6.1.125-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.1.125-rc1 review
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 17 Jan 2025 10:34:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.125-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.125-rc1
Biju Das <[email protected]>
drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
Ahmad Fatoum <[email protected]>
drm: bridge: adv7511: use dev_err_probe in probe function
Dennis Lam <[email protected]>
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
Joseph Qi <[email protected]>
ocfs2: correct return value of ocfs2_local_free_info()
Andrea della Porta <[email protected]>
of: address: Preserve the flags portion on 1:1 dma-ranges mapping
Rob Herring <[email protected]>
of: address: Store number of bus flag cells rather than bool
Herve Codina <[email protected]>
of: address: Remove duplicated functions
Herve Codina <[email protected]>
of: address: Fix address translation when address-size is greater than 2
Rob Herring <[email protected]>
of/address: Add support for 3 address cell bus
Rob Herring <[email protected]>
of: unittest: Add bus address range parsing tests
Peter Geis <[email protected]>
arm64: dts: rockchip: add hevc power domain clock to rk3328
Yu Kuai <[email protected]>
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
Jesse Taube <[email protected]>
ARM: dts: imxrt1050: Fix clocks for mmc
Jens Axboe <[email protected]>
io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
Uwe Kleine-König <[email protected]>
iio: adc: ad7124: Disable all channels at probe time
Joe Hattori <[email protected]>
iio: inkern: call iio_device_put() only on mapped devices
Joe Hattori <[email protected]>
iio: adc: at91: call input_free_device() on allocated iio_dev
Fabio Estevam <[email protected]>
iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
Carlos Song <[email protected]>
iio: gyro: fxas21002c: Fix missing data update in trigger handler
Javier Carrasco <[email protected]>
iio: adc: ti-ads8688: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: imu: kmx61: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: light: vcnl4035: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: pressure: zpa2326: fix information leak in triggered buffer
Akash M <[email protected]>
usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
Prashanth K <[email protected]>
usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
Ma Ke <[email protected]>
usb: fix reference leak in usb_new_device()
Kai-Heng Feng <[email protected]>
USB: core: Disable LPM only for non-suspended ports
Jun Yan <[email protected]>
USB: usblp: return error when setting unsupported protocol
Prashanth K <[email protected]>
usb: dwc3-am62: Disable autosuspend during remove
Lianqin Hu <[email protected]>
usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
Rengarajan S <[email protected]>
misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
Rengarajan S <[email protected]>
misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
Li Huafei <[email protected]>
topology: Keep the cpumask unchanged when printing cpumap
André Draszik <[email protected]>
usb: dwc3: gadget: fix writing NYET threshold
Johan Hovold <[email protected]>
USB: serial: cp210x: add Phoenix Contact UPS Device
Lubomir Rintel <[email protected]>
usb-storage: Add max sectors quirk for Nokia 208
Zicheng Qu <[email protected]>
staging: iio: ad9832: Correct phase range check
Zicheng Qu <[email protected]>
staging: iio: ad9834: Correct phase range check
Michal Hrusecky <[email protected]>
USB: serial: option: add Neoway N723-EA support
Chukun Pan <[email protected]>
USB: serial: option: add MeiG Smart SRM815
Daniel Borkmann <[email protected]>
bpf: Fix overloading of MEM_UNINIT's meaning
Daniel Borkmann <[email protected]>
bpf: Add MEM_WRITE attribute
Milan Broz <[email protected]>
dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
Melissa Wen <[email protected]>
drm/amd/display: increase MAX_SURFACES to the value supported by hw
Hans de Goede <[email protected]>
ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
Nam Cao <[email protected]>
riscv: Fix sleeping in invalid context in die()
Joe Hattori <[email protected]>
thermal: of: fix OF node leak in of_thermal_zone_find()
Roman Li <[email protected]>
drm/amd/display: Add check for granularity in dml ceil/floor helpers
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: udp_port: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: auth_enable: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: rto_min/max: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
Mikulas Patocka <[email protected]>
dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
Krister Johansen <[email protected]>
dm thin: make get_first_thin use rcu-safe list first function
Javier Carrasco <[email protected]>
cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
He Wang <[email protected]>
ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
David Howells <[email protected]>
afs: Fix the maximum cell name length
Wentao Liang <[email protected]>
ksmbd: fix a missing return value check bug
Liankun Yang <[email protected]>
drm/mediatek: Add return value check when reading DPCD
Liankun Yang <[email protected]>
drm/mediatek: Fix mode valid issue for dp
Liankun Yang <[email protected]>
drm/mediatek: Fix YCbCr422 color format issue for DP
Arnd Bergmann <[email protected]>
drm/mediatek: stop selecting foreign drivers
Chenguang Zhao <[email protected]>
net/mlx5: Fix variable not being completed when function returns
Toke Høiland-Jørgensen <[email protected]>
sched: sch_cake: add bounds checks to host bulk flow fairness counts
Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: clamp maximum hashtable size to INT_MAX
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: imbalance in flowtable binding
Daniel Borkmann <[email protected]>
tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix not setting Random Address when required
Benjamin Coddington <[email protected]>
tls: Fix tls_sw_sendmsg error handling
Przemyslaw Korba <[email protected]>
ice: fix incorrect PHY settings for 100 GB/s
Anumula Murali Mohan Reddy <[email protected]>
cxgb4: Avoid removal of uninserted tid
Kalesh AP <[email protected]>
bnxt_en: Fix possible memory leak when hwrm_req_replace fails
Eric Dumazet <[email protected]>
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
Zhongqiu Duan <[email protected]>
tcp/dccp: allow a connection when sk_max_ack_backlog is zero
Jason Xing <[email protected]>
tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
Antonio Pastor <[email protected]>
net: 802: LLC+SNAP OID:PID lookup on start of skb data
Keisuke Nishimura <[email protected]>
ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
Chen-Yu Tsai <[email protected]>
ASoC: mediatek: disable buffer pre-allocation
Kuan-Wei Chiu <[email protected]>
scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in __exfat_free_cluster()
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in exfat_readdir()
Ming-Hung Tsai <[email protected]>
dm array: fix cursor index when skipping across block boundaries
Ming-Hung Tsai <[email protected]>
dm array: fix unreleased btree blocks on closing a faulty array cursor
Ming-Hung Tsai <[email protected]>
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
Zhang Yi <[email protected]>
jbd2: flush filesystem device before updating tail sequence
Zhang Yi <[email protected]>
jbd2: increase IO priority for writing revoke records
Qun-Wei Lin <[email protected]>
sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
Michal Luczaj <[email protected]>
bpf, sockmap: Fix race between element replace and close()
Max Kellermann <[email protected]>
ceph: give up on paths longer than PATH_MAX
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/imxrt1050.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 + arch/riscv/kernel/traps.c | 6 +- block/bfq-iosched.c | 12 +- drivers/acpi/resource.c | 18 +++ drivers/base/topology.c | 24 +++- drivers/cpuidle/cpuidle-riscv-sbi.c | 4 +- drivers/gpu/drm/amd/display/dc/dc.h | 2 +- .../gpu/drm/amd/display/dc/dml/dml_inline_defs.h | 8 ++ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 8 +- drivers/gpu/drm/bridge/adv7511/adv7533.c | 22 ++-- drivers/gpu/drm/mediatek/Kconfig | 5 - drivers/gpu/drm/mediatek/mtk_dp.c | 46 ++++--- drivers/iio/adc/ad7124.c | 3 + drivers/iio/adc/at91_adc.c | 2 +- drivers/iio/adc/ti-ads124s08.c | 4 +- drivers/iio/adc/ti-ads8688.c | 2 +- drivers/iio/dummy/iio_simple_dummy_buffer.c | 2 +- drivers/iio/gyro/fxas21002c_core.c | 11 +- drivers/iio/imu/kmx61.c | 2 +- drivers/iio/inkern.c | 2 +- drivers/iio/light/vcnl4035.c | 2 +- drivers/iio/pressure/zpa2326.c | 2 + drivers/md/dm-ebs-target.c | 2 +- drivers/md/dm-thin.c | 5 +- drivers/md/dm-verity-fec.c | 39 ++++-- drivers/md/persistent-data/dm-array.c | 19 +-- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 3 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 5 +- drivers/net/ethernet/intel/ice/ice_ptp_consts.h | 4 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 1 + drivers/net/ieee802154/ca8210.c | 6 +- drivers/of/address.c | 76 ++++++++--- drivers/of/unittest-data/tests-address.dtsi | 9 +- drivers/of/unittest.c | 109 ++++++++++++++++ drivers/staging/iio/frequency/ad9832.c | 2 +- drivers/staging/iio/frequency/ad9834.c | 2 +- drivers/thermal/thermal_of.c | 1 + drivers/usb/class/usblp.c | 7 +- drivers/usb/core/hub.c | 6 +- drivers/usb/core/port.c | 7 +- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/dwc3-am62.c | 1 + drivers/usb/dwc3/gadget.c | 4 +- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_uac2.c | 1 + drivers/usb/gadget/function/u_serial.c | 8 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/option.c | 4 +- drivers/usb/storage/unusual_devs.h | 7 ++ fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 +- fs/afs/vlclient.c | 2 +- fs/ceph/mds_client.c | 9 +- fs/exfat/dir.c | 3 +- fs/exfat/fatent.c | 10 ++ fs/jbd2/commit.c | 4 +- fs/jbd2/revoke.c | 2 +- fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/quota_local.c | 10 +- fs/smb/server/smb2pdu.c | 3 + fs/smb/server/vfs.c | 3 +- include/linux/bpf.h | 14 ++- include/linux/sched/task_stack.h | 2 + include/net/inet_connection_sock.h | 2 +- io_uring/io_uring.c | 13 +- kernel/bpf/helpers.c | 10 +- kernel/bpf/ringbuf.c | 2 +- kernel/bpf/syscall.c | 2 +- kernel/bpf/verifier.c | 76 ++++++----- kernel/trace/bpf_trace.c | 4 +- net/802/psnap.c | 4 +- net/bluetooth/hci_sync.c | 11 +- net/core/filter.c | 4 +- net/core/sock_map.c | 6 +- net/ipv4/tcp_ipv4.c | 2 +- net/netfilter/nf_conntrack_core.c | 5 +- net/netfilter/nf_tables_api.c | 15 ++- net/sched/cls_flow.c | 3 +- net/sched/sch_cake.c | 140 +++++++++++---------- net/sctp/sysctl.c | 14 ++- net/tls/tls_sw.c | 2 +- scripts/sorttable.h | 6 +- .../soc/mediatek/common/mtk-afe-platform-driver.c | 4 +- 87 files changed, 624 insertions(+), 306 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/92 ceph: give up on paths longer than PATH_MAX
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
commit 550f7ca98ee028a606aa75705a7e77b1bd11720f upstream.
If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effective DoS vulnerability.
I cannot imagine why this retry was ever implemented, but it seems rather useless and harmful to me. Let's remove it and fail with ENAMETOOLONG instead.
--- fs/ceph/mds_client.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
fs/ceph/mds_client.c +4 -5
@@ -2447,12 +2447,11 @@ retry:if (pos <0 ) {/* -* A rename didn't occur, but somehow we didn't end up where -* we thought we would. Throw a warning and try again. +* The path is longer than PATH_MAX and this function +* cannot ever succeed. Creating paths that long is +* possible with Ceph, but Linux cannot use them. */ -pr_warn ("build_path did not end path lookup where " -"expected, pos is %d\n" , pos); - goto retry; +return ERR_PTR (-ENAMETOOLONG ); } *pbase = base;
Greg Kroah-Hartman
maintainerPATCH 2/92 bpf, sockmap: Fix race between element replace and close()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
commit ed1fc5d76b81a4d681211333c026202cad4d5649 upstream.
Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_delete() unconditionally unrefs the (wrong) element:
// set map[0] = s0map_update_elem(map, 0, s0)
// drop fd of s0
close(s0)
sock_map_close()
lock_sock(sk) (s0!)
sock_map_remove_links(sk)
link = sk_psock_link_pop()
sock_map_unlink(sk, link)
sock_map_delete_from_link
// replace map[0] with s1
map_update_elem(map, 0, s1)
sock_map_update_elem
(s1!) lock_sock(sk)
sock_map_update_common
psock = sk_psock(sk)
spin_lock(&stab->lock)
osk = stab->sks[idx]
sock_map_add_link(..., &stab->sks[idx])
sock_map_unref(osk, &stab->sks[idx])
psock = sk_psock(osk)
sk_psock_put(sk, psock)
if (refcount_dec_and_test(&psock))
sk_psock_drop(sk, psock)
spin_unlock(&stab->lock)
unlock_sock(sk)
__sock_map_delete
spin_lock(&stab->lock)
sk = *psk // s1 replaced s0; sk == s1
if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch
sk = xchg(psk, NULL)
if (sk)
sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle
psock = sk_psock(sk)
sk_psock_put(sk, psock)
if (refcount_dec_and_test())
sk_psock_drop(sk, psock)
spin_unlock(&stab->lock)
release_sock(sk)Then close(map) enqueues bpf_map_free_deferred, which finally calls sock_map_free(). This results in some refcount_t warnings along with a KASAN splat [1].
Fix __sock_map_delete(), do not allow sock_map_unref() on elements that may have been replaced.
[1]:
BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330 Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred Call Trace: <TASK> dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 kasan_check_range+0x10f/0x1e0 sock_map_free+0x10e/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1202: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff88811f5b9080 which belongs to the cache UNIX-STREAM of size 1984
The buggy address is located 128 bytes inside of
freed 1984-byte region [ffff88811f5b9080, ffff88811f5b9840)
The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f5b8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff888127d49401
flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)page_type: f5(slab)
raw: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401
head: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000
head: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401
head: 0017ffffc0000003 ffffea00047d6e01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88811f5b9000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88811f5b9080: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88811f5b9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811f5b9200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fbDisabling lock debugging due to kernel taint
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 14 PID: 1063 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B 6.12.0+ #125 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xce/0x150 Code: 34 73 eb 03 01 e8 82 53 ad fe 0f 0b eb b1 80 3d 27 73 eb 03 00 75 a8 48 c7 c7 80 bd 95 84 c6 05 17 73 eb 03 01 e8 62 53 ad fe <0f> 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xce/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xce/0x150 sock_map_free+0x2e5/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210
refcount_t: underflow; use-after-free.
WARNING: CPU: 14 PID: 1063 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B W 6.12.0+ #125 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xee/0x150 Code: 17 73 eb 03 01 e8 62 53 ad fe 0f 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 f6 72 eb 03 01 e8 42 53 ad fe <0f> 0b e9 6e ff ff ff 80 3d e6 72 eb 03 00 0f 85 61 ff ff ff 48 c7 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xee/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xee/0x150 sock_map_free+0x2d3/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210
--- net/core/sock_map.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/core/sock_map.c +3 -3
@@ -411,15 +411,15 @@ static void *sock_map_lookup_sys(structstatic int __sock_map_delete (struct bpf_stab *stab,struct sock *sk_test,struct sock **psk) { -struct sock *sk; +struct sock *sk =NULL ;int err =0 ;if (irqs_disabled ())return -EOPNOTSUPP ;/* locks here are hardirq-unsafe */ raw_spin_lock_bh (&stab->lock); - sk = *psk; -if (!sk_test || sk_test == sk) + +if (!sk_test || sk_test == *psk) sk =xchg (psk,NULL );if (likely (sk))
Greg Kroah-Hartman
maintainerPATCH 3/92 sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qun-Wei Lin <[email protected]>
commit fd7b4f9f46d46acbc7af3a439bb0d869efdc5c58 upstream.
When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled.
Example of the warning:
ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated.
------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364
sp : ffff800082ea7b40
x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534
x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0
x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418
x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000
x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e
x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e
x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050
Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------
--- include/linux/sched/task_stack.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/sched/task_stack.h +2 -0
@@ -8,6 +8,7 @@#include <linux/sched.h> #include <linux/magic.h> +#include <linux/kasan.h> #ifdef CONFIG_THREAD_INFO_IN_TASK
@@ -88,6 +89,7 @@ static inline int object_is_on_stack(con {void *stack =task_stack_page (current); + obj =kasan_reset_tag (obj);return (obj >= stack) && (obj < (stack +THREAD_SIZE )); }
Greg Kroah-Hartman
maintainerPATCH 4/92 jbd2: increase IO priority for writing revoke records
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit ac1e21bd8c883aeac2f1835fc93b39c1e6838b35 ]
Commit '6a3afb6ac6df ("jbd2: increase the journal IO's priority")' increases the priority of journal I/O by marking I/O with the JBD2_JOURNAL_REQ_FLAGS. However, that commit missed the revoke buffers, so also addresses that kind of I/Os.
--- fs/jbd2/revoke.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jbd2/revoke.c +1 -1
@@ -654,7 +654,7 @@ static void flush_descriptor(journal_t *journal,set_buffer_jwrite (descriptor);BUFFER_TRACE (descriptor,"write" );set_buffer_dirty (descriptor); - write_dirty_buffer(descriptor, REQ_SYNC); + write_dirty_buffer(descriptor, JBD2_JOURNAL_REQ_FLAGS); }#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/92 jbd2: flush filesystem device before updating tail sequence
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit a0851ea9cd555c333795b85ddd908898b937c4e1 ]
When committing transaction in jbd2_journal_commit_transaction(), the disk caches for the filesystem device should be flushed before updating the journal tail sequence. However, this step is missed if the journal is not located on the filesystem device. As a result, the filesystem may become inconsistent following a power failure or system crash. Fix it by ensuring that the filesystem device is flushed appropriately.
--- fs/jbd2/commit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/jbd2/commit.c +2 -2
@@ -811,9 +811,9 @@ void jbd2_journal_commit_transaction(journal_t *journal)/* * If the journal is not located on the file system device, * then we must flush the file system device before we issue -* the commit record +* the commit record and update the journal tail sequence. */ -if (commit_transaction->t_need_data_flush && +if ((commit_transaction->t_need_data_flush || update_tail) && (journal->j_fs_dev != journal->j_dev) && (journal->j_flags &JBD2_BARRIER ))blkdev_issue_flush (journal->j_fs_dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/92 dm array: fix releasing a faulty array block twice in dm_array_cursor_end
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit f2893c0804d86230ffb8f1c8703fdbb18648abc8 ]
When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().
Reproduce steps:
1. initialize a cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1
dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
2. wipe the second array block offline
dmsteup remove cache cmeta cdata corig
mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \
2>/dev/null | hexdump -e '1/8 "%u\n"')
ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \
2>/dev/null | hexdump -e '1/8 "%u\n"')
dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock
3. try reopen the cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
Kernel logs:
(snip)
device-mapper: array: array_block_check failed: blocknr 0 != wanted 10
device-mapper: block manager: array validator check failed for block 10
device-mapper: array: get_ablock failed
device-mapper: cache metadata: dm_array_cursor_next for mapping failed
------------[ cut here ]------------ kernel BUG at drivers/md/dm-bufio.c:638!
Fix by setting the cached block pointer to NULL on errors.
In addition to the reproducer described above, this fix can be verified using the "array_cursor/damaged" test in dm-unit:
dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>
--- drivers/md/persistent-data/dm-array.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/md/persistent-data/dm-array.c +8 -4
@@ -912,23 +912,27 @@ static int load_ablock(struct dm_array_cursor *c)if (c->block)unlock_ablock (c->info, c->block); - c->block =NULL ; - c->ab =NULL ; c->index =0 ; r =dm_btree_cursor_get_value (&c->cursor, &key, &value_le);if (r) {DMERR ("dm_btree_cursor_get_value failed" ); -dm_btree_cursor_end (&c->cursor); + goto out; }else { r =get_ablock (c->info,le64_to_cpu (value_le), &c->block, &c->ab);if (r) {DMERR ("get_ablock failed" ); -dm_btree_cursor_end (&c->cursor); + goto out; } } +return 0 ; + +out: +dm_btree_cursor_end (&c->cursor); + c->block =NULL ; + c->ab =NULL ;return r; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/92 dm array: fix unreleased btree blocks on closing a faulty array cursor
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit 626f128ee9c4133b1cfce4be2b34a1508949370e ]
The cached block pointer in dm_array_cursor might be NULL if it reaches an unreadable array block, or the array is empty. Therefore, dm_array_cursor_end() should call dm_btree_cursor_end() unconditionally, to prevent leaving unreleased btree blocks.
This fix can be verified using the "array_cursor/iterate/empty" test in dm-unit:
dm-unit run /pdata/array_cursor/iterate/empty --kernel-dir <KERNEL_DIR>
--- drivers/md/persistent-data/dm-array.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/md/persistent-data/dm-array.c +3 -3
@@ -955,10 +955,10 @@ EXPORT_SYMBOL_GPL(dm_array_cursor_begin);void dm_array_cursor_end (struct dm_array_cursor *c) { -if (c->block) { +if (c->block)unlock_ablock (c->info, c->block); -dm_btree_cursor_end (&c->cursor); - } + +dm_btree_cursor_end (&c->cursor); }EXPORT_SYMBOL_GPL (dm_array_cursor_end);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/92 dm array: fix cursor index when skipping across block boundaries
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit 0bb1968da2737ba68fd63857d1af2b301a18d3bf ]
dm_array_cursor_skip() seeks to the target position by loading array blocks iteratively until the specified number of entries to skip is reached. When seeking across block boundaries, it uses dm_array_cursor_next() to step into the next block. dm_array_cursor_skip() must first move the cursor index to the end of the current block; otherwise, the cursor position could incorrectly remain in the same block, causing the actual number of skipped entries to be much smaller than expected.
This bug affects cache resizing in v2 metadata and could lead to data loss if the fast device is shrunk during the first-time resume. For example:
1. create a cache metadata consists of 32768 blocks, with a dirty block assigned to the second bitmap block. cache_restore v1.0 is required.
cat <<EOF >> cmeta.xml
<superblock uuid="" block_size="64" nr_cache_blocks="32768" \
policy="smq" hint_width="4">
<mappings>
<mapping cache_block="32767" origin_block="0" dirty="true"/>
</mappings>
</superblock>
EOF
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2
2. bring up the cache while attempt to discard all the blocks belonging to the second bitmap block (block# 32576 to 32767). The last command is expected to fail, but it actually succeeds.
dmsetup create cdata --table "0 2084864 linear /dev/sdc 8192" dmsetup create corig --table "0 65536 linear /dev/sdc 2105344" dmsetup create cache --table "0 65536 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 64 2 metadata2 writeback smq \
2 migration_threshold 0"
In addition to the reproducer described above, this fix can be verified using the "array_cursor/skip" tests in dm-unit:
dm-unit run /pdata/array_cursor/skip/ --kernel-dir <KERNEL_DIR>
--- drivers/md/persistent-data/dm-array.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/persistent-data/dm-array.c +1 -0
@@ -998,6 +998,7 @@ int dm_array_cursor_skip(struct dm_array_cursor *c, uint32_t count) } count -= remaining; + c->index += (remaining -1 ); r =dm_array_cursor_next (c); }while (!r);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/92 exfat: fix the infinite loop in exfat_readdir()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit fee873761bd978d077d8c55334b4966ac4cb7b59 ]
If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop.
This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs().
This commit stops traversing the cluster chain when there is unused directory entry in the cluster to avoid this infinite loop.
--- fs/exfat/dir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/exfat/dir.c +2 -1
@@ -125,7 +125,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent type =exfat_get_entry_type (ep);if (type ==TYPE_UNUSED ) {brelse (bh); -break ; + goto out; }if (type !=TYPE_FILE && type !=TYPE_DIR ) {
@@ -185,6 +185,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent } } +out: dir_entry->namebuf.lfn[0 ] ='\0' ; *cpos =EXFAT_DEN_TO_B (dentry);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/92 exfat: fix the infinite loop in __exfat_free_cluster()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit a5324b3a488d883aa2d42f72260054e87d0940a0 ]
In __exfat_free_cluster(), the cluster chain is traversed until the EOF cluster. If the cluster chain includes a loop due to file system corruption, the EOF cluster cannot be traversed, resulting in an infinite loop.
