6.6.83-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.6.83-rc1 review
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.83-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.83-rc1
Thomas Weißschuh <[email protected]>
kbuild: userprogs: use correct lld when linking through clang
Quang Le <[email protected]>
pfifo_tail_enqueue: Drop new packet when sch->limit == 0
Ralf Schlatterbeck <[email protected]>
spi-mxs: Fix chipselect glitch
Ard Biesheuvel <[email protected]>
x86/boot: Sanitize boot params before parsing command line
Ard Biesheuvel <[email protected]>
x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr'
Roberto Sassu <[email protected]>
ima: Reset IMA_NONACTION_RULE_FLAGS after post_setattr
Xi Ruoyao <[email protected]>
x86/mm: Don't disable PCID when INVLPG has been fixed by microcode
Jiri Olsa <[email protected]>
uprobes: Fix race in uprobe_free_utask
Imre Deak <[email protected]>
drm/i915/dsi: Use TRANS_DDI_FUNC_CTL's own port width macro
Greg Kroah-Hartman <[email protected]>
Revert "KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map()"
Greg Kroah-Hartman <[email protected]>
Revert "KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock"
Greg Kroah-Hartman <[email protected]>
Revert "KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults"
Greg Kroah-Hartman <[email protected]>
Revert "KVM: e500: always restore irqs"
Samuel Holland <[email protected]>
riscv: Save/restore envcfg CSR during CPU suspend
Samuel Holland <[email protected]>
riscv: Fix enabling cbo.zero when running in M-mode
Arnd Bergmann <[email protected]>
ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
Arnd Bergmann <[email protected]>
kbuild: hdrcheck: fix cross build with clang
Ryan Roberts <[email protected]>
arm64: hugetlb: Fix huge_ptep_get_and_clear() for non-present ptes
Ryan Roberts <[email protected]>
mm: hugetlb: Add huge page size param to huge_ptep_get_and_clear()
Nayab Sayed <[email protected]>
iio: adc: at91-sama5d2_adc: fix sama7g5 realbits value
Angelo Dureghello <[email protected]>
iio: dac: ad3552r: clear reset status flag
Sam Winchenbach <[email protected]>
iio: filter: admv8818: Force initialization of SDO
Haoyu Li <[email protected]>
drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
Andy Shevchenko <[email protected]>
eeprom: digsy_mtc: Make GPIO lookup table match the device
Manivannan Sadhasivam <[email protected]>
bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock
Visweswara Tanuku <[email protected]>
slimbus: messaging: Free transaction ID in delayed interrupt scenario
Luca Ceresoli <[email protected]>
drivers: core: fix device leak in __fw_devlink_relax_cycles()
Thadeu Lima de Souza Cascardo <[email protected]>
char: misc: deallocate static minor in error path
Alexander Shishkin <[email protected]>
intel_th: pci: Add Panther Lake-P/U support
Alexander Shishkin <[email protected]>
intel_th: pci: Add Panther Lake-H support
Pawel Chmielewski <[email protected]>
intel_th: pci: Add Arrow Lake support
Alexander Usyskin <[email protected]>
mei: me: add panther lake P DID
Qiu-ji Chen <[email protected]>
cdx: Fix possible UAF error in driver_override_show()
Xiaoyao Li <[email protected]>
KVM: x86: Explicitly zero EAX and EBX when PERFMON_V2 isn't supported by KVM
Sean Christopherson <[email protected]>
KVM: SVM: Suppress DEBUGCTL.BTF on AMD
Sean Christopherson <[email protected]>
KVM: SVM: Drop DEBUGCTL[5:2] from guest's effective value
Michal Pecio <[email protected]>
usb: xhci: Enable the TRB overfetch quirk on VIA VL805
Andy Shevchenko <[email protected]>
xhci: pci: Fix indentation in the PCI device ID definitions
Prashanth K <[email protected]>
usb: gadget: Check bmAttributes only if configuration is valid
Marek Szyprowski <[email protected]>
usb: gadget: Fix setting self-powered state on suspend
Prashanth K <[email protected]>
usb: gadget: Set self-powered based on MaxPower and bmAttributes
AngeloGioacchino Del Regno <[email protected]>
usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
Fedor Pchelkin <[email protected]>
usb: typec: ucsi: increase timeout for PPM reset operations
Badhri Jagan Sridharan <[email protected]>
usb: dwc3: gadget: Prevent irq storm when TH re-executes
Thinh Nguyen <[email protected]>
usb: dwc3: Set SUSPENDENABLE soon after phy init
Nikita Zhandarovich <[email protected]>
usb: atm: cxacru: fix a flaw in existing endpoint checks
Prashanth K <[email protected]>
usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails
Claudiu Beznea <[email protected]>
usb: renesas_usbhs: Flush the notify_hotplug_work
Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Fix NULL pointer access
Miao Li <[email protected]>
usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
Pawel Laszczak <[email protected]>
usb: hub: lack of clearing xHC resources
Claudiu Beznea <[email protected]>
usb: renesas_usbhs: Use devm_usb_get_phy()
Claudiu Beznea <[email protected]>
usb: renesas_usbhs: Call clk_put()
Christian Heusel <[email protected]>
Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
Fabrizio Castro <[email protected]>
gpio: rcar: Fix missing of_node_put() call
Justin Iurman <[email protected]>
net: ipv6: fix missing dst ref drop in ila lwtunnel
Justin Iurman <[email protected]>
net: ipv6: fix dst ref loop in ila lwtunnel
Lorenzo Bianconi <[email protected]>
net: dsa: mt7530: Fix traffic flooding for MMIO devices
Zecheng Li <[email protected]>
sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
Uday Shankar <[email protected]>
ublk: set_params: properly check if parameters can be applied
Jason Xing <[email protected]>
net-timestamp: support TCP GSO case for a few missing flags
Namjae Jeon <[email protected]>
exfat: fix soft lockup in exfat_clear_bitmap
Jarkko Sakkinen <[email protected]>
x86/sgx: Fix size overflows in sgx_encl_create()
Oscar Maes <[email protected]>
vlan: enforce underlying device type
Jiayuan Chen <[email protected]>
ppp: Fix KMSAN uninit-value warning with bpf
Luca Weiss <[email protected]>
net: ipa: Enable checksum for IPA_ENDPOINT_AP_MODEM_{RX,TX} for v4.7
Luca Weiss <[email protected]>
net: ipa: Fix QSB data for v4.7
Luca Weiss <[email protected]>
net: ipa: Fix v4.7 resource group names
Vicki Pfau <[email protected]>
HID: hid-steam: Fix use-after-free when detaching device
Peiyang Wang <[email protected]>
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
Nikolay Aleksandrov <[email protected]>
be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
Philipp Stanner <[email protected]>
drm/sched: Fix preprocessor guard
Xinghuo Chen <[email protected]>
hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
Eric Dumazet <[email protected]>
llc: do not use skb_get() before dev_queue_xmit()
Murad Masimov <[email protected]>
ALSA: usx2y: validate nrpacks module parameter on probe
Masami Hiramatsu (Google) <[email protected]>
tracing: probe-events: Remove unused MAX_ARG_BUF_LEN macro
Erik Schumacher <[email protected]>
hwmon: (ad7314) Validate leading zero bits and return error
Maud Spierings <[email protected]>
hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
Titus Rwantare <[email protected]>
hwmon: (pmbus) Initialise page count in pmbus_identify()
Peter Zijlstra <[email protected]>
perf/core: Fix pmus_lock vs. pmus_srcu ordering
Vitaliy Shevtsov <[email protected]>
caif_virtio: fix wrong pointer check in cfv_probe()
Antoine Tenart <[email protected]>
net: gso: fix ownership in __udp_gso_segment
Meir Elisha <[email protected]>
nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
Salah Triki <[email protected]>
bluetooth: btusb: Initialize .owner field of force_poll_sync_fops
Zhang Lixu <[email protected]>
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
Yu-Chun Lin <[email protected]>
HID: google: fix unused variable warning under !CONFIG_ACPI
Johannes Berg <[email protected]>
wifi: iwlwifi: limit printed string from FW file
Ryan Roberts <[email protected]>
mm: don't skip arch_sync_kernel_mappings() in error paths
Hao Zhang <[email protected]>
mm/page_alloc: fix uninitialized variable
Olivier Gayot <[email protected]>
block: fix conversion of GPT partition name to 7-bit
Mike Snitzer <[email protected]>
NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
Heiko Carstens <[email protected]>
s390/traps: Fix test_monitor_call() inline assembly
Sebastian Andrzej Siewior <[email protected]>
dma: kmsan: export kmsan_handle_dma() for modules
Haoxiang Li <[email protected]>
rapidio: fix an API misues when rio_add_net() fails
Haoxiang Li <[email protected]>
rapidio: add check for rio_add_net() in rio_scan_alloc_net()
Vitaliy Shevtsov <[email protected]>
wifi: nl80211: reject cooked mode if it is set along with other flags
Nikita Zhandarovich <[email protected]>
wifi: cfg80211: regulatory: improve invalid hints checking
Haoxiang Li <[email protected]>
Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()
Haoxiang Li <[email protected]>
Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
Krister Johansen <[email protected]>
mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
Ahmed S. Darwish <[email protected]>
x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
Ahmed S. Darwish <[email protected]>
x86/cpu: Validate CPUID leaf 0x2 EDX output
Ahmed S. Darwish <[email protected]>
x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
Mingcong Bai <[email protected]>
platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
Richard Thier <[email protected]>
drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
Ma Ke <[email protected]>
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
Paul Fertser <[email protected]>
hwmon: (peci/dimmtemp) Do not provide fake thresholds data
Kailang Yang <[email protected]>
ALSA: hda/realtek: update ALC222 depop optimize
Kailang Yang <[email protected]>
ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
Hoku Ishibe <[email protected]>
ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
Takashi Iwai <[email protected]>
ALSA: seq: Avoid module auto-load handling at event delivery
Koichiro Den <[email protected]>
gpio: aggregator: protect driver attr handlers against module unload
Niklas Söderlund <[email protected]>
gpio: rcar: Use raw_spinlock to protect register access
Namjae Jeon <[email protected]>
ksmbd: fix bug on trap in smb2_lock
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in smb2_lock
Namjae Jeon <[email protected]>
ksmbd: fix out-of-bounds in parse_sec_desc()
Namjae Jeon <[email protected]>
ksmbd: fix type confusion via race condition when using ipc_msg_send_request
Daniil Dulov <[email protected]>
HID: appleir: Fix potential NULL dereference at raw event handle
Bibo Mao <[email protected]>
LoongArch: Set max_pfn with the PFN of the last page
Huacai Chen <[email protected]>
LoongArch: Use polling play_dead() when resuming from hibernation
Tiezhu Yang <[email protected]>
LoongArch: Convert unreachable() to BUG()
Masami Hiramatsu (Google) <[email protected]>
tracing: tprobe-events: Fix a memory leak when tprobe with $retval
Rob Herring (Arm) <[email protected]>
Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Add some forgotten models to the SHA check
Yong-Xuan Wang <[email protected]>
riscv: signal: fix signal_minsigstksz
Andrew Jones <[email protected]>
RISC-V: Enable cbo.zero in usermode
Rob Herring <[email protected]>
riscv: cacheinfo: Use of_property_present() for non-boolean properties
Miquel Sabaté Solà <[email protected]>
riscv: Prevent a bad reference count on CPU nodes
Yunhui Cui <[email protected]>
riscv: cacheinfo: initialize cacheinfo's level and type from ACPI PPTT
Yunhui Cui <[email protected]>
riscv: cacheinfo: remove the useless input parameter (node) of ci_leaf_init()
Trond Myklebust <[email protected]>
NFS: O_DIRECT writes must check and adjust the file length
Waiman Long <[email protected]>
x86/speculation: Add __update_spec_ctrl() helper
Wei Fang <[email protected]>
net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC
Martyn Welch <[email protected]>
net: enetc: Replace ifdef with IS_ENABLED
Gal Pressman <[email protected]>
net: enetc: Remove setting of RX software timestamp
Alex Deucher <[email protected]>
drm/amdgpu: disable BAR resize on Dell G5 SE
Ma Jun <[email protected]>
drm/amdgpu: Check extended configuration space register when system uses large bar
Nick Child <[email protected]>
ibmvnic: Inspect header requirements before using scrq direct
Nick Child <[email protected]>
ibmvnic: Perform tx CSO during send scrq direct
Paulo Alcantara <[email protected]>
smb: client: fix chmod(2) regression with ATTR_READONLY
Farouk Bouabid <[email protected]>
arm64: dts: rockchip: add rs485 support on uart5 of px30-ringneck-haikou
Imre Deak <[email protected]>
drm/i915/ddi: Fix HDMI port width programming in DDI_BUF_CTL
Lucas De Marchi <[email protected]>
drm/i915/xe2lpd: Move D2D enable/disable
Peter Jones <[email protected]>
efi: Don't map the entire mokvar table to determine its size
Andrew Cooper <[email protected]>
x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
-------------
Diffstat:
Makefile | 9 +- .../boot/dts/rockchip/px30-ringneck-haikou.dts | 1 + arch/arm64/include/asm/hugetlb.h | 4 +- arch/arm64/mm/hugetlbpage.c | 59 +++--- arch/loongarch/include/asm/hugetlb.h | 6 +- arch/loongarch/kernel/machine_kexec.c | 4 +- arch/loongarch/kernel/setup.c | 3 + arch/loongarch/kernel/smp.c | 47 ++++- arch/mips/include/asm/hugetlb.h | 6 +- arch/parisc/include/asm/hugetlb.h | 2 +- arch/parisc/mm/hugetlbpage.c | 2 +- arch/powerpc/include/asm/hugetlb.h | 6 +- arch/powerpc/kvm/e500_mmu_host.c | 21 ++- arch/riscv/include/asm/cpufeature.h | 1 + arch/riscv/include/asm/csr.h | 3 + arch/riscv/include/asm/hugetlb.h | 3 +- arch/riscv/include/asm/hwcap.h | 16 ++ arch/riscv/include/asm/suspend.h | 1 + arch/riscv/kernel/cacheinfo.c | 54 ++++-- arch/riscv/kernel/cpufeature.c | 6 + arch/riscv/kernel/setup.c | 6 +- arch/riscv/kernel/smpboot.c | 4 + arch/riscv/kernel/suspend.c | 4 + arch/riscv/mm/hugetlbpage.c | 2 +- arch/s390/include/asm/hugetlb.h | 17 +- arch/s390/kernel/traps.c | 6 +- arch/s390/mm/hugetlbpage.c | 4 +- arch/sparc/include/asm/hugetlb.h | 2 +- arch/sparc/mm/hugetlbpage.c | 2 +- arch/x86/boot/compressed/acpi.c | 14 +- arch/x86/boot/compressed/cmdline.c | 4 +- arch/x86/boot/compressed/ident_map_64.c | 7 +- arch/x86/boot/compressed/kaslr.c | 26 +-- arch/x86/boot/compressed/mem.c | 6 +- arch/x86/boot/compressed/misc.c | 26 +-- arch/x86/boot/compressed/misc.h | 1 - arch/x86/boot/compressed/pgtable_64.c | 11 +- arch/x86/boot/compressed/sev.c | 2 +- arch/x86/include/asm/boot.h | 2 + arch/x86/include/asm/spec-ctrl.h | 11 ++ arch/x86/kernel/amd_nb.c | 9 +- arch/x86/kernel/cpu/cacheinfo.c | 2 +- arch/x86/kernel/cpu/intel.c | 52 ++++-- arch/x86/kernel/cpu/microcode/amd.c | 6 + arch/x86/kernel/cpu/sgx/ioctl.c | 7 + arch/x86/kvm/cpuid.c | 2 +- arch/x86/kvm/svm/svm.c | 21 +++ arch/x86/kvm/svm/svm.h | 2 +- arch/x86/mm/init.c | 23 ++- block/partitions/efi.c | 2 +- drivers/base/core.c | 1 + drivers/block/ublk_drv.c | 7 +- drivers/bluetooth/btusb.c | 1 + drivers/bus/mhi/host/pci_generic.c | 5 +- drivers/cdx/cdx.c | 6 +- drivers/char/misc.c | 2 +- drivers/firmware/efi/libstub/x86-stub.c | 2 +- drivers/firmware/efi/libstub/x86-stub.h | 2 - drivers/firmware/efi/mokvar-table.c | 42 ++--- drivers/gpio/gpio-aggregator.c | 20 ++- drivers/gpio/gpio-rcar.c | 31 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 ++ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +- drivers/gpu/drm/i915/display/icl_dsi.c | 4 +- drivers/gpu/drm/i915/display/intel_ddi.c | 46 +++-- drivers/gpu/drm/i915/i915_reg.h | 4 +- drivers/gpu/drm/radeon/r300.c | 3 +- drivers/gpu/drm/radeon/radeon_asic.h | 1 + drivers/gpu/drm/radeon/rs400.c | 18 +- drivers/gpu/drm/scheduler/gpu_scheduler_trace.h | 4 +- drivers/hid/hid-appleir.c | 2 +- drivers/hid/hid-google-hammer.c | 2 + drivers/hid/hid-steam.c | 2 +- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +- drivers/hwmon/ad7314.c | 10 ++ drivers/hwmon/ntc_thermistor.c | 66 +++---- drivers/hwmon/peci/dimmtemp.c | 10 +- drivers/hwmon/pmbus/pmbus.c | 2 + drivers/hwmon/xgene-hwmon.c | 2 +- drivers/hwtracing/intel_th/pci.c | 15 ++ drivers/iio/adc/at91-sama5d2_adc.c | 68 ++++--- drivers/iio/dac/ad3552r.c | 6 + drivers/iio/filter/admv8818.c | 14 +- drivers/misc/cardreader/rtsx_usb.c | 15 -- drivers/misc/eeprom/digsy_mtc_eeprom.c | 2 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/net/caif/caif_virtio.c | 2 +- drivers/net/dsa/mt7530.c | 8 +- drivers/net/ethernet/emulex/benet/be.h | 2 +- drivers/net/ethernet/emulex/benet/be_cmds.c | 197 ++++++++++----------- drivers/net/ethernet/emulex/benet/be_main.c | 2 +- drivers/net/ethernet/freescale/enetc/enetc.c | 25 ++- drivers/net/ethernet/freescale/enetc/enetc.h | 9 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 27 +-- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +- drivers/net/ethernet/ibm/ibmvnic.c | 21 ++- drivers/net/ipa/data/ipa_data-v4.7.c | 18 +- drivers/net/ppp/ppp_generic.c | 28 ++- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 +- drivers/nvme/target/tcp.c | 15 +- drivers/of/of_reserved_mem.c | 4 +- drivers/platform/x86/thinkpad_acpi.c | 1 + drivers/rapidio/devices/rio_mport_cdev.c | 3 +- drivers/rapidio/rio-scan.c | 5 +- drivers/slimbus/messaging.c | 5 +- drivers/spi/spi-mxs.c | 3 +- drivers/usb/atm/cxacru.c | 13 +- drivers/usb/core/hub.c | 33 ++++ drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/core.c | 85 +++++---- drivers/usb/dwc3/core.h | 2 +- drivers/usb/dwc3/drd.c | 4 +- drivers/usb/dwc3/gadget.c | 10 +- drivers/usb/gadget/composite.c | 17 +- drivers/usb/gadget/function/u_ether.c | 4 +- drivers/usb/host/xhci-mem.c | 3 +- drivers/usb/host/xhci-pci.c | 18 +- drivers/usb/host/xhci.h | 2 +- drivers/usb/renesas_usbhs/common.c | 6 +- drivers/usb/renesas_usbhs/mod_gadget.c | 2 +- drivers/usb/typec/tcpm/tcpci_rt1711h.c | 11 ++ drivers/usb/typec/ucsi/ucsi.c | 15 +- drivers/virt/acrn/hsm.c | 6 +- fs/exfat/balloc.c | 10 +- fs/exfat/exfat_fs.h | 2 +- fs/exfat/fatent.c | 11 +- fs/nfs/direct.c | 19 ++ fs/nfs/file.c | 3 +- fs/smb/client/inode.c | 4 +- fs/smb/server/smb2pdu.c | 8 +- fs/smb/server/smbacl.c | 16 ++ fs/smb/server/transport_ipc.c | 1 + include/asm-generic/hugetlb.h | 2 +- include/linux/compaction.h | 5 + include/linux/hugetlb.h | 4 +- include/linux/sched.h | 2 +- kernel/events/core.c | 4 +- kernel/events/uprobes.c | 2 +- kernel/sched/fair.c | 6 +- kernel/trace/trace_fprobe.c | 2 + kernel/trace/trace_probe.h | 1 - mm/compaction.c | 3 + mm/hugetlb.c | 4 +- mm/kmsan/hooks.c | 1 + mm/memory.c | 6 +- mm/page_alloc.c | 1 + mm/vmalloc.c | 4 +- net/8021q/vlan.c | 3 +- net/bluetooth/mgmt.c | 5 + net/ipv4/tcp_offload.c | 11 +- net/ipv4/udp_offload.c | 8 +- net/ipv6/ila/ila_lwt.c | 4 +- net/llc/llc_s_ac.c | 49 ++--- net/mptcp/pm_netlink.c | 18 +- net/sched/sch_fifo.c | 3 + net/wireless/nl80211.c | 5 + net/wireless/reg.c | 3 +- security/integrity/ima/ima_main.c | 7 +- security/integrity/integrity.h | 3 + sound/core/seq/seq_clientmgr.c | 46 +++-- sound/pci/hda/Kconfig | 1 + sound/pci/hda/hda_intel.c | 2 + sound/pci/hda/patch_realtek.c | 99 ++++++++++- sound/usb/usx2y/usbusx2y.c | 11 ++ sound/usb/usx2y/usbusx2y.h | 26 +++ sound/usb/usx2y/usbusx2yaudio.c | 27 --- usr/include/Makefile | 2 +- 168 files changed, 1335 insertions(+), 707 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/145 x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Cooper <[email protected]>
commit 14cb5d83068ecf15d2da6f7d0e9ea9edbcbc0457 upstream.
Xen doesn't offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results in the following warning:
unchecked MSR access error: RDMSR from 0xc0010058 at rIP: 0xffffffff8101d19f (xen_do_read_msr+0x7f/0xa0)
Call Trace: xen_read_msr+0x1e/0x30 amd_get_mmconfig_range+0x2b/0x80 quirk_amd_mmconfig_area+0x28/0x100 pnp_fixup_device+0x39/0x50 __pnp_add_device+0xf/0x150 pnp_add_device+0x3d/0x100 pnpacpi_add_device_handler+0x1f9/0x280 acpi_ns_get_device_callback+0x104/0x1c0 acpi_ns_walk_namespace+0x1d0/0x260 acpi_get_devices+0x8a/0xb0 pnpacpi_init+0x50/0x80 do_one_initcall+0x46/0x2e0 kernel_init_freeable+0x1da/0x2f0 kernel_init+0x16/0x1b0 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1b/0x30
based on quirks for a "PNP0c01" device. Treating MMCFG as disabled is the right course of action, so no change is needed there.
This was most likely exposed by fixing the Xen MSR accessors to not be silently-safe.
--- arch/x86/kernel/amd_nb.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
arch/x86/kernel/amd_nb.c +3 -6
@@ -360,7 +360,6 @@ bool __init early_is_amd_nb(u32 device)struct resource *amd_get_mmconfig_range (struct resource *res) { -u32 address;u64 base, msr;unsigned int segn_busn_bits;
@@ -368,13 +367,11 @@ struct resource *amd_get_mmconfig_range( boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)return NULL ; -/* assume all cpus from fam10h have mmconfig */ -if (boot_cpu_data.x86 <0x10 ) +/* Assume CPUs from Fam10h have mmconfig, although not all VMs do */ +if (boot_cpu_data.x86 <0x10 || +rdmsrl_safe (MSR_FAM10H_MMIO_CONF_BASE , &msr))return NULL ; - address =MSR_FAM10H_MMIO_CONF_BASE ; -rdmsrl (address, msr); -/* mmconfig is not enabled */ if (!(msr &FAM10H_MMIO_CONF_ENABLE ))return NULL ;
Greg Kroah-Hartman
maintainerPATCH 2/145 efi: Dont map the entire mokvar table to determine its size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Jones <[email protected]>
commit 2b90e7ace79774a3540ce569e000388f8d22c9e0 upstream.
Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of early_memmap(), and we get a failure and traceback:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139 __early_ioremap+0xef/0x220 ... Call Trace: <TASK> ? __early_ioremap+0xef/0x220 ? __warn.cold+0x93/0xfa ? __early_ioremap+0xef/0x220 ? report_bug+0xff/0x140 ? early_fixup_exception+0x5d/0xb0 ? early_idt_handler_common+0x2f/0x3a ? __early_ioremap+0xef/0x220 ? efi_mokvar_table_init+0xce/0x1d0 ? setup_arch+0x864/0xc10 ? start_kernel+0x6b/0xa10 ? x86_64_start_reservations+0x24/0x30 ? x86_64_start_kernel+0xed/0xf0 ? common_startup_64+0x13e/0x141 </TASK> ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187.
Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once.
Changes efi_mokvar_table_init() to only map each entry header, not the entire table, when determining the table size. Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place.
--- drivers/firmware/efi/mokvar-table.c | 42 +++++++++++------------------------- 1 file changed, 13 insertions(+), 29 deletions(-)
drivers/firmware/efi/mokvar-table.c +13 -29
@@ -103,9 +103,7 @@ void __init efi_mokvar_table_init(void)void *va =NULL ;unsigned long cur_offset =0 ;unsigned long offset_limit; -unsigned long map_size =0 ;unsigned long map_size_needed =0 ; -unsigned long size;struct efi_mokvar_table_entry *mokvar_entry;int err;
@@ -134,48 +132,34 @@ void __init efi_mokvar_table_init(void)*/ err = -EINVAL ;while (cur_offset +sizeof (*mokvar_entry) <= offset_limit) { - mokvar_entry = va + cur_offset; - map_size_needed = cur_offset +sizeof (*mokvar_entry); -if (map_size_needed > map_size) { -if (va) -early_memunmap (va, map_size); -/* -* Map a little more than the fixed size entry -* header, anticipating some data. It's safe to -* do so as long as we stay within current memory -* descriptor. -*/ - map_size =min (map_size_needed +2 *EFI_PAGE_SIZE , - offset_limit); - va =early_memremap (efi.mokvar_table, map_size); -if (!va) { -pr_err ("Failed to map EFI MOKvar config table pa=0x%lx, size=%lu.\n" , - efi.mokvar_table, map_size); -return ; - } - mokvar_entry = va + cur_offset; +if (va) +early_memunmap (va,sizeof (*mokvar_entry)); + va =early_memremap (efi.mokvar_table + cur_offset,sizeof (*mokvar_entry)); +if (!va) { +pr_err ("Failed to map EFI MOKvar config table pa=0x%lx, size=%zu.\n" , + efi.mokvar_table + cur_offset,sizeof (*mokvar_entry)); +return ; } + mokvar_entry = va;/* Check for last sentinel entry */ if (mokvar_entry->name[0 ] =='\0' ) {if (mokvar_entry->data_size !=0 )break ; err =0 ; + map_size_needed = cur_offset +sizeof (*mokvar_entry);break ; } -/* Sanity check that the name is null terminated */ - size =strnlen (mokvar_entry->name, -sizeof (mokvar_entry->name)); -if (size >=sizeof (mokvar_entry->name)) -break ; +/* Enforce that the name is NUL terminated */ + mokvar_entry->name[sizeof (mokvar_entry->name) -1 ] ='\0' ;/* Advance to the next entry */ - cur_offset = map_size_needed + mokvar_entry->data_size; + cur_offset +=sizeof (*mokvar_entry) + mokvar_entry->data_size; }if (va) -early_memunmap (va, map_size); +early_memunmap (va,sizeof (*mokvar_entry));if (err) {pr_err ("EFI MOKvar config table is not valid\n" );return ;
Greg Kroah-Hartman
maintainerPATCH 3/145 drm/i915/xe2lpd: Move D2D enable/disable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <[email protected]>
[ Upstream commit d5c7854b50e634097da5dd6d221997ecf31ec8c1 ]
Bits to enable/disable and check state for D2D moved from XELPDP_PORT_BUF_CTL1 to DDI_BUF_CTL (now named DDI_CTL_DE in the spec). Make the functions mtl_ddi_disable_d2d() and mtl_ddi_enable_d2d generic to work with multiple reg location and bitfield layout.
v2: Set/Clear XE2LPD_DDI_BUF_D2D_LINK_ENABLE in saved_port_bits when
enabling/disabling D2D so DDI_BUF_CTL is correctly programmed in other places without overriding these bits (Clint)
v3: Leave saved_port_bits alone as those bits are not meant to be
modified outside of the port initialization. Rather propagate the additional bit in DDI_BUF_CTL to be set when that register is written again after D2D is enabled.
Stable-dep-of: 166ce267ae3f ("drm/i915/ddi: Fix HDMI port width programming in DDI_BUF_CTL")
--- drivers/gpu/drm/i915/display/intel_ddi.c | 44 ++++++++++++++++++------ drivers/gpu/drm/i915/i915_reg.h | 2 ++ 2 files changed, 36 insertions(+), 10 deletions(-)
drivers/gpu/drm/i915/display/intel_ddi.c +34 -10
@@ -2357,13 +2357,22 @@ mtl_ddi_enable_d2d(struct intel_encoder *encoder) {struct drm_i915_private *dev_priv =to_i915 (encoder->base.dev);enum port port = encoder->port; +i915_reg_t reg; +u32 set_bits, wait_bits; -intel_de_rmw (dev_priv,XELPDP_PORT_BUF_CTL1 (port),0 , -XELPDP_PORT_BUF_D2D_LINK_ENABLE ); +if (DISPLAY_VER (dev_priv) >=20 ) { + reg =DDI_BUF_CTL (port); + set_bits =XE2LPD_DDI_BUF_D2D_LINK_ENABLE ; + wait_bits =XE2LPD_DDI_BUF_D2D_LINK_STATE ; + }else { + reg =XELPDP_PORT_BUF_CTL1 (port); + set_bits =XELPDP_PORT_BUF_D2D_LINK_ENABLE ; + wait_bits =XELPDP_PORT_BUF_D2D_LINK_STATE ; + } -if (wait_for_us ((intel_de_read (dev_priv,XELPDP_PORT_BUF_CTL1 (port)) & -XELPDP_PORT_BUF_D2D_LINK_STATE ),100 )) { -drm_err (&dev_priv->drm,"Timeout waiting for D2D Link enable for PORT_BUF_CTL %c\n" , +intel_de_rmw (dev_priv, reg,0 , set_bits); +if (wait_for_us (intel_de_read (dev_priv, reg) & wait_bits,100 )) { +drm_err (&dev_priv->drm,"Timeout waiting for D2D Link enable for DDI/PORT_BUF_CTL %c\n" ,port_name (port)); } }
@@ -2810,13 +2819,22 @@ mtl_ddi_disable_d2d_link(struct intel_encoder *encoder) {struct drm_i915_private *dev_priv =to_i915 (encoder->base.dev);enum port port = encoder->port; +i915_reg_t reg; +u32 clr_bits, wait_bits; -intel_de_rmw (dev_priv,XELPDP_PORT_BUF_CTL1 (port), -XELPDP_PORT_BUF_D2D_LINK_ENABLE ,0 ); +if (DISPLAY_VER (dev_priv) >=20 ) { + reg =DDI_BUF_CTL (port); + clr_bits =XE2LPD_DDI_BUF_D2D_LINK_ENABLE ; + wait_bits =XE2LPD_DDI_BUF_D2D_LINK_STATE ; + }else { + reg =XELPDP_PORT_BUF_CTL1 (port); + clr_bits =XELPDP_PORT_BUF_D2D_LINK_ENABLE ; + wait_bits =XELPDP_PORT_BUF_D2D_LINK_STATE ; + } -if (wait_for_us (!(intel_de_read (dev_priv,XELPDP_PORT_BUF_CTL1 (port)) & -XELPDP_PORT_BUF_D2D_LINK_STATE ),100 )) -drm_err (&dev_priv->drm,"Timeout waiting for D2D Link disable for PORT_BUF_CTL %c\n" , +intel_de_rmw (dev_priv, reg, clr_bits,0 ); +if (wait_for_us (!(intel_de_read (dev_priv, reg) & wait_bits),100 )) +drm_err (&dev_priv->drm,"Timeout waiting for D2D Link disable for DDI/PORT_BUF_CTL %c\n" ,port_name (port)); }
@@ -3225,6 +3243,9 @@ static void intel_enable_ddi_hdmi(struct intel_atomic_state *state, XELPDP_PORT_WIDTH_MASK | XELPDP_PORT_REVERSAL, port_buf); buf_ctl |=DDI_PORT_WIDTH (lane_count); + +if (DISPLAY_VER (dev_priv) >=20 ) + buf_ctl |=XE2LPD_DDI_BUF_D2D_LINK_ENABLE ; }else if (IS_ALDERLAKE_P (dev_priv) &&intel_phy_is_tc (dev_priv, phy)) {drm_WARN_ON (&dev_priv->drm, !intel_tc_port_in_legacy_mode (dig_port)); buf_ctl |=DDI_BUF_CTL_TC_PHY_OWNERSHIP ;
@@ -3449,6 +3470,9 @@ static void mtl_ddi_prepare_link_retrain(struct intel_dp *intel_dp,/* 6.i Configure and enable DDI_CTL_DE to start sending valid data to port slice */ intel_dp->DP |=DDI_BUF_CTL_ENABLE ; +if (DISPLAY_VER (dev_priv) >=20 ) + intel_dp->DP |=XE2LPD_DDI_BUF_D2D_LINK_ENABLE ; +intel_de_write (dev_priv,DDI_BUF_CTL (port), intel_dp->DP);intel_de_posting_read (dev_priv,DDI_BUF_CTL (port));
drivers/gpu/drm/i915/i915_reg.h +2 -0
@@ -5724,6 +5724,8 @@ enum skl_power_gate {/* Known as DDI_CTL_DE in MTL+ */ #define DDI_BUF_CTL (port) _MMIO_PORT(port, _DDI_BUF_CTL_A, _DDI_BUF_CTL_B)#define DDI_BUF_CTL_ENABLE (1 << 31) +#define XE2LPD_DDI_BUF_D2D_LINK_ENABLE REG_BIT(29) +#define XE2LPD_DDI_BUF_D2D_LINK_STATE REG_BIT(28)#define DDI_BUF_TRANS_SELECT (n) ((n) << 24)#define DDI_BUF_EMP_MASK (0xf << 24)#define DDI_BUF_PHY_LINK_RATE (r) ((r) << 20)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/145 drm/i915/ddi: Fix HDMI port width programming in DDI_BUF_CTL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
[ Upstream commit 166ce267ae3f96e439d8ccc838e8ec4d8b4dab73 ]
Fix the port width programming in the DDI_BUF_CTL register on MTLP+, where this had an off-by-one error.
--- drivers/gpu/drm/i915/display/intel_ddi.c | 2 +- drivers/gpu/drm/i915/i915_reg.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/display/intel_ddi.c +1 -1
@@ -3242,7 +3242,7 @@ static void intel_enable_ddi_hdmi(struct intel_atomic_state *state,intel_de_rmw (dev_priv,XELPDP_PORT_BUF_CTL1 (port),XELPDP_PORT_WIDTH_MASK |XELPDP_PORT_REVERSAL , port_buf); - buf_ctl |=DDI_PORT_WIDTH (lane_count); + buf_ctl |=DDI_PORT_WIDTH (crtc_state->lane_count);if (DISPLAY_VER (dev_priv) >=20 ) buf_ctl |=XE2LPD_DDI_BUF_D2D_LINK_ENABLE ;
drivers/gpu/drm/i915/i915_reg.h +1 -1
@@ -5737,7 +5737,7 @@ enum skl_power_gate {#define DDI_BUF_IS_IDLE (1 << 7)#define DDI_BUF_CTL_TC_PHY_OWNERSHIP REG_BIT(6)#define DDI_A_4_LANES (1 << 4) -#define DDI_PORT_WIDTH (width) (((width) - 1) << 1) +#define DDI_PORT_WIDTH (width) (((width) == 3 ? 4 : ((width) - 1)) << 1)#define DDI_PORT_WIDTH_MASK (7 << 1)#define DDI_PORT_WIDTH_SHIFT 1#define DDI_INIT_DISPLAY_DETECTED (1 << 0)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/145 arm64: dts: rockchip: add rs485 support on uart5 of px30-ringneck-haikou
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farouk Bouabid <[email protected]>
[ Upstream commit 5963d97aa780619ffb66cf4886c0ca1175ccbd3e ]
A hardware switch can set the rs485 transceiver into half or full duplex mode.
Switching to the half-duplex mode requires the user to enable em485 on uart5 using ioctl, DE/RE are both connected to GPIO0_B5 which is the RTS signal for uart0. Implement GPIO0_B5 as rts-gpios with RTS_ON_SEND option enabled (default) so that driver mode gets enabled while sending (RTS high) and receiver mode gets enabled while not sending (RTS low).
In full-duplex mode (em485 is disabled), DE is connected to GPIO0_B5 and RE is grounded (enabled). Since GPIO0_B5 is implemented as rts-gpios, the driver mode gets enabled whenever we want to send something and RE is not affected (always enabled) in this case by the state of RTS.
Stable-dep-of: 5ae4dca718ea ("arm64: dts: rockchip: Disable DMA for uart5 on px30-ringneck")
--- arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts +1 -0
@@ -226,6 +226,7 @@ &uart0 { &uart5 { pinctrl-0 = <&uart5_xfer>; + rts-gpios = <&gpio0 RK_PB5 GPIO_ACTIVE_HIGH>; status = "okay"; };
Signature · 1 line
2.39.5
Re: [PATCH 6.6 005/145] arm64: dts: rockchip: add rs485 support on uart5 of px30-ringneck-haikou
Hi all,
Quoted 22 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farouk Bouabid <[email protected]>
[ Upstream commit
5963d97aa780619ffb66cf4886c0ca1175ccbd3e]A hardware switch can set the rs485 transceiver into half or full duplex mode.
Switching to the half-duplex mode requires the user to enable em485 on uart5 using ioctl, DE/RE are both connected to
GPIO0_B5which is the RTS signal for uart0. ImplementGPIO0_B5as rts-gpios withRTS_ON_SENDoption enabled (default) so that driver mode gets enabled while sending (RTS high) and receiver mode gets enabled while not sending (RTS low).In full-duplex mode (em485 is disabled), DE is connected to
GPIO0_B5and RE is grounded (enabled). SinceGPIO0_B5is implemented as rts-gpios, the driver mode gets enabled whenever we want to send something and RE is not affected (always enabled) in this case by the state of RTS.
Quoted 4 lines
Signed-off-by Farouk Bouabid <[email protected]>Signed-off-by Heiko Stuebner <[email protected]>Stable-dep-of:
5ae4dca718ea("arm64: dts: rockchip: Disable DMA for uart5 on px30-ringneck")
I don't mind the backport of this 005/145 patch, but this Stable-dep-of commit has already been merged in 6.6 with a conflict resolution, see bcc87e2e01637a90d67c66ce6c2eb28a78bf79f2.
Cheers,
Quentin
Greg Kroah-Hartman
maintainerRe: [PATCH 6.6 005/145] arm64: dts: rockchip: add rs485 support on uart5 of px30-ringneck-haikou
Quoted 25 lines · Quentin Schulz
Hi all,
Quoted 22 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farouk Bouabid <[email protected]>
[ Upstream commit
5963d97aa780619ffb66cf4886c0ca1175ccbd3e]A hardware switch can set the rs485 transceiver into half or full duplex mode.
Switching to the half-duplex mode requires the user to enable em485 on uart5 using ioctl, DE/RE are both connected to
GPIO0_B5which is the RTS signal for uart0. ImplementGPIO0_B5as rts-gpios withRTS_ON_SENDoption enabled (default) so that driver mode gets enabled while sending (RTS high) and receiver mode gets enabled while not sending (RTS low).In full-duplex mode (em485 is disabled), DE is connected to
GPIO0_B5and RE is grounded (enabled). SinceGPIO0_B5is implemented as rts-gpios, the driver mode gets enabled whenever we want to send something and RE is not affected (always enabled) in this case by the state of RTS.
Quoted 8 lines
Quoted 4 lines
Signed-off-by Farouk Bouabid <[email protected]>Signed-off-by Heiko Stuebner <[email protected]>Stable-dep-of:
5ae4dca718ea("arm64: dts: rockchip: Disable DMA for uart5 on px30-ringneck")I don't mind the backport of this 005/145 patch, but this Stable-dep-of commit has already been merged in 6.6 with a conflict resolution, see
bcc87e2e01637a90d67c66ce6c2eb28a78bf79f2.
Odd. Sasha, did something go off in your scripts?
Greg Kroah-Hartman
maintainerPATCH 6/145 smb: client: fix chmod(2) regression with ATTR_READONLY
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 654292a0b264e9b8c51b98394146218a21612aa1 ]
When the user sets a file or directory as read-only (e.g. ~S_IWUGO), the client will set the ATTR_READONLY attribute by sending an SMB2_SET_INFO request to the server in cifs_setattr_{,nounix}(), but cifsInodeInfo::cifsAttrs will be left unchanged as the client will only update the new file attributes in the next call to {smb311_posix,cifs}_get_inode_info() with the new metadata filled in @data parameter.
Commit a18280e7fdea ("smb: cilent: set reparse mount points as automounts") mistakenly removed the @data NULL check when calling is_inode_cache_good(), which broke the above case as the new ATTR_READONLY attribute would end up not being updated on files with a read lease.
Fix this by updating the inode whenever we have cached metadata in @data parameter.
--- fs/smb/client/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/smb/client/inode.c +2 -2
@@ -1320,7 +1320,7 @@ int cifs_get_inode_info(struct inode **inode,struct cifs_fattr fattr = {};int rc; -if (is_inode_cache_good (*inode)) { +if (!data &&is_inode_cache_good (*inode)) {cifs_dbg (FYI ,"No need to revalidate cached inode sizes\n" );return 0 ; }
@@ -1419,7 +1419,7 @@ int smb311_posix_get_inode_info(struct inode **inode,struct cifs_fattr fattr = {};int rc; -if (is_inode_cache_good (*inode)) { +if (!data &&is_inode_cache_good (*inode)) {cifs_dbg (FYI ,"No need to revalidate cached inode sizes\n" );return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/145 ibmvnic: Perform tx CSO during send scrq direct
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Child <[email protected]>
[ Upstream commit e633e32b60fd6701bed73599b273a2a03621ea54 ]
During initialization with the vnic server, a bitstring is communicated to the client regarding header info needed during CSO (See "VNIC Capabilities" in PAPR). Most of the time, to be safe, vnic server requests header info for CSO. When header info is needed, multiple TX descriptors are required per skb; This limits the driver to use send_subcrq_indirect instead of send_subcrq_direct.
Previously, the vnic server request for header info was ignored. This allowed the use of send_sub_crq_direct. Transmissions were successful because the bitstring returned by vnic server is broad and over cautionary. It was observed that mlx backing devices could actually transmit and handle CSO packets without the vnic server receiving header info (despite the fact that the bitstring requested it).
