6.12.9-rc1 review
Greg Kroah-Hartman
maintainercover 6.12.9-rc1 review
This is the start of the stable review cycle for the 6.12.9 release. There are 156 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 08 Jan 2025 15:11:04 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.9-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.9-rc1
Paolo Abeni <[email protected]>
mptcp: don't always assume copied data in mptcp_cleanup_rbuf()
Paolo Abeni <[email protected]>
mptcp: fix recvbuffer adjust on sleeping rcvmsg
Paolo Abeni <[email protected]>
mptcp: fix TCP options overflow.
Liu Shixin <[email protected]>
mm: hugetlb: independent PMD page table shared count
Lorenzo Stoakes <[email protected]>
mm: reinstate ability to map write-sealed memfd mappings read-only
Seiji Nishikawa <[email protected]>
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
Alessandro Carminati <[email protected]>
mm/kmemleak: fix sleeping function called from invalid context at print message
Yafang Shao <[email protected]>
mm/readahead: fix large folio support in async readahead
Joshua Washington <[email protected]>
gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
Joshua Washington <[email protected]>
gve: guard XDP xmit NDO on existence of xdp queues
Joshua Washington <[email protected]>
gve: fix XDP allocation path in edge cases
Joshua Washington <[email protected]>
gve: guard XSK operations on the existence of queues
Joshua Washington <[email protected]>
gve: clean XDP queues in gve_tx_stop_ring_gqi
Joshua Washington <[email protected]>
gve: process XSK TX descriptors as part of RX NAPI
David Hildenbrand <[email protected]>
fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit
Baolin Wang <[email protected]>
mm: shmem: fix incorrect index alignment for within_size policy
Baolin Wang <[email protected]>
mm: shmem: fix the update of 'shmem_falloc->nr_unswapped'
SeongJae Park <[email protected]>
mm/damon/core: fix new damon_target objects leaks on damon_commit_targets()
SeongJae Park <[email protected]>
mm/damon/core: fix ignored quota goals and filters of newly committed schemes
Siddharth Vadapalli <[email protected]>
net: ethernet: ti: am65-cpsw: default to round-robin for host port receive
Zilin Guan <[email protected]>
fgraph: Add READ_ONCE() when accessing fgraph_array[]
Kees Cook <[email protected]>
wifi: iwlwifi: mvm: Fix __counted_by usage in cfg80211_wowlan_nd_*
Biju Das <[email protected]>
drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
Biju Das <[email protected]>
dt-bindings: display: adi,adv7533: Drop single lane support
Biju Das <[email protected]>
drm: adv7511: Drop dsi single lane support
Pavel Begunkov <[email protected]>
io_uring/rw: fix downgraded mshot read
Nikolay Kuratov <[email protected]>
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
Henry Huang <[email protected]>
sched_ext: initialize kit->cursor.flags
Pascal Hambourg <[email protected]>
sky2: Add device ID 11ab:4373 for Marvell 88E8075
Tvrtko Ursulin <[email protected]>
workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker
Evgenii Shatokhin <[email protected]>
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
Dan Carpenter <[email protected]>
RDMA/uverbs: Prevent integer overflow issue
Tejun Heo <[email protected]>
sched_ext: Fix invalid irq restore in scx_ops_bypass()
Kuan-Wei Chiu <[email protected]>
scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
Nikolaus Voss <[email protected]>
clk: clk-imx8mp-audiomix: fix function signature
Yang Erkun <[email protected]>
maple_tree: reload mas before the second call for mas_empty_area
Arnd Bergmann <[email protected]>
kcov: mark in_softirq_really() as __always_inline
Dennis Lam <[email protected]>
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
Takashi Iwai <[email protected]>
ALSA: seq: oss: Fix races at processing SysEx messages
Daniel Schaefer <[email protected]>
ALSA hda/realtek: Add quirk for Framework F111:000C
Nirmoy Das <[email protected]>
drm/xe: Wait for migration job before unmapping pages
Nirmoy Das <[email protected]>
drm/xe: Use non-interruptible wait when moving BO to system
Kohei Enju <[email protected]>
ftrace: Fix function profiler's filtering functionality
Takashi Iwai <[email protected]>
ALSA: seq: Check UMP support for midi_version change
Jens Axboe <[email protected]>
io_uring/kbuf: use pre-committed buffer address for non-pollable file
Mark Zhang <[email protected]>
RDMA/mlx5: Enable multiplane mode only when it is supported
Takashi Iwai <[email protected]>
Revert "ALSA: ump: Don't enumeration invalid groups for legacy rawmidi"
Thomas Weißschuh <[email protected]>
kbuild: pacman-pkg: provide versioned linux-api-headers package
Masahiro Yamada <[email protected]>
modpost: fix the missed iteration for the max bit in do_input()
Mostafa Saleh <[email protected]>
scripts/mksysmap: Fix escape chars '$'
Maksim Kiselev <[email protected]>
clk: thead: Fix TH1520 emmc and shdci clock rate
Eduard Zingerman <[email protected]>
bpf: consider that tail calls invalidate packet pointers
Eduard Zingerman <[email protected]>
bpf: refactor bpf_helper_changes_pkt_data to use helper number
Leon Romanovsky <[email protected]>
ARC: build: Try to guess GCC variant of cross compiler
Uros Bizjak <[email protected]>
irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix sleeping function called from invalid context
Daniele Palmas <[email protected]>
net: usb: qmi_wwan: add Telit FE910C04 compositions
Enzo Matsumiya <[email protected]>
smb: client: destroy cfid_put_wq on module exit
Namjae Jeon <[email protected]>
ksmbd: set ATTR_CTIME flags when setting mtime
Hobin Woo <[email protected]>
ksmbd: retry iterate_dir in smb2_query_dir
Anton Protopopov <[email protected]>
bpf: fix potential error return
Hardevsinh Palaniya <[email protected]>
ARC: bpf: Correct conditional check in 'check_jmp_32'
Paul E. McKenney <[email protected]>
ARC: build: Use __force to suppress per-CPU cmpxchg warnings
Vineet Gupta <[email protected]>
ARC: build: disallow invalid PAE40 + 4K page config
Stephen Gordon <[email protected]>
ASoC: audio-graph-card: Call of_node_put() on correct node
Niravkumar L Rabara <[email protected]>
spi: spi-cadence-qspi: Disable STIG mode for Altera SoCFPGA.
Adrian Ratiu <[email protected]>
sound: usb: format: don't warn that raw DSD is unsupported
Adrian Ratiu <[email protected]>
sound: usb: enable DSD output for ddHiFi TC44C
Vasiliy Kovalev <[email protected]>
ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model
Takashi Iwai <[email protected]>
ALSA: hda/ca0132: Use standard HD-audio quirk matching helpers
Filipe Manana <[email protected]>
btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
Johannes Thumshirn <[email protected]>
btrfs: handle bio_split() errors
Vasiliy Kovalev <[email protected]>
ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio
Simon Trimmer <[email protected]>
ALSA: hda: cs35l56: Remove calls to cs35l56_force_sync_asp1_registers_from_cache()
Prike Liang <[email protected]>
drm/amdkfd: Correct the migration DMA map direction
Victor Zhao <[email protected]>
drm/amdgpu: use sjt mec fw on gfx943 for sriov
Emmanuel Grumbach <[email protected]>
wifi: mac80211: wake the queues in case of failure in resume
Aditya Kumar Singh <[email protected]>
wifi: cfg80211: clear link ID from bitmap during link delete after clean up
Issam Hamdi <[email protected]>
wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
Kan Liang <[email protected]>
perf/x86/intel: Add Arrow Lake U support
Filipe Manana <[email protected]>
btrfs: allow swap activation to be interruptible
Meghana Malladi <[email protected]>
net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init
MD Danish Anwar <[email protected]>
net: ti: icssg-prueth: Fix firmware load sequence.
Eric Dumazet <[email protected]>
ila: serialize calls to nf_register_net_hooks()
Eric Dumazet <[email protected]>
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
Eric Dumazet <[email protected]>
af_packet: fix vlan_get_tci() vs MSG_PEEK
Maciej S. Szmigiero <[email protected]>
net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init()
Eric Dumazet <[email protected]>
net: restrict SO_REUSEPORT to inet sockets
Willem de Bruijn <[email protected]>
net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets
Liang Jie <[email protected]>
net: sfc: Correct key_len for efx_tc_ct_zone_ht_params
Jens Axboe <[email protected]>
io_uring/net: always initialize kmsg->msg.msg_inq upfront
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix error recovery sequence
Li Zhijian <[email protected]>
RDMA/rtrs: Ensure 'ib_sge list' is accessible
Jinjian Song <[email protected]>
net: wwan: t7xx: Fix FSM command timeout issue
Joe Hattori <[email protected]>
net: mv643xx_eth: fix an OF node reference leak
Vitalii Mordan <[email protected]>
eth: bcmsysport: fix call balance of priv->clk handling routines
Tanya Agarwal <[email protected]>
ALSA: usb-audio: US16x08: Initialize array before use
Leo Stone <[email protected]>
nvmet: Don't overflow subsysnqn
Antonio Pastor <[email protected]>
net: llc: reset skb->transport_header
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
Su Hui <[email protected]>
workqueue: add printf attribute to __alloc_workqueue()
Rodrigo Vivi <[email protected]>
drm/i915/dg1: Fix power gate sequence.
Suraj Kandpal <[email protected]>
drm/i915/cx0_phy: Fix C10 pll programming sequence
Zhu Yanjun <[email protected]>
RDMA/rxe: Remove the direct link to net_device
Jianbo Liu <[email protected]>
net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only
Jianbo Liu <[email protected]>
net/mlx5e: Skip restore TC rules for vport rep without loaded flag
Dragos Tatulea <[email protected]>
net/mlx5e: macsec: Maintain TX SA from encoding_sa
Shahar Shitrit <[email protected]>
net/mlx5: DR, select MSIX vector 0 for completion queue creation
Kory Maincent <[email protected]>
net: pse-pd: tps23881: Fix power on/off issue
Ilya Shchipletsov <[email protected]>
netrom: check buffer length before accessing it
Xiao Liang <[email protected]>
net: Fix netns for ip_tunnel_init_flow()
Wang Liang <[email protected]>
net: fix memory leak in tcp_conn_request()
Joe Hattori <[email protected]>
net: stmmac: restructure the error path of stmmac_probe_config_dt()
Lucas De Marchi <[email protected]>
drm/xe: Fix fault on fd close after unbind
Michal Wajdeczko <[email protected]>
drm/xe/pf: Use correct function to check LMEM provisioning
John Harrison <[email protected]>
drm/xe: Revert some changes that break a mesa debug tool
Chengchang Tang <[email protected]>
RDMA/hns: Fix missing flush CQE for DWQE
Chengchang Tang <[email protected]>
RDMA/hns: Fix warning storm caused by invalid input in IO path
Chengchang Tang <[email protected]>
RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
wenglianfa <[email protected]>
RDMA/hns: Fix mapping error of zero-hop WQE buffer
Jakub Kicinski <[email protected]>
netdev-genl: avoid empty messages in napi get
Vladimir Oltean <[email protected]>
selftests: net: local_termination: require mausezahn
Tristram Ha <[email protected]>
net: dsa: microchip: Fix LAN937X set_ageing_time function
Tristram Ha <[email protected]>
net: dsa: microchip: Fix KSZ9477 set_ageing_time function
Stefan Ekenberg <[email protected]>
drm/bridge: adv7511_audio: Update Audio InfoFrame properly
Wei Fang <[email protected]>
net: phy: micrel: Dynamically control external clock of KSZ PHY
Selvin Xavier <[email protected]>
RDMA/bnxt_re: Fix the locking while accessing the QP table
Damodharam Ammepalli <[email protected]>
RDMA/bnxt_re: Fix MSN table size for variable wqe mode
Damodharam Ammepalli <[email protected]>
RDMA/bnxt_re: Add send queue size check for variable wqe
Kalesh AP <[email protected]>
RDMA/bnxt_re: Disable use of reserved wqes
Selvin Xavier <[email protected]>
RDMA/bnxt_re: Fix max_qp_wrs reported
Bernard Metzler <[email protected]>
RDMA/siw: Remove direct link to net_device
Chiara Meiohas <[email protected]>
RDMA/nldev: Set error code in rdma_nl_notify_event
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix reporting hw_ver in query_device
Saravanan Vajravel <[email protected]>
RDMA/bnxt_re: Add check for path mtu in modify_qp
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix the check for 9060 condition
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: fix CRF name for Bz
Robert Beckett <[email protected]>
nvme-pci: 512 byte aligned dma pool segment quirk
Anumula Murali Mohan Reddy <[email protected]>
RDMA/core: Fix ENODEV error for iWARP test over vlan
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters
Selvin Xavier <[email protected]>
RDMA/bnxt_re: Avoid initializing the software queue for user queues
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Fix max SGEs for the Work Request
Patrisious Haddad <[email protected]>
RDMA/mlx5: Enforce same type port association for multiport RoCE
guanjing <[email protected]>
sched_ext: fix application of sizeof to pointer
Leon Romanovsky <[email protected]>
RDMA/bnxt_re: Remove always true dattr validity check
Christoph Hellwig <[email protected]>
btrfs: use bio_is_zone_append() in the completion handler
Christoph Hellwig <[email protected]>
block: lift bio_is_zone_append to bio.h
Steven Rostedt <[email protected]>
tracing: Have process_string() also allow arrays
Lucas Stach <[email protected]>
pmdomain: core: add dummy release function to genpd device
Joe Hattori <[email protected]>
pmdomain: imx: gpcv2: fix an OF node reference leak in imx_gpcv2_probe()
Eric Biggers <[email protected]>
mmc: sdhci-msm: fix crypto key eviction
Thiébaud Weksteen <[email protected]>
selinux: ignore unknown extended permissions
Mingcong Bai <[email protected]>
platform/x86: hp-wmi: mark 8A15 board for timed OMEN thermal profile
Vishnu Sankar <[email protected]>
platform/x86: thinkpad-acpi: Add support for hotkey 0x1401
Alex Deucher <[email protected]>
drm/amdgpu: fix backport of commit 73dae652dcac
Joe Hattori <[email protected]>
platform/x86: mlx-platform: call pci_dev_put() to balance the refcount
-------------
Diffstat:
.../admin-guide/laptops/thinkpad-acpi.rst | 10 +- .../bindings/display/bridge/adi,adv7533.yaml | 2 +- Makefile | 4 +- arch/arc/Kconfig | 4 +- arch/arc/Makefile | 2 +- arch/arc/include/asm/cmpxchg.h | 2 +- arch/arc/net/bpf_jit_arcv2.c | 2 +- arch/x86/events/intel/core.c | 1 + block/blk.h | 9 - drivers/clk/imx/clk-imx8mp-audiomix.c | 3 +- drivers/clk/thead/clk-th1520-ap.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 4 +- drivers/gpu/drm/bridge/adv7511/adv7511_audio.c | 14 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 10 +- drivers/gpu/drm/bridge/adv7511/adv7533.c | 4 +- drivers/gpu/drm/i915/display/intel_cx0_phy.c | 12 +- drivers/gpu/drm/i915/gt/intel_rc6.c | 2 +- drivers/gpu/drm/xe/xe_bo.c | 12 +- drivers/gpu/drm/xe/xe_devcoredump.c | 15 +- drivers/gpu/drm/xe/xe_exec_queue.c | 9 + drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 2 +- drivers/infiniband/core/cma.c | 16 ++ drivers/infiniband/core/nldev.c | 2 +- drivers/infiniband/core/uverbs_cmd.c | 16 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 34 +-- drivers/infiniband/hw/bnxt_re/main.c | 8 +- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 65 +++-- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 3 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 5 +- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 18 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 43 +++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 11 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 5 - drivers/infiniband/hw/mlx5/main.c | 8 +- drivers/infiniband/sw/rxe/rxe.c | 23 +- drivers/infiniband/sw/rxe/rxe.h | 3 +- drivers/infiniband/sw/rxe/rxe_mcast.c | 22 +- drivers/infiniband/sw/rxe/rxe_net.c | 24 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 26 +- drivers/infiniband/sw/rxe/rxe_verbs.h | 11 +- drivers/infiniband/sw/siw/siw.h | 7 +- drivers/infiniband/sw/siw/siw_cm.c | 27 +- drivers/infiniband/sw/siw/siw_main.c | 15 +- drivers/infiniband/sw/siw/siw_verbs.c | 35 ++- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- drivers/irqchip/irq-gic.c | 2 +- drivers/mmc/host/sdhci-msm.c | 16 +- drivers/net/dsa/microchip/ksz9477.c | 47 +++- drivers/net/dsa/microchip/ksz9477_reg.h | 4 +- drivers/net/dsa/microchip/lan937x_main.c | 62 ++++- drivers/net/dsa/microchip/lan937x_reg.h | 9 +- drivers/net/ethernet/broadcom/bcmsysport.c | 21 +- drivers/net/ethernet/google/gve/gve.h | 1 + drivers/net/ethernet/google/gve/gve_main.c | 63 +++-- drivers/net/ethernet/google/gve/gve_tx.c | 46 ++-- drivers/net/ethernet/marvell/mv643xx_eth.c | 14 +- drivers/net/ethernet/marvell/sky2.c | 1 + .../ethernet/mellanox/mlx5/core/en_accel/macsec.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 15 ++ .../net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 5 +- .../ethernet/mellanox/mlx5/core/steering/dr_send.c | 4 +- .../net/ethernet/mellanox/mlxsw/spectrum_span.c | 3 +- drivers/net/ethernet/sfc/tc_conntrack.c | 2 +- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 43 ++-- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- drivers/net/ethernet/ti/icssg/icss_iep.c | 8 + drivers/net/ethernet/ti/icssg/icssg_common.c | 25 -- drivers/net/ethernet/ti/icssg/icssg_config.c | 41 ++- drivers/net/ethernet/ti/icssg/icssg_config.h | 1 + drivers/net/ethernet/ti/icssg/icssg_prueth.c | 281 ++++++++++++++------- drivers/net/ethernet/ti/icssg/icssg_prueth.h | 5 +- drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c | 24 +- drivers/net/phy/micrel.c | 114 ++++++++- drivers/net/pse-pd/tps23881.c | 16 +- drivers/net/usb/qmi_wwan.c | 3 + drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 1 + drivers/net/wireless/intel/iwlwifi/iwl-config.h | 1 + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 14 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 41 ++- drivers/net/wwan/iosm/iosm_ipc_mmio.c | 2 +- drivers/net/wwan/t7xx/t7xx_state_monitor.c | 26 +- drivers/net/wwan/t7xx/t7xx_state_monitor.h | 5 +- drivers/nvme/host/nvme.h | 5 + drivers/nvme/host/pci.c | 9 +- drivers/nvme/target/configfs.c | 11 +- drivers/pinctrl/pinctrl-mcp23s08.c | 6 + drivers/platform/x86/hp/hp-wmi.c | 4 +- drivers/platform/x86/mlx-platform.c | 2 + drivers/platform/x86/thinkpad_acpi.c | 4 +- drivers/pmdomain/core.c | 6 + drivers/pmdomain/imx/gpcv2.c | 4 +- drivers/spi/spi-cadence-quadspi.c | 10 +- fs/btrfs/bio.c | 23 +- fs/btrfs/disk-io.c | 9 + fs/btrfs/inode.c | 5 + fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/quota_local.c | 1 + fs/proc/task_mmu.c | 2 +- fs/smb/client/cifsfs.c | 1 + fs/smb/server/smb2pdu.c | 22 +- fs/smb/server/vfs.h | 1 + include/linux/bio.h | 17 ++ include/linux/filter.h | 2 +- include/linux/if_vlan.h | 16 +- include/linux/memfd.h | 14 + include/linux/mlx5/driver.h | 7 + include/linux/mlx5/mlx5_ifc.h | 4 +- include/linux/mm.h | 57 +++-- include/linux/mm_types.h | 30 +++ include/net/bluetooth/hci_core.h | 108 +++++--- include/net/netfilter/nf_tables.h | 7 +- include/sound/cs35l56.h | 6 - io_uring/kbuf.c | 4 +- io_uring/net.c | 1 + io_uring/rw.c | 2 + kernel/bpf/core.c | 8 +- kernel/bpf/verifier.c | 2 +- kernel/kcov.c | 2 +- kernel/sched/ext.c | 4 +- kernel/trace/fgraph.c | 2 +- kernel/trace/ftrace.c | 8 +- kernel/trace/trace_events.c | 12 + kernel/workqueue.c | 23 +- lib/maple_tree.c | 1 + mm/damon/core.c | 10 +- mm/hugetlb.c | 16 +- mm/kmemleak.c | 2 +- mm/memfd.c | 2 +- mm/mmap.c | 4 + mm/readahead.c | 6 +- mm/shmem.c | 7 +- mm/vmscan.c | 9 +- net/bluetooth/hci_core.c | 10 +- net/bluetooth/iso.c | 6 + net/bluetooth/l2cap_core.c | 12 +- net/bluetooth/rfcomm/core.c | 6 + net/bluetooth/sco.c | 12 +- net/core/dev.c | 4 +- net/core/filter.c | 63 +++-- net/core/netdev-genl.c | 6 +- net/core/sock.c | 5 +- net/ipv4/ip_tunnel.c | 6 +- net/ipv4/tcp_input.c | 1 + net/ipv6/ila/ila_xlat.c | 16 +- net/llc/llc_input.c | 2 +- net/mac80211/cfg.c | 8 +- net/mac80211/mesh.c | 6 +- net/mac80211/util.c | 3 + net/mptcp/options.c | 7 + net/mptcp/protocol.c | 22 +- net/netrom/nr_route.c | 6 + net/packet/af_packet.c | 28 +- net/sctp/associola.c | 3 +- net/wireless/util.c | 3 +- scripts/mksysmap | 4 +- scripts/mod/file2alias.c | 2 +- scripts/package/PKGBUILD | 2 +- scripts/sorttable.h | 5 +- security/selinux/ss/services.c | 8 +- sound/core/seq/oss/seq_oss_synth.c | 2 + sound/core/seq/seq_clientmgr.c | 14 +- sound/core/ump.c | 2 +- sound/pci/hda/cs35l56_hda.c | 8 - sound/pci/hda/patch_ca0132.c | 37 +-- sound/pci/hda/patch_realtek.c | 24 ++ sound/soc/generic/audio-graph-card2.c | 2 +- sound/usb/format.c | 7 +- sound/usb/mixer_us16x08.c | 2 +- sound/usb/quirks.c | 2 + tools/sched_ext/scx_central.c | 2 +- tools/testing/selftests/bpf/progs/tc_bpf2bpf.c | 2 + .../selftests/net/forwarding/local_termination.sh | 1 - 177 files changed, 1698 insertions(+), 764 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/156 platform/x86: mlx-platform: call pci_dev_put() to balance the refcount
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit 185e1b1d91e419445d3fd99c1c0376a970438acf ]
mlxplat_pci_fpga_device_init() calls pci_get_device() but does not release the refcount on error path. Call pci_dev_put() on the error path and in mlxplat_pci_fpga_device_exit() to fix this.
This bug was found by an experimental static analysis tool that I am developing.
--- drivers/platform/x86/mlx-platform.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/x86/mlx-platform.c +2 -0
@@ -6237,6 +6237,7 @@ mlxplat_pci_fpga_device_init(unsigned int device, const char *res_name, struct p fail_pci_request_regions:pci_disable_device (pci_dev); fail_pci_enable_device: +pci_dev_put (pci_dev);return err; }
@@ -6247,6 +6248,7 @@ mlxplat_pci_fpga_device_exit(struct pci_dev *pci_bridge,iounmap (pci_bridge_addr);pci_release_regions (pci_bridge);pci_disable_device (pci_bridge); +pci_dev_put (pci_bridge); } static int
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/156 drm/amdgpu: fix backport of commit 73dae652dcac
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
Commit 73dae652dcac ("drm/amdgpu: rework resume handling for display (v2)") missed a small code change when it was backported resulting in an automatic backlight control breakage. Fix the backport.
Note that this patch is not in Linus' tree as it is not required there; the bug was introduced in the backport.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +5 -1
@@ -3721,8 +3721,12 @@ static int amdgpu_device_ip_resume_phasecontinue ;if (adev->ip_blocks[i].version->type ==AMD_IP_BLOCK_TYPE_DCE ) { r = adev->ip_blocks[i].version->funcs->resume (adev); -if (r) +if (r) { +DRM_ERROR ("resume of IP block <%s> failed %d\n" , + adev->ip_blocks[i].version->funcs->name, r);return r; + } + adev->ip_blocks[i].status.hw = true; } }
Greg Kroah-Hartman
maintainerPATCH 3/156 platform/x86: thinkpad-acpi: Add support for hotkey 0x1401
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Sankar <[email protected]>
commit 7e16ae558a87ac9099b6a93a43f19b42d809fd78 upstream.
F8 mode key on Lenovo 2025 platforms use a different key code. Adding support for the new keycode 0x1401.
Tested on X1 Carbon Gen 13 and X1 2-in-1 Gen 10.
--- Documentation/admin-guide/laptops/thinkpad-acpi.rst | 10 +++++++--- drivers/platform/x86/thinkpad_acpi.c | 4 +++- 2 files changed, 10 insertions(+), 4 deletions(-)
Documentation/admin-guide/laptops/thinkpad-acpi.rst +7 -3
@@ -445,8 +445,10 @@ event code Key Notes 0x1008 0x07 FN+F8 IBM: toggle screen expand Lenovo: configure UltraNav, or toggle screen expand. - On newer platforms (2024+) - replaced by 0x131f (see below) + On 2024 platforms replaced by + 0x131f (see below) and on newer + platforms (2025 +) keycode is + replaced by 0x1401 (see below). 0x1009 0x08 FN+F9 -
@@ -506,9 +508,11 @@ event code Key Notes 0x1019 0x18 unknown -0x131f ... FN+F8 Platform Mode change. +0x131f ... FN+F8 Platform Mode change (2024 systems). Implemented in driver. +0x1401 ... FN+F8 Platform Mode change (2025 + systems). + Implemented in driver. ... ... ... 0x1020 0x1F unknown
drivers/platform/x86/thinkpad_acpi.c +3 -1
@@ -184,7 +184,8 @@ enum tpacpi_hkey_event_t {*/ TP_HKEY_EV_AMT_TOGGLE =0x131a ,/* Toggle AMT on/off */ TP_HKEY_EV_DOUBLETAP_TOGGLE =0x131c ,/* Toggle trackpoint doubletap on/off */ -TP_HKEY_EV_PROFILE_TOGGLE =0x131f ,/* Toggle platform profile */ +TP_HKEY_EV_PROFILE_TOGGLE =0x131f ,/* Toggle platform profile in 2024 systems */ +TP_HKEY_EV_PROFILE_TOGGLE2 =0x1401 ,/* Toggle platform profile in 2025 + systems */ /* Reasons for waking up from S3/S4 */ TP_HKEY_EV_WKUP_S3_UNDOCK = 0x2304, /* undock requested, S3 */
@@ -11200,6 +11201,7 @@ static bool tpacpi_driver_event(const un tp_features.trackpoint_doubletap = !tp_features.trackpoint_doubletap;return true;case TP_HKEY_EV_PROFILE_TOGGLE : +case TP_HKEY_EV_PROFILE_TOGGLE2 :platform_profile_cycle ();return true; }
Greg Kroah-Hartman
maintainerPATCH 4/156 platform/x86: hp-wmi: mark 8A15 board for timed OMEN thermal profile
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingcong Bai <[email protected]>
commit 032fe9b0516702599c2dd990a4703f783d5716b8 upstream.
The HP OMEN 8 (2022), corresponding to a board ID of 8A15, supports OMEN thermal profile and requires the timed profile quirk.
Upon adding this ID to both the omen_thermal_profile_boards and omen_timed_thermal_profile_boards, significant bump in performance can be observed. For instance, SilverBench (https://silver.urih.com/) results improved from ~56,000 to ~69,000, as a result of higher power draws (and thus core frequencies) whilst under load:
Package Power:
- Before the patch: ~65W (dropping to about 55W under sustained load).
- After the patch: ~115W (dropping to about 105W under sustained load).
Core Power:
- Before: ~60W (ditto above).
- After: ~108W (ditto above).
Add 8A15 to omen_thermal_profile_boards and omen_timed_thermal_profile_boards to improve performance.
--- drivers/platform/x86/hp/hp-wmi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/hp/hp-wmi.c +2 -2
@@ -64,7 +64,7 @@ static const char * const omen_thermal_p"874A" ,"8603" ,"8604" ,"8748" ,"886B" ,"886C" ,"878A" ,"878B" ,"878C" ,"88C8" ,"88CB" ,"8786" ,"8787" ,"8788" ,"88D1" ,"88D2" ,"88F4" ,"88FD" ,"88F5" ,"88F6" ,"88F7" ,"88FE" ,"88FF" ,"8900" ,"8901" ,"8902" ,"8912" , -"8917" ,"8918" ,"8949" ,"894A" ,"89EB" ,"8BAD" ,"8A42" +"8917" ,"8918" ,"8949" ,"894A" ,"89EB" ,"8BAD" ,"8A42" ,"8A15" };/* DMI Board names of Omen laptops that are specifically set to be thermal
@@ -80,7 +80,7 @@ static const char * const omen_thermal_p* "balanced" when reaching zero. */ static const char *const omen_timed_thermal_profile_boards[] = { -"8BAD" ,"8A42" +"8BAD" ,"8A42" ,"8A15" };/* DMI Board names of Victus laptops */
Greg Kroah-Hartman
maintainerPATCH 5/156 selinux: ignore unknown extended permissions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thiébaud Weksteen <[email protected]>
commit 900f83cf376bdaf798b6f5dcb2eae0c822e908b6 upstream.
When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels.
--- security/selinux/ss/services.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
security/selinux/ss/services.c +6 -2
@@ -955,7 +955,10 @@ void services_compute_xperms_decision(st xpermd->driver))return ; }else { -BUG (); +pr_warn_once ( +"SELinux: unknown extended permission (%u) will be ignored\n" , + node->datum.u.xperms->specified); +return ; }if (node->key.specified ==AVTAB_XPERMS_ALLOWED ) {
@@ -992,7 +995,8 @@ void services_compute_xperms_decision(st node->datum.u.xperms->perms.p[i]; } }else { -BUG (); +pr_warn_once ("SELinux: unknown specified key (%u)\n" , + node->key.specified); } }
Greg Kroah-Hartman
maintainerPATCH 6/156 mmc: sdhci-msm: fix crypto key eviction
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 8d90a86ed053226a297ce062f4d9f4f521e05c4c upstream.
Commit c7eed31e235c ("mmc: sdhci-msm: Switch to the new ICE API") introduced an incorrect check of the algorithm ID into the key eviction path, and thus qcom_ice_evict_key() is no longer ever called. Fix it.
Message-ID: <[email protected]>
--- drivers/mmc/host/sdhci-msm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/mmc/host/sdhci-msm.c +8 -8
@@ -1867,20 +1867,20 @@ static int sdhci_msm_program_key(structstruct sdhci_msm_host *msm_host =sdhci_pltfm_priv (pltfm_host);union cqhci_crypto_cap_entry cap; +if (!(cfg->config_enable &CQHCI_CRYPTO_CONFIGURATION_ENABLE )) +return qcom_ice_evict_key (msm_host->ice, slot); +/* Only AES-256-XTS has been tested so far. */ cap = cq_host->crypto_cap_array[cfg->crypto_cap_idx];if (cap.algorithm_id !=CQHCI_CRYPTO_ALG_AES_XTS || cap.key_size !=CQHCI_CRYPTO_KEY_SIZE_256 )return -EINVAL ; -if (cfg->config_enable &CQHCI_CRYPTO_CONFIGURATION_ENABLE ) -return qcom_ice_program_key (msm_host->ice, -QCOM_ICE_CRYPTO_ALG_AES_XTS , -QCOM_ICE_CRYPTO_KEY_SIZE_256 , - cfg->crypto_key, - cfg->data_unit_size, slot); -else - return qcom_ice_evict_key(msm_host->ice, slot); +return qcom_ice_program_key (msm_host->ice, +QCOM_ICE_CRYPTO_ALG_AES_XTS , +QCOM_ICE_CRYPTO_KEY_SIZE_256 , + cfg->crypto_key, + cfg->data_unit_size, slot); }#else /* CONFIG_MMC_CRYPTO */
Greg Kroah-Hartman
maintainerPATCH 7/156 pmdomain: imx: gpcv2: fix an OF node reference leak in imx_gpcv2_probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
commit 469c0682e03d67d8dc970ecaa70c2d753057c7c0 upstream.
imx_gpcv2_probe() leaks an OF node reference obtained by of_get_child_by_name(). Fix it by declaring the device node with the __free(device_node) cleanup construct.
This bug was found by an experimental static analysis tool that I am developing.
Message-ID: <[email protected]>
--- drivers/pmdomain/imx/gpcv2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pmdomain/imx/gpcv2.c +2 -2
@@ -1458,12 +1458,12 @@ static int imx_gpcv2_probe(struct platfo .max_register = SZ_4K, };struct device *dev = &pdev->dev; -struct device_node *pgc_np; + struct device_node *pgc_np __free(device_node) = +of_get_child_by_name (dev->of_node,"pgc" );struct regmap *regmap;void __iomem *base;int ret; - pgc_np =of_get_child_by_name (dev->of_node,"pgc" );if (!pgc_np) {dev_err (dev,"No power domains specified in DT\n" );return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 8/156 pmdomain: core: add dummy release function to genpd device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
commit f64f610ec6ab59dd0391b03842cea3a4cd8ee34f upstream.
The genpd device, which is really only used as a handle to lookup OPP, but not even registered to the device core otherwise and thus lifetime linked to the genpd struct it is contained in, is missing a release function. After b8f7bbd1f4ec ("pmdomain: core: Add missing put_device()") the device will be cleaned up going through the driver core device_release() function, which will warn when no release callback is present for the device. Add a dummy release function to shut up the warning.
Message-ID: <[email protected]>
--- drivers/pmdomain/core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/pmdomain/core.c +6 -0
@@ -2141,6 +2141,11 @@ static int genpd_set_default_power_statereturn 0 ; } +static void genpd_provider_release (struct device *dev) +{ +/* nothing to be done here */ +} +static int genpd_alloc_data (struct generic_pm_domain *genpd) {struct genpd_governor_data *gd =NULL ;
@@ -2172,6 +2177,7 @@ static int genpd_alloc_data(struct gener genpd->gd = gd;device_initialize (&genpd->dev); + genpd->dev.release = genpd_provider_release;if (!genpd_is_dev_name_fw (genpd)) {dev_set_name (&genpd->dev,"%s" , genpd->name);
Greg Kroah-Hartman
maintainerPATCH 9/156 tracing: Have process_string() also allow arrays
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit afc6717628f959941d7b33728570568b4af1c4b8 upstream.
In order to catch a common bug where a TRACE_EVENT() TP_fast_assign() assigns an address of an allocated string to the ring buffer and then references it in TP_printk(), which can be executed hours later when the string is free, the function test_event_printk() runs on all events as they are registered to make sure there's no unwanted dereferencing.
It calls process_string() to handle cases in TP_printk() format that has "%s". It returns whether or not the string is safe. But it can have some false positives.
For instance, xe_bo_move() has:
TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s",
__entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size,
xe_mem_type_to_name[__entry->old_placement],
xe_mem_type_to_name[__entry->new_placement], __get_str(device_id))Where the "%s" references into xe_mem_type_to_name[]. This is an array of pointers that should be safe for the event to access. Instead of flagging this as a bad reference, if a reference points to an array, where the record field is the index, consider it safe.
--- kernel/trace/trace_events.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
kernel/trace/trace_events.c +12 -0
@@ -365,6 +365,18 @@ static bool process_string(const char *f }while (s < e);/* +* Check for arrays. If the argument has: foo[REC->val] +* then it is very likely that foo is an array of strings +* that are safe to use. +*/ + r =strstr (s,"[" ); +if (r && r < e) { + r =strstr (r,"REC->" ); +if (r && r < e) +return true; + } + +/* * If there's any strings in the argument consider this arg OK as it * could be: REC->field ? "foo" : "bar" and we don't want to get into * verifying that logic here.
Greg Kroah-Hartman
maintainerPATCH 10/156 block: lift bio_is_zone_append to bio.h
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 0ef2b9e698dbf9ba78f67952a747f35eb7060470 ]
Make bio_is_zone_append globally available, because file systems need to use to check for a zone append bio in their end_io handlers to deal with the block layer emulation.
Stable-dep-of: 6c3864e05548 ("btrfs: use bio_is_zone_append() in the completion handler")
--- block/blk.h | 9 --------- include/linux/bio.h | 17 +++++++++++++++++ 2 files changed, 17 insertions(+), 9 deletions(-)
block/blk.h +0 -9
@@ -469,11 +469,6 @@ static inline bool bio_zone_write_plugging(struct bio *bio) {return bio_flagged (bio,BIO_ZONE_WRITE_PLUGGING ); } -static inline bool bio_is_zone_append (struct bio *bio) -{ -return bio_op (bio) ==REQ_OP_ZONE_APPEND || -bio_flagged (bio,BIO_EMULATES_ZONE_APPEND ); -}void blk_zone_write_plug_bio_merged (struct bio *bio);void blk_zone_write_plug_init_request (struct request *rq); static inline void blk_zone_update_request_bio(struct request *rq,
@@ -522,10 +517,6 @@ static inline bool bio_zone_write_plugging(struct bio *bio) {return false; } -static inline bool bio_is_zone_append (struct bio *bio) -{ -return false; -}static inline void blk_zone_write_plug_bio_merged (struct bio *bio) { }
include/linux/bio.h +17 -0
@@ -677,6 +677,23 @@ static inline void bio_clear_polled(struct bio *bio) bio->bi_opf &= ~REQ_POLLED ; } +/** +* bio_is_zone_append - is this a zone append bio? +* @bio: bio to check +* +* Check if @bio is a zone append operation. Core block layer code and end_io +* handlers must use this instead of an open coded REQ_OP_ZONE_APPEND check +* because the block layer can rewrite REQ_OP_ZONE_APPEND to REQ_OP_WRITE if +* it is not natively supported. +*/ +static inline bool bio_is_zone_append (struct bio *bio) +{ +if (!IS_ENABLED (CONFIG_BLK_DEV_ZONED )) +return false; +return bio_op (bio) ==REQ_OP_ZONE_APPEND || +bio_flagged (bio,BIO_EMULATES_ZONE_APPEND ); +} +struct bio *blk_next_bio (struct bio *bio,struct block_device *bdev,unsigned int nr_pages,blk_opf_t opf,gfp_t gfp);struct bio *bio_chain_and_submit (struct bio *prev,struct bio *new);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/156 btrfs: use bio_is_zone_append() in the completion handler
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 6c3864e055486fadb5b97793b57688082e14b43b ]
Otherwise it won't catch bios turned into regular writes by the block level zone write plugging. The additional test it adds is for emulated zone append.
--- fs/btrfs/bio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/btrfs/bio.c +3 -3
@@ -355,7 +355,7 @@ static void btrfs_simple_end_io(struct bio *bio)INIT_WORK (&bbio->end_io_work, btrfs_end_bio_work);queue_work (btrfs_end_io_wq (fs_info, bio), &bbio->end_io_work); }else { -if (bio_op (bio) ==REQ_OP_ZONE_APPEND && !bio->bi_status) +if (bio_is_zone_append (bio) && !bio->bi_status)btrfs_record_physical_zoned (bbio);btrfs_bio_end_io (bbio, bbio->bio.bi_status); }
@@ -398,7 +398,7 @@ static void btrfs_orig_write_end_io(struct bio *bio)else bio->bi_status =BLK_STS_OK ; -if (bio_op (bio) ==REQ_OP_ZONE_APPEND && !bio->bi_status) +if (bio_is_zone_append (bio) && !bio->bi_status) stripe->physical = bio->bi_iter.bi_sector <<SECTOR_SHIFT ;btrfs_bio_end_io (bbio, bbio->bio.bi_status);
@@ -412,7 +412,7 @@ static void btrfs_clone_write_end_io(struct bio *bio)if (bio->bi_status) {atomic_inc (&stripe->bioc->error);btrfs_log_dev_io_error (bio, stripe->dev); - }else if (bio_op (bio) ==REQ_OP_ZONE_APPEND ) { + }else if (bio_is_zone_append (bio)) { stripe->physical = bio->bi_iter.bi_sector <<SECTOR_SHIFT ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/156 RDMA/bnxt_re: Remove always true dattr validity check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit eb867d797d294a00a092b5027d08439da68940b2 ]
res->dattr is always valid at this point as it was initialized during device addition in bnxt_re_add_device().
This change is fixing the following smatch error:drivers/infiniband/hw/bnxt_re/qplib_fp.c:1090 bnxt_qplib_create_qp()
error: we previously assumed 'res->dattr' could be null (see line 985)
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +1 -3
@@ -999,9 +999,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)u32 tbl_indx;u16 nsge; -if (res->dattr) - qp->is_host_msn_tbl =_is_host_msn_table (res->dattr->dev_cap_flags2); - + qp->is_host_msn_tbl =_is_host_msn_table (res->dattr->dev_cap_flags2); sq->dbinfo.flags =0 ; bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, CMDQ_BASE_OPCODE_CREATE_QP,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/156 sched_ext: fix application of sizeof to pointer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: guanjing <[email protected]>
[ Upstream commit f24d192985cbd6782850fdbb3839039da2f0ee76 ]
sizeof when applied to a pointer typed expression gives the size of the pointer.
The proper fix in this particular case is to code sizeof(*cpuset) instead of sizeof(cpuset).
This issue was detected with the help of Coccinelle.
--- tools/sched_ext/scx_central.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/sched_ext/scx_central.c +1 -1
@@ -97,7 +97,7 @@ int main(int argc, char **argv)SCX_BUG_ON (!cpuset,"Failed to allocate cpuset" );CPU_ZERO (cpuset);CPU_SET (skel->rodata->central_cpu, cpuset); -SCX_BUG_ON (sched_setaffinity (0 ,sizeof (cpuset), cpuset), +SCX_BUG_ON (sched_setaffinity (0 ,sizeof (*cpuset), cpuset),"Failed to affinitize to central CPU %d (max %d)" , skel->rodata->central_cpu, skel->rodata->nr_cpu_ids -1 );CPU_FREE (cpuset);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/156 RDMA/mlx5: Enforce same type port association for multiport RoCE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit e05feab22fd7dabcd6d272c4e2401ec1acdfdb9b ]
Different core device types such as PFs and VFs shouldn't be affiliated together since they have different capabilities, fix that by enforcing type check before doing the affiliation.