This commit uses the total number of clusters to prevent this infinite loop.
--- fs/exfat/fatent.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/exfat/fatent.c +10 -0
@@ -216,6 +216,16 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chainif (err) goto dec_used_clus; + +if (num_clusters >= sbi->num_clusters -EXFAT_FIRST_CLUSTER ) { +/* +* The cluster chain includes a loop, scan the +* bitmap to get the number of used clusters. +*/ +exfat_count_used_clusters (sb, &sbi->used_clusters); + +return 0 ; + } }while (clu !=EXFAT_EOF_CLUSTER ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/92 scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <[email protected]>
The orc_sort_cmp() function, used with qsort(), previously violated the symmetry and transitivity rules required by the C standard. Specifically, when both entries are ORC_REG_UNDEFINED, it could result in both a < b and b < a, which breaks the required symmetry and transitivity. This can lead to undefined behavior and incorrect sorting results, potentially causing memory corruption in glibc implementations [1].
Symmetry: If x < y, then y > x.
Transitivity: If x < y and y < z, then x < z.
Fix the comparison logic to return 0 when both entries are ORC_REG_UNDEFINED, ensuring compliance with qsort() requirements.
--- scripts/sorttable.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
scripts/sorttable.h +5 -1
@@ -110,7 +110,7 @@ static inline unsigned long orc_ip(const int *ip)static int orc_sort_cmp (const void *_a,const void *_b) { -struct orc_entry *orc_a; +struct orc_entry *orc_a, *orc_b;const int *a = g_orc_ip_table + *(int *)_a;const int *b = g_orc_ip_table + *(int *)_b;unsigned long a_val =orc_ip (a);
@@ -128,6 +128,10 @@ static int orc_sort_cmp(const void *_a, const void *_b)* whitelisted .o files which didn't get objtool generation. */ orc_a = g_orc_table + (a - g_orc_ip_table); + orc_b = g_orc_table + (b - g_orc_ip_table); +if (orc_a->sp_reg ==ORC_REG_UNDEFINED && !orc_a->end && + orc_b->sp_reg ==ORC_REG_UNDEFINED && !orc_b->end) +return 0 ;return orc_a->sp_reg ==ORC_REG_UNDEFINED && !orc_a->end ?-1 :1 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/92 ASoC: mediatek: disable buffer pre-allocation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 32c9c06adb5b157ef259233775a063a43746d699 ]
On Chromebooks based on Mediatek MT8195 or MT8188, the audio frontend (AFE) is limited to accessing a very small window (1 MiB) of memory, which is described as a reserved memory region in the device tree.
On these two platforms, the maximum buffer size is given as 512 KiB. The MediaTek common code uses the same value for preallocations. This means that only the first two PCM substreams get preallocations, and then the whole space is exhausted, barring any other substreams from working. Since the substreams used are not always the first two, this means audio won't work correctly.
This is observed on the MT8188 Geralt Chromebooks, on which the "mediatek,dai-link" property was dropped when it was upstreamed. That property causes the driver to only register the PCM substreams listed in the property, and in the order given.
Instead of trying to compute an optimal value and figuring out which streams are used, simply disable preallocation. The PCM buffers are managed by the core and are allocated and released on the fly. There should be no impact to any of the other MediaTek platforms.
--- sound/soc/mediatek/common/mtk-afe-platform-driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/mediatek/common/mtk-afe-platform-driver.c +2 -2
@@ -120,8 +120,8 @@ int mtk_afe_pcm_new(struct snd_soc_component *component,struct mtk_base_afe *afe =snd_soc_component_get_drvdata (component); size = afe->mtk_afe_hardware->buffer_bytes_max; -snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , - afe->dev, size, size); +snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , afe->dev,0 , size); +return 0 ; }EXPORT_SYMBOL_GPL (mtk_afe_pcm_new);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/92 ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keisuke Nishimura <[email protected]>
[ Upstream commit 2c87309ea741341c6722efdf1fb3f50dd427c823 ]
ca8210_test_interface_init() returns the result of kfifo_alloc(), which can be non-zero in case of an error. The caller, ca8210_probe(), should check the return value and do error-handling if it fails.
--- drivers/net/ieee802154/ca8210.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ieee802154/ca8210.c +5 -1
@@ -3078,7 +3078,11 @@ static int ca8210_probe(struct spi_device *spi_device)spi_set_drvdata (priv->spi, priv);if (IS_ENABLED (CONFIG_IEEE802154_CA8210_DEBUGFS )) { cascoda_api_upstream = ca8210_test_int_driver_write; -ca8210_test_interface_init (priv); + ret =ca8210_test_interface_init (priv); +if (ret) { +dev_crit (&spi_device->dev,"ca8210_test_interface_init failed\n" ); + goto error; + } }else { cascoda_api_upstream =NULL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/92 net: 802: LLC+SNAP OID:PID lookup on start of skb data
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Pastor <[email protected]>
[ Upstream commit 1e9b0e1c550c42c13c111d1a31e822057232abc4 ]
802.2+LLC+SNAP frames received by napi_complete_done() with GRO and DSA have skb->transport_header set two bytes short, or pointing 2 bytes before network_header & skb->data. This was an issue as snap_rcv() expected offset to point to SNAP header (OID:PID), causing packet to be dropped.
A fix at llc_fixup_skb() (a024e377efed) resets transport_header for any LLC consumers that may care about it, and stops SNAP packets from being dropped, but doesn't fix the problem which is that LLC and SNAP should not use transport_header offset.
Ths patch eliminates the use of transport_header offset for SNAP lookup of OID:PID so that SNAP does not rely on the offset at all. The offset is reset after pull for any SNAP packet consumers that may (but shouldn't) use it.
--- net/802/psnap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/802/psnap.c +2 -2
@@ -55,11 +55,11 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, goto drop;rcu_read_lock (); - proto =find_snap_client (skb_transport_header (skb)); + proto =find_snap_client (skb->data);if (proto) {/* Pass the frame on. */ - skb->transport_header +=5 ;skb_pull_rcsum (skb,5 ); +skb_reset_transport_header (skb); rc = proto->rcvfunc (skb, dev, &snap_packet_type, orig_dev); }rcu_read_unlock ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/92 tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 9a79c65f00e2b036e17af3a3a607d7d732b7affb ]
Since commit 099ecf59f05b ("net: annotate lockless accesses to sk->sk_max_ack_backlog") decided to handle the sk_max_ack_backlog locklessly, there is one more function mostly called in TCP/DCCP cases. So this patch completes it:)
Stable-dep-of: 3479c7549fb1 ("tcp/dccp: allow a connection when sk_max_ack_backlog is zero")
--- include/net/inet_connection_sock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/inet_connection_sock.h +1 -1
@@ -281,7 +281,7 @@ static inline int inet_csk_reqsk_queue_len(const struct sock *sk)static inline int inet_csk_reqsk_queue_is_full (const struct sock *sk) { -return inet_csk_reqsk_queue_len (sk) >= sk->sk_max_ack_backlog; +return inet_csk_reqsk_queue_len (sk) >=READ_ONCE (sk->sk_max_ack_backlog); }bool inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/92 tcp/dccp: allow a connection when sk_max_ack_backlog is zero
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Duan <[email protected]>
[ Upstream commit 3479c7549fb1dfa7a1db4efb7347c7b8ef50de4b ]
If the backlog of listen() is set to zero, sk_acceptq_is_full() allows one connection to be made, but inet_csk_reqsk_queue_is_full() does not. When the net.ipv4.tcp_syncookies is zero, inet_csk_reqsk_queue_is_full() will cause an immediate drop before the sk_acceptq_is_full() check in tcp_conn_request(), resulting in no connection can be made.
This patch tries to keep consistent with 64a146513f8f ("[NET]: Revert incorrect accept queue backlog changes.").
--- include/net/inet_connection_sock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/inet_connection_sock.h +1 -1
@@ -281,7 +281,7 @@ static inline int inet_csk_reqsk_queue_len(const struct sock *sk)static inline int inet_csk_reqsk_queue_is_full (const struct sock *sk) { -return inet_csk_reqsk_queue_len (sk) >=READ_ONCE (sk->sk_max_ack_backlog); +return inet_csk_reqsk_queue_len (sk) >READ_ONCE (sk->sk_max_ack_backlog); }bool inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/92 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit a039e54397c6a75b713b9ce7894a62e06956aa92 ]
syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values.
UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1771 [inline] tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867 sfb_classify net/sched/sch_sfb.c:260 [inline] sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318 dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793 __dev_xmit_skb net/core/dev.c:3889 [inline] __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173 geneve_xmit_skb drivers/net/geneve.c:916 [inline] geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
--- net/sched/cls_flow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/cls_flow.c +2 -1
@@ -354,7 +354,8 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = { [TCA_FLOW_KEYS] = { .type = NLA_U32 }, [TCA_FLOW_MODE] = { .type = NLA_U32 }, [TCA_FLOW_BASECLASS] = { .type = NLA_U32 }, - [TCA_FLOW_RSHIFT] = { .type = NLA_U32 }, + [TCA_FLOW_RSHIFT ] =NLA_POLICY_MAX (NLA_U32 , + 31 /* BITS_PER_U32 - 1 */), [TCA_FLOW_ADDEND] = { .type = NLA_U32 }, [TCA_FLOW_MASK] = { .type = NLA_U32 }, [TCA_FLOW_XOR] = { .type = NLA_U32 },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/92 bnxt_en: Fix possible memory leak when hwrm_req_replace fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit c8dafb0e4398dacc362832098a04b97da3b0395b ]
When hwrm_req_replace() fails, the driver is not invoking bnxt_req_drop() which could cause a memory leak.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +2 -1
@@ -252,7 +252,7 @@ static int bnxt_send_msg(struct bnxt_en_dev *edev, unsigned int ulp_id, rc =hwrm_req_replace (bp, req, fw_msg->msg, fw_msg->msg_len);if (rc) -return rc; + goto drop_req;hwrm_req_timeout (bp, req, fw_msg->timeout); resp =hwrm_req_hold (bp, req);
@@ -264,6 +264,7 @@ static int bnxt_send_msg(struct bnxt_en_dev *edev, unsigned int ulp_id,memcpy (fw_msg->resp, resp, resp_len); } +drop_req:hwrm_req_drop (bp, req);return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/92 cxgb4: Avoid removal of uninserted tid
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anumula Murali Mohan Reddy <[email protected]>
[ Upstream commit 4c1224501e9d6c5fd12d83752f1c1b444e0e3418 ]
During ARP failure, tid is not inserted but _c4iw_free_ep() attempts to remove tid which results in error.
This patch fixes the issue by avoiding removal of uninserted tid.
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +4 -1
@@ -1800,7 +1800,10 @@ void cxgb4_remove_tid(struct tid_info *t, unsigned int chan, unsigned int tid, struct adapter *adap = container_of(t, struct adapter, tids);struct sk_buff *skb; -WARN_ON (tid_out_of_range (&adap->tids, tid)); +if (tid_out_of_range (&adap->tids, tid)) { +dev_err (adap->pdev_dev,"tid %d out of range\n" , tid); +return ; + }if (t->tid_tab[tid - adap->tids.tid_base]) { t->tid_tab[tid - adap->tids.tid_base] =NULL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/92 ice: fix incorrect PHY settings for 100 GB/s
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemyslaw Korba <[email protected]>
[ Upstream commit 6c5b989116083a98f45aada548ff54e7a83a9c2d ]
ptp4l application reports too high offset when ran on E823 device with a 100GB/s link. Those values cannot go under 100ns, like in a working case when using 100 GB/s cable.
This is due to incorrect frequency settings on the PHY clocks for 100 GB/s speed. Changes are introduced to align with the internal hardware documentation, and correctly initialize frequency in PHY clocks with the frequency values that are in our HW spec.
To reproduce the issue run ptp4l as a Time Receiver on E823 device, and observe the offset, which will never approach values seen in the PTP working case.
Reproduction output:
ptp4l -i enp137s0f3 -m -2 -s -f /etc/ptp4l_8275.conf
ptp4l[5278.775]: master offset 12470 s2 freq +41288 path delay -3002 ptp4l[5278.837]: master offset 10525 s2 freq +39202 path delay -3002 ptp4l[5278.900]: master offset -24840 s2 freq -20130 path delay -3002 ptp4l[5278.963]: master offset 10597 s2 freq +37908 path delay -3002 ptp4l[5279.025]: master offset 8883 s2 freq +36031 path delay -3002 ptp4l[5279.088]: master offset 7267 s2 freq +34151 path delay -3002 ptp4l[5279.150]: master offset 5771 s2 freq +32316 path delay -3002 ptp4l[5279.213]: master offset 4388 s2 freq +30526 path delay -3002 ptp4l[5279.275]: master offset -30434 s2 freq -28485 path delay -3002 ptp4l[5279.338]: master offset -28041 s2 freq -27412 path delay -3002 ptp4l[5279.400]: master offset 7870 s2 freq +31118 path delay -3002
--- drivers/net/ethernet/intel/ice/ice_ptp_consts.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_ptp_consts.h +2 -2
@@ -359,9 +359,9 @@ const struct ice_vernier_info_e822 e822_vernier[NUM_ICE_PTP_LNK_SPD] = {/* rx_desk_rsgb_par */ 644531250 ,/* 644.53125 MHz Reed Solomon gearbox */ /* tx_desk_rsgb_pcs */ -644531250 ,/* 644.53125 MHz Reed Solomon gearbox */ +390625000 ,/* 390.625 MHz Reed Solomon gearbox */ /* rx_desk_rsgb_pcs */ -644531250 ,/* 644.53125 MHz Reed Solomon gearbox */ +390625000 ,/* 390.625 MHz Reed Solomon gearbox */ /* tx_fixed_delay */ 1620,/* pmd_adj_divisor */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/92 tls: Fix tls_sw_sendmsg error handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
[ Upstream commit b341ca51d2679829d26a3f6a4aa9aee9abd94f92 ]
We've noticed that NFS can hang when using RPC over TLS on an unstable connection, and investigation shows that the RPC layer is stuck in a tight loop attempting to transmit, but forever getting -EBADMSG back from the underlying network. The loop begins when tcp_sendmsg_locked() returns -EPIPE to tls_tx_records(), but that error is converted to -EBADMSG when calling the socket's error reporting handler.
Instead of converting errors from tcp_sendmsg_locked(), let's pass them along in this path. The RPC layer handles -EPIPE by reconnecting the transport, which prevents the endless attempts to transmit on a broken connection.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -452,7 +452,7 @@ int tls_tx_records(struct sock *sk, int flags) tx_err:if (rc <0 && rc != -EAGAIN ) -tls_err_abort (sk, -EBADMSG ); +tls_err_abort (sk, rc);return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/92 Bluetooth: hci_sync: Fix not setting Random Address when required
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit c2994b008492db033d40bd767be1620229a3035e ]
This fixes errors such as the following when Own address type is set to Random Address but it has not been programmed yet due to either be advertising or connecting:
< HCI Command: LE Set Exte.. (0x08|0x0041) plen 13
Own address type: Random (0x03)
Filter policy: Ignore not in accept list (0x01)
PHYs: 0x05
Entry 0: LE 1M
Type: Passive (0x00)
Interval: 60.000 msec (0x0060)
Window: 30.000 msec (0x0030)
Entry 1: LE Coded
Type: Passive (0x00)
Interval: 180.000 msec (0x0120)
Window: 90.000 msec (0x0090)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 4
LE Set Extended Scan Parameters (0x08|0x0041) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Exten.. (0x08|0x0042) plen 6
Extended scan: Enabled (0x01)
Filter duplicates: Enabled (0x01)
Duration: 0 msec (0x0000)
Period: 0.00 sec (0x0000)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 4
LE Set Extended Scan Enable (0x08|0x0042) ncmd 1
Status: Invalid HCI Command Parameters (0x12)--- net/bluetooth/hci_sync.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/bluetooth/hci_sync.c +6 -5
@@ -1006,9 +1006,9 @@ static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags)static int hci_set_random_addr_sync (struct hci_dev *hdev,bdaddr_t *rpa) { -/* If we're advertising or initiating an LE connection we can't -* go ahead and change the random address at this time. This is -* because the eventual initiator address used for the +/* If a random_addr has been set we're advertising or initiating an LE +* connection we can't go ahead and change the random address at this +* time. This is because the eventual initiator address used for the * subsequently created connection will be undefined (some * controllers use the new address and others the one we had * when the operation started).
@@ -1016,8 +1016,9 @@ static int hci_set_random_addr_sync(struct hci_dev *hdev, bdaddr_t *rpa)* In this kind of scenario skip the update and let the random * address be updated at the next cycle. */ -if (hci_dev_test_flag (hdev,HCI_LE_ADV ) || -hci_lookup_le_connect (hdev)) { +if (bacmp (&hdev->random_addr,BDADDR_ANY ) && + (hci_dev_test_flag (hdev,HCI_LE_ADV ) || +hci_lookup_le_connect (hdev))) {bt_dev_dbg (hdev,"Deferring random address update" );hci_dev_set_flag (hdev,HCI_RPA_EXPIRED );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/92 tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 80fb40baba19e25a1b6f3ecff6fc5c0171806bde ]
This is a follow-up to 3c5b4d69c358 ("net: annotate data-races around sk->sk_mark"). sk->sk_mark can be read and written without holding the socket lock. IPv6 equivalent is already covered with READ_ONCE() annotation in tcp_v6_send_response().
--- net/ipv4/tcp_ipv4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_ipv4.c +1 -1
@@ -832,7 +832,7 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)sock_net_set (ctl_sk, net);if (sk) { ctl_sk->sk_mark = (sk->sk_state ==TCP_TIME_WAIT ) ? -inet_twsk (sk)->tw_mark : sk->sk_mark; +inet_twsk (sk)->tw_mark :READ_ONCE (sk->sk_mark); ctl_sk->sk_priority = (sk->sk_state ==TCP_TIME_WAIT ) ?inet_twsk (sk)->tw_priority : sk->sk_priority; transmit_time =tcp_transmit_time (sk);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/92 netfilter: nf_tables: imbalance in flowtable binding
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 13210fc63f353fe78584048079343413a3cdf819 ]
All these cases cause imbalance between BIND and UNBIND calls:
- Delete an interface from a flowtable with multiple interfaces
- Add a (device to a) flowtable with --check flag
- Delete a netns containing a flowtable
- In an interactive nft session, create a table with owner flag and flowtable inside, then quit.
Fix it by calling FLOW_BLOCK_UNBIND when unregistering hooks, then remove late FLOW_BLOCK_UNBIND call when destroying flowtable.
--- net/netfilter/nf_tables_api.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +11 -4
@@ -7979,6 +7979,7 @@ static void nft_unregister_flowtable_hook(struct net *net, }static void __nft_unregister_flowtable_net_hooks (struct net *net, +struct nft_flowtable *flowtable,struct list_head *hook_list,bool release_netdev) {
@@ -7986,6 +7987,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net,list_for_each_entry_safe (hook, next, hook_list, list) {nf_unregister_net_hook (net, &hook->ops); + flowtable->data.type->setup (&flowtable->data, hook->ops.dev, +FLOW_BLOCK_UNBIND );if (release_netdev) {list_del (&hook->list);kfree_rcu (hook, rcu);
@@ -7994,9 +7997,10 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, }static void nft_unregister_flowtable_net_hooks (struct net *net, +struct nft_flowtable *flowtable,struct list_head *hook_list) { -__nft_unregister_flowtable_net_hooks (net, hook_list, false); +__nft_unregister_flowtable_net_hooks (net, flowtable, hook_list, false); } static int nft_register_flowtable_net_hooks(struct net *net,
@@ -8618,8 +8622,6 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) flowtable->data.type->free (&flowtable->data);list_for_each_entry_safe (hook, next, &flowtable->hook_list, list) { - flowtable->data.type->setup (&flowtable->data, hook->ops.dev, -FLOW_BLOCK_UNBIND );list_del_rcu (&hook->list);kfree_rcu (hook, rcu); }
@@ -9902,6 +9904,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) &nft_trans_flowtable_hooks (trans), NFT_MSG_DELFLOWTABLE);nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable_hooks (trans)); }else {list_del_rcu (&nft_trans_flowtable (trans)->list);
@@ -9910,6 +9913,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) &nft_trans_flowtable (trans)->hook_list, NFT_MSG_DELFLOWTABLE);nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable (trans)->hook_list); }break ;
@@ -10140,11 +10144,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)case NFT_MSG_NEWFLOWTABLE :if (nft_trans_flowtable_update (trans)) {nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable_hooks (trans)); }else {nft_use_dec_restore (&trans->ctx.table->use);list_del_rcu (&nft_trans_flowtable (trans)->list);nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable (trans)->hook_list); }break ;
@@ -10685,7 +10691,8 @@ static void __nft_release_hook(struct net *net, struct nft_table *table)list_for_each_entry (chain, &table->chains, list)__nf_tables_unregister_hook (net, table, chain, true);list_for_each_entry (flowtable, &table->flowtables, list) -__nft_unregister_flowtable_net_hooks (net, &flowtable->hook_list, +__nft_unregister_flowtable_net_hooks (net, flowtable, + &flowtable->hook_list, true); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/92 netfilter: conntrack: clamp maximum hashtable size to INT_MAX
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 ]
Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See:
0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")
Note: hashtable resize is only possible from init_netns.
--- net/netfilter/nf_conntrack_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_core.c +4 -1
@@ -2591,12 +2591,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)struct hlist_nulls_head *hash;unsigned int nr_slots, i; -if (*sizep > (UINT_MAX /sizeof (struct hlist_nulls_head ))) +if (*sizep > (INT_MAX /sizeof (struct hlist_nulls_head )))return NULL ;BUILD_BUG_ON (sizeof (struct hlist_nulls_head ) !=sizeof (struct hlist_head )); nr_slots = *sizep =roundup (*sizep,PAGE_SIZE /sizeof (struct hlist_nulls_head )); +if (nr_slots > (INT_MAX /sizeof (struct hlist_nulls_head ))) +return NULL ; + hash =kvcalloc (nr_slots,sizeof (struct hlist_nulls_head ),GFP_KERNEL );if (hash && nulls)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/92 sched: sch_cake: add bounds checks to host bulk flow fairness counts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 737d4d91d35b5f7fa5bb442651472277318b0bfd ]
Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access.
To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error).
As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour.
