6.6.87-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.6.87-rc1 review
This is the start of the stable review cycle for the 6.6.87 release. There are 268 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Apr 2025 10:47:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.87-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.87-rc1
Chuck Lever <[email protected]>
NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
Li Lingfeng <[email protected]>
nfsd: put dl_stid if fail to queue dl_recall
Murad Masimov <[email protected]>
media: streamzap: fix race between device disconnection and urb callback
Oleg Nesterov <[email protected]>
exec: fix the racy usage of fs_struct->in_exec
Roman Smirnov <[email protected]>
jfs: add index corruption check to DT_GETPAGE()
Qasim Ijaz <[email protected]>
jfs: fix slab-out-of-bounds read in ea_get()
Acs, Jakub <[email protected]>
ext4: fix OOB read when checking dotdot dir
Theodore Ts'o <[email protected]>
ext4: don't over-report free space or inodes in statvfs
Angelos Oikonomopoulos <[email protected]>
arm64: Don't call NULL in do_compat_alignment_fixup()
Ran Xiaokai <[email protected]>
tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
Douglas Raillard <[email protected]>
tracing: Fix synth event printk format for str fields
Douglas Raillard <[email protected]>
tracing: Ensure module defining synth event cannot be unloaded while tracing
Tengda Wu <[email protected]>
tracing: Fix use-after-free in print_graph_function_flags during tracer switching
Norbert Szetei <[email protected]>
ksmbd: validate zero num_subauth before sub_auth is accessed
Namjae Jeon <[email protected]>
ksmbd: fix session use-after-free in multichannel connection
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in ksmbd_sessions_deregister()
Norbert Szetei <[email protected]>
ksmbd: add bounds check for create lease context
Namjae Jeon <[email protected]>
ksmbd: add bounds check for durable handle context
Ulf Hansson <[email protected]>
mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD
Karel Balej <[email protected]>
mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
Miaoqian Lin <[email protected]>
mmc: omap: Fix memory leak in mmc_omap_new_slot
Paul Menzel <[email protected]>
ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
Murad Masimov <[email protected]>
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
Jann Horn <[email protected]>
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
Guilherme G. Piccoli <[email protected]>
x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
Josef Bacik <[email protected]>
btrfs: handle errors from btrfs_dec_ref() properly
Ivan Orlov <[email protected]>
kunit/overflow: Fix UB in overflow_allocation_test
Kan Liang <[email protected]>
perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
Peter Zijlstra (Intel) <[email protected]>
perf/x86/intel: Apply static call for drain_pebs
Markus Elfring <[email protected]>
ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Correct command storage data length
Hans de Goede <[email protected]>
ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers
Boris Ostrovsky <[email protected]>
x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
Tianyu Lan <[email protected]>
x86/hyperv: Fix check of return value from snp_set_vmsa()
Hengqi Chen <[email protected]>
LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC
Hengqi Chen <[email protected]>
LoongArch: BPF: Don't override subprog's return value
Hengqi Chen <[email protected]>
LoongArch: BPF: Fix off-by-one error in build_prologue()
Huacai Chen <[email protected]>
LoongArch: Increase ARCH_DMA_MINALIGN up to 16
Ying Lu <[email protected]>
usbnet:fix NPE during rx_complete
Alex Hung <[email protected]>
drm/amd/display: Check link_index before accessing dc->links[]
Tengda Wu <[email protected]>
tracing: Correct the refcount if the hist/hist_debug file fails to open
Masami Hiramatsu (Google) <[email protected]>
tracing/hist: Support POLLPRI event for poll on histogram
Masami Hiramatsu (Google) <[email protected]>
tracing/hist: Add poll(POLLIN) support on hist file
Steven Rostedt <[email protected]>
tracing: Switch trace_events_hist.c code over to use guard()
Steven Rostedt (Google) <[email protected]>
tracing: Allow creating instances with specified system events
Yeoreum Yun <[email protected]>
perf/core: Fix child_total_time_enabled accounting bug at task exit
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: fix num_mec
Dave Marquardt <[email protected]>
net: ibmveth: make veth_pool_store stop hanging
Henry Martin <[email protected]>
arcnet: Add NULL check in com20020pci_probe()
Ido Schimmel <[email protected]>
ipv6: Do not consider link down nexthops in path selection
Ido Schimmel <[email protected]>
ipv6: Start path selection from the first nexthop
Lin Ma <[email protected]>
net: fix geneve_opt length integer overflow
David Oberhollenzer <[email protected]>
net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
Fernando Fernandez Mancera <[email protected]>
ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
Lin Ma <[email protected]>
netfilter: nft_tunnel: fix geneve_opt type confusion addition
Antoine Tenart <[email protected]>
net: decrease cached dst counters in dst_release
Guillaume Nault <[email protected]>
tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
Stefano Garzarella <[email protected]>
vsock: avoid timeout during connect() if the socket is closing
Kuniyuki Iwashima <[email protected]>
udp: Fix memory accounting leak.
Tobias Waldekranz <[email protected]>
net: mvpp2: Prevent parser TCAM memory corruption
Cong Wang <[email protected]>
net_sched: skbprio: Remove overly strict queue assertions
Debin Zhu <[email protected]>
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
Florian Westphal <[email protected]>
netfilter: nf_tables: don't unregister hook when table is dormant
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only
Vitaly Lifshits <[email protected]>
e1000e: change k1 configuration on MTP and later platforms
Henry Martin <[email protected]>
ASoC: imx-card: Add NULL check in imx_card_probe()
Alexandre Ghiti <[email protected]>
riscv: Fix hugetlb retrieval of number of ptes in case of !present pte
Christophe JAILLET <[email protected]>
ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe()
Herton R. Krzesinski <[email protected]>
x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs
Palmer Dabbelt <[email protected]>
RISC-V: errata: Use medany for relocatable builds
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA
Richard Fitzgerald <[email protected]>
firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success
Nikita Shubin <[email protected]>
ntb: intel: Fix using link status DB's
Yajun Deng <[email protected]>
ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
Juhan Jin <[email protected]>
riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra
Al Viro <[email protected]>
spufs: fix a leak in spufs_create_context()
Al Viro <[email protected]>
spufs: fix gang directory lifetimes
Al Viro <[email protected]>
spufs: fix a leak on spufs_new_file() failure
Tasos Sahanidis <[email protected]>
hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}Roger Quadros <[email protected]>
memory: omap-gpmc: drop no compatible check
Oliver Hartkopp <[email protected]>
can: statistics: use atomic access in hot path
Navon John Lukose <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
Mario Limonciello <[email protected]>
drm/amd: Keep display off while going into S4
Keith Busch <[email protected]>
nvme-pci: fix stuck reset on concurrent DPC and HP
Vladis Dronov <[email protected]>
x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
Michael Kelley <[email protected]>
x86/hyperv: Fix output argument to hypercall that changes page visibility
Waiman Long <[email protected]>
locking/semaphore: Use wake_q to wake up processes outside lock critical section
Emmanuel Grumbach <[email protected]>
wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state
Naman Jain <[email protected]>
x86/hyperv/vtl: Stop kernel from probing VTL0 low memory
Shrikanth Hegde <[email protected]>
sched/deadline: Use online cpus for validating runtime
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA
Wentao Guan <[email protected]>
HID: i2c-hid: improve i2c_hid_get_report error message
David E. Box <[email protected]>
platform/x86/intel/vsec: Add Diamond Rapids support
Dmitry Panchenko <[email protected]>
platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet
Namjae Jeon <[email protected]>
cifs: fix incorrect validation for num_aces field of smb_acl
Peter Zijlstra <[email protected]>
perf/core: Fix perf_pmu_register() vs. perf_init_event()
Daniel Bárta <[email protected]>
ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0
Antheas Kapenekakis <[email protected]>
ALSA: hda/realtek: Fix Asus Z13 2025 audio
Simon Tatham <[email protected]>
affs: don't write overlarge OFS data block size fields
Simon Tatham <[email protected]>
affs: generate OFS sequence numbers starting at 1
Matthias Proske <[email protected]>
wifi: brcmfmac: keep power during suspend if board requires it
Icenowy Zheng <[email protected]>
nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
Icenowy Zheng <[email protected]>
nvme-pci: clean up CMBMSC when registering CMB fails
Sagi Grimberg <[email protected]>
nvme-tcp: fix possible UAF in nvme_tcp_poll
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: use the right version of the rate API
Johannes Berg <[email protected]>
wifi: iwlwifi: fw: allocate chained SG tables for dump
Josh Poimboeuf <[email protected]>
rcu-tasks: Always inline rcu_irq_work_resched()
Josh Poimboeuf <[email protected]>
context_tracking: Always inline ct_{nmi,irq}_{enter,exit}()
Josh Poimboeuf <[email protected]>
sched/smt: Always inline sched_smt_active()
David Laight <[email protected]>
objtool: Fix verbose disassembly if CROSS_COMPILE isn't set
Geetha sowjanya <[email protected]>
octeontx2-af: Free NIX_AF_INT_VEC_GEN irq
Geetha sowjanya <[email protected]>
octeontx2-af: Fix mbox INTR handler when num VFs > 64
Giovanni Gherdovich <[email protected]>
ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid
Yuli Wang <[email protected]>
LoongArch: Rework the arch_kgdb_breakpoint() implementation
谢致邦 (XIE Zhibang) <[email protected]>
LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig
Josh Poimboeuf <[email protected]>
objtool: Fix segfault in ignore_unreachable_insn()
Feng Yang <[email protected]>
ring-buffer: Fix bytes_dropped calculation issue
Lama Kayal <[email protected]>
net/mlx5e: SHAMPO, Make reserved size independent of page size
Namjae Jeon <[email protected]>
ksmbd: fix r_count dec/increment mismatch
Namjae Jeon <[email protected]>
ksmbd: fix multichannel connection failure
Miaoqian Lin <[email protected]>
ksmbd: use aead_request_free to match aead_request_alloc
Lubomir Rintel <[email protected]>
rndis_host: Flag RNDIS modems as WWAN devices
Mark Zhang <[email protected]>
rtnetlink: Allocate vfinfo size for VF GUIDs when supported
Yuezhang Mo <[email protected]>
exfat: fix the infinite loop in exfat_find_last_cluster()
Wang Zhaolong <[email protected]>
smb: client: Fix netns refcount imbalance causing leaks and use-after-free
Trond Myklebust <[email protected]>
NFS: Shut down the nfs_client only after all the superblocks
Josh Poimboeuf <[email protected]>
objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
Marcus Meissner <[email protected]>
perf tools: annotate asm_pure_loop.S
Bart Van Assche <[email protected]>
fs/procfs: fix the comment above proc_pid_wchan()
Jiri Slaby (SUSE) <[email protected]>
tty: n_tty: use uint for space returned by tty_write_room()
谢致邦 (XIE Zhibang) <[email protected]>
staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
Arnaldo Carvalho de Melo <[email protected]>
perf python: Check if there is space to copy all the event
Arnaldo Carvalho de Melo <[email protected]>
perf python: Don't keep a raw_data pointer to consumed ring buffer space
Arnaldo Carvalho de Melo <[email protected]>
perf python: Decrement the refcount of just created event on failure
Arnaldo Carvalho de Melo <[email protected]>
perf python: Fixup description of sample.id event member
Stanley Chu <[email protected]>
i3c: master: svc: Fix missing the IBI rules
Benjamin Berg <[email protected]>
um: hostfs: avoid issues on inode number reuse by host
Benjamin Berg <[email protected]>
um: remove copy_from_kernel_nofault_allowed
Cyan Yang <[email protected]>
selftests/mm/cow: fix the incorrect error handling
Alistair Popple <[email protected]>
fuse: fix dax truncate/punch_hole fault path
Trond Myklebust <[email protected]>
NFSv4: Don't trigger uneccessary scans for return-on-close delegations
Anshuman Khandual <[email protected]>
arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
Vasiliy Kovalev <[email protected]>
ocfs2: validate l_tree_depth to avoid out-of-bounds access
Sourabh Jain <[email protected]>
kexec: initialize ELF lowest address to ULONG_MAX
David Hildenbrand <[email protected]>
kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page()
Arnaldo Carvalho de Melo <[email protected]>
perf units: Fix insufficient array space
Ian Rogers <[email protected]>
perf evlist: Add success path to evlist__create_syswide_maps
Uwe Kleine-König <[email protected]>
iio: adc: ad7124: Fix comparison of channel configs
Uwe Kleine-König <[email protected]>
iio: adc: ad4130: Fix comparison of channel setups
Peng Fan <[email protected]>
dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister
Dan Carpenter <[email protected]>
fs/ntfs3: Prevent integer overflow in hdr_first_de()
Dan Carpenter <[email protected]>
fs/ntfs3: Fix a couple integer overflows on 32bit systems
Niklas Neronin <[email protected]>
usb: xhci: correct debug message page size calculation
Thomas Richter <[email protected]>
perf bench: Fix perf bench syscall loop count
Leo Yan <[email protected]>
perf arm-spe: Fix load-store operation checking
Jonathan Cameron <[email protected]>
iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails.
Jonathan Cameron <[email protected]>
iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
Mario Limonciello <[email protected]>
ucsi_ccg: Don't show failed to get FW build information error
James Clark <[email protected]>
perf pmu: Don't double count common sysfs and json events
Yuanfang Zhang <[email protected]>
coresight-etm4x: add isb() before reading the TRCSTATR
Mike Christie <[email protected]>
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
Ilkka Koskinen <[email protected]>
coresight: catu: Fix number of pages while using 64k pages
Joe Hattori <[email protected]>
soundwire: slave: fix an OF node reference leak in soundwire slave device
Qasim Ijaz <[email protected]>
isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
Ian Rogers <[email protected]>
perf stat: Fix find_stat for mixed legacy/non-legacy events
Barnabás Czémán <[email protected]>
clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
Andy Shevchenko <[email protected]>
pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm()
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for aead auth key length
Jann Horn <[email protected]>
x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
Remi Pommarel <[email protected]>
leds: Fix LED_OFF brightness race
Nikita Zhandarovich <[email protected]>
mfd: sm501: Switch to BIT() to mitigate integer overflows
Fabrizio Castro <[email protected]>
pinctrl: renesas: rzv2m: Fix missing of_node_put() call
Patrisious Haddad <[email protected]>
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
Herbert Xu <[email protected]>
crypto: nx - Fix uninitialised hv_nxc on error
Artur Weber <[email protected]>
power: supply: max77693: Fix wrong conversion of charge input threshold value
Jann Horn <[email protected]>
x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
Jerome Brunet <[email protected]>
clk: amlogic: g12a: fix mmc A peripheral clock
Laurentiu Mihalcea <[email protected]>
clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents
Alice Ryhl <[email protected]>
rust: fix signature of rust_fmt_argument
Saket Kumar Bhaskar <[email protected]>
selftests/bpf: Select NUMA_NO_NODE to create map
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop non existing 32k clock parent
Jerome Brunet <[email protected]>
clk: amlogic: g12b: fix cluster A parent data
Prathamesh Shete <[email protected]>
pinctrl: tegra: Set SFIO mode to Mux Register
Maher Sanalla <[email protected]>
IB/mad: Check available slots before posting receive WRs
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
Cheng Xu <[email protected]>
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
Chiara Meiohas <[email protected]>
RDMA/mlx5: Fix calculation of total invalidated pages
Roman Gushchin <[email protected]>
RDMA/core: Don't expose hw_counters outside of init net namespace
Peter Geis <[email protected]>
clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
Fabrizio Castro <[email protected]>
pinctrl: renesas: rzg2l: Fix missing of_node_put() call
Fabrizio Castro <[email protected]>
pinctrl: renesas: rza2: Fix missing of_node_put() call
Tanya Agarwal <[email protected]>
lib: 842: Improve error handling in sw842_compress()
Hou Tao <[email protected]>
bpf: Use preempt_count() directly in bpf_send_signal_common()
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
Kees Bakker <[email protected]>
RDMA/mana_ib: Ensure variable err is initialized
Vladimir Lypak <[email protected]>
clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
Will McVicker <[email protected]>
clk: samsung: Fix UBSAN panic in samsung_clk_init()
David Hildenbrand <[email protected]>
x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
Viktor Malik <[email protected]>
selftests/bpf: Fix string read in strncmp benchmark
Andrii Nakryiko <[email protected]>
libbpf: Fix hypothetical STT_SECTION extern NULL deref case
Luca Weiss <[email protected]>
remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
Zijun Hu <[email protected]>
of: property: Increase NR_FWNODE_REFERENCE_ARGS
Peng Fan <[email protected]>
remoteproc: core: Clear table_sz when rproc_shutdown
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for sec spec check
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for aead authsize alignment
Jerome Brunet <[email protected]>
clk: amlogic: gxbb: drop incorrect flag on 32k clock
Danila Chernetsov <[email protected]>
fbdev: sm501fb: Add some geometry checks.
Arnd Bergmann <[email protected]>
mdacon: rework dependency list
Markus Elfring <[email protected]>
fbdev: au1100fb: Move a variable assignment behind a null pointer check
Ilpo Järvinen <[email protected]>
PCI: pciehp: Don't enable HPIE when resuming in poll mode
Christophe JAILLET <[email protected]>
PCI: histb: Fix an error handling path in histb_pcie_probe()
Thadeu Lima de Souza Cascardo <[email protected]>
drm/amd/display: avoid NPD when ASIC does not support DMUB
Dan Carpenter <[email protected]>
drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
Douglas Anderson <[email protected]>
drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
Thippeswamy Havalige <[email protected]>
PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
Dan Carpenter <[email protected]>
PCI: Remove stray put_device() in pci_register_host_bridge()
Vitaliy Shevtsov <[email protected]>
drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
Nishanth Aravamudan <[email protected]>
PCI: Avoid reset when disabled via sysfs
Feng Tang <[email protected]>
PCI/portdrv: Only disable pciehp interrupts early when needed
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix potential premature regulator disabling
Jim Quinlan <[email protected]>
PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
Jim Quinlan <[email protected]>
PCI: brcmstb: Use internal register to change link capability
Hans Zhang <[email protected]>
PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables'
Marijn Suijten <[email protected]>
drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
Marijn Suijten <[email protected]>
drm/msm/dsi: Use existing per-interface slice count in DSC timing
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: don't use active in atomic_check()
Daniel Stodden <[email protected]>
PCI/ASPM: Fix link state exit during switch upstream function removal
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
Kai-Heng Feng <[email protected]>
PCI: Use downstream bridges for distributing resources
José Expósito <[email protected]>
drm/vkms: Fix use after free and double free on init error
Tomi Valkeinen <[email protected]>
drm: xlnx: zynqmp: Fix max dma segment size
Hermes Wu <[email protected]>
drm/bridge: it6505: fix HDCP V match check is not performed correctly
Wayne Lin <[email protected]>
drm/dp_mst: Fix drm RAD print
Geert Uytterhoeven <[email protected]>
drm/bridge: ti-sn65dsi86: Fix multiple instances
Jayesh Choudhary <[email protected]>
ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Always honor no_shutup_pins
Maud Spierings <[email protected]>
dt-bindings: vendor-prefixes: add GOcontroll
Jiri Kosina <[email protected]>
HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
Vitaliy Shevtsov <[email protected]>
ASoC: cs35l41: check the return value from spi_setup()
Armin Wolf <[email protected]>
platform/x86: dell-ddv: Fix temperature calculation
Joe Hattori <[email protected]>
media: platform: allgro-dvt: unregister v4l2_device on the error path
Benjamin Gaignard <[email protected]>
media: verisilicon: HEVC: Initialize start_bit field
Chao Gao <[email protected]>
x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
Josh Poimboeuf <[email protected]>
x86/traps: Make exc_double_fault() consistently noreturn
Tao Chen <[email protected]>
perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
Sebastian Andrzej Siewior <[email protected]>
lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
Rafael J. Wysocki <[email protected]>
PM: sleep: Fix handling devices with direct_complete set on errors
Chenyuan Yang <[email protected]>
thermal: int340x: Add NULL check for adev
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the error path order of ie31200_init()
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the DIMM size mask for several SoCs
Qiuxu Zhuo <[email protected]>
EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
Tim Schumacher <[email protected]>
selinux: Chain up tool resolving errors in install_policy.sh
Atish Patra <[email protected]>
RISC-V: KVM: Disable the kernel perf counter during configure
Rafael J. Wysocki <[email protected]>
PM: sleep: Adjust check before setting power.must_resume
Peter Zijlstra <[email protected]>
lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
Kevin Loughlin <[email protected]>
x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
Arnd Bergmann <[email protected]>
x86/platform: Only allow CONFIG_EISA for 32-bit
Benjamin Berg <[email protected]>
x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
Stanislav Spassov <[email protected]>
x86/fpu: Fix guest FPU state buffer allocation size
Qiuxu Zhuo <[email protected]>
EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids
Jie Zhan <[email protected]>
cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
Konstantin Andreev <[email protected]>
smack: dont compile ipv6 code unless ipv6 is configured
zuoqian <[email protected]>
cpufreq: scpi: compare kHz instead of Hz
Mike Rapoport (Microsoft) <[email protected]>
x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
Eric Sandeen <[email protected]>
watch_queue: fix pipe accounting mismatch
-------------
Diffstat:
.../devicetree/bindings/vendor-prefixes.yaml | 2 + Makefile | 4 +- arch/arm64/kernel/compat_alignment.c | 2 + arch/loongarch/Kconfig | 4 +- arch/loongarch/include/asm/cache.h | 2 + arch/loongarch/kernel/kgdb.c | 5 +- arch/loongarch/net/bpf_jit.c | 12 +- arch/loongarch/net/bpf_jit.h | 5 + arch/powerpc/configs/mpc885_ads_defconfig | 2 +- arch/powerpc/platforms/cell/spufs/gang.c | 1 + arch/powerpc/platforms/cell/spufs/inode.c | 63 ++++++- arch/powerpc/platforms/cell/spufs/spufs.h | 2 + arch/riscv/errata/Makefile | 6 +- arch/riscv/include/asm/ftrace.h | 4 +- arch/riscv/kvm/vcpu_pmu.c | 1 + arch/riscv/mm/hugetlbpage.c | 74 +++++--- arch/um/include/shared/os.h | 1 - arch/um/kernel/Makefile | 2 +- arch/um/kernel/maccess.c | 19 -- arch/um/os-Linux/process.c | 51 ------ arch/x86/Kconfig | 2 +- arch/x86/entry/calling.h | 2 + arch/x86/events/intel/core.c | 47 ++--- arch/x86/events/intel/ds.c | 13 +- arch/x86/events/perf_event.h | 3 +- arch/x86/hyperv/hv_vtl.c | 1 + arch/x86/hyperv/ivm.c | 5 +- arch/x86/include/asm/tlbflush.h | 2 +- arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/cpu/sgx/driver.c | 10 +- arch/x86/kernel/dumpstack.c | 5 +- arch/x86/kernel/fpu/core.c | 6 +- arch/x86/kernel/process.c | 7 +- arch/x86/kernel/traps.c | 18 +- arch/x86/kernel/tsc.c | 4 +- arch/x86/lib/copy_user_64.S | 18 ++ arch/x86/mm/mem_encrypt_identity.c | 4 +- arch/x86/mm/pat/cpa-test.c | 2 +- arch/x86/mm/pat/memtype.c | 52 +++--- drivers/acpi/nfit/core.c | 2 +- drivers/acpi/processor_idle.c | 4 + drivers/acpi/resource.c | 7 + drivers/acpi/x86/utils.c | 3 +- drivers/base/power/main.c | 21 +-- drivers/base/power/runtime.c | 2 +- drivers/clk/imx/clk-imx8mp-audiomix.c | 6 +- drivers/clk/meson/g12a.c | 38 ++-- drivers/clk/meson/gxbb.c | 14 +- drivers/clk/qcom/gcc-msm8953.c | 2 +- drivers/clk/qcom/mmcc-sdm660.c | 2 +- drivers/clk/rockchip/clk-rk3328.c | 2 +- drivers/clk/samsung/clk.c | 2 +- drivers/cpufreq/cpufreq_governor.c | 45 ++--- drivers/cpufreq/scpi-cpufreq.c | 5 +- drivers/crypto/hisilicon/sec2/sec.h | 1 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 125 +++++-------- drivers/crypto/nx/nx-common-pseries.c | 37 ++-- drivers/dma/fsl-edma-main.c | 2 +- drivers/edac/i10nm_base.c | 2 + drivers/edac/ie31200_edac.c | 19 +- drivers/edac/skx_common.c | 33 ++++ drivers/edac/skx_common.h | 11 ++ drivers/firmware/cirrus/cs_dsp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 11 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 15 -- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 ++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 + .../gpu/drm/amd/display/dc/core/dc_link_exports.c | 3 + .../gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 4 + .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 12 +- drivers/gpu/drm/bridge/ite-it6505.c | 7 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 + drivers/gpu/drm/display/drm_dp_mst_topology.c | 8 +- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 33 +++- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 4 - drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 8 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 32 ++-- drivers/gpu/drm/msm/msm_dsc_helper.h | 11 -- drivers/gpu/drm/vkms/vkms_drv.c | 15 +- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 + drivers/hid/Makefile | 1 - drivers/hid/i2c-hid/i2c-hid-core.c | 2 +- drivers/hwmon/nct6775-core.c | 4 +- drivers/hwtracing/coresight/coresight-catu.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 20 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 48 ++++- drivers/i3c/master/svc-i3c-master.c | 2 +- drivers/iio/accel/mma8452.c | 10 +- drivers/iio/accel/msa311.c | 28 +-- drivers/iio/adc/ad4130.c | 41 ++++- drivers/iio/adc/ad7124.c | 35 +++- drivers/infiniband/core/device.c | 9 + drivers/infiniband/core/mad.c | 38 ++-- drivers/infiniband/core/sysfs.c | 1 + drivers/infiniband/hw/erdma/erdma_cm.c | 1 - drivers/infiniband/hw/mana/main.c | 2 +- drivers/infiniband/hw/mlx5/cq.c | 2 +- drivers/infiniband/hw/mlx5/odp.c | 10 +- drivers/leds/led-core.c | 22 ++- drivers/media/dvb-frontends/dib8000.c | 5 +- drivers/media/platform/allegro-dvt/allegro-core.c | 1 + .../platform/verisilicon/hantro_g2_hevc_dec.c | 1 + drivers/media/rc/streamzap.c | 2 +- drivers/memory/omap-gpmc.c | 20 -- drivers/mfd/sm501.c | 6 +- drivers/mmc/host/omap.c | 19 +- drivers/mmc/host/sdhci-omap.c | 4 +- drivers/mmc/host/sdhci-pxav3.c | 1 + drivers/net/arcnet/com20020-pci.c | 17 +- drivers/net/dsa/mv88e6xxx/chip.c | 11 +- drivers/net/dsa/mv88e6xxx/phy.c | 3 + drivers/net/ethernet/ibm/ibmveth.c | 39 ++-- drivers/net/ethernet/intel/e1000e/defines.h | 3 + drivers/net/ethernet/intel/e1000e/ich8lan.c | 80 +++++++- drivers/net/ethernet/intel/e1000e/ich8lan.h | 4 + drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 3 + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 3 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 201 ++++++++++++++------- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en/params.c | 8 +- drivers/net/usb/rndis_host.c | 16 +- drivers/net/usb/usbnet.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 20 +- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 86 ++++++--- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 8 +- drivers/ntb/hw/intel/ntb_hw_gen3.c | 3 + drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +- drivers/ntb/test/ntb_perf.c | 4 +- drivers/nvme/host/pci.c | 34 +++- drivers/nvme/host/tcp.c | 5 +- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/cadence/pcie-cadence.h | 2 +- drivers/pci/controller/dwc/pcie-histb.c | 12 +- drivers/pci/controller/pcie-brcmstb.c | 9 +- drivers/pci/controller/pcie-xilinx-cpm.c | 10 +- drivers/pci/hotplug/pciehp_hpc.c | 4 +- drivers/pci/pci.c | 4 + drivers/pci/pcie/aspm.c | 17 +- drivers/pci/pcie/portdrv.c | 8 +- drivers/pci/probe.c | 5 +- drivers/pci/setup-bus.c | 3 +- drivers/pinctrl/intel/pinctrl-intel.c | 1 - drivers/pinctrl/renesas/pinctrl-rza2.c | 2 + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 + drivers/pinctrl/renesas/pinctrl-rzv2m.c | 2 + drivers/pinctrl/tegra/pinctrl-tegra.c | 3 + drivers/platform/x86/dell/dell-wmi-ddv.c | 6 +- drivers/platform/x86/intel/hid.c | 7 + .../x86/intel/speed_select_if/isst_if_common.c | 2 +- drivers/platform/x86/intel/vsec.c | 7 + drivers/power/supply/max77693_charger.c | 2 +- drivers/remoteproc/qcom_q6v5_mss.c | 21 ++- drivers/remoteproc/qcom_q6v5_pas.c | 12 +- drivers/remoteproc/remoteproc_core.c | 1 + drivers/scsi/qla2xxx/qla_os.c | 2 +- drivers/soundwire/slave.c | 1 + drivers/staging/rtl8723bs/Kconfig | 1 + .../intel/int340x_thermal/int3402_thermal.c | 3 + drivers/tty/n_tty.c | 13 +- drivers/usb/host/xhci-mem.c | 6 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +- drivers/vhost/scsi.c | 25 +-- drivers/video/console/Kconfig | 2 +- drivers/video/fbdev/au1100fb.c | 4 +- drivers/video/fbdev/sm501fb.c | 7 + fs/affs/file.c | 9 +- fs/btrfs/extent-tree.c | 5 +- fs/exec.c | 15 +- fs/exfat/fatent.c | 2 +- fs/ext4/dir.c | 3 + fs/ext4/super.c | 27 ++- fs/fuse/dax.c | 1 - fs/fuse/dir.c | 2 +- fs/fuse/file.c | 4 +- fs/hostfs/hostfs.h | 2 +- fs/hostfs/hostfs_kern.c | 7 +- fs/hostfs/hostfs_user.c | 59 +++--- fs/isofs/dir.c | 3 +- fs/jfs/jfs_dtree.c | 3 +- fs/jfs/xattr.c | 13 +- fs/nfs/delegation.c | 33 ++-- fs/nfs/sysfs.c | 22 ++- fs/nfsd/nfs4state.c | 31 +++- fs/ntfs3/index.c | 4 +- fs/ntfs3/ntfs.h | 2 +- fs/ocfs2/alloc.c | 8 + fs/proc/base.c | 2 +- fs/smb/client/cifsacl.c | 8 +- fs/smb/client/connect.c | 16 +- fs/smb/server/auth.c | 6 +- fs/smb/server/mgmt/user_session.c | 33 +++- fs/smb/server/mgmt/user_session.h | 2 + fs/smb/server/oplock.c | 12 +- fs/smb/server/smb2pdu.c | 40 ++-- fs/smb/server/smbacl.c | 5 + include/drm/display/drm_dp_mst_helper.h | 7 + include/linux/context_tracking_irq.h | 8 +- include/linux/coresight.h | 4 + include/linux/fwnode.h | 2 +- include/linux/interrupt.h | 8 +- include/linux/pgtable.h | 28 ++- include/linux/pm_runtime.h | 2 + include/linux/rcupdate.h | 2 +- include/linux/sched/smt.h | 2 +- include/linux/trace.h | 4 +- include/linux/trace_events.h | 14 ++ include/rdma/ib_verbs.h | 1 + kernel/events/core.c | 46 +++-- kernel/events/ring_buffer.c | 2 +- kernel/events/uprobes.c | 13 +- kernel/fork.c | 4 + kernel/kexec_elf.c | 2 +- kernel/locking/semaphore.c | 13 +- kernel/sched/deadline.c | 2 +- kernel/trace/bpf_trace.c | 2 +- kernel/trace/ring_buffer.c | 4 +- kernel/trace/trace.c | 23 ++- kernel/trace/trace.h | 1 + kernel/trace/trace_boot.c | 2 +- kernel/trace/trace_events.c | 62 ++++++- kernel/trace/trace_events_hist.c | 133 +++++++++++--- kernel/trace/trace_events_synth.c | 32 +++- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 - kernel/trace/trace_osnoise.c | 1 - kernel/trace/trace_sched_wakeup.c | 2 - kernel/watch_queue.c | 9 + lib/842/842_compress.c | 2 + lib/overflow_kunit.c | 3 +- lib/vsprintf.c | 2 +- mm/memory.c | 13 +- net/can/af_can.c | 12 +- net/can/af_can.h | 12 +- net/can/proc.c | 46 +++-- net/core/dst.c | 8 + net/core/rtnetlink.c | 3 + net/ipv4/ip_tunnel_core.c | 4 +- net/ipv4/udp.c | 16 +- net/ipv6/addrconf.c | 37 ++-- net/ipv6/calipso.c | 21 ++- net/ipv6/route.c | 42 ++++- net/mac80211/sta_info.c | 20 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nft_set_hash.c | 3 +- net/netfilter/nft_tunnel.c | 6 +- net/openvswitch/actions.c | 6 - net/sched/act_tunnel_key.c | 2 +- net/sched/cls_flower.c | 2 +- net/sched/sch_skbprio.c | 3 - net/vmw_vsock/af_vsock.c | 6 +- rust/kernel/print.rs | 7 +- samples/ftrace/sample-trace-array.c | 2 +- scripts/selinux/install_policy.sh | 15 +- security/smack/smack.h | 6 + security/smack/smack_lsm.c | 10 +- sound/pci/hda/patch_realtek.c | 33 +++- sound/soc/codecs/cs35l41-spi.c | 4 +- sound/soc/codecs/rt5665.c | 24 +-- sound/soc/fsl/imx-card.c | 4 + sound/soc/ti/j721e-evm.c | 2 + tools/lib/bpf/linker.c | 2 +- tools/objtool/check.c | 35 +--- tools/perf/bench/syscall.c | 22 ++- .../shell/coresight/asm_pure_loop/asm_pure_loop.S | 2 + tools/perf/util/arm-spe.c | 8 +- tools/perf/util/evlist.c | 13 +- tools/perf/util/pmu.c | 7 +- tools/perf/util/pmu.h | 5 + tools/perf/util/pmus.c | 20 +- tools/perf/util/python.c | 17 +- tools/perf/util/stat-shadow.c | 3 +- tools/perf/util/units.c | 2 +- .../selftests/bpf/prog_tests/bloom_filter_map.c | 5 + tools/testing/selftests/bpf/progs/strncmp_bench.c | 5 +- tools/testing/selftests/mm/cow.c | 2 +- 280 files changed, 2331 insertions(+), 1182 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/268 watch_queue: fix pipe accounting mismatch
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
[ Upstream commit f13abc1e8e1a3b7455511c4e122750127f6bc9b0 ]
Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.
To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers()
(It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?)
--- kernel/watch_queue.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/watch_queue.c +9 -0
@@ -269,6 +269,15 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)if (ret <0 ) goto error; +/* +* pipe_resize_ring() does not update nr_accounted for watch_queue +* pipes, because the above vastly overprovisions. Set nr_accounted on +* and max_usage this pipe to the number that was actually charged to +* the user above via account_pipe_buffers. +*/ + pipe->max_usage = nr_pages; + pipe->nr_accounted = nr_pages; + ret = -ENOMEM ; pages =kcalloc (sizeof (struct page *), nr_pages,GFP_KERNEL );if (!pages)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/268 x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <[email protected]>
[ Upstream commit 33ea120582a638b2f2e380a50686c2b1d7cce795 ]
The CPA_ARRAY test always uses len[1] as numpages argument to change_page_attr_set() although the addresses array is different each iteration of the test loop.
Replace len[1] with len[i] to have numpages matching the addresses array.
--- arch/x86/mm/pat/cpa-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/mm/pat/cpa-test.c +1 -1
@@ -183,7 +183,7 @@ static int pageattr_test(void)break ;case 1 : - err =change_page_attr_set (addrs, len[1 ],PAGE_CPA_TEST ,1 ); + err =change_page_attr_set (addrs, len[i],PAGE_CPA_TEST ,1 );break ;case 2 :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/268 cpufreq: scpi: compare kHz instead of Hz
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: zuoqian <[email protected]>
[ Upstream commit 4742da9774a416908ef8e3916164192c15c0e2d1 ]
The CPU rate from clk_get_rate() may not be divisible by 1000 (e.g., 133333333). But the rate calculated from frequency(kHz) is always divisible by 1000 (e.g., 133333000).
Comparing the rate causes a warning during CPU scaling:
"cpufreq: __target_index: Failed to change cpu frequency: -5". When we choose to compare kHz here, the issue does not occur.
--- drivers/cpufreq/scpi-cpufreq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/cpufreq/scpi-cpufreq.c +3 -2
@@ -39,8 +39,9 @@ static unsigned int scpi_cpufreq_get_rate(unsigned int cpu)static int scpi_cpufreq_set_target (struct cpufreq_policy *policy,unsigned int index) { -u64 rate = policy->freq_table[index].frequency *1000 ; +unsigned long freq_khz = policy->freq_table[index].frequency;struct scpi_data *priv = policy->driver_data; +unsigned long rate = freq_khz *1000 ;int ret; ret =clk_set_rate (priv->clk, rate);
@@ -48,7 +49,7 @@ scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)if (ret)return ret; -if (clk_get_rate (priv->clk) != rate) +if (clk_get_rate (priv->clk) /1000 != freq_khz)return -EIO ;return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/268 smack: dont compile ipv6 code unless ipv6 is configured
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit bfcf4004bcbce2cb674b4e8dbd31ce0891766bac ]
I want to be sure that ipv6-specific code
is not compiled in kernel binaries
if ipv6 is not configured.
[1] was getting rid of "unused variable" warning, but, with that, it also mandated compilation of a handful ipv6- specific functions in ipv4-only kernel configurations:
smk_ipv6_localhost, smack_ipv6host_label, smk_ipv6_check.
Their compiled bodies are likely to be removed by compiler from the resulting binary, but, to be on the safe side, I remove them from the compiler view.
--- security/smack/smack.h | 6 ++++++ security/smack/smack_lsm.c | 10 +++++++++- 2 files changed, 15 insertions(+), 1 deletion(-)
security/smack/smack.h +6 -0
@@ -152,6 +152,7 @@ struct smk_net4addr {struct smack_known *smk_label;/* label */ }; +#if IS_ENABLED (CONFIG_IPV6 )/* * An entry in the table identifying IPv6 hosts. */
@@ -162,7 +163,9 @@ struct smk_net6addr {int smk_masks;/* mask size */ struct smack_known *smk_label; /* label */ }; +#endif /* CONFIG_IPV6 */ +#ifdef SMACK_IPV6_PORT_LABELING /* * An entry in the table identifying ports. */
@@ -175,6 +178,7 @@ struct smk_port_label {short smk_sock_type;/* Socket type */ short smk_can_reuse; }; +#endif /* SMACK_IPV6_PORT_LABELING */ struct smack_known_list_elem {struct list_head list;
@@ -314,7 +318,9 @@ extern struct smack_known smack_known_web;extern struct mutex smack_known_lock;extern struct list_head smack_known_list;extern struct list_head smk_net4addr_list; +#if IS_ENABLED (CONFIG_IPV6 )extern struct list_head smk_net6addr_list; +#endif /* CONFIG_IPV6 */ extern struct mutex smack_onlycap_lock;extern struct list_head smack_onlycap_list;
security/smack/smack_lsm.c +9 -1
@@ -2476,6 +2476,7 @@ static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip)return NULL ; } +#if IS_ENABLED (CONFIG_IPV6 )/* * smk_ipv6_localhost - Check for local ipv6 host address * @sip: the address
@@ -2543,6 +2544,7 @@ static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) return NULL; } +#endif /* CONFIG_IPV6 */ /** * smack_netlbl_add - Set the secattr on a socket
@@ -2646,6 +2648,7 @@ static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap)return rc; } +#if IS_ENABLED (CONFIG_IPV6 )/** * smk_ipv6_check - check Smack access * @subject: subject Smack label
@@ -2678,6 +2681,7 @@ static int smk_ipv6_check(struct smack_known *subject, rc =smk_bu_note ("IPv6 check" , subject, object,MAY_WRITE , rc); return rc; } +#endif /* CONFIG_IPV6 */ #ifdef SMACK_IPV6_PORT_LABELING /**
@@ -3010,7 +3014,9 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,return 0 ; if (addrlen < offsetofend(struct sockaddr, sa_family))return 0 ; -if (IS_ENABLED (CONFIG_IPV6 ) && sap->sa_family ==AF_INET6 ) { + +#if IS_ENABLED (CONFIG_IPV6 ) +if (sap->sa_family ==AF_INET6 ) {struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;struct smack_known *rsp =NULL ;
@@ -3030,6 +3036,8 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, return rc; } +#endif /* CONFIG_IPV6 */ +if (sap->sa_family !=AF_INET || addrlen <sizeof (struct sockaddr_in ))return 0 ; rc =smk_ipv4_check (sock->sk, (struct sockaddr_in *)sap);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/268 cpufreq: governor: Fix negative idle_time handling in dbs_update()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Zhan <[email protected]>
[ Upstream commit 3698dd6b139dc37b35a9ad83d9330c1f99666c02 ]
We observed an issue that the CPU frequency can't raise up with a 100% CPU load when NOHZ is off and the 'conservative' governor is selected.
