->id; reuse = intent->reuse; - cmd.id = reuse ?RPM_CMD_RX_DONE_W_REUSE :RPM_CMD_RX_DONE ; + cmd.id = reuse ?GLINK_CMD_RX_DONE_W_REUSE :GLINK_CMD_RX_DONE ; cmd.lcid = cid; cmd.liid = iid;
@@ -637,7 +637,7 @@ static int qcom_glink_send_intent_req_ack(struct qcom_glink *glink, {struct glink_msg msg; - msg.cmd =cpu_to_le16 (RPM_CMD_RX_INTENT_REQ_ACK ); + msg.cmd =cpu_to_le16 (GLINK_CMD_RX_INTENT_REQ_ACK ); msg.param1 =cpu_to_le16 (channel->lcid); msg.param2 =cpu_to_le32 (granted);
@@ -668,7 +668,7 @@ static int qcom_glink_advertise_intent(struct qcom_glink *glink, } __packed;struct command cmd; - cmd.id =cpu_to_le16 (RPM_CMD_INTENT ); + cmd.id =cpu_to_le16 (GLINK_CMD_INTENT ); cmd.lcid =cpu_to_le16 (channel->lcid); cmd.count =cpu_to_le32 (1 ); cmd.size =cpu_to_le32 (intent->size);
@@ -1033,42 +1033,42 @@ static irqreturn_t qcom_glink_native_intr(int irq, void *data) param2 =le32_to_cpu (msg.param2);switch (cmd) { -case RPM_CMD_VERSION : -case RPM_CMD_VERSION_ACK : -case RPM_CMD_CLOSE : -case RPM_CMD_CLOSE_ACK : -case RPM_CMD_RX_INTENT_REQ : +case GLINK_CMD_VERSION : +case GLINK_CMD_VERSION_ACK : +case GLINK_CMD_CLOSE : +case GLINK_CMD_CLOSE_ACK : +case GLINK_CMD_RX_INTENT_REQ : ret =qcom_glink_rx_defer (glink,0 );break ; -case RPM_CMD_OPEN_ACK : +case GLINK_CMD_OPEN_ACK : ret =qcom_glink_rx_open_ack (glink, param1);qcom_glink_rx_advance (glink,ALIGN (sizeof (msg),8 ));break ; -case RPM_CMD_OPEN : +case GLINK_CMD_OPEN : ret =qcom_glink_rx_defer (glink, param2);break ; -case RPM_CMD_TX_DATA : -case RPM_CMD_TX_DATA_CONT : +case GLINK_CMD_TX_DATA : +case GLINK_CMD_TX_DATA_CONT : ret =qcom_glink_rx_data (glink, avail);break ; -case RPM_CMD_READ_NOTIF : +case GLINK_CMD_READ_NOTIF :qcom_glink_rx_advance (glink,ALIGN (sizeof (msg),8 ));mbox_send_message (glink->mbox_chan,NULL );mbox_client_txdone (glink->mbox_chan,0 );break ; -case RPM_CMD_INTENT : +case GLINK_CMD_INTENT :qcom_glink_handle_intent (glink, param1, param2, avail);break ; -case RPM_CMD_RX_DONE : +case GLINK_CMD_RX_DONE :qcom_glink_handle_rx_done (glink, param1, param2, false);qcom_glink_rx_advance (glink,ALIGN (sizeof (msg),8 ));break ; -case RPM_CMD_RX_DONE_W_REUSE : +case GLINK_CMD_RX_DONE_W_REUSE :qcom_glink_handle_rx_done (glink, param1, param2, true);qcom_glink_rx_advance (glink,ALIGN (sizeof (msg),8 ));break ; -case RPM_CMD_RX_INTENT_REQ_ACK : +case GLINK_CMD_RX_INTENT_REQ_ACK :qcom_glink_handle_intent_req_ack (glink, param1, param2);qcom_glink_rx_advance (glink,ALIGN (sizeof (msg),8 ));break ;
@@ -1271,7 +1271,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink,reinit_completion (&channel->intent_req_comp); - cmd.id =RPM_CMD_RX_INTENT_REQ ; + cmd.id =GLINK_CMD_RX_INTENT_REQ ; cmd.cid = channel->lcid; cmd.size = size;
@@ -1345,7 +1345,7 @@ static int __qcom_glink_send(struct glink_channel *channel, chunk_size =SZ_8K ; left_size = len - chunk_size; } - req.msg.cmd =cpu_to_le16 (RPM_CMD_TX_DATA ); + req.msg.cmd =cpu_to_le16 (GLINK_CMD_TX_DATA ); req.msg.param1 =cpu_to_le16 (channel->lcid); req.msg.param2 =cpu_to_le32 (iid); req.chunk_size =cpu_to_le32 (chunk_size);
@@ -1366,7 +1366,7 @@ static int __qcom_glink_send(struct glink_channel *channel, chunk_size =SZ_8K ; left_size -= chunk_size; - req.msg.cmd =cpu_to_le16 (RPM_CMD_TX_DATA_CONT ); + req.msg.cmd =cpu_to_le16 (GLINK_CMD_TX_DATA_CONT ); req.msg.param1 =cpu_to_le16 (channel->lcid); req.msg.param2 =cpu_to_le32 (iid); req.chunk_size =cpu_to_le32 (chunk_size);
@@ -1605,22 +1605,22 @@ static void qcom_glink_work(struct work_struct *work) param2 =le32_to_cpu (msg->param2);switch (cmd) { -case RPM_CMD_VERSION : +case GLINK_CMD_VERSION :qcom_glink_receive_version (glink, param1, param2);break ; -case RPM_CMD_VERSION_ACK : +case GLINK_CMD_VERSION_ACK :qcom_glink_receive_version_ack (glink, param1, param2);break ; -case RPM_CMD_OPEN : +case GLINK_CMD_OPEN :qcom_glink_rx_open (glink, param1, msg->data);break ; -case RPM_CMD_CLOSE : +case GLINK_CMD_CLOSE :qcom_glink_rx_close (glink, param1);break ; -case RPM_CMD_CLOSE_ACK : +case GLINK_CMD_CLOSE_ACK :qcom_glink_rx_close_ack (glink, param1);break ; -case RPM_CMD_RX_INTENT_REQ : +case GLINK_CMD_RX_INTENT_REQ :qcom_glink_handle_intent_req (glink, param1, param2);break ;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 209/459 rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Marek <[email protected]>
[ Upstream commit 06c59d97f63c1b8af521fa5aef8a716fb988b285 ]
The name len field of the CMD_OPEN packet is only 16-bits and the upper 16-bits of "param2" are a different "prio" field, which can be nonzero in certain situations, and CMD_OPEN packets can be unexpectedly dropped because of this.
Fix this by masking out the upper 16 bits of param2.
--- drivers/rpmsg/qcom_glink_native.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/rpmsg/qcom_glink_native.c +2 -1
@@ -1045,7 +1045,8 @@ static irqreturn_t qcom_glink_native_intr(int irq, void *data)qcom_glink_rx_advance (glink,ALIGN (sizeof (msg),8 ));break ;case GLINK_CMD_OPEN : - ret =qcom_glink_rx_defer (glink, param2); +/* upper 16 bits of param2 are the "prio" field */ + ret =qcom_glink_rx_defer (glink, param2 &0xffff );break ;case GLINK_CMD_TX_DATA :case GLINK_CMD_TX_DATA_CONT :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 210/459 remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sibi Sankar <[email protected]>
[ Upstream commit 7b22b7719fc17d5979a991c918c868ab041be5c8 ]
Any write access to the IMEM region when the Q6 is setting up XPU protection on it will result in a XPU violation. Fix this by ensuring IMEM writes related to the MBA post-mortem logs happen before the Q6 is brought out of reset.
--- drivers/remoteproc/qcom_q6v5_mss.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/remoteproc/qcom_q6v5_mss.c +3 -0
@@ -980,6 +980,9 @@ static int q6v5_mba_load(struct q6v5 *qproc) goto disable_active_clks; } +if (qproc->has_mba_logs) +qcom_pil_info_store ("mba" , qproc->mba_phys,MBA_LOG_SIZE ); +writel (qproc->mba_phys, qproc->rmb_base +RMB_MBA_IMAGE_REG );if (qproc->dp_size) {writel (qproc->mba_phys +SZ_1M , qproc->rmb_base +RMB_PMI_CODE_START_REG );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 211/459 NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 1e02c641c3a43c88cecc08402000418e15578d38 ]
@ses is initialized to NULL. If __nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try to dereference @ses and segfault.
--- fs/nfsd/nfs4callback.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfsd/nfs4callback.c +2 -0
@@ -1379,6 +1379,8 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb) ses = c->cn_session; }spin_unlock (&clp->cl_lock); +if (!c) +return ; err =setup_callback_client (clp, &conn, ses);if (err) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 212/459 NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit f64ea4af43161bb86ffc77e6aeb5bcf5c3229df0 ]
It's only current caller already length-checks the string, but let's be safe.
--- fs/nfsd/nfs4recover.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/nfs4recover.c +2 -1
@@ -658,7 +658,8 @@ nfs4_reset_recoverydir(char *recdir)return status; status = -ENOTDIR ;if (d_is_dir (path.dentry)) { -strcpy (user_recovery_dirname, recdir); +strscpy (user_recovery_dirname, recdir, +sizeof (user_recovery_dirname)); status =0 ; }path_put (&path);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 213/459 NFSD: Fix nfsd4_shutdown_copy()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 62a8642ba00aa8ceb0a02ade942f5ec52e877c95 ]
nfsd4_shutdown_copy() is just this:
while ((copy = nfsd4_get_copy(clp)) != NULL) nfsd4_stop_copy(copy);
nfsd4_get_copy() bumps @copy's reference count, preventing nfsd4_stop_copy() from releasing @copy.
A while loop like this usually works by removing the first element of the list, but neither nfsd4_get_copy() nor nfsd4_stop_copy() alters the async_copies list.
Best I can tell, then, is that nfsd4_shutdown_copy() continues to loop until other threads manage to remove all the items from this list. The spinning loop blocks shutdown until these items are gone.
Possibly the reason we haven't seen this issue in the field is because client_has_state() prevents __destroy_client() from calling nfsd4_shutdown_copy() if there are any items on this list. In a subsequent patch I plan to remove that restriction.
--- fs/nfsd/nfs4proc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/nfsd/nfs4proc.c +5 -2
@@ -1256,7 +1256,7 @@ static void nfsd4_stop_copy(struct nfsd4_copy *copy)nfs4_put_copy (copy); } -static struct nfsd4_copy *nfsd4_get_copy (struct nfs4_client *clp) +static struct nfsd4_copy *nfsd4_unhash_copy (struct nfs4_client *clp) {struct nfsd4_copy *copy =NULL ;
@@ -1265,6 +1265,9 @@ static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp) copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, copies);refcount_inc (©->refcount); + copy->cp_clp =NULL ; +if (!list_empty (©->copies)) +list_del_init (©->copies); }spin_unlock (&clp->async_lock);return copy;
@@ -1274,7 +1277,7 @@ void nfsd4_shutdown_copy(struct nfs4_client *clp) {struct nfsd4_copy *copy; -while ((copy =nfsd4_get_copy (clp)) !=NULL ) +while ((copy =nfsd4_unhash_copy (clp)) !=NULL )nfsd4_stop_copy (copy); }#ifdef CONFIG_NFSD_V4_2_INTER_SSC
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 214/459 vdpa/mlx5: Fix suboptimal range on iotlb iteration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Si-Wei Liu <[email protected]>
[ Upstream commit 35025963326e44d8bced3eecd42d2f040f4f0024 ]
The starting iova address to iterate iotlb map entry within a range was set to an irrelevant value when passing to the itree_next() iterator, although luckily it doesn't affect the outcome of finding out the granule of the smallest iotlb map size. Fix the code to make it consistent with the following for-loop.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/core/mr.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/vdpa/mlx5/core/mr.c +1 -3
@@ -226,7 +226,6 @@ static int map_direct_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_direct_mrunsigned long lgcd =0 ;int log_entity_size;unsigned long size; -u64 start =0 ;int err;struct page *pg;unsigned int nsg;
@@ -237,10 +236,9 @@ static int map_direct_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_direct_mrstruct device *dma = mvdev->mdev->device;for (map =vhost_iotlb_itree_first (iotlb, mr->start, mr->end -1 ); - map; map =vhost_iotlb_itree_next (map, start, mr->end -1 )) { + map; map =vhost_iotlb_itree_next (map, mr->start, mr->end -1 )) { size =maplen (map, mr); lgcd =gcd (lgcd, size); - start += size; } log_entity_size =ilog2 (lgcd);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 215/459 vfio/pci: Properly hide first-in-list PCIe extended capability
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avihai Horon <[email protected]>
[ Upstream commit fe4bf8d0b6716a423b16495d55b35d3fe515905d ]
There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability (i.e., capability with ID greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally chosen to be hidden from the user.
Hiding a capability is done by virtualizing and modifying the 'Next Capability Offset' field of the previous capability so it points to the capability after the one that should be hidden.
The special case where the first capability in the list should be hidden is handled differently because there is no previous capability that can be modified. In this case, the capability ID and version are zeroed while leaving the next pointer intact. This hides the capability and leaves an anchor for the rest of the capability list.
However, today, hiding the first capability in the list is not done properly if the capability is unknown, as struct vfio_pci_core_device->pci_config_map is set to the capability ID during initialization but the capability ID is not properly checked later when used in vfio_config_do_rw(). This leads to the following warning [1] and to an out-of-bounds access to ecap_perms array.
Fix it by checking cap_id in vfio_config_do_rw(), and if it is greater than PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct read only access instead of the ecap_perms array.
Note that this is safe since the above is the only case where cap_id can exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which are already checked before).
[1]
WARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] CPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1 (snip) Call Trace: <TASK> ? show_regs+0x69/0x80 ? __warn+0x8d/0x140 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? report_bug+0x18f/0x1a0 ? handle_bug+0x63/0xa0 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core] vfio_pci_rw+0x101/0x1b0 [vfio_pci_core] vfio_pci_core_read+0x1d/0x30 [vfio_pci_core] vfio_device_fops_read+0x27/0x40 [vfio] vfs_read+0xbd/0x340 ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio] ? __rseq_handle_notify_resume+0xa4/0x4b0 __x64_sys_pread64+0x96/0xc0 x64_sys_call+0x1c3d/0x20d0 do_syscall_64+0x4d/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- drivers/vfio/pci/vfio_pci_config.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/vfio/pci/vfio_pci_config.c +14 -2
@@ -312,6 +312,10 @@ static int vfio_virt_config_read(struct vfio_pci_device *vdev, int pos,return count; } +static struct perm_bits direct_ro_perms = { + .readfn = vfio_direct_config_read, +}; +/* Default capability regions to read-only, no-virtualization */ static struct perm_bits cap_perms[PCI_CAP_ID_MAX +1 ] = { [0 ...PCI_CAP_ID_MAX ] = { .readfn = vfio_direct_config_read }
@@ -1840,9 +1844,17 @@ static ssize_t vfio_config_do_rw(struct vfio_pci_device *vdev, char __user *buf, cap_start = *ppos; }else {if (*ppos >=PCI_CFG_SPACE_SIZE ) { -WARN_ON (cap_id >PCI_EXT_CAP_ID_MAX ); +/* +* We can get a cap_id that exceeds PCI_EXT_CAP_ID_MAX +* if we're hiding an unknown capability at the start +* of the extended capability list. Use default, ro +* access, which will virtualize the id and next values. +*/ +if (cap_id >PCI_EXT_CAP_ID_MAX ) + perm = &direct_ro_perms; +else + perm = &ecap_perms[cap_id]; - perm = &ecap_perms[cap_id]; cap_start =vfio_find_cap_start (vdev, *ppos); }else {WARN_ON (cap_id >PCI_CAP_ID_MAX );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 216/459 fs_parser: update mount_api doc to match function signature
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit c66f759832a83cb273ba5a55c66dcc99384efa74 ]
Add the missing 'name' parameter to the mount_api documentation for fs_validate_description().
--- Documentation/filesystems/mount_api.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Documentation/filesystems/mount_api.rst +2 -1
@@ -778,7 +778,8 @@ process the parameters it is given. * :: - bool fs_validate_description(const struct fs_parameter_description *desc); + bool fs_validate_description(const char *name, + const struct fs_parameter_description *desc); This performs some validation checks on a parameter description. It returns true if the description is good and false if it is not. It will
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 217/459 power: supply: core: Remove might_sleep() from power_supply_put()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit f6da4553ff24a5d1c959c9627c965323adc3d307 ]
The put_device() call in power_supply_put() may call power_supply_dev_release(). The latter function does not sleep so power_supply_put() doesn't sleep either. Hence, remove the might_sleep() call from power_supply_put(). This patch suppresses false positive complaints about calling a sleeping function from atomic context if power_supply_put() is called from atomic context.