--- net/sched/sch_cake.c | 140 +++++++++++++++++++++++-------------------- 1 file changed, 75 insertions(+), 65 deletions(-)
net/sched/sch_cake.c +75 -65
@@ -643,6 +643,63 @@ static bool cake_ddst(int flow_mode)return (flow_mode &CAKE_FLOW_DUAL_DST ) ==CAKE_FLOW_DUAL_DST ; } +static void cake_dec_srchost_bulk_flow_count (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +if (likely (cake_dsrc (flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count)) + q->hosts[flow->srchost].srchost_bulk_flow_count--; +} + +static void cake_inc_srchost_bulk_flow_count (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +if (likely (cake_dsrc (flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count <CAKE_QUEUES )) + q->hosts[flow->srchost].srchost_bulk_flow_count++; +} + +static void cake_dec_dsthost_bulk_flow_count (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +if (likely (cake_ddst (flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count--; +} + +static void cake_inc_dsthost_bulk_flow_count (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +if (likely (cake_ddst (flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count <CAKE_QUEUES )) + q->hosts[flow->dsthost].dsthost_bulk_flow_count++; +} + +static u16 cake_get_flow_quantum (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +u16 host_load =1 ; + +if (cake_dsrc (flow_mode)) + host_load =max (host_load, + q->hosts[flow->srchost].srchost_bulk_flow_count); + +if (cake_ddst (flow_mode)) + host_load =max (host_load, + q->hosts[flow->dsthost].dsthost_bulk_flow_count); + +/* The get_random_u16() is a way to apply dithering to avoid +* accumulating roundoff errors +*/ +return (q->flow_quantum * quantum_div[host_load] + +get_random_u16 ()) >>16 ; +} +static u32 cake_hash (struct cake_tin_data *q,const struct sk_buff *skb,int flow_mode,u16 flow_override,u16 host_override) {
@@ -789,10 +846,8 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, allocate_dst =cake_ddst (flow_mode);if (q->flows[outer_hash + k].set ==CAKE_SET_BULK ) { -if (allocate_src) - q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--; -if (allocate_dst) - q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--; +cake_dec_srchost_bulk_flow_count (q, &q->flows[outer_hash + k], flow_mode); +cake_dec_dsthost_bulk_flow_count (q, &q->flows[outer_hash + k], flow_mode); } found:/* reserve queue for future packets in same flow */
@@ -817,9 +872,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].srchost_tag = srchost_hash; found_src: srchost_idx = outer_hash + k; -if (q->flows[reduced_hash].set ==CAKE_SET_BULK ) - q->hosts[srchost_idx].srchost_bulk_flow_count++; q->flows[reduced_hash].srchost = srchost_idx; + +if (q->flows[reduced_hash].set ==CAKE_SET_BULK ) +cake_inc_srchost_bulk_flow_count (q, &q->flows[reduced_hash], flow_mode); }if (allocate_dst) {
@@ -840,9 +896,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].dsthost_tag = dsthost_hash; found_dst: dsthost_idx = outer_hash + k; -if (q->flows[reduced_hash].set ==CAKE_SET_BULK ) - q->hosts[dsthost_idx].dsthost_bulk_flow_count++; q->flows[reduced_hash].dsthost = dsthost_idx; + +if (q->flows[reduced_hash].set ==CAKE_SET_BULK ) +cake_inc_dsthost_bulk_flow_count (q, &q->flows[reduced_hash], flow_mode); } }
@@ -1855,10 +1912,6 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,/* flowchain */ if (!flow->set || flow->set ==CAKE_SET_DECAYING ) { -struct cake_host *srchost = &b->hosts[flow->srchost]; -struct cake_host *dsthost = &b->hosts[flow->dsthost]; -u16 host_load =1 ; -if (!flow->set) {list_add_tail (&flow->flowchain, &b->new_flows); }else {
@@ -1868,18 +1921,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, flow->set =CAKE_SET_SPARSE ; b->sparse_flow_count++; -if (cake_dsrc (q->flow_mode)) - host_load =max (host_load, srchost->srchost_bulk_flow_count); - -if (cake_ddst (q->flow_mode)) - host_load =max (host_load, dsthost->dsthost_bulk_flow_count); - - flow->deficit = (b->flow_quantum * - quantum_div[host_load]) >>16 ; + flow->deficit =cake_get_flow_quantum (b, flow, q->flow_mode); }else if (flow->set ==CAKE_SET_SPARSE_WAIT ) { -struct cake_host *srchost = &b->hosts[flow->srchost]; -struct cake_host *dsthost = &b->hosts[flow->dsthost]; -/* this flow was empty, accounted as a sparse flow, but actually * in the bulk rotation. */
@@ -1887,12 +1930,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, b->sparse_flow_count--; b->bulk_flow_count++; -if (cake_dsrc (q->flow_mode)) - srchost->srchost_bulk_flow_count++; - -if (cake_ddst (q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; - +cake_inc_srchost_bulk_flow_count (b, flow, q->flow_mode); +cake_inc_dsthost_bulk_flow_count (b, flow, q->flow_mode); }if (q->buffer_used > q->buffer_max_used)
@@ -1949,13 +1988,11 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) {struct cake_sched_data *q =qdisc_priv (sch);struct cake_tin_data *b = &q->tins[q->cur_tin]; -struct cake_host *srchost, *dsthost;ktime_t now =ktime_get ();struct cake_flow *flow;struct list_head *head;bool first_flow = true;struct sk_buff *skb; -u16 host_load;u64 delay;u32 len;
@@ -2055,11 +2092,6 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) q->cur_flow = flow - b->flows; first_flow = false; -/* triple isolation (modified DRR++) */ - srchost = &b->hosts[flow->srchost]; - dsthost = &b->hosts[flow->dsthost]; - host_load =1 ; -/* flow isolation (DRR++) */ if (flow->deficit <=0 ) {/* Keep all flows with deficits out of the sparse and decaying
@@ -2071,11 +2103,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) b->sparse_flow_count--; b->bulk_flow_count++; -if (cake_dsrc (q->flow_mode)) - srchost->srchost_bulk_flow_count++; - -if (cake_ddst (q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; +cake_inc_srchost_bulk_flow_count (b, flow, q->flow_mode); +cake_inc_dsthost_bulk_flow_count (b, flow, q->flow_mode); flow->set =CAKE_SET_BULK ; }else {
@@ -2087,19 +2116,7 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) } } -if (cake_dsrc (q->flow_mode)) - host_load =max (host_load, srchost->srchost_bulk_flow_count); - -if (cake_ddst (q->flow_mode)) - host_load =max (host_load, dsthost->dsthost_bulk_flow_count); - -WARN_ON (host_load >CAKE_QUEUES ); - -/* The get_random_u16() is a way to apply dithering to avoid -* accumulating roundoff errors -*/ - flow->deficit += (b->flow_quantum * quantum_div[host_load] + -get_random_u16 ()) >>16 ; + flow->deficit +=cake_get_flow_quantum (b, flow, q->flow_mode);list_move_tail (&flow->flowchain, &b->old_flows); goto retry;
@@ -2123,11 +2140,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch)if (flow->set ==CAKE_SET_BULK ) { b->bulk_flow_count--; -if (cake_dsrc (q->flow_mode)) - srchost->srchost_bulk_flow_count--; - -if (cake_ddst (q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; +cake_dec_srchost_bulk_flow_count (b, flow, q->flow_mode); +cake_dec_dsthost_bulk_flow_count (b, flow, q->flow_mode); b->decaying_flow_count++; } else if (flow->set == CAKE_SET_SPARSE ||
@@ -2145,12 +2159,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch)else if (flow->set ==CAKE_SET_BULK ) { b->bulk_flow_count--; -if (cake_dsrc (q->flow_mode)) - srchost->srchost_bulk_flow_count--; - -if (cake_ddst (q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; - +cake_dec_srchost_bulk_flow_count (b, flow, q->flow_mode); +cake_dec_dsthost_bulk_flow_count (b, flow, q->flow_mode); }else b->decaying_flow_count--;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/92 net/mlx5: Fix variable not being completed when function returns
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenguang Zhao <[email protected]>
[ Upstream commit 0e2909c6bec9048f49d0c8e16887c63b50b14647 ]
When cmd_alloc_index(), fails cmd_work_handler() needs to complete ent->slotted before returning early. Otherwise the task which issued the command may hang:
mlx5_core 0000:01:00.0: cmd_work_handler:877:(pid 3880418): failed to allocate command entry
INFO: task kworker/13:2:4055883 blocked for more than 120 seconds.
Not tainted 4.19.90-25.44.v2101.ky10.aarch64 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/13:2 D 0 4055883 2 0x00000228
Workqueue: events mlx5e_tx_dim_work [mlx5_core]
Call trace:
__switch_to+0xe8/0x150
__schedule+0x2a8/0x9b8
schedule+0x2c/0x88
schedule_timeout+0x204/0x478
wait_for_common+0x154/0x250
wait_for_completion+0x28/0x38
cmd_exec+0x7a0/0xa00 [mlx5_core]
mlx5_cmd_exec+0x54/0x80 [mlx5_core]
mlx5_core_modify_cq+0x6c/0x80 [mlx5_core]
mlx5_core_modify_cq_moderation+0xa0/0xb8 [mlx5_core]
mlx5e_tx_dim_work+0x54/0x68 [mlx5_core]
process_one_work+0x1b0/0x448
worker_thread+0x54/0x468
kthread+0x134/0x138
ret_from_fork+0x10/0x18--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +1 -0
@@ -1003,6 +1003,7 @@ static void cmd_work_handler(struct work_struct *work)complete (&ent->done); }up (&cmd->vars.sem); +complete (&ent->slotted);return ; } }else {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/92 drm/mediatek: stop selecting foreign drivers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 924d66011f2401a4145e2e814842c5c4572e439f ]
The PHY portion of the mediatek hdmi driver was originally part of the driver it self and later split out into drivers/phy, which a 'select' to keep the prior behavior.
However, this leads to build failures when the PHY driver cannot be built:
WARNING: unmet direct dependencies detected for PHY_MTK_HDMI
Depends on [n]: (ARCH_MEDIATEK || COMPILE_TEST [=y]) && COMMON_CLK [=y] && OF [=y] && REGULATOR [=n] Selected by [m]:
- DRM_MEDIATEK_HDMI [=m] && HAS_IOMEM [=y] && DRM [=m] && DRM_MEDIATEK [=m]
ERROR: modpost: "devm_regulator_register" [drivers/phy/mediatek/phy-mtk-hdmi-drv.ko] undefined!
ERROR: modpost: "rdev_get_drvdata" [drivers/phy/mediatek/phy-mtk-hdmi-drv.ko] undefined!
The best option here is to just not select the phy driver and leave that up to the defconfig. Do the same for the other PHY and memory drivers selected here as well for consistency.
--- drivers/gpu/drm/mediatek/Kconfig | 5 ----- 1 file changed, 5 deletions(-)
drivers/gpu/drm/mediatek/Kconfig +0 -5
@@ -11,9 +11,6 @@ config DRM_MEDIATEK select DRM_KMS_HELPER select DRM_MIPI_DSI select DRM_PANEL - select MEMORY - select MTK_SMI - select PHY_MTK_MIPI_DSI select VIDEOMODE_HELPERS help Choose this option if you have a Mediatek SoCs.
@@ -24,7 +21,6 @@ config DRM_MEDIATEK config DRM_MEDIATEK_DP tristate "DRM DPTX Support for MediaTek SoCs" depends on DRM_MEDIATEK - select PHY_MTK_DP select DRM_DISPLAY_HELPER select DRM_DISPLAY_DP_HELPER select DRM_DP_AUX_BUS
@@ -35,6 +31,5 @@ config DRM_MEDIATEK_HDMI tristate "DRM HDMI Support for Mediatek SoCs" depends on DRM_MEDIATEK select SND_SOC_HDMI_CODEC if SND_SOC - select PHY_MTK_HDMI help DRM/KMS HDMI driver for Mediatek SoCs
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/92 drm/mediatek: Fix YCbCr422 color format issue for DP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liankun Yang <[email protected]>
[ Upstream commit ef24fbd8f12015ff827973fffefed3902ffd61cc ]
Setting up misc0 for Pixel Encoding Format.
According to the definition of YCbCr in spec 1.2a Table 2-96, 0x1 << 1 should be written to the register.
Use switch case to distinguish RGB, YCbCr422,
and unsupported color formats.
--- drivers/gpu/drm/mediatek/mtk_dp.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +8 -5
@@ -457,18 +457,16 @@ static int mtk_dp_set_color_format(struct mtk_dp *mtk_dp, enum dp_pixelformat color_format) {u32 val; - -/* update MISC0 */ -mtk_dp_update_bits (mtk_dp,MTK_DP_ENC0_P0_3034 , - color_format <<DP_TEST_COLOR_FORMAT_SHIFT , -DP_TEST_COLOR_FORMAT_MASK ); +u32 misc0_color;switch (color_format) {case DP_PIXELFORMAT_YUV422 : val =PIXEL_ENCODE_FORMAT_DP_ENC0_P0_YCBCR422 ; + misc0_color = DP_COLOR_FORMAT_YCbCr422;break ;case DP_PIXELFORMAT_RGB : val =PIXEL_ENCODE_FORMAT_DP_ENC0_P0_RGB ; + misc0_color =DP_COLOR_FORMAT_RGB ;break ;default : drm_warn(mtk_dp->drm_dev, "Unsupported color format: %d\n",
@@ -476,6 +474,11 @@ static int mtk_dp_set_color_format(struct mtk_dp *mtk_dp,return -EINVAL ; } +/* update MISC0 */ +mtk_dp_update_bits (mtk_dp,MTK_DP_ENC0_P0_3034 , + misc0_color, +DP_TEST_COLOR_FORMAT_MASK ); +mtk_dp_update_bits (mtk_dp,MTK_DP_ENC0_P0_303C , val,PIXEL_ENCODE_FORMAT_DP_ENC0_P0_MASK );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/92 drm/mediatek: Fix mode valid issue for dp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liankun Yang <[email protected]>
[ Upstream commit 0d68b55887cedc7487036ed34cb4c2097c4228f1 ]
Fix dp mode valid issue to avoid abnormal display of limit state.
After DP passes link training, it can express the lane count of the current link status is good. Calculate the maximum bandwidth supported by DP using the current lane count.
The color format will select the best one based on the bandwidth requirements of the current timing mode. If the current timing mode uses RGB and meets the DP link bandwidth requirements, RGB will be used.
If the timing mode uses RGB but does not meet the DP link bandwidthi requirements, it will continue to check whether YUV422 meets the DP link bandwidth.
FEC overhead is approximately 2.4% from DP 1.4a spec 2.2.1.4.2. The down-spread amplitude shall either be disabled (0.0%) or up to 0.5% from 1.4a 3.5.2.6. Add up to approximately 3% total overhead.
Because rate is already divided by 10,mode->clock does not need to be multiplied by 10.
--- drivers/gpu/drm/mediatek/mtk_dp.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +17 -11
@@ -2277,12 +2277,19 @@ mtk_dp_bridge_mode_valid(struct drm_bridge *bridge, {struct mtk_dp *mtk_dp =mtk_dp_from_bridge (bridge);u32 bpp = info->color_formats &DRM_COLOR_FORMAT_YCBCR422 ?16 :24 ; -u32 rate =min_t (u32,drm_dp_max_link_rate (mtk_dp->rx_cap) * -drm_dp_max_lane_count (mtk_dp->rx_cap), -drm_dp_bw_code_to_link_rate (mtk_dp->max_linkrate) * - mtk_dp->max_lanes); +u32 lane_count_min = mtk_dp->train_info.lane_count; +u32 rate =drm_dp_bw_code_to_link_rate (mtk_dp->train_info.link_rate) * + lane_count_min; -if (rate < mode->clock * bpp /8 ) +/* +*FEC overhead is approximately 2.4% from DP 1.4a spec 2.2.1.4.2. +*The down-spread amplitude shall either be disabled (0.0%) or up +*to 0.5% from 1.4a 3.5.2.6. Add up to approximately 3% total overhead. +* +*Because rate is already divided by 10, +*mode->clock does not need to be multiplied by 10 +*/ +if ((rate *97 /100 ) < (mode->clock * bpp /8 ))return MODE_CLOCK_HIGH ;return MODE_OK ;
@@ -2323,10 +2330,9 @@ static u32 *mtk_dp_bridge_atomic_get_input_bus_fmts(struct drm_bridge *bridge,struct drm_display_mode *mode = &crtc_state->adjusted_mode;struct drm_display_info *display_info = &conn_state->connector->display_info; -u32 rate =min_t (u32,drm_dp_max_link_rate (mtk_dp->rx_cap) * -drm_dp_max_lane_count (mtk_dp->rx_cap), -drm_dp_bw_code_to_link_rate (mtk_dp->max_linkrate) * - mtk_dp->max_lanes); +u32 lane_count_min = mtk_dp->train_info.lane_count; +u32 rate =drm_dp_bw_code_to_link_rate (mtk_dp->train_info.link_rate) * + lane_count_min; *num_input_fmts =0 ;
@@ -2335,8 +2341,8 @@ static u32 *mtk_dp_bridge_atomic_get_input_bus_fmts(struct drm_bridge *bridge,* datarate of YUV422 and sink device supports YUV422, we output YUV422 * format. Use this condition, we can support more resolution. */ -if ((rate < (mode->clock *24 /8 )) && - (rate > (mode->clock *16 /8 )) && +if (((rate *97 /100 ) < (mode->clock *24 /8 )) && + ((rate *97 /100 ) > (mode->clock *16 /8 )) && (display_info->color_formats &DRM_COLOR_FORMAT_YCBCR422 )) { input_fmts =kcalloc (1 ,sizeof (*input_fmts),GFP_KERNEL );if (!input_fmts)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/92 drm/mediatek: Add return value check when reading DPCD
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liankun Yang <[email protected]>
[ Upstream commit 522908140645865dc3e2fac70fd3b28834dfa7be ]
Check the return value of drm_dp_dpcd_readb() to confirm that AUX communication is successful. To simplify the code, replace drm_dp_dpcd_readb() and DP_GET_SINK_COUNT() with drm_dp_read_sink_count().
--- drivers/gpu/drm/mediatek/mtk_dp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +2 -3
@@ -1952,7 +1952,6 @@ static enum drm_connector_status mtk_dp_bdg_detect(struct drm_bridge *bridge)struct mtk_dp *mtk_dp =mtk_dp_from_bridge (bridge);enum drm_connector_status ret = connector_status_disconnected;bool enabled = mtk_dp->enabled; -u8 sink_count =0 ;if (!mtk_dp->train_info.cable_plugged_in)return ret;
@@ -1974,8 +1973,8 @@ static enum drm_connector_status mtk_dp_bdg_detect(struct drm_bridge *bridge)* function, we just need to check the HPD connection to check * whether we connect to a sink device. */ -drm_dp_dpcd_readb (&mtk_dp->aux,DP_SINK_COUNT , &sink_count); -if (DP_GET_SINK_COUNT (sink_count)) + +if (drm_dp_read_sink_count (&mtk_dp->aux) >0 ) ret = connector_status_connected;if (!enabled) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/92 ksmbd: fix a missing return value check bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit 4c16e1cadcbcaf3c82d5fc310fbd34d0f5d0db7c ]
In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct() fails to allocate a node, it returns a NULL pointer to the in_work pointer. This can lead to an illegal memory write of in_work->response_buf when allocate_interim_rsp_buf() attempts to perform a kzalloc() on it.
To address this issue, incorporating a check for the return value of ksmbd_alloc_work_struct() ensures that the function returns immediately upon allocation failure, thereby preventing the aforementioned illegal memory access.
--- fs/smb/server/smb2pdu.c | 3 +++ 1 file changed, 3 insertions(+)
fs/smb/server/smb2pdu.c +3 -0
@@ -712,6 +712,9 @@ void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status)struct smb2_hdr *rsp_hdr;struct ksmbd_work *in_work =ksmbd_alloc_work_struct (); +if (!in_work) +return ; +if (allocate_interim_rsp_buf (in_work)) {pr_err ("smb_allocate_rsp_buf failed!\n" );ksmbd_free_work_struct (in_work);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/92 afs: Fix the maximum cell name length
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8 ]
The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning:
WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405
because procfs limits the maximum filename length to 255.
However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL).
Fix this by limiting the maximum acceptable cellname length to 253. This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too.
Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253.
--- fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 ++++++-- fs/afs/vlclient.c | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-)
fs/afs/afs.h +1 -1
@@ -10,7 +10,7 @@#include <linux/in.h> -#define AFS_MAXCELLNAME 256/* Maximum length of a cell name */ +#define AFS_MAXCELLNAME 253/* Maximum length of a cell name (DNS limited) */ #define AFS_MAXVOLNAME 64/* Maximum length of a volume name */ #define AFS_MAXNSERVERS 8/* Maximum servers in a basic volume record */ #define AFS_NMAXNSERVERS 13/* Maximum servers in a N/U-class volume record */
fs/afs/afs_vl.h +1 -0
@@ -13,6 +13,7 @@#define AFS_VL_PORT 7003/* volume location service port */ #define VL_SERVICE 52/* RxRPC service ID for the Volume Location service */ #define YFS_VL_SERVICE 2503/* Service ID for AuriStor upgraded VL service */ +#define YFS_VL_MAXCELLNAME 256/* Maximum length of a cell name in YFS protocol */ enum AFSVL_Operations {VLGETENTRYBYID =503 ,/* AFS Get VLDB entry by ID */
fs/afs/vl_alias.c +6 -2
@@ -302,6 +302,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key)static int yfs_check_canonical_cell_name (struct afs_cell *cell,struct key *key) {struct afs_cell *master; +size_t name_len;char *cell_name; cell_name =afs_vl_get_cell_name (cell, key);
@@ -313,8 +314,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key)return 0 ; } - master =afs_lookup_cell (cell->net, cell_name,strlen (cell_name), -NULL , false); + name_len =strlen (cell_name); +if (!name_len || name_len >AFS_MAXCELLNAME ) + master =ERR_PTR (-EOPNOTSUPP ); +else + master =afs_lookup_cell (cell->net, cell_name, name_len,NULL , false);kfree (cell_name);if (IS_ERR (master))return PTR_ERR (master);
fs/afs/vlclient.c +1 -1
@@ -671,7 +671,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call)return ret; namesz =ntohl (call->tmp); -if (namesz >AFS_MAXCELLNAME ) +if (namesz >YFS_VL_MAXCELLNAME )return afs_protocol_error (call, afs_eproto_cellname_len); paddedsz = (namesz +3 ) & ~3 ; call->count = namesz;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/92 ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: He Wang <[email protected]>
[ Upstream commit 2ac538e40278a2c0c051cca81bcaafc547d61372 ]
When ksmbd_vfs_kern_path_locked met an error and it is not the last entry, it will exit without restoring changed path buffer. But later this buffer may be used as the filename for creation.
--- fs/smb/server/vfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/smb/server/vfs.c +2 -1
@@ -1249,6 +1249,8 @@ int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, filepath, flags, path); +if (!is_last) + next[0 ] ='/' ;if (err) goto out2;else if (is_last)
@@ -1256,7 +1258,6 @@ int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name,path_put (parent_path); *parent_path = *path; - next[0 ] ='/' ; remain_len -= filename_len +1 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/92 cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 7e25044b804581b9c029d5a28d8800aebde18043 ]
The 'np' device_node is initialized via of_cpu_device_node_get(), which requires explicit calls to of_node_put() when it is no longer required to avoid leaking the resource.
Instead of adding the missing calls to of_node_put() in all execution paths, use the cleanup attribute for 'np' by means of the __free() macro, which automatically calls of_node_put() when the variable goes out of scope. Given that 'np' is only used within the for_each_possible_cpu(), reduce its scope to release the nood after every iteration of the loop.
--- drivers/cpuidle/cpuidle-riscv-sbi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpuidle/cpuidle-riscv-sbi.c +2 -2
@@ -540,12 +540,12 @@ static int sbi_cpuidle_probe(struct platform_device *pdev)int cpu, ret;struct cpuidle_driver *drv;struct cpuidle_device *dev; -struct device_node *np, *pds_node; +struct device_node *pds_node;/* Detect OSI support based on CPU DT nodes */ sbi_cpuidle_use_osi = true;for_each_possible_cpu (cpu) { - np =of_cpu_device_node_get (cpu); + struct device_node *np __free(device_node) = of_cpu_device_node_get(cpu);if (np &&of_find_property (np,"power-domains" ,NULL ) &&of_find_property (np,"power-domain-names" ,NULL )) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/92 dm thin: make get_first_thin use rcu-safe list first function
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krister Johansen <[email protected]>
commit 80f130bfad1dab93b95683fc39b87235682b8f72 upstream.
The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty() -> list_first() sequence in RCU safe code. This is because each of these functions performs its own READ_ONCE() of the list head. This can lead to a situation where the list_empty() sees a valid list entry, but the subsequent list_first() sees a different view of list head state after a modification.
In the case of dm-thin, this author had a production box crash from a GP fault in the process_deferred_bios path. This function saw a valid list head in get_first_thin() but when it subsequently dereferenced that and turned it into a thin_c, it got the inside of the struct pool, since the list was now empty and referring to itself. The kernel on which this occurred printed both a warning about a refcount_t being saturated, and a UBSAN error for an out-of-bounds cpuid access in the queued spinlock, prior to the fault itself. When the resulting kdump was examined, it was possible to see another thread patiently waiting in thin_dtr's synchronize_rcu.
