6.12.10-rc1 review
Subsystems (11)
Greg Kroah-Hartman
maintainercover 6.12.10-rc1 review
This is the start of the stable review cycle for the 6.12.10 release. There are 189 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 17 Jan 2025 10:34:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.10-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.10-rc1
Jakub Kicinski <[email protected]>
netdev: prevent accessing NAPI instances from another namespace
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix spi burst write not supported
Pavel Begunkov <[email protected]>
io_uring: don't touch sqd->thread off tw add
Daniel Golle <[email protected]>
drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported
Umesh Nerlige Ramappa <[email protected]>
xe/oa: Fix query mode of operation for OAR/OAC
Ashutosh Dixit <[email protected]>
drm/xe/oa: Add input fence dependencies
Ashutosh Dixit <[email protected]>
drm/xe/oa/uapi: Define and parse OA sync properties
Ashutosh Dixit <[email protected]>
drm/xe/oa: Separate batch submission from waiting for completion
guanjing <[email protected]>
firewall: remove misplaced semicolon from stm32_firewall_get_firewall
Peter Geis <[email protected]>
arm64: dts: rockchip: add hevc power domain clock to rk3328
Yu Kuai <[email protected]>
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
Daniil Stas <[email protected]>
hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
Jie Gan <[email protected]>
arm64: dts: qcom: sa8775p: fix the secure device bootup issue
Jesse Taube <[email protected]>
ARM: dts: imxrt1050: Fix clocks for mmc
Wei Fang <[email protected]>
arm64: dts: imx95: correct the address length of netcmix_blk_ctrl
Jens Axboe <[email protected]>
io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
Uwe Kleine-König <[email protected]>
iio: adc: ad7124: Disable all channels at probe time
David Lechner <[email protected]>
iio: adc: ad7173: fix using shared static info struct
Joe Hattori <[email protected]>
iio: inkern: call iio_device_put() only on mapped devices
Joe Hattori <[email protected]>
iio: adc: at91: call input_free_device() on allocated iio_dev
Fabio Estevam <[email protected]>
iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
Charles Han <[email protected]>
iio: adc: ti-ads1298: Add NULL check in ads1298_init
Carlos Song <[email protected]>
iio: gyro: fxas21002c: Fix missing data update in trigger handler
Javier Carrasco <[email protected]>
iio: adc: ti-ads1119: fix sample size in scan struct for triggered buffer
Javier Carrasco <[email protected]>
iio: adc: ti-ads1119: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: adc: ti-ads8688: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: adc: rockchip_saradc: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: imu: kmx61: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: light: bh1745: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: light: vcnl4035: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: pressure: zpa2326: fix information leak in triggered buffer
GONG Ruiqi <[email protected]>
usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control()
Xu Yang <[email protected]>
usb: host: xhci-plat: set skip_phy_initialization if software node has XHCI_SKIP_PHY_INIT property
Ingo Rohloff <[email protected]>
usb: gadget: configfs: Ignore trailing LF for user strings to cdev
Akash M <[email protected]>
usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
Dan Carpenter <[email protected]>
usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm()
Prashanth K <[email protected]>
usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
Xu Yang <[email protected]>
usb: typec: tcpci: fix NULL pointer issue on shared irq case
Joe Hattori <[email protected]>
usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()
Takashi Iwai <[email protected]>
usb: gadget: midi2: Reverse-select at the right place
Ma Ke <[email protected]>
usb: fix reference leak in usb_new_device()
Kai-Heng Feng <[email protected]>
USB: core: Disable LPM only for non-suspended ports
Jun Yan <[email protected]>
USB: usblp: return error when setting unsupported protocol
Prashanth K <[email protected]>
usb: dwc3-am62: Disable autosuspend during remove
Rick Edgecombe <[email protected]>
x86/fpu: Ensure shadow stack is active before "getting" registers
Lianqin Hu <[email protected]>
usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
Ben Wolsieffer <[email protected]>
serial: stm32: use port lock wrappers for break control
Ilpo Järvinen <[email protected]>
tty: serial: 8250: Fix another runtime PM usage counter underflow
Rengarajan S <[email protected]>
misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
Rengarajan S <[email protected]>
misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
Li Huafei <[email protected]>
topology: Keep the cpumask unchanged when printing cpumap
André Draszik <[email protected]>
usb: dwc3: gadget: fix writing NYET threshold
Johan Hovold <[email protected]>
USB: serial: cp210x: add Phoenix Contact UPS Device
Lubomir Rintel <[email protected]>
usb-storage: Add max sectors quirk for Nokia 208
Zicheng Qu <[email protected]>
staging: iio: ad9832: Correct phase range check
Zicheng Qu <[email protected]>
staging: iio: ad9834: Correct phase range check
Michal Hrusecky <[email protected]>
USB: serial: option: add Neoway N723-EA support
Chukun Pan <[email protected]>
USB: serial: option: add MeiG Smart SRM815
Pavel Begunkov <[email protected]>
io_uring/sqpoll: zero sqd->thread on tctx errors
Pavel Begunkov <[email protected]>
io_uring/timeout: fix multishot updates
Melissa Wen <[email protected]>
drm/amd/display: increase MAX_SURFACES to the value supported by hw
Melissa Wen <[email protected]>
drm/amd/display: fix page fault due to max surface definition mismatch
Melissa Wen <[email protected]>
drm/amd/display: fix divide error in DM plane scale calcs
Zhu Lingshan <[email protected]>
drm/amdkfd: wq_release signals dma_fence only when available
[email protected] <[email protected]>
drm/amdkfd: fixed page fault when enable MES shader debugger
Kun Liu <[email protected]>
drm/amd/pm: fix BUG: scheduling while atomic
Arunpravin Paneer Selvam <[email protected]>
drm/amdgpu: Add a lock when accessing the buddy trim function
Hans de Goede <[email protected]>
ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
Binbin Zhou <[email protected]>
gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset
Nam Cao <[email protected]>
riscv: kprobes: Fix incorrect address calculation
Nam Cao <[email protected]>
riscv: Fix sleeping in invalid context in die()
Christian Brauner <[email protected]>
fs: kill MNT_ONRB
Meetakshi Setiya <[email protected]>
smb: client: sync the root session and superblock context passwords before automounting
Manivannan Sadhasivam <[email protected]>
arm64: dts: qcom: sa8775p: Fix the size of 'addr_space' regions
Qiang Yu <[email protected]>
arm64: dts: qcom: x1e80100: Fix up BAR space size for PCIe6a
Andrea Righi <[email protected]>
sched_ext: idle: Refresh idle masks during idle-to-idle transitions
Chen Ridong <[email protected]>
cgroup/cpuset: remove kernfs active break
Honglei Wang <[email protected]>
sched_ext: switch class when preempted by higher priority scheduler
Changwoo Min <[email protected]>
sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
Joe Hattori <[email protected]>
thermal: of: fix OF node leak in of_thermal_zone_find()
Waiman Long <[email protected]>
cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
Roman Li <[email protected]>
drm/amd/display: Add check for granularity in dml ceil/floor helpers
Alex Hung <[email protected]>
drm/amd/display: Remove unnecessary amdgpu_irq_get/put
Chun-Kuang Hu <[email protected]>
Revert "drm/mediatek: dsi: Correct calculation formula of PHY Timing"
Mikhail Zaslonko <[email protected]>
btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path
Namjae Jeon <[email protected]>
ksmbd: Implement new SMB3 POSIX type
Matthieu Baerts (NGI0) <[email protected]>
rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxyMatthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: udp_port: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: auth_enable: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: rto_min/max: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
mptcp: sysctl: blackhole timeout: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
mptcp: sysctl: sched: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
mptcp: sysctl: avail sched: remove write access
Milan Broz <[email protected]>
dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
Mikulas Patocka <[email protected]>
dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
Miklos Szeredi <[email protected]>
fs: fix is_mnt_ns_file()
Amir Goldstein <[email protected]>
fs: relax assertions on failure to encode file handles
Alex Williamson <[email protected]>
vfio/pci: Fallback huge faults for unaligned pfn
Manivannan Sadhasivam <[email protected]>
scsi: ufs: qcom: Power off the PHY if it was already powered on in ufs_qcom_power_up_sequence()
Krister Johansen <[email protected]>
dm thin: make get_first_thin use rcu-safe list first function
Atish Patra <[email protected]>
drivers/perf: riscv: Return error for default case
Atish Patra <[email protected]>
drivers/perf: riscv: Fix Platform firmware event data
David Howells <[email protected]>
netfs: Fix read-retry for fs with no ->prepare_read()
David Howells <[email protected]>
netfs: Fix kernel async DIO
Lucas De Marchi <[email protected]>
drm/xe: Fix tlb invalidation when wedging
Clément Léger <[email protected]>
riscv: use local label names instead of global ones in assembly
Clément Léger <[email protected]>
riscv: stacktrace: fix backtracing through exceptions
Xu Lu <[email protected]>
riscv: mm: Fix the out of bound issue of vmemmap address
Javier Carrasco <[email protected]>
cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
Clément Léger <[email protected]>
riscv: module: remove relocation_head rel_entry member allocation
He Wang <[email protected]>
ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
David E. Box <[email protected]>
platform/x86: intel/pmc: Fix ioremap() of bad address
Maciej S. Szmigiero <[email protected]>
platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
David Howells <[email protected]>
afs: Fix the maximum cell name length
Wentao Liang <[email protected]>
ksmbd: fix a missing return value check bug
Liankun Yang <[email protected]>
drm/mediatek: Add return value check when reading DPCD
Koichiro Den <[email protected]>
gpio: virtuser: fix handling of multiple conn_ids in lookup table
Koichiro Den <[email protected]>
gpio: virtuser: fix missing lookup table cleanups
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188
Liankun Yang <[email protected]>
drm/mediatek: Fix mode valid issue for dp
Liankun Yang <[email protected]>
drm/mediatek: Fix YCbCr422 color format issue for DP
Arnd Bergmann <[email protected]>
drm/mediatek: stop selecting foreign drivers
Jason-JH.Lin <[email protected]>
drm/mediatek: Add support for 180-degree rotation in the display driver
Jason-JH.Lin <[email protected]>
drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb()
Guoqing Jiang <[email protected]>
drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
Chenguang Zhao <[email protected]>
net/mlx5: Fix variable not being completed when function returns
Dan Carpenter <[email protected]>
rtase: Fix a check for error in rtase_alloc_msix()
Parker Newman <[email protected]>
net: stmmac: dwmac-tegra: Read iommu stream id from device tree
Toke Høiland-Jørgensen <[email protected]>
sched: sch_cake: add bounds checks to host bulk flow fairness counts
Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: clamp maximum hashtable size to INT_MAX
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: imbalance in flowtable binding
Leo Yang <[email protected]>
mctp i3c: fix MCTP I3C driver multi-thread issue
Jie Wang <[email protected]>
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
Hao Lan <[email protected]>
net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
Jian Shen <[email protected]>
net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
Jian Shen <[email protected]>
net: hns3: don't auto enable misc vector
Hao Lan <[email protected]>
net: hns3: Resolved the issue that the debugfs query result is inconsistent.
Hao Lan <[email protected]>
net: hns3: fix missing features due to dev->features configuration too early
Hao Lan <[email protected]>
net: hns3: fixed reset failure issues caused by the incorrect reset type
Daniel Borkmann <[email protected]>
tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
Chris Lu <[email protected]>
Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.
Neeraj Sanjay Kale <[email protected]>
Bluetooth: btnxpuart: Fix driver sending truncated data
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix Add Device to responding before completing
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix not setting Random Address when required
Jakub Kicinski <[email protected]>
eth: gve: use appropriate helper to set xdp_features
Kuniyuki Iwashima <[email protected]>
ipvlan: Fix use-after-free in ipvlan_get_iflink().
Benjamin Coddington <[email protected]>
tls: Fix tls_sw_sendmsg error handling
En-Wei Wu <[email protected]>
igc: return early when failing to read EECD register
Przemyslaw Korba <[email protected]>
ice: fix incorrect PHY settings for 100 GB/s
Arkadiusz Kubalewski <[email protected]>
ice: fix max values for dpll pin phase adjust
Jakub Kicinski <[email protected]>
net: don't dump Tx and uninitialized NAPIs
Anumula Murali Mohan Reddy <[email protected]>
cxgb4: Avoid removal of uninserted tid
Michael Chan <[email protected]>
bnxt_en: Fix DIM shutdown
Kalesh AP <[email protected]>
bnxt_en: Fix possible memory leak when hwrm_req_replace fails
Shannon Nelson <[email protected]>
pds_core: limit loop over fw name list
Qu Wenruo <[email protected]>
btrfs: avoid NULL pointer dereference if no valid extent tree
Jiawen Wu <[email protected]>
net: libwx: fix firmware mailbox abnormal return
Eric Dumazet <[email protected]>
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
Zhongqiu Duan <[email protected]>
tcp/dccp: allow a connection when sk_max_ack_backlog is zero
Antonio Pastor <[email protected]>
net: 802: LLC+SNAP OID:PID lookup on start of skb data
Keisuke Nishimura <[email protected]>
ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
Li Zhijian <[email protected]>
selftests/alsa: Fix circular dependency involving global-timer
Chen-Yu Tsai <[email protected]>
ASoC: mediatek: disable buffer pre-allocation
Shuming Fan <[email protected]>
ASoC: rt722: add delay time to wait for the calibration procedure
Amir Goldstein <[email protected]>
ovl: support encoding fid from inode with no alias
Amir Goldstein <[email protected]>
ovl: pass realinode to ovl_encode_real_fh() instead of realdentry
Amir Goldstein <[email protected]>
fuse: respect FOPEN_KEEP_CACHE on opendir
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in __exfat_free_cluster()
Yuezhang Mo <[email protected]>
exfat: fix the new buffer was not zeroed before writing
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in exfat_readdir()
David Howells <[email protected]>
netfs: Fix is-caching check in read-retry
David Howells <[email protected]>
netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled
David Howells <[email protected]>
netfs: Fix ceph copy to cache on write-begin
David Howells <[email protected]>
netfs: Fix missing barriers by using clear_and_wake_up_bit()
David Howells <[email protected]>
nfs: Fix oops in nfs_netfs_init_request() when copying to cache
David Howells <[email protected]>
netfs: Fix enomem handling in buffered reads
Ming-Hung Tsai <[email protected]>
dm array: fix cursor index when skipping across block boundaries
Ming-Hung Tsai <[email protected]>
dm array: fix unreleased btree blocks on closing a faulty array cursor
Ming-Hung Tsai <[email protected]>
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
Long Li <[email protected]>
iomap: fix zero padding data issue in concurrent append writes
Long Li <[email protected]>
iomap: pass byte granular end position to iomap_add_to_ioend
Pankaj Raghav <[email protected]>
fs/writeback: convert wbc_account_cgroup_owner to take a folio
Zhang Yi <[email protected]>
jbd2: flush filesystem device before updating tail sequence
Zhang Yi <[email protected]>
jbd2: increase IO priority for writing revoke records
-------------
Diffstat:
Documentation/admin-guide/cgroup-v2.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx95.dtsi | 2 +- arch/arm64/boot/dts/qcom/sa8775p.dtsi | 5 +- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 + arch/riscv/include/asm/page.h | 1 + arch/riscv/include/asm/pgtable.h | 2 +- arch/riscv/include/asm/sbi.h | 1 + arch/riscv/kernel/entry.S | 21 +- arch/riscv/kernel/module.c | 18 +- arch/riscv/kernel/probes/kprobes.c | 2 +- arch/riscv/kernel/stacktrace.c | 4 +- arch/riscv/kernel/traps.c | 6 +- arch/riscv/mm/init.c | 17 +- arch/x86/kernel/fpu/regset.c | 3 +- block/bfq-iosched.c | 12 +- drivers/acpi/resource.c | 18 ++ drivers/base/topology.c | 24 +- drivers/bluetooth/btmtk.c | 7 + drivers/bluetooth/btnxpuart.c | 1 + drivers/cpuidle/cpuidle-riscv-sbi.c | 4 +- drivers/gpio/gpio-loongson-64bit.c | 6 +- drivers/gpio/gpio-virtuser.c | 44 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 17 ++ drivers/gpu/drm/amd/amdkfd/kfd_process.c | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 35 +-- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_state.c | 8 +- drivers/gpu/drm/amd/display/dc/dc.h | 4 +- drivers/gpu/drm/amd/display/dc/dc_stream.h | 2 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 1 - .../gpu/drm/amd/display/dc/dml/dml_inline_defs.h | 8 + .../drm/amd/display/dc/dml2/dml2_mall_phantom.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 2 + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 12 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 1 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 1 + drivers/gpu/drm/mediatek/Kconfig | 5 - drivers/gpu/drm/mediatek/mtk_crtc.c | 25 +- drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 69 +++--- drivers/gpu/drm/mediatek/mtk_dp.c | 46 ++-- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 + drivers/gpu/drm/mediatek/mtk_dsi.c | 49 ++-- drivers/gpu/drm/xe/xe_gt.c | 8 +- drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 4 +- drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 3 +- drivers/gpu/drm/xe/xe_oa.c | 265 ++++++++++++++------- drivers/gpu/drm/xe/xe_oa_types.h | 6 + drivers/gpu/drm/xe/xe_query.c | 2 +- drivers/gpu/drm/xe/xe_ring_ops.c | 5 +- drivers/gpu/drm/xe/xe_sched_job_types.h | 2 + drivers/hwmon/drivetemp.c | 8 +- drivers/iio/adc/ad7124.c | 3 + drivers/iio/adc/ad7173.c | 10 +- drivers/iio/adc/at91_adc.c | 2 +- drivers/iio/adc/rockchip_saradc.c | 2 + drivers/iio/adc/ti-ads1119.c | 4 +- drivers/iio/adc/ti-ads124s08.c | 4 +- drivers/iio/adc/ti-ads1298.c | 2 + drivers/iio/adc/ti-ads8688.c | 2 +- drivers/iio/dummy/iio_simple_dummy_buffer.c | 2 +- drivers/iio/gyro/fxas21002c_core.c | 11 +- drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 22 +- drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c | 3 +- drivers/iio/imu/kmx61.c | 2 +- drivers/iio/inkern.c | 2 +- drivers/iio/light/bh1745.c | 2 + drivers/iio/light/vcnl4035.c | 2 +- drivers/iio/pressure/zpa2326.c | 2 + drivers/md/dm-ebs-target.c | 2 +- drivers/md/dm-thin.c | 5 +- drivers/md/dm-verity-fec.c | 40 ++-- drivers/md/persistent-data/dm-array.c | 19 +- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c | 4 +- drivers/net/ethernet/amd/pds_core/devlink.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 38 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 3 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 5 +- drivers/net/ethernet/google/gve/gve_main.c | 14 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 3 - drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 96 +++----- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 1 - .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 45 +++- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 3 + .../ethernet/hisilicon/hns3/hns3pf/hclge_regs.c | 9 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 41 +++- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c | 9 +- drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 2 + drivers/net/ethernet/intel/ice/ice_dpll.c | 35 ++- drivers/net/ethernet/intel/ice/ice_ptp_consts.h | 4 +- drivers/net/ethernet/intel/igc/igc_base.c | 6 + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 1 + drivers/net/ethernet/realtek/rtase/rtase_main.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 14 +- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 24 +- drivers/net/ieee802154/ca8210.c | 6 +- drivers/net/mctp/mctp-i3c.c | 4 + drivers/perf/riscv_pmu_sbi.c | 17 +- drivers/platform/x86/amd/pmc/pmc.c | 8 +- drivers/platform/x86/intel/pmc/core_ssram.c | 4 + drivers/staging/iio/frequency/ad9832.c | 2 +- drivers/staging/iio/frequency/ad9834.c | 2 +- drivers/thermal/thermal_of.c | 1 + drivers/tty/serial/8250/8250_core.c | 3 + drivers/tty/serial/stm32-usart.c | 4 +- drivers/ufs/core/ufshcd-priv.h | 6 - drivers/ufs/core/ufshcd.c | 1 - drivers/ufs/host/ufs-qcom.c | 13 +- drivers/usb/chipidea/ci_hdrc_imx.c | 25 +- drivers/usb/class/usblp.c | 7 +- drivers/usb/core/hub.c | 6 +- drivers/usb/core/port.c | 7 +- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/dwc3-am62.c | 1 + drivers/usb/dwc3/gadget.c | 4 +- drivers/usb/gadget/Kconfig | 4 +- drivers/usb/gadget/configfs.c | 6 +- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_uac2.c | 1 + drivers/usb/gadget/function/u_serial.c | 8 +- drivers/usb/host/xhci-plat.c | 3 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/option.c | 4 +- drivers/usb/storage/unusual_devs.h | 7 + drivers/usb/typec/tcpm/maxim_contaminant.c | 4 +- drivers/usb/typec/tcpm/tcpci.c | 25 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 4 +- drivers/vfio/pci/vfio_pci_core.c | 17 +- fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 +- fs/afs/vlclient.c | 2 +- fs/btrfs/extent_io.c | 7 +- fs/btrfs/inode.c | 2 +- fs/btrfs/scrub.c | 4 + fs/btrfs/zlib.c | 4 +- fs/buffer.c | 4 +- fs/exfat/dir.c | 3 +- fs/exfat/fatent.c | 10 + fs/exfat/file.c | 6 + fs/ext4/page-io.c | 2 +- fs/f2fs/data.c | 9 +- fs/fs-writeback.c | 8 +- fs/fuse/dir.c | 2 + fs/iomap/buffered-io.c | 68 +++++- fs/jbd2/commit.c | 4 +- fs/jbd2/revoke.c | 2 +- fs/mount.h | 15 +- fs/mpage.c | 2 +- fs/namespace.c | 24 +- fs/netfs/buffered_read.c | 28 ++- fs/netfs/direct_write.c | 7 +- fs/netfs/read_collect.c | 9 +- fs/netfs/read_pgpriv2.c | 4 + fs/netfs/read_retry.c | 5 +- fs/netfs/write_collect.c | 9 +- fs/nfs/fscache.c | 9 +- fs/notify/fdinfo.c | 4 +- fs/overlayfs/copy_up.c | 16 +- fs/overlayfs/export.c | 49 ++-- fs/overlayfs/namei.c | 4 +- fs/overlayfs/overlayfs.h | 2 +- fs/smb/client/namespace.c | 19 +- fs/smb/server/smb2pdu.c | 43 ++++ fs/smb/server/smb2pdu.h | 10 + fs/smb/server/vfs.c | 3 +- include/linux/bus/stm32_firewall_device.h | 2 +- include/linux/iomap.h | 2 +- include/linux/mount.h | 3 +- include/linux/netfs.h | 1 - include/linux/writeback.h | 4 +- include/net/inet_connection_sock.h | 2 +- include/uapi/drm/xe_drm.h | 17 ++ include/ufs/ufshcd.h | 2 - io_uring/eventfd.c | 2 +- io_uring/io_uring.c | 5 +- io_uring/sqpoll.c | 6 +- io_uring/timeout.c | 4 +- kernel/cgroup/cpuset.c | 35 +-- kernel/sched/ext.c | 76 ++++-- kernel/sched/ext.h | 8 +- kernel/sched/idle.c | 5 +- net/802/psnap.c | 4 +- net/bluetooth/hci_sync.c | 11 +- net/bluetooth/mgmt.c | 38 ++- net/bluetooth/rfcomm/tty.c | 4 +- net/core/dev.c | 43 +++- net/core/dev.h | 3 +- net/core/link_watch.c | 10 +- net/core/netdev-genl.c | 9 +- net/ipv4/tcp_ipv4.c | 2 +- net/mptcp/ctrl.c | 17 +- net/netfilter/nf_conntrack_core.c | 5 +- net/netfilter/nf_tables_api.c | 15 +- net/rds/tcp.c | 39 ++- net/sched/cls_flow.c | 3 +- net/sched/sch_cake.c | 140 ++++++----- net/sctp/sysctl.c | 14 +- net/tls/tls_sw.c | 2 +- sound/soc/codecs/rt722-sdca.c | 7 +- .../soc/mediatek/common/mtk-afe-platform-driver.c | 4 +- tools/testing/selftests/alsa/Makefile | 2 +- tools/testing/selftests/cgroup/test_cpuset_prs.sh | 33 +-- 207 files changed, 1626 insertions(+), 884 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/189 jbd2: increase IO priority for writing revoke records
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit ac1e21bd8c883aeac2f1835fc93b39c1e6838b35 ]
Commit '6a3afb6ac6df ("jbd2: increase the journal IO's priority")' increases the priority of journal I/O by marking I/O with the JBD2_JOURNAL_REQ_FLAGS. However, that commit missed the revoke buffers, so also addresses that kind of I/Os.
--- fs/jbd2/revoke.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jbd2/revoke.c +1 -1
@@ -654,7 +654,7 @@ static void flush_descriptor(journal_t *journal,set_buffer_jwrite (descriptor);BUFFER_TRACE (descriptor,"write" );set_buffer_dirty (descriptor); - write_dirty_buffer(descriptor, REQ_SYNC); + write_dirty_buffer(descriptor, JBD2_JOURNAL_REQ_FLAGS); }#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/189 jbd2: flush filesystem device before updating tail sequence
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit a0851ea9cd555c333795b85ddd908898b937c4e1 ]
When committing transaction in jbd2_journal_commit_transaction(), the disk caches for the filesystem device should be flushed before updating the journal tail sequence. However, this step is missed if the journal is not located on the filesystem device. As a result, the filesystem may become inconsistent following a power failure or system crash. Fix it by ensuring that the filesystem device is flushed appropriately.
--- fs/jbd2/commit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/jbd2/commit.c +2 -2
@@ -776,9 +776,9 @@ void jbd2_journal_commit_transaction(journal_t *journal)/* * If the journal is not located on the file system device, * then we must flush the file system device before we issue -* the commit record +* the commit record and update the journal tail sequence. */ -if (commit_transaction->t_need_data_flush && +if ((commit_transaction->t_need_data_flush || update_tail) && (journal->j_fs_dev != journal->j_dev) && (journal->j_flags &JBD2_BARRIER ))blkdev_issue_flush (journal->j_fs_dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/189 fs/writeback: convert wbc_account_cgroup_owner to take a folio
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pankaj Raghav <[email protected]>
[ Upstream commit 30dac24e14b52e1787572d1d4e06eeabe8a63630 ]
Most of the callers of wbc_account_cgroup_owner() are converting a folio to page before calling the function. wbc_account_cgroup_owner() is converting the page back to a folio to call mem_cgroup_css_from_folio().
Convert wbc_account_cgroup_owner() to take a folio instead of a page, and convert all callers to pass a folio directly except f2fs.
Convert the page to folio for all the callers from f2fs as they were the only callers calling wbc_account_cgroup_owner() with a page. As f2fs is already in the process of converting to folios, these call sites might also soon be calling wbc_account_cgroup_owner() with a folio directly in the future.
No functional changes. Only compile tested.
Stable-dep-of: 51d20d1dacbe ("iomap: fix zero padding data issue in concurrent append writes")
--- Documentation/admin-guide/cgroup-v2.rst | 2 +- fs/btrfs/extent_io.c | 7 +++---- fs/btrfs/inode.c | 2 +- fs/buffer.c | 4 ++-- fs/ext4/page-io.c | 2 +- fs/f2fs/data.c | 9 ++++++--- fs/fs-writeback.c | 8 +++----- fs/iomap/buffered-io.c | 2 +- fs/mpage.c | 2 +- include/linux/writeback.h | 4 ++-- 10 files changed, 21 insertions(+), 21 deletions(-)
Documentation/admin-guide/cgroup-v2.rst +1 -1
@@ -2954,7 +2954,7 @@ following two functions. a queue (device) has been associated with the bio and before submission. - wbc_account_cgroup_owner(@wbc, @page, @bytes) + wbc_account_cgroup_owner(@wbc, @folio, @bytes) Should be called for each data segment being written out. While this function doesn't care exactly when it's called during the writeback session, it's the easiest and most
fs/btrfs/extent_io.c +3 -4
@@ -786,7 +786,7 @@ static void submit_extent_folio(struct btrfs_bio_ctrl *bio_ctrl, }if (bio_ctrl->wbc) -wbc_account_cgroup_owner (bio_ctrl->wbc, &folio->page, +wbc_account_cgroup_owner (bio_ctrl->wbc, folio, len); size -= len;
@@ -1708,7 +1708,7 @@ static noinline_for_stack void write_one_eb(struct extent_buffer *eb, ret =bio_add_folio (&bbio->bio, folio, eb->len, eb->start -folio_pos (folio));ASSERT (ret); -wbc_account_cgroup_owner (wbc,folio_page (folio,0 ), eb->len); +wbc_account_cgroup_owner (wbc, folio, eb->len);folio_unlock (folio); }else {int num_folios =num_extent_folios (eb);
@@ -1722,8 +1722,7 @@ static noinline_for_stack void write_one_eb(struct extent_buffer *eb,folio_start_writeback (folio); ret =bio_add_folio (&bbio->bio, folio, eb->folio_size,0 );ASSERT (ret); -wbc_account_cgroup_owner (wbc,folio_page (folio,0 ), - eb->folio_size); +wbc_account_cgroup_owner (wbc, folio, eb->folio_size); wbc->nr_to_write -=folio_nr_pages (folio);folio_unlock (folio); }
fs/btrfs/inode.c +1 -1
@@ -1729,7 +1729,7 @@ static bool run_delalloc_compressed(struct btrfs_inode *inode,* need full accuracy. Just account the whole thing * against the first page. */ -wbc_account_cgroup_owner (wbc, &locked_folio->page, +wbc_account_cgroup_owner (wbc, locked_folio, cur_end - start); async_chunk[i].locked_folio = locked_folio; locked_folio =NULL ;
fs/buffer.c +2 -2
@@ -2803,7 +2803,7 @@ static void submit_bh_wbc(blk_opf_t opf, struct buffer_head *bh, bio->bi_iter.bi_sector = bh->b_blocknr * (bh->b_size >>9 ); bio->bi_write_hint = write_hint; -__bio_add_page (bio, bh->b_page, bh->b_size,bh_offset (bh)); +bio_add_folio_nofail (bio, bh->b_folio, bh->b_size,bh_offset (bh)); bio->bi_end_io = end_bio_bh_io_sync; bio->bi_private = bh;
@@ -2813,7 +2813,7 @@ static void submit_bh_wbc(blk_opf_t opf, struct buffer_head *bh,if (wbc) {wbc_init_bio (wbc, bio); -wbc_account_cgroup_owner (wbc, bh->b_page, bh->b_size); +wbc_account_cgroup_owner (wbc, bh->b_folio, bh->b_size); }submit_bio (bio);
fs/ext4/page-io.c +1 -1
@@ -421,7 +421,7 @@ static void io_submit_add_bh(struct ext4_io_submit *io,io_submit_init_bio (io, bh);if (!bio_add_folio (io->io_bio, io_folio, bh->b_size,bh_offset (bh))) goto submit_and_retry; -wbc_account_cgroup_owner (io->io_wbc, &folio->page, bh->b_size); +wbc_account_cgroup_owner (io->io_wbc, folio, bh->b_size); io->io_next_block++; }
fs/f2fs/data.c +6 -3
@@ -711,7 +711,8 @@ int f2fs_submit_page_bio(struct f2fs_io_info *fio) }if (fio->io_wbc && !is_read_io (fio->op)) -wbc_account_cgroup_owner (fio->io_wbc, fio->page,PAGE_SIZE ); +wbc_account_cgroup_owner (fio->io_wbc,page_folio (fio->page), +PAGE_SIZE );inc_page_count (fio->sbi,is_read_io (fio->op) ?__read_io_type (page) :WB_DATA_TYPE (fio->page, false));
@@ -911,7 +912,8 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio) }if (fio->io_wbc) -wbc_account_cgroup_owner (fio->io_wbc, fio->page,PAGE_SIZE ); +wbc_account_cgroup_owner (fio->io_wbc,page_folio (fio->page), +PAGE_SIZE );inc_page_count (fio->sbi,WB_DATA_TYPE (page, false));
@@ -1011,7 +1013,8 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio) }if (fio->io_wbc) -wbc_account_cgroup_owner (fio->io_wbc, fio->page,PAGE_SIZE ); +wbc_account_cgroup_owner (fio->io_wbc,page_folio (fio->page), +PAGE_SIZE ); io->last_block_in_bio = fio->new_blkaddr;
fs/fs-writeback.c +3 -5
@@ -890,17 +890,16 @@ EXPORT_SYMBOL_GPL(wbc_detach_inode);/** * wbc_account_cgroup_owner - account writeback to update inode cgroup ownership * @wbc: writeback_control of the writeback in progress -* @page: page being written out +* @folio: folio being written out * @bytes: number of bytes being written out * -* @bytes from @page are about to written out during the writeback +* @bytes from @folio are about to written out during the writeback * controlled by @wbc. Keep the book for foreign inode detection. See * wbc_detach_inode(). */ -void wbc_account_cgroup_owner (struct writeback_control *wbc,struct page *page, +void wbc_account_cgroup_owner (struct writeback_control *wbc,struct folio *folio,size_t bytes) { -struct folio *folio;struct cgroup_subsys_state *css;int id;
@@ -913,7 +912,6 @@ void wbc_account_cgroup_owner(struct writeback_control *wbc, struct page *page,if (!wbc->wb || wbc->no_cgroup_owner)return ; - folio =page_folio (page); css =mem_cgroup_css_from_folio (folio);/* dead cgroups shouldn't contribute to inode ownership arbitration */ if (!(css->flags &CSS_ONLINE ))
fs/iomap/buffered-io.c +1 -1
@@ -1784,7 +1784,7 @@ static int iomap_add_to_ioend(struct iomap_writepage_ctx *wpc,if (ifs)atomic_add (len, &ifs->write_bytes_pending); wpc->ioend->io_size += len; -wbc_account_cgroup_owner (wbc, &folio->page, len); +wbc_account_cgroup_owner (wbc, folio, len);return 0 ; }
fs/mpage.c +1 -1
@@ -606,7 +606,7 @@ static int __mpage_writepage(struct folio *folio, struct writeback_control *wbc,* the confused fail path above (OOM) will be very confused when * it finds all bh marked clean (i.e. it will not write anything) */ -wbc_account_cgroup_owner (wbc, &folio->page,folio_size (folio)); +wbc_account_cgroup_owner (wbc, folio,folio_size (folio)); length = first_unmapped << blkbits;if (!bio_add_folio (bio, folio, length,0 )) { bio =mpage_bio_submit_write (bio);
include/linux/writeback.h +2 -2
@@ -217,7 +217,7 @@ void wbc_attach_and_unlock_inode(struct writeback_control *wbc, struct inode *inode) __releases(&inode->i_lock);void wbc_detach_inode (struct writeback_control *wbc); -void wbc_account_cgroup_owner (struct writeback_control *wbc,struct page *page, +void wbc_account_cgroup_owner (struct writeback_control *wbc,struct folio *folio,size_t bytes);int cgroup_writeback_by_id (u64 bdi_id,int memcg_id,enum wb_reason reason,struct wb_completion *done);
@@ -324,7 +324,7 @@ static inline void wbc_init_bio(struct writeback_control *wbc, struct bio *bio) }static inline void wbc_account_cgroup_owner (struct writeback_control *wbc, -struct page *page,size_t bytes) +struct folio *folio,size_t bytes) { }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/189 iomap: pass byte granular end position to iomap_add_to_ioend
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit b44679c63e4d3ac820998b6bd59fba89a72ad3e7 ]
This is a preparatory patch for fixing zero padding issues in concurrent append write scenarios. In the following patches, we need to obtain byte-granular writeback end position for io_size trimming after EOF handling.
Due to concurrent writeback and truncate operations, inode size may shrink. Resampling inode size would force writeback code to handle the newly appeared post-EOF blocks, which is undesirable. As Dave explained in [1]:
"Really, the issue is that writeback mappings have to be able to handle the range being mapped suddenly appear to be beyond EOF. This behaviour is a longstanding writeback constraint, and is what iomap_writepage_handle_eof() is attempting to handle.
We handle this by only sampling i_size_read() whilst we have the folio locked and can determine the action we should take with that folio (i.e. nothing, partial zeroing, or skip altogether). Once we've made the decision that the folio is within EOF and taken action on it (i.e. moved the folio to writeback state), we cannot then resample the inode size because a truncate may have started and changed the inode size."
To avoid resampling inode size after EOF handling, we convert end_pos to byte-granular writeback position and return it from EOF handling function.
Since iomap_set_range_dirty() can handle unaligned lengths, this conversion has no impact on it. However, iomap_find_dirty_range() requires aligned start and end range to find dirty blocks within the given range, so the end position needs to be rounded up when passed to it.
LINK [1]: https://lore.kernel.org/linux-xfs/[email protected]/
Stable-dep-of: 51d20d1dacbe ("iomap: fix zero padding data issue in concurrent append writes")
--- fs/iomap/buffered-io.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
fs/iomap/buffered-io.c +12 -9
@@ -1764,7 +1764,8 @@ static bool iomap_can_add_to_ioend(struct iomap_writepage_ctx *wpc, loff_t pos)*/ static int iomap_add_to_ioend (struct iomap_writepage_ctx *wpc,struct writeback_control *wbc,struct folio *folio, -struct inode *inode,loff_t pos,unsigned len) +struct inode *inode,loff_t pos,loff_t end_pos, +unsigned len) {struct iomap_folio_state *ifs = folio->private;size_t poff =offset_in_folio (folio, pos);
@@ -1790,8 +1791,8 @@ static int iomap_add_to_ioend(struct iomap_writepage_ctx *wpc,static int iomap_writepage_map_blocks (struct iomap_writepage_ctx *wpc,struct writeback_control *wbc,struct folio *folio, -struct inode *inode,u64 pos,unsigned dirty_len, -unsigned *count) +struct inode *inode,u64 pos,u64 end_pos, +unsigned dirty_len,unsigned *count) {int error;
@@ -1816,7 +1817,7 @@ static int iomap_writepage_map_blocks(struct iomap_writepage_ctx *wpc,break ;default : error =iomap_add_to_ioend (wpc, wbc, folio, inode, pos, - map_len); + end_pos, map_len);if (!error) (*count)++;break ;
@@ -1887,11 +1888,11 @@ static bool iomap_writepage_handle_eof(struct folio *folio, struct inode *inode,* remaining memory is zeroed when mapped, and writes to that * region are not written out to the file. * -* Also adjust the writeback range to skip all blocks entirely -* beyond i_size. +* Also adjust the end_pos to the end of file and skip writeback +* for all blocks entirely beyond i_size. */ folio_zero_segment (folio, poff,folio_size (folio)); - *end_pos =round_up (isize,i_blocksize (inode)); + *end_pos = isize; }return true;
@@ -1904,6 +1905,7 @@ static int iomap_writepage_map(struct iomap_writepage_ctx *wpc,struct inode *inode = folio->mapping->host;u64 pos =folio_pos (folio);u64 end_pos = pos +folio_size (folio); +u64 end_aligned =0 ;unsigned count =0 ;int error =0 ;u32 rlen;
@@ -1945,9 +1947,10 @@ static int iomap_writepage_map(struct iomap_writepage_ctx *wpc,/* * Walk through the folio to find dirty areas to write back. */ -while ((rlen =iomap_find_dirty_range (folio, &pos, end_pos))) { + end_aligned =round_up (end_pos,i_blocksize (inode)); +while ((rlen =iomap_find_dirty_range (folio, &pos, end_aligned))) { error =iomap_writepage_map_blocks (wpc, wbc, folio, inode, - pos, rlen, &count); + pos, end_pos, rlen, &count);if (error)break ; pos += rlen;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/189 iomap: fix zero padding data issue in concurrent append writes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit 51d20d1dacbec589d459e11fc88fbca419f84a99 ]
During concurrent append writes to XFS filesystem, zero padding data may appear in the file after power failure. This happens due to imprecise disk size updates when handling write completion.
Consider this scenario with concurrent append writes same file:
Thread 1: Thread 2:
------------ -----------
write [A, A+B]
update inode size to A+B
submit I/O [A, A+BS]
write [A+B, A+B+C] update inode size to A+B+C
<I/O completes, updates disk size to min(A+B+C, A+BS)> <power failure>
After reboot:
1) with A+B+C < A+BS, the file has zero padding in range [A+B, A+B+C]
|< Block Size (BS) >|
|DDDDDDDDDDDDDDDD0000000000000000|
^ ^ ^
A A+B A+B+C
(EOF)2) with A+B+C > A+BS, the file has zero padding in range [A+B, A+BS]
|< Block Size (BS) >|< Block Size (BS) >|
|DDDDDDDDDDDDDDDD0000000000000000|00000000000000000000000000000000|
^ ^ ^ ^
A A+B A+BS A+B+C
(EOF) D = Valid Data
0 = Zero Padding
The issue stems from disk size being set to min(io_offset + io_size, inode->i_size) at I/O completion. Since io_offset+io_size is block size granularity, it may exceed the actual valid file data size. In the case of concurrent append writes, inode->i_size may be larger than the actual range of valid file data written to disk, leading to inaccurate disk size updates.
This patch modifies the meaning of io_size to represent the size of valid data within EOF in an ioend. If the ioend spans beyond i_size, io_size will be trimmed to provide the file with more accurate size information. This is particularly useful for on-disk size updates at completion time.
After this change, ioends that span i_size will not grow or merge with other ioends in concurrent scenarios. However, these cases that need growth/merging rarely occur and it seems no noticeable performance impact. Although rounding up io_size could enable ioend growth/merging in these scenarios, we decided to keep the code simple after discussion [1].
Another benefit is that it makes the xfs_ioend_is_append() check more accurate, which can reduce unnecessary end bio callbacks of xfs_end_bio() in certain scenarios, such as repeated writes at the file tail without extending the file size.
Link [1]: https://patchwork.kernel.org/project/xfs/patch/[email protected]
--- fs/iomap/buffered-io.c | 45 ++++++++++++++++++++++++++++++++++++++++++ include/linux/iomap.h | 2 +- 2 files changed, 46 insertions(+), 1 deletion(-)
fs/iomap/buffered-io.c +45 -0
@@ -1784,7 +1784,52 @@ static int iomap_add_to_ioend(struct iomap_writepage_ctx *wpc,if (ifs)atomic_add (len, &ifs->write_bytes_pending); + +/* +* Clamp io_offset and io_size to the incore EOF so that ondisk +* file size updates in the ioend completion are byte-accurate. +* This avoids recovering files with zeroed tail regions when +* writeback races with appending writes: +* +* Thread 1: Thread 2: +* ------------ ----------- +* write [A, A+B] +* update inode size to A+B +* submit I/O [A, A+BS] +* write [A+B, A+B+C] +* update inode size to A+B+C +* <I/O completes, updates disk size to min(A+B+C, A+BS)> +* <power failure> +* +* After reboot: +* 1) with A+B+C < A+BS, the file has zero padding in range +* [A+B, A+B+C] +* +* |< Block Size (BS) >| +* |DDDDDDDDDDDD0000000000000| +* ^ ^ ^ +* A A+B A+B+C +* (EOF) +* +* 2) with A+B+C > A+BS, the file has zero padding in range +* [A+B, A+BS] +* +* |< Block Size (BS) >|< Block Size (BS) >| +* |DDDDDDDDDDDD0000000000000|00000000000000000000000000| +* ^ ^ ^ ^ +* A A+B A+BS A+B+C +* (EOF) +* +* D = Valid Data +* 0 = Zero Padding +* +* Note that this defeats the ability to chain the ioends of +* appending writes. +*/ wpc->ioend->io_size += len; +if (wpc->ioend->io_offset + wpc->ioend->io_size > end_pos) + wpc->ioend->io_size = end_pos - wpc->ioend->io_offset; +wbc_account_cgroup_owner (wbc, folio, len);return 0 ; }
include/linux/iomap.h +1 -1
@@ -330,7 +330,7 @@ struct iomap_ioend {u16 io_type;u16 io_flags;/* IOMAP_F_* */ struct inode *io_inode;/* file being written to */ -size_t io_size;/* size of the extent */ +size_t io_size;/* size of data within eof */ loff_t io_offset;/* offset in the file */ sector_t io_sector;/* start sector of ioend */ struct bio io_bio;/* MUST BE LAST! */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/189 dm array: fix releasing a faulty array block twice in dm_array_cursor_end
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit f2893c0804d86230ffb8f1c8703fdbb18648abc8 ]
When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().
Reproduce steps:
1. initialize a cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1
dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
2. wipe the second array block offline
dmsteup remove cache cmeta cdata corig
mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \
2>/dev/null | hexdump -e '1/8 "%u\n"')
ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \
2>/dev/null | hexdump -e '1/8 "%u\n"')
dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock
3. try reopen the cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
Kernel logs:
(snip)
device-mapper: array: array_block_check failed: blocknr 0 != wanted 10
device-mapper: block manager: array validator check failed for block 10
device-mapper: array: get_ablock failed
device-mapper: cache metadata: dm_array_cursor_next for mapping failed
------------[ cut here ]------------ kernel BUG at drivers/md/dm-bufio.c:638!
Fix by setting the cached block pointer to NULL on errors.
