6.13.11-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 128/499 crypto: tegra - Use HMAC fallback when keyslots are full
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit f80a2e2e77bedd0aa645a60f89b4f581c70accda ]
The intermediate results for HMAC is stored in the allocated keyslot by the hardware. Dynamic allocation of keyslot during an operation is hence not possible. As the number of keyslots are limited in the hardware, fallback to the HMAC software implementation if keyslots are not available
--- drivers/crypto/tegra/tegra-se-hash.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/crypto/tegra/tegra-se-hash.c +6 -1
@@ -632,13 +632,18 @@ static int tegra_hmac_setkey(struct crypto_ahash *tfm, const u8 *key, unsigned int keylen) {struct tegra_sha_ctx *ctx =crypto_ahash_ctx (tfm); +int ret;if (aes_check_keylen (keylen))return tegra_hmac_fallback_setkey (ctx, key, keylen); + ret =tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key_id); +if (ret) +return tegra_hmac_fallback_setkey (ctx, key, keylen); + ctx->fallback = false; -return tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key_id); +return 0 ; }static int tegra_sha_init (struct ahash_request *req)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/499 clk: amlogic: gxbb: drop incorrect flag on 32k clock
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit f38f7fe4830c5cb4eac138249225f119e7939965 ]
gxbb_32k_clk_div sets CLK_DIVIDER_ROUND_CLOSEST in the init_data flag which is incorrect. This is field is not where the divider flags belong.
Thankfully, CLK_DIVIDER_ROUND_CLOSEST maps to bit 4 which is an unused clock flag, so there is no unintended consequence to this error.
Effectively, the clock has been used without CLK_DIVIDER_ROUND_CLOSEST so far, so just drop it.
--- drivers/clk/meson/gxbb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/meson/gxbb.c +1 -1
@@ -1306,7 +1306,7 @@ static struct clk_regmap gxbb_32k_clk_div = { &gxbb_32k_clk_sel.hw }, .num_parents = 1, - .flags = CLK_SET_RATE_PARENT | CLK_DIVIDER_ROUND_CLOSEST, + .flags = CLK_SET_RATE_PARENT, }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/499 crypto: hisilicon/sec2 - fix for aead authsize alignment
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
[ Upstream commit a49cc71e219040d771a8c1254879984f98192811 ]
The hardware only supports authentication sizes
that are 4-byte aligned. Therefore, the driver
switches to software computation in this case.
--- drivers/crypto/hisilicon/sec2/sec_crypto.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-)
drivers/crypto/hisilicon/sec2/sec_crypto.c +9 -13
@@ -57,7 +57,6 @@#define SEC_TYPE_MASK 0x0F#define SEC_DONE_MASK 0x0001#define SEC_ICV_MASK 0x000E -#define SEC_SQE_LEN_RATE_MASK 0x3#define SEC_TOTAL_IV_SZ (depth) (SEC_IV_SIZE * (depth))#define SEC_SGL_SGE_NR 128
@@ -80,16 +79,16 @@#define SEC_TOTAL_PBUF_SZ (depth) (PAGE_SIZE * SEC_PBUF_PAGE_NUM(depth) + \ SEC_PBUF_LEFT_SZ(depth)) -#define SEC_SQE_LEN_RATE 4#define SEC_SQE_CFLAG 2#define SEC_SQE_AEAD_FLAG 3#define SEC_SQE_DONE 0x1#define SEC_ICV_ERR 0x2 -#define MIN_MAC_LEN 4#define MAC_LEN_MASK 0x1U#define MAX_INPUT_DATA_LEN 0xFFFE00#define BITS_MASK 0xFF +#define WORD_MASK 0x3#define BYTE_BITS 0x8 +#define BYTES_TO_WORDS (bcount) ((bcount) >> 2)#define SEC_XTS_NAME_SZ 0x3#define IV_CM_CAL_NUM 2#define IV_CL_MASK 0x7
@@ -1175,7 +1174,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, goto bad_key; } -if (ctx->a_ctx.a_key_len &SEC_SQE_LEN_RATE_MASK ) { +if (ctx->a_ctx.a_key_len &WORD_MASK ) { ret = -EINVAL ;dev_err (dev,"AUTH key length error!\n" ); goto bad_key;
@@ -1583,11 +1582,10 @@ static void sec_auth_bd_fill_ex(struct sec_auth_ctx *ctx, int dir, sec_sqe->type2.a_key_addr =cpu_to_le64 (ctx->a_key_dma); - sec_sqe->type2.mac_key_alg =cpu_to_le32 (authsize /SEC_SQE_LEN_RATE ); + sec_sqe->type2.mac_key_alg =cpu_to_le32 (BYTES_TO_WORDS (authsize)); sec_sqe->type2.mac_key_alg |= -cpu_to_le32 ((u32)((ctx->a_key_len) / -SEC_SQE_LEN_RATE ) <<SEC_AKEY_OFFSET ); +cpu_to_le32 ((u32 )BYTES_TO_WORDS (ctx->a_key_len) <<SEC_AKEY_OFFSET ); sec_sqe->type2.mac_key_alg |=cpu_to_le32 ((u32)(ctx->a_alg) <<SEC_AEAD_ALG_OFFSET );
@@ -1639,12 +1637,10 @@ static void sec_auth_bd_fill_ex_v3(struct sec_auth_ctx *ctx, int dir, sqe3->a_key_addr =cpu_to_le64 (ctx->a_key_dma); sqe3->auth_mac_key |= -cpu_to_le32 ((u32)(authsize / -SEC_SQE_LEN_RATE ) <<SEC_MAC_OFFSET_V3 ); +cpu_to_le32 (BYTES_TO_WORDS (authsize) <<SEC_MAC_OFFSET_V3 ); sqe3->auth_mac_key |= -cpu_to_le32 ((u32)(ctx->a_key_len / -SEC_SQE_LEN_RATE ) <<SEC_AKEY_OFFSET_V3 ); +cpu_to_le32 ((u32 )BYTES_TO_WORDS (ctx->a_key_len) <<SEC_AKEY_OFFSET_V3 ); sqe3->auth_mac_key |=cpu_to_le32 ((u32)(ctx->a_alg) <<SEC_AUTH_ALG_OFFSET_V3 );
@@ -2234,8 +2230,8 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq)struct device *dev = ctx->dev;int ret; -/* Hardware does not handle cases where authsize is less than 4 bytes */ -if (unlikely (sz <MIN_MAC_LEN )) { +/* Hardware does not handle cases where authsize is not 4 bytes aligned */ +if (c_mode ==SEC_CMODE_CBC && (sz &WORD_MASK )) { sreq->aead_req.fallback = true;return -EINVAL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/499 crypto: hisilicon/sec2 - fix for sec spec check
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
[ Upstream commit f4f353cb7ae9bb43e34943edb693532a39118eca ]
During encryption and decryption, user requests
must be checked first, if the specifications that
are not supported by the hardware are used, the
software computing is used for processing.
--- drivers/crypto/hisilicon/sec2/sec.h | 1 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 101 ++++++++------------- 2 files changed, 39 insertions(+), 63 deletions(-)
drivers/crypto/hisilicon/sec2/sec.h +0 -1
@@ -37,7 +37,6 @@ struct sec_aead_req {u8 *a_ivin;dma_addr_t a_ivin_dma;struct aead_request *aead_req; -bool fallback; };/* SEC request of Crypto */
drivers/crypto/hisilicon/sec2/sec_crypto.c +39 -62
221 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/499 RDMA/mlx5: Fix page_size variable overflow
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit f0c2427412b43cdf1b7b0944749ea17ddb97d5a5 ]
Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to unsigned long to support values larger than 31 and avoid overflow.
For example: If we try to register 4GB of memory that is contiguous in physical memory, the driver will optimize the page_size and try to use an mkey with 4GB entity size. The 'unsigned int' page_size variable will overflow to '0' and we'll hit the WARN_ON() in alloc_cacheable_mr().
WARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Modules linked in: mlx5_ib mlx5_core bonding ip6_gre ip6_tunnel tunnel6 ip_gre gre rdma_rxe rdma_ucm ib_uverbs ib_ipoib ib_umad rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm fuse ib_core [last unloaded: mlx5_core] CPU: 2 UID: 70878 PID: 1203 Comm: rdma_resource_l Tainted: G W 6.14.0-rc4-dirty #43 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Code: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 <0f> 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41 RSP: 0018:ffffc900006ffac8 EFLAGS: 00010246 RAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001 RDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600 RBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240 R13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00 FS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x81/0x130 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] ? report_bug+0xfc/0x1e0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] create_real_mr+0x54/0x150 [mlx5_ib] ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xca/0x140 [ib_uverbs] ib_uverbs_run_method+0x6d0/0x780 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x19b/0x360 [ib_uverbs] ? walk_system_ram_range+0x79/0xd0 ? ___pte_offset_map+0x1b/0x110 ? __pte_offset_map_lock+0x80/0x100 ib_uverbs_ioctl+0xac/0x110 [ib_uverbs] __x64_sys_ioctl+0x94/0xb0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb7ecf0737b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b RDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4 R13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150 </TASK>
--- drivers/infiniband/hw/mlx5/mr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/infiniband/hw/mlx5/mr.c +4 -4
@@ -56,7 +56,7 @@ static void create_mkey_callback(int status, struct mlx5_async_work *context);static struct mlx5_ib_mr *reg_create (struct ib_pd *pd,struct ib_umem *umem,u64 iova,int access_flags, -unsigned int page_size,bool populate, +unsigned long page_size,bool populate,int access_mode);static int __mlx5_ib_dereg_mr (struct ib_mr *ibmr);
@@ -1115,7 +1115,7 @@ static struct mlx5_ib_mr *alloc_cacheable_mr(struct ib_pd *pd,struct mlx5r_cache_rb_key rb_key = {};struct mlx5_cache_ent *ent;struct mlx5_ib_mr *mr; -unsigned int page_size; +unsigned long page_size;if (umem->is_dmabuf) page_size =mlx5_umem_dmabuf_default_pgsz (umem, iova);
@@ -1219,7 +1219,7 @@ reg_create_crossing_vhca_mr(struct ib_pd *pd, u64 iova, u64 length, int access_f*/ static struct mlx5_ib_mr *reg_create (struct ib_pd *pd,struct ib_umem *umem,u64 iova,int access_flags, -unsigned int page_size,bool populate, +unsigned long page_size,bool populate,int access_mode) {struct mlx5_ib_dev *dev =to_mdev (pd->device);
@@ -1425,7 +1425,7 @@ static struct ib_mr *create_real_mr(struct ib_pd *pd, struct ib_umem *umem, mr =alloc_cacheable_mr (pd, umem, iova, access_flags,MLX5_MKC_ACCESS_MODE_MTT ); }else { -unsigned int page_size = +unsigned long page_size =mlx5_umem_mkc_find_best_pgsz (dev, umem, iova);mutex_lock (&dev->slow_path_mutex);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/499 remoteproc: core: Clear table_sz when rproc_shutdown
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit efdde3d73ab25cef4ff2d06783b0aad8b093c0e4 ]
There is case as below could trigger kernel dump:
Use U-Boot to start remote processor(rproc) with resource table published to a fixed address by rproc. After Kernel boots up, stop the rproc, load a new firmware which doesn't have resource table ,and start rproc.
When starting rproc with a firmware not have resource table, memcpy(loaded_table, rproc->cached_table, rproc->table_sz) will trigger dump, because rproc->cache_table is set to NULL during the last stop operation, but rproc->table_sz is still valid.
This issue is found on i.MX8MP and i.MX9.
Dump as below:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af63000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 UID: 0 PID: 1060 Comm: sh Not tainted 6.14.0-rc7-next-20250317-dirty #38 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: a0000005 (NzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __pi_memcpy_generic+0x110/0x22c lr : rproc_start+0x88/0x1e0 Call trace: __pi_memcpy_generic+0x110/0x22c (P) rproc_boot+0x198/0x57c state_store+0x40/0x104 dev_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x120/0x1cc vfs_write+0x240/0x378 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xcc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c
Clear rproc->table_sz to address the issue.
--- drivers/remoteproc/remoteproc_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/remoteproc/remoteproc_core.c +1 -0
@@ -2025,6 +2025,7 @@ int rproc_shutdown(struct rproc *rproc)kfree (rproc->cached_table); rproc->cached_table =NULL ; rproc->table_ptr =NULL ; + rproc->table_sz =0 ; out:mutex_unlock (&rproc->lock);return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/499 of: property: Increase NR_FWNODE_REFERENCE_ARGS
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit eb50844d728f11e87491f7c7af15a4a737f1159d ]
Currently, the following two macros have different values:
// The maximal argument count for firmware node reference
#define NR_FWNODE_REFERENCE_ARGS 8
// The maximal argument count for DT node reference
#define MAX_PHANDLE_ARGS 16
It may cause firmware node reference's argument count out of range if directly assign DT node reference's argument count to firmware's.
drivers/of/property.c:of_fwnode_get_reference_args() is doing the direct assignment, so may cause firmware's argument count @args->nargs got out of range, namely, in [9, 16].
Fix by increasing NR_FWNODE_REFERENCE_ARGS to 16 to meet DT requirement. Will align both macros later to avoid such inconsistency.
--- include/linux/fwnode.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/fwnode.h +1 -1
@@ -91,7 +91,7 @@ struct fwnode_endpoint {#define SWNODE_GRAPH_PORT_NAME_FMT "port@%u"#define SWNODE_GRAPH_ENDPOINT_NAME_FMT "endpoint@%u" -#define NR_FWNODE_REFERENCE_ARGS 8 +#define NR_FWNODE_REFERENCE_ARGS 16/** * struct fwnode_reference_args - Fwnode reference with additional arguments
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/499 pinctrl: renesas: rzg2l: Suppress binding attributes
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit ea4065345643f3163e812e58ed8add2c75c3ee46 ]
Suppress binding attributes for the rzg2l pinctrl driver, as it is an essential block for Renesas SoCs. Unbinding the driver leads to warnings from __device_links_no_driver() and can eventually render the system inaccessible.
--- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/renesas/pinctrl-rzg2l.c +1 -0
@@ -3210,6 +3210,7 @@ static struct platform_driver rzg2l_pinctrl_driver = { .name = DRV_NAME, .of_match_table = of_match_ptr(rzg2l_pinctrl_of_table), .pm = pm_sleep_ptr(&rzg2l_pinctrl_pm_ops), + .suppress_bind_attrs = true, }, .probe = rzg2l_pinctrl_probe, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/499 remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit e917b73234b02aa4966325e7380d2559bf127ba9 ]
Only go into the if condition for single-PD handling when there's actually just one power domain specified there. Otherwise it'll be an issue in the dts and we should fail in the regular code path.
This also mirrors the latest changes in the qcom_q6v5_mss driver.
--- drivers/remoteproc/qcom_q6v5_pas.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/remoteproc/qcom_q6v5_pas.c +5 -5
@@ -501,16 +501,16 @@ static int adsp_pds_attach(struct device *dev, struct device **devs,if (!pd_names)return 0 ; +while (pd_names[num_pds]) + num_pds++; +/* Handle single power domain */ -if (dev->pm_domain) { +if (num_pds ==1 && dev->pm_domain) { devs[0 ] = dev;pm_runtime_enable (dev);return 1 ; } -while (pd_names[num_pds]) - num_pds++; -for (i =0 ; i < num_pds; i++) { devs[i] =dev_pm_domain_attach_by_name (dev, pd_names[i]);if (IS_ERR_OR_NULL (devs[i])) {
@@ -535,7 +535,7 @@ static void adsp_pds_detach(struct qcom_adsp *adsp, struct device **pds,int i;/* Handle single power domain */ -if (dev->pm_domain && pd_count) { +if (pd_count ==1 && dev->pm_domain) {pm_runtime_disable (dev);return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/499 libbpf: Fix hypothetical STT_SECTION extern NULL deref case
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit e0525cd72b5979d8089fe524a071ea93fd011dc9 ]
Fix theoretical NULL dereference in linker when resolving *extern* STT_SECTION symbol against not-yet-existing ELF section. Not sure if it's possible in practice for valid ELF object files (this would require embedded assembly manipulations, at which point BTF will be missing), but fix the s/dst_sym/dst_sec/ typo guarding this condition anyways.
--- tools/lib/bpf/linker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/linker.c +1 -1
@@ -2044,7 +2044,7 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj, obj->sym_map[src_sym_idx] = dst_sym_idx; -if (sym_type ==STT_SECTION && dst_sym) { +if (sym_type ==STT_SECTION && dst_sec) { dst_sec->sec_sym_idx = dst_sym_idx; dst_sym->st_value =0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/499 drivers: clk: qcom: ipq5424: fix the freq table of sdcc1_apps clock
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Mylavarapu <[email protected]>
[ Upstream commit e9ed0ac3ccba65c17ed0d59c77a340a75abc317b ]
The divider values in the sdcc1_apps frequency table were incorrectly updated, assuming the frequency of gpll2_out_main to be 1152MHz. However, the frequency of the gpll2_out_main clock is actually 576MHz (gpll2/2).
Due to these incorrect divider values, the sdcc1_apps clock is running at half of the expected frequency.
Fixing the frequency table of sdcc1_apps allows the sdcc1_apps clock to run according to the frequency plan.
--- drivers/clk/qcom/gcc-ipq5424.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/clk/qcom/gcc-ipq5424.c +4 -4
@@ -614,11 +614,11 @@ static struct clk_rcg2 gcc_qupv3_uart1_clk_src = {static const struct freq_tbl ftbl_gcc_sdcc1_apps_clk_src[] = {F (144000 ,P_XO ,16 ,12 ,125 ),F (400000 ,P_XO ,12 ,1 ,5 ), -F (24000000 ,P_XO ,1 ,0 ,0 ), -F (48000000 ,P_GPLL2_OUT_MAIN ,12 ,1 ,2 ), -F (96000000 ,P_GPLL2_OUT_MAIN ,6 ,1 ,2 ), +F (24000000 ,P_GPLL2_OUT_MAIN ,12 ,1 ,2 ), +F (48000000 ,P_GPLL2_OUT_MAIN ,12 ,0 ,0 ), +F (96000000 ,P_GPLL2_OUT_MAIN ,6 ,0 ,0 ),F (177777778 ,P_GPLL0_OUT_MAIN ,4.5 ,0 ,0 ), -F (192000000 ,P_GPLL2_OUT_MAIN ,6 ,0 ,0 ), +F (192000000 ,P_GPLL2_OUT_MAIN ,3 ,0 ,0 ),F (200000000 ,P_GPLL0_OUT_MAIN ,4 ,0 ,0 ), { } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/499 selftests/bpf: Fix string read in strncmp benchmark
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <[email protected]>
[ Upstream commit de07b182899227d5fd1ca7a1a7d495ecd453d49c ]
The strncmp benchmark uses the bpf_strncmp helper and a hand-written loop to compare two strings. The values of the strings are filled from userspace. One of the strings is non-const (in .bss) while the other is const (in .rodata) since that is the requirement of bpf_strncmp.
The problem is that in the hand-written loop, Clang optimizes the reads from the const string to always return 0 which breaks the benchmark.
Use barrier_var to prevent the optimization.
The effect can be seen on the strncmp-no-helper variant.
Before this change:
# ./bench strncmp-no-helper
Setting up benchmark 'strncmp-no-helper'...
Benchmark 'strncmp-no-helper' started.
Iter 0 (112.309us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 1 (-23.238us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 2 ( 58.994us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 3 (-30.466us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 4 ( 29.996us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 5 ( 16.949us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Iter 6 (-60.035us): hits 0.000M/s ( 0.000M/prod), drops 0.000M/s, total operations 0.000M/s
Summary: hits 0.000 ± 0.000M/s ( 0.000M/prod), drops 0.000 ± 0.000M/s, total operations 0.000 ± 0.000M/sAfter this change:
# ./bench strncmp-no-helper
Setting up benchmark 'strncmp-no-helper'...
Benchmark 'strncmp-no-helper' started.
Iter 0 ( 77.711us): hits 5.534M/s ( 5.534M/prod), drops 0.000M/s, total operations 5.534M/s
Iter 1 ( 11.215us): hits 6.006M/s ( 6.006M/prod), drops 0.000M/s, total operations 6.006M/s
Iter 2 (-14.253us): hits 5.931M/s ( 5.931M/prod), drops 0.000M/s, total operations 5.931M/s
Iter 3 ( 59.087us): hits 6.005M/s ( 6.005M/prod), drops 0.000M/s, total operations 6.005M/s
Iter 4 (-21.379us): hits 6.010M/s ( 6.010M/prod), drops 0.000M/s, total operations 6.010M/s
Iter 5 (-20.310us): hits 5.861M/s ( 5.861M/prod), drops 0.000M/s, total operations 5.861M/s
Iter 6 ( 53.937us): hits 6.004M/s ( 6.004M/prod), drops 0.000M/s, total operations 6.004M/s
Summary: hits 5.969 ± 0.061M/s ( 5.969M/prod), drops 0.000 ± 0.000M/s, total operations 5.969 ± 0.061M/s--- tools/testing/selftests/bpf/progs/strncmp_bench.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/progs/strncmp_bench.c +4 -1
@@ -35,7 +35,10 @@ static __always_inline int local_strncmp(const char *s1, unsigned int sz, SEC("tp/syscalls/sys_enter_getpgid")int strncmp_no_helper (void *ctx) { -if (local_strncmp (str, cmp_str_len +1 , target) <0 ) +const char *target_str = target; + +barrier_var (target_str); +if (local_strncmp (str, cmp_str_len +1 , target_str) <0 )__sync_add_and_fetch (&hits,1 );return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/499 x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit dc84bc2aba85a1508f04a936f9f9a15f64ebfb31 ]
If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables.
Consequently untrack_pfn() will see VM_PAT and try obtaining the PAT information from the page table -- which fails because the page table was not copied.
The easiest fix would be to simply clear the VM_PAT flag of the dst VMA if track_pfn_copy() fails. However, the whole thing is about "simply" clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy() and performed a reservation, but copying the page tables fails, we'll simply clear the VM_PAT flag, not properly undoing the reservation ... which is also wrong.
So let's fix it properly: set the VM_PAT flag only if the reservation succeeded (leaving it clear initially), and undo the reservation if anything goes wrong while copying the page tables: clearing the VM_PAT flag after undoing the reservation.
Note that any copied page table entries will get zapped when the VMA will get removed later, after copy_page_range() succeeded; as VM_PAT is not set then, we won't try cleaning VM_PAT up once more and untrack_pfn() will be happy. Note that leaving these page tables in place without a reservation is not a problem, as we are aborting fork(); this process will never run.
A reproducer can trigger this usually at the first try:
https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c
WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110 Modules linked in: ... CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:get_pat_info+0xf6/0x110 ... Call Trace: <TASK> ... untrack_pfn+0x52/0x110 unmap_single_vma+0xa6/0xe0 unmap_vmas+0x105/0x1f0 exit_mmap+0xf6/0x460 __mmput+0x4b/0x120 copy_process+0x1bf6/0x2aa0 kernel_clone+0xab/0x440 __do_sys_clone+0x66/0x90 do_syscall_64+0x95/0x180
Likely this case was missed in:
d155df53f310 ("x86/mm/pat: clear VM_PAT if copy_p4d_range failed")
... and instead of undoing the reservation we simply cleared the VM_PAT flag.
Keep the documentation of these functions in include/linux/pgtable.h, one place is more than sufficient -- we should clean that up for the other functions like track_pfn_remap/untrack_pfn separately.
--- arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------ include/linux/pgtable.h | 28 ++++++++++++++++----- kernel/fork.c | 4 +++ mm/memory.c | 11 +++------ 4 files changed, 58 insertions(+), 37 deletions(-)
arch/x86/mm/pat/memtype.c +28 -24
@@ -984,29 +984,42 @@ static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr,return -EINVAL ; } -/* -* track_pfn_copy is called when vma that is covering the pfnmap gets -* copied through copy_page_range(). -* -* If the vma has a linear pfn mapping for the entire range, we get the prot -* from pte and reserve the entire vma range with single reserve_pfn_range call. -*/ -int track_pfn_copy (struct vm_area_struct *vma) +int track_pfn_copy (struct vm_area_struct *dst_vma, +struct vm_area_struct *src_vma,unsigned long *pfn) { +const unsigned long vma_size = src_vma->vm_end - src_vma->vm_start;resource_size_t paddr; -unsigned long vma_size = vma->vm_end - vma->vm_start;pgprot_t pgprot; +int rc; -if (vma->vm_flags &VM_PAT ) { -if (get_pat_info (vma, &paddr, &pgprot)) -return -EINVAL ; -/* reserve the whole chunk covered by vma. */ -return reserve_pfn_range (paddr, vma_size, &pgprot,1 ); - } +if (!(src_vma->vm_flags &VM_PAT )) +return 0 ; + +/* +* Duplicate the PAT information for the dst VMA based on the src +* VMA. +*/ +if (get_pat_info (src_vma, &paddr, &pgprot)) +return -EINVAL ; + rc =reserve_pfn_range (paddr, vma_size, &pgprot,1 ); +if (rc) +return rc; +/* Reservation for the destination VMA succeeded. */ +vm_flags_set (dst_vma,VM_PAT ); + *pfn =PHYS_PFN (paddr);return 0 ; } +void untrack_pfn_copy (struct vm_area_struct *dst_vma,unsigned long pfn) +{ +untrack_pfn (dst_vma, pfn, dst_vma->vm_end - dst_vma->vm_start, true); +/* +* Reservation was freed, any copied page tables will get cleaned +* up later, but without getting PAT involved again. +*/ +} +/* * prot is passed in as a parameter for the new mapping. If the vma has * a linear pfn mapping for the entire range, or no vma is provided,
@@ -1095,15 +1108,6 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn, } } -/* -* untrack_pfn_clear is called if the following situation fits: -* -* 1) while mremapping a pfnmap for a new region, with the old vma after -* its pfnmap page table has been removed. The new vma has a new pfnmap -* to the same pfn & cache type with VM_PAT set. -* 2) while duplicating vm area, the new vma fails to copy the pgtable from -* old vma. -*/ void untrack_pfn_clear (struct vm_area_struct *vma) {vm_flags_clear (vma,VM_PAT );
include/linux/pgtable.h +22 -6
@@ -1501,14 +1501,25 @@ static inline void track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot, }/* -* track_pfn_copy is called when vma that is covering the pfnmap gets -* copied through copy_page_range(). +* track_pfn_copy is called when a VM_PFNMAP VMA is about to get the page +* tables copied during copy_page_range(). On success, stores the pfn to be +* passed to untrack_pfn_copy(). */ -static inline int track_pfn_copy (struct vm_area_struct *vma) +static inline int track_pfn_copy (struct vm_area_struct *dst_vma, +struct vm_area_struct *src_vma,unsigned long *pfn) {return 0 ; } +/* +* untrack_pfn_copy is called when a VM_PFNMAP VMA failed to copy during +* copy_page_range(), but after track_pfn_copy() was already called. +*/ +static inline void untrack_pfn_copy (struct vm_area_struct *dst_vma, +unsigned long pfn) +{ +} +/* * untrack_pfn is called while unmapping a pfnmap for a region. * untrack can be called for a specific region indicated by pfn and size or
@@ -1521,8 +1532,10 @@ static inline void untrack_pfn(struct vm_area_struct *vma, }/* -* untrack_pfn_clear is called while mremapping a pfnmap for a new region -* or fails to copy pgtable during duplicate vm area. +* untrack_pfn_clear is called in the following cases on a VM_PFNMAP VMA: +* +* 1) During mremap() on the src VMA after the page tables were moved. +* 2) During fork() on the dst VMA, immediately after duplicating the src VMA. */ static inline void untrack_pfn_clear (struct vm_area_struct *vma) {
@@ -1533,7 +1546,10 @@ extern int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot, unsigned long size);extern void track_pfn_insert (struct vm_area_struct *vma,pgprot_t *prot,pfn_t pfn); -extern int track_pfn_copy (struct vm_area_struct *vma); +extern int track_pfn_copy (struct vm_area_struct *dst_vma, +struct vm_area_struct *src_vma,unsigned long *pfn); +extern void untrack_pfn_copy (struct vm_area_struct *dst_vma, +unsigned long pfn);extern void untrack_pfn (struct vm_area_struct *vma,unsigned long pfn,unsigned long size,bool mm_wr_locked);extern void untrack_pfn_clear (struct vm_area_struct *vma);
kernel/fork.c +4 -0
@@ -504,6 +504,10 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)vma_numab_state_init (new);dup_anon_vma_name (orig, new); +/* track_pfn_copy() will later take care of copying internal state. */ +if (unlikely (new->vm_flags &VM_PFNMAP )) +untrack_pfn_clear (new); +return new; }
mm/memory.c +4 -7
@@ -1362,12 +1362,12 @@ int copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) { pgd_t *src_pgd, *dst_pgd; -unsigned long next;unsigned long addr = src_vma->vm_start;unsigned long end = src_vma->vm_end;struct mm_struct *dst_mm = dst_vma->vm_mm;struct mm_struct *src_mm = src_vma->vm_mm;struct mmu_notifier_range range; +unsigned long next, pfn;bool is_cow;int ret;
@@ -1378,11 +1378,7 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)return copy_hugetlb_page_range (dst_mm, src_mm, dst_vma, src_vma);if (unlikely (src_vma->vm_flags &VM_PFNMAP )) { -/* -* We do not free on error cases below as remove_vma -* gets called on error from higher level routine -*/ - ret =track_pfn_copy (src_vma); + ret =track_pfn_copy (dst_vma, src_vma, &pfn);if (ret)return ret; }
@@ -1419,7 +1415,6 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)continue ;if (unlikely (copy_p4d_range (dst_vma, src_vma, dst_pgd, src_pgd, addr, next))) { -untrack_pfn_clear (dst_vma); ret = -ENOMEM ;break ; }
@@ -1429,6 +1424,8 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)raw_write_seqcount_end (&src_mm->write_protect_seq);mmu_notifier_invalidate_range_end (&range); } +if (ret &&unlikely (src_vma->vm_flags &VM_PFNMAP )) +untrack_pfn_copy (dst_vma, pfn);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/499 clk: renesas: r8a08g045: Check the source of the CPU PLL settings
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit dc0f16c1b76293ac942a783e960abfd19e95fdf5 ]
On the RZ/G3S SoC, the CPU PLL settings can be set and retrieved through the CPG_PLL1_CLK1 and CPG_PLL1_CLK2 registers. However, these settings are applied only when CPG_PLL1_SETTING.SEL_PLL1 is set to 0. Otherwise, the CPU PLL operates at the default frequency of 1.1 GHz. Hence add support to the PLL driver for returning the 1.1 GHz frequency when the CPU PLL is configured with the default frequency.
--- drivers/clk/renesas/r9a08g045-cpg.c | 5 +++-- drivers/clk/renesas/rzg2l-cpg.c | 13 ++++++++++++- drivers/clk/renesas/rzg2l-cpg.h | 10 +++++++--- 3 files changed, 22 insertions(+), 6 deletions(-)
drivers/clk/renesas/r9a08g045-cpg.c +3 -2
@@ -51,7 +51,7 @@#define G3S_SEL_SDHI2 SEL_PLL_PACK(G3S_CPG_SDHI_DSEL, 8, 2)/* PLL 1/4/6 configuration registers macro. */ -#define G3S_PLL146_CONF (clk1, clk2) ((clk1) << 22 | (clk2) << 12) +#define G3S_PLL146_CONF (clk1, clk2, setting) ((clk1) << 22 | (clk2) << 12 | (setting))#define DEF_G3S_MUX (_name, _id, _conf, _parent_names, _mux_flags, _clk_flags) \ DEF_TYPE(_name, _id, CLK_TYPE_MUX, .conf = (_conf), \
@@ -134,7 +134,8 @@ static const struct cpg_core_clk r9a08g045_core_clks[] __initconst = {/* Internal Core Clocks */ DEF_FIXED (".osc_div1000" ,CLK_OSC_DIV1000 ,CLK_EXTAL ,1 ,1000 ), -DEF_G3S_PLL (".pll1" ,CLK_PLL1 ,CLK_EXTAL ,G3S_PLL146_CONF (0x4 ,0x8 )), +DEF_G3S_PLL (".pll1" ,CLK_PLL1 ,CLK_EXTAL ,G3S_PLL146_CONF (0x4 ,0x8 ,0x100 ), +1100000000UL ),DEF_FIXED (".pll2" ,CLK_PLL2 ,CLK_EXTAL ,200 ,3 ),DEF_FIXED (".pll3" ,CLK_PLL3 ,CLK_EXTAL ,200 ,3 ), DEF_FIXED(".pll4", CLK_PLL4, CLK_EXTAL, 100, 3),
drivers/clk/renesas/rzg2l-cpg.c +12 -1
@@ -51,6 +51,7 @@#define RZG3S_DIV_M GENMASK(25, 22)#define RZG3S_DIV_NI GENMASK(21, 13)#define RZG3S_DIV_NF GENMASK(12, 1) +#define RZG3S_SEL_PLL BIT(0)#define CLK_ON_R (reg) (reg)#define CLK_MON_R (reg) (0x180 + (reg))
@@ -60,6 +61,7 @@#define GET_REG_OFFSET (val) ((val >> 20) & 0xfff)#define GET_REG_SAMPLL_CLK1 (val) ((val >> 22) & 0xfff)#define GET_REG_SAMPLL_CLK2 (val) ((val >> 12) & 0xfff) +#define GET_REG_SAMPLL_SETTING (val) ((val) & 0xfff)#define CPG_WEN_BIT BIT(16)
@@ -943,6 +945,7 @@ rzg2l_cpg_sipll5_register(const struct cpg_core_clk *core,struct pll_clk {struct clk_hw hw; +unsigned long default_rate;unsigned int conf;unsigned int type;void __iomem *base;
@@ -980,12 +983,19 @@ static unsigned long rzg3s_cpg_pll_clk_recalc_rate(struct clk_hw *hw, {struct pll_clk *pll_clk =to_pll (hw);struct rzg2l_cpg_priv *priv = pll_clk->priv; -u32 nir, nfr, mr, pr, val; +u32 nir, nfr, mr, pr, val, setting;u64 rate;if (pll_clk->type !=CLK_TYPE_G3S_PLL )return parent_rate; + setting =GET_REG_SAMPLL_SETTING (pll_clk->conf); +if (setting) { + val =readl (priv->base + setting); +if (val &RZG3S_SEL_PLL ) +return pll_clk->default_rate; + } + val =readl (priv->base +GET_REG_SAMPLL_CLK1 (pll_clk->conf)); pr =1 <<FIELD_GET (RZG3S_DIV_P , val);
@@ -1038,6 +1048,7 @@ rzg2l_cpg_pll_clk_register(const struct cpg_core_clk *core, pll_clk->base = priv->base; pll_clk->priv = priv; pll_clk->type = core->type; + pll_clk->default_rate = core->default_rate; ret =devm_clk_hw_register (dev, &pll_clk->hw);if (ret)
drivers/clk/renesas/rzg2l-cpg.h +7 -3
@@ -102,7 +102,10 @@ struct cpg_core_clk {const struct clk_div_table *dtable;const u32 *mtable;const unsigned long invalid_rate; -const unsigned long max_rate; +union { +const unsigned long max_rate; +const unsigned long default_rate; + };const char *const *parent_names;notifier_fn_t notifier;u32 flag;
@@ -144,8 +147,9 @@ enum clk_types { DEF_TYPE(_name, _id, _type, .parent = _parent)#define DEF_SAMPLL (_name, _id, _parent, _conf) \ DEF_TYPE(_name, _id, CLK_TYPE_SAM_PLL, .parent = _parent, .conf = _conf) -#define DEF_G3S_PLL (_name, _id, _parent, _conf) \ - DEF_TYPE(_name, _id, CLK_TYPE_G3S_PLL, .parent = _parent, .conf = _conf) +#define DEF_G3S_PLL (_name, _id, _parent, _conf, _default_rate) \ + DEF_TYPE(_name, _id, CLK_TYPE_G3S_PLL, .parent = _parent, .conf = _conf, \ + .default_rate = _default_rate)#define DEF_INPUT (_name, _id) \ DEF_TYPE(_name, _id, CLK_TYPE_IN)#define DEF_FIXED (_name, _id, _parent, _mult, _div) \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/499 remoteproc: qcom: pas: add minidump_id to SC7280 WPSS
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit d2909538bff0189d4d038f4e903c70be5f5c2bfc ]
Add the minidump ID to the wpss resources, based on msm-5.4 devicetree.
--- drivers/remoteproc/qcom_q6v5_pas.c | 1 + 1 file changed, 1 insertion(+)
drivers/remoteproc/qcom_q6v5_pas.c +1 -0
@@ -1348,6 +1348,7 @@ static const struct adsp_data sc7280_wpss_resource = { .crash_reason_smem = 626, .firmware_name = "wpss.mdt", .pas_id = 6, + .minidump_id = 4, .auto_boot = false, .proxy_pd_names = (char *[]){"cx" ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/499 clk: samsung: Fix UBSAN panic in samsung_clk_init()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will McVicker <[email protected]>
[ Upstream commit d19d7345a7bcdb083b65568a11b11adffe0687af ]
With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to dereferencing ctx->clk_data.hws before setting ctx->clk_data.num = nr_clks. Move that up to fix the crash.
UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP <snip> Call trace: samsung_clk_init+0x110/0x124 (P) samsung_clk_init+0x48/0x124 (L) samsung_cmu_register_one+0x3c/0xa0 exynos_arm64_register_cmu+0x54/0x64 __gs101_cmu_top_of_clk_init_declare+0x28/0x60 ...
--- drivers/clk/samsung/clk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/samsung/clk.c +1 -1
@@ -74,12 +74,12 @@ struct samsung_clk_provider * __init samsung_clk_init(struct device *dev,if (!ctx)panic ("could not allocate clock provider context.\n" ); + ctx->clk_data.num = nr_clks;for (i =0 ; i < nr_clks; ++i) ctx->clk_data.hws[i] =ERR_PTR (-ENOENT ); ctx->dev = dev; ctx->reg_base = base; - ctx->clk_data.num = nr_clks;spin_lock_init (&ctx->lock);return ctx;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 144/499 pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit d6c6fd77e5816e3f6689a2767cdd777797506f24 ]
fwnode_irq_get() was changed to not return 0, fix this by checking for negative error, also update the error log.
--- drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c +2 -2
@@ -2361,8 +2361,8 @@ static int npcm8xx_gpio_fw(struct npcm8xx_pinctrl *pctrl)return dev_err_probe (dev, ret,"gpio-ranges fail for GPIO bank %u\n" , id); ret =fwnode_irq_get (child,0 ); -if (!ret) -return dev_err_probe (dev, ret,"No IRQ for GPIO bank %u\n" , id); +if (ret <0 ) +return dev_err_probe (dev, ret,"Failed to retrieve IRQ for bank %u\n" , id); pctrl->gpio_bank[id].irq = ret; pctrl->gpio_bank[id].irq_chip = npcmgpio_irqchip;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 145/499 crypto: tegra - Fix CMAC intermediate result handling
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit ce390d6c2675d2e24d798169a1a0e3cdbc076907 ]
Saving and restoring of the intermediate results are needed if there is context switch caused by another ongoing request on the same engine. This is therefore not only to support import/export functionality. Hence, save and restore the intermediate result for every non-first task.
--- drivers/crypto/tegra/tegra-se-aes.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +9 -9
@@ -1541,9 +1541,8 @@ static int tegra_cmac_do_update(struct ahash_request *req) rctx->residue.size = nresidue;/* -* If this is not the first 'update' call, paste the previous copied +* If this is not the first task, paste the previous copied * intermediate results to the registers so that it gets picked up. -* This is to support the import/export functionality. */ if (!(rctx->task &SHA_FIRST ))tegra_cmac_paste_result (ctx->se, rctx);
@@ -1551,13 +1550,7 @@ static int tegra_cmac_do_update(struct ahash_request *req) cmdlen =tegra_cmac_prep_cmd (ctx, rctx); ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen); -/* -* If this is not the final update, copy the intermediate results -* from the registers so that it can be used in the next 'update' -* call. This is to support the import/export functionality. -*/ -if (!(rctx->task &SHA_FINAL )) -tegra_cmac_copy_result (ctx->se, rctx); +tegra_cmac_copy_result (ctx->se, rctx);dma_free_coherent (ctx->se->dev, rctx->datbuf.size, rctx->datbuf.buf, rctx->datbuf.addr);
@@ -1594,6 +1587,13 @@ static int tegra_cmac_do_final(struct ahash_request *req) rctx->total_len += rctx->residue.size; rctx->config =tegra234_aes_cfg (SE_ALG_CMAC ,0 ); +/* +* If this is not the first task, paste the previous copied +* intermediate results to the registers so that it gets picked up. +*/ +if (!(rctx->task &SHA_FIRST )) +tegra_cmac_paste_result (ctx->se, rctx); +/* Prepare command and submit */ cmdlen =tegra_cmac_prep_cmd (ctx, rctx); ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 146/499 clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Lypak <[email protected]>
[ Upstream commit cdc59600bccf2cb4c483645438a97d4ec55f326b ]
This clock can't be enable with VENUS_CORE0 GDSC turned off. But that GDSC is under HW control so it can be turned off at any moment. Instead of checking the dependent clock we can just vote for it to enable later when GDSC gets turned on.
--- drivers/clk/qcom/gcc-msm8953.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/gcc-msm8953.c +1 -1
@@ -3770,7 +3770,7 @@ static struct clk_branch gcc_venus0_axi_clk = {static struct clk_branch gcc_venus0_core0_vcodec0_clk = { .halt_reg =0x4c02c , - .halt_check =BRANCH_HALT , + .halt_check =BRANCH_HALT_SKIP , .clkr = { .enable_reg =0x4c02c , .enable_mask =BIT (0 ),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 147/499 selftests/bpf: Fix runqslower cross-endian build
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit cb3ade567816a03d1ac1c33bf86073574efcfcaf ]
The runqslower binary from a cross-endian build currently fails to run because the included skeleton has host endianness. Fix this by passing the target BPF endianness to the runqslower sub-make.
--- tools/bpf/runqslower/Makefile | 3 ++- tools/testing/selftests/bpf/Makefile | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)
tools/bpf/runqslower/Makefile +2 -1
@@ -6,6 +6,7 @@ OUTPUT ?= $(abspath .output)/ BPFTOOL_OUTPUT := $(OUTPUT)bpftool/ DEFAULT_BPFTOOL := $(BPFTOOL_OUTPUT)bootstrap/bpftool BPFTOOL ?= $(DEFAULT_BPFTOOL) +BPF_TARGET_ENDIAN ?= --target=bpf LIBBPF_SRC := $(abspath ../../lib/bpf) BPFOBJ_OUTPUT := $(OUTPUT)libbpf/ BPFOBJ := $(BPFOBJ_OUTPUT)libbpf.a
@@ -63,7 +64,7 @@ $(OUTPUT)/%.skel.h: $(OUTPUT)/%.bpf.o | $(BPFTOOL) $(QUIET_GEN)$(BPFTOOL) gen skeleton $< > $@ $(OUTPUT)/%.bpf.o: %.bpf.c $(BPFOBJ) | $(OUTPUT) - $(QUIET_GEN)$(CLANG) -g -O2 --target=bpf $(INCLUDES) \ + $(QUIET_GEN)$(CLANG) -g -O2 $(BPF_TARGET_ENDIAN) $(INCLUDES) \ -c $(filter %.c,$^) -o $@ && \ $(LLVM_STRIP) -g $@
tools/testing/selftests/bpf/Makefile +1 -0
@@ -354,6 +354,7 @@ $(OUTPUT)/runqslower: $(BPFOBJ) | $(DEFAULT_BPFTOOL) $(RUNQSLOWER_OUTPUT) BPFTOOL_OUTPUT=$(HOST_BUILD_DIR)/bpftool/ \ BPFOBJ_OUTPUT=$(BUILD_DIR)/libbpf/ \ BPFOBJ=$(BPFOBJ) BPF_INCLUDE=$(INCLUDE_DIR) \ + BPF_TARGET_ENDIAN=$(BPF_TARGET_ENDIAN) \ EXTRA_CFLAGS='-g $(OPT_FLAGS) $(SAN_CFLAGS) $(EXTRA_CFLAGS)' \ EXTRA_LDFLAGS='$(SAN_LDFLAGS) $(EXTRA_LDFLAGS)' && \ cp $(RUNQSLOWER_OUTPUT)runqslower $@
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 148/499 s390: Remove ioremap_wt() and pgprot_writethrough()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
[ Upstream commit c94bff63e49302d4ce36502a85a2710a67332a4f ]
It turns out that while s390 architecture calls its memory-I/O mapping variants write-through and write-back the implementation of ioremap_wt() and pgprot_writethrough() does not match Linux notion of ioremap_wt().
In particular Linux expects ioremap_wt() to be weaker still than ioremap_wc(), allowing not just gathering and re-ordering but also reads to be served from cache. Instead s390's implementation is equivalent to normal ioremap() while its ioremap_wc() allows re-ordering.
Note that there are no known users of ioremap_wt() on s390 and the resulting behavior is in line with asm-generic defining ioremap_wt() as ioremap(), if undefined, so no breakage is expected.
As s390 does not have a mapping type matching the Linux notion of ioremap_wt() and pgprot_writethrough(), simply drop them and rely on the asm-generic fallbacks instead.
--- arch/s390/include/asm/io.h | 2 -- arch/s390/include/asm/pgtable.h | 3 --- arch/s390/mm/pgtable.c | 10 ---------- 3 files changed, 15 deletions(-)
arch/s390/include/asm/io.h +0 -2
@@ -34,8 +34,6 @@ void unxlate_dev_mem_ptr(phys_addr_t phys, void *addr);#define ioremap_wc (addr, size) \ ioremap_prot((addr), (size), pgprot_val(pgprot_writecombine(PAGE_KERNEL))) -#define ioremap_wt (addr, size) \ - ioremap_prot((addr), (size), pgprot_val(pgprot_writethrough(PAGE_KERNEL)))static inline void __iomem *ioport_map (unsigned long port,unsigned int nr) {
arch/s390/include/asm/pgtable.h +0 -3
@@ -1391,9 +1391,6 @@ void gmap_pmdp_idte_global(struct mm_struct *mm, unsigned long vmaddr);#define pgprot_writecombine pgprot_writecombinepgprot_t pgprot_writecombine (pgprot_t prot); -#define pgprot_writethrough pgprot_writethrough -pgprot_t pgprot_writethrough (pgprot_t prot); -#define PFN_PTE_SHIFT PAGE_SHIFT/*
arch/s390/mm/pgtable.c +0 -10
@@ -34,16 +34,6 @@ pgprot_t pgprot_writecombine(pgprot_t prot) }EXPORT_SYMBOL_GPL (pgprot_writecombine); -pgprot_t pgprot_writethrough (pgprot_t prot) -{ -/* -* mio_wb_bit_mask may be set on a different CPU, but it is only set -* once at init and only read afterwards. -*/ -return __pgprot (pgprot_val (prot) & ~mio_wb_bit_mask); -} -EXPORT_SYMBOL_GPL (pgprot_writethrough); -static inline void ptep_ipte_local (struct mm_struct *mm,unsigned long addr,pte_t *ptep,int nodat) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 149/499 RDMA/mana_ib: Ensure variable err is initialized
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Bakker <[email protected]>
[ Upstream commit be35a3127d60964b338da95c7bfaaf4a01b330d4 ]
In the function mana_ib_gd_create_dma_region if there are no dma blocks to process the variable err remains uninitialized.
--- drivers/infiniband/hw/mana/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mana/main.c +1 -1
@@ -358,7 +358,7 @@ static int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umemunsigned int tail =0 ;u64 *page_addr_list;void *request_buf; -int err; +int err =0 ; gc =mdev_to_gc (dev); hwc = gc->hwc.driver_data;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 150/499 crypto: tegra - Set IV to NULL explicitly for AES ECB
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit bde558220866e74f19450e16d9a2472b488dfedf ]
It may happen that the variable req->iv may have stale values or zero sized buffer by default and may end up getting used during encryption/decryption. This inturn may corrupt the results or break the operation. Set the req->iv variable to NULL explicitly for algorithms like AES-ECB where IV is not used.
--- drivers/crypto/tegra/tegra-se-aes.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/tegra/tegra-se-aes.c +3 -0
@@ -443,6 +443,9 @@ static int tegra_aes_crypt(struct skcipher_request *req, bool encrypt)if (!req->cryptlen)return 0 ; +if (ctx->alg ==SE_ALG_ECB ) + req->iv =NULL ; + rctx->encrypt = encrypt; rctx->config =tegra234_aes_cfg (ctx->alg, encrypt); rctx->crypto_config =tegra234_aes_crypto_cfg (ctx->alg, encrypt);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 151/499 remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit ba785ff4162a65f18ed501019637a998b752b5ad ]
MSM8226 requires the CX power domain, so use the msm8996_adsp_resource which has cx under proxy_pd_names and is otherwise equivalent.
--- drivers/remoteproc/qcom_q6v5_pas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/qcom_q6v5_pas.c +1 -1
@@ -1411,7 +1411,7 @@ static const struct adsp_data sm8650_mpss_resource = { };static const struct of_device_id adsp_of_match[] = { - { .compatible ="qcom,msm8226-adsp-pil" , .data = &adsp_resource_init}, + { .compatible ="qcom,msm8226-adsp-pil" , .data = &msm8996_adsp_resource}, { .compatible ="qcom,msm8953-adsp-pil" , .data = &msm8996_adsp_resource}, { .compatible ="qcom,msm8974-adsp-pil" , .data = &adsp_resource_init}, { .compatible ="qcom,msm8996-adsp-pil" , .data = &msm8996_adsp_resource},
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 152/499 clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit b60521eff227ef459e03879cbea2b2bd85a8d7af ]
The GPU clock is required for CPU access to GPUSS registers. It was previously decided (on this and many more platforms) that the added overhead/hassle introduced by keeping track of it would not bring much measurable improvement in the power department.
The display clock is basically the same story over again.
Now, we're past that discussion and this commit is not trying to change that. Instead, the clocks are both force-enabled in .probe *and* registered with the common clock framework, resulting in them being toggled off after ignore_unused.
Unregister said clocks to fix breakage when clk_ignore_unused is absent (as it should be).
--- drivers/clk/qcom/gcc-x1e80100.c | 30 ------------------------------ 1 file changed, 30 deletions(-)
drivers/clk/qcom/gcc-x1e80100.c +0 -30
@@ -2564,19 +2564,6 @@ static struct clk_branch gcc_disp_hf_axi_clk = { }, }; -static struct clk_branch gcc_disp_xo_clk = { - .halt_reg =0x27018 , - .halt_check =BRANCH_HALT , - .clkr = { - .enable_reg =0x27018 , - .enable_mask =BIT (0 ), - .hw.init = &(const struct clk_init_data ) { - .name ="gcc_disp_xo_clk" , - .ops = &clk_branch2_ops, - }, - }, -}; -static struct clk_branch gcc_gp1_clk = { .halt_reg =0x64000 , .halt_check =BRANCH_HALT ,
@@ -2631,21 +2618,6 @@ static struct clk_branch gcc_gp3_clk = { }, }; -static struct clk_branch gcc_gpu_cfg_ahb_clk = { - .halt_reg =0x71004 , - .halt_check =BRANCH_HALT_VOTED , - .hwcg_reg =0x71004 , - .hwcg_bit =1 , - .clkr = { - .enable_reg =0x71004 , - .enable_mask =BIT (0 ), - .hw.init = &(const struct clk_init_data ) { - .name ="gcc_gpu_cfg_ahb_clk" , - .ops = &clk_branch2_ops, - }, - }, -}; -static struct clk_branch gcc_gpu_gpll0_cph_clk_src = { .halt_check =BRANCH_HALT_DELAY , .clkr = {
@@ -6268,7 +6240,6 @@ static struct clk_regmap *gcc_x1e80100_clocks[] = { [GCC_CNOC_PCIE_TUNNEL_CLK] = &gcc_cnoc_pcie_tunnel_clk.clkr, [GCC_DDRSS_GPU_AXI_CLK] = &gcc_ddrss_gpu_axi_clk.clkr, [GCC_DISP_HF_AXI_CLK] = &gcc_disp_hf_axi_clk.clkr, - [GCC_DISP_XO_CLK] = &gcc_disp_xo_clk.clkr, [GCC_GP1_CLK] = &gcc_gp1_clk.clkr, [GCC_GP1_CLK_SRC] = &gcc_gp1_clk_src.clkr, [GCC_GP2_CLK] = &gcc_gp2_clk.clkr,
@@ -6281,7 +6252,6 @@ static struct clk_regmap *gcc_x1e80100_clocks[] = { [GCC_GPLL7] = &gcc_gpll7.clkr, [GCC_GPLL8] = &gcc_gpll8.clkr, [GCC_GPLL9] = &gcc_gpll9.clkr, - [GCC_GPU_CFG_AHB_CLK] = &gcc_gpu_cfg_ahb_clk.clkr, [GCC_GPU_GPLL0_CPH_CLK_SRC] = &gcc_gpu_gpll0_cph_clk_src.clkr, [GCC_GPU_GPLL0_DIV_CPH_CLK_SRC] = &gcc_gpu_gpll0_div_cph_clk_src.clkr, [GCC_GPU_MEMNOC_GFX_CLK] = &gcc_gpu_memnoc_gfx_clk.clkr,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 153/499 crypto: tegra - finalize crypto req on error
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit 1e245948ca0c252f561792fabb45de5518301d97 ]
Call the crypto finalize function before exiting *do_one_req() functions. This allows the driver to take up further requests even if the previous one fails.
--- drivers/crypto/tegra/tegra-se-aes.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +17 -11
@@ -275,8 +275,10 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq) rctx->datbuf.size = rctx->len; rctx->datbuf.buf =dma_alloc_coherent (se->dev, rctx->datbuf.size, &rctx->datbuf.addr,GFP_KERNEL ); -if (!rctx->datbuf.buf) -return -ENOMEM ; +if (!rctx->datbuf.buf) { + ret = -ENOMEM ; + goto out_finalize; + }scatterwalk_map_and_copy (rctx->datbuf.buf, req->src,0 , req->cryptlen,0 );
@@ -292,6 +294,7 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)dma_free_coherent (ctx->se->dev, rctx->datbuf.size, rctx->datbuf.buf, rctx->datbuf.addr); +out_finalize:crypto_finalize_skcipher_request (se->engine, req, ret);return 0 ;
@@ -1155,21 +1158,21 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) ret =tegra_ccm_crypt_init (req, se, rctx);if (ret) -return ret; + goto out_finalize;/* Allocate buffers required */ rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen +100 ; rctx->inbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->inbuf.size, &rctx->inbuf.addr,GFP_KERNEL );if (!rctx->inbuf.buf) -return -ENOMEM ; + goto out_finalize; rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen +100 ; rctx->outbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->outbuf.size, &rctx->outbuf.addr,GFP_KERNEL );if (!rctx->outbuf.buf) { ret = -ENOMEM ; - goto outbuf_err; + goto out_free_inbuf; }if (rctx->encrypt) {
@@ -1198,10 +1201,11 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)dma_free_coherent (ctx->se->dev, rctx->inbuf.size, rctx->outbuf.buf, rctx->outbuf.addr); -outbuf_err: +out_free_inbuf:dma_free_coherent (ctx->se->dev, rctx->outbuf.size, rctx->inbuf.buf, rctx->inbuf.addr); +out_finalize:crypto_finalize_aead_request (ctx->se->engine, req, ret);return 0 ;
@@ -1232,15 +1236,17 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen; rctx->inbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->inbuf.size, &rctx->inbuf.addr,GFP_KERNEL ); -if (!rctx->inbuf.buf) -return -ENOMEM ; +if (!rctx->inbuf.buf) { + ret = -ENOMEM ; + goto out_finalize; + } rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen; rctx->outbuf.buf =dma_alloc_coherent (ctx->se->dev, rctx->outbuf.size, &rctx->outbuf.addr,GFP_KERNEL );if (!rctx->outbuf.buf) { ret = -ENOMEM ; - goto outbuf_err; + goto out_free_inbuf; }/* If there is associated data perform GMAC operation */
@@ -1269,11 +1275,11 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)dma_free_coherent (ctx->se->dev, rctx->outbuf.size, rctx->outbuf.buf, rctx->outbuf.addr); -outbuf_err: +out_free_inbuf:dma_free_coherent (ctx->se->dev, rctx->inbuf.size, rctx->inbuf.buf, rctx->inbuf.addr); -/* Finalize the request if there are no errors */ +out_finalize:crypto_finalize_aead_request (ctx->se->engine, req, ret);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 154/499 crypto: tegra - Reserve keyslots to allocate dynamically
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit b157e7a228aee9b48c2de05129476b822aa7956d ]
The HW supports only storing 15 keys at a time. This limits the number of tfms that can work without failutes. Reserve keyslots to solve this and use the reserved ones during the encryption/decryption operation. This allow users to have the capability of hardware protected keys and faster operations if there are limited number of tfms while not halting the operation if there are more tfms.
--- drivers/crypto/tegra/tegra-se-aes.c | 139 +++++++++++++++++++++++----- drivers/crypto/tegra/tegra-se-key.c | 19 +++- drivers/crypto/tegra/tegra-se.h | 28 ++++++ 3 files changed, 164 insertions(+), 22 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +118 -21
@@ -28,6 +28,9 @@ struct tegra_aes_ctx {u32 ivsize;u32 key1_id;u32 key2_id; +u32 keylen; +u8 key1[AES_MAX_KEY_SIZE ]; +u8 key2[AES_MAX_KEY_SIZE ]; };struct tegra_aes_reqctx {
@@ -43,8 +46,9 @@ struct tegra_aead_ctx {struct tegra_se *se;unsigned int authsize;u32 alg; -u32 keylen;u32 key_id; +u32 keylen; +u8 key[AES_MAX_KEY_SIZE ]; };struct tegra_aead_reqctx {
@@ -56,8 +60,8 @@ struct tegra_aead_reqctx {unsigned int cryptlen;unsigned int authsize;bool encrypt; -u32 config;u32 crypto_config; +u32 config;u32 key_id;u32 iv[4 ];u8 authdata[16 ];
@@ -67,6 +71,8 @@ struct tegra_cmac_ctx {struct tegra_se *se;unsigned int alg;u32 key_id; +u32 keylen; +u8 key[AES_MAX_KEY_SIZE ];struct crypto_shash *fallback_tfm; };
@@ -260,11 +266,13 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)struct tegra_aes_ctx *ctx =crypto_skcipher_ctx (crypto_skcipher_reqtfm (req));struct tegra_aes_reqctx *rctx =skcipher_request_ctx (req);struct tegra_se *se = ctx->se; -unsigned int cmdlen; +unsigned int cmdlen, key1_id, key2_id;int ret; rctx->iv = (u32 *)req->iv; rctx->len = req->cryptlen; + key1_id = ctx->key1_id; + key2_id = ctx->key2_id;/* Pad input to AES Block size */ if (ctx->alg !=SE_ALG_XTS ) {
@@ -282,6 +290,29 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)scatterwalk_map_and_copy (rctx->datbuf.buf, req->src,0 , req->cryptlen,0 ); + rctx->config =tegra234_aes_cfg (ctx->alg, rctx->encrypt); + rctx->crypto_config =tegra234_aes_crypto_cfg (ctx->alg, rctx->encrypt); + +if (!key1_id) { + ret =tegra_key_submit_reserved_aes (ctx->se, ctx->key1, + ctx->keylen, ctx->alg, &key1_id); +if (ret) + goto out; + } + + rctx->crypto_config |=SE_AES_KEY_INDEX (key1_id); + +if (ctx->alg ==SE_ALG_XTS ) { +if (!key2_id) { + ret =tegra_key_submit_reserved_xts (ctx->se, ctx->key2, + ctx->keylen, ctx->alg, &key2_id); +if (ret) + goto out; + } + + rctx->crypto_config |=SE_AES_KEY2_INDEX (key2_id); + } +/* Prepare the command and submit for execution */ cmdlen =tegra_aes_prep_cmd (ctx, rctx); ret =tegra_se_host1x_submit (se, se->cmdbuf, cmdlen);
@@ -290,10 +321,17 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)tegra_aes_update_iv (req, ctx);scatterwalk_map_and_copy (rctx->datbuf.buf, req->dst,0 , req->cryptlen,1 ); +out:/* Free the buffer */ dma_free_coherent (ctx->se->dev, rctx->datbuf.size, rctx->datbuf.buf, rctx->datbuf.addr); +if (tegra_key_is_reserved (key1_id)) +tegra_key_invalidate_reserved (ctx->se, key1_id, ctx->alg); + +if (tegra_key_is_reserved (key2_id)) +tegra_key_invalidate_reserved (ctx->se, key2_id, ctx->alg); + out_finalize:crypto_finalize_skcipher_request (se->engine, req, ret);
@@ -316,6 +354,7 @@ static int tegra_aes_cra_init(struct crypto_skcipher *tfm) ctx->se = se_alg->se_dev; ctx->key1_id =0 ; ctx->key2_id =0 ; + ctx->keylen =0 ; algname =crypto_tfm_alg_name (&tfm->base); ret =se_algname_to_algid (algname);
@@ -344,13 +383,20 @@ static int tegra_aes_setkey(struct crypto_skcipher *tfm, const u8 *key, u32 keylen) {struct tegra_aes_ctx *ctx =crypto_skcipher_ctx (tfm); +int ret;if (aes_check_keylen (keylen)) {dev_dbg (ctx->se->dev,"invalid key length (%d)\n" , keylen);return -EINVAL ; } -return tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key1_id); + ret =tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key1_id); +if (ret) { + ctx->keylen = keylen; +memcpy (ctx->key1, key, keylen); + } + +return 0 ; } static int tegra_xts_setkey(struct crypto_skcipher *tfm,
@@ -368,11 +414,17 @@ static int tegra_xts_setkey(struct crypto_skcipher *tfm, ret =tegra_key_submit (ctx->se, key, len, ctx->alg, &ctx->key1_id); -if (ret) -return ret; +if (ret) { + ctx->keylen = len; +memcpy (ctx->key1, key, len); + } -return tegra_key_submit (ctx->se, key + len, len, + ret =tegra_key_submit (ctx->se, key + len, len, ctx->alg, &ctx->key2_id); +if (ret) { + ctx->keylen = len; +memcpy (ctx->key2, key + len, len); + }return 0 ; }
@@ -450,12 +502,6 @@ static int tegra_aes_crypt(struct skcipher_request *req, bool encrypt) req->iv =NULL ; rctx->encrypt = encrypt; - rctx->config =tegra234_aes_cfg (ctx->alg, encrypt); - rctx->crypto_config =tegra234_aes_crypto_cfg (ctx->alg, encrypt); - rctx->crypto_config |=SE_AES_KEY_INDEX (ctx->key1_id); - -if (ctx->key2_id) - rctx->crypto_config |=SE_AES_KEY2_INDEX (ctx->key2_id);return crypto_transfer_skcipher_request_to_engine (ctx->se->engine, req); }
@@ -721,7 +767,7 @@ static int tegra_gcm_do_gmac(struct tegra_aead_ctx *ctx, struct tegra_aead_reqct rctx->config =tegra234_aes_cfg (SE_ALG_GMAC , rctx->encrypt); rctx->crypto_config =tegra234_aes_crypto_cfg (SE_ALG_GMAC , rctx->encrypt) | -SE_AES_KEY_INDEX (ctx->key_id); +SE_AES_KEY_INDEX (rctx->key_id); cmdlen =tegra_gmac_prep_cmd (ctx, rctx);
@@ -738,7 +784,7 @@ static int tegra_gcm_do_crypt(struct tegra_aead_ctx *ctx, struct tegra_aead_reqc rctx->config =tegra234_aes_cfg (SE_ALG_GCM , rctx->encrypt); rctx->crypto_config =tegra234_aes_crypto_cfg (SE_ALG_GCM , rctx->encrypt) | -SE_AES_KEY_INDEX (ctx->key_id); +SE_AES_KEY_INDEX (rctx->key_id);/* Prepare command and submit */ cmdlen =tegra_gcm_crypt_prep_cmd (ctx, rctx);
@@ -761,7 +807,7 @@ static int tegra_gcm_do_final(struct tegra_aead_ctx *ctx, struct tegra_aead_reqc rctx->config =tegra234_aes_cfg (SE_ALG_GCM_FINAL , rctx->encrypt); rctx->crypto_config =tegra234_aes_crypto_cfg (SE_ALG_GCM_FINAL , rctx->encrypt) | -SE_AES_KEY_INDEX (ctx->key_id); +SE_AES_KEY_INDEX (rctx->key_id);/* Prepare command and submit */ cmdlen =tegra_gcm_prep_final_cmd (se, cpuvaddr, rctx);
@@ -892,7 +938,7 @@ static int tegra_ccm_do_cbcmac(struct tegra_aead_ctx *ctx, struct tegra_aead_req rctx->config =tegra234_aes_cfg (SE_ALG_CBC_MAC , rctx->encrypt); rctx->crypto_config =tegra234_aes_crypto_cfg (SE_ALG_CBC_MAC , rctx->encrypt) | -SE_AES_KEY_INDEX (ctx->key_id); +SE_AES_KEY_INDEX (rctx->key_id);/* Prepare command and submit */ cmdlen =tegra_cbcmac_prep_cmd (ctx, rctx);
@@ -1079,7 +1125,7 @@ static int tegra_ccm_do_ctr(struct tegra_aead_ctx *ctx, struct tegra_aead_reqctx rctx->config =tegra234_aes_cfg (SE_ALG_CTR , rctx->encrypt); rctx->crypto_config =tegra234_aes_crypto_cfg (SE_ALG_CTR , rctx->encrypt) | -SE_AES_KEY_INDEX (ctx->key_id); +SE_AES_KEY_INDEX (rctx->key_id);/* Copy authdata in the top of buffer for encryption/decryption */ if (rctx->encrypt)
@@ -1160,6 +1206,8 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)if (ret) goto out_finalize; + rctx->key_id = ctx->key_id; +/* Allocate buffers required */ rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen +100 ; rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size,
@@ -1175,6 +1223,13 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) goto out_free_inbuf; } +if (!ctx->key_id) { + ret =tegra_key_submit_reserved_aes (ctx->se, ctx->key, + ctx->keylen, ctx->alg, &rctx->key_id); +if (ret) + goto out; + } +if (rctx->encrypt) {/* CBC MAC Operation */ ret =tegra_ccm_compute_auth (ctx, rctx);
@@ -1205,6 +1260,9 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)dma_free_coherent (ctx->se->dev, rctx->outbuf.size, rctx->inbuf.buf, rctx->inbuf.addr); +if (tegra_key_is_reserved (rctx->key_id)) +tegra_key_invalidate_reserved (ctx->se, rctx->key_id, ctx->alg); + out_finalize:crypto_finalize_aead_request (ctx->se->engine, req, ret);
@@ -1232,6 +1290,8 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)memcpy (rctx->iv, req->iv,GCM_AES_IV_SIZE ); rctx->iv[3 ] = (1 <<24 ); + rctx->key_id = ctx->key_id; +/* Allocate buffers required */ rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen; rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size,
@@ -1249,6 +1309,13 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) goto out_free_inbuf; } +if (!ctx->key_id) { + ret =tegra_key_submit_reserved_aes (ctx->se, ctx->key, + ctx->keylen, ctx->alg, &rctx->key_id); +if (ret) + goto out; + } +/* If there is associated data perform GMAC operation */ if (rctx->assoclen) { ret =tegra_gcm_do_gmac (ctx, rctx);
@@ -1279,6 +1346,9 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)dma_free_coherent (ctx->se->dev, rctx->inbuf.size, rctx->inbuf.buf, rctx->inbuf.addr); +if (tegra_key_is_reserved (rctx->key_id)) +tegra_key_invalidate_reserved (ctx->se, rctx->key_id, ctx->alg); + out_finalize:crypto_finalize_aead_request (ctx->se->engine, req, ret);
@@ -1301,6 +1371,7 @@ static int tegra_aead_cra_init(struct crypto_aead *tfm) ctx->se = se_alg->se_dev; ctx->key_id =0 ; + ctx->keylen =0 ; ret =se_algname_to_algid (algname);if (ret <0 ) {
@@ -1382,13 +1453,20 @@ static int tegra_aead_setkey(struct crypto_aead *tfm, const u8 *key, u32 keylen) {struct tegra_aead_ctx *ctx =crypto_aead_ctx (tfm); +int ret;if (aes_check_keylen (keylen)) {dev_dbg (ctx->se->dev,"invalid key length (%d)\n" , keylen);return -EINVAL ; } -return tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key_id); + ret =tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key_id); +if (ret) { + ctx->keylen = keylen; +memcpy (ctx->key, key, keylen); + } + +return 0 ; } static unsigned int tegra_cmac_prep_cmd(struct tegra_cmac_ctx *ctx,
@@ -1473,6 +1551,7 @@ static int tegra_cmac_do_init(struct ahash_request *req) rctx->total_len =0 ; rctx->datbuf.size =0 ; rctx->residue.size =0 ; + rctx->key_id = ctx->key_id; rctx->task |=SHA_FIRST ; rctx->blk_size =crypto_ahash_blocksize (tfm);
@@ -1517,7 +1596,7 @@ static int tegra_cmac_do_update(struct ahash_request *req) rctx->datbuf.size = (req->nbytes + rctx->residue.size) - nresidue; rctx->total_len += rctx->datbuf.size; rctx->config =tegra234_aes_cfg (SE_ALG_CMAC ,0 ); - rctx->crypto_config =SE_AES_KEY_INDEX (ctx->key_id); + rctx->crypto_config =SE_AES_KEY_INDEX (rctx->key_id);/* * Keep one block and residue bytes in residue and
@@ -1643,6 +1722,13 @@ static int tegra_cmac_do_one_req(struct crypto_engine *engine, void *areq) rctx->task &= ~SHA_INIT ; } +if (!ctx->key_id) { + ret =tegra_key_submit_reserved_aes (ctx->se, ctx->key, + ctx->keylen, ctx->alg, &rctx->key_id); +if (ret) + goto out; + } +if (rctx->task &SHA_UPDATE ) { ret =tegra_cmac_do_update (req);if (ret)
@@ -1659,6 +1745,9 @@ static int tegra_cmac_do_one_req(struct crypto_engine *engine, void *areq) rctx->task &= ~SHA_FINAL ; } out: +if (tegra_key_is_reserved (rctx->key_id)) +tegra_key_invalidate_reserved (ctx->se, rctx->key_id, ctx->alg); +crypto_finalize_hash_request (se->engine, req, ret);return 0 ;
@@ -1699,6 +1788,7 @@ static int tegra_cmac_cra_init(struct crypto_tfm *tfm) ctx->se = se_alg->se_dev; ctx->key_id =0 ; + ctx->keylen =0 ; ret =se_algname_to_algid (algname);if (ret <0 ) {
@@ -1727,6 +1817,7 @@ static int tegra_cmac_setkey(struct crypto_ahash *tfm, const u8 *key, unsigned int keylen) {struct tegra_cmac_ctx *ctx =crypto_ahash_ctx (tfm); +int ret;if (aes_check_keylen (keylen)) {dev_dbg (ctx->se->dev,"invalid key length (%d)\n" , keylen);
@@ -1736,7 +1827,13 @@ static int tegra_cmac_setkey(struct crypto_ahash *tfm, const u8 *key,if (ctx->fallback_tfm)crypto_shash_setkey (ctx->fallback_tfm, key, keylen); -return tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key_id); + ret =tegra_key_submit (ctx->se, key, keylen, ctx->alg, &ctx->key_id); +if (ret) { + ctx->keylen = keylen; +memcpy (ctx->key, key, keylen); + } + +return 0 ; }static int tegra_cmac_init (struct ahash_request *req)
drivers/crypto/tegra/tegra-se-key.c +18 -1
@@ -141,6 +141,23 @@ void tegra_key_invalidate(struct tegra_se *se, u32 keyid, u32 alg)tegra_keyslot_free (keyid); } +void tegra_key_invalidate_reserved (struct tegra_se *se,u32 keyid,u32 alg) +{ +u8 zkey[AES_MAX_KEY_SIZE ] = {0 }; + +if (!keyid) +return ; + +/* Overwrite the key with 0s */ +tegra_key_insert (se, zkey,AES_MAX_KEY_SIZE , keyid, alg); +} + +inline int tegra_key_submit_reserved (struct tegra_se *se,const u8 *key, +u32 keylen,u32 alg,u32 *keyid) +{ +return tegra_key_insert (se, key, keylen, *keyid, alg); +} +int tegra_key_submit (struct tegra_se *se,const u8 *key,u32 keylen,u32 alg,u32 *keyid) {int ret;
@@ -149,7 +166,7 @@ int tegra_key_submit(struct tegra_se *se, const u8 *key, u32 keylen, u32 alg, u3if (!tegra_key_in_kslt (*keyid)) { *keyid =tegra_keyslot_alloc ();if (!(*keyid)) { -dev_err (se->dev,"failed to allocate key slot\n" ); +dev_dbg (se->dev,"failed to allocate key slot\n" );return -ENOMEM ; } }
drivers/crypto/tegra/tegra-se.h +28 -0
@@ -342,6 +342,9 @@#define SE_MAX_KEYSLOT 15#define SE_MAX_MEM_ALLOC SZ_4M +#define TEGRA_AES_RESERVED_KSLT 14 +#define TEGRA_XTS_RESERVED_KSLT 15 +#define SHA_FIRST BIT(0)#define SHA_INIT BIT(1)#define SHA_UPDATE BIT(2)
@@ -502,9 +505,34 @@ void tegra_deinit_aes(struct tegra_se *se);void tegra_deinit_hash (struct tegra_se *se);int tegra_key_submit (struct tegra_se *se,const u8 *key,u32 keylen,u32 alg,u32 *keyid); + +int tegra_key_submit_reserved (struct tegra_se *se,const u8 *key, +u32 keylen,u32 alg,u32 *keyid); +void tegra_key_invalidate (struct tegra_se *se,u32 keyid,u32 alg); +void tegra_key_invalidate_reserved (struct tegra_se *se,u32 keyid,u32 alg);int tegra_se_host1x_submit (struct tegra_se *se,struct tegra_se_cmdbuf *cmdbuf,u32 size); +static inline int tegra_key_submit_reserved_aes (struct tegra_se *se,const u8 *key, +u32 keylen,u32 alg,u32 *keyid) +{ + *keyid =TEGRA_AES_RESERVED_KSLT ; +return tegra_key_submit_reserved (se, key, keylen, alg, keyid); +} + +static inline int tegra_key_submit_reserved_xts (struct tegra_se *se,const u8 *key, +u32 keylen,u32 alg,u32 *keyid) +{ + *keyid =TEGRA_XTS_RESERVED_KSLT ; +return tegra_key_submit_reserved (se, key, keylen, alg, keyid); +} + +static inline bool tegra_key_is_reserved (u32 keyid) +{ +return ((keyid ==TEGRA_AES_RESERVED_KSLT ) || + (keyid ==TEGRA_XTS_RESERVED_KSLT )); +} +/* HOST1x OPCODES */ static inline u32 host1x_opcode_setpayload (unsigned int payload) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 155/499 bpf: Use preempt_count() directly in bpf_send_signal_common()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit b4a8b5bba712a711d8ca1f7d04646db63f9c88f5 ]
bpf_send_signal_common() uses preemptible() to check whether or not the current context is preemptible. If it is preemptible, it will use irq_work to send the signal asynchronously instead of trying to hold a spin-lock, because spin-lock is sleepable under PREEMPT_RT.
However, preemptible() depends on CONFIG_PREEMPT_COUNT. When CONFIG_PREEMPT_COUNT is turned off (e.g., CONFIG_PREEMPT_VOLUNTARY=y), !preemptible() will be evaluated as 1 and bpf_send_signal_common() will use irq_work unconditionally.
Fix it by unfolding "!preemptible()" and using "preempt_count() != 0 || irqs_disabled()" instead.
--- kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/bpf_trace.c +1 -1
@@ -854,7 +854,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type, struct task_strucif (unlikely (is_global_init (task)))return -EPERM ; -if (!preemptible ()) { +if (preempt_count () !=0 ||irqs_disabled ()) {/* Do an early check on signal validity. Otherwise, * the error is lost in deferred irq_work. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 156/499 lib: 842: Improve error handling in sw842_compress()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanya Agarwal <[email protected]>
[ Upstream commit af324dc0e2b558678aec42260cce38be16cc77ca ]
The static code analysis tool "Coverity Scan" pointed the following implementation details out for further development considerations:
CID 1309755: Unused value
In sw842_compress: A value assigned to a variable is never used. (CWE-563)returned_value: Assigning value from add_repeat_template(p, repeat_count) to ret here, but that stored value is overwritten before it can be used.