--- drivers/power/supply/power_supply_core.c | 2 -- 1 file changed, 2 deletions(-)
drivers/power/supply/power_supply_core.c +0 -2
@@ -479,8 +479,6 @@ EXPORT_SYMBOL_GPL(power_supply_get_by_name);*/ void power_supply_put (struct power_supply *psy) { -might_sleep (); -atomic_dec (&psy->use_cnt);put_device (&psy->dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 218/459 power: supply: bq27xxx: Support CHARGE_NOW for bq27z561/bq28z610/bq34z100
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermes Zhang <[email protected]>
[ Upstream commit 3ed510f06e12f8876c20474766cc2f101a41174f ]
Currently REG_NAC (nominal available capacity) is mapped to power-supply's CHARGE_NOW property. Some chips do not have REG_NAC and do not expose CHARGE_NOW at the moment. Some bq27xxx chips also have another register REG_RM (remaining capacity). The difference between REG_NAC and REG_RM is load compensation.
This patch adds register information for REG_RM for all supported fuel gauges. On systems having REG_NAC it is ignored, so behaviour does not change. On systems without REG_NAC, REG_RM will be used to provide CHARGE_NOW functionality.
As a result there are three more chips exposing CHARGE_NOW:
bq27z561, bq28z610 and bq34z100
Stable-dep-of: 34f99d3b706a ("power: supply: bq27xxx: Fix registers of bq27426")
--- drivers/power/supply/bq27xxx_battery.c | 35 +++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-)
drivers/power/supply/bq27xxx_battery.c +34 -1
@@ -110,6 +110,7 @@ enum bq27xxx_reg_index {BQ27XXX_REG_TTES ,/* Time-to-Empty Standby */ BQ27XXX_REG_TTECP ,/* Time-to-Empty at Constant Power */ BQ27XXX_REG_NAC ,/* Nominal Available Capacity */ +BQ27XXX_REG_RC ,/* Remaining Capacity */ BQ27XXX_REG_FCC ,/* Full Charge Capacity */ BQ27XXX_REG_CYCT ,/* Cycle Count */ BQ27XXX_REG_AE, /* Available Energy */
@@ -145,6 +146,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1c, [BQ27XXX_REG_TTECP] = 0x26, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = INVALID_REG_ADDR, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = 0x22,
@@ -169,6 +171,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1c, [BQ27XXX_REG_TTECP] = 0x26, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = INVALID_REG_ADDR, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
@@ -193,6 +196,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1a, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
@@ -215,6 +219,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1c, [BQ27XXX_REG_TTECP] = 0x26, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = 0x22,
@@ -237,6 +242,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1a, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x1e, [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
@@ -257,6 +263,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1c, [BQ27XXX_REG_TTECP] = 0x26, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = INVALID_REG_ADDR, [BQ27XXX_REG_AE] = 0x22,
@@ -277,6 +284,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1c, [BQ27XXX_REG_TTECP] = 0x26, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = 0x22,
@@ -297,6 +305,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1c, [BQ27XXX_REG_TTECP] = 0x26, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = 0x22,
@@ -317,6 +326,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1c, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x1e, [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
@@ -337,6 +347,7 @@ static u8 [BQ27XXX_REG_TTES] = INVALID_REG_ADDR, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = INVALID_REG_ADDR, + [BQ27XXX_REG_RC] = INVALID_REG_ADDR, [BQ27XXX_REG_FCC] = INVALID_REG_ADDR, [BQ27XXX_REG_CYCT] = INVALID_REG_ADDR, [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
@@ -361,6 +372,7 @@ static u8 [BQ27XXX_REG_TTES] = INVALID_REG_ADDR, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
@@ -382,6 +394,7 @@ static u8 [BQ27XXX_REG_TTES] = INVALID_REG_ADDR, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
@@ -405,6 +418,7 @@ static u8 [BQ27XXX_REG_TTES] = INVALID_REG_ADDR, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = 0x0c, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
@@ -425,6 +439,7 @@ static u8 [BQ27XXX_REG_TTES] = INVALID_REG_ADDR, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = 0x08, + [BQ27XXX_REG_RC] = 0x0c, [BQ27XXX_REG_FCC] = 0x0e, [BQ27XXX_REG_CYCT] = INVALID_REG_ADDR, [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
@@ -450,6 +465,7 @@ static u8 [BQ27XXX_REG_TTES] = INVALID_REG_ADDR, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = INVALID_REG_ADDR, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = 0x22,
@@ -470,6 +486,7 @@ static u8 [BQ27XXX_REG_TTES] = INVALID_REG_ADDR, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = INVALID_REG_ADDR, + [BQ27XXX_REG_RC] = 0x10, [BQ27XXX_REG_FCC] = 0x12, [BQ27XXX_REG_CYCT] = 0x2a, [BQ27XXX_REG_AE] = 0x22,
@@ -490,6 +507,7 @@ static u8 [BQ27XXX_REG_TTES] = 0x1e, [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, [BQ27XXX_REG_NAC] = INVALID_REG_ADDR, + [BQ27XXX_REG_RC] = 0x04, [BQ27XXX_REG_FCC] = 0x06, [BQ27XXX_REG_CYCT] = 0x2c, [BQ27XXX_REG_AE] = 0x24,
@@ -745,6 +763,7 @@ static enum power_supply_property bq27z561_props[] = {POWER_SUPPLY_PROP_TIME_TO_FULL_NOW ,POWER_SUPPLY_PROP_TECHNOLOGY ,POWER_SUPPLY_PROP_CHARGE_FULL , +POWER_SUPPLY_PROP_CHARGE_NOW ,POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN ,POWER_SUPPLY_PROP_CYCLE_COUNT , POWER_SUPPLY_PROP_POWER_AVG,
@@ -764,6 +783,7 @@ static enum power_supply_property bq28z610_props[] = {POWER_SUPPLY_PROP_TIME_TO_FULL_NOW ,POWER_SUPPLY_PROP_TECHNOLOGY ,POWER_SUPPLY_PROP_CHARGE_FULL , +POWER_SUPPLY_PROP_CHARGE_NOW ,POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN ,POWER_SUPPLY_PROP_CYCLE_COUNT , POWER_SUPPLY_PROP_POWER_AVG,
@@ -784,6 +804,7 @@ static enum power_supply_property bq34z100_props[] = {POWER_SUPPLY_PROP_TIME_TO_FULL_NOW ,POWER_SUPPLY_PROP_TECHNOLOGY ,POWER_SUPPLY_PROP_CHARGE_FULL , +POWER_SUPPLY_PROP_CHARGE_NOW ,POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN ,POWER_SUPPLY_PROP_CYCLE_COUNT , POWER_SUPPLY_PROP_ENERGY_NOW,
@@ -1508,6 +1529,15 @@ static inline int bq27xxx_battery_read_nac(struct bq27xxx_device_info *di)return bq27xxx_battery_read_charge (di,BQ27XXX_REG_NAC ); } +/* +* Return the battery Remaining Capacity in µAh +* Or < 0 if something fails. +*/ +static inline int bq27xxx_battery_read_rc (struct bq27xxx_device_info *di) +{ +return bq27xxx_battery_read_charge (di,BQ27XXX_REG_RC ); +} +/* * Return the battery Full Charge Capacity in µAh * Or < 0 if something fails.
@@ -1979,7 +2009,10 @@ static int bq27xxx_battery_get_property(struct power_supply *psy, val->intval =POWER_SUPPLY_TECHNOLOGY_LION ;break ;case POWER_SUPPLY_PROP_CHARGE_NOW : - ret =bq27xxx_simple_value (bq27xxx_battery_read_nac (di), val); +if (di->regs[BQ27XXX_REG_NAC ] !=INVALID_REG_ADDR ) + ret =bq27xxx_simple_value (bq27xxx_battery_read_nac (di), val); +else + ret =bq27xxx_simple_value (bq27xxx_battery_read_rc (di), val);break ;case POWER_SUPPLY_PROP_CHARGE_FULL : ret =bq27xxx_simple_value (di->cache.charge_full, val);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 219/459 power: supply: bq27xxx: Fix registers of bq27426
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <[email protected]>
[ Upstream commit 34f99d3b706a519e556841f405c224ca708b1f54 ]
Correct bq27426 registers, according to technical reference manual it does not have Design Capacity register so it is not register compatible with bq27421.
--- drivers/power/supply/bq27xxx_battery.c | 37 ++++++++++++++++++++++++-- 1 file changed, 35 insertions(+), 2 deletions(-)
drivers/power/supply/bq27xxx_battery.c +35 -2
@@ -448,9 +448,29 @@ static u8 [BQ27XXX_REG_AP ] =0x18 ,BQ27XXX_DM_REG_ROWS , }, + bq27426_regs[BQ27XXX_REG_MAX ] = { + [BQ27XXX_REG_CTRL ] =0x00 , + [BQ27XXX_REG_TEMP ] =0x02 , + [BQ27XXX_REG_INT_TEMP ] =0x1e , + [BQ27XXX_REG_VOLT ] =0x04 , + [BQ27XXX_REG_AI ] =0x10 , + [BQ27XXX_REG_FLAGS ] =0x06 , + [BQ27XXX_REG_TTE ] =INVALID_REG_ADDR , + [BQ27XXX_REG_TTF ] =INVALID_REG_ADDR , + [BQ27XXX_REG_TTES ] =INVALID_REG_ADDR , + [BQ27XXX_REG_TTECP ] =INVALID_REG_ADDR , + [BQ27XXX_REG_NAC ] =0x08 , + [BQ27XXX_REG_RC ] =0x0c , + [BQ27XXX_REG_FCC ] =0x0e , + [BQ27XXX_REG_CYCT ] =INVALID_REG_ADDR , + [BQ27XXX_REG_AE ] =INVALID_REG_ADDR , + [BQ27XXX_REG_SOC ] =0x1c , + [BQ27XXX_REG_DCAP ] =INVALID_REG_ADDR , + [BQ27XXX_REG_AP ] =0x18 , +BQ27XXX_DM_REG_ROWS , + }, #define bq27411_regs bq27421_regs #define bq27425_regs bq27421_regs -#define bq27426_regs bq27421_regs #define bq27441_regs bq27421_regs #define bq27621_regs bq27421_regs bq27z561_regs[BQ27XXX_REG_MAX ] = {
@@ -747,10 +767,23 @@ static enum power_supply_property bq27421_props[] = { };#define bq27411_props bq27421_props#define bq27425_props bq27421_props -#define bq27426_props bq27421_props#define bq27441_props bq27421_props#define bq27621_props bq27421_props +static enum power_supply_property bq27426_props[] = { +POWER_SUPPLY_PROP_STATUS , +POWER_SUPPLY_PROP_PRESENT , +POWER_SUPPLY_PROP_VOLTAGE_NOW , +POWER_SUPPLY_PROP_CURRENT_NOW , +POWER_SUPPLY_PROP_CAPACITY , +POWER_SUPPLY_PROP_CAPACITY_LEVEL , +POWER_SUPPLY_PROP_TEMP , +POWER_SUPPLY_PROP_TECHNOLOGY , +POWER_SUPPLY_PROP_CHARGE_FULL , +POWER_SUPPLY_PROP_CHARGE_NOW , +POWER_SUPPLY_PROP_MANUFACTURER , +}; +static enum power_supply_property bq27z561_props[] = {POWER_SUPPLY_PROP_STATUS ,POWER_SUPPLY_PROP_PRESENT ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 220/459 net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit ae7370e61c5d8f5bcefc2d4fca724bd4e9bbf789 ]
Add calls to phy_device_free after fixed_phy_unregister to fix a memory leak that occurs when the device is unplugged. This ensures proper cleanup of pseudo fixed-link PHYs.
--- drivers/net/usb/lan78xx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/usb/lan78xx.c +4 -1
@@ -2157,6 +2157,7 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)if (dev->chipid ==ID_REV_CHIP_ID_7801_ ) {if (phy_is_pseudo_fixed_link (phydev)) {fixed_phy_unregister (phydev); +phy_device_free (phydev); }else {phy_unregister_fixup_for_uid (PHY_KSZ9031RNX ,0xfffffff0 );
@@ -3835,8 +3836,10 @@ static void lan78xx_disconnect(struct usb_interface *intf)phy_disconnect (net->phydev); -if (phy_is_pseudo_fixed_link (phydev)) +if (phy_is_pseudo_fixed_link (phydev)) {fixed_phy_unregister (phydev); +phy_device_free (phydev); + }unregister_netdev (net);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 221/459 tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavan Chebbi <[email protected]>
[ Upstream commit 614f4d166eeeb9bd709b0ad29552f691c0f45776 ]
The hardware on Broadcom 1G chipsets have a known limitation where they cannot handle DMA addresses that cross over 4GB. When such an address is encountered, the hardware sets the address overflow error bit in the DMA status register and triggers a reset.
However, BCM57766 hardware is setting the overflow bit and triggering a reset in some cases when there is no actual underlying address overflow. The hardware team analyzed the issue and concluded that it is happening when the status block update has an address with higher (b16 to b31) bits as 0xffff following a previous update that had lowest bits as 0xffff.
To work around this bug in the BCM57766 hardware, set the coherent dma mask from the current 64b to 31b. This will ensure that upper bits of the status block DMA address are always at most 0x7fff, thus avoiding the improper overflow check described above. This work around is intended for only status block and ring memories and has no effect on TX and RX buffers as they do not require coherent memory.
--- drivers/net/ethernet/broadcom/tg3.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/broadcom/tg3.c +3 -0
@@ -17807,6 +17807,9 @@ static int tg3_init_one(struct pci_dev *pdev, }else persist_dma_mask = dma_mask =DMA_BIT_MASK (64 ); +if (tg3_asic_rev (tp) ==ASIC_REV_57766 ) + persist_dma_mask =DMA_BIT_MASK (31 ); +/* Configure DMA attributes. */ if (dma_mask >DMA_BIT_MASK (32 )) { err =pci_set_dma_mask (pdev, dma_mask);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 222/459 net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit e863ff806f72098bccaf8fa89c80d9ad6187c3b0 ]
Validate Wake-on-LAN (WoL) options in lan78xx_set_wol before calling usb_autopm_get_interface. This prevents USB autopm refcounting issues and ensures the adapter can properly enter autosuspend when invalid WoL options are provided.
--- drivers/net/usb/lan78xx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/usb/lan78xx.c +3 -3
@@ -1428,13 +1428,13 @@ static int lan78xx_set_wol(struct net_device *netdev,struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0 ]);int ret; +if (wol->wolopts & ~WAKE_ALL ) +return -EINVAL ; + ret =usb_autopm_get_interface (dev->intf);if (ret <0 )return ret; -if (wol->wolopts & ~WAKE_ALL ) -return -EINVAL ; - pdata->wol = wol->wolopts;device_set_wakeup_enable (&dev->udev->dev, (bool )wol->wolopts);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 223/459 marvell: pxa168_eth: fix call balance of pep->clk handling routines
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitalii Mordan <[email protected]>
[ Upstream commit b032ae57d4fe2b2445e3bc190db6fcaa8c102f68 ]
If the clock pep->clk was not enabled in pxa168_eth_probe, it should not be disabled in any path.
Conversely, if it was enabled in pxa168_eth_probe, it must be disabled in all error paths to ensure proper cleanup.
Use the devm_clk_get_enabled helper function to ensure proper call balance for pep->clk.
Found by Linux Verification Center (linuxtesting.org) with Klever.