The thin_dtr call managed to pull the thin_c out of the active thins list (and have it be the last entry in the active_thins list) at just the wrong moment which lead to this crash.
Fortunately, the fix here is straight forward. Switch get_first_thin() function to use list_first_or_null_rcu() which performs just a single READ_ONCE() and returns NULL if the list is already empty.
This was run against the devicemapper test suite's thin-provisioning suites for delete and suspend and no regressions were observed.
--- drivers/md/dm-thin.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/md/dm-thin.c +2 -3
@@ -2306,10 +2306,9 @@ static struct thin_c *get_first_thin(strstruct thin_c *tc =NULL ;rcu_read_lock (); -if (!list_empty (&pool->active_thins)) { - tc = list_entry_rcu(pool->active_thins.next, struct thin_c, list); + tc = list_first_or_null_rcu(&pool->active_thins, struct thin_c, list); +if (tc)thin_get (tc); - }rcu_read_unlock ();return tc;
Greg Kroah-Hartman
maintainerPATCH 37/92 dm-ebs: dont set the flag DM_TARGET_PASSES_INTEGRITY
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 47f33c27fc9565fb0bc7dfb76be08d445cd3d236 upstream.
dm-ebs uses dm-bufio to process requests that are not aligned on logical sector size. dm-bufio doesn't support passing integrity data (and it is unclear how should it do it), so we shouldn't set the DM_TARGET_PASSES_INTEGRITY flag.
--- drivers/md/dm-ebs-target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-ebs-target.c +1 -1
@@ -441,7 +441,7 @@ static int ebs_iterate_devices(struct dmstatic struct target_type ebs_target = { .name ="ebs" , .version = {1 ,0 ,1 }, - .features =DM_TARGET_PASSES_INTEGRITY , + .features =0 , .module =THIS_MODULE , .ctr = ebs_ctr, .dtr = ebs_dtr,
Greg Kroah-Hartman
maintainerPATCH 38/92 sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit ea62dd1383913b5999f3d16ae99d411f41b528d4 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.sctp_hmac_alg' is used.
--- net/sctp/sysctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sysctl.c +2 -1
@@ -380,7 +380,8 @@ static struct ctl_table sctp_net_table[]static int proc_sctp_do_hmac_alg (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, + sctp.sctp_hmac_alg);struct ctl_table tbl;bool changed = false;char *none ="none" ;
Greg Kroah-Hartman
maintainerPATCH 39/92 sctp: sysctl: rto_min/max: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 9fc17b76fc70763780aa78b38fcf4742384044a5 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.rto_min/max' is used.
--- net/sctp/sysctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sctp/sysctl.c +2 -2
@@ -426,7 +426,7 @@ static int proc_sctp_do_hmac_alg(structstatic int proc_sctp_do_rto_min (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.rto_min);unsigned int min = *(unsigned int *) ctl->extra1;unsigned int max = *(unsigned int *) ctl->extra2;struct ctl_table tbl;
@@ -454,7 +454,7 @@ static int proc_sctp_do_rto_min(struct cstatic int proc_sctp_do_rto_max (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.rto_max);unsigned int min = *(unsigned int *) ctl->extra1;unsigned int max = *(unsigned int *) ctl->extra2;struct ctl_table tbl;
Greg Kroah-Hartman
maintainerPATCH 40/92 sctp: sysctl: auth_enable: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 15649fd5415eda664ef35780c2013adeb5d9c695 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
--- net/sctp/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/sysctl.c +1 -1
@@ -492,7 +492,7 @@ static int proc_sctp_do_alpha_beta(strucstatic int proc_sctp_do_auth (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.auth_enable);struct ctl_table tbl;int new_value, ret;
Greg Kroah-Hartman
maintainerPATCH 41/92 sctp: sysctl: udp_port: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit c10377bbc1972d858eaf0ab366a311b39f8ef1b6 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
--- net/sctp/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/sysctl.c +1 -1
@@ -521,7 +521,7 @@ static int proc_sctp_do_auth(struct ctl_static int proc_sctp_do_udp_port (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.udp_port);unsigned int min = *(unsigned int *)ctl->extra1;unsigned int max = *(unsigned int *)ctl->extra2;struct ctl_table tbl;
Greg Kroah-Hartman
maintainerPATCH 42/92 sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 6259d2484d0ceff42245d1f09cc8cb6ee72d847a upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.probe_interval' is used.
--- net/sctp/sysctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sysctl.c +2 -1
@@ -562,7 +562,8 @@ static int proc_sctp_do_udp_port(structstatic int proc_sctp_do_probe_interval (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, + sctp.probe_interval);struct ctl_table tbl;int ret, new_value;
Greg Kroah-Hartman
maintainerPATCH 43/92 drm/amd/display: Add check for granularity in dml ceil/floor helpers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Li <[email protected]>
commit 0881fbc4fd62e00a2b8e102725f76d10351b2ea8 upstream.
[Why]
Wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert and divide-by-zero error in dcn_bw_ functions.
[How]
Add check for granularity 0.
--- drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h +8 -0
@@ -66,11 +66,15 @@ static inline double dml_max5(double a,static inline double dml_ceil (double a,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_ceil2 (a, granularity); }static inline double dml_floor (double a,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_floor2 (a, granularity); }
@@ -114,11 +118,15 @@ static inline double dml_ceil_2(double fstatic inline double dml_ceil_ex (double x,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_ceil2 (x, granularity); }static inline double dml_floor_ex (double x,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_floor2 (x, granularity); }
Greg Kroah-Hartman
maintainerPATCH 44/92 thermal: of: fix OF node leak in of_thermal_zone_find()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit 9164e0912af206a72ddac4915f7784e470a04ace ]
of_thermal_zone_find() calls of_parse_phandle_with_args(), but does not release the OF node reference obtained by it.
Add a of_node_put() call when the call is successful.
--- drivers/thermal/thermal_of.c | 1 + 1 file changed, 1 insertion(+)
drivers/thermal/thermal_of.c +1 -0
@@ -315,6 +315,7 @@ static struct device_node *of_thermal_zone_find(struct device_node *sensor, int goto out; } +of_node_put (sensor_specs.np);if ((sensor == sensor_specs.np) && id == (sensor_specs.args_count ? sensor_specs.args[0 ] :0 )) {pr_debug ("sensor %pOFn id=%d belongs to %pOFn\n" , sensor, id, child);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/92 riscv: Fix sleeping in invalid context in die()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 6a97f4118ac07cfdc316433f385dbdc12af5025e upstream.
die() can be called in exception handler, and therefore cannot sleep. However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled. That causes the following warning:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex
preempt_count: 110001, expected: 0
RCU nest depth: 0, expected: 0
CPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
dump_backtrace+0x1c/0x24
show_stack+0x2c/0x38
dump_stack_lvl+0x5a/0x72
dump_stack+0x14/0x1c
__might_resched+0x130/0x13a
rt_spin_lock+0x2a/0x5c
die+0x24/0x112
do_trap_insn_illegal+0xa0/0xea
_new_vmalloc_restore_context_a0+0xcc/0xd8Oops - illegal instruction [#1]
Switch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT enabled.
--- arch/riscv/kernel/traps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/riscv/kernel/traps.c +3 -3
@@ -27,7 +27,7 @@int show_unhandled_signals =1 ; -static DEFINE_SPINLOCK (die_lock); +static DEFINE_RAW_SPINLOCK (die_lock);void die (struct pt_regs *regs,const char *str) {
@@ -38,7 +38,7 @@ void die(struct pt_regs *regs, const chaoops_enter (); -spin_lock_irqsave (&die_lock, flags); +raw_spin_lock_irqsave (&die_lock, flags);console_verbose ();bust_spinlocks (1 );
@@ -55,7 +55,7 @@ void die(struct pt_regs *regs, const chabust_spinlocks (0 );add_taint (TAINT_DIE ,LOCKDEP_NOW_UNRELIABLE ); -spin_unlock_irqrestore (&die_lock, flags); +raw_spin_unlock_irqrestore (&die_lock, flags);oops_exit ();if (in_interrupt ())
Greg Kroah-Hartman
maintainerPATCH 46/92 ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 7ed4e4a659d99499dc6968c61970d41b64feeac0 upstream.
The TongFang GM5HG0A is a TongFang barebone design which is sold under various brand names.
The ACPI IRQ override for the keyboard IRQ must be used on these AMD Zen laptops in order for the IRQ to work.
At least on the SKIKK Vanaheim variant the DMI product- and board-name strings have been replaced by the OEM with "Vanaheim" so checking that board-name contains "GM5HG0A" as is usually done for TongFang barebones quirks does not work.
The DMI OEM strings do contain "GM5HG0A". I have looked at the dmidecode for a few other TongFang devices and the TongFang code-name string being in the OEM strings seems to be something which is consistently true.
Add a quirk checking one of the DMI_OEM_STRING(s) is "GM5HG0A" in the hope that this will work for other OEM versions of the "GM5HG0A" too.
--- drivers/acpi/resource.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/acpi/resource.c +11 -0
@@ -615,6 +615,17 @@ static const struct dmi_system_id lg_lap DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), }, }, + { +/* +* TongFang GM5HG0A in case of the SKIKK Vanaheim relabel the +* board-name is changed, so check OEM strings instead. Note +* OEM string matches are always exact matches. +* https://bugzilla.kernel.org/show_bug.cgi?id=219614 +*/ + .matches = { + DMI_EXACT_MATCH(DMI_OEM_STRING, "GM5HG0A"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 47/92 ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 66d337fede44dcbab4107d37684af8fcab3d648e upstream.
Like the Vivobook X1704VAP the X1504VAP has its keyboard IRQ (1) described as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which breaks the keyboard.
Add the X1504VAP to the irq1_level_low_skip_override[] quirk table to fix this.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -440,6 +440,13 @@ static const struct dmi_system_id asus_l }, }, { +/* Asus Vivobook X1504VAP */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "X1504VAP"), + }, + }, + {/* Asus Vivobook X1704VAP */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
Greg Kroah-Hartman
maintainerPATCH 48/92 drm/amd/display: increase MAX_SURFACES to the value supported by hw
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melissa Wen <[email protected]>
commit 21541bc6b44241e3f791f9e552352d8440b2b29e upstream.
As the hw supports up to 4 surfaces, increase the maximum number of surfaces to prevent the DC error when trying to use more than three planes.
[drm:dc_state_add_plane [amdgpu]] *ERROR* Surface: can not attach plane_state 000000003e2cb82c! Maximum is: 3
--- drivers/gpu/drm/amd/display/dc/dc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dc.h +1 -1
@@ -49,7 +49,7 @@ struct dmub_notification;#define DC_VER "3.2.207" -#define MAX_SURFACES 3 +#define MAX_SURFACES 4#define MAX_PLANES 6#define MAX_STREAMS 6#define MAX_SINKS_PER_LINK 4
Greg Kroah-Hartman
maintainerPATCH 49/92 dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milan Broz <[email protected]>
commit 6df90c02bae468a3a6110bafbc659884d0c4966c upstream.
This patch fixes an issue that was fixed in the commit
df7b59ba9245 ("dm verity: fix FEC for RS roots unaligned to block size")
but later broken again in the commit
8ca7cab82bda ("dm verity fec: fix misaligned RS roots IO")
If the Reed-Solomon roots setting spans multiple blocks, the code does not use proper parity bytes and randomly fails to repair even trivial errors.
This bug cannot happen if the sector size is multiple of RS roots setting (Android case with roots 2).
The previous solution was to find a dm-bufio block size that is multiple of the device sector size and roots size. Unfortunately, the optimization in commit 8ca7cab82bda ("dm verity fec: fix misaligned RS roots IO") is incorrect and uses data block size for some roots (for example, it uses 4096 block size for roots = 20).
This patch uses a different approach:
- It always uses a configured data block size for dm-bufio to avoid possible misaligned IOs.
- and it caches the processed parity bytes, so it can join it if it spans two blocks.
As the RS calculation is called only if an error is detected and the process is computationally intensive, copying a few more bytes should not introduce performance issues.
The issue was reported to cryptsetup with trivial reproducer
https://gitlab.com/cryptsetup/cryptsetup/-/issues/923
Reproducer (with roots=20):
# create verity device with RS FEC
dd if=/dev/urandom of=data.img bs=4096 count=8 status=none
veritysetup format data.img hash.img --fec-device=fec.img --fec-roots=20 | \
awk '/^Root hash/{ print $3 }' >roothash# create an erasure that should always be repairable with this roots setting dd if=/dev/zero of=data.img conv=notrunc bs=1 count=4 seek=4 status=none
# try to read it through dm-verity veritysetup open data.img test hash.img --fec-device=fec.img --fec-roots=20 $(cat roothash) dd if=/dev/mapper/test of=/dev/null bs=4096 status=noxfer
Even now the log says it cannot repair it:
: verity-fec: 7:1: FEC 0: failed to correct: -74 : device-mapper: verity: 7:1: data block 0 is corrupted
...
With this fix, errors are properly repaired.
: verity-fec: 7:1: FEC 0: corrected 4 errors
--- drivers/md/dm-verity-fec.c | 39 ++++++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 13 deletions(-)
drivers/md/dm-verity-fec.c +26 -13
@@ -60,14 +60,19 @@ static int fec_decode_rs8(struct dm_veri* to the data block. Caller is responsible for releasing buf. */ static u8 *fec_read_parity (struct dm_verity *v,u64 rsb,int index, -unsigned int *offset,struct dm_buffer **buf) +unsigned int *offset,unsigned int par_buf_offset, +struct dm_buffer **buf) {u64 position, block, rem;u8 *res; +/* We have already part of parity bytes read, skip to the next block */ +if (par_buf_offset) + index++; + position = (index + rsb) * v->fec->roots; block =div64_u64_rem (position, v->fec->io_size, &rem); - *offset = (unsigned int )rem; + *offset = par_buf_offset ?0 : (unsigned int )rem; res =dm_bufio_read (v->fec->bufio, block, buf);if (IS_ERR (res)) {
@@ -127,10 +132,11 @@ static int fec_decode_bufs(struct dm_ver {int r, corrected =0 , res;struct dm_buffer *buf; -unsigned int n, i, offset; -u8 *par, *block; +unsigned int n, i, offset, par_buf_offset =0 ; +u8 *par, *block, par_buf[DM_VERITY_FEC_RSM -DM_VERITY_FEC_MIN_RSN ]; - par =fec_read_parity (v, rsb, block_offset, &offset, &buf); + par =fec_read_parity (v, rsb, block_offset, &offset, + par_buf_offset, &buf);if (IS_ERR (par))return PTR_ERR (par);
@@ -140,7 +146,8 @@ static int fec_decode_bufs(struct dm_ver*/ fec_for_each_buffer_rs_block (fio, n, i) { block =fec_buffer_rs_block (v, fio, n, i); - res =fec_decode_rs8 (v, fio, block, &par[offset], neras); +memcpy (&par_buf[par_buf_offset], &par[offset], v->fec->roots - par_buf_offset); + res =fec_decode_rs8 (v, fio, block, par_buf, neras);if (res <0 ) { r = res; goto error;
@@ -153,12 +160,21 @@ static int fec_decode_bufs(struct dm_verif (block_offset >=1 << v->data_dev_block_bits) goto done; -/* read the next block when we run out of parity bytes */ - offset += v->fec->roots; +/* Read the next block when we run out of parity bytes */ + offset += (v->fec->roots - par_buf_offset); +/* Check if parity bytes are split between blocks */ +if (offset < v->fec->io_size && (offset + v->fec->roots) > v->fec->io_size) { + par_buf_offset = v->fec->io_size - offset; +memcpy (par_buf, &par[offset], par_buf_offset); + offset += par_buf_offset; + }else + par_buf_offset =0 ; +if (offset >= v->fec->io_size) {dm_bufio_release (buf); - par =fec_read_parity (v, rsb, block_offset, &offset, &buf); + par =fec_read_parity (v, rsb, block_offset, &offset, + par_buf_offset, &buf);if (IS_ERR (par))return PTR_ERR (par); }
@@ -743,10 +759,7 @@ int verity_fec_ctr(struct dm_verity *v)return -E2BIG ; } -if ((f->roots <<SECTOR_SHIFT ) & ((1 << v->data_dev_block_bits) -1 )) - f->io_size =1 << v->data_dev_block_bits; -else - f->io_size = v->fec->roots <<SECTOR_SHIFT ; + f->io_size =1 << v->data_dev_block_bits; f->bufio = dm_bufio_client_create(f->dev->bdev, f->io_size,
Greg Kroah-Hartman
maintainerPATCH 50/92 bpf: Add MEM_WRITE attribute
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit 6fad274f06f038c29660aa53fbad14241c9fd976 upstream.
Add a MEM_WRITE attribute for BPF helper functions which can be used in bpf_func_proto to annotate an argument type in order to let the verifier know that the helper writes into the memory passed as an argument. In the past MEM_UNINIT has been (ab)used for this function, but the latter merely tells the verifier that the passed memory can be uninitialized.
There have been bugs with overloading the latter but aside from that there are also cases where the passed memory is read + written which currently cannot be expressed, see also 4b3786a6c539 ("bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error").
Stable-dep-of: 8ea607330a39 ("bpf: Fix overloading of MEM_UNINIT's meaning")
--- include/linux/bpf.h | 14 +++++++++++--- kernel/bpf/helpers.c | 10 +++++----- kernel/bpf/ringbuf.c | 2 +- kernel/bpf/syscall.c | 2 +- kernel/trace/bpf_trace.c | 4 ++-- net/core/filter.c | 4 ++-- 6 files changed, 22 insertions(+), 14 deletions(-)
include/linux/bpf.h +11 -3
@@ -464,6 +464,7 @@ enum bpf_type_flag {*/ PTR_UNTRUSTED =BIT (6 +BPF_BASE_TYPE_BITS ), +/* MEM can be uninitialized. */ MEM_UNINIT = BIT(7 + BPF_BASE_TYPE_BITS),/* DYNPTR points to memory local to the bpf program. */
@@ -480,6 +481,13 @@ enum bpf_type_flag {*/ MEM_ALIGNED =BIT (17 +BPF_BASE_TYPE_BITS ), +/* MEM is being written to, often combined with MEM_UNINIT. Non-presence +* of MEM_WRITE means that MEM is only being read. MEM_WRITE without the +* MEM_UNINIT means that memory needs to be initialized since it is also +* read. +*/ +MEM_WRITE =BIT (18 +BPF_BASE_TYPE_BITS ), + __BPF_TYPE_FLAG_MAX, __BPF_TYPE_LAST_FLAG = __BPF_TYPE_FLAG_MAX - 1, };
@@ -537,10 +545,10 @@ enum bpf_arg_type {ARG_PTR_TO_ALLOC_MEM_OR_NULL =PTR_MAYBE_NULL |ARG_PTR_TO_ALLOC_MEM ,ARG_PTR_TO_STACK_OR_NULL =PTR_MAYBE_NULL |ARG_PTR_TO_STACK ,ARG_PTR_TO_BTF_ID_OR_NULL =PTR_MAYBE_NULL |ARG_PTR_TO_BTF_ID , -/* pointer to memory does not need to be initialized, helper function must fill -* all bytes or clear them in error case. +/* Pointer to memory does not need to be initialized, since helper function +* fills all bytes or clears them in error case. */ -ARG_PTR_TO_UNINIT_MEM =MEM_UNINIT |ARG_PTR_TO_MEM , +ARG_PTR_TO_UNINIT_MEM =MEM_UNINIT |MEM_WRITE |ARG_PTR_TO_MEM ,/* Pointer to valid memory of size known at compile time. */ ARG_PTR_TO_FIXED_SIZE_MEM = MEM_FIXED_SIZE | ARG_PTR_TO_MEM,
kernel/bpf/helpers.c +5 -5
@@ -107,7 +107,7 @@ const struct bpf_func_proto bpf_map_pop_ .gpl_only = false, .ret_type = RET_INTEGER, .arg1_type = ARG_CONST_MAP_PTR, - .arg2_type = ARG_PTR_TO_MAP_VALUE | MEM_UNINIT, + .arg2_type = ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE, }; BPF_CALL_2(bpf_map_peek_elem, struct bpf_map *, map, void *, value)
@@ -120,7 +120,7 @@ const struct bpf_func_proto bpf_map_peek .gpl_only = false, .ret_type = RET_INTEGER, .arg1_type = ARG_CONST_MAP_PTR, - .arg2_type = ARG_PTR_TO_MAP_VALUE | MEM_UNINIT, + .arg2_type = ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE, }; BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu)
@@ -531,7 +531,7 @@ const struct bpf_func_proto bpf_strtol_p .arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY, .arg2_type = ARG_CONST_SIZE, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg4_size = sizeof(s64), };
@@ -561,7 +561,7 @@ const struct bpf_func_proto bpf_strtoul_ .arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY, .arg2_type = ARG_CONST_SIZE, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg4_size = sizeof(u64), };
@@ -1502,7 +1502,7 @@ static const struct bpf_func_proto bpf_d .arg1_type = ARG_PTR_TO_UNINIT_MEM, .arg2_type = ARG_CONST_SIZE_OR_ZERO, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL | MEM_UNINIT, + .arg4_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL | MEM_UNINIT | MEM_WRITE, }; BPF_CALL_5(bpf_dynptr_read, void *, dst, u32, len, struct bpf_dynptr_kern *, src,
kernel/bpf/ringbuf.c +1 -1
@@ -618,7 +618,7 @@ const struct bpf_func_proto bpf_ringbuf_ .arg1_type = ARG_CONST_MAP_PTR, .arg2_type = ARG_ANYTHING, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_RINGBUF | MEM_UNINIT, + .arg4_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_RINGBUF | MEM_UNINIT | MEM_WRITE, }; BPF_CALL_2(bpf_ringbuf_submit_dynptr, struct bpf_dynptr_kern *, ptr, u64, flags)
kernel/bpf/syscall.c +1 -1
@@ -5265,7 +5265,7 @@ static const struct bpf_func_proto bpf_k .arg1_type = ARG_PTR_TO_MEM, .arg2_type = ARG_CONST_SIZE_OR_ZERO, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg4_size = sizeof(u64), };
kernel/trace/bpf_trace.c +2 -2
@@ -1192,7 +1192,7 @@ static const struct bpf_func_proto bpf_g .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, .arg2_type = ARG_ANYTHING, - .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg3_size = sizeof(u64), };
@@ -1209,7 +1209,7 @@ static const struct bpf_func_proto bpf_g .func = get_func_ret, .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, - .arg2_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg2_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg2_size = sizeof(u64), };
net/core/filter.c +2 -2
@@ -6243,7 +6243,7 @@ static const struct bpf_func_proto bpf_s .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, .arg2_type = ARG_ANYTHING, - .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg3_size = sizeof(u32), .arg4_type = ARG_ANYTHING, .arg5_type = ARG_ANYTHING,
@@ -6255,7 +6255,7 @@ static const struct bpf_func_proto bpf_x .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, .arg2_type = ARG_ANYTHING, - .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg3_size = sizeof(u32), .arg4_type = ARG_ANYTHING, .arg5_type = ARG_ANYTHING,
Greg Kroah-Hartman
maintainerPATCH 51/92 bpf: Fix overloading of MEM_UNINITs meaning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit 8ea607330a39184f51737c6ae706db7fdca7628e upstream.
Lonial reported an issue in the BPF verifier where check_mem_size_reg() has the following code:
if (!tnum_is_const(reg->var_off))
/* For unprivileged variable accesses, disable raw
* mode so that the program is required to
* initialize all the memory that the helper could
* just partially fill up.
*/
meta = NULL;This means that writes are not checked when the register containing the size of the passed buffer has not a fixed size. Through this bug, a BPF program can write to a map which is marked as read-only, for example, .rodata global maps.