In addition to the reproducer described above, this fix can be verified using the "array_cursor/damaged" test in dm-unit:
dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>
--- drivers/md/persistent-data/dm-array.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/md/persistent-data/dm-array.c +8 -4
@@ -917,23 +917,27 @@ static int load_ablock(struct dm_array_cursor *c)if (c->block)unlock_ablock (c->info, c->block); - c->block =NULL ; - c->ab =NULL ; c->index =0 ; r =dm_btree_cursor_get_value (&c->cursor, &key, &value_le);if (r) {DMERR ("dm_btree_cursor_get_value failed" ); -dm_btree_cursor_end (&c->cursor); + goto out; }else { r =get_ablock (c->info,le64_to_cpu (value_le), &c->block, &c->ab);if (r) {DMERR ("get_ablock failed" ); -dm_btree_cursor_end (&c->cursor); + goto out; } } +return 0 ; + +out: +dm_btree_cursor_end (&c->cursor); + c->block =NULL ; + c->ab =NULL ;return r; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/189 dm array: fix unreleased btree blocks on closing a faulty array cursor
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit 626f128ee9c4133b1cfce4be2b34a1508949370e ]
The cached block pointer in dm_array_cursor might be NULL if it reaches an unreadable array block, or the array is empty. Therefore, dm_array_cursor_end() should call dm_btree_cursor_end() unconditionally, to prevent leaving unreleased btree blocks.
This fix can be verified using the "array_cursor/iterate/empty" test in dm-unit:
dm-unit run /pdata/array_cursor/iterate/empty --kernel-dir <KERNEL_DIR>
--- drivers/md/persistent-data/dm-array.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/md/persistent-data/dm-array.c +3 -3
@@ -960,10 +960,10 @@ EXPORT_SYMBOL_GPL(dm_array_cursor_begin);void dm_array_cursor_end (struct dm_array_cursor *c) { -if (c->block) { +if (c->block)unlock_ablock (c->info, c->block); -dm_btree_cursor_end (&c->cursor); - } + +dm_btree_cursor_end (&c->cursor); }EXPORT_SYMBOL_GPL (dm_array_cursor_end);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/189 dm array: fix cursor index when skipping across block boundaries
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit 0bb1968da2737ba68fd63857d1af2b301a18d3bf ]
dm_array_cursor_skip() seeks to the target position by loading array blocks iteratively until the specified number of entries to skip is reached. When seeking across block boundaries, it uses dm_array_cursor_next() to step into the next block. dm_array_cursor_skip() must first move the cursor index to the end of the current block; otherwise, the cursor position could incorrectly remain in the same block, causing the actual number of skipped entries to be much smaller than expected.
This bug affects cache resizing in v2 metadata and could lead to data loss if the fast device is shrunk during the first-time resume. For example:
1. create a cache metadata consists of 32768 blocks, with a dirty block assigned to the second bitmap block. cache_restore v1.0 is required.
cat <<EOF >> cmeta.xml
<superblock uuid="" block_size="64" nr_cache_blocks="32768" \
policy="smq" hint_width="4">
<mappings>
<mapping cache_block="32767" origin_block="0" dirty="true"/>
</mappings>
</superblock>
EOF
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2
2. bring up the cache while attempt to discard all the blocks belonging to the second bitmap block (block# 32576 to 32767). The last command is expected to fail, but it actually succeeds.
dmsetup create cdata --table "0 2084864 linear /dev/sdc 8192" dmsetup create corig --table "0 65536 linear /dev/sdc 2105344" dmsetup create cache --table "0 65536 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 64 2 metadata2 writeback smq \
2 migration_threshold 0"
In addition to the reproducer described above, this fix can be verified using the "array_cursor/skip" tests in dm-unit:
dm-unit run /pdata/array_cursor/skip/ --kernel-dir <KERNEL_DIR>
--- drivers/md/persistent-data/dm-array.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/persistent-data/dm-array.c +1 -0
@@ -1003,6 +1003,7 @@ int dm_array_cursor_skip(struct dm_array_cursor *c, uint32_t count) } count -= remaining; + c->index += (remaining -1 ); r =dm_array_cursor_next (c); }while (!r);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/189 netfs: Fix enomem handling in buffered reads
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 105549d09a539a876b7c3330ab52d8aceedad358 ]
If netfs_read_to_pagecache() gets an error from either ->prepare_read() or from netfs_prepare_read_iterator(), it needs to decrement ->nr_outstanding, cancel the subrequest and break out of the issuing loop. Currently, it only does this for two of the cases, but there are two more that aren't handled.
Fix this by moving the handling to a common place and jumping to it from all four places. This is in preference to inserting a wrapper around netfs_prepare_read_iterator() as proposed by Dmitry Antipov[1].
--- fs/netfs/buffered_read.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-)
fs/netfs/buffered_read.c +16 -12
@@ -275,22 +275,14 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq)netfs_stat (&netfs_n_rh_download);if (rreq->netfs_ops->prepare_read) { ret = rreq->netfs_ops->prepare_read (subreq); -if (ret <0 ) { -atomic_dec (&rreq->nr_outstanding); -netfs_put_subrequest (subreq, false, - netfs_sreq_trace_put_cancel); -break ; - } +if (ret <0 ) + goto prep_failed;trace_netfs_sreq (subreq, netfs_sreq_trace_prepare); } slice =netfs_prepare_read_iterator (subreq); -if (slice <0 ) { -atomic_dec (&rreq->nr_outstanding); -netfs_put_subrequest (subreq, false, netfs_sreq_trace_put_cancel); - ret = slice; -break ; - } +if (slice <0 ) + goto prep_iter_failed; rreq->netfs_ops->issue_read (subreq); goto done;
@@ -302,6 +294,8 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq)trace_netfs_sreq (subreq, netfs_sreq_trace_submit);netfs_stat (&netfs_n_rh_zero); slice =netfs_prepare_read_iterator (subreq); +if (slice <0 ) + goto prep_iter_failed;__set_bit (NETFS_SREQ_CLEAR_TAIL , &subreq->flags);netfs_read_subreq_terminated (subreq,0 , false); goto done;
@@ -310,6 +304,8 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq)if (source ==NETFS_READ_FROM_CACHE ) {trace_netfs_sreq (subreq, netfs_sreq_trace_submit); slice =netfs_prepare_read_iterator (subreq); +if (slice <0 ) + goto prep_iter_failed;netfs_read_cache_to_pagecache (rreq, subreq); goto done; }
@@ -318,6 +314,14 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq)WARN_ON_ONCE (1 );break ; + prep_iter_failed: + ret = slice; + prep_failed: + subreq->error = ret; +atomic_dec (&rreq->nr_outstanding); +netfs_put_subrequest (subreq, false, netfs_sreq_trace_put_cancel); +break ; + done: size -= slice; start += slice;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/189 nfs: Fix oops in nfs_netfs_init_request() when copying to cache
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 86ad1a58f6a9453f49e06ef957a40a8dac00a13f ]
When netfslib wants to copy some data that has just been read on behalf of nfs, it creates a new write request and calls nfs_netfs_init_request() to initialise it, but with a NULL file pointer. This causes nfs_file_open_context() to oops - however, we don't actually need the nfs context as we're only going to write to the cache.
Fix this by just returning if we aren't given a file pointer and emit a warning if the request was for something other than copy-to-cache.
Further, fix nfs_netfs_free_request() so that it doesn't try to free the context if the pointer is NULL.
--- fs/nfs/fscache.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/nfs/fscache.c +8 -1
@@ -263,6 +263,12 @@ int nfs_netfs_readahead(struct readahead_control *ractl)static atomic_t nfs_netfs_debug_id;static int nfs_netfs_init_request (struct netfs_io_request *rreq,struct file *file) { +if (!file) { +if (WARN_ON_ONCE (rreq->origin !=NETFS_PGPRIV2_COPY_TO_CACHE )) +return -EIO ; +return 0 ; + } + rreq->netfs_priv =get_nfs_open_context (nfs_file_open_context (file)); rreq->debug_id =atomic_inc_return (&nfs_netfs_debug_id);/* [DEPRECATED] Use PG_private_2 to mark folio being written to the cache. */
@@ -274,7 +280,8 @@ static int nfs_netfs_init_request(struct netfs_io_request *rreq, struct file *fistatic void nfs_netfs_free_request (struct netfs_io_request *rreq) { -put_nfs_open_context (rreq->netfs_priv); +if (rreq->netfs_priv) +put_nfs_open_context (rreq->netfs_priv); }static struct nfs_netfs_io_data *nfs_netfs_alloc (struct netfs_io_subrequest *sreq)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/189 netfs: Fix missing barriers by using clear_and_wake_up_bit()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit aa3956418985bda1f68313eadde3267921847978 ]
Use clear_and_wake_up_bit() rather than something like:
clear_bit_unlock(NETFS_RREQ_IN_PROGRESS, &rreq->flags); wake_up_bit(&rreq->flags, NETFS_RREQ_IN_PROGRESS);
as there needs to be a barrier inserted between which is present in clear_and_wake_up_bit().
--- fs/netfs/read_collect.c | 3 +-- fs/netfs/write_collect.c | 9 +++------ 2 files changed, 4 insertions(+), 8 deletions(-)
fs/netfs/read_collect.c +1 -2
@@ -378,8 +378,7 @@ static void netfs_rreq_assess(struct netfs_io_request *rreq)task_io_account_read (rreq->transferred);trace_netfs_rreq (rreq, netfs_rreq_trace_wake_ip); -clear_bit_unlock (NETFS_RREQ_IN_PROGRESS , &rreq->flags); -wake_up_bit (&rreq->flags,NETFS_RREQ_IN_PROGRESS ); +clear_and_wake_up_bit (NETFS_RREQ_IN_PROGRESS , &rreq->flags);trace_netfs_rreq (rreq, netfs_rreq_trace_done);netfs_clear_subrequests (rreq, false);
fs/netfs/write_collect.c +3 -6
@@ -501,8 +501,7 @@ static void netfs_collect_write_results(struct netfs_io_request *wreq) goto need_retry;if ((notes &MADE_PROGRESS ) &&test_bit (NETFS_RREQ_PAUSE , &wreq->flags)) {trace_netfs_rreq (wreq, netfs_rreq_trace_unpause); -clear_bit_unlock (NETFS_RREQ_PAUSE , &wreq->flags); -wake_up_bit (&wreq->flags,NETFS_RREQ_PAUSE ); +clear_and_wake_up_bit (NETFS_RREQ_PAUSE , &wreq->flags); }if (notes &NEED_REASSESS ) {
@@ -605,8 +604,7 @@ void netfs_write_collection_worker(struct work_struct *work)_debug ("finished" );trace_netfs_rreq (wreq, netfs_rreq_trace_wake_ip); -clear_bit_unlock (NETFS_RREQ_IN_PROGRESS , &wreq->flags); -wake_up_bit (&wreq->flags,NETFS_RREQ_IN_PROGRESS ); +clear_and_wake_up_bit (NETFS_RREQ_IN_PROGRESS , &wreq->flags);if (wreq->iocb) {size_t written =min (wreq->transferred, wreq->len);
@@ -714,8 +712,7 @@ void netfs_write_subrequest_terminated(void *_op, ssize_t transferred_or_error,trace_netfs_sreq (subreq, netfs_sreq_trace_terminated); -clear_bit_unlock (NETFS_SREQ_IN_PROGRESS , &subreq->flags); -wake_up_bit (&subreq->flags,NETFS_SREQ_IN_PROGRESS ); +clear_and_wake_up_bit (NETFS_SREQ_IN_PROGRESS , &subreq->flags);/* If we are at the head of the queue, wake up the collector, * transferring a ref to it if we were the ones to do so.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/189 netfs: Fix ceph copy to cache on write-begin
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 38cf8e945721ffe708fa675507465da7f4f2a9f7 ]
At the end of netfs_unlock_read_folio() in which folios are marked appropriately for copying to the cache (either with by being marked dirty and having their private data set or by having PG_private_2 set) and then unlocked, the folio_queue struct has the entry pointing to the folio cleared. This presents a problem for netfs_pgpriv2_write_to_the_cache(), which is used to write folios marked with PG_private_2 to the cache as it expects to be able to trawl the folio_queue list thereafter to find the relevant folios, leading to a hang.
Fix this by not clearing the folio_queue entry if we're going to do the deprecated copy-to-cache. The clearance will be done instead as the folios are written to the cache.
This can be reproduced by starting cachefiles, mounting a ceph filesystem with "-o fsc" and writing to it.
--- fs/netfs/read_collect.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/netfs/read_collect.c +4 -2
@@ -62,10 +62,14 @@ static void netfs_unlock_read_folio(struct netfs_io_subrequest *subreq, }else {trace_netfs_folio (folio, netfs_folio_trace_read_done); } + +folioq_clear (folioq, slot); }else {// TODO: Use of PG_private_2 is deprecated. if (test_bit (NETFS_SREQ_COPY_TO_CACHE , &subreq->flags))netfs_pgpriv2_mark_copy_to_cache (subreq, rreq, folioq, slot); +else +folioq_clear (folioq, slot); }if (!test_bit (NETFS_RREQ_DONT_UNLOCK_FOLIOS , &rreq->flags)) {
@@ -77,8 +81,6 @@ static void netfs_unlock_read_folio(struct netfs_io_subrequest *subreq,folio_unlock (folio); } } - -folioq_clear (folioq, slot); }/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/189 netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit d0327c824338cdccad058723a31d038ecd553409 ]
When the caching for a cookie is temporarily disabled (e.g. due to a DIO write on that file), future copying to the cache for that file is disabled until all fds open on that file are closed. However, if netfslib is using the deprecated PG_private_2 method (such as is currently used by ceph), and decides it wants to copy to the cache, netfs_advance_write() will just bail at the first check seeing that the cache stream is unavailable, and indicate that it dealt with all the content.
This means that we have no subrequests to provide notifications to drive the state machine or even to pin the request and the request just gets discarded, leaving the folios with PG_private_2 set.
Fix this by jumping directly to cancel the request if the cache is not available. That way, we don't remove mark3 from the folio_queue list and netfs_pgpriv2_cancel() will clean up the folios.
This was found by running the generic/013 xfstest against ceph with an active cache and the "-o fsc" option passed to ceph. That would usually hang
--- fs/netfs/read_pgpriv2.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/netfs/read_pgpriv2.c +4 -0
@@ -170,6 +170,10 @@ void netfs_pgpriv2_write_to_the_cache(struct netfs_io_request *rreq)trace_netfs_write (wreq, netfs_write_trace_copy_to_cache);netfs_stat (&netfs_n_wh_copy_to_cache); +if (!wreq->io_streams[1 ].avail) { +netfs_put_request (wreq, false, netfs_rreq_trace_put_return); + goto couldnt_start; + }for (;;) { error =netfs_pgpriv2_copy_folio (wreq, folio);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/189 netfs: Fix is-caching check in read-retry
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit d4e338de17cb6532bf805fae00db8b41e914009b ]
netfs: Fix is-caching check in read-retry
The read-retry code checks the NETFS_RREQ_COPY_TO_CACHE flag to determine if there might be failed reads from the cache that need turning into reads from the server, with the intention of skipping the complicated part if it can. The code that set the flag, however, got lost during the read-side rewrite.
Fix the check to see if the cache_resources are valid instead. The flag can then be removed.
--- fs/netfs/read_retry.c | 2 +- include/linux/netfs.h | 1 - 2 files changed, 1 insertion(+), 2 deletions(-)
fs/netfs/read_retry.c +1 -1
@@ -49,7 +49,7 @@ static void netfs_retry_read_subrequests(struct netfs_io_request *rreq)* up to the first permanently failed one. */ if (!rreq->netfs_ops->prepare_read && - !test_bit (NETFS_RREQ_COPY_TO_CACHE , &rreq->flags)) { + !rreq->cache_resources.ops) {struct netfs_io_subrequest *subreq;list_for_each_entry (subreq, &rreq->subrequests, rreq_link) {
include/linux/netfs.h +0 -1
@@ -269,7 +269,6 @@ struct netfs_io_request {size_t prev_donated;/* Fallback for subreq->prev_donated */ refcount_t ref;unsigned long flags; -#define NETFS_RREQ_COPY_TO_CACHE 1/* Need to write to the cache */ #define NETFS_RREQ_NO_UNLOCK_FOLIO 2/* Don't unlock no_unlock_folio on completion */ #define NETFS_RREQ_DONT_UNLOCK_FOLIOS 3/* Don't unlock the folios on completion */ #define NETFS_RREQ_FAILED 4/* The request failed */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/189 exfat: fix the infinite loop in exfat_readdir()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit fee873761bd978d077d8c55334b4966ac4cb7b59 ]
If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop.
This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs().
This commit stops traversing the cluster chain when there is unused directory entry in the cluster to avoid this infinite loop.
--- fs/exfat/dir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/exfat/dir.c +2 -1
@@ -125,7 +125,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent type =exfat_get_entry_type (ep);if (type ==TYPE_UNUSED ) {brelse (bh); -break ; + goto out; }if (type !=TYPE_FILE && type !=TYPE_DIR ) {
@@ -189,6 +189,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent } } +out: dir_entry->namebuf.lfn[0 ] ='\0' ; *cpos =EXFAT_DEN_TO_B (dentry);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/189 exfat: fix the new buffer was not zeroed before writing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit 98e2fb26d1a9eafe79f46d15d54e68e014d81d8c ]
Before writing, if a buffer_head marked as new, its data must be zeroed, otherwise uninitialized data in the page cache will be written.
So this commit uses folio_zero_new_buffers() to zero the new buffers before ->write_end().
--- fs/exfat/file.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/exfat/file.c +6 -0
@@ -545,6 +545,7 @@ static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size)while (pos < new_valid_size) {u32 len;struct folio *folio; +unsigned long off; len =PAGE_SIZE - (pos & (PAGE_SIZE -1 ));if (pos + len > new_valid_size)
@@ -554,6 +555,9 @@ static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size)if (err) goto out; + off =offset_in_folio (folio, pos); +folio_zero_new_buffers (folio, off, off + len); + err = ops->write_end (file, mapping, pos, len, len, folio,NULL );if (err <0 ) goto out;
@@ -563,6 +567,8 @@ static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size)cond_resched (); } +return 0 ; + out:return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/189 exfat: fix the infinite loop in __exfat_free_cluster()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit a5324b3a488d883aa2d42f72260054e87d0940a0 ]
In __exfat_free_cluster(), the cluster chain is traversed until the EOF cluster. If the cluster chain includes a loop due to file system corruption, the EOF cluster cannot be traversed, resulting in an infinite loop.
This commit uses the total number of clusters to prevent this infinite loop.
--- fs/exfat/fatent.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/exfat/fatent.c +10 -0
@@ -216,6 +216,16 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chainif (err) goto dec_used_clus; + +if (num_clusters >= sbi->num_clusters -EXFAT_FIRST_CLUSTER ) { +/* +* The cluster chain includes a loop, scan the +* bitmap to get the number of used clusters. +*/ +exfat_count_used_clusters (sb, &sbi->used_clusters); + +return 0 ; + } }while (clu !=EXFAT_EOF_CLUSTER ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/189 fuse: respect FOPEN_KEEP_CACHE on opendir
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit 03f275adb8fbd7b4ebe96a1ad5044d8e602692dc ]
The re-factoring of fuse_dir_open() missed the need to invalidate directory inode page cache with open flag FOPEN_KEEP_CACHE.
--- fs/fuse/dir.c | 2 ++ 1 file changed, 2 insertions(+)
fs/fuse/dir.c +2 -0
@@ -1680,6 +1680,8 @@ static int fuse_dir_open(struct inode *inode, struct file *file)*/ if (ff->open_flags & (FOPEN_STREAM |FOPEN_NONSEEKABLE ))nonseekable_open (inode, file); +if (!(ff->open_flags &FOPEN_KEEP_CACHE )) +invalidate_inode_pages2 (inode->i_mapping); }return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/189 ovl: pass realinode to ovl_encode_real_fh() instead of realdentry
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit 07aeefae7ff44d80524375253980b1bdee2396b0 ]
We want to be able to encode an fid from an inode with no alias.
Stable-dep-of: c45beebfde34 ("ovl: support encoding fid from inode with no alias")
--- fs/overlayfs/copy_up.c | 11 ++++++----- fs/overlayfs/export.c | 5 +++-- fs/overlayfs/namei.c | 4 ++-- fs/overlayfs/overlayfs.h | 2 +- 4 files changed, 12 insertions(+), 10 deletions(-)
fs/overlayfs/copy_up.c +6 -5
@@ -416,13 +416,13 @@ int ovl_set_attr(struct ovl_fs *ofs, struct dentry *upperdentry,return err; } -struct ovl_fh *ovl_encode_real_fh (struct ovl_fs *ofs,struct dentry *real, +struct ovl_fh *ovl_encode_real_fh (struct ovl_fs *ofs,struct inode *realinode,bool is_upper) {struct ovl_fh *fh;int fh_type, dwords;int buflen =MAX_HANDLE_SZ ; -uuid_t *uuid = &real->d_sb->s_uuid; +uuid_t *uuid = &realinode->i_sb->s_uuid;int err;/* Make sure the real fid stays 32bit aligned */
@@ -439,7 +439,8 @@ struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real,* the price or reconnecting the dentry. */ dwords = buflen >>2 ; - fh_type =exportfs_encode_fh (real, (void *)fh->fb.fid, &dwords,0 ); + fh_type =exportfs_encode_inode_fh (realinode, (void *)fh->fb.fid, + &dwords,NULL ,0 ); buflen = (dwords <<2 ); err = -EIO ;
@@ -481,7 +482,7 @@ struct ovl_fh *ovl_get_origin_fh(struct ovl_fs *ofs, struct dentry *origin)if (!ovl_can_decode_fh (origin->d_sb))return NULL ; -return ovl_encode_real_fh (ofs, origin, false); +return ovl_encode_real_fh (ofs,d_inode (origin), false); } int ovl_set_origin_fh(struct ovl_fs *ofs, const struct ovl_fh *fh,
@@ -506,7 +507,7 @@ static int ovl_set_upper_fh(struct ovl_fs *ofs, struct dentry *upper,const struct ovl_fh *fh;int err; - fh =ovl_encode_real_fh (ofs, upper, true); + fh =ovl_encode_real_fh (ofs,d_inode (upper), true);if (IS_ERR (fh))return PTR_ERR (fh);
fs/overlayfs/export.c +3 -2
@@ -223,6 +223,7 @@ static int ovl_check_encode_origin(struct dentry *dentry)static int ovl_dentry_to_fid (struct ovl_fs *ofs,struct dentry *dentry,u32 *fid,int buflen) { +struct inode *inode =d_inode (dentry);struct ovl_fh *fh =NULL ;int err, enc_lower;int len;
@@ -236,8 +237,8 @@ static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry, goto fail;/* Encode an upper or lower file handle */ - fh =ovl_encode_real_fh (ofs, enc_lower ?ovl_dentry_lower (dentry) : -ovl_dentry_upper (dentry), !enc_lower); + fh =ovl_encode_real_fh (ofs, enc_lower ?ovl_inode_lower (inode) : +ovl_inode_upper (inode), !enc_lower);if (IS_ERR (fh))return PTR_ERR (fh);
fs/overlayfs/namei.c +2 -2
@@ -542,7 +542,7 @@ int ovl_verify_origin_xattr(struct ovl_fs *ofs, struct dentry *dentry,struct ovl_fh *fh;int err; - fh =ovl_encode_real_fh (ofs, real, is_upper); + fh =ovl_encode_real_fh (ofs,d_inode (real), is_upper); err =PTR_ERR (fh);if (IS_ERR (fh)) { fh =NULL ;
@@ -738,7 +738,7 @@ int ovl_get_index_name(struct ovl_fs *ofs, struct dentry *origin,struct ovl_fh *fh;int err; - fh =ovl_encode_real_fh (ofs, origin, false); + fh =ovl_encode_real_fh (ofs,d_inode (origin), false);if (IS_ERR (fh))return PTR_ERR (fh);
fs/overlayfs/overlayfs.h +1 -1
@@ -869,7 +869,7 @@ int ovl_copy_up_with_data(struct dentry *dentry);int ovl_maybe_copy_up (struct dentry *dentry,int flags);int ovl_copy_xattr (struct super_block *sb,const struct path *path,struct dentry *new);int ovl_set_attr (struct ovl_fs *ofs,struct dentry *upper,struct kstat *stat); -struct ovl_fh *ovl_encode_real_fh (struct ovl_fs *ofs,struct dentry *real, +struct ovl_fh *ovl_encode_real_fh (struct ovl_fs *ofs,struct inode *realinode,bool is_upper);struct ovl_fh *ovl_get_origin_fh (struct ovl_fs *ofs,struct dentry *origin); int ovl_set_origin_fh(struct ovl_fs *ofs, const struct ovl_fh *fh,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/189 ovl: support encoding fid from inode with no alias
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit c45beebfde34aa71afbc48b2c54cdda623515037 ]
Dmitry Safonov reported that a WARN_ON() assertion can be trigered by userspace when calling inotify_show_fdinfo() for an overlayfs watched inode, whose dentry aliases were discarded with drop_caches.
The WARN_ON() assertion in inotify_show_fdinfo() was removed, because it is possible for encoding file handle to fail for other reason, but the impact of failing to encode an overlayfs file handle goes beyond this assertion.
As shown in the LTP test case mentioned in the link below, failure to encode an overlayfs file handle from a non-aliased inode also leads to failure to report an fid with FAN_DELETE_SELF fanotify events.
As Dmitry notes in his analyzis of the problem, ovl_encode_fh() fails if it cannot find an alias for the inode, but this failure can be fixed. ovl_encode_fh() seldom uses the alias and in the case of non-decodable file handles, as is often the case with fanotify fid info, ovl_encode_fh() never needs to use the alias to encode a file handle.
Defer finding an alias until it is actually needed so ovl_encode_fh() will not fail in the common case of FAN_DELETE_SELF fanotify events.
--- fs/overlayfs/export.c | 46 +++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 21 deletions(-)
fs/overlayfs/export.c +25 -21
@@ -176,35 +176,37 @@ static int ovl_connect_layer(struct dentry *dentry)* * Return 0 for upper file handle, > 0 for lower file handle or < 0 on error. */ -static int ovl_check_encode_origin (struct dentry *dentry) +static int ovl_check_encode_origin (struct inode *inode) { -struct ovl_fs *ofs =OVL_FS (dentry->d_sb); +struct ovl_fs *ofs =OVL_FS (inode->i_sb);bool decodable = ofs->config.nfs_export; +struct dentry *dentry; +int err;/* No upper layer? */ if (!ovl_upper_mnt (ofs))return 1 ;/* Lower file handle for non-upper non-decodable */ -if (!ovl_dentry_upper (dentry) && !decodable) +if (!ovl_inode_upper (inode) && !decodable)return 1 ;/* Upper file handle for pure upper */ -if (!ovl_dentry_lower (dentry)) +if (!ovl_inode_lower (inode))return 0 ;/* * Root is never indexed, so if there's an upper layer, encode upper for * root. */ -if (dentry == dentry->d_sb->s_root) +if (inode ==d_inode (inode->i_sb->s_root))return 0 ;/* * Upper decodable file handle for non-indexed upper. */ -if (ovl_dentry_upper (dentry) && decodable && - !ovl_test_flag (OVL_INDEX ,d_inode (dentry))) +if (ovl_inode_upper (inode) && decodable && + !ovl_test_flag (OVL_INDEX , inode))return 0 ;/*
@@ -213,17 +215,25 @@ static int ovl_check_encode_origin(struct dentry *dentry)* ovl_connect_layer() will try to make origin's layer "connected" by * copying up a "connectable" ancestor. */ -if (d_is_dir (dentry) && decodable) -return ovl_connect_layer (dentry); +if (!decodable || !S_ISDIR (inode->i_mode)) +return 1 ; + + dentry =d_find_any_alias (inode); +if (!dentry) +return -ENOENT ; + + err =ovl_connect_layer (dentry); +dput (dentry); +if (err <0 ) +return err;/* Lower file handle for indexed and non-upper dir/non-dir */ return 1 ; } -static int ovl_dentry_to_fid (struct ovl_fs *ofs,struct dentry *dentry, +static int ovl_dentry_to_fid (struct ovl_fs *ofs,struct inode *inode,u32 *fid,int buflen) { -struct inode *inode =d_inode (dentry);struct ovl_fh *fh =NULL ;int err, enc_lower;int len;
@@ -232,7 +242,7 @@ static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry,* Check if we should encode a lower or upper file handle and maybe * copy up an ancestor to make lower file handle connectable. */ - err = enc_lower =ovl_check_encode_origin (dentry); + err = enc_lower =ovl_check_encode_origin (inode);if (enc_lower <0 ) goto fail;
@@ -252,8 +262,8 @@ static int ovl_dentry_to_fid(struct ovl_fs *ofs, struct dentry *dentry,return err; fail: -pr_warn_ratelimited ("failed to encode file handle (%pd2, err=%i)\n" , - dentry, err); +pr_warn_ratelimited ("failed to encode file handle (ino=%lu, err=%i)\n" , + inode->i_ino, err); goto out; }
@@ -261,19 +271,13 @@ static int ovl_encode_fh(struct inode *inode, u32 *fid, int *max_len, struct inode *parent) {struct ovl_fs *ofs =OVL_FS (inode->i_sb); -struct dentry *dentry;int bytes, buflen = *max_len <<2 ;/* TODO: encode connectable file handles */ if (parent)return FILEID_INVALID ; - dentry =d_find_any_alias (inode); -if (!dentry) -return FILEID_INVALID ; - - bytes =ovl_dentry_to_fid (ofs, dentry, fid, buflen); -dput (dentry); + bytes =ovl_dentry_to_fid (ofs, inode, fid, buflen);if (bytes <=0 )return FILEID_INVALID ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/189 ASoC: rt722: add delay time to wait for the calibration procedure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuming Fan <[email protected]>
[ Upstream commit c9e3ebdc52ebe028f238c9df5162ae92483bedd5 ]
The calibration procedure needs some time to finish.
This patch adds the delay time to ensure the calibration procedure is completed correctly.
--- sound/soc/codecs/rt722-sdca.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
sound/soc/codecs/rt722-sdca.c +6 -1
@@ -1467,13 +1467,18 @@ static void rt722_sdca_jack_preset(struct rt722_sdca_priv *rt722) 0x008d);/* check HP calibration FSM status */ for (loop_check =0 ; loop_check < chk_cnt; loop_check++) { +usleep_range (10000 ,11000 ); ret =rt722_sdca_index_read (rt722,RT722_VENDOR_CALI ,RT722_DAC_DC_CALI_CTL3 , &calib_status); -if (ret <0 || loop_check == chk_cnt) +if (ret <0 )dev_dbg (&rt722->slave->dev,"calibration failed!, ret=%d\n" , ret);if ((calib_status &0x0040 ) ==0x0 )break ; } + +if (loop_check == chk_cnt) +dev_dbg (&rt722->slave->dev,"%s, calibration time-out!\n" , __func__); +/* Set ADC09 power entity floating control */ rt722_sdca_index_write (rt722,RT722_VENDOR_HDA_CTL ,RT722_ADC0A_08_PDE_FLOAT_CTL ,0x2a12 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/189 ASoC: mediatek: disable buffer pre-allocation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 32c9c06adb5b157ef259233775a063a43746d699 ]
On Chromebooks based on Mediatek MT8195 or MT8188, the audio frontend (AFE) is limited to accessing a very small window (1 MiB) of memory, which is described as a reserved memory region in the device tree.
On these two platforms, the maximum buffer size is given as 512 KiB. The MediaTek common code uses the same value for preallocations. This means that only the first two PCM substreams get preallocations, and then the whole space is exhausted, barring any other substreams from working. Since the substreams used are not always the first two, this means audio won't work correctly.
This is observed on the MT8188 Geralt Chromebooks, on which the "mediatek,dai-link" property was dropped when it was upstreamed. That property causes the driver to only register the PCM substreams listed in the property, and in the order given.
Instead of trying to compute an optimal value and figuring out which streams are used, simply disable preallocation. The PCM buffers are managed by the core and are allocated and released on the fly. There should be no impact to any of the other MediaTek platforms.
--- sound/soc/mediatek/common/mtk-afe-platform-driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/mediatek/common/mtk-afe-platform-driver.c +2 -2
@@ -120,8 +120,8 @@ int mtk_afe_pcm_new(struct snd_soc_component *component,struct mtk_base_afe *afe =snd_soc_component_get_drvdata (component); size = afe->mtk_afe_hardware->buffer_bytes_max; -snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , - afe->dev, size, size); +snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , afe->dev,0 , size); +return 0 ; }EXPORT_SYMBOL_GPL (mtk_afe_pcm_new);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/189 selftests/alsa: Fix circular dependency involving global-timer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit 55853cb829dc707427c3519f6b8686682a204368 ]
The pattern rule $(OUTPUT)/%: %.c inadvertently included a circular dependency on the global-timer target due to its inclusion in $(TEST_GEN_PROGS_EXTENDED). This resulted in a circular dependency warning during the build process.
To resolve this, the dependency on $(TEST_GEN_PROGS_EXTENDED) has been replaced with an explicit dependency on $(OUTPUT)/libatest.so. This change ensures that libatest.so is built before any other targets that require it, without creating a circular dependency.
This fix addresses the following warning:
make[4]: Entering directory 'tools/testing/selftests/alsa'
make[4]: Circular default_modconfig/kselftest/alsa/global-timer <- default_modconfig/kselftest/alsa/global-timer dependency dropped. make[4]: Nothing to be done for 'all'.
make[4]: Leaving directory 'tools/testing/selftests/alsa'
--- tools/testing/selftests/alsa/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/alsa/Makefile +1 -1
@@ -27,5 +27,5 @@ include ../lib.mk $(OUTPUT)/libatest.so: conf.c alsa-local.h $(CC) $(CFLAGS) -shared -fPIC $< $(LDLIBS) -o $@ -$(OUTPUT)/%: %.c $(TEST_GEN_PROGS_EXTENDED) alsa-local.h +$(OUTPUT)/%: %.c $(OUTPUT)/libatest.so alsa-local.h $(CC) $(CFLAGS) $< $(LDLIBS) -latest -o $@
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/189 ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keisuke Nishimura <[email protected]>
[ Upstream commit 2c87309ea741341c6722efdf1fb3f50dd427c823 ]
ca8210_test_interface_init() returns the result of kfifo_alloc(), which can be non-zero in case of an error. The caller, ca8210_probe(), should check the return value and do error-handling if it fails.
--- drivers/net/ieee802154/ca8210.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ieee802154/ca8210.c +5 -1
@@ -3072,7 +3072,11 @@ static int ca8210_probe(struct spi_device *spi_device)spi_set_drvdata (priv->spi, priv);if (IS_ENABLED (CONFIG_IEEE802154_CA8210_DEBUGFS )) { cascoda_api_upstream = ca8210_test_int_driver_write; -ca8210_test_interface_init (priv); + ret =ca8210_test_interface_init (priv); +if (ret) { +dev_crit (&spi_device->dev,"ca8210_test_interface_init failed\n" ); + goto error; + } }else { cascoda_api_upstream =NULL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/189 net: 802: LLC+SNAP OID:PID lookup on start of skb data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Pastor <[email protected]>
[ Upstream commit 1e9b0e1c550c42c13c111d1a31e822057232abc4 ]
802.2+LLC+SNAP frames received by napi_complete_done() with GRO and DSA have skb->transport_header set two bytes short, or pointing 2 bytes before network_header & skb->data. This was an issue as snap_rcv() expected offset to point to SNAP header (OID:PID), causing packet to be dropped.
A fix at llc_fixup_skb() (a024e377efed) resets transport_header for any LLC consumers that may care about it, and stops SNAP packets from being dropped, but doesn't fix the problem which is that LLC and SNAP should not use transport_header offset.
Ths patch eliminates the use of transport_header offset for SNAP lookup of OID:PID so that SNAP does not rely on the offset at all. The offset is reset after pull for any SNAP packet consumers that may (but shouldn't) use it.
--- net/802/psnap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/802/psnap.c +2 -2
@@ -55,11 +55,11 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, goto drop;rcu_read_lock (); - proto =find_snap_client (skb_transport_header (skb)); + proto =find_snap_client (skb->data);if (proto) {/* Pass the frame on. */ - skb->transport_header +=5 ;skb_pull_rcsum (skb,5 ); +skb_reset_transport_header (skb); rc = proto->rcvfunc (skb, dev, &snap_packet_type, orig_dev); }rcu_read_unlock ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/189 tcp/dccp: allow a connection when sk_max_ack_backlog is zero
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Duan <[email protected]>
[ Upstream commit 3479c7549fb1dfa7a1db4efb7347c7b8ef50de4b ]
If the backlog of listen() is set to zero, sk_acceptq_is_full() allows one connection to be made, but inet_csk_reqsk_queue_is_full() does not. When the net.ipv4.tcp_syncookies is zero, inet_csk_reqsk_queue_is_full() will cause an immediate drop before the sk_acceptq_is_full() check in tcp_conn_request(), resulting in no connection can be made.
This patch tries to keep consistent with 64a146513f8f ("[NET]: Revert incorrect accept queue backlog changes.").
--- include/net/inet_connection_sock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/inet_connection_sock.h +1 -1
@@ -281,7 +281,7 @@ static inline int inet_csk_reqsk_queue_len(const struct sock *sk)static inline int inet_csk_reqsk_queue_is_full (const struct sock *sk) { -return inet_csk_reqsk_queue_len (sk) >=READ_ONCE (sk->sk_max_ack_backlog); +return inet_csk_reqsk_queue_len (sk) >READ_ONCE (sk->sk_max_ack_backlog); }bool inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/189 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit a039e54397c6a75b713b9ce7894a62e06956aa92 ]
syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values.
UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1771 [inline] tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867 sfb_classify net/sched/sch_sfb.c:260 [inline] sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318 dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793 __dev_xmit_skb net/core/dev.c:3889 [inline] __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173 geneve_xmit_skb drivers/net/geneve.c:916 [inline] geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
--- net/sched/cls_flow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/cls_flow.c +2 -1
@@ -356,7 +356,8 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = { [TCA_FLOW_KEYS] = { .type = NLA_U32 }, [TCA_FLOW_MODE] = { .type = NLA_U32 }, [TCA_FLOW_BASECLASS] = { .type = NLA_U32 }, - [TCA_FLOW_RSHIFT] = { .type = NLA_U32 }, + [TCA_FLOW_RSHIFT ] =NLA_POLICY_MAX (NLA_U32 , + 31 /* BITS_PER_U32 - 1 */), [TCA_FLOW_ADDEND] = { .type = NLA_U32 }, [TCA_FLOW_MASK] = { .type = NLA_U32 }, [TCA_FLOW_XOR] = { .type = NLA_U32 },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/189 net: libwx: fix firmware mailbox abnormal return
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit 8ce4f287524c74a118b0af1eebd4b24a8efca57a ]
The existing SW-FW interaction flow on the driver is wrong. Follow this wrong flow, driver would never return error if there is a unknown command. Since firmware writes back 'firmware ready' and 'unknown command' in the mailbox message if there is an unknown command sent by driver. So reading 'firmware ready' does not timeout. Then driver would mistakenly believe that the interaction has completed successfully.
It tends to happen with the use of custom firmware. Move the check for 'unknown command' out of the poll timeout for 'firmware ready'. And adjust the debug log so that mailbox messages are always printed when commands timeout.
--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 24 ++++++++++------------ 1 file changed, 11 insertions(+), 13 deletions(-)
drivers/net/ethernet/wangxun/libwx/wx_hw.c +11 -13
@@ -334,27 +334,25 @@ int wx_host_interface_command(struct wx *wx, u32 *buffer, status =read_poll_timeout (rd32, hicr, hicr &WX_MNG_MBOX_CTL_FWRDY ,1000 , timeout *1000 , false, wx,WX_MNG_MBOX_CTL ); + buf[0 ] =rd32 (wx,WX_MNG_MBOX ); +if ((buf[0 ] &0xff0000 ) >>16 ==0x80 ) { +wx_err (wx,"Unknown FW command: 0x%x\n" , buffer[0 ] &0xff ); + status = -EINVAL ; + goto rel_out; + } +/* Check command completion */ if (status) { -wx_dbg (wx,"Command has failed with no status valid.\n" ); - - buf[0 ] =rd32 (wx,WX_MNG_MBOX ); -if ((buffer[0 ] &0xff ) != (~buf[0 ] >>24 )) { - status = -EINVAL ; - goto rel_out; - } -if ((buf[0 ] &0xff0000 ) >>16 ==0x80 ) { -wx_dbg (wx,"It's unknown cmd.\n" ); - status = -EINVAL ; - goto rel_out; - } - +wx_err (wx,"Command has failed with no status valid.\n" );wx_dbg (wx,"write value:\n" );for (i =0 ; i < dword_len; i++)wx_dbg (wx,"%x " , buffer[i]);wx_dbg (wx,"read value:\n" );for (i =0 ; i < dword_len; i++)wx_dbg (wx,"%x " , buf[i]); +wx_dbg (wx,"\ncheck: %x %x\n" , buffer[0 ] &0xff , ~buf[0 ] >>24 ); + + goto rel_out; }if (!return_data)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/189 btrfs: avoid NULL pointer dereference if no valid extent tree
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 6aecd91a5c5b68939cf4169e32bc49f3cd2dd329 ]
[BUG]
Syzbot reported a crash with the following call trace:
BTRFS info (device loop0): scrub: started on devid 1
BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G O 6.13.0-rc4-custom+ #206 Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs] Call Trace: <TASK> scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs] scrub_simple_mirror+0x175/0x260 [btrfs] scrub_stripe+0x5d4/0x6c0 [btrfs] scrub_chunk+0xbb/0x170 [btrfs] scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs] btrfs_scrub_dev+0x240/0x600 [btrfs] btrfs_ioctl+0x1dc8/0x2fa0 [btrfs] ? do_sys_openat2+0xa5/0xf0 __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>
[CAUSE]
The reproducer is using a corrupted image where extent tree root is corrupted, thus forcing to use "rescue=all,ro" mount option to mount the image.
Then it triggered a scrub, but since scrub relies on extent tree to find where the data/metadata extents are, scrub_find_fill_first_stripe() relies on an non-empty extent root.
But unfortunately scrub_find_fill_first_stripe() doesn't really expect an NULL pointer for extent root, it use extent_root to grab fs_info and triggered a NULL pointer dereference.
[FIX]
Add an extra check for a valid extent root at the beginning of scrub_find_fill_first_stripe().
The new error path is introduced by 42437a6386ff ("btrfs: introduce mount option rescue=ignorebadroots"), but that's pretty old, and later commit b979547513ff ("btrfs: scrub: introduce helper to find and fill sector info for a scrub_stripe") changed how we do scrub.
So for kernels older than 6.6, the fix will need manual backport.
--- fs/btrfs/scrub.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/btrfs/scrub.c +4 -0
@@ -1541,6 +1541,10 @@ static int scrub_find_fill_first_stripe(struct btrfs_block_group *bg,u64 extent_gen;int ret; +if (unlikely (!extent_root)) { +btrfs_err (fs_info,"no valid extent root for scrub" ); +return -EUCLEAN ; + }memset (stripe->sectors,0 ,sizeof (struct scrub_sector_verification ) * stripe->nr_sectors);scrub_stripe_reset_bitmaps (stripe);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/189 pds_core: limit loop over fw name list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit 8c817eb26230dc0ae553cee16ff43a4a895f6756 ]
Add an array size limit to the for-loop to be sure we don't try to reference a fw_version string off the end of the fw info names array. We know that our firmware only has a limited number of firmware slot names, but we shouldn't leave this unchecked.
--- drivers/net/ethernet/amd/pds_core/devlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/amd/pds_core/devlink.c +1 -1
@@ -118,7 +118,7 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req,if (err && err != -EIO )return err; - listlen = fw_list.num_fw_slots; + listlen =min (fw_list.num_fw_slots,ARRAY_SIZE (fw_list.fw_names));for (i =0 ; i < listlen; i++) {if (i <ARRAY_SIZE (fw_slotnames))strscpy (buf, fw_slotnames[i],sizeof (buf));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/189 bnxt_en: Fix possible memory leak when hwrm_req_replace fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit c8dafb0e4398dacc362832098a04b97da3b0395b ]
When hwrm_req_replace() fails, the driver is not invoking bnxt_req_drop() which could cause a memory leak.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +2 -1
@@ -208,7 +208,7 @@ int bnxt_send_msg(struct bnxt_en_dev *edev, rc =hwrm_req_replace (bp, req, fw_msg->msg, fw_msg->msg_len);if (rc) -return rc; + goto drop_req;hwrm_req_timeout (bp, req, fw_msg->timeout); resp =hwrm_req_hold (bp, req);
@@ -220,6 +220,7 @@ int bnxt_send_msg(struct bnxt_en_dev *edev,memcpy (fw_msg->resp, resp, resp_len); } +drop_req:hwrm_req_drop (bp, req);return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/189 bnxt_en: Fix DIM shutdown
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit 40452969a50652e3cbf89dac83d54eebf2206d27 ]
DIM work will call the firmware to adjust the coalescing parameters on the RX rings. We should cancel DIM work before we call the firmware to free the RX rings. Otherwise, FW will reject the call from DIM work if the RX ring has been freed. This will generate an error message like this:
bnxt_en 0000:21:00.1 ens2f1np1: hwrm req_type 0x53 seq id 0x6fca error 0x2
and cause unnecessary concern for the user. It is also possible to modify the coalescing parameters of the wrong ring if the ring has been re-allocated.