--- drivers/net/ethernet/marvell/pxa168_eth.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/net/ethernet/marvell/pxa168_eth.c +4 -10
@@ -1397,18 +1397,15 @@ static int pxa168_eth_probe(struct platform_device *pdev)printk (KERN_NOTICE "PXA168 10/100 Ethernet Driver\n" ); - clk =devm_clk_get (&pdev->dev,NULL ); + clk =devm_clk_get_enabled (&pdev->dev,NULL );if (IS_ERR (clk)) { -dev_err (&pdev->dev,"Fast Ethernet failed to get clock\n" ); +dev_err (&pdev->dev,"Fast Ethernet failed to get and enable clock\n" );return -ENODEV ; } -clk_prepare_enable (clk); dev =alloc_etherdev (sizeof (struct pxa168_eth_private )); -if (!dev) { - err = -ENOMEM ; - goto err_clk; - } +if (!dev) +return -ENOMEM ;platform_set_drvdata (pdev, dev); pep =netdev_priv (dev);
@@ -1523,8 +1520,6 @@ static int pxa168_eth_probe(struct platform_device *pdev)mdiobus_free (pep->smi_bus); err_netdev:free_netdev (dev); -err_clk: -clk_disable_unprepare (clk);return err; }
@@ -1541,7 +1536,6 @@ static int pxa168_eth_remove(struct platform_device *pdev)if (dev->phydev)phy_disconnect (dev->phydev); -clk_disable_unprepare (pep->clk);mdiobus_unregister (pep->smi_bus);mdiobus_free (pep->smi_bus);cancel_work_sync (&pep->tx_timeout_task);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 224/459 net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Chevallier <[email protected]>
[ Upstream commit 407618d66dba55e7db1278872e8be106808bbe91 ]
On DWMAC3 and later, there's a RX Watchdog interrupt that's used for interrupt coalescing. It's known to be buggy on some platforms, and dwmac-socfpga appears to be one of them. Changing the interrupt coalescing from ethtool doesn't appear to have any effect here.
Without disabling RIWT (Received Interrupt Watchdog Timer, I believe...), we observe latencies while receiving traffic that amount to around ~0.4ms. This was discovered with NTP but can be easily reproduced with a simple ping. Without this patch :
64 bytes from 192.168.5.2: icmp_seq=1 ttl=64 time=0.657 ms
With this patch :
64 bytes from 192.168.5.2: icmp_seq=1 ttl=64 time=0.254 ms
--- drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +2 -0
@@ -426,6 +426,8 @@ static int socfpga_dwmac_probe(struct platform_device *pdev) plat_dat->bsp_priv = dwmac; plat_dat->fix_mac_speed = socfpga_dwmac_fix_mac_speed; + plat_dat->riwt_off =1 ; + ret =stmmac_dvr_probe (&pdev->dev, plat_dat, &stmmac_res);if (ret) goto err_remove_config_dt;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 225/459 spi: atmel-quadspi: Fix register name in verbose logging function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit 2ac40e6d0ccdd93031f8b1af61b0fe5cdd704923 ]
atmel_qspi_reg_name() is used for pretty-printing register offsets for verbose logging of register accesses. However, due to a typo (likely a copy-paste error), QSPI_RD's offset prints as "MR", the name of the previous register. Fix this typo.
--- drivers/spi/atmel-quadspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/atmel-quadspi.c +1 -1
@@ -182,7 +182,7 @@ static const char *atmel_qspi_reg_name(u32 offset, char *tmp, size_t sz)case QSPI_MR :return "MR" ;case QSPI_RD : -return "MR" ; +return "RD" ;case QSPI_TD :return "TD" ;case QSPI_SR :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 226/459 net: introduce a netdev feature for UDP GRO forwarding
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Lobakin <[email protected]>
[ Upstream commit 6f1c0ea133a6e4a193a7b285efe209664caeea43 ]
Introduce a new netdev feature, NETIF_F_GRO_UDP_FWD, to allow user to turn UDP GRO on and off for forwarding.
Defaults to off to not change current datapath.
Stable-dep-of: 9cfb5e7f0ded ("net: hsr: fix hsr_init_sk() vs network/transport headers.")
--- include/linux/netdev_features.h | 4 +++- net/ethtool/common.c | 1 + 2 files changed, 4 insertions(+), 1 deletion(-)
include/linux/netdev_features.h +3 -1
@@ -84,6 +84,7 @@ enum {NETIF_F_GRO_FRAGLIST_BIT ,/* Fraglist GRO */ NETIF_F_HW_MACSEC_BIT ,/* Offload MACsec operations */ + NETIF_F_GRO_UDP_FWD_BIT, /* Allow UDP GRO for forwarding *//* * Add your fresh new feature above and remember to update
@@ -157,6 +158,7 @@ enum {#define NETIF_F_GRO_FRAGLIST __NETIF_F(GRO_FRAGLIST)#define NETIF_F_GSO_FRAGLIST __NETIF_F(GSO_FRAGLIST)#define NETIF_F_HW_MACSEC __NETIF_F(HW_MACSEC) +#define NETIF_F_GRO_UDP_FWD __NETIF_F(GRO_UDP_FWD)/* Finds the next feature with the highest number of the range of start-1 till 0. */
@@ -234,7 +236,7 @@ static inline int find_next_netdev_feature(u64 feature, unsigned long start)#define NETIF_F_SOFT_FEATURES (NETIF_F_GSO | NETIF_F_GRO)/* Changeable features with no special hardware requirements that defaults to off. */ -#define NETIF_F_SOFT_FEATURES_OFF NETIF_F_GRO_FRAGLIST +#define NETIF_F_SOFT_FEATURES_OFF (NETIF_F_GRO_FRAGLIST | NETIF_F_GRO_UDP_FWD)#define NETIF_F_VLAN_FEATURES (NETIF_F_HW_VLAN_CTAG_FILTER | \ NETIF_F_HW_VLAN_CTAG_RX | \
net/ethtool/common.c +1 -0
@@ -68,6 +68,7 @@ const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN] = { [NETIF_F_HW_TLS_RX_BIT] = "tls-hw-rx-offload", [NETIF_F_GRO_FRAGLIST_BIT] = "rx-gro-list", [NETIF_F_HW_MACSEC_BIT] = "macsec-hw-offload", + [NETIF_F_GRO_UDP_FWD_BIT] = "rx-udp-gro-forwarding", }; const char
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 227/459 net: hsr: fix hsr_init_sk() vs network/transport headers.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9cfb5e7f0ded2bfaabc270ceb5f91d13f0e805b9 ]
Following sequence in hsr_init_sk() is invalid :
skb_reset_mac_header(skb);
skb_reset_mac_len(skb);
skb_reset_network_header(skb);
skb_reset_transport_header(skb);It is invalid because skb_reset_mac_len() needs the correct network header, which should be after the mac header.
This patch moves the skb_reset_network_header() and skb_reset_transport_header() before
the call to dev_hard_header().
As a result skb->mac_len is no longer set to a value close to 65535.
--- net/hsr/hsr_device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/hsr/hsr_device.c +2 -2
@@ -256,6 +256,8 @@ static struct sk_buff *hsr_init_skb(struct hsr_port *master) skb->dev = master->dev; skb->priority =TC_PRIO_CONTROL ; +skb_reset_network_header (skb); +skb_reset_transport_header (skb);if (dev_hard_header (skb, skb->dev,ETH_P_PRP , hsr->sup_multicast_addr, skb->dev->dev_addr, skb->len) <=0 )
@@ -263,8 +265,6 @@ static struct sk_buff *hsr_init_skb(struct hsr_port *master)skb_reset_mac_header (skb);skb_reset_mac_len (skb); -skb_reset_network_header (skb); -skb_reset_transport_header (skb);return skb; out:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 228/459 bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravanan Vajravel <[email protected]>
[ Upstream commit 5311598f7f3293683cdc761df71ae3469327332c ]
After successful PCIe AER recovery, FW will reset all resource reservations. If it is IF_UP, the driver will call bnxt_open() and all resources will be reserved again. It it is IF_DOWN, we should call bnxt_reserve_rings() so that we can reserve resources including RoCE resources to allow RoCE to resume after AER. Without this patch, RoCE fails to resume in this IF_DOWN scenario.
Later, if it becomes IF_UP, bnxt_open() will see that resources have been reserved and will not reserve again.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +6 -2
@@ -13107,8 +13107,12 @@ static void bnxt_io_resume(struct pci_dev *pdev)rtnl_lock (); err =bnxt_hwrm_func_qcaps (bp); -if (!err &&netif_running (netdev)) - err =bnxt_open (netdev); +if (!err) { +if (netif_running (netdev)) + err =bnxt_open (netdev); +else + err =bnxt_reserve_rings (bp, true); + }bnxt_ulp_start (bp, err);if (!err) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 229/459 ipmr: convert /proc handlers to rcu_read_lock()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b96ef16d2f837870daaea51c38cd50458b95ad5c ]
We can use standard rcu_read_lock(), to get rid
of last read_lock(&mrt_lock) call points.
Stable-dep-of: fc9c273d6daa ("ipmr: fix tables suspicious RCU usage")
--- net/ipv4/ipmr.c | 8 ++++---- net/ipv6/ip6mr.c | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-)
net/ipv4/ipmr.c +4 -4
@@ -2896,7 +2896,7 @@ static int ipmr_rtm_dumplink(struct sk_buff *skb, struct netlink_callback *cb)*/ static void *ipmr_vif_seq_start (struct seq_file *seq,loff_t *pos) -__acquires (mrt_lock) +__acquires (RCU ) {struct mr_vif_iter *iter = seq->private;struct net *net =seq_file_net (seq);
@@ -2908,14 +2908,14 @@ static void *ipmr_vif_seq_start(struct seq_file *seq, loff_t *pos) iter->mrt = mrt; -read_lock (&mrt_lock); +rcu_read_lock ();return mr_vif_seq_start (seq, pos); }static void ipmr_vif_seq_stop (struct seq_file *seq,void *v) -__releases (mrt_lock) +__releases (RCU ) { -read_unlock (&mrt_lock); +rcu_read_unlock (); }static int ipmr_vif_seq_show (struct seq_file *seq,void *v)
net/ipv6/ip6mr.c +4 -4
@@ -405,7 +405,7 @@ static void ip6mr_free_table(struct mr_table *mrt)*/ static void *ip6mr_vif_seq_start (struct seq_file *seq,loff_t *pos) -__acquires (mrt_lock) +__acquires (RCU ) {struct mr_vif_iter *iter = seq->private;struct net *net =seq_file_net (seq);
@@ -417,14 +417,14 @@ static void *ip6mr_vif_seq_start(struct seq_file *seq, loff_t *pos) iter->mrt = mrt; -read_lock (&mrt_lock); +rcu_read_lock ();return mr_vif_seq_start (seq, pos); }static void ip6mr_vif_seq_stop (struct seq_file *seq,void *v) -__releases (mrt_lock) +__releases (RCU ) { -read_unlock (&mrt_lock); +rcu_read_unlock (); }static int ip6mr_vif_seq_show (struct seq_file *seq,void *v)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 230/459 ipmr: fix tables suspicious RCU usage
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit fc9c273d6daaa9866f349bbe8cae25c67764c456 ]
Similar to the previous patch, plumb the RCU lock inside the ipmr_get_table(), provided a lockless variant and apply the latter in the few spots were the lock is already held.
--- net/ipv4/ipmr.c | 42 +++++++++++++++++++++++++++++------------- 1 file changed, 29 insertions(+), 13 deletions(-)
net/ipv4/ipmr.c +29 -13
@@ -131,7 +131,7 @@ static struct mr_table *ipmr_mr_table_iter(struct net *net,return ret; } -static struct mr_table *ipmr_get_table (struct net *net,u32 id) +static struct mr_table *__ipmr_get_table (struct net *net,u32 id) {struct mr_table *mrt;
@@ -142,6 +142,16 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)return NULL ; } +static struct mr_table *ipmr_get_table (struct net *net,u32 id) +{ +struct mr_table *mrt; + +rcu_read_lock (); + mrt =__ipmr_get_table (net, id); +rcu_read_unlock (); +return mrt; +} +static int ipmr_fib_lookup (struct net *net,struct flowi4 *flp4,struct mr_table **mrt) {
@@ -183,7 +193,7 @@ static int ipmr_rule_action(struct fib_rule *rule, struct flowi *flp, arg->table =fib_rule_get_table (rule, arg); - mrt =ipmr_get_table (rule->fr_net, arg->table); + mrt =__ipmr_get_table (rule->fr_net, arg->table);if (!mrt)return -EAGAIN ; res->mrt = mrt;
@@ -315,6 +325,8 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)return net->ipv4.mrt; } +#define __ipmr_get_table ipmr_get_table +static int ipmr_fib_lookup (struct net *net,struct flowi4 *flp4,struct mr_table **mrt) {
@@ -404,7 +416,7 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id)if (id !=RT_TABLE_DEFAULT && id >=1000000000 )return ERR_PTR (-EINVAL ); - mrt =ipmr_get_table (net, id); + mrt =__ipmr_get_table (net, id);if (mrt)return mrt;
@@ -1366,7 +1378,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval, goto out_unlock; } - mrt =ipmr_get_table (net,raw_sk (sk)->ipmr_table ? :RT_TABLE_DEFAULT ); + mrt =__ipmr_get_table (net,raw_sk (sk)->ipmr_table ? :RT_TABLE_DEFAULT );if (!mrt) { ret = -ENOENT ; goto out_unlock;
@@ -2242,11 +2254,13 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,struct mr_table *mrt;int err; - mrt =ipmr_get_table (net,RT_TABLE_DEFAULT ); -if (!mrt) +rcu_read_lock (); + mrt =__ipmr_get_table (net,RT_TABLE_DEFAULT ); +if (!mrt) { +rcu_read_unlock ();return -ENOENT ; + } -rcu_read_lock (); cache =ipmr_cache_find (mrt, saddr, daddr);if (!cache && skb->dev) {int vif =ipmr_find_vif (mrt, skb->dev);
@@ -2537,7 +2551,7 @@ static int ipmr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, grp = tb[RTA_DST ] ?nla_get_in_addr (tb[RTA_DST ]) :0 ; tableid = tb[RTA_TABLE ] ?nla_get_u32 (tb[RTA_TABLE ]) :0 ; - mrt =ipmr_get_table (net, tableid ? tableid :RT_TABLE_DEFAULT ); + mrt =__ipmr_get_table (net, tableid ? tableid :RT_TABLE_DEFAULT );if (!mrt) { err = -ENOENT ; goto errout_free;
@@ -2589,7 +2603,7 @@ static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)if (filter.table_id) {struct mr_table *mrt; - mrt =ipmr_get_table (sock_net (skb->sk), filter.table_id); + mrt =__ipmr_get_table (sock_net (skb->sk), filter.table_id);if (!mrt) {if (rtnl_msg_family (cb->nlh) !=RTNL_FAMILY_IPMR )return skb->len;
@@ -2697,7 +2711,7 @@ static int rtm_to_ipmr_mfcc(struct net *net, struct nlmsghdr *nlh,break ; } } - mrt =ipmr_get_table (net, tblid); + mrt =__ipmr_get_table (net, tblid);if (!mrt) { ret = -ENOENT ; goto out;
@@ -2902,13 +2916,15 @@ static void *ipmr_vif_seq_start(struct seq_file *seq, loff_t *pos)struct net *net =seq_file_net (seq);struct mr_table *mrt; - mrt =ipmr_get_table (net,RT_TABLE_DEFAULT ); -if (!mrt) +rcu_read_lock (); + mrt =__ipmr_get_table (net,RT_TABLE_DEFAULT ); +if (!mrt) { +rcu_read_unlock ();return ERR_PTR (-ENOENT ); + } iter->mrt = mrt; -rcu_read_lock ();return mr_vif_seq_start (seq, pos); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 231/459 iio: light: al3010: Fix an error handling path in al3010_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit a4b7064d34186cf4970fe0333c3b27346cf8f819 ]
If i2c_smbus_write_byte_data() fails in al3010_init(), al3010_set_pwr(false) is not called.
In order to avoid such a situation, move the devm_add_action_or_reset() witch calls al3010_set_pwr(false) right after a successful al3010_set_pwr(true).
--- drivers/iio/light/al3010.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/iio/light/al3010.c +5 -6
@@ -87,7 +87,12 @@ static int al3010_init(struct al3010_data *data)int ret; ret =al3010_set_pwr (data->client, true); +if (ret <0 ) +return ret; + ret =devm_add_action_or_reset (&data->client->dev, + al3010_set_pwr_off, + data);if (ret <0 )return ret;
@@ -191,12 +196,6 @@ static int al3010_probe(struct i2c_client *client,return ret; } - ret =devm_add_action_or_reset (&client->dev, - al3010_set_pwr_off, - data); -if (ret <0 ) -return ret; -return devm_iio_device_register (&client->dev, indio_dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 232/459 usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit 44feafbaa66ec86232b123bb8437a6a262442025 ]
iowarrior_read() uses the iowarrior dev structure, but does not use any lock on the structure. This can cause various bugs including data-races, so it is more appropriate to use a mutex lock to safely protect the iowarrior dev structure. When using a mutex lock, you should split the branch to prevent blocking when the O_NONBLOCK flag is set.
In addition, it is unnecessary to check for NULL on the iowarrior dev structure obtained by reading file->private_data. Therefore, it is better to remove the check.
