5.10.234-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.10.234-rc1 review
This is the start of the stable review cycle for the 5.10.234 release. There are 133 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 01 Feb 2025 14:01:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.234-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.234-rc1
Jack Greiner <[email protected]>
Input: xpad - add support for wooting two he (arm)
Nilton Perim Neto <[email protected]>
Input: xpad - add unofficial Xbox 360 wireless receiver clone
Mark Pearson <[email protected]>
Input: atkbd - map F23 key to support default copilot shortcut
Greg Kroah-Hartman <[email protected]>
Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
Qasim Ijaz <[email protected]>
USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
Anjaneyulu <[email protected]>
wifi: iwlwifi: add a few rate index validity checks
Ido Schimmel <[email protected]>
ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: Fix not validating setsockopt user input
Alex Williamson <[email protected]>
vfio/platform: check the bounds of read/write syscalls
Eric W. Biederman <[email protected]>
signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die
Al Viro <[email protected]>
m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal
Jamal Hadi Salim <[email protected]>
net: sched: fix ets qdisc OOB Indexing
Andreas Gruenbacher <[email protected]>
gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
Charles Keepax <[email protected]>
ASoC: samsung: Add missing depends on I2C
Philippe Simons <[email protected]>
irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
Xiang Zhang <[email protected]>
scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
Linus Walleij <[email protected]>
seccomp: Stub for !CONFIG_SECCOMP
Charles Keepax <[email protected]>
ASoC: samsung: Add missing selects for MFD_WM8994
Charles Keepax <[email protected]>
ASoC: wm8994: Add depends on MFD core
Wang Liang <[email protected]>
net: fix data-races around sk->sk_forward_alloc
Suraj Sonawane <[email protected]>
scsi: sg: Fix slab-use-after-free read in sg_release()
Juergen Gross <[email protected]>
x86/xen: fix SLS mitigation in xen_hypercall_iret()
Stefano Garzarella <[email protected]>
vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
Stefano Garzarella <[email protected]>
vsock/virtio: discard packets if the transport changes
Willem de Bruijn <[email protected]>
fou: remove warn in gue_gro_receive on unsupported protocol
Youzhong Yang <[email protected]>
nfsd: add list_head nf_gc to struct nfsd_file
Eric Dumazet <[email protected]>
ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
Tejun Heo <[email protected]>
blk-cgroup: Fix UAF in blkcg_unpin_online()
Chengchang Tang <[email protected]>
RDMA/hns: Fix deadlock on SRQ async events.
Matthew Wilcox (Oracle) <[email protected]>
vmalloc: fix accounting with i915
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/radeon: check bo_va->bo is non-NULL before using it
Javier Carrasco <[email protected]>
iio: adc: rockchip_saradc: fix information leak in triggered buffer
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix spi burst write not supported
Terry Tritton <[email protected]>
Revert "PCI: Use preserve_config in place of pci_flags"
Koichiro Den <[email protected]>
hrtimers: Handle CPU state correctly on hotplug
Yogesh Lal <[email protected]>
irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
Zhongqiu Han <[email protected]>
gpiolib: cdev: Fix use after free in lineinfo_changed_notify
Rik van Riel <[email protected]>
fs/proc: fix softlockup in __read_vmcore (part 2)
Stefano Garzarella <[email protected]>
vsock: reset socket state when de-assigning the transport
Stefano Garzarella <[email protected]>
vsock/virtio: cancel close work in the destructor
Heiner Kallweit <[email protected]>
net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
Juergen Gross <[email protected]>
x86/asm: Make serialize() always_inline
Luis Chamberlain <[email protected]>
nvmet: propagate npwg topology
Oleg Nesterov <[email protected]>
poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
David Howells <[email protected]>
kheaders: Ignore silly-rename files
Zhang Kunbo <[email protected]>
fs: fix missing declaration of init_files
Leo Stone <[email protected]>
hfs: Sanity check the root record
Lizhi Xu <[email protected]>
mac802154: check local interfaces before deleting sdata list
Wolfram Sang <[email protected]>
i2c: rcar: fix NACK handling when being a target
Wolfram Sang <[email protected]>
i2c: mux: demux-pinctrl: check initial mux selection, too
Maíra Canal <[email protected]>
drm/v3d: Ensure job pointer is set to NULL after job completion
Patrisious Haddad <[email protected]>
net/mlx5: Fix RDMA TX steering prio
Maor Gottlieb <[email protected]>
net/mlx5: Refactor mlx5_get_flow_namespace
Aharon Landau <[email protected]>
net/mlx5: Add priorities for counters in RDMA namespaces
Dan Carpenter <[email protected]>
nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
Kuniyuki Iwashima <[email protected]>
gtp: Destroy device along with udp socket's netns dismantle.
Kuniyuki Iwashima <[email protected]>
gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
Eric Dumazet <[email protected]>
gtp: use exit_batch_rtnl() method
Eric Dumazet <[email protected]>
net: add exit_batch_rtnl() method
Yajun Deng <[email protected]>
net: net_namespace: Optimize the code
Michal Luczaj <[email protected]>
bpf: Fix bpf_sk_select_reuseport() memory leak
Sudheer Kumar Doredla <[email protected]>
net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
Justin Chen <[email protected]>
phy: usb: Fix clock imbalance for suspend/resume
Justin Chen <[email protected]>
phy: usb: Use slow clock for wake enabled suspend
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: rto_min/max: avoid using current->nsproxy
Biju Das <[email protected]>
drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
Ahmad Fatoum <[email protected]>
drm: bridge: adv7511: use dev_err_probe in probe function
Alvin Šipraga <[email protected]>
drm: bridge: adv7511: unregister cec i2c device after cec adapter
Maxime Ripard <[email protected]>
drm/bridge: adv7533: Switch to devm MIPI-DSI helpers
Maxime Ripard <[email protected]>
drm/mipi-dsi: Create devm device attachment
Maxime Ripard <[email protected]>
drm/mipi-dsi: Create devm device registration
Xu Wang <[email protected]>
drm: bridge: adv7511: Remove redundant null check before clk_disable_unprepare
Dennis Lam <[email protected]>
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
Joseph Qi <[email protected]>
ocfs2: correct return value of ocfs2_local_free_info()
Justin Chen <[email protected]>
phy: usb: Toggle the PHY power during init
Al Cooper <[email protected]>
phy: usb: Add "wake on" functionality for newer Synopsis XHCI controllers
Christoph Hellwig <[email protected]>
block: remove the update_bdev parameter to set_capacity_revalidate_and_notify
Christoph Hellwig <[email protected]>
sd: update the bdev size in sd_revalidate_disk
Christoph Hellwig <[email protected]>
nvme: let set_capacity_revalidate_and_notify update the bdev size
Christoph Hellwig <[email protected]>
loop: let set_capacity_revalidate_and_notify update the bdev size
Peter Geis <[email protected]>
arm64: dts: rockchip: add hevc power domain clock to rk3328
Johan Jonker <[email protected]>
arm64: dts: rockchip: add #power-domain-cells to power domain nodes
Joe Hattori <[email protected]>
iio: inkern: call iio_device_put() only on mapped devices
Joe Hattori <[email protected]>
iio: adc: at91: call input_free_device() on allocated iio_dev
Fabio Estevam <[email protected]>
iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
Carlos Song <[email protected]>
iio: gyro: fxas21002c: Fix missing data update in trigger handler
Javier Carrasco <[email protected]>
iio: adc: ti-ads8688: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: imu: kmx61: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: light: vcnl4035: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
Javier Carrasco <[email protected]>
iio: pressure: zpa2326: fix information leak in triggered buffer
Akash M <[email protected]>
usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
Ma Ke <[email protected]>
usb: fix reference leak in usb_new_device()
Kai-Heng Feng <[email protected]>
USB: core: Disable LPM only for non-suspended ports
Jun Yan <[email protected]>
USB: usblp: return error when setting unsupported protocol
Lianqin Hu <[email protected]>
usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
André Draszik <[email protected]>
usb: dwc3: gadget: fix writing NYET threshold
Johan Hovold <[email protected]>
USB: serial: cp210x: add Phoenix Contact UPS Device
Lubomir Rintel <[email protected]>
usb-storage: Add max sectors quirk for Nokia 208
Zicheng Qu <[email protected]>
staging: iio: ad9832: Correct phase range check
Zicheng Qu <[email protected]>
staging: iio: ad9834: Correct phase range check
Michal Hrusecky <[email protected]>
USB: serial: option: add Neoway N723-EA support
Chukun Pan <[email protected]>
USB: serial: option: add MeiG Smart SRM815
Gui-Dong Han <[email protected]>
md/raid5: fix atomicity violation in raid5_cache_count
Kuan-Wei Chiu <[email protected]>
scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
Melissa Wen <[email protected]>
drm/amd/display: increase MAX_SURFACES to the value supported by hw
Hans de Goede <[email protected]>
ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
Nam Cao <[email protected]>
riscv: Fix sleeping in invalid context in die()
Roman Li <[email protected]>
drm/amd/display: Add check for granularity in dml ceil/floor helpers
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: auth_enable: avoid using current->nsproxy
Matthieu Baerts (NGI0) <[email protected]>
sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
Mikulas Patocka <[email protected]>
dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
Krister Johansen <[email protected]>
dm thin: make get_first_thin use rcu-safe list first function
David Howells <[email protected]>
afs: Fix the maximum cell name length
Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: clamp maximum hashtable size to INT_MAX
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: imbalance in flowtable binding
Benjamin Coddington <[email protected]>
tls: Fix tls_sw_sendmsg error handling
Anumula Murali Mohan Reddy <[email protected]>
cxgb4: Avoid removal of uninserted tid
Eric Dumazet <[email protected]>
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
Zhongqiu Duan <[email protected]>
tcp/dccp: allow a connection when sk_max_ack_backlog is zero
Jason Xing <[email protected]>
tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
Antonio Pastor <[email protected]>
net: 802: LLC+SNAP OID:PID lookup on start of skb data
Keisuke Nishimura <[email protected]>
ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
Pablo Neira Ayuso <[email protected]>
netfilter: nft_dynset: honor stateful expressions in set definition
Chen-Yu Tsai <[email protected]>
ASoC: mediatek: disable buffer pre-allocation
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in exfat_readdir()
Ming-Hung Tsai <[email protected]>
dm array: fix cursor index when skipping across block boundaries
Ming-Hung Tsai <[email protected]>
dm array: fix unreleased btree blocks on closing a faulty array cursor
Ming-Hung Tsai <[email protected]>
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
Zhang Yi <[email protected]>
jbd2: flush filesystem device before updating tail sequence
Max Kellermann <[email protected]>
ceph: give up on paths longer than PATH_MAX
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/rockchip/px30.dtsi | 8 ++ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 20 +++++ arch/m68k/fpsp040/skeleton.S | 3 +- arch/m68k/kernel/entry.S | 2 + arch/m68k/kernel/traps.c | 2 +- arch/riscv/kernel/traps.c | 6 +- arch/x86/include/asm/special_insns.h | 2 +- arch/x86/xen/xen-asm.S | 2 +- block/genhd.c | 13 ++- drivers/acpi/resource.c | 18 ++++ drivers/block/loop.c | 8 +- drivers/block/virtio_blk.c | 2 +- drivers/block/xen-blkfront.c | 2 +- drivers/gpio/gpiolib-cdev.c | 2 +- drivers/gpu/drm/amd/display/dc/dc.h | 2 +- .../gpu/drm/amd/display/dc/dml/dml_inline_defs.h | 8 ++ drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 - drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 17 ++-- drivers/gpu/drm/bridge/adv7511/adv7533.c | 38 +++------ drivers/gpu/drm/drm_mipi_dsi.c | 81 ++++++++++++++++++ drivers/gpu/drm/radeon/radeon_gem.c | 2 +- drivers/gpu/drm/v3d/v3d_irq.c | 4 + drivers/i2c/busses/i2c-rcar.c | 20 +++-- drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 +- drivers/iio/adc/at91_adc.c | 2 +- drivers/iio/adc/rockchip_saradc.c | 2 + drivers/iio/adc/ti-ads124s08.c | 4 +- drivers/iio/adc/ti-ads8688.c | 2 +- drivers/iio/dummy/iio_simple_dummy_buffer.c | 2 +- drivers/iio/gyro/fxas21002c_core.c | 11 ++- drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 18 +++- drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c | 3 +- drivers/iio/imu/kmx61.c | 2 +- drivers/iio/inkern.c | 2 +- drivers/iio/light/vcnl4035.c | 2 +- drivers/iio/pressure/zpa2326.c | 2 + drivers/infiniband/hw/hns/hns_roce_main.c | 1 + drivers/infiniband/hw/hns/hns_roce_srq.c | 6 +- drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 2 +- drivers/irqchip/irq-gic-v3.c | 2 +- drivers/irqchip/irq-sunxi-nmi.c | 3 +- drivers/md/dm-ebs-target.c | 2 +- drivers/md/dm-thin.c | 5 +- drivers/md/persistent-data/dm-array.c | 19 +++-- drivers/md/raid5.c | 14 ++-- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 19 +---- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 95 ++++++++++++++++++---- drivers/net/ethernet/netronome/nfp/bpf/offload.c | 3 +- drivers/net/ethernet/ti/cpsw_ale.c | 14 ++-- drivers/net/gtp.c | 42 ++++++---- drivers/net/ieee802154/ca8210.c | 6 +- drivers/net/wireless/intel/iwlwifi/dvm/rs.c | 7 +- drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 9 +- drivers/nvme/host/core.c | 5 +- drivers/nvme/target/io-cmd-bdev.c | 2 +- drivers/pci/controller/pci-host-common.c | 4 + drivers/pci/probe.c | 20 +++-- drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c | 53 +++++++++--- drivers/phy/broadcom/phy-brcm-usb-init.h | 1 - drivers/phy/broadcom/phy-brcm-usb.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 4 +- drivers/scsi/sd.c | 9 +- drivers/scsi/sg.c | 2 +- drivers/staging/iio/frequency/ad9832.c | 2 +- drivers/staging/iio/frequency/ad9834.c | 2 +- drivers/usb/class/usblp.c | 7 +- drivers/usb/core/hub.c | 6 +- drivers/usb/core/port.c | 7 +- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/gadget.c | 4 +- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/option.c | 4 +- drivers/usb/serial/quatech2.c | 2 +- drivers/usb/storage/unusual_devs.h | 7 ++ drivers/vfio/platform/vfio_platform_common.c | 10 +++ fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 +- fs/afs/vlclient.c | 2 +- fs/ceph/mds_client.c | 9 +- fs/exfat/dir.c | 3 +- fs/file.c | 1 + fs/gfs2/file.c | 1 + fs/hfs/super.c | 4 +- fs/jbd2/commit.c | 4 +- fs/nfsd/filecache.c | 18 ++-- fs/nfsd/filecache.h | 1 + fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/quota_local.c | 10 +-- fs/proc/vmcore.c | 2 + include/drm/drm_mipi_dsi.h | 4 + include/linux/blk-cgroup.h | 6 +- include/linux/genhd.h | 3 +- include/linux/hrtimer.h | 1 + include/linux/mlx5/device.h | 2 + include/linux/mlx5/fs.h | 2 + include/linux/poll.h | 10 ++- include/linux/seccomp.h | 2 +- include/net/inet_connection_sock.h | 2 +- include/net/net_namespace.h | 3 + include/net/netfilter/nf_tables.h | 2 + kernel/cpu.c | 2 +- kernel/gen_kheaders.sh | 1 + kernel/time/hrtimer.c | 11 ++- mm/vmalloc.c | 3 +- net/802/psnap.c | 4 +- net/bluetooth/rfcomm/sock.c | 14 ++-- net/core/filter.c | 30 ++++--- net/core/net_namespace.c | 83 ++++++++++++------- net/dccp/ipv6.c | 2 +- net/ipv4/fou.c | 2 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv6/route.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +- net/mac802154/iface.c | 4 + net/netfilter/nf_conntrack_core.c | 5 +- net/netfilter/nf_tables_api.c | 38 ++++++++- net/netfilter/nft_dynset.c | 7 +- net/sched/cls_flow.c | 3 +- net/sched/sch_ets.c | 2 + net/sctp/sysctl.c | 9 +- net/tls/tls_sw.c | 2 +- net/vmw_vsock/af_vsock.c | 15 ++++ net/vmw_vsock/virtio_transport_common.c | 38 ++++++--- scripts/sorttable.h | 10 ++- sound/soc/codecs/Kconfig | 1 + .../soc/mediatek/common/mtk-afe-platform-driver.c | 4 +- sound/soc/samsung/Kconfig | 6 +- 134 files changed, 806 insertions(+), 350 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/133 ceph: give up on paths longer than PATH_MAX
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
commit 550f7ca98ee028a606aa75705a7e77b1bd11720f upstream.
If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effective DoS vulnerability.
I cannot imagine why this retry was ever implemented, but it seems rather useless and harmful to me. Let's remove it and fail with ENAMETOOLONG instead.
--- fs/ceph/mds_client.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
fs/ceph/mds_client.c +4 -5
@@ -2451,12 +2451,11 @@ retry:if (pos <0 ) {/* -* A rename didn't occur, but somehow we didn't end up where -* we thought we would. Throw a warning and try again. +* The path is longer than PATH_MAX and this function +* cannot ever succeed. Creating paths that long is +* possible with Ceph, but Linux cannot use them. */ -pr_warn ("build_path did not end path lookup where " -"expected, pos is %d\n" , pos); - goto retry; +return ERR_PTR (-ENAMETOOLONG ); } *pbase = base;
Greg Kroah-Hartman
maintainerPATCH 2/133 jbd2: flush filesystem device before updating tail sequence
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit a0851ea9cd555c333795b85ddd908898b937c4e1 ]
When committing transaction in jbd2_journal_commit_transaction(), the disk caches for the filesystem device should be flushed before updating the journal tail sequence. However, this step is missed if the journal is not located on the filesystem device. As a result, the filesystem may become inconsistent following a power failure or system crash. Fix it by ensuring that the filesystem device is flushed appropriately.
--- fs/jbd2/commit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/jbd2/commit.c +2 -2
@@ -823,9 +823,9 @@ void jbd2_journal_commit_transaction(journal_t *journal)/* * If the journal is not located on the file system device, * then we must flush the file system device before we issue -* the commit record +* the commit record and update the journal tail sequence. */ -if (commit_transaction->t_need_data_flush && +if ((commit_transaction->t_need_data_flush || update_tail) && (journal->j_fs_dev != journal->j_dev) && (journal->j_flags &JBD2_BARRIER ))blkdev_issue_flush (journal->j_fs_dev,GFP_NOFS );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/133 dm array: fix releasing a faulty array block twice in dm_array_cursor_end
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit f2893c0804d86230ffb8f1c8703fdbb18648abc8 ]
When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().
Reproduce steps:
1. initialize a cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1
dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
2. wipe the second array block offline
dmsteup remove cache cmeta cdata corig
mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \
2>/dev/null | hexdump -e '1/8 "%u\n"')
ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \
2>/dev/null | hexdump -e '1/8 "%u\n"')
dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock
3. try reopen the cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
Kernel logs:
(snip)
device-mapper: array: array_block_check failed: blocknr 0 != wanted 10
device-mapper: block manager: array validator check failed for block 10
device-mapper: array: get_ablock failed
device-mapper: cache metadata: dm_array_cursor_next for mapping failed
------------[ cut here ]------------ kernel BUG at drivers/md/dm-bufio.c:638!
Fix by setting the cached block pointer to NULL on errors.
In addition to the reproducer described above, this fix can be verified using the "array_cursor/damaged" test in dm-unit:
dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>
--- drivers/md/persistent-data/dm-array.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/md/persistent-data/dm-array.c +8 -4
@@ -907,23 +907,27 @@ static int load_ablock(struct dm_array_cursor *c)if (c->block)unlock_ablock (c->info, c->block); - c->block =NULL ; - c->ab =NULL ; c->index =0 ; r =dm_btree_cursor_get_value (&c->cursor, &key, &value_le);if (r) {DMERR ("dm_btree_cursor_get_value failed" ); -dm_btree_cursor_end (&c->cursor); + goto out; }else { r =get_ablock (c->info,le64_to_cpu (value_le), &c->block, &c->ab);if (r) {DMERR ("get_ablock failed" ); -dm_btree_cursor_end (&c->cursor); + goto out; } } +return 0 ; + +out: +dm_btree_cursor_end (&c->cursor); + c->block =NULL ; + c->ab =NULL ;return r; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/133 dm array: fix unreleased btree blocks on closing a faulty array cursor
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit 626f128ee9c4133b1cfce4be2b34a1508949370e ]
The cached block pointer in dm_array_cursor might be NULL if it reaches an unreadable array block, or the array is empty. Therefore, dm_array_cursor_end() should call dm_btree_cursor_end() unconditionally, to prevent leaving unreleased btree blocks.
This fix can be verified using the "array_cursor/iterate/empty" test in dm-unit:
dm-unit run /pdata/array_cursor/iterate/empty --kernel-dir <KERNEL_DIR>
--- drivers/md/persistent-data/dm-array.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/md/persistent-data/dm-array.c +3 -3
@@ -950,10 +950,10 @@ EXPORT_SYMBOL_GPL(dm_array_cursor_begin);void dm_array_cursor_end (struct dm_array_cursor *c) { -if (c->block) { +if (c->block)unlock_ablock (c->info, c->block); -dm_btree_cursor_end (&c->cursor); - } + +dm_btree_cursor_end (&c->cursor); }EXPORT_SYMBOL_GPL (dm_array_cursor_end);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/133 dm array: fix cursor index when skipping across block boundaries
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <[email protected]>
[ Upstream commit 0bb1968da2737ba68fd63857d1af2b301a18d3bf ]
dm_array_cursor_skip() seeks to the target position by loading array blocks iteratively until the specified number of entries to skip is reached. When seeking across block boundaries, it uses dm_array_cursor_next() to step into the next block. dm_array_cursor_skip() must first move the cursor index to the end of the current block; otherwise, the cursor position could incorrectly remain in the same block, causing the actual number of skipped entries to be much smaller than expected.
This bug affects cache resizing in v2 metadata and could lead to data loss if the fast device is shrunk during the first-time resume. For example:
1. create a cache metadata consists of 32768 blocks, with a dirty block assigned to the second bitmap block. cache_restore v1.0 is required.
cat <<EOF >> cmeta.xml
<superblock uuid="" block_size="64" nr_cache_blocks="32768" \
policy="smq" hint_width="4">
<mappings>
<mapping cache_block="32767" origin_block="0" dirty="true"/>
</mappings>
</superblock>
EOF
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2
2. bring up the cache while attempt to discard all the blocks belonging to the second bitmap block (block# 32576 to 32767). The last command is expected to fail, but it actually succeeds.
dmsetup create cdata --table "0 2084864 linear /dev/sdc 8192" dmsetup create corig --table "0 65536 linear /dev/sdc 2105344" dmsetup create cache --table "0 65536 cache /dev/mapper/cmeta \/dev/mapper/cdata /dev/mapper/corig 64 2 metadata2 writeback smq \
2 migration_threshold 0"
In addition to the reproducer described above, this fix can be verified using the "array_cursor/skip" tests in dm-unit:
dm-unit run /pdata/array_cursor/skip/ --kernel-dir <KERNEL_DIR>
--- drivers/md/persistent-data/dm-array.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/persistent-data/dm-array.c +1 -0
@@ -993,6 +993,7 @@ int dm_array_cursor_skip(struct dm_array_cursor *c, uint32_t count) } count -= remaining; + c->index += (remaining -1 ); r =dm_array_cursor_next (c); }while (!r);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/133 exfat: fix the infinite loop in exfat_readdir()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit fee873761bd978d077d8c55334b4966ac4cb7b59 ]
If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop.
This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs().
This commit stops traversing the cluster chain when there is unused directory entry in the cluster to avoid this infinite loop.
--- fs/exfat/dir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/exfat/dir.c +2 -1
@@ -125,7 +125,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent type =exfat_get_entry_type (ep);if (type ==TYPE_UNUSED ) {brelse (bh); -break ; + goto out; }if (type !=TYPE_FILE && type !=TYPE_DIR ) {
@@ -185,6 +185,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent } } +out: dir_entry->namebuf.lfn[0 ] ='\0' ; *cpos =EXFAT_DEN_TO_B (dentry);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/133 ASoC: mediatek: disable buffer pre-allocation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 32c9c06adb5b157ef259233775a063a43746d699 ]
On Chromebooks based on Mediatek MT8195 or MT8188, the audio frontend (AFE) is limited to accessing a very small window (1 MiB) of memory, which is described as a reserved memory region in the device tree.
On these two platforms, the maximum buffer size is given as 512 KiB. The MediaTek common code uses the same value for preallocations. This means that only the first two PCM substreams get preallocations, and then the whole space is exhausted, barring any other substreams from working. Since the substreams used are not always the first two, this means audio won't work correctly.
This is observed on the MT8188 Geralt Chromebooks, on which the "mediatek,dai-link" property was dropped when it was upstreamed. That property causes the driver to only register the PCM substreams listed in the property, and in the order given.
Instead of trying to compute an optimal value and figuring out which streams are used, simply disable preallocation. The PCM buffers are managed by the core and are allocated and released on the fly. There should be no impact to any of the other MediaTek platforms.
--- sound/soc/mediatek/common/mtk-afe-platform-driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/mediatek/common/mtk-afe-platform-driver.c +2 -2
@@ -120,8 +120,8 @@ int mtk_afe_pcm_new(struct snd_soc_component *component,struct mtk_base_afe *afe =snd_soc_component_get_drvdata (component); size = afe->mtk_afe_hardware->buffer_bytes_max; -snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , - afe->dev, size, size); +snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , afe->dev,0 , size); +return 0 ; }EXPORT_SYMBOL_GPL (mtk_afe_pcm_new);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/133 netfilter: nft_dynset: honor stateful expressions in set definition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit fca05d4d61e65fa573a3768f9019a42143c03349 upstream.
If the set definition contains stateful expressions, allocate them for the newly added entries from the packet path.
[ This backport includes nft_set_elem_expr_clone() which has been
taken from 8cfd9b0f8515 ("netfilter: nftables: generalize set expressions support") and skip redundant expressions when set already provides it per ce5379963b28 ("netfilter: nft_dynset: dump expressions when set definition contains no expressions") ]
--- include/net/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 23 +++++++++++++++++++++++ net/netfilter/nft_dynset.c | 7 ++++++- 3 files changed, 31 insertions(+), 1 deletion(-)
include/net/netfilter/nf_tables.h +2 -0
@@ -734,6 +734,8 @@ void *nft_set_elem_init(const struct nft_set *set,const struct nft_set_ext_tmpl *tmpl, const u32 *key, const u32 *key_end, const u32 *data, u64 timeout, u64 expiration, gfp_t gfp); +int nft_set_elem_expr_clone (const struct nft_ctx *ctx,struct nft_set *set, +struct nft_expr **pexpr);void nft_set_elem_destroy (const struct nft_set *set,void *elem,bool destroy_expr); void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
net/netfilter/nf_tables_api.c +23 -0
@@ -5548,6 +5548,29 @@ static int nft_set_elem_expr_setup(struct nft_ctx *ctx,return 0 ; } +int nft_set_elem_expr_clone (const struct nft_ctx *ctx,struct nft_set *set, +struct nft_expr **pexpr) +{ +struct nft_expr *expr; +int err; + + expr =kzalloc (set->expr->ops->size,GFP_KERNEL ); +if (!expr) + goto err_expr; + + err =nft_expr_clone (expr, set->expr,GFP_KERNEL ); +if (err <0 ) { +kfree (expr); + goto err_expr; + } + *pexpr = expr; + +return 0 ; + +err_expr: +return -ENOMEM ; +} +static int nft_add_set_elem (struct nft_ctx *ctx,struct nft_set *set,const struct nlattr *attr,u32 nlmsg_flags) {
net/netfilter/nft_dynset.c +6 -1
@@ -192,6 +192,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx, err = -EOPNOTSUPP ; goto err_expr_free; } + }else if (set->expr) { + err =nft_set_elem_expr_clone (ctx, set, &priv->expr); +if (err <0 ) +return err; }nft_set_ext_prepare (&priv->tmpl);
@@ -272,7 +276,8 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr) nf_jiffies64_to_msecs(priv->timeout), NFTA_DYNSET_PAD)) goto nla_put_failure; -if (priv->expr &&nft_expr_dump (skb,NFTA_DYNSET_EXPR , priv->expr)) +if (!priv->set->expr && priv->expr && +nft_expr_dump (skb,NFTA_DYNSET_EXPR , priv->expr)) goto nla_put_failure;if (nla_put_be32 (skb,NFTA_DYNSET_FLAGS ,htonl (flags))) goto nla_put_failure;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/133 ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keisuke Nishimura <[email protected]>
[ Upstream commit 2c87309ea741341c6722efdf1fb3f50dd427c823 ]
ca8210_test_interface_init() returns the result of kfifo_alloc(), which can be non-zero in case of an error. The caller, ca8210_probe(), should check the return value and do error-handling if it fails.
--- drivers/net/ieee802154/ca8210.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ieee802154/ca8210.c +5 -1
@@ -3125,7 +3125,11 @@ static int ca8210_probe(struct spi_device *spi_device)spi_set_drvdata (priv->spi, priv);if (IS_ENABLED (CONFIG_IEEE802154_CA8210_DEBUGFS )) { cascoda_api_upstream = ca8210_test_int_driver_write; -ca8210_test_interface_init (priv); + ret =ca8210_test_interface_init (priv); +if (ret) { +dev_crit (&spi_device->dev,"ca8210_test_interface_init failed\n" ); + goto error; + } }else { cascoda_api_upstream =NULL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/133 net: 802: LLC+SNAP OID:PID lookup on start of skb data
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Pastor <[email protected]>
[ Upstream commit 1e9b0e1c550c42c13c111d1a31e822057232abc4 ]
802.2+LLC+SNAP frames received by napi_complete_done() with GRO and DSA have skb->transport_header set two bytes short, or pointing 2 bytes before network_header & skb->data. This was an issue as snap_rcv() expected offset to point to SNAP header (OID:PID), causing packet to be dropped.
A fix at llc_fixup_skb() (a024e377efed) resets transport_header for any LLC consumers that may care about it, and stops SNAP packets from being dropped, but doesn't fix the problem which is that LLC and SNAP should not use transport_header offset.
Ths patch eliminates the use of transport_header offset for SNAP lookup of OID:PID so that SNAP does not rely on the offset at all. The offset is reset after pull for any SNAP packet consumers that may (but shouldn't) use it.
--- net/802/psnap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/802/psnap.c +2 -2
@@ -55,11 +55,11 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, goto drop;rcu_read_lock (); - proto =find_snap_client (skb_transport_header (skb)); + proto =find_snap_client (skb->data);if (proto) {/* Pass the frame on. */ - skb->transport_header +=5 ;skb_pull_rcsum (skb,5 ); +skb_reset_transport_header (skb); rc = proto->rcvfunc (skb, dev, &snap_packet_type, orig_dev); }rcu_read_unlock ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/133 tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 9a79c65f00e2b036e17af3a3a607d7d732b7affb ]
Since commit 099ecf59f05b ("net: annotate lockless accesses to sk->sk_max_ack_backlog") decided to handle the sk_max_ack_backlog locklessly, there is one more function mostly called in TCP/DCCP cases. So this patch completes it:)
Stable-dep-of: 3479c7549fb1 ("tcp/dccp: allow a connection when sk_max_ack_backlog is zero")
--- include/net/inet_connection_sock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/inet_connection_sock.h +1 -1
@@ -282,7 +282,7 @@ static inline int inet_csk_reqsk_queue_len(const struct sock *sk)static inline int inet_csk_reqsk_queue_is_full (const struct sock *sk) { -return inet_csk_reqsk_queue_len (sk) >= sk->sk_max_ack_backlog; +return inet_csk_reqsk_queue_len (sk) >=READ_ONCE (sk->sk_max_ack_backlog); }bool inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/133 tcp/dccp: allow a connection when sk_max_ack_backlog is zero
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Duan <[email protected]>
[ Upstream commit 3479c7549fb1dfa7a1db4efb7347c7b8ef50de4b ]
If the backlog of listen() is set to zero, sk_acceptq_is_full() allows one connection to be made, but inet_csk_reqsk_queue_is_full() does not. When the net.ipv4.tcp_syncookies is zero, inet_csk_reqsk_queue_is_full() will cause an immediate drop before the sk_acceptq_is_full() check in tcp_conn_request(), resulting in no connection can be made.
