5.10.236-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.10.236-rc1 review
This is the start of the stable review cycle for the 5.10.236 release. There are 227 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Apr 2025 10:47:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.236-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.236-rc1
Takashi Iwai <[email protected]>
x86/kexec: Fix double-free of elf header buffer
Florian Westphal <[email protected]>
netfilter: conntrack: fix crash due to confirmed bit load reordering
Chuck Lever <[email protected]>
NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
Li Lingfeng <[email protected]>
nfsd: put dl_stid if fail to queue dl_recall
Roman Smirnov <[email protected]>
jfs: add index corruption check to DT_GETPAGE()
Qasim Ijaz <[email protected]>
jfs: fix slab-out-of-bounds read in ea_get()
Acs, Jakub <[email protected]>
ext4: fix OOB read when checking dotdot dir
Theodore Ts'o <[email protected]>
ext4: don't over-report free space or inodes in statvfs
Douglas Raillard <[email protected]>
tracing: Ensure module defining synth event cannot be unloaded while tracing
Tengda Wu <[email protected]>
tracing: Fix use-after-free in print_graph_function_flags during tracer switching
Karel Balej <[email protected]>
mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
Paul Menzel <[email protected]>
ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
Murad Masimov <[email protected]>
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
Jann Horn <[email protected]>
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
Guilherme G. Piccoli <[email protected]>
x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
Josef Bacik <[email protected]>
btrfs: handle errors from btrfs_dec_ref() properly
Markus Elfring <[email protected]>
ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
Hersen Wu <[email protected]>
drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
Jesse Zhang <[email protected]>
drm/amd/pm: Fix negative array index read
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: use UARTMODIR register bits for lpuart32 platform
Haibo Chen <[email protected]>
can: flexcan: only change CAN state when link up in system PM
Henry Martin <[email protected]>
arcnet: Add NULL check in com20020pci_probe()
Lin Ma <[email protected]>
net: fix geneve_opt length integer overflow
David Oberhollenzer <[email protected]>
net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
Fernando Fernandez Mancera <[email protected]>
ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
Lin Ma <[email protected]>
netfilter: nft_tunnel: fix geneve_opt type confusion addition
Guillaume Nault <[email protected]>
tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
Stefano Garzarella <[email protected]>
vsock: avoid timeout during connect() if the socket is closing
Cong Wang <[email protected]>
net_sched: skbprio: Remove overly strict queue assertions
Debin Zhu <[email protected]>
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
Nikita Shubin <[email protected]>
ntb: intel: Fix using link status DB's
Yajun Deng <[email protected]>
ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
Al Viro <[email protected]>
spufs: fix a leak in spufs_create_context()
Al Viro <[email protected]>
spufs: fix a leak on spufs_new_file() failure
Tasos Sahanidis <[email protected]>
hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}Oliver Hartkopp <[email protected]>
can: statistics: use atomic access in hot path
Navon John Lukose <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
Waiman Long <[email protected]>
locking/semaphore: Use wake_q to wake up processes outside lock critical section
Shrikanth Hegde <[email protected]>
sched/deadline: Use online cpus for validating runtime
Dmitry Panchenko <[email protected]>
platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet
Simon Tatham <[email protected]>
affs: don't write overlarge OFS data block size fields
Simon Tatham <[email protected]>
affs: generate OFS sequence numbers starting at 1
Icenowy Zheng <[email protected]>
nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
Icenowy Zheng <[email protected]>
nvme-pci: clean up CMBMSC when registering CMB fails
Sagi Grimberg <[email protected]>
nvme-tcp: fix possible UAF in nvme_tcp_poll
Johannes Berg <[email protected]>
wifi: iwlwifi: fw: allocate chained SG tables for dump
Josh Poimboeuf <[email protected]>
sched/smt: Always inline sched_smt_active()
Geetha sowjanya <[email protected]>
octeontx2-af: Fix mbox INTR handler when num VFs > 64
Giovanni Gherdovich <[email protected]>
ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid
Feng Yang <[email protected]>
ring-buffer: Fix bytes_dropped calculation issue
Mark Zhang <[email protected]>
rtnetlink: Allocate vfinfo size for VF GUIDs when supported
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in exfat_find_last_cluster()
Josh Poimboeuf <[email protected]>
objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
Bart Van Assche <[email protected]>
fs/procfs: fix the comment above proc_pid_wchan()
Arnaldo Carvalho de Melo <[email protected]>
perf python: Check if there is space to copy all the event
Arnaldo Carvalho de Melo <[email protected]>
perf python: Don't keep a raw_data pointer to consumed ring buffer space
Arnaldo Carvalho de Melo <[email protected]>
perf python: Decrement the refcount of just created event on failure
Arnaldo Carvalho de Melo <[email protected]>
perf python: Fixup description of sample.id event member
Trond Myklebust <[email protected]>
NFSv4: Don't trigger uneccessary scans for return-on-close delegations
Vasiliy Kovalev <[email protected]>
ocfs2: validate l_tree_depth to avoid out-of-bounds access
Sourabh Jain <[email protected]>
kexec: initialize ELF lowest address to ULONG_MAX
Arnaldo Carvalho de Melo <[email protected]>
perf units: Fix insufficient array space
Jonathan Cameron <[email protected]>
iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
Ilkka Koskinen <[email protected]>
coresight: catu: Fix number of pages while using 64k pages
Qasim Ijaz <[email protected]>
isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for aead auth key length
Jann Horn <[email protected]>
x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
Nikita Zhandarovich <[email protected]>
mfd: sm501: Switch to BIT() to mitigate integer overflows
Patrisious Haddad <[email protected]>
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
Artur Weber <[email protected]>
power: supply: max77693: Fix wrong conversion of charge input threshold value
Jann Horn <[email protected]>
x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
Jerome Brunet <[email protected]>
clk: amlogic: g12a: fix mmc A peripheral clock
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop non existing 32k clock parent
Jerome Brunet <[email protected]>
clk: amlogic: g12b: fix cluster A parent data
Prathamesh Shete <[email protected]>
pinctrl: tegra: Set SFIO mode to Mux Register
Maher Sanalla <[email protected]>
IB/mad: Check available slots before posting receive WRs
Peter Geis <[email protected]>
clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
Fabrizio Castro <[email protected]>
pinctrl: renesas: rza2: Fix missing of_node_put() call
Tanya Agarwal <[email protected]>
lib: 842: Improve error handling in sw842_compress()
Hou Tao <[email protected]>
bpf: Use preempt_count() directly in bpf_send_signal_common()
Will McVicker <[email protected]>
clk: samsung: Fix UBSAN panic in samsung_clk_init()
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop incorrect flag on 32k clock
Danila Chernetsov <[email protected]>
fbdev: sm501fb: Add some geometry checks.
Arnd Bergmann <[email protected]>
mdacon: rework dependency list
Markus Elfring <[email protected]>
fbdev: au1100fb: Move a variable assignment behind a null pointer check
Ilpo Järvinen <[email protected]>
PCI: pciehp: Don't enable HPIE when resuming in poll mode
Dan Carpenter <[email protected]>
drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
Thippeswamy Havalige <[email protected]>
PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
Dan Carpenter <[email protected]>
PCI: Remove stray put_device() in pci_register_host_bridge()
Vitaliy Shevtsov <[email protected]>
drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
Feng Tang <[email protected]>
PCI/portdrv: Only disable pciehp interrupts early when needed
Jim Quinlan <[email protected]>
PCI: brcmstb: Use internal register to change link capability
Hans Zhang <[email protected]>
PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
Daniel Stodden <[email protected]>
PCI/ASPM: Fix link state exit during switch upstream function removal
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
Tomi Valkeinen <[email protected]>
drm: xlnx: zynqmp: Fix max dma segment size
Wayne Lin <[email protected]>
drm/dp_mst: Fix drm RAD print
Jayesh Choudhary <[email protected]>
ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Always honor no_shutup_pins
Tao Chen <[email protected]>
perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
Sebastian Andrzej Siewior <[email protected]>
lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
Rafael J. Wysocki <[email protected]>
PM: sleep: Fix handling devices with direct_complete set on errors
Chenyuan Yang <[email protected]>
thermal: int340x: Add NULL check for adev
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the error path order of ie31200_init()
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the DIMM size mask for several SoCs
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
Tim Schumacher <[email protected]>
selinux: Chain up tool resolving errors in install_policy.sh
Rafael J. Wysocki <[email protected]>
PM: sleep: Adjust check before setting power.must_resume
Arnd Bergmann <[email protected]>
x86/platform: Only allow CONFIG_EISA for 32-bit
Benjamin Berg <[email protected]>
x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
Jie Zhan <[email protected]>
cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
zuoqian <[email protected]>
cpufreq: scpi: compare kHz instead of Hz
Mike Rapoport (Microsoft) <[email protected]>
x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
Eric Sandeen <[email protected]>
watch_queue: fix pipe accounting mismatch
Andy Shevchenko <[email protected]>
i2c: dev: check return value when calling dev_set_name()
Uwe Kleine-König <[email protected]>
media: i2c: et8ek8: Don't strip remove function when driver is builtin
John Keeping <[email protected]>
serial: 8250_dma: terminate correct DMA in tx_dma_flush()
Luo Qiu <[email protected]>
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
Dominique Martinet <[email protected]>
net: usb: usbnet: restore usb%d name exception for local mac addresses
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FE990B composition
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FN990B composition
Cameron Williams <[email protected]>
tty: serial: 8250: Add some more device IDs
William Breathitt Gray <[email protected]>
counter: microchip-tcb-capture: Fix undefined counter channel state on probe
Fabrice Gasnier <[email protected]>
counter: stm32-lptimer-cnt: fix error handling when enabling
Dhruv Deshpande <[email protected]>
ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
Maxim Mikityanskiy <[email protected]>
netfilter: socket: Lookup orig tuple for IPv6 SNAT
Yanjun Yang <[email protected]>
ARM: Remove address checking for MMUless devices
Kees Cook <[email protected]>
ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
Kees Cook <[email protected]>
ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
Minjoong Kim <[email protected]>
atm: Fix NULL pointer dereference
Terry Junge <[email protected]>
HID: hid-plantronics: Add mic mute mapping and generalize quirks
Terry Junge <[email protected]>
ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
Nikita Zhandarovich <[email protected]>
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
Saranya R <[email protected]>
soc: qcom: pdr: Fix the potential deadlock
Sven Eckelmann <[email protected]>
batman-adv: Ignore own maximum aggregation size during RX
Michal Luczaj <[email protected]>
bpf, sockmap: Fix race between element replace and close()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
Patrik Jakobsson <[email protected]>
drm/amdgpu: Fix even more out of bound writes from debugfs
Geert Uytterhoeven <[email protected]>
ARM: shmobile: smp: Enforce shmobile_smp_* alignment
Ye Bin <[email protected]>
proc: fix UAF in proc_get_inode()
Gu Bowen <[email protected]>
mmc: atmel-mci: Add missing clk_disable_unprepare()
Christian Eggers <[email protected]>
regulator: check that dummy regulator has been probed before using it
Maíra Canal <[email protected]>
drm/v3d: Don't run jobs that have errors flagged in its fence
Andreas Kemnade <[email protected]>
i2c: omap: fix IRQ storms
Lin Ma <[email protected]>
net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
Dan Carpenter <[email protected]>
net: atm: fix use after free in lec_send()
Kuniyuki Iwashima <[email protected]>
ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
Kuniyuki Iwashima <[email protected]>
ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
Dan Carpenter <[email protected]>
Bluetooth: Fix error code in chan_alloc_skb_cb()
Junxian Huang <[email protected]>
RDMA/hns: Fix wrong value of max_sge_rd
Junxian Huang <[email protected]>
RDMA/hns: Fix soft lockup during bt pages loop
Chengchang Tang <[email protected]>
RDMA/hns: Remove redundant 'phy_addr' in hns_roce_hem_list_find_mtt()
Saravanan Vajravel <[email protected]>
RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
Phil Elwell <[email protected]>
ARM: dts: bcm2711: Don't mark timer regs unconfigured
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
Phil Elwell <[email protected]>
ARM: dts: bcm2711: PL011 UARTs are actually r1p5
Cosmin Ratiu <[email protected]>
xfrm_output: Force software GSO only in tunnel mode
Joe Hattori <[email protected]>
firmware: imx-scu: fix OF node leak in .probe()
Ma Ke <[email protected]>
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
Michael Strauss <[email protected]>
drm/amd/display: Check for invalid input params when building scaling params
Dmytro Laktyushkin <[email protected]>
drm/amd/display: fix odm scaling
Nikola Cornij <[email protected]>
drm/amd/display: Reject too small viewport size when validating plane
Lee Jones <[email protected]>
drm/amd/display/dc/core/dc_resource: Staticify local functions
Mario Kleiner <[email protected]>
drm/amd/display: Check plane scaling against format specific hw plane caps.
Christophe JAILLET <[email protected]>
i2c: sis630: Fix an error handling path in sis630_probe()
Christophe JAILLET <[email protected]>
i2c: ali15x3: Fix an error handling path in ali15x3_probe()
Christophe JAILLET <[email protected]>
i2c: ali1535: Fix an error handling path in ali1535_probe()
Christophe JAILLET <[email protected]>
ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
Ivan Abramov <[email protected]>
drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
Haoxiang Li <[email protected]>
qlcnic: fix memory leak issues in qlcnic_sriov_common.c
Mario Limonciello <[email protected]>
drm/amd/display: Fix slab-use-after-free on hdcp_work
Alex Hung <[email protected]>
drm/amd/display: Assign normalized_pix_clk when color depth = 14
Ville Syrjälä <[email protected]>
drm/atomic: Filter out redundant DPMS calls
Florent Revest <[email protected]>
x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
Johan Hovold <[email protected]>
USB: serial: option: match on interface class for Telit FN990B
Fabio Porcedda <[email protected]>
USB: serial: option: fix Telit Cinterion FE990A name
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE990B compositions
Boon Khai Ng <[email protected]>
USB: serial: ftdi_sio: add support for Altera USB Blaster 3
Ming Lei <[email protected]>
block: fix 'kmem_cache of name 'bio-108' already exists'
Thomas Zimmermann <[email protected]>
drm/nouveau: Do not override forced connector status
Matthieu Baerts (NGI0) <[email protected]>
mptcp: safety check before fallback
Arnd Bergmann <[email protected]>
x86/irq: Define trace events conditionally
Miklos Szeredi <[email protected]>
fuse: don't truncate cached, mutated symlink
Hector Martin <[email protected]>
ASoC: tas2764: Set the SDOUT polarity correctly
Hector Martin <[email protected]>
ASoC: tas2764: Fix power control mask
Hector Martin <[email protected]>
ASoC: tas2770: Fix volume scale
Daniel Wagner <[email protected]>
nvme: only allow entering LIVE from CONNECTING state
Yu-Chun Lin <[email protected]>
sctp: Fix undefined behavior in left shift operation
Ruozhu Li <[email protected]>
nvmet-rdma: recheck queue state is LIVE in state lock in recv done
Terry Cheong <[email protected]>
ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
Vitaly Rodionov <[email protected]>
ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
Kuninori Morimoto <[email protected]>
ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
Daniel Lezcano <[email protected]>
thermal/cpufreq_cooling: Remove structure member documentation
Peter Oberparleiter <[email protected]>
s390/cio: Fix CHPID "configure" attribute caching
Chia-Lin Kao (AceLan) <[email protected]>
HID: ignore non-functional sensor in HP 5MP Camera
Zhang Lixu <[email protected]>
HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
Brahmajit Das <[email protected]>
vboxsf: fix building with GCC 15
Eric W. Biederman <[email protected]>
alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
Gannon Kolding <[email protected]>
ACPI: resource: IRQ override for Eluktronics MECH-17
Magnus Lindholm <[email protected]>
scsi: qla1280: Fix kernel oops when debug level > 2
Chengen Du <[email protected]>
iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
Joe Hattori <[email protected]>
powercap: call put_device() on an error path in powercap_register_control_type()
Andy Shevchenko <[email protected]>
hrtimers: Mark is_migration_base() with __always_inline
Daniel Wagner <[email protected]>
nvme-fc: go straight to connecting state when initializing
Carolina Jubran <[email protected]>
net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
Alexey Kashavkin <[email protected]>
netfilter: nft_exthdr: fix offset with ipv4_find_option()
Cong Wang <[email protected]>
net_sched: Prevent creation of classes with TC_H_ROOT
Dan Carpenter <[email protected]>
ipvs: prevent integer overflow in do_ip_vs_get_ctl()
Kohei Enju <[email protected]>
netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
Wentao Liang <[email protected]>
net/mlx5: handle errors in mlx5_chains_create_table()
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
Breno Leitao <[email protected]>
netpoll: hold rcu read lock in __netpoll_send_skb()
Grzegorz Nitka <[email protected]>
ice: fix memory leak in aRFS after reset
Sebastian Andrzej Siewior <[email protected]>
netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
Florian Westphal <[email protected]>
netfilter: nft_ct: fix use after free when attaching zone template
Florian Westphal <[email protected]>
netfilter: conntrack: convert to refcount_t api
Artur Weber <[email protected]>
pinctrl: bcm281xx: Fix incorrect regmap max_registers value
Michael Kelley <[email protected]>
fbdev: hyperv_fb: iounmap() the correct memory when removing a device
Baoquan He <[email protected]>
x86/kexec: fix memory leak of elf header buffer
Sean Christopherson <[email protected]>
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
Wang Yufen <[email protected]>
ipv6: Fix signed integer overflow in __ip6_append_data
Oleg Nesterov <[email protected]>
sched/isolation: Prevent boot crash when the boot CPU is nohz_full
David Woodhouse <[email protected]>
clockevents/drivers/i8253: Fix stop sequence for timer 0
Eric Dumazet <[email protected]>
vlan: fix memory leak in vlan_newlink()
-------------
Diffstat:
Documentation/timers/no_hz.rst | 7 +- Makefile | 4 +- arch/alpha/include/asm/elf.h | 6 +- arch/alpha/include/asm/pgtable.h | 2 +- arch/alpha/include/asm/processor.h | 8 +- arch/alpha/kernel/osf_sys.c | 11 +- arch/arm/boot/dts/bcm2711.dtsi | 11 +- arch/arm/mach-shmobile/headsmp.S | 1 + arch/arm/mm/fault.c | 8 + arch/powerpc/platforms/cell/spufs/inode.c | 9 +- arch/x86/Kconfig | 2 +- arch/x86/entry/calling.h | 2 + arch/x86/include/asm/tlbflush.h | 2 +- arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/cpu/mshyperv.c | 11 - arch/x86/kernel/crash.c | 4 +- arch/x86/kernel/dumpstack.c | 5 +- arch/x86/kernel/irq.c | 2 + arch/x86/kernel/machine_kexec_64.c | 12 +- arch/x86/kernel/process.c | 7 +- arch/x86/kernel/tsc.c | 4 +- arch/x86/kvm/hyperv.c | 6 +- arch/x86/mm/pat/cpa-test.c | 2 +- block/bio.c | 2 +- drivers/acpi/nfit/core.c | 2 +- drivers/acpi/processor_idle.c | 4 + drivers/acpi/resource.c | 13 + drivers/base/power/main.c | 21 +- drivers/base/power/runtime.c | 2 +- drivers/clk/meson/g12a.c | 38 +- drivers/clk/meson/gxbb.c | 14 +- drivers/clk/rockchip/clk-rk3328.c | 2 +- drivers/clk/samsung/clk.c | 2 +- drivers/clocksource/i8253.c | 36 +- drivers/counter/microchip-tcb-capture.c | 19 + drivers/counter/stm32-lptimer-cnt.c | 24 +- drivers/cpufreq/cpufreq_governor.c | 45 +- drivers/cpufreq/scpi-cpufreq.c | 5 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 8 +- drivers/edac/ie31200_edac.c | 19 +- drivers/firmware/imx/imx-scu.c | 1 + drivers/firmware/iscsi_ibft.c | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 106 +++- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 14 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 1 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 589 ++++++++------------- drivers/gpu/drm/amd/display/dc/dc.h | 1 + drivers/gpu/drm/amd/display/dc/dc_types.h | 5 - .../gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c | 12 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 14 +- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 12 +- .../drm/amd/display/dc/dml/display_mode_structs.h | 2 + .../gpu/drm/amd/display/dc/dml/display_mode_vba.c | 40 +- drivers/gpu/drm/amd/display/dc/inc/hw/transform.h | 4 - drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 21 +- drivers/gpu/drm/drm_atomic_uapi.c | 4 + drivers/gpu/drm/drm_connector.c | 4 + drivers/gpu/drm/drm_dp_mst_topology.c | 8 +- drivers/gpu/drm/gma500/mid_bios.c | 5 + drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 33 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 1 - drivers/gpu/drm/radeon/radeon_vce.c | 2 +- drivers/gpu/drm/v3d/v3d_sched.c | 9 +- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-plantronics.c | 144 +++-- drivers/hid/hid-quirks.c | 1 + drivers/hid/intel-ish-hid/ipc/ipc.c | 6 +- drivers/hv/vmbus_drv.c | 13 + drivers/hwmon/nct6775.c | 4 +- drivers/hwtracing/coresight/coresight-catu.c | 2 +- drivers/i2c/busses/i2c-ali1535.c | 12 +- drivers/i2c/busses/i2c-ali15x3.c | 12 +- drivers/i2c/busses/i2c-omap.c | 26 +- drivers/i2c/busses/i2c-sis630.c | 12 +- drivers/i2c/i2c-dev.c | 15 +- drivers/iio/accel/mma8452.c | 10 +- drivers/infiniband/core/mad.c | 38 +- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 - drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 3 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 23 +- drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 +- drivers/infiniband/hw/mlx5/cq.c | 2 +- drivers/media/dvb-frontends/dib8000.c | 5 +- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 +- drivers/memstick/host/rtsx_usb_ms.c | 1 + drivers/mfd/sm501.c | 6 +- drivers/mmc/host/atmel-mci.c | 4 +- drivers/mmc/host/sdhci-pxav3.c | 1 + drivers/net/arcnet/com20020-pci.c | 17 +- drivers/net/can/flexcan.c | 6 +- drivers/net/dsa/mv88e6xxx/chip.c | 11 +- drivers/net/dsa/mv88e6xxx/phy.c | 3 + drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 +- .../ethernet/mellanox/mlx5/core/lib/fs_chains.c | 5 + .../ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 8 +- drivers/net/usb/qmi_wwan.c | 2 + drivers/net/usb/usbnet.c | 21 +- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 86 ++- drivers/ntb/hw/intel/ntb_hw_gen3.c | 3 + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +- drivers/ntb/test/ntb_perf.c | 4 +- drivers/nvme/host/core.c | 2 - drivers/nvme/host/fc.c | 3 +- drivers/nvme/host/pci.c | 21 +- drivers/nvme/host/tcp.c | 5 +- drivers/nvme/target/rdma.c | 33 +- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/cadence/pcie-cadence.h | 2 +- drivers/pci/controller/pcie-brcmstb.c | 4 +- drivers/pci/controller/pcie-xilinx-cpm.c | 10 +- drivers/pci/hotplug/pciehp_hpc.c | 4 +- drivers/pci/pcie/aspm.c | 17 +- drivers/pci/pcie/portdrv_core.c | 8 +- drivers/pci/probe.c | 5 +- drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 2 +- drivers/pinctrl/renesas/pinctrl-rza2.c | 2 + drivers/pinctrl/tegra/pinctrl-tegra.c | 3 + drivers/platform/x86/intel-hid.c | 7 + drivers/power/supply/max77693_charger.c | 2 +- drivers/powercap/powercap_sys.c | 3 +- drivers/regulator/core.c | 12 +- drivers/remoteproc/qcom_q6v5_pas.c | 10 +- drivers/s390/cio/chp.c | 3 +- drivers/scsi/qla1280.c | 2 +- drivers/soc/qcom/pdr_interface.c | 8 +- drivers/thermal/cpufreq_cooling.c | 2 - .../intel/int340x_thermal/int3402_thermal.c | 3 + drivers/tty/serial/8250/8250_dma.c | 2 +- drivers/tty/serial/8250/8250_pci.c | 16 + drivers/tty/serial/fsl_lpuart.c | 25 +- drivers/usb/serial/ftdi_sio.c | 14 + drivers/usb/serial/ftdi_sio_ids.h | 13 + drivers/usb/serial/option.c | 48 +- drivers/video/console/Kconfig | 2 +- drivers/video/fbdev/au1100fb.c | 4 +- drivers/video/fbdev/hyperv_fb.c | 2 +- drivers/video/fbdev/sm501fb.c | 7 + fs/affs/file.c | 9 +- fs/btrfs/extent-tree.c | 5 +- fs/exfat/fatent.c | 2 +- fs/ext4/dir.c | 3 + fs/ext4/super.c | 27 +- fs/fuse/dir.c | 2 +- fs/isofs/dir.c | 3 +- fs/jfs/jfs_dtree.c | 3 +- fs/jfs/xattr.c | 13 +- fs/namei.c | 24 +- fs/nfs/delegation.c | 33 +- fs/nfsd/nfs4state.c | 31 +- fs/ocfs2/alloc.c | 8 + fs/proc/base.c | 2 +- fs/proc/generic.c | 10 +- fs/proc/inode.c | 6 +- fs/proc/internal.h | 14 + fs/vboxsf/super.c | 3 +- include/drm/drm_dp_mst_helper.h | 7 + include/linux/fs.h | 2 + include/linux/i8253.h | 1 - include/linux/interrupt.h | 8 +- include/linux/netfilter/nf_conntrack_common.h | 8 +- include/linux/pm_runtime.h | 2 + include/linux/proc_fs.h | 7 +- include/linux/sched/smt.h | 2 +- include/net/ipv6.h | 4 +- kernel/events/ring_buffer.c | 2 +- kernel/kexec_elf.c | 2 +- kernel/locking/semaphore.c | 13 +- kernel/sched/deadline.c | 2 +- kernel/time/hrtimer.c | 22 +- kernel/trace/bpf_trace.c | 2 +- kernel/trace/ring_buffer.c | 4 +- kernel/trace/trace_events_synth.c | 30 +- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 - kernel/trace/trace_sched_wakeup.c | 2 - kernel/watch_queue.c | 9 + lib/842/842_compress.c | 2 + net/8021q/vlan_netlink.c | 10 +- net/atm/lec.c | 3 +- net/atm/mpc.c | 2 + net/batman-adv/bat_iv_ogm.c | 3 +- net/batman-adv/bat_v_ogm.c | 3 +- net/bluetooth/6lowpan.c | 7 +- net/bluetooth/hci_event.c | 13 +- net/can/af_can.c | 12 +- net/can/af_can.h | 12 +- net/can/proc.c | 46 +- net/core/neighbour.c | 1 + net/core/netpoll.c | 9 +- net/core/rtnetlink.c | 3 + net/core/sock_map.c | 5 +- net/ipv4/ip_tunnel_core.c | 4 +- net/ipv6/addrconf.c | 37 +- net/ipv6/calipso.c | 21 +- net/ipv6/ip6_output.c | 6 +- net/ipv6/netfilter/nf_socket_ipv6.c | 23 + net/ipv6/route.c | 5 +- net/mptcp/protocol.h | 2 + net/netfilter/ipvs/ip_vs_ctl.c | 8 +- net/netfilter/nf_conncount.c | 2 + net/netfilter/nf_conntrack_core.c | 48 +- net/netfilter/nf_conntrack_expect.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 7 +- net/netfilter/nf_conntrack_standalone.c | 7 +- net/netfilter/nf_flow_table_core.c | 2 +- net/netfilter/nf_synproxy_core.c | 1 - net/netfilter/nft_ct.c | 11 +- net/netfilter/nft_exthdr.c | 10 +- net/netfilter/nft_tunnel.c | 6 +- net/netfilter/xt_CT.c | 3 +- net/openvswitch/actions.c | 6 - net/openvswitch/conntrack.c | 1 - net/sched/act_ct.c | 1 - net/sched/act_tunnel_key.c | 2 +- net/sched/cls_flower.c | 2 +- net/sched/sch_api.c | 6 + net/sched/sch_skbprio.c | 3 - net/sctp/stream.c | 2 +- net/vmw_vsock/af_vsock.c | 6 +- net/xfrm/xfrm_output.c | 2 +- scripts/selinux/install_policy.sh | 15 +- sound/pci/hda/patch_realtek.c | 28 +- sound/soc/codecs/arizona.c | 14 +- sound/soc/codecs/madera.c | 10 +- sound/soc/codecs/tas2764.c | 10 +- sound/soc/codecs/tas2764.h | 8 +- sound/soc/codecs/tas2770.c | 2 +- sound/soc/codecs/wm0010.c | 13 +- sound/soc/codecs/wm5110.c | 8 +- sound/soc/sh/rcar/core.c | 14 - sound/soc/sh/rcar/rsnd.h | 1 - sound/soc/sh/rcar/src.c | 18 +- sound/soc/sof/intel/hda-codec.c | 1 + sound/soc/ti/j721e-evm.c | 2 + sound/usb/mixer_quirks.c | 51 ++ tools/perf/util/python.c | 17 +- tools/perf/util/units.c | 2 +- 243 files changed, 1863 insertions(+), 1177 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/227 vlan: fix memory leak in vlan_newlink()
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 72a0b329114b1caa8e69dfa7cdad1dd3c69b8602 upstream.
Blamed commit added back a bug I fixed in commit 9bbd917e0bec ("vlan: fix memory leak in vlan_dev_set_egress_priority")
If a memory allocation fails in vlan_changelink() after other allocations succeeded, we need to call vlan_dev_free_egress_priority()
to free all allocated memory because after a failed ->newlink() we do not call any methods like ndo_uninit() or dev->priv_destructor().
In following example, if the allocation for last element 2000:2001 fails, we need to free eight prior allocations:
ip link add link dummy0 dummy0.100 type vlan id 100 \
egress-qos-map 1:2 2:3 3:4 4:5 5:6 6:7 7:8 8:9 2000:2001
syzbot report was:
BUG: memory leak
unreferenced object 0xffff888117bd1060 (size 32):
comm "syz-executor408", pid 3759, jiffies 4294956555 (age 34.090s) hex dump (first 32 bytes):
09 00 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace:
[<ffffffff83fc60ad>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff83fc60ad>] vlan_dev_set_egress_priority+0xed/0x170 net/8021q/vlan_dev.c:193 [<ffffffff83fc6628>] vlan_changelink+0x178/0x1d0 net/8021q/vlan_netlink.c:128 [<ffffffff83fc67c8>] vlan_newlink+0x148/0x260 net/8021q/vlan_netlink.c:185 [<ffffffff838b1278>] rtnl_newlink_create net/core/rtnetlink.c:3363 [inline] [<ffffffff838b1278>] __rtnl_newlink+0xa58/0xdc0 net/core/rtnetlink.c:3580 [<ffffffff838b1629>] rtnl_newlink+0x49/0x70 net/core/rtnetlink.c:3593 [<ffffffff838ac66c>] rtnetlink_rcv_msg+0x21c/0x5c0 net/core/rtnetlink.c:6089 [<ffffffff839f9c37>] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2501 [<ffffffff839f8da7>] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [<ffffffff839f8da7>] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [<ffffffff839f9266>] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [<ffffffff8384dbf6>] sock_sendmsg_nosec net/socket.c:714 [inline] [<ffffffff8384dbf6>] sock_sendmsg+0x56/0x80 net/socket.c:734 [<ffffffff8384e15c>] ____sys_sendmsg+0x36c/0x390 net/socket.c:2488 [<ffffffff838523cb>] ___sys_sendmsg+0x8b/0xd0 net/socket.c:2542 [<ffffffff838525b8>] __sys_sendmsg net/socket.c:2571 [inline] [<ffffffff838525b8>] __do_sys_sendmsg net/socket.c:2580 [inline] [<ffffffff838525b8>] __se_sys_sendmsg net/socket.c:2578 [inline] [<ffffffff838525b8>] __x64_sys_sendmsg+0x78/0xf0 net/socket.c:2578 [<ffffffff845ad8d5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff845ad8d5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff8460006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
--- net/8021q/vlan_netlink.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/8021q/vlan_netlink.c +7 -3
@@ -186,10 +186,14 @@ static int vlan_newlink(struct net *src_else if (dev->mtu > max_mtu)return -EINVAL ; +/* Note: If this initial vlan_changelink() fails, we need +* to call vlan_dev_free_egress_priority() to free memory. +*/ err =vlan_changelink (dev, tb, data, extack); -if (err) -return err; - err =register_vlan_dev (dev, extack); + +if (!err) + err =register_vlan_dev (dev, extack); +if (err)vlan_dev_free_egress_priority (dev);return err;
Greg Kroah-Hartman
maintainerPATCH 2/227 clockevents/drivers/i8253: Fix stop sequence for timer 0
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <[email protected]>
commit 531b2ca0a940ac9db03f246c8b77c4201de72b00 upstream.
According to the data sheet, writing the MODE register should stop the counter (and thus the interrupts). This appears to work on real hardware, at least modern Intel and AMD systems. It should also work on Hyper-V.
However, on some buggy virtual machines the mode change doesn't have any effect until the counter is subsequently loaded (or perhaps when the IRQ next fires).
So, set MODE 0 and then load the counter, to ensure that those buggy VMs do the right thing and the interrupts stop. And then write MODE 0 *again* to stop the counter on compliant implementations too.
Apparently, Hyper-V keeps firing the IRQ *repeatedly* even in mode zero when it should only happen once, but the second MODE write stops that too.
Userspace test program (mostly written by tglx):
=====
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdint.h>
#include <sys/io.h>
static __always_inline void __out##bwl(type value, uint16_t port) \
{ \
asm volatile("out" #bwl " %" #bw "0, %w1" \
: : "a"(value), "Nd"(port)); \
} \
\
static __always_inline type __in##bwl(uint16_t port) \
{ \
type value; \
asm volatile("in" #bwl " %w1, %" #bw "0" \
: "=a"(value) : "Nd"(port)); \
return value; \
}BUILDIO(b, b, uint8_t)
#define inb __inb
#define outb __outb
#define PIT_MODE 0x43
#define PIT_CH0 0x40
#define PIT_CH2 0x42
static int is8254;
static void dump_pit(void)
{
if (is8254) {
// Latch and output counter and status
outb(0xC2, PIT_MODE);
printf("%02x %02x %02x\n", inb(PIT_CH0), inb(PIT_CH0), inb(PIT_CH0));
} else {
// Latch and output counter
outb(0x0, PIT_MODE);
printf("%02x %02x\n", inb(PIT_CH0), inb(PIT_CH0));
}
}int main(int argc, char* argv[])
{
int nr_counts = 2;
if (argc > 1)
nr_counts = atoi(argv[1]);
if (argc > 2)
is8254 = 1;
if (ioperm(0x40, 4, 1) != 0)
return 1;
dump_pit();
printf("Set oneshot\n");
outb(0x38, PIT_MODE);
outb(0x00, PIT_CH0);
outb(0x0F, PIT_CH0);
dump_pit();
usleep(1000);
dump_pit();
printf("Set periodic\n");
outb(0x34, PIT_MODE);
outb(0x00, PIT_CH0);
outb(0x0F, PIT_CH0);
dump_pit();
usleep(1000);
dump_pit();
dump_pit();
usleep(100000);
dump_pit();
usleep(100000);
dump_pit();
printf("Set stop (%d counter writes)\n", nr_counts);
outb(0x30, PIT_MODE);
while (nr_counts--)
outb(0xFF, PIT_CH0);
dump_pit();
usleep(100000);
dump_pit();
usleep(100000);
dump_pit();
printf("Set MODE 0\n");
outb(0x30, PIT_MODE);
dump_pit();
usleep(100000);
dump_pit();
usleep(100000);
dump_pit();
return 0;
}=====
--- arch/x86/kernel/cpu/mshyperv.c | 11 ----------- drivers/clocksource/i8253.c | 36 +++++++++++++++++++++++++----------- include/linux/i8253.h | 1 - 3 files changed, 25 insertions(+), 23 deletions(-)
arch/x86/kernel/cpu/mshyperv.c +0 -11
@@ -16,7 +16,6 @@#include <linux/interrupt.h> #include <linux/irq.h> #include <linux/kexec.h> -#include <linux/i8253.h> #include <linux/random.h> #include <asm/processor.h> #include <asm/hypervisor.h>
@@ -389,16 +388,6 @@ static void __init ms_hyperv_init_platfoif (efi_enabled (EFI_BOOT )) x86_platform.get_nmi_reason = hv_get_nmi_reason; -/* -* Hyper-V VMs have a PIT emulation quirk such that zeroing the -* counter register during PIT shutdown restarts the PIT. So it -* continues to interrupt @18.2 HZ. Setting i8253_clear_counter -* to false tells pit_shutdown() not to zero the counter so that -* the PIT really is shutdown. Generation 2 VMs don't have a PIT, -* and setting this value has no effect. -*/ - i8253_clear_counter_on_shutdown = false; -#if IS_ENABLED (CONFIG_HYPERV )/* * Setup the hook to get control post apic initialization.
drivers/clocksource/i8253.c +25 -11
@@ -20,13 +20,6 @@DEFINE_RAW_SPINLOCK (i8253_lock);EXPORT_SYMBOL (i8253_lock); -/* -* Handle PIT quirk in pit_shutdown() where zeroing the counter register -* restarts the PIT, negating the shutdown. On platforms with the quirk, -* platform specific code can set this to false. -*/ -bool i8253_clear_counter_on_shutdown__ro_after_init = true; -#ifdef CONFIG_CLKSRC_I8253 /* * Since the PIT overflows every tick, its not very useful
@@ -112,12 +105,33 @@ void clockevent_i8253_disable(void) {raw_spin_lock (&i8253_lock); +/* +* Writing the MODE register should stop the counter, according to +* the datasheet. This appears to work on real hardware (well, on +* modern Intel and AMD boxes; I didn't dig the Pegasos out of the +* shed). +* +* However, some virtual implementations differ, and the MODE change +* doesn't have any effect until either the counter is written (KVM +* in-kernel PIT) or the next interrupt (QEMU). And in those cases, +* it may not stop the *count*, only the interrupts. Although in +* the virt case, that probably doesn't matter, as the value of the +* counter will only be calculated on demand if the guest reads it; +* it's the interrupts which cause steal time. +* +* Hyper-V apparently has a bug where even in mode 0, the IRQ keeps +* firing repeatedly if the counter is running. But it *does* do the +* right thing when the MODE register is written. +* +* So: write the MODE and then load the counter, which ensures that +* the IRQ is stopped on those buggy virt implementations. And then +* write the MODE again, which is the right way to stop it. +*/ outb_p (0x30 ,PIT_MODE ); +outb_p (0 ,PIT_CH0 ); +outb_p (0 ,PIT_CH0 ); -if (i8253_clear_counter_on_shutdown) { -outb_p (0 ,PIT_CH0 ); -outb_p (0 ,PIT_CH0 ); - } +outb_p (0x30 ,PIT_MODE );raw_spin_unlock (&i8253_lock); }
include/linux/i8253.h +0 -1
@@ -21,7 +21,6 @@#define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ)extern raw_spinlock_t i8253_lock; -extern bool i8253_clear_counter_on_shutdown;extern struct clock_event_device i8253_clockevent;extern void clockevent_i8253_init (bool oneshot);extern void clockevent_i8253_disable (void );
Greg Kroah-Hartman
maintainerPATCH 3/227 sched/isolation: Prevent boot crash when the boot CPU is nohz_full
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
Documentation/timers/no_hz.rst states that the "nohz_full=" mask must not include the boot CPU, which is no longer true after:
08ae95f4fd3b ("nohz_full: Allow the boot CPU to be nohz_full").
However after:
aae17ebb53cd ("workqueue: Avoid using isolated cpus' timers on queue_delayed_work")
the kernel will crash at boot time in this case; housekeeping_any_cpu() returns an invalid CPU number until smp_init() brings the first housekeeping CPU up.