--- drivers/usb/misc/iowarrior.c | 46 ++++++++++++++++++++++++++++-------- 1 file changed, 36 insertions(+), 10 deletions(-)
drivers/usb/misc/iowarrior.c +36 -10
@@ -277,28 +277,45 @@ static ssize_t iowarrior_read(struct file *file, char __user *buffer,struct iowarrior *dev;int read_idx;int offset; +int retval; dev = file->private_data; +if (file->f_flags &O_NONBLOCK ) { + retval =mutex_trylock (&dev->mutex); +if (!retval) +return -EAGAIN ; + }else { + retval =mutex_lock_interruptible (&dev->mutex); +if (retval) +return -ERESTARTSYS ; + } +/* verify that the device wasn't unplugged */ -if (!dev || !dev->present) -return -ENODEV ; +if (!dev->present) { + retval = -ENODEV ; + goto exit; + }dev_dbg (&dev->interface->dev,"minor %d, count = %zd\n" , dev->minor, count);/* read count must be packet size (+ time stamp) */ if ((count != dev->report_size) - && (count != (dev->report_size +1 ))) -return -EINVAL ; + && (count != (dev->report_size +1 ))) { + retval = -EINVAL ; + goto exit; + }/* repeat until no buffer overrun in callback handler occur */ do { atomic_set(&dev->overflow_flag, 0); if ((read_idx = read_index(dev)) == -1) { /* queue empty */ - if (file->f_flags & O_NONBLOCK) - return -EAGAIN; + if (file->f_flags & O_NONBLOCK) { + retval = -EAGAIN; + goto exit; + } else { //next line will return when there is either new data, or the device is unplugged int r = wait_event_interruptible(dev->read_wait,
@@ -309,28 +326,37 @@ static ssize_t iowarrior_read(struct file *file, char __user *buffer, -1));if (r) {//we were interrupted by a signal -return -ERESTART ; + retval = -ERESTART ; + goto exit; }if (!dev->present) {//The device was unplugged -return -ENODEV ; + retval = -ENODEV ; + goto exit; }if (read_idx ==-1 ) {// Can this happen ??? -return 0 ; + retval =0 ; + goto exit; } } } offset = read_idx * (dev->report_size +1 );if (copy_to_user (buffer, dev->read_queue + offset, count)) { -return -EFAULT ; + retval = -EFAULT ; + goto exit; } }while (atomic_read (&dev->overflow_flag)); read_idx = ++read_idx ==MAX_INTERRUPT_BUFFER ?0 : read_idx;atomic_set (&dev->read_idx, read_idx); +mutex_unlock (&dev->mutex);return count; + +exit: +mutex_unlock (&dev->mutex); +return retval; }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 233/459 usb: yurex: make waiting on yurex_write interruptible
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit e0aa9614ab0fd35b404e4b16ebe879f9fc152591 ]
The IO yurex_write() needs to wait for in order to have a device ready for writing again can take a long time time. Consequently the sleep is done in an interruptible state. Therefore others waiting for yurex_write() itself to finish should use mutex_lock_interruptible.
Rule: add
--- drivers/usb/misc/iowarrior.c | 4 ---- drivers/usb/misc/yurex.c | 5 ++++- 2 files changed, 4 insertions(+), 5 deletions(-)
drivers/usb/misc/iowarrior.c +0 -4
@@ -915,7 +915,6 @@ static int iowarrior_probe(struct usb_interface *interface,static void iowarrior_disconnect (struct usb_interface *interface) {struct iowarrior *dev =usb_get_intfdata (interface); -int minor = dev->minor;usb_deregister_dev (interface, &iowarrior_class);
@@ -939,9 +938,6 @@ static void iowarrior_disconnect(struct usb_interface *interface)mutex_unlock (&dev->mutex);iowarrior_delete (dev); } - -dev_info (&interface->dev,"I/O-Warror #%d now disconnected\n" , - minor -IOWARRIOR_MINOR_BASE ); }/* usb specific object needed to register this driver with the usb subsystem */
drivers/usb/misc/yurex.c +4 -1
@@ -440,7 +440,10 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,if (count ==0 ) goto error; -mutex_lock (&dev->io_mutex); + retval =mutex_lock_interruptible (&dev->io_mutex); +if (retval <0 ) +return -EINTR ; +if (dev->disconnected) {/* already disconnected */ mutex_unlock (&dev->io_mutex); retval = -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 234/459 USB: chaoskey: fail open after removal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 422dc0a4d12d0b80dd3aab3fe5943f665ba8f041 ]
chaoskey_open() takes the lock only to increase the counter of openings. That means that the mutual exclusion with chaoskey_disconnect() cannot prevent an increase of the counter and chaoskey_open() returning a success.
If that race is hit, chaoskey_disconnect() will happily free all resources associated with the device after it has dropped the lock, as it has read the counter as zero.
To prevent this race chaoskey_open() has to check the presence of the device under the lock. However, the current per device lock cannot be used, because it is a part of the data structure to be freed. Hence an additional global mutex is needed. The issue is as old as the driver.
Rule: add
--- drivers/usb/misc/chaoskey.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-)
drivers/usb/misc/chaoskey.c +24 -11
@@ -27,6 +27,8 @@ static struct usb_class_driver chaoskey_class;static int chaoskey_rng_read (struct hwrng *rng,void *data,size_t max,bool wait); +static DEFINE_MUTEX (chaoskey_list_lock); + #define usb_dbg(usb_if, format, arg...) \ dev_dbg(&(usb_if)->dev, format, ## arg)
@@ -231,6 +233,7 @@ static void chaoskey_disconnect(struct usb_interface *interface)if (dev->hwrng_registered)hwrng_unregister (&dev->hwrng); +mutex_lock (&chaoskey_list_lock);usb_deregister_dev (interface, &chaoskey_class);usb_set_intfdata (interface,NULL );
@@ -245,6 +248,7 @@ static void chaoskey_disconnect(struct usb_interface *interface) }else mutex_unlock (&dev->lock); +mutex_unlock (&chaoskey_list_lock);usb_dbg (interface,"disconnect done" ); }
@@ -252,6 +256,7 @@ static int chaoskey_open(struct inode *inode, struct file *file) {struct chaoskey *dev;struct usb_interface *interface; +int rv =0 ;/* get the interface from minor number and driver information */ interface =usb_find_interface (&chaoskey_driver,iminor (inode));
@@ -267,18 +272,23 @@ static int chaoskey_open(struct inode *inode, struct file *file) } file->private_data = dev; +mutex_lock (&chaoskey_list_lock);mutex_lock (&dev->lock); - ++dev->open; +if (dev->present) + ++dev->open; +else + rv = -ENODEV ;mutex_unlock (&dev->lock); +mutex_unlock (&chaoskey_list_lock); -usb_dbg (interface,"open success" ); -return 0 ; +return rv; }static int chaoskey_release (struct inode *inode,struct file *file) {struct chaoskey *dev = file->private_data;struct usb_interface *interface; +int rv =0 ;if (dev ==NULL )return -ENODEV ;
@@ -287,14 +297,15 @@ static int chaoskey_release(struct inode *inode, struct file *file)usb_dbg (interface,"release" ); +mutex_lock (&chaoskey_list_lock);mutex_lock (&dev->lock);usb_dbg (interface,"open count at release is %d" , dev->open);if (dev->open <=0 ) {usb_dbg (interface,"invalid open count (%d)" , dev->open); -mutex_unlock (&dev->lock); -return -ENODEV ; + rv = -ENODEV ; + goto bail; } --dev->open;
@@ -303,13 +314,15 @@ static int chaoskey_release(struct inode *inode, struct file *file)if (dev->open ==0 ) {mutex_unlock (&dev->lock);chaoskey_free (dev); - }else -mutex_unlock (&dev->lock); - }else -mutex_unlock (&dev->lock); - + goto destruction; + } + } +bail: +mutex_unlock (&dev->lock); +destruction: +mutex_lock (&chaoskey_list_lock);usb_dbg (interface,"release success" ); -return 0 ; +return rv; }static void chaos_read_callback (struct urb *urb)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 235/459 USB: chaoskey: Fix possible deadlock chaoskey_list_lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d73dc7b182be4238b75278bfae16afb4c5564a58 ]
[Syzbot reported two possible deadlocks]
The first possible deadlock is:
WARNING: possible recursive locking detected
6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted
--------------------------------------------
syz-executor363/2651 is trying to acquire lock:ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x15d/0x2c0 drivers/usb/misc/chaoskey.c:322
but task is already holding lock:ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x7f/0x2c0 drivers/usb/misc/chaoskey.c:299
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(chaoskey_list_lock);
lock(chaoskey_list_lock);
*** DEADLOCK ***
The second possible deadlock is:
WARNING: possible circular locking dependency detected 6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted
------------------------------------------------------
kworker/0:2/804 is trying to acquire lock:ffffffff899dadb0 (minor_rwsem){++++}-{3:3}, at: usb_deregister_dev+0x7c/0x1e0 drivers/usb/core/file.c:186
but task is already holding lock:ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_disconnect+0xa8/0x2a0 drivers/usb/misc/chaoskey.c:235
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (chaoskey_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
chaoskey_open+0xdd/0x220 drivers/usb/misc/chaoskey.c:274
usb_open+0x186/0x220 drivers/usb/core/file.c:47
chrdev_open+0x237/0x6a0 fs/char_dev.c:414
do_dentry_open+0x6cb/0x1390 fs/open.c:958
vfs_open+0x82/0x3f0 fs/open.c:1088
do_open fs/namei.c:3774 [inline]
path_openat+0x1e6a/0x2d60 fs/namei.c:3933
do_filp_open+0x1dc/0x430 fs/namei.c:3960
do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #0 (minor_rwsem){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
down_write+0x93/0x200 kernel/locking/rwsem.c:1577
usb_deregister_dev+0x7c/0x1e0 drivers/usb/core/file.c:186
chaoskey_disconnect+0xb7/0x2a0 drivers/usb/misc/chaoskey.c:236
usb_unbind_interface+0x1e8/0x970 drivers/usb/core/driver.c:461
device_remove drivers/base/dd.c:569 [inline]
device_remove+0x122/0x170 drivers/base/dd.c:561
__device_release_driver drivers/base/dd.c:1273 [inline]
device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1296
bus_remove_device+0x22f/0x420 drivers/base/bus.c:576
device_del+0x396/0x9f0 drivers/base/core.c:3864
usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1418
usb_disconnect+0x2e1/0x920 drivers/usb/core/hub.c:2304
hub_port_connect drivers/usb/core/hub.c:5361 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
port_event drivers/usb/core/hub.c:5821 [inline]
hub_event+0x1bed/0x4f40 drivers/usb/core/hub.c:5903
process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(chaoskey_list_lock);
lock(minor_rwsem);
lock(chaoskey_list_lock); lock(minor_rwsem);
*** DEADLOCK ***
[Analysis]
The first is AA lock, it because wrong logic, it need a unlock. The second is AB lock, it needs to rearrange the order of lock usage.
--- drivers/usb/misc/chaoskey.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/misc/chaoskey.c +2 -2
@@ -233,10 +233,10 @@ static void chaoskey_disconnect(struct usb_interface *interface)if (dev->hwrng_registered)hwrng_unregister (&dev->hwrng); -mutex_lock (&chaoskey_list_lock);usb_deregister_dev (interface, &chaoskey_class);usb_set_intfdata (interface,NULL ); +mutex_lock (&chaoskey_list_lock);mutex_lock (&dev->lock); dev->present = false;
@@ -320,7 +320,7 @@ static int chaoskey_release(struct inode *inode, struct file *file) bail:mutex_unlock (&dev->lock); destruction: -mutex_lock (&chaoskey_list_lock); +mutex_unlock (&chaoskey_list_lock);usb_dbg (interface,"release success" );return rv; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 236/459 misc: apds990x: Fix missing pm_runtime_disable()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 3c5d8b819d27012264edd17e6ae7fffda382fe44 ]
The pm_runtime_disable() is missing in probe error path, so add it to fix it.
--- drivers/misc/apds990x.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/misc/apds990x.c +7 -5
@@ -1148,7 +1148,7 @@ static int apds990x_probe(struct i2c_client *client, err = chip->pdata->setup_resources ();if (err) { err = -EINVAL ; - goto fail3; + goto fail4; } }
@@ -1156,7 +1156,7 @@ static int apds990x_probe(struct i2c_client *client, apds990x_attribute_group);if (err <0 ) {dev_err (&chip->client->dev,"Sysfs registration failed\n" ); - goto fail4; + goto fail5; } err = request_threaded_irq(client->irq, NULL,
@@ -1167,15 +1167,17 @@ static int apds990x_probe(struct i2c_client *client,if (err) {dev_err (&client->dev,"could not get IRQ %d\n" , client->irq); - goto fail5; + goto fail6; }return err; -fail5: +fail6:sysfs_remove_group (&chip->client->dev.kobj, &apds990x_attribute_group[0 ]); -fail4: +fail5:if (chip->pdata && chip->pdata->release_resources) chip->pdata->release_resources (); +fail4: +pm_runtime_disable (&client->dev); fail3:regulator_bulk_disable (ARRAY_SIZE (chip->regs), chip->regs); fail2:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 237/459 staging: greybus: uart: clean up TIOCGSERIAL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit d38be702452137fa82a56ff7cc577d829add1637 ]
TIOCSSERIAL is a horrid, underspecified, legacy interface which for most serial devices is only useful for setting the close_delay and closing_wait parameters.
The xmit_fifo_size parameter could be used to set the hardware transmit fifo size of a legacy UART when it could not be detected, but the interface is limited to eight bits and should be left unset when not used.
Similarly, baud_base could be used to set the UART base clock when it could not be detected but might as well be left unset when it is not known.
The type parameter could be used to set the UART type, but is better left unspecified (type unknown) when it isn't used.
Note that some applications have historically expected TIOCGSERIAL to be implemented, but judging from the Debian sources, the port type not being PORT_UNKNOWN is only used to check for the existence of legacy serial ports (ttySn). Notably USB serial drivers like ftdi_sio have been using PORT_UNKNOWN for twenty years without any problems.
Drop the bogus values provided by the greybus implementation.
Stable-dep-of: fe0ebeafc3b7 ("staging: greybus: uart: Fix atomicity violation in get_serial_info()")
--- drivers/staging/greybus/uart.c | 3 --- 1 file changed, 3 deletions(-)
drivers/staging/greybus/uart.c +0 -3
@@ -610,10 +610,7 @@ static int get_serial_info(struct tty_struct *tty, {struct gb_tty *gb_tty = tty->driver_data; - ss->type =PORT_16550A ; ss->line = gb_tty->minor; - ss->xmit_fifo_size =16 ; - ss->baud_base =9600 ; ss->close_delay =jiffies_to_msecs (gb_tty->port.close_delay) /10 ; ss->closing_wait = gb_tty->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 238/459 ALSA: hda/realtek - Add type for ALC287
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit 99cee034c28947fc122799b0b7714e01b047f3f3 ]
Add independent type for ALC287.
Stable-dep-of: cc3d0b5dd989 ("ALSA: hda/realtek: Update ALC256 depop procedure")
--- sound/pci/hda/patch_realtek.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +8 -1
@@ -3168,6 +3168,7 @@ enum {ALC269_TYPE_ALC257 ,ALC269_TYPE_ALC215 ,ALC269_TYPE_ALC225 , +ALC269_TYPE_ALC287 ,ALC269_TYPE_ALC294 ,ALC269_TYPE_ALC300 , ALC269_TYPE_ALC623,
@@ -3204,6 +3205,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)case ALC269_TYPE_ALC257 :case ALC269_TYPE_ALC215 :case ALC269_TYPE_ALC225 : +case ALC269_TYPE_ALC287 :case ALC269_TYPE_ALC294 :case ALC269_TYPE_ALC300 :case ALC269_TYPE_ALC623 :
@@ -10250,7 +10252,6 @@ static int patch_alc269(struct hda_codec *codec)case 0x10ec0215 :case 0x10ec0245 :case 0x10ec0285 : -case 0x10ec0287 :case 0x10ec0289 : spec->codec_variant =ALC269_TYPE_ALC215 ; spec->shutup = alc225_shutup;
@@ -10265,6 +10266,12 @@ static int patch_alc269(struct hda_codec *codec) spec->init_hook = alc225_init; spec->gen.mixer_nid =0 ;/* no loopback on ALC225, ALC295 and ALC299 */ break ; +case 0x10ec0287 : + spec->codec_variant =ALC269_TYPE_ALC287 ; + spec->shutup = alc225_shutup; + spec->init_hook = alc225_init; + spec->gen.mixer_nid =0 ;/* no loopback on ALC287 */ +break ;case 0x10ec0234 :case 0x10ec0274 :case 0x10ec0294 :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 239/459 ALSA: hda/realtek: Update ALC256 depop procedure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit cc3d0b5dd989d3238d456f9fd385946379a9c13d ]
Old procedure has a chance to meet Headphone no output.