This patch tries to keep consistent with 64a146513f8f ("[NET]: Revert incorrect accept queue backlog changes.").
--- include/net/inet_connection_sock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/inet_connection_sock.h +1 -1
@@ -282,7 +282,7 @@ static inline int inet_csk_reqsk_queue_len(const struct sock *sk)static inline int inet_csk_reqsk_queue_is_full (const struct sock *sk) { -return inet_csk_reqsk_queue_len (sk) >=READ_ONCE (sk->sk_max_ack_backlog); +return inet_csk_reqsk_queue_len (sk) >READ_ONCE (sk->sk_max_ack_backlog); }bool inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/133 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit a039e54397c6a75b713b9ce7894a62e06956aa92 ]
syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values.
UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1771 [inline] tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867 sfb_classify net/sched/sch_sfb.c:260 [inline] sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318 dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793 __dev_xmit_skb net/core/dev.c:3889 [inline] __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173 geneve_xmit_skb drivers/net/geneve.c:916 [inline] geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
--- net/sched/cls_flow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/cls_flow.c +2 -1
@@ -354,7 +354,8 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = { [TCA_FLOW_KEYS] = { .type = NLA_U32 }, [TCA_FLOW_MODE] = { .type = NLA_U32 }, [TCA_FLOW_BASECLASS] = { .type = NLA_U32 }, - [TCA_FLOW_RSHIFT] = { .type = NLA_U32 }, + [TCA_FLOW_RSHIFT ] =NLA_POLICY_MAX (NLA_U32 , + 31 /* BITS_PER_U32 - 1 */), [TCA_FLOW_ADDEND] = { .type = NLA_U32 }, [TCA_FLOW_MASK] = { .type = NLA_U32 }, [TCA_FLOW_XOR] = { .type = NLA_U32 },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/133 cxgb4: Avoid removal of uninserted tid
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anumula Murali Mohan Reddy <[email protected]>
[ Upstream commit 4c1224501e9d6c5fd12d83752f1c1b444e0e3418 ]
During ARP failure, tid is not inserted but _c4iw_free_ep() attempts to remove tid which results in error.
This patch fixes the issue by avoiding removal of uninserted tid.
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +4 -1
@@ -1800,7 +1800,10 @@ void cxgb4_remove_tid(struct tid_info *t, unsigned int chan, unsigned int tid, struct adapter *adap = container_of(t, struct adapter, tids);struct sk_buff *skb; -WARN_ON (tid_out_of_range (&adap->tids, tid)); +if (tid_out_of_range (&adap->tids, tid)) { +dev_err (adap->pdev_dev,"tid %d out of range\n" , tid); +return ; + }if (t->tid_tab[tid - adap->tids.tid_base]) { t->tid_tab[tid - adap->tids.tid_base] =NULL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/133 tls: Fix tls_sw_sendmsg error handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
[ Upstream commit b341ca51d2679829d26a3f6a4aa9aee9abd94f92 ]
We've noticed that NFS can hang when using RPC over TLS on an unstable connection, and investigation shows that the RPC layer is stuck in a tight loop attempting to transmit, but forever getting -EBADMSG back from the underlying network. The loop begins when tcp_sendmsg_locked() returns -EPIPE to tls_tx_records(), but that error is converted to -EBADMSG when calling the socket's error reporting handler.
Instead of converting errors from tcp_sendmsg_locked(), let's pass them along in this path. The RPC layer handles -EPIPE by reconnecting the transport, which prevents the endless attempts to transmit on a broken connection.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -428,7 +428,7 @@ int tls_tx_records(struct sock *sk, int flags) tx_err:if (rc <0 && rc != -EAGAIN ) -tls_err_abort (sk, -EBADMSG ); +tls_err_abort (sk, rc);return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/133 netfilter: nf_tables: imbalance in flowtable binding
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 13210fc63f353fe78584048079343413a3cdf819 ]
All these cases cause imbalance between BIND and UNBIND calls:
- Delete an interface from a flowtable with multiple interfaces
- Add a (device to a) flowtable with --check flag
- Delete a netns containing a flowtable
- In an interactive nft session, create a table with owner flag and flowtable inside, then quit.
Fix it by calling FLOW_BLOCK_UNBIND when unregistering hooks, then remove late FLOW_BLOCK_UNBIND call when destroying flowtable.
--- net/netfilter/nf_tables_api.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +11 -4
@@ -7006,6 +7006,7 @@ static void nft_unregister_flowtable_hook(struct net *net, }static void __nft_unregister_flowtable_net_hooks (struct net *net, +struct nft_flowtable *flowtable,struct list_head *hook_list,bool release_netdev) {
@@ -7013,6 +7014,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net,list_for_each_entry_safe (hook, next, hook_list, list) {nf_unregister_net_hook (net, &hook->ops); + flowtable->data.type->setup (&flowtable->data, hook->ops.dev, +FLOW_BLOCK_UNBIND );if (release_netdev) {list_del (&hook->list);kfree_rcu (hook, rcu);
@@ -7021,9 +7024,10 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, }static void nft_unregister_flowtable_net_hooks (struct net *net, +struct nft_flowtable *flowtable,struct list_head *hook_list) { -__nft_unregister_flowtable_net_hooks (net, hook_list, false); +__nft_unregister_flowtable_net_hooks (net, flowtable, hook_list, false); } static int nft_register_flowtable_net_hooks(struct net *net,
@@ -7645,8 +7649,6 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) flowtable->data.type->free (&flowtable->data);list_for_each_entry_safe (hook, next, &flowtable->hook_list, list) { - flowtable->data.type->setup (&flowtable->data, hook->ops.dev, -FLOW_BLOCK_UNBIND );list_del_rcu (&hook->list);kfree_rcu (hook, rcu); }
@@ -8787,6 +8789,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) &nft_trans_flowtable_hooks (trans), NFT_MSG_DELFLOWTABLE);nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable_hooks (trans)); }else {list_del_rcu (&nft_trans_flowtable (trans)->list);
@@ -8795,6 +8798,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) &nft_trans_flowtable (trans)->hook_list, NFT_MSG_DELFLOWTABLE);nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable (trans)->hook_list); }break ;
@@ -9014,11 +9018,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)case NFT_MSG_NEWFLOWTABLE :if (nft_trans_flowtable_update (trans)) {nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable_hooks (trans)); }else {nft_use_dec_restore (&trans->ctx.table->use);list_del_rcu (&nft_trans_flowtable (trans)->list);nft_unregister_flowtable_net_hooks (net, +nft_trans_flowtable (trans), &nft_trans_flowtable (trans)->hook_list); }break ;
@@ -9582,7 +9588,8 @@ static void __nft_release_hook(struct net *net, struct nft_table *table)list_for_each_entry (chain, &table->chains, list)__nf_tables_unregister_hook (net, table, chain, true);list_for_each_entry (flowtable, &table->flowtables, list) -__nft_unregister_flowtable_net_hooks (net, &flowtable->hook_list, +__nft_unregister_flowtable_net_hooks (net, flowtable, + &flowtable->hook_list, true); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/133 netfilter: conntrack: clamp maximum hashtable size to INT_MAX
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 ]
Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See:
0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")
Note: hashtable resize is only possible from init_netns.
--- net/netfilter/nf_conntrack_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_core.c +4 -1
@@ -2435,12 +2435,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)struct hlist_nulls_head *hash;unsigned int nr_slots, i; -if (*sizep > (UINT_MAX /sizeof (struct hlist_nulls_head ))) +if (*sizep > (INT_MAX /sizeof (struct hlist_nulls_head )))return NULL ;BUILD_BUG_ON (sizeof (struct hlist_nulls_head ) !=sizeof (struct hlist_head )); nr_slots = *sizep =roundup (*sizep,PAGE_SIZE /sizeof (struct hlist_nulls_head )); +if (nr_slots > (INT_MAX /sizeof (struct hlist_nulls_head ))) +return NULL ; + hash =kvcalloc (nr_slots,sizeof (struct hlist_nulls_head ),GFP_KERNEL );if (hash && nulls)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/133 afs: Fix the maximum cell name length
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8 ]
The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning:
WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405
because procfs limits the maximum filename length to 255.
However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL).
Fix this by limiting the maximum acceptable cellname length to 253. This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too.
Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253.
--- fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 ++++++-- fs/afs/vlclient.c | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-)
fs/afs/afs.h +1 -1
@@ -10,7 +10,7 @@#include <linux/in.h> -#define AFS_MAXCELLNAME 256/* Maximum length of a cell name */ +#define AFS_MAXCELLNAME 253/* Maximum length of a cell name (DNS limited) */ #define AFS_MAXVOLNAME 64/* Maximum length of a volume name */ #define AFS_MAXNSERVERS 8/* Maximum servers in a basic volume record */ #define AFS_NMAXNSERVERS 13/* Maximum servers in a N/U-class volume record */
fs/afs/afs_vl.h +1 -0
@@ -13,6 +13,7 @@#define AFS_VL_PORT 7003/* volume location service port */ #define VL_SERVICE 52/* RxRPC service ID for the Volume Location service */ #define YFS_VL_SERVICE 2503/* Service ID for AuriStor upgraded VL service */ +#define YFS_VL_MAXCELLNAME 256/* Maximum length of a cell name in YFS protocol */ enum AFSVL_Operations {VLGETENTRYBYID =503 ,/* AFS Get VLDB entry by ID */
fs/afs/vl_alias.c +6 -2
@@ -302,6 +302,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key)static int yfs_check_canonical_cell_name (struct afs_cell *cell,struct key *key) {struct afs_cell *master; +size_t name_len;char *cell_name; cell_name =afs_vl_get_cell_name (cell, key);
@@ -313,8 +314,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key)return 0 ; } - master =afs_lookup_cell (cell->net, cell_name,strlen (cell_name), -NULL , false); + name_len =strlen (cell_name); +if (!name_len || name_len >AFS_MAXCELLNAME ) + master =ERR_PTR (-EOPNOTSUPP ); +else + master =afs_lookup_cell (cell->net, cell_name, name_len,NULL , false);kfree (cell_name);if (IS_ERR (master))return PTR_ERR (master);
fs/afs/vlclient.c +1 -1
@@ -670,7 +670,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call)return ret; namesz =ntohl (call->tmp); -if (namesz >AFS_MAXCELLNAME ) +if (namesz >YFS_VL_MAXCELLNAME )return afs_protocol_error (call, afs_eproto_cellname_len); paddedsz = (namesz +3 ) & ~3 ; call->count = namesz;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/133 dm thin: make get_first_thin use rcu-safe list first function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krister Johansen <[email protected]>
commit 80f130bfad1dab93b95683fc39b87235682b8f72 upstream.
The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty() -> list_first() sequence in RCU safe code. This is because each of these functions performs its own READ_ONCE() of the list head. This can lead to a situation where the list_empty() sees a valid list entry, but the subsequent list_first() sees a different view of list head state after a modification.
In the case of dm-thin, this author had a production box crash from a GP fault in the process_deferred_bios path. This function saw a valid list head in get_first_thin() but when it subsequently dereferenced that and turned it into a thin_c, it got the inside of the struct pool, since the list was now empty and referring to itself. The kernel on which this occurred printed both a warning about a refcount_t being saturated, and a UBSAN error for an out-of-bounds cpuid access in the queued spinlock, prior to the fault itself. When the resulting kdump was examined, it was possible to see another thread patiently waiting in thin_dtr's synchronize_rcu.
The thin_dtr call managed to pull the thin_c out of the active thins list (and have it be the last entry in the active_thins list) at just the wrong moment which lead to this crash.
Fortunately, the fix here is straight forward. Switch get_first_thin() function to use list_first_or_null_rcu() which performs just a single READ_ONCE() and returns NULL if the list is already empty.
This was run against the devicemapper test suite's thin-provisioning suites for delete and suspend and no regressions were observed.
--- drivers/md/dm-thin.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/md/dm-thin.c +2 -3
@@ -2317,10 +2317,9 @@ static struct thin_c *get_first_thin(strstruct thin_c *tc =NULL ;rcu_read_lock (); -if (!list_empty (&pool->active_thins)) { - tc = list_entry_rcu(pool->active_thins.next, struct thin_c, list); + tc = list_first_or_null_rcu(&pool->active_thins, struct thin_c, list); +if (tc)thin_get (tc); - }rcu_read_unlock ();return tc;
Greg Kroah-Hartman
maintainerPATCH 20/133 dm-ebs: dont set the flag DM_TARGET_PASSES_INTEGRITY
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 47f33c27fc9565fb0bc7dfb76be08d445cd3d236 upstream.
dm-ebs uses dm-bufio to process requests that are not aligned on logical sector size. dm-bufio doesn't support passing integrity data (and it is unclear how should it do it), so we shouldn't set the DM_TARGET_PASSES_INTEGRITY flag.
--- drivers/md/dm-ebs-target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-ebs-target.c +1 -1
@@ -437,7 +437,7 @@ static int ebs_iterate_devices(struct dmstatic struct target_type ebs_target = { .name ="ebs" , .version = {1 ,0 ,1 }, - .features =DM_TARGET_PASSES_INTEGRITY , + .features =0 , .module =THIS_MODULE , .ctr = ebs_ctr, .dtr = ebs_dtr,
Greg Kroah-Hartman
maintainerPATCH 21/133 sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit ea62dd1383913b5999f3d16ae99d411f41b528d4 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.sctp_hmac_alg' is used.
--- net/sctp/sysctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sysctl.c +2 -1
@@ -350,7 +350,8 @@ static struct ctl_table sctp_net_table[]static int proc_sctp_do_hmac_alg (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, + sctp.sctp_hmac_alg);struct ctl_table tbl;bool changed = false;char *none ="none" ;
Greg Kroah-Hartman
maintainerPATCH 22/133 sctp: sysctl: auth_enable: avoid using current->nsproxy
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 15649fd5415eda664ef35780c2013adeb5d9c695 upstream.
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
--- net/sctp/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/sysctl.c +1 -1
@@ -462,7 +462,7 @@ static int proc_sctp_do_alpha_beta(strucstatic int proc_sctp_do_auth (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.auth_enable);struct ctl_table tbl;int new_value, ret;
Greg Kroah-Hartman
maintainerPATCH 23/133 drm/amd/display: Add check for granularity in dml ceil/floor helpers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Li <[email protected]>
commit 0881fbc4fd62e00a2b8e102725f76d10351b2ea8 upstream.
[Why]
Wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert and divide-by-zero error in dcn_bw_ functions.
[How]
Add check for granularity 0.
--- drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h +8 -0
@@ -66,11 +66,15 @@ static inline double dml_max5(double a,static inline double dml_ceil (double a,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_ceil2 (a, granularity); }static inline double dml_floor (double a,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_floor2 (a, granularity); }
@@ -119,11 +123,15 @@ static inline double dml_ceil_2(double fstatic inline double dml_ceil_ex (double x,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_ceil2 (x, granularity); }static inline double dml_floor_ex (double x,double granularity) { +if (granularity ==0 ) +return 0 ;return (double )dcn_bw_floor2 (x, granularity); }
Greg Kroah-Hartman
maintainerPATCH 24/133 riscv: Fix sleeping in invalid context in die()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 6a97f4118ac07cfdc316433f385dbdc12af5025e upstream.
die() can be called in exception handler, and therefore cannot sleep. However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled. That causes the following warning:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex
preempt_count: 110001, expected: 0
RCU nest depth: 0, expected: 0
CPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
dump_backtrace+0x1c/0x24
show_stack+0x2c/0x38
dump_stack_lvl+0x5a/0x72
dump_stack+0x14/0x1c
__might_resched+0x130/0x13a
rt_spin_lock+0x2a/0x5c
die+0x24/0x112
do_trap_insn_illegal+0xa0/0xea
_new_vmalloc_restore_context_a0+0xcc/0xd8Oops - illegal instruction [#1]
Switch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT enabled.
--- arch/riscv/kernel/traps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/riscv/kernel/traps.c +3 -3
@@ -25,7 +25,7 @@ int show_unhandled_signals = 1; extern asmlinkage void handle_exception(void); -static DEFINE_SPINLOCK (die_lock); +static DEFINE_RAW_SPINLOCK (die_lock);void die (struct pt_regs *regs,const char *str) {
@@ -36,7 +36,7 @@ void die(struct pt_regs *regs, const chaoops_enter (); -spin_lock_irqsave (&die_lock, flags); +raw_spin_lock_irqsave (&die_lock, flags);console_verbose ();bust_spinlocks (1 );
@@ -53,7 +53,7 @@ void die(struct pt_regs *regs, const chabust_spinlocks (0 );add_taint (TAINT_DIE ,LOCKDEP_NOW_UNRELIABLE ); -spin_unlock_irqrestore (&die_lock, flags); +raw_spin_unlock_irqrestore (&die_lock, flags);oops_exit ();if (in_interrupt ())
Greg Kroah-Hartman
maintainerPATCH 25/133 ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 7ed4e4a659d99499dc6968c61970d41b64feeac0 upstream.
The TongFang GM5HG0A is a TongFang barebone design which is sold under various brand names.
The ACPI IRQ override for the keyboard IRQ must be used on these AMD Zen laptops in order for the IRQ to work.
At least on the SKIKK Vanaheim variant the DMI product- and board-name strings have been replaced by the OEM with "Vanaheim" so checking that board-name contains "GM5HG0A" as is usually done for TongFang barebones quirks does not work.
The DMI OEM strings do contain "GM5HG0A". I have looked at the dmidecode for a few other TongFang devices and the TongFang code-name string being in the OEM strings seems to be something which is consistently true.
Add a quirk checking one of the DMI_OEM_STRING(s) is "GM5HG0A" in the hope that this will work for other OEM versions of the "GM5HG0A" too.
--- drivers/acpi/resource.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/acpi/resource.c +11 -0
@@ -514,6 +514,17 @@ static const struct dmi_system_id asus_l DMI_MATCH(DMI_BOARD_NAME, "16T90SP"), }, }, + { +/* +* TongFang GM5HG0A in case of the SKIKK Vanaheim relabel the +* board-name is changed, so check OEM strings instead. Note +* OEM string matches are always exact matches. +* https://bugzilla.kernel.org/show_bug.cgi?id=219614 +*/ + .matches = { + DMI_EXACT_MATCH(DMI_OEM_STRING, "GM5HG0A"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 26/133 ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 66d337fede44dcbab4107d37684af8fcab3d648e upstream.
Like the Vivobook X1704VAP the X1504VAP has its keyboard IRQ (1) described as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which breaks the keyboard.
Add the X1504VAP to the irq1_level_low_skip_override[] quirk table to fix this.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -443,6 +443,13 @@ static const struct dmi_system_id asus_l }, }, { +/* Asus Vivobook X1504VAP */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "X1504VAP"), + }, + }, + {/* Asus Vivobook X1704VAP */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
Greg Kroah-Hartman
maintainerPATCH 27/133 drm/amd/display: increase MAX_SURFACES to the value supported by hw
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melissa Wen <[email protected]>
commit 21541bc6b44241e3f791f9e552352d8440b2b29e upstream.
As the hw supports up to 4 surfaces, increase the maximum number of surfaces to prevent the DC error when trying to use more than three planes.
[drm:dc_state_add_plane [amdgpu]] *ERROR* Surface: can not attach plane_state 000000003e2cb82c! Maximum is: 3
--- drivers/gpu/drm/amd/display/dc/dc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dc.h +1 -1
@@ -44,7 +44,7 @@#define DC_VER "3.2.104" -#define MAX_SURFACES 3 +#define MAX_SURFACES 4#define MAX_PLANES 6#define MAX_STREAMS 6#define MAX_SINKS_PER_LINK 4
Greg Kroah-Hartman
maintainerPATCH 28/133 scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <[email protected]>
commit 0210d251162f4033350a94a43f95b1c39ec84a90 upstream.
The orc_sort_cmp() function, used with qsort(), previously violated the symmetry and transitivity rules required by the C standard. Specifically, when both entries are ORC_TYPE_UNDEFINED, it could result in both a < b and b < a, which breaks the required symmetry and transitivity. This can lead to undefined behavior and incorrect sorting results, potentially causing memory corruption in glibc implementations [1].
Symmetry: If x < y, then y > x.
Transitivity: If x < y and y < z, then x < z.
Fix the comparison logic to return 0 when both entries are ORC_TYPE_UNDEFINED, ensuring compliance with qsort() requirements.
--- scripts/sorttable.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
scripts/sorttable.h +7 -3
@@ -103,7 +103,7 @@ static inline unsigned long orc_ip(conststatic int orc_sort_cmp (const void *_a,const void *_b) { -struct orc_entry *orc_a; +struct orc_entry *orc_a, *orc_b;const int *a = g_orc_ip_table + *(int *)_a;const int *b = g_orc_ip_table + *(int *)_b;unsigned long a_val =orc_ip (a);
@@ -120,8 +120,12 @@ static int orc_sort_cmp(const void *_a,* These terminator entries exist to handle any gaps created by * whitelisted .o files which didn't get objtool generation. */ - orc_a = g_orc_table + (a - g_orc_ip_table); -return orc_a->sp_reg ==ORC_REG_UNDEFINED && !orc_a->end ?-1 :1 ; + orc_a = g_orc_table + (a - g_orc_ip_table); + orc_b = g_orc_table + (b - g_orc_ip_table); +if (orc_a->sp_reg ==ORC_REG_UNDEFINED && !orc_a->end && + orc_b->sp_reg ==ORC_REG_UNDEFINED && !orc_b->end) +return 0 ; +return orc_a->sp_reg ==ORC_REG_UNDEFINED && !orc_a->end ?-1 :1 ; }static void *sort_orctable (void *arg)
Greg Kroah-Hartman
maintainerPATCH 29/133 md/raid5: fix atomicity violation in raid5_cache_count
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
commit dfd2bf436709b2bccb78c2dda550dde93700efa7 upstream.
In raid5_cache_count():
if (conf->max_nr_stripes < conf->min_nr_stripes)
return 0;
return conf->max_nr_stripes - conf->min_nr_stripes;The current check is ineffective, as the values could change immediately after being checked.
In raid5_set_cache_size():
...
conf->min_nr_stripes = size;
...
while (size > conf->max_nr_stripes)
conf->min_nr_stripes = conf->max_nr_stripes;
...Due to intermediate value updates in raid5_set_cache_size(), concurrent execution of raid5_cache_count() and raid5_set_cache_size() may lead to inconsistent reads of conf->max_nr_stripes and conf->min_nr_stripes. The current checks are ineffective as values could change immediately after being checked, raising the risk of conf->min_nr_stripes exceeding conf->max_nr_stripes and potentially causing an integer overflow.
This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 6.2.
To resolve this issue, it is suggested to introduce local variables 'min_stripes' and 'max_stripes' in raid5_cache_count() to ensure the values remain stable throughout the check. Adding locks in raid5_cache_count() fails to resolve atomicity violations, as raid5_set_cache_size() may hold intermediate values of conf->min_nr_stripes while unlocked. With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the lack of associated hardware, we cannot test the patch in runtime testing, and just verify it according to the code logic.
--- drivers/md/raid5.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/md/raid5.c +8 -6
@@ -2349,7 +2349,7 @@ static int grow_one_stripe(struct r5confatomic_inc (&conf->active_stripes);raid5_release_stripe (sh); - conf->max_nr_stripes++; +WRITE_ONCE (conf->max_nr_stripes, conf->max_nr_stripes +1 );return 1 ; }
@@ -2646,7 +2646,7 @@ static int drop_one_stripe(struct r5confshrink_buffers (sh);free_stripe (conf->slab_cache, sh);atomic_dec (&conf->active_stripes); - conf->max_nr_stripes--; +WRITE_ONCE (conf->max_nr_stripes, conf->max_nr_stripes -1 );return 1 ; }
@@ -6575,7 +6575,7 @@ raid5_set_cache_size(struct mddev *mddevif (size <=16 || size >32768 )return -EINVAL ; - conf->min_nr_stripes = size; +WRITE_ONCE (conf->min_nr_stripes, size);mutex_lock (&conf->cache_size_mutex);while (size < conf->max_nr_stripes &&drop_one_stripe (conf))
@@ -6587,7 +6587,7 @@ raid5_set_cache_size(struct mddev *mddevmutex_lock (&conf->cache_size_mutex);while (size > conf->max_nr_stripes)if (!grow_one_stripe (conf,GFP_KERNEL )) { - conf->min_nr_stripes = conf->max_nr_stripes; +WRITE_ONCE (conf->min_nr_stripes, conf->max_nr_stripes); result = -ENOMEM ;break ; }
@@ -7151,11 +7151,13 @@ static unsigned long raid5_cache_count(s struct shrink_control *sc) { struct r5conf *conf = container_of(shrink, struct r5conf, shrinker); +int max_stripes =READ_ONCE (conf->max_nr_stripes); +int min_stripes =READ_ONCE (conf->min_nr_stripes); -if (conf->max_nr_stripes < conf->min_nr_stripes) +if (max_stripes < min_stripes)/* unlikely, but not impossible */ return 0 ; -return conf->max_nr_stripes - conf->min_nr_stripes; +return max_stripes - min_stripes; }static struct r5conf *setup_conf (struct mddev *mddev)
Greg Kroah-Hartman
maintainerPATCH 30/133 USB: serial: option: add MeiG Smart SRM815
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chukun Pan <[email protected]>
commit c1947d244f807b1f95605b75a4059e7b37b5dcc3 upstream.
It looks like SRM815 shares ID with SRM825L.
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2dee ProdID=4d22 Rev= 4.14 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=123456 C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/serial/option.c +2 -1
@@ -621,7 +621,7 @@ static void option_instat_callback(struc/* MeiG Smart Technology products */ #define MEIGSMART_VENDOR_ID 0x2dee -/* MeiG Smart SRM825L based on Qualcomm 315 */ +/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */ #define MEIGSMART_PRODUCT_SRM825L 0x4d22/* MeiG Smart SLM320 based on UNISOC UIS8910 */ #define MEIGSMART_PRODUCT_SLM320 0x4d41
@@ -2405,6 +2405,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) },
Greg Kroah-Hartman
maintainerPATCH 31/133 USB: serial: option: add Neoway N723-EA support
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hrusecky <[email protected]>
commit f5b435be70cb126866fa92ffc6f89cda9e112c75 upstream.
Update the USB serial option driver to support Neoway N723-EA.
ID 2949:8700 Marvell Mobile Composite Device Bus
T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2949 ProdID=8700 Rev= 1.00 S: Manufacturer=Marvell S: Product=Mobile Composite Device Bus S: SerialNumber=200806006809080000
C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0e(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Tested successfully connecting to the Internet via rndis interface after dialing via AT commands on If#=4 or If#=6.
Not sure of the purpose of the other serial interface.
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -2413,6 +2413,7 @@ static const struct usb_device_id option .driver_info = NCTRL(1) }, { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ .driver_info = NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x2949, 0x8700, 0xff) }, /* Neoway N723-EA */ { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Greg Kroah-Hartman
maintainerPATCH 32/133 staging: iio: ad9834: Correct phase range check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit c0599762f0c7e260b99c6b7bceb8eae69b804c94 upstream.
User Perspective:
When a user sets the phase value, the ad9834_write_phase() is called. The phase register has a 12-bit resolution, so the valid range is 0 to 4095. If the phase offset value of 4096 is input, it effectively exactly equals 0 in the lower 12 bits, meaning no offset.
Reasons for the Change:
1) Original Condition (phase > BIT(AD9834_PHASE_BITS)):
This condition allows a phase value equal to 2^12, which is 4096. However, this value exceeds the valid 12-bit range, as the maximum valid phase value should be 4095.
2) Modified Condition (phase >= BIT(AD9834_PHASE_BITS)):
Ensures that the phase value is within the valid range, preventing invalid datafrom being written.
Impact on Subsequent Logic: st->data = cpu_to_be16(addr | phase):
If the phase value is 2^12, i.e., 4096 (0001 0000 0000 0000), and addr is AD9834_REG_PHASE0 (1100 0000 0000 0000), then addr | phase results in 1101 0000 0000 0000, occupying DB12. According to the section of WRITING TO A PHASE REGISTER in the datasheet, the MSB 12 PHASE0 bits should be DB11. The original condition leads to incorrect DB12 usage, which contradicts the datasheet and could pose potential issues for future updates if DB12 is used in such related cases.
--- drivers/staging/iio/frequency/ad9834.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/frequency/ad9834.c +1 -1
@@ -132,7 +132,7 @@ static int ad9834_write_frequency(structstatic int ad9834_write_phase (struct ad9834_state *st,unsigned long addr,unsigned long phase) { -if (phase >BIT (AD9834_PHASE_BITS )) +if (phase >=BIT (AD9834_PHASE_BITS ))return -EINVAL ; st->data =cpu_to_be16 (addr | phase);
Greg Kroah-Hartman
maintainerPATCH 33/133 staging: iio: ad9832: Correct phase range check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <[email protected]>
commit 4636e859ebe0011f41e35fa79bab585b8004e9a3 upstream.
User Perspective:
When a user sets the phase value, the ad9832_write_phase() is called. The phase register has a 12-bit resolution, so the valid range is 0 to 4095. If the phase offset value of 4096 is input, it effectively exactly equals 0 in the lower 12 bits, meaning no offset.
Reasons for the Change:
1) Original Condition (phase > BIT(AD9832_PHASE_BITS)):
This condition allows a phase value equal to 2^12, which is 4096. However, this value exceeds the valid 12-bit range, as the maximum valid phase value should be 4095.
2) Modified Condition (phase >= BIT(AD9832_PHASE_BITS)):
Ensures that the phase value is within the valid range, preventing invalid datafrom being written.
Impact on Subsequent Logic: st->data = cpu_to_be16(addr | phase):
If the phase value is 2^12, i.e., 4096 (0001 0000 0000 0000), and addr is AD9832_REG_PHASE0 (1100 0000 0000 0000), then addr | phase results in 1101 0000 0000 0000, occupying DB12. According to the section of WRITING TO A PHASE REGISTER in the datasheet, the MSB 12 PHASE0 bits should be DB11. The original condition leads to incorrect DB12 usage, which contradicts the datasheet and could pose potential issues for future updates if DB12 is used in such related cases.
--- drivers/staging/iio/frequency/ad9832.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/frequency/ad9832.c +1 -1
@@ -158,7 +158,7 @@ static int ad9832_write_frequency(structstatic int ad9832_write_phase (struct ad9832_state *st,unsigned long addr,unsigned long phase) { -if (phase >BIT (AD9832_PHASE_BITS )) +if (phase >=BIT (AD9832_PHASE_BITS ))return -EINVAL ; st->phase_data[0] = cpu_to_be16((AD9832_CMD_PHA8BITSW << CMD_SHIFT) |
Greg Kroah-Hartman
maintainerPATCH 34/133 usb-storage: Add max sectors quirk for Nokia 208
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Rintel <[email protected]>
commit cdef30e0774802df2f87024d68a9d86c3b99ca2a upstream.
This fixes data corruption when accessing the internal SD card in mass storage mode.
I am actually not too sure why. I didn't figure a straightforward way to reproduce the issue, but i seem to get garbage when issuing a lot (over 50) of large reads (over 120 sectors) are done in a quick succession. That is, time seems to matter here -- larger reads are fine if they are done with some delay between them.
But I'm not great at understanding this sort of things, so I'll assume the issue other, smarter, folks were seeing with similar phones is the same problem and I'll just put my quirk next to theirs.
The "Software details" screen on the phone is as follows:
V 04.06
07-08-13
RM-849
(c) Nokia
TL;DR version of the device descriptor:
idVendor 0x0421 Nokia Mobile Phones
idProduct 0x06c2
bcdDevice 4.06
iManufacturer 1 Nokia
iProduct 2 Nokia 208
The patch assumes older firmwares are broken too (I'm unable to test, but no biggie if they aren't I guess), and I have no idea if newer firmware exists.