Conclusion:
Add error handling for the return value from an add_repeat_template() call.
--- lib/842/842_compress.c | 2 ++ 1 file changed, 2 insertions(+)
lib/842/842_compress.c +2 -0
@@ -532,6 +532,8 @@ int sw842_compress(const u8 *in, unsigned int ilen, }if (repeat_count) { ret =add_repeat_template (p, repeat_count); +if (ret) +return ret; repeat_count =0 ;if (next == last)/* reached max repeat bits */ goto repeat;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 157/499 pinctrl: renesas: rza2: Fix missing of_node_put() call
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrizio Castro <[email protected]>
[ Upstream commit abcdeb4e299a11ecb5a3ea0cce00e68e8f540375 ]
of_parse_phandle_with_fixed_args() requires its caller to call into of_node_put() on the node pointer from the output structure, but such a call is currently missing.
Call into of_node_put() to rectify that.
--- drivers/pinctrl/renesas/pinctrl-rza2.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/renesas/pinctrl-rza2.c +2 -0
@@ -256,6 +256,8 @@ static int rza2_gpio_register(struct rza2_pinctrl_priv *priv)return ret; } +of_node_put (of_args.np); +if ((of_args.args[0 ] !=0 ) || (of_args.args[1 ] !=0 ) || (of_args.args[2 ] != priv->npins)) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 158/499 pinctrl: renesas: rzg2l: Fix missing of_node_put() call
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrizio Castro <[email protected]>
[ Upstream commit a5779e625e2b377f16a6675c432aaf299ce5028c ]
of_parse_phandle_with_fixed_args() requires its caller to call into of_node_put() on the node pointer from the output structure, but such a call is currently missing.
Call into of_node_put() to rectify that.
--- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/renesas/pinctrl-rzg2l.c +2 -0
@@ -2610,6 +2610,8 @@ static int rzg2l_gpio_register(struct rzg2l_pinctrl *pctrl)if (ret)return dev_err_probe (pctrl->dev, ret,"Unable to parse gpio-ranges\n" ); +of_node_put (of_args.np); +if (of_args.args[0 ] !=0 || of_args.args[1 ] !=0 || of_args.args[2 ] != pctrl->data->n_port_pins) return dev_err_probe(pctrl->dev, -EINVAL,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 159/499 RDMA/mlx5: Fix MR cache initialization error flow
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit a0130ef84b00c68ba0b79ee974a0f01459741421 ]
Destroy all previously created cache entries and work queue when rolling back the MR cache initialization upon an error.
--- drivers/infiniband/hw/mlx5/mr.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-)
drivers/infiniband/hw/mlx5/mr.c +22 -11
@@ -919,6 +919,25 @@ mlx5r_cache_create_ent_locked(struct mlx5_ib_dev *dev,return ERR_PTR (ret); } +static void mlx5r_destroy_cache_entries (struct mlx5_ib_dev *dev) +{ +struct rb_root *root = &dev->cache.rb_root; +struct mlx5_cache_ent *ent; +struct rb_node *node; + +mutex_lock (&dev->cache.rb_lock); + node =rb_first (root); +while (node) { + ent = rb_entry(node, struct mlx5_cache_ent, node); + node =rb_next (node); +clean_keys (dev, ent); +rb_erase (&ent->node, root); +mlx5r_mkeys_uninit (ent); +kfree (ent); + } +mutex_unlock (&dev->cache.rb_lock); +} +int mlx5_mkey_cache_init (struct mlx5_ib_dev *dev) {struct mlx5_mkey_cache *cache = &dev->cache;
@@ -970,6 +989,8 @@ int mlx5_mkey_cache_init(struct mlx5_ib_dev *dev) err:mutex_unlock (&cache->rb_lock);mlx5_mkey_cache_debugfs_cleanup (dev); +mlx5r_destroy_cache_entries (dev); +destroy_workqueue (cache->wq);mlx5_ib_warn (dev,"failed to create mkey cache entry\n" );return ret; }
@@ -1003,17 +1024,7 @@ void mlx5_mkey_cache_cleanup(struct mlx5_ib_dev *dev)mlx5_cmd_cleanup_async_ctx (&dev->async_ctx);/* At this point all entries are disabled and have no concurrent work. */ -mutex_lock (&dev->cache.rb_lock); - node =rb_first (root); -while (node) { - ent = rb_entry(node, struct mlx5_cache_ent, node); - node =rb_next (node); -clean_keys (dev, ent); -rb_erase (&ent->node, root); -mlx5r_mkeys_uninit (ent); -kfree (ent); - } -mutex_unlock (&dev->cache.rb_lock); +mlx5r_destroy_cache_entries (dev);destroy_workqueue (dev->cache.wq);del_timer_sync (&dev->delay_timer);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 160/499 selftests/bpf: Fix freplace_link segfault in tailcalls prog test
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <[email protected]>
[ Upstream commit a63a631c9b5cb25a1c17dd2cb18c63df91e978b1 ]
There are two bpf_link__destroy(freplace_link) calls in test_tailcall_bpf2bpf_freplace(). After the first bpf_link__destroy() is called, if the following bpf_map_{update,delete}_elem() throws an exception, it will jump to the "out" label and call bpf_link__destroy() again, causing double free and eventually leading to a segfault.
Fix it by directly resetting freplace_link to NULL after the first bpf_link__destroy() call.
--- tools/testing/selftests/bpf/prog_tests/tailcalls.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/prog_tests/tailcalls.c +1 -0
@@ -1600,6 +1600,7 @@ static void test_tailcall_bpf2bpf_freplace(void) goto out; err =bpf_link__destroy (freplace_link); + freplace_link =NULL ;if (!ASSERT_OK (err,"destroy link" )) goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 161/499 clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Geis <[email protected]>
[ Upstream commit a9e60f1ffe1ca57d6af6a2573e2f950e76efbf5b ]
Correct the clk_ref_usb3otg parent to fix clock control for the usb3 controller on rk3328. Verified against the rk3328 trm, the rk3228h trm, and the rk3328 usb3 phy clock map.
--- drivers/clk/rockchip/clk-rk3328.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3328.c +1 -1
@@ -201,7 +201,7 @@ PNAME(mux_aclk_peri_pre_p) = { "cpll_peri","gpll_peri" , "hdmiphy_peri" };PNAME (mux_ref_usb3otg_src_p) = {"xin24m" , -"clk_usb3otg_ref" }; +"clk_ref_usb3otg_src" };PNAME (mux_xin24m_32k_p) = {"xin24m" ,"clk_rtc32k" }; PNAME(mux_mac2io_src_p) = { "clk_mac2io_src",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 162/499 RDMA/core: Dont expose hw_counters outside of init net namespace
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Gushchin <[email protected]>
[ Upstream commit a1ecb30f90856b0be4168ad51b8875148e285c1f ]
Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to non-init net namespaces. It didn't expose them fully, as an attempt to read any of those counters leads to a crash like this one:
[42021.807566] BUG: kernel NULL pointer dereference, address: 0000000000000028 [42021.814463] #PF: supervisor read access in kernel mode [42021.819549] #PF: error_code(0x0000) - not-present page [42021.824636] PGD 0 P4D 0 [42021.827145] Oops: 0000 [#1] SMP PTI [42021.830598] CPU: 82 PID: 2843922 Comm: switchto-defaul Kdump: loaded Tainted: G S W I XXX [42021.841697] Hardware name: XXX [42021.849619] RIP: 0010:hw_stat_device_show+0x1e/0x40 [ib_core] [42021.855362] Code: 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 49 89 d0 4c 8b 5e 20 48 8b 8f b8 04 00 00 48 81 c7 f0 fa ff ff <48> 8b 41 28 48 29 ce 48 83 c6 d0 48 c1 ee 04 69 d6 ab aa aa aa 48 [42021.873931] RSP: 0018:ffff97fe90f03da0 EFLAGS: 00010287 [42021.879108] RAX: ffff9406988a8c60 RBX: ffff940e1072d438 RCX: 0000000000000000 [42021.886169] RDX: ffff94085f1aa000 RSI: ffff93c6cbbdbcb0 RDI: ffff940c7517aef0 [42021.893230] RBP: ffff97fe90f03e70 R08: ffff94085f1aa000 R09: 0000000000000000 [42021.900294] R10: ffff94085f1aa000 R11: ffffffffc0775680 R12: ffffffff87ca2530 [42021.907355] R13: ffff940651602840 R14: ffff93c6cbbdbcb0 R15: ffff94085f1aa000 [42021.914418] FS: 00007fda1a3b9700(0000) GS:ffff94453fb80000(0000) knlGS:0000000000000000 [42021.922423] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [42021.928130] CR2: 0000000000000028 CR3: 00000042dcfb8003 CR4: 00000000003726f0 [42021.935194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [42021.942257] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [42021.949324] Call Trace: [42021.951756] <TASK> [42021.953842] [<ffffffff86c58674>] ? show_regs+0x64/0x70 [42021.959030] [<ffffffff86c58468>] ? __die+0x78/0xc0 [42021.963874] [<ffffffff86c9ef75>] ? page_fault_oops+0x2b5/0x3b0 [42021.969749] [<ffffffff87674b92>] ? exc_page_fault+0x1a2/0x3c0 [42021.975549] [<ffffffff87801326>] ? asm_exc_page_fault+0x26/0x30 [42021.981517] [<ffffffffc0775680>] ? __pfx_show_hw_stats+0x10/0x10 [ib_core] [42021.988482] [<ffffffffc077564e>] ? hw_stat_device_show+0x1e/0x40 [ib_core] [42021.995438] [<ffffffff86ac7f8e>] dev_attr_show+0x1e/0x50 [42022.000803] [<ffffffff86a3eeb1>] sysfs_kf_seq_show+0x81/0xe0 [42022.006508] [<ffffffff86a11134>] seq_read_iter+0xf4/0x410 [42022.011954] [<ffffffff869f4b2e>] vfs_read+0x16e/0x2f0 [42022.017058] [<ffffffff869f50ee>] ksys_read+0x6e/0xe0 [42022.022073] [<ffffffff8766f1ca>] do_syscall_64+0x6a/0xa0 [42022.027441] [<ffffffff8780013b>] entry_SYSCALL_64_after_hwframe+0x78/0xe2
The problem can be reproduced using the following steps:
ip netns add foo
ip netns exec foo bash
cat /sys/class/infiniband/mlx4_0/hw_counters/*
The panic occurs because of casting the device pointer into an ib_device pointer using container_of() in hw_stat_device_show() is wrong and leads to a memory corruption.
However the real problem is that hw counters should never been exposed outside of the non-init net namespace.
Fix this by saving the index of the corresponding attribute group (it might be 1 or 2 depending on the presence of driver-specific attributes) and zeroing the pointer to hw_counters group for compat devices during the initialization.
With this fix applied hw_counters are not available in a non-init net namespace:
find /sys/class/infiniband/mlx4_0/ -name hw_counters
/sys/class/infiniband/mlx4_0/ports/1/hw_counters /sys/class/infiniband/mlx4_0/ports/2/hw_counters /sys/class/infiniband/mlx4_0/hw_counters
ip netns add foo
ip netns exec foo bash
find /sys/class/infiniband/mlx4_0/ -name hw_counters
--- drivers/infiniband/core/device.c | 9 +++++++++ drivers/infiniband/core/sysfs.c | 1 + include/rdma/ib_verbs.h | 1 + 3 files changed, 11 insertions(+)
drivers/infiniband/core/device.c +9 -0
@@ -545,6 +545,8 @@ static struct class ib_class = {static void rdma_init_coredev (struct ib_core_device *coredev,struct ib_device *dev,struct net *net) { +bool is_full_dev = &dev->coredev == coredev; +/* This BUILD_BUG_ON is intended to catch layout change * of union of ib_core_device and device. * dev must be the first element as ib_core and providers
@@ -556,6 +558,13 @@ static void rdma_init_coredev(struct ib_core_device *coredev, coredev->dev.class = &ib_class; coredev->dev.groups = dev->groups; + +/* +* Don't expose hw counters outside of the init namespace. +*/ +if (!is_full_dev && dev->hw_stats_attr_index) + coredev->dev.groups[dev->hw_stats_attr_index] =NULL ; +device_initialize (&coredev->dev); coredev->owner = dev;INIT_LIST_HEAD (&coredev->port_list);
drivers/infiniband/core/sysfs.c +1 -0
@@ -988,6 +988,7 @@ int ib_setup_device_attrs(struct ib_device *ibdev)for (i =0 ; i !=ARRAY_SIZE (ibdev->groups); i++)if (!ibdev->groups[i]) { ibdev->groups[i] = &data->group; + ibdev->hw_stats_attr_index = i;return 0 ; }WARN (true,"struct ib_device->groups is too small" );
include/rdma/ib_verbs.h +1 -0
@@ -2743,6 +2743,7 @@ struct ib_device {* It is a NULL terminated array. */ const struct attribute_group *groups[4 ]; +u8 hw_stats_attr_index;u64 uverbs_cmd_mask;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 163/499 RDMA/mlx5: Fix calculation of total invalidated pages
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chiara Meiohas <[email protected]>
[ Upstream commit 79195147644653ebffadece31a42181e4c48c07d ]
When invalidating an address range in mlx5, there is an optimization to do UMR operations in chunks.
Previously, the invalidation counter was incorrectly updated for the same indexes within a chunk. Now, the invalidation counter is updated only when a chunk is complete and mlx5r_umr_update_xlt() is called. This ensures that the counter accurately represents the number of pages invalidated using UMR.
--- drivers/infiniband/hw/mlx5/odp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/infiniband/hw/mlx5/odp.c +6 -4
@@ -309,9 +309,6 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni, blk_start_idx = idx; in_block =1 ; } - -/* Count page invalidations */ - invalidations += idx - blk_start_idx +1 ; }else {u64 umr_offset = idx & umr_block_mask;
@@ -321,14 +318,19 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni,MLX5_IB_UPD_XLT_ZAP | MLX5_IB_UPD_XLT_ATOMIC); in_block =0 ; +/* Count page invalidations */ + invalidations += idx - blk_start_idx +1 ; } } } -if (in_block) +if (in_block) {mlx5r_umr_update_xlt (mr, blk_start_idx, idx - blk_start_idx +1 ,0 ,MLX5_IB_UPD_XLT_ZAP |MLX5_IB_UPD_XLT_ATOMIC ); +/* Count page invalidations */ + invalidations += idx - blk_start_idx +1 ; + }mlx5_update_odp_stats (mr, invalidations, invalidations);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 164/499 RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Xu <[email protected]>
[ Upstream commit 83437689249e6a17b25e27712fbee292e42e7855 ]
After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix this issue.
--- drivers/infiniband/hw/erdma/erdma_cm.c | 1 - 1 file changed, 1 deletion(-)
drivers/infiniband/hw/erdma/erdma_cm.c +0 -1
@@ -705,7 +705,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep)erdma_cancel_mpatimer (new_cep);erdma_cep_put (new_cep); - new_cep->sock =NULL ; }if (new_s) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 165/499 remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit 4641840341f37dc8231e0840ec1514b4061b4322 ]
For example MSM8974 has mx voltage rail exposed as regulator and only cx voltage rail is exposed as power domain. This power domain (cx) is attached internally in power domain and cannot be attached in this driver.
--- drivers/remoteproc/qcom_q6v5_mss.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/remoteproc/qcom_q6v5_mss.c +17 -4
@@ -1831,6 +1831,13 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs,while (pd_names[num_pds]) num_pds++; +/* Handle single power domain */ +if (num_pds ==1 && dev->pm_domain) { + devs[0 ] = dev; +pm_runtime_enable (dev); +return 1 ; + } +for (i =0 ; i < num_pds; i++) { devs[i] =dev_pm_domain_attach_by_name (dev, pd_names[i]);if (IS_ERR_OR_NULL (devs[i])) {
@@ -1851,8 +1858,15 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs,static void q6v5_pds_detach (struct q6v5 *qproc,struct device **pds,size_t pd_count) { +struct device *dev = qproc->dev;int i; +/* Handle single power domain */ +if (pd_count ==1 && dev->pm_domain) { +pm_runtime_disable (dev); +return ; + } +for (i =0 ; i < pd_count; i++)dev_pm_domain_detach (pds[i], false); }
@@ -2449,13 +2463,13 @@ static const struct rproc_hexagon_res msm8974_mss = { .supply = "pll", .uA = 100000, }, - {} - }, - .fallback_proxy_supply = (struct qcom_mss_reg_res[]) { { .supply = "mx", .uV = 1050000, }, + {} + }, + .fallback_proxy_supply = (struct qcom_mss_reg_res[]) { { .supply ="cx" , .uA =100000 ,
@@ -2481,7 +2495,6 @@ static const struct rproc_hexagon_res msm8974_mss = {NULL }, .proxy_pd_names = (char *[]){ -"mx" ,"cx" ,NULL },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 166/499 power: supply: bq27xxx_battery: do not update cached flags prematurely
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sicelo A. Mhlongo <[email protected]>
[ Upstream commit 45291874a762dbb12a619dc2efaf84598859007a ]
Commit 243f8ffc883a1 ("power: supply: bq27xxx_battery: Notify also about status changes") intended to notify userspace when the status changes, based on the flags register. However, the cached state is updated too early, before the flags are tested for any changes. Remove the premature update.
--- drivers/power/supply/bq27xxx_battery.c | 1 - 1 file changed, 1 deletion(-)
drivers/power/supply/bq27xxx_battery.c +0 -1
@@ -1913,7 +1913,6 @@ static void bq27xxx_battery_update_unlocked(struct bq27xxx_device_info *di) cache.flags =-1 ;/* read error */ if (cache.flags >=0 ) { cache.capacity =bq27xxx_battery_read_soc (di); - di->cache.flags = cache.flags;/* * On gauges with signed current reporting the current must be
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 167/499 crypto: api - Fix larval relookup type and mask
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 7505436e2925d89a13706a295a6734d6cabb4b43 ]
When the lookup is retried after instance construction, it uses the type and mask from the larval, which may not match the values used by the caller. For example, if the caller is requesting for a !NEEDS_FALLBACK algorithm, it may end up getting an algorithm that needs fallbacks.
Fix this by making the caller supply the type/mask and using that for the lookup.
--- crypto/api.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
crypto/api.c +7 -10
@@ -36,7 +36,8 @@ EXPORT_SYMBOL_GPL(crypto_chain);DEFINE_STATIC_KEY_FALSE (__crypto_boot_test_finished);#endif -static struct crypto_alg *crypto_larval_wait (struct crypto_alg *alg); +static struct crypto_alg *crypto_larval_wait (struct crypto_alg *alg, +u32 type,u32 mask);static struct crypto_alg *crypto_alg_lookup (const char *name,u32 type,u32 mask);
@@ -145,7 +146,7 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,if (alg != &larval->alg) {kfree (larval);if (crypto_is_larval (alg)) - alg =crypto_larval_wait (alg); + alg =crypto_larval_wait (alg, type, mask); }return alg;
@@ -197,7 +198,8 @@ static void crypto_start_test(struct crypto_larval *larval)crypto_schedule_test (larval); } -static struct crypto_alg *crypto_larval_wait (struct crypto_alg *alg) +static struct crypto_alg *crypto_larval_wait (struct crypto_alg *alg, +u32 type,u32 mask) {struct crypto_larval *larval;long time_left;
@@ -219,12 +221,7 @@ static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg)crypto_larval_kill (larval); alg =ERR_PTR (-ETIMEDOUT ); }else if (!alg) { -u32 type; -u32 mask; - alg = &larval->alg; - type = alg->cra_flags & ~(CRYPTO_ALG_LARVAL |CRYPTO_ALG_DEAD ); - mask = larval->mask; alg =crypto_alg_lookup (alg->cra_name, type, mask) ?:ERR_PTR (-EAGAIN ); }else if (IS_ERR (alg))
@@ -304,7 +301,7 @@ static struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, }if (!IS_ERR_OR_NULL (alg) &&crypto_is_larval (alg)) - alg =crypto_larval_wait (alg); + alg =crypto_larval_wait (alg, type, mask);else if (alg) ;else if (!(mask &CRYPTO_ALG_TESTED ))
@@ -352,7 +349,7 @@ struct crypto_alg *crypto_alg_mod_lookup(const char *name, u32 type, u32 mask) ok =crypto_probing_notify (CRYPTO_MSG_ALG_REQUEST , larval);if (ok ==NOTIFY_STOP ) - alg =crypto_larval_wait (larval); + alg =crypto_larval_wait (larval, type, mask);else {crypto_mod_put (larval); alg =ERR_PTR (-ENOENT );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 168/499 IB/mad: Check available slots before posting receive WRs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <[email protected]>
[ Upstream commit 37826f0a8c2f6b6add5179003b8597e32a445362 ]
The ib_post_receive_mads() function handles posting receive work requests (WRs) to MAD QPs and is called in two cases:
1) When a MAD port is opened.
2) When a receive WQE is consumed upon receiving a new MAD.
Whereas, if MADs arrive during the port open phase, a race condition might cause an extra WR to be posted, exceeding the QP’s capacity. This leads to failures such as:
infiniband mlx5_0: ib_post_recv failed: -12
infiniband mlx5_0: Couldn't post receive WRs
infiniband mlx5_0: Couldn't start port
infiniband mlx5_0: Couldn't open port 1
Fix this by checking the current receive count before posting a new WR. If the QP’s receive queue is full, do not post additional WRs.
--- drivers/infiniband/core/mad.c | 38 ++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 18 deletions(-)
drivers/infiniband/core/mad.c +20 -18
@@ -2671,11 +2671,11 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, struct ib_mad_private *mad) {unsigned long flags; -int post, ret;struct ib_mad_private *mad_priv;struct ib_sge sg_list;struct ib_recv_wr recv_wr;struct ib_mad_queue *recv_queue = &qp_info->recv_queue; +int ret =0 ;/* Initialize common scatter list fields */ sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
@@ -2685,7 +2685,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, recv_wr.sg_list = &sg_list; recv_wr.num_sge =1 ; - do { +while (true) {/* Allocate and map receive buffer */ if (mad) { mad_priv = mad;
@@ -2693,10 +2693,8 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, }else { mad_priv =alloc_mad_private (port_mad_size (qp_info->port_priv),GFP_ATOMIC ); -if (!mad_priv) { - ret = -ENOMEM ; -break ; - } +if (!mad_priv) +return -ENOMEM ; } sg_list.length =mad_priv_dma_size (mad_priv); sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
@@ -2705,37 +2703,41 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, DMA_FROM_DEVICE);if (unlikely (ib_dma_mapping_error (qp_info->port_priv->device, sg_list.addr))) { -kfree (mad_priv); ret = -ENOMEM ; -break ; + goto free_mad_priv; } mad_priv->header.mapping = sg_list.addr; mad_priv->header.mad_list.mad_queue = recv_queue; mad_priv->header.mad_list.cqe.done = ib_mad_recv_done; recv_wr.wr_cqe = &mad_priv->header.mad_list.cqe; - -/* Post receive WR */ spin_lock_irqsave (&recv_queue->lock, flags); - post = (++recv_queue->count < recv_queue->max_active); -list_add_tail (&mad_priv->header.mad_list.list, &recv_queue->list); +if (recv_queue->count >= recv_queue->max_active) { +/* Fully populated the receive queue */ +spin_unlock_irqrestore (&recv_queue->lock, flags); +break ; + } + recv_queue->count++; +list_add_tail (&mad_priv->header.mad_list.list, + &recv_queue->list);spin_unlock_irqrestore (&recv_queue->lock, flags); + ret =ib_post_recv (qp_info->qp, &recv_wr,NULL );if (ret) {spin_lock_irqsave (&recv_queue->lock, flags);list_del (&mad_priv->header.mad_list.list); recv_queue->count--;spin_unlock_irqrestore (&recv_queue->lock, flags); -ib_dma_unmap_single (qp_info->port_priv->device, - mad_priv->header.mapping, -mad_priv_dma_size (mad_priv), -DMA_FROM_DEVICE ); -kfree (mad_priv);dev_err (&qp_info->port_priv->device->dev,"ib_post_recv failed: %d\n" , ret);break ; } - }while (post); + } +ib_dma_unmap_single (qp_info->port_priv->device, + mad_priv->header.mapping, +mad_priv_dma_size (mad_priv),DMA_FROM_DEVICE ); +free_mad_priv: +kfree (mad_priv);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 169/499 pinctrl: tegra: Set SFIO mode to Mux Register
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prathamesh Shete <[email protected]>
[ Upstream commit 17013f0acb322e5052ff9b9d0fab0ab5a4bfd828 ]
Tegra devices have an 'sfsel' bit field that determines whether a pin operates in SFIO (Special Function I/O) or GPIO mode. Currently, tegra_pinctrl_gpio_disable_free() sets this bit when releasing a GPIO.
However, tegra_pinctrl_set_mux() can be called independently in certain code paths where gpio_disable_free() is not invoked. In such cases, failing to set the SFIO mode could lead to incorrect pin configurations, resulting in functional issues for peripherals relying on SFIO.
This patch ensures that whenever set_mux() is called, the SFIO mode is correctly set in the Mux Register if the 'sfsel' bit is present. This prevents situations where the pin remains in GPIO mode despite being configured for SFIO use.
--- drivers/pinctrl/tegra/pinctrl-tegra.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pinctrl/tegra/pinctrl-tegra.c +3 -0
@@ -270,6 +270,9 @@ static int tegra_pinctrl_set_mux(struct pinctrl_dev *pctldev, val =pmx_readl (pmx, g->mux_bank, g->mux_reg); val &= ~(0x3 << g->mux_bit); val |= i << g->mux_bit; +/* Set the SFIO/GPIO selection to SFIO when under pinmux control*/ +if (pmx->soc->sfsel_in_mux) + val |= (1 << g->sfsel_bit);pmx_writel (pmx, val, g->mux_bank, g->mux_reg);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 170/499 clk: amlogic: g12b: fix cluster A parent data
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 8995f8f108c3ac5ad52b12a6cfbbc7b3b32e9a58 ]
Several clocks used by both g12a and g12b use the g12a cpu A clock hw pointer as clock parent. This is incorrect on g12b since the parents of cluster A cpu clock are different. Also the hw clock provided as parent to these children is not even registered clock on g12b.
Fix the problem by reverting to the global namespace and let CCF pick the appropriate, as it is already done for other clocks, such as cpu_clk_trace_div.
--- drivers/clk/meson/g12a.c | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-)
drivers/clk/meson/g12a.c +24 -12
@@ -1137,8 +1137,18 @@ static struct clk_regmap g12a_cpu_clk_div16_en = { .hw.init = &(struct clk_init_data) { .name ="cpu_clk_div16_en" , .ops = &clk_regmap_gate_ro_ops, - .parent_hws = (const struct clk_hw *[]) { - &g12a_cpu_clk.hw + .parent_data = &(const struct clk_parent_data ) { +/* +* Note: +* G12A and G12B have different cpu clocks (with +* different struct clk_hw). We fallback to the global +* naming string mechanism so this clock picks +* up the appropriate one. Same goes for the other +* clock using cpu cluster A clock output and present +* on both G12 variant. +*/ + .name ="cpu_clk" , + .index =-1 , }, .num_parents =1 ,/*
@@ -1203,7 +1213,10 @@ static struct clk_regmap g12a_cpu_clk_apb_div = { .hw.init = &(struct clk_init_data){ .name ="cpu_clk_apb_div" , .ops = &clk_regmap_divider_ro_ops, - .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, + .parent_data = &(const struct clk_parent_data ) { + .name ="cpu_clk" , + .index =-1 , + }, .num_parents =1 , }, };
@@ -1237,7 +1250,10 @@ static struct clk_regmap g12a_cpu_clk_atb_div = { .hw.init = &(struct clk_init_data){ .name ="cpu_clk_atb_div" , .ops = &clk_regmap_divider_ro_ops, - .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, + .parent_data = &(const struct clk_parent_data ) { + .name ="cpu_clk" , + .index =-1 , + }, .num_parents =1 , }, };
@@ -1271,7 +1287,10 @@ static struct clk_regmap g12a_cpu_clk_axi_div = { .hw.init = &(struct clk_init_data){ .name ="cpu_clk_axi_div" , .ops = &clk_regmap_divider_ro_ops, - .parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw }, + .parent_data = &(const struct clk_parent_data ) { + .name ="cpu_clk" , + .index =-1 , + }, .num_parents =1 , }, };
@@ -1306,13 +1325,6 @@ static struct clk_regmap g12a_cpu_clk_trace_div = { .name = "cpu_clk_trace_div", .ops = &clk_regmap_divider_ro_ops, .parent_data = &(const struct clk_parent_data ) { -/* -* Note: -* G12A and G12B have different cpu_clks (with -* different struct clk_hw). We fallback to the global -* naming string mechanism so cpu_clk_trace_div picks -* up the appropriate one. -*/ .name ="cpu_clk" , .index =-1 , },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 171/499 clk: amlogic: gxbb: drop non existing 32k clock parent
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 7915d7d5407c026fa9343befb4d3343f7a345f97 ]
The 32k clock reference a parent 'cts_slow_oscin' with a fixme note saying that this clock should be provided by AO controller.
The HW probably has this clock but it does not exist at the moment in any controller implementation. Furthermore, referencing clock by the global name should be avoided whenever possible.
There is no reason to keep this hack around, at least for now.
--- drivers/clk/meson/gxbb.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/clk/meson/gxbb.c +6 -6
@@ -1266,14 +1266,13 @@ static struct clk_regmap gxbb_cts_i958 = { }, }; +/* +* This table skips a clock named 'cts_slow_oscin' in the documentation +* This clock does not exist yet in this controller or the AO one +*/ +static u32 gxbb_32k_clk_parents_val_table[] = {0 ,2 ,3 };static const struct clk_parent_data gxbb_32k_clk_parent_data[] = { { .fw_name ="xtal" , }, -/* -* FIXME: This clock is provided by the ao clock controller but the -* clock is not yet part of the binding of this controller, so string -* name must be use to set this parent. -*/ - { .name ="cts_slow_oscin" , .index =-1 }, { .hw = &gxbb_fclk_div3.hw }, { .hw = &gxbb_fclk_div5.hw }, };
@@ -1283,6 +1282,7 @@ static struct clk_regmap gxbb_32k_clk_sel = { .offset = HHI_32K_CLK_CNTL, .mask = 0x3, .shift = 16, + .table = gxbb_32k_clk_parents_val_table, }, .hw.init = &(struct clk_init_data ){ .name ="32k_clk_sel" ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 172/499 selftests/bpf: Select NUMA_NO_NODE to create map
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saket Kumar Bhaskar <[email protected]>
[ Upstream commit 4107a1aeb20ed4cdad6a0d49de92ea0f933c71b7 ]
On powerpc, a CPU does not necessarily originate from NUMA node 0. This contrasts with architectures like x86, where CPU 0 is not hot-pluggable, making NUMA node 0 a consistently valid node. This discrepancy can lead to failures when creating a map on NUMA node 0, which is initialized by default, if no CPUs are allocated from NUMA node 0.
This patch fixes the issue by setting NUMA_NO_NODE (-1) for map creation for this selftest.
--- tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c +5 -0
@@ -6,6 +6,10 @@#include <test_progs.h> #include "bloom_filter_map.skel.h" +#ifndef NUMA_NO_NODE +#define NUMA_NO_NODE (-1) +#endif +static void test_fail_cases (void ) {LIBBPF_OPTS (bpf_map_create_opts, opts);
@@ -69,6 +73,7 @@ static void test_success_cases(void)/* Create a map */ opts.map_flags =BPF_F_ZERO_SEED |BPF_F_NUMA_NODE ; + opts.numa_node =NUMA_NO_NODE ; fd =bpf_map_create (BPF_MAP_TYPE_BLOOM_FILTER ,NULL ,0 ,sizeof (value),100 , &opts);if (!ASSERT_GE (fd,0 ,"bpf_map_create bloom filter success case" ))return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 173/499 rust: fix signature of rust_fmt_argument
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
[ Upstream commit 901b3290bd4dc35e613d13abd03c129e754dd3dd ]
Without this change, the rest of this series will emit the following error message:
error[E0308]: if and else have incompatible types
--> <linux>/rust/kernel/print.rs:22:22
|
21 | #[export]
| --------- expected because of this
22 | unsafe extern "C" fn rust_fmt_argument(
| ^^^^^^^^^^^^^^^^^ expected `u8`, found `i8`
|
= note: expected fn item `unsafe extern "C" fn(*mut u8, *mut u8, *mut c_void) -> *mut u8 {bindings::rust_fmt_argument}`
found fn item `unsafe extern "C" fn(*mut i8, *mut i8, *const c_void) -> *mut i8 {print::rust_fmt_argument}`The error may be different depending on the architecture.
To fix this, change the void pointer argument to use a const pointer, and change the imports to use crate::ffi instead of core::ffi for integer types.
--- lib/vsprintf.c | 2 +- rust/kernel/print.rs | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-)
lib/vsprintf.c +1 -1
@@ -2299,7 +2299,7 @@ int __init no_hash_pointers_enable(char *str)early_param ("no_hash_pointers" , no_hash_pointers_enable);/* Used for Rust formatting ('%pA'). */ -char *rust_fmt_argument (char *buf,char *end,void *ptr); +char *rust_fmt_argument (char *buf,char *end,const void *ptr);/* * Show a '%p' thing. A kernel extension is that the '%p' is followed
rust/kernel/print.rs +3 -4
@@ -6,12 +6,11 @@//! //! Reference: <https://docs.kernel.org/core-api/printk-basics.html> -use core::{ +use crate ::{ ffi::{c_char, c_void}, - fmt, + str::RawFormatter , }; - -use crate ::str::RawFormatter ; +use core::fmt;// Called from `vsprintf` with format specifier `%pA`. #[expect(clippy::missing_safety_doc)]
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 174/499 crypto: tegra - Fix format specifier in tegra_sha_prep_cmd()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit 795e5bdb0ada2c77ea28611d88f1d5d7ca9b2f4d ]
When building for 32-bit targets, for which ssize_t is 'int' instead of 'long', there is a warning due to an incorrect format specifier:
In file included from include/linux/printk.h:610,
from include/linux/kernel.h:31,
from include/linux/clk.h:13,
from drivers/crypto/tegra/tegra-se-hash.c:7:
drivers/crypto/tegra/tegra-se-hash.c: In function 'tegra_sha_prep_cmd':
drivers/crypto/tegra/tegra-se-hash.c:343:26: error: format '%lu' expects argument of type 'long unsigned int', but argument 6 has type 'ssize_t' {aka 'int'} [-Werror=format=]
343 | dev_dbg(se->dev, "msg len %llu msg left %llu sz %lu cfg %#x",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
drivers/crypto/tegra/tegra-se-hash.c:343:59: note: format string is defined here
343 | dev_dbg(se->dev, "msg len %llu msg left %llu sz %lu cfg %#x",
| ~~^
| |
| long unsigned int
| %ucc1: all warnings being treated as errors
Use '%zd', the proper specifier for ssize_t, to resolve the warning.
--- drivers/crypto/tegra/tegra-se-hash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/tegra/tegra-se-hash.c +1 -1
@@ -340,7 +340,7 @@ static int tegra_sha_prep_cmd(struct tegra_sha_ctx *ctx, u32 *cpuvaddr, cpuvaddr[i++] =host1x_uclass_incr_syncpt_cond_f (1 ) |host1x_uclass_incr_syncpt_indx_f (se->syncpt_id); -dev_dbg (se->dev,"msg len %llu msg left %llu sz %lu cfg %#x" , +dev_dbg (se->dev,"msg len %llu msg left %llu sz %zd cfg %#x" , msg_len, msg_left, rctx->datbuf.size, rctx->config);return i;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 175/499 libbpf: Add namespace for errstr making it libbpf_errstr
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 307ef667e94530c2f2f77797bfe9ea85c22bec7d ]
When statically linking symbols can be replaced with those from other statically linked libraries depending on the link order and the hoped for "multiple definition" error may not appear. To avoid conflicts it is good practice to namespace symbols, this change renames errstr to libbpf_errstr. To avoid churn a #define is used to turn use of errstr(err) to libbpf_errstr(err).
--- tools/lib/bpf/str_error.c | 2 +- tools/lib/bpf/str_error.h | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-)
tools/lib/bpf/str_error.c +1 -1
@@ -36,7 +36,7 @@ char *libbpf_strerror_r(int err, char *dst, int len)return dst; } -const char *errstr (int err) +const char *libbpf_errstr (int err) {static __threadchar buf[12 ];
tools/lib/bpf/str_error.h +5 -2
@@ -7,10 +7,13 @@char *libbpf_strerror_r (int err,char *dst,int len);/** -* @brief **errstr()** returns string corresponding to numeric errno +* @brief **libbpf_errstr()** returns string corresponding to numeric errno * @param err negative numeric errno * @return pointer to string representation of the errno, that is invalidated * upon the next call. */ -const char *errstr (int err); +const char *libbpf_errstr (int err); + +#define errstr (err) libbpf_errstr(err) +#endif /* __LIBBPF_STR_ERROR_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 176/499 clk: mmp: Fix NULL vs IS_ERR() check
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit 00153c64a72d336cc61f4141e5be53b49b7797e1 ]
The devm_kzalloc() function returns NULL on error, not error pointers. Fix the check.
--- drivers/clk/mmp/clk-pxa1908-apmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/mmp/clk-pxa1908-apmu.c +2 -2
@@ -87,8 +87,8 @@ static int pxa1908_apmu_probe(struct platform_device *pdev)struct pxa1908_clk_unit *pxa_unit; pxa_unit =devm_kzalloc (&pdev->dev,sizeof (*pxa_unit),GFP_KERNEL ); -if (IS_ERR (pxa_unit)) -return PTR_ERR (pxa_unit); +if (!pxa_unit) +return -ENOMEM ; pxa_unit->base =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (pxa_unit->base))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 177/499 pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 113ec87b0f26a17b02c58aa2714a9b8f1020eed9 ]
Sparse is not happy about implementation of the NPCM8XX_PINCFG()
pinctrl-npcm8xx.c:1314:9: warning: obsolete array initializer, use C99 syntax pinctrl-npcm8xx.c:1315:9: warning: obsolete array initializer, use C99 syntax
...
pinctrl-npcm8xx.c:1412:9: warning: obsolete array initializer, use C99 syntax pinctrl-npcm8xx.c:1413:9: warning: too many warnings
which uses index-based assignment in a wrong way, i.e. it missed the equal sign and hence the index is simply ignored, while the entries are indexed naturally. This is not a problem as the pin numbering repeats the natural order, but it might be in case of shuffling the entries. Fix this by adding missed equal sign and reformat a bit for better readability.
--- drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c +4 -2
@@ -1290,12 +1290,14 @@ static struct npcm8xx_func npcm8xx_funcs[] = { };#define NPCM8XX_PINCFG (a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p, q) \ - [a] { .fn0 = fn_ ## b, .reg0 = NPCM8XX_GCR_ ## c, .bit0 = d, \ + [a] = { \ + .flag = q, \ + .fn0 = fn_ ## b, .reg0 = NPCM8XX_GCR_ ## c, .bit0 = d, \ .fn1 = fn_ ## e, .reg1 = NPCM8XX_GCR_ ## f, .bit1 = g, \ .fn2 = fn_ ## h, .reg2 = NPCM8XX_GCR_ ## i, .bit2 = j, \ .fn3 = fn_ ## k, .reg3 = NPCM8XX_GCR_ ## l, .bit3 = m, \ .fn4 = fn_ ## n, .reg4 = NPCM8XX_GCR_ ## o, .bit4 = p, \ - .flag = q } + }/* Drive strength controlled by NPCM8XX_GP_N_ODSC */ #define DRIVE_STRENGTH_LO_SHIFT 8
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 178/499 samples/bpf: Fix broken vmlinux path for VMLINUX_BTF
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinghao Jia <[email protected]>
[ Upstream commit 94f53edc64e19640b5245721cd6d0c4a84f52587 ]
Commit 13b25489b6f8 ("kbuild: change working directory to external module directory with M=") changed kbuild working directory of bpf sample programs to samples/bpf, which broke the vmlinux path for VMLINUX_BTF, as the Makefiles assume the current work directory to be the kernel output directory and use a relative path (i.e., ./vmlinux):
Makefile:316: *** Cannot find a vmlinux for VMLINUX_BTF at any of " /path/to/linux/samples/bpf/vmlinux", build the kernel or set VMLINUX_BTF like "VMLINUX_BTF=/sys/kernel/btf/vmlinux" or VMLINUX_H variable. Stop.
Correctly refer to the kernel output directory using $(objtree).
--- samples/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/bpf/Makefile +1 -1
@@ -307,7 +307,7 @@ $(obj)/$(TRACE_HELPERS): TPROGS_CFLAGS := $(TPROGS_CFLAGS) -D__must_check= VMLINUX_BTF_PATHS ?= $(abspath $(if $(O),$(O)/vmlinux)) \ $(abspath $(if $(KBUILD_OUTPUT),$(KBUILD_OUTPUT)/vmlinux)) \ - $(abspath ./vmlinux) + $(abspath $(objtree)/vmlinux) VMLINUX_BTF ?= $(abspath $(firstword $(wildcard $(VMLINUX_BTF_PATHS)))) $(obj)/vmlinux.h: $(VMLINUX_BTF) $(BPFTOOL)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 179/499 crypto: qat - remove access to parity register for QAT GEN4
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bairavi Alagappan <[email protected]>
[ Upstream commit 92c6a707d82f0629debf1c21dd87717776d96af2 ]
The firmware already handles parity errors reported by the accelerators by clearing them through the corresponding SSMSOFTERRORPARITY register. To ensure consistent behavior and prevent race conditions between the driver and firmware, remove the logic that checks the SSMSOFTERRORPARITY registers.
Additionally, change the return type of the function adf_handle_rf_parr_err() to void, as it consistently returns false. Parity errors are recoverable and do not necessitate a device reset.
--- .../intel/qat/qat_common/adf_gen4_ras.c | 57 ++----------------- 1 file changed, 5 insertions(+), 52 deletions(-)
drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c +5 -52
@@ -1043,63 +1043,16 @@ static bool adf_handle_ssmcpppar_err(struct adf_accel_dev *accel_dev,return reset_required; } -static bool adf_handle_rf_parr_err (struct adf_accel_dev *accel_dev, +static void adf_handle_rf_parr_err (struct adf_accel_dev *accel_dev,void __iomem *csr,u32 iastatssm) { -struct adf_dev_err_mask *err_mask =GET_ERR_MASK (accel_dev); -u32 reg; -if (!(iastatssm &ADF_GEN4_IAINTSTATSSM_SSMSOFTERRORPARITY_BIT )) -return false; - - reg =ADF_CSR_RD (csr,ADF_GEN4_SSMSOFTERRORPARITY_SRC ); - reg &=ADF_GEN4_SSMSOFTERRORPARITY_SRC_BIT ; -if (reg) { -ADF_RAS_ERR_CTR_INC (accel_dev->ras_errors,ADF_RAS_UNCORR ); -ADF_CSR_WR (csr,ADF_GEN4_SSMSOFTERRORPARITY_SRC , reg); - } - - reg =ADF_CSR_RD (csr,ADF_GEN4_SSMSOFTERRORPARITY_ATH_CPH ); - reg &= err_mask->parerr_ath_cph_mask; -if (reg) { -ADF_RAS_ERR_CTR_INC (accel_dev->ras_errors,ADF_RAS_UNCORR ); -ADF_CSR_WR (csr,ADF_GEN4_SSMSOFTERRORPARITY_ATH_CPH , reg); - } - - reg =ADF_CSR_RD (csr,ADF_GEN4_SSMSOFTERRORPARITY_CPR_XLT ); - reg &= err_mask->parerr_cpr_xlt_mask; -if (reg) { -ADF_RAS_ERR_CTR_INC (accel_dev->ras_errors,ADF_RAS_UNCORR ); -ADF_CSR_WR (csr,ADF_GEN4_SSMSOFTERRORPARITY_CPR_XLT , reg); - } - - reg =ADF_CSR_RD (csr,ADF_GEN4_SSMSOFTERRORPARITY_DCPR_UCS ); - reg &= err_mask->parerr_dcpr_ucs_mask; -if (reg) { -ADF_RAS_ERR_CTR_INC (accel_dev->ras_errors,ADF_RAS_UNCORR ); -ADF_CSR_WR (csr,ADF_GEN4_SSMSOFTERRORPARITY_DCPR_UCS , reg); - } - - reg =ADF_CSR_RD (csr,ADF_GEN4_SSMSOFTERRORPARITY_PKE ); - reg &= err_mask->parerr_pke_mask; -if (reg) { -ADF_RAS_ERR_CTR_INC (accel_dev->ras_errors,ADF_RAS_UNCORR ); -ADF_CSR_WR (csr,ADF_GEN4_SSMSOFTERRORPARITY_PKE , reg); - } - -if (err_mask->parerr_wat_wcp_mask) { - reg =ADF_CSR_RD (csr,ADF_GEN4_SSMSOFTERRORPARITY_WAT_WCP ); - reg &= err_mask->parerr_wat_wcp_mask; -if (reg) { -ADF_RAS_ERR_CTR_INC (accel_dev->ras_errors,ADF_RAS_UNCORR ); -ADF_CSR_WR (csr,ADF_GEN4_SSMSOFTERRORPARITY_WAT_WCP , - reg); - } - } +return ; +ADF_RAS_ERR_CTR_INC (accel_dev->ras_errors,ADF_RAS_UNCORR );dev_err (&GET_DEV (accel_dev),"Slice ssm soft parity error reported" ); -return false; +return ; } static bool adf_handle_ser_err_ssmsh(struct adf_accel_dev *accel_dev,
@@ -1171,8 +1124,8 @@ static bool adf_handle_iaintstatssm(struct adf_accel_dev *accel_dev, reset_required |=adf_handle_slice_hang_error (accel_dev, csr, iastatssm); reset_required |=adf_handle_spppar_err (accel_dev, csr, iastatssm); reset_required |=adf_handle_ssmcpppar_err (accel_dev, csr, iastatssm); - reset_required |=adf_handle_rf_parr_err (accel_dev, csr, iastatssm); reset_required |=adf_handle_ser_err_ssmsh (accel_dev, csr, iastatssm); +adf_handle_rf_parr_err (accel_dev, csr, iastatssm);ADF_CSR_WR (csr,ADF_GEN4_IAINTSTATSSM , iastatssm);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 180/499 clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurentiu Mihalcea <[email protected]>
[ Upstream commit 91be7d27099dedf813b80702e4ca117d1fb38ce6 ]
The DSP and OCRAM_A modules from AUDIOMIX are clocked by AUDIO_AXI_CLK_ROOT, not AUDIO_AHB_CLK_ROOT. Update the clock data accordingly.
--- drivers/clk/imx/clk-imx8mp-audiomix.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clk/imx/clk-imx8mp-audiomix.c +3 -3
@@ -180,14 +180,14 @@ static struct clk_imx8mp_audiomix_sel sels[] = {CLK_GATE ("asrc" ,ASRC_IPG ),CLK_GATE ("pdm" ,PDM_IPG ),CLK_GATE ("earc" ,EARC_IPG ), -CLK_GATE ("ocrama" ,OCRAMA_IPG ), +CLK_GATE_PARENT ("ocrama" ,OCRAMA_IPG ,"axi" ),CLK_GATE ("aud2htx" ,AUD2HTX_IPG ),CLK_GATE_PARENT ("earc_phy" ,EARC_PHY ,"sai_pll_out_div2" ),CLK_GATE ("sdma2" ,SDMA2_ROOT ),CLK_GATE ("sdma3" ,SDMA3_ROOT ),CLK_GATE ("spba2" ,SPBA2_ROOT ), -CLK_GATE ("dsp" ,DSP_ROOT ), -CLK_GATE ("dspdbg" ,DSPDBG_ROOT ), +CLK_GATE_PARENT ("dsp" ,DSP_ROOT ,"axi" ), +CLK_GATE_PARENT ("dspdbg" ,DSPDBG_ROOT ,"axi" ),CLK_GATE ("edma" ,EDMA_ROOT ),CLK_GATE_PARENT ("audpll" ,AUDPLL_ROOT ,"osc_24m" ), CLK_GATE("mu2", MU2_ROOT),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 181/499 clk: amlogic: g12a: fix mmc A peripheral clock
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 0079e77c08de692cb20b38e408365c830a44b1ef ]
The bit index of the peripheral clock for mmc A is wrong
This was probably not a problem for mmc A as the peripheral is likely left enabled by the bootloader.
No issues has been reported so far but it could be a problem, most likely some form of conflict between the ethernet and mmc A clock, breaking ethernet on init.
Use the value provided by the documentation for mmc A before this becomes an actual problem.
--- drivers/clk/meson/g12a.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/meson/g12a.c +1 -1
@@ -4323,7 +4323,7 @@ static MESON_GATE(g12a_spicc_1, HHI_GCLK_MPEG0, 14); static MESON_GATE(g12a_hiu_reg, HHI_GCLK_MPEG0, 19); static MESON_GATE(g12a_mipi_dsi_phy, HHI_GCLK_MPEG0, 20); static MESON_GATE(g12a_assist_misc, HHI_GCLK_MPEG0, 23); -static MESON_GATE(g12a_emmc_a, HHI_GCLK_MPEG0, 4); +static MESON_GATE(g12a_emmc_a, HHI_GCLK_MPEG0, 24); static MESON_GATE(g12a_emmc_b, HHI_GCLK_MPEG0, 25); static MESON_GATE(g12a_emmc_c, HHI_GCLK_MPEG0, 26); static MESON_GATE(g12a_audio_codec, HHI_GCLK_MPEG0, 28);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 182/499 x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
[ Upstream commit 57e2428f8df8263275344566e02c277648a4b7f1 ]
PUSH_REGS with save_ret=1 is used by interrupt entry helper functions that initially start with a UNWIND_HINT_FUNC ORC state.
However, save_ret=1 means that we clobber the helper function's return address (and then later restore the return address further down on the stack); after that point, the only thing on the stack we can unwind through is the IRET frame, so use UNWIND_HINT_IRET_REGS until we have a full pt_regs frame.
( An alternate approach would be to move the pt_regs->di overwrite down
such that it is the final step of pt_regs setup; but I don't want to rearrange entry code just to make unwinding a tiny bit more elegant. )
--- arch/x86/entry/calling.h | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/entry/calling.h +2 -0
@@ -70,6 +70,8 @@ For 32-bit we have the following conventions - kernel is built with pushq %rsi /* pt_regs->si */ movq 8(%rsp), %rsi /* temporarily store the return address in %rsi */ movq %rdi, 8(%rsp) /* pt_regs->di (overwriting original return address) */ +/* We just clobbered the return address - use the IRET frame for unwinding: */ +UNWIND_HINT_IRET_REGS offset=3 *8 .else pushq %rdi /* pt_regs->di */ pushq %rsi/* pt_regs->si */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 183/499 power: supply: max77693: Fix wrong conversion of charge input threshold value
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 30cc7b0d0e9341d419eb7da15fb5c22406dbe499 ]
The charge input threshold voltage register on the MAX77693 PMIC accepts four values: 0x0 for 4.3v, 0x1 for 4.7v, 0x2 for 4.8v and 0x3 for 4.9v. Due to an oversight, the driver calculated the values for 4.7v and above starting from 0x0, rather than from 0x1 ([(4700000 - 4700000) / 100000] gives 0).
Add 1 to the calculation to ensure that 4.7v is converted to a register value of 0x1 and that the other two voltages are converted correctly as well.
--- drivers/power/supply/max77693_charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/max77693_charger.c +1 -1
@@ -608,7 +608,7 @@ static int max77693_set_charge_input_threshold_volt(struct max77693_charger *chgcase 4700000 :case 4800000 :case 4900000 : - data = (uvolt -4700000 ) /100000 ; + data = ((uvolt -4700000 ) /100000 ) +1 ;break ;default :dev_err (chg->dev,"Wrong value for charge input voltage regulation threshold\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 184/499 crypto: nx - Fix uninitialised hv_nxc on error
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 9b00eb923f3e60ca76cbc8b31123716f3a87ac6a ]
The compiler correctly warns that hv_nxc may be used uninitialised as that will occur when NX-GZIP is unavailable.
Fix it by rearranging the code and delay setting caps_feat until the final query succeeds.
--- drivers/crypto/nx/nx-common-pseries.c | 37 ++++++++++++--------------- 1 file changed, 17 insertions(+), 20 deletions(-)
drivers/crypto/nx/nx-common-pseries.c +17 -20
@@ -1145,6 +1145,7 @@ static void __init nxcop_get_capabilities(void) {struct hv_vas_all_caps *hv_caps;struct hv_nx_cop_caps *hv_nxc; +u64 feat;int rc; hv_caps =kmalloc (sizeof (*hv_caps),GFP_KERNEL );
@@ -1155,27 +1156,26 @@ static void __init nxcop_get_capabilities(void)*/ rc =h_query_vas_capabilities (H_QUERY_NX_CAPABILITIES ,0 , (u64 )virt_to_phys (hv_caps)); +if (!rc) + feat =be64_to_cpu (hv_caps->feat_type); +kfree (hv_caps);if (rc) - goto out; +return ; +if (!(feat &VAS_NX_GZIP_FEAT_BIT )) +return ; - caps_feat =be64_to_cpu (hv_caps->feat_type);/* * NX-GZIP feature available */ -if (caps_feat &VAS_NX_GZIP_FEAT_BIT ) { - hv_nxc =kmalloc (sizeof (*hv_nxc),GFP_KERNEL ); -if (!hv_nxc) - goto out; -/* -* Get capabilities for NX-GZIP feature -*/ - rc =h_query_vas_capabilities (H_QUERY_NX_CAPABILITIES , -VAS_NX_GZIP_FEAT , - (u64 )virt_to_phys (hv_nxc)); - }else { -pr_err ("NX-GZIP feature is not available\n" ); - rc = -EINVAL ; - } + hv_nxc =kmalloc (sizeof (*hv_nxc),GFP_KERNEL ); +if (!hv_nxc) +return ; +/* +* Get capabilities for NX-GZIP feature +*/ + rc =h_query_vas_capabilities (H_QUERY_NX_CAPABILITIES , +VAS_NX_GZIP_FEAT , + (u64 )virt_to_phys (hv_nxc));if (!rc) { nx_cop_caps.descriptor =be64_to_cpu (hv_nxc->descriptor);
@@ -1185,13 +1185,10 @@ static void __init nxcop_get_capabilities(void)be64_to_cpu (hv_nxc->min_compress_len); nx_cop_caps.min_decompress_len =be64_to_cpu (hv_nxc->min_decompress_len); - }else { - caps_feat =0 ; + caps_feat = feat; }kfree (hv_nxc); -out: -kfree (hv_caps); }static const struct vio_device_id nx842_vio_driver_ids[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 185/499 clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit 8b75c2973997e66fd897b7e87b5ba2f3d683e94b ]
With PWRSTS_OFF_ON, USB GDSCs are turned off during gdsc_disable(). This can happen during scenarios such as system suspend and breaks the resume of USB controller from suspend.
So use PWRSTS_RET_ON to indicate the GDSC driver to not turn off the GDSCs during gdsc_disable() and allow the hardware to transition the GDSCs to retention when the parent domain enters low power state during system suspend.
--- drivers/clk/qcom/gcc-sm8650.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/gcc-sm8650.c +2 -2
@@ -3497,7 +3497,7 @@ static struct gdsc usb30_prim_gdsc = { .pd = { .name = "usb30_prim_gdsc", }, - .pwrsts = PWRSTS_OFF_ON, + .pwrsts = PWRSTS_RET_ON, .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, };
@@ -3506,7 +3506,7 @@ static struct gdsc usb3_phy_gdsc = { .pd = { .name = "usb3_phy_gdsc", }, - .pwrsts = PWRSTS_OFF_ON, + .pwrsts = PWRSTS_RET_ON, .flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 186/499 bpf: Fix array bounds error with may_goto
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0 ]
may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size.
1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly.
2. For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it.
3. For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.
--- kernel/bpf/core.c | 19 +++++++++++++++---- kernel/bpf/verifier.c | 7 +++++++ 2 files changed, 22 insertions(+), 4 deletions(-)
kernel/bpf/core.c +15 -4
@@ -2290,17 +2290,18 @@ void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth) insn->code =BPF_JMP |BPF_CALL_ARGS ; }#endif -#else +#endif +static unsigned int __bpf_prog_ret0_warn (const void *ctx,const struct bpf_insn *insn) {/* If this handler ever gets executed, then BPF_JIT_ALWAYS_ON -* is not working properly, so warn about it! +* is not working properly, or interpreter is being used when +* prog->jit_requested is not 0, so warn about it! */ WARN_ON_ONCE (1 );return 0 ; } -#endif bool bpf_prog_map_compatible (struct bpf_map *map,const struct bpf_prog *fp)
@@ -2380,8 +2381,18 @@ static void bpf_prog_select_func(struct bpf_prog *fp) {#ifndef CONFIG_BPF_JIT_ALWAYS_ON u32 stack_depth =max_t (u32, fp->aux->stack_depth,1 ); +u32 idx = (round_up (stack_depth,32 ) /32 ) -1 ; - fp->bpf_func = interpreters[(round_up (stack_depth,32 ) /32 ) -1 ]; +/* may_goto may cause stack size > 512, leading to idx out-of-bounds. +* But for non-JITed programs, we don't need bpf_func, so no bounds +* check needed. +*/ +if (!fp->jit_requested && + !WARN_ON_ONCE (idx >=ARRAY_SIZE (interpreters))) { + fp->bpf_func = interpreters[idx]; + }else { + fp->bpf_func = __bpf_prog_ret0_warn; + }#else fp->bpf_func = __bpf_prog_ret0_warn;#endif
kernel/bpf/verifier.c +7 -0
@@ -21472,6 +21472,13 @@ static int do_misc_fixups(struct bpf_verifier_env *env)if (subprogs[cur_subprog +1 ].start == i + delta +1 ) { subprogs[cur_subprog].stack_depth += stack_depth_extra; subprogs[cur_subprog].stack_extra = stack_depth_extra; + + stack_depth = subprogs[cur_subprog].stack_depth; +if (stack_depth >MAX_BPF_STACK && !prog->jit_requested) { +verbose (env,"stack size %d(extra %d) is too large\n" , + stack_depth, stack_depth_extra); +return -EINVAL ; + } cur_subprog++; stack_depth = subprogs[cur_subprog].stack_depth; stack_depth_extra =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 187/499 RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 5ed3b0cb3f827072e93b4c5b6e2b8106fd7cccbd ]
When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we already have.
The bug however is that we are checking if the QP is identical by checking the QP number inside the CQE against the QP number inside the mlx5_ib_qp, but that's wrong since the QP number from the CQE is from FW so it should be matched against mlx5_core_qp which is our FW QP number.
Otherwise we could use the wrong QP when handling a CQE which could cause the kernel trace below.
This issue is mainly noticeable over QPs 0 & 1, since for now they are the only QPs in our driver whereas the QP number inside mlx5_ib_qp doesn't match the QP number inside mlx5_core_qp.
BUG: kernel NULL pointer dereference, address: 0000000000000012 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP CPU: 0 UID: 0 PID: 7927 Comm: kworker/u62:1 Not tainted 6.14.0-rc3+ #189 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core] RIP: 0010:mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib] Code: 03 00 00 8d 58 ff 21 cb 66 39 d3 74 39 48 c7 c7 3c 89 6e a0 0f b7 db e8 b7 d2 b3 e0 49 8b 86 60 03 00 00 48 c7 c7 4a 89 6e a0 <0f> b7 5c 98 02 e8 9f d2 b3 e0 41 0f b7 86 78 03 00 00 83 e8 01 21 RSP: 0018:ffff88810511bd60 EFLAGS: 00010046 RAX: 0000000000000010 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88885fa1b3c0 RDI: ffffffffa06e894a RBP: 00000000000000b0 R08: 0000000000000000 R09: ffff88810511bc10 R10: 0000000000000001 R11: 0000000000000001 R12: ffff88810d593000 R13: ffff88810e579108 R14: ffff888105146000 R15: 00000000000000b0 FS: 0000000000000000(0000) GS:ffff88885fa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000012 CR3: 00000001077e6001 CR4: 0000000000370eb0 Call Trace: <TASK> ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib] __ib_process_cq+0x5a/0x150 [ib_core] ib_cq_poll_work+0x31/0x90 [ib_core] process_one_work+0x169/0x320 worker_thread+0x288/0x3a0 ? work_busy+0xb0/0xb0 kthread+0xd7/0x1f0 ? kthreads_online_cpu+0x130/0x130 ? kthreads_online_cpu+0x130/0x130 ret_from_fork+0x2d/0x50 ? kthreads_online_cpu+0x130/0x130 ret_from_fork_asm+0x11/0x20 </TASK>
--- drivers/infiniband/hw/mlx5/cq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/cq.c +1 -1
@@ -490,7 +490,7 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq, } qpn =ntohl (cqe64->sop_drop_qpn) &0xffffff ; -if (!*cur_qp || (qpn != (*cur_qp)->ibqp.qp_num)) { +if (!*cur_qp || (qpn != (*cur_qp)->trans_qp.base.mqp.qpn)) {/* We do not have to take the QP table lock here, * because CQs will be locked while QPs are removed * from the table.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 188/499 pinctrl: renesas: rzv2m: Fix missing of_node_put() call
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrizio Castro <[email protected]>
[ Upstream commit 5a550b00704d3a2cd9d766a9427b0f8166da37df ]
of_parse_phandle_with_fixed_args() requires its caller to call into of_node_put() on the node pointer from the output structure, but such a call is currently missing.
Call into of_node_put() to rectify that.
--- drivers/pinctrl/renesas/pinctrl-rzv2m.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/renesas/pinctrl-rzv2m.c +2 -0
@@ -940,6 +940,8 @@ static int rzv2m_gpio_register(struct rzv2m_pinctrl *pctrl)return ret; } +of_node_put (of_args.np); +if (of_args.args[0 ] !=0 || of_args.args[1 ] !=0 || of_args.args[2 ] != pctrl->data->n_port_pins) {dev_err (pctrl->dev,"gpio-ranges does not match selected SOC\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 189/499 clk: qcom: ipq5424: fix software and hardware flow control error of UART
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikanta Mylavarapu <[email protected]>
[ Upstream commit 4b28beb882a0a1af0ce47a8a87e7877a3ae6ad36 ]
The UART’s software and hardware flow control are currently not functioning correctly.
For software flow control, the following error is encountered:qcom_geni_serial 1a80000.serial: Couldn't find suitable clock rate for 56000000, 3500000, 2500000, 1152000, 921600, 19200
During hardware flow control testing, a “Retry 0: Got ZCAN error” is observed.
To address these issues, update the UART frequency table to include all supported frequencies according to the frequency plan.
--- drivers/clk/qcom/gcc-ipq5424.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/clk/qcom/gcc-ipq5424.c +11 -5
@@ -572,13 +572,19 @@ static struct clk_rcg2 gcc_qupv3_spi1_clk_src = { };static const struct freq_tbl ftbl_gcc_qupv3_uart0_clk_src[] = { -F (960000 ,P_XO ,10 ,2 ,5 ), -F (4800000 ,P_XO ,5 ,0 ,0 ), -F (9600000 ,P_XO ,2 ,4 ,5 ), -F (16000000 ,P_GPLL0_OUT_MAIN ,10 ,1 ,5 ), +F (3686400 ,P_GCC_GPLL0_OUT_MAIN_DIV_CLK_SRC ,1 ,144 ,15625 ), +F (7372800 ,P_GCC_GPLL0_OUT_MAIN_DIV_CLK_SRC ,1 ,288 ,15625 ), +F (14745600 ,P_GCC_GPLL0_OUT_MAIN_DIV_CLK_SRC ,1 ,576 ,15625 ),F (24000000 ,P_XO ,1 ,0 ,0 ),F (25000000 ,P_GPLL0_OUT_MAIN ,16 ,1 ,2 ), -F (50000000 ,P_GPLL0_OUT_MAIN ,16 ,0 ,0 ), +F (32000000 ,P_GPLL0_OUT_MAIN ,1 ,1 ,25 ), +F (40000000 ,P_GPLL0_OUT_MAIN ,1 ,1 ,20 ), +F (46400000 ,P_GPLL0_OUT_MAIN ,1 ,29 ,500 ), +F (48000000 ,P_GPLL0_OUT_MAIN ,1 ,3 ,50 ), +F (51200000 ,P_GPLL0_OUT_MAIN ,1 ,8 ,125 ), +F (56000000 ,P_GPLL0_OUT_MAIN ,1 ,7 ,100 ), +F (58982400 ,P_GPLL0_OUT_MAIN ,1 ,1152 ,15625 ), +F (60000000 ,P_GPLL0_OUT_MAIN ,1 ,3 ,40 ),F (64000000 ,P_GPLL0_OUT_MAIN ,12.5 ,0 ,0 ), { } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 190/499 mfd: sm501: Switch to BIT() to mitigate integer overflows
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 2d8cb9ffe18c2f1e5bd07a19cbce85b26c1d0cf0 ]
If offset end up being high enough, right hand expression in functions like sm501_gpio_set() shifted left for that number of bits, may not fit in int type.
Just in case, fix that by using BIT() both as an option safe from overflow issues and to make this step look similar to other gpio drivers.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/mfd/sm501.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mfd/sm501.c +3 -3
@@ -920,7 +920,7 @@ static void sm501_gpio_set(struct gpio_chip *chip, unsigned offset, int value) {struct sm501_gpio_chip *smchip =gpiochip_get_data (chip);struct sm501_gpio *smgpio = smchip->ourgpio; -unsigned long bit =1 << offset; +unsigned long bit =BIT (offset);void __iomem *regs = smchip->regbase;unsigned long save;unsigned long val;
@@ -946,7 +946,7 @@ static int sm501_gpio_input(struct gpio_chip *chip, unsigned offset)struct sm501_gpio_chip *smchip =gpiochip_get_data (chip);struct sm501_gpio *smgpio = smchip->ourgpio;void __iomem *regs = smchip->regbase; -unsigned long bit =1 << offset; +unsigned long bit =BIT (offset);unsigned long save;unsigned long ddr;
@@ -971,7 +971,7 @@ static int sm501_gpio_output(struct gpio_chip *chip, {struct sm501_gpio_chip *smchip =gpiochip_get_data (chip);struct sm501_gpio *smgpio = smchip->ourgpio; -unsigned long bit =1 << offset; +unsigned long bit =BIT (offset);void __iomem *regs = smchip->regbase;unsigned long save;unsigned long val;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 191/499 leds: Fix LED_OFF brightness race
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
[ Upstream commit 2c70953b6f535f7698ccbf22c1f5ba26cb6c2816 ]
While commit fa15d8c69238 ("leds: Fix set_brightness_delayed() race") successfully forces led_set_brightness() to be called with LED_OFF at least once when switching from blinking to LED on state so that hw-blinking can be disabled, another race remains. Indeed in led_set_brightness(LED_OFF) followed by led_set_brightness(any) scenario the following CPU scheduling can happen:
CPU0 CPU1
---- ----
set_brightness_delayed() {
test_and_clear_bit(BRIGHTNESS_OFF)
led_set_brightness(LED_OFF) {
set_bit(BRIGHTNESS_OFF)
queue_work()
}
led_set_brightness(any) {
set_bit(BRIGHTNESS)
queue_work() //already queued
}
test_and_clear_bit(BRIGHTNESS)
/* LED set with brightness any */}
/* From previous CPU1 queue_work() */
set_brightness_delayed() {
test_and_clear_bit(BRIGHTNESS_OFF)
/* LED turned off */
test_and_clear_bit(BRIGHTNESS)
/* Clear from previous run, LED remains off */In that case the led_set_brightness(LED_OFF)/led_set_brightness(any) sequence will be effectively executed in reverse order and LED will remain off.
With the introduction of commit 32360bf6a5d4 ("leds: Introduce ordered workqueue for LEDs events instead of system_wq") the race is easier to trigger as sysfs brightness configuration does not wait for set_brightness_delayed() work to finish (flush_work() removal).
Use delayed_set_value to optionnally re-configure brightness after a LED_OFF. That way a LED state could be configured more that once but final state will always be as expected. Ensure that delayed_set_value modification is seen before set_bit() using smp_mb__before_atomic().
--- drivers/leds/led-core.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
drivers/leds/led-core.c +18 -4
@@ -159,8 +159,19 @@ static void set_brightness_delayed(struct work_struct *ws)* before this work item runs once. To make sure this works properly * handle LED_SET_BRIGHTNESS_OFF first. */ -if (test_and_clear_bit (LED_SET_BRIGHTNESS_OFF , &led_cdev->work_flags)) +if (test_and_clear_bit (LED_SET_BRIGHTNESS_OFF , &led_cdev->work_flags)) {set_brightness_delayed_set_brightness (led_cdev,LED_OFF ); +/* +* The consecutives led_set_brightness(LED_OFF), +* led_set_brightness(LED_FULL) could have been executed out of +* order (LED_FULL first), if the work_flags has been set +* between LED_SET_BRIGHTNESS_OFF and LED_SET_BRIGHTNESS of this +* work. To avoid ending with the LED turned off, turn the LED +* on again. +*/ +if (led_cdev->delayed_set_value !=LED_OFF ) +set_bit (LED_SET_BRIGHTNESS , &led_cdev->work_flags); + }if (test_and_clear_bit (LED_SET_BRIGHTNESS , &led_cdev->work_flags))set_brightness_delayed_set_brightness (led_cdev, led_cdev->delayed_set_value);
@@ -331,10 +342,13 @@ void led_set_brightness_nopm(struct led_classdev *led_cdev, unsigned int value)* change is done immediately afterwards (before the work runs), * it uses a separate work_flag. */ -if (value) { - led_cdev->delayed_set_value = value; + led_cdev->delayed_set_value = value; +/* Ensure delayed_set_value is seen before work_flags modification */ +smp_mb__before_atomic (); + +if (value)set_bit (LED_SET_BRIGHTNESS , &led_cdev->work_flags); - }else { +else {clear_bit (LED_SET_BRIGHTNESS , &led_cdev->work_flags);clear_bit (LED_SET_BLINK , &led_cdev->work_flags);set_bit (LED_SET_BRIGHTNESS_OFF , &led_cdev->work_flags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 192/499 x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
[ Upstream commit 2c118f50d7fd4d9aefc4533a26f83338b2906b7a ]
Commit:
2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again")
was intended to ensure alignment of the stack pointer; but it also moved the initialization of the "stack" variable down into the loop header.
This was likely intended as a no-op cleanup, since the commit message does not mention it; however, this caused a behavioral change because the value of "regs" is different between the two places.
Originally, get_stack_pointer() used the regs provided by the caller; after that commit, get_stack_pointer() instead uses the regs at the top of the stack frame the unwinder is looking at. Often, there are no such regs at all, and "regs" is NULL, causing get_stack_pointer() to fall back to the task's current stack pointer, which is not what we want here, but probably happens to mostly work. Other times, the original regs will point to another regs frame - in that case, the linear guess unwind logic in show_trace_log_lvl() will start unwinding too far up the stack, causing the first frame found by the proper unwinder to never be visited, resulting in a stack trace consisting purely of guess lines.
Fix it by moving the "stack = " assignment back where it belongs.
--- arch/x86/kernel/dumpstack.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/kernel/dumpstack.c +2 -3
@@ -195,6 +195,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,printk ("%sCall Trace:\n" , log_lvl);unwind_start (&state, task, regs, stack); + stack = stack ?:get_stack_pointer (task, regs); regs =unwind_get_entry_regs (&state, &partial);/*
@@ -213,9 +214,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,* - hardirq stack * - entry stack */ -for (stack = stack ?:get_stack_pointer (task, regs); - stack; - stack = stack_info.next_sp) { +for (; stack; stack = stack_info.next_sp) {const char *stack_name; stack =PTR_ALIGN (stack,sizeof (long ));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 193/499 RDMA/core: Fix use-after-free when rename device name
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit 1d6a9e7449e2a0c1e2934eee7880ba8bd1e464cd ]
Syzbot reported a slab-use-after-free with the following call trace:
==================================================================
BUG: KASAN: slab-use-after-free in nla_put+0xd3/0x150 lib/nlattr.c:1099 Read of size 5 at addr ffff888140ea1c60 by task syz.0.988/10025 CPU: 0 UID: 0 PID: 10025 Comm: syz.0.988 Not tainted 6.14.0-rc4-syzkaller-00859-gf77f12010f67 #0 Hardware name: Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x16e/0x5b0 mm/kasan/report.c:521 kasan_report+0x143/0x180 mm/kasan/report.c:634 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 nla_put+0xd3/0x150 lib/nlattr.c:1099 nla_put_string include/net/netlink.h:1621 [inline] fill_nldev_handle+0x16e/0x200 drivers/infiniband/core/nldev.c:265 rdma_nl_notify_event+0x561/0xef0 drivers/infiniband/core/nldev.c:2857 ib_device_notify_register+0x22/0x230 drivers/infiniband/core/device.c:1344 ib_register_device+0x1292/0x1460 drivers/infiniband/core/device.c:1460 rxe_register_device+0x233/0x350 drivers/infiniband/sw/rxe/rxe_verbs.c:1540 rxe_net_add+0x74/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:550 rxe_newlink+0xde/0x1a0 drivers/infiniband/sw/rxe/rxe.c:212 nldev_newlink+0x5ea/0x680 drivers/infiniband/core/nldev.c:1795 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x6dd/0x9e0 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:709 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:724 ____sys_sendmsg+0x53a/0x860 net/socket.c:2564 ___sys_sendmsg net/socket.c:2618 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2650 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f42d1b8d169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 ... RSP: 002b:00007f42d2960038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f42d1da6320 RCX: 00007f42d1b8d169 RDX: 0000000000000000 RSI: 00004000000002c0 RDI: 000000000000000c RBP: 00007f42d1c0e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f42d1da6320 R15: 00007ffe399344a8 </TASK> Allocated by task 10025: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4294 [inline] __kmalloc_node_track_caller_noprof+0x28b/0x4c0 mm/slub.c:4313 __kmemdup_nul mm/util.c:61 [inline] kstrdup+0x42/0x100 mm/util.c:81 kobject_set_name_vargs+0x61/0x120 lib/kobject.c:274 dev_set_name+0xd5/0x120 drivers/base/core.c:3468 assign_name drivers/infiniband/core/device.c:1202 [inline] ib_register_device+0x178/0x1460 drivers/infiniband/core/device.c:1384 rxe_register_device+0x233/0x350 drivers/infiniband/sw/rxe/rxe_verbs.c:1540 rxe_net_add+0x74/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:550 rxe_newlink+0xde/0x1a0 drivers/infiniband/sw/rxe/rxe.c:212 nldev_newlink+0x5ea/0x680 drivers/infiniband/core/nldev.c:1795 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x6dd/0x9e0 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:709 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:724 ____sys_sendmsg+0x53a/0x860 net/socket.c:2564 ___sys_sendmsg net/socket.c:2618 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2650 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 10035: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4609 [inline] kfree+0x196/0x430 mm/slub.c:4757 kobject_rename+0x38f/0x410 lib/kobject.c:524 device_rename+0x16a/0x200 drivers/base/core.c:4525 ib_device_rename+0x270/0x710 drivers/infiniband/core/device.c:402 nldev_set_doit+0x30e/0x4c0 drivers/infiniband/core/nldev.c:1146 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x6dd/0x9e0 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:709 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:724 ____sys_sendmsg+0x53a/0x860 net/socket.c:2564 ___sys_sendmsg net/socket.c:2618 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2650 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
This is because if rename device happens, the old name is freed in ib_device_rename() with lock, but ib_device_notify_register() may visit the dev name locklessly by event RDMA_REGISTER_EVENT or RDMA_NETDEV_ATTACH_EVENT.
Fix this by hold devices_rwsem in ib_device_notify_register().
--- drivers/infiniband/core/device.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/infiniband/core/device.c +7 -2
@@ -1367,9 +1367,11 @@ static void ib_device_notify_register(struct ib_device *device)u32 port;int ret; +down_read (&devices_rwsem); + ret =rdma_nl_notify_event (device,0 ,RDMA_REGISTER_EVENT );if (ret) -return ; + goto out;rdma_for_each_port (device, port) { netdev =ib_device_get_netdev (device, port);
@@ -1380,8 +1382,11 @@ static void ib_device_notify_register(struct ib_device *device) RDMA_NETDEV_ATTACH_EVENT);dev_put (netdev);if (ret) -return ; + goto out; } + +out: +up_read (&devices_rwsem); }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 194/499 crypto: hisilicon/sec2 - fix for aead auth key length
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
[ Upstream commit 1b284ffc30b02808a0de698667cbcf5ce5f9144e ]
According to the HMAC RFC, the authentication key can be 0 bytes, and the hardware can handle this scenario. Therefore, remove the incorrect validation for this case.
--- drivers/crypto/hisilicon/sec2/sec_crypto.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/crypto/hisilicon/sec2/sec_crypto.c +2 -6
@@ -1085,11 +1085,6 @@ static int sec_aead_auth_set_key(struct sec_auth_ctx *ctx,struct crypto_shash *hash_tfm = ctx->hash_tfm;int blocksize, digestsize, ret; -if (!keys->authkeylen) { -pr_err ("hisi_sec2: aead auth key error!\n" ); -return -EINVAL ; - } - blocksize =crypto_shash_blocksize (hash_tfm); digestsize =crypto_shash_digestsize (hash_tfm);if (keys->authkeylen > blocksize) {
@@ -1101,7 +1096,8 @@ static int sec_aead_auth_set_key(struct sec_auth_ctx *ctx, } ctx->a_key_len = digestsize; }else { -memcpy (ctx->a_key, keys->authkey, keys->authkeylen); +if (keys->authkeylen) +memcpy (ctx->a_key, keys->authkey, keys->authkeylen); ctx->a_key_len = keys->authkeylen; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 195/499 pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 0eee258cdf172763502f142d85e967f27a573be0 ]
When instantiating PWM, the bypass should be set to false. The field is used for the selected Intel SoCs that do not have PWM feature enabled in their pin control IPs.
--- drivers/pinctrl/intel/pinctrl-intel.c | 1 - 1 file changed, 1 deletion(-)
drivers/pinctrl/intel/pinctrl-intel.c +0 -1
@@ -1543,7 +1543,6 @@ static int intel_pinctrl_probe_pwm(struct intel_pinctrl *pctrl, .clk_rate = 19200000, .npwm = 1, .base_unit_bits = 22, - .bypass = true, };struct pwm_chip *chip;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 196/499 clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <[email protected]>
[ Upstream commit 000cbe3896c56bf5c625e286ff096533a6b27657 ]
This clock can't be enable with VENUS_CORE0 GDSC turned off. But that GDSC is under HW control so it can be turned off at any moment. Instead of checking the dependent clock we can just vote for it to enable later when GDSC gets turned on.
--- drivers/clk/qcom/mmcc-sdm660.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/mmcc-sdm660.c +1 -1
@@ -2544,7 +2544,7 @@ static struct clk_branch video_core_clk = {static struct clk_branch video_subcore0_clk = { .halt_reg =0x1048 , - .halt_check =BRANCH_HALT , + .halt_check =BRANCH_HALT_SKIP , .clkr = { .enable_reg =0x1048 , .enable_mask =BIT (0 ),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 197/499 libbpf: Fix accessing BTF.ext core_relo header
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit 0a7c2a84359612e54328aa52030eb202093da6e2 ]
Update btf_ext_parse_info() to ensure the core_relo header is present before reading its fields. This avoids a potential buffer read overflow reported by the OSS Fuzz project.
--- tools/lib/bpf/btf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/lib/bpf/btf.c +2 -2
@@ -3015,8 +3015,6 @@ static int btf_ext_parse_info(struct btf_ext *btf_ext, bool is_native) .desc = "line_info", };struct btf_ext_sec_info_param core_relo = { - .off = btf_ext->hdr->core_relo_off, - .len = btf_ext->hdr->core_relo_len, .min_rec_size =sizeof (struct bpf_core_relo ), .ext_info = &btf_ext->core_relo_info, .desc ="core_relo" ,
@@ -3034,6 +3032,8 @@ static int btf_ext_parse_info(struct btf_ext *btf_ext, bool is_native) if (btf_ext->hdr->hdr_len < offsetofend(struct btf_ext_header, core_relo_len))return 0 ;/* skip core relos parsing */ + core_relo.off = btf_ext->hdr->core_relo_off; + core_relo.len = btf_ext->hdr->core_relo_len; err =btf_ext_parse_sec_info (btf_ext, &core_relo, is_native);if (err)return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 198/499 perf stat: Fix find_stat for mixed legacy/non-legacy events
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 8ce0d2da14d3fb62844dd0e95982c194326b1a5f ]
Legacy events typically don't have a PMU when added leading to mismatched legacy/non-legacy cases in find_stat. Use evsel__find_pmu to make sure the evsel PMU is looked up. Update the evsel__find_pmu code to look for the PMU using the extended config type or, for legacy hardware/hw_cache events on non-hybrid systems, just use the core PMU.
Before:
```
$ perf stat -e cycles,cpu/instructions/ -a sleep 1
Performance counter stats for 'system wide':
215,309,764 cycles
44,326,491 cpu/instructions/
1.002555314 seconds time elapsed
```
After:
```
$ perf stat -e cycles,cpu/instructions/ -a sleep 1
Performance counter stats for 'system wide':
990,676,332 cycles
1,235,762,487 cpu/instructions/ # 1.25 insn per cycle
1.002667198 seconds time elapsed
```--- tools/perf/util/pmus.c | 20 +++++++++++++++++--- tools/perf/util/stat-shadow.c | 3 ++- 2 files changed, 19 insertions(+), 4 deletions(-)
tools/perf/util/pmus.c +17 -3
@@ -710,11 +710,25 @@ char *perf_pmus__default_pmu_name(void)struct perf_pmu *evsel__find_pmu (const struct evsel *evsel) {struct perf_pmu *pmu = evsel->pmu; +bool legacy_core_type; -if (!pmu) { - pmu =perf_pmus__find_by_type (evsel->core.attr.type); - ((struct evsel *)evsel)->pmu = pmu; +if (pmu) +return pmu; + + pmu =perf_pmus__find_by_type (evsel->core.attr.type); + legacy_core_type = + evsel->core.attr.type ==PERF_TYPE_HARDWARE || + evsel->core.attr.type ==PERF_TYPE_HW_CACHE ; +if (!pmu && legacy_core_type) { +if (perf_pmus__supports_extended_type ()) { +u32 type = evsel->core.attr.config >>PERF_PMU_TYPE_SHIFT ; + + pmu =perf_pmus__find_by_type (type); + }else { + pmu =perf_pmus__find_core_pmu (); + } } + ((struct evsel *)evsel)->pmu = pmu;return pmu; }
tools/perf/util/stat-shadow.c +2 -1
@@ -151,6 +151,7 @@ static double find_stat(const struct evsel *evsel, int aggr_idx, enum stat_type {struct evsel *cur;int evsel_ctx =evsel_context (evsel); +struct perf_pmu *evsel_pmu =evsel__find_pmu (evsel);evlist__for_each_entry (evsel->evlist, cur) {struct perf_stat_aggr *aggr;
@@ -177,7 +178,7 @@ static double find_stat(const struct evsel *evsel, int aggr_idx, enum stat_type* Except the SW CLOCK events, * ignore if not the PMU we're looking for. */ -if ((type !=STAT_NSECS ) && (evsel->pmu != cur->pmu)) +if ((type !=STAT_NSECS ) && (evsel_pmu !=evsel__find_pmu (cur)))continue ; aggr = &cur->stats->aggr[aggr_idx];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 199/499 perf: Always feature test reallocarray
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit 4c4c0724d6521a8092b7c16f8f210c5869d95b17 ]
This is also used in util/comm.c now, so instead of selectively doing the feature test, always do it. If it's ever used anywhere else it's less likely to cause another build failure.
This doesn't remove the need to manually include libc_compat.h, and missing that will still cause an error for glibc < 2.26. There isn't a way to fix that without poisoning reallocarray like libbpf did, but that has other downsides like making memory debugging tools less useful. So for Perf keep it like this and we'll have to fix up any missed includes.
Fixes the following build error:
util/comm.c:152:31: error: implicit declaration of function
'reallocarray' [-Wimplicit-function-declaration]
152 | tmp = reallocarray(comm_strs->strs,
| ^~~~~~~~~~~~
--- tools/perf/Makefile.config | 10 ++++------ tools/perf/util/comm.c | 2 ++ 2 files changed, 6 insertions(+), 6 deletions(-)
tools/perf/Makefile.config +4 -6
@@ -516,13 +516,14 @@ ifeq ($(feature-setns), 1) $(call detected,CONFIG_SETNS) endif +ifeq ($(feature-reallocarray), 0) + CFLAGS += -DCOMPAT_NEED_REALLOCARRAY +endif + ifdef CORESIGHT $(call feature_check,libopencsd) ifeq ($(feature-libopencsd), 1) CFLAGS += -DHAVE_CSTRACE_SUPPORT $(LIBOPENCSD_CFLAGS) - ifeq ($(feature-reallocarray), 0) - CFLAGS += -DCOMPAT_NEED_REALLOCARRAY - endif LDFLAGS += $(LIBOPENCSD_LDFLAGS) EXTLIBS += $(OPENCSDLIBS) $(call detected,CONFIG_LIBOPENCSD)
@@ -1130,9 +1131,6 @@ ifndef NO_AUXTRACE ifndef NO_AUXTRACE $(call detected,CONFIG_AUXTRACE) CFLAGS += -DHAVE_AUXTRACE_SUPPORT - ifeq ($(feature-reallocarray), 0) - CFLAGS += -DCOMPAT_NEED_REALLOCARRAY - endif endif endif
tools/perf/util/comm.c +2 -0
@@ -5,6 +5,8 @@#include <internal/rc_check.h> #include <linux/refcount.h> #include <linux/zalloc.h> +#include <tools/libc_compat.h> // reallocarray +#include "rwsem.h" DECLARE_RC_STRUCT (comm_str) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 200/499 w1: fix NULL pointer dereference in probe
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit 0dd6770a72f138dabea9eae87f3da6ffa68f0d06 ]
The w1_uart_probe() function calls w1_uart_serdev_open() (which includes devm_serdev_device_open()) before setting the client ops via serdev_device_set_client_ops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receive_buf handler, as it assumes serdev->ops is valid when SERPORT_ACTIVE is set.
This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: cros_ec_uart: properly fix race condition") where devm_serdev_device_open() was called before fully initializing the device.
Fix the race by ensuring client ops are set before enabling the port via w1_uart_serdev_open().
--- drivers/w1/masters/w1-uart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/w1/masters/w1-uart.c +2 -2
@@ -372,11 +372,11 @@ static int w1_uart_probe(struct serdev_device *serdev)init_completion (&w1dev->rx_byte_received);mutex_init (&w1dev->rx_mutex); +serdev_device_set_drvdata (serdev, w1dev); +serdev_device_set_client_ops (serdev, &w1_uart_serdev_ops); ret =w1_uart_serdev_open (w1dev);if (ret <0 )return ret; -serdev_device_set_drvdata (serdev, w1dev); -serdev_device_set_client_ops (serdev, &w1_uart_serdev_ops);return w1_add_master_device (&w1dev->bus); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 201/499 staging: gpib: Fix pr_err format warning
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
[ Upstream commit 03ec050c437bb4e7c5d215bbeedaa93932f13b35 ]
This patch fixes the following compile warning:
drivers/staging/gpib/hp_82341/hp_82341.c: In function 'hp_82341_attach':./include/linux/kern_levels.h:5:25: warning: format '%lx' expects argument of type 'long unsigned int', but argument 2 has type 'u32' {aka 'unsigned int'} [-Wformat=]
It was introduced in
commit baf8855c9160 ("staging: gpib: fix address space mixup")
but was not detected as the build of the driver depended on BROKEN.
--- drivers/staging/gpib/hp_82341/hp_82341.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/gpib/hp_82341/hp_82341.c +1 -1
@@ -718,7 +718,7 @@ int hp_82341_attach(gpib_board_t *board, const gpib_board_config_t *config)for (i =0 ; i < hp_82341_num_io_regions; ++i) { start_addr = iobase + i * hp_priv->io_region_offset;if (!request_region (start_addr, hp_82341_region_iosize,"hp_82341" )) { -pr_err ("hp_82341: failed to allocate io ports 0x%lx-0x%lx\n" , +pr_err ("hp_82341: failed to allocate io ports 0x%x-0x%x\n" , start_addr, start_addr + hp_82341_region_iosize -1 );return -EIO ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 202/499 iio: dac: adi-axi-dac: modify stream enable
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Angelo Dureghello <[email protected]>
[ Upstream commit 6cc60bc38e8428544f8f4f12ddb6cc05fc83a7da ]
Change suggested from the AXI HDL team, modify the function axi_dac_data_stream_enable() to check for interface busy, to avoid possible issues when starting the stream.
--- drivers/iio/dac/adi-axi-dac.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/iio/dac/adi-axi-dac.c +8 -0
@@ -585,6 +585,14 @@ static int axi_dac_ddr_disable(struct iio_backend *back)static int axi_dac_data_stream_enable (struct iio_backend *back) {struct axi_dac_state *st =iio_backend_get_priv (back); +int ret, val; + + ret =regmap_read_poll_timeout (st->regmap, +AXI_DAC_UI_STATUS_REG , val, +FIELD_GET (AXI_DAC_UI_STATUS_IF_BUSY , val) ==0 , +10 ,100 *KILO ); +if (ret) +return ret;return regmap_set_bits (st->regmap,AXI_DAC_CUSTOM_CTRL_REG ,AXI_DAC_CUSTOM_CTRL_STREAM_ENABLE );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 203/499 perf test: Fix Hwmon PMU test endianess issue
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit 888751e4d0e948d0364eee6fb47e21f090b2b5e4 ]
perf test 11 hwmon fails on s390 with this error
# ./perf test -Fv 11
--- start ---
---- end ----
11.1: Basic parsing test : Ok
--- start ---
Testing 'temp_test_hwmon_event1'
Using CPUID IBM,3931,704,A01,3.7,002f
temp_test_hwmon_event1 -> hwmon_a_test_hwmon_pmu/temp_test_hwmon_event1/
FAILED tests/hwmon_pmu.c:189 Unexpected config for
'temp_test_hwmon_event1', 292470092988416 != 655361
---- end ----
11.2: Parsing without PMU name : FAILED!
--- start ---
Testing 'hwmon_a_test_hwmon_pmu/temp_test_hwmon_event1/'
FAILED tests/hwmon_pmu.c:189 Unexpected config for
'hwmon_a_test_hwmon_pmu/temp_test_hwmon_event1/',
292470092988416 != 655361
---- end ----
11.3: Parsing with PMU name : FAILED!
#The root cause is in member test_event::config which is initialized to 0xA0001 or 655361. During event parsing a long list event parsing functions are called and end up with this gdb call stack:
#0 hwmon_pmu__config_term (hwm=0x168dfd0, attr=0x3ffffff5ee8,
term=0x168db60, err=0x3ffffff81c8) at util/hwmon_pmu.c:623 #1 hwmon_pmu__config_terms (pmu=0x168dfd0, attr=0x3ffffff5ee8, terms=0x3ffffff5ea8, err=0x3ffffff81c8) at util/hwmon_pmu.c:662 #2 0x00000000012f870c in perf_pmu__config_terms (pmu=0x168dfd0, attr=0x3ffffff5ee8, terms=0x3ffffff5ea8, zero=false, apply_hardcoded=false, err=0x3ffffff81c8) at util/pmu.c:1519 #3 0x00000000012f88a4 in perf_pmu__config (pmu=0x168dfd0, attr=0x3ffffff5ee8, head_terms=0x3ffffff5ea8, apply_hardcoded=false, err=0x3ffffff81c8) at util/pmu.c:1545 #4 0x00000000012680c4 in parse_events_add_pmu (parse_state=0x3ffffff7fb8, list=0x168dc00, pmu=0x168dfd0, const_parsed_terms=0x3ffffff6090, auto_merge_stats=true, alternate_hw_config=10) at util/parse-events.c:1508 #5 0x00000000012684c6 in parse_events_multi_pmu_add (parse_state=0x3ffffff7fb8, event_name=0x168ec10 "temp_test_hwmon_event1", hw_config=10, const_parsed_terms=0x0, listp=0x3ffffff6230, loc_=0x3ffffff70e0) at util/parse-events.c:1592 #6 0x00000000012f0e4e in parse_events_parse (_parse_state=0x3ffffff7fb8, scanner=0x16878c0) at util/parse-events.y:293 #7 0x00000000012695a0 in parse_events__scanner (str=0x3ffffff81d8 "temp_test_hwmon_event1", input=0x0, parse_state=0x3ffffff7fb8) at util/parse-events.c:1867 #8 0x000000000126a1e8 in __parse_events (evlist=0x168b580, str=0x3ffffff81d8 "temp_test_hwmon_event1", pmu_filter=0x0, err=0x3ffffff81c8, fake_pmu=false, warn_if_reordered=true, fake_tp=false) at util/parse-events.c:2136 #9 0x00000000011e36aa in parse_events (evlist=0x168b580, str=0x3ffffff81d8 "temp_test_hwmon_event1", err=0x3ffffff81c8) at /root/linux/tools/perf/util/parse-events.h:41 #10 0x00000000011e3e64 in do_test (i=0, with_pmu=false, with_alias=false) at tests/hwmon_pmu.c:164 #11 0x00000000011e422c in test__hwmon_pmu (with_pmu=false) at tests/hwmon_pmu.c:219 #12 0x00000000011e431c in test__hwmon_pmu_without_pmu (test=0x1610368 <suite.hwmon_pmu>, subtest=1) at tests/hwmon_pmu.c:23
where the attr::config is set to value 292470092988416 or 0x10a0000000000 in line 625 of file ./util/hwmon_pmu.c:
attr->config = key.type_and_num;
However member key::type_and_num is defined as union and bit field:
union hwmon_pmu_event_key {
long type_and_num;
struct {
int num :16;
enum hwmon_type type :8;
};
};s390 is big endian and Intel is little endian architecture. The events for the hwmon dummy pmu have num = 1 or num = 2 and type is set to HWMON_TYPE_TEMP (which is 10).
On s390 this assignes member key::type_and_num the value of 0x10a0000000000 (which is 292470092988416) as shown in above trace output.
Fix this and export the structure/union hwmon_pmu_event_key so the test shares the same implementation as the event parsing functions for union and bit fields. This should avoid endianess issues on all platforms.
Output after:
# ./perf test -F 11 11.1: Basic parsing test : Ok 11.2: Parsing without PMU name : Ok 11.3: Parsing with PMU name : Ok #
--- tools/perf/tests/hwmon_pmu.c | 16 +++++++++++----- tools/perf/util/hwmon_pmu.c | 14 -------------- tools/perf/util/hwmon_pmu.h | 16 ++++++++++++++++ 3 files changed, 27 insertions(+), 19 deletions(-)
tools/perf/tests/hwmon_pmu.c +11 -5
@@ -13,17 +13,23 @@static const struct test_event {const char *name;const char *alias; -long config; +union hwmon_pmu_event_key key; } test_events[] = { {"temp_test_hwmon_event1" ,"temp1" , -0xA0001 , + .key = { + .num =1 , + .type =10 + }, }, {"temp_test_hwmon_event2" ,"temp2" , -0xA0002 , + .key = { + .num =2 , + .type =10 + }, }, };
@@ -183,11 +189,11 @@ static int do_test(size_t i, bool with_pmu, bool with_alias) strcmp(evsel->pmu->name, "hwmon_a_test_hwmon_pmu")) continue; -if (evsel->core.attr.config != (u64 )test_events[i].config) { +if (evsel->core.attr.config != (u64 )test_events[i].key.type_and_num) {pr_debug ("FAILED %s:%d Unexpected config for '%s', %lld != %ld\n" , __FILE__, __LINE__, str, evsel->core.attr.config, - test_events[i].config); + test_events[i].key.type_and_num); ret =TEST_FAIL ; goto out; }
tools/perf/util/hwmon_pmu.c +0 -14
@@ -107,20 +107,6 @@ struct hwmon_pmu {int hwmon_dir_fd; }; -/** -* union hwmon_pmu_event_key: Key for hwmon_pmu->events as such each key -* represents an event. -* -* Related hwmon files start <type><number> that this key represents. -*/ -union hwmon_pmu_event_key { -long type_and_num; -struct { -int num :16 ; -enum hwmon_type type :8 ; - }; -}; -/** * struct hwmon_pmu_event_value: Value in hwmon_pmu->events. *
tools/perf/util/hwmon_pmu.h +16 -0
@@ -91,6 +91,22 @@ enum hwmon_item { HWMON_ITEM__MAX, }; +/** +* union hwmon_pmu_event_key: Key for hwmon_pmu->events as such each key +* represents an event. +* union is exposed for testing to ensure problems are avoided on big +* endian machines. +* +* Related hwmon files start <type><number> that this key represents. +*/ +union hwmon_pmu_event_key { +long type_and_num; +struct { +int num :16 ; +enum hwmon_type type :8 ; + }; +}; +bool perf_pmu__is_hwmon (const struct perf_pmu *pmu);bool evsel__is_hwmon (const struct evsel *evsel);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 204/499 perf stat: Dont merge counters purely on name
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 2d9961c690d299893735783a2077e866f2d46a56 ]
Counter merging was added in commit 942c5593393d ("perf stat: Add perf_stat_merge_counters()"), however, it merges events with the same name on different PMUs regardless of whether the different PMUs are actually of the same type (ie they differ only in the suffix on the PMU). For hwmon events there may be a temp1 event on every PMU, but the PMU names are all unique and don't differ just by a suffix. The merging is over eager and will merge all the hwmon counters together meaning an aggregated and very large temp1 value is shown. The same would be true for say cache events and memory controller events where the PMUs differ but the event names are the same.
Fix the problem by correctly saying two PMUs alias when they differ only by suffix.
Note, there is an overlap with evsel's merged_stat with aggregation and the evsel's metric_leader where aggregation happens for metrics.
--- tools/perf/util/stat.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
tools/perf/util/stat.c +11 -2
@@ -535,7 +535,10 @@ static int evsel__merge_aggr_counters(struct evsel *evsel, struct evsel *alias)return 0 ; } -/* events should have the same name, scale, unit, cgroup but on different PMUs */ +/* +* Events should have the same name, scale, unit, cgroup but on different core +* PMUs or on different but matching uncore PMUs. +*/ static bool evsel__is_alias (struct evsel *evsel_a,struct evsel *evsel_b) {if (strcmp (evsel__name (evsel_a),evsel__name (evsel_b)))
@@ -553,7 +556,13 @@ static bool evsel__is_alias(struct evsel *evsel_a, struct evsel *evsel_b)if (evsel__is_clock (evsel_a) !=evsel__is_clock (evsel_b))return false; -return evsel_a->pmu != evsel_b->pmu; +if (evsel_a->pmu == evsel_b->pmu || evsel_a->pmu ==NULL || evsel_b->pmu ==NULL ) +return false; + +if (evsel_a->pmu->is_core) +return evsel_b->pmu->is_core; + +return perf_pmu__name_no_suffix_match (evsel_a->pmu, evsel_b->pmu->name); }static void evsel__merge_aliases (struct evsel *evsel)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 205/499 fs/ntfs3: Update inode->i_mapping->a_ops on compression state
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit b432163ebd15a0fb74051949cb61456d6c55ccbd ]
Update inode->i_mapping->a_ops when the compression state changes to ensure correct address space operations.
Clear ATTR_FLAG_SPARSED/FILE_ATTRIBUTE_SPARSE_FILE when enabling compression to prevent flag conflicts.
v2:
Additionally, ensure that all dirty pages are flushed and concurrent access to the page cache is blocked.
--- fs/ntfs3/attrib.c | 3 ++- fs/ntfs3/file.c | 22 ++++++++++++++++++++-- fs/ntfs3/frecord.c | 6 ++++-- 3 files changed, 26 insertions(+), 5 deletions(-)
fs/ntfs3/attrib.c +2 -1
@@ -2664,8 +2664,9 @@ int attr_set_compress(struct ntfs_inode *ni, bool compr) attr->nres.run_off =cpu_to_le16 (run_off); } -/* Update data attribute flags. */ +/* Update attribute flags. */ if (compr) { + attr->flags &= ~ATTR_FLAG_SPARSED ; attr->flags |=ATTR_FLAG_COMPRESSED ; attr->nres.c_unit =NTFS_LZNT_CUNIT ; }else {
fs/ntfs3/file.c +20 -2
@@ -101,8 +101,26 @@ int ntfs_fileattr_set(struct mnt_idmap *idmap, struct dentry *dentry,/* Allowed to change compression for empty files and for directories only. */ if (!is_dedup (ni) && !is_encrypted (ni) && (S_ISREG (inode->i_mode) ||S_ISDIR (inode->i_mode))) { -/* Change compress state. */ -int err =ni_set_compress (inode, flags &FS_COMPR_FL ); +int err =0 ; +struct address_space *mapping = inode->i_mapping; + +/* write out all data and wait. */ +filemap_invalidate_lock (mapping); + err =filemap_write_and_wait (mapping); + +if (err >=0 ) { +/* Change compress state. */ +bool compr = flags &FS_COMPR_FL ; + err =ni_set_compress (inode, compr); + +/* For files change a_ops too. */ +if (!err) + mapping->a_ops = compr ? &ntfs_aops_cmpr : + &ntfs_aops; + } + +filemap_invalidate_unlock (mapping); +if (err)return err; }
fs/ntfs3/frecord.c +4 -2
@@ -3433,10 +3433,12 @@ int ni_set_compress(struct inode *inode, bool compr) } ni->std_fa = std->fa; -if (compr) +if (compr) { + std->fa &= ~FILE_ATTRIBUTE_SPARSE_FILE ; std->fa |=FILE_ATTRIBUTE_COMPRESSED ; -else + }else { std->fa &= ~FILE_ATTRIBUTE_COMPRESSED ; + }if (ni->std_fa != std->fa) { ni->std_fa = std->fa;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 206/499 phy: phy-rockchip-samsung-hdptx: Dont use dt aliases to determine phy-id
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <[email protected]>
[ Upstream commit f08d1c08563846f9be79a4859e912c8795d690fd ]
The phy needs to know its identity in the system (phy0 or phy1 on rk3588) for some actions and the driver currently contains code abusing of_alias for that.
Devicetree aliases are always optional and should not be used for core device functionality, so instead keep a list of phys on a soc in the of_device_data and find the phy-id by comparing against the mapped register-base.
--- .../phy/rockchip/phy-rockchip-samsung-hdptx.c | 50 ++++++++++++++++--- 1 file changed, 44 insertions(+), 6 deletions(-)
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c +44 -6
@@ -263,11 +263,22 @@ enum rk_hdptx_reset {RST_MAX }; +#define MAX_HDPTX_PHY_NUM 2 + +struct rk_hdptx_phy_cfg { +unsigned int num_phys; +unsigned int phy_ids[MAX_HDPTX_PHY_NUM ]; +}; +struct rk_hdptx_phy {struct device *dev;struct regmap *regmap;struct regmap *grf; +/* PHY const config */ +const struct rk_hdptx_phy_cfg *cfgs; +int phy_id; +struct phy *phy;struct phy_config *phy_cfg;struct clk_bulk_data *clks;
@@ -1007,15 +1018,14 @@ static int rk_hdptx_phy_clk_register(struct rk_hdptx_phy *hdptx)struct device *dev = hdptx->dev;const char *name, *pname;struct clk *refclk; -int ret, id; +int ret; refclk =devm_clk_get (dev,"ref" );if (IS_ERR (refclk))return dev_err_probe (dev,PTR_ERR (refclk),"Failed to get ref clock\n" ); - id =of_alias_get_id (dev->of_node,"hdptxphy" ); - name = id >0 ?"clk_hdmiphy_pixel1" :"clk_hdmiphy_pixel0" ; + name = hdptx->phy_id >0 ?"clk_hdmiphy_pixel1" :"clk_hdmiphy_pixel0" ; pname =__clk_get_name (refclk); hdptx->hw.init = CLK_HW_INIT(name, pname, &hdptx_phy_clk_ops,
@@ -1058,8 +1068,9 @@ static int rk_hdptx_phy_probe(struct platform_device *pdev)struct phy_provider *phy_provider;struct device *dev = &pdev->dev;struct rk_hdptx_phy *hdptx; +struct resource *res;void __iomem *regs; -int ret; +int ret, id; hdptx =devm_kzalloc (dev,sizeof (*hdptx),GFP_KERNEL );if (!hdptx)
@@ -1067,11 +1078,27 @@ static int rk_hdptx_phy_probe(struct platform_device *pdev) hdptx->dev = dev; - regs =devm_platform_ioremap_resource (pdev,0 ); + regs =devm_platform_get_and_ioremap_resource (pdev,0 , &res);if (IS_ERR (regs))return dev_err_probe (dev,PTR_ERR (regs),"Failed to ioremap resource\n" ); + hdptx->cfgs =device_get_match_data (dev); +if (!hdptx->cfgs) +return dev_err_probe (dev, -EINVAL ,"missing match data\n" ); + +/* find the phy-id from the io address */ + hdptx->phy_id = -ENODEV ; +for (id =0 ; id < hdptx->cfgs->num_phys; id++) { +if (res->start == hdptx->cfgs->phy_ids[id]) { + hdptx->phy_id = id; +break ; + } + } + +if (hdptx->phy_id <0 ) +return dev_err_probe (dev, -ENODEV ,"no matching device found\n" ); + ret =devm_clk_bulk_get_all (dev, &hdptx->clks);if (ret <0 )return dev_err_probe (dev, ret,"Failed to get clocks\n" );
@@ -1132,8 +1159,19 @@ static const struct dev_pm_ops rk_hdptx_phy_pm_ops = { rk_hdptx_phy_runtime_resume, NULL) }; +static const struct rk_hdptx_phy_cfg rk3588_hdptx_phy_cfgs = { + .num_phys =2 , + .phy_ids = { +0xfed60000 , +0xfed70000 , + }, +}; +static const struct of_device_id rk_hdptx_phy_of_match[] = { - { .compatible ="rockchip,rk3588-hdptx-phy" , }, + { + .compatible ="rockchip,rk3588-hdptx-phy" , + .data = &rk3588_hdptx_phy_cfgs + }, {} };MODULE_DEVICE_TABLE (of, rk_hdptx_phy_of_match);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 207/499 perf tools: Add skip check in tool_pmu__event_to_str()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <[email protected]>
[ Upstream commit ee8aef2d232142e5fdfed9c16132815969a0bf81 ]
Some topdown related metrics may fail on hybrid machines.
$ perf stat -M tma_frontend_bound Cannot resolve IDs for tma_frontend_bound: cpu_atom@TOPDOWN_FE_BOUND.ALL@ / (8 * cpu_atom@CPU_CLK_UNHALTED.CORE@)
In the find_tool_events(), the tool_pmu__event_to_str() is used to compare the tool_events. It only checks the event name, no PMU or arch. So the tool_events[TOOL_PMU__EVENT_SLOTS] is set to true, because the p-core Topdown metrics has "slots" event.
The tool_events is shared. So when parsing the e-core metrics, the "slots" is automatically added.
The "slots" event as a tool event should only be available on arm64. It has a different meaning on X86. The tool_pmu__skip_event() intends handle the case. Apply it for tool_pmu__event_to_str() as well.
There is a lack of sanity check in the expr__get_id(). Add the check.
--- tools/perf/util/expr.c | 2 ++ tools/perf/util/tool_pmu.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-)
tools/perf/util/expr.c +2 -0
@@ -215,6 +215,8 @@ int expr__add_ref(struct expr_parse_ctx *ctx, struct metric_ref *ref)int expr__get_id (struct expr_parse_ctx *ctx,const char *id,struct expr_id_data **data) { +if (!ctx || !id) +return -1 ;return hashmap__find (ctx->ids, id, data) ?0 :-1 ; }
tools/perf/util/tool_pmu.c +2 -1
@@ -62,7 +62,8 @@ int tool_pmu__num_skip_events(void)const char *tool_pmu__event_to_str (enum tool_pmu_event ev) { -if (ev >TOOL_PMU__EVENT_NONE && ev <TOOL_PMU__EVENT_MAX ) +if ((ev >TOOL_PMU__EVENT_NONE && ev <TOOL_PMU__EVENT_MAX ) && + !tool_pmu__skip_event (tool_pmu__event_names[ev]))return tool_pmu__event_names[ev];return NULL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 208/499 isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
[ Upstream commit 81a82e8f33880793029cd6f8a766fb13b737e6a7 ]
In do_isofs_readdir() when assigning the variable
"struct iso_directory_record *de" the b_data field of the buffer_head is accessed and an offset is added to it, the size of b_data is 2048 and the offset size is 2047, meaning
"de = (struct iso_directory_record *) (bh->b_data + offset);" yields the final byte of the 2048 sized b_data block.
The first byte of the directory record (de_len) is then read and found to be 31, meaning the directory record size is 31 bytes long. The directory record is defined by the structure:
struct iso_directory_record {
__u8 length; // 1 byte
__u8 ext_attr_length; // 1 byte
__u8 extent[8]; // 8 bytes
__u8 size[8]; // 8 bytes
__u8 date[7]; // 7 bytes
__u8 flags; // 1 byte
__u8 file_unit_size; // 1 byte
__u8 interleave; // 1 byte
__u8 volume_sequence_number[4]; // 4 bytes
__u8 name_len; // 1 byte
char name[]; // variable size
} __attribute__((packed));
The fixed portion of this structure occupies 33 bytes. Therefore, a valid directory record must be at least 33 bytes long (even without considering the variable-length name field). Since de_len is only 31, it is insufficient to contain the complete fixed header.
The code later hits the following sanity check that compares de_len against the sum of de->name_len and sizeof(struct iso_directory_record):
if (de_len < de->name_len[0] + sizeof(struct iso_directory_record)) {
...
}Since the fixed portion of the structure is
33 bytes (up to and including name_len member),
a valid record should have de_len of at least 33 bytes; here, however, de_len is too short, and the field de->name_len (located at offset 32) is accessed even though it lies beyond the available 31 bytes.
This access on the corrupted isofs data triggers a KASAN uninitialized memory warning. The fix would be to first verify that de_len is at least sizeof(struct iso_directory_record) before accessing any fields like de->name_len.
--- fs/isofs/dir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/isofs/dir.c +2 -1
@@ -147,7 +147,8 @@ static int do_isofs_readdir(struct inode *inode, struct file *file, de = tmpde; }/* Basic sanity check, whether name doesn't exceed dir entry */ -if (de_len < de->name_len[0 ] + +if (de_len <sizeof (struct iso_directory_record ) || + de_len < de->name_len[0 ] +sizeof (struct iso_directory_record )) { printk(KERN_NOTICE "iso9660: Corrupted directory entry" " in block %lu of inode %lu\n", block,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 209/499 perf tests: Fix Tool PMU test segfault
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit 615ec00b06f78912c370b372426190768402a5b9 ]
tool_pmu__event_to_str() now handles skipped events by returning NULL, so it's wrong to re-check for a skip on the resulting string. Calling tool_pmu__skip_event() with a NULL string results in a segfault so remove the unnecessary skip to fix it:
$ perf test -vv "parsing with PMU name"
12.2: Parsing with PMU name:
...
---- unexpected signal (11) ----
12.2: Parsing with PMU name : FAILED!
--- tools/perf/tests/tool_pmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/tests/tool_pmu.c +2 -2
@@ -27,7 +27,7 @@ static int do_test(enum tool_pmu_event ev, bool with_pmu)parse_events_error__init (&err); ret =parse_events (evlist, str, &err);if (ret) { -if (tool_pmu__skip_event (tool_pmu__event_to_str (ev))) { +if (!tool_pmu__event_to_str (ev)) { ret =TEST_OK ; goto out; }
@@ -59,7 +59,7 @@ static int do_test(enum tool_pmu_event ev, bool with_pmu) } } -if (!found && !tool_pmu__skip_event (tool_pmu__event_to_str (ev))) { +if (!found &&tool_pmu__event_to_str (ev)) {pr_debug ("FAILED %s:%d Didn't find tool event '%s' in parsed evsels\n" , __FILE__, __LINE__, str); ret =TEST_FAIL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 210/499 soundwire: slave: fix an OF node reference leak in soundwire slave device
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit aac2f8363f773ae1f65aab140e06e2084ac6b787 ]
When initializing a soundwire slave device, an OF node is stored to the device with refcount incremented. However, the refcount is not decremented in .release(), thus call of_node_put() in sdw_slave_release().
--- drivers/soundwire/slave.c | 1 + 1 file changed, 1 insertion(+)
drivers/soundwire/slave.c +1 -0
@@ -13,6 +13,7 @@ static void sdw_slave_release(struct device *dev) {struct sdw_slave *slave =dev_to_sdw_dev (dev); +of_node_put (slave->dev.of_node);mutex_destroy (&slave->sdw_dev_lock);kfree (slave); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 211/499 staging: gpib: Fix cb7210 pcmcia Oops
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
[ Upstream commit c1baf6528bcfd6a86842093ff3f8ff8caf309c12 ]
The pcmcia_driver struct was still only using the old .name initialization in the drv field. This led to a NULL pointer deref Oops in strcmp called from pcmcia_register_driver.
Initialize the pcmcia_driver struct name field.
--- drivers/staging/gpib/cb7210/cb7210.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/gpib/cb7210/cb7210.c +1 -1
@@ -1342,8 +1342,8 @@ static struct pcmcia_device_id cb_pcmcia_ids[] = {MODULE_DEVICE_TABLE (pcmcia, cb_pcmcia_ids);static struct pcmcia_driver cb_gpib_cs_driver = { + .name ="cb_gpib_cs" , .owner =THIS_MODULE , - .drv = { .name ="cb_gpib_cs" , }, .id_table = cb_pcmcia_ids, .probe = cb_gpib_probe, .remove = cb_gpib_remove,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 212/499 perf report: Switch data file correctly in TUI
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 43c2b6139b188d8a756130147f7efd5ddf99f88d ]
The 's' key is to switch to a new data file and load the data in the same window. The switch_data_file() will show a popup menu to select which data file user wants and update the 'input_name' global variable.
But in the cmd_report(), it didn't update the data.path using the new 'input_name' and keep usng the old file. This is fairly an old bug and I assume people don't use this feature much. :)
--- tools/perf/builtin-report.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-report.c +1 -1
@@ -1555,12 +1555,12 @@ int cmd_report(int argc, const char **argv) input_name ="perf.data" ; } +repeat: data.path = input_name; data.force = symbol_conf.force; symbol_conf.skip_empty = report.skip_empty; -repeat:perf_tool__init (&report.tool, ordered_events); report.tool.sample = process_sample_event; report.tool.mmap = perf_event__process_mmap;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 213/499 greybus: gb-beagleplay: Add error handling for gb_greybus_init
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit be382372d55d65b5c7e5a523793ca5e403f8c595 ]
Add error handling for the gb_greybus_init(bg) function call during the firmware reflash process to maintain consistency in error handling throughout the codebase. If initialization fails, log an error and return FW_UPLOAD_ERR_RW_ERROR.
--- drivers/greybus/gb-beagleplay.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/greybus/gb-beagleplay.c +3 -1
@@ -912,7 +912,9 @@ static enum fw_upload_err cc1352_prepare(struct fw_upload *fw_upload,cc1352_bootloader_reset (bg);WRITE_ONCE (bg->flashing_mode, false);msleep (200 ); -gb_greybus_init (bg); +if (gb_greybus_init (bg) <0 ) +return dev_err_probe (&bg->sd->dev,FW_UPLOAD_ERR_RW_ERROR , +"Failed to initialize greybus" );gb_beagleplay_start_svc (bg);return FW_UPLOAD_ERR_FW_INVALID ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 214/499 coresight: catu: Fix number of pages while using 64k pages
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilkka Koskinen <[email protected]>
[ Upstream commit 0e14e062f5ff98aa15264dfa87c5f5e924028561 ]
Trying to record a trace on kernel with 64k pages resulted in -ENOMEM. This happens due to a bug in calculating the number of table pages, which returns zero. Fix the issue by rounding up.
$ perf record --kcore -e cs_etm/@tmc_etr55,cycacc,branch_broadcast/k --per-thread taskset --cpu-list 1 dd if=/dev/zero of=/dev/null failed to mmap with 12 (Cannot allocate memory)
--- drivers/hwtracing/coresight/coresight-catu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-catu.c +1 -1
@@ -269,7 +269,7 @@ catu_init_sg_table(struct device *catu_dev, int node,* Each table can address upto 1MB and we can have * CATU_PAGES_PER_SYSPAGE tables in a system page. */ - nr_tpages =DIV_ROUND_UP (size,SZ_1M ) /CATU_PAGES_PER_SYSPAGE ; + nr_tpages =DIV_ROUND_UP (size,CATU_PAGES_PER_SYSPAGE *SZ_1M ); catu_table =tmc_alloc_sg_table (catu_dev, node, nr_tpages, size >>PAGE_SHIFT , pages);if (IS_ERR (catu_table))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 215/499 vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <[email protected]>
[ Upstream commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 ]
If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang:
1. Use-after-free when no tpgs are found:
This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do:
vhost_vq_set_backend(vq, vs_tpg);
...
kfree(vs->vs_tpg);vs->vs_tpg = vs_tpg;
If vhost_scsi_set_endpoint is called again and no tpgs are found match=false so we skip the vhost_vq_set_backend call leaving the pointer to the vs_tpg we then free via:
kfree(vs->vs_tpg);vs->vs_tpg = vs_tpg;
If a scsi request is then sent we do:
vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend
which sees the vs_tpg we just did a kfree on.
2. Tpg dir removal hang:
This patch fixes an issue where we cannot remove a LIO/target layer tpg (and structs above it like the target) dir due to the refcount dropping to -1.
The problem is that if vhost_scsi_set_endpoint detects a tpg is already in the vs->vs_tpg array or if the tpg has been removed so target_depend_item fails, the undepend goto handler will do target_undepend_item on all tpgs in the vs_tpg array dropping their refcount to 0. At this time vs_tpg contains both the tpgs we have added in the current vhost_scsi_set_endpoint call as well as tpgs we added in previous calls which are also in vs->vs_tpg.
Later, when vhost_scsi_clear_endpoint runs it will do target_undepend_item on all the tpgs in the vs->vs_tpg which will drop their refcount to -1. Userspace will then not be able to remove the tpg and will hang when it tries to do rmdir on the tpg dir.
3. Tpg leak:
This fixes a bug where we can leak tpgs and cause them to be un-removable because the target name is overwritten when vhost_scsi_set_endpoint is called multiple times but with different target names.
The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup a vhost-scsi device to target/tpg mapping, then calls VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we haven't seen before (target1 has tpg1 but target2 has tpg2). When this happens we don't teardown the old target tpg mapping and just overwrite the target name and the vs->vs_tpg array. Later when we do vhost_scsi_clear_endpoint, we are passed in either target1 or target2's name and we will only match that target's tpgs when we loop over the vs->vs_tpg. We will then return from the function without doing target_undepend_item on the tpgs.
Because of all these bugs, it looks like being able to call vhost_scsi_set_endpoint multiple times was never supported. The major user, QEMU, already has checks to prevent this use case. So to fix the issues, this patch prevents vhost_scsi_set_endpoint from being called if it's already successfully added tpgs. To add, remove or change the tpg config or target name, you must do a vhost_scsi_clear_endpoint first.
Message-Id: <[email protected]>
--- drivers/vhost/scsi.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
drivers/vhost/scsi.c +13 -12
@@ -1699,14 +1699,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } } +if (vs->vs_tpg) { +pr_err ("vhost-scsi endpoint already set for %s.\n" , + vs->vs_vhost_wwpn); + ret = -EEXIST ; + goto out; + } + len =sizeof (vs_tpg[0 ]) *VHOST_SCSI_MAX_TARGET ; vs_tpg =kzalloc (len,GFP_KERNEL );if (!vs_tpg) { ret = -ENOMEM ; goto out; } -if (vs->vs_tpg) -memcpy (vs_tpg, vs->vs_tpg, len);mutex_lock (&vhost_scsi_mutex);list_for_each_entry (tpg, &vhost_scsi_list, tv_tpg_list) {
@@ -1722,12 +1727,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, tv_tport = tpg->tport;if (!strcmp (tv_tport->tport_name, t->vhost_wwpn)) { -if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { -mutex_unlock (&tpg->tv_tpg_mutex); -mutex_unlock (&vhost_scsi_mutex); - ret = -EEXIST ; - goto undepend; - }/* * In order to ensure individual vhost-scsi configfs * groups cannot be removed while in use by vhost ioctl,
@@ -1774,15 +1773,15 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } ret =0 ; }else { - ret = -EEXIST ; + ret = -ENODEV ; + goto free_tpg; }/* -* Act as synchronize_rcu to make sure access to -* old vs->vs_tpg is finished. +* Act as synchronize_rcu to make sure requests after this point +* see a fully setup device. */ vhost_scsi_flush (vs); -kfree (vs->vs_tpg); vs->vs_tpg = vs_tpg; goto out;
@@ -1802,6 +1801,7 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,target_undepend_item (&tpg->se_tpg.tpg_group.cg_item); } } +free_tpg:kfree (vs_tpg); out:mutex_unlock (&vs->dev.mutex);
@@ -1904,6 +1904,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,vhost_scsi_flush (vs);kfree (vs->vs_tpg); vs->vs_tpg =NULL ; +memset (vs->vs_vhost_wwpn,0 ,sizeof (vs->vs_vhost_wwpn));WARN_ON (vs->vs_events_nr);mutex_unlock (&vs->dev.mutex);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 216/499 coresight-etm4x: add isb() before reading the TRCSTATR
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanfang Zhang <[email protected]>
[ Upstream commit 4ff6039ffb79a4a8a44b63810a8a2f2b43264856 ]
As recommended by section 4.3.7 ("Synchronization when using system instructions to progrom the trace unit") of ARM IHI 0064H.b, the self-hosted trace analyzer must perform a Context synchronization event between writing to the TRCPRGCTLR and reading the TRCSTATR. Additionally, add an ISB between the each read of TRCSTATR on coresight_timeout() when using system instructions to program the trace unit.
--- drivers/hwtracing/coresight/coresight-core.c | 20 ++++++-- .../coresight/coresight-etm4x-core.c | 48 +++++++++++++++++-- include/linux/coresight.h | 4 ++ 3 files changed, 62 insertions(+), 10 deletions(-)
drivers/hwtracing/coresight/coresight-core.c +15 -5
@@ -1017,18 +1017,20 @@ static void coresight_remove_conns(struct coresight_device *csdev) }/** -* coresight_timeout - loop until a bit has changed to a specific register -* state. +* coresight_timeout_action - loop until a bit has changed to a specific register +* state, with a callback after every trial. * @csa: coresight device access for the device * @offset: Offset of the register from the base of the device. * @position: the position of the bit of interest. * @value: the value the bit should have. +* @cb: Call back after each trial. * * Return: 0 as soon as the bit has taken the desired state or -EAGAIN if * TIMEOUT_US has elapsed, which ever happens first. */ -int coresight_timeout (struct csdev_access *csa,u32 offset, -int position,int value) +int coresight_timeout_action (struct csdev_access *csa,u32 offset, +int position,int value, +coresight_timeout_cb_t cb) {int i;u32 val;
@@ -1044,7 +1046,8 @@ int coresight_timeout(struct csdev_access *csa, u32 offset,if (!(val &BIT (position)))return 0 ; } - +if (cb) +cb (csa, offset, position, value);/* * Delay is arbitrary - the specification doesn't say how long * we are expected to wait. Extra check required to make sure
@@ -1056,6 +1059,13 @@ int coresight_timeout(struct csdev_access *csa, u32 offset,return -EAGAIN ; } +EXPORT_SYMBOL_GPL (coresight_timeout_action); + +int coresight_timeout (struct csdev_access *csa,u32 offset, +int position,int value) +{ +return coresight_timeout_action (csa, offset, position, value,NULL ); +}EXPORT_SYMBOL_GPL (coresight_timeout);u32 coresight_relaxed_read32 (struct coresight_device *csdev,u32 offset)
drivers/hwtracing/coresight/coresight-etm4x-core.c +43 -5
87 lines not on this page · raw message
include/linux/coresight.h +4 -0
@@ -639,6 +639,10 @@ extern int coresight_enable_sysfs(struct coresight_device *csdev);extern void coresight_disable_sysfs (struct coresight_device *csdev);extern int coresight_timeout (struct csdev_access *csa,u32 offset,int position,int value); +typedef void (*coresight_timeout_cb_t ) (struct csdev_access *,u32 ,int ,int ); +extern int coresight_timeout_action (struct csdev_access *csa,u32 offset, +int position,int value, +coresight_timeout_cb_t cb);extern int coresight_claim_device (struct coresight_device *csdev);extern int coresight_claim_device_unlocked (struct coresight_device *csdev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 217/499 perf pmu: Dont double count common sysfs and json events
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit c9d699e10fa6c0cdabcddcf991e7ff42af6b2503 ]
After pmu_add_cpu_aliases() is called, perf_pmu__num_events() returns an incorrect value that double counts common events and doesn't match the actual count of events in the alias list. This is because after 'cpu_aliases_added == true', the number of events returned is 'sysfs_aliases + cpu_json_aliases'. But when adding 'case EVENT_SRC_SYSFS' events, 'sysfs_aliases' and 'cpu_json_aliases' are both incremented together, failing to account that these ones overlap and only add a single item to the list. Fix it by adding another counter for overlapping events which doesn't influence 'cpu_json_aliases'.
There doesn't seem to be a current issue because it's used in perf list before pmu_add_cpu_aliases() so the correct value is returned. Other uses in tests may also miss it for other reasons like only looking at uncore events. However it's marked as a fixes commit in case any new fix with new uses of perf_pmu__num_events() is backported.
--- tools/perf/util/pmu.c | 7 ++++--- tools/perf/util/pmu.h | 5 +++++ 2 files changed, 9 insertions(+), 3 deletions(-)
tools/perf/util/pmu.c +4 -3
@@ -595,7 +595,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name, };if (pmu_events_table__find_event (pmu->events_table, pmu, name, update_alias, &data) ==0 ) - pmu->cpu_json_aliases++; + pmu->cpu_common_json_aliases++; } pmu->sysfs_aliases++;break ;
@@ -1840,9 +1840,10 @@ size_t perf_pmu__num_events(struct perf_pmu *pmu)if (pmu->cpu_aliases_added) nr += pmu->cpu_json_aliases;else if (pmu->events_table) - nr +=pmu_events_table__num_events (pmu->events_table, pmu) - pmu->cpu_json_aliases; + nr +=pmu_events_table__num_events (pmu->events_table, pmu) - + pmu->cpu_common_json_aliases;else -assert (pmu->cpu_json_aliases ==0 ); +assert (pmu->cpu_json_aliases ==0 && pmu->cpu_common_json_aliases ==0 );if (perf_pmu__is_tool (pmu)) nr -=tool_pmu__num_skip_events ();
tools/perf/util/pmu.h +5 -0
@@ -134,6 +134,11 @@ struct perf_pmu {uint32_t cpu_json_aliases;/** @sys_json_aliases: Number of json event aliases loaded matching the PMU's identifier. */ uint32_t sys_json_aliases; +/** +* @cpu_common_json_aliases: Number of json events that overlapped with sysfs when +* loading all sysfs events. +*/ +uint32_t cpu_common_json_aliases;/** @sysfs_aliases_loaded: Are sysfs aliases loaded from disk? */ bool sysfs_aliases_loaded;/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 218/499 tools/x86: Fix linux/unaligned.h include path in lib/insn.c
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit fad07a5c0f07ad0884e1cb4362fe28c083b5b811 ]
tools/arch/x86/include/linux doesn't exist but building is working by virtue of a -I. Building using bazel this fails. Use angle brackets to include unaligned.h so there isn't an invalid relative include.
--- tools/arch/x86/lib/insn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/arch/x86/lib/insn.c +1 -1
@@ -13,7 +13,7 @@#endif #include "../include/asm/inat.h" /* __ignore_sync_check__ */ #include "../include/asm/insn.h" /* __ignore_sync_check__ */ -#include "../include/linux/unaligned.h" /* __ignore_sync_check__ */ +#include <linux/unaligned.h> /* __ignore_sync_check__ */ #include <linux/errno.h> #include <linux/kconfig.h>
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 219/499 perf build: Fix in-tree build due to symbolic link
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
[ Upstream commit 75100d848ef4b8ca39bb6dd3a21181e37dea27e2 ]
Building perf in-tree is broken after commit 890a1961c812 ("perf tools:
Create source symlink in perf object dir") which added a 'source' symlink in the output dir pointing to the source dir.
With in-tree builds, the added 'SOURCE = ...' line is executed multiple times (I observed 2 during the build plus 2 during installation). This is a minor inefficiency, in theory not harmful because symlink creation is assumed to be idempotent. But it is not.
Considering with in-tree builds:
srctree=/absolute/path/to/linux
OUTPUT=/absolute/path/to/linux/tools/perf
here's what happens:
1. ln -sf $(srctree)/tools/perf $(OUTPUT)/source
-> creates /absolute/path/to/linux/tools/perf/source
link to /absolute/path/to/linux/tools/perf
=> OK, that's what was intended
2. ln -sf $(srctree)/tools/perf $(OUTPUT)/source # same command as 1
-> creates /absolute/path/to/linux/tools/perf/perf
link to /absolute/path/to/linux/tools/perf
=> Not what was intended, not idempotent
3. Now the build _should_ create the 'perf' executable, but it fails
The reason is the tricky 'ln' command line. At the first invocation 'ln' uses the 1st form:
ln [OPTION]... [-T] TARGET LINK_NAME
and creates a link to TARGET *called LINK_NAME*.
At the second invocation $(OUTPUT)/source exists, so 'ln' uses the 3rd form:
ln [OPTION]... TARGET... DIRECTORY
and creates a link to TARGET *called TARGET* inside DIRECTORY.
Fix by adding -n/--no-dereference to "treat LINK_NAME as a normal file if it is a symbolic link to a directory", as the manpage says.
--- tools/perf/Makefile.perf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/Makefile.perf +1 -1
@@ -164,7 +164,7 @@ ifneq ($(OUTPUT),) VPATH += $(OUTPUT) export VPATH # create symlink to the original source -SOURCE := $(shell ln -sf $(srctree)/tools/perf $(OUTPUT)/source) +SOURCE := $(shell ln -sfn $(srctree)/tools/perf $(OUTPUT)/source) endif ifeq ($(V),1)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 220/499 ucsi_ccg: Dont show failed to get FW build information error
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit c16006852732dc4fe37c14b81f9b4458df05b832 ]
The error failed to get FW build information is added for what looks to be for misdetection of the device property firmware-name.
If the property is missing (such as on non-nvidia HW) this error shows up. Move the error into the scope of the property parser for "firmware-name" to avoid showing errors on systems without the firmware-name property.
--- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/usb/typec/ucsi/ucsi_ccg.c +2 -3
@@ -1433,11 +1433,10 @@ static int ucsi_ccg_probe(struct i2c_client *client) uc->fw_build =CCG_FW_BUILD_NVIDIA_TEGRA ; else if (!strcmp(fw_name, "nvidia,gpu")) uc->fw_build =CCG_FW_BUILD_NVIDIA ; +if (!uc->fw_build) +dev_err (uc->dev,"failed to get FW build information\n" ); } -if (!uc->fw_build) -dev_err (uc->dev,"failed to get FW build information\n" ); -/* reset ccg device and initialize ucsi */ status =ucsi_ccg_init (uc);if (status <0 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 221/499 iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit df330c808182a8beab5d0f84a6cbc9cff76c61fc ]
If a match was not found, then the write_raw() callback would return the odr index, not an error. Return -EINVAL if this occurs. To avoid similar issues in future, introduce j, a new indexing variable rather than using ret for this purpose.
--- drivers/iio/accel/mma8452.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/iio/accel/mma8452.c +7 -3
@@ -712,7 +712,7 @@ static int mma8452_write_raw(struct iio_dev *indio_dev, int val, int val2, long mask) { struct mma8452_data *data = iio_priv(indio_dev); -int i, ret; +int i, j, ret; ret =iio_device_claim_direct_mode (indio_dev);if (ret)
@@ -772,14 +772,18 @@ static int mma8452_write_raw(struct iio_dev *indio_dev,break ;case IIO_CHAN_INFO_OVERSAMPLING_RATIO : - ret =mma8452_get_odr_index (data); + j =mma8452_get_odr_index (data);for (i =0 ; i <ARRAY_SIZE (mma8452_os_ratio); i++) { -if (mma8452_os_ratio[i][ret] == val) { +if (mma8452_os_ratio[i][j] == val) { ret =mma8452_set_power_mode (data, i);break ; } } +if (i ==ARRAY_SIZE (mma8452_os_ratio)) { + ret = -EINVAL ; +break ; + }break ;default : ret = -EINVAL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 222/499 iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails.
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit 60a0cf2ebab92011055ab7db6553c0fc3c546938 ]
Reorder the claiming of direct mode and runtime pm calls to simplify handling a little. For correct error handling, after the reorder iio_device_release_direct_mode() must be claimed in an error occurs in pm_runtime_resume_and_get()
--- drivers/iio/accel/msa311.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
drivers/iio/accel/msa311.c +15 -11
@@ -594,23 +594,25 @@ static int msa311_read_raw_data(struct iio_dev *indio_dev,__le16 axis;int err; - err =pm_runtime_resume_and_get (dev); + err =iio_device_claim_direct_mode (indio_dev);if (err)return err; - err =iio_device_claim_direct_mode (indio_dev); -if (err) + err =pm_runtime_resume_and_get (dev); +if (err) { +iio_device_release_direct_mode (indio_dev);return err; + }mutex_lock (&msa311->lock); err =msa311_get_axis (msa311, chan, &axis);mutex_unlock (&msa311->lock); -iio_device_release_direct_mode (indio_dev); -pm_runtime_mark_last_busy (dev);pm_runtime_put_autosuspend (dev); +iio_device_release_direct_mode (indio_dev); +if (err) {dev_err (dev,"can't get axis %s (%pe)\n" , chan->datasheet_name,ERR_PTR (err));
@@ -756,10 +758,6 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2)unsigned int odr;int err; - err =pm_runtime_resume_and_get (dev); -if (err) -return err; -/* * Sampling frequency changing is prohibited when buffer mode is * enabled, because sometimes MSA311 chip returns outliers during
@@ -769,6 +767,12 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2)if (err)return err; + err =pm_runtime_resume_and_get (dev); +if (err) { +iio_device_release_direct_mode (indio_dev); +return err; + } + err = -EINVAL ;for (odr =0 ; odr <ARRAY_SIZE (msa311_odr_table); odr++) if (val == msa311_odr_table[odr].integral &&
@@ -779,11 +783,11 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2)break ; } -iio_device_release_direct_mode (indio_dev); -pm_runtime_mark_last_busy (dev);pm_runtime_put_autosuspend (dev); +iio_device_release_direct_mode (indio_dev); +if (err)dev_err (dev,"can't update frequency (%pe)\n" ,ERR_PTR (err));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 223/499 iio: backend: make sure to NULL terminate stack buffer
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sá <[email protected]>
[ Upstream commit 035b4989211dc1c8626e186d655ae8ca5141bb73 ]
Make sure to NULL terminate the buffer in iio_backend_debugfs_write_reg() before passing it to sscanf(). It is a stack variable so we should not assume it will 0 initialized.
--- drivers/iio/industrialio-backend.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/industrialio-backend.c +3 -1
@@ -155,10 +155,12 @@ static ssize_t iio_backend_debugfs_write_reg(struct file *file,ssize_t rc;int ret; - rc =simple_write_to_buffer (buf,sizeof (buf), ppos, userbuf, count); + rc =simple_write_to_buffer (buf,sizeof (buf) -1 , ppos, userbuf, count);if (rc <0 )return rc; + buf[count] ='\0' ; + ret =sscanf (buf,"%i %i" , &back->cached_reg_addr, &val);switch (ret) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 224/499 perf arm-spe: Fix load-store operation checking
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit e1d47850bbf79a541c9b3bacdd562f5e0112274d ]
The ARM_SPE_OP_LD and ARM_SPE_OP_ST operations are secondary operation type, they are overlapping with other second level's operation types belonging to SVE and branch operations. As a result, a non load-store operation can be parsed for data source and memory sample.
To fix the issue, this commit introduces a is_ldst_op() macro for checking LDST operation, and apply the checking when synthesize data source and memory samples.
--- tools/perf/util/arm-spe.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
tools/perf/util/arm-spe.c +7 -1
@@ -37,6 +37,8 @@#include "../../arch/arm64/include/asm/cputype.h" #define MAX_TIMESTAMP (~0ULL) +#define is_ldst_op (op) (!!((op) & ARM_SPE_OP_LDST)) +struct arm_spe {struct auxtrace auxtrace;struct auxtrace_queues queues;
@@ -605,6 +607,10 @@ static u64 arm_spe__synth_data_source(struct arm_spe_queue *speq,union perf_mem_data_src data_src = { .mem_op =PERF_MEM_OP_NA };bool is_common =arm_spe__is_common_ds_encoding (speq); +/* Only synthesize data source for LDST operations */ +if (!is_ldst_op (record->op)) +return 0 ; +if (record->op &ARM_SPE_OP_LD ) data_src.mem_op =PERF_MEM_OP_LOAD ;else if (record->op &ARM_SPE_OP_ST )
@@ -705,7 +711,7 @@ static int arm_spe_sample(struct arm_spe_queue *speq)* When data_src is zero it means the record is not a memory operation, * skip to synthesize memory sample for this case. */ -if (spe->sample_memory && data_src) { +if (spe->sample_memory &&is_ldst_op (record->op)) { err =arm_spe__synth_mem_sample (speq, spe->memory_id, data_src);if (err)return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 225/499 perf bench: Fix perf bench syscall loop count
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit 957d194163bf983da98bf7ec7e4f86caff8cd0eb ]
Command 'perf bench syscall fork -l 100000' offers option -l to run for a specified number of iterations. However this option is not always observed. The number is silently limited to 10000 iterations as can be seen:
Output before:
# perf bench syscall fork -l 100000
# Running 'syscall/fork' benchmark:
# Executed 10,000 fork() calls
Total time: 23.388 [sec] 2338.809800 usecs/op
427 ops/sec#
When explicitly specified with option -l or --loops, also observe higher number of iterations:
Output after:
# perf bench syscall fork -l 100000
# Running 'syscall/fork' benchmark:
# Executed 100,000 fork() calls
Total time: 716.982 [sec] 7169.829510 usecs/op
139 ops/sec#
This patch fixes the issue for basic execve fork and getpgid.
--- tools/perf/bench/syscall.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
tools/perf/bench/syscall.c +13 -9
@@ -22,8 +22,7 @@#define __NR_fork -1#endif -#define LOOPS_DEFAULT 10000000 -static int loops =LOOPS_DEFAULT ; +static int loops;static const struct option options[] = {OPT_INTEGER ('l' ,"loop" , &loops,"Specify number of loops" ),
@@ -80,6 +79,18 @@ static int bench_syscall_common(int argc, const char **argv, int syscall)const char *name =NULL ;int i; +switch (syscall) { +case __NR_fork: +case __NR_execve: +/* Limit default loop to 10000 times to save time */ + loops =10000 ; +break ; +default : + loops =10000000 ; +break ; + } + +/* Options -l and --loops override default above */ argc =parse_options (argc, argv, options, bench_syscall_usage,0 );gettimeofday (&start,NULL );
@@ -94,16 +105,9 @@ static int bench_syscall_common(int argc, const char **argv, int syscall)break ;case __NR_fork:test_fork (); -/* Only loop 10000 times to save time */ -if (i ==10000 ) - loops =10000 ;break ;case __NR_execve:test_execve (); -/* Only loop 10000 times to save time */ -if (i ==10000 ) - loops =10000 ; -break ;default :break ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 226/499 usb: xhci: correct debug message page size calculation
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Neronin <[email protected]>
[ Upstream commit 55741c723318905e6d5161bf1e12749020b161e3 ]
The ffs() function returns the index of the first set bit, starting from 1. If no bits are set, it returns zero. This behavior causes an off-by-one page size in the debug message, as the page size calculation [1] is zero-based, while ffs() is one-based.
Fix this by subtracting one from the result of ffs(). Note that since variable 'val' is unsigned, subtracting one from zero will result in the maximum unsigned integer value. Consequently, the condition 'if (val < 16)' will still function correctly.
[1], Page size: (2^(n+12)), where 'n' is the set page size bit.
--- drivers/usb/host/xhci-mem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-mem.c +3 -3
@@ -2391,10 +2391,10 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) page_size =readl (&xhci->op_regs->page_size);xhci_dbg_trace (xhci, trace_xhci_dbg_init,"Supported page size register = 0x%x" , page_size); - i =ffs (page_size); -if (i <16 ) + val =ffs (page_size) -1 ; +if (val <16 )xhci_dbg_trace (xhci, trace_xhci_dbg_init, -"Supported page size of %iK" , (1 << (i+12 )) /1024 ); +"Supported page size of %iK" , (1 << (val +12 )) /1024 );else xhci_warn (xhci,"WARN: no supported page size\n" );/* Use 4K pages, since that's common and the minimum the HC supports */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 227/499 fs/ntfs3: Fix a couple integer overflows on 32bit systems
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 5ad414f4df2294b28836b5b7b69787659d6aa708 ]
On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can have an integer wrapping issue. Fix it by using size_add().
--- fs/ntfs3/index.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ntfs3/index.c +2 -2
@@ -618,7 +618,7 @@ static bool index_hdr_check(const struct INDEX_HDR *hdr, u32 bytes)u32 off =le32_to_cpu (hdr->de_off);if (!IS_ALIGNED (off,8 ) || tot > bytes || end > tot || - off +sizeof (struct NTFS_DE ) > end) { +size_add (off,sizeof (struct NTFS_DE )) > end) {/* incorrect index buffer. */ return false; }
@@ -736,7 +736,7 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx,if (end > total)return NULL ; -if (off +sizeof (struct NTFS_DE ) > end) +if (size_add (off,sizeof (struct NTFS_DE )) > end)return NULL ; e =Add2Ptr (hdr, off);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 228/499 fs/ntfs3: Prevent integer overflow in hdr_first_de()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6bb81b94f7a9cba6bde9a905cef52a65317a8b04 ]
The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.
--- fs/ntfs3/ntfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ntfs3/ntfs.h +1 -1
@@ -717,7 +717,7 @@ static inline struct NTFS_DE *hdr_first_de(const struct INDEX_HDR *hdr)struct NTFS_DE *e;u16 esize; -if (de_off >= used || de_off +sizeof (struct NTFS_DE ) > used ) +if (de_off >= used ||size_add (de_off,sizeof (struct NTFS_DE )) > used)return NULL ; e =Add2Ptr (hdr, de_off);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 229/499 dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit c9c59da76ce9cb3f215b66eb3708cda1134a5206 ]
There is kernel dump when do module test:
sysfs: cannot create duplicate filename /devices/platform/soc@0/44000000.bus/44000000.dma-controller/dma/dma0chan0
__dma_async_device_channel_register+0x128/0x19c dma_async_device_register+0x150/0x454 fsl_edma_probe+0x6cc/0x8a0 platform_probe+0x68/0xc8
fsl_edma_cleanup_vchan will unlink vchan.chan.device_node, while dma_async_device_unregister needs the link to do __dma_async_device_channel_unregister. So need move fsl_edma_cleanup_vchan after dma_async_device_unregister to make sure channel could be freed.
So clean up chan after dma_async_device_unregister to address this.
--- drivers/dma/fsl-edma-main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/fsl-edma-main.c +1 -1
@@ -699,9 +699,9 @@ static void fsl_edma_remove(struct platform_device *pdev)struct fsl_edma_engine *fsl_edma =platform_get_drvdata (pdev);fsl_edma_irq_exit (pdev, fsl_edma); -fsl_edma_cleanup_vchan (&fsl_edma->dma_dev);of_dma_controller_free (np);dma_async_device_unregister (&fsl_edma->dma_dev); +fsl_edma_cleanup_vchan (&fsl_edma->dma_dev);fsl_disable_clocks (fsl_edma, fsl_edma->drvdata->dmamuxs); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 230/499 dmaengine: fsl-edma: free irq correctly in remove path
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit fa70c4c3c580c239a0f9e83a14770ab026e8d820 ]
Add fsl_edma->txirq/errirq check to avoid below warning because no errirq at i.MX9 platform. Otherwise there will be kernel dump:
WARNING: CPU: 0 PID: 11 at kernel/irq/devres.c:144 devm_free_irq+0x74/0x80 Modules linked in: CPU: 0 UID: 0 PID: 11 Comm: kworker/u8:0 Not tainted 6.12.0-rc7#18 Hardware name: NXP i.MX93 11X11 EVK board (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : devm_free_irq+0x74/0x80 lr : devm_free_irq+0x48/0x80 Call trace: devm_free_irq+0x74/0x80 (P) devm_free_irq+0x48/0x80 (L) fsl_edma_remove+0xc4/0xc8 platform_remove+0x28/0x44 device_remove+0x4c/0x80
--- drivers/dma/fsl-edma-main.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/dma/fsl-edma-main.c +9 -3
@@ -303,6 +303,7 @@ fsl_edma2_irq_init(struct platform_device *pdev,/* The last IRQ is for eDMA err */ if (i == count -1 ) { + fsl_edma->errirq = irq; ret =devm_request_irq (&pdev->dev, irq, fsl_edma_err_handler,0 ,"eDMA2-ERR" , fsl_edma);
@@ -322,10 +323,13 @@ static void fsl_edma_irq_exit( struct platform_device *pdev, struct fsl_edma_engine *fsl_edma) {if (fsl_edma->txirq == fsl_edma->errirq) { -devm_free_irq (&pdev->dev, fsl_edma->txirq, fsl_edma); +if (fsl_edma->txirq >=0 ) +devm_free_irq (&pdev->dev, fsl_edma->txirq, fsl_edma); }else { -devm_free_irq (&pdev->dev, fsl_edma->txirq, fsl_edma); -devm_free_irq (&pdev->dev, fsl_edma->errirq, fsl_edma); +if (fsl_edma->txirq >=0 ) +devm_free_irq (&pdev->dev, fsl_edma->txirq, fsl_edma); +if (fsl_edma->errirq >=0 ) +devm_free_irq (&pdev->dev, fsl_edma->errirq, fsl_edma); } }
@@ -513,6 +517,8 @@ static int fsl_edma_probe(struct platform_device *pdev)if (!fsl_edma)return -ENOMEM ; + fsl_edma->errirq = -EINVAL ; + fsl_edma->txirq = -EINVAL ; fsl_edma->drvdata = drvdata; fsl_edma->n_chans = chans;mutex_init (&fsl_edma->fsl_edma_mutex);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 231/499 iio: adc: ad4130: Fix comparison of channel setups
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 280acb19824663d55a3f4d09087c76fabe86fa3c ]
Checking the binary representation of two structs (of the same type) for equality doesn't have the same semantic as comparing all members for equality. The former might find a difference where the latter doesn't in the presence of padding or when ambiguous types like float or bool are involved. (Floats typically have different representations for single values, like -0.0 vs +0.0, or 0.5 * 2² vs 0.25 * 2³. The type bool has at least 8 bits and the raw values 1 and 2 (probably) both evaluate to true, but memcmp finds a difference.)
When searching for a channel that already has the configuration we need, the comparison by member is the one that is needed.
Convert the comparison accordingly to compare the members one after another. Also add a static_assert guard to (somewhat) ensure that when struct ad4130_setup_info is expanded, the comparison is adapted, too.
This issue is somewhat theoretic, but using memcmp() on a struct is a bad pattern that is worth fixing.
--- drivers/iio/adc/ad4130.c | 41 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-)
drivers/iio/adc/ad4130.c +39 -2
@@ -223,6 +223,10 @@ enum ad4130_pin_function { AD4130_PIN_FN_VBIAS = BIT(3), }; +/* +* If you make adaptations in this struct, you most likely also have to adapt +* ad4130_setup_info_eq(), too. +*/ struct ad4130_setup_info {unsigned int iout0_val;unsigned int iout1_val;
@@ -591,6 +595,40 @@ static irqreturn_t ad4130_irq_handler(int irq, void *private)return IRQ_HANDLED ; } +static bool ad4130_setup_info_eq (struct ad4130_setup_info *a, +struct ad4130_setup_info *b) +{ +/* +* This is just to make sure that the comparison is adapted after +* struct ad4130_setup_info was changed. +*/ +static_assert (sizeof (*a) == +sizeof (struct { +unsigned int iout0_val; +unsigned int iout1_val; +unsigned int burnout; +unsigned int pga; +unsigned int fs; +u32 ref_sel; +enum ad4130_filter_mode filter_mode; +bool ref_bufp; +bool ref_bufm; + })); + +if (a->iout0_val != b->iout0_val || + a->iout1_val != b->iout1_val || + a->burnout != b->burnout || + a->pga != b->pga || + a->fs != b->fs || + a->ref_sel != b->ref_sel || + a->filter_mode != b->filter_mode || + a->ref_bufp != b->ref_bufp || + a->ref_bufm != b->ref_bufm) +return false; + +return true; +} +static int ad4130_find_slot (struct ad4130_state *st,struct ad4130_setup_info *target_setup_info,unsigned int *slot,bool *overwrite)
@@ -604,8 +642,7 @@ static int ad4130_find_slot(struct ad4130_state *st,struct ad4130_slot_info *slot_info = &st->slots_info[i];/* Immediately accept a matching setup info. */ -if (!memcmp (target_setup_info, &slot_info->setup, -sizeof (*target_setup_info))) { +if (ad4130_setup_info_eq (target_setup_info, &slot_info->setup)) { *slot = i;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 232/499 iio: adc: ad7124: Fix comparison of channel configs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 05a5d874f7327b75e9bc4359618017e047cc129c ]
Checking the binary representation of two structs (of the same type) for equality doesn't have the same semantic as comparing all members for equality. The former might find a difference where the latter doesn't in the presence of padding or when ambiguous types like float or bool are involved. (Floats typically have different representations for single values, like -0.0 vs +0.0, or 0.5 * 2² vs 0.25 * 2³. The type bool has at least 8 bits and the raw values 1 and 2 (probably) both evaluate to true, but memcmp finds a difference.)
When searching for a channel that already has the configuration we need, the comparison by member is the one that is needed.
Convert the comparison accordingly to compare the members one after another. Also add a static_assert guard to (somewhat) ensure that when struct ad7124_channel_config::config_props is expanded, the comparison is adapted, too.
This issue is somewhat theoretic, but using memcmp() on a struct is a bad pattern that is worth fixing.
--- drivers/iio/adc/ad7124.c | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-)
drivers/iio/adc/ad7124.c +31 -4
@@ -147,7 +147,11 @@ struct ad7124_chip_info {struct ad7124_channel_config {bool live;unsigned int cfg_slot; -/* Following fields are used to compare equality. */ +/* +* Following fields are used to compare for equality. If you +* make adaptations in it, you most likely also have to adapt +* ad7124_find_similar_live_cfg(), too. +*/ struct_group(config_props, enum ad7124_ref_sel refsel;bool bipolar;
@@ -334,15 +338,38 @@ static struct ad7124_channel_config *ad7124_find_similar_live_cfg(struct ad7124_ struct ad7124_channel_config *cfg) {struct ad7124_channel_config *cfg_aux; -ptrdiff_t cmp_size;int i; - cmp_size = sizeof_field(struct ad7124_channel_config, config_props); +/* +* This is just to make sure that the comparison is adapted after +* struct ad7124_channel_config was changed. +*/ + static_assert(sizeof_field(struct ad7124_channel_config, config_props) == +sizeof (struct { +enum ad7124_ref_sel refsel; +bool bipolar; +bool buf_positive; +bool buf_negative; +unsigned int vref_mv; +unsigned int pga_bits; +unsigned int odr; +unsigned int odr_sel_bits; +unsigned int filter_type; + })); +for (i =0 ; i < st->num_channels; i++) { cfg_aux = &st->channels[i].cfg;if (cfg_aux->live && - !memcmp (&cfg->config_props, &cfg_aux->config_props, cmp_size)) + cfg->refsel == cfg_aux->refsel && + cfg->bipolar == cfg_aux->bipolar && + cfg->buf_positive == cfg_aux->buf_positive && + cfg->buf_negative == cfg_aux->buf_negative && + cfg->vref_mv == cfg_aux->vref_mv && + cfg->pga_bits == cfg_aux->pga_bits && + cfg->odr == cfg_aux->odr && + cfg->odr_sel_bits == cfg_aux->odr_sel_bits && + cfg->filter_type == cfg_aux->filter_type)return cfg_aux; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 233/499 iio: adc: ad7173: Fix comparison of channel configs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 7b6033ed5a9e1a369a9cf58018388ae4c5f17e41 ]
Checking the binary representation of two structs (of the same type) for equality doesn't have the same semantic as comparing all members for equality. The former might find a difference where the latter doesn't in the presence of padding or when ambiguous types like float or bool are involved. (Floats typically have different representations for single values, like -0.0 vs +0.0, or 0.5 * 2² vs 0.25 * 2³. The type bool has at least 8 bits and the raw values 1 and 2 (probably) both evaluate to true, but memcmp finds a difference.)
When searching for a channel that already has the configuration we need, the comparison by member is the one that is needed.
Convert the comparison accordingly to compare the members one after another. Also add a static_assert guard to (somewhat) ensure that when struct ad7173_channel_config::config_props is expanded, the comparison is adapted, too.
This issue is somewhat theoretic, but using memcmp() on a struct is a bad pattern that is worth fixing.
--- drivers/iio/adc/ad7173.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)
drivers/iio/adc/ad7173.c +21 -4
@@ -183,7 +183,11 @@ struct ad7173_channel_config {u8 cfg_slot;bool live; -/* Following fields are used to compare equality. */ +/* +* Following fields are used to compare equality. If you +* make adaptations in it, you most likely also have to adapt +* ad7173_find_live_config(), too. +*/ struct_group (config_props, bool bipolar; bool input_buf;
@@ -602,15 +606,28 @@ static struct ad7173_channel_config * ad7173_find_live_config(struct ad7173_state *st, struct ad7173_channel_config *cfg) { struct ad7173_channel_config *cfg_aux; -ptrdiff_t cmp_size;int i; - cmp_size = sizeof_field(struct ad7173_channel_config, config_props); +/* +* This is just to make sure that the comparison is adapted after +* struct ad7173_channel_config was changed. +*/ + static_assert(sizeof_field(struct ad7173_channel_config, config_props) == +sizeof (struct { +bool bipolar; +bool input_buf; +u8 odr; +u8 ref_sel; + })); +for (i =0 ; i < st->num_channels; i++) { cfg_aux = &st->channels[i].cfg;if (cfg_aux->live && - !memcmp (&cfg->config_props, &cfg_aux->config_props, cmp_size)) + cfg->bipolar == cfg_aux->bipolar && + cfg->input_buf == cfg_aux->input_buf && + cfg->odr == cfg_aux->odr && + cfg->ref_sel == cfg_aux->ref_sel)return cfg_aux; }return NULL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 234/499 iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Santos <[email protected]>
[ Upstream commit 2416cec859299be04d021b4cf98eff814f345af7 ]
Datasheet recommends Setting the MOSI idle state to high in order to prevent accidental reset of the device when SCLK is free running. This happens when the controller clocks out a 1 followed by 63 zeros while the CS is held low.
Check if SPI controller supports SPI_MOSI_IDLE_HIGH flag and set it.
--- drivers/iio/adc/ad7768-1.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/iio/adc/ad7768-1.c +15 -0
@@ -574,6 +574,21 @@ static int ad7768_probe(struct spi_device *spi)return -ENOMEM ; st =iio_priv (indio_dev); +/* +* Datasheet recommends SDI line to be kept high when data is not being +* clocked out of the controller and the spi clock is free running, +* to prevent accidental reset. +* Since many controllers do not support the SPI_MOSI_IDLE_HIGH flag +* yet, only request the MOSI idle state to enable if the controller +* supports it. +*/ +if (spi->controller->mode_bits &SPI_MOSI_IDLE_HIGH ) { + spi->mode |=SPI_MOSI_IDLE_HIGH ; + ret =spi_setup (spi); +if (ret <0 ) +return ret; + } + st->spi = spi; st->vref =devm_regulator_get (&spi->dev,"vref" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 235/499 iio: light: Add check for array bounds in veml6075_read_int_time_ms
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karan Sanghavi <[email protected]>
[ Upstream commit ee735aa33db16c1fb5ebccbaf84ad38f5583f3cc ]
The array contains only 5 elements, but the index calculated by veml6075_read_int_time_index can range from 0 to 7,
which could lead to out-of-bounds access. The check prevents this issue.
Coverity Issue
CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN)
overrun-local: Overrunning array veml6075_it_ms of 5 4-byte elements at element index 7 (byte offset 31) using index int_index (which evaluates to 7)
This is hardening against potentially broken hardware. Good to have but not necessary to backport.
--- drivers/iio/light/veml6075.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/iio/light/veml6075.c +6 -2
@@ -195,13 +195,17 @@ static int veml6075_read_uv_direct(struct veml6075_data *data, int chan,static int veml6075_read_int_time_index (struct veml6075_data *data) { -int ret, conf; +int ret, conf, int_index; ret =regmap_read (data->regmap,VEML6075_CMD_CONF , &conf);if (ret <0 )return ret; -return FIELD_GET (VEML6075_CONF_IT , conf); + int_index =FIELD_GET (VEML6075_CONF_IT , conf); +if (int_index >=ARRAY_SIZE (veml6075_it_ms)) +return -EINVAL ; + +return int_index; }static int veml6075_read_int_time_ms (struct veml6075_data *data,int *val)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 236/499 perf debug: Avoid stack overflow in recursive error message
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit bda840191d2aae3b7cadc3ac21835dcf29487191 ]
In debug_file, pr_warning_once is called on error. As that function calls debug_file the function will yield a stack overflow. Switch the location of the call so the recursion is avoided.
--- tools/perf/util/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/debug.c +1 -1
@@ -46,8 +46,8 @@ int debug_type_profile;FILE *debug_file (void ) {if (!_debug_file) { -pr_warning_once ("debug_file not set" );debug_set_file (stderr); +pr_warning_once ("debug_file not set" ); }return _debug_file; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 237/499 perf evlist: Add success path to evlist__create_syswide_maps
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit fe0ce8a9d85a48642880c9b78944cb0d23e779c5 ]
Over various refactorings evlist__create_syswide_maps has been made to only ever return with -ENOMEM. Fix this so that when perf_evlist__set_maps is successfully called, 0 is returned.
--- tools/perf/util/evlist.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
tools/perf/util/evlist.c +6 -7
@@ -1373,19 +1373,18 @@ static int evlist__create_syswide_maps(struct evlist *evlist)*/ cpus =perf_cpu_map__new_online_cpus ();if (!cpus) - goto out; +return -ENOMEM ; threads =perf_thread_map__new_dummy (); -if (!threads) - goto out_put; +if (!threads) { +perf_cpu_map__put (cpus); +return -ENOMEM ; + }perf_evlist__set_maps (&evlist->core, cpus, threads); -perf_thread_map__put (threads); -out_put:perf_cpu_map__put (cpus); -out: -return -ENOMEM ; +return 0 ; }int evlist__open (struct evlist *evlist)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 238/499 perf x86/topdown: Fix topdown leader sampling test error on hybrid
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <[email protected]>
[ Upstream commit b74683b3bb224eccb644cf260753dfc82e802d92 ]
When running topdown leader smapling test on Intel hybrid platforms, such as LNL/ARL, we see the below error.
Topdown leader sampling test
Topdown leader sampling [Failed topdown events not reordered correctly]
It indciates the below command fails.
perf record -o "${perfdata}" -e "{instructions,slots,topdown-retiring}:S" true
The root cause is that perf tool creats a perf event for each PMU type if it can create.
As for this command, there would be 5 perf events created, cpu_atom/instructions/,cpu_atom/topdown_retiring/, cpu_core/slots/,cpu_core/instructions/,cpu_core/topdown-retiring/
For these 5 events, the 2 cpu_atom events are in a group and the other 3 cpu_core events are in another group.
When arch_topdown_sample_read() traverses all these 5 events, events cpu_atom/instructions/ and cpu_core/slots/ don't have a same group leade, and then return false directly and lead to cpu_core/slots/ event is used to sample and this is not allowed by PMU driver.
It's a overkill to return false directly if "evsel->core.leader !=
leader->core.leader" since there could be multiple groups in the event
list.
Just "continue" instead of "return false" to fix this issue.
--- tools/perf/arch/x86/util/topdown.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/arch/x86/util/topdown.c +1 -1
@@ -81,7 +81,7 @@ bool arch_topdown_sample_read(struct evsel *leader)*/ evlist__for_each_entry (leader->evlist, evsel) {if (evsel->core.leader != leader->core.leader) -return false; +continue ;if (evsel != leader &&arch_is_topdown_metrics (evsel))return true; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 239/499 perf units: Fix insufficient array space
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit cf67629f7f637fb988228abdb3aae46d0c1748fe ]
No need to specify the array size, let the compiler figure that out.
This addresses this compiler warning that was noticed while build testing on fedora rawhide:
31 15.81 fedora:rawhide : FAIL gcc version 15.0.1 20250225 (Red Hat 15.0.1-0) (GCC)
util/units.c: In function 'unit_number__scnprintf':
util/units.c:67:24: error: initializer-string for array of 'char' is too long [-Werror=unterminated-string-initialization]
67 | char unit[4] = "BKMG";
| ^~~~~~
cc1: all warnings being treated as errors
--- tools/perf/util/units.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/units.c +1 -1
@@ -64,7 +64,7 @@ unsigned long convert_unit(unsigned long value, char *unit)int unit_number__scnprintf (char *buf,size_t size,u64 n) { -char unit[4 ] ="BKMG" ; +char unit[] ="BKMG" ;int i =0 ;while (((n /1024 ) >1 ) && (i <3 )) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 240/499 perf test stat_all_pmu.sh: Correctly check perf stat result
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Veronika Molnarova <[email protected]>
[ Upstream commit 02ba09c8ab9406f30c5c63b7cfd4b300c3c2c32c ]
Test case "stat_all_pmu.sh" is not correctly checking 'perf stat' output due to a poor design. Firstly, having the 'set -e' option with a trap catching the sigexit causes the shell to exit immediately if 'perf stat' ends with any non-zero value, which is then caught by the trap reporting an unexpected signal. This causes events that should be parsed by the if-else statement to be caught by the trap handler and are reported as errors:
$ perf test -vv "perf all pmu"
Testing i915/actual-frequency/
Unexpected signal in main
Error:
Access to performance monitoring and observability operations is limited.Secondly, the if-else branches are not exclusive as the checking if the event is present in the output log covers also the "<not supported>" events, which should be accepted, and also the "Bad name events", which should be rejected.
Remove the "set -e" option from the test case, correctly parse the "perf stat" output log and check its return value. Add the missing outputs for the 'perf stat' result and also add logs messages to report the branch that parsed the event for more info.
--- tools/perf/tests/shell/stat_all_pmu.sh | 48 ++++++++++++++++++-------- 1 file changed, 34 insertions(+), 14 deletions(-)
tools/perf/tests/shell/stat_all_pmu.sh +34 -14
@@ -2,7 +2,6 @@ # perf all PMU test (exclusive) # SPDX-License-Identifier: GPL-2.0 -set -e err=0 result=""
@@ -16,34 +15,55 @@ trap trap_cleanup EXIT TERM INT # Test all PMU events; however exclude parameterized ones (name contains '?') for p in $(perf list --raw-dump pmu | sed 's/[[:graph:]]\+?[[:graph:]]\+[[:space:]]//g') do - echo "Testing $p" - result=$(perf stat -e "$p" true 2>&1) - if echo "$result" | grep -q "$p" + echo -n "Testing $p -- " + output=$(perf stat -e "$p" true 2>&1) + stat_result=$? + if echo "$output" | grep -q "$p" then # Event seen in output. - continue - fi - if echo "$result" | grep -q "<not supported>" - then - # Event not supported, so ignore. - continue + if [ $stat_result -eq 0 ] && ! echo "$output" | grep -q "<not supported>" + then + # Event supported. + echo "supported" + continue + elif echo "$output" | grep -q "<not supported>" + then + # Event not supported, so ignore. + echo "not supported" + continue + elif echo "$output" | grep -q "No permission to enable" + then + # No permissions, so ignore. + echo "no permission to enable" + continue + elif echo "$output" | grep -q "Bad event name" + then + # Non-existent event. + echo "Error: Bad event name" + echo "$output" + err=1 + continue + fi fi - if echo "$result" | grep -q "Access to performance monitoring and observability operations is limited." + + if echo "$output" | grep -q "Access to performance monitoring and observability operations is limited." then # Access is limited, so ignore. + echo "access limited" continue fi # We failed to see the event and it is supported. Possibly the workload was # too small so retry with something longer. - result=$(perf stat -e "$p" perf bench internals synthesize 2>&1) - if echo "$result" | grep -q "$p" + output=$(perf stat -e "$p" perf bench internals synthesize 2>&1) + if echo "$output" | grep -q "$p" then # Event seen in output. + echo "supported" continue fi echo "Error: event '$p' not printed in:" - echo "$result" + echo "$output" err=1 done
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 241/499 kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit 096cbb80ab3fd85a9035ec17a1312c2a7db8bc8c ]
Ever since commit b756a3b5e7ea ("mm: device exclusive memory access") we can return with a device-exclusive entry from page_vma_mapped_walk().
__replace_page() is not prepared for that, so teach it about these PFN swap PTEs. Note that device-private entries are so far not applicable on that path, because GUP would never have returned such folios (conversion to device-private happens by page migration, not in-place conversion of the PTE).
There is a race between GUP and us locking the folio to look it up using page_vma_mapped_walk(), so this is likely a fix (unless something else could prevent that race, but it doesn't look like). pte_pfn() on something that is not a present pte could give use garbage, and we'd wrongly mess up the mapcount because it was already adjusted by calling folio_remove_rmap_pte() when making the entry device-exclusive.
--- kernel/events/uprobes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
kernel/events/uprobes.c +12 -1
@@ -173,6 +173,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,DEFINE_FOLIO_VMA_WALK (pvmw, old_folio, vma, addr,0 );int err;struct mmu_notifier_range range; +pte_t pte;mmu_notifier_range_init (&range,MMU_NOTIFY_CLEAR ,0 , mm, addr, addr +PAGE_SIZE );
@@ -192,6 +193,16 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,if (!page_vma_mapped_walk (&pvmw)) goto unlock;VM_BUG_ON_PAGE (addr != pvmw.address, old_page); + pte =ptep_get (pvmw.pte); + +/* +* Handle PFN swap PTES, such as device-exclusive ones, that actually +* map pages: simply trigger GUP again to fix it up. +*/ +if (unlikely (!pte_present (pte))) { +page_vma_mapped_walk_done (&pvmw); + goto unlock; + }if (new_page) {folio_get (new_folio);
@@ -206,7 +217,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,inc_mm_counter (mm,MM_ANONPAGES ); } -flush_cache_page (vma, addr,pte_pfn (ptep_get (pvmw.pte))); +flush_cache_page (vma, addr,pte_pfn (pte));ptep_clear_flush (vma, addr, pvmw.pte);if (new_page) set_pte_at(mm, addr, pvmw.pte,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 242/499 kexec: initialize ELF lowest address to ULONG_MAX
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <[email protected]>
[ Upstream commit 9986fb5164c8b21f6439cfd45ba36d8cc80c9710 ]
Patch series "powerpc/crash: use generic crashkernel reservation", v3.
Commit 0ab97169aa05 ("crash_core: add generic function to do reservation") added a generic function to reserve crashkernel memory. So let's use the same function on powerpc and remove the architecture-specific code that essentially does the same thing.
The generic crashkernel reservation also provides a way to split the crashkernel reservation into high and low memory reservations, which can be enabled for powerpc in the future.
Additionally move powerpc to use generic APIs to locate memory hole for kexec segments while loading kdump kernel.
This patch (of 7):
kexec_elf_load() loads an ELF executable and sets the address of the lowest PT_LOAD section to the address held by the lowest_load_addr function argument.
To determine the lowest PT_LOAD address, a local variable lowest_addr (type unsigned long) is initialized to UINT_MAX. After loading each PT_LOAD, its address is compared to lowest_addr. If a loaded PT_LOAD address is lower, lowest_addr is updated. However, setting lowest_addr to UINT_MAX won't work when the kernel image is loaded above 4G, as the returned lowest PT_LOAD address would be invalid. This is resolved by initializing lowest_addr to ULONG_MAX instead.
This issue was discovered while implementing crashkernel high/low reservation on the PowerPC architecture.
--- kernel/kexec_elf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kexec_elf.c +1 -1
@@ -390,7 +390,7 @@ int kexec_elf_load(struct kimage *image, struct elfhdr *ehdr,struct kexec_buf *kbuf, unsigned long *lowest_load_addr) { - unsigned long lowest_addr = UINT_MAX; + unsigned long lowest_addr = ULONG_MAX;int ret;size_t i;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 243/499 ocfs2: validate l_tree_depth to avoid out-of-bounds access
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
[ Upstream commit a406aff8c05115119127c962cbbbbd202e1973ef ]
The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.
Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].
--- fs/ocfs2/alloc.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ocfs2/alloc.c +8 -0
@@ -1803,6 +1803,14 @@ static int __ocfs2_find_path(struct ocfs2_caching_info *ci, el = root_el;while (el->l_tree_depth) { +if (unlikely (le16_to_cpu (el->l_tree_depth) >=OCFS2_MAX_PATH_DEPTH )) { +ocfs2_error (ocfs2_metadata_cache_get_super (ci), +"Owner %llu has invalid tree depth %u in extent list\n" , + (unsigned long long )ocfs2_metadata_cache_owner (ci), +le16_to_cpu (el->l_tree_depth)); + ret = -EROFS ; + goto out; + }if (le16_to_cpu (el->l_next_free_rec) ==0 ) { ocfs2_error(ocfs2_metadata_cache_get_super(ci), "Owner %llu has empty extent list at depth %u\n",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 244/499 arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anshuman Khandual <[email protected]>
[ Upstream commit 2c5e6ac2db64ace51f66a9f3b3b3ab9553d748e8 ]
GENERIC_PTDUMP gets selected on powerpc explicitly and hence can be dropped off from mpc885_ads_defconfig. Replace with CONFIG_PTDUMP_DEBUGFS instead.
--- arch/powerpc/configs/mpc885_ads_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/configs/mpc885_ads_defconfig +1 -1
@@ -78,4 +78,4 @@ CONFIG_DEBUG_VM_PGTABLE=y CONFIG_DETECT_HUNG_TASK=y CONFIG_BDI_SWITCH=y CONFIG_PPC_EARLY_DEBUG=y -CONFIG_GENERIC_PTDUMP=y +CONFIG_PTDUMP_DEBUGFS=y
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 245/499 NFSv4: Dont trigger uneccessary scans for return-on-close delegations
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 47acca884f714f41d95dc654f802845544554784 ]
The amount of looping through the list of delegations is occasionally leading to soft lockups. Avoid at least some loops by not requiring the NFSv4 state manager to scan for delegations that are marked for return-on-close. Instead, either mark them for immediate return (if possible) or else leave it up to nfs4_inode_return_delegation_on_close() to return them once the file is closed by the application.
--- fs/nfs/delegation.c | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-)
fs/nfs/delegation.c +18 -15
@@ -590,17 +590,6 @@ static bool nfs_delegation_need_return(struct nfs_delegation *delegation)if (test_and_clear_bit (NFS_DELEGATION_RETURN , &delegation->flags)) ret = true; -else if (test_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags)) { -struct inode *inode; - -spin_lock (&delegation->lock); - inode = delegation->inode; -if (inode &&list_empty (&NFS_I (inode)->open_files)) - ret = true; -spin_unlock (&delegation->lock); - } -if (ret) -clear_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags);if (test_bit (NFS_DELEGATION_RETURNING , &delegation->flags) ||test_bit (NFS_DELEGATION_RETURN_DELAYED , &delegation->flags) ||test_bit (NFS_DELEGATION_REVOKED , &delegation->flags))
@@ -878,11 +867,25 @@ int nfs4_inode_make_writeable(struct inode *inode)return nfs4_inode_return_delegation (inode); } -static void nfs_mark_return_if_closed_delegation (struct nfs_server *server, -struct nfs_delegation *delegation) +static void +nfs_mark_return_if_closed_delegation (struct nfs_server *server, +struct nfs_delegation *delegation) { -set_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags); -set_bit (NFS4CLNT_DELEGRETURN , &server->nfs_client->cl_state); +struct inode *inode; + +if (test_bit (NFS_DELEGATION_RETURN , &delegation->flags) || +test_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags)) +return ; +spin_lock (&delegation->lock); + inode = delegation->inode; +if (!inode) + goto out; +if (list_empty (&NFS_I (inode)->open_files)) +nfs_mark_return_delegation (server, delegation); +else +set_bit (NFS_DELEGATION_RETURN_IF_CLOSED , &delegation->flags); +out: +spin_unlock (&delegation->lock); }static bool nfs_server_mark_return_all_delegations (struct nfs_server *server)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 246/499 NFSv4: Avoid unnecessary scans of filesystems for returning delegations
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 35a566a24e58f1b5f89737edf60b77de58719ed0 ]
The amount of looping through the list of delegations is occasionally leading to soft lockups. If the state manager was asked to return delegations asynchronously, it should only scan those filesystems that hold delegations that need to be returned.
--- fs/nfs/delegation.c | 5 +++++ include/linux/nfs_fs_sb.h | 2 ++ 2 files changed, 7 insertions(+)
fs/nfs/delegation.c +5 -0
@@ -79,6 +79,7 @@ static void nfs_mark_return_delegation(struct nfs_server *server, struct nfs_delegation *delegation) {set_bit (NFS_DELEGATION_RETURN , &delegation->flags); +set_bit (NFS4SERV_DELEGRETURN , &server->delegation_flags);set_bit (NFS4CLNT_DELEGRETURN , &server->nfs_client->cl_state); }
@@ -608,6 +609,9 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server,struct nfs_delegation *place_holder_deleg =NULL ;int err =0 ; +if (!test_and_clear_bit (NFS4SERV_DELEGRETURN , + &server->delegation_flags)) +return 0 ; restart:/* * To avoid quadratic looping we hold a reference
@@ -659,6 +663,7 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server,cond_resched ();if (!err) goto restart; +set_bit (NFS4SERV_DELEGRETURN , &server->delegation_flags);set_bit (NFS4CLNT_DELEGRETURN , &server->nfs_client->cl_state); goto out; }
include/linux/nfs_fs_sb.h +2 -0
@@ -251,6 +251,8 @@ struct nfs_server {struct list_head ss_copies;struct list_head ss_src_copies; +unsigned long delegation_flags; +#define NFS4SERV_DELEGRETURN (1)unsigned long delegation_gen;unsigned long mig_gen;unsigned long mig_status;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 247/499 NFSv4: Avoid unnecessary scans of filesystems for expired delegations
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit f163aa81a799e2d46d7f8f0b42a0e7770eaa0d06 ]
The amount of looping through the list of delegations is occasionally leading to soft lockups. If the state manager was asked to reap the expired delegations, it should scan only those filesystems that hold delegations that need to be reaped.
--- fs/nfs/delegation.c | 7 +++++++ include/linux/nfs_fs_sb.h | 1 + 2 files changed, 8 insertions(+)
fs/nfs/delegation.c +7 -0
@@ -1284,6 +1284,7 @@ static void nfs_mark_test_expired_delegation(struct nfs_server *server,return ;clear_bit (NFS_DELEGATION_NEED_RECLAIM , &delegation->flags);set_bit (NFS_DELEGATION_TEST_EXPIRED , &delegation->flags); +set_bit (NFS4SERV_DELEGATION_EXPIRED , &server->delegation_flags);set_bit (NFS4CLNT_DELEGATION_EXPIRED , &server->nfs_client->cl_state); }
@@ -1362,6 +1363,9 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server,nfs4_stateid stateid;unsigned long gen = ++server->delegation_gen; +if (!test_and_clear_bit (NFS4SERV_DELEGATION_EXPIRED , + &server->delegation_flags)) +return 0 ; restart:rcu_read_lock ();list_for_each_entry_rcu (delegation, &server->delegations, super_list) {
@@ -1391,6 +1395,9 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server, goto restart; }nfs_inode_mark_test_expired_delegation (server,inode); +set_bit (NFS4SERV_DELEGATION_EXPIRED , &server->delegation_flags); +set_bit (NFS4CLNT_DELEGATION_EXPIRED , + &server->nfs_client->cl_state);iput (inode);return -EAGAIN ; }
include/linux/nfs_fs_sb.h +1 -0
@@ -253,6 +253,7 @@ struct nfs_server {unsigned long delegation_flags;#define NFS4SERV_DELEGRETURN (1) +#define NFS4SERV_DELEGATION_EXPIRED (2)unsigned long delegation_gen;unsigned long mig_gen;unsigned long mig_status;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 248/499 NFSv4: Avoid unnecessary scans of filesystems for delayed delegations
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit e767b59e29b8327d25edde65efc743f479f30d0a ]
The amount of looping through the list of delegations is occasionally leading to soft lockups. If the state manager was asked to manage the delayed return of delegations, then only scan those filesystems containing delegations that were marked as being delayed.
--- fs/nfs/delegation.c | 18 ++++++++++++------ include/linux/nfs_fs_sb.h | 1 + 2 files changed, 13 insertions(+), 6 deletions(-)
fs/nfs/delegation.c +12 -6
@@ -331,14 +331,16 @@ nfs_start_delegation_return(struct nfs_inode *nfsi) }static void nfs_abort_delegation_return (struct nfs_delegation *delegation, -struct nfs_client *clp,int err) +struct nfs_server *server,int err) { -spin_lock (&delegation->lock);clear_bit (NFS_DELEGATION_RETURNING , &delegation->flags);if (err == -EAGAIN ) {set_bit (NFS_DELEGATION_RETURN_DELAYED , &delegation->flags); -set_bit (NFS4CLNT_DELEGRETURN_DELAYED , &clp->cl_state); +set_bit (NFS4SERV_DELEGRETURN_DELAYED , + &server->delegation_flags); +set_bit (NFS4CLNT_DELEGRETURN_DELAYED , + &server->nfs_client->cl_state); }spin_unlock (&delegation->lock); }
@@ -548,7 +550,7 @@ int nfs_inode_set_delegation(struct inode *inode, const struct cred *cred,*/ static int nfs_end_delegation_return (struct inode *inode,struct nfs_delegation *delegation,int issync) { -struct nfs_client *clp =NFS_SERVER (inode)->nfs_client; +struct nfs_server *server =NFS_SERVER (inode);unsigned int mode =O_WRONLY |O_RDWR ;int err =0 ;
@@ -570,11 +572,11 @@ static int nfs_end_delegation_return(struct inode *inode, struct nfs_delegation/* * Guard against state recovery */ - err =nfs4_wait_clnt_recover (clp); + err =nfs4_wait_clnt_recover (server->nfs_client); }if (err) { -nfs_abort_delegation_return (delegation, clp, err); +nfs_abort_delegation_return (delegation, server, err); goto out; }
@@ -678,6 +680,9 @@ static bool nfs_server_clear_delayed_delegations(struct nfs_server *server)struct nfs_delegation *d;bool ret = false; +if (!test_and_clear_bit (NFS4SERV_DELEGRETURN_DELAYED , + &server->delegation_flags)) + goto out; list_for_each_entry_rcu (d, &server->delegations, super_list) {if (!test_bit (NFS_DELEGATION_RETURN_DELAYED , &d->flags))continue ;
@@ -685,6 +690,7 @@ static bool nfs_server_clear_delayed_delegations(struct nfs_server *server)clear_bit (NFS_DELEGATION_RETURN_DELAYED , &d->flags); ret = true; } +out:return ret; }
include/linux/nfs_fs_sb.h +1 -0
@@ -254,6 +254,7 @@ struct nfs_server {unsigned long delegation_flags;#define NFS4SERV_DELEGRETURN (1)#define NFS4SERV_DELEGATION_EXPIRED (2) +#define NFS4SERV_DELEGRETURN_DELAYED (3)unsigned long delegation_gen;unsigned long mig_gen;unsigned long mig_status;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 249/499 NFS: fix open_owner_id_maxsz and related fields.
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 43502f6e8d1e767d6736ea0676cc784025cf6eeb ]
A recent change increased the size of an NFSv4 open owner, but didn't increase the corresponding max_sz defines. This is not know to have caused failure, but should be fixed.
This patch also fixes some relates _maxsz fields that are wrong.
Note that the XXX_owner_id_maxsz values now are only the size of the id and do NOT include the len field that will always preceed the id in xdr encoding. I think this is clearer.
--- fs/nfs/nfs4xdr.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
fs/nfs/nfs4xdr.c +9 -9
@@ -82,9 +82,8 @@ static int decode_layoutget(struct xdr_stream *xdr, struct rpc_rqst *req,* we currently use size 2 (u64) out of (NFS4_OPAQUE_LIMIT >> 2) */ #define pagepad_maxsz (1) -#define open_owner_id_maxsz (1 + 2 + 1 + 1 + 2) -#define lock_owner_id_maxsz (1 + 1 + 4) -#define decode_lockowner_maxsz (1 + XDR_QUADLEN(IDMAP_NAMESZ)) +#define open_owner_id_maxsz (2 + 1 + 2 + 2) +#define lock_owner_id_maxsz (2 + 1 + 2)#define compound_encode_hdr_maxsz (3 + (NFS4_MAXTAGLEN >> 2))#define compound_decode_hdr_maxsz (3 + (NFS4_MAXTAGLEN >> 2))#define op_encode_hdr_maxsz (1)
@@ -185,7 +184,7 @@ static int decode_layoutget(struct xdr_stream *xdr, struct rpc_rqst *req,#define encode_claim_null_maxsz (1 + nfs4_name_maxsz)#define encode_open_maxsz (op_encode_hdr_maxsz + \ 2 + encode_share_access_maxsz + 2 + \ - open_owner_id_maxsz + \ + 1 + open_owner_id_maxsz + \ encode_opentype_maxsz + \ encode_claim_null_maxsz)#define decode_space_limit_maxsz (3)
@@ -255,13 +254,14 @@ static int decode_layoutget(struct xdr_stream *xdr, struct rpc_rqst *req,#define encode_link_maxsz (op_encode_hdr_maxsz + \ nfs4_name_maxsz)#define decode_link_maxsz (op_decode_hdr_maxsz + decode_change_info_maxsz) -#define encode_lockowner_maxsz (7) +#define encode_lockowner_maxsz (2 + 1 + lock_owner_id_maxsz) +#define encode_lock_maxsz (op_encode_hdr_maxsz + \ 7 + \ 1 + encode_stateid_maxsz + 1 + \ encode_lockowner_maxsz)#define decode_lock_denied_maxsz \ - (8 + decode_lockowner_maxsz) + (2 + 2 + 1 + 2 + 1 + lock_owner_id_maxsz)#define decode_lock_maxsz (op_decode_hdr_maxsz + \ decode_lock_denied_maxsz)#define encode_lockt_maxsz (op_encode_hdr_maxsz + 5 + \
@@ -617,7 +617,7 @@ static int decode_layoutget(struct xdr_stream *xdr, struct rpc_rqst *req, encode_lockowner_maxsz)#define NFS4_dec_release_lockowner_sz \ (compound_decode_hdr_maxsz + \ - decode_lockowner_maxsz) + decode_release_lockowner_maxsz)#define NFS4_enc_access_sz (compound_encode_hdr_maxsz + \ encode_sequence_maxsz + \ encode_putfh_maxsz + \
@@ -1412,7 +1412,7 @@ static inline void encode_openhdr(struct xdr_stream *xdr, const struct nfs_opena__be32 *p;/* * opcode 4, seqid 4, share_access 4, share_deny 4, clientid 8, ownerlen 4, -* owner 4 = 32 +* owner 28 */ encode_nfs4_seqid (xdr, arg->seqid);encode_share_access (xdr, arg->share_access);
@@ -5077,7 +5077,7 @@ static int decode_link(struct xdr_stream *xdr, struct nfs4_change_info *cinfo)/* * We create the owner, so we know a proper owner.id length is 4. */ -static int decode_lock_denied (struct xdr_stream *xdr,struct file_lock *fl) +static int decode_lock_denied (struct xdr_stream *xdr,struct file_lock *fl) {uint64_t offset, length, clientid;__be32 *p;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 250/499 fuse: fix dax truncate/punch_hole fault path
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Popple <[email protected]>
[ Upstream commit 7851bf649d423edd7286b292739f2eefded3d35c ]
Patch series "fs/dax: Fix ZONE_DEVICE page reference counts", v9.
Device and FS DAX pages have always maintained their own page reference counts without following the normal rules for page reference counting. In particular pages are considered free when the refcount hits one rather than zero and refcounts are not added when mapping the page.
Tracking this requires special PTE bits (PTE_DEVMAP) and a secondary mechanism for allowing GUP to hold references on the page (see get_dev_pagemap). However there doesn't seem to be any reason why FS DAX pages need their own reference counting scheme.
By treating the refcounts on these pages the same way as normal pages we can remove a lot of special checks. In particular pXd_trans_huge() becomes the same as pXd_leaf(), although I haven't made that change here. It also frees up a valuable SW define PTE bit on architectures that have devmap PTE bits defined.
It also almost certainly allows further clean-up of the devmap managed functions, but I have left that as a future improvment. It also enables support for compound ZONE_DEVICE pages which is one of my primary motivators for doing this work.
This patch (of 20):
FS DAX requires file systems to call into the DAX layout prior to unlinking inodes to ensure there is no ongoing DMA or other remote access to the direct mapped page. The fuse file system implements fuse_dax_break_layouts() to do this which includes a comment indicating that passing dmap_end == 0 leads to unmapping of the whole file.
However this is not true - passing dmap_end == 0 will not unmap anything before dmap_start, and further more dax_layout_busy_page_range() will not scan any of the range to see if there maybe ongoing DMA access to the range. Fix this by passing -1 for dmap_end to fuse_dax_break_layouts() which will invalidate the entire file range to dax_layout_busy_page_range().
--- fs/fuse/dax.c | 1 - fs/fuse/dir.c | 2 +- fs/fuse/file.c | 4 ++-- 3 files changed, 3 insertions(+), 4 deletions(-)
fs/fuse/dax.c +0 -1
@@ -681,7 +681,6 @@ static int __fuse_dax_break_layouts(struct inode *inode, bool *retry, 0, 0, fuse_wait_dax_page(inode)); } -/* dmap_end == 0 leads to unmapping of whole file */ int fuse_dax_break_layouts (struct inode *inode,u64 dmap_start,u64 dmap_end) {
fs/fuse/dir.c +1 -1
@@ -1937,7 +1937,7 @@ int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,if (FUSE_IS_DAX (inode) && is_truncate) {filemap_invalidate_lock (mapping); fault_blocked = true; - err =fuse_dax_break_layouts (inode,0 ,0 ); + err =fuse_dax_break_layouts (inode,0 ,-1 );if (err) {filemap_invalidate_unlock (mapping);return err;
fs/fuse/file.c +2 -2
@@ -253,7 +253,7 @@ static int fuse_open(struct inode *inode, struct file *file)if (dax_truncate) {filemap_invalidate_lock (inode->i_mapping); - err =fuse_dax_break_layouts (inode,0 ,0 ); + err =fuse_dax_break_layouts (inode,0 ,-1 );if (err) goto out_inode_unlock; }
@@ -3205,7 +3205,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,inode_lock (inode);if (block_faults) {filemap_invalidate_lock (inode->i_mapping); - err =fuse_dax_break_layouts (inode,0 ,0 ); + err =fuse_dax_break_layouts (inode,0 ,-1 );if (err) goto out; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 251/499 selftests/mm/cow: fix the incorrect error handling
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyan Yang <[email protected]>
[ Upstream commit f841ad9ca5007167c02de143980c9dc703f90b3d ]
Error handling doesn't check the correct return value. This patch will fix it.
--- tools/testing/selftests/mm/cow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/mm/cow.c +1 -1
@@ -876,7 +876,7 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run, size_t thpsize) mremap_size = thpsize /2 ; mremap_mem =mmap (NULL , mremap_size,PROT_NONE ,MAP_PRIVATE |MAP_ANONYMOUS ,-1 ,0 ); -if (mem ==MAP_FAILED ) { +if (mremap_mem ==MAP_FAILED ) {ksft_test_result_fail ("mmap() failed\n" ); goto munmap; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 252/499 um: Pass the correct Rust target and options with gcc
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gow <[email protected]>
[ Upstream commit 5550187c4c21740942c32a9ae56f9f472a104cb4 ]
In order to work around some issues with disabling SSE on older versions of gcc (compilation would fail upon seeing a function declaration containing a float, even if it was never called or defined), the corresponding CFLAGS and RUSTFLAGS were only set when using clang.
However, this led to two problems:
- Newer gcc versions also wouldn't get the correct flags, despite not having the bug.
- The RUSTFLAGS for setting the rust target definition were not set, despite being unrelated. This works by chance for x86_64, as the built-in default target is close enough, but not for 32-bit x86.
Move the target definition outside the conditional block, and update the condition to take into account the gcc version.
--- arch/x86/Makefile.um | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/x86/Makefile.um +4 -3
@@ -7,12 +7,13 @@ core-y += arch/x86/crypto/ # GCC versions < 11. See: # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99652 # -ifeq ($(CONFIG_CC_IS_CLANG),y) -KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -KBUILD_RUSTFLAGS += --target=$(objtree)/scripts/target.json +ifeq ($(call gcc-min-version, 110000)$(CONFIG_CC_IS_CLANG),y) +KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx KBUILD_RUSTFLAGS += -Ctarget-feature=-sse,-sse2,-sse3,-ssse3,-sse4.1,-sse4.2,-avx,-avx2 endif +KBUILD_RUSTFLAGS += --target=$(objtree)/scripts/target.json + ifeq ($(CONFIG_X86_32),y) START := 0x8048000
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 253/499 um: remove copy_from_kernel_nofault_allowed
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 84a6fc378471fbeaf48f8604566a5a33a3d63c18 ]
There is no need to override the default version of this function anymore as UML now has proper _nofault memory access functions.
Doing this also fixes the fact that the implementation was incorrect as using mincore() will incorrectly flag pages as inaccessible if they were swapped out by the host.
--- arch/um/include/shared/os.h | 1 - arch/um/kernel/Makefile | 2 +- arch/um/kernel/maccess.c | 19 -------------- arch/um/os-Linux/process.c | 51 ------------------------------------- 4 files changed, 1 insertion(+), 72 deletions(-) delete mode 100644 arch/um/kernel/maccess.c
arch/um/include/shared/os.h +0 -1
@@ -213,7 +213,6 @@ extern int os_protect_memory(void *addr, unsigned long len,extern int os_unmap_memory (void *addr,int len);extern int os_drop_memory (void *addr,int length);extern int can_drop_memory (void ); -extern int os_mincore (void *addr,unsigned long len);void os_set_pdeathsig (void );
arch/um/kernel/Makefile +1 -1
@@ -17,7 +17,7 @@ extra-y := vmlinux.lds obj-y = config.o exec.o exitcode.o irq.o ksyms.o mem.o \ physmem.o process.o ptrace.o reboot.o sigio.o \ signal.o sysrq.o time.o tlb.o trap.o \ - um_arch.o umid.o maccess.o kmsg_dump.o capflags.o skas/ + um_arch.o umid.o kmsg_dump.o capflags.o skas/ obj-y += load_file.o obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o
arch/um/kernel/maccess.c deleted +0 -19
@@ -1,19 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-only -/* -* Copyright (C) 2013 Richard Weinberger <[email protected]> -*/ - -#include <linux/uaccess.h> -#include <linux/kernel.h> -#include <os.h> - -bool copy_from_kernel_nofault_allowed (const void *src,size_t size) -{ -void *psrc = (void *)rounddown ((unsigned long )src,PAGE_SIZE ); - -if ((unsigned long )src <PAGE_SIZE || size <=0 ) -return false; -if (os_mincore (psrc, size + src - psrc) <=0 ) -return false; -return true; -}
arch/um/os-Linux/process.c +0 -51
57 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 254/499 um: hostfs: avoid issues on inode number reuse by host
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 0bc754d1e31f40f4a343b692096d9e092ccc0370 ]
Some file systems (e.g. ext4) may reuse inode numbers once the inode is not in use anymore. Usually hostfs will keep an FD open for each inode, but this is not always the case. In the case of sockets, this cannot even be done properly.
As such, the following sequence of events was possible:
* application creates and deletes a socket
* hostfs creates/deletes the socket on the host
* inode is still in the hostfs cache
* hostfs creates a new file
* ext4 on the outside reuses the inode number
* hostfs finds the socket inode for the newly created file
* application receives -ENXIO when opening the file
As mentioned, this can only happen if the deleted file is a special file that is never opened on the host (i.e. no .open fop).
As such, to prevent issues, it is sufficient to check that the inode has the expected type. That said, also add a check for the inode birth time, just to be on the safe side.
--- fs/hostfs/hostfs.h | 2 +- fs/hostfs/hostfs_kern.c | 7 ++++- fs/hostfs/hostfs_user.c | 59 ++++++++++++++++++++++++----------------- 3 files changed, 41 insertions(+), 27 deletions(-)
fs/hostfs/hostfs.h +1 -1
@@ -60,7 +60,7 @@ struct hostfs_stat {unsigned int uid;unsigned int gid;unsigned long long size; -struct hostfs_timespec atime, mtime, ctime; +struct hostfs_timespec atime, mtime, ctime, btime;unsigned int blksize;unsigned long long blocks;struct {
fs/hostfs/hostfs_kern.c +6 -1
@@ -33,6 +33,7 @@ struct hostfs_inode_info {struct inode vfs_inode;struct mutex open_mutex;dev_t dev; +struct hostfs_timespec btime; };static inline struct hostfs_inode_info *HOSTFS_I (struct inode *inode)
@@ -551,6 +552,7 @@ static int hostfs_inode_set(struct inode *ino, void *data) }HOSTFS_I (ino)->dev = dev; +HOSTFS_I (ino)->btime = st->btime; ino->i_ino = st->ino; ino->i_mode = st->mode;return hostfs_inode_update (ino, st);
@@ -561,7 +563,10 @@ static int hostfs_inode_test(struct inode *inode, void *data)const struct hostfs_stat *st = data;dev_t dev =MKDEV (st->dev.maj, st->dev.min); -return inode->i_ino == st->ino &&HOSTFS_I (inode)->dev == dev; +return inode->i_ino == st->ino &&HOSTFS_I (inode)->dev == dev && + (inode->i_mode &S_IFMT ) == (st->mode &S_IFMT ) && +HOSTFS_I (inode)->btime.tv_sec == st->btime.tv_sec && +HOSTFS_I (inode)->btime.tv_nsec == st->btime.tv_nsec; }static struct inode *hostfs_iget (struct super_block *sb,char *name)
fs/hostfs/hostfs_user.c +34 -25
73 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 255/499 i3c: master: svc: Fix missing the IBI rules
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chu <[email protected]>
[ Upstream commit 9cecad134d84d14dc72a0eea7a107691c3e5a837 ]
The code does not add IBI rules for devices with controller capability. However, the secondary controller has the controller capability and works at target mode when the device is probed. Therefore, add IBI rules for such devices.
--- drivers/i3c/master/svc-i3c-master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i3c/master/svc-i3c-master.c +1 -1
@@ -1037,7 +1037,7 @@ static int svc_i3c_update_ibirules(struct svc_i3c_master *master)/* Create the IBIRULES register for both cases */ i3c_bus_for_each_i3cdev (&master->base.bus, dev) { -if (I3C_BCR_DEVICE_ROLE (dev->info.bcr) ==I3C_BCR_I3C_MASTER ) +if (!(dev->info.bcr &I3C_BCR_IBI_REQ_CAP ))continue ;if (dev->info.bcr &I3C_BCR_IBI_PAYLOAD ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 256/499 perf python: Fixup description of sample.id event member
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 1376c195e8ad327bb9f2d32e0acc5ac39e7cb30a ]
Some old cut'n'paste error, its "ip", so the description should be "event ip", not "event type".
--- tools/perf/util/python.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/python.c +1 -1
@@ -79,7 +79,7 @@ struct pyrf_event { };#define sample_members \ - sample_member_def(sample_ip, ip, T_ULONGLONG, "event type"), \ + sample_member_def(sample_ip, ip, T_ULONGLONG, "event ip"), \ sample_member_def(sample_pid, pid, T_INT, "event pid"), \ sample_member_def(sample_tid, tid, T_INT, "event tid"), \ sample_member_def(sample_time, time, T_ULONGLONG, "event timestamp"), \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 257/499 perf python: Decrement the refcount of just created event on failure
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 3de5a2bf5b4847f7a59a184568f969f8fe05d57f ]
To avoid a leak if we have the python object but then something happens and we need to return the operation, decrement the offset of the newly created object.
--- tools/perf/util/python.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
tools/perf/util/python.c +5 -1
@@ -1011,6 +1011,7 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist, evsel =evlist__event2evsel (evlist, event);if (!evsel) { +Py_DECREF (pyevent);Py_INCREF (Py_None);return Py_None; }
@@ -1022,9 +1023,12 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,/* Consume the even only after we parsed it out. */ perf_mmap__consume (&md->core); -if (err) +if (err) { +Py_DECREF (pyevent);return PyErr_Format (PyExc_OSError,"perf: can't parse sample, err=%d" , err); + } +return pyevent; } end:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 258/499 perf python: Dont keep a raw_data pointer to consumed ring buffer space
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit f3fed3ae34d606819d87a63d970cc3092a5be7ab ]
When processing tracepoints the perf python binding was parsing the event before calling perf_mmap__consume(&md->core) in pyrf_evlist__read_on_cpu().
But part of this event parsing was to set the perf_sample->raw_data pointer to the payload of the event, which then could be overwritten by other event before tracepoint fields were asked for via event.prev_comm in a python program, for instance.
This also happened with other fields, but strings were were problems were surfacing, as there is UTF-8 validation for the potentially garbled data.
This ended up showing up as (with some added debugging messages):
( field 'prev_comm' ret=0x7f7c31f65110, raw_size=68 ) ( field 'prev_pid' ret=0x7f7c23b1bed0, raw_size=68 ) ( field 'prev_prio' ret=0x7f7c239c0030, raw_size=68 ) ( field 'prev_state' ret=0x7f7c239c0250, raw_size=68 ) time 14771421785867 prev_comm= prev_pid=1919907691 prev_prio=796026219 prev_state=0x303a32313175 ==> ( XXX '��' len=16, raw_size=68) ( field 'next_comm' ret=(nil), raw_size=68 ) Traceback (most recent call last):
File "/home/acme/git/perf-tools-next/tools/perf/python/tracepoint.py", line 51, in <module>
main()
File "/home/acme/git/perf-tools-next/tools/perf/python/tracepoint.py", line 46, in main
event.next_comm,
^^^^^^^^^^^^^^^ AttributeError: 'perf.sample_event' object has no attribute 'next_comm'
When event.next_comm was asked for, the PyUnicode_FromString() python API would fail and that tracepoint field wouldn't be available, stopping the tools/perf/python/tracepoint.py test tool.
But, since we already do a copy of the whole event in pyrf_event__new, just use it and while at it remove what was done in in e8968e654191390a ("perf python: Fix pyrf_evlist__read_on_cpu event consuming") because we don't really need to wait for parsing the sample before declaring the event as consumed.
This copy is questionable as is now, as it limits the maximum event + sample_type and tracepoint payload to sizeof(union perf_event), this all has been "working" because 'struct perf_event_mmap2', the largest entry in 'union perf_event' is:
$ pahole -C perf_event ~/bin/perf | grep mmap2 struct perf_record_mmap2 mmap2; /* 0 4168 */ $
--- tools/perf/util/python.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
tools/perf/util/python.c +1 -3
@@ -1018,11 +1018,9 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist, pevent->evsel = evsel; - err =evsel__parse_sample (evsel, event, &pevent->sample); - -/* Consume the even only after we parsed it out. */ perf_mmap__consume (&md->core); + err =evsel__parse_sample (evsel, &pevent->event, &pevent->sample);if (err) {Py_DECREF (pyevent); return PyErr_Format(PyExc_OSError,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 259/499 perf python: Check if there is space to copy all the event
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 89aaeaf84231157288035b366cb6300c1c6cac64 ]
The pyrf_event__new() method copies the event obtained from the perf ring buffer to a structure that will then be turned into a python object for further consumption, so it copies perf_event.header.size bytes to its 'event' member:
$ pahole -C pyrf_event /tmp/build/perf-tools-next/python/perf.cpython-312-x86_64-linux-gnu.so
struct pyrf_event {
PyObject ob_base; /* 0 16 */
struct evsel * evsel; /* 16 8 */
struct perf_sample sample; /* 24 312 *//* XXX last struct has 7 bytes of padding, 2 holes */
/* --- cacheline 5 boundary (320 bytes) was 16 bytes ago --- */
union perf_event event; /* 336 4168 */
/* size: 4504, cachelines: 71, members: 4 */ /* member types with holes: 1, total: 2 */ /* paddings: 1, sum paddings: 7 */ /* last cacheline: 24 bytes */ };
$
It was doing so without checking if the event just obtained has more than that space, fix it.
This isn't a proper, final solution, as we need to support larger events, but for the time being we at least bounds check and document it.
--- tools/perf/util/python.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/perf/util/python.c +5 -0
@@ -512,6 +512,11 @@ static PyObject *pyrf_event__new(union perf_event *event) event->header.type == PERF_RECORD_SWITCH_CPU_WIDE))return NULL ; +// FIXME this better be dynamic or we need to parse everything +// before calling perf_mmap__consume(), including tracepoint fields. +if (sizeof (pevent->event) < event->header.size) +return NULL ; + ptype = pyrf_event__type[event->header.type]; pevent = PyObject_New(struct pyrf_event, ptype);if (pevent !=NULL )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 260/499 perf dso: fix dso__is_kallsyms() check
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Brennan <[email protected]>
[ Upstream commit ebf0b332732dcc64239119e554faa946562b0b93 ]
Kernel modules for which we cannot find a file on-disk will have a dso->long_name that looks like "[module_name]". Prior to the commit listed in the fixes, the dso->kernel field would be zero (for user space), so dso__is_kallsyms() would return false. After the commit, kernel module DSOs are correctly labeled, but the result is that dso__is_kallsyms() erroneously returns true for those modules without a filesystem path.
Later, build_id_cache__add() consults this value of is_kallsyms, and when true, it copies /proc/kallsyms into the cache. Users with many kernel modules without a filesystem path (e.g. ksplice or possibly kernel live patch modules) have reported excessive disk space usage in the build ID cache directory due to this behavior.
To reproduce the issue, it's enough to build a trivial out-of-tree hello world kernel module, load it using insmod, and then use:
perf record -ag -- sleep 1
In the build ID directory, there will be a directory for your module name containing a kallsyms file.
Fix this up by changing dso__is_kallsyms() to consult the dso_binary_type enumeration, which is also symmetric to the above checks for dso__is_vmlinux() and dso__is_kcore(). With this change, kallsyms is not cached in the build-id cache for out-of-tree modules.
--- tools/perf/util/dso.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/perf/util/dso.h +3 -1
@@ -808,7 +808,9 @@ static inline bool dso__is_kcore(const struct dso *dso)static inline bool dso__is_kallsyms (const struct dso *dso) { -return RC_CHK_ACCESS (dso)->kernel &&RC_CHK_ACCESS (dso)->long_name[0 ] !='/' ; +enum dso_binary_type bt =dso__binary_type (dso); + +return bt ==DSO_BINARY_TYPE__KALLSYMS || bt ==DSO_BINARY_TYPE__GUEST_KALLSYMS ; }bool dso__is_object_file (const struct dso *dso);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 261/499 perf: intel-tpebs: Fix incorrect usage of zfree()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit 6d2dcd635204c023eb5328ad7d38b198a5558c9b ]
zfree() requires an address otherwise it frees what's in name, rather than name itself. Pass the address of name to fix it.
This was the only incorrect occurrence in Perf found using a search.
--- tools/perf/util/intel-tpebs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/intel-tpebs.c +1 -1
@@ -254,7 +254,7 @@ int tpebs_start(struct evlist *evsel_list) new =zalloc (sizeof (*new));if (!new) { ret =-1 ; -zfree (name); +zfree (&name); goto err; } new->name = name;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 262/499 staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: 谢致邦 (XIE Zhibang) <[email protected]>
[ Upstream commit b2a9a6a26b7e954297e51822e396572026480bad ]
This fixes the following issue:
ERROR: modpost: "aes_expandkey" [drivers/staging/rtl8723bs/r8723bs.ko] undefined!
ERROR: modpost: "aes_encrypt" [drivers/staging/rtl8723bs/r8723bs.ko] undefined!
--- drivers/staging/rtl8723bs/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/staging/rtl8723bs/Kconfig +1 -0
@@ -4,6 +4,7 @@ config RTL8723BS depends on WLAN && MMC && CFG80211 depends on m select CRYPTO + select CRYPTO_LIB_AES select CRYPTO_LIB_ARC4 help This option enables support for RTL8723BS SDIO drivers, such as
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 263/499 staging: vchiq_arm: Register debugfs after cdev
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit 63f4dbb196db60a8536ba3d1b835d597a83f6cbb ]
The commit 2a4d15a4ae98 ("staging: vchiq: Refactor vchiq cdev code") moved the debugfs directory creation before vchiq character device registration. In case the latter fails, the debugfs directory won't be cleaned up.
--- drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +2 -2
@@ -1386,8 +1386,6 @@ static int vchiq_probe(struct platform_device *pdev)return ret; } -vchiq_debugfs_init (&mgmt->state); -dev_dbg (&pdev->dev,"arm: platform initialised - version %d (min %d)\n" ,VCHIQ_VERSION ,VCHIQ_VERSION_MIN );
@@ -1401,6 +1399,8 @@ static int vchiq_probe(struct platform_device *pdev)return ret; } +vchiq_debugfs_init (&mgmt->state); + bcm2835_audio =vchiq_device_register (&pdev->dev,"bcm2835-audio" ); bcm2835_camera =vchiq_device_register (&pdev->dev,"bcm2835-camera" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 264/499 staging: vchiq_arm: Fix possible NPR of keep-alive thread
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit 3db89bc6d973e2bcaa852f6409c98c228f39a926 ]
In case vchiq_platform_conn_state_changed() is never called or fails before driver removal, ka_thread won't be a valid pointer to a task_struct. So do the necessary checks before calling kthread_stop to avoid a crash.
--- drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +2 -1
@@ -1422,7 +1422,8 @@ static void vchiq_remove(struct platform_device *pdev)kthread_stop (mgmt->state.slot_handler_thread); arm_state =vchiq_platform_get_arm_state (&mgmt->state); -kthread_stop (arm_state->ka_thread); +if (!IS_ERR_OR_NULL (arm_state->ka_thread)) +kthread_stop (arm_state->ka_thread); }static struct platform_driver vchiq_driver = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 265/499 staging: vchiq_arm: Stop kthreads if vchiq cdev register fails
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit cfb320d990919836b49bd090c6c232c6c4d90b41 ]
In case the vchiq character device cannot be registered during probe, all kthreads needs to be stopped to avoid resource leaks.
--- .../interface/vchiq_arm/vchiq_arm.c | 25 ++++++++++++------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +16 -9
@@ -308,6 +308,20 @@ static struct vchiq_arm_state *vchiq_platform_get_arm_state(struct vchiq_state *return (struct vchiq_arm_state *)state->platform_state; } +static void +vchiq_platform_uninit (struct vchiq_drv_mgmt *mgmt) +{ +struct vchiq_arm_state *arm_state; + +kthread_stop (mgmt->state.sync_thread); +kthread_stop (mgmt->state.recycle_thread); +kthread_stop (mgmt->state.slot_handler_thread); + + arm_state =vchiq_platform_get_arm_state (&mgmt->state); +if (!IS_ERR_OR_NULL (arm_state->ka_thread)) +kthread_stop (arm_state->ka_thread); +} +void vchiq_dump_platform_state (struct seq_file *f) {seq_puts (f," Platform: 2835 (VC master)\n" );
@@ -1396,6 +1410,7 @@ static int vchiq_probe(struct platform_device *pdev) ret =vchiq_register_chrdev (&pdev->dev);if (ret) {dev_err (&pdev->dev,"arm: Failed to initialize vchiq cdev\n" ); +vchiq_platform_uninit (mgmt);return ret; }
@@ -1410,20 +1425,12 @@ static int vchiq_probe(struct platform_device *pdev)static void vchiq_remove (struct platform_device *pdev) {struct vchiq_drv_mgmt *mgmt =dev_get_drvdata (&pdev->dev); -struct vchiq_arm_state *arm_state;vchiq_device_unregister (bcm2835_audio);vchiq_device_unregister (bcm2835_camera);vchiq_debugfs_deinit ();vchiq_deregister_chrdev (); - -kthread_stop (mgmt->state.sync_thread); -kthread_stop (mgmt->state.recycle_thread); -kthread_stop (mgmt->state.slot_handler_thread); - - arm_state =vchiq_platform_get_arm_state (&mgmt->state); -if (!IS_ERR_OR_NULL (arm_state->ka_thread)) -kthread_stop (arm_state->ka_thread); +vchiq_platform_uninit (mgmt); }static struct platform_driver vchiq_driver = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 266/499 tty: n_tty: use uint for space returned by tty_write_room()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit d97aa066678bd1e2951ee93db9690835dfe57ab6 ]
tty_write_room() returns an "unsigned int". So in case some insane driver (like my tty test driver) returns (legitimate) UINT_MAX from its tty_operations::write_room(), n_tty is confused on several places.
For example, in process_output_block(), the result of tty_write_room() is stored into (signed) "int". So this UINT_MAX suddenly becomes -1. And that is extended to ssize_t and returned from process_output_block(). This causes a write() to such a node to receive -EPERM (which is -1).
Fix that by using proper "unsigned int" and proper "== 0" test. And return 0 constant directly in that "if", so that it is immediately clear what is returned ("space" equals to 0 at that point).
Similarly for process_output() and __process_echoes().
Note this does not fix any in-tree driver as of now.
If you want "Fixes: something", it would be commit 03b3b1a2405c ("tty:
make tty_operations::write_room return uint"). I intentionally do not mark this patch by a real tag below.
--- drivers/tty/n_tty.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/tty/n_tty.c +7 -6
@@ -486,7 +486,8 @@ static int do_output_char(u8 c, struct tty_struct *tty, int space)static int process_output (u8 c,struct tty_struct *tty) {struct n_tty_data *ldata = tty->disc_data; -int space, retval; +unsigned int space; +int retval;mutex_lock (&ldata->output_lock);
@@ -522,16 +523,16 @@ static ssize_t process_output_block(struct tty_struct *tty, const u8 *buf, unsigned int nr) {struct n_tty_data *ldata = tty->disc_data; -int space; -int i; +unsigned int space; +int i;const u8 *cp;mutex_lock (&ldata->output_lock); space =tty_write_room (tty); -if (space <=0 ) { +if (space ==0 ) {mutex_unlock (&ldata->output_lock); -return space; +return 0 ; }if (nr > space) nr = space;
@@ -696,7 +697,7 @@ static int n_tty_process_echo_ops(struct tty_struct *tty, size_t *tail,static size_t __process_echoes (struct tty_struct *tty) {struct n_tty_data *ldata = tty->disc_data; -int space, old_space; +unsigned int space, old_space;size_t tail;u8 c;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 267/499 perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilkka Koskinen <[email protected]>
[ Upstream commit 182f12f3193341c3400ae719a34c00a8a1204cff ]
frontend_bound metrics was miscalculated due to different scaling in a couple of metrics it depends on. Change the scaling to match with AmpereOne.
--- .../arch/arm64/ampere/ampereonex/metrics.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json +5 -5
@@ -229,19 +229,19 @@ }, { "MetricName": "slots_lost_misspeculation_fraction", - "MetricExpr": "(OP_SPEC - OP_RETIRED) / (CPU_CYCLES * #slots)", + "MetricExpr": "100 * (OP_SPEC - OP_RETIRED) / (CPU_CYCLES * #slots)", "BriefDescription": "Fraction of slots lost due to misspeculation", "DefaultMetricgroupName": "TopdownL1", "MetricGroup": "Default;TopdownL1", - "ScaleUnit": "100percent of slots" + "ScaleUnit": "1percent of slots" }, { "MetricName": "retired_fraction", - "MetricExpr": "OP_RETIRED / (CPU_CYCLES * #slots)", + "MetricExpr": "100 * OP_RETIRED / (CPU_CYCLES * #slots)", "BriefDescription": "Fraction of slots retiring, useful work", "DefaultMetricgroupName": "TopdownL1", "MetricGroup": "Default;TopdownL1", - "ScaleUnit": "100percent of slots" + "ScaleUnit": "1percent of slots" }, { "MetricName": "backend_core",
@@ -266,7 +266,7 @@ }, { "MetricName": "frontend_bandwidth", - "MetricExpr": "frontend_bound - frontend_latency", + "MetricExpr": "frontend_bound - 100 * frontend_latency", "BriefDescription": "Fraction of slots the CPU did not dispatch at full bandwidth - able to dispatch partial slots only (1, 2, or 3 uops)", "MetricGroup": "TopdownL2", "ScaleUnit": "1percent of slots"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 268/499 fs/procfs: fix the comment above proc_pid_wchan()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit 6287fbad1cd91f0c25cdc3a580499060828a8f30 ]
proc_pid_wchan() used to report kernel addresses to user space but that is no longer the case today. Bring the comment above proc_pid_wchan() in sync with the implementation.
--- fs/proc/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/proc/base.c +1 -1
@@ -416,7 +416,7 @@ static const struct file_operations proc_pid_cmdline_ops = {#ifdef CONFIG_KALLSYMS /* * Provides a wchan file via kallsyms in a proper one-value-per-file format. -* Returns the resolved symbol. If that fails, simply return the address. +* Returns the resolved symbol to user space. */ static int proc_pid_wchan (struct seq_file *m,struct pid_namespace *ns,struct pid *pid,struct task_struct *task)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 269/499 perf tools: Fix is_compat_mode build break in ppc64
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Likhitha Korrapati <[email protected]>
[ Upstream commit 7e442be7015af524d2b5fb84f0ff04a44501542b ]
Commit 54f9aa1092457 ("tools/perf/powerpc/util: Add support to handle compatible mode PVR for perf json events") introduced to select proper JSON events in case of compat mode using auxiliary vector. But this caused a compilation error in ppc64 Big Endian.
arch/powerpc/util/header.c: In function 'is_compat_mode':arch/powerpc/util/header.c:20:21: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
20 | if (!strcmp((char *)platform, (char *)base_platform))
| ^arch/powerpc/util/header.c:20:39: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
20 | if (!strcmp((char *)platform, (char *)base_platform))
|
Commit saved the getauxval(AT_BASE_PLATFORM) and getauxval(AT_PLATFORM) return values in u64 which causes the compilation error.
Patch fixes this issue by changing u64 to "unsigned long".
--- tools/perf/arch/powerpc/util/header.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/arch/powerpc/util/header.c +2 -2
@@ -14,8 +14,8 @@static bool is_compat_mode (void ) { -u64 base_platform =getauxval (AT_BASE_PLATFORM ); -u64 platform =getauxval (AT_PLATFORM ); +unsigned long base_platform =getauxval (AT_BASE_PLATFORM ); +unsigned long platform =getauxval (AT_PLATFORM );if (!strcmp ((char *)platform, (char *)base_platform))return false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 270/499 perf tools: annotate asm_pure_loop.S
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcus Meissner <[email protected]>
[ Upstream commit 9a352a90e88a041f4b26d359493e12a7f5ae1a6a ]
Annotate so it is built with non-executable stack.
--- tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S +2 -0
@@ -26,3 +26,5 @@ skip: mov x0, #0 mov x8, #93 // __NR_exit syscall svc #0 + +.section .note.GNU-stack, "", @progbits
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 271/499 perf bpf-filter: Fix a parsing error with comma
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 35d13f841a3d8159ef20d5e32a9ed3faa27875bc ]
The previous change to support cgroup filters introduced a bug that pathname can include commas. It confused the lexer to treat an item and the trailing comma as a single token. And it resulted in a parse error:
$ sudo perf record -e cycles:P --filter 'period > 0, ip > 64' -- true perf_bpf_filter: Error: Unexpected item: 0, perf_bpf_filter: syntax error, unexpected BFT_ERROR, expecting BFT_NUM
Usage: perf record [<options>] [<command>]
or: perf record [<options>] -- <command> [<options>]
--filter <filter>
event filter
It should get "0" and "," separately.
An easiest fix would be to remove "," from the possible pathname characters. As it's for cgroup names, probably ok to assume it won't have commas in the pathname.
I found that the existing BPF filtering test didn't have any complex filter condition with commas. Let's update the group filter test which is supposed to test filter combinations like this.
--- tools/perf/tests/shell/record_bpf_filter.sh | 4 ++-- tools/perf/util/bpf-filter.l | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
tools/perf/tests/shell/record_bpf_filter.sh +2 -2
@@ -89,7 +89,7 @@ test_bpf_filter_fail() { test_bpf_filter_group() { echo "Group bpf-filter test" - if ! perf record -e task-clock --filter 'period > 1000 || ip > 0' \ + if ! perf record -e task-clock --filter 'period > 1000, ip > 0' \ -o /dev/null true 2>/dev/null then echo "Group bpf-filter test [Failed should succeed]"
@@ -97,7 +97,7 @@ test_bpf_filter_group() { return fi - if ! perf record -e task-clock --filter 'cpu > 0 || ip > 0' \ + if ! perf record -e task-clock --filter 'period > 1000 , cpu > 0 || ip > 0' \ -o /dev/null true 2>&1 | grep -q PERF_SAMPLE_CPU then echo "Group bpf-filter test [Failed forbidden CPU]"
tools/perf/util/bpf-filter.l +1 -1
@@ -76,7 +76,7 @@ static int path_or_error(void) num_dec [0-9]+ num_hex 0[Xx][0-9a-fA-F]+ space [ \t]+ -path [^ \t\n]+ +path [^ \t\n,]+ ident [_a-zA-Z][_a-zA-Z0-9]+ %%
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 272/499 thermal: core: Remove duplicate struct declaration
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: xueqin Luo <[email protected]>
[ Upstream commit 9e6ec8cf64e2973f0ec74f09023988cabd218426 ]
The struct thermal_zone_device is already declared on line 32, so the duplicate declaration has been removed.
--- include/linux/thermal.h | 2 -- 1 file changed, 2 deletions(-)
include/linux/thermal.h +0 -2
@@ -86,8 +86,6 @@ struct thermal_trip {#define THERMAL_TRIP_PRIV_TO_INT (_val_) (uintptr_t)(_val_)#define THERMAL_INT_TO_TRIP_PRIV (_val_) (void *)(uintptr_t)(_val_) -struct thermal_zone_device ; -struct cooling_spec {unsigned long upper;/* Highest cooling state */ unsigned long lower;/* Lowest cooling state */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 273/499 objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 107a23185d990e3df6638d9a84c835f963fe30a6 ]
The csts_state_names[] array only has six sparse entries, but the iteration code in nvmet_ctrl_state_show() iterates seven, resulting in a potential out-of-bounds stack read. Fix that.
Fixes the following warning with an UBSAN kernel:
vmlinux.o: warning: objtool: .text.nvmet_ctrl_state_show: unexpected end of section
--- drivers/nvme/target/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/target/debugfs.c +1 -1
@@ -78,7 +78,7 @@ static int nvmet_ctrl_state_show(struct seq_file *m, void *p)bool sep = false;int i; -for (i =0 ; i <7 ; i++) { +for (i =0 ; i <ARRAY_SIZE (csts_state_names); i++) {int state =BIT (i);if (!(ctrl->csts & state))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 274/499 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit e63d465f59011dede0a0f1d21718b59a64c3ff5c ]
If dib8000_set_dds()'s call to dib8000_read32() returns zero, the result is a divide-by-zero. Prevent that from happening.
Fixes the following warning with an UBSAN kernel:
drivers/media/dvb-frontends/dib8000.o: warning: objtool: dib8000_tune() falls through to next function dib8096p_cfg_DibRx()
--- drivers/media/dvb-frontends/dib8000.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/dib8000.c +4 -1
@@ -2701,8 +2701,11 @@ static void dib8000_set_dds(struct dib8000_state *state, s32 offset_khz)u8 ratio;if (state->revision ==0x8090 ) { +u32 internal =dib8000_read32 (state,23 ) /1000 ; + ratio =4 ; - unit_khz_dds_val = (1 <<26 ) / (dib8000_read32 (state,23 ) /1000 ); + + unit_khz_dds_val = (1 <<26 ) / (internal ?:1 );if (offset_khz <0 ) dds = (1 <<26 ) - (abs_offset_khz * unit_khz_dds_val);else
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 275/499 NFS: Shut down the nfs_client only after all the superblocks
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 2d3e998a0bc7fe26a724f87a8ce217848040520e ]
The nfs_client manages state for all the superblocks in the "cl_superblocks" list, so it must not be shut down until all of them are gone.
--- fs/nfs/sysfs.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
fs/nfs/sysfs.c +21 -1
@@ -14,6 +14,7 @@#include <linux/rcupdate.h> #include <linux/lockd/lockd.h> +#include "internal.h" #include "nfs4_fs.h" #include "netns.h" #include "sysfs.h"
@@ -228,6 +229,25 @@ static void shutdown_client(struct rpc_clnt *clnt)rpc_cancel_tasks (clnt, -EIO , shutdown_match_client,NULL ); } +/* +* Shut down the nfs_client only once all the superblocks +* have been shut down. +*/ +static void shutdown_nfs_client (struct nfs_client *clp) +{ +struct nfs_server *server; +rcu_read_lock (); +list_for_each_entry_rcu (server, &clp->cl_superblocks, client_link) { +if (!(server->flags &NFS_MOUNT_SHUTDOWN )) { +rcu_read_unlock (); +return ; + } + } +rcu_read_unlock (); +nfs_mark_client_ready (clp, -EIO ); +shutdown_client (clp->cl_rpcclient); +} +static ssize_t shutdown_show (struct kobject *kobj,struct kobj_attribute *attr,char *buf)
@@ -259,7 +279,6 @@ shutdown_store(struct kobject *kobj, struct kobj_attribute *attr, server->flags |=NFS_MOUNT_SHUTDOWN ;shutdown_client (server->client); -shutdown_client (server->nfs_client->cl_rpcclient);if (!IS_ERR (server->client_acl))shutdown_client (server->client_acl);
@@ -267,6 +286,7 @@ shutdown_store(struct kobject *kobj, struct kobj_attribute *attr,if (server->nlm_host)shutdown_client (server->nlm_host->h_rpcclnt); out: +shutdown_nfs_client (server->nfs_client);return count; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 276/499 smb: client: Fix netns refcount imbalance causing leaks and use-after-free
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Zhaolong <[email protected]>
[ Upstream commit 4e7f1644f2ac6d01dc584f6301c3b1d5aac4eaef ]
Commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") attempted to fix a netns use-after-free issue by manually adjusting reference counts via sk->sk_net_refcnt and sock_inuse_add().
However, a later commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod") pointed out that the approach of manually setting sk->sk_net_refcnt in the first commit was technically incorrect, as sk->sk_net_refcnt should only be set for user sockets. It led to issues like TCP timers not being cleared properly on close. The second commit moved to a model of just holding an extra netns reference for server->ssocket using get_net(), and dropping it when the server is torn down.
But there remain some gaps in the get_net()/put_net() balancing added by these commits. The incomplete reference handling in these fixes results in two issues:
1. Netns refcount leaks[1]
The problem process is as follows:
```
mount.cifs cifsd
cifs_do_mount
cifs_mount
cifs_mount_get_session
cifs_get_tcp_session
get_net() /* First get net. */
ip_connect
generic_ip_connect /* Try port 445 */
get_net()
->connect() /* Failed */
put_net()
generic_ip_connect /* Try port 139 */
get_net() /* Missing matching put_net() for this get_net().*/
cifs_get_smb_ses
cifs_negotiate_protocol
smb2_negotiate
SMB2_negotiate
cifs_send_recv
wait_for_response
cifs_demultiplex_thread
cifs_read_from_socket
cifs_readv_from_socket
cifs_reconnect
cifs_abort_connection
sock_release();
server->ssocket = NULL;
/* Missing put_net() here. */
generic_ip_connect
get_net()
->connect() /* Failed */
put_net()
sock_release();
server->ssocket = NULL;
free_rsp_buf
...
clean_demultiplex_info
/* It's only called once here. */
put_net()
```When cifs_reconnect() is triggered, the server->ssocket is released without a corresponding put_net() for the reference acquired in generic_ip_connect() before. it ends up calling generic_ip_connect() again to retry get_net(). After that, server->ssocket is set to NULL in the error path of generic_ip_connect(), and the net count cannot be released in the final clean_demultiplex_info() function.
2. Potential use-after-free
The current refcounting scheme can lead to a potential use-after-free issue in the following scenario:
```
cifs_do_mount
cifs_mount
cifs_mount_get_session
cifs_get_tcp_session
get_net() /* First get net */
ip_connect
generic_ip_connect
get_net()
bind_socket
kernel_bind /* failed */
put_net()
/* after out_err_crypto_release label */
put_net()
/* after out_err label */
put_net()
```In the exception handling process where binding the socket fails, the get_net() and put_net() calls are unbalanced, which may cause the server->net reference count to drop to zero and be prematurely released.
To address both issues, this patch ties the netns reference counting to the server->ssocket and server lifecycles. The extra reference is now acquired when the server or socket is created, and released when the socket is destroyed or the server is torn down.
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=219792
--- fs/smb/client/connect.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
fs/smb/client/connect.c +8 -8
@@ -316,6 +316,7 @@ cifs_abort_connection(struct TCP_Server_Info *server) server->ssocket->flags);sock_release (server->ssocket); server->ssocket =NULL ; +put_net (cifs_net_ns (server)); } server->sequence_number =0 ; server->session_estab = false;
@@ -3158,8 +3159,12 @@ generic_ip_connect(struct TCP_Server_Info *server)/* * Grab netns reference for the socket. * -* It'll be released here, on error, or in clean_demultiplex_info() upon server -* teardown. +* This reference will be released in several situations: +* - In the failure path before the cifsd thread is started. +* - In the all place where server->socket is released, it is +* also set to NULL. +* - Ultimately in clean_demultiplex_info(), during the final +* teardown. */ get_net (net);
@@ -3175,10 +3180,8 @@ generic_ip_connect(struct TCP_Server_Info *server) } rc =bind_socket (server); -if (rc <0 ) { -put_net (cifs_net_ns (server)); +if (rc <0 )return rc; - }/* * Eventually check for other socket options to change from
@@ -3224,9 +3227,6 @@ generic_ip_connect(struct TCP_Server_Info *server)if (sport ==htons (RFC1001_PORT )) rc =ip_rfc1001_connect (server); -if (rc <0 ) -put_net (cifs_net_ns (server)); -return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 277/499 exfat: fix the infinite loop in exfat_find_last_cluster()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit b0522303f67255926b946aa66885a0104d1b2980 ]
In exfat_find_last_cluster(), the cluster chain is traversed until the EOF cluster. If the cluster chain includes a loop due to file system corruption, the EOF cluster cannot be traversed, resulting in an infinite loop.
If the number of clusters indicated by the file size is inconsistent with the cluster chain length, exfat_find_last_cluster() will return an error, so if this inconsistency is found, the traversal can be aborted without traversing to the EOF cluster.
--- fs/exfat/fatent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/exfat/fatent.c +1 -1
@@ -265,7 +265,7 @@ int exfat_find_last_cluster(struct super_block *sb, struct exfat_chain *p_chain, clu = next;if (exfat_ent_get (sb, clu, &next))return -EIO ; - }while (next !=EXFAT_EOF_CLUSTER ); + }while (next !=EXFAT_EOF_CLUSTER && count <= p_chain->size);if (p_chain->size != count) { exfat_fs_error(sb,
Signature · 1 line
2.39.5