--- sound/pci/hda/patch_realtek.c | 42 ++++++++++++++++------------------- 1 file changed, 19 insertions(+), 23 deletions(-)
sound/pci/hda/patch_realtek.c +19 -23
@@ -3596,25 +3596,22 @@ static void alc256_init(struct hda_codec *codec) hp_pin_sense =snd_hda_jack_detect (codec, hp_pin); -if (hp_pin_sense) +if (hp_pin_sense) {msleep (2 ); +alc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x1 );/* Low power */ -alc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x1 );/* Low power */ - -snd_hda_codec_write (codec, hp_pin,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); - -if (hp_pin_sense || spec->ultra_low_power) -msleep (85 ); - -snd_hda_codec_write (codec, hp_pin,0 , +snd_hda_codec_write (codec, hp_pin,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); -if (hp_pin_sense || spec->ultra_low_power) -msleep (100 ); +msleep (75 ); + +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE ); +msleep (75 ); +alc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x4 );/* Hight power */ + }alc_update_coef_idx (codec,0x46 ,3 <<12 ,0 ); -alc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x4 );/* Hight power */ alc_update_coefex_idx (codec,0x53 ,0x02 ,0x8000 ,1 <<15 );/* Clear bit */ alc_update_coefex_idx (codec,0x53 ,0x02 ,0x8000 ,0 <<15 );/*
@@ -3638,29 +3635,28 @@ static void alc256_shutup(struct hda_codec *codec)alc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x1 );/* Low power */ hp_pin_sense =snd_hda_jack_detect (codec, hp_pin); -if (hp_pin_sense) +if (hp_pin_sense) {msleep (2 ); -snd_hda_codec_write (codec, hp_pin,0 , +snd_hda_codec_write (codec, hp_pin,0 ,AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); -if (hp_pin_sense || spec->ultra_low_power) -msleep (85 ); +msleep (75 );/* 3k pull low control for Headset jack. */ /* NOTE: call this before clearing the pin, otherwise codec stalls */ /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly * when booting with headset plugged. So skip setting it for the codec alc257 */ -if (spec->en_3kpull_low) -alc_update_coef_idx (codec,0x46 ,0 ,3 <<12 ); +if (spec->en_3kpull_low) +alc_update_coef_idx (codec,0x46 ,0 ,3 <<12 ); -if (!spec->no_shutup_pins) -snd_hda_codec_write (codec, hp_pin,0 , +if (!spec->no_shutup_pins) +snd_hda_codec_write (codec, hp_pin,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); -if (hp_pin_sense || spec->ultra_low_power) -msleep (100 ); +msleep (75 ); + }alc_auto_setup_eapd (codec, false);alc_shutup_pins (codec);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 240/459 apparmor: fix Do simple duplicate message elimination
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: chao liu <[email protected]>
[ Upstream commit 9b897132424fe76bf6c61f22f9cf12af7f1d1e6a ]
Multiple profiles shared 'ent->caps', so some logs missed.
--- security/apparmor/capability.c | 2 ++ 1 file changed, 2 insertions(+)
security/apparmor/capability.c +2 -0
@@ -94,6 +94,8 @@ static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile,return error; }else {aa_put_profile (ent->profile); +if (profile != ent->profile) +cap_clear (ent->caps); ent->profile =aa_get_profile (profile);cap_raise (ent->caps, cap); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 241/459 xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiu-ji Chen <[email protected]>
commit afc545da381ba0c651b2658966ac737032676f01 upstream.
This patch fixes an issue in the function xenbus_dev_probe(). In the xenbus_dev_probe() function, within the if (err) branch at line 313, the program incorrectly returns err directly without releasing the resources allocated by err = drv->probe(dev, id). As the return value is non-zero, the upper layers assume the processing logic has failed. However, the probe operation was performed earlier without a corresponding remove operation. Since the probe actually allocates resources, failing to perform the remove operation could lead to problems.
To fix this issue, we followed the resource release logic of the xenbus_dev_remove() function by adding a new block fail_remove before the fail_put block. After entering the branch if (err) at line 313, the function will use a goto statement to jump to the fail_remove block, ensuring that the previously acquired resources are correctly released, thus preventing the reference count leak.
This bug was identified by an experimental static analysis tool developed by our team. The tool specializes in analyzing reference count operations and detecting potential issues where resources are not properly managed. In this case, the tool flagged the missing release operation as a potential problem, which led to the development of this patch.
Message-ID: <[email protected]>
--- drivers/xen/xenbus/xenbus_probe.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/xen/xenbus/xenbus_probe.c +7 -1
@@ -250,10 +250,16 @@ int xenbus_dev_probe(struct device *_devif (err) {dev_warn (&dev->dev,"watch_otherend on %s failed.\n" , dev->nodename); -return err; + goto fail_remove; }return 0 ; +fail_remove: +if (drv->remove) { +down (&dev->reclaim_sem); + drv->remove (dev); +up (&dev->reclaim_sem); + } fail_put:module_put (drv->driver.owner); fail:
Greg Kroah-Hartman
maintainerPATCH 242/459 usb: ehci-spear: fix call balance of sehci clk handling routines
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitalii Mordan <[email protected]>
commit 40c974826734836402abfd44efbf04f63a2cc1c1 upstream.
If the clock sehci->clk was not enabled in spear_ehci_hcd_drv_probe, it should not be disabled in any path.
Conversely, if it was enabled in spear_ehci_hcd_drv_probe, it must be disabled in all error paths to ensure proper cleanup.
Found by Linux Verification Center (linuxtesting.org) with Klever.
--- drivers/usb/host/ehci-spear.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/host/ehci-spear.c +4 -3
@@ -108,7 +108,9 @@ static int spear_ehci_hcd_drv_probe(stru/* registers start at offset 0x0 */ hcd_to_ehci (hcd)->caps = hcd->regs; -clk_prepare_enable (sehci->clk); + retval =clk_prepare_enable (sehci->clk); +if (retval) + goto err_put_hcd; retval =usb_add_hcd (hcd, irq,IRQF_SHARED );if (retval) goto err_stop_ehci;
@@ -133,8 +135,7 @@ static int spear_ehci_hcd_drv_remove(strusb_remove_hcd (hcd); -if (sehci->clk) -clk_disable_unprepare (sehci->clk); +clk_disable_unprepare (sehci->clk);usb_put_hcd (hcd);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 243/459 soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Mylavarapu <[email protected]>
commit 128fdbf36cddc2a901c4889ba1c89fa9f2643f2c upstream.
In success case, the revision holds a non-null pointer. The current logic incorrectly returns an error for a non-null pointer, whereas it should return an error for a null pointer.
The socinfo driver for IPQ9574 and IPQ5332 is currently broken, resulting in the following error message
qcom-socinfo qcom-socinfo: probe with driver qcom-socinfo failed with error -12
Add a null check for the revision to ensure it returns an error only in failure case (null pointer).
--- drivers/soc/qcom/socinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/socinfo.c +1 -1
@@ -507,7 +507,7 @@ static int qcom_socinfo_probe(struct pla qs->attr.revision =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%u.%u" ,SOCINFO_MAJOR (le32_to_cpu (info->ver)),SOCINFO_MINOR (le32_to_cpu (info->ver))); -if (!qs->attr.soc_id || qs->attr.revision) +if (!qs->attr.soc_id || !qs->attr.revision)return -ENOMEM ;if (offsetof(struct socinfo , serial_num) <= item_size) {
Greg Kroah-Hartman
maintainerPATCH 244/459 ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Sevens <[email protected]>
commit b909df18ce2a998afef81d58bbd1a05dc0788c40 upstream.
A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config.
This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.
--- sound/usb/quirks.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
sound/usb/quirks.c +14 -5
@@ -595,6 +595,7 @@ int snd_usb_create_quirk(struct snd_usb_static int snd_usb_extigy_boot_quirk (struct usb_device *dev,struct usb_interface *intf) {struct usb_host_config *config = dev->actconfig; +struct usb_device_descriptor new_device_descriptor;int err; if (le16_to_cpu(get_cfg_desc(config)->wTotalLength) == EXTIGY_FIRMWARE_SIZE_OLD ||
@@ -606,10 +607,14 @@ static int snd_usb_extigy_boot_quirk(strif (err <0 )dev_dbg (&dev->dev,"error sending boot message: %d\n" , err); err =usb_get_descriptor (dev,USB_DT_DEVICE ,0 , - &dev->descriptor,sizeof (dev->descriptor)); - config = dev->actconfig; + &new_device_descriptor,sizeof (new_device_descriptor));if (err <0 )dev_dbg (&dev->dev,"error usb_get_descriptor: %d\n" , err); +if (new_device_descriptor.bNumConfigurations > dev->descriptor.bNumConfigurations) +dev_dbg (&dev->dev,"error too large bNumConfigurations: %d\n" , + new_device_descriptor.bNumConfigurations); +else +memcpy (&dev->descriptor, &new_device_descriptor,sizeof (dev->descriptor)); err =usb_reset_configuration (dev);if (err <0 )dev_dbg (&dev->dev,"error usb_reset_configuration: %d\n" , err);
@@ -941,6 +946,7 @@ static void mbox2_setup_48_24_magic(strustatic int snd_usb_mbox2_boot_quirk (struct usb_device *dev) {struct usb_host_config *config = dev->actconfig; +struct usb_device_descriptor new_device_descriptor;int err;u8 bootresponse[0x12 ];int fwsize;
@@ -976,10 +982,14 @@ static int snd_usb_mbox2_boot_quirk(strudev_dbg (&dev->dev,"device initialised!\n" ); err =usb_get_descriptor (dev,USB_DT_DEVICE ,0 , - &dev->descriptor,sizeof (dev->descriptor)); - config = dev->actconfig; + &new_device_descriptor,sizeof (new_device_descriptor));if (err <0 )dev_dbg (&dev->dev,"error usb_get_descriptor: %d\n" , err); +if (new_device_descriptor.bNumConfigurations > dev->descriptor.bNumConfigurations) +dev_dbg (&dev->dev,"error too large bNumConfigurations: %d\n" , + new_device_descriptor.bNumConfigurations); +else +memcpy (&dev->descriptor, &new_device_descriptor,sizeof (dev->descriptor)); err =usb_reset_configuration (dev);if (err <0 )
@@ -1024,7 +1034,6 @@ static int snd_usb_axefx3_boot_quirk(strreturn 0 ; } -#define MICROBOOK_BUF_SIZE 128 static int snd_usb_motu_microbookii_communicate(struct usb_device *dev, u8 *buf,
Greg Kroah-Hartman
maintainerPATCH 245/459 ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit 902cc179c931a033cd7f4242353aa2733bf8524c upstream.
find_group_other() and find_group_orlov() read *_lo, *_hi with ext4_free_inodes_count without additional locking. This can cause data-race warning, but since the lock is held for most writes and free inodes value is generally not a problem even if it is incorrect, it is more appropriate to use READ_ONCE()/WRITE_ONCE() than to add locking.
==================================================================
BUG: KCSAN: data-race in ext4_free_inodes_count / ext4_free_inodes_set
write to 0xffff88810404300e of 2 bytes by task 6254 on cpu 1:
ext4_free_inodes_set+0x1f/0x80 fs/ext4/super.c:405 __ext4_new_inode+0x15ca/0x2200 fs/ext4/ialloc.c:1216 ext4_symlink+0x242/0x5a0 fs/ext4/namei.c:3391 vfs_symlink+0xca/0x1d0 fs/namei.c:4615 do_symlinkat+0xe3/0x340 fs/namei.c:4641 __do_sys_symlinkat fs/namei.c:4657 [inline] __se_sys_symlinkat fs/namei.c:4654 [inline] __x64_sys_symlinkat+0x5e/0x70 fs/namei.c:4654 x64_sys_call+0x1dda/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:267 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e
read to 0xffff88810404300e of 2 bytes by task 6257 on cpu 0:
ext4_free_inodes_count+0x1c/0x80 fs/ext4/super.c:349 find_group_other fs/ext4/ialloc.c:594 [inline] __ext4_new_inode+0x6ec/0x2200 fs/ext4/ialloc.c:1017 ext4_symlink+0x242/0x5a0 fs/ext4/namei.c:3391 vfs_symlink+0xca/0x1d0 fs/namei.c:4615 do_symlinkat+0xe3/0x340 fs/namei.c:4641 __do_sys_symlinkat fs/namei.c:4657 [inline] __se_sys_symlinkat fs/namei.c:4654 [inline] __x64_sys_symlinkat+0x5e/0x70 fs/namei.c:4654 x64_sys_call+0x1dda/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:267 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- fs/ext4/super.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/ext4/super.c +4 -4
@@ -322,9 +322,9 @@ __u32 ext4_free_group_clusters(struct su__u32 ext4_free_inodes_count (struct super_block *sb,struct ext4_group_desc *bg) { -return le16_to_cpu (bg->bg_free_inodes_count_lo) | +return le16_to_cpu (READ_ONCE (bg->bg_free_inodes_count_lo)) | (EXT4_DESC_SIZE (sb) >=EXT4_MIN_DESC_SIZE_64BIT ? - (__u32 )le16_to_cpu (bg->bg_free_inodes_count_hi) <<16 :0 ); + (__u32 )le16_to_cpu (READ_ONCE (bg->bg_free_inodes_count_hi)) <<16 :0 ); } __u32 ext4_used_dirs_count(struct super_block *sb,
@@ -378,9 +378,9 @@ void ext4_free_group_clusters_set(structvoid ext4_free_inodes_set (struct super_block *sb,struct ext4_group_desc *bg,__u32 count) { - bg->bg_free_inodes_count_lo =cpu_to_le16 ((__u16 )count); +WRITE_ONCE (bg->bg_free_inodes_count_lo,cpu_to_le16 ((__u16 )count));if (EXT4_DESC_SIZE (sb) >=EXT4_MIN_DESC_SIZE_64BIT ) - bg->bg_free_inodes_count_hi =cpu_to_le16 (count >>16 ); +WRITE_ONCE (bg->bg_free_inodes_count_hi,cpu_to_le16 (count >>16 )); } void ext4_used_dirs_set(struct super_block *sb,
Greg Kroah-Hartman
maintainerPATCH 246/459 ext4: fix FS_IOC_GETFSMAP handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 4a622e4d477bb12ad5ed4abbc7ad1365de1fa347 upstream.
The original implementation ext4's FS_IOC_GETFSMAP handling only worked when the range of queried blocks included at least one free (unallocated) block range. This is because how the metadata blocks were emitted was as a side effect of ext4_mballoc_query_range() calling ext4_getfsmap_datadev_helper(), and that function was only called when a free block range was identified. As a result, this caused generic/365 to fail.
Fix this by creating a new function ext4_getfsmap_meta_helper() which gets called so that blocks before the first free block range in a block group can get properly reported.
