5.15.180-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.15.180-rc1 review
This is the start of the stable review cycle for the 5.15.180 release. There are 279 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Apr 2025 10:47:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.180-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.180-rc1
Vlastimil Babka <[email protected]>
mm, slab: remove duplicate kernel-doc comment for ksize()
Kamal Dasu <[email protected]>
mmc: sdhci-brcmstb: use clk_get_rate(base_clk) in PM resume
Chuck Lever <[email protected]>
NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
Li Lingfeng <[email protected]>
nfsd: put dl_stid if fail to queue dl_recall
Roman Smirnov <[email protected]>
jfs: add index corruption check to DT_GETPAGE()
Qasim Ijaz <[email protected]>
jfs: fix slab-out-of-bounds read in ea_get()
Acs, Jakub <[email protected]>
ext4: fix OOB read when checking dotdot dir
Theodore Ts'o <[email protected]>
ext4: don't over-report free space or inodes in statvfs
Ran Xiaokai <[email protected]>
tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
Douglas Raillard <[email protected]>
tracing: Fix synth event printk format for str fields
Douglas Raillard <[email protected]>
tracing: Ensure module defining synth event cannot be unloaded while tracing
Tengda Wu <[email protected]>
tracing: Fix use-after-free in print_graph_function_flags during tracer switching
Karel Balej <[email protected]>
mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
Paul Menzel <[email protected]>
ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
Murad Masimov <[email protected]>
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
Jann Horn <[email protected]>
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
Guilherme G. Piccoli <[email protected]>
x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
Josef Bacik <[email protected]>
btrfs: handle errors from btrfs_dec_ref() properly
Markus Elfring <[email protected]>
ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Correct command storage data length
Ying Lu <[email protected]>
usbnet:fix NPE during rx_complete
Hersen Wu <[email protected]>
drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
Jesse Zhang <[email protected]>
drm/amd/pm: Fix negative array index read
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: use UARTMODIR register bits for lpuart32 platform
Kamal Dasu <[email protected]>
mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops
Kamal Dasu <[email protected]>
mmc: sdhci-brcmstb: Add ability to increase max clock rate for 72116b0
Haibo Chen <[email protected]>
can: flexcan: disable transceiver during system PM
Haibo Chen <[email protected]>
can: flexcan: only change CAN state when link up in system PM
Henry Martin <[email protected]>
arcnet: Add NULL check in com20020pci_probe()
Lin Ma <[email protected]>
net: fix geneve_opt length integer overflow
Fernando Fernandez Mancera <[email protected]>
ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
Lin Ma <[email protected]>
netfilter: nft_tunnel: fix geneve_opt type confusion addition
Guillaume Nault <[email protected]>
tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
Stefano Garzarella <[email protected]>
vsock: avoid timeout during connect() if the socket is closing
Tobias Waldekranz <[email protected]>
net: mvpp2: Prevent parser TCAM memory corruption
Cong Wang <[email protected]>
net_sched: skbprio: Remove overly strict queue assertions
Debin Zhu <[email protected]>
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only
Henry Martin <[email protected]>
ASoC: imx-card: Add NULL check in imx_card_probe()
Nikita Shubin <[email protected]>
ntb: intel: Fix using link status DB's
Yajun Deng <[email protected]>
ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
Juhan Jin <[email protected]>
riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra
Al Viro <[email protected]>
spufs: fix a leak in spufs_create_context()
Al Viro <[email protected]>
spufs: fix a leak on spufs_new_file() failure
Tasos Sahanidis <[email protected]>
hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}Oliver Hartkopp <[email protected]>
can: statistics: use atomic access in hot path
Navon John Lukose <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
Mario Limonciello <[email protected]>
drm/amd: Keep display off while going into S4
Vladis Dronov <[email protected]>
x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
Waiman Long <[email protected]>
locking/semaphore: Use wake_q to wake up processes outside lock critical section
Shrikanth Hegde <[email protected]>
sched/deadline: Use online cpus for validating runtime
Namjae Jeon <[email protected]>
ksmbd: fix incorrect validation for num_aces field of smb_acl
Simon Tatham <[email protected]>
affs: don't write overlarge OFS data block size fields
Simon Tatham <[email protected]>
affs: generate OFS sequence numbers starting at 1
Icenowy Zheng <[email protected]>
nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
Icenowy Zheng <[email protected]>
nvme-pci: clean up CMBMSC when registering CMB fails
Sagi Grimberg <[email protected]>
nvme-tcp: fix possible UAF in nvme_tcp_poll
Johannes Berg <[email protected]>
wifi: iwlwifi: fw: allocate chained SG tables for dump
Josh Poimboeuf <[email protected]>
sched/smt: Always inline sched_smt_active()
Geetha sowjanya <[email protected]>
octeontx2-af: Free NIX_AF_INT_VEC_GEN irq
Geetha sowjanya <[email protected]>
octeontx2-af: Fix mbox INTR handler when num VFs > 64
Giovanni Gherdovich <[email protected]>
ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid
Feng Yang <[email protected]>
ring-buffer: Fix bytes_dropped calculation issue
Namjae Jeon <[email protected]>
ksmbd: fix multichannel connection failure
Miaoqian Lin <[email protected]>
ksmbd: use aead_request_free to match aead_request_alloc
Mark Zhang <[email protected]>
rtnetlink: Allocate vfinfo size for VF GUIDs when supported
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in exfat_find_last_cluster()
Josh Poimboeuf <[email protected]>
objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
Bart Van Assche <[email protected]>
fs/procfs: fix the comment above proc_pid_wchan()
Arnaldo Carvalho de Melo <[email protected]>
perf python: Check if there is space to copy all the event
Arnaldo Carvalho de Melo <[email protected]>
perf python: Don't keep a raw_data pointer to consumed ring buffer space
Arnaldo Carvalho de Melo <[email protected]>
perf python: Decrement the refcount of just created event on failure
Arnaldo Carvalho de Melo <[email protected]>
perf python: Fixup description of sample.id event member
Stanley Chu <[email protected]>
i3c: master: svc: Fix missing the IBI rules
Alistair Popple <[email protected]>
fuse: fix dax truncate/punch_hole fault path
Trond Myklebust <[email protected]>
NFSv4: Don't trigger uneccessary scans for return-on-close delegations
Vasiliy Kovalev <[email protected]>
ocfs2: validate l_tree_depth to avoid out-of-bounds access
Sourabh Jain <[email protected]>
kexec: initialize ELF lowest address to ULONG_MAX
Arnaldo Carvalho de Melo <[email protected]>
perf units: Fix insufficient array space
Uwe Kleine-König <[email protected]>
iio: adc: ad7124: Fix comparison of channel configs
Dan Carpenter <[email protected]>
fs/ntfs3: Fix a couple integer overflows on 32bit systems
Jonathan Cameron <[email protected]>
iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
Ilkka Koskinen <[email protected]>
coresight: catu: Fix number of pages while using 64k pages
Joe Hattori <[email protected]>
soundwire: slave: fix an OF node reference leak in soundwire slave device
Qasim Ijaz <[email protected]>
isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
Barnabás Czémán <[email protected]>
clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for aead auth key length
Jann Horn <[email protected]>
x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
Nikita Zhandarovich <[email protected]>
mfd: sm501: Switch to BIT() to mitigate integer overflows
Patrisious Haddad <[email protected]>
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
Herbert Xu <[email protected]>
crypto: nx - Fix uninitialised hv_nxc on error
Artur Weber <[email protected]>
power: supply: max77693: Fix wrong conversion of charge input threshold value
Jann Horn <[email protected]>
x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
Jerome Brunet <[email protected]>
clk: amlogic: g12a: fix mmc A peripheral clock
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop non existing 32k clock parent
Jerome Brunet <[email protected]>
clk: amlogic: g12b: fix cluster A parent data
Prathamesh Shete <[email protected]>
pinctrl: tegra: Set SFIO mode to Mux Register
Maher Sanalla <[email protected]>
IB/mad: Check available slots before posting receive WRs
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
Roman Gushchin <[email protected]>
RDMA/core: Don't expose hw_counters outside of init net namespace
Peter Geis <[email protected]>
clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
Fabrizio Castro <[email protected]>
pinctrl: renesas: rzg2l: Fix missing of_node_put() call
Fabrizio Castro <[email protected]>
pinctrl: renesas: rza2: Fix missing of_node_put() call
Tanya Agarwal <[email protected]>
lib: 842: Improve error handling in sw842_compress()
Hou Tao <[email protected]>
bpf: Use preempt_count() directly in bpf_send_signal_common()
Vladimir Lypak <[email protected]>
clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
Will McVicker <[email protected]>
clk: samsung: Fix UBSAN panic in samsung_clk_init()
Andrii Nakryiko <[email protected]>
libbpf: Fix hypothetical STT_SECTION extern NULL deref case
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
Zijun Hu <[email protected]>
of: property: Increase NR_FWNODE_REFERENCE_ARGS
Peng Fan <[email protected]>
remoteproc: core: Clear table_sz when rproc_shutdown
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for aead authsize alignment
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop incorrect flag on 32k clock
Danila Chernetsov <[email protected]>
fbdev: sm501fb: Add some geometry checks.
Arnd Bergmann <[email protected]>
mdacon: rework dependency list
Markus Elfring <[email protected]>
fbdev: au1100fb: Move a variable assignment behind a null pointer check
Ilpo Järvinen <[email protected]>
PCI: pciehp: Don't enable HPIE when resuming in poll mode
Dan Carpenter <[email protected]>
drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
Thippeswamy Havalige <[email protected]>
PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
Dan Carpenter <[email protected]>
PCI: Remove stray put_device() in pci_register_host_bridge()
Vitaliy Shevtsov <[email protected]>
drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
Nishanth Aravamudan <[email protected]>
PCI: Avoid reset when disabled via sysfs
Feng Tang <[email protected]>
PCI/portdrv: Only disable pciehp interrupts early when needed
Jim Quinlan <[email protected]>
PCI: brcmstb: Use internal register to change link capability
Hans Zhang <[email protected]>
PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
Daniel Stodden <[email protected]>
PCI/ASPM: Fix link state exit during switch upstream function removal
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
José Expósito <[email protected]>
drm/vkms: Fix use after free and double free on init error
Tomi Valkeinen <[email protected]>
drm: xlnx: zynqmp: Fix max dma segment size
Wayne Lin <[email protected]>
drm/dp_mst: Fix drm RAD print
Geert Uytterhoeven <[email protected]>
drm/bridge: ti-sn65dsi86: Fix multiple instances
Jayesh Choudhary <[email protected]>
ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Always honor no_shutup_pins
Jiri Kosina <[email protected]>
HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
Joe Hattori <[email protected]>
media: platform: allgro-dvt: unregister v4l2_device on the error path
Tao Chen <[email protected]>
perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
Sebastian Andrzej Siewior <[email protected]>
lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
Rafael J. Wysocki <[email protected]>
PM: sleep: Fix handling devices with direct_complete set on errors
Chenyuan Yang <[email protected]>
thermal: int340x: Add NULL check for adev
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the error path order of ie31200_init()
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the DIMM size mask for several SoCs
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
Tim Schumacher <[email protected]>
selinux: Chain up tool resolving errors in install_policy.sh
Rafael J. Wysocki <[email protected]>
PM: sleep: Adjust check before setting power.must_resume
Arnd Bergmann <[email protected]>
x86/platform: Only allow CONFIG_EISA for 32-bit
Benjamin Berg <[email protected]>
x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
Jie Zhan <[email protected]>
cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
zuoqian <[email protected]>
cpufreq: scpi: compare kHz instead of Hz
Mike Rapoport (Microsoft) <[email protected]>
x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
Eric Sandeen <[email protected]>
watch_queue: fix pipe accounting mismatch
Uwe Kleine-König <[email protected]>
media: i2c: et8ek8: Don't strip remove function when driver is builtin
John Keeping <[email protected]>
serial: 8250_dma: terminate correct DMA in tx_dma_flush()
Luo Qiu <[email protected]>
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
Dominique Martinet <[email protected]>
net: usb: usbnet: restore usb%d name exception for local mac addresses
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FE990B composition
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FN990B composition
Cameron Williams <[email protected]>
tty: serial: 8250: Add Brainboxes XC devices
Cameron Williams <[email protected]>
tty: serial: 8250: Add some more device IDs
William Breathitt Gray <[email protected]>
counter: microchip-tcb-capture: Fix undefined counter channel state on probe
Fabrice Gasnier <[email protected]>
counter: stm32-lptimer-cnt: fix error handling when enabling
Dhruv Deshpande <[email protected]>
ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
Maxim Mikityanskiy <[email protected]>
netfilter: socket: Lookup orig tuple for IPv6 SNAT
Yanjun Yang <[email protected]>
ARM: Remove address checking for MMUless devices
Kees Cook <[email protected]>
ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
Kees Cook <[email protected]>
ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
Minjoong Kim <[email protected]>
atm: Fix NULL pointer dereference
Terry Junge <[email protected]>
HID: hid-plantronics: Add mic mute mapping and generalize quirks
Terry Junge <[email protected]>
ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
Michal Luczaj <[email protected]>
bpf, sockmap: Fix race between element replace and close()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
Justin Klaassen <[email protected]>
arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S
Arthur Mongodin <[email protected]>
mptcp: Fix data stream corruption in the address announcement
David Rosca <[email protected]>
drm/amdgpu: Fix JPEG video caps max size for navi1x and raven
Nikita Zhandarovich <[email protected]>
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
Saranya R <[email protected]>
soc: qcom: pdr: Fix the potential deadlock
Sven Eckelmann <[email protected]>
batman-adv: Ignore own maximum aggregation size during RX
Geert Uytterhoeven <[email protected]>
ARM: shmobile: smp: Enforce shmobile_smp_* alignment
Ye Bin <[email protected]>
proc: fix UAF in proc_get_inode()
Gu Bowen <[email protected]>
mmc: atmel-mci: Add missing clk_disable_unprepare()
Christian Eggers <[email protected]>
regulator: check that dummy regulator has been probed before using it
Maíra Canal <[email protected]>
drm/v3d: Don't run jobs that have errors flagged in its fence
Andreas Kemnade <[email protected]>
i2c: omap: fix IRQ storms
Guillaume Nault <[email protected]>
Revert "gre: Fix IPv6 link-local address generation."
Lin Ma <[email protected]>
net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
Dan Carpenter <[email protected]>
net: atm: fix use after free in lec_send()
Kuniyuki Iwashima <[email protected]>
ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
Kuniyuki Iwashima <[email protected]>
ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
Dan Carpenter <[email protected]>
Bluetooth: Fix error code in chan_alloc_skb_cb()
Junxian Huang <[email protected]>
RDMA/hns: Fix wrong value of max_sge_rd
Junxian Huang <[email protected]>
RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common()
Junxian Huang <[email protected]>
RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db()
Junxian Huang <[email protected]>
RDMA/hns: Fix soft lockup during bt pages loop
Chengchang Tang <[email protected]>
RDMA/hns: Remove redundant 'phy_addr' in hns_roce_hem_list_find_mtt()
Saravanan Vajravel <[email protected]>
RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
Phil Elwell <[email protected]>
ARM: dts: bcm2711: Don't mark timer regs unconfigured
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
Phil Elwell <[email protected]>
ARM: dts: bcm2711: PL011 UARTs are actually r1p5
Cosmin Ratiu <[email protected]>
xfrm_output: Force software GSO only in tunnel mode
Joe Hattori <[email protected]>
firmware: imx-scu: fix OF node leak in .probe()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_debug_files_proc_show()
Henrique Carvalho <[email protected]>
smb: client: Fix match_session bug preventing session reuse
Ma Ke <[email protected]>
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
Michael Strauss <[email protected]>
drm/amd/display: Check for invalid input params when building scaling params
Christophe JAILLET <[email protected]>
i2c: sis630: Fix an error handling path in sis630_probe()
Christophe JAILLET <[email protected]>
i2c: ali15x3: Fix an error handling path in ali15x3_probe()
Christophe JAILLET <[email protected]>
i2c: ali1535: Fix an error handling path in ali1535_probe()
Murad Masimov <[email protected]>
cifs: Fix integer overflow while processing closetimeo mount option
Murad Masimov <[email protected]>
cifs: Fix integer overflow while processing actimeo mount option
Murad Masimov <[email protected]>
cifs: Fix integer overflow while processing acdirmax mount option
Murad Masimov <[email protected]>
cifs: Fix integer overflow while processing acregmax mount option
Christophe JAILLET <[email protected]>
ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
Ivan Abramov <[email protected]>
drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
Charles Keepax <[email protected]>
ASoC: ops: Consistently treat platform_max as control value
Eric Dumazet <[email protected]>
tcp: fix races in tcp_abort()
Andrii Nakryiko <[email protected]>
lib/buildid: Handle memfd_secret() files in build_id_parse()
Haoxiang Li <[email protected]>
qlcnic: fix memory leak issues in qlcnic_sriov_common.c
Mario Limonciello <[email protected]>
drm/amd/display: Fix slab-use-after-free on hdcp_work
Alex Hung <[email protected]>
drm/amd/display: Assign normalized_pix_clk when color depth = 14
Mario Limonciello <[email protected]>
drm/amd/display: Restore correct backlight brightness after a GPU reset
Ville Syrjälä <[email protected]>
drm/atomic: Filter out redundant DPMS calls
Florent Revest <[email protected]>
x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
Johan Hovold <[email protected]>
USB: serial: option: match on interface class for Telit FN990B
Fabio Porcedda <[email protected]>
USB: serial: option: fix Telit Cinterion FE990A name
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE990B compositions
Boon Khai Ng <[email protected]>
USB: serial: ftdi_sio: add support for Altera USB Blaster 3
Ming Lei <[email protected]>
block: fix 'kmem_cache of name 'bio-108' already exists'
Thomas Zimmermann <[email protected]>
drm/nouveau: Do not override forced connector status
Matthieu Baerts (NGI0) <[email protected]>
mptcp: safety check before fallback
Arnd Bergmann <[email protected]>
x86/irq: Define trace events conditionally
Miklos Szeredi <[email protected]>
fuse: don't truncate cached, mutated symlink
Hector Martin <[email protected]>
ASoC: tas2764: Set the SDOUT polarity correctly
Hector Martin <[email protected]>
ASoC: tas2764: Fix power control mask
Hector Martin <[email protected]>
ASoC: tas2770: Fix volume scale
Daniel Wagner <[email protected]>
nvme: only allow entering LIVE from CONNECTING state
Yu-Chun Lin <[email protected]>
sctp: Fix undefined behavior in left shift operation
Ruozhu Li <[email protected]>
nvmet-rdma: recheck queue state is LIVE in state lock in recv done
Stephan Gerhold <[email protected]>
net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
Terry Cheong <[email protected]>
ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
Vitaly Rodionov <[email protected]>
ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
Kuninori Morimoto <[email protected]>
ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
Daniel Lezcano <[email protected]>
thermal/cpufreq_cooling: Remove structure member documentation
Peter Oberparleiter <[email protected]>
s390/cio: Fix CHPID "configure" attribute caching
Jann Horn <[email protected]>
sched: Clarify wake_up_q()'s write to task->wake_q.next
Chia-Lin Kao (AceLan) <[email protected]>
HID: ignore non-functional sensor in HP 5MP Camera
Zhang Lixu <[email protected]>
HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
Brahmajit Das <[email protected]>
vboxsf: fix building with GCC 15
Eric W. Biederman <[email protected]>
alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
Gannon Kolding <[email protected]>
ACPI: resource: IRQ override for Eluktronics MECH-17
Magnus Lindholm <[email protected]>
scsi: qla1280: Fix kernel oops when debug level > 2
Rik van Riel <[email protected]>
scsi: core: Use GFP_NOIO to avoid circular locking dependency
Chengen Du <[email protected]>
iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
Joe Hattori <[email protected]>
powercap: call put_device() on an error path in powercap_register_control_type()
Andy Shevchenko <[email protected]>
hrtimers: Mark is_migration_base() with __always_inline
Daniel Wagner <[email protected]>
nvme-fc: go straight to connecting state when initializing
Carolina Jubran <[email protected]>
net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
Jianbo Liu <[email protected]>
net/mlx5: Bridge, fix the crash caused by LAG state check
Ilya Maximets <[email protected]>
net: openvswitch: remove misbehaving actions length check
Kees Cook <[email protected]>
openvswitch: Use kmalloc_size_roundup() to match ksize() usage
Kees Cook <[email protected]>
slab: Introduce kmalloc_size_roundup()
Kees Cook <[email protected]>
slab: clean up function prototypes
Guillaume Nault <[email protected]>
gre: Fix IPv6 link-local address generation.
Alexey Kashavkin <[email protected]>
netfilter: nft_exthdr: fix offset with ipv4_find_option()
Cong Wang <[email protected]>
net_sched: Prevent creation of classes with TC_H_ROOT
Dan Carpenter <[email protected]>
ipvs: prevent integer overflow in do_ip_vs_get_ctl()
Kohei Enju <[email protected]>
netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
Wentao Liang <[email protected]>
net/mlx5: handle errors in mlx5_chains_create_table()
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
Breno Leitao <[email protected]>
netpoll: hold rcu read lock in __netpoll_send_skb()
Joseph Huang <[email protected]>
net: dsa: mv88e6xxx: Verify after ATU Load ops
Grzegorz Nitka <[email protected]>
ice: fix memory leak in aRFS after reset
Sebastian Andrzej Siewior <[email protected]>
netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
Artur Weber <[email protected]>
pinctrl: bcm281xx: Fix incorrect regmap max_registers value
Michael Kelley <[email protected]>
fbdev: hyperv_fb: iounmap() the correct memory when removing a device
Wang Yufen <[email protected]>
ipv6: Fix signed integer overflow in __ip6_append_data
Oleg Nesterov <[email protected]>
sched/isolation: Prevent boot crash when the boot CPU is nohz_full
David Woodhouse <[email protected]>
clockevents/drivers/i8253: Fix stop sequence for timer 0
Eric Dumazet <[email protected]>
vlan: fix memory leak in vlan_newlink()
-------------
Diffstat:
Documentation/timers/no_hz.rst | 7 +- Makefile | 4 +- arch/alpha/include/asm/elf.h | 6 +- arch/alpha/include/asm/pgtable.h | 2 +- arch/alpha/include/asm/processor.h | 8 +- arch/alpha/kernel/osf_sys.c | 11 +- arch/arm/boot/dts/bcm2711.dtsi | 11 +- arch/arm/mach-shmobile/headsmp.S | 1 + arch/arm/mm/fault.c | 8 + arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 2 +- arch/powerpc/platforms/cell/spufs/inode.c | 9 +- arch/riscv/include/asm/ftrace.h | 4 +- arch/x86/Kconfig | 2 +- arch/x86/entry/calling.h | 2 + arch/x86/include/asm/tlbflush.h | 2 +- arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/cpu/mshyperv.c | 11 -- arch/x86/kernel/cpu/sgx/driver.c | 10 +- arch/x86/kernel/dumpstack.c | 5 +- arch/x86/kernel/irq.c | 2 + arch/x86/kernel/process.c | 7 +- arch/x86/kernel/tsc.c | 4 +- arch/x86/mm/pat/cpa-test.c | 2 +- block/bio.c | 2 +- drivers/acpi/nfit/core.c | 2 +- drivers/acpi/processor_idle.c | 4 + drivers/acpi/resource.c | 13 ++ drivers/base/power/main.c | 21 +-- drivers/base/power/runtime.c | 2 +- drivers/clk/meson/g12a.c | 38 ++-- drivers/clk/meson/gxbb.c | 14 +- drivers/clk/qcom/gcc-msm8953.c | 2 +- drivers/clk/qcom/mmcc-sdm660.c | 2 +- drivers/clk/rockchip/clk-rk3328.c | 2 +- drivers/clk/samsung/clk.c | 2 +- drivers/clocksource/i8253.c | 36 ++-- drivers/counter/microchip-tcb-capture.c | 19 ++ drivers/counter/stm32-lptimer-cnt.c | 24 ++- drivers/cpufreq/cpufreq_governor.c | 45 ++--- drivers/cpufreq/scpi-cpufreq.c | 5 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 30 ++- drivers/crypto/nx/nx-common-pseries.c | 37 ++-- drivers/edac/ie31200_edac.c | 19 +- drivers/firmware/imx/imx-scu.c | 1 + drivers/firmware/iscsi_ibft.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 11 +- drivers/gpu/drm/amd/amdgpu/nv.c | 2 +- drivers/gpu/drm/amd/amdgpu/soc15.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 15 ++ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 1 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 17 +- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 12 +- .../gpu/drm/amd/display/dc/dml/display_mode_vba.c | 24 +++ drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 21 ++- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 + drivers/gpu/drm/drm_atomic_uapi.c | 4 + drivers/gpu/drm/drm_connector.c | 4 + drivers/gpu/drm/drm_dp_mst_topology.c | 8 +- drivers/gpu/drm/gma500/mid_bios.c | 5 + drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 33 +++- drivers/gpu/drm/nouveau/nouveau_connector.c | 1 - drivers/gpu/drm/radeon/radeon_vce.c | 2 +- drivers/gpu/drm/v3d/v3d_sched.c | 9 +- drivers/gpu/drm/vkms/vkms_drv.c | 15 +- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 + drivers/hid/Makefile | 1 - drivers/hid/hid-ids.h | 1 + drivers/hid/hid-plantronics.c | 144 +++++++-------- drivers/hid/hid-quirks.c | 1 + drivers/hid/intel-ish-hid/ipc/ipc.c | 6 +- drivers/hv/vmbus_drv.c | 13 ++ drivers/hwmon/nct6775.c | 4 +- drivers/hwtracing/coresight/coresight-catu.c | 2 +- drivers/i2c/busses/i2c-ali1535.c | 12 +- drivers/i2c/busses/i2c-ali15x3.c | 12 +- drivers/i2c/busses/i2c-omap.c | 26 +-- drivers/i2c/busses/i2c-sis630.c | 12 +- drivers/i3c/master/svc-i3c-master.c | 2 +- drivers/iio/accel/mma8452.c | 10 +- drivers/iio/adc/ad7124.c | 35 +++- drivers/infiniband/core/device.c | 9 + drivers/infiniband/core/mad.c | 38 ++-- drivers/infiniband/core/sysfs.c | 1 + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 - drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 3 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 23 ++- drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 10 +- drivers/infiniband/hw/mlx5/cq.c | 2 +- drivers/media/dvb-frontends/dib8000.c | 5 +- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 +- drivers/media/platform/allegro-dvt/allegro-core.c | 1 + drivers/memstick/host/rtsx_usb_ms.c | 1 + drivers/mfd/sm501.c | 6 +- drivers/mmc/host/atmel-mci.c | 4 +- drivers/mmc/host/sdhci-brcmstb.c | 86 ++++++++- drivers/mmc/host/sdhci-pxav3.c | 1 + drivers/net/arcnet/com20020-pci.c | 17 +- drivers/net/can/flexcan.c | 18 +- drivers/net/dsa/mv88e6xxx/chip.c | 59 ++++-- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 3 + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 3 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 201 ++++++++++++++------- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 2 +- .../ethernet/mellanox/mlx5/core/en/rep/bridge.c | 12 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 +- .../ethernet/mellanox/mlx5/core/lib/fs_chains.c | 5 + .../ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 8 +- drivers/net/usb/qmi_wwan.c | 2 + drivers/net/usb/usbnet.c | 27 ++- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 86 ++++++--- drivers/net/wwan/mhi_wwan_mbim.c | 2 +- drivers/ntb/hw/intel/ntb_hw_gen3.c | 3 + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +- drivers/ntb/test/ntb_perf.c | 4 +- drivers/nvme/host/core.c | 2 - drivers/nvme/host/fc.c | 3 +- drivers/nvme/host/pci.c | 21 ++- drivers/nvme/host/tcp.c | 5 +- drivers/nvme/target/rdma.c | 33 +++- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/cadence/pcie-cadence.h | 2 +- drivers/pci/controller/pcie-brcmstb.c | 4 +- drivers/pci/controller/pcie-xilinx-cpm.c | 10 +- drivers/pci/hotplug/pciehp_hpc.c | 4 +- drivers/pci/pci.c | 4 + drivers/pci/pcie/aspm.c | 17 +- drivers/pci/pcie/portdrv_core.c | 8 +- drivers/pci/probe.c | 5 +- drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 2 +- drivers/pinctrl/renesas/pinctrl-rza2.c | 2 + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 + drivers/pinctrl/tegra/pinctrl-tegra.c | 3 + .../x86/intel/speed_select_if/isst_if_common.c | 2 +- drivers/power/supply/max77693_charger.c | 2 +- drivers/powercap/powercap_sys.c | 3 +- drivers/regulator/core.c | 12 +- drivers/remoteproc/qcom_q6v5_mss.c | 21 ++- drivers/remoteproc/qcom_q6v5_pas.c | 10 +- drivers/remoteproc/remoteproc_core.c | 1 + drivers/s390/cio/chp.c | 3 +- drivers/scsi/qla1280.c | 2 +- drivers/scsi/scsi_scan.c | 2 +- drivers/soc/qcom/pdr_interface.c | 8 +- drivers/soundwire/slave.c | 1 + drivers/thermal/cpufreq_cooling.c | 2 - .../intel/int340x_thermal/int3402_thermal.c | 3 + drivers/tty/serial/8250/8250_dma.c | 2 +- drivers/tty/serial/8250/8250_pci.c | 46 +++++ drivers/tty/serial/fsl_lpuart.c | 25 ++- drivers/usb/serial/ftdi_sio.c | 14 ++ drivers/usb/serial/ftdi_sio_ids.h | 13 ++ drivers/usb/serial/option.c | 48 +++-- drivers/video/console/Kconfig | 2 +- drivers/video/fbdev/au1100fb.c | 4 +- drivers/video/fbdev/hyperv_fb.c | 2 +- drivers/video/fbdev/sm501fb.c | 7 + fs/affs/file.c | 9 +- fs/btrfs/extent-tree.c | 5 +- fs/cifs/cifs_debug.c | 2 + fs/cifs/cifsglob.h | 8 + fs/cifs/connect.c | 15 +- fs/cifs/fs_context.c | 14 +- fs/exfat/fatent.c | 2 +- fs/ext4/dir.c | 3 + fs/ext4/super.c | 27 ++- fs/fuse/dax.c | 1 - fs/fuse/dir.c | 4 +- fs/fuse/file.c | 4 +- fs/isofs/dir.c | 3 +- fs/jfs/jfs_dtree.c | 3 +- fs/jfs/xattr.c | 13 +- fs/ksmbd/auth.c | 2 +- fs/ksmbd/mgmt/user_session.c | 16 ++ fs/ksmbd/mgmt/user_session.h | 2 + fs/ksmbd/smb2pdu.c | 12 +- fs/ksmbd/smbacl.c | 5 +- fs/namei.c | 24 ++- fs/nfs/delegation.c | 33 ++-- fs/nfsd/nfs4state.c | 31 +++- fs/ntfs3/index.c | 4 +- fs/ocfs2/alloc.c | 8 + fs/proc/base.c | 2 +- fs/proc/generic.c | 10 +- fs/proc/inode.c | 6 +- fs/proc/internal.h | 14 ++ fs/vboxsf/super.c | 3 +- include/drm/drm_dp_mst_helper.h | 7 + include/linux/fs.h | 2 + include/linux/fwnode.h | 2 +- include/linux/i8253.h | 1 - include/linux/interrupt.h | 8 +- include/linux/pm_runtime.h | 2 + include/linux/proc_fs.h | 7 +- include/linux/sched/smt.h | 2 +- include/linux/slab.h | 99 ++++++---- include/net/ipv6.h | 4 +- include/rdma/ib_verbs.h | 1 + include/sound/soc.h | 5 +- kernel/events/ring_buffer.c | 2 +- kernel/kexec_elf.c | 2 +- kernel/locking/semaphore.c | 13 +- kernel/sched/core.c | 5 +- kernel/sched/deadline.c | 2 +- kernel/time/hrtimer.c | 22 ++- kernel/trace/bpf_trace.c | 2 +- kernel/trace/ring_buffer.c | 4 +- kernel/trace/trace_events_synth.c | 33 +++- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 - kernel/trace/trace_osnoise.c | 1 - kernel/trace/trace_sched_wakeup.c | 2 - kernel/watch_queue.c | 9 + lib/842/842_compress.c | 2 + lib/buildid.c | 5 + mm/slab.c | 9 +- mm/slab_common.c | 34 ++-- mm/slob.c | 14 ++ net/8021q/vlan_netlink.c | 10 +- net/atm/lec.c | 3 +- net/atm/mpc.c | 2 + net/batman-adv/bat_iv_ogm.c | 3 +- net/batman-adv/bat_v_ogm.c | 3 +- net/bluetooth/6lowpan.c | 7 +- net/bluetooth/hci_event.c | 13 +- net/can/af_can.c | 12 +- net/can/af_can.h | 12 +- net/can/proc.c | 46 +++-- net/core/neighbour.c | 1 + net/core/netpoll.c | 9 +- net/core/rtnetlink.c | 3 + net/core/sock_map.c | 5 +- net/ipv4/ip_tunnel_core.c | 4 +- net/ipv4/tcp.c | 6 +- net/ipv6/addrconf.c | 37 ++-- net/ipv6/calipso.c | 21 ++- net/ipv6/ip6_output.c | 6 +- net/ipv6/netfilter/nf_socket_ipv6.c | 23 +++ net/ipv6/route.c | 5 +- net/mptcp/options.c | 6 +- net/mptcp/protocol.h | 2 + net/netfilter/ipvs/ip_vs_ctl.c | 8 +- net/netfilter/nf_conncount.c | 2 + net/netfilter/nft_ct.c | 6 +- net/netfilter/nft_exthdr.c | 10 +- net/netfilter/nft_set_hash.c | 3 +- net/netfilter/nft_tunnel.c | 6 +- net/openvswitch/actions.c | 6 - net/openvswitch/flow_netlink.c | 17 +- net/sched/act_tunnel_key.c | 2 +- net/sched/cls_flower.c | 2 +- net/sched/sch_api.c | 6 + net/sched/sch_skbprio.c | 3 - net/sctp/stream.c | 2 +- net/vmw_vsock/af_vsock.c | 6 +- net/xfrm/xfrm_output.c | 2 +- scripts/selinux/install_policy.sh | 15 +- sound/pci/hda/patch_realtek.c | 28 ++- sound/soc/codecs/arizona.c | 14 +- sound/soc/codecs/madera.c | 10 +- sound/soc/codecs/tas2764.c | 10 +- sound/soc/codecs/tas2764.h | 8 +- sound/soc/codecs/tas2770.c | 2 +- sound/soc/codecs/wm0010.c | 13 +- sound/soc/codecs/wm5110.c | 8 +- sound/soc/fsl/imx-card.c | 4 + sound/soc/sh/rcar/core.c | 14 -- sound/soc/sh/rcar/rsnd.h | 1 - sound/soc/sh/rcar/src.c | 18 +- sound/soc/soc-ops.c | 15 +- sound/soc/sof/intel/hda-codec.c | 1 + sound/soc/ti/j721e-evm.c | 2 + sound/usb/mixer_quirks.c | 51 ++++++ tools/lib/bpf/linker.c | 2 +- tools/perf/util/python.c | 17 +- tools/perf/util/units.c | 2 +- 281 files changed, 2101 insertions(+), 1000 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/279 vlan: fix memory leak in vlan_newlink()
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 72a0b329114b1caa8e69dfa7cdad1dd3c69b8602 upstream.
Blamed commit added back a bug I fixed in commit 9bbd917e0bec ("vlan: fix memory leak in vlan_dev_set_egress_priority")
If a memory allocation fails in vlan_changelink() after other allocations succeeded, we need to call vlan_dev_free_egress_priority()
to free all allocated memory because after a failed ->newlink() we do not call any methods like ndo_uninit() or dev->priv_destructor().
In following example, if the allocation for last element 2000:2001 fails, we need to free eight prior allocations:
ip link add link dummy0 dummy0.100 type vlan id 100 \
egress-qos-map 1:2 2:3 3:4 4:5 5:6 6:7 7:8 8:9 2000:2001
syzbot report was:
BUG: memory leak
unreferenced object 0xffff888117bd1060 (size 32):
comm "syz-executor408", pid 3759, jiffies 4294956555 (age 34.090s) hex dump (first 32 bytes):
09 00 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace:
[<ffffffff83fc60ad>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff83fc60ad>] vlan_dev_set_egress_priority+0xed/0x170 net/8021q/vlan_dev.c:193 [<ffffffff83fc6628>] vlan_changelink+0x178/0x1d0 net/8021q/vlan_netlink.c:128 [<ffffffff83fc67c8>] vlan_newlink+0x148/0x260 net/8021q/vlan_netlink.c:185 [<ffffffff838b1278>] rtnl_newlink_create net/core/rtnetlink.c:3363 [inline] [<ffffffff838b1278>] __rtnl_newlink+0xa58/0xdc0 net/core/rtnetlink.c:3580 [<ffffffff838b1629>] rtnl_newlink+0x49/0x70 net/core/rtnetlink.c:3593 [<ffffffff838ac66c>] rtnetlink_rcv_msg+0x21c/0x5c0 net/core/rtnetlink.c:6089 [<ffffffff839f9c37>] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2501 [<ffffffff839f8da7>] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [<ffffffff839f8da7>] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [<ffffffff839f9266>] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [<ffffffff8384dbf6>] sock_sendmsg_nosec net/socket.c:714 [inline] [<ffffffff8384dbf6>] sock_sendmsg+0x56/0x80 net/socket.c:734 [<ffffffff8384e15c>] ____sys_sendmsg+0x36c/0x390 net/socket.c:2488 [<ffffffff838523cb>] ___sys_sendmsg+0x8b/0xd0 net/socket.c:2542 [<ffffffff838525b8>] __sys_sendmsg net/socket.c:2571 [inline] [<ffffffff838525b8>] __do_sys_sendmsg net/socket.c:2580 [inline] [<ffffffff838525b8>] __se_sys_sendmsg net/socket.c:2578 [inline] [<ffffffff838525b8>] __x64_sys_sendmsg+0x78/0xf0 net/socket.c:2578 [<ffffffff845ad8d5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff845ad8d5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff8460006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
--- net/8021q/vlan_netlink.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/8021q/vlan_netlink.c +7 -3
@@ -186,10 +186,14 @@ static int vlan_newlink(struct net *src_else if (dev->mtu > max_mtu)return -EINVAL ; +/* Note: If this initial vlan_changelink() fails, we need +* to call vlan_dev_free_egress_priority() to free memory. +*/ err =vlan_changelink (dev, tb, data, extack); -if (err) -return err; - err =register_vlan_dev (dev, extack); + +if (!err) + err =register_vlan_dev (dev, extack); +if (err)vlan_dev_free_egress_priority (dev);return err;
Greg Kroah-Hartman
maintainerPATCH 2/279 clockevents/drivers/i8253: Fix stop sequence for timer 0
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <[email protected]>
commit 531b2ca0a940ac9db03f246c8b77c4201de72b00 upstream.