To prevent this, cancel DIM work right before freeing the RX rings. We also have to add a check in NAPI poll to not schedule DIM if the RX rings are shutting down. Check that the VNIC is active before we schedule DIM. The VNIC is always disabled before we free the RX rings.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 38 ++++++++++++++++++++--- 1 file changed, 33 insertions(+), 5 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +33 -5
@@ -2826,6 +2826,13 @@ static int bnxt_hwrm_handler(struct bnxt *bp, struct tx_cmp *txcmp)return 0 ; } +static bool bnxt_vnic_is_active (struct bnxt *bp) +{ +struct bnxt_vnic_info *vnic = &bp->vnic_info[0 ]; + +return vnic->fw_vnic_id !=INVALID_HW_RING_ID && vnic->mru >0 ; +} +static irqreturn_t bnxt_msix (int irq,void *dev_instance) {struct bnxt_napi *bnapi = dev_instance;
@@ -3093,7 +3100,7 @@ static int bnxt_poll(struct napi_struct *napi, int budget)break ; } } -if (bp->flags &BNXT_FLAG_DIM ) { +if ((bp->flags &BNXT_FLAG_DIM ) &&bnxt_vnic_is_active (bp)) {struct dim_sample dim_sample = {}; dim_update_sample(cpr->event_ctr,
@@ -3224,7 +3231,7 @@ static int bnxt_poll_p5(struct napi_struct *napi, int budget) poll_done: cpr_rx = &cpr->cp_ring_arr[0 ];if (cpr_rx->cp_ring_type ==BNXT_NQ_HDL_TYPE_RX && - (bp->flags &BNXT_FLAG_DIM )) { + (bp->flags &BNXT_FLAG_DIM ) &&bnxt_vnic_is_active (bp)) {struct dim_sample dim_sample = {}; dim_update_sample(cpr->event_ctr,
@@ -7116,6 +7123,26 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp)return rc; } +static void bnxt_cancel_dim (struct bnxt *bp) +{ +int i; + +/* DIM work is initialized in bnxt_enable_napi(). Proceed only +* if NAPI is enabled. +*/ +if (!bp->bnapi ||test_bit (BNXT_STATE_NAPI_DISABLED , &bp->state)) +return ; + +/* Make sure NAPI sees that the VNIC is disabled */ +synchronize_net (); +for (i =0 ; i < bp->rx_nr_rings; i++) { +struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i]; +struct bnxt_napi *bnapi = rxr->bnapi; + +cancel_work_sync (&bnapi->cp_ring.dim.work); + } +} +static int hwrm_ring_free_send_msg (struct bnxt *bp,struct bnxt_ring_struct *ring,u32 ring_type,int cmpl_ring_id)
@@ -7216,6 +7243,7 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path) } } +bnxt_cancel_dim (bp);for (i =0 ; i < bp->rx_nr_rings; i++) {bnxt_hwrm_rx_ring_free (bp, &bp->rx_ring[i], close_path);bnxt_hwrm_rx_agg_ring_free (bp, &bp->rx_ring[i], close_path);
@@ -11012,8 +11040,6 @@ static void bnxt_disable_napi(struct bnxt *bp)if (bnapi->in_reset) cpr->sw_stats->rx.rx_resets++;napi_disable (&bnapi->napi); -if (bnapi->rx_ring) -cancel_work_sync (&cpr->dim.work); } }
@@ -15269,8 +15295,10 @@ static int bnxt_queue_stop(struct net_device *dev, void *qmem, int idx)bnxt_hwrm_vnic_update (bp, vnic,VNIC_UPDATE_REQ_ENABLES_MRU_VALID ); } - +/* Make sure NAPI sees that the VNIC is disabled */ +synchronize_net (); rxr = &bp->rx_ring[idx]; +cancel_work_sync (&rxr->bnapi->cp_ring.dim.work);bnxt_hwrm_rx_ring_free (bp, rxr, false);bnxt_hwrm_rx_agg_ring_free (bp, rxr, false); rxr->rx_next_cons =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/189 cxgb4: Avoid removal of uninserted tid
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anumula Murali Mohan Reddy <[email protected]>
[ Upstream commit 4c1224501e9d6c5fd12d83752f1c1b444e0e3418 ]
During ARP failure, tid is not inserted but _c4iw_free_ep() attempts to remove tid which results in error.
This patch fixes the issue by avoiding removal of uninserted tid.
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +4 -1
@@ -1799,7 +1799,10 @@ void cxgb4_remove_tid(struct tid_info *t, unsigned int chan, unsigned int tid, struct adapter *adap = container_of(t, struct adapter, tids);struct sk_buff *skb; -WARN_ON (tid_out_of_range (&adap->tids, tid)); +if (tid_out_of_range (&adap->tids, tid)) { +dev_err (adap->pdev_dev,"tid %d out of range\n" , tid); +return ; + }if (t->tid_tab[tid - adap->tids.tid_base]) { t->tid_tab[tid - adap->tids.tid_base] =NULL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/189 net: dont dump Tx and uninitialized NAPIs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit fd48f071a3d6d51e737e953bb43fe69785cf59a9 ]
We use NAPI ID as the key for continuing dumps. We also depend on the NAPIs being sorted by ID within the driver list. Tx NAPIs (which don't have an ID assigned) break this expectation, it's not currently possible to dump them reliably. Since Tx NAPIs are relatively rare, and can't be used in doit (GET or SET) hide them from the dump API as well.
--- net/core/netdev-genl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/core/netdev-genl.c +3 -2
@@ -173,8 +173,7 @@ netdev_nl_napi_fill_one(struct sk_buff *rsp, struct napi_struct *napi,if (!hdr)return -EMSGSIZE ; -if (napi->napi_id >=MIN_NAPI_ID && -nla_put_u32 (rsp,NETDEV_A_NAPI_ID , napi->napi_id)) +if (nla_put_u32 (rsp,NETDEV_A_NAPI_ID , napi->napi_id)) goto nla_put_failure;if (nla_put_u32 (rsp,NETDEV_A_NAPI_IFINDEX , napi->dev->ifindex))
@@ -254,6 +253,8 @@ netdev_nl_napi_dump_one(struct net_device *netdev, struct sk_buff *rsp,return err;list_for_each_entry (napi, &netdev->napi_list, dev_list) { +if (napi->napi_id <MIN_NAPI_ID ) +continue ;if (ctx->napi_id && napi->napi_id >= ctx->napi_id)continue ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/189 ice: fix max values for dpll pin phase adjust
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadiusz Kubalewski <[email protected]>
[ Upstream commit 65104599b3a8ed42d85b3f8f27be650afe1f3a7e ]
Mask admin command returned max phase adjust value for both input and output pins. Only 31 bits are relevant, last released data sheet wrongly points that 32 bits are valid - see [1] 3.2.6.4.1 Get CCU Capabilities Command for reference. Fix of the datasheet itself is in progress.
Fix the min/max assignment logic, previously the value was wrongly considered as negative value due to most significant bit being set.
Example of previous broken behavior:
$ ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/dpll.yaml \
--do pin-get --json '{"id":1}'| grep phase-adjust
'phase-adjust': 0,
'phase-adjust-max': 16723,
'phase-adjust-min': -16723,Correct behavior with the fix:
$ ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/dpll.yaml \
--do pin-get --json '{"id":1}'| grep phase-adjust
'phase-adjust': 0,
'phase-adjust-max': 2147466925,
'phase-adjust-min': -2147466925,[1] https://cdrdv2.intel.com/v1/dl/getContent/613875?explicitVersion=true
--- .../net/ethernet/intel/ice/ice_adminq_cmd.h | 2 ++ drivers/net/ethernet/intel/ice/ice_dpll.c | 35 ++++++++++++------- 2 files changed, 25 insertions(+), 12 deletions(-)
drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +2 -0
@@ -2238,6 +2238,8 @@ struct ice_aqc_get_pkg_info_resp {struct ice_aqc_get_pkg_info pkg_info[]; }; +#define ICE_AQC_GET_CGU_MAX_PHASE_ADJ GENMASK(30, 0) +/* Get CGU abilities command response data structure (indirect 0x0C61) */ struct ice_aqc_get_cgu_abilities {u8 num_inputs;
drivers/net/ethernet/intel/ice/ice_dpll.c +23 -12
@@ -2064,6 +2064,18 @@ static int ice_dpll_init_worker(struct ice_pf *pf)return 0 ; } +/** +* ice_dpll_phase_range_set - initialize phase adjust range helper +* @range: pointer to phase adjust range struct to be initialized +* @phase_adj: a value to be used as min(-)/max(+) boundary +*/ +static void ice_dpll_phase_range_set (struct dpll_pin_phase_adjust_range *range, +u32 phase_adj) +{ + range->min = -phase_adj; + range->max = phase_adj; +} +/** * ice_dpll_init_info_pins_generic - initializes generic pins info * @pf: board private structure
@@ -2105,8 +2117,8 @@ static int ice_dpll_init_info_pins_generic(struct ice_pf *pf, bool input)for (i =0 ; i < pin_num; i++) { pins[i].idx = i; pins[i].prop.board_label = labels[i]; - pins[i].prop.phase_range.min = phase_adj_max; - pins[i].prop.phase_range.max = -phase_adj_max; +ice_dpll_phase_range_set (&pins[i].prop.phase_range, + phase_adj_max); pins[i].prop.capabilities = cap; pins[i].pf = pf; ret =ice_dpll_pin_state_update (pf, &pins[i], pin_type,NULL );
@@ -2152,6 +2164,7 @@ ice_dpll_init_info_direct_pins(struct ice_pf *pf,struct ice_hw *hw = &pf->hw;struct ice_dpll_pin *pins;unsigned long caps; +u32 phase_adj_max;u8 freq_supp_num;bool input;
@@ -2159,11 +2172,13 @@ ice_dpll_init_info_direct_pins(struct ice_pf *pf,case ICE_DPLL_PIN_TYPE_INPUT : pins = pf->dplls.inputs; num_pins = pf->dplls.num_inputs; + phase_adj_max = pf->dplls.input_phase_adj_max; input = true;break ;case ICE_DPLL_PIN_TYPE_OUTPUT : pins = pf->dplls.outputs; num_pins = pf->dplls.num_outputs; + phase_adj_max = pf->dplls.output_phase_adj_max; input = false;break ;default :
@@ -2188,19 +2203,13 @@ ice_dpll_init_info_direct_pins(struct ice_pf *pf,return ret; caps |= (DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE |DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE ); - pins[i].prop.phase_range.min = - pf->dplls.input_phase_adj_max; - pins[i].prop.phase_range.max = - -pf->dplls.input_phase_adj_max; }else { - pins[i].prop.phase_range.min = - pf->dplls.output_phase_adj_max; - pins[i].prop.phase_range.max = - -pf->dplls.output_phase_adj_max; ret =ice_cgu_get_output_pin_state_caps (hw, i, &caps);if (ret)return ret; } +ice_dpll_phase_range_set (&pins[i].prop.phase_range, + phase_adj_max); pins[i].prop.capabilities = caps; ret =ice_dpll_pin_state_update (pf, &pins[i], pin_type,NULL );if (ret)
@@ -2308,8 +2317,10 @@ static int ice_dpll_init_info(struct ice_pf *pf, bool cgu) dp->dpll_idx = abilities.pps_dpll_idx; d->num_inputs = abilities.num_inputs; d->num_outputs = abilities.num_outputs; - d->input_phase_adj_max =le32_to_cpu (abilities.max_in_phase_adj); - d->output_phase_adj_max =le32_to_cpu (abilities.max_out_phase_adj); + d->input_phase_adj_max =le32_to_cpu (abilities.max_in_phase_adj) & +ICE_AQC_GET_CGU_MAX_PHASE_ADJ ; + d->output_phase_adj_max =le32_to_cpu (abilities.max_out_phase_adj) & +ICE_AQC_GET_CGU_MAX_PHASE_ADJ ; alloc_size =sizeof (*d->inputs) * d->num_inputs; d->inputs =kzalloc (alloc_size,GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/189 ice: fix incorrect PHY settings for 100 GB/s
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemyslaw Korba <[email protected]>
[ Upstream commit 6c5b989116083a98f45aada548ff54e7a83a9c2d ]
ptp4l application reports too high offset when ran on E823 device with a 100GB/s link. Those values cannot go under 100ns, like in a working case when using 100 GB/s cable.
This is due to incorrect frequency settings on the PHY clocks for 100 GB/s speed. Changes are introduced to align with the internal hardware documentation, and correctly initialize frequency in PHY clocks with the frequency values that are in our HW spec.
To reproduce the issue run ptp4l as a Time Receiver on E823 device, and observe the offset, which will never approach values seen in the PTP working case.
Reproduction output:
ptp4l -i enp137s0f3 -m -2 -s -f /etc/ptp4l_8275.conf
ptp4l[5278.775]: master offset 12470 s2 freq +41288 path delay -3002 ptp4l[5278.837]: master offset 10525 s2 freq +39202 path delay -3002 ptp4l[5278.900]: master offset -24840 s2 freq -20130 path delay -3002 ptp4l[5278.963]: master offset 10597 s2 freq +37908 path delay -3002 ptp4l[5279.025]: master offset 8883 s2 freq +36031 path delay -3002 ptp4l[5279.088]: master offset 7267 s2 freq +34151 path delay -3002 ptp4l[5279.150]: master offset 5771 s2 freq +32316 path delay -3002 ptp4l[5279.213]: master offset 4388 s2 freq +30526 path delay -3002 ptp4l[5279.275]: master offset -30434 s2 freq -28485 path delay -3002 ptp4l[5279.338]: master offset -28041 s2 freq -27412 path delay -3002 ptp4l[5279.400]: master offset 7870 s2 freq +31118 path delay -3002
--- drivers/net/ethernet/intel/ice/ice_ptp_consts.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_ptp_consts.h +2 -2
@@ -761,9 +761,9 @@ const struct ice_vernier_info_e82x e822_vernier[NUM_ICE_PTP_LNK_SPD] = {/* rx_desk_rsgb_par */ 644531250 ,/* 644.53125 MHz Reed Solomon gearbox */ /* tx_desk_rsgb_pcs */ -644531250 ,/* 644.53125 MHz Reed Solomon gearbox */ +390625000 ,/* 390.625 MHz Reed Solomon gearbox */ /* rx_desk_rsgb_pcs */ -644531250 ,/* 644.53125 MHz Reed Solomon gearbox */ +390625000 ,/* 390.625 MHz Reed Solomon gearbox */ /* tx_fixed_delay */ 1620,/* pmd_adj_divisor */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/189 igc: return early when failing to read EECD register
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: En-Wei Wu <[email protected]>
[ Upstream commit bd2776e39c2a82ef4681d02678bb77b3d41e79be ]
When booting with a dock connected, the igc driver may get stuck for ~40 seconds if PCIe link is lost during initialization.
This happens because the driver access device after EECD register reads return all F's, indicating failed reads. Consequently, hw->hw_addr is set to NULL, which impacts subsequent rd32() reads. This leads to the driver hanging in igc_get_hw_semaphore_i225(), as the invalid hw->hw_addr prevents retrieving the expected value.
To address this, a validation check and a corresponding return value catch is added for the EECD register read result. If all F's are returned, indicating PCIe link loss, the driver will return -ENXIO immediately. This avoids the 40-second hang and significantly improves boot time when using a dock with an igc NIC.
Log before the patch:
[ 0.911913] igc 0000:70:00.0: enabling device (0000 -> 0002) [ 0.912386] igc 0000:70:00.0: PTM enabled, 4ns granularity [ 1.571098] igc 0000:70:00.0 (unnamed net_device) (uninitialized): PCIe link lost, device now detached [ 43.449095] igc_get_hw_semaphore_i225: igc 0000:70:00.0 (unnamed net_device) (uninitialized): Driver can't access device - SMBI bit is set. [ 43.449186] igc 0000:70:00.0: probe with driver igc failed with error -13 [ 46.345701] igc 0000:70:00.0: enabling device (0000 -> 0002) [ 46.345777] igc 0000:70:00.0: PTM enabled, 4ns granularity
Log after the patch:
[ 1.031000] igc 0000:70:00.0: enabling device (0000 -> 0002) [ 1.032097] igc 0000:70:00.0: PTM enabled, 4ns granularity [ 1.642291] igc 0000:70:00.0 (unnamed net_device) (uninitialized): PCIe link lost, device now detached [ 5.480490] igc 0000:70:00.0: enabling device (0000 -> 0002) [ 5.480516] igc 0000:70:00.0: PTM enabled, 4ns granularity
--- drivers/net/ethernet/intel/igc/igc_base.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/intel/igc/igc_base.c +6 -0
@@ -68,6 +68,10 @@ static s32 igc_init_nvm_params_base(struct igc_hw *hw)u32 eecd =rd32 (IGC_EECD );u16 size; +/* failed to read reg and got all F's */ +if (!(~eecd)) +return -ENXIO ; + size =FIELD_GET (IGC_EECD_SIZE_EX_MASK , eecd);/* Added to a constant, "size" becomes the left-shift value
@@ -221,6 +225,8 @@ static s32 igc_get_invariants_base(struct igc_hw *hw)/* NVM initialization */ ret_val =igc_init_nvm_params_base (hw); +if (ret_val) + goto out;switch (hw->mac.type) {case igc_i225: ret_val =igc_init_nvm_params_i225 (hw);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/189 tls: Fix tls_sw_sendmsg error handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
[ Upstream commit b341ca51d2679829d26a3f6a4aa9aee9abd94f92 ]
We've noticed that NFS can hang when using RPC over TLS on an unstable connection, and investigation shows that the RPC layer is stuck in a tight loop attempting to transmit, but forever getting -EBADMSG back from the underlying network. The loop begins when tcp_sendmsg_locked() returns -EPIPE to tls_tx_records(), but that error is converted to -EBADMSG when calling the socket's error reporting handler.
Instead of converting errors from tcp_sendmsg_locked(), let's pass them along in this path. The RPC layer handles -EPIPE by reconnecting the transport, which prevents the endless attempts to transmit on a broken connection.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -458,7 +458,7 @@ int tls_tx_records(struct sock *sk, int flags) tx_err:if (rc <0 && rc != -EAGAIN ) -tls_err_abort (sk, -EBADMSG ); +tls_err_abort (sk, rc);return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/189 ipvlan: Fix use-after-free in ipvlan_get_iflink().
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit cb358ff94154774d031159b018adf45e17673941 ]
syzbot presented an use-after-free report [0] regarding ipvlan and linkwatch.
ipvlan does not hold a refcnt of the lower device unlike vlan and macvlan.
If the linkwatch work is triggered for the ipvlan dev, the lower dev might have already been freed, resulting in UAF of ipvlan->phy_dev in ipvlan_get_iflink().
We can delay the lower dev unregistration like vlan and macvlan by holding the lower dev's refcnt in dev->netdev_ops->ndo_init() and releasing it in dev->priv_destructor().
Jakub pointed out calling .ndo_XXX after unregister_netdevice() has returned is error prone and suggested [1] addressing this UAF in the core by taking commit 750e51603395 ("net: avoid potential UAF in default_operstate()") further.
Let's assume unregistering devices DOWN and use RCU protection in default_operstate() not to race with the device unregistration.
[0]:
BUG: KASAN: slab-use-after-free in ipvlan_get_iflink+0x84/0x88 drivers/net/ipvlan/ipvlan_main.c:353 Read of size 4 at addr ffff0000d768c0e0 by task kworker/u8:35/6944 CPU: 0 UID: 0 PID: 6944 Comm: kworker/u8:35 Not tainted 6.13.0-rc2-g9bc5c9515b48 #12 4c3cb9e8b4565456f6a355f312ff91f4f29b3c47 Hardware name: linux,dummy-virt (DT) Workqueue: events_unbound linkwatch_event Call trace: show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:484 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x16c/0x6f0 mm/kasan/report.c:489 kasan_report+0xc0/0x120 mm/kasan/report.c:602 __asan_report_load4_noabort+0x20/0x30 mm/kasan/report_generic.c:380 ipvlan_get_iflink+0x84/0x88 drivers/net/ipvlan/ipvlan_main.c:353 dev_get_iflink+0x7c/0xd8 net/core/dev.c:674 default_operstate net/core/link_watch.c:45 [inline] rfc2863_policy+0x144/0x360 net/core/link_watch.c:72 linkwatch_do_dev+0x60/0x228 net/core/link_watch.c:175 __linkwatch_run_queue+0x2f4/0x5b8 net/core/link_watch.c:239 linkwatch_event+0x64/0xa8 net/core/link_watch.c:282 process_one_work+0x700/0x1398 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x8c4/0xe10 kernel/workqueue.c:3391 kthread+0x2b0/0x360 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 Allocated by task 9303: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x68 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x58 mm/kasan/generic.c:568 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4283 [inline] __kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4289 __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:650 alloc_netdev_mqs+0xb4/0x1118 net/core/dev.c:11209 rtnl_create_link+0x2b8/0xb60 net/core/rtnetlink.c:3595 rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3771 __rtnl_newlink net/core/rtnetlink.c:3896 [inline] rtnl_newlink+0x122c/0x15c0 net/core/rtnetlink.c:4011 rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6901 netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6928 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x2ec/0x438 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __arm64_sys_sendto+0xe4/0x110 net/socket.c:2200 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151 el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600 Freed by task 10200: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x68 mm/kasan/common.c:68 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x48/0x68 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kfree+0x140/0x420 mm/slub.c:4746 kvfree+0x4c/0x68 mm/util.c:693 netdev_release+0x94/0xc8 net/core/net-sysfs.c:2034 device_release+0x98/0x1c0 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2b0/0x438 lib/kobject.c:737 netdev_run_todo+0xdd8/0xf48 net/core/dev.c:10924 rtnl_unlock net/core/rtnetlink.c:152 [inline] rtnl_net_unlock net/core/rtnetlink.c:209 [inline] rtnl_dellink+0x484/0x680 net/core/rtnetlink.c:3526 rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6901 netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6928 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] ____sys_sendmsg+0x410/0x708 net/socket.c:2583 ___sys_sendmsg+0x178/0x1d8 net/socket.c:2637 __sys_sendmsg net/socket.c:2669 [inline] __do_sys_sendmsg net/socket.c:2674 [inline] __se_sys_sendmsg net/socket.c:2672 [inline] __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2672 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151 el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600 The buggy address belongs to the object at ffff0000d768c000 which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 224 bytes inside of
freed 4096-byte region [ffff0000d768c000, ffff0000d768d000)
The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117688
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff0000c77ef981
flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)page_type: f5(slab)
raw: 0bfffe0000000040 ffff0000c000f500 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000001f5000000 ffff0000c77ef981
head: 0bfffe0000000040 ffff0000c000f500 dead000000000100 dead000000000122
head: 0000000000000000 0000000000040004 00000001f5000000 ffff0000c77ef981
head: 0bfffe0000000003 fffffdffc35da201 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000d768bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d768c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000d768c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000d768c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000d768c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- net/core/link_watch.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/core/link_watch.c +7 -3
@@ -42,14 +42,18 @@ static unsigned int default_operstate(const struct net_device *dev)* first check whether lower is indeed the source of its down state. */ if (!netif_carrier_ok (dev)) { -int iflink =dev_get_iflink (dev);struct net_device *peer; +int iflink;/* If called from netdev_run_todo()/linkwatch_sync_dev(), * dev_net(dev) can be already freed, and RTNL is not held. */ -if (dev->reg_state ==NETREG_UNREGISTERED || - iflink == dev->ifindex) +if (dev->reg_state <=NETREG_REGISTERED ) + iflink =dev_get_iflink (dev); +else + iflink = dev->ifindex; + +if (iflink == dev->ifindex)return IF_OPER_DOWN ;ASSERT_RTNL ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/189 eth: gve: use appropriate helper to set xdp_features
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit db78475ba0d3c66d430f7ded2388cc041078a542 ]
Commit f85949f98206 ("xdp: add xdp_set_features_flag utility routine") added routines to inform the core about XDP flag changes. GVE support was added around the same time and missed using them.
GVE only changes the flags on error recover or resume. Presumably the flags may change during resume if VM migrated. User would not get the notification and upper devices would not get a chance to recalculate their flags.
--- drivers/net/ethernet/google/gve/gve_main.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/net/ethernet/google/gve/gve_main.c +9 -5
@@ -2224,14 +2224,18 @@ static void gve_service_task(struct work_struct *work)static void gve_set_netdev_xdp_features (struct gve_priv *priv) { +xdp_features_t xdp_features; +if (priv->queue_format ==GVE_GQI_QPL_FORMAT ) { - priv->dev->xdp_features =NETDEV_XDP_ACT_BASIC ; - priv->dev->xdp_features |=NETDEV_XDP_ACT_REDIRECT ; - priv->dev->xdp_features |=NETDEV_XDP_ACT_NDO_XMIT ; - priv->dev->xdp_features |=NETDEV_XDP_ACT_XSK_ZEROCOPY ; + xdp_features =NETDEV_XDP_ACT_BASIC ; + xdp_features |=NETDEV_XDP_ACT_REDIRECT ; + xdp_features |=NETDEV_XDP_ACT_NDO_XMIT ; + xdp_features |=NETDEV_XDP_ACT_XSK_ZEROCOPY ; }else { - priv->dev->xdp_features =0 ; + xdp_features =0 ; } + +xdp_set_features_flag (priv->dev, xdp_features); }static int gve_init_priv (struct gve_priv *priv,bool skip_describe_device)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/189 Bluetooth: hci_sync: Fix not setting Random Address when required
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit c2994b008492db033d40bd767be1620229a3035e ]
This fixes errors such as the following when Own address type is set to Random Address but it has not been programmed yet due to either be advertising or connecting:
< HCI Command: LE Set Exte.. (0x08|0x0041) plen 13
Own address type: Random (0x03)
Filter policy: Ignore not in accept list (0x01)
PHYs: 0x05
Entry 0: LE 1M
Type: Passive (0x00)
Interval: 60.000 msec (0x0060)
Window: 30.000 msec (0x0030)
Entry 1: LE Coded
Type: Passive (0x00)
Interval: 180.000 msec (0x0120)
Window: 90.000 msec (0x0090)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 4
LE Set Extended Scan Parameters (0x08|0x0041) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Exten.. (0x08|0x0042) plen 6
Extended scan: Enabled (0x01)
Filter duplicates: Enabled (0x01)
Duration: 0 msec (0x0000)
Period: 0.00 sec (0x0000)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 4
LE Set Extended Scan Enable (0x08|0x0042) ncmd 1
Status: Invalid HCI Command Parameters (0x12)--- net/bluetooth/hci_sync.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/bluetooth/hci_sync.c +6 -5
@@ -1031,9 +1031,9 @@ static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags)static int hci_set_random_addr_sync (struct hci_dev *hdev,bdaddr_t *rpa) { -/* If we're advertising or initiating an LE connection we can't -* go ahead and change the random address at this time. This is -* because the eventual initiator address used for the +/* If a random_addr has been set we're advertising or initiating an LE +* connection we can't go ahead and change the random address at this +* time. This is because the eventual initiator address used for the * subsequently created connection will be undefined (some * controllers use the new address and others the one we had * when the operation started).
@@ -1041,8 +1041,9 @@ static int hci_set_random_addr_sync(struct hci_dev *hdev, bdaddr_t *rpa)* In this kind of scenario skip the update and let the random * address be updated at the next cycle. */ -if (hci_dev_test_flag (hdev,HCI_LE_ADV ) || -hci_lookup_le_connect (hdev)) { +if (bacmp (&hdev->random_addr,BDADDR_ANY ) && + (hci_dev_test_flag (hdev,HCI_LE_ADV ) || +hci_lookup_le_connect (hdev))) {bt_dev_dbg (hdev,"Deferring random address update" );hci_dev_set_flag (hdev,HCI_RPA_EXPIRED );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/189 Bluetooth: MGMT: Fix Add Device to responding before completing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit a182d9c84f9c52fb5db895ecceeee8b3a1bf661e ]
Add Device with LE type requires updating resolving/accept list which requires quite a number of commands to complete and each of them may fail, so instead of pretending it would always work this checks the return of hci_update_passive_scan_sync which indicates if everything worked as intended.
--- net/bluetooth/mgmt.c | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-)
net/bluetooth/mgmt.c +36 -2
@@ -7596,6 +7596,24 @@ static void device_added(struct sock *sk, struct hci_dev *hdev,mgmt_event (MGMT_EV_DEVICE_ADDED , hdev, &ev,sizeof (ev), sk); } +static void add_device_complete (struct hci_dev *hdev,void *data,int err) +{ +struct mgmt_pending_cmd *cmd = data; +struct mgmt_cp_add_device *cp = cmd->param; + +if (!err) { +device_added (cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, + cp->action); +device_flags_changed (NULL , hdev, &cp->addr.bdaddr, + cp->addr.type, hdev->conn_flags, +PTR_UINT (cmd->user_data)); + } + +mgmt_cmd_complete (cmd->sk, hdev->id,MGMT_OP_ADD_DEVICE , +mgmt_status (err), &cp->addr,sizeof (cp->addr)); +mgmt_pending_free (cmd); +} +static int add_device_sync (struct hci_dev *hdev,void *data) {return hci_update_passive_scan_sync (hdev);
@@ -7604,6 +7622,7 @@ static int add_device_sync(struct hci_dev *hdev, void *data)static int add_device (struct sock *sk,struct hci_dev *hdev,void *data,u16 len) { +struct mgmt_pending_cmd *cmd;struct mgmt_cp_add_device *cp = data;u8 auto_conn, addr_type;struct hci_conn_params *params;
@@ -7684,9 +7703,24 @@ static int add_device(struct sock *sk, struct hci_dev *hdev, current_flags = params->flags; } - err =hci_cmd_sync_queue (hdev, add_device_sync,NULL ,NULL ); -if (err <0 ) + cmd =mgmt_pending_new (sk,MGMT_OP_ADD_DEVICE , hdev, data, len); +if (!cmd) { + err = -ENOMEM ; goto unlock; + } + + cmd->user_data =UINT_PTR (current_flags); + + err =hci_cmd_sync_queue (hdev, add_device_sync, cmd, + add_device_complete); +if (err <0 ) { + err =mgmt_cmd_complete (sk, hdev->id,MGMT_OP_ADD_DEVICE , +MGMT_STATUS_FAILED , &cp->addr, +sizeof (cp->addr)); +mgmt_pending_free (cmd); + } + + goto unlock; added:device_added (sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/189 Bluetooth: btnxpuart: Fix driver sending truncated data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neeraj Sanjay Kale <[email protected]>
[ Upstream commit 8023dd2204254a70887f5ee58d914bf70a060b9d ]
This fixes the apparent controller hang issue seen during stress test where the host sends a truncated payload, followed by HCI commands. The controller treats these HCI commands as a part of previously truncated payload, leading to command timeouts.
Adding a serdev_device_wait_until_sent() call after serdev_device_write_buf() fixed the issue.
--- drivers/bluetooth/btnxpuart.c | 1 + 1 file changed, 1 insertion(+)
drivers/bluetooth/btnxpuart.c +1 -0
@@ -1336,6 +1336,7 @@ static void btnxpuart_tx_work(struct work_struct *work)while ((skb =nxp_dequeue (nxpdev))) { len =serdev_device_write_buf (serdev, skb->data, skb->len); +serdev_device_wait_until_sent (serdev,0 ); hdev->stat.byte_tx += len;skb_pull (skb, len);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/189 Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit 67dba2c28fe0af7e25ea1aeade677162ed05310a ]
Use usb_autopm_get_interface() and usb_autopm_put_interface() in btmtk_usb_shutdown(), it could send func ctrl after enabling autosuspend.
Bluetooth: btmtk_usb_hci_wmt_sync() hci0: Execution of wmt command
timed out
Bluetooth: btmtk_usb_shutdown() hci0: Failed to send wmt func ctrl
(-110)
--- drivers/bluetooth/btmtk.c | 7 +++++++ net/bluetooth/rfcomm/tty.c | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/bluetooth/btmtk.c +7 -0
@@ -1472,10 +1472,15 @@ EXPORT_SYMBOL_GPL(btmtk_usb_setup);int btmtk_usb_shutdown (struct hci_dev *hdev) { +struct btmtk_data *data =hci_get_priv (hdev);struct btmtk_hci_wmt_params wmt_params;u8 param =0 ;int err; + err =usb_autopm_get_interface (data->intf); +if (err <0 ) +return err; +/* Disable the device */ wmt_params.op =BTMTK_WMT_FUNC_CTRL ; wmt_params.flag =0 ;
@@ -1486,9 +1491,11 @@ int btmtk_usb_shutdown(struct hci_dev *hdev) err =btmtk_usb_hci_wmt_sync (hdev, &wmt_params);if (err <0 ) {bt_dev_err (hdev,"Failed to send wmt func ctrl (%d)" , err); +usb_autopm_put_interface (data->intf);return err; } +usb_autopm_put_interface (data->intf);return 0 ; }EXPORT_SYMBOL_GPL (btmtk_usb_shutdown);
net/bluetooth/rfcomm/tty.c +2 -2
@@ -201,14 +201,14 @@ static ssize_t address_show(struct device *tty_dev, struct device_attribute *attr, char *buf) { struct rfcomm_dev *dev = dev_get_drvdata(tty_dev); -return sprintf (buf,"%pMR\n" , &dev->dst); +return sysfs_emit (buf,"%pMR\n" , &dev->dst); }static ssize_t channel_show (struct device *tty_dev,struct device_attribute *attr,char *buf) {struct rfcomm_dev *dev =dev_get_drvdata (tty_dev); -return sprintf (buf,"%d\n" , dev->channel); +return sysfs_emit (buf,"%d\n" , dev->channel); }static DEVICE_ATTR_RO (address);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/189 tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 80fb40baba19e25a1b6f3ecff6fc5c0171806bde ]
This is a follow-up to 3c5b4d69c358 ("net: annotate data-races around sk->sk_mark"). sk->sk_mark can be read and written without holding the socket lock. IPv6 equivalent is already covered with READ_ONCE() annotation in tcp_v6_send_response().
--- net/ipv4/tcp_ipv4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_ipv4.c +1 -1
@@ -896,7 +896,7 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb,sock_net_set (ctl_sk, net);if (sk) { ctl_sk->sk_mark = (sk->sk_state ==TCP_TIME_WAIT ) ? -inet_twsk (sk)->tw_mark : sk->sk_mark; +inet_twsk (sk)->tw_mark :READ_ONCE (sk->sk_mark); ctl_sk->sk_priority = (sk->sk_state ==TCP_TIME_WAIT ) ?inet_twsk (sk)->tw_priority :READ_ONCE (sk->sk_priority); transmit_time =tcp_transmit_time (sk);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/189 net: hns3: fixed reset failure issues caused by the incorrect reset type
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Lan <[email protected]>
[ Upstream commit 5a4b584c67699a69981f0740618a144965a63237 ]
When a reset type that is not supported by the driver is input, a reset pending flag bit of the HNAE3_NONE_RESET type is generated in reset_pending. The driver does not have a mechanism to clear this type of error. As a result, the driver considers that the reset is not complete. This patch provides a mechanism to clear the HNAE3_NONE_RESET flag and the parameter of hnae3_ae_ops.set_default_reset_request is verified.
The error message:
hns3 0000:39:01.0: cmd failed -16
hns3 0000:39:01.0: hclge device re-init failed, VF is disabled! hns3 0000:39:01.0: failed to reset VF stack
hns3 0000:39:01.0: failed to reset VF(4)
hns3 0000:39:01.0: prepare reset(2) wait done
hns3 0000:39:01.0 eth4: already uninitialized
Use the crash tool to view struct hclgevf_dev:
struct hclgevf_dev {
...
default_reset_request = 0x20, reset_level = HNAE3_NONE_RESET, reset_pending = 0x100, reset_type = HNAE3_NONE_RESET,
...
};
--- .../hisilicon/hns3/hns3pf/hclge_main.c | 33 ++++++++++++++-- .../hisilicon/hns3/hns3vf/hclgevf_main.c | 38 ++++++++++++++++--- 2 files changed, 61 insertions(+), 10 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +29 -4
@@ -3584,6 +3584,17 @@ static int hclge_set_vf_link_state(struct hnae3_handle *handle, int vf,return ret; } +static void hclge_set_reset_pending (struct hclge_dev *hdev, +enum hnae3_reset_type reset_type) +{ +/* When an incorrect reset type is executed, the get_reset_level +* function generates the HNAE3_NONE_RESET flag. As a result, this +* type do not need to pending. +*/ +if (reset_type !=HNAE3_NONE_RESET ) +set_bit (reset_type, &hdev->reset_pending); +} +static u32 hclge_check_event_cause (struct hclge_dev *hdev,u32 *clearval) {u32 cmdq_src_reg, msix_src_reg, hw_err_src_reg;
@@ -3604,7 +3615,7 @@ static u32 hclge_check_event_cause(struct hclge_dev *hdev, u32 *clearval)*/ if (BIT (HCLGE_VECTOR0_IMPRESET_INT_B ) & msix_src_reg) {dev_info (&hdev->pdev->dev,"IMP reset interrupt\n" ); -set_bit (HNAE3_IMP_RESET , &hdev->reset_pending); +hclge_set_reset_pending (hdev,HNAE3_IMP_RESET );set_bit (HCLGE_COMM_STATE_CMD_DISABLE , &hdev->hw.hw.comm_state); *clearval =BIT (HCLGE_VECTOR0_IMPRESET_INT_B ); hdev->rst_stats.imp_rst_cnt++;
@@ -3614,7 +3625,7 @@ static u32 hclge_check_event_cause(struct hclge_dev *hdev, u32 *clearval)if (BIT (HCLGE_VECTOR0_GLOBALRESET_INT_B ) & msix_src_reg) {dev_info (&hdev->pdev->dev,"global reset interrupt\n" );set_bit (HCLGE_COMM_STATE_CMD_DISABLE , &hdev->hw.hw.comm_state); -set_bit (HNAE3_GLOBAL_RESET , &hdev->reset_pending); +hclge_set_reset_pending (hdev,HNAE3_GLOBAL_RESET ); *clearval =BIT (HCLGE_VECTOR0_GLOBALRESET_INT_B ); hdev->rst_stats.global_rst_cnt++;return HCLGE_VECTOR0_EVENT_RST ;
@@ -4062,7 +4073,7 @@ static void hclge_do_reset(struct hclge_dev *hdev)case HNAE3_FUNC_RESET :dev_info (&pdev->dev,"PF reset requested\n" );/* schedule again to check later */ -set_bit (HNAE3_FUNC_RESET , &hdev->reset_pending); +hclge_set_reset_pending (hdev,HNAE3_FUNC_RESET );hclge_reset_task_schedule (hdev);break ;default :
@@ -4096,6 +4107,8 @@ static enum hnae3_reset_type hclge_get_reset_level(struct hnae3_ae_dev *ae_dev,clear_bit (HNAE3_FLR_RESET , addr); } +clear_bit (HNAE3_NONE_RESET , addr); +if (hdev->reset_type !=HNAE3_NONE_RESET && rst_level < hdev->reset_type)return HNAE3_NONE_RESET ;
@@ -4237,7 +4250,7 @@ static bool hclge_reset_err_handle(struct hclge_dev *hdev)return false; }else if (hdev->rst_stats.reset_fail_cnt <MAX_RESET_FAIL_CNT ) { hdev->rst_stats.reset_fail_cnt++; -set_bit (hdev->reset_type, &hdev->reset_pending); +hclge_set_reset_pending (hdev, hdev->reset_type);dev_info (&hdev->pdev->dev,"re-schedule reset task(%u)\n" , hdev->rst_stats.reset_fail_cnt);
@@ -4480,8 +4493,20 @@ static void hclge_reset_event(struct pci_dev *pdev, struct hnae3_handle *handle)static void hclge_set_def_reset_request (struct hnae3_ae_dev *ae_dev,enum hnae3_reset_type rst_type) { +#define HCLGE_SUPPORT_RESET_TYPE \ + (BIT(HNAE3_FLR_RESET) | BIT(HNAE3_FUNC_RESET) | \ + BIT(HNAE3_GLOBAL_RESET) | BIT(HNAE3_IMP_RESET)) +struct hclge_dev *hdev = ae_dev->priv; +if (!(BIT (rst_type) &HCLGE_SUPPORT_RESET_TYPE )) { +/* To prevent reset triggered by hclge_reset_event */ +set_bit (HNAE3_NONE_RESET , &hdev->default_reset_request); +dev_warn (&hdev->pdev->dev,"unsupported reset type %d\n" , + rst_type); +return ; + } +set_bit (rst_type, &hdev->default_reset_request); }
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +32 -6
@@ -1395,6 +1395,17 @@ static int hclgevf_notify_roce_client(struct hclgevf_dev *hdev,return ret; } +static void hclgevf_set_reset_pending (struct hclgevf_dev *hdev, +enum hnae3_reset_type reset_type) +{ +/* When an incorrect reset type is executed, the get_reset_level +* function generates the HNAE3_NONE_RESET flag. As a result, this +* type do not need to pending. +*/ +if (reset_type !=HNAE3_NONE_RESET ) +set_bit (reset_type, &hdev->reset_pending); +} +static int hclgevf_reset_wait (struct hclgevf_dev *hdev) {#define HCLGEVF_RESET_WAIT_US 20000
@@ -1544,7 +1555,7 @@ static void hclgevf_reset_err_handle(struct hclgevf_dev *hdev) hdev->rst_stats.rst_fail_cnt);if (hdev->rst_stats.rst_fail_cnt <HCLGEVF_RESET_MAX_FAIL_CNT ) -set_bit (hdev->reset_type, &hdev->reset_pending); +hclgevf_set_reset_pending (hdev, hdev->reset_type);if (hclgevf_is_reset_pending (hdev)) {set_bit (HCLGEVF_RESET_PENDING , &hdev->reset_state);
@@ -1664,6 +1675,8 @@ static enum hnae3_reset_type hclgevf_get_reset_level(unsigned long *addr)clear_bit (HNAE3_FLR_RESET , addr); } +clear_bit (HNAE3_NONE_RESET , addr); +return rst_level; }
@@ -1673,14 +1686,15 @@ static void hclgevf_reset_event(struct pci_dev *pdev,struct hnae3_ae_dev *ae_dev =pci_get_drvdata (pdev);struct hclgevf_dev *hdev = ae_dev->priv; -dev_info (&hdev->pdev->dev,"received reset request from VF enet\n" ); -if (hdev->default_reset_request) hdev->reset_level =hclgevf_get_reset_level (&hdev->default_reset_request);else hdev->reset_level =HNAE3_VF_FUNC_RESET ; +dev_info (&hdev->pdev->dev,"received reset request from VF enet, reset level is %d\n" , + hdev->reset_level); +/* reset of this VF requested */ set_bit (HCLGEVF_RESET_REQUESTED , &hdev->reset_state);hclgevf_reset_task_schedule (hdev);
@@ -1691,8 +1705,20 @@ static void hclgevf_reset_event(struct pci_dev *pdev,static void hclgevf_set_def_reset_request (struct hnae3_ae_dev *ae_dev,enum hnae3_reset_type rst_type) { +#define HCLGEVF_SUPPORT_RESET_TYPE \ + (BIT(HNAE3_VF_RESET) | BIT(HNAE3_VF_FUNC_RESET) | \ + BIT(HNAE3_VF_PF_FUNC_RESET) | BIT(HNAE3_VF_FULL_RESET) | \ + BIT(HNAE3_FLR_RESET) | BIT(HNAE3_VF_EXP_RESET)) +struct hclgevf_dev *hdev = ae_dev->priv; +if (!(BIT (rst_type) &HCLGEVF_SUPPORT_RESET_TYPE )) { +/* To prevent reset triggered by hclge_reset_event */ +set_bit (HNAE3_NONE_RESET , &hdev->default_reset_request); +dev_info (&hdev->pdev->dev,"unsupported reset type %d\n" , + rst_type); +return ; + }set_bit (rst_type, &hdev->default_reset_request); }
@@ -1849,14 +1875,14 @@ static void hclgevf_reset_service_task(struct hclgevf_dev *hdev)*/ if (hdev->reset_attempts >HCLGEVF_MAX_RESET_ATTEMPTS_CNT ) {/* prepare for full reset of stack + pcie interface */ -set_bit (HNAE3_VF_FULL_RESET , &hdev->reset_pending); +hclgevf_set_reset_pending (hdev,HNAE3_VF_FULL_RESET );/* "defer" schedule the reset task again */ set_bit (HCLGEVF_RESET_PENDING , &hdev->reset_state); }else { hdev->reset_attempts++; -set_bit (hdev->reset_level, &hdev->reset_pending); +hclgevf_set_reset_pending (hdev, hdev->reset_level);set_bit (HCLGEVF_RESET_PENDING , &hdev->reset_state); }hclgevf_reset_task_schedule (hdev);
@@ -1979,7 +2005,7 @@ static enum hclgevf_evt_cause hclgevf_check_evt_cause(struct hclgevf_dev *hdev, rst_ing_reg =hclgevf_read_dev (&hdev->hw,HCLGEVF_RST_ING );dev_info (&hdev->pdev->dev,"receive reset interrupt 0x%x!\n" , rst_ing_reg); -set_bit (HNAE3_VF_RESET , &hdev->reset_pending); +hclgevf_set_reset_pending (hdev,HNAE3_VF_RESET );set_bit (HCLGEVF_RESET_PENDING , &hdev->reset_state);set_bit (HCLGE_COMM_STATE_CMD_DISABLE , &hdev->hw.hw.comm_state); *clearval = ~(1U <<HCLGEVF_VECTOR0_RST_INT_B );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/189 net: hns3: fix missing features due to dev->features configuration too early
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Lan <[email protected]>
[ Upstream commit ac1e2836fe294c2007ca81cf7006862c3bdf0510 ]
Currently, the netdev->features is configured in hns3_nic_set_features. As a result, __netdev_update_features considers that there is no feature difference, and the procedures of the real features are missing.