Change housekeeping_any_cpu() to check the result of cpumask_any_and() and return smp_processor_id() in this case.
This is just the simple and backportable workaround which fixes the symptom, but smp_processor_id() at boot time should be safe at least for type == HK_TYPE_TIMER, this more or less matches the tick_do_timer_boot_cpu logic.
There is no worry about cpu_down(); tick_nohz_cpu_down() will not allow to offline tick_do_timer_cpu (the 1st online housekeeping CPU).
[ Apply only documentation changes as commit which causes boot
crash when boot CPU is nohz_full is not backported to stable kernels - Krishanth ]
[ strip out upstream commit and Fixes: so tools don't get confused that
this commit actually does anything real - gregkh]
--- Documentation/timers/no_hz.rst | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
Documentation/timers/no_hz.rst +2 -5
@@ -129,11 +129,8 @@ adaptive-tick CPUs: At least one non-ad online to handle timekeeping tasks in order to ensure that system calls like gettimeofday() returns accurate values on adaptive-tick CPUs. (This is not an issue for CONFIG_NO_HZ_IDLE=y because there are no running -user processes to observe slight drifts in clock rate.) Therefore, the -boot CPU is prohibited from entering adaptive-ticks mode. Specifying a -"nohz_full=" mask that includes the boot CPU will result in a boot-time -error message, and the boot CPU will be removed from the mask. Note that -this means that your system must have at least two CPUs in order for +user processes to observe slight drifts in clock rate.) Note that this +means that your system must have at least two CPUs in order for CONFIG_NO_HZ_FULL=y to do anything for you. Finally, adaptive-ticks CPUs must have their RCU callbacks offloaded.
Greg Kroah-Hartman
maintainerPATCH 4/227 ipv6: Fix signed integer overflow in __ip6_append_data
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yufen <[email protected]>
commit f93431c86b631bbca5614c66f966bf3ddb3c2803 upstream.
Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.
UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170
Changes since v1:
-Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2:
-Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3:
-Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested.
[ Conflict due to f37a4cc6bb0b ("udp6: pass flow in ip6_make_skb
together with cork") not in the tree ]
--- include/net/ipv6.h | 4 ++-- net/ipv6/ip6_output.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-)
include/net/ipv6.h +2 -2
@@ -991,7 +991,7 @@ int ip6_find_1stfragopt(struct sk_buff *int ip6_append_data (struct sock *sk,int getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), -void *from,int length,int transhdrlen, +void *from,size_t length,int transhdrlen,struct ipcm6_cookie *ipc6,struct flowi6 *fl6,struct rt6_info *rt,unsigned int flags);
@@ -1007,7 +1007,7 @@ struct sk_buff *__ip6_make_skb(struct sostruct sk_buff *ip6_make_skb (struct sock *sk,int getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), -void *from,int length,int transhdrlen, +void *from,size_t length,int transhdrlen,struct ipcm6_cookie *ipc6,struct flowi6 *fl6,struct rt6_info *rt,unsigned int flags,struct inet_cork_full *cork);
net/ipv6/ip6_output.c +3 -3
@@ -1449,7 +1449,7 @@ static int __ip6_append_data(struct sockstruct page_frag *pfrag, int getfrag(void *from, char *to, int offset,int len,int odd,struct sk_buff *skb), - void *from, int length, int transhdrlen, + void *from, size_t length, int transhdrlen, unsigned int flags, struct ipcm6_cookie *ipc6) { struct sk_buff *skb, *skb_prev = NULL;
@@ -1795,7 +1795,7 @@ error:int ip6_append_data (struct sock *sk,int getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), -void *from,int length,int transhdrlen, +void *from,size_t length,int transhdrlen,struct ipcm6_cookie *ipc6,struct flowi6 *fl6,struct rt6_info *rt,unsigned int flags) {
@@ -1989,7 +1989,7 @@ EXPORT_SYMBOL_GPL(ip6_flush_pending_framstruct sk_buff *ip6_make_skb (struct sock *sk,int getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), -void *from,int length,int transhdrlen, +void *from,size_t length,int transhdrlen,struct ipcm6_cookie *ipc6,struct flowi6 *fl6,struct rt6_info *rt,unsigned int flags,struct inet_cork_full *cork)
Greg Kroah-Hartman
maintainerPATCH 5/227 KVM: x86: Reject Hyper-Vs SEND_IPI hypercalls if local APIC isnt in-kernel
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit a8de7f100bb5989d9c3627d3a223ee1c863f3b69 upstream.
Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said hypercalls if the local APIC is emulated in userspace, i.e. don't rely on userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID.
Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference if Hyper-V enlightenments are exposed to the guest without an in-kernel local APIC:
dump_stack+0xbe/0xfd __kasan_report.cold+0x34/0x84 kasan_report+0x3a/0x50 __apic_accept_irq+0x3a/0x5c0 kvm_hv_send_ipi.isra.0+0x34e/0x820 kvm_hv_hypercall+0x8d9/0x9d0 kvm_emulate_hypercall+0x506/0x7e0 __vmx_handle_exit+0x283/0xb60 vmx_handle_exit+0x1d/0xd0 vcpu_enter_guest+0x16b0/0x24c0 vcpu_run+0xc0/0x550 kvm_arch_vcpu_ioctl_run+0x170/0x6d0 kvm_vcpu_ioctl+0x413/0xb20 __se_sys_ioctl+0x111/0x160 do_syscal1_64+0x30/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1
Note, checking the sending vCPU is sufficient, as the per-VM irqchip_mode can't be modified after vCPUs are created, i.e. if one vCPU has an in-kernel local APIC, then all vCPUs have an in-kernel local APIC.
[ Conflict due to 72167a9d7da2 ("KVM: x86: hyper-v: Stop shadowing
global 'current_vcpu' variable") not in the tree ]
--- arch/x86/kvm/hyperv.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/x86/kvm/hyperv.c +5 -1
@@ -1618,6 +1618,9 @@ static u64 kvm_hv_send_ipi(struct kvm_vcu32 vector;bool all_cpus; +if (!lapic_in_kernel (current_vcpu)) +return HV_STATUS_INVALID_HYPERCALL_INPUT ; +if (!ex) {if (!fast) { if (unlikely(kvm_read_guest(kvm, ingpa, &send_ipi,
@@ -2060,7 +2063,8 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct k ent->eax |=HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED ; ent->eax |=HV_X64_APIC_ACCESS_RECOMMENDED ; ent->eax |=HV_X64_RELAXED_TIMING_RECOMMENDED ; - ent->eax |=HV_X64_CLUSTER_IPI_RECOMMENDED ; +if (!vcpu ||lapic_in_kernel (vcpu)) + ent->eax |=HV_X64_CLUSTER_IPI_RECOMMENDED ; ent->eax |=HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED ;if (evmcs_ver) ent->eax |=HV_X64_ENLIGHTENED_VMCS_RECOMMENDED ;
Greg Kroah-Hartman
maintainerPATCH 6/227 x86/kexec: fix memory leak of elf header buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <[email protected]>
commit b3e34a47f98974d0844444c5121aaff123004e57 upstream.
This is reported by kmemleak detector:
unreferenced object 0xffffc900002a9000 (size 4096):
comm "kexec", pid 14950, jiffies 4295110793 (age 373.951s) hex dump (first 32 bytes):
7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............
04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00 ..>.............
backtrace:
[<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170
[<000000002b66b6c0>] __vmalloc_node+0xb4/0x160
[<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0
[<0000000019afff23>] crash_load_segments+0x260/0x470
[<0000000019ebe95c>] bzImage64_load+0x814/0xad0
[<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0
[<000000009ef2fc88>] kimage_file_alloc_init+0x2ec/0x5a0
[<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530
[<0000000087c19992>] do_syscall_64+0x3b/0x90
[<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xaeIn crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to store elf headers. While it's not freed back to system correctly when kdump kernel is reloaded or unloaded. Then memory leak is caused. Fix it by introducing x86 specific function arch_kimage_file_post_load_cleanup(), and freeing the buffer there.
And also remove the incorrect elf header buffer freeing code. Before calling arch specific kexec_file loading function, the image instance has been initialized. So 'image->elf_headers' must be NULL. It doesn't make sense to free the elf header buffer in the place.
Three different people have reported three bugs about the memory leak on x86_64 inside Redhat.
[ Conflict due to 179350f00e06 ("x86: Use ELF fields defined in 'struct
kimage'") not in the tree ]
--- arch/x86/kernel/machine_kexec_64.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/x86/kernel/machine_kexec_64.c +9 -3
@@ -402,9 +402,6 @@ void machine_kexec(struct kimage *image)#ifdef CONFIG_KEXEC_FILE void *arch_kexec_kernel_image_load (struct kimage *image) { -vfree (image->arch.elf_headers); - image->arch.elf_headers =NULL ; -if (!image->fops || !image->fops->load)return ERR_PTR (-ENOEXEC );
@@ -540,6 +537,15 @@ overflow: (int)ELF64_R_TYPE(rel[i].r_info), value);return -ENOEXEC ; } + +int arch_kimage_file_post_load_cleanup (struct kimage *image) +{ +vfree (image->arch.elf_headers); + image->arch.elf_headers =NULL ; + image->arch.elf_headers_sz =0 ; + +return kexec_image_post_load_cleanup_default (image); +}#endif /* CONFIG_KEXEC_FILE */ static int
Greg Kroah-Hartman
maintainerPATCH 7/227 fbdev: hyperv_fb: iounmap() the correct memory when removing a device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 7241c886a71797cc51efc6fadec7076fcf6435c2 ]
When a Hyper-V framebuffer device is removed, or the driver is unbound from a device, any allocated and/or mapped memory must be released. In particular, MMIO address space that was mapped to the framebuffer must be unmapped. Current code unmaps the wrong address, resulting in an error like:
[ 4093.980597] iounmap: bad address 00000000c936c05c
followed by a stack dump.
Commit d21987d709e8 ("video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver") changed the kind of address stored in info->screen_base, and the iounmap() call in hvfb_putmem() was not updated accordingly.
Fix this by updating hvfb_putmem() to unmap the correct address.
Message-ID: <[email protected]>
--- drivers/video/fbdev/hyperv_fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/hyperv_fb.c +1 -1
@@ -1129,7 +1129,7 @@ static void hvfb_putmem(struct hv_device *hdev, struct fb_info *info)if (par->need_docopy) {vfree (par->dio_vp); -iounmap (info->screen_base); +iounmap (par->mmio_vp);vmbus_free_mmio (par->mem->start, screen_fb_size); }else { hvfb_release_phymem(hdev, info->fix.smem_start,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/227 pinctrl: bcm281xx: Fix incorrect regmap max_registers value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 68283c1cb573143c0b7515e93206f3503616bc10 ]
The max_registers value does not take into consideration the stride; currently, it's set to the number of the last pin, but this does not accurately represent the final register.
Fix this by multiplying the current value by 4.
--- drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/bcm/pinctrl-bcm281xx.c +1 -1
@@ -981,7 +981,7 @@ static const struct regmap_config bcm281xx_pinctrl_regmap_config = { .reg_bits = 32, .reg_stride = 4, .val_bits = 32, - .max_register = BCM281XX_PIN_VC_CAM3_SDA, + .max_register = BCM281XX_PIN_VC_CAM3_SDA * 4, };static int bcm281xx_pinctrl_get_groups_count (struct pinctrl_dev *pctldev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/227 netfilter: conntrack: convert to refcount_t api
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 719774377622bc4025d2a74f551b5dc2158c6c30 ]
Convert nf_conn reference counting from atomic_t to refcount_t based api. refcount_t api provides more runtime sanity checks and will warn on certain constructs, e.g. refcount_inc() on a zero reference count, which usually indicates use-after-free.
For this reason template allocation is changed to init the refcount to 1, the subsequenct add operations are removed.
Likewise, init_conntrack() is changed to set the initial refcount to 1 instead refcount_inc().
This is safe because the new entry is not (yet) visible to other cpus.
Stable-dep-of: 5cfe5612ca95 ("netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.")
--- include/linux/netfilter/nf_conntrack_common.h | 8 +++--- net/netfilter/nf_conntrack_core.c | 26 +++++++++---------- net/netfilter/nf_conntrack_expect.c | 4 +-- net/netfilter/nf_conntrack_netlink.c | 6 ++--- net/netfilter/nf_conntrack_standalone.c | 4 +-- net/netfilter/nf_flow_table_core.c | 2 +- net/netfilter/nf_synproxy_core.c | 1 - net/netfilter/nft_ct.c | 4 +-- net/netfilter/xt_CT.c | 3 +-- net/openvswitch/conntrack.c | 1 - net/sched/act_ct.c | 1 - 11 files changed, 27 insertions(+), 33 deletions(-)
include/linux/netfilter/nf_conntrack_common.h +4 -4
@@ -2,7 +2,7 @@#ifndef _NF_CONNTRACK_COMMON_H#define _NF_CONNTRACK_COMMON_H -#include <linux/atomic.h> +#include <linux/refcount.h> #include <uapi/linux/netfilter/nf_conntrack_common.h> struct ip_conntrack_stat {
@@ -24,19 +24,19 @@ struct ip_conntrack_stat {#define NFCT_PTRMASK ~(NFCT_INFOMASK)struct nf_conntrack { -atomic_t use; +refcount_t use; };void nf_conntrack_destroy (struct nf_conntrack *nfct);static inline void nf_conntrack_put (struct nf_conntrack *nfct) { -if (nfct &&atomic_dec_and_test (&nfct->use)) +if (nfct &&refcount_dec_and_test (&nfct->use))nf_conntrack_destroy (nfct); }static inline void nf_conntrack_get (struct nf_conntrack *nfct) {if (nfct) -atomic_inc (&nfct->use); +refcount_inc (&nfct->use); }#endif /* _NF_CONNTRACK_COMMON_H */
net/netfilter/nf_conntrack_core.c +13 -13
@@ -564,7 +564,7 @@ struct nf_conn *nf_ct_tmpl_alloc(struct net *net, tmpl->status =IPS_TEMPLATE ;write_pnet (&tmpl->ct_net, net);nf_ct_zone_add (tmpl, zone); -atomic_set (&tmpl->ct_general.use,0 ); +refcount_set (&tmpl->ct_general.use,1 );return tmpl; }
@@ -597,7 +597,7 @@ destroy_conntrack(struct nf_conntrack *nfct)struct nf_conn *ct = (struct nf_conn *)nfct;pr_debug ("destroy_conntrack(%p)\n" , ct); -WARN_ON (atomic_read (&nfct->use) !=0 ); +WARN_ON (refcount_read (&nfct->use) !=0 );if (unlikely (nf_ct_is_template (ct))) {nf_ct_tmpl_free (ct);
@@ -716,7 +716,7 @@ nf_ct_match(const struct nf_conn *ct1, const struct nf_conn *ct2)/* caller must hold rcu readlock and none of the nf_conntrack_locks */ static void nf_ct_gc_expired (struct nf_conn *ct) { -if (!atomic_inc_not_zero (&ct->ct_general.use)) +if (!refcount_inc_not_zero (&ct->ct_general.use))return ;if (nf_ct_should_gc (ct))
@@ -784,7 +784,7 @@ __nf_conntrack_find_get(struct net *net, const struct nf_conntrack_zone *zone,* in, try to obtain a reference and re-check tuple */ ct =nf_ct_tuplehash_to_ctrack (h); -if (likely (atomic_inc_not_zero (&ct->ct_general.use))) { +if (likely (refcount_inc_not_zero (&ct->ct_general.use))) {if (likely (nf_ct_key_equal (h, tuple, zone, net))) goto found;
@@ -853,7 +853,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)smp_wmb ();/* The caller holds a reference to this object */ -atomic_set (&ct->ct_general.use,2 ); +refcount_set (&ct->ct_general.use,2 );__nf_conntrack_hash_insert (ct, hash, reply_hash);nf_conntrack_double_unlock (hash, reply_hash);NF_CT_STAT_INC (net, insert);
@@ -902,7 +902,7 @@ static void __nf_conntrack_insert_prepare(struct nf_conn *ct) {struct nf_conn_tstamp *tstamp; -atomic_inc (&ct->ct_general.use); +refcount_inc (&ct->ct_general.use); ct->status |=IPS_CONFIRMED ;/* set conntrack timestamp, if enabled. */
@@ -1281,7 +1281,7 @@ static unsigned int early_drop_list(struct net *net, nf_ct_is_dying(tmp))continue ; -if (!atomic_inc_not_zero (&tmp->ct_general.use)) +if (!refcount_inc_not_zero (&tmp->ct_general.use))continue ;/* kill only if still in same netns -- might have moved due to
@@ -1397,7 +1397,7 @@ static void gc_worker(struct work_struct *work)continue ;/* need to take reference to avoid possible races */ -if (!atomic_inc_not_zero (&tmp->ct_general.use)) +if (!refcount_inc_not_zero (&tmp->ct_general.use))continue ;if (gc_worker_skip_ct (tmp)) {
@@ -1498,7 +1498,7 @@ __nf_conntrack_alloc(struct net *net,/* Because we use RCU lookups, we set ct_general.use to zero before * this is inserted in any list. */ -atomic_set (&ct->ct_general.use,0 ); +refcount_set (&ct->ct_general.use,0 );return ct; out:atomic_dec (&net->ct.count);
@@ -1522,7 +1522,7 @@ void nf_conntrack_free(struct nf_conn *ct)/* A freed object has refcnt == 0, that's * the golden rule for SLAB_TYPESAFE_BY_RCU */ -WARN_ON (atomic_read (&ct->ct_general.use) !=0 ); +WARN_ON (refcount_read (&ct->ct_general.use) !=0 );nf_ct_ext_destroy (ct);kmem_cache_free (nf_conntrack_cachep, ct);
@@ -1610,8 +1610,8 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,if (!exp)__nf_ct_try_assign_helper (ct, tmpl,GFP_ATOMIC ); -/* Now it is inserted into the unconfirmed list, bump refcount */ -nf_conntrack_get (&ct->ct_general); +/* Now it is inserted into the unconfirmed list, set refcount to 1. */ +refcount_set (&ct->ct_general.use,1 );nf_ct_add_to_unconfirmed_list (ct);local_bh_enable ();
@@ -2214,7 +2214,7 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),return NULL ; found: -atomic_inc (&ct->ct_general.use); +refcount_inc (&ct->ct_general.use);spin_unlock (lockp);local_bh_enable ();return ct;
net/netfilter/nf_conntrack_expect.c +2 -2
@@ -187,12 +187,12 @@ nf_ct_find_expectation(struct net *net,* about to invoke ->destroy(), or nf_ct_delete() via timeout * or early_drop(). * -* The atomic_inc_not_zero() check tells: If that fails, we +* The refcount_inc_not_zero() check tells: If that fails, we * know that the ct is being destroyed. If it succeeds, we * can be sure the ct cannot disappear underneath. */ if (unlikely (nf_ct_is_dying (exp->master) || - !atomic_inc_not_zero (&exp->master->ct_general.use))) + !refcount_inc_not_zero (&exp->master->ct_general.use)))return NULL ;if (exp->flags &NF_CT_EXPECT_PERMANENT ) {
net/netfilter/nf_conntrack_netlink.c +3 -3
@@ -506,7 +506,7 @@ static int ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)static int ctnetlink_dump_use (struct sk_buff *skb,const struct nf_conn *ct) { -if (nla_put_be32 (skb,CTA_USE ,htonl (atomic_read (&ct->ct_general.use)))) +if (nla_put_be32 (skb,CTA_USE ,htonl (refcount_read (&ct->ct_general.use)))) goto nla_put_failure;return 0 ;
@@ -1150,7 +1150,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) ct =nf_ct_tuplehash_to_ctrack (h);if (nf_ct_is_expired (ct)) {if (i <ARRAY_SIZE (nf_ct_evict) && -atomic_inc_not_zero (&ct->ct_general.use)) +refcount_inc_not_zero (&ct->ct_general.use)) nf_ct_evict[i++] = ct;continue ; }
@@ -1701,7 +1701,7 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dyingNFNL_MSG_TYPE (cb->nlh->nlmsg_type), ct, dying ? true : false, 0);if (res <0 ) { -if (!atomic_inc_not_zero (&ct->ct_general.use)) +if (!refcount_inc_not_zero (&ct->ct_general.use))continue ; cb->args[0 ] = cpu; cb->args[1 ] = (unsigned long )ct;
net/netfilter/nf_conntrack_standalone.c +2 -2
@@ -300,7 +300,7 @@ static int ct_seq_show(struct seq_file *s, void *v)int ret =0 ;WARN_ON (!ct); -if (unlikely (!atomic_inc_not_zero (&ct->ct_general.use))) +if (unlikely (!refcount_inc_not_zero (&ct->ct_general.use)))return 0 ;if (nf_ct_should_gc (ct)) {
@@ -367,7 +367,7 @@ static int ct_seq_show(struct seq_file *s, void *v)ct_show_zone (s, ct,NF_CT_DEFAULT_ZONE_DIR );ct_show_delta_time (s, ct); -seq_printf (s,"use=%u\n" ,atomic_read (&ct->ct_general.use)); +seq_printf (s,"use=%u\n" ,refcount_read (&ct->ct_general.use));if (seq_has_overflowed (s)) goto release;
net/netfilter/nf_flow_table_core.c +1 -1
@@ -48,7 +48,7 @@ struct flow_offload *flow_offload_alloc(struct nf_conn *ct)struct flow_offload *flow;if (unlikely (nf_ct_is_dying (ct) || - !atomic_inc_not_zero (&ct->ct_general.use))) + !refcount_inc_not_zero (&ct->ct_general.use)))return NULL ; flow =kzalloc (sizeof (*flow),GFP_ATOMIC );
net/netfilter/nf_synproxy_core.c +0 -1
@@ -349,7 +349,6 @@ static int __net_init synproxy_net_init(struct net *net) goto err2;__set_bit (IPS_CONFIRMED_BIT , &ct->status); -nf_conntrack_get (&ct->ct_general); snet->tmpl = ct; snet->stats = alloc_percpu(struct synproxy_stats);
net/netfilter/nft_ct.c +1 -3
@@ -259,7 +259,7 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, ct =this_cpu_read (nft_ct_pcpu_template); -if (likely (atomic_read (&ct->ct_general.use) ==1 )) { +if (likely (refcount_read (&ct->ct_general.use) ==1 )) {nf_ct_zone_add (ct, &zone); }else {/* previous skb got queued to userspace */
@@ -270,7 +270,6 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, } } -atomic_inc (&ct->ct_general.use);nf_ct_set (skb, ct,IP_CT_NEW ); }#endif
@@ -375,7 +374,6 @@ static bool nft_ct_tmpl_alloc_pcpu(void)return false; } -atomic_set (&tmp->ct_general.use,1 );per_cpu (nft_ct_pcpu_template, cpu) = tmp; }
net/netfilter/xt_CT.c +1 -2
@@ -24,7 +24,7 @@ static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)return XT_CONTINUE ;if (ct) { -atomic_inc (&ct->ct_general.use); +refcount_inc (&ct->ct_general.use);nf_ct_set (skb, ct,IP_CT_NEW ); }else {nf_ct_set (skb, ct,IP_CT_UNTRACKED );
@@ -202,7 +202,6 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par, goto err4; }__set_bit (IPS_CONFIRMED_BIT , &ct->status); -nf_conntrack_get (&ct->ct_general); out: info->ct = ct;return 0 ;
net/openvswitch/conntrack.c +0 -1
@@ -1713,7 +1713,6 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr, goto err_free_ct;__set_bit (IPS_CONFIRMED_BIT , &ct_info.ct->status); -nf_conntrack_get (&ct_info.ct->ct_general);return 0 ; err_free_ct:__ovs_ct_free_action (&ct_info);
net/sched/act_ct.c +0 -1
@@ -1235,7 +1235,6 @@ static int tcf_ct_fill_params(struct net *net,return -ENOMEM ; }__set_bit (IPS_CONFIRMED_BIT , &tmpl->status); -nf_conntrack_get (&tmpl->ct_general); p->tmpl = tmpl;return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/227 netfilter: nft_ct: fix use after free when attaching zone template
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 34243b9ec856309339172b1507379074156947e8 ]
The conversion erroneously removed the refcount increment. In case we can use the percpu template, we need to increment the refcount, else it will be released when the skb gets freed.
In case the slowpath is taken, the new template already has a refcount of 1.
Stable-dep-of: 5cfe5612ca95 ("netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.")
--- net/netfilter/nft_ct.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/netfilter/nft_ct.c +4 -1
@@ -260,9 +260,12 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, ct =this_cpu_read (nft_ct_pcpu_template);if (likely (refcount_read (&ct->ct_general.use) ==1 )) { +refcount_inc (&ct->ct_general.use);nf_ct_zone_add (ct, &zone); }else { -/* previous skb got queued to userspace */ +/* previous skb got queued to userspace, allocate temporary +* one until percpu template can be reused. +*/ ct =nf_ct_tmpl_alloc (nft_net (pkt), &zone,GFP_ATOMIC );if (!ct) { regs->verdict.code =NF_DROP ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/227 netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 5cfe5612ca9590db69b9be29dc83041dbf001108 ]
nft_ct_pcpu_template is a per-CPU variable and relies on disabled BH for its locking. The refcounter is read and if its value is set to one then the refcounter is incremented and variable is used - otherwise it is already in use and left untouched.
Without per-CPU locking in local_bh_disable() on PREEMPT_RT the read-then-increment operation is not atomic and therefore racy.
This can be avoided by using unconditionally __refcount_inc() which will increment counter and return the old value as an atomic operation. In case the returned counter is not one, the variable is in use and we need to decrement counter. Otherwise we can use it.
Use __refcount_inc() instead of read and a conditional increment.
--- net/netfilter/nft_ct.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/nft_ct.c +4 -2
@@ -239,6 +239,7 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr,enum ip_conntrack_info ctinfo;u16 value =nft_reg_load16 (®s->data[priv->sreg]);struct nf_conn *ct; +int oldcnt; ct =nf_ct_get (skb, &ctinfo);if (ct)/* already tracked */
@@ -259,10 +260,11 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, ct =this_cpu_read (nft_ct_pcpu_template); -if (likely (refcount_read (&ct->ct_general.use) ==1 )) { -refcount_inc (&ct->ct_general.use); +__refcount_inc (&ct->ct_general.use, &oldcnt); +if (likely (oldcnt ==1 )) {nf_ct_zone_add (ct, &zone); }else { +refcount_dec (&ct->ct_general.use);/* previous skb got queued to userspace, allocate temporary * one until percpu template can be reused. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/227 ice: fix memory leak in aRFS after reset
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grzegorz Nitka <[email protected]>
[ Upstream commit 23d97f18901ef5e4e264e3b1777fe65c760186b5 ]
Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases:
- as part of VSI initialization (at probe), and
- as part of reset handling
However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature:
[root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192):
comm "kworker/0:0", pid 8, jiffies 4296833052 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 0):
[<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340
[<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice]
[<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice]
[<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice]
[<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice]
[<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice]
[<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0
[<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20
[<ffffffff98f0b6d9>] process_one_work+0x179/0x390
[<ffffffff98f0c1e9>] worker_thread+0x239/0x340
[<ffffffff98f14abc>] kthread+0xcc/0x100
[<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50
[<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30
...--- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_arfs.c +1 -1
@@ -510,7 +510,7 @@ void ice_init_arfs(struct ice_vsi *vsi)struct hlist_head *arfs_fltr_list;unsigned int i; -if (!vsi || vsi->type !=ICE_VSI_PF ) +if (!vsi || vsi->type !=ICE_VSI_PF ||ice_is_arfs_active (vsi))return ; arfs_fltr_list = kzalloc(sizeof(*arfs_fltr_list) * ICE_MAX_ARFS_LIST,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/227 netpoll: hold rcu read lock in __netpoll_send_skb()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 505ead7ab77f289f12d8a68ac83da068e4d4408b ]
The function __netpoll_send_skb() is being invoked without holding the RCU read lock. This oversight triggers a warning message when CONFIG_PROVE_RCU_LIST is enabled:
net/core/netpoll.c:330 suspicious rcu_dereference_check() usage!
netpoll_send_skb
netpoll_send_udp
write_ext_msg
console_flush_all
console_unlock
vprintk_emit
To prevent npinfo from disappearing unexpectedly, ensure that __netpoll_send_skb() is protected with the RCU read lock.
--- net/core/netpoll.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/core/netpoll.c +7 -2
@@ -326,6 +326,7 @@ static int netpoll_owner_active(struct net_device *dev)static netdev_tx_t __netpoll_send_skb (struct netpoll *np,struct sk_buff *skb) {netdev_tx_t status =NETDEV_TX_BUSY ; +netdev_tx_t ret =NET_XMIT_DROP ;struct net_device *dev;unsigned long tries;/* It is up to the caller to keep npinfo alive. */
@@ -334,11 +335,12 @@ static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)lockdep_assert_irqs_disabled (); dev = np->dev; +rcu_read_lock (); npinfo =rcu_dereference_bh (dev->npinfo);if (!npinfo || !netif_running (dev) || !netif_device_present (dev)) {dev_kfree_skb_irq (skb); -return NET_XMIT_DROP ; + goto out; }/* don't get messages out of order, and no recursion */
@@ -377,7 +379,10 @@ static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)skb_queue_tail (&npinfo->txq, skb);schedule_delayed_work (&npinfo->tx_work,0 ); } -return NETDEV_TX_OK ; + ret =NETDEV_TX_OK ; +out: +rcu_read_unlock (); +return ret; }netdev_tx_t netpoll_send_skb (struct netpoll *np,struct sk_buff *skb)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/227 Drivers: hv: vmbus: Dont release fb_mmio resource in vmbus_free_mmio()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 73fe9073c0cc28056cb9de0c8a516dac070f1d1f ]
The VMBus driver manages the MMIO space it owns via the hyperv_mmio resource tree. Because the synthetic video framebuffer portion of the MMIO space is initially setup by the Hyper-V host for each guest, the VMBus driver does an early reserve of that portion of MMIO space in the hyperv_mmio resource tree. It saves a pointer to that resource in fb_mmio. When a VMBus driver requests MMIO space and passes "true" for the "fb_overlap_ok" argument, the reserved framebuffer space is used if possible. In that case it's not necessary to do another request against the "shadow" hyperv_mmio resource tree because that resource was already requested in the early reserve steps.
However, the vmbus_free_mmio() function currently does no special handling for the fb_mmio resource. When a framebuffer device is removed, or the driver is unbound, the current code for vmbus_free_mmio() releases the reserved resource, leaving fb_mmio pointing to memory that has been freed. If the same or another driver is subsequently bound to the device, vmbus_allocate_mmio() checks against fb_mmio, and potentially gets garbage. Furthermore a second unbind operation produces this "nonexistent resource" error because of the unbalanced behavior between vmbus_allocate_mmio() and vmbus_free_mmio():
[ 55.499643] resource: Trying to free nonexistent resource <0x00000000f0000000-0x00000000f07fffff>
Fix this by adding logic to vmbus_free_mmio() to recognize when MMIO space in the fb_mmio reserved area would be released, and don't release it. This filtering ensures the fb_mmio resource always exists, and makes vmbus_free_mmio() more parallel with vmbus_allocate_mmio().
Message-ID: <[email protected]>
--- drivers/hv/vmbus_drv.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/hv/vmbus_drv.c +13 -0
@@ -2331,12 +2331,25 @@ void vmbus_free_mmio(resource_size_t start, resource_size_t size)struct resource *iter;mutex_lock (&hyperv_mmio_lock); + +/* +* If all bytes of the MMIO range to be released are within the +* special case fb_mmio shadow region, skip releasing the shadow +* region since no corresponding __request_region() was done +* in vmbus_allocate_mmio(). +*/ +if (fb_mmio && start >= fb_mmio->start && + (start + size -1 <= fb_mmio->end)) + goto skip_shadow_release; +for (iter = hyperv_mmio; iter; iter = iter->sibling) {if ((iter->start >= start + size) || (iter->end <= start))continue ;__release_region (iter, start, size); } + +skip_shadow_release:release_mem_region (start, size);mutex_unlock (&hyperv_mmio_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/227 net/mlx5: handle errors in mlx5_chains_create_table()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit eab0396353be1c778eba1c0b5180176f04dd21ce ]
In mlx5_chains_create_table(), the return value of mlx5_get_fdb_sub_ns() and mlx5_get_flow_namespace() must be checked to prevent NULL pointer dereferences. If either function fails, the function should log error message with mlx5_core_warn() and return error pointer.
--- drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c +5 -0
@@ -267,6 +267,11 @@ mlx5_chains_create_table(struct mlx5_fs_chains *chains, ns =mlx5_get_flow_namespace (chains->dev, chains->ns); } +if (!ns) { +mlx5_core_warn (chains->dev,"Failed to get flow namespace\n" ); +return ERR_PTR (-EOPNOTSUPP ); + } + ft_attr.autogroup.num_reserved_entries =2 ; ft_attr.autogroup.max_num_groups = chains->group_num; ft =mlx5_create_auto_grouped_flow_table (ns, &ft_attr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/227 netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit d653bfeb07ebb3499c403404c21ac58a16531607 ]
Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), cpu and jiffies32 were introduced to the struct nf_conncount_tuple.
The commit made nf_conncount_add() initialize conn->cpu and conn->jiffies32 when allocating the struct.
In contrast, count_tree() was not changed to initialize them.
By commit 34848d5c896e ("netfilter: nf_conncount: Split insert and traversal"), count_tree() was split and the relevant allocation code now resides in insert_tree().
Initialize conn->cpu and conn->jiffies32 in insert_tree().
BUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline] BUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 find_or_evict net/netfilter/nf_conncount.c:117 [inline] __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [inline] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4121 [inline] slab_alloc_node mm/slub.c:4164 [inline] kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171 insert_tree net/netfilter/nf_conncount.c:372 [inline] count_tree net/netfilter/nf_conncount.c:450 [inline] nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
--- net/netfilter/nf_conncount.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/nf_conncount.c +2 -0
@@ -366,6 +366,8 @@ insert_tree(struct net *net, conn->tuple = *tuple; conn->zone = *zone; + conn->cpu =raw_smp_processor_id (); + conn->jiffies32 = (u32 )jiffies;memcpy (rbconn->key, key,sizeof (u32) * data->keylen);nf_conncount_list_init (&rbconn->list);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/227 ipvs: prevent integer overflow in do_ip_vs_get_ctl()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 80b78c39eb86e6b55f56363b709eb817527da5aa ]
The get->num_services variable is an unsigned int which is controlled by the user. The struct_size() function ensures that the size calculation does not overflow an unsigned long, however, we are saving the result to an int so the calculation can overflow.
Both "len" and "get->num_services" come from the user. This check is just a sanity check to help the user and ensure they are using the API correctly. An integer overflow here is not a big deal. This has no security impact.
Save the result from struct_size() type size_t to fix this integer overflow bug.
--- net/netfilter/ipvs/ip_vs_ctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/ipvs/ip_vs_ctl.c +4 -4
@@ -2852,12 +2852,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)case IP_VS_SO_GET_SERVICES : {struct ip_vs_get_services *get; -int size; +size_t size; get = (struct ip_vs_get_services *)arg; size =struct_size (get, entrytable, get->num_services);if (*len != size) { -pr_err ("length: %u != %u\n" , *len, size); +pr_err ("length: %u != %zu\n" , *len, size); ret = -EINVAL ; goto out; }
@@ -2893,12 +2893,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)case IP_VS_SO_GET_DESTS : {struct ip_vs_get_dests *get; -int size; +size_t size; get = (struct ip_vs_get_dests *)arg; size =struct_size (get, entrytable, get->num_dests);if (*len != size) { -pr_err ("length: %u != %u\n" , *len, size); +pr_err ("length: %u != %zu\n" , *len, size); ret = -EINVAL ; goto out; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/227 net_sched: Prevent creation of classes with TC_H_ROOT
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <[email protected]>
[ Upstream commit 0c3057a5a04d07120b3d0ec9c79568fceb9c921e ]
The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho.
Prevent the creation of any Qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.
--- net/sched/sch_api.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/sched/sch_api.c +6 -0
@@ -2169,6 +2169,12 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,return -EOPNOTSUPP ; } +/* Prevent creation of traffic classes with classid TC_H_ROOT */ +if (clid ==TC_H_ROOT ) { +NL_SET_ERR_MSG (extack,"Cannot create traffic class with classid TC_H_ROOT" ); +return -EINVAL ; + } + new_cl = cl; err = -EOPNOTSUPP ;if (cops->change)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/227 netfilter: nft_exthdr: fix offset with ipv4_find_option()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kashavkin <[email protected]>
[ Upstream commit 6edd78af9506bb182518da7f6feebd75655d9a0e ]
There is an incorrect calculation in the offset variable which causes the nft_skb_copy_to_reg() function to always return -EFAULT. Adding the start variable is redundant. In the __ip_options_compile() function the correct offset is specified when finding the function. There is no need to add the size of the iphdr structure to the offset.
--- net/netfilter/nft_exthdr.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
net/netfilter/nft_exthdr.c +4 -6
@@ -85,7 +85,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb,unsigned char optbuf[sizeof (struct ip_options ) +40 ];struct ip_options *opt = (struct ip_options *)optbuf;struct iphdr *iph, _iph; -unsigned int start;bool found = false;__be32 info;int optlen;
@@ -93,7 +92,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, iph =skb_header_pointer (skb,0 ,sizeof (_iph), &_iph);if (!iph)return -EBADMSG ; - start =sizeof (struct iphdr ); optlen = iph->ihl *4 - (int )sizeof (struct iphdr );if (optlen <=0 )
@@ -103,7 +101,7 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb,/* Copy the options since __ip_options_compile() modifies * the options. */ -if (skb_copy_bits (skb, start, opt->__data, optlen)) +if (skb_copy_bits (skb,sizeof (struct iphdr ), opt->__data, optlen))return -EBADMSG ; opt->optlen = optlen;
@@ -118,18 +116,18 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, found = target ==IPOPT_SSRR ? opt->is_strictroute : !opt->is_strictroute;if (found) - *offset = opt->srr + start; + *offset = opt->srr;break ;case IPOPT_RR :if (!opt->rr)break ; - *offset = opt->rr + start; + *offset = opt->rr; found = true;break ;case IPOPT_RA :if (!opt->router_alert)break ; - *offset = opt->router_alert + start; + *offset = opt->router_alert; found = true;break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/227 net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit e92df790d07a8eea873efcb84776e7b71f81c7d5 ]
mlx5_eswitch_get_vepa returns -EPERM if the device lacks eswitch_manager capability, blocking mlx5e_bridge_getlink from retrieving VEPA mode. Since mlx5e_bridge_getlink implements ndo_bridge_getlink, returning -EPERM causes bridge link show to fail instead of skipping devices without this capability.
To avoid this, return -EOPNOTSUPP from mlx5e_bridge_getlink when mlx5_eswitch_get_vepa fails, ensuring the command continues processing other devices while ignoring those without the necessary capability.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +2 -4
@@ -4604,11 +4604,9 @@ static int mlx5e_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,struct mlx5e_priv *priv =netdev_priv (dev);struct mlx5_core_dev *mdev = priv->mdev;u8 mode, setting; -int err; - err =mlx5_eswitch_get_vepa (mdev->priv.eswitch, &setting); -if (err) -return err; +if (mlx5_eswitch_get_vepa (mdev->priv.eswitch, &setting)) +return -EOPNOTSUPP ; mode = setting ?BRIDGE_MODE_VEPA :BRIDGE_MODE_VEB ; return ndo_dflt_bridge_getlink(skb, pid, seq, dev, mode,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/227 nvme-fc: go straight to connecting state when initializing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit d3d380eded7ee5fc2fc53b3b0e72365ded025c4a ]
The initial controller initialization mimiks the reconnect loop behavior by switching from NEW to RESETTING and then to CONNECTING.