According to the data sheet, writing the MODE register should stop the counter (and thus the interrupts). This appears to work on real hardware, at least modern Intel and AMD systems. It should also work on Hyper-V.
However, on some buggy virtual machines the mode change doesn't have any effect until the counter is subsequently loaded (or perhaps when the IRQ next fires).
So, set MODE 0 and then load the counter, to ensure that those buggy VMs do the right thing and the interrupts stop. And then write MODE 0 *again* to stop the counter on compliant implementations too.
Apparently, Hyper-V keeps firing the IRQ *repeatedly* even in mode zero when it should only happen once, but the second MODE write stops that too.
Userspace test program (mostly written by tglx):
=====
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdint.h>
#include <sys/io.h>
static __always_inline void __out##bwl(type value, uint16_t port) \
{ \
asm volatile("out" #bwl " %" #bw "0, %w1" \
: : "a"(value), "Nd"(port)); \
} \
\
static __always_inline type __in##bwl(uint16_t port) \
{ \
type value; \
asm volatile("in" #bwl " %w1, %" #bw "0" \
: "=a"(value) : "Nd"(port)); \
return value; \
}BUILDIO(b, b, uint8_t)
#define inb __inb
#define outb __outb
#define PIT_MODE 0x43
#define PIT_CH0 0x40
#define PIT_CH2 0x42
static int is8254;
static void dump_pit(void)
{
if (is8254) {
// Latch and output counter and status
outb(0xC2, PIT_MODE);
printf("%02x %02x %02x\n", inb(PIT_CH0), inb(PIT_CH0), inb(PIT_CH0));
} else {
// Latch and output counter
outb(0x0, PIT_MODE);
printf("%02x %02x\n", inb(PIT_CH0), inb(PIT_CH0));
}
}int main(int argc, char* argv[])
{
int nr_counts = 2;
if (argc > 1)
nr_counts = atoi(argv[1]);
if (argc > 2)
is8254 = 1;
if (ioperm(0x40, 4, 1) != 0)
return 1;
dump_pit();
printf("Set oneshot\n");
outb(0x38, PIT_MODE);
outb(0x00, PIT_CH0);
outb(0x0F, PIT_CH0);
dump_pit();
usleep(1000);
dump_pit();
printf("Set periodic\n");
outb(0x34, PIT_MODE);
outb(0x00, PIT_CH0);
outb(0x0F, PIT_CH0);
dump_pit();
usleep(1000);
dump_pit();
dump_pit();
usleep(100000);
dump_pit();
usleep(100000);
dump_pit();
printf("Set stop (%d counter writes)\n", nr_counts);
outb(0x30, PIT_MODE);
while (nr_counts--)
outb(0xFF, PIT_CH0);
dump_pit();
usleep(100000);
dump_pit();
usleep(100000);
dump_pit();
printf("Set MODE 0\n");
outb(0x30, PIT_MODE);
dump_pit();
usleep(100000);
dump_pit();
usleep(100000);
dump_pit();
return 0;
}=====
--- arch/x86/kernel/cpu/mshyperv.c | 11 ----------- drivers/clocksource/i8253.c | 36 +++++++++++++++++++++++++----------- include/linux/i8253.h | 1 - 3 files changed, 25 insertions(+), 23 deletions(-)
arch/x86/kernel/cpu/mshyperv.c +0 -11
@@ -16,7 +16,6 @@#include <linux/interrupt.h> #include <linux/irq.h> #include <linux/kexec.h> -#include <linux/i8253.h> #include <linux/random.h> #include <asm/processor.h> #include <asm/hypervisor.h>
@@ -445,16 +444,6 @@ static void __init ms_hyperv_init_platfoif (efi_enabled (EFI_BOOT )) x86_platform.get_nmi_reason = hv_get_nmi_reason; -/* -* Hyper-V VMs have a PIT emulation quirk such that zeroing the -* counter register during PIT shutdown restarts the PIT. So it -* continues to interrupt @18.2 HZ. Setting i8253_clear_counter -* to false tells pit_shutdown() not to zero the counter so that -* the PIT really is shutdown. Generation 2 VMs don't have a PIT, -* and setting this value has no effect. -*/ - i8253_clear_counter_on_shutdown = false; -#if IS_ENABLED (CONFIG_HYPERV )/* * Setup the hook to get control post apic initialization.
drivers/clocksource/i8253.c +25 -11
@@ -20,13 +20,6 @@DEFINE_RAW_SPINLOCK (i8253_lock);EXPORT_SYMBOL (i8253_lock); -/* -* Handle PIT quirk in pit_shutdown() where zeroing the counter register -* restarts the PIT, negating the shutdown. On platforms with the quirk, -* platform specific code can set this to false. -*/ -bool i8253_clear_counter_on_shutdown__ro_after_init = true; -#ifdef CONFIG_CLKSRC_I8253 /* * Since the PIT overflows every tick, its not very useful
@@ -112,12 +105,33 @@ void clockevent_i8253_disable(void) {raw_spin_lock (&i8253_lock); +/* +* Writing the MODE register should stop the counter, according to +* the datasheet. This appears to work on real hardware (well, on +* modern Intel and AMD boxes; I didn't dig the Pegasos out of the +* shed). +* +* However, some virtual implementations differ, and the MODE change +* doesn't have any effect until either the counter is written (KVM +* in-kernel PIT) or the next interrupt (QEMU). And in those cases, +* it may not stop the *count*, only the interrupts. Although in +* the virt case, that probably doesn't matter, as the value of the +* counter will only be calculated on demand if the guest reads it; +* it's the interrupts which cause steal time. +* +* Hyper-V apparently has a bug where even in mode 0, the IRQ keeps +* firing repeatedly if the counter is running. But it *does* do the +* right thing when the MODE register is written. +* +* So: write the MODE and then load the counter, which ensures that +* the IRQ is stopped on those buggy virt implementations. And then +* write the MODE again, which is the right way to stop it. +*/ outb_p (0x30 ,PIT_MODE ); +outb_p (0 ,PIT_CH0 ); +outb_p (0 ,PIT_CH0 ); -if (i8253_clear_counter_on_shutdown) { -outb_p (0 ,PIT_CH0 ); -outb_p (0 ,PIT_CH0 ); - } +outb_p (0x30 ,PIT_MODE );raw_spin_unlock (&i8253_lock); }
include/linux/i8253.h +0 -1
@@ -21,7 +21,6 @@#define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ)extern raw_spinlock_t i8253_lock; -extern bool i8253_clear_counter_on_shutdown;extern struct clock_event_device i8253_clockevent;extern void clockevent_i8253_init (bool oneshot);extern void clockevent_i8253_disable (void );
Greg Kroah-Hartman
maintainerPATCH 3/279 sched/isolation: Prevent boot crash when the boot CPU is nohz_full
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
Documentation/timers/no_hz.rst states that the "nohz_full=" mask must not include the boot CPU, which is no longer true after:
08ae95f4fd3b ("nohz_full: Allow the boot CPU to be nohz_full").
However after:
aae17ebb53cd ("workqueue: Avoid using isolated cpus' timers on queue_delayed_work")
the kernel will crash at boot time in this case; housekeeping_any_cpu() returns an invalid CPU number until smp_init() brings the first housekeeping CPU up.
Change housekeeping_any_cpu() to check the result of cpumask_any_and() and return smp_processor_id() in this case.
This is just the simple and backportable workaround which fixes the symptom, but smp_processor_id() at boot time should be safe at least for type == HK_TYPE_TIMER, this more or less matches the tick_do_timer_boot_cpu logic.
There is no worry about cpu_down(); tick_nohz_cpu_down() will not allow to offline tick_do_timer_cpu (the 1st online housekeeping CPU).
[ Apply only documentation changes as commit which causes boot
crash when boot CPU is nohz_full is not backported to stable kernels - Krishanth ]
[ strip out upstream commit and Fixes: so tools don't get confused that
this commit actually does anything real - gregkh]
--- Documentation/timers/no_hz.rst | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
Documentation/timers/no_hz.rst +2 -5
@@ -129,11 +129,8 @@ adaptive-tick CPUs: At least one non-ad online to handle timekeeping tasks in order to ensure that system calls like gettimeofday() returns accurate values on adaptive-tick CPUs. (This is not an issue for CONFIG_NO_HZ_IDLE=y because there are no running -user processes to observe slight drifts in clock rate.) Therefore, the -boot CPU is prohibited from entering adaptive-ticks mode. Specifying a -"nohz_full=" mask that includes the boot CPU will result in a boot-time -error message, and the boot CPU will be removed from the mask. Note that -this means that your system must have at least two CPUs in order for +user processes to observe slight drifts in clock rate.) Note that this +means that your system must have at least two CPUs in order for CONFIG_NO_HZ_FULL=y to do anything for you. Finally, adaptive-ticks CPUs must have their RCU callbacks offloaded.
Greg Kroah-Hartman
maintainerPATCH 4/279 ipv6: Fix signed integer overflow in __ip6_append_data
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yufen <[email protected]>
commit f93431c86b631bbca5614c66f966bf3ddb3c2803 upstream.
Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.
UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170
Changes since v1:
-Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2:
-Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3:
-Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested.
[ Conflict due to f37a4cc6bb0b ("udp6: pass flow in ip6_make_skb
together with cork") not in the tree ]
--- include/net/ipv6.h | 4 ++-- net/ipv6/ip6_output.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-)
include/net/ipv6.h +2 -2
@@ -1000,7 +1000,7 @@ int ip6_find_1stfragopt(struct sk_buff *int ip6_append_data (struct sock *sk,int getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), -void *from,int length,int transhdrlen, +void *from,size_t length,int transhdrlen,struct ipcm6_cookie *ipc6,struct flowi6 *fl6,struct rt6_info *rt,unsigned int flags);
@@ -1016,7 +1016,7 @@ struct sk_buff *__ip6_make_skb(struct sostruct sk_buff *ip6_make_skb (struct sock *sk,int getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), -void *from,int length,int transhdrlen, +void *from,size_t length,int transhdrlen,struct ipcm6_cookie *ipc6,struct flowi6 *fl6,struct rt6_info *rt,unsigned int flags,struct inet_cork_full *cork);
net/ipv6/ip6_output.c +3 -3
@@ -1461,7 +1461,7 @@ static int __ip6_append_data(struct sockstruct page_frag *pfrag, int getfrag(void *from, char *to, int offset,int len,int odd,struct sk_buff *skb), - void *from, int length, int transhdrlen, + void *from, size_t length, int transhdrlen, unsigned int flags, struct ipcm6_cookie *ipc6) { struct sk_buff *skb, *skb_prev = NULL;
@@ -1806,7 +1806,7 @@ error:int ip6_append_data (struct sock *sk,int getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), -void *from,int length,int transhdrlen, +void *from,size_t length,int transhdrlen,struct ipcm6_cookie *ipc6,struct flowi6 *fl6,struct rt6_info *rt,unsigned int flags) {
@@ -2000,7 +2000,7 @@ EXPORT_SYMBOL_GPL(ip6_flush_pending_framstruct sk_buff *ip6_make_skb (struct sock *sk,int getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), -void *from,int length,int transhdrlen, +void *from,size_t length,int transhdrlen,struct ipcm6_cookie *ipc6,struct flowi6 *fl6,struct rt6_info *rt,unsigned int flags,struct inet_cork_full *cork)
Greg Kroah-Hartman
maintainerPATCH 5/279 fbdev: hyperv_fb: iounmap() the correct memory when removing a device
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 7241c886a71797cc51efc6fadec7076fcf6435c2 ]
When a Hyper-V framebuffer device is removed, or the driver is unbound from a device, any allocated and/or mapped memory must be released. In particular, MMIO address space that was mapped to the framebuffer must be unmapped. Current code unmaps the wrong address, resulting in an error like:
[ 4093.980597] iounmap: bad address 00000000c936c05c
followed by a stack dump.
Commit d21987d709e8 ("video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver") changed the kind of address stored in info->screen_base, and the iounmap() call in hvfb_putmem() was not updated accordingly.
Fix this by updating hvfb_putmem() to unmap the correct address.
Message-ID: <[email protected]>
--- drivers/video/fbdev/hyperv_fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/hyperv_fb.c +1 -1
@@ -1130,7 +1130,7 @@ static void hvfb_putmem(struct hv_device *hdev, struct fb_info *info)if (par->need_docopy) {vfree (par->dio_vp); -iounmap (info->screen_base); +iounmap (par->mmio_vp);vmbus_free_mmio (par->mem->start, screen_fb_size); }else { hvfb_release_phymem(hdev, info->fix.smem_start,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/279 pinctrl: bcm281xx: Fix incorrect regmap max_registers value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 68283c1cb573143c0b7515e93206f3503616bc10 ]
The max_registers value does not take into consideration the stride; currently, it's set to the number of the last pin, but this does not accurately represent the final register.
Fix this by multiplying the current value by 4.
--- drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/bcm/pinctrl-bcm281xx.c +1 -1
@@ -981,7 +981,7 @@ static const struct regmap_config bcm281xx_pinctrl_regmap_config = { .reg_bits = 32, .reg_stride = 4, .val_bits = 32, - .max_register = BCM281XX_PIN_VC_CAM3_SDA, + .max_register = BCM281XX_PIN_VC_CAM3_SDA * 4, };static int bcm281xx_pinctrl_get_groups_count (struct pinctrl_dev *pctldev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/279 netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 5cfe5612ca9590db69b9be29dc83041dbf001108 ]
nft_ct_pcpu_template is a per-CPU variable and relies on disabled BH for its locking. The refcounter is read and if its value is set to one then the refcounter is incremented and variable is used - otherwise it is already in use and left untouched.
Without per-CPU locking in local_bh_disable() on PREEMPT_RT the read-then-increment operation is not atomic and therefore racy.
This can be avoided by using unconditionally __refcount_inc() which will increment counter and return the old value as an atomic operation. In case the returned counter is not one, the variable is in use and we need to decrement counter. Otherwise we can use it.
Use __refcount_inc() instead of read and a conditional increment.
--- net/netfilter/nft_ct.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/nft_ct.c +4 -2
@@ -239,6 +239,7 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr,enum ip_conntrack_info ctinfo;u16 value =nft_reg_load16 (®s->data[priv->sreg]);struct nf_conn *ct; +int oldcnt; ct =nf_ct_get (skb, &ctinfo);if (ct)/* already tracked */
@@ -259,10 +260,11 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, ct =this_cpu_read (nft_ct_pcpu_template); -if (likely (refcount_read (&ct->ct_general.use) ==1 )) { -refcount_inc (&ct->ct_general.use); +__refcount_inc (&ct->ct_general.use, &oldcnt); +if (likely (oldcnt ==1 )) {nf_ct_zone_add (ct, &zone); }else { +refcount_dec (&ct->ct_general.use);/* previous skb got queued to userspace, allocate temporary * one until percpu template can be reused. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/279 ice: fix memory leak in aRFS after reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grzegorz Nitka <[email protected]>
[ Upstream commit 23d97f18901ef5e4e264e3b1777fe65c760186b5 ]
Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases:
- as part of VSI initialization (at probe), and
- as part of reset handling
However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature:
[root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192):
comm "kworker/0:0", pid 8, jiffies 4296833052 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 0):
[<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340
[<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice]
[<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice]
[<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice]
[<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice]
[<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice]
[<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0
[<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20
[<ffffffff98f0b6d9>] process_one_work+0x179/0x390
[<ffffffff98f0c1e9>] worker_thread+0x239/0x340
[<ffffffff98f14abc>] kthread+0xcc/0x100
[<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50
[<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30
...--- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_arfs.c +1 -1
@@ -510,7 +510,7 @@ void ice_init_arfs(struct ice_vsi *vsi)struct hlist_head *arfs_fltr_list;unsigned int i; -if (!vsi || vsi->type !=ICE_VSI_PF ) +if (!vsi || vsi->type !=ICE_VSI_PF ||ice_is_arfs_active (vsi))return ; arfs_fltr_list = kzalloc(sizeof(*arfs_fltr_list) * ICE_MAX_ARFS_LIST,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/279 net: dsa: mv88e6xxx: Verify after ATU Load ops
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Huang <[email protected]>
[ Upstream commit dc5340c3133a3ebe54853fd299116149e528cfaa ]
ATU Load operations could fail silently if there's not enough space on the device to hold the new entry. When this happens, the symptom depends on the unknown flood settings. If unknown multicast flood is disabled, the multicast packets are dropped when the ATU table is full. If unknown multicast flood is enabled, the multicast packets will be flooded to all ports. Either way, IGMP snooping is broken when the ATU Load operation fails silently.
Do a Read-After-Write verification after each fdb/mdb add operation to make sure that the operation was really successful, and return -ENOSPC otherwise.
--- drivers/net/dsa/mv88e6xxx/chip.c | 59 ++++++++++++++++++++++++++------ 1 file changed, 48 insertions(+), 11 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +48 -11
@@ -1775,13 +1775,11 @@ mv88e6xxx_port_vlan_prepare(struct dsa_switch *ds, int port,return err; } -static int mv88e6xxx_port_db_load_purge (struct mv88e6xxx_chip *chip,int port, -const unsigned char *addr,u16 vid, -u8 state) +static int mv88e6xxx_port_db_get (struct mv88e6xxx_chip *chip, +const unsigned char *addr,u16 vid, +u16 *fid,struct mv88e6xxx_atu_entry *entry) { -struct mv88e6xxx_atu_entry entry;struct mv88e6xxx_vtu_entry vlan; -u16 fid;int err;/* Ports have two private address databases: one for when the port is
@@ -1792,7 +1790,7 @@ static int mv88e6xxx_port_db_load_purge(struct mv88e6xxx_chip *chip, int port,* VLAN ID into the port's database used for VLAN-unaware bridging. */ if (vid ==0 ) { - fid =MV88E6XXX_FID_BRIDGED ; + *fid =MV88E6XXX_FID_BRIDGED ; }else { err =mv88e6xxx_vtu_get (chip, vid, &vlan);if (err)
@@ -1802,14 +1800,39 @@ static int mv88e6xxx_port_db_load_purge(struct mv88e6xxx_chip *chip, int port,if (!vlan.valid)return -EOPNOTSUPP ; - fid = vlan.fid; + *fid = vlan.fid; } - entry.state =0 ; -ether_addr_copy (entry.mac, addr); -eth_addr_dec (entry.mac); + entry->state =0 ; +ether_addr_copy (entry->mac, addr); +eth_addr_dec (entry->mac); + +return mv88e6xxx_g1_atu_getnext (chip, *fid, entry); +} + +static bool mv88e6xxx_port_db_find (struct mv88e6xxx_chip *chip, +const unsigned char *addr,u16 vid) +{ +struct mv88e6xxx_atu_entry entry; +u16 fid; +int err; - err =mv88e6xxx_g1_atu_getnext (chip, fid, &entry); + err =mv88e6xxx_port_db_get (chip, addr, vid, &fid, &entry); +if (err) +return false; + +return entry.state &ðer_addr_equal (entry.mac, addr); +} + +static int mv88e6xxx_port_db_load_purge (struct mv88e6xxx_chip *chip,int port, +const unsigned char *addr,u16 vid, +u8 state) +{ +struct mv88e6xxx_atu_entry entry; +u16 fid; +int err; + + err =mv88e6xxx_port_db_get (chip, addr, vid, &fid, &entry);if (err)return err;
@@ -2324,6 +2347,13 @@ static int mv88e6xxx_port_fdb_add(struct dsa_switch *ds, int port,mv88e6xxx_reg_lock (chip); err =mv88e6xxx_port_db_load_purge (chip, port, addr, vid,MV88E6XXX_G1_ATU_DATA_STATE_UC_STATIC ); +if (err) + goto out; + +if (!mv88e6xxx_port_db_find (chip, addr, vid)) + err = -ENOSPC ; + +out:mv88e6xxx_reg_unlock (chip);return err;
@@ -5878,6 +5908,13 @@ static int mv88e6xxx_port_mdb_add(struct dsa_switch *ds, int port,mv88e6xxx_reg_lock (chip); err =mv88e6xxx_port_db_load_purge (chip, port, mdb->addr, mdb->vid,MV88E6XXX_G1_ATU_DATA_STATE_MC_STATIC ); +if (err) + goto out; + +if (!mv88e6xxx_port_db_find (chip, mdb->addr, mdb->vid)) + err = -ENOSPC ; + +out:mv88e6xxx_reg_unlock (chip);return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/279 netpoll: hold rcu read lock in __netpoll_send_skb()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 505ead7ab77f289f12d8a68ac83da068e4d4408b ]
The function __netpoll_send_skb() is being invoked without holding the RCU read lock. This oversight triggers a warning message when CONFIG_PROVE_RCU_LIST is enabled:
net/core/netpoll.c:330 suspicious rcu_dereference_check() usage!
netpoll_send_skb
netpoll_send_udp
write_ext_msg
console_flush_all
console_unlock
vprintk_emit
To prevent npinfo from disappearing unexpectedly, ensure that __netpoll_send_skb() is protected with the RCU read lock.
--- net/core/netpoll.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/core/netpoll.c +7 -2
@@ -326,6 +326,7 @@ static int netpoll_owner_active(struct net_device *dev)static netdev_tx_t __netpoll_send_skb (struct netpoll *np,struct sk_buff *skb) {netdev_tx_t status =NETDEV_TX_BUSY ; +netdev_tx_t ret =NET_XMIT_DROP ;struct net_device *dev;unsigned long tries;/* It is up to the caller to keep npinfo alive. */
@@ -334,11 +335,12 @@ static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)lockdep_assert_irqs_disabled (); dev = np->dev; +rcu_read_lock (); npinfo =rcu_dereference_bh (dev->npinfo);if (!npinfo || !netif_running (dev) || !netif_device_present (dev)) {dev_kfree_skb_irq (skb); -return NET_XMIT_DROP ; + goto out; }/* don't get messages out of order, and no recursion */
@@ -377,7 +379,10 @@ static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)skb_queue_tail (&npinfo->txq, skb);schedule_delayed_work (&npinfo->tx_work,0 ); } -return NETDEV_TX_OK ; + ret =NETDEV_TX_OK ; +out: +rcu_read_unlock (); +return ret; }netdev_tx_t netpoll_send_skb (struct netpoll *np,struct sk_buff *skb)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/279 Drivers: hv: vmbus: Dont release fb_mmio resource in vmbus_free_mmio()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 73fe9073c0cc28056cb9de0c8a516dac070f1d1f ]
The VMBus driver manages the MMIO space it owns via the hyperv_mmio resource tree. Because the synthetic video framebuffer portion of the MMIO space is initially setup by the Hyper-V host for each guest, the VMBus driver does an early reserve of that portion of MMIO space in the hyperv_mmio resource tree. It saves a pointer to that resource in fb_mmio. When a VMBus driver requests MMIO space and passes "true" for the "fb_overlap_ok" argument, the reserved framebuffer space is used if possible. In that case it's not necessary to do another request against the "shadow" hyperv_mmio resource tree because that resource was already requested in the early reserve steps.
However, the vmbus_free_mmio() function currently does no special handling for the fb_mmio resource. When a framebuffer device is removed, or the driver is unbound, the current code for vmbus_free_mmio() releases the reserved resource, leaving fb_mmio pointing to memory that has been freed. If the same or another driver is subsequently bound to the device, vmbus_allocate_mmio() checks against fb_mmio, and potentially gets garbage. Furthermore a second unbind operation produces this "nonexistent resource" error because of the unbalanced behavior between vmbus_allocate_mmio() and vmbus_free_mmio():
[ 55.499643] resource: Trying to free nonexistent resource <0x00000000f0000000-0x00000000f07fffff>
Fix this by adding logic to vmbus_free_mmio() to recognize when MMIO space in the fb_mmio reserved area would be released, and don't release it. This filtering ensures the fb_mmio resource always exists, and makes vmbus_free_mmio() more parallel with vmbus_allocate_mmio().
Message-ID: <[email protected]>
--- drivers/hv/vmbus_drv.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/hv/vmbus_drv.c +13 -0
@@ -2419,12 +2419,25 @@ void vmbus_free_mmio(resource_size_t start, resource_size_t size)struct resource *iter;mutex_lock (&hyperv_mmio_lock); + +/* +* If all bytes of the MMIO range to be released are within the +* special case fb_mmio shadow region, skip releasing the shadow +* region since no corresponding __request_region() was done +* in vmbus_allocate_mmio(). +*/ +if (fb_mmio && start >= fb_mmio->start && + (start + size -1 <= fb_mmio->end)) + goto skip_shadow_release; +for (iter = hyperv_mmio; iter; iter = iter->sibling) {if ((iter->start >= start + size) || (iter->end <= start))continue ;__release_region (iter, start, size); } + +skip_shadow_release:release_mem_region (start, size);mutex_unlock (&hyperv_mmio_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/279 net/mlx5: handle errors in mlx5_chains_create_table()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit eab0396353be1c778eba1c0b5180176f04dd21ce ]
In mlx5_chains_create_table(), the return value of mlx5_get_fdb_sub_ns() and mlx5_get_flow_namespace() must be checked to prevent NULL pointer dereferences. If either function fails, the function should log error message with mlx5_core_warn() and return error pointer.
--- drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c +5 -0
@@ -196,6 +196,11 @@ mlx5_chains_create_table(struct mlx5_fs_chains *chains, ns =mlx5_get_flow_namespace (chains->dev, chains->ns); } +if (!ns) { +mlx5_core_warn (chains->dev,"Failed to get flow namespace\n" ); +return ERR_PTR (-EOPNOTSUPP ); + } + ft_attr.autogroup.num_reserved_entries =2 ; ft_attr.autogroup.max_num_groups = chains->group_num; ft =mlx5_create_auto_grouped_flow_table (ns, &ft_attr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/279 netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit d653bfeb07ebb3499c403404c21ac58a16531607 ]
Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), cpu and jiffies32 were introduced to the struct nf_conncount_tuple.
The commit made nf_conncount_add() initialize conn->cpu and conn->jiffies32 when allocating the struct.
In contrast, count_tree() was not changed to initialize them.
By commit 34848d5c896e ("netfilter: nf_conncount: Split insert and traversal"), count_tree() was split and the relevant allocation code now resides in insert_tree().
Initialize conn->cpu and conn->jiffies32 in insert_tree().
BUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline] BUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 find_or_evict net/netfilter/nf_conncount.c:117 [inline] __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [inline] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4121 [inline] slab_alloc_node mm/slub.c:4164 [inline] kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171 insert_tree net/netfilter/nf_conncount.c:372 [inline] count_tree net/netfilter/nf_conncount.c:450 [inline] nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
--- net/netfilter/nf_conncount.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/nf_conncount.c +2 -0
@@ -366,6 +366,8 @@ insert_tree(struct net *net, conn->tuple = *tuple; conn->zone = *zone; + conn->cpu =raw_smp_processor_id (); + conn->jiffies32 = (u32 )jiffies;memcpy (rbconn->key, key,sizeof (u32) * data->keylen);nf_conncount_list_init (&rbconn->list);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/279 ipvs: prevent integer overflow in do_ip_vs_get_ctl()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 80b78c39eb86e6b55f56363b709eb817527da5aa ]
The get->num_services variable is an unsigned int which is controlled by the user. The struct_size() function ensures that the size calculation does not overflow an unsigned long, however, we are saving the result to an int so the calculation can overflow.
Both "len" and "get->num_services" come from the user. This check is just a sanity check to help the user and ensure they are using the API correctly. An integer overflow here is not a big deal. This has no security impact.
Save the result from struct_size() type size_t to fix this integer overflow bug.
--- net/netfilter/ipvs/ip_vs_ctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/ipvs/ip_vs_ctl.c +4 -4
@@ -2852,12 +2852,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)case IP_VS_SO_GET_SERVICES : {struct ip_vs_get_services *get; -int size; +size_t size; get = (struct ip_vs_get_services *)arg; size =struct_size (get, entrytable, get->num_services);if (*len != size) { -pr_err ("length: %u != %u\n" , *len, size); +pr_err ("length: %u != %zu\n" , *len, size); ret = -EINVAL ; goto out; }
@@ -2893,12 +2893,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)case IP_VS_SO_GET_DESTS : {struct ip_vs_get_dests *get; -int size; +size_t size; get = (struct ip_vs_get_dests *)arg; size =struct_size (get, entrytable, get->num_dests);if (*len != size) { -pr_err ("length: %u != %u\n" , *len, size); +pr_err ("length: %u != %zu\n" , *len, size); ret = -EINVAL ; goto out; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/279 net_sched: Prevent creation of classes with TC_H_ROOT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <[email protected]>
[ Upstream commit 0c3057a5a04d07120b3d0ec9c79568fceb9c921e ]
The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho.
Prevent the creation of any Qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.
--- net/sched/sch_api.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/sched/sch_api.c +6 -0
@@ -2164,6 +2164,12 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,return -EOPNOTSUPP ; } +/* Prevent creation of traffic classes with classid TC_H_ROOT */ +if (clid ==TC_H_ROOT ) { +NL_SET_ERR_MSG (extack,"Cannot create traffic class with classid TC_H_ROOT" ); +return -EINVAL ; + } + new_cl = cl; err = -EOPNOTSUPP ;if (cops->change)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/279 netfilter: nft_exthdr: fix offset with ipv4_find_option()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kashavkin <[email protected]>
[ Upstream commit 6edd78af9506bb182518da7f6feebd75655d9a0e ]
There is an incorrect calculation in the offset variable which causes the nft_skb_copy_to_reg() function to always return -EFAULT. Adding the start variable is redundant. In the __ip_options_compile() function the correct offset is specified when finding the function. There is no need to add the size of the iphdr structure to the offset.
--- net/netfilter/nft_exthdr.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
net/netfilter/nft_exthdr.c +4 -6
@@ -85,7 +85,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb,unsigned char optbuf[sizeof (struct ip_options ) +40 ];struct ip_options *opt = (struct ip_options *)optbuf;struct iphdr *iph, _iph; -unsigned int start;bool found = false;__be32 info;int optlen;
@@ -93,7 +92,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, iph =skb_header_pointer (skb,0 ,sizeof (_iph), &_iph);if (!iph)return -EBADMSG ; - start =sizeof (struct iphdr ); optlen = iph->ihl *4 - (int )sizeof (struct iphdr );if (optlen <=0 )
@@ -103,7 +101,7 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb,/* Copy the options since __ip_options_compile() modifies * the options. */ -if (skb_copy_bits (skb, start, opt->__data, optlen)) +if (skb_copy_bits (skb,sizeof (struct iphdr ), opt->__data, optlen))return -EBADMSG ; opt->optlen = optlen;
@@ -118,18 +116,18 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, found = target ==IPOPT_SSRR ? opt->is_strictroute : !opt->is_strictroute;if (found) - *offset = opt->srr + start; + *offset = opt->srr;break ;case IPOPT_RR :if (!opt->rr)break ; - *offset = opt->rr + start; + *offset = opt->rr; found = true;break ;case IPOPT_RA :if (!opt->router_alert)break ; - *offset = opt->router_alert + start; + *offset = opt->router_alert; found = true;break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/279 gre: Fix IPv6 link-local address generation.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 183185a18ff96751db52a46ccf93fff3a1f42815 ]
Use addrconf_addr_gen() to generate IPv6 link-local addresses on GRE devices in most cases and fall back to using add_v4_addrs() only in case the GRE configuration is incompatible with addrconf_addr_gen().
GRE used to use addrconf_addr_gen() until commit e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address") restricted this use to gretap and ip6gretap devices, and created add_v4_addrs() (borrowed from SIT) for non-Ethernet GRE ones.
The original problem came when commit 9af28511be10 ("addrconf: refuse isatap eui64 for INADDR_ANY") made __ipv6_isatap_ifid() fail when its addr parameter was 0. The commit says that this would create an invalid address, however, I couldn't find any RFC saying that the generated interface identifier would be wrong. Anyway, since gre over IPv4 devices pass their local tunnel address to __ipv6_isatap_ifid(), that commit broke their IPv6 link-local address generation when the local address was unspecified.
Then commit e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address") tried to fix that case by defining add_v4_addrs() and calling it to generate the IPv6 link-local address instead of using addrconf_addr_gen() (apart for gretap and ip6gretap devices, which would still use the regular addrconf_addr_gen(), since they have a MAC address).
That broke several use cases because add_v4_addrs() isn't properly integrated into the rest of IPv6 Neighbor Discovery code. Several of these shortcomings have been fixed over time, but add_v4_addrs() remains broken on several aspects. In particular, it doesn't send any Router Sollicitations, so the SLAAC process doesn't start until the interface receives a Router Advertisement. Also, add_v4_addrs() mostly ignores the address generation mode of the interface (/proc/sys/net/ipv6/conf/*/addr_gen_mode), thus breaking the IN6_ADDR_GEN_MODE_RANDOM and IN6_ADDR_GEN_MODE_STABLE_PRIVACY cases.
Fix the situation by using add_v4_addrs() only in the specific scenario where the normal method would fail. That is, for interfaces that have all of the following characteristics:
* run over IPv4,
* transport IP packets directly, not Ethernet (that is, not gretap interfaces),
* tunnel endpoint is INADDR_ANY (that is, 0),
* device address generation mode is EUI64.
In all other cases, revert back to the regular addrconf_addr_gen().
Also, remove the special case for ip6gre interfaces in add_v4_addrs(), since ip6gre devices now always use addrconf_addr_gen() instead.
--- net/ipv6/addrconf.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/ipv6/addrconf.c +9 -6
@@ -3145,16 +3145,13 @@ static void add_v4_addrs(struct inet6_dev *idev)struct in6_addr addr;struct net_device *dev;struct net *net =dev_net (idev->dev); -int scope, plen, offset =0 ; +int scope, plen;u32 pflags =0 ;ASSERT_RTNL ();memset (&addr,0 ,sizeof (struct in6_addr )); -/* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */ -if (idev->dev->addr_len ==sizeof (struct in6_addr )) - offset =sizeof (struct in6_addr ) -4 ; -memcpy (&addr.s6_addr32[3 ], idev->dev->dev_addr + offset,4 ); +memcpy (&addr.s6_addr32[3 ], idev->dev->dev_addr,4 );if (!(idev->dev->flags &IFF_POINTOPOINT ) && idev->dev->type ==ARPHRD_SIT ) { scope = IPV6_ADDR_COMPATv4;
@@ -3462,7 +3459,13 @@ static void addrconf_gre_config(struct net_device *dev)return ; } -if (dev->type ==ARPHRD_ETHER ) { +/* Generate the IPv6 link-local address using addrconf_addr_gen(), +* unless we have an IPv4 GRE device not bound to an IP address and +* which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this +* case). Such devices fall back to add_v4_addrs() instead. +*/ +if (!(dev->type ==ARPHRD_IPGRE && *(__be32 *)dev->dev_addr ==0 && + idev->cnf.addr_gen_mode ==IN6_ADDR_GEN_MODE_EUI64 )) {addrconf_addr_gen (idev, true);return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/279 slab: clean up function prototypes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 72d67229f522e3331d1eabd9f58d36ae080eb228 ]
Based on feedback from Joe Perches and Linus Torvalds, regularize the slab function prototypes before making attribute changes.