--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +0 -1
@@ -2452,7 +2452,6 @@ static int hns3_nic_set_features(struct net_device *netdev,return ret; } - netdev->features = features;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/189 net: hns3: Resolved the issue that the debugfs query result is inconsistent.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Lan <[email protected]>
[ Upstream commit 5191a8d3c2ab5bc01930ea3425e06a739af5b0e9 ]
This patch modifies the implementation of debugfs:
When the user process stops unexpectedly, not all data of the file system is read. In this case, the save_buf pointer is not released. When the user process is called next time, save_buf is used to copy the cached data to the user space. As a result, the queried data is stale.
To solve this problem, this patch implements .open() and .release() handler for debugfs file_operations. moving allocation buffer and execution of the cmd to the .open() handler and freeing in to the .release() handler. Allocate separate buffer for each reader and associate the buffer with the file pointer.
When different user read processes no longer share the buffer, the stale data problem is fixed.
--- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 3 - .../ethernet/hisilicon/hns3/hns3_debugfs.c | 96 ++++++------------- 2 files changed, 31 insertions(+), 68 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hnae3.h +0 -3
@@ -916,9 +916,6 @@ struct hnae3_handle {u8 netdev_flags;struct dentry *hnae3_dbgfs; -/* protects concurrent contention between debugfs commands */ -struct mutex dbgfs_lock; -char **dbgfs_buf;/* Network interface message level enabled bits */ u32 msg_enable;
drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +31 -65
145 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/189 net: hns3: dont auto enable misc vector
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit 98b1e3b27734139c76295754b6c317aa4df6d32e ]
Currently, there is a time window between misc irq enabled and service task inited. If an interrupte is reported at this time, it will cause warning like below:
[ 16.324639] Call trace: [ 16.324641] __queue_delayed_work+0xb8/0xe0 [ 16.324643] mod_delayed_work_on+0x78/0xd0 [ 16.324655] hclge_errhand_task_schedule+0x58/0x90 [hclge] [ 16.324662] hclge_misc_irq_handle+0x168/0x240 [hclge] [ 16.324666] __handle_irq_event_percpu+0x64/0x1e0 [ 16.324667] handle_irq_event+0x80/0x170 [ 16.324670] handle_fasteoi_edge_irq+0x110/0x2bc [ 16.324671] __handle_domain_irq+0x84/0xfc [ 16.324673] gic_handle_irq+0x88/0x2c0 [ 16.324674] el1_irq+0xb8/0x140 [ 16.324677] arch_cpu_idle+0x18/0x40 [ 16.324679] default_idle_call+0x5c/0x1bc [ 16.324682] cpuidle_idle_call+0x18c/0x1c4 [ 16.324684] do_idle+0x174/0x17c [ 16.324685] cpu_startup_entry+0x30/0x6c [ 16.324687] secondary_start_kernel+0x1a4/0x280 [ 16.324688] ---[ end trace 6aa0bff672a964aa ]---
So don't auto enable misc vector when request irq..
--- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +7 -5
@@ -6,6 +6,7 @@#include <linux/etherdevice.h> #include <linux/init.h> #include <linux/interrupt.h> +#include <linux/irq.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/netdevice.h>
@@ -3780,7 +3781,7 @@ static int hclge_misc_irq_init(struct hclge_dev *hdev)snprintf (hdev->misc_vector.name,HNAE3_INT_NAME_LEN ,"%s-misc-%s" ,HCLGE_NAME ,pci_name (hdev->pdev)); ret =request_irq (hdev->misc_vector.vector_irq, hclge_misc_irq_handle, -0 , hdev->misc_vector.name, hdev); +IRQF_NO_AUTOEN , hdev->misc_vector.name, hdev);if (ret) {hclge_free_vector (hdev,0 ); dev_err(&hdev->pdev->dev, "request misc irq(%d) fail\n",
@@ -11916,9 +11917,6 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)hclge_init_rxd_adv_layout (hdev); -/* Enable MISC vector(vector0) */ -hclge_enable_vector (&hdev->misc_vector, true); - ret =hclge_init_wol (hdev);if (ret) dev_warn(&pdev->dev,
@@ -11931,6 +11929,10 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)hclge_state_init (hdev); hdev->last_reset_time = jiffies; +/* Enable MISC vector(vector0) */ +enable_irq (hdev->misc_vector.vector_irq); +hclge_enable_vector (&hdev->misc_vector, true); +dev_info (&hdev->pdev->dev,"%s driver initialization finished.\n" ,HCLGE_DRIVER_NAME );
@@ -12336,7 +12338,7 @@ static void hclge_uninit_ae_dev(struct hnae3_ae_dev *ae_dev)/* Disable MISC vector(vector0) */ hclge_enable_vector (&hdev->misc_vector, false); -synchronize_irq (hdev->misc_vector.vector_irq); +disable_irq (hdev->misc_vector.vector_irq);/* Disable all hw interrupts */ hclge_config_mac_tnl_int (hdev, false);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/189 net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit 247fd1e33e1cd156aabe444e932d2648d33f1245 ]
Currently the misc irq is initialized before reset_timer setup. But it will access the reset_timer in the irq handler. So initialize the reset_timer earlier.
--- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +2 -1
@@ -2315,6 +2315,8 @@ static void hclgevf_state_init(struct hclgevf_dev *hdev)clear_bit (HCLGEVF_STATE_RST_FAIL , &hdev->state);INIT_DELAYED_WORK (&hdev->service_task, hclgevf_service_task); +/* timer needs to be initialized before misc irq */ +timer_setup (&hdev->reset_timer, hclgevf_reset_timer,0 );mutex_init (&hdev->mbx_resp.mbx_mutex);sema_init (&hdev->reset_sem,1 );
@@ -3014,7 +3016,6 @@ static int hclgevf_init_hdev(struct hclgevf_dev *hdev) HCLGEVF_DRIVER_NAME);hclgevf_task_schedule (hdev,round_jiffies_relative (HZ )); -timer_setup (&hdev->reset_timer, hclgevf_reset_timer,0 );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/189 net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Lan <[email protected]>
[ Upstream commit 7997ddd46c54408bcba5e37fe18b4d832e45d4d4 ]
The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs 1024-1279 are in different BAR space addresses. However, hclge_fetch_pf_reg does not distinguish the tqp space information when reading the tqp space information. When the number of TQPs is greater than 1024, access bar space overwriting occurs.
The problem of different segments has been considered during the initialization of tqp.io_base. Therefore, tqp.io_base is directly used when the queue is read in hclge_fetch_pf_reg.
The error message:
Unable to handle kernel paging request at virtual address ffff800037200000 pc : hclge_fetch_pf_reg+0x138/0x250 [hclge] lr : hclge_get_regs+0x84/0x1d0 [hclge] Call trace: hclge_fetch_pf_reg+0x138/0x250 [hclge] hclge_get_regs+0x84/0x1d0 [hclge] hns3_get_regs+0x2c/0x50 [hns3] ethtool_get_regs+0xf4/0x270 dev_ethtool+0x674/0x8a0 dev_ioctl+0x270/0x36c sock_do_ioctl+0x110/0x2a0 sock_ioctl+0x2ac/0x530 __arm64_sys_ioctl+0xa8/0x100 invoke_syscall+0x4c/0x124 el0_svc_common.constprop.0+0x140/0x15c do_el0_svc+0x30/0xd0 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c | 9 +++++---- .../net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c | 9 +++++---- 2 files changed, 10 insertions(+), 8 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c +5 -4
@@ -510,9 +510,9 @@ static int hclge_get_dfx_reg(struct hclge_dev *hdev, void *data)static int hclge_fetch_pf_reg (struct hclge_dev *hdev,void *data,struct hnae3_knic_private_info *kinfo) { -#define HCLGE_RING_REG_OFFSET 0x200#define HCLGE_RING_INT_REG_OFFSET 0x4 +struct hnae3_queue *tqp;int i, j, reg_num;int data_num_sum;u32 *reg = data;
@@ -533,10 +533,11 @@ static int hclge_fetch_pf_reg(struct hclge_dev *hdev, void *data, reg_num =ARRAY_SIZE (ring_reg_addr_list);for (j =0 ; j < kinfo->num_tqps; j++) { reg +=hclge_reg_get_tlv (HCLGE_REG_TAG_RING , reg_num, reg); + tqp = kinfo->tqp[j];for (i =0 ; i < reg_num; i++) - *reg++ =hclge_read_dev (&hdev->hw, - ring_reg_addr_list[i] + -HCLGE_RING_REG_OFFSET * j); + *reg++ =readl_relaxed (tqp->io_base - +HCLGE_TQP_REG_OFFSET + + ring_reg_addr_list[i]); } data_num_sum += (reg_num +HCLGE_REG_TLV_SPACE ) * kinfo->num_tqps;
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c +5 -4
@@ -123,10 +123,10 @@ int hclgevf_get_regs_len(struct hnae3_handle *handle)void hclgevf_get_regs (struct hnae3_handle *handle,u32 *version,void *data) { -#define HCLGEVF_RING_REG_OFFSET 0x200#define HCLGEVF_RING_INT_REG_OFFSET 0x4struct hclgevf_dev *hdev =hclgevf_ae_get_hdev (handle); +struct hnae3_queue *tqp;int i, j, reg_um;u32 *reg = data;
@@ -147,10 +147,11 @@ void hclgevf_get_regs(struct hnae3_handle *handle, u32 *version, reg_um =ARRAY_SIZE (ring_reg_addr_list);for (j =0 ; j < hdev->num_tqps; j++) { reg +=hclgevf_reg_get_tlv (HCLGEVF_REG_TAG_RING , reg_um, reg); + tqp = &hdev->htqp[j].q;for (i =0 ; i < reg_um; i++) - *reg++ =hclgevf_read_dev (&hdev->hw, - ring_reg_addr_list[i] + -HCLGEVF_RING_REG_OFFSET * j); + *reg++ =readl_relaxed (tqp->io_base - +HCLGEVF_TQP_REG_OFFSET + + ring_reg_addr_list[i]); } reg_um =ARRAY_SIZE (tqp_intr_reg_addr_list);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/189 net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit 9741e72b2286de8b38de9db685588ac421a95c87 ]
Currently, HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL. But the tx process would still try to set hardware time stamp info with SKBTX_HW_TSTAMP flag and cause a kernel crash.
[ 128.087798] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 ... [ 128.280251] pc : hclge_ptp_set_tx_info+0x2c/0x140 [hclge] [ 128.286600] lr : hclge_ptp_set_tx_info+0x20/0x140 [hclge] [ 128.292938] sp : ffff800059b93140 [ 128.297200] x29: ffff800059b93140 x28: 0000000000003280 [ 128.303455] x27: ffff800020d48280 x26: ffff0cb9dc814080 [ 128.309715] x25: ffff0cb9cde93fa0 x24: 0000000000000001 [ 128.315969] x23: 0000000000000000 x22: 0000000000000194 [ 128.322219] x21: ffff0cd94f986000 x20: 0000000000000000 [ 128.328462] x19: ffff0cb9d2a166c0 x18: 0000000000000000 [ 128.334698] x17: 0000000000000000 x16: ffffcf1fc523ed24 [ 128.340934] x15: 0000ffffd530a518 x14: 0000000000000000 [ 128.347162] x13: ffff0cd6bdb31310 x12: 0000000000000368 [ 128.353388] x11: ffff0cb9cfbc7070 x10: ffff2cf55dd11e02 [ 128.359606] x9 : ffffcf1f85a212b4 x8 : ffff0cd7cf27dab0 [ 128.365831] x7 : 0000000000000a20 x6 : ffff0cd7cf27d000 [ 128.372040] x5 : 0000000000000000 x4 : 000000000000ffff [ 128.378243] x3 : 0000000000000400 x2 : ffffcf1f85a21294 [ 128.384437] x1 : ffff0cb9db520080 x0 : ffff0cb9db500080 [ 128.390626] Call trace: [ 128.393964] hclge_ptp_set_tx_info+0x2c/0x140 [hclge] [ 128.399893] hns3_nic_net_xmit+0x39c/0x4c4 [hns3] [ 128.405468] xmit_one.constprop.0+0xc4/0x200 [ 128.410600] dev_hard_start_xmit+0x54/0xf0 [ 128.415556] sch_direct_xmit+0xe8/0x634 [ 128.420246] __dev_queue_xmit+0x224/0xc70 [ 128.425101] dev_queue_xmit+0x1c/0x40 [ 128.429608] ovs_vport_send+0xac/0x1a0 [openvswitch] [ 128.435409] do_output+0x60/0x17c [openvswitch] [ 128.440770] do_execute_actions+0x898/0x8c4 [openvswitch] [ 128.446993] ovs_execute_actions+0x64/0xf0 [openvswitch] [ 128.453129] ovs_dp_process_packet+0xa0/0x224 [openvswitch] [ 128.459530] ovs_vport_receive+0x7c/0xfc [openvswitch] [ 128.465497] internal_dev_xmit+0x34/0xb0 [openvswitch] [ 128.471460] xmit_one.constprop.0+0xc4/0x200 [ 128.476561] dev_hard_start_xmit+0x54/0xf0 [ 128.481489] __dev_queue_xmit+0x968/0xc70 [ 128.486330] dev_queue_xmit+0x1c/0x40 [ 128.490856] ip_finish_output2+0x250/0x570 [ 128.495810] __ip_finish_output+0x170/0x1e0 [ 128.500832] ip_finish_output+0x3c/0xf0 [ 128.505504] ip_output+0xbc/0x160 [ 128.509654] ip_send_skb+0x58/0xd4 [ 128.513892] udp_send_skb+0x12c/0x354 [ 128.518387] udp_sendmsg+0x7a8/0x9c0 [ 128.522793] inet_sendmsg+0x4c/0x8c [ 128.527116] __sock_sendmsg+0x48/0x80 [ 128.531609] __sys_sendto+0x124/0x164 [ 128.536099] __arm64_sys_sendto+0x30/0x5c [ 128.540935] invoke_syscall+0x50/0x130 [ 128.545508] el0_svc_common.constprop.0+0x10c/0x124 [ 128.551205] do_el0_svc+0x34/0xdc [ 128.555347] el0_svc+0x20/0x30 [ 128.559227] el0_sync_handler+0xb8/0xc0 [ 128.563883] el0_sync+0x160/0x180
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c +3 -0
@@ -58,6 +58,9 @@ bool hclge_ptp_set_tx_info(struct hnae3_handle *handle, struct sk_buff *skb)struct hclge_dev *hdev = vport->back;struct hclge_ptp *ptp = hdev->ptp; +if (!ptp) +return false; +if (!test_bit (HCLGE_PTP_FLAG_TX_EN , &ptp->flags) ||test_and_set_bit (HCLGE_STATE_PTP_TX_HANDLING , &hdev->state)) { ptp->tx_skipped++;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/189 mctp i3c: fix MCTP I3C driver multi-thread issue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yang <[email protected]>
[ Upstream commit 2d2d4f60ed266a8f340a721102d035252606980b ]
We found a timeout problem with the pldm command on our system. The reason is that the MCTP-I3C driver has a race condition when receiving multiple-packet messages in multi-thread, resulting in a wrong packet order problem.
We identified this problem by adding a debug message to the mctp_i3c_read function.
According to the MCTP spec, a multiple-packet message must be composed in sequence, and if there is a wrong sequence, the whole message will be discarded and wait for the next SOM.
For example, SOM → Pkt Seq #2 → Pkt Seq #1 → Pkt Seq #3 → EOM.
Therefore, we try to solve this problem by adding a mutex to the mctp_i3c_read function. Before the modification, when a command requesting a multiple-packet message response is sent consecutively, an error usually occurs within 100 loops. After the mutex, it can go through 40000 loops without any error, and it seems to run well.
--- drivers/net/mctp/mctp-i3c.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/mctp/mctp-i3c.c +4 -0
@@ -125,6 +125,8 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi) xfer.data.in =skb_put (skb, mi->mrl); +/* Make sure netif_rx() is read in the same order as i3c. */ +mutex_lock (&mi->lock); rc =i3c_device_do_priv_xfers (mi->i3c, &xfer,1 );if (rc <0 ) goto err;
@@ -166,8 +168,10 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi) stats->rx_dropped++; } +mutex_unlock (&mi->lock);return 0 ; err: +mutex_unlock (&mi->lock);kfree_skb (skb);return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/189 netfilter: nf_tables: imbalance in flowtable binding
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 13210fc63f353fe78584048079343413a3cdf819 ]
All these cases cause imbalance between BIND and UNBIND calls:
- Delete an interface from a flowtable with multiple interfaces
- Add a (device to a) flowtable with --check flag
- Delete a netns containing a flowtable
- In an interactive nft session, create a table with owner flag and flowtable inside, then quit.
Fix it by calling FLOW_BLOCK_UNBIND when unregistering hooks, then remove late FLOW_BLOCK_UNBIND call when destroying flowtable.
--- net/netfilter/nf_tables_api.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +11 -4
@@ -8565,6 +8565,7 @@ static void nft_unregister_flowtable_hook(struct net *net, }static void __nft_unregister_flowtable_net_hooks (struct net *net, +struct nft_flowtable *flowtable,struct list_head *hook_list,bool release_netdev) {
@@ -8572,6 +8573,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net,list_for_each_entry_safe (hook, next, hook_list, list) {nf_unregister_net_hook (net, &hook->ops); + flowtable->data.type->setup (&flowtable->data, hook->ops.dev, +FLOW_BLOCK_UNBIND );if (release_netdev) {list_del (&hook->list);kfree_rcu (hook, rcu);
@@ -8580,9 +8583,10 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, }static void nft_unregister_flowtable_net_hooks (struct net *net, +struct nft_flowtable *flowtable,struct list_head *hook_list) { -__nft_unregister_flowtable_net_hooks (net, hook_list, false); +__nft_unregister_flowtable_net_hooks (net, flowtable, hook_list, false); } static int nft_register_flowtable_net_hooks(struct net *net,
@@ -9223,8 +9227,6 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) flowtable->data.type->free (&flowtable->data);list_for_each_entry_safe (hook, next, &flowtable->hook_list, list) { - flowtable->data.type->setup (&flowtable->data, hook->ops.dev, -FLOW_BLOCK_UNBIND );list_del_rcu (&hook->list);kfree_rcu (hook, rcu); }
@@ -10622,6 +10624,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) &nft_trans_flowtable_hooks (trans), trans->msg_type);nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable_hooks (trans)); }else {list_del_rcu (&nft_trans_flowtable (trans)->list);
@@ -10630,6 +10633,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)NULL , trans->msg_type);nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable (trans)->hook_list); }break ;
@@ -10901,11 +10905,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)case NFT_MSG_NEWFLOWTABLE :if (nft_trans_flowtable_update (trans)) {nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable_hooks (trans)); }else {nft_use_dec_restore (&table->use);list_del_rcu (&nft_trans_flowtable (trans)->list);nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable (trans)->hook_list); }break ;
@@ -11498,7 +11504,8 @@ static void __nft_release_hook(struct net *net, struct nft_table *table)list_for_each_entry (chain, &table->chains, list)__nf_tables_unregister_hook (net, table, chain, true);list_for_each_entry (flowtable, &table->flowtables, list) -__nft_unregister_flowtable_net_hooks (net, &flowtable->hook_list, +__nft_unregister_flowtable_net_hooks (net, flowtable, + &flowtable->hook_list, true); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/189 netfilter: conntrack: clamp maximum hashtable size to INT_MAX
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 ]
Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See:
0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")
Note: hashtable resize is only possible from init_netns.
--- net/netfilter/nf_conntrack_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_core.c +4 -1
@@ -2517,12 +2517,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)struct hlist_nulls_head *hash;unsigned int nr_slots, i; -if (*sizep > (UINT_MAX /sizeof (struct hlist_nulls_head ))) +if (*sizep > (INT_MAX /sizeof (struct hlist_nulls_head )))return NULL ;BUILD_BUG_ON (sizeof (struct hlist_nulls_head ) !=sizeof (struct hlist_head )); nr_slots = *sizep =roundup (*sizep,PAGE_SIZE /sizeof (struct hlist_nulls_head )); +if (nr_slots > (INT_MAX /sizeof (struct hlist_nulls_head ))) +return NULL ; + hash =kvcalloc (nr_slots,sizeof (struct hlist_nulls_head ),GFP_KERNEL );if (hash && nulls)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/189 sched: sch_cake: add bounds checks to host bulk flow fairness counts
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 737d4d91d35b5f7fa5bb442651472277318b0bfd ]
Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access.
To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error).
As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour.
--- net/sched/sch_cake.c | 140 +++++++++++++++++++++++-------------------- 1 file changed, 75 insertions(+), 65 deletions(-)
net/sched/sch_cake.c +75 -65
@@ -627,6 +627,63 @@ static bool cake_ddst(int flow_mode)return (flow_mode &CAKE_FLOW_DUAL_DST ) ==CAKE_FLOW_DUAL_DST ; } +static void cake_dec_srchost_bulk_flow_count (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +if (likely (cake_dsrc (flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count)) + q->hosts[flow->srchost].srchost_bulk_flow_count--; +} + +static void cake_inc_srchost_bulk_flow_count (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +if (likely (cake_dsrc (flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count <CAKE_QUEUES )) + q->hosts[flow->srchost].srchost_bulk_flow_count++; +} + +static void cake_dec_dsthost_bulk_flow_count (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +if (likely (cake_ddst (flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count--; +} + +static void cake_inc_dsthost_bulk_flow_count (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +if (likely (cake_ddst (flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count <CAKE_QUEUES )) + q->hosts[flow->dsthost].dsthost_bulk_flow_count++; +} + +static u16 cake_get_flow_quantum (struct cake_tin_data *q, +struct cake_flow *flow, +int flow_mode) +{ +u16 host_load =1 ; + +if (cake_dsrc (flow_mode)) + host_load =max (host_load, + q->hosts[flow->srchost].srchost_bulk_flow_count); + +if (cake_ddst (flow_mode)) + host_load =max (host_load, + q->hosts[flow->dsthost].dsthost_bulk_flow_count); + +/* The get_random_u16() is a way to apply dithering to avoid +* accumulating roundoff errors +*/ +return (q->flow_quantum * quantum_div[host_load] + +get_random_u16 ()) >>16 ; +} +static u32 cake_hash (struct cake_tin_data *q,const struct sk_buff *skb,int flow_mode,u16 flow_override,u16 host_override) {
@@ -773,10 +830,8 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, allocate_dst =cake_ddst (flow_mode);if (q->flows[outer_hash + k].set ==CAKE_SET_BULK ) { -if (allocate_src) - q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--; -if (allocate_dst) - q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--; +cake_dec_srchost_bulk_flow_count (q, &q->flows[outer_hash + k], flow_mode); +cake_dec_dsthost_bulk_flow_count (q, &q->flows[outer_hash + k], flow_mode); } found:/* reserve queue for future packets in same flow */
@@ -801,9 +856,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].srchost_tag = srchost_hash; found_src: srchost_idx = outer_hash + k; -if (q->flows[reduced_hash].set ==CAKE_SET_BULK ) - q->hosts[srchost_idx].srchost_bulk_flow_count++; q->flows[reduced_hash].srchost = srchost_idx; + +if (q->flows[reduced_hash].set ==CAKE_SET_BULK ) +cake_inc_srchost_bulk_flow_count (q, &q->flows[reduced_hash], flow_mode); }if (allocate_dst) {
@@ -824,9 +880,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].dsthost_tag = dsthost_hash; found_dst: dsthost_idx = outer_hash + k; -if (q->flows[reduced_hash].set ==CAKE_SET_BULK ) - q->hosts[dsthost_idx].dsthost_bulk_flow_count++; q->flows[reduced_hash].dsthost = dsthost_idx; + +if (q->flows[reduced_hash].set ==CAKE_SET_BULK ) +cake_inc_dsthost_bulk_flow_count (q, &q->flows[reduced_hash], flow_mode); } }
@@ -1839,10 +1896,6 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,/* flowchain */ if (!flow->set || flow->set ==CAKE_SET_DECAYING ) { -struct cake_host *srchost = &b->hosts[flow->srchost]; -struct cake_host *dsthost = &b->hosts[flow->dsthost]; -u16 host_load =1 ; -if (!flow->set) {list_add_tail (&flow->flowchain, &b->new_flows); }else {
@@ -1852,18 +1905,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, flow->set =CAKE_SET_SPARSE ; b->sparse_flow_count++; -if (cake_dsrc (q->flow_mode)) - host_load =max (host_load, srchost->srchost_bulk_flow_count); - -if (cake_ddst (q->flow_mode)) - host_load =max (host_load, dsthost->dsthost_bulk_flow_count); - - flow->deficit = (b->flow_quantum * - quantum_div[host_load]) >>16 ; + flow->deficit =cake_get_flow_quantum (b, flow, q->flow_mode); }else if (flow->set ==CAKE_SET_SPARSE_WAIT ) { -struct cake_host *srchost = &b->hosts[flow->srchost]; -struct cake_host *dsthost = &b->hosts[flow->dsthost]; -/* this flow was empty, accounted as a sparse flow, but actually * in the bulk rotation. */
@@ -1871,12 +1914,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, b->sparse_flow_count--; b->bulk_flow_count++; -if (cake_dsrc (q->flow_mode)) - srchost->srchost_bulk_flow_count++; - -if (cake_ddst (q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; - +cake_inc_srchost_bulk_flow_count (b, flow, q->flow_mode); +cake_inc_dsthost_bulk_flow_count (b, flow, q->flow_mode); }if (q->buffer_used > q->buffer_max_used)
@@ -1933,13 +1972,11 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) {struct cake_sched_data *q =qdisc_priv (sch);struct cake_tin_data *b = &q->tins[q->cur_tin]; -struct cake_host *srchost, *dsthost;ktime_t now =ktime_get ();struct cake_flow *flow;struct list_head *head;bool first_flow = true;struct sk_buff *skb; -u16 host_load;u64 delay;u32 len;
@@ -2039,11 +2076,6 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) q->cur_flow = flow - b->flows; first_flow = false; -/* triple isolation (modified DRR++) */ - srchost = &b->hosts[flow->srchost]; - dsthost = &b->hosts[flow->dsthost]; - host_load =1 ; -/* flow isolation (DRR++) */ if (flow->deficit <=0 ) {/* Keep all flows with deficits out of the sparse and decaying
@@ -2055,11 +2087,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) b->sparse_flow_count--; b->bulk_flow_count++; -if (cake_dsrc (q->flow_mode)) - srchost->srchost_bulk_flow_count++; - -if (cake_ddst (q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; +cake_inc_srchost_bulk_flow_count (b, flow, q->flow_mode); +cake_inc_dsthost_bulk_flow_count (b, flow, q->flow_mode); flow->set =CAKE_SET_BULK ; }else {
@@ -2071,19 +2100,7 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) } } -if (cake_dsrc (q->flow_mode)) - host_load =max (host_load, srchost->srchost_bulk_flow_count); - -if (cake_ddst (q->flow_mode)) - host_load =max (host_load, dsthost->dsthost_bulk_flow_count); - -WARN_ON (host_load >CAKE_QUEUES ); - -/* The get_random_u16() is a way to apply dithering to avoid -* accumulating roundoff errors -*/ - flow->deficit += (b->flow_quantum * quantum_div[host_load] + -get_random_u16 ()) >>16 ; + flow->deficit +=cake_get_flow_quantum (b, flow, q->flow_mode);list_move_tail (&flow->flowchain, &b->old_flows); goto retry;
@@ -2107,11 +2124,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch)if (flow->set ==CAKE_SET_BULK ) { b->bulk_flow_count--; -if (cake_dsrc (q->flow_mode)) - srchost->srchost_bulk_flow_count--; - -if (cake_ddst (q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; +cake_dec_srchost_bulk_flow_count (b, flow, q->flow_mode); +cake_dec_dsthost_bulk_flow_count (b, flow, q->flow_mode); b->decaying_flow_count++; } else if (flow->set == CAKE_SET_SPARSE ||
@@ -2129,12 +2143,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch)else if (flow->set ==CAKE_SET_BULK ) { b->bulk_flow_count--; -if (cake_dsrc (q->flow_mode)) - srchost->srchost_bulk_flow_count--; - -if (cake_ddst (q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; - +cake_dec_srchost_bulk_flow_count (b, flow, q->flow_mode); +cake_dec_dsthost_bulk_flow_count (b, flow, q->flow_mode); }else b->decaying_flow_count--;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/189 net: stmmac: dwmac-tegra: Read iommu stream id from device tree
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parker Newman <[email protected]>
[ Upstream commit 426046e2d62dd19533808661e912b8e8a9eaec16 ]
Nvidia's Tegra MGBE controllers require the IOMMU "Stream ID" (SID) to be written to the MGBE_WRAP_AXI_ASID0_CTRL register.
The current driver is hard coded to use MGBE0's SID for all controllers. This causes softirq time outs and kernel panics when using controllers other than MGBE0.
Example dmesg errors when an ethernet cable is connected to MGBE1:
[ 116.133290] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx
[ 121.851283] tegra-mgbe 6910000.ethernet eth1: NETDEV WATCHDOG: CPU: 5: transmit queue 0 timed out 5690 ms
[ 121.851782] tegra-mgbe 6910000.ethernet eth1: Reset adapter.
[ 121.892464] tegra-mgbe 6910000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-0
[ 121.905920] tegra-mgbe 6910000.ethernet eth1: PHY [stmmac-1:00] driver [Aquantia AQR113] (irq=171)
[ 121.907356] tegra-mgbe 6910000.ethernet eth1: Enabling Safety Features
[ 121.907578] tegra-mgbe 6910000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported
[ 121.908399] tegra-mgbe 6910000.ethernet eth1: registered PTP clock
[ 121.908582] tegra-mgbe 6910000.ethernet eth1: configuring for phy/10gbase-r link mode
[ 125.961292] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx
[ 181.921198] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
[ 181.921404] rcu: 7-....: (1 GPs behind) idle=540c/1/0x4000000000000002 softirq=1748/1749 fqs=2337
[ 181.921684] rcu: (detected by 4, t=6002 jiffies, g=1357, q=1254 ncpus=8)
[ 181.921878] Sending NMI from CPU 4 to CPUs 7:
[ 181.921886] NMI backtrace for cpu 7
[ 181.922131] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: loaded Not tainted 6.13.0-rc3+ #6
[ 181.922390] Hardware name: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 10/28/2024
[ 181.922658] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 181.922847] pc : handle_softirqs+0x98/0x368
[ 181.922978] lr : __do_softirq+0x18/0x20
[ 181.923095] sp : ffff80008003bf50
[ 181.923189] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000
[ 181.923379] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0
[ 181.924486] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70
[ 181.925568] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000
[ 181.926655] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000
[ 181.931455] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d
[ 181.938628] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160
[ 181.945804] x8 : ffff8000827b3160 x7 : f9157b241586f343 x6 : eeb6502a01c81c74
[ 181.953068] x5 : a4acfcdd2e8096bb x4 : ffffce78ea277340 x3 : 00000000ffffd1e1
[ 181.960329] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000
[ 181.967591] Call trace:
[ 181.970043] handle_softirqs+0x98/0x368 (P)
[ 181.974240] __do_softirq+0x18/0x20
[ 181.977743] ____do_softirq+0x14/0x28
[ 181.981415] call_on_irq_stack+0x24/0x30
[ 181.985180] do_softirq_own_stack+0x20/0x30
[ 181.989379] __irq_exit_rcu+0x114/0x140
[ 181.993142] irq_exit_rcu+0x14/0x28
[ 181.996816] el1_interrupt+0x44/0xb8
[ 182.000316] el1h_64_irq_handler+0x14/0x20
[ 182.004343] el1h_64_irq+0x80/0x88
[ 182.007755] cpuidle_enter_state+0xc4/0x4a8 (P)
[ 182.012305] cpuidle_enter+0x3c/0x58
[ 182.015980] cpuidle_idle_call+0x128/0x1c0
[ 182.020005] do_idle+0xe0/0xf0
[ 182.023155] cpu_startup_entry+0x3c/0x48
[ 182.026917] secondary_start_kernel+0xdc/0x120
[ 182.031379] __secondary_switched+0x74/0x78
[ 212.971162] rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 7-.... } 6103 jiffies s: 417 root: 0x80/.
[ 212.985935] rcu: blocking rcu_node structures (internal RCU debug):
[ 212.992758] Sending NMI from CPU 0 to CPUs 7:
[ 212.998539] NMI backtrace for cpu 7
[ 213.004304] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: loaded Not tainted 6.13.0-rc3+ #6
[ 213.016116] Hardware name: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 10/28/2024
[ 213.030817] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 213.040528] pc : handle_softirqs+0x98/0x368
[ 213.046563] lr : __do_softirq+0x18/0x20
[ 213.051293] sp : ffff80008003bf50
[ 213.055839] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000
[ 213.067304] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0
[ 213.077014] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70
[ 213.087339] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000
[ 213.097313] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000
[ 213.107201] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d
[ 213.116651] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160
[ 213.127500] x8 : ffff8000827b3160 x7 : 0a37b344852820af x6 : 3f049caedd1ff608
[ 213.138002] x5 : cff7cfdbfaf31291 x4 : ffffce78ea277340 x3 : 00000000ffffde04
[ 213.150428] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000
[ 213.162063] Call trace:
[ 213.165494] handle_softirqs+0x98/0x368 (P)
[ 213.171256] __do_softirq+0x18/0x20
[ 213.177291] ____do_softirq+0x14/0x28
[ 213.182017] call_on_irq_stack+0x24/0x30
[ 213.186565] do_softirq_own_stack+0x20/0x30
[ 213.191815] __irq_exit_rcu+0x114/0x140
[ 213.196891] irq_exit_rcu+0x14/0x28
[ 213.202401] el1_interrupt+0x44/0xb8
[ 213.207741] el1h_64_irq_handler+0x14/0x20
[ 213.213519] el1h_64_irq+0x80/0x88
[ 213.217541] cpuidle_enter_state+0xc4/0x4a8 (P)
[ 213.224364] cpuidle_enter+0x3c/0x58
[ 213.228653] cpuidle_idle_call+0x128/0x1c0
[ 213.233993] do_idle+0xe0/0xf0
[ 213.237928] cpu_startup_entry+0x3c/0x48
[ 213.243791] secondary_start_kernel+0xdc/0x120
[ 213.249830] __secondary_switched+0x74/0x78This bug has existed since the dwmac-tegra driver was added in Dec 2022 (See Fixes tag below for commit hash).
The Tegra234 SOC has 4 MGBE controllers, however Nvidia's Developer Kit only uses MGBE0 which is why the bug was not found previously. Connect Tech has many products that use 2 (or more) MGBE controllers.
The solution is to read the controller's SID from the existing "iommus" device tree property. The 2nd field of the "iommus" device tree property is the controller's SID.
Device tree snippet from tegra234.dtsi showing MGBE1's "iommus" property:
smmu_niso0: iommu@12000000 {
compatible = "nvidia,tegra234-smmu", "nvidia,smmu-500";...
}
/* MGBE1 */
ethernet@6900000 {
compatible = "nvidia,tegra234-mgbe";
...
iommus = <&smmu_niso0 TEGRA234_SID_MGBE_VF1>;...
}
Nvidia's arm-smmu driver reads the "iommus" property and stores the SID in the MGBE device's "fwspec" struct. The dwmac-tegra driver can access the SID using the tegra_dev_iommu_get_stream_id() helper function found in linux/iommu.h.
Calling tegra_dev_iommu_get_stream_id() should not fail unless the "iommus" property is removed from the device tree or the IOMMU is disabled.
While the Tegra234 SOC technically supports bypassing the IOMMU, it is not supported by the current firmware, has not been tested and not recommended. More detailed discussion with Thierry Reding from Nvidia linked below.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c +11 -3
@@ -1,4 +1,5 @@// SPDX-License-Identifier: GPL-2.0-only +#include <linux/iommu.h> #include <linux/platform_device.h> #include <linux/of.h> #include <linux/module.h>
@@ -19,6 +20,8 @@ struct tegra_mgbe {struct reset_control *rst_mac;struct reset_control *rst_pcs; +u32 iommu_sid; +void __iomem *hv;void __iomem *regs;void __iomem *xpcs;
@@ -50,7 +53,6 @@ struct tegra_mgbe {#define MGBE_WRAP_COMMON_INTR_ENABLE 0x8704#define MAC_SBD_INTR BIT(2)#define MGBE_WRAP_AXI_ASID0_CTRL 0x8400 -#define MGBE_SID 0x6static int __maybe_unused tegra_mgbe_suspend (struct device *dev) {
@@ -84,7 +86,7 @@ static int __maybe_unused tegra_mgbe_resume(struct device *dev)writel (MAC_SBD_INTR , mgbe->regs +MGBE_WRAP_COMMON_INTR_ENABLE );/* Program SID */ -writel (MGBE_SID , mgbe->hv +MGBE_WRAP_AXI_ASID0_CTRL ); +writel (mgbe->iommu_sid, mgbe->hv +MGBE_WRAP_AXI_ASID0_CTRL ); value =readl (mgbe->xpcs +XPCS_WRAP_UPHY_STATUS );if ((value &XPCS_WRAP_UPHY_STATUS_TX_P_UP ) ==0 ) {
@@ -241,6 +243,12 @@ static int tegra_mgbe_probe(struct platform_device *pdev)if (IS_ERR (mgbe->xpcs))return PTR_ERR (mgbe->xpcs); +/* get controller's stream id from iommu property in device tree */ +if (!tegra_dev_iommu_get_stream_id (mgbe->dev, &mgbe->iommu_sid)) { +dev_err (mgbe->dev,"failed to get iommu stream id\n" ); +return -EINVAL ; + } + res.addr = mgbe->regs; res.irq = irq;
@@ -346,7 +354,7 @@ static int tegra_mgbe_probe(struct platform_device *pdev)writel (MAC_SBD_INTR , mgbe->regs +MGBE_WRAP_COMMON_INTR_ENABLE );/* Program SID */ -writel (MGBE_SID , mgbe->hv +MGBE_WRAP_AXI_ASID0_CTRL ); +writel (mgbe->iommu_sid, mgbe->hv +MGBE_WRAP_AXI_ASID0_CTRL ); plat->flags |=STMMAC_FLAG_SERDES_UP_AFTER_PHY_LINKUP ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/189 rtase: Fix a check for error in rtase_alloc_msix()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 2055272e3ae01a954e41a5afb437c5d76f758e0b ]
The pci_irq_vector() function never returns zero. It returns negative error codes or a positive non-zero IRQ number. Fix the error checking to test for negatives.
--- drivers/net/ethernet/realtek/rtase/rtase_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/realtek/rtase/rtase_main.c +1 -1
@@ -1827,7 +1827,7 @@ static int rtase_alloc_msix(struct pci_dev *pdev, struct rtase_private *tp)for (i =0 ; i < tp->int_nums; i++) { irq =pci_irq_vector (pdev, i); -if (!irq) { +if (irq <0 ) {pci_disable_msix (pdev);return irq; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/189 net/mlx5: Fix variable not being completed when function returns
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenguang Zhao <[email protected]>
[ Upstream commit 0e2909c6bec9048f49d0c8e16887c63b50b14647 ]
When cmd_alloc_index(), fails cmd_work_handler() needs to complete ent->slotted before returning early. Otherwise the task which issued the command may hang:
mlx5_core 0000:01:00.0: cmd_work_handler:877:(pid 3880418): failed to allocate command entry
INFO: task kworker/13:2:4055883 blocked for more than 120 seconds.
Not tainted 4.19.90-25.44.v2101.ky10.aarch64 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/13:2 D 0 4055883 2 0x00000228
Workqueue: events mlx5e_tx_dim_work [mlx5_core]
Call trace:
__switch_to+0xe8/0x150
__schedule+0x2a8/0x9b8
schedule+0x2c/0x88
schedule_timeout+0x204/0x478
wait_for_common+0x154/0x250
wait_for_completion+0x28/0x38
cmd_exec+0x7a0/0xa00 [mlx5_core]
mlx5_cmd_exec+0x54/0x80 [mlx5_core]
mlx5_core_modify_cq+0x6c/0x80 [mlx5_core]
mlx5_core_modify_cq_moderation+0xa0/0xb8 [mlx5_core]
mlx5e_tx_dim_work+0x54/0x68 [mlx5_core]
process_one_work+0x1b0/0x448
worker_thread+0x54/0x468
kthread+0x134/0x138
ret_from_fork+0x10/0x18--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +1 -0
@@ -1013,6 +1013,7 @@ static void cmd_work_handler(struct work_struct *work)complete (&ent->done); }up (&cmd->vars.sem); +complete (&ent->slotted);return ; } }else {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/189 drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <[email protected]>
[ Upstream commit 36684e9d88a2e2401ae26715a2e217cb4295cea7 ]
The pointer need to be set to NULL, otherwise KASAN complains about use-after-free. Because in mtk_drm_bind, all private's drm are set as follows.
private->all_drm_private[i]->drm = drm;
And drm will be released by drm_dev_put in case mtk_drm_kms_init returns failure. However, the shutdown path still accesses the previous allocated memory in drm_atomic_helper_shutdown.
[ 84.874820] watchdog: watchdog0: watchdog did not stop! [ 86.512054] ================================================================== [ 86.513162] BUG: KASAN: use-after-free in drm_atomic_helper_shutdown+0x33c/0x378 [ 86.514258] Read of size 8 at addr ffff0000d46fc068 by task shutdown/1 [ 86.515213] [ 86.515455] CPU: 1 UID: 0 PID: 1 Comm: shutdown Not tainted 6.13.0-rc1-mtk+gfa1a78e5d24b-dirty #55 [ 86.516752] Hardware name: Unknown Product/Unknown Product, BIOS 2022.10 10/01/2022 [ 86.517960] Call trace: [ 86.518333] show_stack+0x20/0x38 (C) [ 86.518891] dump_stack_lvl+0x90/0xd0 [ 86.519443] print_report+0xf8/0x5b0 [ 86.519985] kasan_report+0xb4/0x100 [ 86.520526] __asan_report_load8_noabort+0x20/0x30 [ 86.521240] drm_atomic_helper_shutdown+0x33c/0x378 [ 86.521966] mtk_drm_shutdown+0x54/0x80 [ 86.522546] platform_shutdown+0x64/0x90 [ 86.523137] device_shutdown+0x260/0x5b8 [ 86.523728] kernel_restart+0x78/0xf0 [ 86.524282] __do_sys_reboot+0x258/0x2f0 [ 86.524871] __arm64_sys_reboot+0x90/0xd8 [ 86.525473] invoke_syscall+0x74/0x268 [ 86.526041] el0_svc_common.constprop.0+0xb0/0x240 [ 86.526751] do_el0_svc+0x4c/0x70 [ 86.527251] el0_svc+0x4c/0xc0 [ 86.527719] el0t_64_sync_handler+0x144/0x168 [ 86.528367] el0t_64_sync+0x198/0x1a0 [ 86.528920] [ 86.529157] The buggy address belongs to the physical page: [ 86.529972] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d46fd4d0 pfn:0x1146fc [ 86.531319] flags: 0xbfffc0000000000(node=0|zone=2|lastcpupid=0xffff) [ 86.532267] raw: 0bfffc0000000000 0000000000000000 dead000000000122 0000000000000000 [ 86.533390] raw: ffff0000d46fd4d0 0000000000000000 00000000ffffffff 0000000000000000 [ 86.534511] page dumped because: kasan: bad access detected [ 86.535323] [ 86.535559] Memory state around the buggy address: [ 86.536265] ffff0000d46fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.537314] ffff0000d46fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.538363] >ffff0000d46fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.544733] ^ [ 86.551057] ffff0000d46fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.557510] ffff0000d46fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 86.563928] ================================================================== [ 86.571093] Disabling lock debugging due to kernel taint [ 86.577642] Unable to handle kernel paging request at virtual address e0e9c0920000000b [ 86.581834] KASAN: maybe wild-memory-access in range [0x0752049000000058-0x075204900000005f]
...
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +2 -0
@@ -673,6 +673,8 @@ static int mtk_drm_bind(struct device *dev) err_free: private->drm =NULL ;drm_dev_put (drm); +for (i =0 ; i < private->data->mmsys_dev_num; i++) + private->all_drm_private[i]->drm =NULL ;return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/189 drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH.Lin <[email protected]>
[ Upstream commit da03801ad08f2488c01e684509cd89e1aa5d17ec ]
mtk_crtc_finish_page_flip() is used to notify userspace that a page flip has been completed, allowing userspace to free the frame buffer of the last frame and commit the next frame.
In MediaTek's hardware design for configuring display hardware by using GCE, DRM_EVENT_FLIP_COMPLETE should be notified to userspace after GCE has finished configuring all display hardware settings for each atomic_commit().