The transition from NEW to CONNECTING is a valid transition, so there is no point entering the RESETTING state. TCP and RDMA also transition directly to CONNECTING state.
--- drivers/nvme/host/fc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/nvme/host/fc.c +1 -2
@@ -3536,8 +3536,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,list_add_tail (&ctrl->ctrl_list, &rport->ctrl_list);spin_unlock_irqrestore (&rport->lock, flags); -if (!nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_RESETTING ) || - !nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_CONNECTING )) { +if (!nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_CONNECTING )) {dev_err (ctrl->ctrl.device,"NVME-FC{%d}: failed to init ctrl state\n" , ctrl->cnum); goto fail_ctrl;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/227 hrtimers: Mark is_migration_base() with __always_inline
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 27af31e44949fa85550176520ef7086a0d00fd7b ]
When is_migration_base() is unused, it prevents kernel builds with clang, make W=1 and CONFIG_WERROR=y:
kernel/time/hrtimer.c:156:20: error: unused function 'is_migration_base' [-Werror,-Wunused-function]
156 | static inline bool is_migration_base(struct hrtimer_clock_base *base)
| ^~~~~~~~~~~~~~~~~
Fix this by marking it with __always_inline.
[ tglx: Use __always_inline instead of __maybe_unused and move it into the
usage sites conditional ]
--- kernel/time/hrtimer.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
kernel/time/hrtimer.c +12 -10
@@ -144,11 +144,6 @@ static struct hrtimer_cpu_base migration_cpu_base = {#define migration_base migration_cpu_base.clock_base[0] -static inline bool is_migration_base (struct hrtimer_clock_base *base) -{ -return base == &migration_base; -} -/* * We are using hashed locking: holding per_cpu(hrtimer_bases)[n].lock * means that all timers which are tied to this base via timer->base are
@@ -273,11 +268,6 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base,#else /* CONFIG_SMP */ -static inline bool is_migration_base (struct hrtimer_clock_base *base) -{ -return false; -} -static inline struct hrtimer_clock_base *lock_hrtimer_base (const struct hrtimer *timer,unsigned long *flags) {
@@ -1275,6 +1265,18 @@ static void hrtimer_sync_wait_running(struct hrtimer_cpu_base *cpu_base, } } +#ifdef CONFIG_SMP +static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) +{ +return base == &migration_base; +} +#else +static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) +{ +return false; +} +#endif +/* * This function is called on PREEMPT_RT kernels when the fast path * deletion of a timer failed because the timer callback function was
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/227 powercap: call put_device() on an error path in powercap_register_control_type()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit 93c66fbc280747ea700bd6199633d661e3c819b3 ]
powercap_register_control_type() calls device_register(), but does not release the refcount of the device when it fails.
Call put_device() before returning an error to balance the refcount.
Since the kfree(control_type) will be done by powercap_release(), remove the lines in powercap_register_control_type() before returning the error.
This bug was found by an experimental verifier that I am developing.
--- drivers/powercap/powercap_sys.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/powercap/powercap_sys.c +1 -2
@@ -627,8 +627,7 @@ struct powercap_control_type *powercap_register_control_type(dev_set_name (&control_type->dev,"%s" , name); result =device_register (&control_type->dev);if (result) { -if (control_type->allocated) -kfree (control_type); +put_device (&control_type->dev);return ERR_PTR (result); }idr_init (&control_type->idr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/227 iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengen Du <[email protected]>
[ Upstream commit 07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 ]
When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message.
--- drivers/firmware/iscsi_ibft.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/firmware/iscsi_ibft.c +4 -1
@@ -312,7 +312,10 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf) str +=sprintf_ipaddr (str, nic->ip_addr);break ;case ISCSI_BOOT_ETH_SUBNET_MASK : - val =cpu_to_be32 (~((1 << (32 -nic->subnet_mask_prefix))-1 )); +if (nic->subnet_mask_prefix >32 ) + val =cpu_to_be32 (~0 ); +else + val =cpu_to_be32 (~((1 << (32 -nic->subnet_mask_prefix))-1 )); str +=sprintf (str,"%pI4" , &val);break ;case ISCSI_BOOT_ETH_PREFIX_LEN :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/227 scsi: qla1280: Fix kernel oops when debug level > 2
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <[email protected]>
[ Upstream commit 5233e3235dec3065ccc632729675575dbe3c6b8a ]
A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I think its clear from the code that the intention here is sg_dma_len(s) not length of sg_next(s) when printing the debug info.
--- drivers/scsi/qla1280.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla1280.c +1 -1
@@ -2876,7 +2876,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)dprintk (3 ,"S/G Segment phys_addr=%x %x, len=0x%x\n" ,cpu_to_le32 (upper_32_bits (dma_handle)),cpu_to_le32 (lower_32_bits (dma_handle)), -cpu_to_le32 (sg_dma_len (sg_next (s)))); +cpu_to_le32 (sg_dma_len (s))); remseg--; } dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather "
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/227 ACPI: resource: IRQ override for Eluktronics MECH-17
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gannon Kolding <[email protected]>
[ Upstream commit 607ab6f85f4194b644ea95ac5fe660ef575db3b4 ]
The Eluktronics MECH-17 (GM7RG7N) needs IRQ overriding for the keyboard to work.
Adding a DMI_MATCH entry for this laptop model makes the internal keyboard function normally.
--- drivers/acpi/resource.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/resource.c +6 -0
@@ -482,6 +482,12 @@ static const struct dmi_system_id asus_laptop[] = { DMI_MATCH(DMI_BOARD_NAME, "RP-15"), }, }, + { + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Eluktronics Inc." ), + DMI_MATCH(DMI_BOARD_NAME, "MECH-17"), + }, + }, {/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/227 alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
[ Upstream commit b029628be267cba3c7684ec684749fe3e4372398 ]
Richard Henderson <[email protected]> writes[1]:
Quoted 11 lines
There was a Spec benchmark (I forget which) which was memory bound and ran twice as fast with 32-bit pointers.
I copied the idea from DEC to the ELF abi, but never did all the other work to allow the toolchain to take advantage.
Amusingly, a later Spec changed the benchmark data sets to not fit into a 32-bit address space, specifically because of this.
I expect one could delete the ELF bit and personality and no one would notice. Not even the 10 remaining Alpha users.
In [2] it was pointed out that parts of setarch weren't working properly on alpha because it has it's own SET_PERSONALITY implementation. In the discussion that followed Richard Henderson pointed out that the 32bit pointer support for alpha was never completed.
Fix this by removing alpha's 32bit pointer support.
As a bit of paranoia refuse to execute any alpha binaries that have the EF_ALPHA_32BIT flag set. Just in case someone somewhere has binaries that try to use alpha's 32bit pointer support.
--- arch/alpha/include/asm/elf.h | 6 +----- arch/alpha/include/asm/pgtable.h | 2 +- arch/alpha/include/asm/processor.h | 8 ++------ arch/alpha/kernel/osf_sys.c | 11 ++--------- 4 files changed, 6 insertions(+), 21 deletions(-)
arch/alpha/include/asm/elf.h +1 -5
@@ -74,7 +74,7 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];/* * This is used to ensure we don't load something for the wrong architecture. */ -#define elf_check_arch (x) ((x)->e_machine == EM_ALPHA) +#define elf_check_arch (x) (((x)->e_machine == EM_ALPHA) && !((x)->e_flags & EF_ALPHA_32BIT))/* * These are used to set parameters in the core dumps.
@@ -145,10 +145,6 @@ extern int dump_elf_task_fp(elf_fpreg_t *dest, struct task_struct *task); : amask (AMASK_CIX) ? "ev6" : "ev67"); \ }) -#define SET_PERSONALITY (EX ) \ - set_personality(((EX).e_flags & EF_ALPHA_32BIT) \ - ? PER_LINUX_32BIT : PER_LINUX) -extern int alpha_l1i_cacheshape;extern int alpha_l1d_cacheshape;extern int alpha_l2_cacheshape;
arch/alpha/include/asm/pgtable.h +1 -1
@@ -347,7 +347,7 @@ extern inline pte_t mk_swap_pte(unsigned long type, unsigned long offset)extern void paging_init (void ); -/* We have our own get_unmapped_area to cope with ADDR_LIMIT_32BIT. */ +/* We have our own get_unmapped_area */ #define HAVE_ARCH_UNMAPPED_AREA #endif /* _ALPHA_PGTABLE_H */
arch/alpha/include/asm/processor.h +2 -6
@@ -8,23 +8,19 @@ #ifndef __ASM_ALPHA_PROCESSOR_H #define __ASM_ALPHA_PROCESSOR_H -#include <linux/personality.h> /* for ADDR_LIMIT_32BIT */ - /* * We have a 42-bit user address space: 4TB user VM... */ #define TASK_SIZE (0x40000000000UL) -#define STACK_TOP \ - (current->personality & ADDR_LIMIT_32BIT ? 0x80000000 : 0x00120000000UL) +#define STACK_TOP (0x00120000000UL) #define STACK_TOP_MAX 0x00120000000UL /* This decides where the kernel will search for a free chunk of vm * space during mmap's. */ -#define TASK_UNMAPPED_BASE \ - ((current->personality & ADDR_LIMIT_32BIT) ? 0x40000000 : TASK_SIZE / 2) +#define TASK_UNMAPPED_BASE (TASK_SIZE / 2) typedef struct { unsigned long seg;
arch/alpha/kernel/osf_sys.c +2 -9
@@ -1212,8 +1212,7 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)return ret; } -/* Get an address range which is currently unmapped. Similar to the -generic version except that we know how to honor ADDR_LIMIT_32BIT. */ +/* Get an address range which is currently unmapped. */ static unsigned long arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
@@ -1235,13 +1234,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags) { - unsigned long limit; - -/* "32 bit" actually means 31 bit, since pointers sign extend. */ -if (current->personality &ADDR_LIMIT_32BIT ) - limit =0x80000000 ; -else - limit =TASK_SIZE ; + unsigned long limit = TASK_SIZE;if (len > limit)return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/227 vboxsf: fix building with GCC 15
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 4e7487245abcbc5a1a1aea54e4d3b33c53804bda ]
Building with GCC 15 results in build errorfs/vboxsf/super.c:24:54: error: initializer-string for array of ‘unsigned char’ is too long [-Werror=unterminated-string-initialization]
24 | static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375";
| ^~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
Due to GCC having enabled -Werror=unterminated-string-initialization[0] by default. Separately initializing each array element of VBSF_MOUNT_SIGNATURE to ensure NUL termination, thus satisfying GCC 15 and fixing the build error.
[0]: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wno-unterminated-string-initialization
--- fs/vboxsf/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/vboxsf/super.c +2 -1
@@ -21,7 +21,8 @@#define VBOXSF_SUPER_MAGIC 0x786f4256/* 'VBox' little endian */ -static const unsigned char VBSF_MOUNT_SIGNATURE [4 ] ="\000\377\376\375" ; +static const unsigned char VBSF_MOUNT_SIGNATURE [4 ] = {'\000' ,'\377' ,'\376' , +'\375' };static int follow_symlinks;module_param (follow_symlinks, int,0444 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/227 HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 4b54ae69197b9f416baa0fceadff7e89075f8454 ]
The timestamps in the Firmware log and HID sensor samples are incorrect. They show 1970-01-01 because the current IPC driver only uses the first 8 bytes of bootup time when synchronizing time with the firmware. The firmware converts the bootup time to UTC time, which results in the display of 1970-01-01.
In write_ipc_from_queue(), when sending the MNG_SYNC_FW_CLOCK message, the clock is updated according to the definition of ipc_time_update_msg. However, in _ish_sync_fw_clock(), the message length is specified as the size of uint64_t when building the doorbell. As a result, the firmware only receives the first 8 bytes of struct ipc_time_update_msg. This patch corrects the length in the doorbell to ensure the entire ipc_time_update_msg is sent, fixing the timestamp issue.
--- drivers/hid/intel-ish-hid/ipc/ipc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hid/intel-ish-hid/ipc/ipc.c +3 -3
@@ -549,14 +549,14 @@ static void fw_reset_work_fn(struct work_struct *unused)static void _ish_sync_fw_clock (struct ishtp_device *dev) {static unsigned long prev_sync; -uint64_t usec; +struct ipc_time_update_msg time = {};if (prev_sync && jiffies - prev_sync <20 *HZ )return ; prev_sync = jiffies; - usec =ktime_to_us (ktime_get_boottime ()); -ipc_send_mng_msg (dev,MNG_SYNC_FW_CLOCK , &usec,sizeof (uint64_t )); +/* The fields of time would be updated while sending message */ +ipc_send_mng_msg (dev,MNG_SYNC_FW_CLOCK , &time,sizeof (time)); }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/227 HID: ignore non-functional sensor in HP 5MP Camera
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chia-Lin Kao (AceLan) <[email protected]>
[ Upstream commit 363236d709e75610b628c2a4337ccbe42e454b6d ]
The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor.
[453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff
[453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff
Add this device to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -1014,6 +1014,7 @@#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008 +#define USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473 0x5473#define I2C_VENDOR_ID_RAYDIUM 0x2386#define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33
drivers/hid/hid-quirks.c +1 -0
@@ -870,6 +870,7 @@ static const struct hid_device_id hid_ignore_list[] = { { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DPAD) }, #endif { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, + { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, { } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/227 s390/cio: Fix CHPID "configure" attribute caching
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
[ Upstream commit 32ae4a2992529e2c7934e422035fad1d9b0f1fb5 ]
In some environments, the SCLP firmware interface used to query a CHPID's configured state is not supported. On these environments, rapidly reading the corresponding sysfs attribute produces inconsistent results:
$ cat /sys/devices/css0/chp0.00/configure cat: /sys/devices/css0/chp0.00/configure: Operation not supported $ cat /sys/devices/css0/chp0.00/configure 3
This occurs for example when Linux is run as a KVM guest. The inconsistency is a result of CIO using cached results for generating the value of the "configure" attribute while failing to handle the situation where no data was returned by SCLP.
Fix this by not updating the cache-expiration timestamp when SCLP returns no data. With the fix applied, the system response is consistent:
$ cat /sys/devices/css0/chp0.00/configure cat: /sys/devices/css0/chp0.00/configure: Operation not supported $ cat /sys/devices/css0/chp0.00/configure cat: /sys/devices/css0/chp0.00/configure: Operation not supported
--- drivers/s390/cio/chp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/s390/cio/chp.c +2 -1
@@ -646,7 +646,8 @@ static int info_update(void)if (time_after (jiffies, chp_info_expires)) {/* Data is too old, update. */ rc =sclp_chp_read_info (&chp_info); - chp_info_expires = jiffies +CHP_INFO_UPDATE_INTERVAL ; +if (!rc) + chp_info_expires = jiffies +CHP_INFO_UPDATE_INTERVAL ; }mutex_unlock (&info_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/227 thermal/cpufreq_cooling: Remove structure member documentation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit a6768c4f92e152265590371975d44c071a5279c7 ]
The structure member documentation refers to a member which does not exist any more. Remove it.
--- drivers/thermal/cpufreq_cooling.c | 2 -- 1 file changed, 2 deletions(-)
drivers/thermal/cpufreq_cooling.c +0 -2
@@ -58,8 +58,6 @@ struct time_in_idle {* @max_level: maximum cooling level. One less than total number of valid * cpufreq frequencies. * @em: Reference on the Energy Model of the device -* @cdev: thermal_cooling_device pointer to keep track of the -* registered cooling device. * @policy: cpufreq policy. * @node: list_head to link all cpufreq_cooling_device together. * @idle_time: idle time stats
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/227 ASoC: rsnd: dont indicate warning on rsnd_kctrl_accept_runtime()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit c3fc002b206c6c83d1e3702b979733002ba6fb2c ]
rsnd_kctrl_accept_runtime() (1) is used for runtime convert rate (= Synchronous SRC Mode). Now, rsnd driver has 2 kctrls for it
(A): "SRC Out Rate Switch"
(B): "SRC Out Rate" // it calls (1)
(A): can be called anytime
(B): can be called only runtime, and will indicate warning if it was used
at non-runtime.
To use runtime convert rate (= Synchronous SRC Mode), user might uses command in below order.
(X): > amixer set "SRC Out Rate" on
> aplay xxx.wav &
(Y): > amixer set "SRC Out Rate" 48010 // convert rate to 48010Hz
(Y): calls B
(X): calls both A and B.
In this case, when user calls (X), it calls both (A) and (B), but it is not yet start running. So, (B) will indicate warning.
This warning was added by commit b5c088689847 ("ASoC: rsnd: add warning message to rsnd_kctrl_accept_runtime()"), but the message sounds like the operation was not correct. Let's update warning message.
The message is very SRC specific, implement it in src.c
--- sound/soc/sh/rcar/core.c | 14 -------------- sound/soc/sh/rcar/rsnd.h | 1 - sound/soc/sh/rcar/src.c | 18 +++++++++++++++++- 3 files changed, 17 insertions(+), 16 deletions(-)
sound/soc/sh/rcar/core.c +0 -14
@@ -1599,20 +1599,6 @@ int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io)return 1 ; } -int rsnd_kctrl_accept_runtime (struct rsnd_dai_stream *io) -{ -struct snd_pcm_runtime *runtime =rsnd_io_to_runtime (io); -struct rsnd_priv *priv =rsnd_io_to_priv (io); -struct device *dev =rsnd_priv_to_dev (priv); - -if (!runtime) { -dev_warn (dev,"Can't update kctrl when idle\n" ); -return 0 ; - } - -return 1 ; -} -struct rsnd_kctrl_cfg *rsnd_kctrl_init_m (struct rsnd_kctrl_cfg_m *cfg) { cfg->cfg.val = cfg->val;
sound/soc/sh/rcar/rsnd.h +0 -1
@@ -737,7 +737,6 @@ struct rsnd_kctrl_cfg_s {#define rsnd_kctrl_vals (x) ((x).val)/* = (x).cfg.val[0] */ int rsnd_kctrl_accept_anytime (struct rsnd_dai_stream *io); -int rsnd_kctrl_accept_runtime (struct rsnd_dai_stream *io);struct rsnd_kctrl_cfg *rsnd_kctrl_init_m (struct rsnd_kctrl_cfg_m *cfg);struct rsnd_kctrl_cfg *rsnd_kctrl_init_s (struct rsnd_kctrl_cfg_s *cfg); int rsnd_kctrl_new(struct rsnd_mod *mod,
sound/soc/sh/rcar/src.c +17 -1
@@ -521,6 +521,22 @@ static irqreturn_t rsnd_src_interrupt(int irq, void *data)return IRQ_HANDLED ; } +static int rsnd_src_kctrl_accept_runtime (struct rsnd_dai_stream *io) +{ +struct snd_pcm_runtime *runtime =rsnd_io_to_runtime (io); + +if (!runtime) { +struct rsnd_priv *priv =rsnd_io_to_priv (io); +struct device *dev =rsnd_priv_to_dev (priv); + +dev_warn (dev,"\"SRC Out Rate\" can use during running\n" ); + +return 0 ; + } + +return 1 ; +} +static int rsnd_src_probe_ (struct rsnd_mod *mod,struct rsnd_dai_stream *io,struct rsnd_priv *priv)
@@ -584,7 +600,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod,rsnd_io_is_play (io) ?"SRC Out Rate" :"SRC In Rate" , - rsnd_kctrl_accept_runtime, + rsnd_src_kctrl_accept_runtime, rsnd_src_set_convert_rate, &src->sync, 192000);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/227 ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Rodionov <[email protected]>
[ Upstream commit 679074942c2502a95842a80471d8fb718165ac77 ]
Using fsleep instead of msleep resolves some customer complaints regarding the precision of up/down DAPM event timing. fsleep() automatically selects the appropriate sleep function, making the delay time more predictable.
--- sound/soc/codecs/arizona.c | 14 +++++++------- sound/soc/codecs/madera.c | 10 +++++----- sound/soc/codecs/wm5110.c | 8 ++++---- 3 files changed, 16 insertions(+), 16 deletions(-)
sound/soc/codecs/arizona.c +7 -7
@@ -967,7 +967,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,case ARIZONA_OUT3L_ENA_SHIFT :case ARIZONA_OUT3R_ENA_SHIFT : priv->out_up_pending++; - priv->out_up_delay +=17 ; + priv->out_up_delay +=17000 ;break ;case ARIZONA_OUT4L_ENA_SHIFT :case ARIZONA_OUT4R_ENA_SHIFT :
@@ -977,7 +977,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,case WM8997 :break ;default : - priv->out_up_delay +=10 ; + priv->out_up_delay +=10000 ;break ; }break ;
@@ -999,7 +999,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,if (!priv->out_up_pending && priv->out_up_delay) {dev_dbg (component->dev,"Power up delay: %d\n" , priv->out_up_delay); -msleep (priv->out_up_delay); +fsleep (priv->out_up_delay); priv->out_up_delay =0 ; }break ;
@@ -1017,7 +1017,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,case ARIZONA_OUT3L_ENA_SHIFT :case ARIZONA_OUT3R_ENA_SHIFT : priv->out_down_pending++; - priv->out_down_delay++; + priv->out_down_delay +=1000 ;break ;case ARIZONA_OUT4L_ENA_SHIFT :case ARIZONA_OUT4R_ENA_SHIFT :
@@ -1028,10 +1028,10 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,break ;case WM8998 :case WM1814 : - priv->out_down_delay +=5 ; + priv->out_down_delay +=5000 ;break ;default : - priv->out_down_delay++; + priv->out_down_delay +=1000 ;break ; }default :
@@ -1052,7 +1052,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,if (!priv->out_down_pending && priv->out_down_delay) {dev_dbg (component->dev,"Power down delay: %d\n" , priv->out_down_delay); -msleep (priv->out_down_delay); +fsleep (priv->out_down_delay); priv->out_down_delay =0 ; }break ;
sound/soc/codecs/madera.c +5 -5
@@ -2322,10 +2322,10 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case CS42L92 :case CS47L92 :case CS47L93 : - out_up_delay =6 ; + out_up_delay =6000 ;break ;default : - out_up_delay =17 ; + out_up_delay =17000 ;break ; }
@@ -2356,7 +2356,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case MADERA_OUT3R_ENA_SHIFT : priv->out_up_pending--;if (!priv->out_up_pending) { -msleep (priv->out_up_delay); +fsleep (priv->out_up_delay); priv->out_up_delay =0 ; }break ;
@@ -2375,7 +2375,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case MADERA_OUT3L_ENA_SHIFT :case MADERA_OUT3R_ENA_SHIFT : priv->out_down_pending++; - priv->out_down_delay++; + priv->out_down_delay +=1000 ;break ;default :break ;
@@ -2392,7 +2392,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case MADERA_OUT3R_ENA_SHIFT : priv->out_down_pending--;if (!priv->out_down_pending) { -msleep (priv->out_down_delay); +fsleep (priv->out_down_delay); priv->out_down_delay =0 ; }break ;
sound/soc/codecs/wm5110.c +4 -4
@@ -302,7 +302,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) }else { wseq = wm5110_no_dre_left_enable; nregs =ARRAY_SIZE (wm5110_no_dre_left_enable); - priv->out_up_delay +=10 ; + priv->out_up_delay +=10000 ; }break ;case ARIZONA_OUT1R_ENA_SHIFT :
@@ -312,7 +312,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) }else { wseq = wm5110_no_dre_right_enable; nregs =ARRAY_SIZE (wm5110_no_dre_right_enable); - priv->out_up_delay +=10 ; + priv->out_up_delay +=10000 ; }break ;default :
@@ -338,7 +338,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w)snd_soc_component_update_bits (component,ARIZONA_SPARE_TRIGGERS ,ARIZONA_WS_TRG1 ,0 ); - priv->out_down_delay +=27 ; + priv->out_down_delay +=27000 ; }break ;case ARIZONA_OUT1R_ENA_SHIFT :
@@ -350,7 +350,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w)snd_soc_component_update_bits (component,ARIZONA_SPARE_TRIGGERS ,ARIZONA_WS_TRG2 ,0 ); - priv->out_down_delay +=27 ; + priv->out_down_delay +=27000 ; }break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/227 ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Cheong <[email protected]>
[ Upstream commit 33b7dc7843dbdc9b90c91d11ba30b107f9138ffd ]
In enviornment without KMOD requesting module may fail to load snd-hda-codec-hdmi, resulting in HDMI audio not usable.
Add softdep to loading HDMI codec module first to ensure we can load it correctly.
--- sound/soc/sof/intel/hda-codec.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/sof/intel/hda-codec.c +1 -0
@@ -260,6 +260,7 @@ int hda_codec_i915_exit(struct snd_sof_dev *sdev) }EXPORT_SYMBOL_NS (hda_codec_i915_exit,SND_SOC_SOF_HDA_AUDIO_CODEC_I915 ); +MODULE_SOFTDEP ("pre: snd-hda-codec-hdmi" );#endif MODULE_LICENSE ("Dual BSD/GPL" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/227 nvmet-rdma: recheck queue state is LIVE in state lock in recv done
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruozhu Li <[email protected]>
[ Upstream commit 3988ac1c67e6e84d2feb987d7b36d5791174b3da ]
The queue state checking in nvmet_rdma_recv_done is not in queue state lock.Queue state can transfer to LIVE in cm establish handler between state checking and state lock here, cause a silent drop of nvme connect cmd.
Recheck queue state whether in LIVE state in state lock to prevent this issue.
--- drivers/nvme/target/rdma.c | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-)
drivers/nvme/target/rdma.c +23 -10
@@ -996,6 +996,27 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue,nvmet_req_complete (&cmd->req, status); } +static bool nvmet_rdma_recv_not_live (struct nvmet_rdma_queue *queue, +struct nvmet_rdma_rsp *rsp) +{ +unsigned long flags; +bool ret = true; + +spin_lock_irqsave (&queue->state_lock, flags); +/* +* recheck queue state is not live to prevent a race condition +* with RDMA_CM_EVENT_ESTABLISHED handler. +*/ +if (queue->state ==NVMET_RDMA_Q_LIVE ) + ret = false; +else if (queue->state ==NVMET_RDMA_Q_CONNECTING ) +list_add_tail (&rsp->wait_list, &queue->rsp_wait_list); +else +nvmet_rdma_put_rsp (rsp); +spin_unlock_irqrestore (&queue->state_lock, flags); +return ret; +} +static void nvmet_rdma_recv_done (struct ib_cq *cq,struct ib_wc *wc) { struct nvmet_rdma_cmd *cmd =
@@ -1037,17 +1058,9 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) rsp->req.port = queue->port; rsp->n_rdma =0 ; -if (unlikely (queue->state !=NVMET_RDMA_Q_LIVE )) { -unsigned long flags; - -spin_lock_irqsave (&queue->state_lock, flags); -if (queue->state ==NVMET_RDMA_Q_CONNECTING ) -list_add_tail (&rsp->wait_list, &queue->rsp_wait_list); -else -nvmet_rdma_put_rsp (rsp); -spin_unlock_irqrestore (&queue->state_lock, flags); +if (unlikely (queue->state !=NVMET_RDMA_Q_LIVE ) && +nvmet_rdma_recv_not_live (queue, rsp))return ; - }nvmet_rdma_handle_command (queue, rsp); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/227 sctp: Fix undefined behavior in left shift operation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu-Chun Lin <[email protected]>
[ Upstream commit 606572eb22c1786a3957d24307f5760bb058ca19 ]
According to the C11 standard (ISO/IEC 9899:2011, 6.5.7):
"If E1 has a signed type and E1 x 2^E2 is not representable in the result type, the behavior is undefined."
Shifting 1 << 31 causes signed integer overflow, which leads to undefined behavior.
Fix this by explicitly using '1U << 31' to ensure the shift operates on an unsigned type, avoiding undefined behavior.
--- net/sctp/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/stream.c +1 -1
@@ -735,7 +735,7 @@ struct sctp_chunk *sctp_process_strreset_tsnreq(* value SHOULD be the smallest TSN not acknowledged by the * receiver of the request plus 2^31. */ - init_tsn =sctp_tsnmap_get_ctsn (&asoc->peer.tsn_map) + (1 <<31 ); + init_tsn =sctp_tsnmap_get_ctsn (&asoc->peer.tsn_map) + (1U <<31 );sctp_tsnmap_init (&asoc->peer.tsn_map,SCTP_TSN_MAP_INITIAL , init_tsn,GFP_ATOMIC );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/227 nvme: only allow entering LIVE from CONNECTING state
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit d2fe192348f93fe3a0cb1e33e4aba58e646397f4 ]
The fabric transports and also the PCI transport are not entering the LIVE state from NEW or RESETTING. This makes the state machine more restrictive and allows to catch not supported state transitions, e.g. directly switching from RESETTING to LIVE.
--- drivers/nvme/host/core.c | 2 -- 1 file changed, 2 deletions(-)
drivers/nvme/host/core.c +0 -2
@@ -384,8 +384,6 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,switch (new_state) {case NVME_CTRL_LIVE :switch (old_state) { -case NVME_CTRL_NEW : -case NVME_CTRL_RESETTING :case NVME_CTRL_CONNECTING : changed = true; fallthrough;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/227 ASoC: tas2770: Fix volume scale
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit 579cd64b9df8a60284ec3422be919c362de40e41 ]
The scale starts at -100dB, not -128dB.
--- sound/soc/codecs/tas2770.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2770.c +1 -1
@@ -508,7 +508,7 @@ static int tas2770_codec_probe(struct snd_soc_component *component) } static DECLARE_TLV_DB_SCALE(tas2770_digital_tlv, 1100, 50, 0); -static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -12750, 50, 0); +static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -10050, 50, 0);static const struct snd_kcontrol_new tas2770_snd_controls[] = { SOC_SINGLE_TLV("Speaker Playback Volume", TAS2770_PLAY_CFG_REG2,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/227 ASoC: tas2764: Fix power control mask
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit a3f172359e22b2c11b750d23560481a55bf86af1 ]
--- sound/soc/codecs/tas2764.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2764.h +1 -1
@@ -25,7 +25,7 @@/* Power Control */ #define TAS2764_PWR_CTRL TAS2764_REG(0X0, 0x02) -#define TAS2764_PWR_CTRL_MASK GENMASK(1, 0) +#define TAS2764_PWR_CTRL_MASK GENMASK(2, 0)#define TAS2764_PWR_CTRL_ACTIVE 0x0#define TAS2764_PWR_CTRL_MUTE BIT(0)#define TAS2764_PWR_CTRL_SHUTDOWN BIT(1)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/227 ASoC: tas2764: Set the SDOUT polarity correctly
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit f5468beeab1b1adfc63c2717b1f29ef3f49a5fab ]
TX launch polarity needs to be the opposite of RX capture polarity, to generate the right bit slot alignment.
--- sound/soc/codecs/tas2764.c | 10 +++++++++- sound/soc/codecs/tas2764.h | 6 ++++++ 2 files changed, 15 insertions(+), 1 deletion(-)
sound/soc/codecs/tas2764.c +9 -1
@@ -315,7 +315,7 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) {struct snd_soc_component *component = dai->component;struct tas2764_priv *tas2764 =snd_soc_component_get_drvdata (component); -u8 tdm_rx_start_slot =0 , asi_cfg_0 =0 , asi_cfg_1 =0 ; +u8 tdm_rx_start_slot =0 , asi_cfg_0 =0 , asi_cfg_1 =0 , asi_cfg_4 =0 ;int ret;switch (fmt &SND_SOC_DAIFMT_INV_MASK ) {
@@ -324,12 +324,14 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) fallthrough;case SND_SOC_DAIFMT_NB_NF : asi_cfg_1 =TAS2764_TDM_CFG1_RX_RISING ; + asi_cfg_4 =TAS2764_TDM_CFG4_TX_FALLING ;break ;case SND_SOC_DAIFMT_IB_IF : asi_cfg_0 ^=TAS2764_TDM_CFG0_FRAME_START ; fallthrough;case SND_SOC_DAIFMT_IB_NF : asi_cfg_1 =TAS2764_TDM_CFG1_RX_FALLING ; + asi_cfg_4 =TAS2764_TDM_CFG4_TX_RISING ;break ; }
@@ -339,6 +341,12 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)if (ret <0 )return ret; + ret =snd_soc_component_update_bits (component,TAS2764_TDM_CFG4 , +TAS2764_TDM_CFG4_TX_MASK , + asi_cfg_4); +if (ret <0 ) +return ret; +switch (fmt &SND_SOC_DAIFMT_FORMAT_MASK ) {case SND_SOC_DAIFMT_I2S : asi_cfg_0 ^=TAS2764_TDM_CFG0_FRAME_START ;
sound/soc/codecs/tas2764.h +6 -0
@@ -75,6 +75,12 @@#define TAS2764_TDM_CFG3_RXS_SHIFT 0x4#define TAS2764_TDM_CFG3_MASK GENMASK(3, 0) +/* TDM Configuration Reg4 */ +#define TAS2764_TDM_CFG4 TAS2764_REG(0X0, 0x0d) +#define TAS2764_TDM_CFG4_TX_MASK BIT(0) +#define TAS2764_TDM_CFG4_TX_RISING 0x0 +#define TAS2764_TDM_CFG4_TX_FALLING BIT(0) +/* TDM Configuration Reg5 */ #define TAS2764_TDM_CFG5 TAS2764_REG(0X0, 0x0e)#define TAS2764_TDM_CFG5_VSNS_MASK BIT(6)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/227 fuse: dont truncate cached, mutated symlink
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
[ Upstream commit b4c173dfbb6c78568578ff18f9e8822d7bd0e31b ]
Fuse allows the value of a symlink to change and this property is exploited by some filesystems (e.g. CVMFS).
It has been observed, that sometimes after changing the symlink contents, the value is truncated to the old size.
This is caused by fuse_getattr() racing with fuse_reverse_inval_inode(). fuse_reverse_inval_inode() updates the fuse_inode's attr_version, which results in fuse_change_attributes() exiting before updating the cached attributes
This is okay, as the cached attributes remain invalid and the next call to fuse_change_attributes() will likely update the inode with the correct values.
The reason this causes problems is that cached symlinks will be returned through page_get_link(), which truncates the symlink to inode->i_size. This is correct for filesystems that don't mutate symlinks, but in this case it causes bad behavior.
The solution is to just remove this truncation. This can cause a regression in a filesystem that relies on supplying a symlink larger than the file size, but this is unlikely. If that happens we'd need to make this behavior conditional.
--- fs/fuse/dir.c | 2 +- fs/namei.c | 24 +++++++++++++++++++----- include/linux/fs.h | 2 ++ 3 files changed, 22 insertions(+), 6 deletions(-)
fs/fuse/dir.c +1 -1
@@ -1384,7 +1384,7 @@ static const char *fuse_get_link(struct dentry *dentry, struct inode *inode, goto out_err;if (fc->cache_symlinks) -return page_get_link (dentry, inode, callback); +return page_get_link_raw (dentry, inode, callback); err = -ECHILD ;if (!dentry)
fs/namei.c +19 -5
@@ -4678,10 +4678,9 @@ const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)EXPORT_SYMBOL (vfs_get_link);/* get the link contents into pagecache */ -const char *page_get_link (struct dentry *dentry,struct inode *inode, -struct delayed_call *callback) +static char *__page_get_link (struct dentry *dentry,struct inode *inode, +struct delayed_call *callback) { -char *kaddr;struct page *page;struct address_space *mapping = inode->i_mapping;
@@ -4700,8 +4699,23 @@ const char *page_get_link(struct dentry *dentry, struct inode *inode, }set_delayed_call (callback, page_put_link, page);BUG_ON (mapping_gfp_mask (mapping) & __GFP_HIGHMEM); - kaddr =page_address (page); -nd_terminate_link (kaddr, inode->i_size,PAGE_SIZE -1 ); +return page_address (page); +} + +const char *page_get_link_raw (struct dentry *dentry,struct inode *inode, +struct delayed_call *callback) +{ +return __page_get_link (dentry, inode, callback); +} +EXPORT_SYMBOL_GPL (page_get_link_raw); + +const char *page_get_link (struct dentry *dentry,struct inode *inode, +struct delayed_call *callback) +{ +char *kaddr =__page_get_link (dentry, inode, callback); + +if (!IS_ERR (kaddr)) +nd_terminate_link (kaddr, inode->i_size,PAGE_SIZE -1 );return kaddr; }
include/linux/fs.h +2 -0
@@ -3242,6 +3242,8 @@ extern const struct file_operations generic_ro_fops;extern int readlink_copy (char __user *,int ,const char *);extern int page_readlink (struct dentry *,char __user *,int ); +extern const char *page_get_link_raw (struct dentry *,struct inode *, +struct delayed_call *);extern const char *page_get_link (struct dentry *,struct inode *,struct delayed_call *);extern void page_put_link (void *);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/227 x86/irq: Define trace events conditionally
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 9de7695925d5d2d2085681ba935857246eb2817d ]
When both of X86_LOCAL_APIC and X86_THERMAL_VECTOR are disabled, the irq tracing produces a W=1 build warning for the tracing definitions:
In file included from include/trace/trace_events.h:27,
from include/trace/define_trace.h:113,
from arch/x86/include/asm/trace/irq_vectors.h:383,
from arch/x86/kernel/irq.c:29: include/trace/stages/init.h:2:23: error: 'str__irq_vectors__trace_system_name' defined but not used [-Werror=unused-const-variable=]
Make the tracepoints conditional on the same symbosl that guard their usage.
--- arch/x86/kernel/irq.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kernel/irq.c +2 -0
@@ -22,8 +22,10 @@#include <asm/desc.h> #include <asm/traps.h> +#if defined(CONFIG_X86_LOCAL_APIC ) || defined(CONFIG_X86_THERMAL_VECTOR )#define CREATE_TRACE_POINTS #include <asm/trace/irq_vectors.h> +#endif DEFINE_PER_CPU_SHARED_ALIGNED (irq_cpustat_t, irq_stat);EXPORT_PER_CPU_SYMBOL (irq_stat);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/227 mptcp: safety check before fallback
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit db75a16813aabae3b78c06b1b99f5e314c1f55d3 ]
Recently, some fallback have been initiated, while the connection was not supposed to fallback.
Add a safety check with a warning to detect when an wrong attempt to fallback is being done. This should help detecting any future issues quicker.
--- net/mptcp/protocol.h | 2 ++ 1 file changed, 2 insertions(+)
net/mptcp/protocol.h +2 -0
@@ -530,6 +530,8 @@ static inline void __mptcp_do_fallback(struct mptcp_sock *msk)pr_debug ("TCP fallback already done (msk=%p)\n" , msk);return ; } +if (WARN_ON_ONCE (!READ_ONCE (msk->allow_infinite_fallback))) +return ;set_bit (MPTCP_FALLBACK_DONE , &msk->flags); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/227 drm/nouveau: Do not override forced connector status
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 01f1d77a2630e774ce33233c4e6723bca3ae9daa ]
Keep user-forced connector status even if it cannot be programmed. Same behavior as for the rest of the drivers.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_connector.c +0 -1
@@ -751,7 +751,6 @@ nouveau_connector_force(struct drm_connector *connector)if (!nv_encoder) {NV_ERROR (drm,"can't find encoder to force %s on!\n" , connector->name); - connector->status = connector_status_disconnected;return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/227 block: fix kmem_cache of name bio-108 already exists
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit b654f7a51ffb386131de42aa98ed831f8c126546 ]
Device mapper bioset often has big bio_slab size, which can be more than 1000, then 8byte can't hold the slab name any more, cause the kmem_cache allocation warning of 'kmem_cache of name 'bio-108' already exists'.
Fix the warning by extending bio_slab->name to 12 bytes, but fix output of /proc/slabinfo
--- block/bio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bio.c +1 -1
@@ -55,7 +55,7 @@ struct bio_slab {struct kmem_cache *slab;unsigned int slab_ref;unsigned int slab_size; -char name[8 ]; +char name[12 ]; };static DEFINE_MUTEX (bio_slab_lock);static struct bio_slab *bio_slabs;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/227 USB: serial: ftdi_sio: add support for Altera USB Blaster 3
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boon Khai Ng <[email protected]>
commit 18e0885bd2ca738407036434418a26a58394a60e upstream.