Stable-dep-of: a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check")
--- include/linux/slab.h | 68 ++++++++++++++++++++++---------------------- 1 file changed, 34 insertions(+), 34 deletions(-)
include/linux/slab.h +34 -34
@@ -152,8 +152,8 @@ struct kmem_cache *kmem_cache_create_usercopy(const char *name,slab_flags_t flags, unsigned int useroffset, unsigned int usersize, void (*ctor)(void *)); -void kmem_cache_destroy (struct kmem_cache *); -int kmem_cache_shrink (struct kmem_cache *); +void kmem_cache_destroy (struct kmem_cache *s); +int kmem_cache_shrink (struct kmem_cache *s);/* * Please use this macro to create slab caches. Simply specify the
@@ -181,11 +181,11 @@ int kmem_cache_shrink(struct kmem_cache *);/* * Common kmalloc functions provided by all allocators */ -void *__must_check krealloc (const void *,size_t ,gfp_t ); -void kfree (const void *); -void kfree_sensitive (const void *); -size_t __ksize (const void *); -size_t ksize (const void *); +void *__must_check krealloc (const void *objp,size_t new_size,gfp_t flags); +void kfree (const void *objp); +void kfree_sensitive (const void *objp); +size_t __ksize (const void *objp); +size_t ksize (const void *objp);#ifdef CONFIG_PRINTK bool kmem_valid_obj (void *object);void kmem_dump_obj (void *object);
@@ -426,8 +426,8 @@ static __always_inline unsigned int __kmalloc_index(size_t size,#endif /* !CONFIG_SLOB */ void *__kmalloc (size_t size,gfp_t flags) __assume_kmalloc_alignment __malloc; -void *kmem_cache_alloc (struct kmem_cache *,gfp_t flags) __assume_slab_alignment __malloc; -void kmem_cache_free (struct kmem_cache *,void *); +void *kmem_cache_alloc (struct kmem_cache *s,gfp_t flags) __assume_slab_alignment __malloc; +void kmem_cache_free (struct kmem_cache *s,void *objp);/* * Bulk allocation and freeing operations. These are accelerated in an
@@ -436,8 +436,8 @@ void kmem_cache_free(struct kmem_cache *, void *);* * Note that interrupts must be enabled when calling these functions. */ -void kmem_cache_free_bulk (struct kmem_cache *,size_t ,void **); -int kmem_cache_alloc_bulk (struct kmem_cache *,gfp_t ,size_t ,void **); +void kmem_cache_free_bulk (struct kmem_cache *s,size_t size,void **p); +int kmem_cache_alloc_bulk (struct kmem_cache *s,gfp_t flags,size_t size,void **p);/* * Caller must not use kfree_bulk() on memory not originally allocated
@@ -450,7 +450,8 @@ static __always_inline void kfree_bulk(size_t size, void **p)#ifdef CONFIG_NUMA void *__kmalloc_node (size_t size,gfp_t flags,int node) __assume_kmalloc_alignment __malloc; -void *kmem_cache_alloc_node (struct kmem_cache *,gfp_t flags,int node) __assume_slab_alignment __malloc; +void *kmem_cache_alloc_node (struct kmem_cache *s,gfp_t flags,int node) __assume_slab_alignment + __malloc;#else static __always_inline void *__kmalloc_node(size_t size, gfp_t flags, int node) {
@@ -464,25 +465,24 @@ static __always_inline void *kmem_cache_alloc_node(struct kmem_cache *s, gfp_t f#endif #ifdef CONFIG_TRACING -extern void *kmem_cache_alloc_trace (struct kmem_cache *,gfp_t ,size_t ) __assume_slab_alignment __malloc; +extern void *kmem_cache_alloc_trace (struct kmem_cache *s,gfp_t flags,size_t size) + __assume_slab_alignment __malloc;#ifdef CONFIG_NUMA -extern void *kmem_cache_alloc_node_trace (struct kmem_cache *s, -gfp_t gfpflags, -int node,size_t size) __assume_slab_alignment __malloc; +extern void *kmem_cache_alloc_node_trace (struct kmem_cache *s,gfp_t gfpflags, +int node,size_t size) __assume_slab_alignment __malloc;#else -static __always_inline void * -kmem_cache_alloc_node_trace (struct kmem_cache *s, -gfp_t gfpflags, -int node,size_t size) +static __always_inline void *kmem_cache_alloc_node_trace(struct kmem_cache *s, +gfp_t gfpflags,int node, +size_t size) {return kmem_cache_alloc_trace (s, gfpflags, size); }#endif /* CONFIG_NUMA */ #else /* CONFIG_TRACING */ -static __always_inline void *kmem_cache_alloc_trace(struct kmem_cache *s, -gfp_t flags,size_t size) +static __always_inline void *kmem_cache_alloc_trace(struct kmem_cache *s, gfp_t flags, +size_t size) {void *ret =kmem_cache_alloc (s, flags);
@@ -490,10 +490,8 @@ static __always_inline void *kmem_cache_alloc_trace(struct kmem_cache *s,return ret; } -static __always_inline void * -kmem_cache_alloc_node_trace (struct kmem_cache *s, -gfp_t gfpflags, -int node,size_t size) +static __always_inline void *kmem_cache_alloc_node_trace(struct kmem_cache *s, gfp_t gfpflags, +int node,size_t size) {void *ret =kmem_cache_alloc_node (s, gfpflags, node);
@@ -502,13 +500,14 @@ kmem_cache_alloc_node_trace(struct kmem_cache *s, }#endif /* CONFIG_TRACING */ -extern void *kmalloc_order (size_t size,gfp_t flags,unsigned int order) __assume_page_alignment __malloc; +extern void *kmalloc_order (size_t size,gfp_t flags,unsigned int order) __assume_page_alignment + __malloc;#ifdef CONFIG_TRACING -extern void *kmalloc_order_trace (size_t size,gfp_t flags,unsigned int order) __assume_page_alignment __malloc; +extern void *kmalloc_order_trace (size_t size,gfp_t flags,unsigned int order) + __assume_page_alignment __malloc;#else -static __always_inline void * -kmalloc_order_trace (size_t size,gfp_t flags,unsigned int order) +static __always_inline void *kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order) {return kmalloc_order (size, flags, order); }
@@ -638,8 +637,8 @@ static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags)* @new_size: new size of a single member of the array * @flags: the type of memory to allocate (see kmalloc) */ -static __must_check inline void * -krealloc_array (void *p,size_t new_n,size_t new_size,gfp_t flags) +static inline void *__must_check krealloc_array (void *p,size_t new_n,size_t new_size, +gfp_t flags) {size_t bytes;
@@ -668,7 +667,7 @@ static inline void *kcalloc(size_t n, size_t size, gfp_t flags)* allocator where we care about the real place the memory allocation * request comes from. */ -extern void *__kmalloc_track_caller (size_t ,gfp_t ,unsigned long ); +extern void *__kmalloc_track_caller (size_t size,gfp_t flags,unsigned long caller);#define kmalloc_track_caller (size, flags) \ __kmalloc_track_caller(size, flags, _RET_IP_)
@@ -691,7 +690,8 @@ static inline void *kcalloc_node(size_t n, size_t size, gfp_t flags, int node)#ifdef CONFIG_NUMA -extern void *__kmalloc_node_track_caller (size_t ,gfp_t ,int ,unsigned long ); +extern void *__kmalloc_node_track_caller (size_t size,gfp_t flags,int node, +unsigned long caller);#define kmalloc_node_track_caller (size, flags, node) \ __kmalloc_node_track_caller(size, flags, node, \ _RET_IP_)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/279 slab: Introduce kmalloc_size_roundup()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 05a940656e1eb2026d9ee31019d5b47e9545124d ]
In the effort to help the compiler reason about buffer sizes, the __alloc_size attribute was added to allocators. This improves the scope of the compiler's ability to apply CONFIG_UBSAN_BOUNDS and (in the near future) CONFIG_FORTIFY_SOURCE. For most allocations, this works well, as the vast majority of callers are not expecting to use more memory than what they asked for.
There is, however, one common exception to this: anticipatory resizing of kmalloc allocations. These cases all use ksize() to determine the actual bucket size of a given allocation (e.g. 128 when 126 was asked for). This comes in two styles in the kernel:
1) An allocation has been determined to be too small, and needs to be resized. Instead of the caller choosing its own next best size, it wants to minimize the number of calls to krealloc(), so it just uses ksize() plus some additional bytes, forcing the realloc into the next bucket size, from which it can learn how large it is now. For example:
data = krealloc(data, ksize(data) + 1, gfp); data_len = ksize(data);
2) The minimum size of an allocation is calculated, but since it may grow in the future, just use all the space available in the chosen bucket immediately, to avoid needing to reallocate later. A good example of this is skbuff's allocators:
data = kmalloc_reserve(size, gfp_mask, node, &pfmemalloc);
...
/* kmalloc(size) might give us more room than requested.
* Put skb_shared_info exactly at the end of allocated zone,
* to allow max possible filling before reallocation.
*/
osize = ksize(data);
size = SKB_WITH_OVERHEAD(osize);In both cases, the "how much was actually allocated?" question is answered _after_ the allocation, where the compiler hinting is not in an easy place to make the association any more. This mismatch between the compiler's view of the buffer length and the code's intention about how much it is going to actually use has already caused problems[1]. It is possible to fix this by reordering the use of the "actual size" information.
We can serve the needs of users of ksize() and still have accurate buffer length hinting for the compiler by doing the bucket size calculation _before_ the allocation. Code can instead ask "how large an allocation would I get for a given size?".
Introduce kmalloc_size_roundup(), to serve this function so we can start replacing the "anticipatory resizing" uses of ksize().
[1] https://github.com/ClangBuiltLinux/linux/issues/1599
https://github.com/KSPP/linux/issues/183
[ [email protected]: add SLOB version ]
Stable-dep-of: a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check")
--- include/linux/slab.h | 31 +++++++++++++++++++++++++++++++ mm/slab.c | 9 ++++++--- mm/slab_common.c | 20 ++++++++++++++++++++ mm/slob.c | 14 ++++++++++++++ 4 files changed, 71 insertions(+), 3 deletions(-)
include/linux/slab.h +31 -0
@@ -185,7 +185,21 @@ void * __must_check krealloc(const void *objp, size_t new_size, gfp_t flags);void kfree (const void *objp);void kfree_sensitive (const void *objp);size_t __ksize (const void *objp); + +/** +* ksize - Report actual allocation size of associated object +* +* @objp: Pointer returned from a prior kmalloc()-family allocation. +* +* This should not be used for writing beyond the originally requested +* allocation size. Either use krealloc() or round up the allocation size +* with kmalloc_size_roundup() prior to allocation. If this is used to +* access beyond the originally requested allocation size, UBSAN_BOUNDS +* and/or FORTIFY_SOURCE may trip, since they only know about the +* originally allocated size via the __alloc_size attribute. +*/ size_t ksize (const void *objp); +#ifdef CONFIG_PRINTK bool kmem_valid_obj (void *object);void kmem_dump_obj (void *object);
@@ -733,6 +747,23 @@ static inline void *kzalloc_node(size_t size, gfp_t flags, int node) }unsigned int kmem_cache_size (struct kmem_cache *s); + +/** +* kmalloc_size_roundup - Report allocation bucket size for the given size +* +* @size: Number of bytes to round up from. +* +* This returns the number of bytes that would be available in a kmalloc() +* allocation of @size bytes. For example, a 126 byte request would be +* rounded up to the next sized kmalloc bucket, 128 bytes. (This is strictly +* for the general-purpose kmalloc()-based allocations, and is not for the +* pre-sized kmem_cache_alloc()-based allocations.) +* +* Use this to kmalloc() the full bucket size ahead of time instead of using +* ksize() to query the size after an allocation. +*/ +size_t kmalloc_size_roundup (size_t size); +void __init kmem_cache_init_late (void );#if defined(CONFIG_SMP ) && defined(CONFIG_SLAB )
mm/slab.c +6 -3
@@ -4226,11 +4226,14 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,#endif /* CONFIG_HARDENED_USERCOPY */ /** -* __ksize -- Uninstrumented ksize. +* __ksize -- Report full size of underlying allocation * @objp: pointer to the object * -* Unlike ksize(), __ksize() is uninstrumented, and does not provide the same -* safety checks as ksize() with KASAN instrumentation enabled. +* This should only be used internally to query the true size of allocations. +* It is not meant to be a way to discover the usable size of an allocation +* after the fact. Instead, use kmalloc_size_roundup(). Using memory beyond +* the originally requested allocation size may trigger KASAN, UBSAN_BOUNDS, +* and/or FORTIFY_SOURCE. * * Return: size of the actual memory used by @objp in bytes */
mm/slab_common.c +20 -0
@@ -758,6 +758,26 @@ struct kmem_cache *kmalloc_slab(size_t size, gfp_t flags)return kmalloc_caches[kmalloc_type (flags)][index]; } +size_t kmalloc_size_roundup (size_t size) +{ +struct kmem_cache *c; + +/* Short-circuit the 0 size case. */ +if (unlikely (size ==0 )) +return 0 ; +/* Short-circuit saturated "too-large" case. */ +if (unlikely (size ==SIZE_MAX )) +return SIZE_MAX ; +/* Above the smaller buckets, size is a multiple of page size. */ +if (size >KMALLOC_MAX_CACHE_SIZE ) +return PAGE_SIZE <<get_order (size); + +/* The flags don't matter since size_index is common to all. */ + c =kmalloc_slab (size,GFP_KERNEL ); +return c ? c->object_size :0 ; +} +EXPORT_SYMBOL (kmalloc_size_roundup); +#ifdef CONFIG_ZONE_DMA #define KMALLOC_DMA_NAME (sz) .name[KMALLOC_DMA] = "dma-kmalloc-" #sz,#else
mm/slob.c +14 -0
@@ -567,6 +567,20 @@ void kfree(const void *block) }EXPORT_SYMBOL (kfree); +size_t kmalloc_size_roundup (size_t size) +{ +/* Short-circuit the 0 size case. */ +if (unlikely (size ==0 )) +return 0 ; +/* Short-circuit saturated "too-large" case. */ +if (unlikely (size ==SIZE_MAX )) +return SIZE_MAX ; + +return ALIGN (size,ARCH_KMALLOC_MINALIGN ); +} + +EXPORT_SYMBOL (kmalloc_size_roundup); +/* can't use ksize for kmem_cache_alloc memory, only kmalloc */ size_t __ksize (const void *block) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/279 openvswitch: Use kmalloc_size_roundup() to match ksize() usage
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit ab3f7828c9793a5dfa99a54dc19ae3491c38bfa3 ]
Round up allocations with kmalloc_size_roundup() so that openvswitch's use of ksize() is always accurate and no special handling of the memory is needed by KASAN, UBSAN_BOUNDS, nor FORTIFY_SOURCE.
Stable-dep-of: a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check")
--- net/openvswitch/flow_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/openvswitch/flow_netlink.c +1 -1
@@ -2281,7 +2281,7 @@ static struct sw_flow_actions *nla_alloc_flow_actions(int size)WARN_ON_ONCE (size >MAX_ACTIONS_BUFSIZE ); - sfa =kmalloc (sizeof (*sfa) + size,GFP_KERNEL ); + sfa =kmalloc (kmalloc_size_roundup (sizeof (*sfa) + size),GFP_KERNEL );if (!sfa)return ERR_PTR (-ENOMEM );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/279 net: openvswitch: remove misbehaving actions length check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <[email protected]>
[ Upstream commit a1e64addf3ff9257b45b78bc7d743781c3f41340 ]
The actions length check is unreliable and produces different results depending on the initial length of the provided netlink attribute and the composition of the actual actions inside of it. For example, a user can add 4088 empty clone() actions without triggering -EMSGSIZE, on attempt to add 4089 such actions the operation will fail with the -EMSGSIZE verdict. However, if another 16 KB of other actions will be *appended* to the previous 4089 clone() actions, the check passes and the flow is successfully installed into the openvswitch datapath.
The reason for a such a weird behavior is the way memory is allocated. When ovs_flow_cmd_new() is invoked, it calls ovs_nla_copy_actions(), that in turn calls nla_alloc_flow_actions() with either the actual length of the user-provided actions or the MAX_ACTIONS_BUFSIZE. The function adds the size of the sw_flow_actions structure and then the actually allocated memory is rounded up to the closest power of two.
So, if the user-provided actions are larger than MAX_ACTIONS_BUFSIZE, then MAX_ACTIONS_BUFSIZE + sizeof(*sfa) rounded up is 32K + 24 -> 64K. Later, while copying individual actions, we look at ksize(), which is 64K, so this way the MAX_ACTIONS_BUFSIZE check is not actually triggered and the user can easily allocate almost 64 KB of actions.
However, when the initial size is less than MAX_ACTIONS_BUFSIZE, but the actions contain ones that require size increase while copying (such as clone() or sample()), then the limit check will be performed during the reserve_sfa_size() and the user will not be allowed to create actions that yield more than 32 KB internally.
This is one part of the problem. The other part is that it's not actually possible for the userspace application to know beforehand if the particular set of actions will be rejected or not.
Certain actions require more space in the internal representation, e.g. an empty clone() takes 4 bytes in the action list passed in by the user, but it takes 12 bytes in the internal representation due to an extra nested attribute, and some actions require less space in the internal representations, e.g. set(tunnel(..)) normally takes 64+ bytes in the action list provided by the user, but only needs to store a single pointer in the internal implementation, since all the data is stored in the tunnel_info structure instead.
And the action size limit is applied to the internal representation, not to the action list passed by the user. So, it's not possible for the userpsace application to predict if the certain combination of actions will be rejected or not, because it is not possible for it to calculate how much space these actions will take in the internal representation without knowing kernel internals.
All that is causing random failures in ovs-vswitchd in userspace and inability to handle certain traffic patterns as a result. For example, it is reported that adding a bit more than a 1100 VMs in an OpenStack setup breaks the network due to OVS not being able to handle ARP traffic anymore in some cases (it tries to install a proper datapath flow, but the kernel rejects it with -EMSGSIZE, even though the action list isn't actually that large.)
Kernel behavior must be consistent and predictable in order for the userspace application to use it in a reasonable way. ovs-vswitchd has a mechanism to re-direct parts of the traffic and partially handle it in userspace if the required action list is oversized, but that doesn't work properly if we can't actually tell if the action list is oversized or not.
Solution for this is to check the size of the user-provided actions instead of the internal representation. This commit just removes the check from the internal part because there is already an implicit size check imposed by the netlink protocol. The attribute can't be larger than 64 KB. Realistically, we could reduce the limit to 32 KB, but we'll be risking to break some existing setups that rely on the fact that it's possible to create nearly 64 KB action lists today.
Vast majority of flows in real setups are below 100-ish bytes. So removal of the limit will not change real memory consumption on the system. The absolutely worst case scenario is if someone adds a flow with 64 KB of empty clone() actions. That will yield a 192 KB in the internal representation consuming 256 KB block of memory. However, that list of actions is not meaningful and also a no-op. Real world very large action lists (that can occur for a rare cases of BUM traffic handling) are unlikely to contain a large number of clones and will likely have a lot of tunnel attributes making the internal representation comparable in size to the original action list. So, it should be fine to just remove the limit.
Commit in the 'Fixes' tag is the first one that introduced the difference between internal representation and the user-provided action lists, but there were many more afterwards that lead to the situation we have today.
--- net/openvswitch/flow_netlink.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-)
net/openvswitch/flow_netlink.c +1 -14
@@ -2273,14 +2273,10 @@ int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb) OVS_FLOW_ATTR_MASK, true, skb); } -#define MAX_ACTIONS_BUFSIZE (32 * 1024) -static struct sw_flow_actions *nla_alloc_flow_actions (int size) {struct sw_flow_actions *sfa; -WARN_ON_ONCE (size >MAX_ACTIONS_BUFSIZE ); - sfa =kmalloc (kmalloc_size_roundup (sizeof (*sfa) + size),GFP_KERNEL );if (!sfa)return ERR_PTR (-ENOMEM );
@@ -2436,15 +2432,6 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, new_acts_size =max (next_offset + req_size,ksize (*sfa) *2 ); -if (new_acts_size >MAX_ACTIONS_BUFSIZE ) { -if ((next_offset + req_size) >MAX_ACTIONS_BUFSIZE ) { -OVS_NLERR (log,"Flow action size exceeds max %u" , -MAX_ACTIONS_BUFSIZE ); -return ERR_PTR (-EMSGSIZE ); - } - new_acts_size =MAX_ACTIONS_BUFSIZE ; - } - acts =nla_alloc_flow_actions (new_acts_size);if (IS_ERR (acts))return (void *)acts;
@@ -3463,7 +3450,7 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,int err;u32 mpls_label_count =0 ; - *sfa =nla_alloc_flow_actions (min (nla_len (attr),MAX_ACTIONS_BUFSIZE )); + *sfa =nla_alloc_flow_actions (nla_len (attr));if (IS_ERR (*sfa))return PTR_ERR (*sfa);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/279 net/mlx5: Bridge, fix the crash caused by LAG state check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 4b8eeed4fb105770ce6dc84a2c6ef953c7b71cbb ]
When removing LAG device from bridge, NETDEV_CHANGEUPPER event is triggered. Driver finds the lower devices (PFs) to flush all the offloaded entries. And mlx5_lag_is_shared_fdb is checked, it returns false if one of PF is unloaded. In such case, mlx5_esw_bridge_lag_rep_get() and its caller return NULL, instead of the alive PF, and the flush is skipped.
Besides, the bridge fdb entry's lastuse is updated in mlx5 bridge event handler. But this SWITCHDEV_FDB_ADD_TO_BRIDGE event can be ignored in this case because the upper interface for bond is deleted, and the entry will never be aged because lastuse is never updated.
To make things worse, as the entry is alive, mlx5 bridge workqueue keeps sending that event, which is then handled by kernel bridge notifier. It causes the following crash when accessing the passed bond netdev which is already destroyed.
To fix this issue, remove such checks. LAG state is already checked in commit 15f8f168952f ("net/mlx5: Bridge, verify LAG state when adding bond to bridge"), driver still need to skip offload if LAG becomes invalid state after initialization.
Oops: stack segment: 0000 [#1] SMP CPU: 3 UID: 0 PID: 23695 Comm: kworker/u40:3 Tainted: G OE 6.11.0_mlnx #1 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_bridge_wq mlx5_esw_bridge_update_work [mlx5_core] RIP: 0010:br_switchdev_event+0x2c/0x110 [bridge] Code: 44 00 00 48 8b 02 48 f7 00 00 02 00 00 74 69 41 54 55 53 48 83 ec 08 48 8b a8 08 01 00 00 48 85 ed 74 4a 48 83 fe 02 48 89 d3 <4c> 8b 65 00 74 23 76 49 48 83 fe 05 74 7e 48 83 fe 06 75 2f 0f b7 RSP: 0018:ffffc900092cfda0 EFLAGS: 00010297 RAX: ffff888123bfe000 RBX: ffffc900092cfe08 RCX: 00000000ffffffff RDX: ffffc900092cfe08 RSI: 0000000000000001 RDI: ffffffffa0c585f0 RBP: 6669746f6e690a30 R08: 0000000000000000 R09: ffff888123ae92c8 R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888123ae9c60 R13: 0000000000000001 R14: ffffc900092cfe08 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f15914c8734 CR3: 0000000002830005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x1a/0x60 ? die+0x38/0x60 ? do_trap+0x10b/0x120 ? do_error_trap+0x64/0xa0 ? exc_stack_segment+0x33/0x50 ? asm_exc_stack_segment+0x22/0x30 ? br_switchdev_event+0x2c/0x110 [bridge] ? sched_balance_newidle.isra.149+0x248/0x390 notifier_call_chain+0x4b/0xa0 atomic_notifier_call_chain+0x16/0x20 mlx5_esw_bridge_update+0xec/0x170 [mlx5_core] mlx5_esw_bridge_update_work+0x19/0x40 [mlx5_core] process_scheduled_works+0x81/0x390 worker_thread+0x106/0x250 ? bh_worker+0x110/0x110 kthread+0xb7/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 </TASK>
--- .../net/ethernet/mellanox/mlx5/core/en/rep/bridge.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +5 -7
@@ -48,15 +48,10 @@ mlx5_esw_bridge_lag_rep_get(struct net_device *dev, struct mlx5_eswitch *esw)struct list_head *iter;netdev_for_each_lower_dev (dev, lower, iter) { -struct mlx5_core_dev *mdev; -struct mlx5e_priv *priv; -if (!mlx5e_eswitch_rep (lower))continue ; - priv =netdev_priv (lower); - mdev = priv->mdev; -if (mlx5_lag_is_shared_fdb (mdev) &&mlx5_esw_bridge_dev_same_esw (lower, esw)) +if (mlx5_esw_bridge_dev_same_esw (lower, esw))return lower; }
@@ -121,7 +116,7 @@ static bool mlx5_esw_bridge_is_local(struct net_device *dev, struct net_device * priv =netdev_priv (rep); mdev = priv->mdev;if (netif_is_lag_master (dev)) -return mlx5_lag_is_shared_fdb (mdev) &&mlx5_lag_is_master (mdev); +return mlx5_lag_is_master (mdev);return true; }
@@ -430,6 +425,9 @@ static int mlx5_esw_bridge_switchdev_event(struct notifier_block *nb,if (!rep)return NOTIFY_DONE ; +if (netif_is_lag_master (dev) && !mlx5_lag_is_shared_fdb (esw->dev)) +return NOTIFY_DONE ; +switch (event) {case SWITCHDEV_FDB_ADD_TO_BRIDGE : fdb_info = container_of(info,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/279 net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit e92df790d07a8eea873efcb84776e7b71f81c7d5 ]
mlx5_eswitch_get_vepa returns -EPERM if the device lacks eswitch_manager capability, blocking mlx5e_bridge_getlink from retrieving VEPA mode. Since mlx5e_bridge_getlink implements ndo_bridge_getlink, returning -EPERM causes bridge link show to fail instead of skipping devices without this capability.
To avoid this, return -EOPNOTSUPP from mlx5e_bridge_getlink when mlx5_eswitch_get_vepa fails, ensuring the command continues processing other devices while ignoring those without the necessary capability.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +2 -4
@@ -4186,11 +4186,9 @@ static int mlx5e_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,struct mlx5e_priv *priv =netdev_priv (dev);struct mlx5_core_dev *mdev = priv->mdev;u8 mode, setting; -int err; - err =mlx5_eswitch_get_vepa (mdev->priv.eswitch, &setting); -if (err) -return err; +if (mlx5_eswitch_get_vepa (mdev->priv.eswitch, &setting)) +return -EOPNOTSUPP ; mode = setting ?BRIDGE_MODE_VEPA :BRIDGE_MODE_VEB ; return ndo_dflt_bridge_getlink(skb, pid, seq, dev, mode,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/279 nvme-fc: go straight to connecting state when initializing
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit d3d380eded7ee5fc2fc53b3b0e72365ded025c4a ]
The initial controller initialization mimiks the reconnect loop behavior by switching from NEW to RESETTING and then to CONNECTING.
The transition from NEW to CONNECTING is a valid transition, so there is no point entering the RESETTING state. TCP and RDMA also transition directly to CONNECTING state.
--- drivers/nvme/host/fc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/nvme/host/fc.c +1 -2
@@ -3547,8 +3547,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,list_add_tail (&ctrl->ctrl_list, &rport->ctrl_list);spin_unlock_irqrestore (&rport->lock, flags); -if (!nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_RESETTING ) || - !nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_CONNECTING )) { +if (!nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_CONNECTING )) {dev_err (ctrl->ctrl.device,"NVME-FC{%d}: failed to init ctrl state\n" , ctrl->cnum); goto fail_ctrl;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/279 hrtimers: Mark is_migration_base() with __always_inline
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 27af31e44949fa85550176520ef7086a0d00fd7b ]
When is_migration_base() is unused, it prevents kernel builds with clang, make W=1 and CONFIG_WERROR=y:
kernel/time/hrtimer.c:156:20: error: unused function 'is_migration_base' [-Werror,-Wunused-function]
156 | static inline bool is_migration_base(struct hrtimer_clock_base *base)
| ^~~~~~~~~~~~~~~~~
Fix this by marking it with __always_inline.
[ tglx: Use __always_inline instead of __maybe_unused and move it into the
usage sites conditional ]
--- kernel/time/hrtimer.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
kernel/time/hrtimer.c +12 -10
@@ -144,11 +144,6 @@ static struct hrtimer_cpu_base migration_cpu_base = {#define migration_base migration_cpu_base.clock_base[0] -static inline bool is_migration_base (struct hrtimer_clock_base *base) -{ -return base == &migration_base; -} -/* * We are using hashed locking: holding per_cpu(hrtimer_bases)[n].lock * means that all timers which are tied to this base via timer->base are
@@ -273,11 +268,6 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base,#else /* CONFIG_SMP */ -static inline bool is_migration_base (struct hrtimer_clock_base *base) -{ -return false; -} -static inline struct hrtimer_clock_base *lock_hrtimer_base (const struct hrtimer *timer,unsigned long *flags) {
@@ -1377,6 +1367,18 @@ static void hrtimer_sync_wait_running(struct hrtimer_cpu_base *cpu_base, } } +#ifdef CONFIG_SMP +static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) +{ +return base == &migration_base; +} +#else +static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) +{ +return false; +} +#endif +/* * This function is called on PREEMPT_RT kernels when the fast path * deletion of a timer failed because the timer callback function was
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/279 powercap: call put_device() on an error path in powercap_register_control_type()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit 93c66fbc280747ea700bd6199633d661e3c819b3 ]
powercap_register_control_type() calls device_register(), but does not release the refcount of the device when it fails.
Call put_device() before returning an error to balance the refcount.
Since the kfree(control_type) will be done by powercap_release(), remove the lines in powercap_register_control_type() before returning the error.
This bug was found by an experimental verifier that I am developing.
--- drivers/powercap/powercap_sys.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/powercap/powercap_sys.c +1 -2
@@ -626,8 +626,7 @@ struct powercap_control_type *powercap_register_control_type(dev_set_name (&control_type->dev,"%s" , name); result =device_register (&control_type->dev);if (result) { -if (control_type->allocated) -kfree (control_type); +put_device (&control_type->dev);return ERR_PTR (result); }idr_init (&control_type->idr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/279 iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengen Du <[email protected]>
[ Upstream commit 07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 ]
When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message.
--- drivers/firmware/iscsi_ibft.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/firmware/iscsi_ibft.c +4 -1
@@ -310,7 +310,10 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf) str +=sprintf_ipaddr (str, nic->ip_addr);break ;case ISCSI_BOOT_ETH_SUBNET_MASK : - val =cpu_to_be32 (~((1 << (32 -nic->subnet_mask_prefix))-1 )); +if (nic->subnet_mask_prefix >32 ) + val =cpu_to_be32 (~0 ); +else + val =cpu_to_be32 (~((1 << (32 -nic->subnet_mask_prefix))-1 )); str +=sprintf (str,"%pI4" , &val);break ;case ISCSI_BOOT_ETH_PREFIX_LEN :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/279 scsi: core: Use GFP_NOIO to avoid circular locking dependency
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit 5363ee9d110e139584c2d92a0b640bc210588506 ]
Filesystems can write to disk from page reclaim with __GFP_FS set. Marc found a case where scsi_realloc_sdev_budget_map() ends up in page reclaim with GFP_KERNEL, where it could try to take filesystem locks again, leading to a deadlock.
WARNING: possible circular locking dependency detected
6.13.0 #1 Not tainted
------------------------------------------------------
kswapd0/70 is trying to acquire lock:ffff8881025d5d78 (&q->q_usage_counter(io)){++++}-{0:0}, at: blk_mq_submit_bio+0x461/0x6e0
but task is already holding lock:ffffffff81ef5f40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x9f/0x760
The full lockdep splat can be found in Marc's report:
https://lkml.org/lkml/2025/1/24/1101
Avoid the potential deadlock by doing the allocation with GFP_NOIO, which prevents both filesystem and block layer recursion.
--- drivers/scsi/scsi_scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/scsi_scan.c +1 -1
@@ -229,7 +229,7 @@ static int scsi_realloc_sdev_budget_map(struct scsi_device *sdev, } ret =sbitmap_init_node (&sdev->budget_map,scsi_device_max_queue_depth (sdev), - new_shift,GFP_KERNEL , + new_shift,GFP_NOIO , sdev->request_queue->node, false, true);if (!ret)sbitmap_resize (&sdev->budget_map, depth);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/279 scsi: qla1280: Fix kernel oops when debug level > 2
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <[email protected]>
[ Upstream commit 5233e3235dec3065ccc632729675575dbe3c6b8a ]
A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I think its clear from the code that the intention here is sg_dma_len(s) not length of sg_next(s) when printing the debug info.
--- drivers/scsi/qla1280.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla1280.c +1 -1
@@ -2875,7 +2875,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)dprintk (3 ,"S/G Segment phys_addr=%x %x, len=0x%x\n" ,cpu_to_le32 (upper_32_bits (dma_handle)),cpu_to_le32 (lower_32_bits (dma_handle)), -cpu_to_le32 (sg_dma_len (sg_next (s)))); +cpu_to_le32 (sg_dma_len (s))); remseg--; } dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather "
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/279 ACPI: resource: IRQ override for Eluktronics MECH-17
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gannon Kolding <[email protected]>
[ Upstream commit 607ab6f85f4194b644ea95ac5fe660ef575db3b4 ]
The Eluktronics MECH-17 (GM7RG7N) needs IRQ overriding for the keyboard to work.
Adding a DMI_MATCH entry for this laptop model makes the internal keyboard function normally.
--- drivers/acpi/resource.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/resource.c +6 -0
@@ -556,6 +556,12 @@ static const struct dmi_system_id maingear_laptop[] = { DMI_MATCH(DMI_BOARD_NAME, "RP-15"), }, }, + { + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Eluktronics Inc." ), + DMI_MATCH(DMI_BOARD_NAME, "MECH-17"), + }, + }, {/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/279 alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
[ Upstream commit b029628be267cba3c7684ec684749fe3e4372398 ]
Richard Henderson <[email protected]> writes[1]:
Quoted 11 lines
There was a Spec benchmark (I forget which) which was memory bound and ran twice as fast with 32-bit pointers.
I copied the idea from DEC to the ELF abi, but never did all the other work to allow the toolchain to take advantage.
Amusingly, a later Spec changed the benchmark data sets to not fit into a 32-bit address space, specifically because of this.
I expect one could delete the ELF bit and personality and no one would notice. Not even the 10 remaining Alpha users.
In [2] it was pointed out that parts of setarch weren't working properly on alpha because it has it's own SET_PERSONALITY implementation. In the discussion that followed Richard Henderson pointed out that the 32bit pointer support for alpha was never completed.
Fix this by removing alpha's 32bit pointer support.
As a bit of paranoia refuse to execute any alpha binaries that have the EF_ALPHA_32BIT flag set. Just in case someone somewhere has binaries that try to use alpha's 32bit pointer support.
--- arch/alpha/include/asm/elf.h | 6 +----- arch/alpha/include/asm/pgtable.h | 2 +- arch/alpha/include/asm/processor.h | 8 ++------ arch/alpha/kernel/osf_sys.c | 11 ++--------- 4 files changed, 6 insertions(+), 21 deletions(-)
arch/alpha/include/asm/elf.h +1 -5
@@ -74,7 +74,7 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];/* * This is used to ensure we don't load something for the wrong architecture. */ -#define elf_check_arch (x) ((x)->e_machine == EM_ALPHA) +#define elf_check_arch (x) (((x)->e_machine == EM_ALPHA) && !((x)->e_flags & EF_ALPHA_32BIT))/* * These are used to set parameters in the core dumps.
@@ -145,10 +145,6 @@ extern int dump_elf_task_fp(elf_fpreg_t *dest, struct task_struct *task); : amask (AMASK_CIX) ? "ev6" : "ev67"); \ }) -#define SET_PERSONALITY (EX ) \ - set_personality(((EX).e_flags & EF_ALPHA_32BIT) \ - ? PER_LINUX_32BIT : PER_LINUX) -extern int alpha_l1i_cacheshape;extern int alpha_l1d_cacheshape;extern int alpha_l2_cacheshape;
arch/alpha/include/asm/pgtable.h +1 -1
@@ -340,7 +340,7 @@ extern inline pte_t mk_swap_pte(unsigned long type, unsigned long offset)extern void paging_init (void ); -/* We have our own get_unmapped_area to cope with ADDR_LIMIT_32BIT. */ +/* We have our own get_unmapped_area */ #define HAVE_ARCH_UNMAPPED_AREA #endif /* _ALPHA_PGTABLE_H */
arch/alpha/include/asm/processor.h +2 -6
@@ -8,23 +8,19 @@ #ifndef __ASM_ALPHA_PROCESSOR_H #define __ASM_ALPHA_PROCESSOR_H -#include <linux/personality.h> /* for ADDR_LIMIT_32BIT */ - /* * We have a 42-bit user address space: 4TB user VM... */ #define TASK_SIZE (0x40000000000UL) -#define STACK_TOP \ - (current->personality & ADDR_LIMIT_32BIT ? 0x80000000 : 0x00120000000UL) +#define STACK_TOP (0x00120000000UL) #define STACK_TOP_MAX 0x00120000000UL /* This decides where the kernel will search for a free chunk of vm * space during mmap's. */ -#define TASK_UNMAPPED_BASE \ - ((current->personality & ADDR_LIMIT_32BIT) ? 0x40000000 : TASK_SIZE / 2) +#define TASK_UNMAPPED_BASE (TASK_SIZE / 2) typedef struct { unsigned long seg;
arch/alpha/kernel/osf_sys.c +2 -9
@@ -1212,8 +1212,7 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)return ret; } -/* Get an address range which is currently unmapped. Similar to the -generic version except that we know how to honor ADDR_LIMIT_32BIT. */ +/* Get an address range which is currently unmapped. */ static unsigned long arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
@@ -1235,13 +1234,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags) { - unsigned long limit; - -/* "32 bit" actually means 31 bit, since pointers sign extend. */ -if (current->personality &ADDR_LIMIT_32BIT ) - limit =0x80000000 ; -else - limit =TASK_SIZE ; + unsigned long limit = TASK_SIZE;if (len > limit)return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/279 vboxsf: fix building with GCC 15
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 4e7487245abcbc5a1a1aea54e4d3b33c53804bda ]
Building with GCC 15 results in build errorfs/vboxsf/super.c:24:54: error: initializer-string for array of ‘unsigned char’ is too long [-Werror=unterminated-string-initialization]
24 | static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375";
| ^~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
Due to GCC having enabled -Werror=unterminated-string-initialization[0] by default. Separately initializing each array element of VBSF_MOUNT_SIGNATURE to ensure NUL termination, thus satisfying GCC 15 and fixing the build error.
[0]: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wno-unterminated-string-initialization
--- fs/vboxsf/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/vboxsf/super.c +2 -1
@@ -21,7 +21,8 @@#define VBOXSF_SUPER_MAGIC 0x786f4256/* 'VBox' little endian */ -static const unsigned char VBSF_MOUNT_SIGNATURE [4 ] ="\000\377\376\375" ; +static const unsigned char VBSF_MOUNT_SIGNATURE [4 ] = {'\000' ,'\377' ,'\376' , +'\375' };static int follow_symlinks;module_param (follow_symlinks, int,0444 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/279 HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 4b54ae69197b9f416baa0fceadff7e89075f8454 ]
The timestamps in the Firmware log and HID sensor samples are incorrect. They show 1970-01-01 because the current IPC driver only uses the first 8 bytes of bootup time when synchronizing time with the firmware. The firmware converts the bootup time to UTC time, which results in the display of 1970-01-01.
In write_ipc_from_queue(), when sending the MNG_SYNC_FW_CLOCK message, the clock is updated according to the definition of ipc_time_update_msg. However, in _ish_sync_fw_clock(), the message length is specified as the size of uint64_t when building the doorbell. As a result, the firmware only receives the first 8 bytes of struct ipc_time_update_msg. This patch corrects the length in the doorbell to ensure the entire ipc_time_update_msg is sent, fixing the timestamp issue.