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -255,6 +255,13 @@ UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_MAX_SECTORS_64 ), +/* Added by Lubomir Rintel <[email protected]>, a very fine chap */ +UNUSUAL_DEV( 0x0421, 0x06c2, 0x0000, 0x0406, + "Nokia", + "Nokia 208", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 ), +#ifdef NO_SDDR09 UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100, "Microtech",
Greg Kroah-Hartman
maintainerPATCH 35/133 USB: serial: cp210x: add Phoenix Contact UPS Device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 854eee93bd6e3dca619d47087af4d65b2045828e upstream.
Phoenix Contact sells UPS Quint devices [1] with a custom datacable [2] that embeds a Silicon Labs converter:
Bus 001 Device 003: ID 1b93:1013 Silicon Labs Phoenix Contact UPS Device Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x1b93 idProduct 0x1013 bcdDevice 1.00 iManufacturer 1 Silicon Labs iProduct 2 Phoenix Contact UPS Device iSerial 3 <redacted>
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0020
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 2 Phoenix Contact UPS Device
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
[1] https://www.phoenixcontact.com/en-pc/products/power-supply-unit-quint-ps-1ac-24dc-10-2866763
[2] https://www.phoenixcontact.com/en-il/products/data-cable-preassembled-ifs-usb-datacable-2320500
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -227,6 +227,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ + { USB_DEVICE(0x1B93, 0x1013) }, /* Phoenix Contact UPS Device */ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */
Greg Kroah-Hartman
maintainerPATCH 36/133 usb: dwc3: gadget: fix writing NYET threshold
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
commit 01ea6bf5cb58b20cc1bd159f0cf74a76cf04bb69 upstream.
Before writing a new value to the register, the old value needs to be masked out for the new value to be programmed as intended, because at least in some cases the reset value of that field is 0xf (max value).
At the moment, the dwc3 core initialises the threshold to the maximum value (0xf), with the option to override it via a DT. No upstream DTs seem to override it, therefore this commit doesn't change behaviour for any upstream platform. Nevertheless, the code should be fixed to have the desired outcome.
Do so.
--- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/gadget.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/usb/dwc3/core.h +1 -0
@@ -422,6 +422,7 @@#define DWC3_DCTL_TRGTULST_SS_INACT (DWC3_DCTL_TRGTULST(6))/* These apply for core versions 1.94a and later */ +#define DWC3_DCTL_NYET_THRES_MASK (0xf << 20)#define DWC3_DCTL_NYET_THRES (n) (((n) & 0xf) << 20)#define DWC3_DCTL_KEEP_CONNECT BIT(19)
drivers/usb/dwc3/gadget.c +3 -1
@@ -3519,8 +3519,10 @@ static void dwc3_gadget_conndone_interru WARN_ONCE(DWC3_VER_IS_PRIOR(DWC3, 240A) && dwc->has_lpm_erratum,"LPM Erratum not available on dwc3 revisions < 2.40a\n" ); - if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) + if (dwc->has_lpm_erratum && !DWC3_VER_IS_PRIOR(DWC3, 240A)) { + reg &= ~DWC3_DCTL_NYET_THRES_MASK ; reg |=DWC3_DCTL_NYET_THRES (dwc->lpm_nyet_threshold); + }dwc3_gadget_dctl_write_safe (dwc, reg); }else {
Greg Kroah-Hartman
maintainerPATCH 37/133 usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lianqin Hu <[email protected]>
commit 13014969cbf07f18d62ceea40bd8ca8ec9d36cec upstream.
Considering that in some extreme cases, when performing the unbinding operation, gserial_disconnect has cleared gser->ioport, which triggers gadget reconfiguration, and then calls gs_read_complete, resulting in access to a null pointer. Therefore, ep is disabled before gserial_disconnect sets port to null to prevent this from happening.
Call trace: gs_read_complete+0x58/0x240 usb_gadget_giveback_request+0x40/0x160 dwc3_remove_requests+0x170/0x484 dwc3_ep0_out_start+0xb0/0x1d4 __dwc3_gadget_start+0x25c/0x720 kretprobe_trampoline.cfi_jt+0x0/0x8 kretprobe_trampoline.cfi_jt+0x0/0x8 udc_bind_to_driver+0x1d8/0x300 usb_gadget_probe_driver+0xa8/0x1dc gadget_dev_desc_UDC_store+0x13c/0x188 configfs_write_iter+0x160/0x1f4 vfs_write+0x2d0/0x40c ksys_write+0x7c/0xf0 __arm64_sys_write+0x20/0x30 invoke_syscall+0x60/0x150 el0_svc_common+0x8c/0xf8 do_el0_svc+0x28/0xa0 el0_svc+0x24/0x84
--- drivers/usb/gadget/function/u_serial.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/u_serial.c +4 -4
@@ -1395,6 +1395,10 @@ void gserial_disconnect(struct gserial */* REVISIT as above: how best to track this? */ port->port_line_coding = gser->port_line_coding; +/* disable endpoints, aborting down any active I/O */ +usb_ep_disable (gser->out); +usb_ep_disable (gser->in); + port->port_usb =NULL ; gser->ioport =NULL ;if (port->port.count >0 ) {
@@ -1406,10 +1410,6 @@ void gserial_disconnect(struct gserial *spin_unlock (&port->port_lock);spin_unlock_irqrestore (&serial_port_lock, flags); -/* disable endpoints, aborting down any active I/O */ -usb_ep_disable (gser->out); -usb_ep_disable (gser->in); -/* finally, free any unused/unusable I/O buffers */ spin_lock_irqsave (&port->port_lock, flags);if (port->port.count ==0 )
Greg Kroah-Hartman
maintainerPATCH 38/133 USB: usblp: return error when setting unsupported protocol
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yan <[email protected]>
commit 7a3d76a0b60b3f6fc3375e4de2174bab43f64545 upstream.
Fix the regression introduced by commit d8c6edfa3f4e ("USB:
usblp: don't call usb_set_interface if there's a single alt"), which causes that unsupported protocols can also be set via ioctl when the num_altsetting of the device is 1.
Move the check for protocol support to the earlier stage.
--- drivers/usb/class/usblp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/class/usblp.c +4 -3
@@ -1337,11 +1337,12 @@ static int usblp_set_protocol(struct usbif (protocol <USBLP_FIRST_PROTOCOL || protocol >USBLP_LAST_PROTOCOL )return -EINVAL ; + alts = usblp->protocol[protocol].alt_setting; +if (alts <0 ) +return -EINVAL ; +/* Don't unnecessarily set the interface if there's a single alt. */ if (usblp->intf->num_altsetting >1 ) { - alts = usblp->protocol[protocol].alt_setting; -if (alts <0 ) -return -EINVAL ; r =usb_set_interface (usblp->dev, usblp->ifnum, alts);if (r <0 ) { printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n",
Greg Kroah-Hartman
maintainerPATCH 39/133 USB: core: Disable LPM only for non-suspended ports
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
commit 59bfeaf5454b7e764288d84802577f4a99bf0819 upstream.
There's USB error when tegra board is shutting down:
[ 180.919315] usb 2-3: Failed to set U1 timeout to 0x0,error code -113 [ 180.919995] usb 2-3: Failed to set U1 timeout to 0xa,error code -113 [ 180.920512] usb 2-3: Failed to set U2 timeout to 0x4,error code -113 [ 186.157172] tegra-xusb 3610000.usb: xHCI host controller not responding, assume dead [ 186.157858] tegra-xusb 3610000.usb: HC died; cleaning up [ 186.317280] tegra-xusb 3610000.usb: Timeout while waiting for evaluate context command
The issue is caused by disabling LPM on already suspended ports.
For USB2 LPM, the LPM is already disabled during port suspend. For USB3 LPM, port won't transit to U1/U2 when it's already suspended in U3, hence disabling LPM is only needed for ports that are not suspended.
--- drivers/usb/core/port.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/core/port.c +4 -3
@@ -294,10 +294,11 @@ static int usb_port_runtime_suspend(strustatic void usb_port_shutdown (struct device *dev) {struct usb_port *port_dev =to_usb_port (dev); +struct usb_device *udev = port_dev->child; -if (port_dev->child) { -usb_disable_usb2_hardware_lpm (port_dev->child); -usb_unlocked_disable_lpm (port_dev->child); +if (udev && !udev->port_is_suspended) { +usb_disable_usb2_hardware_lpm (udev); +usb_unlocked_disable_lpm (udev); } }
Greg Kroah-Hartman
maintainerPATCH 40/133 usb: fix reference leak in usb_new_device()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 0df11fa8cee5a9cf8753d4e2672bb3667138c652 upstream.
When device_add(&udev->dev) succeeds and a later call fails, usb_new_device() does not properly call device_del(). As comment of device_add() says, 'if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count'.
Found by code review.
--- drivers/usb/core/hub.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/core/hub.c +4 -2
@@ -2604,13 +2604,13 @@ int usb_new_device(struct usb_device *ud err =sysfs_create_link (&udev->dev.kobj, &port_dev->dev.kobj,"port" );if (err) - goto fail; + goto out_del_dev; err =sysfs_create_link (&port_dev->dev.kobj, &udev->dev.kobj,"device" );if (err) {sysfs_remove_link (&udev->dev.kobj,"port" ); - goto fail; + goto out_del_dev; }if (!test_and_set_bit (port1, hub->child_usage_bits))
@@ -2622,6 +2622,8 @@ int usb_new_device(struct usb_device *udpm_runtime_put_sync_autosuspend (&udev->dev);return err; +out_del_dev: +device_del (&udev->dev); fail:usb_set_device_state (udev,USB_STATE_NOTATTACHED );pm_runtime_disable (&udev->dev);
Greg Kroah-Hartman
maintainerPATCH 41/133 usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akash M <[email protected]>
commit dfc51e48bca475bbee984e90f33fdc537ce09699 upstream.
This commit addresses an issue related to below kernel panic where panic_on_warn is enabled. It is caused by the unnecessary use of WARN_ON in functionsfs_bind, which easily leads to the following scenarios.
1.adb_write in adbd 2. UDC write via configfs
================= =====================
->usb_ffs_open_thread() ->UDC write
->open_functionfs() ->configfs_write_iter()
->adb_open() ->gadget_dev_desc_UDC_store()
->adb_write() ->usb_gadget_register_driver_owner
->driver_register()
->StartMonitor() ->bus_add_driver()
->adb_read() ->gadget_bind_driver()
<times-out without BIND event> ->configfs_composite_bind()
->usb_add_function()
->open_functionfs() ->ffs_func_bind()
->adb_open() ->functionfs_bind()
<ffs->state !=FFS_ACTIVE>The adb_open, adb_read, and adb_write operations are invoked from the daemon, but trying to bind the function is a process that is invoked by UDC write through configfs, which opens up the possibility of a race condition between the two paths. In this race scenario, the kernel panic occurs due to the WARN_ON from functionfs_bind when panic_on_warn is enabled. This commit fixes the kernel panic by removing the unnecessary WARN_ON.
Kernel panic - not syncing: kernel: panic_on_warn set ... [ 14.542395] Call trace: [ 14.542464] ffs_func_bind+0x1c8/0x14a8 [ 14.542468] usb_add_function+0xcc/0x1f0 [ 14.542473] configfs_composite_bind+0x468/0x588 [ 14.542478] gadget_bind_driver+0x108/0x27c [ 14.542483] really_probe+0x190/0x374 [ 14.542488] __driver_probe_device+0xa0/0x12c [ 14.542492] driver_probe_device+0x3c/0x220 [ 14.542498] __driver_attach+0x11c/0x1fc [ 14.542502] bus_for_each_dev+0x104/0x160 [ 14.542506] driver_attach+0x24/0x34 [ 14.542510] bus_add_driver+0x154/0x270 [ 14.542514] driver_register+0x68/0x104 [ 14.542518] usb_gadget_register_driver_owner+0x48/0xf4 [ 14.542523] gadget_dev_desc_UDC_store+0xf8/0x144 [ 14.542526] configfs_write_iter+0xf0/0x138
--- drivers/usb/gadget/function/f_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +1 -1
@@ -1856,7 +1856,7 @@ static int functionfs_bind(struct ffs_daENTER (); -if (WARN_ON (ffs->state !=FFS_ACTIVE +if ((ffs->state !=FFS_ACTIVE ||test_and_set_bit (FFS_FL_BOUND , &ffs->flags)))return -EBADFD ;
Greg Kroah-Hartman
maintainerPATCH 42/133 iio: pressure: zpa2326: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 6007d10c5262f6f71479627c1216899ea7f09073 upstream.
The 'sample' local struct is used to push data to user space from a triggered buffer, but it has a hole between the temperature and the timestamp (u32 pressure, u16 temperature, GAP, u64 timestamp). This hole is never initialized.
Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace.
--- drivers/iio/pressure/zpa2326.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/pressure/zpa2326.c +2 -0
@@ -586,6 +586,8 @@ static int zpa2326_fill_sample_buffer(st } sample;int err; +memset (&sample,0 ,sizeof (sample)); +if (test_bit (0 , indio_dev->active_scan_mask)) {/* Get current pressure from hardware FIFO. */ err =zpa2326_dequeue_pressure (indio_dev, &sample.pressure);
Greg Kroah-Hartman
maintainerPATCH 43/133 iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 333be433ee908a53f283beb95585dfc14c8ffb46 upstream.
The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.
Use kzalloc for the memory allocation to avoid pushing uninitialized information to userspace.
--- drivers/iio/dummy/iio_simple_dummy_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dummy/iio_simple_dummy_buffer.c +1 -1
@@ -48,7 +48,7 @@ static irqreturn_t iio_simple_dummy_trigint len =0 ;u16 *data; - data =kmalloc (indio_dev->scan_bytes,GFP_KERNEL ); + data =kzalloc (indio_dev->scan_bytes,GFP_KERNEL );if (!data) goto done;
Greg Kroah-Hartman
maintainerPATCH 44/133 iio: light: vcnl4035: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 47b43e53c0a0edf5578d5d12f5fc71c019649279 upstream.
The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the single data element, which is an u16 aligned to 8 bytes. That leaves at least 4 bytes uninitialized even after writing an integer value with regmap_read().
Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.
--- drivers/iio/light/vcnl4035.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/light/vcnl4035.c +1 -1
@@ -105,7 +105,7 @@ static irqreturn_t vcnl4035_trigger_consstruct iio_dev *indio_dev = pf->indio_dev;struct vcnl4035_data *data =iio_priv (indio_dev);/* Ensure naturally aligned timestamp */ -u8 buffer[ALIGN (sizeof (u16),sizeof (s64)) +sizeof (s64)]__aligned(8) ; +u8 buffer[ALIGN (sizeof (u16),sizeof (s64)) +sizeof (s64)]__aligned(8) = { };int ret; ret =regmap_read (data->regmap,VCNL4035_ALS_DATA , (int *)buffer);
Greg Kroah-Hartman
maintainerPATCH 45/133 iio: imu: kmx61: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 6ae053113f6a226a2303caa4936a4c37f3bfff7b upstream.
The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.
Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.
--- drivers/iio/imu/kmx61.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/kmx61.c +1 -1
@@ -1198,7 +1198,7 @@ static irqreturn_t kmx61_trigger_handlerstruct kmx61_data *data =kmx61_get_data (indio_dev);int bit, ret, i =0 ;u8 base; -s16 buffer[8 ]; +s16 buffer[8 ] = { };if (indio_dev == data->acc_indio_dev) base =KMX61_ACC_XOUT_L ;
Greg Kroah-Hartman
maintainerPATCH 46/133 iio: adc: ti-ads8688: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 2a7377ccfd940cd6e9201756aff1e7852c266e69 upstream.
The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.
Initialize the array to zero before using it to avoid pushing uninitialized information to userspace.
--- drivers/iio/adc/ti-ads8688.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ti-ads8688.c +1 -1
@@ -384,7 +384,7 @@ static irqreturn_t ads8688_trigger_handlstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;/* Ensure naturally aligned timestamp */ -u16 buffer[ADS8688_MAX_CHANNELS +sizeof (s64)/sizeof (u16)]__aligned(8) ; +u16 buffer[ADS8688_MAX_CHANNELS +sizeof (s64)/sizeof (u16)]__aligned(8) = { };int i, j =0 ;for (i =0 ; i < indio_dev->masklength; i++) {
Greg Kroah-Hartman
maintainerPATCH 47/133 iio: gyro: fxas21002c: Fix missing data update in trigger handler
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Song <[email protected]>
commit fa13ac6cdf9b6c358e7d77c29fb60145c7a87965 upstream.
The fxas21002c_trigger_handler() may fail to acquire sample data because the runtime PM enters the autosuspend state and sensor can not return sample data in standby mode..
Resume the sensor before reading the sample data into the buffer within the trigger handler. After the data is read, place the sensor back into the autosuspend state.
--- drivers/iio/gyro/fxas21002c_core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/iio/gyro/fxas21002c_core.c +8 -1
@@ -730,14 +730,21 @@ static irqreturn_t fxas21002c_trigger_haint ret;mutex_lock (&data->lock); + ret =fxas21002c_pm_get (data); +if (ret <0 ) + goto out_unlock; + ret =regmap_bulk_read (data->regmap,FXAS21002C_REG_OUT_X_MSB , data->buffer,CHANNEL_SCAN_MAX *sizeof (s16));if (ret <0 ) - goto out_unlock; + goto out_pm_put;iio_push_to_buffers_with_timestamp (indio_dev, data->buffer, data->timestamp); +out_pm_put: +fxas21002c_pm_put (data); + out_unlock:mutex_unlock (&data->lock);
Greg Kroah-Hartman
maintainerPATCH 48/133 iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 2a8e34096ec70d73ebb6d9920688ea312700cbd9 upstream.
Using gpiod_set_value() to control the reset GPIO causes some verbose warnings during boot when the reset GPIO is controlled by an I2C IO expander.
As the caller can sleep, use the gpiod_set_value_cansleep() variant to fix the issue.
Tested on a custom i.MX93 board with a ADS124S08 ADC.
--- drivers/iio/adc/ti-ads124s08.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/ti-ads124s08.c +2 -2
@@ -184,9 +184,9 @@ static int ads124s_reset(struct iio_devstruct ads124s_private *priv =iio_priv (indio_dev);if (priv->reset_gpio) { -gpiod_set_value (priv->reset_gpio,0 ); +gpiod_set_value_cansleep (priv->reset_gpio,0 );udelay (200 ); -gpiod_set_value (priv->reset_gpio,1 ); +gpiod_set_value_cansleep (priv->reset_gpio,1 ); }else {return ads124s_write_cmd (indio_dev,ADS124S08_CMD_RESET ); }
Greg Kroah-Hartman
maintainerPATCH 49/133 iio: adc: at91: call input_free_device() on allocated iio_dev
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
commit de6a73bad1743e9e81ea5a24c178c67429ff510b upstream.
Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached before the allocated iio_dev is stored to st->ts_input. Thus call input_free_device() on input instead of st->ts_input.
--- drivers/iio/adc/at91_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/at91_adc.c +1 -1
@@ -1139,7 +1139,7 @@ static int at91_ts_register(struct iio_dreturn ret; err: -input_free_device (st->ts_input); +input_free_device (input);return ret; }
Greg Kroah-Hartman
maintainerPATCH 50/133 iio: inkern: call iio_device_put() only on mapped devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
commit 64f43895b4457532a3cc524ab250b7a30739a1b1 upstream.
In the error path of iio_channel_get_all(), iio_device_put() is called on all IIO devices, which can cause a refcount imbalance. Fix this error by calling iio_device_put() only on IIO devices whose refcounts were previously incremented by iio_device_get().
--- drivers/iio/inkern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/inkern.c +1 -1
@@ -447,7 +447,7 @@ struct iio_channel *iio_channel_get_all(return chans; error_free_chans: -for (i =0 ; i < nummaps; i++) +for (i =0 ; i < mapind; i++)iio_device_put (chans[i].indio_dev);kfree (chans); error_ret:
Greg Kroah-Hartman
maintainerPATCH 51/133 arm64: dts: rockchip: add #power-domain-cells to power domain nodes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Jonker <[email protected]>
[ Upstream commit 837188d49823230f47afdbbec7556740e89a8557 ]
Add #power-domain-cells to power domain nodes, because they are required by power-domain.yaml
Stable-dep-of: 3699f2c43ea9 ("arm64: dts: rockchip: add hevc power domain clock to rk3328")
--- arch/arm64/boot/dts/rockchip/px30.dtsi | 8 ++++++++ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +++ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 20 ++++++++++++++++++++ 3 files changed, 31 insertions(+)
arch/arm64/boot/dts/rockchip/px30.dtsi +8 -0
@@ -250,12 +250,14 @@ <&cru HCLK_OTG>, <&cru SCLK_OTG_ADP>; pm_qos = <&qos_usb_host>, <&qos_usb_otg>; + #power-domain-cells = <0>; }; power-domain@PX30_PD_SDCARD { reg = <PX30_PD_SDCARD>; clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>; pm_qos = <&qos_sdmmc>; + #power-domain-cells = <0>; }; power-domain@PX30_PD_GMAC { reg = <PX30_PD_GMAC>;
@@ -264,6 +266,7 @@ <&cru SCLK_MAC_REF>, <&cru SCLK_GMAC_RX_TX>; pm_qos = <&qos_gmac>; + #power-domain-cells = <0>; }; power-domain@PX30_PD_MMC_NAND { reg = <PX30_PD_MMC_NAND>;
@@ -277,6 +280,7 @@ <&cru SCLK_SFC>; pm_qos = <&qos_emmc>, <&qos_nand>, <&qos_sdio>, <&qos_sfc>; + #power-domain-cells = <0>; }; power-domain@PX30_PD_VPU { reg = <PX30_PD_VPU>;
@@ -284,6 +288,7 @@ <&cru HCLK_VPU>, <&cru SCLK_CORE_VPU>; pm_qos = <&qos_vpu>, <&qos_vpu_r128>; + #power-domain-cells = <0>; }; power-domain@PX30_PD_VO { reg = <PX30_PD_VO>;
@@ -300,6 +305,7 @@ <&cru SCLK_VOPB_PWM>; pm_qos = <&qos_rga_rd>, <&qos_rga_wr>, <&qos_vop_m0>, <&qos_vop_m1>; + #power-domain-cells = <0>; }; power-domain@PX30_PD_VI { reg = <PX30_PD_VI>;
@@ -311,11 +317,13 @@ pm_qos = <&qos_isp_128>, <&qos_isp_rd>, <&qos_isp_wr>, <&qos_isp_m1>, <&qos_vip>; + #power-domain-cells = <0>; }; power-domain@PX30_PD_GPU { reg = <PX30_PD_GPU>; clocks = <&cru SCLK_GPU>; pm_qos = <&qos_gpu>; + #power-domain-cells = <0>; }; }; };
arch/arm64/boot/dts/rockchip/rk3328.dtsi +3 -0
@@ -320,13 +320,16 @@ power-domain@RK3328_PD_HEVC { reg = <RK3328_PD_HEVC>; + #power-domain-cells = <0>; }; power-domain@RK3328_PD_VIDEO { reg = <RK3328_PD_VIDEO>; + #power-domain-cells = <0>; }; power-domain@RK3328_PD_VPU { reg = <RK3328_PD_VPU>; clocks = <&cru ACLK_VPU>, <&cru HCLK_VPU>; + #power-domain-cells = <0>; }; };
arch/arm64/boot/dts/rockchip/rk3399.dtsi +20 -0
@@ -1005,6 +1005,7 @@ clocks = <&cru ACLK_IEP>, <&cru HCLK_IEP>; pm_qos = <&qos_iep>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_RGA { reg = <RK3399_PD_RGA>;
@@ -1012,12 +1013,14 @@ <&cru HCLK_RGA>; pm_qos = <&qos_rga_r>, <&qos_rga_w>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_VCODEC { reg = <RK3399_PD_VCODEC>; clocks = <&cru ACLK_VCODEC>, <&cru HCLK_VCODEC>; pm_qos = <&qos_video_m0>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_VDU { reg = <RK3399_PD_VDU>;
@@ -1027,6 +1030,7 @@ <&cru SCLK_VDU_CORE>; pm_qos = <&qos_video_m1_r>, <&qos_video_m1_w>; + #power-domain-cells = <0>; }; /* These power domains are grouped by VD_GPU */
@@ -1034,53 +1038,63 @@ reg = <RK3399_PD_GPU>; clocks = <&cru ACLK_GPU>; pm_qos = <&qos_gpu>; + #power-domain-cells = <0>; }; /* These power domains are grouped by VD_LOGIC */ power-domain@RK3399_PD_EDP { reg = <RK3399_PD_EDP>; clocks = <&cru PCLK_EDP_CTRL>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_EMMC { reg = <RK3399_PD_EMMC>; clocks = <&cru ACLK_EMMC>; pm_qos = <&qos_emmc>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_GMAC { reg = <RK3399_PD_GMAC>; clocks = <&cru ACLK_GMAC>, <&cru PCLK_GMAC>; pm_qos = <&qos_gmac>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_SD { reg = <RK3399_PD_SD>; clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>; pm_qos = <&qos_sd>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_SDIOAUDIO { reg = <RK3399_PD_SDIOAUDIO>; clocks = <&cru HCLK_SDIO>; pm_qos = <&qos_sdioaudio>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_TCPD0 { reg = <RK3399_PD_TCPD0>; clocks = <&cru SCLK_UPHY0_TCPDCORE>, <&cru SCLK_UPHY0_TCPDPHY_REF>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_TCPD1 { reg = <RK3399_PD_TCPD1>; clocks = <&cru SCLK_UPHY1_TCPDCORE>, <&cru SCLK_UPHY1_TCPDPHY_REF>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_USB3 { reg = <RK3399_PD_USB3>; clocks = <&cru ACLK_USB3>; pm_qos = <&qos_usb_otg0>, <&qos_usb_otg1>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_VIO { reg = <RK3399_PD_VIO>; + #power-domain-cells = <1>; #address-cells = <1>; #size-cells = <0>;
@@ -1090,6 +1104,7 @@ <&cru HCLK_HDCP>, <&cru PCLK_HDCP>; pm_qos = <&qos_hdcp>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_ISP0 { reg = <RK3399_PD_ISP0>;
@@ -1097,6 +1112,7 @@ <&cru HCLK_ISP0>; pm_qos = <&qos_isp0_m0>, <&qos_isp0_m1>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_ISP1 { reg = <RK3399_PD_ISP1>;
@@ -1104,9 +1120,11 @@ <&cru HCLK_ISP1>; pm_qos = <&qos_isp1_m0>, <&qos_isp1_m1>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_VO { reg = <RK3399_PD_VO>; + #power-domain-cells = <1>; #address-cells = <1>; #size-cells = <0>;
@@ -1116,12 +1134,14 @@ <&cru HCLK_VOP0>; pm_qos = <&qos_vop_big_r>, <&qos_vop_big_w>; + #power-domain-cells = <0>; }; power-domain@RK3399_PD_VOPL { reg = <RK3399_PD_VOPL>; clocks = <&cru ACLK_VOP1>, <&cru HCLK_VOP1>; pm_qos = <&qos_vop_little>; + #power-domain-cells = <0>; }; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/133 arm64: dts: rockchip: add hevc power domain clock to rk3328
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Geis <[email protected]>
[ Upstream commit 3699f2c43ea9984e00d70463f8c29baaf260ea97 ]
There is a race condition at startup between disabling power domains not used and disabling clocks not used on the rk3328. When the clocks are disabled first, the hevc power domain fails to shut off leading to a splat of failures. Add the hevc core clock to the rk3328 power domain node to prevent this condition.
rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 3-.... }1087 jiffies s: 89 root: 0x8/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 0 to CPUs 3:
NMI backtrace for cpu 3
CPU: 3 UID: 0 PID: 86 Comm: kworker/3:3 Not tainted 6.12.0-rc5+ #53 Hardware name: Firefly ROC-RK3328-CC (DT) Workqueue: pm genpd_power_off_work_fn pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : regmap_unlock_spinlock+0x18/0x30 lr : regmap_read+0x60/0x88
sp : ffff800081123c00
x29: ffff800081123c00 x28: ffff2fa4c62cad80 x27: 0000000000000000
x26: ffffd74e6e660eb8 x25: ffff2fa4c62cae00 x24: 0000000000000040
x23: ffffd74e6d2f3ab8 x22: 0000000000000001 x21: ffff800081123c74
x20: 0000000000000000 x19: ffff2fa4c0412000 x18: 0000000000000000
x17: 77202c31203d2065 x16: 6c6469203a72656c x15: 6c6f72746e6f632d
x14: 7265776f703a6e6f x13: 2063766568206e69 x12: 616d6f64202c3431
x11: 347830206f742030 x10: 3430303034783020 x9 : ffffd74e6c7369e0 x8 : 3030316666206e69 x7 : 205d383738353733 x6 : 332e31202020205b x5 : ffffd74e6c73fc88 x4 : ffffd74e6c73fcd4 x3 : ffffd74e6c740b40 x2 : ffff800080015484 x1 : 0000000000000000 x0 : ffff2fa4c0412000
Call trace: regmap_unlock_spinlock+0x18/0x30 rockchip_pmu_set_idle_request+0xac/0x2c0 rockchip_pd_power+0x144/0x5f8 rockchip_pd_power_off+0x1c/0x30 _genpd_power_off+0x9c/0x180 genpd_power_off.part.0.isra.0+0x130/0x2a8 genpd_power_off_work_fn+0x6c/0x98 process_one_work+0x170/0x3f0 worker_thread+0x290/0x4a8 kthread+0xec/0xf8 ret_from_fork+0x10/0x20
rockchip-pm-domain ff100000.syscon:power-controller: failed to get ack on domain 'hevc', val=0x88220
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +1 -0
@@ -320,6 +320,7 @@ power-domain@RK3328_PD_HEVC { reg = <RK3328_PD_HEVC>; + clocks = <&cru SCLK_VENC_CORE>; #power-domain-cells = <0>; }; power-domain@RK3328_PD_VIDEO {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/133 loop: let set_capacity_revalidate_and_notify update the bdev size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 3b4f85d02a4bd85cbea999a064235a47694bbb7b ]
There is no good reason to call revalidate_disk_size separately.
Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
--- drivers/block/loop.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/block/loop.c +2 -6
@@ -238,12 +238,8 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)*/ static void loop_set_size (struct loop_device *lo,loff_t size) { -struct block_device *bdev = lo->lo_device; - -bd_set_nr_sectors (bdev, size); - -if (!set_capacity_revalidate_and_notify (lo->lo_disk, size, false)) -kobject_uevent (&disk_to_dev (bdev->bd_disk)->kobj,KOBJ_CHANGE ); +if (!set_capacity_revalidate_and_notify (lo->lo_disk, size, true)) +kobject_uevent (&disk_to_dev (lo->lo_disk)->kobj,KOBJ_CHANGE ); } static inline int
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/133 nvme: let set_capacity_revalidate_and_notify update the bdev size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 5dd55749b79cdf471ca0966ad91541daebac3e2f ]
There is no good reason to call revalidate_disk_size separately.
Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
--- drivers/nvme/host/core.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/nvme/host/core.c +1 -4
@@ -2132,7 +2132,7 @@ static void nvme_update_disk_info(struct gendisk *disk, capacity =0 ; } -set_capacity_revalidate_and_notify (disk, capacity, false); +set_capacity_revalidate_and_notify (disk, capacity, true);nvme_config_discard (disk, ns);nvme_config_write_zeroes (disk->queue, ns->ctrl);
@@ -2213,7 +2213,6 @@ static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_id_ns *id)blk_stack_limits (&ns->head->disk->queue->limits, &ns->queue->limits,0 );blk_queue_update_readahead (ns->head->disk->queue); -nvme_update_bdev_size (ns->head->disk); blk_mq_unfreeze_queue(ns->head->disk->queue); }#endif
@@ -4095,8 +4094,6 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)*/ if (ret >0 && (ret &NVME_SC_DNR ))nvme_ns_remove (ns); -else -revalidate_disk_size (ns->disk, true); }static void nvme_validate_or_alloc_ns (struct nvme_ctrl *ctrl,unsigned nsid)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/133 sd: update the bdev size in sd_revalidate_disk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit b200e38c493b2a5acff4f86d40a3e45d546c664c ]
This avoids the extra call to revalidate_disk_size in sd_rescan and is otherwise a no-op because the size did not change, or we are in the probe path.
Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
--- drivers/scsi/sd.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/scsi/sd.c +3 -5
@@ -1767,10 +1767,8 @@ static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr)static void sd_rescan (struct device *dev) {struct scsi_disk *sdkp =dev_get_drvdata (dev); -int ret; - ret =sd_revalidate_disk (sdkp->disk); -revalidate_disk_size (sdkp->disk, ret ==0 ); +sd_revalidate_disk (sdkp->disk); } static int sd_ioctl(struct block_device *bdev, fmode_t mode,
@@ -3295,7 +3293,7 @@ static int sd_revalidate_disk(struct gendisk *disk) sdkp->first_scan =0 ;set_capacity_revalidate_and_notify (disk, -logical_to_sectors (sdp, sdkp->capacity), false); +logical_to_sectors (sdp, sdkp->capacity), true);sd_config_write_same (sdkp);kfree (buffer);
@@ -3305,7 +3303,7 @@ static int sd_revalidate_disk(struct gendisk *disk)* capacity to 0. */ if (sd_zbc_revalidate_zones (sdkp)) -set_capacity_revalidate_and_notify (disk,0 , false); +set_capacity_revalidate_and_notify (disk,0 , true); out:return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/133 block: remove the update_bdev parameter to set_capacity_revalidate_and_notify
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 449f4ec9892ebc2f37a7eae6d97db2cf7c65e09a ]
The update_bdev argument is always set to true, so remove it. Also rename the function to the slighly less verbose set_capacity_and_notify, as propagating the disk size to the block device isn't really revalidation.
Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device")
--- block/genhd.c | 13 +++++-------- drivers/block/loop.c | 2 +- drivers/block/virtio_blk.c | 2 +- drivers/block/xen-blkfront.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/scsi/sd.c | 5 ++--- include/linux/genhd.h | 3 +-- 7 files changed, 12 insertions(+), 17 deletions(-)
block/genhd.c +5 -8
@@ -46,17 +46,15 @@ static void disk_del_events(struct gendisk *disk);static void disk_release_events (struct gendisk *disk);/* -* Set disk capacity and notify if the size is not currently -* zero and will not be set to zero +* Set disk capacity and notify if the size is not currently zero and will not +* be set to zero. Returns true if a uevent was sent, otherwise false. */ -bool set_capacity_revalidate_and_notify (struct gendisk *disk,sector_t size, -bool update_bdev) +bool set_capacity_and_notify (struct gendisk *disk,sector_t size) {sector_t capacity =get_capacity (disk);set_capacity (disk, size); -if (update_bdev) -revalidate_disk_size (disk, true); +revalidate_disk_size (disk, true);if (capacity != size && capacity !=0 && size !=0 ) {char *envp[] = {"RESIZE=1" ,NULL };
@@ -67,8 +65,7 @@ bool set_capacity_revalidate_and_notify(struct gendisk *disk, sector_t size,return false; } - -EXPORT_SYMBOL_GPL (set_capacity_revalidate_and_notify); +EXPORT_SYMBOL_GPL (set_capacity_and_notify);/* * Format the device name of the indicated disk into the supplied buffer and
drivers/block/loop.c +1 -1
@@ -238,7 +238,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)*/ static void loop_set_size (struct loop_device *lo,loff_t size) { -if (!set_capacity_revalidate_and_notify (lo->lo_disk, size, true)) +if (!set_capacity_and_notify (lo->lo_disk, size))kobject_uevent (&disk_to_dev (lo->lo_disk)->kobj,KOBJ_CHANGE ); }
drivers/block/virtio_blk.c +1 -1
@@ -470,7 +470,7 @@ static void virtblk_update_capacity(struct virtio_blk *vblk, bool resize) cap_str_10, cap_str_2); -set_capacity_revalidate_and_notify (vblk->disk, capacity, true); +set_capacity_and_notify (vblk->disk, capacity); }static void virtblk_config_changed_work (struct work_struct *work)
drivers/block/xen-blkfront.c +1 -1
@@ -2443,7 +2443,7 @@ static void blkfront_connect(struct blkfront_info *info)return ;printk (KERN_INFO "Setting capacity to %Lu\n" , sectors); -set_capacity_revalidate_and_notify (info->gd, sectors, true); +set_capacity_and_notify (info->gd, sectors);return ;case BLKIF_STATE_SUSPENDED :
drivers/nvme/host/core.c +1 -1
@@ -2132,7 +2132,7 @@ static void nvme_update_disk_info(struct gendisk *disk, capacity =0 ; } -set_capacity_revalidate_and_notify (disk, capacity, true); +set_capacity_and_notify (disk, capacity);nvme_config_discard (disk, ns);nvme_config_write_zeroes (disk->queue, ns->ctrl);
drivers/scsi/sd.c +2 -3
@@ -3292,8 +3292,7 @@ static int sd_revalidate_disk(struct gendisk *disk) sdkp->first_scan =0 ; -set_capacity_revalidate_and_notify (disk, -logical_to_sectors (sdp, sdkp->capacity), true); +set_capacity_and_notify (disk,logical_to_sectors (sdp, sdkp->capacity));sd_config_write_same (sdkp);kfree (buffer);
@@ -3303,7 +3302,7 @@ static int sd_revalidate_disk(struct gendisk *disk)* capacity to 0. */ if (sd_zbc_revalidate_zones (sdkp)) -set_capacity_revalidate_and_notify (disk,0 , true); +set_capacity_and_notify (disk,0 ); out:return 0 ;
include/linux/genhd.h +1 -2
@@ -315,8 +315,7 @@ static inline int get_disk_ro(struct gendisk *disk)extern void disk_block_events (struct gendisk *disk);extern void disk_unblock_events (struct gendisk *disk);extern void disk_flush_events (struct gendisk *disk,unsigned int mask); -bool set_capacity_revalidate_and_notify (struct gendisk *disk,sector_t size, -bool update_bdev); +bool set_capacity_and_notify (struct gendisk *disk,sector_t size);/* drivers/char/random.c */ extern void add_disk_randomness(struct gendisk *disk) __latent_entropy;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/133 phy: usb: Add "wake on" functionality for newer Synopsis XHCI controllers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Cooper <[email protected]>
[ Upstream commit ae532b2b7aa5a3dad036aef4e0b177607172d276 ]
Add "wake on" support for the newer Synopsis based XHCI only controller. This works on the 72165 and 72164 and newer chips and does not work on 7216 based systems. Also switch the USB sysclk to a slower clock on suspend to save additional power in S2. The clock switch will only save power on the 72165b0 and newer chips and is a nop on older chips.
Stable-dep-of: 0a92ea87bdd6 ("phy: usb: Toggle the PHY power during init")
--- .../phy/broadcom/phy-brcm-usb-init-synopsys.c | 46 +++++++++++++++---- 1 file changed, 38 insertions(+), 8 deletions(-)
drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +38 -8
@@ -47,6 +47,8 @@#define USB_CTRL_USB_PM_SOFT_RESET_MASK 0x40000000#define USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK 0x00800000#define USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK 0x00400000 +#define USB_CTRL_USB_PM_XHC_PME_EN_MASK 0x00000010 +#define USB_CTRL_USB_PM_XHC_S2_CLK_SWITCH_EN_MASK 0x00000008#define USB_CTRL_USB_PM_STATUS 0x08#define USB_CTRL_USB_DEVICE_CTL1 0x10#define USB_CTRL_USB_DEVICE_CTL1_PORT_MODE_MASK 0x00000003
@@ -190,10 +192,6 @@ static void usb_init_common(struct brcm_usb_init_params *params)pr_debug ("%s\n" , __func__); -USB_CTRL_UNSET (ctrl,USB_PM ,USB_PWRDN ); -/* 1 millisecond - for USB clocks to settle down */ -usleep_range (1000 ,2000 ); -if (USB_CTRL_MASK (USB_DEVICE_CTL1 ,PORT_MODE )) { reg =brcm_usb_readl (USB_CTRL_REG (ctrl,USB_DEVICE_CTL1 )); reg &= ~USB_CTRL_MASK (USB_DEVICE_CTL1 ,PORT_MODE );
@@ -222,6 +220,17 @@ static void usb_wake_enable_7211b0(struct brcm_usb_init_params *params,USB_CTRL_UNSET (ctrl,CTLR_CSHCR , ctl_pme_en); } +static void usb_wake_enable_7216 (struct brcm_usb_init_params *params, +bool enable) +{ +void __iomem *ctrl = params->regs[BRCM_REGS_CTRL ]; + +if (enable) +USB_CTRL_SET (ctrl,USB_PM ,XHC_PME_EN ); +else +USB_CTRL_UNSET (ctrl,USB_PM ,XHC_PME_EN ); +} +static void usb_init_common_7211b0 (struct brcm_usb_init_params *params) {void __iomem *ctrl = params->regs[BRCM_REGS_CTRL ];
@@ -295,6 +304,20 @@ static void usb_init_common_7211b0(struct brcm_usb_init_params *params)usb2_eye_fix_7211b0 (params); } +static void usb_init_common_7216 (struct brcm_usb_init_params *params) +{ +void __iomem *ctrl = params->regs[BRCM_REGS_CTRL ]; + +USB_CTRL_UNSET (ctrl,USB_PM ,XHC_S2_CLK_SWITCH_EN ); +USB_CTRL_UNSET (ctrl,USB_PM ,USB_PWRDN ); + +/* 1 millisecond - for USB clocks to settle down */ +usleep_range (1000 ,2000 ); + +usb_wake_enable_7216 (params, false); +usb_init_common (params); +} +static void usb_init_xhci (struct brcm_usb_init_params *params) {pr_debug ("%s\n" , __func__);
@@ -302,14 +325,20 @@ static void usb_init_xhci(struct brcm_usb_init_params *params)xhci_soft_reset (params,0 ); } -static void usb_uninit_common (struct brcm_usb_init_params *params) +static void usb_uninit_common_7216 (struct brcm_usb_init_params *params) {void __iomem *ctrl = params->regs[BRCM_REGS_CTRL ];pr_debug ("%s\n" , __func__); -USB_CTRL_SET (ctrl,USB_PM ,USB_PWRDN ); +if (!params->wake_enabled) { +USB_CTRL_SET (ctrl,USB_PM ,USB_PWRDN ); +/* Switch to using slower clock during suspend to save power */ +USB_CTRL_SET (ctrl,USB_PM ,XHC_S2_CLK_SWITCH_EN ); + }else { +usb_wake_enable_7216 (params, true); + } }static void usb_uninit_common_7211b0 (struct brcm_usb_init_params *params)
@@ -371,9 +400,9 @@ static void usb_set_dual_select(struct brcm_usb_init_params *params, int mode)static const struct brcm_usb_init_ops bcm7216_ops = { .init_ipp = usb_init_ipp, - .init_common = usb_init_common, + .init_common = usb_init_common_7216, .init_xhci = usb_init_xhci, - .uninit_common = usb_uninit_common, + .uninit_common = usb_uninit_common_7216, .uninit_xhci = usb_uninit_xhci, .get_dual_select = usb_get_dual_select, .set_dual_select = usb_set_dual_select,
@@ -396,6 +425,7 @@ void brcm_usb_dvr_init_7216(struct brcm_usb_init_params *params) params->family_name ="7216" ; params->ops = &bcm7216_ops; + params->suspend_with_clocks = true; }void brcm_usb_dvr_init_7211b0 (struct brcm_usb_init_params *params)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/133 phy: usb: Toggle the PHY power during init
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
[ Upstream commit 0a92ea87bdd6f77ca4e17fe19649882cf5209edd ]
When bringing up the PHY, it might be in a bad state if left powered. One case is we lose the PLL lock if the PLL is gated while the PHY is powered. Toggle the PHY power so we can start from a known state.
--- drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +6 -0
@@ -309,6 +309,12 @@ static void usb_init_common_7216(struct brcm_usb_init_params *params)void __iomem *ctrl = params->regs[BRCM_REGS_CTRL ];USB_CTRL_UNSET (ctrl,USB_PM ,XHC_S2_CLK_SWITCH_EN ); + +/* +* The PHY might be in a bad state if it is already powered +* up. Toggle the power just in case. +*/ +USB_CTRL_SET (ctrl,USB_PM ,USB_PWRDN );USB_CTRL_UNSET (ctrl,USB_PM ,USB_PWRDN );/* 1 millisecond - for USB clocks to settle down */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/133 ocfs2: correct return value of ocfs2_local_free_info()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
[ Upstream commit d32840ad4a111c6abd651fbf6b5996e6123913da ]
Now in ocfs2_local_free_info(), it returns 0 even if it actually fails. Though it doesn't cause any real problem since the only caller dquot_disable() ignores the return value, we'd better return correct as it is.
Stable-dep-of: 5f3fd772d152 ("ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv")
--- fs/ocfs2/quota_local.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
fs/ocfs2/quota_local.c +3 -6
@@ -815,7 +815,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type)struct ocfs2_quota_chunk *chunk;struct ocfs2_local_disk_chunk *dchunk;int mark_clean =1 , len; -int status; +int status =0 ;iput (oinfo->dqi_gqinode);ocfs2_simple_drop_lockres (OCFS2_SB (sb), &oinfo->dqi_gqlock);
@@ -857,17 +857,14 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) oinfo->dqi_libh, olq_update_info, info); -if (status <0 ) { +if (status <0 )mlog_errno (status); - goto out; - } - out:ocfs2_inode_unlock (sb_dqopt (sb)->files[type],1 );brelse (oinfo->dqi_libh);brelse (oinfo->dqi_lqi_bh);kfree (oinfo); -return 0 ; +return status; }static void olq_set_dquot (struct buffer_head *bh,void *private)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/133 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Lam <[email protected]>
[ Upstream commit 5f3fd772d152229d94602bca243fbb658068a597 ]
When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the dangling pointer.
During the remounting process, the pointer dqi_priv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOT_SUSPENDED flag instead of setting the DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2_get_next_id is called and only checks the quota usage flags and not the quota suspended flags.
To fix this, I set dqi_priv to null when it is freed after remounting with read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.
--- fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/quota_local.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
fs/ocfs2/quota_global.c +1 -1
@@ -881,7 +881,7 @@ static int ocfs2_get_next_id(struct super_block *sb, struct kqid *qid)int status =0 ;trace_ocfs2_get_next_id (from_kqid (&init_user_ns, *qid), type); -if (!sb_has_quota_loaded (sb, type)) { +if (!sb_has_quota_active (sb, type)) { status = -ESRCH ; goto out; }
fs/ocfs2/quota_local.c +1 -0
@@ -864,6 +864,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type)brelse (oinfo->dqi_libh);brelse (oinfo->dqi_lqi_bh);kfree (oinfo); + info->dqi_priv =NULL ;return status; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/133 drm: bridge: adv7511: Remove redundant null check before clk_disable_unprepare
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Wang <[email protected]>
[ Upstream commit 3fc5a284213d5fca1c0807ea8725355d39808930 ]
Because clk_disable_unprepare() already checked NULL clock parameter, so the additional check is unnecessary, just remove them.
Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +2 -4
@@ -1324,8 +1324,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) err_unregister_cec:cec_unregister_adapter (adv7511->cec_adap);i2c_unregister_device (adv7511->i2c_cec); -if (adv7511->cec_clk) -clk_disable_unprepare (adv7511->cec_clk); +clk_disable_unprepare (adv7511->cec_clk); err_i2c_unregister_packet:i2c_unregister_device (adv7511->i2c_packet); err_i2c_unregister_edid:
@@ -1343,8 +1342,7 @@ static int adv7511_remove(struct i2c_client *i2c)if (adv7511->type ==ADV7533 || adv7511->type ==ADV7535 )adv7533_detach_dsi (adv7511);i2c_unregister_device (adv7511->i2c_cec); -if (adv7511->cec_clk) -clk_disable_unprepare (adv7511->cec_clk); +clk_disable_unprepare (adv7511->cec_clk);adv7511_uninit_regulators (adv7511);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/133 drm/mipi-dsi: Create devm device registration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <[email protected]>
[ Upstream commit a1419fb4a73e47f0eab2985dff594ed52397471b ]
Devices that take their data through the MIPI-DSI bus but are controlled through a secondary bus like I2C have to register a secondary device on the MIPI-DSI bus through the mipi_dsi_device_register_full() function.
At removal or when an error occurs, that device needs to be removed through a call to mipi_dsi_device_unregister().
Let's create a device-managed variant of the registration function that will automatically unregister the device at unbind.
Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
--- drivers/gpu/drm/drm_mipi_dsi.c | 46 ++++++++++++++++++++++++++++++++++ include/drm/drm_mipi_dsi.h | 3 +++ 2 files changed, 49 insertions(+)
drivers/gpu/drm/drm_mipi_dsi.c +46 -0
@@ -246,6 +246,52 @@ void mipi_dsi_device_unregister(struct mipi_dsi_device *dsi) }EXPORT_SYMBOL (mipi_dsi_device_unregister); +static void devm_mipi_dsi_device_unregister (void *arg) +{ +struct mipi_dsi_device *dsi = arg; + +mipi_dsi_device_unregister (dsi); +} + +/** +* devm_mipi_dsi_device_register_full - create a managed MIPI DSI device +* @dev: device to tie the MIPI-DSI device lifetime to +* @host: DSI host to which this device is connected +* @info: pointer to template containing DSI device information +* +* Create a MIPI DSI device by using the device information provided by +* mipi_dsi_device_info template +* +* This is the managed version of mipi_dsi_device_register_full() which +* automatically calls mipi_dsi_device_unregister() when @dev is +* unbound. +* +* Returns: +* A pointer to the newly created MIPI DSI device, or, a pointer encoded +* with an error +*/ +struct mipi_dsi_device * +devm_mipi_dsi_device_register_full (struct device *dev, +struct mipi_dsi_host *host, +const struct mipi_dsi_device_info *info) +{ +struct mipi_dsi_device *dsi; +int ret; + + dsi =mipi_dsi_device_register_full (host, info); +if (IS_ERR (dsi)) +return dsi; + + ret =devm_add_action_or_reset (dev, + devm_mipi_dsi_device_unregister, + dsi); +if (ret) +return ERR_PTR (ret); + +return dsi; +} +EXPORT_SYMBOL_GPL (devm_mipi_dsi_device_register_full); +static DEFINE_MUTEX (host_lock);static LIST_HEAD (host_list);
include/drm/drm_mipi_dsi.h +3 -0
@@ -224,6 +224,9 @@ struct mipi_dsi_device * mipi_dsi_device_register_full(struct mipi_dsi_host *host, const struct mipi_dsi_device_info *info);void mipi_dsi_device_unregister (struct mipi_dsi_device *dsi); +struct mipi_dsi_device * +devm_mipi_dsi_device_register_full (struct device *dev,struct mipi_dsi_host *host, +const struct mipi_dsi_device_info *info);struct mipi_dsi_device *of_find_mipi_dsi_device_by_node (struct device_node *np);int mipi_dsi_attach (struct mipi_dsi_device *dsi);int mipi_dsi_detach (struct mipi_dsi_device *dsi);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/133 drm/mipi-dsi: Create devm device attachment
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <[email protected]>
[ Upstream commit db6568498b35a4d5d5a99420df27ed25fae31406 ]
MIPI-DSI devices need to call mipi_dsi_attach() when their probe is done to attach against their host.
However, at removal or when an error occurs, that attachment needs to be undone through a call to mipi_dsi_detach().
Let's create a device-managed variant of the attachment function that will automatically detach the device at unbind.
Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
--- drivers/gpu/drm/drm_mipi_dsi.c | 35 ++++++++++++++++++++++++++++++++++ include/drm/drm_mipi_dsi.h | 1 + 2 files changed, 36 insertions(+)
drivers/gpu/drm/drm_mipi_dsi.c +35 -0
@@ -405,6 +405,41 @@ int mipi_dsi_detach(struct mipi_dsi_device *dsi) }EXPORT_SYMBOL (mipi_dsi_detach); +static void devm_mipi_dsi_detach (void *arg) +{ +struct mipi_dsi_device *dsi = arg; + +mipi_dsi_detach (dsi); +} + +/** +* devm_mipi_dsi_attach - Attach a MIPI-DSI device to its DSI Host +* @dev: device to tie the MIPI-DSI device attachment lifetime to +* @dsi: DSI peripheral +* +* This is the managed version of mipi_dsi_attach() which automatically +* calls mipi_dsi_detach() when @dev is unbound. +* +* Returns: +* 0 on success, a negative error code on failure. +*/ +int devm_mipi_dsi_attach (struct device *dev, +struct mipi_dsi_device *dsi) +{ +int ret; + + ret =mipi_dsi_attach (dsi); +if (ret) +return ret; + + ret =devm_add_action_or_reset (dev, devm_mipi_dsi_detach, dsi); +if (ret) +return ret; + +return 0 ; +} +EXPORT_SYMBOL_GPL (devm_mipi_dsi_attach); +static ssize_t mipi_dsi_device_transfer (struct mipi_dsi_device *dsi,struct mipi_dsi_msg *msg) {
include/drm/drm_mipi_dsi.h +1 -0
@@ -230,6 +230,7 @@ devm_mipi_dsi_device_register_full(struct device *dev, struct mipi_dsi_host *hosstruct mipi_dsi_device *of_find_mipi_dsi_device_by_node (struct device_node *np);int mipi_dsi_attach (struct mipi_dsi_device *dsi);int mipi_dsi_detach (struct mipi_dsi_device *dsi); +int devm_mipi_dsi_attach (struct device *dev,struct mipi_dsi_device *dsi);int mipi_dsi_shutdown_peripheral (struct mipi_dsi_device *dsi);int mipi_dsi_turn_on_peripheral (struct mipi_dsi_device *dsi); int mipi_dsi_set_maximum_return_packet_size(struct mipi_dsi_device *dsi,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/133 drm/bridge: adv7533: Switch to devm MIPI-DSI helpers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <[email protected]>
[ Upstream commit ee9418808bcce77e2c31dbbfc58621ea99a05597 ]
Let's switch to the new devm MIPI-DSI function to register and attach our secondary device. This also avoids leaking the device when we detach the bridge.
Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
--- drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 - drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 2 -- drivers/gpu/drm/bridge/adv7511/adv7533.c | 20 ++++---------------- 3 files changed, 4 insertions(+), 19 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511.h +0 -1
@@ -399,7 +399,6 @@ enum drm_mode_status adv7533_mode_valid(struct adv7511 *adv,int adv7533_patch_registers (struct adv7511 *adv);int adv7533_patch_cec_registers (struct adv7511 *adv);int adv7533_attach_dsi (struct adv7511 *adv); -void adv7533_detach_dsi (struct adv7511 *adv);int adv7533_parse_dt (struct device_node *np,struct adv7511 *adv);#ifdef CONFIG_DRM_I2C_ADV7511_AUDIO
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +0 -2
@@ -1339,8 +1339,6 @@ static int adv7511_remove(struct i2c_client *i2c) {struct adv7511 *adv7511 =i2c_get_clientdata (i2c); -if (adv7511->type ==ADV7533 || adv7511->type ==ADV7535 ) -adv7533_detach_dsi (adv7511);i2c_unregister_device (adv7511->i2c_cec);clk_disable_unprepare (adv7511->cec_clk);
drivers/gpu/drm/bridge/adv7511/adv7533.c +4 -16
@@ -151,11 +151,10 @@ int adv7533_attach_dsi(struct adv7511 *adv)return -EPROBE_DEFER ; } - dsi =mipi_dsi_device_register_full (host, &info); + dsi =devm_mipi_dsi_device_register_full (dev, host, &info);if (IS_ERR (dsi)) {dev_err (dev,"failed to create dsi device\n" ); - ret =PTR_ERR (dsi); - goto err_dsi_device; +return PTR_ERR (dsi); } adv->dsi = dsi;
@@ -165,24 +164,13 @@ int adv7533_attach_dsi(struct adv7511 *adv) dsi->mode_flags =MIPI_DSI_MODE_VIDEO |MIPI_DSI_MODE_VIDEO_SYNC_PULSE |MIPI_DSI_MODE_EOT_PACKET |MIPI_DSI_MODE_VIDEO_HSE ; - ret =mipi_dsi_attach (dsi); + ret =devm_mipi_dsi_attach (dev, dsi);if (ret <0 ) {dev_err (dev,"failed to attach dsi to host\n" ); - goto err_dsi_attach; +return ret; }return 0 ; - -err_dsi_attach: -mipi_dsi_device_unregister (dsi); -err_dsi_device: -return ret; -} - -void adv7533_detach_dsi (struct adv7511 *adv) -{ -mipi_dsi_detach (adv->dsi); -mipi_dsi_device_unregister (adv->dsi); }int adv7533_parse_dt (struct device_node *np,struct adv7511 *adv)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/133 drm: bridge: adv7511: unregister cec i2c device after cec adapter
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alvin Šipraga <[email protected]>
[ Upstream commit 40cdb02cb9f965732eb543d47f15bef8d10f0f5f ]
cec_unregister_adapter() assumes that the underlying adapter ops are callable. For example, if the CEC adapter currently has a valid physical address, then the unregistration procedure will invalidate the physical address by setting it to f.f.f.f. Whence the following kernel oops observed after removing the adv7511 module:
Unable to handle kernel execution of user memory at virtual address 0000000000000000
Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP
Call trace:
0x0
adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511]
cec_adap_unconfigure+0x44/0x90 [cec]
__cec_s_phys_addr.part.0+0x68/0x230 [cec]
__cec_s_phys_addr+0x40/0x50 [cec]
cec_unregister_adapter+0xb4/0x118 [cec]
adv7511_remove+0x60/0x90 [adv7511]
i2c_device_remove+0x34/0xe0
device_release_driver_internal+0x114/0x1f0
driver_detach+0x54/0xe0
bus_remove_driver+0x60/0xd8
driver_unregister+0x34/0x60
i2c_del_driver+0x2c/0x68
adv7511_exit+0x1c/0x67c [adv7511]
__arm64_sys_delete_module+0x154/0x288
invoke_syscall+0x48/0x100
el0_svc_common.constprop.0+0x48/0xe8
do_el0_svc+0x28/0x88
el0_svc+0x1c/0x50
el0t_64_sync_handler+0xa8/0xb0
el0t_64_sync+0x15c/0x160
Code: bad PC value
---[ end trace 0000000000000000 ]---Protect against this scenario by unregistering i2c_cec after unregistering the CEC adapter. Duly disable the CEC clock afterwards too.
Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +2 -3
@@ -1339,9 +1339,6 @@ static int adv7511_remove(struct i2c_client *i2c) {struct adv7511 *adv7511 =i2c_get_clientdata (i2c); -i2c_unregister_device (adv7511->i2c_cec); -clk_disable_unprepare (adv7511->cec_clk); -adv7511_uninit_regulators (adv7511);drm_bridge_remove (&adv7511->bridge);
@@ -1349,6 +1346,8 @@ static int adv7511_remove(struct i2c_client *i2c)adv7511_audio_exit (adv7511);cec_unregister_adapter (adv7511->cec_adap); +i2c_unregister_device (adv7511->i2c_cec); +clk_disable_unprepare (adv7511->cec_clk);i2c_unregister_device (adv7511->i2c_packet);i2c_unregister_device (adv7511->i2c_edid);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/133 drm: bridge: adv7511: use dev_err_probe in probe function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmad Fatoum <[email protected]>
[ Upstream commit 2a865248399a13bb2b2bcc50297069a7521de258 ]
adv7511 probe may need to be attempted multiple times before no -EPROBE_DEFER is returned. Currently, every such probe results in an error message:
[ 4.534229] adv7511 1-003d: failed to find dsi host [ 4.580288] adv7511 1-003d: failed to find dsi host
This is misleading, as there is no error and probe deferral is normal behavior. Fix this by using dev_err_probe that will suppress -EPROBE_DEFER errors. While at it, we touch all dev_err in the probe path. This makes the code more concise and included the error code everywhere to aid user in debugging.
Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()")
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 6 ++---- drivers/gpu/drm/bridge/adv7511/adv7533.c | 20 ++++++++------------ 2 files changed, 10 insertions(+), 16 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +2 -4
@@ -1220,10 +1220,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)return ret; ret =adv7511_init_regulators (adv7511); -if (ret) { -dev_err (dev,"failed to init regulators\n" ); -return ret; - } +if (ret) +return dev_err_probe (dev, ret,"failed to init regulators\n" );/* * The power down GPIO is optional. If present, toggle it from active to
drivers/gpu/drm/bridge/adv7511/adv7533.c +8 -12
@@ -146,16 +146,14 @@ int adv7533_attach_dsi(struct adv7511 *adv) }; host =of_find_mipi_dsi_host_by_node (adv->host_node); -if (!host) { -dev_err (dev,"failed to find dsi host\n" ); -return -EPROBE_DEFER ; - } +if (!host) +return dev_err_probe (dev, -EPROBE_DEFER , +"failed to find dsi host\n" ); dsi =devm_mipi_dsi_device_register_full (dev, host, &info); -if (IS_ERR (dsi)) { -dev_err (dev,"failed to create dsi device\n" ); -return PTR_ERR (dsi); - } +if (IS_ERR (dsi)) +return dev_err_probe (dev,PTR_ERR (dsi), +"failed to create dsi device\n" ); adv->dsi = dsi;
@@ -165,10 +163,8 @@ int adv7533_attach_dsi(struct adv7511 *adv)MIPI_DSI_MODE_EOT_PACKET |MIPI_DSI_MODE_VIDEO_HSE ; ret =devm_mipi_dsi_attach (dev, dsi); -if (ret <0 ) { -dev_err (dev,"failed to attach dsi to host\n" ); -return ret; - } +if (ret <0 ) +return dev_err_probe (dev, ret,"failed to attach dsi to host\n" );return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/133 drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 ]
The host_node pointer was assigned and freed in adv7533_parse_dt(), and later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put() in error path of probe() and also in the remove().
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 10 ++++++++-- drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 -- 2 files changed, 8 insertions(+), 4 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +8 -2
@@ -1220,8 +1220,10 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)return ret; ret =adv7511_init_regulators (adv7511); -if (ret) -return dev_err_probe (dev, ret,"failed to init regulators\n" ); +if (ret) { +dev_err_probe (dev, ret,"failed to init regulators\n" ); + goto err_of_node_put; + }/* * The power down GPIO is optional. If present, toggle it from active to
@@ -1329,6 +1331,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)i2c_unregister_device (adv7511->i2c_edid); uninit_regulators:adv7511_uninit_regulators (adv7511); +err_of_node_put: +of_node_put (adv7511->host_node);return ret; }
@@ -1337,6 +1341,8 @@ static int adv7511_remove(struct i2c_client *i2c) {struct adv7511 *adv7511 =i2c_get_clientdata (i2c); +of_node_put (adv7511->host_node); +adv7511_uninit_regulators (adv7511);drm_bridge_remove (&adv7511->bridge);
drivers/gpu/drm/bridge/adv7511/adv7533.c +0 -2
@@ -184,8 +184,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv)if (!adv->host_node)return -ENODEV ; -of_node_put (adv->host_node); - adv->use_timing_gen = !of_property_read_bool (np,"adi,disable-timing-generator" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/133 sctp: sysctl: rto_min/max: avoid using current->nsproxy
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit 9fc17b76fc70763780aa78b38fcf4742384044a5 ]
As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:
- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.
- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.rto_min/max' is used.
--- net/sctp/sysctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sctp/sysctl.c +2 -2
@@ -396,7 +396,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,static int proc_sctp_do_rto_min (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.rto_min);unsigned int min = *(unsigned int *) ctl->extra1;unsigned int max = *(unsigned int *) ctl->extra2;struct ctl_table tbl;
@@ -424,7 +424,7 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,static int proc_sctp_do_rto_max (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) { -struct net *net = current->nsproxy->net_ns; + struct net *net = container_of(ctl->data, struct net, sctp.rto_max);unsigned int min = *(unsigned int *) ctl->extra1;unsigned int max = *(unsigned int *) ctl->extra2;struct ctl_table tbl;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/133 phy: usb: Use slow clock for wake enabled suspend
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
commit 700c44b508020a3ea29d297c677f8d4ab14b7e6a upstream.
The logic was incorrect when switching to slow clock. We want the slow clock if wake_enabled is set.
--- drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +3 -4
@@ -337,13 +337,12 @@ static void usb_uninit_common_7216(strucpr_debug ("%s\n" , __func__); -if (!params->wake_enabled) { -USB_CTRL_SET (ctrl,USB_PM ,USB_PWRDN ); - +if (params->wake_enabled) {/* Switch to using slower clock during suspend to save power */ USB_CTRL_SET (ctrl,USB_PM ,XHC_S2_CLK_SWITCH_EN ); - }else {usb_wake_enable_7216 (params, true); + }else { +USB_CTRL_SET (ctrl,USB_PM ,USB_PWRDN ); } }
Greg Kroah-Hartman
maintainerPATCH 70/133 phy: usb: Fix clock imbalance for suspend/resume
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
commit 8484199c09347bdd5d81ee8a2bc530850f900797 upstream.
We should be disabling clocks when wake from USB is not needed. Since this wasn't done, we had a clock imbalance since clocks were always being enabled on resume.
--- drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c | 2 -- drivers/phy/broadcom/phy-brcm-usb-init.h | 1 - drivers/phy/broadcom/phy-brcm-usb.c | 8 +++++--- 3 files changed, 5 insertions(+), 6 deletions(-)
drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +0 -2
@@ -430,7 +430,6 @@ void brcm_usb_dvr_init_7216(struct brcm_ params->family_name ="7216" ; params->ops = &bcm7216_ops; - params->suspend_with_clocks = true; }void brcm_usb_dvr_init_7211b0 (struct brcm_usb_init_params *params)
@@ -440,5 +439,4 @@ void brcm_usb_dvr_init_7211b0(struct brc params->family_name ="7211" ; params->ops = &bcm7211b0_ops; - params->suspend_with_clocks = true; }
drivers/phy/broadcom/phy-brcm-usb-init.h +0 -1
@@ -61,7 +61,6 @@ struct brcm_usb_init_params {const struct brcm_usb_init_ops *ops;struct regmap *syscon_piarbctl;bool wake_enabled; -bool suspend_with_clocks; };void brcm_usb_dvr_init_7445 (struct brcm_usb_init_params *params);
drivers/phy/broadcom/phy-brcm-usb.c +5 -3
@@ -585,7 +585,7 @@ static int brcm_usb_phy_suspend(struct d* and newer XHCI->2.0-clks/3.0-clks. */ -if (!priv->ini.suspend_with_clocks) { +if (!priv->ini.wake_enabled) {if (priv->phys[BRCM_USB_PHY_3_0 ].inited)clk_disable_unprepare (priv->usb_30_clk); if (priv->phys[BRCM_USB_PHY_2_0].inited ||
@@ -602,8 +602,10 @@ static int brcm_usb_phy_resume(struct de {struct brcm_usb_phy_data *priv =dev_get_drvdata (dev); -clk_prepare_enable (priv->usb_20_clk); -clk_prepare_enable (priv->usb_30_clk); +if (!priv->ini.wake_enabled) { +clk_prepare_enable (priv->usb_20_clk); +clk_prepare_enable (priv->usb_30_clk); + }brcm_usb_init_ipp (&priv->ini);/*
Greg Kroah-Hartman
maintainerPATCH 71/133 net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudheer Kumar Doredla <[email protected]>
[ Upstream commit 03d120f27d050336f7e7d21879891542c4741f81 ]
CPSW ALE has 75-bit ALE entries stored across three 32-bit words. The cpsw_ale_get_field() and cpsw_ale_set_field() functions support ALE field entries spanning up to two words at the most.
The cpsw_ale_get_field() and cpsw_ale_set_field() functions work as expected when ALE field spanned across word1 and word2, but fails when ALE field spanned across word2 and word3.
For example, while reading the ALE field spanned across word2 and word3 (i.e. bits 62 to 64), the word3 data shifted to an incorrect position due to the index becoming zero while flipping.
The same issue occurred when setting an ALE entry.
This issue has not been seen in practice but will be an issue in the future if the driver supports accessing ALE fields spanning word2 and word3
Fix the methods to handle getting/setting fields spanning up to two words.
--- drivers/net/ethernet/ti/cpsw_ale.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/ti/cpsw_ale.c +7 -7
@@ -104,15 +104,15 @@ struct cpsw_ale_dev_id {static inline int cpsw_ale_get_field (u32 *ale_entry,u32 start,u32 bits) { -int idx, idx2; +int idx, idx2, index;u32 hi_val =0 ; idx = start /32 ; idx2 = (start + bits -1 ) /32 ;/* Check if bits to be fetched exceed a word */ if (idx != idx2) { - idx2 =2 - idx2;/* flip */ - hi_val = ale_entry[idx2] << ((idx2 *32 ) - start); + index =2 - idx2;/* flip */ + hi_val = ale_entry[index] << ((idx2 *32 ) - start); } start -= idx *32 ; idx =2 - idx;/* flip */
@@ -122,16 +122,16 @@ static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits)static inline void cpsw_ale_set_field (u32 *ale_entry,u32 start,u32 bits,u32 value) { -int idx, idx2; +int idx, idx2, index; value &=BITMASK (bits); idx = start /32 ; idx2 = (start + bits -1 ) /32 ;/* Check if bits to be set exceed a word */ if (idx != idx2) { - idx2 =2 - idx2;/* flip */ - ale_entry[idx2] &= ~(BITMASK (bits + start - (idx2 *32 ))); - ale_entry[idx2] |= (value >> ((idx2 *32 ) - start)); + index =2 - idx2;/* flip */ + ale_entry[index] &= ~(BITMASK (bits + start - (idx2 *32 ))); + ale_entry[index] |= (value >> ((idx2 *32 ) - start)); } start -= idx *32 ; idx =2 - idx;/* flip */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/133 bpf: Fix bpf_sk_select_reuseport() memory leak
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit b3af60928ab9129befa65e6df0310d27300942bf ]
As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_EBPF set before it was ESTABLISHED. In other words, a non-NULL sk_reuseport_cb does not imply a non-refcounted socket.
Drop sk's reference in both error paths.
unreferenced object 0xffff888101911800 (size 2048):
comm "test_progs", pid 44109, jiffies 4297131437 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
80 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 9336483b):
__kmalloc_noprof+0x3bf/0x560
__reuseport_alloc+0x1d/0x40
reuseport_alloc+0xca/0x150
reuseport_attach_prog+0x87/0x140
sk_reuseport_attach_bpf+0xc8/0x100
sk_setsockopt+0x1181/0x1990
do_sock_setsockopt+0x12b/0x160
__sys_setsockopt+0x7b/0xc0
__x64_sys_setsockopt+0x1b/0x30
do_syscall_64+0x93/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e--- net/core/filter.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-)
net/core/filter.c +18 -12
@@ -10016,6 +10016,7 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern,bool is_sockarray = map->map_type ==BPF_MAP_TYPE_REUSEPORT_SOCKARRAY ;struct sock_reuseport *reuse;struct sock *selected_sk; +int err; selected_sk = map->ops->map_lookup_elem (map, key);if (!selected_sk)
@@ -10023,10 +10024,6 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, reuse =rcu_dereference (selected_sk->sk_reuseport_cb);if (!reuse) { -/* Lookup in sock_map can return TCP ESTABLISHED sockets. */ -if (sk_is_refcounted (selected_sk)) -sock_put (selected_sk); -/* reuseport_array has only sk with non NULL sk_reuseport_cb. * The only (!reuse) case here is - the sk has already been * unhashed (e.g. by close()), so treat it as -ENOENT.
@@ -10034,24 +10031,33 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern,* Other maps (e.g. sock_map) do not provide this guarantee and * the sk may never be in the reuseport group to begin with. */ -return is_sockarray ? -ENOENT : -EINVAL ; + err = is_sockarray ? -ENOENT : -EINVAL ; + goto error; }if (unlikely (reuse->reuseport_id != reuse_kern->reuseport_id)) {struct sock *sk = reuse_kern->sk; -if (sk->sk_protocol != selected_sk->sk_protocol) -return -EPROTOTYPE ; -else if (sk->sk_family != selected_sk->sk_family) -return -EAFNOSUPPORT ; - -/* Catch all. Likely bound to a different sockaddr. */ -return -EBADFD ; +if (sk->sk_protocol != selected_sk->sk_protocol) { + err = -EPROTOTYPE ; + }else if (sk->sk_family != selected_sk->sk_family) { + err = -EAFNOSUPPORT ; + }else { +/* Catch all. Likely bound to a different sockaddr. */ + err = -EBADFD ; + } + goto error; } reuse_kern->selected_sk = selected_sk;return 0 ; +error: +/* Lookup in sock_map can return TCP ESTABLISHED sockets. */ +if (sk_is_refcounted (selected_sk)) +sock_put (selected_sk); + +return err; }static const struct bpf_func_proto sk_select_reuseport_proto = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/133 net: net_namespace: Optimize the code
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yajun Deng <[email protected]>
[ Upstream commit 41467d2ff4dfe1837cbb0f45e2088e6e787580c6 ]
There is only one caller for ops_free(), so inline it. Separate net_drop_ns() and net_free(), so the net_free() can be called directly.
Add free_exit_list() helper function for free net_exit_list.
====================
v2:
- v1 does not apply, rebase it.
====================
Stable-dep-of: 46841c7053e6 ("gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().")
--- net/core/net_namespace.c | 52 +++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 28 deletions(-)
net/core/net_namespace.c +24 -28
@@ -113,7 +113,7 @@ static int net_assign_generic(struct net *net, unsigned int id, void *data) } ng =net_alloc_generic (); -if (ng ==NULL ) +if (!ng)return -ENOMEM ;/*
@@ -170,13 +170,6 @@ static int ops_init(const struct pernet_operations *ops, struct net *net)return err; } -static void ops_free (const struct pernet_operations *ops,struct net *net) -{ -if (ops->id && ops->size) { -kfree (net_generic (net, *ops->id)); - } -} -static void ops_pre_exit_list (const struct pernet_operations *ops,struct list_head *net_exit_list) {
@@ -208,7 +201,7 @@ static void ops_free_list(const struct pernet_operations *ops,struct net *net;if (ops->size && ops->id) {list_for_each_entry (net, net_exit_list, exit_list) -ops_free (ops, net); +kfree (net_generic (net, *ops->id)); } }
@@ -454,15 +447,18 @@ static struct net *net_alloc(void)static void net_free (struct net *net) { -kfree (rcu_access_pointer (net->gen)); -kmem_cache_free (net_cachep, net); +if (refcount_dec_and_test (&net->passive)) { +kfree (rcu_access_pointer (net->gen)); +kmem_cache_free (net_cachep, net); + } }void net_drop_ns (void *p) { -struct net *ns = p; -if (ns &&refcount_dec_and_test (&ns->passive)) -net_free (ns); +struct net *net = (struct net *)p; + +if (net) +net_free (net); } struct net *copy_net_ns(unsigned long flags,
@@ -502,7 +498,7 @@ struct net *copy_net_ns(unsigned long flags,key_remove_domain (net->key_domain);#endif put_user_ns (user_ns); -net_drop_ns (net); +net_free (net); dec_ucounts:dec_net_namespaces (ucounts);return ERR_PTR (rv);
@@ -636,7 +632,7 @@ static void cleanup_net(struct work_struct *work)key_remove_domain (net->key_domain);#endif put_user_ns (net->user_ns); -net_drop_ns (net); +net_free (net); } }
@@ -1160,6 +1156,14 @@ static int __init net_ns_init(void)pure_initcall (net_ns_init); +static void free_exit_list (struct pernet_operations *ops,struct list_head *net_exit_list) +{ +ops_pre_exit_list (ops, net_exit_list); +synchronize_rcu (); +ops_exit_list (ops, net_exit_list); +ops_free_list (ops, net_exit_list); +} +#ifdef CONFIG_NET_NS static int __register_pernet_operations (struct list_head *list,struct pernet_operations *ops)
@@ -1185,10 +1189,7 @@ static int __register_pernet_operations(struct list_head *list, out_undo:/* If I have an error cleanup all namespaces I initialized */ list_del (&ops->list); -ops_pre_exit_list (ops, &net_exit_list); -synchronize_rcu (); -ops_exit_list (ops, &net_exit_list); -ops_free_list (ops, &net_exit_list); +free_exit_list (ops, &net_exit_list);return error; }
@@ -1201,10 +1202,8 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)/* See comment in __register_pernet_operations() */ for_each_net (net)list_add_tail (&net->exit_list, &net_exit_list); -ops_pre_exit_list (ops, &net_exit_list); -synchronize_rcu (); -ops_exit_list (ops, &net_exit_list); - ops_free_list(ops, &net_exit_list); + + free_exit_list(ops, &net_exit_list); }#else
@@ -1227,10 +1226,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops) }else {LIST_HEAD (net_exit_list);list_add (&init_net.exit_list, &net_exit_list); -ops_pre_exit_list (ops, &net_exit_list); -synchronize_rcu (); -ops_exit_list (ops, &net_exit_list); -ops_free_list (ops, &net_exit_list); +free_exit_list (ops, &net_exit_list); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/133 net: add exit_batch_rtnl() method
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit fd4f101edbd9f99567ab2adb1f2169579ede7c13 ]
Many (struct pernet_operations)->exit_batch() methods have to acquire rtnl.
In presence of rtnl mutex pressure, this makes cleanup_net() very slow.
This patch adds a new exit_batch_rtnl() method to reduce number of rtnl acquisitions from cleanup_net().
exit_batch_rtnl() handlers are called while rtnl is locked, and devices to be killed can be queued in a list provided as their second argument.
A single unregister_netdevice_many() is called right before rtnl is released.
exit_batch_rtnl() handlers are called before ->exit() and ->exit_batch() handlers.
Stable-dep-of: 46841c7053e6 ("gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().")
--- include/net/net_namespace.h | 3 +++ net/core/net_namespace.c | 31 ++++++++++++++++++++++++++++++- 2 files changed, 33 insertions(+), 1 deletion(-)
include/net/net_namespace.h +3 -0
@@ -393,6 +393,9 @@ struct pernet_operations {void (*pre_exit)(struct net *net);void (*exit)(struct net *net);void (*exit_batch)(struct list_head *net_exit_list); +/* Following method is called with RTNL held. */ +void (*exit_batch_rtnl)(struct list_head *net_exit_list, +struct list_head *dev_kill_list);unsigned int *id;size_t size; };
net/core/net_namespace.c +30 -1
@@ -331,8 +331,9 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) {/* Must be called with pernet_ops_rwsem held */ const struct pernet_operations *ops, *saved_ops; -int error =0 ;LIST_HEAD (net_exit_list); +LIST_HEAD (dev_kill_list); +int error =0 ;refcount_set (&net->count,1 );refcount_set (&net->passive,1 );
@@ -365,6 +366,15 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)synchronize_rcu (); + ops = saved_ops; +rtnl_lock (); +list_for_each_entry_continue_reverse (ops, &pernet_list, list) { +if (ops->exit_batch_rtnl) + ops->exit_batch_rtnl (&net_exit_list, &dev_kill_list); + } +unregister_netdevice_many (&dev_kill_list); +rtnl_unlock (); + ops = saved_ops;list_for_each_entry_continue_reverse (ops, &pernet_list, list)ops_exit_list (ops, &net_exit_list);
@@ -569,6 +579,7 @@ static void cleanup_net(struct work_struct *work)struct net *net, *tmp, *last;struct llist_node *net_kill_list;LIST_HEAD (net_exit_list); +LIST_HEAD (dev_kill_list);/* Atomically snapshot the list of namespaces to cleanup */ net_kill_list =llist_del_all (&cleanup_list);
@@ -609,6 +620,14 @@ static void cleanup_net(struct work_struct *work)*/ synchronize_rcu (); +rtnl_lock (); +list_for_each_entry_reverse (ops, &pernet_list, list) { +if (ops->exit_batch_rtnl) + ops->exit_batch_rtnl (&net_exit_list, &dev_kill_list); + } +unregister_netdevice_many (&dev_kill_list); +rtnl_unlock (); +/* Run all of the network namespace exit methods */ list_for_each_entry_reverse (ops, &pernet_list, list)ops_exit_list (ops, &net_exit_list);
@@ -1160,7 +1179,17 @@ static void free_exit_list(struct pernet_operations *ops, struct list_head *net_ {ops_pre_exit_list (ops, net_exit_list);synchronize_rcu (); + +if (ops->exit_batch_rtnl) { +LIST_HEAD (dev_kill_list); + +rtnl_lock (); + ops->exit_batch_rtnl (net_exit_list, &dev_kill_list); +unregister_netdevice_many (&dev_kill_list); +rtnl_unlock (); + }ops_exit_list (ops, net_exit_list); +ops_free_list (ops, net_exit_list); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/133 gtp: use exit_batch_rtnl() method
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 6eedda01b2bfdcf427b37759e053dc27232f3af1 ]
exit_batch_rtnl() is called while RTNL is held,
and devices to be unregistered can be queued in the dev_kill_list.
This saves one rtnl_lock()/rtnl_unlock() pair per netns and one unregister_netdevice_many() call per netns.
Stable-dep-of: 46841c7053e6 ("gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().")
--- drivers/net/gtp.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/net/gtp.c +10 -10
@@ -1387,23 +1387,23 @@ static int __net_init gtp_net_init(struct net *net)return 0 ; } -static void __net_exit gtp_net_exit(struct net *net) +static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list, +struct list_head *dev_to_kill) { -struct gtp_net *gn =net_generic (net, gtp_net_id); -struct gtp_dev *gtp; -LIST_HEAD (list); +struct net *net; -rtnl_lock (); -list_for_each_entry (gtp, &gn->gtp_dev_list, list) -gtp_dellink (gtp->dev, &list); +list_for_each_entry (net, net_list, exit_list) { +struct gtp_net *gn =net_generic (net, gtp_net_id); +struct gtp_dev *gtp; -unregister_netdevice_many (&list); -rtnl_unlock (); +list_for_each_entry (gtp, &gn->gtp_dev_list, list) +gtp_dellink (gtp->dev, dev_to_kill); + } }static struct pernet_operations gtp_net_ops = { .init = gtp_net_init, - .exit = gtp_net_exit, + .exit_batch_rtnl = gtp_net_exit_batch_rtnl, .id = >p_net_id, .size =sizeof (struct gtp_net ), };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/133 gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 46841c7053e6d25fb33e0534ef023833bf03e382 ]
gtp_newlink() links the gtp device to a list in dev_net(dev).
However, even after the gtp device is moved to another netns, it stays on the list but should be invisible.
Let's use for_each_netdev_rcu() for netdev traversal in gtp_genl_dump_pdp().
Note that gtp_dev_list is no longer used under RCU, so list helpers are converted to the non-RCU variant.
--- drivers/net/gtp.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/net/gtp.c +11 -8
@@ -685,7 +685,7 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, } gn =net_generic (dev_net (dev), gtp_net_id); -list_add_rcu (>p->list, &gn->gtp_dev_list); +list_add (>p->list, &gn->gtp_dev_list); dev->priv_destructor = gtp_destructor;netdev_dbg (dev,"registered new GTP interface\n" );
@@ -711,7 +711,7 @@ static void gtp_dellink(struct net_device *dev, struct list_head *head)hlist_for_each_entry_safe (pctx, next, >p->tid_hash[i], hlist_tid)pdp_context_delete (pctx); -list_del_rcu (>p->list); +list_del (>p->list);unregister_netdevice_queue (dev, head); }
@@ -1289,16 +1289,19 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb,struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2 ], *gtp;int i, j, bucket = cb->args[0 ], skip = cb->args[1 ];struct net *net =sock_net (skb->sk); +struct net_device *dev;struct pdp_ctx *pctx; -struct gtp_net *gn; - - gn =net_generic (net, gtp_net_id);if (cb->args[4 ])return 0 ;rcu_read_lock (); -list_for_each_entry_rcu (gtp, &gn->gtp_dev_list, list) { +for_each_netdev_rcu (net, dev) { +if (dev->rtnl_link_ops != >p_link_ops) +continue ; + + gtp =netdev_priv (dev); +if (last_gtp && last_gtp != gtp)continue ;else
@@ -1394,9 +1397,9 @@ static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list,list_for_each_entry (net, net_list, exit_list) {struct gtp_net *gn =net_generic (net, gtp_net_id); -struct gtp_dev *gtp; +struct gtp_dev *gtp, *gtp_next; -list_for_each_entry (gtp, &gn->gtp_dev_list, list) +list_for_each_entry_safe (gtp, gtp_next, &gn->gtp_dev_list, list)gtp_dellink (gtp->dev, dev_to_kill); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/133 gtp: Destroy device along with udp sockets netns dismantle.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit eb28fd76c0a08a47b470677c6cef9dd1c60e92d1 ]
gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created.
Even when src_net is removed, the device stays alive on dev_net(dev). Then, removing src_net triggers the splat below. [0]
In this example, gtp0 is created in ns2, and the udp socket is created in ns1.
ip netns add ns1
ip netns add ns2
ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn ip netns del ns1
Let's link the device to the socket's netns instead.
Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove all gtp devices in the netns.
[0]:ref_tracker: net notrefcnt@000000003d6e7d05 has 1/2 users at
sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236)
inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252)
__sock_create (net/socket.c:1558)
udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18)
gtp_create_sock (./include/net/udp_tunnel.h:59 drivers/net/gtp.c:1423)
gtp_create_sockets (drivers/net/gtp.c:1447)
gtp_newlink (drivers/net/gtp.c:1507)
rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012)
rtnetlink_rcv_msg (net/core/rtnetlink.c:6922)
netlink_rcv_skb (net/netlink/af_netlink.c:2542)
netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347)
netlink_sendmsg (net/netlink/af_netlink.c:1891)
____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583)
___sys_sendmsg (net/socket.c:2639)
__sys_sendmsg (net/socket.c:2669)
do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
WARNING: CPU: 1 PID: 60 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179)
Modules linked in:
CPU: 1 UID: 0 PID: 60 Comm: kworker/u16:2 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179)
Code: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f> 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89
RSP: 0018:ff11000009a07b60 EFLAGS: 00010286
RAX: 0000000000002bd3 RBX: ff1100000f4e1aa0 RCX: 1ffffffff0e40ac6
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c
RBP: ff1100000f4e1af0 R08: 0000000000000001 R09: fffffbfff0e395ae
R10: 0000000000000001 R11: 0000000000036001 R12: ff1100000f4e1af0
R13: dead000000000100 R14: ff1100000f4e1af0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9b2464bd98 CR3: 0000000005286005 CR4: 0000000000771ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
? __warn (kernel/panic.c:748)
? ref_tracker_dir_exit (lib/ref_tracker.c:179)
? report_bug (lib/bug.c:201 lib/bug.c:219)
? handle_bug (arch/x86/kernel/traps.c:285)
? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1))
? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)
? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)
? ref_tracker_dir_exit (lib/ref_tracker.c:179)
? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158)
? kfree (mm/slub.c:4613 mm/slub.c:4761)
net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467)
cleanup_net (net/core/net_namespace.c:664 (discriminator 3))
process_one_work (kernel/workqueue.c:3229)
worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391)
kthread (kernel/kthread.c:389)
ret_from_fork (arch/x86/kernel/process.c:147)
ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
</TASK>--- drivers/net/gtp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/gtp.c +6 -1
@@ -684,7 +684,7 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, goto out_encap; } - gn =net_generic (dev_net (dev), gtp_net_id); + gn =net_generic (src_net, gtp_net_id);list_add (>p->list, &gn->gtp_dev_list); dev->priv_destructor = gtp_destructor;
@@ -1398,6 +1398,11 @@ static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list,list_for_each_entry (net, net_list, exit_list) {struct gtp_net *gn =net_generic (net, gtp_net_id);struct gtp_dev *gtp, *gtp_next; +struct net_device *dev; + +for_each_netdev (net, dev) +if (dev->rtnl_link_ops == >p_link_ops) +gtp_dellink (dev, dev_to_kill);list_for_each_entry_safe (gtp, gtp_next, &gn->gtp_dev_list, list)gtp_dellink (gtp->dev, dev_to_kill);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/133 nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 16ebb6f5b6295c9688749862a39a4889c56227f8 ]
The "sizeof(struct cmsg_bpf_event) + pkt_size + data_size" math could potentially have an integer wrapping bug on 32bit systems. Check for this and return an error.
--- drivers/net/ethernet/netronome/nfp/bpf/offload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/netronome/nfp/bpf/offload.c +2 -1
@@ -458,7 +458,8 @@ int nfp_bpf_event_output(struct nfp_app_bpf *bpf, const void *data, map_id_full =be64_to_cpu (cbe->map_ptr); map_id = map_id_full; -if (len <sizeof (struct cmsg_bpf_event ) + pkt_size + data_size) +if (size_add (pkt_size, data_size) >INT_MAX || + len <sizeof (struct cmsg_bpf_event ) + pkt_size + data_size)return -EINVAL ;if (cbe->hdr.ver !=NFP_CCM_ABI_VERSION )return -EINVAL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/133 net/mlx5: Add priorities for counters in RDMA namespaces
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aharon Landau <[email protected]>
[ Upstream commit b8dfed636fc6239396c3a2ae5f812505906cf215 ]
Add additional flow steering priorities in the RDMA namespace. This allows adding flow counters to count filtered RDMA traffic and then continue processing in the regular RDMA steering flow.
Stable-dep-of: c08d3e62b2e7 ("net/mlx5: Fix RDMA TX steering prio")
--- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 54 ++++++++++++++++--- include/linux/mlx5/device.h | 2 + include/linux/mlx5/fs.h | 2 + 3 files changed, 50 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +46 -8
@@ -98,6 +98,9 @@#define LEFTOVERS_NUM_LEVELS 1#define LEFTOVERS_NUM_PRIOS 1 +#define RDMA_RX_COUNTERS_PRIO_NUM_LEVELS 1 +#define RDMA_TX_COUNTERS_PRIO_NUM_LEVELS 1 +#define BY_PASS_PRIO_NUM_LEVELS 1#define BY_PASS_MIN_LEVEL (ETHTOOL_MIN_LEVEL + MLX5_BY_PASS_NUM_PRIOS +\ LEFTOVERS_NUM_PRIOS)
@@ -205,34 +208,63 @@ static struct init_tree_node egress_root_fs = { } }; -#define RDMA_RX_BYPASS_PRIO 0 -#define RDMA_RX_KERNEL_PRIO 1 +enum { +RDMA_RX_COUNTERS_PRIO , +RDMA_RX_BYPASS_PRIO , +RDMA_RX_KERNEL_PRIO , +}; + +#define RDMA_RX_BYPASS_MIN_LEVEL MLX5_BY_PASS_NUM_REGULAR_PRIOS +#define RDMA_RX_KERNEL_MIN_LEVEL (RDMA_RX_BYPASS_MIN_LEVEL + 1) +#define RDMA_RX_COUNTERS_MIN_LEVEL (RDMA_RX_KERNEL_MIN_LEVEL + 2) +static struct init_tree_node rdma_rx_root_fs = { .type =FS_TYPE_NAMESPACE , - .ar_size =2 , + .ar_size =3 , .children = (struct init_tree_node []) { + [RDMA_RX_COUNTERS_PRIO ] = +ADD_PRIO (0 ,RDMA_RX_COUNTERS_MIN_LEVEL ,0 , +FS_CHAINING_CAPS , +ADD_NS (MLX5_FLOW_TABLE_MISS_ACTION_DEF , +ADD_MULTIPLE_PRIO (MLX5_RDMA_RX_NUM_COUNTERS_PRIOS , +RDMA_RX_COUNTERS_PRIO_NUM_LEVELS ))), [RDMA_RX_BYPASS_PRIO ] = -ADD_PRIO (0 ,MLX5_BY_PASS_NUM_REGULAR_PRIOS ,0 , +ADD_PRIO (0 ,RDMA_RX_BYPASS_MIN_LEVEL ,0 ,FS_CHAINING_CAPS ,ADD_NS (MLX5_FLOW_TABLE_MISS_ACTION_DEF ,ADD_MULTIPLE_PRIO (MLX5_BY_PASS_NUM_REGULAR_PRIOS ,BY_PASS_PRIO_NUM_LEVELS ))), [RDMA_RX_KERNEL_PRIO ] = -ADD_PRIO (0 ,MLX5_BY_PASS_NUM_REGULAR_PRIOS +1 ,0 , +ADD_PRIO (0 ,RDMA_RX_KERNEL_MIN_LEVEL ,0 ,FS_CHAINING_CAPS ,ADD_NS (MLX5_FLOW_TABLE_MISS_ACTION_SWITCH_DOMAIN ,ADD_MULTIPLE_PRIO (1 ,1 ))), } }; +enum { +RDMA_TX_COUNTERS_PRIO , +RDMA_TX_BYPASS_PRIO , +}; + +#define RDMA_TX_BYPASS_MIN_LEVEL MLX5_BY_PASS_NUM_PRIOS +#define RDMA_TX_COUNTERS_MIN_LEVEL (RDMA_TX_BYPASS_MIN_LEVEL + 1) +static struct init_tree_node rdma_tx_root_fs = { .type =FS_TYPE_NAMESPACE , - .ar_size =1 , + .ar_size =2 , .children = (struct init_tree_node []) { -ADD_PRIO (0 ,MLX5_BY_PASS_NUM_PRIOS ,0 , + [RDMA_TX_COUNTERS_PRIO ] = +ADD_PRIO (0 ,RDMA_TX_COUNTERS_MIN_LEVEL ,0 , +FS_CHAINING_CAPS , +ADD_NS (MLX5_FLOW_TABLE_MISS_ACTION_DEF , +ADD_MULTIPLE_PRIO (MLX5_RDMA_TX_NUM_COUNTERS_PRIOS , +RDMA_TX_COUNTERS_PRIO_NUM_LEVELS ))), + [RDMA_TX_BYPASS_PRIO ] = +ADD_PRIO (0 ,RDMA_TX_BYPASS_MIN_LEVEL ,0 ,FS_CHAINING_CAPS_RDMA_TX ,ADD_NS (MLX5_FLOW_TABLE_MISS_ACTION_DEF , -ADD_MULTIPLE_PRIO (MLX5_BY_PASS_NUM_PRIOS , +ADD_MULTIPLE_PRIO (RDMA_TX_BYPASS_MIN_LEVEL ,BY_PASS_PRIO_NUM_LEVELS ))), } };
@@ -2311,6 +2343,12 @@ struct mlx5_flow_namespace *mlx5_get_flow_namespace(struct mlx5_core_dev *dev, prio =RDMA_RX_KERNEL_PRIO ; }else if (type ==MLX5_FLOW_NAMESPACE_RDMA_TX ) { root_ns = steering->rdma_tx_root_ns; + }else if (type ==MLX5_FLOW_NAMESPACE_RDMA_RX_COUNTERS ) { + root_ns = steering->rdma_rx_root_ns; + prio =RDMA_RX_COUNTERS_PRIO ; + }else if (type ==MLX5_FLOW_NAMESPACE_RDMA_TX_COUNTERS ) { + root_ns = steering->rdma_tx_root_ns; + prio =RDMA_TX_COUNTERS_PRIO ; }else {/* Must be NIC RX */ root_ns = steering->root_ns; prio = type;
include/linux/mlx5/device.h +2 -0
@@ -1418,6 +1418,8 @@ static inline u16 mlx5_to_sw_pkey_sz(int pkey_sz)return MLX5_MIN_PKEY_TABLE_SIZE << pkey_sz; } +#define MLX5_RDMA_RX_NUM_COUNTERS_PRIOS 2 +#define MLX5_RDMA_TX_NUM_COUNTERS_PRIOS 1#define MLX5_BY_PASS_NUM_REGULAR_PRIOS 16#define MLX5_BY_PASS_NUM_DONT_TRAP_PRIOS 16#define MLX5_BY_PASS_NUM_MULTICAST_PRIOS 1
include/linux/mlx5/fs.h +2 -0
@@ -80,6 +80,8 @@ enum mlx5_flow_namespace_type {MLX5_FLOW_NAMESPACE_RDMA_RX ,MLX5_FLOW_NAMESPACE_RDMA_RX_KERNEL ,MLX5_FLOW_NAMESPACE_RDMA_TX , +MLX5_FLOW_NAMESPACE_RDMA_RX_COUNTERS , + MLX5_FLOW_NAMESPACE_RDMA_TX_COUNTERS, }; enum {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/133 net/mlx5: Refactor mlx5_get_flow_namespace
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maor Gottlieb <[email protected]>
[ Upstream commit 4588fed7beae6d54ef4c67c77fc39364f8fc42af ]
Have all the namespace type check in the same switch case.