--- drivers/infiniband/hw/mlx5/main.c | 6 ++++-- include/linux/mlx5/driver.h | 6 ++++++ 2 files changed, 10 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/main.c +4 -2
@@ -3631,7 +3631,8 @@ static int mlx5_ib_init_multiport_master(struct mlx5_ib_dev *dev)list_for_each_entry (mpi, &mlx5_ib_unaffiliated_port_list, list) {if (dev->sys_image_guid == mpi->sys_image_guid && - (mlx5_core_native_port_num (mpi->mdev) -1 ) == i) { + (mlx5_core_native_port_num (mpi->mdev) -1 ) == i && +mlx5_core_same_coredev_type (dev->mdev, mpi->mdev)) { bound =mlx5_ib_bind_slave_port (dev, mpi); }
@@ -4776,7 +4777,8 @@ static int mlx5r_mp_probe(struct auxiliary_device *adev,mutex_lock (&mlx5_ib_multiport_mutex);list_for_each_entry (dev, &mlx5_ib_dev_list, ib_dev_list) { -if (dev->sys_image_guid == mpi->sys_image_guid) +if (dev->sys_image_guid == mpi->sys_image_guid && +mlx5_core_same_coredev_type (dev->mdev, mpi->mdev)) bound =mlx5_ib_bind_slave_port (dev, mpi);if (bound) {
include/linux/mlx5/driver.h +6 -0
@@ -1233,6 +1233,12 @@ static inline bool mlx5_core_is_vf(const struct mlx5_core_dev *dev)return dev->coredev_type ==MLX5_COREDEV_VF ; } +static inline bool mlx5_core_same_coredev_type (const struct mlx5_core_dev *dev1, +const struct mlx5_core_dev *dev2) +{ +return dev1->coredev_type == dev2->coredev_type; +} +static inline bool mlx5_core_is_ecpf (const struct mlx5_core_dev *dev) {return dev->caps.embedded_cpu;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/156 RDMA/bnxt_re: Fix max SGEs for the Work Request
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kashyap Desai <[email protected]>
[ Upstream commit 79d330fbdffd8cee06d8bdf38d82cb62d8363a27 ]
Gen P7 supports up to 13 SGEs for now. WQE software structure can hold only 6 now. Since the max send sge is reported as 13, the stack can give requests up to 13 SGEs. This is causing traffic failures and system crashes.
Use the define for max SGE supported for variable size. This will work for both static and variable WQEs.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_fp.h +1 -2
@@ -114,7 +114,6 @@ struct bnxt_qplib_sge {u32 size; }; -#define BNXT_QPLIB_QP_MAX_SGL 6struct bnxt_qplib_swq {u64 wr_id;int next_idx;
@@ -154,7 +153,7 @@ struct bnxt_qplib_swqe {#define BNXT_QPLIB_SWQE_FLAGS_UC_FENCE BIT(2)#define BNXT_QPLIB_SWQE_FLAGS_SOLICIT_EVENT BIT(3)#define BNXT_QPLIB_SWQE_FLAGS_INLINE BIT(4) -struct bnxt_qplib_sge sg_list[BNXT_QPLIB_QP_MAX_SGL ]; +struct bnxt_qplib_sge sg_list[BNXT_VAR_MAX_SGE ];int num_sge;/* Max inline data is 96 bytes */ u32 inline_len;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/156 RDMA/bnxt_re: Avoid initializing the software queue for user queues
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <[email protected]>
[ Upstream commit 5effcacc8a8f3eb2a9f069d7e81a9ac793598dfb ]
Software Queues to hold the WRs needs to be created for only kernel queues. Avoid allocating the unnecessary memory for user Queues.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 42 +++++++++++++----------- 1 file changed, 23 insertions(+), 19 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +23 -19
@@ -658,13 +658,6 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res, rc =bnxt_qplib_alloc_init_hwq (&srq->hwq, &hwq_attr);if (rc)return rc; - - srq->swq =kcalloc (srq->hwq.max_elements,sizeof (*srq->swq), -GFP_KERNEL ); -if (!srq->swq) { - rc = -ENOMEM ; - goto fail; - } srq->dbinfo.flags =0 ; bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, CMDQ_BASE_OPCODE_CREATE_SRQ,
@@ -693,9 +686,17 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res,spin_lock_init (&srq->lock); srq->start_idx =0 ; srq->last_idx = srq->hwq.max_elements -1 ; -for (idx =0 ; idx < srq->hwq.max_elements; idx++) - srq->swq[idx].next_idx = idx +1 ; - srq->swq[srq->last_idx].next_idx =-1 ; +if (!srq->hwq.is_user) { + srq->swq =kcalloc (srq->hwq.max_elements,sizeof (*srq->swq), +GFP_KERNEL ); +if (!srq->swq) { + rc = -ENOMEM ; + goto fail; + } +for (idx =0 ; idx < srq->hwq.max_elements; idx++) + srq->swq[idx].next_idx = idx +1 ; + srq->swq[srq->last_idx].next_idx =-1 ; + } srq->id =le32_to_cpu (resp.xid); srq->dbinfo.hwq = &srq->hwq;
@@ -1041,13 +1042,14 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)if (rc)return rc; - rc =bnxt_qplib_alloc_init_swq (sq); -if (rc) - goto fail_sq; - -if (psn_sz) -bnxt_qplib_init_psn_ptr (qp, psn_sz); +if (!sq->hwq.is_user) { + rc =bnxt_qplib_alloc_init_swq (sq); +if (rc) + goto fail_sq; +if (psn_sz) +bnxt_qplib_init_psn_ptr (qp, psn_sz); + } req.sq_size =cpu_to_le32 (bnxt_qplib_set_sq_size (sq, qp->wqe_mode)); pbl = &sq->hwq.pbl[PBL_LVL_0 ]; req.sq_pbl =cpu_to_le64 (pbl->pg_map_arr[0 ]);
@@ -1073,9 +1075,11 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) rc =bnxt_qplib_alloc_init_hwq (&rq->hwq, &hwq_attr);if (rc) goto sq_swq; - rc =bnxt_qplib_alloc_init_swq (rq); -if (rc) - goto fail_rq; +if (!rq->hwq.is_user) { + rc =bnxt_qplib_alloc_init_swq (rq); +if (rc) + goto fail_rq; + } req.rq_size =cpu_to_le32 (rq->max_wqe); pbl = &rq->hwq.pbl[PBL_LVL_0 ];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/156 RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kashyap Desai <[email protected]>
[ Upstream commit 064c22408a73b9e945139b64614c534cbbefb591 ]
The workaround to modify the UD QP from RTS to RTS is required only for older adapters. Issuing this for latest adapters can caus some unexpected behavior. Fix it
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +4 -2
@@ -2763,7 +2763,8 @@ static int bnxt_re_post_send_shadow_qp(struct bnxt_re_dev *rdev, wr = wr->next; }bnxt_qplib_post_send_db (&qp->qplib_qp); -bnxt_ud_qp_hw_stall_workaround (qp); +if (!bnxt_qplib_is_chip_gen_p5_p7 (qp->rdev->chip_ctx)) +bnxt_ud_qp_hw_stall_workaround (qp);spin_unlock_irqrestore (&qp->sq_lock, flags);return rc; }
@@ -2875,7 +2876,8 @@ int bnxt_re_post_send(struct ib_qp *ib_qp, const struct ib_send_wr *wr, wr = wr->next; }bnxt_qplib_post_send_db (&qp->qplib_qp); -bnxt_ud_qp_hw_stall_workaround (qp); +if (!bnxt_qplib_is_chip_gen_p5_p7 (qp->rdev->chip_ctx)) +bnxt_ud_qp_hw_stall_workaround (qp);spin_unlock_irqrestore (&qp->sq_lock, flags);return rc;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/156 RDMA/core: Fix ENODEV error for iWARP test over vlan
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anumula Murali Mohan Reddy <[email protected]>
[ Upstream commit a4048c83fd87c65657a4acb17d639092d4b6133d ]
If traffic is over vlan, cma_validate_port() fails to match net_device ifindex with bound_if_index and results in ENODEV error. As iWARP gid table is static, it contains entry corresponding to only one net device which is either real netdev or vlan netdev for cases like siw attached to a vlan interface.
This patch fixes the issue by assigning bound_if_index with net device index, if real net device obtained from bound if index matches with net device retrieved from gid table
--- drivers/infiniband/core/cma.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/infiniband/core/cma.c +16 -0
@@ -690,6 +690,7 @@ cma_validate_port(struct ib_device *device, u32 port,int bound_if_index = dev_addr->bound_dev_if;int dev_type = dev_addr->dev_type;struct net_device *ndev =NULL ; +struct net_device *pdev =NULL ;if (!rdma_dev_access_netns (device, id_priv->id.route.addr.dev_addr.net)) goto out;
@@ -714,6 +715,21 @@ cma_validate_port(struct ib_device *device, u32 port,rcu_read_lock (); ndev =rcu_dereference (sgid_attr->ndev); +if (ndev->ifindex != bound_if_index) { + pdev =dev_get_by_index_rcu (dev_addr->net, bound_if_index); +if (pdev) { +if (is_vlan_dev (pdev)) { + pdev =vlan_dev_real_dev (pdev); +if (ndev->ifindex == pdev->ifindex) + bound_if_index = pdev->ifindex; + } +if (is_vlan_dev (ndev)) { + pdev =vlan_dev_real_dev (ndev); +if (bound_if_index == pdev->ifindex) + bound_if_index = ndev->ifindex; + } + } + }if (!net_eq (dev_net (ndev), dev_addr->net) || ndev->ifindex != bound_if_index) {rdma_put_gid_attr (sgid_attr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/156 nvme-pci: 512 byte aligned dma pool segment quirk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Beckett <[email protected]>
[ Upstream commit ebefac5647968679f6ef5803e5d35a71997d20fa ]
We initially introduced a quick fix limiting the queue depth to 1 as experimentation showed that it fixed data corruption on 64GB steamdecks.
Further experimentation revealed corruption only happens when the last PRP data element aligns to the end of the page boundary. The device appears to treat this as a PRP chain to a new list instead of the data element that it actually is. This implementation is in violation of the spec. Encountering this errata with the Linux driver requires the host request a 128k transfer and coincidently be handed the last small pool dma buffer within a page.
The QD1 quirk effectly works around this because the last data PRP always was at a 248 byte offset from the page start, so it never appeared at the end of the page, but comes at the expense of throttling IO and wasting the remainder of the PRP page beyond 256 bytes. Also to note, the MDTS on these devices is small enough that the "large" prp pool can hold enough PRP elements to never reach the end, so that pool is not a problem either.
Introduce a new quirk to ensure the small pool is always aligned such that the last PRP element can't appear a the end of the page. This comes at the expense of wasting 256 bytes per small pool page allocated.
--- drivers/nvme/host/nvme.h | 5 +++++ drivers/nvme/host/pci.c | 9 +++++++-- 2 files changed, 12 insertions(+), 2 deletions(-)
drivers/nvme/host/nvme.h +5 -0
@@ -173,6 +173,11 @@ enum nvme_quirks {* MSI (but not MSI-X) interrupts are broken and never fire. */ NVME_QUIRK_BROKEN_MSI = (1 <<21 ), + +/* +* Align dma pool segment size to 512 bytes +*/ + NVME_QUIRK_DMAPOOL_ALIGN_512 = (1 << 22), };/*
drivers/nvme/host/pci.c +7 -2
@@ -2690,15 +2690,20 @@ static int nvme_disable_prepare_reset(struct nvme_dev *dev, bool shutdown)static int nvme_setup_prp_pools (struct nvme_dev *dev) { +size_t small_align =256 ; + dev->prp_page_pool =dma_pool_create ("prp list page" , dev->dev,NVME_CTRL_PAGE_SIZE ,NVME_CTRL_PAGE_SIZE ,0 );if (!dev->prp_page_pool)return -ENOMEM ; +if (dev->ctrl.quirks &NVME_QUIRK_DMAPOOL_ALIGN_512 ) + small_align =512 ; +/* Optimisation for I/Os between 4k and 128k */ dev->prp_small_pool =dma_pool_create ("prp list 256" , dev->dev, -256 ,256 ,0 ); +256 , small_align,0 );if (!dev->prp_small_pool) {dma_pool_destroy (dev->prp_page_pool);return -ENOMEM ;
@@ -3446,7 +3451,7 @@ static const struct pci_device_id nvme_id_table[] = { { PCI_VDEVICE(REDHAT, 0x0010), /* Qemu emulated controller */ .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1217, 0x8760), /* O2 Micro 64GB Steam Deck */ - .driver_data = NVME_QUIRK_QDEPTH_ONE }, + .driver_data = NVME_QUIRK_DMAPOOL_ALIGN_512, }, { PCI_DEVICE(0x126f, 0x2262), /* Silicon Motion generic */ .driver_data = NVME_QUIRK_NO_DEEPEST_PS | NVME_QUIRK_BOGUS_NID, },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/156 wifi: iwlwifi: fix CRF name for Bz
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 0e8c52091633b354b12d0c29a27a22077584c111 ]
We had BE201 hard coded.
Look at the RF_ID and decide based on its value.
--- drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 1 + .../net/wireless/intel/iwlwifi/iwl-config.h | 1 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 37 ++++++++++++++++++- 3 files changed, 38 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/cfg/bz.c +1 -0
@@ -161,6 +161,7 @@ const struct iwl_cfg_trans_params iwl_gl_trans_cfg = {const char iwl_bz_name[] ="Intel(R) TBD Bz device" ;const char iwl_fm_name[] ="Intel(R) Wi-Fi 7 BE201 320MHz" ; +const char iwl_wh_name[] ="Intel(R) Wi-Fi 7 BE211 320MHz" ;const char iwl_gl_name[] ="Intel(R) Wi-Fi 7 BE200 320MHz" ;const char iwl_mtp_name[] ="Intel(R) Wi-Fi 7 BE202 160MHz" ;
drivers/net/wireless/intel/iwlwifi/iwl-config.h +1 -0
@@ -545,6 +545,7 @@ extern const char iwl_ax231_name[];extern const char iwl_ax411_name[];extern const char iwl_bz_name[];extern const char iwl_fm_name[]; +extern const char iwl_wh_name[];extern const char iwl_gl_name[];extern const char iwl_mtp_name[];extern const char iwl_sc_name[];
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +36 -1
@@ -1106,19 +1106,54 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct iwl_dev_info iwl_dev_info_table[] = { iwlax210_2ax_cfg_so_jf_b0, iwl9462_name),/* Bz */ -/* FIXME: need to change the naming according to the actual CRF */ _IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_MAC_TYPE_BZ ,IWL_CFG_ANY , +IWL_CFG_RF_TYPE_HR2 ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , + iwl_cfg_bz, iwl_ax201_name), + +_IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_MAC_TYPE_BZ ,IWL_CFG_ANY , +IWL_CFG_RF_TYPE_GF ,IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , + iwl_cfg_bz, iwl_ax211_name), + +_IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_MAC_TYPE_BZ ,IWL_CFG_ANY , +IWL_CFG_RF_TYPE_FM ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , iwl_cfg_bz, iwl_fm_name), +_IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_MAC_TYPE_BZ ,IWL_CFG_ANY , +IWL_CFG_RF_TYPE_WH ,IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , + iwl_cfg_bz, iwl_wh_name), +_IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_MAC_TYPE_BZ_W ,IWL_CFG_ANY , +IWL_CFG_RF_TYPE_HR2 ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , + iwl_cfg_bz, iwl_ax201_name), + +_IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_MAC_TYPE_BZ_W ,IWL_CFG_ANY , +IWL_CFG_RF_TYPE_GF ,IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , + iwl_cfg_bz, iwl_ax211_name), + +_IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_MAC_TYPE_BZ_W ,IWL_CFG_ANY , +IWL_CFG_RF_TYPE_FM ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , iwl_cfg_bz, iwl_fm_name), +_IWL_DEV_INFO (IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_MAC_TYPE_BZ_W ,IWL_CFG_ANY , +IWL_CFG_RF_TYPE_WH ,IWL_CFG_ANY ,IWL_CFG_ANY , +IWL_CFG_ANY ,IWL_CFG_ANY ,IWL_CFG_ANY , + iwl_cfg_bz, iwl_wh_name), +/* Ga (Gl) */ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_MAC_TYPE_GL, IWL_CFG_ANY,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/156 RDMA/bnxt_re: Fix the check for 9060 condition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit 38651476e46e088598354510502c383e932e2297 ]
The check for 9060 condition should only be made for legacy chips.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +6 -4
@@ -2598,10 +2598,12 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,bnxt_qplib_add_flush_qp (qp); }else {/* Before we complete, do WA 9060 */ -if (do_wa9060 (qp, cq, cq_cons, sq->swq_last, - cqe_sq_cons)) { - *lib_qp = qp; - goto out; +if (!bnxt_qplib_is_chip_gen_p5_p7 (qp->cctx)) { +if (do_wa9060 (qp, cq, cq_cons, sq->swq_last, + cqe_sq_cons)) { + *lib_qp = qp; + goto out; + } }if (swq->flags &SQ_SEND_FLAGS_SIGNAL_COMP ) { cqe->status =CQ_REQ_STATUS_OK ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/156 RDMA/bnxt_re: Add check for path mtu in modify_qp
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravanan Vajravel <[email protected]>
[ Upstream commit 798653a0ee30d3cd495099282751c0f248614ae7 ]
When RDMA app configures path MTU, add a check in modify_qp verb to make sure that it doesn't go beyond interface MTU. If this check fails, driver will fail the modify_qp verb.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 26 +++++++++++++----------- 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +14 -12
@@ -2107,18 +2107,20 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, } } -if (qp_attr_mask &IB_QP_PATH_MTU ) { - qp->qplib_qp.modify_flags |= -CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU ; - qp->qplib_qp.path_mtu =__from_ib_mtu (qp_attr->path_mtu); - qp->qplib_qp.mtu =ib_mtu_enum_to_int (qp_attr->path_mtu); - }else if (qp_attr->qp_state ==IB_QPS_RTR ) { - qp->qplib_qp.modify_flags |= -CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU ; - qp->qplib_qp.path_mtu = -__from_ib_mtu (iboe_get_mtu (rdev->netdev->mtu)); - qp->qplib_qp.mtu = -ib_mtu_enum_to_int (iboe_get_mtu (rdev->netdev->mtu)); +if (qp_attr->qp_state ==IB_QPS_RTR ) { +enum ib_mtu qpmtu; + + qpmtu =iboe_get_mtu (rdev->netdev->mtu); +if (qp_attr_mask &IB_QP_PATH_MTU ) { +if (ib_mtu_enum_to_int (qp_attr->path_mtu) > +ib_mtu_enum_to_int (qpmtu)) +return -EINVAL ; + qpmtu = qp_attr->path_mtu; + } + + qp->qplib_qp.modify_flags |=CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU ; + qp->qplib_qp.path_mtu =__from_ib_mtu (qpmtu); + qp->qplib_qp.mtu =ib_mtu_enum_to_int (qpmtu); }if (qp_attr_mask &IB_QP_TIMEOUT ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/156 RDMA/bnxt_re: Fix reporting hw_ver in query_device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit 7179fe0074a3c962e43a9e51169304c4911989ed ]
Driver currently populates subsystem_device id in the "hw_ver" field of ib_attr structure in query_device.
Updated to populate PCI revision ID.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +1 -1
@@ -156,7 +156,7 @@ int bnxt_re_query_device(struct ib_device *ibdev, ib_attr->vendor_id = rdev->en_dev->pdev->vendor; ib_attr->vendor_part_id = rdev->en_dev->pdev->device; - ib_attr->hw_ver = rdev->en_dev->pdev->subsystem_device; + ib_attr->hw_ver = rdev->en_dev->pdev->revision; ib_attr->max_qp = dev_attr->max_qp; ib_attr->max_qp_wr = dev_attr->max_qp_wqes; ib_attr->device_cap_flags =
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/156 RDMA/nldev: Set error code in rdma_nl_notify_event
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chiara Meiohas <[email protected]>
[ Upstream commit 13a6691910cc23ea9ba4066e098603088673d5b0 ]
In case of error set the error code before the goto.
--- drivers/infiniband/core/nldev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/nldev.c +1 -1
@@ -2802,8 +2802,8 @@ int rdma_nl_notify_event(struct ib_device *device, u32 port_num, enum rdma_nl_notify_event_type type) {struct sk_buff *skb; +int ret = -EMSGSIZE ;struct net *net; -int ret =0 ;void *nlh; net =read_pnet (&device->coredev.rdma_net);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/156 RDMA/siw: Remove direct link to net_device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernard Metzler <[email protected]>
[ Upstream commit 16b87037b48889d21854c8e97aec8a1baf2642b3 ]
Do not manage a per device direct link to net_device. Rely on associated ib_devices net_device management, not doubling the effort locally. A badly managed local link to net_device was causing a 'KASAN: slab-use-after-free' exception during siw_query_port() call.
--- drivers/infiniband/sw/siw/siw.h | 7 +++--- drivers/infiniband/sw/siw/siw_cm.c | 27 ++++++++++++++++----- drivers/infiniband/sw/siw/siw_main.c | 15 +----------- drivers/infiniband/sw/siw/siw_verbs.c | 35 ++++++++++++++++++--------- 4 files changed, 49 insertions(+), 35 deletions(-)
drivers/infiniband/sw/siw/siw.h +3 -4
@@ -46,6 +46,9 @@*/ #define SIW_IRQ_MAXBURST_SQ_ACTIVE 4 +/* There is always only a port 1 per siw device */ +#define SIW_PORT 1 +struct siw_dev_cap {int max_qp;int max_qp_wr;
@@ -69,16 +72,12 @@ struct siw_pd {struct siw_device {struct ib_device base_dev; -struct net_device *netdev;struct siw_dev_cap attrs;u32 vendor_part_id;int numa_node;char raw_gid[ETH_ALEN ]; -/* physical port state (only one port per device) */ -enum ib_port_state state; -spinlock_t lock;struct xarray qp_xa;
drivers/infiniband/sw/siw/siw_cm.c +21 -6
@@ -1759,6 +1759,7 @@ int siw_create_listen(struct iw_cm_id *id, int backlog) {struct socket *s;struct siw_cep *cep =NULL ; +struct net_device *ndev =NULL ;struct siw_device *sdev =to_siw_dev (id->device);int addr_family = id->local_addr.ss_family;int rv =0 ;
@@ -1779,9 +1780,15 @@ int siw_create_listen(struct iw_cm_id *id, int backlog)struct sockaddr_in *laddr = &to_sockaddr_in (id->local_addr);/* For wildcard addr, limit binding to current device only */ -if (ipv4_is_zeronet (laddr->sin_addr.s_addr)) - s->sk->sk_bound_dev_if = sdev->netdev->ifindex; - +if (ipv4_is_zeronet (laddr->sin_addr.s_addr)) { + ndev =ib_device_get_netdev (id->device,SIW_PORT ); +if (ndev) { + s->sk->sk_bound_dev_if = ndev->ifindex; + }else { + rv = -ENODEV ; + goto error; + } + } rv = s->ops->bind (s, (struct sockaddr *)laddr,sizeof (struct sockaddr_in )); }else {
@@ -1797,9 +1804,15 @@ int siw_create_listen(struct iw_cm_id *id, int backlog) }/* For wildcard addr, limit binding to current device only */ -if (ipv6_addr_any (&laddr->sin6_addr)) - s->sk->sk_bound_dev_if = sdev->netdev->ifindex; - +if (ipv6_addr_any (&laddr->sin6_addr)) { + ndev =ib_device_get_netdev (id->device,SIW_PORT ); +if (ndev) { + s->sk->sk_bound_dev_if = ndev->ifindex; + }else { + rv = -ENODEV ; + goto error; + } + } rv = s->ops->bind (s, (struct sockaddr *)laddr,sizeof (struct sockaddr_in6 )); }
@@ -1860,6 +1873,7 @@ int siw_create_listen(struct iw_cm_id *id, int backlog) }list_add_tail (&cep->listenq, (struct list_head *)id->provider_data); cep->state =SIW_EPSTATE_LISTENING ; +dev_put (ndev);siw_dbg (id->device,"Listen at laddr %pISp\n" , &id->local_addr);
@@ -1879,6 +1893,7 @@ int siw_create_listen(struct iw_cm_id *id, int backlog)siw_cep_set_free_and_put (cep); }sock_release (s); +dev_put (ndev);return rv; }
drivers/infiniband/sw/siw/siw_main.c +1 -14
@@ -287,7 +287,6 @@ static struct siw_device *siw_device_create(struct net_device *netdev)return NULL ; base_dev = &sdev->base_dev; - sdev->netdev = netdev;if (netdev->addr_len) { memcpy(sdev->raw_gid, netdev->dev_addr,
@@ -381,12 +380,10 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event,switch (event) {case NETDEV_UP : - sdev->state =IB_PORT_ACTIVE ;siw_port_event (sdev,1 ,IB_EVENT_PORT_ACTIVE );break ;case NETDEV_DOWN : - sdev->state =IB_PORT_DOWN ;siw_port_event (sdev,1 ,IB_EVENT_PORT_ERR );break ;
@@ -407,12 +404,8 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event,siw_port_event (sdev,1 ,IB_EVENT_LID_CHANGE );break ;/* -* Todo: Below netdev events are currently not handled. +* All other events are not handled */ -case NETDEV_CHANGEMTU : -case NETDEV_CHANGE : -break ; -default :break ; }
@@ -442,12 +435,6 @@ static int siw_newlink(const char *basedev_name, struct net_device *netdev) sdev =siw_device_create (netdev);if (sdev) {dev_dbg (&netdev->dev,"siw: new device\n" ); - -if (netif_running (netdev) &&netif_carrier_ok (netdev)) - sdev->state =IB_PORT_ACTIVE ; -else - sdev->state =IB_PORT_DOWN ; -ib_mark_name_assigned_by_user (&sdev->base_dev); rv =siw_device_register (sdev, basedev_name);if (rv)
drivers/infiniband/sw/siw/siw_verbs.c +24 -11
@@ -171,21 +171,29 @@ int siw_query_device(struct ib_device *base_dev, struct ib_device_attr *attr,int siw_query_port (struct ib_device *base_dev,u32 port,struct ib_port_attr *attr) { -struct siw_device *sdev =to_siw_dev (base_dev); +struct net_device *ndev;int rv;memset (attr,0 ,sizeof (*attr)); rv =ib_get_eth_speed (base_dev, port, &attr->active_speed, &attr->active_width); +if (rv) +return rv; + + ndev =ib_device_get_netdev (base_dev,SIW_PORT ); +if (!ndev) +return -ENODEV ; + attr->gid_tbl_len =1 ; attr->max_msg_sz =-1 ; - attr->max_mtu =ib_mtu_int_to_enum (sdev->netdev->mtu); - attr->active_mtu =ib_mtu_int_to_enum (sdev->netdev->mtu); - attr->phys_state = sdev->state ==IB_PORT_ACTIVE ? + attr->max_mtu =ib_mtu_int_to_enum (ndev->max_mtu); + attr->active_mtu =ib_mtu_int_to_enum (READ_ONCE (ndev->mtu)); + attr->phys_state = (netif_running (ndev) &&netif_carrier_ok (ndev)) ?IB_PORT_PHYS_STATE_LINK_UP :IB_PORT_PHYS_STATE_DISABLED ; + attr->state = attr->phys_state ==IB_PORT_PHYS_STATE_LINK_UP ? +IB_PORT_ACTIVE :IB_PORT_DOWN ; attr->port_cap_flags =IB_PORT_CM_SUP |IB_PORT_DEVICE_MGMT_SUP ; - attr->state = sdev->state;/* * All zero *
@@ -199,6 +207,7 @@ int siw_query_port(struct ib_device *base_dev, u32 port,* attr->subnet_timeout = 0; * attr->init_type_repy = 0; */ +dev_put (ndev);return rv; }
@@ -505,21 +514,24 @@ int siw_query_qp(struct ib_qp *base_qp, struct ib_qp_attr *qp_attr, int qp_attr_mask, struct ib_qp_init_attr *qp_init_attr) { struct siw_qp *qp; -struct siw_device *sdev; +struct net_device *ndev; -if (base_qp && qp_attr && qp_init_attr) { +if (base_qp && qp_attr && qp_init_attr) qp =to_siw_qp (base_qp); - sdev =to_siw_dev (base_qp->device); - }else { +else return -EINVAL ; - } + + ndev =ib_device_get_netdev (base_qp->device,SIW_PORT ); +if (!ndev) +return -ENODEV ; + qp_attr->qp_state = siw_qp_state_to_ib_qp_state[qp->attrs.state]; qp_attr->cap.max_inline_data =SIW_MAX_INLINE ; qp_attr->cap.max_send_wr = qp->attrs.sq_size; qp_attr->cap.max_send_sge = qp->attrs.sq_max_sges; qp_attr->cap.max_recv_wr = qp->attrs.rq_size; qp_attr->cap.max_recv_sge = qp->attrs.rq_max_sges; - qp_attr->path_mtu =ib_mtu_int_to_enum (sdev->netdev->mtu); + qp_attr->path_mtu =ib_mtu_int_to_enum (READ_ONCE (ndev->mtu)); qp_attr->max_rd_atomic = qp->attrs.irq_size; qp_attr->max_dest_rd_atomic = qp->attrs.orq_size;
@@ -534,6 +546,7 @@ int siw_query_qp(struct ib_qp *base_qp, struct ib_qp_attr *qp_attr, qp_init_attr->cap = qp_attr->cap; +dev_put (ndev);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/156 RDMA/bnxt_re: Fix max_qp_wrs reported
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <[email protected]>
[ Upstream commit 40be32303ec829ea12f9883e499bfd3fe9e52baf ]
While creating qps, driver adds one extra entry to the sq size passed by the ULPs in order to avoid queue full condition. When ULPs creates QPs with max_qp_wr reported, driver creates QP with 1 more than the max_wqes supported by HW. Create QP fails in this case. To avoid this error, reduce 1 entry in max_qp_wqes and report it to the stack.
--- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/qplib_sp.c +1 -1
@@ -129,7 +129,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, attr->max_qp_init_rd_atom = sb->max_qp_init_rd_atom >BNXT_QPLIB_MAX_OUT_RD_ATOM ?BNXT_QPLIB_MAX_OUT_RD_ATOM : sb->max_qp_init_rd_atom; - attr->max_qp_wqes =le16_to_cpu (sb->max_qp_wr); + attr->max_qp_wqes =le16_to_cpu (sb->max_qp_wr) -1 ;/* * 128 WQEs needs to be reserved for the HW (8916). Prevent * reporting the max number
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/156 RDMA/bnxt_re: Disable use of reserved wqes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit d5a38bf2f35979537c526acbc56bc435ed40685f ]
Disabling the reserved wqes logic for Gen P5/P7 devices because this workaround is required only for legacy devices.
--- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_sp.c +7 -5
@@ -130,11 +130,13 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, sb->max_qp_init_rd_atom >BNXT_QPLIB_MAX_OUT_RD_ATOM ?BNXT_QPLIB_MAX_OUT_RD_ATOM : sb->max_qp_init_rd_atom; attr->max_qp_wqes =le16_to_cpu (sb->max_qp_wr) -1 ; -/* -* 128 WQEs needs to be reserved for the HW (8916). Prevent -* reporting the max number -*/ - attr->max_qp_wqes -=BNXT_QPLIB_RESERVED_QP_WRS +1 ; +if (!bnxt_qplib_is_chip_gen_p5_p7 (rcfw->res->cctx)) { +/* +* 128 WQEs needs to be reserved for the HW (8916). Prevent +* reporting the max number on legacy devices +*/ + attr->max_qp_wqes -=BNXT_QPLIB_RESERVED_QP_WRS +1 ; + } attr->max_qp_sges = cctx->modes.wqe_mode ==BNXT_QPLIB_WQE_MODE_VARIABLE ?min_t (u32, sb->max_sge_var_wqe,BNXT_VAR_MAX_SGE ) :6 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/156 RDMA/bnxt_re: Add send queue size check for variable wqe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damodharam Ammepalli <[email protected]>
[ Upstream commit d13be54dc18baee7a3e44349b80755a8c8205d3f ]
For the fixed WQE case, HW supports 0xFFFF WQEs. For variable Size WQEs, HW treats this number as the 16 bytes slots. The maximum supported WQEs needs to be adjusted based on the number of slots. Set a maximum WQE limit for variable WQE scenario.
--- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/infiniband/hw/bnxt_re/qplib_sp.c +4 -0
@@ -138,6 +138,10 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, attr->max_qp_wqes -=BNXT_QPLIB_RESERVED_QP_WRS +1 ; } +/* Adjust for max_qp_wqes for variable wqe */ +if (cctx->modes.wqe_mode ==BNXT_QPLIB_WQE_MODE_VARIABLE ) + attr->max_qp_wqes =BNXT_VAR_MAX_WQE -1 ; + attr->max_qp_sges = cctx->modes.wqe_mode ==BNXT_QPLIB_WQE_MODE_VARIABLE ?min_t (u32, sb->max_sge_var_wqe,BNXT_VAR_MAX_SGE ) :6 ; attr->max_cq =le32_to_cpu (sb->max_cq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/156 RDMA/bnxt_re: Fix MSN table size for variable wqe mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damodharam Ammepalli <[email protected]>
[ Upstream commit bb839f3ace0fee532a0487b692cc4d868fccb7cf ]
For variable size wqe mode, the MSN table size should be half the size of the SQ depth. Fixing this to avoid wrap around problems in the retransmission path.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +6 -1
@@ -1032,7 +1032,12 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) : 0;/* Update msn tbl size */ if (qp->is_host_msn_tbl && psn_sz) { - hwq_attr.aux_depth =roundup_pow_of_two (bnxt_qplib_set_sq_size (sq, qp->wqe_mode)); +if (qp->wqe_mode ==BNXT_QPLIB_WQE_MODE_STATIC ) + hwq_attr.aux_depth = +roundup_pow_of_two (bnxt_qplib_set_sq_size (sq, qp->wqe_mode)); +else + hwq_attr.aux_depth = +roundup_pow_of_two (bnxt_qplib_set_sq_size (sq, qp->wqe_mode)) /2 ; qp->msn_tbl_sz = hwq_attr.aux_depth; qp->msn =0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/156 RDMA/bnxt_re: Fix the locking while accessing the QP table
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <[email protected]>
[ Upstream commit 9272cba0ded71b5a2084da3004ec7806b8cb7fd2 ]
QP table handling is synchronized with destroy QP and Async event from the HW. The same needs to be synchronized during create_qp also. Use the same lock in create_qp also.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +2 -0
@@ -1180,9 +1180,11 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) rq->dbinfo.db = qp->dpi->dbr; rq->dbinfo.max_slot =bnxt_qplib_set_rq_max_slot (rq->wqe_size); } +spin_lock_bh (&rcfw->tbl_lock); tbl_indx =map_qp_id_to_tbl_indx (qp->id, rcfw); rcfw->qp_tbl[tbl_indx].qp_id = qp->id; rcfw->qp_tbl[tbl_indx].qp_handle = (void *)qp; +spin_unlock_bh (&rcfw->tbl_lock);return 0 ; fail:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/156 net: phy: micrel: Dynamically control external clock of KSZ PHY
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 25c6a5ab151fb9c886552bf5aa7cbf2a5c6e96af ]
On the i.MX6ULL-14x14-EVK board, enet1_ref and enet2_ref are used as the clock sources for two external KSZ PHYs. However, after closing the two FEC ports, the clk_enable_count of the enet1_ref and enet2_ref clocks is not 0. The root cause is that since the commit 985329462723 ("net: phy:
micrel: use devm_clk_get_optional_enabled for the rmii-ref clock"), the external clock of KSZ PHY has been enabled when the PHY driver probes, and it can only be disabled when the PHY driver is removed. This causes the clock to continue working when the system is suspended or the network port is down.
Although Heiko explained in the commit message that the patch was because some clock suppliers need to enable the clock to get the valid clock rate , it seems that the simple fix is to disable the clock after getting the clock rate to solve the current problem. This is indeed true, but we need to admit that Heiko's patch has been applied for more than a year, and we cannot guarantee whether there are platforms that only enable rmii-ref in the KSZ PHY driver during this period. If this is the case, disabling rmii-ref will cause RMII on these platforms to not work.
Secondly, commit 99ac4cbcc2a5 ("net: phy: micrel: allow usage of generic ethernet-phy clock") just simply enables the generic clock permanently, which seems like the generic clock may only be enabled in the PHY driver. If we simply disable the generic clock, RMII may not work. If we keep it as it is, the platform using the generic clock will have the same problem as the i.MX6ULL platform.
To solve this problem, the clock is enabled when phy_driver::resume() is called, and the clock is disabled when phy_driver::suspend() is called. Since phy_driver::resume() and phy_driver::suspend() are not called in pairs, an additional clk_enable flag is added. When phy_driver::suspend() is called, the clock is disabled only if clk_enable is true. Conversely, when phy_driver::resume() is called, the clock is enabled if clk_enable is false.
The changes that introduced the problem were only a few lines, while the current fix is about a hundred lines, which seems out of proportion, but it is necessary because kszphy_probe() is used by multiple KSZ PHYs and we need to fix all of them.
--- drivers/net/phy/micrel.c | 114 ++++++++++++++++++++++++++++++++++----- 1 file changed, 101 insertions(+), 13 deletions(-)
drivers/net/phy/micrel.c +101 -13
@@ -432,10 +432,12 @@ struct kszphy_ptp_priv {struct kszphy_priv {struct kszphy_ptp_priv ptp_priv;const struct kszphy_type *type; +struct clk *clk;int led_mode;u16 vct_ctrl1000;bool rmii_ref_clk_sel;bool rmii_ref_clk_sel_val; +bool clk_enable;u64 stats[ARRAY_SIZE (kszphy_hw_stats)]; };
@@ -2052,6 +2054,46 @@ static void kszphy_get_stats(struct phy_device *phydev, data[i] =kszphy_get_stat (phydev, i); } +static void kszphy_enable_clk (struct phy_device *phydev) +{ +struct kszphy_priv *priv = phydev->priv; + +if (!priv->clk_enable && priv->clk) { +clk_prepare_enable (priv->clk); + priv->clk_enable = true; + } +} + +static void kszphy_disable_clk (struct phy_device *phydev) +{ +struct kszphy_priv *priv = phydev->priv; + +if (priv->clk_enable && priv->clk) { +clk_disable_unprepare (priv->clk); + priv->clk_enable = false; + } +} + +static int kszphy_generic_resume (struct phy_device *phydev) +{ +kszphy_enable_clk (phydev); + +return genphy_resume (phydev); +} + +static int kszphy_generic_suspend (struct phy_device *phydev) +{ +int ret; + + ret =genphy_suspend (phydev); +if (ret) +return ret; + +kszphy_disable_clk (phydev); + +return 0 ; +} +static int kszphy_suspend (struct phy_device *phydev) {/* Disable PHY Interrupts */
@@ -2061,7 +2103,7 @@ static int kszphy_suspend(struct phy_device *phydev) phydev->drv->config_intr (phydev); } -return genphy_suspend (phydev); +return kszphy_generic_suspend (phydev); }static void kszphy_parse_led_mode (struct phy_device *phydev)
@@ -2092,7 +2134,9 @@ static int kszphy_resume(struct phy_device *phydev) {int ret; -genphy_resume (phydev); + ret =kszphy_generic_resume (phydev); +if (ret) +return ret;/* After switching from power-down to normal mode, an internal global * reset is automatically generated. Wait a minimum of 1 ms before
@@ -2114,6 +2158,24 @@ static int kszphy_resume(struct phy_device *phydev)return 0 ; } +/* Because of errata DS80000700A, receiver error following software +* power down. Suspend and resume callbacks only disable and enable +* external rmii reference clock. +*/ +static int ksz8041_resume (struct phy_device *phydev) +{ +kszphy_enable_clk (phydev); + +return 0 ; +} + +static int ksz8041_suspend (struct phy_device *phydev) +{ +kszphy_disable_clk (phydev); + +return 0 ; +} +static int ksz9477_resume (struct phy_device *phydev) {int ret;
@@ -2161,7 +2223,10 @@ static int ksz8061_resume(struct phy_device *phydev)if (!(ret &BMCR_PDOWN ))return 0 ; -genphy_resume (phydev); + ret =kszphy_generic_resume (phydev); +if (ret) +return ret; +usleep_range (1000 ,2000 );/* Re-program the value after chip is reset. */
@@ -2179,6 +2244,11 @@ static int ksz8061_resume(struct phy_device *phydev)return 0 ; } +static int ksz8061_suspend (struct phy_device *phydev) +{ +return kszphy_suspend (phydev); +} +static int kszphy_probe (struct phy_device *phydev) {const struct kszphy_type *type = phydev->drv->driver_data;
@@ -2219,10 +2289,14 @@ static int kszphy_probe(struct phy_device *phydev) }else if (!clk) {/* unnamed clock from the generic ethernet-phy binding */ clk =devm_clk_get_optional_enabled (&phydev->mdio.dev,NULL ); -if (IS_ERR (clk)) -return PTR_ERR (clk); } +if (IS_ERR (clk)) +return PTR_ERR (clk); + +clk_disable_unprepare (clk); + priv->clk = clk; +if (ksz8041_fiber_mode (phydev)) phydev->port =PORT_FIBRE ;
@@ -5292,6 +5366,21 @@ static int lan8841_probe(struct phy_device *phydev)return 0 ; } +static int lan8804_resume (struct phy_device *phydev) +{ +return kszphy_resume (phydev); +} + +static int lan8804_suspend (struct phy_device *phydev) +{ +return kszphy_generic_suspend (phydev); +} + +static int lan8841_resume (struct phy_device *phydev) +{ +return kszphy_generic_resume (phydev); +} +static int lan8841_suspend (struct phy_device *phydev) {struct kszphy_priv *priv = phydev->priv;
@@ -5300,7 +5389,7 @@ static int lan8841_suspend(struct phy_device *phydev)if (ptp_priv->ptp_clock)ptp_cancel_worker_sync (ptp_priv->ptp_clock); -return genphy_suspend (phydev); +return kszphy_generic_suspend (phydev); }static struct phy_driver ksphy_driver[] = {
@@ -5360,9 +5449,8 @@ static struct phy_driver ksphy_driver[] = { .get_sset_count = kszphy_get_sset_count, .get_strings = kszphy_get_strings, .get_stats = kszphy_get_stats, -/* No suspend/resume callbacks because of errata DS80000700A, -* receiver error following software power down. -*/ + .suspend = ksz8041_suspend, + .resume = ksz8041_resume, }, { .phy_id = PHY_ID_KSZ8041RNLI, .phy_id_mask = MICREL_PHY_ID_MASK,
@@ -5438,7 +5526,7 @@ static struct phy_driver ksphy_driver[] = { .soft_reset = genphy_soft_reset, .config_intr = kszphy_config_intr, .handle_interrupt = kszphy_handle_interrupt, - .suspend = kszphy_suspend, + .suspend = ksz8061_suspend, .resume = ksz8061_resume, }, { .phy_id = PHY_ID_KSZ9021,
@@ -5509,8 +5597,8 @@ static struct phy_driver ksphy_driver[] = { .get_sset_count = kszphy_get_sset_count, .get_strings = kszphy_get_strings, .get_stats = kszphy_get_stats, - .suspend = genphy_suspend, - .resume = kszphy_resume, + .suspend = lan8804_suspend, + .resume = lan8804_resume, .config_intr = lan8804_config_intr, .handle_interrupt = lan8804_handle_interrupt, }, {
@@ -5528,7 +5616,7 @@ static struct phy_driver ksphy_driver[] = { .get_strings = kszphy_get_strings, .get_stats = kszphy_get_stats, .suspend = lan8841_suspend, - .resume = genphy_resume, + .resume = lan8841_resume, .cable_test_start = lan8814_cable_test_start, .cable_test_get_status = ksz886x_cable_test_get_status, }, {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/156 drm/bridge: adv7511_audio: Update Audio InfoFrame properly
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Ekenberg <[email protected]>
[ Upstream commit 902806baf3c1e8383c1fe3ff0b6042b8cb5c2707 ]
AUDIO_UPDATE bit (Bit 5 of MAIN register 0x4A) needs to be set to 1 while updating Audio InfoFrame information and then set to 0 when done. Otherwise partially updated Audio InfoFrames could be sent out. Two cases where this rule were not followed are fixed:
- In adv7511_hdmi_hw_params() make sure AUDIO_UPDATE bit is updated before/after setting ADV7511_REG_AUDIO_INFOFRAME.