--- fs/ext4/fsmap.c | 54 +++++++++++++++++++++++++++++++++++++++++++++++++++++- fs/ext4/mballoc.c | 18 ++++++++++++++---- fs/ext4/mballoc.h | 1 + 3 files changed, 68 insertions(+), 5 deletions(-)
fs/ext4/fsmap.c +53 -1
@@ -185,6 +185,56 @@ static inline ext4_fsblk_t ext4_fsmap_nereturn fmr->fmr_physical + fmr->fmr_length; } +static int ext4_getfsmap_meta_helper (struct super_block *sb, +ext4_group_t agno,ext4_grpblk_t start, +ext4_grpblk_t len,void *priv) +{ +struct ext4_getfsmap_info *info = priv; +struct ext4_fsmap *p; +struct ext4_fsmap *tmp; +struct ext4_sb_info *sbi =EXT4_SB (sb); +ext4_fsblk_t fsb, fs_start, fs_end; +int error; + + fs_start = fsb = (EXT4_C2B (sbi, start) + +ext4_group_first_block_no (sb, agno)); + fs_end = fs_start +EXT4_C2B (sbi, len); + +/* Return relevant extents from the meta_list */ +list_for_each_entry_safe (p, tmp, &info->gfi_meta_list, fmr_list) { +if (p->fmr_physical < info->gfi_next_fsblk) { +list_del (&p->fmr_list); +kfree (p); +continue ; + } +if (p->fmr_physical <= fs_start || + p->fmr_physical + p->fmr_length <= fs_end) { +/* Emit the retained free extent record if present */ +if (info->gfi_lastfree.fmr_owner) { + error =ext4_getfsmap_helper (sb, info, + &info->gfi_lastfree); +if (error) +return error; + info->gfi_lastfree.fmr_owner =0 ; + } + error =ext4_getfsmap_helper (sb, info, p); +if (error) +return error; + fsb = p->fmr_physical + p->fmr_length; +if (info->gfi_next_fsblk < fsb) + info->gfi_next_fsblk = fsb; +list_del (&p->fmr_list); +kfree (p); +continue ; + } + } +if (info->gfi_next_fsblk < fsb) + info->gfi_next_fsblk = fsb; + +return 0 ; +} + +/* Transform a blockgroup's free record into a fsmap */ static int ext4_getfsmap_datadev_helper(struct super_block *sb, ext4_group_t agno, ext4_grpblk_t start,
@@ -539,6 +589,7 @@ static int ext4_getfsmap_datadev(struct error =ext4_mballoc_query_range (sb, info->gfi_agno,EXT4_B2C (sbi, info->gfi_low.fmr_physical),EXT4_B2C (sbi, info->gfi_high.fmr_physical), + ext4_getfsmap_meta_helper, ext4_getfsmap_datadev_helper, info);if (error) goto err;
@@ -560,7 +611,8 @@ static int ext4_getfsmap_datadev(struct/* Report any gaps at the end of the bg */ info->gfi_last = true; - error =ext4_getfsmap_datadev_helper (sb, end_ag, last_cluster,0 , info); + error =ext4_getfsmap_datadev_helper (sb, end_ag, last_cluster +1 , +0 , info);if (error) goto err;
fs/ext4/mballoc.c +14 -4
@@ -6162,13 +6162,14 @@ intext4_mballoc_query_range ( struct super_block *sb, ext4_group_t group, - ext4_grpblk_t start, + ext4_grpblk_t first, ext4_grpblk_t end, + ext4_mballoc_query_range_fn meta_formatter, ext4_mballoc_query_range_fn formatter, void *priv) { void *bitmap; -ext4_grpblk_t next; +ext4_grpblk_t start, next;struct ext4_buddy e4b;int error;
@@ -6179,10 +6180,19 @@ ext4_mballoc_query_range(ext4_lock_group (sb, group); - start =max (e4b.bd_info->bb_first_free, start); + start =max (e4b.bd_info->bb_first_free, first);if (end >=EXT4_CLUSTERS_PER_GROUP (sb)) end =EXT4_CLUSTERS_PER_GROUP (sb) -1 ; - +if (meta_formatter && start != first) { +if (start > end) + start = end; +ext4_unlock_group (sb, group); + error =meta_formatter (sb, group, first, start - first, + priv); +if (error) + goto out_unload; +ext4_lock_group (sb, group); + }while (start <= end) { start =mb_find_next_zero_bit (bitmap, end +1 , start);if (start > end)
fs/ext4/mballoc.h +1 -0
@@ -226,6 +226,7 @@ ext4_mballoc_query_range(ext4_group_t agno, ext4_grpblk_t start, ext4_grpblk_t end, + ext4_mballoc_query_range_fn meta_formatter, ext4_mballoc_query_range_fn formatter, void *priv);
Greg Kroah-Hartman
maintainerPATCH 247/459 jfs: xattr: check invalid xattr size more strictly
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Sadovnikov <[email protected]>
commit d9f9d96136cba8fedd647d2c024342ce090133c2 upstream.
Commit 7c55b78818cf ("jfs: xattr: fix buffer overflow for invalid xattr") also addresses this issue but it only fixes it for positive values, while ea_size is an integer type and can take negative values, e.g. in case of a corrupted filesystem. This still breaks validation and would overflow because of implicit conversion from int to size_t in print_hex_dump().
Fix this issue by clamping the ea_size value instead.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- fs/jfs/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jfs/xattr.c +1 -1
@@ -559,7 +559,7 @@ static int ea_get(struct inode *inode, s size_check:if (EALIST_SIZE (ea_buf->xattr) != ea_size) { -int size =min_t (int,EALIST_SIZE (ea_buf->xattr), ea_size); +int size =clamp_t (int, ea_size,0 ,EALIST_SIZE (ea_buf->xattr));printk (KERN_ERR "ea_get: invalid extended attribute\n" ); print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1,
Greg Kroah-Hartman
maintainerPATCH 248/459 ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiu-ji Chen <[email protected]>
commit 1157733344651ca505e259d6554591ff156922fa upstream.
An atomicity violation occurs when the validity of the variables da7219->clk_src and da7219->mclk_rate is being assessed. Since the entire assessment is not protected by a lock, the da7219 variable might still be in flux during the assessment, rendering this check invalid.
To fix this issue, we recommend adding a lock before the block if ((da7219->clk_src == clk_id) && (da7219->mclk_rate == freq)) so that the legitimacy check for da7219->clk_src and da7219->mclk_rate is protected by the lock, ensuring the validity of the check.
This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations.
--- sound/soc/codecs/da7219.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/codecs/da7219.c +6 -3
@@ -1167,17 +1167,20 @@ static int da7219_set_dai_sysclk(structstruct da7219_priv *da7219 =snd_soc_component_get_drvdata (component);int ret =0 ; -if ((da7219->clk_src == clk_id) && (da7219->mclk_rate == freq)) +mutex_lock (&da7219->pll_lock); + +if ((da7219->clk_src == clk_id) && (da7219->mclk_rate == freq)) { +mutex_unlock (&da7219->pll_lock);return 0 ; + }if ((freq <2000000 ) || (freq >54000000 )) { +mutex_unlock (&da7219->pll_lock);dev_err (codec_dai->dev,"Unsupported MCLK value %d\n" , freq);return -EINVAL ; } -mutex_lock (&da7219->pll_lock); -switch (clk_id) {case DA7219_CLKSRC_MCLK_SQR : snd_soc_component_update_bits(component, DA7219_PLL_CTRL,
Greg Kroah-Hartman
maintainerPATCH 249/459 perf/x86/intel/pt: Fix buffer full but size is 0 case
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 5b590160d2cf776b304eb054afafea2bd55e3620 upstream.
If the trace data buffer becomes full, a truncated flag [T] is reported in PERF_RECORD_AUX. In some cases, the size reported is 0, even though data must have been added to make the buffer full.
That happens when the buffer fills up from empty to full before the Intel PT driver has updated the buffer position. Then the driver calculates the new buffer position before calculating the data size. If the old and new positions are the same, the data size is reported as 0, even though it is really the whole buffer size.
Fix by detecting when the buffer position is wrapped, and adjust the data size calculation accordingly.
Example
Use a very small buffer size (8K) and observe the size of truncated [T] data. Before the fix, it is possible to see records of 0 size.
Before:
$ perf record -m,8K -e intel_pt// uname
Linux
[ perf record: Woken up 2 times to write data ]
[ perf record: Captured and wrote 0.105 MB perf.data ]
$ perf script -D --no-itrace | grep AUX | grep -F '[T]'
Warning:
AUX data lost 2 times out of 3! 5 19462712368111 0x19710 [0x40]: PERF_RECORD_AUX offset: 0 size: 0 flags: 0x1 [T]
5 19462712700046 0x19ba8 [0x40]: PERF_RECORD_AUX offset: 0x170 size: 0xe90 flags: 0x1 [T]After:
$ perf record -m,8K -e intel_pt// uname
Linux
[ perf record: Woken up 3 times to write data ]
[ perf record: Captured and wrote 0.040 MB perf.data ]
$ perf script -D --no-itrace | grep AUX | grep -F '[T]'
Warning:
AUX data lost 2 times out of 3! 1 113720802995 0x4948 [0x40]: PERF_RECORD_AUX offset: 0 size: 0x2000 flags: 0x1 [T]
1 113720979812 0x6b10 [0x40]: PERF_RECORD_AUX offset: 0x2000 size: 0x2000 flags: 0x1 [T]--- arch/x86/events/intel/pt.c | 11 ++++++++--- arch/x86/events/intel/pt.h | 2 ++ 2 files changed, 10 insertions(+), 3 deletions(-)
arch/x86/events/intel/pt.c +8 -3
@@ -811,11 +811,13 @@ static void pt_buffer_advance(struct pt_ buf->cur_idx++;if (buf->cur_idx == buf->cur->last) { -if (buf->cur == buf->last) +if (buf->cur == buf->last) { buf->cur = buf->first; -else + buf->wrapped = true; + }else { buf->cur = list_entry(buf->cur->list.next, struct topa, list); + } buf->cur_idx =0 ; } }
@@ -829,8 +831,11 @@ static void pt_buffer_advance(struct pt_static void pt_update_head (struct pt *pt) {struct pt_buffer *buf =perf_get_aux (&pt->handle); +bool wrapped = buf->wrapped;u64 topa_idx, base, old; + buf->wrapped = false; +if (buf->single) {local_set (&buf->data_size, buf->output_off);return ;
@@ -848,7 +853,7 @@ static void pt_update_head(struct pt *pt }else { old = (local64_xchg (&buf->head, base) & ((buf->nr_pages <<PAGE_SHIFT ) -1 )); -if (base < old) +if (base < old || (base == old && wrapped)) base += buf->nr_pages <<PAGE_SHIFT ;local_add (base - old, &buf->data_size);
arch/x86/events/intel/pt.h +2 -0
@@ -65,6 +65,7 @@ struct pt_pmu {* @head: logical write offset inside the buffer * @snapshot: if this is for a snapshot/overwrite counter * @single: use Single Range Output instead of ToPA +* @wrapped: buffer advance wrapped back to the first topa table * @stop_pos: STOP topa entry index * @intr_pos: INT topa entry index * @stop_te: STOP topa entry pointer
@@ -82,6 +83,7 @@ struct pt_buffer {local64_t head;bool snapshot;bool single; +bool wrapped;long stop_pos, intr_pos;struct topa_entry *stop_te, *intr_te;void **data_pages;
Greg Kroah-Hartman
maintainerPATCH 250/459 crypto: x86/aegis128 - access 32-bit arguments as 32-bit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 3b2f2d22fb424e9bebda4dbf6676cbfc7f9f62cd upstream.
Fix the AEGIS assembly code to access 'unsigned int' arguments as 32-bit values instead of 64-bit, since the upper bits of the corresponding 64-bit registers are not guaranteed to be zero.
Note: there haven't been any reports of this bug actually causing incorrect behavior. Neither gcc nor clang guarantee zero-extension to 64 bits, but zero-extension is likely to happen in practice because most instructions that operate on 32-bit registers zero-extend to 64 bits.
--- arch/x86/crypto/aegis128-aesni-asm.S | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-)
arch/x86/crypto/aegis128-aesni-asm.S +15 -14
@@ -20,7 +20,7 @@ #define T1 %xmm7 #define STATEP %rdi -#define LEN %rsi +#define LEN %esi #define SRC %rdx #define DST %rcx
@@ -75,32 +75,32 @@ SYM_FUNC_START_LOCAL(__load_partial) xor %r9d, %r9d pxor MSG, MSG - mov LEN, %r8 + mov LEN, %r8d and $0x1, %r8 jz .Lld_partial_1 - mov LEN, %r8 + mov LEN, %r8d and $0x1E, %r8 add SRC, %r8 mov (%r8), %r9b .Lld_partial_1: - mov LEN, %r8 + mov LEN, %r8d and $0x2, %r8 jz .Lld_partial_2 - mov LEN, %r8 + mov LEN, %r8d and $0x1C, %r8 add SRC, %r8 shl $0x10, %r9 mov (%r8), %r9w .Lld_partial_2: - mov LEN, %r8 + mov LEN, %r8d and $0x4, %r8 jz .Lld_partial_4 - mov LEN, %r8 + mov LEN, %r8d and $0x18, %r8 add SRC, %r8 shl $32, %r9
@@ -110,11 +110,11 @@ SYM_FUNC_START_LOCAL(__load_partial) .Lld_partial_4: movq %r9, MSG - mov LEN, %r8 + mov LEN, %r8d and $0x8, %r8 jz .Lld_partial_8 - mov LEN, %r8 + mov LEN, %r8d and $0x10, %r8 add SRC, %r8 pslldq $8, MSG
@@ -138,7 +138,7 @@ SYM_FUNC_END(__load_partial) * %r10 */ SYM_FUNC_START_LOCAL(__store_partial) - mov LEN, %r8 + mov LEN, %r8d mov DST, %r9 movq T0, %r10
@@ -676,7 +676,7 @@ SYM_FUNC_START(crypto_aegis128_aesni_dec call __store_partial /* mask with byte count: */ - movq LEN, T0 + movd LEN, T0 punpcklbw T0, T0 punpcklbw T0, T0 punpcklbw T0, T0
@@ -701,7 +701,8 @@ SYM_FUNC_END(crypto_aegis128_aesni_dec_t /* * void crypto_aegis128_aesni_final(void *state, void *tag_xor, - * u64 assoclen, u64 cryptlen); + * unsigned int assoclen, + * unsigned int cryptlen); */ SYM_FUNC_START(crypto_aegis128_aesni_final) FRAME_BEGIN
@@ -714,8 +715,8 @@ SYM_FUNC_START(crypto_aegis128_aesni_fin movdqu 0x40(STATEP), STATE4 /* prepare length block: */ - movq %rdx, MSG - movq %rcx, T0 + movd %edx, MSG + movd %ecx, T0 pslldq $8, T0 pxor T0, MSG psllq $3, MSG /* multiply by 8 (to get bit count) */
Greg Kroah-Hartman
maintainerPATCH 251/459 KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghavendra Rao Ananta <[email protected]>
commit 54bbee190d42166209185d89070c58a343bf514b upstream.
DDI0487K.a D13.3.1 describes the PMU overflow condition, which evaluates to true if any counter's global enable (PMCR_EL0.E), overflow flag (PMOVSSET_EL0[n]), and interrupt enable (PMINTENSET_EL1[n]) are all 1. Of note, this does not require a counter to be enabled
(i.e. PMCNTENSET_EL0[n] = 1) to generate an overflow.
Align kvm_pmu_overflow_status() with the reality of the architecture and stop using PMCNTENSET_EL0 as part of the overflow condition. The bug was discovered while running an SBSA PMU test [*], which only sets PMCR.E, PMOVSSET<0>, PMINTENSET<0>, and expects an overflow interrupt.
--- arch/arm64/kvm/pmu-emul.c | 1 - 1 file changed, 1 deletion(-)
arch/arm64/kvm/pmu-emul.c +0 -1
@@ -371,7 +371,6 @@ static u64 kvm_pmu_overflow_status(strucif ((__vcpu_sys_reg (vcpu,PMCR_EL0 ) &ARMV8_PMU_PMCR_E )) { reg =__vcpu_sys_reg (vcpu,PMOVSSET_EL0 ); - reg &=__vcpu_sys_reg (vcpu,PMCNTENSET_EL0 ); reg &=__vcpu_sys_reg (vcpu,PMINTENSET_EL1 ); reg &=kvm_pmu_valid_counter_mask (vcpu); }
Greg Kroah-Hartman
maintainerPATCH 252/459 PCI: Fix use-after-free of slot->bus on hot remove
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit c7acef99642b763ba585f4a43af999fcdbcc3dc4 upstream.
Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock.
Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver.
The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock.
The crash occurs when pciehp is unbound from one of the dock's Downstream
Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus.
In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device().
However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device().
In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free.
One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming.
If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change.
Abridged stacktrace:
pcieport 0000:00:07.0: PME: Signaling with IRQ 156
pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12
pcieport 0000:00:07.0: pciehp: Slot(12): Card not present
...
pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0
Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist
--- drivers/pci/slot.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/slot.c +3 -1
@@ -79,6 +79,7 @@ static void pci_slot_release(struct kobjup_read (&pci_bus_sem);list_del (&slot->list); +pci_bus_put (slot->bus);kfree (slot); }
@@ -260,7 +261,7 @@ placeholder: goto err; } - slot->bus = parent; + slot->bus =pci_bus_get (parent); slot->number = slot_nr; slot->kobj.kset = pci_slots_kset;
@@ -268,6 +269,7 @@ placeholder: slot_name =make_slot_name (name);if (!slot_name) { err = -ENOMEM ; +pci_bus_put (slot->bus);kfree (slot); goto err; }
Greg Kroah-Hartman
maintainerPATCH 253/459 fsnotify: fix sending inotify event with unexpected filename
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit aa52c54da40d9eee3ba87c05cdcb0cd07c04fa13 upstream.
We got a report that adding a fanotify filsystem watch prevents tail -f from receiving events.