--- drivers/hid/intel-ish-hid/ipc/ipc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hid/intel-ish-hid/ipc/ipc.c +3 -3
@@ -577,14 +577,14 @@ static void fw_reset_work_fn(struct work_struct *unused)static void _ish_sync_fw_clock (struct ishtp_device *dev) {static unsigned long prev_sync; -uint64_t usec; +struct ipc_time_update_msg time = {};if (prev_sync && jiffies - prev_sync <20 *HZ )return ; prev_sync = jiffies; - usec =ktime_to_us (ktime_get_boottime ()); -ipc_send_mng_msg (dev,MNG_SYNC_FW_CLOCK , &usec,sizeof (uint64_t )); +/* The fields of time would be updated while sending message */ +ipc_send_mng_msg (dev,MNG_SYNC_FW_CLOCK , &time,sizeof (time)); }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/279 HID: ignore non-functional sensor in HP 5MP Camera
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chia-Lin Kao (AceLan) <[email protected]>
[ Upstream commit 363236d709e75610b628c2a4337ccbe42e454b6d ]
The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor.
[453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff
[453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff
Add this device to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -1037,6 +1037,7 @@#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008 +#define USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473 0x5473#define I2C_VENDOR_ID_RAYDIUM 0x2386#define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33
drivers/hid/hid-quirks.c +1 -0
@@ -871,6 +871,7 @@ static const struct hid_device_id hid_ignore_list[] = { { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DPAD) }, #endif { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, + { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, { } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/279 sched: Clarify wake_up_q()s write to task->wake_q.next
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
[ Upstream commit bcc6244e13b4d4903511a1ea84368abf925031c0 ]
Clarify that wake_up_q() does an atomic write to task->wake_q.next, after which a concurrent __wake_q_add() can immediately overwrite task->wake_q.next again.
--- kernel/sched/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/sched/core.c +3 -2
@@ -941,9 +941,10 @@ void wake_up_q(struct wake_q_head *head)struct task_struct *task; task = container_of(node, struct task_struct, wake_q); -/* Task can safely be re-inserted now: */ node = node->next; - task->wake_q.next =NULL ; +/* pairs with cmpxchg_relaxed() in __wake_q_add() */ +WRITE_ONCE (task->wake_q.next,NULL ); +/* Task can safely be re-inserted now. */ /* * wake_up_process() executes a full barrier, which pairs with
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/279 s390/cio: Fix CHPID "configure" attribute caching
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
[ Upstream commit 32ae4a2992529e2c7934e422035fad1d9b0f1fb5 ]
In some environments, the SCLP firmware interface used to query a CHPID's configured state is not supported. On these environments, rapidly reading the corresponding sysfs attribute produces inconsistent results:
$ cat /sys/devices/css0/chp0.00/configure cat: /sys/devices/css0/chp0.00/configure: Operation not supported $ cat /sys/devices/css0/chp0.00/configure 3
This occurs for example when Linux is run as a KVM guest. The inconsistency is a result of CIO using cached results for generating the value of the "configure" attribute while failing to handle the situation where no data was returned by SCLP.
Fix this by not updating the cache-expiration timestamp when SCLP returns no data. With the fix applied, the system response is consistent:
$ cat /sys/devices/css0/chp0.00/configure cat: /sys/devices/css0/chp0.00/configure: Operation not supported $ cat /sys/devices/css0/chp0.00/configure cat: /sys/devices/css0/chp0.00/configure: Operation not supported
--- drivers/s390/cio/chp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/s390/cio/chp.c +2 -1
@@ -661,7 +661,8 @@ static int info_update(void)if (time_after (jiffies, chp_info_expires)) {/* Data is too old, update. */ rc =sclp_chp_read_info (&chp_info); - chp_info_expires = jiffies +CHP_INFO_UPDATE_INTERVAL ; +if (!rc) + chp_info_expires = jiffies +CHP_INFO_UPDATE_INTERVAL ; }mutex_unlock (&info_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/279 thermal/cpufreq_cooling: Remove structure member documentation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit a6768c4f92e152265590371975d44c071a5279c7 ]
The structure member documentation refers to a member which does not exist any more. Remove it.
--- drivers/thermal/cpufreq_cooling.c | 2 -- 1 file changed, 2 deletions(-)
drivers/thermal/cpufreq_cooling.c +0 -2
@@ -56,8 +56,6 @@ struct time_in_idle {* @max_level: maximum cooling level. One less than total number of valid * cpufreq frequencies. * @em: Reference on the Energy Model of the device -* @cdev: thermal_cooling_device pointer to keep track of the -* registered cooling device. * @policy: cpufreq policy. * @idle_time: idle time stats * @qos_req: PM QoS contraint to apply
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/279 ASoC: rsnd: dont indicate warning on rsnd_kctrl_accept_runtime()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit c3fc002b206c6c83d1e3702b979733002ba6fb2c ]
rsnd_kctrl_accept_runtime() (1) is used for runtime convert rate (= Synchronous SRC Mode). Now, rsnd driver has 2 kctrls for it
(A): "SRC Out Rate Switch"
(B): "SRC Out Rate" // it calls (1)
(A): can be called anytime
(B): can be called only runtime, and will indicate warning if it was used
at non-runtime.
To use runtime convert rate (= Synchronous SRC Mode), user might uses command in below order.
(X): > amixer set "SRC Out Rate" on
> aplay xxx.wav &
(Y): > amixer set "SRC Out Rate" 48010 // convert rate to 48010Hz
(Y): calls B
(X): calls both A and B.
In this case, when user calls (X), it calls both (A) and (B), but it is not yet start running. So, (B) will indicate warning.
This warning was added by commit b5c088689847 ("ASoC: rsnd: add warning message to rsnd_kctrl_accept_runtime()"), but the message sounds like the operation was not correct. Let's update warning message.
The message is very SRC specific, implement it in src.c
--- sound/soc/sh/rcar/core.c | 14 -------------- sound/soc/sh/rcar/rsnd.h | 1 - sound/soc/sh/rcar/src.c | 18 +++++++++++++++++- 3 files changed, 17 insertions(+), 16 deletions(-)
sound/soc/sh/rcar/core.c +0 -14
@@ -1694,20 +1694,6 @@ int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io)return 1 ; } -int rsnd_kctrl_accept_runtime (struct rsnd_dai_stream *io) -{ -struct snd_pcm_runtime *runtime =rsnd_io_to_runtime (io); -struct rsnd_priv *priv =rsnd_io_to_priv (io); -struct device *dev =rsnd_priv_to_dev (priv); - -if (!runtime) { -dev_warn (dev,"Can't update kctrl when idle\n" ); -return 0 ; - } - -return 1 ; -} -struct rsnd_kctrl_cfg *rsnd_kctrl_init_m (struct rsnd_kctrl_cfg_m *cfg) { cfg->cfg.val = cfg->val;
sound/soc/sh/rcar/rsnd.h +0 -1
@@ -742,7 +742,6 @@ struct rsnd_kctrl_cfg_s {#define rsnd_kctrl_vals (x) ((x).val)/* = (x).cfg.val[0] */ int rsnd_kctrl_accept_anytime (struct rsnd_dai_stream *io); -int rsnd_kctrl_accept_runtime (struct rsnd_dai_stream *io);struct rsnd_kctrl_cfg *rsnd_kctrl_init_m (struct rsnd_kctrl_cfg_m *cfg);struct rsnd_kctrl_cfg *rsnd_kctrl_init_s (struct rsnd_kctrl_cfg_s *cfg); int rsnd_kctrl_new(struct rsnd_mod *mod,
sound/soc/sh/rcar/src.c +17 -1
@@ -530,6 +530,22 @@ static irqreturn_t rsnd_src_interrupt(int irq, void *data)return IRQ_HANDLED ; } +static int rsnd_src_kctrl_accept_runtime (struct rsnd_dai_stream *io) +{ +struct snd_pcm_runtime *runtime =rsnd_io_to_runtime (io); + +if (!runtime) { +struct rsnd_priv *priv =rsnd_io_to_priv (io); +struct device *dev =rsnd_priv_to_dev (priv); + +dev_warn (dev,"\"SRC Out Rate\" can use during running\n" ); + +return 0 ; + } + +return 1 ; +} +static int rsnd_src_probe_ (struct rsnd_mod *mod,struct rsnd_dai_stream *io,struct rsnd_priv *priv)
@@ -593,7 +609,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod,rsnd_io_is_play (io) ?"SRC Out Rate" :"SRC In Rate" , - rsnd_kctrl_accept_runtime, + rsnd_src_kctrl_accept_runtime, rsnd_src_set_convert_rate, &src->sync, 192000);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/279 ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Rodionov <[email protected]>
[ Upstream commit 679074942c2502a95842a80471d8fb718165ac77 ]
Using fsleep instead of msleep resolves some customer complaints regarding the precision of up/down DAPM event timing. fsleep() automatically selects the appropriate sleep function, making the delay time more predictable.
--- sound/soc/codecs/arizona.c | 14 +++++++------- sound/soc/codecs/madera.c | 10 +++++----- sound/soc/codecs/wm5110.c | 8 ++++---- 3 files changed, 16 insertions(+), 16 deletions(-)
sound/soc/codecs/arizona.c +7 -7
@@ -967,7 +967,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,case ARIZONA_OUT3L_ENA_SHIFT :case ARIZONA_OUT3R_ENA_SHIFT : priv->out_up_pending++; - priv->out_up_delay +=17 ; + priv->out_up_delay +=17000 ;break ;case ARIZONA_OUT4L_ENA_SHIFT :case ARIZONA_OUT4R_ENA_SHIFT :
@@ -977,7 +977,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,case WM8997 :break ;default : - priv->out_up_delay +=10 ; + priv->out_up_delay +=10000 ;break ; }break ;
@@ -999,7 +999,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,if (!priv->out_up_pending && priv->out_up_delay) {dev_dbg (component->dev,"Power up delay: %d\n" , priv->out_up_delay); -msleep (priv->out_up_delay); +fsleep (priv->out_up_delay); priv->out_up_delay =0 ; }break ;
@@ -1017,7 +1017,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,case ARIZONA_OUT3L_ENA_SHIFT :case ARIZONA_OUT3R_ENA_SHIFT : priv->out_down_pending++; - priv->out_down_delay++; + priv->out_down_delay +=1000 ;break ;case ARIZONA_OUT4L_ENA_SHIFT :case ARIZONA_OUT4R_ENA_SHIFT :
@@ -1028,10 +1028,10 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,break ;case WM8998 :case WM1814 : - priv->out_down_delay +=5 ; + priv->out_down_delay +=5000 ;break ;default : - priv->out_down_delay++; + priv->out_down_delay +=1000 ;break ; }break ;
@@ -1053,7 +1053,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,if (!priv->out_down_pending && priv->out_down_delay) {dev_dbg (component->dev,"Power down delay: %d\n" , priv->out_down_delay); -msleep (priv->out_down_delay); +fsleep (priv->out_down_delay); priv->out_down_delay =0 ; }break ;
sound/soc/codecs/madera.c +5 -5
@@ -2322,10 +2322,10 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case CS42L92 :case CS47L92 :case CS47L93 : - out_up_delay =6 ; + out_up_delay =6000 ;break ;default : - out_up_delay =17 ; + out_up_delay =17000 ;break ; }
@@ -2356,7 +2356,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case MADERA_OUT3R_ENA_SHIFT : priv->out_up_pending--;if (!priv->out_up_pending) { -msleep (priv->out_up_delay); +fsleep (priv->out_up_delay); priv->out_up_delay =0 ; }break ;
@@ -2375,7 +2375,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case MADERA_OUT3L_ENA_SHIFT :case MADERA_OUT3R_ENA_SHIFT : priv->out_down_pending++; - priv->out_down_delay++; + priv->out_down_delay +=1000 ;break ;default :break ;
@@ -2392,7 +2392,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case MADERA_OUT3R_ENA_SHIFT : priv->out_down_pending--;if (!priv->out_down_pending) { -msleep (priv->out_down_delay); +fsleep (priv->out_down_delay); priv->out_down_delay =0 ; }break ;
sound/soc/codecs/wm5110.c +4 -4
@@ -302,7 +302,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) }else { wseq = wm5110_no_dre_left_enable; nregs =ARRAY_SIZE (wm5110_no_dre_left_enable); - priv->out_up_delay +=10 ; + priv->out_up_delay +=10000 ; }break ;case ARIZONA_OUT1R_ENA_SHIFT :
@@ -312,7 +312,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) }else { wseq = wm5110_no_dre_right_enable; nregs =ARRAY_SIZE (wm5110_no_dre_right_enable); - priv->out_up_delay +=10 ; + priv->out_up_delay +=10000 ; }break ;default :
@@ -338,7 +338,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w)snd_soc_component_update_bits (component,ARIZONA_SPARE_TRIGGERS ,ARIZONA_WS_TRG1 ,0 ); - priv->out_down_delay +=27 ; + priv->out_down_delay +=27000 ; }break ;case ARIZONA_OUT1R_ENA_SHIFT :
@@ -350,7 +350,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w)snd_soc_component_update_bits (component,ARIZONA_SPARE_TRIGGERS ,ARIZONA_WS_TRG2 ,0 ); - priv->out_down_delay +=27 ; + priv->out_down_delay +=27000 ; }break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/279 ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Cheong <[email protected]>
[ Upstream commit 33b7dc7843dbdc9b90c91d11ba30b107f9138ffd ]
In enviornment without KMOD requesting module may fail to load snd-hda-codec-hdmi, resulting in HDMI audio not usable.
Add softdep to loading HDMI codec module first to ensure we can load it correctly.
--- sound/soc/sof/intel/hda-codec.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/sof/intel/hda-codec.c +1 -0
@@ -258,6 +258,7 @@ int hda_codec_i915_exit(struct snd_sof_dev *sdev) }EXPORT_SYMBOL_NS (hda_codec_i915_exit,SND_SOC_SOF_HDA_AUDIO_CODEC_I915 ); +MODULE_SOFTDEP ("pre: snd-hda-codec-hdmi" );#endif MODULE_LICENSE ("Dual BSD/GPL" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/279 net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit 0d1fac6d26aff5df21bb4ec980d9b7a11c410b96 ]
When using the Qualcomm X55 modem on the ThinkPad X13s, the kernel log is constantly being filled with errors related to a "sequence number glitch", e.g.:
[ 1903.284538] sequence number glitch prev=16 curr=0 [ 1913.812205] sequence number glitch prev=50 curr=0 [ 1923.698219] sequence number glitch prev=142 curr=0 [ 2029.248276] sequence number glitch prev=1555 curr=0 [ 2046.333059] sequence number glitch prev=70 curr=0 [ 2076.520067] sequence number glitch prev=272 curr=0 [ 2158.704202] sequence number glitch prev=2655 curr=0 [ 2218.530776] sequence number glitch prev=2349 curr=0 [ 2225.579092] sequence number glitch prev=6 curr=0
Internet connectivity is working fine, so this error seems harmless. It looks like modem does not preserve the sequence number when entering low power state; the amount of errors depends on how actively the modem is being used.
A similar issue has also been seen on USB-based MBIM modems [1]. However, in cdc_ncm.c the "sequence number glitch" message is a debug message instead of an error. Apply the same to the mhi_wwan_mbim.c driver to silence these errors when using the modem.
[1]: https://lists.freedesktop.org/archives/libmbim-devel/2016-November/000781.html
--- drivers/net/wwan/mhi_wwan_mbim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wwan/mhi_wwan_mbim.c +1 -1
@@ -209,7 +209,7 @@ static int mbim_rx_verify_nth16(struct mhi_mbim_context *mbim, struct sk_buff *sif (mbim->rx_seq +1 !=le16_to_cpu (nth16->wSequence) && (mbim->rx_seq ||le16_to_cpu (nth16->wSequence)) && !(mbim->rx_seq ==0xffff && !le16_to_cpu (nth16->wSequence))) { -net_err_ratelimited ("sequence number glitch prev=%d curr=%d\n" , +net_dbg_ratelimited ("sequence number glitch prev=%d curr=%d\n" , mbim->rx_seq,le16_to_cpu (nth16->wSequence)); } mbim->rx_seq =le16_to_cpu (nth16->wSequence);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/279 nvmet-rdma: recheck queue state is LIVE in state lock in recv done
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruozhu Li <[email protected]>
[ Upstream commit 3988ac1c67e6e84d2feb987d7b36d5791174b3da ]
The queue state checking in nvmet_rdma_recv_done is not in queue state lock.Queue state can transfer to LIVE in cm establish handler between state checking and state lock here, cause a silent drop of nvme connect cmd.
Recheck queue state whether in LIVE state in state lock to prevent this issue.
--- drivers/nvme/target/rdma.c | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-)
drivers/nvme/target/rdma.c +23 -10
@@ -996,6 +996,27 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue,nvmet_req_complete (&cmd->req, status); } +static bool nvmet_rdma_recv_not_live (struct nvmet_rdma_queue *queue, +struct nvmet_rdma_rsp *rsp) +{ +unsigned long flags; +bool ret = true; + +spin_lock_irqsave (&queue->state_lock, flags); +/* +* recheck queue state is not live to prevent a race condition +* with RDMA_CM_EVENT_ESTABLISHED handler. +*/ +if (queue->state ==NVMET_RDMA_Q_LIVE ) + ret = false; +else if (queue->state ==NVMET_RDMA_Q_CONNECTING ) +list_add_tail (&rsp->wait_list, &queue->rsp_wait_list); +else +nvmet_rdma_put_rsp (rsp); +spin_unlock_irqrestore (&queue->state_lock, flags); +return ret; +} +static void nvmet_rdma_recv_done (struct ib_cq *cq,struct ib_wc *wc) { struct nvmet_rdma_cmd *cmd =
@@ -1037,17 +1058,9 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) rsp->req.port = queue->port; rsp->n_rdma =0 ; -if (unlikely (queue->state !=NVMET_RDMA_Q_LIVE )) { -unsigned long flags; - -spin_lock_irqsave (&queue->state_lock, flags); -if (queue->state ==NVMET_RDMA_Q_CONNECTING ) -list_add_tail (&rsp->wait_list, &queue->rsp_wait_list); -else -nvmet_rdma_put_rsp (rsp); -spin_unlock_irqrestore (&queue->state_lock, flags); +if (unlikely (queue->state !=NVMET_RDMA_Q_LIVE ) && +nvmet_rdma_recv_not_live (queue, rsp))return ; - }nvmet_rdma_handle_command (queue, rsp); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/279 sctp: Fix undefined behavior in left shift operation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu-Chun Lin <[email protected]>
[ Upstream commit 606572eb22c1786a3957d24307f5760bb058ca19 ]
According to the C11 standard (ISO/IEC 9899:2011, 6.5.7):
"If E1 has a signed type and E1 x 2^E2 is not representable in the result type, the behavior is undefined."
Shifting 1 << 31 causes signed integer overflow, which leads to undefined behavior.
Fix this by explicitly using '1U << 31' to ensure the shift operates on an unsigned type, avoiding undefined behavior.
--- net/sctp/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/stream.c +1 -1
@@ -735,7 +735,7 @@ struct sctp_chunk *sctp_process_strreset_tsnreq(* value SHOULD be the smallest TSN not acknowledged by the * receiver of the request plus 2^31. */ - init_tsn =sctp_tsnmap_get_ctsn (&asoc->peer.tsn_map) + (1 <<31 ); + init_tsn =sctp_tsnmap_get_ctsn (&asoc->peer.tsn_map) + (1U <<31 );sctp_tsnmap_init (&asoc->peer.tsn_map,SCTP_TSN_MAP_INITIAL , init_tsn,GFP_ATOMIC );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/279 nvme: only allow entering LIVE from CONNECTING state
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit d2fe192348f93fe3a0cb1e33e4aba58e646397f4 ]
The fabric transports and also the PCI transport are not entering the LIVE state from NEW or RESETTING. This makes the state machine more restrictive and allows to catch not supported state transitions, e.g. directly switching from RESETTING to LIVE.
--- drivers/nvme/host/core.c | 2 -- 1 file changed, 2 deletions(-)
drivers/nvme/host/core.c +0 -2
@@ -444,8 +444,6 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,switch (new_state) {case NVME_CTRL_LIVE :switch (old_state) { -case NVME_CTRL_NEW : -case NVME_CTRL_RESETTING :case NVME_CTRL_CONNECTING : changed = true; fallthrough;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/279 ASoC: tas2770: Fix volume scale
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit 579cd64b9df8a60284ec3422be919c362de40e41 ]
The scale starts at -100dB, not -128dB.
--- sound/soc/codecs/tas2770.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2770.c +1 -1
@@ -508,7 +508,7 @@ static int tas2770_codec_probe(struct snd_soc_component *component) } static DECLARE_TLV_DB_SCALE(tas2770_digital_tlv, 1100, 50, 0); -static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -12750, 50, 0); +static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -10050, 50, 0);static const struct snd_kcontrol_new tas2770_snd_controls[] = { SOC_SINGLE_TLV("Speaker Playback Volume", TAS2770_PLAY_CFG_REG2,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/279 ASoC: tas2764: Fix power control mask
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit a3f172359e22b2c11b750d23560481a55bf86af1 ]
--- sound/soc/codecs/tas2764.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2764.h +1 -1
@@ -25,7 +25,7 @@/* Power Control */ #define TAS2764_PWR_CTRL TAS2764_REG(0X0, 0x02) -#define TAS2764_PWR_CTRL_MASK GENMASK(1, 0) +#define TAS2764_PWR_CTRL_MASK GENMASK(2, 0)#define TAS2764_PWR_CTRL_ACTIVE 0x0#define TAS2764_PWR_CTRL_MUTE BIT(0)#define TAS2764_PWR_CTRL_SHUTDOWN BIT(1)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/279 ASoC: tas2764: Set the SDOUT polarity correctly
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit f5468beeab1b1adfc63c2717b1f29ef3f49a5fab ]
TX launch polarity needs to be the opposite of RX capture polarity, to generate the right bit slot alignment.
--- sound/soc/codecs/tas2764.c | 10 +++++++++- sound/soc/codecs/tas2764.h | 6 ++++++ 2 files changed, 15 insertions(+), 1 deletion(-)
sound/soc/codecs/tas2764.c +9 -1
@@ -315,7 +315,7 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) {struct snd_soc_component *component = dai->component;struct tas2764_priv *tas2764 =snd_soc_component_get_drvdata (component); -u8 tdm_rx_start_slot =0 , asi_cfg_0 =0 , asi_cfg_1 =0 ; +u8 tdm_rx_start_slot =0 , asi_cfg_0 =0 , asi_cfg_1 =0 , asi_cfg_4 =0 ;int ret;switch (fmt &SND_SOC_DAIFMT_INV_MASK ) {
@@ -324,12 +324,14 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) fallthrough;case SND_SOC_DAIFMT_NB_NF : asi_cfg_1 =TAS2764_TDM_CFG1_RX_RISING ; + asi_cfg_4 =TAS2764_TDM_CFG4_TX_FALLING ;break ;case SND_SOC_DAIFMT_IB_IF : asi_cfg_0 ^=TAS2764_TDM_CFG0_FRAME_START ; fallthrough;case SND_SOC_DAIFMT_IB_NF : asi_cfg_1 =TAS2764_TDM_CFG1_RX_FALLING ; + asi_cfg_4 =TAS2764_TDM_CFG4_TX_RISING ;break ; }
@@ -339,6 +341,12 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)if (ret <0 )return ret; + ret =snd_soc_component_update_bits (component,TAS2764_TDM_CFG4 , +TAS2764_TDM_CFG4_TX_MASK , + asi_cfg_4); +if (ret <0 ) +return ret; +switch (fmt &SND_SOC_DAIFMT_FORMAT_MASK ) {case SND_SOC_DAIFMT_I2S : asi_cfg_0 ^=TAS2764_TDM_CFG0_FRAME_START ;
sound/soc/codecs/tas2764.h +6 -0
@@ -75,6 +75,12 @@#define TAS2764_TDM_CFG3_RXS_SHIFT 0x4#define TAS2764_TDM_CFG3_MASK GENMASK(3, 0) +/* TDM Configuration Reg4 */ +#define TAS2764_TDM_CFG4 TAS2764_REG(0X0, 0x0d) +#define TAS2764_TDM_CFG4_TX_MASK BIT(0) +#define TAS2764_TDM_CFG4_TX_RISING 0x0 +#define TAS2764_TDM_CFG4_TX_FALLING BIT(0) +/* TDM Configuration Reg5 */ #define TAS2764_TDM_CFG5 TAS2764_REG(0X0, 0x0e)#define TAS2764_TDM_CFG5_VSNS_MASK BIT(6)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/279 fuse: dont truncate cached, mutated symlink
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
[ Upstream commit b4c173dfbb6c78568578ff18f9e8822d7bd0e31b ]
Fuse allows the value of a symlink to change and this property is exploited by some filesystems (e.g. CVMFS).
It has been observed, that sometimes after changing the symlink contents, the value is truncated to the old size.
This is caused by fuse_getattr() racing with fuse_reverse_inval_inode(). fuse_reverse_inval_inode() updates the fuse_inode's attr_version, which results in fuse_change_attributes() exiting before updating the cached attributes
This is okay, as the cached attributes remain invalid and the next call to fuse_change_attributes() will likely update the inode with the correct values.
The reason this causes problems is that cached symlinks will be returned through page_get_link(), which truncates the symlink to inode->i_size. This is correct for filesystems that don't mutate symlinks, but in this case it causes bad behavior.
The solution is to just remove this truncation. This can cause a regression in a filesystem that relies on supplying a symlink larger than the file size, but this is unlikely. If that happens we'd need to make this behavior conditional.
--- fs/fuse/dir.c | 2 +- fs/namei.c | 24 +++++++++++++++++++----- include/linux/fs.h | 2 ++ 3 files changed, 22 insertions(+), 6 deletions(-)
fs/fuse/dir.c +1 -1
@@ -1333,7 +1333,7 @@ static const char *fuse_get_link(struct dentry *dentry, struct inode *inode, goto out_err;if (fc->cache_symlinks) -return page_get_link (dentry, inode, callback); +return page_get_link_raw (dentry, inode, callback); err = -ECHILD ;if (!dentry)
fs/namei.c +19 -5
@@ -5114,10 +5114,9 @@ const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)EXPORT_SYMBOL (vfs_get_link);/* get the link contents into pagecache */ -const char *page_get_link (struct dentry *dentry,struct inode *inode, -struct delayed_call *callback) +static char *__page_get_link (struct dentry *dentry,struct inode *inode, +struct delayed_call *callback) { -char *kaddr;struct page *page;struct address_space *mapping = inode->i_mapping;
@@ -5136,8 +5135,23 @@ const char *page_get_link(struct dentry *dentry, struct inode *inode, }set_delayed_call (callback, page_put_link, page);BUG_ON (mapping_gfp_mask (mapping) & __GFP_HIGHMEM); - kaddr =page_address (page); -nd_terminate_link (kaddr, inode->i_size,PAGE_SIZE -1 ); +return page_address (page); +} + +const char *page_get_link_raw (struct dentry *dentry,struct inode *inode, +struct delayed_call *callback) +{ +return __page_get_link (dentry, inode, callback); +} +EXPORT_SYMBOL_GPL (page_get_link_raw); + +const char *page_get_link (struct dentry *dentry,struct inode *inode, +struct delayed_call *callback) +{ +char *kaddr =__page_get_link (dentry, inode, callback); + +if (!IS_ERR (kaddr)) +nd_terminate_link (kaddr, inode->i_size,PAGE_SIZE -1 );return kaddr; }
include/linux/fs.h +2 -0
@@ -3387,6 +3387,8 @@ extern const struct file_operations generic_ro_fops;extern int readlink_copy (char __user *,int ,const char *);extern int page_readlink (struct dentry *,char __user *,int ); +extern const char *page_get_link_raw (struct dentry *,struct inode *, +struct delayed_call *);extern const char *page_get_link (struct dentry *,struct inode *,struct delayed_call *);extern void page_put_link (void *);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/279 x86/irq: Define trace events conditionally
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 9de7695925d5d2d2085681ba935857246eb2817d ]
When both of X86_LOCAL_APIC and X86_THERMAL_VECTOR are disabled, the irq tracing produces a W=1 build warning for the tracing definitions:
In file included from include/trace/trace_events.h:27,
from include/trace/define_trace.h:113,
from arch/x86/include/asm/trace/irq_vectors.h:383,
from arch/x86/kernel/irq.c:29: include/trace/stages/init.h:2:23: error: 'str__irq_vectors__trace_system_name' defined but not used [-Werror=unused-const-variable=]
Make the tracepoints conditional on the same symbosl that guard their usage.
--- arch/x86/kernel/irq.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kernel/irq.c +2 -0
@@ -23,8 +23,10 @@#include <asm/traps.h> #include <asm/thermal.h> +#if defined(CONFIG_X86_LOCAL_APIC ) || defined(CONFIG_X86_THERMAL_VECTOR )#define CREATE_TRACE_POINTS #include <asm/trace/irq_vectors.h> +#endif DEFINE_PER_CPU_SHARED_ALIGNED (irq_cpustat_t, irq_stat);EXPORT_PER_CPU_SYMBOL (irq_stat);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/279 mptcp: safety check before fallback
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit db75a16813aabae3b78c06b1b99f5e314c1f55d3 ]
Recently, some fallback have been initiated, while the connection was not supposed to fallback.
Add a safety check with a warning to detect when an wrong attempt to fallback is being done. This should help detecting any future issues quicker.
--- net/mptcp/protocol.h | 2 ++ 1 file changed, 2 insertions(+)
net/mptcp/protocol.h +2 -0
@@ -872,6 +872,8 @@ static inline void __mptcp_do_fallback(struct mptcp_sock *msk)pr_debug ("TCP fallback already done (msk=%p)\n" , msk);return ; } +if (WARN_ON_ONCE (!READ_ONCE (msk->allow_infinite_fallback))) +return ;set_bit (MPTCP_FALLBACK_DONE , &msk->flags); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/279 drm/nouveau: Do not override forced connector status
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 01f1d77a2630e774ce33233c4e6723bca3ae9daa ]
Keep user-forced connector status even if it cannot be programmed. Same behavior as for the rest of the drivers.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_connector.c +0 -1
@@ -754,7 +754,6 @@ nouveau_connector_force(struct drm_connector *connector)if (!nv_encoder) {NV_ERROR (drm,"can't find encoder to force %s on!\n" , connector->name); - connector->status = connector_status_disconnected;return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/279 block: fix kmem_cache of name bio-108 already exists
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit b654f7a51ffb386131de42aa98ed831f8c126546 ]
Device mapper bioset often has big bio_slab size, which can be more than 1000, then 8byte can't hold the slab name any more, cause the kmem_cache allocation warning of 'kmem_cache of name 'bio-108' already exists'.
Fix the warning by extending bio_slab->name to 12 bytes, but fix output of /proc/slabinfo
--- block/bio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bio.c +1 -1
@@ -73,7 +73,7 @@ struct bio_slab {struct kmem_cache *slab;unsigned int slab_ref;unsigned int slab_size; -char name[8 ]; +char name[12 ]; };static DEFINE_MUTEX (bio_slab_lock);static DEFINE_XARRAY (bio_slabs);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/279 USB: serial: ftdi_sio: add support for Altera USB Blaster 3
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boon Khai Ng <[email protected]>
commit 18e0885bd2ca738407036434418a26a58394a60e upstream.
The Altera USB Blaster 3, available as both a cable and an on-board solution, is primarily used for programming and debugging FPGAs.
It interfaces with host software such as Quartus Programmer, System Console, SignalTap, and Nios Debugger. The device utilizes either an FT2232 or FT4232 chip.
Enabling the support for various configurations of the on-board USB Blaster 3 by including the appropriate VID/PID pairs, allowing it to function as a serial device via ftdi_sio.
Note that this check-in does not include support for the cable solution, as it does not support UART functionality. The supported configurations are determined by the hardware design and include:
1) PID 0x6022, FT2232, 1 JTAG port (Port A) + Port B as UART
2) PID 0x6025, FT4232, 1 JTAG port (Port A) + Port C as UART
3) PID 0x6026, FT4232, 1 JTAG port (Port A) + Port C, D as UART
4) PID 0x6029, FT4232, 1 JTAG port (Port B) + Port C as UART
5) PID 0x602a, FT4232, 1 JTAG port (Port B) + Port C, D as UART
6) PID 0x602c, FT4232, 1 JTAG port (Port A) + Port B as UART
7) PID 0x602d, FT4232, 1 JTAG port (Port A) + Port B, C as UART
8) PID 0x602e, FT4232, 1 JTAG port (Port A) + Port B, C, D as UART
These configurations allow for flexibility in how the USB Blaster 3 is used, depending on the specific needs of the hardware design.
--- drivers/usb/serial/ftdi_sio.c | 14 ++++++++++++++ drivers/usb/serial/ftdi_sio_ids.h | 13 +++++++++++++ 2 files changed, 27 insertions(+)
drivers/usb/serial/ftdi_sio.c +14 -0
@@ -1057,6 +1057,20 @@ static const struct usb_device_id id_tab .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },/* GMC devices */ { USB_DEVICE(GMC_VID, GMC_Z216C_PID) }, +/* Altera USB Blaster 3 */ + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6022_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6025_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 3) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6029_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 3) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602C_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 2) }, + { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) }, { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +13 -0
@@ -1605,3 +1605,16 @@*/ #define GMC_VID 0x1cd7#define GMC_Z216C_PID 0x0217/* GMC Z216C Adapter IR-USB */ + +/* +* Altera USB Blaster 3 (http://www.altera.com). +*/ +#define ALTERA_VID 0x09fb +#define ALTERA_UB3_6022_PID 0x6022 +#define ALTERA_UB3_6025_PID 0x6025 +#define ALTERA_UB3_6026_PID 0x6026 +#define ALTERA_UB3_6029_PID 0x6029 +#define ALTERA_UB3_602A_PID 0x602a +#define ALTERA_UB3_602C_PID 0x602c +#define ALTERA_UB3_602D_PID 0x602d +#define ALTERA_UB3_602E_PID 0x602e
Greg Kroah-Hartman
maintainerPATCH 54/279 USB: serial: option: add Telit Cinterion FE990B compositions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 4981bb50392b7515b765da28cf8768ce624c2670 upstream.
Add the following Telit Cinterion FE990B40 compositions:
0x10b0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10b1: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10b2: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b2 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10b3: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b3 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -1388,6 +1388,22 @@ static const struct usb_device_id option .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */ + .driver_info = NCTRL(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x30), /* Telit FE990B (MBIM) */ + .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x30), /* Telit FE990B (RNDIS) */ + .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x30), /* Telit FE990B (ECM) */ + .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */
Greg Kroah-Hartman
maintainerPATCH 55/279 USB: serial: option: fix Telit Cinterion FE990A name
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 6232f0d8e100a26275bbd773fc56a60af2c95322 upstream.
The correct name for FE990 is FE990A so use it in order to avoid confusion with FE990B.
--- drivers/usb/serial/option.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/serial/option.c +4 -4
@@ -1368,13 +1368,13 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ .driver_info = RSVD(0) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990A (rmnet) */ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990 (MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990A (MBIM) */ .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990 (RNDIS) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990A (RNDIS) */ .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990A (ECM) */ .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) },
Greg Kroah-Hartman
maintainerPATCH 56/279 USB: serial: option: match on interface class for Telit FN990B
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 9a665fe3d967fe46edb4fd2497c7a5cc2dac2f55 upstream.
The device id entries for Telit FN990B ended up matching only on the interface protocol. While this works, the protocol is qualified by the interface class (and subclass) which should have been included.
Switch to matching using USB_DEVICE_AND_INTERFACE_INFO() while keeping the entries sorted also by protocol for consistency.
--- drivers/usb/serial/option.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/usb/serial/option.c +12 -12
@@ -1410,22 +1410,22 @@ static const struct usb_device_id option .driver_info = RSVD(0) | NCTRL(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) }, /* Telit FN990B (rmnet) */ - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30), + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */ .driver_info = NCTRL(5) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) }, /* Telit FN990B (MBIM) */ - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30), + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ .driver_info = NCTRL(6) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) }, /* Telit FN990B (RNDIS) */ - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30), + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x30), /* Telit FN990B (RNDIS) */ .driver_info = NCTRL(6) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) }, /* Telit FN990B (ECM) */ - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) }, - { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30), + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x30), /* Telit FN990B (ECM) */ .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x60) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
Greg Kroah-Hartman
maintainerPATCH 57/279 x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florent Revest <[email protected]>
commit e3e89178a9f4a80092578af3ff3c8478f9187d59 upstream.
Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses per-CPU data for the first CPU of each mask.
According to Documentation/admin-guide/mm/numaperf.rst:
"Some memory may share the same node as a CPU, and others are provided as memory only nodes."
Therefore, some node CPU masks may be empty and wouldn't have a "first CPU".
On a machine with far memory (and therefore CPU-less NUMA nodes):
- cpumask_of_node(nid) is 0
- cpumask_first(0) is CONFIG_NR_CPUS
- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an index that is 1 out of bounds
This does not have any security implications since flashing microcode is a privileged operation but I believe this has reliability implications by potentially corrupting memory while flashing a microcode update.
When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes a microcode update. I get the following splat:
UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y index 512 is out of range for type 'unsigned long[512]' [...] Call Trace: dump_stack __ubsan_handle_out_of_bounds load_microcode_amd request_microcode_amd reload_store kernfs_fop_write_iter vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe
Change the loop to go over only NUMA nodes which have CPUs before determining whether the first CPU on the respective node needs microcode update.
[ bp: Massage commit message, fix typo. ]
--- arch/x86/kernel/cpu/microcode/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/microcode/amd.c +1 -1
@@ -861,7 +861,7 @@ static enum ucode_state load_microcode_areturn ret; } -for_each_node (nid) { +for_each_node_with_cpus (nid) { cpu =cpumask_first (cpumask_of_node (nid)); c = &cpu_data (cpu);
Greg Kroah-Hartman
maintainerPATCH 58/279 drm/atomic: Filter out redundant DPMS calls
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
commit de93ddf88088f7624b589d0ff3af9effb87e8f3b upstream.
Video players (eg. mpv) do periodic XResetScreenSaver() calls to keep the screen on while the video playing. The modesetting ddx plumbs these straight through into the kernel as DPMS setproperty ioctls, without any filtering whatsoever. When implemented via atomic these end up as empty commits on the crtc (which will nonetheless take one full frame), which leads to a dropped frame every time XResetScreenSaver() is called.