- In audio_startup() use the correct register for clearing AUDIO_UPDATE bit.
The problem with corrupted audio infoframes were discovered by letting a HDMI logic analyser check the output of ADV7535.
Note that this patchs replaces writing REG_GC(1) with REG_INFOFRAME_UPDATE. Bit 5 of REG_GC(1) is positioned within field GC_PP[3:0] and that field doesn't control audio infoframe and is read- only. My conclusion therefore was that the author if this code meant to clear bit 5 of REG_INFOFRAME_UPDATE from the very beginning.
--- drivers/gpu/drm/bridge/adv7511/adv7511_audio.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_audio.c +12 -2
@@ -153,7 +153,16 @@ static int adv7511_hdmi_hw_params(struct device *dev, void *data, ADV7511_AUDIO_CFG3_LEN_MASK, len);regmap_update_bits (adv7511->regmap,ADV7511_REG_I2C_FREQ_ID_CFG ,ADV7511_I2C_FREQ_ID_CFG_RATE_MASK , rate <<4 ); -regmap_write (adv7511->regmap,0x73 ,0x1 ); + +/* send current Audio infoframe values while updating */ +regmap_update_bits (adv7511->regmap,ADV7511_REG_INFOFRAME_UPDATE , +BIT (5 ),BIT (5 )); + +regmap_write (adv7511->regmap,ADV7511_REG_AUDIO_INFOFRAME (0 ),0x1 ); + +/* use Audio infoframe updated info */ +regmap_update_bits (adv7511->regmap,ADV7511_REG_INFOFRAME_UPDATE , +BIT (5 ),0 );return 0 ; }
@@ -184,8 +193,9 @@ static int audio_startup(struct device *dev, void *data)regmap_update_bits (adv7511->regmap,ADV7511_REG_GC (0 ),BIT (7 ) |BIT (6 ),BIT (7 ));/* use Audio infoframe updated info */ -regmap_update_bits (adv7511->regmap,ADV7511_REG_GC (1 ), +regmap_update_bits (adv7511->regmap,ADV7511_REG_INFOFRAME_UPDATE ,BIT (5 ),0 ); +/* enable SPDIF receiver */ if (adv7511->audio_source ==ADV7511_AUDIO_SOURCE_SPDIF ) regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/156 net: dsa: microchip: Fix KSZ9477 set_ageing_time function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristram Ha <[email protected]>
[ Upstream commit 262bfba8ab820641c8cfbbf03b86d6c00242c078 ]
The aging count is not a simple 11-bit value but comprises a 3-bit multiplier and an 8-bit second count. The code tries to use the original multiplier which is 4 as the second count is still 300 seconds by default.
--- drivers/net/dsa/microchip/ksz9477.c | 47 +++++++++++++++++++------ drivers/net/dsa/microchip/ksz9477_reg.h | 4 +-- 2 files changed, 37 insertions(+), 14 deletions(-)
drivers/net/dsa/microchip/ksz9477.c +36 -11
@@ -2,7 +2,7 @@/* * Microchip KSZ9477 switch driver main logic * -* Copyright (C) 2017-2019 Microchip Technology Inc. +* Copyright (C) 2017-2024 Microchip Technology Inc. */ #include <linux/kernel.h>
@@ -983,26 +983,51 @@ void ksz9477_get_caps(struct ksz_device *dev, int port,int ksz9477_set_ageing_time (struct ksz_device *dev,unsigned int msecs) {u32 secs = msecs /1000 ; -u8 value; -u8 data; +u8 data, mult, value; +u32 max_val;int ret; - value =FIELD_GET (SW_AGE_PERIOD_7_0_M , secs); +#define MAX_TIMER_VAL ((1 << 8) - 1) - ret =ksz_write8 (dev,REG_SW_LUE_CTRL_3 , value); -if (ret <0 ) -return ret; +/* The aging timer comprises a 3-bit multiplier and an 8-bit second +* value. Either of them cannot be zero. The maximum timer is then +* 7 * 255 = 1785 seconds. +*/ +if (!secs) + secs =1 ; - data =FIELD_GET (SW_AGE_PERIOD_10_8_M , secs); +/* Return error if too large. */ +else if (secs >7 *MAX_TIMER_VAL ) +return -EINVAL ; ret =ksz_read8 (dev,REG_SW_LUE_CTRL_0 , &value);if (ret <0 )return ret; - value &= ~SW_AGE_CNT_M ; - value |=FIELD_PREP (SW_AGE_CNT_M , data); +/* Check whether there is need to update the multiplier. */ + mult =FIELD_GET (SW_AGE_CNT_M , value); + max_val =MAX_TIMER_VAL ; +if (mult >0 ) { +/* Try to use the same multiplier already in the register as +* the hardware default uses multiplier 4 and 75 seconds for +* 300 seconds. +*/ + max_val =DIV_ROUND_UP (secs, mult); +if (max_val >MAX_TIMER_VAL || max_val * mult != secs) + max_val =MAX_TIMER_VAL ; + } + + data =DIV_ROUND_UP (secs, max_val); +if (mult != data) { + value &= ~SW_AGE_CNT_M ; + value |=FIELD_PREP (SW_AGE_CNT_M , data); + ret =ksz_write8 (dev,REG_SW_LUE_CTRL_0 , value); +if (ret <0 ) +return ret; + } -return ksz_write8 (dev,REG_SW_LUE_CTRL_0 , value); + value =DIV_ROUND_UP (secs, data); +return ksz_write8 (dev,REG_SW_LUE_CTRL_3 , value); }void ksz9477_port_queue_split (struct ksz_device *dev,int port)
drivers/net/dsa/microchip/ksz9477_reg.h +1 -3
@@ -2,7 +2,7 @@/* * Microchip KSZ9477 register definitions * -* Copyright (C) 2017-2018 Microchip Technology Inc. +* Copyright (C) 2017-2024 Microchip Technology Inc. */ #ifndef __KSZ9477_REGS_H
@@ -165,8 +165,6 @@#define SW_VLAN_ENABLE BIT(7)#define SW_DROP_INVALID_VID BIT(6)#define SW_AGE_CNT_M GENMASK(5, 3) -#define SW_AGE_CNT_S 3 -#define SW_AGE_PERIOD_10_8_M GENMASK(10, 8)#define SW_RESV_MCAST_ENABLE BIT(2)#define SW_HASH_OPTION_M 0x03#define SW_HASH_OPTION_CRC 1
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/156 net: dsa: microchip: Fix LAN937X set_ageing_time function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristram Ha <[email protected]>
[ Upstream commit bb9869043438af5b94230f94fb4c39206525d758 ]
The aging count is not a simple 20-bit value but comprises a 3-bit multiplier and a 20-bit second time. The code tries to use the original multiplier which is 4 as the second count is still 300 seconds by default.
As the 20-bit number is now too large for practical use there is an option to interpret it as microseconds instead of seconds.
--- drivers/net/dsa/microchip/lan937x_main.c | 62 ++++++++++++++++++++++-- drivers/net/dsa/microchip/lan937x_reg.h | 9 ++-- 2 files changed, 65 insertions(+), 6 deletions(-)
drivers/net/dsa/microchip/lan937x_main.c +59 -3
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 /* Microchip LAN937X switch driver main logic -* Copyright (C) 2019-2022 Microchip Technology Inc. +* Copyright (C) 2019-2024 Microchip Technology Inc. */ #include <linux/kernel.h> #include <linux/module.h>
@@ -260,10 +260,66 @@ int lan937x_change_mtu(struct ksz_device *dev, int port, int new_mtu)int lan937x_set_ageing_time (struct ksz_device *dev,unsigned int msecs) { -u32 secs = msecs /1000 ; -u32 value; +u8 data, mult, value8; +bool in_msec = false; +u32 max_val, value; +u32 secs = msecs;int ret; +#define MAX_TIMER_VAL ((1 << 20) - 1) + +/* The aging timer comprises a 3-bit multiplier and a 20-bit second +* value. Either of them cannot be zero. The maximum timer is then +* 7 * 1048575 = 7340025 seconds. As this value is too large for +* practical use it can be interpreted as microseconds, making the +* maximum timer 7340 seconds with finer control. This allows for +* maximum 122 minutes compared to 29 minutes in KSZ9477 switch. +*/ +if (msecs %1000 ) + in_msec = true; +else + secs /=1000 ; +if (!secs) + secs =1 ; + +/* Return error if too large. */ +else if (secs >7 *MAX_TIMER_VAL ) +return -EINVAL ; + +/* Configure how to interpret the number value. */ + ret =ksz_rmw8 (dev,REG_SW_LUE_CTRL_2 ,SW_AGE_CNT_IN_MICROSEC , + in_msec ?SW_AGE_CNT_IN_MICROSEC :0 ); +if (ret <0 ) +return ret; + + ret =ksz_read8 (dev,REG_SW_LUE_CTRL_0 , &value8); +if (ret <0 ) +return ret; + +/* Check whether there is need to update the multiplier. */ + mult =FIELD_GET (SW_AGE_CNT_M , value8); + max_val =MAX_TIMER_VAL ; +if (mult >0 ) { +/* Try to use the same multiplier already in the register as +* the hardware default uses multiplier 4 and 75 seconds for +* 300 seconds. +*/ + max_val =DIV_ROUND_UP (secs, mult); +if (max_val >MAX_TIMER_VAL || max_val * mult != secs) + max_val =MAX_TIMER_VAL ; + } + + data =DIV_ROUND_UP (secs, max_val); +if (mult != data) { + value8 &= ~SW_AGE_CNT_M ; + value8 |=FIELD_PREP (SW_AGE_CNT_M , data); + ret =ksz_write8 (dev,REG_SW_LUE_CTRL_0 , value8); +if (ret <0 ) +return ret; + } + + secs =DIV_ROUND_UP (secs, data); + value =FIELD_GET (SW_AGE_PERIOD_7_0_M , secs); ret =ksz_write8 (dev,REG_SW_AGE_PERIOD__1 , value);
drivers/net/dsa/microchip/lan937x_reg.h +6 -3
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 */ /* Microchip LAN937X switch register definitions -* Copyright (C) 2019-2021 Microchip Technology Inc. +* Copyright (C) 2019-2024 Microchip Technology Inc. */ #ifndef __LAN937X_REG_H#define __LAN937X_REG_H
@@ -52,8 +52,7 @@#define SW_VLAN_ENABLE BIT(7)#define SW_DROP_INVALID_VID BIT(6) -#define SW_AGE_CNT_M 0x7 -#define SW_AGE_CNT_S 3 +#define SW_AGE_CNT_M GENMASK(5, 3)#define SW_RESV_MCAST_ENABLE BIT(2)#define REG_SW_LUE_CTRL_1 0x0311
@@ -66,6 +65,10 @@#define SW_FAST_AGING BIT(1)#define SW_LINK_AUTO_AGING BIT(0) +#define REG_SW_LUE_CTRL_2 0x0312 + +#define SW_AGE_CNT_IN_MICROSEC BIT(7) +#define REG_SW_AGE_PERIOD__1 0x0313#define SW_AGE_PERIOD_7_0_M GENMASK(7, 0)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/156 selftests: net: local_termination: require mausezahn
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 246068b86b1c36e4590388ab8f278e21f1997dc1 ]
Since the blamed commit, we require mausezahn because send_raw() uses it. Remove the "REQUIRE_MZ=no" line, which overwrites the default of requiring it.
--- tools/testing/selftests/net/forwarding/local_termination.sh | 1 - 1 file changed, 1 deletion(-)
tools/testing/selftests/net/forwarding/local_termination.sh +0 -1
@@ -7,7 +7,6 @@ ALL_TESTS="standalone vlan_unaware_bridge vlan_aware_bridge test_vlan \ NUM_NETIFS=2 PING_COUNT=1 REQUIRE_MTOOLS=yes -REQUIRE_MZ=no source lib.sh
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/156 netdev-genl: avoid empty messages in napi get
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 4a25201aa46ce88e8e31f9ccdec0e4e3dd6bb736 ]
Empty netlink responses from do() are not correct (as opposed to dump() where not dumping anything is perfectly fine). We should return an error if the target object does not exist, in this case if the netdev is down we "hide" the NAPI instances.
--- net/core/netdev-genl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/core/netdev-genl.c +5 -1
@@ -228,8 +228,12 @@ int netdev_nl_napi_get_doit(struct sk_buff *skb, struct genl_info *info)rcu_read_unlock ();rtnl_unlock (); -if (err) +if (err) { + goto err_free_msg; + }else if (!rsp->len) { + err = -ENOENT ; goto err_free_msg; + }return genlmsg_reply (rsp, info);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/156 RDMA/hns: Fix mapping error of zero-hop WQE buffer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: wenglianfa <[email protected]>
[ Upstream commit 8673a6c2d9e483dfeeef83a1f06f59e05636f4d1 ]
Due to HW limitation, the three region of WQE buffer must be mapped and set to HW in a fixed order: SQ buffer, SGE buffer, and RQ buffer.
Currently when one region is zero-hop while the other two are not, the zero-hop region will not be mapped. This violate the limitation above and leads to address error.
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 43 ++++++++++++++++-------- drivers/infiniband/hw/hns/hns_roce_mr.c | 5 --- 2 files changed, 29 insertions(+), 19 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +29 -14
@@ -931,6 +931,7 @@ struct hns_roce_hem_item {size_t count;/* max ba numbers */ int start;/* start buf offset in this hem */ int end;/* end buf offset in this hem */ +bool exist_bt; };/* All HEM items are linked in a tree structure */
@@ -959,6 +960,7 @@ hem_list_alloc_item(struct hns_roce_dev *hr_dev, int start, int end, int count, } } + hem->exist_bt = exist_bt; hem->count = count; hem->start = start; hem->end = end;
@@ -969,22 +971,22 @@ hem_list_alloc_item(struct hns_roce_dev *hr_dev, int start, int end, int count, }static void hem_list_free_item (struct hns_roce_dev *hr_dev, -struct hns_roce_hem_item *hem,bool exist_bt) +struct hns_roce_hem_item *hem) { -if (exist_bt) +if (hem->exist_bt)dma_free_coherent (hr_dev->dev, hem->count *BA_BYTE_LEN , hem->addr, hem->dma_addr);kfree (hem); }static void hem_list_free_all (struct hns_roce_dev *hr_dev, -struct list_head *head,bool exist_bt) +struct list_head *head) {struct hns_roce_hem_item *hem, *temp_hem;list_for_each_entry_safe (hem, temp_hem, head, list) {list_del (&hem->list); -hem_list_free_item (hr_dev, hem, exist_bt); +hem_list_free_item (hr_dev, hem); } }
@@ -1084,6 +1086,10 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions,for (i =0 ; i < region_cnt; i++) { r = (struct hns_roce_buf_region *)®ions[i]; +/* when r->hopnum = 0, the region should not occupy root_ba. */ +if (!r->hopnum) +continue ; +if (r->hopnum >1 ) { step =hem_list_calc_ba_range (r->hopnum,1 , unit);if (step >0 )
@@ -1177,7 +1183,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, err_exit:for (level =1 ; level < hopnum; level++) -hem_list_free_all (hr_dev, &temp_list[level], true); +hem_list_free_all (hr_dev, &temp_list[level]);return ret; }
@@ -1218,16 +1224,26 @@ static int alloc_fake_root_bt(struct hns_roce_dev *hr_dev, void *cpu_base, {struct hns_roce_hem_item *hem; +/* This is on the has_mtt branch, if r->hopnum +* is 0, there is no root_ba to reuse for the +* region's fake hem, so a dma_alloc request is +* necessary here. +*/ hem =hem_list_alloc_item (hr_dev, r->offset, r->offset + r->count -1 , - r->count, false); + r->count, !r->hopnum);if (!hem)return -ENOMEM ; -hem_list_assign_bt (hem, cpu_base, phy_base); +/* The root_ba can be reused only when r->hopnum > 0. */ +if (r->hopnum) +hem_list_assign_bt (hem, cpu_base, phy_base);list_add (&hem->list, branch_head);list_add (&hem->sibling, leaf_head); -return r->count; +/* If r->hopnum == 0, 0 is returned, +* so that the root_bt entry is not occupied. +*/ +return r->hopnum ? r->count :0 ; } static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base,
@@ -1271,7 +1287,7 @@ setup_root_hem(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list,return -ENOMEM ; total =0 ; -for (i =0 ; i < region_cnt && total < max_ba_num; i++) { +for (i =0 ; i < region_cnt && total <= max_ba_num; i++) { r = ®ions[i];if (!r->count)continue ;
@@ -1337,9 +1353,9 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev, region_cnt);if (ret) {for (i =0 ; i < region_cnt; i++) -hem_list_free_all (hr_dev, &head.branch[i], false); +hem_list_free_all (hr_dev, &head.branch[i]); -hem_list_free_all (hr_dev, &head.root, true); +hem_list_free_all (hr_dev, &head.root); }return ret;
@@ -1402,10 +1418,9 @@ void hns_roce_hem_list_release(struct hns_roce_dev *hr_dev,for (i =0 ; i <HNS_ROCE_MAX_BT_REGION ; i++)for (j =0 ; j <HNS_ROCE_MAX_BT_LEVEL ; j++) -hem_list_free_all (hr_dev, &hem_list->mid_bt[i][j], - j !=0 ); +hem_list_free_all (hr_dev, &hem_list->mid_bt[i][j]); -hem_list_free_all (hr_dev, &hem_list->root_bt, true); +hem_list_free_all (hr_dev, &hem_list->root_bt);INIT_LIST_HEAD (&hem_list->btm_bt); hem_list->root_ba =0 ; }
drivers/infiniband/hw/hns/hns_roce_mr.c +0 -5
@@ -814,11 +814,6 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,for (i =0 , mapped_cnt =0 ; i < mtr->hem_cfg.region_count && mapped_cnt < page_cnt; i++) { r = &mtr->hem_cfg.region[i]; -/* if hopnum is 0, no need to map pages in this region */ -if (!r->hopnum) { - mapped_cnt += r->count; -continue ; - }if (r->offset + r->count > page_cnt) { ret = -EINVAL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/156 RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 0572eccf239ce4bd89bd531767ec5ab20e249290 ]
If it fails to modify QP to RTR, dip_ctx will not be attached. And during detroying QP, the invalid dip_ctx pointer will be accessed.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +3 -0
@@ -5619,6 +5619,9 @@ static void put_dip_ctx_idx(struct hns_roce_dev *hr_dev, {struct hns_roce_dip *hr_dip = hr_qp->dip; +if (!hr_dip) +return ; +xa_lock (&hr_dev->qp_table.dip_xa); hr_dip->qp_cnt--;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/156 RDMA/hns: Fix warning storm caused by invalid input in IO path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit fa5c4ba8cdbfd2c2d6422e001311c8213283ebbf ]
WARN_ON() is called in the IO path. And it could lead to a warning storm. Use WARN_ON_ONCE() instead of WARN_ON().
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +2 -2
@@ -468,7 +468,7 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp, valid_num_sge =calc_wr_sge_num (wr, &msg_len); ret =set_ud_opcode (ud_sq_wqe, wr); -if (WARN_ON (ret)) +if (WARN_ON_ONCE (ret))return ret; ud_sq_wqe->msg_len =cpu_to_le32 (msg_len);
@@ -572,7 +572,7 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp, rc_sq_wqe->msg_len =cpu_to_le32 (msg_len); ret =set_rc_opcode (hr_dev, rc_sq_wqe, wr); -if (WARN_ON (ret)) +if (WARN_ON_ONCE (ret))return ret; hr_reg_write(rc_sq_wqe, RC_SEND_WQE_SO,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/156 RDMA/hns: Fix missing flush CQE for DWQE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit e3debdd48423d3d75b9d366399228d7225d902cd ]
Flush CQE handler has not been called if QP state gets into errored mode in DWQE path. So, the new added outstanding WQEs will never be flushed.
It leads to a hung task timeout when using NFS over RDMA:
__switch_to+0x7c/0xd0
__schedule+0x350/0x750
schedule+0x50/0xf0
schedule_timeout+0x2c8/0x340
wait_for_common+0xf4/0x2b0
wait_for_completion+0x20/0x40
__ib_drain_sq+0x140/0x1d0 [ib_core]
ib_drain_sq+0x98/0xb0 [ib_core]
rpcrdma_xprt_disconnect+0x68/0x270 [rpcrdma]
xprt_rdma_close+0x20/0x60 [rpcrdma]
xprt_autoclose+0x64/0x1cc [sunrpc]
process_one_work+0x1d8/0x4e0
worker_thread+0x154/0x420
kthread+0x108/0x150
ret_from_fork+0x10/0x18--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +4 -0
@@ -670,6 +670,10 @@ static void write_dwqe(struct hns_roce_dev *hr_dev, struct hns_roce_qp *qp,#define HNS_ROCE_SL_SHIFT 2struct hns_roce_v2_rc_send_wqe *rc_sq_wqe = wqe; +if (unlikely (qp->state ==IB_QPS_ERR )) { +flush_cqe (hr_dev, qp); +return ; + }/* All kinds of DirectWQE have the same header field layout */ hr_reg_enable (rc_sq_wqe,RC_SEND_WQE_FLAG );hr_reg_write (rc_sq_wqe,RC_SEND_WQE_DB_SL_L , qp->sl);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/156 drm/xe: Revert some changes that break a mesa debug tool
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Harrison <[email protected]>
[ Upstream commit a53da2fb25a31f4fb8eaeb93c7b1134fc14fd209 ]
There is a mesa debug tool for decoding devcoredump files. Recent changes to improve the devcoredump output broke that tool. So revert the changes until the tool can be extended to support the new fields.
--- drivers/gpu/drm/xe/xe_devcoredump.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_devcoredump.c +14 -1
@@ -104,7 +104,11 @@ static ssize_t __xe_devcoredump_read(char *buffer, size_t count,drm_puts (&p,"\n**** GuC CT ****\n" );xe_guc_ct_snapshot_print (ss->ct, &p); -drm_puts (&p,"\n**** Contexts ****\n" ); +/* +* Don't add a new section header here because the mesa debug decoder +* tool expects the context information to be in the 'GuC CT' section. +*/ +/* drm_puts(&p, "\n**** Contexts ****\n"); */ xe_guc_exec_queue_snapshot_print (ss->ge, &p);drm_puts (&p,"\n**** Job ****\n" );
@@ -358,6 +362,15 @@ void xe_print_blob_ascii85(struct drm_printer *p, const char *prefix,char buff[ASCII85_BUFSZ ], *line_buff;size_t line_pos =0 ; +/* +* Splitting blobs across multiple lines is not compatible with the mesa +* debug decoder tool. Note that even dropping the explicit '\n' below +* doesn't help because the GuC log is so big some underlying implementation +* still splits the lines at 512K characters. So just bail completely for +* the moment. +*/ +return ; +#define DMESG_MAX_LINE_LEN 800#define MIN_SPACE (ASCII85_BUFSZ + 2)/* 85 + "\n\0" */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/156 drm/xe/pf: Use correct function to check LMEM provisioning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Wajdeczko <[email protected]>
[ Upstream commit af12ba67d09ebe2b31ab997cea1a930864028562 ]
There is a typo in function call and instead of VF LMEM we were looking at VF GGTT provisioning. Fix that.
--- drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c +1 -1
@@ -2038,7 +2038,7 @@ static int pf_validate_vf_config(struct xe_gt *gt, unsigned int vfid) valid_any = valid_any || (valid_ggtt && is_primary);if (IS_DGFX (xe)) { -bool valid_lmem =pf_get_vf_config_ggtt (primary_gt, vfid); +bool valid_lmem =pf_get_vf_config_lmem (primary_gt, vfid); valid_any = valid_any || (valid_lmem && is_primary); valid_all = valid_all && valid_lmem;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/156 drm/xe: Fix fault on fd close after unbind
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <[email protected]>
[ Upstream commit fe39b222a4139354d32ff9d46b88757f63f71d63 ]
If userspace holds an fd open, unbinds the device and then closes it, the driver shouldn't try to access the hardware. Protect it by using drm_dev_enter()/drm_dev_exit(). This fixes the following page fault:
<6> [IGT] xe_wedged: exiting, ret=98
<1> BUG: unable to handle page fault for address: ffffc901bc5e508c <1> #PF: supervisor read access in kernel mode
<1> #PF: error_code(0x0000) - not-present page
...
<4> xe_lrc_update_timestamp+0x1c/0xd0 [xe] <4> xe_exec_queue_update_run_ticks+0x50/0xb0 [xe] <4> xe_exec_queue_fini+0x16/0xb0 [xe] <4> __guc_exec_queue_fini_async+0xc4/0x190 [xe] <4> guc_exec_queue_fini_async+0xa0/0xe0 [xe] <4> guc_exec_queue_fini+0x23/0x40 [xe] <4> xe_exec_queue_destroy+0xb3/0xf0 [xe] <4> xe_file_close+0xd4/0x1a0 [xe] <4> drm_file_free+0x210/0x280 [drm] <4> drm_close_helper.isra.0+0x6d/0x80 [drm] <4> drm_release_noglobal+0x20/0x90 [drm]
--- drivers/gpu/drm/xe/xe_exec_queue.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/drm/xe/xe_exec_queue.c +9 -0
@@ -8,6 +8,7 @@#include <linux/nospec.h> #include <drm/drm_device.h> +#include <drm/drm_drv.h> #include <drm/drm_file.h> #include <uapi/drm/xe_drm.h>
@@ -762,9 +763,11 @@ bool xe_exec_queue_is_idle(struct xe_exec_queue *q)*/ void xe_exec_queue_update_run_ticks (struct xe_exec_queue *q) { +struct xe_device *xe =gt_to_xe (q->gt);struct xe_file *xef;struct xe_lrc *lrc;u32 old_ts, new_ts; +int idx;/* * Jobs that are run during driver load may use an exec_queue, but are
@@ -774,6 +777,10 @@ void xe_exec_queue_update_run_ticks(struct xe_exec_queue *q)if (!q->vm || !q->vm->xef)return ; +/* Synchronize with unbind while holding the xe file open */ +if (!drm_dev_enter (&xe->drm, &idx)) +return ; + xef = q->vm->xef;/*
@@ -787,6 +794,8 @@ void xe_exec_queue_update_run_ticks(struct xe_exec_queue *q) lrc = q->lrc[0 ]; new_ts =xe_lrc_update_timestamp (lrc, &old_ts); xef->run_ticks[q->class] += (new_ts - old_ts) * q->width; + +drm_dev_exit (idx); }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/156 net: stmmac: restructure the error path of stmmac_probe_config_dt()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit 2b6ffcd7873b7e8a62c3e15a6f305bfc747c466b ]
Current implementation of stmmac_probe_config_dt() does not release the OF node reference obtained by of_parse_phandle() in some error paths. The problem is that some error paths call stmmac_remove_config_dt() to clean up but others use and unwind ladder. These two types of error handling have not kept in sync and have been a recurring source of bugs. Re-write the error handling in stmmac_probe_config_dt() to use an unwind ladder. Consequently, stmmac_remove_config_dt() is not needed anymore, thus remove it.
This bug was found by an experimental verification tool that I am developing.
--- .../ethernet/stmicro/stmmac/stmmac_platform.c | 43 ++++++++----------- 1 file changed, 17 insertions(+), 26 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +17 -26
@@ -405,22 +405,6 @@ static int stmmac_of_get_mac_mode(struct device_node *np)return -ENODEV ; } -/** -* stmmac_remove_config_dt - undo the effects of stmmac_probe_config_dt() -* @pdev: platform_device structure -* @plat: driver data platform structure -* -* Release resources claimed by stmmac_probe_config_dt(). -*/ -static void stmmac_remove_config_dt (struct platform_device *pdev, -struct plat_stmmacenet_data *plat) -{ -clk_disable_unprepare (plat->stmmac_clk); -clk_disable_unprepare (plat->pclk); -of_node_put (plat->phy_node); -of_node_put (plat->mdio_node); -} -/** * stmmac_probe_config_dt - parse device-tree driver parameters * @pdev: platform_device structure
@@ -490,8 +474,10 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac)dev_warn (&pdev->dev,"snps,phy-addr property is deprecated\n" ); rc =stmmac_mdio_setup (plat, np, &pdev->dev); -if (rc) -return ERR_PTR (rc); +if (rc) { + ret =ERR_PTR (rc); + goto error_put_phy; + }of_property_read_u32 (np,"tx-fifo-depth" , &plat->tx_fifo_size);
@@ -580,8 +566,8 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) dma_cfg =devm_kzalloc (&pdev->dev,sizeof (*dma_cfg),GFP_KERNEL );if (!dma_cfg) { -stmmac_remove_config_dt (pdev, plat); -return ERR_PTR (-ENOMEM ); + ret =ERR_PTR (-ENOMEM ); + goto error_put_mdio; } plat->dma_cfg = dma_cfg;
@@ -609,8 +595,8 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) rc =stmmac_mtl_setup (pdev, plat);if (rc) { -stmmac_remove_config_dt (pdev, plat); -return ERR_PTR (rc); + ret =ERR_PTR (rc); + goto error_put_mdio; }/* clock setup */
@@ -662,6 +648,10 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac)clk_disable_unprepare (plat->pclk); error_pclk_get:clk_disable_unprepare (plat->stmmac_clk); +error_put_mdio: +of_node_put (plat->mdio_node); +error_put_phy: +of_node_put (plat->phy_node);return ret; }
@@ -670,16 +660,17 @@ static void devm_stmmac_remove_config_dt(void *data) {struct plat_stmmacenet_data *plat = data; -/* Platform data argument is unused */ -stmmac_remove_config_dt (NULL , plat); +clk_disable_unprepare (plat->stmmac_clk); +clk_disable_unprepare (plat->pclk); +of_node_put (plat->mdio_node); +of_node_put (plat->phy_node); }/** * devm_stmmac_probe_config_dt * @pdev: platform_device structure * @mac: MAC address to use -* Description: Devres variant of stmmac_probe_config_dt(). Does not require -* the user to call stmmac_remove_config_dt() at driver detach. +* Description: Devres variant of stmmac_probe_config_dt(). */ struct plat_stmmacenet_data *devm_stmmac_probe_config_dt (struct platform_device *pdev,u8 *mac)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/156 net: fix memory leak in tcp_conn_request()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit 4f4aa4aa28142d53f8b06585c478476cfe325cfc ]
If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will return without free the dst memory, which allocated in af_ops->route_req.
Here is the kmemleak stack:
unreferenced object 0xffff8881198631c0 (size 240):
comm "softirq", pid 0, jiffies 4299266571 (age 1802.392s) hex dump (first 32 bytes):
00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................
81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U..............
backtrace:
[<ffffffffb93e8d4c>] kmem_cache_alloc+0x60c/0xa80
[<ffffffffba11b4c5>] dst_alloc+0x55/0x250
[<ffffffffba227bf6>] rt_dst_alloc+0x46/0x1d0
[<ffffffffba23050a>] __mkroute_output+0x29a/0xa50
[<ffffffffba23456b>] ip_route_output_key_hash+0x10b/0x240
[<ffffffffba2346bd>] ip_route_output_flow+0x1d/0x90
[<ffffffffba254855>] inet_csk_route_req+0x2c5/0x500
[<ffffffffba26b331>] tcp_conn_request+0x691/0x12c0
[<ffffffffba27bd08>] tcp_rcv_state_process+0x3c8/0x11b0
[<ffffffffba2965c6>] tcp_v4_do_rcv+0x156/0x3b0
[<ffffffffba299c98>] tcp_v4_rcv+0x1cf8/0x1d80
[<ffffffffba239656>] ip_protocol_deliver_rcu+0xf6/0x360
[<ffffffffba2399a6>] ip_local_deliver_finish+0xe6/0x1e0
[<ffffffffba239b8e>] ip_local_deliver+0xee/0x360
[<ffffffffba239ead>] ip_rcv+0xad/0x2f0
[<ffffffffba110943>] __netif_receive_skb_one_core+0x123/0x140Call dst_release() to free the dst memory when inet_csk_reqsk_queue_hash_add() return false in tcp_conn_request().
--- net/ipv4/tcp_input.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/tcp_input.c +1 -0
@@ -7328,6 +7328,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,if (unlikely (!inet_csk_reqsk_queue_hash_add (sk, req, req->timeout))) {reqsk_free (req); +dst_release (dst);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/156 net: Fix netns for ip_tunnel_init_flow()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Liang <[email protected]>
[ Upstream commit b5a7b661a073727219fedc35f5619f62418ffe72 ]
The device denoted by tunnel->parms.link resides in the underlay net namespace. Therefore pass tunnel->net to ip_tunnel_init_flow().
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c | 3 +-- net/ipv4/ip_tunnel.c | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c +1 -2
@@ -423,8 +423,7 @@ mlxsw_sp_span_gretap4_route(const struct net_device *to_dev, parms =mlxsw_sp_ipip_netdev_parms4 (to_dev);ip_tunnel_init_flow (&fl4, parms.iph.protocol, *daddrp, *saddrp, -0 ,0 ,dev_net (to_dev), parms.link, tun->fwmark,0 , -0 ); +0 ,0 , tun->net, parms.link, tun->fwmark,0 ,0 ); rt =ip_route_output_key (tun->net, &fl4);if (IS_ERR (rt))
net/ipv4/ip_tunnel.c +3 -3
@@ -294,7 +294,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)ip_tunnel_init_flow (&fl4, iph->protocol, iph->daddr, iph->saddr, tunnel->parms.o_key, - iph->tos &INET_DSCP_MASK ,dev_net (dev), + iph->tos &INET_DSCP_MASK , tunnel->net, tunnel->parms.link, tunnel->fwmark,0 ,0 ); rt =ip_route_output_key (tunnel->net, &fl4);
@@ -611,7 +611,7 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, }ip_tunnel_init_flow (&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,tunnel_id_to_key32 (key->tun_id), - tos &INET_DSCP_MASK ,dev_net (dev),0 , skb->mark, + tos &INET_DSCP_MASK , tunnel->net,0 , skb->mark,skb_get_hash (skb), key->flow_flags);if (!tunnel_hlen)
@@ -774,7 +774,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,ip_tunnel_init_flow (&fl4, protocol, dst, tnl_params->saddr, tunnel->parms.o_key, tos &INET_DSCP_MASK , -dev_net (dev),READ_ONCE (tunnel->parms.link), + tunnel->net,READ_ONCE (tunnel->parms.link), tunnel->fwmark,skb_get_hash (skb),0 );if (ip_tunnel_encap (skb, &tunnel->encap, &protocol, &fl4) <0 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/156 netrom: check buffer length before accessing it
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Shchipletsov <[email protected]>
[ Upstream commit a4fd163aed2edd967a244499754dec991d8b4c7d ]
Syzkaller reports an uninit value read from ax25cmp when sending raw message through ieee802154 implementation.
=====================================================
BUG: KMSAN: uninit-value in ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119 ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119 nr_dev_get+0x20e/0x450 net/netrom/nr_route.c:601 nr_route_frame+0x1a2/0xfc0 net/netrom/nr_route.c:774 nr_xmit+0x5a/0x1c0 net/netrom/nr_dev.c:144 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] raw_sendmsg+0x654/0xc10 net/ieee802154/socket.c:299 ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x318/0x740 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2780 sock_alloc_send_skb include/net/sock.h:1884 [inline] raw_sendmsg+0x36d/0xc10 net/ieee802154/socket.c:282 ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 5037 Comm: syz-executor166 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 =====================================================
This issue occurs because the skb buffer is too small, and it's actual allocation is aligned. This hides an actual issue, which is that nr_route_frame does not validate the buffer size before using it.
Fix this issue by checking skb->len before accessing any fields in skb->data.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/netrom/nr_route.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/netrom/nr_route.c +6 -0
@@ -754,6 +754,12 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25)int ret;struct sk_buff *skbn; +/* +* Reject malformed packets early. Check that it contains at least 2 +* addresses and 1 byte more for Time-To-Live +*/ +if (skb->len <2 *sizeof (ax25_address) +1 ) +return 0 ; nr_src = (ax25_address *)(skb->data +0 ); nr_dest = (ax25_address *)(skb->data +7 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/156 net: pse-pd: tps23881: Fix power on/off issue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kory Maincent <[email protected]>
[ Upstream commit 75221e96101fa93390d3db5c23e026f5e3565d9b ]
An issue was present in the initial driver implementation. The driver read the power status of all channels before toggling the bit of the desired one. Using the power status register as a base value introduced a problem, because only the bit corresponding to the concerned channel ID should be set in the write-only power enable register. This led to cases where disabling power for one channel also powered off other channels.
This patch removes the power status read and ensures the value is limited to the bit matching the channel index of the PI.
--- drivers/net/pse-pd/tps23881.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/net/pse-pd/tps23881.c +4 -12
@@ -64,15 +64,11 @@ static int tps23881_pi_enable(struct pse_controller_dev *pcdev, int id)if (id >=TPS23881_MAX_CHANS )return -ERANGE ; - ret =i2c_smbus_read_word_data (client,TPS23881_REG_PW_STATUS ); -if (ret <0 ) -return ret; - chan = priv->port[id].chan[0 ];if (chan <4 ) - val = (u16)(ret |BIT (chan)); + val =BIT (chan);else - val = (u16)(ret |BIT (chan +4 )); + val =BIT (chan +4 );if (priv->port[id].is_4p) { chan = priv->port[id].chan[1 ];
@@ -100,15 +96,11 @@ static int tps23881_pi_disable(struct pse_controller_dev *pcdev, int id)if (id >=TPS23881_MAX_CHANS )return -ERANGE ; - ret =i2c_smbus_read_word_data (client,TPS23881_REG_PW_STATUS ); -if (ret <0 ) -return ret; - chan = priv->port[id].chan[0 ];if (chan <4 ) - val = (u16)(ret |BIT (chan +4 )); + val =BIT (chan +4 );else - val = (u16)(ret |BIT (chan +8 )); + val =BIT (chan +8 );if (priv->port[id].is_4p) { chan = priv->port[id].chan[1 ];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/156 net/mlx5: DR, select MSIX vector 0 for completion queue creation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Shitrit <[email protected]>
[ Upstream commit 050a4c011b0dfeb91664a5d7bd3647ff38db08ce ]
When creating a software steering completion queue (CQ), an arbitrary MSIX vector n is selected. This results in the CQ sharing the same Ethernet traffic channel n associated with the chosen vector. However, the value of n is often unpredictable, which can introduce complications for interrupt monitoring and verification tools.
Moreover, SW steering uses polling rather than event-driven interrupts. Therefore, there is no need to select any MSIX vector other than the existing vector 0 for CQ creation.
In light of these factors, and to enhance predictability, we modify the code to consistently select MSIX vector 0 for CQ creation.
--- drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c +1 -3
@@ -1067,7 +1067,6 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev,int inlen, err, eqn;void *cqc, *in;__be64 *pas; -int vector;u32 i; cq =kzalloc (sizeof (*cq),GFP_KERNEL );
@@ -1096,8 +1095,7 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev,if (!in) goto err_cqwq; - vector =raw_smp_processor_id () %mlx5_comp_vectors_max (mdev); - err =mlx5_comp_eqn_get (mdev, vector, &eqn); + err =mlx5_comp_eqn_get (mdev,0 , &eqn);if (err) {kvfree (in); goto err_cqwq;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/156 net/mlx5e: macsec: Maintain TX SA from encoding_sa
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit 8c6254479b3d5bd788d2b5fefaa48fb194331ed0 ]
In MACsec, it is possible to create multiple active TX SAs on a SC, but only one such SA can be used at a time for transmission. This SA is selected through the encoding_sa link parameter.
When there are 2 or more active TX SAs configured (encoding_sa=0):
ip macsec add macsec0 tx sa 0 pn 1 on key 00 <KEY1> ip macsec add macsec0 tx sa 1 pn 1 on key 00 <KEY2>
... the traffic should be still sent via TX SA 0 as the encoding_sa was not changed. However, the driver ignores the encoding_sa and overrides it to SA 1 by installing the flow steering id of the newly created TX SA into the SCI -> flow steering id hash map. The future packet tx descriptors will point to the incorrect flow steering rule (SA 1).
This patch fixes the issue by avoiding the creation of the flow steering rule for an active TX SA that is not the encoding_sa. The driver side tx_sa object and the FW side macsec object are still created. When the encoding_sa link parameter is changed to another active TX SA, only the new flow steering rule will be created in the mlx5e_macsec_upd_txsa() handler.
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +4 -0
@@ -339,9 +339,13 @@ static int mlx5e_macsec_init_sa_fs(struct macsec_context *ctx, {struct mlx5e_priv *priv =macsec_netdev_priv (ctx->netdev);struct mlx5_macsec_fs *macsec_fs = priv->mdev->macsec_fs; +const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;struct mlx5_macsec_rule_attrs rule_attrs;union mlx5_macsec_rule *macsec_rule; +if (is_tx && tx_sc->encoding_sa != sa->assoc_num) +return 0 ; + rule_attrs.macsec_obj_id = sa->macsec_obj_id; rule_attrs.sci = sa->sci; rule_attrs.assoc_num = sa->assoc_num;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/156 net/mlx5e: Skip restore TC rules for vport rep without loaded flag
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be ]
During driver unload, unregister_netdev is called after unloading vport rep. So, the mlx5e_rep_priv is already freed while trying to get rpriv->netdev, or walk rpriv->tc_ht, which results in use-after-free. So add the checking to make sure access the data of vport rep which is still loaded.
--- drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 6 +++--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 +++ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 --- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c +3 -3
@@ -150,11 +150,11 @@ void mlx5_esw_ipsec_restore_dest_uplink(struct mlx5_core_dev *mdev)unsigned long i;int err; -xa_for_each (&esw->offloads.vport_reps, i, rep) { - rpriv = rep->rep_data[REP_ETH ].priv; -if (!rpriv || !rpriv->netdev) +mlx5_esw_for_each_rep (esw, i, rep) { +if (atomic_read (&rep->rep_data[REP_ETH ].state) !=REP_LOADED )continue ; + rpriv = rep->rep_data[REP_ETH ].priv;rhashtable_walk_enter (&rpriv->tc_ht, &iter);rhashtable_walk_start (&iter);while ((flow =rhashtable_walk_next (&iter)) !=NULL ) {
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +3 -0
@@ -716,6 +716,9 @@ void mlx5e_tc_clean_fdb_peer_flows(struct mlx5_eswitch *esw); MLX5_CAP_GEN_2((esw->dev), ec_vf_vport_base) +\ (last) - 1) +#define mlx5_esw_for_each_rep (esw, i, rep) \ + xa_for_each(&((esw)->offloads.vport_reps), i, rep) +struct mlx5_eswitch *__must_check mlx5_devlink_eswitch_get (struct devlink *devlink);
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +0 -3
@@ -53,9 +53,6 @@#include "lag/lag.h" #include "en/tc/post_meter.h" -#define mlx5_esw_for_each_rep (esw, i, rep) \ - xa_for_each(&((esw)->offloads.vport_reps), i, rep) -/* There are two match-all miss flows, one for unicast dst mac and * one for multicast. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/156 net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 2a4f56fbcc473d8faeb29b73082df39efbe5893c ]
In the cited commit, when changing from switchdev to legacy mode, uplink representor's netdev is kept, and its profile is replaced with nic profile, so netdev is detached from old profile, then attach to new profile.
During profile change, the hardware resources allocated by the old profile will be cleaned up. However, the cleanup is relying on the related kernel modules. And they may need to flush themselves first, which is triggered by netdev events, for example, NETDEV_UNREGISTER. However, netdev is kept, or netdev_register is called after the cleanup, which may cause troubles because the resources are still referred by kernel modules.
The same process applies to all the caes when uplink is leaving switchdev mode, including devlink eswitch mode set legacy, driver unload and devlink reload. For the first one, it can be blocked and returns failure to users, whenever possible. But it's hard for the others. Besides, the attachment to nic profile is unnecessary as the netdev will be unregistered anyway for such cases.
So in this patch, the original behavior is kept only for devlink eswitch set mode legacy. For the others, moves netdev unregistration before the profile change.
--- .../net/ethernet/mellanox/mlx5/core/en_main.c | 19 +++++++++++++++++-- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 15 +++++++++++++++ .../mellanox/mlx5/core/eswitch_offloads.c | 2 ++ include/linux/mlx5/driver.h | 1 + 4 files changed, 35 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +17 -2
@@ -6510,8 +6510,23 @@ static void _mlx5e_remove(struct auxiliary_device *adev)mlx5_core_uplink_netdev_set (mdev,NULL );mlx5e_dcbnl_delete_app (priv); -unregister_netdev (priv->netdev); -_mlx5e_suspend (adev, false); +/* When unload driver, the netdev is in registered state +* if it's from legacy mode. If from switchdev mode, it +* is already unregistered before changing to NIC profile. +*/ +if (priv->netdev->reg_state ==NETREG_REGISTERED ) { +unregister_netdev (priv->netdev); +_mlx5e_suspend (adev, false); + }else { +struct mlx5_core_dev *pos; +int i; + +if (test_bit (MLX5E_STATE_DESTROYING , &priv->state)) +mlx5_sd_for_each_dev (i, mdev, pos) +mlx5e_destroy_mdev_resources (pos); +else +_mlx5e_suspend (adev, true); + }/* Avoid cleanup if profile rollback failed. */ if (priv->profile) priv->profile->cleanup (priv);
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +15 -0
@@ -1508,6 +1508,21 @@ mlx5e_vport_uplink_rep_unload(struct mlx5e_rep_priv *rpriv) priv =netdev_priv (netdev); +/* This bit is set when using devlink to change eswitch mode from +* switchdev to legacy. As need to keep uplink netdev ifindex, we +* detach uplink representor profile and attach NIC profile only. +* The netdev will be unregistered later when unload NIC auxiliary +* driver for this case. +* We explicitly block devlink eswitch mode change if any IPSec rules +* offloaded, but can't block other cases, such as driver unload +* and devlink reload. We have to unregister netdev before profile +* change for those cases. This is to avoid resource leak because +* the offloaded rules don't have the chance to be unoffloaded before +* cleanup which is triggered by detach uplink representor profile. +*/ +if (!(priv->mdev->priv.flags &MLX5_PRIV_FLAGS_SWITCH_LEGACY )) +unregister_netdev (netdev); +mlx5e_netdev_attach_nic_profile (priv); }
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +2 -0
@@ -3759,6 +3759,8 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, esw->eswitch_operation_in_progress = true;up_write (&esw->mode_lock); +if (mode ==DEVLINK_ESWITCH_MODE_LEGACY ) + esw->dev->priv.flags |=MLX5_PRIV_FLAGS_SWITCH_LEGACY ;mlx5_eswitch_disable_locked (esw);if (mode ==DEVLINK_ESWITCH_MODE_SWITCHDEV ) {if (mlx5_devlink_trap_get_num_active (esw->dev)) {
include/linux/mlx5/driver.h +1 -0
@@ -555,6 +555,7 @@ enum {* creation/deletion on drivers rescan. Unset during device attach. */ MLX5_PRIV_FLAGS_DETACH =1 <<2 , + MLX5_PRIV_FLAGS_SWITCH_LEGACY = 1 << 3, }; struct mlx5_adev {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/156 RDMA/rxe: Remove the direct link to net_device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <[email protected]>
[ Upstream commit 2ac5415022d16d63d912a39a06f32f1f51140261 ]
The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem. In the following Call Traces:
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295 CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: infiniband ib_cache_event_task Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60 __ib_query_port drivers/infiniband/core/device.c:2111 [inline] ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143 ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494 ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
"
1). In the link [1],
"
infiniband syz2: set down
"
This means that on 839.350575, the event ib_cache_event_task was sent andi queued in ib_wq.
2). In the link [1],
"
team0 (unregistering): Port device team_slave_0 removed
"
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0
"
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ib_cache_event_task was sent and queued in ib_wq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
--- drivers/infiniband/sw/rxe/rxe.c | 23 +++++++++++++++++++---- drivers/infiniband/sw/rxe/rxe.h | 3 ++- drivers/infiniband/sw/rxe/rxe_mcast.c | 22 ++++++++++++++++++++-- drivers/infiniband/sw/rxe/rxe_net.c | 24 ++++++++++++++++++++---- drivers/infiniband/sw/rxe/rxe_verbs.c | 26 +++++++++++++++++++++----- drivers/infiniband/sw/rxe/rxe_verbs.h | 11 ++++++++--- 6 files changed, 90 insertions(+), 19 deletions(-)
drivers/infiniband/sw/rxe/rxe.c +19 -4
@@ -40,6 +40,8 @@ void rxe_dealloc(struct ib_device *ib_dev)/* initialize rxe device parameters */ static void rxe_init_device_param (struct rxe_dev *rxe) { +struct net_device *ndev; + rxe->max_inline_data =RXE_MAX_INLINE_DATA ; rxe->attr.vendor_id =RXE_VENDOR_ID ;
@@ -71,8 +73,15 @@ static void rxe_init_device_param(struct rxe_dev *rxe) rxe->attr.max_fast_reg_page_list_len =RXE_MAX_FMR_PAGE_LIST_LEN ; rxe->attr.max_pkeys =RXE_MAX_PKEYS ; rxe->attr.local_ca_ack_delay =RXE_LOCAL_CA_ACK_DELAY ; + + ndev =rxe_ib_device_get_netdev (&rxe->ib_dev); +if (!ndev) +return ; +addrconf_addr_eui48 ((unsigned char *)&rxe->attr.sys_image_guid, - rxe->ndev->dev_addr); + ndev->dev_addr); + +dev_put (ndev); rxe->max_ucontext =RXE_MAX_UCONTEXT ; }
@@ -109,10 +118,15 @@ static void rxe_init_port_param(struct rxe_port *port)static void rxe_init_ports (struct rxe_dev *rxe) {struct rxe_port *port = &rxe->port; +struct net_device *ndev;rxe_init_port_param (port); + ndev =rxe_ib_device_get_netdev (&rxe->ib_dev); +if (!ndev) +return ;addrconf_addr_eui48 ((unsigned char *)&port->port_guid, - rxe->ndev->dev_addr); + ndev->dev_addr); +dev_put (ndev);spin_lock_init (&port->port_lock); }
@@ -167,12 +181,13 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu)/* called by ifc layer to create new rxe device. * The caller should allocate memory for rxe by calling ib_alloc_device. */ -int rxe_add (struct rxe_dev *rxe,unsigned int mtu,const char *ibdev_name) +int rxe_add (struct rxe_dev *rxe,unsigned int mtu,const char *ibdev_name, +struct net_device *ndev) {rxe_init (rxe);rxe_set_mtu (rxe, mtu); -return rxe_register_device (rxe, ibdev_name); +return rxe_register_device (rxe, ibdev_name, ndev); }static int rxe_newlink (const char *ibdev_name,struct net_device *ndev)
drivers/infiniband/sw/rxe/rxe.h +2 -1
@@ -139,7 +139,8 @@ enum resp_states {void rxe_set_mtu (struct rxe_dev *rxe,unsigned int dev_mtu); -int rxe_add (struct rxe_dev *rxe,unsigned int mtu,const char *ibdev_name); +int rxe_add (struct rxe_dev *rxe,unsigned int mtu,const char *ibdev_name, +struct net_device *ndev);void rxe_rcv (struct sk_buff *skb);
drivers/infiniband/sw/rxe/rxe_mcast.c +20 -2
@@ -31,10 +31,19 @@static int rxe_mcast_add (struct rxe_dev *rxe,union ib_gid *mgid) {unsigned char ll_addr[ETH_ALEN ]; +struct net_device *ndev; +int ret; + + ndev =rxe_ib_device_get_netdev (&rxe->ib_dev); +if (!ndev) +return -ENODEV ;ipv6_eth_mc_map ((struct in6_addr *)mgid->raw, ll_addr); -return dev_mc_add (rxe->ndev, ll_addr); + ret =dev_mc_add (ndev, ll_addr); +dev_put (ndev); + +return ret; }/**
@@ -47,10 +56,19 @@ static int rxe_mcast_add(struct rxe_dev *rxe, union ib_gid *mgid)static int rxe_mcast_del (struct rxe_dev *rxe,union ib_gid *mgid) {unsigned char ll_addr[ETH_ALEN ]; +struct net_device *ndev; +int ret; + + ndev =rxe_ib_device_get_netdev (&rxe->ib_dev); +if (!ndev) +return -ENODEV ;ipv6_eth_mc_map ((struct in6_addr *)mgid->raw, ll_addr); -return dev_mc_del (rxe->ndev, ll_addr); + ret =dev_mc_del (ndev, ll_addr); +dev_put (ndev); + +return ret; }/**
drivers/infiniband/sw/rxe/rxe_net.c +20 -4
@@ -524,7 +524,16 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,*/ const char *rxe_parent_name (struct rxe_dev *rxe,unsigned int port_num) { -return rxe->ndev->name; +struct net_device *ndev; +char *ndev_name; + + ndev =rxe_ib_device_get_netdev (&rxe->ib_dev); +if (!ndev) +return NULL ; + ndev_name = ndev->name; +dev_put (ndev); + +return ndev_name; }int rxe_net_add (const char *ibdev_name,struct net_device *ndev)
@@ -536,10 +545,9 @@ int rxe_net_add(const char *ibdev_name, struct net_device *ndev)if (!rxe)return -ENOMEM ; - rxe->ndev = ndev;ib_mark_name_assigned_by_user (&rxe->ib_dev); - err =rxe_add (rxe, ndev->mtu, ibdev_name); + err =rxe_add (rxe, ndev->mtu, ibdev_name, ndev);if (err) {ib_dealloc_device (&rxe->ib_dev);return err;
@@ -587,10 +595,18 @@ void rxe_port_down(struct rxe_dev *rxe)void rxe_set_port_state (struct rxe_dev *rxe) { -if (netif_running (rxe->ndev) &&netif_carrier_ok (rxe->ndev)) +struct net_device *ndev; + + ndev =rxe_ib_device_get_netdev (&rxe->ib_dev); +if (!ndev) +return ; + +if (netif_running (ndev) &&netif_carrier_ok (ndev))rxe_port_up (rxe);else rxe_port_down (rxe); + +dev_put (ndev); } static int rxe_notify(struct notifier_block *not_blk,
drivers/infiniband/sw/rxe/rxe_verbs.c +21 -5
@@ -41,6 +41,7 @@ static int rxe_query_port(struct ib_device *ibdev, u32 port_num, struct ib_port_attr *attr) { struct rxe_dev *rxe = to_rdev(ibdev); +struct net_device *ndev;int err, ret;if (port_num !=1 ) {
@@ -49,6 +50,12 @@ static int rxe_query_port(struct ib_device *ibdev, goto err_out; } + ndev =rxe_ib_device_get_netdev (ibdev); +if (!ndev) { + err = -ENODEV ; + goto err_out; + } +memcpy (attr, &rxe->port.attr,sizeof (*attr));mutex_lock (&rxe->usdev_lock);
@@ -57,13 +64,14 @@ static int rxe_query_port(struct ib_device *ibdev,if (attr->state ==IB_PORT_ACTIVE ) attr->phys_state =IB_PORT_PHYS_STATE_LINK_UP ; -else if (dev_get_flags (rxe->ndev) &IFF_UP ) +else if (dev_get_flags (ndev) &IFF_UP ) attr->phys_state =IB_PORT_PHYS_STATE_POLLING ;else attr->phys_state =IB_PORT_PHYS_STATE_DISABLED ;mutex_unlock (&rxe->usdev_lock); +dev_put (ndev);return ret; err_out:
@@ -1425,9 +1433,16 @@ static const struct attribute_group rxe_attr_group = {static int rxe_enable_driver (struct ib_device *ib_dev) { struct rxe_dev *rxe = container_of(ib_dev, struct rxe_dev, ib_dev); +struct net_device *ndev; + + ndev =rxe_ib_device_get_netdev (ib_dev); +if (!ndev) +return -ENODEV ;rxe_set_port_state (rxe); -dev_info (&rxe->ib_dev.dev,"added %s\n" ,netdev_name (rxe->ndev)); +dev_info (&rxe->ib_dev.dev,"added %s\n" ,netdev_name (ndev)); + +dev_put (ndev);return 0 ; }
@@ -1495,7 +1510,8 @@ static const struct ib_device_ops rxe_dev_ops = { INIT_RDMA_OBJ_SIZE(ib_mw, rxe_mw, ibmw), }; -int rxe_register_device (struct rxe_dev *rxe,const char *ibdev_name) +int rxe_register_device (struct rxe_dev *rxe,const char *ibdev_name, +struct net_device *ndev) {int err;struct ib_device *dev = &rxe->ib_dev;
@@ -1507,13 +1523,13 @@ int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name) dev->num_comp_vectors =num_possible_cpus (); dev->local_dma_lkey =0 ;addrconf_addr_eui48 ((unsigned char *)&dev->node_guid, - rxe->ndev->dev_addr); + ndev->dev_addr); dev->uverbs_cmd_mask |=BIT_ULL (IB_USER_VERBS_CMD_POST_SEND ) |BIT_ULL (IB_USER_VERBS_CMD_REQ_NOTIFY_CQ );ib_set_device_ops (dev, &rxe_dev_ops); - err =ib_device_set_netdev (&rxe->ib_dev, rxe->ndev,1 ); + err =ib_device_set_netdev (&rxe->ib_dev, ndev,1 );if (err)return err;
drivers/infiniband/sw/rxe/rxe_verbs.h +8 -3
@@ -370,6 +370,7 @@ struct rxe_port {u32 qp_gsi_index; }; +#define RXE_PORT 1struct rxe_dev {struct ib_device ib_dev;struct ib_device_attr attr;
@@ -377,8 +378,6 @@ struct rxe_dev {int max_inline_data;struct mutex usdev_lock; -struct net_device *ndev; -struct rxe_pool uc_pool;struct rxe_pool pd_pool;struct rxe_pool ah_pool;
@@ -406,6 +405,11 @@ struct rxe_dev {struct crypto_shash *tfm; }; +static inline struct net_device *rxe_ib_device_get_netdev (struct ib_device *dev) +{ +return ib_device_get_netdev (dev,RXE_PORT ); +} +static inline void rxe_counter_inc (struct rxe_dev *rxe,enum rxe_counters index) {atomic64_inc (&rxe->stats_counters[index]);
@@ -471,6 +475,7 @@ static inline struct rxe_pd *rxe_mw_pd(struct rxe_mw *mw) return to_rpd(mw->ibmw.pd); } -int rxe_register_device (struct rxe_dev *rxe,const char *ibdev_name); +int rxe_register_device (struct rxe_dev *rxe,const char *ibdev_name, +struct net_device *ndev);#endif /* RXE_VERBS_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/156 drm/i915/cx0_phy: Fix C10 pll programming sequence
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Kandpal <[email protected]>
[ Upstream commit 385a95cc72941c7f88630a7bc4176048cc03b395 ]
According to spec VDR_CUSTOM_WIDTH register gets programmed after pll specific VDR registers and TX Lane programming registers are done. Moreover we only program into C10_VDR_CONTROL1 to update config and setup master lane once all VDR registers are written into.
Bspec: 67636
--- drivers/gpu/drm/i915/display/intel_cx0_phy.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/gpu/drm/i915/display/intel_cx0_phy.c +4 -8
@@ -2084,14 +2084,6 @@ static void intel_c10_pll_program(struct drm_i915_private *i915,0 ,C10_VDR_CTRL_MSGBUS_ACCESS , MB_WRITE_COMMITTED); -/* Custom width needs to be programmed to 0 for both the phy lanes */ -intel_cx0_rmw (encoder,INTEL_CX0_BOTH_LANES ,PHY_C10_VDR_CUSTOM_WIDTH , -C10_VDR_CUSTOM_WIDTH_MASK ,C10_VDR_CUSTOM_WIDTH_8_10 , -MB_WRITE_COMMITTED ); -intel_cx0_rmw (encoder,INTEL_CX0_BOTH_LANES ,PHY_C10_VDR_CONTROL (1 ), -0 ,C10_VDR_CTRL_UPDATE_CFG , -MB_WRITE_COMMITTED ); -/* Program the pll values only for the master lane */ for (i =0 ; i <ARRAY_SIZE (pll_state->pll); i++) intel_cx0_write(encoder, INTEL_CX0_LANE0, PHY_C10_VDR_PLL(i),
@@ -2101,6 +2093,10 @@ static void intel_c10_pll_program(struct drm_i915_private *i915,intel_cx0_write (encoder,INTEL_CX0_LANE0 ,PHY_C10_VDR_CMN (0 ), pll_state->cmn,MB_WRITE_COMMITTED );intel_cx0_write (encoder,INTEL_CX0_LANE0 ,PHY_C10_VDR_TX (0 ), pll_state->tx,MB_WRITE_COMMITTED ); +/* Custom width needs to be programmed to 0 for both the phy lanes */ +intel_cx0_rmw (encoder,INTEL_CX0_BOTH_LANES ,PHY_C10_VDR_CUSTOM_WIDTH , +C10_VDR_CUSTOM_WIDTH_MASK ,C10_VDR_CUSTOM_WIDTH_8_10 , +MB_WRITE_COMMITTED );intel_cx0_rmw (encoder,INTEL_CX0_LANE0 ,PHY_C10_VDR_CONTROL (1 ),0 ,C10_VDR_CTRL_MASTER_LANE |C10_VDR_CTRL_UPDATE_CFG ,MB_WRITE_COMMITTED );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/156 drm/i915/dg1: Fix power gate sequence.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Vivi <[email protected]>
[ Upstream commit 20e7c5313ffbf11c34a46395345677adbe890bee ]
sub-pipe PG is not present on DG1. Setting these bits can disable other power gates and cause GPU hangs on video playbacks.
VLK: 16314, 4304
--- drivers/gpu/drm/i915/gt/intel_rc6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/intel_rc6.c +1 -1
@@ -133,7 +133,7 @@ static void gen11_rc6_enable(struct intel_rc6 *rc6)GEN9_MEDIA_PG_ENABLE |GEN11_MEDIA_SAMPLER_PG_ENABLE ; -if (GRAPHICS_VER (gt->i915) >=12 ) { +if (GRAPHICS_VER (gt->i915) >=12 && !IS_DG1 (gt->i915)) {for (i =0 ; i <I915_MAX_VCS ; i++)if (HAS_ENGINE (gt,_VCS (i))) pg_enable |= (VDN_HCP_POWERGATE_ENABLE(i) |
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/156 workqueue: add printf attribute to __alloc_workqueue()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit d57212f281fda9056412cd6cca983d9d2eb89f53 ]
Fix a compiler warning with W=1:kernel/workqueue.c: error:
function ‘__alloc_workqueue’ might be a candidate for ‘gnu_printf’ format attribute[-Werror=suggest-attribute=format]
5657 | name_len = vsnprintf(wq->name, sizeof(wq->name), fmt, args);
| ^~~~~~~~--- kernel/workqueue.c | 1 + 1 file changed, 1 insertion(+)
kernel/workqueue.c +1 -0
@@ -5627,6 +5627,7 @@ static void wq_adjust_max_active(struct workqueue_struct *wq) }while (activated); } +__printf(1, 0)static struct workqueue_struct *__alloc_workqueue (const char *fmt,unsigned int flags,int max_active,va_list args)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/156 netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 542ed8145e6f9392e3d0a86a0e9027d2ffd183e4 ]
Access to genmask field in struct nft_set_ext results in unaligned atomic read:
[ 72.130109] Unable to handle kernel paging request at virtual address ffff0000c2bb708c [ 72.131036] Mem abort info: [ 72.131213] ESR = 0x0000000096000021 [ 72.131446] EC = 0x25: DABT (current EL), IL = 32 bits [ 72.132209] SET = 0, FnV = 0 [ 72.133216] EA = 0, S1PTW = 0 [ 72.134080] FSC = 0x21: alignment fault [ 72.135593] Data abort info: [ 72.137194] ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000 [ 72.142351] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 72.145989] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 72.150115] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000237d27000 [ 72.154893] [ffff0000c2bb708c] pgd=0000000000000000, p4d=180000023ffff403, pud=180000023f84b403, pmd=180000023f835403, +pte=0068000102bb7707 [ 72.163021] Internal error: Oops: 0000000096000021 [#1] SMP [...] [ 72.170041] CPU: 7 UID: 0 PID: 54 Comm: kworker/7:0 Tainted: G E 6.13.0-rc3+ #2 [ 72.170509] Tainted: [E]=UNSIGNED_MODULE [ 72.170720] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-stable202302-for-qemu 03/01/2023 [ 72.171192] Workqueue: events_power_efficient nft_rhash_gc [nf_tables] [ 72.171552] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 72.171915] pc : nft_rhash_gc+0x200/0x2d8 [nf_tables] [ 72.172166] lr : nft_rhash_gc+0x128/0x2d8 [nf_tables] [ 72.172546] sp : ffff800081f2bce0 [ 72.172724] x29: ffff800081f2bd40 x28: ffff0000c2bb708c x27: 0000000000000038 [ 72.173078] x26: ffff0000c6780ef0 x25: ffff0000c643df00 x24: ffff0000c6778f78 [ 72.173431] x23: 000000000000001a x22: ffff0000c4b1f000 x21: ffff0000c6780f78 [ 72.173782] x20: ffff0000c2bb70dc x19: ffff0000c2bb7080 x18: 0000000000000000 [ 72.174135] x17: ffff0000c0a4e1c0 x16: 0000000000003000 x15: 0000ac26d173b978 [ 72.174485] x14: ffffffffffffffff x13: 0000000000000030 x12: ffff0000c6780ef0 [ 72.174841] x11: 0000000000000000 x10: ffff800081f2bcf8 x9 : ffff0000c3000000 [ 72.175193] x8 : 00000000000004be x7 : 0000000000000000 x6 : 0000000000000000 [ 72.175544] x5 : 0000000000000040 x4 : ffff0000c3000010 x3 : 0000000000000000 [ 72.175871] x2 : 0000000000003a98 x1 : ffff0000c2bb708c x0 : 0000000000000004 [ 72.176207] Call trace: [ 72.176316] nft_rhash_gc+0x200/0x2d8 [nf_tables] (P) [ 72.176653] process_one_work+0x178/0x3d0 [ 72.176831] worker_thread+0x200/0x3f0 [ 72.176995] kthread+0xe8/0xf8 [ 72.177130] ret_from_fork+0x10/0x20 [ 72.177289] Code: 54fff984 d503201f d2800080 91003261 (f820303f) [ 72.177557] ---[ end trace 0000000000000000 ]---
Align struct nft_set_ext to word size to address this and documentation it.
pahole reports that this increases the size of elements for rhash and pipapo in 8 bytes on x86_64.
--- include/net/netfilter/nf_tables.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
include/net/netfilter/nf_tables.h +5 -2
@@ -733,15 +733,18 @@ struct nft_set_ext_tmpl {/** * struct nft_set_ext - set extensions * -* @genmask: generation mask +* @genmask: generation mask, but also flags (see NFT_SET_ELEM_DEAD_BIT) * @offset: offsets of individual extension types * @data: beginning of extension data +* +* This structure must be aligned to word size, otherwise atomic bitops +* on genmask field can cause alignment failure on some archs. */ struct nft_set_ext {u8 genmask;u8 offset[NFT_SET_EXT_NUM ];char data[]; -}; +}__aligned(BITS_PER_LONG / 8) ;static inline void nft_set_ext_prepare (struct nft_set_ext_tmpl *tmpl) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/156 net: llc: reset skb->transport_header
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Pastor <[email protected]>
[ Upstream commit a024e377efed31ecfb39210bed562932321345b3 ]
802.2+LLC+SNAP frames received by napi_complete_done with GRO and DSA have skb->transport_header set two bytes short, or pointing 2 bytes before network_header & skb->data. As snap_rcv expects transport_header to point to SNAP header (OID:PID) after LLC processing advances offset over LLC header (llc_rcv & llc_fixup_skb), code doesn't find a match and packet is dropped.
Between napi_complete_done and snap_rcv, transport_header is not used until __netif_receive_skb_core, where originally it was being reset. Commit fda55eca5a33 ("net: introduce skb_transport_header_was_set()") only does so if not set, on the assumption the value was set correctly by GRO (and also on assumption that "network stacks usually reset the transport header anyway"). Afterwards it is moved forward by llc_fixup_skb.
Locally generated traffic shows up at __netif_receive_skb_core with no transport_header set and is processed without issue. On a setup with GRO but no DSA, transport_header and network_header are both set to point to skb->data which is also correct.
As issue is LLC specific, to avoid impacting non-LLC traffic, and to follow up on original assumption made on previous code change, llc_fixup_skb to reset the offset after skb pull. llc_fixup_skb assumes the LLC header is at skb->data, and by definition SNAP header immediately follows.
--- net/llc/llc_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/llc/llc_input.c +1 -1
@@ -124,8 +124,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)if (unlikely (!pskb_may_pull (skb, llc_len)))return 0 ; - skb->transport_header += llc_len;skb_pull (skb, llc_len); +skb_reset_transport_header (skb);if (skb->protocol ==htons (ETH_P_802_2 )) {__be16 pdulen;s32 data_size;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/156 nvmet: Dont overflow subsysnqn
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Stone <[email protected]>
[ Upstream commit 4db3d750ac7e894278ef1cb1c53cc7d883060496 ]
nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed size buffer, even though it is dynamically allocated to the size of the string.
Create a new string with kstrndup instead of using the old buffer.
--- drivers/nvme/target/configfs.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/nvme/target/configfs.c +9 -2
@@ -2227,12 +2227,17 @@ static ssize_t nvmet_root_discovery_nqn_store(struct config_item *item, const char *page, size_t count) {struct list_head *entry; +char *old_nqn, *new_nqn;size_t len; len =strcspn (page,"\n" );if (!len || len >NVMF_NQN_FIELD_LEN -1 )return -EINVAL ; + new_nqn =kstrndup (page, len,GFP_KERNEL ); +if (!new_nqn) +return -ENOMEM ; +down_write (&nvmet_config_sem);list_for_each (entry, &nvmet_subsystems_group.cg_children) { struct config_item *item =
@@ -2241,13 +2246,15 @@ static ssize_t nvmet_root_discovery_nqn_store(struct config_item *item,if (!strncmp (config_item_name (item), page, len)) {pr_err ("duplicate NQN %s\n" ,config_item_name (item));up_write (&nvmet_config_sem); +kfree (new_nqn);return -EINVAL ; } } -memset (nvmet_disc_subsys->subsysnqn,0 ,NVMF_NQN_FIELD_LEN ); -memcpy (nvmet_disc_subsys->subsysnqn, page, len); + old_nqn = nvmet_disc_subsys->subsysnqn; + nvmet_disc_subsys->subsysnqn = new_nqn;up_write (&nvmet_config_sem); +kfree (old_nqn);return len; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/156 ALSA: usb-audio: US16x08: Initialize array before use
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanya Agarwal <[email protected]>
[ Upstream commit b06a6187ef983f501e93faa56209169752d3bde3 ]
Initialize meter_urb array before use in mixer_us16x08.c.
CID 1410197: (#1 of 1): Uninitialized scalar variable (UNINIT)uninit_use_in_call: Using uninitialized value *meter_urb when calling get_meter_levels_from_urb.
Coverity Link:
https://scan7.scan.coverity.com/#/project-view/52849/11354?selectedIssue=1410197
--- sound/usb/mixer_us16x08.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/mixer_us16x08.c +1 -1
@@ -687,7 +687,7 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol,struct usb_mixer_elem_info *elem = kcontrol->private_data;struct snd_usb_audio *chip = elem->head.mixer->chip;struct snd_us16x08_meter_store *store = elem->private_data; -u8 meter_urb[64 ]; +u8 meter_urb[64 ] = {0 };switch (kcontrol->private_value) {case 0 : {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/156 eth: bcmsysport: fix call balance of priv->clk handling routines
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitalii Mordan <[email protected]>
[ Upstream commit b255ef45fcc2141c1bf98456796abb956d843a27 ]
Check the return value of clk_prepare_enable to ensure that priv->clk has been successfully enabled.
If priv->clk was not enabled during bcm_sysport_probe, bcm_sysport_resume, or bcm_sysport_open, it must not be disabled in any subsequent execution paths.
--- drivers/net/ethernet/broadcom/bcmsysport.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/net/ethernet/broadcom/bcmsysport.c +18 -3
@@ -1967,7 +1967,11 @@ static int bcm_sysport_open(struct net_device *dev)unsigned int i;int ret; -clk_prepare_enable (priv->clk); + ret =clk_prepare_enable (priv->clk); +if (ret) { +netdev_err (dev,"could not enable priv clock\n" ); +return ret; + }/* Reset UniMAC */ umac_reset (priv);
@@ -2625,7 +2629,11 @@ static int bcm_sysport_probe(struct platform_device *pdev) goto err_deregister_notifier; } -clk_prepare_enable (priv->clk); + ret =clk_prepare_enable (priv->clk); +if (ret) { +dev_err (&pdev->dev,"could not enable priv clock\n" ); + goto err_deregister_netdev; + } priv->rev =topctrl_readl (priv,REV_CNTL ) &REV_MASK ; dev_info(&pdev->dev,
@@ -2639,6 +2647,8 @@ static int bcm_sysport_probe(struct platform_device *pdev)return 0 ; +err_deregister_netdev: +unregister_netdev (dev); err_deregister_notifier:unregister_netdevice_notifier (&priv->netdev_notifier); err_deregister_fixed_link:
@@ -2808,7 +2818,12 @@ static int __maybe_unused bcm_sysport_resume(struct device *d)if (!netif_running (dev))return 0 ; -clk_prepare_enable (priv->clk); + ret =clk_prepare_enable (priv->clk); +if (ret) { +netdev_err (dev,"could not enable priv clock\n" ); +return ret; + } +if (priv->wolopts)clk_disable_unprepare (priv->wol_clk);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/156 net: mv643xx_eth: fix an OF node reference leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit ad5c318086e2e23b577eca33559c5ebf89bc7eb9 ]
Current implementation of mv643xx_eth_shared_of_add_port() calls of_parse_phandle(), but does not release the refcount on error. Call of_node_put() in the error path and in mv643xx_eth_shared_of_remove().
This bug was found by an experimental verification tool that I am developing.
--- drivers/net/ethernet/marvell/mv643xx_eth.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/mv643xx_eth.c +12 -2
@@ -2708,9 +2708,15 @@ static struct platform_device *port_platdev[3];static void mv643xx_eth_shared_of_remove (void ) { +struct mv643xx_eth_platform_data *pd;int n;for (n =0 ; n <3 ; n++) { +if (!port_platdev[n]) +continue ; + pd =dev_get_platdata (&port_platdev[n]->dev); +if (pd) +of_node_put (pd->phy_node);platform_device_del (port_platdev[n]); port_platdev[n] =NULL ; }
@@ -2773,8 +2779,10 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, } ppdev =platform_device_alloc (MV643XX_ETH_NAME , dev_num); -if (!ppdev) -return -ENOMEM ; +if (!ppdev) { + ret = -ENOMEM ; + goto put_err; + } ppdev->dev.coherent_dma_mask =DMA_BIT_MASK (32 ); ppdev->dev.of_node = pnp;
@@ -2796,6 +2804,8 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, port_err:platform_device_put (ppdev); +put_err: +of_node_put (ppd.phy_node);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/156 net: wwan: t7xx: Fix FSM command timeout issue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjian Song <[email protected]>
[ Upstream commit 4f619d518db9cd1a933c3a095a5f95d0c1584ae8 ]
When driver processes the internal state change command, it use an asynchronous thread to process the command operation. If the main thread detects that the task has timed out, the asynchronous thread will panic when executing the completion notification because the main thread completion object has been released.
BUG: unable to handle page fault for address: fffffffffffffff8 PGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:complete_all+0x3e/0xa0 [...] Call Trace: <TASK> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? complete_all+0x3e/0xa0 fsm_main_thread+0xa3/0x9c0 [mtk_t7xx (HASH:1400 5)] ? __pfx_autoremove_wake_function+0x10/0x10 kthread+0xd8/0x110 ? __pfx_fsm_main_thread+0x10/0x10 [mtk_t7xx (HASH:1400 5)] ? __pfx_kthread+0x10/0x10 ret_from_fork+0x38/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> [...] CR2: fffffffffffffff8 ---[ end trace 0000000000000000 ]---
Use the reference counter to ensure safe release as Sergey suggests:
https://lore.kernel.org/all/[email protected]/
--- drivers/net/wwan/t7xx/t7xx_state_monitor.c | 26 ++++++++++++++-------- drivers/net/wwan/t7xx/t7xx_state_monitor.h | 5 +++-- 2 files changed, 20 insertions(+), 11 deletions(-)
drivers/net/wwan/t7xx/t7xx_state_monitor.c +17 -9
@@ -104,14 +104,21 @@ void t7xx_fsm_broadcast_state(struct t7xx_fsm_ctl *ctl, enum md_state state)fsm_state_notify (ctl->md, state); } +static void fsm_release_command (struct kref *ref) +{ +struct t7xx_fsm_command *cmd =container_of (ref,typeof (*cmd), refcnt); + +kfree (cmd); +} +static void fsm_finish_command (struct t7xx_fsm_ctl *ctl,struct t7xx_fsm_command *cmd,int result) {if (cmd->flag &FSM_CMD_FLAG_WAIT_FOR_COMPLETION ) { - *cmd->ret = result; -complete_all (cmd->done); + cmd->result = result; +complete_all (&cmd->done); } -kfree (cmd); +kref_put (&cmd->refcnt, fsm_release_command); }static void fsm_del_kf_event (struct t7xx_fsm_event *event)
@@ -475,7 +482,6 @@ static int fsm_main_thread(void *data)int t7xx_fsm_append_cmd (struct t7xx_fsm_ctl *ctl,enum t7xx_fsm_cmd_state cmd_id,unsigned int flag) { -DECLARE_COMPLETION_ONSTACK (done);struct t7xx_fsm_command *cmd;unsigned long flags;int ret;
@@ -487,11 +493,13 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_idINIT_LIST_HEAD (&cmd->entry); cmd->cmd_id = cmd_id; cmd->flag = flag; +kref_init (&cmd->refcnt);if (flag &FSM_CMD_FLAG_WAIT_FOR_COMPLETION ) { - cmd->done = &done; - cmd->ret = &ret; +init_completion (&cmd->done); +kref_get (&cmd->refcnt); } +kref_get (&cmd->refcnt);spin_lock_irqsave (&ctl->command_lock, flags);list_add_tail (&cmd->entry, &ctl->command_queue);spin_unlock_irqrestore (&ctl->command_lock, flags);
@@ -501,11 +509,11 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_idif (flag &FSM_CMD_FLAG_WAIT_FOR_COMPLETION ) {unsigned long wait_ret; - wait_ret =wait_for_completion_timeout (&done, + wait_ret =wait_for_completion_timeout (&cmd->done,msecs_to_jiffies (FSM_CMD_TIMEOUT_MS )); -if (!wait_ret) -return -ETIMEDOUT ; + ret = wait_ret ? cmd->result : -ETIMEDOUT ; +kref_put (&cmd->refcnt, fsm_release_command);return ret; }
drivers/net/wwan/t7xx/t7xx_state_monitor.h +3 -2
@@ -110,8 +110,9 @@ struct t7xx_fsm_command {struct list_head entry;enum t7xx_fsm_cmd_state cmd_id;unsigned int flag; -struct completion *done; -int *ret; +struct completion done; +int result; +struct kref refcnt; };struct t7xx_fsm_notifier {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/156 RDMA/rtrs: Ensure ib_sge list is accessible
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit fb514b31395946022f13a08e06a435f53cf9e8b3 ]
Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the function.
Previously, 'ib_sge list' was declared within the 'always_invalidate' block, limiting its accessibility, then caused a
'BUG: kernel NULL pointer dereference'[1].
? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2d0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? memcpy_orig+0xd5/0x140 rxe_mr_copy+0x1c3/0x200 [rdma_rxe] ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] copy_data+0xa5/0x230 [rdma_rxe] rxe_requester+0xd9b/0xf70 [rdma_rxe] ? finish_task_switch.isra.0+0x99/0x2e0 rxe_sender+0x13/0x40 [rdma_rxe] do_task+0x68/0x1e0 [rdma_rxe] process_one_work+0x177/0x330 worker_thread+0x252/0x390 ? __pfx_worker_thread+0x10/0x10
This change ensures the variable is available for subsequent operations that require it.
[1] https://lore.kernel.org/linux-rdma/[email protected]/
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +1 -1
@@ -349,6 +349,7 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,struct rtrs_srv_mr *srv_mr;bool need_inval = false;enum ib_send_flags flags; +struct ib_sge list;u32 imm;int err;
@@ -401,7 +402,6 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id, imm =rtrs_to_io_rsp_imm (id->msg_id, errno, need_inval); imm_wr.wr.next =NULL ;if (always_invalidate) { -struct ib_sge list;struct rtrs_msg_rkey_rsp *msg; srv_mr = &srv_path->mrs[id->msg_id];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/156 RDMA/bnxt_re: Fix error recovery sequence
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit e6178bf78d0378c2d397a6aafaf4882d0af643fa ]
Fixed to return ENXIO from __send_message_basic_sanity() to indicate that device is in error state. In the case of ERR_DEVICE_DETACHED state, the driver should not post the commands to the firmware as it will time out eventually.
Removed bnxt_re_modify_qp() call from bnxt_re_dev_stop() as it is a no-op.
--- drivers/infiniband/hw/bnxt_re/main.c | 8 +------- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 5 +++-- 2 files changed, 4 insertions(+), 9 deletions(-)
drivers/infiniband/hw/bnxt_re/main.c +1 -7
@@ -1435,11 +1435,8 @@ static bool bnxt_re_is_qp1_or_shadow_qp(struct bnxt_re_dev *rdev,static void bnxt_re_dev_stop (struct bnxt_re_dev *rdev) { -int mask =IB_QP_STATE ; -struct ib_qp_attr qp_attr;struct bnxt_re_qp *qp; - qp_attr.qp_state =IB_QPS_ERR ;mutex_lock (&rdev->qp_lock);list_for_each_entry (qp, &rdev->qp_list, list) {/* Modify the state of all QPs except QP1/Shadow QP */
@@ -1447,12 +1444,9 @@ static void bnxt_re_dev_stop(struct bnxt_re_dev *rdev)if (qp->qplib_qp.state !=CMDQ_MODIFY_QP_NEW_STATE_RESET && qp->qplib_qp.state != -CMDQ_MODIFY_QP_NEW_STATE_ERR ) { +CMDQ_MODIFY_QP_NEW_STATE_ERR )bnxt_re_dispatch_event (&rdev->ibdev, &qp->ib_qp,1 ,IB_EVENT_QP_FATAL ); -bnxt_re_modify_qp (&qp->ib_qp, &qp_attr, mask, -NULL ); - } } }mutex_unlock (&rdev->qp_lock);
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +3 -2
@@ -424,7 +424,8 @@ static int __send_message_basic_sanity(struct bnxt_qplib_rcfw *rcfw,/* Prevent posting if f/w is not in a state to process */ if (test_bit (ERR_DEVICE_DETACHED , &rcfw->cmdq.flags)) -return bnxt_qplib_map_rc (opcode); +return -ENXIO ; +if (test_bit (FIRMWARE_STALL_DETECTED , &cmdq->flags))return -ETIMEDOUT ;
@@ -493,7 +494,7 @@ static int __bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw, rc =__send_message_basic_sanity (rcfw, msg, opcode);if (rc) -return rc; +return rc == -ENXIO ?bnxt_qplib_map_rc (opcode) : rc; rc =__send_message (rcfw, msg, opcode);if (rc)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/156 io_uring/net: always initialize kmsg->msg.msg_inq upfront
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit c6e60a0a68b7e6b3c7e33863a16e8e88ba9eee6f ]
syzbot reports that ->msg_inq may get used uinitialized from the following path:
BUG: KMSAN: uninit-value in io_recv_buf_select io_uring/net.c:1094 [inline] BUG: KMSAN: uninit-value in io_recv+0x930/0x1f90 io_uring/net.c:1158 io_recv_buf_select io_uring/net.c:1094 [inline] io_recv+0x930/0x1f90 io_uring/net.c:1158 io_issue_sqe+0x420/0x2130 io_uring/io_uring.c:1740 io_queue_sqe io_uring/io_uring.c:1950 [inline] io_req_task_submit+0xfa/0x1d0 io_uring/io_uring.c:1374 io_handle_tw_list+0x55f/0x5c0 io_uring/io_uring.c:1057 tctx_task_work_run+0x109/0x3e0 io_uring/io_uring.c:1121 tctx_task_work+0x6d/0xc0 io_uring/io_uring.c:1139 task_work_run+0x268/0x310 kernel/task_work.c:239 io_run_task_work+0x43a/0x4a0 io_uring/io_uring.h:343 io_cqring_wait io_uring/io_uring.c:2527 [inline] __do_sys_io_uring_enter io_uring/io_uring.c:3439 [inline] __se_sys_io_uring_enter+0x204f/0x4ce0 io_uring/io_uring.c:3330 __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3330 x64_sys_call+0xce5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:427 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
and it is correct, as it's never initialized upfront. Hence the first submission can end up using it uninitialized, if the recv wasn't successful and the networking stack didn't honor ->msg_get_inq being set and filling in the output value of ->msg_inq as requested.