The Altera USB Blaster 3, available as both a cable and an on-board solution, is primarily used for programming and debugging FPGAs.
It interfaces with host software such as Quartus Programmer, System Console, SignalTap, and Nios Debugger. The device utilizes either an FT2232 or FT4232 chip.
Enabling the support for various configurations of the on-board USB Blaster 3 by including the appropriate VID/PID pairs, allowing it to function as a serial device via ftdi_sio.
Note that this check-in does not include support for the cable solution, as it does not support UART functionality. The supported configurations are determined by the hardware design and include:
1) PID 0x6022, FT2232, 1 JTAG port (Port A) + Port B as UART
2) PID 0x6025, FT4232, 1 JTAG port (Port A) + Port C as UART
3) PID 0x6026, FT4232, 1 JTAG port (Port A) + Port C, D as UART
4) PID 0x6029, FT4232, 1 JTAG port (Port B) + Port C as UART
5) PID 0x602a, FT4232, 1 JTAG port (Port B) + Port C, D as UART
6) PID 0x602c, FT4232, 1 JTAG port (Port A) + Port B as UART
7) PID 0x602d, FT4232, 1 JTAG port (Port A) + Port B, C as UART
8) PID 0x602e, FT4232, 1 JTAG port (Port A) + Port B, C, D as UART
These configurations allow for flexibility in how the USB Blaster 3 is used, depending on the specific needs of the hardware design.
--- drivers/usb/serial/ftdi_sio.c | 14 ++++++++++++++ drivers/usb/serial/ftdi_sio_ids.h | 13 +++++++++++++ 2 files changed, 27 insertions(+)
drivers/usb/serial/ftdi_sio.c +14 -0
@@ -1057,6 +1057,20 @@ static const struct usb_device_id id_tab .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },/* GMC devices */ { USB_DEVICE(GMC_VID, GMC_Z216C_PID) }, +/* Altera USB Blaster 3 */ + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6022_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6025_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 3) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6029_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 3) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602C_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) }, { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +13 -0
@@ -1605,3 +1605,16 @@*/ #define GMC_VID 0x1cd7#define GMC_Z216C_PID 0x0217/* GMC Z216C Adapter IR-USB */ + +/* +* Altera USB Blaster 3 (http://www.altera.com). +*/ +#define ALTERA_VID 0x09fb +#define ALTERA_UB3_6022_PID 0x6022 +#define ALTERA_UB3_6025_PID 0x6025 +#define ALTERA_UB3_6026_PID 0x6026 +#define ALTERA_UB3_6029_PID 0x6029 +#define ALTERA_UB3_602A_PID 0x602a +#define ALTERA_UB3_602C_PID 0x602c +#define ALTERA_UB3_602D_PID 0x602d +#define ALTERA_UB3_602E_PID 0x602e
Greg Kroah-Hartman
maintainerPATCH 48/227 USB: serial: option: add Telit Cinterion FE990B compositions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 4981bb50392b7515b765da28cf8768ce624c2670 upstream.
Add the following Telit Cinterion FE990B40 compositions:
0x10b0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10b1: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10b2: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b2 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10b3: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b3 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -1388,6 +1388,22 @@ static const struct usb_device_id option .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */ + .driver_info = NCTRL(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x30), /* Telit FE990B (MBIM) */ + .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x30), /* Telit FE990B (RNDIS) */ + .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x30), /* Telit FE990B (ECM) */ + .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */
Greg Kroah-Hartman
maintainerPATCH 49/227 USB: serial: option: fix Telit Cinterion FE990A name
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 6232f0d8e100a26275bbd773fc56a60af2c95322 upstream.
The correct name for FE990 is FE990A so use it in order to avoid confusion with FE990B.
--- drivers/usb/serial/option.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/serial/option.c +4 -4
@@ -1368,13 +1368,13 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ .driver_info = RSVD(0) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990A (rmnet) */ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990 (MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990A (MBIM) */ .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990 (RNDIS) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990A (RNDIS) */ .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990A (ECM) */ .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) },
Greg Kroah-Hartman
maintainerPATCH 50/227 USB: serial: option: match on interface class for Telit FN990B
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 9a665fe3d967fe46edb4fd2497c7a5cc2dac2f55 upstream.
The device id entries for Telit FN990B ended up matching only on the interface protocol. While this works, the protocol is qualified by the interface class (and subclass) which should have been included.
Switch to matching using USB_DEVICE_AND_INTERFACE_INFO() while keeping the entries sorted also by protocol for consistency.
--- drivers/usb/serial/option.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/usb/serial/option.c +12 -12
@@ -1410,22 +1410,22 @@ static const struct usb_device_id option .driver_info = RSVD(0) | NCTRL(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) }, /* Telit FN990B (rmnet) */ - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30), + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */ .driver_info = NCTRL(5) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) }, /* Telit FN990B (MBIM) */ - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30), + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ .driver_info = NCTRL(6) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) }, /* Telit FN990B (RNDIS) */ - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30), + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x30), /* Telit FN990B (RNDIS) */ .driver_info = NCTRL(6) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) }, /* Telit FN990B (ECM) */ - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30), + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x30), /* Telit FN990B (ECM) */ .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x60) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
Greg Kroah-Hartman
maintainerPATCH 51/227 x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florent Revest <[email protected]>
commit e3e89178a9f4a80092578af3ff3c8478f9187d59 upstream.
Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses per-CPU data for the first CPU of each mask.
According to Documentation/admin-guide/mm/numaperf.rst:
"Some memory may share the same node as a CPU, and others are provided as memory only nodes."
Therefore, some node CPU masks may be empty and wouldn't have a "first CPU".
On a machine with far memory (and therefore CPU-less NUMA nodes):
- cpumask_of_node(nid) is 0
- cpumask_first(0) is CONFIG_NR_CPUS
- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an index that is 1 out of bounds
This does not have any security implications since flashing microcode is a privileged operation but I believe this has reliability implications by potentially corrupting memory while flashing a microcode update.
When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes a microcode update. I get the following splat:
UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y index 512 is out of range for type 'unsigned long[512]' [...] Call Trace: dump_stack __ubsan_handle_out_of_bounds load_microcode_amd request_microcode_amd reload_store kernfs_fop_write_iter vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe
Change the loop to go over only NUMA nodes which have CPUs before determining whether the first CPU on the respective node needs microcode update.
[ bp: Massage commit message, fix typo. ]
--- arch/x86/kernel/cpu/microcode/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/microcode/amd.c +1 -1
@@ -862,7 +862,7 @@ static enum ucode_state load_microcode_areturn ret; } -for_each_node (nid) { +for_each_node_with_cpus (nid) { cpu =cpumask_first (cpumask_of_node (nid)); c = &cpu_data (cpu);
Greg Kroah-Hartman
maintainerPATCH 52/227 drm/atomic: Filter out redundant DPMS calls
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
commit de93ddf88088f7624b589d0ff3af9effb87e8f3b upstream.
Video players (eg. mpv) do periodic XResetScreenSaver() calls to keep the screen on while the video playing. The modesetting ddx plumbs these straight through into the kernel as DPMS setproperty ioctls, without any filtering whatsoever. When implemented via atomic these end up as empty commits on the crtc (which will nonetheless take one full frame), which leads to a dropped frame every time XResetScreenSaver() is called.
Let's just filter out redundant DPMS property changes in the kernel to avoid this issue.
v2: Explain the resulting commits a bit better (Sima)
Document the behaviour in uapi docs (Sima)
Cc: [email protected]
Testcase: igt/kms_flip/flip-vs-dpms-on-nop
--- drivers/gpu/drm/drm_atomic_uapi.c | 4 ++++ drivers/gpu/drm/drm_connector.c | 4 ++++ 2 files changed, 8 insertions(+)
drivers/gpu/drm/drm_atomic_uapi.c +4 -0
@@ -936,6 +936,10 @@ int drm_atomic_connector_commit_dpms(strif (mode !=DRM_MODE_DPMS_ON ) mode =DRM_MODE_DPMS_OFF ; + +if (connector->dpms == mode) + goto out; + connector->dpms = mode; crtc = connector->state->crtc;
drivers/gpu/drm/drm_connector.c +4 -0
@@ -990,6 +990,10 @@ static const struct drm_prop_enum_list d* callback. For atomic drivers the remapping to the "ACTIVE" property is * implemented in the DRM core. * +* On atomic drivers any DPMS setproperty ioctl where the value does not +* change is completely skipped, otherwise a full atomic commit will occur. +* On legacy drivers the exact behavior is driver specific. +* * Note that this property cannot be set through the MODE_ATOMIC ioctl, * userspace must use "ACTIVE" on the CRTC instead. *
Greg Kroah-Hartman
maintainerPATCH 53/227 drm/amd/display: Assign normalized_pix_clk when color depth = 14
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
commit 79e31396fdd7037c503e6add15af7cb00633ea92 upstream.
[WHY & HOW]
A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397 calculate_phy_pix_clks+0xef/0x100 [amdgpu]" occurs because the display_color_depth == COLOR_DEPTH_141414 is not handled. This is observed in Radeon RX 6600 XT.
It is fixed by assigning pix_clk * (14 * 3) / 24 - same as the rests.
Also fixes the indentation in get_norm_pix_clk.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +5 -2
@@ -1975,10 +1975,13 @@ static int get_norm_pix_clk(const structbreak ;case COLOR_DEPTH_121212 : normalized_pix_clk = (pix_clk *36 ) /24 ; -break ; +break ; +case COLOR_DEPTH_141414 : + normalized_pix_clk = (pix_clk *42 ) /24 ; +break ;case COLOR_DEPTH_161616 : normalized_pix_clk = (pix_clk *48 ) /24 ; -break ; +break ;default :ASSERT (0 );break ;
Greg Kroah-Hartman
maintainerPATCH 54/227 drm/amd/display: Fix slab-use-after-free on hdcp_work
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit e65e7bea220c3ce8c4c793b4ba35557f4994ab2b upstream.
[Why]
A slab-use-after-free is reported when HDCP is destroyed but the property_validate_dwork queue is still running.
[How]
Cancel the delayed work when destroying workqueue.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +1 -0
@@ -383,6 +383,7 @@ void hdcp_destroy(struct kobject *kobj,for (i =0 ; i < hdcp_work->max_link; i++) {cancel_delayed_work_sync (&hdcp_work[i].callback_dwork);cancel_delayed_work_sync (&hdcp_work[i].watchdog_timer_dwork); +cancel_delayed_work_sync (&hdcp_work[i].property_validate_dwork); }sysfs_remove_bin_file (kobj, &hdcp_work[0 ].attr);
Greg Kroah-Hartman
maintainerPATCH 55/227 qlcnic: fix memory leak issues in qlcnic_sriov_common.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d2b9d97e89c79c95f8b517e4fa43fd100f936acc upstream.
Add qlcnic_sriov_free_vlans() in qlcnic_sriov_alloc_vlans() if any sriov_vlans fails to be allocated.
Add qlcnic_sriov_free_vlans() to free the memory allocated by qlcnic_sriov_alloc_vlans() if "sriov->allowed_vlans" fails to be allocated.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +6 -2
@@ -454,8 +454,10 @@ static int qlcnic_sriov_set_guest_vlan_m num_vlans = sriov->num_allowed_vlans; sriov->allowed_vlans =kcalloc (num_vlans,sizeof (u16),GFP_KERNEL ); -if (!sriov->allowed_vlans) +if (!sriov->allowed_vlans) { +qlcnic_sriov_free_vlans (adapter);return -ENOMEM ; + } vlans = (u16 *)&cmd->rsp.arg[3 ];for (i =0 ; i < num_vlans; i++)
@@ -2173,8 +2175,10 @@ int qlcnic_sriov_alloc_vlans(struct qlcn vf = &sriov->vf_info[i]; vf->sriov_vlans =kcalloc (sriov->num_allowed_vlans,sizeof (*vf->sriov_vlans),GFP_KERNEL ); -if (!vf->sriov_vlans) +if (!vf->sriov_vlans) { +qlcnic_sriov_free_vlans (adapter);return -ENOMEM ; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 56/227 drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <[email protected]>
[ Upstream commit 9af152dcf1a06f589f44a74da4ad67e365d4db9a ]
Since pci_get_domain_bus_and_slot() can return NULL, add NULL check for pci_gfx_root in the mid_get_vbt_data().
This change is similar to the checks implemented in mid_get_fuse_settings() and mid_get_pci_revID(), which were introduced by commit 0cecdd818cd7 ("gma500: Final enables for Oaktrail") as "additional minor bulletproofing".
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpu/drm/gma500/mid_bios.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/gma500/mid_bios.c +5 -0
@@ -277,6 +277,11 @@ static void mid_get_vbt_data(struct drm_psb_private *dev_priv) 0, PCI_DEVFN(2, 0));int ret =-1 ; +if (pci_gfx_root ==NULL ) { +WARN_ON (1 ); +return ; + } +/* Get the address of the platform config vbt */ pci_read_config_dword (pci_gfx_root,0xFC , &addr);pci_dev_put (pci_gfx_root);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/227 ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit ed92bc5264c4357d4fca292c769ea9967cd3d3b6 ]
Free some resources in the error handling path of the probe, as already done in the remove function.
--- sound/soc/codecs/wm0010.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
sound/soc/codecs/wm0010.c +11 -2
@@ -952,7 +952,7 @@ static int wm0010_spi_probe(struct spi_device *spi)if (ret) {dev_err (wm0010->dev,"Failed to set IRQ %d as wake source: %d\n" , irq, ret); -return ret; + goto free_irq; }if (spi->max_speed_hz)
@@ -964,9 +964,18 @@ static int wm0010_spi_probe(struct spi_device *spi) &soc_component_dev_wm0010, wm0010_dai, ARRAY_SIZE(wm0010_dai));if (ret <0 ) -return ret; + goto disable_irq_wake;return 0 ; + +disable_irq_wake: +irq_set_irq_wake (wm0010->irq,0 ); + +free_irq: +if (wm0010->irq) +free_irq (wm0010->irq, wm0010); + +return ret; }static int wm0010_spi_remove (struct spi_device *spi)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/227 i2c: ali1535: Fix an error handling path in ali1535_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 9b5463f349d019a261f1e80803447efca3126151 ]
If i2c_add_adapter() fails, the request_region() call in ali1535_setup() must be undone by a corresponding release_region() call, as done in the remove function.
--- drivers/i2c/busses/i2c-ali1535.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-ali1535.c +11 -1
@@ -490,6 +490,8 @@ MODULE_DEVICE_TABLE(pci, ali1535_ids);static int ali1535_probe (struct pci_dev *dev,const struct pci_device_id *id) { +int ret; +if (ali1535_setup (dev)) {dev_warn (&dev->dev,"ALI1535 not detected, module not inserted.\n" );
@@ -501,7 +503,15 @@ static int ali1535_probe(struct pci_dev *dev, const struct pci_device_id *id)snprintf (ali1535_adapter.name,sizeof (ali1535_adapter.name),"SMBus ALI1535 adapter at %04x" , ali1535_offset); -return i2c_add_adapter (&ali1535_adapter); + ret =i2c_add_adapter (&ali1535_adapter); +if (ret) + goto release_region; + +return 0 ; + +release_region: +release_region (ali1535_smba,ALI1535_SMB_IOSIZE ); +return ret; }static void ali1535_remove (struct pci_dev *dev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/227 i2c: ali15x3: Fix an error handling path in ali15x3_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 6e55caaf30c88209d097e575a169b1dface1ab69 ]
If i2c_add_adapter() fails, the request_region() call in ali15x3_setup() must be undone by a corresponding release_region() call, as done in the remove function.
--- drivers/i2c/busses/i2c-ali15x3.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-ali15x3.c +11 -1
@@ -473,6 +473,8 @@ MODULE_DEVICE_TABLE (pci, ali15x3_ids);static int ali15x3_probe (struct pci_dev *dev,const struct pci_device_id *id) { +int ret; +if (ali15x3_setup (dev)) {dev_err (&dev->dev,"ALI15X3 not detected, module not inserted.\n" );
@@ -484,7 +486,15 @@ static int ali15x3_probe(struct pci_dev *dev, const struct pci_device_id *id)snprintf (ali15x3_adapter.name,sizeof (ali15x3_adapter.name),"SMBus ALI15X3 adapter at %04x" , ali15x3_smba); -return i2c_add_adapter (&ali15x3_adapter); + ret =i2c_add_adapter (&ali15x3_adapter); +if (ret) + goto release_region; + +return 0 ; + +release_region: +release_region (ali15x3_smba,ALI15X3_SMB_IOSIZE ); +return ret; }static void ali15x3_remove (struct pci_dev *dev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/227 i2c: sis630: Fix an error handling path in sis630_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 2b22459792fcb4def9f0936d64575ac11a95a58d ]
If i2c_add_adapter() fails, the request_region() call in sis630_setup() must be undone by a corresponding release_region() call, as done in the remove function.
--- drivers/i2c/busses/i2c-sis630.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-sis630.c +11 -1
@@ -509,6 +509,8 @@ MODULE_DEVICE_TABLE(pci, sis630_ids);static int sis630_probe (struct pci_dev *dev,const struct pci_device_id *id) { +int ret; +if (sis630_setup (dev)) {dev_err (&dev->dev, "SIS630 compatible bus not detected, "
@@ -522,7 +524,15 @@ static int sis630_probe(struct pci_dev *dev, const struct pci_device_id *id)snprintf (sis630_adapter.name,sizeof (sis630_adapter.name),"SMBus SIS630 adapter at %04x" , smbus_base +SMB_STS ); -return i2c_add_adapter (&sis630_adapter); + ret =i2c_add_adapter (&sis630_adapter); +if (ret) + goto release_region; + +return 0 ; + +release_region: +release_region (smbus_base +SMB_STS ,SIS630_SMB_IOREGION ); +return ret; }static void sis630_remove (struct pci_dev *dev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/227 drm/amd/display: Check plane scaling against format specific hw plane caps.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
[ Upstream commit 6300b3bd9d0d7afaf085dd086ce6258511c3f057 ]
This takes hw constraints specific to pixel formats into account, e.g., the inability of older hw to scale fp16 format framebuffers.
It should now allow safely to enable fp16 formats also on DCE-8, DCE-10, DCE-11.0
Stable-dep-of: 374c9faac5a7 ("drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params")
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 81 +++++++++++++++++-- 1 file changed, 73 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +73 -8
@@ -3719,10 +3719,53 @@ static const struct drm_encoder_funcs amdgpu_dm_encoder_funcs = { }; +static void get_min_max_dc_plane_scaling (struct drm_device *dev, +struct drm_framebuffer *fb, +int *min_downscale,int *max_upscale) +{ +struct amdgpu_device *adev =drm_to_adev (dev); +struct dc *dc = adev->dm.dc; +/* Caps for all supported planes are the same on DCE and DCN 1 - 3 */ +struct dc_plane_cap *plane_cap = &dc->caps.planes[0 ]; + +switch (fb->format->format) { +case DRM_FORMAT_P010 : +case DRM_FORMAT_NV12 : +case DRM_FORMAT_NV21 : + *max_upscale = plane_cap->max_upscale_factor.nv12; + *min_downscale = plane_cap->max_downscale_factor.nv12; +break ; + +case DRM_FORMAT_XRGB16161616F : +case DRM_FORMAT_ARGB16161616F : +case DRM_FORMAT_XBGR16161616F : +case DRM_FORMAT_ABGR16161616F : + *max_upscale = plane_cap->max_upscale_factor.fp16; + *min_downscale = plane_cap->max_downscale_factor.fp16; +break ; + +default : + *max_upscale = plane_cap->max_upscale_factor.argb8888; + *min_downscale = plane_cap->max_downscale_factor.argb8888; +break ; + } + +/* +* A factor of 1 in the plane_cap means to not allow scaling, ie. use a +* scaling factor of 1.0 == 1000 units. +*/ +if (*max_upscale ==1 ) + *max_upscale =1000 ; + +if (*min_downscale ==1 ) + *min_downscale =1000 ; +} + +static int fill_dc_scaling_info (const struct drm_plane_state *state,struct dc_scaling_info *scaling_info) { -int scale_w, scale_h; +int scale_w, scale_h, min_downscale, max_upscale;memset (scaling_info,0 ,sizeof (*scaling_info));
@@ -3788,17 +3831,25 @@ static int fill_dc_scaling_info(const struct drm_plane_state *state,/* DRM doesn't specify clipping on destination output. */ scaling_info->clip_rect = scaling_info->dst_rect; -/* TODO: Validate scaling per-format with DC plane caps */ +/* Validate scaling per-format with DC plane caps */ +if (state->plane && state->plane->dev && state->fb) { +get_min_max_dc_plane_scaling (state->plane->dev, state->fb, + &min_downscale, &max_upscale); + }else { + min_downscale =250 ; + max_upscale =16000 ; + } + scale_w = scaling_info->dst_rect.width *1000 / scaling_info->src_rect.width; -if (scale_w <250 || scale_w >16000 ) +if (scale_w < min_downscale || scale_w > max_upscale)return -EINVAL ; scale_h = scaling_info->dst_rect.height *1000 / scaling_info->src_rect.height; -if (scale_h <250 || scale_h >16000 ) +if (scale_h < min_downscale || scale_h > max_upscale)return -EINVAL ;/*
@@ -6010,12 +6061,26 @@ static void dm_plane_helper_cleanup_fb(struct drm_plane *plane,static int dm_plane_helper_check_state (struct drm_plane_state *state,struct drm_crtc_state *new_crtc_state) { -int max_downscale =0 ; -int max_upscale =INT_MAX ; +struct drm_framebuffer *fb = state->fb; +int min_downscale, max_upscale; +int min_scale =0 ; +int max_scale =INT_MAX ; + +/* Plane enabled? Get min/max allowed scaling factors from plane caps. */ +if (fb && state->crtc) { +get_min_max_dc_plane_scaling (state->crtc->dev, fb, + &min_downscale, &max_upscale); +/* +* Convert to drm convention: 16.16 fixed point, instead of dc's +* 1.0 == 1000. Also drm scaling is src/dst instead of dc's +* dst/src, so min_scale = 1.0 / max_upscale, etc. +*/ + min_scale = (1000 <<16 ) / max_upscale; + max_scale = (1000 <<16 ) / min_downscale; + } -/* TODO: These should be checked against DC plane caps */ return drm_atomic_helper_check_plane_state ( - state, new_crtc_state, max_downscale, max_upscale, true, true); + state, new_crtc_state, min_scale, max_scale, true, true); } static int dm_plane_atomic_check(struct drm_plane *plane,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/227 drm/amd/display/dc/core/dc_resource: Staticify local functions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit c88855f3a50903721c4e1dda16cb42b5f5432b5c ]
Fixes the following W=1 kernel build warning(s):
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:1120:5: warning: no previous prototype for ‘shift_border_left_to_dst’ [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:1131:6: warning: no previous prototype for ‘restore_border_left_from_dst’ [-Wmissing-prototypes]
Stable-dep-of: 374c9faac5a7 ("drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params")
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +3 -3
@@ -1108,7 +1108,7 @@ static void calculate_inits_and_adj_vp(struct pipe_ctx *pipe_ctx)* We also need to make sure pipe_ctx->plane_res.scl_data.h_active uses the * original h_border_left value in its calculation. */ -int shift_border_left_to_dst (struct pipe_ctx *pipe_ctx) +static int shift_border_left_to_dst (struct pipe_ctx *pipe_ctx) {int store_h_border_left = pipe_ctx->stream->timing.h_border_left;
@@ -1119,8 +1119,8 @@ int shift_border_left_to_dst(struct pipe_ctx *pipe_ctx)return store_h_border_left; } -void restore_border_left_from_dst (struct pipe_ctx *pipe_ctx, -int store_h_border_left) +static void restore_border_left_from_dst (struct pipe_ctx *pipe_ctx, +int store_h_border_left) { pipe_ctx->stream->dst.x -= store_h_border_left; pipe_ctx->stream->timing.h_border_left = store_h_border_left;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/227 drm/amd/display: Reject too small viewport size when validating plane
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikola Cornij <[email protected]>
[ Upstream commit 40d916a2602c8920e0f04a49abfd1ff7c1e54e91 ]
[why]
Overlay won't move to a new positon if viewport size is smaller than what can be handled. It'd either disappear or stay at the old position. This condition is for example hit if overlay is moved too much outside of left or top edge of the screen, but it applies to any non-cursor plane type.
[how]
Reject this contidion at validation time. This gives the calling level a chance to handle this gracefully and avoid inconsistent behaivor.
Stable-dep-of: 374c9faac5a7 ("drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params")
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 27 ++++++++++++++++++- .../gpu/drm/amd/display/dc/core/dc_resource.c | 4 +-- drivers/gpu/drm/amd/display/dc/dc.h | 1 + 3 files changed, 29 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +26 -1
@@ -6066,8 +6066,33 @@ static int dm_plane_helper_check_state(struct drm_plane_state *state,int min_scale =0 ;int max_scale =INT_MAX ; -/* Plane enabled? Get min/max allowed scaling factors from plane caps. */ +/* Plane enabled? Validate viewport and get scaling factors from plane caps. */ if (fb && state->crtc) { +/* Validate viewport to cover the case when only the position changes */ +if (state->plane->type !=DRM_PLANE_TYPE_CURSOR ) { +int viewport_width = state->crtc_w; +int viewport_height = state->crtc_h; + +if (state->crtc_x <0 ) + viewport_width += state->crtc_x; +else if (state->crtc_x + state->crtc_w > new_crtc_state->mode.crtc_hdisplay) + viewport_width = new_crtc_state->mode.crtc_hdisplay - state->crtc_x; + +if (state->crtc_y <0 ) + viewport_height += state->crtc_y; +else if (state->crtc_y + state->crtc_h > new_crtc_state->mode.crtc_vdisplay) + viewport_height = new_crtc_state->mode.crtc_vdisplay - state->crtc_y; + +/* If completely outside of screen, viewport_width and/or viewport_height will be negative, +* which is still OK to satisfy the condition below, thereby also covering these cases +* (when plane is completely outside of screen). +* x2 for width is because of pipe-split. +*/ +if (viewport_width <MIN_VIEWPORT_SIZE *2 || viewport_height <MIN_VIEWPORT_SIZE ) +return -EINVAL ; + } + +/* Get min/max allowed scaling factors from plane caps. */ get_min_max_dc_plane_scaling (state->crtc->dev, fb, &min_downscale, &max_upscale);/*
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +2 -2
@@ -1144,8 +1144,8 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)calculate_viewport (pipe_ctx); -if (pipe_ctx->plane_res.scl_data.viewport.height <12 || - pipe_ctx->plane_res.scl_data.viewport.width <12 ) { +if (pipe_ctx->plane_res.scl_data.viewport.height <MIN_VIEWPORT_SIZE || + pipe_ctx->plane_res.scl_data.viewport.width <MIN_VIEWPORT_SIZE ) {if (store_h_border_left) {restore_border_left_from_dst (pipe_ctx, store_h_border_left);
drivers/gpu/drm/amd/display/dc/dc.h +1 -0
@@ -48,6 +48,7 @@#define MAX_PLANES 6#define MAX_STREAMS 6#define MAX_SINKS_PER_LINK 4 +#define MIN_VIEWPORT_SIZE 12/******************************************************************************* * Display Core Interfaces
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/227 drm/amd/display: fix odm scaling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmytro Laktyushkin <[email protected]>
[ Upstream commit 6566cae7aef30da8833f1fa0eb854baf33b96676 ]
There are two issues with scaling calculations, odm recout calculation and matching viewport to actual recout.
This change fixes both issues. Odm recout calculation via special casing and viewport matching issue by reworking the viewport calcualtion to use scaling ratios and recout to derrive the required offset and size.
Stable-dep-of: 374c9faac5a7 ("drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params")
--- .../gpu/drm/amd/display/dc/core/dc_resource.c | 568 +++++++----------- drivers/gpu/drm/amd/display/dc/dc_types.h | 5 - .../drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c | 12 +- .../drm/amd/display/dc/dcn20/dcn20_resource.c | 14 +- .../amd/display/dc/dml/display_mode_structs.h | 2 + .../drm/amd/display/dc/dml/display_mode_vba.c | 13 + .../gpu/drm/amd/display/dc/inc/hw/transform.h | 4 - 7 files changed, 232 insertions(+), 386 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +201 -367
@@ -647,124 +647,23 @@ static void calculate_split_count_and_index(struct pipe_ctx *pipe_ctx, int *spli } } -static void calculate_viewport (struct pipe_ctx *pipe_ctx) +/* +* This is a preliminary vp size calculation to allow us to check taps support. +* The result is completely overridden afterwards. +*/ +static void calculate_viewport_size (struct pipe_ctx *pipe_ctx) { -const struct dc_plane_state *plane_state = pipe_ctx->plane_state; -const struct dc_stream_state *stream = pipe_ctx->stream;struct scaler_data *data = &pipe_ctx->plane_res.scl_data; -struct rect surf_src = plane_state->src_rect; -struct rect clip, dest; -int vpc_div = (data->format ==PIXEL_FORMAT_420BPP8 - || data->format ==PIXEL_FORMAT_420BPP10 ) ?2 :1 ; -int split_count =0 ; -int split_idx =0 ; -bool orthogonal_rotation, flip_y_start, flip_x_start; - -calculate_split_count_and_index (pipe_ctx, &split_count, &split_idx); -if (stream->view_format ==VIEW_3D_FORMAT_SIDE_BY_SIDE || - stream->view_format ==VIEW_3D_FORMAT_TOP_AND_BOTTOM ) { - split_count =0 ; - split_idx =0 ; - } - -/* The actual clip is an intersection between stream -* source and surface clip -*/ - dest = plane_state->dst_rect; - clip.x = stream->src.x > plane_state->clip_rect.x ? - stream->src.x : plane_state->clip_rect.x; - - clip.width = stream->src.x + stream->src.width < - plane_state->clip_rect.x + plane_state->clip_rect.width ? - stream->src.x + stream->src.width - clip.x : - plane_state->clip_rect.x + plane_state->clip_rect.width - clip.x ; - - clip.y = stream->src.y > plane_state->clip_rect.y ? - stream->src.y : plane_state->clip_rect.y; - - clip.height = stream->src.y + stream->src.height < - plane_state->clip_rect.y + plane_state->clip_rect.height ? - stream->src.y + stream->src.height - clip.y : - plane_state->clip_rect.y + plane_state->clip_rect.height - clip.y ; - -/* -* Need to calculate how scan origin is shifted in vp space -* to correctly rotate clip and dst -*/ -get_vp_scan_direction ( - plane_state->rotation, - plane_state->horizontal_mirror, - &orthogonal_rotation, - &flip_y_start, - &flip_x_start); - -if (orthogonal_rotation) { -swap (clip.x, clip.y); -swap (clip.width, clip.height); -swap (dest.x, dest.y); -swap (dest.width, dest.height); - } -if (flip_x_start) { - clip.x = dest.x + dest.width - clip.x - clip.width; - dest.x =0 ; - } -if (flip_y_start) { - clip.y = dest.y + dest.height - clip.y - clip.height; - dest.y =0 ; - } - -/* offset = surf_src.ofs + (clip.ofs - surface->dst_rect.ofs) * scl_ratio -* num_pixels = clip.num_pix * scl_ratio -*/ - data->viewport.x = surf_src.x + (clip.x - dest.x) * surf_src.width / dest.width; - data->viewport.width = clip.width * surf_src.width / dest.width; - - data->viewport.y = surf_src.y + (clip.y - dest.y) * surf_src.height / dest.height; - data->viewport.height = clip.height * surf_src.height / dest.height; - -/* Handle split */ -if (split_count) { -/* extra pixels in the division remainder need to go to pipes after -* the extra pixel index minus one(epimo) defined here as: -*/ -int epimo =0 ; - -if (orthogonal_rotation) { -if (flip_y_start) - split_idx = split_count - split_idx; - - epimo = split_count - data->viewport.height % (split_count +1 ); - - data->viewport.y += (data->viewport.height / (split_count +1 )) * split_idx; -if (split_idx > epimo) - data->viewport.y += split_idx - epimo -1 ; - data->viewport.height = data->viewport.height / (split_count +1 ) + (split_idx > epimo ?1 :0 ); - }else { -if (flip_x_start) - split_idx = split_count - split_idx; - - epimo = split_count - data->viewport.width % (split_count +1 ); - - data->viewport.x += (data->viewport.width / (split_count +1 )) * split_idx; -if (split_idx > epimo) - data->viewport.x += split_idx - epimo -1 ; - data->viewport.width = data->viewport.width / (split_count +1 ) + (split_idx > epimo ?1 :0 ); - } + data->viewport.width =dc_fixpt_ceil (dc_fixpt_mul_int (data->ratios.horz, data->recout.width)); + data->viewport.height =dc_fixpt_ceil (dc_fixpt_mul_int (data->ratios.vert, data->recout.height)); + data->viewport_c.width =dc_fixpt_ceil (dc_fixpt_mul_int (data->ratios.horz_c, data->recout.width)); + data->viewport_c.height =dc_fixpt_ceil (dc_fixpt_mul_int (data->ratios.vert_c, data->recout.height)); +if (pipe_ctx->plane_state->rotation ==ROTATION_ANGLE_90 || + pipe_ctx->plane_state->rotation ==ROTATION_ANGLE_270 ) { +swap (data->viewport.width, data->viewport.height); +swap (data->viewport_c.width, data->viewport_c.height); } - -/* Round down, compensate in init */ - data->viewport_c.x = data->viewport.x / vpc_div; - data->viewport_c.y = data->viewport.y / vpc_div; - data->inits.h_c = (data->viewport.x % vpc_div) !=0 ? dc_fixpt_half : dc_fixpt_zero; - data->inits.v_c = (data->viewport.y % vpc_div) !=0 ? dc_fixpt_half : dc_fixpt_zero; - -/* Round up, assume original video size always even dimensions */ - data->viewport_c.width = (data->viewport.width + vpc_div -1 ) / vpc_div; - data->viewport_c.height = (data->viewport.height + vpc_div -1 ) / vpc_div; - - data->viewport_unadjusted = data->viewport; - data->viewport_c_unadjusted = data->viewport_c; }static void calculate_recout (struct pipe_ctx *pipe_ctx)
@@ -773,26 +672,21 @@ static void calculate_recout(struct pipe_ctx *pipe_ctx)const struct dc_stream_state *stream = pipe_ctx->stream;struct scaler_data *data = &pipe_ctx->plane_res.scl_data;struct rect surf_clip = plane_state->clip_rect; -bool pri_split_tb = pipe_ctx->bottom_pipe && - pipe_ctx->bottom_pipe->plane_state == pipe_ctx->plane_state && - stream->view_format ==VIEW_3D_FORMAT_TOP_AND_BOTTOM ; -bool sec_split_tb = pipe_ctx->top_pipe && - pipe_ctx->top_pipe->plane_state == pipe_ctx->plane_state && - stream->view_format ==VIEW_3D_FORMAT_TOP_AND_BOTTOM ; -int split_count =0 ; -int split_idx =0 ; +bool split_tb = stream->view_format ==VIEW_3D_FORMAT_TOP_AND_BOTTOM ; +int split_count, split_idx;calculate_split_count_and_index (pipe_ctx, &split_count, &split_idx); +if (stream->view_format ==VIEW_3D_FORMAT_SIDE_BY_SIDE ) + split_idx =0 ;/* * Only the leftmost ODM pipe should be offset by a nonzero distance */ -if (!pipe_ctx->prev_odm_pipe) { +if (!pipe_ctx->prev_odm_pipe || split_idx == split_count) { data->recout.x = stream->dst.x;if (stream->src.x < surf_clip.x) data->recout.x += (surf_clip.x - stream->src.x) * stream->dst.width / stream->src.width; - }else data->recout.x =0 ;
@@ -809,26 +703,31 @@ static void calculate_recout(struct pipe_ctx *pipe_ctx)if (data->recout.height + data->recout.y > stream->dst.y + stream->dst.height) data->recout.height = stream->dst.y + stream->dst.height - data->recout.y; -/* Handle h & v split, handle rotation using viewport */ -if (sec_split_tb) { - data->recout.y += data->recout.height /2 ; -/* Floor primary pipe, ceil 2ndary pipe */ - data->recout.height = (data->recout.height +1 ) /2 ; - }else if (pri_split_tb) +/* Handle h & v split */ +if (split_tb) { +ASSERT (data->recout.height %2 ==0 ); data->recout.height /=2 ; -else if (split_count) { -/* extra pixels in the division remainder need to go to pipes after -* the extra pixel index minus one(epimo) defined here as: -*/ -int epimo = split_count - data->recout.width % (split_count +1 ); - -/*no recout offset due to odm */ + }else if (split_count) {if (!pipe_ctx->next_odm_pipe && !pipe_ctx->prev_odm_pipe) { +/* extra pixels in the division remainder need to go to pipes after +* the extra pixel index minus one(epimo) defined here as: +*/ +int epimo = split_count - data->recout.width % (split_count +1 ); + data->recout.x += (data->recout.width / (split_count +1 )) * split_idx;if (split_idx > epimo) data->recout.x += split_idx - epimo -1 ; +ASSERT (stream->view_format !=VIEW_3D_FORMAT_SIDE_BY_SIDE || data->recout.width %2 ==0 ); + data->recout.width = data->recout.width / (split_count +1 ) + (split_idx > epimo ?1 :0 ); + }else { +/* odm */ +if (split_idx == split_count) { +/* rightmost pipe is the remainder recout */ + data->recout.width -= data->h_active * split_count - data->recout.x; + data->recout.x =0 ; + }else + data->recout.width = data->h_active - data->recout.x; } - data->recout.width = data->recout.width / (split_count +1 ) + (split_idx > epimo ?1 :0 ); } }
@@ -882,9 +781,15 @@ static void calculate_scaling_ratios(struct pipe_ctx *pipe_ctx) pipe_ctx->plane_res.scl_data.ratios.vert_c, 19); } -static inline void adjust_vp_and_init_for_seamless_clip( + +/* +* We completely calculate vp offset, size and inits here based entirely on scaling +* ratios and recout for pixel perfect pipe combine. +*/ +static void calculate_init_and_vp( bool flip_scan_dir, - int recout_skip, + int recout_offset_within_recout_full, + int recout_size, int src_size, int taps, struct fixed31_32 ratio,