'idle_time' can be negative if it's obtained from get_cpu_idle_time_jiffy() when NOHZ is off. This was found and explained in commit 9485e4ca0b48 ("cpufreq: governor: Fix handling of special cases in dbs_update()").
However, commit 7592019634f8 ("cpufreq: governors: Fix long idle detection logic in load calculation") introduced a comparison between 'idle_time' and 'samling_rate' to detect a long idle interval. While 'idle_time' is converted to int before comparison, it's actually promoted to unsigned again when compared with an unsigned 'sampling_rate'. Hence, this leads to wrong idle interval detection when it's in fact 100% busy and sets policy_dbs->idle_periods to a very large value. 'conservative' adjusts the frequency to minimum because of the large 'idle_periods', such that the frequency can't raise up. 'Ondemand' doesn't use policy_dbs->idle_periods so it fortunately avoids the issue.
Correct negative 'idle_time' to 0 before any use of it in dbs_update().
--- drivers/cpufreq/cpufreq_governor.c | 45 +++++++++++++++--------------- 1 file changed, 23 insertions(+), 22 deletions(-)
drivers/cpufreq/cpufreq_governor.c +23 -22
@@ -145,7 +145,23 @@ unsigned int dbs_update(struct cpufreq_policy *policy) time_elapsed = update_time - j_cdbs->prev_update_time; j_cdbs->prev_update_time = update_time; - idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +/* +* cur_idle_time could be smaller than j_cdbs->prev_cpu_idle if +* it's obtained from get_cpu_idle_time_jiffy() when NOHZ is +* off, where idle_time is calculated by the difference between +* time elapsed in jiffies and "busy time" obtained from CPU +* statistics. If a CPU is 100% busy, the time elapsed and busy +* time should grow with the same amount in two consecutive +* samples, but in practice there could be a tiny difference, +* making the accumulated idle time decrease sometimes. Hence, +* in this case, idle_time should be regarded as 0 in order to +* make the further process correct. +*/ +if (cur_idle_time > j_cdbs->prev_cpu_idle) + idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; +else + idle_time =0 ; + j_cdbs->prev_cpu_idle = cur_idle_time;if (ignore_nice) {
@@ -162,7 +178,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)* calls, so the previous load value can be used then. */ load = j_cdbs->prev_load; - }else if (unlikely ((int )idle_time >2 * sampling_rate && + }else if (unlikely (idle_time >2 * sampling_rate && j_cdbs->prev_load)) {/* * If the CPU had gone completely idle and a task has
@@ -189,30 +205,15 @@ unsigned int dbs_update(struct cpufreq_policy *policy) load = j_cdbs->prev_load; j_cdbs->prev_load =0 ; }else { -if (time_elapsed >= idle_time) { +if (time_elapsed > idle_time) load =100 * (time_elapsed - idle_time) / time_elapsed; - }else { -/* -* That can happen if idle_time is returned by -* get_cpu_idle_time_jiffy(). In that case -* idle_time is roughly equal to the difference -* between time_elapsed and "busy time" obtained -* from CPU statistics. Then, the "busy time" -* can end up being greater than time_elapsed -* (for example, if jiffies_64 and the CPU -* statistics are updated by different CPUs), -* so idle_time may in fact be negative. That -* means, though, that the CPU was busy all -* the time (on the rough average) during the -* last sampling interval and 100 can be -* returned as the load. -*/ - load = (int )idle_time <0 ?100 :0 ; - } +else + load =0 ; + j_cdbs->prev_load = load; } -if (unlikely ((int )idle_time >2 * sampling_rate)) { +if (unlikely (idle_time >2 * sampling_rate)) {unsigned int periods = idle_time / sampling_rate;if (periods < idle_periods)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/268 EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit d9207cf7760f5f5599e9ff7eb0fedf56821a1d59 ]
When doing error injection to some memory DIMMs on certain Intel Emerald Rapids servers, the i10nm_edac missed error reports for some memory DIMMs.
Certain BIOS configurations may hide some memory controllers, and the i10nm_edac doesn't enumerate these hidden memory controllers. However, the ADXL decodes memory errors using memory controller physical indices even if there are hidden memory controllers. Therefore, the memory controller physical indices reported by the ADXL may mismatch the logical indices enumerated by the i10nm_edac, resulting in missed error reports for some memory DIMMs.
Fix this issue by creating a mapping table from memory controller physical indices (used by the ADXL) to logical indices (used by the i10nm_edac) and using it to convert the physical indices to the logical indices during the error handling process.
--- drivers/edac/i10nm_base.c | 2 ++ drivers/edac/skx_common.c | 33 +++++++++++++++++++++++++++++++++ drivers/edac/skx_common.h | 11 +++++++++++ 3 files changed, 46 insertions(+)
drivers/edac/i10nm_base.c +2 -0
@@ -755,6 +755,8 @@ static int i10nm_get_ddr_munits(void)continue ; }else { d->imc[lmc].mdev = mdev; +if (res_cfg->type ==SPR ) +skx_set_mc_mapping (d, i, lmc); lmc++; } }
drivers/edac/skx_common.c +33 -0
@@ -120,6 +120,35 @@ void skx_adxl_put(void) }EXPORT_SYMBOL_GPL (skx_adxl_put); +static void skx_init_mc_mapping (struct skx_dev *d) +{ +/* +* By default, the BIOS presents all memory controllers within each +* socket to the EDAC driver. The physical indices are the same as +* the logical indices of the memory controllers enumerated by the +* EDAC driver. +*/ +for (int i =0 ; i <NUM_IMC ; i++) + d->mc_mapping[i] = i; +} + +void skx_set_mc_mapping (struct skx_dev *d,u8 pmc,u8 lmc) +{ +edac_dbg (0 ,"Set the mapping of mc phy idx to logical idx: %02d -> %02d\n" , + pmc, lmc); + + d->mc_mapping[pmc] = lmc; +} +EXPORT_SYMBOL_GPL (skx_set_mc_mapping); + +static u8 skx_get_mc_mapping (struct skx_dev *d,u8 pmc) +{ +edac_dbg (0 ,"Get the mapping of mc phy idx to logical idx: %02d -> %02d\n" , + pmc, d->mc_mapping[pmc]); + +return d->mc_mapping[pmc]; +} +static bool skx_adxl_decode (struct decoded_addr *res,enum error_source err_src) {struct skx_dev *d;
@@ -187,6 +216,8 @@ static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src)return false; } + res->imc =skx_get_mc_mapping (d, res->imc); +for (i =0 ; i < adxl_component_count; i++) {if (adxl_values[i] == ~0x0ull )continue ;
@@ -307,6 +338,8 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list) d->bus[0], d->bus[1], d->bus[2], d->bus[3]);list_add_tail (&d->list, &dev_edac_list); prev = pdev; + +skx_init_mc_mapping (d); }if (list)
drivers/edac/skx_common.h +11 -0
@@ -94,6 +94,16 @@ struct skx_dev {struct pci_dev *uracu;/* for i10nm CPU */ struct pci_dev *pcu_cr3;/* for HBM memory detection */ u32 mcroute; +/* +* Some server BIOS may hide certain memory controllers, and the +* EDAC driver skips those hidden memory controllers. However, the +* ADXL still decodes memory error address using physical memory +* controller indices. The mapping table is used to convert the +* physical indices (reported by ADXL) to the logical indices +* (used the EDAC driver) of present memory controllers during the +* error handling process. +*/ +u8 mc_mapping[NUM_IMC ];struct skx_imc {struct mem_ctl_info *mci;struct pci_dev *mdev;/* for i10nm CPU */
@@ -243,6 +253,7 @@ void skx_adxl_put(void);void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log);void skx_set_mem_cfg (bool mem_cfg_2lm);void skx_set_res_cfg (struct res_config *cfg); +void skx_set_mc_mapping (struct skx_dev *d,u8 pmc,u8 lmc);int skx_get_src_id (struct skx_dev *d,int off,u8 *id);int skx_get_node_id (struct skx_dev *d,u8 *id);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/268 x86/fpu: Fix guest FPU state buffer allocation size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Spassov <[email protected]>
[ Upstream commit 1937e18cc3cf27e2b3ef70e8c161437051ab7608 ]
Ongoing work on an optimization to batch-preallocate vCPU state buffers for KVM revealed a mismatch between the allocation sizes used in fpu_alloc_guest_fpstate() and fpstate_realloc(). While the former allocates a buffer sized to fit the default set of XSAVE features in UABI form (as per fpu_user_cfg), the latter uses its ksize argument derived (for the requested set of features) in the same way as the sizes found in fpu_kernel_cfg, i.e. using the compacted in-kernel representation.
The correct size to use for guest FPU state should indeed be the kernel one as seen in fpstate_realloc(). The original issue likely went unnoticed through a combination of UABI size typically being larger than or equal to kernel size, and/or both amounting to the same number of allocated 4K pages.
--- arch/x86/kernel/fpu/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/fpu/core.c +1 -1
@@ -220,7 +220,7 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu)struct fpstate *fpstate;unsigned int size; - size = fpu_user_cfg.default_size +ALIGN (offsetof(struct fpstate , regs),64 ); + size = fpu_kernel_cfg.default_size +ALIGN (offsetof(struct fpstate , regs),64 ); fpstate =vzalloc (size);if (!fpstate)return false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/268 x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 5d3b81d4d8520efe888536b6906dc10fd1a228a8 ]
The init_task instance of struct task_struct is statically allocated and may not contain the full FP state for userspace. As such, limit the copy to the valid area of both init_task and 'dst' and ensure all memory is initialized.
Note that the FP state is only needed for userspace, and as such it is entirely reasonable for init_task to not contain parts of it.
----
v2:
- Fix code if arch_task_struct_size < sizeof(init_task) by using memcpy_and_pad.
--- arch/x86/kernel/process.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/kernel/process.c +6 -1
@@ -92,7 +92,12 @@ EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);*/ int arch_dup_task_struct (struct task_struct *dst,struct task_struct *src) { -memcpy (dst, src, arch_task_struct_size); +/* init_task is not dynamically sized (incomplete FPU state) */ +if (unlikely (src == &init_task)) +memcpy_and_pad (dst, arch_task_struct_size, src,sizeof (init_task),0 ); +else +memcpy (dst, src, arch_task_struct_size); +#ifdef CONFIG_VM86 dst->thread.vm86 =NULL ;#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/268 x86/platform: Only allow CONFIG_EISA for 32-bit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 976ba8da2f3c2f1e997f4f620da83ae65c0e3728 ]
The CONFIG_EISA menu was cleaned up in 2018, but this inadvertently brought the option back on 64-bit machines: ISA remains guarded by a CONFIG_X86_32 check, but EISA no longer depends on ISA.
The last Intel machines ith EISA support used a 82375EB PCI/EISA bridge from 1993 that could be paired with the 440FX chipset on early Pentium-II CPUs, long before the first x86-64 products.
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -215,7 +215,7 @@ config X86 select HAVE_SAMPLE_FTRACE_DIRECT_MULTI if X86_64 select HAVE_EBPF_JIT select HAVE_EFFICIENT_UNALIGNED_ACCESS - select HAVE_EISA + select HAVE_EISA if X86_32 select HAVE_EXIT_THREAD select HAVE_FAST_GUP select HAVE_FENTRY if X86_64 || DYNAMIC_FTRACE
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/268 x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Loughlin <[email protected]>
[ Upstream commit 72dafb567760320f2de7447cd6e979bf9d4e5d17 ]
The following commit:
1c811d403afd ("x86/sev: Fix position dependent variable references in startup code")
introduced RIP_REL_REF() to force RIP-relative accesses to global variables, as needed to prevent crashes during early SEV/SME startup code.
For completeness, RIP_REL_REF() should be used with additional variables during sme_enable():
https://lore.kernel.org/all/CAMj1kXHnA0fJu6zh634=fbJswp59kSRAbhW+ubDGj1+NYwZJ-Q@mail.gmail.com/
Access these vars with RIP_REL_REF() to prevent problem reoccurence.
--- arch/x86/mm/mem_encrypt_identity.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/mm/mem_encrypt_identity.c +2 -2
@@ -562,7 +562,7 @@ void __head sme_enable(struct boot_params *bp) }RIP_REL_REF (sme_me_mask) = me_mask; - physical_mask &= ~me_mask; - cc_vendor =CC_VENDOR_AMD ; +RIP_REL_REF (physical_mask) &= ~me_mask; +RIP_REL_REF (cc_vendor) =CC_VENDOR_AMD ;cc_set_mask (me_mask); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/268 lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit a1b65f3f7c6f7f0a08a7dba8be458c6415236487 ]
Turns out that this commit, about 10 years ago:
9ec23531fd48 ("sched/preempt, mm/fault: Trigger might_sleep() in might_fault() with disabled pagefaults")
... accidentally (and unnessecarily) put the lockdep part of __might_fault() under CONFIG_DEBUG_ATOMIC_SLEEP=y.
This is potentially notable because large distributions such as Ubuntu are running with !CONFIG_DEBUG_ATOMIC_SLEEP.
Restore the debug check.
[ mingo: Update changelog. ]
--- mm/memory.c | 2 -- 1 file changed, 2 deletions(-)
mm/memory.c +0 -2
@@ -5945,10 +5945,8 @@ void __might_fault(const char *file, int line)if (pagefault_disabled ())return ;__might_sleep (file, line); -#if defined(CONFIG_DEBUG_ATOMIC_SLEEP )if (current->mm) might_lock_read(¤t->mm->mmap_lock); -#endif }EXPORT_SYMBOL (__might_fault);#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/268 PM: sleep: Adjust check before setting power.must_resume
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit eeb87d17aceab7803a5a5bcb6cf2817b745157cf ]
The check before setting power.must_resume in device_suspend_noirq() does not take power.child_count into account, but it should do that, so use pm_runtime_need_not_resume() in it for this purpose and adjust the comment next to it accordingly.
--- drivers/base/power/main.c | 13 ++++++------- drivers/base/power/runtime.c | 2 +- include/linux/pm_runtime.h | 2 ++ 3 files changed, 9 insertions(+), 8 deletions(-)
drivers/base/power/main.c +6 -7
@@ -1236,14 +1236,13 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a dev->power.is_noirq_suspended = true;/* -* Skipping the resume of devices that were in use right before the -* system suspend (as indicated by their PM-runtime usage counters) -* would be suboptimal. Also resume them if doing that is not allowed -* to be skipped. +* Devices must be resumed unless they are explicitly allowed to be left +* in suspend, but even in that case skipping the resume of devices that +* were in use right before the system suspend (as indicated by their +* runtime PM usage counters and child counters) would be suboptimal. */ -if (atomic_read (&dev->power.usage_count) >1 || - !(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && - dev->power.may_skip_resume)) +if (!(dev_pm_test_driver_flags (dev,DPM_FLAG_MAY_SKIP_RESUME ) && + dev->power.may_skip_resume) || !pm_runtime_need_not_resume (dev)) dev->power.must_resume = true;if (dev->power.must_resume)
drivers/base/power/runtime.c +1 -1
@@ -1841,7 +1841,7 @@ void pm_runtime_drop_link(struct device_link *link)pm_request_idle (link->supplier); } -static bool pm_runtime_need_not_resume (struct device *dev) +bool pm_runtime_need_not_resume (struct device *dev) { return atomic_read(&dev->power.usage_count) <= 1 && (atomic_read(&dev->power.child_count) == 0 ||
include/linux/pm_runtime.h +2 -0
@@ -66,6 +66,7 @@ static inline bool queue_pm_work(struct work_struct *work)extern int pm_generic_runtime_suspend (struct device *dev);extern int pm_generic_runtime_resume (struct device *dev); +extern bool pm_runtime_need_not_resume (struct device *dev);extern int pm_runtime_force_suspend (struct device *dev);extern int pm_runtime_force_resume (struct device *dev);
@@ -252,6 +253,7 @@ static inline bool queue_pm_work(struct work_struct *work) { return false; }static inline int pm_generic_runtime_suspend (struct device *dev) {return 0 ; }static inline int pm_generic_runtime_resume (struct device *dev) {return 0 ; } +static inline bool pm_runtime_need_not_resume (struct device *dev) {return true; }static inline int pm_runtime_force_suspend (struct device *dev) {return 0 ; }static inline int pm_runtime_force_resume (struct device *dev) {return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/268 RISC-V: KVM: Disable the kernel perf counter during configure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit bbb622488749478955485765ddff9d56be4a7e4b ]
The perf event should be marked disabled during the creation as it is not ready to be scheduled until there is SBI PMU start call or config matching is called with auto start. Otherwise, event add/start gets called during perf_event_create_kernel_counter function. It will be enabled and scheduled to run via perf_event_enable during either the above mentioned scenario.
--- arch/riscv/kvm/vcpu_pmu.c | 1 + 1 file changed, 1 insertion(+)
arch/riscv/kvm/vcpu_pmu.c +1 -0
@@ -468,6 +468,7 @@ int kvm_riscv_vcpu_pmu_ctr_cfg_match(struct kvm_vcpu *vcpu, unsigned long ctr_ba .type = etype, .size = sizeof(struct perf_event_attr), .pinned = true, + .disabled = true,/* * It should never reach here if the platform doesn't support the sscofpmf * extension as mode filtering won't work without it.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/268 selinux: Chain up tool resolving errors in install_policy.sh
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Schumacher <[email protected]>
[ Upstream commit 6ae0042f4d3f331e841495eb0a3d51598e593ec2 ]
Subshell evaluations are not exempt from errexit, so if a command is not available, which will fail and exit the script as a whole. This causes the helpful error messages to not be printed if they are tacked on using a $? comparison.
Resolve the issue by using chains of logical operators, which are not subject to the effects of errexit.
--- scripts/selinux/install_policy.sh | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
scripts/selinux/install_policy.sh +6 -9
@@ -6,27 +6,24 @@ if [ `id -u` -ne 0 ]; then exit 1 fi -SF=`which setfiles` -if [ $? -eq 1 ]; then +SF=`which setfiles` || { echo "Could not find setfiles" echo "Do you have policycoreutils installed?" exit 1 -fi +} -CP=`which checkpolicy` -if [ $? -eq 1 ]; then +CP=`which checkpolicy` || { echo "Could not find checkpolicy" echo "Do you have checkpolicy installed?" exit 1 -fi +} VERS=`$CP -V | awk '{print $1}'` -ENABLED=`which selinuxenabled` -if [ $? -eq 1 ]; then +ENABLED=`which selinuxenabled` || { echo "Could not find selinuxenabled" echo "Do you have libselinux-utils installed?" exit 1 -fi +} if selinuxenabled; then echo "SELinux is already enabled"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/268 EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit d59d844e319d97682c8de29b88d2d60922a683b3 ]
The EDAC_MC_LAYER_CHIP_SELECT layer pertains to the rank, not the DIMM. Fix its size to reflect the number of ranks instead of the number of DIMMs. Also delete the unused macros IE31200_{DIMMS,RANKS}.
--- drivers/edac/ie31200_edac.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/edac/ie31200_edac.c +1 -3
@@ -91,8 +91,6 @@ (((did) & PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK) == \ PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK)) -#define IE31200_DIMMS 4 -#define IE31200_RANKS 8#define IE31200_RANKS_PER_CHANNEL 4#define IE31200_DIMMS_PER_CHANNEL 2#define IE31200_CHANNELS 2
@@ -426,7 +424,7 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx) nr_channels =how_many_channels (pdev); layers[0 ].type =EDAC_MC_LAYER_CHIP_SELECT ; - layers[0 ].size =IE31200_DIMMS ; + layers[0 ].size =IE31200_RANKS_PER_CHANNEL ; layers[0 ].is_virt_csrow = true; layers[1 ].type =EDAC_MC_LAYER_CHANNEL ; layers[1 ].size = nr_channels;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/268 EDAC/ie31200: Fix the DIMM size mask for several SoCs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 3427befbbca6b19fe0e37f91d66ce5221de70bf1 ]
The DIMM size mask for {Sky, Kaby, Coffee} Lake is not bits{7:0}, but bits{5:0}. Fix it.
--- drivers/edac/ie31200_edac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/edac/ie31200_edac.c +2 -1
@@ -162,6 +162,7 @@#define IE31200_MAD_DIMM_0_OFFSET 0x5004#define IE31200_MAD_DIMM_0_OFFSET_SKL 0x500C#define IE31200_MAD_DIMM_SIZE GENMASK_ULL(7, 0) +#define IE31200_MAD_DIMM_SIZE_SKL GENMASK_ULL(5, 0)#define IE31200_MAD_DIMM_A_RANK BIT(17)#define IE31200_MAD_DIMM_A_RANK_SHIFT 17#define IE31200_MAD_DIMM_A_RANK_SKL BIT(10)
@@ -375,7 +376,7 @@ static void __iomem *ie31200_map_mchbar(struct pci_dev *pdev)static void __skl_populate_dimm_info (struct dimm_data *dd,u32 addr_decode,int chan) { - dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE ; + dd->size = (addr_decode >> (chan <<4 )) &IE31200_MAD_DIMM_SIZE_SKL ; dd->dual_rank = (addr_decode & (IE31200_MAD_DIMM_A_RANK_SKL << (chan <<4 ))) ?1 :0 ; dd->x16_width = ((addr_decode & (IE31200_MAD_DIMM_A_WIDTH_SKL << (chan <<4 ))) >> (IE31200_MAD_DIMM_A_WIDTH_SKL_SHIFT + (chan <<4 )));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/268 EDAC/ie31200: Fix the error path order of ie31200_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 231e341036d9988447e3b3345cf741a98139199e ]
The error path order of ie31200_init() is incorrect, fix it.
--- drivers/edac/ie31200_edac.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/edac/ie31200_edac.c +7 -5
@@ -617,7 +617,7 @@ static int __init ie31200_init(void) pci_rc =pci_register_driver (&ie31200_driver);if (pci_rc <0 ) - goto fail0; +return pci_rc;if (!mci_pdev) { ie31200_registered =0 ;
@@ -628,11 +628,13 @@ static int __init ie31200_init(void)if (mci_pdev)break ; } +if (!mci_pdev) {edac_dbg (0 ,"ie31200 pci_get_device fail\n" ); pci_rc = -ENODEV ; - goto fail1; + goto fail0; } + pci_rc =ie31200_init_one (mci_pdev, &ie31200_pci_tbl[i]);if (pci_rc <0 ) {edac_dbg (0 ,"ie31200 init fail\n" );
@@ -640,12 +642,12 @@ static int __init ie31200_init(void) goto fail1; } } -return 0 ; +return 0 ; fail1: -pci_unregister_driver (&ie31200_driver); -fail0:pci_dev_put (mci_pdev); +fail0: +pci_unregister_driver (&ie31200_driver);return pci_rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/268 thermal: int340x: Add NULL check for adev
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit 2542a3f70e563a9e70e7ded314286535a3321bdb ]
Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480
("platform/x86: int3472: Check for adev == NULL").
Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe().
Note, under the same directory, int3400_thermal_probe() has such a check.
--- drivers/thermal/intel/int340x_thermal/int3402_thermal.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/intel/int340x_thermal/int3402_thermal.c +3 -0
@@ -45,6 +45,9 @@ static int int3402_thermal_probe(struct platform_device *pdev)struct int3402_thermal_data *d;int ret; +if (!adev) +return -ENODEV ; +if (!acpi_has_method (adev->handle,"_TMP" ))return -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/268 PM: sleep: Fix handling devices with direct_complete set on errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 03f1444016b71feffa1dfb8a51f15ba592f94b13 ]
When dpm_suspend() fails, some devices with power.direct_complete set may not have been handled by device_suspend() yet, so runtime PM has not been disabled for them yet even though power.direct_complete is set.
Since device_resume() expects that runtime PM has been disabled for all devices with power.direct_complete set, it will attempt to reenable runtime PM for the devices that have not been processed by device_suspend() which does not make sense. Had those devices had runtime PM disabled before device_suspend() had run, device_resume() would have inadvertently enable runtime PM for them, but this is not expected to happen because it would require ->prepare() callbacks to return positive values for devices with runtime PM disabled, which would be invalid.
In practice, this issue is most likely benign because pm_runtime_enable() will not allow the "disable depth" counter to underflow, but it causes a warning message to be printed for each affected device.
To allow device_resume() to distinguish the "direct complete" devices that have been processed by device_suspend() from those which have not been handled by it, make device_suspend() set power.is_suspended for "direct complete" devices.
Next, move the power.is_suspended check in device_resume() before the power.direct_complete check in it to make it skip the "direct complete" devices that have not been handled by device_suspend().
This change is based on a preliminary patch from Saravana Kannan.
--- drivers/base/power/main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/base/power/main.c +4 -4
@@ -894,6 +894,9 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)if (dev->power.syscore) goto Complete; +if (!dev->power.is_suspended) + goto Complete; +if (dev->power.direct_complete) {/* Match the pm_runtime_disable() in __device_suspend(). */ pm_runtime_enable (dev);
@@ -912,9 +915,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)*/ dev->power.is_prepared = false; -if (!dev->power.is_suspended) - goto Unlock; -if (dev->pm_domain) { info ="power domain " ; callback =pm_op (&dev->pm_domain->ops, state);
@@ -954,7 +954,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async) error =dpm_run_callback (callback, dev, state, info); dev->power.is_suspended = false; - Unlock:device_unlock (dev);dpm_watchdog_clear (&wd);
@@ -1638,6 +1637,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)pm_runtime_disable (dev);if (pm_runtime_status_suspended (dev)) {pm_dev_dbg (dev, state,"direct-complete " ); + dev->power.is_suspended = true; goto Complete; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/268 lockdep: Dont disable interrupts on RT in disable_irq_nosync_lockdep.*()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 87886b32d669abc11c7be95ef44099215e4f5788 ]
disable_irq_nosync_lockdep() disables interrupts with lockdep enabled to avoid false positive reports by lockdep that a certain lock has not been acquired with disabled interrupts. The user of this macros expects that a lock can be acquried without disabling interrupts because the IRQ line triggering the interrupt is disabled.
This triggers a warning on PREEMPT_RT because after disable_irq_nosync_lockdep.*() the following spinlock_t now is acquired with disabled interrupts.
On PREEMPT_RT there is no difference between spin_lock() and spin_lock_irq() so avoiding disabling interrupts in this case works for the two remaining callers as of today.
Don't disable interrupts on PREEMPT_RT in disable_irq_nosync_lockdep.*().
--- include/linux/interrupt.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/linux/interrupt.h +4 -4
@@ -441,7 +441,7 @@ irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec,static inline void disable_irq_nosync_lockdep (unsigned int irq) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_disable ();#endif }
@@ -449,7 +449,7 @@ static inline void disable_irq_nosync_lockdep(unsigned int irq)static inline void disable_irq_nosync_lockdep_irqsave (unsigned int irq,unsigned long *flags) {disable_irq_nosync (irq); -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_save (*flags);#endif }
@@ -464,7 +464,7 @@ static inline void disable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep (unsigned int irq) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_enable ();#endif enable_irq (irq);
@@ -472,7 +472,7 @@ static inline void enable_irq_lockdep(unsigned int irq)static inline void enable_irq_lockdep_irqrestore (unsigned int irq,unsigned long *flags) { -#ifdef CONFIG_LOCKDEP +#if defined(CONFIG_LOCKDEP ) && !defined(CONFIG_PREEMPT_RT )local_irq_restore (*flags);#endif enable_irq (irq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/268 perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit c96fff391c095c11dc87dab35be72dee7d217cde ]
The poll man page says POLLRDNORM is equivalent to POLLIN. For poll(), it seems that if user sets pollfd with POLLRDNORM in userspace, perf_poll will not return until timeout even if perf_output_wakeup called, whereas POLLIN returns.
--- kernel/events/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/ring_buffer.c +1 -1
@@ -19,7 +19,7 @@static void perf_output_wakeup (struct perf_output_handle *handle) { -atomic_set (&handle->rb->poll,EPOLLIN ); +atomic_set (&handle->rb->poll,EPOLLIN |EPOLLRDNORM ); handle->event->pending_wakeup =1 ;irq_work_queue (&handle->event->pending_irq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/268 x86/traps: Make exc_double_fault() consistently noreturn
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 8085fcd78c1a3dbdf2278732579009d41ce0bc4e ]
The CONFIG_X86_ESPFIX64 version of exc_double_fault() can return to its caller, but the !CONFIG_X86_ESPFIX64 version never does. In the latter case the compiler and/or objtool may consider it to be implicitly noreturn.
However, due to the currently inflexible way objtool detects noreturns, a function's noreturn status needs to be consistent across configs.
The current workaround for this issue is to suppress unreachable warnings for exc_double_fault()'s callers. Unfortunately that can result in ORC coverage gaps and potentially worse issues like inert static calls and silently disabled CPU mitigations.
Instead, prevent exc_double_fault() from ever being implicitly marked noreturn by forcing a return behind a never-taken conditional.
Until a more integrated noreturn detection method exists, this is likely the least objectionable workaround.
--- arch/x86/kernel/traps.c | 18 +++++++++++++++++- tools/objtool/check.c | 31 +------------------------------ 2 files changed, 18 insertions(+), 31 deletions(-)
arch/x86/kernel/traps.c +17 -1
@@ -377,6 +377,21 @@ __visible void __noreturn handle_stack_overflow(struct pt_regs *regs, }#endif +/* +* Prevent the compiler and/or objtool from marking the !CONFIG_X86_ESPFIX64 +* version of exc_double_fault() as noreturn. Otherwise the noreturn mismatch +* between configs triggers objtool warnings. +* +* This is a temporary hack until we have compiler or plugin support for +* annotating noreturns. +*/ +#ifdef CONFIG_X86_ESPFIX64 +#define always_true () true +#else +bool always_true (void ); +bool __weak always_true (void ) {return true; } +#endif +/* * Runs on an IST stack for x86_64 and on a special task stack for x86_32. *
@@ -512,7 +527,8 @@ DEFINE_IDTENTRY_DF(exc_double_fault)pr_emerg ("PANIC: double fault, error_code: 0x%lx\n" , error_code);die ("double fault" , regs, error_code); -panic ("Machine halted." ); +if (always_true ()) +panic ("Machine halted." );instrumentation_end (); }
tools/objtool/check.c +1 -30
@@ -4511,35 +4511,6 @@ static int validate_sls(struct objtool_file *file)return warnings; } -static bool ignore_noreturn_call (struct instruction *insn) -{ -struct symbol *call_dest =insn_call_dest (insn); - -/* -* FIXME: hack, we need a real noreturn solution -* -* Problem is, exc_double_fault() may or may not return, depending on -* whether CONFIG_X86_ESPFIX64 is set. But objtool has no visibility -* to the kernel config. -* -* Other potential ways to fix it: -* -* - have compiler communicate __noreturn functions somehow -* - remove CONFIG_X86_ESPFIX64 -* - read the .config file -* - add a cmdline option -* - create a generic objtool annotation format (vs a bunch of custom -* formats) and annotate it -*/ -if (!strcmp (call_dest->name,"exc_double_fault" )) { -/* prevent further unreachable warnings for the caller */ - insn->sym->warned =1 ; -return true; - } - -return false; -} -static int validate_reachable_instructions (struct objtool_file *file) {struct instruction *insn, *prev_insn;
@@ -4556,7 +4527,7 @@ static int validate_reachable_instructions(struct objtool_file *file) prev_insn =prev_insn_same_sec (file, insn);if (prev_insn && prev_insn->dead_end) { call_dest =insn_call_dest (prev_insn); -if (call_dest && !ignore_noreturn_call (prev_insn)) { +if (call_dest) {WARN_INSN (insn,"%s() is missing a __noreturn annotation" , call_dest->name); warnings++;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/268 x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Gao <[email protected]>
[ Upstream commit dda366083e5ff307a4a728757db874bbfe7550be ]
Guest FPUs manage vCPU FPU states. They are allocated via fpu_alloc_guest_fpstate() and are resized in fpstate_realloc() when XFD features are enabled.
Since the introduction of guest FPUs, there have been inconsistencies in the kernel buffer size and xfeatures:
1. fpu_alloc_guest_fpstate() uses fpu_user_cfg since its introduction. See:
69f6ed1d14c6 ("x86/fpu: Provide infrastructure for KVM FPU cleanup") 36487e6228c4 ("x86/fpu: Prepare guest FPU for dynamically enabled FPU features")
2. __fpstate_reset() references fpu_kernel_cfg to set storage attributes.
3. fpu->guest_perm uses fpu_kernel_cfg, affecting fpstate_realloc().
A recent commit in the tip:x86/fpu tree partially addressed the inconsistency between (1) and (3) by using fpu_kernel_cfg for size calculation in (1), but left fpu_guest->xfeatures and fpu_guest->perm still referencing fpu_user_cfg:
https://lore.kernel.org/all/[email protected]/
1937e18cc3cf ("x86/fpu: Fix guest FPU state buffer allocation size")
The inconsistencies within fpu_alloc_guest_fpstate() and across the mentioned functions cause confusion.
Fix them by using fpu_kernel_cfg consistently in fpu_alloc_guest_fpstate(), except for fields related to the UABI buffer. Referencing fpu_kernel_cfg won't impact functionalities, as:
1. fpu_guest->perm is overwritten shortly in fpu_init_guest_permissions()
with fpstate->guest_perm, which already uses fpu_kernel_cfg.
2. fpu_guest->xfeatures is solely used to check if XFD features are enabled. Including supervisor xfeatures doesn't affect the check.
--- arch/x86/kernel/fpu/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/fpu/core.c +2 -2
@@ -232,8 +232,8 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu) fpstate->is_guest = true; gfpu->fpstate = fpstate; - gfpu->xfeatures = fpu_user_cfg.default_features; - gfpu->perm = fpu_user_cfg.default_features; + gfpu->xfeatures = fpu_kernel_cfg.default_features; + gfpu->perm = fpu_kernel_cfg.default_features;/* * KVM sets the FP+SSE bits in the XSAVE header when copying FPU state
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/268 media: verisilicon: HEVC: Initialize start_bit field
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gaignard <[email protected]>
[ Upstream commit 7fcb42b3835e90ef18d68555934cf72adaf58402 ]
The HEVC driver needs to set the start_bit field explicitly to avoid causing corrupted frames when the VP9 decoder is used in parallel. The reason for this problem is that the VP9 and the HEVC decoder share this register.
--- drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c +1 -0
@@ -517,6 +517,7 @@ static void set_buffers(struct hantro_ctx *ctx)hantro_reg_write (vpu, &g2_stream_len, src_len);hantro_reg_write (vpu, &g2_strm_buffer_len, src_buf_len);hantro_reg_write (vpu, &g2_strm_start_offset,0 ); +hantro_reg_write (vpu, &g2_start_bit,0 );hantro_reg_write (vpu, &g2_write_mvs_e,1 );hantro_write_addr (vpu,G2_TILE_SIZES_ADDR , ctx->hevc_dec.tile_sizes.dma);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/268 media: platform: allgro-dvt: unregister v4l2_device on the error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit c2b96a6818159fba8a3bcc38262da9e77f9b3ec7 ]
In allegro_probe(), the v4l2 device is not unregistered in the error path, which results in a memory leak. Fix it by calling v4l2_device_unregister() before returning error.
--- drivers/media/platform/allegro-dvt/allegro-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/allegro-dvt/allegro-core.c +1 -0
@@ -3914,6 +3914,7 @@ static int allegro_probe(struct platform_device *pdev)if (ret <0 ) {v4l2_err (&dev->v4l2_dev,"failed to request firmware: %d\n" , ret); +v4l2_device_unregister (&dev->v4l2_dev);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/268 platform/x86: dell-ddv: Fix temperature calculation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 7a248294a3145bc65eb0d8980a0a8edbb1b92db4 ]
On the Dell Inspiron 3505 the battery temperature is always 0.1 degrees larger than the temperature show inside the OEM application.
Emulate this behaviour to avoid showing strange looking values like 29.1 degrees.
--- drivers/platform/x86/dell/dell-wmi-ddv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/platform/x86/dell/dell-wmi-ddv.c +4 -2
@@ -665,8 +665,10 @@ static ssize_t temp_show(struct device *dev, struct device_attribute *attr, charif (ret <0 )return ret; -/* Use 2731 instead of 2731.5 to avoid unnecessary rounding */ -return sysfs_emit (buf,"%d\n" , value -2731 ); +/* Use 2732 instead of 2731.5 to avoid unnecessary rounding and to emulate +* the behaviour of the OEM application which seems to round down the result. +*/ +return sysfs_emit (buf,"%d\n" , value -2732 ); }static ssize_t eppid_show (struct device *dev,struct device_attribute *attr,char *buf)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/268 ASoC: cs35l41: check the return value from spi_setup()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit ad5a0970f86d82e39ebd06d45a1f7aa48a1316f8 ]
Currently the return value from spi_setup() is not checked for a failure. It is unlikely it will ever fail in this particular case but it is still better to add this check for the sake of completeness and correctness. This is cheap since it is performed once when the device is being probed.
Handle spi_setup() return value.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- sound/soc/codecs/cs35l41-spi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/codecs/cs35l41-spi.c +3 -1
@@ -39,7 +39,9 @@ static int cs35l41_spi_probe(struct spi_device *spi)return -ENOMEM ; spi->max_speed_hz =CS35L41_SPI_MAX_FREQ ; -spi_setup (spi); + ret =spi_setup (spi); +if (ret <0 ) +return ret;spi_set_drvdata (spi, cs35l41); cs35l41->regmap =devm_regmap_init_spi (spi, regmap_config);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/268 HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
[ Upstream commit fe0fb58325e519008e2606a5aa2cff7ad23e212d ]
The line
obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/
in top-level HID Makefile is both superfluous (as CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER depends on CONFIG_INTEL_ISH_HID, which contains intel-ish-hid/ already) and wrong (as it's missing the CONFIG_ prefix).
Just remove it.
--- drivers/hid/Makefile | 1 - 1 file changed, 1 deletion(-)
drivers/hid/Makefile +0 -1
@@ -165,7 +165,6 @@ obj-$(CONFIG_USB_KBD) += usbhid/ obj-$(CONFIG_I2C_HID_CORE) += i2c-hid/ obj-$(CONFIG_INTEL_ISH_HID) += intel-ish-hid/ -obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/ obj-$(CONFIG_AMD_SFH_HID) += amd-sfh-hid/
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/268 dt-bindings: vendor-prefixes: add GOcontroll
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maud Spierings <[email protected]>
[ Upstream commit 5f0d2de417166698c8eba433b696037ce04730da ]
GOcontroll produces embedded linux systems and IO modules to use in these systems, add its prefix.
--- Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++ 1 file changed, 2 insertions(+)
Documentation/devicetree/bindings/vendor-prefixes.yaml +2 -0
@@ -524,6 +524,8 @@ patternProperties: description: GlobalTop Technology, Inc. "^gmt,.*": description: Global Mixed-mode Technology, Inc. + "^gocontroll,.*": + description: GOcontroll Modular Embedded Electronics B.V. "^goldelico,.*": description: Golden Delicious Computers GmbH & Co. KG "^goodix,.*":
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/268 ALSA: hda/realtek: Always honor no_shutup_pins
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 5a0c72c1da3cbc0cd4940a95d1be2830104c6edf ]
The workaround for Dell machines to skip the pin-shutup for mic pins introduced alc_headset_mic_no_shutup() that is replaced from the generic snd_hda_shutup_pins() for certain codecs. The problem is that the call is done unconditionally even if spec->no_shutup_pins is set. This seems causing problems on other platforms like Lenovo.
This patch corrects the behavior and the driver honors always spec->no_shutup_pins flag and skips alc_headset_mic_no_shutup() if it's set.
--- sound/pci/hda/patch_realtek.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +4 -2
@@ -584,6 +584,9 @@ static void alc_shutup_pins(struct hda_codec *codec) {struct alc_spec *spec = codec->spec; +if (spec->no_shutup_pins) +return ; +switch (codec->core.vendor_id) {case 0x10ec0236 :case 0x10ec0256 :
@@ -599,8 +602,7 @@ static void alc_shutup_pins(struct hda_codec *codec)alc_headset_mic_no_shutup (codec);break ;default : -if (!spec->no_shutup_pins) -snd_hda_shutup_pins (codec); +snd_hda_shutup_pins (codec);break ; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/268 ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <[email protected]>
[ Upstream commit 45ff65e30deb919604e68faed156ad96ce7474d9 ]
For 'ti,j7200-cpb-audio' compatible, there is support for only one PLL for 48k. For 11025, 22050, 44100 and 88200 sampling rates, due to absence of J721E_CLK_PARENT_44100, we get EINVAL while running any audio application. Add support for these rates by using the 48k parent clock and adjusting the clock for these rates later in j721e_configure_refclk.
--- sound/soc/ti/j721e-evm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/ti/j721e-evm.c +2 -0
@@ -182,6 +182,8 @@ static int j721e_configure_refclk(struct j721e_priv *priv, clk_id =J721E_CLK_PARENT_48000 ; else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_44100]) clk_id =J721E_CLK_PARENT_44100 ; + else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_48000]) + clk_id =J721E_CLK_PARENT_48000 ; else return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/268 drm/bridge: ti-sn65dsi86: Fix multiple instances
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 574f5ee2c85a00a579549d50e9fc9c6c072ee4c4 ]
Each bridge instance creates up to four auxiliary devices with different names. However, their IDs are always zero, causing duplicate filename errors when a system has multiple bridges:
sysfs: cannot create duplicate filename '/bus/auxiliary/devices/ti_sn65dsi86.gpio.0'
Fix this by using a unique instance ID per bridge instance. The instance ID is derived from the I2C adapter number and the bridge's I2C address, to support multiple instances on the same bus.
--- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/bridge/ti-sn65dsi86.c +2 -0
@@ -480,6 +480,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata, const char *name) {struct device *dev = pdata->dev; +const struct i2c_client *client =to_i2c_client (dev);struct auxiliary_device *aux;int ret;
@@ -488,6 +489,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,return -ENOMEM ; aux->name = name; + aux->id = (client->adapter->nr <<10 ) | client->addr; aux->dev.parent = dev; aux->dev.release = ti_sn65dsi86_aux_device_release;device_set_of_node_from_dev (&aux->dev, dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/268 drm/dp_mst: Fix drm RAD print
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
[ Upstream commit 6bbce873a9c97cb12f5455c497be279ac58e707f ]
[Why]
The RAD of sideband message printed today is incorrect.
For RAD stored within MST branch
- If MST branch LCT is 1, it's RAD array is untouched and remained as 0.
- If MST branch LCT is larger than 1, use nibble to store the up facing port number in cascaded sequence as illustrated below:
u8 RAD[0] = (LCT_2_UFP << 4) | LCT_3_UFP
RAD[1] = (LCT_4_UFP << 4) | LCT_5_UFP
...In drm_dp_mst_rad_to_str(), it wrongly to use BIT_MASK(4) to fetch the port number of one nibble.
[How]
Adjust the code by:
- RAD array items are valuable only for LCT >= 1.
- Use 0xF as the mask to replace BIT_MASK(4)
V2:
- Document how RAD is constructed (Imre)
V3:
- Adjust the comment for rad[] so kdoc formats it properly (Lyude)
--- drivers/gpu/drm/display/drm_dp_mst_topology.c | 8 ++++---- include/drm/display/drm_dp_mst_helper.h | 7 +++++++ 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/gpu/drm/display/drm_dp_mst_topology.c +4 -4
@@ -178,13 +178,13 @@ static int drm_dp_mst_rad_to_str(const u8 rad[8], u8 lct, char *out, size_t len) { int i; -u8 unpacked_rad[16 ]; +u8 unpacked_rad[16 ] = {}; -for (i =0 ; i < lct; i++) { +for (i =1 ; i < lct; i++) {if (i %2 ) - unpacked_rad[i] = rad[i /2 ] >>4 ; + unpacked_rad[i] = rad[(i -1 ) /2 ] >>4 ;else - unpacked_rad[i] = rad[i /2 ] &BIT_MASK (4 ); + unpacked_rad[i] = rad[(i -1 ) /2 ] &0xF ; }/* TODO: Eventually add something to printk so we can format the rad
include/drm/display/drm_dp_mst_helper.h +7 -0
@@ -215,6 +215,13 @@ struct drm_dp_mst_branch {*/ struct list_head destroy_next; +/** +* @rad: Relative Address of the MST branch. +* For &drm_dp_mst_topology_mgr.mst_primary, it's rad[8] are all 0, +* unset and unused. For MST branches connected after mst_primary, +* in each element of rad[] the nibbles are ordered by the most +* signifcant 4 bits first and the least significant 4 bits second. +*/ u8 rad[8 ];u8 lct;int num_ports;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/268 drm/bridge: it6505: fix HDCP V match check is not performed correctly
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermes Wu <[email protected]>
[ Upstream commit a5072fc77fb9e38fa9fd883642c83c3720049159 ]
Fix a typo where V compare incorrectly compares av[] with av[] itself, which can result in HDCP failure.
The loop of V compare is expected to iterate for 5 times which compare V array form av[0][] to av[4][].
It should check loop counter reach the last statement "i == 5" before return true
--- drivers/gpu/drm/bridge/ite-it6505.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/ite-it6505.c +4 -3
@@ -2039,12 +2039,13 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505)continue ; } -for (i =0 ; i <5 ; i++) { +for (i =0 ; i <5 ; i++)if (bv[i][3 ] != av[i][0 ] || bv[i][2 ] != av[i][1 ] || - av[i][1 ] != av[i][2 ] || bv[i][0 ] != av[i][3 ]) + bv[i][1 ] != av[i][2 ] || bv[i][0 ] != av[i][3 ])break ; -DRM_DEV_DEBUG_DRIVER (dev,"V' all match!! %d, %d" , retry, i); +if (i ==5 ) { +DRM_DEV_DEBUG_DRIVER (dev,"V' all match!! %d" , retry);return true; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/268 drm: xlnx: zynqmp: Fix max dma segment size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 28b529a98525123acd37372a04d21e87ec2edcf7 ]
Fix "mapping sg segment longer than device claims to support" warning by setting the max segment size.
--- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/xlnx/zynqmp_dpsub.c +2 -0
@@ -231,6 +231,8 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev)if (ret)return ret; +dma_set_max_seg_size (&pdev->dev,DMA_BIT_MASK (32 )); +/* Try the reserved memory. Proceed if there's none. */ of_reserved_mem_device_init (&pdev->dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/268 drm/vkms: Fix use after free and double free on init error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit ed15511a773df86205bda66c37193569575ae828 ]
If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it might double free it.
Fix both possible errors by initializing default_config only when the driver initialization succeeded.
--- drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/gpu/drm/vkms/vkms_drv.c +9 -6
@@ -243,17 +243,19 @@ static int __init vkms_init(void)if (!config)return -ENOMEM ; - default_config = config; - config->cursor = enable_cursor; config->writeback = enable_writeback; config->overlay = enable_overlay; ret =vkms_create (config); -if (ret) +if (ret) {kfree (config); +return ret; + } -return ret; + default_config = config; + +return 0 ; }static void vkms_destroy (struct vkms_config *config)
@@ -277,9 +279,10 @@ static void vkms_destroy(struct vkms_config *config) static void __exit vkms_exit(void) { -if (default_config->dev) -vkms_destroy (default_config); +if (!default_config) +return ; +vkms_destroy (default_config);kfree (default_config); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/268 PCI: Use downstream bridges for distributing resources
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit 1a596ad00ffe9b37fc60a93cbdd4daead3bf95f3 ]
7180c1d08639 ("PCI: Distribute available resources for root buses, too") breaks BAR assignment on some devices:
pci 0006:03:00.0: BAR 0 [mem 0x6300c0000000-0x6300c1ffffff 64bit pref]: assigned pci 0006:03:00.1: BAR 0 [mem 0x6300c2000000-0x6300c3ffffff 64bit pref]: assigned pci 0006:03:00.2: BAR 0 [mem size 0x00800000 64bit pref]: can't assign; no space pci 0006:03:00.0: VF BAR 0 [mem size 0x02000000 64bit pref]: can't assign; no space pci 0006:03:00.1: VF BAR 0 [mem size 0x02000000 64bit pref]: can't assign; no space
The apertures of domain 0006 before 7180c1d08639:
6300c0000000-63ffffffffff : PCI Bus 0006:00
6300c0000000-6300c9ffffff : PCI Bus 0006:01
6300c0000000-6300c9ffffff : PCI Bus 0006:02 # 160MB
6300c0000000-6300c8ffffff : PCI Bus 0006:03 # 144MB
6300c0000000-6300c1ffffff : 0006:03:00.0 # 32MB
6300c2000000-6300c3ffffff : 0006:03:00.1 # 32MB
6300c4000000-6300c47fffff : 0006:03:00.2 # 8MB
6300c4800000-6300c67fffff : 0006:03:00.0 # 32MB
6300c6800000-6300c87fffff : 0006:03:00.1 # 32MB
6300c9000000-6300c9bfffff : PCI Bus 0006:04 # 12MB
6300c9000000-6300c9bfffff : PCI Bus 0006:05 # 12MB
6300c9000000-6300c91fffff : PCI Bus 0006:06 # 2MB
6300c9200000-6300c93fffff : PCI Bus 0006:07 # 2MB
6300c9400000-6300c95fffff : PCI Bus 0006:08 # 2MB
6300c9600000-6300c97fffff : PCI Bus 0006:09 # 2MBAfter 7180c1d08639:
6300c0000000-63ffffffffff : PCI Bus 0006:00
6300c0000000-6300c9ffffff : PCI Bus 0006:01
6300c0000000-6300c9ffffff : PCI Bus 0006:02 # 160MB
6300c0000000-6300c43fffff : PCI Bus 0006:03 # 68MB
6300c0000000-6300c1ffffff : 0006:03:00.0 # 32MB
6300c2000000-6300c3ffffff : 0006:03:00.1 # 32MB
--- no space --- : 0006:03:00.2 # 8MB
--- no space --- : 0006:03:00.0 # 32MB
--- no space --- : 0006:03:00.1 # 32MB
6300c4400000-6300c4dfffff : PCI Bus 0006:04 # 10MB
6300c4400000-6300c4dfffff : PCI Bus 0006:05 # 10MB
6300c4400000-6300c45fffff : PCI Bus 0006:06 # 2MB
6300c4600000-6300c47fffff : PCI Bus 0006:07 # 2MB
6300c4800000-6300c49fffff : PCI Bus 0006:08 # 2MB
6300c4a00000-6300c4bfffff : PCI Bus 0006:09 # 2MBWe can see that the window to 0006:03 gets shrunken too much and 0006:04 eats away the window for 0006:03:00.2.
The offending commit distributes the upstream bridge's resources multiple times to every downstream bridge, hence makes the aperture smaller than desired because calculation of io_per_b, mmio_per_b and mmio_pref_per_b becomes incorrect.
Instead, distribute downstream bridges' own resources to resolve the issue.
--- drivers/pci/setup-bus.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pci/setup-bus.c +1 -2
@@ -2018,8 +2018,7 @@ pci_root_bus_distribute_available_resources(struct pci_bus *bus,* in case of root bus. */ if (bridge &&pci_bridge_resources_not_assigned (dev)) -pci_bridge_distribute_available_resources (bridge, - add_list); +pci_bridge_distribute_available_resources (dev, add_list);else pci_root_bus_distribute_available_resources (b, add_list); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/268 drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 0be123cafc06eed0fd1227166a66e786434b0c50 ]
The probe function of this driver may fail after registering the audio platform device: in that case, the state is not getting cleaned up, leaving this device registered.
Adding up to the mix, should the probe function of this driver return a probe deferral for N times, we're registering up to N audio platform devices and, again, never freeing them up.
To fix this, add a pointer to the audio platform device in the mtk_hdmi structure, and add a devm action to unregister it upon driver removal or probe failure.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +19 -6
@@ -173,6 +173,7 @@ struct mtk_hdmi {unsigned int sys_offset;void __iomem *regs;enum hdmi_colorspace csp; +struct platform_device *audio_pdev;struct hdmi_audio_param aud_param;bool audio_enable;bool powered;
@@ -1666,6 +1667,11 @@ static const struct hdmi_codec_ops mtk_hdmi_audio_codec_ops = { .no_capture_mute = 1, }; +static void mtk_hdmi_unregister_audio_driver (void *data) +{ +platform_device_unregister (data); +} +static int mtk_hdmi_register_audio_driver (struct device *dev) {struct mtk_hdmi *hdmi =dev_get_drvdata (dev);
@@ -1675,13 +1681,20 @@ static int mtk_hdmi_register_audio_driver(struct device *dev) .i2s = 1, .data = hdmi, }; -struct platform_device *pdev; +int ret; - pdev =platform_device_register_data (dev,HDMI_CODEC_DRV_NAME , -PLATFORM_DEVID_AUTO , &codec_data, -sizeof (codec_data)); -if (IS_ERR (pdev)) -return PTR_ERR (pdev); + hdmi->audio_pdev =platform_device_register_data (dev, +HDMI_CODEC_DRV_NAME , +PLATFORM_DEVID_AUTO , + &codec_data, +sizeof (codec_data)); +if (IS_ERR (hdmi->audio_pdev)) +return PTR_ERR (hdmi->audio_pdev); + + ret =devm_add_action_or_reset (dev, mtk_hdmi_unregister_audio_driver, + hdmi->audio_pdev); +if (ret) +return ret;DRM_INFO ("%s driver bound to HDMI\n" ,HDMI_CODEC_DRV_NAME );return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/268 drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 72fcb88e7bbc053ed4fc74cebb0315b98a0f20c3 ]
Rename member aud_sampe_size of struct hdmi_audio_param to aud_sample_size to fix a typo and enhance readability.
This commit brings no functional changes.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +4 -4
@@ -137,7 +137,7 @@ enum hdmi_aud_channel_swap_type {struct hdmi_audio_param {enum hdmi_audio_coding_type aud_codec; -enum hdmi_audio_sample_size aud_sampe_size; +enum hdmi_audio_sample_size aud_sample_size;enum hdmi_aud_input_type aud_input_type;enum hdmi_aud_i2s_fmt aud_i2s_fmt;enum hdmi_aud_mclk aud_mclk;
@@ -1075,7 +1075,7 @@ static int mtk_hdmi_output_init(struct mtk_hdmi *hdmi) hdmi->csp =HDMI_COLORSPACE_RGB ; aud_param->aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - aud_param->aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + aud_param->aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; aud_param->aud_input_type =HDMI_AUD_INPUT_I2S ; aud_param->aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; aud_param->aud_mclk =HDMI_AUD_MCLK_128FS ;
@@ -1576,14 +1576,14 @@ static int mtk_hdmi_audio_hw_params(struct device *dev, void *data,switch (daifmt->fmt) {case HDMI_I2S : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_I2S ; hdmi_params.aud_i2s_fmt =HDMI_I2S_MODE_I2S_24BIT ; hdmi_params.aud_mclk =HDMI_AUD_MCLK_128FS ;break ;case HDMI_SPDIF : hdmi_params.aud_codec =HDMI_AUDIO_CODING_TYPE_PCM ; - hdmi_params.aud_sampe_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; + hdmi_params.aud_sample_size =HDMI_AUDIO_SAMPLE_SIZE_16 ; hdmi_params.aud_input_type =HDMI_AUD_INPUT_SPDIF ;break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/268 PCI/ASPM: Fix link state exit during switch upstream function removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Stodden <[email protected]>
[ Upstream commit cbf937dcadfd571a434f8074d057b32cd14fbea5 ]
Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed.
That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after.
After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link.
That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports.
The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order.
On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone.
--- drivers/pci/pcie/aspm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/pci/pcie/aspm.c +9 -8
@@ -977,16 +977,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) parent_link = link->parent;/* -* link->downstream is a pointer to the pci_dev of function 0. If -* we remove that function, the pci_dev is about to be deallocated, -* so we can't use link->downstream again. Free the link state to -* avoid this. +* Free the parent link state, no later than function 0 (i.e. +* link->downstream) being removed. * -* If we're removing a non-0 function, it's possible we could -* retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends -* programming the same ASPM Control value for all functions of -* multi-function devices, so disable ASPM for all of them. +* Do not free the link state any earlier. If function 0 is a +* switch upstream port, this link state is parent_link to all +* subordinate ones. */ +if (pdev != link->downstream) + goto out; +pcie_config_aspm_link (link,0 );list_del (&link->sibling);free_link_state (link);
@@ -997,6 +997,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)pcie_config_aspm_path (parent_link); } + out:mutex_unlock (&aspm_lock);up_read (&pci_bus_sem); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/268 drm/msm/dpu: dont use active in atomic_check()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 25b4614843bcc56ba150f7c99905125a019e656c ]
The driver isn't supposed to consult crtc_state->active/active_check for resource allocation. Instead all resources should be allocated if crtc_state->enabled is set. Stop consulting active / active_changed in order to determine whether the hardware resources should be (re)allocated.
Patchwork: https://patchwork.freedesktop.org/patch/633393/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 4 ---- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +-- 2 files changed, 1 insertion(+), 6 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +0 -4
@@ -1210,10 +1210,6 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,DRM_DEBUG_ATOMIC ("%s: check\n" , dpu_crtc->name); -/* force a full mode set if active state changed */ -if (crtc_state->active_changed) - crtc_state->mode_changed = true; -if (cstate->num_mixers) { rc =_dpu_crtc_check_and_setup_lm_bounds (crtc, crtc_state);if (rc)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +1 -2
@@ -669,12 +669,11 @@ static int dpu_encoder_virt_atomic_check(/* * Release and Allocate resources on every modeset -* Dont allocate when active is false. */ if (drm_atomic_crtc_needs_modeset (crtc_state)) {dpu_rm_release (global_state, drm_enc); -if (!crtc_state->active_changed || crtc_state->enable) +if (crtc_state->enable) ret =dpu_rm_reserve (&dpu_kms->rm, global_state, drm_enc, crtc_state, topology); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/268 drm/msm/dsi: Use existing per-interface slice count in DSC timing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marijn Suijten <[email protected]>
[ Upstream commit 14ad809ceb66d0874cbe4bd5ca9edf0de8d9ad96 ]
When configuring the timing of DSI hosts (interfaces) in dsi_timing_setup() all values written to registers are taking bonded-mode into account by dividing the original mode width by 2 (half the data is sent over each of the two DSI hosts), but the full width instead of the interface width is passed as hdisplay parameter to dsi_update_dsc_timing().
Currently only msm_dsc_get_slices_per_intf() is called within dsi_update_dsc_timing() with the hdisplay argument which clearly documents that it wants the width of a single interface (which, again, in bonded DSI mode is half the total width of the mode) resulting in all subsequent values to be completely off.
However, as soon as we start to pass the halved hdisplay into dsi_update_dsc_timing() we might as well discard msm_dsc_get_slices_per_intf() since the value it calculates is already available in dsc->slice_count which is per-interface by the current design of MSM DPU/DSI implementations and their use of the DRM DSC helpers.
Patchwork: https://patchwork.freedesktop.org/patch/637648/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 8 ++++---- drivers/gpu/drm/msm/msm_dsc_helper.h | 11 ----------- 2 files changed, 4 insertions(+), 15 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +4 -4
@@ -825,7 +825,7 @@ static void dsi_ctrl_enable(struct msm_dsi_host *msm_host,dsi_write (msm_host,REG_DSI_CPHY_MODE_CTRL ,BIT (0 )); } -static void dsi_update_dsc_timing (struct msm_dsi_host *msm_host,bool is_cmd_mode,u32 hdisplay) +static void dsi_update_dsc_timing (struct msm_dsi_host *msm_host,bool is_cmd_mode) {struct drm_dsc_config *dsc = msm_host->dsc;u32 reg, reg_ctrl, reg_ctrl2;
@@ -837,7 +837,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod/* first calculate dsc parameters and then program * compress mode registers */ - slice_per_intf =msm_dsc_get_slices_per_intf (dsc, hdisplay); + slice_per_intf = dsc->slice_count; total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf; bytes_per_pkt = dsc->slice_chunk_size;/* * slice_per_pkt; */
@@ -948,7 +948,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)if (msm_host->mode_flags &MIPI_DSI_MODE_VIDEO ) {if (msm_host->dsc) -dsi_update_dsc_timing (msm_host, false, mode->hdisplay); +dsi_update_dsc_timing (msm_host, false); dsi_write(msm_host, REG_DSI_ACTIVE_H, DSI_ACTIVE_H_START(ha_start) |
@@ -969,7 +969,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi) DSI_ACTIVE_VSYNC_VPOS_END(vs_end)); }else {/* command mode */ if (msm_host->dsc) -dsi_update_dsc_timing (msm_host, true, mode->hdisplay); +dsi_update_dsc_timing (msm_host, true);/* image data and 1 byte write_memory_start cmd */ if (!msm_host->dsc)
drivers/gpu/drm/msm/msm_dsc_helper.h +0 -11
@@ -12,17 +12,6 @@#include <linux/math.h> #include <drm/display/drm_dsc_helper.h> -/** -* msm_dsc_get_slices_per_intf() - calculate number of slices per interface -* @dsc: Pointer to drm dsc config struct -* @intf_width: interface width in pixels -* Returns: Integer representing the number of slices for the given interface -*/ -static inline u32 msm_dsc_get_slices_per_intf (const struct drm_dsc_config *dsc,u32 intf_width) -{ -return DIV_ROUND_UP (intf_width, dsc->slice_width); -} -/** * msm_dsc_get_bytes_per_line() - calculate bytes per line * @dsc: Pointer to drm dsc config struct
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/268 drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marijn Suijten <[email protected]>
[ Upstream commit 660c396c98c061f9696bebacc178b74072e80054 ]
Ordering issues here cause an uninitialized (default STANDALONE) usecase to be programmed (which appears to be a MUX) in some cases when msm_dsi_host_register() is called, leading to the slave PLL in bonded-DSI mode to source from a clock parent (dsi1vco) that is off.
This should seemingly not be a problem as the actual dispcc clocks from DSI1 that are muxed in the clock tree of DSI0 are way further down, this bit still seems to have an effect on them somehow and causes the right side of the panel controlled by DSI1 to not function.
In an ideal world this code is refactored to no longer have such error-prone calls "across subsystems", and instead model the "PLL src" register field as a regular mux so that changing the clock parents programmatically or in DTS via assigned-clock-parents has the desired effect.
But for the avid reader, the clocks that we *are* muxing into DSI0's tree are way further down, so if this bit turns out to be a simple mux between dsiXvco and out_div, that shouldn't have any effect as this whole tree is off anyway.
Patchwork: https://patchwork.freedesktop.org/patch/637650/
--- drivers/gpu/drm/msm/dsi/dsi_manager.c | 32 ++++++++++++++++++--------- 1 file changed, 21 insertions(+), 11 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_manager.c +21 -11
@@ -74,17 +74,35 @@ static int dsi_mgr_setup_components(int id)int ret;if (!IS_BONDED_DSI ()) { +/* +* Set the usecase before calling msm_dsi_host_register(), which would +* already program the PLL source mux based on a default usecase. +*/ +msm_dsi_phy_set_usecase (msm_dsi->phy,MSM_DSI_PHY_STANDALONE ); +msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); + ret =msm_dsi_host_register (msm_dsi->host);if (ret)return ret; - -msm_dsi_phy_set_usecase (msm_dsi->phy,MSM_DSI_PHY_STANDALONE ); -msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); }else if (other_dsi) {struct msm_dsi *master_link_dsi =IS_MASTER_DSI_LINK (id) ? msm_dsi : other_dsi;struct msm_dsi *slave_link_dsi =IS_MASTER_DSI_LINK (id) ? other_dsi : msm_dsi; + +/* +* PLL0 is to drive both DSI link clocks in bonded DSI mode. +* +* Set the usecase before calling msm_dsi_host_register(), which would +* already program the PLL source mux based on a default usecase. +*/ +msm_dsi_phy_set_usecase (clk_master_dsi->phy, +MSM_DSI_PHY_MASTER ); +msm_dsi_phy_set_usecase (clk_slave_dsi->phy, +MSM_DSI_PHY_SLAVE ); +msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); +msm_dsi_host_set_phy_mode (other_dsi->host, other_dsi->phy); +/* Register slave host first, so that slave DSI device * has a chance to probe, and do not block the master * DSI device's probe.
@@ -98,14 +116,6 @@ static int dsi_mgr_setup_components(int id) ret =msm_dsi_host_register (master_link_dsi->host);if (ret)return ret; - -/* PLL0 is to drive both 2 DSI link clocks in bonded DSI mode. */ -msm_dsi_phy_set_usecase (clk_master_dsi->phy, -MSM_DSI_PHY_MASTER ); -msm_dsi_phy_set_usecase (clk_slave_dsi->phy, -MSM_DSI_PHY_SLAVE ); -msm_dsi_host_set_phy_mode (msm_dsi->host, msm_dsi->phy); -msm_dsi_host_set_phy_mode (other_dsi->host, other_dsi->phy); }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/268 drm/amdkfd: Fix Circular Locking Dependency in svm_range_cpu_invalidate_pagetables
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit fddc45026311c05a5355fd34b9dc0a1d7eaef4a2 ]
This commit addresses a circular locking dependency in the svm_range_cpu_invalidate_pagetables function. The function previously held a lock while determining whether to perform an unmap or eviction operation, which could lead to deadlocks.
Fixes the below:
[ 223.418794] ======================================================
[ 223.418820] WARNING: possible circular locking dependency detected
[ 223.418845] 6.12.0-amdstaging-drm-next-lol-050225 #14 Tainted: G U OE
[ 223.418869] ------------------------------------------------------
[ 223.418889] kfdtest/3939 is trying to acquire lock:
[ 223.418906] ffff8957552eae38 (&dqm->lock_hidden){+.+.}-{3:3}, at: evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.419302]
but task is already holding lock:
[ 223.419303] ffff8957556b83b0 (&prange->lock){+.+.}-{3:3}, at: svm_range_cpu_invalidate_pagetables+0x9d/0x850 [amdgpu]
[ 223.419447] Console: switching to colour dummy device 80x25
[ 223.419477] [IGT] amd_basic: executing
[ 223.419599]
which lock already depends on the new lock.[ 223.419611]
the existing dependency chain (in reverse order) is:
[ 223.419621]
-> #2 (&prange->lock){+.+.}-{3:3}:
[ 223.419636] __mutex_lock+0x85/0xe20
[ 223.419647] mutex_lock_nested+0x1b/0x30
[ 223.419656] svm_range_validate_and_map+0x2f1/0x15b0 [amdgpu]
[ 223.419954] svm_range_set_attr+0xe8c/0x1710 [amdgpu]
[ 223.420236] svm_ioctl+0x46/0x50 [amdgpu]
[ 223.420503] kfd_ioctl_svm+0x50/0x90 [amdgpu]
[ 223.420763] kfd_ioctl+0x409/0x6d0 [amdgpu]
[ 223.421024] __x64_sys_ioctl+0x95/0xd0
[ 223.421036] x64_sys_call+0x1205/0x20d0
[ 223.421047] do_syscall_64+0x87/0x140
[ 223.421056] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 223.421068]
-> #1 (reservation_ww_class_mutex){+.+.}-{3:3}:
[ 223.421084] __ww_mutex_lock.constprop.0+0xab/0x1560
[ 223.421095] ww_mutex_lock+0x2b/0x90
[ 223.421103] amdgpu_amdkfd_alloc_gtt_mem+0xcc/0x2b0 [amdgpu]
[ 223.421361] add_queue_mes+0x3bc/0x440 [amdgpu]
[ 223.421623] unhalt_cpsch+0x1ae/0x240 [amdgpu]
[ 223.421888] kgd2kfd_start_sched+0x5e/0xd0 [amdgpu]
[ 223.422148] amdgpu_amdkfd_start_sched+0x3d/0x50 [amdgpu]
[ 223.422414] amdgpu_gfx_enforce_isolation_handler+0x132/0x270 [amdgpu]
[ 223.422662] process_one_work+0x21e/0x680
[ 223.422673] worker_thread+0x190/0x330
[ 223.422682] kthread+0xe7/0x120
[ 223.422690] ret_from_fork+0x3c/0x60
[ 223.422699] ret_from_fork_asm+0x1a/0x30
[ 223.422708]
-> #0 (&dqm->lock_hidden){+.+.}-{3:3}:
[ 223.422723] __lock_acquire+0x16f4/0x2810
[ 223.422734] lock_acquire+0xd1/0x300
[ 223.422742] __mutex_lock+0x85/0xe20
[ 223.422751] mutex_lock_nested+0x1b/0x30
[ 223.422760] evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.423025] kfd_process_evict_queues+0x8a/0x1d0 [amdgpu]
[ 223.423285] kgd2kfd_quiesce_mm+0x43/0x90 [amdgpu]
[ 223.423540] svm_range_cpu_invalidate_pagetables+0x4a7/0x850 [amdgpu]
[ 223.423807] __mmu_notifier_invalidate_range_start+0x1f5/0x250
[ 223.423819] copy_page_range+0x1e94/0x1ea0
[ 223.423829] copy_process+0x172f/0x2ad0
[ 223.423839] kernel_clone+0x9c/0x3f0
[ 223.423847] __do_sys_clone+0x66/0x90
[ 223.423856] __x64_sys_clone+0x25/0x30
[ 223.423864] x64_sys_call+0x1d7c/0x20d0
[ 223.423872] do_syscall_64+0x87/0x140
[ 223.423880] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 223.423891]
other info that might help us debug this:[ 223.423903] Chain exists of:
&dqm->lock_hidden --> reservation_ww_class_mutex --> &prange->lock[ 223.423926] Possible unsafe locking scenario:
[ 223.423935] CPU0 CPU1
[ 223.423942] ---- ----
[ 223.423949] lock(&prange->lock);
[ 223.423958] lock(reservation_ww_class_mutex);
[ 223.423970] lock(&prange->lock);
[ 223.423981] lock(&dqm->lock_hidden);
[ 223.423990]
*** DEADLOCK ***[ 223.423999] 5 locks held by kfdtest/3939:
[ 223.424006] #0: ffffffffb82b4fc0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x1387/0x2ad0
[ 223.424026] #1: ffff89575eda81b0 (&mm->mmap_lock){++++}-{3:3}, at: copy_process+0x13a8/0x2ad0
[ 223.424046] #2: ffff89575edaf3b0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_process+0x13e4/0x2ad0
[ 223.424066] #3: ffffffffb82e76e0 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: copy_page_range+0x1cea/0x1ea0
[ 223.424088] #4: ffff8957556b83b0 (&prange->lock){+.+.}-{3:3}, at: svm_range_cpu_invalidate_pagetables+0x9d/0x850 [amdgpu]
[ 223.424365]
stack backtrace:
[ 223.424374] CPU: 0 UID: 0 PID: 3939 Comm: kfdtest Tainted: G U OE 6.12.0-amdstaging-drm-next-lol-050225 #14
[ 223.424392] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 223.424401] Hardware name: Gigabyte Technology Co., Ltd. X570 AORUS PRO WIFI/X570 AORUS PRO WIFI, BIOS F36a 02/16/2022
[ 223.424416] Call Trace:
[ 223.424423] <TASK>
[ 223.424430] dump_stack_lvl+0x9b/0xf0
[ 223.424441] dump_stack+0x10/0x20
[ 223.424449] print_circular_bug+0x275/0x350
[ 223.424460] check_noncircular+0x157/0x170
[ 223.424469] ? __bfs+0xfd/0x2c0
[ 223.424481] __lock_acquire+0x16f4/0x2810
[ 223.424490] ? srso_return_thunk+0x5/0x5f
[ 223.424505] lock_acquire+0xd1/0x300
[ 223.424514] ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.424783] __mutex_lock+0x85/0xe20
[ 223.424792] ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.425058] ? srso_return_thunk+0x5/0x5f
[ 223.425067] ? mark_held_locks+0x54/0x90
[ 223.425076] ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.425339] ? srso_return_thunk+0x5/0x5f
[ 223.425350] mutex_lock_nested+0x1b/0x30
[ 223.425358] ? mutex_lock_nested+0x1b/0x30
[ 223.425367] evict_process_queues_cpsch+0x43/0x210 [amdgpu]
[ 223.425631] kfd_process_evict_queues+0x8a/0x1d0 [amdgpu]
[ 223.425893] kgd2kfd_quiesce_mm+0x43/0x90 [amdgpu]
[ 223.426156] svm_range_cpu_invalidate_pagetables+0x4a7/0x850 [amdgpu]
[ 223.426423] ? srso_return_thunk+0x5/0x5f
[ 223.426436] __mmu_notifier_invalidate_range_start+0x1f5/0x250
[ 223.426450] copy_page_range+0x1e94/0x1ea0
[ 223.426461] ? srso_return_thunk+0x5/0x5f
[ 223.426474] ? srso_return_thunk+0x5/0x5f
[ 223.426484] ? lock_acquire+0xd1/0x300
[ 223.426494] ? copy_process+0x1718/0x2ad0
[ 223.426502] ? srso_return_thunk+0x5/0x5f
[ 223.426510] ? sched_clock_noinstr+0x9/0x10
[ 223.426519] ? local_clock_noinstr+0xe/0xc0
[ 223.426528] ? copy_process+0x1718/0x2ad0
[ 223.426537] ? srso_return_thunk+0x5/0x5f
[ 223.426550] copy_process+0x172f/0x2ad0
[ 223.426569] kernel_clone+0x9c/0x3f0
[ 223.426577] ? __schedule+0x4c9/0x1b00
[ 223.426586] ? srso_return_thunk+0x5/0x5f
[ 223.426594] ? sched_clock_noinstr+0x9/0x10
[ 223.426602] ? srso_return_thunk+0x5/0x5f
[ 223.426610] ? local_clock_noinstr+0xe/0xc0
[ 223.426619] ? schedule+0x107/0x1a0
[ 223.426629] __do_sys_clone+0x66/0x90
[ 223.426643] __x64_sys_clone+0x25/0x30
[ 223.426652] x64_sys_call+0x1d7c/0x20d0
[ 223.426661] do_syscall_64+0x87/0x140
[ 223.426671] ? srso_return_thunk+0x5/0x5f
[ 223.426679] ? common_nsleep+0x44/0x50
[ 223.426690] ? srso_return_thunk+0x5/0x5f
[ 223.426698] ? trace_hardirqs_off+0x52/0xd0
[ 223.426709] ? srso_return_thunk+0x5/0x5f
[ 223.426717] ? syscall_exit_to_user_mode+0xcc/0x200
[ 223.426727] ? srso_return_thunk+0x5/0x5f
[ 223.426736] ? do_syscall_64+0x93/0x140
[ 223.426748] ? srso_return_thunk+0x5/0x5f
[ 223.426756] ? up_write+0x1c/0x1e0
[ 223.426765] ? srso_return_thunk+0x5/0x5f
[ 223.426775] ? srso_return_thunk+0x5/0x5f
[ 223.426783] ? trace_hardirqs_off+0x52/0xd0
[ 223.426792] ? srso_return_thunk+0x5/0x5f
[ 223.426800] ? syscall_exit_to_user_mode+0xcc/0x200
[ 223.426810] ? srso_return_thunk+0x5/0x5f
[ 223.426818] ? do_syscall_64+0x93/0x140
[ 223.426826] ? syscall_exit_to_user_mode+0xcc/0x200
[ 223.426836] ? srso_return_thunk+0x5/0x5f
[ 223.426844] ? do_syscall_64+0x93/0x140
[ 223.426853] ? srso_return_thunk+0x5/0x5f
[ 223.426861] ? irqentry_exit+0x6b/0x90
[ 223.426869] ? srso_return_thunk+0x5/0x5f
[ 223.426877] ? exc_page_fault+0xa7/0x2c0
[ 223.426888] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 223.426898] RIP: 0033:0x7f46758eab57
[ 223.426906] Code: ba 04 00 f3 0f 1e fa 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 41 89 c0 85 c0 75 2c 64 48 8b 04 25 10 00
[ 223.426930] RSP: 002b:00007fff5c3e5188 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[ 223.426943] RAX: ffffffffffffffda RBX: 00007f4675f8c040 RCX: 00007f46758eab57
[ 223.426954] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
[ 223.426965] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 223.426975] R10: 00007f4675e81a50 R11: 0000000000000246 R12: 0000000000000001
[ 223.426986] R13: 00007fff5c3e5470 R14: 00007fff5c3e53e0 R15: 00007fff5c3e5410
[ 223.427004] </TASK>v2: To resolve this issue, the allocation of the process context buffer (proc_ctx_bo) has been moved from the add_queue_mes function to the pqm_create_queue function. This change ensures that the buffer is allocated only when the first queue for a process is created and only if the Micro Engine Scheduler (MES) is enabled. (Felix)
v3: Fix typo s/Memory Execution Scheduler (MES)/Micro Engine Scheduler in commit message. (Lijo)
--- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 15 --------------- .../drm/amd/amdkfd/kfd_process_queue_manager.c | 16 ++++++++++++++++ 2 files changed, 16 insertions(+), 15 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +0 -15
@@ -197,21 +197,6 @@ static int add_queue_mes(struct device_queue_manager *dqm, struct queue *q,if (dqm->is_hws_hang)return -EIO ; -if (!pdd->proc_ctx_cpu_ptr) { - r =amdgpu_amdkfd_alloc_gtt_mem (adev, -AMDGPU_MES_PROC_CTX_SIZE , - &pdd->proc_ctx_bo, - &pdd->proc_ctx_gpu_addr, - &pdd->proc_ctx_cpu_ptr, - false); -if (r) { -dev_err (adev->dev, -"failed to allocate process context bo\n" ); -return r; - } -memset (pdd->proc_ctx_cpu_ptr,0 ,AMDGPU_MES_PROC_CTX_SIZE ); - } -memset (&queue_input,0x0 ,sizeof (struct mes_add_queue_input )); queue_input.process_id = qpd->pqm->process->pasid; queue_input.page_table_base_addr = qpd->page_table_base;
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +16 -0
@@ -329,10 +329,26 @@ int pqm_create_queue(struct process_queue_manager *pqm,if (retval !=0 )return retval; +/* Register process if this is the first queue */ if (list_empty (&pdd->qpd.queues_list) &&list_empty (&pdd->qpd.priv_queue_list)) dev->dqm->ops.register_process (dev->dqm, &pdd->qpd); +/* Allocate proc_ctx_bo only if MES is enabled and this is the first queue */ +if (!pdd->proc_ctx_cpu_ptr && dev->kfd->shared_resources.enable_mes) { + retval =amdgpu_amdkfd_alloc_gtt_mem (dev->adev, +AMDGPU_MES_PROC_CTX_SIZE , + &pdd->proc_ctx_bo, + &pdd->proc_ctx_gpu_addr, + &pdd->proc_ctx_cpu_ptr, + false); +if (retval) { +dev_err (dev->adev->dev,"failed to allocate process context bo\n" ); +return retval; + } +memset (pdd->proc_ctx_cpu_ptr,0 ,AMDGPU_MES_PROC_CTX_SIZE ); + } + pqn =kzalloc (sizeof (*pqn),GFP_KERNEL );if (!pqn) { retval = -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/268 PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit 3ac47fbf4f6e8c3a7c3855fac68cc3246f90f850 ]
Per the Cadence's "PCIe Controller IP for AX14" user guide, Version 1.04, Section 9.1.7.1, "AXI Subordinate to PCIe Address Translation Registers", Table 9.4, the bit 16 of the AXI Subordinate Address (axi_s_awaddr) when set corresponds to MSG with data, and when not set, to MSG without data.