Stable-dep-of: c08d3e62b2e7 ("net/mlx5: Fix RDMA TX steering prio")
--- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 44 ++++++++++++++----- 1 file changed, 32 insertions(+), 12 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +32 -12
@@ -2302,6 +2302,22 @@ struct mlx5_flow_namespace *mlx5_get_fdb_sub_ns(struct mlx5_core_dev *dev, }EXPORT_SYMBOL (mlx5_get_fdb_sub_ns); +static bool is_nic_rx_ns (enum mlx5_flow_namespace_type type) +{ +switch (type) { +case MLX5_FLOW_NAMESPACE_BYPASS : +case MLX5_FLOW_NAMESPACE_LAG : +case MLX5_FLOW_NAMESPACE_OFFLOADS : +case MLX5_FLOW_NAMESPACE_ETHTOOL : +case MLX5_FLOW_NAMESPACE_KERNEL : +case MLX5_FLOW_NAMESPACE_LEFTOVERS : +case MLX5_FLOW_NAMESPACE_ANCHOR : +return true; +default : +return false; + } +} +struct mlx5_flow_namespace *mlx5_get_flow_namespace (struct mlx5_core_dev *dev,enum mlx5_flow_namespace_type type) {
@@ -2327,31 +2343,35 @@ struct mlx5_flow_namespace *mlx5_get_flow_namespace(struct mlx5_core_dev *dev,if (steering->sniffer_tx_root_ns)return &steering->sniffer_tx_root_ns->ns;return NULL ; -default : -break ; - } - -if (type ==MLX5_FLOW_NAMESPACE_EGRESS || - type ==MLX5_FLOW_NAMESPACE_EGRESS_KERNEL ) { +case MLX5_FLOW_NAMESPACE_EGRESS : +case MLX5_FLOW_NAMESPACE_EGRESS_KERNEL : root_ns = steering->egress_root_ns; prio = type -MLX5_FLOW_NAMESPACE_EGRESS ; - }else if (type ==MLX5_FLOW_NAMESPACE_RDMA_RX ) { +break ; +case MLX5_FLOW_NAMESPACE_RDMA_RX : root_ns = steering->rdma_rx_root_ns; prio =RDMA_RX_BYPASS_PRIO ; - }else if (type ==MLX5_FLOW_NAMESPACE_RDMA_RX_KERNEL ) { +break ; +case MLX5_FLOW_NAMESPACE_RDMA_RX_KERNEL : root_ns = steering->rdma_rx_root_ns; prio =RDMA_RX_KERNEL_PRIO ; - }else if (type ==MLX5_FLOW_NAMESPACE_RDMA_TX ) { +break ; +case MLX5_FLOW_NAMESPACE_RDMA_TX : root_ns = steering->rdma_tx_root_ns; - }else if (type ==MLX5_FLOW_NAMESPACE_RDMA_RX_COUNTERS ) { +break ; +case MLX5_FLOW_NAMESPACE_RDMA_RX_COUNTERS : root_ns = steering->rdma_rx_root_ns; prio =RDMA_RX_COUNTERS_PRIO ; - }else if (type ==MLX5_FLOW_NAMESPACE_RDMA_TX_COUNTERS ) { +break ; +case MLX5_FLOW_NAMESPACE_RDMA_TX_COUNTERS : root_ns = steering->rdma_tx_root_ns; prio =RDMA_TX_COUNTERS_PRIO ; - }else {/* Must be NIC RX */ +break ; +default :/* Must be NIC RX */ +WARN_ON (!is_nic_rx_ns (type)); root_ns = steering->root_ns; prio = type; +break ; }if (!root_ns)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/133 net/mlx5: Fix RDMA TX steering prio
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit c08d3e62b2e73e14da318a1d20b52d0486a28ee0 ]
User added steering rules at RDMA_TX were being added to the first prio, which is the counters prio.
Fix that so that they are correctly added to the BYPASS_PRIO instead.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +1 -0
@@ -2358,6 +2358,7 @@ struct mlx5_flow_namespace *mlx5_get_flow_namespace(struct mlx5_core_dev *dev,break ;case MLX5_FLOW_NAMESPACE_RDMA_TX : root_ns = steering->rdma_tx_root_ns; + prio =RDMA_TX_BYPASS_PRIO ;break ;case MLX5_FLOW_NAMESPACE_RDMA_RX_COUNTERS : root_ns = steering->rdma_rx_root_ns;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/133 drm/v3d: Ensure job pointer is set to NULL after job completion
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit e4b5ccd392b92300a2b341705cc4805681094e49 ]
After a job completes, the corresponding pointer in the device must be set to NULL. Failing to do so triggers a warning when unloading the driver, as it appears the job is still active. To prevent this, assign the job pointer to NULL after completing the job, indicating the job has finished.
--- drivers/gpu/drm/v3d/v3d_irq.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/v3d/v3d_irq.c +4 -0
@@ -103,6 +103,7 @@ v3d_irq(int irq, void *arg)trace_v3d_bcl_irq (&v3d->drm, fence->seqno);dma_fence_signal (&fence->base); + v3d->bin_job =NULL ; status =IRQ_HANDLED ; }
@@ -112,6 +113,7 @@ v3d_irq(int irq, void *arg)trace_v3d_rcl_irq (&v3d->drm, fence->seqno);dma_fence_signal (&fence->base); + v3d->render_job =NULL ; status =IRQ_HANDLED ; }
@@ -121,6 +123,7 @@ v3d_irq(int irq, void *arg)trace_v3d_csd_irq (&v3d->drm, fence->seqno);dma_fence_signal (&fence->base); + v3d->csd_job =NULL ; status =IRQ_HANDLED ; }
@@ -157,6 +160,7 @@ v3d_hub_irq(int irq, void *arg)trace_v3d_tfu_irq (&v3d->drm, fence->seqno);dma_fence_signal (&fence->base); + v3d->tfu_job =NULL ; status =IRQ_HANDLED ; }
Signature · 1 line
2.39.5
Re: [PATCH 5.10 082/133] drm/v3d: Ensure job pointer is set to NULL after job completion
Hi Greg,
This patch introduced a race-condition that was fixed in 6e64d6b3a3c39655de56682ec83e894978d23412 ("drm/v3d: Assign job pointer to NULL before signaling the fence") - already in torvalds/master. Is it possible to push the two patches together? This way we wouldn't break any devices.
If possible, same thing for 5.4.
Best Regards,
- Maíra
Quoted 59 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit
e4b5ccd392b92300a2b341705cc4805681094e49]After a job completes, the corresponding pointer in the device must be set to NULL. Failing to do so triggers a warning when unloading the driver, as it appears the job is still active. To prevent this, assign the job pointer to NULL after completing the job, indicating the job has finished.
Fixes 14d1d1908696 ("drm/v3d: Remove the bad signaled() implementation.")Signed-off-by Maíra Canal <[email protected]>Reviewed-by Jose Maria Casanova Crespo <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/gpu/drm/v3d/v3d_irq.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/gpu/drm/v3d/v3d_irq.c +4
-0@@ -103,6 +103,7 @@ v3d_irq(int irq, void *arg)trace_v3d_bcl_irq (&v3d->drm, fence->seqno);dma_fence_signal (&fence->base); + v3d->bin_job =NULL ; status =IRQ_HANDLED ; }@@ -112,6 +113,7 @@ v3d_irq(int irq, void *arg)trace_v3d_rcl_irq (&v3d->drm, fence->seqno);dma_fence_signal (&fence->base); + v3d->render_job =NULL ; status =IRQ_HANDLED ; }@@ -121,6 +123,7 @@ v3d_irq(int irq, void *arg)trace_v3d_csd_irq (&v3d->drm, fence->seqno);dma_fence_signal (&fence->base); + v3d->csd_job =NULL ; status =IRQ_HANDLED ; }@@ -157,6 +160,7 @@ v3d_hub_irq(int irq, void *arg)trace_v3d_tfu_irq (&v3d->drm, fence->seqno);dma_fence_signal (&fence->base); + v3d->tfu_job =NULL ; status =IRQ_HANDLED ; }
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 082/133] drm/v3d: Ensure job pointer is set to NULL after job completion
Quoted 7 lines · Maíra Canal
Hi Greg,
This patch introduced a race-condition that was fixed in
6e64d6b3a3c39655de56682ec83e894978d23412("drm/v3d: Assign job pointer to NULL before signaling the fence") - already in torvalds/master. Is it possible to push the two patches together? This way we wouldn't break any devices.
As all 5.15 and newer devices are broken right now, that's not good :(
Quoted 1 line
If possible, same thing for 5.4.
Ok, let me queue it up now, thanks.
greg k-h
Re: [PATCH 5.10 082/133] drm/v3d: Ensure job pointer is set to NULL after job completion
Hi Greg,
Quoted 10 lines · Greg Kroah-Hartman
Quoted 7 lines · Maíra Canal
Hi Greg,
This patch introduced a race-condition that was fixed in
6e64d6b3a3c39655de56682ec83e894978d23412("drm/v3d: Assign job pointer to NULL before signaling the fence") - already in torvalds/master. Is it possible to push the two patches together? This way we wouldn't break any devices.As all 5.15 and newer devices are broken right now, that's not good :(
I agree, it's terrible. I'm currently waiting for stable to pick up the fix (as it is quite quick, thanks for the great work). For a even quicker solution, should I send the fix for the newer stable branches or you can queue 6e64d6b3a3c39655de56682ec83e894978d23412 directly?
I added the "Fixes:" tag to the fix and CCed stable.
Best Regards,
- Maíra
Quoted 6 lines
Quoted 2 lines
If possible, same thing for 5.4.
Ok, let me queue it up now, thanks.
greg k-h
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 082/133] drm/v3d: Ensure job pointer is set to NULL after job completion
Quoted 12 lines · Maíra Canal
Hi Greg,
Quoted 9 lines · Greg Kroah-Hartman
Quoted 7 lines · Maíra Canal
Hi Greg,
This patch introduced a race-condition that was fixed in
6e64d6b3a3c39655de56682ec83e894978d23412("drm/v3d: Assign job pointer to NULL before signaling the fence") - already in torvalds/master. Is it possible to push the two patches together? This way we wouldn't break any devices.
Quoted 8 lines
Quoted 1 line
As all 5.15 and newer devices are broken right now, that's not good :(
I agree, it's terrible. I'm currently waiting for stable to pick up the fix (as it is quite quick, thanks for the great work). For a even quicker solution, should I send the fix for the newer stable branches or you can queue
6e64d6b3a3c39655de56682ec83e894978d23412directly?I added the "Fixes:" tag to the fix and CCed stable.
You did it all right here, it's just that we can't normally take patches until they show up in a -rc release unless specifically asked to (or it's a trivial one). You hit the window where the longest delay is, not your fault.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 83/133 i2c: mux: demux-pinctrl: check initial mux selection, too
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit ca89f73394daf92779ddaa37b42956f4953f3941 ]
When misconfigured, the initial setup of the current mux channel can fail, too. It must be checked as well.
--- drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/i2c/muxes/i2c-demux-pinctrl.c +3 -1
@@ -261,7 +261,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)pm_runtime_no_callbacks (&pdev->dev);/* switch to first parent as active master */ -i2c_demux_activate_master (priv,0 ); + err =i2c_demux_activate_master (priv,0 ); +if (err) + goto err_rollback; err =device_create_file (&pdev->dev, &dev_attr_available_masters);if (err)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/133 i2c: rcar: fix NACK handling when being a target
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 093f70c134f70e4632b295240f07d2b50b74e247 ]
When this controller is a target, the NACK handling had two issues. First, the return value from the backend was not checked on the initial WRITE_REQUESTED. So, the driver missed to send a NACK in this case. Also, the NACK always arrives one byte late on the bus, even in the WRITE_RECEIVED case. This seems to be a HW issue. We should then not rely on the backend to correctly NACK the superfluous byte as well. Fix both issues by introducing a flag which gets set whenever the backend requests a NACK and keep sending it until we get a STOP condition.
--- drivers/i2c/busses/i2c-rcar.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/i2c/busses/i2c-rcar.c +15 -5
@@ -112,6 +112,8 @@#define ID_P_PM_BLOCKED BIT(31)#define ID_P_MASK GENMASK(31, 28) +#define ID_SLAVE_NACK BIT(0) +enum rcar_i2c_type {I2C_RCAR_GEN1 ,I2C_RCAR_GEN2 ,
@@ -145,6 +147,7 @@ struct rcar_i2c_priv {int irq;struct i2c_client *host_notify_client; +u8 slave_flags; };#define rcar_i2c_priv_to_dev (p) ((p)->adap.dev.parent)
@@ -573,6 +576,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) {u32 ssr_raw, ssr_filtered;u8 value; +int ret; ssr_raw =rcar_i2c_read (priv,ICSSR ) &0xff ; ssr_filtered = ssr_raw &rcar_i2c_read (priv,ICSIER );
@@ -588,7 +592,10 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)rcar_i2c_write (priv,ICRXTX , value);rcar_i2c_write (priv,ICSIER ,SDE |SSR |SAR ); }else { -i2c_slave_event (priv->slave,I2C_SLAVE_WRITE_REQUESTED , &value); + ret =i2c_slave_event (priv->slave,I2C_SLAVE_WRITE_REQUESTED , &value); +if (ret) + priv->slave_flags |=ID_SLAVE_NACK ; +rcar_i2c_read (priv,ICRXTX );/* dummy read */ rcar_i2c_write (priv,ICSIER ,SDR |SSR |SAR ); }
@@ -601,18 +608,21 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)if (ssr_filtered &SSR ) {i2c_slave_event (priv->slave,I2C_SLAVE_STOP , &value);rcar_i2c_write (priv,ICSCR ,SIE |SDBS );/* clear our NACK */ + priv->slave_flags &= ~ID_SLAVE_NACK ;rcar_i2c_write (priv,ICSIER ,SAR );rcar_i2c_write (priv,ICSSR , ~SSR &0xff ); }/* master wants to write to us */ if (ssr_filtered &SDR ) { -int ret; - value =rcar_i2c_read (priv,ICRXTX ); ret =i2c_slave_event (priv->slave,I2C_SLAVE_WRITE_RECEIVED , &value); -/* Send NACK in case of error */ -rcar_i2c_write (priv,ICSCR ,SIE |SDBS | (ret <0 ?FNA :0 )); +if (ret) + priv->slave_flags |=ID_SLAVE_NACK ; + +/* Send NACK in case of error, but it will come 1 byte late :( */ +rcar_i2c_write (priv,ICSCR ,SIE |SDBS | + (priv->slave_flags &ID_SLAVE_NACK ?FNA :0 ));rcar_i2c_write (priv,ICSSR , ~SDR &0xff ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/133 mac802154: check local interfaces before deleting sdata list
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit eb09fbeb48709fe66c0d708aed81e910a577a30a ]
syzkaller reported a corrupted list in ieee802154_if_remove. [1]
Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4 hardware device from the system.
CPU0 CPU1
==== ====genl_family_rcv_msg_doit ieee802154_unregister_hwieee802154_del_iface ieee802154_remove_interfacesrdev_del_virtual_intf_deprecated list_del(&sdata->list)ieee802154_if_removelist_del_rcu
The net device has been unregistered, since the rcu grace period, unregistration must be run before ieee802154_if_remove.
To avoid this issue, add a check for local->interfaces before deleting sdata list.
[1]
kernel BUG at lib/list_debug.c:58!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6277 Comm: syz-executor157 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__list_del_entry_valid_or_report+0xf4/0x140 lib/list_debug.c:56 Code: e8 a1 7e 00 07 90 0f 0b 48 c7 c7 e0 37 60 8c 4c 89 fe e8 8f 7e 00 07 90 0f 0b 48 c7 c7 40 38 60 8c 4c 89 fe e8 7d 7e 00 07 90 <0f> 0b 48 c7 c7 a0 38 60 8c 4c 89 fe e8 6b 7e 00 07 90 0f 0b 48 c7 RSP: 0018:ffffc9000490f3d0 EFLAGS: 00010246 RAX: 000000000000004e RBX: dead000000000122 RCX: d211eee56bb28d00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88805b278dd8 R08: ffffffff8174a12c R09: 1ffffffff2852f0d R10: dffffc0000000000 R11: fffffbfff2852f0e R12: dffffc0000000000 R13: dffffc0000000000 R14: dead000000000100 R15: ffff88805b278cc0 FS: 0000555572f94380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056262e4a3000 CR3: 0000000078496000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_del_rcu include/linux/rculist.h:157 [inline] ieee802154_if_remove+0x86/0x1e0 net/mac802154/iface.c:687 rdev_del_virtual_intf_deprecated net/ieee802154/rdev-ops.h:24 [inline] ieee802154_del_iface+0x2c0/0x5c0 net/ieee802154/nl-phy.c:323 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2551 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:744 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2607 ___sys_sendmsg net/socket.c:2661 [inline] __sys_sendmsg+0x292/0x380 net/socket.c:2690 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/mac802154/iface.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac802154/iface.c +4 -0
@@ -688,6 +688,10 @@ void ieee802154_if_remove(struct ieee802154_sub_if_data *sdata)ASSERT_RTNL ();mutex_lock (&sdata->local->iflist_mtx); +if (list_empty (&sdata->local->interfaces)) { +mutex_unlock (&sdata->local->iflist_mtx); +return ; + }list_del_rcu (&sdata->list);mutex_unlock (&sdata->local->iflist_mtx);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/133 hfs: Sanity check the root record
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Stone <[email protected]>
[ Upstream commit b905bafdea21a75d75a96855edd9e0b6051eee30 ]
In the syzbot reproducer, the hfs_cat_rec for the root dir has type HFS_CDR_FIL after being read with hfs_bnode_read() in hfs_super_fill(). This indicates it should be used as an hfs_cat_file, which is 102 bytes. Only the first 70 bytes of that struct are initialized, however, because the entrylength passed into hfs_bnode_read() is still the length of a directory record. This causes uninitialized values to be used later on, when the hfs_cat_rec union is treated as the larger hfs_cat_file struct.
Add a check to make sure the retrieved record has the correct type for the root directory (HFS_CDR_DIR), and make sure we load the correct number of bytes for a directory record.
--- fs/hfs/super.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/hfs/super.c +3 -1
@@ -418,11 +418,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent) goto bail_no_root; res =hfs_cat_find_brec (sb,HFS_ROOT_CNID , &fd);if (!res) { -if (fd.entrylength >sizeof (rec) || fd.entrylength <0 ) { +if (fd.entrylength !=sizeof (rec.dir)) { res = -EIO ; goto bail_hfs_find; }hfs_bnode_read (fd.bnode, &rec, fd.entryoffset, fd.entrylength); +if (rec.type !=HFS_CDR_DIR ) + res = -EIO ; }if (res) goto bail_hfs_find;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/133 fs: fix missing declaration of init_files
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Kunbo <[email protected]>
[ Upstream commit 2b2fc0be98a828cf33a88a28e9745e8599fb05cf ]
fs/file.c should include include/linux/init_task.h for
declaration of init_files. This fixes the sparse warning:
fs/file.c:501:21: warning: symbol 'init_files' was not declared. Should it be static?
--- fs/file.c | 1 + 1 file changed, 1 insertion(+)
fs/file.c +1 -0
@@ -21,6 +21,7 @@#include <linux/rcupdate.h> #include <linux/close_range.h> #include <net/sock.h> +#include <linux/init_task.h> #include "internal.h"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/133 kheaders: Ignore silly-rename files
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 973b710b8821c3401ad7a25360c89e94b26884ac ]
Tell tar to ignore silly-rename files (".__afs*" and ".nfs*") when building the header archive. These occur when a file that is open is unlinked locally, but hasn't yet been closed. Such files are visible to the user via the getdents() syscall and so programs may want to do things with them.
During the kernel build, such files may be made during the processing of header files and the cleanup may get deferred by fput() which may result in tar seeing these files when it reads the directory, but they may have disappeared by the time it tries to open them, causing tar to fail with an error. Further, we don't want to include them in the tarball if they still exist.
With CONFIG_HEADERS_INSTALL=y, something like the following may be seen:
find: './kernel/.tmp_cpio_dir/include/dt-bindings/reset/.__afs2080': No such file or directory
tar: ./include/linux/greybus/.__afs3C95: File removed before we read it
The find warning doesn't seem to cause a problem.
Fix this by telling tar when called from in gen_kheaders.sh to exclude such files. This only affects afs and nfs; cifs uses the Windows Hidden attribute to prevent the file from being seen.
--- kernel/gen_kheaders.sh | 1 + 1 file changed, 1 insertion(+)
kernel/gen_kheaders.sh +1 -0
@@ -84,6 +84,7 @@ find $cpio_dir -type f -print0 | # Create archive and try to normalize metadata for reproducibility. tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ + --exclude=".__afs*" --exclude=".nfs*" \ --owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \ -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/133 poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[ Upstream commit cacd9ae4bf801ff4125d8961bb9a3ba955e51680 ]
As the comment above waitqueue_active() explains, it can only be used if both waker and waiter have mb()'s that pair with each other. However __pollwait() is broken in this respect.
This is not pipe-specific, but let's look at pipe_poll() for example:
poll_wait(...); // -> __pollwait() -> add_wait_queue() LOAD(pipe->head); LOAD(pipe->head);
In theory these LOAD()'s can leak into the critical section inside add_wait_queue() and can happen before list_add(entry, wq_head), in this case pipe_poll() can race with wakeup_pipe_readers/writers which do
smp_mb(); if (waitqueue_active(wq_head)) wake_up_interruptible(wq_head);
There are more __pollwait()-like functions (grep init_poll_funcptr), and it seems that at least ep_ptable_queue_proc() has the same problem, so the patch adds smp_mb() into poll_wait().
--- include/linux/poll.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
include/linux/poll.h +9 -1
@@ -43,8 +43,16 @@ typedef struct poll_table_struct {static inline void poll_wait (struct file * filp,wait_queue_head_t * wait_address,poll_table *p) { -if (p && p->_qproc && wait_address) +if (p && p->_qproc && wait_address) { p->_qproc (filp, wait_address, p); +/* +* This memory barrier is paired in the wq_has_sleeper(). +* See the comment above prepare_to_wait(), we need to +* ensure that subsequent tests in this thread can't be +* reordered with __add_wait_queue() in _qproc() paths. +*/ +smp_mb (); + } }/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/133 nvmet: propagate npwg topology
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Chamberlain <[email protected]>
[ Upstream commit b579d6fdc3a9149bb4d2b3133cc0767130ed13e6 ]
Ensure we propagate npwg to the target as well instead of assuming its the same logical blocks per physical block.
This ensures devices with large IUs information properly propagated on the target.
--- drivers/nvme/target/io-cmd-bdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/target/io-cmd-bdev.c +1 -1
@@ -36,7 +36,7 @@ void nvmet_bdev_set_limits(struct block_device *bdev, struct nvme_id_ns *id)*/ id->nsfeat |=1 <<4 ;/* NPWG = Namespace Preferred Write Granularity. 0's based */ - id->npwg = lpp0b; + id->npwg =to0based (bdev_io_min (bdev) /bdev_logical_block_size (bdev));/* NPWA = Namespace Preferred Write Alignment. 0's based */ id->npwa = id->npwg;/* NPDG = Namespace Preferred Deallocate Granularity. 0's based */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/133 x86/asm: Make serialize() always_inline
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit ae02ae16b76160f0aeeae2c5fb9b15226d00a4ef ]
In order to allow serialize() to be used from noinstr code, make it __always_inline.
--- arch/x86/include/asm/special_insns.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/special_insns.h +1 -1
@@ -236,7 +236,7 @@ static inline void clwb(volatile void *__p)#define nop () asm volatile ("nop") -static inline void serialize (void ) +static __always_inline void serialize(void) {/* Instruction opcode for SERIALIZE; supported in binutils >= 2.35. */ asmvolatile (".byte 0xf, 0x1, 0xe8" :::"memory" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/133 net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
commit 6be7aca91009865d8c2b73589270224a6b6e67ab upstream.
In 4.19, before the switch to linkmode bitmaps, PHY_GBIT_FEATURES included feature bits for aneg and TP/MII ports.
SUPPORTED_TP | \ SUPPORTED_MII) SUPPORTED_10baseT_Full) SUPPORTED_100baseT_Full) SUPPORTED_1000baseT_Full) PHY_100BT_FEATURES | \ PHY_DEFAULT_FEATURES) PHY_1000BT_FEATURES)
Referenced commit expanded PHY_GBIT_FEATURES, silently removing PHY_DEFAULT_FEATURES. The removed part can be re-added by using the new PHY_GBIT_FEATURES definition.
Not clear to me is why nobody seems to have noticed this issue.
I stumbled across this when checking what it takes to make phy_10_100_features_array et al private to phylib.
--- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +2 -17
@@ -856,7 +856,6 @@ static void xgbe_phy_free_phy_device(strstatic bool xgbe_phy_finisar_phy_quirks (struct xgbe_prv_data *pdata) { -__ETHTOOL_DECLARE_LINK_MODE_MASK (supported) = {0 , };struct xgbe_phy_data *phy_data = pdata->phy_data;unsigned int phy_id = phy_data->phydev->phy_id;
@@ -878,14 +877,7 @@ static bool xgbe_phy_finisar_phy_quirks(phy_write (phy_data->phydev,0x04 ,0x0d01 );phy_write (phy_data->phydev,0x00 ,0x9140 ); -linkmode_set_bit_array (phy_10_100_features_array, -ARRAY_SIZE (phy_10_100_features_array), - supported); -linkmode_set_bit_array (phy_gbit_features_array, -ARRAY_SIZE (phy_gbit_features_array), - supported); - -linkmode_copy (phy_data->phydev->supported, supported); +linkmode_copy (phy_data->phydev->supported,PHY_GBIT_FEATURES );phy_support_asym_pause (phy_data->phydev);
@@ -897,7 +889,6 @@ static bool xgbe_phy_finisar_phy_quirks(static bool xgbe_phy_belfuse_phy_quirks (struct xgbe_prv_data *pdata) { -__ETHTOOL_DECLARE_LINK_MODE_MASK (supported) = {0 , };struct xgbe_phy_data *phy_data = pdata->phy_data;struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom;unsigned int phy_id = phy_data->phydev->phy_id;
@@ -961,13 +952,7 @@ static bool xgbe_phy_belfuse_phy_quirks( reg =phy_read (phy_data->phydev,0x00 );phy_write (phy_data->phydev,0x00 , reg & ~0x00800 ); -linkmode_set_bit_array (phy_10_100_features_array, -ARRAY_SIZE (phy_10_100_features_array), - supported); -linkmode_set_bit_array (phy_gbit_features_array, -ARRAY_SIZE (phy_gbit_features_array), - supported); -linkmode_copy (phy_data->phydev->supported, supported); +linkmode_copy (phy_data->phydev->supported,PHY_GBIT_FEATURES );phy_support_asym_pause (phy_data->phydev); netif_dbg(pdata, drv, pdata->netdev,
Greg Kroah-Hartman
maintainerPATCH 93/133 vsock/virtio: cancel close work in the destructor
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
commit df137da9d6d166e87e40980e36eb8e0bc90483ef upstream.
During virtio_transport_release() we can schedule a delayed work to perform the closing of the socket before destruction.
The destructor is called either when the socket is really destroyed (reference counter to zero), or it can also be called when we are de-assigning the transport.
In the former case, we are sure the delayed work has completed, because it holds a reference until it completes, so the destructor will definitely be called after the delayed work is finished.
But in the latter case, the destructor is called by AF_VSOCK core, just after the release(), so there may still be delayed work scheduled.
Refactor the code, moving the code to delete the close work already in the do_close() to a new function. Invoke it during destruction to make sure we don't leave any pending work.
--- net/vmw_vsock/virtio_transport_common.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
net/vmw_vsock/virtio_transport_common.c +21 -8
@@ -26,6 +26,9 @@/* Threshold for detecting small packets to copy */ #define GOOD_COPY_LEN 128 +static void virtio_transport_cancel_close_work (struct vsock_sock *vsk, +bool cancel_timeout); +static const struct virtio_transport *virtio_transport_get_ops (struct vsock_sock *vsk) {
@@ -686,6 +689,8 @@ void virtio_transport_destruct(struct vs {struct virtio_vsock_sock *vvs = vsk->trans; +virtio_transport_cancel_close_work (vsk, true); +kfree (vvs); vsk->trans =NULL ; }
@@ -775,17 +780,11 @@ static void virtio_transport_wait_close( } } -static void virtio_transport_do_close (struct vsock_sock *vsk, -bool cancel_timeout) +static void virtio_transport_cancel_close_work (struct vsock_sock *vsk, +bool cancel_timeout) {struct sock *sk =sk_vsock (vsk); -sock_set_flag (sk,SOCK_DONE ); - vsk->peer_shutdown =SHUTDOWN_MASK ; -if (vsock_stream_has_data (vsk) <=0 ) - sk->sk_state =TCP_CLOSING ; - sk->sk_state_change (sk); -if (vsk->close_work_scheduled && (!cancel_timeout ||cancel_delayed_work (&vsk->close_work))) { vsk->close_work_scheduled = false;
@@ -797,6 +796,20 @@ static void virtio_transport_do_close(st } } +static void virtio_transport_do_close (struct vsock_sock *vsk, +bool cancel_timeout) +{ +struct sock *sk =sk_vsock (vsk); + +sock_set_flag (sk,SOCK_DONE ); + vsk->peer_shutdown =SHUTDOWN_MASK ; +if (vsock_stream_has_data (vsk) <=0 ) + sk->sk_state =TCP_CLOSING ; + sk->sk_state_change (sk); + +virtio_transport_cancel_close_work (vsk, cancel_timeout); +} +static void virtio_transport_close_timeout (struct work_struct *work) { struct vsock_sock *vsk =
Greg Kroah-Hartman
maintainerPATCH 94/133 vsock: reset socket state when de-assigning the transport
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
commit a24009bc9be60242651a21702609381b5092459e upstream.
Transport's release() and destruct() are called when de-assigning the vsock transport. These callbacks can touch some socket state like sock flags, sk_state, and peer_shutdown.
Since we are reassigning the socket to a new transport during vsock_connect(), let's reset these fields to have a clean state with the new transport.
--- net/vmw_vsock/af_vsock.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/vmw_vsock/af_vsock.c +9 -0
@@ -464,6 +464,15 @@ int vsock_assign_transport(struct vsock_*/ vsk->transport->release (vsk);vsock_deassign_transport (vsk); + +/* transport's release() and destruct() can touch some socket +* state, since we are reassigning the socket to a new transport +* during vsock_connect(), let's reset these fields to have a +* clean state. +*/ +sock_reset_flag (sk,SOCK_DONE ); + sk->sk_state =TCP_CLOSE ; + vsk->peer_shutdown =0 ; }/* We increase the module refcnt to prevent the transport unloading
Greg Kroah-Hartman
maintainerPATCH 95/133 fs/proc: fix softlockup in __read_vmcore (part 2)
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
commit cbc5dde0a461240046e8a41c43d7c3b76d5db952 upstream.
Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the number of softlockups in __read_vmcore at kdump time have gone down, but they still happen sometimes.
In a memory constrained environment like the kdump image, a softlockup is not just a harmless message, but it can interfere with things like RCU freeing memory, causing the crashdump to get stuck.
The second loop in __read_vmcore has a lot more opportunities for natural sleep points, like scheduling out while waiting for a data write to happen, but apparently that is not always enough.
Add a cond_resched() to the second loop in __read_vmcore to (hopefully) get rid of the softlockups.
--- fs/proc/vmcore.c | 2 ++ 1 file changed, 2 insertions(+)
fs/proc/vmcore.c +2 -0
@@ -396,6 +396,8 @@ static ssize_t __read_vmcore(char *buffeif (buflen ==0 )return acc; } + +cond_resched (); }return acc;
Greg Kroah-Hartman
maintainerPATCH 96/133 gpiolib: cdev: Fix use after free in lineinfo_changed_notify
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Han <[email protected]>
commit 02f6b0e1ec7e0e7d059dddc893645816552039da upstream.
The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watched_lines is freed by bitmap_free(), but the unregistration of lineinfo_changed_nb notifier chain failed due to waiting write rwsem. Additionally, one of the GPIO chip's lines is also in the release process and holds the notifier chain's read rwsem. Consequently, a race condition leads to the use-after-free of watched_lines.