Currently, mtk_crtc_finish_page_flip() cannot guarantee that GCE has configured all the display hardware settings of the last frame. Therefore, to increase the accuracy of the timing for notifying DRM_EVENT_FLIP_COMPLETE to userspace, mtk_crtc_finish_page_flip() should be moved to ddp_cmdq_cb().
--- drivers/gpu/drm/mediatek/mtk_crtc.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/gpu/drm/mediatek/mtk_crtc.c +19 -6
@@ -112,6 +112,11 @@ static void mtk_drm_finish_page_flip(struct mtk_crtc *mtk_crtc)drm_crtc_handle_vblank (&mtk_crtc->base); +#if IS_REACHABLE (CONFIG_MTK_CMDQ ) +if (mtk_crtc->cmdq_client.chan) +return ; +#endif +spin_lock_irqsave (&mtk_crtc->config_lock, flags);if (!mtk_crtc->config_updating && mtk_crtc->pending_needs_vblank) {mtk_crtc_finish_page_flip (mtk_crtc);
@@ -284,10 +289,8 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg) state =to_mtk_crtc_state (mtk_crtc->base.state);spin_lock_irqsave (&mtk_crtc->config_lock, flags); -if (mtk_crtc->config_updating) { -spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); +if (mtk_crtc->config_updating) goto ddp_cmdq_cb_out; - } state->pending_config = false;
@@ -315,10 +318,15 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg) mtk_crtc->pending_async_planes = false; } -spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); - ddp_cmdq_cb_out: +if (mtk_crtc->pending_needs_vblank) { +mtk_crtc_finish_page_flip (mtk_crtc); + mtk_crtc->pending_needs_vblank = false; + } + +spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); + mtk_crtc->cmdq_vblank_cnt =0 ;wake_up (&mtk_crtc->cb_blocking_queue); }
@@ -606,13 +614,18 @@ static void mtk_crtc_update_config(struct mtk_crtc *mtk_crtc, bool needs_vblank)*/ mtk_crtc->cmdq_vblank_cnt =3 ; +spin_lock_irqsave (&mtk_crtc->config_lock, flags); + mtk_crtc->config_updating = false; +spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); +mbox_send_message (mtk_crtc->cmdq_client.chan, cmdq_handle); mbox_client_txdone(mtk_crtc->cmdq_client.chan, 0); } -#endif +#else spin_lock_irqsave (&mtk_crtc->config_lock, flags); mtk_crtc->config_updating = false;spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); +#endif mutex_unlock (&mtk_crtc->hw_lock); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/189 drm/mediatek: Add support for 180-degree rotation in the display driver
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH.Lin <[email protected]>
[ Upstream commit 5c9d7e79ba154e8e1f0bfdeb7b495f454c1a3eba ]
mediatek-drm driver reported the capability of 180-degree rotation by adding DRM_MODE_ROTATE_180 to the plane property, as flip-x combined with flip-y equals a 180-degree rotation. However, we did not handle the rotation property in the driver and lead to rotation issues.
--- drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_disp_ovl.c +10 -2
@@ -471,6 +471,7 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx,unsigned int pitch = pending->pitch;unsigned int hdr_pitch = pending->hdr_pitch;unsigned int fmt = pending->format; +unsigned int rotation = pending->rotation;unsigned int offset = (pending->y <<16 ) | pending->x;unsigned int src_size = (pending->height <<16 ) | pending->width;unsigned int blend_mode = state->base.pixel_blend_mode;
@@ -513,12 +514,19 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, ignore_pixel_alpha =OVL_CONST_BLEND ; } -if (pending->rotation &DRM_MODE_REFLECT_Y ) { +/* +* Treat rotate 180 as flip x + flip y, and XOR the original rotation value +* to flip x + flip y to support both in the same time. +*/ +if (rotation &DRM_MODE_ROTATE_180 ) + rotation ^=DRM_MODE_REFLECT_X |DRM_MODE_REFLECT_Y ; + +if (rotation &DRM_MODE_REFLECT_Y ) { con |=OVL_CON_VIRT_FLIP ; addr += (pending->height -1 ) * pending->pitch; } -if (pending->rotation &DRM_MODE_REFLECT_X ) { +if (rotation &DRM_MODE_REFLECT_X ) { con |=OVL_CON_HORZ_FLIP ; addr += pending->pitch -1 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/189 drm/mediatek: stop selecting foreign drivers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 924d66011f2401a4145e2e814842c5c4572e439f ]
The PHY portion of the mediatek hdmi driver was originally part of the driver it self and later split out into drivers/phy, which a 'select' to keep the prior behavior.
However, this leads to build failures when the PHY driver cannot be built:
WARNING: unmet direct dependencies detected for PHY_MTK_HDMI
Depends on [n]: (ARCH_MEDIATEK || COMPILE_TEST [=y]) && COMMON_CLK [=y] && OF [=y] && REGULATOR [=n] Selected by [m]:
- DRM_MEDIATEK_HDMI [=m] && HAS_IOMEM [=y] && DRM [=m] && DRM_MEDIATEK [=m]
ERROR: modpost: "devm_regulator_register" [drivers/phy/mediatek/phy-mtk-hdmi-drv.ko] undefined!
ERROR: modpost: "rdev_get_drvdata" [drivers/phy/mediatek/phy-mtk-hdmi-drv.ko] undefined!
The best option here is to just not select the phy driver and leave that up to the defconfig. Do the same for the other PHY and memory drivers selected here as well for consistency.
--- drivers/gpu/drm/mediatek/Kconfig | 5 ----- 1 file changed, 5 deletions(-)
drivers/gpu/drm/mediatek/Kconfig +0 -5
@@ -13,9 +13,6 @@ config DRM_MEDIATEK select DRM_BRIDGE_CONNECTOR select DRM_MIPI_DSI select DRM_PANEL - select MEMORY - select MTK_SMI - select PHY_MTK_MIPI_DSI select VIDEOMODE_HELPERS help Choose this option if you have a Mediatek SoCs.
@@ -26,7 +23,6 @@ config DRM_MEDIATEK config DRM_MEDIATEK_DP tristate "DRM DPTX Support for MediaTek SoCs" depends on DRM_MEDIATEK - select PHY_MTK_DP select DRM_DISPLAY_HELPER select DRM_DISPLAY_DP_HELPER select DRM_DISPLAY_DP_AUX_BUS
@@ -37,6 +33,5 @@ config DRM_MEDIATEK_HDMI tristate "DRM HDMI Support for Mediatek SoCs" depends on DRM_MEDIATEK select SND_SOC_HDMI_CODEC if SND_SOC - select PHY_MTK_HDMI help DRM/KMS HDMI driver for Mediatek SoCs
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/189 drm/mediatek: Fix YCbCr422 color format issue for DP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liankun Yang <[email protected]>
[ Upstream commit ef24fbd8f12015ff827973fffefed3902ffd61cc ]
Setting up misc0 for Pixel Encoding Format.
According to the definition of YCbCr in spec 1.2a Table 2-96, 0x1 << 1 should be written to the register.
Use switch case to distinguish RGB, YCbCr422,
and unsupported color formats.
--- drivers/gpu/drm/mediatek/mtk_dp.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +8 -5
@@ -543,18 +543,16 @@ static int mtk_dp_set_color_format(struct mtk_dp *mtk_dp, enum dp_pixelformat color_format) {u32 val; - -/* update MISC0 */ -mtk_dp_update_bits (mtk_dp,MTK_DP_ENC0_P0_3034 , - color_format <<DP_TEST_COLOR_FORMAT_SHIFT , -DP_TEST_COLOR_FORMAT_MASK ); +u32 misc0_color;switch (color_format) {case DP_PIXELFORMAT_YUV422 : val =PIXEL_ENCODE_FORMAT_DP_ENC0_P0_YCBCR422 ; + misc0_color = DP_COLOR_FORMAT_YCbCr422;break ;case DP_PIXELFORMAT_RGB : val =PIXEL_ENCODE_FORMAT_DP_ENC0_P0_RGB ; + misc0_color =DP_COLOR_FORMAT_RGB ;break ;default : drm_warn(mtk_dp->drm_dev, "Unsupported color format: %d\n",
@@ -562,6 +560,11 @@ static int mtk_dp_set_color_format(struct mtk_dp *mtk_dp,return -EINVAL ; } +/* update MISC0 */ +mtk_dp_update_bits (mtk_dp,MTK_DP_ENC0_P0_3034 , + misc0_color, +DP_TEST_COLOR_FORMAT_MASK ); +mtk_dp_update_bits (mtk_dp,MTK_DP_ENC0_P0_303C , val,PIXEL_ENCODE_FORMAT_DP_ENC0_P0_MASK );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/189 drm/mediatek: Fix mode valid issue for dp
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liankun Yang <[email protected]>
[ Upstream commit 0d68b55887cedc7487036ed34cb4c2097c4228f1 ]
Fix dp mode valid issue to avoid abnormal display of limit state.
After DP passes link training, it can express the lane count of the current link status is good. Calculate the maximum bandwidth supported by DP using the current lane count.
The color format will select the best one based on the bandwidth requirements of the current timing mode. If the current timing mode uses RGB and meets the DP link bandwidth requirements, RGB will be used.
If the timing mode uses RGB but does not meet the DP link bandwidthi requirements, it will continue to check whether YUV422 meets the DP link bandwidth.
FEC overhead is approximately 2.4% from DP 1.4a spec 2.2.1.4.2. The down-spread amplitude shall either be disabled (0.0%) or up to 0.5% from 1.4a 3.5.2.6. Add up to approximately 3% total overhead.
Because rate is already divided by 10,mode->clock does not need to be multiplied by 10.
--- drivers/gpu/drm/mediatek/mtk_dp.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +17 -11
@@ -2411,12 +2411,19 @@ mtk_dp_bridge_mode_valid(struct drm_bridge *bridge, {struct mtk_dp *mtk_dp =mtk_dp_from_bridge (bridge);u32 bpp = info->color_formats &DRM_COLOR_FORMAT_YCBCR422 ?16 :24 ; -u32 rate =min_t (u32,drm_dp_max_link_rate (mtk_dp->rx_cap) * -drm_dp_max_lane_count (mtk_dp->rx_cap), -drm_dp_bw_code_to_link_rate (mtk_dp->max_linkrate) * - mtk_dp->max_lanes); +u32 lane_count_min = mtk_dp->train_info.lane_count; +u32 rate =drm_dp_bw_code_to_link_rate (mtk_dp->train_info.link_rate) * + lane_count_min; -if (rate < mode->clock * bpp /8 ) +/* +*FEC overhead is approximately 2.4% from DP 1.4a spec 2.2.1.4.2. +*The down-spread amplitude shall either be disabled (0.0%) or up +*to 0.5% from 1.4a 3.5.2.6. Add up to approximately 3% total overhead. +* +*Because rate is already divided by 10, +*mode->clock does not need to be multiplied by 10 +*/ +if ((rate *97 /100 ) < (mode->clock * bpp /8 ))return MODE_CLOCK_HIGH ;return MODE_OK ;
@@ -2457,10 +2464,9 @@ static u32 *mtk_dp_bridge_atomic_get_input_bus_fmts(struct drm_bridge *bridge,struct drm_display_mode *mode = &crtc_state->adjusted_mode;struct drm_display_info *display_info = &conn_state->connector->display_info; -u32 rate =min_t (u32,drm_dp_max_link_rate (mtk_dp->rx_cap) * -drm_dp_max_lane_count (mtk_dp->rx_cap), -drm_dp_bw_code_to_link_rate (mtk_dp->max_linkrate) * - mtk_dp->max_lanes); +u32 lane_count_min = mtk_dp->train_info.lane_count; +u32 rate =drm_dp_bw_code_to_link_rate (mtk_dp->train_info.link_rate) * + lane_count_min; *num_input_fmts =0 ;
@@ -2469,8 +2475,8 @@ static u32 *mtk_dp_bridge_atomic_get_input_bus_fmts(struct drm_bridge *bridge,* datarate of YUV422 and sink device supports YUV422, we output YUV422 * format. Use this condition, we can support more resolution. */ -if ((rate < (mode->clock *24 /8 )) && - (rate > (mode->clock *16 /8 )) && +if (((rate *97 /100 ) < (mode->clock *24 /8 )) && + ((rate *97 /100 ) > (mode->clock *16 /8 )) && (display_info->color_formats &DRM_COLOR_FORMAT_YCBCR422 )) { input_fmts =kcalloc (1 ,sizeof (*input_fmts),GFP_KERNEL );if (!input_fmts)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/189 drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 76aed5e00ff2625e0ec4b40c75f3514bdb27fae4 ]
Registers DSI_VM_CMD and DSI_SHADOW_DEBUG start at different addresses in both MT8186 and MT8188 compared to the older IPs.
Add two members in struct mtk_dsi_driver_data to specify the offsets for these two registers on a per-SoC basis, then do specify those in all of the currently present SoC driver data.
This fixes writes to the Video Mode Command Packet Control register, fixing enablement of command packet transmission (VM_CMD_EN) and allowance of this transmission during the VFP period (TS_VFP_EN) on both MT8186 and MT8188.
--- drivers/gpu/drm/mediatek/mtk_dsi.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/gpu/drm/mediatek/mtk_dsi.c +17 -5
@@ -139,11 +139,11 @@#define CLK_HS_POST GENMASK(15, 8)#define CLK_HS_EXIT GENMASK(23, 16) -#define DSI_VM_CMD_CON 0x130 +/* DSI_VM_CMD_CON */ #define VM_CMD_EN BIT(0)#define TS_VFP_EN BIT(5) -#define DSI_SHADOW_DEBUG 0x190U +/* DSI_SHADOW_DEBUG */ #define FORCE_COMMIT BIT(0)#define BYPASS_SHADOW BIT(1)
@@ -187,6 +187,8 @@ struct phy;struct mtk_dsi_driver_data {const u32 reg_cmdq_off; +const u32 reg_vm_cmd_off; +const u32 reg_shadow_dbg_off;bool has_shadow_ctl;bool has_size_ctl;bool cmdq_long_packet_ctl;
@@ -367,8 +369,8 @@ static void mtk_dsi_set_mode(struct mtk_dsi *dsi)static void mtk_dsi_set_vm_cmd (struct mtk_dsi *dsi) { -mtk_dsi_mask (dsi,DSI_VM_CMD_CON ,VM_CMD_EN ,VM_CMD_EN ); -mtk_dsi_mask (dsi,DSI_VM_CMD_CON ,TS_VFP_EN ,TS_VFP_EN ); +mtk_dsi_mask (dsi, dsi->driver_data->reg_vm_cmd_off,VM_CMD_EN ,VM_CMD_EN ); +mtk_dsi_mask (dsi, dsi->driver_data->reg_vm_cmd_off,TS_VFP_EN ,TS_VFP_EN ); }static void mtk_dsi_rxtx_control (struct mtk_dsi *dsi)
@@ -714,7 +716,7 @@ static int mtk_dsi_poweron(struct mtk_dsi *dsi)if (dsi->driver_data->has_shadow_ctl)writel (FORCE_COMMIT |BYPASS_SHADOW , - dsi->regs +DSI_SHADOW_DEBUG ); + dsi->regs + dsi->driver_data->reg_shadow_dbg_off);mtk_dsi_reset_engine (dsi);mtk_dsi_phy_timconfig (dsi);
@@ -1255,26 +1257,36 @@ static void mtk_dsi_remove(struct platform_device *pdev)static const struct mtk_dsi_driver_data mt8173_dsi_driver_data = { .reg_cmdq_off =0x200 , + .reg_vm_cmd_off =0x130 , + .reg_shadow_dbg_off =0x190 };static const struct mtk_dsi_driver_data mt2701_dsi_driver_data = { .reg_cmdq_off =0x180 , + .reg_vm_cmd_off =0x130 , + .reg_shadow_dbg_off =0x190 };static const struct mtk_dsi_driver_data mt8183_dsi_driver_data = { .reg_cmdq_off =0x200 , + .reg_vm_cmd_off =0x130 , + .reg_shadow_dbg_off =0x190 , .has_shadow_ctl = true, .has_size_ctl = true, };static const struct mtk_dsi_driver_data mt8186_dsi_driver_data = { .reg_cmdq_off =0xd00 , + .reg_vm_cmd_off =0x200 , + .reg_shadow_dbg_off =0xc00 , .has_shadow_ctl = true, .has_size_ctl = true, };static const struct mtk_dsi_driver_data mt8188_dsi_driver_data = { .reg_cmdq_off =0xd00 , + .reg_vm_cmd_off =0x200 , + .reg_shadow_dbg_off =0xc00 , .has_shadow_ctl = true, .has_size_ctl = true, .cmdq_long_packet_ctl = true,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/189 gpio: virtuser: fix missing lookup table cleanups
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
[ Upstream commit a619cba8c69c434258ff4101d463322cd63e1bdc ]
When a virtuser device is created via configfs and the probe fails due to an incorrect lookup table, the table is not removed. This prevents subsequent probe attempts from succeeding, even if the issue is corrected, unless the device is released. Additionally, cleanup is also needed in the less likely case of platform_device_register_full() failure.
Besides, a consistent memory leak in lookup_table->dev_id was spotted using kmemleak by toggling the live state between 0 and 1 with a correct lookup table.
Introduce gpio_virtuser_remove_lookup_table() as the counterpart to the existing gpio_virtuser_make_lookup_table() and call it from all necessary points to ensure proper cleanup.
--- drivers/gpio/gpio-virtuser.c | 36 +++++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-)
drivers/gpio/gpio-virtuser.c +25 -11
@@ -1439,6 +1439,15 @@ gpio_virtuser_make_lookup_table(struct gpio_virtuser_device *dev)return 0 ; } +static void +gpio_virtuser_remove_lookup_table (struct gpio_virtuser_device *dev) +{ +gpiod_remove_lookup_table (dev->lookup_table); +kfree (dev->lookup_table->dev_id); +kfree (dev->lookup_table); + dev->lookup_table =NULL ; +} +static struct fwnode_handle *gpio_virtuser_make_device_swnode (struct gpio_virtuser_device *dev) {
@@ -1487,10 +1496,8 @@ gpio_virtuser_device_activate(struct gpio_virtuser_device *dev) pdevinfo.fwnode = swnode; ret =gpio_virtuser_make_lookup_table (dev); -if (ret) { -fwnode_remove_software_node (swnode); -return ret; - } +if (ret) + goto err_remove_swnode;reinit_completion (&dev->probe_completion); dev->driver_bound = false;
@@ -1498,23 +1505,31 @@ gpio_virtuser_device_activate(struct gpio_virtuser_device *dev) pdev =platform_device_register_full (&pdevinfo);if (IS_ERR (pdev)) { + ret =PTR_ERR (pdev);bus_unregister_notifier (&platform_bus_type, &dev->bus_notifier); -fwnode_remove_software_node (swnode); -return PTR_ERR (pdev); + goto err_remove_lookup_table; }wait_for_completion (&dev->probe_completion);bus_unregister_notifier (&platform_bus_type, &dev->bus_notifier);if (!dev->driver_bound) { -platform_device_unregister (pdev); -fwnode_remove_software_node (swnode); -return -ENXIO ; + ret = -ENXIO ; + goto err_unregister_pdev; } dev->pdev = pdev;return 0 ; + +err_unregister_pdev: +platform_device_unregister (pdev); +err_remove_lookup_table: +gpio_virtuser_remove_lookup_table (dev); +err_remove_swnode: +fwnode_remove_software_node (swnode); + +return ret; } static void
@@ -1526,10 +1541,9 @@ gpio_virtuser_device_deactivate(struct gpio_virtuser_device *dev) swnode =dev_fwnode (&dev->pdev->dev);platform_device_unregister (dev->pdev); +gpio_virtuser_remove_lookup_table (dev);fwnode_remove_software_node (swnode); dev->pdev =NULL ; -gpiod_remove_lookup_table (dev->lookup_table); -kfree (dev->lookup_table); } static ssize_t
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/189 gpio: virtuser: fix handling of multiple conn_ids in lookup table
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
[ Upstream commit 656cc2e892f128b03ea9ef19bd11d70f71d5472b ]
Creating a virtuser device via configfs with multiple conn_ids fails due to incorrect indexing of lookup entries. Correct the indexing logic to ensure proper functionality when multiple gpio_virtuser_lookup are created.
--- drivers/gpio/gpio-virtuser.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpio/gpio-virtuser.c +4 -4
@@ -1410,7 +1410,7 @@ gpio_virtuser_make_lookup_table(struct gpio_virtuser_device *dev)size_t num_entries =gpio_virtuser_get_lookup_count (dev);struct gpio_virtuser_lookup_entry *entry;struct gpio_virtuser_lookup *lookup; -unsigned int i =0 ; +unsigned int i =0 , idx;lockdep_assert_held (&dev->lock);
@@ -1424,12 +1424,12 @@ gpio_virtuser_make_lookup_table(struct gpio_virtuser_device *dev)return -ENOMEM ;list_for_each_entry (lookup, &dev->lookup_list, siblings) { + idx =0 ;list_for_each_entry (entry, &lookup->entry_list, siblings) { - table->table[i] = + table->table[i++] =GPIO_LOOKUP_IDX (entry->key, entry->offset <0 ?U16_MAX : entry->offset, - lookup->con_id, i, entry->flags); - i++; + lookup->con_id, idx++, entry->flags); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/189 drm/mediatek: Add return value check when reading DPCD
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liankun Yang <[email protected]>
[ Upstream commit 522908140645865dc3e2fac70fd3b28834dfa7be ]
Check the return value of drm_dp_dpcd_readb() to confirm that AUX communication is successful. To simplify the code, replace drm_dp_dpcd_readb() and DP_GET_SINK_COUNT() with drm_dp_read_sink_count().
--- drivers/gpu/drm/mediatek/mtk_dp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +2 -3
@@ -2103,7 +2103,6 @@ static enum drm_connector_status mtk_dp_bdg_detect(struct drm_bridge *bridge)struct mtk_dp *mtk_dp =mtk_dp_from_bridge (bridge);enum drm_connector_status ret = connector_status_disconnected;bool enabled = mtk_dp->enabled; -u8 sink_count =0 ;if (!mtk_dp->train_info.cable_plugged_in)return ret;
@@ -2118,8 +2117,8 @@ static enum drm_connector_status mtk_dp_bdg_detect(struct drm_bridge *bridge)* function, we just need to check the HPD connection to check * whether we connect to a sink device. */ -drm_dp_dpcd_readb (&mtk_dp->aux,DP_SINK_COUNT , &sink_count); -if (DP_GET_SINK_COUNT (sink_count)) + +if (drm_dp_read_sink_count (&mtk_dp->aux) >0 ) ret = connector_status_connected;if (!enabled)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/189 ksmbd: fix a missing return value check bug
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit 4c16e1cadcbcaf3c82d5fc310fbd34d0f5d0db7c ]
In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct() fails to allocate a node, it returns a NULL pointer to the in_work pointer. This can lead to an illegal memory write of in_work->response_buf when allocate_interim_rsp_buf() attempts to perform a kzalloc() on it.
To address this issue, incorporating a check for the return value of ksmbd_alloc_work_struct() ensures that the function returns immediately upon allocation failure, thereby preventing the aforementioned illegal memory access.
--- fs/smb/server/smb2pdu.c | 3 +++ 1 file changed, 3 insertions(+)
fs/smb/server/smb2pdu.c +3 -0
@@ -695,6 +695,9 @@ void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status)struct smb2_hdr *rsp_hdr;struct ksmbd_work *in_work =ksmbd_alloc_work_struct (); +if (!in_work) +return ; +if (allocate_interim_rsp_buf (in_work)) {pr_err ("smb_allocate_rsp_buf failed!\n" );ksmbd_free_work_struct (in_work);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/189 afs: Fix the maximum cell name length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8 ]
The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning:
WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405
because procfs limits the maximum filename length to 255.
However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL).
Fix this by limiting the maximum acceptable cellname length to 253. This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too.
Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253.
--- fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 ++++++-- fs/afs/vlclient.c | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-)
fs/afs/afs.h +1 -1
@@ -10,7 +10,7 @@#include <linux/in.h> -#define AFS_MAXCELLNAME 256/* Maximum length of a cell name */ +#define AFS_MAXCELLNAME 253/* Maximum length of a cell name (DNS limited) */ #define AFS_MAXVOLNAME 64/* Maximum length of a volume name */ #define AFS_MAXNSERVERS 8/* Maximum servers in a basic volume record */ #define AFS_NMAXNSERVERS 13/* Maximum servers in a N/U-class volume record */
fs/afs/afs_vl.h +1 -0
@@ -13,6 +13,7 @@#define AFS_VL_PORT 7003/* volume location service port */ #define VL_SERVICE 52/* RxRPC service ID for the Volume Location service */ #define YFS_VL_SERVICE 2503/* Service ID for AuriStor upgraded VL service */ +#define YFS_VL_MAXCELLNAME 256/* Maximum length of a cell name in YFS protocol */ enum AFSVL_Operations {VLGETENTRYBYID =503 ,/* AFS Get VLDB entry by ID */
fs/afs/vl_alias.c +6 -2
@@ -253,6 +253,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key)static int yfs_check_canonical_cell_name (struct afs_cell *cell,struct key *key) {struct afs_cell *master; +size_t name_len;char *cell_name; cell_name =afs_vl_get_cell_name (cell, key);
@@ -264,8 +265,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key)return 0 ; } - master =afs_lookup_cell (cell->net, cell_name,strlen (cell_name), -NULL , false); + name_len =strlen (cell_name); +if (!name_len || name_len >AFS_MAXCELLNAME ) + master =ERR_PTR (-EOPNOTSUPP ); +else + master =afs_lookup_cell (cell->net, cell_name, name_len,NULL , false);kfree (cell_name);if (IS_ERR (master))return PTR_ERR (master);
fs/afs/vlclient.c +1 -1
@@ -697,7 +697,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call)return ret; namesz =ntohl (call->tmp); -if (namesz >AFS_MAXCELLNAME ) +if (namesz >YFS_VL_MAXCELLNAME )return afs_protocol_error (call, afs_eproto_cellname_len); paddedsz = (namesz +3 ) & ~3 ; call->count = namesz;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/189 platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej S. Szmigiero <[email protected]>
[ Upstream commit dd410d784402c5775f66faf8b624e85e41c38aaf ]
Wakeup for IRQ1 should be disabled only in cases where i8042 had actually enabled it, otherwise "wake_depth" for this IRQ will try to drop below zero and there will be an unpleasant WARN() logged:
kernel: atkbd serio0: Disabling IRQ1 wakeup source to avoid platform firmware bug
kernel: ------------[ cut here ]------------
kernel: Unbalanced IRQ 1 wake disable
kernel: WARNING: CPU: 10 PID: 6431 at kernel/irq/manage.c:920 irq_set_irq_wake+0x147/0x1a0
The PMC driver uses DEFINE_SIMPLE_DEV_PM_OPS() to define its dev_pm_ops which sets amd_pmc_suspend_handler() to the .suspend, .freeze, and .poweroff handlers. i8042_pm_suspend(), however, is only set as the .suspend handler.
Fix the issue by call PMC suspend handler only from the same set of dev_pm_ops handlers as i8042_pm_suspend(), which currently means just the .suspend handler.
To reproduce this issue try hibernating (S4) the machine after a fresh boot without putting it into s2idle first.
--- drivers/platform/x86/amd/pmc/pmc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/platform/x86/amd/pmc/pmc.c +7 -1
@@ -947,6 +947,10 @@ static int amd_pmc_suspend_handler(struct device *dev) {struct amd_pmc_dev *pdev =dev_get_drvdata (dev); +/* +* Must be called only from the same set of dev_pm_ops handlers +* as i8042_pm_suspend() is called: currently just from .suspend. +*/ if (pdev->disable_8042_wakeup && !disable_workarounds) {int rc =amd_pmc_wa_irq1 (pdev);
@@ -959,7 +963,9 @@ static int amd_pmc_suspend_handler(struct device *dev)return 0 ; } -static DEFINE_SIMPLE_DEV_PM_OPS(amd_pmc_pm, amd_pmc_suspend_handler, NULL); +static const struct dev_pm_ops amd_pmc_pm = { + .suspend = amd_pmc_suspend_handler, +};static const struct pci_device_id pmc_pci_ids[] = { {PCI_DEVICE (PCI_VENDOR_ID_AMD ,AMD_CPU_ID_PS ) },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/189 platform/x86: intel/pmc: Fix ioremap() of bad address
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David E. Box <[email protected]>
[ Upstream commit 1d7461d0c8330689117286169106af6531a747ed ]
In pmc_core_ssram_get_pmc(), the physical addresses for hidden SSRAM devices are retrieved from the MMIO region of the primary SSRAM device. If additional devices are not present, the address returned is zero. Currently, the code does not check for this condition, resulting in ioremap() incorrectly attempting to map address 0.
Add a check for a zero address and return 0 if no additional devices are found, as it is not an error for the device to be absent.
--- drivers/platform/x86/intel/pmc/core_ssram.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/intel/pmc/core_ssram.c +4 -0
@@ -269,8 +269,12 @@ pmc_core_ssram_get_pmc(struct pmc_dev *pmcdev, int pmc_idx, u32 offset)/* * The secondary PMC BARS (which are behind hidden PCI devices) * are read from fixed offsets in MMIO of the primary PMC BAR. +* If a device is not present, the value will be 0. */ ssram_base =get_base (tmp_ssram, offset); +if (!ssram_base) +return 0 ; + ssram =ioremap (ssram_base,SSRAM_HDR_SIZE );if (!ssram)return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/189 ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: He Wang <[email protected]>
[ Upstream commit 2ac538e40278a2c0c051cca81bcaafc547d61372 ]
When ksmbd_vfs_kern_path_locked met an error and it is not the last entry, it will exit without restoring changed path buffer. But later this buffer may be used as the filename for creation.
--- fs/smb/server/vfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/smb/server/vfs.c +2 -1
@@ -1264,6 +1264,8 @@ int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, filepath, flags, path); +if (!is_last) + next[0 ] ='/' ;if (err) goto out2;else if (is_last)
@@ -1271,7 +1273,6 @@ int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name,path_put (parent_path); *parent_path = *path; - next[0 ] ='/' ; remain_len -= filename_len +1 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/189 riscv: module: remove relocation_head rel_entry member allocation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 03f0b548537f758830bdb2dc3f2aba713069cef2 ]
relocation_head's list_head member, rel_entry, doesn't need to be allocated, its storage can just be part of the allocated relocation_head. Remove the pointer which allows to get rid of the allocation as well as an existing memory leak found by Kai Zhang using kmemleak.
--- arch/riscv/kernel/module.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-)
arch/riscv/kernel/module.c +4 -14
@@ -23,7 +23,7 @@ struct used_bucket {struct relocation_head {struct hlist_node node; -struct list_head *rel_entry; +struct list_head rel_entry;void *location; };
@@ -634,7 +634,7 @@ process_accumulated_relocations(struct module *me, location = rel_head_iter->location;list_for_each_entry_safe (rel_entry_iter, rel_entry_iter_tmp, - rel_head_iter->rel_entry, + &rel_head_iter->rel_entry, head) { curr_type = rel_entry_iter->type; reloc_handlers[curr_type].reloc_handler(
@@ -704,16 +704,7 @@ static int add_relocation_to_accumulate(struct module *me, int type,return -ENOMEM ; } - rel_head->rel_entry = -kmalloc (sizeof (struct list_head ),GFP_KERNEL ); - -if (!rel_head->rel_entry) { -kfree (entry); -kfree (rel_head); -return -ENOMEM ; - } - -INIT_LIST_HEAD (rel_head->rel_entry); +INIT_LIST_HEAD (&rel_head->rel_entry); rel_head->location = location;INIT_HLIST_NODE (&rel_head->node);if (!current_head->first) {
@@ -722,7 +713,6 @@ static int add_relocation_to_accumulate(struct module *me, int type,if (!bucket) {kfree (entry); -kfree (rel_head->rel_entry);kfree (rel_head);return -ENOMEM ; }
@@ -735,7 +725,7 @@ static int add_relocation_to_accumulate(struct module *me, int type, }/* Add relocation to head of discovered rel_head */ -list_add_tail (&entry->head, rel_head->rel_entry); +list_add_tail (&entry->head, &rel_head->rel_entry);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/189 cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 7e25044b804581b9c029d5a28d8800aebde18043 ]
The 'np' device_node is initialized via of_cpu_device_node_get(), which requires explicit calls to of_node_put() when it is no longer required to avoid leaking the resource.
Instead of adding the missing calls to of_node_put() in all execution paths, use the cleanup attribute for 'np' by means of the __free() macro, which automatically calls of_node_put() when the variable goes out of scope. Given that 'np' is only used within the for_each_possible_cpu(), reduce its scope to release the nood after every iteration of the loop.
--- drivers/cpuidle/cpuidle-riscv-sbi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpuidle/cpuidle-riscv-sbi.c +2 -2
@@ -500,12 +500,12 @@ static int sbi_cpuidle_probe(struct platform_device *pdev)int cpu, ret;struct cpuidle_driver *drv;struct cpuidle_device *dev; -struct device_node *np, *pds_node; +struct device_node *pds_node;/* Detect OSI support based on CPU DT nodes */ sbi_cpuidle_use_osi = true;for_each_possible_cpu (cpu) { - np =of_cpu_device_node_get (cpu); + struct device_node *np __free(device_node) = of_cpu_device_node_get(cpu);if (np &&of_property_present (np,"power-domains" ) &&of_property_present (np,"power-domain-names" )) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/189 riscv: mm: Fix the out of bound issue of vmemmap address
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Lu <[email protected]>
[ Upstream commit f754f27e98f88428aaf6be6e00f5cbce97f62d4b ]
In sparse vmemmap model, the virtual address of vmemmap is calculated as:
((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT)). And the struct page's va can be calculated with an offset:
(vmemmap + (pfn)).
However, when initializing struct pages, kernel actually starts from the first page from the same section that phys_ram_base belongs to. If the first page's physical address is not (phys_ram_base >> PAGE_SHIFT), then we get an va below VMEMMAP_START when calculating va for it's struct page.
For example, if phys_ram_base starts from 0x82000000 with pfn 0x82000, the first page in the same section is actually pfn 0x80000. During init_unavailable_range(), we will initialize struct page for pfn 0x80000 with virtual address ((struct page *)VMEMMAP_START - 0x2000), which is below VMEMMAP_START as well as PCI_IO_END.
This commit fixes this bug by introducing a new variable 'vmemmap_start_pfn' which is aligned with memory section size and using it to calculate vmemmap address instead of phys_ram_base.
--- arch/riscv/include/asm/page.h | 1 + arch/riscv/include/asm/pgtable.h | 2 +- arch/riscv/mm/init.c | 17 ++++++++++++++++- 3 files changed, 18 insertions(+), 2 deletions(-)
arch/riscv/include/asm/page.h +1 -0
@@ -124,6 +124,7 @@ struct kernel_mapping {extern struct kernel_mapping kernel_map;extern phys_addr_t phys_ram_base; +extern unsigned long vmemmap_start_pfn;#define is_kernel_mapping (x) \ ((x) >= kernel_map.virt_addr && (x) < (kernel_map.virt_addr + kernel_map.size))
arch/riscv/include/asm/pgtable.h +1 -1
@@ -87,7 +87,7 @@* Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled. */ -#define vmemmap ((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT)) +#define vmemmap ((struct page *)VMEMMAP_START - vmemmap_start_pfn)#define PCI_IO_SIZE SZ_16M#define PCI_IO_END VMEMMAP_START
arch/riscv/mm/init.c +16 -1
@@ -33,6 +33,7 @@#include <asm/pgtable.h> #include <asm/sections.h> #include <asm/soc.h> +#include <asm/sparsemem.h> #include <asm/tlbflush.h> #include "../kernel/head.h"
@@ -62,6 +63,13 @@ EXPORT_SYMBOL(pgtable_l5_enabled);phys_addr_t phys_ram_base__ro_after_init ;EXPORT_SYMBOL (phys_ram_base); +#ifdef CONFIG_SPARSEMEM_VMEMMAP +#define VMEMMAP_ADDR_ALIGN (1ULL << SECTION_SIZE_BITS) + +unsigned long vmemmap_start_pfn__ro_after_init ; +EXPORT_SYMBOL (vmemmap_start_pfn); +#endif + unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)] __page_aligned_bss;EXPORT_SYMBOL (empty_zero_page);
@@ -240,8 +248,12 @@ static void __init setup_bootmem(void)* Make sure we align the start of the memory on a PMD boundary so that * at worst, we map the linear mapping with PMD mappings. */ -if (!IS_ENABLED (CONFIG_XIP_KERNEL )) +if (!IS_ENABLED (CONFIG_XIP_KERNEL )) { phys_ram_base =memblock_start_of_DRAM () &PMD_MASK ; +#ifdef CONFIG_SPARSEMEM_VMEMMAP + vmemmap_start_pfn =round_down (phys_ram_base,VMEMMAP_ADDR_ALIGN ) >>PAGE_SHIFT ; +#endif + }/* * In 64-bit, any use of __va/__pa before this point is wrong as we
@@ -1101,6 +1113,9 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa) kernel_map.xiprom_sz = (uintptr_t )(&_exiprom) - (uintptr_t )(&_xiprom); phys_ram_base =CONFIG_PHYS_RAM_BASE ; +#ifdef CONFIG_SPARSEMEM_VMEMMAP + vmemmap_start_pfn =round_down (phys_ram_base,VMEMMAP_ADDR_ALIGN ) >>PAGE_SHIFT ; +#endif kernel_map.phys_addr = (uintptr_t )CONFIG_PHYS_RAM_BASE ; kernel_map.size = (uintptr_t )(&_end) - (uintptr_t )(&_start);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/189 riscv: stacktrace: fix backtracing through exceptions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 51356ce60e5915a6bd812873186ed54e45c2699d ]
Prior to commit 5d5fc33ce58e ("riscv: Improve exception and system call latency"), backtrace through exception worked since ra was filled with ret_from_exception symbol address and the stacktrace code checked 'pc' to be equal to that symbol. Now that handle_exception uses regular 'call' instructions, this isn't working anymore and backtrace stops at handle_exception(). Since there are multiple call site to C code in the exception handling path, rather than checking multiple potential return addresses, add a new symbol at the end of exception handling and check pc to be in that range.
--- arch/riscv/kernel/entry.S | 1 + arch/riscv/kernel/stacktrace.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-)
arch/riscv/kernel/entry.S +1 -0
@@ -278,6 +278,7 @@ SYM_CODE_START_NOALIGN(ret_from_exception) #else sret #endif +SYM_INNER_LABEL(ret_from_exception_end, SYM_L_GLOBAL) SYM_CODE_END(ret_from_exception) ASM_NOKPROBE(ret_from_exception)
arch/riscv/kernel/stacktrace.c +3 -1
@@ -17,6 +17,7 @@#ifdef CONFIG_FRAME_POINTER extern asmlinkage void handle_exception(void); +extern unsigned long ret_from_exception_end;static inline int fp_is_valid (unsigned long fp,unsigned long sp) {
@@ -71,7 +72,8 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, fp = frame->fp; pc =ftrace_graph_ret_addr (current, &graph_idx, frame->ra, &frame->ra); -if (pc == (unsigned long )handle_exception) { +if (pc >= (unsigned long )handle_exception && + pc < (unsigned long )&ret_from_exception_end) {if (unlikely (!__kernel_text_address (pc) || !fn (arg, pc)))break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/189 riscv: use local label names instead of global ones in assembly
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 5cd900b8b7e42c492431eb4261c18927768db1f9 ]
Local labels should be prefix by '.L' or they'll be exported in the symbol table. Additionally, this messes up the backtrace by displaying an incorrect symbol:
...
[ 12.751810] [<ffffffff80441628>] _copy_from_user+0x28/0xc2 [ 12.752035] [<ffffffff800152ca>] handle_misaligned_load+0x1ca/0x2fc [ 12.752310] [<ffffffff80a033e8>] do_trap_load_misaligned+0x24/0xee [ 12.752596] [<ffffffff80a0dcae>] _new_vmalloc_restore_context_a0+0xc2/0xce
After:
...
[ 10.243916] [<ffffffff804415e4>] _copy_from_user+0x28/0xc2 [ 10.244026] [<ffffffff800152ca>] handle_misaligned_load+0x1ca/0x2fc [ 10.244150] [<ffffffff80a033a0>] do_trap_load_misaligned+0x24/0xee [ 10.244268] [<ffffffff80a0dc66>] handle_exception+0x146/0x152
--- arch/riscv/kernel/entry.S | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/riscv/kernel/entry.S +10 -10
@@ -23,21 +23,21 @@ REG_S a0, TASK_TI_A0(tp) csrr a0, CSR_CAUSE /* Exclude IRQs */ - blt a0, zero, _new_vmalloc_restore_context_a0 + blt a0, zero, .Lnew_vmalloc_restore_context_a0 REG_S a1, TASK_TI_A1(tp) /* Only check new_vmalloc if we are in page/protection fault */ li a1, EXC_LOAD_PAGE_FAULT - beq a0, a1, _new_vmalloc_kernel_address + beq a0, a1, .Lnew_vmalloc_kernel_address li a1, EXC_STORE_PAGE_FAULT - beq a0, a1, _new_vmalloc_kernel_address + beq a0, a1, .Lnew_vmalloc_kernel_address li a1, EXC_INST_PAGE_FAULT - bne a0, a1, _new_vmalloc_restore_context_a1 + bne a0, a1, .Lnew_vmalloc_restore_context_a1 -_new_vmalloc_kernel_address: +.Lnew_vmalloc_kernel_address: /* Is it a kernel address? */ csrr a0, CSR_TVAL - bge a0, zero, _new_vmalloc_restore_context_a1 + bge a0, zero, .Lnew_vmalloc_restore_context_a1 /* Check if a new vmalloc mapping appeared that could explain the trap */ REG_S a2, TASK_TI_A2(tp)
@@ -69,7 +69,7 @@ _new_vmalloc_kernel_address: /* Check the value of new_vmalloc for this cpu */ REG_L a2, 0(a0) and a2, a2, a1 - beq a2, zero, _new_vmalloc_restore_context + beq a2, zero, .Lnew_vmalloc_restore_context /* Atomically reset the current cpu bit in new_vmalloc */ amoxor.d a0, a1, (a0)
@@ -83,11 +83,11 @@ _new_vmalloc_kernel_address: csrw CSR_SCRATCH, x0 sret -_new_vmalloc_restore_context: +.Lnew_vmalloc_restore_context: REG_L a2, TASK_TI_A2(tp) -_new_vmalloc_restore_context_a1: +.Lnew_vmalloc_restore_context_a1: REG_L a1, TASK_TI_A1(tp) -_new_vmalloc_restore_context_a0: +.Lnew_vmalloc_restore_context_a0: REG_L a0, TASK_TI_A0(tp) .endm
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/189 drm/xe: Fix tlb invalidation when wedging
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <[email protected]>
[ Upstream commit 9ab4981552930a9c45682d62424ba610edc3992d ]
If GuC fails to load, the driver wedges, but in the process it tries to do stuff that may not be initialized yet. This moves the xe_gt_tlb_invalidation_init() to be done earlier: as its own doc says, it's a software-only initialization and should had been named with the _early() suffix.
Move it to be called by xe_gt_init_early(), so the locks and seqno are initialized, avoiding a NULL ptr deref when wedging:
xe 0000:03:00.0: [drm] *ERROR* GT0: load failed: status: Reset = 0, BootROM = 0x50, UKernel = 0x00, MIA = 0x00, Auth = 0x01 xe 0000:03:00.0: [drm] *ERROR* GT0: firmware signature verification failed xe 0000:03:00.0: [drm] *ERROR* CRITICAL: Xe has declared device 0000:03:00.0 as wedged. ... BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 9 UID: 0 PID: 3908 Comm: modprobe Tainted: G U W 6.13.0-rc4-xe+ #3 Tainted: [U]=USER, [W]=WARN Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-S ADP-S DDR5 UDIMM CRB, BIOS ADLSFWI1.R00.3275.A00.2207010640 07/01/2022 RIP: 0010:xe_gt_tlb_invalidation_reset+0x75/0x110 [xe]
This can be easily triggered by poking the GuC binary to force a signature failure. There will still be an extra message,
xe 0000:03:00.0: [drm] *ERROR* GT0: GuC mmio request 0x4100: no reply 0x4100
but that's better than a NULL ptr deref.