There was a trust issue: The bitstring was overcautionary. This extra precaution (requesting header info when the backing device may not use it) comes at the cost of performance (using direct vs indirect hcalls has a 30% delta in small packet RR transaction rate). So it has been requested that the vnic server team tries to ensure that the bitstring is more exact. In the meantime, disable CSO when it is possible to use the skb in the send_subcrq_direct path. In other words, calculate the checksum before handing the packet to FW when the packet is not segmented and xmit_more is false.
Since the code path is only possible if the skb is non GSO and xmit_more is false, the cost of doing checksum in the send_subcrq_direct path is minimal. Any large segmented skb will have xmit_more set to true more frequently and it is inexpensive to do checksumming on a small skb. The worst-case workload would be a 9000 MTU TCP_RR test with close to MTU sized packets (and TSO off). This allows xmit_more to be false more frequently and open the code path up to use send_subcrq_direct. Observing trace data (graph-time = 1) and packet rate with this workload shows minimal performance degradation:
1. NIC does checksum w headers, safely use send_subcrq_indirect:
- Packet rate: 631k txs
- Trace data:
ibmvnic_xmit = 44344685.87 us / 6234576 hits = AVG 7.11 us
skb_checksum_help = 4.07 us / 2 hits = AVG 2.04 us
^ Notice hits, tracing this just for reassurance
ibmvnic_tx_scrq_flush = 33040649.69 us / 5638441 hits = AVG 5.86 us
send_subcrq_indirect = 37438922.24 us / 6030859 hits = AVG 6.21 us2. NIC does checksum w/o headers, dangerously use send_subcrq_direct:
- Packet rate: 831k txs
- Trace data:
ibmvnic_xmit = 48940092.29 us / 8187630 hits = AVG 5.98 us
skb_checksum_help = 2.03 us / 1 hits = AVG 2.03
ibmvnic_tx_scrq_flush = 31141879.57 us / 7948960 hits = AVG 3.92 us
send_subcrq_indirect = 8412506.03 us / 728781 hits = AVG 11.54
^ notice hits is much lower b/c send_subcrq_direct was called
^ wasn't traceable3. driver does checksum, safely use send_subcrq_direct (THIS PATCH):
- Packet rate: 829k txs
- Trace data:
ibmvnic_xmit = 56696077.63 us / 8066168 hits = AVG 7.03 us
skb_checksum_help = 8587456.16 us / 7526072 hits = AVG 1.14 us
ibmvnic_tx_scrq_flush = 30219545.55 us / 7782409 hits = AVG 3.88 us
send_subcrq_indirect = 8638326.44 us / 763693 hits = AVG 11.31 usWhen the bitstring ever specifies that CSO does not require headers (dependent on VIOS vnic server changes), then this patch should be removed and replaced with one that investigates the bitstring before using send_subcrq_direct.
Stable-dep-of: de390657b5d6 ("ibmvnic: Inspect header requirements before using scrq direct")
--- drivers/net/ethernet/ibm/ibmvnic.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/net/ethernet/ibm/ibmvnic.c +17 -2
@@ -2427,6 +2427,7 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)unsigned int skblen;union sub_crq tx_crq;unsigned int offset; +bool use_scrq_send_direct = false;int num_entries =1 ;unsigned char *dst;int bufidx =0 ;
@@ -2486,6 +2487,18 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)memset (dst,0 , tx_pool->buf_size); data_dma_addr = ltb->addr + offset; +/* if we are going to send_subcrq_direct this then we need to +* update the checksum before copying the data into ltb. Essentially +* these packets force disable CSO so that we can guarantee that +* FW does not need header info and we can send direct. +*/ +if (!skb_is_gso (skb) && !ind_bufp->index && !netdev_xmit_more ()) { + use_scrq_send_direct = true; +if (skb->ip_summed ==CHECKSUM_PARTIAL && +skb_checksum_help (skb)) + use_scrq_send_direct = false; + } +if (skb_shinfo (skb)->nr_frags) {int cur, i;
@@ -2571,11 +2584,13 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) tx_crq.v1.flags1 |=IBMVNIC_TX_LSO ; tx_crq.v1.mss =cpu_to_be16 (skb_shinfo (skb)->gso_size); hdrs +=2 ; - }else if (!ind_bufp->index && !netdev_xmit_more ()) { - ind_bufp->indir_arr[0 ] = tx_crq; + }else if (use_scrq_send_direct) { +/* See above comment, CSO disabled with direct xmit */ + tx_crq.v1.flags1 &= ~(IBMVNIC_TX_CHKSUM_OFFLOAD ); ind_bufp->index =1 ; tx_buff->num_entries =1 ;netdev_tx_sent_queue (txq, skb->len); + ind_bufp->indir_arr[0 ] = tx_crq; lpar_rc =ibmvnic_tx_scrq_flush (adapter, tx_scrq, false);if (lpar_rc !=H_SUCCESS ) goto tx_err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/145 ibmvnic: Inspect header requirements before using scrq direct
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Child <[email protected]>
[ Upstream commit de390657b5d6f7deb9d1d36aaf45f02ba51ec9dc ]
Previously, the TX header requirement for standard frames was ignored. This requirement is a bitstring sent from the VIOS which maps to the type of header information needed during TX. If no header information, is needed then send subcrq direct can be used (which can be more performant).
This bitstring was previously ignored for standard packets (AKA non LSO, non CSO) due to the belief that the bitstring was over-cautionary. It turns out that there are some configurations where the backing device does need header information for transmission of standard packets. If the information is not supplied then this causes continuous "Adapter error" transport events. Therefore, this bitstring should be respected and observed before considering the use of send subcrq direct.
--- drivers/net/ethernet/ibm/ibmvnic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/ibm/ibmvnic.c +4 -2
@@ -2490,9 +2490,11 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)/* if we are going to send_subcrq_direct this then we need to * update the checksum before copying the data into ltb. Essentially * these packets force disable CSO so that we can guarantee that -* FW does not need header info and we can send direct. +* FW does not need header info and we can send direct. Also, vnic +* server must be able to xmit standard packets without header data */ -if (!skb_is_gso (skb) && !ind_bufp->index && !netdev_xmit_more ()) { +if (*hdrs ==0 && !skb_is_gso (skb) && + !ind_bufp->index && !netdev_xmit_more ()) { use_scrq_send_direct = true;if (skb->ip_summed ==CHECKSUM_PARTIAL &&skb_checksum_help (skb))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/145 drm/amdgpu: Check extended configuration space register when system uses large bar
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit e372baeb3d336b20fd9463784c577fd8824497cd ]
Some customer platforms do not enable mmconfig for various reasons, such as bios bug, and therefore cannot access the GPU extend configuration space through mmio.
When the system enters the d3cold state and resumes, the amdgpu driver fails to resume because the extend configuration space registers of GPU can't be restored. At this point, Usually we only see some failure dmesg log printed by amdgpu driver, it is difficult to find the root cause.
Therefor print a warnning message if the system can't access the extended configuration space register when using large bar.
Stable-dep-of: 099bffc7cadf ("drm/amdgpu: disable BAR resize on Dell G5 SE")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +4 -0
@@ -1116,6 +1116,10 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev)if (amdgpu_sriov_vf (adev))return 0 ; +/* PCI_EXT_CAP_ID_VNDR extended capability is located at 0x100 */ +if (!pci_find_ext_capability (adev->pdev,PCI_EXT_CAP_ID_VNDR )) +DRM_WARN ("System can't access extended configuration space,please check!!\n" ); +/* skip if the bios has already enabled large BAR */ if (adev->gmc.real_vram_size && (pci_resource_len (adev->pdev,0 ) >= adev->gmc.real_vram_size))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/145 drm/amdgpu: disable BAR resize on Dell G5 SE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 099bffc7cadff40bfab1517c3461c53a7a38a0d7 ]
There was a quirk added to add a workaround for a Sapphire RX 5600 XT Pulse that didn't allow BAR resizing. However, the quirk caused a regression with runtime pm on Dell laptops using those chips, rather than narrowing the scope of the resizing quirk, add a quirk to prevent amdgpu from resizing the BAR on those Dell platforms unless runtime pm is disabled.
v2: update commit message, add runpm check
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +7 -0
@@ -1116,6 +1116,13 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev)if (amdgpu_sriov_vf (adev))return 0 ; +/* resizing on Dell G5 SE platforms causes problems with runtime pm */ +if ((amdgpu_runtime_pm !=0 ) && + adev->pdev->vendor ==PCI_VENDOR_ID_ATI && + adev->pdev->device ==0x731f && + adev->pdev->subsystem_vendor ==PCI_VENDOR_ID_DELL ) +return 0 ; +/* PCI_EXT_CAP_ID_VNDR extended capability is located at 0x100 */ if (!pci_find_ext_capability (adev->pdev,PCI_EXT_CAP_ID_VNDR ))DRM_WARN ("System can't access extended configuration space,please check!!\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/145 net: enetc: Remove setting of RX software timestamp
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 3dd261ca7f84c65af40f37825bf1cbb0cf3d5583 ]
The responsibility for reporting of RX software timestamp has moved to the core layer (see __ethtool_get_ts_info()), remove usage from the device drivers.
Stable-dep-of: a562d0c4a893 ("net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC")
--- drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +2 -8
@@ -846,17 +846,13 @@ static int enetc_get_ts_info(struct net_device *ndev,if (phc_idx) { info->phc_index = *phc_idx;symbol_put (enetc_phc_index); - }else { - info->phc_index =-1 ; }#ifdef CONFIG_FSL_ENETC_PTP_CLOCK info->so_timestamping =SOF_TIMESTAMPING_TX_HARDWARE |SOF_TIMESTAMPING_RX_HARDWARE |SOF_TIMESTAMPING_RAW_HARDWARE | -SOF_TIMESTAMPING_TX_SOFTWARE | -SOF_TIMESTAMPING_RX_SOFTWARE | -SOF_TIMESTAMPING_SOFTWARE ; +SOF_TIMESTAMPING_TX_SOFTWARE ; info->tx_types = (1 <<HWTSTAMP_TX_OFF ) | (1 << HWTSTAMP_TX_ON) |
@@ -864,9 +860,7 @@ static int enetc_get_ts_info(struct net_device *ndev, info->rx_filters = (1 <<HWTSTAMP_FILTER_NONE ) | (1 <<HWTSTAMP_FILTER_ALL );#else - info->so_timestamping =SOF_TIMESTAMPING_RX_SOFTWARE | -SOF_TIMESTAMPING_TX_SOFTWARE | -SOF_TIMESTAMPING_SOFTWARE ; + info->so_timestamping =SOF_TIMESTAMPING_TX_SOFTWARE ;#endif return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/145 net: enetc: Replace ifdef with IS_ENABLED
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martyn Welch <[email protected]>
[ Upstream commit 9c699a8f3b273c62f7b364ff999e873501a1e834 ]
The enetc driver uses ifdefs when checking whether CONFIG_FSL_ENETC_PTP_CLOCK is enabled in a number of places. This works if the driver is built-in but fails if the driver is available as a kernel module. Replace the instances of ifdef with use of the IS_ENABLED macro, that will evaluate as true when this feature is built as a kernel module and follows the kernel's coding style.
Stable-dep-of: a562d0c4a893 ("net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC")
--- drivers/net/ethernet/freescale/enetc/enetc.c | 22 ++++++++----------- drivers/net/ethernet/freescale/enetc/enetc.h | 9 +++----- .../ethernet/freescale/enetc/enetc_ethtool.c | 12 ++++++---- 3 files changed, 20 insertions(+), 23 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +9 -13
@@ -1023,7 +1023,6 @@ static int enetc_refill_rx_ring(struct enetc_bdr *rx_ring, const int buff_cnt)return j; } -#ifdef CONFIG_FSL_ENETC_PTP_CLOCK static void enetc_get_rx_tstamp (struct net_device *ndev,union enetc_rx_bd *rxbd,struct sk_buff *skb)
@@ -1047,7 +1046,6 @@ static void enetc_get_rx_tstamp(struct net_device *ndev, shhwtstamps->hwtstamp =ns_to_ktime (tstamp); } } -#endif static void enetc_get_offloads (struct enetc_bdr *rx_ring,union enetc_rx_bd *rxbd,struct sk_buff *skb)
@@ -1087,10 +1085,9 @@ static void enetc_get_offloads(struct enetc_bdr *rx_ring,__vlan_hwaccel_put_tag (skb, tpid,le16_to_cpu (rxbd->r.vlan_opt)); } -#ifdef CONFIG_FSL_ENETC_PTP_CLOCK -if (priv->active_offloads &ENETC_F_RX_TSTAMP ) +if (IS_ENABLED (CONFIG_FSL_ENETC_PTP_CLOCK ) && + (priv->active_offloads &ENETC_F_RX_TSTAMP ))enetc_get_rx_tstamp (rx_ring->ndev, rxbd, skb); -#endif }/* This gets called during the non-XDP NAPI poll cycle as well as on XDP_PASS,
@@ -2956,7 +2953,6 @@ void enetc_set_features(struct net_device *ndev, netdev_features_t features) }EXPORT_SYMBOL_GPL (enetc_set_features); -#ifdef CONFIG_FSL_ENETC_PTP_CLOCK static int enetc_hwtstamp_set (struct net_device *ndev,struct ifreq *ifr) {struct enetc_ndev_priv *priv =netdev_priv (ndev);
@@ -3025,17 +3021,17 @@ static int enetc_hwtstamp_get(struct net_device *ndev, struct ifreq *ifr)return copy_to_user (ifr->ifr_data, &config,sizeof (config)) ? -EFAULT :0 ; } -#endif int enetc_ioctl (struct net_device *ndev,struct ifreq *rq,int cmd) {struct enetc_ndev_priv *priv =netdev_priv (ndev); -#ifdef CONFIG_FSL_ENETC_PTP_CLOCK -if (cmd ==SIOCSHWTSTAMP ) -return enetc_hwtstamp_set (ndev, rq); -if (cmd ==SIOCGHWTSTAMP ) -return enetc_hwtstamp_get (ndev, rq); -#endif + +if (IS_ENABLED (CONFIG_FSL_ENETC_PTP_CLOCK )) { +if (cmd ==SIOCSHWTSTAMP ) +return enetc_hwtstamp_set (ndev, rq); +if (cmd ==SIOCGHWTSTAMP ) +return enetc_hwtstamp_get (ndev, rq); + }if (!priv->phylink)return -EOPNOTSUPP ;
drivers/net/ethernet/freescale/enetc/enetc.h +3 -6
@@ -184,10 +184,9 @@ static inline union enetc_rx_bd *enetc_rxbd(struct enetc_bdr *rx_ring, int i) {int hw_idx = i; -#ifdef CONFIG_FSL_ENETC_PTP_CLOCK -if (rx_ring->ext_en) +if (IS_ENABLED (CONFIG_FSL_ENETC_PTP_CLOCK ) && rx_ring->ext_en) hw_idx =2 * i; -#endif +return &(((union enetc_rx_bd *)rx_ring->bd_base)[hw_idx]); }
@@ -199,10 +198,8 @@ static inline void enetc_rxbd_next(struct enetc_bdr *rx_ring, new_rxbd++; -#ifdef CONFIG_FSL_ENETC_PTP_CLOCK -if (rx_ring->ext_en) +if (IS_ENABLED (CONFIG_FSL_ENETC_PTP_CLOCK ) && rx_ring->ext_en) new_rxbd++; -#endif if (unlikely (++new_index == rx_ring->bd_count)) { new_rxbd = rx_ring->bd_base;
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +8 -4
@@ -848,7 +848,12 @@ static int enetc_get_ts_info(struct net_device *ndev,symbol_put (enetc_phc_index); } -#ifdef CONFIG_FSL_ENETC_PTP_CLOCK +if (!IS_ENABLED (CONFIG_FSL_ENETC_PTP_CLOCK )) { + info->so_timestamping =SOF_TIMESTAMPING_TX_SOFTWARE ; + +return 0 ; + } + info->so_timestamping =SOF_TIMESTAMPING_TX_HARDWARE |SOF_TIMESTAMPING_RX_HARDWARE | SOF_TIMESTAMPING_RAW_HARDWARE |
@@ -857,11 +862,10 @@ static int enetc_get_ts_info(struct net_device *ndev, info->tx_types = (1 <<HWTSTAMP_TX_OFF ) | (1 <<HWTSTAMP_TX_ON ) | (1 <<HWTSTAMP_TX_ONESTEP_SYNC ); + info->rx_filters = (1 <<HWTSTAMP_FILTER_NONE ) | (1 <<HWTSTAMP_FILTER_ALL ); -#else - info->so_timestamping =SOF_TIMESTAMPING_TX_SOFTWARE ; -#endif +return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/145 net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit a562d0c4a893eae3ea51d512c4d90ab858a6b7ec ]
Actually ENETC VFs do not support HWTSTAMP_TX_ONESTEP_SYNC because only ENETC PF can access PMa_SINGLE_STEP registers. And there will be a crash if VFs are used to test one-step timestamp, the crash log as follows.
[ 129.110909] Unable to handle kernel paging request at virtual address 00000000000080c0 [ 129.287769] Call trace: [ 129.290219] enetc_port_mac_wr+0x30/0xec (P) [ 129.294504] enetc_start_xmit+0xda4/0xe74 [ 129.298525] enetc_xmit+0x70/0xec [ 129.301848] dev_hard_start_xmit+0x98/0x118
--- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +++ drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 7 +++++-- 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +3 -0
@@ -2971,6 +2971,9 @@ static int enetc_hwtstamp_set(struct net_device *ndev, struct ifreq *ifr) new_offloads |=ENETC_F_TX_TSTAMP ;break ;case HWTSTAMP_TX_ONESTEP_SYNC : +if (!enetc_si_is_pf (priv->si)) +return -EOPNOTSUPP ; + new_offloads &= ~ENETC_F_TX_TSTAMP_MASK ; new_offloads |=ENETC_F_TX_ONESTEP_SYNC_TSTAMP ;break ;
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +5 -2
@@ -840,6 +840,7 @@ static int enetc_set_coalesce(struct net_device *ndev,static int enetc_get_ts_info (struct net_device *ndev,struct ethtool_ts_info *info) { +struct enetc_ndev_priv *priv =netdev_priv (ndev);int *phc_idx; phc_idx =symbol_get (enetc_phc_index);
@@ -860,8 +861,10 @@ static int enetc_get_ts_info(struct net_device *ndev,SOF_TIMESTAMPING_TX_SOFTWARE ; info->tx_types = (1 <<HWTSTAMP_TX_OFF ) | - (1 <<HWTSTAMP_TX_ON ) | - (1 <<HWTSTAMP_TX_ONESTEP_SYNC ); + (1 <<HWTSTAMP_TX_ON ); + +if (enetc_si_is_pf (priv->si)) + info->tx_types |= (1 <<HWTSTAMP_TX_ONESTEP_SYNC ); info->rx_filters = (1 <<HWTSTAMP_FILTER_NONE ) | (1 <<HWTSTAMP_FILTER_ALL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/145 x86/speculation: Add __update_spec_ctrl() helper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
[ Upstream commit e3e3bab1844d448a239cd57ebf618839e26b4157 ]
Add a new __update_spec_ctrl() helper which is a variant of update_spec_ctrl() that can be used in a noinstr function.
Stable-dep-of: c157d351460b ("intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly")
--- arch/x86/include/asm/spec-ctrl.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
arch/x86/include/asm/spec-ctrl.h +11 -0
@@ -4,6 +4,7 @@#include <linux/thread_info.h> #include <asm/nospec-branch.h> +#include <asm/msr.h> /* * On VMENTER we must preserve whatever view of the SPEC_CTRL MSR
@@ -76,6 +77,16 @@ static inline u64 ssbd_tif_to_amd_ls_cfg(u64 tifn)return (tifn & _TIF_SSBD) ? x86_amd_ls_cfg_ssbd_mask :0ULL ; } +/* +* This can be used in noinstr functions & should only be called in bare +* metal context. +*/ +static __always_inline void __update_spec_ctrl(u64 val) +{ +__this_cpu_write (x86_spec_ctrl_current, val); +native_wrmsrl (MSR_IA32_SPEC_CTRL , val); +} +#ifdef CONFIG_SMP extern void speculative_store_bypass_ht_init (void );#else
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/145 NFS: O_DIRECT writes must check and adjust the file length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit fcf857ee1958e9247298251f7615d0c76f1e9b38 ]
While it is uncommon for delegations to be held while O_DIRECT writes are in progress, it is possible. The xfstests generic/647 and generic/729 both end up triggering that state, and end up failing due to the fact that the file size is not adjusted.
--- fs/nfs/direct.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
fs/nfs/direct.c +19 -0
@@ -130,6 +130,20 @@ static void nfs_direct_truncate_request(struct nfs_direct_req *dreq, dreq->count = req_start; } +static void nfs_direct_file_adjust_size_locked (struct inode *inode, +loff_t offset,size_t count) +{ +loff_t newsize = offset + (loff_t )count; +loff_t oldsize =i_size_read (inode); + +if (newsize > oldsize) { +i_size_write (inode, newsize); +NFS_I (inode)->cache_validity &= ~NFS_INO_INVALID_SIZE ; +trace_nfs_size_grow (inode, newsize); +nfs_inc_stats (inode,NFSIOS_EXTENDWRITE ); + } +} +/** * nfs_swap_rw - NFS address space operation for swap I/O * @iocb: target I/O control block
@@ -728,6 +742,7 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)struct nfs_direct_req *dreq = hdr->dreq;struct nfs_commit_info cinfo;struct nfs_page *req =nfs_list_entry (hdr->pages.next); +struct inode *inode = dreq->inode;int flags =NFS_ODIRECT_DONE ;trace_nfs_direct_write_completion (dreq);
@@ -749,6 +764,10 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr) }spin_unlock (&dreq->lock); +spin_lock (&inode->i_lock); +nfs_direct_file_adjust_size_locked (inode, dreq->io_start, dreq->count); +spin_unlock (&inode->i_lock); +while (!list_empty (&hdr->pages)) { req =nfs_list_entry (hdr->pages.next);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/145 riscv: cacheinfo: remove the useless input parameter (node) of ci_leaf_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunhui Cui <[email protected]>
[ Upstream commit ee3fab10cb1566562aa683f319066eaeecccf918 ]
ci_leaf_init() is a declared static function. The implementation of the function body and the caller do not use the parameter (struct device_node *node) input parameter, so remove it.
Stable-dep-of: fb8179ce2996 ("riscv: cacheinfo: Use of_property_present() for non-boolean properties")
--- arch/riscv/kernel/cacheinfo.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
arch/riscv/kernel/cacheinfo.c +6 -7
@@ -64,7 +64,6 @@ uintptr_t get_cache_geometry(u32 level, enum cache_type type) }static void ci_leaf_init (struct cacheinfo *this_leaf, -struct device_node *node,enum cache_type type,unsigned int level) { this_leaf->level = level;
@@ -80,11 +79,11 @@ int populate_cache_leaves(unsigned int cpu)int levels =1 , level =1 ;if (of_property_read_bool (np,"cache-size" )) -ci_leaf_init (this_leaf++, np,CACHE_TYPE_UNIFIED , level); +ci_leaf_init (this_leaf++,CACHE_TYPE_UNIFIED , level);if (of_property_read_bool (np,"i-cache-size" )) -ci_leaf_init (this_leaf++, np,CACHE_TYPE_INST , level); +ci_leaf_init (this_leaf++,CACHE_TYPE_INST , level);if (of_property_read_bool (np,"d-cache-size" )) -ci_leaf_init (this_leaf++, np,CACHE_TYPE_DATA , level); +ci_leaf_init (this_leaf++,CACHE_TYPE_DATA , level); prev = np;while ((np =of_find_next_cache_node (np))) {
@@ -97,11 +96,11 @@ int populate_cache_leaves(unsigned int cpu)if (level <= levels)break ;if (of_property_read_bool (np,"cache-size" )) -ci_leaf_init (this_leaf++, np,CACHE_TYPE_UNIFIED , level); +ci_leaf_init (this_leaf++,CACHE_TYPE_UNIFIED , level);if (of_property_read_bool (np,"i-cache-size" )) -ci_leaf_init (this_leaf++, np,CACHE_TYPE_INST , level); +ci_leaf_init (this_leaf++,CACHE_TYPE_INST , level);if (of_property_read_bool (np,"d-cache-size" )) -ci_leaf_init (this_leaf++, np,CACHE_TYPE_DATA , level); +ci_leaf_init (this_leaf++,CACHE_TYPE_DATA , level); levels = level; }of_node_put (np);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/145 riscv: cacheinfo: initialize cacheinfos level and type from ACPI PPTT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunhui Cui <[email protected]>
[ Upstream commit 604f32ea6909b0ebb8ab0bf1ab7dc66ee3dc8955 ]
Before cacheinfo can be built correctly, we need to initialize level and type. Since RISC-V currently does not have a register group that describes cache-related attributes like ARM64, we cannot obtain them directly, so now we obtain cache leaves from the ACPI PPTT table (acpi_get_cache_info()) and set the cache type through split_levels.
Stable-dep-of: fb8179ce2996 ("riscv: cacheinfo: Use of_property_present() for non-boolean properties")
--- arch/riscv/kernel/cacheinfo.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
arch/riscv/kernel/cacheinfo.c +22 -0
@@ -3,6 +3,7 @@* Copyright (C) 2017 SiFive */ +#include <linux/acpi.h> #include <linux/cpu.h> #include <linux/of.h> #include <asm/cacheinfo.h>
@@ -78,6 +79,27 @@ int populate_cache_leaves(unsigned int cpu)struct device_node *prev =NULL ;int levels =1 , level =1 ; +if (!acpi_disabled) { +int ret, fw_levels, split_levels; + + ret =acpi_get_cache_info (cpu, &fw_levels, &split_levels); +if (ret) +return ret; + +BUG_ON ((split_levels > fw_levels) || + (split_levels + fw_levels > this_cpu_ci->num_leaves)); + +for (; level <= this_cpu_ci->num_levels; level++) { +if (level <= split_levels) { +ci_leaf_init (this_leaf++,CACHE_TYPE_DATA , level); +ci_leaf_init (this_leaf++,CACHE_TYPE_INST , level); + }else { +ci_leaf_init (this_leaf++,CACHE_TYPE_UNIFIED , level); + } + } +return 0 ; + } +if (of_property_read_bool (np,"cache-size" ))ci_leaf_init (this_leaf++,CACHE_TYPE_UNIFIED , level);if (of_property_read_bool (np,"i-cache-size" ))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/145 riscv: Prevent a bad reference count on CPU nodes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Sabaté Solà <[email protected]>
[ Upstream commit 37233169a6ea912020c572f870075a63293b786a ]
When populating cache leaves we previously fetched the CPU device node at the very beginning. But when ACPI is enabled we go through a specific branch which returns early and does not call 'of_node_put' for the node that was acquired.
Since we are not using a CPU device node for the ACPI code anyways, we can simply move the initialization of it just passed the ACPI block, and we are guaranteed to have an 'of_node_put' call for the acquired node. This prevents a bad reference count of the CPU device node.
Moreover, the previous function did not check for errors when acquiring the device node, so a return -ENOENT has been added for that case.
Stable-dep-of: fb8179ce2996 ("riscv: cacheinfo: Use of_property_present() for non-boolean properties")
--- arch/riscv/kernel/cacheinfo.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/riscv/kernel/cacheinfo.c +5 -2
@@ -75,8 +75,7 @@ int populate_cache_leaves(unsigned int cpu) {struct cpu_cacheinfo *this_cpu_ci =get_cpu_cacheinfo (cpu);struct cacheinfo *this_leaf = this_cpu_ci->info_list; -struct device_node *np =of_cpu_device_node_get (cpu); -struct device_node *prev =NULL ; +struct device_node *np, *prev;int levels =1 , level =1 ;if (!acpi_disabled) {
@@ -100,6 +99,10 @@ int populate_cache_leaves(unsigned int cpu)return 0 ; } + np =of_cpu_device_node_get (cpu); +if (!np) +return -ENOENT ; +if (of_property_read_bool (np,"cache-size" ))ci_leaf_init (this_leaf++,CACHE_TYPE_UNIFIED , level);if (of_property_read_bool (np,"i-cache-size" ))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/145 riscv: cacheinfo: Use of_property_present() for non-boolean properties
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit fb8179ce2996bffaa36a04e2b6262843b01b7565 ]
The use of of_property_read_bool() for non-boolean properties is deprecated in favor of of_property_present() when testing for property presence.
--- arch/riscv/kernel/cacheinfo.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/riscv/kernel/cacheinfo.c +6 -6
@@ -103,11 +103,11 @@ int populate_cache_leaves(unsigned int cpu)if (!np)return -ENOENT ; -if (of_property_read_bool (np,"cache-size" )) +if (of_property_present (np,"cache-size" ))ci_leaf_init (this_leaf++,CACHE_TYPE_UNIFIED , level); -if (of_property_read_bool (np,"i-cache-size" )) +if (of_property_present (np,"i-cache-size" ))ci_leaf_init (this_leaf++,CACHE_TYPE_INST , level); -if (of_property_read_bool (np,"d-cache-size" )) +if (of_property_present (np,"d-cache-size" ))ci_leaf_init (this_leaf++,CACHE_TYPE_DATA , level); prev = np;
@@ -120,11 +120,11 @@ int populate_cache_leaves(unsigned int cpu)break ;if (level <= levels)break ; -if (of_property_read_bool (np,"cache-size" )) +if (of_property_present (np,"cache-size" ))ci_leaf_init (this_leaf++,CACHE_TYPE_UNIFIED , level); -if (of_property_read_bool (np,"i-cache-size" )) +if (of_property_present (np,"i-cache-size" ))ci_leaf_init (this_leaf++,CACHE_TYPE_INST , level); -if (of_property_read_bool (np,"d-cache-size" )) +if (of_property_present (np,"d-cache-size" ))ci_leaf_init (this_leaf++,CACHE_TYPE_DATA , level); levels = level; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/145 RISC-V: Enable cbo.zero in usermode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Jones <[email protected]>
[ Upstream commit 43c16d51a19b0ba2ed66978d5924d486ec1e42bc ]
When Zicboz is present, enable its instruction (cbo.zero) in usermode by setting its respective senvcfg bit. We don't bother trying to set this bit per-task, which would also require an interface for tasks to request enabling and/or disabling. Instead, permanently set the bit for each hart which has the extension when bringing it online.
This patch also introduces riscv_cpu_has_extension_[un]likely() functions to check a specific hart's ISA bitmap for extensions. Prior to checking the specific hart's bitmap in these functions we try the bitmap which represents the LCD of extensions, but only when we know it will use its optimized, alternatives path by gating its call on CONFIG_RISCV_ALTERNATIVE. When alternatives are used, the compiler ensures that the invocation of the LCD search becomes a constant true or false. When it's true, even the new functions will completely vanish from their callsites. OTOH, when the LCD check is false, we need to do a search of the hart's ISA bitmap. Had we also checked the LCD bitmap without the use of alternatives, then we would have ended up with two bitmap searches instead of one.
Stable-dep-of: 564fc8eb6f78 ("riscv: signal: fix signal_minsigstksz")
--- arch/riscv/include/asm/cpufeature.h | 1 + arch/riscv/include/asm/csr.h | 1 + arch/riscv/include/asm/hwcap.h | 16 ++++++++++++++++ arch/riscv/kernel/cpufeature.c | 6 ++++++ arch/riscv/kernel/setup.c | 4 ++++ arch/riscv/kernel/smpboot.c | 4 ++++ 6 files changed, 32 insertions(+)
arch/riscv/include/asm/cpufeature.h +1 -0
@@ -31,5 +31,6 @@ DECLARE_PER_CPU(long, misaligned_access_speed);extern struct riscv_isainfo hart_isa[NR_CPUS ];void check_unaligned_access (int cpu); +void riscv_user_isa_enable (void );#endif
arch/riscv/include/asm/csr.h +1 -0
@@ -275,6 +275,7 @@#define CSR_SIE 0x104#define CSR_STVEC 0x105#define CSR_SCOUNTEREN 0x106 +#define CSR_SENVCFG 0x10a#define CSR_SSCRATCH 0x140#define CSR_SEPC 0x141#define CSR_SCAUSE 0x142
arch/riscv/include/asm/hwcap.h +16 -0
@@ -70,6 +70,7 @@#ifndef __ASSEMBLY__#include <linux/jump_label.h> +#include <asm/cpufeature.h> unsigned long riscv_get_elf_hwcap (void );
@@ -137,6 +138,21 @@ riscv_has_extension_unlikely(const unsigned long ext)return true; } +static __always_inline bool riscv_cpu_has_extension_likely(int cpu, const unsigned long ext) +{ +if (IS_ENABLED (CONFIG_RISCV_ALTERNATIVE ) &&riscv_has_extension_likely (ext)) +return true; + +return __riscv_isa_extension_available (hart_isa[cpu].isa, ext); +} + +static __always_inline bool riscv_cpu_has_extension_unlikely(int cpu, const unsigned long ext) +{ +if (IS_ENABLED (CONFIG_RISCV_ALTERNATIVE ) &&riscv_has_extension_unlikely (ext)) +return true; + +return __riscv_isa_extension_available (hart_isa[cpu].isa, ext); +}#endif #endif /* _ASM_RISCV_HWCAP_H */
arch/riscv/kernel/cpufeature.c +6 -0
@@ -676,6 +676,12 @@ static int check_unaligned_access_boot_cpu(void)arch_initcall (check_unaligned_access_boot_cpu); +void riscv_user_isa_enable (void ) +{ +if (riscv_cpu_has_extension_unlikely (smp_processor_id (),RISCV_ISA_EXT_ZICBOZ )) +csr_set (CSR_SENVCFG ,ENVCFG_CBZE ); +} +#ifdef CONFIG_RISCV_ALTERNATIVE /* * Alternative patch sites consider 48 bits when determining when to patch
arch/riscv/kernel/setup.c +4 -0
@@ -26,6 +26,7 @@#include <asm/acpi.h> #include <asm/alternative.h> #include <asm/cacheflush.h> +#include <asm/cpufeature.h> #include <asm/cpu_ops.h> #include <asm/early_ioremap.h> #include <asm/pgtable.h>
@@ -307,10 +308,13 @@ void __init setup_arch(char **cmdline_p)riscv_fill_hwcap ();init_rt_signal_env ();apply_boot_alternatives (); +if (IS_ENABLED (CONFIG_RISCV_ISA_ZICBOM ) &&riscv_isa_extension_available (NULL ,ZICBOM ))riscv_noncoherent_supported ();riscv_set_dma_cache_alignment (); + +riscv_user_isa_enable (); }static int __init topology_init (void )
arch/riscv/kernel/smpboot.c +4 -0
@@ -25,6 +25,8 @@#include <linux/of.h> #include <linux/sched/task_stack.h> #include <linux/sched/mm.h> + +#include <asm/cpufeature.h> #include <asm/cpu_ops.h> #include <asm/cpufeature.h> #include <asm/irq.h>
@@ -253,6 +255,8 @@ asmlinkage __visible void smp_callin(void) elf_hwcap &= ~COMPAT_HWCAP_ISA_V ; } +riscv_user_isa_enable (); +/* * Remote TLB flushes are ignored while the CPU is offline, so emit * a local TLB flush right now just in case.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/145 riscv: signal: fix signal_minsigstksz
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yong-Xuan Wang <[email protected]>
[ Upstream commit 564fc8eb6f78e01292ff10801f318feae6153fdd ]
The init_rt_signal_env() funciton is called before the alternative patch is applied, so using the alternative-related API to check the availability of an extension within this function doesn't have the intended effect. This patch reorders the init_rt_signal_env() and apply_boot_alternatives() to get the correct signal_minsigstksz.
--- arch/riscv/kernel/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/setup.c +1 -1
@@ -306,8 +306,8 @@ void __init setup_arch(char **cmdline_p)riscv_init_cbo_blocksizes ();riscv_fill_hwcap (); -init_rt_signal_env ();apply_boot_alternatives (); +init_rt_signal_env ();if (IS_ENABLED (CONFIG_RISCV_ISA_ZICBOM ) &&riscv_isa_extension_available (NULL ,ZICBOM ))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/145 x86/microcode/AMD: Add some forgotten models to the SHA check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 058a6bec37c6c3b826158f6d26b75de43816a880 upstream.
Add some more forgotten models to the SHA check.
--- arch/x86/kernel/cpu/microcode/amd.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/x86/kernel/cpu/microcode/amd.c +6 -0
@@ -177,23 +177,29 @@ static bool need_sha_check(u32 cur_rev) {switch (cur_rev >>8 ) {case 0x80012 :return cur_rev <=0x800126f ;break ; +case 0x80082 :return cur_rev <=0x800820f ;break ;case 0x83010 :return cur_rev <=0x830107c ;break ;case 0x86001 :return cur_rev <=0x860010e ;break ;case 0x86081 :return cur_rev <=0x8608108 ;break ;case 0x87010 :return cur_rev <=0x8701034 ;break ;case 0x8a000 :return cur_rev <=0x8a0000a ;break ; +case 0xa0010 :return cur_rev <=0xa00107a ;break ;case 0xa0011 :return cur_rev <=0xa0011da ;break ;case 0xa0012 :return cur_rev <=0xa001243 ;break ; +case 0xa0082 :return cur_rev <=0xa00820e ;break ;case 0xa1011 :return cur_rev <=0xa101153 ;break ;case 0xa1012 :return cur_rev <=0xa10124e ;break ;case 0xa1081 :return cur_rev <=0xa108109 ;break ;case 0xa2010 :return cur_rev <=0xa20102f ;break ;case 0xa2012 :return cur_rev <=0xa201212 ;break ; +case 0xa4041 :return cur_rev <=0xa404109 ;break ; +case 0xa5000 :return cur_rev <=0xa500013 ;break ;case 0xa6012 :return cur_rev <=0xa60120a ;break ;case 0xa7041 :return cur_rev <=0xa704109 ;break ;case 0xa7052 :return cur_rev <=0xa705208 ;break ;case 0xa7080 :return cur_rev <=0xa708009 ;break ;case 0xa70c0 :return cur_rev <=0xa70C009 ;break ; +case 0xaa001 :return cur_rev <=0xaa00116 ;break ;case 0xaa002 :return cur_rev <=0xaa00218 ;break ;default :break ; }
Greg Kroah-Hartman
maintainerPATCH 23/145 Revert "of: reserved-memory: Fix using wrong number of cells to get property alignment"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
commit 75f1f311d883dfaffb98be3c1da208d6ed5d4df9 upstream.
This reverts commit 267b21d0bef8e67dbe6c591c9991444e58237ec9.
Turns out some DTs do depend on this behavior. Specifically, a downstream Pixel 6 DT. Revert the change at least until we can decide if the DT spec can be changed instead.
--- drivers/of/of_reserved_mem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/of/of_reserved_mem.c +2 -2
@@ -156,12 +156,12 @@ static int __init __reserved_mem_alloc_s prop =of_get_flat_dt_prop (node,"alignment" , &len);if (prop) { -if (len != dt_root_size_cells *sizeof (__be32)) { +if (len != dt_root_addr_cells *sizeof (__be32)) {pr_err ("invalid alignment property in '%s' node.\n" , uname);return -EINVAL ; } - align =dt_mem_next_cell (dt_root_size_cells, &prop); + align =dt_mem_next_cell (dt_root_addr_cells, &prop); } nomap =of_get_flat_dt_prop (node,"no-map" ,NULL ) !=NULL ;
Greg Kroah-Hartman
maintainerPATCH 24/145 tracing: tprobe-events: Fix a memory leak when tprobe with $retval
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit ac965d7d88fc36fb42e3d50225c0a44dd8326da4 upstream.
Fix a memory leak when a tprobe is defined with $retval. This combination is not allowed, but the parse_symbol_and_return() does not free the *symbol which should not be used if it returns the error. Thus, it leaks the *symbol memory in that error path.
--- kernel/trace/trace_fprobe.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/trace_fprobe.c +2 -0
@@ -948,6 +948,8 @@ static int parse_symbol_and_return(int aif (is_tracepoint) {trace_probe_log_set_index (i);trace_probe_log_err (tmp - argv[i],RETVAL_ON_PROBE ); +kfree (*symbol); + *symbol =NULL ;return -EINVAL ; } *is_return = true;
Greg Kroah-Hartman
maintainerPATCH 25/145 LoongArch: Convert unreachable() to BUG()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
commit da64a2359092ceec4f9dea5b329d0aef20104217 upstream.
When compiling on LoongArch, there exists the following objtool warning in arch/loongarch/kernel/machine_kexec.o:
kexec_reboot() falls through to next function crash_shutdown_secondary()
Avoid using unreachable() as it can (and will in the absence of UBSAN) generate fall-through code. Use BUG() so we get a "break BRK_BUG" trap (with unreachable annotation).
--- arch/loongarch/kernel/machine_kexec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/loongarch/kernel/machine_kexec.c +2 -2
@@ -126,14 +126,14 @@ void kexec_reboot(void)/* All secondary cpus go to kexec_smp_wait */ if (smp_processor_id () >0 ) {relocated_kexec_smp_wait (NULL ); -unreachable (); +BUG (); }#endif do_kexec = (void *)reboot_code_buffer;do_kexec (efi_boot, cmdline_ptr, systable_ptr, start_addr, first_ind_entry); -unreachable (); +BUG (); }
Greg Kroah-Hartman
maintainerPATCH 26/145 LoongArch: Use polling play_dead() when resuming from hibernation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit c9117434c8f7523f0b77db4c5766f5011cc94677 upstream.
When CONFIG_RANDOM_KMALLOC_CACHES or other randomization infrastructrue enabled, the idle_task's stack may different between the booting kernel and target kernel. So when resuming from hibernation, an ACTION_BOOT_CPU IPI wakeup the idle instruction in arch_cpu_idle_dead() and jump to the interrupt handler. But since the stack pointer is changed, the interrupt handler cannot restore correct context.
So rename the current arch_cpu_idle_dead() to idle_play_dead(), make it as the default version of play_dead(), and the new arch_cpu_idle_dead() call play_dead() directly. For hibernation, implement an arch-specific hibernate_resume_nonboot_cpu_disable() to use the polling version (idle instruction is replace by nop, and irq is disabled) of play_dead(), i.e. poll_play_dead(), to avoid IPI handler corrupting the idle_task's stack when resuming from hibernation.
This solution is a little similar to commit 406f992e4a372dafbe3c ("x86 /
hibernate: Use hlt_play_dead() when resuming from hibernation").
--- arch/loongarch/kernel/smp.c | 47 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-)
arch/loongarch/kernel/smp.c +46 -1
@@ -18,6 +18,7 @@#include <linux/smp.h> #include <linux/threads.h> #include <linux/export.h> +#include <linux/suspend.h> #include <linux/syscore_ops.h> #include <linux/time.h> #include <linux/tracepoint.h>
@@ -388,7 +389,7 @@ void loongson_cpu_die(unsigned int cpu)mb (); } -void __noreturn arch_cpu_idle_dead (void ) +static void __noreturn idle_play_dead (void ) { registeruint64_t addr; registervoid (*init_fn)(void );
@@ -412,6 +413,50 @@ void __noreturn arch_cpu_idle_dead(void)BUG (); } +#ifdef CONFIG_HIBERNATION +static void __noreturn poll_play_dead (void ) +{ + registeruint64_t addr; + registervoid (*init_fn)(void ); + +idle_task_exit (); +__this_cpu_write (cpu_state,CPU_DEAD ); + +__smp_mb (); +do { + __asm__ __volatile__("nop\n\t" ); + addr =iocsr_read64 (LOONGARCH_IOCSR_MBUF0 ); + }while (addr ==0 ); + + init_fn = (void *)TO_CACHE (addr); +iocsr_write32 (0xffffffff ,LOONGARCH_IOCSR_IPI_CLEAR ); + +init_fn (); +BUG (); +} +#endif + +static void (*play_dead)(void ) = idle_play_dead; + +void __noreturn arch_cpu_idle_dead (void ) +{ +play_dead (); +BUG ();/* play_dead() doesn't return */ +} + +#ifdef CONFIG_HIBERNATION +int hibernate_resume_nonboot_cpu_disable (void ) +{ +int ret; + + play_dead = poll_play_dead; + ret =suspend_disable_secondary_cpus (); + play_dead = idle_play_dead; + +return ret; +} +#endif +#endif /*
Greg Kroah-Hartman
maintainerPATCH 27/145 LoongArch: Set max_pfn with the PFN of the last page
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit c8477bb0a8e7f6b2e47952b403c5cb67a6929e55 upstream.
The current max_pfn equals to zero. In this case, it causes user cannot get some page information through /proc filesystem such as kpagecount. The following message is displayed by stress-ng test suite with command "stress-ng --verbose --physpage 1 -t 1".
# stress-ng --verbose --physpage 1 -t 1 stress-ng: error: [1691] physpage: cannot read page count for address 0x134ac000 in /proc/kpagecount, errno=22 (Invalid argument) stress-ng: error: [1691] physpage: cannot read page count for address 0x7ffff207c3a8 in /proc/kpagecount, errno=22 (Invalid argument) stress-ng: error: [1691] physpage: cannot read page count for address 0x134b0000 in /proc/kpagecount, errno=22 (Invalid argument) ...
After applying this patch, the kernel can pass the test.
# stress-ng --verbose --physpage 1 -t 1 stress-ng: debug: [1701] physpage: [1701] started (instance 0 on CPU 3) stress-ng: debug: [1701] physpage: [1701] exited (instance 0 on CPU 3) stress-ng: debug: [1700] physpage: [1701] terminated (success)
--- arch/loongarch/kernel/setup.c | 3 +++ 1 file changed, 3 insertions(+)
arch/loongarch/kernel/setup.c +3 -0
@@ -400,6 +400,9 @@ static void __init check_kernel_sections*/ static void __init arch_mem_init (char **cmdline_p) { +/* Recalculate max_low_pfn for "mem=xxx" */ + max_pfn = max_low_pfn =PHYS_PFN (memblock_end_of_DRAM ()); +if (usermem)pr_info ("User-defined physical RAM map overwrite\n" );
Greg Kroah-Hartman
maintainerPATCH 28/145 HID: appleir: Fix potential NULL dereference at raw event handle
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
commit 2ff5baa9b5275e3acafdf7f2089f74cccb2f38d1 upstream.
Syzkaller reports a NULL pointer dereference issue in input_event().
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline] BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395 Read of size 8 at addr 0000000000000028 by task syz-executor199/2949 CPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 kasan_report+0xd9/0x110 mm/kasan/report.c:602 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] is_event_supported drivers/input/input.c:67 [inline] input_event+0x42/0xa0 drivers/input/input.c:395 input_report_key include/linux/input.h:439 [inline] key_down drivers/hid/hid-appleir.c:159 [inline] appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232 __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111 hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484 __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734 dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820 handle_softirqs+0x206/0x8d0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185 add_timer+0x62/0x90 kernel/time/timer.c:1295 schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98 usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645 usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784 hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
This happens due to the malformed report items sent by the emulated device which results in a report, that has no fields, being added to the report list. Due to this appleir_input_configured() is never called, hidinput_connect() fails which results in the HID_CLAIMED_INPUT flag is not being set. However, it does not make appleir_probe() fail and lets the event callback to be called without the associated input device.
Thus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook early if the driver didn't claim any input_dev for some reason. Moreover, some other hid drivers accessing input_dev in their event callbacks do have similar checks, too.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/hid/hid-appleir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-appleir.c +1 -1
@@ -188,7 +188,7 @@ static int appleir_raw_event(struct hid_static const u8 flatbattery[] = {0x25 ,0x87 ,0xe0 };unsigned long flags; -if (len !=5 ) +if (len !=5 || !(hid->claimed &HID_CLAIMED_INPUT )) goto out;if (!memcmp (data, keydown,sizeof (keydown))) {
Greg Kroah-Hartman
maintainerPATCH 29/145 ksmbd: fix type confusion via race condition when using ipc_msg_send_request
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit e2ff19f0b7a30e03516e6eb73b948e27a55bc9d2 upstream.
req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion between messages, resulting in access to unexpected parts of memory after an incorrect delivery. ksmbd check type of ipc response but missing add continue to check next ipc reponse.
--- fs/smb/server/transport_ipc.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/server/transport_ipc.c +1 -0
@@ -267,6 +267,7 @@ static int handle_response(int type, voiif (entry->type +1 != type) {pr_err ("Waiting for IPC type %d, got %d. Ignore.\n" , entry->type +1 , type); +continue ; } entry->response =kvzalloc (sz,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 30/145 ksmbd: fix out-of-bounds in parse_sec_desc()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit d6e13e19063db24f94b690159d0633aaf72a0f03 upstream.
If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when validating sid, It need to check it included subauth array size.
--- fs/smb/server/smbacl.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/smb/server/smbacl.c +16 -0
@@ -807,6 +807,13 @@ static int parse_sid(struct smb_sid *psireturn -EINVAL ; } +if (!psid->num_subauth) +return 0 ; + +if (psid->num_subauth >SID_MAX_SUB_AUTHORITIES || + end_of_acl < (char *)psid +8 +sizeof (__le32) * psid->num_subauth) +return -EINVAL ; +return 0 ; }
@@ -848,6 +855,9 @@ int parse_sec_desc(struct mnt_idmap *idm pntsd->type =cpu_to_le16 (DACL_PRESENT );if (pntsd->osidoffset) { +if (le32_to_cpu (pntsd->osidoffset) <sizeof (struct smb_ntsd )) +return -EINVAL ; + rc =parse_sid (owner_sid_ptr, end_of_acl);if (rc) {pr_err ("%s: Error %d parsing Owner SID\n" , __func__, rc);
@@ -863,6 +873,9 @@ int parse_sec_desc(struct mnt_idmap *idm }if (pntsd->gsidoffset) { +if (le32_to_cpu (pntsd->gsidoffset) <sizeof (struct smb_ntsd )) +return -EINVAL ; + rc =parse_sid (group_sid_ptr, end_of_acl);if (rc) { pr_err("%s: Error %d mapping Owner SID to gid\n",
@@ -884,6 +897,9 @@ int parse_sec_desc(struct mnt_idmap *idm pntsd->type |=cpu_to_le16 (DACL_PROTECTED );if (dacloffset) { +if (dacloffset <sizeof (struct smb_ntsd )) +return -EINVAL ; +parse_dacl (idmap, dacl_ptr, end_of_acl, owner_sid_ptr, group_sid_ptr, fattr); }
Greg Kroah-Hartman
maintainerPATCH 31/145 ksmbd: fix use-after-free in smb2_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit 84d2d1641b71dec326e8736a749b7ee76a9599fc upstream.
If smb_lock->zero_len has value, ->llist of smb_lock is not delete and flock is old one. It will cause use-after-free on error handling routine.
--- fs/smb/server/smb2pdu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/smb/server/smb2pdu.c +3 -3
@@ -7442,13 +7442,13 @@ out_check_cl: } no_check_cl: + flock = smb_lock->fl; +list_del (&smb_lock->llist); +if (smb_lock->zero_len) { err =0 ; goto skip; } - - flock = smb_lock->fl; -list_del (&smb_lock->llist); retry: rc =vfs_lock_file (filp, smb_lock->cmd, flock,NULL ); skip:
Greg Kroah-Hartman
maintainerPATCH 32/145 ksmbd: fix bug on trap in smb2_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit e26e2d2e15daf1ab33e0135caf2304a0cfa2744b upstream.
If lock count is greater than 1, flags could be old value. It should be checked with flags of smb_lock, not flags. It will cause bug-on trap from locks_free_lock in error handling routine.
--- fs/smb/server/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +1 -1
@@ -7452,7 +7452,7 @@ no_check_cl: retry: rc =vfs_lock_file (filp, smb_lock->cmd, flock,NULL ); skip: -if (flags &SMB2_LOCKFLAG_UNLOCK ) { +if (smb_lock->flags &SMB2_LOCKFLAG_UNLOCK ) {if (!rc) {ksmbd_debug (SMB ,"File unlocked\n" ); }else if (rc == -ENOENT ) {
Greg Kroah-Hartman
maintainerPATCH 33/145 gpio: rcar: Use raw_spinlock to protect register access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
commit f02c41f87cfe61440c18bf77d1ef0a884b9ee2b5 upstream.
Use raw_spinlock in order to fix spurious messages about invalid context when spinlock debugging is enabled. The lock is only used to serialize register access.
[ 4.239592] =============================
[ 4.239595] [ BUG: Invalid wait context ]
[ 4.239599] 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 Not tainted
[ 4.239603] -----------------------------
[ 4.239606] kworker/u8:5/76 is trying to lock:
[ 4.239609] ffff0000091898a0 (&p->lock){....}-{3:3}, at: gpio_rcar_config_interrupt_input_mode+0x34/0x164
[ 4.239641] other info that might help us debug this:
[ 4.239643] context-{5:5}
[ 4.239646] 5 locks held by kworker/u8:5/76:
[ 4.239651] #0: ffff0000080fb148 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x190/0x62c
[ 4.250180] OF: /soc/sound@ec500000/ports/port@0/endpoint: Read of boolean property 'frame-master' with a value.
[ 4.254094] #1: ffff80008299bd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x1b8/0x62c
[ 4.254109] #2: ffff00000920c8f8
[ 4.258345] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'bitclock-master' with a value.
[ 4.264803] (&dev->mutex){....}-{4:4}, at: __device_attach_async_helper+0x3c/0xdc
[ 4.264820] #3: ffff00000a50ca40 (request_class#2){+.+.}-{4:4}, at: __setup_irq+0xa0/0x690
[ 4.264840] #4:
[ 4.268872] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'frame-master' with a value.
[ 4.273275] ffff00000a50c8c8 (lock_class){....}-{2:2}, at: __setup_irq+0xc4/0x690
[ 4.296130] renesas_sdhi_internal_dmac ee100000.mmc: mmc1 base at 0x00000000ee100000, max clock rate 200 MHz
[ 4.304082] stack backtrace:
[ 4.304086] CPU: 1 UID: 0 PID: 76 Comm: kworker/u8:5 Not tainted 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35
[ 4.304092] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
[ 4.304097] Workqueue: async async_run_entry_fn
[ 4.304106] Call trace:
[ 4.304110] show_stack+0x14/0x20 (C)
[ 4.304122] dump_stack_lvl+0x6c/0x90
[ 4.304131] dump_stack+0x14/0x1c
[ 4.304138] __lock_acquire+0xdfc/0x1584
[ 4.426274] lock_acquire+0x1c4/0x33c
[ 4.429942] _raw_spin_lock_irqsave+0x5c/0x80
[ 4.434307] gpio_rcar_config_interrupt_input_mode+0x34/0x164
[ 4.440061] gpio_rcar_irq_set_type+0xd4/0xd8
[ 4.444422] __irq_set_trigger+0x5c/0x178
[ 4.448435] __setup_irq+0x2e4/0x690
[ 4.452012] request_threaded_irq+0xc4/0x190
[ 4.456285] devm_request_threaded_irq+0x7c/0xf4
[ 4.459398] ata1: link resume succeeded after 1 retries
[ 4.460902] mmc_gpiod_request_cd_irq+0x68/0xe0
[ 4.470660] mmc_start_host+0x50/0xac
[ 4.474327] mmc_add_host+0x80/0xe4
[ 4.477817] tmio_mmc_host_probe+0x2b0/0x440
[ 4.482094] renesas_sdhi_probe+0x488/0x6f4
[ 4.486281] renesas_sdhi_internal_dmac_probe+0x60/0x78
[ 4.491509] platform_probe+0x64/0xd8
[ 4.495178] really_probe+0xb8/0x2a8
[ 4.498756] __driver_probe_device+0x74/0x118
[ 4.503116] driver_probe_device+0x3c/0x154
[ 4.507303] __device_attach_driver+0xd4/0x160
[ 4.511750] bus_for_each_drv+0x84/0xe0
[ 4.515588] __device_attach_async_helper+0xb0/0xdc
[ 4.520470] async_run_entry_fn+0x30/0xd8
[ 4.524481] process_one_work+0x210/0x62c
[ 4.528494] worker_thread+0x1ac/0x340
[ 4.532245] kthread+0x10c/0x110
[ 4.535476] ret_from_fork+0x10/0x20--- drivers/gpio/gpio-rcar.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/gpio/gpio-rcar.c +12 -12
@@ -40,7 +40,7 @@ struct gpio_rcar_info {struct gpio_rcar_priv {void __iomem *base; -spinlock_t lock; +raw_spinlock_t lock;struct device *dev;struct gpio_chip gpio_chip;unsigned int irq_parent;
@@ -123,7 +123,7 @@ static void gpio_rcar_config_interrupt_i* "Setting Level-Sensitive Interrupt Input Mode" */ -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags);/* Configure positive or negative logic in POSNEG */ gpio_rcar_modify_bit (p,POSNEG , hwirq, !active_high_rising_edge);
@@ -142,7 +142,7 @@ static void gpio_rcar_config_interrupt_iif (!level_trigger)gpio_rcar_write (p,INTCLR ,BIT (hwirq)); -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); }static int gpio_rcar_irq_set_type (struct irq_data *d,unsigned int type)
@@ -246,7 +246,7 @@ static void gpio_rcar_config_general_inp* "Setting General Input Mode" */ -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags);/* Configure positive logic in POSNEG */ gpio_rcar_modify_bit (p,POSNEG , gpio, false);
@@ -261,7 +261,7 @@ static void gpio_rcar_config_general_inpif (p->info.has_outdtsel && output)gpio_rcar_modify_bit (p,OUTDTSEL , gpio, false); -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); }static int gpio_rcar_request (struct gpio_chip *chip,unsigned offset)
@@ -347,7 +347,7 @@ static int gpio_rcar_get_multiple(structreturn 0 ; } -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags); outputs =gpio_rcar_read (p,INOUTSEL ); m = outputs & bankmask;if (m)
@@ -356,7 +356,7 @@ static int gpio_rcar_get_multiple(struct m = ~outputs & bankmask;if (m) val |=gpio_rcar_read (p,INDT ) & m; -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); bits[0 ] = val;return 0 ;
@@ -367,9 +367,9 @@ static void gpio_rcar_set(struct gpio_chstruct gpio_rcar_priv *p =gpiochip_get_data (chip);unsigned long flags; -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags);gpio_rcar_modify_bit (p,OUTDT , offset, value); -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); } static void gpio_rcar_set_multiple(struct gpio_chip *chip, unsigned long *mask,
@@ -386,12 +386,12 @@ static void gpio_rcar_set_multiple(strucif (!bankmask)return ; -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags); val =gpio_rcar_read (p,OUTDT ); val &= ~bankmask; val |= (bankmask & bits[0 ]);gpio_rcar_write (p,OUTDT , val); -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); } static int gpio_rcar_direction_output(struct gpio_chip *chip, unsigned offset,
@@ -505,7 +505,7 @@ static int gpio_rcar_probe(struct platforeturn -ENOMEM ; p->dev = dev; -spin_lock_init (&p->lock); +raw_spin_lock_init (&p->lock);/* Get device configuration from DT node */ ret =gpio_rcar_parse_dt (p, &npins);
Greg Kroah-Hartman
maintainerPATCH 34/145 gpio: aggregator: protect driver attr handlers against module unload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream.
Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held.
Add try_module_get() in these handlers.
For new_device_store, this eliminates what appears to be the most dangerous
scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems:
#!/bin/bash
while :; do
# note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device
done &
while :; do
modprobe gpio-aggregator
modprobe -r gpio-aggregator
done &
wait
Starting with the following warning, several kinds of warnings will appear and the system may become unstable:
------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]---
--- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
drivers/gpio/gpio-aggregator.c +17 -3
@@ -121,10 +121,15 @@ static ssize_t new_device_store(struct dstruct platform_device *pdev;int res, id; +if (!try_module_get (THIS_MODULE )) +return -ENOENT ; +/* kernfs guarantees string termination, so count + 1 is safe */ aggr =kzalloc (sizeof (*aggr) + count +1 ,GFP_KERNEL ); -if (!aggr) -return -ENOMEM ; +if (!aggr) { + res = -ENOMEM ; + goto put_module; + }memcpy (aggr->args, buf, count +1 );
@@ -163,6 +168,7 @@ static ssize_t new_device_store(struct d } aggr->pdev = pdev; +module_put (THIS_MODULE );return count; remove_table:
@@ -177,6 +183,8 @@ free_table:kfree (aggr->lookups); free_ga:kfree (aggr); +put_module: +module_put (THIS_MODULE );return res; }
@@ -205,13 +213,19 @@ static ssize_t delete_device_store(strucif (error)return error; +if (!try_module_get (THIS_MODULE )) +return -ENOENT ; +mutex_lock (&gpio_aggregator_lock); aggr =idr_remove (&gpio_aggregator_idr, id);mutex_unlock (&gpio_aggregator_lock); -if (!aggr) +if (!aggr) { +module_put (THIS_MODULE );return -ENOENT ; + }gpio_aggregator_free (aggr); +module_put (THIS_MODULE );return count; }static DRIVER_ATTR_WO (delete_device);
Greg Kroah-Hartman
maintainerPATCH 35/145 ALSA: seq: Avoid module auto-load handling at event delivery
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c9ce148ea753bef66686460fa3cec6641cdfbb9f upstream.
snd_seq_client_use_ptr() is supposed to return the snd_seq_client object for the given client ID, and it tries to handle the module auto-loading when no matching object is found. Although the module handling is performed only conditionally with "!in_interrupt()", this condition may be fragile, e.g. when the code is called from the ALSA timer callback where the spinlock is temporarily disabled while the irq is disabled. Then his doesn't fit well and spews the error about sleep from invalid context, as complained recently by syzbot.
Also, in general, handling the module-loading at each time if no matching object is found is really an overkill. It can be still useful when performed at the top-level ioctl or proc reads, but it shouldn't be done at event delivery at all.
For addressing the issues above, this patch disables the module handling in snd_seq_client_use_ptr() in normal cases like event deliveries, but allow only in limited and safe situations. A new function client_load_and_use_ptr() is used for the cases where the module loading can be done safely, instead.
--- sound/core/seq/seq_clientmgr.c | 46 ++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 16 deletions(-)
sound/core/seq/seq_clientmgr.c +30 -16
@@ -106,7 +106,7 @@ static struct snd_seq_client *clientptr(return clienttab[clientid]; } -struct snd_seq_client *snd_seq_client_use_ptr (int clientid) +static struct snd_seq_client *client_use_ptr (int clientid,bool load_module) {unsigned long flags;struct snd_seq_client *client;
@@ -126,7 +126,7 @@ struct snd_seq_client *snd_seq_client_us }spin_unlock_irqrestore (&clients_lock, flags);#ifdef CONFIG_MODULES -if (!in_interrupt ()) { +if (load_module) { static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS); static DECLARE_BITMAP(card_requested, SNDRV_CARDS);
@@ -168,6 +168,20 @@ struct snd_seq_client *snd_seq_client_usreturn client; } +/* get snd_seq_client object for the given id quickly */ +struct snd_seq_client *snd_seq_client_use_ptr (int clientid) +{ +return client_use_ptr (clientid, false); +} + +/* get snd_seq_client object for the given id; +* if not found, retry after loading the modules +*/ +static struct snd_seq_client *client_load_and_use_ptr (int clientid) +{ +return client_use_ptr (clientid,IS_ENABLED (CONFIG_MODULES )); +} +/* Take refcount and perform ioctl_mutex lock on the given client; * used only for OSS sequencer * Unlock via snd_seq_client_ioctl_unlock() below
@@ -176,7 +190,7 @@ bool snd_seq_client_ioctl_lock(int clien {struct snd_seq_client *client; - client =snd_seq_client_use_ptr (clientid); + client =client_load_and_use_ptr (clientid);if (!client)return false;mutex_lock (&client->ioctl_mutex);
@@ -1200,7 +1214,7 @@ static int snd_seq_ioctl_running_mode(stint err =0 ;/* requested client number */ - cptr =snd_seq_client_use_ptr (info->client); + cptr =client_load_and_use_ptr (info->client);if (cptr ==NULL )return -ENOENT ;/* don't change !!! */
@@ -1262,7 +1276,7 @@ static int snd_seq_ioctl_get_client_infostruct snd_seq_client *cptr;/* requested client number */ - cptr =snd_seq_client_use_ptr (client_info->client); + cptr =client_load_and_use_ptr (client_info->client);if (cptr ==NULL )return -ENOENT ;/* don't change !!! */
@@ -1397,7 +1411,7 @@ static int snd_seq_ioctl_get_port_info(sstruct snd_seq_client *cptr;struct snd_seq_client_port *port; - cptr =snd_seq_client_use_ptr (info->addr.client); + cptr =client_load_and_use_ptr (info->addr.client);if (cptr ==NULL )return -ENXIO ;
@@ -1501,10 +1515,10 @@ static int snd_seq_ioctl_subscribe_port(struct snd_seq_client *receiver =NULL , *sender =NULL ;struct snd_seq_client_port *sport =NULL , *dport =NULL ; - receiver =snd_seq_client_use_ptr (subs->dest.client); + receiver =client_load_and_use_ptr (subs->dest.client);if (!receiver) goto __end; - sender =snd_seq_client_use_ptr (subs->sender.client); + sender =client_load_and_use_ptr (subs->sender.client);if (!sender) goto __end; sport =snd_seq_port_use_ptr (sender, subs->sender.port);
@@ -1865,7 +1879,7 @@ static int snd_seq_ioctl_get_client_poolstruct snd_seq_client_pool *info = arg;struct snd_seq_client *cptr; - cptr =snd_seq_client_use_ptr (info->client); + cptr =client_load_and_use_ptr (info->client);if (cptr ==NULL )return -ENOENT ;memset (info,0 ,sizeof (*info));
@@ -1969,7 +1983,7 @@ static int snd_seq_ioctl_get_subscriptiostruct snd_seq_client_port *sport =NULL ; result = -EINVAL ; - sender =snd_seq_client_use_ptr (subs->sender.client); + sender =client_load_and_use_ptr (subs->sender.client);if (!sender) goto __end; sport =snd_seq_port_use_ptr (sender, subs->sender.port);
@@ -2000,7 +2014,7 @@ static int snd_seq_ioctl_query_subs(strustruct list_head *p;int i; - cptr =snd_seq_client_use_ptr (subs->root.client); + cptr =client_load_and_use_ptr (subs->root.client);if (!cptr) goto __end; port =snd_seq_port_use_ptr (cptr, subs->root.port);
@@ -2067,7 +2081,7 @@ static int snd_seq_ioctl_query_next_clieif (info->client <0 ) info->client =0 ;for (; info->client <SNDRV_SEQ_MAX_CLIENTS ; info->client++) { - cptr =snd_seq_client_use_ptr (info->client); + cptr =client_load_and_use_ptr (info->client);if (cptr)break ;/* found */ }
@@ -2090,7 +2104,7 @@ static int snd_seq_ioctl_query_next_portstruct snd_seq_client *cptr;struct snd_seq_client_port *port =NULL ; - cptr =snd_seq_client_use_ptr (info->addr.client); + cptr =client_load_and_use_ptr (info->addr.client);if (cptr ==NULL )return -ENXIO ;
@@ -2187,7 +2201,7 @@ static int snd_seq_ioctl_client_ump_info size =sizeof (struct snd_ump_endpoint_info ); else size =sizeof (struct snd_ump_block_info ); - cptr =snd_seq_client_use_ptr (client); + cptr =client_load_and_use_ptr (client);if (!cptr)return -ENOENT ;
@@ -2459,7 +2473,7 @@ int snd_seq_kernel_client_enqueue(int clif (check_event_type_and_length (ev))return -EINVAL ; - cptr =snd_seq_client_use_ptr (client); + cptr =client_load_and_use_ptr (client);if (cptr ==NULL )return -EINVAL ;
@@ -2686,7 +2700,7 @@ void snd_seq_info_clients_read(struct sn/* list the client table */ for (c =0 ; c <SNDRV_SEQ_MAX_CLIENTS ; c++) { - client =snd_seq_client_use_ptr (c); + client =client_load_and_use_ptr (c);if (client ==NULL )continue ;if (client->type ==NO_CLIENT ) {
Greg Kroah-Hartman
maintainerPATCH 36/145 ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hoku Ishibe <[email protected]>
commit 1ee5aa765c22a0577ec552d460bf2035300b4b51 upstream.
Dell XPS 13 7390 with the Realtek ALC3271 codec experiences persistent humming noise when the power_save mode is enabled. This issue occurs when the codec enters power saving mode, leading to unwanted noise from the speakers.
This patch adds the affected model (PCI ID 0x1028:0x0962) to the power_save denylist to ensure power_save is disabled by default, preventing power-off related noise issues.
Steps to Reproduce
1. Boot the system with snd_hda_intel loaded.
2. Verify that power_save mode is enabled:
```sh cat /sys/module/snd_hda_intel/parameters/power_save ````
output: 10 (default power save timeout)
3. Wait for the power save timeout
4. Observe a persistent humming noise from the speakers
5. Disable power_save manually:
```sh echo 0 | sudo tee /sys/module/snd_hda_intel/parameters/power_save ````
6. Confirm that the noise disappears immediately.
This issue has been observed on my system, and this patch successfully eliminates the unwanted noise. If other users experience similar issues, additional reports would be helpful.
--- sound/pci/hda/hda_intel.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/hda_intel.c +2 -0
@@ -2222,6 +2222,8 @@ static const struct snd_pci_quirk power_SND_PCI_QUIRK (0x1631 ,0xe017 ,"Packard Bell NEC IMEDIA 5204" ,0 ),/* KONTRON SinglePC may cause a stall at runtime resume */ SND_PCI_QUIRK (0x1734 ,0x1232 ,"KONTRON SinglePC" ,0 ), +/* Dell ALC3271 */ + SND_PCI_QUIRK(0x1028, 0x0962, "Dell ALC3271", 0), {} };#endif /* CONFIG_PM */
Greg Kroah-Hartman
maintainerPATCH 37/145 ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit f603b159231b0c58f0c27ab39348534063d38223 upstream.
Support Mic Mute LED for ThinkCentre M series.
--- sound/pci/hda/patch_realtek.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
sound/pci/hda/patch_realtek.c +18 -0
@@ -4918,6 +4918,16 @@ static void alc269_fixup_hp_line1_mic1_l } } +static void alc233_fixup_lenovo_low_en_micmute_led (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +struct alc_spec *spec = codec->spec; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) + spec->micmute_led_polarity =1 ; +alc233_fixup_lenovo_line2_mic_hotkey (codec, fix, action); +} +static void alc_hp_mute_disable (struct hda_codec *codec,unsigned int delay) {if (delay <=0 )
@@ -7295,6 +7305,7 @@ enum {ALC275_FIXUP_DELL_XPS ,ALC293_FIXUP_LENOVO_SPK_NOISE ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY , +ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED ,ALC255_FIXUP_DELL_SPK_NOISE ,ALC225_FIXUP_DISABLE_MIC_VREF , ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -8282,6 +8293,10 @@ static const struct hda_fixup alc269_fix .type = HDA_FIXUP_FUNC, .v.func = alc233_fixup_lenovo_line2_mic_hotkey, }, + [ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc233_fixup_lenovo_low_en_micmute_led, + }, [ALC233_FIXUP_INTEL_NUC8_DMIC] = { .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_inv_dmic,
@@ -10343,6 +10358,9 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x17aa ,0x3178 ,"ThinkCentre Station" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x17aa ,0x31af ,"ThinkCentre Station" ,ALC623_FIXUP_LENOVO_THINKSTATION_P340 ),SND_PCI_QUIRK (0x17aa ,0x334b ,"Lenovo ThinkCentre M70 Gen5" ,ALC283_FIXUP_HEADSET_MIC ), +SND_PCI_QUIRK (0x17aa ,0x3384 ,"ThinkCentre M90a PRO" ,ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED ), +SND_PCI_QUIRK (0x17aa ,0x3386 ,"ThinkCentre M90a Gen6" ,ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED ), +SND_PCI_QUIRK (0x17aa ,0x3387 ,"ThinkCentre M70a Gen6" ,ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED ),SND_PCI_QUIRK (0x17aa ,0x3801 ,"Lenovo Yoga9 14IAP7" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x3802 ,"Lenovo Yoga Pro 9 14IRP8 / DuetITL 2021" ,ALC287_FIXUP_LENOVO_14IRP8_DUETITL ), SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
Greg Kroah-Hartman
maintainerPATCH 38/145 ALSA: hda/realtek: update ALC222 depop optimize
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit ca0dedaff92307591f66c9206933fbdfe87add10 upstream.
Add ALC222 its own depop functions for alc_init and alc_shutup.
[note: this fixes pop noise issues on the models with two headphone
jacks -- tiwai ]
--- sound/pci/hda/patch_realtek.c | 76 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+)
sound/pci/hda/patch_realtek.c +76 -0
@@ -3834,6 +3834,79 @@ static void alc225_shutup(struct hda_cod } } +static void alc222_init (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; +hda_nid_t hp_pin =alc_get_hp_pin (spec); +bool hp1_pin_sense, hp2_pin_sense; + +if (!hp_pin) +return ; + +msleep (30 ); + + hp1_pin_sense =snd_hda_jack_detect (codec, hp_pin); + hp2_pin_sense =snd_hda_jack_detect (codec,0x14 ); + +if (hp1_pin_sense || hp2_pin_sense) { +msleep (2 ); + +if (hp1_pin_sense) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); +if (hp2_pin_sense) +snd_hda_codec_write (codec,0x14 ,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); +msleep (75 ); + +if (hp1_pin_sense) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE ); +if (hp2_pin_sense) +snd_hda_codec_write (codec,0x14 ,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE ); + +msleep (75 ); + } +} + +static void alc222_shutup (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; +hda_nid_t hp_pin =alc_get_hp_pin (spec); +bool hp1_pin_sense, hp2_pin_sense; + +if (!hp_pin) + hp_pin =0x21 ; + + hp1_pin_sense =snd_hda_jack_detect (codec, hp_pin); + hp2_pin_sense =snd_hda_jack_detect (codec,0x14 ); + +if (hp1_pin_sense || hp2_pin_sense) { +msleep (2 ); + +if (hp1_pin_sense) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); +if (hp2_pin_sense) +snd_hda_codec_write (codec,0x14 ,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); + +msleep (75 ); + +if (hp1_pin_sense) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); +if (hp2_pin_sense) +snd_hda_codec_write (codec,0x14 ,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); + +msleep (75 ); + } +alc_auto_setup_eapd (codec, false); +alc_shutup_pins (codec); +} +static void alc_default_init (struct hda_codec *codec) {struct alc_spec *spec = codec->spec;
@@ -11309,8 +11382,11 @@ static int patch_alc269(struct hda_codec spec->codec_variant =ALC269_TYPE_ALC300 ; spec->gen.mixer_nid =0 ;/* no loopback on ALC300 */ break ; +case 0x10ec0222 :case 0x10ec0623 : spec->codec_variant =ALC269_TYPE_ALC623 ; + spec->shutup = alc222_shutup; + spec->init_hook = alc222_init;break ;case 0x10ec0700 :case 0x10ec0701 :
Greg Kroah-Hartman
maintainerPATCH 39/145 hwmon: (peci/dimmtemp) Do not provide fake thresholds data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Fertser <[email protected]>
commit 5797c04400ee117bfe459ff1e468d0ea38054ab4 upstream.
When an Icelake or Sapphire Rapids CPU isn't providing the maximum and critical thresholds for particular DIMM the driver should return an error to the userspace instead of giving it stale (best case) or wrong (the structure contains all zeros after kzalloc() call) data.
The issue can be reproduced by binding the peci driver while the host is fully booted and idle, this makes PECI interaction unreliable enough.
--- drivers/hwmon/peci/dimmtemp.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/hwmon/peci/dimmtemp.c +4 -6
@@ -127,8 +127,6 @@ static int update_thresholds(struct pecireturn 0 ; ret = priv->gen_info->read_thresholds (priv, dimm_order, chan_rank, &data); -if (ret == -ENODATA )/* Use default or previous value */ -return 0 ;if (ret)return ret;
@@ -509,11 +507,11 @@ read_thresholds_icx(struct peci_dimmtemp ret =peci_ep_pci_local_read (priv->peci_dev,0 ,13 ,0 ,2 ,0xd4 , ®_val);if (ret || !(reg_val &BIT (31 ))) -return -ENODATA ;/* Use default or previous value */ +return -ENODATA ; ret =peci_ep_pci_local_read (priv->peci_dev,0 ,13 ,0 ,2 ,0xd0 , ®_val);if (ret) -return -ENODATA ;/* Use default or previous value */ +return -ENODATA ;/* * Device 26, Offset 224e0: IMC 0 channel 0 -> rank 0
@@ -546,11 +544,11 @@ read_thresholds_spr(struct peci_dimmtemp ret =peci_ep_pci_local_read (priv->peci_dev,0 ,30 ,0 ,2 ,0xd4 , ®_val);if (ret || !(reg_val &BIT (31 ))) -return -ENODATA ;/* Use default or previous value */ +return -ENODATA ; ret =peci_ep_pci_local_read (priv->peci_dev,0 ,30 ,0 ,2 ,0xd0 , ®_val);if (ret) -return -ENODATA ;/* Use default or previous value */ +return -ENODATA ;/* * Device 26, Offset 219a8: IMC 0 channel 0 -> rank 0
Greg Kroah-Hartman
maintainerPATCH 40/145 drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 374c9faac5a763a05bc3f68ad9f73dab3c6aec90 upstream.
Null pointer dereference issue could occur when pipe_ctx->plane_state is null. The fix adds a check to ensure 'pipe_ctx->plane_state' is not null before accessing. This prevents a null pointer dereference.
Found by code review.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +2 -1
@@ -1394,7 +1394,8 @@ bool resource_build_scaling_params(strucDC_LOGGER_INIT (pipe_ctx->stream->ctx->logger);/* Invalid input */ -if (!plane_state->dst_rect.width || +if (!plane_state || + !plane_state->dst_rect.width || !plane_state->dst_rect.height || !plane_state->src_rect.width || !plane_state->src_rect.height) {
Greg Kroah-Hartman
maintainerPATCH 41/145 drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Thier <[email protected]>
commit 29ffeb73b216ce3eff10229eb077cf9b7812119d upstream.
num_gb_pipes was set to a wrong value using r420_pipe_config
This have lead to HyperZ glitches on fast Z clearing.
--- drivers/gpu/drm/radeon/r300.c | 3 ++- drivers/gpu/drm/radeon/radeon_asic.h | 1 + drivers/gpu/drm/radeon/rs400.c | 18 ++++++++++++++++-- 3 files changed, 19 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/r300.c +2 -1
@@ -358,7 +358,8 @@ int r300_mc_wait_for_idle(struct radeon_return -1 ; } -static void r300_gpu_init (struct radeon_device *rdev) +/* rs400_gpu_init also calls this! */ +void r300_gpu_init (struct radeon_device *rdev) {uint32_t gb_tile_config, tmp;
drivers/gpu/drm/radeon/radeon_asic.h +1 -0
@@ -165,6 +165,7 @@ void r200_set_safe_registers(struct rade*/ extern int r300_init (struct radeon_device *rdev);extern void r300_fini (struct radeon_device *rdev); +extern void r300_gpu_init (struct radeon_device *rdev);extern int r300_suspend (struct radeon_device *rdev);extern int r300_resume (struct radeon_device *rdev);extern int r300_asic_reset (struct radeon_device *rdev,bool hard);
drivers/gpu/drm/radeon/rs400.c +16 -2
@@ -255,8 +255,22 @@ int rs400_mc_wait_for_idle(struct radeonstatic void rs400_gpu_init (struct radeon_device *rdev) { -/* FIXME: is this correct ? */ -r420_pipes_init (rdev); +/* Earlier code was calling r420_pipes_init and then +* rs400_mc_wait_for_idle(rdev). The problem is that +* at least on my Mobility Radeon Xpress 200M RC410 card +* that ends up in this code path ends up num_gb_pipes == 3 +* while the card seems to have only one pipe. With the +* r420 pipe initialization method. +* +* Problems shown up as HyperZ glitches, see: +* https://bugs.freedesktop.org/show_bug.cgi?id=110897 +* +* Delegating initialization to r300 code seems to work +* and results in proper pipe numbers. The rs400 cards +* are said to be not r400, but r300 kind of cards. +*/ +r300_gpu_init (rdev); +if (rs400_mc_wait_for_idle (rdev)) {pr_warn ("rs400: Failed to wait MC idle while programming pipes. Bad things might happen. %08x\n" ,RREG32 (RADEON_MC_STATUS ));
Greg Kroah-Hartman
maintainerPATCH 42/145 platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingcong Bai <[email protected]>
commit d0d10eaedcb53740883d7e5d53c5e15c879b48fb upstream.
Based on the dmesg messages from the original reporter:
[ 4.964073] ACPI: \_SB_.PCI0.LPCB.EC__.HKEY: BCTG evaluated but flagged as error [ 4.964083] thinkpad_acpi: Error probing battery 2
Lenovo ThinkPad X131e also needs this battery quirk.
--- drivers/platform/x86/thinkpad_acpi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/thinkpad_acpi.c +1 -0
@@ -9911,6 +9911,7 @@ static const struct tpacpi_quirk battery* Individual addressing is broken on models that expose the * primary battery as BAT1. */ +TPACPI_Q_LNV ('G' ,'8' , true),/* ThinkPad X131e */ TPACPI_Q_LNV ('8' ,'F' , true),/* Thinkpad X120e */ TPACPI_Q_LNV ('J' ,'7' , true),/* B5400 */ TPACPI_Q_LNV('J', 'I', true), /* Thinkpad 11e */
Greg Kroah-Hartman
maintainerPATCH 43/145 x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
commit 8177c6bedb7013cf736137da586cf783922309dd upstream.
CPUID leaf 0x2 emits one-byte descriptors in its four output registers EAX, EBX, ECX, and EDX. For these descriptors to be valid, the most significant bit (MSB) of each register must be clear.
The historical Git commit:
019361a20f016 ("- pre6: Intel: start to add Pentium IV specific stuff (128-byte cacheline etc)...")
introduced leaf 0x2 output parsing. It only validated the MSBs of EAX, EBX, and ECX, but left EDX unchecked.
Validate EDX's most-significant bit.
--- arch/x86/kernel/cpu/cacheinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/cacheinfo.c +1 -1
@@ -810,7 +810,7 @@ void init_intel_cacheinfo(struct cpuinfocpuid (2 , ®s[0 ], ®s[1 ], ®s[2 ], ®s[3 ]);/* If bit 31 is set, this is an unknown format */ -for (j =0 ; j <3 ; j++) +for (j =0 ; j <4 ; j++)if (regs[j] & (1 <<31 )) regs[j] =0 ;
Greg Kroah-Hartman
maintainerPATCH 44/145 x86/cpu: Validate CPUID leaf 0x2 EDX output
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
commit 1881148215c67151b146450fb89ec22fd92337a7 upstream.
CPUID leaf 0x2 emits one-byte descriptors in its four output registers EAX, EBX, ECX, and EDX. For these descriptors to be valid, the most significant bit (MSB) of each register must be clear.
Leaf 0x2 parsing at intel.c only validated the MSBs of EAX, EBX, and ECX, but left EDX unchecked.
Validate EDX's most-significant bit as well.
--- arch/x86/kernel/cpu/intel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/intel.c +1 -1
@@ -912,7 +912,7 @@ static void intel_detect_tlb(struct cpuicpuid (2 , ®s[0 ], ®s[1 ], ®s[2 ], ®s[3 ]);/* If bit 31 is set, this is an unknown format */ -for (j =0 ; j <3 ; j++) +for (j =0 ; j <4 ; j++)if (regs[j] & (1 <<31 )) regs[j] =0 ;
Greg Kroah-Hartman
maintainerPATCH 45/145 x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
commit f6bdaab79ee4228a143ee1b4cb80416d6ffc0c63 upstream.
CPUID leaf 0x2's one-byte TLB descriptors report the number of entries for specific TLB types, among other properties.
Typically, each emitted descriptor implies the same number of entries for its respective TLB type(s). An emitted 0x63 descriptor is an
exception: it implies 4 data TLB entries for 1GB pages and 32 data TLB entries for 2MB or 4MB pages.
For the TLB descriptors parsing code, the entry count for 1GB pages is encoded at the intel_tlb_table[] mapping, but the 2MB/4MB entry count is totally ignored.
Update leaf 0x2's parsing logic 0x2 to account for 32 data TLB entries for 2MB/4MB pages implied by the 0x63 descriptor.
--- arch/x86/kernel/cpu/intel.c | 60 ++++++++++++++++++++++++++++---------------- 1 file changed, 39 insertions(+), 21 deletions(-)
arch/x86/kernel/cpu/intel.c +39 -21
@@ -748,26 +748,37 @@ static unsigned int intel_size_cache(str }#endif -#define TLB_INST_4K 0x01 -#define TLB_INST_4M 0x02 -#define TLB_INST_2M_4M 0x03 - -#define TLB_INST_ALL 0x05 -#define TLB_INST_1G 0x06 - -#define TLB_DATA_4K 0x11 -#define TLB_DATA_4M 0x12 -#define TLB_DATA_2M_4M 0x13 -#define TLB_DATA_4K_4M 0x14 - -#define TLB_DATA_1G 0x16 - -#define TLB_DATA0_4K 0x21 -#define TLB_DATA0_4M 0x22 -#define TLB_DATA0_2M_4M 0x23 - -#define STLB_4K 0x41 -#define STLB_4K_2M 0x42 +#define TLB_INST_4K 0x01 +#define TLB_INST_4M 0x02 +#define TLB_INST_2M_4M 0x03 + +#define TLB_INST_ALL 0x05 +#define TLB_INST_1G 0x06 + +#define TLB_DATA_4K 0x11 +#define TLB_DATA_4M 0x12 +#define TLB_DATA_2M_4M 0x13 +#define TLB_DATA_4K_4M 0x14 + +#define TLB_DATA_1G 0x16 +#define TLB_DATA_1G_2M_4M 0x17 + +#define TLB_DATA0_4K 0x21 +#define TLB_DATA0_4M 0x22 +#define TLB_DATA0_2M_4M 0x23 + +#define STLB_4K 0x41 +#define STLB_4K_2M 0x42 + +/* +* All of leaf 0x2's one-byte TLB descriptors implies the same number of +* entries for their respective TLB types. The 0x63 descriptor is an +* exception: it implies 4 dTLB entries for 1GB pages 32 dTLB entries +* for 2MB or 4MB pages. Encode descriptor 0x63 dTLB entry count for +* 2MB/4MB pages here, as its count for dTLB 1GB pages is already at the +* intel_tlb_table[] mapping. +*/ +#define TLB_0x63_2M_4M_ENTRIES 32static const struct _tlb_table intel_tlb_table[] = { {0x01 ,TLB_INST_4K ,32 ," TLB_INST 4 KByte pages, 4-way set associative" },
@@ -789,7 +800,8 @@ static const struct _tlb_table intel_tlb { 0x5c, TLB_DATA_4K_4M, 128, " TLB_DATA 4 KByte and 4 MByte pages" }, { 0x5d, TLB_DATA_4K_4M, 256, " TLB_DATA 4 KByte and 4 MByte pages" }, { 0x61, TLB_INST_4K, 48, " TLB_INST 4 KByte pages, full associative" }, - { 0x63, TLB_DATA_1G, 4, " TLB_DATA 1 GByte pages, 4-way set associative" }, + { 0x63, TLB_DATA_1G_2M_4M, 4, " TLB_DATA 1 GByte pages, 4-way set associative" + " (plus 32 entries TLB_DATA 2 MByte or 4 MByte pages, not encoded here)" }, { 0x6b, TLB_DATA_4K, 256, " TLB_DATA 4 KByte pages, 8-way associative" }, { 0x6c, TLB_DATA_2M_4M, 128, " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" }, { 0x6d, TLB_DATA_1G, 16, " TLB_DATA 1 GByte pages, fully associative" },
@@ -889,6 +901,12 @@ static void intel_tlb_lookup(const unsigif (tlb_lld_4m[ENTRIES ] < intel_tlb_table[k].entries) tlb_lld_4m[ENTRIES ] = intel_tlb_table[k].entries;break ; +case TLB_DATA_1G_2M_4M : +if (tlb_lld_2m[ENTRIES ] < TLB_0x63_2M_4M_ENTRIES) + tlb_lld_2m[ENTRIES ] = TLB_0x63_2M_4M_ENTRIES; +if (tlb_lld_4m[ENTRIES ] < TLB_0x63_2M_4M_ENTRIES) + tlb_lld_4m[ENTRIES ] = TLB_0x63_2M_4M_ENTRIES; + fallthrough;case TLB_DATA_1G :if (tlb_lld_1g[ENTRIES ] < intel_tlb_table[k].entries) tlb_lld_1g[ENTRIES ] = intel_tlb_table[k].entries;
Greg Kroah-Hartman
maintainerPATCH 46/145 mptcp: fix scheduling while atomic in mptcp_pm_nl_append_new_local_addr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krister Johansen <[email protected]>
commit 022bfe24aad8937705704ff2e414b100cf0f2e1a upstream.
If multiple connection requests attempt to create an implicit mptcp endpoint in parallel, more than one caller may end up in mptcp_pm_nl_append_new_local_addr because none found the address in local_addr_list during their call to mptcp_pm_nl_get_local_id. In this case, the concurrent new_local_addr calls may delete the address entry created by the previous caller. These deletes use synchronize_rcu, but this is not permitted in some of the contexts where this function may be called. During packet recv, the caller may be in a rcu read critical section and have preemption disabled.
An example stack:
BUG: scheduling while atomic: swapper/2/0/0x00000302 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) dump_stack (lib/dump_stack.c:124) __schedule_bug (kernel/sched/core.c:5943) schedule_debug.constprop.0 (arch/x86/include/asm/preempt.h:33 kernel/sched/core.c:5970) __schedule (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:207 kernel/sched/features.h:29 kernel/sched/core.c:6621) schedule (arch/x86/include/asm/preempt.h:84 kernel/sched/core.c:6804 kernel/sched/core.c:6818) schedule_timeout (kernel/time/timer.c:2160) wait_for_completion (kernel/sched/completion.c:96 kernel/sched/completion.c:116 kernel/sched/completion.c:127 kernel/sched/completion.c:148) __wait_rcu_gp (include/linux/rcupdate.h:311 kernel/rcu/update.c:444) synchronize_rcu (kernel/rcu/tree.c:3609) mptcp_pm_nl_append_new_local_addr (net/mptcp/pm_netlink.c:966 net/mptcp/pm_netlink.c:1061) mptcp_pm_nl_get_local_id (net/mptcp/pm_netlink.c:1164) mptcp_pm_get_local_id (net/mptcp/pm.c:420) subflow_check_req (net/mptcp/subflow.c:98 net/mptcp/subflow.c:213) subflow_v4_route_req (net/mptcp/subflow.c:305) tcp_conn_request (net/ipv4/tcp_input.c:7216) subflow_v4_conn_request (net/mptcp/subflow.c:651) tcp_rcv_state_process (net/ipv4/tcp_input.c:6709) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1934) tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2334) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205 (discriminator 1)) ip_local_deliver_finish (include/linux/rcupdate.h:813 net/ipv4/ip_input.c:234) ip_local_deliver (include/linux/netfilter.h:314 include/linux/netfilter.h:308 net/ipv4/ip_input.c:254) ip_sublist_rcv_finish (include/net/dst.h:461 net/ipv4/ip_input.c:580) ip_sublist_rcv (net/ipv4/ip_input.c:640) ip_list_rcv (net/ipv4/ip_input.c:675) __netif_receive_skb_list_core (net/core/dev.c:5583 net/core/dev.c:5631) netif_receive_skb_list_internal (net/core/dev.c:5685 net/core/dev.c:5774) napi_complete_done (include/linux/list.h:37 include/net/gro.h:449 include/net/gro.h:444 net/core/dev.c:6114) igb_poll (drivers/net/ethernet/intel/igb/igb_main.c:8244) igb __napi_poll (net/core/dev.c:6582) net_rx_action (net/core/dev.c:6653 net/core/dev.c:6787) handle_softirqs (kernel/softirq.c:553) __irq_exit_rcu (kernel/softirq.c:588 kernel/softirq.c:427 kernel/softirq.c:636) irq_exit_rcu (kernel/softirq.c:651) common_interrupt (arch/x86/kernel/irq.c:247 (discriminator 14)) </IRQ>
This problem seems particularly prevalent if the user advertises an endpoint that has a different external vs internal address. In the case where the external address is advertised and multiple connections already exist, multiple subflow SYNs arrive in parallel which tends to trigger the race during creation of the first local_addr_list entries which have the internal address instead.
Fix by skipping the replacement of an existing implicit local address if called via mptcp_pm_nl_get_local_id.
--- net/mptcp/pm_netlink.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
net/mptcp/pm_netlink.c +15 -3
@@ -969,7 +969,7 @@ static void __mptcp_pm_release_addr_entrstatic int mptcp_pm_nl_append_new_local_addr (struct pm_nl_pernet *pernet,struct mptcp_pm_addr_entry *entry, -bool needs_id) +bool needs_id,bool replace) {struct mptcp_pm_addr_entry *cur, *del_entry =NULL ;unsigned int addr_max;
@@ -1009,6 +1009,17 @@ static int mptcp_pm_nl_append_new_local_if (entry->addr.id) goto out; +/* allow callers that only need to look up the local +* addr's id to skip replacement. This allows them to +* avoid calling synchronize_rcu in the packet recv +* path. +*/ +if (!replace) { +kfree (entry); + ret = cur->addr.id; + goto out; + } + pernet->addrs--; entry->addr.id = cur->addr.id;list_del_rcu (&cur->list);
@@ -1161,7 +1172,7 @@ int mptcp_pm_nl_get_local_id(struct mptc entry->ifindex =0 ; entry->flags =MPTCP_PM_ADDR_FLAG_IMPLICIT ; entry->lsk =NULL ; - ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, true); + ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, true, false);if (ret <0 )kfree (entry);
@@ -1456,7 +1467,8 @@ static int mptcp_nl_cmd_add_addr(struct } } ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, - !mptcp_pm_has_addr_attr_id (attr, info)); + !mptcp_pm_has_addr_attr_id (attr, info), + true);if (ret <0 ) {GENL_SET_ERR_MSG_FMT (info,"too many addresses or duplicate one: %d" , ret); goto out_free;
Greg Kroah-Hartman
maintainerPATCH 47/145 Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit f2176a07e7b19f73e05c805cf3d130a2999154cb upstream.
Add check for the return value of mgmt_alloc_skb() in mgmt_remote_name() to prevent null pointer dereference.
--- net/bluetooth/mgmt.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/mgmt.c +2 -0
@@ -10443,6 +10443,8 @@ void mgmt_remote_name(struct hci_dev *hd skb =mgmt_alloc_skb (hdev,MGMT_EV_DEVICE_FOUND ,sizeof (*ev) + (name ?eir_precalc_len (name_len) :0 )); +if (!skb) +return ; ev =skb_put (skb,sizeof (*ev));bacpy (&ev->addr.bdaddr, bdaddr);
Greg Kroah-Hartman
maintainerPATCH 48/145 Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d8df010f72b8a32aaea393e36121738bb53ed905 upstream.
Add check for the return value of mgmt_alloc_skb() in mgmt_device_connected() to prevent null pointer dereference.
--- net/bluetooth/mgmt.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/mgmt.c +3 -0
@@ -9679,6 +9679,9 @@ void mgmt_device_connected(struct hci_desizeof (*ev) + (name ?eir_precalc_len (name_len) :0 ) + eir_precalc_len(sizeof(conn->dev_class))); +if (!skb) +return ; + ev =skb_put (skb,sizeof (*ev));bacpy (&ev->addr.bdaddr, &conn->dst); ev->addr.type =link_to_bdaddr (conn->type, conn->dst_type);
Greg Kroah-Hartman
maintainerPATCH 49/145 wifi: cfg80211: regulatory: improve invalid hints checking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 59b348be7597c4a9903cb003c69e37df20c04a30 upstream.
Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regulatory_hint_user() call. Such invalid regulatory hints should be rejected.
While a sanity check from commit 47caf685a685 ("cfg80211: regulatory:
reject invalid hints") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons.
1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters.
2) While processing a user regulatory request, between reg_process_hint_user() and regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[].
Syzbot triggers a warning in is_user_regdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check.
Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin letters and nothing else.
[1] Syzbot report:
------------[ cut here ]------------ Unexpected user alpha2: A� WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 Modules linked in: CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_power_efficient crda_timeout_work RIP: 0010:is_user_regdom_saved net/wireless/reg.c:440 [inline] RIP: 0010:restore_alpha2 net/wireless/reg.c:3424 [inline] RIP: 0010:restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 ... Call Trace: <TASK> crda_timeout_work+0x27/0x50 net/wireless/reg.c:542 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
--- net/wireless/reg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/wireless/reg.c +2 -1
@@ -405,7 +405,8 @@ static bool is_an_alpha2(const char *alp {if (!alpha2)return false; -return isalpha (alpha2[0 ]) &&isalpha (alpha2[1 ]); +return isascii (alpha2[0 ]) &&isalpha (alpha2[0 ]) && +isascii (alpha2[1 ]) &&isalpha (alpha2[1 ]); }static bool alpha2_equal (const char *alpha2_x,const char *alpha2_y)
Greg Kroah-Hartman
maintainerPATCH 50/145 wifi: nl80211: reject cooked mode if it is set along with other flags
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
commit 49f27f29446a5bfe633dd2cc0cfebd48a1a5e77f upstream.
It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor interface from the userspace. This causes a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit set because the monitor interface is in the cooked state and it takes precedence over all other states. When the interface is then being deleted the kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing that bit.
Fix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with other flags.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/wireless/nl80211.c | 5 +++++ 1 file changed, 5 insertions(+)
net/wireless/nl80211.c +5 -0
@@ -4102,6 +4102,11 @@ static int parse_monitor_flags(struct nlif (flags[flag]) *mntrflags |= (1 <<flag); +/* cooked monitor mode is incompatible with other modes */ +if (*mntrflags &MONITOR_FLAG_COOK_FRAMES && + *mntrflags !=MONITOR_FLAG_COOK_FRAMES ) +return -EOPNOTSUPP ; + *mntrflags |=MONITOR_FLAG_CHANGED ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 51/145 rapidio: add check for rio_add_net() in rio_scan_alloc_net()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream.
The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net().
--- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/rapidio/rio-scan.c +4 -1
@@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_nedev_set_name (&net->dev,"rnet_%d" , net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; -rio_add_net (net); +if (rio_add_net (net)) { +put_device (&net->dev); + net =NULL ; + } }return net;
Greg Kroah-Hartman
maintainerPATCH 52/145 rapidio: fix an API misues when rio_add_net() fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit b2ef51c74b0171fde7eb69b6152d3d2f743ef269 upstream.
rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "mport->net = NULL;" to avoid a use after free issue.
--- drivers/rapidio/devices/rio_mport_cdev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/rapidio/devices/rio_mport_cdev.c +2 -1
@@ -1740,7 +1740,8 @@ static int rio_mport_add_riodev(struct m err =rio_add_net (net);if (err) {rmcd_debug (RDEV ,"failed to register net, err=%d" , err); -kfree (net); +put_device (&net->dev); + mport->net =NULL ; goto cleanup; } }
Greg Kroah-Hartman
maintainerPATCH 53/145 dma: kmsan: export kmsan_handle_dma() for modules
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
commit 19fac3c93991502a22c5132824c40b6a2e64b136 upstream.
kmsan_handle_dma() is used by virtio_ring() which can be built as a module. kmsan_handle_dma() needs to be exported otherwise building the virtio_ring fails.
Export kmsan_handle_dma for modules.
--- mm/kmsan/hooks.c | 1 + 1 file changed, 1 insertion(+)
mm/kmsan/hooks.c +1 -0
@@ -346,6 +346,7 @@ void kmsan_handle_dma(struct page *page, size -= to_go; } } +EXPORT_SYMBOL_GPL (kmsan_handle_dma);void kmsan_handle_dma_sg (struct scatterlist *sg,int nents,enum dma_data_direction dir)
Greg Kroah-Hartman
maintainerPATCH 54/145 s390/traps: Fix test_monitor_call() inline assembly
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 5623bc23a1cb9f9a9470fa73b3a20321dc4c4870 upstream.
The test_monitor_call() inline assembly uses the xgr instruction, which also modifies the condition code, to clear a register. However the clobber list of the inline assembly does not specify that the condition code is modified, which may lead to incorrect code generation.
Use the lhi instruction instead to clear the register without that the condition code is modified. Furthermore this limits clearing to the lower 32 bits of val, since its type is int.
--- arch/s390/kernel/traps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/s390/kernel/traps.c +3 -3
@@ -276,10 +276,10 @@ static void __init test_monitor_call(voireturn ; asmvolatile (" mc 0,0\n" -"0: xgr %0,%0\n" +"0: lhi %[val],0\n" "1:\n" - EX_TABLE(0b,1b) - : "+d" (val)); + EX_TABLE(0b, 1b) + : [val] "+d" (val)); if (!val)panic ("Monitor call doesn't work!\n" ); }
Greg Kroah-Hartman
maintainerPATCH 55/145 NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit ce6d9c1c2b5cc785016faa11b48b6cd317eb367e upstream.
Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.
Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back to NFS (which triggers writeback to NFSD via NFS loopback mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio):
6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.
{---
[58] "kcompactd0"
[<0>] folio_wait_bit+0xe8/0x200 [<0>] folio_wait_writeback+0x2b/0x80 [<0>] nfs_wb_folio+0x80/0x1b0 [nfs] [<0>] nfs_release_folio+0x68/0x130 [nfs] [<0>] split_huge_page_to_list_to_order+0x362/0x840 [<0>] migrate_pages_batch+0x43d/0xb90 [<0>] migrate_pages_sync+0x9a/0x240 [<0>] migrate_pages+0x93c/0x9f0 [<0>] compact_zone+0x8e2/0x1030 [<0>] compact_node+0xdb/0x120 [<0>] kcompactd+0x121/0x2e0 [<0>] kthread+0xcf/0x100 [<0>] ret_from_fork+0x31/0x40 [<0>] ret_from_fork_asm+0x1a/0x30
---}
--- fs/nfs/file.c | 3 ++- include/linux/compaction.h | 5 +++++ include/linux/sched.h | 2 +- mm/compaction.c | 3 +++ 4 files changed, 11 insertions(+), 2 deletions(-)
fs/nfs/file.c +2 -1
@@ -29,6 +29,7 @@#include <linux/pagemap.h> #include <linux/gfp.h> #include <linux/swap.h> +#include <linux/compaction.h> #include <linux/uaccess.h> #include <linux/filelock.h>
@@ -450,7 +451,7 @@ static bool nfs_release_folio(struct fol/* If the private flag is set, then the folio is not freeable */ if (folio_test_private (folio)) {if ((current_gfp_context (gfp) &GFP_KERNEL ) !=GFP_KERNEL || -current_is_kswapd ()) +current_is_kswapd () ||current_is_kcompactd ())return false;if (nfs_wb_folio (folio_file_mapping (folio)->host, folio) <0 )return false;
include/linux/compaction.h +5 -0
@@ -80,6 +80,11 @@ static inline unsigned long compact_gap(return 2UL << order; } +static inline int current_is_kcompactd (void ) +{ +return current->flags &PF_KCOMPACTD ; +} +#ifdef CONFIG_COMPACTION extern unsigned int extfrag_for_order (struct zone *zone,unsigned int order);
include/linux/sched.h +1 -1
@@ -1746,7 +1746,7 @@ extern struct pid *cad_pid;#define PF_USED_MATH 0x00002000/* If unset the fpu must be initialized before use */ #define PF_USER_WORKER 0x00004000/* Kernel thread cloned from userspace thread */ #define PF_NOFREEZE 0x00008000/* This thread should not be frozen */ -#define PF__HOLE__00010000 0x00010000 +#define PF_KCOMPACTD 0x00010000/* I am kcompactd */ #define PF_KSWAPD 0x00020000/* I am kswapd */ #define PF_MEMALLOC_NOFS 0x00040000/* All allocation requests will inherit GFP_NOFS */ #define PF_MEMALLOC_NOIO 0x00080000/* All allocation requests will inherit GFP_NOIO */
mm/compaction.c +3 -0
@@ -3050,6 +3050,7 @@ static int kcompactd(void *p)if (!cpumask_empty (cpumask))set_cpus_allowed_ptr (tsk, cpumask); + current->flags |=PF_KCOMPACTD ;set_freezable (); pgdat->kcompactd_max_order =0 ;
@@ -3106,6 +3107,8 @@ static int kcompactd(void *p) pgdat->proactive_compact_trigger = false; } + current->flags &= ~PF_KCOMPACTD ; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 56/145 block: fix conversion of GPT partition name to 7-bit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Gayot <[email protected]>
commit e06472bab2a5393430cc2fbc3211cd3602422c1e upstream.
The utf16_le_to_7bit function claims to, naively, convert a UTF-16 string to a 7-bit ASCII string. By naively, we mean that it:
* drops the first byte of every character in the original UTF-16 string
* checks if all characters are printable, and otherwise replaces them by exclamation mark "!".
This means that theoretically, all characters outside the 7-bit ASCII range should be replaced by another character. Examples:
* lower-case alpha (ɒ) 0x0252 becomes 0x52 (R)
* ligature OE (œ) 0x0153 becomes 0x53 (S)
* hangul letter pieup (ㅂ) 0x3142 becomes 0x42 (B)
* upper-case gamma (Ɣ) 0x0194 becomes 0x94 (not printable) so gets replaced by "!"
The result of this conversion for the GPT partition name is passed to user-space as PARTNAME via udev, which is confusing and feels questionable.
However, there is a flaw in the conversion function itself. By dropping one byte of each character and using isprint() to check if the remaining byte corresponds to a printable character, we do not actually guarantee that the resulting character is 7-bit ASCII.
This happens because we pass 8-bit characters to isprint(), which in the kernel returns 1 for many values > 0x7f - as defined in ctype.c.
This results in many values which should be replaced by "!" to be kept as-is, despite not being valid 7-bit ASCII. Examples:
* e with acute accent (é) 0x00E9 becomes 0xE9 - kept as-is because isprint(0xE9) returns 1.
* euro sign (€) 0x20AC becomes 0xAC - kept as-is because isprint(0xAC) returns 1.
This way has broken pyudev utility[1], fixes it by using a mask of 7 bits instead of 8 bits before calling isprint.
--- block/partitions/efi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/partitions/efi.c +1 -1
@@ -682,7 +682,7 @@ static void utf16_le_to_7bit(const __le1 out[size] =0 ;while (i < size) { -u8 c =le16_to_cpu (in[i]) &0xff ; +u8 c =le16_to_cpu (in[i]) &0x7f ;if (c && !isprint (c)) c ='!' ;
Greg Kroah-Hartman
maintainerPATCH 57/145 mm/page_alloc: fix uninitialized variable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Zhang <[email protected]>
commit 8fe9ed44dc29fba0786b7e956d2e87179e407582 upstream.
The variable "compact_result" is not initialized in function __alloc_pages_slowpath(). It causes should_compact_retry() to use an uninitialized value.
Initialize variable "compact_result" with the value COMPACT_SKIPPED.
BUG: KMSAN: uninit-value in __alloc_pages_slowpath+0xee8/0x16c0 mm/page_alloc.c:4416 __alloc_pages_slowpath+0xee8/0x16c0 mm/page_alloc.c:4416 __alloc_frozen_pages_noprof+0xa4c/0xe00 mm/page_alloc.c:4752 alloc_pages_mpol+0x4cd/0x890 mm/mempolicy.c:2270 alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline] alloc_pages_noprof mm/mempolicy.c:2361 [inline] folio_alloc_noprof+0x1dc/0x350 mm/mempolicy.c:2371 filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1019 __filemap_get_folio+0xb9a/0x1840 mm/filemap.c:1970 grow_dev_folio fs/buffer.c:1039 [inline] grow_buffers fs/buffer.c:1105 [inline] __getblk_slow fs/buffer.c:1131 [inline] bdev_getblk+0x2c9/0xab0 fs/buffer.c:1431 getblk_unmovable include/linux/buffer_head.h:369 [inline] ext4_getblk+0x3b7/0xe50 fs/ext4/inode.c:864 ext4_bread_batch+0x9f/0x7d0 fs/ext4/inode.c:933 __ext4_find_entry+0x1ebb/0x36c0 fs/ext4/namei.c:1627 ext4_lookup_entry fs/ext4/namei.c:1729 [inline] ext4_lookup+0x189/0xb40 fs/ext4/namei.c:1797 __lookup_slow+0x538/0x710 fs/namei.c:1793 lookup_slow+0x6a/0xd0 fs/namei.c:1810 walk_component fs/namei.c:2114 [inline] link_path_walk+0xf29/0x1420 fs/namei.c:2479 path_openat+0x30f/0x6250 fs/namei.c:3985 do_filp_open+0x268/0x600 fs/namei.c:4016 do_sys_openat2+0x1bf/0x2f0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x2a1/0x310 fs/open.c:1454 x64_sys_call+0x36f5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:258 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable compact_result created at:
__alloc_pages_slowpath+0x66/0x16c0 mm/page_alloc.c:4218 __alloc_frozen_pages_noprof+0xa4c/0xe00 mm/page_alloc.c:4752
--- mm/page_alloc.c | 1 + 1 file changed, 1 insertion(+)
mm/page_alloc.c +1 -0
@@ -3936,6 +3936,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u restart: compaction_retries =0 ; no_progress_loops =0 ; + compact_result =COMPACT_SKIPPED ; compact_priority =DEF_COMPACT_PRIORITY ; cpuset_mems_cookie =read_mems_allowed_begin (); zonelist_iter_cookie =zonelist_iter_begin ();
Greg Kroah-Hartman
maintainerPATCH 58/145 mm: dont skip arch_sync_kernel_mappings() in error paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
commit 3685024edd270f7c791f993157d65d3c928f3d6e upstream.
Fix callers that previously skipped calling arch_sync_kernel_mappings() if an error occurred during a pgtable update. The call is still required to sync any pgtable updates that may have occurred prior to hitting the error condition.
These are theoretical bugs discovered during code review.
--- mm/memory.c | 6 ++++-- mm/vmalloc.c | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-)
mm/memory.c +4 -2
@@ -2746,8 +2746,10 @@ static int __apply_to_page_range(struct next =pgd_addr_end (addr, end);if (pgd_none (*pgd) && !create)continue ; -if (WARN_ON_ONCE (pgd_leaf (*pgd))) -return -EINVAL ; +if (WARN_ON_ONCE (pgd_leaf (*pgd))) { + err = -EINVAL ; +break ; + }if (!pgd_none (*pgd) &&WARN_ON_ONCE (pgd_bad (*pgd))) {if (!create)continue ;
mm/vmalloc.c +2 -2
@@ -558,13 +558,13 @@ static int vmap_small_pages_range_noflus mask |=PGTBL_PGD_MODIFIED ; err =vmap_pages_p4d_range (pgd, addr, next, prot, pages, &nr, &mask);if (err) -return err; +break ; }while (pgd++, addr = next, addr != end);if (mask &ARCH_PAGE_TABLE_SYNC_MASK )arch_sync_kernel_mappings (start, end); -return 0 ; +return err; }/*
Greg Kroah-Hartman
maintainerPATCH 59/145 wifi: iwlwifi: limit printed string from FW file
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit e0dc2c1bef722cbf16ae557690861e5f91208129 ]
There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's the last TLV in the file, it can perhaps even read beyond the end of the file buffer.
Fix that by limiting the print format to the size of the buffer we have.
--- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/iwl-drv.c +1 -1
@@ -1200,7 +1200,7 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,if (tlv_len !=sizeof (*fseq_ver)) goto invalid_tlv_len; -IWL_INFO (drv,"TLV_FW_FSEQ_VERSION: %s\n" , +IWL_INFO (drv,"TLV_FW_FSEQ_VERSION: %.32s\n" , fseq_ver->version); }break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/145 HID: google: fix unused variable warning under !CONFIG_ACPI
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu-Chun Lin <[email protected]>
[ Upstream commit 4bd0725c09f377ffaf22b834241f6c050742e4fc ]
As reported by the kernel test robot, the following warning occurs:
Quoted 1 line
Quoted 1 line
drivers/hid/hid-google-hammer.c:261:36: warning: 'cbas_ec_acpi_ids' defined but not used [-Wunused-const-variable=]
261 | static const struct acpi_device_id cbas_ec_acpi_ids[] = {
| ^~~~~~~~~~~~~~~~The 'cbas_ec_acpi_ids' array is only used when CONFIG_ACPI is enabled. Wrapping its definition and 'MODULE_DEVICE_TABLE' in '#ifdef CONFIG_ACPI' prevents a compiler warning when ACPI is disabled.
--- drivers/hid/hid-google-hammer.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-google-hammer.c +2 -0
@@ -269,11 +269,13 @@ static int cbas_ec_remove(struct platform_device *pdev)return 0 ; } +#ifdef CONFIG_ACPI static const struct acpi_device_id cbas_ec_acpi_ids[] = { {"GOOG000B" ,0 }, { } };MODULE_DEVICE_TABLE (acpi, cbas_ec_acpi_ids); +#endif #ifdef CONFIG_OF static const struct of_device_id cbas_ec_of_match[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/145 HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 07583a0010696a17fb0942e0b499a62785c5fc9f ]
The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function.
The function currently frees the driver_data directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, hid_destroy_device() uses driver_data when it calls hid_ishtp_set_feature() to power off the sensor, so freeing driver_data beforehand can result in accessing invalid memory.
This patch resolves the issue by storing the driver_data in a temporary variable before calling hid_destroy_device(), and then freeing the driver_data after the device is destroyed.
--- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/intel-ish-hid/ishtp-hid.c +3 -1
@@ -261,12 +261,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev,*/ void ishtp_hid_remove (struct ishtp_cl_data *client_data) { +void *data;int i;for (i =0 ; i < client_data->num_hid_devices; ++i) {if (client_data->hid_sensor_hubs[i]) { -kfree (client_data->hid_sensor_hubs[i]->driver_data); + data = client_data->hid_sensor_hubs[i]->driver_data;hid_destroy_device (client_data->hid_sensor_hubs[i]); +kfree (data); client_data->hid_sensor_hubs[i] =NULL ; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/145 bluetooth: btusb: Initialize .owner field of force_poll_sync_fops
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Salah Triki <[email protected]>
[ Upstream commit cbf85b9cb80bec6345ffe0368dfff98386f4714f ]
Initialize .owner field of force_poll_sync_fops to THIS_MODULE in order to prevent btusb from being unloaded while its operations are in use.
--- drivers/bluetooth/btusb.c | 1 + 1 file changed, 1 insertion(+)
drivers/bluetooth/btusb.c +1 -0
@@ -4230,6 +4230,7 @@ static ssize_t force_poll_sync_write(struct file *file, }static const struct file_operations force_poll_sync_fops = { + .owner =THIS_MODULE , .open = simple_open, .read = force_poll_sync_read, .write = force_poll_sync_write,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/145 nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meir Elisha <[email protected]>
[ Upstream commit a16f88964c647103dad7743a484b216d488a6352 ]
The order in which queue->cmd and rcv_state are updated is crucial. If these assignments are reordered by the compiler, the worker might not get queued in nvmet_tcp_queue_response(), hanging the IO. to enforce the the correct reordering, set rcv_state using smp_store_release().
--- drivers/nvme/target/tcp.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/nvme/target/tcp.c +11 -4
@@ -547,10 +547,16 @@ static void nvmet_tcp_queue_response(struct nvmet_req *req)struct nvmet_tcp_cmd *cmd = container_of(req, struct nvmet_tcp_cmd, req);struct nvmet_tcp_queue *queue = cmd->queue; +enum nvmet_tcp_recv_state queue_state; +struct nvmet_tcp_cmd *queue_cmd;struct nvme_sgl_desc *sgl;u32 len; -if (unlikely (cmd == queue->cmd)) { +/* Pairs with store_release in nvmet_prepare_receive_pdu() */ + queue_state =smp_load_acquire (&queue->rcv_state); + queue_cmd =READ_ONCE (queue->cmd); + +if (unlikely (cmd == queue_cmd)) { sgl = &cmd->req.cmd->common.dptr.sgl; len =le32_to_cpu (sgl->length);
@@ -559,7 +565,7 @@ static void nvmet_tcp_queue_response(struct nvmet_req *req)* Avoid using helpers, this might happen before * nvmet_req_init is completed. */ -if (queue->rcv_state ==NVMET_TCP_RECV_PDU && +if (queue_state ==NVMET_TCP_RECV_PDU && len && len <= cmd->req.port->inline_data_size &&nvme_is_write (cmd->req.cmd))return ;
@@ -823,8 +829,9 @@ static void nvmet_prepare_receive_pdu(struct nvmet_tcp_queue *queue) { queue->offset =0 ; queue->left =sizeof (struct nvme_tcp_hdr ); - queue->cmd =NULL ; - queue->rcv_state =NVMET_TCP_RECV_PDU ; +WRITE_ONCE (queue->cmd,NULL ); +/* Ensure rcv_state is visible only after queue->cmd is set */ +smp_store_release (&queue->rcv_state,NVMET_TCP_RECV_PDU ); }static void nvmet_tcp_free_crypto (struct nvmet_tcp_queue *queue)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/145 net: gso: fix ownership in __udp_gso_segment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoine Tenart <[email protected]>
[ Upstream commit ee01b2f2d7d0010787c2343463965bbc283a497f ]
In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the following bug:
kernel BUG at ./include/linux/skbuff.h:3312! (skb_orphan)
RIP: 0010:ip_rcv_core+0x8b2/0xca0 Call Trace: ip_rcv+0xab/0x6e0 __netif_receive_skb_one_core+0x168/0x1b0 process_backlog+0x384/0x1100 __napi_poll.constprop.0+0xa1/0x370 net_rx_action+0x925/0xe50
The above can happen following a sequence of events when using OpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an OVS_ACTION_ATTR_OUTPUT action:
1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb goes through queue_gso_packets and then __udp_gso_segment, where its destructor is removed.
2. The segments' data are copied and sent to userspace.
3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the same original skb is sent to its path.
4. If it later hits skb_orphan, we hit the bug.
Fix this by also removing the reference to the socket in __udp_gso_segment.
--- net/ipv4/udp_offload.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/ipv4/udp_offload.c +6 -2
@@ -315,13 +315,17 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,/* clear destructor to avoid skb_segment assigning it to tail */ copy_dtor = gso_skb->destructor == sock_wfree; -if (copy_dtor) +if (copy_dtor) { gso_skb->destructor =NULL ; + gso_skb->sk =NULL ; + } segs =skb_segment (gso_skb, features);if (IS_ERR_OR_NULL (segs)) { -if (copy_dtor) +if (copy_dtor) { gso_skb->destructor = sock_wfree; + gso_skb->sk = sk; + }return segs; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/145 caif_virtio: fix wrong pointer check in cfv_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit a466fd7e9fafd975949e5945e2f70c33a94b1a70 ]
del_vqs() frees virtqueues, therefore cfv->vq_tx pointer should be checked for NULL before calling it, not cfv->vdev. Also the current implementation is redundant because the pointer cfv->vdev is dereferenced before it is checked for NULL.
Fix this by checking cfv->vq_tx for NULL instead of cfv->vdev before calling del_vqs().
--- drivers/net/caif/caif_virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/caif/caif_virtio.c +1 -1
@@ -745,7 +745,7 @@ static int cfv_probe(struct virtio_device *vdev)if (cfv->vr_rx) vdev->vringh_config->del_vrhs (cfv->vdev); -if (cfv->vdev) +if (cfv->vq_tx) vdev->config->del_vqs (cfv->vdev);free_netdev (netdev);return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/145 perf/core: Fix pmus_lock vs. pmus_srcu ordering
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ]
Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep.
Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again.
--- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/events/core.c +2 -2
@@ -11660,6 +11660,8 @@ void perf_pmu_unregister(struct pmu *pmu) {mutex_lock (&pmus_lock);list_del_rcu (&pmu->entry); +idr_remove (&pmu_idr, pmu->type); +mutex_unlock (&pmus_lock);/* * We dereference the pmu list under both SRCU and regular RCU, so
@@ -11669,7 +11671,6 @@ void perf_pmu_unregister(struct pmu *pmu)synchronize_rcu ();free_percpu (pmu->pmu_disable_count); -idr_remove (&pmu_idr, pmu->type);if (pmu_bus_running && pmu->dev && pmu->dev !=PMU_NULL_DEV ) {if (pmu->nr_addr_filters)device_remove_file (pmu->dev, &dev_attr_nr_addr_filters);
@@ -11677,7 +11678,6 @@ void perf_pmu_unregister(struct pmu *pmu)put_device (pmu->dev); }free_pmu_context (pmu); -mutex_unlock (&pmus_lock); }EXPORT_SYMBOL_GPL (perf_pmu_unregister);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/145 hwmon: (pmbus) Initialise page count in pmbus_identify()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Titus Rwantare <[email protected]>
[ Upstream commit 6b6e2e8fd0de3fa7c6f4f8fe6841b01770b2e7bc ]
The pmbus_identify() function fails to correctly determine the number of supported pages on PMBus devices. This occurs because info->pages is implicitly zero-initialised, and pmbus_set_page() does not perform writes to the page register if info->pages is not yet initialised. Without this patch, info->pages is always set to the maximum after scanning.
This patch initialises info->pages to PMBUS_PAGES before the probing loop, enabling pmbus_set_page() writes to make it out onto the bus correctly identifying the number of pages. PMBUS_PAGES seemed like a reasonable non-zero number because that's the current result of the identification process.
Testing was done with a PMBus device in QEMU.
--- drivers/hwmon/pmbus/pmbus.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hwmon/pmbus/pmbus.c +2 -0
@@ -103,6 +103,8 @@ static int pmbus_identify(struct i2c_client *client,if (pmbus_check_byte_register (client,0 ,PMBUS_PAGE )) {int page; + info->pages =PMBUS_PAGES ; +for (page =1 ; page <PMBUS_PAGES ; page++) {if (pmbus_set_page (client, page,0xff ) <0 )break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/145 hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maud Spierings <[email protected]>
[ Upstream commit 1c7932d5ae0f5c22fa52ac811b4c427bbca5aff5 ]
I could not find a single table that has the values currently present in the table, change it to the actual values that can be found in [1]/[2] and [3] (page 15 column 2)
[1]: https://www.murata.com/products/productdetail?partno=NCP15XH103F03RC
[2]: https://www.murata.com/products/productdata/8796836626462/NTHCG83.txt?1437969843000
[3]: https://nl.mouser.com/datasheet/2/281/r44e-522712.pdf
--- drivers/hwmon/ntc_thermistor.c | 66 +++++++++++++++++----------------- 1 file changed, 33 insertions(+), 33 deletions(-)
drivers/hwmon/ntc_thermistor.c +33 -33
@@ -181,40 +181,40 @@ static const struct ntc_compensation ncpXXwf104[] = { };static const struct ntc_compensation ncpXXxh103[] = { - { .temp_c =-40 , .ohm =247565 }, - { .temp_c =-35 , .ohm =181742 }, - { .temp_c =-30 , .ohm =135128 }, - { .temp_c =-25 , .ohm =101678 }, - { .temp_c =-20 , .ohm =77373 }, - { .temp_c =-15 , .ohm =59504 }, - { .temp_c =-10 , .ohm =46222 }, - { .temp_c =-5 , .ohm =36244 }, - { .temp_c =0 , .ohm =28674 }, - { .temp_c =5 , .ohm =22878 }, - { .temp_c =10 , .ohm =18399 }, - { .temp_c =15 , .ohm =14910 }, - { .temp_c =20 , .ohm =12169 }, + { .temp_c =-40 , .ohm =195652 }, + { .temp_c =-35 , .ohm =148171 }, + { .temp_c =-30 , .ohm =113347 }, + { .temp_c =-25 , .ohm =87559 }, + { .temp_c =-20 , .ohm =68237 }, + { .temp_c =-15 , .ohm =53650 }, + { .temp_c =-10 , .ohm =42506 }, + { .temp_c =-5 , .ohm =33892 }, + { .temp_c =0 , .ohm =27219 }, + { .temp_c =5 , .ohm =22021 }, + { .temp_c =10 , .ohm =17926 }, + { .temp_c =15 , .ohm =14674 }, + { .temp_c =20 , .ohm =12081 }, { .temp_c =25 , .ohm =10000 }, - { .temp_c =30 , .ohm =8271 }, - { .temp_c =35 , .ohm =6883 }, - { .temp_c =40 , .ohm =5762 }, - { .temp_c =45 , .ohm =4851 }, - { .temp_c =50 , .ohm =4105 }, - { .temp_c =55 , .ohm =3492 }, - { .temp_c =60 , .ohm =2985 }, - { .temp_c =65 , .ohm =2563 }, - { .temp_c =70 , .ohm =2211 }, - { .temp_c =75 , .ohm =1915 }, - { .temp_c =80 , .ohm =1666 }, - { .temp_c =85 , .ohm =1454 }, - { .temp_c =90 , .ohm =1275 }, - { .temp_c =95 , .ohm =1121 }, - { .temp_c =100 , .ohm =990 }, - { .temp_c =105 , .ohm =876 }, - { .temp_c =110 , .ohm =779 }, - { .temp_c =115 , .ohm =694 }, - { .temp_c =120 , .ohm =620 }, - { .temp_c =125 , .ohm =556 }, + { .temp_c =30 , .ohm =8315 }, + { .temp_c =35 , .ohm =6948 }, + { .temp_c =40 , .ohm =5834 }, + { .temp_c =45 , .ohm =4917 }, + { .temp_c =50 , .ohm =4161 }, + { .temp_c =55 , .ohm =3535 }, + { .temp_c =60 , .ohm =3014 }, + { .temp_c =65 , .ohm =2586 }, + { .temp_c =70 , .ohm =2228 }, + { .temp_c =75 , .ohm =1925 }, + { .temp_c =80 , .ohm =1669 }, + { .temp_c =85 , .ohm =1452 }, + { .temp_c =90 , .ohm =1268 }, + { .temp_c =95 , .ohm =1110 }, + { .temp_c =100 , .ohm =974 }, + { .temp_c =105 , .ohm =858 }, + { .temp_c =110 , .ohm =758 }, + { .temp_c =115 , .ohm =672 }, + { .temp_c =120 , .ohm =596 }, + { .temp_c =125 , .ohm =531 }, };/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/145 hwmon: (ad7314) Validate leading zero bits and return error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erik Schumacher <[email protected]>
[ Upstream commit e278d5e8aef4c0a1d9a9fa8b8910d713a89aa800 ]
Leading zero bits are sent on the bus before the temperature value is transmitted. If any of these bits are high, the connection might be unstable or there could be no AD7314 / ADT730x (or compatible) at all. Return -EIO in that case.
--- drivers/hwmon/ad7314.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/hwmon/ad7314.c +10 -0
@@ -22,11 +22,13 @@*/ #define AD7314_TEMP_MASK 0x7FE0#define AD7314_TEMP_SHIFT 5 +#define AD7314_LEADING_ZEROS_MASK BIT(15)/* * ADT7301 and ADT7302 temperature masks */ #define ADT7301_TEMP_MASK 0x3FFF +#define ADT7301_LEADING_ZEROS_MASK (BIT(15) | BIT(14))enum ad7314_variant { adt7301,
@@ -65,12 +67,20 @@ static ssize_t ad7314_temperature_show(struct device *dev,return ret;switch (spi_get_device_id (chip->spi_dev)->driver_data) {case ad7314: +if (ret &AD7314_LEADING_ZEROS_MASK ) { +/* Invalid read-out, leading zero part is missing */ +return -EIO ; + } data = (ret &AD7314_TEMP_MASK ) >>AD7314_TEMP_SHIFT ; data =sign_extend32 (data,9 );return sprintf (buf,"%d\n" ,250 * data);case adt7301:case adt7302: +if (ret &ADT7301_LEADING_ZEROS_MASK ) { +/* Invalid read-out, leading zero part is missing */ +return -EIO ; + }/* * Documented as a 13 bit twos complement register * with a sign bit - which is a 14 bit 2's complement
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/145 tracing: probe-events: Remove unused MAX_ARG_BUF_LEN macro
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit fd5ba38390c59e1c147480ae49b6133c4ac24001 ]
Commit 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args") introduced MAX_ARG_BUF_LEN but it is not used. Remove it.
--- kernel/trace/trace_probe.h | 1 - 1 file changed, 1 deletion(-)
kernel/trace/trace_probe.h +0 -1
@@ -35,7 +35,6 @@#define MAX_ARG_NAME_LEN 32#define MAX_BTF_ARGS_LEN 128#define MAX_STRING_SIZE PATH_MAX -#define MAX_ARG_BUF_LEN (MAX_TRACE_ARGS * MAX_ARG_NAME_LEN)/* Reserved field names */ #define FIELD_STRING_IP "__probe_ip"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/145 ALSA: usx2y: validate nrpacks module parameter on probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
[ Upstream commit 172a0f509723fe4741d4b8e9190cf434b18320d8 ]
The module parameter defines number of iso packets per one URB. User is allowed to set any value to the parameter of type int, which can lead to various kinds of weird and incorrect behavior like integer overflows, truncations, etc. Number of packets should be a small non-negative number.
Since this parameter is read-only, its value can be validated on driver probe.
--- sound/usb/usx2y/usbusx2y.c | 11 +++++++++++ sound/usb/usx2y/usbusx2y.h | 26 ++++++++++++++++++++++++++ sound/usb/usx2y/usbusx2yaudio.c | 27 --------------------------- 3 files changed, 37 insertions(+), 27 deletions(-)
sound/usb/usx2y/usbusx2y.c +11 -0
@@ -151,6 +151,12 @@ static int snd_usx2y_card_used[SNDRV_CARDS];static void snd_usx2y_card_private_free (struct snd_card *card);static void usx2y_unlinkseq (struct snd_usx2y_async_seq *s); +#ifdef USX2Y_NRPACKS_VARIABLE +int nrpacks =USX2Y_NRPACKS ;/* number of packets per urb */ +module_param (nrpacks, int,0444 ); +MODULE_PARM_DESC (nrpacks,"Number of packets per URB." ); +#endif +/* * pipe 4 is used for switching the lamps, setting samplerate, volumes .... */
@@ -433,6 +439,11 @@ static int snd_usx2y_probe(struct usb_interface *intf,struct snd_card *card;int err; +#ifdef USX2Y_NRPACKS_VARIABLE +if (nrpacks <0 || nrpacks >USX2Y_NRPACKS_MAX ) +return -EINVAL ; +#endif + if (le16_to_cpu(device->descriptor.idVendor) != 0x1604 || (le16_to_cpu(device->descriptor.idProduct) != USB_ID_US122 && le16_to_cpu(device->descriptor.idProduct) != USB_ID_US224 &&
sound/usb/usx2y/usbusx2y.h +26 -0
@@ -7,6 +7,32 @@#define NRURBS 2 +/* Default value used for nr of packs per urb. +* 1 to 4 have been tested ok on uhci. +* To use 3 on ohci, you'd need a patch: +* look for "0000425-linux-2.6.9-rc4-mm1_ohci-hcd.patch.gz" on +* "https://bugtrack.alsa-project.org/alsa-bug/bug_view_page.php?bug_id=0000425" +* +* 1, 2 and 4 work out of the box on ohci, if I recall correctly. +* Bigger is safer operation, smaller gives lower latencies. +*/ +#define USX2Y_NRPACKS 4 + +#define USX2Y_NRPACKS_MAX 1024 + +/* If your system works ok with this module's parameter +* nrpacks set to 1, you might as well comment +* this define out, and thereby produce smaller, faster code. +* You'd also set USX2Y_NRPACKS to 1 then. +*/ +#define USX2Y_NRPACKS_VARIABLE 1 + +#ifdef USX2Y_NRPACKS_VARIABLE +extern int nrpacks; +#define nr_of_packs () nrpacks +#else +#define nr_of_packs () USX2Y_NRPACKS +#endif #define URBS_ASYNC_SEQ 10#define URB_DATA_LEN_ASYNC_SEQ 32
sound/usb/usx2y/usbusx2yaudio.c +0 -27
@@ -28,33 +28,6 @@#include "usx2y.h" #include "usbusx2y.h" -/* Default value used for nr of packs per urb. -* 1 to 4 have been tested ok on uhci. -* To use 3 on ohci, you'd need a patch: -* look for "0000425-linux-2.6.9-rc4-mm1_ohci-hcd.patch.gz" on -* "https://bugtrack.alsa-project.org/alsa-bug/bug_view_page.php?bug_id=0000425" -* -* 1, 2 and 4 work out of the box on ohci, if I recall correctly. -* Bigger is safer operation, smaller gives lower latencies. -*/ -#define USX2Y_NRPACKS 4 - -/* If your system works ok with this module's parameter -* nrpacks set to 1, you might as well comment -* this define out, and thereby produce smaller, faster code. -* You'd also set USX2Y_NRPACKS to 1 then. -*/ -#define USX2Y_NRPACKS_VARIABLE 1 - -#ifdef USX2Y_NRPACKS_VARIABLE -static int nrpacks =USX2Y_NRPACKS ;/* number of packets per urb */ -#define nr_of_packs () nrpacks -module_param (nrpacks, int,0444 ); -MODULE_PARM_DESC (nrpacks,"Number of packets per URB." ); -#else -#define nr_of_packs () USX2Y_NRPACKS -#endif -static int usx2y_urb_capt_retire (struct snd_usx2y_substream *subs) {struct urb *urb = subs->completed_urb;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/145 llc: do not use skb_get() before dev_queue_xmit()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 64e6a754d33d31aa844b3ee66fb93ac84ca1565e ]
syzbot is able to crash hosts [1], using llc and devices not supporting IFF_TX_SKB_SHARING.
In this case, e1000 driver calls eth_skb_pad(), while the skb is shared.
Simply replace skb_get() by skb_clone() in net/llc/llc_s_ac.c
Note that e1000 driver might have an issue with pktgen, because it does not clear IFF_TX_SKB_SHARING, this is an orthogonal change.
We need to audit other skb_get() uses in net/llc.
[1]
kernel BUG at net/core/skbuff.c:2178 !
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 16371 Comm: syz.2.2764 Not tainted 6.14.0-rc4-syzkaller-00052-gac9c34d1e45a #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:pskb_expand_head+0x6ce/0x1240 net/core/skbuff.c:2178 Call Trace: <TASK> __skb_pad+0x18a/0x610 net/core/skbuff.c:2466 __skb_put_padto include/linux/skbuff.h:3843 [inline] skb_put_padto include/linux/skbuff.h:3862 [inline] eth_skb_pad include/linux/etherdevice.h:656 [inline] e1000_xmit_frame+0x2d99/0x5800 drivers/net/ethernet/intel/e1000/e1000_main.c:3128 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3806 [inline] dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3822 sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:4045 [inline] __dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4621 dev_queue_xmit include/linux/netdevice.h:3313 [inline] llc_sap_action_send_test_c+0x268/0x320 net/llc/llc_s_ac.c:144 llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline] llc_sap_next_state net/llc/llc_sap.c:182 [inline] llc_sap_state_process+0x239/0x510 net/llc/llc_sap.c:209 llc_ui_sendmsg+0xd0d/0x14e0 net/llc/af_llc.c:993 sock_sendmsg_nosec net/socket.c:718 [inline]
--- net/llc/llc_s_ac.c | 49 +++++++++++++++++++++++++--------------------- 1 file changed, 27 insertions(+), 22 deletions(-)
net/llc/llc_s_ac.c +27 -22
@@ -24,7 +24,7 @@#include <net/llc_s_ac.h> #include <net/llc_s_ev.h> #include <net/llc_sap.h> - +#include <net/sock.h> /** * llc_sap_action_unitdata_ind - forward UI PDU to network layer
@@ -40,6 +40,26 @@ int llc_sap_action_unitdata_ind(struct llc_sap *sap, struct sk_buff *skb)return 0 ; } +static int llc_prepare_and_xmit (struct sk_buff *skb) +{ +struct llc_sap_state_ev *ev =llc_sap_ev (skb); +struct sk_buff *nskb; +int rc; + + rc =llc_mac_hdr_init (skb, ev->saddr.mac, ev->daddr.mac); +if (rc) +return rc; + + nskb =skb_clone (skb,GFP_ATOMIC ); +if (!nskb) +return -ENOMEM ; + +if (skb->sk) +skb_set_owner_w (nskb, skb->sk); + +return dev_queue_xmit (nskb); +} +/** * llc_sap_action_send_ui - sends UI PDU resp to UNITDATA REQ to MAC layer * @sap: SAP
@@ -52,17 +72,12 @@ int llc_sap_action_unitdata_ind(struct llc_sap *sap, struct sk_buff *skb)int llc_sap_action_send_ui (struct llc_sap *sap,struct sk_buff *skb) {struct llc_sap_state_ev *ev =llc_sap_ev (skb); -int rc;llc_pdu_header_init (skb,LLC_PDU_TYPE_U , ev->saddr.lsap, ev->daddr.lsap,LLC_PDU_CMD );llc_pdu_init_as_ui_cmd (skb); - rc =llc_mac_hdr_init (skb, ev->saddr.mac, ev->daddr.mac); -if (likely (!rc)) { -skb_get (skb); - rc =dev_queue_xmit (skb); - } -return rc; + +return llc_prepare_and_xmit (skb); }/**
@@ -77,17 +92,12 @@ int llc_sap_action_send_ui(struct llc_sap *sap, struct sk_buff *skb)int llc_sap_action_send_xid_c (struct llc_sap *sap,struct sk_buff *skb) {struct llc_sap_state_ev *ev =llc_sap_ev (skb); -int rc;llc_pdu_header_init (skb,LLC_PDU_TYPE_U_XID , ev->saddr.lsap, ev->daddr.lsap,LLC_PDU_CMD );llc_pdu_init_as_xid_cmd (skb,LLC_XID_NULL_CLASS_2 ,0 ); - rc =llc_mac_hdr_init (skb, ev->saddr.mac, ev->daddr.mac); -if (likely (!rc)) { -skb_get (skb); - rc =dev_queue_xmit (skb); - } -return rc; + +return llc_prepare_and_xmit (skb); }/**
@@ -133,17 +143,12 @@ int llc_sap_action_send_xid_r(struct llc_sap *sap, struct sk_buff *skb)int llc_sap_action_send_test_c (struct llc_sap *sap,struct sk_buff *skb) {struct llc_sap_state_ev *ev =llc_sap_ev (skb); -int rc;llc_pdu_header_init (skb,LLC_PDU_TYPE_U , ev->saddr.lsap, ev->daddr.lsap,LLC_PDU_CMD );llc_pdu_init_as_test_cmd (skb); - rc =llc_mac_hdr_init (skb, ev->saddr.mac, ev->daddr.mac); -if (likely (!rc)) { -skb_get (skb); - rc =dev_queue_xmit (skb); - } -return rc; + +return llc_prepare_and_xmit (skb); }int llc_sap_action_send_test_r (struct llc_sap *sap,struct sk_buff *skb)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/145 hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xinghuo Chen <[email protected]>
[ Upstream commit 10fce7ebe888fa8c97eee7e317a47e7603e5e78d ]
The devm_memremap() function returns error pointers on error, it doesn't return NULL.
--- drivers/hwmon/xgene-hwmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/xgene-hwmon.c +1 -1
@@ -712,7 +712,7 @@ static int xgene_hwmon_probe(struct platform_device *pdev) goto out; } -if (!ctx->pcc_comm_addr) { +if (IS_ERR_OR_NULL (ctx->pcc_comm_addr)) {dev_err (&pdev->dev,"Failed to ioremap PCC comm region\n" ); rc = -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/145 drm/sched: Fix preprocessor guard
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit 23e0832d6d7be2d3c713f9390c060b6f1c48bf36 ]
When writing the header guard for gpu_scheduler_trace.h, a typo, apparently, occurred.
Fix the typo and document the scope of the guard.
--- drivers/gpu/drm/scheduler/gpu_scheduler_trace.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/scheduler/gpu_scheduler_trace.h +2 -2
@@ -21,7 +21,7 @@* */ -#if !defined(_GPU_SCHED_TRACE_H) || defined(TRACE_HEADER_MULTI_READ ) +#if !defined(_GPU_SCHED_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ )#define _GPU_SCHED_TRACE_H_#include <linux/stringify.h>
@@ -106,7 +106,7 @@ TRACE_EVENT(drm_sched_job_wait_dep, __entry->seqno) ); -#endif +#endif /* _GPU_SCHED_TRACE_H_ */ /* This part must be outside protection */ #undef TRACE_INCLUDE_PATH
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/145 be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 1a82d19ca2d6835904ee71e2d40fd331098f94a0 ]
Partially revert commit b71724147e73 ("be2net: replace polling with sleeping in the FW completion path") w.r.t mcc mutex it introduces and the use of usleep_range. The be2net be_ndo_bridge_getlink() callback is called with rcu_read_lock, so this code has been broken for a long time. Both the mutex_lock and the usleep_range can cause the issue Ian Kumlien reported[1]. The call path is:be_ndo_bridge_getlink -> be_cmd_get_hsw_config -> be_mcc_notify_wait -> be_mcc_wait_compl -> usleep_range()
[1] https://lore.kernel.org/netdev/CAA85sZveppNgEVa_FD+qhOMtG_AavK9_mFiU+jWrMtXmwqefGA@mail.gmail.com/
--- drivers/net/ethernet/emulex/benet/be.h | 2 +- drivers/net/ethernet/emulex/benet/be_cmds.c | 197 ++++++++++---------- drivers/net/ethernet/emulex/benet/be_main.c | 2 +- 3 files changed, 100 insertions(+), 101 deletions(-)
drivers/net/ethernet/emulex/benet/be.h +1 -1
@@ -562,7 +562,7 @@ struct be_adapter {struct be_dma_mem mbox_mem_alloced;struct be_mcc_obj mcc_obj; -struct mutex mcc_lock;/* For serializing mcc cmds to BE card */ +spinlock_t mcc_lock;/* For serializing mcc cmds to BE card */ spinlock_t mcc_cq_lock;u16 cfg_num_rx_irqs;/* configured via set-channels */
drivers/net/ethernet/emulex/benet/be_cmds.c +98 -99
787 lines not on this page · raw message
drivers/net/ethernet/emulex/benet/be_main.c +1 -1
@@ -5670,8 +5670,8 @@ static int be_drv_init(struct be_adapter *adapter) }mutex_init (&adapter->mbox_lock); -mutex_init (&adapter->mcc_lock);mutex_init (&adapter->rx_filter_lock); +spin_lock_init (&adapter->mcc_lock);spin_lock_init (&adapter->mcc_cq_lock);init_completion (&adapter->et_cmd_compl);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/145 net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peiyang Wang <[email protected]>
[ Upstream commit b7365eab39831487a84e63a9638209b68dc54008 ]
During the initialization of ptp, hclge_ptp_get_cycle might return an error and returned directly without unregister clock and free it. To avoid that, call hclge_ptp_destroy_clock to unregist and free clock if hclge_ptp_get_cycle failed.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c +1 -1
@@ -484,7 +484,7 @@ int hclge_ptp_init(struct hclge_dev *hdev) ret =hclge_ptp_get_cycle (hdev);if (ret) -return ret; + goto out; } ret =hclge_ptp_int_en (hdev, true);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/145 HID: hid-steam: Fix use-after-free when detaching device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vicki Pfau <[email protected]>
[ Upstream commit e53fc232a65f7488ab75d03a5b95f06aaada7262 ]
When a hid-steam device is removed it must clean up the client_hdev used for intercepting hidraw access. This can lead to scheduling deferred work to reattach the input device. Though the cleanup cancels the deferred work, this was done before the client_hdev itself is cleaned up, so it gets rescheduled. This patch fixes the ordering to make sure the deferred work is properly canceled.
--- drivers/hid/hid-steam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-steam.c +1 -1
@@ -1325,11 +1325,11 @@ static void steam_remove(struct hid_device *hdev)return ; } +hid_destroy_device (steam->client_hdev);cancel_delayed_work_sync (&steam->mode_switch);cancel_work_sync (&steam->work_connect);cancel_work_sync (&steam->rumble_work);cancel_work_sync (&steam->unregister_work); -hid_destroy_device (steam->client_hdev); steam->client_hdev =NULL ; steam->client_opened = false;if (steam->quirks &STEAM_QUIRK_WIRELESS ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/145 net: ipa: Fix v4.7 resource group names
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit 5eb3dc1396aa7e315486b24df80df782912334b7 ]
In the downstream IPA driver there's only one group defined for source and destination, and the destination group doesn't have a _DPL suffix.
--- drivers/net/ipa/data/ipa_data-v4.7.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/net/ipa/data/ipa_data-v4.7.c +5 -7
@@ -27,12 +27,10 @@ enum ipa_resource_type {enum ipa_rsrc_group_id {/* Source resource group identifiers */ IPA_RSRC_GROUP_SRC_UL_DL =0 , -IPA_RSRC_GROUP_SRC_UC_RX_Q ,IPA_RSRC_GROUP_SRC_COUNT ,/* Last in set; not a source group */ /* Destination resource group identifiers */ -IPA_RSRC_GROUP_DST_UL_DL_DPL =0 , -IPA_RSRC_GROUP_DST_UNUSED_1 , +IPA_RSRC_GROUP_DST_UL_DL =0 ,IPA_RSRC_GROUP_DST_COUNT ,/* Last; not a destination group */ };
@@ -80,7 +78,7 @@ static const struct ipa_gsi_endpoint_data ipa_gsi_endpoint_data[] = { }, .endpoint = { .config = { - .resource_group = IPA_RSRC_GROUP_DST_UL_DL_DPL, + .resource_group = IPA_RSRC_GROUP_DST_UL_DL, .aggregation = true, .status_enable = true, .rx = {
@@ -127,7 +125,7 @@ static const struct ipa_gsi_endpoint_data ipa_gsi_endpoint_data[] = { }, .endpoint = { .config = { - .resource_group = IPA_RSRC_GROUP_DST_UL_DL_DPL, + .resource_group = IPA_RSRC_GROUP_DST_UL_DL, .qmap = true, .aggregation = true, .rx = {
@@ -196,12 +194,12 @@ static const struct ipa_resource ipa_resource_src[] = {/* Destination resource configuration data for an SoC having IPA v4.7 */ static const struct ipa_resource ipa_resource_dst[] = { [IPA_RESOURCE_TYPE_DST_DATA_SECTORS ] = { - .limits[IPA_RSRC_GROUP_DST_UL_DL_DPL ] = { + .limits[IPA_RSRC_GROUP_DST_UL_DL ] = { .min =7 , .max =7 , }, }, [IPA_RESOURCE_TYPE_DST_DPS_DMARS ] = { - .limits[IPA_RSRC_GROUP_DST_UL_DL_DPL ] = { + .limits[IPA_RSRC_GROUP_DST_UL_DL ] = { .min =2 , .max =2 , }, },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/145 net: ipa: Fix QSB data for v4.7
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit 6a2843aaf551d87beb92d774f7d5b8ae007fe774 ]
As per downstream reference, max_writes should be 12 and max_reads should be 13.
--- drivers/net/ipa/data/ipa_data-v4.7.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ipa/data/ipa_data-v4.7.c +2 -2
@@ -37,8 +37,8 @@ enum ipa_rsrc_group_id {/* QSB configuration data for an SoC having IPA v4.7 */ static const struct ipa_qsb_data ipa_qsb_data[] = { [IPA_QSB_MASTER_DDR ] = { - .max_writes =8 , - .max_reads =0 ,/* no limit (hardware max) */ + .max_writes =12 , + .max_reads =13 , .max_reads_beats =120 , }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/145 net: ipa: Enable checksum for IPA_ENDPOINT_AP_MODEM_{RX,TX} for v4.7
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit 934e69669e32eb653234898424ae007bae2f636e ]
Enable the checksum option for these two endpoints in order to allow mobile data to actually work. Without this, no packets seem to make it through the IPA.
--- drivers/net/ipa/data/ipa_data-v4.7.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ipa/data/ipa_data-v4.7.c +2 -0
@@ -103,6 +103,7 @@ static const struct ipa_gsi_endpoint_data ipa_gsi_endpoint_data[] = { .filter_support = true, .config = { .resource_group = IPA_RSRC_GROUP_SRC_UL_DL, + .checksum = true, .qmap = true, .status_enable = true, .tx = {
@@ -126,6 +127,7 @@ static const struct ipa_gsi_endpoint_data ipa_gsi_endpoint_data[] = { .endpoint = { .config = { .resource_group = IPA_RSRC_GROUP_DST_UL_DL, + .checksum = true, .qmap = true, .aggregation = true, .rx = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/145 ppp: Fix KMSAN uninit-value warning with bpf
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 4c2d14c40a68678d885eab4008a0129646805bae ]
Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the ppp driver not initializing a 2-byte header when using socket filter.
The following code can generate a PPP filter BPF program:
'''
struct bpf_program fp;pcap_t *handle;
handle = pcap_open_dead(DLT_PPP_PPPD, 65535); pcap_compile(handle, &fp, "ip and outbound", 0, 0); bpf_dump(&fp, 1);
'''
Its output is:
'''
(000) ldh [2]
(001) jeq #0x21 jt 2 jf 5
(002) ldb [0]
(003) jeq #0x1 jt 4 jf 5
(004) ret #65535
(005) ret #0
'''
Wen can find similar code at the following link:
https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680
The maintainer of this code repository is also the original maintainer of the ppp driver.
As you can see the BPF program skips 2 bytes of data and then reads the 'Protocol' field to determine if it's an IP packet. Then it read the first byte of the first 2 bytes to determine the direction.
The issue is that only the first byte indicating direction is initialized in current ppp driver code while the second byte is not initialized.
For normal BPF programs generated by libpcap, uninitialized data won't be used, so it's not a problem. However, for carefully crafted BPF programs, such as those generated by syzkaller [2], which start reading from offset 0, the uninitialized data will be used and caught by KMSAN.
[1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791
[2] https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000
--- drivers/net/ppp/ppp_generic.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-)
drivers/net/ppp/ppp_generic.c +19 -9
@@ -72,6 +72,17 @@#define PPP_PROTO_LEN 2#define PPP_LCP_HDRLEN 4 +/* The filter instructions generated by libpcap are constructed +* assuming a four-byte PPP header on each packet, where the last +* 2 bytes are the protocol field defined in the RFC and the first +* byte of the first 2 bytes indicates the direction. +* The second byte is currently unused, but we still need to initialize +* it to prevent crafted BPF programs from reading them which would +* cause reading of uninitialized data. +*/ +#define PPP_FILTER_OUTBOUND_TAG 0x0100 +#define PPP_FILTER_INBOUND_TAG 0x0000 +/* * An instance of /dev/ppp can be associated with either a ppp * interface unit or a ppp channel. In both cases, file->private_data
@@ -1762,10 +1773,10 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)if (proto <0x8000 ) {#ifdef CONFIG_PPP_FILTER -/* check if we should pass this packet */ -/* the filter instructions are constructed assuming -a four-byte PPP header on each packet */ - *(u8 *)skb_push (skb,2 ) =1 ; +/* check if the packet passes the pass and active filters. +* See comment for PPP_FILTER_OUTBOUND_TAG above. +*/ + *(__be16 *)skb_push (skb,2 ) =htons (PPP_FILTER_OUTBOUND_TAG );if (ppp->pass_filter &&bpf_prog_run (ppp->pass_filter, skb) ==0 ) {if (ppp->debug &1 )
@@ -2482,14 +2493,13 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)/* network protocol frame - give it to the kernel */ #ifdef CONFIG_PPP_FILTER -/* check if the packet passes the pass and active filters */ -/* the filter instructions are constructed assuming -a four-byte PPP header on each packet */ if (ppp->pass_filter || ppp->active_filter) {if (skb_unclone (skb,GFP_ATOMIC )) goto err; - - *(u8 *)skb_push (skb,2 ) =0 ; +/* Check if the packet passes the pass and active filters. +* See comment for PPP_FILTER_INBOUND_TAG above. +*/ + *(__be16 *)skb_push (skb,2 ) =htons (PPP_FILTER_INBOUND_TAG );if (ppp->pass_filter &&bpf_prog_run (ppp->pass_filter, skb) ==0 ) {if (ppp->debug &1 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/145 vlan: enforce underlying device type
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oscar Maes <[email protected]>
[ Upstream commit b33a534610067ade2bdaf2052900aaad99701353 ]
Currently, VLAN devices can be created on top of non-ethernet devices.
Besides the fact that it doesn't make much sense, this also causes a bug which leaks the address of a kernel function to usermode.
When creating a VLAN device, we initialize GARP (garp_init_applicant) and MRP (mrp_init_applicant) for the underlying device.
As part of the initialization process, we add the multicast address of each applicant to the underlying device, by calling dev_mc_add.
__dev_mc_add uses dev->addr_len to determine the length of the new multicast address.
This causes an out-of-bounds read if dev->addr_len is greater than 6, since the multicast addresses provided by GARP and MRP are only 6 bytes long.
This behaviour can be reproduced using the following commands:
ip tunnel add gretest mode ip6gre local ::1 remote ::2 dev lo ip l set up dev gretest
ip link add link gretest name vlantest type vlan id 100
Then, the following command will display the address of garp_pdu_rcv:
ip maddr show | grep 01:80:c2:00:00:21
Fix the bug by enforcing the type of the underlying device during VLAN device initialization.
--- net/8021q/vlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/8021q/vlan.c +2 -1
@@ -131,7 +131,8 @@ int vlan_check_real_dev(struct net_device *real_dev, {const char *name = real_dev->name; -if (real_dev->features &NETIF_F_VLAN_CHALLENGED ) { +if (real_dev->features &NETIF_F_VLAN_CHALLENGED || + real_dev->type !=ARPHRD_ETHER ) {pr_info ("VLANs not supported on %s\n" , name);NL_SET_ERR_MSG_MOD (extack,"VLANs not supported on device" );return -EOPNOTSUPP ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/145 x86/sgx: Fix size overflows in sgx_encl_create()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <[email protected]>
[ Upstream commit 0d3e0dfd68fb9e6b0ec865be9f3377cc3ff55733 ]
The total size calculated for EPC can overflow u64 given the added up page for SECS. Further, the total size calculated for shmem can overflow even when the EPC size stays within limits of u64, given that it adds the extra space for 128 byte PCMD structures (one for each page).
Address this by pre-evaluating the micro-architectural requirement of
SGX: the address space size must be power of two. This is eventually checked up by ECREATE but the pre-check has the additional benefit of making sure that there is some space for additional data.
--- arch/x86/kernel/cpu/sgx/ioctl.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/x86/kernel/cpu/sgx/ioctl.c +7 -0
@@ -64,6 +64,13 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)struct file *backing;long ret; +/* +* ECREATE would detect this too, but checking here also ensures +* that the 'encl_size' calculations below can never overflow. +*/ +if (!is_power_of_2 (secs->size)) +return -EINVAL ; + va_page =sgx_encl_grow (encl, true);if (IS_ERR (va_page))return PTR_ERR (va_page);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/145 exfat: fix soft lockup in exfat_clear_bitmap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 9da33619e0ca53627641bc97d1b93ec741299111 ]
bitmap clear loop will take long time in __exfat_free_cluster() if data size of file/dir enty is invalid.
If cluster bit in bitmap is already clear, stop clearing bitmap go to out of loop.
--- fs/exfat/balloc.c | 10 ++++++++-- fs/exfat/exfat_fs.h | 2 +- fs/exfat/fatent.c | 11 +++++++---- 3 files changed, 16 insertions(+), 7 deletions(-)
fs/exfat/balloc.c +8 -2
@@ -160,7 +160,7 @@ int exfat_set_bitmap(struct inode *inode, unsigned int clu, bool sync)return 0 ; } -void exfat_clear_bitmap (struct inode *inode,unsigned int clu,bool sync) +int exfat_clear_bitmap (struct inode *inode,unsigned int clu,bool sync) {int i, b;unsigned int ent_idx;
@@ -169,13 +169,17 @@ void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync)struct exfat_mount_options *opts = &sbi->options;if (!is_valid_cluster (sbi, clu)) -return ; +return -EIO ; ent_idx =CLUSTER_TO_BITMAP_ENT (clu); i =BITMAP_OFFSET_SECTOR_INDEX (sb, ent_idx); b =BITMAP_OFFSET_BIT_IN_SECTOR (sb, ent_idx); +if (!test_bit_le (b, sbi->vol_amap[i]->b_data)) +return -EIO ; +clear_bit_le (b, sbi->vol_amap[i]->b_data); +exfat_update_bh (sbi->vol_amap[i], sync);if (opts->discard) {
@@ -190,6 +194,8 @@ void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync) opts->discard =0 ; } } + +return 0 ; }/*
fs/exfat/exfat_fs.h +1 -1
@@ -441,7 +441,7 @@ int exfat_count_num_clusters(struct super_block *sb,int exfat_load_bitmap (struct super_block *sb);void exfat_free_bitmap (struct exfat_sb_info *sbi);int exfat_set_bitmap (struct inode *inode,unsigned int clu,bool sync); -void exfat_clear_bitmap (struct inode *inode,unsigned int clu,bool sync); +int exfat_clear_bitmap (struct inode *inode,unsigned int clu,bool sync);unsigned int exfat_find_free_bitmap (struct super_block *sb,unsigned int clu);int exfat_count_used_clusters (struct super_block *sb,unsigned int *ret_count);int exfat_trim_fs (struct inode *inode,struct fstrim_range *range);
fs/exfat/fatent.c +7 -4
@@ -175,6 +175,7 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chainBITMAP_OFFSET_SECTOR_INDEX (sb,CLUSTER_TO_BITMAP_ENT (clu));if (p_chain->flags ==ALLOC_NO_FAT_CHAIN ) { +int err;unsigned int last_cluster = p_chain->dir + p_chain->size -1 ; do { bool sync = false;
@@ -189,7 +190,9 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain cur_cmap_i = next_cmap_i; } -exfat_clear_bitmap (inode, clu, (sync &&IS_DIRSYNC (inode))); + err =exfat_clear_bitmap (inode, clu, (sync &&IS_DIRSYNC (inode))); +if (err) +break ; clu++; num_clusters++; }while (num_clusters < p_chain->size);
@@ -210,12 +213,13 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain cur_cmap_i = next_cmap_i; } -exfat_clear_bitmap (inode, clu, (sync &&IS_DIRSYNC (inode))); +if (exfat_clear_bitmap (inode, clu, (sync &&IS_DIRSYNC (inode)))) +break ; clu = n_clu; num_clusters++;if (err) - goto dec_used_clus; +break ;if (num_clusters >= sbi->num_clusters -EXFAT_FIRST_CLUSTER ) {/*
@@ -229,7 +233,6 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain }while (clu !=EXFAT_EOF_CLUSTER ); } -dec_used_clus: sbi->used_clusters -= num_clusters;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/145 net-timestamp: support TCP GSO case for a few missing flags
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 3c9231ea6497dfc50ac0ef69fff484da27d0df66 ]
When I read through the TSO codes, I found out that we probably miss initializing the tx_flags of last seg when TSO is turned off, which means at the following points no more timestamp (for this last one) will be generated. There are three flags to be handled in this patch:
1. SKBTX_HW_TSTAMP
2. SKBTX_BPF
3. SKBTX_SCHED_TSTAMP
Note that SKBTX_BPF[1] was added in 6.14.0-rc2 by commit 6b98ec7e882af ("bpf: Add BPF_SOCK_OPS_TSTAMP_SCHED_CB callback") and only belongs to net-next branch material for now. The common issue of the above three flags can be fixed by this single patch.
This patch initializes the tx_flags to SKBTX_ANY_TSTAMP like what the UDP GSO does to make the newly segmented last skb inherit the tx_flags so that requested timestamp will be generated in each certain layer, or else that last one has zero value of tx_flags which leads to no timestamp at all.
--- net/ipv4/tcp_offload.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/ipv4/tcp_offload.c +7 -4
@@ -13,12 +13,15 @@#include <net/tcp.h> #include <net/protocol.h> -static void tcp_gso_tstamp (struct sk_buff *skb,unsigned int ts_seq, +static void tcp_gso_tstamp (struct sk_buff *skb,struct sk_buff *gso_skb,unsigned int seq,unsigned int mss) { +u32 flags =skb_shinfo (gso_skb)->tx_flags &SKBTX_ANY_TSTAMP ; +u32 ts_seq =skb_shinfo (gso_skb)->tskey; +while (skb) {if (before (ts_seq, seq + mss)) { -skb_shinfo (skb)->tx_flags |=SKBTX_SW_TSTAMP ; +skb_shinfo (skb)->tx_flags |= flags;skb_shinfo (skb)->tskey = ts_seq;return ; }
@@ -120,8 +123,8 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb, th =tcp_hdr (skb); seq =ntohl (th->seq); -if (unlikely (skb_shinfo (gso_skb)->tx_flags &SKBTX_SW_TSTAMP )) -tcp_gso_tstamp (segs,skb_shinfo (gso_skb)->tskey, seq, mss); +if (unlikely (skb_shinfo (gso_skb)->tx_flags &SKBTX_ANY_TSTAMP )) +tcp_gso_tstamp (segs, gso_skb, seq, mss); newcheck = ~csum_fold (csum_add (csum_unfold (th->check), delta));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/145 ublk: set_params: properly check if parameters can be applied
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Shankar <[email protected]>
[ Upstream commit 5ac60242b0173be83709603ebaf27a473f16c4e4 ]
The parameters set by the set_params call are only applied to the block device in the start_dev call. So if a device has already been started, a subsequently issued set_params on that device will not have the desired effect, and should return an error. There is an existing check for this
- set_params fails on devices in the LIVE state. But this check is not sufficient to cover the recovery case. In this case, the device will be in the QUIESCED or FAIL_IO states, so set_params will succeed. But this success is misleading, because the parameters will not be applied, since the device has already been started (by a previous ublk server). The bit UB_STATE_USED is set on completion of the start_dev; use it to detect and fail set_params commands which arrive too late to be applied (after start_dev).
--- drivers/block/ublk_drv.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/block/ublk_drv.c +5 -2
@@ -2599,9 +2599,12 @@ static int ublk_ctrl_set_params(struct ublk_device *ub,if (ph.len >sizeof (struct ublk_params )) ph.len =sizeof (struct ublk_params ); -/* parameters can only be changed when device isn't live */ mutex_lock (&ub->mutex); -if (ub->dev_info.state ==UBLK_S_DEV_LIVE ) { +if (test_bit (UB_STATE_USED , &ub->state)) { +/* +* Parameters can only be changed when device hasn't +* been started yet +*/ ret = -EACCES ; }else if (copy_from_user (&ub->params, argp, ph.len)) { ret = -EFAULT ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/145 sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zecheng Li <[email protected]>
[ Upstream commit 3b4035ddbfc8e4521f85569998a7569668cccf51 ]
child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. This 'prev' pointer can originate from struct rq's leaf_cfs_rq_list, making the conversion invalid and potentially leading to memory corruption. Depending on the relative positions of leaf_cfs_rq_list and the task group (tg) pointer within the struct, this can cause a memory fault or access garbage data.
The issue arises in list_add_leaf_cfs_rq, where both cfs_rq->leaf_cfs_rq_list and rq->leaf_cfs_rq_list are added to the same leaf list. Also, rq->tmp_alone_branch can be set to rq->leaf_cfs_rq_list.
This adds a check if (prev == &rq->leaf_cfs_rq_list) after the main conditional in child_cfs_rq_on_list. This ensures that the container_of operation will convert a correct cfs_rq struct.
This check is sufficient because only cfs_rqs on the same CPU are added to the list, so verifying the 'prev' pointer against the current rq's list head is enough.
Fixes a potential memory corruption issue that due to current struct layout might not be manifesting as a crash but could lead to unpredictable behavior when the layout changes.
--- kernel/sched/fair.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/sched/fair.c +4 -2
@@ -4118,15 +4118,17 @@ static inline bool child_cfs_rq_on_list(struct cfs_rq *cfs_rq) {struct cfs_rq *prev_cfs_rq;struct list_head *prev; +struct rq *rq =rq_of (cfs_rq);if (cfs_rq->on_list) { prev = cfs_rq->leaf_cfs_rq_list.prev; }else { -struct rq *rq =rq_of (cfs_rq); - prev = rq->tmp_alone_branch; } +if (prev == &rq->leaf_cfs_rq_list) +return false; + prev_cfs_rq = container_of(prev, struct cfs_rq, leaf_cfs_rq_list);return (prev_cfs_rq->tg->parent == cfs_rq->tg);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/145 net: dsa: mt7530: Fix traffic flooding for MMIO devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit ccc2f5a436fbb0ae1fb598932a9b8e48423c1959 ]
On MMIO devices (e.g. MT7988 or EN7581) unicast traffic received on lanX port is flooded on all other user ports if the DSA switch is configured without VLAN support since PORT_MATRIX in PCR regs contains all user ports. Similar to MDIO devices (e.g. MT7530 and MT7531) fix the issue defining default VLAN-ID 0 for MT7530 MMIO devices.
--- drivers/net/dsa/mt7530.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/net/dsa/mt7530.c +2 -6
@@ -2640,7 +2640,8 @@ mt7531_setup_common(struct dsa_switch *ds)if (ret <0 )return ret; -return 0 ; +/* Setup VLAN ID 0 for VLAN-unaware bridges */ +return mt7530_setup_vlan0 (priv); } static int
@@ -2734,11 +2735,6 @@ mt7531_setup(struct dsa_switch *ds)mt7531_setup_common (ds); -/* Setup VLAN ID 0 for VLAN-unaware bridges */ - ret =mt7530_setup_vlan0 (priv); -if (ret) -return ret; - ds->assisted_learning_on_cpu_port = true; ds->mtu_enforcement_ingress = true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/145 net: ipv6: fix dst ref loop in ila lwtunnel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Iurman <[email protected]>
[ Upstream commit 0e7633d7b95b67f1758aea19f8e85621c5f506a3 ]
This patch follows commit 92191dd10730 ("net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels") and, on a second thought, the same patch is also needed for ila (even though the config that triggered the issue was pathological, but still, we don't want that to happen).
--- net/ipv6/ila/ila_lwt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/ila/ila_lwt.c +2 -1
@@ -88,7 +88,8 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) goto drop; } -if (ilwt->connected) { +/* cache only if we don't create a dst reference loop */ +if (ilwt->connected && orig_dst->lwtstate != dst->lwtstate) {local_bh_disable ();dst_cache_set_ip6 (&ilwt->dst_cache, dst, &fl6.saddr);local_bh_enable ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/145 net: ipv6: fix missing dst ref drop in ila lwtunnel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Iurman <[email protected]>
[ Upstream commit 5da15a9c11c1c47ef573e6805b60a7d8a1687a2a ]
Add missing skb_dst_drop() to drop reference to the old dst before adding the new dst to the skb.
--- net/ipv6/ila/ila_lwt.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/ila/ila_lwt.c +1 -0
@@ -96,6 +96,7 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) } } +skb_dst_drop (skb);skb_dst_set (skb, dst);return dst_output (net, sk, skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/145 gpio: rcar: Fix missing of_node_put() call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrizio Castro <[email protected]>
[ Upstream commit 391b41f983bf7ff853de44704d8e14e7cc648a9b ]
of_parse_phandle_with_fixed_args() requires its caller to call into of_node_put() on the node pointer from the output structure, but such a call is currently missing.
Call into of_node_put() to rectify that.
--- drivers/gpio/gpio-rcar.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpio/gpio-rcar.c +6 -1
@@ -468,7 +468,12 @@ static int gpio_rcar_parse_dt(struct gpio_rcar_priv *p, unsigned int *npins) p->info = *info; ret =of_parse_phandle_with_fixed_args (np,"gpio-ranges" ,3 ,0 , &args); - *npins = ret ==0 ? args.args[2 ] :RCAR_MAX_GPIO_PER_BANK ; +if (ret) { + *npins =RCAR_MAX_GPIO_PER_BANK ; + }else { + *npins = args.args[2 ]; +of_node_put (args.np); + }if (*npins ==0 || *npins >RCAR_MAX_GPIO_PER_BANK ) { dev_warn(p->dev, "Invalid number of gpio lines %u, using %u\n",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/145 Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Heusel <[email protected]>
commit 2397d61ee45cddb8f3bd3a3a9840ef0f0b5aa843 upstream.
This reverts commit 235b630eda072d7e7b102ab346d6b8a2c028a772.
This commit was found responsible for issues with SD card recognition, as users had to re-insert their cards in the readers and wait for a while. As for some people the SD card was involved in the boot process it also caused boot failures.
--- drivers/misc/cardreader/rtsx_usb.c | 15 --------------- 1 file changed, 15 deletions(-)
drivers/misc/cardreader/rtsx_usb.c +0 -15
@@ -286,7 +286,6 @@ static int rtsx_usb_get_status_with_bulkint rtsx_usb_get_card_status (struct rtsx_ucr *ucr,u16 *status) {int ret; -u8 interrupt_val =0 ;u16 *buf;if (!status)
@@ -309,20 +308,6 @@ int rtsx_usb_get_card_status(struct rtsx ret =rtsx_usb_get_status_with_bulk (ucr, status); } -rtsx_usb_read_register (ucr,CARD_INT_PEND , &interrupt_val); -/* Cross check presence with interrupts */ -if (*status &XD_CD ) -if (!(interrupt_val &XD_INT )) - *status &= ~XD_CD ; - -if (*status &SD_CD ) -if (!(interrupt_val &SD_INT )) - *status &= ~SD_CD ; - -if (*status &MS_CD ) -if (!(interrupt_val &MS_INT )) - *status &= ~MS_CD ; -/* usb_control_msg may return positive when success */ if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 93/145 usb: renesas_usbhs: Call clk_put()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit b5ea08aa883da05106fcc683d12489a4292d1122 upstream.
Clocks acquired with of_clk_get() need to be freed with clk_put(). Call clk_put() on priv->clks[0] on error path.
--- drivers/usb/renesas_usbhs/common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/renesas_usbhs/common.c +3 -1
@@ -312,8 +312,10 @@ static int usbhsc_clk_get(struct device priv->clks[1 ] =of_clk_get (dev_of_node (dev),1 );if (PTR_ERR (priv->clks[1 ]) == -ENOENT ) priv->clks[1 ] =NULL ; -else if (IS_ERR (priv->clks[1 ])) +else if (IS_ERR (priv->clks[1 ])) { +clk_put (priv->clks[0 ]);return PTR_ERR (priv->clks[1 ]); + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 94/145 usb: renesas_usbhs: Use devm_usb_get_phy()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit e0c92440938930e7fa7aa6362780d39cdea34449 upstream.
The gpriv->transceiver is retrieved in probe() through usb_get_phy() but never released. Use devm_usb_get_phy() to handle this scenario.
This issue was identified through code investigation. No issue was found without this change.
--- drivers/usb/renesas_usbhs/mod_gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/renesas_usbhs/mod_gadget.c +1 -1
@@ -1094,7 +1094,7 @@ int usbhs_mod_gadget_probe(struct usbhs_ goto usbhs_mod_gadget_probe_err_gpriv; } - gpriv->transceiver =usb_get_phy (USB_PHY_TYPE_UNDEFINED ); + gpriv->transceiver =devm_usb_get_phy (dev,USB_PHY_TYPE_UNDEFINED );dev_info (dev,"%stransceiver found\n" , !IS_ERR (gpriv->transceiver) ?"" :"no " );
Greg Kroah-Hartman
maintainerPATCH 95/145 usb: hub: lack of clearing xHC resources
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Laszczak <[email protected]>
commit 2b66ef84d0d2a0ea955b40bd306f5e3abbc5cf9c upstream.
The xHC resources allocated for USB devices are not released in correct order after resuming in case when while suspend device was reconnected.
This issue has been detected during the fallowing scenario:
- connect hub HS to root port
- connect LS/FS device to hub port
- wait for enumeration to finish
- force host to suspend
- reconnect hub attached to root port
- wake host
For this scenario during enumeration of USB LS/FS device the Cadence xHC reports completion error code for xHC commands because the xHC resources used for devices has not been properly released.
XHCI specification doesn't mention that device can be reset in any order so, we should not treat this issue as Cadence xHC controller bug. Similar as during disconnecting in this case the device resources should be cleared starting form the last usb device in tree toward the root hub. To fix this issue usbcore driver should call hcd->driver->reset_device for all USB devices connected to hub which was reconnected while suspending.
--- drivers/usb/core/hub.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
drivers/usb/core/hub.c +33 -0
@@ -6034,6 +6034,36 @@ void usb_hub_cleanup(void) }/* usb_hub_cleanup() */ /** +* hub_hc_release_resources - clear resources used by host controller +* @udev: pointer to device being released +* +* Context: task context, might sleep +* +* Function releases the host controller resources in correct order before +* making any operation on resuming usb device. The host controller resources +* allocated for devices in tree should be released starting from the last +* usb device in tree toward the root hub. This function is used only during +* resuming device when usb device require reinitialization – that is, when +* flag udev->reset_resume is set. +* +* This call is synchronous, and may not be used in an interrupt context. +*/ +static void hub_hc_release_resources (struct usb_device *udev) +{ +struct usb_hub *hub =usb_hub_to_struct_hub (udev); +struct usb_hcd *hcd =bus_to_hcd (udev->bus); +int i; + +/* Release up resources for all children before this device */ +for (i =0 ; i < udev->maxchild; i++) +if (hub->ports[i]->child) +hub_hc_release_resources (hub->ports[i]->child); + +if (hcd->driver->reset_device) + hcd->driver->reset_device (hcd, udev); +} + +/** * usb_reset_and_verify_device - perform a USB port reset to reinitialize a device * @udev: device to reset (not in SUSPENDED or NOTATTACHED state) *
@@ -6097,6 +6127,9 @@ static int usb_reset_and_verify_device(s bos = udev->bos; udev->bos =NULL ; +if (udev->reset_resume) +hub_hc_release_resources (udev); +mutex_lock (hcd->address0_mutex);for (i =0 ; i <PORT_INIT_TRIES ; ++i) {
Greg Kroah-Hartman
maintainerPATCH 96/145 usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miao Li <[email protected]>
commit ff712188daa3fe3ce7e11e530b4dca3826dae14a upstream.
When used on Huawei hisi platforms, Prolific Mass Storage Card Reader which the VID:PID is in 067b:2731 might fail to enumerate at boot time and doesn't work well with LPM enabled, combination quirks:
USB_QUIRK_DELAY_INIT + USB_QUIRK_NO_LPM
fixed the problems.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -341,6 +341,10 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0638, 0x0a13), .driver_info = USB_QUIRK_STRING_FETCH_255 }, + /* Prolific Single-LUN Mass Storage Card Reader */ + { USB_DEVICE(0x067b, 0x2731), .driver_info = USB_QUIRK_DELAY_INIT | + USB_QUIRK_NO_LPM }, + /* Saitek Cyborg Gold Joystick */ { USB_DEVICE(0x06a3, 0x0006), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
Greg Kroah-Hartman
maintainerPATCH 97/145 usb: typec: ucsi: Fix NULL pointer access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Kuchynski <[email protected]>
commit b13abcb7ddd8d38de769486db5bd917537b32ab1 upstream.
Resources should be released only after all threads that utilize them have been destroyed.
This commit ensures that resources are not released prematurely by waiting for the associated workqueue to complete before deallocating them.
--- drivers/usb/typec/ucsi/ucsi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/usb/typec/ucsi/ucsi.c +7 -6
@@ -1465,11 +1465,11 @@ static int ucsi_init(struct ucsi *ucsi) err_unregister:for (con = connector; con->port; con++) { +if (con->wq) +destroy_workqueue (con->wq);ucsi_unregister_partner (con);ucsi_unregister_altmodes (con,UCSI_RECIPIENT_CON );ucsi_unregister_port_psy (con); -if (con->wq) -destroy_workqueue (con->wq);usb_power_delivery_unregister_capabilities (con->port_sink_caps); con->port_sink_caps =NULL ;
@@ -1651,10 +1651,6 @@ void ucsi_unregister(struct ucsi *ucsi)for (i =0 ; i < ucsi->cap.num_connectors; i++) {cancel_work_sync (&ucsi->connector[i].work); -ucsi_unregister_partner (&ucsi->connector[i]); -ucsi_unregister_altmodes (&ucsi->connector[i], -UCSI_RECIPIENT_CON ); -ucsi_unregister_port_psy (&ucsi->connector[i]);if (ucsi->connector[i].wq) {struct ucsi_work *uwork;
@@ -1670,6 +1666,11 @@ void ucsi_unregister(struct ucsi *ucsi)destroy_workqueue (ucsi->connector[i].wq); } +ucsi_unregister_partner (&ucsi->connector[i]); +ucsi_unregister_altmodes (&ucsi->connector[i], +UCSI_RECIPIENT_CON ); +ucsi_unregister_port_psy (&ucsi->connector[i]); +usb_power_delivery_unregister_capabilities (ucsi->connector[i].port_sink_caps); ucsi->connector[i].port_sink_caps =NULL ;usb_power_delivery_unregister_capabilities (ucsi->connector[i].port_source_caps);
Greg Kroah-Hartman
maintainerPATCH 98/145 usb: renesas_usbhs: Flush the notify_hotplug_work
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 552ca6b87e3778f3dd5b87842f95138162e16c82 upstream.
When performing continuous unbind/bind operations on the USB drivers available on the Renesas RZ/G2L SoC, a kernel crash with the message "Unable to handle kernel NULL pointer dereference at virtual address" may occur. This issue points to the usbhsc_notify_hotplug() function.
Flush the delayed work to avoid its execution when driver resources are unavailable.
--- drivers/usb/renesas_usbhs/common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/renesas_usbhs/common.c +2 -0
@@ -770,6 +770,8 @@ static void usbhs_remove(struct platformdev_dbg (&pdev->dev,"usb remove\n" ); +flush_delayed_work (&priv->notify_hotplug_work); +/* power off */ if (!usbhs_get_dparam (priv, runtime_pwctrl))usbhsc_power_ctrl (priv,0 );
Greg Kroah-Hartman
maintainerPATCH 99/145 usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashanth K <[email protected]>
commit 17c2c87c37862c3e95b55f660681cc6e8d66660e upstream.
Currently while UDC suspends, u_ether attempts to remote wakeup the host if there are any pending transfers. However, if remote wakeup fails, the UDC remains suspended but the is_suspend flag is not set. And since is_suspend flag isn't set, the subsequent eth_start_xmit() would queue USB requests to suspended UDC.
To fix this, bail out from gether_suspend() only if remote wakeup operation is successful.
--- drivers/usb/gadget/function/u_ether.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/u_ether.c +2 -2
@@ -1052,8 +1052,8 @@ void gether_suspend(struct gether *link)* There is a transfer in progress. So we trigger a remote * wakeup to inform the host. */ -ether_wakeup_host (dev->port_usb); -return ; +if (!ether_wakeup_host (dev->port_usb)) +return ; }spin_lock_irqsave (&dev->lock, flags); link->is_suspend = true;
Greg Kroah-Hartman
maintainerPATCH 100/145 usb: atm: cxacru: fix a flaw in existing endpoint checks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit c90aad369899a607cfbc002bebeafd51e31900cd upstream.
Syzbot once again identified a flaw in usb endpoint checking, see [1]. This time the issue stems from a commit authored by me (2eabb655a968 ("usb: atm: cxacru: fix endpoint checking in cxacru_bind()")).
While using usb_find_common_endpoints() may usually be enough to discard devices with wrong endpoints, in this case one needs more than just finding and identifying the sufficient number of endpoints of correct types - one needs to check the endpoint's address as well.
Since cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind, switch the endpoint verification approach to usb_check_XXX_endpoints() instead to fix incomplete ep testing.
[1] Syzbot report:
usb 5-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... RIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649 cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline] cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223 usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058 cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377 usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396 really_probe+0x2b9/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830
...
--- drivers/usb/atm/cxacru.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/usb/atm/cxacru.c +7 -6
@@ -1131,7 +1131,10 @@ static int cxacru_bind(struct usbatm_datstruct cxacru_data *instance;struct usb_device *usb_dev =interface_to_usbdev (intf);struct usb_host_endpoint *cmd_ep = usb_dev->ep_in[CXACRU_EP_CMD ]; -struct usb_endpoint_descriptor *in, *out; +static const u8 ep_addrs[] = { +CXACRU_EP_CMD +USB_DIR_IN , +CXACRU_EP_CMD +USB_DIR_OUT , +0 };int ret;/* instance init */
@@ -1179,13 +1182,11 @@ static int cxacru_bind(struct usbatm_dat }if (usb_endpoint_xfer_int (&cmd_ep->desc)) - ret =usb_find_common_endpoints (intf->cur_altsetting, -NULL ,NULL , &in, &out); + ret =usb_check_int_endpoints (intf, ep_addrs);else - ret =usb_find_common_endpoints (intf->cur_altsetting, - &in, &out,NULL ,NULL ); + ret =usb_check_bulk_endpoints (intf, ep_addrs); -if (ret) { +if (!ret) {usb_err (usbatm_instance,"cxacru_bind: interface has incorrect endpoints\n" ); ret = -ENODEV ; goto fail;
Greg Kroah-Hartman
maintainerPATCH 101/145 usb: dwc3: Set SUSPENDENABLE soon after phy init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit cc5bfc4e16fc1d1c520cd7bb28646e82b6e69217 upstream.
After phy initialization, some phy operations can only be executed while in lower P states. Ensure GUSB3PIPECTL.SUSPENDENABLE and GUSB2PHYCFG.SUSPHY are set soon after initialization to avoid blocking phy ops.
Previously the SUSPENDENABLE bits are only set after the controller initialization, which may not happen right away if there's no gadget driver or xhci driver bound. Revise this to clear SUSPENDENABLE bits only when there's mode switching (change in GCTL.PRTCAPDIR).
--- drivers/usb/dwc3/core.c | 69 +++++++++++++++++++++++++++++------------------- drivers/usb/dwc3/core.h | 2 - drivers/usb/dwc3/drd.c | 4 +- 3 files changed, 45 insertions(+), 30 deletions(-)
drivers/usb/dwc3/core.c +42 -27
@@ -125,11 +125,24 @@ void dwc3_enable_susphy(struct dwc3 *dwcdwc3_writel (dwc->regs,DWC3_GUSB2PHYCFG (0 ), reg); } -void dwc3_set_prtcap (struct dwc3 *dwc,u32 mode) +void dwc3_set_prtcap (struct dwc3 *dwc,u32 mode,bool ignore_susphy) { +unsigned int hw_mode;u32 reg; reg =dwc3_readl (dwc->regs,DWC3_GCTL ); + +/* +* For DRD controllers, GUSB3PIPECTL.SUSPENDENABLE and +* GUSB2PHYCFG.SUSPHY should be cleared during mode switching, +* and they can be set after core initialization. +*/ + hw_mode =DWC3_GHWPARAMS0_MODE (dwc->hwparams.hwparams0); +if (hw_mode ==DWC3_GHWPARAMS0_MODE_DRD && !ignore_susphy) { +if (DWC3_GCTL_PRTCAP (reg) != mode) +dwc3_enable_susphy (dwc, false); + } + reg &= ~(DWC3_GCTL_PRTCAPDIR (DWC3_GCTL_PRTCAP_OTG )); reg |=DWC3_GCTL_PRTCAPDIR (mode);dwc3_writel (dwc->regs,DWC3_GCTL , reg);
@@ -209,7 +222,7 @@ static void __dwc3_set_mode(struct work_spin_lock_irqsave (&dwc->lock, flags); -dwc3_set_prtcap (dwc, desired_dr_role); +dwc3_set_prtcap (dwc, desired_dr_role, false);spin_unlock_irqrestore (&dwc->lock, flags);
@@ -643,16 +656,7 @@ static int dwc3_phy_setup(struct dwc3 *d*/ reg &= ~DWC3_GUSB3PIPECTL_UX_EXIT_PX ; -/* -* Above DWC_usb3.0 1.94a, it is recommended to set -* DWC3_GUSB3PIPECTL_SUSPHY to '0' during coreConsultant configuration. -* So default value will be '0' when the core is reset. Application -* needs to set it to '1' after the core initialization is completed. -* -* Similarly for DRD controllers, GUSB3PIPECTL.SUSPENDENABLE must be -* cleared after power-on reset, and it can be set after core -* initialization. -*/ +/* Ensure the GUSB3PIPECTL.SUSPENDENABLE is cleared prior to phy init. */ reg &= ~DWC3_GUSB3PIPECTL_SUSPHY ;if (dwc->u2ss_inp3_quirk)
@@ -725,15 +729,7 @@ static int dwc3_phy_setup(struct dwc3 *dbreak ; } -/* -* Above DWC_usb3.0 1.94a, it is recommended to set -* DWC3_GUSB2PHYCFG_SUSPHY to '0' during coreConsultant configuration. -* So default value will be '0' when the core is reset. Application -* needs to set it to '1' after the core initialization is completed. -* -* Similarly for DRD controllers, GUSB2PHYCFG.SUSPHY must be cleared -* after power-on reset, and it can be set after core initialization. -*/ +/* Ensure the GUSB2PHYCFG.SUSPHY is cleared prior to phy init. */ reg &= ~DWC3_GUSB2PHYCFG_SUSPHY ;if (dwc->dis_enblslpm_quirk)
@@ -809,6 +805,25 @@ static int dwc3_phy_power_on(struct dwc3if (ret <0 ) goto err_power_off_usb2_phy; +/* +* Above DWC_usb3.0 1.94a, it is recommended to set +* DWC3_GUSB3PIPECTL_SUSPHY and DWC3_GUSB2PHYCFG_SUSPHY to '0' during +* coreConsultant configuration. So default value will be '0' when the +* core is reset. Application needs to set it to '1' after the core +* initialization is completed. +* +* Certain phy requires to be in P0 power state during initialization. +* Make sure GUSB3PIPECTL.SUSPENDENABLE and GUSB2PHYCFG.SUSPHY are clear +* prior to phy init to maintain in the P0 state. +* +* After phy initialization, some phy operations can only be executed +* while in lower P states. Ensure GUSB3PIPECTL.SUSPENDENABLE and +* GUSB2PHYCFG.SUSPHY are set soon after initialization to avoid +* blocking phy ops. +*/ + if (!DWC3_VER_IS_WITHIN(DWC3, ANY, 194A)) +dwc3_enable_susphy (dwc, true); +return 0 ; err_power_off_usb2_phy:
@@ -1432,7 +1447,7 @@ static int dwc3_core_init_mode(struct dwswitch (dwc->dr_mode) {case USB_DR_MODE_PERIPHERAL : -dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_DEVICE ); +dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_DEVICE , false);if (dwc->usb2_phy)otg_set_vbus (dwc->usb2_phy->otg, false);
@@ -1444,7 +1459,7 @@ static int dwc3_core_init_mode(struct dwreturn dev_err_probe (dev, ret,"failed to initialize gadget\n" );break ;case USB_DR_MODE_HOST : -dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_HOST ); +dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_HOST , false);if (dwc->usb2_phy)otg_set_vbus (dwc->usb2_phy->otg, true);
@@ -1487,7 +1502,7 @@ static void dwc3_core_exit_mode(struct d }/* de-assert DRVVBUS for HOST and OTG mode */ -dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_DEVICE ); +dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_DEVICE , true); }static void dwc3_get_properties (struct dwc3 *dwc)
@@ -2192,7 +2207,7 @@ static int dwc3_resume_common(struct dwcif (ret)return ret; -dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_DEVICE ); +dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_DEVICE , true);dwc3_gadget_resume (dwc);break ;case DWC3_GCTL_PRTCAP_HOST :
@@ -2200,7 +2215,7 @@ static int dwc3_resume_common(struct dwc ret =dwc3_core_init_for_resume (dwc);if (ret)return ret; -dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_HOST ); +dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_HOST , true);break ; }/* Restore GUSB2PHYCFG bits that were modified in suspend */
@@ -2225,7 +2240,7 @@ static int dwc3_resume_common(struct dwcif (ret)return ret; -dwc3_set_prtcap (dwc, dwc->current_dr_role); +dwc3_set_prtcap (dwc, dwc->current_dr_role, true);dwc3_otg_init (dwc);if (dwc->current_otg_role ==DWC3_OTG_ROLE_HOST ) {
drivers/usb/dwc3/core.h +1 -1
@@ -1531,7 +1531,7 @@ struct dwc3_gadget_ep_cmd_params {#define DWC3_HAS_OTG BIT(3)/* prototypes */ -void dwc3_set_prtcap (struct dwc3 *dwc,u32 mode); +void dwc3_set_prtcap (struct dwc3 *dwc,u32 mode,bool ignore_susphy);void dwc3_set_mode (struct dwc3 *dwc,u32 mode);u32 dwc3_core_fifo_space (struct dwc3_ep *dep,u8 type);
drivers/usb/dwc3/drd.c +2 -2
@@ -173,7 +173,7 @@ void dwc3_otg_init(struct dwc3 *dwc)* block "Initialize GCTL for OTG operation". */ /* GCTL.PrtCapDir=2'b11 */ -dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_OTG ); +dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_OTG , true);/* GUSB2PHYCFG0.SusPHY=0 */ reg =dwc3_readl (dwc->regs,DWC3_GUSB2PHYCFG (0 )); reg &= ~DWC3_GUSB2PHYCFG_SUSPHY ;
@@ -553,7 +553,7 @@ int dwc3_drd_init(struct dwc3 *dwc)dwc3_drd_update (dwc); }else { -dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_OTG ); +dwc3_set_prtcap (dwc,DWC3_GCTL_PRTCAP_OTG , true);/* use OTG block to get ID event */ irq =dwc3_otg_get_irq (dwc);
Greg Kroah-Hartman
maintainerPATCH 102/145 usb: dwc3: gadget: Prevent irq storm when TH re-executes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Badhri Jagan Sridharan <[email protected]>
commit 69c58deec19628c8a686030102176484eb94fed4 upstream.
While commit d325a1de49d6 ("usb: dwc3: gadget: Prevent losing events in event cache") makes sure that top half(TH) does not end up overwriting the cached events before processing them when the TH gets invoked more than one time, returning IRQ_HANDLED results in occasional irq storm where the TH hogs the CPU. The irq storm can be prevented by the flag before event handler busy is cleared. Default enable interrupt moderation in all versions which support them.
ftrace event stub during dwc3 irq storm:
irq/504_dwc3-1111 ( 1111) [000] .... 70.000866: irq_handler_exit: irq=14 ret=handled
irq/504_dwc3-1111 ( 1111) [000] .... 70.000872: irq_handler_entry: irq=504 name=dwc3
irq/504_dwc3-1111 ( 1111) [000] .... 70.000874: irq_handler_exit: irq=504 ret=handled
irq/504_dwc3-1111 ( 1111) [000] .... 70.000881: irq_handler_entry: irq=504 name=dwc3
irq/504_dwc3-1111 ( 1111) [000] .... 70.000883: irq_handler_exit: irq=504 ret=handled
irq/504_dwc3-1111 ( 1111) [000] .... 70.000889: irq_handler_entry: irq=504 name=dwc3
irq/504_dwc3-1111 ( 1111) [000] .... 70.000892: irq_handler_exit: irq=504 ret=handled
irq/504_dwc3-1111 ( 1111) [000] .... 70.000898: irq_handler_entry: irq=504 name=dwc3
irq/504_dwc3-1111 ( 1111) [000] .... 70.000901: irq_handler_exit: irq=504 ret=handled
irq/504_dwc3-1111 ( 1111) [000] .... 70.000907: irq_handler_entry: irq=504 name=dwc3
irq/504_dwc3-1111 ( 1111) [000] .... 70.000909: irq_handler_exit: irq=504 ret=handled
irq/504_dwc3-1111 ( 1111) [000] .... 70.000915: irq_handler_entry: irq=504 name=dwc3
irq/504_dwc3-1111 ( 1111) [000] .... 70.000918: irq_handler_exit: irq=504 ret=handled
irq/504_dwc3-1111 ( 1111) [000] .... 70.000924: irq_handler_entry: irq=504 name=dwc3
irq/504_dwc3-1111 ( 1111) [000] .... 70.000927: irq_handler_exit: irq=504 ret=handled
irq/504_dwc3-1111 ( 1111) [000] .... 70.000933: irq_handler_entry: irq=504 name=dwc3
irq/504_dwc3-1111 ( 1111) [000] .... 70.000935: irq_handler_exit: irq=504 ret=handled
....--- drivers/usb/dwc3/core.c | 16 ++++++---------- drivers/usb/dwc3/gadget.c | 10 +++++++--- 2 files changed, 13 insertions(+), 13 deletions(-)
drivers/usb/dwc3/core.c +6 -10
@@ -1671,8 +1671,6 @@ static void dwc3_get_properties(struct d dwc->tx_thr_num_pkt_prd = tx_thr_num_pkt_prd; dwc->tx_max_burst_prd = tx_max_burst_prd; - dwc->imod_interval =0 ; - dwc->tx_fifo_resize_max_num = tx_fifo_resize_max_num; }
@@ -1690,21 +1688,19 @@ static void dwc3_check_params(struct dwcunsigned int hwparam_gen =DWC3_GHWPARAMS3_SSPHY_IFC (dwc->hwparams.hwparams3); -/* Check for proper value of imod_interval */ -if (dwc->imod_interval && !dwc3_has_imod (dwc)) { -dev_warn (dwc->dev,"Interrupt moderation not supported\n" ); - dwc->imod_interval =0 ; - } -/* +* Enable IMOD for all supporting controllers. +* +* Particularly, DWC_usb3 v3.00a must enable this feature for +* the following reason: +* * Workaround for STAR 9000961433 which affects only version * 3.00a of the DWC_usb3 core. This prevents the controller * interrupt from being masked while handling events. IMOD * allows us to work around this issue. Enable it for the * affected version. */ -if (!dwc->imod_interval && - DWC3_VER_IS(DWC3, 300A)) +if (dwc3_has_imod ((dwc))) dwc->imod_interval =1 ;/* Check the maximum_speed parameter */
drivers/usb/dwc3/gadget.c +7 -3
@@ -4507,14 +4507,18 @@ static irqreturn_t dwc3_process_event_budwc3_writel (dwc->regs,DWC3_GEVNTSIZ (0 ),DWC3_GEVNTSIZ_SIZE (evt->length)); + evt->flags &= ~DWC3_EVENT_PENDING ; +/* +* Add an explicit write memory barrier to make sure that the update of +* clearing DWC3_EVENT_PENDING is observed in dwc3_check_event_buf() +*/ +wmb (); +if (dwc->imod_interval) {dwc3_writel (dwc->regs,DWC3_GEVNTCOUNT (0 ),DWC3_GEVNTCOUNT_EHB );dwc3_writel (dwc->regs,DWC3_DEV_IMOD (0 ), dwc->imod_interval); } -/* Keep the clearing of DWC3_EVENT_PENDING at the end */ - evt->flags &= ~DWC3_EVENT_PENDING ; -return ret; }
Greg Kroah-Hartman
maintainerPATCH 103/145 usb: typec: ucsi: increase timeout for PPM reset operations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
commit bf4f9ae1cb08ccaafbe6874be6c46f59b83ae778 upstream.
It is observed that on some systems an initial PPM reset during the boot phase can trigger a timeout:
[ 6.482546] ucsi_acpi USBC000:00: failed to reset PPM! [ 6.482551] ucsi_acpi USBC000:00: error -ETIMEDOUT: PPM init failed
Still, increasing the timeout value, albeit being the most straightforward solution, eliminates the problem: the initial PPM reset may take up to ~8000-10000ms on some Lenovo laptops. When it is reset after the above period of time (or even if ucsi_reset_ppm() is not called overall), UCSI works as expected.
Moreover, if the ucsi_acpi module is loaded/unloaded manually after the system has booted, reading the CCI values and resetting the PPM works perfectly, without any timeout. Thus it's only a boot-time issue.
The reason for this behavior is not clear but it may be the consequence of some tricks that the firmware performs or be an actual firmware bug. As a workaround, increase the timeout to avoid failing the UCSI initialization prematurely.
--- drivers/usb/typec/ucsi/ucsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/ucsi/ucsi.c +1 -1
@@ -25,7 +25,7 @@* difficult to estimate the time it takes for the system to process the command * before it is actually passed to the PPM. */ -#define UCSI_TIMEOUT_MS 5000 +#define UCSI_TIMEOUT_MS 10000/* * UCSI_SWAP_TIMEOUT_MS - Timeout for role swap requests
Greg Kroah-Hartman
maintainerPATCH 104/145 usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
commit d6b82dafd17db0658f089b9cdec573982ca82bc5 upstream.
During probe, the TCPC alert interrupts are getting masked to avoid unwanted interrupts during chip setup: this is ok to do but there is no unmasking happening at any later time, which means that the chip will not raise any interrupt, essentially making it not functional as, while internally it does perform all of the intended functions, it won't signal anything to the outside.
Unmask the alert interrupts to fix functionality.
--- drivers/usb/typec/tcpm/tcpci_rt1711h.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/typec/tcpm/tcpci_rt1711h.c +11 -0
@@ -331,6 +331,11 @@ static int rt1711h_probe(struct i2c_clie {int ret;struct rt1711h_chip *chip; +const u16 alert_mask =TCPC_ALERT_TX_SUCCESS |TCPC_ALERT_TX_DISCARDED | +TCPC_ALERT_TX_FAILED |TCPC_ALERT_RX_HARD_RST | +TCPC_ALERT_RX_STATUS |TCPC_ALERT_POWER_STATUS | +TCPC_ALERT_CC_STATUS |TCPC_ALERT_RX_BUF_OVF | +TCPC_ALERT_FAULT ; chip =devm_kzalloc (&client->dev,sizeof (*chip),GFP_KERNEL );if (!chip)
@@ -379,6 +384,12 @@ static int rt1711h_probe(struct i2c_clie dev_name(chip->dev), chip);if (ret <0 )return ret; + +/* Enable alert interrupts */ + ret =rt1711h_write16 (chip,TCPC_ALERT_MASK , alert_mask); +if (ret <0 ) +return ret; +enable_irq_wake (client->irq);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 105/145 usb: gadget: Set self-powered based on MaxPower and bmAttributes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashanth K <[email protected]>
commit 40e89ff5750fca2c1d6da93f98a2038716bba86c upstream.
Currently the USB gadget will be set as bus-powered based solely on whether its bMaxPower is greater than 100mA, but this may miss devices that may legitimately draw less than 100mA but still want to report as bus-powered. Similarly during suspend & resume, USB gadget is incorrectly marked as bus/self powered without checking the bmAttributes field. Fix these by configuring the USB gadget as self or bus powered based on bmAttributes, and explicitly set it as bus-powered if it draws more than 100mA.
--- drivers/usb/gadget/composite.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/usb/gadget/composite.c +11 -5
@@ -1050,10 +1050,11 @@ static int set_config(struct usb_composielse usb_gadget_set_remote_wakeup (gadget,0 ); done: -if (power <=USB_SELF_POWER_VBUS_MAX_DRAW ) -usb_gadget_set_selfpowered (gadget); -else +if (power >USB_SELF_POWER_VBUS_MAX_DRAW || + !(c->bmAttributes &USB_CONFIG_ATT_SELFPOWER ))usb_gadget_clear_selfpowered (gadget); +else +usb_gadget_set_selfpowered (gadget);usb_gadget_vbus_draw (gadget, power);if (result >=0 && cdev->delayed_status)
@@ -2615,7 +2616,9 @@ void composite_suspend(struct usb_gadget cdev->suspended =1 ; -usb_gadget_set_selfpowered (gadget); +if (cdev->config->bmAttributes &USB_CONFIG_ATT_SELFPOWER ) +usb_gadget_set_selfpowered (gadget); +usb_gadget_vbus_draw (gadget,2 ); }
@@ -2649,8 +2652,11 @@ void composite_resume(struct usb_gadgetelse maxpower =min (maxpower,900U ); -if (maxpower >USB_SELF_POWER_VBUS_MAX_DRAW ) +if (maxpower >USB_SELF_POWER_VBUS_MAX_DRAW || + !(cdev->config->bmAttributes &USB_CONFIG_ATT_SELFPOWER ))usb_gadget_clear_selfpowered (gadget); +else +usb_gadget_set_selfpowered (gadget);usb_gadget_vbus_draw (gadget, maxpower); }else {
Greg Kroah-Hartman
maintainerPATCH 106/145 usb: gadget: Fix setting self-powered state on suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit c783e1258f29c5caac9eea0aea6b172870f1baf8 upstream.
cdev->config might be NULL, so check it before dereferencing.
--- drivers/usb/gadget/composite.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/composite.c +2 -1
@@ -2616,7 +2616,8 @@ void composite_suspend(struct usb_gadget cdev->suspended =1 ; -if (cdev->config->bmAttributes &USB_CONFIG_ATT_SELFPOWER ) +if (cdev->config && + cdev->config->bmAttributes &USB_CONFIG_ATT_SELFPOWER )usb_gadget_set_selfpowered (gadget);usb_gadget_vbus_draw (gadget,2 );
Greg Kroah-Hartman
maintainerPATCH 107/145 usb: gadget: Check bmAttributes only if configuration is valid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashanth K <[email protected]>
commit 8e812e9355a6f14dffd54a33d951ca403b9732f5 upstream.
If the USB configuration is not valid, then avoid checking for bmAttributes to prevent null pointer deference.
--- drivers/usb/gadget/composite.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/composite.c +1 -1
@@ -1051,7 +1051,7 @@ static int set_config(struct usb_composiusb_gadget_set_remote_wakeup (gadget,0 ); done:if (power >USB_SELF_POWER_VBUS_MAX_DRAW || - !(c->bmAttributes &USB_CONFIG_ATT_SELFPOWER )) + (c && !(c->bmAttributes &USB_CONFIG_ATT_SELFPOWER )))usb_gadget_clear_selfpowered (gadget);else usb_gadget_set_selfpowered (gadget);
Greg Kroah-Hartman
maintainerPATCH 108/145 xhci: pci: Fix indentation in the PCI device ID definitions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 0309ed83791c079f239c13e0c605210425cd1a61 upstream.
Some of the definitions are missing the one TAB, add it to them.
--- drivers/usb/host/xhci-pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/host/xhci-pci.c +4 -4
@@ -28,8 +28,8 @@#define SPARSE_CNTL_ENABLE 0xC12C/* Device for a quirk */ -#define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 -#define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000 +#define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 +#define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 0x1100#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400
@@ -38,8 +38,8 @@#define PCI_DEVICE_ID_EJ168 0x7023#define PCI_DEVICE_ID_EJ188 0x7052 -#define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31 -#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31 +#define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31 +#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI 0x9cb1#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
Greg Kroah-Hartman
maintainerPATCH 109/145 usb: xhci: Enable the TRB overfetch quirk on VIA VL805
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Pecio <[email protected]>
commit c133ec0e5717868c9967fa3df92a55e537b1aead upstream.
Raspberry Pi is a major user of those chips and they discovered a bug - when the end of a transfer ring segment is reached, up to four TRBs can be prefetched from the next page even if the segment ends with link TRB and on page boundary (the chip claims to support standard 4KB pages).
It also appears that if the prefetched TRBs belong to a different ring whose doorbell is later rung, they may be used without refreshing from system RAM and the endpoint will stay idle if their cycle bit is stale.
Other users complain about IOMMU faults on x86 systems, unsurprisingly.
Deal with it by using existing quirk which allocates a dummy page after each transfer ring segment. This was seen to resolve both problems. RPi came up with a more efficient solution, shortening each segment by four TRBs, but it complicated the driver and they ditched it for this quirk.
Also rename the quirk and add VL805 device ID macro.
--- drivers/usb/host/xhci-mem.c | 3 ++- drivers/usb/host/xhci-pci.c | 10 +++++++--- drivers/usb/host/xhci.h | 2 +- 3 files changed, 10 insertions(+), 5 deletions(-)
drivers/usb/host/xhci-mem.c +2 -1
@@ -2364,7 +2364,8 @@ int xhci_mem_init(struct xhci_hcd *xhci,* and our use of dma addresses in the trb_address_map radix tree needs * TRB_SEGMENT_SIZE alignment, so we pick the greater alignment need. */ -if (xhci->quirks &XHCI_ZHAOXIN_TRB_FETCH ) +if (xhci->quirks &XHCI_TRB_OVERFETCH ) +/* Buggy HC prefetches beyond segment bounds - allocate dummy space at the end */ xhci->segment_pool =dma_pool_create ("xHCI ring segments" , dev,TRB_SEGMENT_SIZE *2 ,TRB_SEGMENT_SIZE *2 , xhci->page_size *2 );else
drivers/usb/host/xhci-pci.c +7 -3
@@ -38,6 +38,8 @@#define PCI_DEVICE_ID_EJ168 0x7023#define PCI_DEVICE_ID_EJ188 0x7052 +#define PCI_DEVICE_ID_VIA_VL805 0x3483 +#define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI 0x9cb1
@@ -480,8 +482,10 @@ static void xhci_pci_quirks(struct devic pdev->device == 0x3432) xhci->quirks |=XHCI_BROKEN_STREAMS ; -if (pdev->vendor ==PCI_VENDOR_ID_VIA && pdev->device ==0x3483 ) +if (pdev->vendor ==PCI_VENDOR_ID_VIA && pdev->device ==PCI_DEVICE_ID_VIA_VL805 ) { xhci->quirks |=XHCI_LPM_SUPPORT ; + xhci->quirks |=XHCI_TRB_OVERFETCH ; + }if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && pdev->device ==PCI_DEVICE_ID_ASMEDIA_1042_XHCI ) {
@@ -529,11 +533,11 @@ static void xhci_pci_quirks(struct devicif (pdev->device ==0x9202 ) { xhci->quirks |=XHCI_RESET_ON_RESUME ; - xhci->quirks |=XHCI_ZHAOXIN_TRB_FETCH ; + xhci->quirks |=XHCI_TRB_OVERFETCH ; }if (pdev->device ==0x9203 ) - xhci->quirks |=XHCI_ZHAOXIN_TRB_FETCH ; + xhci->quirks |=XHCI_TRB_OVERFETCH ; } if (pdev->vendor == PCI_DEVICE_ID_CADENCE &&
drivers/usb/host/xhci.h +1 -1
@@ -1657,7 +1657,7 @@ struct xhci_hcd {#define XHCI_EP_CTX_BROKEN_DCS BIT_ULL(42)#define XHCI_SUSPEND_RESUME_CLKS BIT_ULL(43)#define XHCI_RESET_TO_DEFAULT BIT_ULL(44) -#define XHCI_ZHAOXIN_TRB_FETCH BIT_ULL(45) +#define XHCI_TRB_OVERFETCH BIT_ULL(45)#define XHCI_ZHAOXIN_HOST BIT_ULL(46)#define XHCI_WRITE_64_HI_LO BIT_ULL(47)#define XHCI_CDNS_SCTX_QUIRK BIT_ULL(48)
Greg Kroah-Hartman
maintainerPATCH 110/145 KVM: SVM: Drop DEBUGCTL[5:2] from guests effective value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit ee89e8013383d50a27ea9bf3c8a69eed6799856f upstream.
Drop bits 5:2 from the guest's effective DEBUGCTL value, as AMD changed the architectural behavior of the bits and broke backwards compatibility. On CPUs without BusLockTrap (or at least, in APMs from before ~2023), bits 5:2 controlled the behavior of external pins:
Performance-Monitoring/Breakpoint Pin-Control (PBi)—Bits 5:2, read/write. Software uses thesebits to control the type of information reported by the four external performance-monitoring/breakpoint pins on the processor. When a PBi bit is cleared to 0, the corresponding external pin (BPi) reports performance-monitor information. When a PBi bit is set to 1, the corresponding external pin (BPi) reports breakpoint information.
With the introduction of BusLockTrap, presumably to be compatible with Intel CPUs, AMD redefined bit 2 to be BLCKDB:
Bus Lock #DB Trap (BLCKDB)—Bit 2, read/write. Software sets this bit to enable generation of a #DB trap following successful execution of a bus lock when CPL is > 0.
and redefined bits 5:3 (and bit 6) as "6:3 Reserved MBZ".
Ideally, KVM would treat bits 5:2 as reserved. Defer that change to a feature cleanup to avoid breaking existing guest in LTS kernels. For now, drop the bits to retain backwards compatibility (of a sort).
Note, dropping bits 5:2 is still a guest-visible change, e.g. if the guest is enabling LBRs *and* the legacy PBi bits, then the state of the PBi bits is visible to the guest, whereas now the guest will always see '0'.
--- arch/x86/kvm/svm/svm.c | 12 ++++++++++++ arch/x86/kvm/svm/svm.h | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-)
arch/x86/kvm/svm/svm.c +12 -0
@@ -3156,6 +3156,18 @@ static int svm_set_msr(struct kvm_vcpu *kvm_pr_unimpl_wrmsr (vcpu, ecx, data);break ; } + +/* +* AMD changed the architectural behavior of bits 5:2. On CPUs +* without BusLockTrap, bits 5:2 control "external pins", but +* on CPUs that support BusLockDetect, bit 2 enables BusLockTrap +* and bits 5:3 are reserved-to-zero. Sadly, old KVM allowed +* the guest to set bits 5:2 despite not actually virtualizing +* Performance-Monitoring/Breakpoint external pins. Drop bits +* 5:2 for backwards compatibility. +*/ + data &= ~GENMASK (5 ,2 ); +if (data &DEBUGCTL_RESERVED_BITS )return 1 ;
arch/x86/kvm/svm/svm.h +1 -1
@@ -533,7 +533,7 @@ static inline bool is_vnmi_enabled(struc/* svm.c */ #define MSR_INVALID 0xffffffffU -#define DEBUGCTL_RESERVED_BITS (~(0x3fULL)) +#define DEBUGCTL_RESERVED_BITS (~(DEBUGCTLMSR_BTF | DEBUGCTLMSR_LBR))extern bool dump_invalid_vmcb;
Greg Kroah-Hartman
maintainerPATCH 111/145 KVM: SVM: Suppress DEBUGCTL.BTF on AMD
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit d0eac42f5cecce009d315655bee341304fbe075e upstream.
Mark BTF as reserved in DEBUGCTL on AMD, as KVM doesn't actually support BTF, and fully enabling BTF virtualization is non-trivial due to interactions with the emulator, guest_debug, #DB interception, nested SVM, etc.
Don't inject #GP if the guest attempts to set BTF, as there's no way to communicate lack of support to the guest, and instead suppress the flag and treat the WRMSR as (partially) unsupported.
In short, make KVM behave the same on AMD and Intel (VMX already squashes BTF).
Note, due to other bugs in KVM's handling of DEBUGCTL, the only way BTF has "worked" in any capacity is if the guest simultaneously enables LBRs.
--- arch/x86/kvm/svm/svm.c | 9 +++++++++ arch/x86/kvm/svm/svm.h | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-)
arch/x86/kvm/svm/svm.c +9 -0
@@ -3168,6 +3168,15 @@ static int svm_set_msr(struct kvm_vcpu **/ data &= ~GENMASK (5 ,2 ); +/* +* Suppress BTF as KVM doesn't virtualize BTF, but there's no +* way to communicate lack of support to the guest. +*/ +if (data &DEBUGCTLMSR_BTF ) { +kvm_pr_unimpl_wrmsr (vcpu,MSR_IA32_DEBUGCTLMSR , data); + data &= ~DEBUGCTLMSR_BTF ; + } +if (data &DEBUGCTL_RESERVED_BITS )return 1 ;
arch/x86/kvm/svm/svm.h +1 -1
@@ -533,7 +533,7 @@ static inline bool is_vnmi_enabled(struc/* svm.c */ #define MSR_INVALID 0xffffffffU -#define DEBUGCTL_RESERVED_BITS (~(DEBUGCTLMSR_BTF | DEBUGCTLMSR_LBR)) +#define DEBUGCTL_RESERVED_BITS (~DEBUGCTLMSR_LBR)extern bool dump_invalid_vmcb;
Greg Kroah-Hartman
maintainerPATCH 112/145 KVM: x86: Explicitly zero EAX and EBX when PERFMON_V2 isnt supported by KVM
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <[email protected]>
commit f9dc8fb3afc968042bdaf4b6e445a9272071c9f3 upstream.
Fix a goof where KVM sets CPUID.0x80000022.EAX to CPUID.0x80000022.EBX instead of zeroing both when PERFMON_V2 isn't supported by KVM. In practice, barring a buggy CPU (or vCPU model when running nested) only the !enable_pmu case is affected, as KVM always supports PERFMON_V2 if it's available in hardware, i.e. CPUID.0x80000022.EBX will be '0' if PERFMON_V2 is unsupported.
For the !enable_pmu case, the bug is relatively benign as KVM will refuse to enable PMU capabilities, but a VMM that reflects KVM's supported CPUID into the guest could inadvertently induce #GPs in the guest due to advertising support for MSRs that KVM refuses to emulate.
--- arch/x86/kvm/cpuid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/cpuid.c +1 -1
@@ -1307,7 +1307,7 @@ static inline int __do_cpuid_func(struct entry->ecx = entry->edx =0 ;if (!enable_pmu || !kvm_cpu_cap_has (X86_FEATURE_PERFMON_V2 )) { - entry->eax = entry->ebx; + entry->eax = entry->ebx =0 ;break ; }
Greg Kroah-Hartman
maintainerPATCH 113/145 cdx: Fix possible UAF error in driver_override_show()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiu-ji Chen <[email protected]>
commit 91d44c1afc61a2fec37a9c7a3485368309391e0b upstream.
Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c
This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs.
The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users.
Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues.
This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations.
--- drivers/cdx/cdx.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/cdx/cdx.c +5 -1
@@ -365,8 +365,12 @@ static ssize_t driver_override_show(stru struct device_attribute *attr, char *buf) { struct cdx_device *cdx_dev = to_cdx_device(dev); +ssize_t len; -return sysfs_emit (buf,"%s\n" , cdx_dev->driver_override); +device_lock (dev); + len =sysfs_emit (buf,"%s\n" , cdx_dev->driver_override); +device_unlock (dev); +return len; }static DEVICE_ATTR_RW (driver_override);
Greg Kroah-Hartman
maintainerPATCH 114/145 mei: me: add panther lake P DID
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit a8e8ffcc3afce2ee5fb70162aeaef3f03573ee1e upstream.
Add Panther Lake P device id.
--- drivers/misc/mei/hw-me-regs.h | 2 ++ drivers/misc/mei/pci-me.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/misc/mei/hw-me-regs.h +2 -0
@@ -117,6 +117,8 @@#define MEI_DEV_ID_LNL_M 0xA870/* Lunar Lake Point M */ +#define MEI_DEV_ID_PTL_P 0xE470/* Panther Lake P */ +/* * MEI HW Section */
drivers/misc/mei/pci-me.c +2 -0
@@ -124,6 +124,8 @@ static const struct pci_device_id mei_me {MEI_PCI_DEVICE(MEI_DEV_ID_LNL_M, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)}, +/* required last entry */ {0, } };
Greg Kroah-Hartman
maintainerPATCH 115/145 intel_th: pci: Add Arrow Lake support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Chmielewski <[email protected]>
commit b5edccae9f447a92d475267d94c33f4926963eec upstream.
Add support for the Trace Hub in Arrow Lake.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -330,6 +330,11 @@ static const struct pci_device_id intel_ .driver_data = (kernel_ulong_t)&intel_th_2x, }, { +/* Arrow Lake */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7724), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + {/* Alder Lake CPU */ PCI_DEVICE (PCI_VENDOR_ID_INTEL ,0x466f ), .driver_data = (kernel_ulong_t)&intel_th_2x,
Greg Kroah-Hartman
maintainerPATCH 116/145 intel_th: pci: Add Panther Lake-H support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <[email protected]>
commit a70034d6c0d5f3cdee40bb00a578e17fd2ebe426 upstream.
Add support for the Trace Hub in Panther Lake-H.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -335,6 +335,11 @@ static const struct pci_device_id intel_ .driver_data = (kernel_ulong_t)&intel_th_2x, }, { +/* Panther Lake-H */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe324), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + {/* Alder Lake CPU */ PCI_DEVICE (PCI_VENDOR_ID_INTEL ,0x466f ), .driver_data = (kernel_ulong_t)&intel_th_2x,
Greg Kroah-Hartman
maintainerPATCH 117/145 intel_th: pci: Add Panther Lake-P/U support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <[email protected]>
commit 49114ff05770264ae233f50023fc64a719a9dcf9 upstream.
Add support for the Trace Hub in Panther Lake-P/U.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -340,6 +340,11 @@ static const struct pci_device_id intel_ .driver_data = (kernel_ulong_t)&intel_th_2x, }, { +/* Panther Lake-P/U */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe424), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + {/* Alder Lake CPU */ PCI_DEVICE (PCI_VENDOR_ID_INTEL ,0x466f ), .driver_data = (kernel_ulong_t)&intel_th_2x,
Greg Kroah-Hartman
maintainerPATCH 118/145 char: misc: deallocate static minor in error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit 6d991f569c5ef6eaeadf1238df2c36e3975233ad upstream.
When creating sysfs files fail, the allocated minor must be freed such that it can be later reused. That is specially harmful for static minor numbers, since those would always fail to register later on.
--- drivers/char/misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/misc.c +1 -1
@@ -264,8 +264,8 @@ int misc_register(struct miscdevice *misdevice_create_with_groups (&misc_class, misc->parent, dev, misc, misc->groups,"%s" , misc->name);if (IS_ERR (misc->this_device)) { +misc_minor_free (misc->minor);if (is_dynamic) { -misc_minor_free (misc->minor); misc->minor =MISC_DYNAMIC_MINOR ; } err =PTR_ERR (misc->this_device);
Greg Kroah-Hartman
maintainerPATCH 119/145 drivers: core: fix device leak in __fw_devlink_relax_cycles()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
commit 78eb41f518f414378643ab022241df2a9dcd008b upstream.
Commit bac3b10b78e5 ("driver core: fw_devlink: Stop trying to optimize cycle detection logic") introduced a new struct device *con_dev and a get_dev_from_fwnode() call to get it, but without adding a corresponding put_device().
--- drivers/base/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/base/core.c +1 -0
@@ -2026,6 +2026,7 @@ static bool __fw_devlink_relax_cycles(st out: sup_handle->flags &= ~FWNODE_FLAG_VISITED ;put_device (sup_dev); +put_device (con_dev);put_device (par_dev);return ret; }
Greg Kroah-Hartman
maintainerPATCH 120/145 slimbus: messaging: Free transaction ID in delayed interrupt scenario
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Visweswara Tanuku <[email protected]>
commit dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a upstream.
In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not freed. This results into invalid memory access inside qcom_slim_ngd_rx_msgq_cb() due to invalid TID.
Fix the issue by freeing the TID in slim_do_transfer() before returning timeout error to avoid invalid memory access.
Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 Code: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ end trace 0fe00bec2b975c99 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt.
--- drivers/slimbus/messaging.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/slimbus/messaging.c +3 -2
@@ -147,8 +147,9 @@ int slim_do_transfer(struct slim_control } ret = ctrl->xfer_msg (ctrl, txn); - -if (!ret && need_tid && !txn->msg->comp) { +if (ret == -ETIMEDOUT ) { +slim_free_txn_tid (ctrl, txn); + }else if (!ret && need_tid && !txn->msg->comp) {unsigned long ms = txn->rl +HZ ; timeout = wait_for_completion_timeout(txn->comp,
Greg Kroah-Hartman
maintainerPATCH 121/145 bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
commit a321d163de3d8aa38a6449ab2becf4b1581aed96 upstream.
There are multiple places from where the recovery work gets scheduled asynchronously. Also, there are multiple places where the caller waits synchronously for the recovery to be completed. One such place is during the PM shutdown() callback.
If the device is not alive during recovery_work, it will try to reset the device using pci_reset_function(). This function internally will take the device_lock() first before resetting the device. By this time, if the lock has already been acquired, then recovery_work will get stalled while waiting for the lock. And if the lock was already acquired by the caller which waits for the recovery_work to be completed, it will lead to deadlock.
This is what happened on the X1E80100 CRD device when the device died before shutdown() callback. Driver core calls the driver's shutdown() callback while holding the device_lock() leading to deadlock.
And this deadlock scenario can occur on other paths as well, like during the PM suspend() callback, where the driver core would hold the device_lock() before calling driver's suspend() callback. And if the recovery_work was already started, it could lead to deadlock. This is also observed on the X1E80100 CRD.
So to fix both issues, use pci_try_reset_function() in recovery_work. This function first checks for the availability of the device_lock() before trying to reset the device. If the lock is available, it will acquire it and reset the device. Otherwise, it will return -EAGAIN. If that happens, recovery_work will fail with the error message "Recovery failed" as not much could be done.
--- drivers/bus/mhi/host/pci_generic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/bus/mhi/host/pci_generic.c +3 -2
@@ -892,8 +892,9 @@ static void mhi_pci_recovery_work(struct err_unprepare:mhi_unprepare_after_power_down (mhi_cntrl); err_try_reset: -if (pci_reset_function (pdev)) -dev_err (&pdev->dev,"Recovery failed\n" ); + err =pci_try_reset_function (pdev); +if (err) +dev_err (&pdev->dev,"Recovery failed: %d\n" , err); }static void health_check (struct timer_list *t)
Greg Kroah-Hartman
maintainerPATCH 122/145 eeprom: digsy_mtc: Make GPIO lookup table match the device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 038ef0754aae76f79b147b8867f9250e6a976872 upstream.
The dev_id value in the GPIO lookup table must match to the device instance name, which in this case is combined of name and platform device ID, i.e. "spi_gpio.1". But the table assumed that there was no platform device ID defined, which is wrong. Fix the dev_id value accordingly.
--- drivers/misc/eeprom/digsy_mtc_eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/eeprom/digsy_mtc_eeprom.c +1 -1
@@ -60,7 +60,7 @@ static struct platform_device digsy_mtc_ };static struct gpiod_lookup_table eeprom_spi_gpiod_table = { - .dev_id ="spi_gpio" , + .dev_id ="spi_gpio.1" , .table = {GPIO_LOOKUP ("gpio@b00" ,GPIO_EEPROM_CLK ,"sck" ,GPIO_ACTIVE_HIGH ),
Greg Kroah-Hartman
maintainerPATCH 123/145 drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoyu Li <[email protected]>
commit 819cec1dc47cdeac8f5dd6ba81c1dbee2a68c3bb upstream.
In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", which are then copied to user space. The initializer is indeed implemented in "acrn_hypercall2" (arch/x86/include/asm/acrn.h). There is a risk of information leakage due to uninitialized bytes.
--- drivers/virt/acrn/hsm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/virt/acrn/hsm.c +3 -3
@@ -49,7 +49,7 @@ static int pmcmd_ioctl(u64 cmd, void __uswitch (cmd &PMCMD_TYPE_MASK ) {case ACRN_PMCMD_GET_PX_CNT :case ACRN_PMCMD_GET_CX_CNT : - pm_info =kmalloc (sizeof (u64),GFP_KERNEL ); + pm_info =kzalloc (sizeof (u64),GFP_KERNEL );if (!pm_info)return -ENOMEM ;
@@ -64,7 +64,7 @@ static int pmcmd_ioctl(u64 cmd, void __ukfree (pm_info);break ;case ACRN_PMCMD_GET_PX_DATA : - px_data =kmalloc (sizeof (*px_data),GFP_KERNEL ); + px_data =kzalloc (sizeof (*px_data),GFP_KERNEL );if (!px_data)return -ENOMEM ;
@@ -79,7 +79,7 @@ static int pmcmd_ioctl(u64 cmd, void __ukfree (px_data);break ;case ACRN_PMCMD_GET_CX_DATA : - cx_data =kmalloc (sizeof (*cx_data),GFP_KERNEL ); + cx_data =kzalloc (sizeof (*cx_data),GFP_KERNEL );if (!cx_data)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 124/145 iio: filter: admv8818: Force initialization of SDO
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Winchenbach <[email protected]>
commit cc2c3540d9477a9931fb0fd851fcaeba524a5b35 upstream.
When a weak pull-up is present on the SDO line, regmap_update_bits fails to write both the SOFTRESET and SDOACTIVE bits because it incorrectly reads them as already set.
Since the soft reset disables the SDO line, performing a read-modify-write operation on ADI_SPI_CONFIG_A to enable the SDO line doesn't make sense. This change directly writes to the register instead of using regmap_update_bits.
--- drivers/iio/filter/admv8818.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/iio/filter/admv8818.c +4 -10
@@ -574,21 +574,15 @@ static int admv8818_init(struct admv8818struct spi_device *spi = st->spi;unsigned int chip_id; - ret =regmap_update_bits (st->regmap,ADMV8818_REG_SPI_CONFIG_A , -ADMV8818_SOFTRESET_N_MSK | -ADMV8818_SOFTRESET_MSK , -FIELD_PREP (ADMV8818_SOFTRESET_N_MSK ,1 ) | -FIELD_PREP (ADMV8818_SOFTRESET_MSK ,1 )); + ret =regmap_write (st->regmap,ADMV8818_REG_SPI_CONFIG_A , +ADMV8818_SOFTRESET_N_MSK |ADMV8818_SOFTRESET_MSK );if (ret) {dev_err (&spi->dev,"ADMV8818 Soft Reset failed.\n" );return ret; } - ret =regmap_update_bits (st->regmap,ADMV8818_REG_SPI_CONFIG_A , -ADMV8818_SDOACTIVE_N_MSK | -ADMV8818_SDOACTIVE_MSK , -FIELD_PREP (ADMV8818_SDOACTIVE_N_MSK ,1 ) | -FIELD_PREP (ADMV8818_SDOACTIVE_MSK ,1 )); + ret =regmap_write (st->regmap,ADMV8818_REG_SPI_CONFIG_A , +ADMV8818_SDOACTIVE_N_MSK |ADMV8818_SDOACTIVE_MSK );if (ret) {dev_err (&spi->dev,"ADMV8818 SDO Enable failed.\n" );return ret;
Greg Kroah-Hartman
maintainerPATCH 125/145 iio: dac: ad3552r: clear reset status flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Angelo Dureghello <[email protected]>
commit e17b9f20da7d2bc1f48878ab2230523b2512d965 upstream.
Clear reset status flag, to keep error status register clean after reset (ad3552r manual, rev B table 38).
Reset error flag was left to 1, so debugging registers, the "Error Status Register" was dirty (0x01). It is important to clear this bit, so if there is any reset event over normal working mode, it is possible to detect it.
--- drivers/iio/dac/ad3552r.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/iio/dac/ad3552r.c +6 -0
@@ -703,6 +703,12 @@ static int ad3552r_reset(struct ad3552r_return ret; } +/* Clear reset error flag, see ad3552r manual, rev B table 38. */ + ret =ad3552r_write_reg (dac,AD3552R_REG_ADDR_ERR_STATUS , +AD3552R_MASK_RESET_STATUS ); +if (ret) +return ret; + return ad3552r_update_reg_field(dac, addr_mask_map[AD3552R_ADDR_ASCENSION][0], addr_mask_map[AD3552R_ADDR_ASCENSION][1],
Greg Kroah-Hartman
maintainerPATCH 126/145 iio: adc: at91-sama5d2_adc: fix sama7g5 realbits value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayab Sayed <[email protected]>
commit aa5119c36d19639397d29ef305aa53a5ecd72b27 upstream.
The number of valid bits in SAMA7G5 ADC channel data register are 16. Hence changing the realbits value to 16
--- drivers/iio/adc/at91-sama5d2_adc.c | 68 +++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 28 deletions(-)
drivers/iio/adc/at91-sama5d2_adc.c +40 -28
@@ -329,7 +329,7 @@ static const struct at91_adc_reg_layout#define AT91_HWFIFO_MAX_SIZE_STR "128"#define AT91_HWFIFO_MAX_SIZE 128 -#define AT91_SAMA5D2_CHAN_SINGLE (index, num, addr) \ +#define AT91_SAMA_CHAN_SINGLE (index, num, addr, rbits) \ { \ .type = IIO_VOLTAGE, \ .channel = num, \
@@ -337,7 +337,7 @@ static const struct at91_adc_reg_layout .scan_index = index, \ .scan_type = { \ .sign = 'u', \ - .realbits = 14, \ + .realbits = rbits, \ .storagebits = 16, \ }, \ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \
@@ -350,7 +350,13 @@ static const struct at91_adc_reg_layout .indexed = 1, \ } -#define AT91_SAMA5D2_CHAN_DIFF (index, num, num2, addr) \ +#define AT91_SAMA5D2_CHAN_SINGLE (index, num, addr) \ + AT91_SAMA_CHAN_SINGLE(index, num, addr, 14) + +#define AT91_SAMA7G5_CHAN_SINGLE (index, num, addr) \ + AT91_SAMA_CHAN_SINGLE(index, num, addr, 16) + +#define AT91_SAMA_CHAN_DIFF (index, num, num2, addr, rbits) \ { \ .type = IIO_VOLTAGE, \ .differential = 1, \
@@ -360,7 +366,7 @@ static const struct at91_adc_reg_layout .scan_index = index, \ .scan_type = { \ .sign = 's', \ - .realbits = 14, \ + .realbits = rbits, \ .storagebits = 16, \ }, \ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \
@@ -373,6 +379,12 @@ static const struct at91_adc_reg_layout .indexed = 1, \ } +#define AT91_SAMA5D2_CHAN_DIFF (index, num, num2, addr) \ + AT91_SAMA_CHAN_DIFF(index, num, num2, addr, 14) + +#define AT91_SAMA7G5_CHAN_DIFF (index, num, num2, addr) \ + AT91_SAMA_CHAN_DIFF(index, num, num2, addr, 16) +#define AT91_SAMA5D2_CHAN_TOUCH (num, name, mod) \ { \ .type = IIO_POSITIONRELATIVE, \
@@ -666,30 +678,30 @@ static const struct iio_chan_spec at91_s };static const struct iio_chan_spec at91_sama7g5_adc_channels[] = { -AT91_SAMA5D2_CHAN_SINGLE (0 ,0 ,0x60 ), -AT91_SAMA5D2_CHAN_SINGLE (1 ,1 ,0x64 ), -AT91_SAMA5D2_CHAN_SINGLE (2 ,2 ,0x68 ), -AT91_SAMA5D2_CHAN_SINGLE (3 ,3 ,0x6c ), -AT91_SAMA5D2_CHAN_SINGLE (4 ,4 ,0x70 ), -AT91_SAMA5D2_CHAN_SINGLE (5 ,5 ,0x74 ), -AT91_SAMA5D2_CHAN_SINGLE (6 ,6 ,0x78 ), -AT91_SAMA5D2_CHAN_SINGLE (7 ,7 ,0x7c ), -AT91_SAMA5D2_CHAN_SINGLE (8 ,8 ,0x80 ), -AT91_SAMA5D2_CHAN_SINGLE (9 ,9 ,0x84 ), -AT91_SAMA5D2_CHAN_SINGLE (10 ,10 ,0x88 ), -AT91_SAMA5D2_CHAN_SINGLE (11 ,11 ,0x8c ), -AT91_SAMA5D2_CHAN_SINGLE (12 ,12 ,0x90 ), -AT91_SAMA5D2_CHAN_SINGLE (13 ,13 ,0x94 ), -AT91_SAMA5D2_CHAN_SINGLE (14 ,14 ,0x98 ), -AT91_SAMA5D2_CHAN_SINGLE (15 ,15 ,0x9c ), -AT91_SAMA5D2_CHAN_DIFF (16 ,0 ,1 ,0x60 ), -AT91_SAMA5D2_CHAN_DIFF (17 ,2 ,3 ,0x68 ), -AT91_SAMA5D2_CHAN_DIFF (18 ,4 ,5 ,0x70 ), -AT91_SAMA5D2_CHAN_DIFF (19 ,6 ,7 ,0x78 ), -AT91_SAMA5D2_CHAN_DIFF (20 ,8 ,9 ,0x80 ), -AT91_SAMA5D2_CHAN_DIFF (21 ,10 ,11 ,0x88 ), -AT91_SAMA5D2_CHAN_DIFF (22 ,12 ,13 ,0x90 ), -AT91_SAMA5D2_CHAN_DIFF (23 ,14 ,15 ,0x98 ), +AT91_SAMA7G5_CHAN_SINGLE (0 ,0 ,0x60 ), +AT91_SAMA7G5_CHAN_SINGLE (1 ,1 ,0x64 ), +AT91_SAMA7G5_CHAN_SINGLE (2 ,2 ,0x68 ), +AT91_SAMA7G5_CHAN_SINGLE (3 ,3 ,0x6c ), +AT91_SAMA7G5_CHAN_SINGLE (4 ,4 ,0x70 ), +AT91_SAMA7G5_CHAN_SINGLE (5 ,5 ,0x74 ), +AT91_SAMA7G5_CHAN_SINGLE (6 ,6 ,0x78 ), +AT91_SAMA7G5_CHAN_SINGLE (7 ,7 ,0x7c ), +AT91_SAMA7G5_CHAN_SINGLE (8 ,8 ,0x80 ), +AT91_SAMA7G5_CHAN_SINGLE (9 ,9 ,0x84 ), +AT91_SAMA7G5_CHAN_SINGLE (10 ,10 ,0x88 ), +AT91_SAMA7G5_CHAN_SINGLE (11 ,11 ,0x8c ), +AT91_SAMA7G5_CHAN_SINGLE (12 ,12 ,0x90 ), +AT91_SAMA7G5_CHAN_SINGLE (13 ,13 ,0x94 ), +AT91_SAMA7G5_CHAN_SINGLE (14 ,14 ,0x98 ), +AT91_SAMA7G5_CHAN_SINGLE (15 ,15 ,0x9c ), +AT91_SAMA7G5_CHAN_DIFF (16 ,0 ,1 ,0x60 ), +AT91_SAMA7G5_CHAN_DIFF (17 ,2 ,3 ,0x68 ), +AT91_SAMA7G5_CHAN_DIFF (18 ,4 ,5 ,0x70 ), +AT91_SAMA7G5_CHAN_DIFF (19 ,6 ,7 ,0x78 ), +AT91_SAMA7G5_CHAN_DIFF (20 ,8 ,9 ,0x80 ), +AT91_SAMA7G5_CHAN_DIFF (21 ,10 ,11 ,0x88 ), +AT91_SAMA7G5_CHAN_DIFF (22 ,12 ,13 ,0x90 ), +AT91_SAMA7G5_CHAN_DIFF (23 ,14 ,15 ,0x98 ),IIO_CHAN_SOFT_TIMESTAMP (24 ),AT91_SAMA5D2_CHAN_TEMP (AT91_SAMA7G5_ADC_TEMP_CHANNEL ,"temp" ,0xdc ), };
Greg Kroah-Hartman
maintainerPATCH 127/145 mm: hugetlb: Add huge page size param to huge_ptep_get_and_clear()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
commit 02410ac72ac3707936c07ede66e94360d0d65319 upstream.
In order to fix a bug, arm64 needs to be told the size of the huge page for which the huge_pte is being cleared in huge_ptep_get_and_clear(). Provide for this by adding an unsigned long sz parameter to the function. This follows the same pattern as huge_pte_clear() and set_huge_pte_at().
This commit makes the required interface modifications to the core mm as well as all arches that implement this function (arm64, loongarch, mips, parisc, powerpc, riscv, s390, sparc). The actual arm64 bug will be fixed in a separate commit.
--- arch/arm64/include/asm/hugetlb.h | 4 ++-- arch/arm64/mm/hugetlbpage.c | 8 +++++--- arch/loongarch/include/asm/hugetlb.h | 6 ++++-- arch/mips/include/asm/hugetlb.h | 6 ++++-- arch/parisc/include/asm/hugetlb.h | 2 +- arch/parisc/mm/hugetlbpage.c | 2 +- arch/powerpc/include/asm/hugetlb.h | 6 ++++-- arch/riscv/include/asm/hugetlb.h | 3 ++- arch/riscv/mm/hugetlbpage.c | 2 +- arch/s390/include/asm/hugetlb.h | 17 ++++++++++++----- arch/s390/mm/hugetlbpage.c | 4 ++-- arch/sparc/include/asm/hugetlb.h | 2 +- arch/sparc/mm/hugetlbpage.c | 2 +- include/asm-generic/hugetlb.h | 2 +- include/linux/hugetlb.h | 4 +++- mm/hugetlb.c | 4 ++-- 16 files changed, 46 insertions(+), 28 deletions(-)
arch/arm64/include/asm/hugetlb.h +2 -2
@@ -34,8 +34,8 @@ extern int huge_ptep_set_access_flags(st unsigned long addr, pte_t *ptep, pte_t pte, int dirty);#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEAR -extern pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep); +extern pte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, +pte_t *ptep,unsigned long sz);#define __HAVE_ARCH_HUGE_PTEP_SET_WRPROTECTextern void huge_ptep_set_wrprotect (struct mm_struct *mm,unsigned long addr,pte_t *ptep);
arch/arm64/mm/hugetlbpage.c +5 -3
@@ -403,8 +403,8 @@ void huge_pte_clear(struct mm_struct *mmpte_clear (mm, addr, ptep); } -pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +pte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, +pte_t *ptep,unsigned long sz) {int ncontig;size_t pgsize;
@@ -556,6 +556,8 @@ bool __init arch_hugetlb_valid_size(unsipte_t huge_ptep_modify_prot_start (struct vm_area_struct *vma,unsigned long addr,pte_t *ptep) { +unsigned long psize =huge_page_size (hstate_vma (vma)); +if (IS_ENABLED (CONFIG_ARM64_ERRATUM_2645198 ) &&cpus_have_const_cap (ARM64_WORKAROUND_2645198 )) {/*
@@ -566,7 +568,7 @@ pte_t huge_ptep_modify_prot_start(structif (pte_user_exec (READ_ONCE (*ptep)))return huge_ptep_clear_flush (vma, addr, ptep); } -return huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); +return huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, psize); } void huge_ptep_modify_prot_commit(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep,
arch/loongarch/include/asm/hugetlb.h +4 -2
@@ -41,7 +41,8 @@ static inline void huge_pte_clear(struct#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARstatic inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +unsigned long addr,pte_t *ptep, +unsigned long sz) {pte_t clear;pte_t pte = *ptep;
@@ -56,8 +57,9 @@ static inline pte_t huge_ptep_clear_flus unsigned long addr, pte_t *ptep) { pte_t pte; +unsigned long sz =huge_page_size (hstate_vma (vma)); - pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); + pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, sz);flush_tlb_page (vma, addr);return pte; }
arch/mips/include/asm/hugetlb.h +4 -2
@@ -32,7 +32,8 @@ static inline int prepare_hugepage_range#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARstatic inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +unsigned long addr,pte_t *ptep, +unsigned long sz) {pte_t clear;pte_t pte = *ptep;
@@ -47,13 +48,14 @@ static inline pte_t huge_ptep_clear_flus unsigned long addr, pte_t *ptep) { pte_t pte; +unsigned long sz =huge_page_size (hstate_vma (vma));/* * clear the huge pte entry firstly, so that the other smp threads will * not get old pte entry after finishing flush_tlb_page and before * setting new huge pte entry */ - pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); + pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, sz);flush_tlb_page (vma, addr);return pte; }
arch/parisc/include/asm/hugetlb.h +1 -1
@@ -10,7 +10,7 @@ void set_huge_pte_at(struct mm_struct *m#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARpte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep); +pte_t *ptep,unsigned long sz);/* * If the arch doesn't supply something else, assume that hugepage
arch/parisc/mm/hugetlbpage.c +1 -1
@@ -147,7 +147,7 @@ void set_huge_pte_at(struct mm_struct *mpte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep) +pte_t *ptep,unsigned long sz) {pte_t entry;
arch/powerpc/include/asm/hugetlb.h +4 -2
@@ -46,7 +46,8 @@ void hugetlb_free_pgd_range(struct mmu_g#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARstatic inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +unsigned long addr,pte_t *ptep, +unsigned long sz) {return __pte (pte_update (mm, addr, ptep, ~0UL ,0 ,1 )); }
@@ -56,8 +57,9 @@ static inline pte_t huge_ptep_clear_flus unsigned long addr, pte_t *ptep) { pte_t pte; +unsigned long sz =huge_page_size (hstate_vma (vma)); - pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); + pte =huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, sz);flush_hugetlb_page (vma, addr);return pte; }
arch/riscv/include/asm/hugetlb.h +2 -1
@@ -28,7 +28,8 @@ void set_huge_pte_at(struct mm_struct *m#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARpte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep); +unsigned long addr,pte_t *ptep, +unsigned long sz);#define __HAVE_ARCH_HUGE_PTEP_CLEAR_FLUSH pte_t huge_ptep_clear_flush(struct vm_area_struct *vma,
arch/riscv/mm/hugetlbpage.c +1 -1
@@ -293,7 +293,7 @@ int huge_ptep_set_access_flags(struct vmpte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep) +pte_t *ptep,unsigned long sz) {pte_t orig_pte =ptep_get (ptep);int pte_num;
arch/s390/include/asm/hugetlb.h +12 -5
@@ -20,8 +20,15 @@ void set_huge_pte_at(struct mm_struct *mvoid __set_huge_pte_at (struct mm_struct *mm,unsigned long addr,pte_t *ptep,pte_t pte);pte_t huge_ptep_get (pte_t *ptep); -pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep); +pte_t __huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, +pte_t *ptep); + +static inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, +unsigned long addr,pte_t *ptep, +unsigned long sz) +{ +return __huge_ptep_get_and_clear (mm, addr, ptep); +}/* * If the arch doesn't supply something else, assume that hugepage
@@ -57,7 +64,7 @@ static inline void huge_pte_clear(structstatic inline pte_t huge_ptep_clear_flush (struct vm_area_struct *vma,unsigned long address,pte_t *ptep) { -return huge_ptep_get_and_clear (vma->vm_mm, address, ptep); +return __huge_ptep_get_and_clear (vma->vm_mm, address, ptep); } static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma,
@@ -66,7 +73,7 @@ static inline int huge_ptep_set_access_f {int changed = !pte_same (huge_ptep_get (ptep), pte);if (changed) { -huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); +__huge_ptep_get_and_clear (vma->vm_mm, addr, ptep);__set_huge_pte_at (vma->vm_mm, addr, ptep, pte); }return changed;
@@ -75,7 +82,7 @@ static inline int huge_ptep_set_access_fstatic inline void huge_ptep_set_wrprotect (struct mm_struct *mm,unsigned long addr,pte_t *ptep) { -pte_t pte =huge_ptep_get_and_clear (mm, addr, ptep); +pte_t pte =__huge_ptep_get_and_clear (mm, addr, ptep);__set_huge_pte_at (mm, addr, ptep,pte_wrprotect (pte)); }
arch/s390/mm/hugetlbpage.c +2 -2
@@ -174,8 +174,8 @@ pte_t huge_ptep_get(pte_t *ptep)return __rste_to_pte (pte_val (*ptep)); } -pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +pte_t __huge_ptep_get_and_clear (struct mm_struct *mm, +unsigned long addr,pte_t *ptep) {pte_t pte =huge_ptep_get (ptep);pmd_t *pmdp = (pmd_t *) ptep;
arch/sparc/include/asm/hugetlb.h +1 -1
@@ -20,7 +20,7 @@ void __set_huge_pte_at(struct mm_struct#define __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARpte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep); +pte_t *ptep,unsigned long sz);#define __HAVE_ARCH_HUGE_PTEP_CLEAR_FLUSH static inline pte_t huge_ptep_clear_flush(struct vm_area_struct *vma,
arch/sparc/mm/hugetlbpage.c +1 -1
@@ -371,7 +371,7 @@ void set_huge_pte_at(struct mm_struct *m }pte_t huge_ptep_get_and_clear (struct mm_struct *mm,unsigned long addr, -pte_t *ptep) +pte_t *ptep,unsigned long sz) {unsigned int i, nptes, orig_shift, shift;unsigned long size;
include/asm-generic/hugetlb.h +1 -1
@@ -84,7 +84,7 @@ static inline void set_huge_pte_at(struc#ifndef __HAVE_ARCH_HUGE_PTEP_GET_AND_CLEARstatic inline pte_t huge_ptep_get_and_clear (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) +unsigned long addr,pte_t *ptep,unsigned long sz) {return ptep_get_and_clear (mm, addr, ptep); }
include/linux/hugetlb.h +3 -1
@@ -1007,7 +1007,9 @@ static inline void hugetlb_count_sub(lonstatic inline pte_t huge_ptep_modify_prot_start (struct vm_area_struct *vma,unsigned long addr,pte_t *ptep) { -return huge_ptep_get_and_clear (vma->vm_mm, addr, ptep); +unsigned long psize =huge_page_size (hstate_vma (vma)); + +return huge_ptep_get_and_clear (vma->vm_mm, addr, ptep, psize); }#endif
mm/hugetlb.c +2 -2
@@ -5236,7 +5236,7 @@ static void move_huge_pte(struct vm_areaif (src_ptl != dst_ptl)spin_lock_nested (src_ptl,SINGLE_DEPTH_NESTING ); - pte =huge_ptep_get_and_clear (mm, old_addr, src_pte); + pte =huge_ptep_get_and_clear (mm, old_addr, src_pte, sz);set_huge_pte_at (mm, new_addr, dst_pte, pte, sz);if (src_ptl != dst_ptl)
@@ -5399,7 +5399,7 @@ void __unmap_hugepage_range(struct mmu_gset_vma_resv_flags (vma,HPAGE_RESV_UNMAPPED ); } - pte =huge_ptep_get_and_clear (mm, address, ptep); + pte =huge_ptep_get_and_clear (mm, address, ptep, sz);tlb_remove_huge_tlb_entry (h, tlb, ptep, address);if (huge_pte_dirty (pte))set_page_dirty (page);
Greg Kroah-Hartman
maintainerPATCH 128/145 arm64: hugetlb: Fix huge_ptep_get_and_clear() for non-present ptes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
commit 49c87f7677746f3c5bd16c81b23700bb6b88bfd4 upstream.
arm64 supports multiple huge_pte sizes. Some of the sizes are covered by a single pte entry at a particular level (PMD_SIZE, PUD_SIZE), and some are covered by multiple ptes at a particular level (CONT_PTE_SIZE, CONT_PMD_SIZE). So the function has to figure out the size from the huge_pte pointer. This was previously done by walking the pgtable to determine the level and by using the PTE_CONT bit to determine the number of ptes at the level.
But the PTE_CONT bit is only valid when the pte is present. For non-present pte values (e.g. markers, migration entries), the previous implementation was therefore erroneously determining the size. There is at least one known caller in core-mm, move_huge_pte(), which may call huge_ptep_get_and_clear() for a non-present pte. So we must be robust to this case. Additionally the "regular" ptep_get_and_clear() is robust to being called for non-present ptes so it makes sense to follow the behavior.
Fix this by using the new sz parameter which is now provided to the function. Additionally when clearing each pte in a contig range, don't gather the access and dirty bits if the pte is not present.
An alternative approach that would not require API changes would be to store the PTE_CONT bit in a spare bit in the swap entry pte for the non-present case. But it felt cleaner to follow other APIs' lead and just pass in the size.
As an aside, PTE_CONT is bit 52, which corresponds to bit 40 in the swap entry offset field (layout of non-present pte). Since hugetlb is never swapped to disk, this field will only be populated for markers, which always set this bit to 0 and hwpoison swap entries, which set the offset field to a PFN; So it would only ever be 1 for a 52-bit PVA system where memory in that high half was poisoned (I think!). So in practice, this bit would almost always be zero for non-present ptes and we would only clear the first entry if it was actually a contiguous block. That's probably a less severe symptom than if it was always interpreted as 1 and cleared out potentially-present neighboring PTEs.
--- arch/arm64/mm/hugetlbpage.c | 51 ++++++++++++++++---------------------------- 1 file changed, 19 insertions(+), 32 deletions(-)
arch/arm64/mm/hugetlbpage.c +19 -32
@@ -121,20 +121,11 @@ static int find_num_contig(struct mm_strstatic inline int num_contig_ptes (unsigned long size,size_t *pgsize) { -int contig_ptes =0 ; +int contig_ptes =1 ; *pgsize = size;switch (size) { -#ifndef __PAGETABLE_PMD_FOLDED -case PUD_SIZE : -if (pud_sect_supported ()) - contig_ptes =1 ; -break ; -#endif -case PMD_SIZE : - contig_ptes =1 ; -break ;case CONT_PMD_SIZE : *pgsize =PMD_SIZE ; contig_ptes =CONT_PMDS ;
@@ -143,6 +134,8 @@ static inline int num_contig_ptes(unsign *pgsize =PAGE_SIZE ; contig_ptes =CONT_PTES ;break ; +default : +WARN_ON (!__hugetlb_valid_size (size)); }return contig_ptes;
@@ -184,24 +177,23 @@ static pte_t get_clear_contig(struct mm_ unsigned long pgsize, unsigned long ncontig) { -pte_t orig_pte =ptep_get (ptep); -unsigned long i; +pte_t pte, tmp_pte; +bool present; -for (i =0 ; i < ncontig; i++, addr += pgsize, ptep++) { -pte_t pte =ptep_get_and_clear (mm, addr, ptep); - -/* -* If HW_AFDBM is enabled, then the HW could turn on -* the dirty or accessed bit for any page in the set, -* so check them all. -*/ -if (pte_dirty (pte)) - orig_pte =pte_mkdirty (orig_pte); - -if (pte_young (pte)) - orig_pte =pte_mkyoung (orig_pte); + pte =ptep_get_and_clear (mm, addr, ptep); + present =pte_present (pte); +while (--ncontig) { + ptep++; + addr += pgsize; + tmp_pte =ptep_get_and_clear (mm, addr, ptep); +if (present) { +if (pte_dirty (tmp_pte)) + pte =pte_mkdirty (pte); +if (pte_young (tmp_pte)) + pte =pte_mkyoung (pte); + } } -return orig_pte; +return pte; } static pte_t get_clear_contig_flush(struct mm_struct *mm,
@@ -408,13 +400,8 @@ pte_t huge_ptep_get_and_clear(struct mm_ {int ncontig;size_t pgsize; -pte_t orig_pte =ptep_get (ptep); - -if (!pte_cont (orig_pte)) -return ptep_get_and_clear (mm, addr, ptep); - - ncontig =find_num_contig (mm, addr, ptep, &pgsize); + ncontig =num_contig_ptes (sz, &pgsize);return get_clear_contig (mm, addr, ptep, pgsize, ncontig); }
Greg Kroah-Hartman
maintainerPATCH 129/145 kbuild: hdrcheck: fix cross build with clang
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 02e9a22ceef0227175e391902d8760425fa072c6 ]
The headercheck tries to call clang with a mix of compiler arguments that don't include the target architecture. When building e.g. x86 headers on arm64, this produces a warning like
clang: warning: unknown platform, assuming -mfloat-abi=soft
Add in the KBUILD_CPPFLAGS, which contain the target, in order to make it build properly.
See also 1b71c2fb04e7 ("kbuild: userprogs: fix bitsize and target detection on clang").
--- usr/include/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
usr/include/Makefile +1 -1
@@ -10,7 +10,7 @@ UAPI_CFLAGS := -std=c90 -Wall -Werror=implicit-function-declaration # In theory, we do not care -m32 or -m64 for header compile tests. # It is here just because CONFIG_CC_CAN_LINK is tested with -m32 or -m64. -UAPI_CFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) +UAPI_CFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) # USERCFLAGS might contain sysroot location for CC. UAPI_CFLAGS += $(USERCFLAGS)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/145 ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit d0bbe332669c5db32c8c92bc967f8e7f8d460ddf upstream.
The alternative path leads to a build error after a recent change:
sound/pci/hda/patch_realtek.c: In function 'alc233_fixup_lenovo_low_en_micmute_led':include/linux/stddef.h:9:14: error: called object is not a function or function pointer
9 | #define NULL ((void *)0)
| ^
sound/pci/hda/patch_realtek.c:5041:49: note: in expansion of macro 'NULL'
5041 | #define alc233_fixup_lenovo_line2_mic_hotkey NULL
| ^~~~sound/pci/hda/patch_realtek.c:5063:9: note: in expansion of macro 'alc233_fixup_lenovo_line2_mic_hotkey'
5063 | alc233_fixup_lenovo_line2_mic_hotkey(codec, fix, action);
Using IS_REACHABLE() is somewhat questionable here anyway since it leads to the input code not working when the HDA driver is builtin but input is in a loadable module. Replace this with a hard compile-time dependency on CONFIG_INPUT. In practice this won't chance much other than solve the compiler error because it is rare to require sound output but no input support.
--- sound/pci/hda/Kconfig | 1 + sound/pci/hda/patch_realtek.c | 5 ----- 2 files changed, 1 insertion(+), 5 deletions(-)
sound/pci/hda/Kconfig +1 -0
@@ -183,6 +183,7 @@ comment "Set to Y if you want auto-loadi config SND_HDA_CODEC_REALTEK tristate "Build Realtek HD-audio codec support" + depends on INPUT select SND_HDA_GENERIC select SND_HDA_GENERIC_LEDS help
sound/pci/hda/patch_realtek.c +0 -5
@@ -4865,7 +4865,6 @@ static void alc298_fixup_samsung_amp(str } } -#if IS_REACHABLE (CONFIG_INPUT )static void gpio2_mic_hotkey_event (struct hda_codec *codec,struct hda_jack_callback *event) {
@@ -4974,10 +4973,6 @@ static void alc233_fixup_lenovo_line2_mi spec->kb_dev =NULL ; } } -#else /* INPUT */ -#define alc280_fixup_hp_gpio2_mic_hotkey NULL -#define alc233_fixup_lenovo_line2_mic_hotkey NULL -#endif /* INPUT */ static void alc269_fixup_hp_line1_mic1_led (struct hda_codec *codec,const struct hda_fixup *fix,int action)
Greg Kroah-Hartman
maintainerPATCH 131/145 riscv: Fix enabling cbo.zero when running in M-mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
commit 3fb3f7164edc467450e650dca51dbe4823315a56 upstream.
When the kernel is running in M-mode, the CBZE bit must be set in the menvcfg CSR, not in senvcfg.
--- arch/riscv/include/asm/csr.h | 2 ++ arch/riscv/kernel/cpufeature.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-)
arch/riscv/include/asm/csr.h +2 -0
@@ -398,6 +398,7 @@# define CSR_STATUS CSR_MSTATUS# define CSR_IE CSR_MIE# define CSR_TVEC CSR_MTVEC +# define CSR_ENVCFG CSR_MENVCFG# define CSR_SCRATCH CSR_MSCRATCH# define CSR_EPC CSR_MEPC# define CSR_CAUSE CSR_MCAUSE
@@ -422,6 +423,7 @@# define CSR_STATUS CSR_SSTATUS# define CSR_IE CSR_SIE# define CSR_TVEC CSR_STVEC +# define CSR_ENVCFG CSR_SENVCFG# define CSR_SCRATCH CSR_SSCRATCH# define CSR_EPC CSR_SEPC# define CSR_CAUSE CSR_SCAUSE
arch/riscv/kernel/cpufeature.c +1 -1
@@ -679,7 +679,7 @@ arch_initcall(check_unaligned_access_boovoid riscv_user_isa_enable (void ) {if (riscv_cpu_has_extension_unlikely (smp_processor_id (),RISCV_ISA_EXT_ZICBOZ )) -csr_set (CSR_SENVCFG ,ENVCFG_CBZE ); +csr_set (CSR_ENVCFG ,ENVCFG_CBZE ); }#ifdef CONFIG_RISCV_ALTERNATIVE
Greg Kroah-Hartman
maintainerPATCH 132/145 riscv: Save/restore envcfg CSR during CPU suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
commit 05ab803d1ad8ac505ade77c6bd3f86b1b4ea0dc4 upstream.
The value of the [ms]envcfg CSR is lost when entering a nonretentive idle state, so the CSR must be rewritten when resuming the CPU.
--- arch/riscv/include/asm/suspend.h | 1 + arch/riscv/kernel/suspend.c | 4 ++++ 2 files changed, 5 insertions(+)
arch/riscv/include/asm/suspend.h +1 -0
@@ -14,6 +14,7 @@ struct suspend_context {struct pt_regs regs;/* Saved and restored by high-level functions */ unsigned long scratch; +unsigned long envcfg;unsigned long tvec;unsigned long ie;#ifdef CONFIG_MMU
arch/riscv/kernel/suspend.c +4 -0
@@ -11,6 +11,8 @@void suspend_save_csrs (struct suspend_context *context) { context->scratch =csr_read (CSR_SCRATCH ); +if (riscv_cpu_has_extension_unlikely (smp_processor_id (),RISCV_ISA_EXT_XLINUXENVCFG )) + context->envcfg =csr_read (CSR_ENVCFG ); context->tvec =csr_read (CSR_TVEC ); context->ie =csr_read (CSR_IE );
@@ -32,6 +34,8 @@ void suspend_save_csrs(struct suspend_covoid suspend_restore_csrs (struct suspend_context *context) {csr_write (CSR_SCRATCH , context->scratch); +if (riscv_cpu_has_extension_unlikely (smp_processor_id (),RISCV_ISA_EXT_XLINUXENVCFG )) +csr_write (CSR_ENVCFG , context->envcfg);csr_write (CSR_TVEC , context->tvec);csr_write (CSR_IE , context->ie);
Greg Kroah-Hartman
maintainerPATCH 133/145 Revert "KVM: e500: always restore irqs"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit b9d93eda1214985d1b3d00a0f9d4306282a5b189 which is commit 87ecfdbc699cc95fac73291b52650283ddcf929d upstream.
It should not have been applied.
--- arch/powerpc/kvm/e500_mmu_host.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kvm/e500_mmu_host.c +2 -2
@@ -479,6 +479,7 @@ static inline int kvmppc_e500_shadow_mapif (pte_present (pte)) { wimg = (pte_val (pte) >>PTE_WIMGE_SHIFT ) &MAS2_WIMGE_MASK ; +local_irq_restore (flags); }else {local_irq_restore (flags); pr_err_ratelimited("%s: pte not present: gfn %lx,pfn %lx\n",
@@ -487,9 +488,8 @@ static inline int kvmppc_e500_shadow_map goto out; } } -local_irq_restore (flags); - writable =kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg); +kvmppc_e500_setup_stlbe (&vcpu_e500->vcpu, gtlbe, tsize, ref, gvaddr, stlbe);
Greg Kroah-Hartman
maintainerPATCH 134/145 Revert "KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit ba3cf83f4a5063edb6ee150633e641954ce30478 which is commit 419cfb983ca93e75e905794521afefcfa07988bb upstream.
It should not have been applied.
--- arch/powerpc/kvm/e500_mmu_host.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
arch/powerpc/kvm/e500_mmu_host.c +5 -3
@@ -322,7 +322,6 @@ static inline int kvmppc_e500_shadow_map {struct kvm_memory_slot *slot;unsigned long pfn =0 ;/* silence GCC warning */ -struct page *page =NULL ;unsigned long hva;int pfnmap =0 ;int tsize =BOOK3E_PAGESZ_4K ;
@@ -444,7 +443,7 @@ static inline int kvmppc_e500_shadow_mapif (likely (!pfnmap)) { tsize_pages =1UL << (tsize +10 -PAGE_SHIFT ); - pfn =__kvm_faultin_pfn (slot, gfn,FOLL_WRITE ,NULL , &page); + pfn =gfn_to_pfn_memslot (slot, gfn);if (is_error_noslot_pfn (pfn)) {if (printk_ratelimit ()) pr_err("%s: real page not found for gfn %lx\n",
@@ -489,6 +488,8 @@ static inline int kvmppc_e500_shadow_map } } writable =kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg); +if (writable) +kvm_set_pfn_dirty (pfn);kvmppc_e500_setup_stlbe (&vcpu_e500->vcpu, gtlbe, tsize, ref, gvaddr, stlbe);
@@ -497,7 +498,8 @@ static inline int kvmppc_e500_shadow_mapkvmppc_mmu_flush_icache (pfn); out: -kvm_release_faultin_page (kvm, page, !!ret, writable); +/* Drop refcount on page, so that mmu notifiers can clear it */ +kvm_release_pfn_clean (pfn);spin_unlock (&kvm->mmu_lock);return ret; }
Greg Kroah-Hartman
maintainerPATCH 135/145 Revert "KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 59e21c4613b0a46f46eb124984928df46d88ad57 which is commit 84cf78dcd9d65c45ab73998d4ad50f433d53fb93 upstream.
It should not have been applied.
--- arch/powerpc/kvm/e500_mmu_host.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kvm/e500_mmu_host.c +3 -1
@@ -498,9 +498,11 @@ static inline int kvmppc_e500_shadow_mapkvmppc_mmu_flush_icache (pfn); out: +spin_unlock (&kvm->mmu_lock); +/* Drop refcount on page, so that mmu notifiers can clear it */ kvm_release_pfn_clean (pfn); -spin_unlock (&kvm->mmu_lock); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 136/145 Revert "KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map()"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 15d60c13b704f770ba45c58477380d4577cebfa3 which is commit c9be85dabb376299504e0d391d15662c0edf8273 upstream.
It should not have been applied.
--- arch/powerpc/kvm/e500_mmu_host.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
arch/powerpc/kvm/e500_mmu_host.c +7 -6
@@ -242,7 +242,7 @@ static inline int tlbe_is_writable(strucreturn tlbe->mas7_3 & (MAS3_SW |MAS3_UW ); } -static inline bool kvmppc_e500_ref_setup (struct tlbe_ref *ref, +static inline void kvmppc_e500_ref_setup (struct tlbe_ref *ref,struct kvm_book3e_206_tlb_entry *gtlbe,kvm_pfn_t pfn,unsigned int wimg) {
@@ -252,7 +252,11 @@ static inline bool kvmppc_e500_ref_setup/* Use guest supplied MAS2_G and MAS2_E */ ref->flags |= (gtlbe->mas2 &MAS2_ATTRIB_MASK ) | wimg; -return tlbe_is_writable (gtlbe); +/* Mark the page accessed */ +kvm_set_pfn_accessed (pfn); + +if (tlbe_is_writable (gtlbe)) +kvm_set_pfn_dirty (pfn); }static inline void kvmppc_e500_ref_release (struct tlbe_ref *ref)
@@ -333,7 +337,6 @@ static inline int kvmppc_e500_shadow_mapunsigned int wimg =0 ;pgd_t *pgdir;unsigned long flags; -bool writable = false;/* used to check for invalidations in progress */ mmu_seq = kvm->mmu_invalidate_seq;
@@ -487,9 +490,7 @@ static inline int kvmppc_e500_shadow_map goto out; } } - writable =kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg); -if (writable) -kvm_set_pfn_dirty (pfn); +kvmppc_e500_ref_setup (ref, gtlbe, pfn, wimg);kvmppc_e500_setup_stlbe (&vcpu_e500->vcpu, gtlbe, tsize, ref, gvaddr, stlbe);
Greg Kroah-Hartman
maintainerPATCH 137/145 drm/i915/dsi: Use TRANS_DDI_FUNC_CTLs own port width macro
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
commit 879f70382ff3e92fc854589ada3453e3f5f5b601 upstream.
The format of the port width field in the DDI_BUF_CTL and the TRANS_DDI_FUNC_CTL registers are different starting with MTL, where the x3 lane mode for HDMI FRL has a different encoding in the two registers. To account for this use the TRANS_DDI_FUNC_CTL's own port width macro.
[Imre: Rebased on v6.6.y, due to upstream API changes for intel_de_read(),
TRANS_DDI_FUNC_CTL()]
--- drivers/gpu/drm/i915/display/icl_dsi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/display/icl_dsi.c +2 -2
@@ -797,8 +797,8 @@ gen11_dsi_configure_transcoder(struct in/* select data lane width */ tmp =intel_de_read (dev_priv,TRANS_DDI_FUNC_CTL (dsi_trans)); - tmp &= ~DDI_PORT_WIDTH_MASK ; - tmp |=DDI_PORT_WIDTH (intel_dsi->lane_count); + tmp &= ~TRANS_DDI_PORT_WIDTH_MASK ; + tmp |=TRANS_DDI_PORT_WIDTH (intel_dsi->lane_count);/* select input pipe */ tmp &= ~TRANS_DDI_EDP_INPUT_MASK ;
Greg Kroah-Hartman
maintainerPATCH 138/145 uprobes: Fix race in uprobe_free_utask
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
commit b583ef82b671c9a752fbe3e95bd4c1c51eab764d upstream.
Max Makarov reported kernel panic [1] in perf user callchain code.
The reason for that is the race between uprobe_free_utask and bpf profiler code doing the perf user stack unwind and is triggered within uprobe_free_utask function:
- after current->utask is freed and
- before current->utask is set to NULL
general protection fault, probably for non-canonical address 0x9e759c37ee555c76: 0000 [#1] SMP PTI RIP: 0010:is_uprobe_at_func_entry+0x28/0x80 ... ? die_addr+0x36/0x90 ? exc_general_protection+0x217/0x420 ? asm_exc_general_protection+0x26/0x30 ? is_uprobe_at_func_entry+0x28/0x80 perf_callchain_user+0x20a/0x360 get_perf_callchain+0x147/0x1d0 bpf_get_stackid+0x60/0x90 bpf_prog_9aac297fb833e2f5_do_perf_event+0x434/0x53b ? __smp_call_single_queue+0xad/0x120 bpf_overflow_handler+0x75/0x110 ... asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:__kmem_cache_free+0x1cb/0x350 ... ? uprobe_free_utask+0x62/0x80 ? acct_collect+0x4c/0x220 uprobe_free_utask+0x62/0x80 mm_release+0x12/0xb0 do_exit+0x26b/0xaa0 __x64_sys_exit+0x1b/0x20 do_syscall_64+0x5a/0x80
It can be easily reproduced by running following commands in separate terminals:
# while :; do bpftrace -e 'uprobe:/bin/ls:_start { printf("hit\n"); }' -c ls; done
# bpftrace -e 'profile:hz:100000 { @[ustack()] = count(); }'Fixing this by making sure current->utask pointer is set to NULL before we start to release the utask object.
[1] https://github.com/grafana/pyroscope/issues/3673
--- kernel/events/uprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/uprobes.c +1 -1
@@ -1721,6 +1721,7 @@ void uprobe_free_utask(struct task_strucif (!utask)return ; + t->utask =NULL ;if (utask->active_uprobe)put_uprobe (utask->active_uprobe);
@@ -1730,7 +1731,6 @@ void uprobe_free_utask(struct task_strucxol_free_insn_slot (t);kfree (utask); - t->utask =NULL ; }/*
Greg Kroah-Hartman
maintainerPATCH 139/145 x86/mm: Dont disable PCID when INVLPG has been fixed by microcode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <[email protected]>
commit f24f669d03f884a6ef95cca84317d0f329e93961 upstream.
Per the "Processor Specification Update" documentations referred by the intel-microcode-20240312 release note, this microcode release has fixed the issue for all affected models.
So don't disable PCID if the microcode is new enough. The precise minimum microcode revision fixing the issue was provided by Pawan Intel.
[ dhansen: comment and changelog tweaks ]
--- arch/x86/mm/init.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
arch/x86/mm/init.c +14 -9
@@ -262,28 +262,33 @@ static void __init probe_page_size_mask( }/* -* INVLPG may not properly flush Global entries -* on these CPUs when PCIDs are enabled. +* INVLPG may not properly flush Global entries on +* these CPUs. New microcode fixes the issue. */ static const struct x86_cpu_id invlpg_miss_ids[] = { -X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE ,0 ), -X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE_L ,0 ), -X86_MATCH_INTEL_FAM6_MODEL (ATOM_GRACEMONT ,0 ), -X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE ,0 ), -X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_P ,0 ), -X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_S ,0 ), +X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE ,0x2e ), +X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE_L ,0x42c ), +X86_MATCH_INTEL_FAM6_MODEL (ATOM_GRACEMONT ,0x11 ), +X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE ,0x118 ), +X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_P ,0x4117 ), +X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_S ,0x2e ), {} };static void setup_pcid (void ) { +const struct x86_cpu_id *invlpg_miss_match; +if (!IS_ENABLED (CONFIG_X86_64 ))return ;if (!boot_cpu_has (X86_FEATURE_PCID ))return ; -if (x86_match_cpu (invlpg_miss_ids)) { + invlpg_miss_match =x86_match_cpu (invlpg_miss_ids); + +if (invlpg_miss_match && + boot_cpu_data.microcode < invlpg_miss_match->driver_data) {pr_info ("Incomplete global flushes, disabling PCID" );setup_clear_cpu_cap (X86_FEATURE_PCID );return ;
Greg Kroah-Hartman
maintainerPATCH 140/145 ima: Reset IMA_NONACTION_RULE_FLAGS after post_setattr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roberto Sassu <[email protected]>
commit 57a0ef02fefafc4b9603e33a18b669ba5ce59ba3 upstream.
Commit 0d73a55208e9 ("ima: re-introduce own integrity cache lock") mistakenly reverted the performance improvement introduced in commit 42a4c603198f0 ("ima: fix ima_inode_post_setattr"). The unused bit mask was subsequently removed by commit 11c60f23ed13 ("integrity: Remove unused macro IMA_ACTION_RULE_FLAGS").
Restore the performance improvement by introducing the new mask IMA_NONACTION_RULE_FLAGS, equal to IMA_NONACTION_FLAGS without IMA_NEW_FILE, which is not a rule-specific flag.
Finally, reset IMA_NONACTION_RULE_FLAGS instead of IMA_NONACTION_FLAGS in process_measurement(), if the IMA_CHANGE_ATTR atomic flag is set (after file metadata modification).
With this patch, new files for which metadata were modified while they are still open, can be reopened before the last file close (when security.ima is written), since the IMA_NEW_FILE flag is not cleared anymore. Otherwise, appraisal fails because security.ima is missing (files with IMA_NEW_FILE set are an exception).
--- security/integrity/ima/ima_main.c | 7 +++++-- security/integrity/integrity.h | 3 +++ 2 files changed, 8 insertions(+), 2 deletions(-)
security/integrity/ima/ima_main.c +5 -2
@@ -267,10 +267,13 @@ static int process_measurement(struct fimutex_lock (&iint->mutex);if (test_and_clear_bit (IMA_CHANGE_ATTR , &iint->atomic_flags)) -/* reset appraisal flags if ima_inode_post_setattr was called */ +/* +* Reset appraisal flags (action and non-action rule-specific) +* if ima_inode_post_setattr was called. +*/ iint->flags &= ~(IMA_APPRAISE |IMA_APPRAISED |IMA_APPRAISE_SUBMASK |IMA_APPRAISED_SUBMASK | -IMA_NONACTION_FLAGS ); +IMA_NONACTION_RULE_FLAGS );/* * Re-evaulate the file if either the xattr has changed or the
security/integrity/integrity.h +3 -0
@@ -42,6 +42,9 @@#define IMA_CHECK_BLACKLIST 0x40000000#define IMA_VERITY_REQUIRED 0x80000000 +/* Exclude non-action flags which are not rule-specific. */ +#define IMA_NONACTION_RULE_FLAGS (IMA_NONACTION_FLAGS & ~IMA_NEW_FILE) +#define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ IMA_HASH | IMA_APPRAISE_SUBMASK)#define IMA_DONE_MASK (IMA_MEASURED | IMA_APPRAISED | IMA_AUDITED | \
Greg Kroah-Hartman
maintainerPATCH 141/145 x86/boot: Rename conflicting boot_params pointer to boot_params_ptr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit d55d5bc5d937743aa8ebb7ca3af25111053b5d8c upstream.
The x86 decompressor is built and linked as a separate executable, but it shares components with the kernel proper, which are either #include'd as C files, or linked into the decompresor as a static library (e.g, the EFI stub)
Both the kernel itself and the decompressor define a global symbol 'boot_params' to refer to the boot_params struct, but in the former case, it refers to the struct directly, whereas in the decompressor, it refers to a global pointer variable referring to the struct boot_params passed by the bootloader or constructed from scratch.
This ambiguity is unfortunate, and makes it impossible to assign this decompressor variable from the x86 EFI stub, given that declaring it as extern results in a clash. So rename the decompressor version (whose scope is limited) to boot_params_ptr.
[ mingo: Renamed 'boot_params_p' to 'boot_params_ptr' for clarity ]
--- arch/x86/boot/compressed/acpi.c | 14 +++++++------- arch/x86/boot/compressed/cmdline.c | 4 ++-- arch/x86/boot/compressed/ident_map_64.c | 7 ++++--- arch/x86/boot/compressed/kaslr.c | 26 +++++++++++++------------- arch/x86/boot/compressed/mem.c | 6 +++--- arch/x86/boot/compressed/misc.c | 26 +++++++++++++------------- arch/x86/boot/compressed/misc.h | 1 - arch/x86/boot/compressed/pgtable_64.c | 9 ++++----- arch/x86/boot/compressed/sev.c | 2 +- arch/x86/include/asm/boot.h | 2 ++ drivers/firmware/efi/libstub/x86-stub.c | 2 +- drivers/firmware/efi/libstub/x86-stub.h | 2 -- 12 files changed, 50 insertions(+), 51 deletions(-)
arch/x86/boot/compressed/acpi.c +7 -7
@@ -30,13 +30,13 @@ __efi_get_rsdp_addr(unsigned long cfg_tb* Search EFI system tables for RSDP. Preferred is ACPI_20_TABLE_GUID to * ACPI_TABLE_GUID because it has more features. */ - rsdp_addr =efi_find_vendor_table (boot_params, cfg_tbl_pa, cfg_tbl_len, + rsdp_addr =efi_find_vendor_table (boot_params_ptr, cfg_tbl_pa, cfg_tbl_len,ACPI_20_TABLE_GUID );if (rsdp_addr)return (acpi_physical_address )rsdp_addr;/* No ACPI_20_TABLE_GUID found, fallback to ACPI_TABLE_GUID. */ - rsdp_addr =efi_find_vendor_table (boot_params, cfg_tbl_pa, cfg_tbl_len, + rsdp_addr =efi_find_vendor_table (boot_params_ptr, cfg_tbl_pa, cfg_tbl_len,ACPI_TABLE_GUID );if (rsdp_addr)return (acpi_physical_address )rsdp_addr;
@@ -56,15 +56,15 @@ static acpi_physical_address efi_get_rsdenum efi_type et;int ret; - et =efi_get_type (boot_params); + et =efi_get_type (boot_params_ptr);if (et ==EFI_TYPE_NONE )return 0 ; - systab_pa =efi_get_system_table (boot_params); + systab_pa =efi_get_system_table (boot_params_ptr);if (!systab_pa)error ("EFI support advertised, but unable to locate system table." ); - ret =efi_get_conf_table (boot_params, &cfg_tbl_pa, &cfg_tbl_len); + ret =efi_get_conf_table (boot_params_ptr, &cfg_tbl_pa, &cfg_tbl_len);if (ret || !cfg_tbl_pa)error ("EFI config table not found." );
@@ -156,7 +156,7 @@ acpi_physical_address get_rsdp_addr(void {acpi_physical_address pa; - pa = boot_params->acpi_rsdp_addr; + pa = boot_params_ptr->acpi_rsdp_addr;if (!pa) pa =efi_get_rsdp_addr ();
@@ -210,7 +210,7 @@ static unsigned long get_acpi_srat_table rsdp = (struct acpi_table_rsdp *)get_cmdline_acpi_rsdp ();if (!rsdp) rsdp = (struct acpi_table_rsdp *)(long ) - boot_params->acpi_rsdp_addr; + boot_params_ptr->acpi_rsdp_addr;if (!rsdp)return 0 ;
arch/x86/boot/compressed/cmdline.c +2 -2
@@ -14,9 +14,9 @@ static inline char rdfs8(addr_t addr)#include "../cmdline.c" unsigned long get_cmd_line_ptr (void ) { -unsigned long cmd_line_ptr = boot_params->hdr.cmd_line_ptr; +unsigned long cmd_line_ptr = boot_params_ptr->hdr.cmd_line_ptr; - cmd_line_ptr |= (u64 )boot_params->ext_cmd_line_ptr <<32 ; + cmd_line_ptr |= (u64 )boot_params_ptr->ext_cmd_line_ptr <<32 ;return cmd_line_ptr; }
arch/x86/boot/compressed/ident_map_64.c +4 -3
@@ -159,8 +159,9 @@ void initialize_identity_maps(void *rmod* or does not touch all the pages covering them. */ kernel_add_identity_map ((unsigned long )_head, (unsigned long )_end); - boot_params = rmode; -kernel_add_identity_map ((unsigned long )boot_params, (unsigned long )(boot_params +1 )); + boot_params_ptr = rmode; +kernel_add_identity_map ((unsigned long )boot_params_ptr, + (unsigned long )(boot_params_ptr +1 )); cmdline =get_cmd_line_ptr ();kernel_add_identity_map (cmdline, cmdline +COMMAND_LINE_SIZE );
@@ -168,7 +169,7 @@ void initialize_identity_maps(void *rmod* Also map the setup_data entries passed via boot_params in case they * need to be accessed by uncompressed kernel via the identity mapping. */ - sd = (struct setup_data *)boot_params->hdr.setup_data; + sd = (struct setup_data *)boot_params_ptr->hdr.setup_data;while (sd) {unsigned long sd_addr = (unsigned long )sd;
arch/x86/boot/compressed/kaslr.c +13 -13
@@ -63,7 +63,7 @@ static unsigned long get_boot_seed(void)unsigned long hash =0 ; hash =rotate_xor (hash, build_str,sizeof (build_str)); - hash =rotate_xor (hash, boot_params,sizeof (*boot_params)); + hash =rotate_xor (hash, boot_params_ptr,sizeof (*boot_params_ptr));return hash; }
@@ -383,7 +383,7 @@ static void handle_mem_options(void)static void mem_avoid_init (unsigned long input,unsigned long input_size,unsigned long output) { -unsigned long init_size = boot_params->hdr.init_size; +unsigned long init_size = boot_params_ptr->hdr.init_size;u64 initrd_start, initrd_size;unsigned long cmd_line, cmd_line_size;
@@ -395,10 +395,10 @@ static void mem_avoid_init(unsigned long mem_avoid[MEM_AVOID_ZO_RANGE ].size = (output + init_size) - input;/* Avoid initrd. */ - initrd_start = (u64 )boot_params->ext_ramdisk_image <<32 ; - initrd_start |= boot_params->hdr.ramdisk_image; - initrd_size = (u64 )boot_params->ext_ramdisk_size <<32 ; - initrd_size |= boot_params->hdr.ramdisk_size; + initrd_start = (u64 )boot_params_ptr->ext_ramdisk_image <<32 ; + initrd_start |= boot_params_ptr->hdr.ramdisk_image; + initrd_size = (u64 )boot_params_ptr->ext_ramdisk_size <<32 ; + initrd_size |= boot_params_ptr->hdr.ramdisk_size; mem_avoid[MEM_AVOID_INITRD ].start = initrd_start; mem_avoid[MEM_AVOID_INITRD ].size = initrd_size;/* No need to set mapping for initrd, it will be handled in VO. */
@@ -413,8 +413,8 @@ static void mem_avoid_init(unsigned long }/* Avoid boot parameters. */ - mem_avoid[MEM_AVOID_BOOTPARAMS ].start = (unsigned long )boot_params; - mem_avoid[MEM_AVOID_BOOTPARAMS ].size =sizeof (*boot_params); + mem_avoid[MEM_AVOID_BOOTPARAMS ].start = (unsigned long )boot_params_ptr; + mem_avoid[MEM_AVOID_BOOTPARAMS ].size =sizeof (*boot_params_ptr);/* We don't need to set a mapping for setup_data. */
@@ -447,7 +447,7 @@ static bool mem_avoid_overlap(struct mem }/* Avoid all entries in the setup_data linked list. */ - ptr = (struct setup_data *)(unsigned long )boot_params->hdr.setup_data; + ptr = (struct setup_data *)(unsigned long )boot_params_ptr->hdr.setup_data;while (ptr) {struct mem_vector avoid;
@@ -706,7 +706,7 @@ static inline bool memory_type_is_free(estatic bool process_efi_entries (unsigned long minimum,unsigned long image_size) { -struct efi_info *e = &boot_params->efi_info; +struct efi_info *e = &boot_params_ptr->efi_info;bool efi_mirror_found = false;struct mem_vector region;efi_memory_desc_t *md;
@@ -777,8 +777,8 @@ static void process_e820_entries(unsignestruct boot_e820_entry *entry;/* Verify potential e820 positions, appending to slots list. */ -for (i =0 ; i < boot_params->e820_entries; i++) { - entry = &boot_params->e820_table[i]; +for (i =0 ; i < boot_params_ptr->e820_entries; i++) { + entry = &boot_params_ptr->e820_table[i];/* Skip non-RAM entries. */ if (entry->type !=E820_TYPE_RAM )continue ;
@@ -852,7 +852,7 @@ void choose_random_location(unsigned lonreturn ; } - boot_params->hdr.loadflags |=KASLR_FLAG ; + boot_params_ptr->hdr.loadflags |=KASLR_FLAG ;if (IS_ENABLED (CONFIG_X86_32 )) mem_limit =KERNEL_IMAGE_SIZE ;
arch/x86/boot/compressed/mem.c +3 -3
@@ -54,17 +54,17 @@ bool init_unaccepted_memory(void)enum efi_type et;int ret; - et =efi_get_type (boot_params); + et =efi_get_type (boot_params_ptr);if (et ==EFI_TYPE_NONE )return false; - ret =efi_get_conf_table (boot_params, &cfg_table_pa, &cfg_table_len); + ret =efi_get_conf_table (boot_params_ptr, &cfg_table_pa, &cfg_table_len);if (ret) {warn ("EFI config table not found." );return false; } - table = (void *)efi_find_vendor_table (boot_params, cfg_table_pa, + table = (void *)efi_find_vendor_table (boot_params_ptr, cfg_table_pa, cfg_table_len, guid);if (!table)return false;
arch/x86/boot/compressed/misc.c +13 -13
@@ -46,7 +46,7 @@ void *memmove(void *dest, const void *sr/* * This is set up by the setup-routine at boot-time */ -struct boot_params *boot_params; +struct boot_params *boot_params_ptr;struct port_io_ops pio_ops;
@@ -132,8 +132,8 @@ void __putstr(const char *s)if (lines ==0 || cols ==0 )return ; - x = boot_params->screen_info.orig_x; - y = boot_params->screen_info.orig_y; + x = boot_params_ptr->screen_info.orig_x; + y = boot_params_ptr->screen_info.orig_y;while ((c = *s++) !='\0' ) {if (c =='\n' ) {
@@ -154,8 +154,8 @@ void __putstr(const char *s) } } - boot_params->screen_info.orig_x = x; - boot_params->screen_info.orig_y = y; + boot_params_ptr->screen_info.orig_x = x; + boot_params_ptr->screen_info.orig_y = y; pos = (x + cols * y) *2 ;/* Update cursor position */ outb (14 , vidport);
@@ -396,16 +396,16 @@ asmlinkage __visible void *extract_kernesize_t entry_offset;/* Retain x86 boot parameters pointer passed from startup_32/64. */ - boot_params = rmode; + boot_params_ptr = rmode;/* Clear flags intended for solely in-kernel use. */ - boot_params->hdr.loadflags &= ~KASLR_FLAG ; + boot_params_ptr->hdr.loadflags &= ~KASLR_FLAG ; -parse_mem_encrypt (&boot_params->hdr); +parse_mem_encrypt (&boot_params_ptr->hdr); -sanitize_boot_params (boot_params); +sanitize_boot_params (boot_params_ptr); -if (boot_params->screen_info.orig_video_mode ==7 ) { +if (boot_params_ptr->screen_info.orig_video_mode ==7 ) { vidmem = (char *)0xb0000 ; vidport =0x3b4 ; }else {
@@ -413,8 +413,8 @@ asmlinkage __visible void *extract_kerne vidport =0x3d4 ; } - lines = boot_params->screen_info.orig_video_lines; - cols = boot_params->screen_info.orig_video_cols; + lines = boot_params_ptr->screen_info.orig_video_lines; + cols = boot_params_ptr->screen_info.orig_video_cols;init_default_io_ops ();
@@ -433,7 +433,7 @@ asmlinkage __visible void *extract_kerne* so that early debugging output from the RSDP parsing code can be * collected. */ - boot_params->acpi_rsdp_addr =get_rsdp_addr (); + boot_params_ptr->acpi_rsdp_addr =get_rsdp_addr ();debug_putstr ("early console in extract_kernel\n" );
arch/x86/boot/compressed/misc.h +0 -1
@@ -61,7 +61,6 @@ extern memptr free_mem_ptr;extern memptr free_mem_end_ptr;void *malloc (int size);void free (void *where); -extern struct boot_params *boot_params;void __putstr (const char *s);void __puthex (unsigned long value);#define error_putstr (__x) __putstr(__x)
arch/x86/boot/compressed/pgtable_64.c +4 -5
@@ -28,7 +28,6 @@ static char trampoline_save[TRAMPOLINE_3*/ unsigned long *trampoline_32bit __section(".data"); -extern struct boot_params *boot_params;int cmdline_find_option_bool (const char *option);static unsigned long find_trampoline_placement (void )
@@ -49,7 +48,7 @@ static unsigned long find_trampoline_pla* * Only look for values in the legacy ROM for non-EFI system. */ - signature = (char *)&boot_params->efi_info.efi_loader_signature; + signature = (char *)&boot_params_ptr->efi_info.efi_loader_signature;if (strncmp (signature,EFI32_LOADER_SIGNATURE ,4 ) &&strncmp (signature,EFI64_LOADER_SIGNATURE ,4 )) { ebda_start = *(unsigned short *)0x40e <<4 ;
@@ -65,10 +64,10 @@ static unsigned long find_trampoline_pla bios_start =round_down (bios_start,PAGE_SIZE );/* Find the first usable memory region under bios_start. */ -for (i = boot_params->e820_entries -1 ; i >=0 ; i--) { +for (i = boot_params_ptr->e820_entries -1 ; i >=0 ; i--) {unsigned long new = bios_start; - entry = &boot_params->e820_table[i]; + entry = &boot_params_ptr->e820_table[i];/* Skip all entries above bios_start. */ if (bios_start <= entry->addr)
@@ -107,7 +106,7 @@ asmlinkage void configure_5level_paging(bool l5_required = false;/* Initialize boot_params. Required for cmdline_find_option_bool(). */ - boot_params = bp; + boot_params_ptr = bp;/* * Check if LA57 is desired and supported.
arch/x86/boot/compressed/sev.c +1 -1
@@ -618,7 +618,7 @@ void sev_prep_identity_maps(unsigned lon* accessed after switchover. */ if (sev_snp_enabled ()) { -unsigned long cc_info_pa = boot_params->cc_blob_address; +unsigned long cc_info_pa = boot_params_ptr->cc_blob_address;struct cc_blob_sev_info *cc_info;kernel_add_identity_map (cc_info_pa, cc_info_pa +sizeof (*cc_info));
arch/x86/include/asm/boot.h +2 -0
@@ -86,6 +86,8 @@ extern const unsigned long kernel_total_unsigned long decompress_kernel (unsigned char *outbuf,unsigned long virt_addr,void (*error)(char *x)); + +extern struct boot_params *boot_params_ptr;#endif #endif /* _ASM_X86_BOOT_H */
drivers/firmware/efi/libstub/x86-stub.c +1 -1
@@ -883,7 +883,7 @@ void __noreturn efi_stub_entry(efi_handlunsigned long kernel_entry;efi_status_t status; - boot_params_pointer = boot_params; + boot_params_ptr = boot_params; efi_system_table = sys_table_arg;/* Check if we were booted by the EFI firmware */
drivers/firmware/efi/libstub/x86-stub.h +0 -2
@@ -2,8 +2,6 @@#include <linux/efi.h> -extern struct boot_params *boot_params_pointer asm("boot_params" ); -extern void trampoline_32bit_src (void *,bool );extern const u16 trampoline_ljmp_imm_offset;
Greg Kroah-Hartman
maintainerPATCH 142/145 x86/boot: Sanitize boot params before parsing command line
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit c00b413a96261faef4ce22329153c6abd4acef25 upstream.
The 5-level paging code parses the command line to look for the 'no5lvl' string, and does so very early, before sanitize_boot_params() has been called and has been given the opportunity to wipe bogus data from the fields in boot_params that are not covered by struct setup_header, and are therefore supposed to be initialized to zero by the bootloader.
This triggers an early boot crash when using syslinux-efi to boot a recent kernel built with CONFIG_X86_5LEVEL=y and CONFIG_EFI_STUB=n, as the 0xff padding that now fills the unused PE/COFF header is copied into boot_params by the bootloader, and interpreted as the top half of the command line pointer.
Fix this by sanitizing the boot_params before use. Note that there is no harm in calling this more than once; subsequent invocations are able to spot that the boot_params have already been cleaned up.
--- arch/x86/boot/compressed/pgtable_64.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/boot/compressed/pgtable_64.c +2 -0
@@ -1,5 +1,6 @@// SPDX-License-Identifier: GPL-2.0 #include "misc.h" +#include <asm/bootparam_utils.h> #include <asm/e820/types.h> #include <asm/processor.h> #include "pgtable.h"
@@ -106,6 +107,7 @@ asmlinkage void configure_5level_paging(bool l5_required = false;/* Initialize boot_params. Required for cmdline_find_option_bool(). */ +sanitize_boot_params (bp); boot_params_ptr = bp;/*
Greg Kroah-Hartman
maintainerPATCH 143/145 spi-mxs: Fix chipselect glitch
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Schlatterbeck <[email protected]>
commit 269e31aecdd0b70f53a05def79480f15cbcc0fd6 upstream.
There was a change in the mxs-dma engine that uses a new custom flag. The change was not applied to the mxs spi driver.
This results in chipselect being deasserted too early.
This fixes the chipselect problem by using the new flag in the mxs-spi driver.
--- drivers/spi/spi-mxs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-mxs.c +2 -1
@@ -39,6 +39,7 @@#include <linux/spi/spi.h> #include <linux/spi/mxs-spi.h> #include <trace/events/spi.h> +#include <linux/dma/mxs-dma.h> #define DRIVER_NAME "mxs-spi"
@@ -252,7 +253,7 @@ static int mxs_spi_txrx_dma(struct mxs_s desc =dmaengine_prep_slave_sg (ssp->dmach, &dma_xfer[sg_count].sg,1 , (flags &TXRX_WRITE ) ?DMA_MEM_TO_DEV :DMA_DEV_TO_MEM , -DMA_PREP_INTERRUPT |DMA_CTRL_ACK ); +DMA_PREP_INTERRUPT |MXS_DMA_CTRL_WAIT4END );if (!desc) { dev_err(ssp->dev,
Greg Kroah-Hartman
maintainerPATCH 144/145 pfifo_tail_enqueue: Drop new packet when sch->limit == 0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quang Le <[email protected]>
commit 647cef20e649c576dff271e018d5d15d998b629d upstream.
Expected behaviour:
In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifo_tail_enqueue() enqueue new packet and increase scheduler's qlen by one. Finally, pfifo_tail_enqueue() return NET_XMIT_CN status code.
Weird behaviour:
In case we set sch->limit == 0 and trigger pfifo_tail_enqueue() on a scheduler that has no packet, the 'drop a packet' step will do nothing. This means the scheduler's qlen still has value equal 0. Then, we continue to enqueue new packet and increase scheduler's qlen by one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by one and return NET_XMIT_CN status code.
The problem is:
Let's say we have two qdiscs: Qdisc_A and Qdisc_B.
- Qdisc_A's type must have '->graft()' function to create parent/child relationship. Let's say Qdisc_A's type is hfsc. Enqueue packet to this qdisc will trigger hfsc_enqueue.
- Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger pfifo_tail_enqueue.
- Qdisc_B is configured to have sch->limit == 0.
- Qdisc_A is configured to route the enqueued's packet to Qdisc_B.
Enqueue packet through Qdisc_A will lead to:
- hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B)
- Qdisc_B->q.qlen += 1
- pfifo_tail_enqueue() return NET_XMIT_CN
- hfsc_enqueue() check for NET_XMIT_SUCCESS and see NET_XMIT_CN => hfsc_enqueue() don't increase qlen of Qdisc_A.
The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1. Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. This violate the design where parent's qlen should equal to the sum of its childrens'qlen.
Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable.
--- net/sched/sch_fifo.c | 3 +++ 1 file changed, 3 insertions(+)
net/sched/sch_fifo.c +3 -0
@@ -39,6 +39,9 @@ static int pfifo_tail_enqueue(struct sk_ {unsigned int prev_backlog; +if (unlikely (sch->limit ==0 )) +return qdisc_drop (skb, sch, to_free); +if (likely (sch->q.qlen < sch->limit))return qdisc_enqueue_tail (skb, sch);
Greg Kroah-Hartman
maintainerPATCH 145/145 kbuild: userprogs: use correct lld when linking through clang
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Thomas Wei�schuh" <[email protected]>
commit dfc1b168a8c4b376fa222b27b97c2c4ad4b786e1 upstream.
The userprog infrastructure links objects files through $(CC). Either explicitly by manually calling $(CC) on multiple object files or implicitly by directly compiling a source file to an executable. The documentation at Documentation/kbuild/llvm.rst indicates that ld.lld would be used for linking if LLVM=1 is specified.
However clang instead will use either a globally installed cross linker from $PATH called ${target}-ld or fall back to the system linker, which probably does not support crosslinking.
For the normal kernel build this is not an issue because the linker is always executed directly, without the compiler being involved.
Explicitly pass --ld-path to clang so $(LD) is respected.
As clang 13.0.1 is required to build the kernel, this option is available.
[nathan: use cc-option for 6.6 and older, as those trees support back to
clang-11]
--- Makefile | 5 +++++ 1 file changed, 5 insertions(+)
Makefile +5 -0
@@ -1057,6 +1057,11 @@ endif KBUILD_USERCFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) +# userspace programs are linked via the compiler, use the correct linker +ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_LD_IS_LLD),yy) +KBUILD_USERLDFLAGS += $(call cc-option, --ld-path=$(LD)) +endif + # make the checker run with the right architecture CHECKFLAGS += --arch=$(ARCH)
Hello,
Quoted 7 lines · On Mon, 10 Mar 2025 18:04:54 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/damonitor/damon-tests/tree/next/corr
[2] b49d45c66a5e ("Linux 6.6.83-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: debugfs_rm_non_contexts.sh
ok 8 selftests: damon: sysfs.sh
ok 9 selftests: damon: sysfs_update_removed_scheme_dir.sh
ok 10 selftests: damon: reclaim.sh
ok 11 selftests: damon: lru_sort.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh # SKIP
ok 12 selftests: damon-tests: build_m68k.sh # SKIP
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.83-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.83-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
The build fails on RISC-V with:
arch/riscv/kernel/suspend.c: In function 'suspend_save_csrs':arch/riscv/kernel/suspend.c:14:66: error: 'RISCV_ISA_EXT_XLINUXENVCFG' undeclared (first use in this function); did you mean 'RISCV_ISA_EXT_ZIFENCEI'? 14 | if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
| RISCV_ISA_EXT_ZIFENCEIarch/riscv/kernel/suspend.c:14:66: note: each undeclared identifier is reported only once for each function it appears in arch/riscv/kernel/suspend.c: In function 'suspend_restore_csrs':arch/riscv/kernel/suspend.c:37:66: error: 'RISCV_ISA_EXT_XLINUXENVCFG' undeclared (first use in this function); did you mean 'RISCV_ISA_EXT_ZIFENCEI'? 37 | if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
| RISCV_ISA_EXT_ZIFENCEI
make[4]: *** [scripts/Makefile.build:243: arch/riscv/kernel/suspend.o] Error 1
Reverting commit "riscv: Save/restore envcfg CSR during suspend" 8bf2e196c94af0a384f7bb545d54d501a1e9c510 fixes the build.
Hi!
Quoted 37 lines
Quoted 5 lines
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.83-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.The build fails on RISC-V with:
arch/riscv/kernel/suspend.c: In function 'suspend_save_csrs':arch/riscv/kernel/suspend.c:14:66: error: 'RISCV_ISA_EXT_XLINUXENVCFG' undeclared (first use in this function); did you mean 'RISCV_ISA_EXT_ZIFENCEI'?
14 | if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
|RISCV_ISA_EXT_ZIFENCEIarch/riscv/kernel/suspend.c:14:66: note: each undeclared identifier is reported only once for each function it appears inarch/riscv/kernel/suspend.c: In function 'suspend_restore_csrs':arch/riscv/kernel/suspend.c:37:66: error: 'RISCV_ISA_EXT_XLINUXENVCFG' undeclared (first use in this function); did you mean 'RISCV_ISA_EXT_ZIFENCEI'?
37 | if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
|RISCV_ISA_EXT_ZIFENCEI
make[4]: *** [scripts/Makefile.build:243:arch/riscv/kernel/suspend.o] Error 1
Quoted 2 lines
Reverting commit "riscv: Save/restore envcfg CSR during suspend"
8bf2e196c94af0a384f7bb545d54d501a1e9c510fixes the build.
We see the same problem.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerQuoted 42 lines · Ron Economos
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.83-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
The build fails on RISC-V with:
arch/riscv/kernel/suspend.c: In function 'suspend_save_csrs':arch/riscv/kernel/suspend.c:14:66: error: 'RISCV_ISA_EXT_XLINUXENVCFG' undeclared (first use in this function); did you mean 'RISCV_ISA_EXT_ZIFENCEI'?
14 | if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
|RISCV_ISA_EXT_ZIFENCEIarch/riscv/kernel/suspend.c:14:66: note: each undeclared identifier is reported only once for each function it appears inarch/riscv/kernel/suspend.c: In function 'suspend_restore_csrs':arch/riscv/kernel/suspend.c:37:66: error: 'RISCV_ISA_EXT_XLINUXENVCFG' undeclared (first use in this function); did you mean 'RISCV_ISA_EXT_ZIFENCEI'?
37 | if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
|RISCV_ISA_EXT_ZIFENCEI
make[4]: *** [scripts/Makefile.build:243:arch/riscv/kernel/suspend.o] Error 1
Quoted 2 lines
Reverting commit "riscv: Save/restore envcfg CSR during suspend"
8bf2e196c94af0a384f7bb545d54d501a1e9c510fixes the build.
Thanks, offending commit now dropped.
greg k-h
Hi Greg,
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
No problems seen on x86_64 and aarch64 with our testing.
Thanks,
Harshit
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.83-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.6:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
116 tests: 116 pass, 0 failLinux version: 6.6.83-rc1-g70aba17a9467
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.83-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.83-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on riscv the defconfig builds failed with clang-20 and gcc-13 the stable-rc 6.6.83-rc1.
First seen on the 6.6.83-rc1
Good: v6.6.81
Bad: v6.6.81-153-g70aba17a9467
* riscv, build
- clang-20-allmodconfig
- clang-20-allyesconfig
- clang-20-defconfig
- clang-20-lkftconfig
- gcc-13-allmodconfig
- gcc-13-allyesconfig
- gcc-13-defconfig
- gcc-13-lkftconfig
- gcc-13-lkftconfig-libgpiod
- gcc-8-defconfig
- rv32-clang-20-allnoconfig
- rv32-clang-20-allyesconfig
- rv32-clang-20-defconfig
- rv32-clang-20-lkftconfig
- rv32-clang-20-tinyconfig
- rv32-gcc-13-lkftconfig
Regression Analysis:
- New regression? Yes
- Reproducible? Yes
Build regression: riscv 'RISCV_ISA_EXT_XLINUXENVCFG' undeclared
## Build logarch/riscv/kernel/suspend.c: In function 'suspend_save_csrs':arch/riscv/kernel/suspend.c:14:66: error: 'RISCV_ISA_EXT_XLINUXENVCFG' undeclared (first use in this function); did you mean 'RISCV_ISA_EXT_ZIFENCEI'?
14 | if
(riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
|
^~~~~~~~~~~~~~~~~~~~~~~~~~
| RISCV_ISA_EXT_ZIFENCEIarch/riscv/kernel/suspend.c:14:66: note: each undeclared identifier is reported only once for each function it appears in arch/riscv/kernel/suspend.c: In function 'suspend_restore_csrs':arch/riscv/kernel/suspend.c:37:66: error: 'RISCV_ISA_EXT_XLINUXENVCFG' undeclared (first use in this function); did you mean 'RISCV_ISA_EXT_ZIFENCEI'?
37 | if
(riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
|
^~~~~~~~~~~~~~~~~~~~~~~~~~
| RISCV_ISA_EXT_ZIFENCEI
## Source
* Kernel version: 6.6.83-rc1
* Git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* Git sha: 70aba17a9467a99637c9355a7eac2cc5e6b102cd
* Git describe: v6.6.81-153-g70aba17a9467
* Project details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.81-153-g70aba17a9467
## Build
* Build log: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.81-153-g70aba17a9467/testrun/27569234/suite/build/test/gcc-13-defconfig/log
* Build history:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/tests/build/gcc-13-defconfig
* Build details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.81-153-g70aba17a9467/testrun/27569234/suite/build/test/gcc-13-defconfig/
* Build link: https://storage.tuxsuite.com/public/linaro/lkft/builds/2u8VMDUVvHABJlsXGyG5COTPGZM/
* Kernel config:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2u8VMDUVvHABJlsXGyG5COTPGZM/config
## Steps to reproduce
- tuxmake --runtime podman --target-arch riscv --toolchain gcc-13
--kconfig defconfig
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.83 release. There are 145 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.83-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
The kernel, bpf tool, perf tool, and kselftest builds fine for v6.6.83-rc1 on x86 and arm64 Azure VM.
Kernel binary size for x86 build:
text data bss dec hex filename 27318015 16713718 4644864 48676597 2e6bef5 vmlinux
Kernel binary size for arm64 build:
text data bss dec hex filename 34688768 13844986 970368 49504122 2f35f7a vmlinux
Thanks,
Hardik