However, the driver is currently doing the opposite and due to this, the INTx is never received on the host.
So, fix the driver to reflect the documentation and also make INTx work.
--- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +-- drivers/pci/controller/cadence/pcie-cadence.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-ep.c +1 -2
@@ -354,8 +354,7 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn, u8 intx,spin_unlock_irqrestore (&ep->lock, flags); offset =CDNS_PCIE_NORMAL_MSG_ROUTING (MSG_ROUTING_LOCAL ) | -CDNS_PCIE_NORMAL_MSG_CODE (msg_code) | -CDNS_PCIE_MSG_NO_DATA ; +CDNS_PCIE_NORMAL_MSG_CODE (msg_code);writel (0 , ep->irq_cpu_addr + offset); }
drivers/pci/controller/cadence/pcie-cadence.h +1 -1
@@ -240,7 +240,7 @@ struct cdns_pcie_rp_ib_bar {#define CDNS_PCIE_NORMAL_MSG_CODE_MASK GENMASK(15, 8)#define CDNS_PCIE_NORMAL_MSG_CODE (code) \ (((code) << 8) & CDNS_PCIE_NORMAL_MSG_CODE_MASK) -#define CDNS_PCIE_MSG_NO_DATA BIT(16) +#define CDNS_PCIE_MSG_DATA BIT(16)struct cdns_pcie ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/268 PCI: brcmstb: Use internal register to change link capability
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 0c97321e11e0e9e18546f828492758f6aaecec59 ]
The driver has been mistakenly writing to a read-only (RO) configuration space register (PCI_EXP_LNKCAP) to change the PCIe link capability.
Although harmless in this case, the proper write destination is an internal register that is reflected by PCI_EXP_LNKCAP.
Thus, fix the brcm_pcie_set_gen() function to correctly update the link capability.
--- drivers/pci/controller/pcie-brcmstb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-brcmstb.c +2 -2
@@ -378,10 +378,10 @@ static int brcm_pcie_set_ssc(struct brcm_pcie *pcie)static void brcm_pcie_set_gen (struct brcm_pcie *pcie,int gen) {u16 lnkctl2 =readw (pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCTL2 ); -u32 lnkcap =readl (pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCAP ); +u32 lnkcap =readl (pcie->base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY ); lnkcap = (lnkcap & ~PCI_EXP_LNKCAP_SLS ) | gen; -writel (lnkcap, pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCAP ); +writel (lnkcap, pcie->base +PCIE_RC_CFG_PRIV1_LINK_CAPABILITY ); lnkctl2 = (lnkctl2 & ~0xf ) | gen;writew (lnkctl2, pcie->base +BRCM_PCIE_CAP_REGS +PCI_EXP_LNKCTL2 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/268 PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit 3651ad5249c51cf7eee078e12612557040a6bdb4 ]
If the regulator_bulk_get() returns an error and no regulators are created, we need to set their number to zero.
If we don't do this and the PCIe link up fails, a call to the regulator_bulk_free() will result in a kernel panic.
While at it, print the error value, as we cannot return an error upwards as the kernel will WARN() on an error from add_bus().
[kwilczynski: commit log, use comma in the message to match style with other similar messages]
--- drivers/pci/controller/pcie-brcmstb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/controller/pcie-brcmstb.c +2 -1
@@ -1132,7 +1132,8 @@ static int brcm_pcie_add_bus(struct pci_bus *bus) ret =regulator_bulk_get (dev, sr->num_supplies, sr->supplies);if (ret) { -dev_info (dev,"No regulators for downstream device\n" ); +dev_info (dev,"Did not get regulators, err=%d\n" , ret); + pcie->sr =NULL ; goto no_regulators; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/268 PCI: brcmstb: Fix potential premature regulator disabling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Quinlan <[email protected]>
[ Upstream commit b7de1b60ecab2f7b6f05d8116e93228a0bbb8563 ]
The platform supports enabling and disabling regulators only on ports below the Root Complex.
Thus, we need to verify this both when adding and removing the bus, otherwise regulators may be disabled prematurely when a bus further down the topology is removed.
--- drivers/pci/controller/pcie-brcmstb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pcie-brcmstb.c +1 -1
@@ -1156,7 +1156,7 @@ static void brcm_pcie_remove_bus(struct pci_bus *bus)struct subdev_regulators *sr = pcie->sr;struct device *dev = &bus->dev; -if (!sr) +if (!sr || !bus->parent || !pci_is_root_bus (bus->parent))return ;if (regulator_bulk_disable (sr->num_supplies, sr->supplies))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/268 PCI/portdrv: Only disable pciehp interrupts early when needed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
[ Upstream commit 9d7db4db19827380e225914618c0c1bf435ed2f5 ]
Firmware developers reported that Linux issues two PCIe hotplug commands in very short intervals on an ARM server, which doesn't comply with the PCIe spec. According to PCIe r6.1, sec 6.7.3.2, if the Command Completed event is supported, software must wait for a command to complete or wait at least 1 second before sending a new command.
In the failure case, the first PCIe hotplug command is from get_port_device_capability(), which sends a command to disable PCIe hotplug interrupts without waiting for its completion, and the second command comes from pcie_enable_notification() of pciehp driver, which enables hotplug interrupts again.
Fix this by only disabling the hotplug interrupts when the pciehp driver is not enabled.
--- drivers/pci/pcie/portdrv.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/pci/pcie/portdrv.c +5 -3
@@ -227,10 +227,12 @@ static int get_port_device_capability(struct pci_dev *dev)/* * Disable hot-plug interrupts in case they have been enabled -* by the BIOS and the hot-plug service driver is not loaded. +* by the BIOS and the hot-plug service driver won't be loaded +* to handle them. */ -pcie_capability_clear_word (dev,PCI_EXP_SLTCTL , -PCI_EXP_SLTCTL_CCIE |PCI_EXP_SLTCTL_HPIE ); +if (!IS_ENABLED (CONFIG_HOTPLUG_PCI_PCIE )) +pcie_capability_clear_word (dev,PCI_EXP_SLTCTL , +PCI_EXP_SLTCTL_CCIE |PCI_EXP_SLTCTL_HPIE ); }#ifdef CONFIG_PCIEAER
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/268 PCI: Avoid reset when disabled via sysfs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Aravamudan <[email protected]>
[ Upstream commit 479380efe1625e251008d24b2810283db60d6fcd ]
After d88f521da3ef ("PCI: Allow userspace to query and set device reset mechanism"), userspace can disable reset of specific PCI devices by writing an empty string to the sysfs reset_method file.
However, pci_slot_resettable() does not check pci_reset_supported(), which means that pci_reset_function() will still reset the device even if userspace has disabled all the reset methods.
I was able to reproduce this issue with a vfio device passed to a qemu guest, where I had disabled PCI reset via sysfs.
Add an explicit check of pci_reset_supported() in both pci_slot_resettable() and pci_bus_resettable() to ensure both the reset status and reset execution are bypassed if an administrator disables it for a device.
--- drivers/pci/pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pci/pci.c +4 -0
@@ -5714,6 +5714,8 @@ static bool pci_bus_resettable(struct pci_bus *bus)return false;list_for_each_entry (dev, &bus->devices, bus_list) { +if (!pci_reset_supported (dev)) +return false;if (dev->dev_flags &PCI_DEV_FLAGS_NO_BUS_RESET || (dev->subordinate && !pci_bus_resettable (dev->subordinate)))return false;
@@ -5790,6 +5792,8 @@ static bool pci_slot_resettable(struct pci_slot *slot)list_for_each_entry (dev, &slot->bus->devices, bus_list) {if (!dev->slot || dev->slot != slot)continue ; +if (!pci_reset_supported (dev)) +return false;if (dev->dev_flags &PCI_DEV_FLAGS_NO_BUS_RESET || (dev->subordinate && !pci_bus_resettable (dev->subordinate)))return false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/268 drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit c3c584c18c90a024a54716229809ba36424f9660 ]
There is a type mismatch between what CalculateDynamicMetadataParameters() takes and what is passed to it. Currently this function accepts several args as signed long but it's called with unsigned integers and integer. On some systems where long is 32 bits and one of these unsigned int params is greater than INT_MAX it may cause passing input params as negative values.
Fix this by changing these argument types from long to unsigned int and to int respectively. Also this will align the function's definition with similar functions in other dcn* drivers.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +6 -6
@@ -281,10 +281,10 @@ static void CalculateDynamicMetadataParameters(double DISPCLK , double DCFClkDeepSleep, double PixelClock, - long HTotal, - long VBlank, - long DynamicMetadataTransmittedBytes, - long DynamicMetadataLinesBeforeActiveRequired, + unsigned int HTotal, + unsigned int VBlank, + unsigned int DynamicMetadataTransmittedBytes, + int DynamicMetadataLinesBeforeActiveRequired, int InterlaceEnable, bool ProgressiveToInterlaceUnitInOPP, double *Tsetup,
@@ -3277,8 +3277,8 @@ static double CalculateWriteBackDelay(static void CalculateDynamicMetadataParameters (int MaxInterDCNTileRepeaters,double DPPCLK ,double DISPCLK , -double DCFClkDeepSleep,double PixelClock,long HTotal,long VBlank,long DynamicMetadataTransmittedBytes, -long DynamicMetadataLinesBeforeActiveRequired,int InterlaceEnable,bool ProgressiveToInterlaceUnitInOPP, +double DCFClkDeepSleep,double PixelClock,unsigned int HTotal,unsigned int VBlank,unsigned int DynamicMetadataTransmittedBytes, +int DynamicMetadataLinesBeforeActiveRequired,int InterlaceEnable,bool ProgressiveToInterlaceUnitInOPP,double *Tsetup,double *Tdmbf,double *Tdmec,double *Tdmsks) {double TotalRepeaterDelayTime =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/268 PCI: Remove stray put_device() in pci_register_host_bridge()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6e8d06e5096c80cbf41313b4a204f43071ca42be ]
This put_device() was accidentally left over from when we changed the code from using device_register() to calling device_add(). Delete it.
--- drivers/pci/probe.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/pci/probe.c +2 -3
@@ -927,10 +927,9 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)/* Temporarily move resources off the list */ list_splice_init (&bridge->windows, &resources); err =device_add (&bridge->dev); -if (err) { -put_device (&bridge->dev); +if (err) goto free; - } + bus->bridge =get_device (&bridge->dev);device_enable_async_suspend (bus->bridge);pci_set_bus_of_node (bus);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/268 PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thippeswamy Havalige <[email protected]>
[ Upstream commit 57b0302240741e73fe51f88404b3866e0d2933ad ]
The IRQ domain allocated for the PCIe controller is not freed if resource_list_first_type() returns NULL, leading to a resource leak.
This fix ensures properly cleaning up the allocated IRQ domain in the error path.
--- drivers/pci/controller/pcie-xilinx-cpm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/pci/controller/pcie-xilinx-cpm.c +6 -4
@@ -594,15 +594,17 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)return err; bus =resource_list_first_type (&bridge->windows,IORESOURCE_BUS ); -if (!bus) -return -ENODEV ; +if (!bus) { + err = -ENODEV ; + goto err_free_irq_domains; + } port->variant =of_device_get_match_data (dev); err =xilinx_cpm_pcie_parse_dt (port, bus->res);if (err) {dev_err (dev,"Parsing DT failed\n" ); - goto err_parse_dt; + goto err_free_irq_domains; }xilinx_cpm_pcie_init_port (port);
@@ -626,7 +628,7 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)xilinx_cpm_free_interrupts (port); err_setup_irq:pci_ecam_free (port->cfg); -err_parse_dt: +err_free_irq_domains:xilinx_cpm_free_irq_domains (port);return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/268 drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 106a6de46cf4887d535018185ec528ce822d6d84 ]
The function mtk_dp_wait_hpd_asserted() may be called before the mtk_dp->drm_dev pointer is assigned in mtk_dp_bridge_attach(). Specifically it can be called via this callpath:
- mtk_edp_wait_hpd_asserted
- [panel probe]
- dp_aux_ep_probe
Using "drm" level prints anywhere in this callpath causes a NULL pointer dereference. Change the error message directly in mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the error messages in mtk_dp_parse_capabilities(), which is called by mtk_dp_wait_hpd_asserted().
While touching these prints, also add the error code to them to make future debugging easier.
--- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +3 -3
@@ -1648,7 +1648,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) ret =drm_dp_dpcd_readb (&mtk_dp->aux,DP_MSTM_CAP , &val);if (ret <1 ) { -drm_err (mtk_dp->drm_dev,"Read mstm cap failed\n" ); +dev_err (mtk_dp->dev,"Read mstm cap failed: %zd\n" , ret);return ret ==0 ? -EIO : ret; }
@@ -1658,7 +1658,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp)DP_DEVICE_SERVICE_IRQ_VECTOR_ESI0 , &val);if (ret <1 ) { -drm_err (mtk_dp->drm_dev,"Read irq vector failed\n" ); +dev_err (mtk_dp->dev,"Read irq vector failed: %zd\n" , ret);return ret ==0 ? -EIO : ret; }
@@ -1941,7 +1941,7 @@ static int mtk_dp_wait_hpd_asserted(struct drm_dp_aux *mtk_aux, unsigned long wa ret =mtk_dp_parse_capabilities (mtk_dp);if (ret) { -drm_err (mtk_dp->drm_dev,"Can't parse capabilities\n" ); +dev_err (mtk_dp->dev,"Can't parse capabilities: %d\n" , ret);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/268 drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit dcb166ee43c3d594e7b73a24f6e8cf5663eeff2c ]
There is a type bug because the return statement:
return ret < 0 ? ret : recv_cnt;
The issue is that ret is an int, recv_cnt is a u32 and the function returns ssize_t, which is a signed long. The way that the type promotion works is that the negative error codes are first cast to u32 and then to signed long. The error codes end up being positive instead of negative and the callers treat them as success.
--- drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dsi.c +3 -3
@@ -1016,12 +1016,12 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host, const struct mipi_dsi_msg *msg) {struct mtk_dsi *dsi =host_to_dsi (host); -u32 recv_cnt, i; +ssize_t recv_cnt;u8 read_data[16 ];void *src_addr;u8 irq_flag =CMD_DONE_INT_FLAG ;u32 dsi_mode; -int ret; +int ret, i; dsi_mode =readl (dsi->regs +DSI_MODE_CTRL );if (dsi_mode &MODE ) {
@@ -1070,7 +1070,7 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,if (recv_cnt)memcpy (msg->rx_buf, src_addr, recv_cnt); -DRM_INFO ("dsi get %d byte data from the panel address(0x%x)\n" , +DRM_INFO ("dsi get %zd byte data from the panel address(0x%x)\n" , recv_cnt, *((u8 *)(msg->tx_buf))); restore_dsi_mode:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/268 drm/amd/display: avoid NPD when ASIC does not support DMUB
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit 42d9d7bed270247f134190ba0cb05bbd072f58c2 ]
ctx->dmub_srv will de NULL if the ASIC does not support DMUB, which is tested in dm_dmub_sw_init.
However, it will be dereferenced in dmub_hw_lock_mgr_cmd if should_use_dmub_lock returns true.
This has been the case since dmub support has been added for PSR1.
Fix this by checking for dmub_srv in should_use_dmub_lock.
[ 37.440832] BUG: kernel NULL pointer dereference, address: 0000000000000058 [ 37.447808] #PF: supervisor read access in kernel mode [ 37.452959] #PF: error_code(0x0000) - not-present page [ 37.458112] PGD 0 P4D 0 [ 37.460662] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI [ 37.465553] CPU: 2 UID: 1000 PID: 1745 Comm: DrmThread Not tainted 6.14.0-rc1-00003-gd62e938120f0 #23 99720e1cb1e0fc4773b8513150932a07de3c6e88 [ 37.478324] Hardware name: Google Morphius/Morphius, BIOS Google_Morphius.13434.858.0 10/26/2023 [ 37.487103] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.492074] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5 [ 37.510822] RSP: 0018:ffff969442853300 EFLAGS: 00010202 [ 37.516052] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358 [ 37.523185] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000 [ 37.530322] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5 [ 37.537453] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000 [ 37.544589] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000 [ 37.551725] FS: 0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000 [ 37.559814] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.565562] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0 [ 37.572697] Call Trace: [ 37.575152] <TASK> [ 37.577258] ? __die_body+0x66/0xb0 [ 37.580756] ? page_fault_oops+0x3e7/0x4a0 [ 37.584861] ? exc_page_fault+0x3e/0xe0 [ 37.588706] ? exc_page_fault+0x5c/0xe0 [ 37.592550] ? asm_exc_page_fault+0x22/0x30 [ 37.596742] ? dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.601107] dcn10_cursor_lock+0x1e1/0x240 [ 37.605211] program_cursor_attributes+0x81/0x190 [ 37.609923] commit_planes_for_stream+0x998/0x1ef0 [ 37.614722] update_planes_and_stream_v2+0x41e/0x5c0 [ 37.619703] dc_update_planes_and_stream+0x78/0x140 [ 37.624588] amdgpu_dm_atomic_commit_tail+0x4362/0x49f0 [ 37.629832] ? srso_return_thunk+0x5/0x5f [ 37.633847] ? mark_held_locks+0x6d/0xd0 [ 37.637774] ? _raw_spin_unlock_irq+0x24/0x50 [ 37.642135] ? srso_return_thunk+0x5/0x5f [ 37.646148] ? lockdep_hardirqs_on+0x95/0x150 [ 37.650510] ? srso_return_thunk+0x5/0x5f [ 37.654522] ? _raw_spin_unlock_irq+0x2f/0x50 [ 37.658883] ? srso_return_thunk+0x5/0x5f [ 37.662897] ? wait_for_common+0x186/0x1c0 [ 37.666998] ? srso_return_thunk+0x5/0x5f [ 37.671009] ? drm_crtc_next_vblank_start+0xc3/0x170 [ 37.675983] commit_tail+0xf5/0x1c0 [ 37.679478] drm_atomic_helper_commit+0x2a2/0x2b0 [ 37.684186] drm_atomic_commit+0xd6/0x100 [ 37.688199] ? __cfi___drm_printfn_info+0x10/0x10 [ 37.692911] drm_atomic_helper_update_plane+0xe5/0x130 [ 37.698054] drm_mode_cursor_common+0x501/0x670 [ 37.702600] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10 [ 37.707572] drm_mode_cursor_ioctl+0x48/0x70 [ 37.711851] drm_ioctl_kernel+0xf2/0x150 [ 37.715781] drm_ioctl+0x363/0x590 [ 37.719189] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10 [ 37.724165] amdgpu_drm_ioctl+0x41/0x80 [ 37.728013] __se_sys_ioctl+0x7f/0xd0 [ 37.731685] do_syscall_64+0x87/0x100 [ 37.735355] ? vma_end_read+0x12/0xe0 [ 37.739024] ? srso_return_thunk+0x5/0x5f [ 37.743041] ? find_held_lock+0x47/0xf0 [ 37.746884] ? vma_end_read+0x12/0xe0 [ 37.750552] ? srso_return_thunk+0x5/0x5f [ 37.754565] ? lock_release+0x1c4/0x2e0 [ 37.758406] ? vma_end_read+0x12/0xe0 [ 37.762079] ? exc_page_fault+0x84/0xe0 [ 37.765921] ? srso_return_thunk+0x5/0x5f [ 37.769938] ? lockdep_hardirqs_on+0x95/0x150 [ 37.774303] ? srso_return_thunk+0x5/0x5f [ 37.778317] ? exc_page_fault+0x84/0xe0 [ 37.782163] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 37.787218] RIP: 0033:0x784aa5ec3059 [ 37.790803] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1d 48 8b 45 c8 64 48 2b 04 25 28 00 0 [ 37.809553] RSP: 002b:0000784a9cdf90e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 37.817121] RAX: ffffffffffffffda RBX: 0000784a9cdf917c RCX: 0000784aa5ec3059 [ 37.824256] RDX: 0000784a9cdf917c RSI: 00000000c01c64a3 RDI: 0000000000000020 [ 37.831391] RBP: 0000784a9cdf9130 R08: 0000000000000100 R09: 0000000000ff0000 [ 37.838525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000025c01606ed0 [ 37.845657] R13: 0000025c00030200 R14: 00000000c01c64a3 R15: 0000000000000020 [ 37.852799] </TASK> [ 37.854992] Modules linked in: [ 37.864546] gsmi: Log Shutdown Reason 0x03 [ 37.868656] CR2: 0000000000000058 [ 37.871979] ---[ end trace 0000000000000000 ]--- [ 37.880976] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.885954] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5 [ 37.904703] RSP: 0018:ffff969442853300 EFLAGS: 00010202 [ 37.909933] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358 [ 37.917068] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000 [ 37.924201] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5 [ 37.931336] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000 [ 37.938469] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000 [ 37.945602] FS: 0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000 [ 37.953689] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.959435] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0 [ 37.966570] Kernel panic - not syncing: Fatal exception [ 37.971901] Kernel Offset: 0x30200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 37.982840] gsmi: Log Shutdown Reason 0x02
--- drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c +4 -0
@@ -63,6 +63,10 @@ void dmub_hw_lock_mgr_inbox0_cmd(struct dc_dmub_srv *dmub_srv,bool should_use_dmub_lock (struct dc_link *link) { +/* ASIC doesn't support DMUB */ +if (!link->ctx->dmub_srv) +return false; +if (link->psr_settings.psr_version ==DC_PSR_VERSION_SU_1 )return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/268 PCI: histb: Fix an error handling path in histb_pcie_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit b36fb50701619efca5f5450b355d42575cf532ed ]
If an error occurs after a successful phy_init() call, then phy_exit() should be called.
Add the missing call, as already done in the remove function.
[kwilczynski: remove unnecessary hipcie->phy NULL check from histb_pcie_probe() and squash a patch that removes similar NULL check for hipcie-phy from histb_pcie_remove() from
https://lore.kernel.org/linux-pci/c369b5d25e17a44984ae5a889ccc28a59a0737f7.1742058005.git.christophe.jaillet@wanadoo.fr]
--- drivers/pci/controller/dwc/pcie-histb.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/pci/controller/dwc/pcie-histb.c +8 -4
@@ -409,16 +409,21 @@ static int histb_pcie_probe(struct platform_device *pdev) ret =histb_pcie_host_enable (pp);if (ret) {dev_err (dev,"failed to enable host\n" ); -return ret; + goto err_exit_phy; } ret =dw_pcie_host_init (pp);if (ret) {dev_err (dev,"failed to initialize host\n" ); -return ret; + goto err_exit_phy; }return 0 ; + +err_exit_phy: +phy_exit (hipcie->phy); + +return ret; }static void histb_pcie_remove (struct platform_device *pdev)
@@ -427,8 +432,7 @@ static void histb_pcie_remove(struct platform_device *pdev)histb_pcie_host_disable (hipcie); -if (hipcie->phy) -phy_exit (hipcie->phy); +phy_exit (hipcie->phy); }static const struct of_device_id histb_pcie_of_match[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/268 PCI: pciehp: Dont enable HPIE when resuming in poll mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 527664f738afb6f2c58022cd35e63801e5dc7aec ]
PCIe hotplug can operate in poll mode without interrupt handlers using a polling kthread only. eb34da60edee ("PCI: pciehp: Disable hotplug interrupt during suspend") failed to consider that and enables HPIE (Hot-Plug Interrupt Enable) unconditionally when resuming the Port.
Only set HPIE if non-poll mode is in use. This makes pcie_enable_interrupt() match how pcie_enable_notification() already handles HPIE.
--- drivers/pci/hotplug/pciehp_hpc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/hotplug/pciehp_hpc.c +3 -1
@@ -839,7 +839,9 @@ void pcie_enable_interrupt(struct controller *ctrl) {u16 mask; - mask =PCI_EXP_SLTCTL_HPIE |PCI_EXP_SLTCTL_DLLSCE ; + mask =PCI_EXP_SLTCTL_DLLSCE ; +if (!pciehp_poll_mode) + mask |=PCI_EXP_SLTCTL_HPIE ;pcie_write_cmd (ctrl, mask, mask); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/268 fbdev: au1100fb: Move a variable assignment behind a null pointer check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
[ Upstream commit 2df2c0caaecfd869b49e14f2b8df822397c5dd7f ]
The address of a data structure member was determined before a corresponding null pointer check in the implementation of the function “au1100fb_setmode”.
This issue was detected by using the Coccinelle software.
--- drivers/video/fbdev/au1100fb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/au1100fb.c +3 -1
@@ -137,13 +137,15 @@ static int au1100fb_fb_blank(int blank_mode, struct fb_info *fbi)*/ int au1100fb_setmode (struct au1100fb_device *fbdev) { -struct fb_info *info = &fbdev->info; +struct fb_info *info;u32 words;int index;if (!fbdev)return -EINVAL ; + info = &fbdev->info; +/* Update var-dependent FB info */ if (panel_is_active (fbdev->panel) ||panel_is_color (fbdev->panel)) {if (info->var.bits_per_pixel <=8 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/268 mdacon: rework dependency list
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 5bbcc7645f4b244ffb5ac6563fbe9d3d42194447 ]
mdacon has roughly the same dependencies as vgacon but expresses them as a negative list instead of a positive list, with the only practical difference being PowerPC/CHRP, which uses vga16fb instead of vgacon.
The CONFIG_MDA_CONSOLE description advises to only turn it on when vgacon is also used because MDA/Hercules-only systems should be using vgacon instead, so just change the list to enforce that directly for simplicity.
The probing was broken from 2002 to 2008, this improves on the fix that was added then: If vgacon is a loadable module, then mdacon cannot be built-in now, and the list of systems that support vgacon is carried over.
--- drivers/video/console/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/console/Kconfig +1 -1
@@ -24,7 +24,7 @@ config VGA_CONSOLE Say Y. config MDA_CONSOLE - depends on !M68K && !PARISC && ISA + depends on VGA_CONSOLE && ISA tristate "MDA text console (dual-headed)" help Say Y here if you have an old MDA or monochrome Hercules graphics
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/268 fbdev: sm501fb: Add some geometry checks.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Chernetsov <[email protected]>
[ Upstream commit aee50bd88ea5fde1ff4cc021385598f81a65830c ]
Added checks for xoffset, yoffset settings. Incorrect settings of these parameters can lead to errors in sm501fb_pan_ functions.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/video/fbdev/sm501fb.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/video/fbdev/sm501fb.c +7 -0
@@ -326,6 +326,13 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var,if (var->xres_virtual >4096 || var->yres_virtual >2048 )return -EINVAL ; +/* geometry sanity checks */ +if (var->xres + var->xoffset > var->xres_virtual) +return -EINVAL ; + +if (var->yres + var->yoffset > var->yres_virtual) +return -EINVAL ; +/* can cope with 8,16 or 32bpp */ if (var->bits_per_pixel <=8 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/268 clk: amlogic: gxbb: drop incorrect flag on 32k clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit f38f7fe4830c5cb4eac138249225f119e7939965 ]
gxbb_32k_clk_div sets CLK_DIVIDER_ROUND_CLOSEST in the init_data flag which is incorrect. This is field is not where the divider flags belong.
Thankfully, CLK_DIVIDER_ROUND_CLOSEST maps to bit 4 which is an unused clock flag, so there is no unintended consequence to this error.
Effectively, the clock has been used without CLK_DIVIDER_ROUND_CLOSEST so far, so just drop it.
--- drivers/clk/meson/gxbb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/meson/gxbb.c +1 -1
@@ -1312,7 +1312,7 @@ static struct clk_regmap gxbb_32k_clk_div = { &gxbb_32k_clk_sel.hw }, .num_parents = 1, - .flags = CLK_SET_RATE_PARENT | CLK_DIVIDER_ROUND_CLOSEST, + .flags = CLK_SET_RATE_PARENT, }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/268 crypto: hisilicon/sec2 - fix for aead authsize alignment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
[ Upstream commit a49cc71e219040d771a8c1254879984f98192811 ]
The hardware only supports authentication sizes
that are 4-byte aligned. Therefore, the driver
switches to software computation in this case.
--- drivers/crypto/hisilicon/sec2/sec_crypto.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-)
drivers/crypto/hisilicon/sec2/sec_crypto.c +9 -13
@@ -57,7 +57,6 @@#define SEC_TYPE_MASK 0x0F#define SEC_DONE_MASK 0x0001#define SEC_ICV_MASK 0x000E -#define SEC_SQE_LEN_RATE_MASK 0x3#define SEC_TOTAL_IV_SZ (depth) (SEC_IV_SIZE * (depth))#define SEC_SGL_SGE_NR 128
@@ -80,16 +79,16 @@#define SEC_TOTAL_PBUF_SZ (depth) (PAGE_SIZE * SEC_PBUF_PAGE_NUM(depth) + \ SEC_PBUF_LEFT_SZ(depth)) -#define SEC_SQE_LEN_RATE 4#define SEC_SQE_CFLAG 2#define SEC_SQE_AEAD_FLAG 3#define SEC_SQE_DONE 0x1#define SEC_ICV_ERR 0x2 -#define MIN_MAC_LEN 4#define MAC_LEN_MASK 0x1U#define MAX_INPUT_DATA_LEN 0xFFFE00#define BITS_MASK 0xFF +#define WORD_MASK 0x3#define BYTE_BITS 0x8 +#define BYTES_TO_WORDS (bcount) ((bcount) >> 2)#define SEC_XTS_NAME_SZ 0x3#define IV_CM_CAL_NUM 2#define IV_CL_MASK 0x7
@@ -1179,7 +1178,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, goto bad_key; } -if (ctx->a_ctx.a_key_len &SEC_SQE_LEN_RATE_MASK ) { +if (ctx->a_ctx.a_key_len &WORD_MASK ) { ret = -EINVAL ;dev_err (dev,"AUTH key length error!\n" ); goto bad_key;
@@ -1587,11 +1586,10 @@ static void sec_auth_bd_fill_ex(struct sec_auth_ctx *ctx, int dir, sec_sqe->type2.a_key_addr =cpu_to_le64 (ctx->a_key_dma); - sec_sqe->type2.mac_key_alg =cpu_to_le32 (authsize /SEC_SQE_LEN_RATE ); + sec_sqe->type2.mac_key_alg =cpu_to_le32 (BYTES_TO_WORDS (authsize)); sec_sqe->type2.mac_key_alg |= -cpu_to_le32 ((u32)((ctx->a_key_len) / -SEC_SQE_LEN_RATE ) <<SEC_AKEY_OFFSET ); +cpu_to_le32 ((u32 )BYTES_TO_WORDS (ctx->a_key_len) <<SEC_AKEY_OFFSET ); sec_sqe->type2.mac_key_alg |=cpu_to_le32 ((u32)(ctx->a_alg) <<SEC_AEAD_ALG_OFFSET );
@@ -1643,12 +1641,10 @@ static void sec_auth_bd_fill_ex_v3(struct sec_auth_ctx *ctx, int dir, sqe3->a_key_addr =cpu_to_le64 (ctx->a_key_dma); sqe3->auth_mac_key |= -cpu_to_le32 ((u32)(authsize / -SEC_SQE_LEN_RATE ) <<SEC_MAC_OFFSET_V3 ); +cpu_to_le32 (BYTES_TO_WORDS (authsize) <<SEC_MAC_OFFSET_V3 ); sqe3->auth_mac_key |= -cpu_to_le32 ((u32)(ctx->a_key_len / -SEC_SQE_LEN_RATE ) <<SEC_AKEY_OFFSET_V3 ); +cpu_to_le32 ((u32 )BYTES_TO_WORDS (ctx->a_key_len) <<SEC_AKEY_OFFSET_V3 ); sqe3->auth_mac_key |=cpu_to_le32 ((u32)(ctx->a_alg) <<SEC_AUTH_ALG_OFFSET_V3 );
@@ -2265,8 +2261,8 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq)struct device *dev = ctx->dev;int ret; -/* Hardware does not handle cases where authsize is less than 4 bytes */ -if (unlikely (sz <MIN_MAC_LEN )) { +/* Hardware does not handle cases where authsize is not 4 bytes aligned */ +if (c_mode ==SEC_CMODE_CBC && (sz &WORD_MASK )) { sreq->aead_req.fallback = true;return -EINVAL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/268 crypto: hisilicon/sec2 - fix for sec spec check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
[ Upstream commit f4f353cb7ae9bb43e34943edb693532a39118eca ]
During encryption and decryption, user requests
must be checked first, if the specifications that
are not supported by the hardware are used, the
software computing is used for processing.
--- drivers/crypto/hisilicon/sec2/sec.h | 1 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 101 ++++++++------------- 2 files changed, 39 insertions(+), 63 deletions(-)
drivers/crypto/hisilicon/sec2/sec.h +0 -1
@@ -37,7 +37,6 @@ struct sec_aead_req {u8 *a_ivin;dma_addr_t a_ivin_dma;struct aead_request *aead_req; -bool fallback; };/* SEC request of Crypto */
drivers/crypto/hisilicon/sec2/sec_crypto.c +39 -62
221 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/268 remoteproc: core: Clear table_sz when rproc_shutdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit efdde3d73ab25cef4ff2d06783b0aad8b093c0e4 ]
There is case as below could trigger kernel dump:
Use U-Boot to start remote processor(rproc) with resource table published to a fixed address by rproc. After Kernel boots up, stop the rproc, load a new firmware which doesn't have resource table ,and start rproc.
When starting rproc with a firmware not have resource table, memcpy(loaded_table, rproc->cached_table, rproc->table_sz) will trigger dump, because rproc->cache_table is set to NULL during the last stop operation, but rproc->table_sz is still valid.
This issue is found on i.MX8MP and i.MX9.
Dump as below:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af63000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 UID: 0 PID: 1060 Comm: sh Not tainted 6.14.0-rc7-next-20250317-dirty #38 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: a0000005 (NzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __pi_memcpy_generic+0x110/0x22c lr : rproc_start+0x88/0x1e0 Call trace: __pi_memcpy_generic+0x110/0x22c (P) rproc_boot+0x198/0x57c state_store+0x40/0x104 dev_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x120/0x1cc vfs_write+0x240/0x378 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xcc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c
Clear rproc->table_sz to address the issue.
--- drivers/remoteproc/remoteproc_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/remoteproc/remoteproc_core.c +1 -0
@@ -2024,6 +2024,7 @@ int rproc_shutdown(struct rproc *rproc)kfree (rproc->cached_table); rproc->cached_table =NULL ; rproc->table_ptr =NULL ; + rproc->table_sz =0 ; out:mutex_unlock (&rproc->lock);return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/268 of: property: Increase NR_FWNODE_REFERENCE_ARGS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit eb50844d728f11e87491f7c7af15a4a737f1159d ]
Currently, the following two macros have different values:
// The maximal argument count for firmware node reference
#define NR_FWNODE_REFERENCE_ARGS 8
// The maximal argument count for DT node reference
#define MAX_PHANDLE_ARGS 16
It may cause firmware node reference's argument count out of range if directly assign DT node reference's argument count to firmware's.
drivers/of/property.c:of_fwnode_get_reference_args() is doing the direct assignment, so may cause firmware's argument count @args->nargs got out of range, namely, in [9, 16].
Fix by increasing NR_FWNODE_REFERENCE_ARGS to 16 to meet DT requirement. Will align both macros later to avoid such inconsistency.
--- include/linux/fwnode.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/fwnode.h +1 -1
@@ -83,7 +83,7 @@ struct fwnode_endpoint {#define SWNODE_GRAPH_PORT_NAME_FMT "port@%u"#define SWNODE_GRAPH_ENDPOINT_NAME_FMT "endpoint@%u" -#define NR_FWNODE_REFERENCE_ARGS 8 +#define NR_FWNODE_REFERENCE_ARGS 16/** * struct fwnode_reference_args - Fwnode reference with additional arguments
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/268 remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit e917b73234b02aa4966325e7380d2559bf127ba9 ]
Only go into the if condition for single-PD handling when there's actually just one power domain specified there. Otherwise it'll be an issue in the dts and we should fail in the regular code path.
This also mirrors the latest changes in the qcom_q6v5_mss driver.
--- drivers/remoteproc/qcom_q6v5_pas.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/remoteproc/qcom_q6v5_pas.c +5 -5
@@ -490,16 +490,16 @@ static int adsp_pds_attach(struct device *dev, struct device **devs,if (!pd_names)return 0 ; +while (pd_names[num_pds]) + num_pds++; +/* Handle single power domain */ -if (dev->pm_domain) { +if (num_pds ==1 && dev->pm_domain) { devs[0 ] = dev;pm_runtime_enable (dev);return 1 ; } -while (pd_names[num_pds]) - num_pds++; -for (i =0 ; i < num_pds; i++) { devs[i] =dev_pm_domain_attach_by_name (dev, pd_names[i]);if (IS_ERR_OR_NULL (devs[i])) {
@@ -524,7 +524,7 @@ static void adsp_pds_detach(struct qcom_adsp *adsp, struct device **pds,int i;/* Handle single power domain */ -if (dev->pm_domain && pd_count) { +if (pd_count ==1 && dev->pm_domain) {pm_runtime_disable (dev);return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/268 libbpf: Fix hypothetical STT_SECTION extern NULL deref case
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit e0525cd72b5979d8089fe524a071ea93fd011dc9 ]
Fix theoretical NULL dereference in linker when resolving *extern* STT_SECTION symbol against not-yet-existing ELF section. Not sure if it's possible in practice for valid ELF object files (this would require embedded assembly manipulations, at which point BTF will be missing), but fix the s/dst_sym/dst_sec/ typo guarding this condition anyways.
--- tools/lib/bpf/linker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/linker.c +1 -1
@@ -1974,7 +1974,7 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj, obj->sym_map[src_sym_idx] = dst_sym_idx; -if (sym_type ==STT_SECTION && dst_sym) { +if (sym_type ==STT_SECTION && dst_sec) { dst_sec->sec_sym_idx = dst_sym_idx; dst_sym->st_value =0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/268 selftests/bpf: Fix string read in strncmp benchmark
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <[email protected]>
[ Upstream commit de07b182899227d5fd1ca7a1a7d495ecd453d49c ]
The strncmp benchmark uses the bpf_strncmp helper and a hand-written loop to compare two strings. The values of the strings are filled from userspace. One of the strings is non-const (in .bss) while the other is const (in .rodata) since that is the requirement of bpf_strncmp.
The problem is that in the hand-written loop, Clang optimizes the reads from the const string to always return 0 which breaks the benchmark.
Use barrier_var to prevent the optimization.
The effect can be seen on the strncmp-no-helper variant.
Before this change:
# ./bench strncmp-no-helper
Setting up benchmark 'strncmp-no-helper'...
Benchmark 'strncmp-no-helper' started.
Iter 0 (112.309us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 1 (-23.238us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 2 ( 58.994us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 3 (-30.466us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 4 ( 29.996us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 5 ( 16.949us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 6 (-60.035us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Summary: hits 0.000 ± 0.000M/s ( 0.000M/prod), drops 0.000 ± 0.000M/s, total operations 0.000 ± 0.000M/sAfter this change:
# ./bench strncmp-no-helper
Setting up benchmark 'strncmp-no-helper'...
Benchmark 'strncmp-no-helper' started.