@@ -892,91 +797,87 @@ static inline void adjust_vp_and_init_for_seamless_clip(int *vp_offset, int *vp_size) { -if (!flip_scan_dir) { -/* Adjust for viewport end clip-off */ -if ((*vp_offset + *vp_size) < src_size) { -int vp_clip = src_size - *vp_size - *vp_offset; -int int_part =dc_fixpt_floor (dc_fixpt_sub (*init, ratio)); - - int_part = int_part >0 ? int_part :0 ; - *vp_size += int_part < vp_clip ? int_part : vp_clip; - } - -/* Adjust for non-0 viewport offset */ -if (*vp_offset) { -int int_part; - - *init =dc_fixpt_add (*init,dc_fixpt_mul_int (ratio, recout_skip)); - int_part =dc_fixpt_floor (*init) - *vp_offset; -if (int_part < taps) { -int int_adj = *vp_offset >= (taps - int_part) ? - (taps - int_part) : *vp_offset; - *vp_offset -= int_adj; - *vp_size += int_adj; - int_part += int_adj; - }else if (int_part > taps) { - *vp_offset += int_part - taps; - *vp_size -= int_part - taps; - int_part = taps; - } - init->value &=0xffffffff ; - *init =dc_fixpt_add_int (*init, int_part); - } - }else { -/* Adjust for non-0 viewport offset */ -if (*vp_offset) { -int int_part =dc_fixpt_floor (dc_fixpt_sub (*init, ratio)); - - int_part = int_part >0 ? int_part :0 ; - *vp_size += int_part < *vp_offset ? int_part : *vp_offset; - *vp_offset -= int_part < *vp_offset ? int_part : *vp_offset; - } + struct fixed31_32 temp; +int int_part; -/* Adjust for viewport end clip-off */ -if ((*vp_offset + *vp_size) < src_size) { -int int_part; -int end_offset = src_size - *vp_offset - *vp_size; - -/* -* this is init if vp had no offset, keep in mind this is from the -* right side of vp due to scan direction -*/ - *init =dc_fixpt_add (*init,dc_fixpt_mul_int (ratio, recout_skip)); -/* -* this is the difference between first pixel of viewport available to read -* and init position, takning into account scan direction -*/ - int_part =dc_fixpt_floor (*init) - end_offset; -if (int_part < taps) { -int int_adj = end_offset >= (taps - int_part) ? - (taps - int_part) : end_offset; - *vp_size += int_adj; - int_part += int_adj; - }else if (int_part > taps) { - *vp_size += int_part - taps; - int_part = taps; - } - init->value &=0xffffffff ; - *init =dc_fixpt_add_int (*init, int_part); - } +/* +* First of the taps starts sampling pixel number <init_int_part> corresponding to recout +* pixel 1. Next recout pixel samples int part of <init + scaling ratio> and so on. +* All following calculations are based on this logic. +* +* Init calculated according to formula: +* init = (scaling_ratio + number_of_taps + 1) / 2 +* init_bot = init + scaling_ratio +* to get pixel perfect combine add the fraction from calculating vp offset +*/ + temp =dc_fixpt_mul_int (ratio, recout_offset_within_recout_full); + *vp_offset =dc_fixpt_floor (temp); + temp.value &=0xffffffff ; + *init =dc_fixpt_truncate (dc_fixpt_add (dc_fixpt_div_int ( +dc_fixpt_add_int (ratio, taps +1 ),2 ), temp),19 ); +/* +* If viewport has non 0 offset and there are more taps than covered by init then +* we should decrease the offset and increase init so we are never sampling +* outside of viewport. +*/ + int_part =dc_fixpt_floor (*init); +if (int_part < taps) { + int_part = taps - int_part; +if (int_part > *vp_offset) + int_part = *vp_offset; + *vp_offset -= int_part; + *init =dc_fixpt_add_int (*init, int_part); } +/* +* If taps are sampling outside of viewport at end of recout and there are more pixels +* available in the surface we should increase the viewport size, regardless set vp to +* only what is used. +*/ + temp =dc_fixpt_add (*init,dc_fixpt_mul_int (ratio, recout_size -1 )); + *vp_size =dc_fixpt_floor (temp); +if (*vp_size + *vp_offset > src_size) + *vp_size = src_size - *vp_offset; + +/* We did all the math assuming we are scanning same direction as display does, +* however mirror/rotation changes how vp scans vs how it is offset. If scan direction +* is flipped we simply need to calculate offset from the other side of plane. +* Note that outside of viewport all scaling hardware works in recout space. +*/ +if (flip_scan_dir) + *vp_offset = src_size - *vp_offset - *vp_size; } -static void calculate_inits_and_adj_vp (struct pipe_ctx *pipe_ctx) +static void calculate_inits_and_viewports (struct pipe_ctx *pipe_ctx) {const struct dc_plane_state *plane_state = pipe_ctx->plane_state;const struct dc_stream_state *stream = pipe_ctx->stream; -struct pipe_ctx *odm_pipe = pipe_ctx;struct scaler_data *data = &pipe_ctx->plane_res.scl_data; -struct rect src = pipe_ctx->plane_state->src_rect; -int recout_skip_h, recout_skip_v, surf_size_h, surf_size_v; +struct rect src = plane_state->src_rect;int vpc_div = (data->format ==PIXEL_FORMAT_420BPP8 - || data->format ==PIXEL_FORMAT_420BPP10 ) ?2 :1 ; + || data->format ==PIXEL_FORMAT_420BPP10 ) ?2 :1 ; +int split_count, split_idx, ro_lb, ro_tb, recout_full_x, recout_full_y;bool orthogonal_rotation, flip_vert_scan_dir, flip_horz_scan_dir; -int odm_idx =0 ; +calculate_split_count_and_index (pipe_ctx, &split_count, &split_idx);/* -* Need to calculate the scan direction for viewport to make adjustments +* recout full is what the recout would have been if we didnt clip +* the source plane at all. We only care about left(ro_lb) and top(ro_tb) +* offsets of recout within recout full because those are the directions +* we scan from and therefore the only ones that affect inits. +*/ + recout_full_x = stream->dst.x + (plane_state->dst_rect.x - stream->src.x) + * stream->dst.width / stream->src.width; + recout_full_y = stream->dst.y + (plane_state->dst_rect.y - stream->src.y) + * stream->dst.height / stream->src.height; +if (pipe_ctx->prev_odm_pipe && split_idx) + ro_lb = data->h_active * split_idx - recout_full_x; +else + ro_lb = data->recout.x - recout_full_x; + ro_tb = data->recout.y - recout_full_y; +ASSERT (ro_lb >=0 && ro_tb >=0 ); + +/* +* Work in recout rotation since that requires less transformations */ get_vp_scan_direction( plane_state->rotation,
@@ -985,145 +886,62 @@ static void calculate_inits_and_adj_vp(struct pipe_ctx *pipe_ctx) &flip_vert_scan_dir, &flip_horz_scan_dir); -/* Calculate src rect rotation adjusted to recout space */ - surf_size_h = src.x + src.width; - surf_size_v = src.y + src.height; -if (flip_horz_scan_dir) - src.x =0 ; -if (flip_vert_scan_dir) - src.y =0 ;if (orthogonal_rotation) { -swap (src.x, src.y);swap (src.width, src.height); +swap (flip_vert_scan_dir, flip_horz_scan_dir); } -/*modified recout_skip_h calculation due to odm having no recout offset*/ -while (odm_pipe->prev_odm_pipe) { - odm_idx++; - odm_pipe = odm_pipe->prev_odm_pipe; - } -/*odm_pipe is the leftmost pipe in the ODM group*/ - recout_skip_h = odm_idx * data->recout.width; - -/* Recout matching initial vp offset = recout_offset - (stream dst offset + -* ((surf dst offset - stream src offset) * 1/ stream scaling ratio) -* - (surf surf_src offset * 1/ full scl ratio)) -*/ - recout_skip_h += odm_pipe->plane_res.scl_data.recout.x - - (stream->dst.x + (plane_state->dst_rect.x - stream->src.x) - * stream->dst.width / stream->src.width - - src.x * plane_state->dst_rect.width / src.width - * stream->dst.width / stream->src.width); - - - recout_skip_v = data->recout.y - (stream->dst.y + (plane_state->dst_rect.y - stream->src.y) - * stream->dst.height / stream->src.height - - src.y * plane_state->dst_rect.height / src.height - * stream->dst.height / stream->src.height); -if (orthogonal_rotation) -swap (recout_skip_h, recout_skip_v); -/* -* Init calculated according to formula: -* init = (scaling_ratio + number_of_taps + 1) / 2 -* init_bot = init + scaling_ratio -* init_c = init + truncated_vp_c_offset(from calculate viewport) -*/ - data->inits.h =dc_fixpt_truncate (dc_fixpt_div_int ( -dc_fixpt_add_int (data->ratios.horz, data->taps.h_taps +1 ),2 ),19 ); - - data->inits.h_c =dc_fixpt_truncate (dc_fixpt_add (data->inits.h_c,dc_fixpt_div_int ( -dc_fixpt_add_int (data->ratios.horz_c, data->taps.h_taps_c +1 ),2 )),19 ); - - data->inits.v =dc_fixpt_truncate (dc_fixpt_div_int ( -dc_fixpt_add_int (data->ratios.vert, data->taps.v_taps +1 ),2 ),19 ); - - data->inits.v_c =dc_fixpt_truncate (dc_fixpt_add (data->inits.v_c,dc_fixpt_div_int ( -dc_fixpt_add_int (data->ratios.vert_c, data->taps.v_taps_c +1 ),2 )),19 ); - -/* -* Taps, inits and scaling ratios are in recout space need to rotate -* to viewport rotation before adjustment -*/ -adjust_vp_and_init_for_seamless_clip ( +calculate_init_and_vp ( flip_horz_scan_dir, - recout_skip_h, - surf_size_h, - orthogonal_rotation ? data->taps.v_taps : data->taps.h_taps, - orthogonal_rotation ? data->ratios.vert : data->ratios.horz, - orthogonal_rotation ? &data->inits.v : &data->inits.h, + ro_lb, + data->recout.width, + src.width, + data->taps.h_taps, + data->ratios.horz, + &data->inits.h, &data->viewport.x, &data->viewport.width); -adjust_vp_and_init_for_seamless_clip ( +calculate_init_and_vp ( flip_horz_scan_dir, - recout_skip_h, - surf_size_h / vpc_div, - orthogonal_rotation ? data->taps.v_taps_c : data->taps.h_taps_c, - orthogonal_rotation ? data->ratios.vert_c : data->ratios.horz_c, - orthogonal_rotation ? &data->inits.v_c : &data->inits.h_c, + ro_lb, + data->recout.width, + src.width / vpc_div, + data->taps.h_taps_c, + data->ratios.horz_c, + &data->inits.h_c, &data->viewport_c.x, &data->viewport_c.width); -adjust_vp_and_init_for_seamless_clip ( +calculate_init_and_vp ( flip_vert_scan_dir, - recout_skip_v, - surf_size_v, - orthogonal_rotation ? data->taps.h_taps : data->taps.v_taps, - orthogonal_rotation ? data->ratios.horz : data->ratios.vert, - orthogonal_rotation ? &data->inits.h : &data->inits.v, + ro_tb, + data->recout.height, + src.height, + data->taps.v_taps, + data->ratios.vert, + &data->inits.v, &data->viewport.y, &data->viewport.height); -adjust_vp_and_init_for_seamless_clip ( +calculate_init_and_vp ( flip_vert_scan_dir, - recout_skip_v, - surf_size_v / vpc_div, - orthogonal_rotation ? data->taps.h_taps_c : data->taps.v_taps_c, - orthogonal_rotation ? data->ratios.horz_c : data->ratios.vert_c, - orthogonal_rotation ? &data->inits.h_c : &data->inits.v_c, + ro_tb, + data->recout.height, + src.height / vpc_div, + data->taps.v_taps_c, + data->ratios.vert_c, + &data->inits.v_c, &data->viewport_c.y, &data->viewport_c.height); - -/* Interlaced inits based on final vert inits */ - data->inits.v_bot =dc_fixpt_add (data->inits.v, data->ratios.vert); - data->inits.v_c_bot =dc_fixpt_add (data->inits.v_c, data->ratios.vert_c); - -} - -/* -* When handling 270 rotation in mixed SLS mode, we have -* stream->timing.h_border_left that is non zero. If we are doing -* pipe-splitting, this h_border_left value gets added to recout.x and when it -* calls calculate_inits_and_adj_vp() and -* adjust_vp_and_init_for_seamless_clip(), it can cause viewport.height for a -* pipe to be incorrect. -* -* To fix this, instead of using stream->timing.h_border_left, we can use -* stream->dst.x to represent the border instead. So we will set h_border_left -* to 0 and shift the appropriate amount in stream->dst.x. We will then -* perform all calculations in resource_build_scaling_params() based on this -* and then restore the h_border_left and stream->dst.x to their original -* values. -* -* shift_border_left_to_dst() will shift the amount of h_border_left to -* stream->dst.x and set h_border_left to 0. restore_border_left_from_dst() -* will restore h_border_left and stream->dst.x back to their original values -* We also need to make sure pipe_ctx->plane_res.scl_data.h_active uses the -* original h_border_left value in its calculation. -*/ -static int shift_border_left_to_dst (struct pipe_ctx *pipe_ctx) -{ -int store_h_border_left = pipe_ctx->stream->timing.h_border_left; - -if (store_h_border_left) { - pipe_ctx->stream->timing.h_border_left =0 ; - pipe_ctx->stream->dst.x += store_h_border_left; +if (orthogonal_rotation) { +swap (data->viewport.x, data->viewport.y); +swap (data->viewport.width, data->viewport.height); +swap (data->viewport_c.x, data->viewport_c.y); +swap (data->viewport_c.width, data->viewport_c.height); } -return store_h_border_left; -} - -static void restore_border_left_from_dst (struct pipe_ctx *pipe_ctx, -int store_h_border_left) -{ - pipe_ctx->stream->dst.x -= store_h_border_left; - pipe_ctx->stream->timing.h_border_left = store_h_border_left; + data->viewport.x += src.x; + data->viewport.y += src.y; +ASSERT (src.x % vpc_div ==0 && src.y % vpc_div ==0 ); + data->viewport_c.x += src.x / vpc_div; + data->viewport_c.y += src.y / vpc_div; }bool resource_build_scaling_params (struct pipe_ctx *pipe_ctx)
@@ -1131,48 +949,42 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)const struct dc_plane_state *plane_state = pipe_ctx->plane_state;struct dc_crtc_timing *timing = &pipe_ctx->stream->timing;bool res = false; -int store_h_border_left =shift_border_left_to_dst (pipe_ctx);DC_LOGGER_INIT (pipe_ctx->stream->ctx->logger); -/* Important: scaling ratio calculation requires pixel format, -* lb depth calculation requires recout and taps require scaling ratios. -* Inits require viewport, taps, ratios and recout of split pipe -*/ + pipe_ctx->plane_res.scl_data.format =convert_pixel_format_to_dalsurface ( pipe_ctx->plane_state->format); -calculate_scaling_ratios (pipe_ctx); - -calculate_viewport (pipe_ctx); +/* Timing borders are part of vactive that we are also supposed to skip in addition +* to any stream dst offset. Since dm logic assumes dst is in addressable +* space we need to add the the left and top borders to dst offsets temporarily. +* TODO: fix in DM, stream dst is supposed to be in vactive +*/ + pipe_ctx->stream->dst.x += timing->h_border_left; + pipe_ctx->stream->dst.y += timing->v_border_top; -if (pipe_ctx->plane_res.scl_data.viewport.height <MIN_VIEWPORT_SIZE || - pipe_ctx->plane_res.scl_data.viewport.width <MIN_VIEWPORT_SIZE ) { -if (store_h_border_left) { -restore_border_left_from_dst (pipe_ctx, - store_h_border_left); - } -return false; - } +/* Calculate H and V active size */ + pipe_ctx->plane_res.scl_data.h_active = timing->h_addressable + + timing->h_border_left + timing->h_border_right; + pipe_ctx->plane_res.scl_data.v_active = timing->v_addressable + + timing->v_border_top + timing->v_border_bottom; +if (pipe_ctx->next_odm_pipe || pipe_ctx->prev_odm_pipe) + pipe_ctx->plane_res.scl_data.h_active /=get_num_odm_splits (pipe_ctx) +1 ; +/* depends on h_active */ calculate_recout (pipe_ctx); +/* depends on pixel format */ +calculate_scaling_ratios (pipe_ctx); +/* depends on scaling ratios and recout, does not calculate offset yet */ +calculate_viewport_size (pipe_ctx); -/** +/* +* LB calculations depend on vp size, h/v_active and scaling ratios * Setting line buffer pixel depth to 24bpp yields banding * on certain displays, such as the Sharp 4k */ pipe_ctx->plane_res.scl_data.lb_params.depth =LB_PIXEL_DEPTH_30BPP ; pipe_ctx->plane_res.scl_data.lb_params.alpha_en = plane_state->per_pixel_alpha; - pipe_ctx->plane_res.scl_data.recout.x += timing->h_border_left; - pipe_ctx->plane_res.scl_data.recout.y += timing->v_border_top; - - pipe_ctx->plane_res.scl_data.h_active = timing->h_addressable + - store_h_border_left + timing->h_border_right; - pipe_ctx->plane_res.scl_data.v_active = timing->v_addressable + - timing->v_border_top + timing->v_border_bottom; -if (pipe_ctx->next_odm_pipe || pipe_ctx->prev_odm_pipe) - pipe_ctx->plane_res.scl_data.h_active /=get_num_odm_splits (pipe_ctx) +1 ; - -/* Taps calculations */ if (pipe_ctx->plane_res.xfm !=NULL ) res = pipe_ctx->plane_res.xfm->funcs->transform_get_optimal_number_of_taps ( pipe_ctx->plane_res.xfm, &pipe_ctx->plane_res.scl_data, &plane_state->scaling_quality);
@@ -1199,9 +1011,31 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx) &plane_state->scaling_quality); } +/* +* Depends on recout, scaling ratios, h_active and taps +* May need to re-check lb size after this in some obscure scenario +*/ if (res) -/* May need to re-check lb size after this in some obscure scenario */ -calculate_inits_and_adj_vp (pipe_ctx); +calculate_inits_and_viewports (pipe_ctx); + +/* +* Handle side by side and top bottom 3d recout offsets after vp calculation +* since 3d is special and needs to calculate vp as if there is no recout offset +* This may break with rotation, good thing we aren't mixing hw rotation and 3d +*/ +if (pipe_ctx->top_pipe && pipe_ctx->top_pipe->plane_state == plane_state) { +ASSERT (plane_state->rotation ==ROTATION_ANGLE_0 || + (pipe_ctx->stream->view_format !=VIEW_3D_FORMAT_TOP_AND_BOTTOM && + pipe_ctx->stream->view_format !=VIEW_3D_FORMAT_SIDE_BY_SIDE )); +if (pipe_ctx->stream->view_format ==VIEW_3D_FORMAT_TOP_AND_BOTTOM ) + pipe_ctx->plane_res.scl_data.recout.y += pipe_ctx->plane_res.scl_data.recout.height; +else if (pipe_ctx->stream->view_format ==VIEW_3D_FORMAT_SIDE_BY_SIDE ) + pipe_ctx->plane_res.scl_data.recout.x += pipe_ctx->plane_res.scl_data.recout.width; + } + +if (pipe_ctx->plane_res.scl_data.viewport.height <MIN_VIEWPORT_SIZE || + pipe_ctx->plane_res.scl_data.viewport.width <MIN_VIEWPORT_SIZE ) + res = false; DC_LOG_SCALER("%s pipe %d:\nViewport: height:%d width:%d x:%d y:%d Recout: height:%d width:%d x:%d y:%d HACTIVE:%d VACTIVE:%d\n" "src_rect: height:%d width:%d x:%d y:%d dst_rect: height:%d width:%d x:%d y:%d clip_rect: height:%d width:%d x:%d y:%d\n",
@@ -1230,8 +1064,8 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx) plane_state->clip_rect.x, plane_state->clip_rect.y); -if (store_h_border_left) -restore_border_left_from_dst (pipe_ctx, store_h_border_left); + pipe_ctx->stream->dst.x -= timing->h_border_left; + pipe_ctx->stream->dst.y -= timing->v_border_top;return res; }
drivers/gpu/drm/amd/display/dc/dc_types.h +0 -5
@@ -268,11 +268,6 @@ struct dc_edid_caps {struct dc_panel_patch panel_patch; }; -struct view { -uint32_t width; -uint32_t height; -}; -struct dc_mode_flags {/* note: part of refresh rate flag*/ uint32_t INTERLACE :1 ;
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c +8 -4
@@ -617,8 +617,10 @@ static void dpp1_dscl_set_manual_ratio_init( SCL_V_INIT_INT, init_int);if (REG (SCL_VERT_FILTER_INIT_BOT )) { - init_frac =dc_fixpt_u0d19 (data->inits.v_bot) <<5 ; - init_int =dc_fixpt_floor (data->inits.v_bot); +struct fixed31_32 bot =dc_fixpt_add (data->inits.v, data->ratios.vert); + + init_frac =dc_fixpt_u0d19 (bot) <<5 ; + init_int =dc_fixpt_floor (bot);REG_SET_2 (SCL_VERT_FILTER_INIT_BOT ,0 ,SCL_V_INIT_FRAC_BOT , init_frac,SCL_V_INIT_INT_BOT , init_int);
@@ -631,8 +633,10 @@ static void dpp1_dscl_set_manual_ratio_init( SCL_V_INIT_INT_C, init_int);if (REG (SCL_VERT_FILTER_INIT_BOT_C )) { - init_frac =dc_fixpt_u0d19 (data->inits.v_c_bot) <<5 ; - init_int =dc_fixpt_floor (data->inits.v_c_bot); +struct fixed31_32 bot =dc_fixpt_add (data->inits.v_c, data->ratios.vert_c); + + init_frac =dc_fixpt_u0d19 (bot) <<5 ; + init_int =dc_fixpt_floor (bot);REG_SET_2 (SCL_VERT_FILTER_INIT_BOT_C ,0 ,SCL_V_INIT_FRAC_BOT_C , init_frac,SCL_V_INIT_INT_BOT_C , init_int);
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +8 -6
@@ -2281,12 +2281,14 @@ int dcn20_populate_dml_pipes_from_context( pipes[pipe_cnt].pipe.src.source_scan = pln->rotation ==ROTATION_ANGLE_90 || pln->rotation ==ROTATION_ANGLE_270 ? dm_vert : dm_horz; - pipes[pipe_cnt].pipe.src.viewport_y_y = scl->viewport_unadjusted.y; - pipes[pipe_cnt].pipe.src.viewport_y_c = scl->viewport_c_unadjusted.y; - pipes[pipe_cnt].pipe.src.viewport_width = scl->viewport_unadjusted.width; - pipes[pipe_cnt].pipe.src.viewport_width_c = scl->viewport_c_unadjusted.width; - pipes[pipe_cnt].pipe.src.viewport_height = scl->viewport_unadjusted.height; - pipes[pipe_cnt].pipe.src.viewport_height_c = scl->viewport_c_unadjusted.height; + pipes[pipe_cnt].pipe.src.viewport_y_y = scl->viewport.y; + pipes[pipe_cnt].pipe.src.viewport_y_c = scl->viewport_c.y; + pipes[pipe_cnt].pipe.src.viewport_width = scl->viewport.width; + pipes[pipe_cnt].pipe.src.viewport_width_c = scl->viewport_c.width; + pipes[pipe_cnt].pipe.src.viewport_height = scl->viewport.height; + pipes[pipe_cnt].pipe.src.viewport_height_c = scl->viewport_c.height; + pipes[pipe_cnt].pipe.src.viewport_width_max = pln->src_rect.width; + pipes[pipe_cnt].pipe.src.viewport_height_max = pln->src_rect.height; pipes[pipe_cnt].pipe.src.surface_width_y = pln->plane_size.surface_size.width; pipes[pipe_cnt].pipe.src.surface_height_y = pln->plane_size.surface_size.height; pipes[pipe_cnt].pipe.src.surface_width_c = pln->plane_size.chroma_size.width;
drivers/gpu/drm/amd/display/dc/dml/display_mode_structs.h +2 -0
@@ -255,6 +255,8 @@ struct _vcs_dpi_display_pipe_source_params_st {unsigned int viewport_y_c;unsigned int viewport_width_c;unsigned int viewport_height_c; +unsigned int viewport_width_max; +unsigned int viewport_height_max;unsigned int data_pitch;unsigned int data_pitch_c;unsigned int meta_pitch;
drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c +13 -0
@@ -628,6 +628,19 @@ static void fetch_pipe_params(struct display_mode_lib *mode_lib) } } } +if (src->viewport_width_max) { +int hdiv_c = src->source_format >= dm_420_8 && src->source_format <= dm_422_10 ?2 :1 ; +int vdiv_c = src->source_format >= dm_420_8 && src->source_format <= dm_420_12 ?2 :1 ; + +if (mode_lib->vba.ViewportWidth[mode_lib->vba.NumberOfActivePlanes] > src->viewport_width_max) + mode_lib->vba.ViewportWidth[mode_lib->vba.NumberOfActivePlanes] = src->viewport_width_max; +if (mode_lib->vba.ViewportHeight[mode_lib->vba.NumberOfActivePlanes] > src->viewport_height_max) + mode_lib->vba.ViewportHeight[mode_lib->vba.NumberOfActivePlanes] = src->viewport_height_max; +if (mode_lib->vba.ViewportWidthChroma[mode_lib->vba.NumberOfActivePlanes] > src->viewport_width_max / hdiv_c) + mode_lib->vba.ViewportWidthChroma[mode_lib->vba.NumberOfActivePlanes] = src->viewport_width_max / hdiv_c; +if (mode_lib->vba.ViewportHeightChroma[mode_lib->vba.NumberOfActivePlanes] > src->viewport_height_max / vdiv_c) + mode_lib->vba.ViewportHeightChroma[mode_lib->vba.NumberOfActivePlanes] = src->viewport_height_max / vdiv_c; + }if (pipes[k].pipe.src.immediate_flip) { mode_lib->vba.ImmediateFlipSupport = true;
drivers/gpu/drm/amd/display/dc/inc/hw/transform.h +0 -4
@@ -162,9 +162,7 @@ struct scl_inits {struct fixed31_32 h;struct fixed31_32 h_c;struct fixed31_32 v; -struct fixed31_32 v_bot;struct fixed31_32 v_c; -struct fixed31_32 v_c_bot; };struct scaler_data {
@@ -173,8 +171,6 @@ struct scaler_data {struct scaling_taps taps;struct rect viewport;struct rect viewport_c; -struct rect viewport_unadjusted; -struct rect viewport_c_unadjusted;struct rect recout;struct scaling_ratios ratios;struct scl_inits inits;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/227 drm/amd/display: Check for invalid input params when building scaling params
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Strauss <[email protected]>
[ Upstream commit 73b1da69f5314d96e1f963468863eaa884ee1030 ]
[WHY]
Function to calculate scaling ratios can be called with invalid plane src/dest, causing a divide by zero.
[HOW]
Fail building scaling params if plane state src/dest rects are unpopulated
Stable-dep-of: 374c9faac5a7 ("drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params")
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +9 -0
@@ -951,6 +951,15 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)bool res = false;DC_LOGGER_INIT (pipe_ctx->stream->ctx->logger); +/* Invalid input */ +if (!plane_state->dst_rect.width || + !plane_state->dst_rect.height || + !plane_state->src_rect.width || + !plane_state->src_rect.height) { +ASSERT (0 ); +return false; + } + pipe_ctx->plane_res.scl_data.format =convert_pixel_format_to_dalsurface ( pipe_ctx->plane_state->format);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/227 drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 374c9faac5a763a05bc3f68ad9f73dab3c6aec90 ]
Null pointer dereference issue could occur when pipe_ctx->plane_state is null. The fix adds a check to ensure 'pipe_ctx->plane_state' is not null before accessing. This prevents a null pointer dereference.
Found by code review.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +2 -1
@@ -952,7 +952,8 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)DC_LOGGER_INIT (pipe_ctx->stream->ctx->logger);/* Invalid input */ -if (!plane_state->dst_rect.width || +if (!plane_state || + !plane_state->dst_rect.width || !plane_state->dst_rect.height || !plane_state->src_rect.width || !plane_state->src_rect.height) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/227 firmware: imx-scu: fix OF node leak in .probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit fbf10b86f6057cf79300720da4ea4b77e6708b0d ]
imx_scu_probe() calls of_parse_phandle_with_args(), but does not release the OF node reference obtained by it. Add a of_node_put() call after done with the node.
--- drivers/firmware/imx/imx-scu.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/imx/imx-scu.c +1 -0
@@ -279,6 +279,7 @@ static int imx_scu_probe(struct platform_device *pdev)return ret; sc_ipc->fast_ipc =of_device_is_compatible (args.np,"fsl,imx8-mu-scu" ); +of_node_put (args.np); num_channel = sc_ipc->fast_ipc ?2 :SCU_MU_CHAN_NUM ;for (i =0 ; i < num_channel; i++) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/227 xfrm_output: Force software GSO only in tunnel mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit 0aae2867aa6067f73d066bc98385e23c8454a1d7 ]
The cited commit fixed a software GSO bug with VXLAN + IPSec in tunnel mode. Unfortunately, it is slightly broader than necessary, as it also severely affects performance for Geneve + IPSec transport mode over a device capable of both HW GSO and IPSec crypto offload. In this case, xfrm_output unnecessarily triggers software GSO instead of letting the HW do it. In simple iperf3 tests over Geneve + IPSec transport mode over a back-2-back pair of NICs with MTU 1500, the performance was observed to be up to 6x worse when doing software GSO compared to leaving it to the hardware.
This commit makes xfrm_output only trigger software GSO in crypto offload cases for already encapsulated packets in tunnel mode, as not doing so would then cause the inner tunnel skb->inner_networking_header to be overwritten and break software GSO for that packet later if the device turns out to not be capable of HW GSO.
Taking a closer look at the conditions for the original bug, to better understand the reasons for this change:
- vxlan_build_skb -> iptunnel_handle_offloads sets inner_protocol and inner network header.
- then, udp_tunnel_xmit_skb -> ip_tunnel_xmit adds outer transport and network headers.
- later in the xmit path, xfrm_output -> xfrm_outer_mode_output -> xfrm4_prepare_output -> xfrm4_tunnel_encap_add overwrites the inner network header with the one set in ip_tunnel_xmit before adding the second outer header.
- __dev_queue_xmit -> validate_xmit_skb checks whether GSO segmentation needs to happen based on dev features. In the original bug, the hw couldn't segment the packets, so skb_gso_segment was invoked.
- deep in the .gso_segment callback machinery, __skb_udp_tunnel_segment tries to use the wrong inner network header, expecting the one set in iptunnel_handle_offloads but getting the one set by xfrm instead.
- a bit later, ipv6_gso_segment accesses the wrong memory based on that wrong inner network header.
With the new change, the original bug (or similar ones) cannot happen again, as xfrm will now trigger software GSO before applying a tunnel. This concern doesn't exist in packet offload mode, when the HW adds encapsulation headers. For the non-offloaded packets (crypto in SW), software GSO is still done unconditionally in the else branch.
--- net/xfrm/xfrm_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_output.c +1 -1
@@ -601,7 +601,7 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)xfrm_state_hold (x);if (skb_is_gso (skb)) { -if (skb->inner_protocol) +if (skb->inner_protocol && x->props.mode ==XFRM_MODE_TUNNEL )return xfrm_output_gso (net, sk, skb);skb_shinfo (skb)->gso_type |=SKB_GSO_ESP ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/227 ARM: dts: bcm2711: PL011 UARTs are actually r1p5
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit 0de09025f161f67c07978c4742e221243d070d41 ]
The ARM PL011 UART instances in BCM2711 are r1p5 spec, which means they have 32-entry FIFOs. The correct periphid value for this is 0x00341011. Thanks to N Buchwitz for pointing this out.
--- arch/arm/boot/dts/bcm2711.dtsi | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/arm/boot/dts/bcm2711.dtsi +5 -4
@@ -133,7 +133,7 @@ uart2: serial@7e201400 { clocks = <&clocks BCM2835_CLOCK_UART>, <&clocks BCM2835_CLOCK_VPU>; clock-names = "uartclk", "apb_pclk"; - arm,primecell-periphid = <0x00241011>; + arm,primecell-periphid = <0x00341011>; status = "disabled"; };
@@ -144,7 +144,7 @@ uart3: serial@7e201600 { clocks = <&clocks BCM2835_CLOCK_UART>, <&clocks BCM2835_CLOCK_VPU>; clock-names = "uartclk", "apb_pclk"; - arm,primecell-periphid = <0x00241011>; + arm,primecell-periphid = <0x00341011>; status = "disabled"; };
@@ -155,7 +155,7 @@ uart4: serial@7e201800 { clocks = <&clocks BCM2835_CLOCK_UART>, <&clocks BCM2835_CLOCK_VPU>; clock-names = "uartclk", "apb_pclk"; - arm,primecell-periphid = <0x00241011>; + arm,primecell-periphid = <0x00341011>; status = "disabled"; };
@@ -166,7 +166,7 @@ uart5: serial@7e201a00 { clocks = <&clocks BCM2835_CLOCK_UART>, <&clocks BCM2835_CLOCK_VPU>; clock-names = "uartclk", "apb_pclk"; - arm,primecell-periphid = <0x00241011>; + arm,primecell-periphid = <0x00341011>; status = "disabled"; };
@@ -1115,6 +1115,7 @@ &txp { }; &uart0 { + arm,primecell-periphid = <0x00341011>; interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/227 RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kashyap Desai <[email protected]>
[ Upstream commit 67ee8d496511ad8e1cb88f72944847e7b3e4e47c ]
The modulo operation returns wrong result without the paranthesis and that resulted in wrong QP table indexing.
--- drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +2 -1
@@ -218,9 +218,10 @@ int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw);int bnxt_qplib_init_rcfw (struct bnxt_qplib_rcfw *rcfw,struct bnxt_qplib_ctx *ctx,int is_virtfn);void bnxt_qplib_mark_qp_error (void *qp_handle); +static inline u32 map_qp_id_to_tbl_indx (u32 qid,struct bnxt_qplib_rcfw *rcfw) {/* Last index of the qp_tbl is for QP1 ie. qp_tbl_size - 1*/ -return (qid ==1 ) ? rcfw->qp_tbl_size -1 : qid % rcfw->qp_tbl_size -2 ; +return (qid ==1 ) ? rcfw->qp_tbl_size -1 : (qid % (rcfw->qp_tbl_size -2 )); }#endif /* __BNXT_QPLIB_RCFW_H__ */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/227 ARM: dts: bcm2711: Dont mark timer regs unconfigured
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit c24f272ae751a9f54f8816430e7f2d56031892cc ]
During upstream process of Raspberry Pi 4 back in 2019 the ARMv7 stubs didn't configured the ARM architectural timer. This firmware issue has been fixed in 2020, which gave users enough time to update their system.
So drop this property to allow the use of the vDSO version of clock_gettime.
--- arch/arm/boot/dts/bcm2711.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm/boot/dts/bcm2711.dtsi +0 -2
@@ -424,8 +424,6 @@ IRQ_TYPE_LEVEL_LOW)>, IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>; - /* This only applies to the ARMv7 stub */ - arm,cpu-registers-not-fw-configured; }; cpus: cpus {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/227 RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravanan Vajravel <[email protected]>
[ Upstream commit 81c0db302a674f8004ed805393d17fd76f552e83 ]
Driver is always clearing the mask that sets the VLAN ID/Service Level in the adapter. Recent change for supporting multiple traffic class exposed this issue.
Allow setting SL and VLAN_ID while QP is moved from INIT to RTR state.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 -- 1 file changed, 2 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +0 -2
@@ -1163,8 +1163,6 @@ static void __modify_flags_from_init_state(struct bnxt_qplib_qp *qp) qp->path_mtu =CMDQ_MODIFY_QP_PATH_MTU_MTU_2048 ; } - qp->modify_flags &= - ~CMDQ_MODIFY_QP_MODIFY_MASK_VLAN_ID ;/* Bono FW require the max_dest_rd_atomic to be >= 1 */ if (qp->max_dest_rd_atomic <1 ) qp->max_dest_rd_atomic =1 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/227 RDMA/hns: Remove redundant phy_addr in hns_roce_hem_list_find_mtt()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 5f652387c5423a82453c5cb446a88834bf41a94b ]
This parameter has never been used. Remove it to simplify the function.
Stable-dep-of: 25655580136d ("RDMA/hns: Fix soft lockup during bt pages loop")
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 7 +------ drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++-- 3 files changed, 4 insertions(+), 9 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +1 -6
@@ -1462,19 +1462,17 @@ void hns_roce_hem_list_init(struct hns_roce_hem_list *hem_list)void *hns_roce_hem_list_find_mtt (struct hns_roce_dev *hr_dev,struct hns_roce_hem_list *hem_list, -int offset,int *mtt_cnt,u64 *phy_addr) +int offset,int *mtt_cnt) {struct list_head *head = &hem_list->btm_bt;struct hns_roce_hem_item *hem, *temp_hem;void *cpu_base =NULL ; -u64 phy_base =0 ;int nr =0 ;list_for_each_entry_safe (hem, temp_hem, head, sibling) {if (hem_list_page_is_in_range (hem, offset)) { nr = offset - hem->start; cpu_base = hem->addr + nr *BA_BYTE_LEN ; - phy_base = hem->dma_addr + nr *BA_BYTE_LEN ; nr = hem->end +1 - offset;break ; }
@@ -1483,8 +1481,5 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev,if (mtt_cnt) *mtt_cnt = nr; -if (phy_addr) - *phy_addr = phy_base; -return cpu_base; }
drivers/infiniband/hw/hns/hns_roce_hem.h +1 -1
@@ -131,7 +131,7 @@ void hns_roce_hem_list_release(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list);void *hns_roce_hem_list_find_mtt (struct hns_roce_dev *hr_dev,struct hns_roce_hem_list *hem_list, -int offset,int *mtt_cnt,u64 *phy_addr); +int offset,int *mtt_cnt);static inline void hns_roce_hem_first (struct hns_roce_hem *hem,struct hns_roce_hem_iter *iter)
drivers/infiniband/hw/hns/hns_roce_mr.c +2 -2
@@ -649,7 +649,7 @@ static int mtr_map_region(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,while (offset < end && npage < max_count) { count =0 ; mtts =hns_roce_hem_list_find_mtt (hr_dev, &mtr->hem_list, - offset, &count,NULL ); + offset, &count);if (!mtts)return -ENOBUFS ;
@@ -923,7 +923,7 @@ int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, mtt_count =0 ; mtts =hns_roce_hem_list_find_mtt (hr_dev, &mtr->hem_list, start_index + total, - &mtt_count,NULL ); + &mtt_count);if (!mtts || !mtt_count) goto done;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/227 RDMA/hns: Fix soft lockup during bt pages loop
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit 25655580136de59ec89f09089dd28008ea440fc9 ]
Driver runs a for-loop when allocating bt pages and mapping them with buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated, it may require a considerable loop count. This will lead to soft lockup:
watchdog: BUG: soft lockup - CPU#27 stuck for 22s!
...
Call trace:
hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2]
hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2]
hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2]
alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2]
hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2]
ib_uverbs_reg_mr+0x118/0x290
watchdog: BUG: soft lockup - CPU#35 stuck for 23s!
...
Call trace:
hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2]
mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2]
hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2]
alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2]
hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2]
ib_uverbs_reg_mr+0x120/0x2bcAdd a cond_resched() to fix soft lockup during these loops. In order not to affect the allocation performance of normal-size buffer, set the loop count of a 100GB MR as the threshold to call cond_resched().
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +15 -1
@@ -1384,6 +1384,11 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev,return ret; } +/* This is the bottom bt pages number of a 100G MR on 4K OS, assuming +* the bt page size is not expanded by cal_best_bt_pg_sz() +*/ +#define RESCHED_LOOP_CNT_THRESHOLD_ON_4K 12800 +/* construct the base address table and link them by address hop config */ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list,
@@ -1392,6 +1397,7 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, {const struct hns_roce_buf_region *r;int ofs, end; +int loop;int unit;int ret;int i;
@@ -1409,7 +1415,10 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev,continue ; end = r->offset + r->count; -for (ofs = r->offset; ofs < end; ofs += unit) { +for (ofs = r->offset, loop =1 ; ofs < end; ofs += unit, loop++) { +if (!(loop %RESCHED_LOOP_CNT_THRESHOLD_ON_4K )) +cond_resched (); + ret =hem_list_alloc_mid_bt (hr_dev, r, unit, ofs, hem_list->mid_bt[i], &hem_list->btm_bt);
@@ -1467,9 +1476,14 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev,struct list_head *head = &hem_list->btm_bt;struct hns_roce_hem_item *hem, *temp_hem;void *cpu_base =NULL ; +int loop =1 ;int nr =0 ;list_for_each_entry_safe (hem, temp_hem, head, sibling) { +if (!(loop %RESCHED_LOOP_CNT_THRESHOLD_ON_4K )) +cond_resched (); + loop++; +if (hem_list_page_is_in_range (hem, offset)) { nr = offset - hem->start; cpu_base = hem->addr + nr *BA_BYTE_LEN ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/227 RDMA/hns: Fix wrong value of max_sge_rd
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit 6b5e41a8b51fce520bb09bd651a29ef495e990de ]
There is no difference between the sge of READ and non-READ operations in hns RoCE. Set max_sge_rd to the same value as max_send_sge.
--- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_main.c +1 -1
@@ -199,7 +199,7 @@ static int hns_roce_query_device(struct ib_device *ib_dev,IB_DEVICE_RC_RNR_NAK_GEN ; props->max_send_sge = hr_dev->caps.max_sq_sg; props->max_recv_sge = hr_dev->caps.max_rq_sg; - props->max_sge_rd =1 ; + props->max_sge_rd = hr_dev->caps.max_sq_sg; props->max_cq = hr_dev->caps.num_cqs; props->max_cqe = hr_dev->caps.max_cqes; props->max_mr = hr_dev->caps.num_mtpts;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/227 Bluetooth: Fix error code in chan_alloc_skb_cb()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 72d061ee630d0dbb45c2920d8d19b3861c413e54 ]
The chan_alloc_skb_cb() function is supposed to return error pointers on error. Returning NULL will lead to a NULL dereference.
--- net/bluetooth/6lowpan.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/bluetooth/6lowpan.c +6 -1
@@ -855,11 +855,16 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan,unsigned long hdr_len, unsigned long len, int nb) { + struct sk_buff *skb; +/* Note that we must allocate using GFP_ATOMIC here as * this function is called originally from netdev hard xmit * function in atomic context. */ -return bt_skb_alloc (hdr_len + len,GFP_ATOMIC ); + skb =bt_skb_alloc (hdr_len + len,GFP_ATOMIC ); +if (!skb) +return ERR_PTR (-ENOMEM ); +return skb; }static void chan_suspend_cb (struct l2cap_chan *chan)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/227 ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9740890ee20e01f99ff1dde84c63dcf089fabb98 ]
fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything when it fails.
Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init() but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak.
Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the error path.
Note that we can remove the fib6_nh_release() call in nh_create_ipv6() later in net-next.git.
--- net/ipv6/route.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/route.c +2 -1
@@ -3519,7 +3519,8 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,in6_dev_put (idev);if (err) { -lwtstate_put (fib6_nh->fib_nh_lws); +fib_nh_common_release (&fib6_nh->nh_common); + fib6_nh->nh_common.nhc_pcpu_rth_output =NULL ; fib6_nh->fib_nh_lws =NULL ;if (dev)dev_put (dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/227 ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9a81fc3480bf5dbe2bf80e278c440770f6ba2692 ]
While creating a new IPv6, we could get a weird -ENOMEM when RTA_NH_ID is set and either of the conditions below is true:
1) CONFIG_IPV6_SUBTREES is enabled and rtm_src_len is specified
2) nexthop_get() fails
e.g.)
# strace ip -6 route add fe80::dead:beef:dead:beef nhid 1 from ::
recvmsg(3, {msg_iov=[{iov_base=[...[
{error=-ENOMEM, msg=[... [...]]},
[{nla_len=49, nla_type=NLMSGERR_ATTR_MSG}, "Nexthops can not be used with so"...]
]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 148Let's set err explicitly after ip_fib_metrics_init() in ip6_route_info_create().
--- net/ipv6/route.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv6/route.c +2 -0
@@ -3697,10 +3697,12 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,if (nh) {if (rt->fib6_src.plen) {NL_SET_ERR_MSG (extack,"Nexthops can not be used with source routing" ); + err = -EINVAL ; goto out_free; }if (!nexthop_get (nh)) {NL_SET_ERR_MSG (extack,"Nexthop has been deleted" ); + err = -ENOENT ; goto out_free; } rt->nh = nh;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/227 net: atm: fix use after free in lec_send()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit f3009d0d6ab78053117f8857b921a8237f4d17b3 ]
The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.
--- net/atm/lec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/atm/lec.c +2 -1
@@ -181,6 +181,7 @@ static void lec_send(struct atm_vcc *vcc, struct sk_buff *skb) { struct net_device *dev = skb->dev; +unsigned int len = skb->len;ATM_SKB (skb)->vcc = vcc;atm_account_tx (vcc, skb);
@@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) } dev->stats.tx_packets++; - dev->stats.tx_bytes += skb->len; + dev->stats.tx_bytes += len; }static void lec_tx_timeout (struct net_device *dev,unsigned int txqueue)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/227 net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit 90a7138619a0c55e2aefaad27b12ffc2ddbeed78 ]
Previous commit 8b5c171bb3dc ("neigh: new unresolved queue limits") introduces new netlink attribute NDTPA_QUEUE_LENBYTES to represent approximative value for deprecated QUEUE_LEN. However, it forgot to add the associated nla_policy in nl_ntbl_parm_policy array. Fix it with one simple NLA_U32 type policy.
--- net/core/neighbour.c | 1 + 1 file changed, 1 insertion(+)
net/core/neighbour.c +1 -0
@@ -2181,6 +2181,7 @@ static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX +1 ] = { [NDTPA_IFINDEX ] = { .type =NLA_U32 }, [NDTPA_QUEUE_LEN ] = { .type =NLA_U32 }, + [NDTPA_QUEUE_LENBYTES ] = { .type =NLA_U32 }, [NDTPA_PROXY_QLEN ] = { .type =NLA_U32 }, [NDTPA_APP_PROBES ] = { .type =NLA_U32 }, [NDTPA_UCAST_PROBES ] = { .type =NLA_U32 },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/227 i2c: omap: fix IRQ storms
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <[email protected]>
commit 285df995f90e3d61d97f327d34b9659d92313314 upstream.
On the GTA04A5 writing a reset command to the gyroscope causes IRQ storms because NACK IRQs are enabled and therefore triggered but not acked.
Sending a reset command to the gyroscope by
i2cset 1 0x69 0x14 0xb6
with an additional debug print in the ISR (not the thread) itself causes
[ 363.353515] i2c i2c-1: ioctl, cmd=0x720, arg=0xbe801b00 [ 363.359039] omap_i2c 48072000.i2c: addr: 0x0069, len: 2, flags: 0x0, stop: 1 [ 363.366180] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x1110) [ 363.371673] omap_i2c 48072000.i2c: IRQ (ISR = 0x0010) [ 363.376892] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) [ 363.382263] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) [ 363.387664] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102)
repeating till infinity
[...]
(0x2 = NACK, 0x100 = Bus free, which is not enabled) Apparently no other IRQ bit gets set, so this stalls.
Do not ignore enabled interrupts and make sure they are acked. If the NACK IRQ is not needed, it should simply not enabled, but according to the above log, caring about it is necessary unless the Bus free IRQ is enabled and handled. The assumption that is will always come with a ARDY IRQ, which was the idea behind ignoring it, proves wrong.
It is true for simple reads from an unused address.
To still avoid the i2cdetect trouble which is the reason for commit c770657bd261 ("i2c: omap: Fix standard mode false ACK readings"), avoid doing much about NACK in omap_i2c_xfer_data() which is used by both IRQ mode and polling mode, so also the false detection fix is extended to polling usage and IRQ storms are avoided.
By changing this, the hardirq handler is not needed anymore to filter stuff.
The mentioned gyro reset now just causes a -ETIMEDOUT instead of hanging the system.
--- drivers/i2c/busses/i2c-omap.c | 26 +++++++------------------- 1 file changed, 7 insertions(+), 19 deletions(-)
drivers/i2c/busses/i2c-omap.c +7 -19
@@ -1049,23 +1049,6 @@ static int omap_i2c_transmit_data(structreturn 0 ; } -static irqreturn_t -omap_i2c_isr (int irq,void *dev_id) -{ -struct omap_i2c_dev *omap = dev_id; -irqreturn_t ret =IRQ_HANDLED ; -u16 mask; -u16 stat; - - stat =omap_i2c_read_reg (omap,OMAP_I2C_STAT_REG ); - mask =omap_i2c_read_reg (omap,OMAP_I2C_IE_REG ) & ~OMAP_I2C_STAT_NACK ; - -if (stat & mask) - ret =IRQ_WAKE_THREAD ; - -return ret; -} -static int omap_i2c_xfer_data (struct omap_i2c_dev *omap) {u16 bits;
@@ -1096,8 +1079,13 @@ static int omap_i2c_xfer_data(struct oma }if (stat &OMAP_I2C_STAT_NACK ) { - err |=OMAP_I2C_STAT_NACK ; + omap->cmd_err |=OMAP_I2C_STAT_NACK ;omap_i2c_ack_stat (omap,OMAP_I2C_STAT_NACK ); + +if (!(stat & ~OMAP_I2C_STAT_NACK )) { + err = -EAGAIN ; +break ; + } }if (stat &OMAP_I2C_STAT_AL ) {
@@ -1475,7 +1463,7 @@ omap_i2c_probe(struct platform_device *p IRQF_NO_SUSPEND, pdev->name, omap); else r =devm_request_threaded_irq (&pdev->dev, omap->irq, - omap_i2c_isr, omap_i2c_isr_thread, +NULL , omap_i2c_isr_thread,IRQF_NO_SUSPEND |IRQF_ONESHOT , pdev->name, omap);
Greg Kroah-Hartman
maintainerPATCH 82/227 drm/v3d: Dont run jobs that have errors flagged in its fence
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
commit 80cbee810e4e13cdbd3ae9654e9ecddf17f3e828 upstream.
The V3D driver still relies on drm_sched_increase_karma() and drm_sched_resubmit_jobs() for resubmissions when a timeout occurs. The function drm_sched_increase_karma() marks the job as guilty, while drm_sched_resubmit_jobs() sets an error (-ECANCELED) in the DMA fence of that guilty job.
Because of this, we must check whether the job’s DMA fence has been flagged with an error before executing the job. Otherwise, the same guilty job may be resubmitted indefinitely, causing repeated GPU resets.
This patch adds a check for an error on the job's fence to prevent running a guilty job that was previously flagged when the GPU timed out.
Note that the CPU and CACHE_CLEAN queues do not require this check, as their jobs are executed synchronously once the DRM scheduler starts them.
--- drivers/gpu/drm/v3d/v3d_sched.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/v3d/v3d_sched.c +8 -1
@@ -188,11 +188,15 @@ v3d_tfu_job_run(struct drm_sched_job *scstruct drm_device *dev = &v3d->drm;struct dma_fence *fence; +if (unlikely (job->base.base.s_fence->finished.error)) +return NULL ; + + v3d->tfu_job = job; + fence =v3d_fence_create (v3d,V3D_TFU );if (IS_ERR (fence))return NULL ; - v3d->tfu_job = job;if (job->base.irq_fence)dma_fence_put (job->base.irq_fence); job->base.irq_fence =dma_fence_get (fence);
@@ -226,6 +230,9 @@ v3d_csd_job_run(struct drm_sched_job *scstruct dma_fence *fence;int i; +if (unlikely (job->base.base.s_fence->finished.error)) +return NULL ; + v3d->csd_job = job;v3d_invalidate_caches (v3d);
Greg Kroah-Hartman
maintainerPATCH 83/227 regulator: check that dummy regulator has been probed before using it
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <[email protected]>
commit 2c7a50bec4958f1d1c84d19cde518d0e96a676fd upstream.
Due to asynchronous driver probing there is a chance that the dummy regulator hasn't already been probed when first accessing it.
--- drivers/regulator/core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/regulator/core.c +11 -1
@@ -1924,6 +1924,10 @@ static int regulator_resolve_supply(struif (have_full_constraints ()) { r = dummy_regulator_rdev; +if (!r) { + ret = -EPROBE_DEFER ; + goto out; + }get_device (&r->dev); }else { dev_err(dev, "Failed to resolve %s-supply for %s\n",
@@ -1941,6 +1945,10 @@ static int regulator_resolve_supply(stru goto out; } r = dummy_regulator_rdev; +if (!r) { + ret = -EPROBE_DEFER ; + goto out; + }get_device (&r->dev); }
@@ -2049,8 +2057,10 @@ struct regulator *_regulator_get(struct* enabled, even if it isn't hooked up, and just * provide a dummy. */ -dev_warn (dev,"supply %s not found, using dummy regulator\n" , id); rdev = dummy_regulator_rdev; +if (!rdev) +return ERR_PTR (-EPROBE_DEFER ); +dev_warn (dev,"supply %s not found, using dummy regulator\n" , id);get_device (&rdev->dev);break ;
Greg Kroah-Hartman
maintainerPATCH 84/227 mmc: atmel-mci: Add missing clk_disable_unprepare()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gu Bowen <[email protected]>
commit e51a349d2dcf1df8422dabb90b2f691dc7df6f92 upstream.
The error path when atmci_configure_dma() set dma fails in atmci driver does not correctly disable the clock.
Add the missing clk_disable_unprepare() to the error path for pair with clk_prepare_enable().
--- drivers/mmc/host/atmel-mci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mmc/host/atmel-mci.c +3 -1
@@ -2507,8 +2507,10 @@ static int atmci_probe(struct platform_d/* Get MCI capabilities and set operations according to it */ atmci_get_cap (host); ret =atmci_configure_dma (host); -if (ret == -EPROBE_DEFER ) +if (ret == -EPROBE_DEFER ) { +clk_disable_unprepare (host->mck); goto err_dma_probe_defer; + }if (ret ==0 ) { host->prepare_data = &atmci_prepare_data_dma; host->submit_data = &atmci_submit_data_dma;
Greg Kroah-Hartman
maintainerPATCH 85/227 proc: fix UAF in proc_get_inode()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df upstream.
Fix race between rmmod and /proc/XXX's inode instantiation.
The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used.
use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->... dereference.
rmmod lookupsys_delete_module
proc_lookup_de
pde_get(de);
proc_get_inode(dir->i_sb, de);
mod->exit()
proc_remove
remove_proc_subtree
proc_entry_rundown(de); free_module(mod);
if (S_ISREG(inode->i_mode))
if (de->proc_ops->proc_read_iter)
--> As module is already freed, will trigger UAFBUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- fs/proc/generic.c | 10 +++++++++- fs/proc/inode.c | 6 +++--- fs/proc/internal.h | 14 ++++++++++++++ include/linux/proc_fs.h | 7 +++++-- 4 files changed, 31 insertions(+), 6 deletions(-)
fs/proc/generic.c +9 -1
@@ -563,10 +563,16 @@ struct proc_dir_entry *proc_create_reg(creturn p; } -static inline void pde_set_flags (struct proc_dir_entry *pde) +static void pde_set_flags (struct proc_dir_entry *pde) {if (pde->proc_ops->proc_flags &PROC_ENTRY_PERMANENT ) pde->flags |=PROC_ENTRY_PERMANENT ; +if (pde->proc_ops->proc_read_iter) + pde->flags |= PROC_ENTRY_proc_read_iter; +#ifdef CONFIG_COMPAT +if (pde->proc_ops->proc_compat_ioctl) + pde->flags |= PROC_ENTRY_proc_compat_ioctl; +#endif } struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
@@ -630,6 +636,7 @@ struct proc_dir_entry *proc_create_seq_p p->proc_ops = &proc_seq_ops; p->seq_ops = ops; p->state_size = state_size; +pde_set_flags (p);return proc_register (parent, p); }EXPORT_SYMBOL (proc_create_seq_private);
@@ -660,6 +667,7 @@ struct proc_dir_entry *proc_create_singlreturn NULL ; p->proc_ops = &proc_single_ops; p->single_show = show; +pde_set_flags (p);return proc_register (parent, p); }EXPORT_SYMBOL (proc_create_single_data);
fs/proc/inode.c +3 -3
@@ -684,13 +684,13 @@ struct inode *proc_get_inode(struct supeif (S_ISREG (inode->i_mode)) { inode->i_op = de->proc_iops; -if (de->proc_ops->proc_read_iter) +if (pde_has_proc_read_iter (de)) inode->i_fop = &proc_iter_file_ops;else inode->i_fop = &proc_reg_file_ops;#ifdef CONFIG_COMPAT -if (de->proc_ops->proc_compat_ioctl) { -if (de->proc_ops->proc_read_iter) +if (pde_has_proc_compat_ioctl (de)) { +if (pde_has_proc_read_iter (de)) inode->i_fop = &proc_iter_file_ops_compat;else inode->i_fop = &proc_reg_file_ops_compat;
fs/proc/internal.h +14 -0
@@ -79,6 +79,20 @@ static inline bool pde_is_permanent(consreturn pde->flags &PROC_ENTRY_PERMANENT ; } +static inline bool pde_has_proc_read_iter (const struct proc_dir_entry *pde) +{ +return pde->flags & PROC_ENTRY_proc_read_iter; +} + +static inline bool pde_has_proc_compat_ioctl (const struct proc_dir_entry *pde) +{ +#ifdef CONFIG_COMPAT +return pde->flags & PROC_ENTRY_proc_compat_ioctl; +#else +return false; +#endif +} +extern struct kmem_cache *proc_dir_entry_cache;void pde_free (struct proc_dir_entry *pde);
include/linux/proc_fs.h +5 -2
@@ -20,10 +20,13 @@ enum {* If in doubt, ignore this flag. */ #ifdef MODULE - PROC_ENTRY_PERMANENT = 0U, + PROC_ENTRY_PERMANENT = 0U, #else - PROC_ENTRY_PERMANENT = 1U << 0, + PROC_ENTRY_PERMANENT = 1U << 0, #endif + + PROC_ENTRY_proc_read_iter = 1U << 1, + PROC_ENTRY_proc_compat_ioctl = 1U << 2, }; struct proc_ops {
Greg Kroah-Hartman
maintainerPATCH 86/227 ARM: shmobile: smp: Enforce shmobile_smp_* alignment
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit 379c590113ce46f605439d4887996c60ab8820cc upstream.
When the addresses of the shmobile_smp_mpidr, shmobile_smp_fn, and shmobile_smp_arg variables are not multiples of 4 bytes, secondary CPU bring-up fails:
smp: Bringing up secondary CPUs ...
CPU1: failed to come online
CPU2: failed to come online
CPU3: failed to come online
smp: Brought up 1 node, 1 CPU
Fix this by adding the missing alignment directive.
--- arch/arm/mach-shmobile/headsmp.S | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-shmobile/headsmp.S +1 -0
@@ -136,6 +136,7 @@ ENDPROC(shmobile_smp_sleep) .long shmobile_smp_arg - 1b .bss + .align 2 .globl shmobile_smp_mpidr shmobile_smp_mpidr: .space NR_CPUS * 4
Greg Kroah-Hartman
maintainerPATCH 87/227 drm/amdgpu: Fix even more out of bound writes from debugfs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrik Jakobsson <[email protected]>
commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 upstream.
CVE-2021-42327 was fixed by:
commit f23750b5b3d98653b31d4469592935ef6364ad67
Author: Thelford Williams <[email protected]> Date: Wed Oct 13 16:04:13 2021 -0400
drm/amdgpu: fix out of bounds write
but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones.
v2:
* Add missing fix in dp_max_bpc_write (Harry Wentland)
[ Cherry-pick the fix and drop the following functions which were introduced
since 5.13 or later: dp_max_bpc_write() was introduced in commit cca912e0a6b4 ("drm/amd/display: Add max bpc debugfs") dp_dsc_passthrough_set() was introduced in commit fcd1e484c8ae ("drm/amd/display: Add debugfs entry for dsc passthrough"). ]
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +7 -7
@@ -424,7 +424,7 @@ static ssize_t dp_phy_settings_write(strif (!wr_buf)return -ENOSPC ; -if (parse_write_buffer_into_params (wr_buf, size, +if (parse_write_buffer_into_params (wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) {
@@ -576,7 +576,7 @@ static ssize_t dp_phy_test_pattern_debugif (!wr_buf)return -ENOSPC ; -if (parse_write_buffer_into_params (wr_buf, size, +if (parse_write_buffer_into_params (wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) {
@@ -1091,7 +1091,7 @@ static ssize_t dp_trigger_hotplug(structreturn -ENOSPC ; } -if (parse_write_buffer_into_params (wr_buf, size, +if (parse_write_buffer_into_params (wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) {
@@ -1272,7 +1272,7 @@ static ssize_t dp_dsc_clock_en_write(strreturn -ENOSPC ; } -if (parse_write_buffer_into_params (wr_buf, size, +if (parse_write_buffer_into_params (wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) {
@@ -1426,7 +1426,7 @@ static ssize_t dp_dsc_slice_width_write(return -ENOSPC ; } -if (parse_write_buffer_into_params (wr_buf, size, +if (parse_write_buffer_into_params (wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) {
@@ -1580,7 +1580,7 @@ static ssize_t dp_dsc_slice_height_writereturn -ENOSPC ; } -if (parse_write_buffer_into_params (wr_buf, size, +if (parse_write_buffer_into_params (wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) {
@@ -1727,7 +1727,7 @@ static ssize_t dp_dsc_bits_per_pixel_wrireturn -ENOSPC ; } -if (parse_write_buffer_into_params (wr_buf, size, +if (parse_write_buffer_into_params (wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) {
Greg Kroah-Hartman
maintainerPATCH 88/227 Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
commit b25e11f978b63cb7857890edb3a698599cddb10e upstream.
This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4 ("Bluetooth: Always request for user confirmation for Just Works") always request user confirmation with confirm_hint set since the likes of bluetoothd have dedicated policy around JUST_WORKS method (e.g. main.conf:JustWorksRepairing).
CVE: CVE-2024-8805
--- net/bluetooth/hci_event.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
net/bluetooth/hci_event.c +5 -8
@@ -4751,19 +4751,16 @@ static void hci_user_confirm_request_evt goto unlock; } -/* If no side requires MITM protection; auto-accept */ +/* If no side requires MITM protection; use JUST_CFM method */ if ((!loc_mitm || conn->remote_cap ==HCI_IO_NO_INPUT_OUTPUT ) && (!rem_mitm || conn->io_capability ==HCI_IO_NO_INPUT_OUTPUT )) { -/* If we're not the initiators request authorization to -* proceed from user space (mgmt_user_confirm with -* confirm_hint set to 1). The exception is if neither -* side had MITM or if the local IO capability is -* NoInputNoOutput, in which case we do auto-accept +/* If we're not the initiator of request authorization and the +* local IO capability is not NoInputNoOutput, use JUST_WORKS +* method (mgmt_user_confirm with confirm_hint set to 1). */ if (!test_bit (HCI_CONN_AUTH_PEND , &conn->flags) && - conn->io_capability !=HCI_IO_NO_INPUT_OUTPUT && - (loc_mitm || rem_mitm)) { + conn->io_capability !=HCI_IO_NO_INPUT_OUTPUT ) {BT_DBG ("Confirming auto-accept as acceptor" ); confirm_hint =1 ; goto confirm;
Greg Kroah-Hartman
maintainerPATCH 89/227 bpf, sockmap: Fix race between element replace and close()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
commit ed1fc5d76b81a4d681211333c026202cad4d5649 upstream.
Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_delete() unconditionally unrefs the (wrong) element:
// set map[0] = s0map_update_elem(map, 0, s0)
// drop fd of s0
close(s0)
sock_map_close()
lock_sock(sk) (s0!)
sock_map_remove_links(sk)
link = sk_psock_link_pop()
sock_map_unlink(sk, link)
sock_map_delete_from_link
// replace map[0] with s1
map_update_elem(map, 0, s1)
sock_map_update_elem
(s1!) lock_sock(sk)
sock_map_update_common
psock = sk_psock(sk)
spin_lock(&stab->lock)
osk = stab->sks[idx]
sock_map_add_link(..., &stab->sks[idx])
sock_map_unref(osk, &stab->sks[idx])
psock = sk_psock(osk)
sk_psock_put(sk, psock)
if (refcount_dec_and_test(&psock))
sk_psock_drop(sk, psock)
spin_unlock(&stab->lock)
unlock_sock(sk)
__sock_map_delete
spin_lock(&stab->lock)
sk = *psk // s1 replaced s0; sk == s1
if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch
sk = xchg(psk, NULL)
if (sk)
sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle
psock = sk_psock(sk)
sk_psock_put(sk, psock)
if (refcount_dec_and_test())
sk_psock_drop(sk, psock)
spin_unlock(&stab->lock)
release_sock(sk)Then close(map) enqueues bpf_map_free_deferred, which finally calls sock_map_free(). This results in some refcount_t warnings along with a KASAN splat [1].
Fix __sock_map_delete(), do not allow sock_map_unref() on elements that may have been replaced.
[1]:
BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330 Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred Call Trace: <TASK> dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 kasan_check_range+0x10f/0x1e0 sock_map_free+0x10e/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1202: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff88811f5b9080 which belongs to the cache UNIX-STREAM of size 1984
The buggy address is located 128 bytes inside of
freed 1984-byte region [ffff88811f5b9080, ffff88811f5b9840)
The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f5b8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff888127d49401
flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)page_type: f5(slab)
raw: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401
head: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000
head: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401
head: 0017ffffc0000003 ffffea00047d6e01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88811f5b9000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88811f5b9080: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88811f5b9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811f5b9200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fbDisabling lock debugging due to kernel taint
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 14 PID: 1063 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B 6.12.0+ #125 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xce/0x150 Code: 34 73 eb 03 01 e8 82 53 ad fe 0f 0b eb b1 80 3d 27 73 eb 03 00 75 a8 48 c7 c7 80 bd 95 84 c6 05 17 73 eb 03 01 e8 62 53 ad fe <0f> 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xce/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xce/0x150 sock_map_free+0x2e5/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210
refcount_t: underflow; use-after-free.
WARNING: CPU: 14 PID: 1063 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B W 6.12.0+ #125 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xee/0x150 Code: 17 73 eb 03 01 e8 62 53 ad fe 0f 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 f6 72 eb 03 01 e8 42 53 ad fe <0f> 0b e9 6e ff ff ff 80 3d e6 72 eb 03 00 0f 85 61 ff ff ff 48 c7 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xee/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xee/0x150 sock_map_free+0x2d3/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210
--- net/core/sock_map.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/core/sock_map.c +2 -3
@@ -420,15 +420,14 @@ static void *sock_map_lookup_sys(structstatic int __sock_map_delete (struct bpf_stab *stab,struct sock *sk_test,struct sock **psk) { -struct sock *sk; +struct sock *sk =NULL ;int err =0 ;if (irqs_disabled ())return -EOPNOTSUPP ;/* locks here are hardirq-unsafe */ raw_spin_lock_bh (&stab->lock); - sk = *psk; -if (!sk_test || sk_test == sk) +if (!sk_test || sk_test == *psk) sk =xchg (psk,NULL );if (likely (sk))
Greg Kroah-Hartman
maintainerPATCH 90/227 batman-adv: Ignore own maximum aggregation size during RX
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 548b0c5de7619ef53bbde5590700693f2f6d2a56 upstream.
An OGMv1 and OGMv2 packet receive processing were not only limited by the number of bytes in the received packet but also by the nodes maximum aggregation packet size limit. But this limit is relevant for TX and not for RX. It must not be enforced by batadv_(i)v_ogm_aggr_packet to avoid loss of information in case of a different limit for sender and receiver.
This has a minor side effect for B.A.T.M.A.N. IV because the batadv_iv_ogm_aggr_packet is also used for the preprocessing for the TX. But since the aggregation code itself will not allow more than BATADV_MAX_AGGREGATION_BYTES bytes, this check was never triggering (in this context) prior of removing it.
--- net/batman-adv/bat_iv_ogm.c | 3 +-- net/batman-adv/bat_v_ogm.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
net/batman-adv/bat_iv_ogm.c +1 -2
@@ -326,8 +326,7 @@ batadv_iv_ogm_aggr_packet(int buff_pos,/* check if there is enough space for the optional TVLV */ next_buff_pos +=ntohs (ogm_packet->tvlv_len); -return (next_buff_pos <= packet_len) && - (next_buff_pos <=BATADV_MAX_AGGREGATION_BYTES ); +return next_buff_pos <= packet_len; }/* send a batman ogm to a given interface */
net/batman-adv/bat_v_ogm.c +1 -2
@@ -850,8 +850,7 @@ batadv_v_ogm_aggr_packet(int buff_pos, i/* check if there is enough space for the optional TVLV */ next_buff_pos +=ntohs (ogm2_packet->tvlv_len); -return (next_buff_pos <= packet_len) && - (next_buff_pos <=BATADV_MAX_AGGREGATION_BYTES ); +return next_buff_pos <= packet_len; }/**
Greg Kroah-Hartman
maintainerPATCH 91/227 soc: qcom: pdr: Fix the potential deadlock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saranya R <[email protected]>
commit 2eeb03ad9f42dfece63051be2400af487ddb96d2 upstream.
When some client process A call pdr_add_lookup() to add the look up for the service and does schedule locator work, later a process B got a new server packet indicating locator is up and call pdr_locator_new_server() which eventually sets pdr->locator_init_complete to true which process A sees and takes list lock and queries domain list but it will timeout due to deadlock as the response will queued to the same qmi->wq and it is ordered workqueue and process B is not able to complete new server request work due to deadlock on list lock.
Fix it by removing the unnecessary list iteration as the list iteration is already being done inside locator work, so avoid it here and just call schedule_work() here.
Process A Process B
process_scheduled_works()pdr_add_lookup() qmi_data_ready_work()
process_scheduled_works() pdr_locator_new_server()
pdr->locator_init_complete=true;
pdr_locator_work()
mutex_lock(&pdr->list_lock);
pdr_locate_service() mutex_lock(&pdr->list_lock);
pdr_get_domain_list()
pr_err("PDR: %s get domain list
txn wait failed: %d\n",
req->service_name,
ret);Timeout error log due to deadlock:
"
PDR: tms/servreg get domain list txn wait failed: -110
PDR: service lookup for msm/adsp/sensor_pd:tms/servreg failed: -110
"
Thanks to Bjorn and Johan for letting me know that this commit also fixes an audio regression when using the in-kernel pd-mapper as that makes it easier to hit this race. [1]
--- drivers/soc/qcom/pdr_interface.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/soc/qcom/pdr_interface.c +1 -7
@@ -74,7 +74,6 @@ static int pdr_locator_new_server(struct { struct pdr_handle *pdr = container_of(qmi, struct pdr_handle, locator_hdl); -struct pdr_service *pds;mutex_lock (&pdr->lock);/* Create a local client port for QMI communication */
@@ -86,12 +85,7 @@ static int pdr_locator_new_server(structmutex_unlock (&pdr->lock);/* Service pending lookup requests */ -mutex_lock (&pdr->list_lock); -list_for_each_entry (pds, &pdr->lookups, node) { -if (pds->need_locator_lookup) -schedule_work (&pdr->locator_work); - } -mutex_unlock (&pdr->list_lock); +schedule_work (&pdr->locator_work);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 92/227 drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit dd8689b52a24807c2d5ce0a17cb26dc87f75235c upstream.
On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value.
Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/gpu/drm/radeon/radeon_vce.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_vce.c +1 -1
@@ -558,7 +558,7 @@ int radeon_vce_cs_parse(struct radeon_cs {int session_idx =-1 ;bool destroyed = false, created = false, allocated = false; -uint32_t tmp, handle =0 ; +uint32_t tmp =0 , handle =0 ;uint32_t *size = &tmp;int i, r =0 ;
Greg Kroah-Hartman
maintainerPATCH 93/227 ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Junge <[email protected]>
commit 486f6205c233da1baa309bde5f634eb1f8319a33 upstream.
Many Poly/Plantronics headset families name the feature, input, and/or output units in a such a way to produce control names that are not recognized by user space. As such, the volume and mute events do not get routed to the headset's audio controls.
As an example from a product family:
The microphone mute control is named
Headset Microphone Capture Switch
and the headset volume control is named
Headset Earphone Playback Volume
The quirk fixes these to become
Headset Capture Switch
Headset Playback Volume
--- sound/usb/mixer_quirks.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+)
sound/usb/mixer_quirks.c +51 -0
@@ -3296,6 +3296,52 @@ static void snd_dragonfly_quirk_db_scale } } +/* +* Some Plantronics headsets have control names that don't meet ALSA naming +* standards. This function fixes nonstandard source names. By the time +* this function is called the control name should look like one of these: +* "source names Playback Volume" +* "source names Playback Switch" +* "source names Capture Volume" +* "source names Capture Switch" +* If any of the trigger words are found in the name then the name will +* be changed to: +* "Headset Playback Volume" +* "Headset Playback Switch" +* "Headset Capture Volume" +* "Headset Capture Switch" +* depending on the current suffix. +*/ +static void snd_fix_plt_name (struct snd_usb_audio *chip, +struct snd_ctl_elem_id *id) +{ +/* no variant of "Sidetone" should be added to this list */ +static const char *const trigger[] = { +"Earphone" ,"Microphone" ,"Receive" ,"Transmit" + }; +static const char *const suffix[] = { +" Playback Volume" ," Playback Switch" , +" Capture Volume" ," Capture Switch" + }; +int i; + +for (i =0 ; i <ARRAY_SIZE (trigger); i++) +if (strstr (id->name, trigger[i])) + goto triggered; +usb_audio_dbg (chip,"no change in %s\n" , id->name); +return ; + +triggered: +for (i =0 ; i <ARRAY_SIZE (suffix); i++) +if (strstr (id->name, suffix[i])) { +usb_audio_dbg (chip,"fixing kctl name %s\n" , id->name); +snprintf (id->name,sizeof (id->name),"Headset%s" , + suffix[i]); +return ; + } +usb_audio_dbg (chip,"something wrong in kctl name %s\n" , id->name); +} +void snd_usb_mixer_fu_apply_quirk (struct usb_mixer_interface *mixer,struct usb_mixer_elem_info *cval,int unitid,struct snd_kcontrol *kctl)
@@ -3313,5 +3359,10 @@ void snd_usb_mixer_fu_apply_quirk(struct cval->min_mute =1 ;break ; } + +/* ALSA-ify some Plantronics headset control names */ +if (USB_ID_VENDOR (mixer->chip->usb_id) ==0x047f && + (cval->control ==UAC_FU_MUTE || cval->control ==UAC_FU_VOLUME )) +snd_fix_plt_name (mixer->chip, &kctl->id); }
Greg Kroah-Hartman
maintainerPATCH 94/227 HID: hid-plantronics: Add mic mute mapping and generalize quirks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Junge <[email protected]>
commit 9821709af892be9fbf4ee9a50b2f3e0604295ce0 upstream.
Add mapping for headset mute key events.
Remove PLT_QUIRK_DOUBLE_VOLUME_KEYS quirk and made it generic. The quirk logic did not keep track of the actual previous key so any key event occurring in less than or equal to 5ms was ignored.
Remove PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS quirk.
It had the same logic issue as the double key quirk and was actually masking the as designed behavior of most of the headsets. It's occurrence should be minimized with the ALSA control naming quirk that is part of the patch set.
--- drivers/hid/hid-plantronics.c | 148 +++++++++++++++++++----------------------- 1 file changed, 69 insertions(+), 79 deletions(-)
drivers/hid/hid-plantronics.c +69 -79
@@ -6,9 +6,6 @@* Copyright (c) 2015-2018 Terry Junge <[email protected]> */ -/* -*/ -#include "hid-ids.h" #include <linux/hid.h>
@@ -23,30 +20,28 @@#define PLT_VOL_UP 0x00b1#define PLT_VOL_DOWN 0x00b2 +#define PLT_MIC_MUTE 0x00b5#define PLT1_VOL_UP (PLT_HID_1_0_PAGE | PLT_VOL_UP)#define PLT1_VOL_DOWN (PLT_HID_1_0_PAGE | PLT_VOL_DOWN) +#define PLT1_MIC_MUTE (PLT_HID_1_0_PAGE | PLT_MIC_MUTE)#define PLT2_VOL_UP (PLT_HID_2_0_PAGE | PLT_VOL_UP)#define PLT2_VOL_DOWN (PLT_HID_2_0_PAGE | PLT_VOL_DOWN) +#define PLT2_MIC_MUTE (PLT_HID_2_0_PAGE | PLT_MIC_MUTE) +#define HID_TELEPHONY_MUTE (HID_UP_TELEPHONY | 0x2f) +#define HID_CONSUMER_MUTE (HID_UP_CONSUMER | 0xe2)#define PLT_DA60 0xda60#define PLT_BT300_MIN 0x0413#define PLT_BT300_MAX 0x0418 - -#define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \ - (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER) - -#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0) -#define PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS BIT(1) -#define PLT_DOUBLE_KEY_TIMEOUT 5/* ms */ -#define PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT 220/* ms */ struct plt_drv_data {unsigned long device_type; -unsigned long last_volume_key_ts; -u32 quirks; +unsigned long last_key_ts; +unsigned long double_key_to; +__u16 last_key; }; static int plantronics_input_mapping(struct hid_device *hdev,
@@ -58,34 +53,43 @@ static int plantronics_input_mapping(strunsigned short mapped_key;struct plt_drv_data *drv_data =hid_get_drvdata (hdev);unsigned long plt_type = drv_data->device_type; +int allow_mute = usage->hid ==HID_TELEPHONY_MUTE ; +int allow_consumer = field->application ==HID_CP_CONSUMERCONTROL && + (usage->hid &HID_USAGE_PAGE ) ==HID_UP_CONSUMER && + usage->hid !=HID_CONSUMER_MUTE ;/* special case for PTT products */ if (field->application ==HID_GD_JOYSTICK ) goto defaulted; -/* handle volume up/down mapping */ /* non-standard types or multi-HID interfaces - plt_type is PID */ if (!(plt_type &HID_USAGE_PAGE )) {switch (plt_type) {case PLT_DA60 : -if (PLT_ALLOW_CONSUMER ) +if (allow_consumer) goto defaulted; - goto ignored; +if (usage->hid ==HID_CONSUMER_MUTE ) { + mapped_key =KEY_MICMUTE ; + goto mapped; + } +break ;default : -if (PLT_ALLOW_CONSUMER ) +if (allow_consumer || allow_mute) goto defaulted; } + goto ignored; } -/* handle standard types - plt_type is 0xffa0uuuu or 0xffa2uuuu */ -/* 'basic telephony compliant' - allow default consumer page map */ -else if ((plt_type &HID_USAGE ) >=PLT_BASIC_TELEPHONY && - (plt_type &HID_USAGE ) !=PLT_BASIC_EXCEPTION ) { -if (PLT_ALLOW_CONSUMER ) - goto defaulted; - } -/* not 'basic telephony' - apply legacy mapping */ -/* only map if the field is in the device's primary vendor page */ -else if (!((field->application ^ plt_type) &HID_USAGE_PAGE )) { + +/* handle standard consumer control mapping */ +/* and standard telephony mic mute mapping */ +if (allow_consumer || allow_mute) + goto defaulted; + +/* handle vendor unique types - plt_type is 0xffa0uuuu or 0xffa2uuuu */ +/* if not 'basic telephony compliant' - map vendor unique controls */ +if (!((plt_type &HID_USAGE ) >=PLT_BASIC_TELEPHONY && + (plt_type &HID_USAGE ) !=PLT_BASIC_EXCEPTION ) && + !((field->application ^ plt_type) &HID_USAGE_PAGE ))switch (usage->hid) {case PLT1_VOL_UP :case PLT2_VOL_UP :
@@ -95,8 +99,11 @@ static int plantronics_input_mapping(strcase PLT2_VOL_DOWN : mapped_key =KEY_VOLUMEDOWN ; goto mapped; +case PLT1_MIC_MUTE : +case PLT2_MIC_MUTE : + mapped_key =KEY_MICMUTE ; + goto mapped; } - }/* * Future mapping of call control or other usages,
@@ -105,6 +112,8 @@ static int plantronics_input_mapping(str*/ ignored: +hid_dbg (hdev,"usage: %08x (appl: %08x) - ignored\n" , + usage->hid, field->application);return -1 ; defaulted:
@@ -123,38 +132,26 @@ static int plantronics_event(struct hid_ struct hid_usage *usage, __s32 value) {struct plt_drv_data *drv_data =hid_get_drvdata (hdev); +unsigned long prev_tsto, cur_ts; +__u16 prev_key, cur_key; -if (drv_data->quirks &PLT_QUIRK_DOUBLE_VOLUME_KEYS ) { -unsigned long prev_ts, cur_ts; - -/* Usages are filtered in plantronics_usages. */ - -if (!value)/* Handle key presses only. */ -return 0 ; - - prev_ts = drv_data->last_volume_key_ts; - cur_ts = jiffies; -if (jiffies_to_msecs (cur_ts - prev_ts) <=PLT_DOUBLE_KEY_TIMEOUT ) -return 1 ;/* Ignore the repeated key. */ - - drv_data->last_volume_key_ts = cur_ts; - } -if (drv_data->quirks &PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS ) { -unsigned long prev_ts, cur_ts; - -/* Usages are filtered in plantronics_usages. */ - -if (!value)/* Handle key presses only. */ -return 0 ; +/* Usages are filtered in plantronics_usages. */ - prev_ts = drv_data->last_volume_key_ts; - cur_ts = jiffies; -if (jiffies_to_msecs (cur_ts - prev_ts) <=PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT ) -return 1 ;/* Ignore the followed opposite volume key. */ - - drv_data->last_volume_key_ts = cur_ts; +/* HZ too low for ms resolution - double key detection disabled */ +/* or it is a key release - handle key presses only. */ +if (!drv_data->double_key_to || !value) +return 0 ; + + prev_tsto = drv_data->last_key_ts + drv_data->double_key_to; + cur_ts = drv_data->last_key_ts = jiffies; + prev_key = drv_data->last_key; + cur_key = drv_data->last_key = usage->code; + +/* If the same key occurs in <= double_key_to -- ignore it */ +if (prev_key == cur_key &&time_before_eq (cur_ts, prev_tsto)) { +hid_dbg (hdev,"double key %d ignored\n" , cur_key); +return 1 ;/* Ignore the repeated key. */ } -return 0 ; }
@@ -196,12 +193,16 @@ static int plantronics_probe(struct hid_ ret =hid_parse (hdev);if (ret) {hid_err (hdev,"parse failed\n" ); - goto err; +return ret; } drv_data->device_type =plantronics_device_type (hdev); - drv_data->quirks = id->driver_data; - drv_data->last_volume_key_ts = jiffies -msecs_to_jiffies (PLT_DOUBLE_KEY_TIMEOUT ); + drv_data->double_key_to =msecs_to_jiffies (PLT_DOUBLE_KEY_TIMEOUT ); + drv_data->last_key_ts = jiffies - drv_data->double_key_to; + +/* if HZ does not allow ms resolution - disable double key detection */ +if (drv_data->double_key_to <PLT_DOUBLE_KEY_TIMEOUT ) + drv_data->double_key_to =0 ;hid_set_drvdata (hdev, drv_data);
@@ -210,29 +211,10 @@ static int plantronics_probe(struct hid_if (ret)hid_err (hdev,"hw start failed\n" ); -err:return ret; }static const struct hid_device_id plantronics_devices[] = { - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3210_SERIES ), - .driver_data =PLT_QUIRK_DOUBLE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES ), - .driver_data =PLT_QUIRK_DOUBLE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES ), - .driver_data =PLT_QUIRK_DOUBLE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES ), - .driver_data =PLT_QUIRK_DOUBLE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3325_SERIES ), - .driver_data =PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_ENCOREPRO_500_SERIES ), - .driver_data =PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS }, {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS ,HID_ANY_ID ) }, { } };
@@ -241,6 +223,14 @@ MODULE_DEVICE_TABLE(hid, plantronics_devstatic const struct hid_usage_id plantronics_usages[] = { {HID_CP_VOLUMEUP ,EV_KEY ,HID_ANY_ID }, {HID_CP_VOLUMEDOWN ,EV_KEY ,HID_ANY_ID }, + {HID_TELEPHONY_MUTE ,EV_KEY ,HID_ANY_ID }, + {HID_CONSUMER_MUTE ,EV_KEY ,HID_ANY_ID }, + {PLT2_VOL_UP ,EV_KEY ,HID_ANY_ID }, + {PLT2_VOL_DOWN ,EV_KEY ,HID_ANY_ID }, + {PLT2_MIC_MUTE ,EV_KEY ,HID_ANY_ID }, + {PLT1_VOL_UP ,EV_KEY ,HID_ANY_ID }, + {PLT1_VOL_DOWN ,EV_KEY ,HID_ANY_ID }, + {PLT1_MIC_MUTE ,EV_KEY ,HID_ANY_ID }, {HID_TERMINATOR ,HID_TERMINATOR ,HID_TERMINATOR } };
Greg Kroah-Hartman
maintainerPATCH 95/227 atm: Fix NULL pointer dereference
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjoong Kim <[email protected]>
commit bf2986fcf82a449441f9ee4335df19be19e83970 upstream.