Here is the typical stack when issue happened:
[free]gpio_chrdev_release()
--> bitmap_free(cdev->watched_lines) <-- freed
--> blocking_notifier_chain_unregister()
--> down_write(&nh->rwsem) <-- waiting rwsem
--> __down_write_common()
--> rwsem_down_write_slowpath()
--> schedule_preempt_disabled()
--> schedule()[use]st54spi_gpio_dev_release()
--> gpio_free()
--> gpiod_free()
--> gpiod_free_commit()
--> gpiod_line_state_notify()
--> blocking_notifier_call_chain()
--> down_read(&nh->rwsem); <-- held rwsem
--> notifier_call_chain()
--> lineinfo_changed_notify()
--> test_bit(xxxx, cdev->watched_lines) <-- use after freeThe side effect of the use-after-free issue is that a GPIO line event is being generated for userspace where it shouldn't. However, since the chrdev is being closed, userspace won't have the chance to read that event anyway.
To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.
--- drivers/gpio/gpiolib-cdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpiolib-cdev.c +1 -1
@@ -2352,9 +2352,9 @@ static int gpio_chrdev_release(struct instruct gpio_chardev_data *cdev = file->private_data;struct gpio_device *gdev = cdev->gdev; -bitmap_free (cdev->watched_lines);blocking_notifier_chain_unregister (&gdev->notifier, &cdev->lineinfo_changed_nb); +bitmap_free (cdev->watched_lines);put_device (&gdev->dev);kfree (cdev);
Greg Kroah-Hartman
maintainerPATCH 97/133 irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yogesh Lal <[email protected]>
commit 0d62a49ab55c99e8deb4593b8d9f923de1ab5c18 upstream.
When a CPU attempts to enter low power mode, it disables the redistributor and Group 1 interrupts and reinitializes the system registers upon wakeup.
If the transition into low power mode fails, then the CPU_PM framework invokes the PM notifier callback with CPU_PM_ENTER_FAILED to allow the drivers to undo the state changes.
The GIC V3 driver ignores CPU_PM_ENTER_FAILED, which leaves the GIC in disabled state.
Handle CPU_PM_ENTER_FAILED in the same way as CPU_PM_EXIT to restore normal operation.
[ tglx: Massage change log, add Fixes tag ]
--- drivers/irqchip/irq-gic-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-gic-v3.c +1 -1
@@ -1309,7 +1309,7 @@ static int gic_retrigger(struct irq_datastatic int gic_cpu_pm_notifier (struct notifier_block *self,unsigned long cmd,void *v) { -if (cmd ==CPU_PM_EXIT ) { +if (cmd ==CPU_PM_EXIT || cmd ==CPU_PM_ENTER_FAILED ) {if (gic_dist_security_disabled ())gic_enable_redist (true);gic_cpu_sys_reg_init ();
Greg Kroah-Hartman
maintainerPATCH 98/133 hrtimers: Handle CPU state correctly on hotplug
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
commit 2f8dea1692eef2b7ba6a256246ed82c365fdc686 upstream.
Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE:
Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once.
This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer().
Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case.
Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag.
[ tglx: Make the new callback unconditionally available, remove the online
modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ]
--- include/linux/hrtimer.h | 1 + kernel/cpu.c | 2 +- kernel/time/hrtimer.c | 11 ++++++++++- 3 files changed, 12 insertions(+), 2 deletions(-)
include/linux/hrtimer.h +1 -0
@@ -527,6 +527,7 @@ extern void __init hrtimers_init(void);extern void sysrq_timer_list_show (void );int hrtimers_prepare_cpu (unsigned int cpu); +int hrtimers_cpu_starting (unsigned int cpu);#ifdef CONFIG_HOTPLUG_CPU int hrtimers_cpu_dying (unsigned int cpu);#else
kernel/cpu.c +1 -1
@@ -1664,7 +1664,7 @@ static struct cpuhp_step cpuhp_hp_states }, [CPUHP_AP_HRTIMERS_DYING] = { .name = "hrtimers:dying", - .startup.single = NULL, + .startup.single = hrtimers_cpu_starting, .teardown.single = hrtimers_cpu_dying, },
kernel/time/hrtimer.c +10 -1
@@ -2074,6 +2074,15 @@ int hrtimers_prepare_cpu(unsigned int cp } cpu_base->cpu = cpu; +hrtimer_cpu_base_init_expiry_lock (cpu_base); +return 0 ; +} + +int hrtimers_cpu_starting (unsigned int cpu) +{ +struct hrtimer_cpu_base *cpu_base =this_cpu_ptr (&hrtimer_bases); + +/* Clear out any left over state from a CPU down operation */ cpu_base->active_bases =0 ; cpu_base->hres_active =0 ; cpu_base->hang_detected =0 ;
@@ -2082,7 +2091,6 @@ int hrtimers_prepare_cpu(unsigned int cp cpu_base->expires_next =KTIME_MAX ; cpu_base->softirq_expires_next =KTIME_MAX ; cpu_base->online =1 ; -hrtimer_cpu_base_init_expiry_lock (cpu_base);return 0 ; }
@@ -2160,6 +2168,7 @@ int hrtimers_cpu_dying(unsigned int dyinvoid __init hrtimers_init (void ) {hrtimers_prepare_cpu (smp_processor_id ()); +hrtimers_cpu_starting (smp_processor_id ());open_softirq (HRTIMER_SOFTIRQ , hrtimer_run_softirq); }
Greg Kroah-Hartman
maintainerPATCH 99/133 Revert "PCI: Use preserve_config in place of pci_flags"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Tritton <[email protected]>
This reverts commit 0dde3ae52a0dcc5cdfe2185ec58ec52b43fda22e which is commit 7246a4520b4bf1494d7d030166a11b5226f6d508 upstream.
This patch causes a regression in cuttlefish/crossvm boot on arm64.
The patch was part of a series that when applied will not cause a regression but this patch was backported to the 5.10 branch by itself.
The other patches do not apply cleanly to the 5.10 branch.
--- drivers/pci/controller/pci-host-common.c | 4 ++++ drivers/pci/probe.c | 20 +++++++++++--------- 2 files changed, 15 insertions(+), 9 deletions(-)
drivers/pci/controller/pci-host-common.c +4 -0
@@ -71,6 +71,10 @@ int pci_host_common_probe(struct platforif (IS_ERR (cfg))return PTR_ERR (cfg); +/* Do not reassign resources if probe only */ +if (!pci_has_flag (PCI_PROBE_ONLY )) +pci_add_flags (PCI_REASSIGN_ALL_BUS ); + bridge->sysdata = cfg; bridge->ops = (struct pci_ops *)&ops->pci_ops;
drivers/pci/probe.c +11 -9
@@ -3018,18 +3018,20 @@ int pci_host_probe(struct pci_host_bridg bus = bridge->bus; -/* If we must preserve the resource configuration, claim now */ -if (bridge->preserve_config) -pci_bus_claim_resources (bus); -/* -* Assign whatever was left unassigned. If we didn't claim above, -* this will reassign everything. +* We insert PCI resources into the iomem_resource and +* ioport_resource trees in either pci_bus_claim_resources() +* or pci_bus_assign_resources(). */ -pci_assign_unassigned_root_bus_resources (bus); +if (pci_has_flag (PCI_PROBE_ONLY )) { +pci_bus_claim_resources (bus); + }else { +pci_bus_size_bridges (bus); +pci_bus_assign_resources (bus); -list_for_each_entry (child, &bus->children, node) -pcie_bus_configure_settings (child); +list_for_each_entry (child, &bus->children, node) +pcie_bus_configure_settings (child); + }pci_bus_add_devices (bus);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 100/133 iio: imu: inv_icm42600: fix spi burst write not supported
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
commit c0f866de4ce447bca3191b9cefac60c4b36a7922 upstream.
Burst write with SPI is not working for all icm42600 chips. It was only used for setting user offsets with regmap_bulk_write.
Add specific SPI regmap config for using only single write with SPI.
--- drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 11 +++++++++++ drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c | 3 ++- 3 files changed, 14 insertions(+), 1 deletion(-)
drivers/iio/imu/inv_icm42600/inv_icm42600.h +1 -0
@@ -360,6 +360,7 @@ struct inv_icm42600_state {typedef int (*inv_icm42600_bus_setup )(struct inv_icm42600_state *);extern const struct regmap_config inv_icm42600_regmap_config; +extern const struct regmap_config inv_icm42600_spi_regmap_config;extern const struct dev_pm_ops inv_icm42600_pm_ops; const struct iio_mount_matrix *
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +11 -0
@@ -43,6 +43,17 @@ const struct regmap_config inv_icm42600_ };EXPORT_SYMBOL_GPL (inv_icm42600_regmap_config); +/* define specific regmap for SPI not supporting burst write */ +const struct regmap_config inv_icm42600_spi_regmap_config = { + .reg_bits =8 , + .val_bits =8 , + .max_register =0x4FFF , + .ranges = inv_icm42600_regmap_ranges, + .num_ranges =ARRAY_SIZE (inv_icm42600_regmap_ranges), + .use_single_write = true, +}; +EXPORT_SYMBOL_GPL (inv_icm42600_spi_regmap_config); +struct inv_icm42600_hw {uint8_t whoami;const char *name;
drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c +2 -1
@@ -59,7 +59,8 @@ static int inv_icm42600_probe(struct spireturn -EINVAL ; chip = (enum inv_icm42600_chip )match; - regmap =devm_regmap_init_spi (spi, &inv_icm42600_regmap_config); +/* use SPI specific regmap */ + regmap =devm_regmap_init_spi (spi, &inv_icm42600_spi_regmap_config);if (IS_ERR (regmap))return PTR_ERR (regmap);
Greg Kroah-Hartman
maintainerPATCH 101/133 iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
commit 65a60a590142c54a3f3be11ff162db2d5b0e1e06 upstream.
Currently suspending while sensors are one will result in timestamping continuing without gap at resume. It can work with monotonic clock but not with other clocks. Fix that by resetting timestamping.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +6 -1
@@ -720,6 +720,8 @@ out_unlock:static int __maybe_unused inv_icm42600_resume (struct device *dev) {struct inv_icm42600_state *st =dev_get_drvdata (dev); +struct inv_icm42600_timestamp *gyro_ts =iio_priv (st->indio_gyro); +struct inv_icm42600_timestamp *accel_ts =iio_priv (st->indio_accel);int ret;mutex_lock (&st->lock);
@@ -740,9 +742,12 @@ static int __maybe_unused inv_icm42600_r goto out_unlock;/* restore FIFO data streaming */ -if (st->fifo.on) +if (st->fifo.on) { +inv_icm42600_timestamp_reset (gyro_ts); +inv_icm42600_timestamp_reset (accel_ts); ret =regmap_write (st->map,INV_ICM42600_REG_FIFO_CONFIG ,INV_ICM42600_FIFO_CONFIG_STREAM ); + } out_unlock:mutex_unlock (&st->lock);
Greg Kroah-Hartman
maintainerPATCH 102/133 iio: adc: rockchip_saradc: fix information leak in triggered buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 38724591364e1e3b278b4053f102b49ea06ee17c upstream.
The 'data' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values.
Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace.
--- drivers/iio/adc/rockchip_saradc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/adc/rockchip_saradc.c +2 -0
@@ -254,6 +254,8 @@ static irqreturn_t rockchip_saradc_triggint ret;int i, j =0 ; +memset (&data,0 ,sizeof (data)); +mutex_lock (&i_dev->mlock);for_each_set_bit (i, i_dev->active_scan_mask, i_dev->masklength) {
Greg Kroah-Hartman
maintainerPATCH 103/133 drm/radeon: check bo_va->bo is non-NULL before using it
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Eric Pelloux-Prayer <[email protected]>
commit 6fb15dcbcf4f212930350eaee174bb60ed40a536 upstream.
The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it.
--- drivers/gpu/drm/radeon/radeon_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_gem.c +1 -1
@@ -582,7 +582,7 @@ static void radeon_gem_va_update_vm(struif (r) goto error_unlock; -if (bo_va->it.start) +if (bo_va->it.start && bo_va->bo) r =radeon_vm_bo_update (rdev, bo_va, &bo_va->bo->tbo.mem); error_unlock:
Greg Kroah-Hartman
maintainerPATCH 104/133 vmalloc: fix accounting with i915
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit a2e740e216f5bf49ccb83b6d490c72a340558a43 ]
If the caller of vmap() specifies VM_MAP_PUT_PAGES (currently only the i915 driver), we will decrement nr_vmalloc_pages and MEMCG_VMALLOC in vfree(). These counters are incremented by vmalloc() but not by vmap() so this will cause an underflow. Check the VM_MAP_PUT_PAGES flag before decrementing either counter.
--- mm/vmalloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/vmalloc.c +2 -1
@@ -2269,7 +2269,8 @@ static void __vunmap(const void *addr, iBUG_ON (!page);__free_pages (page,0 ); } -atomic_long_sub (area->nr_pages, &nr_vmalloc_pages); +if (!(area->flags &VM_MAP_PUT_PAGES )) +atomic_long_sub (area->nr_pages, &nr_vmalloc_pages);kvfree (area->pages); }
Greg Kroah-Hartman
maintainerPATCH 105/133 RDMA/hns: Fix deadlock on SRQ async events.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
commit b46494b6f9c19f141114a57729e198698f40af37 upstream.
xa_lock for SRQ table may be required in AEQ. Use xa_store_irq()/ xa_erase_irq() to avoid deadlock.
--- drivers/infiniband/hw/hns/hns_roce_main.c | 1 + drivers/infiniband/hw/hns/hns_roce_srq.c | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/infiniband/hw/hns/hns_roce_main.c +1 -0
@@ -37,6 +37,7 @@#include <rdma/ib_smi.h> #include <rdma/ib_user_verbs.h> #include <rdma/ib_cache.h> +#include "hnae3.h" #include "hns_roce_common.h" #include "hns_roce_device.h" #include <rdma/hns-abi.h>
drivers/infiniband/hw/hns/hns_roce_srq.c +3 -3
@@ -120,7 +120,7 @@ static int alloc_srqc(struct hns_roce_de goto err_out; } - ret =xa_err (xa_store (&srq_table->xa, srq->srqn, srq,GFP_KERNEL )); + ret =xa_err (xa_store_irq (&srq_table->xa, srq->srqn, srq,GFP_KERNEL ));if (ret) {ibdev_err (ibdev,"failed to store SRQC, ret = %d.\n" , ret); goto err_put;
@@ -149,7 +149,7 @@ static int alloc_srqc(struct hns_roce_dereturn ret; err_xa: -xa_erase (&srq_table->xa, srq->srqn); +xa_erase_irq (&srq_table->xa, srq->srqn); err_put:hns_roce_table_put (hr_dev, &srq_table->table, srq->srqn);
@@ -169,7 +169,7 @@ static void free_srqc(struct hns_roce_dedev_err (hr_dev->dev,"DESTROY_SRQ failed (%d) for SRQN %06lx\n" , ret, srq->srqn); -xa_erase (&srq_table->xa, srq->srqn); +xa_erase_irq (&srq_table->xa, srq->srqn);if (atomic_dec_and_test (&srq->refcount))complete (&srq->free);
Greg Kroah-Hartman
maintainerPATCH 106/133 blk-cgroup: Fix UAF in blkcg_unpin_online()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 86e6ca55b83c575ab0f2e105cf08f98e58d3d7af upstream.
blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF:
==================================================================
BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117 CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> ... Freed by task 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30
Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online().
Fix it by reading the parent pointer before destroying the blkcg's blkg's.
--- include/linux/blk-cgroup.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
include/linux/blk-cgroup.h +5 -1
@@ -428,10 +428,14 @@ static inline void blkcg_pin_online(strustatic inline void blkcg_unpin_online (struct blkcg *blkcg) {do { +struct blkcg *parent; +if (!refcount_dec_and_test (&blkcg->online_pin))break ; + + parent =blkcg_parent (blkcg);blkcg_destroy_blkgs (blkcg); - blkcg =blkcg_parent (blkcg); + blkcg = parent; }while (blkcg); }
Greg Kroah-Hartman
maintainerPATCH 107/133 ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 04ccecfa959d3b9ae7348780d8e379c6486176ac upstream.
Blamed commit accidentally removed a check for rt->rt6i_idev being NULL, as spotted by syzbot:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856 addrconf_notify+0x3cb/0x1020 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352 unregister_netdevice_many net/core/dev.c:11414 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289 unregister_netdevice include/linux/netdevice.h:3129 [inline] __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685 tun_detach drivers/net/tun.c:701 [inline] tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1acc77def9 Code: Unable to access opcode bytes at 0x7f1acc77decf. RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
--- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/route.c +1 -1
@@ -174,7 +174,7 @@ static void rt6_uncached_list_flush_dev(struct inet6_dev *rt_idev = rt->rt6i_idev;struct net_device *rt_dev = rt->dst.dev; -if (rt_idev->dev == dev) { +if (rt_idev && rt_idev->dev == dev) { rt->rt6i_idev =in6_dev_get (loopback_dev);in6_dev_put (rt_idev); }
Greg Kroah-Hartman
maintainerPATCH 108/133 nfsd: add list_head nf_gc to struct nfsd_file
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youzhong Yang <[email protected]>
commit 8e6e2ffa6569a205f1805cbaeca143b556581da6 upstream.
nfsd_file_put() in one thread can race with another thread doing garbage collection (running nfsd_file_gc() -> list_lru_walk() -> nfsd_file_lru_cb()):
* In nfsd_file_put(), nf->nf_ref is 1, so it tries to do nfsd_file_lru_add().
* nfsd_file_lru_add() returns true (with NFSD_FILE_REFERENCED bit set)
* garbage collector kicks in, nfsd_file_lru_cb() clears REFERENCED bit and returns LRU_ROTATE.
* garbage collector kicks in again, nfsd_file_lru_cb() now decrements nf->nf_ref to 0, runs nfsd_file_unhash(), removes it from the LRU and adds to the dispose list [list_lru_isolate_move(lru, &nf->nf_lru, head)]
* nfsd_file_put() detects NFSD_FILE_HASHED bit is cleared, so it tries to remove the 'nf' from the LRU [if (!nfsd_file_lru_remove(nf))]. The 'nf' has been added to the 'dispose' list by nfsd_file_lru_cb(), so nfsd_file_lru_remove(nf) simply treats it as part of the LRU and removes it, which leads to its removal from the 'dispose' list.
* At this moment, 'nf' is unhashed with its nf_ref being 0, and not on the LRU.
nfsd_file_put() continues its execution [if (refcount_dec_and_test(&nf->nf_ref))],
as nf->nf_ref is already 0, nf->nf_ref is set to REFCOUNT_SATURATED, and the 'nf'
gets no chance of being freed.nfsd_file_put() can also race with nfsd_file_cond_queue():
* In nfsd_file_put(), nf->nf_ref is 1, so it tries to do nfsd_file_lru_add().
* nfsd_file_lru_add() sets REFERENCED bit and returns true.
* Some userland application runs 'exportfs -f' or something like that, which triggers
__nfsd_file_cache_purge() -> nfsd_file_cond_queue().
* In nfsd_file_cond_queue(), it runs [if (!nfsd_file_unhash(nf))], unhash is done
successfully.
* nfsd_file_cond_queue() runs [if (!nfsd_file_get(nf))], now nf->nf_ref goes to 2.
* nfsd_file_cond_queue() runs [if (nfsd_file_lru_remove(nf))], it succeeds.
* nfsd_file_cond_queue() runs [if (refcount_sub_and_test(decrement, &nf->nf_ref))]
(with "decrement" being 2), so the nf->nf_ref goes to 0, the 'nf' is added to the
dispose list [list_add(&nf->nf_lru, dispose)]
* nfsd_file_put() detects NFSD_FILE_HASHED bit is cleared, so it tries to remove
the 'nf' from the LRU [if (!nfsd_file_lru_remove(nf))], although the 'nf' is not
in the LRU, but it is linked in the 'dispose' list, nfsd_file_lru_remove() simply
treats it as part of the LRU and removes it. This leads to its removal from
the 'dispose' list!
* Now nf->ref is 0, unhashed. nfsd_file_put() continues its execution and set
nf->nf_ref to REFCOUNT_SATURATED.As shown in the above analysis, using nf_lru for both the LRU list and dispose list can cause the leaks. This patch adds a new list_head nf_gc in struct nfsd_file, and uses it for the dispose list. This does not fix the nfsd_file leaking issue completely.
--- fs/nfsd/filecache.c | 18 ++++++++++-------- fs/nfsd/filecache.h | 1 + 2 files changed, 11 insertions(+), 8 deletions(-)
fs/nfsd/filecache.c +10 -8
@@ -218,6 +218,7 @@ nfsd_file_alloc(struct net *net, structreturn NULL ;INIT_LIST_HEAD (&nf->nf_lru); +INIT_LIST_HEAD (&nf->nf_gc); nf->nf_birthtime =ktime_get (); nf->nf_file =NULL ; nf->nf_cred =get_current_cred ();
@@ -395,8 +396,8 @@ nfsd_file_dispose_list(struct list_headstruct nfsd_file *nf;while (!list_empty (dispose)) { - nf = list_first_entry(dispose, struct nfsd_file, nf_lru); -list_del_init (&nf->nf_lru); + nf = list_first_entry(dispose, struct nfsd_file, nf_gc); +list_del_init (&nf->nf_gc);nfsd_file_free (nf); } }
@@ -413,12 +414,12 @@ nfsd_file_dispose_list_delayed(struct li {while (!list_empty (dispose)) {struct nfsd_file *nf =list_first_entry (dispose, - struct nfsd_file, nf_lru); + struct nfsd_file, nf_gc);struct nfsd_net *nn =net_generic (nf->nf_net, nfsd_net_id);struct nfsd_fcache_disposal *l = nn->fcache_disposal;spin_lock (&l->lock); -list_move_tail (&nf->nf_lru, &l->freeme); +list_move_tail (&nf->nf_gc, &l->freeme);spin_unlock (&l->lock);queue_work (nfsd_filecache_wq, &l->work); }
@@ -475,7 +476,8 @@ nfsd_file_lru_cb(struct list_head *item,/* Refcount went to zero. Unhash it and queue it to the dispose list */ nfsd_file_unhash (nf); -list_lru_isolate_move (lru, &nf->nf_lru, head); +list_lru_isolate (lru, &nf->nf_lru); +list_add (&nf->nf_gc, head);this_cpu_inc (nfsd_file_evictions);trace_nfsd_file_gc_disposed (nf);return LRU_REMOVED ;
@@ -554,7 +556,7 @@ nfsd_file_cond_queue(struct nfsd_file *n/* If refcount goes to 0, then put on the dispose list */ if (refcount_sub_and_test (decrement, &nf->nf_ref)) { -list_add (&nf->nf_lru, dispose); +list_add (&nf->nf_gc, dispose);trace_nfsd_file_closing (nf); } }
@@ -630,8 +632,8 @@ nfsd_file_close_inode_sync(struct inodenfsd_file_queue_for_close (inode, &dispose);while (!list_empty (&dispose)) { - nf = list_first_entry(&dispose, struct nfsd_file, nf_lru); -list_del_init (&nf->nf_lru); + nf = list_first_entry(&dispose, struct nfsd_file, nf_gc); +list_del_init (&nf->nf_gc);nfsd_file_free (nf); }flush_delayed_fput ();
fs/nfsd/filecache.h +1 -0
@@ -44,6 +44,7 @@ struct nfsd_file {struct nfsd_file_mark *nf_mark;struct list_head nf_lru; +struct list_head nf_gc;struct rcu_head nf_rcu;ktime_t nf_birthtime; };
Greg Kroah-Hartman
maintainerPATCH 109/133 fou: remove warn in gue_gro_receive on unsupported protocol
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
commit dd89a81d850fa9a65f67b4527c0e420d15bf836c upstream.
Drop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is not known or does not have a GRO handler.
Such a packet is easily constructed. Syzbot generates them and sets off this warning.
Remove the warning as it is expected and not actionable.
The warning was previously reduced from WARN_ON to WARN_ON_ONCE in commit 270136613bf7 ("fou: Do WARN_ON_ONCE in gue_gro_receive for bad proto callbacks").
--- net/ipv4/fou.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/fou.c +1 -1
@@ -453,7 +453,7 @@ next_proto: offloads =NAPI_GRO_CB (skb)->is_ipv6 ? inet6_offloads : inet_offloads; ops =rcu_dereference (offloads[proto]); -if (WARN_ON_ONCE (!ops || !ops->callbacks.gro_receive)) +if (!ops || !ops->callbacks.gro_receive) goto out; pp =call_gro_receive (ops->callbacks.gro_receive, head, skb);
Greg Kroah-Hartman
maintainerPATCH 110/133 vsock/virtio: discard packets if the transport changes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
commit 2cb7c756f605ec02ffe562fb26828e4bcc5fdfc1 upstream.
If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected and would cause issues when we access vsk->transport.
A possible scenario is described by Hyunwoo Kim in the attached link, where after a first connect() interrupted by a signal, and a second connect() failed, we can find vsk->transport at NULL, leading to a NULL pointer dereference.
[SG: fixed context conflict since this tree is missing commit 71dc9ec9ac7d
("virtio/vsock: replace virtio_vsock_pkt with sk_buff")]
--- net/vmw_vsock/virtio_transport_common.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/vmw_vsock/virtio_transport_common.c +5 -2
@@ -1171,8 +1171,11 @@ void virtio_transport_recv_pkt(struct vilock_sock (sk); -/* Check if sk has been closed before lock_sock */ -if (sock_flag (sk,SOCK_DONE )) { +/* Check if sk has been closed or assigned to another transport before +* lock_sock (note: listener sockets are not assigned to any transport) +*/ +if (sock_flag (sk,SOCK_DONE ) || + (sk->sk_state !=TCP_LISTEN && vsk->transport != &t->transport)) { (void )virtio_transport_reset_no_sock (t, pkt);release_sock (sk);sock_put (sk);
Greg Kroah-Hartman
maintainerPATCH 111/133 vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
commit 91751e248256efc111e52e15115840c35d85abaf upstream.
Recent reports have shown how we sometimes call vsock_*_has_data() when a vsock socket has been de-assigned from a transport (see attached links), but we shouldn't.
Previous commits should have solved the real problems, but we may have more in the future, so to avoid null-ptr-deref, we can return 0 (no space, no data available) but with a warning.
This way the code should continue to run in a nearly consistent state and have a warning that allows us to debug future problems.
[SG: fixed conflict since this tree is missing vsock_connectible_has_data()
added by commit 0798e78b102b ("af_vsock: rest of SEQPACKET support")]
--- net/vmw_vsock/af_vsock.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/vmw_vsock/af_vsock.c +6 -0
@@ -837,12 +837,18 @@ EXPORT_SYMBOL_GPL(vsock_create_connecteds64 vsock_stream_has_data (struct vsock_sock *vsk) { +if (WARN_ON (!vsk->transport)) +return 0 ; +return vsk->transport->stream_has_data (vsk); }EXPORT_SYMBOL_GPL (vsock_stream_has_data);s64 vsock_stream_has_space (struct vsock_sock *vsk) { +if (WARN_ON (!vsk->transport)) +return 0 ; +return vsk->transport->stream_has_space (vsk); }EXPORT_SYMBOL_GPL (vsock_stream_has_space);
Greg Kroah-Hartman
maintainerPATCH 112/133 x86/xen: fix SLS mitigation in xen_hypercall_iret()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
The backport of upstream patch a2796dff62d6 ("x86/xen: don't do PV iret hypercall through hypercall page") missed to adapt the SLS mitigation config check from CONFIG_MITIGATION_SLS to CONFIG_SLS.
--- arch/x86/xen/xen-asm.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/xen/xen-asm.S +1 -1
@@ -242,7 +242,7 @@ SYM_CODE_END(xen_early_idt_handler_array push %rax mov $__HYPERVISOR_iret, %eax syscall /* Do the IRET. */ -#ifdef CONFIG_MITIGATION_SLS +#ifdef CONFIG_SLS int3 #endif .endm
Greg Kroah-Hartman
maintainerPATCH 113/133 scsi: sg: Fix slab-use-after-free read in sg_release()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Sonawane <[email protected]>
commit f10593ad9bc36921f623361c9e3dd96bd52d85ee upstream.
Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN:
BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5838 __mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912 sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407
In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is called before releasing the open_rel_lock mutex. The kref_put() call may decrement the reference count of sfp to zero, triggering its cleanup through sg_remove_sfp(). This cleanup includes scheduling deferred work via sg_remove_sfp_usercontext(), which ultimately frees sfp.
After kref_put(), sg_release() continues to unlock open_rel_lock and may reference sfp or sdp. If sfp has already been freed, this results in a slab-use-after-free error.
Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the open_rel_lock mutex. This ensures:
- No references to sfp or sdp occur after the reference count is decremented.
- Cleanup functions such as sg_remove_sfp() and sg_remove_sfp_usercontext() can safely execute without impacting the mutex handling in sg_release().
The fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures proper sequencing of resource cleanup and mutex operations, eliminating the risk of use-after-free errors in sg_release().
--- drivers/scsi/sg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/sg.c +1 -1
@@ -390,7 +390,6 @@ sg_release(struct inode *inode, struct fmutex_lock (&sdp->open_rel_lock);scsi_autopm_put_device (sdp->device); -kref_put (&sfp->f_ref, sg_remove_sfp); sdp->open_cnt--;/* possibly many open()s waiting on exlude clearing, start many;
@@ -402,6 +401,7 @@ sg_release(struct inode *inode, struct fwake_up_interruptible (&sdp->open_wait); }mutex_unlock (&sdp->open_rel_lock); +kref_put (&sfp->f_ref, sg_remove_sfp);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 114/133 net: fix data-races around sk->sk_forward_alloc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
commit 073d89808c065ac4c672c0a613a71b27a80691cb upstream.
Syzkaller reported this warning:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:inet_sock_destruct+0x1c5/0x1e0 Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 <0f> 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00 RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206 RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007 RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00 RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007 R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00 R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78 FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x88/0x130 ? inet_sock_destruct+0x1c5/0x1e0 ? report_bug+0x18e/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? inet_sock_destruct+0x1c5/0x1e0 __sk_destruct+0x2a/0x200 rcu_do_batch+0x1aa/0x530 ? rcu_do_batch+0x13b/0x530 rcu_core+0x159/0x2f0 handle_softirqs+0xd3/0x2b0 ? __pfx_smpboot_thread_fn+0x10/0x10 run_ksoftirqd+0x25/0x30 smpboot_thread_fn+0xdd/0x1d0 kthread+0xd3/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]---
Its possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add() concurrently when sk->sk_state == TCP_LISTEN with sk->sk_lock unlocked, which triggers a data-race around sk->sk_forward_alloc:tcp_v6_rcv
tcp_v6_do_rcv
skb_clone_and_charge_r
sk_rmem_schedule
__sk_mem_schedule
sk_forward_alloc_add()
skb_set_owner_r
sk_mem_charge
sk_forward_alloc_add()
__kfree_skb
skb_release_all
skb_release_head_state
sock_rfree
sk_mem_uncharge
sk_forward_alloc_add()
sk_mem_reclaim
// set local var reclaimable
__sk_mem_reclaim
sk_forward_alloc_add()In this syzkaller testcase, two threads calltcp_v6_do_rcv() with skb->truesize=768, the sk_forward_alloc changes like this:
(cpu 1) | (cpu 2) | sk_forward_alloc
... | ... | 0
__sk_mem_schedule() | | +4096 = 4096
| __sk_mem_schedule() | +4096 = 8192
sk_mem_charge() | | -768 = 7424
| sk_mem_charge() | -768 = 6656
... | ... |
sk_mem_uncharge() | | +768 = 7424
reclaimable=7424 | |
| sk_mem_uncharge() | +768 = 8192
| reclaimable=8192 |
__sk_mem_reclaim() | | -4096 = 4096
| __sk_mem_reclaim() | -8192 = -4096 != 0The skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when sk->sk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock(). Fix the same issue in dccp_v6_do_rcv().