Iter 0 ( 77.711us): hits 5.534M/s ( 5.534M/prod), drops 0.000M/s, total operations 5.534M/s
Iter 1 ( 11.215us): hits 6.006M/s ( 6.006M/prod), drops 0.000M/s, total operations 6.006M/s
Iter 2 (-14.253us): hits 5.931M/s ( 5.931M/prod), drops 0.000M/s, total operations 5.931M/s
Iter 3 ( 59.087us): hits 6.005M/s ( 6.005M/prod), drops 0.000M/s, total operations 6.005M/s
Iter 4 (-21.379us): hits 6.010M/s ( 6.010M/prod), drops 0.000M/s, total operations 6.010M/s
Iter 5 (-20.310us): hits 5.861M/s ( 5.861M/prod), drops 0.000M/s, total operations 5.861M/s
Iter 6 ( 53.937us): hits 6.004M/s ( 6.004M/prod), drops 0.000M/s, total operations 6.004M/s
Summary: hits 5.969 ± 0.061M/s ( 5.969M/prod), drops 0.000 ± 0.000M/s, total operations 5.969 ± 0.061M/s--- tools/testing/selftests/bpf/progs/strncmp_bench.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/progs/strncmp_bench.c +4 -1
@@ -35,7 +35,10 @@ static __always_inline int local_strncmp(const char *s1, unsigned int sz, SEC("tp/syscalls/sys_enter_getpgid")int strncmp_no_helper (void *ctx) { -if (local_strncmp (str, cmp_str_len +1 , target) <0 ) +const char *target_str = target; + +barrier_var (target_str); +if (local_strncmp (str, cmp_str_len +1 , target_str) <0 )__sync_add_and_fetch (&hits,1 );return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/268 x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit dc84bc2aba85a1508f04a936f9f9a15f64ebfb31 ]
If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables.
Consequently untrack_pfn() will see VM_PAT and try obtaining the PAT information from the page table -- which fails because the page table was not copied.
The easiest fix would be to simply clear the VM_PAT flag of the dst VMA if track_pfn_copy() fails. However, the whole thing is about "simply" clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy() and performed a reservation, but copying the page tables fails, we'll simply clear the VM_PAT flag, not properly undoing the reservation ... which is also wrong.
So let's fix it properly: set the VM_PAT flag only if the reservation succeeded (leaving it clear initially), and undo the reservation if anything goes wrong while copying the page tables: clearing the VM_PAT flag after undoing the reservation.
Note that any copied page table entries will get zapped when the VMA will get removed later, after copy_page_range() succeeded; as VM_PAT is not set then, we won't try cleaning VM_PAT up once more and untrack_pfn() will be happy. Note that leaving these page tables in place without a reservation is not a problem, as we are aborting fork(); this process will never run.
A reproducer can trigger this usually at the first try:
https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c
WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110 Modules linked in: ... CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:get_pat_info+0xf6/0x110 ... Call Trace: <TASK> ... untrack_pfn+0x52/0x110 unmap_single_vma+0xa6/0xe0 unmap_vmas+0x105/0x1f0 exit_mmap+0xf6/0x460 __mmput+0x4b/0x120 copy_process+0x1bf6/0x2aa0 kernel_clone+0xab/0x440 __do_sys_clone+0x66/0x90 do_syscall_64+0x95/0x180
Likely this case was missed in:
d155df53f310 ("x86/mm/pat: clear VM_PAT if copy_p4d_range failed")
... and instead of undoing the reservation we simply cleared the VM_PAT flag.
Keep the documentation of these functions in include/linux/pgtable.h, one place is more than sufficient -- we should clean that up for the other functions like track_pfn_remap/untrack_pfn separately.
--- arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------ include/linux/pgtable.h | 28 ++++++++++++++++----- kernel/fork.c | 4 +++ mm/memory.c | 11 +++------ 4 files changed, 58 insertions(+), 37 deletions(-)
arch/x86/mm/pat/memtype.c +28 -24
@@ -982,29 +982,42 @@ static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr,return -EINVAL ; } -/* -* track_pfn_copy is called when vma that is covering the pfnmap gets -* copied through copy_page_range(). -* -* If the vma has a linear pfn mapping for the entire range, we get the prot -* from pte and reserve the entire vma range with single reserve_pfn_range call. -*/ -int track_pfn_copy (struct vm_area_struct *vma) +int track_pfn_copy (struct vm_area_struct *dst_vma, +struct vm_area_struct *src_vma,unsigned long *pfn) { +const unsigned long vma_size = src_vma->vm_end - src_vma->vm_start;resource_size_t paddr; -unsigned long vma_size = vma->vm_end - vma->vm_start;pgprot_t pgprot; +int rc; -if (vma->vm_flags &VM_PAT ) { -if (get_pat_info (vma, &paddr, &pgprot)) -return -EINVAL ; -/* reserve the whole chunk covered by vma. */ -return reserve_pfn_range (paddr, vma_size, &pgprot,1 ); - } +if (!(src_vma->vm_flags &VM_PAT )) +return 0 ; + +/* +* Duplicate the PAT information for the dst VMA based on the src +* VMA. +*/ +if (get_pat_info (src_vma, &paddr, &pgprot)) +return -EINVAL ; + rc =reserve_pfn_range (paddr, vma_size, &pgprot,1 ); +if (rc) +return rc; +/* Reservation for the destination VMA succeeded. */ +vm_flags_set (dst_vma,VM_PAT ); + *pfn =PHYS_PFN (paddr);return 0 ; } +void untrack_pfn_copy (struct vm_area_struct *dst_vma,unsigned long pfn) +{ +untrack_pfn (dst_vma, pfn, dst_vma->vm_end - dst_vma->vm_start, true); +/* +* Reservation was freed, any copied page tables will get cleaned +* up later, but without getting PAT involved again. +*/ +} +/* * prot is passed in as a parameter for the new mapping. If the vma has * a linear pfn mapping for the entire range, or no vma is provided,
@@ -1093,15 +1106,6 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn, } } -/* -* untrack_pfn_clear is called if the following situation fits: -* -* 1) while mremapping a pfnmap for a new region, with the old vma after -* its pfnmap page table has been removed. The new vma has a new pfnmap -* to the same pfn & cache type with VM_PAT set. -* 2) while duplicating vm area, the new vma fails to copy the pgtable from -* old vma. -*/ void untrack_pfn_clear (struct vm_area_struct *vma) {vm_flags_clear (vma,VM_PAT );
include/linux/pgtable.h +22 -6
@@ -1286,14 +1286,25 @@ static inline void track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot, }/* -* track_pfn_copy is called when vma that is covering the pfnmap gets -* copied through copy_page_range(). +* track_pfn_copy is called when a VM_PFNMAP VMA is about to get the page +* tables copied during copy_page_range(). On success, stores the pfn to be +* passed to untrack_pfn_copy(). */ -static inline int track_pfn_copy (struct vm_area_struct *vma) +static inline int track_pfn_copy (struct vm_area_struct *dst_vma, +struct vm_area_struct *src_vma,unsigned long *pfn) {return 0 ; } +/* +* untrack_pfn_copy is called when a VM_PFNMAP VMA failed to copy during +* copy_page_range(), but after track_pfn_copy() was already called. +*/ +static inline void untrack_pfn_copy (struct vm_area_struct *dst_vma, +unsigned long pfn) +{ +} +/* * untrack_pfn is called while unmapping a pfnmap for a region. * untrack can be called for a specific region indicated by pfn and size or
@@ -1306,8 +1317,10 @@ static inline void untrack_pfn(struct vm_area_struct *vma, }/* -* untrack_pfn_clear is called while mremapping a pfnmap for a new region -* or fails to copy pgtable during duplicate vm area. +* untrack_pfn_clear is called in the following cases on a VM_PFNMAP VMA: +* +* 1) During mremap() on the src VMA after the page tables were moved. +* 2) During fork() on the dst VMA, immediately after duplicating the src VMA. */ static inline void untrack_pfn_clear (struct vm_area_struct *vma) {
@@ -1318,7 +1331,10 @@ extern int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot, unsigned long size);extern void track_pfn_insert (struct vm_area_struct *vma,pgprot_t *prot,pfn_t pfn); -extern int track_pfn_copy (struct vm_area_struct *vma); +extern int track_pfn_copy (struct vm_area_struct *dst_vma, +struct vm_area_struct *src_vma,unsigned long *pfn); +extern void untrack_pfn_copy (struct vm_area_struct *dst_vma, +unsigned long pfn);extern void untrack_pfn (struct vm_area_struct *vma,unsigned long pfn,unsigned long size,bool mm_wr_locked);extern void untrack_pfn_clear (struct vm_area_struct *vma);
kernel/fork.c +4 -0
@@ -518,6 +518,10 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)vma_numab_state_init (new);dup_anon_vma_name (orig, new); +/* track_pfn_copy() will later take care of copying internal state. */ +if (unlikely (new->vm_flags &VM_PFNMAP )) +untrack_pfn_clear (new); +return new; }
mm/memory.c +4 -7
@@ -1268,12 +1268,12 @@ int copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) { pgd_t *src_pgd, *dst_pgd; -unsigned long next;unsigned long addr = src_vma->vm_start;unsigned long end = src_vma->vm_end;struct mm_struct *dst_mm = dst_vma->vm_mm;struct mm_struct *src_mm = src_vma->vm_mm;struct mmu_notifier_range range; +unsigned long next, pfn;bool is_cow;int ret;
@@ -1284,11 +1284,7 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)return copy_hugetlb_page_range (dst_mm, src_mm, dst_vma, src_vma);if (unlikely (src_vma->vm_flags &VM_PFNMAP )) { -/* -* We do not free on error cases below as remove_vma -* gets called on error from higher level routine -*/ - ret =track_pfn_copy (src_vma); + ret =track_pfn_copy (dst_vma, src_vma, &pfn);if (ret)return ret; }
@@ -1325,7 +1321,6 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)continue ;if (unlikely (copy_p4d_range (dst_vma, src_vma, dst_pgd, src_pgd, addr, next))) { -untrack_pfn_clear (dst_vma); ret = -ENOMEM ;break ; }
@@ -1335,6 +1330,8 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)raw_write_seqcount_end (&src_mm->write_protect_seq);mmu_notifier_invalidate_range_end (&range); } +if (ret &&unlikely (src_vma->vm_flags &VM_PFNMAP )) +untrack_pfn_copy (dst_vma, pfn);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/268 clk: samsung: Fix UBSAN panic in samsung_clk_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will McVicker <[email protected]>
[ Upstream commit d19d7345a7bcdb083b65568a11b11adffe0687af ]
With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to dereferencing ctx->clk_data.hws before setting ctx->clk_data.num = nr_clks. Move that up to fix the crash.
UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP <snip> Call trace: samsung_clk_init+0x110/0x124 (P) samsung_clk_init+0x48/0x124 (L) samsung_cmu_register_one+0x3c/0xa0 exynos_arm64_register_cmu+0x54/0x64 __gs101_cmu_top_of_clk_init_declare+0x28/0x60 ...
--- drivers/clk/samsung/clk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/samsung/clk.c +1 -1
@@ -74,12 +74,12 @@ struct samsung_clk_provider * __init samsung_clk_init(struct device *dev,if (!ctx)panic ("could not allocate clock provider context.\n" ); + ctx->clk_data.num = nr_clks;for (i =0 ; i < nr_clks; ++i) ctx->clk_data.hws[i] =ERR_PTR (-ENOENT ); ctx->dev = dev; ctx->reg_base = base; - ctx->clk_data.num = nr_clks;spin_lock_init (&ctx->lock);return ctx;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/268 clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Lypak <[email protected]>
[ Upstream commit cdc59600bccf2cb4c483645438a97d4ec55f326b ]
This clock can't be enable with VENUS_CORE0 GDSC turned off. But that GDSC is under HW control so it can be turned off at any moment. Instead of checking the dependent clock we can just vote for it to enable later when GDSC gets turned on.
--- drivers/clk/qcom/gcc-msm8953.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/gcc-msm8953.c +1 -1
@@ -3770,7 +3770,7 @@ static struct clk_branch gcc_venus0_axi_clk = {static struct clk_branch gcc_venus0_core0_vcodec0_clk = { .halt_reg =0x4c02c , - .halt_check =BRANCH_HALT , + .halt_check =BRANCH_HALT_SKIP , .clkr = { .enable_reg =0x4c02c , .enable_mask =BIT (0 ),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/268 RDMA/mana_ib: Ensure variable err is initialized
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Bakker <[email protected]>
[ Upstream commit be35a3127d60964b338da95c7bfaaf4a01b330d4 ]
In the function mana_ib_gd_create_dma_region if there are no dma blocks to process the variable err remains uninitialized.
--- drivers/infiniband/hw/mana/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mana/main.c +1 -1
@@ -327,7 +327,7 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,unsigned int tail =0 ;u64 *page_addr_list;void *request_buf; -int err; +int err =0 ; mdev = dev->gdma_dev; gc = mdev->gdma_context;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/268 remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit ba785ff4162a65f18ed501019637a998b752b5ad ]
MSM8226 requires the CX power domain, so use the msm8996_adsp_resource which has cx under proxy_pd_names and is otherwise equivalent.
--- drivers/remoteproc/qcom_q6v5_pas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/qcom_q6v5_pas.c +1 -1
@@ -1240,7 +1240,7 @@ static const struct adsp_data sm8550_mpss_resource = { };static const struct of_device_id adsp_of_match[] = { - { .compatible ="qcom,msm8226-adsp-pil" , .data = &adsp_resource_init}, + { .compatible ="qcom,msm8226-adsp-pil" , .data = &msm8996_adsp_resource}, { .compatible ="qcom,msm8953-adsp-pil" , .data = &msm8996_adsp_resource}, { .compatible ="qcom,msm8974-adsp-pil" , .data = &adsp_resource_init}, { .compatible ="qcom,msm8996-adsp-pil" , .data = &msm8996_adsp_resource},
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/268 bpf: Use preempt_count() directly in bpf_send_signal_common()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit b4a8b5bba712a711d8ca1f7d04646db63f9c88f5 ]
bpf_send_signal_common() uses preemptible() to check whether or not the current context is preemptible. If it is preemptible, it will use irq_work to send the signal asynchronously instead of trying to hold a spin-lock, because spin-lock is sleepable under PREEMPT_RT.
However, preemptible() depends on CONFIG_PREEMPT_COUNT. When CONFIG_PREEMPT_COUNT is turned off (e.g., CONFIG_PREEMPT_VOLUNTARY=y), !preemptible() will be evaluated as 1 and bpf_send_signal_common() will use irq_work unconditionally.
Fix it by unfolding "!preemptible()" and using "preempt_count() != 0 || irqs_disabled()" instead.
--- kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/bpf_trace.c +1 -1
@@ -853,7 +853,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type)if (unlikely (is_global_init (current)))return -EPERM ; -if (!preemptible ()) { +if (preempt_count () !=0 ||irqs_disabled ()) {/* Do an early check on signal validity. Otherwise, * the error is lost in deferred irq_work. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/268 lib: 842: Improve error handling in sw842_compress()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanya Agarwal <[email protected]>
[ Upstream commit af324dc0e2b558678aec42260cce38be16cc77ca ]
The static code analysis tool "Coverity Scan" pointed the following implementation details out for further development considerations:
CID 1309755: Unused value
In sw842_compress: A value assigned to a variable is never used. (CWE-563)returned_value: Assigning value from add_repeat_template(p, repeat_count) to ret here, but that stored value is overwritten before it can be used.
Conclusion:
Add error handling for the return value from an add_repeat_template() call.
--- lib/842/842_compress.c | 2 ++ 1 file changed, 2 insertions(+)
lib/842/842_compress.c +2 -0
@@ -532,6 +532,8 @@ int sw842_compress(const u8 *in, unsigned int ilen, }if (repeat_count) { ret =add_repeat_template (p, repeat_count); +if (ret) +return ret; repeat_count =0 ;if (next == last)/* reached max repeat bits */ goto repeat;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/268 pinctrl: renesas: rza2: Fix missing of_node_put() call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrizio Castro <[email protected]>
[ Upstream commit abcdeb4e299a11ecb5a3ea0cce00e68e8f540375 ]
of_parse_phandle_with_fixed_args() requires its caller to call into of_node_put() on the node pointer from the output structure, but such a call is currently missing.
Call into of_node_put() to rectify that.
--- drivers/pinctrl/renesas/pinctrl-rza2.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/renesas/pinctrl-rza2.c +2 -0
@@ -253,6 +253,8 @@ static int rza2_gpio_register(struct rza2_pinctrl_priv *priv)return ret; } +of_node_put (of_args.np); +if ((of_args.args[0 ] !=0 ) || (of_args.args[1 ] !=0 ) || (of_args.args[2 ] != priv->npins)) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/268 pinctrl: renesas: rzg2l: Fix missing of_node_put() call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrizio Castro <[email protected]>
[ Upstream commit a5779e625e2b377f16a6675c432aaf299ce5028c ]
of_parse_phandle_with_fixed_args() requires its caller to call into of_node_put() on the node pointer from the output structure, but such a call is currently missing.
Call into of_node_put() to rectify that.
--- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/renesas/pinctrl-rzg2l.c +2 -0
@@ -1367,6 +1367,8 @@ static int rzg2l_gpio_register(struct rzg2l_pinctrl *pctrl)return ret; } +of_node_put (of_args.np); +if (of_args.args[0 ] !=0 || of_args.args[1 ] !=0 || of_args.args[2 ] != pctrl->data->n_port_pins) {dev_err (pctrl->dev,"gpio-ranges does not match selected SOC\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/268 clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Geis <[email protected]>
[ Upstream commit a9e60f1ffe1ca57d6af6a2573e2f950e76efbf5b ]
Correct the clk_ref_usb3otg parent to fix clock control for the usb3 controller on rk3328. Verified against the rk3328 trm, the rk3228h trm, and the rk3328 usb3 phy clock map.
--- drivers/clk/rockchip/clk-rk3328.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3328.c +1 -1
@@ -201,7 +201,7 @@ PNAME(mux_aclk_peri_pre_p) = { "cpll_peri","gpll_peri" , "hdmiphy_peri" };PNAME (mux_ref_usb3otg_src_p) = {"xin24m" , -"clk_usb3otg_ref" }; +"clk_ref_usb3otg_src" };PNAME (mux_xin24m_32k_p) = {"xin24m" ,"clk_rtc32k" }; PNAME(mux_mac2io_src_p) = { "clk_mac2io_src",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/268 RDMA/core: Dont expose hw_counters outside of init net namespace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Gushchin <[email protected]>
[ Upstream commit a1ecb30f90856b0be4168ad51b8875148e285c1f ]
Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to non-init net namespaces. It didn't expose them fully, as an attempt to read any of those counters leads to a crash like this one:
[42021.807566] BUG: kernel NULL pointer dereference, address: 0000000000000028 [42021.814463] #PF: supervisor read access in kernel mode [42021.819549] #PF: error_code(0x0000) - not-present page [42021.824636] PGD 0 P4D 0 [42021.827145] Oops: 0000 [#1] SMP PTI [42021.830598] CPU: 82 PID: 2843922 Comm: switchto-defaul Kdump: loaded Tainted: G S W I XXX [42021.841697] Hardware name: XXX [42021.849619] RIP: 0010:hw_stat_device_show+0x1e/0x40 [ib_core] [42021.855362] Code: 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 49 89 d0 4c 8b 5e 20 48 8b 8f b8 04 00 00 48 81 c7 f0 fa ff ff <48> 8b 41 28 48 29 ce 48 83 c6 d0 48 c1 ee 04 69 d6 ab aa aa aa 48 [42021.873931] RSP: 0018:ffff97fe90f03da0 EFLAGS: 00010287 [42021.879108] RAX: ffff9406988a8c60 RBX: ffff940e1072d438 RCX: 0000000000000000 [42021.886169] RDX: ffff94085f1aa000 RSI: ffff93c6cbbdbcb0 RDI: ffff940c7517aef0 [42021.893230] RBP: ffff97fe90f03e70 R08: ffff94085f1aa000 R09: 0000000000000000 [42021.900294] R10: ffff94085f1aa000 R11: ffffffffc0775680 R12: ffffffff87ca2530 [42021.907355] R13: ffff940651602840 R14: ffff93c6cbbdbcb0 R15: ffff94085f1aa000 [42021.914418] FS: 00007fda1a3b9700(0000) GS:ffff94453fb80000(0000) knlGS:0000000000000000 [42021.922423] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [42021.928130] CR2: 0000000000000028 CR3: 00000042dcfb8003 CR4: 00000000003726f0 [42021.935194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [42021.942257] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [42021.949324] Call Trace: [42021.951756] <TASK> [42021.953842] [<ffffffff86c58674>] ? show_regs+0x64/0x70 [42021.959030] [<ffffffff86c58468>] ? __die+0x78/0xc0 [42021.963874] [<ffffffff86c9ef75>] ? page_fault_oops+0x2b5/0x3b0 [42021.969749] [<ffffffff87674b92>] ? exc_page_fault+0x1a2/0x3c0 [42021.975549] [<ffffffff87801326>] ? asm_exc_page_fault+0x26/0x30 [42021.981517] [<ffffffffc0775680>] ? __pfx_show_hw_stats+0x10/0x10 [ib_core] [42021.988482] [<ffffffffc077564e>] ? hw_stat_device_show+0x1e/0x40 [ib_core] [42021.995438] [<ffffffff86ac7f8e>] dev_attr_show+0x1e/0x50 [42022.000803] [<ffffffff86a3eeb1>] sysfs_kf_seq_show+0x81/0xe0 [42022.006508] [<ffffffff86a11134>] seq_read_iter+0xf4/0x410 [42022.011954] [<ffffffff869f4b2e>] vfs_read+0x16e/0x2f0 [42022.017058] [<ffffffff869f50ee>] ksys_read+0x6e/0xe0 [42022.022073] [<ffffffff8766f1ca>] do_syscall_64+0x6a/0xa0 [42022.027441] [<ffffffff8780013b>] entry_SYSCALL_64_after_hwframe+0x78/0xe2
The problem can be reproduced using the following steps:
ip netns add foo
ip netns exec foo bash
cat /sys/class/infiniband/mlx4_0/hw_counters/*
The panic occurs because of casting the device pointer into an ib_device pointer using container_of() in hw_stat_device_show() is wrong and leads to a memory corruption.
However the real problem is that hw counters should never been exposed outside of the non-init net namespace.
Fix this by saving the index of the corresponding attribute group (it might be 1 or 2 depending on the presence of driver-specific attributes) and zeroing the pointer to hw_counters group for compat devices during the initialization.
With this fix applied hw_counters are not available in a non-init net namespace:
find /sys/class/infiniband/mlx4_0/ -name hw_counters
/sys/class/infiniband/mlx4_0/ports/1/hw_counters /sys/class/infiniband/mlx4_0/ports/2/hw_counters /sys/class/infiniband/mlx4_0/hw_counters
ip netns add foo
ip netns exec foo bash
find /sys/class/infiniband/mlx4_0/ -name hw_counters
--- drivers/infiniband/core/device.c | 9 +++++++++ drivers/infiniband/core/sysfs.c | 1 + include/rdma/ib_verbs.h | 1 + 3 files changed, 11 insertions(+)
drivers/infiniband/core/device.c +9 -0
@@ -543,6 +543,8 @@ static struct class ib_class = {static void rdma_init_coredev (struct ib_core_device *coredev,struct ib_device *dev,struct net *net) { +bool is_full_dev = &dev->coredev == coredev; +/* This BUILD_BUG_ON is intended to catch layout change * of union of ib_core_device and device. * dev must be the first element as ib_core and providers
@@ -554,6 +556,13 @@ static void rdma_init_coredev(struct ib_core_device *coredev, coredev->dev.class = &ib_class; coredev->dev.groups = dev->groups; + +/* +* Don't expose hw counters outside of the init namespace. +*/ +if (!is_full_dev && dev->hw_stats_attr_index) + coredev->dev.groups[dev->hw_stats_attr_index] =NULL ; +device_initialize (&coredev->dev); coredev->owner = dev;INIT_LIST_HEAD (&coredev->port_list);
drivers/infiniband/core/sysfs.c +1 -0
@@ -988,6 +988,7 @@ int ib_setup_device_attrs(struct ib_device *ibdev)for (i =0 ; i !=ARRAY_SIZE (ibdev->groups); i++)if (!ibdev->groups[i]) { ibdev->groups[i] = &data->group; + ibdev->hw_stats_attr_index = i;return 0 ; }WARN (true,"struct ib_device->groups is too small" );
include/rdma/ib_verbs.h +1 -0
@@ -2738,6 +2738,7 @@ struct ib_device {* It is a NULL terminated array. */ const struct attribute_group *groups[4 ]; +u8 hw_stats_attr_index;u64 uverbs_cmd_mask;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/268 RDMA/mlx5: Fix calculation of total invalidated pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chiara Meiohas <[email protected]>
[ Upstream commit 79195147644653ebffadece31a42181e4c48c07d ]
When invalidating an address range in mlx5, there is an optimization to do UMR operations in chunks.
Previously, the invalidation counter was incorrectly updated for the same indexes within a chunk. Now, the invalidation counter is updated only when a chunk is complete and mlx5r_umr_update_xlt() is called. This ensures that the counter accurately represents the number of pages invalidated using UMR.
--- drivers/infiniband/hw/mlx5/odp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/infiniband/hw/mlx5/odp.c +6 -4
@@ -274,9 +274,6 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni, blk_start_idx = idx; in_block =1 ; } - -/* Count page invalidations */ - invalidations += idx - blk_start_idx +1 ; }else {u64 umr_offset = idx & umr_block_mask;
@@ -286,14 +283,19 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni,MLX5_IB_UPD_XLT_ZAP | MLX5_IB_UPD_XLT_ATOMIC); in_block =0 ; +/* Count page invalidations */ + invalidations += idx - blk_start_idx +1 ; } } } -if (in_block) +if (in_block) {mlx5r_umr_update_xlt (mr, blk_start_idx, idx - blk_start_idx +1 ,0 ,MLX5_IB_UPD_XLT_ZAP |MLX5_IB_UPD_XLT_ATOMIC ); +/* Count page invalidations */ + invalidations += idx - blk_start_idx +1 ; + }mlx5_update_odp_stats (mr, invalidations, invalidations);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/268 RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Xu <[email protected]>
[ Upstream commit 83437689249e6a17b25e27712fbee292e42e7855 ]
After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix this issue.
--- drivers/infiniband/hw/erdma/erdma_cm.c | 1 - 1 file changed, 1 deletion(-)
drivers/infiniband/hw/erdma/erdma_cm.c +0 -1
@@ -705,7 +705,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep)erdma_cancel_mpatimer (new_cep);erdma_cep_put (new_cep); - new_cep->sock =NULL ; }if (new_s) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/268 remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit 4641840341f37dc8231e0840ec1514b4061b4322 ]
For example MSM8974 has mx voltage rail exposed as regulator and only cx voltage rail is exposed as power domain. This power domain (cx) is attached internally in power domain and cannot be attached in this driver.
--- drivers/remoteproc/qcom_q6v5_mss.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/remoteproc/qcom_q6v5_mss.c +17 -4
@@ -1838,6 +1838,13 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs,while (pd_names[num_pds]) num_pds++; +/* Handle single power domain */ +if (num_pds ==1 && dev->pm_domain) { + devs[0 ] = dev; +pm_runtime_enable (dev); +return 1 ; + } +for (i =0 ; i < num_pds; i++) { devs[i] =dev_pm_domain_attach_by_name (dev, pd_names[i]);if (IS_ERR_OR_NULL (devs[i])) {
@@ -1858,8 +1865,15 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs,static void q6v5_pds_detach (struct q6v5 *qproc,struct device **pds,size_t pd_count) { +struct device *dev = qproc->dev;int i; +/* Handle single power domain */ +if (pd_count ==1 && dev->pm_domain) { +pm_runtime_disable (dev); +return ; + } +for (i =0 ; i < pd_count; i++)dev_pm_domain_detach (pds[i], false); }
@@ -2471,13 +2485,13 @@ static const struct rproc_hexagon_res msm8974_mss = { .supply = "pll", .uA = 100000, }, - {} - }, - .fallback_proxy_supply = (struct qcom_mss_reg_res[]) { { .supply = "mx", .uV = 1050000, }, + {} + }, + .fallback_proxy_supply = (struct qcom_mss_reg_res[]) { { .supply ="cx" , .uA =100000 ,
@@ -2503,7 +2517,6 @@ static const struct rproc_hexagon_res msm8974_mss = {NULL }, .proxy_pd_names = (char *[]){ -"mx" ,"cx" ,NULL },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/268 IB/mad: Check available slots before posting receive WRs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <[email protected]>
[ Upstream commit 37826f0a8c2f6b6add5179003b8597e32a445362 ]
The ib_post_receive_mads() function handles posting receive work requests (WRs) to MAD QPs and is called in two cases:
1) When a MAD port is opened.
2) When a receive WQE is consumed upon receiving a new MAD.
Whereas, if MADs arrive during the port open phase, a race condition might cause an extra WR to be posted, exceeding the QP’s capacity. This leads to failures such as:
infiniband mlx5_0: ib_post_recv failed: -12
infiniband mlx5_0: Couldn't post receive WRs
infiniband mlx5_0: Couldn't start port
infiniband mlx5_0: Couldn't open port 1
Fix this by checking the current receive count before posting a new WR. If the QP’s receive queue is full, do not post additional WRs.
--- drivers/infiniband/core/mad.c | 38 ++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 18 deletions(-)
drivers/infiniband/core/mad.c +20 -18
@@ -2671,11 +2671,11 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, struct ib_mad_private *mad) {unsigned long flags; -int post, ret;struct ib_mad_private *mad_priv;struct ib_sge sg_list;struct ib_recv_wr recv_wr;struct ib_mad_queue *recv_queue = &qp_info->recv_queue; +int ret =0 ;/* Initialize common scatter list fields */ sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
@@ -2685,7 +2685,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, recv_wr.sg_list = &sg_list; recv_wr.num_sge =1 ; - do { +while (true) {/* Allocate and map receive buffer */ if (mad) { mad_priv = mad;
@@ -2693,10 +2693,8 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, }else { mad_priv =alloc_mad_private (port_mad_size (qp_info->port_priv),GFP_ATOMIC ); -if (!mad_priv) { - ret = -ENOMEM ; -break ; - } +if (!mad_priv) +return -ENOMEM ; } sg_list.length =mad_priv_dma_size (mad_priv); sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
@@ -2705,37 +2703,41 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, DMA_FROM_DEVICE);if (unlikely (ib_dma_mapping_error (qp_info->port_priv->device, sg_list.addr))) { -kfree (mad_priv); ret = -ENOMEM ; -break ; + goto free_mad_priv; } mad_priv->header.mapping = sg_list.addr; mad_priv->header.mad_list.mad_queue = recv_queue; mad_priv->header.mad_list.cqe.done = ib_mad_recv_done; recv_wr.wr_cqe = &mad_priv->header.mad_list.cqe; - -/* Post receive WR */ spin_lock_irqsave (&recv_queue->lock, flags); - post = (++recv_queue->count < recv_queue->max_active); -list_add_tail (&mad_priv->header.mad_list.list, &recv_queue->list); +if (recv_queue->count >= recv_queue->max_active) { +/* Fully populated the receive queue */ +spin_unlock_irqrestore (&recv_queue->lock, flags); +break ; + } + recv_queue->count++; +list_add_tail (&mad_priv->header.mad_list.list, + &recv_queue->list);spin_unlock_irqrestore (&recv_queue->lock, flags); + ret =ib_post_recv (qp_info->qp, &recv_wr,NULL );if (ret) {spin_lock_irqsave (&recv_queue->lock, flags);list_del (&mad_priv->header.mad_list.list); recv_queue->count--;spin_unlock_irqrestore (&recv_queue->lock, flags); -ib_dma_unmap_single (qp_info->port_priv->device, - mad_priv->header.mapping, -mad_priv_dma_size (mad_priv), -DMA_FROM_DEVICE ); -kfree (mad_priv);dev_err (&qp_info->port_priv->device->dev,"ib_post_recv failed: %d\n" , ret);break ; } - }while (post); + } +ib_dma_unmap_single (qp_info->port_priv->device, + mad_priv->header.mapping, +mad_priv_dma_size (mad_priv),DMA_FROM_DEVICE ); +free_mad_priv: +kfree (mad_priv);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/268 pinctrl: tegra: Set SFIO mode to Mux Register
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prathamesh Shete <[email protected]>
[ Upstream commit 17013f0acb322e5052ff9b9d0fab0ab5a4bfd828 ]
Tegra devices have an 'sfsel' bit field that determines whether a pin operates in SFIO (Special Function I/O) or GPIO mode. Currently, tegra_pinctrl_gpio_disable_free() sets this bit when releasing a GPIO.
However, tegra_pinctrl_set_mux() can be called independently in certain code paths where gpio_disable_free() is not invoked. In such cases, failing to set the SFIO mode could lead to incorrect pin configurations, resulting in functional issues for peripherals relying on SFIO.
This patch ensures that whenever set_mux() is called, the SFIO mode is correctly set in the Mux Register if the 'sfsel' bit is present. This prevents situations where the pin remains in GPIO mode despite being configured for SFIO use.
--- drivers/pinctrl/tegra/pinctrl-tegra.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pinctrl/tegra/pinctrl-tegra.c +3 -0
@@ -272,6 +272,9 @@ static int tegra_pinctrl_set_mux(struct pinctrl_dev *pctldev, val =pmx_readl (pmx, g->mux_bank, g->mux_reg); val &= ~(0x3 << g->mux_bit); val |= i << g->mux_bit; +/* Set the SFIO/GPIO selection to SFIO when under pinmux control*/ +if (pmx->soc->sfsel_in_mux) + val |= (1 << g->sfsel_bit);pmx_writel (pmx, val, g->mux_bank, g->mux_reg);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/268 clk: amlogic: g12b: fix cluster A parent data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 8995f8f108c3ac5ad52b12a6cfbbc7b3b32e9a58 ]
Several clocks used by both g12a and g12b use the g12a cpu A clock hw pointer as clock parent. This is incorrect on g12b since the parents of cluster A cpu clock are different. Also the hw clock provided as parent to these children is not even registered clock on g12b.
Fix the problem by reverting to the global namespace and let CCF pick the appropriate, as it is already done for other clocks, such as cpu_clk_trace_div.
--- drivers/clk/meson/g12a.c | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-)
drivers/clk/meson/g12a.c +24 -12
@@ -1138,8 +1138,18 @@ static struct clk_regmap g12a_cpu_clk_div16_en = { .hw.init = &(struct clk_init_data) { .name ="cpu_clk_div16_en" , .ops = &clk_regmap_gate_ro_ops, - .parent_hws = (const struct clk_hw *[]) { - &g12a_cpu_clk.hw + .parent_data = &(const struct clk_parent_data ) { +/* +* Note: +* G12A and G12B have different cpu clocks (with +* different struct clk_hw). We fallback to the global +* naming string mechanism so this clock picks +* up the appropriate one. Same goes for the other +* clock using cpu cluster A clock output and present +* on both G12 variant. +*/ + .name ="cpu_clk" , + .index =-1 , }, .num_parents =1 ,/*
@@ -1204,7 +1214,10 @@ static struct clk_regmap g12a_cpu_clk_apb_div = { .hw.init = &(struct clk_init_data){ .name ="cpu_clk_apb_div" , .ops = &clk_regmap_divider_ro_ops, - .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, + .parent_data = &(const struct clk_parent_data ) { + .name ="cpu_clk" , + .index =-1 , + }, .num_parents =1 , }, };
@@ -1238,7 +1251,10 @@ static struct clk_regmap g12a_cpu_clk_atb_div = { .hw.init = &(struct clk_init_data){ .name ="cpu_clk_atb_div" , .ops = &clk_regmap_divider_ro_ops, - .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, + .parent_data = &(const struct clk_parent_data ) { + .name ="cpu_clk" , + .index =-1 , + }, .num_parents =1 , }, };
@@ -1272,7 +1288,10 @@ static struct clk_regmap g12a_cpu_clk_axi_div = { .hw.init = &(struct clk_init_data){ .name ="cpu_clk_axi_div" , .ops = &clk_regmap_divider_ro_ops, - .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, + .parent_data = &(const struct clk_parent_data ) { + .name ="cpu_clk" , + .index =-1 , + }, .num_parents =1 , }, };
@@ -1307,13 +1326,6 @@ static struct clk_regmap g12a_cpu_clk_trace_div = { .name = "cpu_clk_trace_div", .ops = &clk_regmap_divider_ro_ops, .parent_data = &(const struct clk_parent_data ) { -/* -* Note: -* G12A and G12B have different cpu_clks (with -* different struct clk_hw). We fallback to the global -* naming string mechanism so cpu_clk_trace_div picks -* up the appropriate one. -*/ .name ="cpu_clk" , .index =-1 , },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/268 clk: amlogic: gxbb: drop non existing 32k clock parent
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 7915d7d5407c026fa9343befb4d3343f7a345f97 ]
The 32k clock reference a parent 'cts_slow_oscin' with a fixme note saying that this clock should be provided by AO controller.
The HW probably has this clock but it does not exist at the moment in any controller implementation. Furthermore, referencing clock by the global name should be avoided whenever possible.
There is no reason to keep this hack around, at least for now.
--- drivers/clk/meson/gxbb.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/clk/meson/gxbb.c +6 -6
@@ -1272,14 +1272,13 @@ static struct clk_regmap gxbb_cts_i958 = { }, }; +/* +* This table skips a clock named 'cts_slow_oscin' in the documentation +* This clock does not exist yet in this controller or the AO one +*/ +static u32 gxbb_32k_clk_parents_val_table[] = {0 ,2 ,3 };static const struct clk_parent_data gxbb_32k_clk_parent_data[] = { { .fw_name ="xtal" , }, -/* -* FIXME: This clock is provided by the ao clock controller but the -* clock is not yet part of the binding of this controller, so string -* name must be use to set this parent. -*/ - { .name ="cts_slow_oscin" , .index =-1 }, { .hw = &gxbb_fclk_div3.hw }, { .hw = &gxbb_fclk_div5.hw }, };
@@ -1289,6 +1288,7 @@ static struct clk_regmap gxbb_32k_clk_sel = { .offset = HHI_32K_CLK_CNTL, .mask = 0x3, .shift = 16, + .table = gxbb_32k_clk_parents_val_table, }, .hw.init = &(struct clk_init_data ){ .name ="32k_clk_sel" ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/268 selftests/bpf: Select NUMA_NO_NODE to create map
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saket Kumar Bhaskar <[email protected]>
[ Upstream commit 4107a1aeb20ed4cdad6a0d49de92ea0f933c71b7 ]
On powerpc, a CPU does not necessarily originate from NUMA node 0. This contrasts with architectures like x86, where CPU 0 is not hot-pluggable, making NUMA node 0 a consistently valid node. This discrepancy can lead to failures when creating a map on NUMA node 0, which is initialized by default, if no CPUs are allocated from NUMA node 0.
This patch fixes the issue by setting NUMA_NO_NODE (-1) for map creation for this selftest.
--- tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c +5 -0
@@ -6,6 +6,10 @@#include <test_progs.h> #include "bloom_filter_map.skel.h" +#ifndef NUMA_NO_NODE +#define NUMA_NO_NODE (-1) +#endif +static void test_fail_cases (void ) {LIBBPF_OPTS (bpf_map_create_opts, opts);
@@ -69,6 +73,7 @@ static void test_success_cases(void)/* Create a map */ opts.map_flags =BPF_F_ZERO_SEED |BPF_F_NUMA_NODE ; + opts.numa_node =NUMA_NO_NODE ; fd =bpf_map_create (BPF_MAP_TYPE_BLOOM_FILTER ,NULL ,0 ,sizeof (value),100 , &opts);if (!ASSERT_GE (fd,0 ,"bpf_map_create bloom filter success case" ))return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/268 rust: fix signature of rust_fmt_argument
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
[ Upstream commit 901b3290bd4dc35e613d13abd03c129e754dd3dd ]
Without this change, the rest of this series will emit the following error message:
error[E0308]: if and else have incompatible types
--> <linux>/rust/kernel/print.rs:22:22
|
21 | #[export]
| --------- expected because of this
22 | unsafe extern "C" fn rust_fmt_argument(
| ^^^^^^^^^^^^^^^^^ expected `u8`, found `i8`
|
= note: expected fn item `unsafe extern "C" fn(*mut u8, *mut u8, *mut c_void) -> *mut u8 {bindings::rust_fmt_argument}`
found fn item `unsafe extern "C" fn(*mut i8, *mut i8, *const c_void) -> *mut i8 {print::rust_fmt_argument}`The error may be different depending on the architecture.