When MPOA_cache_impos_rcvd() receives the msg, it can trigger Null Pointer Dereference Vulnerability if both entry and holding_time are NULL. Because there is only for the situation where entry is NULL and holding_time exists, it can be passed when both entry and holding_time are NULL. If these are NULL, the entry will be passd to eg_cache_put() as parameter and it is referenced by entry->use code in it.
kasan log:
[ 3.316691] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006:I [ 3.317568] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 3.318188] CPU: 3 UID: 0 PID: 79 Comm: ex Not tainted 6.14.0-rc2 #102 [ 3.318601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 3.319298] RIP: 0010:eg_cache_remove_entry+0xa5/0x470 [ 3.319677] Code: c1 f7 6e fd 48 c7 c7 00 7e 38 b2 e8 95 64 54 fd 48 c7 c7 40 7e 38 b2 48 89 ee e80 [ 3.321220] RSP: 0018:ffff88800583f8a8 EFLAGS: 00010006 [ 3.321596] RAX: 0000000000000006 RBX: ffff888005989000 RCX: ffffffffaecc2d8e [ 3.322112] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000030 [ 3.322643] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6558b88 [ 3.323181] R10: 0000000000000003 R11: 203a207972746e65 R12: 1ffff11000b07f15 [ 3.323707] R13: dffffc0000000000 R14: ffff888005989000 R15: ffff888005989068 [ 3.324185] FS: 000000001b6313c0(0000) GS:ffff88806d380000(0000) knlGS:0000000000000000 [ 3.325042] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.325545] CR2: 00000000004b4b40 CR3: 000000000248e000 CR4: 00000000000006f0 [ 3.326430] Call Trace: [ 3.326725] <TASK> [ 3.326927] ? die_addr+0x3c/0xa0 [ 3.327330] ? exc_general_protection+0x161/0x2a0 [ 3.327662] ? asm_exc_general_protection+0x26/0x30 [ 3.328214] ? vprintk_emit+0x15e/0x420 [ 3.328543] ? eg_cache_remove_entry+0xa5/0x470 [ 3.328910] ? eg_cache_remove_entry+0x9a/0x470 [ 3.329294] ? __pfx_eg_cache_remove_entry+0x10/0x10 [ 3.329664] ? console_unlock+0x107/0x1d0 [ 3.329946] ? __pfx_console_unlock+0x10/0x10 [ 3.330283] ? do_syscall_64+0xa6/0x1a0 [ 3.330584] ? entry_SYSCALL_64_after_hwframe+0x47/0x7f [ 3.331090] ? __pfx_prb_read_valid+0x10/0x10 [ 3.331395] ? down_trylock+0x52/0x80 [ 3.331703] ? vprintk_emit+0x15e/0x420 [ 3.331986] ? __pfx_vprintk_emit+0x10/0x10 [ 3.332279] ? down_trylock+0x52/0x80 [ 3.332527] ? _printk+0xbf/0x100 [ 3.332762] ? __pfx__printk+0x10/0x10 [ 3.333007] ? _raw_write_lock_irq+0x81/0xe0 [ 3.333284] ? __pfx__raw_write_lock_irq+0x10/0x10 [ 3.333614] msg_from_mpoad+0x1185/0x2750 [ 3.333893] ? __build_skb_around+0x27b/0x3a0 [ 3.334183] ? __pfx_msg_from_mpoad+0x10/0x10 [ 3.334501] ? __alloc_skb+0x1c0/0x310 [ 3.334809] ? __pfx___alloc_skb+0x10/0x10 [ 3.335283] ? _raw_spin_lock+0xe0/0xe0 [ 3.335632] ? finish_wait+0x8d/0x1e0 [ 3.335975] vcc_sendmsg+0x684/0xba0 [ 3.336250] ? __pfx_vcc_sendmsg+0x10/0x10 [ 3.336587] ? __pfx_autoremove_wake_function+0x10/0x10 [ 3.337056] ? fdget+0x176/0x3e0 [ 3.337348] __sys_sendto+0x4a2/0x510 [ 3.337663] ? __pfx___sys_sendto+0x10/0x10 [ 3.337969] ? ioctl_has_perm.constprop.0.isra.0+0x284/0x400 [ 3.338364] ? sock_ioctl+0x1bb/0x5a0 [ 3.338653] ? __rseq_handle_notify_resume+0x825/0xd20 [ 3.339017] ? __pfx_sock_ioctl+0x10/0x10 [ 3.339316] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 3.339727] ? selinux_file_ioctl+0xa4/0x260 [ 3.340166] __x64_sys_sendto+0xe0/0x1c0 [ 3.340526] ? syscall_exit_to_user_mode+0x123/0x140 [ 3.340898] do_syscall_64+0xa6/0x1a0 [ 3.341170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3.341533] RIP: 0033:0x44a380 [ 3.341757] Code: 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c00 [ 3.343078] RSP: 002b:00007ffc1d404098 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 3.343631] RAX: ffffffffffffffda RBX: 00007ffc1d404458 RCX: 000000000044a380 [ 3.344306] RDX: 000000000000019c RSI: 00007ffc1d4040b0 RDI: 0000000000000003 [ 3.344833] RBP: 00007ffc1d404260 R08: 0000000000000000 R09: 0000000000000000 [ 3.345381] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3.346015] R13: 00007ffc1d404448 R14: 00000000004c17d0 R15: 0000000000000001 [ 3.346503] </TASK> [ 3.346679] Modules linked in: [ 3.346956] ---[ end trace 0000000000000000 ]--- [ 3.347315] RIP: 0010:eg_cache_remove_entry+0xa5/0x470 [ 3.347737] Code: c1 f7 6e fd 48 c7 c7 00 7e 38 b2 e8 95 64 54 fd 48 c7 c7 40 7e 38 b2 48 89 ee e80 [ 3.349157] RSP: 0018:ffff88800583f8a8 EFLAGS: 00010006 [ 3.349517] RAX: 0000000000000006 RBX: ffff888005989000 RCX: ffffffffaecc2d8e [ 3.350103] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000030 [ 3.350610] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6558b88 [ 3.351246] R10: 0000000000000003 R11: 203a207972746e65 R12: 1ffff11000b07f15 [ 3.351785] R13: dffffc0000000000 R14: ffff888005989000 R15: ffff888005989068 [ 3.352404] FS: 000000001b6313c0(0000) GS:ffff88806d380000(0000) knlGS:0000000000000000 [ 3.353099] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.353544] CR2: 00000000004b4b40 CR3: 000000000248e000 CR4: 00000000000006f0 [ 3.354072] note: ex[79] exited with irqs disabled [ 3.354458] note: ex[79] exited with preempt_count 1
--- net/atm/mpc.c | 2 ++ 1 file changed, 2 insertions(+)
net/atm/mpc.c +2 -0
@@ -1314,6 +1314,8 @@ static void MPOA_cache_impos_rcvd(struct holding_time = msg->content.eg_info.holding_time;dprintk ("(%s) entry = %p, holding_time = %u\n" , mpc->dev->name, entry, holding_time); +if (entry ==NULL && !holding_time) +return ;if (entry ==NULL && holding_time) { entry = mpc->eg_ops->add_entry (msg, mpc); mpc->eg_ops->put (entry);
Greg Kroah-Hartman
maintainerPATCH 96/227 ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 169f9102f9198b04afffa6164372a4ba4070f412 upstream.
Under PAN emulation when dumping backtraces from things like the LKDTM EXEC_USERSPACE test[1], a double fault (which would hang a CPU) would happen because of dump_instr() attempting to read a userspace address. Make sure copy_from_kernel_nofault() does not attempt this any more.
--- arch/arm/mm/fault.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/arm/mm/fault.c +7 -0
@@ -24,6 +24,13 @@#include "fault.h" +bool copy_from_kernel_nofault_allowed (const void *unsafe_src,size_t size) +{ +unsigned long addr = (unsigned long )unsafe_src; + +return addr >=TASK_SIZE &&ULONG_MAX - addr >= size; +} +#ifdef CONFIG_MMU /*
Greg Kroah-Hartman
maintainerPATCH 97/227 ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 8f09b8b4fa58e99cbfd9a650b31d65cdbd8e4276 upstream.
The common pattern in arm is to emit a "8<--- cut here ---" line for faults, but it was missing for do_PrefetchAbort(). Add it.
--- arch/arm/mm/fault.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mm/fault.c +1 -0
@@ -559,6 +559,7 @@ do_PrefetchAbort(unsigned long addr, unsif (!inf->fn (addr, ifsr |FSR_LNX_PF , regs))return ; +pr_alert ("8<--- cut here ---\n" );pr_alert ("Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n" , inf->name, ifsr, addr);
Greg Kroah-Hartman
maintainerPATCH 98/227 ARM: Remove address checking for MMUless devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanjun Yang <[email protected]>
commit 3ccea4784fddd96fbd6c4497eb28b45dab638c2a upstream.
Commit 169f9102f9198b ("ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()") added the function to check address before use. However, for devices without MMU, addr > TASK_SIZE will always fail. This patch move this function after the #ifdef CONFIG_MMU statement.
--- arch/arm/mm/fault.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mm/fault.c +2 -2
@@ -24,6 +24,8 @@#include "fault.h" +#ifdef CONFIG_MMU +bool copy_from_kernel_nofault_allowed (const void *unsafe_src,size_t size) {unsigned long addr = (unsigned long )unsafe_src;
@@ -31,8 +33,6 @@ bool copy_from_kernel_nofault_allowed(coreturn addr >=TASK_SIZE &&ULONG_MAX - addr >= size; } -#ifdef CONFIG_MMU -/* * This is useful to dump out the page tables associated with * 'addr' in mm 'mm'.
Greg Kroah-Hartman
maintainerPATCH 99/227 netfilter: socket: Lookup orig tuple for IPv6 SNAT
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Mikityanskiy <[email protected]>
commit 932b32ffd7604fb00b5c57e239a3cc4d901ccf6e upstream.
nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any). Then socket_match() can correctly check whether the socket was transparent.
However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this conntrack lookup, making xt_socket fail to match on the socket when the packet was SNATed. Add the same logic to nf_sk_lookup_slow_v6.
IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as pods' addresses are in the fd00::/8 ULA subnet and need to be replaced with the node's external address. Cilium leverages Envoy to enforce L7 policies, and Envoy uses transparent sockets. Cilium inserts an iptables prerouting rule that matches on -m socket --transparent and redirects the packets to localhost, but it fails to match SNATed IPv6 packets due to that missing conntrack lookup.
--- net/ipv6/netfilter/nf_socket_ipv6.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
net/ipv6/netfilter/nf_socket_ipv6.c +23 -0
@@ -103,6 +103,10 @@ struct sock *nf_sk_lookup_slow_v6(structstruct sk_buff *data_skb =NULL ;int doff =0 ;int thoff =0 , tproto; +#if IS_ENABLED (CONFIG_NF_CONNTRACK ) +enum ip_conntrack_info ctinfo; +struct nf_conn const *ct; +#endif tproto =ipv6_find_hdr (skb, &thoff,-1 ,NULL ,NULL );if (tproto <0 ) {
@@ -136,6 +140,25 @@ struct sock *nf_sk_lookup_slow_v6(structreturn NULL ; } +#if IS_ENABLED (CONFIG_NF_CONNTRACK ) +/* Do the lookup with the original socket address in +* case this is a reply packet of an established +* SNAT-ted connection. +*/ + ct =nf_ct_get (skb, &ctinfo); +if (ct && + ((tproto !=IPPROTO_ICMPV6 && + ctinfo ==IP_CT_ESTABLISHED_REPLY ) || + (tproto ==IPPROTO_ICMPV6 && + ctinfo ==IP_CT_RELATED_REPLY )) && + (ct->status &IPS_SRC_NAT_DONE )) { + daddr = &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.u3.in6; + dport = (tproto ==IPPROTO_TCP ) ? + ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.u.tcp.port : + ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.u.udp.port; + } +#endif +return nf_socket_get_sock_v6 (net, data_skb, doff, tproto, saddr, daddr, sport, dport, indev); }
Greg Kroah-Hartman
maintainerPATCH 100/227 ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dhruv Deshpande <[email protected]>
commit 35ef1c79d2e09e9e5a66e28a66fe0df4368b0f3d upstream.
The mute LED on this HP laptop uses ALC236 and requires a quirk to function. This patch enables the existing quirk for the device.
Tested on my laptop and the LED behaviour works as intended.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9239,6 +9239,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8811 ,"HP Spectre x360 15-eb1xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ),SND_PCI_QUIRK (0x103c ,0x8812 ,"HP Spectre x360 15-eb1xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ),SND_PCI_QUIRK (0x103c ,0x881d ,"HP 250 G8 Notebook PC" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ), +SND_PCI_QUIRK (0x103c ,0x881e ,"HP Laptop 15s-du3xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8846 ,"HP EliteBook 850 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8847 ,"HP EliteBook x360 830 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 101/227 counter: stm32-lptimer-cnt: fix error handling when enabling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Gasnier <[email protected]>
commit 8744dcd4fc7800de2eb9369410470bb2930d4c14 upstream.
In case the stm32_lptim_set_enable_state() fails to update CMP and ARR, a timeout error is raised, by regmap_read_poll_timeout. It may happen, when the lptimer runs on a slow clock, and the clock is gated only few times during the polling.
Badly, when this happen, STM32_LPTIM_ENABLE in CR register has been set. So the 'enable' state in sysfs wrongly lies on the counter being correctly enabled, due to CR is read as one in stm32_lptim_is_enabled().
To fix both issues:
- enable the clock before writing CMP, ARR and polling ISR bits. It will avoid the possible timeout error.
- clear the ENABLE bit in CR and disable the clock in the error path.
--- drivers/counter/stm32-lptimer-cnt.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
drivers/counter/stm32-lptimer-cnt.c +15 -9
@@ -58,37 +58,43 @@ static int stm32_lptim_set_enable_state(return 0 ; } + ret =clk_enable (priv->clk); +if (ret) + goto disable_cnt; +/* LP timer must be enabled before writing CMP & ARR */ ret =regmap_write (priv->regmap,STM32_LPTIM_ARR , priv->ceiling);if (ret) -return ret; + goto disable_clk; ret =regmap_write (priv->regmap,STM32_LPTIM_CMP ,0 );if (ret) -return ret; + goto disable_clk;/* ensure CMP & ARR registers are properly written */ ret =regmap_read_poll_timeout (priv->regmap,STM32_LPTIM_ISR , val, (val &STM32_LPTIM_CMPOK_ARROK ) ==STM32_LPTIM_CMPOK_ARROK ,100 ,1000 );if (ret) -return ret; + goto disable_clk; ret =regmap_write (priv->regmap,STM32_LPTIM_ICR ,STM32_LPTIM_CMPOKCF_ARROKCF );if (ret) -return ret; + goto disable_clk; - ret =clk_enable (priv->clk); -if (ret) { -regmap_write (priv->regmap,STM32_LPTIM_CR ,0 ); -return ret; - } priv->enabled = true;/* Start LP timer in continuous mode */ return regmap_update_bits (priv->regmap,STM32_LPTIM_CR ,STM32_LPTIM_CNTSTRT ,STM32_LPTIM_CNTSTRT ); + +disable_clk: +clk_disable (priv->clk); +disable_cnt: +regmap_write (priv->regmap,STM32_LPTIM_CR ,0 ); + +return ret; }static int stm32_lptim_setup (struct stm32_lptim_cnt *priv,int enable)
Greg Kroah-Hartman
maintainerPATCH 102/227 counter: microchip-tcb-capture: Fix undefined counter channel state on probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Breathitt Gray <[email protected]>
commit c0c9c73434666dc99ee156b25e7e722150bee001 upstream.
Hardware initialize of the timer counter channel does not occur on probe thus leaving the Count in an undefined state until the first function_write() callback is executed. Fix this by performing the proper hardware initialization during probe.
--- drivers/counter/microchip-tcb-capture.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/counter/microchip-tcb-capture.c +19 -0
@@ -377,6 +377,25 @@ static int mchp_tc_probe(struct platform channel); } +/* Disable Quadrature Decoder and position measure */ + ret =regmap_update_bits (regmap,ATMEL_TC_BMR ,ATMEL_TC_QDEN |ATMEL_TC_POSEN ,0 ); +if (ret) +return ret; + +/* Setup the period capture mode */ + ret =regmap_update_bits (regmap,ATMEL_TC_REG (priv->channel[0 ],CMR ), +ATMEL_TC_WAVE |ATMEL_TC_ABETRG |ATMEL_TC_CMR_MASK | +ATMEL_TC_TCCLKS , +ATMEL_TC_CMR_MASK ); +if (ret) +return ret; + +/* Enable clock and trigger counter */ + ret =regmap_write (regmap,ATMEL_TC_REG (priv->channel[0 ],CCR ), +ATMEL_TC_CLKEN |ATMEL_TC_SWTRG ); +if (ret) +return ret; + priv->tc_cfg = tcb_config; priv->regmap = regmap; priv->counter.name =dev_name (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 103/227 tty: serial: 8250: Add some more device IDs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <[email protected]>
commit be6a23650908e2f827f2e7839a3fbae41ccb5b63 upstream.
These card IDs got missed the first time around.
--- drivers/tty/serial/8250/8250_pci.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/tty/serial/8250/8250_pci.c +16 -0
@@ -5160,6 +5160,14 @@ static const struct pci_device_id serialPCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_b2_2_115200 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0BA2, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_b2_2_115200 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0BA3, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_b2_2_115200 },/* * Brainboxes UC-235/246 */
@@ -5340,6 +5348,14 @@ static const struct pci_device_id serialPCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_b2_4_115200 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0C42, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_b2_4_115200 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0C43, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_b2_4_115200 },/* * Brainboxes UC-420 */
Greg Kroah-Hartman
maintainerPATCH 104/227 net: usb: qmi_wwan: add Telit Cinterion FN990B composition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 9dba9a45f8ca64a7df32aada14c20a3153af1ac8 upstream.
Add the following Telit Cinterion FN990B composition:
0x10d0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10d0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN990 S: SerialNumber=43b38f19 C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1309,6 +1309,7 @@ static const struct usb_device_id produc {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10d0, 0)}, /* Telit FN990B */ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
Greg Kroah-Hartman
maintainerPATCH 105/227 net: usb: qmi_wwan: add Telit Cinterion FE990B composition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit e8cdd91926aac2c53a23925c538ad4c44be4201f upstream.
Add the following Telit Cinterion FE990B composition:0x10b0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
usb-devices:
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1306,6 +1306,7 @@ static const struct usb_device_id produc {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10b0, 0)}, /* Telit FE990B */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */
Greg Kroah-Hartman
maintainerPATCH 106/227 net: usb: usbnet: restore usb%d name exception for local mac addresses
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
commit 2ea396448f26d0d7d66224cb56500a6789c7ed07 upstream.
commit 8a7d12d674ac ("net: usb: usbnet: fix name regression") assumed that local addresses always came from the kernel, but some devices hand out local mac addresses so we ended up with point-to-point devices with a mac set by the driver, renaming to eth%d when they used to be named usb%d.
Userspace should not rely on device name, but for the sake of stability restore the local mac address check portion of the naming exception:
point to point devices which either have no mac set by the driver or have a local mac handed out by the driver will keep the usb%d name.
(some USB LTE modems are known to hand out a stable mac from the locally administered range; that mac appears to be random (different for mulitple devices) and can be reset with device-specific commands, so while such devices would benefit from getting a OUI reserved, we have to deal with these and might as well preserve the existing behavior to avoid breaking fragile openwrt configurations and such on upgrade.)
--- drivers/net/usb/usbnet.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/net/usb/usbnet.c +15 -6
@@ -164,6 +164,17 @@ int usbnet_get_ethernet_addr(struct usbn }EXPORT_SYMBOL_GPL (usbnet_get_ethernet_addr); +static bool usbnet_needs_usb_name_format (struct usbnet *dev,struct net_device *net) +{ +/* Point to point devices which don't have a real MAC address +* (or report a fake local one) have historically used the usb%d +* naming. Preserve this.. +*/ +return (dev->driver_info->flags &FLAG_POINTTOPOINT ) !=0 && + (is_zero_ether_addr (net->dev_addr) || +is_local_ether_addr (net->dev_addr)); +} +static void intr_complete (struct urb *urb) {struct usbnet *dev = urb->context;
@@ -1712,13 +1723,11 @@ usbnet_probe (struct usb_interface *udevif (status <0 ) goto out1; -// heuristic: "usb%d" for links we know are two-host, -// else "eth%d" when there's reasonable doubt. userspace -// can rename the link if it knows better. +/* heuristic: rename to "eth%d" if we are not sure this link +* is two-host (these links keep "usb%d") +*/ if ((dev->driver_info->flags &FLAG_ETHER ) !=0 && - ((dev->driver_info->flags &FLAG_POINTTOPOINT ) ==0 || -/* somebody touched it*/ - !is_zero_ether_addr (net->dev_addr))) + !usbnet_needs_usb_name_format (dev, net))strscpy (net->name,"eth%d" ,sizeof (net->name));/* WLAN devices should always be named "wlan%d" */ if ((dev->driver_info->flags &FLAG_WLAN ) !=0 )
Greg Kroah-Hartman
maintainerPATCH 107/227 memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Qiu <[email protected]>
commit 4676741a3464b300b486e70585c3c9b692be1632 upstream.
This fixes the following crash:
==================================================================
BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_one_work+0x357/0x660 worker_thread+0x390/0x4c0 ? __pfx_worker_thread+0x10/0x10 kthread+0x190/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 161446: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_noprof+0x1a7/0x470 memstick_alloc_host+0x1f/0xe0 [memstick] rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms] platform_probe+0x60/0xe0 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 bus_probe_device+0xbd/0xd0 device_add+0x4a5/0x760 platform_device_add+0x189/0x370 mfd_add_device+0x587/0x5e0 mfd_add_devices+0xb1/0x130 rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb] usb_probe_interface+0x15c/0x460 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 rebind_marked_interfaces.isra.0+0xcc/0x110 usb_reset_device+0x352/0x410 usbdev_do_ioctl+0xe5c/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 161506: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0x34/0x50 kfree+0x1fd/0x3b0 device_release+0x56/0xf0 kobject_cleanup+0x73/0x1c0 rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms] platform_remove+0x2f/0x50 device_release_driver_internal+0x24b/0x2e0 bus_remove_device+0x124/0x1d0 device_del+0x239/0x530 platform_device_del.part.0+0x19/0xe0 platform_device_unregister+0x1c/0x40 mfd_remove_devices_fn+0x167/0x170 device_for_each_child_reverse+0xc9/0x130 mfd_remove_devices+0x6e/0xa0 rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb] usb_unbind_interface+0xf3/0x3f0 device_release_driver_internal+0x24b/0x2e0 proc_disconnect_claim+0x13d/0x220 usbdev_do_ioctl+0xb5e/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 The buggy address belongs to the object at ffff888136335000 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 896 bytes inside of
freed 2048-byte region [ffff888136335000, ffff888136335800)
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x136330 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 0017ffffc0000003 ffffea0004d8cc01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888136335280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888136335300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888136335380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888136335400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888136335480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- drivers/memstick/host/rtsx_usb_ms.c | 1 + 1 file changed, 1 insertion(+)
drivers/memstick/host/rtsx_usb_ms.c +1 -0
@@ -813,6 +813,7 @@ static int rtsx_usb_ms_drv_remove(struct host->eject = true;cancel_work_sync (&host->handle_req); +cancel_delayed_work_sync (&host->poll_card);mutex_lock (&host->host_mutex);if (host->req) {
Greg Kroah-Hartman
maintainerPATCH 108/227 serial: 8250_dma: terminate correct DMA in tx_dma_flush()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
commit a26503092c75abba70a0be2aa01145ecf90c2a22 upstream.
When flushing transmit side DMA, it is the transmit channel that should be terminated, not the receive channel.
--- drivers/tty/serial/8250/8250_dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_dma.c +1 -1
@@ -148,7 +148,7 @@ void serial8250_tx_dma_flush(struct uart*/ dma->tx_size =0 ; -dmaengine_terminate_async (dma->rxchan); +dmaengine_terminate_async (dma->txchan); }int serial8250_rx_dma (struct uart_8250_port *p)
Greg Kroah-Hartman
maintainerPATCH 109/227 media: i2c: et8ek8: Dont strip remove function when driver is builtin
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit 545b215736c5c4b354e182d99c578a472ac9bfce upstream.
Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally.
This also fixes a W=1 modpost warning:
WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text)
--- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/et8ek8/et8ek8_driver.c +2 -2
@@ -1460,7 +1460,7 @@ err_mutex:return ret; } -static int __exit et8ek8_remove(struct i2c_client *client) +static int et8ek8_remove (struct i2c_client *client) {struct v4l2_subdev *subdev =i2c_get_clientdata (client);struct et8ek8_sensor *sensor =to_et8ek8_sensor (subdev);
@@ -1504,7 +1504,7 @@ static struct i2c_driver et8ek8_i2c_driv .of_match_table = et8ek8_of_table, }, .probe_new = et8ek8_probe, - .remove = __exit_p(et8ek8_remove), + .remove = et8ek8_remove, .id_table = et8ek8_id_table, };
Greg Kroah-Hartman
maintainerPATCH 110/227 i2c: dev: check return value when calling dev_set_name()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 993eb48fa199b5f476df8204e652eff63dd19361 upstream.
If dev_set_name() fails, the dev_name() is null, check the return value of dev_set_name() to avoid the null-ptr-deref.
--- drivers/i2c/i2c-dev.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/i2c/i2c-dev.c +10 -5
@@ -669,17 +669,22 @@ static int i2cdev_attach_adapter(struct i2c_dev->dev.class = i2c_dev_class; i2c_dev->dev.parent = &adap->dev; i2c_dev->dev.release = i2cdev_dev_release; -dev_set_name (&i2c_dev->dev,"i2c-%d" , adap->nr); + + res =dev_set_name (&i2c_dev->dev,"i2c-%d" , adap->nr); +if (res) + goto err_put_i2c_dev; res =cdev_device_add (&i2c_dev->cdev, &i2c_dev->dev); -if (res) { -put_i2c_dev (i2c_dev, false); -return res; - } +if (res) + goto err_put_i2c_dev;pr_debug ("i2c-dev: adapter [%s] registered as minor %d\n" , adap->name, adap->nr);return 0 ; + +err_put_i2c_dev: +put_i2c_dev (i2c_dev, false); +return res; }static int i2cdev_detach_adapter (struct device *dev,void *dummy)
Greg Kroah-Hartman
maintainerPATCH 111/227 watch_queue: fix pipe accounting mismatch
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
[ Upstream commit f13abc1e8e1a3b7455511c4e122750127f6bc9b0 ]
Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.
To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers()
(It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?)
--- kernel/watch_queue.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/watch_queue.c +9 -0
@@ -274,6 +274,15 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)if (ret <0 ) goto error; +/* +* pipe_resize_ring() does not update nr_accounted for watch_queue +* pipes, because the above vastly overprovisions. Set nr_accounted on +* and max_usage this pipe to the number that was actually charged to +* the user above via account_pipe_buffers. +*/ + pipe->max_usage = nr_pages; + pipe->nr_accounted = nr_pages; + ret = -ENOMEM ; pages =kcalloc (sizeof (struct page *), nr_pages,GFP_KERNEL );if (!pages)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/227 x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <[email protected]>
[ Upstream commit 33ea120582a638b2f2e380a50686c2b1d7cce795 ]
The CPA_ARRAY test always uses len[1] as numpages argument to change_page_attr_set() although the addresses array is different each iteration of the test loop.
Replace len[1] with len[i] to have numpages matching the addresses array.
--- arch/x86/mm/pat/cpa-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/mm/pat/cpa-test.c +1 -1
@@ -183,7 +183,7 @@ static int pageattr_test(void)break ;case 1 : - err =change_page_attr_set (addrs, len[1 ],PAGE_CPA_TEST ,1 ); + err =change_page_attr_set (addrs, len[i],PAGE_CPA_TEST ,1 );break ;case 2 :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/227 cpufreq: scpi: compare kHz instead of Hz
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: zuoqian <[email protected]>
[ Upstream commit 4742da9774a416908ef8e3916164192c15c0e2d1 ]
The CPU rate from clk_get_rate() may not be divisible by 1000 (e.g., 133333333). But the rate calculated from frequency(kHz) is always divisible by 1000 (e.g., 133333000).
Comparing the rate causes a warning during CPU scaling:
"cpufreq: __target_index: Failed to change cpu frequency: -5". When we choose to compare kHz here, the issue does not occur.
--- drivers/cpufreq/scpi-cpufreq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/cpufreq/scpi-cpufreq.c +3 -2
@@ -47,8 +47,9 @@ static unsigned int scpi_cpufreq_get_rate(unsigned int cpu)static int scpi_cpufreq_set_target (struct cpufreq_policy *policy,unsigned int index) { -u64 rate = policy->freq_table[index].frequency *1000 ; +unsigned long freq_khz = policy->freq_table[index].frequency;struct scpi_data *priv = policy->driver_data; +unsigned long rate = freq_khz *1000 ;int ret; ret =clk_set_rate (priv->clk, rate);
@@ -56,7 +57,7 @@ scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)if (ret)return ret; -if (clk_get_rate (priv->clk) != rate) +if (clk_get_rate (priv->clk) /1000 != freq_khz)return -EIO ;return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/227 cpufreq: governor: Fix negative idle_time handling in dbs_update()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Zhan <[email protected]>
[ Upstream commit 3698dd6b139dc37b35a9ad83d9330c1f99666c02 ]
We observed an issue that the CPU frequency can't raise up with a 100% CPU load when NOHZ is off and the 'conservative' governor is selected.
'idle_time' can be negative if it's obtained from get_cpu_idle_time_jiffy() when NOHZ is off. This was found and explained in commit 9485e4ca0b48 ("cpufreq: governor: Fix handling of special cases in dbs_update()").
However, commit 7592019634f8 ("cpufreq: governors: Fix long idle detection logic in load calculation") introduced a comparison between 'idle_time' and 'samling_rate' to detect a long idle interval. While 'idle_time' is converted to int before comparison, it's actually promoted to unsigned again when compared with an unsigned 'sampling_rate'. Hence, this leads to wrong idle interval detection when it's in fact 100% busy and sets policy_dbs->idle_periods to a very large value. 'conservative' adjusts the frequency to minimum because of the large 'idle_periods', such that the frequency can't raise up. 'Ondemand' doesn't use policy_dbs->idle_periods so it fortunately avoids the issue.
Correct negative 'idle_time' to 0 before any use of it in dbs_update().
--- drivers/cpufreq/cpufreq_governor.c | 45 +++++++++++++++--------------- 1 file changed, 23 insertions(+), 22 deletions(-)
drivers/cpufreq/cpufreq_governor.c +23 -22
@@ -145,7 +145,23 @@ unsigned int dbs_update(struct cpufreq_policy *policy) time_elapsed = update_time - j_cdbs->prev_update_time; j_cdbs->prev_update_time = update_time; - idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +/* +* cur_idle_time could be smaller than j_cdbs->prev_cpu_idle if +* it's obtained from get_cpu_idle_time_jiffy() when NOHZ is +* off, where idle_time is calculated by the difference between +* time elapsed in jiffies and "busy time" obtained from CPU +* statistics. If a CPU is 100% busy, the time elapsed and busy +* time should grow with the same amount in two consecutive +* samples, but in practice there could be a tiny difference, +* making the accumulated idle time decrease sometimes. Hence, +* in this case, idle_time should be regarded as 0 in order to +* make the further process correct. +*/ +if (cur_idle_time > j_cdbs->prev_cpu_idle) + idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +else + idle_time =0 ; + j_cdbs->prev_cpu_idle = cur_idle_time;if (ignore_nice) {
@@ -162,7 +178,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)* calls, so the previous load value can be used then. */ load = j_cdbs->prev_load; - }else if (unlikely ((int )idle_time >2 * sampling_rate && + }else if (unlikely (idle_time >2 * sampling_rate && j_cdbs->prev_load)) {/* * If the CPU had gone completely idle and a task has
@@ -189,30 +205,15 @@ unsigned int dbs_update(struct cpufreq_policy *policy) load = j_cdbs->prev_load; j_cdbs->prev_load =0 ; }else { -if (time_elapsed >= idle_time) { +if (time_elapsed > idle_time) load =100 * (time_elapsed - idle_time) / time_elapsed; - }else { -/* -* That can happen if idle_time is returned by -* get_cpu_idle_time_jiffy(). In that case -* idle_time is roughly equal to the difference -* between time_elapsed and "busy time" obtained -* from CPU statistics. Then, the "busy time" -* can end up being greater than time_elapsed -* (for example, if jiffies_64 and the CPU -* statistics are updated by different CPUs), -* so idle_time may in fact be negative. That -* means, though, that the CPU was busy all -* the time (on the rough average) during the -* last sampling interval and 100 can be -* returned as the load. -*/ - load = (int )idle_time <0 ?100 :0 ; - } +else + load =0 ; + j_cdbs->prev_load = load; } -if (unlikely ((int )idle_time >2 * sampling_rate)) { +if (unlikely (idle_time >2 * sampling_rate)) {unsigned int periods = idle_time / sampling_rate;if (periods < idle_periods)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/227 x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 5d3b81d4d8520efe888536b6906dc10fd1a228a8 ]
The init_task instance of struct task_struct is statically allocated and may not contain the full FP state for userspace. As such, limit the copy to the valid area of both init_task and 'dst' and ensure all memory is initialized.
Note that the FP state is only needed for userspace, and as such it is entirely reasonable for init_task to not contain parts of it.
----
v2:
- Fix code if arch_task_struct_size < sizeof(init_task) by using memcpy_and_pad.
--- arch/x86/kernel/process.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/kernel/process.c +6 -1
@@ -88,7 +88,12 @@ EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);*/ int arch_dup_task_struct (struct task_struct *dst,struct task_struct *src) { -memcpy (dst, src, arch_task_struct_size); +/* init_task is not dynamically sized (incomplete FPU state) */ +if (unlikely (src == &init_task)) +memcpy_and_pad (dst, arch_task_struct_size, src,sizeof (init_task),0 ); +else +memcpy (dst, src, arch_task_struct_size); +#ifdef CONFIG_VM86 dst->thread.vm86 =NULL ;#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/227 x86/platform: Only allow CONFIG_EISA for 32-bit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 976ba8da2f3c2f1e997f4f620da83ae65c0e3728 ]
The CONFIG_EISA menu was cleaned up in 2018, but this inadvertently brought the option back on 64-bit machines: ISA remains guarded by a CONFIG_X86_32 check, but EISA no longer depends on ISA.
The last Intel machines ith EISA support used a 82375EB PCI/EISA bridge from 1993 that could be paired with the 440FX chipset on early Pentium-II CPUs, long before the first x86-64 products.