Let's just filter out redundant DPMS property changes in the kernel to avoid this issue.
v2: Explain the resulting commits a bit better (Sima)
Document the behaviour in uapi docs (Sima)
Cc: [email protected]
Testcase: igt/kms_flip/flip-vs-dpms-on-nop
--- drivers/gpu/drm/drm_atomic_uapi.c | 4 ++++ drivers/gpu/drm/drm_connector.c | 4 ++++ 2 files changed, 8 insertions(+)
drivers/gpu/drm/drm_atomic_uapi.c +4 -0
@@ -964,6 +964,10 @@ int drm_atomic_connector_commit_dpms(strif (mode !=DRM_MODE_DPMS_ON ) mode =DRM_MODE_DPMS_OFF ; + +if (connector->dpms == mode) + goto out; + connector->dpms = mode; crtc = connector->state->crtc;
drivers/gpu/drm/drm_connector.c +4 -0
@@ -980,6 +980,10 @@ static const struct drm_prop_enum_list d* callback. For atomic drivers the remapping to the "ACTIVE" property is * implemented in the DRM core. * +* On atomic drivers any DPMS setproperty ioctl where the value does not +* change is completely skipped, otherwise a full atomic commit will occur. +* On legacy drivers the exact behavior is driver specific. +* * Note that this property cannot be set through the MODE_ATOMIC ioctl, * userspace must use "ACTIVE" on the CRTC instead. *
Greg Kroah-Hartman
maintainerPATCH 59/279 drm/amd/display: Restore correct backlight brightness after a GPU reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 5760388d9681ac743038b846b9082b9023969551 upstream.
[Why]
GPU reset will attempt to restore cached state, but brightness doesn't get restored. It will come back at 100% brightness, but userspace thinks it's the previous value.
[How]
When running resume sequence if GPU is in reset restore brightness to previous value.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +10 -0
@@ -218,6 +218,10 @@ amd_get_format_info(const struct drm_modstatic void handle_hpd_irq_helper (struct amdgpu_dm_connector *aconnector); +static void amdgpu_dm_backlight_set_level (struct amdgpu_display_manager *dm, +int bl_idx, +u32 user_brightness); +static bool is_timing_unchanged_for_freesync (struct drm_crtc_state *old_crtc_state,struct drm_crtc_state *new_crtc_state);
@@ -2698,6 +2702,12 @@ static int dm_resume(void *handle)mutex_unlock (&dm->dc_lock); +/* set the backlight after a reset */ +for (i =0 ; i < dm->num_of_edps; i++) { +if (dm->backlight_dev[i]) +amdgpu_dm_backlight_set_level (dm, i, dm->brightness[i]); + } +return 0 ; }/* Recreate dc_state - DC invalidates it when setting power state to S3. */
Greg Kroah-Hartman
maintainerPATCH 60/279 drm/amd/display: Assign normalized_pix_clk when color depth = 14
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
commit 79e31396fdd7037c503e6add15af7cb00633ea92 upstream.
[WHY & HOW]
A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397 calculate_phy_pix_clks+0xef/0x100 [amdgpu]" occurs because the display_color_depth == COLOR_DEPTH_141414 is not handled. This is observed in Radeon RX 6600 XT.
It is fixed by assigning pix_clk * (14 * 3) / 24 - same as the rests.
Also fixes the indentation in get_norm_pix_clk.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +5 -2
@@ -1901,10 +1901,13 @@ static int get_norm_pix_clk(const structbreak ;case COLOR_DEPTH_121212 : normalized_pix_clk = (pix_clk *36 ) /24 ; -break ; +break ; +case COLOR_DEPTH_141414 : + normalized_pix_clk = (pix_clk *42 ) /24 ; +break ;case COLOR_DEPTH_161616 : normalized_pix_clk = (pix_clk *48 ) /24 ; -break ; +break ;default :ASSERT (0 );break ;
Greg Kroah-Hartman
maintainerPATCH 61/279 drm/amd/display: Fix slab-use-after-free on hdcp_work
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit e65e7bea220c3ce8c4c793b4ba35557f4994ab2b upstream.
[Why]
A slab-use-after-free is reported when HDCP is destroyed but the property_validate_dwork queue is still running.
[How]
Cancel the delayed work when destroying workqueue.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +1 -0
@@ -396,6 +396,7 @@ void hdcp_destroy(struct kobject *kobj,for (i =0 ; i < hdcp_work->max_link; i++) {cancel_delayed_work_sync (&hdcp_work[i].callback_dwork);cancel_delayed_work_sync (&hdcp_work[i].watchdog_timer_dwork); +cancel_delayed_work_sync (&hdcp_work[i].property_validate_dwork); }sysfs_remove_bin_file (kobj, &hdcp_work[0 ].attr);
Greg Kroah-Hartman
maintainerPATCH 62/279 qlcnic: fix memory leak issues in qlcnic_sriov_common.c
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d2b9d97e89c79c95f8b517e4fa43fd100f936acc upstream.
Add qlcnic_sriov_free_vlans() in qlcnic_sriov_alloc_vlans() if any sriov_vlans fails to be allocated.
Add qlcnic_sriov_free_vlans() to free the memory allocated by qlcnic_sriov_alloc_vlans() if "sriov->allowed_vlans" fails to be allocated.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +6 -2
@@ -454,8 +454,10 @@ static int qlcnic_sriov_set_guest_vlan_m num_vlans = sriov->num_allowed_vlans; sriov->allowed_vlans =kcalloc (num_vlans,sizeof (u16),GFP_KERNEL ); -if (!sriov->allowed_vlans) +if (!sriov->allowed_vlans) { +qlcnic_sriov_free_vlans (adapter);return -ENOMEM ; + } vlans = (u16 *)&cmd->rsp.arg[3 ];for (i =0 ; i < num_vlans; i++)
@@ -2168,8 +2170,10 @@ int qlcnic_sriov_alloc_vlans(struct qlcn vf = &sriov->vf_info[i]; vf->sriov_vlans =kcalloc (sriov->num_allowed_vlans,sizeof (*vf->sriov_vlans),GFP_KERNEL ); -if (!vf->sriov_vlans) +if (!vf->sriov_vlans) { +qlcnic_sriov_free_vlans (adapter);return -ENOMEM ; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 63/279 lib/buildid: Handle memfd_secret() files in build_id_parse()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
commit 5ac9b4e935dfc6af41eee2ddc21deb5c36507a9f upstream.
Quoted 1 line
From
memfd_secret(2)manpage:
The memory areas backing the file created with memfd_secret(2) are visible only to the processes that have access to the file descriptor. The memory region is removed from the kernel page tables and only the page tables of the processes holding the file descriptor map the corresponding physical memory. (Thus, the pages in the region can't be accessed by the kernel itself, so that, for example, pointers to the region can't be passed to system calls.)
We need to handle this special case gracefully in build ID fetching code. Return -EFAULT whenever secretmem file is passed to build_id_parse() family of APIs. Original report and repro can be found in [0].
[0] https://lore.kernel.org/bpf/ZwyG8Uro%2FSyTXAni@ly-workstation/
--- lib/buildid.c | 5 +++++ 1 file changed, 5 insertions(+)
lib/buildid.c +5 -0
@@ -5,6 +5,7 @@#include <linux/elf.h> #include <linux/kernel.h> #include <linux/pagemap.h> +#include <linux/secretmem.h> #define BUILD_ID 3
@@ -157,6 +158,10 @@ int build_id_parse(struct vm_area_structif (!vma->vm_file)return -EINVAL ; +/* reject secretmem folios created with memfd_secret() */ +if (vma_is_secretmem (vma)) +return -EFAULT ; + page =find_get_page (vma->vm_file->f_mapping,0 );if (!page)return -EFAULT ;/* page not mapped */
Greg Kroah-Hartman
maintainerPATCH 64/279 tcp: fix races in tcp_abort()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 5ce4645c23cf5f048eb8e9ce49e514bababdee85 upstream.
tcp_abort() has the same issue than the one fixed in the prior patch in tcp_write_err().
In order to get consistent results from tcp_poll(), we must call sk_error_report() after tcp_done().
We can use tcp_done_with_error() to centralize this logic.
--- net/ipv4/tcp.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/ipv4/tcp.c +1 -5
@@ -4514,13 +4514,9 @@ int tcp_abort(struct sock *sk, int err)bh_lock_sock (sk);if (!sock_flag (sk,SOCK_DEAD )) { -WRITE_ONCE (sk->sk_err, err); -/* This barrier is coupled with smp_rmb() in tcp_poll() */ -smp_wmb (); -sk_error_report (sk);if (tcp_need_reset (sk->sk_state))tcp_send_active_reset (sk,GFP_ATOMIC ); -tcp_done (sk); +tcp_done_with_error (sk, err); }bh_unlock_sock (sk);
Greg Kroah-Hartman
maintainerPATCH 65/279 ASoC: ops: Consistently treat platform_max as control value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 0eba2a7e858907a746ba69cd002eb9eb4dbd7bf3 ]
This reverts commit 9bdd10d57a88 ("ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min"), and makes some additional related updates.
There are two ways the platform_max could be interpreted; the maximum register value, or the maximum value the control can be set to. The patch moved from treating the value as a control value to a register one. When the patch was applied it was technically correct as snd_soc_limit_volume() also used the register interpretation. However, even then most of the other usages treated platform_max as a control value, and snd_soc_limit_volume() has since been updated to also do so in commit fb9ad24485087 ("ASoC: ops: add correct range check for limiting volume"). That patch however, missed updating snd_soc_put_volsw() back to the control interpretation, and fixing snd_soc_info_volsw_range(). The control interpretation makes more sense as limiting is typically done from the machine driver, so it is appropriate to use the customer facing representation rather than the internal codec representation. Update all the code to consistently use this interpretation of platform_max.
Finally, also add some comments to the soc_mixer_control struct to hopefully avoid further patches switching between the two approaches.
--- include/sound/soc.h | 5 ++++- sound/soc/soc-ops.c | 15 +++++++-------- 2 files changed, 11 insertions(+), 9 deletions(-)
include/sound/soc.h +4 -1
@@ -1113,7 +1113,10 @@ void snd_soc_close_delayed_work(struct snd_soc_pcm_runtime *rtd);/* mixer control */ struct soc_mixer_control { -int min, max, platform_max; +/* Minimum and maximum specified as written to the hardware */ +int min, max; +/* Limited maximum value specified as presented through the control */ +int platform_max;int reg, rreg;unsigned int shift, rshift;unsigned int sign_bit;
sound/soc/soc-ops.c +7 -8
@@ -317,7 +317,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, mask =BIT (sign_bit +1 ) -1 ; val = ucontrol->value.integer.value[0 ]; -if (mc->platform_max && ((int )val + min) > mc->platform_max) +if (mc->platform_max && val > mc->platform_max)return -EINVAL ;if (val > max - min)return -EINVAL ;
@@ -330,7 +330,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, val = val << shift;if (snd_soc_volsw_is_stereo (mc)) { val2 = ucontrol->value.integer.value[1 ]; -if (mc->platform_max && ((int )val2 + min) > mc->platform_max) +if (mc->platform_max && val2 > mc->platform_max)return -EINVAL ;if (val2 > max - min)return -EINVAL ;
@@ -485,17 +485,16 @@ int snd_soc_info_volsw_range(struct snd_kcontrol *kcontrol, {struct soc_mixer_control *mc = (struct soc_mixer_control *)kcontrol->private_value; -int platform_max; -int min = mc->min; +int max; -if (!mc->platform_max) - mc->platform_max = mc->max; - platform_max = mc->platform_max; + max = mc->max - mc->min; +if (mc->platform_max && mc->platform_max < max) + max = mc->platform_max; uinfo->type =SNDRV_CTL_ELEM_TYPE_INTEGER ; uinfo->count =snd_soc_volsw_is_stereo (mc) ?2 :1 ; uinfo->value.integer.min =0 ; - uinfo->value.integer.max = platform_max - min; + uinfo->value.integer.max = max;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/279 drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <[email protected]>
[ Upstream commit 9af152dcf1a06f589f44a74da4ad67e365d4db9a ]
Since pci_get_domain_bus_and_slot() can return NULL, add NULL check for pci_gfx_root in the mid_get_vbt_data().
This change is similar to the checks implemented in mid_get_fuse_settings() and mid_get_pci_revID(), which were introduced by commit 0cecdd818cd7 ("gma500: Final enables for Oaktrail") as "additional minor bulletproofing".
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpu/drm/gma500/mid_bios.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/gma500/mid_bios.c +5 -0
@@ -280,6 +280,11 @@ static void mid_get_vbt_data(struct drm_psb_private *dev_priv) 0, PCI_DEVFN(2, 0));int ret =-1 ; +if (pci_gfx_root ==NULL ) { +WARN_ON (1 ); +return ; + } +/* Get the address of the platform config vbt */ pci_read_config_dword (pci_gfx_root,0xFC , &addr);pci_dev_put (pci_gfx_root);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/279 ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit ed92bc5264c4357d4fca292c769ea9967cd3d3b6 ]
Free some resources in the error handling path of the probe, as already done in the remove function.
--- sound/soc/codecs/wm0010.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
sound/soc/codecs/wm0010.c +11 -2
@@ -952,7 +952,7 @@ static int wm0010_spi_probe(struct spi_device *spi)if (ret) {dev_err (wm0010->dev,"Failed to set IRQ %d as wake source: %d\n" , irq, ret); -return ret; + goto free_irq; }if (spi->max_speed_hz)
@@ -964,9 +964,18 @@ static int wm0010_spi_probe(struct spi_device *spi) &soc_component_dev_wm0010, wm0010_dai, ARRAY_SIZE(wm0010_dai));if (ret <0 ) -return ret; + goto disable_irq_wake;return 0 ; + +disable_irq_wake: +irq_set_irq_wake (wm0010->irq,0 ); + +free_irq: +if (wm0010->irq) +free_irq (wm0010->irq, wm0010); + +return ret; }static int wm0010_spi_remove (struct spi_device *spi)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/279 cifs: Fix integer overflow while processing acregmax mount option
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
[ Upstream commit 7489161b1852390b4413d57f2457cd40b34da6cc ]
User-provided mount parameter acregmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- fs/cifs/fs_context.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/fs_context.c +2 -2
@@ -1055,11 +1055,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, ctx->got_wsize = true;break ;case Opt_acregmax: - ctx->acregmax =HZ * result.uint_32; -if (ctx->acregmax >CIFS_MAX_ACTIMEO ) { +if (result.uint_32 >CIFS_MAX_ACTIMEO /HZ ) {cifs_errorf (fc,"acregmax too large\n" ); goto cifs_parse_mount_err; } + ctx->acregmax =HZ * result.uint_32;break ;case Opt_acdirmax: ctx->acdirmax =HZ * result.uint_32;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/279 cifs: Fix integer overflow while processing acdirmax mount option
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
[ Upstream commit 5b29891f91dfb8758baf1e2217bef4b16b2b165b ]
User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- fs/cifs/fs_context.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/fs_context.c +2 -2
@@ -1062,11 +1062,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, ctx->acregmax =HZ * result.uint_32;break ;case Opt_acdirmax: - ctx->acdirmax =HZ * result.uint_32; -if (ctx->acdirmax >CIFS_MAX_ACTIMEO ) { +if (result.uint_32 >CIFS_MAX_ACTIMEO /HZ ) {cifs_errorf (fc,"acdirmax too large\n" ); goto cifs_parse_mount_err; } + ctx->acdirmax =HZ * result.uint_32;break ;case Opt_actimeo:if (HZ * result.uint_32 >CIFS_MAX_ACTIMEO ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/279 cifs: Fix integer overflow while processing actimeo mount option
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
[ Upstream commit 64f690ee22c99e16084e0e45181b2a1eed2fa149 ]
User-provided mount parameter actimeo of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- fs/cifs/fs_context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/fs_context.c +1 -1
@@ -1069,7 +1069,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, ctx->acdirmax =HZ * result.uint_32;break ;case Opt_actimeo: -if (HZ * result.uint_32 >CIFS_MAX_ACTIMEO ) { +if (result.uint_32 >CIFS_MAX_ACTIMEO /HZ ) {cifs_errorf (fc,"timeout too large\n" ); goto cifs_parse_mount_err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/279 cifs: Fix integer overflow while processing closetimeo mount option
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
[ Upstream commit d5a30fddfe2f2e540f6c43b59cf701809995faef ]
User-provided mount parameter closetimeo of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- fs/cifs/fs_context.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/fs_context.c +2 -2
@@ -1081,11 +1081,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, ctx->acdirmax = ctx->acregmax =HZ * result.uint_32;break ;case Opt_closetimeo: - ctx->closetimeo =HZ * result.uint_32; -if (ctx->closetimeo >SMB3_MAX_DCLOSETIMEO ) { +if (result.uint_32 >SMB3_MAX_DCLOSETIMEO /HZ ) {cifs_errorf (fc,"closetimeo too large\n" ); goto cifs_parse_mount_err; } + ctx->closetimeo =HZ * result.uint_32;break ;case Opt_echo_interval: ctx->echo_interval = result.uint_32;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/279 i2c: ali1535: Fix an error handling path in ali1535_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 9b5463f349d019a261f1e80803447efca3126151 ]
If i2c_add_adapter() fails, the request_region() call in ali1535_setup() must be undone by a corresponding release_region() call, as done in the remove function.
--- drivers/i2c/busses/i2c-ali1535.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-ali1535.c +11 -1
@@ -490,6 +490,8 @@ MODULE_DEVICE_TABLE(pci, ali1535_ids);static int ali1535_probe (struct pci_dev *dev,const struct pci_device_id *id) { +int ret; +if (ali1535_setup (dev)) {dev_warn (&dev->dev,"ALI1535 not detected, module not inserted.\n" );
@@ -501,7 +503,15 @@ static int ali1535_probe(struct pci_dev *dev, const struct pci_device_id *id)snprintf (ali1535_adapter.name,sizeof (ali1535_adapter.name),"SMBus ALI1535 adapter at %04x" , ali1535_offset); -return i2c_add_adapter (&ali1535_adapter); + ret =i2c_add_adapter (&ali1535_adapter); +if (ret) + goto release_region; + +return 0 ; + +release_region: +release_region (ali1535_smba,ALI1535_SMB_IOSIZE ); +return ret; }static void ali1535_remove (struct pci_dev *dev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/279 i2c: ali15x3: Fix an error handling path in ali15x3_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 6e55caaf30c88209d097e575a169b1dface1ab69 ]
If i2c_add_adapter() fails, the request_region() call in ali15x3_setup() must be undone by a corresponding release_region() call, as done in the remove function.
--- drivers/i2c/busses/i2c-ali15x3.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-ali15x3.c +11 -1
@@ -473,6 +473,8 @@ MODULE_DEVICE_TABLE (pci, ali15x3_ids);static int ali15x3_probe (struct pci_dev *dev,const struct pci_device_id *id) { +int ret; +if (ali15x3_setup (dev)) {dev_err (&dev->dev,"ALI15X3 not detected, module not inserted.\n" );
@@ -484,7 +486,15 @@ static int ali15x3_probe(struct pci_dev *dev, const struct pci_device_id *id)snprintf (ali15x3_adapter.name,sizeof (ali15x3_adapter.name),"SMBus ALI15X3 adapter at %04x" , ali15x3_smba); -return i2c_add_adapter (&ali15x3_adapter); + ret =i2c_add_adapter (&ali15x3_adapter); +if (ret) + goto release_region; + +return 0 ; + +release_region: +release_region (ali15x3_smba,ALI15X3_SMB_IOSIZE ); +return ret; }static void ali15x3_remove (struct pci_dev *dev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/279 i2c: sis630: Fix an error handling path in sis630_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 2b22459792fcb4def9f0936d64575ac11a95a58d ]
If i2c_add_adapter() fails, the request_region() call in sis630_setup() must be undone by a corresponding release_region() call, as done in the remove function.
--- drivers/i2c/busses/i2c-sis630.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-sis630.c +11 -1
@@ -509,6 +509,8 @@ MODULE_DEVICE_TABLE(pci, sis630_ids);static int sis630_probe (struct pci_dev *dev,const struct pci_device_id *id) { +int ret; +if (sis630_setup (dev)) {dev_err (&dev->dev, "SIS630 compatible bus not detected, "
@@ -522,7 +524,15 @@ static int sis630_probe(struct pci_dev *dev, const struct pci_device_id *id)snprintf (sis630_adapter.name,sizeof (sis630_adapter.name),"SMBus SIS630 adapter at %04x" , smbus_base +SMB_STS ); -return i2c_add_adapter (&sis630_adapter); + ret =i2c_add_adapter (&sis630_adapter); +if (ret) + goto release_region; + +return 0 ; + +release_region: +release_region (smbus_base +SMB_STS ,SIS630_SMB_IOREGION ); +return ret; }static void sis630_remove (struct pci_dev *dev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/279 drm/amd/display: Check for invalid input params when building scaling params
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Strauss <[email protected]>
[ Upstream commit 73b1da69f5314d96e1f963468863eaa884ee1030 ]
[WHY]
Function to calculate scaling ratios can be called with invalid plane src/dest, causing a divide by zero.
[HOW]
Fail building scaling params if plane state src/dest rects are unpopulated
Stable-dep-of: 374c9faac5a7 ("drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params")
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +9 -0
@@ -1025,6 +1025,15 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)bool res = false;DC_LOGGER_INIT (pipe_ctx->stream->ctx->logger); +/* Invalid input */ +if (!plane_state->dst_rect.width || + !plane_state->dst_rect.height || + !plane_state->src_rect.width || + !plane_state->src_rect.height) { +ASSERT (0 ); +return false; + } + pipe_ctx->plane_res.scl_data.format =convert_pixel_format_to_dalsurface ( pipe_ctx->plane_state->format);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/279 drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 374c9faac5a763a05bc3f68ad9f73dab3c6aec90 ]
Null pointer dereference issue could occur when pipe_ctx->plane_state is null. The fix adds a check to ensure 'pipe_ctx->plane_state' is not null before accessing. This prevents a null pointer dereference.
Found by code review.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +2 -1
@@ -1026,7 +1026,8 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)DC_LOGGER_INIT (pipe_ctx->stream->ctx->logger);/* Invalid input */ -if (!plane_state->dst_rect.width || +if (!plane_state || + !plane_state->dst_rect.width || !plane_state->dst_rect.height || !plane_state->src_rect.width || !plane_state->src_rect.height) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/279 smb: client: Fix match_session bug preventing session reuse
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <[email protected]>
commit 605b249ea96770ac4fac4b8510a99e0f8442be5e upstream.
Fix a bug in match_session() that can causes the session to not be reused in some cases.
Reproduction steps:
mount.cifs //server/share /mnt/a -o credentials=creds mount.cifs //server/share /mnt/b -o credentials=creds,sec=ntlmssp cat /proc/fs/cifs/DebugData | grep SessionId | wc -l
mount.cifs //server/share /mnt/b -o credentials=creds,sec=ntlmssp mount.cifs //server/share /mnt/a -o credentials=creds cat /proc/fs/cifs/DebugData | grep SessionId | wc -l
--- fs/cifs/connect.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
fs/cifs/connect.c +11 -4
@@ -1582,9 +1582,8 @@ out_err:static int match_session (struct cifs_ses *ses,struct smb3_fs_context *ctx) { -if (ctx->sectype != Unspecified && - ctx->sectype != ses->sectype) -return 0 ; +struct TCP_Server_Info *server = ses->server; +enum securityEnum ctx_sec, ses_sec;/* * If an existing session is limited to less channels than
@@ -1597,11 +1596,19 @@ static int match_session(struct cifs_ses }spin_unlock (&ses->chan_lock); -switch (ses->sectype) { + ctx_sec = server->ops->select_sectype (server, ctx->sectype); + ses_sec = server->ops->select_sectype (server, ses->sectype); + +if (ctx_sec != ses_sec) +return 0 ; + +switch (ctx_sec) {case Kerberos:if (!uid_eq (ctx->cred_uid, ses->cred_uid))return 0 ;break ; +case NTLMv2: +case RawNTLMSSP:default :/* NULL username means anonymous session */ if (ses->user_name ==NULL ) {
Greg Kroah-Hartman
maintainerPATCH 78/279 smb: client: fix potential UAF in cifs_debug_files_proc_show()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
commit ca545b7f0823f19db0f1148d59bc5e1a56634502 upstream.
Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
[ This patch removes lock/unlock operation in routine cifs_ses_exiting()
for ses_lock is not present in v5.15 and not ported yet. ses->status is protected by a global lock, cifs_tcp_ses_lock, in v5.15. ]
--- fs/cifs/cifs_debug.c | 2 ++ fs/cifs/cifsglob.h | 8 ++++++++ 2 files changed, 10 insertions(+)
fs/cifs/cifs_debug.c +2 -0
@@ -183,6 +183,8 @@ static int cifs_debug_files_proc_show(stlist_for_each_entry (server, &cifs_tcp_ses_list, tcp_ses_list) {list_for_each (tmp, &server->smb_ses_list) { ses = list_entry(tmp, struct cifs_ses, smb_ses_list); +if (cifs_ses_exiting (ses)) +continue ;list_for_each (tmp1, &ses->tcon_list) { tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);spin_lock (&tcon->open_file_lock);
fs/cifs/cifsglob.h +8 -0
@@ -2041,4 +2041,12 @@ static inline struct scatterlist *cifs_s return sg; } +static inline bool cifs_ses_exiting (struct cifs_ses *ses) +{ +bool ret; + + ret = ses->status == CifsExiting; +return ret; +} +#endif /* _CIFS_GLOB_H */
Greg Kroah-Hartman
maintainerPATCH 79/279 firmware: imx-scu: fix OF node leak in .probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit fbf10b86f6057cf79300720da4ea4b77e6708b0d ]
imx_scu_probe() calls of_parse_phandle_with_args(), but does not release the OF node reference obtained by it. Add a of_node_put() call after done with the node.
--- drivers/firmware/imx/imx-scu.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/imx/imx-scu.c +1 -0
@@ -279,6 +279,7 @@ static int imx_scu_probe(struct platform_device *pdev)return ret; sc_ipc->fast_ipc =of_device_is_compatible (args.np,"fsl,imx8-mu-scu" ); +of_node_put (args.np); num_channel = sc_ipc->fast_ipc ?2 :SCU_MU_CHAN_NUM ;for (i =0 ; i < num_channel; i++) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/279 xfrm_output: Force software GSO only in tunnel mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit 0aae2867aa6067f73d066bc98385e23c8454a1d7 ]
The cited commit fixed a software GSO bug with VXLAN + IPSec in tunnel mode. Unfortunately, it is slightly broader than necessary, as it also severely affects performance for Geneve + IPSec transport mode over a device capable of both HW GSO and IPSec crypto offload. In this case, xfrm_output unnecessarily triggers software GSO instead of letting the HW do it. In simple iperf3 tests over Geneve + IPSec transport mode over a back-2-back pair of NICs with MTU 1500, the performance was observed to be up to 6x worse when doing software GSO compared to leaving it to the hardware.
This commit makes xfrm_output only trigger software GSO in crypto offload cases for already encapsulated packets in tunnel mode, as not doing so would then cause the inner tunnel skb->inner_networking_header to be overwritten and break software GSO for that packet later if the device turns out to not be capable of HW GSO.
Taking a closer look at the conditions for the original bug, to better understand the reasons for this change:
- vxlan_build_skb -> iptunnel_handle_offloads sets inner_protocol and inner network header.
- then, udp_tunnel_xmit_skb -> ip_tunnel_xmit adds outer transport and network headers.
- later in the xmit path, xfrm_output -> xfrm_outer_mode_output -> xfrm4_prepare_output -> xfrm4_tunnel_encap_add overwrites the inner network header with the one set in ip_tunnel_xmit before adding the second outer header.
- __dev_queue_xmit -> validate_xmit_skb checks whether GSO segmentation needs to happen based on dev features. In the original bug, the hw couldn't segment the packets, so skb_gso_segment was invoked.
- deep in the .gso_segment callback machinery, __skb_udp_tunnel_segment tries to use the wrong inner network header, expecting the one set in iptunnel_handle_offloads but getting the one set by xfrm instead.
- a bit later, ipv6_gso_segment accesses the wrong memory based on that wrong inner network header.
With the new change, the original bug (or similar ones) cannot happen again, as xfrm will now trigger software GSO before applying a tunnel. This concern doesn't exist in packet offload mode, when the HW adds encapsulation headers. For the non-offloaded packets (crypto in SW), software GSO is still done unconditionally in the else branch.
--- net/xfrm/xfrm_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_output.c +1 -1
@@ -737,7 +737,7 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) skb->encapsulation =1 ;if (skb_is_gso (skb)) { -if (skb->inner_protocol) +if (skb->inner_protocol && x->props.mode ==XFRM_MODE_TUNNEL )return xfrm_output_gso (net, sk, skb);skb_shinfo (skb)->gso_type |=SKB_GSO_ESP ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/279 ARM: dts: bcm2711: PL011 UARTs are actually r1p5
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit 0de09025f161f67c07978c4742e221243d070d41 ]
The ARM PL011 UART instances in BCM2711 are r1p5 spec, which means they have 32-entry FIFOs. The correct periphid value for this is 0x00341011. Thanks to N Buchwitz for pointing this out.
--- arch/arm/boot/dts/bcm2711.dtsi | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/arm/boot/dts/bcm2711.dtsi +5 -4
@@ -133,7 +133,7 @@ uart2: serial@7e201400 { clocks = <&clocks BCM2835_CLOCK_UART>, <&clocks BCM2835_CLOCK_VPU>; clock-names = "uartclk", "apb_pclk"; - arm,primecell-periphid = <0x00241011>; + arm,primecell-periphid = <0x00341011>; status = "disabled"; };
@@ -144,7 +144,7 @@ uart3: serial@7e201600 { clocks = <&clocks BCM2835_CLOCK_UART>, <&clocks BCM2835_CLOCK_VPU>; clock-names = "uartclk", "apb_pclk"; - arm,primecell-periphid = <0x00241011>; + arm,primecell-periphid = <0x00341011>; status = "disabled"; };
@@ -155,7 +155,7 @@ uart4: serial@7e201800 { clocks = <&clocks BCM2835_CLOCK_UART>, <&clocks BCM2835_CLOCK_VPU>; clock-names = "uartclk", "apb_pclk"; - arm,primecell-periphid = <0x00241011>; + arm,primecell-periphid = <0x00341011>; status = "disabled"; };
@@ -166,7 +166,7 @@ uart5: serial@7e201a00 { clocks = <&clocks BCM2835_CLOCK_UART>, <&clocks BCM2835_CLOCK_VPU>; clock-names = "uartclk", "apb_pclk"; - arm,primecell-periphid = <0x00241011>; + arm,primecell-periphid = <0x00341011>; status = "disabled"; };
@@ -1142,6 +1142,7 @@ &txp { }; &uart0 { + arm,primecell-periphid = <0x00341011>; interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/279 RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kashyap Desai <[email protected]>
[ Upstream commit 67ee8d496511ad8e1cb88f72944847e7b3e4e47c ]
The modulo operation returns wrong result without the paranthesis and that resulted in wrong QP table indexing.
--- drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +2 -1
@@ -220,9 +220,10 @@ int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw);int bnxt_qplib_init_rcfw (struct bnxt_qplib_rcfw *rcfw,struct bnxt_qplib_ctx *ctx,int is_virtfn);void bnxt_qplib_mark_qp_error (void *qp_handle); +static inline u32 map_qp_id_to_tbl_indx (u32 qid,struct bnxt_qplib_rcfw *rcfw) {/* Last index of the qp_tbl is for QP1 ie. qp_tbl_size - 1*/ -return (qid ==1 ) ? rcfw->qp_tbl_size -1 : qid % rcfw->qp_tbl_size -2 ; +return (qid ==1 ) ? rcfw->qp_tbl_size -1 : (qid % (rcfw->qp_tbl_size -2 )); }#endif /* __BNXT_QPLIB_RCFW_H__ */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/279 ARM: dts: bcm2711: Dont mark timer regs unconfigured
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit c24f272ae751a9f54f8816430e7f2d56031892cc ]
During upstream process of Raspberry Pi 4 back in 2019 the ARMv7 stubs didn't configured the ARM architectural timer. This firmware issue has been fixed in 2020, which gave users enough time to update their system.
So drop this property to allow the use of the vDSO version of clock_gettime.
--- arch/arm/boot/dts/bcm2711.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm/boot/dts/bcm2711.dtsi +0 -2
@@ -450,8 +450,6 @@ IRQ_TYPE_LEVEL_LOW)>, IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>; - /* This only applies to the ARMv7 stub */ - arm,cpu-registers-not-fw-configured; }; cpus: cpus {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/279 RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravanan Vajravel <[email protected]>
[ Upstream commit 81c0db302a674f8004ed805393d17fd76f552e83 ]
Driver is always clearing the mask that sets the VLAN ID/Service Level in the adapter. Recent change for supporting multiple traffic class exposed this issue.
Allow setting SL and VLAN_ID while QP is moved from INIT to RTR state.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 -- 1 file changed, 2 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +0 -2
@@ -1181,8 +1181,6 @@ static void __modify_flags_from_init_state(struct bnxt_qplib_qp *qp) qp->path_mtu =CMDQ_MODIFY_QP_PATH_MTU_MTU_2048 ; } - qp->modify_flags &= - ~CMDQ_MODIFY_QP_MODIFY_MASK_VLAN_ID ;/* Bono FW require the max_dest_rd_atomic to be >= 1 */ if (qp->max_dest_rd_atomic <1 ) qp->max_dest_rd_atomic =1 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/279 RDMA/hns: Remove redundant phy_addr in hns_roce_hem_list_find_mtt()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 5f652387c5423a82453c5cb446a88834bf41a94b ]
This parameter has never been used. Remove it to simplify the function.
Stable-dep-of: 25655580136d ("RDMA/hns: Fix soft lockup during bt pages loop")
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 7 +------ drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++-- 3 files changed, 4 insertions(+), 9 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +1 -6
@@ -1487,19 +1487,17 @@ void hns_roce_hem_list_init(struct hns_roce_hem_list *hem_list)void *hns_roce_hem_list_find_mtt (struct hns_roce_dev *hr_dev,struct hns_roce_hem_list *hem_list, -int offset,int *mtt_cnt,u64 *phy_addr) +int offset,int *mtt_cnt) {struct list_head *head = &hem_list->btm_bt;struct hns_roce_hem_item *hem, *temp_hem;void *cpu_base =NULL ; -u64 phy_base =0 ;int nr =0 ;list_for_each_entry_safe (hem, temp_hem, head, sibling) {if (hem_list_page_is_in_range (hem, offset)) { nr = offset - hem->start; cpu_base = hem->addr + nr *BA_BYTE_LEN ; - phy_base = hem->dma_addr + nr *BA_BYTE_LEN ; nr = hem->end +1 - offset;break ; }
@@ -1508,8 +1506,5 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev,if (mtt_cnt) *mtt_cnt = nr; -if (phy_addr) - *phy_addr = phy_base; -return cpu_base; }
drivers/infiniband/hw/hns/hns_roce_hem.h +1 -1
@@ -132,7 +132,7 @@ void hns_roce_hem_list_release(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list);void *hns_roce_hem_list_find_mtt (struct hns_roce_dev *hr_dev,struct hns_roce_hem_list *hem_list, -int offset,int *mtt_cnt,u64 *phy_addr); +int offset,int *mtt_cnt);static inline void hns_roce_hem_first (struct hns_roce_hem *hem,struct hns_roce_hem_iter *iter)
drivers/infiniband/hw/hns/hns_roce_mr.c +2 -2
@@ -614,7 +614,7 @@ static int mtr_map_region(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,while (offset < end && npage < max_count) { count =0 ; mtts =hns_roce_hem_list_find_mtt (hr_dev, &mtr->hem_list, - offset, &count,NULL ); + offset, &count);if (!mtts)return -ENOBUFS ;
@@ -864,7 +864,7 @@ int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, mtt_count =0 ; mtts =hns_roce_hem_list_find_mtt (hr_dev, &mtr->hem_list, start_index + total, - &mtt_count,NULL ); + &mtt_count);if (!mtts || !mtt_count) goto done;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/279 RDMA/hns: Fix soft lockup during bt pages loop
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit 25655580136de59ec89f09089dd28008ea440fc9 ]
Driver runs a for-loop when allocating bt pages and mapping them with buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated, it may require a considerable loop count. This will lead to soft lockup:
watchdog: BUG: soft lockup - CPU#27 stuck for 22s!
...
Call trace:
hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2]
hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2]
hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2]
alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2]
hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2]
ib_uverbs_reg_mr+0x118/0x290
watchdog: BUG: soft lockup - CPU#35 stuck for 23s!
...
Call trace:
hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2]
mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2]
hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2]
alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2]
hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2]
ib_uverbs_reg_mr+0x120/0x2bcAdd a cond_resched() to fix soft lockup during these loops. In order not to affect the allocation performance of normal-size buffer, set the loop count of a 100GB MR as the threshold to call cond_resched().
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +15 -1
@@ -1410,6 +1410,11 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev,return ret; } +/* This is the bottom bt pages number of a 100G MR on 4K OS, assuming +* the bt page size is not expanded by cal_best_bt_pg_sz() +*/ +#define RESCHED_LOOP_CNT_THRESHOLD_ON_4K 12800 +/* construct the base address table and link them by address hop config */ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list,
@@ -1418,6 +1423,7 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, {const struct hns_roce_buf_region *r;int ofs, end; +int loop;int unit;int ret;int i;
@@ -1435,7 +1441,10 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev,continue ; end = r->offset + r->count; -for (ofs = r->offset; ofs < end; ofs += unit) { +for (ofs = r->offset, loop =1 ; ofs < end; ofs += unit, loop++) { +if (!(loop %RESCHED_LOOP_CNT_THRESHOLD_ON_4K )) +cond_resched (); + ret =hem_list_alloc_mid_bt (hr_dev, r, unit, ofs, hem_list->mid_bt[i], &hem_list->btm_bt);
@@ -1492,9 +1501,14 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev,struct list_head *head = &hem_list->btm_bt;struct hns_roce_hem_item *hem, *temp_hem;void *cpu_base =NULL ; +int loop =1 ;int nr =0 ;list_for_each_entry_safe (hem, temp_hem, head, sibling) { +if (!(loop %RESCHED_LOOP_CNT_THRESHOLD_ON_4K )) +cond_resched (); + loop++; +if (hem_list_page_is_in_range (hem, offset)) { nr = offset - hem->start; cpu_base = hem->addr + nr *BA_BYTE_LEN ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/279 RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit b9f59a24ba35a7d955a9f8e148dd9f85b7b40a01 ]
Currently the condition of unmapping sdb in error path is not exactly the same as the condition of mapping in alloc_user_qp_db(). This may cause a problem of unmapping an unmapped db in some case, such as when the QP is XRC TGT. Unified the two conditions.
--- drivers/infiniband/hw/hns/hns_roce_qp.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/infiniband/hw/hns/hns_roce_qp.c +5 -3
@@ -842,12 +842,14 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev,struct hns_roce_ib_create_qp *ucmd, struct hns_roce_ib_create_qp_resp *resp) { + bool has_sdb = user_qp_has_sdb(hr_dev, init_attr, udata, resp, ucmd);struct hns_roce_ucontext *uctx =rdma_udata_to_drv_context (udata, struct hns_roce_ucontext, ibucontext); +bool has_rdb =user_qp_has_rdb (hr_dev, init_attr, udata, resp);struct ib_device *ibdev = &hr_dev->ib_dev;int ret; -if (user_qp_has_sdb (hr_dev, init_attr, udata, resp, ucmd)) { +if (has_sdb) { ret =hns_roce_db_map_user (uctx, ucmd->sdb_addr, &hr_qp->sdb);if (ret) { ibdev_err(ibdev,
@@ -858,7 +860,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, hr_qp->en_flags |=HNS_ROCE_QP_CAP_SQ_RECORD_DB ; } -if (user_qp_has_rdb (hr_dev, init_attr, udata, resp)) { +if (has_rdb) { ret =hns_roce_db_map_user (uctx, ucmd->db_addr, &hr_qp->rdb);if (ret) { ibdev_err(ibdev,
@@ -872,7 +874,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev,return 0 ; err_sdb: -if (hr_qp->en_flags &HNS_ROCE_QP_CAP_SQ_RECORD_DB ) +if (has_sdb)hns_roce_db_unmap_user (uctx, &hr_qp->sdb); err_out:return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/279 RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit 444907dd45cbe62fd69398805b6e2c626fab5b3a ]
When ib_copy_to_udata() fails in hns_roce_create_qp_common(), hns_roce_qp_remove() should be called in the error path to clean up resources in hns_roce_qp_store().
--- drivers/infiniband/hw/hns/hns_roce_qp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_qp.c +1 -1
@@ -1117,7 +1117,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, min(udata->outlen, sizeof(resp)));if (ret) {ibdev_err (ibdev,"copy qp resp failed!\n" ); - goto err_store; + goto err_flow_ctrl; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/279 RDMA/hns: Fix wrong value of max_sge_rd
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit 6b5e41a8b51fce520bb09bd651a29ef495e990de ]
There is no difference between the sge of READ and non-READ operations in hns RoCE. Set max_sge_rd to the same value as max_send_sge.
--- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_main.c +1 -1
@@ -185,7 +185,7 @@ static int hns_roce_query_device(struct ib_device *ib_dev,IB_DEVICE_RC_RNR_NAK_GEN ; props->max_send_sge = hr_dev->caps.max_sq_sg; props->max_recv_sge = hr_dev->caps.max_rq_sg; - props->max_sge_rd =1 ; + props->max_sge_rd = hr_dev->caps.max_sq_sg; props->max_cq = hr_dev->caps.num_cqs; props->max_cqe = hr_dev->caps.max_cqes; props->max_mr = hr_dev->caps.num_mtpts;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/279 Bluetooth: Fix error code in chan_alloc_skb_cb()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 72d061ee630d0dbb45c2920d8d19b3861c413e54 ]
The chan_alloc_skb_cb() function is supposed to return error pointers on error. Returning NULL will lead to a NULL dereference.
--- net/bluetooth/6lowpan.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/bluetooth/6lowpan.c +6 -1
@@ -824,11 +824,16 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan,unsigned long hdr_len, unsigned long len, int nb) { + struct sk_buff *skb; +/* Note that we must allocate using GFP_ATOMIC here as * this function is called originally from netdev hard xmit * function in atomic context. */ -return bt_skb_alloc (hdr_len + len,GFP_ATOMIC ); + skb =bt_skb_alloc (hdr_len + len,GFP_ATOMIC ); +if (!skb) +return ERR_PTR (-ENOMEM ); +return skb; }static void chan_suspend_cb (struct l2cap_chan *chan)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/279 ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9740890ee20e01f99ff1dde84c63dcf089fabb98 ]
fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything when it fails.
Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init() but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak.
Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the error path.
Note that we can remove the fib6_nh_release() call in nh_create_ipv6() later in net-next.git.
--- net/ipv6/route.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/route.c +2 -1
@@ -3630,7 +3630,8 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,in6_dev_put (idev);if (err) { -lwtstate_put (fib6_nh->fib_nh_lws); +fib_nh_common_release (&fib6_nh->nh_common); + fib6_nh->nh_common.nhc_pcpu_rth_output =NULL ; fib6_nh->fib_nh_lws =NULL ;dev_put (dev); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/279 ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9a81fc3480bf5dbe2bf80e278c440770f6ba2692 ]
While creating a new IPv6, we could get a weird -ENOMEM when RTA_NH_ID is set and either of the conditions below is true:
1) CONFIG_IPV6_SUBTREES is enabled and rtm_src_len is specified
2) nexthop_get() fails
e.g.)
# strace ip -6 route add fe80::dead:beef:dead:beef nhid 1 from ::
recvmsg(3, {msg_iov=[{iov_base=[...[
{error=-ENOMEM, msg=[... [...]]},
[{nla_len=49, nla_type=NLMSGERR_ATTR_MSG}, "Nexthops can not be used with so"...]
]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 148Let's set err explicitly after ip_fib_metrics_init() in ip6_route_info_create().
--- net/ipv6/route.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv6/route.c +2 -0
@@ -3807,10 +3807,12 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,if (nh) {if (rt->fib6_src.plen) {NL_SET_ERR_MSG (extack,"Nexthops can not be used with source routing" ); + err = -EINVAL ; goto out_free; }if (!nexthop_get (nh)) {NL_SET_ERR_MSG (extack,"Nexthop has been deleted" ); + err = -ENOENT ; goto out_free; } rt->nh = nh;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/279 net: atm: fix use after free in lec_send()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit f3009d0d6ab78053117f8857b921a8237f4d17b3 ]
The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.
--- net/atm/lec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/atm/lec.c +2 -1
@@ -181,6 +181,7 @@ static void lec_send(struct atm_vcc *vcc, struct sk_buff *skb) { struct net_device *dev = skb->dev; +unsigned int len = skb->len;ATM_SKB (skb)->vcc = vcc;atm_account_tx (vcc, skb);
@@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) } dev->stats.tx_packets++; - dev->stats.tx_bytes += skb->len; + dev->stats.tx_bytes += len; }static void lec_tx_timeout (struct net_device *dev,unsigned int txqueue)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/279 net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit 90a7138619a0c55e2aefaad27b12ffc2ddbeed78 ]
Previous commit 8b5c171bb3dc ("neigh: new unresolved queue limits") introduces new netlink attribute NDTPA_QUEUE_LENBYTES to represent approximative value for deprecated QUEUE_LEN. However, it forgot to add the associated nla_policy in nl_ntbl_parm_policy array. Fix it with one simple NLA_U32 type policy.
--- net/core/neighbour.c | 1 + 1 file changed, 1 insertion(+)
net/core/neighbour.c +1 -0
@@ -2173,6 +2173,7 @@ static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX +1 ] = { [NDTPA_IFINDEX ] = { .type =NLA_U32 }, [NDTPA_QUEUE_LEN ] = { .type =NLA_U32 }, + [NDTPA_QUEUE_LENBYTES ] = { .type =NLA_U32 }, [NDTPA_PROXY_QLEN ] = { .type =NLA_U32 }, [NDTPA_APP_PROBES ] = { .type =NLA_U32 }, [NDTPA_UCAST_PROBES ] = { .type =NLA_U32 },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/279 Revert "gre: Fix IPv6 link-local address generation."
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit fc486c2d060f67d672ddad81724f7c8a4d329570 ]
This reverts commit 183185a18ff96751db52a46ccf93fff3a1f42815.
This patch broke net/forwarding/ip6gre_custom_multipath_hash.sh in some circumstances (https://lore.kernel.org/netdev/Z9RIyKZDNoka53EO@mini-arch/).
Let's revert it while the problem is being investigated.
--- net/ipv6/addrconf.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
net/ipv6/addrconf.c +6 -9
@@ -3145,13 +3145,16 @@ static void add_v4_addrs(struct inet6_dev *idev)struct in6_addr addr;struct net_device *dev;struct net *net =dev_net (idev->dev); -int scope, plen; +int scope, plen, offset =0 ;u32 pflags =0 ;ASSERT_RTNL ();memset (&addr,0 ,sizeof (struct in6_addr )); -memcpy (&addr.s6_addr32[3 ], idev->dev->dev_addr,4 ); +/* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */ +if (idev->dev->addr_len ==sizeof (struct in6_addr )) + offset =sizeof (struct in6_addr ) -4 ; +memcpy (&addr.s6_addr32[3 ], idev->dev->dev_addr + offset,4 );if (!(idev->dev->flags &IFF_POINTOPOINT ) && idev->dev->type ==ARPHRD_SIT ) { scope = IPV6_ADDR_COMPATv4;
@@ -3459,13 +3462,7 @@ static void addrconf_gre_config(struct net_device *dev)return ; } -/* Generate the IPv6 link-local address using addrconf_addr_gen(), -* unless we have an IPv4 GRE device not bound to an IP address and -* which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this -* case). Such devices fall back to add_v4_addrs() instead. -*/ -if (!(dev->type ==ARPHRD_IPGRE && *(__be32 *)dev->dev_addr ==0 && - idev->cnf.addr_gen_mode ==IN6_ADDR_GEN_MODE_EUI64 )) { +if (dev->type ==ARPHRD_ETHER ) {addrconf_addr_gen (idev, true);return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/279 i2c: omap: fix IRQ storms
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <[email protected]>
commit 285df995f90e3d61d97f327d34b9659d92313314 upstream.
On the GTA04A5 writing a reset command to the gyroscope causes IRQ storms because NACK IRQs are enabled and therefore triggered but not acked.
Sending a reset command to the gyroscope by
i2cset 1 0x69 0x14 0xb6
with an additional debug print in the ISR (not the thread) itself causes
[ 363.353515] i2c i2c-1: ioctl, cmd=0x720, arg=0xbe801b00 [ 363.359039] omap_i2c 48072000.i2c: addr: 0x0069, len: 2, flags: 0x0, stop: 1 [ 363.366180] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x1110) [ 363.371673] omap_i2c 48072000.i2c: IRQ (ISR = 0x0010) [ 363.376892] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) [ 363.382263] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102) [ 363.387664] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102)
repeating till infinity
[...]
(0x2 = NACK, 0x100 = Bus free, which is not enabled) Apparently no other IRQ bit gets set, so this stalls.
Do not ignore enabled interrupts and make sure they are acked. If the NACK IRQ is not needed, it should simply not enabled, but according to the above log, caring about it is necessary unless the Bus free IRQ is enabled and handled. The assumption that is will always come with a ARDY IRQ, which was the idea behind ignoring it, proves wrong.
It is true for simple reads from an unused address.
To still avoid the i2cdetect trouble which is the reason for commit c770657bd261 ("i2c: omap: Fix standard mode false ACK readings"), avoid doing much about NACK in omap_i2c_xfer_data() which is used by both IRQ mode and polling mode, so also the false detection fix is extended to polling usage and IRQ storms are avoided.
By changing this, the hardirq handler is not needed anymore to filter stuff.
The mentioned gyro reset now just causes a -ETIMEDOUT instead of hanging the system.
--- drivers/i2c/busses/i2c-omap.c | 26 +++++++------------------- 1 file changed, 7 insertions(+), 19 deletions(-)
drivers/i2c/busses/i2c-omap.c +7 -19
@@ -1049,23 +1049,6 @@ static int omap_i2c_transmit_data(structreturn 0 ; } -static irqreturn_t -omap_i2c_isr (int irq,void *dev_id) -{ -struct omap_i2c_dev *omap = dev_id; -irqreturn_t ret =IRQ_HANDLED ; -u16 mask; -u16 stat; - - stat =omap_i2c_read_reg (omap,OMAP_I2C_STAT_REG ); - mask =omap_i2c_read_reg (omap,OMAP_I2C_IE_REG ) & ~OMAP_I2C_STAT_NACK ; - -if (stat & mask) - ret =IRQ_WAKE_THREAD ; - -return ret; -} -static int omap_i2c_xfer_data (struct omap_i2c_dev *omap) {u16 bits;
@@ -1096,8 +1079,13 @@ static int omap_i2c_xfer_data(struct oma }if (stat &OMAP_I2C_STAT_NACK ) { - err |=OMAP_I2C_STAT_NACK ; + omap->cmd_err |=OMAP_I2C_STAT_NACK ;omap_i2c_ack_stat (omap,OMAP_I2C_STAT_NACK ); + +if (!(stat & ~OMAP_I2C_STAT_NACK )) { + err = -EAGAIN ; +break ; + } }if (stat &OMAP_I2C_STAT_AL ) {
@@ -1475,7 +1463,7 @@ omap_i2c_probe(struct platform_device *p IRQF_NO_SUSPEND, pdev->name, omap); else r =devm_request_threaded_irq (&pdev->dev, omap->irq, - omap_i2c_isr, omap_i2c_isr_thread, +NULL , omap_i2c_isr_thread,IRQF_NO_SUSPEND |IRQF_ONESHOT , pdev->name, omap);
Greg Kroah-Hartman
maintainerPATCH 97/279 drm/v3d: Dont run jobs that have errors flagged in its fence
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
commit 80cbee810e4e13cdbd3ae9654e9ecddf17f3e828 upstream.
The V3D driver still relies on drm_sched_increase_karma() and drm_sched_resubmit_jobs() for resubmissions when a timeout occurs. The function drm_sched_increase_karma() marks the job as guilty, while drm_sched_resubmit_jobs() sets an error (-ECANCELED) in the DMA fence of that guilty job.
Because of this, we must check whether the job’s DMA fence has been flagged with an error before executing the job. Otherwise, the same guilty job may be resubmitted indefinitely, causing repeated GPU resets.
This patch adds a check for an error on the job's fence to prevent running a guilty job that was previously flagged when the GPU timed out.
Note that the CPU and CACHE_CLEAN queues do not require this check, as their jobs are executed synchronously once the DRM scheduler starts them.
--- drivers/gpu/drm/v3d/v3d_sched.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/v3d/v3d_sched.c +8 -1
@@ -202,11 +202,15 @@ v3d_tfu_job_run(struct drm_sched_job *scstruct drm_device *dev = &v3d->drm;struct dma_fence *fence; +if (unlikely (job->base.base.s_fence->finished.error)) +return NULL ; + + v3d->tfu_job = job; + fence =v3d_fence_create (v3d,V3D_TFU );if (IS_ERR (fence))return NULL ; - v3d->tfu_job = job;if (job->base.irq_fence)dma_fence_put (job->base.irq_fence); job->base.irq_fence =dma_fence_get (fence);
@@ -240,6 +244,9 @@ v3d_csd_job_run(struct drm_sched_job *scstruct dma_fence *fence;int i; +if (unlikely (job->base.base.s_fence->finished.error)) +return NULL ; + v3d->csd_job = job;v3d_invalidate_caches (v3d);
Greg Kroah-Hartman
maintainerPATCH 98/279 regulator: check that dummy regulator has been probed before using it
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <[email protected]>
commit 2c7a50bec4958f1d1c84d19cde518d0e96a676fd upstream.
Due to asynchronous driver probing there is a chance that the dummy regulator hasn't already been probed when first accessing it.
--- drivers/regulator/core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/regulator/core.c +11 -1
@@ -2047,6 +2047,10 @@ static int regulator_resolve_supply(struif (have_full_constraints ()) { r = dummy_regulator_rdev; +if (!r) { + ret = -EPROBE_DEFER ; + goto out; + }get_device (&r->dev); }else { dev_err(dev, "Failed to resolve %s-supply for %s\n",
@@ -2064,6 +2068,10 @@ static int regulator_resolve_supply(stru goto out; } r = dummy_regulator_rdev; +if (!r) { + ret = -EPROBE_DEFER ; + goto out; + }get_device (&r->dev); }
@@ -2172,8 +2180,10 @@ struct regulator *_regulator_get(struct* enabled, even if it isn't hooked up, and just * provide a dummy. */ -dev_warn (dev,"supply %s not found, using dummy regulator\n" , id); rdev = dummy_regulator_rdev; +if (!rdev) +return ERR_PTR (-EPROBE_DEFER ); +dev_warn (dev,"supply %s not found, using dummy regulator\n" , id);get_device (&rdev->dev);break ;
Greg Kroah-Hartman
maintainerPATCH 99/279 mmc: atmel-mci: Add missing clk_disable_unprepare()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gu Bowen <[email protected]>
commit e51a349d2dcf1df8422dabb90b2f691dc7df6f92 upstream.
The error path when atmci_configure_dma() set dma fails in atmci driver does not correctly disable the clock.
Add the missing clk_disable_unprepare() to the error path for pair with clk_prepare_enable().
--- drivers/mmc/host/atmel-mci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mmc/host/atmel-mci.c +3 -1
@@ -2507,8 +2507,10 @@ static int atmci_probe(struct platform_d/* Get MCI capabilities and set operations according to it */ atmci_get_cap (host); ret =atmci_configure_dma (host); -if (ret == -EPROBE_DEFER ) +if (ret == -EPROBE_DEFER ) { +clk_disable_unprepare (host->mck); goto err_dma_probe_defer; + }if (ret ==0 ) { host->prepare_data = &atmci_prepare_data_dma; host->submit_data = &atmci_submit_data_dma;
Greg Kroah-Hartman
maintainerPATCH 100/279 proc: fix UAF in proc_get_inode()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df upstream.
Fix race between rmmod and /proc/XXX's inode instantiation.
The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used.
use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->... dereference.
rmmod lookupsys_delete_module
proc_lookup_de
pde_get(de);
proc_get_inode(dir->i_sb, de);
mod->exit()
proc_remove
remove_proc_subtree
proc_entry_rundown(de); free_module(mod);
if (S_ISREG(inode->i_mode))
if (de->proc_ops->proc_read_iter)
--> As module is already freed, will trigger UAFBUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- fs/proc/generic.c | 10 +++++++++- fs/proc/inode.c | 6 +++--- fs/proc/internal.h | 14 ++++++++++++++ include/linux/proc_fs.h | 7 +++++-- 4 files changed, 31 insertions(+), 6 deletions(-)
fs/proc/generic.c +9 -1
@@ -558,10 +558,16 @@ struct proc_dir_entry *proc_create_reg(creturn p; } -static inline void pde_set_flags (struct proc_dir_entry *pde) +static void pde_set_flags (struct proc_dir_entry *pde) {if (pde->proc_ops->proc_flags &PROC_ENTRY_PERMANENT ) pde->flags |=PROC_ENTRY_PERMANENT ; +if (pde->proc_ops->proc_read_iter) + pde->flags |= PROC_ENTRY_proc_read_iter; +#ifdef CONFIG_COMPAT +if (pde->proc_ops->proc_compat_ioctl) + pde->flags |= PROC_ENTRY_proc_compat_ioctl; +#endif } struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
@@ -625,6 +631,7 @@ struct proc_dir_entry *proc_create_seq_p p->proc_ops = &proc_seq_ops; p->seq_ops = ops; p->state_size = state_size; +pde_set_flags (p);return proc_register (parent, p); }EXPORT_SYMBOL (proc_create_seq_private);
@@ -655,6 +662,7 @@ struct proc_dir_entry *proc_create_singlreturn NULL ; p->proc_ops = &proc_single_ops; p->single_show = show; +pde_set_flags (p);return proc_register (parent, p); }EXPORT_SYMBOL (proc_create_single_data);
fs/proc/inode.c +3 -3
@@ -670,13 +670,13 @@ struct inode *proc_get_inode(struct supeif (S_ISREG (inode->i_mode)) { inode->i_op = de->proc_iops; -if (de->proc_ops->proc_read_iter) +if (pde_has_proc_read_iter (de)) inode->i_fop = &proc_iter_file_ops;else inode->i_fop = &proc_reg_file_ops;#ifdef CONFIG_COMPAT -if (de->proc_ops->proc_compat_ioctl) { -if (de->proc_ops->proc_read_iter) +if (pde_has_proc_compat_ioctl (de)) { +if (pde_has_proc_read_iter (de)) inode->i_fop = &proc_iter_file_ops_compat;else inode->i_fop = &proc_reg_file_ops_compat;
fs/proc/internal.h +14 -0
@@ -79,6 +79,20 @@ static inline bool pde_is_permanent(consreturn pde->flags &PROC_ENTRY_PERMANENT ; } +static inline bool pde_has_proc_read_iter (const struct proc_dir_entry *pde) +{ +return pde->flags & PROC_ENTRY_proc_read_iter; +} + +static inline bool pde_has_proc_compat_ioctl (const struct proc_dir_entry *pde) +{ +#ifdef CONFIG_COMPAT +return pde->flags & PROC_ENTRY_proc_compat_ioctl; +#else +return false; +#endif +} +extern struct kmem_cache *proc_dir_entry_cache;void pde_free (struct proc_dir_entry *pde);
include/linux/proc_fs.h +5 -2
@@ -20,10 +20,13 @@ enum {* If in doubt, ignore this flag. */ #ifdef MODULE - PROC_ENTRY_PERMANENT = 0U, + PROC_ENTRY_PERMANENT = 0U, #else - PROC_ENTRY_PERMANENT = 1U << 0, + PROC_ENTRY_PERMANENT = 1U << 0, #endif + + PROC_ENTRY_proc_read_iter = 1U << 1, + PROC_ENTRY_proc_compat_ioctl = 1U << 2, }; struct proc_ops {
Greg Kroah-Hartman
maintainerPATCH 101/279 ARM: shmobile: smp: Enforce shmobile_smp_* alignment
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit 379c590113ce46f605439d4887996c60ab8820cc upstream.
When the addresses of the shmobile_smp_mpidr, shmobile_smp_fn, and shmobile_smp_arg variables are not multiples of 4 bytes, secondary CPU bring-up fails:
smp: Bringing up secondary CPUs ...
CPU1: failed to come online
CPU2: failed to come online
CPU3: failed to come online
smp: Brought up 1 node, 1 CPU
Fix this by adding the missing alignment directive.
--- arch/arm/mach-shmobile/headsmp.S | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-shmobile/headsmp.S +1 -0
@@ -136,6 +136,7 @@ ENDPROC(shmobile_smp_sleep) .long shmobile_smp_arg - 1b .bss + .align 2 .globl shmobile_smp_mpidr shmobile_smp_mpidr: .space NR_CPUS * 4
Greg Kroah-Hartman
maintainerPATCH 102/279 batman-adv: Ignore own maximum aggregation size during RX
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 548b0c5de7619ef53bbde5590700693f2f6d2a56 upstream.
An OGMv1 and OGMv2 packet receive processing were not only limited by the number of bytes in the received packet but also by the nodes maximum aggregation packet size limit. But this limit is relevant for TX and not for RX. It must not be enforced by batadv_(i)v_ogm_aggr_packet to avoid loss of information in case of a different limit for sender and receiver.
This has a minor side effect for B.A.T.M.A.N. IV because the batadv_iv_ogm_aggr_packet is also used for the preprocessing for the TX. But since the aggregation code itself will not allow more than BATADV_MAX_AGGREGATION_BYTES bytes, this check was never triggering (in this context) prior of removing it.
--- net/batman-adv/bat_iv_ogm.c | 3 +-- net/batman-adv/bat_v_ogm.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
net/batman-adv/bat_iv_ogm.c +1 -2
@@ -325,8 +325,7 @@ batadv_iv_ogm_aggr_packet(int buff_pos,/* check if there is enough space for the optional TVLV */ next_buff_pos +=ntohs (ogm_packet->tvlv_len); -return (next_buff_pos <= packet_len) && - (next_buff_pos <=BATADV_MAX_AGGREGATION_BYTES ); +return next_buff_pos <= packet_len; }/* send a batman ogm to a given interface */
net/batman-adv/bat_v_ogm.c +1 -2
@@ -840,8 +840,7 @@ batadv_v_ogm_aggr_packet(int buff_pos, i/* check if there is enough space for the optional TVLV */ next_buff_pos +=ntohs (ogm2_packet->tvlv_len); -return (next_buff_pos <= packet_len) && - (next_buff_pos <=BATADV_MAX_AGGREGATION_BYTES ); +return next_buff_pos <= packet_len; }/**
Greg Kroah-Hartman
maintainerPATCH 103/279 soc: qcom: pdr: Fix the potential deadlock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saranya R <[email protected]>
commit 2eeb03ad9f42dfece63051be2400af487ddb96d2 upstream.
When some client process A call pdr_add_lookup() to add the look up for the service and does schedule locator work, later a process B got a new server packet indicating locator is up and call pdr_locator_new_server() which eventually sets pdr->locator_init_complete to true which process A sees and takes list lock and queries domain list but it will timeout due to deadlock as the response will queued to the same qmi->wq and it is ordered workqueue and process B is not able to complete new server request work due to deadlock on list lock.
Fix it by removing the unnecessary list iteration as the list iteration is already being done inside locator work, so avoid it here and just call schedule_work() here.
Process A Process B
process_scheduled_works()pdr_add_lookup() qmi_data_ready_work()
process_scheduled_works() pdr_locator_new_server()
pdr->locator_init_complete=true;
pdr_locator_work()
mutex_lock(&pdr->list_lock);
pdr_locate_service() mutex_lock(&pdr->list_lock);
pdr_get_domain_list()
pr_err("PDR: %s get domain list
txn wait failed: %d\n",
req->service_name,
ret);Timeout error log due to deadlock:
"
PDR: tms/servreg get domain list txn wait failed: -110
PDR: service lookup for msm/adsp/sensor_pd:tms/servreg failed: -110
"
Thanks to Bjorn and Johan for letting me know that this commit also fixes an audio regression when using the in-kernel pd-mapper as that makes it easier to hit this race. [1]
--- drivers/soc/qcom/pdr_interface.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/soc/qcom/pdr_interface.c +1 -7
@@ -74,7 +74,6 @@ static int pdr_locator_new_server(struct { struct pdr_handle *pdr = container_of(qmi, struct pdr_handle, locator_hdl); -struct pdr_service *pds;mutex_lock (&pdr->lock);/* Create a local client port for QMI communication */
@@ -86,12 +85,7 @@ static int pdr_locator_new_server(structmutex_unlock (&pdr->lock);/* Service pending lookup requests */ -mutex_lock (&pdr->list_lock); -list_for_each_entry (pds, &pdr->lookups, node) { -if (pds->need_locator_lookup) -schedule_work (&pdr->locator_work); - } -mutex_unlock (&pdr->list_lock); +schedule_work (&pdr->locator_work);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 104/279 drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit dd8689b52a24807c2d5ce0a17cb26dc87f75235c upstream.
On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value.
Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/gpu/drm/radeon/radeon_vce.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_vce.c +1 -1
@@ -557,7 +557,7 @@ int radeon_vce_cs_parse(struct radeon_cs {int session_idx =-1 ;bool destroyed = false, created = false, allocated = false; -uint32_t tmp, handle =0 ; +uint32_t tmp =0 , handle =0 ;uint32_t *size = &tmp;int i, r =0 ;
Greg Kroah-Hartman
maintainerPATCH 105/279 drm/amdgpu: Fix JPEG video caps max size for navi1x and raven
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rosca <[email protected]>
commit ec33964d9d88488fa954a03d476a8b811efc6e85 upstream.
8192x8192 is the maximum supported resolution.
--- drivers/gpu/drm/amd/amdgpu/nv.c | 2 +- drivers/gpu/drm/amd/amdgpu/soc15.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/nv.c +1 -1
@@ -87,7 +87,7 @@ static const struct amdgpu_video_codec_i {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4906, 52)}, {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4906, 4)}, {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 8192, 8192, 0)}, {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, };
drivers/gpu/drm/amd/amdgpu/soc15.c +1 -1
@@ -123,7 +123,7 @@ static const struct amdgpu_video_codec_i {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4906, 52)}, {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4906, 4)}, {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)}, - {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, + {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 8192, 8192, 0)}, {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 4096, 4096, 0)}, };
Greg Kroah-Hartman
maintainerPATCH 106/279 mptcp: Fix data stream corruption in the address announcement
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arthur Mongodin <[email protected]>
commit 2c1f97a52cb827a5f2768e67a9dddffae1ed47ab upstream.
Because of the size restriction in the TCP options space, the MPTCP ADD_ADDR option is exclusive and cannot be sent with other MPTCP ones. For this reason, in the linked mptcp_out_options structure, group of fields linked to different options are part of the same union.
There is a case where the mptcp_pm_add_addr_signal() function can modify opts->addr, but not ended up sending an ADD_ADDR. Later on, back in mptcp_established_options, other options will be sent, but with unexpected data written in other fields due to the union, e.g. in opts->ext_copy. This could lead to a data stream corruption in the next packet.
Using an intermediate variable, prevents from corrupting previously established DSS option. The assignment of the ADD_ADDR option parameters is now done once we are sure this ADD_ADDR option can be set in the packet, e.g. after having dropped other suboptions.
[ Matt: the commit message has been updated: long lines splits and some
clarifications. ]
--- net/mptcp/options.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/mptcp/options.c +4 -2
@@ -647,6 +647,7 @@ static bool mptcp_established_options_adstruct mptcp_sock *msk =mptcp_sk (subflow->conn);bool drop_other_suboptions = false;unsigned int opt_size = *size; +struct mptcp_addr_info addr;bool echo;int len;
@@ -655,7 +656,7 @@ static bool mptcp_established_options_ad*/ if (!mptcp_pm_should_add_signal (msk) || (opts->suboptions & (OPTION_MPTCP_MPJ_ACK |OPTION_MPTCP_MPC_ACK )) || - !mptcp_pm_add_addr_signal (msk, skb, opt_size, remaining, &opts->addr, + !mptcp_pm_add_addr_signal (msk, skb, opt_size, remaining, &addr, &echo, &drop_other_suboptions))return false;
@@ -668,7 +669,7 @@ static bool mptcp_established_options_adelse if (opts->suboptions &OPTION_MPTCP_DSS )return false; - len =mptcp_add_addr_len (opts->addr.family, echo, !!opts->addr.port); + len =mptcp_add_addr_len (addr.family, echo, !!addr.port);if (remaining < len)return false;
@@ -685,6 +686,7 @@ static bool mptcp_established_options_ad opts->ahmac =0 ; *size -= opt_size; } + opts->addr = addr; opts->suboptions |=OPTION_MPTCP_ADD_ADDR ;if (!echo) { opts->ahmac = add_addr_generate_hmac(msk->local_key,
Greg Kroah-Hartman
maintainerPATCH 107/279 arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Klaassen <[email protected]>
commit 38f4aa34a5f737ea8588dac320d884cc2e762c03 upstream.
The u2phy1_host should always have the same status as usb_host1_ehci and usb_host1_ohci, otherwise the EHCI and OHCI drivers may be initialized for a disabled usb port.
Per the NanoPi R4S schematic, the phy-supply for u2phy1_host is set to the vdd_5v regulator.
--- arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts +1 -1
@@ -117,7 +117,7 @@ }; &u2phy1_host { - status = "disabled"; + phy-supply = <&vdd_5v>; }; &uart0 {
Greg Kroah-Hartman
maintainerPATCH 108/279 Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
commit b25e11f978b63cb7857890edb3a698599cddb10e upstream.
This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4 ("Bluetooth: Always request for user confirmation for Just Works") always request user confirmation with confirm_hint set since the likes of bluetoothd have dedicated policy around JUST_WORKS method (e.g. main.conf:JustWorksRepairing).
CVE: CVE-2024-8805
--- net/bluetooth/hci_event.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
net/bluetooth/hci_event.c +5 -8
@@ -4859,19 +4859,16 @@ static void hci_user_confirm_request_evt goto unlock; } -/* If no side requires MITM protection; auto-accept */ +/* If no side requires MITM protection; use JUST_CFM method */ if ((!loc_mitm || conn->remote_cap ==HCI_IO_NO_INPUT_OUTPUT ) && (!rem_mitm || conn->io_capability ==HCI_IO_NO_INPUT_OUTPUT )) { -/* If we're not the initiators request authorization to -* proceed from user space (mgmt_user_confirm with -* confirm_hint set to 1). The exception is if neither -* side had MITM or if the local IO capability is -* NoInputNoOutput, in which case we do auto-accept +/* If we're not the initiator of request authorization and the +* local IO capability is not NoInputNoOutput, use JUST_WORKS +* method (mgmt_user_confirm with confirm_hint set to 1). */ if (!test_bit (HCI_CONN_AUTH_PEND , &conn->flags) && - conn->io_capability !=HCI_IO_NO_INPUT_OUTPUT && - (loc_mitm || rem_mitm)) { + conn->io_capability !=HCI_IO_NO_INPUT_OUTPUT ) {BT_DBG ("Confirming auto-accept as acceptor" ); confirm_hint =1 ; goto confirm;
Greg Kroah-Hartman
maintainerPATCH 109/279 bpf, sockmap: Fix race between element replace and close()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
commit ed1fc5d76b81a4d681211333c026202cad4d5649 upstream.
Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_delete() unconditionally unrefs the (wrong) element:
// set map[0] = s0map_update_elem(map, 0, s0)
// drop fd of s0
close(s0)
sock_map_close()
lock_sock(sk) (s0!)
sock_map_remove_links(sk)
link = sk_psock_link_pop()
sock_map_unlink(sk, link)
sock_map_delete_from_link
// replace map[0] with s1
map_update_elem(map, 0, s1)
sock_map_update_elem
(s1!) lock_sock(sk)
sock_map_update_common
psock = sk_psock(sk)
spin_lock(&stab->lock)
osk = stab->sks[idx]
sock_map_add_link(..., &stab->sks[idx])
sock_map_unref(osk, &stab->sks[idx])
psock = sk_psock(osk)
sk_psock_put(sk, psock)
if (refcount_dec_and_test(&psock))
sk_psock_drop(sk, psock)
spin_unlock(&stab->lock)
unlock_sock(sk)
__sock_map_delete
spin_lock(&stab->lock)
sk = *psk // s1 replaced s0; sk == s1
if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch
sk = xchg(psk, NULL)
if (sk)
sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle
psock = sk_psock(sk)
sk_psock_put(sk, psock)
if (refcount_dec_and_test())
sk_psock_drop(sk, psock)
spin_unlock(&stab->lock)
release_sock(sk)Then close(map) enqueues bpf_map_free_deferred, which finally calls sock_map_free(). This results in some refcount_t warnings along with a KASAN splat [1].
Fix __sock_map_delete(), do not allow sock_map_unref() on elements that may have been replaced.
[1]:
BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330 Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred Call Trace: <TASK> dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 kasan_check_range+0x10f/0x1e0 sock_map_free+0x10e/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1202: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff88811f5b9080 which belongs to the cache UNIX-STREAM of size 1984
The buggy address is located 128 bytes inside of
freed 1984-byte region [ffff88811f5b9080, ffff88811f5b9840)
The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f5b8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff888127d49401
flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)page_type: f5(slab)
raw: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401
head: 0017ffffc0000040 ffff8881042e4500 dead000000000122 0000000000000000
head: 0000000000000000 00000000800f000f 00000001f5000000 ffff888127d49401
head: 0017ffffc0000003 ffffea00047d6e01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88811f5b9000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88811f5b9080: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88811f5b9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811f5b9200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fbDisabling lock debugging due to kernel taint
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 14 PID: 1063 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B 6.12.0+ #125 Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xce/0x150 Code: 34 73 eb 03 01 e8 82 53 ad fe 0f 0b eb b1 80 3d 27 73 eb 03 00 75 a8 48 c7 c7 80 bd 95 84 c6 05 17 73 eb 03 01 e8 62 53 ad fe <0f> 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xce/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xce/0x150 sock_map_free+0x2e5/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210
refcount_t: underflow; use-after-free.
WARNING: CPU: 14 PID: 1063 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Tainted: G B W 6.12.0+ #125 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred RIP: 0010:refcount_warn_saturate+0xee/0x150 Code: 17 73 eb 03 01 e8 62 53 ad fe 0f 0b eb 91 80 3d 06 73 eb 03 00 75 88 48 c7 c7 e0 bd 95 84 c6 05 f6 72 eb 03 01 e8 42 53 ad fe <0f> 0b e9 6e ff ff ff 80 3d e6 72 eb 03 00 0f 85 61 ff ff ff 48 c7 RSP: 0018:ffff88815c49fc70 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88811f5b9100 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: ffffed10bcde6349 R10: ffff8885e6f31a4b R11: 0000000000000000 R12: ffff88813be0b000 R13: ffff88811f5b9100 R14: ffff88811f5b9080 R15: ffff88813be0b024 FS: 0000000000000000(0000) GS:ffff8885e6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dda99b0250 CR3: 000000015dbac000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0x5f/0x1ff ? refcount_warn_saturate+0xee/0x150 ? report_bug+0x1ec/0x390 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xee/0x150 sock_map_free+0x2d3/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 10741 hardirqs last enabled at (10741): [<ffffffff84400ec6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (10740): [<ffffffff811e532d>] handle_softirqs+0x60d/0x770 softirqs last enabled at (10506): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210 softirqs last disabled at (10301): [<ffffffff811e55a9>] __irq_exit_rcu+0x109/0x210
--- net/core/sock_map.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/core/sock_map.c +2 -3
@@ -411,15 +411,14 @@ static void *sock_map_lookup_sys(structstatic int __sock_map_delete (struct bpf_stab *stab,struct sock *sk_test,struct sock **psk) { -struct sock *sk; +struct sock *sk =NULL ;int err =0 ;if (irqs_disabled ())return -EOPNOTSUPP ;/* locks here are hardirq-unsafe */ raw_spin_lock_bh (&stab->lock); - sk = *psk; -if (!sk_test || sk_test == sk) +if (!sk_test || sk_test == *psk) sk =xchg (psk,NULL );if (likely (sk))
Greg Kroah-Hartman
maintainerPATCH 110/279 ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Junge <[email protected]>
commit 486f6205c233da1baa309bde5f634eb1f8319a33 upstream.