--- drivers/gpu/drm/xe/xe_gt.c | 8 ++++---- drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 4 ++-- drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 3 ++- 3 files changed, 8 insertions(+), 7 deletions(-)
drivers/gpu/drm/xe/xe_gt.c +4 -4
@@ -386,6 +386,10 @@ int xe_gt_init_early(struct xe_gt *gt)xe_force_wake_init_gt (gt,gt_to_fw (gt));spin_lock_init (>->global_invl_lock); + err =xe_gt_tlb_invalidation_init_early (gt); +if (err) +return err; +return 0 ; }
@@ -585,10 +589,6 @@ int xe_gt_init(struct xe_gt *gt)xe_hw_fence_irq_init (>->fence_irq[i]); } - err =xe_gt_tlb_invalidation_init (gt); -if (err) -return err; - err =xe_gt_pagefault_init (gt);if (err)return err;
drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c +2 -2
@@ -106,7 +106,7 @@ static void xe_gt_tlb_fence_timeout(struct work_struct *work) }/** -* xe_gt_tlb_invalidation_init - Initialize GT TLB invalidation state +* xe_gt_tlb_invalidation_init_early - Initialize GT TLB invalidation state * @gt: graphics tile * * Initialize GT TLB invalidation state, purely software initialization, should
@@ -114,7 +114,7 @@ static void xe_gt_tlb_fence_timeout(struct work_struct *work)* * Return: 0 on success, negative error code on error. */ -int xe_gt_tlb_invalidation_init (struct xe_gt *gt) +int xe_gt_tlb_invalidation_init_early (struct xe_gt *gt) { gt->tlb_invalidation.seqno =1 ;INIT_LIST_HEAD (>->tlb_invalidation.pending_fences);
drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h +2 -1
@@ -14,7 +14,8 @@ struct xe_gt;struct xe_guc ;struct xe_vma ; -int xe_gt_tlb_invalidation_init (struct xe_gt *gt); +int xe_gt_tlb_invalidation_init_early (struct xe_gt *gt); +void xe_gt_tlb_invalidation_reset (struct xe_gt *gt);int xe_gt_tlb_invalidation_ggtt (struct xe_gt *gt); int xe_gt_tlb_invalidation_vma(struct xe_gt *gt,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/189 netfs: Fix kernel async DIO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 3f6bc9e3ab9b127171d39f9ac6eca1abb693b731 ]
Netfslib needs to be able to handle kernel-initiated asynchronous DIO that is supplied with a bio_vec[] array. Currently, because of the async flag, this gets passed to netfs_extract_user_iter() which throws a warning and fails because it only handles IOVEC and UBUF iterators. This can be triggered through a combination of cifs and a loopback blockdev with something like:
mount //my/cifs/share /foo
dd if=/dev/zero of=/foo/m0 bs=4K count=1K
losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0
echo hello >/dev/loop2046This causes the following to appear in syslog:
WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs]
and the write to fail.
Fix this by removing the check in netfs_unbuffered_write_iter_locked() that causes async kernel DIO writes to be handled as userspace writes. Note that this change relies on the kernel caller maintaining the existence of the bio_vec array (or kvec[] or folio_queue) until the op is complete.
--- fs/netfs/direct_write.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/netfs/direct_write.c +6 -1
@@ -67,7 +67,7 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter ** allocate a sufficiently large bvec array and may shorten the * request. */ -if (async ||user_backed_iter (iter)) { +if (user_backed_iter (iter)) { n =netfs_extract_user_iter (iter, len, &wreq->iter,0 );if (n <0 ) { ret = n;
@@ -77,6 +77,11 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter * wreq->direct_bv_count = n; wreq->direct_bv_unpin =iov_iter_extract_will_pin (iter); }else { +/* If this is a kernel-generated async DIO request, +* assume that any resources the iterator points to +* (eg. a bio_vec array) will persist till the end of +* the op. +*/ wreq->iter = *iter; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/189 netfs: Fix read-retry for fs with no ->prepare_read()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 904abff4b1b94184aaa0e9f5fce7821f7b5b81a3 ]
Fix netfslib's read-retry to only call ->prepare_read() in the backing filesystem such a function is provided. We can get to this point if a there's an active cache as failed reads from the cache need negotiating with the server instead.
--- fs/netfs/read_retry.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/netfs/read_retry.c +2 -1
@@ -149,7 +149,8 @@ static void netfs_retry_read_subrequests(struct netfs_io_request *rreq)BUG_ON (!len);/* Renegotiate max_len (rsize) */ -if (rreq->netfs_ops->prepare_read (subreq) <0 ) { +if (rreq->netfs_ops->prepare_read && + rreq->netfs_ops->prepare_read (subreq) <0 ) {trace_netfs_sreq (subreq, netfs_sreq_trace_reprep_failed);__set_bit (NETFS_SREQ_FAILED , &subreq->flags); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/189 drivers/perf: riscv: Fix Platform firmware event data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit fc58db9aeb15e89b69ff5e9abc69ecf9e5f888ed ]
Platform firmware event data field is allowed to be 62 bits for Linux as uppper most two bits are reserved to indicate SBI fw or platform specific firmware events.
However, the event data field is masked as per the hardware raw event mask which is not correct.
Fix the platform firmware event data field with proper mask.
--- arch/riscv/include/asm/sbi.h | 1 + drivers/perf/riscv_pmu_sbi.c | 12 +++++------- 2 files changed, 6 insertions(+), 7 deletions(-)
arch/riscv/include/asm/sbi.h +1 -0
@@ -158,6 +158,7 @@ struct riscv_pmu_snapshot_data { };#define RISCV_PMU_RAW_EVENT_MASK GENMASK_ULL(47, 0) +#define RISCV_PMU_PLAT_FW_EVENT_MASK GENMASK_ULL(61, 0)#define RISCV_PMU_RAW_EVENT_IDX 0x20000#define RISCV_PLAT_FW_EVENT 0xFFFF
drivers/perf/riscv_pmu_sbi.c +5 -7
@@ -507,7 +507,6 @@ static int pmu_sbi_event_map(struct perf_event *event, u64 *econfig) {u32 type = event->attr.type;u64 config = event->attr.config; -u64 raw_config_val;int ret;/*
@@ -528,21 +527,20 @@ static int pmu_sbi_event_map(struct perf_event *event, u64 *econfig)case PERF_TYPE_RAW :/* * As per SBI specification, the upper 16 bits must be unused -* for a raw event. +* for a hardware raw event. * Bits 63:62 are used to distinguish between raw events * 00 - Hardware raw event * 10 - SBI firmware events * 11 - Risc-V platform specific firmware event */ - raw_config_val = config &RISCV_PMU_RAW_EVENT_MASK ; +switch (config >>62 ) {case 0 : ret =RISCV_PMU_RAW_EVENT_IDX ; - *econfig = raw_config_val; + *econfig = config &RISCV_PMU_RAW_EVENT_MASK ;break ;case 2 : - ret = (raw_config_val &0xFFFF ) | - (SBI_PMU_EVENT_TYPE_FW <<16 ); + ret = (config &0xFFFF ) | (SBI_PMU_EVENT_TYPE_FW <<16 );break ;case 3 :/*
@@ -551,7 +549,7 @@ static int pmu_sbi_event_map(struct perf_event *event, u64 *econfig)* Event data - raw event encoding */ ret =SBI_PMU_EVENT_TYPE_FW <<16 |RISCV_PLAT_FW_EVENT ; - *econfig = raw_config_val; + *econfig = config &RISCV_PMU_PLAT_FW_EVENT_MASK ;break ; }break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/189 drivers/perf: riscv: Return error for default case
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit 2c206cdede567f53035c622e846678a996f39d69 ]
If the upper two bits has an invalid valid (0x1), the event mapping is not reliable as it returns an uninitialized variable.
Return appropriate value for the default case.
--- drivers/perf/riscv_pmu_sbi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/perf/riscv_pmu_sbi.c +3 -2
@@ -507,7 +507,7 @@ static int pmu_sbi_event_map(struct perf_event *event, u64 *econfig) {u32 type = event->attr.type;u64 config = event->attr.config; -int ret; +int ret = -ENOENT ;/* * Ensure we are finished checking standard hardware events for
@@ -551,10 +551,11 @@ static int pmu_sbi_event_map(struct perf_event *event, u64 *econfig) ret =SBI_PMU_EVENT_TYPE_FW <<16 |RISCV_PLAT_FW_EVENT ; *econfig = config &RISCV_PMU_PLAT_FW_EVENT_MASK ;break ; +default : +break ; }break ;default : - ret = -ENOENT ;break ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/189 dm thin: make get_first_thin use rcu-safe list first function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krister Johansen <[email protected]>
commit 80f130bfad1dab93b95683fc39b87235682b8f72 upstream.
The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty() -> list_first() sequence in RCU safe code. This is because each of these functions performs its own READ_ONCE() of the list head. This can lead to a situation where the list_empty() sees a valid list entry, but the subsequent list_first() sees a different view of list head state after a modification.
In the case of dm-thin, this author had a production box crash from a GP fault in the process_deferred_bios path. This function saw a valid list head in get_first_thin() but when it subsequently dereferenced that and turned it into a thin_c, it got the inside of the struct pool, since the list was now empty and referring to itself. The kernel on which this occurred printed both a warning about a refcount_t being saturated, and a UBSAN error for an out-of-bounds cpuid access in the queued spinlock, prior to the fault itself. When the resulting kdump was examined, it was possible to see another thread patiently waiting in thin_dtr's synchronize_rcu.
The thin_dtr call managed to pull the thin_c out of the active thins list (and have it be the last entry in the active_thins list) at just the wrong moment which lead to this crash.
Fortunately, the fix here is straight forward. Switch get_first_thin() function to use list_first_or_null_rcu() which performs just a single READ_ONCE() and returns NULL if the list is already empty.
This was run against the devicemapper test suite's thin-provisioning suites for delete and suspend and no regressions were observed.
--- drivers/md/dm-thin.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/md/dm-thin.c +2 -3
@@ -2332,10 +2332,9 @@ static struct thin_c *get_first_thin(strstruct thin_c *tc =NULL ;rcu_read_lock (); -if (!list_empty (&pool->active_thins)) { - tc = list_entry_rcu(pool->active_thins.next, struct thin_c, list); + tc = list_first_or_null_rcu(&pool->active_thins, struct thin_c, list); +if (tc)thin_get (tc); - }rcu_read_unlock ();return tc;
Greg Kroah-Hartman
maintainerPATCH 86/189 scsi: ufs: qcom: Power off the PHY if it was already powered on in ufs_qcom_power_up_sequence()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
commit 7bac65687510038390a0a54cbe14fba08d037e46 upstream.
PHY might already be powered on during ufs_qcom_power_up_sequence() in a couple of cases:
1. During UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH quirk
2. Resuming from spm_lvl = 5 suspend
In those cases, it is necessary to call phy_power_off() and phy_exit() in ufs_qcom_power_up_sequence() function to power off the PHY before calling phy_init() and phy_power_on().
Case (1) is doing it via ufs_qcom_reinit_notify() callback, but case (2) is not handled. So to satisfy both cases, call phy_power_off() and phy_exit() if the phy_count is non-zero. And with this change, the reinit_notify() callback is no longer needed.
This fixes the below UFS resume failure with spm_lvl = 5:
ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: ufshcd_host_reset_and_restore: Host init failed -5 ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: ufshcd_host_reset_and_restore: Host init failed -5 ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: ufshcd_host_reset_and_restore: Host init failed -5 ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: ufshcd_host_reset_and_restore: Host init failed -5 ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: Enabling the controller failed ufshcd-qcom 1d84000.ufshc: ufshcd_host_reset_and_restore: Host init failed -5 ufs_device_wlun 0:0:0:49488: ufshcd_wl_resume failed: -5 ufs_device_wlun 0:0:0:49488: PM: dpm_run_callback(): scsi_bus_resume returns -5 ufs_device_wlun 0:0:0:49488: PM: failed to resume async: error -5
--- drivers/ufs/core/ufshcd-priv.h | 6 ------ drivers/ufs/core/ufshcd.c | 1 - drivers/ufs/host/ufs-qcom.c | 13 +++++-------- include/ufs/ufshcd.h | 2 -- 4 files changed, 5 insertions(+), 17 deletions(-)
drivers/ufs/core/ufshcd-priv.h +0 -6
@@ -237,12 +237,6 @@ static inline void ufshcd_vops_config_sc hba->vops->config_scaling_param (hba, p, data); } -static inline void ufshcd_vops_reinit_notify (struct ufs_hba *hba) -{ -if (hba->vops && hba->vops->reinit_notify) - hba->vops->reinit_notify (hba); -} -static inline int ufshcd_vops_mcq_config_resource (struct ufs_hba *hba) {if (hba->vops && hba->vops->mcq_config_resource)
drivers/ufs/core/ufshcd.c +0 -1
@@ -8881,7 +8881,6 @@ static int ufshcd_probe_hba(struct ufs_hufshcd_device_reset (hba);ufs_put_device_desc (hba);ufshcd_hba_stop (hba); -ufshcd_vops_reinit_notify (hba); ret =ufshcd_hba_enable (hba);if (ret) {dev_err (hba->dev,"Host controller enable failed\n" );
drivers/ufs/host/ufs-qcom.c +5 -8
@@ -368,6 +368,11 @@ static int ufs_qcom_power_up_sequence(stif (ret)return ret; +if (phy->power_count) { +phy_power_off (phy); +phy_exit (phy); + } +/* phy initialization - calibrate the phy */ ret =phy_init (phy);if (ret) {
@@ -1562,13 +1567,6 @@ static void ufs_qcom_config_scaling_para }#endif -static void ufs_qcom_reinit_notify (struct ufs_hba *hba) -{ -struct ufs_qcom_host *host =ufshcd_get_variant (hba); - -phy_power_off (host->generic_phy); -} -/* Resources */ static const struct ufshcd_res_info ufs_res_info[RES_MAX ] = { {.name ="ufs_mem" ,},
@@ -1807,7 +1805,6 @@ static const struct ufs_hba_variant_ops .device_reset = ufs_qcom_device_reset, .config_scaling_param = ufs_qcom_config_scaling_param, .program_key = ufs_qcom_ice_program_key, - .reinit_notify = ufs_qcom_reinit_notify, .mcq_config_resource = ufs_qcom_mcq_config_resource, .get_hba_mac = ufs_qcom_get_hba_mac, .op_runtime_config = ufs_qcom_op_runtime_config,
include/ufs/ufshcd.h +0 -2
@@ -329,7 +329,6 @@ struct ufs_pwr_mode_info {* @program_key: program or evict an inline encryption key * @fill_crypto_prdt: initialize crypto-related fields in the PRDT * @event_notify: called to notify important events -* @reinit_notify: called to notify reinit of UFSHCD during max gear switch * @mcq_config_resource: called to configure MCQ platform resources * @get_hba_mac: reports maximum number of outstanding commands supported by * the controller. Should be implemented for UFSHCI 4.0 or later
@@ -381,7 +380,6 @@ struct ufs_hba_variant_ops { void *prdt, unsigned int num_segments);void (*event_notify)(struct ufs_hba *hba,enum ufs_event_type evt,void *data); -void (*reinit_notify)(struct ufs_hba *);int (*mcq_config_resource)(struct ufs_hba *hba);int (*get_hba_mac)(struct ufs_hba *hba);int (*op_runtime_config)(struct ufs_hba *hba);
Greg Kroah-Hartman
maintainerPATCH 87/189 vfio/pci: Fallback huge faults for unaligned pfn
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit 09dfc8a5f2ce897005a94bf66cca4f91e4e03700 upstream.
The PFN must also be aligned to the fault order to insert a huge pfnmap. Test the alignment and fallback when unaligned.
--- drivers/vfio/pci/vfio_pci_core.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/vfio/pci/vfio_pci_core.c +9 -8
@@ -1661,14 +1661,15 @@ static vm_fault_t vfio_pci_mmap_huge_fauunsigned long pfn, pgoff = vmf->pgoff - vma->vm_pgoff;vm_fault_t ret =VM_FAULT_SIGBUS ; -if (order && (vmf->address & ((PAGE_SIZE << order) -1 ) || + pfn =vma_to_pfn (vma) + pgoff; + +if (order && (pfn & ((1 << order) -1 ) || + vmf->address & ((PAGE_SIZE << order) -1 ) || vmf->address + (PAGE_SIZE << order) > vma->vm_end)) { ret =VM_FAULT_FALLBACK ; goto out; } - pfn =vma_to_pfn (vma); -down_read (&vdev->memory_lock);if (vdev->pm_runtime_engaged || !__vfio_pci_memory_enabled (vdev))
@@ -1676,18 +1677,18 @@ static vm_fault_t vfio_pci_mmap_huge_fauswitch (order) {case 0 : - ret =vmf_insert_pfn (vma, vmf->address, pfn + pgoff); + ret =vmf_insert_pfn (vma, vmf->address, pfn);break ;#ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP case PMD_ORDER : - ret =vmf_insert_pfn_pmd (vmf,__pfn_to_pfn_t (pfn + pgoff, -PFN_DEV ), false); + ret =vmf_insert_pfn_pmd (vmf, +__pfn_to_pfn_t (pfn,PFN_DEV ), false);break ;#endif #ifdef CONFIG_ARCH_SUPPORTS_PUD_PFNMAP case PUD_ORDER : - ret =vmf_insert_pfn_pud (vmf,__pfn_to_pfn_t (pfn + pgoff, -PFN_DEV ), false); + ret =vmf_insert_pfn_pud (vmf, +__pfn_to_pfn_t (pfn,PFN_DEV ), false);break ;#endif default :
Greg Kroah-Hartman
maintainerPATCH 88/189 fs: relax assertions on failure to encode file handles
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 974e3fe0ac61de85015bbe5a4990cf4127b304b2 upstream.
Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons.
The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle.
There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encode_fh() fails. Relax those assertions because they are wrong.
The second linked bug report states commit 16aac5ad1fa9 ("ovl: support encoding non-decodable file handles") in v6.6 as the regressing commit, but this is not accurate.
The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches.
Triggering this assertion was always possible with other filesystems and other reasons of ->encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlayfs that is mounted with options index=on,nfs_export=on also on kernels < v6.6. Therefore, I am not listing the aforementioned commit as a Fixes commit.
Backport hint: this patch will have a trivial conflict applying to v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.
--- fs/notify/fdinfo.c | 4 +--- fs/overlayfs/copy_up.c | 5 ++--- 2 files changed, 3 insertions(+), 6 deletions(-)
fs/notify/fdinfo.c +1 -3
@@ -47,10 +47,8 @@ static void show_mark_fhandle(struct seq size = f->handle_bytes >>2 ; ret =exportfs_encode_fid (inode, (struct fid *)f->f_handle, &size); -if ((ret ==FILEID_INVALID ) || (ret <0 )) { -WARN_ONCE (1 ,"Can't encode file handler for inotify: %d\n" , ret); +if ((ret ==FILEID_INVALID ) || (ret <0 ))return ; - } f->handle_type = ret; f->handle_bytes = size *sizeof (u32);
fs/overlayfs/copy_up.c +2 -3
@@ -444,9 +444,8 @@ struct ovl_fh *ovl_encode_real_fh(struct buflen = (dwords <<2 ); err = -EIO ; -if (WARN_ON (fh_type <0 ) || -WARN_ON (buflen >MAX_HANDLE_SZ ) || -WARN_ON (fh_type ==FILEID_INVALID )) +if (fh_type <0 || fh_type ==FILEID_INVALID || +WARN_ON (buflen >MAX_HANDLE_SZ )) goto out_err; fh->fb.version =OVL_FH_VERSION ;
Greg Kroah-Hartman
maintainerPATCH 89/189 fs: fix is_mnt_ns_file()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit aa21f333c86c8a09d39189de87abb0153d338190 upstream.
Commit 1fa08aece425 ("nsfs: convert to path_from_stashed() helper") reused nsfs dentry's d_fsdata, which no longer contains a pointer to proc_ns_operations.
Fix the remaining use in is_mnt_ns_file().
--- fs/namespace.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/namespace.c +8 -2
@@ -2055,9 +2055,15 @@ SYSCALL_DEFINE1(oldumount, char __user *static bool is_mnt_ns_file (struct dentry *dentry) { +struct ns_common *ns; +/* Is this a proxy for a mount namespace? */ -return dentry->d_op == &ns_dentry_operations && - dentry->d_fsdata == &mntns_operations; +if (dentry->d_op != &ns_dentry_operations) +return false; + + ns =d_inode (dentry)->i_private; + +return ns->ops == &mntns_operations; }struct ns_common *from_mnt_ns (struct mnt_namespace *mnt)
Greg Kroah-Hartman
maintainerPATCH 90/189 dm-ebs: dont set the flag DM_TARGET_PASSES_INTEGRITY
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 47f33c27fc9565fb0bc7dfb76be08d445cd3d236 upstream.
dm-ebs uses dm-bufio to process requests that are not aligned on logical sector size. dm-bufio doesn't support passing integrity data (and it is unclear how should it do it), so we shouldn't set the DM_TARGET_PASSES_INTEGRITY flag.
--- drivers/md/dm-ebs-target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-ebs-target.c +1 -1
@@ -442,7 +442,7 @@ static int ebs_iterate_devices(struct dmstatic struct target_type ebs_target = { .name ="ebs" , .version = {1 ,0 ,1 }, - .features =DM_TARGET_PASSES_INTEGRITY , + .features =0 , .module =THIS_MODULE , .ctr = ebs_ctr, .dtr = ebs_dtr,
Greg Kroah-Hartman
maintainerPATCH 91/189 dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milan Broz <[email protected]>
commit 6df90c02bae468a3a6110bafbc659884d0c4966c upstream.
This patch fixes an issue that was fixed in the commit
df7b59ba9245 ("dm verity: fix FEC for RS roots unaligned to block size")
but later broken again in the commit
8ca7cab82bda ("dm verity fec: fix misaligned RS roots IO")
If the Reed-Solomon roots setting spans multiple blocks, the code does not use proper parity bytes and randomly fails to repair even trivial errors.
This bug cannot happen if the sector size is multiple of RS roots setting (Android case with roots 2).
The previous solution was to find a dm-bufio block size that is multiple of the device sector size and roots size. Unfortunately, the optimization in commit 8ca7cab82bda ("dm verity fec: fix misaligned RS roots IO") is incorrect and uses data block size for some roots (for example, it uses 4096 block size for roots = 20).
This patch uses a different approach:
- It always uses a configured data block size for dm-bufio to avoid possible misaligned IOs.
- and it caches the processed parity bytes, so it can join it if it spans two blocks.
As the RS calculation is called only if an error is detected and the process is computationally intensive, copying a few more bytes should not introduce performance issues.
The issue was reported to cryptsetup with trivial reproducer
https://gitlab.com/cryptsetup/cryptsetup/-/issues/923
Reproducer (with roots=20):
# create verity device with RS FEC
dd if=/dev/urandom of=data.img bs=4096 count=8 status=none
veritysetup format data.img hash.img --fec-device=fec.img --fec-roots=20 | \
awk '/^Root hash/{ print $3 }' >roothash# create an erasure that should always be repairable with this roots setting dd if=/dev/zero of=data.img conv=notrunc bs=1 count=4 seek=4 status=none
# try to read it through dm-verity veritysetup open data.img test hash.img --fec-device=fec.img --fec-roots=20 $(cat roothash) dd if=/dev/mapper/test of=/dev/null bs=4096 status=noxfer
Even now the log says it cannot repair it:
: verity-fec: 7:1: FEC 0: failed to correct: -74 : device-mapper: verity: 7:1: data block 0 is corrupted
...
With this fix, errors are properly repaired.
: verity-fec: 7:1: FEC 0: corrected 4 errors
--- drivers/md/dm-verity-fec.c | 40 ++++++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 14 deletions(-)
drivers/md/dm-verity-fec.c +26 -14
@@ -60,15 +60,19 @@ static int fec_decode_rs8(struct dm_veri* to the data block. Caller is responsible for releasing buf. */ static u8 *fec_read_parity (struct dm_verity *v,u64 rsb,int index, -unsigned int *offset,struct dm_buffer **buf, -unsigned short ioprio) +unsigned int *offset,unsigned int par_buf_offset, +struct dm_buffer **buf,unsigned short ioprio) {u64 position, block, rem;u8 *res; +/* We have already part of parity bytes read, skip to the next block */ +if (par_buf_offset) + index++; + position = (index + rsb) * v->fec->roots; block =div64_u64_rem (position, v->fec->io_size, &rem); - *offset = (unsigned int )rem; + *offset = par_buf_offset ?0 : (unsigned int )rem; res =dm_bufio_read_with_ioprio (v->fec->bufio, block, buf, ioprio);if (IS_ERR (res)) {
@@ -128,11 +132,12 @@ static int fec_decode_bufs(struct dm_ver {int r, corrected =0 , res;struct dm_buffer *buf; -unsigned int n, i, offset; -u8 *par, *block; +unsigned int n, i, offset, par_buf_offset =0 ; +u8 *par, *block, par_buf[DM_VERITY_FEC_RSM -DM_VERITY_FEC_MIN_RSN ];struct bio *bio =dm_bio_from_per_bio_data (io, v->ti->per_io_data_size); - par =fec_read_parity (v, rsb, block_offset, &offset, &buf,bio_prio (bio)); + par =fec_read_parity (v, rsb, block_offset, &offset, + par_buf_offset, &buf,bio_prio (bio));if (IS_ERR (par))return PTR_ERR (par);
@@ -142,7 +147,8 @@ static int fec_decode_bufs(struct dm_ver*/ fec_for_each_buffer_rs_block (fio, n, i) { block =fec_buffer_rs_block (v, fio, n, i); - res =fec_decode_rs8 (v, fio, block, &par[offset], neras); +memcpy (&par_buf[par_buf_offset], &par[offset], v->fec->roots - par_buf_offset); + res =fec_decode_rs8 (v, fio, block, par_buf, neras);if (res <0 ) { r = res; goto error;
@@ -155,12 +161,21 @@ static int fec_decode_bufs(struct dm_verif (block_offset >=1 << v->data_dev_block_bits) goto done; -/* read the next block when we run out of parity bytes */ - offset += v->fec->roots; +/* Read the next block when we run out of parity bytes */ + offset += (v->fec->roots - par_buf_offset); +/* Check if parity bytes are split between blocks */ +if (offset < v->fec->io_size && (offset + v->fec->roots) > v->fec->io_size) { + par_buf_offset = v->fec->io_size - offset; +memcpy (par_buf, &par[offset], par_buf_offset); + offset += par_buf_offset; + }else + par_buf_offset =0 ; +if (offset >= v->fec->io_size) {dm_bufio_release (buf); - par =fec_read_parity (v, rsb, block_offset, &offset, &buf,bio_prio (bio)); + par =fec_read_parity (v, rsb, block_offset, &offset, + par_buf_offset, &buf,bio_prio (bio));if (IS_ERR (par))return PTR_ERR (par); }
@@ -724,10 +739,7 @@ int verity_fec_ctr(struct dm_verity *v)return -E2BIG ; } -if ((f->roots <<SECTOR_SHIFT ) & ((1 << v->data_dev_block_bits) -1 )) - f->io_size =1 << v->data_dev_block_bits; -else - f->io_size = v->fec->roots <<SECTOR_SHIFT ; + f->io_size =1 << v->data_dev_block_bits; f->bufio = dm_bufio_client_create(f->dev->bdev, f->io_size,
Greg Kroah-Hartman
maintainerPATCH 92/189 mptcp: sysctl: avail sched: remove write access
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 771ec78dc8b48d562e6015bb535ed3cd37043d78 upstream.
'net.mptcp.available_schedulers' sysctl knob is there to list available schedulers, not to modify this list.
There are then no reasons to give write access to it.
Nothing would have been written anyway, but no errors would have been returned, which is unexpected.
--- net/mptcp/ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mptcp/ctrl.c +1 -1
@@ -228,7 +228,7 @@ static struct ctl_table mptcp_sysctl_table[] = { { .procname = "available_schedulers", .maxlen = MPTCP_SCHED_BUF_MAX, - .mode = 0644, + .mode = 0444, .proc_handler = proc_available_schedulers, }, {
Signature · 1 line
2.48.0
Greg Kroah-Hartman
maintainerPATCH 93/189 mptcp: sysctl: sched: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit d38e26e36206ae3d544d496513212ae931d1da0a upstream.
Using the 'net' structure via 'current' is not recommended for different reasons.
First, if the goal is to use it to read or write per-netns data, this is inconsistent with how the "generic" sysctl entries are doing: directly by only using pointers set to the table entry, e.g. table->data. Linked to that, the per-netns data should always be obtained from the table linked to the netns it had been created for, which may not coincide with the reader's or writer's netns.
Another reason is that access to current->nsproxy->netns can oops if attempted when current->nsproxy had been dropped when the current task is exiting. This is what syzbot found, when using acct(2):
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 UID: 0 PID: 5924 Comm: syz-executor Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125 Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cc 02 00 00 4d 8b 7c 24 28 48 8d 84 24 c8 00 00 RSP: 0018:ffffc900034774e8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 1ffff9200068ee9e RCX: ffffc90003477620
RDX: 0000000000000005 RSI: ffffffff8b08f91e RDI: 0000000000000028
RBP: 0000000000000001 R08: ffffc90003477710 R09: 0000000000000040
R10: 0000000000000040 R11: 00000000726f7475 R12: 0000000000000000
R13: ffffc90003477620 R14: ffffc90003477710 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fee3cd452d8 CR3: 000000007d116000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
proc_sys_call_handler+0x403/0x5d0 fs/proc/proc_sysctl.c:601
__kernel_write_iter+0x318/0xa80 fs/read_write.c:612
__kernel_write+0xf6/0x140 fs/read_write.c:632
do_acct_process+0xcb0/0x14a0 kernel/acct.c:539
acct_pin_kill+0x2d/0x100 kernel/acct.c:192
pin_kill+0x194/0x7c0 fs/fs_pin.c:44
mnt_pin_kill+0x61/0x1e0 fs/fs_pin.c:81
cleanup_mnt+0x3ac/0x450 fs/namespace.c:1366
task_work_run+0x14e/0x250 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xad8/0x2d70 kernel/exit.c:938
do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
get_signal+0x2576/0x2610 kernel/signal.c:3017
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fee3cb87a6a
Code: Unable to access opcode bytes at 0x7fee3cb87a40.
RSP: 002b:00007fffcccac688 EFLAGS: 00000202 ORIG_RAX: 0000000000000037
RAX: 0000000000000000 RBX: 00007fffcccac710 RCX: 00007fee3cb87a6a
RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007fffcccac6ac R09: 00007fffcccacac7
R10: 00007fffcccac710 R11: 0000000000000202 R12: 00007fee3cd49500
R13: 00007fffcccac6ac R14: 0000000000000000 R15: 00007fee3cd4b000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125
Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cc 02 00 00 4d 8b 7c 24 28 48 8d 84 24 c8 00 00
RSP: 0018:ffffc900034774e8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 1ffff9200068ee9e RCX: ffffc90003477620
RDX: 0000000000000005 RSI: ffffffff8b08f91e RDI: 0000000000000028
RBP: 0000000000000001 R08: ffffc90003477710 R09: 0000000000000040
R10: 0000000000000040 R11: 00000000726f7475 R12: 0000000000000000
R13: ffffc90003477620 R14: ffffc90003477710 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fee3cd452d8 CR3: 000000007d116000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
5: 0f 85 fe 02 00 00 jne 0x309
b: 4d 8b a4 24 08 09 00 mov 0x908(%r12),%r12
12: 00
13: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1a: fc ff df
1d: 49 8d 7c 24 28 lea 0x28(%r12),%rdi
22: 48 89 fa mov %rdi,%rdx
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2d: 0f 85 cc 02 00 00 jne 0x2ff
33: 4d 8b 7c 24 28 mov 0x28(%r12),%r15
38: 48 rex.W
39: 8d .byte 0x8d
3a: 84 24 c8 test %ah,(%rax,%rcx,8)Here with 'net.mptcp.scheduler', the 'net' structure is not really needed, because the table->data already has a pointer to the current scheduler, the only thing needed from the per-netns data. Simply use 'data', instead of getting (most of the time) the same thing, but from a longer and indirect way.
--- net/mptcp/ctrl.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
net/mptcp/ctrl.c +5 -6
@@ -102,16 +102,15 @@ static void mptcp_pernet_set_defaults(st }#ifdef CONFIG_SYSCTL -static int mptcp_set_scheduler (const struct net *net,const char *name) +static int mptcp_set_scheduler (char *scheduler,const char *name) { -struct mptcp_pernet *pernet =mptcp_get_pernet (net);struct mptcp_sched_ops *sched;int ret =0 ;rcu_read_lock (); sched =mptcp_sched_find (name);if (sched) -strscpy (pernet->scheduler, name,MPTCP_SCHED_NAME_MAX ); +strscpy (scheduler, name,MPTCP_SCHED_NAME_MAX );else ret = -ENOENT ;rcu_read_unlock ();
@@ -122,7 +121,7 @@ static int mptcp_set_scheduler(const strstatic int proc_scheduler (const struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -const struct net *net = current->nsproxy->net_ns; +char (*scheduler)[MPTCP_SCHED_NAME_MAX ] = ctl->data;char val[MPTCP_SCHED_NAME_MAX ];struct ctl_table tbl = { .data = val,
@@ -130,11 +129,11 @@ static int proc_scheduler(const struct c };int ret; -strscpy (val,mptcp_get_scheduler (net),MPTCP_SCHED_NAME_MAX ); +strscpy (val, *scheduler,MPTCP_SCHED_NAME_MAX ); ret =proc_dostring (&tbl, write, buffer, lenp, ppos);if (write && ret ==0 ) - ret =mptcp_set_scheduler (net, val); + ret =mptcp_set_scheduler (*scheduler, val);return ret; }
Greg Kroah-Hartman
maintainerPATCH 94/189 mptcp: sysctl: blackhole timeout: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 92cf7a51bdae24a32c592adcdd59a773ae149289 upstream.
As mentioned in the previous commit, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'pernet' structure can be obtained from the table->data using container_of().
--- net/mptcp/ctrl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mptcp/ctrl.c +3 -1
@@ -160,7 +160,9 @@ static int proc_blackhole_detect_timeout(const struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { - struct mptcp_pernet *pernet = mptcp_get_pernet(current->nsproxy->net_ns); + struct mptcp_pernet *pernet = container_of(table->data, + struct mptcp_pernet, + blackhole_timeout);int ret; ret =proc_dointvec_minmax (table, write, buffer, lenp, ppos);
Signature · 1 line
2.48.0
Greg Kroah-Hartman
maintainerPATCH 95/189 sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit ea62dd1383913b5999f3d16ae99d411f41b528d4 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.sctp_hmac_alg' is used.
--- net/sctp/sysctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sysctl.c +2 -1
@@ -387,7 +387,8 @@ static struct ctl_table sctp_net_table[]static int proc_sctp_do_hmac_alg (const struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, + sctp.sctp_hmac_alg);struct ctl_table tbl;bool changed = false;char *none ="none" ;
Greg Kroah-Hartman
maintainerPATCH 96/189 sctp: sysctl: rto_min/max: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 9fc17b76fc70763780aa78b38fcf4742384044a5 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.rto_min/max' is used.
--- net/sctp/sysctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sctp/sysctl.c +2 -2
@@ -433,7 +433,7 @@ static int proc_sctp_do_hmac_alg(const sstatic int proc_sctp_do_rto_min (const struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.rto_min);unsigned int min = *(unsigned int *) ctl->extra1;unsigned int max = *(unsigned int *) ctl->extra2;struct ctl_table tbl;
@@ -461,7 +461,7 @@ static int proc_sctp_do_rto_min(const ststatic int proc_sctp_do_rto_max (const struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.rto_max);unsigned int min = *(unsigned int *) ctl->extra1;unsigned int max = *(unsigned int *) ctl->extra2;struct ctl_table tbl;
Greg Kroah-Hartman
maintainerPATCH 97/189 sctp: sysctl: auth_enable: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 15649fd5415eda664ef35780c2013adeb5d9c695 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
--- net/sctp/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/sysctl.c +1 -1
@@ -499,7 +499,7 @@ static int proc_sctp_do_alpha_beta(conststatic int proc_sctp_do_auth (const struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.auth_enable);struct ctl_table tbl;int new_value, ret;
Greg Kroah-Hartman
maintainerPATCH 98/189 sctp: sysctl: udp_port: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit c10377bbc1972d858eaf0ab366a311b39f8ef1b6 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
--- net/sctp/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/sysctl.c +1 -1
@@ -528,7 +528,7 @@ static int proc_sctp_do_auth(const strucstatic int proc_sctp_do_udp_port (const struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.udp_port);unsigned int min = *(unsigned int *)ctl->extra1;unsigned int max = *(unsigned int *)ctl->extra2;struct ctl_table tbl;
Greg Kroah-Hartman
maintainerPATCH 99/189 sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 6259d2484d0ceff42245d1f09cc8cb6ee72d847a upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.probe_interval' is used.
--- net/sctp/sysctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sysctl.c +2 -1
@@ -569,7 +569,8 @@ static int proc_sctp_do_udp_port(const sstatic int proc_sctp_do_probe_interval (const struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, + sctp.probe_interval);struct ctl_table tbl;int ret, new_value;
Greg Kroah-Hartman
maintainerPATCH 100/189 rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The per-netns structure can be obtained from the table->data using container_of(), then the 'net' one can be retrieved from the listen socket (if available).
--- net/rds/tcp.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-)
net/rds/tcp.c +32 -7
@@ -61,8 +61,10 @@ static atomic_t rds_tcp_unloading = ATOMstatic struct kmem_cache *rds_tcp_conn_slab; -static int rds_tcp_skbuf_handler (const struct ctl_table *ctl,int write, -void *buffer,size_t *lenp,loff_t *fpos); +static int rds_tcp_sndbuf_handler (const struct ctl_table *ctl,int write, +void *buffer,size_t *lenp,loff_t *fpos); +static int rds_tcp_rcvbuf_handler (const struct ctl_table *ctl,int write, +void *buffer,size_t *lenp,loff_t *fpos);static int rds_tcp_min_sndbuf =SOCK_MIN_SNDBUF ;static int rds_tcp_min_rcvbuf =SOCK_MIN_RCVBUF ;
@@ -74,7 +76,7 @@ static struct ctl_table rds_tcp_sysctl_t/* data is per-net pointer */ .maxlen = sizeof(int), .mode = 0644, - .proc_handler = rds_tcp_skbuf_handler, + .proc_handler = rds_tcp_sndbuf_handler, .extra1 = &rds_tcp_min_sndbuf, },#define RDS_TCP_RCVBUF 1
@@ -83,7 +85,7 @@ static struct ctl_table rds_tcp_sysctl_t/* data is per-net pointer */ .maxlen = sizeof(int), .mode = 0644, - .proc_handler = rds_tcp_skbuf_handler, + .proc_handler = rds_tcp_rcvbuf_handler, .extra1 = &rds_tcp_min_rcvbuf, }, };
@@ -682,10 +684,10 @@ static void rds_tcp_sysctl_reset(structspin_unlock_irq (&rds_tcp_conn_lock); } -static int rds_tcp_skbuf_handler (const struct ctl_table *ctl,int write, +static int rds_tcp_skbuf_handler (struct rds_tcp_net *rtn, +const struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *fpos) { -struct net *net = current->nsproxy->net_ns;int err; err =proc_dointvec_minmax (ctl, write, buffer, lenp, fpos);
@@ -694,11 +696,34 @@ static int rds_tcp_skbuf_handler(const s *(int *)(ctl->extra1));return err; } -if (write) + +if (write && rtn->rds_tcp_listen_sock && rtn->rds_tcp_listen_sock->sk) { +struct net *net =sock_net (rtn->rds_tcp_listen_sock->sk); +rds_tcp_sysctl_reset (net); + } +return 0 ; } +static int rds_tcp_sndbuf_handler (const struct ctl_table *ctl,int write, +void *buffer,size_t *lenp,loff_t *fpos) +{ + struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net, + sndbuf_size); + +return rds_tcp_skbuf_handler (rtn, ctl, write, buffer, lenp, fpos); +} + +static int rds_tcp_rcvbuf_handler (const struct ctl_table *ctl,int write, +void *buffer,size_t *lenp,loff_t *fpos) +{ + struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net, + rcvbuf_size); + +return rds_tcp_skbuf_handler (rtn, ctl, write, buffer, lenp, fpos); +} +static void rds_tcp_exit (void ) {rds_tcp_set_unloading ();
Greg Kroah-Hartman
maintainerPATCH 101/189 ksmbd: Implement new SMB3 POSIX type
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit e8580b4c600e085b3c8e6404392de2f822d4c132 upstream.
As SMB3 posix extension specification, Give posix file type to posix mode.
https://www.samba.org/~slow/SMB3_POSIX/fscc_posix_extensions.html#posix-file-type-definition
--- fs/smb/server/smb2pdu.c | 40 ++++++++++++++++++++++++++++++++++++++++ fs/smb/server/smb2pdu.h | 10 ++++++++++ 2 files changed, 50 insertions(+)
fs/smb/server/smb2pdu.c +40 -0
@@ -3988,6 +3988,26 @@ static int smb2_populate_readdir_entry(s posix_info->DeviceId =cpu_to_le32 (ksmbd_kstat->kstat->rdev); posix_info->HardLinks =cpu_to_le32 (ksmbd_kstat->kstat->nlink); posix_info->Mode =cpu_to_le32 (ksmbd_kstat->kstat->mode &0777 ); +switch (ksmbd_kstat->kstat->mode &S_IFMT ) { +case S_IFDIR : + posix_info->Mode |=cpu_to_le32 (POSIX_TYPE_DIR <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFLNK : + posix_info->Mode |=cpu_to_le32 (POSIX_TYPE_SYMLINK <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFCHR : + posix_info->Mode |=cpu_to_le32 (POSIX_TYPE_CHARDEV <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFBLK : + posix_info->Mode |=cpu_to_le32 (POSIX_TYPE_BLKDEV <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFIFO : + posix_info->Mode |=cpu_to_le32 (POSIX_TYPE_FIFO <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFSOCK : + posix_info->Mode |=cpu_to_le32 (POSIX_TYPE_SOCKET <<POSIX_FILETYPE_SHIFT ); + } + posix_info->Inode =cpu_to_le64 (ksmbd_kstat->kstat->ino); posix_info->DosAttributes = S_ISDIR(ksmbd_kstat->kstat->mode) ?
@@ -5176,6 +5196,26 @@ static int find_file_posix_info(struct s file_info->AllocationSize =cpu_to_le64 (stat.blocks <<9 ); file_info->HardLinks =cpu_to_le32 (stat.nlink); file_info->Mode =cpu_to_le32 (stat.mode &0777 ); +switch (stat.mode &S_IFMT ) { +case S_IFDIR : + file_info->Mode |=cpu_to_le32 (POSIX_TYPE_DIR <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFLNK : + file_info->Mode |=cpu_to_le32 (POSIX_TYPE_SYMLINK <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFCHR : + file_info->Mode |=cpu_to_le32 (POSIX_TYPE_CHARDEV <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFBLK : + file_info->Mode |=cpu_to_le32 (POSIX_TYPE_BLKDEV <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFIFO : + file_info->Mode |=cpu_to_le32 (POSIX_TYPE_FIFO <<POSIX_FILETYPE_SHIFT ); +break ; +case S_IFSOCK : + file_info->Mode |=cpu_to_le32 (POSIX_TYPE_SOCKET <<POSIX_FILETYPE_SHIFT ); + } + file_info->DeviceId =cpu_to_le32 (stat.rdev);/*
fs/smb/server/smb2pdu.h +10 -0
@@ -502,4 +502,14 @@ static inline void *smb2_get_msg(void *b return buf + 4; } +#define POSIX_TYPE_FILE 0 +#define POSIX_TYPE_DIR 1 +#define POSIX_TYPE_SYMLINK 2 +#define POSIX_TYPE_CHARDEV 3 +#define POSIX_TYPE_BLKDEV 4 +#define POSIX_TYPE_FIFO 5 +#define POSIX_TYPE_SOCKET 6 + +#define POSIX_FILETYPE_SHIFT 12 +#endif /* _SMB2PDU_H */
Greg Kroah-Hartman
maintainerPATCH 102/189 btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Zaslonko <[email protected]>
commit 0ee4736c003daded513de0ff112d4a1e9c85bbab upstream.
Since the input data length passed to zlib_compress_folios() can be arbitrary, always setting strm.avail_in to a multiple of PAGE_SIZE may cause read-in bytes to exceed the input range. Currently this triggers an assert in btrfs_compress_folios() on the debug kernel (see below). Fix strm.avail_in calculation for S390 hardware acceleration path.
assertion failed: *total_in <= orig_len, in fs/btrfs/compression.c:1041
------------[ cut here ]------------
kernel BUG at fs/btrfs/compression.c:1041!
monitor event: 0040 ilc:2 [#1] PREEMPT SMP
CPU: 16 UID: 0 PID: 325 Comm: kworker/u273:3 Not tainted 6.13.0-20241204.rc1.git6.fae3b21430ca.300.fc41.s390x+debug #1
Hardware name: IBM 3931 A01 703 (z/VM 7.4.0)
Workqueue: btrfs-delalloc btrfs_work_helper
Krnl PSW : 0704d00180000000 0000021761df6538 (btrfs_compress_folios+0x198/0x1a0)
R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
Krnl GPRS: 0000000080000000 0000000000000001 0000000000000047 0000000000000000
0000000000000006 ffffff01757bb000 000001976232fcc0 000000000000130c
000001976232fcd0 000001976232fcc8 00000118ff4a0e30 0000000000000001
00000111821ab400 0000011100000000 0000021761df6534 000001976232fb58
Krnl Code: 0000021761df6528: c020006f5ef4 larl %r2,0000021762be2310
0000021761df652e: c0e5ffbd09d5 brasl %r14,00000217615978d8
#0000021761df6534: af000000 mc 0,0
>0000021761df6538: 0707 bcr 0,%r7
0000021761df653a: 0707 bcr 0,%r7
0000021761df653c: 0707 bcr 0,%r7
0000021761df653e: 0707 bcr 0,%r7
0000021761df6540: c004004bb7ec brcl 0,000002176276d518
Call Trace:
[<0000021761df6538>] btrfs_compress_folios+0x198/0x1a0
([<0000021761df6534>] btrfs_compress_folios+0x194/0x1a0)
[<0000021761d97788>] compress_file_range+0x3b8/0x6d0
[<0000021761dcee7c>] btrfs_work_helper+0x10c/0x160
[<0000021761645760>] process_one_work+0x2b0/0x5d0
[<000002176164637e>] worker_thread+0x20e/0x3e0
[<000002176165221a>] kthread+0x15a/0x170
[<00000217615b859c>] __ret_from_fork+0x3c/0x60
[<00000217626e72d2>] ret_from_fork+0xa/0x38
INFO: lockdep is turned off.