The problem is that MEM_UNINIT's initial meaning that "the passed buffer to the BPF helper does not need to be initialized" which was added back in commit 435faee1aae9 ("bpf, verifier: add ARG_PTR_TO_RAW_STACK type") got overloaded over time with "the passed buffer is being written to".
The problem however is that checks such as the above which were added later via 06c1c049721a ("bpf: allow helpers access to variable memory") set meta to NULL in order force the user to always initialize the passed buffer to the helper. Due to the current double meaning of MEM_UNINIT, this bypasses verifier write checks to the memory (not boundary checks though) and only assumes the latter memory is read instead.
Fix this by reverting MEM_UNINIT back to its original meaning, and having MEM_WRITE as an annotation to BPF helpers in order to then trigger the BPF verifier checks for writing to memory.
Some notes: check_arg_pair_ok() ensures that for ARG_CONST_SIZE{,_OR_ZERO} we can access fn->arg_type[arg - 1] since it must contain a preceding ARG_PTR_TO_MEM. For check_mem_reg() the meta argument can be removed altogether since we do check both BPF_READ and BPF_WRITE. Same for the equivalent check_kfunc_mem_size_reg().
--- kernel/bpf/verifier.c | 76 +++++++++++++++++++++++--------------------------- 1 file changed, 36 insertions(+), 40 deletions(-)
kernel/bpf/verifier.c +36 -40
@@ -5416,7 +5416,8 @@ mark: }static int check_helper_mem_access (struct bpf_verifier_env *env,int regno, -int access_size,bool zero_size_allowed, +int access_size,enum bpf_access_type access_type, +bool zero_size_allowed,struct bpf_call_arg_meta *meta) {struct bpf_reg_state *regs =cur_regs (env), *reg = ®s[regno];
@@ -5428,7 +5429,7 @@ static int check_helper_mem_access(strucreturn check_packet_access (env, regno, reg->off, access_size, zero_size_allowed);case PTR_TO_MAP_KEY : -if (meta && meta->raw_mode) { +if (access_type ==BPF_WRITE ) {verbose (env,"R%d cannot write into %s\n" , regno,reg_type_str (env, reg->type));return -EACCES ;
@@ -5436,15 +5437,13 @@ static int check_helper_mem_access(strucreturn check_mem_region_access (env, regno, reg->off, access_size, reg->map_ptr->key_size, false);case PTR_TO_MAP_VALUE : -if (check_map_access_type (env, regno, reg->off, access_size, - meta && meta->raw_mode ?BPF_WRITE : -BPF_READ )) +if (check_map_access_type (env, regno, reg->off, access_size, access_type))return -EACCES ;return check_map_access (env, regno, reg->off, access_size, zero_size_allowed,ACCESS_HELPER );case PTR_TO_MEM :if (type_is_rdonly_mem (reg->type)) { -if (meta && meta->raw_mode) { +if (access_type ==BPF_WRITE ) {verbose (env,"R%d cannot write into %s\n" , regno,reg_type_str (env, reg->type));return -EACCES ;
@@ -5455,7 +5454,7 @@ static int check_helper_mem_access(struc zero_size_allowed);case PTR_TO_BUF :if (type_is_rdonly_mem (reg->type)) { -if (meta && meta->raw_mode) { +if (access_type ==BPF_WRITE ) {verbose (env,"R%d cannot write into %s\n" , regno,reg_type_str (env, reg->type));return -EACCES ;
@@ -5480,7 +5479,6 @@ static int check_helper_mem_access(struc* Dynamically check it now. */ if (!env->ops->convert_ctx_access) { -enum bpf_access_type atype = meta && meta->raw_mode ?BPF_WRITE :BPF_READ ;int offset = access_size -1 ;/* Allow zero-byte read from PTR_TO_CTX */
@@ -5488,7 +5486,7 @@ static int check_helper_mem_access(strucreturn zero_size_allowed ?0 : -EACCES ;return check_mem_access (env, env->insn_idx, regno, offset,BPF_B , - atype,-1 , false); + access_type,-1 , false); } fallthrough;
@@ -5507,6 +5505,7 @@ static int check_helper_mem_access(strucstatic int check_mem_size_reg (struct bpf_verifier_env *env,struct bpf_reg_state *reg,u32 regno, +enum bpf_access_type access_type,bool zero_size_allowed,struct bpf_call_arg_meta *meta) {
@@ -5522,15 +5521,12 @@ static int check_mem_size_reg(struct bpf*/ meta->msize_max_value = reg->umax_value; -/* The register is SCALAR_VALUE; the access check -* happens using its boundaries. +/* The register is SCALAR_VALUE; the access check happens using +* its boundaries. For unprivileged variable accesses, disable +* raw mode so that the program is required to initialize all +* the memory that the helper could just partially fill up. */ if (!tnum_is_const (reg->var_off)) -/* For unprivileged variable accesses, disable raw -* mode so that the program is required to -* initialize all the memory that the helper could -* just partially fill up. -*/ meta =NULL ;if (reg->smin_value <0 ) {
@@ -5541,8 +5537,7 @@ static int check_mem_size_reg(struct bpfif (reg->umin_value ==0 ) { err =check_helper_mem_access (env, regno -1 ,0 , - zero_size_allowed, - meta); + access_type, zero_size_allowed, meta);if (err)return err; }
@@ -5552,9 +5547,8 @@ static int check_mem_size_reg(struct bpf regno);return -EACCES ; } - err =check_helper_mem_access (env, regno -1 , - reg->umax_value, - zero_size_allowed, meta); + err =check_helper_mem_access (env, regno -1 , reg->umax_value, + access_type, zero_size_allowed, meta);if (!err) err =mark_chain_precision (env, regno);return err;
@@ -5565,13 +5559,11 @@ int check_mem_reg(struct bpf_verifier_en {bool may_be_null =type_may_be_null (reg->type);struct bpf_reg_state saved_reg; -struct bpf_call_arg_meta meta;int err;if (register_is_null (reg))return 0 ; -memset (&meta,0 ,sizeof (meta));/* Assuming that the register contains a value check if the memory * access is safe. Temporarily save and restore the register's state as * the conversion shouldn't be visible to a caller.
@@ -5581,10 +5573,8 @@ int check_mem_reg(struct bpf_verifier_enmark_ptr_not_null_reg (reg); } - err =check_helper_mem_access (env, regno, mem_size, true, &meta); -/* Check access for BPF_WRITE */ - meta.raw_mode = true; - err = err ?:check_helper_mem_access (env, regno, mem_size, true, &meta); + err =check_helper_mem_access (env, regno, mem_size,BPF_READ , true,NULL ); + err = err ?:check_helper_mem_access (env, regno, mem_size,BPF_WRITE , true,NULL );if (may_be_null) *reg = saved_reg;
@@ -5610,13 +5600,12 @@ int check_kfunc_mem_size_reg(struct bpf_mark_ptr_not_null_reg (mem_reg); } - err =check_mem_size_reg (env, reg, regno, true, &meta); -/* Check access for BPF_WRITE */ - meta.raw_mode = true; - err = err ?:check_mem_size_reg (env, reg, regno, true, &meta); + err =check_mem_size_reg (env, reg, regno,BPF_READ , true, &meta); + err = err ?:check_mem_size_reg (env, reg, regno,BPF_WRITE , true, &meta);if (may_be_null) *mem_reg = saved_reg; +return err; }
@@ -6227,9 +6216,8 @@ skip_type_check:verbose (env,"invalid map_ptr to access map->key\n" );return -EACCES ; } - err =check_helper_mem_access (env, regno, - meta->map_ptr->key_size, false, -NULL ); + err =check_helper_mem_access (env, regno, meta->map_ptr->key_size, +BPF_READ , false,NULL );break ;case ARG_PTR_TO_MAP_VALUE :if (type_may_be_null (arg_type) &®ister_is_null (reg))
@@ -6244,9 +6232,9 @@ skip_type_check:return -EACCES ; } meta->raw_mode = arg_type &MEM_UNINIT ; - err =check_helper_mem_access (env, regno, - meta->map_ptr->value_size, false, - meta); + err =check_helper_mem_access (env, regno, meta->map_ptr->value_size, + arg_type &MEM_WRITE ?BPF_WRITE :BPF_READ , + false, meta);break ;case ARG_PTR_TO_PERCPU_BTF_ID :if (!reg->btf_id) {
@@ -6281,7 +6269,9 @@ skip_type_check:*/ meta->raw_mode = arg_type &MEM_UNINIT ;if (arg_type &MEM_FIXED_SIZE ) { - err =check_helper_mem_access (env, regno, fn->arg_size[arg], false, meta); + err =check_helper_mem_access (env, regno, fn->arg_size[arg], + arg_type &MEM_WRITE ?BPF_WRITE :BPF_READ , + false, meta);if (err)return err;if (arg_type &MEM_ALIGNED )
@@ -6289,10 +6279,16 @@ skip_type_check: }break ;case ARG_CONST_SIZE : - err =check_mem_size_reg (env, reg, regno, false, meta); + err =check_mem_size_reg (env, reg, regno, + fn->arg_type[arg -1 ] &MEM_WRITE ? +BPF_WRITE :BPF_READ , + false, meta);break ;case ARG_CONST_SIZE_OR_ZERO : - err =check_mem_size_reg (env, reg, regno, true, meta); + err =check_mem_size_reg (env, reg, regno, + fn->arg_type[arg -1 ] &MEM_WRITE ? +BPF_WRITE :BPF_READ , + true, meta);break ;case ARG_PTR_TO_DYNPTR :/* We only need to check for initialized / uninitialized helper
Greg Kroah-Hartman
maintainerPATCH 52/92 USB: serial: option: add MeiG Smart SRM815
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chukun Pan <[email protected]>
commit c1947d244f807b1f95605b75a4059e7b37b5dcc3 upstream.
It looks like SRM815 shares ID with SRM825L.
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2dee ProdID=4d22 Rev= 4.14 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=123456 C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/serial/option.c +2 -1
@@ -621,7 +621,7 @@ static void option_instat_callback(struc/* MeiG Smart Technology products */ #define MEIGSMART_VENDOR_ID 0x2dee -/* MeiG Smart SRM825L based on Qualcomm 315 */ +/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */ #define MEIGSMART_PRODUCT_SRM825L 0x4d22/* MeiG Smart SLM320 based on UNISOC UIS8910 */ #define MEIGSMART_PRODUCT_SLM320 0x4d41
@@ -2405,6 +2405,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) },
Greg Kroah-Hartman
maintainerPATCH 53/92 USB: serial: option: add Neoway N723-EA support
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hrusecky <[email protected]>
commit f5b435be70cb126866fa92ffc6f89cda9e112c75 upstream.
Update the USB serial option driver to support Neoway N723-EA.
ID 2949:8700 Marvell Mobile Composite Device Bus
T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2949 ProdID=8700 Rev= 1.00 S: Manufacturer=Marvell S: Product=Mobile Composite Device Bus S: SerialNumber=200806006809080000
C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0e(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Tested successfully connecting to the Internet via rndis interface after dialing via AT commands on If#=4 or If#=6.
Not sure of the purpose of the other serial interface.
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -2413,6 +2413,7 @@ static const struct usb_device_id option .driver_info = NCTRL(1) }, { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ .driver_info = NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x2949, 0x8700, 0xff) }, /* Neoway N723-EA */ { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Greg Kroah-Hartman
maintainerPATCH 54/92 staging: iio: ad9834: Correct phase range check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit c0599762f0c7e260b99c6b7bceb8eae69b804c94 upstream.
User Perspective:
When a user sets the phase value, the ad9834_write_phase() is called. The phase register has a 12-bit resolution, so the valid range is 0 to 4095. If the phase offset value of 4096 is input, it effectively exactly equals 0 in the lower 12 bits, meaning no offset.
Reasons for the Change:
1) Original Condition (phase > BIT(AD9834_PHASE_BITS)):
This condition allows a phase value equal to 2^12, which is 4096. However, this value exceeds the valid 12-bit range, as the maximum valid phase value should be 4095.
2) Modified Condition (phase >= BIT(AD9834_PHASE_BITS)):
Ensures that the phase value is within the valid range, preventing invalid datafrom being written.
Impact on Subsequent Logic: st->data = cpu_to_be16(addr | phase):
If the phase value is 2^12, i.e., 4096 (0001 0000 0000 0000), and addr is AD9834_REG_PHASE0 (1100 0000 0000 0000), then addr | phase results in 1101 0000 0000 0000, occupying DB12. According to the section of WRITING TO A PHASE REGISTER in the datasheet, the MSB 12 PHASE0 bits should be DB11. The original condition leads to incorrect DB12 usage, which contradicts the datasheet and could pose potential issues for future updates if DB12 is used in such related cases.
--- drivers/staging/iio/frequency/ad9834.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/frequency/ad9834.c +1 -1
@@ -131,7 +131,7 @@ static int ad9834_write_frequency(structstatic int ad9834_write_phase (struct ad9834_state *st,unsigned long addr,unsigned long phase) { -if (phase >BIT (AD9834_PHASE_BITS )) +if (phase >=BIT (AD9834_PHASE_BITS ))return -EINVAL ; st->data =cpu_to_be16 (addr | phase);
Greg Kroah-Hartman
maintainerPATCH 55/92 staging: iio: ad9832: Correct phase range check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit 4636e859ebe0011f41e35fa79bab585b8004e9a3 upstream.
User Perspective:
When a user sets the phase value, the ad9832_write_phase() is called. The phase register has a 12-bit resolution, so the valid range is 0 to 4095. If the phase offset value of 4096 is input, it effectively exactly equals 0 in the lower 12 bits, meaning no offset.
Reasons for the Change:
1) Original Condition (phase > BIT(AD9832_PHASE_BITS)):
This condition allows a phase value equal to 2^12, which is 4096. However, this value exceeds the valid 12-bit range, as the maximum valid phase value should be 4095.
2) Modified Condition (phase >= BIT(AD9832_PHASE_BITS)):
Ensures that the phase value is within the valid range, preventing invalid datafrom being written.
Impact on Subsequent Logic: st->data = cpu_to_be16(addr | phase):
If the phase value is 2^12, i.e., 4096 (0001 0000 0000 0000), and addr is AD9832_REG_PHASE0 (1100 0000 0000 0000), then addr | phase results in 1101 0000 0000 0000, occupying DB12. According to the section of WRITING TO A PHASE REGISTER in the datasheet, the MSB 12 PHASE0 bits should be DB11. The original condition leads to incorrect DB12 usage, which contradicts the datasheet and could pose potential issues for future updates if DB12 is used in such related cases.
--- drivers/staging/iio/frequency/ad9832.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/frequency/ad9832.c +1 -1
@@ -158,7 +158,7 @@ static int ad9832_write_frequency(structstatic int ad9832_write_phase (struct ad9832_state *st,unsigned long addr,unsigned long phase) { -if (phase >BIT (AD9832_PHASE_BITS )) +if (phase >=BIT (AD9832_PHASE_BITS ))return -EINVAL ; st->phase_data[0] = cpu_to_be16((AD9832_CMD_PHA8BITSW << CMD_SHIFT) |
Greg Kroah-Hartman
maintainerPATCH 56/92 usb-storage: Add max sectors quirk for Nokia 208
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Rintel <[email protected]>
commit cdef30e0774802df2f87024d68a9d86c3b99ca2a upstream.
This fixes data corruption when accessing the internal SD card in mass storage mode.
I am actually not too sure why. I didn't figure a straightforward way to reproduce the issue, but i seem to get garbage when issuing a lot (over 50) of large reads (over 120 sectors) are done in a quick succession. That is, time seems to matter here -- larger reads are fine if they are done with some delay between them.
But I'm not great at understanding this sort of things, so I'll assume the issue other, smarter, folks were seeing with similar phones is the same problem and I'll just put my quirk next to theirs.
The "Software details" screen on the phone is as follows:
V 04.06
07-08-13
RM-849
(c) Nokia
TL;DR version of the device descriptor:
idVendor 0x0421 Nokia Mobile Phones
idProduct 0x06c2
bcdDevice 4.06
iManufacturer 1 Nokia
iProduct 2 Nokia 208
The patch assumes older firmwares are broken too (I'm unable to test, but no biggie if they aren't I guess), and I have no idea if newer firmware exists.
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -255,6 +255,13 @@ UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_MAX_SECTORS_64 ), +/* Added by Lubomir Rintel <[email protected]>, a very fine chap */ +UNUSUAL_DEV( 0x0421, 0x06c2, 0x0000, 0x0406, + "Nokia", + "Nokia 208", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 ), +#ifdef NO_SDDR09 UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100, "Microtech",
Greg Kroah-Hartman
maintainerPATCH 57/92 USB: serial: cp210x: add Phoenix Contact UPS Device
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 854eee93bd6e3dca619d47087af4d65b2045828e upstream.
Phoenix Contact sells UPS Quint devices [1] with a custom datacable [2] that embeds a Silicon Labs converter:
Bus 001 Device 003: ID 1b93:1013 Silicon Labs Phoenix Contact UPS Device Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x1b93 idProduct 0x1013 bcdDevice 1.00 iManufacturer 1 Silicon Labs iProduct 2 Phoenix Contact UPS Device iSerial 3 <redacted>
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0020
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 2 Phoenix Contact UPS Device
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
[1] https://www.phoenixcontact.com/en-pc/products/power-supply-unit-quint-ps-1ac-24dc-10-2866763
[2] https://www.phoenixcontact.com/en-il/products/data-cable-preassembled-ifs-usb-datacable-2320500
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -223,6 +223,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ + { USB_DEVICE(0x1B93, 0x1013) }, /* Phoenix Contact UPS Device */ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */
Greg Kroah-Hartman
maintainerPATCH 58/92 usb: dwc3: gadget: fix writing NYET threshold
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
commit 01ea6bf5cb58b20cc1bd159f0cf74a76cf04bb69 upstream.
Before writing a new value to the register, the old value needs to be masked out for the new value to be programmed as intended, because at least in some cases the reset value of that field is 0xf (max value).
At the moment, the dwc3 core initialises the threshold to the maximum value (0xf), with the option to override it via a DT. No upstream DTs seem to override it, therefore this commit doesn't change behaviour for any upstream platform. Nevertheless, the code should be fixed to have the desired outcome.
Do so.
--- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/gadget.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/usb/dwc3/core.h +1 -0
@@ -447,6 +447,7 @@#define DWC3_DCTL_TRGTULST_SS_INACT (DWC3_DCTL_TRGTULST(6))/* These apply for core versions 1.94a and later */ +#define DWC3_DCTL_NYET_THRES_MASK (0xf << 20)#define DWC3_DCTL_NYET_THRES (n) (((n) & 0xf) << 20)#define DWC3_DCTL_KEEP_CONNECT BIT(19)
drivers/usb/dwc3/gadget.c +3 -1
@@ -4056,8 +4056,10 @@ static void dwc3_gadget_conndone_interru WARN_ONCE(DWC3_VER_IS_PRIOR(DWC3, 240A) && dwc->has_lpm_erratum,"LPM Erratum not available on dwc3 revisions < 2.40a\n" ); - if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) + if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) { + reg &= ~DWC3_DCTL_NYET_THRES_MASK ; reg |=DWC3_DCTL_NYET_THRES (dwc->lpm_nyet_threshold); + }dwc3_gadget_dctl_write_safe (dwc, reg); }else {
Greg Kroah-Hartman
maintainerPATCH 59/92 topology: Keep the cpumask unchanged when printing cpumap
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
commit cbd399f78e23ad4492c174fc5e6b3676dba74a52 upstream.
During fuzz testing, the following warning was discovered:
different return values (15 and 11) from vsnprintf("%*pbl ", ...)
test:keyward is WARNING in kvasprintf
WARNING: CPU: 55 PID: 1168477 at lib/kasprintf.c:30 kvasprintf+0x121/0x130 Call Trace: kvasprintf+0x121/0x130 kasprintf+0xa6/0xe0 bitmap_print_to_buf+0x89/0x100 core_siblings_list_read+0x7e/0xb0 kernfs_file_read_iter+0x15b/0x270 new_sync_read+0x153/0x260 vfs_read+0x215/0x290 ksys_read+0xb9/0x160 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2
The call trace shows that kvasprintf() reported this warning during the printing of core_siblings_list. kvasprintf() has several steps:
(1) First, calculate the length of the resulting formatted string.
(2) Allocate a buffer based on the returned length.
(3) Then, perform the actual string formatting.
(4) Check whether the lengths of the formatted strings returned in steps (1) and (2) are consistent.
If the core_cpumask is modified between steps (1) and (3), the lengths obtained in these two steps may not match. Indeed our test includes cpu hotplugging, which should modify core_cpumask while printing.
To fix this issue, cache the cpumask into a temporary variable before calling cpumap_print_{list, cpumask}_to_buf(), to keep it unchanged during the printing process.
--- drivers/base/topology.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)
drivers/base/topology.c +20 -4
@@ -27,9 +27,17 @@ static ssize_t name##_read(struct file * loff_t off, size_t count) \ { \struct device *dev =kobj_to_dev (kobj); \ +cpumask_var_t mask; \ +ssize_t n; \ \ - return cpumap_print_bitmask_to_buf(buf, topology_##mask(dev->id), \ - off, count); \ +if (!alloc_cpumask_var (&mask,GFP_KERNEL )) \ +return -ENOMEM ; \ + \ + cpumask_copy(mask, topology_##mask(dev->id)); \ + n = cpumap_print_bitmask_to_buf(buf, mask, off, count); \ + free_cpumask_var(mask); \ + \ + return n; \ } \ \ static ssize_t name##_list_read(struct file *file, struct kobject *kobj, \
@@ -37,9 +45,17 @@ static ssize_t name##_list_read(struct f loff_t off, size_t count) \ { \struct device *dev =kobj_to_dev (kobj); \ +cpumask_var_t mask; \ +ssize_t n; \ + \ +if (!alloc_cpumask_var (&mask,GFP_KERNEL )) \ +return -ENOMEM ; \ + \ + cpumask_copy(mask, topology_##mask(dev->id)); \ + n = cpumap_print_list_to_buf(buf, mask, off, count); \ + free_cpumask_var(mask); \ \ - return cpumap_print_list_to_buf(buf, topology_##mask(dev->id), \ - off, count); \ + return n; \ }define_id_show_func (physical_package_id,"%d" );
Greg Kroah-Hartman
maintainerPATCH 60/92 misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rengarajan S <[email protected]>
commit 194f9f94a5169547d682e9bbcc5ae6d18a564735 upstream.
Resolve kernel panic caused by improper handling of IRQs while accessing GPIO values. This is done by replacing generic_handle_irq with handle_nested_irq.
--- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c +1 -1
@@ -273,7 +273,7 @@ static irqreturn_t pci1xxxx_gpio_irq_hanwritel (BIT (bit), priv->reg_base +INTR_STATUS_OFFSET (gpiobank));spin_unlock_irqrestore (&priv->lock, flags); irq =irq_find_mapping (gc->irq.domain, (bit + (gpiobank *32 ))); -generic_handle_irq (irq); +handle_nested_irq (irq); } }spin_lock_irqsave (&priv->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 61/92 misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rengarajan S <[email protected]>
commit c7a5378a0f707686de3ddb489f1653c523bb7dcc upstream.
Driver returns -EOPNOTSUPPORTED on unsupported parameters case in set config. Upper level driver checks for -ENOTSUPP. Because of the return code mismatch, the ioctls from userspace fail. Resolve the issue by passing -ENOTSUPP during unsupported case.
--- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c +1 -1
@@ -148,7 +148,7 @@ static int pci1xxxx_gpio_set_config(strupci1xxx_assign_bit (priv->reg_base,OPENDRAIN_OFFSET (offset), (offset %32 ), true);break ;default : - ret = -EOPNOTSUPP ; + ret = -ENOTSUPP ;break ; }spin_unlock_irqrestore (&priv->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 62/92 usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lianqin Hu <[email protected]>
commit 13014969cbf07f18d62ceea40bd8ca8ec9d36cec upstream.