Set it to 0 upfront when it's allocated, just to silence this KMSAN warning. There's no side effect of using it uninitialized, it'll just potentially cause the next receive to use a recv value hint that's not accurate.
--- io_uring/net.c | 1 + 1 file changed, 1 insertion(+)
io_uring/net.c +1 -0
@@ -748,6 +748,7 @@ static int io_recvmsg_prep_setup(struct io_kiocb *req)if (req->opcode ==IORING_OP_RECV ) { kmsg->msg.msg_name =NULL ; kmsg->msg.msg_namelen =0 ; + kmsg->msg.msg_inq =0 ; kmsg->msg.msg_control =NULL ; kmsg->msg.msg_get_inq =1 ; kmsg->msg.msg_controllen =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/156 net: sfc: Correct key_len for efx_tc_ct_zone_ht_params
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liang Jie <[email protected]>
[ Upstream commit a8620de72e5676993ec3a3b975f7c10908f5f60f ]
In efx_tc_ct_zone_ht_params, the key_len was previously set to offsetof(struct efx_tc_ct_zone, linkage). This calculation is incorrect because it includes any padding between the zone field and the linkage field due to structure alignment, which can vary between systems.
This patch updates key_len to use sizeof_field(struct efx_tc_ct_zone, zone) , ensuring that the hash table correctly uses the zone as the key. This fix prevents potential hash lookup errors and improves connection tracking reliability.
--- drivers/net/ethernet/sfc/tc_conntrack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/sfc/tc_conntrack.c +1 -1
@@ -16,7 +16,7 @@ static int efx_tc_flow_block(enum tc_setup_type type, void *type_data, void *cb_priv);static const struct rhashtable_params efx_tc_ct_zone_ht_params = { - .key_len = offsetof(struct efx_tc_ct_zone , linkage), + .key_len = sizeof_field(struct efx_tc_ct_zone, zone), .key_offset =0 , .head_offset = offsetof(struct efx_tc_ct_zone , linkage), };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/156 net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit 68e068cabd2c6c533ef934c2e5151609cf6ecc6d ]
The blamed commit disabled hardware offoad of IPv6 packets with extension headers on devices that advertise NETIF_F_IPV6_CSUM, based on the definition of that feature in skbuff.h:
* * - %NETIF_F_IPV6_CSUM
* - Driver (device) is only able to checksum plain
* TCP or UDP packets over IPv6. These are specifically * unencapsulated packets of the form IPv6|TCP or * IPv6|UDP where the Next Header field in the IPv6 * header is either TCP or UDP. IPv6 extension headers * are not supported with this feature. This feature * cannot be set in features for a device with * NETIF_F_HW_CSUM also set. This feature is being * DEPRECATED (see below).
The change causes skb_warn_bad_offload to fire for BIG TCP packets.
[ 496.310233] WARNING: CPU: 13 PID: 23472 at net/core/dev.c:3129 skb_warn_bad_offload+0xc4/0xe0
[ 496.310297] ? skb_warn_bad_offload+0xc4/0xe0 [ 496.310300] skb_checksum_help+0x129/0x1f0 [ 496.310303] skb_csum_hwoffload_help+0x150/0x1b0 [ 496.310306] validate_xmit_skb+0x159/0x270 [ 496.310309] validate_xmit_skb_list+0x41/0x70 [ 496.310312] sch_direct_xmit+0x5c/0x250 [ 496.310317] __qdisc_run+0x388/0x620
BIG TCP introduced an IPV6_TLV_JUMBO IPv6 extension header to communicate packet length, as this is an IPv6 jumbogram. But, the feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices.
For this specific case of extension headers that are not transmitted, return to the situation before the blamed commit and support hardware offload.
ipv6_has_hopopt_jumbo() tests not only whether this header is present, but also that it is the only extension header before a terminal (L4) header.
--- net/core/dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/core/dev.c +3 -1
@@ -3640,8 +3640,10 @@ int skb_csum_hwoffload_help(struct sk_buff *skb,if (features & (NETIF_F_IP_CSUM |NETIF_F_IPV6_CSUM )) {if (vlan_get_protocol (skb) ==htons (ETH_P_IPV6 ) && -skb_network_header_len (skb) !=sizeof (struct ipv6hdr )) +skb_network_header_len (skb) !=sizeof (struct ipv6hdr ) && + !ipv6_has_hopopt_jumbo (skb)) goto sw_checksum; +switch (skb->csum_offset) {case offsetof(struct tcphdr , check):case offsetof(struct udphdr , check):
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/156 net: restrict SO_REUSEPORT to inet sockets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5b0af621c3f6ef9261cf6067812f2fd9943acb4b ]
After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot [1].
Trying to acquire a mutex in RCU callback is not allowed.
Restrict SO_REUSEPORT socket option to inet sockets.
v1 of this patch supported TCP, UDP and SCTP sockets, but fcnal-test.sh test needed RAW and ICMP support.
[1]
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:562
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 24, name: ksoftirqd/1preempt_count: 100, expected: 0
RCU nest depth: 0, expected: 0
1 lock held by ksoftirqd/1/24:
#0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2561 [inline] #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_core+0xa37/0x17a0 kernel/rcu/tree.c:2823
Preemption disabled at:
[<ffffffff8161c8c8>] softirq_handle_begin kernel/softirq.c:402 [inline] [<ffffffff8161c8c8>] handle_softirqs+0x128/0x9b0 kernel/softirq.c:537 CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.13.0-rc3-syzkaller-00174-ga024e377efed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 __might_resched+0x5d4/0x780 kernel/sched/core.c:8758 __mutex_lock_common kernel/locking/mutex.c:562 [inline] __mutex_lock+0x131/0xee0 kernel/locking/mutex.c:735 crypto_put_default_null_skcipher+0x18/0x70 crypto/crypto_null.c:179 aead_release+0x3d/0x50 crypto/algif_aead.c:489 alg_do_release crypto/af_alg.c:118 [inline] alg_sock_destruct+0x86/0xc0 crypto/af_alg.c:502 __sk_destruct+0x58/0x5f0 net/core/sock.c:2260 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 run_ksoftirqd+0xca/0x130 kernel/softirq.c:950 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
--- net/core/sock.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/core/sock.c +4 -1
@@ -1300,7 +1300,10 @@ int sk_setsockopt(struct sock *sk, int level, int optname, sk->sk_reuse = (valbool ?SK_CAN_REUSE :SK_NO_REUSE );break ;case SO_REUSEPORT : - sk->sk_reuseport = valbool; +if (valbool && !sk_is_inet (sk)) + ret = -EOPNOTSUPP ; +else + sk->sk_reuseport = valbool;break ;case SO_DONTROUTE :sock_valbool_flag (sk,SOCK_LOCALROUTE , valbool);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/156 net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej S. Szmigiero <[email protected]>
[ Upstream commit a7af435df0e04cfb4a4004136d597c42639a2ae7 ]
ipc_mmio_init() used the post-decrement operator in its loop continuing condition of "retries" counter being "> 0", which meant that when this condition caused loop exit "retries" counter reached -1.
But the later valid exec stage failure check only tests for "retries" counter being exactly zero, so it didn't trigger in this case (but would wrongly trigger if the code reaches a valid exec stage in the very last loop iteration).
Fix this by using the pre-decrement operator instead, so the loop counter is exactly zero on valid exec stage failure.
--- drivers/net/wwan/iosm/iosm_ipc_mmio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wwan/iosm/iosm_ipc_mmio.c +1 -1
@@ -104,7 +104,7 @@ struct iosm_mmio *ipc_mmio_init(void __iomem *mmio, struct device *dev)break ;msleep (20 ); - }while (retries-- >0 ); + }while (--retries >0 );if (!retries) {dev_err (ipc_mmio->dev,"invalid exec stage %X" , stage);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/156 af_packet: fix vlan_get_tci() vs MSG_PEEK
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 77ee7a6d16b6ec07b5c3ae2b6b60a24c1afbed09 ]
Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot.
Rework vlan_get_tci() to not touch skb at all, so that it can be used from many cpus on the same skb.
Add a const qualifier to skb argument.
[1]
skbuff: skb_under_panic: text:ffffffff8a8da482 len:32 put:14 head:ffff88807a1d5800 data:ffff88807a1d5810 tail:0x14 end:0x140 dev:<NULL>
------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:206 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 5880 Comm: syz-executor172 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:skb_panic net/core/skbuff.c:206 [inline] RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216 Code: 0b 8d 48 c7 c6 9e 6c 26 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 3a 5a 79 f7 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc90003baf5b8 EFLAGS: 00010286 RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 8565c1eec37aa000 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88802616fb50 R08: ffffffff817f0a4c R09: 1ffff92000775e50 R10: dffffc0000000000 R11: fffff52000775e51 R12: 0000000000000140 R13: ffff88807a1d5800 R14: ffff88807a1d5810 R15: 0000000000000014 FS: 00007fa03261f6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd65753000 CR3: 0000000031720000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> skb_push+0xe5/0x100 net/core/skbuff.c:2636 vlan_get_tci+0x272/0x550 net/packet/af_packet.c:565 packet_recvmsg+0x13c9/0x1ef0 net/packet/af_packet.c:3616 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0x22f/0x280 net/socket.c:1066 ____sys_recvmsg+0x1c6/0x480 net/socket.c:2814 ___sys_recvmsg net/socket.c:2856 [inline] do_recvmmsg+0x426/0xab0 net/socket.c:2951 __sys_recvmmsg net/socket.c:3025 [inline] __do_sys_recvmmsg net/socket.c:3048 [inline] __se_sys_recvmmsg net/socket.c:3041 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3041 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
--- net/packet/af_packet.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
net/packet/af_packet.c +3 -9
@@ -538,10 +538,8 @@ static void *packet_current_frame(struct packet_sock *po,return packet_lookup_frame (po, rb, rb->head, status); } -static u16 vlan_get_tci (struct sk_buff *skb,struct net_device *dev) +static u16 vlan_get_tci (const struct sk_buff *skb,struct net_device *dev) { -u8 *skb_orig_data = skb->data; -int skb_orig_len = skb->len;struct vlan_hdr vhdr, *vh;unsigned int header_len;
@@ -562,12 +560,8 @@ static u16 vlan_get_tci(struct sk_buff *skb, struct net_device *dev)else return 0 ; -skb_push (skb, skb->data -skb_mac_header (skb)); - vh =skb_header_pointer (skb, header_len,sizeof (vhdr), &vhdr); -if (skb_orig_data != skb->data) { - skb->data = skb_orig_data; - skb->len = skb_orig_len; - } + vh =skb_header_pointer (skb,skb_mac_offset (skb) + header_len, +sizeof (vhdr), &vhdr);if (unlikely (!vh))return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/156 af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit f91a5b8089389eb408501af2762f168c3aaa7b79 ]
Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot.
Rework vlan_get_protocol_dgram() to not touch skb at all, so that it can be used from many cpus on the same skb.
Add a const qualifier to skb argument.
[1]
skbuff: skb_under_panic: text:ffffffff8a8ccd05 len:29 put:14 head:ffff88807fc8e400 data:ffff88807fc8e3f4 tail:0x11 end:0x140 dev:<NULL>
------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:206 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 5892 Comm: syz-executor883 Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:skb_panic net/core/skbuff.c:206 [inline] RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216 Code: 0b 8d 48 c7 c6 86 d5 25 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 5a 69 79 f7 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc900038d7638 EFLAGS: 00010282 RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 609ffd18ea660600 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88802483c8d0 R08: ffffffff817f0a8c R09: 1ffff9200071ae60 R10: dffffc0000000000 R11: fffff5200071ae61 R12: 0000000000000140 R13: ffff88807fc8e400 R14: ffff88807fc8e3f4 R15: 0000000000000011 FS: 00007fbac5e006c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbac5e00d58 CR3: 000000001238e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> skb_push+0xe5/0x100 net/core/skbuff.c:2636 vlan_get_protocol_dgram+0x165/0x290 net/packet/af_packet.c:585 packet_recvmsg+0x948/0x1ef0 net/packet/af_packet.c:3552 sock_recvmsg_nosec net/socket.c:1033 [inline] sock_recvmsg+0x22f/0x280 net/socket.c:1055 ____sys_recvmsg+0x1c6/0x480 net/socket.c:2803 ___sys_recvmsg net/socket.c:2845 [inline] do_recvmmsg+0x426/0xab0 net/socket.c:2940 __sys_recvmmsg net/socket.c:3014 [inline] __do_sys_recvmmsg net/socket.c:3037 [inline] __se_sys_recvmmsg net/socket.c:3030 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3030 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- include/linux/if_vlan.h | 16 +++++++++++++--- net/packet/af_packet.c | 16 ++++------------ 2 files changed, 17 insertions(+), 15 deletions(-)
include/linux/if_vlan.h +13 -3
@@ -585,13 +585,16 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)* vlan_get_protocol - get protocol EtherType. * @skb: skbuff to query * @type: first vlan protocol +* @mac_offset: MAC offset * @depth: buffer to store length of eth and vlan tags in bytes * * Returns the EtherType of the packet, regardless of whether it is * vlan encapsulated (normal or hardware accelerated) or not. */ -static inline __be16 __vlan_get_protocol (const struct sk_buff *skb,__be16 type, -int *depth) +static inline __be16 __vlan_get_protocol_offset (const struct sk_buff *skb, +__be16 type, +int mac_offset, +int *depth) {unsigned int vlan_depth = skb->mac_len, parse_depth =VLAN_MAX_DEPTH ;
@@ -610,7 +613,8 @@ static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, do { struct vlan_hdr vhdr, *vh; - vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr); + vh = skb_header_pointer(skb, mac_offset + vlan_depth, + sizeof(vhdr), &vhdr); if (unlikely(!vh || !--parse_depth)) return 0;
@@ -625,6 +629,12 @@ static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type,return type; } +static inline __be16 __vlan_get_protocol (const struct sk_buff *skb,__be16 type, +int *depth) +{ +return __vlan_get_protocol_offset (skb, type,0 , depth); +} +/** * vlan_get_protocol - get protocol EtherType. * @skb: skbuff to query
net/packet/af_packet.c +4 -12
@@ -568,21 +568,13 @@ static u16 vlan_get_tci(const struct sk_buff *skb, struct net_device *dev)return ntohs (vh->h_vlan_TCI); } -static __be16 vlan_get_protocol_dgram (struct sk_buff *skb) +static __be16 vlan_get_protocol_dgram (const struct sk_buff *skb) {__be16 proto = skb->protocol; -if (unlikely (eth_type_vlan (proto))) { -u8 *skb_orig_data = skb->data; -int skb_orig_len = skb->len; - -skb_push (skb, skb->data -skb_mac_header (skb)); - proto =__vlan_get_protocol (skb, proto,NULL ); -if (skb_orig_data != skb->data) { - skb->data = skb_orig_data; - skb->len = skb_orig_len; - } - } +if (unlikely (eth_type_vlan (proto))) + proto =__vlan_get_protocol_offset (skb, proto, +skb_mac_offset (skb),NULL );return proto; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/156 ila: serialize calls to nf_register_net_hooks()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 260466b576bca0081a7d4acecc8e93687aa22d0e ]
syzbot found a race in ila_add_mapping() [1]
commit 031ae72825ce ("ila: call nf_unregister_net_hooks() sooner") attempted to fix a similar issue.
Looking at the syzbot repro, we have concurrent ILA_CMD_ADD commands.
Add a mutex to make sure at most one thread is calling nf_register_net_hooks().
[1]
BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 Read of size 4 at addr ffff888028f40008 by task dhcpcd/5501 CPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626 nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269 NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785 process_backlog+0x443/0x15f0 net/core/dev.c:6117 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883 napi_poll net/core/dev.c:6952 [inline] net_rx_action+0xa94/0x1010 net/core/dev.c:7074 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
--- net/ipv6/ila/ila_xlat.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
net/ipv6/ila/ila_xlat.c +11 -5
@@ -200,6 +200,8 @@ static const struct nf_hook_ops ila_nf_hook_ops[] = { }, }; +static DEFINE_MUTEX (ila_mutex); +static int ila_add_mapping (struct net *net,struct ila_xlat_params *xp) {struct ila_net *ilan =net_generic (net, ila_net_id);
@@ -207,16 +209,20 @@ static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp)spinlock_t *lock =ila_get_lock (ilan, xp->ip.locator_match);int err =0 , order; -if (!ilan->xlat.hooks_registered) { +if (!READ_ONCE (ilan->xlat.hooks_registered)) {/* We defer registering net hooks in the namespace until the * first mapping is added. */ - err =nf_register_net_hooks (net, ila_nf_hook_ops, -ARRAY_SIZE (ila_nf_hook_ops)); +mutex_lock (&ila_mutex); +if (!ilan->xlat.hooks_registered) { + err =nf_register_net_hooks (net, ila_nf_hook_ops, +ARRAY_SIZE (ila_nf_hook_ops)); +if (!err) +WRITE_ONCE (ilan->xlat.hooks_registered, true); + } +mutex_unlock (&ila_mutex);if (err)return err; - - ilan->xlat.hooks_registered = true; } ila =kzalloc (sizeof (*ila),GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/156 net: ti: icssg-prueth: Fix firmware load sequence.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: MD Danish Anwar <[email protected]>
[ Upstream commit 9facce84f4062f782ebde18daa7006a23d40b607 ]
Timesync related operations are ran in PRU0 cores for both ICSSG SLICE0 and SLICE1. Currently whenever any ICSSG interface comes up we load the respective firmwares to PRU cores and whenever interface goes down, we stop the resective cores. Due to this, when SLICE0 goes down while SLICE1 is still active, PRU0 firmwares are unloaded and PRU0 core is stopped. This results in clock jump for SLICE1 interface as the timesync related operations are no longer running.
As there are interdependencies between SLICE0 and SLICE1 firmwares, fix this by running both PRU0 and PRU1 firmwares as long as at least 1 ICSSG interface is up. Add new flag in prueth struct to check if all firmwares are running and remove the old flag (fw_running).
Use emacs_initialized as reference count to load the firmwares for the first and last interface up/down. Moving init_emac_mode and fw_offload_mode API outside of icssg_config to icssg_common_start API as they need to be called only once per firmware boot.
Change prueth_emac_restart() to return error code and add error prints inside the caller of this functions in case of any failures.
Move prueth_emac_stop() from common to sr1 driver. sr1 and sr2 drivers have different logic handling for stopping the firmwares. While sr1 driver is dependent on emac structure to stop the corresponding pru cores for that slice, for sr2 all the pru cores of both the slices are stopped and is not dependent on emac. So the prueth_emac_stop() function is no longer common and can be moved to sr1 driver.
--- drivers/net/ethernet/ti/icssg/icssg_common.c | 25 -- drivers/net/ethernet/ti/icssg/icssg_config.c | 41 ++- drivers/net/ethernet/ti/icssg/icssg_config.h | 1 + drivers/net/ethernet/ti/icssg/icssg_prueth.c | 261 ++++++++++++------ drivers/net/ethernet/ti/icssg/icssg_prueth.h | 5 +- .../net/ethernet/ti/icssg/icssg_prueth_sr1.c | 24 +- 6 files changed, 236 insertions(+), 121 deletions(-)
drivers/net/ethernet/ti/icssg/icssg_common.c +0 -25
@@ -855,31 +855,6 @@ irqreturn_t prueth_rx_irq(int irq, void *dev_id) }EXPORT_SYMBOL_GPL (prueth_rx_irq); -void prueth_emac_stop (struct prueth_emac *emac) -{ -struct prueth *prueth = emac->prueth; -int slice; - -switch (emac->port_id) { -case PRUETH_PORT_MII0 : - slice =ICSS_SLICE0 ; -break ; -case PRUETH_PORT_MII1 : - slice =ICSS_SLICE1 ; -break ; -default : -netdev_err (emac->ndev,"invalid port\n" ); -return ; - } - - emac->fw_running =0 ; -if (!emac->is_sr1) -rproc_shutdown (prueth->txpru[slice]); -rproc_shutdown (prueth->rtu[slice]); -rproc_shutdown (prueth->pru[slice]); -} -EXPORT_SYMBOL_GPL (prueth_emac_stop); -void prueth_cleanup_tx_ts (struct prueth_emac *emac) {int i;
drivers/net/ethernet/ti/icssg/icssg_config.c +28 -13
79 lines not on this page · raw message
drivers/net/ethernet/ti/icssg/icssg_config.h +1 -0
@@ -55,6 +55,7 @@ struct icssg_rxq_ctx {#define ICSSG_FW_MGMT_FDB_CMD_TYPE 0x03#define ICSSG_FW_MGMT_CMD_TYPE 0x04#define ICSSG_FW_MGMT_PKT 0x80000000 +#define ICSSG_FW_MGMT_FDB_CMD_TYPE_RX_FLOW 0x05struct icssg_r30_cmd {u32 cmd[4 ];
drivers/net/ethernet/ti/icssg/icssg_prueth.c +181 -80
416 lines not on this page · raw message
drivers/net/ethernet/ti/icssg/icssg_prueth.h +3 -2
@@ -140,7 +140,6 @@ struct prueth_rx_chn {/* data for each emac port */ struct prueth_emac {bool is_sr1; -bool fw_running;struct prueth *prueth;struct net_device *ndev;u8 mac_addr[6 ];
@@ -361,6 +360,8 @@ int icssg_set_port_state(struct prueth_emac *emac, enum icssg_port_state_cmd state);void icssg_config_set_speed (struct prueth_emac *emac);void icssg_config_half_duplex (struct prueth_emac *emac); +void icssg_init_emac_mode (struct prueth *prueth); +void icssg_init_fw_offload_mode (struct prueth *prueth);/* Buffer queue helpers */ int icssg_queue_pop (struct prueth *prueth,u8 queue);
@@ -377,6 +378,7 @@ void icssg_vtbl_modify(struct prueth_emac *emac, u8 vid, u8 port_mask, u8 untag_mask, bool add);u16 icssg_get_pvid (struct prueth_emac *emac);void icssg_set_pvid (struct prueth *prueth,u8 vid,u8 port); +int emac_fdb_flow_id_updated (struct prueth_emac *emac);#define prueth_napi_to_tx_chn (pnapi) \ container_of(pnapi, struct prueth_tx_chn, napi_tx)
@@ -407,7 +409,6 @@ void emac_rx_timestamp(struct prueth_emac *emac, struct sk_buff *skb, u32 *psdata);enum netdev_tx icssg_ndo_start_xmit (struct sk_buff *skb,struct net_device *ndev);irqreturn_t prueth_rx_irq (int irq,void *dev_id); -void prueth_emac_stop (struct prueth_emac *emac);void prueth_cleanup_tx_ts (struct prueth_emac *emac);int icssg_napi_rx_poll (struct napi_struct *napi_rx,int budget); int prueth_prepare_rx_chan(struct prueth_emac *emac,
drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c +23 -1
@@ -440,7 +440,6 @@ static int prueth_emac_start(struct prueth *prueth, struct prueth_emac *emac) goto halt_pru; } - emac->fw_running =1 ;return 0 ; halt_pru:
@@ -449,6 +448,29 @@ static int prueth_emac_start(struct prueth *prueth, struct prueth_emac *emac)return ret; } +static void prueth_emac_stop (struct prueth_emac *emac) +{ +struct prueth *prueth = emac->prueth; +int slice; + +switch (emac->port_id) { +case PRUETH_PORT_MII0 : + slice =ICSS_SLICE0 ; +break ; +case PRUETH_PORT_MII1 : + slice =ICSS_SLICE1 ; +break ; +default : +netdev_err (emac->ndev,"invalid port\n" ); +return ; + } + +if (!emac->is_sr1) +rproc_shutdown (prueth->txpru[slice]); +rproc_shutdown (prueth->rtu[slice]); +rproc_shutdown (prueth->pru[slice]); +} +/** * emac_ndo_open - EMAC device open * @ndev: network adapter device
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/156 net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meghana Malladi <[email protected]>
[ Upstream commit 9b115361248dc6cce182a2dc030c1c70b0a9639e ]
When ICSSG interfaces are brought down and brought up again, the pru cores are shut down and booted again, flushing out all the memories and start again in a clean state. Hence it is expected that the IEP_CMP_CFG register needs to be flushed during iep_init() to ensure that the existing residual configuration doesn't cause any unusual behavior. If the register is not cleared, existing IEP_CMP_CFG set for CMP1 will result in SYNC0_OUT signal based on the SYNC_OUT register values.
After bringing the interface up, calling PPS enable doesn't work as the driver believes PPS is already enabled, (iep->pps_enabled is not cleared during interface bring down) and driver will just return true even though there is no signal. Fix this by disabling pps and perout.
--- drivers/net/ethernet/ti/icssg/icss_iep.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/ethernet/ti/icssg/icss_iep.c +8 -0
@@ -215,6 +215,9 @@ static void icss_iep_enable_shadow_mode(struct icss_iep *iep)for (cmp =IEP_MIN_CMP ; cmp <IEP_MAX_CMP ; cmp++) {regmap_update_bits (iep->map,ICSS_IEP_CMP_STAT_REG ,IEP_CMP_STATUS (cmp),IEP_CMP_STATUS (cmp)); + +regmap_update_bits (iep->map,ICSS_IEP_CMP_CFG_REG , +IEP_CMP_CFG_CMP_EN (cmp),0 ); }/* enable reset counter on CMP0 event */
@@ -780,6 +783,11 @@ int icss_iep_exit(struct icss_iep *iep) }icss_iep_disable (iep); +if (iep->pps_enabled) +icss_iep_pps_enable (iep, false); +else if (iep->perout_enabled) +icss_iep_perout_enable (iep,NULL , false); +return 0 ; }EXPORT_SYMBOL_GPL (icss_iep_exit);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/156 btrfs: allow swap activation to be interruptible
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 9a45022a0efadd99bcc58f7f1cc2b6fb3b808c40 ]
During swap activation we iterate over the extents of a file, then do several checks for each extent, some of which may take some significant time such as checking if an extent is shared. Since a file can have many thousands of extents, this can be a very slow operation and it's currently not interruptible. I had a bug during development of a previous patch that resulted in an infinite loop when iterating the extents, so a core was busy looping and I couldn't cancel the operation, which is very annoying and requires a reboot. So make the loop interruptible by checking for fatal signals at the end of each iteration and stopping immediately if there is one.
--- fs/btrfs/inode.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/btrfs/inode.c +5 -0
@@ -10056,6 +10056,11 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, bsi.block_start = physical_block_start; bsi.block_len = len; } + +if (fatal_signal_pending (current)) { + ret = -EINTR ; + goto out; + } }if (bsi.block_len)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/156 perf/x86/intel: Add Arrow Lake U support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <[email protected]>
[ Upstream commit 4e54ed496343702837ddca5f5af720161c6a5407 ]
Quoted 1 line
From PMU's perspective, the new Arrow Lake U is the same as the
Meteor Lake.
--- arch/x86/events/intel/core.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/events/intel/core.c +1 -0
@@ -7067,6 +7067,7 @@ __init int intel_pmu_init(void)case INTEL_METEORLAKE :case INTEL_METEORLAKE_L : +case INTEL_ARROWLAKE_U :intel_pmu_init_hybrid (hybrid_big_small); x86_pmu.pebs_latency_data = cmt_latency_data;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/156 wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Issam Hamdi <[email protected]>
[ Upstream commit 49dba1ded8dd5a6a12748631403240b2ab245c34 ]
On 32-bit systems, the size of an unsigned long is 4 bytes, while a u64 is 8 bytes. Therefore, when using or_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE), the code is incorrectly searching for a bit in a 32-bit variable that is expected to be 64 bits in size, leading to incorrect bit finding.
Solution: Ensure that the size of the bits variable is correctly adjusted for each architecture.
Call Trace: ? show_regs+0x54/0x58 ? __warn+0x6b/0xd4 ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211] ? report_bug+0x113/0x150 ? exc_overflow+0x30/0x30 ? handle_bug+0x27/0x44 ? exc_invalid_op+0x18/0x50 ? handle_exception+0xf6/0xf6 ? exc_overflow+0x30/0x30 ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211] ? exc_overflow+0x30/0x30 ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211] ? ieee80211_mesh_work+0xff/0x260 [mac80211] ? cfg80211_wiphy_work+0x72/0x98 [cfg80211] ? process_one_work+0xf1/0x1fc ? worker_thread+0x2c0/0x3b4 ? kthread+0xc7/0xf0 ? mod_delayed_work_on+0x4c/0x4c ? kthread_complete_and_exit+0x14/0x14 ? ret_from_fork+0x24/0x38 ? kthread_complete_and_exit+0x14/0x14 ? ret_from_fork_asm+0xf/0x14 ? entry_INT80_32+0xf0/0xf0
--- net/mac80211/mesh.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/mac80211/mesh.c +3 -3
@@ -1157,14 +1157,14 @@ void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata, u64 changed) {struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; -unsigned long bits = changed; +unsigned long bits[] = {BITMAP_FROM_U64 (changed) };u32 bit; -if (!bits) +if (!changed)return ;/* if we race with running work, worst case this work becomes a noop */ -for_each_set_bit (bit, &bits,sizeof (changed) *BITS_PER_BYTE ) +for_each_set_bit (bit, bits,sizeof (changed) *BITS_PER_BYTE )set_bit (bit, ifmsh->mbss_changed);set_bit (MESH_WORK_MBSS_CHANGED , &ifmsh->wrkq_flags);wiphy_work_queue (sdata->local->hw.wiphy, &sdata->work);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/156 wifi: cfg80211: clear link ID from bitmap during link delete after clean up
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Kumar Singh <[email protected]>
[ Upstream commit b5c32ff6a3a38c74facdd1fe34c0d709a55527fd ]
Currently, during link deletion, the link ID is first removed from the valid_links bitmap before performing any clean-up operations. However, some functions require the link ID to remain in the valid_links bitmap. One such example is cfg80211_cac_event(). The flow is -
nl80211_remove_link()
cfg80211_remove_link()
ieee80211_del_intf_link()
ieee80211_vif_set_links()
ieee80211_vif_update_links()
ieee80211_link_stop()
cfg80211_cac_event()cfg80211_cac_event() requires link ID to be present but it is cleared already in cfg80211_remove_link(). Ultimately, WARN_ON() is hit.
Therefore, clear the link ID from the bitmap only after completing the link clean-up.
--- net/mac80211/cfg.c | 8 +++++++- net/wireless/util.c | 3 +-- 2 files changed, 8 insertions(+), 3 deletions(-)
net/mac80211/cfg.c +7 -1
@@ -4992,10 +4992,16 @@ static void ieee80211_del_intf_link(struct wiphy *wiphy, unsigned int link_id) {struct ieee80211_sub_if_data *sdata =IEEE80211_WDEV_TO_SUB_IF (wdev); +u16 new_links = wdev->valid_links & ~BIT (link_id);lockdep_assert_wiphy (sdata->local->hw.wiphy); -ieee80211_vif_set_links (sdata, wdev->valid_links,0 ); +/* During the link teardown process, certain functions require the +* link_id to remain in the valid_links bitmap. Therefore, instead +* of removing the link_id from the bitmap, pass a masked value to +* simulate as if link_id does not exist anymore. +*/ +ieee80211_vif_set_links (sdata, new_links,0 ); } static int
net/wireless/util.c +1 -2
@@ -2843,10 +2843,9 @@ void cfg80211_remove_link(struct wireless_dev *wdev, unsigned int link_id)break ; } - wdev->valid_links &= ~BIT (link_id); -rdev_del_intf_link (rdev, wdev, link_id); + wdev->valid_links &= ~BIT (link_id);eth_zero_addr (wdev->links[link_id].addr); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/156 wifi: mac80211: wake the queues in case of failure in resume
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 220bf000530f9b1114fa2a1022a871c7ce8a0b38 ]
In case we fail to resume, we'll WARN with
"Hardware became unavailable during restart." and we'll wait until user space does something. It'll typically bring the interface down and up to recover. This won't work though because the queues are still stopped on IEEE80211_QUEUE_STOP_REASON_SUSPEND reason.
Make sure we clear that reason so that we give a chance to the recovery to succeed.
--- net/mac80211/util.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/util.c +3 -0
@@ -1825,6 +1825,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)WARN (1 ,"Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n" ); else WARN(1, "Hardware became unavailable during restart.\n"); +ieee80211_wake_queues_by_reason (hw,IEEE80211_MAX_QUEUE_MAP , +IEEE80211_QUEUE_STOP_REASON_SUSPEND , + false);ieee80211_handle_reconfig_failure (local);return res; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/156 drm/amdgpu: use sjt mec fw on gfx943 for sriov
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Zhao <[email protected]>
[ Upstream commit 9a4ab400f1fad0e6e8686b8f5fc5376383860ce8 ]
Use second jump table in sriov for live migration or mulitple VF support so different VF can load different version of MEC as long as they support sjt
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +8 -2
@@ -45,6 +45,8 @@ MODULE_FIRMWARE("amdgpu/gc_9_4_3_mec.bin");MODULE_FIRMWARE ("amdgpu/gc_9_4_4_mec.bin" );MODULE_FIRMWARE ("amdgpu/gc_9_4_3_rlc.bin" );MODULE_FIRMWARE ("amdgpu/gc_9_4_4_rlc.bin" ); +MODULE_FIRMWARE ("amdgpu/gc_9_4_3_sjt_mec.bin" ); +MODULE_FIRMWARE ("amdgpu/gc_9_4_4_sjt_mec.bin" );#define GFX9_MEC_HPD_SIZE 4096#define RLCG_UCODE_LOADING_START_ADDRESS 0x00002000L
@@ -574,8 +576,12 @@ static int gfx_v9_4_3_init_cp_compute_microcode(struct amdgpu_device *adev, {int err; - err =amdgpu_ucode_request (adev, &adev->gfx.mec_fw, -"amdgpu/%s_mec.bin" , chip_name); +if (amdgpu_sriov_vf (adev)) + err =amdgpu_ucode_request (adev, &adev->gfx.mec_fw, +"amdgpu/%s_sjt_mec.bin" , chip_name); +else + err =amdgpu_ucode_request (adev, &adev->gfx.mec_fw, +"amdgpu/%s_mec.bin" , chip_name);if (err) goto out;amdgpu_gfx_cp_init_microcode (adev,AMDGPU_UCODE_ID_CP_MEC1 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/156 drm/amdkfd: Correct the migration DMA map direction
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prike Liang <[email protected]>
[ Upstream commit 5c3de6b02d38eb9386edf50490e050bb44398e40 ]
The SVM DMA device map direction should be set the same as the DMA unmap setting, otherwise the DMA core will report the following warning.
Before finialize this solution, there're some discussion on the DMA mapping type(stream-based or coherent) in this KFD migration case, followed by https://lore.kernel.org/all/04d4ab32
[email protected]/T/.
As there's no dma_sync_single_for_*() in the DMA buffer accessed that because this migration operation should be sync properly and automatically. Give that there's might not be a performance problem in various cache sync policy of DMA sync. Therefore, in order to simplify the DMA direction setting alignment, let's set the DMA map direction as BIDIRECTIONAL.
[ 150.834218] WARNING: CPU: 8 PID: 1812 at kernel/dma/debug.c:1028 check_unmap+0x1cc/0x930 [ 150.834225] Modules linked in: amdgpu(OE) amdxcp drm_exec(OE) gpu_sched drm_buddy(OE) drm_ttm_helper(OE) ttm(OE) drm_suballoc_helper(OE) drm_display_helper(OE) drm_kms_helper(OE) i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc sch_fq_codel intel_rapl_msr amd_atl intel_rapl_common snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd snd_pci_acp6x snd_hda_codec snd_acp_config snd_hda_core snd_hwdep snd_soc_acpi kvm_amd sunrpc snd_pcm kvm binfmt_misc snd_seq_midi crct10dif_pclmul snd_seq_midi_event ghash_clmulni_intel sha512_ssse3 snd_rawmidi nls_iso8859_1 sha256_ssse3 sha1_ssse3 snd_seq aesni_intel snd_seq_device crypto_simd snd_timer cryptd input_leds [ 150.834310] wmi_bmof serio_raw k10temp rapl snd sp5100_tco ipmi_devintf soundcore ccp ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport efi_pstore drm(OE) ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 150.834354] CPU: 8 PID: 1812 Comm: rocrtst64 Tainted: G OE 6.10.0-custom #492 [ 150.834358] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 150.834360] RIP: 0010:check_unmap+0x1cc/0x930 [ 150.834363] Code: c0 4c 89 4d c8 e8 34 bf 86 00 4c 8b 4d c8 4c 8b 45 c0 48 8b 4d b8 48 89 c6 41 57 4c 89 ea 48 c7 c7 80 49 b4 84 e8 b4 81 f3 ff <0f> 0b 48 c7 c7 04 83 ac 84 e8 76 ba fc ff 41 8b 76 4c 49 8d 7e 50 [ 150.834365] RSP: 0018:ffffaac5023739e0 EFLAGS: 00010086 [ 150.834368] RAX: 0000000000000000 RBX: ffffffff8566a2e0 RCX: 0000000000000027 [ 150.834370] RDX: ffff8f6a8f621688 RSI: 0000000000000001 RDI: ffff8f6a8f621680 [ 150.834372] RBP: ffffaac502373a30 R08: 00000000000000c9 R09: ffffaac502373850 [ 150.834373] R10: ffffaac502373848 R11: ffffffff84f46328 R12: ffffaac502373a40 [ 150.834375] R13: ffff8f6741045330 R14: ffff8f6741a77700 R15: ffffffff84ac831b [ 150.834377] FS: 00007faf0fc94c00(0000) GS:ffff8f6a8f600000(0000) knlGS:0000000000000000 [ 150.834379] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 150.834381] CR2: 00007faf0b600020 CR3: 000000010a52e000 CR4: 0000000000350ef0 [ 150.834383] Call Trace: [ 150.834385] <TASK> [ 150.834387] ? show_regs+0x6d/0x80 [ 150.834393] ? __warn+0x8c/0x140 [ 150.834397] ? check_unmap+0x1cc/0x930 [ 150.834400] ? report_bug+0x193/0x1a0 [ 150.834406] ? handle_bug+0x46/0x80 [ 150.834410] ? exc_invalid_op+0x1d/0x80 [ 150.834413] ? asm_exc_invalid_op+0x1f/0x30 [ 150.834420] ? check_unmap+0x1cc/0x930 [ 150.834425] debug_dma_unmap_page+0x86/0x90 [ 150.834431] ? srso_return_thunk+0x5/0x5f [ 150.834435] ? rmap_walk+0x28/0x50 [ 150.834438] ? srso_return_thunk+0x5/0x5f [ 150.834441] ? remove_migration_ptes+0x79/0x80 [ 150.834445] ? srso_return_thunk+0x5/0x5f [ 150.834448] dma_unmap_page_attrs+0xfa/0x1d0 [ 150.834453] svm_range_dma_unmap_dev+0x8a/0xf0 [amdgpu] [ 150.834710] svm_migrate_ram_to_vram+0x361/0x740 [amdgpu] [ 150.834914] svm_migrate_to_vram+0xa8/0xe0 [amdgpu] [ 150.835111] svm_range_set_attr+0xff2/0x1450 [amdgpu] [ 150.835311] svm_ioctl+0x4a/0x50 [amdgpu] [ 150.835510] kfd_ioctl_svm+0x54/0x90 [amdgpu] [ 150.835701] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 150.835888] ? __pfx_kfd_ioctl_svm+0x10/0x10 [amdgpu] [ 150.836075] ? srso_return_thunk+0x5/0x5f [ 150.836080] ? tomoyo_file_ioctl+0x20/0x30 [ 150.836086] __x64_sys_ioctl+0x9c/0xd0 [ 150.836091] x64_sys_call+0x1219/0x20d0 [ 150.836095] do_syscall_64+0x51/0x120 [ 150.836098] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 150.836102] RIP: 0033:0x7faf0f11a94f [ 150.836105] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00 [ 150.836107] RSP: 002b:00007ffeced26bc0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 150.836110] RAX: ffffffffffffffda RBX: 000055c683528fb0 RCX: 00007faf0f11a94f [ 150.836112] RDX: 00007ffeced26c60 RSI: 00000000c0484b20 RDI: 0000000000000003 [ 150.836114] RBP: 00007ffeced26c50 R08: 0000000000000000 R09: 0000000000000001 [ 150.836115] R10: 0000000000000032 R11: 0000000000000246 R12: 000055c683528bd0 [ 150.836117] R13: 0000000000000000 R14: 0000000000000021 R15: 0000000000000000 [ 150.836122] </TASK> [ 150.836124] ---[ end trace 0000000000000000 ]---
--- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +2 -2
@@ -306,7 +306,7 @@ svm_migrate_copy_to_vram(struct kfd_node *node, struct svm_range *prange, spage =migrate_pfn_to_page (migrate->src[i]);if (spage && !is_zone_device_page (spage)) { src[i] =dma_map_page (dev, spage,0 ,PAGE_SIZE , -DMA_TO_DEVICE ); +DMA_BIDIRECTIONAL ); r =dma_mapping_error (dev, src[i]);if (r) { dev_err(dev, "%s: fail %d dma_map_page\n",
@@ -630,7 +630,7 @@ svm_migrate_copy_to_ram(struct amdgpu_device *adev, struct svm_range *prange, goto out_oom; } - dst[i] =dma_map_page (dev, dpage,0 ,PAGE_SIZE ,DMA_FROM_DEVICE ); + dst[i] =dma_map_page (dev, dpage,0 ,PAGE_SIZE ,DMA_BIDIRECTIONAL ); r =dma_mapping_error (dev, dst[i]);if (r) {dev_err (adev->dev,"%s: fail %d dma_map_page\n" , __func__, r);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/156 ALSA: hda: cs35l56: Remove calls to cs35l56_force_sync_asp1_registers_from_cache()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Trimmer <[email protected]>
[ Upstream commit 47b17ba05a463b22fa79f132e6f6899d53538802 ]
Commit 5d7e328e20b3 ("ASoC: cs35l56: Revert support for dual-ownership of ASP registers")
replaced cs35l56_force_sync_asp1_registers_from_cache() with a dummy implementation so that the HDA driver would continue to build.