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -174,7 +174,7 @@ config X86 select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS select HAVE_EBPF_JIT select HAVE_EFFICIENT_UNALIGNED_ACCESS - select HAVE_EISA + select HAVE_EISA if X86_32 select HAVE_EXIT_THREAD select HAVE_FAST_GUP select HAVE_FENTRY if X86_64 || DYNAMIC_FTRACE
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/227 PM: sleep: Adjust check before setting power.must_resume
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit eeb87d17aceab7803a5a5bcb6cf2817b745157cf ]
The check before setting power.must_resume in device_suspend_noirq() does not take power.child_count into account, but it should do that, so use pm_runtime_need_not_resume() in it for this purpose and adjust the comment next to it accordingly.
--- drivers/base/power/main.c | 13 ++++++------- drivers/base/power/runtime.c | 2 +- include/linux/pm_runtime.h | 2 ++ 3 files changed, 9 insertions(+), 8 deletions(-)
drivers/base/power/main.c +6 -7
@@ -1242,14 +1242,13 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a dev->power.is_noirq_suspended = true;/* -* Skipping the resume of devices that were in use right before the -* system suspend (as indicated by their PM-runtime usage counters) -* would be suboptimal. Also resume them if doing that is not allowed -* to be skipped. +* Devices must be resumed unless they are explicitly allowed to be left +* in suspend, but even in that case skipping the resume of devices that +* were in use right before the system suspend (as indicated by their +* runtime PM usage counters and child counters) would be suboptimal. */ -if (atomic_read (&dev->power.usage_count) >1 || - !(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && - dev->power.may_skip_resume)) +if (!(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && + dev->power.may_skip_resume) || !pm_runtime_need_not_resume (dev)) dev->power.must_resume = true;if (dev->power.must_resume)
drivers/base/power/runtime.c +1 -1
@@ -1811,7 +1811,7 @@ void pm_runtime_drop_link(struct device_link *link)pm_request_idle (link->supplier); } -static bool pm_runtime_need_not_resume (struct device *dev) +bool pm_runtime_need_not_resume (struct device *dev) { return atomic_read(&dev->power.usage_count) <= 1 && (atomic_read(&dev->power.child_count) == 0 ||
include/linux/pm_runtime.h +2 -0
@@ -32,6 +32,7 @@ static inline bool queue_pm_work(struct work_struct *work)extern int pm_generic_runtime_suspend (struct device *dev);extern int pm_generic_runtime_resume (struct device *dev); +extern bool pm_runtime_need_not_resume (struct device *dev);extern int pm_runtime_force_suspend (struct device *dev);extern int pm_runtime_force_resume (struct device *dev);
@@ -220,6 +221,7 @@ static inline bool queue_pm_work(struct work_struct *work) { return false; }static inline int pm_generic_runtime_suspend (struct device *dev) {return 0 ; }static inline int pm_generic_runtime_resume (struct device *dev) {return 0 ; } +static inline bool pm_runtime_need_not_resume (struct device *dev) {return true; }static inline int pm_runtime_force_suspend (struct device *dev) {return 0 ; }static inline int pm_runtime_force_resume (struct device *dev) {return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/227 selinux: Chain up tool resolving errors in install_policy.sh
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Schumacher <[email protected]>
[ Upstream commit 6ae0042f4d3f331e841495eb0a3d51598e593ec2 ]
Subshell evaluations are not exempt from errexit, so if a command is not available, which will fail and exit the script as a whole. This causes the helpful error messages to not be printed if they are tacked on using a $? comparison.
Resolve the issue by using chains of logical operators, which are not subject to the effects of errexit.
--- scripts/selinux/install_policy.sh | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
scripts/selinux/install_policy.sh +6 -9
@@ -6,27 +6,24 @@ if [ `id -u` -ne 0 ]; then exit 1 fi -SF=`which setfiles` -if [ $? -eq 1 ]; then +SF=`which setfiles` || { echo "Could not find setfiles" echo "Do you have policycoreutils installed?" exit 1 -fi +} -CP=`which checkpolicy` -if [ $? -eq 1 ]; then +CP=`which checkpolicy` || { echo "Could not find checkpolicy" echo "Do you have checkpolicy installed?" exit 1 -fi +} VERS=`$CP -V | awk '{print $1}'` -ENABLED=`which selinuxenabled` -if [ $? -eq 1 ]; then +ENABLED=`which selinuxenabled` || { echo "Could not find selinuxenabled" echo "Do you have libselinux-utils installed?" exit 1 -fi +} if selinuxenabled; then echo "SELinux is already enabled"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/227 EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit d59d844e319d97682c8de29b88d2d60922a683b3 ]
The EDAC_MC_LAYER_CHIP_SELECT layer pertains to the rank, not the DIMM. Fix its size to reflect the number of ranks instead of the number of DIMMs. Also delete the unused macros IE31200_{DIMMS,RANKS}.
--- drivers/edac/ie31200_edac.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/edac/ie31200_edac.c +1 -3
@@ -83,8 +83,6 @@ (((did) & PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK) == \ PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK)) -#define IE31200_DIMMS 4 -#define IE31200_RANKS 8#define IE31200_RANKS_PER_CHANNEL 4#define IE31200_DIMMS_PER_CHANNEL 2#define IE31200_CHANNELS 2
@@ -419,7 +417,7 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) nr_channels =how_many_channels (pdev); layers[0 ].type =EDAC_MC_LAYER_CHIP_SELECT ; - layers[0 ].size =IE31200_DIMMS ; + layers[0 ].size =IE31200_RANKS_PER_CHANNEL ; layers[0 ].is_virt_csrow = true; layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = nr_channels;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/227 EDAC/ie31200: Fix the DIMM size mask for several SoCs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 3427befbbca6b19fe0e37f91d66ce5221de70bf1 ]
The DIMM size mask for {Sky, Kaby, Coffee} Lake is not bits{7:0}, but bits{5:0}. Fix it.
--- drivers/edac/ie31200_edac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/edac/ie31200_edac.c +2 -1
@@ -154,6 +154,7 @@#define IE31200_MAD_DIMM_0_OFFSET 0x5004#define IE31200_MAD_DIMM_0_OFFSET_SKL 0x500C#define IE31200_MAD_DIMM_SIZE GENMASK_ULL(7, 0) +#define IE31200_MAD_DIMM_SIZE_SKL GENMASK_ULL(5, 0)#define IE31200_MAD_DIMM_A_RANK BIT(17)#define IE31200_MAD_DIMM_A_RANK_SHIFT 17#define IE31200_MAD_DIMM_A_RANK_SKL BIT(10)
@@ -368,7 +369,7 @@ static void __iomem *ie31200_map_mchbar(struct pci_dev *pdev)static void __skl_populate_dimm_info (struct dimm_data *dd,u32 addr_decode,int chan) { - dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE ; + dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE_SKL ; dd->dual_rank = (addr_decode & (IE31200_MAD_DIMM_A_RANK_SKL << (chan <<4 ))) ?1 :0 ; dd->x16_width = ((addr_decode & (IE31200_MAD_DIMM_A_WIDTH_SKL << (chan <<4 ))) >> (IE31200_MAD_DIMM_A_WIDTH_SKL_SHIFT + (chan <<4 )));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/227 EDAC/ie31200: Fix the error path order of ie31200_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 231e341036d9988447e3b3345cf741a98139199e ]
The error path order of ie31200_init() is incorrect, fix it.
--- drivers/edac/ie31200_edac.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/edac/ie31200_edac.c +7 -5
@@ -608,7 +608,7 @@ static int __init ie31200_init(void) pci_rc =pci_register_driver (&ie31200_driver);if (pci_rc <0 ) - goto fail0; +return pci_rc;if (!mci_pdev) { ie31200_registered =0 ;
@@ -619,11 +619,13 @@ static int __init ie31200_init(void)if (mci_pdev)break ; } +if (!mci_pdev) {edac_dbg (0 ,"ie31200 pci_get_device fail\n" ); pci_rc = -ENODEV ; - goto fail1; + goto fail0; } + pci_rc =ie31200_init_one (mci_pdev, &ie31200_pci_tbl[i]);if (pci_rc <0 ) {edac_dbg (0 ,"ie31200 init fail\n" );
@@ -631,12 +633,12 @@ static int __init ie31200_init(void) goto fail1; } } -return 0 ; +return 0 ; fail1: -pci_unregister_driver (&ie31200_driver); -fail0:pci_dev_put (mci_pdev); +fail0: +pci_unregister_driver (&ie31200_driver);return pci_rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/227 thermal: int340x: Add NULL check for adev
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit 2542a3f70e563a9e70e7ded314286535a3321bdb ]
Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480
("platform/x86: int3472: Check for adev == NULL").
Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe().
Note, under the same directory, int3400_thermal_probe() has such a check.
--- drivers/thermal/intel/int340x_thermal/int3402_thermal.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/intel/int340x_thermal/int3402_thermal.c +3 -0
@@ -45,6 +45,9 @@ static int int3402_thermal_probe(struct platform_device *pdev)struct int3402_thermal_data *d;int ret; +if (!adev) +return -ENODEV ; +if (!acpi_has_method (adev->handle,"_TMP" ))return -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/227 PM: sleep: Fix handling devices with direct_complete set on errors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 03f1444016b71feffa1dfb8a51f15ba592f94b13 ]
When dpm_suspend() fails, some devices with power.direct_complete set may not have been handled by device_suspend() yet, so runtime PM has not been disabled for them yet even though power.direct_complete is set.
Since device_resume() expects that runtime PM has been disabled for all devices with power.direct_complete set, it will attempt to reenable runtime PM for the devices that have not been processed by device_suspend() which does not make sense. Had those devices had runtime PM disabled before device_suspend() had run, device_resume() would have inadvertently enable runtime PM for them, but this is not expected to happen because it would require ->prepare() callbacks to return positive values for devices with runtime PM disabled, which would be invalid.
In practice, this issue is most likely benign because pm_runtime_enable() will not allow the "disable depth" counter to underflow, but it causes a warning message to be printed for each affected device.
To allow device_resume() to distinguish the "direct complete" devices that have been processed by device_suspend() from those which have not been handled by it, make device_suspend() set power.is_suspended for "direct complete" devices.
Next, move the power.is_suspended check in device_resume() before the power.direct_complete check in it to make it skip the "direct complete" devices that have not been handled by device_suspend().
This change is based on a preliminary patch from Saravana Kannan.
--- drivers/base/power/main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/base/power/main.c +4 -4
@@ -900,6 +900,9 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)if (dev->power.syscore) goto Complete; +if (!dev->power.is_suspended) + goto Complete; +if (dev->power.direct_complete) {/* Match the pm_runtime_disable() in __device_suspend(). */ pm_runtime_enable (dev);
@@ -918,9 +921,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)*/ dev->power.is_prepared = false; -if (!dev->power.is_suspended) - goto Unlock; -if (dev->pm_domain) { info ="power domain " ; callback =pm_op (&dev->pm_domain->ops, state);
@@ -960,7 +960,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async) error =dpm_run_callback (callback, dev, state, info); dev->power.is_suspended = false; - Unlock:device_unlock (dev);dpm_watchdog_clear (&wd);
@@ -1645,6 +1644,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)pm_runtime_disable (dev);if (pm_runtime_status_suspended (dev)) {pm_dev_dbg (dev, state,"direct-complete " ); + dev->power.is_suspended = true; goto Complete; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/227 lockdep: Dont disable interrupts on RT in disable_irq_nosync_lockdep.*()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 87886b32d669abc11c7be95ef44099215e4f5788 ]
disable_irq_nosync_lockdep() disables interrupts with lockdep enabled to avoid false positive reports by lockdep that a certain lock has not been acquired with disabled interrupts. The user of this macros expects that a lock can be acquried without disabling interrupts because the IRQ line triggering the interrupt is disabled.
This triggers a warning on PREEMPT_RT because after disable_irq_nosync_lockdep.*() the following spinlock_t now is acquired with disabled interrupts.
On PREEMPT_RT there is no difference between spin_lock() and spin_lock_irq() so avoiding disabling interrupts in this case works for the two remaining callers as of today.
Don't disable interrupts on PREEMPT_RT in disable_irq_nosync_lockdep.*().
--- include/linux/interrupt.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/linux/interrupt.h +4 -4
@@ -426,7 +426,7 @@ irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec,static inline void disable_irq_nosync_lockdep (unsigned int irq) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_disable ();#endif }
@@ -434,7 +434,7 @@ static inline void disable_irq_nosync_lockdep(unsigned int irq)static inline void disable_irq_nosync_lockdep_irqsave (unsigned int irq,unsigned long *flags) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_save (*flags);#endif }
@@ -449,7 +449,7 @@ static inline void disable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep (unsigned int irq) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_enable ();#endif enable_irq (irq);
@@ -457,7 +457,7 @@ static inline void enable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep_irqrestore (unsigned int irq,unsigned long *flags) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_restore (*flags);#endif enable_irq (irq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/227 perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit c96fff391c095c11dc87dab35be72dee7d217cde ]
The poll man page says POLLRDNORM is equivalent to POLLIN. For poll(), it seems that if user sets pollfd with POLLRDNORM in userspace, perf_poll will not return until timeout even if perf_output_wakeup called, whereas POLLIN returns.
--- kernel/events/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/ring_buffer.c +1 -1
@@ -19,7 +19,7 @@static void perf_output_wakeup (struct perf_output_handle *handle) { -atomic_set (&handle->rb->poll,EPOLLIN ); +atomic_set (&handle->rb->poll,EPOLLIN |EPOLLRDNORM ); handle->event->pending_wakeup =1 ;irq_work_queue (&handle->event->pending);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/227 ALSA: hda/realtek: Always honor no_shutup_pins
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 5a0c72c1da3cbc0cd4940a95d1be2830104c6edf ]
The workaround for Dell machines to skip the pin-shutup for mic pins introduced alc_headset_mic_no_shutup() that is replaced from the generic snd_hda_shutup_pins() for certain codecs. The problem is that the call is done unconditionally even if spec->no_shutup_pins is set. This seems causing problems on other platforms like Lenovo.
This patch corrects the behavior and the driver honors always spec->no_shutup_pins flag and skips alc_headset_mic_no_shutup() if it's set.
--- sound/pci/hda/patch_realtek.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +4 -2
@@ -577,6 +577,9 @@ static void alc_shutup_pins(struct hda_codec *codec) {struct alc_spec *spec = codec->spec; +if (spec->no_shutup_pins) +return ; +switch (codec->core.vendor_id) {case 0x10ec0236 :case 0x10ec0256 :
@@ -592,8 +595,7 @@ static void alc_shutup_pins(struct hda_codec *codec)alc_headset_mic_no_shutup (codec);break ;default : -if (!spec->no_shutup_pins) -snd_hda_shutup_pins (codec); +snd_hda_shutup_pins (codec);break ; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/227 ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <[email protected]>
[ Upstream commit 45ff65e30deb919604e68faed156ad96ce7474d9 ]
For 'ti,j7200-cpb-audio' compatible, there is support for only one PLL for 48k. For 11025, 22050, 44100 and 88200 sampling rates, due to absence of J721E_CLK_PARENT_44100, we get EINVAL while running any audio application. Add support for these rates by using the 48k parent clock and adjusting the clock for these rates later in j721e_configure_refclk.
--- sound/soc/ti/j721e-evm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/ti/j721e-evm.c +2 -0
@@ -179,6 +179,8 @@ static int j721e_configure_refclk(struct j721e_priv *priv, clk_id =J721E_CLK_PARENT_48000 ; else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_44100]) clk_id =J721E_CLK_PARENT_44100 ; + else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_48000]) + clk_id =J721E_CLK_PARENT_48000 ; else return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/227 drm/dp_mst: Fix drm RAD print
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
[ Upstream commit 6bbce873a9c97cb12f5455c497be279ac58e707f ]
[Why]
The RAD of sideband message printed today is incorrect.
For RAD stored within MST branch
- If MST branch LCT is 1, it's RAD array is untouched and remained as 0.
- If MST branch LCT is larger than 1, use nibble to store the up facing port number in cascaded sequence as illustrated below:
u8 RAD[0] = (LCT_2_UFP << 4) | LCT_3_UFP
RAD[1] = (LCT_4_UFP << 4) | LCT_5_UFP
...In drm_dp_mst_rad_to_str(), it wrongly to use BIT_MASK(4) to fetch the port number of one nibble.
[How]
Adjust the code by:
- RAD array items are valuable only for LCT >= 1.
- Use 0xF as the mask to replace BIT_MASK(4)
V2:
- Document how RAD is constructed (Imre)
V3:
- Adjust the comment for rad[] so kdoc formats it properly (Lyude)
--- drivers/gpu/drm/drm_dp_mst_topology.c | 8 ++++---- include/drm/drm_dp_mst_helper.h | 7 +++++++ 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/gpu/drm/drm_dp_mst_topology.c +4 -4
@@ -178,13 +178,13 @@ static int drm_dp_mst_rad_to_str(const u8 rad[8], u8 lct, char *out, size_t len) { int i; -u8 unpacked_rad[16 ]; +u8 unpacked_rad[16 ] = {}; -for (i =0 ; i < lct; i++) { +for (i =1 ; i < lct; i++) {if (i %2 ) - unpacked_rad[i] = rad[i /2 ] >>4 ; + unpacked_rad[i] = rad[(i -1 ) /2 ] >>4 ;else - unpacked_rad[i] = rad[i /2 ] &BIT_MASK (4 ); + unpacked_rad[i] = rad[(i -1 ) /2 ] &0xF ; }/* TODO: Eventually add something to printk so we can format the rad
include/drm/drm_dp_mst_helper.h +7 -0
@@ -232,6 +232,13 @@ struct drm_dp_mst_branch {*/ struct list_head destroy_next; +/** +* @rad: Relative Address of the MST branch. +* For &drm_dp_mst_topology_mgr.mst_primary, it's rad[8] are all 0, +* unset and unused. For MST branches connected after mst_primary, +* in each element of rad[] the nibbles are ordered by the most +* signifcant 4 bits first and the least significant 4 bits second. +*/ u8 rad[8 ];u8 lct;int num_ports;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/227 drm: xlnx: zynqmp: Fix max dma segment size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 28b529a98525123acd37372a04d21e87ec2edcf7 ]
Fix "mapping sg segment longer than device claims to support" warning by setting the max segment size.
--- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/xlnx/zynqmp_dpsub.c +2 -0
@@ -218,6 +218,8 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev)if (ret)return ret; +dma_set_max_seg_size (&pdev->dev,DMA_BIT_MASK (32 )); +/* Try the reserved memory. Proceed if there's none. */ of_reserved_mem_device_init (&pdev->dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/227 drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 0be123cafc06eed0fd1227166a66e786434b0c50 ]
The probe function of this driver may fail after registering the audio platform device: in that case, the state is not getting cleaned up, leaving this device registered.
Adding up to the mix, should the probe function of this driver return a probe deferral for N times, we're registering up to N audio platform devices and, again, never freeing them up.
To fix this, add a pointer to the audio platform device in the mtk_hdmi structure, and add a devm action to unregister it upon driver removal or probe failure.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +19 -6
@@ -172,6 +172,7 @@ struct mtk_hdmi {unsigned int sys_offset;void __iomem *regs;enum hdmi_colorspace csp; +struct platform_device *audio_pdev;struct hdmi_audio_param aud_param;bool audio_enable;bool powered;
@@ -1706,6 +1707,11 @@ static const struct hdmi_codec_ops mtk_hdmi_audio_codec_ops = { .no_capture_mute = 1, }; +static void mtk_hdmi_unregister_audio_driver (void *data) +{ +platform_device_unregister (data); +} +static int mtk_hdmi_register_audio_driver (struct device *dev) {struct mtk_hdmi *hdmi =dev_get_drvdata (dev);
@@ -1715,13 +1721,20 @@ static int mtk_hdmi_register_audio_driver(struct device *dev) .i2s = 1, .data = hdmi, }; -struct platform_device *pdev; +int ret; - pdev =platform_device_register_data (dev,HDMI_CODEC_DRV_NAME , -PLATFORM_DEVID_AUTO , &codec_data, -sizeof (codec_data)); -if (IS_ERR (pdev)) -return PTR_ERR (pdev); + hdmi->audio_pdev =platform_device_register_data (dev, +HDMI_CODEC_DRV_NAME , +PLATFORM_DEVID_AUTO , + &codec_data, +sizeof (codec_data)); +if (IS_ERR (hdmi->audio_pdev)) +return PTR_ERR (hdmi->audio_pdev); + + ret =devm_add_action_or_reset (dev, mtk_hdmi_unregister_audio_driver, + hdmi->audio_pdev); +if (ret) +return ret;DRM_INFO ("%s driver bound to HDMI\n" ,HDMI_CODEC_DRV_NAME );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/227 drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 72fcb88e7bbc053ed4fc74cebb0315b98a0f20c3 ]
Rename member aud_sampe_size of struct hdmi_audio_param to aud_sample_size to fix a typo and enhance readability.
This commit brings no functional changes.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +4 -4
@@ -138,7 +138,7 @@ enum hdmi_aud_channel_swap_type {struct hdmi_audio_param {enum hdmi_audio_coding_type aud_codec; -enum hdmi_audio_sample_size aud_sampe_size; +enum hdmi_audio_sample_size aud_sample_size;enum hdmi_aud_input_type aud_input_type;enum hdmi_aud_i2s_fmt aud_i2s_fmt;enum hdmi_aud_mclk aud_mclk;
@@ -1092,7 +1092,7 @@ static int mtk_hdmi_output_init(struct mtk_hdmi *hdmi) hdmi->csp =HDMI_COLORSPACE_RGB ; aud_param->aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - aud_param->aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + aud_param->aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; aud_param->aud_input_type =HDMI_AUD_INPUT_I2S ; aud_param->aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; aud_param->aud_mclk =HDMI_AUD_MCLK_128FS ;
@@ -1618,14 +1618,14 @@ static int mtk_hdmi_audio_hw_params(struct device *dev, void *data,switch (daifmt->fmt) {case HDMI_I2S : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_I2S ; hdmi_params.aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; hdmi_params.aud_mclk =HDMI_AUD_MCLK_128FS ;break ;case HDMI_SPDIF : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_SPDIF ;break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/227 PCI/ASPM: Fix link state exit during switch upstream function removal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Stodden <[email protected]>
[ Upstream commit cbf937dcadfd571a434f8074d057b32cd14fbea5 ]
Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed.
That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after.
After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link.
That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports.
The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order.
On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone.
--- drivers/pci/pcie/aspm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/pci/pcie/aspm.c +9 -8
@@ -1014,16 +1014,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) parent_link = link->parent;/* -* link->downstream is a pointer to the pci_dev of function 0. If -* we remove that function, the pci_dev is about to be deallocated, -* so we can't use link->downstream again. Free the link state to -* avoid this. +* Free the parent link state, no later than function 0 (i.e. +* link->downstream) being removed. * -* If we're removing a non-0 function, it's possible we could -* retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends -* programming the same ASPM Control value for all functions of -* multi-function devices, so disable ASPM for all of them. +* Do not free the link state any earlier. If function 0 is a +* switch upstream port, this link state is parent_link to all +* subordinate ones. */ +if (pdev != link->downstream) + goto out; +pcie_config_aspm_link (link,0 );list_del (&link->sibling);free_link_state (link);
@@ -1034,6 +1034,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)pcie_config_aspm_path (parent_link); } + out:mutex_unlock (&aspm_lock);up_read (&pci_bus_sem); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/227 PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit 3ac47fbf4f6e8c3a7c3855fac68cc3246f90f850 ]
Per the Cadence's "PCIe Controller IP for AX14" user guide, Version 1.04, Section 9.1.7.1, "AXI Subordinate to PCIe Address Translation Registers", Table 9.4, the bit 16 of the AXI Subordinate Address (axi_s_awaddr) when set corresponds to MSG with data, and when not set, to MSG without data.
However, the driver is currently doing the opposite and due to this, the INTx is never received on the host.
So, fix the driver to reflect the documentation and also make INTx work.
--- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +-- drivers/pci/controller/cadence/pcie-cadence.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-ep.c +1 -2
@@ -311,8 +311,7 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn,spin_unlock_irqrestore (&ep->lock, flags); offset =CDNS_PCIE_NORMAL_MSG_ROUTING (MSG_ROUTING_LOCAL ) | -CDNS_PCIE_NORMAL_MSG_CODE (msg_code) | -CDNS_PCIE_MSG_NO_DATA ; +CDNS_PCIE_NORMAL_MSG_CODE (msg_code);writel (0 , ep->irq_cpu_addr + offset); }
drivers/pci/controller/cadence/pcie-cadence.h +1 -1
@@ -224,7 +224,7 @@ struct cdns_pcie_rp_ib_bar {#define CDNS_PCIE_NORMAL_MSG_CODE_MASK GENMASK(15, 8)#define CDNS_PCIE_NORMAL_MSG_CODE (code) \ (((code) << 8) & CDNS_PCIE_NORMAL_MSG_CODE_MASK) -#define CDNS_PCIE_MSG_NO_DATA BIT(16) +#define CDNS_PCIE_MSG_DATA BIT(16)struct cdns_pcie ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/227 PCI: brcmstb: Use internal register to change link capability
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 0c97321e11e0e9e18546f828492758f6aaecec59 ]
The driver has been mistakenly writing to a read-only (RO) configuration space register (PCI_EXP_LNKCAP) to change the PCIe link capability.
Although harmless in this case, the proper write destination is an internal register that is reflected by PCI_EXP_LNKCAP.
Thus, fix the brcm_pcie_set_gen() function to correctly update the link capability.
--- drivers/pci/controller/pcie-brcmstb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-brcmstb.c +2 -2
@@ -402,10 +402,10 @@ static int brcm_pcie_set_ssc(struct brcm_pcie *pcie)static void brcm_pcie_set_gen (struct brcm_pcie *pcie,int gen) {u16 lnkctl2 =readw (pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCTL2 ); -u32 lnkcap =readl (pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCAP ); +u32 lnkcap =readl (pcie->base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY ); lnkcap = (lnkcap & ~PCI_EXP_LNKCAP_SLS ) | gen; -writel (lnkcap, pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCAP ); +writel (lnkcap, pcie->base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY ); lnkctl2 = (lnkctl2 & ~0xf ) | gen;writew (lnkctl2, pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCTL2 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/227 PCI/portdrv: Only disable pciehp interrupts early when needed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
[ Upstream commit 9d7db4db19827380e225914618c0c1bf435ed2f5 ]
Firmware developers reported that Linux issues two PCIe hotplug commands in very short intervals on an ARM server, which doesn't comply with the PCIe spec. According to PCIe r6.1, sec 6.7.3.2, if the Command Completed event is supported, software must wait for a command to complete or wait at least 1 second before sending a new command.
In the failure case, the first PCIe hotplug command is from get_port_device_capability(), which sends a command to disable PCIe hotplug interrupts without waiting for its completion, and the second command comes from pcie_enable_notification() of pciehp driver, which enables hotplug interrupts again.
Fix this by only disabling the hotplug interrupts when the pciehp driver is not enabled.
--- drivers/pci/pcie/portdrv_core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/pci/pcie/portdrv_core.c +5 -3
@@ -214,10 +214,12 @@ static int get_port_device_capability(struct pci_dev *dev)/* * Disable hot-plug interrupts in case they have been enabled -* by the BIOS and the hot-plug service driver is not loaded. +* by the BIOS and the hot-plug service driver won't be loaded +* to handle them. */ -pcie_capability_clear_word (dev,PCI_EXP_SLTCTL , -PCI_EXP_SLTCTL_CCIE |PCI_EXP_SLTCTL_HPIE ); +if (!IS_ENABLED (CONFIG_HOTPLUG_PCI_PCIE )) +pcie_capability_clear_word (dev,PCI_EXP_SLTCTL , +PCI_EXP_SLTCTL_CCIE |PCI_EXP_SLTCTL_HPIE ); }#ifdef CONFIG_PCIEAER
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/227 drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit c3c584c18c90a024a54716229809ba36424f9660 ]
There is a type mismatch between what CalculateDynamicMetadataParameters() takes and what is passed to it. Currently this function accepts several args as signed long but it's called with unsigned integers and integer. On some systems where long is 32 bits and one of these unsigned int params is greater than INT_MAX it may cause passing input params as negative values.
Fix this by changing these argument types from long to unsigned int and to int respectively. Also this will align the function's definition with similar functions in other dcn* drivers.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +6 -6
@@ -283,10 +283,10 @@ static void CalculateDynamicMetadataParameters(double DISPCLK , double DCFClkDeepSleep, double PixelClock, - long HTotal, - long VBlank, - long DynamicMetadataTransmittedBytes, - long DynamicMetadataLinesBeforeActiveRequired, + unsigned int HTotal, + unsigned int VBlank, + unsigned int DynamicMetadataTransmittedBytes, + int DynamicMetadataLinesBeforeActiveRequired, int InterlaceEnable, bool ProgressiveToInterlaceUnitInOPP, double *Tsetup,
@@ -3373,8 +3373,8 @@ static double CalculateWriteBackDelay(static void CalculateDynamicMetadataParameters (int MaxInterDCNTileRepeaters,double DPPCLK ,double DISPCLK , -double DCFClkDeepSleep,double PixelClock,long HTotal,long VBlank,long DynamicMetadataTransmittedBytes, -long DynamicMetadataLinesBeforeActiveRequired,int InterlaceEnable,bool ProgressiveToInterlaceUnitInOPP, +double DCFClkDeepSleep,double PixelClock,unsigned int HTotal,unsigned int VBlank,unsigned int DynamicMetadataTransmittedBytes, +int DynamicMetadataLinesBeforeActiveRequired,int InterlaceEnable,bool ProgressiveToInterlaceUnitInOPP,double *Tsetup,double *Tdmbf,double *Tdmec,double *Tdmsks) {double TotalRepeaterDelayTime =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/227 PCI: Remove stray put_device() in pci_register_host_bridge()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6e8d06e5096c80cbf41313b4a204f43071ca42be ]
This put_device() was accidentally left over from when we changed the code from using device_register() to calling device_add(). Delete it.
--- drivers/pci/probe.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/pci/probe.c +2 -3
@@ -918,10 +918,9 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge) goto free; err =device_add (&bridge->dev); -if (err) { -put_device (&bridge->dev); +if (err) goto free; - } + bus->bridge =get_device (&bridge->dev);device_enable_async_suspend (bus->bridge);pci_set_bus_of_node (bus);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/227 PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thippeswamy Havalige <[email protected]>
[ Upstream commit 57b0302240741e73fe51f88404b3866e0d2933ad ]
The IRQ domain allocated for the PCIe controller is not freed if resource_list_first_type() returns NULL, leading to a resource leak.
This fix ensures properly cleaning up the allocated IRQ domain in the error path.
--- drivers/pci/controller/pcie-xilinx-cpm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/pci/controller/pcie-xilinx-cpm.c +6 -4
@@ -556,13 +556,15 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)return err; bus =resource_list_first_type (&bridge->windows,IORESOURCE_BUS ); -if (!bus) -return -ENODEV ; +if (!bus) { + err = -ENODEV ; + goto err_free_irq_domains; + } err =xilinx_cpm_pcie_parse_dt (port, bus->res);if (err) {dev_err (dev,"Parsing DT failed\n" ); - goto err_parse_dt; + goto err_free_irq_domains; }xilinx_cpm_pcie_init_port (port);
@@ -586,7 +588,7 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)xilinx_cpm_free_interrupts (port); err_setup_irq:pci_ecam_free (port->cfg); -err_parse_dt: +err_free_irq_domains:xilinx_cpm_free_irq_domains (port);return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/227 drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit dcb166ee43c3d594e7b73a24f6e8cf5663eeff2c ]
There is a type bug because the return statement:
return ret < 0 ? ret : recv_cnt;
The issue is that ret is an int, recv_cnt is a u32 and the function returns ssize_t, which is a signed long. The way that the type promotion works is that the negative error codes are first cast to u32 and then to signed long. The error codes end up being positive instead of negative and the callers treat them as success.
--- drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dsi.c +3 -3
@@ -920,12 +920,12 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host, const struct mipi_dsi_msg *msg) {struct mtk_dsi *dsi =host_to_dsi (host); -u32 recv_cnt, i; +ssize_t recv_cnt;u8 read_data[16 ];void *src_addr;u8 irq_flag =CMD_DONE_INT_FLAG ;u32 dsi_mode; -int ret; +int ret, i; dsi_mode =readl (dsi->regs +DSI_MODE_CTRL );if (dsi_mode &MODE ) {
@@ -974,7 +974,7 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,if (recv_cnt)memcpy (msg->rx_buf, src_addr, recv_cnt); -DRM_INFO ("dsi get %d byte data from the panel address(0x%x)\n" , +DRM_INFO ("dsi get %zd byte data from the panel address(0x%x)\n" , recv_cnt, *((u8 *)(msg->tx_buf))); restore_dsi_mode:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/227 PCI: pciehp: Dont enable HPIE when resuming in poll mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 527664f738afb6f2c58022cd35e63801e5dc7aec ]
PCIe hotplug can operate in poll mode without interrupt handlers using a polling kthread only. eb34da60edee ("PCI: pciehp: Disable hotplug interrupt during suspend") failed to consider that and enables HPIE (Hot-Plug Interrupt Enable) unconditionally when resuming the Port.
Only set HPIE if non-poll mode is in use. This makes pcie_enable_interrupt() match how pcie_enable_notification() already handles HPIE.
--- drivers/pci/hotplug/pciehp_hpc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/hotplug/pciehp_hpc.c +3 -1
@@ -840,7 +840,9 @@ void pcie_enable_interrupt(struct controller *ctrl) {u16 mask; - mask =PCI_EXP_SLTCTL_HPIE |PCI_EXP_SLTCTL_DLLSCE ; + mask =PCI_EXP_SLTCTL_DLLSCE ; +if (!pciehp_poll_mode) + mask |=PCI_EXP_SLTCTL_HPIE ;pcie_write_cmd (ctrl, mask, mask); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/227 fbdev: au1100fb: Move a variable assignment behind a null pointer check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
[ Upstream commit 2df2c0caaecfd869b49e14f2b8df822397c5dd7f ]
The address of a data structure member was determined before a corresponding null pointer check in the implementation of the function “au1100fb_setmode”.
This issue was detected by using the Coccinelle software.
--- drivers/video/fbdev/au1100fb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/au1100fb.c +3 -1
@@ -137,13 +137,15 @@ static int au1100fb_fb_blank(int blank_mode, struct fb_info *fbi)*/ int au1100fb_setmode (struct au1100fb_device *fbdev) { -struct fb_info *info = &fbdev->info; +struct fb_info *info;u32 words;int index;if (!fbdev)return -EINVAL ; + info = &fbdev->info; +/* Update var-dependent FB info */ if (panel_is_active (fbdev->panel) ||panel_is_color (fbdev->panel)) {if (info->var.bits_per_pixel <=8 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/227 mdacon: rework dependency list
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 5bbcc7645f4b244ffb5ac6563fbe9d3d42194447 ]
mdacon has roughly the same dependencies as vgacon but expresses them as a negative list instead of a positive list, with the only practical difference being PowerPC/CHRP, which uses vga16fb instead of vgacon.
The CONFIG_MDA_CONSOLE description advises to only turn it on when vgacon is also used because MDA/Hercules-only systems should be using vgacon instead, so just change the list to enforce that directly for simplicity.
The probing was broken from 2002 to 2008, this improves on the fix that was added then: If vgacon is a loadable module, then mdacon cannot be built-in now, and the list of systems that support vgacon is carried over.
--- drivers/video/console/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/console/Kconfig +1 -1
@@ -23,7 +23,7 @@ config VGA_CONSOLE Say Y. config MDA_CONSOLE - depends on !M68K && !PARISC && ISA + depends on VGA_CONSOLE && ISA tristate "MDA text console (dual-headed)" help Say Y here if you have an old MDA or monochrome Hercules graphics
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/227 fbdev: sm501fb: Add some geometry checks.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Chernetsov <[email protected]>
[ Upstream commit aee50bd88ea5fde1ff4cc021385598f81a65830c ]
Added checks for xoffset, yoffset settings. Incorrect settings of these parameters can lead to errors in sm501fb_pan_ functions.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/video/fbdev/sm501fb.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/video/fbdev/sm501fb.c +7 -0
@@ -326,6 +326,13 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var,if (var->xres_virtual >4096 || var->yres_virtual >2048 )return -EINVAL ; +/* geometry sanity checks */ +if (var->xres + var->xoffset > var->xres_virtual) +return -EINVAL ; + +if (var->yres + var->yoffset > var->yres_virtual) +return -EINVAL ; +/* can cope with 8,16 or 32bpp */ if (var->bits_per_pixel <=8 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 144/227 clk: amlogic: gxbb: drop incorrect flag on 32k clock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit f38f7fe4830c5cb4eac138249225f119e7939965 ]
gxbb_32k_clk_div sets CLK_DIVIDER_ROUND_CLOSEST in the init_data flag which is incorrect. This is field is not where the divider flags belong.
Thankfully, CLK_DIVIDER_ROUND_CLOSEST maps to bit 4 which is an unused clock flag, so there is no unintended consequence to this error.
Effectively, the clock has been used without CLK_DIVIDER_ROUND_CLOSEST so far, so just drop it.
--- drivers/clk/meson/gxbb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/meson/gxbb.c +1 -1
@@ -1309,7 +1309,7 @@ static struct clk_regmap gxbb_32k_clk_div = { &gxbb_32k_clk_sel.hw }, .num_parents = 1, - .flags = CLK_SET_RATE_PARENT | CLK_DIVIDER_ROUND_CLOSEST, + .flags = CLK_SET_RATE_PARENT, }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 145/227 remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit e917b73234b02aa4966325e7380d2559bf127ba9 ]
Only go into the if condition for single-PD handling when there's actually just one power domain specified there. Otherwise it'll be an issue in the dts and we should fail in the regular code path.
This also mirrors the latest changes in the qcom_q6v5_mss driver.
--- drivers/remoteproc/qcom_q6v5_pas.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/remoteproc/qcom_q6v5_pas.c +5 -5
@@ -309,16 +309,16 @@ static int adsp_pds_attach(struct device *dev, struct device **devs,if (!pd_names)return 0 ; +while (pd_names[num_pds]) + num_pds++; +/* Handle single power domain */ -if (dev->pm_domain) { +if (num_pds ==1 && dev->pm_domain) { devs[0 ] = dev;pm_runtime_enable (dev);return 1 ; } -while (pd_names[num_pds]) - num_pds++; -for (i =0 ; i < num_pds; i++) { devs[i] =dev_pm_domain_attach_by_name (dev, pd_names[i]);if (IS_ERR_OR_NULL (devs[i])) {
@@ -343,7 +343,7 @@ static void adsp_pds_detach(struct qcom_adsp *adsp, struct device **pds,int i;/* Handle single power domain */ -if (dev->pm_domain && pd_count) { +if (pd_count ==1 && dev->pm_domain) {pm_runtime_disable (dev);return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 146/227 clk: samsung: Fix UBSAN panic in samsung_clk_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will McVicker <[email protected]>
[ Upstream commit d19d7345a7bcdb083b65568a11b11adffe0687af ]
With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to dereferencing ctx->clk_data.hws before setting ctx->clk_data.num = nr_clks. Move that up to fix the crash.
UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP <snip> Call trace: samsung_clk_init+0x110/0x124 (P) samsung_clk_init+0x48/0x124 (L) samsung_cmu_register_one+0x3c/0xa0 exynos_arm64_register_cmu+0x54/0x64 __gs101_cmu_top_of_clk_init_declare+0x28/0x60 ...
--- drivers/clk/samsung/clk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/samsung/clk.c +1 -1
@@ -64,11 +64,11 @@ struct samsung_clk_provider *__init samsung_clk_init(struct device_node *np,if (!ctx)panic ("could not allocate clock provider context.\n" ); + ctx->clk_data.num = nr_clks;for (i =0 ; i < nr_clks; ++i) ctx->clk_data.hws[i] =ERR_PTR (-ENOENT ); ctx->reg_base = base; - ctx->clk_data.num = nr_clks;spin_lock_init (&ctx->lock);return ctx;
Signature · 1 line
2.39.5