Considering that in some extreme cases, when performing the unbinding operation, gserial_disconnect has cleared gser->ioport, which triggers gadget reconfiguration, and then calls gs_read_complete, resulting in access to a null pointer. Therefore, ep is disabled before gserial_disconnect sets port to null to prevent this from happening.
Call trace: gs_read_complete+0x58/0x240 usb_gadget_giveback_request+0x40/0x160 dwc3_remove_requests+0x170/0x484 dwc3_ep0_out_start+0xb0/0x1d4 __dwc3_gadget_start+0x25c/0x720 kretprobe_trampoline.cfi_jt+0x0/0x8 kretprobe_trampoline.cfi_jt+0x0/0x8 udc_bind_to_driver+0x1d8/0x300 usb_gadget_probe_driver+0xa8/0x1dc gadget_dev_desc_UDC_store+0x13c/0x188 configfs_write_iter+0x160/0x1f4 vfs_write+0x2d0/0x40c ksys_write+0x7c/0xf0 __arm64_sys_write+0x20/0x30 invoke_syscall+0x60/0x150 el0_svc_common+0x8c/0xf8 do_el0_svc+0x28/0xa0 el0_svc+0x24/0x84
--- drivers/usb/gadget/function/u_serial.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/u_serial.c +4 -4
@@ -1393,6 +1393,10 @@ void gserial_disconnect(struct gserial */* REVISIT as above: how best to track this? */ port->port_line_coding = gser->port_line_coding; +/* disable endpoints, aborting down any active I/O */ +usb_ep_disable (gser->out); +usb_ep_disable (gser->in); + port->port_usb =NULL ; gser->ioport =NULL ;if (port->port.count >0 ) {
@@ -1404,10 +1408,6 @@ void gserial_disconnect(struct gserial *spin_unlock (&port->port_lock);spin_unlock_irqrestore (&serial_port_lock, flags); -/* disable endpoints, aborting down any active I/O */ -usb_ep_disable (gser->out); -usb_ep_disable (gser->in); -/* finally, free any unused/unusable I/O buffers */ spin_lock_irqsave (&port->port_lock, flags);if (port->port.count ==0 )
Greg Kroah-Hartman
maintainerPATCH 63/92 usb: dwc3-am62: Disable autosuspend during remove
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashanth K <[email protected]>
commit 625e70ccb7bbbb2cc912e23c63390946170c085c upstream.
Runtime PM documentation (Section 5) mentions, during remove() callbacks, drivers should undo the runtime PM changes done in probe(). Usually this means calling pm_runtime_disable(), pm_runtime_dont_use_autosuspend() etc. Hence add missing function to disable autosuspend on dwc3-am62 driver unbind.
--- drivers/usb/dwc3/dwc3-am62.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc3/dwc3-am62.c +1 -0
@@ -263,6 +263,7 @@ static int dwc3_ti_remove(struct platforpm_runtime_put_sync (dev);pm_runtime_disable (dev); +pm_runtime_dont_use_autosuspend (dev);pm_runtime_set_suspended (dev);platform_set_drvdata (pdev,NULL );
Greg Kroah-Hartman
maintainerPATCH 64/92 USB: usblp: return error when setting unsupported protocol
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yan <[email protected]>
commit 7a3d76a0b60b3f6fc3375e4de2174bab43f64545 upstream.
Fix the regression introduced by commit d8c6edfa3f4e ("USB:
usblp: don't call usb_set_interface if there's a single alt"), which causes that unsupported protocols can also be set via ioctl when the num_altsetting of the device is 1.
Move the check for protocol support to the earlier stage.
--- drivers/usb/class/usblp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/class/usblp.c +4 -3
@@ -1337,11 +1337,12 @@ static int usblp_set_protocol(struct usbif (protocol <USBLP_FIRST_PROTOCOL || protocol >USBLP_LAST_PROTOCOL )return -EINVAL ; + alts = usblp->protocol[protocol].alt_setting; +if (alts <0 ) +return -EINVAL ; +/* Don't unnecessarily set the interface if there's a single alt. */ if (usblp->intf->num_altsetting >1 ) { - alts = usblp->protocol[protocol].alt_setting; -if (alts <0 ) -return -EINVAL ; r =usb_set_interface (usblp->dev, usblp->ifnum, alts);if (r <0 ) { printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n",
Greg Kroah-Hartman
maintainerPATCH 65/92 USB: core: Disable LPM only for non-suspended ports
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
commit 59bfeaf5454b7e764288d84802577f4a99bf0819 upstream.
There's USB error when tegra board is shutting down:
[ 180.919315] usb 2-3: Failed to set U1 timeout to 0x0,error code -113 [ 180.919995] usb 2-3: Failed to set U1 timeout to 0xa,error code -113 [ 180.920512] usb 2-3: Failed to set U2 timeout to 0x4,error code -113 [ 186.157172] tegra-xusb 3610000.usb: xHCI host controller not responding, assume dead [ 186.157858] tegra-xusb 3610000.usb: HC died; cleaning up [ 186.317280] tegra-xusb 3610000.usb: Timeout while waiting for evaluate context command
The issue is caused by disabling LPM on already suspended ports.
For USB2 LPM, the LPM is already disabled during port suspend. For USB3 LPM, port won't transit to U1/U2 when it's already suspended in U3, hence disabling LPM is only needed for ports that are not suspended.
--- drivers/usb/core/port.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/core/port.c +4 -3
@@ -412,10 +412,11 @@ static int usb_port_runtime_suspend(strustatic void usb_port_shutdown (struct device *dev) {struct usb_port *port_dev =to_usb_port (dev); +struct usb_device *udev = port_dev->child; -if (port_dev->child) { -usb_disable_usb2_hardware_lpm (port_dev->child); -usb_unlocked_disable_lpm (port_dev->child); +if (udev && !udev->port_is_suspended) { +usb_disable_usb2_hardware_lpm (udev); +usb_unlocked_disable_lpm (udev); } }
Greg Kroah-Hartman
maintainerPATCH 66/92 usb: fix reference leak in usb_new_device()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 0df11fa8cee5a9cf8753d4e2672bb3667138c652 upstream.
When device_add(&udev->dev) succeeds and a later call fails, usb_new_device() does not properly call device_del(). As comment of device_add() says, 'if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count'.
Found by code review.
--- drivers/usb/core/hub.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/core/hub.c +4 -2
@@ -2632,13 +2632,13 @@ int usb_new_device(struct usb_device *ud err =sysfs_create_link (&udev->dev.kobj, &port_dev->dev.kobj,"port" );if (err) - goto fail; + goto out_del_dev; err =sysfs_create_link (&port_dev->dev.kobj, &udev->dev.kobj,"device" );if (err) {sysfs_remove_link (&udev->dev.kobj,"port" ); - goto fail; + goto out_del_dev; }if (!test_and_set_bit (port1, hub->child_usage_bits))
@@ -2650,6 +2650,8 @@ int usb_new_device(struct usb_device *udpm_runtime_put_sync_autosuspend (&udev->dev);return err; +out_del_dev: +device_del (&udev->dev); fail:usb_set_device_state (udev,USB_STATE_NOTATTACHED );pm_runtime_disable (&udev->dev);
Greg Kroah-Hartman
maintainerPATCH 67/92 usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashanth K <[email protected]>
commit 057bd54dfcf68b1f67e6dfc32a47a72e12198495 upstream.
Currently afunc_bind sets std_ac_if_desc.bNumEndpoints to 1 if controls (mute/volume) are enabled. During next afunc_bind call, bNumEndpoints would be unchanged and incorrectly set to 1 even if the controls aren't enabled.
Fix this by resetting the value of bNumEndpoints to 0 on every afunc_bind call.
--- drivers/usb/gadget/function/f_uac2.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/function/f_uac2.c +1 -0
@@ -1176,6 +1176,7 @@ afunc_bind(struct usb_configuration *cfg uac2->as_in_alt =0 ; } + std_ac_if_desc.bNumEndpoints =0 ;if (FUOUT_EN (uac2_opts) ||FUIN_EN (uac2_opts)) { uac2->int_ep =usb_ep_autoconfig (gadget, &fs_ep_int_desc);if (!uac2->int_ep) {
Greg Kroah-Hartman
maintainerPATCH 68/92 usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akash M <[email protected]>
commit dfc51e48bca475bbee984e90f33fdc537ce09699 upstream.
This commit addresses an issue related to below kernel panic where panic_on_warn is enabled. It is caused by the unnecessary use of WARN_ON in functionsfs_bind, which easily leads to the following scenarios.
1.adb_write in adbd 2. UDC write via configfs
================= =====================
->usb_ffs_open_thread() ->UDC write
->open_functionfs() ->configfs_write_iter()
->adb_open() ->gadget_dev_desc_UDC_store()
->adb_write() ->usb_gadget_register_driver_owner
->driver_register()
->StartMonitor() ->bus_add_driver()
->adb_read() ->gadget_bind_driver()
<times-out without BIND event> ->configfs_composite_bind()
->usb_add_function()
->open_functionfs() ->ffs_func_bind()
->adb_open() ->functionfs_bind()
<ffs->state !=FFS_ACTIVE>The adb_open, adb_read, and adb_write operations are invoked from the daemon, but trying to bind the function is a process that is invoked by UDC write through configfs, which opens up the possibility of a race condition between the two paths. In this race scenario, the kernel panic occurs due to the WARN_ON from functionfs_bind when panic_on_warn is enabled. This commit fixes the kernel panic by removing the unnecessary WARN_ON.
Kernel panic - not syncing: kernel: panic_on_warn set ... [ 14.542395] Call trace: [ 14.542464] ffs_func_bind+0x1c8/0x14a8 [ 14.542468] usb_add_function+0xcc/0x1f0 [ 14.542473] configfs_composite_bind+0x468/0x588 [ 14.542478] gadget_bind_driver+0x108/0x27c [ 14.542483] really_probe+0x190/0x374 [ 14.542488] __driver_probe_device+0xa0/0x12c [ 14.542492] driver_probe_device+0x3c/0x220 [ 14.542498] __driver_attach+0x11c/0x1fc [ 14.542502] bus_for_each_dev+0x104/0x160 [ 14.542506] driver_attach+0x24/0x34 [ 14.542510] bus_add_driver+0x154/0x270 [ 14.542514] driver_register+0x68/0x104 [ 14.542518] usb_gadget_register_driver_owner+0x48/0xf4 [ 14.542523] gadget_dev_desc_UDC_store+0xf8/0x144 [ 14.542526] configfs_write_iter+0xf0/0x138
--- drivers/usb/gadget/function/f_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +1 -1
@@ -1868,7 +1868,7 @@ static int functionfs_bind(struct ffs_daENTER (); -if (WARN_ON (ffs->state !=FFS_ACTIVE +if ((ffs->state !=FFS_ACTIVE ||test_and_set_bit (FFS_FL_BOUND , &ffs->flags)))return -EBADFD ;
Greg Kroah-Hartman
maintainerPATCH 69/92 iio: pressure: zpa2326: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 6007d10c5262f6f71479627c1216899ea7f09073 upstream.
The 'sample' local struct is used to push data to user space from a triggered buffer, but it has a hole between the temperature and the timestamp (u32 pressure, u16 temperature, GAP, u64 timestamp). This hole is never initialized.
Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace.
--- drivers/iio/pressure/zpa2326.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/pressure/zpa2326.c +2 -0
@@ -586,6 +586,8 @@ static int zpa2326_fill_sample_buffer(st } sample;int err; +memset (&sample,0 ,sizeof (sample)); +if (test_bit (0 , indio_dev->active_scan_mask)) {/* Get current pressure from hardware FIFO. */ err =zpa2326_dequeue_pressure (indio_dev, &sample.pressure);
Greg Kroah-Hartman
maintainerPATCH 70/92 iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 333be433ee908a53f283beb95585dfc14c8ffb46 upstream.
The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.
Use kzalloc for the memory allocation to avoid pushing uninitialized information to userspace.
--- drivers/iio/dummy/iio_simple_dummy_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dummy/iio_simple_dummy_buffer.c +1 -1
@@ -48,7 +48,7 @@ static irqreturn_t iio_simple_dummy_trigint i =0 , j;u16 *data; - data =kmalloc (indio_dev->scan_bytes,GFP_KERNEL ); + data =kzalloc (indio_dev->scan_bytes,GFP_KERNEL );if (!data) goto done;
Greg Kroah-Hartman
maintainerPATCH 71/92 iio: light: vcnl4035: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 47b43e53c0a0edf5578d5d12f5fc71c019649279 upstream.
The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the single data element, which is an u16 aligned to 8 bytes. That leaves at least 4 bytes uninitialized even after writing an integer value with regmap_read().
Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.
--- drivers/iio/light/vcnl4035.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/light/vcnl4035.c +1 -1
@@ -105,7 +105,7 @@ static irqreturn_t vcnl4035_trigger_consstruct iio_dev *indio_dev = pf->indio_dev;struct vcnl4035_data *data =iio_priv (indio_dev);/* Ensure naturally aligned timestamp */ -u8 buffer[ALIGN (sizeof (u16),sizeof (s64)) +sizeof (s64)]__aligned(8) ; +u8 buffer[ALIGN (sizeof (u16),sizeof (s64)) +sizeof (s64)]__aligned(8) = { };int ret; ret =regmap_read (data->regmap,VCNL4035_ALS_DATA , (int *)buffer);
Greg Kroah-Hartman
maintainerPATCH 72/92 iio: imu: kmx61: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 6ae053113f6a226a2303caa4936a4c37f3bfff7b upstream.
The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.
Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.
--- drivers/iio/imu/kmx61.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/kmx61.c +1 -1
@@ -1192,7 +1192,7 @@ static irqreturn_t kmx61_trigger_handlerstruct kmx61_data *data =kmx61_get_data (indio_dev);int bit, ret, i =0 ;u8 base; -s16 buffer[8 ]; +s16 buffer[8 ] = { };if (indio_dev == data->acc_indio_dev) base =KMX61_ACC_XOUT_L ;
Greg Kroah-Hartman
maintainerPATCH 73/92 iio: adc: ti-ads8688: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 2a7377ccfd940cd6e9201756aff1e7852c266e69 upstream.
The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.
Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.
--- drivers/iio/adc/ti-ads8688.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ti-ads8688.c +1 -1
@@ -382,7 +382,7 @@ static irqreturn_t ads8688_trigger_handlstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;/* Ensure naturally aligned timestamp */ -u16 buffer[ADS8688_MAX_CHANNELS +sizeof (s64)/sizeof (u16)]__aligned(8) ; +u16 buffer[ADS8688_MAX_CHANNELS +sizeof (s64)/sizeof (u16)]__aligned(8) = { };int i, j =0 ;for (i =0 ; i < indio_dev->masklength; i++) {
Greg Kroah-Hartman
maintainerPATCH 74/92 iio: gyro: fxas21002c: Fix missing data update in trigger handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Song <[email protected]>
commit fa13ac6cdf9b6c358e7d77c29fb60145c7a87965 upstream.
The fxas21002c_trigger_handler() may fail to acquire sample data because the runtime PM enters the autosuspend state and sensor can not return sample data in standby mode..
Resume the sensor before reading the sample data into the buffer within the trigger handler. After the data is read, place the sensor back into the autosuspend state.
--- drivers/iio/gyro/fxas21002c_core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/iio/gyro/fxas21002c_core.c +8 -1
@@ -730,14 +730,21 @@ static irqreturn_t fxas21002c_trigger_haint ret;mutex_lock (&data->lock); + ret =fxas21002c_pm_get (data); +if (ret <0 ) + goto out_unlock; + ret =regmap_bulk_read (data->regmap,FXAS21002C_REG_OUT_X_MSB , data->buffer,CHANNEL_SCAN_MAX *sizeof (s16));if (ret <0 ) - goto out_unlock; + goto out_pm_put;iio_push_to_buffers_with_timestamp (indio_dev, data->buffer, data->timestamp); +out_pm_put: +fxas21002c_pm_put (data); + out_unlock:mutex_unlock (&data->lock);
Greg Kroah-Hartman
maintainerPATCH 75/92 iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 2a8e34096ec70d73ebb6d9920688ea312700cbd9 upstream.
Using gpiod_set_value() to control the reset GPIO causes some verbose warnings during boot when the reset GPIO is controlled by an I2C IO expander.
As the caller can sleep, use the gpiod_set_value_cansleep() variant to fix the issue.
Tested on a custom i.MX93 board with a ADS124S08 ADC.
--- drivers/iio/adc/ti-ads124s08.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/ti-ads124s08.c +2 -2
@@ -183,9 +183,9 @@ static int ads124s_reset(struct iio_devstruct ads124s_private *priv =iio_priv (indio_dev);if (priv->reset_gpio) { -gpiod_set_value (priv->reset_gpio,0 ); +gpiod_set_value_cansleep (priv->reset_gpio,0 );udelay (200 ); -gpiod_set_value (priv->reset_gpio,1 ); +gpiod_set_value_cansleep (priv->reset_gpio,1 ); }else {return ads124s_write_cmd (indio_dev,ADS124S08_CMD_RESET ); }
Greg Kroah-Hartman
maintainerPATCH 76/92 iio: adc: at91: call input_free_device() on allocated iio_dev
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
commit de6a73bad1743e9e81ea5a24c178c67429ff510b upstream.
Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached before the allocated iio_dev is stored to st->ts_input. Thus call input_free_device() on input instead of st->ts_input.
--- drivers/iio/adc/at91_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/at91_adc.c +1 -1
@@ -985,7 +985,7 @@ static int at91_ts_register(struct iio_dreturn ret; err: -input_free_device (st->ts_input); +input_free_device (input);return ret; }
Greg Kroah-Hartman
maintainerPATCH 77/92 iio: inkern: call iio_device_put() only on mapped devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
commit 64f43895b4457532a3cc524ab250b7a30739a1b1 upstream.
In the error path of iio_channel_get_all(), iio_device_put() is called on all IIO devices, which can cause a refcount imbalance. Fix this error by calling iio_device_put() only on IIO devices whose refcounts were previously incremented by iio_device_get().
--- drivers/iio/inkern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/inkern.c +1 -1
@@ -513,7 +513,7 @@ struct iio_channel *iio_channel_get_all(return chans; error_free_chans: -for (i =0 ; i < nummaps; i++) +for (i =0 ; i < mapind; i++)iio_device_put (chans[i].indio_dev);kfree (chans); error_ret:
Greg Kroah-Hartman
maintainerPATCH 78/92 iio: adc: ad7124: Disable all channels at probe time
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit 4be339af334c283a1a1af3cb28e7e448a0aa8a7c upstream.
When during a measurement two channels are enabled, two measurements are done that are reported sequencially in the DATA register. As the code triggered by reading one of the sysfs properties expects that only one channel is enabled it only reads the first data set which might or might not belong to the intended channel.
To prevent this situation disable all channels during probe. This fixes a problem in practise because the reset default for channel 0 is enabled. So all measurements before the first measurement on channel 0 (which disables channel 0 at the end) might report wrong values.
--- drivers/iio/adc/ad7124.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iio/adc/ad7124.c +3 -0
@@ -931,6 +931,9 @@ static int ad7124_setup(struct ad7124_st* set all channels to this default value. */ ad7124_set_channel_odr (st, i,10 ); + +/* Disable all channels to prevent unintended conversions. */ +ad_sd_write_reg (&st->sd,AD7124_CHANNEL (i),2 ,0 ); }return ret;
Greg Kroah-Hartman
maintainerPATCH 79/92 io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
Commit c9a40292a44e78f71258b8522655bffaf5753bdb upstream.
io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls io_eventfd_free() directly if the refcount drops to zero. This isn't correct, as any potential freeing of the io_ev_fd should be deferred another RCU grace period.
Just call io_eventfd_put() rather than open-code the dec-and-test and free, which will correctly defer it another RCU grace period.
--- io_uring/io_uring.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
io_uring/io_uring.c +9 -4
@@ -479,6 +479,13 @@ static __cold void io_queue_deferred(str } } +static void io_eventfd_free (struct rcu_head *rcu) +{ + struct io_ev_fd *ev_fd = container_of(rcu, struct io_ev_fd, rcu); + +eventfd_ctx_put (ev_fd->cq_ev_fd); +kfree (ev_fd); +}static void io_eventfd_ops (struct rcu_head *rcu) {
@@ -492,10 +499,8 @@ static void io_eventfd_ops(struct rcu_he* ordering in a race but if references are 0 we know we have to free * it regardless. */ -if (atomic_dec_and_test (&ev_fd->refs)) { -eventfd_ctx_put (ev_fd->cq_ev_fd); -kfree (ev_fd); - } +if (atomic_dec_and_test (&ev_fd->refs)) +call_rcu (&ev_fd->rcu, io_eventfd_free); }static void io_eventfd_signal (struct io_ring_ctx *ctx)
Greg Kroah-Hartman
maintainerPATCH 80/92 ARM: dts: imxrt1050: Fix clocks for mmc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Taube <[email protected]>
[ Upstream commit 5f122030061db3e5d2bddd9cf5c583deaa6c54ff ]
One of the usdhc1 controller's clocks should be IMXRT1050_CLK_AHB_PODF not IMXRT1050_CLK_OSC.