Reproducer:
1. Create 3 windows / login sessions. Become root in each session.
2. Choose a mounted filesystem that is pretty quiet; I picked /boot.
3. In the first window, run: fsnotifywait -S -m /boot
4. In the second window, run: echo data >> /boot/foo
5. In the third window, run: tail -f /boot/foo
6. Go back to the second window and run: echo more data >> /boot/foo
7. Observe that the tail command doesn't show the new data.
8. In the first window, hit control-C to interrupt fsnotifywait.
9. In the second window, run: echo still more data >> /boot/foo
10. Observe that the tail command in the third window has now printed the missing data.
When stracing tail, we observed that when fanotify filesystem mark is set, tail does get the inotify event, but the event is receieved with the filename:
read(4, "\1\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0foo\0\0\0\0\0\0\0\0\0\0\0\0\0",
50) = 32
This is unexpected, because tail is watching the file itself and not its parent and is inconsistent with the inotify event received by tail when fanotify filesystem mark is not set:
read(4, "\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0", 50) = 16
The inteference between different fsnotify groups was caused by the fact that the mark on the sb requires the filename, so the filename is passed to fsnotify(). Later on, fsnotify_handle_event() tries to take care of not passing the filename to groups (such as inotify) that are interested in the filename only when the parent is watching.
But the logic was incorrect for the case that no group is watching the parent, some groups are watching the sb and some watching the inode.
--- fs/notify/fsnotify.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
fs/notify/fsnotify.c +13 -10
@@ -310,16 +310,19 @@ static int fsnotify_handle_event(structif (!inode_mark)return 0 ; -if (mask &FS_EVENT_ON_CHILD ) { -/* -* Some events can be sent on both parent dir and child marks -* (e.g. FS_ATTRIB). If both parent dir and child are -* watching, report the event once to parent dir with name (if -* interested) and once to child without name (if interested). -* The child watcher is expecting an event without a file name -* and without the FS_EVENT_ON_CHILD flag. -*/ - mask &= ~FS_EVENT_ON_CHILD ; +/* +* Some events can be sent on both parent dir and child marks (e.g. +* FS_ATTRIB). If both parent dir and child are watching, report the +* event once to parent dir with name (if interested) and once to child +* without name (if interested). +* +* In any case regardless whether the parent is watching or not, the +* child watcher is expecting an event without the FS_EVENT_ON_CHILD +* flag. The file name is expected if and only if this is a directory +* event. +*/ + mask &= ~FS_EVENT_ON_CHILD ; +if (!(mask &ALL_FSNOTIFY_DIRENT_EVENTS )) { dir =NULL ; name =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 254/459 comedi: Flush partial mappings in error case
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit ce8f9fb651fac95dd41f69afe54d935420b945bd upstream.
If some remap_pfn_range() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buffer reference with comedi_buf_map_put(bm). The userspace mappings are only cleaned up later in the mmap error path.
Fix it by explicitly flushing all mappings in our VMA on the error path.
See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in error case").
--- drivers/staging/comedi/comedi_fops.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/staging/comedi/comedi_fops.c +12 -0
@@ -2402,6 +2402,18 @@ static int comedi_mmap(struct file *file start +=PAGE_SIZE ; } + +#ifdef CONFIG_MMU +/* +* Leaving behind a partial mapping of a buffer we're about to +* drop is unsafe, see remap_pfn_range_notrack(). +* We need to zap the range here ourselves instead of relying +* on the automatic zapping in remap_pfn_range() because we call +* remap_pfn_range() in a loop. +*/ +if (retval) +zap_vma_ptes (vma, vma->vm_start, size); +#endif }if (retval ==0 ) {
Greg Kroah-Hartman
maintainerPATCH 255/459 apparmor: test: Fix memory leak for aa_unpack_strdup()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 7290f59231910ccba427d441a6e8b8c6f6112448 upstream.
The string allocated by kmemdup() in aa_unpack_strdup() is not freed and cause following memory leaks, free them to fix it.
unreferenced object 0xffffff80c6af8a50 (size 8): comm "kunit_try_catch", pid 225, jiffies 4294894407 hex dump (first 8 bytes): 74 65 73 74 69 6e 67 00 testing. backtrace (crc 5eab668b): [<0000000001e3714d>] kmemleak_alloc+0x34/0x40 [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0 [<000000006870467c>] kmemdup_noprof+0x34/0x60 [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c [<000000008ecde918>] policy_unpack_test_unpack_strdup_with_null_name+0xf8/0x3ec [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000adf936cf>] kthread+0x2e8/0x374 [<0000000041bb1628>] ret_from_fork+0x10/0x20 unreferenced object 0xffffff80c2a29090 (size 8): comm "kunit_try_catch", pid 227, jiffies 4294894409 hex dump (first 8 bytes): 74 65 73 74 69 6e 67 00 testing. backtrace (crc 5eab668b): [<0000000001e3714d>] kmemleak_alloc+0x34/0x40 [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0 [<000000006870467c>] kmemdup_noprof+0x34/0x60 [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c [<0000000046a45c1a>] policy_unpack_test_unpack_strdup_with_name+0xd0/0x3c4 [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000adf936cf>] kthread+0x2e8/0x374 [<0000000041bb1628>] ret_from_fork+0x10/0x20
--- security/apparmor/policy_unpack_test.c | 6 ++++++ 1 file changed, 6 insertions(+)
security/apparmor/policy_unpack_test.c +6 -0
@@ -283,6 +283,8 @@ static void policy_unpack_test_unpack_st ((uintptr_t )puf->e->start <= (uintptr_t )string) && ((uintptr_t)string <= (uintptr_t)puf->e->end));KUNIT_EXPECT_STREQ (test, string,TEST_STRING_DATA ); + +kfree (string); }static void policy_unpack_test_unpack_strdup_with_name (struct kunit *test)
@@ -298,6 +300,8 @@ static void policy_unpack_test_unpack_st ((uintptr_t )puf->e->start <= (uintptr_t )string) && ((uintptr_t)string <= (uintptr_t)puf->e->end));KUNIT_EXPECT_STREQ (test, string,TEST_STRING_DATA ); + +kfree (string); }static void policy_unpack_test_unpack_strdup_out_of_bounds (struct kunit *test)
@@ -315,6 +319,8 @@ static void policy_unpack_test_unpack_stKUNIT_EXPECT_EQ (test, size,0 );KUNIT_EXPECT_PTR_EQ (test, string, (char *)NULL );KUNIT_EXPECT_PTR_EQ (test, puf->e->pos, start); + +kfree (string); }static void policy_unpack_test_unpack_nameX_with_null_name (struct kunit *test)
Greg Kroah-Hartman
maintainerPATCH 256/459 tty: ldsic: fix tty_ldisc_autoload sysctls proc_handler
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Bouchinet <[email protected]>
commit 635a9fca54f4f4148be1ae1c7c6bd37af80f5773 upstream.
Commit 7c0cca7c847e ("tty: ldisc: add sysctl to prevent autoloading of ldiscs") introduces the tty_ldisc_autoload sysctl with the wrong proc_handler. .extra1 and .extra2 parameters are set to avoid other values thant SYSCTL_ZERO or SYSCTL_ONE to be set but proc_dointvec do not uses them.
This commit fixes this by using proc_dointvec_minmax instead of proc_dointvec.
--- drivers/tty/tty_ldisc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/tty_ldisc.c +1 -1
@@ -856,7 +856,7 @@ static struct ctl_table tty_table[] = { .data = &tty_ldisc_autoload, .maxlen = sizeof(tty_ldisc_autoload), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, .extra2 = SYSCTL_ONE, },
Greg Kroah-Hartman
maintainerPATCH 257/459 locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed Ehab <[email protected]>
commit d7fe143cb115076fed0126ad8cf5ba6c3e575e43 upstream.
Syzbot reports a problem that a warning will be triggered while searching a lock class in look_up_lock_class().
The cause of the issue is that a new name is created and used by lockdep_set_subclass() instead of using the existing one. This results in a lock instance has a different name pointer than previous registered one stored in lock class, and WARN_ONCE() is triggered because of that in look_up_lock_class().
To fix this, change lockdep_set_subclass() to use the existing name instead of a new one. Hence, no new name will be created by lockdep_set_subclass(). Hence, the warning is avoided.
[boqun: Reword the commit log to state the correct issue]
--- include/linux/lockdep.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/lockdep.h +1 -1
@@ -233,7 +233,7 @@ static inline void lockdep_init_map(stru (lock)->dep_map.lock_type)#define lockdep_set_subclass (lock, sub) \ - lockdep_init_map_type(&(lock)->dep_map, #lock, (lock)->dep_map.key, sub,\ + lockdep_init_map_type(&(lock)->dep_map, (lock)->dep_map.name, (lock)->dep_map.key, sub,\ (lock)->dep_map.wait_type_inner, \ (lock)->dep_map.wait_type_outer, \ (lock)->dep_map.lock_type)
Greg Kroah-Hartman
maintainerPATCH 258/459 exfat: fix uninit-value in __exfat_get_dentry_set
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit 02dffe9ab092fc4c8800aee68cb7eafd37a980c4 upstream.
There is no check if stream size and start_clu are invalid. If start_clu is EOF cluster and stream size is 4096, It will cause uninit value access. because ei->hint_femp.eidx could be 128(if cluster size is 4K) and wrong hint will allocate next cluster. and this cluster will be same with the cluster that is allocated by exfat_extend_valid_size(). The previous patch will check invalid start_clu, but for clarity, initialize hint_femp.eidx to zero.
--- fs/exfat/namei.c | 1 + 1 file changed, 1 insertion(+)
fs/exfat/namei.c +1 -0
@@ -356,6 +356,7 @@ static int exfat_find_empty_entry(structif (ei->start_clu ==EXFAT_EOF_CLUSTER ) { ei->start_clu = clu.dir; p_dir->dir = clu.dir; + hint_femp.eidx =0 ; }/* append to the FAT chain */
Greg Kroah-Hartman
maintainerPATCH 259/459 Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrej Shadura <[email protected]>
commit 5fe6caa62b07fd39cd6a28acc8f92ba2955e11a6 upstream.
Commit 9bf4e919ccad worked around an issue introduced after an innocuous optimisation change in LLVM main:
Quoted 11 lines
len is defined as an 'int' because it is assigned from '
__userint *optlen'. However, it is clamped against the result ofsizeof(), which has a type of 'size_t' ('unsigned long' for 64-bit platforms). This is done withmin_t()becausemin()requires compatible types, which results in both len and the result ofsizeof()being casted to 'unsigned int', meaning len changes signs and the result ofsizeof()is truncated. From there, len is passed tocopy_to_user(), which has a third parameter type of 'unsigned long', so it is widened and changes signs again. This excessive casting in combination with the KCSAN instrumentation causes LLVM to fail to eliminate the__bad_copy_from()call, failing the build.
The same issue occurs in rfcomm in functions rfcomm_sock_getsockopt and rfcomm_sock_getsockopt_old.
Change the type of len to size_t in both rfcomm_sock_getsockopt and rfcomm_sock_getsockopt_old and replace min_t() with min().
Improves: 9bf4e919ccad ("Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()")
--- net/bluetooth/rfcomm/sock.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/bluetooth/rfcomm/sock.c +6 -4
@@ -735,7 +735,8 @@ static int rfcomm_sock_getsockopt_old(ststruct sock *l2cap_sk;struct l2cap_conn *conn;struct rfcomm_conninfo cinfo; -int len, err =0 ; +int err =0 ; +size_t len;u32 opt;BT_DBG ("sk %p" , sk);
@@ -789,7 +790,7 @@ static int rfcomm_sock_getsockopt_old(st cinfo.hci_handle = conn->hcon->handle;memcpy (cinfo.dev_class, conn->hcon->dev_class,3 ); - len = min_t(unsigned int, len, sizeof(cinfo)); + len =min (len,sizeof (cinfo));if (copy_to_user (optval, (char *) &cinfo, len)) err = -EFAULT ;
@@ -808,7 +809,8 @@ static int rfcomm_sock_getsockopt(struct {struct sock *sk = sock->sk;struct bt_security sec; -int len, err =0 ; +int err =0 ; +size_t len;BT_DBG ("sk %p" , sk);
@@ -833,7 +835,7 @@ static int rfcomm_sock_getsockopt(struct sec.level =rfcomm_pi (sk)->sec_level; sec.key_size =0 ; - len = min_t(unsigned int, len, sizeof(sec)); + len =min (len,sizeof (sec));if (copy_to_user (optval, (char *) &sec, len)) err = -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 260/459 driver core: bus: Fix double free in driver API bus_register()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
commit bfa54a793ba77ef696755b66f3ac4ed00c7d1248 upstream.
For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, fixed by setting @priv with NULL after the first free.
--- drivers/base/bus.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/base/bus.c +2 -0
@@ -874,6 +874,8 @@ bus_devices_fail:bus_remove_file (bus, &bus_attr_uevent); bus_uevent_fail:kset_unregister (&bus->p->subsys); +/* Above kset_unregister() will kfree @bus->p */ + bus->p =NULL ; out:kfree (bus->p); bus->p =NULL ;
Greg Kroah-Hartman
maintainerPATCH 261/459 Revert "usb: gadget: composite: fix OS descriptors w_value logic"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Vrastil <[email protected]>
commit 51cdd69d6a857f527d6d0697a2e1f0fa8bca1005 upstream.
This reverts commit ec6ce7075ef879b91a8710829016005dc8170f17.
Fix installation of WinUSB driver using OS descriptors. Without the fix the drivers are not installed correctly and the property 'DeviceInterfaceGUID' is missing on host side.
The original change was based on the assumption that the interface number is in the high byte of wValue but it is in the low byte, instead. Unfortunately, the fix is based on MS documentation which is also wrong.
The actual USB request for OS descriptors (using USB analyzer) looks like:
Offset 0 1 2 3 4 5 6 7 0x000 C1 A1 02 00 05 00 0A 00
C1: bmRequestType (device to host, vendor, interface)
A1: nas magic number
0002: wValue (2: nas interface)
0005: wIndex (5: get extended property i.e. nas interface GUID) 008E: wLength (142)
The fix was tested on Windows 10 and Windows 11.
--- drivers/usb/gadget/composite.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/usb/gadget/composite.c +15 -3
@@ -1924,8 +1924,20 @@ unknown:memset (buf,0 , w_length); buf[5 ] =0x01 ;switch (ctrl->bRequestType &USB_RECIP_MASK ) { +/* +* The Microsoft CompatID OS Descriptor Spec(w_index = 0x4) and +* Extended Prop OS Desc Spec(w_index = 0x5) state that the +* HighByte of wValue is the InterfaceNumber and the LowByte is +* the PageNumber. This high/low byte ordering is incorrectly +* documented in the Spec. USB analyzer output on the below +* request packets show the high/low byte inverted i.e LowByte +* is the InterfaceNumber and the HighByte is the PageNumber. +* Since we dont support >64KB CompatID/ExtendedProp descriptors, +* PageNumber is set to 0. Hence verify that the HighByte is 0 +* for below two cases. +*/ case USB_RECIP_DEVICE : -if (w_index !=0x4 || (w_value &0xff )) +if (w_index !=0x4 || (w_value >>8 ))break ; buf[6 ] = w_index;/* Number of ext compat interfaces */
@@ -1941,9 +1953,9 @@ unknown: }break ;case USB_RECIP_INTERFACE : -if (w_index !=0x5 || (w_value &0xff )) +if (w_index !=0x5 || (w_value >>8 ))break ; - interface = w_value >>8 ; + interface = w_value &0xFF ;if (interface >=MAX_CONFIG_INTERFACES || !os_desc_cfg->interface[interface])break ;
Greg Kroah-Hartman
maintainerPATCH 262/459 serial: sh-sci: Clean sci_ports[0] after at earlycon exit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 3791ea69a4858b81e0277f695ca40f5aae40f312 upstream.
The early_console_setup() function initializes the sci_ports[0].port with an object of type struct uart_port obtained from the object of type struct earlycon_device received as argument by the early_console_setup().
It may happen that later, when the rest of the serial ports are probed, the serial port that was used as earlycon (e.g., port A) to be mapped to a different position in sci_ports[] and the slot 0 to be used by a different serial port (e.g., port B), as follows:
sci_ports[0] = port A
sci_ports[X] = port B
In this case, the new port mapped at index zero will have associated data that was used for earlycon.
In case this happens, after Linux boot, any access to the serial port that maps on sci_ports[0] (port A) will block the serial port that was used as earlycon (port B).
To fix this, add early_console_exit() that clean the sci_ports[0] at earlycon exit time.