To fix this, change the void pointer argument to use a const pointer, and change the imports to use crate::ffi instead of core::ffi for integer types.
--- lib/vsprintf.c | 2 +- rust/kernel/print.rs | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-)
lib/vsprintf.c +1 -1
@@ -2275,7 +2275,7 @@ int __init no_hash_pointers_enable(char *str)early_param ("no_hash_pointers" , no_hash_pointers_enable);/* Used for Rust formatting ('%pA'). */ -char *rust_fmt_argument (char *buf,char *end,void *ptr); +char *rust_fmt_argument (char *buf,char *end,const void *ptr);/* * Show a '%p' thing. A kernel extension is that the '%p' is followed
rust/kernel/print.rs +3 -4
@@ -6,12 +6,11 @@//! //! Reference: <https://www.kernel.org/doc/html/latest/core-api/printk-basics.html> -use core::{ +use crate ::{ ffi::{c_char, c_void}, - fmt, + str::RawFormatter , }; - -use crate ::str::RawFormatter ; +use core::fmt;#[cfg( CONFIG_PRINTK )] use crate ::bindings;
Signature · 1 line
2.39.5
Re: [PATCH 6.6 089/268] rust: fix signature of rust_fmt_argument
Quoted 38 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
[ Upstream commit
901b3290bd4dc35e613d13abd03c129e754dd3dd]Without this change, the rest of this series will emit the following error message:
error[E0308]:
ifandelsehave incompatible types
--> <linux>/rust/kernel/print.rs:22:22| 21 | #[export] | --------- expected because of this 22 | unsafe extern "C" fn rust_fmt_argument( | ^^^^^^^^^^^^^^^^^ expected `u8`, found `i8` | = note: expected fn item `unsafe extern "C" fn(*mut u8, *mut u8, *mut c_void) -> *mut u8 {bindings::rust_fmt_argument}` found fn item `unsafe extern "C" fn(*mut i8, *mut i8, *const c_void) -> *mut i8 {print::rust_fmt_argument}`The error may be different depending on the architecture.
To fix this, change the void pointer argument to use a const pointer, and change the imports to use
crate::ffiinstead ofcore::ffifor integer types.Fixes 787983da7718 ("vsprintf: add new `%pA` format specifier")Reviewed-by Tamir Duberstein <[email protected]>Signed-off-by Alice Ryhl <[email protected]>Acked-by Petr Mladek <[email protected]>Signed-off-by Miguel Ojeda <[email protected]>Signed-off-by Sasha Levin <[email protected]>
rust/kernel/print.rs line 10
Quoted 3 lines
rust/kernel/print.rs +1
-1-use core::{ +use crate ::{ ffi::{c_char, c_void},
I don't think crate::ffi exists on 6.6, so I would think that this does not compile.
Alice
Re: [PATCH 6.6 089/268] rust: fix signature of rust_fmt_argument
Quoted 41 lines · Alice Ryhl
Quoted 37 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
[ Upstream commit
901b3290bd4dc35e613d13abd03c129e754dd3dd]Without this change, the rest of this series will emit the following error message:
error[E0308]:
ifandelsehave incompatible types
--> <linux>/rust/kernel/print.rs:22:22| 21 | #[export] | --------- expected because of this 22 | unsafe extern "C" fn rust_fmt_argument( | ^^^^^^^^^^^^^^^^^ expected `u8`, found `i8` | = note: expected fn item `unsafe extern "C" fn(*mut u8, *mut u8, *mut c_void) -> *mut u8 {bindings::rust_fmt_argument}` found fn item `unsafe extern "C" fn(*mut i8, *mut i8, *const c_void) -> *mut i8 {print::rust_fmt_argument}`The error may be different depending on the architecture.
To fix this, change the void pointer argument to use a const pointer, and change the imports to use
crate::ffiinstead ofcore::ffifor integer types.Fixes 787983da7718 ("vsprintf: add new `%pA` format specifier")Reviewed-by Tamir Duberstein <[email protected]>Signed-off-by Alice Ryhl <[email protected]>Acked-by Petr Mladek <[email protected]>Signed-off-by Miguel Ojeda <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Quoted 6 lines
rust/kernel/print.rs line 10
Quoted 3 lines
rust/kernel/print.rs +1
-1-use core::{ +use crate ::{ ffi::{c_char, c_void},I don't think
crate::ffiexists on 6.6, so I would think that this does not compile.
We probably need to change rust_fmt_argument to use *mut u8 instead of *mut c_char` to fix this. Let me know if you want a patch for this.
Alice
Greg Kroah-Hartman
maintainerPATCH 90/268 clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurentiu Mihalcea <[email protected]>
[ Upstream commit 91be7d27099dedf813b80702e4ca117d1fb38ce6 ]
The DSP and OCRAM_A modules from AUDIOMIX are clocked by AUDIO_AXI_CLK_ROOT, not AUDIO_AHB_CLK_ROOT. Update the clock data accordingly.
--- drivers/clk/imx/clk-imx8mp-audiomix.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clk/imx/clk-imx8mp-audiomix.c +3 -3
@@ -170,14 +170,14 @@ static struct clk_imx8mp_audiomix_sel sels[] = {CLK_GATE ("asrc" ,ASRC_IPG ),CLK_GATE ("pdm" ,PDM_IPG ),CLK_GATE ("earc" ,EARC_IPG ), -CLK_GATE ("ocrama" ,OCRAMA_IPG ), +CLK_GATE_PARENT ("ocrama" ,OCRAMA_IPG ,"axi" ),CLK_GATE ("aud2htx" ,AUD2HTX_IPG ),CLK_GATE_PARENT ("earc_phy" ,EARC_PHY ,"sai_pll_out_div2" ),CLK_GATE ("sdma2" ,SDMA2_ROOT ),CLK_GATE ("sdma3" ,SDMA3_ROOT ),CLK_GATE ("spba2" ,SPBA2_ROOT ), -CLK_GATE ("dsp" ,DSP_ROOT ), -CLK_GATE ("dspdbg" ,DSPDBG_ROOT ), +CLK_GATE_PARENT ("dsp" ,DSP_ROOT ,"axi" ), +CLK_GATE_PARENT ("dspdbg" ,DSPDBG_ROOT ,"axi" ),CLK_GATE ("edma" ,EDMA_ROOT ),CLK_GATE_PARENT ("audpll" ,AUDPLL_ROOT ,"osc_24m" ), CLK_GATE("mu2", MU2_ROOT),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/268 clk: amlogic: g12a: fix mmc A peripheral clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 0079e77c08de692cb20b38e408365c830a44b1ef ]
The bit index of the peripheral clock for mmc A is wrong
This was probably not a problem for mmc A as the peripheral is likely left enabled by the bootloader.
No issues has been reported so far but it could be a problem, most likely some form of conflict between the ethernet and mmc A clock, breaking ethernet on init.
Use the value provided by the documentation for mmc A before this becomes an actual problem.
--- drivers/clk/meson/g12a.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/meson/g12a.c +1 -1
@@ -4201,7 +4201,7 @@ static MESON_GATE(g12a_spicc_1, HHI_GCLK_MPEG0, 14); static MESON_GATE(g12a_hiu_reg, HHI_GCLK_MPEG0, 19); static MESON_GATE(g12a_mipi_dsi_phy, HHI_GCLK_MPEG0, 20); static MESON_GATE(g12a_assist_misc, HHI_GCLK_MPEG0, 23); -static MESON_GATE(g12a_emmc_a, HHI_GCLK_MPEG0, 4); +static MESON_GATE(g12a_emmc_a, HHI_GCLK_MPEG0, 24); static MESON_GATE(g12a_emmc_b, HHI_GCLK_MPEG0, 25); static MESON_GATE(g12a_emmc_c, HHI_GCLK_MPEG0, 26); static MESON_GATE(g12a_audio_codec, HHI_GCLK_MPEG0, 28);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/268 x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
[ Upstream commit 57e2428f8df8263275344566e02c277648a4b7f1 ]
PUSH_REGS with save_ret=1 is used by interrupt entry helper functions that initially start with a UNWIND_HINT_FUNC ORC state.
However, save_ret=1 means that we clobber the helper function's return address (and then later restore the return address further down on the stack); after that point, the only thing on the stack we can unwind through is the IRET frame, so use UNWIND_HINT_IRET_REGS until we have a full pt_regs frame.
( An alternate approach would be to move the pt_regs->di overwrite down
such that it is the final step of pt_regs setup; but I don't want to rearrange entry code just to make unwinding a tiny bit more elegant. )
--- arch/x86/entry/calling.h | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/entry/calling.h +2 -0
@@ -70,6 +70,8 @@ For 32-bit we have the following conventions - kernel is built with pushq %rsi /* pt_regs->si */ movq 8(%rsp), %rsi /* temporarily store the return address in %rsi */ movq %rdi, 8(%rsp) /* pt_regs->di (overwriting original return address) */ +/* We just clobbered the return address - use the IRET frame for unwinding: */ +UNWIND_HINT_IRET_REGS offset=3 *8 .else pushq %rdi /* pt_regs->di */ pushq %rsi/* pt_regs->si */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/268 power: supply: max77693: Fix wrong conversion of charge input threshold value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 30cc7b0d0e9341d419eb7da15fb5c22406dbe499 ]
The charge input threshold voltage register on the MAX77693 PMIC accepts four values: 0x0 for 4.3v, 0x1 for 4.7v, 0x2 for 4.8v and 0x3 for 4.9v. Due to an oversight, the driver calculated the values for 4.7v and above starting from 0x0, rather than from 0x1 ([(4700000 - 4700000) / 100000] gives 0).
Add 1 to the calculation to ensure that 4.7v is converted to a register value of 0x1 and that the other two voltages are converted correctly as well.
--- drivers/power/supply/max77693_charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/max77693_charger.c +1 -1
@@ -556,7 +556,7 @@ static int max77693_set_charge_input_threshold_volt(struct max77693_charger *chgcase 4700000 :case 4800000 :case 4900000 : - data = (uvolt -4700000 ) /100000 ; + data = ((uvolt -4700000 ) /100000 ) +1 ;break ;default :dev_err (chg->dev,"Wrong value for charge input voltage regulation threshold\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/268 crypto: nx - Fix uninitialised hv_nxc on error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 9b00eb923f3e60ca76cbc8b31123716f3a87ac6a ]
The compiler correctly warns that hv_nxc may be used uninitialised as that will occur when NX-GZIP is unavailable.
Fix it by rearranging the code and delay setting caps_feat until the final query succeeds.
--- drivers/crypto/nx/nx-common-pseries.c | 37 ++++++++++++--------------- 1 file changed, 17 insertions(+), 20 deletions(-)
drivers/crypto/nx/nx-common-pseries.c +17 -20
@@ -1144,6 +1144,7 @@ static void __init nxcop_get_capabilities(void) {struct hv_vas_all_caps *hv_caps;struct hv_nx_cop_caps *hv_nxc; +u64 feat;int rc; hv_caps =kmalloc (sizeof (*hv_caps),GFP_KERNEL );
@@ -1154,27 +1155,26 @@ static void __init nxcop_get_capabilities(void)*/ rc =h_query_vas_capabilities (H_QUERY_NX_CAPABILITIES ,0 , (u64 )virt_to_phys (hv_caps)); +if (!rc) + feat =be64_to_cpu (hv_caps->feat_type); +kfree (hv_caps);if (rc) - goto out; +return ; +if (!(feat &VAS_NX_GZIP_FEAT_BIT )) +return ; - caps_feat =be64_to_cpu (hv_caps->feat_type);/* * NX-GZIP feature available */ -if (caps_feat &VAS_NX_GZIP_FEAT_BIT ) { - hv_nxc =kmalloc (sizeof (*hv_nxc),GFP_KERNEL ); -if (!hv_nxc) - goto out; -/* -* Get capabilities for NX-GZIP feature -*/ - rc =h_query_vas_capabilities (H_QUERY_NX_CAPABILITIES , -VAS_NX_GZIP_FEAT , - (u64 )virt_to_phys (hv_nxc)); - }else { -pr_err ("NX-GZIP feature is not available\n" ); - rc = -EINVAL ; - } + hv_nxc =kmalloc (sizeof (*hv_nxc),GFP_KERNEL ); +if (!hv_nxc) +return ; +/* +* Get capabilities for NX-GZIP feature +*/ + rc =h_query_vas_capabilities (H_QUERY_NX_CAPABILITIES , +VAS_NX_GZIP_FEAT , + (u64 )virt_to_phys (hv_nxc));if (!rc) { nx_cop_caps.descriptor =be64_to_cpu (hv_nxc->descriptor);
@@ -1184,13 +1184,10 @@ static void __init nxcop_get_capabilities(void)be64_to_cpu (hv_nxc->min_compress_len); nx_cop_caps.min_decompress_len =be64_to_cpu (hv_nxc->min_decompress_len); - }else { - caps_feat =0 ; + caps_feat = feat; }kfree (hv_nxc); -out: -kfree (hv_caps); }static const struct vio_device_id nx842_vio_driver_ids[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/268 RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 5ed3b0cb3f827072e93b4c5b6e2b8106fd7cccbd ]
When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we already have.
The bug however is that we are checking if the QP is identical by checking the QP number inside the CQE against the QP number inside the mlx5_ib_qp, but that's wrong since the QP number from the CQE is from FW so it should be matched against mlx5_core_qp which is our FW QP number.
Otherwise we could use the wrong QP when handling a CQE which could cause the kernel trace below.
This issue is mainly noticeable over QPs 0 & 1, since for now they are the only QPs in our driver whereas the QP number inside mlx5_ib_qp doesn't match the QP number inside mlx5_core_qp.
BUG: kernel NULL pointer dereference, address: 0000000000000012 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP CPU: 0 UID: 0 PID: 7927 Comm: kworker/u62:1 Not tainted 6.14.0-rc3+ #189 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core] RIP: 0010:mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib] Code: 03 00 00 8d 58 ff 21 cb 66 39 d3 74 39 48 c7 c7 3c 89 6e a0 0f b7 db e8 b7 d2 b3 e0 49 8b 86 60 03 00 00 48 c7 c7 4a 89 6e a0 <0f> b7 5c 98 02 e8 9f d2 b3 e0 41 0f b7 86 78 03 00 00 83 e8 01 21 RSP: 0018:ffff88810511bd60 EFLAGS: 00010046 RAX: 0000000000000010 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88885fa1b3c0 RDI: ffffffffa06e894a RBP: 00000000000000b0 R08: 0000000000000000 R09: ffff88810511bc10 R10: 0000000000000001 R11: 0000000000000001 R12: ffff88810d593000 R13: ffff88810e579108 R14: ffff888105146000 R15: 00000000000000b0 FS: 0000000000000000(0000) GS:ffff88885fa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000012 CR3: 00000001077e6001 CR4: 0000000000370eb0 Call Trace: <TASK> ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib] __ib_process_cq+0x5a/0x150 [ib_core] ib_cq_poll_work+0x31/0x90 [ib_core] process_one_work+0x169/0x320 worker_thread+0x288/0x3a0 ? work_busy+0xb0/0xb0 kthread+0xd7/0x1f0 ? kthreads_online_cpu+0x130/0x130 ? kthreads_online_cpu+0x130/0x130 ret_from_fork+0x2d/0x50 ? kthreads_online_cpu+0x130/0x130 ret_from_fork_asm+0x11/0x20 </TASK>
--- drivers/infiniband/hw/mlx5/cq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/cq.c +1 -1
@@ -487,7 +487,7 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq, } qpn =ntohl (cqe64->sop_drop_qpn) &0xffffff ; -if (!*cur_qp || (qpn != (*cur_qp)->ibqp.qp_num)) { +if (!*cur_qp || (qpn != (*cur_qp)->trans_qp.base.mqp.qpn)) {/* We do not have to take the QP table lock here, * because CQs will be locked while QPs are removed * from the table.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/268 pinctrl: renesas: rzv2m: Fix missing of_node_put() call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrizio Castro <[email protected]>
[ Upstream commit 5a550b00704d3a2cd9d766a9427b0f8166da37df ]
of_parse_phandle_with_fixed_args() requires its caller to call into of_node_put() on the node pointer from the output structure, but such a call is currently missing.
Call into of_node_put() to rectify that.
--- drivers/pinctrl/renesas/pinctrl-rzv2m.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/renesas/pinctrl-rzv2m.c +2 -0
@@ -944,6 +944,8 @@ static int rzv2m_gpio_register(struct rzv2m_pinctrl *pctrl)return ret; } +of_node_put (of_args.np); +if (of_args.args[0 ] !=0 || of_args.args[1 ] !=0 || of_args.args[2 ] != pctrl->data->n_port_pins) {dev_err (pctrl->dev,"gpio-ranges does not match selected SOC\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/268 mfd: sm501: Switch to BIT() to mitigate integer overflows
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 2d8cb9ffe18c2f1e5bd07a19cbce85b26c1d0cf0 ]
If offset end up being high enough, right hand expression in functions like sm501_gpio_set() shifted left for that number of bits, may not fit in int type.
Just in case, fix that by using BIT() both as an option safe from overflow issues and to make this step look similar to other gpio drivers.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/mfd/sm501.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mfd/sm501.c +3 -3
@@ -920,7 +920,7 @@ static void sm501_gpio_set(struct gpio_chip *chip, unsigned offset, int value) {struct sm501_gpio_chip *smchip =gpiochip_get_data (chip);struct sm501_gpio *smgpio = smchip->ourgpio; -unsigned long bit =1 << offset; +unsigned long bit =BIT (offset);void __iomem *regs = smchip->regbase;unsigned long save;unsigned long val;
@@ -946,7 +946,7 @@ static int sm501_gpio_input(struct gpio_chip *chip, unsigned offset)struct sm501_gpio_chip *smchip =gpiochip_get_data (chip);struct sm501_gpio *smgpio = smchip->ourgpio;void __iomem *regs = smchip->regbase; -unsigned long bit =1 << offset; +unsigned long bit =BIT (offset);unsigned long save;unsigned long ddr;
@@ -971,7 +971,7 @@ static int sm501_gpio_output(struct gpio_chip *chip, {struct sm501_gpio_chip *smchip =gpiochip_get_data (chip);struct sm501_gpio *smgpio = smchip->ourgpio; -unsigned long bit =1 << offset; +unsigned long bit =BIT (offset);void __iomem *regs = smchip->regbase;unsigned long save;unsigned long val;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/268 leds: Fix LED_OFF brightness race
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
[ Upstream commit 2c70953b6f535f7698ccbf22c1f5ba26cb6c2816 ]
While commit fa15d8c69238 ("leds: Fix set_brightness_delayed() race") successfully forces led_set_brightness() to be called with LED_OFF at least once when switching from blinking to LED on state so that hw-blinking can be disabled, another race remains. Indeed in led_set_brightness(LED_OFF) followed by led_set_brightness(any) scenario the following CPU scheduling can happen:
CPU0 CPU1
---- ----
set_brightness_delayed() {
test_and_clear_bit(BRIGHTNESS_OFF)
led_set_brightness(LED_OFF) {
set_bit(BRIGHTNESS_OFF)
queue_work()
}
led_set_brightness(any) {
set_bit(BRIGHTNESS)
queue_work() //already queued
}
test_and_clear_bit(BRIGHTNESS)
/* LED set with brightness any */}
/* From previous CPU1 queue_work() */
set_brightness_delayed() {
test_and_clear_bit(BRIGHTNESS_OFF)
/* LED turned off */
test_and_clear_bit(BRIGHTNESS)
/* Clear from previous run, LED remains off */In that case the led_set_brightness(LED_OFF)/led_set_brightness(any) sequence will be effectively executed in reverse order and LED will remain off.
With the introduction of commit 32360bf6a5d4 ("leds: Introduce ordered workqueue for LEDs events instead of system_wq") the race is easier to trigger as sysfs brightness configuration does not wait for set_brightness_delayed() work to finish (flush_work() removal).
Use delayed_set_value to optionnally re-configure brightness after a LED_OFF. That way a LED state could be configured more that once but final state will always be as expected. Ensure that delayed_set_value modification is seen before set_bit() using smp_mb__before_atomic().
--- drivers/leds/led-core.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
drivers/leds/led-core.c +18 -4
@@ -147,8 +147,19 @@ static void set_brightness_delayed(struct work_struct *ws)* before this work item runs once. To make sure this works properly * handle LED_SET_BRIGHTNESS_OFF first. */ -if (test_and_clear_bit (LED_SET_BRIGHTNESS_OFF , &led_cdev->work_flags)) +if (test_and_clear_bit (LED_SET_BRIGHTNESS_OFF , &led_cdev->work_flags)) {set_brightness_delayed_set_brightness (led_cdev,LED_OFF ); +/* +* The consecutives led_set_brightness(LED_OFF), +* led_set_brightness(LED_FULL) could have been executed out of +* order (LED_FULL first), if the work_flags has been set +* between LED_SET_BRIGHTNESS_OFF and LED_SET_BRIGHTNESS of this +* work. To avoid ending with the LED turned off, turn the LED +* on again. +*/ +if (led_cdev->delayed_set_value !=LED_OFF ) +set_bit (LED_SET_BRIGHTNESS , &led_cdev->work_flags); + }if (test_and_clear_bit (LED_SET_BRIGHTNESS , &led_cdev->work_flags))set_brightness_delayed_set_brightness (led_cdev, led_cdev->delayed_set_value);
@@ -319,10 +330,13 @@ void led_set_brightness_nopm(struct led_classdev *led_cdev, unsigned int value)* change is done immediately afterwards (before the work runs), * it uses a separate work_flag. */ -if (value) { - led_cdev->delayed_set_value = value; + led_cdev->delayed_set_value = value; +/* Ensure delayed_set_value is seen before work_flags modification */ +smp_mb__before_atomic (); + +if (value)set_bit (LED_SET_BRIGHTNESS , &led_cdev->work_flags); - }else { +else {clear_bit (LED_SET_BRIGHTNESS , &led_cdev->work_flags);clear_bit (LED_SET_BLINK , &led_cdev->work_flags);set_bit (LED_SET_BRIGHTNESS_OFF , &led_cdev->work_flags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/268 x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
[ Upstream commit 2c118f50d7fd4d9aefc4533a26f83338b2906b7a ]
Commit:
2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again")
was intended to ensure alignment of the stack pointer; but it also moved the initialization of the "stack" variable down into the loop header.
This was likely intended as a no-op cleanup, since the commit message does not mention it; however, this caused a behavioral change because the value of "regs" is different between the two places.
Originally, get_stack_pointer() used the regs provided by the caller; after that commit, get_stack_pointer() instead uses the regs at the top of the stack frame the unwinder is looking at. Often, there are no such regs at all, and "regs" is NULL, causing get_stack_pointer() to fall back to the task's current stack pointer, which is not what we want here, but probably happens to mostly work. Other times, the original regs will point to another regs frame - in that case, the linear guess unwind logic in show_trace_log_lvl() will start unwinding too far up the stack, causing the first frame found by the proper unwinder to never be visited, resulting in a stack trace consisting purely of guess lines.
Fix it by moving the "stack = " assignment back where it belongs.
--- arch/x86/kernel/dumpstack.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/kernel/dumpstack.c +2 -3
@@ -195,6 +195,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,printk ("%sCall Trace:\n" , log_lvl);unwind_start (&state, task, regs, stack); + stack = stack ?:get_stack_pointer (task, regs); regs =unwind_get_entry_regs (&state, &partial);/*
@@ -213,9 +214,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,* - hardirq stack * - entry stack */ -for (stack = stack ?:get_stack_pointer (task, regs); - stack; - stack = stack_info.next_sp) { +for (; stack; stack = stack_info.next_sp) {const char *stack_name; stack =PTR_ALIGN (stack,sizeof (long ));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/268 crypto: hisilicon/sec2 - fix for aead auth key length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
[ Upstream commit 1b284ffc30b02808a0de698667cbcf5ce5f9144e ]
According to the HMAC RFC, the authentication key can be 0 bytes, and the hardware can handle this scenario. Therefore, remove the incorrect validation for this case.
--- drivers/crypto/hisilicon/sec2/sec_crypto.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/crypto/hisilicon/sec2/sec_crypto.c +2 -6
@@ -1089,11 +1089,6 @@ static int sec_aead_auth_set_key(struct sec_auth_ctx *ctx,struct crypto_shash *hash_tfm = ctx->hash_tfm;int blocksize, digestsize, ret; -if (!keys->authkeylen) { -pr_err ("hisi_sec2: aead auth key error!\n" ); -return -EINVAL ; - } - blocksize =crypto_shash_blocksize (hash_tfm); digestsize =crypto_shash_digestsize (hash_tfm);if (keys->authkeylen > blocksize) {
@@ -1105,7 +1100,8 @@ static int sec_aead_auth_set_key(struct sec_auth_ctx *ctx, } ctx->a_key_len = digestsize; }else { -memcpy (ctx->a_key, keys->authkey, keys->authkeylen); +if (keys->authkeylen) +memcpy (ctx->a_key, keys->authkey, keys->authkeylen); ctx->a_key_len = keys->authkeylen; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/268 pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 0eee258cdf172763502f142d85e967f27a573be0 ]
When instantiating PWM, the bypass should be set to false. The field is used for the selected Intel SoCs that do not have PWM feature enabled in their pin control IPs.
--- drivers/pinctrl/intel/pinctrl-intel.c | 1 - 1 file changed, 1 deletion(-)
drivers/pinctrl/intel/pinctrl-intel.c +0 -1
@@ -1524,7 +1524,6 @@ static int intel_pinctrl_probe_pwm(struct intel_pinctrl *pctrl, .clk_rate = 19200000, .npwm = 1, .base_unit_bits = 22, - .bypass = true, };struct pwm_lpss_chip *pwm;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/268 clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <[email protected]>
[ Upstream commit 000cbe3896c56bf5c625e286ff096533a6b27657 ]
This clock can't be enable with VENUS_CORE0 GDSC turned off. But that GDSC is under HW control so it can be turned off at any moment. Instead of checking the dependent clock we can just vote for it to enable later when GDSC gets turned on.
--- drivers/clk/qcom/mmcc-sdm660.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/mmcc-sdm660.c +1 -1
@@ -2544,7 +2544,7 @@ static struct clk_branch video_core_clk = {static struct clk_branch video_subcore0_clk = { .halt_reg =0x1048 , - .halt_check =BRANCH_HALT , + .halt_check =BRANCH_HALT_SKIP , .clkr = { .enable_reg =0x1048 , .enable_mask =BIT (0 ),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/268 perf stat: Fix find_stat for mixed legacy/non-legacy events
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 8ce0d2da14d3fb62844dd0e95982c194326b1a5f ]
Legacy events typically don't have a PMU when added leading to mismatched legacy/non-legacy cases in find_stat. Use evsel__find_pmu to make sure the evsel PMU is looked up. Update the evsel__find_pmu code to look for the PMU using the extended config type or, for legacy hardware/hw_cache events on non-hybrid systems, just use the core PMU.
Before:
```
$ perf stat -e cycles,cpu/instructions/ -a sleep 1
Performance counter stats for 'system wide':
215,309,764 cycles
44,326,491 cpu/instructions/
1.002555314 seconds time elapsed
```
After:
```
$ perf stat -e cycles,cpu/instructions/ -a sleep 1
Performance counter stats for 'system wide':
990,676,332 cycles
1,235,762,487 cpu/instructions/ # 1.25 insn per cycle
1.002667198 seconds time elapsed
```--- tools/perf/util/pmus.c | 20 +++++++++++++++++--- tools/perf/util/stat-shadow.c | 3 ++- 2 files changed, 19 insertions(+), 4 deletions(-)
tools/perf/util/pmus.c +17 -3
@@ -587,11 +587,25 @@ char *perf_pmus__default_pmu_name(void)struct perf_pmu *evsel__find_pmu (const struct evsel *evsel) {struct perf_pmu *pmu = evsel->pmu; +bool legacy_core_type; -if (!pmu) { - pmu =perf_pmus__find_by_type (evsel->core.attr.type); - ((struct evsel *)evsel)->pmu = pmu; +if (pmu) +return pmu; + + pmu =perf_pmus__find_by_type (evsel->core.attr.type); + legacy_core_type = + evsel->core.attr.type ==PERF_TYPE_HARDWARE || + evsel->core.attr.type ==PERF_TYPE_HW_CACHE ; +if (!pmu && legacy_core_type) { +if (perf_pmus__supports_extended_type ()) { +u32 type = evsel->core.attr.config >>PERF_PMU_TYPE_SHIFT ; + + pmu =perf_pmus__find_by_type (type); + }else { + pmu =perf_pmus__find_core_pmu (); + } } + ((struct evsel *)evsel)->pmu = pmu;return pmu; }
tools/perf/util/stat-shadow.c +2 -1
@@ -154,6 +154,7 @@ static double find_stat(const struct evsel *evsel, int aggr_idx, enum stat_type {const struct evsel *cur;int evsel_ctx =evsel_context (evsel); +struct perf_pmu *evsel_pmu =evsel__find_pmu (evsel);evlist__for_each_entry (evsel->evlist, cur) {struct perf_stat_aggr *aggr;
@@ -180,7 +181,7 @@ static double find_stat(const struct evsel *evsel, int aggr_idx, enum stat_type* Except the SW CLOCK events, * ignore if not the PMU we're looking for. */ -if ((type !=STAT_NSECS ) && (evsel->pmu != cur->pmu)) +if ((type !=STAT_NSECS ) && (evsel_pmu !=evsel__find_pmu (cur)))continue ; aggr = &cur->stats->aggr[aggr_idx];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/268 isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
[ Upstream commit 81a82e8f33880793029cd6f8a766fb13b737e6a7 ]
In do_isofs_readdir() when assigning the variable
"struct iso_directory_record *de" the b_data field of the buffer_head is accessed and an offset is added to it, the size of b_data is 2048 and the offset size is 2047, meaning
"de = (struct iso_directory_record *) (bh->b_data + offset);" yields the final byte of the 2048 sized b_data block.
The first byte of the directory record (de_len) is then read and found to be 31, meaning the directory record size is 31 bytes long. The directory record is defined by the structure:
struct iso_directory_record {
__u8 length; // 1 byte
__u8 ext_attr_length; // 1 byte
__u8 extent[8]; // 8 bytes
__u8 size[8]; // 8 bytes
__u8 date[7]; // 7 bytes
__u8 flags; // 1 byte
__u8 file_unit_size; // 1 byte
__u8 interleave; // 1 byte
__u8 volume_sequence_number[4]; // 4 bytes
__u8 name_len; // 1 byte
char name[]; // variable size
} __attribute__((packed));
The fixed portion of this structure occupies 33 bytes. Therefore, a valid directory record must be at least 33 bytes long (even without considering the variable-length name field). Since de_len is only 31, it is insufficient to contain the complete fixed header.
The code later hits the following sanity check that compares de_len against the sum of de->name_len and sizeof(struct iso_directory_record):
if (de_len < de->name_len[0] + sizeof(struct iso_directory_record)) {
...
}Since the fixed portion of the structure is
33 bytes (up to and including name_len member),
a valid record should have de_len of at least 33 bytes; here, however, de_len is too short, and the field de->name_len (located at offset 32) is accessed even though it lies beyond the available 31 bytes.
This access on the corrupted isofs data triggers a KASAN uninitialized memory warning. The fix would be to first verify that de_len is at least sizeof(struct iso_directory_record) before accessing any fields like de->name_len.
--- fs/isofs/dir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/isofs/dir.c +2 -1
@@ -147,7 +147,8 @@ static int do_isofs_readdir(struct inode *inode, struct file *file, de = tmpde; }/* Basic sanity check, whether name doesn't exceed dir entry */ -if (de_len < de->name_len[0 ] + +if (de_len <sizeof (struct iso_directory_record ) || + de_len < de->name_len[0 ] +sizeof (struct iso_directory_record )) { printk(KERN_NOTICE "iso9660: Corrupted directory entry" " in block %lu of inode %lu\n", block,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/268 soundwire: slave: fix an OF node reference leak in soundwire slave device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit aac2f8363f773ae1f65aab140e06e2084ac6b787 ]
When initializing a soundwire slave device, an OF node is stored to the device with refcount incremented. However, the refcount is not decremented in .release(), thus call of_node_put() in sdw_slave_release().
--- drivers/soundwire/slave.c | 1 + 1 file changed, 1 insertion(+)
drivers/soundwire/slave.c +1 -0
@@ -12,6 +12,7 @@ static void sdw_slave_release(struct device *dev) {struct sdw_slave *slave =dev_to_sdw_dev (dev); +of_node_put (slave->dev.of_node);mutex_destroy (&slave->sdw_dev_lock);kfree (slave); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/268 coresight: catu: Fix number of pages while using 64k pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilkka Koskinen <[email protected]>
[ Upstream commit 0e14e062f5ff98aa15264dfa87c5f5e924028561 ]
Trying to record a trace on kernel with 64k pages resulted in -ENOMEM. This happens due to a bug in calculating the number of table pages, which returns zero. Fix the issue by rounding up.
$ perf record --kcore -e cs_etm/@tmc_etr55,cycacc,branch_broadcast/k --per-thread taskset --cpu-list 1 dd if=/dev/zero of=/dev/null failed to mmap with 12 (Cannot allocate memory)
--- drivers/hwtracing/coresight/coresight-catu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-catu.c +1 -1
@@ -267,7 +267,7 @@ catu_init_sg_table(struct device *catu_dev, int node,* Each table can address upto 1MB and we can have * CATU_PAGES_PER_SYSPAGE tables in a system page. */ - nr_tpages =DIV_ROUND_UP (size,SZ_1M ) /CATU_PAGES_PER_SYSPAGE ; + nr_tpages =DIV_ROUND_UP (size,CATU_PAGES_PER_SYSPAGE *SZ_1M ); catu_table =tmc_alloc_sg_table (catu_dev, node, nr_tpages, size >>PAGE_SHIFT , pages);if (IS_ERR (catu_table))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/268 vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <[email protected]>
[ Upstream commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 ]
If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang:
1. Use-after-free when no tpgs are found:
This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do:
vhost_vq_set_backend(vq, vs_tpg);
...
kfree(vs->vs_tpg);vs->vs_tpg = vs_tpg;
If vhost_scsi_set_endpoint is called again and no tpgs are found match=false so we skip the vhost_vq_set_backend call leaving the pointer to the vs_tpg we then free via:
kfree(vs->vs_tpg);vs->vs_tpg = vs_tpg;
If a scsi request is then sent we do:
vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend
which sees the vs_tpg we just did a kfree on.
2. Tpg dir removal hang:
This patch fixes an issue where we cannot remove a LIO/target layer tpg (and structs above it like the target) dir due to the refcount dropping to -1.
The problem is that if vhost_scsi_set_endpoint detects a tpg is already in the vs->vs_tpg array or if the tpg has been removed so target_depend_item fails, the undepend goto handler will do target_undepend_item on all tpgs in the vs_tpg array dropping their refcount to 0. At this time vs_tpg contains both the tpgs we have added in the current vhost_scsi_set_endpoint call as well as tpgs we added in previous calls which are also in vs->vs_tpg.
Later, when vhost_scsi_clear_endpoint runs it will do target_undepend_item on all the tpgs in the vs->vs_tpg which will drop their refcount to -1. Userspace will then not be able to remove the tpg and will hang when it tries to do rmdir on the tpg dir.
3. Tpg leak:
This fixes a bug where we can leak tpgs and cause them to be un-removable because the target name is overwritten when vhost_scsi_set_endpoint is called multiple times but with different target names.
The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup a vhost-scsi device to target/tpg mapping, then calls VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we haven't seen before (target1 has tpg1 but target2 has tpg2). When this happens we don't teardown the old target tpg mapping and just overwrite the target name and the vs->vs_tpg array. Later when we do vhost_scsi_clear_endpoint, we are passed in either target1 or target2's name and we will only match that target's tpgs when we loop over the vs->vs_tpg. We will then return from the function without doing target_undepend_item on the tpgs.
Because of all these bugs, it looks like being able to call vhost_scsi_set_endpoint multiple times was never supported. The major user, QEMU, already has checks to prevent this use case. So to fix the issues, this patch prevents vhost_scsi_set_endpoint from being called if it's already successfully added tpgs. To add, remove or change the tpg config or target name, you must do a vhost_scsi_clear_endpoint first.
Message-Id: <[email protected]>
--- drivers/vhost/scsi.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
drivers/vhost/scsi.c +13 -12
@@ -1688,14 +1688,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } } +if (vs->vs_tpg) { +pr_err ("vhost-scsi endpoint already set for %s.\n" , + vs->vs_vhost_wwpn); + ret = -EEXIST ; + goto out; + } + len =sizeof (vs_tpg[0 ]) *VHOST_SCSI_MAX_TARGET ; vs_tpg =kzalloc (len,GFP_KERNEL );if (!vs_tpg) { ret = -ENOMEM ; goto out; } -if (vs->vs_tpg) -memcpy (vs_tpg, vs->vs_tpg, len);mutex_lock (&vhost_scsi_mutex);list_for_each_entry (tpg, &vhost_scsi_list, tv_tpg_list) {
@@ -1711,12 +1716,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, tv_tport = tpg->tport;if (!strcmp (tv_tport->tport_name, t->vhost_wwpn)) { -if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { -mutex_unlock (&tpg->tv_tpg_mutex); -mutex_unlock (&vhost_scsi_mutex); - ret = -EEXIST ; - goto undepend; - }/* * In order to ensure individual vhost-scsi configfs * groups cannot be removed while in use by vhost ioctl,
@@ -1763,15 +1762,15 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } ret =0 ; }else { - ret = -EEXIST ; + ret = -ENODEV ; + goto free_tpg; }/* -* Act as synchronize_rcu to make sure access to -* old vs->vs_tpg is finished. +* Act as synchronize_rcu to make sure requests after this point +* see a fully setup device. */ vhost_scsi_flush (vs); -kfree (vs->vs_tpg); vs->vs_tpg = vs_tpg; goto out;
@@ -1791,6 +1790,7 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,target_undepend_item (&tpg->se_tpg.tpg_group.cg_item); } } +free_tpg:kfree (vs_tpg); out:mutex_unlock (&vs->dev.mutex);
@@ -1893,6 +1893,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,vhost_scsi_flush (vs);kfree (vs->vs_tpg); vs->vs_tpg =NULL ; +memset (vs->vs_vhost_wwpn,0 ,sizeof (vs->vs_vhost_wwpn));WARN_ON (vs->vs_events_nr);mutex_unlock (&vs->dev.mutex);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/268 coresight-etm4x: add isb() before reading the TRCSTATR
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanfang Zhang <[email protected]>
[ Upstream commit 4ff6039ffb79a4a8a44b63810a8a2f2b43264856 ]
As recommended by section 4.3.7 ("Synchronization when using system instructions to progrom the trace unit") of ARM IHI 0064H.b, the self-hosted trace analyzer must perform a Context synchronization event between writing to the TRCPRGCTLR and reading the TRCSTATR. Additionally, add an ISB between the each read of TRCSTATR on coresight_timeout() when using system instructions to program the trace unit.
--- drivers/hwtracing/coresight/coresight-core.c | 20 ++++++-- .../coresight/coresight-etm4x-core.c | 48 +++++++++++++++++-- include/linux/coresight.h | 4 ++ 3 files changed, 62 insertions(+), 10 deletions(-)
drivers/hwtracing/coresight/coresight-core.c +15 -5
@@ -1465,18 +1465,20 @@ static void coresight_remove_conns(struct coresight_device *csdev) }/** -* coresight_timeout - loop until a bit has changed to a specific register -* state. +* coresight_timeout_action - loop until a bit has changed to a specific register +* state, with a callback after every trial. * @csa: coresight device access for the device * @offset: Offset of the register from the base of the device. * @position: the position of the bit of interest. * @value: the value the bit should have. +* @cb: Call back after each trial. * * Return: 0 as soon as the bit has taken the desired state or -EAGAIN if * TIMEOUT_US has elapsed, which ever happens first. */ -int coresight_timeout (struct csdev_access *csa,u32 offset, -int position,int value) +int coresight_timeout_action (struct csdev_access *csa,u32 offset, +int position,int value, +coresight_timeout_cb_t cb) {int i;u32 val;
@@ -1492,7 +1494,8 @@ int coresight_timeout(struct csdev_access *csa, u32 offset,if (!(val &BIT (position)))return 0 ; } - +if (cb) +cb (csa, offset, position, value);/* * Delay is arbitrary - the specification doesn't say how long * we are expected to wait. Extra check required to make sure
@@ -1504,6 +1507,13 @@ int coresight_timeout(struct csdev_access *csa, u32 offset,return -EAGAIN ; } +EXPORT_SYMBOL_GPL (coresight_timeout_action); + +int coresight_timeout (struct csdev_access *csa,u32 offset, +int position,int value) +{ +return coresight_timeout_action (csa, offset, position, value,NULL ); +}EXPORT_SYMBOL_GPL (coresight_timeout);u32 coresight_relaxed_read32 (struct coresight_device *csdev,u32 offset)
drivers/hwtracing/coresight/coresight-etm4x-core.c +43 -5
87 lines not on this page · raw message
include/linux/coresight.h +4 -0
@@ -575,6 +575,10 @@ extern int coresight_enable(struct coresight_device *csdev);extern void coresight_disable (struct coresight_device *csdev);extern int coresight_timeout (struct csdev_access *csa,u32 offset,int position,int value); +typedef void (*coresight_timeout_cb_t ) (struct csdev_access *,u32 ,int ,int ); +extern int coresight_timeout_action (struct csdev_access *csa,u32 offset, +int position,int value, +coresight_timeout_cb_t cb);extern int coresight_claim_device (struct coresight_device *csdev);extern int coresight_claim_device_unlocked (struct coresight_device *csdev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/268 perf pmu: Dont double count common sysfs and json events
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit c9d699e10fa6c0cdabcddcf991e7ff42af6b2503 ]
After pmu_add_cpu_aliases() is called, perf_pmu__num_events() returns an incorrect value that double counts common events and doesn't match the actual count of events in the alias list. This is because after 'cpu_aliases_added == true', the number of events returned is 'sysfs_aliases + cpu_json_aliases'. But when adding 'case EVENT_SRC_SYSFS' events, 'sysfs_aliases' and 'cpu_json_aliases' are both incremented together, failing to account that these ones overlap and only add a single item to the list. Fix it by adding another counter for overlapping events which doesn't influence 'cpu_json_aliases'.
There doesn't seem to be a current issue because it's used in perf list before pmu_add_cpu_aliases() so the correct value is returned. Other uses in tests may also miss it for other reasons like only looking at uncore events. However it's marked as a fixes commit in case any new fix with new uses of perf_pmu__num_events() is backported.
--- tools/perf/util/pmu.c | 7 ++++--- tools/perf/util/pmu.h | 5 +++++ 2 files changed, 9 insertions(+), 3 deletions(-)
tools/perf/util/pmu.c +4 -3
@@ -597,7 +597,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name, };if (pmu_events_table__find_event (pmu->events_table, pmu, name, update_alias, &data) ==0 ) - pmu->cpu_json_aliases++; + pmu->cpu_common_json_aliases++; } pmu->sysfs_aliases++;break ;
@@ -1680,9 +1680,10 @@ size_t perf_pmu__num_events(struct perf_pmu *pmu)if (pmu->cpu_aliases_added) nr += pmu->cpu_json_aliases;else if (pmu->events_table) - nr +=pmu_events_table__num_events (pmu->events_table, pmu) - pmu->cpu_json_aliases; + nr +=pmu_events_table__num_events (pmu->events_table, pmu) - + pmu->cpu_common_json_aliases;else -assert (pmu->cpu_json_aliases ==0 ); +assert (pmu->cpu_json_aliases ==0 && pmu->cpu_common_json_aliases ==0 );return pmu->selectable ? nr +1 : nr; }
tools/perf/util/pmu.h +5 -0
@@ -124,6 +124,11 @@ struct perf_pmu {uint32_t cpu_json_aliases;/** @sys_json_aliases: Number of json event aliases loaded matching the PMU's identifier. */ uint32_t sys_json_aliases; +/** +* @cpu_common_json_aliases: Number of json events that overlapped with sysfs when +* loading all sysfs events. +*/ +uint32_t cpu_common_json_aliases;/** @sysfs_aliases_loaded: Are sysfs aliases loaded from disk? */ bool sysfs_aliases_loaded;/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/268 ucsi_ccg: Dont show failed to get FW build information error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit c16006852732dc4fe37c14b81f9b4458df05b832 ]
The error failed to get FW build information is added for what looks to be for misdetection of the device property firmware-name.
If the property is missing (such as on non-nvidia HW) this error shows up. Move the error into the scope of the property parser for "firmware-name" to avoid showing errors on systems without the firmware-name property.
--- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/usb/typec/ucsi/ucsi_ccg.c +2 -3
@@ -1366,11 +1366,10 @@ static int ucsi_ccg_probe(struct i2c_client *client) uc->fw_build =CCG_FW_BUILD_NVIDIA_TEGRA ; else if (!strcmp(fw_name, "nvidia,gpu")) uc->fw_build =CCG_FW_BUILD_NVIDIA ; +if (!uc->fw_build) +dev_err (uc->dev,"failed to get FW build information\n" ); } -if (!uc->fw_build) -dev_err (uc->dev,"failed to get FW build information\n" ); -/* reset ccg device and initialize ucsi */ status =ucsi_ccg_init (uc);if (status <0 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/268 iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit df330c808182a8beab5d0f84a6cbc9cff76c61fc ]
If a match was not found, then the write_raw() callback would return the odr index, not an error. Return -EINVAL if this occurs. To avoid similar issues in future, introduce j, a new indexing variable rather than using ret for this purpose.
--- drivers/iio/accel/mma8452.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/iio/accel/mma8452.c +7 -3
@@ -711,7 +711,7 @@ static int mma8452_write_raw(struct iio_dev *indio_dev, int val, int val2, long mask) { struct mma8452_data *data = iio_priv(indio_dev); -int i, ret; +int i, j, ret; ret =iio_device_claim_direct_mode (indio_dev);if (ret)
@@ -771,14 +771,18 @@ static int mma8452_write_raw(struct iio_dev *indio_dev,break ;case IIO_CHAN_INFO_OVERSAMPLING_RATIO : - ret =mma8452_get_odr_index (data); + j =mma8452_get_odr_index (data);for (i =0 ; i <ARRAY_SIZE (mma8452_os_ratio); i++) { -if (mma8452_os_ratio[i][ret] == val) { +if (mma8452_os_ratio[i][j] == val) { ret =mma8452_set_power_mode (data, i);break ; } } +if (i ==ARRAY_SIZE (mma8452_os_ratio)) { + ret = -EINVAL ; +break ; + }break ;default : ret = -EINVAL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/268 iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit 60a0cf2ebab92011055ab7db6553c0fc3c546938 ]
Reorder the claiming of direct mode and runtime pm calls to simplify handling a little. For correct error handling, after the reorder iio_device_release_direct_mode() must be claimed in an error occurs in pm_runtime_resume_and_get()
--- drivers/iio/accel/msa311.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
drivers/iio/accel/msa311.c +15 -11
@@ -593,23 +593,25 @@ static int msa311_read_raw_data(struct iio_dev *indio_dev,__le16 axis;int err; - err =pm_runtime_resume_and_get (dev); + err =iio_device_claim_direct_mode (indio_dev);if (err)return err; - err =iio_device_claim_direct_mode (indio_dev); -if (err) + err =pm_runtime_resume_and_get (dev); +if (err) { +iio_device_release_direct_mode (indio_dev);return err; + }mutex_lock (&msa311->lock); err =msa311_get_axis (msa311, chan, &axis);mutex_unlock (&msa311->lock); -iio_device_release_direct_mode (indio_dev); -pm_runtime_mark_last_busy (dev);pm_runtime_put_autosuspend (dev); +iio_device_release_direct_mode (indio_dev); +if (err) {dev_err (dev,"can't get axis %s (%pe)\n" , chan->datasheet_name,ERR_PTR (err));
@@ -755,10 +757,6 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2)unsigned int odr;int err; - err =pm_runtime_resume_and_get (dev); -if (err) -return err; -/* * Sampling frequency changing is prohibited when buffer mode is * enabled, because sometimes MSA311 chip returns outliers during
@@ -768,6 +766,12 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2)if (err)return err; + err =pm_runtime_resume_and_get (dev); +if (err) { +iio_device_release_direct_mode (indio_dev); +return err; + } + err = -EINVAL ;for (odr =0 ; odr <ARRAY_SIZE (msa311_odr_table); odr++) if (val == msa311_odr_table[odr].integral &&
@@ -778,11 +782,11 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2)break ; } -iio_device_release_direct_mode (indio_dev); -pm_runtime_mark_last_busy (dev);pm_runtime_put_autosuspend (dev); +iio_device_release_direct_mode (indio_dev); +if (err)dev_err (dev,"can't update frequency (%pe)\n" ,ERR_PTR (err));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/268 perf arm-spe: Fix load-store operation checking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit e1d47850bbf79a541c9b3bacdd562f5e0112274d ]
The ARM_SPE_OP_LD and ARM_SPE_OP_ST operations are secondary operation type, they are overlapping with other second level's operation types belonging to SVE and branch operations. As a result, a non load-store operation can be parsed for data source and memory sample.
To fix the issue, this commit introduces a is_ldst_op() macro for checking LDST operation, and apply the checking when synthesize data source and memory samples.
--- tools/perf/util/arm-spe.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
tools/perf/util/arm-spe.c +7 -1
@@ -37,6 +37,8 @@#include "../../arch/arm64/include/asm/cputype.h" #define MAX_TIMESTAMP (~0ULL) +#define is_ldst_op (op) (!!((op) & ARM_SPE_OP_LDST)) +struct arm_spe {struct auxtrace auxtrace;struct auxtrace_queues queues;
@@ -520,6 +522,10 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 munion perf_mem_data_src data_src = { .mem_op =PERF_MEM_OP_NA };bool is_neoverse =is_midr_in_range_list (midr, neoverse_spe); +/* Only synthesize data source for LDST operations */ +if (!is_ldst_op (record->op)) +return 0 ; +if (record->op &ARM_SPE_OP_LD ) data_src.mem_op =PERF_MEM_OP_LOAD ;else if (record->op &ARM_SPE_OP_ST )
@@ -619,7 +625,7 @@ static int arm_spe_sample(struct arm_spe_queue *speq)* When data_src is zero it means the record is not a memory operation, * skip to synthesize memory sample for this case. */ -if (spe->sample_memory && data_src) { +if (spe->sample_memory &&is_ldst_op (record->op)) { err =arm_spe__synth_mem_sample (speq, spe->memory_id, data_src);if (err)return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/268 perf bench: Fix perf bench syscall loop count
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit 957d194163bf983da98bf7ec7e4f86caff8cd0eb ]
Command 'perf bench syscall fork -l 100000' offers option -l to run for a specified number of iterations. However this option is not always observed. The number is silently limited to 10000 iterations as can be seen:
Output before:
# perf bench syscall fork -l 100000
# Running 'syscall/fork' benchmark:
# Executed 10,000 fork() calls
Total time: 23.388 [sec] 2338.809800 usecs/op
427 ops/sec#
When explicitly specified with option -l or --loops, also observe higher number of iterations:
Output after:
# perf bench syscall fork -l 100000
# Running 'syscall/fork' benchmark:
# Executed 100,000 fork() calls
Total time: 716.982 [sec] 7169.829510 usecs/op
139 ops/sec#
This patch fixes the issue for basic execve fork and getpgid.
--- tools/perf/bench/syscall.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
tools/perf/bench/syscall.c +13 -9
@@ -22,8 +22,7 @@#define __NR_fork -1#endif -#define LOOPS_DEFAULT 10000000 -static int loops =LOOPS_DEFAULT ; +static int loops;static const struct option options[] = {OPT_INTEGER ('l' ,"loop" , &loops,"Specify number of loops" ),
@@ -80,6 +79,18 @@ static int bench_syscall_common(int argc, const char **argv, int syscall)const char *name =NULL ;int i; +switch (syscall) { +case __NR_fork: +case __NR_execve: +/* Limit default loop to 10000 times to save time */ + loops =10000 ; +break ; +default : + loops =10000000 ; +break ; + } + +/* Options -l and --loops override default above */ argc =parse_options (argc, argv, options, bench_syscall_usage,0 );gettimeofday (&start,NULL );
@@ -94,16 +105,9 @@ static int bench_syscall_common(int argc, const char **argv, int syscall)break ;case __NR_fork:test_fork (); -/* Only loop 10000 times to save time */ -if (i ==10000 ) - loops =10000 ;break ;case __NR_execve:test_execve (); -/* Only loop 10000 times to save time */ -if (i ==10000 ) - loops =10000 ; -break ;default :break ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/268 usb: xhci: correct debug message page size calculation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Neronin <[email protected]>
[ Upstream commit 55741c723318905e6d5161bf1e12749020b161e3 ]
The ffs() function returns the index of the first set bit, starting from 1. If no bits are set, it returns zero. This behavior causes an off-by-one page size in the debug message, as the page size calculation [1] is zero-based, while ffs() is one-based.
Fix this by subtracting one from the result of ffs(). Note that since variable 'val' is unsigned, subtracting one from zero will result in the maximum unsigned integer value. Consequently, the condition 'if (val < 16)' will still function correctly.
[1], Page size: (2^(n+12)), where 'n' is the set page size bit.
--- drivers/usb/host/xhci-mem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-mem.c +3 -3
@@ -2318,10 +2318,10 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) page_size =readl (&xhci->op_regs->page_size);xhci_dbg_trace (xhci, trace_xhci_dbg_init,"Supported page size register = 0x%x" , page_size); - i =ffs (page_size); -if (i <16 ) + val =ffs (page_size) -1 ; +if (val <16 )xhci_dbg_trace (xhci, trace_xhci_dbg_init, -"Supported page size of %iK" , (1 << (i+12 )) /1024 ); +"Supported page size of %iK" , (1 << (val +12 )) /1024 );else xhci_warn (xhci,"WARN: no supported page size\n" );/* Use 4K pages, since that's common and the minimum the HC supports */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/268 fs/ntfs3: Fix a couple integer overflows on 32bit systems
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 5ad414f4df2294b28836b5b7b69787659d6aa708 ]
On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can have an integer wrapping issue. Fix it by using size_add().
--- fs/ntfs3/index.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ntfs3/index.c +2 -2
@@ -618,7 +618,7 @@ static bool index_hdr_check(const struct INDEX_HDR *hdr, u32 bytes)u32 off =le32_to_cpu (hdr->de_off);if (!IS_ALIGNED (off,8 ) || tot > bytes || end > tot || - off +sizeof (struct NTFS_DE ) > end) { +size_add (off,sizeof (struct NTFS_DE )) > end) {/* incorrect index buffer. */ return false; }
@@ -736,7 +736,7 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx,if (end > total)return NULL ; -if (off +sizeof (struct NTFS_DE ) > end) +if (size_add (off,sizeof (struct NTFS_DE )) > end)return NULL ; e =Add2Ptr (hdr, off);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/268 fs/ntfs3: Prevent integer overflow in hdr_first_de()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6bb81b94f7a9cba6bde9a905cef52a65317a8b04 ]
The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.
--- fs/ntfs3/ntfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ntfs3/ntfs.h +1 -1
@@ -717,7 +717,7 @@ static inline struct NTFS_DE *hdr_first_de(const struct INDEX_HDR *hdr)struct NTFS_DE *e;u16 esize; -if (de_off >= used || de_off +sizeof (struct NTFS_DE ) > used ) +if (de_off >= used ||size_add (de_off,sizeof (struct NTFS_DE )) > used)return NULL ; e =Add2Ptr (hdr, de_off);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/268 dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit c9c59da76ce9cb3f215b66eb3708cda1134a5206 ]
There is kernel dump when do module test:
sysfs: cannot create duplicate filename /devices/platform/soc@0/44000000.bus/44000000.dma-controller/dma/dma0chan0
__dma_async_device_channel_register+0x128/0x19c dma_async_device_register+0x150/0x454 fsl_edma_probe+0x6cc/0x8a0 platform_probe+0x68/0xc8
fsl_edma_cleanup_vchan will unlink vchan.chan.device_node, while dma_async_device_unregister needs the link to do __dma_async_device_channel_unregister. So need move fsl_edma_cleanup_vchan after dma_async_device_unregister to make sure channel could be freed.
So clean up chan after dma_async_device_unregister to address this.
--- drivers/dma/fsl-edma-main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/fsl-edma-main.c +1 -1
@@ -675,9 +675,9 @@ static int fsl_edma_remove(struct platform_device *pdev)struct fsl_edma_engine *fsl_edma =platform_get_drvdata (pdev);fsl_edma_irq_exit (pdev, fsl_edma); -fsl_edma_cleanup_vchan (&fsl_edma->dma_dev);of_dma_controller_free (np);dma_async_device_unregister (&fsl_edma->dma_dev); +fsl_edma_cleanup_vchan (&fsl_edma->dma_dev);fsl_disable_clocks (fsl_edma, fsl_edma->drvdata->dmamuxs);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/268 iio: adc: ad4130: Fix comparison of channel setups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 280acb19824663d55a3f4d09087c76fabe86fa3c ]
Checking the binary representation of two structs (of the same type) for equality doesn't have the same semantic as comparing all members for equality. The former might find a difference where the latter doesn't in the presence of padding or when ambiguous types like float or bool are involved. (Floats typically have different representations for single values, like -0.0 vs +0.0, or 0.5 * 2² vs 0.25 * 2³. The type bool has at least 8 bits and the raw values 1 and 2 (probably) both evaluate to true, but memcmp finds a difference.)
When searching for a channel that already has the configuration we need, the comparison by member is the one that is needed.
Convert the comparison accordingly to compare the members one after another. Also add a static_assert guard to (somewhat) ensure that when struct ad4130_setup_info is expanded, the comparison is adapted, too.
This issue is somewhat theoretic, but using memcmp() on a struct is a bad pattern that is worth fixing.
--- drivers/iio/adc/ad4130.c | 41 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-)
drivers/iio/adc/ad4130.c +39 -2
@@ -223,6 +223,10 @@ enum ad4130_pin_function { AD4130_PIN_FN_VBIAS = BIT(3), }; +/* +* If you make adaptations in this struct, you most likely also have to adapt +* ad4130_setup_info_eq(), too. +*/ struct ad4130_setup_info {unsigned int iout0_val;unsigned int iout1_val;
@@ -591,6 +595,40 @@ static irqreturn_t ad4130_irq_handler(int irq, void *private)return IRQ_HANDLED ; } +static bool ad4130_setup_info_eq (struct ad4130_setup_info *a, +struct ad4130_setup_info *b) +{ +/* +* This is just to make sure that the comparison is adapted after +* struct ad4130_setup_info was changed. +*/ +static_assert (sizeof (*a) == +sizeof (struct { +unsigned int iout0_val; +unsigned int iout1_val; +unsigned int burnout; +unsigned int pga; +unsigned int fs; +u32 ref_sel; +enum ad4130_filter_mode filter_mode; +bool ref_bufp; +bool ref_bufm; + })); + +if (a->iout0_val != b->iout0_val || + a->iout1_val != b->iout1_val || + a->burnout != b->burnout || + a->pga != b->pga || + a->fs != b->fs || + a->ref_sel != b->ref_sel || + a->filter_mode != b->filter_mode || + a->ref_bufp != b->ref_bufp || + a->ref_bufm != b->ref_bufm) +return false; + +return true; +} +static int ad4130_find_slot (struct ad4130_state *st,struct ad4130_setup_info *target_setup_info,unsigned int *slot,bool *overwrite)
@@ -604,8 +642,7 @@ static int ad4130_find_slot(struct ad4130_state *st,struct ad4130_slot_info *slot_info = &st->slots_info[i];/* Immediately accept a matching setup info. */ -if (!memcmp (target_setup_info, &slot_info->setup, -sizeof (*target_setup_info))) { +if (ad4130_setup_info_eq (target_setup_info, &slot_info->setup)) { *slot = i;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/268 iio: adc: ad7124: Fix comparison of channel configs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 05a5d874f7327b75e9bc4359618017e047cc129c ]
Checking the binary representation of two structs (of the same type) for equality doesn't have the same semantic as comparing all members for equality. The former might find a difference where the latter doesn't in the presence of padding or when ambiguous types like float or bool are involved. (Floats typically have different representations for single values, like -0.0 vs +0.0, or 0.5 * 2² vs 0.25 * 2³. The type bool has at least 8 bits and the raw values 1 and 2 (probably) both evaluate to true, but memcmp finds a difference.)
When searching for a channel that already has the configuration we need, the comparison by member is the one that is needed.
Convert the comparison accordingly to compare the members one after another. Also add a static_assert guard to (somewhat) ensure that when struct ad7124_channel_config::config_props is expanded, the comparison is adapted, too.
This issue is somewhat theoretic, but using memcmp() on a struct is a bad pattern that is worth fixing.
--- drivers/iio/adc/ad7124.c | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-)
drivers/iio/adc/ad7124.c +31 -4
@@ -147,7 +147,11 @@ struct ad7124_chip_info {struct ad7124_channel_config {bool live;unsigned int cfg_slot; -/* Following fields are used to compare equality. */ +/* +* Following fields are used to compare for equality. If you +* make adaptations in it, you most likely also have to adapt +* ad7124_find_similar_live_cfg(), too. +*/ struct_group(config_props, enum ad7124_ref_sel refsel;bool bipolar;
@@ -334,15 +338,38 @@ static struct ad7124_channel_config *ad7124_find_similar_live_cfg(struct ad7124_ struct ad7124_channel_config *cfg) {struct ad7124_channel_config *cfg_aux; -ptrdiff_t cmp_size;int i; - cmp_size = sizeof_field(struct ad7124_channel_config, config_props); +/* +* This is just to make sure that the comparison is adapted after +* struct ad7124_channel_config was changed. +*/ + static_assert(sizeof_field(struct ad7124_channel_config, config_props) == +sizeof (struct { +enum ad7124_ref_sel refsel; +bool bipolar; +bool buf_positive; +bool buf_negative; +unsigned int vref_mv; +unsigned int pga_bits; +unsigned int odr; +unsigned int odr_sel_bits; +unsigned int filter_type; + })); +for (i =0 ; i < st->num_channels; i++) { cfg_aux = &st->channels[i].cfg;if (cfg_aux->live && - !memcmp (&cfg->config_props, &cfg_aux->config_props, cmp_size)) + cfg->refsel == cfg_aux->refsel && + cfg->bipolar == cfg_aux->bipolar && + cfg->buf_positive == cfg_aux->buf_positive && + cfg->buf_negative == cfg_aux->buf_negative && + cfg->vref_mv == cfg_aux->vref_mv && + cfg->pga_bits == cfg_aux->pga_bits && + cfg->odr == cfg_aux->odr && + cfg->odr_sel_bits == cfg_aux->odr_sel_bits && + cfg->filter_type == cfg_aux->filter_type)return cfg_aux; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/268 perf evlist: Add success path to evlist__create_syswide_maps
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit fe0ce8a9d85a48642880c9b78944cb0d23e779c5 ]
Over various refactorings evlist__create_syswide_maps has been made to only ever return with -ENOMEM. Fix this so that when perf_evlist__set_maps is successfully called, 0 is returned.
--- tools/perf/util/evlist.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
tools/perf/util/evlist.c +6 -7
@@ -1362,19 +1362,18 @@ static int evlist__create_syswide_maps(struct evlist *evlist)*/ cpus =perf_cpu_map__new (NULL );if (!cpus) - goto out; +return -ENOMEM ; threads =perf_thread_map__new_dummy (); -if (!threads) - goto out_put; +if (!threads) { +perf_cpu_map__put (cpus); +return -ENOMEM ; + }perf_evlist__set_maps (&evlist->core, cpus, threads); -perf_thread_map__put (threads); -out_put:perf_cpu_map__put (cpus); -out: -return -ENOMEM ; +return 0 ; }int evlist__open (struct evlist *evlist)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/268 perf units: Fix insufficient array space
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit cf67629f7f637fb988228abdb3aae46d0c1748fe ]
No need to specify the array size, let the compiler figure that out.
This addresses this compiler warning that was noticed while build testing on fedora rawhide:
31 15.81 fedora:rawhide : FAIL gcc version 15.0.1 20250225 (Red Hat 15.0.1-0) (GCC)
util/units.c: In function 'unit_number__scnprintf':
util/units.c:67:24: error: initializer-string for array of 'char' is too long [-Werror=unterminated-string-initialization]
67 | char unit[4] = "BKMG";
| ^~~~~~
cc1: all warnings being treated as errors
--- tools/perf/util/units.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/units.c +1 -1
@@ -64,7 +64,7 @@ unsigned long convert_unit(unsigned long value, char *unit)int unit_number__scnprintf (char *buf,size_t size,u64 n) { -char unit[4 ] ="BKMG" ; +char unit[] ="BKMG" ;int i =0 ;while (((n /1024 ) >1 ) && (i <3 )) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/268 kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit 096cbb80ab3fd85a9035ec17a1312c2a7db8bc8c ]
Ever since commit b756a3b5e7ea ("mm: device exclusive memory access") we can return with a device-exclusive entry from page_vma_mapped_walk().
__replace_page() is not prepared for that, so teach it about these PFN swap PTEs. Note that device-private entries are so far not applicable on that path, because GUP would never have returned such folios (conversion to device-private happens by page migration, not in-place conversion of the PTE).
There is a race between GUP and us locking the folio to look it up using page_vma_mapped_walk(), so this is likely a fix (unless something else could prevent that race, but it doesn't look like). pte_pfn() on something that is not a present pte could give use garbage, and we'd wrongly mess up the mapcount because it was already adjusted by calling folio_remove_rmap_pte() when making the entry device-exclusive.
--- kernel/events/uprobes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
kernel/events/uprobes.c +12 -1
@@ -159,6 +159,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,DEFINE_FOLIO_VMA_WALK (pvmw, old_folio, vma, addr,0 );int err;struct mmu_notifier_range range; +pte_t pte;mmu_notifier_range_init (&range,MMU_NOTIFY_CLEAR ,0 , mm, addr, addr +PAGE_SIZE );
@@ -178,6 +179,16 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,if (!page_vma_mapped_walk (&pvmw)) goto unlock;VM_BUG_ON_PAGE (addr != pvmw.address, old_page); + pte =ptep_get (pvmw.pte); + +/* +* Handle PFN swap PTES, such as device-exclusive ones, that actually +* map pages: simply trigger GUP again to fix it up. +*/ +if (unlikely (!pte_present (pte))) { +page_vma_mapped_walk_done (&pvmw); + goto unlock; + }if (new_page) {folio_get (new_folio);
@@ -192,7 +203,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,inc_mm_counter (mm,MM_ANONPAGES ); } -flush_cache_page (vma, addr,pte_pfn (ptep_get (pvmw.pte))); +flush_cache_page (vma, addr,pte_pfn (pte));ptep_clear_flush (vma, addr, pvmw.pte);if (new_page) set_pte_at_notify(mm, addr, pvmw.pte,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/268 kexec: initialize ELF lowest address to ULONG_MAX
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <[email protected]>
[ Upstream commit 9986fb5164c8b21f6439cfd45ba36d8cc80c9710 ]
Patch series "powerpc/crash: use generic crashkernel reservation", v3.
Commit 0ab97169aa05 ("crash_core: add generic function to do reservation") added a generic function to reserve crashkernel memory. So let's use the same function on powerpc and remove the architecture-specific code that essentially does the same thing.
The generic crashkernel reservation also provides a way to split the crashkernel reservation into high and low memory reservations, which can be enabled for powerpc in the future.
Additionally move powerpc to use generic APIs to locate memory hole for kexec segments while loading kdump kernel.
This patch (of 7):
kexec_elf_load() loads an ELF executable and sets the address of the lowest PT_LOAD section to the address held by the lowest_load_addr function argument.
To determine the lowest PT_LOAD address, a local variable lowest_addr (type unsigned long) is initialized to UINT_MAX. After loading each PT_LOAD, its address is compared to lowest_addr. If a loaded PT_LOAD address is lower, lowest_addr is updated. However, setting lowest_addr to UINT_MAX won't work when the kernel image is loaded above 4G, as the returned lowest PT_LOAD address would be invalid. This is resolved by initializing lowest_addr to ULONG_MAX instead.
This issue was discovered while implementing crashkernel high/low reservation on the PowerPC architecture.
--- kernel/kexec_elf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kexec_elf.c +1 -1
@@ -390,7 +390,7 @@ int kexec_elf_load(struct kimage *image, struct elfhdr *ehdr,struct kexec_buf *kbuf, unsigned long *lowest_load_addr) { - unsigned long lowest_addr = UINT_MAX; + unsigned long lowest_addr = ULONG_MAX;int ret;size_t i;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/268 ocfs2: validate l_tree_depth to avoid out-of-bounds access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
[ Upstream commit a406aff8c05115119127c962cbbbbd202e1973ef ]
The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.
Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].
--- fs/ocfs2/alloc.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ocfs2/alloc.c +8 -0
@@ -1796,6 +1796,14 @@ static int __ocfs2_find_path(struct ocfs2_caching_info *ci, el = root_el;while (el->l_tree_depth) { +if (unlikely (le16_to_cpu (el->l_tree_depth) >=OCFS2_MAX_PATH_DEPTH )) { +ocfs2_error (ocfs2_metadata_cache_get_super (ci), +"Owner %llu has invalid tree depth %u in extent list\n" , + (unsigned long long )ocfs2_metadata_cache_owner (ci), +le16_to_cpu (el->l_tree_depth)); + ret = -EROFS ; + goto out; + }if (le16_to_cpu (el->l_next_free_rec) ==0 ) { ocfs2_error(ocfs2_metadata_cache_get_super(ci), "Owner %llu has empty extent list at depth %u\n",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/268 arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anshuman Khandual <[email protected]>
[ Upstream commit 2c5e6ac2db64ace51f66a9f3b3b3ab9553d748e8 ]
GENERIC_PTDUMP gets selected on powerpc explicitly and hence can be dropped off from mpc885_ads_defconfig. Replace with CONFIG_PTDUMP_DEBUGFS instead.
--- arch/powerpc/configs/mpc885_ads_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/configs/mpc885_ads_defconfig +1 -1
@@ -78,4 +78,4 @@ CONFIG_DEBUG_VM_PGTABLE=y CONFIG_DETECT_HUNG_TASK=y CONFIG_BDI_SWITCH=y CONFIG_PPC_EARLY_DEBUG=y -CONFIG_GENERIC_PTDUMP=y +CONFIG_PTDUMP_DEBUGFS=y
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/268 NFSv4: Dont trigger uneccessary scans for return-on-close delegations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 47acca884f714f41d95dc654f802845544554784 ]
The amount of looping through the list of delegations is occasionally leading to soft lockups. Avoid at least some loops by not requiring the NFSv4 state manager to scan for delegations that are marked for return-on-close. Instead, either mark them for immediate return (if possible) or else leave it up to nfs4_inode_return_delegation_on_close() to return them once the file is closed by the application.
--- fs/nfs/delegation.c | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-)
fs/nfs/delegation.c +18 -15
@@ -570,17 +570,6 @@ static bool nfs_delegation_need_return(struct nfs_delegation *delegation)if (test_and_clear_bit (NFS_DELEGATION_RETURN , &delegation->flags)) ret = true; -else if (test_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags)) { -struct inode *inode; - -spin_lock (&delegation->lock); - inode = delegation->inode; -if (inode &&list_empty (&NFS_I (inode)->open_files)) - ret = true; -spin_unlock (&delegation->lock); - } -if (ret) -clear_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags);if (test_bit (NFS_DELEGATION_RETURNING , &delegation->flags) ||test_bit (NFS_DELEGATION_RETURN_DELAYED , &delegation->flags) ||test_bit (NFS_DELEGATION_REVOKED , &delegation->flags))
@@ -821,11 +810,25 @@ int nfs4_inode_make_writeable(struct inode *inode)return nfs4_inode_return_delegation (inode); } -static void nfs_mark_return_if_closed_delegation (struct nfs_server *server, -struct nfs_delegation *delegation) +static void +nfs_mark_return_if_closed_delegation (struct nfs_server *server, +struct nfs_delegation *delegation) { -set_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags); -set_bit (NFS4CLNT_DELEGRETURN , &server->nfs_client->cl_state); +struct inode *inode; + +if (test_bit (NFS_DELEGATION_RETURN , &delegation->flags) || +test_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags)) +return ; +spin_lock (&delegation->lock); + inode = delegation->inode; +if (!inode) + goto out; +if (list_empty (&NFS_I (inode)->open_files)) +nfs_mark_return_delegation (server, delegation); +else +set_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags); +out: +spin_unlock (&delegation->lock); }static bool nfs_server_mark_return_all_delegations (struct nfs_server *server)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/268 fuse: fix dax truncate/punch_hole fault path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Popple <[email protected]>
[ Upstream commit 7851bf649d423edd7286b292739f2eefded3d35c ]
Patch series "fs/dax: Fix ZONE_DEVICE page reference counts", v9.
Device and FS DAX pages have always maintained their own page reference counts without following the normal rules for page reference counting. In particular pages are considered free when the refcount hits one rather than zero and refcounts are not added when mapping the page.
Tracking this requires special PTE bits (PTE_DEVMAP) and a secondary mechanism for allowing GUP to hold references on the page (see get_dev_pagemap). However there doesn't seem to be any reason why FS DAX pages need their own reference counting scheme.
By treating the refcounts on these pages the same way as normal pages we can remove a lot of special checks. In particular pXd_trans_huge() becomes the same as pXd_leaf(), although I haven't made that change here. It also frees up a valuable SW define PTE bit on architectures that have devmap PTE bits defined.
It also almost certainly allows further clean-up of the devmap managed functions, but I have left that as a future improvment. It also enables support for compound ZONE_DEVICE pages which is one of my primary motivators for doing this work.
This patch (of 20):
FS DAX requires file systems to call into the DAX layout prior to unlinking inodes to ensure there is no ongoing DMA or other remote access to the direct mapped page. The fuse file system implements fuse_dax_break_layouts() to do this which includes a comment indicating that passing dmap_end == 0 leads to unmapping of the whole file.
However this is not true - passing dmap_end == 0 will not unmap anything before dmap_start, and further more dax_layout_busy_page_range() will not scan any of the range to see if there maybe ongoing DMA access to the range. Fix this by passing -1 for dmap_end to fuse_dax_break_layouts() which will invalidate the entire file range to dax_layout_busy_page_range().
--- fs/fuse/dax.c | 1 - fs/fuse/dir.c | 2 +- fs/fuse/file.c | 4 ++-- 3 files changed, 3 insertions(+), 4 deletions(-)
fs/fuse/dax.c +0 -1
@@ -681,7 +681,6 @@ static int __fuse_dax_break_layouts(struct inode *inode, bool *retry, 0, 0, fuse_wait_dax_page(inode)); } -/* dmap_end == 0 leads to unmapping of whole file */ int fuse_dax_break_layouts (struct inode *inode,u64 dmap_start,u64 dmap_end) {
fs/fuse/dir.c +1 -1
@@ -1875,7 +1875,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,if (FUSE_IS_DAX (inode) && is_truncate) {filemap_invalidate_lock (mapping); fault_blocked = true; - err =fuse_dax_break_layouts (inode,0 ,0 ); + err =fuse_dax_break_layouts (inode,0 ,-1 );if (err) {filemap_invalidate_unlock (mapping);return err;
fs/fuse/file.c +2 -2
@@ -241,7 +241,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)if (dax_truncate) {filemap_invalidate_lock (inode->i_mapping); - err =fuse_dax_break_layouts (inode,0 ,0 ); + err =fuse_dax_break_layouts (inode,0 ,-1 );if (err) goto out_inode_unlock; }
@@ -3023,7 +3023,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,inode_lock (inode);if (block_faults) {filemap_invalidate_lock (inode->i_mapping); - err =fuse_dax_break_layouts (inode,0 ,0 ); + err =fuse_dax_break_layouts (inode,0 ,-1 );if (err) goto out; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/268 selftests/mm/cow: fix the incorrect error handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyan Yang <[email protected]>
[ Upstream commit f841ad9ca5007167c02de143980c9dc703f90b3d ]
Error handling doesn't check the correct return value. This patch will fix it.
--- tools/testing/selftests/mm/cow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/mm/cow.c +1 -1
@@ -812,7 +812,7 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run) mremap_size = thpsize /2 ; mremap_mem =mmap (NULL , mremap_size,PROT_NONE ,MAP_PRIVATE |MAP_ANONYMOUS ,-1 ,0 ); -if (mem ==MAP_FAILED ) { +if (mremap_mem ==MAP_FAILED ) {ksft_test_result_fail ("mmap() failed\n" ); goto munmap; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/268 um: remove copy_from_kernel_nofault_allowed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 84a6fc378471fbeaf48f8604566a5a33a3d63c18 ]
There is no need to override the default version of this function anymore as UML now has proper _nofault memory access functions.
Doing this also fixes the fact that the implementation was incorrect as using mincore() will incorrectly flag pages as inaccessible if they were swapped out by the host.
--- arch/um/include/shared/os.h | 1 - arch/um/kernel/Makefile | 2 +- arch/um/kernel/maccess.c | 19 -------------- arch/um/os-Linux/process.c | 51 ------------------------------------- 4 files changed, 1 insertion(+), 72 deletions(-) delete mode 100644 arch/um/kernel/maccess.c
arch/um/include/shared/os.h +0 -1
@@ -211,7 +211,6 @@ extern int os_protect_memory(void *addr, unsigned long len,extern int os_unmap_memory (void *addr,int len);extern int os_drop_memory (void *addr,int length);extern int can_drop_memory (void ); -extern int os_mincore (void *addr,unsigned long len);/* execvp.c */ extern int execvp_noalloc (char *buf,const char *file,char *const argv[]);
arch/um/kernel/Makefile +1 -1
@@ -17,7 +17,7 @@ extra-y := vmlinux.lds obj-y = config.o exec.o exitcode.o irq.o ksyms.o mem.o \ physmem.o process.o ptrace.o reboot.o sigio.o \ signal.o sysrq.o time.o tlb.o trap.o \ - um_arch.o umid.o maccess.o kmsg_dump.o capflags.o skas/ + um_arch.o umid.o kmsg_dump.o capflags.o skas/ obj-y += load_file.o obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o
arch/um/kernel/maccess.c deleted +0 -19
@@ -1,19 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-only -/* -* Copyright (C) 2013 Richard Weinberger <[email protected]> -*/ - -#include <linux/uaccess.h> -#include <linux/kernel.h> -#include <os.h> - -bool copy_from_kernel_nofault_allowed (const void *src,size_t size) -{ -void *psrc = (void *)rounddown ((unsigned long )src,PAGE_SIZE ); - -if ((unsigned long )src <PAGE_SIZE || size <=0 ) -return false; -if (os_mincore (psrc, size + src - psrc) <=0 ) -return false; -return true; -}
arch/um/os-Linux/process.c +0 -51
57 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/268 um: hostfs: avoid issues on inode number reuse by host
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 0bc754d1e31f40f4a343b692096d9e092ccc0370 ]
Some file systems (e.g. ext4) may reuse inode numbers once the inode is not in use anymore. Usually hostfs will keep an FD open for each inode, but this is not always the case. In the case of sockets, this cannot even be done properly.
As such, the following sequence of events was possible:
* application creates and deletes a socket
* hostfs creates/deletes the socket on the host
* inode is still in the hostfs cache
* hostfs creates a new file
* ext4 on the outside reuses the inode number
* hostfs finds the socket inode for the newly created file
* application receives -ENXIO when opening the file
As mentioned, this can only happen if the deleted file is a special file that is never opened on the host (i.e. no .open fop).
As such, to prevent issues, it is sufficient to check that the inode has the expected type. That said, also add a check for the inode birth time, just to be on the safe side.
--- fs/hostfs/hostfs.h | 2 +- fs/hostfs/hostfs_kern.c | 7 ++++- fs/hostfs/hostfs_user.c | 59 ++++++++++++++++++++++++----------------- 3 files changed, 41 insertions(+), 27 deletions(-)
fs/hostfs/hostfs.h +1 -1
@@ -60,7 +60,7 @@ struct hostfs_stat {unsigned int uid;unsigned int gid;unsigned long long size; -struct hostfs_timespec atime, mtime, ctime; +struct hostfs_timespec atime, mtime, ctime, btime;unsigned int blksize;unsigned long long blocks;struct {
fs/hostfs/hostfs_kern.c +6 -1
@@ -27,6 +27,7 @@ struct hostfs_inode_info {struct inode vfs_inode;struct mutex open_mutex;dev_t dev; +struct hostfs_timespec btime; };static inline struct hostfs_inode_info *HOSTFS_I (struct inode *inode)
@@ -557,6 +558,7 @@ static int hostfs_inode_set(struct inode *ino, void *data) }HOSTFS_I (ino)->dev = dev; +HOSTFS_I (ino)->btime = st->btime; ino->i_ino = st->ino; ino->i_mode = st->mode;return hostfs_inode_update (ino, st);
@@ -567,7 +569,10 @@ static int hostfs_inode_test(struct inode *inode, void *data)const struct hostfs_stat *st = data;dev_t dev =MKDEV (st->dev.maj, st->dev.min); -return inode->i_ino == st->ino &&HOSTFS_I (inode)->dev == dev; +return inode->i_ino == st->ino &&HOSTFS_I (inode)->dev == dev && + (inode->i_mode &S_IFMT ) == (st->mode &S_IFMT ) && +HOSTFS_I (inode)->btime.tv_sec == st->btime.tv_sec && +HOSTFS_I (inode)->btime.tv_nsec == st->btime.tv_nsec; }static struct inode *hostfs_iget (struct super_block *sb,char *name)
fs/hostfs/hostfs_user.c +34 -25
73 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/268 i3c: master: svc: Fix missing the IBI rules
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chu <[email protected]>
[ Upstream commit 9cecad134d84d14dc72a0eea7a107691c3e5a837 ]
The code does not add IBI rules for devices with controller capability. However, the secondary controller has the controller capability and works at target mode when the device is probed. Therefore, add IBI rules for such devices.
--- drivers/i3c/master/svc-i3c-master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i3c/master/svc-i3c-master.c +1 -1
@@ -951,7 +951,7 @@ static int svc_i3c_update_ibirules(struct svc_i3c_master *master)/* Create the IBIRULES register for both cases */ i3c_bus_for_each_i3cdev (&master->base.bus, dev) { -if (I3C_BCR_DEVICE_ROLE (dev->info.bcr) ==I3C_BCR_I3C_MASTER ) +if (!(dev->info.bcr &I3C_BCR_IBI_REQ_CAP ))continue ;if (dev->info.bcr &I3C_BCR_IBI_PAYLOAD ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/268 perf python: Fixup description of sample.id event member
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 1376c195e8ad327bb9f2d32e0acc5ac39e7cb30a ]
Some old cut'n'paste error, its "ip", so the description should be "event ip", not "event type".
--- tools/perf/util/python.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/python.c +1 -1
@@ -238,7 +238,7 @@ struct pyrf_event { };#define sample_members \ - sample_member_def(sample_ip, ip, T_ULONGLONG, "event type"), \ + sample_member_def(sample_ip, ip, T_ULONGLONG, "event ip"), \ sample_member_def(sample_pid, pid, T_INT, "event pid"), \ sample_member_def(sample_tid, tid, T_INT, "event tid"), \ sample_member_def(sample_time, time, T_ULONGLONG, "event timestamp"), \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/268 perf python: Decrement the refcount of just created event on failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 3de5a2bf5b4847f7a59a184568f969f8fe05d57f ]
To avoid a leak if we have the python object but then something happens and we need to return the operation, decrement the offset of the newly created object.
--- tools/perf/util/python.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
tools/perf/util/python.c +5 -1
@@ -1170,6 +1170,7 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist, evsel =evlist__event2evsel (evlist, event);if (!evsel) { +Py_DECREF (pyevent);Py_INCREF (Py_None);return Py_None; }
@@ -1181,9 +1182,12 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,/* Consume the even only after we parsed it out. */ perf_mmap__consume (&md->core); -if (err) +if (err) { +Py_DECREF (pyevent);return PyErr_Format (PyExc_OSError,"perf: can't parse sample, err=%d" , err); + } +return pyevent; } end:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/268 perf python: Dont keep a raw_data pointer to consumed ring buffer space
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit f3fed3ae34d606819d87a63d970cc3092a5be7ab ]
When processing tracepoints the perf python binding was parsing the event before calling perf_mmap__consume(&md->core) in pyrf_evlist__read_on_cpu().
But part of this event parsing was to set the perf_sample->raw_data pointer to the payload of the event, which then could be overwritten by other event before tracepoint fields were asked for via event.prev_comm in a python program, for instance.
This also happened with other fields, but strings were were problems were surfacing, as there is UTF-8 validation for the potentially garbled data.
This ended up showing up as (with some added debugging messages):
( field 'prev_comm' ret=0x7f7c31f65110, raw_size=68 ) ( field 'prev_pid' ret=0x7f7c23b1bed0, raw_size=68 ) ( field 'prev_prio' ret=0x7f7c239c0030, raw_size=68 ) ( field 'prev_state' ret=0x7f7c239c0250, raw_size=68 ) time 14771421785867 prev_comm= prev_pid=1919907691 prev_prio=796026219 prev_state=0x303a32313175 ==> ( XXX '��' len=16, raw_size=68) ( field 'next_comm' ret=(nil), raw_size=68 ) Traceback (most recent call last):
File "/home/acme/git/perf-tools-next/tools/perf/python/tracepoint.py", line 51, in <module>
main()
File "/home/acme/git/perf-tools-next/tools/perf/python/tracepoint.py", line 46, in main
event.next_comm,
^^^^^^^^^^^^^^^ AttributeError: 'perf.sample_event' object has no attribute 'next_comm'
When event.next_comm was asked for, the PyUnicode_FromString() python API would fail and that tracepoint field wouldn't be available, stopping the tools/perf/python/tracepoint.py test tool.
But, since we already do a copy of the whole event in pyrf_event__new, just use it and while at it remove what was done in in e8968e654191390a ("perf python: Fix pyrf_evlist__read_on_cpu event consuming") because we don't really need to wait for parsing the sample before declaring the event as consumed.
This copy is questionable as is now, as it limits the maximum event + sample_type and tracepoint payload to sizeof(union perf_event), this all has been "working" because 'struct perf_event_mmap2', the largest entry in 'union perf_event' is:
$ pahole -C perf_event ~/bin/perf | grep mmap2 struct perf_record_mmap2 mmap2; /* 0 4168 */ $
--- tools/perf/util/python.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
tools/perf/util/python.c +1 -3
@@ -1177,11 +1177,9 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist, pevent->evsel = evsel; - err =evsel__parse_sample (evsel, event, &pevent->sample); - -/* Consume the even only after we parsed it out. */ perf_mmap__consume (&md->core); + err =evsel__parse_sample (evsel, &pevent->event, &pevent->sample);if (err) {Py_DECREF (pyevent); return PyErr_Format(PyExc_OSError,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/268 perf python: Check if there is space to copy all the event
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 89aaeaf84231157288035b366cb6300c1c6cac64 ]
The pyrf_event__new() method copies the event obtained from the perf ring buffer to a structure that will then be turned into a python object for further consumption, so it copies perf_event.header.size bytes to its 'event' member:
$ pahole -C pyrf_event /tmp/build/perf-tools-next/python/perf.cpython-312-x86_64-linux-gnu.so
struct pyrf_event {
PyObject ob_base; /* 0 16 */
struct evsel * evsel; /* 16 8 */
struct perf_sample sample; /* 24 312 *//* XXX last struct has 7 bytes of padding, 2 holes */
/* --- cacheline 5 boundary (320 bytes) was 16 bytes ago --- */
union perf_event event; /* 336 4168 */
/* size: 4504, cachelines: 71, members: 4 */ /* member types with holes: 1, total: 2 */ /* paddings: 1, sum paddings: 7 */ /* last cacheline: 24 bytes */ };
$
It was doing so without checking if the event just obtained has more than that space, fix it.
This isn't a proper, final solution, as we need to support larger events, but for the time being we at least bounds check and document it.
--- tools/perf/util/python.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/perf/util/python.c +5 -0
@@ -671,6 +671,11 @@ static PyObject *pyrf_event__new(union perf_event *event) event->header.type == PERF_RECORD_SWITCH_CPU_WIDE))return NULL ; +// FIXME this better be dynamic or we need to parse everything +// before calling perf_mmap__consume(), including tracepoint fields. +if (sizeof (pevent->event) < event->header.size) +return NULL ; + ptype = pyrf_event__type[event->header.type]; pevent = PyObject_New(struct pyrf_event, ptype);if (pevent !=NULL )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/268 staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: 谢致邦 (XIE Zhibang) <[email protected]>
[ Upstream commit b2a9a6a26b7e954297e51822e396572026480bad ]
This fixes the following issue:
ERROR: modpost: "aes_expandkey" [drivers/staging/rtl8723bs/r8723bs.ko] undefined!
ERROR: modpost: "aes_encrypt" [drivers/staging/rtl8723bs/r8723bs.ko] undefined!
--- drivers/staging/rtl8723bs/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/staging/rtl8723bs/Kconfig +1 -0
@@ -5,6 +5,7 @@ config RTL8723BS depends on m select CFG80211_WEXT select CRYPTO + select CRYPTO_LIB_AES select CRYPTO_LIB_ARC4 help This option enables support for RTL8723BS SDIO drivers, such as
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/268 tty: n_tty: use uint for space returned by tty_write_room()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit d97aa066678bd1e2951ee93db9690835dfe57ab6 ]
tty_write_room() returns an "unsigned int". So in case some insane driver (like my tty test driver) returns (legitimate) UINT_MAX from its tty_operations::write_room(), n_tty is confused on several places.
For example, in process_output_block(), the result of tty_write_room() is stored into (signed) "int". So this UINT_MAX suddenly becomes -1. And that is extended to ssize_t and returned from process_output_block(). This causes a write() to such a node to receive -EPERM (which is -1).
Fix that by using proper "unsigned int" and proper "== 0" test. And return 0 constant directly in that "if", so that it is immediately clear what is returned ("space" equals to 0 at that point).
Similarly for process_output() and __process_echoes().
Note this does not fix any in-tree driver as of now.
If you want "Fixes: something", it would be commit 03b3b1a2405c ("tty:
make tty_operations::write_room return uint"). I intentionally do not mark this patch by a real tag below.
--- drivers/tty/n_tty.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/tty/n_tty.c +7 -6
@@ -491,7 +491,8 @@ static int do_output_char(u8 c, struct tty_struct *tty, int space)static int process_output (u8 c,struct tty_struct *tty) {struct n_tty_data *ldata = tty->disc_data; -int space, retval; +unsigned int space; +int retval;mutex_lock (&ldata->output_lock);
@@ -527,16 +528,16 @@ static ssize_t process_output_block(struct tty_struct *tty, const u8 *buf, unsigned int nr) {struct n_tty_data *ldata = tty->disc_data; -int space; -int i; +unsigned int space; +int i;const u8 *cp;mutex_lock (&ldata->output_lock); space =tty_write_room (tty); -if (space <=0 ) { +if (space ==0 ) {mutex_unlock (&ldata->output_lock); -return space; +return 0 ; }if (nr > space) nr = space;
@@ -701,7 +702,7 @@ static int n_tty_process_echo_ops(struct tty_struct *tty, size_t *tail,static size_t __process_echoes (struct tty_struct *tty) {struct n_tty_data *ldata = tty->disc_data; -int space, old_space; +unsigned int space, old_space;size_t tail;u8 c;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/268 fs/procfs: fix the comment above proc_pid_wchan()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit 6287fbad1cd91f0c25cdc3a580499060828a8f30 ]
proc_pid_wchan() used to report kernel addresses to user space but that is no longer the case today. Bring the comment above proc_pid_wchan() in sync with the implementation.
--- fs/proc/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/proc/base.c +1 -1
@@ -416,7 +416,7 @@ static const struct file_operations proc_pid_cmdline_ops = {#ifdef CONFIG_KALLSYMS /* * Provides a wchan file via kallsyms in a proper one-value-per-file format. -* Returns the resolved symbol. If that fails, simply return the address. +* Returns the resolved symbol to user space. */ static int proc_pid_wchan (struct seq_file *m,struct pid_namespace *ns,struct pid *pid,struct task_struct *task)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/268 perf tools: annotate asm_pure_loop.S
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcus Meissner <[email protected]>
[ Upstream commit 9a352a90e88a041f4b26d359493e12a7f5ae1a6a ]
Annotate so it is built with non-executable stack.
--- tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S +2 -0
@@ -26,3 +26,5 @@ skip: mov x0, #0 mov x8, #93 // __NR_exit syscall svc #0 + +.section .note.GNU-stack, "", @progbits
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/268 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit e63d465f59011dede0a0f1d21718b59a64c3ff5c ]
If dib8000_set_dds()'s call to dib8000_read32() returns zero, the result is a divide-by-zero. Prevent that from happening.
Fixes the following warning with an UBSAN kernel:
drivers/media/dvb-frontends/dib8000.o: warning: objtool: dib8000_tune() falls through to next function dib8096p_cfg_DibRx()
--- drivers/media/dvb-frontends/dib8000.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/dib8000.c +4 -1
@@ -2701,8 +2701,11 @@ static void dib8000_set_dds(struct dib8000_state *state, s32 offset_khz)u8 ratio;if (state->revision ==0x8090 ) { +u32 internal =dib8000_read32 (state,23 ) /1000 ; + ratio =4 ; - unit_khz_dds_val = (1 <<26 ) / (dib8000_read32 (state,23 ) /1000 ); + + unit_khz_dds_val = (1 <<26 ) / (internal ?:1 );if (offset_khz <0 ) dds = (1 <<26 ) - (abs_offset_khz * unit_khz_dds_val);else
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/268 NFS: Shut down the nfs_client only after all the superblocks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 2d3e998a0bc7fe26a724f87a8ce217848040520e ]
The nfs_client manages state for all the superblocks in the "cl_superblocks" list, so it must not be shut down until all of them are gone.
--- fs/nfs/sysfs.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
fs/nfs/sysfs.c +21 -1
@@ -14,6 +14,7 @@#include <linux/rcupdate.h> #include <linux/lockd/lockd.h> +#include "internal.h" #include "nfs4_fs.h" #include "netns.h" #include "sysfs.h"
@@ -228,6 +229,25 @@ static void shutdown_client(struct rpc_clnt *clnt)rpc_cancel_tasks (clnt, -EIO , shutdown_match_client,NULL ); } +/* +* Shut down the nfs_client only once all the superblocks +* have been shut down. +*/ +static void shutdown_nfs_client (struct nfs_client *clp) +{ +struct nfs_server *server; +rcu_read_lock (); +list_for_each_entry_rcu (server, &clp->cl_superblocks, client_link) { +if (!(server->flags &NFS_MOUNT_SHUTDOWN )) { +rcu_read_unlock (); +return ; + } + } +rcu_read_unlock (); +nfs_mark_client_ready (clp, -EIO ); +shutdown_client (clp->cl_rpcclient); +} +static ssize_t shutdown_show (struct kobject *kobj,struct kobj_attribute *attr,char *buf)
@@ -259,7 +279,6 @@ shutdown_store(struct kobject *kobj, struct kobj_attribute *attr, server->flags |=NFS_MOUNT_SHUTDOWN ;shutdown_client (server->client); -shutdown_client (server->nfs_client->cl_rpcclient);if (!IS_ERR (server->client_acl))shutdown_client (server->client_acl);
@@ -267,6 +286,7 @@ shutdown_store(struct kobject *kobj, struct kobj_attribute *attr,if (server->nlm_host)shutdown_client (server->nlm_host->h_rpcclnt); out: +shutdown_nfs_client (server->nfs_client);return count; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/268 smb: client: Fix netns refcount imbalance causing leaks and use-after-free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Zhaolong <[email protected]>
[ Upstream commit 4e7f1644f2ac6d01dc584f6301c3b1d5aac4eaef ]
Commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") attempted to fix a netns use-after-free issue by manually adjusting reference counts via sk->sk_net_refcnt and sock_inuse_add().
However, a later commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod") pointed out that the approach of manually setting sk->sk_net_refcnt in the first commit was technically incorrect, as sk->sk_net_refcnt should only be set for user sockets. It led to issues like TCP timers not being cleared properly on close. The second commit moved to a model of just holding an extra netns reference for server->ssocket using get_net(), and dropping it when the server is torn down.
But there remain some gaps in the get_net()/put_net() balancing added by these commits. The incomplete reference handling in these fixes results in two issues:
1. Netns refcount leaks[1]
The problem process is as follows:
```
mount.cifs cifsd
cifs_do_mount
cifs_mount
cifs_mount_get_session
cifs_get_tcp_session
get_net() /* First get net. */
ip_connect
generic_ip_connect /* Try port 445 */
get_net()
->connect() /* Failed */
put_net()
generic_ip_connect /* Try port 139 */
get_net() /* Missing matching put_net() for this get_net().*/
cifs_get_smb_ses
cifs_negotiate_protocol
smb2_negotiate
SMB2_negotiate
cifs_send_recv
wait_for_response
cifs_demultiplex_thread
cifs_read_from_socket
cifs_readv_from_socket
cifs_reconnect
cifs_abort_connection
sock_release();
server->ssocket = NULL;
/* Missing put_net() here. */
generic_ip_connect
get_net()
->connect() /* Failed */
put_net()
sock_release();
server->ssocket = NULL;
free_rsp_buf
...
clean_demultiplex_info
/* It's only called once here. */
put_net()
```When cifs_reconnect() is triggered, the server->ssocket is released without a corresponding put_net() for the reference acquired in generic_ip_connect() before. it ends up calling generic_ip_connect() again to retry get_net(). After that, server->ssocket is set to NULL in the error path of generic_ip_connect(), and the net count cannot be released in the final clean_demultiplex_info() function.
2. Potential use-after-free
The current refcounting scheme can lead to a potential use-after-free issue in the following scenario:
```
cifs_do_mount
cifs_mount
cifs_mount_get_session
cifs_get_tcp_session
get_net() /* First get net */
ip_connect
generic_ip_connect
get_net()
bind_socket
kernel_bind /* failed */
put_net()
/* after out_err_crypto_release label */
put_net()
/* after out_err label */
put_net()
```In the exception handling process where binding the socket fails, the get_net() and put_net() calls are unbalanced, which may cause the server->net reference count to drop to zero and be prematurely released.
To address both issues, this patch ties the netns reference counting to the server->ssocket and server lifecycles. The extra reference is now acquired when the server or socket is created, and released when the socket is destroyed or the server is torn down.
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=219792
--- fs/smb/client/connect.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
fs/smb/client/connect.c +8 -8
@@ -316,6 +316,7 @@ cifs_abort_connection(struct TCP_Server_Info *server) server->ssocket->flags);sock_release (server->ssocket); server->ssocket =NULL ; +put_net (cifs_net_ns (server)); } server->sequence_number =0 ; server->session_estab = false;
@@ -3147,8 +3148,12 @@ generic_ip_connect(struct TCP_Server_Info *server)/* * Grab netns reference for the socket. * -* It'll be released here, on error, or in clean_demultiplex_info() upon server -* teardown. +* This reference will be released in several situations: +* - In the failure path before the cifsd thread is started. +* - In the all place where server->socket is released, it is +* also set to NULL. +* - Ultimately in clean_demultiplex_info(), during the final +* teardown. */ get_net (net);
@@ -3164,10 +3169,8 @@ generic_ip_connect(struct TCP_Server_Info *server) } rc =bind_socket (server); -if (rc <0 ) { -put_net (cifs_net_ns (server)); +if (rc <0 )return rc; - }/* * Eventually check for other socket options to change from
@@ -3213,9 +3216,6 @@ generic_ip_connect(struct TCP_Server_Info *server)if (sport ==htons (RFC1001_PORT )) rc =ip_rfc1001_connect (server); -if (rc <0 ) -put_net (cifs_net_ns (server)); -return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 144/268 exfat: fix the infinite loop in exfat_find_last_cluster()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit b0522303f67255926b946aa66885a0104d1b2980 ]
In exfat_find_last_cluster(), the cluster chain is traversed until the EOF cluster. If the cluster chain includes a loop due to file system corruption, the EOF cluster cannot be traversed, resulting in an infinite loop.
If the number of clusters indicated by the file size is inconsistent with the cluster chain length, exfat_find_last_cluster() will return an error, so if this inconsistency is found, the traversal can be aborted without traversing to the EOF cluster.
--- fs/exfat/fatent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/exfat/fatent.c +1 -1
@@ -265,7 +265,7 @@ int exfat_find_last_cluster(struct super_block *sb, struct exfat_chain *p_chain, clu = next;if (exfat_ent_get (sb, clu, &next))return -EIO ; - }while (next !=EXFAT_EOF_CLUSTER ); + }while (next !=EXFAT_EOF_CLUSTER && count <= p_chain->size);if (p_chain->size != count) { exfat_fs_error(sb,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 145/268 rtnetlink: Allocate vfinfo size for VF GUIDs when supported
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Zhang <[email protected]>
[ Upstream commit 23f00807619d15063d676218f36c5dfeda1eb420 ]
Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs") added support for getting VF port and node GUIDs in netlink ifinfo messages, but their size was not taken into consideration in the function that allocates the netlink message, causing the following warning when a netlink message is filled with many VF port and node GUIDs:
# echo 64 > /sys/bus/pci/devices/0000\:08\:00.0/sriov_numvfs # ip link show dev ib0 RTNETLINK answers: Message too long Cannot send link get request: Message too long
Kernel warning:
------------[ cut here ]------------ WARNING: CPU: 2 PID: 1930 at net/core/rtnetlink.c:4151 rtnl_getlink+0x586/0x5a0 Modules linked in: xt_conntrack xt_MASQUERADE nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay mlx5_ib macsec mlx5_core tls rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm iw_cm ib_ipoib fuse ib_cm ib_core CPU: 2 UID: 0 PID: 1930 Comm: ip Not tainted 6.14.0-rc2+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rtnl_getlink+0x586/0x5a0 Code: cb 82 e8 3d af 0a 00 4d 85 ff 0f 84 08 ff ff ff 4c 89 ff 41 be ea ff ff ff e8 66 63 5b ff 49 c7 07 80 4f cb 82 e9 36 fc ff ff <0f> 0b e9 16 fe ff ff e8 de a0 56 00 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ffff888113557348 EFLAGS: 00010246 RAX: 00000000ffffffa6 RBX: ffff88817e87aa34 RCX: dffffc0000000000 RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff88817e87afb8 RBP: 0000000000000009 R08: ffffffff821f44aa R09: 0000000000000000 R10: ffff8881260f79a8 R11: ffff88817e87af00 R12: ffff88817e87aa00 R13: ffffffff8563d300 R14: 00000000ffffffa6 R15: 00000000ffffffff FS: 00007f63a5dbf280(0000) GS:ffff88881ee00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f63a5ba4493 CR3: 00000001700fe002 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0xa5/0x230 ? rtnl_getlink+0x586/0x5a0 ? report_bug+0x22d/0x240 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x14/0x50 ? asm_exc_invalid_op+0x16/0x20 ? skb_trim+0x6a/0x80 ? rtnl_getlink+0x586/0x5a0 ? __pfx_rtnl_getlink+0x10/0x10 ? rtnetlink_rcv_msg+0x1e5/0x860 ? __pfx___mutex_lock+0x10/0x10 ? rcu_is_watching+0x34/0x60 ? __pfx_lock_acquire+0x10/0x10 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1d/0x70 ? kasan_save_stack+0x30/0x40 ? kasan_save_stack+0x20/0x40 ? kasan_save_track+0x10/0x30 rtnetlink_rcv_msg+0x21c/0x860 ? entry_SYSCALL_64_after_hwframe+0x76/0x7e ? __pfx_rtnetlink_rcv_msg+0x10/0x10 ? arch_stack_walk+0x9e/0xf0 ? rcu_is_watching+0x34/0x60 ? lock_acquire+0xd5/0x410 ? rcu_is_watching+0x34/0x60 netlink_rcv_skb+0xe0/0x210 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? rcu_is_watching+0x34/0x60 ? __pfx___netlink_lookup+0x10/0x10 ? lock_release+0x62/0x200 ? netlink_deliver_tap+0xfd/0x290 ? rcu_is_watching+0x34/0x60 ? lock_release+0x62/0x200 ? netlink_deliver_tap+0x95/0x290 netlink_unicast+0x31f/0x480 ? __pfx_netlink_unicast+0x10/0x10 ? rcu_is_watching+0x34/0x60 ? lock_acquire+0xd5/0x410 netlink_sendmsg+0x369/0x660 ? lock_release+0x62/0x200 ? __pfx_netlink_sendmsg+0x10/0x10 ? import_ubuf+0xb9/0xf0 ? __import_iovec+0x254/0x2b0 ? lock_release+0x62/0x200 ? __pfx_netlink_sendmsg+0x10/0x10 ____sys_sendmsg+0x559/0x5a0 ? __pfx_____sys_sendmsg+0x10/0x10 ? __pfx_copy_msghdr_from_user+0x10/0x10 ? rcu_is_watching+0x34/0x60 ? do_read_fault+0x213/0x4a0 ? rcu_is_watching+0x34/0x60 ___sys_sendmsg+0xe4/0x150 ? __pfx____sys_sendmsg+0x10/0x10 ? do_fault+0x2cc/0x6f0 ? handle_pte_fault+0x2e3/0x3d0 ? __pfx_handle_pte_fault+0x10/0x10 ? preempt_count_sub+0x14/0xc0 ? __down_read_trylock+0x150/0x270 ? __handle_mm_fault+0x404/0x8e0 ? __pfx___handle_mm_fault+0x10/0x10 ? lock_release+0x62/0x200 ? __rcu_read_unlock+0x65/0x90 ? rcu_is_watching+0x34/0x60 __sys_sendmsg+0xd5/0x150 ? __pfx___sys_sendmsg+0x10/0x10 ? __up_read+0x192/0x480 ? lock_release+0x62/0x200 ? __rcu_read_unlock+0x65/0x90 ? rcu_is_watching+0x34/0x60 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f63a5b13367 Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RSP: 002b:00007fff8c726bc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000067b687c2 RCX: 00007f63a5b13367 RDX: 0000000000000000 RSI: 00007fff8c726c30 RDI: 0000000000000004 RBP: 00007fff8c726cb8 R08: 0000000000000000 R09: 0000000000000034 R10: 00007fff8c726c7c R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 00007fff8c726cd0 R15: 00007fff8c726cd0 </TASK> irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [<ffffffff813f9e58>] copy_process+0xd08/0x2830 softirqs last enabled at (0): [<ffffffff813f9e58>] copy_process+0xd08/0x2830 softirqs last disabled at (0): [<0000000000000000>] 0x0 ---[ end trace 0000000000000000 ]---
Thus, when calculating ifinfo message size, take VF GUIDs sizes into account when supported.
--- net/core/rtnetlink.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/rtnetlink.c +3 -0
@@ -1011,6 +1011,9 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,/* IFLA_VF_STATS_TX_DROPPED */ nla_total_size_64bit(sizeof(__u64))); } +if (dev->netdev_ops->ndo_get_vf_guid) + size += num_vfs *2 * +nla_total_size (sizeof (struct ifla_vf_guid ));return size; }else return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 146/268 rndis_host: Flag RNDIS modems as WWAN devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Rintel <[email protected]>
[ Upstream commit 67d1a8956d2d62fe6b4c13ebabb57806098511d8 ]
Set FLAG_WWAN instead of FLAG_ETHERNET for RNDIS interfaces on Mobile Broadband Modems, as opposed to regular Ethernet adapters.
Otherwise NetworkManager gets confused, misjudges the device type, and wouldn't know it should connect a modem to get the device to work. What would be the result depends on ModemManager version -- older ModemManager would end up disconnecting a device after an unsuccessful probe attempt (if it connected without needing to unlock a SIM), while a newer one might spawn a separate PPP connection over a tty interface instead, resulting in a general confusion and no end of chaos.
The only way to get this work reliably is to fix the device type and have good enough version ModemManager (or equivalent).
--- drivers/net/usb/rndis_host.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/net/usb/rndis_host.c +14 -2
@@ -630,6 +630,16 @@ static const struct driver_info zte_rndis_info = { .tx_fixup = rndis_tx_fixup, }; +static const struct driver_info wwan_rndis_info = { + .description ="Mobile Broadband RNDIS device" , + .flags =FLAG_WWAN |FLAG_POINTTOPOINT |FLAG_FRAMING_RN |FLAG_NO_SETINT , + .bind = rndis_bind, + .unbind = rndis_unbind, + .status = rndis_status, + .rx_fixup = rndis_rx_fixup, + .tx_fixup = rndis_tx_fixup, +}; +/*-------------------------------------------------------------------------*/ static const struct usb_device_id products [] = {
@@ -666,9 +676,11 @@ static const struct usb_device_id products [] = { USB_INTERFACE_INFO(USB_CLASS_WIRELESS_CONTROLLER, 1, 3), .driver_info = (unsigned long) &rndis_info, }, { -/* Novatel Verizon USB730L */ +/* Mobile Broadband Modem, seen in Novatel Verizon USB730L and +* Telit FN990A (RNDIS) +*/ USB_INTERFACE_INFO(USB_CLASS_MISC, 4, 1), - .driver_info = (unsigned long) &rndis_info, + .driver_info = (unsigned long)&wwan_rndis_info, }, { }, // END };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 147/268 ksmbd: use aead_request_free to match aead_request_alloc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
[ Upstream commit 6171063e9d046ffa46f51579b2ca4a43caef581a ]
Use aead_request_free() instead of kfree() to properly free memory allocated by aead_request_alloc(). This ensures sensitive crypto data is zeroed before being freed.
--- fs/smb/server/auth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/server/auth.c +1 -1
@@ -1213,7 +1213,7 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov, free_sg:kfree (sg); free_req: -kfree (req); +aead_request_free (req); free_ctx:ksmbd_release_crypto_ctx (ctx);return rc;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 148/268 ksmbd: fix multichannel connection failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit c1883049aa9b2b7dffd3a68c5fc67fa92c174bd9 ]
ksmbd check that the session of second channel is in the session list of first connection. If it is in session list, multichannel connection should not be allowed.
--- fs/smb/server/mgmt/user_session.c | 16 ++++++++++++++++ fs/smb/server/mgmt/user_session.h | 2 ++ fs/smb/server/smb2pdu.c | 12 ++++-------- 3 files changed, 22 insertions(+), 8 deletions(-)
fs/smb/server/mgmt/user_session.c +16 -0
@@ -255,6 +255,22 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn)up_write (&sessions_table_lock); } +bool is_ksmbd_session_in_connection (struct ksmbd_conn *conn, +unsigned long long id) +{ +struct ksmbd_session *sess; + +down_read (&conn->session_lock); + sess =xa_load (&conn->sessions, id); +if (sess) { +up_read (&conn->session_lock); +return true; + } +up_read (&conn->session_lock); + +return false; +} +struct ksmbd_session *ksmbd_session_lookup (struct ksmbd_conn *conn,unsigned long long id) {
fs/smb/server/mgmt/user_session.h +2 -0
@@ -87,6 +87,8 @@ void ksmbd_session_destroy(struct ksmbd_session *sess);struct ksmbd_session *ksmbd_session_lookup_slowpath (unsigned long long id);struct ksmbd_session *ksmbd_session_lookup (struct ksmbd_conn *conn,unsigned long long id); +bool is_ksmbd_session_in_connection (struct ksmbd_conn *conn, +unsigned long long id);int ksmbd_session_register (struct ksmbd_conn *conn,struct ksmbd_session *sess);void ksmbd_sessions_deregister (struct ksmbd_conn *conn);
fs/smb/server/smb2pdu.c +4 -8
@@ -1707,44 +1707,38 @@ int smb2_sess_setup(struct ksmbd_work *work)if (conn->dialect != sess->dialect) { rc = -EINVAL ; -ksmbd_user_session_put (sess); goto out_err; }if (!(req->hdr.Flags &SMB2_FLAGS_SIGNED )) { rc = -EINVAL ; -ksmbd_user_session_put (sess); goto out_err; }if (strncmp (conn->ClientGUID, sess->ClientGUID,SMB2_CLIENT_GUID_SIZE )) { rc = -ENOENT ; -ksmbd_user_session_put (sess); goto out_err; }if (sess->state ==SMB2_SESSION_IN_PROGRESS ) { rc = -EACCES ; -ksmbd_user_session_put (sess); goto out_err; }if (sess->state ==SMB2_SESSION_EXPIRED ) { rc = -EFAULT ; -ksmbd_user_session_put (sess); goto out_err; } -ksmbd_user_session_put (sess);if (ksmbd_conn_need_reconnect (conn)) { rc = -EFAULT ; +ksmbd_user_session_put (sess); sess =NULL ; goto out_err; } - sess =ksmbd_session_lookup (conn, sess_id); -if (!sess) { +if (is_ksmbd_session_in_connection (conn, sess_id)) { rc = -EACCES ; goto out_err; }
@@ -1910,6 +1904,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess->last_active = jiffies; sess->state =SMB2_SESSION_EXPIRED ; +ksmbd_user_session_put (sess); + work->sess =NULL ;if (try_delay) {ksmbd_conn_set_need_reconnect (conn);ssleep (5 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 149/268 ksmbd: fix r_count dec/increment mismatch
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit ddb7ea36ba7129c2ed107e2186591128618864e1 ]
r_count is only increased when there is an oplock break wait, so r_count inc/decrement are not paired. This can cause r_count to become negative, which can lead to a problem where the ksmbd thread does not terminate.
--- fs/smb/server/oplock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/smb/server/oplock.c +2 -2
@@ -724,8 +724,8 @@ static int smb2_oplock_break_noti(struct oplock_info *opinfo) work->conn = conn; work->sess = opinfo->sess; +ksmbd_conn_r_count_inc (conn);if (opinfo->op_state ==OPLOCK_ACK_WAIT ) { -ksmbd_conn_r_count_inc (conn);INIT_WORK (&work->work, __smb2_oplock_break_noti);ksmbd_queue_work (work);
@@ -833,8 +833,8 @@ static int smb2_lease_break_noti(struct oplock_info *opinfo) work->conn = conn; work->sess = opinfo->sess; +ksmbd_conn_r_count_inc (conn);if (opinfo->op_state ==OPLOCK_ACK_WAIT ) { -ksmbd_conn_r_count_inc (conn);INIT_WORK (&work->work, __smb2_lease_break_noti);ksmbd_queue_work (work);wait_for_break_ack (opinfo);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 150/268 net/mlx5e: SHAMPO, Make reserved size independent of page size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lama Kayal <[email protected]>
[ Upstream commit fab05835688526f9de123d1e98e4d1f838da4e22 ]
When hw-gro is enabled, the maximum number of header entries that are needed per wqe (hd_per_wqe) is calculated based on the size of the reservations among other parameters.
Miscalculation of the size of reservations leads to incorrect calculation of hd_per_wqe as 0, particularly in the case of large page size like in aarch64, this prevents the SHAMPO header from being correctly initialized in the device, ultimately causing the following cqe err that indicates a violation of PD.
mlx5_core 0000:00:08.0 eth2: ERR CQE on RQ: 0x1180
mlx5_core 0000:00:08.0 eth2: Error cqe on cqn 0x510, ci 0x0, qn 0x1180, opcode 0xe, syndrome 0x4, vendor syndrome 0x32 00000000: 00 00 00 00 04 4a 00 00 00 00 00 00 20 00 93 32
00000010: 55 00 00 00 fb cc 00 00 00 00 00 00 07 18 00 00
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4a
00000030: 00 00 00 9a 93 00 32 04 00 00 00 00 00 00 da e1
Use the correct formula for calculating the size of reservations, precisely it shouldn't be dependent on page size, instead use the correct multiply of MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE.
--- drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/params.c +5 -3
@@ -408,7 +408,7 @@ u8 mlx5e_shampo_get_log_pkt_per_rsrv(struct mlx5_core_dev *mdev, struct mlx5e_params *params) {u32 resrv_size =BIT (mlx5e_shampo_get_log_rsrv_size (mdev, params)) * -PAGE_SIZE ; +MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE ;return order_base_2 (DIV_ROUND_UP (resrv_size, params->sw_mtu)); }
@@ -881,7 +881,8 @@ static u32 mlx5e_shampo_get_log_cq_size(struct mlx5_core_dev *mdev,struct mlx5e_params *params, struct mlx5e_xsk_param *xsk) { - int rsrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * PAGE_SIZE; + int rsrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * +MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE ;u16 num_strides =BIT (mlx5e_mpwqe_get_log_num_strides (mdev, params, xsk));int pkt_per_rsrv =BIT (mlx5e_shampo_get_log_pkt_per_rsrv (mdev, params));u8 log_stride_sz =mlx5e_mpwqe_get_log_stride_size (mdev, params, xsk);
@@ -1094,7 +1095,8 @@ u32 mlx5e_shampo_hd_per_wqe(struct mlx5_core_dev *mdev,struct mlx5e_params *params, struct mlx5e_rq_param *rq_param) { - int resv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * PAGE_SIZE; + int resv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * +MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE ;u16 num_strides =BIT (mlx5e_mpwqe_get_log_num_strides (mdev, params,NULL ));int pkt_per_resv =BIT (mlx5e_shampo_get_log_pkt_per_rsrv (mdev, params));u8 log_stride_sz =mlx5e_mpwqe_get_log_stride_size (mdev, params,NULL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 151/268 ring-buffer: Fix bytes_dropped calculation issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Yang <[email protected]>
[ Upstream commit c73f0b69648501978e8b3e8fa7eef7f4197d0481 ]
The calculation of bytes-dropped and bytes_dropped_nested is reversed. Although it does not affect the final calculation of total_dropped, it should still be modified.
--- kernel/trace/ring_buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/ring_buffer.c +2 -2
@@ -5995,9 +5995,9 @@ static __init int rb_write_something(struct rb_test_data *data, bool nested)/* Ignore dropped events before test starts. */ if (started) {if (nested) - data->bytes_dropped += len; -else data->bytes_dropped_nested += len; +else + data->bytes_dropped += len; }return len; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 152/268 objtool: Fix segfault in ignore_unreachable_insn()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 69d41d6dafff0967565b971d950bd10443e4076c ]
Check 'prev_insn' before dereferencing it.
--- tools/objtool/check.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/objtool/check.c +1 -1
@@ -4089,7 +4089,7 @@ static bool ignore_unreachable_insn(struct objtool_file *file, struct instructio* It may also insert a UD2 after calling a __noreturn function. */ prev_insn =prev_insn_same_sec (file, insn); -if (prev_insn->dead_end && +if (prev_insn && prev_insn->dead_end && (insn->type ==INSN_BUG || (insn->type ==INSN_JUMP_UNCONDITIONAL && insn->jump_dest && insn->jump_dest->type ==INSN_BUG )))
Signature · 1 line
2.39.5