Remove the calls from HDA and remove the stub function.
--- include/sound/cs35l56.h | 6 ------ sound/pci/hda/cs35l56_hda.c | 8 -------- 2 files changed, 14 deletions(-)
include/sound/cs35l56.h +0 -6
@@ -271,12 +271,6 @@ struct cs35l56_base {struct gpio_desc *reset_gpio; }; -/* Temporary to avoid a build break with the HDA driver */ -static inline int cs35l56_force_sync_asp1_registers_from_cache (struct cs35l56_base *cs35l56_base) -{ -return 0 ; -} -static inline bool cs35l56_is_otp_register (unsigned int reg) {return (reg >>16 ) ==3 ;
sound/pci/hda/cs35l56_hda.c +0 -8
@@ -151,10 +151,6 @@ static int cs35l56_hda_runtime_resume(struct device *dev) } } - ret =cs35l56_force_sync_asp1_registers_from_cache (&cs35l56->base); -if (ret) - goto err; -return 0 ; err:
@@ -1059,9 +1055,6 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int hid, int id)regmap_multi_reg_write (cs35l56->base.regmap, cs35l56_hda_dai_config,ARRAY_SIZE (cs35l56_hda_dai_config)); - ret =cs35l56_force_sync_asp1_registers_from_cache (&cs35l56->base); -if (ret) - goto dsp_err;/* * By default only enable one ASP1TXn, where n=amplifier index,
@@ -1087,7 +1080,6 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int hid, int id) pm_err:pm_runtime_disable (cs35l56->base.dev); -dsp_err:cs_dsp_remove (&cs35l56->cs_dsp); err:gpiod_set_value_cansleep (cs35l56->base.reset_gpio,0 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/156 ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
[ Upstream commit 1b452c2de5555d832cd51c46824272a44ad7acac ]
Introduces necessary quirks to enable audio functionality on the ASUS Zen AIO 27 Z272SD_A272SD:
- configures verbs to activate internal speakers and headphone jack.
- implements adjustments for headset microphone functionality.
The speaker and jack configurations were derived from a dump of the working Windows driver, while the headset microphone functionality was fine-tuned through experimental testing.
--- sound/pci/hda/patch_realtek.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
sound/pci/hda/patch_realtek.c +22 -0
@@ -7704,6 +7704,7 @@ enum {ALC274_FIXUP_HP_MIC ,ALC274_FIXUP_HP_HEADSET_MIC ,ALC274_FIXUP_HP_ENVY_GPIO , +ALC274_FIXUP_ASUS_ZEN_AIO_27 ,ALC256_FIXUP_ASUS_HPE ,ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK , ALC287_FIXUP_HP_GPIO_LED,
@@ -9505,6 +9506,26 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc274_fixup_hp_envy_gpio, }, + [ALC274_FIXUP_ASUS_ZEN_AIO_27] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb []) { + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x10 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xc420 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x40 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x8800 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x49 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0249 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x4a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x202b }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x62 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xa007 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x6b }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x5060 }, + {} + }, + .chained = true, + .chain_id = ALC2XX_FIXUP_HEADSET_MIC, + }, [ALC256_FIXUP_ASUS_HPE] = { .type = HDA_FIXUP_VERBS, .v.verbs = (const struct hda_verb []) {
@@ -10615,6 +10636,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1f62 ,"ASUS UX7602ZM" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1f92 ,"ASUS ROG Flow X16" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x3030 ,"ASUS ZN270IE" ,ALC256_FIXUP_ASUS_AIO_GPIO2 ), +SND_PCI_QUIRK (0x1043 ,0x31d0 ,"ASUS Zen AIO 27 Z272SD_A272SD" ,ALC274_FIXUP_ASUS_ZEN_AIO_27 ),SND_PCI_QUIRK (0x1043 ,0x3a20 ,"ASUS G614JZR" ,ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS ),SND_PCI_QUIRK (0x1043 ,0x3a30 ,"ASUS G814JVR/JIR" ,ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS ), SND_PCI_QUIRK(0x1043, 0x3a40, "ASUS G814JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/156 btrfs: handle bio_split() errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit c7c97ceff98cc459bf5e358e5cbd06fcb651d501 ]
Commit e546fe1da9bd ("block: Rework bio_split() return value") changed bio_split() so that it can return errors.
Add error handling for it in btrfs_split_bio() and ultimately btrfs_submit_chunk(). As the bio is not submitted, the bio counter must be decremented to pair btrfs_bio_counter_inc_blocked().
--- fs/btrfs/bio.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
fs/btrfs/bio.c +15 -2
@@ -81,6 +81,9 @@ static struct btrfs_bio *btrfs_split_bio(struct btrfs_fs_info *fs_info, bio =bio_split (&orig_bbio->bio, map_length >>SECTOR_SHIFT ,GFP_NOFS , &btrfs_clone_bioset); +if (IS_ERR (bio)) +return ERR_CAST (bio); + bbio =btrfs_bio (bio);btrfs_bio_init (bbio, fs_info,NULL , orig_bbio); bbio->inode = orig_bbio->inode;
@@ -684,7 +687,8 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) &bioc, &smap, &mirror_num);if (error) { ret =errno_to_blk_status (error); - goto fail; +btrfs_bio_counter_dec (fs_info); + goto end_bbio; } map_length =min (map_length, length);
@@ -692,7 +696,15 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) map_length =btrfs_append_map_length (bbio, map_length);if (map_length < length) { - bbio =btrfs_split_bio (fs_info, bbio, map_length); +struct btrfs_bio *split; + + split =btrfs_split_bio (fs_info, bbio, map_length); +if (IS_ERR (split)) { + ret =errno_to_blk_status (PTR_ERR (split)); +btrfs_bio_counter_dec (fs_info); + goto end_bbio; + } + bbio = split; bio = &bbio->bio; }
@@ -766,6 +778,7 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)btrfs_bio_end_io (remaining, ret); } +end_bbio:btrfs_bio_end_io (bbio, ret);/* Do not submit another chunk */ return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/156 btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit f10bef73fb355e3fc85e63a50386798be68ff486 ]
During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which frees the associated task_struct, and then stop and destroy all the work queues. However after we stopped the cleaner we may still have a worker from the delalloc_workers queue running inode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(), which in turn tries to wake up the cleaner kthread - which was already destroyed before, resulting in a use-after-free on the task_struct.
Syzbot reported this with the following stack traces:
BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089
Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52
CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: btrfs-delalloc btrfs_work_helper
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602
__lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205
submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615
run_ordered_work fs/btrfs/async-thread.c:288 [inline]
btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 2:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4104 [inline]
slab_alloc_node mm/slub.c:4153 [inline]
kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205
alloc_task_struct_node kernel/fork.c:180 [inline]
dup_task_struct+0x57/0x8c0 kernel/fork.c:1113
copy_process+0x5d1/0x3d50 kernel/fork.c:2225
kernel_clone+0x223/0x870 kernel/fork.c:2807
kernel_thread+0x1bc/0x240 kernel/fork.c:2869
create_kthread kernel/kthread.c:412 [inline]
kthreadd+0x60d/0x810 kernel/kthread.c:767
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 24:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2338 [inline]
slab_free mm/slub.c:4598 [inline]
kmem_cache_free+0x195/0x410 mm/slub.c:4700
put_task_struct include/linux/sched/task.h:144 [inline]
delayed_put_task_struct+0x125/0x300 kernel/exit.c:227
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554
run_ksoftirqd+0xca/0x130 kernel/softirq.c:943
smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
__call_rcu_common kernel/rcu/tree.c:3086 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:3190
context_switch kernel/sched/core.c:5372 [inline]
__schedule+0x1803/0x4be0 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
kthread_stop+0x19e/0x640 kernel/kthread.c:712
close_ctree+0x524/0xd60 fs/btrfs/disk-io.c:4328
generic_shutdown_super+0x139/0x2d0 fs/super.c:642
kill_anon_super+0x3b/0x70 fs/super.c:1237
btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2112
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
task_work_run+0x24f/0x310 kernel/task_work.c:239
ptrace_notify+0x2d2/0x380 kernel/signal.c:2503
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc7/0x1d0 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x24a/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff8880259d1e00
which belongs to the cache task_struct of size 7424
The buggy address is located 2584 bytes inside of
freed 7424-byte region [ffff8880259d1e00, ffff8880259d3b00)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x259d0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88802f4b56c1
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1
head: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122
head: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1
head: 00fff00000000003 ffffea0000967401 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12, tgid 12 (kworker/u8:1), ts 7328037942, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
prep_new_page mm/page_alloc.c:1564 [inline]
get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x140 mm/slub.c:2408
allocate_slab+0x5a/0x2f0 mm/slub.c:2574
new_slab mm/slub.c:2627 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3815
__slab_alloc+0x58/0xa0 mm/slub.c:3905
__slab_alloc_node mm/slub.c:3980 [inline]
slab_alloc_node mm/slub.c:4141 [inline]
kmem_cache_alloc_node_noprof+0x269/0x380 mm/slub.c:4205
alloc_task_struct_node kernel/fork.c:180 [inline]
dup_task_struct+0x57/0x8c0 kernel/fork.c:1113
copy_process+0x5d1/0x3d50 kernel/fork.c:2225
kernel_clone+0x223/0x870 kernel/fork.c:2807
user_mode_thread+0x132/0x1a0 kernel/fork.c:2885
call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:171
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
page_owner free stack trace missing
Memory state around the buggy address:
ffff8880259d2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880259d2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880259d2800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880259d2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880259d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================Fix this by flushing the delalloc workers queue before stopping the cleaner kthread.
--- fs/btrfs/disk-io.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/btrfs/disk-io.c +9 -0
@@ -4264,6 +4264,15 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info)* already the cleaner, but below we run all pending delayed iputs. */ btrfs_flush_workqueue (fs_info->fixup_workers); +/* +* Similar case here, we have to wait for delalloc workers before we +* proceed below and stop the cleaner kthread, otherwise we trigger a +* use-after-tree on the cleaner kthread task_struct when a delalloc +* worker running submit_compressed_extents() adds a delayed iput, which +* does a wake up on the cleaner kthread, which was already freed below +* when we call kthread_stop(). +*/ +btrfs_flush_workqueue (fs_info->delalloc_workers);/* * After we parked the cleaner kthread, ordered extents may have
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/156 ALSA: hda/ca0132: Use standard HD-audio quirk matching helpers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7c005292e20ac53dfa601bf2a7375fd4815511ad ]
CA0132 used the PCI SSID lookup helper that doesn't support the model string matching or quirk aliasing.
Replace it with the standard HD-audio quirk helpers for supporting those, and add the definition of the model strings for supported quirks, too. There should be no visible change to the outside for the working system, but the driver will parse the model option and apply the quirk based on it from now on.
--- sound/pci/hda/patch_ca0132.c | 37 ++++++++++++++++++++---------------- 1 file changed, 21 insertions(+), 16 deletions(-)
sound/pci/hda/patch_ca0132.c +21 -16
@@ -1134,7 +1134,6 @@ struct ca0132_spec {struct hda_codec *codec;struct delayed_work unsol_hp_work; -int quirk;#ifdef ENABLE_TUNING_CONTROLS long cur_ctl_vals[TUNING_CTLS_COUNT ];
@@ -1166,7 +1165,6 @@ struct ca0132_spec {* CA0132 quirks table */ enum { -QUIRK_NONE ,QUIRK_ALIENWARE ,QUIRK_ALIENWARE_M17XR4 ,QUIRK_SBZ ,
@@ -1176,10 +1174,11 @@ enum {QUIRK_R3D ,QUIRK_AE5 ,QUIRK_AE7 , + QUIRK_NONE = HDA_FIXUP_ID_NOT_SET, };#ifdef CONFIG_PCI -#define ca0132_quirk (spec) ((spec)->quirk) +#define ca0132_quirk (spec) ((spec)->codec->fixup_id)#define ca0132_use_pci_mmio (spec) ((spec)->use_pci_mmio)#define ca0132_use_alt_functions (spec) ((spec)->use_alt_functions)#define ca0132_use_alt_controls (spec) ((spec)->use_alt_controls)
@@ -1293,7 +1292,7 @@ static const struct hda_pintbl ae7_pincfgs[] = { {} }; -static const struct snd_pci_quirk ca0132_quirks[] = { +static const struct hda_quirk ca0132_quirks[] = {SND_PCI_QUIRK (0x1028 ,0x057b ,"Alienware M17x R4" ,QUIRK_ALIENWARE_M17XR4 ),SND_PCI_QUIRK (0x1028 ,0x0685 ,"Alienware 15 2015" ,QUIRK_ALIENWARE ),SND_PCI_QUIRK (0x1028 ,0x0688 ,"Alienware 17 2015" ,QUIRK_ALIENWARE ),
@@ -1316,6 +1315,19 @@ static const struct snd_pci_quirk ca0132_quirks[] = { {} }; +static const struct hda_model_fixup ca0132_quirk_models[] = { + { .id =QUIRK_ALIENWARE , .name ="alienware" }, + { .id =QUIRK_ALIENWARE_M17XR4 , .name ="alienware-m17xr4" }, + { .id =QUIRK_SBZ , .name ="sbz" }, + { .id =QUIRK_ZXR , .name ="zxr" }, + { .id =QUIRK_ZXR_DBPRO , .name ="zxr-dbpro" }, + { .id =QUIRK_R3DI , .name ="r3di" }, + { .id =QUIRK_R3D , .name ="r3d" }, + { .id =QUIRK_AE5 , .name ="ae5" }, + { .id =QUIRK_AE7 , .name ="ae7" }, + {} +}; +/* Output selection quirk info structures. */ #define MAX_QUIRK_MMIO_GPIO_SET_VALS 3#define MAX_QUIRK_SCP_SET_VALS 2
@@ -9957,17 +9969,15 @@ static int ca0132_prepare_verbs(struct hda_codec *codec)*/ static void sbz_detect_quirk (struct hda_codec *codec) { -struct ca0132_spec *spec = codec->spec; -switch (codec->core.subsystem_id) {case 0x11020033 : - spec->quirk =QUIRK_ZXR ; + codec->fixup_id =QUIRK_ZXR ;break ;case 0x1102003f : - spec->quirk =QUIRK_ZXR_DBPRO ; + codec->fixup_id =QUIRK_ZXR_DBPRO ;break ;default : - spec->quirk =QUIRK_SBZ ; + codec->fixup_id =QUIRK_SBZ ;break ; } }
@@ -9976,7 +9986,6 @@ static int patch_ca0132(struct hda_codec *codec) {struct ca0132_spec *spec;int err; -const struct snd_pci_quirk *quirk;codec_dbg (codec,"patch_ca0132\n" );
@@ -9987,11 +9996,7 @@ static int patch_ca0132(struct hda_codec *codec) spec->codec = codec;/* Detect codec quirk */ - quirk =snd_pci_quirk_lookup (codec->bus->pci, ca0132_quirks); -if (quirk) - spec->quirk = quirk->value; -else - spec->quirk =QUIRK_NONE ; +snd_hda_pick_fixup (codec, ca0132_quirk_models, ca0132_quirks,NULL );if (ca0132_quirk (spec) ==QUIRK_SBZ )sbz_detect_quirk (codec);
@@ -10068,7 +10073,7 @@ static int patch_ca0132(struct hda_codec *codec) spec->mem_base =pci_iomap (codec->bus->pci,2 ,0xC20 );if (spec->mem_base ==NULL ) {codec_warn (codec,"pci_iomap failed! Setting quirk to QUIRK_NONE." ); - spec->quirk =QUIRK_NONE ; + codec->fixup_id =QUIRK_NONE ; } }#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/156 ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
[ Upstream commit 50db91fccea0da5c669bc68e2429e8de303758d3 ]
Introduces the alc2xx-fixup-headset-mic model to simplify enabling headset microphones on ALC2XX codecs.
Many recent configurations, as well as older systems that lacked this fix for a long time, leave headset microphones inactive by default. This addition provides a flexible workaround using the existing ALC2XX_FIXUP_HEADSET_MIC quirk.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -11184,6 +11184,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { {.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"}, {.id = ALC285_FIXUP_HP_GPIO_AMP_INIT, .name = "alc285-hp-amp-init"}, {.id = ALC236_FIXUP_LENOVO_INV_DMIC, .name = "alc236-fixup-lenovo-inv-mic"}, + {.id = ALC2XX_FIXUP_HEADSET_MIC, .name = "alc2xx-fixup-headset-mic"}, {} };#define ALC225_STANDARD_PINS \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/156 sound: usb: enable DSD output for ddHiFi TC44C
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ratiu <[email protected]>
[ Upstream commit c84bd6c810d1880194fea2229c7086e4b73fddc1 ]
This is a UAC 2 DAC capable of raw DSD on intf 2 alt 4:
Bus 007 Device 004: ID 262a:9302 SAVITECH Corp. TC44C Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 239 Miscellaneous Device
bDeviceSubClass 2 [unknown]
bDeviceProtocol 1 Interface Association
bMaxPacketSize0 64
idVendor 0x262a SAVITECH Corp.
idProduct 0x9302 TC44C
bcdDevice 0.01
iManufacturer 1 DDHIFI iProduct 2 TC44C iSerial 6 5000000001
.......
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 2
bAlternateSetting 4
bNumEndpoints 2
bInterfaceClass 1 Audio
bInterfaceSubClass 2 Streaming
bInterfaceProtocol 32
iInterface 0
AudioStreaming Interface Descriptor:
bLength 16
bDescriptorType 36
bDescriptorSubtype 1 (AS_GENERAL)
bTerminalLink 3
bmControls 0x00
bFormatType 1
bmFormats 0x80000000
bNrChannels 2
bmChannelConfig 0x00000000
iChannelNames 0
.......
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2325,6 +2325,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_DSD_RAW),DEVICE_FLG (0x2522 ,0x0007 ,/* LH Labs Geek Out HD Audio 1V5 */ QUIRK_FLAG_SET_IFACE_FIRST ), +DEVICE_FLG (0x262a ,0x9302 ,/* ddHiFi TC44C */ +QUIRK_FLAG_DSD_RAW ),DEVICE_FLG (0x2708 ,0x0002 ,/* Audient iD14 */ QUIRK_FLAG_IGNORE_CTL_ERROR ), DEVICE_FLG(0x2912, 0x30c8, /* Audioengine D1 */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/156 sound: usb: format: dont warn that raw DSD is unsupported
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ratiu <[email protected]>
[ Upstream commit b50a3e98442b8d72f061617c7f7a71f7dba19484 ]
UAC 2 & 3 DAC's set bit 31 of the format to signal support for a RAW_DATA type, typically used for DSD playback.
This is correctly tested by (format & UAC*_FORMAT_TYPE_I_RAW_DATA), fp->dsd_raw = true; and call snd_usb_interface_dsd_format_quirks(), however a confusing and unnecessary message gets printed because the bit is not properly tested in the last "unsupported" if test:
if (format & ~0x3F) { ... }
For example the output:
usb 7-1: new high-speed USB device number 5 using xhci_hcd
usb 7-1: New USB device found, idVendor=262a, idProduct=9302, bcdDevice=0.01
usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=6
usb 7-1: Product: TC44C
usb 7-1: Manufacturer: TC44C
usb 7-1: SerialNumber: 5000000001
hid-generic 0003:262A:9302.001E: No inputs registered, leaving
hid-generic 0003:262A:9302.001E: hidraw6: USB HID v1.00 Device [DDHIFI TC44C] on usb-0000:08:00.3-1/input0 usb 7-1: 2:4 : unsupported format bits 0x100000000
This last "unsupported format" is actually wrong: we know the format is a RAW_DATA which we assume is DSD, so there is no need to print the confusing message.
This we unset bit 31 of the format after recognizing it, to avoid the message.
--- sound/usb/format.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
sound/usb/format.c +6 -1
@@ -60,6 +60,8 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip, pcm_formats |=SNDRV_PCM_FMTBIT_SPECIAL ;/* flag potentially raw DSD capable altsettings */ fp->dsd_raw = true; +/* clear special format bit to avoid "unsupported format" msg below */ + format &= ~UAC2_FORMAT_TYPE_I_RAW_DATA ; } format <<=1 ;
@@ -71,8 +73,11 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip, sample_width = as->bBitResolution; sample_bytes = as->bSubslotSize; -if (format &UAC3_FORMAT_TYPE_I_RAW_DATA ) +if (format &UAC3_FORMAT_TYPE_I_RAW_DATA ) { pcm_formats |=SNDRV_PCM_FMTBIT_SPECIAL ; +/* clear special format bit to avoid "unsupported format" msg below */ + format &= ~UAC3_FORMAT_TYPE_I_RAW_DATA ; + } format <<=1 ;break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/156 spi: spi-cadence-qspi: Disable STIG mode for Altera SoCFPGA.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <[email protected]>
[ Upstream commit 25fb0e77b90e290a1ca30900d54c6a495eea65e2 ]
STIG mode is enabled by default for less than 8 bytes data read/write. STIG mode doesn't work with Altera SocFPGA platform due hardware limitation.
Add a quirks to disable STIG mode for Altera SoCFPGA platform.
--- drivers/spi/spi-cadence-quadspi.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/spi/spi-cadence-quadspi.c +8 -2
@@ -43,6 +43,7 @@ static_assert(CQSPI_MAX_CHIPSELECT <= SPI_CS_CNT_MAX);#define CQSPI_SLOW_SRAM BIT(4)#define CQSPI_NEEDS_APB_AHB_HAZARD_WAR BIT(5)#define CQSPI_RD_NO_IRQ BIT(6) +#define CQSPI_DISABLE_STIG_MODE BIT(7)/* Capabilities */ #define CQSPI_SUPPORTS_OCTAL BIT(0)
@@ -103,6 +104,7 @@ struct cqspi_st {bool apb_ahb_hazard;bool is_jh7110;/* Flag for StarFive JH7110 SoC */ +bool disable_stig_mode;const struct cqspi_driver_platdata *ddata; };
@@ -1416,7 +1418,8 @@ static int cqspi_mem_process(struct spi_mem *mem, const struct spi_mem_op *op)* reads, prefer STIG mode for such small reads. */ if (!op->addr.nbytes || - op->data.nbytes <=CQSPI_STIG_DATA_LEN_MAX ) + (op->data.nbytes <=CQSPI_STIG_DATA_LEN_MAX && + !cqspi->disable_stig_mode))return cqspi_command_read (f_pdata, op);return cqspi_read (f_pdata, op);
@@ -1880,6 +1883,8 @@ static int cqspi_probe(struct platform_device *pdev)if (ret) goto probe_reset_failed; } +if (ddata->quirks &CQSPI_DISABLE_STIG_MODE ) + cqspi->disable_stig_mode = true;if (of_device_is_compatible (pdev->dev.of_node,"xlnx,versal-ospi-1.0" )) {
@@ -2043,7 +2048,8 @@ static const struct cqspi_driver_platdata intel_lgm_qspi = {static const struct cqspi_driver_platdata socfpga_qspi = { .quirks =CQSPI_DISABLE_DAC_MODE |CQSPI_NO_SUPPORT_WR_COMPLETION - |CQSPI_SLOW_SRAM , + |CQSPI_SLOW_SRAM + |CQSPI_DISABLE_STIG_MODE , };static const struct cqspi_driver_platdata versal_ospi = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/156 ASoC: audio-graph-card: Call of_node_put() on correct node
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Gordon <[email protected]>
[ Upstream commit 687630aa582acf674120c87350beb01d836c837c ]
--- sound/soc/generic/audio-graph-card2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/generic/audio-graph-card2.c +1 -1
@@ -779,7 +779,7 @@ static void graph_link_init(struct simple_util_priv *priv,of_node_get (port_codec);if (graph_lnk_is_multi (port_codec)) { ep_codec =graph_get_next_multi_ep (&port_codec); -of_node_put (port_cpu); +of_node_put (port_codec); port_codec =ep_to_port (ep_codec); }else { ep_codec =port_to_endpoint (port_codec);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/156 ARC: build: disallow invalid PAE40 + 4K page config
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <[email protected]>
[ Upstream commit 8871331b1769978ecece205a430338a2581e5050 ]
The config option being built was
| CONFIG_ARC_MMU_V4=y | CONFIG_ARC_PAGE_SIZE_4K=y | CONFIG_HIGHMEM=y | CONFIG_ARC_HAS_PAE40=y
This was hitting a BUILD_BUG_ON() since a 4K page can't hoist 1k, 8-byte PTE entries (8 byte due to PAE40). BUILD_BUG_ON() is a good last ditch resort, but such a config needs to be disallowed explicitly in Kconfig.
Side-note: the actual fix is single liner dependency, but while at it cleaned out a few things:
- 4K dependency on MMU v3 or v4 is always true, since 288ff7de62af09 ("ARC: retire MMUv1 and MMUv2 support")
- PAE40 dependency in on MMU ver not really ISA, although that follows eventually.
--- arch/arc/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arc/Kconfig +2 -2
@@ -297,7 +297,6 @@ config ARC_PAGE_SIZE_16K config ARC_PAGE_SIZE_4K bool "4KB" select HAVE_PAGE_SIZE_4KB - depends on ARC_MMU_V3 || ARC_MMU_V4 endchoice
@@ -474,7 +473,8 @@ config HIGHMEM config ARC_HAS_PAE40 bool "Support for the 40-bit Physical Address Extension" - depends on ISA_ARCV2 + depends on MMU_V4 + depends on !ARC_PAGE_SIZE_4K select HIGHMEM select PHYS_ADDR_T_64BIT help
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/156 ARC: build: Use __force to suppress per-CPU cmpxchg warnings
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit 1e8af9f04346ecc0bccf0c53b728fc8eb3490a28 ]
Currently, the cast of the first argument to cmpxchg_emu_u8() drops the __percpu address-space designator, which results in sparse complaints when applying cmpxchg() to per-CPU variables in ARC. Therefore, use __force to suppress these complaints, given that this does not pertain to cmpxchg() semantics, which are plently well-defined on variables in general, whether per-CPU or otherwise.
--- arch/arc/include/asm/cmpxchg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arc/include/asm/cmpxchg.h +1 -1
@@ -48,7 +48,7 @@ \switch (sizeof ((_p_))) { \case 1 : \ - _prev_ = (__typeof__ (*(ptr )))cmpxchg_emu_u8 ((volatile u8 *)_p_, (uintptr_t )_o_, (uintptr_t )_n_); \ + _prev_ = (__typeof__(*(ptr)))cmpxchg_emu_u8((volatile u8 *__force)_p_, (uintptr_t)_o_, (uintptr_t)_n_); \break ; \case 4 : \ _prev_ =__cmpxchg (_p_, _o_, _n_); \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/156 ARC: bpf: Correct conditional check in check_jmp_32
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hardevsinh Palaniya <[email protected]>
[ Upstream commit 7dd9eb6ba88964b091b89855ce7d2a12405013af ]
The original code checks 'if (ARC_CC_AL)', which is always true since ARC_CC_AL is a constant. This makes the check redundant and likely obscures the intention of verifying whether the jump is conditional.
Updates the code to check cond == ARC_CC_AL instead, reflecting the intent to differentiate conditional from unconditional jumps.
--- arch/arc/net/bpf_jit_arcv2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arc/net/bpf_jit_arcv2.c +1 -1
@@ -2916,7 +2916,7 @@ bool check_jmp_32(u32 curr_off, u32 targ_off, u8 cond) addendum = (cond ==ARC_CC_AL ) ?0 : INSN_len_normal; disp =get_displacement (curr_off + addendum, targ_off); -if (ARC_CC_AL ) +if (cond ==ARC_CC_AL )return is_valid_far_disp (disp);else return is_valid_near_disp (disp);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/156 bpf: fix potential error return
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit c4441ca86afe4814039ee1b32c39d833c1a16bbc ]
The bpf_remove_insns() function returns WARN_ON_ONCE(error), where error is a result of bpf_adj_branches(), and thus should be always 0 However, if for any reason it is not 0, then it will be converted to boolean by WARN_ON_ONCE and returned to user space as 1, not an actual error value. Fix this by returning the original err after the WARN check.
--- kernel/bpf/core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/bpf/core.c +5 -1
@@ -539,6 +539,8 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,int bpf_remove_insns (struct bpf_prog *prog,u32 off,u32 cnt) { +int err; +/* Branch offsets can't overflow when program is shrinking, no need * to call bpf_adj_branches(..., true) here */
@@ -546,7 +548,9 @@ int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt) sizeof(struct bpf_insn) * (prog->len - off - cnt)); prog->len -= cnt; -return WARN_ON_ONCE (bpf_adj_branches (prog, off, off + cnt, off, false)); + err =bpf_adj_branches (prog, off, off + cnt, off, false); +WARN_ON_ONCE (err); +return err; }static void bpf_prog_kallsyms_del_subprogs (struct bpf_prog *fp)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/156 ksmbd: retry iterate_dir in smb2_query_dir
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hobin Woo <[email protected]>
[ Upstream commit 2b904d61a97e8ba79e3bc216ba290fd7e1d85028 ]
Some file systems do not ensure that the single call of iterate_dir reaches the end of the directory. For example, FUSE fetches entries from a daemon using 4KB buffer and stops fetching if entries exceed the buffer. And then an actor of caller, KSMBD, is used to fill the entries from the buffer.
Thus, pattern searching on FUSE, files located after the 4KB could not be found and STATUS_NO_SUCH_FILE was returned.
--- fs/smb/server/smb2pdu.c | 12 +++++++++++- fs/smb/server/vfs.h | 1 + 2 files changed, 12 insertions(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +11 -1
@@ -4224,6 +4224,7 @@ static bool __query_dir(struct dir_context *ctx, const char *name, int namlen,/* dot and dotdot entries are already reserved */ if (!strcmp ("." , name) || !strcmp (".." , name))return true; + d_info->num_scan++;if (ksmbd_share_veto_filename (priv->work->tcon->share_conf, name))return true;if (!match_pattern (name, namlen, priv->search_pattern))
@@ -4384,8 +4385,17 @@ int smb2_query_dir(struct ksmbd_work *work) query_dir_private.info_level = req->FileInformationClass; dir_fp->readdir_data.private = &query_dir_private;set_ctx_actor (&dir_fp->readdir_data.ctx, __query_dir); - +again: + d_info.num_scan =0 ; rc =iterate_dir (dir_fp->filp, &dir_fp->readdir_data.ctx); +/* +* num_entry can be 0 if the directory iteration stops before reaching +* the end of the directory and no file is matched with the search +* pattern. +*/ +if (rc >=0 && !d_info.num_entry && d_info.num_scan && + d_info.out_buf_len >0 ) + goto again;/* * req->OutputBufferLength is too small to contain even one entry. * In this case, it immediately returns OutputBufferLength 0 to client.
fs/smb/server/vfs.h +1 -0
@@ -43,6 +43,7 @@ struct ksmbd_dir_info {char *rptr;int name_len;int out_buf_len; +int num_scan;int num_entry;int data_count;int last_entry_offset;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/156 ksmbd: set ATTR_CTIME flags when setting mtime
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 21e46a79bbe6c4e1aa73b3ed998130f2ff07b128 ]
David reported that the new warning from setattr_copy_mgtime is coming like the following.
[ 113.215316] ------------[ cut here ]------------ [ 113.215974] WARNING: CPU: 1 PID: 31 at fs/attr.c:300 setattr_copy+0x1ee/0x200 [ 113.219192] CPU: 1 UID: 0 PID: 31 Comm: kworker/1:1 Not tainted 6.13.0-rc1+ #234 [ 113.220127] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 [ 113.221530] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 113.222220] RIP: 0010:setattr_copy+0x1ee/0x200 [ 113.222833] Code: 24 28 49 8b 44 24 30 48 89 53 58 89 43 6c 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 48 89 df e8 77 d6 ff ff e9 cd fe ff ff <0f> 0b e9 be fe ff ff 66 0 [ 113.225110] RSP: 0018:ffffaf218010fb68 EFLAGS: 00010202 [ 113.225765] RAX: 0000000000000120 RBX: ffffa446815f8568 RCX: 0000000000000003 [ 113.226667] RDX: ffffaf218010fd38 RSI: ffffa446815f8568 RDI: ffffffff94eb03a0 [ 113.227531] RBP: ffffaf218010fb90 R08: 0000001a251e217d R09: 00000000675259fa [ 113.228426] R10: 0000000002ba8a6d R11: ffffa4468196c7a8 R12: ffffaf218010fd38 [ 113.229304] R13: 0000000000000120 R14: ffffffff94eb03a0 R15: 0000000000000000 [ 113.230210] FS: 0000000000000000(0000) GS:ffffa44739d00000(0000) knlGS:0000000000000000 [ 113.231215] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.232055] CR2: 00007efe0053d27e CR3: 000000000331a000 CR4: 00000000000006b0 [ 113.232926] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 113.233812] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 113.234797] Call Trace: [ 113.235116] <TASK> [ 113.235393] ? __warn+0x73/0xd0 [ 113.235802] ? setattr_copy+0x1ee/0x200 [ 113.236299] ? report_bug+0xf3/0x1e0 [ 113.236757] ? handle_bug+0x4d/0x90 [ 113.237202] ? exc_invalid_op+0x13/0x60 [ 113.237689] ? asm_exc_invalid_op+0x16/0x20 [ 113.238185] ? setattr_copy+0x1ee/0x200 [ 113.238692] btrfs_setattr+0x80/0x820 [btrfs] [ 113.239285] ? get_stack_info_noinstr+0x12/0xf0 [ 113.239857] ? __module_address+0x22/0xa0 [ 113.240368] ? handle_ksmbd_work+0x6e/0x460 [ksmbd] [ 113.240993] ? __module_text_address+0x9/0x50 [ 113.241545] ? __module_address+0x22/0xa0 [ 113.242033] ? unwind_next_frame+0x10e/0x920 [ 113.242600] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 113.243268] notify_change+0x2c2/0x4e0 [ 113.243746] ? stack_depot_save_flags+0x27/0x730 [ 113.244339] ? set_file_basic_info+0x130/0x2b0 [ksmbd] [ 113.244993] set_file_basic_info+0x130/0x2b0 [ksmbd] [ 113.245613] ? process_scheduled_works+0xbe/0x310 [ 113.246181] ? worker_thread+0x100/0x240 [ 113.246696] ? kthread+0xc8/0x100 [ 113.247126] ? ret_from_fork+0x2b/0x40 [ 113.247606] ? ret_from_fork_asm+0x1a/0x30 [ 113.248132] smb2_set_info+0x63f/0xa70 [ksmbd]
ksmbd is trying to set the atime and mtime via notify_change without also setting the ctime. so This patch add ATTR_CTIME flags when setting mtime to avoid a warning.
--- fs/smb/server/smb2pdu.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
fs/smb/server/smb2pdu.c +3 -7
@@ -6016,15 +6016,13 @@ static int set_file_basic_info(struct ksmbd_file *fp, attrs.ia_valid |= (ATTR_ATIME |ATTR_ATIME_SET ); } - attrs.ia_valid |=ATTR_CTIME ;if (file_info->ChangeTime) - attrs.ia_ctime =ksmbd_NTtimeToUnix (file_info->ChangeTime); -else - attrs.ia_ctime =inode_get_ctime (inode); +inode_set_ctime_to_ts (inode, +ksmbd_NTtimeToUnix (file_info->ChangeTime));if (file_info->LastWriteTime) { attrs.ia_mtime =ksmbd_NTtimeToUnix (file_info->LastWriteTime); - attrs.ia_valid |= (ATTR_MTIME |ATTR_MTIME_SET ); + attrs.ia_valid |= (ATTR_MTIME |ATTR_MTIME_SET |ATTR_CTIME ); }if (file_info->Attributes) {
@@ -6066,8 +6064,6 @@ static int set_file_basic_info(struct ksmbd_file *fp,return -EACCES ;inode_lock (inode); -inode_set_ctime_to_ts (inode, attrs.ia_ctime); - attrs.ia_valid &= ~ATTR_CTIME ; rc =notify_change (idmap, dentry, &attrs,NULL );inode_unlock (inode); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/156 smb: client: destroy cfid_put_wq on module exit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enzo Matsumiya <[email protected]>
[ Upstream commit 633609c48a358134d3f8ef8241dff24841577f58 ]
Fix potential problem in rmmod
--- fs/smb/client/cifsfs.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/client/cifsfs.c +1 -0
@@ -2018,6 +2018,7 @@ exit_cifs(void)destroy_workqueue (decrypt_wq);destroy_workqueue (fileinfo_put_wq);destroy_workqueue (serverclose_wq); +destroy_workqueue (cfid_put_wq);destroy_workqueue (cifsiod_wq);cifs_proc_clean (); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/156 net: usb: qmi_wwan: add Telit FE910C04 compositions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
[ Upstream commit 3b58b53a26598209a7ad8259a5114ce71f7c3d64 ]
Add the following Telit FE910C04 compositions:
0x10c0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=02 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c4: rmnet + tty (AT) + tty (AT) + tty (diag)
T: Bus=02 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 14 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c4 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c8: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb
T: Bus=02 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c8 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/qmi_wwan.c +3 -0
@@ -1365,6 +1365,9 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/156 Bluetooth: hci_core: Fix sleeping function called from invalid context
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 4d94f05558271654670d18c26c912da0c1c15549 ]
This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs like the bellow:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u9:2/5070:
#0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline] #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline] #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335 #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: hci0 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 __might_resched+0x5d4/0x780 kernel/sched/core.c:10187 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752 hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline] hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939 hci_event_func net/bluetooth/hci_event.c:7514 [inline] hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 </TASK>
--- include/net/bluetooth/hci_core.h | 108 ++++++++++++++++++++----------- net/bluetooth/hci_core.c | 10 +-- net/bluetooth/iso.c | 6 ++ net/bluetooth/l2cap_core.c | 12 ++-- net/bluetooth/rfcomm/core.c | 6 ++ net/bluetooth/sco.c | 12 ++-- 6 files changed, 97 insertions(+), 57 deletions(-)
include/net/bluetooth/hci_core.h +70 -38
@@ -804,7 +804,6 @@ struct hci_conn_params {extern struct list_head hci_dev_list;extern struct list_head hci_cb_list;extern rwlock_t hci_dev_list_lock; -extern struct mutex hci_cb_list_lock;#define hci_dev_set_flag (hdev, nr) set_bit((nr), (hdev)->dev_flags)#define hci_dev_clear_flag (hdev, nr) clear_bit((nr), (hdev)->dev_flags)
@@ -2007,24 +2006,47 @@ struct hci_cb {char *name; +bool (*match) (struct hci_conn *conn);void (*connect_cfm) (struct hci_conn *conn,__u8 status);void (*disconn_cfm) (struct hci_conn *conn,__u8 status);void (*security_cfm) (struct hci_conn *conn,__u8 status, -__u8 encrypt); +__u8 encrypt);void (*key_change_cfm) (struct hci_conn *conn,__u8 status);void (*role_switch_cfm) (struct hci_conn *conn,__u8 status,__u8 role); }; +static inline void hci_cb_lookup (struct hci_conn *conn,struct list_head *list) +{ +struct hci_cb *cb, *cpy; + +rcu_read_lock (); +list_for_each_entry_rcu (cb, &hci_cb_list, list) { +if (cb->match && cb->match (conn)) { + cpy =kmalloc (sizeof (*cpy),GFP_ATOMIC ); +if (!cpy) +break ; + + *cpy = *cb; +INIT_LIST_HEAD (&cpy->list); +list_add_rcu (&cpy->list, list); + } + } +rcu_read_unlock (); +} +static inline void hci_connect_cfm (struct hci_conn *conn,__u8 status) { -struct hci_cb *cb; +struct list_head list; +struct hci_cb *cb, *tmp; + +INIT_LIST_HEAD (&list); +hci_cb_lookup (conn, &list); -mutex_lock (&hci_cb_list_lock); -list_for_each_entry (cb, &hci_cb_list, list) { +list_for_each_entry_safe (cb, tmp, &list, list) {if (cb->connect_cfm) cb->connect_cfm (conn, status); +kfree (cb); } -mutex_unlock (&hci_cb_list_lock);if (conn->connect_cfm_cb) conn->connect_cfm_cb (conn, status);
@@ -2032,43 +2054,55 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status)static inline void hci_disconn_cfm (struct hci_conn *conn,__u8 reason) { -struct hci_cb *cb; +struct list_head list; +struct hci_cb *cb, *tmp; + +INIT_LIST_HEAD (&list); +hci_cb_lookup (conn, &list); -mutex_lock (&hci_cb_list_lock); -list_for_each_entry (cb, &hci_cb_list, list) { +list_for_each_entry_safe (cb, tmp, &list, list) {if (cb->disconn_cfm) cb->disconn_cfm (conn, reason); +kfree (cb); } -mutex_unlock (&hci_cb_list_lock);if (conn->disconn_cfm_cb) conn->disconn_cfm_cb (conn, reason); } -static inline void hci_auth_cfm (struct hci_conn *conn,__u8 status) +static inline void hci_security_cfm (struct hci_conn *conn,__u8 status, +__u8 encrypt) { -struct hci_cb *cb; -__u8 encrypt; - -if (test_bit (HCI_CONN_ENCRYPT_PEND , &conn->flags)) -return ; +struct list_head list; +struct hci_cb *cb, *tmp; - encrypt =test_bit (HCI_CONN_ENCRYPT , &conn->flags) ?0x01 :0x00 ; +INIT_LIST_HEAD (&list); +hci_cb_lookup (conn, &list); -mutex_lock (&hci_cb_list_lock); -list_for_each_entry (cb, &hci_cb_list, list) { +list_for_each_entry_safe (cb, tmp, &list, list) {if (cb->security_cfm) cb->security_cfm (conn, status, encrypt); +kfree (cb); } -mutex_unlock (&hci_cb_list_lock);if (conn->security_cfm_cb) conn->security_cfm_cb (conn, status); } +static inline void hci_auth_cfm (struct hci_conn *conn,__u8 status) +{ +__u8 encrypt; + +if (test_bit (HCI_CONN_ENCRYPT_PEND , &conn->flags)) +return ; + + encrypt =test_bit (HCI_CONN_ENCRYPT , &conn->flags) ?0x01 :0x00 ; + +hci_security_cfm (conn, status, encrypt); +} +static inline void hci_encrypt_cfm (struct hci_conn *conn,__u8 status) { -struct hci_cb *cb;__u8 encrypt;if (conn->state ==BT_CONFIG ) {
@@ -2095,40 +2129,38 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) conn->sec_level = conn->pending_sec_level; } -mutex_lock (&hci_cb_list_lock); -list_for_each_entry (cb, &hci_cb_list, list) { -if (cb->security_cfm) - cb->security_cfm (conn, status, encrypt); - } -mutex_unlock (&hci_cb_list_lock); - -if (conn->security_cfm_cb) - conn->security_cfm_cb (conn, status); +hci_security_cfm (conn, status, encrypt); }static inline void hci_key_change_cfm (struct hci_conn *conn,__u8 status) { -struct hci_cb *cb; +struct list_head list; +struct hci_cb *cb, *tmp; + +INIT_LIST_HEAD (&list); +hci_cb_lookup (conn, &list); -mutex_lock (&hci_cb_list_lock); -list_for_each_entry (cb, &hci_cb_list, list) { +list_for_each_entry_safe (cb, tmp, &list, list) {if (cb->key_change_cfm) cb->key_change_cfm (conn, status); +kfree (cb); } -mutex_unlock (&hci_cb_list_lock); }static inline void hci_role_switch_cfm (struct hci_conn *conn,__u8 status,__u8 role) { -struct hci_cb *cb; +struct list_head list; +struct hci_cb *cb, *tmp; + +INIT_LIST_HEAD (&list); +hci_cb_lookup (conn, &list); -mutex_lock (&hci_cb_list_lock); -list_for_each_entry (cb, &hci_cb_list, list) { +list_for_each_entry_safe (cb, tmp, &list, list) {if (cb->role_switch_cfm) cb->role_switch_cfm (conn, status, role); +kfree (cb); } -mutex_unlock (&hci_cb_list_lock); }static inline bool hci_bdaddr_is_rpa (bdaddr_t *bdaddr,u8 addr_type)
net/bluetooth/hci_core.c +3 -7
@@ -57,7 +57,6 @@ DEFINE_RWLOCK(hci_dev_list_lock);/* HCI callback list */ LIST_HEAD (hci_cb_list); -DEFINE_MUTEX (hci_cb_list_lock);/* HCI ID Numbering */ static DEFINE_IDA (hci_index_ida);
@@ -2993,9 +2992,7 @@ int hci_register_cb(struct hci_cb *cb) {BT_DBG ("%p name %s" , cb, cb->name); -mutex_lock (&hci_cb_list_lock); -list_add_tail (&cb->list, &hci_cb_list); -mutex_unlock (&hci_cb_list_lock); +list_add_tail_rcu (&cb->list, &hci_cb_list);return 0 ; }
@@ -3005,9 +3002,8 @@ int hci_unregister_cb(struct hci_cb *cb) {BT_DBG ("%p name %s" , cb, cb->name); -mutex_lock (&hci_cb_list_lock); -list_del (&cb->list); -mutex_unlock (&hci_cb_list_lock); +list_del_rcu (&cb->list); +synchronize_rcu ();return 0 ; }
net/bluetooth/iso.c +6 -0
@@ -2137,6 +2137,11 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)return HCI_LM_ACCEPT ; } +static bool iso_match (struct hci_conn *hcon) +{ +return hcon->type ==ISO_LINK || hcon->type ==LE_LINK ; +} +static void iso_connect_cfm (struct hci_conn *hcon,__u8 status) {if (hcon->type !=ISO_LINK ) {
@@ -2318,6 +2323,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)static struct hci_cb iso_cb = { .name ="ISO" , + .match = iso_match, .connect_cfm = iso_connect_cfm, .disconn_cfm = iso_disconn_cfm, };
net/bluetooth/l2cap_core.c +6 -6
@@ -7217,6 +7217,11 @@ static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,return NULL ; } +static bool l2cap_match (struct hci_conn *hcon) +{ +return hcon->type ==ACL_LINK || hcon->type ==LE_LINK ; +} +static void l2cap_connect_cfm (struct hci_conn *hcon,u8 status) {struct hci_dev *hdev = hcon->hdev;
@@ -7224,9 +7229,6 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)struct l2cap_chan *pchan;u8 dst_type; -if (hcon->type !=ACL_LINK && hcon->type !=LE_LINK ) -return ; -BT_DBG ("hcon %p bdaddr %pMR status %d" , hcon, &hcon->dst, status);if (status) {
@@ -7291,9 +7293,6 @@ int l2cap_disconn_ind(struct hci_conn *hcon)static void l2cap_disconn_cfm (struct hci_conn *hcon,u8 reason) { -if (hcon->type !=ACL_LINK && hcon->type !=LE_LINK ) -return ; -BT_DBG ("hcon %p reason %d" , hcon, reason);l2cap_conn_del (hcon,bt_to_errno (reason));
@@ -7572,6 +7571,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)static struct hci_cb l2cap_cb = { .name ="L2CAP" , + .match = l2cap_match, .connect_cfm = l2cap_connect_cfm, .disconn_cfm = l2cap_disconn_cfm, .security_cfm = l2cap_security_cfm,
net/bluetooth/rfcomm/core.c +6 -0
@@ -2134,6 +2134,11 @@ static int rfcomm_run(void *unused)return 0 ; } +static bool rfcomm_match (struct hci_conn *hcon) +{ +return hcon->type ==ACL_LINK ; +} +static void rfcomm_security_cfm (struct hci_conn *conn,u8 status,u8 encrypt) {struct rfcomm_session *s;
@@ -2180,6 +2185,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)static struct hci_cb rfcomm_cb = { .name ="RFCOMM" , + .match = rfcomm_match, .security_cfm = rfcomm_security_cfm };
net/bluetooth/sco.c +6 -6
@@ -1355,11 +1355,13 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)return lm; } -static void sco_connect_cfm (struct hci_conn *hcon,__u8 status) +static bool sco_match (struct hci_conn *hcon) { -if (hcon->type !=SCO_LINK && hcon->type !=ESCO_LINK ) -return ; +return hcon->type ==SCO_LINK || hcon->type ==ESCO_LINK ; +} +static void sco_connect_cfm (struct hci_conn *hcon,__u8 status) +{BT_DBG ("hcon %p bdaddr %pMR status %u" , hcon, &hcon->dst, status);if (!status) {
@@ -1374,9 +1376,6 @@ static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)static void sco_disconn_cfm (struct hci_conn *hcon,__u8 reason) { -if (hcon->type !=SCO_LINK && hcon->type !=ESCO_LINK ) -return ; -BT_DBG ("hcon %p reason %d" , hcon, reason);sco_conn_del (hcon,bt_to_errno (reason));
@@ -1402,6 +1401,7 @@ void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)static struct hci_cb sco_cb = { .name ="SCO" , + .match = sco_match, .connect_cfm = sco_connect_cfm, .disconn_cfm = sco_disconn_cfm, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/156 irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak <[email protected]>
[ Upstream commit a1855f1b7c33642c9f7a01991fb763342a312e9b ]
percpu_base is used in various percpu functions that expect variable in __percpu address space. Correct the declaration of percpu_base to
void __iomem * __percpu *percpu_base;
to declare the variable as __percpu pointer.