Last Breaking-Event-Address:
[<0000021761597924>] _printk+0x4c/0x58
Kernel panic - not syncing: Fatal exception: panic_on_oops--- fs/btrfs/zlib.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/zlib.c +2 -2
@@ -174,10 +174,10 @@ int zlib_compress_folios(struct list_head *ws, struct address_space *mapping,copy_page (workspace->buf + i *PAGE_SIZE , data_in); start +=PAGE_SIZE ; - workspace->strm.avail_in = - (in_buf_folios <<PAGE_SHIFT ); } workspace->strm.next_in = workspace->buf; + workspace->strm.avail_in =min (bytes_left, + in_buf_folios <<PAGE_SHIFT ); }else {unsigned int pg_off;unsigned int cur_len;
Signature · 1 line
2.48.0
Greg Kroah-Hartman
maintainerPATCH 103/189 Revert "drm/mediatek: dsi: Correct calculation formula of PHY Timing"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chun-Kuang Hu <[email protected]>
commit d08555758fb1dbfb48f0cb58176fdc98009e6070 upstream.
This reverts commit 417d8c47271d5cf1a705e997065873b2a9a36fd4.
With that patch the panel in the Tentacruel ASUS Chromebook CM14 (CM1402F) flickers. There are 1 or 2 times per second a black panel. Stable Kernel 6.11.5 and mainline 6.12-rc4 works only when reverse that patch.
--- drivers/gpu/drm/mediatek/mtk_dsi.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-)
drivers/gpu/drm/mediatek/mtk_dsi.c +13 -14
@@ -248,23 +248,22 @@ static void mtk_dsi_phy_timconfig(structu32 data_rate_mhz =DIV_ROUND_UP (dsi->data_rate,HZ_PER_MHZ );struct mtk_phy_timing *timing = &dsi->phy_timing; - timing->lpx = (80 * data_rate_mhz / (8 *1000 )) +1 ; - timing->da_hs_prepare = (59 * data_rate_mhz +4 *1000 ) /8000 +1 ; - timing->da_hs_zero = (163 * data_rate_mhz +11 *1000 ) /8000 +1 - + timing->lpx = (60 * data_rate_mhz / (8 *1000 )) +1 ; + timing->da_hs_prepare = (80 * data_rate_mhz +4 *1000 ) /8000 ; + timing->da_hs_zero = (170 * data_rate_mhz +10 *1000 ) /8000 +1 - timing->da_hs_prepare; - timing->da_hs_trail = (78 * data_rate_mhz +7 *1000 ) /8000 +1 ; + timing->da_hs_trail = timing->da_hs_prepare +1 ; - timing->ta_go =4 * timing->lpx; - timing->ta_sure =3 * timing->lpx /2 ; - timing->ta_get =5 * timing->lpx; - timing->da_hs_exit = (118 * data_rate_mhz / (8 *1000 )) +1 ; + timing->ta_go =4 * timing->lpx -2 ; + timing->ta_sure = timing->lpx +2 ; + timing->ta_get =4 * timing->lpx; + timing->da_hs_exit =2 * timing->lpx +1 ; - timing->clk_hs_prepare = (57 * data_rate_mhz / (8 *1000 )) +1 ; - timing->clk_hs_post = (65 * data_rate_mhz +53 *1000 ) /8000 +1 ; - timing->clk_hs_trail = (78 * data_rate_mhz +7 *1000 ) /8000 +1 ; - timing->clk_hs_zero = (330 * data_rate_mhz / (8 *1000 )) +1 - - timing->clk_hs_prepare; - timing->clk_hs_exit = (118 * data_rate_mhz / (8 *1000 )) +1 ; + timing->clk_hs_prepare =70 * data_rate_mhz / (8 *1000 ); + timing->clk_hs_post = timing->clk_hs_prepare +8 ; + timing->clk_hs_trail = timing->clk_hs_prepare; + timing->clk_hs_zero = timing->clk_hs_trail *4 ; + timing->clk_hs_exit =2 * timing->clk_hs_trail; timcon0 =FIELD_PREP (LPX , timing->lpx) | FIELD_PREP(HS_PREP, timing->da_hs_prepare) |
Greg Kroah-Hartman
maintainerPATCH 104/189 drm/amd/display: Remove unnecessary amdgpu_irq_get/put
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
commit 5009628d8509dbb90e1b88e01eda00430fa24b4b upstream.
[WHY & HOW]
commit 7fb363c57522 ("drm/amd/display: Let drm_crtc_vblank_on/off manage interrupts") lets drm_crtc_vblank_* to manage interrupts in amdgpu_dm_crtc_set_vblank, and amdgpu_irq_get/put do not need to be called here. Part of that patch got lost somehow, so fix it up.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 31 ---------------------- 1 file changed, 31 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +0 -31
@@ -8393,16 +8393,6 @@ static void manage_dm_interrupts(structstruct amdgpu_crtc *acrtc, struct dm_crtc_state *acrtc_state) { -/* -* We have no guarantee that the frontend index maps to the same -* backend index - some even map to more than one. -* -* TODO: Use a different interrupt or check DC itself for the mapping. -*/ -int irq_type = -amdgpu_display_crtc_idx_to_irq_type ( - adev, - acrtc->crtc_id); struct drm_vblank_crtc_config config = {0};struct dc_crtc_timing *timing;int offdelay;
@@ -8428,28 +8418,7 @@ static void manage_dm_interrupts(structdrm_crtc_vblank_on_config (&acrtc->base, &config); - -amdgpu_irq_get ( - adev, - &adev->pageflip_irq, - irq_type); -#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY ) -amdgpu_irq_get ( - adev, - &adev->vline0_irq, - irq_type); -#endif }else { -#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY ) -amdgpu_irq_put ( - adev, - &adev->vline0_irq, - irq_type); -#endif -amdgpu_irq_put ( - adev, - &adev->pageflip_irq, - irq_type);drm_crtc_vblank_off (&acrtc->base); } }
Greg Kroah-Hartman
maintainerPATCH 105/189 drm/amd/display: Add check for granularity in dml ceil/floor helpers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Li <[email protected]>
commit 0881fbc4fd62e00a2b8e102725f76d10351b2ea8 upstream.
[Why]
Wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert and divide-by-zero error in dcn_bw_ functions.
[How]
Add check for granularity 0.
--- drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h +8 -0
@@ -66,11 +66,15 @@ static inline double dml_max5(double a,static inline double dml_ceil (double a,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_ceil2 (a, granularity); }static inline double dml_floor (double a,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_floor2 (a, granularity); }
@@ -114,11 +118,15 @@ static inline double dml_ceil_2(double fstatic inline double dml_ceil_ex (double x,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_ceil2 (x, granularity); }static inline double dml_floor_ex (double x,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_floor2 (x, granularity); }
Greg Kroah-Hartman
maintainerPATCH 106/189 cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
[ Upstream commit 9b496a8bbed9cc292b0dfd796f38ec58b6d0375f ]
Isolated CPUs are not allowed to be used in a non-isolated partition. The only exception is the top cpuset which is allowed to contain boot time isolated CPUs.
Commit ccac8e8de99c ("cgroup/cpuset: Fix remote root partition creation problem") introduces a simplified scheme of including only partition roots in sched domain generation. However, it does not properly account for this exception case. This can result in leakage of isolated CPUs into a sched domain.
Fix it by making sure that isolated CPUs are excluded from the top cpuset before generating sched domains.
Also update the way the boot time isolated CPUs are handled in test_cpuset_prs.sh to make sure that those isolated CPUs are really isolated instead of just skipping them in the tests.
--- kernel/cgroup/cpuset.c | 10 +++++- .../selftests/cgroup/test_cpuset_prs.sh | 33 +++++++++++-------- 2 files changed, 28 insertions(+), 15 deletions(-)
kernel/cgroup/cpuset.c +9 -1
@@ -862,7 +862,15 @@ static int generate_sched_domains(cpumask_var_t **domains,*/ if (cgrpv2) {for (i =0 ; i < ndoms; i++) { -cpumask_copy (doms[i], csa[i]->effective_cpus); +/* +* The top cpuset may contain some boot time isolated +* CPUs that need to be excluded from the sched domain. +*/ +if (csa[i] == &top_cpuset) +cpumask_and (doms[i], csa[i]->effective_cpus, +housekeeping_cpumask (HK_TYPE_DOMAIN )); +else +cpumask_copy (doms[i], csa[i]->effective_cpus);if (dattr) dattr[i] =SD_ATTR_INIT ; }
tools/testing/selftests/cgroup/test_cpuset_prs.sh +19 -14
@@ -86,15 +86,15 @@ echo "" > test/cpuset.cpus # # If isolated CPUs have been reserved at boot time (as shown in -# cpuset.cpus.isolated), these isolated CPUs should be outside of CPUs 0-7 +# cpuset.cpus.isolated), these isolated CPUs should be outside of CPUs 0-8 # that will be used by this script for testing purpose. If not, some of -# the tests may fail incorrectly. These isolated CPUs will also be removed -# before being compared with the expected results. +# the tests may fail incorrectly. These pre-isolated CPUs should stay in +# an isolated state throughout the testing process for now. # BOOT_ISOLCPUS=$(cat $CGROUP2/cpuset.cpus.isolated) if [[ -n "$BOOT_ISOLCPUS" ]] then - [[ $(echo $BOOT_ISOLCPUS | sed -e "s/[,-].*//") -le 7 ]] && + [[ $(echo $BOOT_ISOLCPUS | sed -e "s/[,-].*//") -le 8 ]] && skip_test "Pre-isolated CPUs ($BOOT_ISOLCPUS) overlap CPUs to be tested" echo "Pre-isolated CPUs: $BOOT_ISOLCPUS" fi
@@ -683,15 +683,19 @@ check_isolcpus() EXPECT_VAL2=$EXPECT_VAL fi + # + # Appending pre-isolated CPUs + # Even though CPU #8 isn't used for testing, it can't be pre-isolated + # to make appending those CPUs easier. + # + [[ -n "$BOOT_ISOLCPUS" ]] && { + EXPECT_VAL=${EXPECT_VAL:+${EXPECT_VAL},}${BOOT_ISOLCPUS} + EXPECT_VAL2=${EXPECT_VAL2:+${EXPECT_VAL2},}${BOOT_ISOLCPUS} + } + # # Check cpuset.cpus.isolated cpumask # - if [[ -z "$BOOT_ISOLCPUS" ]] - then - ISOLCPUS=$(cat $ISCPUS) - else - ISOLCPUS=$(cat $ISCPUS | sed -e "s/,*$BOOT_ISOLCPUS//") - fi [[ "$EXPECT_VAL2" != "$ISOLCPUS" ]] && { # Take a 50ms pause and try again pause 0.05
@@ -731,8 +735,6 @@ check_isolcpus() fi done [[ "$ISOLCPUS" = *- ]] && ISOLCPUS=${ISOLCPUS}$LASTISOLCPU - [[ -n "BOOT_ISOLCPUS" ]] && - ISOLCPUS=$(echo $ISOLCPUS | sed -e "s/,*$BOOT_ISOLCPUS//") [[ "$EXPECT_VAL" = "$ISOLCPUS" ]] }
@@ -836,8 +838,11 @@ run_state_test() # if available [[ -n "$ICPUS" ]] && { check_isolcpus $ICPUS - [[ $? -ne 0 ]] && test_fail $I "isolated CPU" \ - "Expect $ICPUS, get $ISOLCPUS instead" + [[ $? -ne 0 ]] && { + [[ -n "$BOOT_ISOLCPUS" ]] && ICPUS=${ICPUS},${BOOT_ISOLCPUS} + test_fail $I "isolated CPU" \ + "Expect $ICPUS, get $ISOLCPUS instead" + } } reset_cgroup_states #
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/189 thermal: of: fix OF node leak in of_thermal_zone_find()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit 9164e0912af206a72ddac4915f7784e470a04ace ]
of_thermal_zone_find() calls of_parse_phandle_with_args(), but does not release the OF node reference obtained by it.
Add a of_node_put() call when the call is successful.
--- drivers/thermal/thermal_of.c | 1 + 1 file changed, 1 insertion(+)
drivers/thermal/thermal_of.c +1 -0
@@ -176,6 +176,7 @@ static struct device_node *of_thermal_zone_find(struct device_node *sensor, int goto out; } +of_node_put (sensor_specs.np);if ((sensor == sensor_specs.np) && id == (sensor_specs.args_count ? sensor_specs.args[0 ] :0 )) {pr_debug ("sensor %pOFn id=%d belongs to %pOFn\n" , sensor, id, child);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/189 sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Changwoo Min <[email protected]>
[ Upstream commit 6268d5bc10354fc2ab8d44a0cd3b042d49a0417e ]
scx_ops_bypass() iterates all CPUs to re-enqueue all the scx tasks. For each CPU, it acquires a lock using rq_lock() regardless of whether a CPU is offline or the CPU is currently running a task in a higher scheduler class (e.g., deadline). The rq_lock() is supposed to be used for online CPUs, and the use of rq_lock() may trigger an unnecessary warning in rq_pin_lock(). Therefore, replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass().
Without this change, we observe the following warning:
===== START =====
[ 6.615205] rq->balance_callback && rq->balance_callback != &balance_push_callback [ 6.615208] WARNING: CPU: 2 PID: 0 at kernel/sched/sched.h:1730 __schedule+0x1130/0x1c90
===== END =====
--- kernel/sched/ext.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
kernel/sched/ext.c +6 -6
@@ -4348,10 +4348,9 @@ static void scx_ops_bypass(bool bypass)*/ for_each_possible_cpu (cpu) {struct rq *rq =cpu_rq (cpu); -struct rq_flags rf;struct task_struct *p, *n; -rq_lock (rq, &rf); +raw_spin_rq_lock (rq);if (bypass) {WARN_ON_ONCE (rq->scx.flags &SCX_RQ_BYPASSING );
@@ -4367,7 +4366,7 @@ static void scx_ops_bypass(bool bypass)* sees scx_rq_bypassing() before moving tasks to SCX. */ if (!scx_enabled ()) { -rq_unlock (rq, &rf); +raw_spin_rq_unlock (rq);continue ; }
@@ -4387,10 +4386,11 @@ static void scx_ops_bypass(bool bypass)sched_enq_and_set_task (&ctx); } -rq_unlock (rq, &rf); -/* resched to restore ticks and idle state */ -resched_cpu (cpu); +if (cpu_online (cpu) || cpu ==smp_processor_id ()) +resched_curr (rq); + +raw_spin_rq_unlock (rq); } unlock:raw_spin_unlock_irqrestore (&__scx_ops_bypass_lock, flags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/189 sched_ext: switch class when preempted by higher priority scheduler
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honglei Wang <[email protected]>
[ Upstream commit 68e449d849fd50bd5e61d8bd32b3458dbd3a3df6 ]
ops.cpu_release() function, if defined, must be invoked when preempted by a higher priority scheduler class task. This scenario was skipped in commit f422316d7466 ("sched_ext: Remove switch_class_scx()"). Let's fix it.
--- kernel/sched/ext.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/sched/ext.c +2 -1
@@ -2917,7 +2917,7 @@ static void put_prev_task_scx(struct rq *rq, struct task_struct *p,*/ if (p->scx.slice && !scx_rq_bypassing (rq)) {dispatch_enqueue (&rq->scx.local_dsq, p,SCX_ENQ_HEAD ); -return ; + goto switch_class; }/*
@@ -2934,6 +2934,7 @@ static void put_prev_task_scx(struct rq *rq, struct task_struct *p, } } +switch_class:if (next && next->sched_class != &ext_sched_class)switch_class (rq, next); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/189 cgroup/cpuset: remove kernfs active break
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit 3cb97a927fffe443e1e7e8eddbfebfdb062e86ed ]
A warning was found:
WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140
It can be explained by:
rmdir echo 1 > cpuset.cpus
kernfs_fop_write_iter // active=0cgroup_rm_filekernfs_remove_by_name_ns kernfs_get_active // active=1__kernfs_remove // active=0x80000002kernfs_drain cpuset_write_resmaskwait_event
//waiting (active == 0x80000001)
kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002
...kernfs_should_drain_open_files
// warning occurs
kernfs_put_active
This warning is caused by 'kernfs_break_active_protection' when it is writing to cpuset.cpus, and the cgroup is removed concurrently.
The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroup_mutex inside get_online_cpus()") made cpuset_hotplug_workfn asynchronous, This change involves calling flush_work(), which can create a multiple processes circular locking dependency that involve cgroup_mutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpuset_write_resmask()") added 'kernfs_break_active_protection' in the cpuset_write_resmask. This could lead to this warning.
After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset_write_resmask no longer needs to wait the hotplug to finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning, just remove kernfs_break_active_protection operation in the 'cpuset_write_resmask'.
--- kernel/cgroup/cpuset.c | 25 ------------------------- 1 file changed, 25 deletions(-)
kernel/cgroup/cpuset.c +0 -25
@@ -3110,29 +3110,6 @@ ssize_t cpuset_write_resmask(struct kernfs_open_file *of,int retval = -ENODEV ; buf =strstrip (buf); - -/* -* CPU or memory hotunplug may leave @cs w/o any execution -* resources, in which case the hotplug code asynchronously updates -* configuration and transfers all tasks to the nearest ancestor -* which can execute. -* -* As writes to "cpus" or "mems" may restore @cs's execution -* resources, wait for the previously scheduled operations before -* proceeding, so that we don't end up keep removing tasks added -* after execution capability is restored. -* -* cpuset_handle_hotplug may call back into cgroup core asynchronously -* via cgroup_transfer_tasks() and waiting for it from a cgroupfs -* operation like this one can lead to a deadlock through kernfs -* active_ref protection. Let's break the protection. Losing the -* protection is okay as we check whether @cs is online after -* grabbing cpuset_mutex anyway. This only happens on the legacy -* hierarchies. -*/ -css_get (&cs->css); -kernfs_break_active_protection (of->kn); -cpus_read_lock ();mutex_lock (&cpuset_mutex);if (!is_cpuset_online (cs))
@@ -3163,8 +3140,6 @@ ssize_t cpuset_write_resmask(struct kernfs_open_file *of, out_unlock:mutex_unlock (&cpuset_mutex);cpus_read_unlock (); -kernfs_unbreak_active_protection (of->kn); -css_put (&cs->css);flush_workqueue (cpuset_migrate_mm_wq);return retval ?: nbytes; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/189 sched_ext: idle: Refresh idle masks during idle-to-idle transitions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <[email protected]>
[ Upstream commit a2a3374c47c428c0edb0bbc693638d4783f81e31 ]
With the consolidation of put_prev_task/set_next_task(), see commit 436f3eed5c69 ("sched: Combine the last put_prev_task() and the first set_next_task()"), we are now skipping the transition between these two functions when the previous and the next tasks are the same.
As a result, the scx idle state of a CPU is updated only when transitioning to or from the idle thread. While this is generally correct, it can lead to uneven and inefficient core utilization in certain scenarios [1].
A typical scenario involves proactive wake-ups: scx_bpf_pick_idle_cpu() selects and marks an idle CPU as busy, followed by a wake-up via scx_bpf_kick_cpu(), without dispatching any tasks. In this case, the CPU continues running the idle thread, returns to idle, but remains marked as busy, preventing it from being selected again as an idle CPU (until a task eventually runs on it and releases the CPU).
For example, running a workload that uses 20% of each CPU, combined with an scx scheduler using proactive wake-ups, results in the following core utilization:
CPU 0: 25.7%
CPU 1: 29.3%
CPU 2: 26.5%
CPU 3: 25.5%
CPU 4: 0.0%
CPU 5: 25.5%
CPU 6: 0.0%
CPU 7: 10.5%
To address this, refresh the idle state also in pick_task_idle(), during idle-to-idle transitions, but only trigger ops.update_idle() on actual state changes to prevent unnecessary updates to the scx scheduler and maintain balanced state transitions.
With this change in place, the core utilization in the previous example becomes the following:
CPU 0: 18.8%
CPU 1: 19.4%
CPU 2: 18.0%
CPU 3: 18.7%
CPU 4: 19.3%
CPU 5: 18.9%
CPU 6: 18.7%
CPU 7: 19.3%
[1] https://github.com/sched-ext/scx/pull/1139
--- kernel/sched/ext.c | 61 ++++++++++++++++++++++++++++++++++++++------- kernel/sched/ext.h | 8 +++--- kernel/sched/idle.c | 5 ++-- 3 files changed, 59 insertions(+), 15 deletions(-)
kernel/sched/ext.c +52 -9
@@ -3240,16 +3240,8 @@ static void reset_idle_masks(void)cpumask_copy (idle_masks.smt, cpu_online_mask); } -void __scx_update_idle (struct rq *rq,bool idle) +static void update_builtin_idle (int cpu,bool idle) { -int cpu =cpu_of (rq); - -if (SCX_HAS_OP (update_idle) && !scx_rq_bypassing (rq)) { -SCX_CALL_OP (SCX_KF_REST , update_idle,cpu_of (rq), idle); -if (!static_branch_unlikely (&scx_builtin_idle_enabled)) -return ; - } -if (idle)cpumask_set_cpu (cpu, idle_masks.cpu);else
@@ -3276,6 +3268,57 @@ void __scx_update_idle(struct rq *rq, bool idle)#endif } +/* +* Update the idle state of a CPU to @idle. +* +* If @do_notify is true, ops.update_idle() is invoked to notify the scx +* scheduler of an actual idle state transition (idle to busy or vice +* versa). If @do_notify is false, only the idle state in the idle masks is +* refreshed without invoking ops.update_idle(). +* +* This distinction is necessary, because an idle CPU can be "reserved" and +* awakened via scx_bpf_pick_idle_cpu() + scx_bpf_kick_cpu(), marking it as +* busy even if no tasks are dispatched. In this case, the CPU may return +* to idle without a true state transition. Refreshing the idle masks +* without invoking ops.update_idle() ensures accurate idle state tracking +* while avoiding unnecessary updates and maintaining balanced state +* transitions. +*/ +void __scx_update_idle (struct rq *rq,bool idle,bool do_notify) +{ +int cpu =cpu_of (rq); + +lockdep_assert_rq_held (rq); + +/* +* Trigger ops.update_idle() only when transitioning from a task to +* the idle thread and vice versa. +* +* Idle transitions are indicated by do_notify being set to true, +* managed by put_prev_task_idle()/set_next_task_idle(). +*/ +if (SCX_HAS_OP (update_idle) && do_notify && !scx_rq_bypassing (rq)) +SCX_CALL_OP (SCX_KF_REST , update_idle,cpu_of (rq), idle); + +/* +* Update the idle masks: +* - for real idle transitions (do_notify == true) +* - for idle-to-idle transitions (indicated by the previous task +* being the idle thread, managed by pick_task_idle()) +* +* Skip updating idle masks if the previous task is not the idle +* thread, since set_next_task_idle() has already handled it when +* transitioning from a task to the idle thread (calling this +* function with do_notify == true). +* +* In this way we can avoid updating the idle masks twice, +* unnecessarily. +*/ +if (static_branch_likely (&scx_builtin_idle_enabled)) +if (do_notify ||is_idle_task (rq->curr)) +update_builtin_idle (cpu, idle); +} +static void handle_hotplug (struct rq *rq,bool online) {int cpu =cpu_of (rq);
kernel/sched/ext.h +4 -4
@@ -57,15 +57,15 @@ static inline void init_sched_ext_class(void) {}#endif /* CONFIG_SCHED_CLASS_EXT */ #if defined(CONFIG_SCHED_CLASS_EXT ) && defined(CONFIG_SMP ) -void __scx_update_idle (struct rq *rq,bool idle); +void __scx_update_idle (struct rq *rq,bool idle,bool do_notify); -static inline void scx_update_idle (struct rq *rq,bool idle) +static inline void scx_update_idle (struct rq *rq,bool idle,bool do_notify) {if (scx_enabled ()) -__scx_update_idle (rq, idle); +__scx_update_idle (rq, idle, do_notify); }#else -static inline void scx_update_idle (struct rq *rq,bool idle) {} +static inline void scx_update_idle (struct rq *rq,bool idle,bool do_notify) {}#endif #ifdef CONFIG_CGROUP_SCHED
kernel/sched/idle.c +3 -2
@@ -453,19 +453,20 @@ static void wakeup_preempt_idle(struct rq *rq, struct task_struct *p, int flags)static void put_prev_task_idle (struct rq *rq,struct task_struct *prev,struct task_struct *next) {dl_server_update_idle_time (rq, prev); -scx_update_idle (rq, false); +scx_update_idle (rq, false, true); }static void set_next_task_idle (struct rq *rq,struct task_struct *next,bool first) {update_idle_core (rq); -scx_update_idle (rq, true); +scx_update_idle (rq, true, true);schedstat_inc (rq->sched_goidle); next->se.exec_start =rq_clock_task (rq); }struct task_struct *pick_task_idle (struct rq *rq) { +scx_update_idle (rq, true, false);return rq->idle; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/189 arm64: dts: qcom: x1e80100: Fix up BAR space size for PCIe6a
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Yu <[email protected]>
commit fb8e7b33c2174e00dfa411361eeed21eeaf3634b upstream.
As per memory map table, the region for PCIe6a is 64MByte. Hence, set the size of 32 bit non-prefetchable memory region beginning on address 0x70300000 as 0x3d00000 so that BAR space assigned to BAR registers can be allocated from 0x70300000 to 0x74000000.
--- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/x1e80100.dtsi +1 -1
@@ -2925,7 +2925,7 @@ #address-cells = <3>; #size-cells = <2>; ranges = <0x01000000 0x0 0x00000000 0x0 0x70200000 0x0 0x100000>, - <0x02000000 0x0 0x70300000 0x0 0x70300000 0x0 0x1d00000>; + <0x02000000 0x0 0x70300000 0x0 0x70300000 0x0 0x3d00000>; bus-range = <0x00 0xff>; dma-coherent;
Greg Kroah-Hartman
maintainerPATCH 113/189 arm64: dts: qcom: sa8775p: Fix the size of addr_space regions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
commit e60b14f47d779edc38bc1f14d2c995d477cec6f9 upstream.
For both the controller instances, size of the 'addr_space' region should be 0x1fe00000 as per the hardware memory layout.
Otherwise, endpoint drivers cannot request even reasonable BAR size of 1MB.
--- arch/arm64/boot/dts/qcom/sa8775p.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/sa8775p.dtsi +2 -2
@@ -5587,7 +5587,7 @@ <0x0 0x40000000 0x0 0xf20>, <0x0 0x40000f20 0x0 0xa8>, <0x0 0x40001000 0x0 0x4000>, - <0x0 0x40200000 0x0 0x100000>, + <0x0 0x40200000 0x0 0x1fe00000>, <0x0 0x01c03000 0x0 0x1000>, <0x0 0x40005000 0x0 0x2000>; reg-names = "parf", "dbi", "elbi", "atu", "addr_space",
@@ -5744,7 +5744,7 @@ <0x0 0x60000000 0x0 0xf20>, <0x0 0x60000f20 0x0 0xa8>, <0x0 0x60001000 0x0 0x4000>, - <0x0 0x60200000 0x0 0x100000>, + <0x0 0x60200000 0x0 0x1fe00000>, <0x0 0x01c13000 0x0 0x1000>, <0x0 0x60005000 0x0 0x2000>; reg-names = "parf", "dbi", "elbi", "atu", "addr_space",
Greg Kroah-Hartman
maintainerPATCH 114/189 smb: client: sync the root session and superblock context passwords before automounting
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meetakshi Setiya <[email protected]>
commit 20b1aa912316ffb7fbb5f407f17c330f2a22ddff upstream.
In some cases, when password2 becomes the working password, the client swaps the two password fields in the root session struct, but not in the smb3_fs_context struct in cifs_sb. DFS automounts inherit fs context from their parent mounts. Therefore, they might end up getting the passwords in the stale order.
The automount should succeed, because the mount function will end up retrying with the actual password anyway. But to reduce these unnecessary session setup retries for automounts, we can sync the parent context's passwords with the root session's passwords before duplicating it to the child's fs context.
--- fs/smb/client/namespace.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
fs/smb/client/namespace.c +18 -1
@@ -196,11 +196,28 @@ static struct vfsmount *cifs_do_automounstruct smb3_fs_context tmp;char *full_path;struct vfsmount *mnt; +struct cifs_sb_info *mntpt_sb; +struct cifs_ses *ses;if (IS_ROOT (mntpt))return ERR_PTR (-ESTALE ); - cur_ctx =CIFS_SB (mntpt->d_sb)->ctx; + mntpt_sb =CIFS_SB (mntpt->d_sb); + ses =cifs_sb_master_tcon (mntpt_sb)->ses; + cur_ctx = mntpt_sb->ctx; + +/* +* At this point, the root session should be in the mntpt sb. We should +* bring the sb context passwords in sync with the root session's +* passwords. This would help prevent unnecessary retries and password +* swaps for automounts. +*/ +mutex_lock (&ses->session_mutex); + rc =smb3_sync_session_ctx_passwords (mntpt_sb, ses); +mutex_unlock (&ses->session_mutex); + +if (rc) +return ERR_PTR (rc); fc =fs_context_for_submount (path->mnt->mnt_sb->s_type, mntpt);if (IS_ERR (fc))
Greg Kroah-Hartman
maintainerPATCH 115/189 fs: kill MNT_ONRB
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
commit 344bac8f0d73fe970cd9f5b2f132906317d29e8b upstream.
Move mnt->mnt_node into the union with mnt->mnt_rcu and mnt->mnt_llist instead of keeping it with mnt->mnt_list. This allows us to use RB_CLEAR_NODE(&mnt->mnt_node) in umount_tree() as well as list_empty(&mnt->mnt_node). That in turn allows us to remove MNT_ONRB.
This also fixes the bug reported in [1] where seemingly MNT_ONRB wasn't set in @mnt->mnt_flags even though the mount was present in the mount rbtree of the mount namespace.
The root cause is the following race. When a btrfs subvolume is mounted a temporary mount is created:
btrfs_get_tree_subvol()
{
mnt = fc_mount()
// Register the newly allocated mount with sb->mounts:
lock_mount_hash();
list_add_tail(&mnt->mnt_instance, &mnt->mnt.mnt_sb->s_mounts);
unlock_mount_hash();
}and registered on sb->s_mounts. Later it is added to an anonymous mount namespace via mount_subvol():
-> mount_subvol()
-> mount_subtree()
-> alloc_mnt_ns()
mnt_add_to_ns()
vfs_path_lookup()
put_mnt_ns()The mnt_add_to_ns() call raises MNT_ONRB in @mnt->mnt_flags. If someone concurrently does a ro remount:
reconfigure_super()
-> sb_prepare_remount_readonly()
{
list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {}
all mounts registered in sb->s_mounts are visited and first MNT_WRITE_HOLD is raised, then MNT_READONLY is raised, and finally MNT_WRITE_HOLD is removed again.
The flag modification for MNT_WRITE_HOLD/MNT_READONLY and MNT_ONRB race so MNT_ONRB might be lost.
--- fs/mount.h | 15 +++++++++------ fs/namespace.c | 14 ++++++-------- include/linux/mount.h | 3 +-- 3 files changed, 16 insertions(+), 16 deletions(-)
fs/mount.h +9 -6
@@ -38,6 +38,7 @@ struct mount {struct dentry *mnt_mountpoint;struct vfsmount mnt;union { +struct rb_node mnt_node;/* node in the ns->mounts rbtree */ struct rcu_head mnt_rcu;struct llist_node mnt_llist; };
@@ -51,10 +52,7 @@ struct mount {struct list_head mnt_child;/* and going through their mnt_child */ struct list_head mnt_instance;/* mount instance on sb->s_mounts */ const char *mnt_devname;/* Name of device e.g. /dev/dsk/hda1 */ -union { -struct rb_node mnt_node;/* Under ns->mounts */ -struct list_head mnt_list; - }; +struct list_head mnt_list;struct list_head mnt_expire;/* link in fs-specific expiry list */ struct list_head mnt_share;/* circular list of shared mounts */ struct list_head mnt_slave_list;/* list of slave mounts */
@@ -145,11 +143,16 @@ static inline bool is_anon_ns(struct mnt_namespace *ns)return ns->seq ==0 ; } +static inline bool mnt_ns_attached (const struct mount *mnt) +{ +return !RB_EMPTY_NODE (&mnt->mnt_node); +} +static inline void move_from_ns (struct mount *mnt,struct list_head *dt_list) { -WARN_ON (!(mnt->mnt.mnt_flags &MNT_ONRB )); - mnt->mnt.mnt_flags &= ~MNT_ONRB ; +WARN_ON (!mnt_ns_attached (mnt));rb_erase (&mnt->mnt_node, &mnt->mnt_ns->mounts); +RB_CLEAR_NODE (&mnt->mnt_node);list_add_tail (&mnt->mnt_list, dt_list); }
fs/namespace.c +6 -8
@@ -344,6 +344,7 @@ static struct mount *alloc_vfsmnt(const char *name)INIT_HLIST_NODE (&mnt->mnt_mp_list);INIT_LIST_HEAD (&mnt->mnt_umounting);INIT_HLIST_HEAD (&mnt->mnt_stuck_children); +RB_CLEAR_NODE (&mnt->mnt_node); mnt->mnt.mnt_idmap = &nop_mnt_idmap; }return mnt;
@@ -1124,7 +1125,7 @@ static void mnt_add_to_ns(struct mnt_namespace *ns, struct mount *mnt)struct rb_node **link = &ns->mounts.rb_node;struct rb_node *parent =NULL ; -WARN_ON (mnt->mnt.mnt_flags &MNT_ONRB ); +WARN_ON (mnt_ns_attached (mnt)); mnt->mnt_ns = ns;while (*link) { parent = *link;
@@ -1135,7 +1136,6 @@ static void mnt_add_to_ns(struct mnt_namespace *ns, struct mount *mnt) }rb_link_node (&mnt->mnt_node, parent, link);rb_insert_color (&mnt->mnt_node, &ns->mounts); - mnt->mnt.mnt_flags |=MNT_ONRB ; }/*
@@ -1305,7 +1305,7 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root, } mnt->mnt.mnt_flags = old->mnt.mnt_flags; - mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD |MNT_MARKED |MNT_INTERNAL |MNT_ONRB ); + mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD |MNT_MARKED |MNT_INTERNAL );atomic_inc (&sb->s_active); mnt->mnt.mnt_idmap =mnt_idmap_get (mnt_idmap (&old->mnt));
@@ -1763,7 +1763,7 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)/* Gather the mounts to umount */ for (p = mnt; p; p =next_mnt (p, mnt)) { p->mnt.mnt_flags |=MNT_UMOUNT ; -if (p->mnt.mnt_flags &MNT_ONRB ) +if (mnt_ns_attached (p))move_from_ns (p, &tmp_list);else list_move (&p->mnt_list, &tmp_list);
@@ -1912,16 +1912,14 @@ static int do_umount(struct mount *mnt, int flags) event++;if (flags &MNT_DETACH ) { -if (mnt->mnt.mnt_flags &MNT_ONRB || - !list_empty (&mnt->mnt_list)) +if (mnt_ns_attached (mnt) || !list_empty (&mnt->mnt_list))umount_tree (mnt,UMOUNT_PROPAGATE ); retval =0 ; }else {shrink_submounts (mnt); retval = -EBUSY ;if (!propagate_mount_busy (mnt,2 )) { -if (mnt->mnt.mnt_flags &MNT_ONRB || - !list_empty (&mnt->mnt_list)) +if (mnt_ns_attached (mnt) || !list_empty (&mnt->mnt_list))umount_tree (mnt,UMOUNT_PROPAGATE |UMOUNT_SYNC ); retval =0 ; }
include/linux/mount.h +1 -2
@@ -50,7 +50,7 @@ struct path;#define MNT_ATIME_MASK (MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME )#define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \ - MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED | MNT_ONRB) + MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED)#define MNT_INTERNAL 0x4000
@@ -64,7 +64,6 @@ struct path;#define MNT_SYNC_UMOUNT 0x2000000#define MNT_MARKED 0x4000000#define MNT_UMOUNT 0x8000000 -#define MNT_ONRB 0x10000000struct vfsmount {struct dentry *mnt_root;/* root of the mounted tree */
Signature · 1 line
2.48.0
Greg Kroah-Hartman
maintainerPATCH 116/189 riscv: Fix sleeping in invalid context in die()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 6a97f4118ac07cfdc316433f385dbdc12af5025e upstream.
die() can be called in exception handler, and therefore cannot sleep. However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled. That causes the following warning:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex
preempt_count: 110001, expected: 0
RCU nest depth: 0, expected: 0
CPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
dump_backtrace+0x1c/0x24
show_stack+0x2c/0x38
dump_stack_lvl+0x5a/0x72
dump_stack+0x14/0x1c
__might_resched+0x130/0x13a
rt_spin_lock+0x2a/0x5c
die+0x24/0x112
do_trap_insn_illegal+0xa0/0xea
_new_vmalloc_restore_context_a0+0xcc/0xd8Oops - illegal instruction [#1]
Switch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT enabled.
--- arch/riscv/kernel/traps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/riscv/kernel/traps.c +3 -3
@@ -35,7 +35,7 @@int show_unhandled_signals =1 ; -static DEFINE_SPINLOCK (die_lock); +static DEFINE_RAW_SPINLOCK (die_lock);static int copy_code (struct pt_regs *regs,u16 *val,const u16 *insns) {
@@ -81,7 +81,7 @@ void die(struct pt_regs *regs, const chaoops_enter (); -spin_lock_irqsave (&die_lock, flags); +raw_spin_lock_irqsave (&die_lock, flags);console_verbose ();bust_spinlocks (1 );
@@ -100,7 +100,7 @@ void die(struct pt_regs *regs, const chabust_spinlocks (0 );add_taint (TAINT_DIE ,LOCKDEP_NOW_UNRELIABLE ); -spin_unlock_irqrestore (&die_lock, flags); +raw_spin_unlock_irqrestore (&die_lock, flags);oops_exit ();if (in_interrupt ())
Greg Kroah-Hartman
maintainerPATCH 117/189 riscv: kprobes: Fix incorrect address calculation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 13134cc949148e1dfa540a0fe5dc73569bc62155 upstream.
p->ainsn.api.insn is a pointer to u32, therefore arithmetic operations are multiplied by four. This is clearly undesirable for this case.
Cast it to (void *) first before any calculation.
Below is a sample before/after. The dumped memory is two kprobe slots, the first slot has
- c.addiw a0, 0x1c (0x7125)
- ebreak (0x00100073)
and the second slot has:
- c.addiw a0, -4 (0x7135)
- ebreak (0x00100073)
Before this patch:
(gdb) x/16xh 0xff200000001350000xff20000000135000: 0x7125 0x0000 0x0000 0x0000 0x7135 0x0010 0x0000 0x00000xff20000000135010: 0x0073 0x0010 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000
After this patch:
(gdb) x/16xh 0xff200000001250000xff20000000125000: 0x7125 0x0073 0x0010 0x0000 0x7135 0x0073 0x0010 0x00000xff20000000125010: 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000 0x0000
--- arch/riscv/kernel/probes/kprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/probes/kprobes.c +1 -1
@@ -30,7 +30,7 @@ static void __kprobes arch_prepare_ss_sl p->ainsn.api.restore = (unsigned long )p->addr + len;patch_text_nosync (p->ainsn.api.insn, &p->opcode, len); -patch_text_nosync (p->ainsn.api.insn + len, &insn,GET_INSN_LENGTH (insn)); +patch_text_nosync ((void *)p->ainsn.api.insn + len, &insn,GET_INSN_LENGTH (insn)); }static void __kprobes arch_prepare_simulate (struct kprobe *p)
Greg Kroah-Hartman
maintainerPATCH 118/189 gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Binbin Zhou <[email protected]>
commit e59f4c97172de0c302894cfd5616161c1f0c4d85 upstream.
Since commit 3feb70a61740 ("gpio: loongson: add more gpio chip support"), the Loongson-2K2000 GPIO is supported.
However, according to the firmware development specification, the Loongson-2K2000 ACPI GPIO register offsets in the driver do not match the register base addresses in the firmware, resulting in the registers not being accessed properly.
Now, we fix it to ensure the GPIO function works properly.
--- drivers/gpio/gpio-loongson-64bit.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpio/gpio-loongson-64bit.c +3 -3
@@ -237,9 +237,9 @@ static const struct loongson_gpio_chip_dstatic const struct loongson_gpio_chip_data loongson_gpio_ls2k2000_data2 = { .label ="ls2k2000_gpio" , .mode =BIT_CTRL_MODE , - .conf_offset =0x84 , - .in_offset =0x88 , - .out_offset =0x80 , + .conf_offset =0x4 , + .in_offset =0x8 , + .out_offset =0x0 , };static const struct loongson_gpio_chip_data loongson_gpio_ls3a5000_data = {
Greg Kroah-Hartman
maintainerPATCH 119/189 ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 7ed4e4a659d99499dc6968c61970d41b64feeac0 upstream.
The TongFang GM5HG0A is a TongFang barebone design which is sold under various brand names.
The ACPI IRQ override for the keyboard IRQ must be used on these AMD Zen laptops in order for the IRQ to work.
At least on the SKIKK Vanaheim variant the DMI product- and board-name strings have been replaced by the OEM with "Vanaheim" so checking that board-name contains "GM5HG0A" as is usually done for TongFang barebones quirks does not work.
The DMI OEM strings do contain "GM5HG0A". I have looked at the dmidecode for a few other TongFang devices and the TongFang code-name string being in the OEM strings seems to be something which is consistently true.
Add a quirk checking one of the DMI_OEM_STRING(s) is "GM5HG0A" in the hope that this will work for other OEM versions of the "GM5HG0A" too.
--- drivers/acpi/resource.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/acpi/resource.c +11 -0
@@ -646,6 +646,17 @@ static const struct dmi_system_id irq1_e DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), }, }, + { +/* +* TongFang GM5HG0A in case of the SKIKK Vanaheim relabel the +* board-name is changed, so check OEM strings instead. Note +* OEM string matches are always exact matches. +* https://bugzilla.kernel.org/show_bug.cgi?id=219614 +*/ + .matches = { + DMI_EXACT_MATCH(DMI_OEM_STRING, "GM5HG0A"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 120/189 ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 66d337fede44dcbab4107d37684af8fcab3d648e upstream.
Like the Vivobook X1704VAP the X1504VAP has its keyboard IRQ (1) described as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which breaks the keyboard.
Add the X1504VAP to the irq1_level_low_skip_override[] quirk table to fix this.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -441,6 +441,13 @@ static const struct dmi_system_id irq1_l }, }, { +/* Asus Vivobook X1504VAP */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "X1504VAP"), + }, + }, + {/* Asus Vivobook X1704VAP */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
Greg Kroah-Hartman
maintainerPATCH 121/189 drm/amdgpu: Add a lock when accessing the buddy trim function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arunpravin Paneer Selvam <[email protected]>
commit 75c8b703e5bded1e33b08fb09b829e7c2c1ed50a upstream.
When running YouTube videos and Steam games simultaneously, the tester found a system hang / race condition issue with the multi-display configuration setting. Adding a lock to the buddy allocator's trim function would be the solution.