--- arch/arm/boot/dts/imxrt1050.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imxrt1050.dtsi +1 -1
@@ -87,7 +87,7 @@ reg = <0x402c0000 0x4000>; interrupts = <110>; clocks = <&clks IMXRT1050_CLK_IPG_PDOF>, - <&clks IMXRT1050_CLK_OSC>, + <&clks IMXRT1050_CLK_AHB_PODF>, <&clks IMXRT1050_CLK_USDHC1>; clock-names = "ipg", "ahb", "per"; bus-width = <4>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/92 block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit fcede1f0a043ccefe9bc6ad57f12718e42f63f1d ]
Our syzkaller report a following UAF for v6.6:
BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read of size 8 at addr ffff8881b57147d8 by task fsstress/232726 CPU: 2 PID: 232726 Comm: fsstress Not tainted 6.6.0-g3629d1885222 #39 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description.constprop.0+0x66/0x300 mm/kasan/report.c:364 print_report+0x3e/0x70 mm/kasan/report.c:475 kasan_report+0xb8/0xf0 mm/kasan/report.c:588 hlist_add_head include/linux/list.h:1023 [inline] bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 __submit_bio+0xa0/0x6b0 block/blk-core.c:639 __submit_bio_noacct_mq block/blk-core.c:718 [inline] submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 __ext4_read_bh fs/ext4/super.c:205 [inline] ext4_read_bh+0x15e/0x2e0 fs/ext4/super.c:230 __read_extent_tree_block+0x304/0x6f0 fs/ext4/extents.c:567 ext4_find_extent+0x479/0xd20 fs/ext4/extents.c:947 ext4_ext_map_blocks+0x1a3/0x2680 fs/ext4/extents.c:4182 ext4_map_blocks+0x929/0x15a0 fs/ext4/inode.c:660 ext4_iomap_begin_report+0x298/0x480 fs/ext4/inode.c:3569 iomap_iter+0x3dd/0x1010 fs/iomap/iter.c:91 iomap_fiemap+0x1f4/0x360 fs/iomap/fiemap.c:80 ext4_fiemap+0x181/0x210 fs/ext4/extents.c:5051 ioctl_fiemap.isra.0+0x1b4/0x290 fs/ioctl.c:220 do_vfs_ioctl+0x31c/0x11a0 fs/ioctl.c:811 __do_sys_ioctl fs/ioctl.c:869 [inline] __se_sys_ioctl+0xae/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Allocated by task 232719: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:768 [inline] slab_alloc_node mm/slub.c:3492 [inline] kmem_cache_alloc_node+0x1b8/0x6f0 mm/slub.c:3537 bfq_get_queue+0x215/0x1f00 block/bfq-iosched.c:5869 bfq_get_bfqq_handle_split+0x167/0x5f0 block/bfq-iosched.c:6776 bfq_init_rq+0x13a4/0x17a0 block/bfq-iosched.c:6938 bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 __submit_bio+0xa0/0x6b0 block/blk-core.c:639 __submit_bio_noacct_mq block/blk-core.c:718 [inline] submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 __ext4_read_bh fs/ext4/super.c:205 [inline] ext4_read_bh_nowait+0x15a/0x240 fs/ext4/super.c:217 ext4_read_bh_lock+0xac/0xd0 fs/ext4/super.c:242 ext4_bread_batch+0x268/0x500 fs/ext4/inode.c:958 __ext4_find_entry+0x448/0x10f0 fs/ext4/namei.c:1671 ext4_lookup_entry fs/ext4/namei.c:1774 [inline] ext4_lookup.part.0+0x359/0x6f0 fs/ext4/namei.c:1842 ext4_lookup+0x72/0x90 fs/ext4/namei.c:1839 __lookup_slow+0x257/0x480 fs/namei.c:1696 lookup_slow fs/namei.c:1713 [inline] walk_component+0x454/0x5c0 fs/namei.c:2004 link_path_walk.part.0+0x773/0xda0 fs/namei.c:2331 link_path_walk fs/namei.c:3826 [inline] path_openat+0x1b9/0x520 fs/namei.c:3826 do_filp_open+0x1b7/0x400 fs/namei.c:3857 do_sys_openat2+0x5dc/0x6e0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x148/0x200 fs/open.c:1454 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Freed by task 232726: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] __kasan_slab_free+0x12a/0x1b0 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1827 [inline] slab_free_freelist_hook mm/slub.c:1853 [inline] slab_free mm/slub.c:3820 [inline] kmem_cache_free+0x110/0x760 mm/slub.c:3842 bfq_put_queue+0x6a7/0xfb0 block/bfq-iosched.c:5428 bfq_forget_entity block/bfq-wf2q.c:634 [inline] bfq_put_idle_entity+0x142/0x240 block/bfq-wf2q.c:645 bfq_forget_idle+0x189/0x1e0 block/bfq-wf2q.c:671 bfq_update_vtime block/bfq-wf2q.c:1280 [inline] __bfq_lookup_next_entity block/bfq-wf2q.c:1374 [inline] bfq_lookup_next_entity+0x350/0x480 block/bfq-wf2q.c:1433 bfq_update_next_in_service+0x1c0/0x4f0 block/bfq-wf2q.c:128 bfq_deactivate_entity+0x10a/0x240 block/bfq-wf2q.c:1188 bfq_deactivate_bfqq block/bfq-wf2q.c:1592 [inline] bfq_del_bfqq_busy+0x2e8/0xad0 block/bfq-wf2q.c:1659 bfq_release_process_ref+0x1cc/0x220 block/bfq-iosched.c:3139 bfq_split_bfqq+0x481/0xdf0 block/bfq-iosched.c:6754 bfq_init_rq+0xf29/0x17a0 block/bfq-iosched.c:6934 bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 __submit_bio+0xa0/0x6b0 block/blk-core.c:639 __submit_bio_noacct_mq block/blk-core.c:718 [inline] submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 __ext4_read_bh fs/ext4/super.c:205 [inline] ext4_read_bh+0x15e/0x2e0 fs/ext4/super.c:230 __read_extent_tree_block+0x304/0x6f0 fs/ext4/extents.c:567 ext4_find_extent+0x479/0xd20 fs/ext4/extents.c:947 ext4_ext_map_blocks+0x1a3/0x2680 fs/ext4/extents.c:4182 ext4_map_blocks+0x929/0x15a0 fs/ext4/inode.c:660 ext4_iomap_begin_report+0x298/0x480 fs/ext4/inode.c:3569 iomap_iter+0x3dd/0x1010 fs/iomap/iter.c:91 iomap_fiemap+0x1f4/0x360 fs/iomap/fiemap.c:80 ext4_fiemap+0x181/0x210 fs/ext4/extents.c:5051 ioctl_fiemap.isra.0+0x1b4/0x290 fs/ioctl.c:220 do_vfs_ioctl+0x31c/0x11a0 fs/ioctl.c:811 __do_sys_ioctl fs/ioctl.c:869 [inline] __se_sys_ioctl+0xae/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2
commit 1ba0403ac644 ("block, bfq: fix uaf for accessing waker_bfqq after splitting") fix the problem that if waker_bfqq is in the merge chain, and current is the only procress, waker_bfqq can be freed from bfq_split_bfqq(). However, the case that waker_bfqq is not in the merge chain is missed, and if the procress reference of waker_bfqq is 0, waker_bfqq can be freed as well.
Fix the problem by checking procress reference if waker_bfqq is not in the merge_chain.
--- block/bfq-iosched.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
block/bfq-iosched.c +10 -2
@@ -6733,16 +6733,24 @@ static struct bfq_queue *bfq_waker_bfqq(struct bfq_queue *bfqq)if (new_bfqq == waker_bfqq) {/* * If waker_bfqq is in the merge chain, and current -* is the only procress. +* is the only process, waker_bfqq can be freed. */ if (bfqq_process_refs (waker_bfqq) ==1 )return NULL ; -break ; + +return waker_bfqq; } new_bfqq = new_bfqq->new_bfqq; } +/* +* If waker_bfqq is not in the merge chain, and it's procress reference +* is 0, waker_bfqq can be freed. +*/ +if (bfqq_process_refs (waker_bfqq) ==0 ) +return NULL ; +return waker_bfqq; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/92 arm64: dts: rockchip: add hevc power domain clock to rk3328
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Geis <[email protected]>
[ Upstream commit 3699f2c43ea9984e00d70463f8c29baaf260ea97 ]
There is a race condition at startup between disabling power domains not used and disabling clocks not used on the rk3328. When the clocks are disabled first, the hevc power domain fails to shut off leading to a splat of failures. Add the hevc core clock to the rk3328 power domain node to prevent this condition.
rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 3-.... }1087 jiffies s: 89 root: 0x8/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 0 to CPUs 3:
NMI backtrace for cpu 3
CPU: 3 UID: 0 PID: 86 Comm: kworker/3:3 Not tainted 6.12.0-rc5+ #53 Hardware name: Firefly ROC-RK3328-CC (DT) Workqueue: pm genpd_power_off_work_fn pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : regmap_unlock_spinlock+0x18/0x30 lr : regmap_read+0x60/0x88
sp : ffff800081123c00
x29: ffff800081123c00 x28: ffff2fa4c62cad80 x27: 0000000000000000
x26: ffffd74e6e660eb8 x25: ffff2fa4c62cae00 x24: 0000000000000040
x23: ffffd74e6d2f3ab8 x22: 0000000000000001 x21: ffff800081123c74
x20: 0000000000000000 x19: ffff2fa4c0412000 x18: 0000000000000000
x17: 77202c31203d2065 x16: 6c6469203a72656c x15: 6c6f72746e6f632d
x14: 7265776f703a6e6f x13: 2063766568206e69 x12: 616d6f64202c3431
x11: 347830206f742030 x10: 3430303034783020 x9 : ffffd74e6c7369e0 x8 : 3030316666206e69 x7 : 205d383738353733 x6 : 332e31202020205b x5 : ffffd74e6c73fc88 x4 : ffffd74e6c73fcd4 x3 : ffffd74e6c740b40 x2 : ffff800080015484 x1 : 0000000000000000 x0 : ffff2fa4c0412000
Call trace: regmap_unlock_spinlock+0x18/0x30 rockchip_pmu_set_idle_request+0xac/0x2c0 rockchip_pd_power+0x144/0x5f8 rockchip_pd_power_off+0x1c/0x30 _genpd_power_off+0x9c/0x180 genpd_power_off.part.0.isra.0+0x130/0x2a8 genpd_power_off_work_fn+0x6c/0x98 process_one_work+0x170/0x3f0 worker_thread+0x290/0x4a8 kthread+0xec/0xf8 ret_from_fork+0x10/0x20
rockchip-pm-domain ff100000.syscon:power-controller: failed to get ack on domain 'hevc', val=0x88220
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +1 -0
@@ -302,6 +302,7 @@ power-domain@RK3328_PD_HEVC { reg = <RK3328_PD_HEVC>; + clocks = <&cru SCLK_VENC_CORE>; #power-domain-cells = <0>; }; power-domain@RK3328_PD_VIDEO {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/92 of: unittest: Add bus address range parsing tests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit 6d32dadb11a6480be62c6ada901bbdcbda1775c9 ]
While there are tests for "dma-ranges" helpers, "ranges" is missing any tests. It's the same underlying code, but for completeness add a test for "ranges" parsing iterators. This is in preparation to add some additional "ranges" helpers.
Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
--- drivers/of/unittest.c | 53 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+)
drivers/of/unittest.c +53 -0
@@ -1019,6 +1019,58 @@ static void __init of_unittest_pci_dma_ranges(void)of_node_put (np); } +static void __init of_unittest_bus_ranges (void ) +{ +struct device_node *np; +struct of_range range; +struct of_range_parser parser; +int i =0 ; + + np =of_find_node_by_path ("/testcase-data/address-tests" ); +if (!np) { +pr_err ("missing testcase data\n" ); +return ; + } + +if (of_range_parser_init (&parser, np)) { +pr_err ("missing ranges property\n" ); +return ; + } + +/* +* Get the "ranges" from the device tree +*/ +for_each_of_range (&parser, &range) { +unittest (range.flags ==IORESOURCE_MEM , +"for_each_of_range wrong flags on node %pOF flags=%x (expected %x)\n" , + np, range.flags,IORESOURCE_MEM ); +if (!i) { +unittest (range.size ==0x40000000 , +"for_each_of_range wrong size on node %pOF size=%llx\n" , + np, range.size); +unittest (range.cpu_addr ==0x70000000 , +"for_each_of_range wrong CPU addr (%llx) on node %pOF" , + range.cpu_addr, np); +unittest (range.bus_addr ==0x70000000 , +"for_each_of_range wrong bus addr (%llx) on node %pOF" , + range.pci_addr, np); + }else { +unittest (range.size ==0x20000000 , +"for_each_of_range wrong size on node %pOF size=%llx\n" , + np, range.size); +unittest (range.cpu_addr ==0xd0000000 , +"for_each_of_range wrong CPU addr (%llx) on node %pOF" , + range.cpu_addr, np); +unittest (range.bus_addr ==0x00000000 , +"for_each_of_range wrong bus addr (%llx) on node %pOF" , + range.pci_addr, np); + } + i++; + } + +of_node_put (np); +} +static void __init of_unittest_parse_interrupts (void ) {struct device_node *np;
@@ -3521,6 +3573,7 @@ static int __init of_unittest(void)of_unittest_dma_get_max_cpu_address ();of_unittest_parse_dma_ranges ();of_unittest_pci_dma_ranges (); +of_unittest_bus_ranges ();of_unittest_match_node ();of_unittest_platform_populate ();of_unittest_overlay ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/92 of/address: Add support for 3 address cell bus
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit 3d5089c4263d3594dc055e0f9c5cb990505cdd64 ]
There's a few custom bus bindings (e.g. fsl,qoriq-mc) which use a 3 cell format with custom flags in the high cell. We can match these buses as a fallback if we didn't match on PCI bus which is the only standard bus binding with 3 address cells.
Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
--- drivers/of/address.c | 22 ++++++++ drivers/of/unittest-data/tests-address.dtsi | 9 +++- drivers/of/unittest.c | 58 ++++++++++++++++++++- 3 files changed, 87 insertions(+), 2 deletions(-)
drivers/of/address.c +22 -0
@@ -95,11 +95,17 @@ static int of_bus_default_translate(__be32 *addr, u64 offset, int na)return 0 ; } +static unsigned int of_bus_default_flags_get_flags (const __be32 *addr) +{ +return of_read_number (addr,1 ); +} +static unsigned int of_bus_default_get_flags (const __be32 *addr) {return IORESOURCE_MEM ; } +#ifdef CONFIG_PCI static unsigned int of_bus_pci_get_flags (const __be32 *addr) {
@@ -319,6 +325,11 @@ static unsigned int of_bus_isa_get_flags(const __be32 *addr)return flags; } +static int of_bus_default_flags_match (struct device_node *np) +{ +return of_bus_n_addr_cells (np) ==3 ; +} +/* * Array of bus specific translators */
@@ -348,6 +359,17 @@ static struct of_bus of_busses[] = { .has_flags = true, .get_flags = of_bus_isa_get_flags, }, +/* Default with flags cell */ + { + .name = "default-flags", + .addresses = "reg", + .match = of_bus_default_flags_match, + .count_cells = of_bus_default_count_cells, + .map = of_bus_default_map, + .translate = of_bus_default_translate, + .has_flags = true, + .get_flags = of_bus_default_flags_get_flags, + }, /* Default */ { .name = "default",
drivers/of/unittest-data/tests-address.dtsi +8 -1
@@ -14,7 +14,7 @@ #size-cells = <1>; /* ranges here is to make sure we don't use it for * dma-ranges translation */ - ranges = <0x70000000 0x70000000 0x40000000>, + ranges = <0x70000000 0x70000000 0x50000000>, <0x00000000 0xd0000000 0x20000000>; dma-ranges = <0x0 0x20000000 0x40000000>;
@@ -43,6 +43,13 @@ <0x42000000 0x0 0xc0000000 0x20000000 0x0 0x10000000>; }; + bus@a0000000 { + #address-cells = <3>; + #size-cells = <2>; + ranges = <0xf00baa 0x0 0x0 0xa0000000 0x0 0x100000>, + <0xf00bee 0x1 0x0 0xb0000000 0x0 0x200000>; + }; + }; }; };
drivers/of/unittest.c +57 -1
76 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/92 of: address: Fix address translation when address-size is greater than 2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit 42604f8eb7ba04b589375049cc76282dad4677d2 ]
With the recent addition of of_pci_prop_ranges() in commit 407d1a51921e ("PCI: Create device tree node for bridge"), the ranges property can have a 3 cells child address, a 3 cells parent address and a 2 cells child size.
A range item property for a PCI device is filled as follow:
<BAR_nbr> 0 0 <phys.hi> <phys.mid> <phys.low> <BAR_sizeh> <BAR_sizel> <-- Child --> <-- Parent (PCI definition) --> <- BAR size (64bit) -->
This allow to translate BAR addresses from the DT. For instance:
pci@0,0 {
#address-cells = <0x03>;
#size-cells = <0x02>;
device_type = "pci";
compatible = "pci11ab,100", "pciclass,060400", "pciclass,0604"; ranges = <0x82000000 0x00 0xe8000000
0x82000000 0x00 0xe8000000
0x00 0x4400000>;
...
dev@0,0 {
#address-cells = <0x03>;
#size-cells = <0x02>;
compatible = "pci1055,9660", "pciclass,020000", "pciclass,0200";
/* Translations for BAR0 to BAR5 */
ranges = <0x00 0x00 0x00 0x82010000 0x00 0xe8000000 0x00 0x2000000
0x01 0x00 0x00 0x82010000 0x00 0xea000000 0x00 0x1000000
0x02 0x00 0x00 0x82010000 0x00 0xeb000000 0x00 0x800000
0x03 0x00 0x00 0x82010000 0x00 0xeb800000 0x00 0x800000
0x04 0x00 0x00 0x82010000 0x00 0xec000000 0x00 0x20000
0x05 0x00 0x00 0x82010000 0x00 0xec020000 0x00 0x2000>;
...
pci-ep-bus@0 {
#address-cells = <0x01>;
#size-cells = <0x01>;
compatible = "simple-bus";
/* Translate 0xe2000000 to BAR0 and 0xe0000000 to BAR1 */
ranges = <0xe2000000 0x00 0x00 0x00 0x2000000
0xe0000000 0x01 0x00 0x00 0x1000000>;
...
}; };
};
During the translation process, the "default-flags" map() function is used to select the matching item in the ranges table and determine the address offset from this matching item.
This map() function simply calls of_read_number() and when address-size is greater than 2, the map() function skips the extra high address part (ie part over 64bit). This lead to a wrong matching item and a wrong offset computation.
Also during the translation itself, the extra high part related to the parent address is not present in the translated address.
Fix the "default-flags" map() and translate() in order to take into account the child extra high address part in map() and the parent extra high address part in translate() and so having a correct address translation for ranges patterns such as the one given in the example above.
Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
--- drivers/of/address.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-)
drivers/of/address.c +28 -2
@@ -105,6 +105,32 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr)return IORESOURCE_MEM ; } +static u64 of_bus_default_flags_map (__be32 *addr,const __be32 *range,int na, +int ns,int pna) +{ +u64 cp, s, da; + +/* Check that flags match */ +if (*addr != *range) +return OF_BAD_ADDR ; + +/* Read address values, skipping high cell */ + cp =of_read_number (range +1 , na -1 ); + s =of_read_number (range + na + pna, ns); + da =of_read_number (addr +1 , na -1 ); + +pr_debug ("default flags map, cp=%llx, s=%llx, da=%llx\n" , cp, s, da); + +if (da < cp || da >= (cp + s)) +return OF_BAD_ADDR ; +return da - cp; +} + +static int of_bus_default_flags_translate (__be32 *addr,u64 offset,int na) +{ +/* Keep "flags" part (high cell) in translated address */ +return of_bus_default_translate (addr +1 , offset, na -1 ); +}#ifdef CONFIG_PCI static unsigned int of_bus_pci_get_flags (const __be32 *addr)
@@ -365,8 +391,8 @@ static struct of_bus of_busses[] = { .addresses = "reg", .match = of_bus_default_flags_match, .count_cells = of_bus_default_count_cells, - .map = of_bus_default_map, - .translate = of_bus_default_translate, + .map = of_bus_default_flags_map, + .translate = of_bus_default_flags_translate, .has_flags = true, .get_flags = of_bus_default_flags_get_flags, },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/92 of: address: Remove duplicated functions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit 3eb030c60835668997d5763b1a0c7938faf169f6 ]
The recently added of_bus_default_flags_translate() performs the exact same operation as of_bus_pci_translate() and of_bus_isa_translate().
Avoid duplicated code replacing both of_bus_pci_translate() and of_bus_isa_translate() with of_bus_default_flags_translate().
Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
--- drivers/of/address.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/of/address.c +2 -11
@@ -221,10 +221,6 @@ static u64 of_bus_pci_map(__be32 *addr, const __be32 *range, int na, int ns,return da - cp; } -static int of_bus_pci_translate (__be32 *addr,u64 offset,int na) -{ -return of_bus_default_translate (addr +1 , offset, na -1 ); -}#endif /* CONFIG_PCI */ int of_pci_address_to_resource(struct device_node *dev, int bar,
@@ -334,11 +330,6 @@ static u64 of_bus_isa_map(__be32 *addr, const __be32 *range, int na, int ns,return da - cp; } -static int of_bus_isa_translate (__be32 *addr,u64 offset,int na) -{ -return of_bus_default_translate (addr +1 , offset, na -1 ); -} -static unsigned int of_bus_isa_get_flags (const __be32 *addr) {unsigned int flags =0 ;
@@ -369,7 +360,7 @@ static struct of_bus of_busses[] = { .match = of_bus_pci_match, .count_cells = of_bus_pci_count_cells, .map = of_bus_pci_map, - .translate = of_bus_pci_translate, + .translate = of_bus_default_flags_translate, .has_flags = true, .get_flags = of_bus_pci_get_flags, },
@@ -381,7 +372,7 @@ static struct of_bus of_busses[] = { .match = of_bus_isa_match, .count_cells = of_bus_isa_count_cells, .map = of_bus_isa_map, - .translate = of_bus_isa_translate, + .translate = of_bus_default_flags_translate, .has_flags = true, .get_flags = of_bus_isa_get_flags, },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/92 of: address: Store number of bus flag cells rather than bool
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit 88696db08b7efa3b6bb722014ea7429e78f6be32 ]
It is more useful to know how many flags cells a bus has rather than whether a bus has flags or not as ultimately the number of cells is the information used. Replace 'has_flags' boolean with 'flag_cells' count.
Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping")
--- drivers/of/address.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/of/address.c +5 -9
@@ -50,7 +50,7 @@ struct of_bus {u64 (*map)(__be32 *addr,const __be32 *range,int na,int ns,int pna);int (*translate)(__be32 *addr,u64 offset,int na); -bool has_flags; +int flag_cells;unsigned int (*get_flags)(const __be32 *addr); };
@@ -361,7 +361,7 @@ static struct of_bus of_busses[] = { .count_cells = of_bus_pci_count_cells, .map = of_bus_pci_map, .translate = of_bus_default_flags_translate, - .has_flags = true, + .flag_cells = 1, .get_flags = of_bus_pci_get_flags, },#endif /* CONFIG_PCI */
@@ -373,7 +373,7 @@ static struct of_bus of_busses[] = { .count_cells = of_bus_isa_count_cells, .map = of_bus_isa_map, .translate = of_bus_default_flags_translate, - .has_flags = true, + .flag_cells = 1, .get_flags = of_bus_isa_get_flags, },/* Default with flags cell */
@@ -384,7 +384,7 @@ static struct of_bus of_busses[] = { .count_cells = of_bus_default_count_cells, .map = of_bus_default_flags_map, .translate = of_bus_default_flags_translate, - .has_flags = true, + .flag_cells = 1, .get_flags = of_bus_default_flags_get_flags, },/* Default */
@@ -753,7 +753,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser,int na = parser->na;int ns = parser->ns;int np = parser->pna + na + ns; -int busflag_na =0 ; +int busflag_na = parser->bus->flag_cells;if (!range)return NULL ;
@@ -763,10 +763,6 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser, range->flags = parser->bus->get_flags (parser->range); -/* A extra cell for resource flags */ -if (parser->bus->has_flags) - busflag_na =1 ; - range->bus_addr =of_read_number (parser->range + busflag_na, na - busflag_na);if (parser->dma)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/92 of: address: Preserve the flags portion on 1:1 dma-ranges mapping
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea della Porta <[email protected]>
[ Upstream commit 7f05e20b989ac33c9c0f8c2028ec0a566493548f ]
A missing or empty dma-ranges in a DT node implies a 1:1 mapping for dma translations. In this specific case, the current behaviour is to zero out the entire specifier so that the translation could be carried on as an offset from zero. This includes address specifier that has flags (e.g. PCI ranges).
Once the flags portion has been zeroed, the translation chain is broken since the mapping functions will check the upcoming address specifier against mismatching flags, always failing the 1:1 mapping and its entire purpose of always succeeding.
Set to zero only the address portion while passing the flags through.
--- drivers/of/address.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/of/address.c +2 -1
@@ -466,7 +466,8 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus, }if (ranges ==NULL || rlen ==0 ) { offset =of_read_number (addr, na); -memset (addr,0 , pna *4 ); +/* set address to zero, pass flags through */ +memset (addr + pbus->flag_cells,0 , (pna - pbus->flag_cells) *4 );pr_debug ("empty ranges; 1:1 translation\n" ); goto finish; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/92 ocfs2: correct return value of ocfs2_local_free_info()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
[ Upstream commit d32840ad4a111c6abd651fbf6b5996e6123913da ]
Now in ocfs2_local_free_info(), it returns 0 even if it actually fails. Though it doesn't cause any real problem since the only caller dquot_disable() ignores the return value, we'd better return correct as it is.