The patch fixes several sparse warnings:
irq-gic.c:1172:44: warning: incorrect type in assignment (different address spaces)
irq-gic.c:1172:44: expected void [noderef] __percpu *[noderef] __iomem *percpu_base
irq-gic.c:1172:44: got void [noderef] __iomem *[noderef] __percpu *
...
irq-gic.c:1231:43: warning: incorrect type in argument 1 (different address spaces)
irq-gic.c:1231:43: expected void [noderef] __percpu *__pdata
irq-gic.c:1231:43: got void [noderef] __percpu *[noderef] __iomem *percpu_base
There were no changes in the resulting object files.
--- drivers/irqchip/irq-gic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-gic.c +1 -1
@@ -64,7 +64,7 @@ static void gic_check_cpu_features(void)union gic_base {void __iomem *common_base; -void __percpu *__iomem *percpu_base; +void __iomem *__percpu *percpu_base; };struct gic_chip_data {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/156 ARC: build: Try to guess GCC variant of cross compiler
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 824927e88456331c7a999fdf5d9d27923b619590 ]
ARC GCC compiler is packaged starting from Fedora 39i and the GCC variant of cross compile tools has arc-linux-gnu- prefix and not arc-linux-. This is causing that CROSS_COMPILE variable is left unset.
This change allows builds without need to supply CROSS_COMPILE argument if distro package is used.
Before this change:
$ make -j 128 ARCH=arc W=1 drivers/infiniband/hw/mlx4/ gcc: warning: ‘-mcpu=’ is deprecated; use ‘-mtune=’ or ‘-march=’ instead gcc: error: unrecognized command-line option ‘-mmedium-calls’ gcc: error: unrecognized command-line option ‘-mlock’ gcc: error: unrecognized command-line option ‘-munaligned-access’
[1] https://packages.fedoraproject.org/pkgs/cross-gcc/gcc-arc-linux-gnu/index.html
--- arch/arc/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arc/Makefile +1 -1
@@ -6,7 +6,7 @@ KBUILD_DEFCONFIG := haps_hs_smp_defconfig ifeq ($(CROSS_COMPILE),) -CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux-) +CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux- arc-linux-gnu-) endif cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/156 bpf: refactor bpf_helper_changes_pkt_data to use helper number
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit b238e187b4a2d3b54d80aec05a9cab6466b79dde ]
Use BPF helper number instead of function pointer in bpf_helper_changes_pkt_data(). This would simplify usage of this function in verifier.c:check_cfg() (in a follow-up patch), where only helper number is easily available and there is no real need to lookup helper proto.
Stable-dep-of: 1a4607ffba35 ("bpf: consider that tail calls invalidate packet pointers")
--- include/linux/filter.h | 2 +- kernel/bpf/core.c | 2 +- kernel/bpf/verifier.c | 2 +- net/core/filter.c | 63 +++++++++++++++++++----------------------- 4 files changed, 31 insertions(+), 38 deletions(-)
include/linux/filter.h +1 -1
@@ -1121,7 +1121,7 @@ bool bpf_jit_supports_arena(void);bool bpf_jit_supports_insn (struct bpf_insn *insn,bool in_arena);u64 bpf_arch_uaddress_limit (void );void arch_bpf_stack_walk (bool (*consume_fn)(void *cookie,u64 ip,u64 sp,u64 bp),void *cookie); -bool bpf_helper_changes_pkt_data (void *func); +bool bpf_helper_changes_pkt_data (enum bpf_func_id func_id);static inline bool bpf_dump_raw_ok (const struct cred *cred) {
kernel/bpf/core.c +1 -1
@@ -2940,7 +2940,7 @@ void __weak bpf_jit_compile(struct bpf_prog *prog) { } -bool __weak bpf_helper_changes_pkt_data (void *func) +bool __weak bpf_helper_changes_pkt_data (enum bpf_func_id func_id) {return false; }
kernel/bpf/verifier.c +1 -1
@@ -10476,7 +10476,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn }/* With LD_ABS/IND some JITs save/restore skb from r1. */ - changes_data =bpf_helper_changes_pkt_data (fn->func); + changes_data =bpf_helper_changes_pkt_data (func_id);if (changes_data && fn->arg1_type !=ARG_PTR_TO_CTX ) {verbose (env,"kernel subsystem misconfigured func %s#%d: r1 != ctx\n" ,func_id_name (func_id), func_id);
net/core/filter.c +28 -35
70 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/156 bpf: consider that tail calls invalidate packet pointers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit 1a4607ffba35bf2a630aab299e34dd3f6e658d70 ]
Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers.
Making the change in bpf_helper_changes_pkt_data() automatically makes use of check_cfg() logic that computes 'changes_pkt_data' effect for global sub-programs, such that the following program could be rejected:
int tail_call(struct __sk_buff *sk)
{
bpf_tail_call_static(sk, &jmp_table, 0);
return 0;
}
SEC("tc")
int not_safe(struct __sk_buff *sk)
{
int *p = (void *)(long)sk->data;
... make p valid ...
tail_call(sk);
*p = 42; /* this is unsafe */
...
}The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that can invalidate packet pointers. Otherwise, it can't be freplaced with tailcall_freplace.c:entry_freplace() that does a tail call.
--- net/core/filter.c | 2 ++ tools/testing/selftests/bpf/progs/tc_bpf2bpf.c | 2 ++ 2 files changed, 4 insertions(+)
net/core/filter.c +2 -0
@@ -7943,6 +7943,8 @@ bool bpf_helper_changes_pkt_data(enum bpf_func_id func_id)case BPF_FUNC_xdp_adjust_head:case BPF_FUNC_xdp_adjust_meta:case BPF_FUNC_xdp_adjust_tail: +/* tail-called program could call any of the above */ +case BPF_FUNC_tail_call:return true;default :return false;
tools/testing/selftests/bpf/progs/tc_bpf2bpf.c +2 -0
@@ -10,6 +10,8 @@ int subprog(struct __sk_buff *skb)int ret =1 ;__sink (ret); +/* let verifier know that 'subprog_tc' can change pointers to skb->data */ +bpf_skb_change_proto (skb,0 ,0 );return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/156 clk: thead: Fix TH1520 emmc and shdci clock rate
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maksim Kiselev <[email protected]>
[ Upstream commit f4bf0b909a6bf64a2220a42a7c8b8c2ee1b77b89 ]
In accordance with LicheePi 4A BSP the clock that comes to emmc/sdhci is 198Mhz which is got through frequency division of source clock VIDEO PLL by 4 [1].
But now the AP_SUBSYS driver sets the CLK EMMC SDIO to the same frequency as the VIDEO PLL, equal to 792 MHz. This causes emmc/sdhci to work 4 times slower.
Let's fix this issue by adding fixed factor clock that divides VIDEO PLL by 4 for emmc/sdhci.
--- drivers/clk/thead/clk-th1520-ap.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/clk/thead/clk-th1520-ap.c +12 -1
@@ -779,6 +779,13 @@ static struct ccu_div dpu1_clk = { }, }; +static CLK_FIXED_FACTOR_HW(emmc_sdio_ref_clk, "emmc-sdio-ref", + &video_pll_clk.common.hw, 4, 1, 0); + +static const struct clk_parent_data emmc_sdio_ref_clk_pd[] = { + { .hw = &emmc_sdio_ref_clk.hw }, +}; + static CCU_GATE(CLK_BROM, brom_clk, "brom", ahb2_cpusys_hclk_pd, 0x100, BIT(4), 0); static CCU_GATE(CLK_BMU, bmu_clk, "bmu", axi4_cpusys2_aclk_pd, 0x100, BIT(5), 0); static CCU_GATE(CLK_AON2CPU_A2X, aon2cpu_a2x_clk, "aon2cpu-a2x", axi4_cpusys2_aclk_pd,
@@ -798,7 +805,7 @@ static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", p 0x150, BIT(12), 0); static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, BIT(5), 0); static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, BIT(13), 0); -static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", video_pll_clk_pd, 0x204, BIT(30), 0); +static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, BIT(30), 0); static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, BIT(26), 0); static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, BIT(24), 0); static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, BIT(23), 0);
@@ -1059,6 +1066,10 @@ static int th1520_clk_probe(struct platform_device *pdev)return ret; priv->hws[CLK_PLL_GMAC_100M ] = &gmac_pll_clk_100m.hw; + ret =devm_clk_hw_register (dev, &emmc_sdio_ref_clk.hw); +if (ret) +return ret; + ret =devm_of_clk_add_hw_provider (dev, of_clk_hw_onecell_get, priv);if (ret)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/156 scripts/mksysmap: Fix escape chars $
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mostafa Saleh <[email protected]>
[ Upstream commit 7a6c355b55c051eb37cb15d191241da3aa3d6cba ]
Commit b18b047002b7 ("kbuild: change scripts/mksysmap into sed script") changed the invocation of the script, to call sed directly without shell.
That means, the current extra escape that was added in:
commit ec336aa83162 ("scripts/mksysmap: Fix badly escaped '$'") for the shell is not correct any more, at the moment the stack traces for nvhe are corrupted:
[ 22.840904] kvm [190]: [<ffff80008116dd54>] __kvm_nvhe_$x.220+0x58/0x9c [ 22.842913] kvm [190]: [<ffff8000811709bc>] __kvm_nvhe_$x.9+0x44/0x50 [ 22.844112] kvm [190]: [<ffff80008116f8fc>] __kvm_nvhe___skip_pauth_save+0x4/0x4
With this patch:
[ 25.793513] kvm [192]: nVHE call trace: [ 25.794141] kvm [192]: [<ffff80008116dd54>] __kvm_nvhe_hyp_panic+0xb0/0xf4 [ 25.796590] kvm [192]: [<ffff8000811709bc>] __kvm_nvhe_handle_trap+0xe4/0x188 [ 25.797553] kvm [192]: [<ffff80008116f8fc>] __kvm_nvhe___skip_pauth_save+0x4/0x4
--- scripts/mksysmap | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/mksysmap +2 -2
@@ -26,7 +26,7 @@ # (do not forget a space before each pattern) # local symbols for ARM, MIPS, etc. -/ \\$/d +/ \$/d # local labels, .LBB, .Ltmpxxx, .L__unnamed_xx, .LASANPC, etc. / \.L/d
@@ -39,7 +39,7 @@ / __pi_\.L/d # arm64 local symbols in non-VHE KVM namespace -/ __kvm_nvhe_\\$/d +/ __kvm_nvhe_\$/d / __kvm_nvhe_\.L/d # lld arm/aarch64/mips thunks
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/156 modpost: fix the missed iteration for the max bit in do_input()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit bf36b4bf1b9a7a0015610e2f038ee84ddb085de2 ]
This loop should iterate over the range from 'min' to 'max' inclusively. The last interation is missed.
--- scripts/mod/file2alias.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/mod/file2alias.c +1 -1
@@ -742,7 +742,7 @@ static void do_input(char *alias,for (i = min /BITS_PER_LONG ; i < max /BITS_PER_LONG +1 ; i++) arr[i] =TO_NATIVE (arr[i]); -for (i = min; i < max; i++) +for (i = min; i <= max; i++)if (arr[i /BITS_PER_LONG ] & (1ULL << (i%BITS_PER_LONG )))sprintf (alias +strlen (alias),"%X,*" , i); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/156 kbuild: pacman-pkg: provide versioned linux-api-headers package
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 385443057f475e775fe1c66e77d4be9727f40973 ]
The Arch Linux glibc package contains a versioned dependency on "linux-api-headers". If the linux-api-headers package provided by pacman-pkg does not specify an explicit version this dependency is not satisfied.
Fix the dependency by providing an explicit version.
--- scripts/package/PKGBUILD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/package/PKGBUILD +1 -1
@@ -103,7 +103,7 @@ _package-headers() { _package-api-headers() { pkgdesc="Kernel headers sanitized for use in userspace" - provides=(linux-api-headers) + provides=(linux-api-headers="${pkgver}") conflicts=(linux-api-headers) _prologue
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/156 Revert "ALSA: ump: Dont enumeration invalid groups for legacy rawmidi"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit abbff41b6932cde359589fd51f4024b7c85f366b upstream.
This reverts commit c2d188e137e77294323132a760a4608321a36a70.
Although it's fine to filter the invalid UMP groups at the first probe time, this will become a problem when UMP groups are updated and (re-)activated. Then there is no way to re-add the substreams properly for the legacy rawmidi, and the new active groups will be still invisible.
So let's revert the change. This will move back to showing the full 16 groups, but it's better than forever lost.
--- sound/core/ump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/ump.c +1 -1
@@ -1244,7 +1244,7 @@ static int fill_legacy_mapping(struct snd_ump_endpoint *ump) num =0 ;for (i =0 ; i <SNDRV_UMP_MAX_GROUPS ; i++) -if ((group_maps & (1U << i)) && ump->groups[i].valid) +if (group_maps & (1U << i)) ump->legacy_mapping[num++] = i;return num;
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 111/156 RDMA/mlx5: Enable multiplane mode only when it is supported
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Zhang <[email protected]>
commit 45d339fefaa3dcd237038769e0d34584fb867390 upstream.
Driver queries vport_cxt.num_plane and enables multiplane when it is greater then 0, but some old FWs (versions from x.40.1000 till x.42.1000), report vport_cxt.num_plane = 1 unexpectedly.
Fix it by querying num_plane only when HCA_CAP2.multiplane bit is set.
--- drivers/infiniband/hw/mlx5/main.c | 2 +- include/linux/mlx5/mlx5_ifc.h | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/main.c +1 -1
@@ -2831,7 +2831,7 @@ static int mlx5_ib_get_plane_num(structint err; *num_plane =0 ; -if (!MLX5_CAP_GEN (mdev, ib_virt)) +if (!MLX5_CAP_GEN (mdev, ib_virt) || !MLX5_CAP_GEN_2 (mdev, multiplane))return 0 ; err =mlx5_query_hca_vport_context (mdev,0 ,1 ,0 , &vport_ctx);
include/linux/mlx5/mlx5_ifc.h +3 -1
@@ -2113,7 +2113,9 @@ struct mlx5_ifc_cmd_hca_cap_2_bits {u8 migration_in_chunks[0x1 ];u8 reserved_at_d1[0x1 ];u8 sf_eq_usage[0x1 ]; -u8 reserved_at_d3[0xd ]; +u8 reserved_at_d3[0x5 ]; +u8 multiplane[0x1 ]; +u8 reserved_at_d9[0x7 ];u8 cross_vhca_object_to_object_supported[0x20 ];
Greg Kroah-Hartman
maintainerPATCH 112/156 io_uring/kbuf: use pre-committed buffer address for non-pollable file
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit ed123c948d06688d10f3b10a7bce1d6fbfd1ed07 upstream.
For non-pollable files, buffer ring consumption will commit upfront. This is fine, but io_ring_buffer_select() will return the address of the buffer after having committed it. For incrementally consumed buffers, this is incorrect as it will modify the buffer address.
Store the pre-committed value and return that. If that isn't done, then the initial part of the buffer is not used and the application will correctly assume the content arrived at the start of the userspace buffer, but the kernel will have put it later in the buffer. Or it can cause a spurious -EFAULT returned in the CQE, depending on the buffer size. As bounds are suitably checked for doing the actual IO, no adverse side effects are possible - it's just a data misplacement within the existing buffer.
--- io_uring/kbuf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
io_uring/kbuf.c +3 -1
@@ -139,6 +139,7 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len,struct io_uring_buf_ring *br = bl->buf_ring;__u16 tail, head = bl->head;struct io_uring_buf *buf; +void __user *ret; tail =smp_load_acquire (&br->tail);if (unlikely (tail == head))
@@ -153,6 +154,7 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len, req->flags |=REQ_F_BUFFER_RING |REQ_F_BUFFERS_COMMIT ; req->buf_list = bl; req->buf_index = buf->bid; + ret =u64_to_user_ptr (buf->addr);if (issue_flags &IO_URING_F_UNLOCKED || !io_file_can_poll (req)) {/*
@@ -168,7 +170,7 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len,io_kbuf_commit (req, bl, *len,1 ); req->buf_list =NULL ; } -return u64_to_user_ptr (buf->addr); +return ret; } void __user *io_buffer_select(struct io_kiocb *req, size_t *len,
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 113/156 ALSA: seq: Check UMP support for midi_version change
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 8765429279e7d3d68d39ace5f84af2815174bb1e upstream.
When the kernel is built without UMP support but a user-space app requires the midi_version > 0, the kernel should return an error. Otherwise user-space assumes as if it were possible to deal, eventually hitting serious errors later.
--- sound/core/seq/seq_clientmgr.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
sound/core/seq/seq_clientmgr.c +10 -4
@@ -1275,10 +1275,16 @@ static int snd_seq_ioctl_set_client_infoif (client->type != client_info->type)return -EINVAL ; -/* check validity of midi_version field */ -if (client->user_pversion >=SNDRV_PROTOCOL_VERSION (1 ,0 ,3 ) && - client_info->midi_version >SNDRV_SEQ_CLIENT_UMP_MIDI_2_0 ) -return -EINVAL ; +if (client->user_pversion >=SNDRV_PROTOCOL_VERSION (1 ,0 ,3 )) { +/* check validity of midi_version field */ +if (client_info->midi_version >SNDRV_SEQ_CLIENT_UMP_MIDI_2_0 ) +return -EINVAL ; + +/* check if UMP is supported in kernel */ +if (!IS_ENABLED (CONFIG_SND_SEQ_UMP ) && + client_info->midi_version >0 ) +return -EINVAL ; + }/* fill the info fields */ if (client_info->name[0 ])
Greg Kroah-Hartman
maintainerPATCH 114/156 ftrace: Fix function profilers filtering functionality
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
commit 789a8cff8d2dbe4b5c617c3004b5eb63fa7a3b35 upstream.
Commit c132be2c4fcc ("function_graph: Have the instances use their own ftrace_ops for filtering"), function profiler (enabled via function_profile_enabled) has been showing statistics for all functions, ignoring set_ftrace_filter settings.
While tracers are instantiated, the function profiler is not. Therefore, it should use the global set_ftrace_filter for consistency. This patch modifies the function profiler to use the global filter, fixing the filtering functionality.
Before (filtering not working):
```
root@localhost:~# echo 'vfs*' > /sys/kernel/tracing/set_ftrace_filter
root@localhost:~# echo 1 > /sys/kernel/tracing/function_profile_enabled
root@localhost:~# sleep 1
root@localhost:~# echo 0 > /sys/kernel/tracing/function_profile_enabled
root@localhost:~# head /sys/kernel/tracing/trace_stat/*
Function Hit Time Avg
s^2
-------- --- ---- ---
---
schedule 314 22290594 us 70989.15 us
40372231 us
x64_sys_call 1527 8762510 us 5738.382 us
3414354 us
schedule_hrtimeout_range 176 8665356 us 49234.98 us
405618876 us
__x64_sys_ppoll 324 5656635 us 17458.75 us
19203976 us
do_sys_poll 324 5653747 us 17449.83 us
19214945 us
schedule_timeout 67 5531396 us 82558.15 us
2136740827 us
__x64_sys_pselect6 12 3029540 us 252461.7 us
63296940171 us
do_pselect.constprop.0 12 3029532 us 252461.0 us
63296952931 us
```After (filtering working):
```
root@localhost:~# echo 'vfs*' > /sys/kernel/tracing/set_ftrace_filter
root@localhost:~# echo 1 > /sys/kernel/tracing/function_profile_enabled
root@localhost:~# sleep 1
root@localhost:~# echo 0 > /sys/kernel/tracing/function_profile_enabled
root@localhost:~# head /sys/kernel/tracing/trace_stat/*
Function Hit Time Avg
s^2
-------- --- ---- ---
---
vfs_write 462 68476.43 us 148.217 us
25874.48 us
vfs_read 641 9611.356 us 14.994 us
28868.07 us
vfs_fstat 890 878.094 us 0.986 us
1.667 us
vfs_fstatat 227 757.176 us 3.335 us
18.928 us
vfs_statx 226 610.610 us 2.701 us
17.749 us
vfs_getattr_nosec 1187 460.919 us 0.388 us
0.326 us
vfs_statx_path 297 343.287 us 1.155 us
11.116 us
vfs_rename 6 291.575 us 48.595 us
9889.236 us
```--- kernel/trace/ftrace.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
kernel/trace/ftrace.c +2 -6
@@ -883,16 +883,13 @@ static void profile_graph_return(struct }static struct fgraph_ops fprofiler_ops = { - .ops = { - .flags =FTRACE_OPS_FL_INITIALIZED , -INIT_OPS_HASH (fprofiler_ops.ops) - }, .entryfunc = &profile_graph_entry, .retfunc = &profile_graph_return, };static int register_ftrace_profiler (void ) { +ftrace_ops_set_global_filter (&fprofiler_ops.ops);return register_ftrace_graph (&fprofiler_ops); }
@@ -903,12 +900,11 @@ static void unregister_ftrace_profiler(v#else static struct ftrace_ops ftrace_profile_ops__read_mostly = { .func = function_profile_call, - .flags =FTRACE_OPS_FL_INITIALIZED , -INIT_OPS_HASH (ftrace_profile_ops) };static int register_ftrace_profiler (void ) { +ftrace_ops_set_global_filter (&ftrace_profile_ops);return register_ftrace_function (&ftrace_profile_ops); }
Greg Kroah-Hartman
maintainerPATCH 115/156 drm/xe: Use non-interruptible wait when moving BO to system
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <[email protected]>
commit 528cef1b4170f328d28d4e9b437380d8e5a2d18f upstream.
Ensure a non-interruptible wait is used when moving a bo to XE_PL_SYSTEM. This prevents dma_mappings from being removed prematurely while a GPU job is still in progress, even if the CPU receives a signal during the operation.
--- drivers/gpu/drm/xe/xe_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_bo.c +1 -1
@@ -722,7 +722,7 @@ static int xe_bo_move(struct ttm_buffer_ new_mem->mem_type == XE_PL_SYSTEM) {long timeout =dma_resv_wait_timeout (ttm_bo->base.resv,DMA_RESV_USAGE_BOOKKEEP , - true, + false,MAX_SCHEDULE_TIMEOUT );if (timeout <0 ) { ret = timeout;
Greg Kroah-Hartman
maintainerPATCH 116/156 drm/xe: Wait for migration job before unmapping pages
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <[email protected]>
commit 5e0a67fdb894d34c5f109e969320eef9ddae7480 upstream.
Fix a potential GPU page fault during tt -> system moves by waiting for migration jobs to complete before unmapping SG. This ensures that IOMMU mappings are not prematurely torn down while a migration job is still in progress.
v2: Use intr=false(Matt A)
v3: Update commit message(Matt A)
v4: s/DMA_RESV_USAGE_BOOKKEEP/DMA_RESV_USAGE_KERNEL(Thomas)
--- drivers/gpu/drm/xe/xe_bo.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_bo.c +9 -1
@@ -846,8 +846,16 @@ static int xe_bo_move(struct ttm_buffer_ out:if ((!ttm_bo->resource || ttm_bo->resource->mem_type ==XE_PL_SYSTEM ) && - ttm_bo->ttm) + ttm_bo->ttm) { +long timeout =dma_resv_wait_timeout (ttm_bo->base.resv, +DMA_RESV_USAGE_KERNEL , + false, +MAX_SCHEDULE_TIMEOUT ); +if (timeout <0 ) + ret = timeout; +xe_tt_unmap_sg (ttm_bo->ttm); + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 117/156 ALSA hda/realtek: Add quirk for Framework F111:000C
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Schaefer <[email protected]>
commit 7b509910b3ad6d7aacead24c8744de10daf8715d upstream.
Similar to commit eb91c456f371
("ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks") and previous quirks for Framework systems with
Realtek codecs.
000C is a new platform that will also have an ALC285 codec and needs the same quirk.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10993,6 +10993,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0009 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0xf111 ,0x000c ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0/* Below is a quirk table taken from the old code.
Greg Kroah-Hartman
maintainerPATCH 118/156 ALSA: seq: oss: Fix races at processing SysEx messages
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 0179488ca992d79908b8e26b9213f1554fc5bacc upstream.
OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access.
As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets.
--- sound/core/seq/oss/seq_oss_synth.c | 2 ++ 1 file changed, 2 insertions(+)
sound/core/seq/oss/seq_oss_synth.c +2 -0
@@ -66,6 +66,7 @@ static struct seq_oss_synth midi_synth_d };static DEFINE_SPINLOCK (register_lock); +static DEFINE_MUTEX (sysex_mutex);/* * prototypes
@@ -497,6 +498,7 @@ snd_seq_oss_synth_sysex(struct seq_oss_dif (!info)return -ENXIO ; +guard (mutex)(&sysex_mutex); sysex = info->sysex;if (sysex ==NULL ) { sysex =kzalloc (sizeof (*sysex),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 119/156 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Lam <[email protected]>
commit 5f3fd772d152229d94602bca243fbb658068a597 upstream.
When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the dangling pointer.
During the remounting process, the pointer dqi_priv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOT_SUSPENDED flag instead of setting the DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2_get_next_id is called and only checks the quota usage flags and not the quota suspended flags.
To fix this, I set dqi_priv to null when it is freed after remounting with read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.
--- fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/quota_local.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
fs/ocfs2/quota_global.c +1 -1
@@ -893,7 +893,7 @@ static int ocfs2_get_next_id(struct supeint status =0 ;trace_ocfs2_get_next_id (from_kqid (&init_user_ns, *qid), type); -if (!sb_has_quota_loaded (sb, type)) { +if (!sb_has_quota_active (sb, type)) { status = -ESRCH ; goto out; }
fs/ocfs2/quota_local.c +1 -0
@@ -867,6 +867,7 @@ out:brelse (oinfo->dqi_libh);brelse (oinfo->dqi_lqi_bh);kfree (oinfo); + info->dqi_priv =NULL ;return status; }
Greg Kroah-Hartman
maintainerPATCH 120/156 kcov: mark in_softirq_really() as __always_inline
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit cb0ca08b326aa03f87fe94bb91872ce8d2ef1ed8 upstream.
If gcc decides not to inline in_softirq_really(), objtool warns about a function call with UACCESS enabled:
kernel/kcov.o: warning: objtool: __sanitizer_cov_trace_pc+0x1e: call to in_softirq_really() with UACCESS enabled kernel/kcov.o: warning: objtool: check_kcov_mode+0x11: call to in_softirq_really() with UACCESS enabled
Mark this as __always_inline to avoid the problem.
--- kernel/kcov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kcov.c +1 -1
@@ -166,7 +166,7 @@ static void kcov_remote_area_put(struct* Unlike in_serving_softirq(), this function returns false when called during * a hardirq or an NMI that happened in the softirq context. */ -static inline bool in_softirq_really (void ) +static __always_inline bool in_softirq_really(void) {return in_serving_softirq () && !in_hardirq () && !in_nmi (); }
Greg Kroah-Hartman
maintainerPATCH 121/156 maple_tree: reload mas before the second call for mas_empty_area
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
commit 1fd8bc7cd889bd73d07a83cb32d674ac68f99153 upstream.
Change the LONG_MAX in simple_offset_add to 1024, and do latter:
[root@fedora ~]# mkdir /tmp/dir
[root@fedora ~]# for i in {1..1024}; do touch /tmp/dir/$i; done
touch: cannot touch '/tmp/dir/1024': Device or resource busy [root@fedora ~]# rm /tmp/dir/123
[root@fedora ~]# touch /tmp/dir/1024
[root@fedora ~]# rm /tmp/dir/100
[root@fedora ~]# touch /tmp/dir/1025
touch: cannot touch '/tmp/dir/1025': Device or resource busy
After we delete file 100, actually this is a empty entry, but the latter create failed unexpected.
mas_alloc_cyclic has two chance to find empty entry. First find the entry with range range_lo and range_hi, if no empty entry exist, and range_lo > min, retry find with range min and range_hi. However, the first call mas_empty_area may mark mas as EBUSY, and the second call for mas_empty_area will return false directly. Fix this by reload mas before second call for mas_empty_area.
--- lib/maple_tree.c | 1 + 1 file changed, 1 insertion(+)
lib/maple_tree.c +1 -0
@@ -4367,6 +4367,7 @@ int mas_alloc_cyclic(struct ma_state *ma ret =1 ; }if (ret <0 && range_lo > min) { +mas_reset (mas); ret =mas_empty_area (mas, min, range_hi,1 );if (ret ==0 ) ret =1 ;
Greg Kroah-Hartman
maintainerPATCH 122/156 clk: clk-imx8mp-audiomix: fix function signature
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolaus Voss <[email protected]>
commit c384481006476ac65478fa3584c7245782e52f34 upstream.
clk_imx8mp_audiomix_reset_controller_register() in the "if !CONFIG_RESET_CONTROLLER" branch had the first argument missing. It is an empty function for this branch so it wasn't immediately apparent.
--- drivers/clk/imx/clk-imx8mp-audiomix.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/clk/imx/clk-imx8mp-audiomix.c +2 -1
@@ -278,7 +278,8 @@ static int clk_imx8mp_audiomix_reset_con#else /* !CONFIG_RESET_CONTROLLER */ -static int clk_imx8mp_audiomix_reset_controller_register (struct clk_imx8mp_audiomix_priv *priv) +static int clk_imx8mp_audiomix_reset_controller_register (struct device *dev, +struct clk_imx8mp_audiomix_priv *priv) {return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 123/156 scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <[email protected]>
commit 0210d251162f4033350a94a43f95b1c39ec84a90 upstream.
The orc_sort_cmp() function, used with qsort(), previously violated the symmetry and transitivity rules required by the C standard. Specifically, when both entries are ORC_TYPE_UNDEFINED, it could result in both a < b and b < a, which breaks the required symmetry and transitivity. This can lead to undefined behavior and incorrect sorting results, potentially causing memory corruption in glibc implementations [1].
Symmetry: If x < y, then y > x.
Transitivity: If x < y and y < z, then x < z.
Fix the comparison logic to return 0 when both entries are ORC_TYPE_UNDEFINED, ensuring compliance with qsort() requirements.
--- scripts/sorttable.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
scripts/sorttable.h +4 -1
@@ -110,7 +110,7 @@ static inline unsigned long orc_ip(conststatic int orc_sort_cmp (const void *_a,const void *_b) { -struct orc_entry *orc_a; +struct orc_entry *orc_a, *orc_b;const int *a = g_orc_ip_table + *(int *)_a;const int *b = g_orc_ip_table + *(int *)_b;unsigned long a_val =orc_ip (a);
@@ -128,6 +128,9 @@ static int orc_sort_cmp(const void *_a,* whitelisted .o files which didn't get objtool generation. */ orc_a = g_orc_table + (a - g_orc_ip_table); + orc_b = g_orc_table + (b - g_orc_ip_table); +if (orc_a->type ==ORC_TYPE_UNDEFINED && orc_b->type ==ORC_TYPE_UNDEFINED ) +return 0 ;return orc_a->type ==ORC_TYPE_UNDEFINED ?-1 :1 ; }
Greg Kroah-Hartman
maintainerPATCH 124/156 sched_ext: Fix invalid irq restore in scx_ops_bypass()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 18b2093f4598d8ee67a8153badc93f0fa7686b8a upstream.
While adding outer irqsave/restore locking, 0e7ffff1b811 ("scx: Fix raciness in scx_ops_bypass()") forgot to convert an inner rq_unlock_irqrestore() to rq_unlock() which could re-enable IRQ prematurely leading to the following warning:
raw_local_irq_restore() called with IRQs enabled
WARNING: CPU: 1 PID: 96 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40 ... Sched_ext: create_dsq (enabling) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : warn_bogus_irq_restore+0x30/0x40 lr : warn_bogus_irq_restore+0x30/0x40 ... Call trace: warn_bogus_irq_restore+0x30/0x40 (P) warn_bogus_irq_restore+0x30/0x40 (L) scx_ops_bypass+0x224/0x3b8 scx_ops_enable.isra.0+0x2c8/0xaa8 bpf_scx_reg+0x18/0x30 ... irq event stamp: 33739 hardirqs last enabled at (33739): [<ffff8000800b699c>] scx_ops_bypass+0x174/0x3b8 hardirqs last disabled at (33738): [<ffff800080d48ad4>] _raw_spin_lock_irqsave+0xb4/0xd8
Drop the stray _irqrestore().
--- kernel/sched/ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/ext.c +1 -1
@@ -4367,7 +4367,7 @@ static void scx_ops_bypass(bool bypass)* sees scx_rq_bypassing() before moving tasks to SCX. */ if (!scx_enabled ()) { -rq_unlock_irqrestore (rq, &rf); +rq_unlock (rq, &rf);continue ; }
Greg Kroah-Hartman
maintainerPATCH 125/156 RDMA/uverbs: Prevent integer overflow issue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit d0257e089d1bbd35c69b6c97ff73e3690ab149a9 upstream.
In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbs_request_next_ptr() which also could potentially wrap. The "cmd.sge_count * sizeof(struct ib_uverbs_sge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems.
This patch does two things. First, I've re-arranged the condition in uverbs_request_next_ptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use size_mul() for the multiplications.
--- drivers/infiniband/core/uverbs_cmd.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/infiniband/core/uverbs_cmd.c +9 -7
@@ -161,7 +161,7 @@ static const void __user *uverbs_request {const void __user *res = iter->cur; -if (iter->cur + len > iter->end) +if (len > iter->end - iter->cur)return (void __force __user *)ERR_PTR (-ENOSPC ); iter->cur += len;return res;
@@ -2010,11 +2010,13 @@ static int ib_uverbs_post_send(struct uv ret =uverbs_request_start (attrs, &iter, &cmd,sizeof (cmd));if (ret)return ret; - wqes =uverbs_request_next_ptr (&iter, cmd.wqe_size * cmd.wr_count); + wqes =uverbs_request_next_ptr (&iter,size_mul (cmd.wqe_size, + cmd.wr_count));if (IS_ERR (wqes))return PTR_ERR (wqes); - sgls =uverbs_request_next_ptr ( - &iter, cmd.sge_count *sizeof (struct ib_uverbs_sge )); + sgls =uverbs_request_next_ptr (&iter, +size_mul (cmd.sge_count, +sizeof (struct ib_uverbs_sge )));if (IS_ERR (sgls))return PTR_ERR (sgls); ret =uverbs_request_finish (&iter);
@@ -2200,11 +2202,11 @@ ib_uverbs_unmarshall_recv(struct uverbs_if (wqe_size <sizeof (struct ib_uverbs_recv_wr ))return ERR_PTR (-EINVAL ); - wqes =uverbs_request_next_ptr (iter, wqe_size * wr_count); + wqes =uverbs_request_next_ptr (iter,size_mul (wqe_size, wr_count));if (IS_ERR (wqes))return ERR_CAST (wqes); - sgls =uverbs_request_next_ptr ( - iter, sge_count *sizeof (struct ib_uverbs_sge )); + sgls =uverbs_request_next_ptr (iter,size_mul (sge_count, +sizeof (struct ib_uverbs_sge )));if (IS_ERR (sgls))return ERR_CAST (sgls); ret =uverbs_request_finish (iter);
Greg Kroah-Hartman
maintainerPATCH 126/156 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evgenii Shatokhin <[email protected]>
commit a37eecb705f33726f1fb7cd2a67e514a15dfe693 upstream.
If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen:
BUG: sleeping function called from invalid context
at kernel/locking/mutex.c:283
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ...
preempt_count: 1, expected: 0
...
Call Trace:
...
__might_resched+0x104/0x10e
__might_sleep+0x3e/0x62
mutex_lock+0x20/0x4c
regmap_lock_mutex+0x10/0x18
regmap_update_bits_base+0x2c/0x66
mcp23s08_irq_set_type+0x1ae/0x1d6
__irq_set_trigger+0x56/0x172
__setup_irq+0x1e6/0x646
request_threaded_irq+0xb6/0x160
...We observed the problem while experimenting with a touchscreen driver which used MCP23017 IO expander (I2C).
The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from concurrent accesses, which is the default for regmaps without .fast_io, .disable_locking, etc.
mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter locks the mutex.
However, __setup_irq() locks desc->lock spinlock before calling these functions. As a result, the system tries to lock the mutex whole holding the spinlock.
It seems, the internal regmap locks are not needed in this driver at all. mcp->lock seems to protect the regmap from concurrent accesses already, except, probably, in mcp_pinconf_get/set.
mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under chip_bus_lock(), which calls mcp23s08_irq_bus_lock(). The latter takes mcp->lock and enables regmap caching, so that the potentially slow I2C accesses are deferred until chip_bus_unlock().