<log snip>
[ 7197.250436] general protection fault, probably for non-canonical address 0xdead000000000108 [ 7197.250447] RIP: 0010:__alloc_range+0x8b/0x340 [amddrm_buddy] [ 7197.250470] Call Trace: [ 7197.250472] <TASK> [ 7197.250475] ? show_regs+0x6d/0x80 [ 7197.250481] ? die_addr+0x37/0xa0 [ 7197.250483] ? exc_general_protection+0x1db/0x480 [ 7197.250488] ? drm_suballoc_new+0x13c/0x93d [drm_suballoc_helper] [ 7197.250493] ? asm_exc_general_protection+0x27/0x30 [ 7197.250498] ? __alloc_range+0x8b/0x340 [amddrm_buddy] [ 7197.250501] ? __alloc_range+0x109/0x340 [amddrm_buddy] [ 7197.250506] amddrm_buddy_block_trim+0x1b5/0x260 [amddrm_buddy] [ 7197.250511] amdgpu_vram_mgr_new+0x4f5/0x590 [amdgpu] [ 7197.250682] amdttm_resource_alloc+0x46/0xb0 [amdttm] [ 7197.250689] ttm_bo_alloc_resource+0xe4/0x370 [amdttm] [ 7197.250696] amdttm_bo_validate+0x9d/0x180 [amdttm] [ 7197.250701] amdgpu_bo_pin+0x15a/0x2f0 [amdgpu] [ 7197.250831] amdgpu_dm_plane_helper_prepare_fb+0xb2/0x360 [amdgpu] [ 7197.251025] ? try_wait_for_completion+0x59/0x70 [ 7197.251030] drm_atomic_helper_prepare_planes.part.0+0x2f/0x1e0 [ 7197.251035] drm_atomic_helper_prepare_planes+0x5d/0x70 [ 7197.251037] drm_atomic_helper_commit+0x84/0x160 [ 7197.251040] drm_atomic_nonblocking_commit+0x59/0x70 [ 7197.251043] drm_mode_atomic_ioctl+0x720/0x850 [ 7197.251047] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 7197.251049] drm_ioctl_kernel+0xb9/0x120 [ 7197.251053] ? srso_alias_return_thunk+0x5/0xfbef5 [ 7197.251056] drm_ioctl+0x2d4/0x550 [ 7197.251058] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 7197.251063] amdgpu_drm_ioctl+0x4e/0x90 [amdgpu] [ 7197.251186] __x64_sys_ioctl+0xa0/0xf0 [ 7197.251190] x64_sys_call+0x143b/0x25c0 [ 7197.251193] do_syscall_64+0x7f/0x180 [ 7197.251197] ? srso_alias_return_thunk+0x5/0xfbef5 [ 7197.251199] ? amdgpu_display_user_framebuffer_create+0x215/0x320 [amdgpu] [ 7197.251329] ? drm_internal_framebuffer_create+0xb7/0x1a0 [ 7197.251332] ? srso_alias_return_thunk+0x5/0xfbef5
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +1 -1
@@ -567,7 +567,6 @@ static int amdgpu_vram_mgr_new(struct ttm_resource_manager *man,else remaining_size -= size; } -mutex_unlock (&mgr->lock);if (bo->flags &AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS && adjust_dcc_size) {struct drm_buddy_block *dcc_block;
@@ -584,6 +583,7 @@ static int amdgpu_vram_mgr_new(struct ttm_resource_manager *man, (u64 )vres->base.size, &vres->blocks); } +mutex_unlock (&mgr->lock); vres->base.start =0 ; size = max_t(u64, amdgpu_vram_mgr_blocks_size(&vres->blocks),
Signature · 1 line
2.48.0
Greg Kroah-Hartman
maintainerPATCH 122/189 drm/amd/pm: fix BUG: scheduling while atomic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kun Liu <[email protected]>
commit 2a238b09bfd04e8155a7a323364bce1c38b28c0f upstream.
atomic scheduling will be triggered in interrupt handler for AC/DC mode switch as following backtrace.
Call Trace: <IRQ> dump_stack_lvl __schedule_bug __schedule schedule schedule_preempt_disabled __mutex_lock smu_cmn_send_smc_msg_with_param smu_v13_0_irq_process amdgpu_irq_dispatch amdgpu_ih_process amdgpu_irq_handler __handle_irq_event_percpu handle_irq_event handle_edge_irq __common_interrupt common_interrupt </IRQ> <TASK> asm_common_interrupt
--- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 2 ++ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 12 ++++++------ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 1 + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 1 + 4 files changed, 10 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +2 -0
@@ -302,5 +302,7 @@ int smu_v13_0_set_wbrf_exclusion_ranges(int smu_v13_0_get_boot_freq_by_index (struct smu_context *smu,enum smu_clk_type clk_type,uint32_t *value); + +void smu_v13_0_interrupt_work (struct smu_context *smu);#endif #endif
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +6 -6
@@ -1320,11 +1320,11 @@ static int smu_v13_0_set_irq_state(strucreturn 0 ; } -static int smu_v13_0_ack_ac_dc_interrupt (struct smu_context *smu) +void smu_v13_0_interrupt_work (struct smu_context *smu) { -return smu_cmn_send_smc_msg (smu, - SMU_MSG_ReenableAcDcInterrupt, -NULL ); +smu_cmn_send_smc_msg (smu, + SMU_MSG_ReenableAcDcInterrupt, +NULL ); }#define THM_11_0__SRCID__THM_DIG_THERM_L2H 0/* ASIC_TEMP > CG_THERMAL_INT.DIG_THERM_INTH */
@@ -1377,12 +1377,12 @@ static int smu_v13_0_irq_process(structswitch (ctxid) {case SMU_IH_INTERRUPT_CONTEXT_ID_AC :dev_dbg (adev->dev,"Switched to AC mode!\n" ); -smu_v13_0_ack_ac_dc_interrupt (smu); +schedule_work (&smu->interrupt_work); adev->pm.ac_power = true;break ;case SMU_IH_INTERRUPT_CONTEXT_ID_DC :dev_dbg (adev->dev,"Switched to DC mode!\n" ); -smu_v13_0_ack_ac_dc_interrupt (smu); +schedule_work (&smu->interrupt_work); adev->pm.ac_power = false;break ;case SMU_IH_INTERRUPT_CONTEXT_ID_THERMAL_THROTTLING :
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +1 -0
@@ -3126,6 +3126,7 @@ static const struct pptable_funcs smu_v1 .is_asic_wbrf_supported = smu_v13_0_0_wbrf_support_check, .enable_uclk_shadow = smu_v13_0_enable_uclk_shadow, .set_wbrf_exclusion_ranges = smu_v13_0_set_wbrf_exclusion_ranges, + .interrupt_work = smu_v13_0_interrupt_work, };void smu_v13_0_0_set_ppt_funcs (struct smu_context *smu)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +1 -0
@@ -2704,6 +2704,7 @@ static const struct pptable_funcs smu_v1 .is_asic_wbrf_supported = smu_v13_0_7_wbrf_support_check, .enable_uclk_shadow = smu_v13_0_enable_uclk_shadow, .set_wbrf_exclusion_ranges = smu_v13_0_set_wbrf_exclusion_ranges, + .interrupt_work = smu_v13_0_interrupt_work, };void smu_v13_0_7_set_ppt_funcs (struct smu_context *smu)
Greg Kroah-Hartman
maintainerPATCH 123/189 drm/amdkfd: fixed page fault when enable MES shader debugger
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: [email protected] <[email protected]>
commit 9738609449c3e44d1afb73eecab4763362b57930 upstream.
Initialize the process context address before setting the shader debugger.
[ 260.781212] amdgpu 0000:03:00.0: amdgpu: [gfxhub] page fault (src_id:0 ring:32 vmid:0 pasid:0) [ 260.781236] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000000000000 from client 10 [ 260.781255] amdgpu 0000:03:00.0: amdgpu: GCVM_L2_PROTECTION_FAULT_STATUS:0x00040A40 [ 260.781270] amdgpu 0000:03:00.0: amdgpu: Faulty UTCL2 client ID: CPC (0x5) [ 260.781284] amdgpu 0000:03:00.0: amdgpu: MORE_FAULTS: 0x0 [ 260.781296] amdgpu 0000:03:00.0: amdgpu: WALKER_ERROR: 0x0 [ 260.781308] amdgpu 0000:03:00.0: amdgpu: PERMISSION_FAULTS: 0x4 [ 260.781320] amdgpu 0000:03:00.0: amdgpu: MAPPING_ERROR: 0x0 [ 260.781332] amdgpu 0000:03:00.0: amdgpu: RW: 0x1 [ 260.782017] amdgpu 0000:03:00.0: amdgpu: [gfxhub] page fault (src_id:0 ring:32 vmid:0 pasid:0) [ 260.782039] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000000000000 from client 10 [ 260.782058] amdgpu 0000:03:00.0: amdgpu: GCVM_L2_PROTECTION_FAULT_STATUS:0x00040A41 [ 260.782073] amdgpu 0000:03:00.0: amdgpu: Faulty UTCL2 client ID: CPC (0x5) [ 260.782087] amdgpu 0000:03:00.0: amdgpu: MORE_FAULTS: 0x1 [ 260.782098] amdgpu 0000:03:00.0: amdgpu: WALKER_ERROR: 0x0 [ 260.782110] amdgpu 0000:03:00.0: amdgpu: PERMISSION_FAULTS: 0x4 [ 260.782122] amdgpu 0000:03:00.0: amdgpu: MAPPING_ERROR: 0x0 [ 260.782137] amdgpu 0000:03:00.0: amdgpu: RW: 0x1 [ 260.782155] amdgpu 0000:03:00.0: amdgpu: [gfxhub] page fault (src_id:0 ring:32 vmid:0 pasid:0) [ 260.782166] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000000000000 from client 10
--- drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/gpu/drm/amd/amdkfd/kfd_debug.c +17 -0
@@ -350,10 +350,27 @@ int kfd_dbg_set_mes_debug_mode(struct kf {uint32_t spi_dbg_cntl = pdd->spi_dbg_override | pdd->spi_dbg_launch_mode;uint32_t flags = pdd->process->dbg_flags; +struct amdgpu_device *adev = pdd->dev->adev; +int r;if (!kfd_dbg_is_per_vmid_supported (pdd->dev))return 0 ; +if (!pdd->proc_ctx_cpu_ptr) { + r =amdgpu_amdkfd_alloc_gtt_mem (adev, +AMDGPU_MES_PROC_CTX_SIZE , + &pdd->proc_ctx_bo, + &pdd->proc_ctx_gpu_addr, + &pdd->proc_ctx_cpu_ptr, + false); +if (r) { +dev_err (adev->dev, +"failed to allocate process context bo\n" ); +return r; + } +memset (pdd->proc_ctx_cpu_ptr,0 ,AMDGPU_MES_PROC_CTX_SIZE ); + } +return amdgpu_mes_set_shader_debugger (pdd->dev->adev, pdd->proc_ctx_gpu_addr, spi_dbg_cntl, pdd->watch_points, flags, sq_trap_en); }
Greg Kroah-Hartman
maintainerPATCH 124/189 drm/amdkfd: wq_release signals dma_fence only when available
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Lingshan <[email protected]>
commit a993d319aebb7cce8a10c6e685344b7c2ad5c4c2 upstream.
kfd_process_wq_release() signals eviction fence by dma_fence_signal() which wanrs if dma_fence is NULL.
kfd_process->ef is initialized by kfd_process_device_init_vm() through ioctl. That means the fence is NULL for a new created kfd_process, and close a kfd_process right after open it will trigger the warning.
This commit conditionally signals the eviction fence in kfd_process_wq_release() only when it is available.
[ 503.660882] WARNING: CPU: 0 PID: 9 at drivers/dma-buf/dma-fence.c:467 dma_fence_signal+0x74/0xa0 [ 503.782940] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu] [ 503.789640] RIP: 0010:dma_fence_signal+0x74/0xa0 [ 503.877620] Call Trace: [ 503.880066] <TASK> [ 503.882168] ? __warn+0xcd/0x260 [ 503.885407] ? dma_fence_signal+0x74/0xa0 [ 503.889416] ? report_bug+0x288/0x2d0 [ 503.893089] ? handle_bug+0x53/0xa0 [ 503.896587] ? exc_invalid_op+0x14/0x50 [ 503.900424] ? asm_exc_invalid_op+0x16/0x20 [ 503.904616] ? dma_fence_signal+0x74/0xa0 [ 503.908626] kfd_process_wq_release+0x6b/0x370 [amdgpu] [ 503.914081] process_one_work+0x654/0x10a0 [ 503.918186] worker_thread+0x6c3/0xe70 [ 503.921943] ? srso_alias_return_thunk+0x5/0xfbef5 [ 503.926735] ? srso_alias_return_thunk+0x5/0xfbef5 [ 503.931527] ? __kthread_parkme+0x82/0x140 [ 503.935631] ? __pfx_worker_thread+0x10/0x10 [ 503.939904] kthread+0x2a8/0x380 [ 503.943132] ? __pfx_kthread+0x10/0x10 [ 503.946882] ret_from_fork+0x2d/0x70 [ 503.950458] ? __pfx_kthread+0x10/0x10 [ 503.954210] ret_from_fork_asm+0x1a/0x30 [ 503.958142] </TASK> [ 503.960328] ---[ end trace 0000000000000000 ]---
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +2 -1
@@ -1160,7 +1160,8 @@ static void kfd_process_wq_release(struct work_struct *work)*/ synchronize_rcu (); ef =rcu_access_pointer (p->ef); -dma_fence_signal (ef); +if (ef) +dma_fence_signal (ef);kfd_process_remove_sysfs (p);
Signature · 1 line
2.48.0
Greg Kroah-Hartman
maintainerPATCH 125/189 drm/amd/display: fix divide error in DM plane scale calcs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melissa Wen <[email protected]>
commit 5225fd2a26211d012533acf98a6ad3f983885817 upstream.
dm_get_plane_scale doesn't take into account plane scaled size equal to zero, leading to a kernel oops due to division by zero. Fix by setting out-scale size as zero when the dst size is zero, similar to what is done by drm_calc_scale(). This issue started with the introduction of cursor ovelay mode that uses this function to assess cursor mode changes via dm_crtc_get_cursor_mode() before checking plane state.
[Dec17 17:14] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI
[ +0.000018] CPU: 5 PID: 1660 Comm: surface-DP-1 Not tainted 6.10.0+ #231 [ +0.000007] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024 [ +0.000004] RIP: 0010:dm_get_plane_scale+0x3f/0x60 [amdgpu] [ +0.000553] Code: 44 0f b7 41 3a 44 0f b7 49 3e 83 e0 0f 48 0f a3 c2 73 21 69 41 28 e8 03 00 00 31 d2 41 f7 f1 31 d2 89 06 69 41 2c e8 03 00 00 <41> f7 f0 89 07 e9 d7 d8 7e e9 44 89 c8 45 89 c1 41 89 c0 eb d4 66 [ +0.000005] RSP: 0018:ffffa8df0de6b8a0 EFLAGS: 00010246 [ +0.000006] RAX: 00000000000003e8 RBX: ffff9ac65c1f6e00 RCX: ffff9ac65d055500 [ +0.000003] RDX: 0000000000000000 RSI: ffffa8df0de6b8b0 RDI: ffffa8df0de6b8b4 [ +0.000004] RBP: ffff9ac64e7a5800 R08: 0000000000000000 R09: 0000000000000a00 [ +0.000003] R10: 00000000000000ff R11: 0000000000000054 R12: ffff9ac6d0700010 [ +0.000003] R13: ffff9ac65d054f00 R14: ffff9ac65d055500 R15: ffff9ac64e7a60a0 [ +0.000004] FS: 00007f869ea00640(0000) GS:ffff9ac970080000(0000) knlGS:0000000000000000 [ +0.000004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000003] CR2: 000055ca701becd0 CR3: 000000010e7f2000 CR4: 0000000000350ef0 [ +0.000004] Call Trace: [ +0.000007] <TASK> [ +0.000006] ? __die_body.cold+0x19/0x27 [ +0.000009] ? die+0x2e/0x50 [ +0.000007] ? do_trap+0xca/0x110 [ +0.000007] ? do_error_trap+0x6a/0x90 [ +0.000006] ? dm_get_plane_scale+0x3f/0x60 [amdgpu] [ +0.000504] ? exc_divide_error+0x38/0x50 [ +0.000005] ? dm_get_plane_scale+0x3f/0x60 [amdgpu] [ +0.000488] ? asm_exc_divide_error+0x1a/0x20 [ +0.000011] ? dm_get_plane_scale+0x3f/0x60 [amdgpu] [ +0.000593] dm_crtc_get_cursor_mode+0x33f/0x430 [amdgpu] [ +0.000562] amdgpu_dm_atomic_check+0x2ef/0x1770 [amdgpu] [ +0.000501] drm_atomic_check_only+0x5e1/0xa30 [drm] [ +0.000047] drm_mode_atomic_ioctl+0x832/0xcb0 [drm] [ +0.000050] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [drm] [ +0.000047] drm_ioctl_kernel+0xb3/0x100 [drm] [ +0.000062] drm_ioctl+0x27a/0x4f0 [drm] [ +0.000049] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [drm] [ +0.000055] amdgpu_drm_ioctl+0x4e/0x90 [amdgpu] [ +0.000360] __x64_sys_ioctl+0x97/0xd0 [ +0.000010] do_syscall_64+0x82/0x190 [ +0.000008] ? __pfx_drm_mode_createblob_ioctl+0x10/0x10 [drm] [ +0.000044] ? srso_return_thunk+0x5/0x5f [ +0.000006] ? drm_ioctl_kernel+0xb3/0x100 [drm] [ +0.000040] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? __check_object_size+0x50/0x220 [ +0.000007] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? drm_ioctl+0x2a4/0x4f0 [drm] [ +0.000039] ? __pfx_drm_mode_createblob_ioctl+0x10/0x10 [drm] [ +0.000043] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? __pm_runtime_suspend+0x69/0xc0 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? amdgpu_drm_ioctl+0x71/0x90 [amdgpu] [ +0.000366] ? srso_return_thunk+0x5/0x5f [ +0.000006] ? syscall_exit_to_user_mode+0x77/0x210 [ +0.000007] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? do_syscall_64+0x8e/0x190 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000006] ? do_syscall_64+0x8e/0x190 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000008] RIP: 0033:0x55bb7cd962bc [ +0.000007] Code: 4c 89 6c 24 18 4c 89 64 24 20 4c 89 74 24 28 0f 57 c0 0f 11 44 24 30 89 c7 48 8d 54 24 08 b8 10 00 00 00 be bc 64 38 c0 0f 05 <49> 89 c7 48 83 3b 00 74 09 4c 89 c7 ff 15 62 64 99 00 48 83 7b 18 [ +0.000005] RSP: 002b:00007f869e9f4da0 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 [ +0.000007] RAX: ffffffffffffffda RBX: 00007f869e9f4fb8 RCX: 000055bb7cd962bc [ +0.000004] RDX: 00007f869e9f4da8 RSI: 00000000c03864bc RDI: 000000000000003b [ +0.000003] RBP: 000055bb9ddcbcc0 R08: 00007f86541b9920 R09: 0000000000000009 [ +0.000004] R10: 0000000000000004 R11: 0000000000000217 R12: 00007f865406c6b0 [ +0.000003] R13: 00007f86541b5290 R14: 00007f865410b700 R15: 000055bb9ddcbc18 [ +0.000009] </TASK>
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -2
@@ -11115,8 +11115,8 @@ dm_get_plane_scale(struct drm_plane_statint plane_src_w, plane_src_h;dm_get_oriented_plane_size (plane_state, &plane_src_w, &plane_src_h); - *out_plane_scale_w = plane_state->crtc_w *1000 / plane_src_w; - *out_plane_scale_h = plane_state->crtc_h *1000 / plane_src_h; + *out_plane_scale_w = plane_src_w ? plane_state->crtc_w *1000 / plane_src_w :0 ; + *out_plane_scale_h = plane_src_h ? plane_state->crtc_h *1000 / plane_src_h :0 ; }/*
Greg Kroah-Hartman
maintainerPATCH 126/189 drm/amd/display: fix page fault due to max surface definition mismatch
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melissa Wen <[email protected]>
commit 7de8d5c90be9ad9f6575e818a674801db2ada794 upstream.
DC driver is using two different values to define the maximum number of
surfaces: MAX_SURFACES and MAX_SURFACE_NUM. Consolidate MAX_SURFACES as the unique definition for surface updates across DC.
It fixes page fault faced by Cosmic users on AMD display versions that support two overlay planes, since the introduction of cursor overlay mode.
[Nov26 21:33] BUG: unable to handle page fault for address: 0000000051d0f08b
[ +0.000015] #PF: supervisor read access in kernel mode [ +0.000006] #PF: error_code(0x0000) - not-present page [ +0.000005] PGD 0 P4D 0 [ +0.000007] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI [ +0.000006] CPU: 4 PID: 71 Comm: kworker/u32:6 Not tainted 6.10.0+ #300 [ +0.000006] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024 [ +0.000007] Workqueue: events_unbound commit_work [drm_kms_helper] [ +0.000040] RIP: 0010:copy_stream_update_to_stream.isra.0+0x30d/0x750 [amdgpu] [ +0.000847] Code: 8b 10 49 89 94 24 f8 00 00 00 48 8b 50 08 49 89 94 24 00 01 00 00 8b 40 10 41 89 84 24 08 01 00 00 49 8b 45 78 48 85 c0 74 0b <0f> b6 00 41 88 84 24 90 64 00 00 49 8b 45 60 48 85 c0 74 3b 48 8b [ +0.000010] RSP: 0018:ffffc203802f79a0 EFLAGS: 00010206 [ +0.000009] RAX: 0000000051d0f08b RBX: 0000000000000004 RCX: ffff9f964f0a8070 [ +0.000004] RDX: ffff9f9710f90e40 RSI: ffff9f96600c8000 RDI: ffff9f964f000000 [ +0.000004] RBP: ffffc203802f79f8 R08: 0000000000000000 R09: 0000000000000000 [ +0.000005] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9f96600c8000 [ +0.000004] R13: ffff9f9710f90e40 R14: ffff9f964f000000 R15: ffff9f96600c8000 [ +0.000004] FS: 0000000000000000(0000) GS:ffff9f9970000000(0000) knlGS:0000000000000000 [ +0.000005] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000005] CR2: 0000000051d0f08b CR3: 00000002e6a20000 CR4: 0000000000350ef0 [ +0.000005] Call Trace: [ +0.000011] <TASK> [ +0.000010] ? __die_body.cold+0x19/0x27 [ +0.000012] ? page_fault_oops+0x15a/0x2d0 [ +0.000014] ? exc_page_fault+0x7e/0x180 [ +0.000009] ? asm_exc_page_fault+0x26/0x30 [ +0.000013] ? copy_stream_update_to_stream.isra.0+0x30d/0x750 [amdgpu] [ +0.000739] ? dc_commit_state_no_check+0xd6c/0xe70 [amdgpu] [ +0.000470] update_planes_and_stream_state+0x49b/0x4f0 [amdgpu] [ +0.000450] ? srso_return_thunk+0x5/0x5f [ +0.000009] ? commit_minimal_transition_state+0x239/0x3d0 [amdgpu] [ +0.000446] update_planes_and_stream_v2+0x24a/0x590 [amdgpu] [ +0.000464] ? srso_return_thunk+0x5/0x5f [ +0.000009] ? sort+0x31/0x50 [ +0.000007] ? amdgpu_dm_atomic_commit_tail+0x159f/0x3a30 [amdgpu] [ +0.000508] ? srso_return_thunk+0x5/0x5f [ +0.000009] ? amdgpu_crtc_get_scanout_position+0x28/0x40 [amdgpu] [ +0.000377] ? srso_return_thunk+0x5/0x5f [ +0.000009] ? drm_crtc_vblank_helper_get_vblank_timestamp_internal+0x160/0x390 [drm] [ +0.000058] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? dma_fence_default_wait+0x8c/0x260 [ +0.000010] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? wait_for_completion_timeout+0x13b/0x170 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? dma_fence_wait_timeout+0x108/0x140 [ +0.000010] ? commit_tail+0x94/0x130 [drm_kms_helper] [ +0.000024] ? process_one_work+0x177/0x330 [ +0.000008] ? worker_thread+0x266/0x3a0 [ +0.000006] ? __pfx_worker_thread+0x10/0x10 [ +0.000004] ? kthread+0xd2/0x100 [ +0.000006] ? __pfx_kthread+0x10/0x10 [ +0.000006] ? ret_from_fork+0x34/0x50 [ +0.000004] ? __pfx_kthread+0x10/0x10 [ +0.000005] ? ret_from_fork_asm+0x1a/0x30 [ +0.000011] </TASK>
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_state.c | 8 ++++---- drivers/gpu/drm/amd/display/dc/dc.h | 2 +- drivers/gpu/drm/amd/display/dc/dc_stream.h | 2 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 1 - drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c | 2 +- 6 files changed, 8 insertions(+), 9 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +1 -1
@@ -4421,7 +4421,7 @@ static bool commit_minimal_transition_bastruct pipe_split_policy_backup policy;struct dc_state *intermediate_context;struct dc_state *old_current_state = dc->current_state; -struct dc_surface_update srf_updates[MAX_SURFACE_NUM ] = {0 }; +struct dc_surface_update srf_updates[MAX_SURFACES ] = {0 };int surface_count;/*
drivers/gpu/drm/amd/display/dc/core/dc_state.c +4 -4
@@ -483,9 +483,9 @@ bool dc_state_add_plane(if (stream_status ==NULL ) {dm_error ("Existing stream not found; failed to attach surface!\n" ); goto out; - }else if (stream_status->plane_count ==MAX_SURFACE_NUM ) { + }else if (stream_status->plane_count ==MAX_SURFACES ) {dm_error ("Surface: can not attach plane_state %p! Maximum is: %d\n" , - plane_state,MAX_SURFACE_NUM ); + plane_state,MAX_SURFACES ); goto out; }else if (!otg_master_pipe) { goto out;
@@ -600,7 +600,7 @@ bool dc_state_rem_all_planes_for_stream( {int i, old_plane_count;struct dc_stream_status *stream_status =NULL ; -struct dc_plane_state *del_planes[MAX_SURFACE_NUM ] = {0 }; +struct dc_plane_state *del_planes[MAX_SURFACES ] = {0 };for (i =0 ; i < state->stream_count; i++)if (state->streams[i] == stream) {
@@ -875,7 +875,7 @@ bool dc_state_rem_all_phantom_planes_for {int i, old_plane_count;struct dc_stream_status *stream_status =NULL ; -struct dc_plane_state *del_planes[MAX_SURFACE_NUM ] = {0 }; +struct dc_plane_state *del_planes[MAX_SURFACES ] = {0 };for (i =0 ; i < state->stream_count; i++)if (state->streams[i] == phantom_stream) {
drivers/gpu/drm/amd/display/dc/dc.h +1 -1
@@ -1390,7 +1390,7 @@ struct dc_scratch_space {* store current value in plane states so we can still recover * a valid current state during dc update. */ -struct dc_plane_state plane_states[MAX_SURFACE_NUM ]; +struct dc_plane_state plane_states[MAX_SURFACES ];struct dc_stream_state stream_state; };
drivers/gpu/drm/amd/display/dc/dc_stream.h +1 -1
@@ -56,7 +56,7 @@ struct dc_stream_status {int plane_count;int audio_inst;struct timing_sync_info timing_sync_info; -struct dc_plane_state *plane_states[MAX_SURFACE_NUM ]; +struct dc_plane_state *plane_states[MAX_SURFACES ];bool is_abm_supported;struct mall_stream_config mall_stream_config;bool fpo_in_use;
drivers/gpu/drm/amd/display/dc/dc_types.h +0 -1
@@ -76,7 +76,6 @@ struct dc_perf_trace {unsigned long last_entry_write; }; -#define MAX_SURFACE_NUM 6#define NUM_PIXEL_FORMATS 10enum tiling_mode {
drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c +1 -1
@@ -813,7 +813,7 @@ static bool remove_all_phantom_planes_fo {int i, old_plane_count;struct dc_stream_status *stream_status =NULL ; -struct dc_plane_state *del_planes[MAX_SURFACE_NUM ] = {0 }; +struct dc_plane_state *del_planes[MAX_SURFACES ] = {0 };for (i =0 ; i < context->stream_count; i++)if (context->streams[i] == stream) {
Greg Kroah-Hartman
maintainerPATCH 127/189 drm/amd/display: increase MAX_SURFACES to the value supported by hw
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melissa Wen <[email protected]>
commit 21541bc6b44241e3f791f9e552352d8440b2b29e upstream.
As the hw supports up to 4 surfaces, increase the maximum number of surfaces to prevent the DC error when trying to use more than three planes.
[drm:dc_state_add_plane [amdgpu]] *ERROR* Surface: can not attach plane_state 000000003e2cb82c! Maximum is: 3
--- drivers/gpu/drm/amd/display/dc/dc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dc.h +1 -1
@@ -57,7 +57,7 @@ struct dmub_notification;#define DC_VER "3.2.301" -#define MAX_SURFACES 3 +#define MAX_SURFACES 4#define MAX_PLANES 6#define MAX_STREAMS 6#define MIN_VIEWPORT_SIZE 12
Greg Kroah-Hartman
maintainerPATCH 128/189 io_uring/timeout: fix multishot updates
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit c83c846231db8b153bfcb44d552d373c34f78245 upstream.
After update only the first shot of a multishot timeout request adheres to the new timeout value while all subsequent retries continue to use the old value. Don't forget to update the timeout stored in struct io_timeout_data.
--- io_uring/timeout.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
io_uring/timeout.c +3 -1
@@ -409,10 +409,12 @@ static int io_timeout_update(struct io_r timeout->off =0 ;/* noseq */ data = req->async_data; + data->ts = *ts; +list_add_tail (&timeout->list, &ctx->timeout_list);hrtimer_init (&data->timer,io_timeout_get_clock (data), mode); data->timer.function = io_timeout_fn; -hrtimer_start (&data->timer,timespec64_to_ktime (*ts), mode); +hrtimer_start (&data->timer,timespec64_to_ktime (data->ts), mode);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 129/189 io_uring/sqpoll: zero sqd->thread on tctx errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit 4b7cfa8b6c28a9fa22b86894166a1a34f6d630ba upstream.
Syzkeller reports:
BUG: KASAN: slab-use-after-free in thread_group_cputime+0x409/0x700 kernel/sched/cputime.c:341 Read of size 8 at addr ffff88803578c510 by task syz.2.3223/27552 Call Trace: <TASK> ... kasan_report+0x143/0x180 mm/kasan/report.c:602 thread_group_cputime+0x409/0x700 kernel/sched/cputime.c:341 thread_group_cputime_adjusted+0xa6/0x340 kernel/sched/cputime.c:639 getrusage+0x1000/0x1340 kernel/sys.c:1863 io_uring_show_fdinfo+0xdfe/0x1770 io_uring/fdinfo.c:197 seq_show+0x608/0x770 fs/proc/fd.c:68 ...
That's due to sqd->task not being cleared properly in cases where SQPOLL task tctx setup fails, which can essentially only happen with fault injection to insert allocation errors.
--- io_uring/sqpoll.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
io_uring/sqpoll.c +5 -1
@@ -275,8 +275,12 @@ static int io_sq_thread(void *data)DEFINE_WAIT (wait);/* offload context creation failed, just exit */ -if (!current->io_uring) +if (!current->io_uring) { +mutex_lock (&sqd->lock); + sqd->thread =NULL ; +mutex_unlock (&sqd->lock); goto err_out; + }snprintf (buf,sizeof (buf),"iou-sqp-%d" , sqd->task_pid);set_task_comm (current, buf);
Greg Kroah-Hartman
maintainerPATCH 130/189 USB: serial: option: add MeiG Smart SRM815
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chukun Pan <[email protected]>
commit c1947d244f807b1f95605b75a4059e7b37b5dcc3 upstream.
It looks like SRM815 shares ID with SRM825L.
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2dee ProdID=4d22 Rev= 4.14 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=123456 C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/serial/option.c +2 -1
@@ -621,7 +621,7 @@ static void option_instat_callback(struc/* MeiG Smart Technology products */ #define MEIGSMART_VENDOR_ID 0x2dee -/* MeiG Smart SRM825L based on Qualcomm 315 */ +/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */ #define MEIGSMART_PRODUCT_SRM825L 0x4d22/* MeiG Smart SLM320 based on UNISOC UIS8910 */ #define MEIGSMART_PRODUCT_SLM320 0x4d41
@@ -2405,6 +2405,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) },
Greg Kroah-Hartman
maintainerPATCH 131/189 USB: serial: option: add Neoway N723-EA support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hrusecky <[email protected]>
commit f5b435be70cb126866fa92ffc6f89cda9e112c75 upstream.
Update the USB serial option driver to support Neoway N723-EA.
ID 2949:8700 Marvell Mobile Composite Device Bus
T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2949 ProdID=8700 Rev= 1.00 S: Manufacturer=Marvell S: Product=Mobile Composite Device Bus S: SerialNumber=200806006809080000
C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0e(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Tested successfully connecting to the Internet via rndis interface after dialing via AT commands on If#=4 or If#=6.
Not sure of the purpose of the other serial interface.
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -2413,6 +2413,7 @@ static const struct usb_device_id option .driver_info = NCTRL(1) }, { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ .driver_info = NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x2949, 0x8700, 0xff) }, /* Neoway N723-EA */ { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Greg Kroah-Hartman
maintainerPATCH 132/189 staging: iio: ad9834: Correct phase range check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit c0599762f0c7e260b99c6b7bceb8eae69b804c94 upstream.
User Perspective:
When a user sets the phase value, the ad9834_write_phase() is called. The phase register has a 12-bit resolution, so the valid range is 0 to 4095. If the phase offset value of 4096 is input, it effectively exactly equals 0 in the lower 12 bits, meaning no offset.
Reasons for the Change:
1) Original Condition (phase > BIT(AD9834_PHASE_BITS)):
This condition allows a phase value equal to 2^12, which is 4096. However, this value exceeds the valid 12-bit range, as the maximum valid phase value should be 4095.
2) Modified Condition (phase >= BIT(AD9834_PHASE_BITS)):
Ensures that the phase value is within the valid range, preventing invalid datafrom being written.
Impact on Subsequent Logic: st->data = cpu_to_be16(addr | phase):
If the phase value is 2^12, i.e., 4096 (0001 0000 0000 0000), and addr is AD9834_REG_PHASE0 (1100 0000 0000 0000), then addr | phase results in 1101 0000 0000 0000, occupying DB12. According to the section of WRITING TO A PHASE REGISTER in the datasheet, the MSB 12 PHASE0 bits should be DB11. The original condition leads to incorrect DB12 usage, which contradicts the datasheet and could pose potential issues for future updates if DB12 is used in such related cases.
--- drivers/staging/iio/frequency/ad9834.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/frequency/ad9834.c +1 -1
@@ -131,7 +131,7 @@ static int ad9834_write_frequency(structstatic int ad9834_write_phase (struct ad9834_state *st,unsigned long addr,unsigned long phase) { -if (phase >BIT (AD9834_PHASE_BITS )) +if (phase >=BIT (AD9834_PHASE_BITS ))return -EINVAL ; st->data =cpu_to_be16 (addr | phase);
Greg Kroah-Hartman
maintainerPATCH 133/189 staging: iio: ad9832: Correct phase range check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit 4636e859ebe0011f41e35fa79bab585b8004e9a3 upstream.
User Perspective:
When a user sets the phase value, the ad9832_write_phase() is called. The phase register has a 12-bit resolution, so the valid range is 0 to 4095. If the phase offset value of 4096 is input, it effectively exactly equals 0 in the lower 12 bits, meaning no offset.
Reasons for the Change:
1) Original Condition (phase > BIT(AD9832_PHASE_BITS)):
This condition allows a phase value equal to 2^12, which is 4096. However, this value exceeds the valid 12-bit range, as the maximum valid phase value should be 4095.
2) Modified Condition (phase >= BIT(AD9832_PHASE_BITS)):
Ensures that the phase value is within the valid range, preventing invalid datafrom being written.
Impact on Subsequent Logic: st->data = cpu_to_be16(addr | phase):
If the phase value is 2^12, i.e., 4096 (0001 0000 0000 0000), and addr is AD9832_REG_PHASE0 (1100 0000 0000 0000), then addr | phase results in 1101 0000 0000 0000, occupying DB12. According to the section of WRITING TO A PHASE REGISTER in the datasheet, the MSB 12 PHASE0 bits should be DB11. The original condition leads to incorrect DB12 usage, which contradicts the datasheet and could pose potential issues for future updates if DB12 is used in such related cases.
--- drivers/staging/iio/frequency/ad9832.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/frequency/ad9832.c +1 -1
@@ -158,7 +158,7 @@ static int ad9832_write_frequency(structstatic int ad9832_write_phase (struct ad9832_state *st,unsigned long addr,unsigned long phase) { -if (phase >BIT (AD9832_PHASE_BITS )) +if (phase >=BIT (AD9832_PHASE_BITS ))return -EINVAL ; st->phase_data[0] = cpu_to_be16((AD9832_CMD_PHA8BITSW << CMD_SHIFT) |
Greg Kroah-Hartman
maintainerPATCH 134/189 usb-storage: Add max sectors quirk for Nokia 208
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Rintel <[email protected]>
commit cdef30e0774802df2f87024d68a9d86c3b99ca2a upstream.
This fixes data corruption when accessing the internal SD card in mass storage mode.
I am actually not too sure why. I didn't figure a straightforward way to reproduce the issue, but i seem to get garbage when issuing a lot (over 50) of large reads (over 120 sectors) are done in a quick succession. That is, time seems to matter here -- larger reads are fine if they are done with some delay between them.
But I'm not great at understanding this sort of things, so I'll assume the issue other, smarter, folks were seeing with similar phones is the same problem and I'll just put my quirk next to theirs.
The "Software details" screen on the phone is as follows:
V 04.06
07-08-13
RM-849
(c) Nokia
TL;DR version of the device descriptor:
idVendor 0x0421 Nokia Mobile Phones
idProduct 0x06c2
bcdDevice 4.06
iManufacturer 1 Nokia
iProduct 2 Nokia 208
The patch assumes older firmwares are broken too (I'm unable to test, but no biggie if they aren't I guess), and I have no idea if newer firmware exists.
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -255,6 +255,13 @@ UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_MAX_SECTORS_64 ), +/* Added by Lubomir Rintel <[email protected]>, a very fine chap */ +UNUSUAL_DEV( 0x0421, 0x06c2, 0x0000, 0x0406, + "Nokia", + "Nokia 208", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 ), +#ifdef NO_SDDR09 UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100, "Microtech",
Greg Kroah-Hartman
maintainerPATCH 135/189 USB: serial: cp210x: add Phoenix Contact UPS Device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 854eee93bd6e3dca619d47087af4d65b2045828e upstream.
Phoenix Contact sells UPS Quint devices [1] with a custom datacable [2] that embeds a Silicon Labs converter:
Bus 001 Device 003: ID 1b93:1013 Silicon Labs Phoenix Contact UPS Device Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x1b93 idProduct 0x1013 bcdDevice 1.00 iManufacturer 1 Silicon Labs iProduct 2 Phoenix Contact UPS Device iSerial 3 <redacted>
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0020
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 2 Phoenix Contact UPS Device
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
[1] https://www.phoenixcontact.com/en-pc/products/power-supply-unit-quint-ps-1ac-24dc-10-2866763
[2] https://www.phoenixcontact.com/en-il/products/data-cable-preassembled-ifs-usb-datacable-2320500
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -223,6 +223,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ + { USB_DEVICE(0x1B93, 0x1013) }, /* Phoenix Contact UPS Device */ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */
Greg Kroah-Hartman
maintainerPATCH 136/189 usb: dwc3: gadget: fix writing NYET threshold
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
commit 01ea6bf5cb58b20cc1bd159f0cf74a76cf04bb69 upstream.
Before writing a new value to the register, the old value needs to be masked out for the new value to be programmed as intended, because at least in some cases the reset value of that field is 0xf (max value).
At the moment, the dwc3 core initialises the threshold to the maximum value (0xf), with the option to override it via a DT. No upstream DTs seem to override it, therefore this commit doesn't change behaviour for any upstream platform. Nevertheless, the code should be fixed to have the desired outcome.
Do so.
--- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/gadget.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/usb/dwc3/core.h +1 -0
@@ -464,6 +464,7 @@#define DWC3_DCTL_TRGTULST_SS_INACT (DWC3_DCTL_TRGTULST(6))/* These apply for core versions 1.94a and later */ +#define DWC3_DCTL_NYET_THRES_MASK (0xf << 20)#define DWC3_DCTL_NYET_THRES (n) (((n) & 0xf) << 20)#define DWC3_DCTL_KEEP_CONNECT BIT(19)
drivers/usb/dwc3/gadget.c +3 -1
@@ -4208,8 +4208,10 @@ static void dwc3_gadget_conndone_interru WARN_ONCE(DWC3_VER_IS_PRIOR(DWC3, 240A) && dwc->has_lpm_erratum,"LPM Erratum not available on dwc3 revisions < 2.40a\n" ); - if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) + if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) { + reg &= ~DWC3_DCTL_NYET_THRES_MASK ; reg |=DWC3_DCTL_NYET_THRES (dwc->lpm_nyet_threshold); + }dwc3_gadget_dctl_write_safe (dwc, reg); }else {
Greg Kroah-Hartman
maintainerPATCH 137/189 topology: Keep the cpumask unchanged when printing cpumap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
commit cbd399f78e23ad4492c174fc5e6b3676dba74a52 upstream.
During fuzz testing, the following warning was discovered:
different return values (15 and 11) from vsnprintf("%*pbl ", ...)
test:keyward is WARNING in kvasprintf
WARNING: CPU: 55 PID: 1168477 at lib/kasprintf.c:30 kvasprintf+0x121/0x130 Call Trace: kvasprintf+0x121/0x130 kasprintf+0xa6/0xe0 bitmap_print_to_buf+0x89/0x100 core_siblings_list_read+0x7e/0xb0 kernfs_file_read_iter+0x15b/0x270 new_sync_read+0x153/0x260 vfs_read+0x215/0x290 ksys_read+0xb9/0x160 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2
The call trace shows that kvasprintf() reported this warning during the printing of core_siblings_list. kvasprintf() has several steps:
(1) First, calculate the length of the resulting formatted string.
(2) Allocate a buffer based on the returned length.
(3) Then, perform the actual string formatting.
(4) Check whether the lengths of the formatted strings returned in steps (1) and (2) are consistent.
If the core_cpumask is modified between steps (1) and (3), the lengths obtained in these two steps may not match. Indeed our test includes cpu hotplugging, which should modify core_cpumask while printing.
To fix this issue, cache the cpumask into a temporary variable before calling cpumap_print_{list, cpumask}_to_buf(), to keep it unchanged during the printing process.
--- drivers/base/topology.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)
drivers/base/topology.c +20 -4
@@ -27,9 +27,17 @@ static ssize_t name##_read(struct file * loff_t off, size_t count) \ { \struct device *dev =kobj_to_dev (kobj); \ +cpumask_var_t mask; \ +ssize_t n; \ \ - return cpumap_print_bitmask_to_buf(buf, topology_##mask(dev->id), \ - off, count); \ +if (!alloc_cpumask_var (&mask,GFP_KERNEL )) \ +return -ENOMEM ; \ + \ + cpumask_copy(mask, topology_##mask(dev->id)); \ + n = cpumap_print_bitmask_to_buf(buf, mask, off, count); \ + free_cpumask_var(mask); \ + \ + return n; \ } \ \ static ssize_t name##_list_read(struct file *file, struct kobject *kobj, \
@@ -37,9 +45,17 @@ static ssize_t name##_list_read(struct f loff_t off, size_t count) \ { \struct device *dev =kobj_to_dev (kobj); \ +cpumask_var_t mask; \ +ssize_t n; \ + \ +if (!alloc_cpumask_var (&mask,GFP_KERNEL )) \ +return -ENOMEM ; \ + \ + cpumask_copy(mask, topology_##mask(dev->id)); \ + n = cpumap_print_list_to_buf(buf, mask, off, count); \ + free_cpumask_var(mask); \ \ - return cpumap_print_list_to_buf(buf, topology_##mask(dev->id), \ - off, count); \ + return n; \ }define_id_show_func (physical_package_id,"%d" );
Greg Kroah-Hartman
maintainerPATCH 138/189 misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rengarajan S <[email protected]>
commit 194f9f94a5169547d682e9bbcc5ae6d18a564735 upstream.
Resolve kernel panic caused by improper handling of IRQs while accessing GPIO values. This is done by replacing generic_handle_irq with handle_nested_irq.
--- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c +1 -1
@@ -277,7 +277,7 @@ static irqreturn_t pci1xxxx_gpio_irq_hanwritel (BIT (bit), priv->reg_base +INTR_STATUS_OFFSET (gpiobank));spin_unlock_irqrestore (&priv->lock, flags); irq =irq_find_mapping (gc->irq.domain, (bit + (gpiobank *32 ))); -generic_handle_irq (irq); +handle_nested_irq (irq); } }spin_lock_irqsave (&priv->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 139/189 misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rengarajan S <[email protected]>
commit c7a5378a0f707686de3ddb489f1653c523bb7dcc upstream.
Driver returns -EOPNOTSUPPORTED on unsupported parameters case in set config. Upper level driver checks for -ENOTSUPP. Because of the return code mismatch, the ioctls from userspace fail. Resolve the issue by passing -ENOTSUPP during unsupported case.
--- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c +1 -1
@@ -148,7 +148,7 @@ static int pci1xxxx_gpio_set_config(strupci1xxx_assign_bit (priv->reg_base,OPENDRAIN_OFFSET (offset), (offset %32 ), true);break ;default : - ret = -EOPNOTSUPP ; + ret = -ENOTSUPP ;break ; }spin_unlock_irqrestore (&priv->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 140/189 tty: serial: 8250: Fix another runtime PM usage counter underflow
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit ed2761958ad77e54791802b07095786150eab844 upstream.
The commit f9b11229b79c ("serial: 8250: Fix PM usage_count for console handover") fixed one runtime PM usage counter balance problem that occurs because .dev is not set during univ8250 setup preventing call to pm_runtime_get_sync(). Later, univ8250_console_exit() will trigger the runtime PM usage counter underflow as .dev is already set at that time.
Call pm_runtime_get_sync() to balance the RPM usage counter also in serial8250_register_8250_port() before trying to add the port.
--- drivers/tty/serial/8250/8250_core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/tty/serial/8250/8250_core.c +3 -0
@@ -812,6 +812,9 @@ int serial8250_register_8250_port(const uart->dl_write = up->dl_write;if (uart->port.type !=PORT_8250_CIR ) { +if (uart_console_registered (&uart->port)) +pm_runtime_get_sync (uart->port.dev); +if (serial8250_isa_config !=NULL )serial8250_isa_config (0 , &uart->port, &uart->capabilities);