Stable-dep-of: 5f3fd772d152 ("ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv")
--- fs/ocfs2/quota_local.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
fs/ocfs2/quota_local.c +3 -6
@@ -815,7 +815,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type)struct ocfs2_quota_chunk *chunk;struct ocfs2_local_disk_chunk *dchunk;int mark_clean =1 , len; -int status; +int status =0 ;iput (oinfo->dqi_gqinode);ocfs2_simple_drop_lockres (OCFS2_SB (sb), &oinfo->dqi_gqlock);
@@ -857,17 +857,14 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) oinfo->dqi_libh, olq_update_info, info); -if (status <0 ) { +if (status <0 )mlog_errno (status); - goto out; - } - out:ocfs2_inode_unlock (sb_dqopt (sb)->files[type],1 );brelse (oinfo->dqi_libh);brelse (oinfo->dqi_lqi_bh);kfree (oinfo); -return 0 ; +return status; }static void olq_set_dquot (struct buffer_head *bh,void *private)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/92 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Lam <[email protected]>
[ Upstream commit 5f3fd772d152229d94602bca243fbb658068a597 ]
When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the dangling pointer.
During the remounting process, the pointer dqi_priv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOT_SUSPENDED flag instead of setting the DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2_get_next_id is called and only checks the quota usage flags and not the quota suspended flags.
To fix this, I set dqi_priv to null when it is freed after remounting with read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.
--- fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/quota_local.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
fs/ocfs2/quota_global.c +1 -1
@@ -881,7 +881,7 @@ static int ocfs2_get_next_id(struct super_block *sb, struct kqid *qid)int status =0 ;trace_ocfs2_get_next_id (from_kqid (&init_user_ns, *qid), type); -if (!sb_has_quota_loaded (sb, type)) { +if (!sb_has_quota_active (sb, type)) { status = -ESRCH ; goto out; }
fs/ocfs2/quota_local.c +1 -0
@@ -864,6 +864,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type)brelse (oinfo->dqi_libh);brelse (oinfo->dqi_lqi_bh);kfree (oinfo); + info->dqi_priv =NULL ;return status; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/92 drm: bridge: adv7511: use dev_err_probe in probe function
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmad Fatoum <[email protected]>
[ Upstream commit 2a865248399a13bb2b2bcc50297069a7521de258 ]
adv7511 probe may need to be attempted multiple times before no -EPROBE_DEFER is returned. Currently, every such probe results in an error message:
[ 4.534229] adv7511 1-003d: failed to find dsi host [ 4.580288] adv7511 1-003d: failed to find dsi host
This is misleading, as there is no error and probe deferral is normal behavior. Fix this by using dev_err_probe that will suppress -EPROBE_DEFER errors. While at it, we touch all dev_err in the probe path. This makes the code more concise and included the error code everywhere to aid user in debugging.
Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 6 ++---- drivers/gpu/drm/bridge/adv7511/adv7533.c | 20 ++++++++------------ 2 files changed, 10 insertions(+), 16 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +2 -4
@@ -1224,10 +1224,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)return ret; ret =adv7511_init_regulators (adv7511); -if (ret) { -dev_err (dev,"failed to init regulators\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"failed to init regulators\n" );/* * The power down GPIO is optional. If present, toggle it from active to
drivers/gpu/drm/bridge/adv7511/adv7533.c +8 -12
@@ -146,16 +146,14 @@ int adv7533_attach_dsi(struct adv7511 *adv) }; host =of_find_mipi_dsi_host_by_node (adv->host_node); -if (!host) { -dev_err (dev,"failed to find dsi host\n" ); -return -EPROBE_DEFER ; - } +if (!host) +return dev_err_probe (dev, -EPROBE_DEFER , +"failed to find dsi host\n" ); dsi =devm_mipi_dsi_device_register_full (dev, host, &info); -if (IS_ERR (dsi)) { -dev_err (dev,"failed to create dsi device\n" ); -return PTR_ERR (dsi); - } +if (IS_ERR (dsi)) +return dev_err_probe (dev,PTR_ERR (dsi), +"failed to create dsi device\n" ); adv->dsi = dsi;
@@ -165,10 +163,8 @@ int adv7533_attach_dsi(struct adv7511 *adv)MIPI_DSI_MODE_NO_EOT_PACKET |MIPI_DSI_MODE_VIDEO_HSE ; ret =devm_mipi_dsi_attach (dev, dsi); -if (ret <0 ) { -dev_err (dev,"failed to attach dsi to host\n" ); -return ret; - } +if (ret <0 ) +return dev_err_probe (dev, ret,"failed to attach dsi to host\n" );return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/92 drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 ]
The host_node pointer was assigned and freed in adv7533_parse_dt(), and later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put() in error path of probe() and also in the remove().
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 10 ++++++++-- drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 -- 2 files changed, 8 insertions(+), 4 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +8 -2
@@ -1224,8 +1224,10 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)return ret; ret =adv7511_init_regulators (adv7511); -if (ret) -return dev_err_probe (dev, ret,"failed to init regulators\n" ); +if (ret) { +dev_err_probe (dev, ret,"failed to init regulators\n" ); + goto err_of_node_put; + }/* * The power down GPIO is optional. If present, toggle it from active to
@@ -1345,6 +1347,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)i2c_unregister_device (adv7511->i2c_edid); uninit_regulators:adv7511_uninit_regulators (adv7511); +err_of_node_put: +of_node_put (adv7511->host_node);return ret; }
@@ -1353,6 +1357,8 @@ static void adv7511_remove(struct i2c_client *i2c) {struct adv7511 *adv7511 =i2c_get_clientdata (i2c); +of_node_put (adv7511->host_node); +adv7511_uninit_regulators (adv7511);drm_bridge_remove (&adv7511->bridge);
drivers/gpu/drm/bridge/adv7511/adv7533.c +0 -2
@@ -184,8 +184,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv)if (!adv->host_node)return -ENODEV ; -of_node_put (adv->host_node); - adv->use_timing_gen = !of_property_read_bool (np,"adi,disable-timing-generator" );
Signature · 1 line
2.39.5
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Still building, but we already have failures on risc-v.
drivers/usb/core/port.c: In function 'usb_port_shutdown':
2912drivers/usb/core/port.c:417:26: error: 'struct usb_device' has no member named 'port_is_suspended' 2913
417 | if (udev && !udev->port_is_suspended) {
2914
| ^~
2915
make[4]: *** [scripts/Makefile.build:250: drivers/usb/core/port.o] Error 1
2916
make[4]: *** Waiting for unfinished jobs....
2917
CC drivers/gpu/drm/radeon/radeon_test.o
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1626266073
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Hi!
Quoted 7 lines
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Still building, but we already have failures on risc-v.
Quoted 13 lines
drivers/usb/core/port.c: In function 'usb_port_shutdown':
2912drivers/usb/core/port.c:417:26: error: 'structusb_device' has no member named 'port_is_suspended' 2913
417 | if (udev && !udev->port_is_suspended) {
2914
| ^~
2915
make[4]: *** [scripts/Makefile.build:250:drivers/usb/core/port.o] Error 1
2916
make[4]: *** Waiting for unfinished jobs....
2917
CCdrivers/gpu/drm/radeon/radeon_test.o
And there's similar failure on x86:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1626266073
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
A message that is not in the archive (sent off-list or not yet received): 2025011725-underdog-heftiness-49df@gregkh
6.1.125 build fail was -- Re: [PATCH 6.1 00/92] 6.1.125-rc1 review
Hi!
Quoted 16 lines
Quoted 16 lines
Quoted 15 lines
Still building, but we already have failures on risc-v.
drivers/usb/core/port.c: In function 'usb_port_shutdown':
2912drivers/usb/core/port.c:417:26: error: 'structusb_device' has no member named 'port_is_suspended' 2913
417 | if (udev && !udev->port_is_suspended) {
2914
| ^~
2915
make[4]: *** [scripts/Makefile.build:250:drivers/usb/core/port.o] Error 1
2916
make[4]: *** Waiting for unfinished jobs....
2917
CCdrivers/gpu/drm/radeon/radeon_test.o
Quoted 5 lines
Quoted 3 lines
And there's similar failure on x86:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1626266073
Thanks for testing and letting me know,
Ok, so it seems _this_ failure is fixed... but there's new one. Build failure on risc-v.
LD .tmp_vmlinux.kallsyms1
2941
riscv64-linux-gnu-ld: drivers/usb/host/xhci-pci.o: in function `xhci_pci_resume':
2942
xhci-pci.c:(.text+0xd8c): undefined reference to `xhci_resume'
2943
riscv64-linux-gnu-ld: xhci-pci.c:(.text+0xe1a): undefined reference to `xhci_suspend' 2944
make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1
2945
make: *** [Makefile:1250: vmlinux] Error 2
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/8883180471
(I have also 2 runtime failures, I'm retrying those jobs.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1630005263
). I partly reconsructed To:.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: 6.1.125 build fail was -- Re: [PATCH 6.1 00/92] 6.1.125-rc1 review
Quoted 40 lines · Pavel Machek
Hi!
Quoted 15 lines
Quoted 15 lines
Quoted 15 lines
Still building, but we already have failures on risc-v.
drivers/usb/core/port.c: In function 'usb_port_shutdown':
2912drivers/usb/core/port.c:417:26: error: 'structusb_device' has no member named 'port_is_suspended' 2913
417 | if (udev && !udev->port_is_suspended) {
2914
| ^~
2915
make[4]: *** [scripts/Makefile.build:250:drivers/usb/core/port.o] Error 1
2916
make[4]: *** Waiting for unfinished jobs....
2917
CCdrivers/gpu/drm/radeon/radeon_test.oQuoted 4 lines
Quoted 3 lines
And there's similar failure on x86:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1626266073
Thanks for testing and letting me know,
Ok, so it seems _this_ failure is fixed... but there's new one. Build failure on risc-v.
LD .tmp_vmlinux.kallsyms1
2941
riscv64-linux-gnu-ld:drivers/usb/host/xhci-pci.o: in function `xhci_pci_resume':
2942
xhci-pci.c:(.text+0xd8c): undefined reference to `xhci_resume'
2943
riscv64-linux-gnu-ld: xhci-pci.c:(.text+0xe1a): undefined reference to `xhci_suspend' 2944
make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1
2945
make: *** [Makefile:1250: vmlinux] Error 2https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/8883180471
(I have also 2 runtime failures, I'm retrying those jobs.
Quoted 7 lines
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1630005263
). I partly reconsructed To:.
Best regards,
Pavel
Seeing the build failure on RISC-V here also. The fixup patch was a little too aggressive. I tried just removing the #ifdef CONFIG_PM around "port_is_suspended" in include/linux/usb.h and it builds okay.
Greg Kroah-Hartman
maintainerRe: 6.1.125 build fail was -- Re: [PATCH 6.1 00/92] 6.1.125-rc1 review
Quoted 45 lines · Ron Economos
Quoted 44 lines · Pavel Machek
Hi!
Quoted 15 lines
Quoted 15 lines
Quoted 15 lines
Still building, but we already have failures on risc-v.
drivers/usb/core/port.c: In function 'usb_port_shutdown':
2912drivers/usb/core/port.c:417:26: error: 'structusb_device' has no member named 'port_is_suspended' 2913
417 | if (udev && !udev->port_is_suspended) {
2914
| ^~
2915
make[4]: *** [scripts/Makefile.build:250:drivers/usb/core/port.o] Error 1
2916
make[4]: *** Waiting for unfinished jobs....
2917
CCdrivers/gpu/drm/radeon/radeon_test.oQuoted 4 lines
Quoted 3 lines
And there's similar failure on x86:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1626266073
Thanks for testing and letting me know,
Ok, so it seems _this_ failure is fixed... but there's new one. Build failure on risc-v.
LD .tmp_vmlinux.kallsyms1
2941
riscv64-linux-gnu-ld:drivers/usb/host/xhci-pci.o: in function `xhci_pci_resume':
2942
xhci-pci.c:(.text+0xd8c): undefined reference to `xhci_resume'
2943
riscv64-linux-gnu-ld: xhci-pci.c:(.text+0xe1a): undefined reference to `xhci_suspend' 2944
make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1
2945
make: *** [Makefile:1250: vmlinux] Error 2https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/8883180471
(I have also 2 runtime failures, I'm retrying those jobs.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1630005263
). I partly reconsructed To:.
Quoted 7 lines
Quoted 3 lines
Best regards,
Pavel
Seeing the build failure on RISC-V here also. The fixup patch was a little too aggressive. I tried just removing the #ifdef
CONFIG_PMaround "port_is_suspended" ininclude/linux/usb.hand it builds okay.
Can you send a fix-up patch for this that works for you?
thanks,
greg k-h
Re: 6.1.125 build fail was -- Re: [PATCH 6.1 00/92] 6.1.125-rc1 review
Quoted 49 lines · Greg Kroah-Hartman
Quoted 48 lines · Ron Economos
Quoted 47 lines · Pavel Machek
Hi!
Quoted 15 lines
Quoted 15 lines
Quoted 15 lines
Still building, but we already have failures on risc-v.
drivers/usb/core/port.c: In function 'usb_port_shutdown':
2912drivers/usb/core/port.c:417:26: error: 'structusb_device' has no member named 'port_is_suspended' 2913417 | if (udev && !udev->port_is_suspended) {2914
| ^~
2915
make[4]: *** [scripts/Makefile.build:250:drivers/usb/core/port.o] Error 1 2916
make[4]: *** Waiting for unfinished jobs....
2917
CCdrivers/gpu/drm/radeon/radeon_test.oQuoted 4 lines
Quoted 3 lines
And there's similar failure on x86:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1626266073
Thanks for testing and letting me know,
Ok, so it seems _this_ failure is fixed... but there's new one. Build failure on risc-v.
LD .tmp_vmlinux.kallsyms1
2941
riscv64-linux-gnu-ld:drivers/usb/host/xhci-pci.o: in function `xhci_pci_resume':
2942
xhci-pci.c:(.text+0xd8c): undefined reference to `xhci_resume'
2943
riscv64-linux-gnu-ld: xhci-pci.c:(.text+0xe1a): undefined reference to `xhci_suspend' 2944
make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1
2945
make: *** [Makefile:1250: vmlinux] Error 2https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/8883180471
(I have also 2 runtime failures, I'm retrying those jobs.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1630005263
). I partly reconsructed To:.
Best regards,
Pavel
Quoted 8 lines
Quoted 3 lines
Seeing the build failure on RISC-V here also. The fixup patch was a little too aggressive. I tried just removing the #ifdef
CONFIG_PMaround "port_is_suspended" ininclude/linux/usb.hand it builds okay.Can you send a fix-up patch for this that works for you?
thanks,
greg k-h
I just sent a patch. https://lore.kernel.org/linux-kernel/[email protected]/
I'm not used to sending patches, so I hope it's okay.
Quoted 22 lines · Pavel Machek
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Still building, but we already have failures on risc-v.
drivers/usb/core/port.c: In function 'usb_port_shutdown':
2912drivers/usb/core/port.c:417:26: error: 'structusb_device' has no member named 'port_is_suspended' 2913
417 | if (udev && !udev->port_is_suspended) {
2914
| ^~
2915
make[4]: *** [scripts/Makefile.build:250:drivers/usb/core/port.o] Error 1
2916
make[4]: *** Waiting for unfinished jobs....
2917
CCdrivers/gpu/drm/radeon/radeon_test.o
Quoted 4 lines
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1626266073
Best regards,
Pavel
I'm seeing the build failure here also. Looks like it's due to not having CONFIG_PM set in the config. The member "port_is_suspended" is inside of an #ifdef CONFIG_PM in include/linux/usb.h. The #ifdef CONFIG_PM has been removed at some point.
Greg Kroah-Hartman
maintainerQuoted 25 lines · Ron Economos
Quoted 24 lines · Pavel Machek
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Still building, but we already have failures on risc-v.
drivers/usb/core/port.c: In function 'usb_port_shutdown':
2912drivers/usb/core/port.c:417:26: error: 'structusb_device' has no member named 'port_is_suspended' 2913
417 | if (udev && !udev->port_is_suspended) {
2914
| ^~
2915
make[4]: *** [scripts/Makefile.build:250:drivers/usb/core/port.o] Error 1
2916
make[4]: *** Waiting for unfinished jobs....
2917
CCdrivers/gpu/drm/radeon/radeon_test.ohttps://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1626266073
Quoted 7 lines
Quoted 2 lines
Best regards,
PavelI'm seeing the build failure here also. Looks like it's due to not having
CONFIG_PMset in the config. The member "port_is_suspended" is inside of an #ifdefCONFIG_PMininclude/linux/usb.h. The #ifdefCONFIG_PMhas been removed at some point.
Yeah, it was fixed up in 6.4 with commit 130eac417085 ("xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals"), which is why we didn't see this as a dependency. I'll see if I can figure that out tomorrow for how to backport it as it doesn't apply cleanly.
thanks,
greg k-h
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 17 Jan 2025 10:34:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.125-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.1:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
115 tests: 115 pass, 0 failLinux version: 6.1.125-rc1-gf121d22cf28e
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 17 Jan 2025 10:34:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.125-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 17 Jan 2025 10:34:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.125-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 17 Jan 2025 10:34:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.125-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
As other reported,
The arm axm55xx_defconfig and footbridge_defconfig build failed and also arc, mips, parisc, Powerpc, s390 and sh builds failed with below warnings / errors.
Error:
----drivers/usb/core/port.c:417:21: error: no member named 'port_is_suspended' in 'struct usb_device'
417 | if (udev && !udev->port_is_suspended) {
| ~~~~ ^
1 error generated.
Build regression:
gcc-compiler-drivers_usb_core_port_c-error-struct-usb_device-has-no-member-named-port_is_suspended
The bad commit points to,
USB: core: Disable LPM only for non-suspended ports
commit 59bfeaf5454b7e764288d84802577f4a99bf0819 upstream.
## Build
* kernel: 6.1.125-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: f121d22cf28ea1a09e9040843f57dd73dde42bc0
* git describe: v6.1.124-93-gf121d22cf28e
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.124-93-gf121d22cf28e
## Test Regressions (compared to v6.1.123-82-g88f2306b7d74)
* arc, build
- gcc-9-axs103_defconfig
- gcc-9-vdk_hs38_smp_defconfig
* arm, build
- clang-19-axm55xx_defconfig
- clang-19-footbridge_defconfig
- clang-nightly-axm55xx_defconfig
- clang-nightly-footbridge_defconfig
- gcc-13-axm55xx_defconfig
- gcc-13-footbridge_defconfig
- gcc-8-axm55xx_defconfig
- gcc-8-footbridge_defconfig
* mips, build
- gcc-12-ath79_defconfig
- gcc-12-bcm47xx_defconfig
- gcc-12-rt305x_defconfig
- gcc-8-ath79_defconfig
- gcc-8-bcm47xx_defconfig
- gcc-8-rt305x_defconfig
* parisc, build
- gcc-11-allmodconfig
- gcc-11-allyesconfig
- gcc-11-defconfig
* powerpc, build
- clang-19-cell_defconfig
- clang-19-ppc64e_defconfig
- clang-nightly-cell_defconfig
- clang-nightly-ppc64e_defconfig
- gcc-13-cell_defconfig
- gcc-13-ppc64e_defconfig
- gcc-8-cell_defconfig
- gcc-8-ppc64e_defconfig
* s390, build
- clang-19-allmodconfig
- clang-19-allyesconfig
- gcc-13-allmodconfig
- gcc-13-allyesconfig
- gcc-8-allyesconfig
* sh, build
- gcc-11-defconfig
- gcc-11-shx3_defconfig
- gcc-8-defconfig
- gcc-8-shx3_defconfig
## Metric Regressions (compared to v6.1.123-82-g88f2306b7d74)
## Test Fixes (compared to v6.1.123-82-g88f2306b7d74)
## Metric Fixes (compared to v6.1.123-82-g88f2306b7d74)
## Test result summary
total: 82792, pass: 63395, fail: 4390, skip: 14641, xfail: 366
## Build Summary
* arc: 6 total, 3 passed, 3 failed
* arm: 139 total, 131 passed, 8 failed
* arm64: 46 total, 44 passed, 2 failed
* i386: 31 total, 27 passed, 4 failed
* mips: 30 total, 19 passed, 11 failed
* parisc: 5 total, 2 passed, 3 failed
* powerpc: 36 total, 25 passed, 11 failed
* riscv: 14 total, 13 passed, 1 failed
* s390: 18 total, 12 passed, 6 failed
* sh: 12 total, 6 passed, 6 failed
* sparc: 9 total, 8 passed, 1 failed
* x86_64: 38 total, 38 passed, 0 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Am 15.01.2025 um 11:36 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
I have CONFIG_PM=Y (and many more dependent config options) in my config, so I'm not seeing the build failure reported by others who don't have that set.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
The kernel, bpf tool, amd kselftest tool builds fine for v6.1.125-rc1 on x86 and arm64 Azure VM.
Thanks,
Hardik
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 17 Jan 2025 10:34:58 +0000. Anything received after that time might be too late.
Various allmodconfig builds fail. Example:
Building csky:allmodconfig ... failed
--------------
Error log:
ERROR: modpost: "xhci_suspend" [drivers/usb/host/xhci-pci.ko] undefined!
ERROR: modpost: "xhci_resume" [drivers/usb/host/xhci-pci.ko] undefined! make[2]: [scripts/Makefile.modpost:127: Module.symvers] Error 1 (ignored)
This is because the backport of commit 9734fd7a2777 ("xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals") is wrong.
9734fd7a2777:
-#ifdef CONFIG_PM
xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend;
xhci_pci_hc_driver.pci_resume = xhci_pci_resume;
xhci_pci_hc_driver.shutdown = xhci_pci_shutdown;-#endif
130eac4170859 (upstream version of 9734fd7a2777):
-#ifdef CONFIG_PM
- xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend; - xhci_pci_hc_driver.pci_resume = xhci_pci_resume; - xhci_pci_hc_driver.pci_poweroff_late = xhci_pci_poweroff_late; - xhci_pci_hc_driver.shutdown = xhci_pci_shutdown; -#endif + xhci_pci_hc_driver.pci_suspend = pm_ptr(xhci_pci_suspend); + xhci_pci_hc_driver.pci_resume = pm_ptr(xhci_pci_resume); + xhci_pci_hc_driver.pci_poweroff_late = pm_ptr(xhci_pci_poweroff_late); + xhci_pci_hc_driver.shutdown = pm_ptr(xhci_pci_shutdown);
Guenter
Greg Kroah-Hartman
maintainerQuoted 32 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.125 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 17 Jan 2025 10:34:58 +0000. Anything received after that time might be too late.
Various allmodconfig builds fail. Example:
Building csky:allmodconfig ... failed
--------------
Error log:
ERROR: modpost: "xhci_suspend" [drivers/usb/host/xhci-pci.ko] undefined!
ERROR: modpost: "xhci_resume" [drivers/usb/host/xhci-pci.ko] undefined! make[2]: [scripts/Makefile.modpost:127: Module.symvers] Error 1 (ignored)This is because the backport of commit
9734fd7a2777("xhci: usepm_ptr()instead of #ifdef forCONFIG_PMconditionals") is wrong.
9734fd7a2777:(quoted diff) +0
-2-#ifdef CONFIG_PM xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend; xhci_pci_hc_driver.pci_resume = xhci_pci_resume; xhci_pci_hc_driver.shutdown = xhci_pci_shutdown; -#endif
130eac4170859(upstream version of9734fd7a2777):
Review
Quoted 10 lines
(quoted diff) +4
-6-#ifdef CONFIG_PM - xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend; - xhci_pci_hc_driver.pci_resume = xhci_pci_resume; - xhci_pci_hc_driver.pci_poweroff_late = xhci_pci_poweroff_late; - xhci_pci_hc_driver.shutdown = xhci_pci_shutdown; -#endif + xhci_pci_hc_driver.pci_suspend = pm_ptr(xhci_pci_suspend); + xhci_pci_hc_driver.pci_resume = pm_ptr(xhci_pci_resume); + xhci_pci_hc_driver.pci_poweroff_late = pm_ptr(xhci_pci_poweroff_late); + xhci_pci_hc_driver.shutdown = pm_ptr(xhci_pci_shutdown);
Ron sent a fix for this:
https://lore.kernel.org/r/[email protected]
I'll get a new release out with this fix in it soon.
thanks,
greg k-h