The accesses to the regmap from mcp23s08_probe_one() do not need additional locking.
In all remaining places where the regmap is accessed, except mcp_pinconf_get/set(), the driver already takes mcp->lock.
This patch adds locking in mcp_pinconf_get/set() and disables internal locking in the regmap config. Among other things, it fixes the sleeping in atomic context described above.
--- drivers/pinctrl/pinctrl-mcp23s08.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/pinctrl/pinctrl-mcp23s08.c +6 -0
@@ -86,6 +86,7 @@ const struct regmap_config mcp23x08_regm .num_reg_defaults = ARRAY_SIZE(mcp23x08_defaults), .cache_type = REGCACHE_FLAT, .max_register = MCP_OLAT, + .disable_locking = true, /* mcp->lock protects the regmap */ };EXPORT_SYMBOL_GPL (mcp23x08_regmap);
@@ -132,6 +133,7 @@ const struct regmap_config mcp23x17_regm .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults), .cache_type = REGCACHE_FLAT, .val_format_endian = REGMAP_ENDIAN_LITTLE, + .disable_locking = true, /* mcp->lock protects the regmap */ };EXPORT_SYMBOL_GPL (mcp23x17_regmap);
@@ -228,7 +230,9 @@ static int mcp_pinconf_get(struct pinctrswitch (param) {case PIN_CONFIG_BIAS_PULL_UP : +mutex_lock (&mcp->lock); ret =mcp_read (mcp,MCP_GPPU , &data); +mutex_unlock (&mcp->lock);if (ret <0 )return ret; status = (data &BIT (pin)) ?1 :0 ;
@@ -257,7 +261,9 @@ static int mcp_pinconf_set(struct pinctrswitch (param) {case PIN_CONFIG_BIAS_PULL_UP : +mutex_lock (&mcp->lock); ret =mcp_set_bit (mcp,MCP_GPPU , pin, arg); +mutex_unlock (&mcp->lock);break ;default :dev_dbg (mcp->dev,"Invalid config param %04x\n" , param);
Greg Kroah-Hartman
maintainerPATCH 127/156 workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <[email protected]>
commit de35994ecd2dd6148ab5a6c5050a1670a04dec77 upstream.
After commit746ae46c1113 ("drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM") amdgpu started seeing the following warning:
[ ] workqueue: WQ_MEM_RECLAIM sdma0:drm_sched_run_job_work [gpu_sched] is flushing !WQ_MEM_RECLAIM events:amdgpu_device_delay_enable_gfx_off [amdgpu]
...
[ ] Workqueue: sdma0 drm_sched_run_job_work [gpu_sched]
...
[ ] Call Trace:
[ ] <TASK>
...
[ ] ? check_flush_dependency+0xf5/0x110
...
[ ] cancel_delayed_work_sync+0x6e/0x80 [ ] amdgpu_gfx_off_ctrl+0xab/0x140 [amdgpu] [ ] amdgpu_ring_alloc+0x40/0x50 [amdgpu] [ ] amdgpu_ib_schedule+0xf4/0x810 [amdgpu] [ ] ? drm_sched_run_job_work+0x22c/0x430 [gpu_sched] [ ] amdgpu_job_run+0xaa/0x1f0 [amdgpu] [ ] drm_sched_run_job_work+0x257/0x430 [gpu_sched] [ ] process_one_work+0x217/0x720
...
[ ] </TASK>
The intent of the verifcation done in check_flush_depedency is to ensure forward progress during memory reclaim, by flagging cases when either a memory reclaim process, or a memory reclaim work item is flushed from a context not marked as memory reclaim safe.
This is correct when flushing, but when called from the cancel(_delayed)_work_sync() paths it is a false positive because work is either already running, or will not be running at all. Therefore cancelling it is safe and we can relax the warning criteria by letting the helper know of the calling context.
References: 746ae46c1113 ("drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM")
--- kernel/workqueue.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
kernel/workqueue.c +13 -9
@@ -3680,23 +3680,27 @@ void workqueue_softirq_dead(unsigned int* check_flush_dependency - check for flush dependency sanity * @target_wq: workqueue being flushed * @target_work: work item being flushed (NULL for workqueue flushes) +* @from_cancel: are we called from the work cancel path * * %current is trying to flush the whole @target_wq or @target_work on it. -* If @target_wq doesn't have %WQ_MEM_RECLAIM, verify that %current is not -* reclaiming memory or running on a workqueue which doesn't have -* %WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to -* a deadlock. +* If this is not the cancel path (which implies work being flushed is either +* already running, or will not be at all), check if @target_wq doesn't have +* %WQ_MEM_RECLAIM and verify that %current is not reclaiming memory or running +* on a workqueue which doesn't have %WQ_MEM_RECLAIM as that can break forward- +* progress guarantee leading to a deadlock. */ static void check_flush_dependency (struct workqueue_struct *target_wq, -struct work_struct *target_work) +struct work_struct *target_work, +bool from_cancel) { -work_func_t target_func = target_work ? target_work->func :NULL ; +work_func_t target_func;struct worker *worker; -if (target_wq->flags &WQ_MEM_RECLAIM ) +if (from_cancel || target_wq->flags &WQ_MEM_RECLAIM )return ; worker =current_wq_worker (); + target_func = target_work ? target_work->func :NULL ; WARN_ONCE(current->flags & PF_MEMALLOC, "workqueue: PF_MEMALLOC task %d(%s) is flushing !WQ_MEM_RECLAIM %s:%ps",
@@ -3966,7 +3970,7 @@ void __flush_workqueue(struct workqueue_list_add_tail (&this_flusher.list, &wq->flusher_overflow); } -check_flush_dependency (wq,NULL ); +check_flush_dependency (wq,NULL , false);mutex_unlock (&wq->mutex);
@@ -4141,7 +4145,7 @@ static bool start_flush_work(struct work } wq = pwq->wq; -check_flush_dependency (wq, work); +check_flush_dependency (wq, work, from_cancel);insert_wq_barrier (pwq, barr, work, worker);raw_spin_unlock_irq (&pool->lock);
Greg Kroah-Hartman
maintainerPATCH 128/156 sky2: Add device ID 11ab:4373 for Marvell 88E8075
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pascal Hambourg <[email protected]>
commit 03c8d0af2e409e15c16130b185e12b5efba0a6b9 upstream.
A Marvell 88E8075 ethernet controller has this device ID instead of 11ab:4370 and works fine with the sky2 driver.
--- drivers/net/ethernet/marvell/sky2.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/marvell/sky2.c +1 -0
@@ -130,6 +130,7 @@ static const struct pci_device_id sky2_i { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436C) }, /* 88E8072 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436D) }, /* 88E8055 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4370) }, /* 88E8075 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4373) }, /* 88E8075 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4380) }, /* 88E8057 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4381) }, /* 88E8059 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4382) }, /* 88E8079 */
Greg Kroah-Hartman
maintainerPATCH 129/156 sched_ext: initialize kit->cursor.flags
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Huang <[email protected]>
commit 35bf430e08a18fdab6eb94492a06d9ad14c6179b upstream.
struct bpf_iter_scx_dsq *it maybe not initialized.
If we didn't call scx_bpf_dsq_move_set_vtime and scx_bpf_dsq_move_set_slice before scx_bpf_dsq_move, it would cause unexpected behaviors:
1. Assign a huge slice into p->scx.slice
2. Assign a invalid vtime into p->scx.dsq_vtime
--- kernel/sched/ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/ext.c +1 -1
@@ -6637,7 +6637,7 @@ __bpf_kfunc int bpf_iter_scx_dsq_new(strreturn -ENOENT ;INIT_LIST_HEAD (&kit->cursor.node); - kit->cursor.flags |=SCX_DSQ_LNODE_ITER_CURSOR | flags; + kit->cursor.flags =SCX_DSQ_LNODE_ITER_CURSOR | flags; kit->cursor.priv =READ_ONCE (kit->dsq->seq);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 130/156 net/sctp: Prevent autoclose integer overflow in sctp_association_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Kuratov <[email protected]>
commit 4e86729d1ff329815a6e8a920cb554a1d4cb5b8d upstream.
While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow.
--- net/sctp/associola.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/associola.c +2 -1
@@ -137,7 +137,8 @@ static struct sctp_association *sctp_ass = 5 * asoc->rto_max; asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK ] = asoc->sackdelay; - asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE ] = sp->autoclose *HZ ; + asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE ] = + (unsigned long )sp->autoclose *HZ ;/* Initializes the timers */ for (i =SCTP_EVENT_TIMEOUT_NONE ; i <SCTP_NUM_TIMEOUT_TYPES ; ++i)
Greg Kroah-Hartman
maintainerPATCH 131/156 io_uring/rw: fix downgraded mshot read
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit 38fc96a58ce40257aec79b32e9b310c86907c63c upstream.
The io-wq path can downgrade a multishot request to oneshot mode, however io_read_mshot() doesn't handle that and would still post multiple CQEs. That's not allowed, because io_req_post_cqe() requires stricter context requirements.
The described can only happen with pollable files that don't support FMODE_NOWAIT, which is an odd combination, so if even allowed it should be fairly rare.
--- io_uring/rw.c | 2 ++ 1 file changed, 2 insertions(+)
io_uring/rw.c +2 -0
@@ -979,6 +979,8 @@ int io_read_mshot(struct io_kiocb *req,io_kbuf_recycle (req, issue_flags);if (ret <0 )req_set_fail (req); + }else if (!(req->flags &REQ_F_APOLL_MULTISHOT )) { + cflags =io_put_kbuf (req, ret, issue_flags); }else {/* * Any successful return value will keep the multishot read
Greg Kroah-Hartman
maintainerPATCH 132/156 drm: adv7511: Drop dsi single lane support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit 79d67c499c3f886202a40c5cb27e747e4fa4d738 upstream.
As per [1] and [2], ADV7535/7533 supports only 2-, 3-, or 4-lane. Drop unsupported 1-lane.
[1] https://www.analog.com/media/en/technical-documentation/data-sheets/ADV7535.pdf
[2] https://www.analog.com/media/en/technical-documentation/data-sheets/ADV7533.pdf
--- drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/bridge/adv7511/adv7533.c +1 -1
@@ -172,7 +172,7 @@ int adv7533_parse_dt(struct device_nodeof_property_read_u32 (np,"adi,dsi-lanes" , &num_lanes); -if (num_lanes <1 || num_lanes >4 ) +if (num_lanes <2 || num_lanes >4 )return -EINVAL ; adv->num_dsi_lanes = num_lanes;
Greg Kroah-Hartman
maintainerPATCH 133/156 dt-bindings: display: adi,adv7533: Drop single lane support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit ee8f9ed57a397605434caeef351bafa3ec4dfdd4 upstream.
As per [1] and [2], ADV7535/7533 supports only 2-, 3-, or 4-lane. Drop unsupported 1-lane from bindings.
[1] https://www.analog.com/media/en/technical-documentation/data-sheets/ADV7535.pdf
[2] https://www.analog.com/media/en/technical-documentation/data-sheets/ADV7533.pdf
--- Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml +1 -1
@@ -90,7 +90,7 @@ properties: adi,dsi-lanes: description: Number of DSI data lanes connected to the DSI host. $ref: /schemas/types.yaml#/definitions/uint32 - enum: [ 1, 2, 3, 4 ] + enum: [ 2, 3, 4 ] "#sound-dai-cells": const: 0
Greg Kroah-Hartman
maintainerPATCH 134/156 drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 upstream.
The host_node pointer was assigned and freed in adv7533_parse_dt(), and later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put() in error path of probe() and also in the remove().
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 10 ++++++++-- drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 -- 2 files changed, 8 insertions(+), 4 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +8 -2
@@ -1241,8 +1241,10 @@ static int adv7511_probe(struct i2c_cliereturn ret; ret =adv7511_init_regulators (adv7511); -if (ret) -return dev_err_probe (dev, ret,"failed to init regulators\n" ); +if (ret) { +dev_err_probe (dev, ret,"failed to init regulators\n" ); + goto err_of_node_put; + }/* * The power down GPIO is optional. If present, toggle it from active to
@@ -1363,6 +1365,8 @@ err_i2c_unregister_edid:i2c_unregister_device (adv7511->i2c_edid); uninit_regulators:adv7511_uninit_regulators (adv7511); +err_of_node_put: +of_node_put (adv7511->host_node);return ret; }
@@ -1371,6 +1375,8 @@ static void adv7511_remove(struct i2c_cl {struct adv7511 *adv7511 =i2c_get_clientdata (i2c); +of_node_put (adv7511->host_node); +adv7511_uninit_regulators (adv7511);drm_bridge_remove (&adv7511->bridge);
drivers/gpu/drm/bridge/adv7511/adv7533.c +0 -2
@@ -181,8 +181,6 @@ int adv7533_parse_dt(struct device_nodeif (!adv->host_node)return -ENODEV ; -of_node_put (adv->host_node); - adv->use_timing_gen = !of_property_read_bool (np,"adi,disable-timing-generator" );
Greg Kroah-Hartman
maintainerPATCH 135/156 wifi: iwlwifi: mvm: Fix __counted_by usage in cfg80211_wowlan_nd_*
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit cc0c53f4fac562efb3aca2bc493515e77642ae33 upstream.
Both struct cfg80211_wowlan_nd_match and struct cfg80211_wowlan_nd_info pre-allocate space for channels and matches, but then may end up using fewer that the full allocation. Shrink the associated counter (n_channels and n_matches) after counting the results. This avoids compile-time (and run-time) warnings from __counted_by. (The counter member needs to be updated _before_ accessing the array index.)
Seen with coming GCC 15:
drivers/net/wireless/intel/iwlwifi/mvm/d3.c: In function 'iwl_mvm_query_set_freqs':drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2877:66: warning: operation on 'match->n_channels' may be undefined [-Wsequence-point]
2877 | match->channels[match->n_channels++] =
| ~~~~~~~~~~~~~~~~~^~
drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2885:66: warning: operation on 'match->n_channels' may be undefined [-Wsequence-point]
2885 | match->channels[match->n_channels++] =
| ~~~~~~~~~~~~~~~~~^~
drivers/net/wireless/intel/iwlwifi/mvm/d3.c: In function 'iwl_mvm_query_netdetect_reasons':
drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2982:58: warning: operation on 'net_detect->n_matches' may be undefined [-Wsequence-point]
2982 | net_detect->matches[net_detect->n_matches++] = match;
| ~~~~~~~~~~~~~~~~~~~~~^~--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +11 -3
@@ -2871,6 +2871,7 @@ static void iwl_mvm_query_set_freqs(stru int idx) {int i; +int n_channels =0 ;if (fw_has_api (&mvm->fw->ucode_capa,IWL_UCODE_TLV_API_SCAN_OFFLOAD_CHANS )) {
@@ -2879,7 +2880,7 @@ static void iwl_mvm_query_set_freqs(strufor (i =0 ; i <SCAN_OFFLOAD_MATCHING_CHANNELS_LEN *8 ; i++)if (matches[idx].matching_channels[i /8 ] & (BIT (i %8 ))) - match->channels[match->n_channels++] = + match->channels[n_channels++] = mvm->nd_channels[i]->center_freq; }else { struct iwl_scan_offload_profile_match_v1 *matches =
@@ -2887,9 +2888,11 @@ static void iwl_mvm_query_set_freqs(strufor (i =0 ; i <SCAN_OFFLOAD_MATCHING_CHANNELS_LEN_V1 *8 ; i++)if (matches[idx].matching_channels[i /8 ] & (BIT (i %8 ))) - match->channels[match->n_channels++] = + match->channels[n_channels++] = mvm->nd_channels[i]->center_freq; } +/* We may have ended up with fewer channels than we allocated. */ + match->n_channels = n_channels; }/**
@@ -2970,6 +2973,8 @@ static void iwl_mvm_query_netdetect_reas GFP_KERNEL);if (!net_detect || !n_matches) goto out_report_nd; + net_detect->n_matches = n_matches; + n_matches =0 ;for_each_set_bit (i, &matched_profiles, mvm->n_nd_match_sets) {struct cfg80211_wowlan_nd_match *match;
@@ -2983,8 +2988,9 @@ static void iwl_mvm_query_netdetect_reas GFP_KERNEL);if (!match) goto out_report_nd; + match->n_channels = n_channels; - net_detect->matches[net_detect->n_matches++] = match; + net_detect->matches[n_matches++] = match;/* We inverted the order of the SSIDs in the scan * request, so invert the index here.
@@ -2999,6 +3005,8 @@ static void iwl_mvm_query_netdetect_reasiwl_mvm_query_set_freqs (mvm, d3_data->nd_results, match, i); } +/* We may have fewer matches than we allocated. */ + net_detect->n_matches = n_matches; out_report_nd: wakeup.net_detect = net_detect;
Greg Kroah-Hartman
maintainerPATCH 136/156 fgraph: Add READ_ONCE() when accessing fgraph_array[]
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
commit d65474033740ded0a4fe9a097fce72328655b41d upstream.
In __ftrace_return_to_handler(), a loop iterates over the fgraph_array[] elements, which are fgraph_ops. The loop checks if an element is a fgraph_stub to prevent using a fgraph_stub afterward.
However, if the compiler reloads fgraph_array[] after this check, it might race with an update to fgraph_array[] that introduces a fgraph_stub. This could result in the stub being processed, but the stub contains a null "func_hash" field, leading to a NULL pointer dereference.
To ensure that the gops compared against the fgraph_stub matches the gops processed later, add a READ_ONCE(). A similar patch appears in commit 63a8dfb ("function_graph: Add READ_ONCE() when accessing fgraph_array[]").
--- kernel/trace/fgraph.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/fgraph.c +1 -1
@@ -802,7 +802,7 @@ static unsigned long __ftrace_return_to_#endif {for_each_set_bit (i, &bitmap,sizeof (bitmap) *BITS_PER_BYTE ) { -struct fgraph_ops *gops = fgraph_array[i]; +struct fgraph_ops *gops =READ_ONCE (fgraph_array[i]);if (gops == &fgraph_stub)continue ;
Greg Kroah-Hartman
maintainerPATCH 137/156 net: ethernet: ti: am65-cpsw: default to round-robin for host port receive
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
commit 4a4d38ace1fb0586bffd2aab03caaa05d6011748 upstream.
The Host Port (i.e. CPU facing port) of CPSW receives traffic from Linux via TX DMA Channels which are Hardware Queues consisting of traffic categorized according to their priority. The Host Port is configured to dequeue traffic from these Hardware Queues on the basis of priority i.e. as long as traffic exists on a Hardware Queue of a higher priority, the traffic on Hardware Queues of lower priority isn't dequeued. An alternate operation is also supported wherein traffic can be dequeued by the Host Port in a Round-Robin manner.
Until commit under Fixes, the am65-cpsw driver enabled a single TX DMA Channel, due to which, unless modified by user via "ethtool", all traffic from Linux is transmitted on DMA Channel 0. Therefore, configuring the Host Port for priority based dequeuing or Round-Robin operation is identical since there is a single DMA Channel.
Since commit under Fixes, all 8 TX DMA Channels are enabled by default. Additionally, the default "tc mapping" doesn't take into account the possibility of different traffic profiles which various users might have. This results in traffic starvation at the Host Port due to the priority based dequeuing which has been enabled by default since the inception of the driver. The traffic starvation triggers NETDEV WATCHDOG timeout for all TX DMA Channels that haven't been serviced due to the presence of traffic on the higher priority TX DMA Channels.
Fix this by defaulting to Round-Robin dequeuing at the Host Port, which shall ensure that traffic is dequeued from all TX DMA Channels irrespective of the traffic profile. This will address the NETDEV WATCHDOG timeouts. At the same time, users can still switch from Round-Robin to Priority based dequeuing at the Host Port with the help of the "p0-rx-ptype-rrobin" private flag of "ethtool". Users are expected to setup an appropriate "tc mapping" that suits their traffic profile when switching to priority based dequeuing at the Host Port.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +1 -1
@@ -3525,7 +3525,7 @@ static int am65_cpsw_nuss_probe(struct pinit_completion (&common->tdown_complete); common->tx_ch_num =AM65_CPSW_DEFAULT_TX_CHNS ; common->rx_ch_num_flows =AM65_CPSW_DEFAULT_RX_CHN_FLOWS ; - common->pf_p0_rx_ptype_rrobin = false; + common->pf_p0_rx_ptype_rrobin = true; common->default_vlan =1 ; common->ports = devm_kcalloc(dev, common->port_num,
Greg Kroah-Hartman
maintainerPATCH 138/156 mm/damon/core: fix ignored quota goals and filters of newly committed schemes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 7d390b53067ef745e2d9bee5a9683df4c96b80a0 upstream.
damon_commit_schemes() ignores quota goals and filters of the newly committed schemes. This makes users confused about the behaviors. Correctly handle those inputs.
--- mm/damon/core.c | 5 +++++ 1 file changed, 5 insertions(+)
mm/damon/core.c +5 -0
@@ -868,6 +868,11 @@ static int damon_commit_schemes(struct damon_ctx *dst, struct damon_ctx *src) NUMA_NO_NODE);if (!new_scheme)return -ENOMEM ; + err =damos_commit (new_scheme, src_scheme); +if (err) { +damon_destroy_scheme (new_scheme); +return err; + }damon_add_scheme (dst, new_scheme); }return 0 ;
Signature · 1 line
2.47.1
Greg Kroah-Hartman
maintainerPATCH 139/156 mm/damon/core: fix new damon_target objects leaks on damon_commit_targets()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 8debfc5b1aa569d3d2ac836af2553da037611c61 upstream.
Patch series "mm/damon/core: fix memory leaks and ignored inputs from damon_commit_ctx()".
Due to two bugs in damon_commit_targets() and damon_commit_schemes(), which are called from damon_commit_ctx(), some user inputs can be ignored, and some mmeory objects can be leaked. Fix those.
Note that only DAMON sysfs interface users are affected. Other DAMON core API user modules that more focused more on simple and dedicated production usages, including DAMON_RECLAIM and DAMON_LRU_SORT are not using the buggy function in the way, so not affected.
This patch (of 2):
When new DAMON targets are added via damon_commit_targets(), the newly created targets are not deallocated when updating the internal data (damon_commit_target()) is failed. Worse yet, even if the setup is successfully done, the new target is not linked to the context. Hence, the new targets are always leaked regardless of the internal data setup failure. Fix the leaks.
--- mm/damon/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
mm/damon/core.c +4 -1
@@ -966,8 +966,11 @@ static int damon_commit_targets(return -ENOMEM ; err =damon_commit_target (new_target, false, src_target,damon_target_has_pid (src)); -if (err) +if (err) { +damon_destroy_target (new_target);return err; + } +damon_add_target (dst, new_target); }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 140/156 mm: shmem: fix the update of shmem_falloc->nr_unswapped
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Wang <[email protected]>
commit d77b90d2b2642655b5f60953c36ad887257e1802 upstream.
The 'shmem_falloc->nr_unswapped' is used to record how many writepage refused to swap out because fallocate() is allocating, but after shmem supports large folio swap out, the update of 'shmem_falloc->nr_unswapped' does not use the correct number of pages in the large folio, which may lead to fallocate() not exiting as soon as possible.
Anyway, this is found through code inspection, and I am not sure whether it would actually cause serious issues.
--- mm/shmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/shmem.c +1 -1
@@ -1527,7 +1527,7 @@ try_split: !shmem_falloc->waitq && index >= shmem_falloc->start && index < shmem_falloc->next) - shmem_falloc->nr_unswapped++; + shmem_falloc->nr_unswapped += nr_pages; else shmem_falloc =NULL ;spin_unlock (&inode->i_lock);
Greg Kroah-Hartman
maintainerPATCH 141/156 mm: shmem: fix incorrect index alignment for within_size policy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Wang <[email protected]>
commit d0e6983a6d1719738cf8d13982a68094f0a1872a upstream.
With enabling the shmem per-size within_size policy, using an incorrect 'order' size to round_up() the index can lead to incorrect i_size checks, resulting in an inappropriate large orders being returned.
Changing to use '1 << order' to round_up() the index to fix this issue. Additionally, adding an 'aligned_index' variable to avoid affecting the index checks.
--- mm/shmem.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
mm/shmem.c +3 -2
@@ -1664,6 +1664,7 @@ unsigned long shmem_allowable_huge_orderunsigned long mask =READ_ONCE (huge_shmem_orders_always);unsigned long within_size_orders =READ_ONCE (huge_shmem_orders_within_size);unsigned long vm_flags = vma ? vma->vm_flags :0 ; +pgoff_t aligned_index;bool global_huge;loff_t i_size;int order;
@@ -1698,9 +1699,9 @@ unsigned long shmem_allowable_huge_order/* Allow mTHP that will be fully within i_size. */ order =highest_order (within_size_orders);while (within_size_orders) { - index =round_up (index +1 , order); + aligned_index =round_up (index +1 ,1 << order); i_size =round_up (i_size_read (inode),PAGE_SIZE ); -if (i_size >>PAGE_SHIFT >= index) { +if (i_size >>PAGE_SHIFT >= aligned_index) { mask |= within_size_orders;break ; }
Greg Kroah-Hartman
maintainerPATCH 142/156 fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
commit 3754137d263f52f4b507cf9ae913f8f0497d1b0e upstream.
Entries (including flags) are u64, even on 32bit. So right now we are cutting of the flags on 32bit. This way, for example the cow selftest complains about:
# ./cow ... Bail Out! read and ioctl return unmatched results for populated: 0 1
--- fs/proc/task_mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/proc/task_mmu.c +1 -1
@@ -1810,7 +1810,7 @@ static int pagemap_pmd_range(pmd_t *pmdp }for (; addr != end; addr +=PAGE_SIZE , idx++) { -unsigned long cur_flags = flags; +u64 cur_flags = flags;pagemap_entry_t pme; if (folio && (flags & PM_PRESENT) &&
Greg Kroah-Hartman
maintainerPATCH 143/156 gve: process XSK TX descriptors as part of RX NAPI
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Washington <[email protected]>
commit ba0925c34e0fa6fe02d3d642bc02ab099ab312c7 upstream.
When busy polling is enabled, xsk_sendmsg for AF_XDP zero copy marks the NAPI ID corresponding to the memory pool allocated for the socket. In GVE, this NAPI ID will never correspond to a NAPI ID of one of the dedicated XDP TX queues registered with the umem because XDP TX is not set up to share a NAPI with a corresponding RX queue.
This patch moves XSK TX descriptor processing from the TX NAPI to the RX NAPI, and the gve_xsk_wakeup callback is updated to use the RX NAPI instead of the TX NAPI, accordingly. The branch on if the wakeup is for TX is removed, as the NAPI poll should be invoked whether the wakeup is for TX or for RX.
--- drivers/net/ethernet/google/gve/gve.h | 1 drivers/net/ethernet/google/gve/gve_main.c | 8 ++++++ drivers/net/ethernet/google/gve/gve_tx.c | 36 +++++++++++++++++------------ 3 files changed, 31 insertions(+), 14 deletions(-)
drivers/net/ethernet/google/gve/gve.h +1 -0
@@ -1134,6 +1134,7 @@ int gve_xdp_xmit_one(struct gve_priv *prvoid gve_xdp_tx_flush (struct gve_priv *priv,u32 xdp_qid);bool gve_tx_poll (struct gve_notify_block *block,int budget);bool gve_xdp_poll (struct gve_notify_block *block,int budget); +int gve_xsk_tx_poll (struct gve_notify_block *block,int budget);int gve_tx_alloc_rings_gqi (struct gve_priv *priv,struct gve_tx_alloc_rings_cfg *cfg); void gve_tx_free_rings_gqi(struct gve_priv *priv,
drivers/net/ethernet/google/gve/gve_main.c +8 -0
@@ -333,6 +333,14 @@ int gve_napi_poll(struct napi_struct *naif (block->rx) { work_done =gve_rx_poll (block, budget); + +/* Poll XSK TX as part of RX NAPI. Setup re-poll based on max of +* TX and RX work done. +*/ +if (priv->xdp_prog) + work_done =max_t (int, work_done, +gve_xsk_tx_poll (block, budget)); + reschedule |= work_done == budget; }
drivers/net/ethernet/google/gve/gve_tx.c +22 -14
@@ -975,33 +975,41 @@ out:return sent; } +int gve_xsk_tx_poll (struct gve_notify_block *rx_block,int budget) +{ +struct gve_rx_ring *rx = rx_block->rx; +struct gve_priv *priv = rx->gve; +struct gve_tx_ring *tx; +int sent =0 ; + + tx = &priv->tx[gve_xdp_tx_queue_id (priv, rx->q_num)]; +if (tx->xsk_pool) { + sent =gve_xsk_tx (priv, tx, budget); + +u64_stats_update_begin (&tx->statss); + tx->xdp_xsk_sent += sent; +u64_stats_update_end (&tx->statss); +if (xsk_uses_need_wakeup (tx->xsk_pool)) +xsk_set_tx_need_wakeup (tx->xsk_pool); + } + +return sent; +} +bool gve_xdp_poll (struct gve_notify_block *block,int budget) {struct gve_priv *priv = block->priv;struct gve_tx_ring *tx = block->tx;u32 nic_done; -bool repoll;u32 to_do;/* Find out how much work there is to be done */ nic_done =gve_tx_load_event_counter (priv, tx); to_do =min_t (u32, (nic_done - tx->done), budget);gve_clean_xdp_done (priv, tx, to_do); - repoll = nic_done != tx->done; - -if (tx->xsk_pool) { -int sent =gve_xsk_tx (priv, tx, budget); - -u64_stats_update_begin (&tx->statss); - tx->xdp_xsk_sent += sent; -u64_stats_update_end (&tx->statss); - repoll |= (sent == budget); -if (xsk_uses_need_wakeup (tx->xsk_pool)) -xsk_set_tx_need_wakeup (tx->xsk_pool); - }/* If we still have work we want to repoll */ -return repoll; +return nic_done != tx->done; }bool gve_tx_poll (struct gve_notify_block *block,int budget)
Greg Kroah-Hartman
maintainerPATCH 144/156 gve: clean XDP queues in gve_tx_stop_ring_gqi
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Washington <[email protected]>
commit 6321f5fb70d502d95de8a212a7b484c297ec9644 upstream.
When stopping XDP TX rings, the XDP clean function needs to be called to clean out the entire queue, similar to what happens in the normal TX queue case. Otherwise, the FIFO won't be cleared correctly, and xsk_tx_completed won't be reported.
--- drivers/net/ethernet/google/gve/gve_tx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/google/gve/gve_tx.c +4 -1
@@ -206,7 +206,10 @@ void gve_tx_stop_ring_gqi(struct gve_prireturn ;gve_remove_napi (priv, ntfy_idx); -gve_clean_tx_done (priv, tx, priv->tx_desc_cnt, false); +if (tx->q_num < priv->tx_cfg.num_queues) +gve_clean_tx_done (priv, tx, priv->tx_desc_cnt, false); +else +gve_clean_xdp_done (priv, tx, priv->tx_desc_cnt);netdev_tx_reset_queue (tx->netdev_txq);gve_tx_remove_from_block (priv, idx); }
Greg Kroah-Hartman
maintainerPATCH 145/156 gve: guard XSK operations on the existence of queues
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Washington <[email protected]>
commit 40338d7987d810fcaa95c500b1068a52b08eec9b upstream.
This patch predicates the enabling and disabling of XSK pools on the existence of queues. As it stands, if the interface is down, disabling or enabling XSK pools would result in a crash, as the RX queue pointer would be NULL. XSK pool registration will occur as part of the next interface up.
Similarly, xsk_wakeup needs be guarded against queues disappearing while the function is executing, so a check against the GVE_PRIV_FLAGS_NAPI_ENABLED flag is added to synchronize with the disabling of the bit and the synchronize_net() in gve_turndown.
--- drivers/net/ethernet/google/gve/gve_main.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-)
drivers/net/ethernet/google/gve/gve_main.c +10 -12
@@ -1631,8 +1631,8 @@ static int gve_xsk_pool_enable(struct neif (err)return err; -/* If XDP prog is not installed, return */ -if (!priv->xdp_prog) +/* If XDP prog is not installed or interface is down, return. */ +if (!priv->xdp_prog || !netif_running (dev))return 0 ; rx = &priv->rx[qid];
@@ -1677,21 +1677,16 @@ static int gve_xsk_pool_disable(struct nif (qid >= priv->rx_cfg.num_queues)return -EINVAL ; -/* If XDP prog is not installed, unmap DMA and return */ -if (!priv->xdp_prog) +/* If XDP prog is not installed or interface is down, unmap DMA and +* return. +*/ +if (!priv->xdp_prog || !netif_running (dev)) goto done; - tx_qid =gve_xdp_tx_queue_id (priv, qid); -if (!netif_running (dev)) { - priv->rx[qid].xsk_pool =NULL ; -xdp_rxq_info_unreg (&priv->rx[qid].xsk_rxq); - priv->tx[tx_qid].xsk_pool =NULL ; - goto done; - } - napi_rx = &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi;napi_disable (napi_rx);/* make sure current rx poll is done */ + tx_qid =gve_xdp_tx_queue_id (priv, qid); napi_tx = &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi;napi_disable (napi_tx);/* make sure current tx poll is done */
@@ -1719,6 +1714,9 @@ static int gve_xsk_wakeup(struct net_devstruct gve_priv *priv =netdev_priv (dev);int tx_queue_id =gve_xdp_tx_queue_id (priv, queue_id); +if (!gve_get_napi_enabled (priv)) +return -ENETDOWN ; +if (queue_id >= priv->rx_cfg.num_queues || !priv->xdp_prog)return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 146/156 gve: fix XDP allocation path in edge cases
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Washington <[email protected]>
commit de63ac44a527b2c5067551dbd70d939fe151325a upstream.
This patch fixes a number of consistency issues in the queue allocation path related to XDP.
As it stands, the number of allocated XDP queues changes in three different scenarios.
1) Adding an XDP program while the interface is up via gve_add_xdp_queues
2) Removing an XDP program while the interface is up via gve_remove_xdp_queues
3) After queues have been allocated and the old queue memory has been removed in gve_queues_start.
However, the requirement for the interface to be up for gve_(add|remove)_xdp_queues to be called, in conjunction with the fact that the number of queues stored in priv isn't updated until _after_ XDP queues have been allocated in the normal queue allocation path means that if an XDP program is added while the interface is down, XDP queues won't be added until the _second_ if_up, not the first.
Given the expectation that the number of XDP queues is equal to the number of RX queues, scenario (3) has another problematic implication. When changing the number of queues while an XDP program is loaded, the number of XDP queues must be updated as well, as there is logic in the driver (gve_xdp_tx_queue_id()) which relies on every RX queue having a corresponding XDP TX queue. However, the number of XDP queues stored in priv would not be updated until _after_ a close/open leading to a mismatch in the number of XDP queues reported vs the number of XDP queues which actually exist after the queue count update completes.
This patch remedies these issues by doing the following:
1) The allocation config getter function is set up to retrieve the _expected_ number of XDP queues to allocate instead of relying on the value stored in priv which is only updated once the queues have been allocated.
2) When adjusting queues, XDP queues are adjusted to match the number of RX queues when XDP is enabled. This only works in the case when queues are live, so part (1) of the fix must still be available in the case that queues are adjusted when there is an XDP program and the interface is down.
--- drivers/net/ethernet/google/gve/gve_main.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/google/gve/gve_main.c +8 -1
@@ -930,11 +930,13 @@ static void gve_init_sync_stats(struct gstatic void gve_tx_get_curr_alloc_cfg (struct gve_priv *priv,struct gve_tx_alloc_rings_cfg *cfg) { +int num_xdp_queues = priv->xdp_prog ? priv->rx_cfg.num_queues :0 ; + cfg->qcfg = &priv->tx_cfg; cfg->raw_addressing = !gve_is_qpl (priv); cfg->ring_size = priv->tx_desc_cnt; cfg->start_idx =0 ; - cfg->num_rings =gve_num_tx_queues (priv); + cfg->num_rings = priv->tx_cfg.num_queues + num_xdp_queues; cfg->tx = priv->tx; }
@@ -1843,6 +1845,7 @@ int gve_adjust_queues(struct gve_priv *p {struct gve_tx_alloc_rings_cfg tx_alloc_cfg = {0 };struct gve_rx_alloc_rings_cfg rx_alloc_cfg = {0 }; +int num_xdp_queues;int err;gve_get_curr_alloc_cfgs (priv, &tx_alloc_cfg, &rx_alloc_cfg);
@@ -1853,6 +1856,10 @@ int gve_adjust_queues(struct gve_priv *p rx_alloc_cfg.qcfg = &new_rx_config; tx_alloc_cfg.num_rings = new_tx_config.num_queues; +/* Add dedicated XDP TX queues if enabled. */ + num_xdp_queues = priv->xdp_prog ? new_rx_config.num_queues :0 ; + tx_alloc_cfg.num_rings += num_xdp_queues; +if (netif_running (priv->dev)) { err =gve_adjust_config (priv, &tx_alloc_cfg, &rx_alloc_cfg);return err;
Greg Kroah-Hartman
maintainerPATCH 147/156 gve: guard XDP xmit NDO on existence of xdp queues
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Washington <[email protected]>
commit ff7c2dea9dd1a436fc79d6273adffdcc4a7ffea3 upstream.
In GVE, dedicated XDP queues only exist when an XDP program is installed and the interface is up. As such, the NDO XDP XMIT callback should return early if either of these conditions are false.
In the case of no loaded XDP program, priv->num_xdp_queues=0 which can cause a divide-by-zero error, and in the case of interface down, num_xdp_queues remains untouched to persist XDP queue count for the next interface up, but the TX pointer itself would be NULL.
The XDP xmit callback also needs to synchronize with a device transitioning from open to close. This synchronization will happen via the GVE_PRIV_FLAGS_NAPI_ENABLED bit along with a synchronize_net() call, which waits for any RCU critical sections at call-time to complete.
--- drivers/net/ethernet/google/gve/gve_main.c | 3 +++ drivers/net/ethernet/google/gve/gve_tx.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/google/gve/gve_main.c +3 -0
@@ -1904,6 +1904,9 @@ static void gve_turndown(struct gve_privgve_clear_napi_enabled (priv);gve_clear_report_stats (priv); + +/* Make sure that all traffic is finished processing. */ +synchronize_net (); }static void gve_turnup (struct gve_priv *priv)
drivers/net/ethernet/google/gve/gve_tx.c +4 -1
@@ -837,9 +837,12 @@ int gve_xdp_xmit(struct net_device *dev,struct gve_tx_ring *tx;int i, err =0 , qid; -if (unlikely (flags & ~XDP_XMIT_FLAGS_MASK )) +if (unlikely (flags & ~XDP_XMIT_FLAGS_MASK ) || !priv->xdp_prog)return -EINVAL ; +if (!gve_get_napi_enabled (priv)) +return -ENETDOWN ; + qid =gve_xdp_tx_queue_id (priv,smp_processor_id () % priv->num_xdp_queues);
Greg Kroah-Hartman
maintainerPATCH 148/156 gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Washington <[email protected]>
commit fb3a9a1165cea104b5ab3753e88218e4497b01c1 upstream.
Commit ba0925c34e0f ("gve: process XSK TX descriptors as part of RX NAPI") moved XSK TX processing to be part of the RX NAPI. However, that commit did not include triggering the RX NAPI in gve_xsk_wakeup. This is necessary because the TX NAPI only processes TX completions, meaning that a TX wakeup would not actually trigger XSK descriptor processing. Also, the branch on XDP_WAKEUP_TX was supposed to have been removed, as the NAPI should be scheduled whether the wakeup is for RX or TX.
--- drivers/net/ethernet/google/gve/gve_main.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)
drivers/net/ethernet/google/gve/gve_main.c +7 -14
@@ -1714,7 +1714,7 @@ done:static int gve_xsk_wakeup (struct net_device *dev,u32 queue_id,u32 flags) {struct gve_priv *priv =netdev_priv (dev); -int tx_queue_id =gve_xdp_tx_queue_id (priv, queue_id); +struct napi_struct *napi;if (!gve_get_napi_enabled (priv))return -ENETDOWN ;
@@ -1722,19 +1722,12 @@ static int gve_xsk_wakeup(struct net_devif (queue_id >= priv->rx_cfg.num_queues || !priv->xdp_prog)return -EINVAL ; -if (flags &XDP_WAKEUP_TX ) { -struct gve_tx_ring *tx = &priv->tx[tx_queue_id]; -struct napi_struct *napi = - &priv->ntfy_blocks[tx->ntfy_id].napi; - -if (!napi_if_scheduled_mark_missed (napi)) { -/* Call local_bh_enable to trigger SoftIRQ processing */ -local_bh_disable (); -napi_schedule (napi); -local_bh_enable (); - } - - tx->xdp_xsk_wakeup++; + napi = &priv->ntfy_blocks[gve_rx_idx_to_ntfy (priv, queue_id)].napi; +if (!napi_if_scheduled_mark_missed (napi)) { +/* Call local_bh_enable to trigger SoftIRQ processing */ +local_bh_disable (); +napi_schedule (napi); +local_bh_enable (); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 149/156 mm/readahead: fix large folio support in async readahead
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
commit 158cdce87c8c172787063998ad5dd3e2f658b963 upstream.
When testing large folio support with XFS on our servers, we observed that only a few large folios are mapped when reading large files via mmap. After a thorough analysis, I identified it was caused by the /sys/block/*/queue/read_ahead_kb setting. On our test servers, this parameter is set to 128KB. After I tune it to 2MB, the large folio can work as expected. However, I believe the large folio behavior should not be dependent on the value of read_ahead_kb. It would be more robust if the kernel can automatically adopt to it.
With /sys/block/*/queue/read_ahead_kb set to 128KB and performing a sequential read on a 1GB file using MADV_HUGEPAGE, the differences in /proc/meminfo are as follows:
- before this patch
FileHugePages: 18432 kB
FilePmdMapped: 4096 kB
- after this patch
FileHugePages: 1067008 kB
FilePmdMapped: 1048576 kB
This shows that after applying the patch, the entire 1GB file is mapped to huge pages. The stable list is CCed, as without this patch, large folios don't function optimally in the readahead path.
It's worth noting that if read_ahead_kb is set to a larger value that isn't aligned with huge page sizes (e.g., 4MB + 128KB), it may still fail to map to hugepages.
--- mm/readahead.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
mm/readahead.c +5 -1
@@ -641,7 +641,11 @@ void page_cache_async_ra(struct readahea 1UL << order);if (index == expected) { ra->start += ra->size; - ra->size =get_next_ra_size (ra, max_pages); +/* +* In the case of MADV_HUGEPAGE, the actual size might exceed +* the readahead window. +*/ + ra->size =max (ra->size,get_next_ra_size (ra, max_pages)); ra->async_size = ra->size; goto readit; }