--- drivers/tty/serial/sh-sci.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/tty/serial/sh-sci.c +28 -0
@@ -3457,6 +3457,32 @@ sh_early_platform_init_buffer("earlyprin#ifdef CONFIG_SERIAL_SH_SCI_EARLYCON static struct plat_sci_port port_cfg__initdata ; +static int early_console_exit (struct console *co) +{ +struct sci_port *sci_port = &sci_ports[0 ]; +struct uart_port *port = &sci_port->port; +unsigned long flags; +int locked =1 ; + +if (port->sysrq) + locked =0 ; +else if (oops_in_progress) + locked =uart_port_trylock_irqsave (port, &flags); +else +uart_port_lock_irqsave (port, &flags); + +/* +* Clean the slot used by earlycon. A new SCI device might +* map to this slot. +*/ +memset (sci_ports,0 ,sizeof (*sci_port)); + +if (locked) +uart_port_unlock_irqrestore (port, flags); + +return 0 ; +} +static int __init early_console_setup (struct earlycon_device *device,int type) {
@@ -3475,6 +3501,8 @@ static int __init early_console_setup(st SCSCR_RE | SCSCR_TE | port_cfg.scscr); device->con->write = serial_console_write; + device->con->exit = early_console_exit; +return 0 ; } static int __init sci_early_console_setup(struct earlycon_device *device,
Greg Kroah-Hartman
maintainerPATCH 263/459 Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 718632467d88e98816fa01ab12681ef1c2aa56f8 upstream.
This reverts commit 3791ea69a4858b81e0277f695ca40f5aae40f312.
It was reported to cause boot-time issues, so revert it for now.
--- drivers/tty/serial/sh-sci.c | 28 ---------------------------- 1 file changed, 28 deletions(-)
drivers/tty/serial/sh-sci.c +0 -28
@@ -3457,32 +3457,6 @@ sh_early_platform_init_buffer("earlyprin#ifdef CONFIG_SERIAL_SH_SCI_EARLYCON static struct plat_sci_port port_cfg__initdata ; -static int early_console_exit (struct console *co) -{ -struct sci_port *sci_port = &sci_ports[0 ]; -struct uart_port *port = &sci_port->port; -unsigned long flags; -int locked =1 ; - -if (port->sysrq) - locked =0 ; -else if (oops_in_progress) - locked =uart_port_trylock_irqsave (port, &flags); -else -uart_port_lock_irqsave (port, &flags); - -/* -* Clean the slot used by earlycon. A new SCI device might -* map to this slot. -*/ -memset (sci_ports,0 ,sizeof (*sci_port)); - -if (locked) -uart_port_unlock_irqrestore (port, flags); - -return 0 ; -} -static int __init early_console_setup (struct earlycon_device *device,int type) {
@@ -3501,8 +3475,6 @@ static int __init early_console_setup(st SCSCR_RE | SCSCR_TE | port_cfg.scscr); device->con->write = serial_console_write; - device->con->exit = early_console_exit; -return 0 ; } static int __init sci_early_console_setup(struct earlycon_device *device,
Greg Kroah-Hartman
maintainerPATCH 264/459 netfilter: ipset: add missing range check in bitmap_ip_uadt
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit 35f56c554eb1b56b77b3cf197a6b00922d49033d upstream.
When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs.
So we should add missing range checks and remove unnecessary range checks.
--- net/netfilter/ipset/ip_set_bitmap_ip.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
net/netfilter/ipset/ip_set_bitmap_ip.c +2 -5
@@ -163,11 +163,8 @@ bitmap_ip_uadt(struct ip_set *set, struc ret =ip_set_get_hostipaddr4 (tb[IPSET_ATTR_IP_TO ], &ip_to);if (ret)return ret; -if (ip > ip_to) { +if (ip > ip_to)swap (ip, ip_to); -if (ip < map->first_ip) -return -IPSET_ERR_BITMAP_RANGE ; - } }else if (tb[IPSET_ATTR_CIDR ]) {u8 cidr =nla_get_u8 (tb[IPSET_ATTR_CIDR ]);
@@ -178,7 +175,7 @@ bitmap_ip_uadt(struct ip_set *set, struc ip_to = ip; } -if (ip_to > map->last_ip) +if (ip < map->first_ip || ip_to > map->last_ip)return -IPSET_ERR_BITMAP_RANGE ;for (; !before (ip_to, ip); ip += map->hosts) {
Greg Kroah-Hartman
maintainerPATCH 265/459 spi: Fix acpi deferred irq probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <[email protected]>
commit d24cfee7f63d6b44d45a67c5662bd1cc48e8b3ca upstream.
When probing spi device take care of deferred probe of ACPI irq gpio similar like for OF/DT case.
Quoted 1 line
From practical standpoint this fixes issue with vsc-tp driver on
Dell XP 9340 laptop, which try to request interrupt with spi->irq equal to -EPROBE_DEFER and fail to probe with the following error:
vsc-tp spi-INTC10D0:00: probe with driver vsc-tp failed with error -22
--- drivers/spi/spi.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/spi/spi.c +10 -3
@@ -397,6 +397,16 @@ static int spi_drv_probe(struct device * spi->irq =0 ; } +if (has_acpi_companion (dev) && spi->irq <0 ) { +struct acpi_device *adev =to_acpi_device_node (dev->fwnode); + + spi->irq =acpi_dev_gpio_irq_get (adev,0 ); +if (spi->irq == -EPROBE_DEFER ) +return -EPROBE_DEFER ; +if (spi->irq <0 ) + spi->irq =0 ; + } + ret =dev_pm_domain_attach (dev, true);if (ret)return ret;
@@ -2249,9 +2259,6 @@ static acpi_status acpi_register_spi_devacpi_set_modalias (adev,acpi_device_hid (adev), spi->modalias,sizeof (spi->modalias)); -if (spi->irq <0 ) - spi->irq =acpi_dev_gpio_irq_get (adev,0 ); -acpi_device_set_enumerated (adev); adev->power.flags.ignore_parent = true;
Greg Kroah-Hartman
maintainerPATCH 266/459 platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 9c41f371457bd9a24874e3c7934d9745e87fbc58 upstream.
The device_for_each_child_node() macro requires explicit calls to fwnode_handle_put() upon early exits (return, break, goto) to decrement the fwnode's refcount, and avoid levaing a node reference behind.
Add the missing fwnode_handle_put() after the common label for all error paths.
--- drivers/platform/chrome/cros_ec_typec.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/chrome/cros_ec_typec.c +1 -0
@@ -294,6 +294,7 @@ static int cros_typec_init_ports(structreturn 0 ; unregister_ports: +fwnode_handle_put (fwnode);cros_unregister_ports (typec);return ret; }
Greg Kroah-Hartman
maintainerPATCH 267/459 ubi: wl: Put source PEB into correct list if trying locking LEB failed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhihao Cheng <[email protected]>
commit d610020f030bec819f42de327c2bd5437d2766b3 upstream.
During wear-leveing work, the source PEB will be moved into scrub list when source LEB cannot be locked in ubi_eba_copy_leb(), which is wrong for non-scrub type source PEB. The problem could bring extra and ineffective wear-leveing jobs, which makes more or less negative effects for the life time of flash. Specifically, the process is divided 2 steps:
1. wear_leveling_worker // generate false scrub type PEB ubi_eba_copy_leb // MOVE_RETRY is returned leb_write_trylock // trylock failed
scrubbing = 1;
e1 is put into ubi->scrub
2. wear_leveling_worker // schedule false scrub type PEB for wl scrubbing = 1
e1 = rb_entry(rb_first(&ubi->scrub))
The problem can be reproduced easily by running fsstress on a small UBIFS partition(<64M, simulated by nandsim) for 5~10mins (CONFIG_MTD_UBI_FASTMAP=y,CONFIG_MTD_UBI_WL_THRESHOLD=50). Following message is shown:
ubi0: scrubbed PEB 66 (LEB 0:10), data moved to PEB 165
Since scrub type source PEB has set variable scrubbing as '1', and variable scrubbing is checked before variable keep, so the problem can be fixed by setting keep variable as 1 directly if the source LEB cannot be locked.
--- drivers/mtd/ubi/wl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/mtd/ubi/wl.c +8 -1
@@ -830,7 +830,14 @@ static int wear_leveling_worker(struct u goto out_not_moved; }if (err ==MOVE_RETRY ) { - scrubbing =1 ; +/* +* For source PEB: +* 1. The scrubbing is set for scrub type PEB, it will +* be put back into ubi->scrub list. +* 2. Non-scrub type PEB will be put back into ubi->used +* list. +*/ + keep =1 ; dst_leb_clean =1 ; goto out_not_moved; }
Greg Kroah-Hartman
maintainerPATCH 268/459 um: ubd: Do not use drvdata in release
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <[email protected]>
commit 5bee35e5389f450a7eea7318deb9073e9414d3b1 upstream.
The drvdata is not available in release. Let's just use container_of() to get the ubd instance. Otherwise, removing a ubd device will result in a crash:
RIP: 0033:blk_mq_free_tag_set+0x1f/0xba RSP: 00000000e2083bf0 EFLAGS: 00010246 RAX: 000000006021463a RBX: 0000000000000348 RCX: 0000000062604d00 RDX: 0000000004208060 RSI: 00000000605241a0 RDI: 0000000000000348 RBP: 00000000e2083c10 R08: 0000000062414010 R09: 00000000601603f7 R10: 000000000000133a R11: 000000006038c4bd R12: 0000000000000000 R13: 0000000060213a5c R14: 0000000062405d20 R15: 00000000604f7aa0 Kernel panic - not syncing: Segfault with no mm CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.8.0-rc3-00107-gba3f67c11638 #1 Workqueue: events mc_work_proc Stack: 00000000 604f7ef0 62c5d000 62405d20 e2083c30 6002c776 6002c755 600e47ff e2083c60 6025ffe3 04208060 603d36e0 Call Trace: [<6002c776>] ubd_device_release+0x21/0x55 [<6002c755>] ? ubd_device_release+0x0/0x55 [<600e47ff>] ? kfree+0x0/0x100 [<6025ffe3>] device_release+0x70/0xba [<60381d6a>] kobject_put+0xb5/0xe2 [<6026027b>] put_device+0x19/0x1c [<6026a036>] platform_device_put+0x26/0x29 [<6026ac5a>] platform_device_unregister+0x2c/0x2e [<6002c52e>] ubd_remove+0xb8/0xd6 [<6002bb74>] ? mconsole_reply+0x0/0x50 [<6002b926>] mconsole_remove+0x160/0x1cc [<6002bbbc>] ? mconsole_reply+0x48/0x50 [<6003379c>] ? um_set_signals+0x3b/0x43 [<60061c55>] ? update_min_vruntime+0x14/0x70 [<6006251f>] ? dequeue_task_fair+0x164/0x235 [<600620aa>] ? update_cfs_group+0x0/0x40 [<603a0e77>] ? __schedule+0x0/0x3ed [<60033761>] ? um_set_signals+0x0/0x43 [<6002af6a>] mc_work_proc+0x77/0x91 [<600520b4>] process_scheduled_works+0x1af/0x2c3 [<6004ede3>] ? assign_work+0x0/0x58 [<600527a1>] worker_thread+0x2f7/0x37a [<6004ee3b>] ? set_pf_worker+0x0/0x64 [<6005765d>] ? arch_local_irq_save+0x0/0x2d [<60058e07>] ? kthread_exit+0x0/0x3a [<600524aa>] ? worker_thread+0x0/0x37a [<60058f9f>] kthread+0x130/0x135 [<6002068e>] new_thread_handler+0x85/0xb6
--- arch/um/drivers/ubd_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/um/drivers/ubd_kern.c +1 -1
@@ -861,7 +861,7 @@ static int ubd_open_dev(struct ubd *ubd_static void ubd_device_release (struct device *dev) { -struct ubd *ubd_dev =dev_get_drvdata (dev); + struct ubd *ubd_dev = container_of(dev, struct ubd, pdev.dev);blk_cleanup_queue (ubd_dev->queue);blk_mq_free_tag_set (&ubd_dev->tag_set);
Greg Kroah-Hartman
maintainerPATCH 269/459 um: net: Do not use drvdata in release
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <[email protected]>
commit d1db692a9be3b4bd3473b64fcae996afaffe8438 upstream.
The drvdata is not available in release. Let's just use container_of() to get the uml_net instance. Otherwise, removing a network device will result in a crash:
RIP: 0033:net_device_release+0x10/0x6f RSP: 00000000e20c7c40 EFLAGS: 00010206 RAX: 000000006002e4e7 RBX: 00000000600f1baf RCX: 00000000624074e0 RDX: 0000000062778000 RSI: 0000000060551c80 RDI: 00000000627af028 RBP: 00000000e20c7c50 R08: 00000000603ad594 R09: 00000000e20c7b70 R10: 000000000000135a R11: 00000000603ad422 R12: 0000000000000000 R13: 0000000062c7af00 R14: 0000000062406d60 R15: 00000000627700b6 Kernel panic - not syncing: Segfault with no mm CPU: 0 UID: 0 PID: 29 Comm: kworker/0:2 Not tainted 6.12.0-rc6-g59b723cd2adb #1 Workqueue: events mc_work_proc Stack: 627af028 62c7af00 e20c7c80 60276fcd 62778000 603f5820 627af028 00000000 e20c7cb0 603a2bcd 627af000 62770010 Call Trace: [<60276fcd>] device_release+0x70/0xba [<603a2bcd>] kobject_put+0xba/0xe7 [<60277265>] put_device+0x19/0x1c [<60281266>] platform_device_put+0x26/0x29 [<60281e5f>] platform_device_unregister+0x2c/0x2e [<6002ec9c>] net_remove+0x63/0x69 [<60031316>] ? mconsole_reply+0x0/0x50 [<600310c8>] mconsole_remove+0x160/0x1cc [<60087d40>] ? __remove_hrtimer+0x38/0x74 [<60087ff8>] ? hrtimer_try_to_cancel+0x8c/0x98 [<6006b3cf>] ? dl_server_stop+0x3f/0x48 [<6006b390>] ? dl_server_stop+0x0/0x48 [<600672e8>] ? dequeue_entities+0x327/0x390 [<60038fa6>] ? um_set_signals+0x0/0x43 [<6003070c>] mc_work_proc+0x77/0x91 [<60057664>] process_scheduled_works+0x1b3/0x2dd [<60055f32>] ? assign_work+0x0/0x58 [<60057f0a>] worker_thread+0x1e9/0x293 [<6005406f>] ? set_pf_worker+0x0/0x64 [<6005d65d>] ? arch_local_irq_save+0x0/0x2d [<6005d748>] ? kthread_exit+0x0/0x3a [<60057d21>] ? worker_thread+0x0/0x293 [<6005dbf1>] kthread+0x126/0x12b [<600219c5>] new_thread_handler+0x85/0xb6
--- arch/um/drivers/net_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/um/drivers/net_kern.c +1 -1
@@ -335,7 +335,7 @@ static struct platform_driver uml_net_drstatic void net_device_release (struct device *dev) { -struct uml_net *device =dev_get_drvdata (dev); + struct uml_net *device = container_of(dev, struct uml_net, pdev.dev);struct net_device *netdev = device->dev;struct uml_net_private *lp =netdev_priv (netdev);
Greg Kroah-Hartman
maintainerPATCH 270/459 serial: 8250: omap: Move pm_runtime_get_sync
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Liu <[email protected]>
commit bcc7ba668818dcadd2f1db66b39ed860a63ecf97 upstream.
Currently in omap_8250_shutdown, the dma->rx_running flag is set to zero in omap_8250_rx_dma_flush. Next pm_runtime_get_sync is called, which is a runtime resume call stack which can re-set the flag. When the call omap_8250_shutdown returns, the flag is expected to be UN-SET, but this is not the case. This is causing issues the next time UART is re-opened and omap_8250_rx_dma is called. Fix by moving pm_runtime_get_sync before the omap_8250_rx_dma_flush.
--- drivers/tty/serial/8250/8250_omap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/8250/8250_omap.c +2 -2
@@ -768,12 +768,12 @@ static void omap_8250_shutdown(struct uastruct uart_8250_port *up =up_to_u8250p (port);struct omap8250_priv *priv = port->private_data; +pm_runtime_get_sync (port->dev); +flush_work (&priv->qos_work);if (up->dma)omap_8250_rx_dma_flush (up); -pm_runtime_get_sync (port->dev); -serial_out (up,UART_OMAP_WER ,0 );if (priv->habit &UART_HAS_EFR2 )serial_out (up,UART_OMAP_EFR2 ,0x0 );