Many Poly/Plantronics headset families name the feature, input, and/or output units in a such a way to produce control names that are not recognized by user space. As such, the volume and mute events do not get routed to the headset's audio controls.
As an example from a product family:
The microphone mute control is named
Headset Microphone Capture Switch
and the headset volume control is named
Headset Earphone Playback Volume
The quirk fixes these to become
Headset Capture Switch
Headset Playback Volume
--- sound/usb/mixer_quirks.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+)
sound/usb/mixer_quirks.c +51 -0
@@ -3553,6 +3553,52 @@ static void snd_dragonfly_quirk_db_scale } } +/* +* Some Plantronics headsets have control names that don't meet ALSA naming +* standards. This function fixes nonstandard source names. By the time +* this function is called the control name should look like one of these: +* "source names Playback Volume" +* "source names Playback Switch" +* "source names Capture Volume" +* "source names Capture Switch" +* If any of the trigger words are found in the name then the name will +* be changed to: +* "Headset Playback Volume" +* "Headset Playback Switch" +* "Headset Capture Volume" +* "Headset Capture Switch" +* depending on the current suffix. +*/ +static void snd_fix_plt_name (struct snd_usb_audio *chip, +struct snd_ctl_elem_id *id) +{ +/* no variant of "Sidetone" should be added to this list */ +static const char *const trigger[] = { +"Earphone" ,"Microphone" ,"Receive" ,"Transmit" + }; +static const char *const suffix[] = { +" Playback Volume" ," Playback Switch" , +" Capture Volume" ," Capture Switch" + }; +int i; + +for (i =0 ; i <ARRAY_SIZE (trigger); i++) +if (strstr (id->name, trigger[i])) + goto triggered; +usb_audio_dbg (chip,"no change in %s\n" , id->name); +return ; + +triggered: +for (i =0 ; i <ARRAY_SIZE (suffix); i++) +if (strstr (id->name, suffix[i])) { +usb_audio_dbg (chip,"fixing kctl name %s\n" , id->name); +snprintf (id->name,sizeof (id->name),"Headset%s" , + suffix[i]); +return ; + } +usb_audio_dbg (chip,"something wrong in kctl name %s\n" , id->name); +} +void snd_usb_mixer_fu_apply_quirk (struct usb_mixer_interface *mixer,struct usb_mixer_elem_info *cval,int unitid,struct snd_kcontrol *kctl)
@@ -3570,5 +3616,10 @@ void snd_usb_mixer_fu_apply_quirk(struct cval->min_mute =1 ;break ; } + +/* ALSA-ify some Plantronics headset control names */ +if (USB_ID_VENDOR (mixer->chip->usb_id) ==0x047f && + (cval->control ==UAC_FU_MUTE || cval->control ==UAC_FU_VOLUME )) +snd_fix_plt_name (mixer->chip, &kctl->id); }
Greg Kroah-Hartman
maintainerPATCH 111/279 HID: hid-plantronics: Add mic mute mapping and generalize quirks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Junge <[email protected]>
commit 9821709af892be9fbf4ee9a50b2f3e0604295ce0 upstream.
Add mapping for headset mute key events.
Remove PLT_QUIRK_DOUBLE_VOLUME_KEYS quirk and made it generic. The quirk logic did not keep track of the actual previous key so any key event occurring in less than or equal to 5ms was ignored.
Remove PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS quirk.
It had the same logic issue as the double key quirk and was actually masking the as designed behavior of most of the headsets. It's occurrence should be minimized with the ALSA control naming quirk that is part of the patch set.
--- drivers/hid/hid-plantronics.c | 148 +++++++++++++++++++----------------------- 1 file changed, 69 insertions(+), 79 deletions(-)
drivers/hid/hid-plantronics.c +69 -79
@@ -6,9 +6,6 @@* Copyright (c) 2015-2018 Terry Junge <[email protected]> */ -/* -*/ -#include "hid-ids.h" #include <linux/hid.h>
@@ -23,30 +20,28 @@#define PLT_VOL_UP 0x00b1#define PLT_VOL_DOWN 0x00b2 +#define PLT_MIC_MUTE 0x00b5#define PLT1_VOL_UP (PLT_HID_1_0_PAGE | PLT_VOL_UP)#define PLT1_VOL_DOWN (PLT_HID_1_0_PAGE | PLT_VOL_DOWN) +#define PLT1_MIC_MUTE (PLT_HID_1_0_PAGE | PLT_MIC_MUTE)#define PLT2_VOL_UP (PLT_HID_2_0_PAGE | PLT_VOL_UP)#define PLT2_VOL_DOWN (PLT_HID_2_0_PAGE | PLT_VOL_DOWN) +#define PLT2_MIC_MUTE (PLT_HID_2_0_PAGE | PLT_MIC_MUTE) +#define HID_TELEPHONY_MUTE (HID_UP_TELEPHONY | 0x2f) +#define HID_CONSUMER_MUTE (HID_UP_CONSUMER | 0xe2)#define PLT_DA60 0xda60#define PLT_BT300_MIN 0x0413#define PLT_BT300_MAX 0x0418 - -#define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \ - (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER) - -#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0) -#define PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS BIT(1) -#define PLT_DOUBLE_KEY_TIMEOUT 5/* ms */ -#define PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT 220/* ms */ struct plt_drv_data {unsigned long device_type; -unsigned long last_volume_key_ts; -u32 quirks; +unsigned long last_key_ts; +unsigned long double_key_to; +__u16 last_key; }; static int plantronics_input_mapping(struct hid_device *hdev,
@@ -58,34 +53,43 @@ static int plantronics_input_mapping(strunsigned short mapped_key;struct plt_drv_data *drv_data =hid_get_drvdata (hdev);unsigned long plt_type = drv_data->device_type; +int allow_mute = usage->hid ==HID_TELEPHONY_MUTE ; +int allow_consumer = field->application ==HID_CP_CONSUMERCONTROL && + (usage->hid &HID_USAGE_PAGE ) ==HID_UP_CONSUMER && + usage->hid !=HID_CONSUMER_MUTE ;/* special case for PTT products */ if (field->application ==HID_GD_JOYSTICK ) goto defaulted; -/* handle volume up/down mapping */ /* non-standard types or multi-HID interfaces - plt_type is PID */ if (!(plt_type &HID_USAGE_PAGE )) {switch (plt_type) {case PLT_DA60 : -if (PLT_ALLOW_CONSUMER ) +if (allow_consumer) goto defaulted; - goto ignored; +if (usage->hid ==HID_CONSUMER_MUTE ) { + mapped_key =KEY_MICMUTE ; + goto mapped; + } +break ;default : -if (PLT_ALLOW_CONSUMER ) +if (allow_consumer || allow_mute) goto defaulted; } + goto ignored; } -/* handle standard types - plt_type is 0xffa0uuuu or 0xffa2uuuu */ -/* 'basic telephony compliant' - allow default consumer page map */ -else if ((plt_type &HID_USAGE ) >=PLT_BASIC_TELEPHONY && - (plt_type &HID_USAGE ) !=PLT_BASIC_EXCEPTION ) { -if (PLT_ALLOW_CONSUMER ) - goto defaulted; - } -/* not 'basic telephony' - apply legacy mapping */ -/* only map if the field is in the device's primary vendor page */ -else if (!((field->application ^ plt_type) &HID_USAGE_PAGE )) { + +/* handle standard consumer control mapping */ +/* and standard telephony mic mute mapping */ +if (allow_consumer || allow_mute) + goto defaulted; + +/* handle vendor unique types - plt_type is 0xffa0uuuu or 0xffa2uuuu */ +/* if not 'basic telephony compliant' - map vendor unique controls */ +if (!((plt_type &HID_USAGE ) >=PLT_BASIC_TELEPHONY && + (plt_type &HID_USAGE ) !=PLT_BASIC_EXCEPTION ) && + !((field->application ^ plt_type) &HID_USAGE_PAGE ))switch (usage->hid) {case PLT1_VOL_UP :case PLT2_VOL_UP :
@@ -95,8 +99,11 @@ static int plantronics_input_mapping(strcase PLT2_VOL_DOWN : mapped_key =KEY_VOLUMEDOWN ; goto mapped; +case PLT1_MIC_MUTE : +case PLT2_MIC_MUTE : + mapped_key =KEY_MICMUTE ; + goto mapped; } - }/* * Future mapping of call control or other usages,
@@ -105,6 +112,8 @@ static int plantronics_input_mapping(str*/ ignored: +hid_dbg (hdev,"usage: %08x (appl: %08x) - ignored\n" , + usage->hid, field->application);return -1 ; defaulted:
@@ -123,38 +132,26 @@ static int plantronics_event(struct hid_ struct hid_usage *usage, __s32 value) {struct plt_drv_data *drv_data =hid_get_drvdata (hdev); +unsigned long prev_tsto, cur_ts; +__u16 prev_key, cur_key; -if (drv_data->quirks &PLT_QUIRK_DOUBLE_VOLUME_KEYS ) { -unsigned long prev_ts, cur_ts; - -/* Usages are filtered in plantronics_usages. */ - -if (!value)/* Handle key presses only. */ -return 0 ; - - prev_ts = drv_data->last_volume_key_ts; - cur_ts = jiffies; -if (jiffies_to_msecs (cur_ts - prev_ts) <=PLT_DOUBLE_KEY_TIMEOUT ) -return 1 ;/* Ignore the repeated key. */ - - drv_data->last_volume_key_ts = cur_ts; - } -if (drv_data->quirks &PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS ) { -unsigned long prev_ts, cur_ts; - -/* Usages are filtered in plantronics_usages. */ - -if (!value)/* Handle key presses only. */ -return 0 ; +/* Usages are filtered in plantronics_usages. */ - prev_ts = drv_data->last_volume_key_ts; - cur_ts = jiffies; -if (jiffies_to_msecs (cur_ts - prev_ts) <=PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT ) -return 1 ;/* Ignore the followed opposite volume key. */ - - drv_data->last_volume_key_ts = cur_ts; +/* HZ too low for ms resolution - double key detection disabled */ +/* or it is a key release - handle key presses only. */ +if (!drv_data->double_key_to || !value) +return 0 ; + + prev_tsto = drv_data->last_key_ts + drv_data->double_key_to; + cur_ts = drv_data->last_key_ts = jiffies; + prev_key = drv_data->last_key; + cur_key = drv_data->last_key = usage->code; + +/* If the same key occurs in <= double_key_to -- ignore it */ +if (prev_key == cur_key &&time_before_eq (cur_ts, prev_tsto)) { +hid_dbg (hdev,"double key %d ignored\n" , cur_key); +return 1 ;/* Ignore the repeated key. */ } -return 0 ; }
@@ -196,12 +193,16 @@ static int plantronics_probe(struct hid_ ret =hid_parse (hdev);if (ret) {hid_err (hdev,"parse failed\n" ); - goto err; +return ret; } drv_data->device_type =plantronics_device_type (hdev); - drv_data->quirks = id->driver_data; - drv_data->last_volume_key_ts = jiffies -msecs_to_jiffies (PLT_DOUBLE_KEY_TIMEOUT ); + drv_data->double_key_to =msecs_to_jiffies (PLT_DOUBLE_KEY_TIMEOUT ); + drv_data->last_key_ts = jiffies - drv_data->double_key_to; + +/* if HZ does not allow ms resolution - disable double key detection */ +if (drv_data->double_key_to <PLT_DOUBLE_KEY_TIMEOUT ) + drv_data->double_key_to =0 ;hid_set_drvdata (hdev, drv_data);
@@ -210,29 +211,10 @@ static int plantronics_probe(struct hid_if (ret)hid_err (hdev,"hw start failed\n" ); -err:return ret; }static const struct hid_device_id plantronics_devices[] = { - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3210_SERIES ), - .driver_data =PLT_QUIRK_DOUBLE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES ), - .driver_data =PLT_QUIRK_DOUBLE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES ), - .driver_data =PLT_QUIRK_DOUBLE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES ), - .driver_data =PLT_QUIRK_DOUBLE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3325_SERIES ), - .driver_data =PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS }, - {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , -USB_DEVICE_ID_PLANTRONICS_ENCOREPRO_500_SERIES ), - .driver_data =PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS }, {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS ,HID_ANY_ID ) }, { } };
@@ -241,6 +223,14 @@ MODULE_DEVICE_TABLE(hid, plantronics_devstatic const struct hid_usage_id plantronics_usages[] = { {HID_CP_VOLUMEUP ,EV_KEY ,HID_ANY_ID }, {HID_CP_VOLUMEDOWN ,EV_KEY ,HID_ANY_ID }, + {HID_TELEPHONY_MUTE ,EV_KEY ,HID_ANY_ID }, + {HID_CONSUMER_MUTE ,EV_KEY ,HID_ANY_ID }, + {PLT2_VOL_UP ,EV_KEY ,HID_ANY_ID }, + {PLT2_VOL_DOWN ,EV_KEY ,HID_ANY_ID }, + {PLT2_MIC_MUTE ,EV_KEY ,HID_ANY_ID }, + {PLT1_VOL_UP ,EV_KEY ,HID_ANY_ID }, + {PLT1_VOL_DOWN ,EV_KEY ,HID_ANY_ID }, + {PLT1_MIC_MUTE ,EV_KEY ,HID_ANY_ID }, {HID_TERMINATOR ,HID_TERMINATOR ,HID_TERMINATOR } };
Greg Kroah-Hartman
maintainerPATCH 112/279 atm: Fix NULL pointer dereference
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjoong Kim <[email protected]>
commit bf2986fcf82a449441f9ee4335df19be19e83970 upstream.
When MPOA_cache_impos_rcvd() receives the msg, it can trigger Null Pointer Dereference Vulnerability if both entry and holding_time are NULL. Because there is only for the situation where entry is NULL and holding_time exists, it can be passed when both entry and holding_time are NULL. If these are NULL, the entry will be passd to eg_cache_put() as parameter and it is referenced by entry->use code in it.
kasan log:
[ 3.316691] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006:I [ 3.317568] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 3.318188] CPU: 3 UID: 0 PID: 79 Comm: ex Not tainted 6.14.0-rc2 #102 [ 3.318601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 3.319298] RIP: 0010:eg_cache_remove_entry+0xa5/0x470 [ 3.319677] Code: c1 f7 6e fd 48 c7 c7 00 7e 38 b2 e8 95 64 54 fd 48 c7 c7 40 7e 38 b2 48 89 ee e80 [ 3.321220] RSP: 0018:ffff88800583f8a8 EFLAGS: 00010006 [ 3.321596] RAX: 0000000000000006 RBX: ffff888005989000 RCX: ffffffffaecc2d8e [ 3.322112] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000030 [ 3.322643] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6558b88 [ 3.323181] R10: 0000000000000003 R11: 203a207972746e65 R12: 1ffff11000b07f15 [ 3.323707] R13: dffffc0000000000 R14: ffff888005989000 R15: ffff888005989068 [ 3.324185] FS: 000000001b6313c0(0000) GS:ffff88806d380000(0000) knlGS:0000000000000000 [ 3.325042] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.325545] CR2: 00000000004b4b40 CR3: 000000000248e000 CR4: 00000000000006f0 [ 3.326430] Call Trace: [ 3.326725] <TASK> [ 3.326927] ? die_addr+0x3c/0xa0 [ 3.327330] ? exc_general_protection+0x161/0x2a0 [ 3.327662] ? asm_exc_general_protection+0x26/0x30 [ 3.328214] ? vprintk_emit+0x15e/0x420 [ 3.328543] ? eg_cache_remove_entry+0xa5/0x470 [ 3.328910] ? eg_cache_remove_entry+0x9a/0x470 [ 3.329294] ? __pfx_eg_cache_remove_entry+0x10/0x10 [ 3.329664] ? console_unlock+0x107/0x1d0 [ 3.329946] ? __pfx_console_unlock+0x10/0x10 [ 3.330283] ? do_syscall_64+0xa6/0x1a0 [ 3.330584] ? entry_SYSCALL_64_after_hwframe+0x47/0x7f [ 3.331090] ? __pfx_prb_read_valid+0x10/0x10 [ 3.331395] ? down_trylock+0x52/0x80 [ 3.331703] ? vprintk_emit+0x15e/0x420 [ 3.331986] ? __pfx_vprintk_emit+0x10/0x10 [ 3.332279] ? down_trylock+0x52/0x80 [ 3.332527] ? _printk+0xbf/0x100 [ 3.332762] ? __pfx__printk+0x10/0x10 [ 3.333007] ? _raw_write_lock_irq+0x81/0xe0 [ 3.333284] ? __pfx__raw_write_lock_irq+0x10/0x10 [ 3.333614] msg_from_mpoad+0x1185/0x2750 [ 3.333893] ? __build_skb_around+0x27b/0x3a0 [ 3.334183] ? __pfx_msg_from_mpoad+0x10/0x10 [ 3.334501] ? __alloc_skb+0x1c0/0x310 [ 3.334809] ? __pfx___alloc_skb+0x10/0x10 [ 3.335283] ? _raw_spin_lock+0xe0/0xe0 [ 3.335632] ? finish_wait+0x8d/0x1e0 [ 3.335975] vcc_sendmsg+0x684/0xba0 [ 3.336250] ? __pfx_vcc_sendmsg+0x10/0x10 [ 3.336587] ? __pfx_autoremove_wake_function+0x10/0x10 [ 3.337056] ? fdget+0x176/0x3e0 [ 3.337348] __sys_sendto+0x4a2/0x510 [ 3.337663] ? __pfx___sys_sendto+0x10/0x10 [ 3.337969] ? ioctl_has_perm.constprop.0.isra.0+0x284/0x400 [ 3.338364] ? sock_ioctl+0x1bb/0x5a0 [ 3.338653] ? __rseq_handle_notify_resume+0x825/0xd20 [ 3.339017] ? __pfx_sock_ioctl+0x10/0x10 [ 3.339316] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 3.339727] ? selinux_file_ioctl+0xa4/0x260 [ 3.340166] __x64_sys_sendto+0xe0/0x1c0 [ 3.340526] ? syscall_exit_to_user_mode+0x123/0x140 [ 3.340898] do_syscall_64+0xa6/0x1a0 [ 3.341170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3.341533] RIP: 0033:0x44a380 [ 3.341757] Code: 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c00 [ 3.343078] RSP: 002b:00007ffc1d404098 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 3.343631] RAX: ffffffffffffffda RBX: 00007ffc1d404458 RCX: 000000000044a380 [ 3.344306] RDX: 000000000000019c RSI: 00007ffc1d4040b0 RDI: 0000000000000003 [ 3.344833] RBP: 00007ffc1d404260 R08: 0000000000000000 R09: 0000000000000000 [ 3.345381] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3.346015] R13: 00007ffc1d404448 R14: 00000000004c17d0 R15: 0000000000000001 [ 3.346503] </TASK> [ 3.346679] Modules linked in: [ 3.346956] ---[ end trace 0000000000000000 ]--- [ 3.347315] RIP: 0010:eg_cache_remove_entry+0xa5/0x470 [ 3.347737] Code: c1 f7 6e fd 48 c7 c7 00 7e 38 b2 e8 95 64 54 fd 48 c7 c7 40 7e 38 b2 48 89 ee e80 [ 3.349157] RSP: 0018:ffff88800583f8a8 EFLAGS: 00010006 [ 3.349517] RAX: 0000000000000006 RBX: ffff888005989000 RCX: ffffffffaecc2d8e [ 3.350103] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000030 [ 3.350610] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6558b88 [ 3.351246] R10: 0000000000000003 R11: 203a207972746e65 R12: 1ffff11000b07f15 [ 3.351785] R13: dffffc0000000000 R14: ffff888005989000 R15: ffff888005989068 [ 3.352404] FS: 000000001b6313c0(0000) GS:ffff88806d380000(0000) knlGS:0000000000000000 [ 3.353099] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.353544] CR2: 00000000004b4b40 CR3: 000000000248e000 CR4: 00000000000006f0 [ 3.354072] note: ex[79] exited with irqs disabled [ 3.354458] note: ex[79] exited with preempt_count 1
--- net/atm/mpc.c | 2 ++ 1 file changed, 2 insertions(+)
net/atm/mpc.c +2 -0
@@ -1314,6 +1314,8 @@ static void MPOA_cache_impos_rcvd(struct holding_time = msg->content.eg_info.holding_time;dprintk ("(%s) entry = %p, holding_time = %u\n" , mpc->dev->name, entry, holding_time); +if (entry ==NULL && !holding_time) +return ;if (entry ==NULL && holding_time) { entry = mpc->eg_ops->add_entry (msg, mpc); mpc->eg_ops->put (entry);
Greg Kroah-Hartman
maintainerPATCH 113/279 ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 169f9102f9198b04afffa6164372a4ba4070f412 upstream.
Under PAN emulation when dumping backtraces from things like the LKDTM EXEC_USERSPACE test[1], a double fault (which would hang a CPU) would happen because of dump_instr() attempting to read a userspace address. Make sure copy_from_kernel_nofault() does not attempt this any more.
--- arch/arm/mm/fault.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/arm/mm/fault.c +7 -0
@@ -24,6 +24,13 @@#include "fault.h" +bool copy_from_kernel_nofault_allowed (const void *unsafe_src,size_t size) +{ +unsigned long addr = (unsigned long )unsafe_src; + +return addr >=TASK_SIZE &&ULONG_MAX - addr >= size; +} +#ifdef CONFIG_MMU /*
Greg Kroah-Hartman
maintainerPATCH 114/279 ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 8f09b8b4fa58e99cbfd9a650b31d65cdbd8e4276 upstream.
The common pattern in arm is to emit a "8<--- cut here ---" line for faults, but it was missing for do_PrefetchAbort(). Add it.
--- arch/arm/mm/fault.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mm/fault.c +1 -0
@@ -559,6 +559,7 @@ do_PrefetchAbort(unsigned long addr, unsif (!inf->fn (addr, ifsr |FSR_LNX_PF , regs))return ; +pr_alert ("8<--- cut here ---\n" );pr_alert ("Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n" , inf->name, ifsr, addr);
Greg Kroah-Hartman
maintainerPATCH 115/279 ARM: Remove address checking for MMUless devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanjun Yang <[email protected]>
commit 3ccea4784fddd96fbd6c4497eb28b45dab638c2a upstream.
Commit 169f9102f9198b ("ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()") added the function to check address before use. However, for devices without MMU, addr > TASK_SIZE will always fail. This patch move this function after the #ifdef CONFIG_MMU statement.
--- arch/arm/mm/fault.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mm/fault.c +2 -2
@@ -24,6 +24,8 @@#include "fault.h" +#ifdef CONFIG_MMU +bool copy_from_kernel_nofault_allowed (const void *unsafe_src,size_t size) {unsigned long addr = (unsigned long )unsafe_src;
@@ -31,8 +33,6 @@ bool copy_from_kernel_nofault_allowed(coreturn addr >=TASK_SIZE &&ULONG_MAX - addr >= size; } -#ifdef CONFIG_MMU -/* * This is useful to dump out the page tables associated with * 'addr' in mm 'mm'.
Greg Kroah-Hartman
maintainerPATCH 116/279 netfilter: socket: Lookup orig tuple for IPv6 SNAT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Mikityanskiy <[email protected]>
commit 932b32ffd7604fb00b5c57e239a3cc4d901ccf6e upstream.
nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any). Then socket_match() can correctly check whether the socket was transparent.
However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this conntrack lookup, making xt_socket fail to match on the socket when the packet was SNATed. Add the same logic to nf_sk_lookup_slow_v6.
IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as pods' addresses are in the fd00::/8 ULA subnet and need to be replaced with the node's external address. Cilium leverages Envoy to enforce L7 policies, and Envoy uses transparent sockets. Cilium inserts an iptables prerouting rule that matches on -m socket --transparent and redirects the packets to localhost, but it fails to match SNATed IPv6 packets due to that missing conntrack lookup.
--- net/ipv6/netfilter/nf_socket_ipv6.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
net/ipv6/netfilter/nf_socket_ipv6.c +23 -0
@@ -103,6 +103,10 @@ struct sock *nf_sk_lookup_slow_v6(structstruct sk_buff *data_skb =NULL ;int doff =0 ;int thoff =0 , tproto; +#if IS_ENABLED (CONFIG_NF_CONNTRACK ) +enum ip_conntrack_info ctinfo; +struct nf_conn const *ct; +#endif tproto =ipv6_find_hdr (skb, &thoff,-1 ,NULL ,NULL );if (tproto <0 ) {
@@ -136,6 +140,25 @@ struct sock *nf_sk_lookup_slow_v6(structreturn NULL ; } +#if IS_ENABLED (CONFIG_NF_CONNTRACK ) +/* Do the lookup with the original socket address in +* case this is a reply packet of an established +* SNAT-ted connection. +*/ + ct =nf_ct_get (skb, &ctinfo); +if (ct && + ((tproto !=IPPROTO_ICMPV6 && + ctinfo ==IP_CT_ESTABLISHED_REPLY ) || + (tproto ==IPPROTO_ICMPV6 && + ctinfo ==IP_CT_RELATED_REPLY )) && + (ct->status &IPS_SRC_NAT_DONE )) { + daddr = &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.u3.in6; + dport = (tproto ==IPPROTO_TCP ) ? + ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.u.tcp.port : + ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple.src.u.udp.port; + } +#endif +return nf_socket_get_sock_v6 (net, data_skb, doff, tproto, saddr, daddr, sport, dport, indev); }
Greg Kroah-Hartman
maintainerPATCH 117/279 ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dhruv Deshpande <[email protected]>
commit 35ef1c79d2e09e9e5a66e28a66fe0df4368b0f3d upstream.
The mute LED on this HP laptop uses ALC236 and requires a quirk to function. This patch enables the existing quirk for the device.
Tested on my laptop and the LED behaviour works as intended.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9302,6 +9302,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8811 ,"HP Spectre x360 15-eb1xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ),SND_PCI_QUIRK (0x103c ,0x8812 ,"HP Spectre x360 15-eb1xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ),SND_PCI_QUIRK (0x103c ,0x881d ,"HP 250 G8 Notebook PC" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ), +SND_PCI_QUIRK (0x103c ,0x881e ,"HP Laptop 15s-du3xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8846 ,"HP EliteBook 850 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8847 ,"HP EliteBook x360 830 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 118/279 counter: stm32-lptimer-cnt: fix error handling when enabling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Gasnier <[email protected]>
commit 8744dcd4fc7800de2eb9369410470bb2930d4c14 upstream.
In case the stm32_lptim_set_enable_state() fails to update CMP and ARR, a timeout error is raised, by regmap_read_poll_timeout. It may happen, when the lptimer runs on a slow clock, and the clock is gated only few times during the polling.
Badly, when this happen, STM32_LPTIM_ENABLE in CR register has been set. So the 'enable' state in sysfs wrongly lies on the counter being correctly enabled, due to CR is read as one in stm32_lptim_is_enabled().
To fix both issues:
- enable the clock before writing CMP, ARR and polling ISR bits. It will avoid the possible timeout error.
- clear the ENABLE bit in CR and disable the clock in the error path.
--- drivers/counter/stm32-lptimer-cnt.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
drivers/counter/stm32-lptimer-cnt.c +15 -9
@@ -59,37 +59,43 @@ static int stm32_lptim_set_enable_state(return 0 ; } + ret =clk_enable (priv->clk); +if (ret) + goto disable_cnt; +/* LP timer must be enabled before writing CMP & ARR */ ret =regmap_write (priv->regmap,STM32_LPTIM_ARR , priv->ceiling);if (ret) -return ret; + goto disable_clk; ret =regmap_write (priv->regmap,STM32_LPTIM_CMP ,0 );if (ret) -return ret; + goto disable_clk;/* ensure CMP & ARR registers are properly written */ ret =regmap_read_poll_timeout (priv->regmap,STM32_LPTIM_ISR , val, (val &STM32_LPTIM_CMPOK_ARROK ) ==STM32_LPTIM_CMPOK_ARROK ,100 ,1000 );if (ret) -return ret; + goto disable_clk; ret =regmap_write (priv->regmap,STM32_LPTIM_ICR ,STM32_LPTIM_CMPOKCF_ARROKCF );if (ret) -return ret; + goto disable_clk; - ret =clk_enable (priv->clk); -if (ret) { -regmap_write (priv->regmap,STM32_LPTIM_CR ,0 ); -return ret; - } priv->enabled = true;/* Start LP timer in continuous mode */ return regmap_update_bits (priv->regmap,STM32_LPTIM_CR ,STM32_LPTIM_CNTSTRT ,STM32_LPTIM_CNTSTRT ); + +disable_clk: +clk_disable (priv->clk); +disable_cnt: +regmap_write (priv->regmap,STM32_LPTIM_CR ,0 ); + +return ret; }static int stm32_lptim_setup (struct stm32_lptim_cnt *priv,int enable)
Greg Kroah-Hartman
maintainerPATCH 119/279 counter: microchip-tcb-capture: Fix undefined counter channel state on probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Breathitt Gray <[email protected]>
commit c0c9c73434666dc99ee156b25e7e722150bee001 upstream.
Hardware initialize of the timer counter channel does not occur on probe thus leaving the Count in an undefined state until the first function_write() callback is executed. Fix this by performing the proper hardware initialization during probe.
--- drivers/counter/microchip-tcb-capture.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/counter/microchip-tcb-capture.c +19 -0
@@ -370,6 +370,25 @@ static int mchp_tc_probe(struct platform channel); } +/* Disable Quadrature Decoder and position measure */ + ret =regmap_update_bits (regmap,ATMEL_TC_BMR ,ATMEL_TC_QDEN |ATMEL_TC_POSEN ,0 ); +if (ret) +return ret; + +/* Setup the period capture mode */ + ret =regmap_update_bits (regmap,ATMEL_TC_REG (priv->channel[0 ],CMR ), +ATMEL_TC_WAVE |ATMEL_TC_ABETRG |ATMEL_TC_CMR_MASK | +ATMEL_TC_TCCLKS , +ATMEL_TC_CMR_MASK ); +if (ret) +return ret; + +/* Enable clock and trigger counter */ + ret =regmap_write (regmap,ATMEL_TC_REG (priv->channel[0 ],CCR ), +ATMEL_TC_CLKEN |ATMEL_TC_SWTRG ); +if (ret) +return ret; + priv->tc_cfg = tcb_config; priv->regmap = regmap; priv->counter.name =dev_name (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 120/279 tty: serial: 8250: Add some more device IDs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <[email protected]>
commit be6a23650908e2f827f2e7839a3fbae41ccb5b63 upstream.
These card IDs got missed the first time around.
--- drivers/tty/serial/8250/8250_pci.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/tty/serial/8250/8250_pci.c +16 -0
@@ -5536,6 +5536,14 @@ static const struct pci_device_id serialPCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_b2_2_115200 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0BA2, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_b2_2_115200 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0BA3, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_b2_2_115200 },/* * Brainboxes UC-235/246 */
@@ -5656,6 +5664,14 @@ static const struct pci_device_id serialPCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_b2_4_115200 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0C42, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_b2_4_115200 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0C43, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_b2_4_115200 },/* * Brainboxes UC-420 */
Greg Kroah-Hartman
maintainerPATCH 121/279 tty: serial: 8250: Add Brainboxes XC devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <[email protected]>
commit 5c7e2896481a177bbda41d7850f05a9f5a8aee2b upstream.
These ExpressCard devices use the OxPCIE chip and can be used with this driver.
--- drivers/tty/serial/8250/8250_pci.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/tty/serial/8250/8250_pci.c +30 -0
@@ -2869,6 +2869,22 @@ static struct pci_serial_quirk pci_seria .setup = pci_oxsemi_tornado_setup, }, { + .vendor = PCI_VENDOR_ID_INTASHIELD, + .device = 0x4026, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .init = pci_oxsemi_tornado_init, + .setup = pci_oxsemi_tornado_setup, + }, + { + .vendor = PCI_VENDOR_ID_INTASHIELD, + .device = 0x4021, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .init = pci_oxsemi_tornado_init, + .setup = pci_oxsemi_tornado_setup, + }, + { .vendor = PCI_VENDOR_ID_INTEL, .device = 0x8811, .subvendor = PCI_ANY_ID,
@@ -5898,6 +5914,20 @@ static const struct pci_device_id serialPCI_ANY_ID ,PCI_ANY_ID ,0 ,0 , pbn_oxsemi_1_15625000 }, +/* +* Brainboxes XC-235 +*/ + { PCI_VENDOR_ID_INTASHIELD, 0x4026, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_oxsemi_1_15625000 }, +/* +* Brainboxes XC-475 +*/ + { PCI_VENDOR_ID_INTASHIELD, 0x4021, +PCI_ANY_ID ,PCI_ANY_ID , +0 ,0 , + pbn_oxsemi_1_15625000 },/* * Perle PCI-RAS cards
Greg Kroah-Hartman
maintainerPATCH 122/279 net: usb: qmi_wwan: add Telit Cinterion FN990B composition
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 9dba9a45f8ca64a7df32aada14c20a3153af1ac8 upstream.
Add the following Telit Cinterion FN990B composition:
0x10d0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10d0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN990 S: SerialNumber=43b38f19 C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1370,6 +1370,7 @@ static const struct usb_device_id produc {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10d0, 0)}, /* Telit FN990B */ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
Greg Kroah-Hartman
maintainerPATCH 123/279 net: usb: qmi_wwan: add Telit Cinterion FE990B composition
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit e8cdd91926aac2c53a23925c538ad4c44be4201f upstream.
Add the following Telit Cinterion FE990B composition:0x10b0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
usb-devices:
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10b0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE990 S: SerialNumber=28c2595e C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1367,6 +1367,7 @@ static const struct usb_device_id produc {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10b0, 0)}, /* Telit FE990B */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */
Greg Kroah-Hartman
maintainerPATCH 124/279 net: usb: usbnet: restore usb%d name exception for local mac addresses
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
commit 2ea396448f26d0d7d66224cb56500a6789c7ed07 upstream.
commit 8a7d12d674ac ("net: usb: usbnet: fix name regression") assumed that local addresses always came from the kernel, but some devices hand out local mac addresses so we ended up with point-to-point devices with a mac set by the driver, renaming to eth%d when they used to be named usb%d.
Userspace should not rely on device name, but for the sake of stability restore the local mac address check portion of the naming exception:
point to point devices which either have no mac set by the driver or have a local mac handed out by the driver will keep the usb%d name.
(some USB LTE modems are known to hand out a stable mac from the locally administered range; that mac appears to be random (different for mulitple devices) and can be reset with device-specific commands, so while such devices would benefit from getting a OUI reserved, we have to deal with these and might as well preserve the existing behavior to avoid breaking fragile openwrt configurations and such on upgrade.)
--- drivers/net/usb/usbnet.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/net/usb/usbnet.c +15 -6
@@ -181,6 +181,17 @@ int usbnet_get_ethernet_addr(struct usbn }EXPORT_SYMBOL_GPL (usbnet_get_ethernet_addr); +static bool usbnet_needs_usb_name_format (struct usbnet *dev,struct net_device *net) +{ +/* Point to point devices which don't have a real MAC address +* (or report a fake local one) have historically used the usb%d +* naming. Preserve this.. +*/ +return (dev->driver_info->flags &FLAG_POINTTOPOINT ) !=0 && + (is_zero_ether_addr (net->dev_addr) || +is_local_ether_addr (net->dev_addr)); +} +static void intr_complete (struct urb *urb) {struct usbnet *dev = urb->context;
@@ -1764,13 +1775,11 @@ usbnet_probe (struct usb_interface *udevif (status <0 ) goto out1; -// heuristic: "usb%d" for links we know are two-host, -// else "eth%d" when there's reasonable doubt. userspace -// can rename the link if it knows better. +/* heuristic: rename to "eth%d" if we are not sure this link +* is two-host (these links keep "usb%d") +*/ if ((dev->driver_info->flags &FLAG_ETHER ) !=0 && - ((dev->driver_info->flags &FLAG_POINTTOPOINT ) ==0 || -/* somebody touched it*/ - !is_zero_ether_addr (net->dev_addr))) + !usbnet_needs_usb_name_format (dev, net))strscpy (net->name,"eth%d" ,sizeof (net->name));/* WLAN devices should always be named "wlan%d" */ if ((dev->driver_info->flags &FLAG_WLAN ) !=0 )
Greg Kroah-Hartman
maintainerPATCH 125/279 memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Qiu <[email protected]>
commit 4676741a3464b300b486e70585c3c9b692be1632 upstream.
This fixes the following crash:
==================================================================
BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_one_work+0x357/0x660 worker_thread+0x390/0x4c0 ? __pfx_worker_thread+0x10/0x10 kthread+0x190/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 161446: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_noprof+0x1a7/0x470 memstick_alloc_host+0x1f/0xe0 [memstick] rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms] platform_probe+0x60/0xe0 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 bus_probe_device+0xbd/0xd0 device_add+0x4a5/0x760 platform_device_add+0x189/0x370 mfd_add_device+0x587/0x5e0 mfd_add_devices+0xb1/0x130 rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb] usb_probe_interface+0x15c/0x460 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 rebind_marked_interfaces.isra.0+0xcc/0x110 usb_reset_device+0x352/0x410 usbdev_do_ioctl+0xe5c/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 161506: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0x34/0x50 kfree+0x1fd/0x3b0 device_release+0x56/0xf0 kobject_cleanup+0x73/0x1c0 rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms] platform_remove+0x2f/0x50 device_release_driver_internal+0x24b/0x2e0 bus_remove_device+0x124/0x1d0 device_del+0x239/0x530 platform_device_del.part.0+0x19/0xe0 platform_device_unregister+0x1c/0x40 mfd_remove_devices_fn+0x167/0x170 device_for_each_child_reverse+0xc9/0x130 mfd_remove_devices+0x6e/0xa0 rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb] usb_unbind_interface+0xf3/0x3f0 device_release_driver_internal+0x24b/0x2e0 proc_disconnect_claim+0x13d/0x220 usbdev_do_ioctl+0xb5e/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 The buggy address belongs to the object at ffff888136335000 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 896 bytes inside of
freed 2048-byte region [ffff888136335000, ffff888136335800)
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x136330 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 0017ffffc0000003 ffffea0004d8cc01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888136335280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888136335300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888136335380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888136335400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888136335480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- drivers/memstick/host/rtsx_usb_ms.c | 1 + 1 file changed, 1 insertion(+)
drivers/memstick/host/rtsx_usb_ms.c +1 -0
@@ -813,6 +813,7 @@ static int rtsx_usb_ms_drv_remove(struct host->eject = true;cancel_work_sync (&host->handle_req); +cancel_delayed_work_sync (&host->poll_card);mutex_lock (&host->host_mutex);if (host->req) {
Greg Kroah-Hartman
maintainerPATCH 126/279 serial: 8250_dma: terminate correct DMA in tx_dma_flush()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
commit a26503092c75abba70a0be2aa01145ecf90c2a22 upstream.
When flushing transmit side DMA, it is the transmit channel that should be terminated, not the receive channel.
--- drivers/tty/serial/8250/8250_dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_dma.c +1 -1
@@ -150,7 +150,7 @@ void serial8250_tx_dma_flush(struct uart*/ dma->tx_size =0 ; -dmaengine_terminate_async (dma->rxchan); +dmaengine_terminate_async (dma->txchan); }int serial8250_rx_dma (struct uart_8250_port *p)
Greg Kroah-Hartman
maintainerPATCH 127/279 media: i2c: et8ek8: Dont strip remove function when driver is builtin
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit 545b215736c5c4b354e182d99c578a472ac9bfce upstream.
Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally.
This also fixes a W=1 modpost warning:
WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text)
--- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/et8ek8/et8ek8_driver.c +2 -2
@@ -1460,7 +1460,7 @@ err_mutex:return ret; } -static int __exit et8ek8_remove(struct i2c_client *client) +static int et8ek8_remove (struct i2c_client *client) {struct v4l2_subdev *subdev =i2c_get_clientdata (client);struct et8ek8_sensor *sensor =to_et8ek8_sensor (subdev);
@@ -1504,7 +1504,7 @@ static struct i2c_driver et8ek8_i2c_driv .of_match_table = et8ek8_of_table, }, .probe_new = et8ek8_probe, - .remove = __exit_p(et8ek8_remove), + .remove = et8ek8_remove, .id_table = et8ek8_id_table, };
Greg Kroah-Hartman
maintainerPATCH 128/279 watch_queue: fix pipe accounting mismatch
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
[ Upstream commit f13abc1e8e1a3b7455511c4e122750127f6bc9b0 ]
Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.
To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers()
(It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?)
--- kernel/watch_queue.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/watch_queue.c +9 -0
@@ -274,6 +274,15 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)if (ret <0 ) goto error; +/* +* pipe_resize_ring() does not update nr_accounted for watch_queue +* pipes, because the above vastly overprovisions. Set nr_accounted on +* and max_usage this pipe to the number that was actually charged to +* the user above via account_pipe_buffers. +*/ + pipe->max_usage = nr_pages; + pipe->nr_accounted = nr_pages; + ret = -ENOMEM ; pages =kcalloc (sizeof (struct page *), nr_pages,GFP_KERNEL );if (!pages)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/279 x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <[email protected]>
[ Upstream commit 33ea120582a638b2f2e380a50686c2b1d7cce795 ]
The CPA_ARRAY test always uses len[1] as numpages argument to change_page_attr_set() although the addresses array is different each iteration of the test loop.
Replace len[1] with len[i] to have numpages matching the addresses array.
--- arch/x86/mm/pat/cpa-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/mm/pat/cpa-test.c +1 -1
@@ -183,7 +183,7 @@ static int pageattr_test(void)break ;case 1 : - err =change_page_attr_set (addrs, len[1 ],PAGE_CPA_TEST ,1 ); + err =change_page_attr_set (addrs, len[i],PAGE_CPA_TEST ,1 );break ;case 2 :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/279 cpufreq: scpi: compare kHz instead of Hz
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: zuoqian <[email protected]>
[ Upstream commit 4742da9774a416908ef8e3916164192c15c0e2d1 ]
The CPU rate from clk_get_rate() may not be divisible by 1000 (e.g., 133333333). But the rate calculated from frequency(kHz) is always divisible by 1000 (e.g., 133333000).
Comparing the rate causes a warning during CPU scaling:
"cpufreq: __target_index: Failed to change cpu frequency: -5". When we choose to compare kHz here, the issue does not occur.
--- drivers/cpufreq/scpi-cpufreq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/cpufreq/scpi-cpufreq.c +3 -2
@@ -47,8 +47,9 @@ static unsigned int scpi_cpufreq_get_rate(unsigned int cpu)static int scpi_cpufreq_set_target (struct cpufreq_policy *policy,unsigned int index) { -u64 rate = policy->freq_table[index].frequency *1000 ; +unsigned long freq_khz = policy->freq_table[index].frequency;struct scpi_data *priv = policy->driver_data; +unsigned long rate = freq_khz *1000 ;int ret; ret =clk_set_rate (priv->clk, rate);
@@ -56,7 +57,7 @@ scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)if (ret)return ret; -if (clk_get_rate (priv->clk) != rate) +if (clk_get_rate (priv->clk) /1000 != freq_khz)return -EIO ;return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/279 cpufreq: governor: Fix negative idle_time handling in dbs_update()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Zhan <[email protected]>
[ Upstream commit 3698dd6b139dc37b35a9ad83d9330c1f99666c02 ]
We observed an issue that the CPU frequency can't raise up with a 100% CPU load when NOHZ is off and the 'conservative' governor is selected.
'idle_time' can be negative if it's obtained from get_cpu_idle_time_jiffy() when NOHZ is off. This was found and explained in commit 9485e4ca0b48 ("cpufreq: governor: Fix handling of special cases in dbs_update()").
However, commit 7592019634f8 ("cpufreq: governors: Fix long idle detection logic in load calculation") introduced a comparison between 'idle_time' and 'samling_rate' to detect a long idle interval. While 'idle_time' is converted to int before comparison, it's actually promoted to unsigned again when compared with an unsigned 'sampling_rate'. Hence, this leads to wrong idle interval detection when it's in fact 100% busy and sets policy_dbs->idle_periods to a very large value. 'conservative' adjusts the frequency to minimum because of the large 'idle_periods', such that the frequency can't raise up. 'Ondemand' doesn't use policy_dbs->idle_periods so it fortunately avoids the issue.
Correct negative 'idle_time' to 0 before any use of it in dbs_update().
--- drivers/cpufreq/cpufreq_governor.c | 45 +++++++++++++++--------------- 1 file changed, 23 insertions(+), 22 deletions(-)
drivers/cpufreq/cpufreq_governor.c +23 -22
@@ -145,7 +145,23 @@ unsigned int dbs_update(struct cpufreq_policy *policy) time_elapsed = update_time - j_cdbs->prev_update_time; j_cdbs->prev_update_time = update_time; - idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +/* +* cur_idle_time could be smaller than j_cdbs->prev_cpu_idle if +* it's obtained from get_cpu_idle_time_jiffy() when NOHZ is +* off, where idle_time is calculated by the difference between +* time elapsed in jiffies and "busy time" obtained from CPU +* statistics. If a CPU is 100% busy, the time elapsed and busy +* time should grow with the same amount in two consecutive +* samples, but in practice there could be a tiny difference, +* making the accumulated idle time decrease sometimes. Hence, +* in this case, idle_time should be regarded as 0 in order to +* make the further process correct. +*/ +if (cur_idle_time > j_cdbs->prev_cpu_idle) + idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +else + idle_time =0 ; + j_cdbs->prev_cpu_idle = cur_idle_time;if (ignore_nice) {
@@ -162,7 +178,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)* calls, so the previous load value can be used then. */ load = j_cdbs->prev_load; - }else if (unlikely ((int )idle_time >2 * sampling_rate && + }else if (unlikely (idle_time >2 * sampling_rate && j_cdbs->prev_load)) {/* * If the CPU had gone completely idle and a task has
@@ -189,30 +205,15 @@ unsigned int dbs_update(struct cpufreq_policy *policy) load = j_cdbs->prev_load; j_cdbs->prev_load =0 ; }else { -if (time_elapsed >= idle_time) { +if (time_elapsed > idle_time) load =100 * (time_elapsed - idle_time) / time_elapsed; - }else { -/* -* That can happen if idle_time is returned by -* get_cpu_idle_time_jiffy(). In that case -* idle_time is roughly equal to the difference -* between time_elapsed and "busy time" obtained -* from CPU statistics. Then, the "busy time" -* can end up being greater than time_elapsed -* (for example, if jiffies_64 and the CPU -* statistics are updated by different CPUs), -* so idle_time may in fact be negative. That -* means, though, that the CPU was busy all -* the time (on the rough average) during the -* last sampling interval and 100 can be -* returned as the load. -*/ - load = (int )idle_time <0 ?100 :0 ; - } +else + load =0 ; + j_cdbs->prev_load = load; } -if (unlikely ((int )idle_time >2 * sampling_rate)) { +if (unlikely (idle_time >2 * sampling_rate)) {unsigned int periods = idle_time / sampling_rate;if (periods < idle_periods)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/279 x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 5d3b81d4d8520efe888536b6906dc10fd1a228a8 ]
The init_task instance of struct task_struct is statically allocated and may not contain the full FP state for userspace. As such, limit the copy to the valid area of both init_task and 'dst' and ensure all memory is initialized.
Note that the FP state is only needed for userspace, and as such it is entirely reasonable for init_task to not contain parts of it.
----
v2:
- Fix code if arch_task_struct_size < sizeof(init_task) by using memcpy_and_pad.
--- arch/x86/kernel/process.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/kernel/process.c +6 -1
@@ -83,7 +83,12 @@ EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);*/ int arch_dup_task_struct (struct task_struct *dst,struct task_struct *src) { -memcpy (dst, src, arch_task_struct_size); +/* init_task is not dynamically sized (incomplete FPU state) */ +if (unlikely (src == &init_task)) +memcpy_and_pad (dst, arch_task_struct_size, src,sizeof (init_task),0 ); +else +memcpy (dst, src, arch_task_struct_size); +#ifdef CONFIG_VM86 dst->thread.vm86 =NULL ;#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/279 x86/platform: Only allow CONFIG_EISA for 32-bit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 976ba8da2f3c2f1e997f4f620da83ae65c0e3728 ]
The CONFIG_EISA menu was cleaned up in 2018, but this inadvertently brought the option back on 64-bit machines: ISA remains guarded by a CONFIG_X86_32 check, but EISA no longer depends on ISA.
The last Intel machines ith EISA support used a 82375EB PCI/EISA bridge from 1993 that could be paired with the 440FX chipset on early Pentium-II CPUs, long before the first x86-64 products.
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -194,7 +194,7 @@ config X86 select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS select HAVE_EBPF_JIT select HAVE_EFFICIENT_UNALIGNED_ACCESS - select HAVE_EISA + select HAVE_EISA if X86_32 select HAVE_EXIT_THREAD select HAVE_FAST_GUP select HAVE_FENTRY if X86_64 || DYNAMIC_FTRACE
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/279 PM: sleep: Adjust check before setting power.must_resume
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit eeb87d17aceab7803a5a5bcb6cf2817b745157cf ]
The check before setting power.must_resume in device_suspend_noirq() does not take power.child_count into account, but it should do that, so use pm_runtime_need_not_resume() in it for this purpose and adjust the comment next to it accordingly.
--- drivers/base/power/main.c | 13 ++++++------- drivers/base/power/runtime.c | 2 +- include/linux/pm_runtime.h | 2 ++ 3 files changed, 9 insertions(+), 8 deletions(-)
drivers/base/power/main.c +6 -7
@@ -1239,14 +1239,13 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a dev->power.is_noirq_suspended = true;/* -* Skipping the resume of devices that were in use right before the -* system suspend (as indicated by their PM-runtime usage counters) -* would be suboptimal. Also resume them if doing that is not allowed -* to be skipped. +* Devices must be resumed unless they are explicitly allowed to be left +* in suspend, but even in that case skipping the resume of devices that +* were in use right before the system suspend (as indicated by their +* runtime PM usage counters and child counters) would be suboptimal. */ -if (atomic_read (&dev->power.usage_count) >1 || - !(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && - dev->power.may_skip_resume)) +if (!(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && + dev->power.may_skip_resume) || !pm_runtime_need_not_resume (dev)) dev->power.must_resume = true;if (dev->power.must_resume)
drivers/base/power/runtime.c +1 -1
@@ -1809,7 +1809,7 @@ void pm_runtime_drop_link(struct device_link *link)pm_request_idle (link->supplier); } -static bool pm_runtime_need_not_resume (struct device *dev) +bool pm_runtime_need_not_resume (struct device *dev) { return atomic_read(&dev->power.usage_count) <= 1 && (atomic_read(&dev->power.child_count) == 0 ||
include/linux/pm_runtime.h +2 -0
@@ -46,6 +46,7 @@ static inline bool queue_pm_work(struct work_struct *work)extern int pm_generic_runtime_suspend (struct device *dev);extern int pm_generic_runtime_resume (struct device *dev); +extern bool pm_runtime_need_not_resume (struct device *dev);extern int pm_runtime_force_suspend (struct device *dev);extern int pm_runtime_force_resume (struct device *dev);
@@ -234,6 +235,7 @@ static inline bool queue_pm_work(struct work_struct *work) { return false; }static inline int pm_generic_runtime_suspend (struct device *dev) {return 0 ; }static inline int pm_generic_runtime_resume (struct device *dev) {return 0 ; } +static inline bool pm_runtime_need_not_resume (struct device *dev) {return true; }static inline int pm_runtime_force_suspend (struct device *dev) {return 0 ; }static inline int pm_runtime_force_resume (struct device *dev) {return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/279 selinux: Chain up tool resolving errors in install_policy.sh
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Schumacher <[email protected]>
[ Upstream commit 6ae0042f4d3f331e841495eb0a3d51598e593ec2 ]
Subshell evaluations are not exempt from errexit, so if a command is not available, which will fail and exit the script as a whole. This causes the helpful error messages to not be printed if they are tacked on using a $? comparison.
Resolve the issue by using chains of logical operators, which are not subject to the effects of errexit.
--- scripts/selinux/install_policy.sh | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
scripts/selinux/install_policy.sh +6 -9
@@ -6,27 +6,24 @@ if [ `id -u` -ne 0 ]; then exit 1 fi -SF=`which setfiles` -if [ $? -eq 1 ]; then +SF=`which setfiles` || { echo "Could not find setfiles" echo "Do you have policycoreutils installed?" exit 1 -fi +} -CP=`which checkpolicy` -if [ $? -eq 1 ]; then +CP=`which checkpolicy` || { echo "Could not find checkpolicy" echo "Do you have checkpolicy installed?" exit 1 -fi +} VERS=`$CP -V | awk '{print $1}'` -ENABLED=`which selinuxenabled` -if [ $? -eq 1 ]; then +ENABLED=`which selinuxenabled` || { echo "Could not find selinuxenabled" echo "Do you have libselinux-utils installed?" exit 1 -fi +} if selinuxenabled; then echo "SELinux is already enabled"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/279 EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit d59d844e319d97682c8de29b88d2d60922a683b3 ]
The EDAC_MC_LAYER_CHIP_SELECT layer pertains to the rank, not the DIMM. Fix its size to reflect the number of ranks instead of the number of DIMMs. Also delete the unused macros IE31200_{DIMMS,RANKS}.
--- drivers/edac/ie31200_edac.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/edac/ie31200_edac.c +1 -3
@@ -83,8 +83,6 @@ (((did) & PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK) == \ PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK)) -#define IE31200_DIMMS 4 -#define IE31200_RANKS 8#define IE31200_RANKS_PER_CHANNEL 4#define IE31200_DIMMS_PER_CHANNEL 2#define IE31200_CHANNELS 2
@@ -418,7 +416,7 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) nr_channels =how_many_channels (pdev); layers[0 ].type =EDAC_MC_LAYER_CHIP_SELECT ; - layers[0 ].size =IE31200_DIMMS ; + layers[0 ].size =IE31200_RANKS_PER_CHANNEL ; layers[0 ].is_virt_csrow = true; layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = nr_channels;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/279 EDAC/ie31200: Fix the DIMM size mask for several SoCs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 3427befbbca6b19fe0e37f91d66ce5221de70bf1 ]
The DIMM size mask for {Sky, Kaby, Coffee} Lake is not bits{7:0}, but bits{5:0}. Fix it.
--- drivers/edac/ie31200_edac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/edac/ie31200_edac.c +2 -1
@@ -154,6 +154,7 @@#define IE31200_MAD_DIMM_0_OFFSET 0x5004#define IE31200_MAD_DIMM_0_OFFSET_SKL 0x500C#define IE31200_MAD_DIMM_SIZE GENMASK_ULL(7, 0) +#define IE31200_MAD_DIMM_SIZE_SKL GENMASK_ULL(5, 0)#define IE31200_MAD_DIMM_A_RANK BIT(17)#define IE31200_MAD_DIMM_A_RANK_SHIFT 17#define IE31200_MAD_DIMM_A_RANK_SKL BIT(10)
@@ -367,7 +368,7 @@ static void __iomem *ie31200_map_mchbar(struct pci_dev *pdev)static void __skl_populate_dimm_info (struct dimm_data *dd,u32 addr_decode,int chan) { - dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE ; + dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE_SKL ; dd->dual_rank = (addr_decode & (IE31200_MAD_DIMM_A_RANK_SKL << (chan <<4 ))) ?1 :0 ; dd->x16_width = ((addr_decode & (IE31200_MAD_DIMM_A_WIDTH_SKL << (chan <<4 ))) >> (IE31200_MAD_DIMM_A_WIDTH_SKL_SHIFT + (chan <<4 )));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/279 EDAC/ie31200: Fix the error path order of ie31200_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 231e341036d9988447e3b3345cf741a98139199e ]
The error path order of ie31200_init() is incorrect, fix it.
--- drivers/edac/ie31200_edac.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/edac/ie31200_edac.c +7 -5
@@ -607,7 +607,7 @@ static int __init ie31200_init(void) pci_rc =pci_register_driver (&ie31200_driver);if (pci_rc <0 ) - goto fail0; +return pci_rc;if (!mci_pdev) { ie31200_registered =0 ;
@@ -618,11 +618,13 @@ static int __init ie31200_init(void)if (mci_pdev)break ; } +if (!mci_pdev) {edac_dbg (0 ,"ie31200 pci_get_device fail\n" ); pci_rc = -ENODEV ; - goto fail1; + goto fail0; } + pci_rc =ie31200_init_one (mci_pdev, &ie31200_pci_tbl[i]);if (pci_rc <0 ) {edac_dbg (0 ,"ie31200 init fail\n" );
@@ -630,12 +632,12 @@ static int __init ie31200_init(void) goto fail1; } } -return 0 ; +return 0 ; fail1: -pci_unregister_driver (&ie31200_driver); -fail0:pci_dev_put (mci_pdev); +fail0: +pci_unregister_driver (&ie31200_driver);return pci_rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/279 thermal: int340x: Add NULL check for adev
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit 2542a3f70e563a9e70e7ded314286535a3321bdb ]
Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480
("platform/x86: int3472: Check for adev == NULL").
Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe().
Note, under the same directory, int3400_thermal_probe() has such a check.
--- drivers/thermal/intel/int340x_thermal/int3402_thermal.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/intel/int340x_thermal/int3402_thermal.c +3 -0
@@ -45,6 +45,9 @@ static int int3402_thermal_probe(struct platform_device *pdev)struct int3402_thermal_data *d;int ret; +if (!adev) +return -ENODEV ; +if (!acpi_has_method (adev->handle,"_TMP" ))return -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/279 PM: sleep: Fix handling devices with direct_complete set on errors
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 03f1444016b71feffa1dfb8a51f15ba592f94b13 ]
When dpm_suspend() fails, some devices with power.direct_complete set may not have been handled by device_suspend() yet, so runtime PM has not been disabled for them yet even though power.direct_complete is set.
Since device_resume() expects that runtime PM has been disabled for all devices with power.direct_complete set, it will attempt to reenable runtime PM for the devices that have not been processed by device_suspend() which does not make sense. Had those devices had runtime PM disabled before device_suspend() had run, device_resume() would have inadvertently enable runtime PM for them, but this is not expected to happen because it would require ->prepare() callbacks to return positive values for devices with runtime PM disabled, which would be invalid.
In practice, this issue is most likely benign because pm_runtime_enable() will not allow the "disable depth" counter to underflow, but it causes a warning message to be printed for each affected device.
To allow device_resume() to distinguish the "direct complete" devices that have been processed by device_suspend() from those which have not been handled by it, make device_suspend() set power.is_suspended for "direct complete" devices.
Next, move the power.is_suspended check in device_resume() before the power.direct_complete check in it to make it skip the "direct complete" devices that have not been handled by device_suspend().
This change is based on a preliminary patch from Saravana Kannan.
--- drivers/base/power/main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/base/power/main.c +4 -4
@@ -897,6 +897,9 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)if (dev->power.syscore) goto Complete; +if (!dev->power.is_suspended) + goto Complete; +if (dev->power.direct_complete) {/* Match the pm_runtime_disable() in __device_suspend(). */ pm_runtime_enable (dev);
@@ -915,9 +918,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)*/ dev->power.is_prepared = false; -if (!dev->power.is_suspended) - goto Unlock; -if (dev->pm_domain) { info ="power domain " ; callback =pm_op (&dev->pm_domain->ops, state);
@@ -957,7 +957,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async) error =dpm_run_callback (callback, dev, state, info); dev->power.is_suspended = false; - Unlock:device_unlock (dev);dpm_watchdog_clear (&wd);
@@ -1642,6 +1641,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)pm_runtime_disable (dev);if (pm_runtime_status_suspended (dev)) {pm_dev_dbg (dev, state,"direct-complete " ); + dev->power.is_suspended = true; goto Complete; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/279 lockdep: Dont disable interrupts on RT in disable_irq_nosync_lockdep.*()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 87886b32d669abc11c7be95ef44099215e4f5788 ]
disable_irq_nosync_lockdep() disables interrupts with lockdep enabled to avoid false positive reports by lockdep that a certain lock has not been acquired with disabled interrupts. The user of this macros expects that a lock can be acquried without disabling interrupts because the IRQ line triggering the interrupt is disabled.
This triggers a warning on PREEMPT_RT because after disable_irq_nosync_lockdep.*() the following spinlock_t now is acquired with disabled interrupts.
On PREEMPT_RT there is no difference between spin_lock() and spin_lock_irq() so avoiding disabling interrupts in this case works for the two remaining callers as of today.
Don't disable interrupts on PREEMPT_RT in disable_irq_nosync_lockdep.*().
--- include/linux/interrupt.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/linux/interrupt.h +4 -4
@@ -408,7 +408,7 @@ irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec,static inline void disable_irq_nosync_lockdep (unsigned int irq) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_disable ();#endif }
@@ -416,7 +416,7 @@ static inline void disable_irq_nosync_lockdep(unsigned int irq)static inline void disable_irq_nosync_lockdep_irqsave (unsigned int irq,unsigned long *flags) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_save (*flags);#endif }
@@ -431,7 +431,7 @@ static inline void disable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep (unsigned int irq) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_enable ();#endif enable_irq (irq);
@@ -439,7 +439,7 @@ static inline void enable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep_irqrestore (unsigned int irq,unsigned long *flags) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_restore (*flags);#endif enable_irq (irq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/279 perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit c96fff391c095c11dc87dab35be72dee7d217cde ]
The poll man page says POLLRDNORM is equivalent to POLLIN. For poll(), it seems that if user sets pollfd with POLLRDNORM in userspace, perf_poll will not return until timeout even if perf_output_wakeup called, whereas POLLIN returns.
--- kernel/events/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/ring_buffer.c +1 -1
@@ -19,7 +19,7 @@static void perf_output_wakeup (struct perf_output_handle *handle) { -atomic_set (&handle->rb->poll,EPOLLIN ); +atomic_set (&handle->rb->poll,EPOLLIN |EPOLLRDNORM ); handle->event->pending_wakeup =1 ;irq_work_queue (&handle->event->pending_irq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/279 media: platform: allgro-dvt: unregister v4l2_device on the error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit c2b96a6818159fba8a3bcc38262da9e77f9b3ec7 ]
In allegro_probe(), the v4l2 device is not unregistered in the error path, which results in a memory leak. Fix it by calling v4l2_device_unregister() before returning error.
--- drivers/media/platform/allegro-dvt/allegro-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/allegro-dvt/allegro-core.c +1 -0
@@ -3740,6 +3740,7 @@ static int allegro_probe(struct platform_device *pdev)if (ret <0 ) {v4l2_err (&dev->v4l2_dev,"failed to request firmware: %d\n" , ret); +v4l2_device_unregister (&dev->v4l2_dev);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 144/279 HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
[ Upstream commit fe0fb58325e519008e2606a5aa2cff7ad23e212d ]
The line
obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/
in top-level HID Makefile is both superfluous (as CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER depends on CONFIG_INTEL_ISH_HID, which contains intel-ish-hid/ already) and wrong (as it's missing the CONFIG_ prefix).
Just remove it.
--- drivers/hid/Makefile | 1 - 1 file changed, 1 deletion(-)
drivers/hid/Makefile +0 -1
@@ -144,7 +144,6 @@ obj-$(CONFIG_USB_KBD) += usbhid/ obj-$(CONFIG_I2C_HID_CORE) += i2c-hid/ obj-$(CONFIG_INTEL_ISH_HID) += intel-ish-hid/ -obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/ obj-$(CONFIG_AMD_SFH_HID) += amd-sfh-hid/
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 145/279 ALSA: hda/realtek: Always honor no_shutup_pins
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 5a0c72c1da3cbc0cd4940a95d1be2830104c6edf ]
The workaround for Dell machines to skip the pin-shutup for mic pins introduced alc_headset_mic_no_shutup() that is replaced from the generic snd_hda_shutup_pins() for certain codecs. The problem is that the call is done unconditionally even if spec->no_shutup_pins is set. This seems causing problems on other platforms like Lenovo.
This patch corrects the behavior and the driver honors always spec->no_shutup_pins flag and skips alc_headset_mic_no_shutup() if it's set.
--- sound/pci/hda/patch_realtek.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +4 -2
@@ -576,6 +576,9 @@ static void alc_shutup_pins(struct hda_codec *codec) {struct alc_spec *spec = codec->spec; +if (spec->no_shutup_pins) +return ; +switch (codec->core.vendor_id) {case 0x10ec0236 :case 0x10ec0256 :
@@ -591,8 +594,7 @@ static void alc_shutup_pins(struct hda_codec *codec)alc_headset_mic_no_shutup (codec);break ;default : -if (!spec->no_shutup_pins) -snd_hda_shutup_pins (codec); +snd_hda_shutup_pins (codec);break ; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 146/279 ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <[email protected]>
[ Upstream commit 45ff65e30deb919604e68faed156ad96ce7474d9 ]
For 'ti,j7200-cpb-audio' compatible, there is support for only one PLL for 48k. For 11025, 22050, 44100 and 88200 sampling rates, due to absence of J721E_CLK_PARENT_44100, we get EINVAL while running any audio application. Add support for these rates by using the 48k parent clock and adjusting the clock for these rates later in j721e_configure_refclk.
--- sound/soc/ti/j721e-evm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/ti/j721e-evm.c +2 -0
@@ -182,6 +182,8 @@ static int j721e_configure_refclk(struct j721e_priv *priv, clk_id =J721E_CLK_PARENT_48000 ; else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_44100]) clk_id =J721E_CLK_PARENT_44100 ; + else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_48000]) + clk_id =J721E_CLK_PARENT_48000 ; else return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 147/279 drm/bridge: ti-sn65dsi86: Fix multiple instances
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 574f5ee2c85a00a579549d50e9fc9c6c072ee4c4 ]
Each bridge instance creates up to four auxiliary devices with different names. However, their IDs are always zero, causing duplicate filename errors when a system has multiple bridges:
sysfs: cannot create duplicate filename '/bus/auxiliary/devices/ti_sn65dsi86.gpio.0'
Fix this by using a unique instance ID per bridge instance. The instance ID is derived from the I2C adapter number and the bridge's I2C address, to support multiple instances on the same bus.
--- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/bridge/ti-sn65dsi86.c +2 -0
@@ -424,6 +424,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata, const char *name) {struct device *dev = pdata->dev; +const struct i2c_client *client =to_i2c_client (dev);struct auxiliary_device *aux;int ret;
@@ -432,6 +433,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,return -ENOMEM ; aux->name = name; + aux->id = (client->adapter->nr <<10 ) | client->addr; aux->dev.parent = dev; aux->dev.release = ti_sn65dsi86_aux_device_release;device_set_of_node_from_dev (&aux->dev, dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 148/279 drm/dp_mst: Fix drm RAD print
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
[ Upstream commit 6bbce873a9c97cb12f5455c497be279ac58e707f ]
[Why]
The RAD of sideband message printed today is incorrect.
For RAD stored within MST branch
- If MST branch LCT is 1, it's RAD array is untouched and remained as 0.
- If MST branch LCT is larger than 1, use nibble to store the up facing port number in cascaded sequence as illustrated below:
u8 RAD[0] = (LCT_2_UFP << 4) | LCT_3_UFP
RAD[1] = (LCT_4_UFP << 4) | LCT_5_UFP
...In drm_dp_mst_rad_to_str(), it wrongly to use BIT_MASK(4) to fetch the port number of one nibble.
[How]
Adjust the code by:
- RAD array items are valuable only for LCT >= 1.
- Use 0xF as the mask to replace BIT_MASK(4)
V2:
- Document how RAD is constructed (Imre)
V3:
- Adjust the comment for rad[] so kdoc formats it properly (Lyude)
--- drivers/gpu/drm/drm_dp_mst_topology.c | 8 ++++---- include/drm/drm_dp_mst_helper.h | 7 +++++++ 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/gpu/drm/drm_dp_mst_topology.c +4 -4
@@ -178,13 +178,13 @@ static int drm_dp_mst_rad_to_str(const u8 rad[8], u8 lct, char *out, size_t len) { int i; -u8 unpacked_rad[16 ]; +u8 unpacked_rad[16 ] = {}; -for (i =0 ; i < lct; i++) { +for (i =1 ; i < lct; i++) {if (i %2 ) - unpacked_rad[i] = rad[i /2 ] >>4 ; + unpacked_rad[i] = rad[(i -1 ) /2 ] >>4 ;else - unpacked_rad[i] = rad[i /2 ] &BIT_MASK (4 ); + unpacked_rad[i] = rad[(i -1 ) /2 ] &0xF ; }/* TODO: Eventually add something to printk so we can format the rad
include/drm/drm_dp_mst_helper.h +7 -0
@@ -232,6 +232,13 @@ struct drm_dp_mst_branch {*/ struct list_head destroy_next; +/** +* @rad: Relative Address of the MST branch. +* For &drm_dp_mst_topology_mgr.mst_primary, it's rad[8] are all 0, +* unset and unused. For MST branches connected after mst_primary, +* in each element of rad[] the nibbles are ordered by the most +* signifcant 4 bits first and the least significant 4 bits second. +*/ u8 rad[8 ];u8 lct;int num_ports;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 149/279 drm: xlnx: zynqmp: Fix max dma segment size
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 28b529a98525123acd37372a04d21e87ec2edcf7 ]
Fix "mapping sg segment longer than device claims to support" warning by setting the max segment size.
--- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/xlnx/zynqmp_dpsub.c +2 -0
@@ -204,6 +204,8 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev)if (ret)return ret; +dma_set_max_seg_size (&pdev->dev,DMA_BIT_MASK (32 )); +/* Try the reserved memory. Proceed if there's none. */ of_reserved_mem_device_init (&pdev->dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 150/279 drm/vkms: Fix use after free and double free on init error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit ed15511a773df86205bda66c37193569575ae828 ]
If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it might double free it.
Fix both possible errors by initializing default_config only when the driver initialization succeeded.
--- drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/gpu/drm/vkms/vkms_drv.c +9 -6
@@ -226,17 +226,19 @@ static int __init vkms_init(void)if (!config)return -ENOMEM ; - default_config = config; - config->cursor = enable_cursor; config->writeback = enable_writeback; config->overlay = enable_overlay; ret =vkms_create (config); -if (ret) +if (ret) {kfree (config); +return ret; + } -return ret; + default_config = config; + +return 0 ; }static void vkms_destroy (struct vkms_config *config)
@@ -260,9 +262,10 @@ static void vkms_destroy(struct vkms_config *config) static void __exit vkms_exit(void) { -if (default_config->dev) -vkms_destroy (default_config); +if (!default_config) +return ; +vkms_destroy (default_config);kfree (default_config); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 151/279 drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 0be123cafc06eed0fd1227166a66e786434b0c50 ]
The probe function of this driver may fail after registering the audio platform device: in that case, the state is not getting cleaned up, leaving this device registered.
Adding up to the mix, should the probe function of this driver return a probe deferral for N times, we're registering up to N audio platform devices and, again, never freeing them up.
To fix this, add a pointer to the audio platform device in the mtk_hdmi structure, and add a devm action to unregister it upon driver removal or probe failure.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +19 -6
@@ -174,6 +174,7 @@ struct mtk_hdmi {unsigned int sys_offset;void __iomem *regs;enum hdmi_colorspace csp; +struct platform_device *audio_pdev;struct hdmi_audio_param aud_param;bool audio_enable;bool powered;
@@ -1667,6 +1668,11 @@ static const struct hdmi_codec_ops mtk_hdmi_audio_codec_ops = { .no_capture_mute = 1, }; +static void mtk_hdmi_unregister_audio_driver (void *data) +{ +platform_device_unregister (data); +} +static int mtk_hdmi_register_audio_driver (struct device *dev) {struct mtk_hdmi *hdmi =dev_get_drvdata (dev);
@@ -1676,13 +1682,20 @@ static int mtk_hdmi_register_audio_driver(struct device *dev) .i2s = 1, .data = hdmi, }; -struct platform_device *pdev; +int ret; - pdev =platform_device_register_data (dev,HDMI_CODEC_DRV_NAME , -PLATFORM_DEVID_AUTO , &codec_data, -sizeof (codec_data)); -if (IS_ERR (pdev)) -return PTR_ERR (pdev); + hdmi->audio_pdev =platform_device_register_data (dev, +HDMI_CODEC_DRV_NAME , +PLATFORM_DEVID_AUTO , + &codec_data, +sizeof (codec_data)); +if (IS_ERR (hdmi->audio_pdev)) +return PTR_ERR (hdmi->audio_pdev); + + ret =devm_add_action_or_reset (dev, mtk_hdmi_unregister_audio_driver, + hdmi->audio_pdev); +if (ret) +return ret;DRM_INFO ("%s driver bound to HDMI\n" ,HDMI_CODEC_DRV_NAME );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 152/279 drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 72fcb88e7bbc053ed4fc74cebb0315b98a0f20c3 ]
Rename member aud_sampe_size of struct hdmi_audio_param to aud_sample_size to fix a typo and enhance readability.
This commit brings no functional changes.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +4 -4
@@ -138,7 +138,7 @@ enum hdmi_aud_channel_swap_type {struct hdmi_audio_param {enum hdmi_audio_coding_type aud_codec; -enum hdmi_audio_sample_size aud_sampe_size; +enum hdmi_audio_sample_size aud_sample_size;enum hdmi_aud_input_type aud_input_type;enum hdmi_aud_i2s_fmt aud_i2s_fmt;enum hdmi_aud_mclk aud_mclk;
@@ -1076,7 +1076,7 @@ static int mtk_hdmi_output_init(struct mtk_hdmi *hdmi) hdmi->csp =HDMI_COLORSPACE_RGB ; aud_param->aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - aud_param->aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + aud_param->aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; aud_param->aud_input_type =HDMI_AUD_INPUT_I2S ; aud_param->aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; aud_param->aud_mclk =HDMI_AUD_MCLK_128FS ;
@@ -1577,14 +1577,14 @@ static int mtk_hdmi_audio_hw_params(struct device *dev, void *data,switch (daifmt->fmt) {case HDMI_I2S : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_I2S ; hdmi_params.aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; hdmi_params.aud_mclk =HDMI_AUD_MCLK_128FS ;break ;case HDMI_SPDIF : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_SPDIF ;break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 153/279 PCI/ASPM: Fix link state exit during switch upstream function removal
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Stodden <[email protected]>
[ Upstream commit cbf937dcadfd571a434f8074d057b32cd14fbea5 ]
Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed.
That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after.
After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link.
That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports.
The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order.
On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone.
--- drivers/pci/pcie/aspm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/pci/pcie/aspm.c +9 -8
@@ -1014,16 +1014,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) parent_link = link->parent;/* -* link->downstream is a pointer to the pci_dev of function 0. If -* we remove that function, the pci_dev is about to be deallocated, -* so we can't use link->downstream again. Free the link state to -* avoid this. +* Free the parent link state, no later than function 0 (i.e. +* link->downstream) being removed. * -* If we're removing a non-0 function, it's possible we could -* retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends -* programming the same ASPM Control value for all functions of -* multi-function devices, so disable ASPM for all of them. +* Do not free the link state any earlier. If function 0 is a +* switch upstream port, this link state is parent_link to all +* subordinate ones. */ +if (pdev != link->downstream) + goto out; +pcie_config_aspm_link (link,0 );list_del (&link->sibling);free_link_state (link);
@@ -1034,6 +1034,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)pcie_config_aspm_path (parent_link); } + out:mutex_unlock (&aspm_lock);up_read (&pci_bus_sem); }
Signature · 1 line
2.39.5