--- net/dccp/ipv6.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-)
net/dccp/ipv6.c +1 -1
@@ -602,7 +602,7 @@ static int dccp_v6_do_rcv(struct sock *sby tcp. Feel free to propose better solution. --ANK (980728) */ -if (np->rxopt.all) +if (np->rxopt.all && sk->sk_state !=DCCP_LISTEN ) opt_skb =skb_clone_and_charge_r (skb, sk);if (sk->sk_state ==DCCP_OPEN ) {/* Fast path */
net/ipv6/tcp_ipv6.c +1 -3
@@ -1484,7 +1484,7 @@ static int tcp_v6_do_rcv(struct sock *skby tcp. Feel free to propose better solution. --ANK (980728) */ -if (np->rxopt.all) +if (np->rxopt.all && sk->sk_state !=TCP_LISTEN ) opt_skb =skb_clone_and_charge_r (skb, sk);if (sk->sk_state ==TCP_ESTABLISHED ) {/* Fast path */
@@ -1521,8 +1521,6 @@ static int tcp_v6_do_rcv(struct sock *skif (nsk != sk) {if (tcp_child_process (sk, nsk, skb)) goto reset; -if (opt_skb) -__kfree_skb (opt_skb);return 0 ; } }else
Greg Kroah-Hartman
maintainerPATCH 115/133 ASoC: wm8994: Add depends on MFD core
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 5ed01155cea69801f1f0c908954a56a5a3474bed ]
The ASoC driver should not be used without the MFD component. This was causing randconfig issues with regmap IRQ which is selected by the MFD part of the wm8994 driver.
--- sound/soc/codecs/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/Kconfig +1 -0
@@ -1647,6 +1647,7 @@ config SND_SOC_WM8993 config SND_SOC_WM8994 tristate + depends on MFD_WM8994 config SND_SOC_WM8995 tristate
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/133 ASoC: samsung: Add missing selects for MFD_WM8994
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit fd55c6065bec5268740e944a1800e6fad00974d9 ]
Anything selecting SND_SOC_WM8994 should also select MFD_WM8994, as SND_SOC_WM8994 does not automatically do so. Add the missing selects.
--- sound/soc/samsung/Kconfig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/samsung/Kconfig +3 -1
@@ -214,8 +214,9 @@ config SND_SOC_SAMSUNG_TM2_WM5110 config SND_SOC_SAMSUNG_ARIES_WM8994 tristate "SoC I2S Audio support for WM8994 on Aries" - depends on SND_SOC_SAMSUNG && MFD_WM8994 && IIO && EXTCON + depends on SND_SOC_SAMSUNG && IIO && EXTCON select SND_SOC_BT_SCO + select MFD_WM8994 select SND_SOC_WM8994 select SND_SAMSUNG_I2S help
@@ -229,6 +230,7 @@ config SND_SOC_SAMSUNG_MIDAS_WM1811 tristate "SoC I2S Audio support for Midas boards" depends on SND_SOC_SAMSUNG select SND_SAMSUNG_I2S + select MFD_WM8994 select SND_SOC_WM8994 help Say Y if you want to add support for SoC audio on the Midas boards.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/133 seccomp: Stub for !CONFIG_SECCOMP
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit f90877dd7fb5085dd9abd6399daf63dd2969fc90 ]
When using !CONFIG_SECCOMP with CONFIG_GENERIC_ENTRY, the randconfig bots found the following snag:
kernel/entry/common.c: In function 'syscall_trace_enter':
Quoted 1 line
Quoted 1 line
kernel/entry/common.c:52:23: error: implicit declaration
of function '__secure_computing' [-Wimplicit-function-declaration]
52 | ret = __secure_computing(NULL);
| ^~~~~~~~~~~~~~~~~~Since generic entry calls __secure_computing() unconditionally, fix this by moving the stub out of the ifdef clause for CONFIG_HAVE_ARCH_SECCOMP_FILTER so it's always available.
--- include/linux/seccomp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/seccomp.h +1 -1
@@ -68,10 +68,10 @@ struct seccomp_data;#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER static inline int secure_computing (void ) {return 0 ; } -static inline int __secure_computing (const struct seccomp_data *sd) {return 0 ; }#else static inline void secure_computing_strict (int this_syscall) {return ; }#endif +static inline int __secure_computing (const struct seccomp_data *sd) {return 0 ; }static inline long prctl_get_seccomp (void ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/133 scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Zhang <[email protected]>
[ Upstream commit 63ca02221cc5aa0731fe2b0cc28158aaa4b84982 ]
The ISCSI_UEVENT_GET_HOST_STATS request is already handled in iscsi_get_host_stats(). This fix ensures that redundant responses are skipped in iscsi_if_rx().
- On success: send reply and stats from iscsi_get_host_stats() within if_recv_msg().
- On error: fall through.
--- drivers/scsi/scsi_transport_iscsi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/scsi_transport_iscsi.c +3 -1
@@ -4076,7 +4076,7 @@ iscsi_if_rx(struct sk_buff *skb) } do { /* - * special case for GET_STATS: + * special case for GET_STATS, GET_CHAP and GET_HOST_STATS: * on success - sending reply and stats from * inside of if_recv_msg(), * on error - fall through.
@@ -4085,6 +4085,8 @@ iscsi_if_rx(struct sk_buff *skb)break ;if (ev->type ==ISCSI_UEVENT_GET_CHAP && !err)break ; +if (ev->type ==ISCSI_UEVENT_GET_HOST_STATS && !err) +break ; err =iscsi_if_send_reply (portid, nlh->nlmsg_type, ev,sizeof (*ev));if (err == -EAGAIN && --retries <0 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/133 irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philippe Simons <[email protected]>
[ Upstream commit 3a748d483d80f066ca4b26abe45cdc0c367d13e9 ]
Some boards with Allwinner SoCs connect the PMIC's IRQ pin to the SoC's NMI pin instead of a normal GPIO. Since the power key is connected to the PMIC, and people expect to wake up a suspended system via this key, the NMI IRQ controller must stay alive when the system goes into suspend.
Add the SKIP_WAKE flag to prevent the sunxi NMI controller from going to sleep, so that the power key can wake up those systems.
[ tglx: Fixed up coding style ]
--- drivers/irqchip/irq-sunxi-nmi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/irqchip/irq-sunxi-nmi.c +2 -1
@@ -200,7 +200,8 @@ static int __init sunxi_sc_nmi_irq_init(struct device_node *node, gc->chip_types[0 ].chip.irq_unmask = irq_gc_mask_set_bit; gc->chip_types[0 ].chip.irq_eoi = irq_gc_ack_set_bit; gc->chip_types[0 ].chip.irq_set_type = sunxi_sc_nmi_set_type; - gc->chip_types[0 ].chip.flags =IRQCHIP_EOI_THREADED |IRQCHIP_EOI_IF_HANDLED ; + gc->chip_types[0 ].chip.flags =IRQCHIP_EOI_THREADED |IRQCHIP_EOI_IF_HANDLED | +IRQCHIP_SKIP_SET_WAKE ; gc->chip_types[0 ].regs.ack = reg_offs->pend; gc->chip_types[0 ].regs.mask = reg_offs->enable; gc->chip_types[0 ].regs.type = reg_offs->ctrl;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/133 ASoC: samsung: Add missing depends on I2C
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 704dbe97a68153a84319ad63f526e12ba868b88e ]
When switching to selects for MFD_WM8994 a dependency should have also been added for I2C, as the dependency on MFD_WM8994 will not be considered by the select.
--- sound/soc/samsung/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/samsung/Kconfig +2 -2
@@ -214,7 +214,7 @@ config SND_SOC_SAMSUNG_TM2_WM5110 config SND_SOC_SAMSUNG_ARIES_WM8994 tristate "SoC I2S Audio support for WM8994 on Aries" - depends on SND_SOC_SAMSUNG && IIO && EXTCON + depends on SND_SOC_SAMSUNG && I2C && IIO && EXTCON select SND_SOC_BT_SCO select MFD_WM8994 select SND_SOC_WM8994
@@ -228,7 +228,7 @@ config SND_SOC_SAMSUNG_ARIES_WM8994 config SND_SOC_SAMSUNG_MIDAS_WM1811 tristate "SoC I2S Audio support for Midas boards" - depends on SND_SOC_SAMSUNG + depends on SND_SOC_SAMSUNG && I2C select SND_SAMSUNG_I2S select MFD_WM8994 select SND_SOC_WM8994
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/133 gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
commit 7c9d9223802fbed4dee1ae301661bf346964c9d2 upstream.
Truncate an inode's address space when flipping the GFS2_DIF_JDATA flag:
depending on that flag, the pages in the address space will either use buffer heads or iomap_folio_state structs, and we cannot mix the two.
--- fs/gfs2/file.c | 1 + 1 file changed, 1 insertion(+)
fs/gfs2/file.c +1 -0
@@ -271,6 +271,7 @@ static int do_gfs2_set_flags(struct file error =filemap_fdatawait (inode->i_mapping);if (error) goto out; +truncate_inode_pages (inode->i_mapping,0 );if (new_flags &GFS2_DIF_JDATA )gfs2_ordered_del_inode (ip); }
Greg Kroah-Hartman
maintainerPATCH 122/133 net: sched: fix ets qdisc OOB Indexing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
commit d62b04fca4340a0d468d7853bd66e511935a18cb upstream.
Haowei Yan <[email protected]> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of
0. The overflow may cause local privilege escalation.
[ 18.852298] ------------[ cut here ]------------ [ 18.853271] UBSAN: array-index-out-of-bounds in net/sched/sch_ets.c:93:20 [ 18.853743] index 18446744073709551615 is out of range for type 'ets_class [16]' [ 18.854254] CPU: 0 UID: 0 PID: 1275 Comm: poc Not tainted 6.12.6-dirty #17 [ 18.854821] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 18.856532] Call Trace: [ 18.857441] <TASK> [ 18.858227] dump_stack_lvl+0xc2/0xf0 [ 18.859607] dump_stack+0x10/0x20 [ 18.860908] __ubsan_handle_out_of_bounds+0xa7/0xf0 [ 18.864022] ets_class_change+0x3d6/0x3f0 [ 18.864322] tc_ctl_tclass+0x251/0x910 [ 18.864587] ? lock_acquire+0x5e/0x140 [ 18.865113] ? __mutex_lock+0x9c/0xe70 [ 18.866009] ? __mutex_lock+0xa34/0xe70 [ 18.866401] rtnetlink_rcv_msg+0x170/0x6f0 [ 18.866806] ? __lock_acquire+0x578/0xc10 [ 18.867184] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 18.867503] netlink_rcv_skb+0x59/0x110 [ 18.867776] rtnetlink_rcv+0x15/0x30 [ 18.868159] netlink_unicast+0x1c3/0x2b0 [ 18.868440] netlink_sendmsg+0x239/0x4b0 [ 18.868721] ____sys_sendmsg+0x3e2/0x410 [ 18.869012] ___sys_sendmsg+0x88/0xe0 [ 18.869276] ? rseq_ip_fixup+0x198/0x260 [ 18.869563] ? rseq_update_cpu_node_id+0x10a/0x190 [ 18.869900] ? trace_hardirqs_off+0x5a/0xd0 [ 18.870196] ? syscall_exit_to_user_mode+0xcc/0x220 [ 18.870547] ? do_syscall_64+0x93/0x150 [ 18.870821] ? __memcg_slab_free_hook+0x69/0x290 [ 18.871157] __sys_sendmsg+0x69/0xd0 [ 18.871416] __x64_sys_sendmsg+0x1d/0x30 [ 18.871699] x64_sys_call+0x9e2/0x2670 [ 18.871979] do_syscall_64+0x87/0x150 [ 18.873280] ? do_syscall_64+0x93/0x150 [ 18.874742] ? lock_release+0x7b/0x160 [ 18.876157] ? do_user_addr_fault+0x5ce/0x8f0 [ 18.877833] ? irqentry_exit_to_user_mode+0xc2/0x210 [ 18.879608] ? irqentry_exit+0x77/0xb0 [ 18.879808] ? clear_bhb_loop+0x15/0x70 [ 18.880023] ? clear_bhb_loop+0x15/0x70 [ 18.880223] ? clear_bhb_loop+0x15/0x70 [ 18.880426] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 18.880683] RIP: 0033:0x44a957 [ 18.880851] Code: ff ff e8 fc 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 8974 24 10 [ 18.881766] RSP: 002b:00007ffcdd00fad8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 18.882149] RAX: ffffffffffffffda RBX: 00007ffcdd010db8 RCX: 000000000044a957 [ 18.882507] RDX: 0000000000000000 RSI: 00007ffcdd00fb70 RDI: 0000000000000003 [ 18.885037] RBP: 00007ffcdd010bc0 R08: 000000000703c770 R09: 000000000703c7c0 [ 18.887203] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 18.888026] R13: 00007ffcdd010da8 R14: 00000000004ca7d0 R15: 0000000000000001 [ 18.888395] </TASK> [ 18.888610] ---[ end trace ]---
--- net/sched/sch_ets.c | 2 ++ 1 file changed, 2 insertions(+)
net/sched/sch_ets.c +2 -0
@@ -91,6 +91,8 @@ ets_class_from_arg(struct Qdisc *sch, un {struct ets_sched *q =qdisc_priv (sch); +if (arg ==0 || arg > q->nbands) +return NULL ;return &q->classes[arg -1 ]; }
Greg Kroah-Hartman
maintainerPATCH 123/133 m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 50e43a57334400668952f8e551c9d87d3ed2dfef upstream.
We get there when sigreturn has performed obscene acts on kernel stack; in particular, the location of pt_regs has shifted. We are about to call syscall_trace(), which might stop for tracer. If that happens, we'd better have task_pt_regs() returning correct result...
--- arch/m68k/kernel/entry.S | 2 ++ 1 file changed, 2 insertions(+)
arch/m68k/kernel/entry.S +2 -0
@@ -189,6 +189,8 @@ ENTRY(ret_from_signal) movel %curptr@(TASK_STACK),%a1 tstb %a1@(TINFO_FLAGS+2) jge 1f + lea %sp@(SWITCH_STACK_SIZE),%a1 + movel %a1,%curptr@(TASK_THREAD+THREAD_ESP0) jbsr syscall_trace 1: RESTORE_SWITCH_STACK addql #4,%sp
Greg Kroah-Hartman
maintainerPATCH 124/133 signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit a3616a3c02722d1edb95acc7fceade242f6553ba upstream.
In the fpsp040 code when copyin or copyout fails call force_sigsegv(SIGSEGV) instead of do_exit(SIGSEGV).
This solves a couple of problems. Because do_exit embeds the ptrace stop PTRACE_EVENT_EXIT a complete stack frame needs to be present for that to work correctly. There is always the information needed for a ptrace stop where get_signal is called. So exiting with a signal solves the ptrace issue.
Further exiting with a signal ensures that all of the threads in a process are killed not just the thread that malfunctioned. Which avoids confusing userspace.
To make force_sigsegv(SIGSEGV) work in fpsp040_die modify the code to save all of the registers and jump to ret_from_exception (which ultimately calls get_signal) after fpsp040_die returns.
v2: Updated the branches to use gas's pseudo ops that automatically
calculate the best branch instruction to use for the purpose.
v1: https://lkml.kernel.org/r/87a6m8kgtx.fsf_-_@disp2133
--- arch/m68k/fpsp040/skeleton.S | 3 ++- arch/m68k/kernel/traps.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
arch/m68k/fpsp040/skeleton.S +2 -1
@@ -502,7 +502,8 @@ in_ea: .section .fixup,"ax" .even 1: - jbra fpsp040_die + jbsr fpsp040_die + jbra .Lnotkern .section __ex_table,"a" .align 4
arch/m68k/kernel/traps.c +1 -1
@@ -1152,7 +1152,7 @@ asmlinkage void set_esp0(unsigned long s*/ asmlinkage void fpsp040_die(void) { -do_exit (SIGSEGV ); +force_sigsegv (SIGSEGV ); }#ifdef CONFIG_M68KFPU_EMU
Greg Kroah-Hartman
maintainerPATCH 125/133 vfio/platform: check the bounds of read/write syscalls
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit ce9ff21ea89d191e477a02ad7eabf4f996b80a69 upstream.
count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device.
--- drivers/vfio/platform/vfio_platform_common.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/vfio/platform/vfio_platform_common.c +10 -0
@@ -405,6 +405,11 @@ static ssize_t vfio_platform_read_mmio(s {unsigned int done =0 ; +if (off >= reg->size) +return -EINVAL ; + + count =min_t (size_t, count, reg->size - off); +if (!reg->ioaddr) { reg->ioaddr =ioremap (reg->addr, reg->size);
@@ -482,6 +487,11 @@ static ssize_t vfio_platform_write_mmio( {unsigned int done =0 ; +if (off >= reg->size) +return -EINVAL ; + + count =min_t (size_t, count, reg->size - off); +if (!reg->ioaddr) { reg->ioaddr =ioremap (reg->addr, reg->size);
Greg Kroah-Hartman
maintainerPATCH 126/133 Bluetooth: RFCOMM: Fix not validating setsockopt user input
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
commit a97de7bff13b1cc825c1b1344eaed8d6c2d3e695 upstream.
syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length.
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064
--- net/bluetooth/rfcomm/sock.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
net/bluetooth/rfcomm/sock.c +5 -9
@@ -631,7 +631,7 @@ static int rfcomm_sock_setsockopt_old(stswitch (optname) {case RFCOMM_LM : -if (copy_from_sockptr (&opt, optval,sizeof (u32))) { +if (bt_copy_from_sockptr (&opt,sizeof (opt), optval, optlen)) { err = -EFAULT ;break ; }
@@ -666,7 +666,6 @@ static int rfcomm_sock_setsockopt(structstruct sock *sk = sock->sk;struct bt_security sec;int err =0 ; -size_t len;u32 opt;BT_DBG ("sk %p" , sk);
@@ -688,11 +687,9 @@ static int rfcomm_sock_setsockopt(struct sec.level =BT_SECURITY_LOW ; - len = min_t(unsigned int, sizeof(sec), optlen); -if (copy_from_sockptr (&sec, optval, len)) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&sec,sizeof (sec), optval, optlen); +if (err)break ; - }if (sec.level >BT_SECURITY_HIGH ) { err = -EINVAL ;
@@ -708,10 +705,9 @@ static int rfcomm_sock_setsockopt(structbreak ; } -if (copy_from_sockptr (&opt, optval,sizeof (u32))) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&opt,sizeof (opt), optval, optlen); +if (err)break ; - }if (opt)set_bit (BT_SK_DEFER_SETUP , &bt_sk (sk)->flags);
Greg Kroah-Hartman
maintainerPATCH 127/133 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
commit 90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12 upstream.
The per-netns IP tunnel hash table is protected by the RTNL mutex and ip_tunnel_find() is only called from the control path where the mutex is taken.
Add a lockdep expression to hlist_for_each_entry_rcu() in ip_tunnel_find() in order to validate that the mutex is held and to silence the suspicious RCU usage warning [1].
[1]
WARNING: suspicious RCU usage 6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted
-----------------------------net/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/362:
#0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60
stack backtrace: CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0xba/0x110 lockdep_rcu_suspicious.cold+0x4f/0xd6 ip_tunnel_find+0x435/0x4d0 ip_tunnel_newlink+0x517/0x7a0 ipgre_newlink+0x14c/0x170 __rtnl_newlink+0x1173/0x19c0 rtnl_newlink+0x6c/0xa0 rtnetlink_rcv_msg+0x3cc/0xf60 netlink_rcv_skb+0x171/0x450 netlink_unicast+0x539/0x7f0 netlink_sendmsg+0x8c1/0xd80 ____sys_sendmsg+0x8f9/0xc20 ___sys_sendmsg+0x197/0x1e0 __sys_sendmsg+0x122/0x1f0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/ipv4/ip_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/ip_tunnel.c +1 -1
@@ -218,7 +218,7 @@ static struct ip_tunnel *ip_tunnel_find(struct ip_tunnel *t =NULL ;struct hlist_head *head =ip_bucket (itn, parms); -hlist_for_each_entry_rcu (t, head, hash_node) { +hlist_for_each_entry_rcu (t, head, hash_node,lockdep_rtnl_is_held ()) { if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr && link == t->parms.link &&
Greg Kroah-Hartman
maintainerPATCH 128/133 wifi: iwlwifi: add a few rate index validity checks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anjaneyulu <[email protected]>
commit efbe8f81952fe469d38655744627d860879dcde8 upstream.
Validate index before access iwl_rate_mcs to keep rate->index inside the valid boundaries. Use MCS_0_INDEX if index is less than MCS_0_INDEX and MCS_9_INDEX if index is greater then MCS_9_INDEX.
--- drivers/net/wireless/intel/iwlwifi/dvm/rs.c | 7 +++++-- drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 9 ++++++--- 2 files changed, 11 insertions(+), 5 deletions(-)
drivers/net/wireless/intel/iwlwifi/dvm/rs.c +5 -2
@@ -130,7 +130,7 @@ static int iwl_hwrate_to_plcp_idx(u32 rareturn idx; } -return -1 ; +return IWL_RATE_INVALID ; } static void rs_rate_scale_perform(struct iwl_priv *priv,
@@ -3151,7 +3151,10 @@ static ssize_t rs_sta_dbgfs_scale_table_for (i =0 ; i <LINK_QUAL_MAX_RETRY_NUM ; i++) { index =iwl_hwrate_to_plcp_idx (le32_to_cpu (lq_sta->lq.rs_table[i].rate_n_flags)); -if (is_legacy (tbl->lq_type)) { +if (index ==IWL_RATE_INVALID ) { + desc +=sprintf (buff + desc," rate[%d] 0x%X invalid rate\n" , + i,le32_to_cpu (lq_sta->lq.rs_table[i].rate_n_flags)); + }else if (is_legacy (tbl->lq_type)) { desc +=sprintf (buff+desc," rate[%d] 0x%X %smbps\n" , i,le32_to_cpu (lq_sta->lq.rs_table[i].rate_n_flags), iwl_rate_mcs[index].mbps);
drivers/net/wireless/intel/iwlwifi/mvm/rs.c +6 -3
@@ -1120,10 +1120,13 @@ static void rs_get_lower_rate_down_colum rate->bw =RATE_MCS_CHAN_WIDTH_20 ; -WARN_ON_ONCE (rate->index <IWL_RATE_MCS_0_INDEX || - rate->index >IWL_RATE_MCS_9_INDEX ); +if (WARN_ON_ONCE (rate->index <IWL_RATE_MCS_0_INDEX )) + rate->index = rs_ht_to_legacy[IWL_RATE_MCS_0_INDEX ]; +else if (WARN_ON_ONCE (rate->index >IWL_RATE_MCS_9_INDEX )) + rate->index = rs_ht_to_legacy[IWL_RATE_MCS_9_INDEX ]; +else + rate->index = rs_ht_to_legacy[rate->index]; - rate->index = rs_ht_to_legacy[rate->index]; rate->ldpc = false; }else {/* Downgrade to SISO with same MCS if in MIMO */
Greg Kroah-Hartman
maintainerPATCH 129/133 USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit 575a5adf48b06a2980c9eeffedf699ed5534fade upstream.
This patch addresses a null-ptr-deref in qt2_process_read_urb() due to an incorrect bounds check in the following:
if (newport > serial->num_ports) {
dev_err(&port->dev,
"%s - port change to invalid port: %i\n",
__func__, newport);
break;
}The condition doesn't account for the valid range of the serial->port buffer, which is from 0 to serial->num_ports - 1. When newport is equal to serial->num_ports, the assignment of "port" in the following code is out-of-bounds and NULL:
serial_priv->current_port = newport;
port = serial->port[serial_priv->current_port];The fix checks if newport is greater than or equal to serial->num_ports indicating it is out-of-bounds.
--- drivers/usb/serial/quatech2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/quatech2.c +1 -1
@@ -540,7 +540,7 @@ static void qt2_process_read_urb(struct newport = *(ch +3 ); -if (newport > serial->num_ports) { +if (newport >= serial->num_ports) {dev_err (&port->dev,"%s - port change to invalid port: %i\n" , __func__, newport);
Greg Kroah-Hartman
maintainerPATCH 130/133 Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 086fd062bc3883ae1ce4166cff5355db315ad879 upstream.
This reverts commit 13014969cbf07f18d62ceea40bd8ca8ec9d36cec.
It is reported to cause crashes on Tegra systems, so revert it for now.
--- drivers/usb/gadget/function/u_serial.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/u_serial.c +4 -4
@@ -1395,10 +1395,6 @@ void gserial_disconnect(struct gserial */* REVISIT as above: how best to track this? */ port->port_line_coding = gser->port_line_coding; -/* disable endpoints, aborting down any active I/O */ -usb_ep_disable (gser->out); -usb_ep_disable (gser->in); - port->port_usb =NULL ; gser->ioport =NULL ;if (port->port.count >0 ) {
@@ -1410,6 +1406,10 @@ void gserial_disconnect(struct gserial *spin_unlock (&port->port_lock);spin_unlock_irqrestore (&serial_port_lock, flags); +/* disable endpoints, aborting down any active I/O */ +usb_ep_disable (gser->out); +usb_ep_disable (gser->in); +/* finally, free any unused/unusable I/O buffers */ spin_lock_irqsave (&port->port_lock, flags);if (port->port.count ==0 )
Greg Kroah-Hartman
maintainerPATCH 131/133 Input: atkbd - map F23 key to support default copilot shortcut
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Pearson <[email protected]>
commit 907bc9268a5a9f823ffa751957a5c1dd59f83f42 upstream.
Microsoft defined Meta+Shift+F23 as the Copilot shortcut instead of a dedicated keycode, and multiple vendors have their keyboards emit this sequence in response to users pressing a dedicated "Copilot" key. Unfortunately the default keymap table in atkbd does not map scancode 0x6e (F23) and so the key combination does not work even if userspace is ready to handle it.
Because this behavior is common between multiple vendors and the scancode is currently unused map 0x6e to keycode 193 (KEY_F23) so that key sequence is generated properly.
MS documentation for the scan code:
https://learn.microsoft.com/en-us/windows/win32/inputdev/about-keyboard-input#scan-codes
Confirmed on Lenovo, HP and Dell machines by Canonical. Tested on Lenovo T14s G6 AMD.
--- drivers/input/keyboard/atkbd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/keyboard/atkbd.c +1 -1
@@ -90,7 +90,7 @@ static const unsigned short atkbd_set2_k0 ,46 ,45 ,32 ,18 ,5 ,4 ,95 ,0 ,57 ,47 ,33 ,20 ,19 ,6 ,183 ,0 ,49 ,48 ,35 ,34 ,21 ,7 ,184 ,0 ,0 ,50 ,36 ,22 ,8 ,9 ,185 ,0 ,51 ,37 ,23 ,24 ,11 ,10 ,0 ,0 ,52 ,53 ,38 ,39 ,25 ,12 ,0 , -0 ,89 ,40 ,0 ,26 ,13 ,0 ,0 ,58 ,54 ,28 ,27 ,0 ,43 ,0 ,85 , +0 ,89 ,40 ,0 ,26 ,13 ,0 ,193 ,58 ,54 ,28 ,27 ,0 ,43 ,0 ,85 ,0 ,86 ,91 ,90 ,92 ,0 ,14 ,94 ,0 ,79 ,124 ,75 ,71 ,121 ,0 ,0 , 82, 83, 80, 76, 77, 72, 1, 69, 87, 78, 81, 74, 55, 73, 70, 99,
Greg Kroah-Hartman
maintainerPATCH 132/133 Input: xpad - add unofficial Xbox 360 wireless receiver clone
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilton Perim Neto <[email protected]>
commit e4940fe6322c851659c17852b671c6e7b1aa9f56 upstream.
Although it mimics the Microsoft's VendorID, it is in fact a clone. Taking into account that the original Microsoft Receiver is not being manufactured anymore, this drive can solve dpad issues encontered by those who still use the original 360 Wireless controller but are using a receiver clone.
--- drivers/input/joystick/xpad.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/xpad.c +1 -0
@@ -128,6 +128,7 @@ static const struct xpad_device { { 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 }, { 0x045e, 0x028f, "Microsoft X-Box 360 pad v2", 0, XTYPE_XBOX360 }, { 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, + { 0x045e, 0x02a9, "Xbox 360 Wireless Receiver (Unofficial)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE }, { 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE }, { 0x045e, 0x02e3, "Microsoft X-Box One Elite pad", 0, XTYPE_XBOXONE },
Greg Kroah-Hartman
maintainerPATCH 133/133 Input: xpad - add support for wooting two he (arm)
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Greiner <[email protected]>
commit 222f3390c15c4452a9f7e26f5b7d9138e75d00d5 upstream.
Add Wooting Two HE (ARM) to the list of supported devices.
--- drivers/input/joystick/xpad.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/xpad.c +1 -0
@@ -345,6 +345,7 @@ static const struct xpad_device { { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 }, { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 }, { 0x31e3, 0x1220, "Wooting Two HE", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1230, "Wooting Two HE (ARM)", 0, XTYPE_XBOX360 }, { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 }, { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 }, { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 },
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.234 release. There are 133 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.234 release. There are 133 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 01 Feb 2025 14:01:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.234-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
The following build regressions were noticed and reported last time on 5.15 and found here again on arc, arm, mips, parisc, powerpc with gcc and clang toolchains on 5.10.234-rc1 and 5.4.290-rc1.
Build regression: arc, arm, mips, parisc, powerpc, drivers/usb/core/port.c struct usb_device has no member named port_is_suspended
First seen on Linux (5.10.234-rc1)
Good: v5.10.233
Bad: 5.10.234-rc1
* arc:
build:
- gcc-9-axs103_defconfig
- gcc-9-vdk_hs38_smp_defconfig
* arm:
build:
- clang-19-axm55xx_defconfig
- clang-19-footbridge_defconfig
- gcc-12-axm55xx_defconfig
- gcc-12-footbridge_defconfig
- gcc-8-axm55xx_defconfig
- gcc-8-footbridge_defconfig
* mips:
build:
- gcc-12-ath79_defconfig
- gcc-12-bcm47xx_defconfig
- gcc-12-rt305x_defconfig
- gcc-8-ath79_defconfig
- gcc-8-bcm47xx_defconfig
- gcc-8-rt305x_defconfig
* parisc:
build:
- gcc-11-allyesconfig
- gcc-11-defconfig
* powerpc:
build:
- clang-19-ppc64e_defconfig
- gcc-12-cell_defconfig
- gcc-12-ppc64e_defconfig
- gcc-8-cell_defconfig
- gcc-8-ppc64e_defconfig
Build log:
-------drivers/usb/core/port.c:299:26: error: 'struct usb_device' has no member named 'port_is_suspended'
299 | if (udev && !udev->port_is_suspended) {
|metadata:
---------
* Build log: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.233-134-gd215826da15b/testrun/27078309/suite/build/test/gcc-12-footbridge_defconfig/log
* Details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.233-134-gd215826da15b/testrun/27078309/suite/build/test/gcc-12-footbridge_defconfig/details/
* build: https://storage.tuxsuite.com/public/linaro/lkft/builds/2sLvkKOcaJTFWGOHFpeqcAkyaIB/
* Kernel config:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2sLvkKOcaJTFWGOHFpeqcAkyaIB/config
* git_describe: v5.10.233-134-gd215826da15b
* git_repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git_sha: d215826da15b526aadf99923695890c777190399
* Architectures: arc, arm, mips, parisc, powerpc
* Toolchain version: gcc-12, gcc-11, gcc-8 and clang-19
Please find the email discussion
Steps to reproduce:
------
$ tuxmake --runtime podman --target-arch arm --toolchain gcc-12 --kconfig footbridge_defconfig $ tuxmake --runtime podman --target-arch sh --toolchain gcc-11 --kconfig defconfig
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.234 release. There are 133 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 01 Feb 2025 14:01:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.234-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Hi1
Quoted 4 lines
This is the start of the stable review cycle for the 5.10.234 release. There are 133 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
We get build errors on risc-v:
drivers/usb/core/port.c: In function 'usb_port_shutdown':
2268drivers/usb/core/port.c:299:19: error: 'struct usb_device' has no member named 'port_is_suspended' 2269
299 | if (udev && !udev->port_is_suspended) {
2270
| ^~
2271
make[3]: *** [scripts/Makefile.build:286: drivers/usb/core/port.o] Error 1
2272
make[3]: *** Waiting for unfinished jobs....
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/9000587039
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1648756200
I believe we hit similar problems in 6.1 before.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.234 release. There are 133 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 01 Feb 2025 14:01:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.234-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
67 tests: 67 pass, 0 failLinux version: 5.10.234-rc1-gd215826da15b
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon