6.14.4-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.14.4-rc1 review
This is the start of the stable review cycle for the 6.14.4 release. There are 241 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 25 Apr 2025 14:25:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.14.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.14.4-rc1
P Praneesh <[email protected]>
wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
WangYuli <[email protected]>
MIPS: ds1287: Match ds1287_set_base_clock() function types
WangYuli <[email protected]>
MIPS: cevt-ds1287: Add missing ds1287.h include
WangYuli <[email protected]>
MIPS: dec: Declare which_prom() as static
Alexander Tsoy <[email protected]>
Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process"
Lorenzo Stoakes <[email protected]>
mm/vma: add give_up_on_oom option on modify/merge, use in uffd release
WangYuli <[email protected]>
nvmet-fc: Remove unused functions
Aurabindo Pillai <[email protected]>
drm/amd/display: Temporarily disable hostvm on DCN31
Armin Wolf <[email protected]>
platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug
Armin Wolf <[email protected]>
platform/x86: msi-wmi-platform: Rename "data" variable
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Extend support to more laptops
Kurt Borja <[email protected]>
platform/x86: alienware-wmi-wmax: Add G-Mode support to Alienware m16 R1
Lukas Fischer <[email protected]>
scripts: generate_rust_analyzer: Add ffi crate
Rafael J. Wysocki <[email protected]>
cpufreq: Reference count policy in cpufreq_update_limits()
Anshuman Khandual <[email protected]>
arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9
Anshuman Khandual <[email protected]>
arm64/sysreg: Add register fields for HFGWTR2_EL2
Anshuman Khandual <[email protected]>
arm64/sysreg: Add register fields for HFGRTR2_EL2
Anshuman Khandual <[email protected]>
arm64/sysreg: Add register fields for HFGITR2_EL2
Anshuman Khandual <[email protected]>
arm64/sysreg: Add register fields for HDFGWTR2_EL2
Anshuman Khandual <[email protected]>
arm64/sysreg: Add register fields for HDFGRTR2_EL2
Anshuman Khandual <[email protected]>
arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1
Pavel Begunkov <[email protected]>
io_uring: don't post tag CQEs on file/buffer registration failure
Thomas Zimmermann <[email protected]>
drm/mgag200: Fix value in <VBLKSTR> register
ZhenGuo Yin <[email protected]>
drm/amdgpu: fix warning of drm_mm_clean
Alex Deucher <[email protected]>
drm/amd/display/dml2: use vzalloc rather than kzalloc
Ankit Nautiyal <[email protected]>
drm/i915/dp: Check for HAS_DSC_3ENGINES while configuring DSC slices
Ankit Nautiyal <[email protected]>
drm/i915/display: Add macro for checking 3 DSC engines
Lucas De Marchi <[email protected]>
drm/xe: Set LRC addresses before guc load
Matthew Auld <[email protected]>
drm/xe/userptr: fix notifier vs folio deadlock
Matthew Auld <[email protected]>
drm/xe/dma_buf: stop relying on placement in unmap
Mario Limonciello <[email protected]>
drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1
Huacai Chen <[email protected]>
drm/amd/display: Protect FPU in dml2_init()/dml21_init()
Tom Chung <[email protected]>
drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes()
Christian König <[email protected]>
drm/amdgpu: immediately use GTT for new allocations
Ville Syrjälä <[email protected]>
drm/i915/dp: Reject HBR3 when sink doesn't support TPS4
Vivek Kasireddy <[email protected]>
drm/i915/xe2hpd: Identify the memory type for SKUs with GDDR + ECC
Jani Nikula <[email protected]>
drm/i915/gvt: fix unterminated-string-initialization warning
Matt Roper <[email protected]>
drm/xe/bmg: Add one additional PCI ID
Thomas Hellström <[email protected]>
drm/xe: Fix an out-of-bounds shift when invalidating TLB
Ville Syrjälä <[email protected]>
drm/i915: Fix scanline_offset for LNL+ and BMG+
Rolf Eike Beer <[email protected]>
drm/sti: remove duplicate object names
Dmitry Osipenko <[email protected]>
drm/virtio: Fix missed dmabuf unpinning in error path of prepare_fb()
Brendan King <[email protected]>
drm/imagination: take paired job reference
Brendan King <[email protected]>
drm/imagination: fix firmware memory leaks
Chris Bainbridge <[email protected]>
drm/nouveau: prime: fix ttm_bo_delayed_delete oops
Matthew Auld <[email protected]>
drm/amdgpu/dma_buf: fix page_link check
Alex Deucher <[email protected]>
drm/amdgpu/mes11: optimize MES pipe FW version fetching
Huacai Chen <[email protected]>
drm/amd/display: Protect FPU in dml21_copy()
Huacai Chen <[email protected]>
drm/amd/display: Protect FPU in dml2_validate()/dml21_validate()
Mario Limonciello <[email protected]>
drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1
Dmitry Osipenko <[email protected]>
drm/virtio: Don't attach GEM to a non-created context in gem_object_open()
Matthew Brost <[email protected]>
drm/xe: Use local fence in error path of xe_migrate_clear
Ankit Nautiyal <[email protected]>
drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed
Alex Deucher <[email protected]>
drm/amdgpu/mes12: optimize MES pipe FW version fetching
Denis Arefev <[email protected]>
drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
Denis Arefev <[email protected]>
drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
Denis Arefev <[email protected]>
drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
Denis Arefev <[email protected]>
drm/amd/pm/smu11: Prevent division by zero
Tomasz Pakuła <[email protected]>
drm/amd/pm: Add zero RPM enabled OD setting support for SMU14.0.2
Denis Arefev <[email protected]>
drm/amd/pm/powerplay: Prevent division by zero
Denis Arefev <[email protected]>
drm/amd/pm: Prevent division by zero
Leo Li <[email protected]>
drm/amd/display: Increase vblank offdelay for PSR panels
Leo Li <[email protected]>
drm/amd/display: Actually do immediate vblank disable
Mario Limonciello <[email protected]>
drm/amd: Handle being compiled without SI or CIK support better
Brendan Tam <[email protected]>
drm/amd/display: prevent hang on link training fail
Lijo Lazar <[email protected]>
drm/amdgpu: Prefer shadow rom when available
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix stale rpmh votes from GPU
Haoxiang Li <[email protected]>
drm/msm/dsi: Add check for devm_kstrdup()
Jocelyn Falempe <[email protected]>
drm/ast: Fix ast_dp connection status
Nikita Zhandarovich <[email protected]>
drm/repaper: fix integer overflows in repeat functions
Kan Liang <[email protected]>
perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR
Kan Liang <[email protected]>
perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX
Kan Liang <[email protected]>
perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
Dapeng Mi <[email protected]>
perf/x86/intel: Allow to update user space GPRs from PEBS records
Mario Limonciello <[email protected]>
platform/x86: amd: pmf: Fix STT limits
Yazen Ghannam <[email protected]>
RAS/AMD/FMPM: Get masked address
Yazen Ghannam <[email protected]>
RAS/AMD/ATL: Include row[13] bit in row retirement
Sharath Srinivasan <[email protected]>
RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
Peter Griffin <[email protected]>
scsi: ufs: exynos: Ensure consistent phy reference counts
Peter Griffin <[email protected]>
scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
Peter Griffin <[email protected]>
scsi: ufs: exynos: Move UFS shareability value to drvdata
Chandrakanth Patil <[email protected]>
scsi: megaraid_sas: Block zero-length ATA VPD inquiry
Ard Biesheuvel <[email protected]>
x86/boot/sev: Avoid shared GHCB page for early memory acceptance
Sandipan Das <[email protected]>
x86/cpu/amd: Fix workaround for erratum 1054
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches
Xiangsheng Hou <[email protected]>
virtiofs: add filesystem context source name check
Steven Rostedt <[email protected]>
tracing: Fix filter string testing
Peter Collingbourne <[email protected]>
string: Add load_unaligned_zeropad() code path to sized_strscpy()
Chunjie Zhu <[email protected]>
smb3 client: fix open hardlink on deferred close file error
Suren Baghdasaryan <[email protected]>
slab: ensure slab->obj_exts is clear in a newly allocated slab page
Mark Brown <[email protected]>
selftests/mm: generate a temporary mountpoint for cgroup filesystem
Nathan Chancellor <[email protected]>
riscv: Avoid fortify warning in syscall_get_arguments()
Kuniyuki Iwashima <[email protected]>
Revert "smb: client: fix TCP timers deadlock after rmmod"
Kuniyuki Iwashima <[email protected]>
Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
Namjae Jeon <[email protected]>
ksmbd: fix the warning from __kernel_write_iter
Denis Arefev <[email protected]>
ksmbd: Prevent integer overflow in calculation of deadtime
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in smb_break_all_levII_oplock()
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __smb2_lease_break_noti()
Sean Heelan <[email protected]>
ksmbd: Fix dangling pointer in krb_authenticate
Miklos Szeredi <[email protected]>
ovl: don't allow datadir only
Kirill A. Shutemov <[email protected]>
mm: fix apply_to_existing_page_range()
Vishal Moola (Oracle) <[email protected]>
mm: fix filemap_get_folios_contig returning batches of identical folios
Baoquan He <[email protected]>
mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()
Vishal Moola (Oracle) <[email protected]>
mm/compaction: fix bug in hugetlb handling pathway
Thomas Weißschuh <[email protected]>
loop: LOOP_SET_FD: send uevents for partitions
Thomas Weißschuh <[email protected]>
loop: properly send KOBJ_CHANGED uevent for disk device
Sheng Yong <[email protected]>
lib/iov_iter: fix to increase non slab folio refcount
Edward Adam Davis <[email protected]>
isofs: Prevent the use of too small fid
Thadeu Lima de Souza Cascardo <[email protected]>
i2c: cros-ec-tunnel: defer probe if parent EC is not present
Vasiliy Kovalev <[email protected]>
hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
Herbert Xu <[email protected]>
crypto: caam/qi - Fix drv_ctx refcount bug
Rafael J. Wysocki <[email protected]>
cpufreq: Avoid using inconsistent policy->min and policy->max
Rafael J. Wysocki <[email protected]>
cpufreq/sched: Explicitly synchronize limits_changed flag handling
Johannes Kimmel <[email protected]>
btrfs: correctly escape subvol in btrfs_show_options()
Sidong Yang <[email protected]>
btrfs: ioctl: don't free iov when btrfs_encoded_read() returns -EAGAIN
Kees Cook <[email protected]>
Bluetooth: vhci: Avoid needless snprintf() calls
Frédéric Danis <[email protected]>
Bluetooth: l2cap: Process valid commands in too long frame
Rob Clark <[email protected]>
drm/msm/a6xx+: Don't let IB_SIZE overflow
Menglong Dong <[email protected]>
ftrace: fix incorrect hash size in register_ftrace_direct()
Christoph Hellwig <[email protected]>
fs: move the bdex_statx call to vfs_getattr_nosec
Joe Damato <[email protected]>
eventpoll: Set epoll timeout if it's in the future
Jens Axboe <[email protected]>
eventpoll: abstract out ep_try_send_events() helper
Andy Shevchenko <[email protected]>
i2c: atr: Fix wrong include
Li Lingfeng <[email protected]>
nfsd: decrease sc_count directly if fail to queue dl_recall
Eric Biggers <[email protected]>
nfs: add missing selections of CONFIG_CRC32
Dan Carpenter <[email protected]>
dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline()
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: drop rogue intr_tear_rd_ptr values
Chenyuan Yang <[email protected]>
drm/msm/dpu: Fix error pointers in dpu_plane_virtual_atomic_check
Maíra Canal <[email protected]>
drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later
Martin K. Petersen <[email protected]>
block: integrity: Do not call set_page_dirty_lock()
Denis Arefev <[email protected]>
asus-laptop: Fix an uninitialized variable
T.J. Mercier <[email protected]>
alloc_tag: handle incomplete bulk allocations in vm_module_tags_populate
Andrzej Kacprowski <[email protected]>
accel/ivpu: Fix the NPU's DPU frequency calculation
Evgeny Pimenov <[email protected]>
ASoC: qcom: Fix sc7280 lpass potential buffer overflow
Peter Ujfalusi <[email protected]>
ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16
Srinivas Kandagatla <[email protected]>
ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
Srinivas Kandagatla <[email protected]>
ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
Herve Codina <[email protected]>
ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event
Alex Williamson <[email protected]>
Revert "PCI: Avoid reset when disabled via sysfs"
Andreas Gruenbacher <[email protected]>
writeback: fix false warning in inode_to_wb()
Miguel Ojeda <[email protected]>
rust: kbuild: use pound to support GNU Make < 4.3
Sami Tolvanen <[email protected]>
rust: kbuild: Don't export __pfx symbols
Miguel Ojeda <[email protected]>
rust: disable clippy::needless_continue
Miguel Ojeda <[email protected]>
rust: kasan/kbuild: fix missing flags on first build
FUJITA Tomonori <[email protected]>
rust: helpers: Remove volatile qualifier from io helpers
Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function for Rust 1.86.0
Rafael J. Wysocki <[email protected]>
cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
WangYuli <[email protected]>
riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
WangYuli <[email protected]>
riscv: KGDB: Do not inline arch_kgdb_breakpoint()
Srinivas Pandruvada <[email protected]>
thermal: intel: int340x: Fix Panther Lake DLVR support
Thomas Weißschuh <[email protected]>
kunit: qemu_configs: SH: Respect kunit cmdline
Samuel Holland <[email protected]>
riscv: module: Allocate PLT entries for R_RISCV_PLT32
Samuel Holland <[email protected]>
riscv: module: Fix out-of-bounds relocation access
Björn Töpel <[email protected]>
riscv: Properly export reserved regions in /proc/iomem
Will Pierce <[email protected]>
riscv: Use kvmalloc_array on relocation_hashtable
Bo-Cun Chen <[email protected]>
net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings
Bo-Cun Chen <[email protected]>
net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps
Bo-Cun Chen <[email protected]>
net: ethernet: mtk_eth_soc: reapply mdc divider on reset
Meghana Malladi <[email protected]>
net: ti: icss-iep: Fix possible NULL pointer dereference for perout request
Meghana Malladi <[email protected]>
net: ti: icss-iep: Add phase offset configuration for perout signal
Meghana Malladi <[email protected]>
net: ti: icss-iep: Add pwidth configuration for perout signal
Florian Westphal <[email protected]>
netfilter: conntrack: fix erronous removal of offload bit
Sagi Maimon <[email protected]>
ptp: ocp: fix start time alignment in ptp_ocp_signal_set
Vladimir Oltean <[email protected]>
net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails
Vladimir Oltean <[email protected]>
net: dsa: free routing table on probe failure
Vladimir Oltean <[email protected]>
net: dsa: clean up FDB, MDB, VLAN entries on unbind
Vladimir Oltean <[email protected]>
net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported
Vladimir Oltean <[email protected]>
net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
Abdun Nihaal <[email protected]>
net: txgbe: fix memory leak in txgbe_probe() error path
Jonas Gorski <[email protected]>
net: bridge: switchdev: do not notify new brentries as changed
Jonas Gorski <[email protected]>
net: b53: enable BPDU reception for management port
Jakub Kicinski <[email protected]>
netlink: specs: rt-neigh: prefix struct nfmsg members with ndm
Jakub Kicinski <[email protected]>
netlink: specs: rt-link: adjust mctp attribute naming
Jakub Kicinski <[email protected]>
netlink: specs: rtnetlink: attribute naming corrections
Jakub Kicinski <[email protected]>
netlink: specs: rt-link: add an attr layer around alt-ifname
Jakub Kicinski <[email protected]>
tools: ynl-gen: make sure we validate subtype of array-nest
Jakub Kicinski <[email protected]>
tools: ynl-gen: individually free previous values on double set
Abdun Nihaal <[email protected]>
cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
Niklas Cassel <[email protected]>
ata: libata-sata: Save all fields from sense data descriptor
Damien Le Moal <[email protected]>
nvmet: pci-epf: clear CC and CSTS when disabling the controller
Damien Le Moal <[email protected]>
nvmet: pci-epf: always fully initialize completion entries
Christoph Hellwig <[email protected]>
loop: stop using vfs_iter_{read,write} for buffered I/O
Yunlong Xing <[email protected]>
loop: aio inherit the ioprio of original request
Jakub Kicinski <[email protected]>
eth: bnxt: fix missing ring index trim on error path
Michael Walle <[email protected]>
net: ethernet: ti: am65-cpsw: fix port_np reference counting
Chenyuan Yang <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors
Abdun Nihaal <[email protected]>
net: ngbe: fix memory leak in ngbe_probe() error path
Weizhao Ouyang <[email protected]>
can: rockchip_canfd: fix broken quirks checks
Ilya Maximets <[email protected]>
net: openvswitch: fix nested key length validation in the set() action
Jakub Kicinski <[email protected]>
netlink: specs: ovs_vport: align with C codegen capabilities
Zheng Qixing <[email protected]>
block: fix resource leak in blk_register_queue() error path
Jijie Shao <[email protected]>
net: hibmcge: fix not restore rx pause mac addr after reset issue
Jijie Shao <[email protected]>
net: hibmcge: fix wrong mtu log issue
Jijie Shao <[email protected]>
net: hibmcge: fix incorrect multicast filtering issue
Jijie Shao <[email protected]>
net: hibmcge: fix incorrect pause frame statistics issue
Matt Johnston <[email protected]>
net: mctp: Set SOCK_RCU_FREE
Damodharam Ammepalli <[email protected]>
ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
Abdun Nihaal <[email protected]>
pds_core: fix memory leak in pdsc_debugfs_add_qcq()
Baolin Wang <[email protected]>
selftests: mincore: fix tmpfs mincore test failure
Matthew Wilcox (Oracle) <[email protected]>
test suite: use %zu to print size_t
Kuniyuki Iwashima <[email protected]>
smc: Fix lockdep false-positive for IPPROTO_SMC.
Geert Uytterhoeven <[email protected]>
dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry
Namhyung Kim <[email protected]>
perf tools: Remove evsel__handle_error_quirks()
Christopher S M Hall <[email protected]>
igc: add lock preventing multiple simultaneous PTM transactions
Christopher S M Hall <[email protected]>
igc: cleanup PTP module if probe fails
Christopher S M Hall <[email protected]>
igc: handle the IGC_PTP_ENABLED flag correctly
Christopher S M Hall <[email protected]>
igc: move ktime snapshot into PTM retry loop
Christopher S M Hall <[email protected]>
igc: increase wait time before retrying PTM
Christopher S M Hall <[email protected]>
igc: fix PTM cycle trigger logic
Johannes Berg <[email protected]>
Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
Johannes Berg <[email protected]>
wifi: iwlwifi: pcie: set state to no-FW before reset handshake
David Thompson <[email protected]>
mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show()
Juergen Gross <[email protected]>
xen: fix multicall debug feature
Xin Long <[email protected]>
ipv6: add exception routes to GC list in rt6_insert_exception
Leon Romanovsky <[email protected]>
RDMA/bnxt_re: Remove unusable nq variable
Frédéric Danis <[email protected]>
Bluetooth: l2cap: Check encryption key size on incoming connection
Dmitry Baryshkov <[email protected]>
Bluetooth: qca: fix NV variant for one of WCN3950 SoCs
Dan Carpenter <[email protected]>
Bluetooth: btrtl: Prevent potential NULL dereference
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
Richard Fitzgerald <[email protected]>
firmware: cs_dsp: test_bin_error: Fix uninitialized data used as fw version
Shay Drory <[email protected]>
RDMA/core: Silence oversized kvmalloc() warning
Charles Keepax <[email protected]>
ASoC: cs42l43: Reset clamp override on jack removal
Kailang Yang <[email protected]>
ALSA: hda/realtek - Fixed ASUS platform headset Mic issue
Richard Fitzgerald <[email protected]>
ALSA: hda/cirrus_scodec_test: Don't select dependencies
Chengchang Tang <[email protected]>
RDMA/hns: Fix wrong maximum DMA segment size
Yue Haibing <[email protected]>
RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Fix budget handling of notification queue
Giuseppe Scrivano <[email protected]>
ovl: remove unused forward declaration
Akhil R <[email protected]>
crypto: tegra - Fix IV usage for AES ECB
Henry Martin <[email protected]>
ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
Brady Norander <[email protected]>
ASoC: dwc: always enable/disable i2s irqs
Zheng Qixing <[email protected]>
md/md-bitmap: fix stats collection for external bitmaps
Yu Kuai <[email protected]>
md/raid10: fix missing discard IO accounting
Martin Wilck <[email protected]>
scsi: smartpqi: Use is_kdump_kernel() to check for kdump
Miaoqian Lin <[email protected]>
scsi: iscsi: Fix missing scsi_host_put() in error path
Abdun Nihaal <[email protected]>
wifi: wl1251: fix memory leak in wl1251_tx_work
Abdun Nihaal <[email protected]>
wifi: brcmfmac: fix memory leak in brcmf_get_module_param
Remi Pommarel <[email protected]>
wifi: mac80211: Purge vif txq in ieee80211_do_stop()
Remi Pommarel <[email protected]>
wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
Abdun Nihaal <[email protected]>
wifi: at76c50x: fix use after free access in at76_disconnect
Xingui Yang <[email protected]>
scsi: hisi_sas: Enable force phy when SATA disk directly connected
-------------
Diffstat:
Documentation/arch/arm64/booting.rst | 22 +++ .../bindings/soc/fsl/fsl,ls1028a-reset.yaml | 2 +- Documentation/netlink/specs/ovs_vport.yaml | 4 +- Documentation/netlink/specs/rt_link.yaml | 20 ++- Documentation/netlink/specs/rt_neigh.yaml | 14 +- Documentation/wmi/devices/msi-wmi-platform.rst | 4 + Makefile | 5 +- arch/arm64/include/asm/el2_setup.h | 25 ++++ arch/arm64/tools/sysreg | 103 ++++++++++++++ arch/mips/dec/prom/init.c | 2 +- arch/mips/include/asm/ds1287.h | 2 +- arch/mips/kernel/cevt-ds1287.c | 1 + arch/riscv/include/asm/kgdb.h | 9 +- arch/riscv/include/asm/syscall.h | 7 +- arch/riscv/kernel/kgdb.c | 6 + arch/riscv/kernel/module-sections.c | 13 +- arch/riscv/kernel/module.c | 11 +- arch/riscv/kernel/setup.c | 36 ++++- arch/x86/boot/compressed/mem.c | 5 +- arch/x86/boot/compressed/sev.c | 67 +++------ arch/x86/boot/compressed/sev.h | 2 + arch/x86/events/intel/ds.c | 8 +- arch/x86/events/intel/uncore_snbep.c | 107 ++------------- arch/x86/kernel/cpu/amd.c | 19 ++- arch/x86/kernel/cpu/microcode/amd.c | 9 +- arch/x86/xen/multicalls.c | 26 ++-- arch/x86/xen/smp_pv.c | 1 - arch/x86/xen/xen-ops.h | 3 - block/bdev.c | 3 +- block/bio-integrity.c | 17 +-- block/blk-sysfs.c | 2 + drivers/accel/ivpu/ivpu_drv.c | 4 +- drivers/accel/ivpu/ivpu_fw.c | 3 +- drivers/accel/ivpu/ivpu_hw.h | 11 +- drivers/accel/ivpu/ivpu_hw_btrs.c | 126 ++++++++--------- drivers/accel/ivpu/ivpu_hw_btrs.h | 6 +- drivers/ata/libata-sata.c | 15 +++ drivers/block/loop.c | 121 +++-------------- drivers/bluetooth/btqca.c | 2 +- drivers/bluetooth/btrtl.c | 2 + drivers/bluetooth/hci_vhci.c | 10 +- drivers/cpufreq/cpufreq.c | 40 +++++- drivers/crypto/caam/qi.c | 6 +- drivers/crypto/tegra/tegra-se-aes.c | 5 +- drivers/dma-buf/sw_sync.c | 19 ++- .../firmware/cirrus/test/cs_dsp_mock_mem_maps.c | 30 ----- drivers/firmware/cirrus/test/cs_dsp_test_bin.c | 2 +- .../firmware/cirrus/test/cs_dsp_test_bin_error.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 34 ++++- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 44 +++--- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 4 +- drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 4 + drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 21 +-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 62 ++++++++- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 6 +- .../drm/amd/display/dc/dml2/dml21/dml21_wrapper.c | 28 +++- drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 15 ++- .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 7 +- .../amd/display/dc/resource/dcn31/dcn31_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c | 4 +- .../drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 4 +- .../drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 3 + drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 55 +++++++- drivers/gpu/drm/ast/ast_dp.c | 6 + drivers/gpu/drm/i915/display/intel_bw.c | 14 +- drivers/gpu/drm/i915/display/intel_display.c | 4 +- .../gpu/drm/i915/display/intel_display_device.h | 1 + drivers/gpu/drm/i915/display/intel_dp.c | 58 ++++++-- drivers/gpu/drm/i915/display/intel_vblank.c | 4 +- drivers/gpu/drm/i915/gvt/opregion.c | 7 +- drivers/gpu/drm/i915/i915_drv.h | 1 + drivers/gpu/drm/i915/soc/intel_dram.c | 4 + drivers/gpu/drm/imagination/pvr_fw.c | 27 +++- drivers/gpu/drm/imagination/pvr_job.c | 7 + drivers/gpu/drm/imagination/pvr_queue.c | 4 + drivers/gpu/drm/mgag200/mgag200_mode.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 82 +++++------ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 8 +- .../drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h | 2 - .../drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h | 1 - .../drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h | 3 - .../drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h | 4 - .../gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h | 3 - .../gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h | 2 - drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 3 + drivers/gpu/drm/msm/dsi/dsi_host.c | 9 +- .../gpu/drm/msm/registers/adreno/adreno_pm4.xml | 7 + drivers/gpu/drm/nouveau/nouveau_bo.c | 3 + drivers/gpu/drm/nouveau/nouveau_gem.c | 3 - drivers/gpu/drm/sti/Makefile | 2 - drivers/gpu/drm/tiny/repaper.c | 4 +- drivers/gpu/drm/v3d/v3d_sched.c | 16 ++- drivers/gpu/drm/virtio/virtgpu_gem.c | 11 +- drivers/gpu/drm/virtio/virtgpu_plane.c | 20 ++- drivers/gpu/drm/xe/xe_device_types.h | 1 + drivers/gpu/drm/xe/xe_dma_buf.c | 5 +- drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 12 +- drivers/gpu/drm/xe/xe_guc_ads.c | 75 ++++++----- drivers/gpu/drm/xe/xe_hmm.c | 24 ---- drivers/gpu/drm/xe/xe_migrate.c | 2 +- drivers/i2c/busses/i2c-cros-ec-tunnel.c | 3 + drivers/i2c/i2c-atr.c | 2 +- drivers/infiniband/core/cma.c | 4 +- drivers/infiniband/core/umem_odp.c | 6 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 10 -- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- drivers/infiniband/hw/usnic/usnic_ib_main.c | 14 +- drivers/md/md-bitmap.c | 5 +- drivers/md/raid10.c | 1 + drivers/net/can/rockchip/rockchip_canfd-core.c | 7 +- drivers/net/dsa/b53/b53_common.c | 10 ++ drivers/net/dsa/mv88e6xxx/chip.c | 13 +- drivers/net/dsa/mv88e6xxx/devlink.c | 3 +- drivers/net/ethernet/amd/pds_core/debugfs.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 1 + drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 3 + drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c | 7 + drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 6 +- drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h | 3 + drivers/net/ethernet/intel/igc/igc.h | 1 + drivers/net/ethernet/intel/igc/igc_defines.h | 6 +- drivers/net/ethernet/intel/igc/igc_main.c | 1 + drivers/net/ethernet/intel/igc/igc_ptp.c | 113 ++++++++++------ drivers/net/ethernet/marvell/octeontx2/nic/rep.c | 2 + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 49 ++++--- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 15 ++- drivers/net/ethernet/ti/icssg/icss_iep.c | 150 ++++++++++++++------- drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 3 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/wireless/ath/ath12k/dp_mon.c | 4 +- drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +- .../net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 8 +- drivers/net/wireless/ti/wl1251/tx.c | 4 +- drivers/nvme/target/fc.c | 14 -- drivers/nvme/target/pci-epf.c | 74 ++++++---- drivers/pci/pci.c | 4 - drivers/platform/mellanox/mlxbf-bootctl.c | 4 +- drivers/platform/x86/amd/pmf/auto-mode.c | 4 +- drivers/platform/x86/amd/pmf/cnqf.c | 8 +- drivers/platform/x86/amd/pmf/core.c | 14 ++ drivers/platform/x86/amd/pmf/pmf.h | 1 + drivers/platform/x86/amd/pmf/sps.c | 12 +- drivers/platform/x86/amd/pmf/tee-if.c | 6 +- drivers/platform/x86/asus-laptop.c | 9 +- drivers/platform/x86/dell/alienware-wmi.c | 56 +++++++- drivers/platform/x86/msi-wmi-platform.c | 99 +++++++++----- drivers/ptp/ptp_ocp.c | 1 + drivers/ras/amd/atl/internal.h | 3 + drivers/ras/amd/atl/umc.c | 19 ++- drivers/ras/amd/fmpm.c | 9 +- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 9 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 14 +- drivers/scsi/megaraid/megaraid_sas_base.c | 9 +- drivers/scsi/megaraid/megaraid_sas_fusion.c | 5 +- drivers/scsi/scsi_transport_iscsi.c | 7 +- drivers/scsi/smartpqi/smartpqi_init.c | 13 +- .../intel/int340x_thermal/processor_thermal_rfim.c | 33 ++--- drivers/ufs/host/ufs-exynos.c | 41 ++++-- drivers/ufs/host/ufs-exynos.h | 5 +- fs/Kconfig | 1 + fs/btrfs/ioctl.c | 2 + fs/btrfs/super.c | 3 +- fs/eventpoll.c | 38 ++++-- fs/fuse/virtio_fs.c | 3 + fs/hfs/bnode.c | 6 + fs/hfsplus/bnode.c | 6 + fs/isofs/export.c | 2 +- fs/nfs/Kconfig | 2 +- fs/nfs/internal.h | 7 - fs/nfs/nfs4session.h | 4 - fs/nfsd/Kconfig | 1 + fs/nfsd/nfs4state.c | 2 +- fs/nfsd/nfsfh.h | 7 - fs/overlayfs/overlayfs.h | 2 - fs/overlayfs/super.c | 5 + fs/smb/client/cifsproto.h | 2 + fs/smb/client/connect.c | 34 ++--- fs/smb/client/file.c | 28 ++++ fs/smb/server/connection.c | 4 +- fs/smb/server/oplock.c | 29 ++-- fs/smb/server/oplock.h | 1 - fs/smb/server/smb2pdu.c | 4 +- fs/smb/server/transport_ipc.c | 7 +- fs/smb/server/transport_tcp.c | 14 +- fs/smb/server/transport_tcp.h | 1 + fs/smb/server/vfs.c | 3 +- fs/stat.c | 32 +++-- include/drm/intel/pciids.h | 1 + include/linux/backing-dev.h | 1 + include/linux/blkdev.h | 6 +- include/linux/firmware/cirrus/cs_dsp_test_utils.h | 1 - include/linux/nfs.h | 7 - include/uapi/drm/ivpu_accel.h | 4 +- io_uring/rsrc.c | 17 ++- kernel/sched/cpufreq_schedutil.c | 46 ++++++- kernel/trace/ftrace.c | 7 +- kernel/trace/trace_events_filter.c | 4 +- lib/alloc_tag.c | 15 ++- lib/iov_iter.c | 2 +- lib/string.c | 13 +- mm/compaction.c | 6 +- mm/filemap.c | 1 + mm/gup.c | 4 +- mm/memory.c | 4 +- mm/slub.c | 10 ++ mm/userfaultfd.c | 13 +- mm/vma.c | 38 +++++- mm/vma.h | 9 +- net/bluetooth/hci_event.c | 5 +- net/bluetooth/l2cap_core.c | 21 ++- net/bridge/br_vlan.c | 4 +- net/dsa/dsa.c | 59 ++++++-- net/dsa/tag_8021q.c | 2 +- net/ethtool/cmis_cdb.c | 2 +- net/ipv6/route.c | 1 + net/mac80211/iface.c | 3 + net/mctp/af_mctp.c | 3 + net/netfilter/nf_flow_table_core.c | 10 +- net/openvswitch/flow_netlink.c | 3 +- net/smc/af_smc.c | 5 + rust/Makefile | 2 +- rust/helpers/io.c | 34 ++--- scripts/Makefile.compiler | 4 +- scripts/generate_rust_analyzer.py | 12 +- sound/pci/hda/Kconfig | 4 +- sound/pci/hda/patch_realtek.c | 23 ++-- sound/soc/codecs/cs42l43-jack.c | 3 + sound/soc/codecs/lpass-wsa-macro.c | 139 +++++++++++++------ sound/soc/dwc/dwc-i2s.c | 13 +- sound/soc/fsl/fsl_qmc_audio.c | 3 + sound/soc/intel/avs/pcm.c | 3 +- sound/soc/intel/boards/sof_sdw.c | 1 + sound/soc/qcom/lpass.h | 3 +- tools/net/ynl/pyynl/ynl_gen_c.py | 69 +++++++--- tools/objtool/check.c | 1 + tools/perf/util/evsel.c | 22 --- tools/testing/kunit/qemu_configs/sh.py | 4 +- tools/testing/selftests/mincore/mincore_selftest.c | 16 +-- .../selftests/mm/charge_reserved_hugetlb.sh | 4 +- .../selftests/mm/hugetlb_reparenting_test.sh | 2 +- tools/testing/shared/linux.c | 4 +- 250 files changed, 2269 insertions(+), 1331 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/241 scsi: hisi_sas: Enable force phy when SATA disk directly connected
6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <[email protected]>
[ Upstream commit 8aa580cd92843b60d4d6331f3b0a9e8409bb70eb ]
when a SATA disk is directly connected the SAS controller determines the disk to which I/Os are delivered based on the port ID in the DQ entry.
When many phys are disconnected and reconnect, the port ID of phys were changed and used by other link, resulting in I/O being sent to incorrect disk. Data inconsistency on the SATA disk may occur during I/O retries using the old port ID. So enable force phy, then force the command to be executed in a certain phy, and if the actual phy ID of the port does not match the phy configured in the command, the chip will stop delivering the I/O to disk.
--- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 9 +++++++-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 14 ++++++++++++-- 2 files changed, 19 insertions(+), 4 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +7 -2
@@ -2501,6 +2501,7 @@ static void prep_ata_v2_hw(struct hisi_hba *hisi_hba,struct hisi_sas_port *port =to_hisi_sas_port (sas_port);struct sas_ata_task *ata_task = &task->ata_task;struct sas_tmf_task *tmf = slot->tmf; +int phy_id;u8 *buf_cmd;int has_data =0 , hdr_tag =0 ;u32 dw0, dw1 =0 , dw2 =0 ;
@@ -2508,10 +2509,14 @@ static void prep_ata_v2_hw(struct hisi_hba *hisi_hba,/* create header */ /* dw0 */ dw0 = port->id <<CMD_HDR_PORT_OFF ; -if (parent_dev &&dev_is_expander (parent_dev->dev_type)) +if (parent_dev &&dev_is_expander (parent_dev->dev_type)) { dw0 |=3 <<CMD_HDR_CMD_OFF ; -else + }else { + phy_id = device->phy->identify.phy_identifier; + dw0 |= (1U << phy_id) <<CMD_HDR_PHY_ID_OFF ; + dw0 |=CMD_HDR_FORCE_PHY_MSK ; dw0 |=4 <<CMD_HDR_CMD_OFF ; + }if (tmf && ata_task->force_phy) { dw0 |=CMD_HDR_FORCE_PHY_MSK ;
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +12 -2
@@ -359,6 +359,10 @@#define CMD_HDR_RESP_REPORT_MSK (0x1 << CMD_HDR_RESP_REPORT_OFF)#define CMD_HDR_TLR_CTRL_OFF 6#define CMD_HDR_TLR_CTRL_MSK (0x3 << CMD_HDR_TLR_CTRL_OFF) +#define CMD_HDR_PHY_ID_OFF 8 +#define CMD_HDR_PHY_ID_MSK (0x1ff << CMD_HDR_PHY_ID_OFF) +#define CMD_HDR_FORCE_PHY_OFF 17 +#define CMD_HDR_FORCE_PHY_MSK (0x1U << CMD_HDR_FORCE_PHY_OFF)#define CMD_HDR_PORT_OFF 18#define CMD_HDR_PORT_MSK (0xf << CMD_HDR_PORT_OFF)#define CMD_HDR_PRIORITY_OFF 27
@@ -1429,15 +1433,21 @@ static void prep_ata_v3_hw(struct hisi_hba *hisi_hba,struct hisi_sas_cmd_hdr *hdr = slot->cmd_hdr;struct asd_sas_port *sas_port = device->port;struct hisi_sas_port *port =to_hisi_sas_port (sas_port); +int phy_id;u8 *buf_cmd;int has_data =0 , hdr_tag =0 ;u32 dw1 =0 , dw2 =0 ; hdr->dw0 =cpu_to_le32 (port->id <<CMD_HDR_PORT_OFF ); -if (parent_dev &&dev_is_expander (parent_dev->dev_type)) +if (parent_dev &&dev_is_expander (parent_dev->dev_type)) { hdr->dw0 |=cpu_to_le32 (3 <<CMD_HDR_CMD_OFF ); -else + }else { + phy_id = device->phy->identify.phy_identifier; + hdr->dw0 |=cpu_to_le32 ((1U << phy_id) + <<CMD_HDR_PHY_ID_OFF ); + hdr->dw0 |=CMD_HDR_FORCE_PHY_MSK ; hdr->dw0 |=cpu_to_le32 (4U <<CMD_HDR_CMD_OFF ); + }switch (task->data_dir) {case DMA_TO_DEVICE :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/241 wifi: at76c50x: fix use after free access in at76_disconnect
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ]
The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface.
--- drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/atmel/at76c50x-usb.c +1 -1
@@ -2552,7 +2552,7 @@ static void at76_disconnect(struct usb_interface *interface)wiphy_info (priv->hw->wiphy,"disconnecting\n" );at76_delete_device (priv); -usb_put_dev (priv->udev); +usb_put_dev (interface_to_usbdev (interface));dev_info (&interface->dev,"disconnected\n" ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/241 wifi: mac80211: Update skbs control block key in ieee80211_tx_dequeue()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
[ Upstream commit a104042e2bf6528199adb6ca901efe7b60c2c27f ]
The ieee80211 skb control block key (set when skb was queued) could have been removed before ieee80211_tx_dequeue() call. ieee80211_tx_dequeue() already called ieee80211_tx_h_select_key() to get the current key, but the latter do not update the key in skb control block in case it is NULL. Because some drivers actually use this key in their TX callbacks (e.g. ath1{1,2}k_mac_op_tx()) this could lead to the use after free below:
BUG: KASAN: slab-use-after-free in ath11k_mac_op_tx+0x590/0x61c Read of size 4 at addr ffffff803083c248 by task kworker/u16:4/1440 CPU: 3 UID: 0 PID: 1440 Comm: kworker/u16:4 Not tainted 6.13.0-ge128f627f404 #2 Hardware name: HW (DT) Workqueue: bat_events batadv_send_outstanding_bcast_packet Call trace: show_stack+0x14/0x1c (C) dump_stack_lvl+0x58/0x74 print_report+0x164/0x4c0 kasan_report+0xac/0xe8 __asan_report_load4_noabort+0x1c/0x24 ath11k_mac_op_tx+0x590/0x61c ieee80211_handle_wake_tx_queue+0x12c/0x1c8 ieee80211_queue_skb+0xdcc/0x1b4c ieee80211_tx+0x1ec/0x2bc ieee80211_xmit+0x224/0x324 __ieee80211_subif_start_xmit+0x85c/0xcf8 ieee80211_subif_start_xmit+0xc0/0xec4 dev_hard_start_xmit+0xf4/0x28c __dev_queue_xmit+0x6ac/0x318c batadv_send_skb_packet+0x38c/0x4b0 batadv_send_outstanding_bcast_packet+0x110/0x328 process_one_work+0x578/0xc10 worker_thread+0x4bc/0xc7c kthread+0x2f8/0x380 ret_from_fork+0x10/0x20 Allocated by task 1906: kasan_save_stack+0x28/0x4c kasan_save_track+0x1c/0x40 kasan_save_alloc_info+0x3c/0x4c __kasan_kmalloc+0xac/0xb0 __kmalloc_noprof+0x1b4/0x380 ieee80211_key_alloc+0x3c/0xb64 ieee80211_add_key+0x1b4/0x71c nl80211_new_key+0x2b4/0x5d8 genl_family_rcv_msg_doit+0x198/0x240 <...> Freed by task 1494: kasan_save_stack+0x28/0x4c kasan_save_track+0x1c/0x40 kasan_save_free_info+0x48/0x94 __kasan_slab_free+0x48/0x60 kfree+0xc8/0x31c kfree_sensitive+0x70/0x80 ieee80211_key_free_common+0x10c/0x174 ieee80211_free_keys+0x188/0x46c ieee80211_stop_mesh+0x70/0x2cc ieee80211_leave_mesh+0x1c/0x60 cfg80211_leave_mesh+0xe0/0x280 cfg80211_leave+0x1e0/0x244 <...>
Reset SKB control block key before calling ieee80211_tx_h_select_key() to avoid that.
--- net/mac80211/tx.c | 1 + 1 file changed, 1 insertion(+)
net/mac80211/tx.c +1 -0
@@ -3893,6 +3893,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,* The key can be removed while the packet was queued, so need to call * this here to get the current key. */ + info->control.hw_key =NULL ; r =ieee80211_tx_h_select_key (&tx);if (r !=TX_CONTINUE ) {ieee80211_free_txskb (&local->hw, skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/241 wifi: mac80211: Purge vif txq in ieee80211_do_stop()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
[ Upstream commit 378677eb8f44621ecc9ce659f7af61e5baa94d81 ]
After ieee80211_do_stop() SKB from vif's txq could still be processed. Indeed another concurrent vif schedule_and_wake_txq call could cause those packets to be dequeued (see ieee80211_handle_wake_tx_queue()) without checking the sdata current state.
Because vif.drv_priv is now cleared in this function, this could lead to driver crash.
For example in ath12k, ahvif is store in vif.drv_priv. Thus if ath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif->ah can be NULL, leading the ath12k_warn(ahvif->ah,...) call in this function to trigger the NULL deref below.
Unable to handle kernel paging request at virtual address dfffffc000000001
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
batman_adv: bat0: Interface deactivated: brbh1337
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfffffc000000001] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] SMP
CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114
Hardware name: HW (DT)
pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k]
lr : ath12k_mac_op_tx+0x174/0x29b8 [ath12k]
sp : ffffffc086ace450
x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4
x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e
x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0
x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958
x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8
x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03
x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40
x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0
x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001
x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008
Call trace:
ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P)
ieee80211_handle_wake_tx_queue+0x16c/0x260
ieee80211_queue_skb+0xeec/0x1d20
ieee80211_tx+0x200/0x2c8
ieee80211_xmit+0x22c/0x338
__ieee80211_subif_start_xmit+0x7e8/0xc60
ieee80211_subif_start_xmit+0xc4/0xee0
__ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0
ieee80211_subif_start_xmit_8023+0x124/0x488
dev_hard_start_xmit+0x160/0x5a8
__dev_queue_xmit+0x6f8/0x3120
br_dev_queue_push_xmit+0x120/0x4a8
__br_forward+0xe4/0x2b0
deliver_clone+0x5c/0xd0
br_flood+0x398/0x580
br_dev_xmit+0x454/0x9f8
dev_hard_start_xmit+0x160/0x5a8
__dev_queue_xmit+0x6f8/0x3120
ip6_finish_output2+0xc28/0x1b60
__ip6_finish_output+0x38c/0x638
ip6_output+0x1b4/0x338
ip6_local_out+0x7c/0xa8
ip6_send_skb+0x7c/0x1b0
ip6_push_pending_frames+0x94/0xd0
rawv6_sendmsg+0x1a98/0x2898
inet_sendmsg+0x94/0xe0
__sys_sendto+0x1e4/0x308
__arm64_sys_sendto+0xc4/0x140
do_el0_svc+0x110/0x280
el0_svc+0x20/0x60
el0t_64_sync_handler+0x104/0x138
el0t_64_sync+0x154/0x158To avoid that, empty vif's txq at ieee80211_do_stop() so no packet could be dequeued after ieee80211_do_stop() (new packets cannot be queued because SDATA_STATE_RUNNING is cleared at this point).
--- net/mac80211/iface.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/iface.c +3 -0
@@ -660,6 +660,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doif (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN )ieee80211_txq_remove_vlan (local, sdata); +if (sdata->vif.txq) +ieee80211_txq_purge (sdata->local,to_txq_info (sdata->vif.txq)); + sdata->bss =NULL ;if (local->open_count ==0 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/241 wifi: brcmfmac: fix memory leak in brcmf_get_module_param
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 9e935c0fe3f806ff700a804c00832f0f340b6061 ]
The memory allocated for settings is not freed when brcmf_of_probe fails. Fix that by freeing settings before returning in error path.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +3 -1
@@ -561,8 +561,10 @@ struct brcmf_mp_device *brcmf_get_module_param(struct device *dev,if (!found) {/* No platform data for this device, try OF and DMI data */ brcmf_dmi_probe (settings, chip, chiprev); -if (brcmf_of_probe (dev, bus_type, settings) == -EPROBE_DEFER ) +if (brcmf_of_probe (dev, bus_type, settings) == -EPROBE_DEFER ) { +kfree (settings);return ERR_PTR (-EPROBE_DEFER ); + }brcmf_acpi_probe (dev, bus_type, settings); }return settings;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/241 wifi: wl1251: fix memory leak in wl1251_tx_work
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit a0f0dc96de03ffeefc2a177b7f8acde565cb77f4 ]
The skb dequeued from tx_queue is lost when wl1251_ps_elp_wakeup fails with a -ETIMEDOUT error. Fix that by queueing the skb back to tx_queue.
--- drivers/net/wireless/ti/wl1251/tx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ti/wl1251/tx.c +3 -1
@@ -342,8 +342,10 @@ void wl1251_tx_work(struct work_struct *work)while ((skb =skb_dequeue (&wl->tx_queue))) {if (!woken_up) { ret =wl1251_ps_elp_wakeup (wl); -if (ret <0 ) +if (ret <0 ) { +skb_queue_head (&wl->tx_queue, skb); goto out; + } woken_up = true; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/241 scsi: iscsi: Fix missing scsi_host_put() in error path
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
[ Upstream commit 72eea84a1092b50a10eeecfeba4b28ac9f1312ab ]
Add goto to ensure scsi_host_put() is called in all error paths of iscsi_set_host_param() function. This fixes a potential memory leak when strlen() check fails.
--- drivers/scsi/scsi_transport_iscsi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/scsi/scsi_transport_iscsi.c +5 -2
@@ -3182,11 +3182,14 @@ iscsi_set_host_param(struct iscsi_transport *transport, }/* see similar check in iscsi_if_set_param() */ -if (strlen (data) > ev->u.set_host_param.len) -return -EINVAL ; +if (strlen (data) > ev->u.set_host_param.len) { + err = -EINVAL ; + goto out; + } err = transport->set_host_param (shost, ev->u.set_host_param.param, data, ev->u.set_host_param.len); +out:scsi_host_put (shost);return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/241 scsi: smartpqi: Use is_kdump_kernel() to check for kdump
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <[email protected]>
[ Upstream commit a2d5a0072235a69749ceb04c1a26dc75df66a31a ]
The smartpqi driver checks the reset_devices variable to determine whether special adjustments need to be made for kdump. This has the effect that after a regular kexec reboot, some driver parameters such as max_transfer_size are much lower than usual. More importantly, kexec reboot tests have revealed memory corruption caused by the driver log being written to system memory after a kexec.
Fix this by testing is_kdump_kernel() rather than reset_devices where appropriate.
--- drivers/scsi/smartpqi/smartpqi_init.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/scsi/smartpqi/smartpqi_init.c +7 -6
@@ -19,6 +19,7 @@#include <linux/bcd.h> #include <linux/reboot.h> #include <linux/cciss_ioctl.h> +#include <linux/crash_dump.h> #include <scsi/scsi_host.h> #include <scsi/scsi_cmnd.h> #include <scsi/scsi_device.h>
@@ -5246,7 +5247,7 @@ static void pqi_calculate_io_resources(struct pqi_ctrl_info *ctrl_info) ctrl_info->error_buffer_length = ctrl_info->max_io_slots *PQI_ERROR_BUFFER_ELEMENT_LENGTH ; -if (reset_devices) +if (is_kdump_kernel ()) max_transfer_size =min (ctrl_info->max_transfer_size,PQI_MAX_TRANSFER_SIZE_KDUMP );else
@@ -5275,7 +5276,7 @@ static void pqi_calculate_queue_resources(struct pqi_ctrl_info *ctrl_info)u16 num_elements_per_iq;u16 num_elements_per_oq; -if (reset_devices) { +if (is_kdump_kernel ()) { num_queue_groups =1 ; }else {int num_cpus;
@@ -8288,12 +8289,12 @@ static int pqi_ctrl_init(struct pqi_ctrl_info *ctrl_info)u32 product_id;if (reset_devices) { -if (pqi_is_fw_triage_supported (ctrl_info)) { +if (is_kdump_kernel () &&pqi_is_fw_triage_supported (ctrl_info)) { rc =sis_wait_for_fw_triage_completion (ctrl_info);if (rc)return rc; } -if (sis_is_ctrl_logging_supported (ctrl_info)) { +if (is_kdump_kernel () &&sis_is_ctrl_logging_supported (ctrl_info)) {sis_notify_kdump (ctrl_info); rc =sis_wait_for_ctrl_logging_completion (ctrl_info);if (rc)
@@ -8344,7 +8345,7 @@ static int pqi_ctrl_init(struct pqi_ctrl_info *ctrl_info) ctrl_info->product_id = (u8 )product_id; ctrl_info->product_revision = (u8)(product_id >>8 ); -if (reset_devices) { +if (is_kdump_kernel ()) {if (ctrl_info->max_outstanding_requests >PQI_MAX_OUTSTANDING_REQUESTS_KDUMP ) ctrl_info->max_outstanding_requests =
@@ -8480,7 +8481,7 @@ static int pqi_ctrl_init(struct pqi_ctrl_info *ctrl_info)if (rc)return rc; -if (ctrl_info->ctrl_logging_supported && !reset_devices) { +if (ctrl_info->ctrl_logging_supported && !is_kdump_kernel ()) {pqi_host_setup_buffer (ctrl_info, &ctrl_info->ctrl_log_memory,PQI_CTRL_LOG_TOTAL_SIZE ,PQI_CTRL_LOG_MIN_SIZE );pqi_host_memory_update (ctrl_info, &ctrl_info->ctrl_log_memory,PQI_VENDOR_GENERAL_CTRL_LOG_MEMORY_UPDATE ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/241 md/raid10: fix missing discard IO accounting
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit d05af90d6218e9c8f1c2026990c3f53c1b41bfb0 ]
md_account_bio() is not called from raid10_handle_discard(), now that we handle bitmap inside md_account_bio(), also fix missing bitmap_startwrite for discard.
Test whole disk discard for 20G raid10:
Before:
Device d/s dMB/s drqm/s %drqm d_await dareq-sz
md0 48.00 16.00 0.00 0.00 5.42 341.33
After:
Device d/s dMB/s drqm/s %drqm d_await dareq-sz
md0 68.00 20462.00 0.00 0.00 2.65 308133.65
--- drivers/md/raid10.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/raid10.c +1 -0
@@ -1734,6 +1734,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)* The discard bio returns only first r10bio finishes */ if (first_copy) { +md_account_bio (mddev, &bio); r10_bio->master_bio = bio;set_bit (R10BIO_Discard, &r10_bio->state); first_copy = false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/241 md/md-bitmap: fix stats collection for external bitmaps
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 6ec1f0239485028445d213d91cfee5242f3211ba ]
The bitmap_get_stats() function incorrectly returns -ENOENT for external bitmaps.
Remove the external bitmap check as the statistics should be available regardless of bitmap storage location.
Return -EINVAL only for invalid bitmap with no storage (neither in superblock nor in external file).
Note: "bitmap_info.external" here refers to a bitmap stored in a separate file (bitmap_file), not to external metadata.
--- drivers/md/md-bitmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/md/md-bitmap.c +2 -3
@@ -2355,9 +2355,8 @@ static int bitmap_get_stats(void *data, struct md_bitmap_stats *stats)if (!bitmap)return -ENOENT ; -if (bitmap->mddev->bitmap_info.external) -return -ENOENT ; -if (!bitmap->storage.sb_page)/* no superblock */ +if (!bitmap->mddev->bitmap_info.external && + !bitmap->storage.sb_page)return -EINVAL ; sb =kmap_local_page (bitmap->storage.sb_page); stats->sync_size =le64_to_cpu (sb->sync_size);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/241 ASoC: dwc: always enable/disable i2s irqs
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brady Norander <[email protected]>
[ Upstream commit 2b727b3f8a04fe52f55316ccb8792cfd9b2dd05d ]
Commit a42e988 ("ASoC: dwc: add DMA handshake control") changed the behavior of the driver to not enable or disable i2s irqs if using DMA. This breaks platforms such as AMD ACP. Audio playback appears to work but no audio can be heard. Revert to the old behavior by always enabling and disabling i2s irqs while keeping DMA handshake control.
--- sound/soc/dwc/dwc-i2s.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
sound/soc/dwc/dwc-i2s.c +6 -7
@@ -199,12 +199,10 @@ static void i2s_start(struct dw_i2s_dev *dev,else i2s_write_reg (dev->i2s_base,IRER ,1 ); -/* I2S needs to enable IRQ to make a handshake with DMAC on the JH7110 SoC */ -if (dev->use_pio || dev->is_jh7110) -i2s_enable_irqs (dev, substream->stream, config->chan_nr); -else +if (!(dev->use_pio || dev->is_jh7110))i2s_enable_dma (dev, substream->stream); +i2s_enable_irqs (dev, substream->stream, config->chan_nr);i2s_write_reg (dev->i2s_base,CER ,1 ); }
@@ -218,11 +216,12 @@ static void i2s_stop(struct dw_i2s_dev *dev,else i2s_write_reg (dev->i2s_base,IRER ,0 ); -if (dev->use_pio || dev->is_jh7110) -i2s_disable_irqs (dev, substream->stream,8 ); -else +if (!(dev->use_pio || dev->is_jh7110))i2s_disable_dma (dev, substream->stream); +i2s_disable_irqs (dev, substream->stream,8 ); + +if (!dev->active) {i2s_write_reg (dev->i2s_base,CER ,0 );i2s_write_reg (dev->i2s_base,IER ,0 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/241 ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit 95f723cf141b95e3b3a5b92cf2ea98a863fe7275 ]
devm_kasprintf() returns NULL when memory allocation fails. Currently, avs_component_probe() does not check for this case, which results in a NULL pointer dereference.
--- sound/soc/intel/avs/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/intel/avs/pcm.c +2 -1
@@ -927,7 +927,8 @@ static int avs_component_probe(struct snd_soc_component *component)else mach->tplg_filename =devm_kasprintf (adev->dev,GFP_KERNEL ,"hda-generic-tplg.bin" ); - +if (!mach->tplg_filename) +return -ENOMEM ; filename =kasprintf (GFP_KERNEL ,"%s/%s" , component->driver->topology_name_prefix, mach->tplg_filename);if (!filename)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/241 crypto: tegra - Fix IV usage for AES ECB
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit 1ddaff40c08abb926be5ba713c5efc412d0836c5 ]
Modifying the crypto_request turns out to be not the right way to handle the stale value issue with the IV. Though the IV is not used for AES ECB, it eventually get used in algorithms like LRW in the next step after AES ECB encryption/decryption. Setting req->iv to NULL breaks the implementation of such algorithms. Hence modify only the local reqctx to check for IV.
--- drivers/crypto/tegra/tegra-se-aes.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +1 -4
@@ -269,7 +269,7 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)unsigned int cmdlen, key1_id, key2_id;int ret; - rctx->iv = (u32 *)req->iv; + rctx->iv = (ctx->alg ==SE_ALG_ECB ) ?NULL : (u32 *)req->iv; rctx->len = req->cryptlen; key1_id = ctx->key1_id; key2_id = ctx->key2_id;
@@ -498,9 +498,6 @@ static int tegra_aes_crypt(struct skcipher_request *req, bool encrypt)if (!req->cryptlen)return 0 ; -if (ctx->alg ==SE_ALG_ECB ) - req->iv =NULL ; - rctx->encrypt = encrypt;return crypto_transfer_skcipher_request_to_engine (ctx->se->engine, req);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/241 ovl: remove unused forward declaration
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giuseppe Scrivano <[email protected]>
[ Upstream commit a6eb9a4a69cc360b930dad9dc8513f8fd9b3577f ]
The ovl_get_verity_xattr() function was never added, only its declaration.
--- fs/overlayfs/overlayfs.h | 2 -- 1 file changed, 2 deletions(-)
fs/overlayfs/overlayfs.h +0 -2
@@ -540,8 +540,6 @@ int ovl_set_metacopy_xattr(struct ovl_fs *ofs, struct dentry *d,bool ovl_is_metacopy_dentry (struct dentry *dentry);char *ovl_get_redirect_xattr (struct ovl_fs *ofs,const struct path *path,int padding);int ovl_ensure_verity_loaded (struct path *path); -int ovl_get_verity_xattr (struct ovl_fs *ofs,const struct path *path, -u8 *digest_buf,int *buf_length);int ovl_validate_verity (struct ovl_fs *ofs,struct path *metapath,struct path *datapath);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/241 RDMA/bnxt_re: Fix budget handling of notification queue
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kashyap Desai <[email protected]>
[ Upstream commit 6b395d31146a3fae775823ea8570a37b922f6685 ]
The cited commit in Fixes tag introduced a bug which can cause hang of completion queue processing because of notification queue budget goes to zero.
Found while doing nfs over rdma mount and umount. Below message is noticed because of the existing bug.
kernel: cm_destroy_id_wait_timeout: cm_id=00000000ff6c6cc6 timed out. state 11 -> 0, refcnt=1
Fix to handle this issue -
Driver will not change nq->budget upon create and destroy of cq and srq rdma resources.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +0 -5
@@ -1784,8 +1784,6 @@ int bnxt_re_destroy_srq(struct ib_srq *ib_srq, struct ib_udata *udata)bnxt_qplib_destroy_srq (&rdev->qplib_res, qplib_srq);ib_umem_release (srq->umem);atomic_dec (&rdev->stats.res.srq_count); -if (nq) - nq->budget--;return 0 ; }
@@ -1907,8 +1905,6 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, goto fail; } } -if (nq) - nq->budget++; active_srqs =atomic_inc_return (&rdev->stats.res.srq_count);if (active_srqs > rdev->stats.res.srq_watermark) rdev->stats.res.srq_watermark = active_srqs;
@@ -3078,7 +3074,6 @@ int bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)ib_umem_release (cq->umem);atomic_dec (&rdev->stats.res.cq_count); - nq->budget--;kfree (cq->cql);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/241 RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit 95ba3850fed03e01b422ab5d7943aeba130c9723 ]
drivers/infiniband/hw/usnic/usnic_ib_main.c:590
usnic_ib_pci_probe() warn: passing zero to 'PTR_ERR'
Make usnic_ib_device_add() return NULL on fail path, also remove useless NULL check for usnic_ib_discover_pf()
--- drivers/infiniband/hw/usnic/usnic_ib_main.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/infiniband/hw/usnic/usnic_ib_main.c +7 -7
@@ -397,7 +397,7 @@ static void *usnic_ib_device_add(struct pci_dev *dev)if (!us_ibdev) {usnic_err ("Device %s context alloc failed\n" ,netdev_name (pci_get_drvdata (dev))); -return ERR_PTR (-EFAULT ); +return NULL ; } us_ibdev->ufdev =usnic_fwd_dev_alloc (dev);
@@ -517,8 +517,8 @@ static struct usnic_ib_dev *usnic_ib_discover_pf(struct usnic_vnic *vnic) } us_ibdev =usnic_ib_device_add (parent_pci); -if (IS_ERR_OR_NULL (us_ibdev)) { - us_ibdev = us_ibdev ? us_ibdev :ERR_PTR (-EFAULT ); +if (!us_ibdev) { + us_ibdev =ERR_PTR (-EFAULT ); goto out; }
@@ -586,10 +586,10 @@ static int usnic_ib_pci_probe(struct pci_dev *pdev, } pf =usnic_ib_discover_pf (vf->vnic); -if (IS_ERR_OR_NULL (pf)) { -usnic_err ("Failed to discover pf of vnic %s with err%ld\n" , -pci_name (pdev),PTR_ERR (pf)); - err = pf ?PTR_ERR (pf) : -EFAULT ; +if (IS_ERR (pf)) { + err =PTR_ERR (pf); +usnic_err ("Failed to discover pf of vnic %s with err%d\n" , +pci_name (pdev), err); goto out_clean_vnic; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/241 RDMA/hns: Fix wrong maximum DMA segment size
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 9beb2c91fb86e0be70a5833c6730441fa3c9efa8 ]
Set maximum DMA segment size to 2G instead of UINT_MAX due to HW limit.
--- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_main.c +1 -1
@@ -763,7 +763,7 @@ static int hns_roce_register_device(struct hns_roce_dev *hr_dev)if (ret)return ret; } -dma_set_max_seg_size (dev,UINT_MAX ); +dma_set_max_seg_size (dev,SZ_2G ); ret =ib_register_device (ib_dev,"hns_%d" , dev);if (ret) {dev_err (dev,"ib_register_device failed!\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/241 ALSA: hda/cirrus_scodec_test: Dont select dependencies
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit e9c7fa025dc6125eb47993515d45da0cd02a263c ]
Depend on SND_HDA_CIRRUS_SCODEC and GPIOLIB instead of selecting them.
KUNIT_ALL_TESTS should only build tests that have satisfied dependencies and test components that are already being built. It must not cause other stuff to be added to the build.
--- sound/pci/hda/Kconfig | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
sound/pci/hda/Kconfig +1 -3
@@ -96,9 +96,7 @@ config SND_HDA_CIRRUS_SCODEC config SND_HDA_CIRRUS_SCODEC_KUNIT_TEST tristate "KUnit test for Cirrus side-codec library" if !KUNIT_ALL_TESTS - select SND_HDA_CIRRUS_SCODEC - select GPIOLIB - depends on KUNIT + depends on SND_HDA_CIRRUS_SCODEC && GPIOLIB && KUNIT default KUNIT_ALL_TESTS help This builds KUnit tests for the cirrus side-codec library.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/241 ALSA: hda/realtek - Fixed ASUS platform headset Mic issue
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit b5458fcabd96ce29adbf7225c1741ecdfff70a91 ]
ASUS platform Headset Mic was disable by default.
Assigned verb table for Mic pin will enable it.
--- sound/pci/hda/patch_realtek.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
sound/pci/hda/patch_realtek.c +15 -8
@@ -7924,6 +7924,7 @@ enum {ALC233_FIXUP_MEDION_MTL_SPK ,ALC294_FIXUP_BASS_SPEAKER_15 ,ALC283_FIXUP_DELL_HP_RESUME , + ALC294_FIXUP_ASUS_CS35L41_SPI_2, };/* A special fixup for Lenovo C940 and Yoga Duet 7;
@@ -10278,6 +10279,12 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc283_fixup_dell_hp_resume, }, + [ALC294_FIXUP_ASUS_CS35L41_SPI_2] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs35l41_fixup_spi_two, + .chained = true, + .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC, + }, }; static const struct hda_quirk alc269_fixup_tbl[] = {
@@ -10763,7 +10770,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x12a0 ,"ASUS X441UV" ,ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x12a3 ,"Asus N7691ZM" ,ALC269_FIXUP_ASUS_N7601ZM ),SND_PCI_QUIRK (0x1043 ,0x12af ,"ASUS UX582ZS" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x12b4 ,"ASUS B3405CCA / P3405CCA" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x12b4 ,"ASUS B3405CCA / P3405CCA" ,ALC294_FIXUP_ASUS_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x12e0 ,"ASUS X541SA" ,ALC256_FIXUP_ASUS_MIC ),SND_PCI_QUIRK (0x1043 ,0x12f0 ,"ASUS X541UV" ,ALC256_FIXUP_ASUS_MIC ), SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE),
@@ -10853,14 +10860,14 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1fb3 ,"ASUS ROG Flow Z13 GZ302EA" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x3011 ,"ASUS B5605CVA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x3030 ,"ASUS ZN270IE" ,ALC256_FIXUP_ASUS_AIO_GPIO2 ), -SND_PCI_QUIRK (0x1043 ,0x3061 ,"ASUS B3405CCA" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x3071 ,"ASUS B5405CCA" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x30c1 ,"ASUS B3605CCA / P3605CCA" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x30d1 ,"ASUS B5405CCA" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x30e1 ,"ASUS B5605CCA" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x3061 ,"ASUS B3405CCA" ,ALC294_FIXUP_ASUS_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x3071 ,"ASUS B5405CCA" ,ALC294_FIXUP_ASUS_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x30c1 ,"ASUS B3605CCA / P3605CCA" ,ALC294_FIXUP_ASUS_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x30d1 ,"ASUS B5405CCA" ,ALC294_FIXUP_ASUS_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x30e1 ,"ASUS B5605CCA" ,ALC294_FIXUP_ASUS_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x31d0 ,"ASUS Zen AIO 27 Z272SD_A272SD" ,ALC274_FIXUP_ASUS_ZEN_AIO_27 ), -SND_PCI_QUIRK (0x1043 ,0x31e1 ,"ASUS B5605CCA" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x31f1 ,"ASUS B3605CCA" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x31e1 ,"ASUS B5605CCA" ,ALC294_FIXUP_ASUS_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x31f1 ,"ASUS B3605CCA" ,ALC294_FIXUP_ASUS_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x3a20 ,"ASUS G614JZR" ,ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS ),SND_PCI_QUIRK (0x1043 ,0x3a30 ,"ASUS G814JVR/JIR" ,ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS ), SND_PCI_QUIRK(0x1043, 0x3a40, "ASUS G814JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/241 ASoC: cs42l43: Reset clamp override on jack removal
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 5fc7d2b5cab47f2ac712f689140b1fed978fb91c ]
Some of the manually selected jack configurations will disable the headphone clamp override. Restore this on jack removal, such that the state is consistent for a new insert.
--- sound/soc/codecs/cs42l43-jack.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/codecs/cs42l43-jack.c +3 -0
@@ -702,6 +702,9 @@ static void cs42l43_clear_jack(struct cs42l43_codec *priv) CS42L43_PGA_WIDESWING_MODE_EN_MASK, 0);regmap_update_bits (cs42l43->regmap,CS42L43_STEREO_MIC_CTRL ,CS42L43_JACK_STEREO_CONFIG_MASK ,0 ); +regmap_update_bits (cs42l43->regmap,CS42L43_STEREO_MIC_CLAMP_CTRL , +CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_MASK , +CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_MASK );regmap_update_bits (cs42l43->regmap,CS42L43_HS2 ,CS42L43_HSDET_MODE_MASK |CS42L43_HSDET_MANUAL_MODE_MASK ,0x2 <<CS42L43_HSDET_MODE_SHIFT );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/241 RDMA/core: Silence oversized kvmalloc() warning
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 9a0e6f15029e1a8a21e40f06fd05aa52b7f063de ]
syzkaller triggered an oversized kvmalloc() warning. Silence it by adding __GFP_NOWARN.
syzkaller log:
WARNING: CPU: 7 PID: 518 at mm/util.c:665 __kvmalloc_node_noprof+0x175/0x180 CPU: 7 UID: 0 PID: 518 Comm: c_repro Not tainted 6.11.0-rc6+ #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:__kvmalloc_node_noprof+0x175/0x180 RSP: 0018:ffffc90001e67c10 EFLAGS: 00010246 RAX: 0000000000000100 RBX: 0000000000000400 RCX: ffffffff8149d46b RDX: 0000000000000000 RSI: ffff8881030fae80 RDI: 0000000000000002 RBP: 000000712c800000 R08: 0000000000000100 R09: 0000000000000000 R10: ffffc90001e67c10 R11: 0030ae0601000000 R12: 0000000000000000 R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000 FS: 00007fde79159740(0000) GS:ffff88813bdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000180 CR3: 0000000105eb4005 CR4: 00000000003706b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ib_umem_odp_get+0x1f6/0x390 mlx5_ib_reg_user_mr+0x1e8/0x450 ib_uverbs_reg_mr+0x28b/0x440 ib_uverbs_write+0x7d3/0xa30 vfs_write+0x1ac/0x6c0 ksys_write+0x134/0x170 ? __sanitizer_cov_trace_pc+0x1c/0x50 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- drivers/infiniband/core/umem_odp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/core/umem_odp.c +4 -2
@@ -76,12 +76,14 @@ static inline int ib_init_umem_odp(struct ib_umem_odp *umem_odp, npfns = (end - start) >>PAGE_SHIFT ; umem_odp->pfn_list =kvcalloc ( - npfns,sizeof (*umem_odp->pfn_list),GFP_KERNEL ); + npfns,sizeof (*umem_odp->pfn_list), +GFP_KERNEL | __GFP_NOWARN);if (!umem_odp->pfn_list)return -ENOMEM ; umem_odp->dma_list =kvcalloc ( - ndmas,sizeof (*umem_odp->dma_list),GFP_KERNEL ); + ndmas,sizeof (*umem_odp->dma_list), +GFP_KERNEL | __GFP_NOWARN);if (!umem_odp->dma_list) { ret = -ENOMEM ; goto out_pfn_list;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/241 firmware: cs_dsp: test_bin_error: Fix uninitialized data used as fw version
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 285b2c74cf9982e873ef82a2cb1328d9e9406f65 ]
Call cs_dsp_mock_xm_header_get_fw_version() to get the firmware version from the dummy XM header data in cs_dsp_bin_err_test_common_init().
Make the same change to cs_dsp_bin_test_common_init() and remove the cs_dsp_mock_xm_header_get_fw_version_from_regmap() function.
The code in cs_dsp_test_bin.c was correctly calling cs_dsp_mock_xm_header_get_fw_version_from_regmap() to fetch the fw version from a dummy header it wrote to XM registers. However in cs_dsp_test_bin_error.c the test doesn't stuff a dummy header into XM, it populates it the normal way using a wmfw file. It should have called cs_dsp_mock_xm_header_get_fw_version() to get the data from its blob buffer, but was calling cs_dsp_mock_xm_header_get_fw_version_from_regmap(). As nothing had been written to the registers this returned the value of uninitialized data.
The only other use of cs_dsp_mock_xm_header_get_fw_version_from_regmap() was cs_dsp_test_bin.c, but it doesn't need to use it. It already has a blob buffer containing the dummy XM header so it can use cs_dsp_mock_xm_header_get_fw_version() to read from that.
--- .../cirrus/test/cs_dsp_mock_mem_maps.c | 30 ------------------- .../firmware/cirrus/test/cs_dsp_test_bin.c | 2 +- .../cirrus/test/cs_dsp_test_bin_error.c | 2 +- .../linux/firmware/cirrus/cs_dsp_test_utils.h | 1 - 4 files changed, 2 insertions(+), 33 deletions(-)
drivers/firmware/cirrus/test/cs_dsp_mock_mem_maps.c +0 -30
@@ -461,36 +461,6 @@ unsigned int cs_dsp_mock_xm_header_get_alg_base_in_words(struct cs_dsp_test *pri }EXPORT_SYMBOL_NS_GPL (cs_dsp_mock_xm_header_get_alg_base_in_words,"FW_CS_DSP_KUNIT_TEST_UTILS" ); -/** -* cs_dsp_mock_xm_header_get_fw_version_from_regmap() - Firmware version. -* -* @priv: Pointer to struct cs_dsp_test. -* -* Return: Firmware version word value. -*/ -unsigned int cs_dsp_mock_xm_header_get_fw_version_from_regmap (struct cs_dsp_test *priv) -{ -unsigned int xm =cs_dsp_mock_base_addr_for_mem (priv,WMFW_ADSP2_XM ); -union { -struct wmfw_id_hdr adsp2; -struct wmfw_v3_id_hdr halo; - } hdr; - -switch (priv->dsp->type) { -case WMFW_ADSP2 : -regmap_raw_read (priv->dsp->regmap, xm, &hdr.adsp2,sizeof (hdr.adsp2)); -return be32_to_cpu (hdr.adsp2.ver); -case WMFW_HALO : -regmap_raw_read (priv->dsp->regmap, xm, &hdr.halo,sizeof (hdr.halo)); -return be32_to_cpu (hdr.halo.ver); -default : -KUNIT_FAIL (priv->test,NULL ); -return 0 ; - } -} -EXPORT_SYMBOL_NS_GPL (cs_dsp_mock_xm_header_get_fw_version_from_regmap, -"FW_CS_DSP_KUNIT_TEST_UTILS" ); -/** * cs_dsp_mock_xm_header_get_fw_version() - Firmware version. *
drivers/firmware/cirrus/test/cs_dsp_test_bin.c +1 -1
@@ -2198,7 +2198,7 @@ static int cs_dsp_bin_test_common_init(struct kunit *test, struct cs_dsp *dsp) priv->local->bin_builder =cs_dsp_mock_bin_init (priv,1 , -cs_dsp_mock_xm_header_get_fw_version_from_regmap (priv)); +cs_dsp_mock_xm_header_get_fw_version (xm_hdr));KUNIT_ASSERT_NOT_ERR_OR_NULL (test, priv->local->bin_builder);/* We must provide a dummy wmfw to load */
drivers/firmware/cirrus/test/cs_dsp_test_bin_error.c +1 -1
@@ -451,7 +451,7 @@ static int cs_dsp_bin_err_test_common_init(struct kunit *test, struct cs_dsp *ds local->bin_builder =cs_dsp_mock_bin_init (priv,1 , -cs_dsp_mock_xm_header_get_fw_version_from_regmap (priv)); +cs_dsp_mock_xm_header_get_fw_version (local->xm_header));KUNIT_ASSERT_NOT_ERR_OR_NULL (test, local->bin_builder);/* Init cs_dsp */
include/linux/firmware/cirrus/cs_dsp_test_utils.h +0 -1
@@ -104,7 +104,6 @@ unsigned int cs_dsp_mock_num_dsp_words_to_num_packed_regs(unsigned int num_dsp_wunsigned int cs_dsp_mock_xm_header_get_alg_base_in_words (struct cs_dsp_test *priv,unsigned int alg_id,int mem_type); -unsigned int cs_dsp_mock_xm_header_get_fw_version_from_regmap (struct cs_dsp_test *priv);unsigned int cs_dsp_mock_xm_header_get_fw_version (struct cs_dsp_mock_xm_header *header);void cs_dsp_mock_xm_header_drop_from_regmap_cache (struct cs_dsp_test *priv);int cs_dsp_mock_xm_header_write_to_regmap (struct cs_dsp_mock_xm_header *header);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/241 Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit eb73b5a9157221f405b4fe32751da84ee46b7a25 ]
This fixes sending MGMT_EV_DEVICE_FOUND for invalid address (00:00:00:00:00:00) which is a regression introduced by a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report") since in the attempt to skip storing data for extended advertisement it actually made the code to skip the entire if statement supposed to send MGMT_EV_DEVICE_FOUND without attempting to use the last_addr_adv which is garanteed to be invalid for extended advertisement since we never store anything on it.
--- net/bluetooth/hci_event.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/bluetooth/hci_event.c +3 -2
@@ -6153,11 +6153,12 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,* event or send an immediate device found event if the data * should not be stored for later. */ -if (!ext_adv && !has_pending_adv_report (hdev)) { +if (!has_pending_adv_report (hdev)) {/* If the report will trigger a SCAN_REQ store it for * later merging. */ -if (type ==LE_ADV_IND || type ==LE_ADV_SCAN_IND ) { +if (!ext_adv && (type ==LE_ADV_IND || + type ==LE_ADV_SCAN_IND )) {store_pending_adv_report (hdev, bdaddr, bdaddr_type, rssi, flags, data, len);return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/241 Bluetooth: btrtl: Prevent potential NULL dereference
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 324dddea321078a6eeb535c2bff5257be74c9799 ]
The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs NULL bug, followed by a NULL pointer dereference. This was detected by Smatch:
drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'
--- drivers/bluetooth/btrtl.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btrtl.c +2 -0
@@ -1215,6 +1215,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,rtl_dev_err (hdev,"mandatory config file %s not found" , btrtl_dev->ic_info->cfg_name); ret = btrtl_dev->cfg_len; +if (!ret) + ret = -EINVAL ; goto err_free; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/241 Bluetooth: qca: fix NV variant for one of WCN3950 SoCs
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit e92900c9803fb35ad6cf599cb268b8ddd9f91940 ]
The QCA_WCN3950_SOC_ID_S should be using qca/cmnv13s.bin, rather than qca/cmnv13u.bin file. Correct the variant suffix to be used for this SoC ID.
--- drivers/bluetooth/btqca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/btqca.c +1 -1
@@ -889,7 +889,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,if (le32_to_cpu (ver.soc_id) ==QCA_WCN3950_SOC_ID_T ) variant ="t" ;else if (le32_to_cpu (ver.soc_id) ==QCA_WCN3950_SOC_ID_S ) - variant ="u" ; + variant ="s" ;snprintf (config.fwname,sizeof (config.fwname),"qca/cmnv%02x%s.bin" , rom_ver, variant);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/241 Bluetooth: l2cap: Check encryption key size on incoming connection
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frédéric Danis <[email protected]>
[ Upstream commit 522e9ed157e3c21b4dd623c79967f72c21e45b78 ]
This is required for passing GAP/SEC/SEM/BI-04-C PTS test case:
Security Mode 4 Level 4, Responder - Invalid Encryption Key Size
- 128 bit
This tests the security key with size from 1 to 15 bytes while the Security Mode 4 Level 4 requests 16 bytes key size.
Currently PTS fails with the following logs:
- expected:Connection Response:
Code: [3 (0x03)] Code
Identifier: (lt)WildCard: Exists(gt)
Length: [8 (0x0008)]
Destination CID: (lt)WildCard: Exists(gt)
Source CID: [64 (0x0040)]
Result: [3 (0x0003)] Connection refused - Security block
Status: (lt)WildCard: Exists(gt),
but received:Connection Response:
Code: [3 (0x03)] Code
Identifier: [1 (0x01)]
Length: [8 (0x0008)]
Destination CID: [64 (0x0040)]
Source CID: [64 (0x0040)]
Result: [0 (0x0000)] Connection Successful
Status: [0 (0x0000)] No further information availableAnd HCI logs:
< HCI Command: Read Encrypti.. (0x05|0x0008) plen 2
Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 7
Read Encryption Key Size (0x05|0x0008) ncmd 1
Status: Success (0x00)
Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
Key size: 7Quoted 1 line
ACL Data RX: Handle 14 flags
0x02dlen 12
L2CAP: Connection Request (0x02) ident 1 len 4
PSM: 4097 (0x1001)
Source CID: 64
< ACL Data TX: Handle 14 flags 0x00 dlen 16
L2CAP: Connection Response (0x03) ident 1 len 8
Destination CID: 64
Source CID: 64
Result: Connection successful (0x0000)
Status: No further information available (0x0000)--- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bluetooth/l2cap_core.c +2 -1
@@ -3956,7 +3956,8 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,/* Check if the ACL is secure enough (if not SDP) */ if (psm !=cpu_to_le16 (L2CAP_PSM_SDP ) && - !hci_conn_check_link_mode (conn->hcon)) { + (!hci_conn_check_link_mode (conn->hcon) || + !l2cap_check_enc_key_size (conn->hcon))) { conn->disc_reason =HCI_ERROR_AUTH_FAILURE ; result =L2CAP_CR_SEC_BLOCK ; goto response;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/241 RDMA/bnxt_re: Remove unusable nq variable
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit ffc59e32c67e599cc473d6427a4aa584399d5b3c ]
Remove nq variable from bnxt_re_create_srq() and bnxt_re_destroy_srq() as it generates the following compilation warnings:
Quoted 1 line
Quoted 1 line
drivers/infiniband/hw/bnxt_re/ib_verbs.c:1777:24: warning: variable
'nq' set but not used [-Wunused-but-set-variable]
1777 | struct bnxt_qplib_nq *nq = NULL;
| ^
drivers/infiniband/hw/bnxt_re/ib_verbs.c:1828:24: warning: variable
'nq' set but not used [-Wunused-but-set-variable]
1828 | struct bnxt_qplib_nq *nq = NULL;
| ^2 warnings generated.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +0 -5
@@ -1773,10 +1773,7 @@ int bnxt_re_destroy_srq(struct ib_srq *ib_srq, struct ib_udata *udata) ib_srq);struct bnxt_re_dev *rdev = srq->rdev;struct bnxt_qplib_srq *qplib_srq = &srq->qplib_srq; -struct bnxt_qplib_nq *nq =NULL ; -if (qplib_srq->cq) - nq = qplib_srq->cq->nq;if (rdev->chip_ctx->modes.toggle_bits &BNXT_QPLIB_SRQ_TOGGLE_BIT ) {free_page ((unsigned long )srq->uctx_srq_page);hash_del (&srq->hash_entry);
@@ -1824,7 +1821,6 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, struct ib_udata *udata) {struct bnxt_qplib_dev_attr *dev_attr; -struct bnxt_qplib_nq *nq =NULL ;struct bnxt_re_ucontext *uctx;struct bnxt_re_dev *rdev;struct bnxt_re_srq *srq;
@@ -1870,7 +1866,6 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, srq->qplib_srq.eventq_hw_ring_id = rdev->nqr->nq[0 ].ring_id; srq->qplib_srq.sg_info.pgsize =PAGE_SIZE ; srq->qplib_srq.sg_info.pgshft =PAGE_SHIFT ; - nq = &rdev->nqr->nq[0 ];if (udata) { rc =bnxt_re_init_user_srq (rdev, pd, srq, udata);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/241 ipv6: add exception routes to GC list in rt6_insert_exception
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit cfe82469a00f0c0983bf4652de3a2972637dfc56 ]
Commit 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.") introduced a separated list for managing route expiration via the GC timer.
However, it missed adding exception routes (created by ip6_rt_update_pmtu() and rt6_do_redirect()) to this GC list. As a result, these exceptions were never considered for expiration and removal, leading to stale entries persisting in the routing table.
This patch fixes the issue by calling fib6_add_gc_list() in rt6_insert_exception(), ensuring that exception routes are properly tracked and garbage collected when expired.
--- net/ipv6/route.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/route.c +1 -0
@@ -1771,6 +1771,7 @@ static int rt6_insert_exception(struct rt6_info *nrt,if (!err) {spin_lock_bh (&f6i->fib6_table->tb6_lock);fib6_update_sernum (net, f6i); +fib6_add_gc_list (f6i);spin_unlock_bh (&f6i->fib6_table->tb6_lock);fib6_force_start_gc (net); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/241 xen: fix multicall debug feature
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit 715ad3e0ec2b13c27335749f27a5c9f0c0e84064 ]
Initializing a percpu variable with the address of a struct tagged as .initdata is breaking the build with CONFIG_SECTION_MISMATCH_WARN_ONLY not set to "y".
Fix that by using an access function instead returning the .initdata struct address if the percpu space of the struct hasn't been allocated yet.
Message-ID: <[email protected]>
--- arch/x86/xen/multicalls.c | 26 ++++++++++++++------------ arch/x86/xen/smp_pv.c | 1 - arch/x86/xen/xen-ops.h | 3 --- 3 files changed, 14 insertions(+), 16 deletions(-)
arch/x86/xen/multicalls.c +14 -12
@@ -54,14 +54,20 @@ struct mc_debug_data { static DEFINE_PER_CPU(struct mc_buffer, mc_buffer);static struct mc_debug_data mc_debug_data_early__initdata ; -static DEFINE_PER_CPU(struct mc_debug_data *, mc_debug_data) = - &mc_debug_data_early;static struct mc_debug_data __percpu *mc_debug_data_ptr; DEFINE_PER_CPU(unsigned long, xen_mc_irq_flags);static struct static_key mc_debug__ro_after_init ;static bool mc_debug_enabled__initdata ; +static struct mc_debug_data *__ref get_mc_debug (void ) +{ +if (!mc_debug_data_ptr) +return &mc_debug_data_early; + +return this_cpu_ptr (mc_debug_data_ptr); +} +static int __init xen_parse_mc_debug (char *arg) { mc_debug_enabled = true;
@@ -71,20 +77,16 @@ static int __init xen_parse_mc_debug(char *arg) }early_param ("xen_mc_debug" , xen_parse_mc_debug); -void mc_percpu_init (unsigned int cpu) -{ -per_cpu (mc_debug_data, cpu) =per_cpu_ptr (mc_debug_data_ptr, cpu); -} -static int __init mc_debug_enable (void ) {unsigned long flags; +struct mc_debug_data __percpu *mcdb;if (!mc_debug_enabled)return 0 ; - mc_debug_data_ptr = alloc_percpu(struct mc_debug_data); -if (!mc_debug_data_ptr) { + mcdb = alloc_percpu(struct mc_debug_data); +if (!mcdb) {pr_err ("xen_mc_debug inactive\n" );static_key_slow_dec (&mc_debug);return -ENOMEM ;
@@ -93,7 +95,7 @@ static int __init mc_debug_enable(void)/* Be careful when switching to percpu debug data. */ local_irq_save (flags);xen_mc_flush (); -mc_percpu_init (0 ); + mc_debug_data_ptr = mcdb;local_irq_restore (flags);pr_info ("xen_mc_debug active\n" );
@@ -155,7 +157,7 @@ void xen_mc_flush(void)trace_xen_mc_flush (b->mcidx, b->argidx, b->cbidx);if (static_key_false (&mc_debug)) { - mcdb =__this_cpu_read (mc_debug_data); + mcdb =get_mc_debug ();memcpy (mcdb->entries, b->entries, b->mcidx *sizeof (struct multicall_entry )); }
@@ -235,7 +237,7 @@ struct multicall_space __xen_mc_entry(size_t args) ret.mc = &b->entries[b->mcidx];if (static_key_false (&mc_debug)) { -struct mc_debug_data *mcdb =__this_cpu_read (mc_debug_data); +struct mc_debug_data *mcdb =get_mc_debug (); mcdb->caller[b->mcidx] =__builtin_return_address (0 ); mcdb->argsz[b->mcidx] = args;
arch/x86/xen/smp_pv.c +0 -1
@@ -305,7 +305,6 @@ static int xen_pv_kick_ap(unsigned int cpu, struct task_struct *idle)return rc;xen_pmu_init (cpu); -mc_percpu_init (cpu);/* * Why is this a BUG? If the hypercall fails then everything can be
arch/x86/xen/xen-ops.h +0 -3
@@ -261,9 +261,6 @@ void xen_mc_callback(void (*fn)(void *), void *data);*/ struct multicall_space xen_mc_extend_args (unsigned long op,size_t arg_size); -/* Do percpu data initialization for multicalls. */ -void mc_percpu_init (unsigned int cpu); -extern bool is_xen_pmu;irqreturn_t xen_pmu_irq_handler (int irq,void *dev_id);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/241 mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit b129005ddfc0e6daf04a6d3b928a9e474f9b3918 ]
A warning is seen when running the latest kernel on a BlueField SOC:
[251.512704] ------------[ cut here ]------------ [251.512711] invalid sysfs_emit: buf:0000000003aa32ae [251.512720] WARNING: CPU: 1 PID: 705264 at fs/sysfs/file.c:767 sysfs_emit+0xac/0xc8
The warning is triggered because the mlxbf-bootctl driver invokes "sysfs_emit()" with a buffer pointer that is not aligned to the start of the page. The driver should instead use "sysfs_emit_at()" to support non-zero offsets into the destination buffer.
--- drivers/platform/mellanox/mlxbf-bootctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/mellanox/mlxbf-bootctl.c +2 -2
@@ -332,9 +332,9 @@ static ssize_t secure_boot_fuse_state_show(struct device *dev,else status = valid ?"Invalid" :"Free" ; } - buf_len +=sysfs_emit (buf + buf_len,"%d:%s " , key, status); + buf_len +=sysfs_emit_at (buf, buf_len,"%d:%s " , key, status); } - buf_len +=sysfs_emit (buf + buf_len,"\n" ); + buf_len +=sysfs_emit_at (buf, buf_len,"\n" );return buf_len; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/241 wifi: iwlwifi: pcie: set state to no-FW before reset handshake
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 5f05c14e7c198415abe936514a6905f8b545b63b ]
The reset handshake attempts to kill the firmware, and it'll go into a pretty much dead state once we do that. However, if it times out, then we'll attempt to dump the firmware to be able to see why it didn't respond. During this dump, we cannot treat it as if it was still running, since we just tried to kill it, otherwise dumping will attempt to send a DBGC stop command. As this command will time out, we'll go into a reset loop.
For now, fix this by setting the trans->state to say firmware isn't running before doing the reset handshake. In the longer term, we should clean up the way this state is handled.
It's not entirely clear but it seems likely that this issue was introduced by my rework of the error handling, prior to that it would've been synchronous at that point and (I think) not have attempted to reset since it was already doing down.
--- drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c +7 -1
@@ -147,8 +147,14 @@ static void _iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans)return ;if (trans->state >=IWL_TRANS_FW_STARTED && - trans_pcie->fw_reset_handshake) + trans_pcie->fw_reset_handshake) { +/* +* Reset handshake can dump firmware on timeout, but that +* should assume that the firmware is already dead. +*/ + trans->state =IWL_TRANS_NO_FW ;iwl_trans_pcie_fw_reset_handshake (trans); + } trans_pcie->is_down = true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/241 Revert "wifi: mac80211: Update skbs control block key in ieee80211_tx_dequeue()"
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 0937cb5f345c79d702b4d0d744e2a2529b551cb2 ]
This reverts commit a104042e2bf6528199adb6ca901efe7b60c2c27f.
Since the original bug seems to have been around for years, but a new issue was report with the fix, revert the fix for now. We have a couple of weeks to figure it out for this release, if needed.
--- net/mac80211/tx.c | 1 - 1 file changed, 1 deletion(-)
net/mac80211/tx.c +0 -1
@@ -3893,7 +3893,6 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,* The key can be removed while the packet was queued, so need to call * this here to get the current key. */ - info->control.hw_key =NULL ; r =ieee80211_tx_h_select_key (&tx);if (r !=TX_CONTINUE ) {ieee80211_free_txskb (&local->hw, skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/241 igc: fix PTM cycle trigger logic
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher S M Hall <[email protected]>
[ Upstream commit 8e404ad95d2c10c261e2ef6992c7c12dde03df0e ]
Writing to clear the PTM status 'valid' bit while the PTM cycle is triggered results in unreliable PTM operation. To fix this, clear the PTM 'trigger' and status after each PTM transaction.
The issue can be reproduced with the following:
$ sudo phc2sys -R 1000 -O 0 -i tsn0 -m
Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to quickly reproduce the issue.
PHC2SYS exits with:
"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
fails
This patch also fixes a hang in igc_probe() when loading the igc driver in the kdump kernel on systems supporting PTM.
The igc driver running in the base kernel enables PTM trigger in igc_probe(). Therefore the driver is always in PTM trigger mode, except in brief periods when manually triggering a PTM cycle.
When a crash occurs, the NIC is reset while PTM trigger is enabled. Due to a hardware problem, the NIC is subsequently in a bad busmaster state and doesn't handle register reads/writes. When running igc_probe() in the kdump kernel, the first register access to a NIC register hangs driver probing and ultimately breaks kdump.
With this patch, igc has PTM trigger disabled most of the time, and the trigger is only enabled for very brief (10 - 100 us) periods when manually triggering a PTM cycle. Chances that a crash occurs during a PTM trigger are not 0, but extremely reduced.
--- drivers/net/ethernet/intel/igc/igc_defines.h | 1 + drivers/net/ethernet/intel/igc/igc_ptp.c | 70 ++++++++++++-------- 2 files changed, 42 insertions(+), 29 deletions(-)
drivers/net/ethernet/intel/igc/igc_defines.h +1 -0
@@ -593,6 +593,7 @@#define IGC_PTM_STAT_T4M1_OVFL BIT(3)/* T4 minus T1 overflow */ #define IGC_PTM_STAT_ADJUST_1ST BIT(4)/* 1588 timer adjusted during 1st PTM cycle */ #define IGC_PTM_STAT_ADJUST_CYC BIT(5)/* 1588 timer adjusted during non-1st PTM cycle */ +#define IGC_PTM_STAT_ALL GENMASK(5, 0)/* Used to clear all status */ /* PCIe PTM Cycle Control */ #define IGC_PTM_CYCLE_CTRL_CYC_TIME (msec) ((msec) & 0x3ff)/* PTM Cycle Time (msec) */
drivers/net/ethernet/intel/igc/igc_ptp.c +41 -29
115 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/241 igc: increase wait time before retrying PTM
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher S M Hall <[email protected]>
[ Upstream commit 714cd033da6fea4cf54a11b3cfd070afde3f31df ]
The i225/i226 hardware retries if it receives an inappropriate response from the upstream device. If the device retries too quickly, the root port does not respond.
The wait between attempts was reduced from 10us to 1us in commit 6b8aa753a9f9 ("igc: Decrease PTM short interval from 10 us to 1 us"), which said:
With the 10us interval, we were seeing PTM transactions take around 12us. Hardware team suggested this interval could be lowered to 1us which was confirmed with PCIe sniffer. With the 1us interval, PTM dialogs took around 2us.
While a 1us short cycle time was thought to be theoretically sufficient, it turns out in practice it is not quite long enough. It is unclear if the problem is in the root port or an issue in i225/i226.
Increase the wait from 1us to 4us. Increasing to 2us appeared to work in practice on the setups we have available. A value of 4us was chosen due to the limited hardware available for testing, with a goal of ensuring we wait long enough without overly penalizing the response time when unnecessary.
The issue can be reproduced with the following:
$ sudo phc2sys -R 1000 -O 0 -i tsn0 -m
Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to quickly reproduce the issue.
PHC2SYS exits with:
"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
fails
--- drivers/net/ethernet/intel/igc/igc_defines.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/igc/igc_defines.h +4 -1
@@ -574,7 +574,10 @@#define IGC_PTM_CTRL_SHRT_CYC (usec) (((usec) & 0x3f) << 2)#define IGC_PTM_CTRL_PTM_TO (usec) (((usec) & 0xff) << 8) -#define IGC_PTM_SHORT_CYC_DEFAULT 1/* Default short cycle interval */ +/* A short cycle time of 1us theoretically should work, but appears to be too +* short in practice. +*/ +#define IGC_PTM_SHORT_CYC_DEFAULT 4/* Default short cycle interval */ #define IGC_PTM_CYC_TIME_DEFAULT 5/* Default PTM cycle time */ #define IGC_PTM_TIMEOUT_DEFAULT 255/* Default timeout for PTM errors */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/241 igc: move ktime snapshot into PTM retry loop
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher S M Hall <[email protected]>
[ Upstream commit cd7f7328d691937102732f39f97ead35b15bf803 ]
Move ktime_get_snapshot() into the loop. If a retry does occur, a more recent snapshot will result in a more accurate cross-timestamp.
--- drivers/net/ethernet/intel/igc/igc_ptp.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/ethernet/intel/igc/igc_ptp.c +9 -9
@@ -1011,16 +1011,16 @@ static int igc_phc_get_syncdevicetime(ktime_t *device,int err, count =100 ;ktime_t t1, t2_curr; -/* Get a snapshot of system clocks to use as historic value. */ -ktime_get_snapshot (&adapter->snapshot); - +/* Doing this in a loop because in the event of a +* badly timed (ha!) system clock adjustment, we may +* get PTM errors from the PCI root, but these errors +* are transitory. Repeating the process returns valid +* data eventually. +*/ do { - /* Doing this in a loop because in the event of a - * badly timed (ha!) system clock adjustment, we may - * get PTM errors from the PCI root, but these errors - * are transitory. Repeating the process returns valid - * data eventually. - */ + /* Get a snapshot of system clocks to use as historic value. */ + ktime_get_snapshot(&adapter->snapshot); + igc_ptm_trigger(hw); err = readx_poll_timeout(rd32, IGC_PTM_STAT, stat,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/241 igc: handle the IGC_PTP_ENABLED flag correctly
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher S M Hall <[email protected]>
[ Upstream commit 26a3910afd111f7c1a96dace6dc02f3225063896 ]
All functions in igc_ptp.c called from igc_main.c should check the IGC_PTP_ENABLED flag. Adding check for this flag to stop and reset functions.
--- drivers/net/ethernet/intel/igc/igc_ptp.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/intel/igc/igc_ptp.c +7 -0
@@ -1244,8 +1244,12 @@ void igc_ptp_suspend(struct igc_adapter *adapter)**/ void igc_ptp_stop (struct igc_adapter *adapter) { +if (!(adapter->ptp_flags &IGC_PTP_ENABLED )) +return ; +igc_ptp_suspend (adapter); + adapter->ptp_flags &= ~IGC_PTP_ENABLED ;if (adapter->ptp_clock) {ptp_clock_unregister (adapter->ptp_clock);netdev_info (adapter->netdev,"PHC removed\n" );
@@ -1266,6 +1270,9 @@ void igc_ptp_reset(struct igc_adapter *adapter)unsigned long flags;u32 timadj; +if (!(adapter->ptp_flags &IGC_PTP_ENABLED )) +return ; +/* reset the tstamp_config */ igc_ptp_set_timestamp_mode (adapter, &adapter->tstamp_config);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/241 igc: cleanup PTP module if probe fails
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher S M Hall <[email protected]>
[ Upstream commit 1f025759ba394dd53e434d2668cb0597886d9b69 ]
Make sure that the PTP module is cleaned up if the igc_probe() fails by calling igc_ptp_stop() on exit.
--- drivers/net/ethernet/intel/igc/igc_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/igc/igc_main.c +1 -0
@@ -7230,6 +7230,7 @@ static int igc_probe(struct pci_dev *pdev, err_register:igc_release_hw_control (adapter); +igc_ptp_stop (adapter); err_eeprom:if (!igc_check_reset_block (hw))igc_reset_phy (hw);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/241 igc: add lock preventing multiple simultaneous PTM transactions
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher S M Hall <[email protected]>
[ Upstream commit 1a931c4f5e6862e61a4b130cb76b422e1415f644 ]
Add a mutex around the PTM transaction to prevent multiple transactors
Multiple processes try to initiate a PTM transaction, one or all may fail. This can be reproduced by running two instances of the following:
$ sudo phc2sys -O 0 -i tsn0 -m
PHC2SYS exits with:
"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
fails
Note: Normally two instance of PHC2SYS will not run, but one process
should not break another.
--- drivers/net/ethernet/intel/igc/igc.h | 1 + drivers/net/ethernet/intel/igc/igc_ptp.c | 20 ++++++++++++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/igc/igc.h +1 -0
@@ -319,6 +319,7 @@ struct igc_adapter {struct timespec64 prev_ptp_time;/* Pre-reset PTP clock */ ktime_t ptp_reset_start;/* Reset time in clock mono */ struct system_time_snapshot snapshot; +struct mutex ptm_lock;/* Only allow one PTM transaction at a time */ char fw_version[32 ];
drivers/net/ethernet/intel/igc/igc_ptp.c +18 -2
@@ -974,6 +974,7 @@ static void igc_ptm_log_error(struct igc_adapter *adapter, u32 ptm_stat) } } +/* The PTM lock: adapter->ptm_lock must be held when calling igc_ptm_trigger() */ static void igc_ptm_trigger (struct igc_hw *hw) {u32 ctrl;
@@ -990,6 +991,7 @@ static void igc_ptm_trigger(struct igc_hw *hw)wrfl (); } +/* The PTM lock: adapter->ptm_lock must be held when calling igc_ptm_reset() */ static void igc_ptm_reset (struct igc_hw *hw) {u32 ctrl;
@@ -1068,9 +1070,16 @@ static int igc_ptp_getcrosststamp(struct ptp_clock_info *ptp, { struct igc_adapter *adapter = container_of(ptp, struct igc_adapter, ptp_caps); +int ret; -return get_device_system_crosststamp (igc_phc_get_syncdevicetime, - adapter, &adapter->snapshot, cts); +/* This blocks until any in progress PTM transactions complete */ +mutex_lock (&adapter->ptm_lock); + + ret =get_device_system_crosststamp (igc_phc_get_syncdevicetime, + adapter, &adapter->snapshot, cts); +mutex_unlock (&adapter->ptm_lock); + +return ret; } static int igc_ptp_getcyclesx64(struct ptp_clock_info *ptp,
@@ -1169,6 +1178,7 @@ void igc_ptp_init(struct igc_adapter *adapter)spin_lock_init (&adapter->ptp_tx_lock);spin_lock_init (&adapter->free_timer_lock);spin_lock_init (&adapter->tmreg_lock); +mutex_init (&adapter->ptm_lock); adapter->tstamp_config.rx_filter =HWTSTAMP_FILTER_NONE ; adapter->tstamp_config.tx_type =HWTSTAMP_TX_OFF ;
@@ -1181,6 +1191,7 @@ void igc_ptp_init(struct igc_adapter *adapter)if (IS_ERR (adapter->ptp_clock)) { adapter->ptp_clock =NULL ;netdev_err (netdev,"ptp_clock_register failed\n" ); +mutex_destroy (&adapter->ptm_lock); }else if (adapter->ptp_clock) {netdev_info (netdev,"PHC added\n" ); adapter->ptp_flags |=IGC_PTP_ENABLED ;
@@ -1210,10 +1221,12 @@ static void igc_ptm_stop(struct igc_adapter *adapter)struct igc_hw *hw = &adapter->hw;u32 ctrl; +mutex_lock (&adapter->ptm_lock); ctrl =rd32 (IGC_PTM_CTRL ); ctrl &= ~IGC_PTM_CTRL_EN ;wr32 (IGC_PTM_CTRL , ctrl); +mutex_unlock (&adapter->ptm_lock); }/**
@@ -1255,6 +1268,7 @@ void igc_ptp_stop(struct igc_adapter *adapter)netdev_info (adapter->netdev,"PHC removed\n" ); adapter->ptp_flags &= ~IGC_PTP_ENABLED ; } +mutex_destroy (&adapter->ptm_lock); }/**
@@ -1294,6 +1308,7 @@ void igc_ptp_reset(struct igc_adapter *adapter)if (!igc_is_crosststamp_supported (adapter))break ; +mutex_lock (&adapter->ptm_lock);wr32 (IGC_PCIE_DIG_DELAY ,IGC_PCIE_DIG_DELAY_DEFAULT );wr32 (IGC_PCIE_PHY_DELAY ,IGC_PCIE_PHY_DELAY_DEFAULT );
@@ -1317,6 +1332,7 @@ void igc_ptp_reset(struct igc_adapter *adapter)netdev_err (adapter->netdev,"Timeout reading IGC_PTM_STAT register\n" );igc_ptm_reset (hw); +mutex_unlock (&adapter->ptm_lock);break ;default :/* No work to do. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/241 perf tools: Remove evsel__handle_error_quirks()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 2b70702917337a8d6d07f03eed961e0119091647 ]
The evsel__handle_error_quirks() is to fixup invalid event attributes on some architecture based on the error code. Currently it's only used for AMD to disable precise_ip not to use IBS which has more restrictions.
But the commit c33aea446bf555ab changed call evsel__precise_ip_fallback for any errors so there's no difference with the above function. To make matter worse, it caused a problem with branch stack on Zen3.
The IBS doesn't support branch stack so it should use a regular core PMU event. The default event is set precise_max and it starts with 3. And evsel__precise_ip_fallback() tries with it and reduces the level one by one. At last it tries with 0 but it also failed on Zen3 since the branch stack is not supported for the cycles event.
At this point, evsel__precise_ip_fallback() restores the original precise_ip value (3) in the hope that it can succeed with other modifier (like exclude_kernel). Then evsel__handle_error_quirks() see it has precise_ip != 0 and make it retry with 0. This created an infinite loop.
Before:
$ perf record -b -vv |& grep removing removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD removing precise_ip on AMD ...
After:
$ perf record -b true Error: Failure to open event 'cycles:P' on PMU 'cpu' which will be removed. Invalid event (cycles:P) in per-thread mode, enable system wide with '-a'. Error: Failure to open any events for recording.
--- tools/perf/util/evsel.c | 22 ---------------------- 1 file changed, 22 deletions(-)
tools/perf/util/evsel.c +0 -22
@@ -2556,25 +2556,6 @@ static bool evsel__detect_missing_features(struct evsel *evsel, struct perf_cpureturn false; } -static bool evsel__handle_error_quirks (struct evsel *evsel,int error) -{ -/* -* AMD core PMU tries to forward events with precise_ip to IBS PMU -* implicitly. But IBS PMU has more restrictions so it can fail with -* supported event attributes. Let's forward it back to the core PMU -* by clearing precise_ip only if it's from precise_max (:P). -*/ -if ((error == -EINVAL || error == -ENOENT ) &&x86__is_amd_cpu () && - evsel->core.attr.precise_ip && evsel->precise_max) { - evsel->core.attr.precise_ip =0 ; -pr_debug2_peo ("removing precise_ip on AMD\n" ); -display_attr (&evsel->core.attr); -return true; - } - -return false; -} -static int evsel__open_cpu (struct evsel *evsel,struct perf_cpu_map *cpus,struct perf_thread_map *threads,int start_cpu_map_idx,int end_cpu_map_idx)
@@ -2720,9 +2701,6 @@ static int evsel__open_cpu(struct evsel *evsel, struct perf_cpu_map *cpus,if (evsel__precise_ip_fallback (evsel)) goto retry_open; -if (evsel__handle_error_quirks (evsel, err)) - goto retry_open; - out_close:if (err) threads->err_thread = thread;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/241 dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit d5f49921707cc73376ad6cf8410218b438fcd233 ]
make dt_binding_check:
Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml: maintainers:0: 'Frank Li' does not match '@'
from schema $id: http://devicetree.org/meta-schemas/base.yaml#
Fix this by adding Frank's email address.
--- .../devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml +1 -1
@@ -7,7 +7,7 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# title: Freescale Layerscape Reset Registers Module maintainers: - - Frank Li + - Frank Li <[email protected]> description: Reset Module includes chip reset, service processor control and Reset Control
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/241 smc: Fix lockdep false-positive for IPPROTO_SMC.
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 752e2217d789be2c6a6ac66554b981cd71cd9f31 ]
SMC consists of two sockets: smc_sock and kernel TCP socket.
Currently, there are two ways of creating the sockets, and syzbot reported a lockdep splat [0] for the newer way introduced by commit d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC").
socket(AF_SMC , SOCK_STREAM, SMCPROTO_SMC or SMCPROTO_SMC6)
socket(AF_INET or AF_INET6, SOCK_STREAM, IPPROTO_SMC)
When a socket is allocated, sock_lock_init() sets a lockdep lock class to sk->sk_lock.slock based on its protocol family. In the IPPROTO_SMC case, AF_INET or AF_INET6 lock class is assigned to smc_sock.
The repro sets IPV6_JOIN_ANYCAST for IPv6 UDP and SMC socket and exercises smc_switch_to_fallback() for IPPROTO_SMC.
1. smc_switch_to_fallback() is called under lock_sock() and holds
smc->clcsock_release_lock.
sk_lock-AF_INET6 -> &smc->clcsock_release_lock
(sk_lock-AF_SMC) 2. Setting IPV6_JOIN_ANYCAST to SMC holds smc->clcsock_release_lock and calls setsockopt() for the kernel TCP socket, which holds RTNL and the kernel socket's lock_sock().
&smc->clcsock_release_lock -> rtnl_mutex (-> k-sk_lock-AF_INET6)
3. Setting IPV6_JOIN_ANYCAST to UDP holds RTNL and lock_sock().
rtnl_mutex -> sk_lock-AF_INET6
Then, lockdep detects a false-positive circular locking,
.-> sk_lock-AF_INET6 -> &smc->clcsock_release_lock -> rtnl_mutex -. `-----------------------------------------------------------------'
but IPPROTO_SMC should have the same locking rule as AF_SMC.
sk_lock-AF_SMC -> &smc->clcsock_release_lock -> rtnl_mutex -> k-sk_lock-AF_INET6
Let's set the same lock class for smc_sock.
Given AF_SMC uses the same lock class for SMCPROTO_SMC and SMCPROTO_SMC6, we do not need to separate the class for AF_INET and AF_INET6.
[0]:
WARNING: possible circular locking dependency detected 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 Not tainted
syz.4.1528/11571 is trying to acquire lock:ffffffff8fef8de8 (rtnl_mutex){+.+.}-{4:4}, at: ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220
but task is already holding lock:ffff888027f596a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_clcsock_release+0x75/0xe0 net/smc/smc_close.c:30
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&smc->clcsock_release_lock){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730
smc_switch_to_fallback+0x2d/0xa00 net/smc/af_smc.c:903
smc_sendmsg+0x13d/0x520 net/smc/af_smc.c:2781
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:733 [inline]
____sys_sendmsg+0xaaf/0xc90 net/socket.c:2573
___sys_sendmsg+0x135/0x1e0 net/socket.c:2627
__sys_sendmsg+0x16e/0x220 net/socket.c:2659
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #1 (sk_lock-AF_INET6){+.+.}-{0:0}:
lock_sock_nested+0x3a/0xf0 net/core/sock.c:3645
lock_sock include/net/sock.h:1624 [inline]
sockopt_lock_sock net/core/sock.c:1133 [inline]
sockopt_lock_sock+0x54/0x70 net/core/sock.c:1124
do_ipv6_setsockopt+0x2160/0x4520 net/ipv6/ipv6_sockglue.c:567
ipv6_setsockopt+0xcb/0x170 net/ipv6/ipv6_sockglue.c:993
udpv6_setsockopt+0x7d/0xd0 net/ipv6/udp.c:1850
do_sock_setsockopt+0x222/0x480 net/socket.c:2303
__sys_setsockopt+0x1a0/0x230 net/socket.c:2328
__do_sys_setsockopt net/socket.c:2334 [inline]
__se_sys_setsockopt net/socket.c:2331 [inline]
__x64_sys_setsockopt+0xbd/0x160 net/socket.c:2331
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #0 (rtnl_mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain kernel/locking/lockdep.c:3906 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730
ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220
inet6_release+0x47/0x70 net/ipv6/af_inet6.c:485
__sock_release net/socket.c:647 [inline]
sock_release+0x8e/0x1d0 net/socket.c:675
smc_clcsock_release+0xb7/0xe0 net/smc/smc_close.c:34
__smc_release+0x5c2/0x880 net/smc/af_smc.c:301
smc_release+0x1fc/0x5f0 net/smc/af_smc.c:344
__sock_release+0xb0/0x270 net/socket.c:647
sock_close+0x1c/0x30 net/socket.c:1398
__fput+0x3ff/0xb70 fs/file_table.c:464
task_work_run+0x14e/0x250 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7fother info that might help us debug this:
Chain exists of: rtnl_mutex --> sk_lock-AF_INET6 --> &smc->clcsock_release_lock Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&smc->clcsock_release_lock);
lock(sk_lock-AF_INET6);
lock(&smc->clcsock_release_lock); lock(rtnl_mutex);
*** DEADLOCK ***
2 locks held by syz.4.1528/11571:
#0: ffff888077e88208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:877 [inline] #0: ffff888077e88208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646 #1: ffff888027f596a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_clcsock_release+0x75/0xe0 net/smc/smc_close.c:30
stack backtrace: CPU: 0 UID: 0 PID: 11571 Comm: syz.4.1528 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_circular_bug+0x490/0x760 kernel/locking/lockdep.c:2076 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2208 check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain kernel/locking/lockdep.c:3906 [inline] __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730 ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220 inet6_release+0x47/0x70 net/ipv6/af_inet6.c:485 __sock_release net/socket.c:647 [inline] sock_release+0x8e/0x1d0 net/socket.c:675 smc_clcsock_release+0xb7/0xe0 net/smc/smc_close.c:34 __smc_release+0x5c2/0x880 net/smc/af_smc.c:301 smc_release+0x1fc/0x5f0 net/smc/af_smc.c:344 __sock_release+0xb0/0x270 net/socket.c:647 sock_close+0x1c/0x30 net/socket.c:1398 __fput+0x3ff/0xb70 fs/file_table.c:464 task_work_run+0x14e/0x250 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8b4b38d169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe4efd22d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000b14a3 RCX: 00007f8b4b38d169 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f8b4b5a7ba0 R08: 0000000000000001 R09: 000000114efd25cf R10: 00007f8b4b200000 R11: 0000000000000246 R12: 00007f8b4b5a5fac R13: 00007f8b4b5a5fa0 R14: ffffffffffffffff R15: 00007ffe4efd23f0 </TASK>
--- net/smc/af_smc.c | 5 +++++ 1 file changed, 5 insertions(+)
net/smc/af_smc.c +5 -0
@@ -362,6 +362,9 @@ static void smc_destruct(struct sock *sk)return ; } +static struct lock_class_key smc_key; +static struct lock_class_key smc_slock_key; +void smc_sk_init (struct net *net,struct sock *sk,int protocol) {struct smc_sock *smc =smc_sk (sk);
@@ -375,6 +378,8 @@ void smc_sk_init(struct net *net, struct sock *sk, int protocol)INIT_WORK (&smc->connect_work, smc_connect_work);INIT_DELAYED_WORK (&smc->conn.tx_work, smc_tx_work);INIT_LIST_HEAD (&smc->accept_q); +sock_lock_init_class_and_name (sk,"slock-AF_SMC" , &smc_slock_key, +"sk_lock-AF_SMC" , &smc_key);spin_lock_init (&smc->accept_q_lock);spin_lock_init (&smc->conn.send_lock); sk->sk_prot->hash (sk);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/241 test suite: use %zu to print size_t
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit a30951d09c33c899f0e4aca80eb87fad5f10ecfa ]
On 32-bit, we can't use %lu to print a size_t variable and gcc warns us about it. Shame it doesn't warn about it on 64-bit.
--- tools/testing/shared/linux.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/shared/linux.c +2 -2
@@ -150,7 +150,7 @@ void kmem_cache_free(struct kmem_cache *cachep, void *objp)void kmem_cache_free_bulk (struct kmem_cache *cachep,size_t size,void **list) {if (kmalloc_verbose) -pr_debug ("Bulk free %p[0-%lu]\n" , list, size -1 ); +pr_debug ("Bulk free %p[0-%zu]\n" , list, size -1 );pthread_mutex_lock (&cachep->lock);for (int i =0 ; i < size; i++)
@@ -168,7 +168,7 @@ int kmem_cache_alloc_bulk(struct kmem_cache *cachep, gfp_t gfp, size_t size,size_t i;if (kmalloc_verbose) -pr_debug ("Bulk alloc %lu\n" , size); +pr_debug ("Bulk alloc %zu\n" , size);pthread_mutex_lock (&cachep->lock);if (cachep->nr_objs >= size) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/241 selftests: mincore: fix tmpfs mincore test failure
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Wang <[email protected]>
[ Upstream commit 8c583e538aa681ecb293d5606054de70f44b5558 ]
When running mincore test cases, I encountered the following failures:
"
mincore_selftest.c:359:check_tmpfs_mmap:Expected ra_pages (511) == 0 (0) mincore_selftest.c:360:check_tmpfs_mmap:Read-ahead pages found in memorycheck_tmpfs_mmap: Test terminated by assertion
FAIL global.check_tmpfs_mmap
not ok 5 global.check_tmpfs_mmap
FAILED: 4 / 5 tests passed
"
The reason for the test case failure is that my system automatically enabled tmpfs large folio allocation by adding the 'transparent_hugepage_tmpfs=always' cmdline. However, the test case still expects the tmpfs mounted on /dev/shm to allocate small folios, which leads to assertion failures when verifying readahead pages.
As discussed with David, there's no reason to continue checking the readahead logic for tmpfs. Drop it to fix this issue.
--- .../testing/selftests/mincore/mincore_selftest.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-)
tools/testing/selftests/mincore/mincore_selftest.c +2 -14
@@ -286,8 +286,7 @@ TEST(check_file_mmap)/* * Test mincore() behavior on a page backed by a tmpfs file. This test -* performs the same steps as the previous one. However, we don't expect -* any readahead in this case. +* performs the same steps as the previous one. */ TEST (check_tmpfs_mmap) {
@@ -298,7 +297,6 @@ TEST(check_tmpfs_mmap)int page_size;int fd;int i; -int ra_pages =0 ; page_size =sysconf (_SC_PAGESIZE); vec_size =FILE_SIZE / page_size;
@@ -341,8 +339,7 @@ TEST(check_tmpfs_mmap) }/* -* Touch a page in the middle of the mapping. We expect only -* that page to be fetched into memory. +* Touch a page in the middle of the mapping. */ addr[FILE_SIZE /2 ] =1 ; retval =mincore (addr,FILE_SIZE , vec);
@@ -351,15 +348,6 @@ TEST(check_tmpfs_mmap)TH_LOG ("Page not found in memory after use" ); } - i =FILE_SIZE /2 / page_size +1 ; -while (i < vec_size && vec[i]) { - ra_pages++; - i++; - } - ASSERT_EQ(ra_pages, 0) { -TH_LOG ("Read-ahead pages found in memory" ); - } -munmap (addr,FILE_SIZE );close (fd);free (vec);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/241 pds_core: fix memory leak in pdsc_debugfs_add_qcq()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 8b82f656826c741d032490b089a5638c33f2c91d ]
The memory allocated for intr_ctrl_regset, which is passed to debugfs_create_regset32() may not be cleaned up when the driver is removed. Fix that by using device managed allocation for it.
--- drivers/net/ethernet/amd/pds_core/debugfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/amd/pds_core/debugfs.c +3 -2
@@ -154,8 +154,9 @@ void pdsc_debugfs_add_qcq(struct pdsc *pdsc, struct pdsc_qcq *qcq)debugfs_create_u32 ("index" ,0400 , intr_dentry, &intr->index);debugfs_create_u32 ("vector" ,0400 , intr_dentry, &intr->vector); - intr_ctrl_regset =kzalloc (sizeof (*intr_ctrl_regset), -GFP_KERNEL ); + intr_ctrl_regset =devm_kzalloc (pdsc->dev, +sizeof (*intr_ctrl_regset), +GFP_KERNEL );if (!intr_ctrl_regset)return ; intr_ctrl_regset->regs = intr_ctrl_regs;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/241 ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damodharam Ammepalli <[email protected]>
[ Upstream commit f3fdd4fba16c74697d8bc730b82fb7c1eff7fab3 ]
rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct size of rpl is sizeof(*rpl) which should be just 1 byte. Using the pointer size instead can cause stack corruption:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 Workqueue: events module_flash_fw_work Call Trace: <TASK> panic+0x339/0x360 ? ethtool_cmis_wait_for_cond+0xf4/0x100 ? __pfx_status_success+0x10/0x10 ? __pfx_status_fail+0x10/0x10 __stack_chk_fail+0x10/0x10 ethtool_cmis_wait_for_cond+0xf4/0x100 ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 ? __pfx_status_fail+0x10/0x10 cmis_cdb_module_features_get+0x6d/0xd0 ethtool_cmis_cdb_init+0x8a/0xd0 ethtool_cmis_fw_update+0x46/0x1d0 module_flash_fw_work+0x17/0xa0 process_one_work+0x179/0x390 worker_thread+0x239/0x340 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
--- net/ethtool/cmis_cdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ethtool/cmis_cdb.c +1 -1
@@ -351,7 +351,7 @@ ethtool_cmis_module_poll(struct net_device *dev,struct netlink_ext_ack extack = {};int err; -ethtool_cmis_page_init (&page_data,0 , offset,sizeof (rpl)); +ethtool_cmis_page_init (&page_data,0 , offset,sizeof (*rpl)); page_data.data = (u8 *)rpl; err = ops->get_module_eeprom_by_page (dev, &page_data, &extack);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/241 net: mctp: Set SOCK_RCU_FREE
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Johnston <[email protected]>
[ Upstream commit 52024cd6ec71a6ca934d0cc12452bd8d49850679 ]
Bind lookup runs under RCU, so ensure that a socket doesn't go away in the middle of a lookup.
--- net/mctp/af_mctp.c | 3 +++ 1 file changed, 3 insertions(+)
net/mctp/af_mctp.c +3 -0
@@ -630,6 +630,9 @@ static int mctp_sk_hash(struct sock *sk) {struct net *net =sock_net (sk); +/* Bind lookup runs under RCU, remain live during that. */ +sock_set_flag (sk,SOCK_RCU_FREE ); +mutex_lock (&net->mctp.bind_lock);sk_add_node_rcu (sk, &net->mctp.binds);mutex_unlock (&net->mctp.bind_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/241 net: hibmcge: fix incorrect pause frame statistics issue
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 5b04080cd6028f0737bbbd0c5b462d226cff9052 ]
The driver supports pause frames,
but does not pass pause frames based on rx pause enable configuration, resulting in incorrect pause frame statistics.
like this:
mz eno3 '01 80 c2 00 00 01 00 18 2d 04 00 9c 88 08 00 01 ff ff' \ -p 64 -c 100
ethtool -S enp132s0f2 | grep -v ": 0"
NIC statistics:
rx_octets_total_filt_cnt: 6800
rx_filt_pkt_cnt: 100The rx pause frames are filtered by the MAC hardware.
This patch configures pass pause frames based on the rx puase enable status to ensure that
rx pause frames are not filtered.
mz eno3 '01 80 c2 00 00 01 00 18 2d 04 00 9c 88 08 00 01 ff ff' \
-p 64 -c 100ethtool --include-statistics -a enp132s0f2
Pause parameters for enp132s0f2:
Autonegotiate: on
RX: on
TX: on
RX negotiated: on
TX negotiated: on
Statistics:
tx_pause_frames: 0
rx_pause_frames: 100
--- drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c | 3 +++ drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h | 1 + 2 files changed, 4 insertions(+)
drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c +3 -0
@@ -232,6 +232,9 @@ void hbg_hw_set_pause_enable(struct hbg_priv *priv, u32 tx_en, u32 rx_en) HBG_REG_PAUSE_ENABLE_TX_B, tx_en);hbg_reg_write_field (priv,HBG_REG_PAUSE_ENABLE_ADDR ,HBG_REG_PAUSE_ENABLE_RX_B , rx_en); + +hbg_reg_write_field (priv,HBG_REG_REC_FILT_CTRL_ADDR , +HBG_REG_REC_FILT_CTRL_PAUSE_FRM_PASS_B , rx_en); }void hbg_hw_get_pause_enable (struct hbg_priv *priv,u32 *tx_en,u32 *rx_en)
drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h +1 -0
@@ -60,6 +60,7 @@#define HBG_REG_TRANSMIT_CTRL_AN_EN_B BIT(5)#define HBG_REG_REC_FILT_CTRL_ADDR (HBG_REG_SGMII_BASE + 0x0064)#define HBG_REG_REC_FILT_CTRL_UC_MATCH_EN_B BIT(0) +#define HBG_REG_REC_FILT_CTRL_PAUSE_FRM_PASS_B BIT(4)#define HBG_REG_LINE_LOOP_BACK_ADDR (HBG_REG_SGMII_BASE + 0x01A8)#define HBG_REG_CF_CRC_STRIP_ADDR (HBG_REG_SGMII_BASE + 0x01B0)#define HBG_REG_CF_CRC_STRIP_B BIT(0)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/241 net: hibmcge: fix incorrect multicast filtering issue
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 9afaaa54e3eb9b64fc07c06741897800e98ac253 ]
The driver does not support multicast filtering,
the mask must be set to 0xFFFFFFFF. Otherwise,
incorrect filtering occurs.
This patch fixes this problem.
--- drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c | 4 ++++ drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h | 2 ++ 2 files changed, 6 insertions(+)
drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c +4 -0
@@ -224,6 +224,10 @@ void hbg_hw_set_mac_filter_enable(struct hbg_priv *priv, u32 enable) {hbg_reg_write_field (priv,HBG_REG_REC_FILT_CTRL_ADDR ,HBG_REG_REC_FILT_CTRL_UC_MATCH_EN_B , enable); + +/* only uc filter is supported, so set all bits of mc mask reg to 1 */ +hbg_reg_write64 (priv,HBG_REG_STATION_ADDR_LOW_MSK_0 ,U64_MAX ); +hbg_reg_write64 (priv,HBG_REG_STATION_ADDR_LOW_MSK_1 ,U64_MAX ); }void hbg_hw_set_pause_enable (struct hbg_priv *priv,u32 tx_en,u32 rx_en)
drivers/net/ethernet/hisilicon/hibmcge/hbg_reg.h +2 -0
@@ -82,6 +82,8 @@#define HBG_REG_STATION_ADDR_HIGH_4_ADDR (HBG_REG_SGMII_BASE + 0x0224)#define HBG_REG_STATION_ADDR_LOW_5_ADDR (HBG_REG_SGMII_BASE + 0x0228)#define HBG_REG_STATION_ADDR_HIGH_5_ADDR (HBG_REG_SGMII_BASE + 0x022C) +#define HBG_REG_STATION_ADDR_LOW_MSK_0 (HBG_REG_SGMII_BASE + 0x0230) +#define HBG_REG_STATION_ADDR_LOW_MSK_1 (HBG_REG_SGMII_BASE + 0x0238)/* PCU */ #define HBG_REG_TX_FIFO_THRSLD_ADDR (HBG_REG_SGMII_BASE + 0x0420)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/241 net: hibmcge: fix wrong mtu log issue
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 4e4ac53335de54bcb9d26842df0998cfd8fcaf90 ]
A dbg log is generated when the driver modifies the MTU, which is expected to trace the change of the MTU.
However, the log is recorded after WRITE_ONCE(). At this time, netdev->mtu has been changed to the new value. As a result, netdev->mtu is the same as new_mtu.
This patch modifies the log location and records logs before WRITE_ONCE().
--- drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c +3 -3
@@ -198,12 +198,12 @@ static int hbg_net_change_mtu(struct net_device *netdev, int new_mtu)if (netif_running (netdev))return -EBUSY ; -hbg_hw_set_mtu (priv, new_mtu); -WRITE_ONCE (netdev->mtu, new_mtu); -dev_dbg (&priv->pdev->dev,"change mtu from %u to %u\n" , netdev->mtu, new_mtu); +hbg_hw_set_mtu (priv, new_mtu); +WRITE_ONCE (netdev->mtu, new_mtu); +return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/241 net: hibmcge: fix not restore rx pause mac addr after reset issue
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit ae6c1dce3244e31011ee65f89fc2484f3cf6cf85 ]
The MAC hardware supports receiving two types of pause frames from link partner.
One is a pause frame with a destination address of 01:80:C2:00:00:01.
The other is a pause frame whose destination address is the address of the hibmcge driver.
01:80:C2:00:00:01 is supported by default.
In .ndo_set_mac_address(), the hibmcge driver calls .hbg_hw_set_rx_pause_mac_addr() to set its mac address as the destination address of the rx puase frame.
Therefore, pause frames with two types of MAC addresses can be received.
Currently, the rx pause addr does not restored after reset. As a result, pause frames whose destination address is the hibmcge driver address cannot be correctly received.
This patch restores the configuration by calling .hbg_hw_set_rx_pause_mac_addr() after reset is complete.
--- drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c +3 -0
@@ -26,12 +26,15 @@ static void hbg_restore_mac_table(struct hbg_priv *priv)static void hbg_restore_user_def_settings (struct hbg_priv *priv) { +/* The index of host mac is always 0. */ +u64 rx_pause_addr =ether_addr_to_u64 (priv->filter.mac_table[0 ].addr);struct ethtool_pauseparam *pause_param = &priv->user_def.pause_param;hbg_restore_mac_table (priv);hbg_hw_set_mtu (priv, priv->netdev->mtu);hbg_hw_set_pause_enable (priv, pause_param->tx_pause, pause_param->rx_pause); +hbg_hw_set_rx_pause_mac_addr (priv, rx_pause_addr); }int hbg_rebuild (struct hbg_priv *priv)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/241 block: fix resource leak in blk_register_queue() error path
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 40f2eb9b531475dd01b683fdaf61ca3cfd03a51e ]
When registering a queue fails after blk_mq_sysfs_register() is successful but the function later encounters an error, we need to clean up the blk_mq_sysfs resources.
Add the missing blk_mq_sysfs_unregister() call in the error path to properly clean up these resources and prevent a memory leak.
--- block/blk-sysfs.c | 2 ++ 1 file changed, 2 insertions(+)
block/blk-sysfs.c +2 -0
@@ -824,6 +824,8 @@ int blk_register_queue(struct gendisk *disk) out_debugfs_remove:blk_debugfs_remove (disk);mutex_unlock (&q->sysfs_lock); +if (queue_is_mq (q)) +blk_mq_sysfs_unregister (disk); out_put_queue_kobj:kobject_put (&disk->queue_kobj);return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/241 netlink: specs: ovs_vport: align with C codegen capabilities
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 747fb8413aaa36e4c988d45c4fe20d4c2b0778cd ]
We started generating C code for OvS a while back, but actually C codegen only supports fixed headers specified at the family level right now (schema also allows specifying them per op). ovs_flow and ovs_datapath already specify the fixed header at the family level but ovs_vport does it per op. Move the property, all ops use the same header.
This ensures YNL C sees the correct hdr_len:
const struct ynl_family ynl_ovs_vport_family = {
.name = "ovs_vport", - .hdr_len = sizeof(struct genlmsghdr), + .hdr_len = sizeof(struct genlmsghdr) + sizeof(struct ovs_header),
};
--- Documentation/netlink/specs/ovs_vport.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
Documentation/netlink/specs/ovs_vport.yaml +1 -3
@@ -123,12 +123,12 @@ attribute-sets: operations: name-prefix: ovs-vport-cmd- + fixed-header: ovs-header list: - name: new doc: Create a new OVS vport attribute-set: vport - fixed-header: ovs-header do: request: attributes:
@@ -141,7 +141,6 @@ operations: name: del doc: Delete existing OVS vport from a data path attribute-set: vport - fixed-header: ovs-header do: request: attributes:
@@ -152,7 +151,6 @@ operations: name: get doc: Get / dump OVS vport configuration and state attribute-set: vport - fixed-header: ovs-header do: &vport-get-op request: attributes:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/241 net: openvswitch: fix nested key length validation in the set() action
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <[email protected]>
[ Upstream commit 65d91192aa66f05710cfddf6a14b5a25ee554dba ]
It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first.
--- net/openvswitch/flow_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/openvswitch/flow_netlink.c +2 -1
@@ -2876,7 +2876,8 @@ static int validate_set(const struct nlattr *a,size_t key_len;/* There can be only one key in a action */ -if (nla_total_size (nla_len (ovs_key)) !=nla_len (a)) +if (!nla_ok (ovs_key,nla_len (a)) || +nla_total_size (nla_len (ovs_key)) !=nla_len (a))return -EINVAL ; key_len =nla_len (ovs_key);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/241 can: rockchip_canfd: fix broken quirks checks
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weizhao Ouyang <[email protected]>
[ Upstream commit 6315d93541f8a5f77c5ef5c4f25233e66d189603 ]
First get the devtype_data then check quirks.
--- drivers/net/can/rockchip/rockchip_canfd-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/can/rockchip/rockchip_canfd-core.c +4 -3
@@ -902,15 +902,16 @@ static int rkcanfd_probe(struct platform_device *pdev) priv->can.data_bittiming_const = &rkcanfd_data_bittiming_const; priv->can.ctrlmode_supported =CAN_CTRLMODE_LOOPBACK |CAN_CTRLMODE_BERR_REPORTING ; -if (!(priv->devtype_data.quirks &RKCANFD_QUIRK_CANFD_BROKEN )) - priv->can.ctrlmode_supported |=CAN_CTRLMODE_FD ; priv->can.do_set_mode = rkcanfd_set_mode; priv->can.do_get_berr_counter = rkcanfd_get_berr_counter; priv->ndev = ndev; match =device_get_match_data (&pdev->dev); -if (match) +if (match) { priv->devtype_data = *(struct rkcanfd_devtype_data *)match; +if (!(priv->devtype_data.quirks &RKCANFD_QUIRK_CANFD_BROKEN )) + priv->can.ctrlmode_supported |=CAN_CTRLMODE_FD ; + } err =can_rx_offload_add_manual (ndev, &priv->offload,RKCANFD_NAPI_WEIGHT );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/241 net: ngbe: fix memory leak in ngbe_probe() error path
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 88fa80021b77732bc98f73fb69d69c7cc37b9f0d ]
When ngbe_sw_init() is called, memory is allocated for wx->rss_key in wx_init_rss_key(). However, in ngbe_probe() function, the subsequent error paths after ngbe_sw_init() don't free the rss_key. Fix that by freeing it in error path along with wx->mac_table.
Also change the label to which execution jumps when ngbe_sw_init() fails, because otherwise, it could lead to a double free for rss_key, when the mac_table allocation fails in wx_sw_init().
--- drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/wangxun/ngbe/ngbe_main.c +2 -1
@@ -607,7 +607,7 @@ static int ngbe_probe(struct pci_dev *pdev,/* setup the private structure */ err =ngbe_sw_init (wx);if (err) - goto err_free_mac_table; + goto err_pci_release_regions;/* check if flash load is done after hw power up */ err =wx_check_flash_load (wx,NGBE_SPI_ILDR_STATUS_PERST );
@@ -701,6 +701,7 @@ static int ngbe_probe(struct pci_dev *pdev, err_clear_interrupt_scheme:wx_clear_interrupt_scheme (wx); err_free_mac_table: +kfree (wx->rss_key);kfree (wx->mac_table); err_pci_release_regions: pci_release_selected_regions(pdev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/241 octeontx2-pf: handle otx2_mbox_get_rsp errors
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit 688abe1027d00b7d4b2ce2d8764a2ae5ec6d250b ]
Adding error pointer check after calling otx2_mbox_get_rsp().
This is similar to the commit bd3110bc102a ("octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c").
--- drivers/net/ethernet/marvell/octeontx2/nic/rep.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/rep.c +2 -0
@@ -67,6 +67,8 @@ static int rvu_rep_mcam_flow_init(struct rep_dev *rep) rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp (&priv->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) + goto exit;for (ent =0 ; ent < rsp->count; ent++) rep->flow_cfg->flow_ent[ent + allocated] = rsp->entry_list[ent];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/241 net: ethernet: ti: am65-cpsw: fix port_np reference counting
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit 903d2b9f9efc5b3339d74015fcfc0d9fff276c4c ]
A reference to the device tree node is stored in a private struct, thus the reference count has to be incremented. Also, decrement the count on device removal and in the error path.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +14 -1
@@ -2756,7 +2756,7 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)of_property_read_bool (port_np,"ti,mac-only" );/* get phy/link info */ - port->slave.port_np = port_np; + port->slave.port_np =of_node_get (port_np); ret =of_get_phy_mode (port_np, &port->slave.phy_if);if (ret) { dev_err(dev, "%pOF read phy-mode err %d\n",
@@ -2810,6 +2810,17 @@ static void am65_cpsw_nuss_phylink_cleanup(struct am65_cpsw_common *common) } } +static void am65_cpsw_remove_dt (struct am65_cpsw_common *common) +{ +struct am65_cpsw_port *port; +int i; + +for (i =0 ; i < common->port_num; i++) { + port = &common->ports[i]; +of_node_put (port->slave.port_np); + } +} +static int am65_cpsw_nuss_init_port_ndev (struct am65_cpsw_common *common,u32 port_idx) {
@@ -3708,6 +3719,7 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev)am65_cpsw_nuss_cleanup_ndev (common);am65_cpsw_nuss_phylink_cleanup (common);am65_cpts_release (common->cpts); +am65_cpsw_remove_dt (common); err_of_clear:if (common->mdio_dev)of_platform_device_destroy (common->mdio_dev,NULL );
@@ -3747,6 +3759,7 @@ static void am65_cpsw_nuss_remove(struct platform_device *pdev)am65_cpsw_nuss_phylink_cleanup (common);am65_cpts_release (common->cpts);am65_cpsw_disable_serdes_phy (common); +am65_cpsw_remove_dt (common);if (common->mdio_dev)of_platform_device_destroy (common->mdio_dev,NULL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/241 eth: bnxt: fix missing ring index trim on error path
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 12f2d033fae957d84c2c0ce604d2a077e61fa2c0 ]
Commit under Fixes converted tx_prod to be free running but missed masking it on the Tx error path. This crashes on error conditions, for example when DMA mapping fails.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -2
@@ -783,7 +783,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)dev_kfree_skb_any (skb); tx_kick_pending:if (BNXT_TX_PTP_IS_SET (lflags)) { - txr->tx_buf_ring[txr->tx_prod].is_ts_pkt =0 ; + txr->tx_buf_ring[RING_TX (bp, txr->tx_prod)].is_ts_pkt =0 ;atomic64_inc (&bp->ptp_cfg->stats.ts_err);if (!(bp->fw_cap &BNXT_FW_CAP_TX_TS_CMP ))/* set SKB to err so PTP worker will clean up */
@@ -791,7 +791,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) }if (txr->kick_pending)bnxt_txr_db_kick (bp, txr, txr->tx_prod); - txr->tx_buf_ring[txr->tx_prod].skb =NULL ; + txr->tx_buf_ring[RING_TX (bp, txr->tx_prod)].skb =NULL ;dev_core_stats_tx_dropped_inc (dev);return NETDEV_TX_OK ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/241 loop: aio inherit the ioprio of original request
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunlong Xing <[email protected]>
[ Upstream commit 1fdb8188c3d505452b40cdb365b1bb32be533a8e ]
Set cmd->iocb.ki_ioprio to the ioprio of loop device's request. The purpose is to inherit the original request ioprio in the aio flow.
Stable-dep-of: f2fed441c69b ("loop: stop using vfs_iter_{read,write} for buffered I/O")
--- drivers/block/loop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/loop.c +1 -1
@@ -471,7 +471,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, cmd->iocb.ki_filp = file; cmd->iocb.ki_complete = lo_rw_aio_complete; cmd->iocb.ki_flags =IOCB_DIRECT ; - cmd->iocb.ki_ioprio =IOPRIO_PRIO_VALUE (IOPRIO_CLASS_NONE ,0 ); + cmd->iocb.ki_ioprio =req_get_ioprio (rq);if (rw ==ITER_SOURCE ) ret = file->f_op->write_iter (&cmd->iocb, &iter);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/241 loop: stop using vfs_iter_{read,write} for buffered I/O
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit f2fed441c69b9237760840a45a004730ff324faf ]
vfs_iter_{read,write} always perform direct I/O when the file has the O_DIRECT flag set, which breaks disabling direct I/O using the LOOP_SET_STATUS / LOOP_SET_STATUS64 ioctls.
This was recenly reported as a regression, but as far as I can tell was only uncovered by better checking for block sizes and has been around since the direct I/O support was added.
Fix this by using the existing aio code that calls the raw read/write iter methods instead. Note that despite the comments there is no need for block drivers to ever call flush_dcache_page themselves, and the call is a left-over from prehistoric times.
--- drivers/block/loop.c | 112 +++++++------------------------------------ 1 file changed, 17 insertions(+), 95 deletions(-)
drivers/block/loop.c +17 -95
@@ -235,72 +235,6 @@ static void loop_set_size(struct loop_device *lo, loff_t size)kobject_uevent (&disk_to_dev (lo->lo_disk)->kobj,KOBJ_CHANGE ); } -static int lo_write_bvec (struct file *file,struct bio_vec *bvec,loff_t *ppos) -{ -struct iov_iter i; -ssize_t bw; - -iov_iter_bvec (&i,ITER_SOURCE , bvec,1 , bvec->bv_len); - - bw =vfs_iter_write (file, &i, ppos,0 ); - -if (likely (bw == bvec->bv_len)) -return 0 ; - -printk_ratelimited (KERN_ERR -"loop: Write error at byte offset %llu, length %i.\n" , - (unsigned long long )*ppos, bvec->bv_len); -if (bw >=0 ) - bw = -EIO ; -return bw; -} - -static int lo_write_simple (struct loop_device *lo,struct request *rq, -loff_t pos) -{ -struct bio_vec bvec; -struct req_iterator iter; -int ret =0 ; - -rq_for_each_segment (bvec, rq, iter) { - ret =lo_write_bvec (lo->lo_backing_file, &bvec, &pos); -if (ret <0 ) -break ; -cond_resched (); - } - -return ret; -} - -static int lo_read_simple (struct loop_device *lo,struct request *rq, -loff_t pos) -{ -struct bio_vec bvec; -struct req_iterator iter; -struct iov_iter i; -ssize_t len; - -rq_for_each_segment (bvec, rq, iter) { -iov_iter_bvec (&i,ITER_DEST , &bvec,1 , bvec.bv_len); - len =vfs_iter_read (lo->lo_backing_file, &i, &pos,0 ); -if (len <0 ) -return len; - -flush_dcache_page (bvec.bv_page); - -if (len != bvec.bv_len) { -struct bio *bio; - -__rq_for_each_bio (bio, rq) -zero_fill_bio (bio); -break ; - } -cond_resched (); - } - -return 0 ; -} -static void loop_clear_limits (struct loop_device *lo,int mode) {struct queue_limits lim =queue_limits_start_update (lo->lo_queue);
@@ -366,7 +300,7 @@ static void lo_complete_rq(struct request *rq)struct loop_cmd *cmd =blk_mq_rq_to_pdu (rq);blk_status_t ret =BLK_STS_OK ; -if (!cmd->use_aio || cmd->ret <0 || cmd->ret ==blk_rq_bytes (rq) || +if (cmd->ret <0 || cmd->ret ==blk_rq_bytes (rq) ||req_op (rq) !=REQ_OP_READ ) {if (cmd->ret <0 ) ret =errno_to_blk_status (cmd->ret);
@@ -382,14 +316,13 @@ static void lo_complete_rq(struct request *rq) cmd->ret =0 ;blk_mq_requeue_request (rq, true); }else { -if (cmd->use_aio) { -struct bio *bio = rq->bio; +struct bio *bio = rq->bio; -while (bio) { -zero_fill_bio (bio); - bio = bio->bi_next; - } +while (bio) { +zero_fill_bio (bio); + bio = bio->bi_next; } + ret =BLK_STS_IOERR ; end_io:blk_mq_end_request (rq, ret);
@@ -469,9 +402,14 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, cmd->iocb.ki_pos = pos; cmd->iocb.ki_filp = file; - cmd->iocb.ki_complete = lo_rw_aio_complete; - cmd->iocb.ki_flags =IOCB_DIRECT ; cmd->iocb.ki_ioprio =req_get_ioprio (rq); +if (cmd->use_aio) { + cmd->iocb.ki_complete = lo_rw_aio_complete; + cmd->iocb.ki_flags =IOCB_DIRECT ; + }else { + cmd->iocb.ki_complete =NULL ; + cmd->iocb.ki_flags =0 ; + }if (rw ==ITER_SOURCE ) ret = file->f_op->write_iter (&cmd->iocb, &iter);
@@ -482,7 +420,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,if (ret != -EIOCBQUEUED )lo_rw_aio_complete (&cmd->iocb, ret); -return 0 ; +return -EIOCBQUEUED ; }static int do_req_filebacked (struct loop_device *lo,struct request *rq)
@@ -490,15 +428,6 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq)struct loop_cmd *cmd =blk_mq_rq_to_pdu (rq);loff_t pos = ((loff_t )blk_rq_pos (rq) <<9 ) + lo->lo_offset; -/* -* lo_write_simple and lo_read_simple should have been covered -* by io submit style function like lo_rw_aio(), one blocker -* is that lo_read_simple() need to call flush_dcache_page after -* the page is written from kernel, and it isn't easy to handle -* this in io submit style function which submits all segments -* of the req at one time. And direct read IO doesn't need to -* run flush_dcache_page(). -*/ switch (req_op (rq)) {case REQ_OP_FLUSH :return lo_req_flush (lo, rq);
@@ -514,15 +443,9 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq)case REQ_OP_DISCARD :return lo_fallocate (lo, rq, pos,FALLOC_FL_PUNCH_HOLE );case REQ_OP_WRITE : -if (cmd->use_aio) -return lo_rw_aio (lo, cmd, pos,ITER_SOURCE ); -else -return lo_write_simple (lo, rq, pos); +return lo_rw_aio (lo, cmd, pos,ITER_SOURCE );case REQ_OP_READ : -if (cmd->use_aio) -return lo_rw_aio (lo, cmd, pos,ITER_DEST ); -else -return lo_read_simple (lo, rq, pos); +return lo_rw_aio (lo, cmd, pos,ITER_DEST );default :WARN_ON_ONCE (1 );return -EIO ;
@@ -1907,7 +1830,6 @@ static void loop_handle_cmd(struct loop_cmd *cmd)struct loop_device *lo = rq->q->queuedata;int ret =0 ;struct mem_cgroup *old_memcg =NULL ; -const bool use_aio = cmd->use_aio;if (write && (lo->lo_flags &LO_FLAGS_READ_ONLY )) { ret = -EIO ;
@@ -1937,7 +1859,7 @@ static void loop_handle_cmd(struct loop_cmd *cmd) } failed:/* complete non-aio request */ -if (!use_aio || ret) { +if (ret != -EIOCBQUEUED ) {if (ret == -EOPNOTSUPP ) cmd->ret = ret;else
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/241 nvmet: pci-epf: always fully initialize completion entries
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit ffe0398c7d6a38af0584d4668d3762b7a97e2275 ]
For a command that is normally processed through the command request execute() function, the completion entry for the command is initialized by __nvmet_req_complete() and nvmet_pci_epf_cq_work() only needs to set the status field and the phase of the completion entry before posting the entry to the completion queue.
However, for commands that are failed due to an internal error (e.g. the command data buffer allocation fails), the command request execute() function is not called and __nvmet_req_complete() is never executed for the command, leaving the command completion entry uninitialized. For such command failed before calling req->execute(), the host ends up seeing completion entries with an invalid submission queue ID and command ID.
Avoid such issue by always fully initilizing a command completion entry in nvmet_pci_epf_cq_work(), setting the entry submission queue head, ID and command ID.
--- drivers/nvme/target/pci-epf.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
drivers/nvme/target/pci-epf.c +18 -7
@@ -1655,16 +1655,17 @@ static int nvmet_pci_epf_process_sq(struct nvmet_pci_epf_ctrl *ctrl, {struct nvmet_pci_epf_iod *iod;int ret, n =0 ; +u16 head = sq->head; sq->tail =nvmet_pci_epf_bar_read32 (ctrl, sq->db); -while (sq->head != sq->tail && (!ctrl->sq_ab || n < ctrl->sq_ab)) { +while (head != sq->tail && (!ctrl->sq_ab || n < ctrl->sq_ab)) { iod =nvmet_pci_epf_alloc_iod (sq);if (!iod)break ;/* Get the NVMe command submitted by the host. */ ret =nvmet_pci_epf_transfer (ctrl, &iod->cmd, - sq->pci_addr + sq->head * sq->qes, + sq->pci_addr + head * sq->qes, sq->qes,DMA_FROM_DEVICE );if (ret) {/* Not much we can do... */
@@ -1673,12 +1674,13 @@ static int nvmet_pci_epf_process_sq(struct nvmet_pci_epf_ctrl *ctrl, }dev_dbg (ctrl->dev,"SQ[%u]: head %u, tail %u, command %s\n" , - sq->qid, sq->head, sq->tail, + sq->qid, head, sq->tail,nvmet_pci_epf_iod_name (iod)); - sq->head++; -if (sq->head == sq->depth) - sq->head =0 ; + head++; +if (head == sq->depth) + head =0 ; +WRITE_ONCE (sq->head, head); n++;queue_work_on (WORK_CPU_UNBOUND , sq->iod_wq, &iod->work);
@@ -1772,8 +1774,17 @@ static void nvmet_pci_epf_cq_work(struct work_struct *work)if (!iod)break ; -/* Post the IOD completion entry. */ +/* +* Post the IOD completion entry. If the IOD request was +* executed (req->execute() called), the CQE is already +* initialized. However, the IOD may have been failed before +* that, leaving the CQE not properly initialized. So always +* initialize it here. +*/ cqe = &iod->cqe; + cqe->sq_head =cpu_to_le16 (READ_ONCE (iod->sq->head)); + cqe->sq_id =cpu_to_le16 (iod->sq->qid); + cqe->command_id = iod->cmd.common.command_id; cqe->status =cpu_to_le16 ((iod->status <<1 ) | cq->phase); dev_dbg(ctrl->dev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/241 nvmet: pci-epf: clear CC and CSTS when disabling the controller
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit f8e01fa93f3e4fc255d240cfa0c045ce0b5c97ea ]
When a host shuts down the controller when shutting down but does so without first disabling the controller, the enable bit remains set in the controller configuration register. When the host restarts and attempts to enable the controller again, the nvmet_pci_epf_poll_cc_work() function is unable to detect the change from 0 to 1 of the enable bit, and thus the controller is not enabled again, which result in a device scan timeout on the host. This problem also occurs if the host shuts down uncleanly or if the PCIe link goes
down: as the CC.EN value is not reset, the controller is not enabled again when the host restarts.
Fix this by introducing the function nvmet_pci_epf_clear_ctrl_config() to clear the CC and CSTS registers of the controller when the PCIe link is lost (nvmet_pci_epf_stop_ctrl() function), or when starting the controller fails (nvmet_pci_epf_enable_ctrl() fails). Also use this function in nvmet_pci_epf_init_bar() to simplify the initialization of the CC and CSTS registers.
Furthermore, modify the function nvmet_pci_epf_disable_ctrl() to clear the CC.EN bit and write this updated value to the BAR register when the controller is shutdown by the host, to ensure that upon restart, we can detect the host setting CC.EN.
--- drivers/nvme/target/pci-epf.c | 49 +++++++++++++++++++++++------------ 1 file changed, 32 insertions(+), 17 deletions(-)
drivers/nvme/target/pci-epf.c +32 -17
@@ -1825,6 +1825,21 @@ static void nvmet_pci_epf_cq_work(struct work_struct *work) NVMET_PCI_EPF_CQ_RETRY_INTERVAL); } +static void nvmet_pci_epf_clear_ctrl_config (struct nvmet_pci_epf_ctrl *ctrl) +{ +struct nvmet_ctrl *tctrl = ctrl->tctrl; + +/* Initialize controller status. */ + tctrl->csts =0 ; + ctrl->csts =0 ; +nvmet_pci_epf_bar_write32 (ctrl,NVME_REG_CSTS , ctrl->csts); + +/* Initialize controller configuration and start polling. */ + tctrl->cc =0 ; + ctrl->cc =0 ; +nvmet_pci_epf_bar_write32 (ctrl,NVME_REG_CC , ctrl->cc); +} +static int nvmet_pci_epf_enable_ctrl (struct nvmet_pci_epf_ctrl *ctrl) {u64 pci_addr, asq, acq;
@@ -1890,18 +1905,20 @@ static int nvmet_pci_epf_enable_ctrl(struct nvmet_pci_epf_ctrl *ctrl)return 0 ; err: - ctrl->csts =0 ; +nvmet_pci_epf_clear_ctrl_config (ctrl);return -EINVAL ; } -static void nvmet_pci_epf_disable_ctrl (struct nvmet_pci_epf_ctrl *ctrl) +static void nvmet_pci_epf_disable_ctrl (struct nvmet_pci_epf_ctrl *ctrl, +bool shutdown) {int qid;if (!ctrl->enabled)return ; -dev_info (ctrl->dev,"Disabling controller\n" ); +dev_info (ctrl->dev,"%s controller\n" , + shutdown ?"Shutting down" :"Disabling" ); ctrl->enabled = false;cancel_delayed_work_sync (&ctrl->poll_sqs);
@@ -1918,6 +1935,11 @@ static void nvmet_pci_epf_disable_ctrl(struct nvmet_pci_epf_ctrl *ctrl)nvmet_pci_epf_delete_cq (ctrl->tctrl,0 ); ctrl->csts &= ~NVME_CSTS_RDY ; +if (shutdown) { + ctrl->csts |=NVME_CSTS_SHST_CMPLT ; + ctrl->cc &= ~NVME_CC_ENABLE ; +nvmet_pci_epf_bar_write32 (ctrl,NVME_REG_CC , ctrl->cc); + } }static void nvmet_pci_epf_poll_cc_work (struct work_struct *work)
@@ -1944,12 +1966,10 @@ static void nvmet_pci_epf_poll_cc_work(struct work_struct *work) }if (!nvmet_cc_en (new_cc) &&nvmet_cc_en (old_cc)) -nvmet_pci_epf_disable_ctrl (ctrl); +nvmet_pci_epf_disable_ctrl (ctrl, false); -if (nvmet_cc_shn (new_cc) && !nvmet_cc_shn (old_cc)) { -nvmet_pci_epf_disable_ctrl (ctrl); - ctrl->csts |=NVME_CSTS_SHST_CMPLT ; - } +if (nvmet_cc_shn (new_cc) && !nvmet_cc_shn (old_cc)) +nvmet_pci_epf_disable_ctrl (ctrl, true);if (!nvmet_cc_shn (new_cc) &&nvmet_cc_shn (old_cc)) ctrl->csts &= ~NVME_CSTS_SHST_CMPLT ;
@@ -1988,16 +2008,10 @@ static void nvmet_pci_epf_init_bar(struct nvmet_pci_epf_ctrl *ctrl)/* Clear Controller Memory Buffer Supported (CMBS). */ ctrl->cap &= ~(0x1ULL <<57 ); -/* Controller configuration. */ - ctrl->cc = tctrl->cc & (~NVME_CC_ENABLE ); - -/* Controller status. */ - ctrl->csts = ctrl->tctrl->csts; -nvmet_pci_epf_bar_write64 (ctrl,NVME_REG_CAP , ctrl->cap);nvmet_pci_epf_bar_write32 (ctrl,NVME_REG_VS , tctrl->subsys->ver); -nvmet_pci_epf_bar_write32 (ctrl,NVME_REG_CSTS , ctrl->csts); -nvmet_pci_epf_bar_write32 (ctrl,NVME_REG_CC , ctrl->cc); + +nvmet_pci_epf_clear_ctrl_config (ctrl); } static int nvmet_pci_epf_create_ctrl(struct nvmet_pci_epf *nvme_epf,
@@ -2102,7 +2116,8 @@ static void nvmet_pci_epf_stop_ctrl(struct nvmet_pci_epf_ctrl *ctrl) {cancel_delayed_work_sync (&ctrl->poll_cc); -nvmet_pci_epf_disable_ctrl (ctrl); +nvmet_pci_epf_disable_ctrl (ctrl, false); +nvmet_pci_epf_clear_ctrl_config (ctrl); }static void nvmet_pci_epf_destroy_ctrl (struct nvmet_pci_epf_ctrl *ctrl)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/241 ata: libata-sata: Save all fields from sense data descriptor
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 399eab7f92fb73ffe621294a2d6bec8fc9f3b36b ]
When filling the taskfile result for a successful NCQ command, we use the SDB FIS from the FIS Receive Area, see e.g. ahci_qc_ncq_fill_rtf().
However, the SDB FIS only has fields STATUS and ERROR.
For a successful NCQ command that has sense data, we will have a successful sense data descriptor, in the Sense Data for Successful NCQ Commands log.
Since we have access to additional taskfile result fields, fill in these additional fields in qc->result_tf.
This matches how for failing/aborted NCQ commands, we will use e.g. ahci_qc_fill_rtf() to fill in some fields, but then for the command that actually caused the NCQ error, we will use ata_eh_read_log_10h(), which provides additional fields, saving additional fields/overriding the qc->result_tf that was fetched using ahci_qc_fill_rtf().
--- drivers/ata/libata-sata.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/ata/libata-sata.c +15 -0
@@ -1510,6 +1510,8 @@ int ata_eh_get_ncq_success_sense(struct ata_link *link)unsigned int err_mask, tag;u8 *sense, sk =0 , asc =0 , ascq =0 ;u64 sense_valid, val; +u16 extended_sense; +bool aux_icc_valid;int ret =0 ; err_mask =ata_read_log_page (dev,ATA_LOG_SENSE_NCQ ,0 , buf,2 );
@@ -1529,6 +1531,8 @@ int ata_eh_get_ncq_success_sense(struct ata_link *link) sense_valid = (u64 )buf[8 ] | ((u64 )buf[9 ] <<8 ) | ((u64 )buf[10 ] <<16 ) | ((u64 )buf[11 ] <<24 ); + extended_sense =get_unaligned_le16 (&buf[14 ]); + aux_icc_valid = extended_sense &BIT (15 );ata_qc_for_each_raw (ap, qc, tag) { if (!(qc->flags & ATA_QCFLAG_EH) ||
@@ -1556,6 +1560,17 @@ int ata_eh_get_ncq_success_sense(struct ata_link *link)continue ; } + qc->result_tf.nsect = sense[6 ]; + qc->result_tf.hob_nsect = sense[7 ]; + qc->result_tf.lbal = sense[8 ]; + qc->result_tf.lbam = sense[9 ]; + qc->result_tf.lbah = sense[10 ]; + qc->result_tf.hob_lbal = sense[11 ]; + qc->result_tf.hob_lbam = sense[12 ]; + qc->result_tf.hob_lbah = sense[13 ]; +if (aux_icc_valid) + qc->result_tf.auxiliary =get_unaligned_le32 (&sense[16 ]); +/* Set sense without also setting scsicmd->result */ scsi_build_sense_buffer(dev->flags & ATA_DFLAG_D_SENSE, qc->scsicmd->sense_buffer, sk,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/241 cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 00ffb3724ce743578163f5ade2884374554ca021 ]
In the for loop used to allocate the loc_array and bmap for each port, a memory leak is possible when the allocation for loc_array succeeds, but the allocation for bmap fails. This is because when the control flow goes to the label free_eth_finfo, only the allocations starting from (i-1)th iteration are freed.
Fix that by freeing the loc_array in the bmap allocation error path.
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c +1 -0
@@ -2270,6 +2270,7 @@ int cxgb4_init_ethtool_filters(struct adapter *adap) eth_filter->port[i].bmap =bitmap_zalloc (nentries,GFP_KERNEL );if (!eth_filter->port[i].bmap) { ret = -ENOMEM ; +kvfree (eth_filter->port[i].loc_array); goto free_eth_finfo; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/241 tools: ynl-gen: individually free previous values on double set
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit ce6cb8113c842b94e77364b247c4f85c7b34e0c2 ]
When user calls request_attrA_set() multiple times (for the same attribute), and attrA is of type which allocates memory - we try to free the previously associated values. For array types (including multi-attr) we have only freed the array, but the array may have contained pointers.
Refactor the code generation for free attr and reuse the generated lines in setters to flush out the previous state. Since setters are static inlines in the header we need to add forward declarations for the free helpers of pure nested structs. Track which types get used by arrays and include the right forwad declarations.
At least ethtool string set and bit set would not be freed without this. Tho, admittedly, overriding already set attribute twice is likely a very very rare thing to do.
--- tools/net/ynl/pyynl/ynl_gen_c.py | 62 +++++++++++++++++++++++--------- 1 file changed, 45 insertions(+), 17 deletions(-)
tools/net/ynl/pyynl/ynl_gen_c.py +45 -17
@@ -157,9 +157,15 @@ class Type(SpecAttr): def free_needs_iter(self): return False - def free(self, ri, var, ref): + def _free_lines(self, ri, var, ref): if self.is_multi_val() or self.presence_type() == 'len': - ri.cw.p(f'free({var}->{ref}{self.c_name});') + return [f'free({var}->{ref}{self.c_name});'] + return [] + + def free(self, ri, var, ref): + lines = self._free_lines(ri, var, ref) + for line in lines: + ri.cw.p(line) def arg_member(self, ri): member = self._complex_member_type(ri)
@@ -258,6 +264,10 @@ class Type(SpecAttr): var = "req" member = f"{var}->{'.'.join(ref)}" + local_vars = [] + if self.free_needs_iter(): + local_vars += ['unsigned int i;'] + code = [] presence = '' for i in range(0, len(ref)):
@@ -267,6 +277,10 @@ class Type(SpecAttr): if i == len(ref) - 1 and self.presence_type() != 'bit': continue code.append(presence + ' = 1;') + ref_path = '.'.join(ref[:-1]) + if ref_path: + ref_path += '.' + code += self._free_lines(ri, var, ref_path) code += self._setter_lines(ri, member, presence) func_name = f"{op_prefix(ri, direction, deref=deref)}_set_{'_'.join(ref)}"
@@ -274,7 +288,8 @@ class Type(SpecAttr): alloc = bool([x for x in code if 'alloc(' in x]) if free and not alloc: func_name = '__' + func_name - ri.cw.write_func('static inline void', func_name, body=code, + ri.cw.write_func('static inline void', func_name, local_vars=local_vars, + body=code, args=[f'{type_name(ri, direction, deref=deref)} *{var}'] + self.arg_member(ri))
@@ -477,8 +492,7 @@ class TypeString(Type): ['unsigned int len;'] def _setter_lines(self, ri, member, presence): - return [f"free({member});", - f"{presence}_len = strlen({self.c_name});", + return [f"{presence}_len = strlen({self.c_name});", f"{member} = malloc({presence}_len + 1);", f'memcpy({member}, {self.c_name}, {presence}_len);', f'{member}[{presence}_len] = 0;']
@@ -531,8 +545,7 @@ class TypeBinary(Type): ['unsigned int len;'] def _setter_lines(self, ri, member, presence): - return [f"free({member});", - f"{presence}_len = len;", + return [f"{presence}_len = len;", f"{member} = malloc({presence}_len);", f'memcpy({member}, {self.c_name}, {presence}_len);']
@@ -569,12 +582,14 @@ class TypeNest(Type): def _complex_member_type(self, ri): return self.nested_struct_type - def free(self, ri, var, ref): + def _free_lines(self, ri, var, ref): + lines = [] at = '&' if self.is_recursive_for_op(ri): at = '' - ri.cw.p(f'if ({var}->{ref}{self.c_name})') - ri.cw.p(f'{self.nested_render_name}_free({at}{var}->{ref}{self.c_name});') + lines += [f'if ({var}->{ref}{self.c_name})'] + lines += [f'{self.nested_render_name}_free({at}{var}->{ref}{self.c_name});'] + return lines def _attr_typol(self): return f'.type = YNL_PT_NEST, .nest = &{self.nested_render_name}_nest, '
@@ -627,15 +642,19 @@ class TypeMultiAttr(Type): def free_needs_iter(self): return 'type' not in self.attr or self.attr['type'] == 'nest' - def free(self, ri, var, ref): + def _free_lines(self, ri, var, ref): + lines = [] if self.attr['type'] in scalars: - ri.cw.p(f"free({var}->{ref}{self.c_name});") + lines += [f"free({var}->{ref}{self.c_name});"] elif 'type' not in self.attr or self.attr['type'] == 'nest': - ri.cw.p(f"for (i = 0; i < {var}->{ref}n_{self.c_name}; i++)") - ri.cw.p(f'{self.nested_render_name}_free(&{var}->{ref}{self.c_name}[i]);') - ri.cw.p(f"free({var}->{ref}{self.c_name});") + lines += [ + f"for (i = 0; i < {var}->{ref}n_{self.c_name}; i++)", + f'{self.nested_render_name}_free(&{var}->{ref}{self.c_name}[i]);', + f"free({var}->{ref}{self.c_name});", + ] else: raise Exception(f"Free of MultiAttr sub-type {self.attr['type']} not supported yet") + return lines def _attr_policy(self, policy): return self.base_type._attr_policy(policy)
@@ -661,8 +680,7 @@ class TypeMultiAttr(Type): def _setter_lines(self, ri, member, presence): # For multi-attr we have a count, not presence, hack up the presence presence = presence[:-(len('_present.') + len(self.c_name))] + "n_" + self.c_name - return [f"free({member});", - f"{member} = {self.c_name};", + return [f"{member} = {self.c_name};", f"{presence} = n_{self.c_name};"]
@@ -747,6 +765,7 @@ class Struct: self.request = False self.reply = False self.recursive = False + self.in_multi_val = False # used by a MultiAttr or and legacy arrays self.attr_list = [] self.attrs = dict()
@@ -1114,6 +1133,10 @@ class Family(SpecFamily): if attr in rs_members['reply']: self.pure_nested_structs[nested].reply = True + if spec.is_multi_val(): + child = self.pure_nested_structs.get(nested) + child.in_multi_val = True + self._sort_pure_types() # Propagate the request / reply / recursive
@@ -1128,6 +1151,8 @@ class Family(SpecFamily): struct.child_nests.update(child.child_nests) child.request |= struct.request child.reply |= struct.reply + if spec.is_multi_val(): + child.in_multi_val = True if attr_set in struct.child_nests: struct.recursive = True
@@ -2921,6 +2946,9 @@ def main(): for attr_set, struct in parsed.pure_nested_structs.items(): ri = RenderInfo(cw, parsed, args.mode, "", "", attr_set) print_type_full(ri, struct) + if struct.request and struct.in_multi_val: + free_rsp_nested_prototype(ri) + cw.nl() for op_name, op in parsed.ops.items(): cw.p(f"/* ============== {op.enum_name} ============== */")
Signature · 1 line
2.39.5
Re: [PATCH 6.14 065/241] tools: ynl-gen: individually free previous values on double set
[note, to avoid confusion: the problem mentioned below is independent of an ynl problem I ran into with -next today:
https://lore.kernel.org/all/[email protected]/ ]
Quoted 20 lines · Greg Kroah-Hartman
6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit
ce6cb8113c842b94e77364b247c4f85c7b34e0c2]When user calls
request_attrA_set()multiple times (for the same attribute), and attrA is of type which allocates memory - we try to free the previously associated values. For array types (including multi-attr) we have only freed the array, but the array may have contained pointers.Refactor the code generation for free attr and reuse the generated lines in setters to flush out the previous state. Since setters are static inlines in the header we need to add forward declarations for the free helpers of pure nested structs. Track which types get used by arrays and include the right forwad declarations.
Quoted 3 lines
At least ethtool string set and bit set would not be freed without this. Tho, admittedly, overriding already set attribute twice is likely a very very rare thing to do.
This change caused the following build error for me on Fedora while using a slightly modified version of the distro's kernel.spec file to build kernel rpms for Fedora. Reverting the change fixed the problem.
"""
[....]
CC net_shaper-user.o
CC netdev-user.o
CC nfsd-user.o
In file included from net_shaper-user.c:8:net_shaper-user.h: In function ‘__net_shaper_group_req_set_leaves’:
net_shaper-user.h:420:1: error: old-style parameter declarations in prototyped function definition
420 | __net_shaper_group_req_set_leaves(struct net_shaper_group_req *req,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from dpll-user.c:8:dpll-user.h: In function ‘__dpll_pin_set_req_set_parent_device’:
dpll-user.h:522:1: error: old-style parameter declarations in prototyped function definition
522 | __dpll_pin_set_req_set_parent_device(struct dpll_pin_set_req *req,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net_shaper-user.h:426:14: error: ‘i’ undeclared (first use in this function)
426 | for (i = 0; i < req->n_leaves; i++)
| ^
net_shaper-user.h:426:14: note: each undeclared identifier is reported only once for each function it appears in dpll-user.h:528:14: error: ‘i’ undeclared (first use in this function)
528 | for (i = 0; i < req->n_parent_device; i++)
| ^
dpll-user.h:528:14: note: each undeclared identifier is reported only once for each function it appears in dpll-user.h: In function ‘__dpll_pin_set_req_set_parent_pin’:
dpll-user.h:535:1: error: old-style parameter declarations in prototyped function definition
535 | __dpll_pin_set_req_set_parent_pin(struct dpll_pin_set_req *req,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
dpll-user.h:541:14: error: ‘i’ undeclared (first use in this function)
541 | for (i = 0; i < req->n_parent_pin; i++)
| ^
CC nlctrl-user.o
make[1]: *** [Makefile:53: net_shaper-user.o] Error 1
make[1]: *** Waiting for unfinished jobs....
CC ovs_datapath-user.o
make[1]: *** [Makefile:53: dpll-user.o] Error 1
In file included from netdev-user.c:8:netdev-user.h: In function ‘__netdev_bind_rx_req_set_queues’:
In file included from nfsd-user.c:8:nfsd-user.h: In function ‘__nfsd_version_set_req_set_version’:
netdev-user.h:563:1: error: old-style parameter declarations in prototyped function definition
563 | __netdev_bind_rx_req_set_queues(struct netdev_bind_rx_req *req,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
netdev-user.h:569:14: error: ‘i’ undeclared (first use in this function)
569 | for (i = 0; i < req->n_queues; i++)
| ^
nfsd-user.h:190:1: error: old-style parameter declarations in prototyped function definition
190 | __nfsd_version_set_req_set_version(struct nfsd_version_set_req *req,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
netdev-user.h:569:14: note: each undeclared identifier is reported only once for each function it appears in nfsd-user.h:196:14: error: ‘i’ undeclared (first use in this function)
196 | for (i = 0; i < req->n_version; i++)
| ^
nfsd-user.h:196:14: note: each undeclared identifier is reported only once for each function it appears in nfsd-user.h: In function ‘__nfsd_listener_set_req_set_addr’:
nfsd-user.h:237:1: error: old-style parameter declarations in prototyped function definition
237 | __nfsd_listener_set_req_set_addr(struct nfsd_listener_set_req *req,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
nfsd-user.h:242:14: error: ‘i’ undeclared (first use in this function)
242 | for (i = 0; i < req->n_addr; i++)
| ^
make[1]: *** [Makefile:53: nfsd-user.o] Error 1
make[1]: *** [Makefile:53: netdev-user.o] Error 1
AR ynl.a
make: *** [Makefile:25: generated] Error 2
"""
Ciao, Thorsten
Quoted 175 lines
Fixes be5bea1cc0bf ("net: add basic C code generators for Netlink")Reviewed-by Donald Hunter <[email protected]>Reviewed-by Jacob Keller <[email protected]>Signed-off-by Jakub Kicinski <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- tools/net/ynl/pyynl/ynl_gen_c.py | 62 +++++++++++++++++++++++--------- 1 file changed, 45 insertions(+), 17 deletions(-)tools/net/ynl/pyynl/ynl_gen_c.py +45
-17@@ -157,9 +157,15 @@ class Type(SpecAttr): def free_needs_iter(self): return False - def free(self, ri, var, ref): + def _free_lines(self, ri, var, ref): if self.is_multi_val() or self.presence_type() == 'len': - ri.cw.p(f'free({var}->{ref}{self.c_name});') + return [f'free({var}->{ref}{self.c_name});'] + return [] + + def free(self, ri, var, ref): + lines = self._free_lines(ri, var, ref) + for line in lines: + ri.cw.p(line) def arg_member(self, ri): member = self._complex_member_type(ri)@@ -258,6 +264,10 @@ class Type(SpecAttr): var = "req" member = f"{var}->{'.'.join(ref)}" + local_vars = [] + if self.free_needs_iter(): + local_vars += ['unsigned int i;'] + code = [] presence = '' for i in range(0, len(ref)):@@ -267,6 +277,10 @@ class Type(SpecAttr): if i == len(ref) - 1 and self.presence_type() != 'bit': continue code.append(presence + ' = 1;') + ref_path = '.'.join(ref[:-1]) + if ref_path: + ref_path += '.' + code += self._free_lines(ri, var, ref_path) code += self._setter_lines(ri, member, presence) func_name = f"{op_prefix(ri, direction, deref=deref)}_set_{'_'.join(ref)}"@@ -274,7 +288,8 @@ class Type(SpecAttr): alloc = bool([x for x in code if 'alloc(' in x]) if free and not alloc: func_name = '__' + func_name - ri.cw.write_func('static inline void', func_name, body=code, + ri.cw.write_func('static inline void', func_name, local_vars=local_vars, + body=code, args=[f'{type_name(ri, direction, deref=deref)} *{var}'] + self.arg_member(ri))@@ -477,8 +492,7 @@ class TypeString(Type): ['unsigned int len;'] def _setter_lines(self, ri, member, presence): - return [f"free({member});", - f"{presence}_len = strlen({self.c_name});", + return [f"{presence}_len = strlen({self.c_name});", f"{member} = malloc({presence}_len + 1);", f'memcpy({member}, {self.c_name}, {presence}_len);', f'{member}[{presence}_len] = 0;']@@ -531,8 +545,7 @@ class TypeBinary(Type): ['unsigned int len;'] def _setter_lines(self, ri, member, presence): - return [f"free({member});", - f"{presence}_len = len;", + return [f"{presence}_len = len;", f"{member} = malloc({presence}_len);", f'memcpy({member}, {self.c_name}, {presence}_len);']@@ -569,12 +582,14 @@ class TypeNest(Type): def _complex_member_type(self, ri): return self.nested_struct_type - def free(self, ri, var, ref): + def _free_lines(self, ri, var, ref): + lines = [] at = '&' if self.is_recursive_for_op(ri): at = '' - ri.cw.p(f'if ({var}->{ref}{self.c_name})') - ri.cw.p(f'{self.nested_render_name}_free({at}{var}->{ref}{self.c_name});') + lines += [f'if ({var}->{ref}{self.c_name})'] + lines += [f'{self.nested_render_name}_free({at}{var}->{ref}{self.c_name});'] + return lines def _attr_typol(self): return f'.type = YNL_PT_NEST, .nest = &{self.nested_render_name}_nest, '@@ -627,15 +642,19 @@ class TypeMultiAttr(Type): def free_needs_iter(self): return 'type' not in self.attr or self.attr['type'] == 'nest' - def free(self, ri, var, ref): + def _free_lines(self, ri, var, ref): + lines = [] if self.attr['type'] in scalars: - ri.cw.p(f"free({var}->{ref}{self.c_name});") + lines += [f"free({var}->{ref}{self.c_name});"] elif 'type' not in self.attr or self.attr['type'] == 'nest': - ri.cw.p(f"for (i = 0; i < {var}->{ref}n_{self.c_name}; i++)") - ri.cw.p(f'{self.nested_render_name}_free(&{var}->{ref}{self.c_name}[i]);') - ri.cw.p(f"free({var}->{ref}{self.c_name});") + lines += [ + f"for (i = 0; i < {var}->{ref}n_{self.c_name}; i++)", + f'{self.nested_render_name}_free(&{var}->{ref}{self.c_name}[i]);', + f"free({var}->{ref}{self.c_name});", + ] else: raise Exception(f"Free of MultiAttr sub-type {self.attr['type']} not supported yet") + return lines def _attr_policy(self, policy): return self.base_type._attr_policy(policy)@@ -661,8 +680,7 @@ class TypeMultiAttr(Type): def _setter_lines(self, ri, member, presence): # For multi-attr we have a count, not presence, hack up the presence presence = presence[:-(len('_present.') + len(self.c_name))] + "n_" + self.c_name - return [f"free({member});", - f"{member} = {self.c_name};", + return [f"{member} = {self.c_name};", f"{presence} = n_{self.c_name};"]@@ -747,6 +765,7 @@ class Struct: self.request = False self.reply = False self.recursive = False + self.in_multi_val = False # used by a MultiAttr or and legacy arrays self.attr_list = [] self.attrs = dict()@@ -1114,6 +1133,10 @@ class Family(SpecFamily): if attr in rs_members['reply']: self.pure_nested_structs[nested].reply = True + if spec.is_multi_val(): + child = self.pure_nested_structs.get(nested) + child.in_multi_val = True + self._sort_pure_types() # Propagate the request / reply / recursive@@ -1128,6 +1151,8 @@ class Family(SpecFamily): struct.child_nests.update(child.child_nests) child.request |= struct.request child.reply |= struct.reply + if spec.is_multi_val(): + child.in_multi_val = True if attr_set in struct.child_nests: struct.recursive = True@@ -2921,6 +2946,9 @@ def main(): for attr_set, struct in parsed.pure_nested_structs.items(): ri = RenderInfo(cw, parsed, args.mode, "", "", attr_set) print_type_full(ri, struct) + if struct.request and struct.in_multi_val: + free_rsp_nested_prototype(ri) + cw.nl() for op_name, op in parsed.ops.items(): cw.p(f"/* ============== {op.enum_name} ============== */")
Re: [PATCH 6.14 065/241] tools: ynl-gen: individually free previous values on double set
Quoted 3 lines · On Wed, 23 Apr 2025 18:27:46 +0200 Thorsten Leemhuis wrote:
[note, to avoid confusion: the problem mentioned below is independent of an ynl problem I ran into with -next today:
https://lore.kernel.org/all/[email protected]/ ]
Thanks for the report, these 4 need to be backported together:
57e7dedf2b8c tools: ynl-gen: make sure we validate subtype of array-nest ce6cb8113c84 tools: ynl-gen: individually free previous values on double set dfa464b4a603 tools: ynl-gen: move local vars after the opening bracket 4d07bbf2d456 tools: ynl-gen: don't declare loop iterator in place
Greg Kroah-Hartman
maintainerRe: [PATCH 6.14 065/241] tools: ynl-gen: individually free previous values on double set
Quoted 5 lines · Jakub Kicinski
Quoted 3 lines · On Wed, 23 Apr 2025 18:27:46 +0200 Thorsten Leemhuis wrote:
[note, to avoid confusion: the problem mentioned below is independent of an ynl problem I ran into with -next today:
https://lore.kernel.org/all/[email protected]/ ]
Quoted 8 lines
Thanks for the report, these 4 need to be backported together:
57e7dedf2b8ctools: ynl-gen: make sure we validate subtype of array-nestce6cb8113c84tools: ynl-gen: individually free previous values on double setdfa464b4a603tools: ynl-gen: move local vars after the opening bracket4d07bbf2d456tools: ynl-gen: don't declare loop iterator in place
Great, all now dropped instead :)
Greg Kroah-Hartman
maintainerPATCH 66/241 tools: ynl-gen: make sure we validate subtype of array-nest
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 57e7dedf2b8c72caa6f04b9e08b19e4f370562fa ]
ArrayNest AKA indexed-array support currently skips inner type validation. We count the attributes and then we parse them, make sure we call validate, too. Otherwise buggy / unexpected kernel response may lead to crashes.
--- tools/net/ynl/pyynl/ynl_gen_c.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/net/ynl/pyynl/ynl_gen_c.py +5 -2
@@ -706,8 +706,11 @@ class TypeArrayNest(Type): def _attr_get(self, ri, var): local_vars = ['const struct nlattr *attr2;'] get_lines = [f'attr_{self.c_name} = attr;', - 'ynl_attr_for_each_nested(attr2, attr)', - f'\t{var}->n_{self.c_name}++;'] + 'ynl_attr_for_each_nested(attr2, attr) {', + '\tif (ynl_attr_validate(yarg, attr2))', + '\t\treturn YNL_PARSE_CB_ERROR;', + f'\t{var}->n_{self.c_name}++;', + '}'] return get_lines, None, local_vars
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/241 netlink: specs: rt-link: add an attr layer around alt-ifname
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit acf4da17deada7f8b120e051aa6c9cac40dbd83b ]
alt-ifname attr is directly placed in requests (as an alternative to ifname) but in responses its wrapped up in IFLA_PROP_LIST and only there is may be multi-attr. See rtnl_fill_prop_list().
--- Documentation/netlink/specs/rt_link.yaml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
Documentation/netlink/specs/rt_link.yaml +8 -3
@@ -1101,11 +1101,10 @@ attribute-sets: - name: prop-list type: nest - nested-attributes: link-attrs + nested-attributes: prop-list-link-attrs - name: alt-ifname type: string - multi-attr: true - name: perm-address type: binary
@@ -1148,6 +1147,13 @@ attribute-sets: name: max-pacing-offload-horizon type: uint doc: EDT offload horizon supported by the device (in nsec). + - + name: prop-list-link-attrs + subset-of: link-attrs + attributes: + - + name: alt-ifname + multi-attr: true - name: af-spec-attrs attributes:
@@ -2434,7 +2440,6 @@ operations: - min-mtu - max-mtu - prop-list - - alt-ifname - perm-address - proto-down-reason - parent-dev-name
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/241 netlink: specs: rtnetlink: attribute naming corrections
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 540201c0ef7e8e7b169f68a238ade931a81a31a6 ]
Some attribute names diverge in very minor ways from the C names. These are most likely typos, and they prevent the C codegen from working.
--- Documentation/netlink/specs/rt_link.yaml | 6 +++--- Documentation/netlink/specs/rt_neigh.yaml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
Documentation/netlink/specs/rt_link.yaml +3 -3
@@ -1576,7 +1576,7 @@ attribute-sets: name: nf-call-iptables type: u8 - - name: nf-call-ip6-tables + name: nf-call-ip6tables type: u8 - name: nf-call-arptables
@@ -2064,7 +2064,7 @@ attribute-sets: name: id type: u16 - - name: flag + name: flags type: binary struct: ifla-vlan-flags -
@@ -2152,7 +2152,7 @@ attribute-sets: type: binary struct: ifla-cacheinfo - - name: icmp6-stats + name: icmp6stats type: binary struct: ifla-icmp6-stats -
Documentation/netlink/specs/rt_neigh.yaml +1 -1
@@ -189,7 +189,7 @@ attribute-sets: type: binary display-hint: ipv4 - - name: lladr + name: lladdr type: binary display-hint: mac -
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/241 netlink: specs: rt-link: adjust mctp attribute naming
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit beb3c5ad8829b52057f48a776a9d9558b98c157f ]
MCTP attribute naming is inconsistent. In C we have:
IFLA_MCTP_NET,
IFLA_MCTP_PHYS_BINDING,
^^^^but in YAML:
- mctp-net
- phys-binding
^
no "mctp"
It's unclear whether the "mctp" part of the name is supposed to be a prefix or part of attribute name. Make it a prefix, seems cleaner, even tho technically phys-binding was added later.
--- Documentation/netlink/specs/rt_link.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Documentation/netlink/specs/rt_link.yaml +2 -1
@@ -2166,9 +2166,10 @@ attribute-sets: type: u32 - name: mctp-attrs + name-prefix: ifla-mctp- attributes: - - name: mctp-net + name: net type: u32 - name: phys-binding
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/241 net: b53: enable BPDU reception for management port
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 36355ddfe8955f226a88a543ed354b9f6b84cd70 ]
For STP to work, receiving BPDUs is essential, but the appropriate bit was never set. Without GC_RX_BPDU_EN, the switch chip will filter all BPDUs, even if an appropriate PVID VLAN was setup.
--- drivers/net/dsa/b53/b53_common.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/dsa/b53/b53_common.c +10 -0
@@ -737,6 +737,15 @@ static void b53_enable_mib(struct b53_device *dev)b53_write8 (dev,B53_MGMT_PAGE ,B53_GLOBAL_CONFIG , gc); } +static void b53_enable_stp (struct b53_device *dev) +{ +u8 gc; + +b53_read8 (dev,B53_MGMT_PAGE ,B53_GLOBAL_CONFIG , &gc); + gc |=GC_RX_BPDU_EN ; +b53_write8 (dev,B53_MGMT_PAGE ,B53_GLOBAL_CONFIG , gc); +} +static u16 b53_default_pvid (struct b53_device *dev) {if (is5325 (dev) ||is5365 (dev))
@@ -876,6 +885,7 @@ static int b53_switch_reset(struct b53_device *dev) }b53_enable_mib (dev); +b53_enable_stp (dev);return b53_flush_arl (dev,FAST_AGE_STATIC ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/241 net: bridge: switchdev: do not notify new brentries as changed
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit eb25de13bd9cf025413a04f25e715d0e99847e30 ]
When adding a bridge vlan that is pvid or untagged after the vlan has already been added to any other switchdev backed port, the vlan change will be propagated as changed, since the flags change.
This causes the vlan to not be added to the hardware for DSA switches, since the DSA handler ignores any vlans for the CPU or DSA ports that are changed.
E.g. the following order of operations would work:
$ ip link add swbridge type bridge vlan_filtering 1 vlan_default_pvid 0 $ ip link set lan1 master swbridge $ bridge vlan add dev swbridge vid 1 pvid untagged self $ bridge vlan add dev lan1 vid 1 pvid untagged
but this order would break:
$ ip link add swbridge type bridge vlan_filtering 1 vlan_default_pvid 0 $ ip link set lan1 master swbridge $ bridge vlan add dev lan1 vid 1 pvid untagged $ bridge vlan add dev swbridge vid 1 pvid untagged self
Additionally, the vlan on the bridge itself would become undeletable:
$ bridge vlan port vlan-id lan1 1 PVID Egress Untagged swbridge 1 PVID Egress Untagged $ bridge vlan del dev swbridge vid 1 self $ bridge vlan port vlan-id lan1 1 PVID Egress Untagged swbridge 1 Egress Untagged
since the vlan was never added to DSA's vlan list, so deleting it will cause an error, causing the bridge code to not remove it.
Fix this by checking if flags changed only for vlans that are already brentry and pass changed as false for those that become brentries, as these are a new vlan (member) from the switchdev point of view.
Since *changed is set to true for becomes_brentry = true regardless of would_change's value, this will not change any rtnetlink notification delivery, just the value passed on to switchdev in vlan->changed.
--- net/bridge/br_vlan.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/bridge/br_vlan.c +3 -1
@@ -715,8 +715,8 @@ static int br_vlan_add_existing(struct net_bridge *br, u16 flags, bool *changed, struct netlink_ext_ack *extack) { - bool would_change = __vlan_flags_would_change(vlan, flags); bool becomes_brentry = false; +bool would_change = false;int err;if (!br_vlan_is_brentry (vlan)) {
@@ -725,6 +725,8 @@ static int br_vlan_add_existing(struct net_bridge *br,return -EINVAL ; becomes_brentry = true; + }else { + would_change =__vlan_flags_would_change (vlan, flags); }/* Master VLANs that aren't brentries weren't notified before,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/241 net: txgbe: fix memory leak in txgbe_probe() error path
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit b2727326d0a53709380aa147018085d71a6d4843 ]
When txgbe_sw_init() is called, memory is allocated for wx->rss_key in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent error paths after txgbe_sw_init() don't free the rss_key. Fix that by freeing it in error path along with wx->mac_table.
Also change the label to which execution jumps when txgbe_sw_init() fails, because otherwise, it could lead to a double free for rss_key, when the mac_table allocation fails in wx_sw_init().
--- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +2 -1
@@ -559,7 +559,7 @@ static int txgbe_probe(struct pci_dev *pdev,/* setup the private structure */ err =txgbe_sw_init (wx);if (err) - goto err_free_mac_table; + goto err_pci_release_regions;/* check if flash load is done after hw power up */ err =wx_check_flash_load (wx,TXGBE_SPI_ILDR_STATUS_PERST );
@@ -717,6 +717,7 @@ static int txgbe_probe(struct pci_dev *pdev,wx_clear_interrupt_scheme (wx);wx_control_hw (wx, false); err_free_mac_table: +kfree (wx->rss_key);kfree (wx->mac_table); err_pci_release_regions: pci_release_selected_regions(pdev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/241 net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit c84f6ce918a9e6f4996597cbc62536bbf2247c96 ]
Russell King reports that a system with mv88e6xxx dereferences a NULL pointer when unbinding this driver:
https://lore.kernel.org/netdev/[email protected]/
The crash seems to be in devlink_region_destroy(), which is not NULL tolerant but is given a NULL devlink global region pointer.
At least on some chips, some devlink regions are conditionally registered since the blamed commit, see mv88e6xxx_setup_devlink_regions_global():
if (cond && !cond(chip)) continue;
These are MV88E6XXX_REGION_STU and MV88E6XXX_REGION_PVT. If the chip does not have an STU or PVT, it should crash like this.
To fix the issue, avoid unregistering those regions which are NULL, i.e. were skipped at mv88e6xxx_setup_devlink_regions_global() time.
--- drivers/net/dsa/mv88e6xxx/devlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/devlink.c +2 -1
@@ -736,7 +736,8 @@ void mv88e6xxx_teardown_devlink_regions_global(struct dsa_switch *ds)int i;for (i =0 ; i <ARRAY_SIZE (mv88e6xxx_regions); i++) -dsa_devlink_region_destroy (chip->regions[i]); +if (chip->regions[i]) +dsa_devlink_region_destroy (chip->regions[i]); }void mv88e6xxx_teardown_devlink_regions_port (struct dsa_switch *ds,int port)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/241 net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit ea08dfc35f83cfc73493c52f63ae4f2e29edfe8d ]
Russell King reports that on the ZII dev rev B, deleting a bridge VLAN from a user port fails with -ENOENT:
https://lore.kernel.org/netdev/[email protected]/
This comes from mv88e6xxx_port_vlan_leave() -> mv88e6xxx_mst_put(), which tries to find an MST entry in &chip->msts associated with the SID, but fails and returns -ENOENT as such.
But we know that this chip does not support MST at all, so that is not surprising. The question is why does the guard in mv88e6xxx_mst_put() not exit early:
if (!sid) return 0;
And the answer seems to be simple: the sid comes from vlan.sid which supposedly was previously populated by mv88e6xxx_vtu_get(). But some chip->info->ops->vtu_getnext() implementations do not populate vlan.sid, for example see mv88e6185_g1_vtu_getnext(). In that case, later in mv88e6xxx_port_vlan_leave() we are using a garbage sid which is just residual stack memory.
Testing for sid == 0 covers all cases of a non-bridge VLAN or a bridge VLAN mapped to the default MSTI. For some chips, SID 0 is valid and installed by mv88e6xxx_stu_setup(). A chip which does not support the STU would implicitly only support mapping all VLANs to the default MSTI, so although SID 0 is not valid, it would be sufficient, if we were to zero-initialize the vlan structure, to fix the bug, due to the coincidence that a test for vlan.sid == 0 already exists and leads to the same (correct) behavior.
Another option which would be sufficient would be to add a test for mv88e6xxx_has_stu() inside mv88e6xxx_mst_put(), symmetric to the one which already exists in mv88e6xxx_mst_get(). But that placement means the caller will have to dereference vlan.sid, which means it will access uninitialized memory, which is not nice even if it ignores it later.
So we end up making both modifications, in order to not rely just on the sid == 0 coincidence, but also to avoid having uninitialized structure fields which might get temporarily accessed.
--- drivers/net/dsa/mv88e6xxx/chip.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +12 -1
@@ -1852,6 +1852,8 @@ static int mv88e6xxx_vtu_get(struct mv88e6xxx_chip *chip, u16 vid,if (!chip->info->ops->vtu_getnext)return -EOPNOTSUPP ; +memset (entry,0 ,sizeof (*entry)); + entry->vid = vid ? vid -1 :mv88e6xxx_max_vid (chip); entry->valid = false;
@@ -1960,7 +1962,16 @@ static int mv88e6xxx_mst_put(struct mv88e6xxx_chip *chip, u8 sid)struct mv88e6xxx_mst *mst, *tmp;int err; -if (!sid) +/* If the SID is zero, it is for a VLAN mapped to the default MSTI, +* and mv88e6xxx_stu_setup() made sure it is always present, and thus, +* should not be removed here. +* +* If the chip lacks STU support, numerically the "sid" variable will +* happen to also be zero, but we don't want to rely on that fact, so +* we explicitly test that first. In that case, there is also nothing +* to do here. +*/ +if (!mv88e6xxx_has_stu (chip) || !sid)return 0 ;list_for_each_entry_safe (mst, tmp, &chip->msts, node) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/241 net: dsa: clean up FDB, MDB, VLAN entries on unbind
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 7afb5fb42d4950f33af2732b8147c552659f79b7 ]
As explained in many places such as commit b117e1e8a86d ("net: dsa:
delete dsa_legacy_fdb_add and dsa_legacy_fdb_del"), DSA is written given the assumption that higher layers have balanced additions/deletions. As such, it only makes sense to be extremely vocal when those assumptions are violated and the driver unbinds with entries still present.
But Ido Schimmel points out a very simple situation where that is wrong:
https://lore.kernel.org/netdev/ZDazSM5UsPPjQuKr@shredder/
(also briefly discussed by me in the aforementioned commit).
Basically, while the bridge bypass operations are not something that DSA explicitly documents, and for the majority of DSA drivers this API simply causes them to go to promiscuous mode, that isn't the case for all drivers. Some have the necessary requirements for bridge bypass operations to do something useful - see dsa_switch_supports_uc_filtering().
Although in tools/testing/selftests/net/forwarding/local_termination.sh, we made an effort to popularize better mechanisms to manage address filters on DSA interfaces from user space - namely macvlan for unicast, and setsockopt(IP_ADD_MEMBERSHIP) - through mtools - for multicast, the fact is that 'bridge fdb add ... self static local' also exists as kernel UAPI, and might be useful to someone, even if only for a quick hack.
It seems counter-productive to block that path by implementing shim .ndo_fdb_add and .ndo_fdb_del operations which just return -EOPNOTSUPP in order to prevent the ndo_dflt_fdb_add() and ndo_dflt_fdb_del() from running, although we could do that.
Accepting that cleanup is necessary seems to be the only option. Especially since we appear to be coming back at this from a different angle as well. Russell King is noticing that the WARN_ON() triggers even for VLANs:
https://lore.kernel.org/netdev/[email protected]/
What happens in the bug report above is that dsa_port_do_vlan_del() fails, then the VLAN entry lingers on, and then we warn on unbind and leak it.
This is not a straight revert of the blamed commit, but we now add an informational print to the kernel log (to still have a way to see that bugs exist), and some extra comments gathered from past years' experience, to justify the logic.
--- net/dsa/dsa.c | 38 +++++++++++++++++++++++++++++++++++--- 1 file changed, 35 insertions(+), 3 deletions(-)
net/dsa/dsa.c +35 -3
@@ -1478,12 +1478,44 @@ static int dsa_switch_parse(struct dsa_switch *ds, struct dsa_chip_data *cd)static void dsa_switch_release_ports (struct dsa_switch *ds) { +struct dsa_mac_addr *a, *tmp;struct dsa_port *dp, *next; +struct dsa_vlan *v, *n;dsa_switch_for_each_port_safe (dp, next, ds) { -WARN_ON (!list_empty (&dp->fdbs)); -WARN_ON (!list_empty (&dp->mdbs)); -WARN_ON (!list_empty (&dp->vlans)); +/* These are either entries that upper layers lost track of +* (probably due to bugs), or installed through interfaces +* where one does not necessarily have to remove them, like +* ndo_dflt_fdb_add(). +*/ +list_for_each_entry_safe (a, tmp, &dp->fdbs, list) { +dev_info (ds->dev, +"Cleaning up unicast address %pM vid %u from port %d\n" , + a->addr, a->vid, dp->index); +list_del (&a->list); +kfree (a); + } + +list_for_each_entry_safe (a, tmp, &dp->mdbs, list) { +dev_info (ds->dev, +"Cleaning up multicast address %pM vid %u from port %d\n" , + a->addr, a->vid, dp->index); +list_del (&a->list); +kfree (a); + } + +/* These are entries that upper layers have lost track of, +* probably due to bugs, but also due to dsa_port_do_vlan_del() +* having failed and the VLAN entry still lingering on. +*/ +list_for_each_entry_safe (v, n, &dp->vlans, list) { +dev_info (ds->dev, +"Cleaning up vid %u from port %d\n" , + v->vid, dp->index); +list_del (&v->list); +kfree (v); + } +list_del (&dp->list);kfree (dp); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/241 net: dsa: free routing table on probe failure
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 8bf108d7161ffc6880ad13a0cc109de3cf631727 ]
If complete = true in dsa_tree_setup(), it means that we are the last switch of the tree which is successfully probing, and we should be setting up all switches from our probe path.
After "complete" becomes true, dsa_tree_setup_cpu_ports() or any subsequent function may fail. If that happens, the entire tree setup is in limbo: the first N-1 switches have successfully finished probing (doing nothing but having allocated persistent memory in the tree's dst->ports, and maybe dst->rtable), and switch N failed to probe, ending the tree setup process before anything is tangible from the user's PoV.
If switch N fails to probe, its memory (ports) will be freed and removed from dst->ports. However, the dst->rtable elements pointing to its ports, as created by dsa_link_touch(), will remain there, and will lead to use-after-free if dereferenced.
If dsa_tree_setup_switches() returns -EPROBE_DEFER, which is entirely possible because that is where ds->ops->setup() is, we get a kasan report like this:
==================================================================
BUG: KASAN: slab-use-after-free in mv88e6xxx_setup_upstream_port+0x240/0x568 Read of size 8 at addr ffff000004f56020 by task kworker/u8:3/42 Call trace: __asan_report_load8_noabort+0x20/0x30 mv88e6xxx_setup_upstream_port+0x240/0x568 mv88e6xxx_setup+0xebc/0x1eb0 dsa_register_switch+0x1af4/0x2ae0 mv88e6xxx_register_switch+0x1b8/0x2a8 mv88e6xxx_probe+0xc4c/0xf60 mdio_probe+0x78/0xb8 really_probe+0x2b8/0x5a8 __driver_probe_device+0x164/0x298 driver_probe_device+0x78/0x258 __device_attach_driver+0x274/0x350 Allocated by task 42: __kasan_kmalloc+0x84/0xa0 __kmalloc_cache_noprof+0x298/0x490 dsa_switch_touch_ports+0x174/0x3d8 dsa_register_switch+0x800/0x2ae0 mv88e6xxx_register_switch+0x1b8/0x2a8 mv88e6xxx_probe+0xc4c/0xf60 mdio_probe+0x78/0xb8 really_probe+0x2b8/0x5a8 __driver_probe_device+0x164/0x298 driver_probe_device+0x78/0x258 __device_attach_driver+0x274/0x350 Freed by task 42: __kasan_slab_free+0x48/0x68 kfree+0x138/0x418 dsa_register_switch+0x2694/0x2ae0 mv88e6xxx_register_switch+0x1b8/0x2a8 mv88e6xxx_probe+0xc4c/0xf60 mdio_probe+0x78/0xb8 really_probe+0x2b8/0x5a8 __driver_probe_device+0x164/0x298 driver_probe_device+0x78/0x258 __device_attach_driver+0x274/0x350
The simplest way to fix the bug is to delete the routing table in its entirety. dsa_tree_setup_routing_table() has no problem in regenerating it even if we deleted links between ports other than those of switch N, because dsa_link_touch() first checks whether the port pair already exists in dst->rtable, allocating if not.
The deletion of the routing table in its entirety already exists in dsa_tree_teardown(), so refactor that into a function that can also be called from the tree setup error path.
In my analysis of the commit to blame, it is the one which added dsa_link elements to dst->rtable. Prior to that, each switch had its own ds->rtable which is freed when the switch fails to probe. But the tree is potentially persistent memory.
--- net/dsa/dsa.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
net/dsa/dsa.c +14 -7
@@ -862,6 +862,16 @@ static void dsa_tree_teardown_lags(struct dsa_switch_tree *dst)kfree (dst->lags); } +static void dsa_tree_teardown_routing_table (struct dsa_switch_tree *dst) +{ +struct dsa_link *dl, *next; + +list_for_each_entry_safe (dl, next, &dst->rtable, list) { +list_del (&dl->list); +kfree (dl); + } +} +static int dsa_tree_setup (struct dsa_switch_tree *dst) {bool complete;
@@ -879,7 +889,7 @@ static int dsa_tree_setup(struct dsa_switch_tree *dst) err =dsa_tree_setup_cpu_ports (dst);if (err) -return err; + goto teardown_rtable; err =dsa_tree_setup_switches (dst);if (err)
@@ -911,14 +921,14 @@ static int dsa_tree_setup(struct dsa_switch_tree *dst)dsa_tree_teardown_switches (dst); teardown_cpu_ports:dsa_tree_teardown_cpu_ports (dst); +teardown_rtable: +dsa_tree_teardown_routing_table (dst);return err; }static void dsa_tree_teardown (struct dsa_switch_tree *dst) { -struct dsa_link *dl, *next; -if (!dst->setup)return ;
@@ -932,10 +942,7 @@ static void dsa_tree_teardown(struct dsa_switch_tree *dst)dsa_tree_teardown_cpu_ports (dst); -list_for_each_entry_safe (dl, next, &dst->rtable, list) { -list_del (&dl->list); -kfree (dl); - } +dsa_tree_teardown_routing_table (dst);pr_info ("DSA: tree %d torn down\n" , dst->index);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/241 net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 514eff7b0aa1c5eb645ddbb8676ef3e2d88a8b99 ]
This is very similar to the problem and solution from commit 232deb3f9567 ("net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error"), except for the dsa_port_do_tag_8021q_vlan_del() operation.
--- net/dsa/tag_8021q.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/dsa/tag_8021q.c +1 -1
@@ -197,7 +197,7 @@ static int dsa_port_do_tag_8021q_vlan_del(struct dsa_port *dp, u16 vid) err = ds->ops->tag_8021q_vlan_del (ds, port, vid);if (err) { -refcount_inc (&v->refcount); +refcount_set (&v->refcount,1 );return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/241 ptp: ocp: fix start time alignment in ptp_ocp_signal_set
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Maimon <[email protected]>
[ Upstream commit 2a5970d5aaff8f3e33ce3bfaa403ae88c40de40d ]
In ptp_ocp_signal_set, the start time for periodic signals is not aligned to the next period boundary. The current code rounds up the start time and divides by the period but fails to multiply back by the period, causing misaligned signal starts. Fix this by multiplying the rounded-up value by the period to ensure the start time is the closest next period.
--- drivers/ptp/ptp_ocp.c | 1 + 1 file changed, 1 insertion(+)
drivers/ptp/ptp_ocp.c +1 -0
@@ -2067,6 +2067,7 @@ ptp_ocp_signal_set(struct ptp_ocp *bp, int gen, struct ptp_ocp_signal *s)if (!s->start) {/* roundup() does not work on 32-bit systems */ s->start =DIV64_U64_ROUND_UP (start_ns, s->period); + s->start *= s->period; s->start =ktime_add (s->start, s->phase); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/241 netfilter: conntrack: fix erronous removal of offload bit
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit d2d31ea8cd80b9830cdab624e94f9d41178fc99d ]
The blamed commit exposes a possible issue with flow_offload_teardown():
We might remove the offload bit of a conntrack entry that has been offloaded again.
1. conntrack entry c1 is offloaded via flow f1 (f1->ct == c1).
2. f1 times out and is pushed back to slowpath, c1 offload bit is removed. Due to bug, f1 is not unlinked from rhashtable right away.
3. a new packet arrives for the flow and re-offload is triggered, i.e. f2->ct == c1. This is because lookup in flowtable skip entries with teardown bit set.
4. Next flowtable gc cycle finds f1 again
5. flow_offload_teardown() is called again for f1 and c1 offload bit is removed again, even though we have f2 referencing the same entry.
This is harmless, but clearly not correct.
Fix the bug that exposes this: set 'teardown = true' to have the gc callback unlink the flowtable entry from the table right away instead of the unintentional defer to the next round.
Also prevent flow_offload_teardown() from fixing up the ct state more than
once: We could also be called from the data path or a notifier, not only from the flowtable gc callback.
NF_FLOW_TEARDOWN can never be unset, so we can use it as synchronization
point: if we observe did not see a 0 -> 1 transition, then another CPU is already doing the ct state fixups for us.
--- net/netfilter/nf_flow_table_core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/netfilter/nf_flow_table_core.c +6 -4
@@ -383,8 +383,8 @@ static void flow_offload_del(struct nf_flowtable *flow_table,void flow_offload_teardown (struct flow_offload *flow) {clear_bit (IPS_OFFLOAD_BIT , &flow->ct->status); -set_bit (NF_FLOW_TEARDOWN , &flow->flags); -flow_offload_fixup_ct (flow); +if (!test_and_set_bit (NF_FLOW_TEARDOWN , &flow->flags)) +flow_offload_fixup_ct (flow); }EXPORT_SYMBOL_GPL (flow_offload_teardown);
@@ -558,10 +558,12 @@ static void nf_flow_offload_gc_step(struct nf_flowtable *flow_table,if (nf_flow_has_expired (flow) ||nf_ct_is_dying (flow->ct) || -nf_flow_custom_gc (flow_table, flow)) +nf_flow_custom_gc (flow_table, flow)) {flow_offload_teardown (flow); -else if (!teardown) + teardown = true; + }else if (!teardown) {nf_flow_table_extend_ct_timeout (flow->ct); + }if (teardown) {if (test_bit (NF_FLOW_HW , &flow->flags)) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/241 net: ti: icss-iep: Add pwidth configuration for perout signal
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meghana Malladi <[email protected]>
[ Upstream commit e5b456a14215e3c0e84844c2926861b972e03632 ]
icss_iep_perout_enable_hw() is a common function for generating both pps and perout signals. When enabling pps, the application needs to only pass enable/disable argument, whereas for perout it supports different flags to configure the signal.
But icss_iep_perout_enable_hw() function is missing to hook the configuration params passed by the app, causing perout to behave same a pps (except being able to configure the period). As duty cycle is also one feature which can configured for perout, incorporate this in the function to get the expected signal.
Stable-dep-of: 7349c9e99793 ("net: ti: icss-iep: Fix possible NULL pointer dereference for perout request")
--- drivers/net/ethernet/ti/icssg/icss_iep.c | 47 ++++++++++++++++++++++-- 1 file changed, 44 insertions(+), 3 deletions(-)
drivers/net/ethernet/ti/icssg/icss_iep.c +44 -3
@@ -406,9 +406,16 @@ static void icss_iep_update_to_next_boundary(struct icss_iep *iep, u64 start_ns)static int icss_iep_perout_enable_hw (struct icss_iep *iep,struct ptp_perout_request *req,int on) { +struct timespec64 ts; +u64 ns_width;int ret;u64 cmp; +/* Calculate width of the signal for PPS/PEROUT handling */ + ts.tv_sec = req->on.sec; + ts.tv_nsec = req->on.nsec; + ns_width =timespec64_to_ns (&ts); +if (iep->ops && iep->ops->perout_enable) { ret = iep->ops->perout_enable (iep->clockops_data, req, on, &cmp);if (ret)
@@ -419,8 +426,9 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,regmap_write (iep->map,ICSS_IEP_CMP1_REG0 ,lower_32_bits (cmp));if (iep->plat_data->flags &ICSS_IEP_64BIT_COUNTER_SUPPORT )regmap_write (iep->map,ICSS_IEP_CMP1_REG1 ,upper_32_bits (cmp)); -/* Configure SYNC, 1ms pulse width */ -regmap_write (iep->map,ICSS_IEP_SYNC_PWIDTH_REG ,1000000 ); +/* Configure SYNC, based on req on width */ +regmap_write (iep->map,ICSS_IEP_SYNC_PWIDTH_REG , +div_u64 (ns_width, iep->def_inc));regmap_write (iep->map,ICSS_IEP_SYNC0_PERIOD_REG ,0 );regmap_write (iep->map,ICSS_IEP_SYNC_START_REG ,0 );regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG ,0 );/* one-shot mode */
@@ -447,6 +455,8 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, + req->period.nsec;icss_iep_update_to_next_boundary (iep, start_ns); +regmap_write (iep->map,ICSS_IEP_SYNC_PWIDTH_REG , +div_u64 (ns_width, iep->def_inc));/* Enable Sync in single shot mode */ regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG ,IEP_SYNC_CTRL_SYNC_N_EN (0 ) |IEP_SYNC_CTRL_SYNC_EN );
@@ -474,7 +484,36 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,static int icss_iep_perout_enable (struct icss_iep *iep,struct ptp_perout_request *req,int on) { -return -EOPNOTSUPP ; +int ret =0 ; + +/* Reject requests with unsupported flags */ +if (req->flags & ~PTP_PEROUT_DUTY_CYCLE ) +return -EOPNOTSUPP ; + +mutex_lock (&iep->ptp_clk_mutex); + +if (iep->pps_enabled) { + ret = -EBUSY ; + goto exit; + } + +if (iep->perout_enabled == !!on) + goto exit; + +/* Set default "on" time (1ms) for the signal if not passed by the app */ +if (!(req->flags &PTP_PEROUT_DUTY_CYCLE )) { + req->on.sec =0 ; + req->on.nsec =NSEC_PER_MSEC ; + } + + ret =icss_iep_perout_enable_hw (iep, req, on); +if (!ret) + iep->perout_enabled = !!on; + +exit: +mutex_unlock (&iep->ptp_clk_mutex); + +return ret; }static void icss_iep_cap_cmp_work (struct work_struct *work)
@@ -553,6 +592,8 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on) rq.perout.period.nsec =0 ; rq.perout.start.sec = ts.tv_sec +2 ; rq.perout.start.nsec =0 ; + rq.perout.on.sec =0 ; + rq.perout.on.nsec =NSEC_PER_MSEC ; ret =icss_iep_perout_enable_hw (iep, &rq.perout, on); }else { ret =icss_iep_perout_enable_hw (iep, &rq.perout, on);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/241 net: ti: icss-iep: Add phase offset configuration for perout signal
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meghana Malladi <[email protected]>
[ Upstream commit 220cb1be647a7ca4e60241405c66f8f612c9b046 ]
icss_iep_perout_enable_hw() is a common function for generating both pps and perout signals. When enabling pps, the application needs to only pass enable/disable argument, whereas for perout it supports different flags to configure the signal.
In case the app passes a valid phase offset value, the signal should start toggling after that phase offset, else start immediately or as soon as possible. ICSS_IEP_SYNC_START_REG register take number of clock cycles to wait before starting the signal after activation time. Set appropriate value to this register to support phase offset.
Stable-dep-of: 7349c9e99793 ("net: ti: icss-iep: Fix possible NULL pointer dereference for perout request")
--- drivers/net/ethernet/ti/icssg/icss_iep.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/icssg/icss_iep.c +16 -2
@@ -407,6 +407,7 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, struct ptp_perout_request *req, int on) {struct timespec64 ts; +u64 ns_start;u64 ns_width;int ret;u64 cmp;
@@ -416,6 +417,14 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep, ts.tv_nsec = req->on.nsec; ns_width =timespec64_to_ns (&ts); +if (req->flags &PTP_PEROUT_PHASE ) { + ts.tv_sec = req->phase.sec; + ts.tv_nsec = req->phase.nsec; + ns_start =timespec64_to_ns (&ts); + }else { + ns_start =0 ; + } +if (iep->ops && iep->ops->perout_enable) { ret = iep->ops->perout_enable (iep->clockops_data, req, on, &cmp);if (ret)
@@ -430,7 +439,8 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,regmap_write (iep->map,ICSS_IEP_SYNC_PWIDTH_REG ,div_u64 (ns_width, iep->def_inc));regmap_write (iep->map,ICSS_IEP_SYNC0_PERIOD_REG ,0 ); -regmap_write (iep->map,ICSS_IEP_SYNC_START_REG ,0 ); +regmap_write (iep->map,ICSS_IEP_SYNC_START_REG , +div_u64 (ns_start, iep->def_inc));regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG ,0 );/* one-shot mode */ /* Enable CMP 1 */ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
@@ -457,6 +467,8 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,regmap_write (iep->map,ICSS_IEP_SYNC_PWIDTH_REG ,div_u64 (ns_width, iep->def_inc)); +regmap_write (iep->map,ICSS_IEP_SYNC_START_REG , +div_u64 (ns_start, iep->def_inc));/* Enable Sync in single shot mode */ regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG ,IEP_SYNC_CTRL_SYNC_N_EN (0 ) |IEP_SYNC_CTRL_SYNC_EN );
@@ -487,7 +499,8 @@ static int icss_iep_perout_enable(struct icss_iep *iep,int ret =0 ;/* Reject requests with unsupported flags */ -if (req->flags & ~PTP_PEROUT_DUTY_CYCLE ) +if (req->flags & ~(PTP_PEROUT_DUTY_CYCLE | +PTP_PEROUT_PHASE ))return -EOPNOTSUPP ;mutex_lock (&iep->ptp_clk_mutex);
@@ -588,6 +601,7 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on)if (on) { ns =icss_iep_gettime (iep,NULL ); ts =ns_to_timespec64 (ns); + rq.perout.flags =0 ; rq.perout.period.sec =1 ; rq.perout.period.nsec =0 ; rq.perout.start.sec = ts.tv_sec +2 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/241 net: ti: icss-iep: Fix possible NULL pointer dereference for perout request
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meghana Malladi <[email protected]>
[ Upstream commit 7349c9e9979333abfce42da5f9025598083b59c9 ]
The ICSS IEP driver tracks perout and pps enable state with flags. Currently when disabling pps and perout signals during icss_iep_exit(), results in NULL pointer dereference for perout.
To fix the null pointer dereference issue, the icss_iep_perout_enable_hw function can be modified to directly clear the IEP CMP registers when disabling PPS or PEROUT, without referencing the ptp_perout_request structure, as its contents are irrelevant in this case.
--- drivers/net/ethernet/ti/icssg/icss_iep.c | 121 +++++++++++------------ 1 file changed, 58 insertions(+), 63 deletions(-)
drivers/net/ethernet/ti/icssg/icss_iep.c +58 -63
@@ -412,6 +412,22 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,int ret;u64 cmp; +if (!on) { +/* Disable CMP 1 */ +regmap_update_bits (iep->map,ICSS_IEP_CMP_CFG_REG , +IEP_CMP_CFG_CMP_EN (1 ),0 ); + +/* clear CMP regs */ +regmap_write (iep->map,ICSS_IEP_CMP1_REG0 ,0 ); +if (iep->plat_data->flags &ICSS_IEP_64BIT_COUNTER_SUPPORT ) +regmap_write (iep->map,ICSS_IEP_CMP1_REG1 ,0 ); + +/* Disable sync */ +regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG ,0 ); + +return 0 ; + } +/* Calculate width of the signal for PPS/PEROUT handling */ ts.tv_sec = req->on.sec; ts.tv_nsec = req->on.nsec;
@@ -430,64 +446,39 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,if (ret)return ret; -if (on) { -/* Configure CMP */ -regmap_write (iep->map,ICSS_IEP_CMP1_REG0 ,lower_32_bits (cmp)); -if (iep->plat_data->flags &ICSS_IEP_64BIT_COUNTER_SUPPORT ) -regmap_write (iep->map,ICSS_IEP_CMP1_REG1 ,upper_32_bits (cmp)); -/* Configure SYNC, based on req on width */ -regmap_write (iep->map,ICSS_IEP_SYNC_PWIDTH_REG , -div_u64 (ns_width, iep->def_inc)); -regmap_write (iep->map,ICSS_IEP_SYNC0_PERIOD_REG ,0 ); -regmap_write (iep->map,ICSS_IEP_SYNC_START_REG , -div_u64 (ns_start, iep->def_inc)); -regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG ,0 );/* one-shot mode */ -/* Enable CMP 1 */ -regmap_update_bits (iep->map,ICSS_IEP_CMP_CFG_REG , -IEP_CMP_CFG_CMP_EN (1 ),IEP_CMP_CFG_CMP_EN (1 )); - }else { -/* Disable CMP 1 */ -regmap_update_bits (iep->map,ICSS_IEP_CMP_CFG_REG , -IEP_CMP_CFG_CMP_EN (1 ),0 ); - -/* clear regs */ -regmap_write (iep->map,ICSS_IEP_CMP1_REG0 ,0 ); -if (iep->plat_data->flags &ICSS_IEP_64BIT_COUNTER_SUPPORT ) -regmap_write (iep->map,ICSS_IEP_CMP1_REG1 ,0 ); - } +/* Configure CMP */ +regmap_write (iep->map,ICSS_IEP_CMP1_REG0 ,lower_32_bits (cmp)); +if (iep->plat_data->flags &ICSS_IEP_64BIT_COUNTER_SUPPORT ) +regmap_write (iep->map,ICSS_IEP_CMP1_REG1 ,upper_32_bits (cmp)); +/* Configure SYNC, based on req on width */ +regmap_write (iep->map,ICSS_IEP_SYNC_PWIDTH_REG , +div_u64 (ns_width, iep->def_inc)); +regmap_write (iep->map,ICSS_IEP_SYNC0_PERIOD_REG ,0 ); +regmap_write (iep->map,ICSS_IEP_SYNC_START_REG , +div_u64 (ns_start, iep->def_inc)); +regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG ,0 );/* one-shot mode */ +/* Enable CMP 1 */ +regmap_update_bits (iep->map,ICSS_IEP_CMP_CFG_REG , +IEP_CMP_CFG_CMP_EN (1 ),IEP_CMP_CFG_CMP_EN (1 )); }else { -if (on) { -u64 start_ns; - - iep->period = ((u64 )req->period.sec *NSEC_PER_SEC ) + - req->period.nsec; - start_ns = ((u64 )req->period.sec *NSEC_PER_SEC ) - + req->period.nsec; -icss_iep_update_to_next_boundary (iep, start_ns); - -regmap_write (iep->map,ICSS_IEP_SYNC_PWIDTH_REG , -div_u64 (ns_width, iep->def_inc)); -regmap_write (iep->map,ICSS_IEP_SYNC_START_REG , -div_u64 (ns_start, iep->def_inc)); -/* Enable Sync in single shot mode */ -regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG , -IEP_SYNC_CTRL_SYNC_N_EN (0 ) |IEP_SYNC_CTRL_SYNC_EN ); -/* Enable CMP 1 */ -regmap_update_bits (iep->map,ICSS_IEP_CMP_CFG_REG , -IEP_CMP_CFG_CMP_EN (1 ),IEP_CMP_CFG_CMP_EN (1 )); - }else { -/* Disable CMP 1 */ -regmap_update_bits (iep->map,ICSS_IEP_CMP_CFG_REG , -IEP_CMP_CFG_CMP_EN (1 ),0 ); - -/* clear CMP regs */ -regmap_write (iep->map,ICSS_IEP_CMP1_REG0 ,0 ); -if (iep->plat_data->flags &ICSS_IEP_64BIT_COUNTER_SUPPORT ) -regmap_write (iep->map,ICSS_IEP_CMP1_REG1 ,0 ); - -/* Disable sync */ -regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG ,0 ); - } +u64 start_ns; + + iep->period = ((u64 )req->period.sec *NSEC_PER_SEC ) + + req->period.nsec; + start_ns = ((u64 )req->period.sec *NSEC_PER_SEC ) + + req->period.nsec; +icss_iep_update_to_next_boundary (iep, start_ns); + +regmap_write (iep->map,ICSS_IEP_SYNC_PWIDTH_REG , +div_u64 (ns_width, iep->def_inc)); +regmap_write (iep->map,ICSS_IEP_SYNC_START_REG , +div_u64 (ns_start, iep->def_inc)); +/* Enable Sync in single shot mode */ +regmap_write (iep->map,ICSS_IEP_SYNC_CTRL_REG , +IEP_SYNC_CTRL_SYNC_N_EN (0 ) |IEP_SYNC_CTRL_SYNC_EN ); +/* Enable CMP 1 */ +regmap_update_bits (iep->map,ICSS_IEP_CMP_CFG_REG , +IEP_CMP_CFG_CMP_EN (1 ),IEP_CMP_CFG_CMP_EN (1 )); }return 0 ;
@@ -498,11 +489,21 @@ static int icss_iep_perout_enable(struct icss_iep *iep, {int ret =0 ; +if (!on) + goto disable; +/* Reject requests with unsupported flags */ if (req->flags & ~(PTP_PEROUT_DUTY_CYCLE |PTP_PEROUT_PHASE ))return -EOPNOTSUPP ; +/* Set default "on" time (1ms) for the signal if not passed by the app */ +if (!(req->flags &PTP_PEROUT_DUTY_CYCLE )) { + req->on.sec =0 ; + req->on.nsec =NSEC_PER_MSEC ; + } + +disable:mutex_lock (&iep->ptp_clk_mutex);if (iep->pps_enabled) {
@@ -513,12 +514,6 @@ static int icss_iep_perout_enable(struct icss_iep *iep,if (iep->perout_enabled == !!on) goto exit; -/* Set default "on" time (1ms) for the signal if not passed by the app */ -if (!(req->flags &PTP_PEROUT_DUTY_CYCLE )) { - req->on.sec =0 ; - req->on.nsec =NSEC_PER_MSEC ; - } - ret =icss_iep_perout_enable_hw (iep, req, on);if (!ret) iep->perout_enabled = !!on;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/241 net: ethernet: mtk_eth_soc: reapply mdc divider on reset
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo-Cun Chen <[email protected]>
[ Upstream commit 6bc2b6c6f16d8e60de518d26da1bc6bc436cf71d ]
In the current method, the MDC divider was reset to the default setting of 2.5MHz after the NETSYS SER. Therefore, we need to reapply the MDC divider configuration function in mtk_hw_init() after reset.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 39 +++++++++++++-------- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 + 2 files changed, 25 insertions(+), 15 deletions(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +24 -15
@@ -823,9 +823,25 @@ static const struct phylink_mac_ops mtk_phylink_ops = { .mac_link_up = mtk_mac_link_up, }; +static void mtk_mdio_config (struct mtk_eth *eth) +{ +u32 val; + +/* Configure MDC Divider */ + val =FIELD_PREP (PPSC_MDC_CFG , eth->mdc_divider); + +/* Configure MDC Turbo Mode */ +if (mtk_is_netsys_v3_or_greater (eth)) +mtk_m32 (eth,0 ,MISC_MDC_TURBO ,MTK_MAC_MISC_V3 ); +else + val |=PPSC_MDC_TURBO ; + +mtk_m32 (eth,PPSC_MDC_CFG , val,MTK_PPSC ); +} +static int mtk_mdio_init (struct mtk_eth *eth) { -unsigned int max_clk =2500000 , divider; +unsigned int max_clk =2500000 ;struct device_node *mii_np;int ret;u32 val;
@@ -865,20 +881,9 @@ static int mtk_mdio_init(struct mtk_eth *eth) } max_clk = val; } - divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63); - -/* Configure MDC Turbo Mode */ -if (mtk_is_netsys_v3_or_greater (eth)) -mtk_m32 (eth,0 ,MISC_MDC_TURBO ,MTK_MAC_MISC_V3 ); - -/* Configure MDC Divider */ - val =FIELD_PREP (PPSC_MDC_CFG , divider); -if (!mtk_is_netsys_v3_or_greater (eth)) - val |=PPSC_MDC_TURBO ; -mtk_m32 (eth,PPSC_MDC_CFG , val,MTK_PPSC ); - -dev_dbg (eth->dev,"MDC is running on %d Hz\n" ,MDC_MAX_FREQ / divider); - + eth->mdc_divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63); +mtk_mdio_config (eth); +dev_dbg (eth->dev,"MDC is running on %d Hz\n" ,MDC_MAX_FREQ / eth->mdc_divider); ret =of_mdiobus_register (eth->mii_bus, mii_np); err_put_node:
@@ -3928,6 +3933,10 @@ static int mtk_hw_init(struct mtk_eth *eth, bool reset)else mtk_hw_reset (eth); +/* No MT7628/88 support yet */ +if (reset && !MTK_HAS_CAPS (eth->soc->caps,MTK_SOC_MT7628 )) +mtk_mdio_config (eth); +if (mtk_is_netsys_v3_or_greater (eth)) {/* Set FE to PDMAv2 if necessary */ val =mtk_r32 (eth,MTK_FE_GLO_MISC );
drivers/net/ethernet/mediatek/mtk_eth_soc.h +1 -0
@@ -1260,6 +1260,7 @@ struct mtk_eth {struct clk *clks[MTK_CLK_MAX ];struct mii_bus *mii_bus; +unsigned int mdc_divider;struct work_struct pending_work;unsigned long state;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/241 net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo-Cun Chen <[email protected]>
[ Upstream commit 6b02eb372c6776c9abb8bc81cf63f96039c24664 ]
Without this patch, the maximum weight of the queue limit will be incorrect when linked at 100Mbps due to an apparent typo.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +2 -2
@@ -734,7 +734,7 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,case SPEED_100 : val |=MTK_QTX_SCH_MAX_RATE_EN |FIELD_PREP (MTK_QTX_SCH_MAX_RATE_MAN ,103 ) | -FIELD_PREP (MTK_QTX_SCH_MAX_RATE_EXP ,3 ); +FIELD_PREP (MTK_QTX_SCH_MAX_RATE_EXP ,3 ) |FIELD_PREP (MTK_QTX_SCH_MAX_RATE_WEIGHT ,1 );break ;case SPEED_1000 :
@@ -757,7 +757,7 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,case SPEED_100 : val |=MTK_QTX_SCH_MAX_RATE_EN |FIELD_PREP (MTK_QTX_SCH_MAX_RATE_MAN ,1 ) | -FIELD_PREP (MTK_QTX_SCH_MAX_RATE_EXP ,5 ); +FIELD_PREP (MTK_QTX_SCH_MAX_RATE_EXP ,5 ) |FIELD_PREP (MTK_QTX_SCH_MAX_RATE_WEIGHT ,1 );break ;case SPEED_1000 :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/241 net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo-Cun Chen <[email protected]>
[ Upstream commit 1b66124135f5f8640bd540fadda4b20cdd23114b ]
The QDMA packet scheduler suffers from a performance issue. Fix this by picking up changes from MediaTek's SDK which change to use Token Bucket instead of Leaky Bucket and fix the SPEED_1000 configuration.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +3 -3
@@ -762,8 +762,8 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,break ;case SPEED_1000 : val |=MTK_QTX_SCH_MAX_RATE_EN | -FIELD_PREP (MTK_QTX_SCH_MAX_RATE_MAN ,10 ) | -FIELD_PREP (MTK_QTX_SCH_MAX_RATE_EXP ,5 ) | +FIELD_PREP (MTK_QTX_SCH_MAX_RATE_MAN ,1 ) | +FIELD_PREP (MTK_QTX_SCH_MAX_RATE_EXP ,6 ) |FIELD_PREP (MTK_QTX_SCH_MAX_RATE_WEIGHT ,10 );break ;default :
@@ -3274,7 +3274,7 @@ static int mtk_start_dma(struct mtk_eth *eth)if (mtk_is_netsys_v2_or_greater (eth)) val |=MTK_MUTLI_CNT |MTK_RESV_BUF |MTK_WCOMP_EN |MTK_DMAD_WR_WDONE | -MTK_CHK_DDONE_EN |MTK_LEAKY_BUCKET_EN ; +MTK_CHK_DDONE_EN ;else val |=MTK_RX_BT_32DWORDS ;mtk_w32 (eth, val, reg_map->qdma.glo_cfg);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/241 riscv: Use kvmalloc_array on relocation_hashtable
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Pierce <[email protected]>
[ Upstream commit 8578b2f7e1fb79d4b92b62fbbe913548bb363654 ]
The number of relocations may be a huge value that is unallocatable by kmalloc. Use kvmalloc instead so that it does not fail.
--- arch/riscv/kernel/module.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/riscv/kernel/module.c +5 -4
@@ -648,7 +648,7 @@ process_accumulated_relocations(struct module *me,kfree (bucket_iter); } -kfree (*relocation_hashtable); +kvfree (*relocation_hashtable); } static int add_relocation_to_accumulate(struct module *me, int type,
@@ -752,9 +752,10 @@ initialize_relocation_hashtable(unsigned int num_relocations, hashtable_size <<= should_double_size; - *relocation_hashtable =kmalloc_array (hashtable_size, -sizeof (**relocation_hashtable), -GFP_KERNEL ); +/* Number of relocations may be large, so kvmalloc it */ + *relocation_hashtable =kvmalloc_array (hashtable_size, +sizeof (**relocation_hashtable), +GFP_KERNEL );if (!*relocation_hashtable)return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/241 riscv: Properly export reserved regions in /proc/iomem
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Björn Töpel <[email protected]>
[ Upstream commit e94eb7ea6f206e229791761a5fdf9389f8dbd183 ]
The /proc/iomem represents the kernel's memory map. Regions marked with "Reserved" tells the user that the range should not be tampered with. Kexec-tools, when using the older kexec_load syscall relies on the "Reserved" regions to build the memory segments, that will be the target of the new kexec'd kernel.
The RISC-V port tries to expose all reserved regions to userland, but some regions were not properly exposed: Regions that resided in both the "regular" and reserved memory block, e.g. the EFI Memory Map. A missing entry could result in reserved memory being overwritten.
It turns out, that arm64, and loongarch had a similar issue a while back:
commit d91680e687f4 ("arm64: Fix /proc/iomem for reserved but not memory regions") commit 50d7ba36b916 ("arm64: export memblock_reserve()d regions via /proc/iomem")
Similar to the other ports, resolve the issue by splitting the regions in an arch initcall, since we need a working allocator.
--- arch/riscv/kernel/setup.c | 36 +++++++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-)
arch/riscv/kernel/setup.c +35 -1
@@ -66,6 +66,9 @@ static struct resource bss_res = { .name = "Kernel bss", };static struct resource elfcorehdr_res = { .name ="ELF Core hdr" , };#endif +static int num_standard_resources; +static struct resource *standard_resources; +static int __init add_resource (struct resource *parent,struct resource *res) {
@@ -139,7 +142,7 @@ static void __init init_resources(void)struct resource *res =NULL ;struct resource *mem_res =NULL ;size_t mem_res_sz =0 ; -int num_resources =0 , res_idx =0 ; +int num_resources =0 , res_idx =0 , non_resv_res =0 ;int ret =0 ;/* + 1 as memblock_alloc() might increase memblock.reserved.cnt */
@@ -193,6 +196,7 @@ static void __init init_resources(void)/* Add /memory regions to the resource tree */ for_each_mem_region (region) { res = &mem_res[res_idx--]; + non_resv_res++;if (unlikely (memblock_is_nomap (region))) { res->name ="Reserved" ;
@@ -210,6 +214,9 @@ static void __init init_resources(void) goto error; } + num_standard_resources = non_resv_res; + standard_resources = &mem_res[res_idx +1 ]; +/* Clean-up any unused pre-allocated resources */ if (res_idx >=0 )memblock_free (mem_res, (res_idx +1 ) *sizeof (*mem_res));
@@ -221,6 +228,33 @@ static void __init init_resources(void)memblock_free (mem_res, mem_res_sz); } +static int __init reserve_memblock_reserved_regions (void ) +{ +u64 i, j; + +for (i =0 ; i < num_standard_resources; i++) { +struct resource *mem = &standard_resources[i]; +phys_addr_t r_start, r_end, mem_size =resource_size (mem); + +if (!memblock_is_region_reserved (mem->start, mem_size)) +continue ; + +for_each_reserved_mem_range (j, &r_start, &r_end) { +resource_size_t start, end; + + start =max (PFN_PHYS (PFN_DOWN (r_start)), mem->start); + end =min (PFN_PHYS (PFN_UP (r_end)) -1 , mem->end); + +if (start > mem->end || end < mem->start) +continue ; + +reserve_region_with_split (mem, start, end,"Reserved" ); + } + } + +return 0 ; +} +arch_initcall (reserve_memblock_reserved_regions);static void __init parse_dtb (void ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/241 riscv: module: Fix out-of-bounds relocation access
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
[ Upstream commit 0b4cce68efb93e31a8e51795d696df6e379cb41c ]
The current code allows rel[j] to access one element past the end of the relocation section. Simplify to num_relocations which is equivalent to the existing size expression.
--- arch/riscv/kernel/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/module.c +1 -1
@@ -860,7 +860,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, } j++; -if (j > sechdrs[relsec].sh_size /sizeof (*rel)) +if (j == num_relocations) j =0 ; }while (j_idx != j);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/241 riscv: module: Allocate PLT entries for R_RISCV_PLT32
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
[ Upstream commit 1ee1313f4722e6d67c6e9447ee81d24d6e3ff4ad ]
apply_r_riscv_plt32_rela() may need to emit a PLT entry for the referenced symbol, so there must be space allocated in the PLT.
--- arch/riscv/kernel/module-sections.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
arch/riscv/kernel/module-sections.c +7 -6
@@ -73,16 +73,17 @@ static bool duplicate_rela(const Elf_Rela *rela, int idx)static void count_max_entries (Elf_Rela *relas,int num,unsigned int *plts,unsigned int *gots) { -unsigned int type, i; - -for (i =0 ; i < num; i++) { - type =ELF_RISCV_R_TYPE (relas[i].r_info); -if (type ==R_RISCV_CALL_PLT ) { +for (int i =0 ; i < num; i++) { +switch (ELF_R_TYPE (relas[i].r_info)) { +case R_RISCV_CALL_PLT : +case R_RISCV_PLT32 :if (!duplicate_rela (relas, i)) (*plts)++; - }else if (type ==R_RISCV_GOT_HI20 ) { +break ; +case R_RISCV_GOT_HI20 :if (!duplicate_rela (relas, i)) (*gots)++; +break ; } } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/241 kunit: qemu_configs: SH: Respect kunit cmdline
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit b26c1a85f3fc3cc749380ff94199377fc2d0c203 ]
The default SH kunit configuration sets CONFIG_CMDLINE_OVERWRITE which completely disregards the cmdline passed from the bootloader/QEMU in favor of the builtin CONFIG_CMDLINE.
However the kunit tool needs to pass arguments to the in-kernel kunit core, for filters and other runtime parameters.
Enable CONFIG_CMDLINE_EXTEND instead, so kunit arguments are respected.
--- tools/testing/kunit/qemu_configs/sh.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/testing/kunit/qemu_configs/sh.py +3 -1
@@ -7,7 +7,9 @@ CONFIG_CPU_SUBTYPE_SH7751R=y CONFIG_MEMORY_START=0x0c000000 CONFIG_SH_RTS7751R2D=y CONFIG_RTS7751R2D_PLUS=y -CONFIG_SERIAL_SH_SCI=y''', +CONFIG_SERIAL_SH_SCI=y +CONFIG_CMDLINE_EXTEND=y +''', qemu_arch='sh4', kernel_path='arch/sh/boot/zImage', kernel_command_line='console=ttySC1',
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/241 thermal: intel: int340x: Fix Panther Lake DLVR support
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
[ Upstream commit 00c5ff5e9a55dca2e7ca29af4e5f8708731faf11 ]
Panther Lake uses the same DLVR register offsets as Lunar Lake, but the driver uses the default register offsets table for it by mistake.
Move the selection of register offsets table from the actual attribute read/write callbacks to proc_thermal_rfim_add() and make it handle Panther Lake the same way as Lunar Lake. This way it is clean and in the future such issues can be avoided.
--- .../int340x_thermal/processor_thermal_rfim.c | 33 ++++++++++--------- 1 file changed, 17 insertions(+), 16 deletions(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c +17 -16
@@ -166,15 +166,18 @@ static const struct mmio_reg adl_dvfs_mmio_regs[] = { { 0, 0x5A40, 1, 0x1, 0}, /* rfi_disable */ }; +static const struct mapping_table *dlvr_mapping; +static const struct mmio_reg *dlvr_mmio_regs_table; +#define RFIM_SHOW (suffix, table)\ static ssize_t suffix##_show(struct device *dev,\ struct device_attribute *attr,\ char *buf)\ {\ - const struct mapping_table *mapping = NULL;\ + const struct mmio_reg *mmio_regs = dlvr_mmio_regs_table;\ + const struct mapping_table *mapping = dlvr_mapping;\ struct proc_thermal_device *proc_priv;\ struct pci_dev *pdev = to_pci_dev(dev);\ - const struct mmio_reg *mmio_regs;\ const char **match_strs;\ int ret, err;\ u32 reg_val;\
@@ -186,12 +189,6 @@ static ssize_t suffix##_show(struct device *dev,\ mmio_regs = adl_dvfs_mmio_regs;\ }else if (table ==2 ) { \ match_strs = (const char **)dlvr_strings;\ -if (pdev->device ==PCI_DEVICE_ID_INTEL_LNLM_THERMAL ) {\ - mmio_regs = lnl_dlvr_mmio_regs;\ - mapping = lnl_dlvr_mapping;\ - }else {\ - mmio_regs = dlvr_mmio_regs;\ - } \ }else {\ match_strs = (const char **)fivr_strings;\ mmio_regs = tgl_fivr_mmio_regs;\
@@ -214,12 +211,12 @@ static ssize_t suffix##_store(struct device *dev,\struct device_attribute *attr,\ const char *buf, size_t count)\ {\ - const struct mapping_table *mapping = NULL;\ + const struct mmio_reg *mmio_regs = dlvr_mmio_regs_table;\ +const struct mapping_table *mapping = dlvr_mapping;\struct proc_thermal_device *proc_priv;\struct pci_dev *pdev =to_pci_dev (dev);\unsigned int input;\const char **match_strs;\ -const struct mmio_reg *mmio_regs;\int ret, err;\u32 reg_val;\u32 mask;\
@@ -230,12 +227,6 @@ static ssize_t suffix##_store(struct device *dev,\ mmio_regs = adl_dvfs_mmio_regs;\ }else if (table ==2 ) { \ match_strs = (const char **)dlvr_strings;\ -if (pdev->device ==PCI_DEVICE_ID_INTEL_LNLM_THERMAL ) {\ - mmio_regs = lnl_dlvr_mmio_regs;\ - mapping = lnl_dlvr_mapping;\ - }else {\ - mmio_regs = dlvr_mmio_regs;\ - } \ }else {\ match_strs = (const char **)fivr_strings;\ mmio_regs = tgl_fivr_mmio_regs;\
@@ -448,6 +439,16 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc }if (proc_priv->mmio_feature_mask &PROC_THERMAL_FEATURE_DLVR ) { +switch (pdev->device) { +case PCI_DEVICE_ID_INTEL_LNLM_THERMAL : +case PCI_DEVICE_ID_INTEL_PTL_THERMAL : + dlvr_mmio_regs_table = lnl_dlvr_mmio_regs; + dlvr_mapping = lnl_dlvr_mapping; +break ; +default : + dlvr_mmio_regs_table = dlvr_mmio_regs; +break ; + } ret =sysfs_create_group (&pdev->dev.kobj, &dlvr_attribute_group);if (ret)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/241 riscv: KGDB: Do not inline arch_kgdb_breakpoint()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
[ Upstream commit 3af4bec9c1db3f003be4d5ae09b6a737e4be1612 ]
The arch_kgdb_breakpoint() function defines the kgdb_compiled_break symbol using inline assembly.
There's a potential issue where the compiler might inline arch_kgdb_breakpoint(), which would then define the kgdb_compiled_break symbol multiple times, leading to fail to link vmlinux.o.
This isn't merely a potential compilation problem. The intent here is to determine the global symbol address of kgdb_compiled_break, and if this function is inlined multiple times, it would logically be a grave error.
--- arch/riscv/include/asm/kgdb.h | 9 +-------- arch/riscv/kernel/kgdb.c | 8 ++++++++ 2 files changed, 9 insertions(+), 8 deletions(-)
arch/riscv/include/asm/kgdb.h +1 -8
@@ -19,16 +19,9 @@#ifndef __ASSEMBLY__ +void arch_kgdb_breakpoint (void );extern unsigned long kgdb_compiled_break; -static inline void arch_kgdb_breakpoint (void ) -{ - asm(".global kgdb_compiled_break\n" -".option norvc\n" -"kgdb_compiled_break: ebreak\n" -".option rvc\n" ); -} -#endif /* !__ASSEMBLY__ */ #define DBG_REG_ZERO "zero"
arch/riscv/kernel/kgdb.c +8 -0
@@ -254,6 +254,14 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc) regs->epc = pc; } +noinline void arch_kgdb_breakpoint(void) +{ + asm(".global kgdb_compiled_break\n" +".option norvc\n" +"kgdb_compiled_break: ebreak\n" +".option rvc\n" ); +} +void kgdb_arch_handle_qxfer_pkt (char *remcom_in_buffer,char *remcom_out_buffer) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/241 riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
[ Upstream commit 550c2aa787d1b06efcb11de1877354502a1237f2 ]
[ Quoting Samuel Holland: ]
This is a separate issue, but using ".option rvc" here is a bug. It will unconditionally enable the C extension for the rest of the file, even if the kernel is being built with CONFIG_RISCV_ISA_C=n.
[ Quoting Palmer Dabbelt: ]
We're just looking at the address of kgdb_compiled_break, so it's fine if it ends up as a c.ebreak.
[ Quoting Alexandre Ghiti: ]
.option norvc is used to prevent the assembler from using compressed instructions, but it's generally used when we need to ensure the size of the instructions that are used, which is not the case here as noted by Palmer since we only care about the address. So yes it will work fine with C enabled :)
So let's just remove them all.
--- arch/riscv/kernel/kgdb.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/riscv/kernel/kgdb.c +1 -3
@@ -257,9 +257,7 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc) noinline void arch_kgdb_breakpoint(void) { asm(".global kgdb_compiled_break\n" -".option norvc\n" -"kgdb_compiled_break: ebreak\n" -".option rvc\n" ); +"kgdb_compiled_break: ebreak\n" ); } void kgdb_arch_handle_qxfer_pkt(char *remcom_in_buffer,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/241 cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit cfde542df7dd51d26cf667f4af497878ddffd85a ]
Commit 8e461a1cb43d ("cpufreq: schedutil: Fix superfluous updates caused by need_freq_update") modified sugov_should_update_freq() to set the need_freq_update flag only for drivers with CPUFREQ_NEED_UPDATE_LIMITS set, but that flag generally needs to be set when the policy limits change because the driver callback may need to be invoked for the new limits to take effect.
However, if the return value of cpufreq_driver_resolve_freq() after applying the new limits is still equal to the previously selected frequency, the driver callback needs to be invoked only in the case when CPUFREQ_NEED_UPDATE_LIMITS is set (which means that the driver specifically wants its callback to be invoked every time the policy limits change).
Update the code accordingly to avoid missing policy limits changes for drivers without CPUFREQ_NEED_UPDATE_LIMITS.
--- kernel/sched/cpufreq_schedutil.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
kernel/sched/cpufreq_schedutil.c +15 -3
@@ -83,7 +83,7 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)if (unlikely (sg_policy->limits_changed)) { sg_policy->limits_changed = false; - sg_policy->need_freq_update =cpufreq_driver_test_flags (CPUFREQ_NEED_UPDATE_LIMITS ); + sg_policy->need_freq_update = true;return true; }
@@ -95,10 +95,22 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)static bool sugov_update_next_freq (struct sugov_policy *sg_policy,u64 time,unsigned int next_freq) { -if (sg_policy->need_freq_update) +if (sg_policy->need_freq_update) { sg_policy->need_freq_update = false; -else if (sg_policy->next_freq == next_freq) +/* +* The policy limits have changed, but if the return value of +* cpufreq_driver_resolve_freq() after applying the new limits +* is still equal to the previously selected frequency, the +* driver callback need not be invoked unless the driver +* specifically wants that to happen on every update of the +* policy limits. +*/ +if (sg_policy->next_freq == next_freq && + !cpufreq_driver_test_flags (CPUFREQ_NEED_UPDATE_LIMITS )) +return false; + }else if (sg_policy->next_freq == next_freq) {return false; + } sg_policy->next_freq = next_freq; sg_policy->last_freq_update_time = time;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/241 objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit a3cd5f507b72c0532c3345b6913557efab34f405 upstream.
Starting with Rust 1.86.0 (see upstream commit b151b513ba2b ("Insert null checks for pointer dereferences when debug assertions are enabled") [1]), under some kernel configurations with CONFIG_RUST_DEBUG_ASSERTIONS=y, one may trigger a new objtool warning:
rust/kernel.o: warning: objtool: _R..._6kernel9workqueue6system() falls through to next function _R...9workqueue14system_highpri()
due to a call to the noreturn symbol:
core::panicking::panic_null_pointer_dereference
Thus add it to the list so that objtool knows it is actually noreturn.
See commit 56d680dd23c3 ("objtool/rust: list noreturn Rust functions") for more details.
--- tools/objtool/check.c | 1 + 1 file changed, 1 insertion(+)
tools/objtool/check.c +1 -0
@@ -226,6 +226,7 @@ static bool is_rust_noreturn(const strucstr_ends_with (func->name,"_4core9panicking14panic_nounwind" ) ||str_ends_with (func->name,"_4core9panicking18panic_bounds_check" ) ||str_ends_with (func->name,"_4core9panicking19assert_failed_inner" ) || +str_ends_with (func->name,"_4core9panicking30panic_null_pointer_dereference" ) ||str_ends_with (func->name,"_4core9panicking36panic_misaligned_pointer_dereference" ) ||strstr (func->name,"_4core9panicking13assert_failed" ) || strstr(func->name, "_4core9panicking11panic_const24panic_const_") ||
Greg Kroah-Hartman
maintainerPATCH 97/241 rust: helpers: Remove volatile qualifier from io helpers
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUJITA Tomonori <[email protected]>
commit 584e61452f75bfeac2cdd83730b4059526ec60c7 upstream.
Remove the volatile qualifier used with __iomem in helper functions in io.c. These helper functions are just wrappers around the corresponding accessors so they are unnecessary.
This fixes the following UML build error with CONFIG_RUST enabled:
In file included from rust/helpers/helpers.c:19:rust/helpers/io.c:12:10: error: passing 'volatile void *' to parameter of type 'void *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
12 | iounmap(addr);
| ^~~~arch/um/include/asm/io.h:19:42: note: passing argument to parameter 'addr' here
19 | static inline void iounmap(void __iomem *addr)
| ^
1 error generated.
[ Arnd explains [1] that removing the qualifier is the way forward
(thanks!):
Rihgt, I tried this last week when it came up first, removing the 'volatile' annotations in the asm-generic/io.h header and then all the ones that caused build regressions on arm/arm64/x86 randconfig and allmodconfig builds. This patch is a little longer than my original version as I did run into a few regressions later.
As far as I can tell, none of these volatile annotations have any actual effect, and most of them date back to ancient kernels where this may have been required.
Leaving it out of the rust interface is clearly the right way, and it shouldn't be too hard to upstream the changes below when we need to, but I also don't see any priority to send these. If anyone wants to help out, I can send them the whole patch.
I created an issue [2] in case someone wants to help. - Miguel ]
--- rust/helpers/io.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-)
rust/helpers/io.c +17 -17
@@ -7,94 +7,94 @@ void __iomem *rust_helper_ioremap(phys_addr_t offset, size_t size)return ioremap (offset, size); } -void rust_helper_iounmap (volatile void __iomem *addr) +void rust_helper_iounmap (void __iomem *addr) {iounmap (addr); } -u8 rust_helper_readb (const volatile void __iomem *addr) +u8 rust_helper_readb (const void __iomem *addr) {return readb (addr); } -u16 rust_helper_readw (const volatile void __iomem *addr) +u16 rust_helper_readw (const void __iomem *addr) {return readw (addr); } -u32 rust_helper_readl (const volatile void __iomem *addr) +u32 rust_helper_readl (const void __iomem *addr) {return readl (addr); }#ifdef CONFIG_64BIT -u64 rust_helper_readq (const volatile void __iomem *addr) +u64 rust_helper_readq (const void __iomem *addr) {return readq (addr); }#endif -void rust_helper_writeb (u8 value,volatile void __iomem *addr) +void rust_helper_writeb (u8 value,void __iomem *addr) {writeb (value, addr); } -void rust_helper_writew (u16 value,volatile void __iomem *addr) +void rust_helper_writew (u16 value,void __iomem *addr) {writew (value, addr); } -void rust_helper_writel (u32 value,volatile void __iomem *addr) +void rust_helper_writel (u32 value,void __iomem *addr) {writel (value, addr); }#ifdef CONFIG_64BIT -void rust_helper_writeq (u64 value,volatile void __iomem *addr) +void rust_helper_writeq (u64 value,void __iomem *addr) {writeq (value, addr); }#endif -u8 rust_helper_readb_relaxed (const volatile void __iomem *addr) +u8 rust_helper_readb_relaxed (const void __iomem *addr) {return readb_relaxed (addr); } -u16 rust_helper_readw_relaxed (const volatile void __iomem *addr) +u16 rust_helper_readw_relaxed (const void __iomem *addr) {return readw_relaxed (addr); } -u32 rust_helper_readl_relaxed (const volatile void __iomem *addr) +u32 rust_helper_readl_relaxed (const void __iomem *addr) {return readl_relaxed (addr); }#ifdef CONFIG_64BIT -u64 rust_helper_readq_relaxed (const volatile void __iomem *addr) +u64 rust_helper_readq_relaxed (const void __iomem *addr) {return readq_relaxed (addr); }#endif -void rust_helper_writeb_relaxed (u8 value,volatile void __iomem *addr) +void rust_helper_writeb_relaxed (u8 value,void __iomem *addr) {writeb_relaxed (value, addr); } -void rust_helper_writew_relaxed (u16 value,volatile void __iomem *addr) +void rust_helper_writew_relaxed (u16 value,void __iomem *addr) {writew_relaxed (value, addr); } -void rust_helper_writel_relaxed (u32 value,volatile void __iomem *addr) +void rust_helper_writel_relaxed (u32 value,void __iomem *addr) {writel_relaxed (value, addr); }#ifdef CONFIG_64BIT -void rust_helper_writeq_relaxed (u64 value,volatile void __iomem *addr) +void rust_helper_writeq_relaxed (u64 value,void __iomem *addr) {writeq_relaxed (value, addr); }
Signature · 1 line
2.49.0
Greg Kroah-Hartman
maintainerPATCH 98/241 rust: kasan/kbuild: fix missing flags on first build
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 46e24a545cdb4556f8128c90ecc34eeae52477a0 upstream.
If KASAN is enabled, and one runs in a clean repository e.g.:
make LLVM=1 prepare
make LLVM=1 prepare
Then the Rust code gets rebuilt, which should not happen.
The reason is some of the LLVM KASAN rustc flags are added in the second run:
-Cllvm-args=-asan-instrumentation-with-call-threshold=10000
-Cllvm-args=-asan-stack=0
-Cllvm-args=-asan-globals=1
-Cllvm-args=-asan-kernel-mem-intrinsic-prefix=1Further runs do not rebuild Rust because the flags do not change anymore.
Rebuilding like that in the second run is bad, even if this just happens with KASAN enabled, but missing flags in the first one is even worse.
The root issue is that we pass, for some architectures and for the moment, a generated target.json file. That file is not ready by the time rustc gets called for the flag test, and thus the flag test fails just because the file is not available, e.g.:
$ ... --target=./scripts/target.json ... -Cllvm-args=...
error: target file "./scripts/target.json" does not existThere are a few approaches we could take here to solve this. For instance, we could ensure that every time that the config is rebuilt, we regenerate the file and recompute the flags. Or we could use the LLVM version to check for these flags, instead of testing the flag (which may have other advantages, such as allowing us to detect renames on the LLVM side).
However, it may be easier than that: rustc is aware of the -Cllvm-args regardless of the --target (e.g. I checked that the list printed is the same, plus that I can check for these flags even if I pass a completely unrelated target), and thus we can just eliminate the dependency completely.
Thus filter out the target.
This does mean that rustc-option cannot be used to test a flag that requires the right target, but we don't have other users yet, it is a minimal change and we want to get rid of custom targets in the future.
We could only filter in the case target.json is used, to make it work in more cases, but then it would be harder to notice that it may not work in a couple architectures.
--- scripts/Makefile.compiler | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.compiler +1 -1
@@ -76,7 +76,7 @@ ld-option = $(call try-run, $(LD) $(KBUI # TODO: remove RUSTC_BOOTSTRAP=1 when we raise the minimum GNU Make version to 4.4 __rustc-option = $(call try-run,\ echo '#![allow(missing_docs)]#![feature(no_core)]#![no_core]' | RUSTC_BOOTSTRAP=1\ - $(1) --sysroot=/dev/null $(filter-out --sysroot=/dev/null,$(2)) $(3)\ + $(1) --sysroot=/dev/null $(filter-out --sysroot=/dev/null --target=%,$(2)) $(3)\ --crate-type=rlib --out-dir=$(TMPOUT) --emit=obj=- - >/dev/null,$(3),$(4)) # rustc-option
Greg Kroah-Hartman
maintainerPATCH 99/241 rust: disable `clippy::needless_continue`
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 0866ee8e50f017731b80891294c0edd0f5fcd0a9 upstream.
Starting with Rust 1.86.0, Clippy's needless_continue lint complains about the last statement of a loop [1], including cases like:
while ... {
match ... {
... if ... => {
...
return ...;
}
_ => continue,
}
}as well as nested matches in a loop.
One solution is changing continue for () [2], but arguably using continue shows the intent better when it is alone in an arm like that.
Moreover, I am not sure we want to force people to try to find other ways to write the code either, in cases when that applies.
In addition, the help text does not really apply in the new cases the lint has introduced, e.g. here one cannot simply "drop" the expression:
warning: this continue expression is redundant
--> rust/macros/helpers.rs:85:18
|
85 | _ => continue,
| ^^^^^^^^
|
= help: consider dropping the continue expression
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#needless_continue
= note: requested on the command line with -W clippy::needless-continue
The examples in the documentation do not show a case like this, either, so the second "help" line does not help.
In addition, locally disabling the lint is not possible with expect, since the behavior differs across versions. Using allow would be possible, but, even then, an extra line just for this is a bit too much, especially if there are other ways to satisfy the lint.
Finally, the lint is still in the "pedantic" category and disabled by default by Clippy.
Thus disable the lint, at least for the time being.
Feedback was submitted to upstream Clippy, in case this can be improved or perhaps the lint split into several [3].
--- Makefile | 1 - 1 file changed, 1 deletion(-)
Makefile +0 -1
@@ -480,7 +480,6 @@ export rust_common_flags := --edition=20 -Wclippy::ignored_unit_patterns \ -Wclippy::mut_mut \ -Wclippy::needless_bitwise_bool \ - -Wclippy::needless_continue \ -Aclippy::needless_lifetimes \ -Wclippy::no_mangle_with_rust_abi \ -Wclippy::undocumented_unsafe_blocks \
Greg Kroah-Hartman
maintainerPATCH 100/241 rust: kbuild: Dont export __pfx symbols
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sami Tolvanen <[email protected]>
commit c59026c0570a2a97ce2e7d5ae5e9c48fc841542b upstream.
With CONFIG_PREFIX_SYMBOLS, objtool adds __pfx prefix symbols to claim the compiler emitted call padding bytes. When CONFIG_X86_KERNEL_IBT is not selected, the symbols are added to individual object files and for Rust objects, they end up being exported, resulting in warnings with CONFIG_GENDWARFKSYMS as the symbols have no debugging information:
warning: gendwarfksyms: symbol_print_versions: no information for symbol __pfx_rust_helper_put_task_struct
warning: gendwarfksyms: symbol_print_versions: no information for symbol __pfx_rust_helper_task_euid
warning: gendwarfksyms: symbol_print_versions: no information for symbol __pfx_rust_helper_readq_relaxed
...
Filter out the __pfx prefix from exported symbols similarly to the existing __cfi and __odr_asan prefixes.
--- rust/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
rust/Makefile +1 -1
@@ -334,7 +334,7 @@ $(obj)/bindings/bindings_helpers_generat $(obj)/bindings/bindings_helpers_generated.rs: $(src)/helpers/helpers.c FORCE $(call if_changed_dep,bindgen) -rust_exports = $(NM) -p --defined-only $(1) | awk '$$2~/(T|R|D|B)/ && $$3!~/__cfi/ && $$3!~/__odr_asan/ { printf $(2),$$3 }' +rust_exports = $(NM) -p --defined-only $(1) | awk '$$2~/(T|R|D|B)/ && $$3!~/__(pfx|cfi|odr_asan)/ { printf $(2),$$3 }' quiet_cmd_exports = EXPORTS $@ cmd_exports = \
Greg Kroah-Hartman
maintainerPATCH 101/241 rust: kbuild: use `pound` to support GNU Make < 4.3
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 1c4494c14b4124f3a13a7f4912b84b633ff4f9ba upstream.
GNU Make 4.3 changed the behavior of # inside commands in commit c6966b323811 ("[SV 20513] Un-escaped # are not comments in function invocations"):
* WARNING: Backward-incompatibility!
Number signs (#) appearing inside a macro reference or function invocation no longer introduce comments and should not be escaped with backslashes:
thus a call such as:
foo := $(shell echo '#')
is legal. Previously the number sign needed to be escaped, for example:
foo := $(shell echo '\#')
Now this latter will resolve to "\#". If you want to write makefiles portable to both versions, assign the number sign to a variable:
H := \#
foo := $(shell echo '$H')
This was claimed to be fixed in 3.81, but wasn't, for some reason. To detect this change search for 'nocomment' in the .FEATURES variable.
Unlike other commits in the kernel about this issue, such as commit 633174a7046e ("lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3"), that fixed the issue for newer GNU Makes, in our case it was the opposite, i.e. we need to fix it for the older ones: someone building with e.g. 4.2.1 gets the following error:
scripts/Makefile.compiler:81: *** unterminated call to function 'call': missing ')'. Stop.
Thus use the existing variable to fix it.
--- scripts/Makefile.compiler | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.compiler +1 -1
@@ -75,7 +75,7 @@ ld-option = $(call try-run, $(LD) $(KBUI # Usage: MY_RUSTFLAGS += $(call __rustc-option,$(RUSTC),$(MY_RUSTFLAGS),-Cinstrument-coverage,-Zinstrument-coverage) # TODO: remove RUSTC_BOOTSTRAP=1 when we raise the minimum GNU Make version to 4.4 __rustc-option = $(call try-run,\ - echo '#![allow(missing_docs)]#![feature(no_core)]#![no_core]' | RUSTC_BOOTSTRAP=1\ + echo '$(pound)![allow(missing_docs)]$(pound)![feature(no_core)]$(pound)![no_core]' | RUSTC_BOOTSTRAP=1\ $(1) --sysroot=/dev/null $(filter-out --sysroot=/dev/null --target=%,$(2)) $(3)\ --crate-type=rlib --out-dir=$(TMPOUT) --emit=obj=- - >/dev/null,$(3),$(4))
Greg Kroah-Hartman
maintainerPATCH 102/241 writeback: fix false warning in inode_to_wb()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
commit 9e888998ea4d22257b07ce911576509486fa0667 upstream.
inode_to_wb() is used also for filesystems that don't support cgroup writeback. For these filesystems inode->i_wb is stable during the lifetime of the inode (it points to bdi->wb) and there's no need to hold locks protecting the inode->i_wb dereference. Improve the warning in inode_to_wb() to not trigger for these filesystems.
--- include/linux/backing-dev.h | 1 + 1 file changed, 1 insertion(+)
include/linux/backing-dev.h +1 -0
@@ -249,6 +249,7 @@ static inline struct bdi_writeback *inod {#ifdef CONFIG_LOCKDEP WARN_ON_ONCE (debug_locks && + (inode->i_sb->s_iflags &SB_I_CGROUPWB ) && (!lockdep_is_held (&inode->i_lock) && !lockdep_is_held (&inode->i_mapping->i_pages.xa_lock) && !lockdep_is_held (&inode->i_wb->list_lock)));
Greg Kroah-Hartman
maintainerPATCH 103/241 Revert "PCI: Avoid reset when disabled via sysfs"
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit bc0b828ef6e561081ebc4c758d0c4d166bb9829c upstream.
This reverts commit 479380efe1625e251008d24b2810283db60d6fcd.
The reset_method attribute on a PCI device is only intended to manage the availability of function scoped resets for a device. It was never intended to restrict resets targeting the bus or slot.
In introducing a restriction that each device must support function level reset by testing pci_reset_supported(), we essentially create a catch-22, that a device must have a function scope reset in order to support bus/slot reset, when we use bus/slot reset to effect a reset of a device that does not support a function scoped reset, especially multi-function devices.
This breaks the majority of uses cases where vfio-pci uses bus/slot resets to manage multifunction devices that do not support function scoped resets.
--- drivers/pci/pci.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/pci/pci.c +0 -4
@@ -5419,8 +5419,6 @@ static bool pci_bus_resettable(struct pcreturn false;list_for_each_entry (dev, &bus->devices, bus_list) { -if (!pci_reset_supported (dev)) -return false;if (dev->dev_flags &PCI_DEV_FLAGS_NO_BUS_RESET || (dev->subordinate && !pci_bus_resettable (dev->subordinate)))return false;
@@ -5497,8 +5495,6 @@ static bool pci_slot_resettable(struct plist_for_each_entry (dev, &slot->bus->devices, bus_list) {if (!dev->slot || dev->slot != slot)continue ; -if (!pci_reset_supported (dev)) -return false;if (dev->dev_flags &PCI_DEV_FLAGS_NO_BUS_RESET || (dev->subordinate && !pci_bus_resettable (dev->subordinate)))return false;
Greg Kroah-Hartman
maintainerPATCH 104/241 ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
commit 9aa33d5b4a53a1945dd2aee45c09282248d3c98b upstream.
On SNDRV_PCM_TRIGGER_START event, audio data pointers are not reset.
This leads to wrong data buffer usage when multiple TRIGGER_START are received and ends to incorrect buffer usage between the user-space and the driver. Indeed, the driver can read data that are not already set by the user-space or the user-space and the driver are writing and reading the same area.
Fix that resetting data pointers on each SNDRV_PCM_TRIGGER_START events.
--- sound/soc/fsl/fsl_qmc_audio.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/fsl/fsl_qmc_audio.c +3 -0
@@ -250,6 +250,9 @@ static int qmc_audio_pcm_trigger(structswitch (cmd) {case SNDRV_PCM_TRIGGER_START :bitmap_zero (prtd->chans_pending,64 ); + prtd->buffer_ended =0 ; + prtd->ch_dma_addr_current = prtd->ch_dma_addr_start; +if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) {for (i =0 ; i < prtd->channels; i++) prtd->qmc_dai->chans[i].prtd_tx = prtd;
Greg Kroah-Hartman
maintainerPATCH 105/241 ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit d7bff1415e85b889dc8908be6aedba8807ae5e37 upstream.
Currently the VI feedback rate is set to fixed 8K, fix this by getting the correct rate from params_rate.
Without this patch incorrect rate will be set on the VI feedback recording resulting in rate miss match and audio artifacts.
--- sound/soc/codecs/lpass-wsa-macro.c | 39 ++++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-)
sound/soc/codecs/lpass-wsa-macro.c +36 -3
@@ -63,6 +63,10 @@#define CDC_WSA_TX_SPKR_PROT_CLK_DISABLE 0#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK GENMASK(3, 0)#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K 0 +#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_16K 1 +#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_24K 2 +#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_32K 3 +#define CDC_WSA_TX_SPKR_PROT_PCM_RATE_48K 4#define CDC_WSA_TX0_SPKR_PROT_PATH_CFG0 (0x0248)#define CDC_WSA_TX1_SPKR_PROT_PATH_CTL (0x0264)#define CDC_WSA_TX1_SPKR_PROT_PATH_CFG0 (0x0268)
@@ -407,6 +411,7 @@ struct wsa_macro {int ear_spkr_gain;int spkr_gain_offset;int spkr_mode; +u32 pcm_rate_vi;int is_softclip_on[WSA_MACRO_SOFTCLIP_MAX ];int softclip_clk_users[WSA_MACRO_SOFTCLIP_MAX ];struct regmap *regmap;
@@ -1280,6 +1285,7 @@ static int wsa_macro_hw_params(struct sn struct snd_soc_dai *dai) {struct snd_soc_component *component = dai->component; +struct wsa_macro *wsa =snd_soc_component_get_drvdata (component);int ret;switch (substream->stream) {
@@ -1292,6 +1298,11 @@ static int wsa_macro_hw_params(struct snreturn ret; }break ; +case SNDRV_PCM_STREAM_CAPTURE : +if (dai->id ==WSA_MACRO_AIF_VI ) + wsa->pcm_rate_vi =params_rate (params); + +break ;default :break ; }
@@ -1465,6 +1476,28 @@ static int wsa_macro_enable_vi_feedback(struct snd_soc_component *component =snd_soc_dapm_to_component (w->dapm);struct wsa_macro *wsa =snd_soc_component_get_drvdata (component);u32 tx_reg0, tx_reg1; +u32 rate_val; + +switch (wsa->pcm_rate_vi) { +case 8000 : + rate_val =CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K ; +break ; +case 16000 : + rate_val =CDC_WSA_TX_SPKR_PROT_PCM_RATE_16K ; +break ; +case 24000 : + rate_val =CDC_WSA_TX_SPKR_PROT_PCM_RATE_24K ; +break ; +case 32000 : + rate_val =CDC_WSA_TX_SPKR_PROT_PCM_RATE_32K ; +break ; +case 48000 : + rate_val =CDC_WSA_TX_SPKR_PROT_PCM_RATE_48K ; +break ; +default : + rate_val =CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K ; +break ; + }if (test_bit (WSA_MACRO_TX0 , &wsa->active_ch_mask[WSA_MACRO_AIF_VI ])) { tx_reg0 =CDC_WSA_TX0_SPKR_PROT_PATH_CTL ;
@@ -1476,7 +1509,7 @@ static int wsa_macro_enable_vi_feedback(switch (event) {case SND_SOC_DAPM_POST_PMU : -/* Enable V&I sensing */ +/* Enable V&I sensing */ snd_soc_component_update_bits (component, tx_reg0,CDC_WSA_TX_SPKR_PROT_RESET_MASK ,CDC_WSA_TX_SPKR_PROT_RESET );
@@ -1485,10 +1518,10 @@ static int wsa_macro_enable_vi_feedback( CDC_WSA_TX_SPKR_PROT_RESET);snd_soc_component_update_bits (component, tx_reg0,CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK , -CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K ); + rate_val);snd_soc_component_update_bits (component, tx_reg1,CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK , -CDC_WSA_TX_SPKR_PROT_PCM_RATE_8K ); + rate_val);snd_soc_component_update_bits (component, tx_reg0,CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK ,CDC_WSA_TX_SPKR_PROT_CLK_ENABLE );
Greg Kroah-Hartman
maintainerPATCH 106/241 ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit 7648beb65600220996ebb2da207610b1ff9b735e upstream.
Existing code only configures one of WSA_MACRO_TX0 or WSA_MACRO_TX1 paths eventhough we enable both of them. Fix this bug by adding proper checks and rearranging some of the common code to able to allow setting both TX0 and TX1 paths
Without this patch only one channel gets enabled in VI path instead of 2 channels. End result would be 1 channel recording instead of 2.
--- sound/soc/codecs/lpass-wsa-macro.c | 108 +++++++++++++++++++++---------------- 1 file changed, 63 insertions(+), 45 deletions(-)
sound/soc/codecs/lpass-wsa-macro.c +63 -45
@@ -1459,6 +1459,67 @@ static void wsa_macro_mclk_enable(struct } } +static void wsa_macro_enable_disable_vi_sense (struct snd_soc_component *component,bool enable, +u32 tx_reg0,u32 tx_reg1,u32 val) +{ +if (enable) { +/* Enable V&I sensing */ +snd_soc_component_update_bits (component, tx_reg0, +CDC_WSA_TX_SPKR_PROT_RESET_MASK , +CDC_WSA_TX_SPKR_PROT_RESET ); +snd_soc_component_update_bits (component, tx_reg1, +CDC_WSA_TX_SPKR_PROT_RESET_MASK , +CDC_WSA_TX_SPKR_PROT_RESET ); +snd_soc_component_update_bits (component, tx_reg0, +CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK , + val); +snd_soc_component_update_bits (component, tx_reg1, +CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK , + val); +snd_soc_component_update_bits (component, tx_reg0, +CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK , +CDC_WSA_TX_SPKR_PROT_CLK_ENABLE ); +snd_soc_component_update_bits (component, tx_reg1, +CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK , +CDC_WSA_TX_SPKR_PROT_CLK_ENABLE ); +snd_soc_component_update_bits (component, tx_reg0, +CDC_WSA_TX_SPKR_PROT_RESET_MASK , +CDC_WSA_TX_SPKR_PROT_NO_RESET ); +snd_soc_component_update_bits (component, tx_reg1, +CDC_WSA_TX_SPKR_PROT_RESET_MASK , +CDC_WSA_TX_SPKR_PROT_NO_RESET ); + }else { +snd_soc_component_update_bits (component, tx_reg0, +CDC_WSA_TX_SPKR_PROT_RESET_MASK , +CDC_WSA_TX_SPKR_PROT_RESET ); +snd_soc_component_update_bits (component, tx_reg1, +CDC_WSA_TX_SPKR_PROT_RESET_MASK , +CDC_WSA_TX_SPKR_PROT_RESET ); +snd_soc_component_update_bits (component, tx_reg0, +CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK , +CDC_WSA_TX_SPKR_PROT_CLK_DISABLE ); +snd_soc_component_update_bits (component, tx_reg1, +CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK , +CDC_WSA_TX_SPKR_PROT_CLK_DISABLE ); + } +} + +static void wsa_macro_enable_disable_vi_feedback (struct snd_soc_component *component, +bool enable,u32 rate) +{ +struct wsa_macro *wsa =snd_soc_component_get_drvdata (component); + +if (test_bit (WSA_MACRO_TX0 , &wsa->active_ch_mask[WSA_MACRO_AIF_VI ])) +wsa_macro_enable_disable_vi_sense (component, enable, +CDC_WSA_TX0_SPKR_PROT_PATH_CTL , +CDC_WSA_TX1_SPKR_PROT_PATH_CTL , rate); + +if (test_bit (WSA_MACRO_TX1 , &wsa->active_ch_mask[WSA_MACRO_AIF_VI ])) +wsa_macro_enable_disable_vi_sense (component, enable, +CDC_WSA_TX2_SPKR_PROT_PATH_CTL , +CDC_WSA_TX3_SPKR_PROT_PATH_CTL , rate); +} +static int wsa_macro_mclk_event (struct snd_soc_dapm_widget *w,struct snd_kcontrol *kcontrol,int event) {
@@ -1475,7 +1536,6 @@ static int wsa_macro_enable_vi_feedback( {struct snd_soc_component *component =snd_soc_dapm_to_component (w->dapm);struct wsa_macro *wsa =snd_soc_component_get_drvdata (component); -u32 tx_reg0, tx_reg1;u32 rate_val;switch (wsa->pcm_rate_vi) {
@@ -1499,56 +1559,14 @@ static int wsa_macro_enable_vi_feedback(break ; } -if (test_bit (WSA_MACRO_TX0 , &wsa->active_ch_mask[WSA_MACRO_AIF_VI ])) { - tx_reg0 =CDC_WSA_TX0_SPKR_PROT_PATH_CTL ; - tx_reg1 =CDC_WSA_TX1_SPKR_PROT_PATH_CTL ; - }else if (test_bit (WSA_MACRO_TX1 , &wsa->active_ch_mask[WSA_MACRO_AIF_VI ])) { - tx_reg0 =CDC_WSA_TX2_SPKR_PROT_PATH_CTL ; - tx_reg1 =CDC_WSA_TX3_SPKR_PROT_PATH_CTL ; - } -switch (event) {case SND_SOC_DAPM_POST_PMU :/* Enable V&I sensing */ -snd_soc_component_update_bits (component, tx_reg0, -CDC_WSA_TX_SPKR_PROT_RESET_MASK , -CDC_WSA_TX_SPKR_PROT_RESET ); -snd_soc_component_update_bits (component, tx_reg1, -CDC_WSA_TX_SPKR_PROT_RESET_MASK , -CDC_WSA_TX_SPKR_PROT_RESET ); -snd_soc_component_update_bits (component, tx_reg0, -CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK , - rate_val); -snd_soc_component_update_bits (component, tx_reg1, -CDC_WSA_TX_SPKR_PROT_PCM_RATE_MASK , - rate_val); -snd_soc_component_update_bits (component, tx_reg0, -CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK , -CDC_WSA_TX_SPKR_PROT_CLK_ENABLE ); -snd_soc_component_update_bits (component, tx_reg1, -CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK , -CDC_WSA_TX_SPKR_PROT_CLK_ENABLE ); -snd_soc_component_update_bits (component, tx_reg0, -CDC_WSA_TX_SPKR_PROT_RESET_MASK , -CDC_WSA_TX_SPKR_PROT_NO_RESET ); -snd_soc_component_update_bits (component, tx_reg1, -CDC_WSA_TX_SPKR_PROT_RESET_MASK , -CDC_WSA_TX_SPKR_PROT_NO_RESET ); +wsa_macro_enable_disable_vi_feedback (component, true, rate_val);break ;case SND_SOC_DAPM_POST_PMD :/* Disable V&I sensing */ -snd_soc_component_update_bits (component, tx_reg0, -CDC_WSA_TX_SPKR_PROT_RESET_MASK , -CDC_WSA_TX_SPKR_PROT_RESET ); -snd_soc_component_update_bits (component, tx_reg1, -CDC_WSA_TX_SPKR_PROT_RESET_MASK , -CDC_WSA_TX_SPKR_PROT_RESET ); -snd_soc_component_update_bits (component, tx_reg0, -CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK , -CDC_WSA_TX_SPKR_PROT_CLK_DISABLE ); -snd_soc_component_update_bits (component, tx_reg1, -CDC_WSA_TX_SPKR_PROT_CLK_EN_MASK , -CDC_WSA_TX_SPKR_PROT_CLK_DISABLE ); +wsa_macro_enable_disable_vi_feedback (component, false, rate_val);break ; }
Greg Kroah-Hartman
maintainerPATCH 107/241 ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit dfcf3dde45df383f2695c3d3475fec153d2c7dbe upstream.
Asus laptops with sound PCI subsystem ID 1043:1f43 have the DMICs connected to the host instead of the CS42L43 so need the SOC_SDW_CODEC_MIC quirk.
--- sound/soc/intel/boards/sof_sdw.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/boards/sof_sdw.c +1 -0
@@ -764,6 +764,7 @@ static const struct dmi_system_id sof_sdstatic const struct snd_pci_quirk sof_sdw_ssid_quirk_table[] = {SND_PCI_QUIRK (0x1043 ,0x1e13 ,"ASUS Zenbook S14" ,SOC_SDW_CODEC_MIC ), +SND_PCI_QUIRK (0x1043 ,0x1f43 ,"ASUS Zenbook S16" ,SOC_SDW_CODEC_MIC ), {} };
Greg Kroah-Hartman
maintainerPATCH 108/241 ASoC: qcom: Fix sc7280 lpass potential buffer overflow
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evgeny Pimenov <[email protected]>
commit a31a4934b31faea76e735bab17e63d02fcd8e029 upstream.
Case values introduced in commit5f78e1fb7a3e ("ASoC: qcom: Add driver support for audioreach solution") cause out of bounds access in arrays of sc7280 driver data (e.g. in case of RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params()).
Redefine LPASS_MAX_PORTS to consider the maximum possible port id for q6dsp as sc7280 driver utilizes some of those values.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/soc/qcom/lpass.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/qcom/lpass.h +2 -1
@@ -13,10 +13,11 @@#include <linux/platform_device.h> #include <linux/regmap.h> #include <dt-bindings/sound/qcom,lpass.h> +#include <dt-bindings/sound/qcom,q6afe.h> #include "lpass-hdmi.h" #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000 -#define LPASS_MAX_PORTS (LPASS_CDC_DMA_VA_TX8 + 1) +#define LPASS_MAX_PORTS (DISPLAY_PORT_RX_7 + 1)#define LPASS_MAX_MI2S_PORTS (8)#define LPASS_MAX_DMA_CHANNELS (8)#define LPASS_MAX_HDMI_DMA_CHANNELS (4)
Greg Kroah-Hartman
maintainerPATCH 109/241 accel/ivpu: Fix the NPUs DPU frequency calculation
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Kacprowski <[email protected]>
commit 6c2b75404d33caa46a582f2791a70f92232adb71 upstream.
Fix the frequency returned to the user space by the DRM_IVPU_PARAM_CORE_CLOCK_RATE GET_PARAM IOCTL. The kernel driver returned CPU frequency for MTL and bare PLL frequency for LNL - this was inconsistent and incorrect for both platforms. With this fix the driver returns maximum frequency of the NPU data processing unit (DPU) for all HW generations. This is what user space always expected.
Also do not set CPU frequency in boot params - the firmware does not use frequency passed from the driver, it was only used by the early pre-production firmware.
With that we can remove CPU frequency calculation code.
Show NPU frequency in FREQ_CHANGE interrupt when frequency tracking is enabled.
--- drivers/accel/ivpu/ivpu_drv.c | 4 - drivers/accel/ivpu/ivpu_fw.c | 3 drivers/accel/ivpu/ivpu_hw.h | 11 --- drivers/accel/ivpu/ivpu_hw_btrs.c | 126 ++++++++++++++++---------------------- drivers/accel/ivpu/ivpu_hw_btrs.h | 6 - include/uapi/drm/ivpu_accel.h | 4 - 6 files changed, 66 insertions(+), 88 deletions(-)
drivers/accel/ivpu/ivpu_drv.c +2 -2
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only /* -* Copyright (C) 2020-2024 Intel Corporation +* Copyright (C) 2020-2025 Intel Corporation */ #include <linux/firmware.h>
@@ -167,7 +167,7 @@ static int ivpu_get_param_ioctl(struct d args->value = vdev->platform;break ;case DRM_IVPU_PARAM_CORE_CLOCK_RATE : - args->value =ivpu_hw_ratio_to_freq (vdev, vdev->hw->pll.max_ratio); + args->value =ivpu_hw_dpu_max_freq_get (vdev);break ;case DRM_IVPU_PARAM_NUM_CONTEXTS : args->value =ivpu_get_context_count (vdev);
drivers/accel/ivpu/ivpu_fw.c +1 -2
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only /* -* Copyright (C) 2020-2024 Intel Corporation +* Copyright (C) 2020-2025 Intel Corporation */ #include <linux/firmware.h>
@@ -561,7 +561,6 @@ void ivpu_fw_boot_params_setup(struct iv boot_params->magic =VPU_BOOT_PARAMS_MAGIC ; boot_params->vpu_id =to_pci_dev (vdev->drm.dev)->bus->number; - boot_params->frequency =ivpu_hw_pll_freq_get (vdev);/* * This param is a debug firmware feature. It switches default clock
drivers/accel/ivpu/ivpu_hw.h +3 -8
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0-only */ /* -* Copyright (C) 2020-2024 Intel Corporation +* Copyright (C) 2020-2025 Intel Corporation */ #ifndef __IVPU_HW_H__
@@ -86,9 +86,9 @@ static inline u64 ivpu_hw_range_size(conreturn range->end - range->start; } -static inline u32 ivpu_hw_ratio_to_freq (struct ivpu_device *vdev,u32 ratio) +static inline u32 ivpu_hw_dpu_max_freq_get (struct ivpu_device *vdev) { -return ivpu_hw_btrs_ratio_to_freq (vdev, ratio); +return ivpu_hw_btrs_dpu_max_freq_get (vdev); }static inline void ivpu_hw_irq_clear (struct ivpu_device *vdev)
@@ -96,11 +96,6 @@ static inline void ivpu_hw_irq_clear(strivpu_hw_ip_irq_clear (vdev); } -static inline u32 ivpu_hw_pll_freq_get (struct ivpu_device *vdev) -{ -return ivpu_hw_btrs_pll_freq_get (vdev); -} -static inline u32 ivpu_hw_profiling_freq_get (struct ivpu_device *vdev) {return vdev->hw->pll.profiling_freq;
drivers/accel/ivpu/ivpu_hw_btrs.c +56 -70
185 lines not on this page · raw message
drivers/accel/ivpu/ivpu_hw_btrs.h +2 -4
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0-only */ /* -* Copyright (C) 2020-2024 Intel Corporation +* Copyright (C) 2020-2025 Intel Corporation */ #ifndef __IVPU_HW_BTRS_H__
@@ -13,7 +13,6 @@#define PLL_PROFILING_FREQ_DEFAULT 38400000#define PLL_PROFILING_FREQ_HIGH 400000000 -#define PLL_RATIO_TO_FREQ (x) ((x) * PLL_REF_CLK_FREQ)#define DCT_DEFAULT_ACTIVE_PERCENT 15u#define DCT_PERIOD_US 35300u
@@ -32,12 +31,11 @@ int ivpu_hw_btrs_ip_reset(struct ivpu_devoid ivpu_hw_btrs_profiling_freq_reg_set_lnl (struct ivpu_device *vdev);void ivpu_hw_btrs_ats_print_lnl (struct ivpu_device *vdev);void ivpu_hw_btrs_clock_relinquish_disable_lnl (struct ivpu_device *vdev); +u32 ivpu_hw_btrs_dpu_max_freq_get (struct ivpu_device *vdev);bool ivpu_hw_btrs_irq_handler_mtl (struct ivpu_device *vdev,int irq);bool ivpu_hw_btrs_irq_handler_lnl (struct ivpu_device *vdev,int irq);int ivpu_hw_btrs_dct_get_request (struct ivpu_device *vdev,bool *enable);void ivpu_hw_btrs_dct_set_status (struct ivpu_device *vdev,bool enable,u32 dct_percent); -u32 ivpu_hw_btrs_pll_freq_get (struct ivpu_device *vdev); -u32 ivpu_hw_btrs_ratio_to_freq (struct ivpu_device *vdev,u32 ratio);u32 ivpu_hw_btrs_telemetry_offset_get (struct ivpu_device *vdev);u32 ivpu_hw_btrs_telemetry_size_get (struct ivpu_device *vdev);u32 ivpu_hw_btrs_telemetry_enable_get (struct ivpu_device *vdev);
include/uapi/drm/ivpu_accel.h +2 -2
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */ /* -* Copyright (C) 2020-2024 Intel Corporation +* Copyright (C) 2020-2025 Intel Corporation */ #ifndef __UAPI_IVPU_DRM_H__
@@ -128,7 +128,7 @@ struct drm_ivpu_param {* platform type when executing on a simulator or emulator (read-only) * * %DRM_IVPU_PARAM_CORE_CLOCK_RATE: -* Current PLL frequency (read-only) +* Maximum frequency of the NPU data processing unit clock (read-only) * * %DRM_IVPU_PARAM_NUM_CONTEXTS: * Maximum number of simultaneously existing contexts (read-only)
Greg Kroah-Hartman
maintainerPATCH 110/241 alloc_tag: handle incomplete bulk allocations in vm_module_tags_populate
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: T.J. Mercier <[email protected]>
commit e6e07b696da529e85d1ba880555b5df5c80a46bd upstream.
alloc_pages_bulk_node() may partially succeed and allocate fewer than the requested nr_pages. There are several conditions under which this can occur, but we have encountered the case where CONFIG_PAGE_OWNER is enabled causing all bulk allocations to always fallback to single page allocations due to commit 187ad460b841 ("mm/page_alloc: avoid page allocator recursion with pagesets.lock held").
Currently vm_module_tags_populate() immediately fails when alloc_pages_bulk_node() returns fewer than the requested number of pages. When this happens memory allocation profiling gets disabled, for example
[ 14.297583] [9: modprobe: 465] Failed to allocate memory for allocation tags in the module scsc_wlan. Memory allocation profiling is disabled! [ 14.299339] [9: modprobe: 465] modprobe: Failed to insmod '/vendor/lib/modules/scsc_wlan.ko' with args '': Out of memory
This patch causes vm_module_tags_populate() to retry bulk allocations for the remaining memory instead of failing immediately which will avoid the disablement of memory allocation profiling.
--- lib/alloc_tag.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
lib/alloc_tag.c +12 -3
@@ -422,11 +422,20 @@ static int vm_module_tags_populate(void)unsigned long old_shadow_end =ALIGN (phys_end,MODULE_ALIGN );unsigned long new_shadow_end =ALIGN (new_end,MODULE_ALIGN );unsigned long more_pages; -unsigned long nr; +unsigned long nr =0 ; more_pages =ALIGN (new_end - phys_end,PAGE_SIZE ) >>PAGE_SHIFT ; - nr =alloc_pages_bulk_node (GFP_KERNEL | __GFP_NOWARN, -NUMA_NO_NODE , more_pages, next_page); +while (nr < more_pages) { +unsigned long allocated; + + allocated =alloc_pages_bulk_node (GFP_KERNEL | __GFP_NOWARN, +NUMA_NO_NODE , more_pages - nr, next_page + nr); + +if (!allocated) +break ; + nr += allocated; + } +if (nr < more_pages ||vmap_pages_range (phys_end, phys_end + (nr <<PAGE_SHIFT ),PAGE_KERNEL , next_page,PAGE_SHIFT ) <0 ) {
Greg Kroah-Hartman
maintainerPATCH 111/241 asus-laptop: Fix an uninitialized variable
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <[email protected]>
commit 6c683c6887e4addcd6bd1ddce08cafccb0a21e32 upstream.
The value returned by acpi_evaluate_integer() is not checked, but the result is not always successful, so it is necessary to add a check of the returned value.
If the result remains negative during three iterations of the loop, then the uninitialized variable 'val' will be used in the clamp_val() macro, so it must be initialized with the current value of the 'curr' variable.
In this case, the algorithm should be less noisy.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/platform/x86/asus-laptop.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/platform/x86/asus-laptop.c +6 -3
@@ -426,11 +426,14 @@ static int asus_pega_lucid_set(struct asstatic int pega_acc_axis (struct asus_laptop *asus,int curr,char *method) { +unsigned long long val = (unsigned long long )curr; +acpi_status status;int i, delta; -unsigned long long val; -for (i =0 ; i <PEGA_ACC_RETRIES ; i++) { -acpi_evaluate_integer (asus->handle, method,NULL , &val); +for (i =0 ; i <PEGA_ACC_RETRIES ; i++) { + status =acpi_evaluate_integer (asus->handle, method,NULL , &val); +if (ACPI_FAILURE (status)) +continue ;/* The output is noisy. From reading the ASL * dissassembly, timeout errors are returned with 1's * in the high word, and the lack of locking around
Greg Kroah-Hartman
maintainerPATCH 112/241 block: integrity: Do not call set_page_dirty_lock()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin K. Petersen <[email protected]>
commit 39e160505198ff8c158f11bce2ba19809a756e8b upstream.
Placing multiple protection information buffers inside the same page can lead to oopses because set_page_dirty_lock() can't be called from interrupt context.
Since a protection information buffer is not backed by a file there is no point in setting its page dirty, there is nothing to synchronize. Drop the call to set_page_dirty_lock() and remove the last argument to bio_integrity_unpin_bvec().
--- block/bio-integrity.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
block/bio-integrity.c +6 -11
@@ -104,16 +104,12 @@ err: }EXPORT_SYMBOL (bio_integrity_alloc); -static void bio_integrity_unpin_bvec (struct bio_vec *bv,int nr_vecs, -bool dirty) +static void bio_integrity_unpin_bvec (struct bio_vec *bv,int nr_vecs) {int i; -for (i =0 ; i < nr_vecs; i++) { -if (dirty && !PageCompound (bv[i].bv_page)) -set_page_dirty_lock (bv[i].bv_page); +for (i =0 ; i < nr_vecs; i++)unpin_user_page (bv[i].bv_page); - } }static void bio_integrity_uncopy_user (struct bio_integrity_payload *bip)
@@ -129,7 +125,7 @@ static void bio_integrity_uncopy_user(st ret =copy_to_iter (bvec_virt (bounce_bvec), bytes, &orig_iter);WARN_ON_ONCE (ret != bytes); -bio_integrity_unpin_bvec (orig_bvecs, orig_nr_vecs, true); +bio_integrity_unpin_bvec (orig_bvecs, orig_nr_vecs); }/**
@@ -149,8 +145,7 @@ void bio_integrity_unmap_user(struct bioreturn ; } -bio_integrity_unpin_bvec (bip->bip_vec, bip->bip_max_vcnt, -bio_data_dir (bio) ==READ ); +bio_integrity_unpin_bvec (bip->bip_vec, bip->bip_max_vcnt); }/**
@@ -236,7 +231,7 @@ static int bio_integrity_copy_user(struc }if (write) -bio_integrity_unpin_bvec (bvec, nr_vecs, false); +bio_integrity_unpin_bvec (bvec, nr_vecs);else memcpy (&bip->bip_vec[1 ], bvec, nr_vecs *sizeof (*bvec));
@@ -357,7 +352,7 @@ int bio_integrity_map_user(struct bio *breturn 0 ; release_pages: -bio_integrity_unpin_bvec (bvec, nr_bvecs, false); +bio_integrity_unpin_bvec (bvec, nr_bvecs); free_bvec:if (bvec != stack_vec)kfree (bvec);
Greg Kroah-Hartman
maintainerPATCH 113/241 drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit dcdae6e92d4e062da29235fe88980604595e3f0f ]
This commit is a resubmission of commit 1fe1c66274fb ("drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later"), which was accidentally reverted by commit 91dae758bdb8 ("Merge tag 'drm-misc-next-2024-08-01' of https://gitlab.freedesktop.org/drm/misc/kernel
into drm-next"), likely due to an unfortunate conflict resolution.
Quoted 1 line
From the original commit message:
``` `args->cfg[4]` is configured in Indirect Dispatch using the number of batches. Currently, for all V3D tech versions, `args->cfg[4]` equals the number of batches subtracted by 1. But, for V3D 7.1.6 and later, we must not subtract 1 from the number of batches. Implement the fix by checking the V3D tech version and revision. Fixes several `dEQP-VK.synchronization*` CTS tests related to Indirect Dispatch. ```
--- drivers/gpu/drm/v3d/v3d_sched.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/gpu/drm/v3d/v3d_sched.c +13 -3
@@ -428,7 +428,8 @@ v3d_rewrite_csd_job_wg_counts_from_indirect(struct v3d_cpu_job *job)struct v3d_bo *bo =to_v3d_bo (job->base.bo[0 ]);struct v3d_bo *indirect =to_v3d_bo (indirect_csd->indirect);struct drm_v3d_submit_csd *args = &indirect_csd->job->args; -u32 *wg_counts; +struct v3d_dev *v3d = job->base.v3d; +u32 num_batches, *wg_counts;v3d_get_bo_vaddr (bo);v3d_get_bo_vaddr (indirect);
@@ -441,8 +442,17 @@ v3d_rewrite_csd_job_wg_counts_from_indirect(struct v3d_cpu_job *job) args->cfg[0 ] = wg_counts[0 ] <<V3D_CSD_CFG012_WG_COUNT_SHIFT ; args->cfg[1 ] = wg_counts[1 ] <<V3D_CSD_CFG012_WG_COUNT_SHIFT ; args->cfg[2 ] = wg_counts[2 ] <<V3D_CSD_CFG012_WG_COUNT_SHIFT ; - args->cfg[4 ] =DIV_ROUND_UP (indirect_csd->wg_size,16 ) * - (wg_counts[0 ] * wg_counts[1 ] * wg_counts[2 ]) -1 ; + + num_batches =DIV_ROUND_UP (indirect_csd->wg_size,16 ) * + (wg_counts[0 ] * wg_counts[1 ] * wg_counts[2 ]); + +/* V3D 7.1.6 and later don't subtract 1 from the number of batches */ +if (v3d->ver <71 || (v3d->ver ==71 && v3d->rev <6 )) + args->cfg[4 ] = num_batches -1 ; +else + args->cfg[4 ] = num_batches; + +WARN_ON (args->cfg[4 ] == ~0 );for (int i =0 ; i <3 ; i++) {/* 0xffffffff indicates that the uniform rewrite is not needed */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/241 drm/msm/dpu: Fix error pointers in dpu_plane_virtual_atomic_check
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit 5cb1b130e1cd04239cc9c26a98279f4660dce583 ]
The function dpu_plane_virtual_atomic_check was dereferencing pointers returned by drm_atomic_get_plane_state without checking for errors. This could lead to undefined behavior if the function returns an error pointer.
This commit adds checks using IS_ERR to ensure that plane_state is valid before dereferencing them.
Similar to commit da29abe71e16
("drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed").
Patchwork: https://patchwork.freedesktop.org/patch/643132/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +3 -0
@@ -1059,6 +1059,9 @@ static int dpu_plane_virtual_atomic_check(struct drm_plane *plane,struct drm_crtc_state *crtc_state;int ret; +if (IS_ERR (plane_state)) +return PTR_ERR (plane_state); +if (plane_state->crtc) crtc_state =drm_atomic_get_new_crtc_state (state, plane_state->crtc);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/241 drm/msm/dpu: drop rogue intr_tear_rd_ptr values
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit ddfa00afae800b3dea02fa36f3f4012a8379ae58 ]
The commit 5a9d50150c2c ("drm/msm/dpu: shift IRQ indices by 1") shifted IRQ indices by 1, making 'NO_IRQ' to be 0 rather than -1 (and allowing to skip the definition if the IRQ is not present).
Several platform files were sketched before that commit, but got applied afterwards. As such, they inherited historical (and currently incorrect) setting of .intr_tear_rd_ptr = -1 for 'NO_IRQ' value.
Drop that setting for all the affected platforms.
Patchwork: https://patchwork.freedesktop.org/patch/647486/
--- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h | 2 -- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h | 1 - drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h | 3 --- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h | 4 ---- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h | 3 --- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h | 2 -- 6 files changed, 15 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h +0 -2
@@ -132,7 +132,6 @@ static const struct dpu_intf_cfg msm8937_intf[] = { .prog_fetch_lines_worst_case = 14, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), - .intr_tear_rd_ptr = -1, }, { .name = "intf_2", .id = INTF_2, .base = 0x6b000, .len = 0x268,
@@ -141,7 +140,6 @@ static const struct dpu_intf_cfg msm8937_intf[] = { .prog_fetch_lines_worst_case = 14, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29), - .intr_tear_rd_ptr = -1, }, };
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h +0 -1
@@ -118,7 +118,6 @@ static const struct dpu_intf_cfg msm8917_intf[] = { .prog_fetch_lines_worst_case = 14, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), - .intr_tear_rd_ptr = -1, }, };
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h +0 -3
@@ -131,7 +131,6 @@ static const struct dpu_intf_cfg msm8953_intf[] = { .prog_fetch_lines_worst_case = 14, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25), - .intr_tear_rd_ptr = -1, }, { .name = "intf_1", .id = INTF_1, .base = 0x6a800, .len = 0x268,
@@ -140,7 +139,6 @@ static const struct dpu_intf_cfg msm8953_intf[] = { .prog_fetch_lines_worst_case = 14, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), - .intr_tear_rd_ptr = -1, }, { .name = "intf_2", .id = INTF_2, .base = 0x6b000, .len = 0x268,
@@ -149,7 +147,6 @@ static const struct dpu_intf_cfg msm8953_intf[] = { .prog_fetch_lines_worst_case = 14, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29), - .intr_tear_rd_ptr = -1, }, };
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h +0 -4
@@ -241,7 +241,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = { .prog_fetch_lines_worst_case = 25, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25), - .intr_tear_rd_ptr = -1, }, { .name = "intf_1", .id = INTF_1, .base = 0x6a800, .len = 0x268,
@@ -250,7 +249,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = { .prog_fetch_lines_worst_case = 25, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), - .intr_tear_rd_ptr = -1, }, { .name = "intf_2", .id = INTF_2, .base = 0x6b000, .len = 0x268,
@@ -259,7 +257,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = { .prog_fetch_lines_worst_case = 25, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29), - .intr_tear_rd_ptr = -1, }, { .name = "intf_3", .id = INTF_3, .base = 0x6b800, .len = 0x268,
@@ -267,7 +264,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = { .prog_fetch_lines_worst_case = 25, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31), - .intr_tear_rd_ptr = -1, }, };
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h +0 -3
@@ -202,7 +202,6 @@ static const struct dpu_intf_cfg sdm660_intf[] = { .prog_fetch_lines_worst_case = 21, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25), - .intr_tear_rd_ptr = -1, }, { .name = "intf_1", .id = INTF_1, .base = 0x6a800, .len = 0x280,
@@ -211,7 +210,6 @@ static const struct dpu_intf_cfg sdm660_intf[] = { .prog_fetch_lines_worst_case = 21, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), - .intr_tear_rd_ptr = -1, }, { .name = "intf_2", .id = INTF_2, .base = 0x6b000, .len = 0x280,
@@ -220,7 +218,6 @@ static const struct dpu_intf_cfg sdm660_intf[] = { .prog_fetch_lines_worst_case = 21, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29), - .intr_tear_rd_ptr = -1, }, };
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h +0 -2
@@ -147,7 +147,6 @@ static const struct dpu_intf_cfg sdm630_intf[] = { .prog_fetch_lines_worst_case = 21, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25), - .intr_tear_rd_ptr = -1, }, { .name = "intf_1", .id = INTF_1, .base = 0x6a800, .len = 0x280,
@@ -156,7 +155,6 @@ static const struct dpu_intf_cfg sdm630_intf[] = { .prog_fetch_lines_worst_case = 21, .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), - .intr_tear_rd_ptr = -1, }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/241 dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit d27326a9999286fa45ad063f760e63329254f130 ]
Call dma_fence_put(fence) before returning an error if dma_fence_to_sync_pt() fails. Use an unwind ladder at the end of the function to do the cleanup.
--- drivers/dma-buf/sw_sync.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/dma-buf/sw_sync.c +14 -5
@@ -438,15 +438,17 @@ static int sw_sync_ioctl_get_deadline(struct sync_timeline *obj, unsigned long areturn -EINVAL ; pt =dma_fence_to_sync_pt (fence); -if (!pt) -return -EINVAL ; +if (!pt) { + ret = -EINVAL ; + goto put_fence; + }spin_lock_irqsave (fence->lock, flags); -if (test_bit (SW_SYNC_HAS_DEADLINE_BIT , &fence->flags)) { - data.deadline_ns =ktime_to_ns (pt->deadline); - }else { +if (!test_bit (SW_SYNC_HAS_DEADLINE_BIT , &fence->flags)) { ret = -ENOENT ; + goto unlock; } + data.deadline_ns =ktime_to_ns (pt->deadline);spin_unlock_irqrestore (fence->lock, flags);dma_fence_put (fence);
@@ -458,6 +460,13 @@ static int sw_sync_ioctl_get_deadline(struct sync_timeline *obj, unsigned long areturn -EFAULT ;return 0 ; + +unlock: +spin_unlock_irqrestore (fence->lock, flags); +put_fence: +dma_fence_put (fence); + +return ret; } static long sw_sync_ioctl(struct file *file, unsigned int cmd,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/241 nfs: add missing selections of CONFIG_CRC32
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit cd35b6cb46649750b7dbd0df0e2d767415d8917b ]
nfs.ko, nfsd.ko, and lockd.ko all use crc32_le(), which is available only when CONFIG_CRC32 is enabled. But the only NFS kconfig option that selected CONFIG_CRC32 was CONFIG_NFS_DEBUG, which is client-specific and did not actually guard the use of crc32_le() even on the client.
The code worked around this bug by only actually calling crc32_le() when CONFIG_CRC32 is built-in, instead hard-coding '0' in other cases. This avoided randconfig build errors, and in real kernels the fallback code was unlikely to be reached since CONFIG_CRC32 is 'default y'. But, this really needs to just be done properly, especially now that I'm planning to update CONFIG_CRC32 to not be 'default y'.
Therefore, make CONFIG_NFS_FS, CONFIG_NFSD, and CONFIG_LOCKD select CONFIG_CRC32. Then remove the fallback code that becomes unnecessary, as well as the selection of CONFIG_CRC32 from CONFIG_NFS_DEBUG.
--- fs/Kconfig | 1 + fs/nfs/Kconfig | 2 +- fs/nfs/internal.h | 7 ------- fs/nfs/nfs4session.h | 4 ---- fs/nfsd/Kconfig | 1 + fs/nfsd/nfsfh.h | 7 ------- include/linux/nfs.h | 7 ------- 7 files changed, 3 insertions(+), 26 deletions(-)
fs/Kconfig +1 -0
@@ -368,6 +368,7 @@ config GRACE_PERIOD config LOCKD tristate depends on FILE_LOCKING + select CRC32 select GRACE_PERIOD config LOCKD_V4
fs/nfs/Kconfig +1 -1
@@ -2,6 +2,7 @@ config NFS_FS tristate "NFS client support" depends on INET && FILE_LOCKING && MULTIUSER + select CRC32 select LOCKD select SUNRPC select NFS_COMMON
@@ -196,7 +197,6 @@ config NFS_USE_KERNEL_DNS config NFS_DEBUG bool depends on NFS_FS && SUNRPC_DEBUG - select CRC32 default y config NFS_DISABLE_UDP_SUPPORT
fs/nfs/internal.h +0 -7
@@ -899,18 +899,11 @@ u64 nfs_timespec_to_change_attr(const struct timespec64 *ts)return ((u64 )ts->tv_sec <<30 ) + ts->tv_nsec; } -#ifdef CONFIG_CRC32 static inline u32 nfs_stateid_hash (const nfs4_stateid *stateid) {return ~crc32_le (0xFFFFFFFF , &stateid->other[0 ],NFS4_STATEID_OTHER_SIZE ); } -#else -static inline u32 nfs_stateid_hash (nfs4_stateid *stateid) -{ -return 0 ; -} -#endif static inline bool nfs_error_is_fatal (int err) {
fs/nfs/nfs4session.h +0 -4
@@ -148,16 +148,12 @@ static inline void nfs4_copy_sessionid(struct nfs4_sessionid *dst, memcpy(dst->data, src->data, NFS4_MAX_SESSIONID_LEN); } -#ifdef CONFIG_CRC32 /* * nfs_session_id_hash - calculate the crc32 hash for the session id * @session - pointer to session */ #define nfs_session_id_hash (sess_id) \ (~crc32_le(0xFFFFFFFF, &(sess_id)->data[0], sizeof((sess_id)->data))) -#else -#define nfs_session_id_hash (session) (0) -#endif #else /* defined(CONFIG_NFS_V4_1) */ static inline int nfs4_init_session (struct nfs_client *clp)
fs/nfsd/Kconfig +1 -0
@@ -4,6 +4,7 @@ config NFSD depends on INET depends on FILE_LOCKING depends on FSNOTIFY + select CRC32 select LOCKD select SUNRPC select EXPORTFS
fs/nfsd/nfsfh.h +0 -7
@@ -267,7 +267,6 @@ static inline bool fh_fsid_match(const struct knfsd_fh *fh1,return true; } -#ifdef CONFIG_CRC32 /** * knfsd_fh_hash - calculate the crc32 hash for the filehandle * @fh - pointer to filehandle
@@ -279,12 +278,6 @@ static inline u32 knfsd_fh_hash(const struct knfsd_fh *fh) {return ~crc32_le (0xFFFFFFFF , fh->fh_raw, fh->fh_size); } -#else -static inline u32 knfsd_fh_hash (const struct knfsd_fh *fh) -{ -return 0 ; -} -#endif /** * fh_clear_pre_post_attrs - Reset pre/post attributes
include/linux/nfs.h +0 -7
@@ -55,7 +55,6 @@ enum nfs3_stable_how { NFS_INVALID_STABLE_HOW = -1 }; -#ifdef CONFIG_CRC32 /** * nfs_fhandle_hash - calculate the crc32 hash for the filehandle * @fh - pointer to filehandle
@@ -67,10 +66,4 @@ static inline u32 nfs_fhandle_hash(const struct nfs_fh *fh) {return ~crc32_le (0xFFFFFFFF , &fh->data[0 ], fh->size); } -#else /* CONFIG_CRC32 */ -static inline u32 nfs_fhandle_hash (const struct nfs_fh *fh) -{ -return 0 ; -} -#endif /* CONFIG_CRC32 */ #endif /* _LINUX_NFS_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/241 nfsd: decrease sc_count directly if fail to queue dl_recall
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
[ Upstream commit a1d14d931bf700c1025db8c46d6731aa5cf440f9 ]
A deadlock warning occurred when invoking nfs4_put_stid following a failed dl_recall queue operation:
T1 T2
nfs4_laundromat
nfs4_get_client_reaplist
nfs4_anylock_blockers__break_lease
spin_lock // ctx->flc_lock
spin_lock // clp->cl_lock
nfs4_lockowner_has_blockers
locks_owner_has_blockers
spin_lock // flctx->flc_lock
nfsd_break_deleg_cb
nfsd_break_one_deleg
nfs4_put_stid
refcount_dec_and_lock
spin_lock // clp->cl_lockWhen a file is opened, an nfs4_delegation is allocated with sc_count initialized to 1, and the file_lease holds a reference to the delegation. The file_lease is then associated with the file through kernel_setlease.
The disassociation is performed in nfsd4_delegreturn via the following call chain:nfsd4_delegreturn --> destroy_delegation --> destroy_unhashed_deleg --> nfs4_unlock_deleg_lease --> kernel_setlease --> generic_delete_lease The corresponding sc_count reference will be released after this disassociation.
Since nfsd_break_one_deleg executes while holding the flc_lock, the disassociation process becomes blocked when attempting to acquire flc_lock in generic_delete_lease. This means:
1) sc_count in nfsd_break_one_deleg will not be decremented to 0;
2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to acquire cl_lock;
3) Consequently, no deadlock condition is created.
Given that sc_count in nfsd_break_one_deleg remains non-zero, we can safely perform refcount_dec on sc_count directly. This approach effectively avoids triggering deadlock warnings.
--- fs/nfsd/nfs4state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4state.c +1 -1
@@ -5432,7 +5432,7 @@ static void nfsd_break_one_deleg(struct nfs4_delegation *dp) queued =nfsd4_run_cb (&dp->dl_recall);WARN_ON_ONCE (!queued);if (!queued) -nfs4_put_stid (&dp->dl_stid); +refcount_dec (&dp->dl_stid.sc_count); }/* Called from break_lease() with flc_lock held. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/241 i2c: atr: Fix wrong include
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 75caec0c2aa3a7ec84348d438c74cb8a2eb4de97 ]
The fwnode.h is not supposed to be used by the drivers as it has the definitions for the core parts for different device property provider implementations. Drop it.
Note, that fwnode API for drivers is provided in property.h which is included here.
--- drivers/i2c/i2c-atr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/i2c-atr.c +1 -1
@@ -8,12 +8,12 @@* Originally based on i2c-mux.c */ -#include <linux/fwnode.h> #include <linux/i2c-atr.h> #include <linux/i2c.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/mutex.h> +#include <linux/property.h> #include <linux/slab.h> #include <linux/spinlock.h>
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/241 eventpoll: abstract out ep_try_send_events() helper
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 38d203560118a673018df5892a6555bb0aba7762 ]
In preparation for reusing this helper in another epoll setup helper, abstract it out.
Stable-dep-of: 0a65bc27bd64 ("eventpoll: Set epoll timeout if it's in the future")
--- fs/eventpoll.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
fs/eventpoll.c +18 -10
@@ -1980,6 +1980,22 @@ static int ep_autoremove_wake_function(struct wait_queue_entry *wq_entry,return ret; } +static int ep_try_send_events (struct eventpoll *ep, +struct epoll_event __user *events,int maxevents) +{ +int res; + +/* +* Try to transfer events to user space. In case we get 0 events and +* there's still timeout left over, we go trying again in search of +* more luck. +*/ + res =ep_send_events (ep, events, maxevents); +if (res >0 ) +ep_suspend_napi_irqs (ep); +return res; +} +/** * ep_poll - Retrieves ready events, and delivers them to the caller-supplied * event buffer.
@@ -2031,17 +2047,9 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,while (1 ) {if (eavail) { -/* -* Try to transfer events to user space. In case we get -* 0 events and there's still timeout left over, we go -* trying again in search of more luck. -*/ - res =ep_send_events (ep, events, maxevents); -if (res) { -if (res >0 ) -ep_suspend_napi_irqs (ep); + res =ep_try_send_events (ep, events, maxevents); +if (res)return res; - } }if (timed_out)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/241 eventpoll: Set epoll timeout if its in the future
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Damato <[email protected]>
[ Upstream commit 0a65bc27bd645894175c059397b4916e31955fb2 ]
Avoid an edge case where epoll_wait arms a timer and calls schedule() even if the timer will expire immediately.
For example: if the user has specified an epoll busy poll usecs which is equal or larger than the epoll_wait/epoll_pwait2 timeout, it is unnecessary to call schedule_hrtimeout_range; the busy poll usecs have consumed the entire timeout duration so it is unnecessary to induce scheduling latency by calling schedule() (via schedule_hrtimeout_range).
This can be measured using a simple bpftrace script:
tracepoint:sched:sched_switch
/ args->prev_pid == $1 /
{
print(kstack());
print(ustack());
}
Before this patch is applied:
Testing an epoll_wait app with busy poll usecs set to 1000, and epoll_wait timeout set to 1ms using the script above shows:
__traceiter_sched_switch+69
__schedule+1495
schedule+32
schedule_hrtimeout_range+159
do_epoll_wait+1424
__x64_sys_epoll_wait+97
do_syscall_64+95
entry_SYSCALL_64_after_hwframe+118
epoll_wait+82Which is unexpected; the busy poll usecs should have consumed the entire timeout and there should be no reason to arm a timer.
After this patch is applied: the same test scenario does not generate a call to schedule() in the above edge case. If the busy poll usecs are reduced (for example usecs: 100, epoll_wait timeout 1ms) the timer is armed as expected.
--- fs/eventpoll.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/eventpoll.c +9 -1
@@ -1996,6 +1996,14 @@ static int ep_try_send_events(struct eventpoll *ep,return res; } +static int ep_schedule_timeout (ktime_t *to) +{ +if (to) +return ktime_after (*to,ktime_get ()); +else +return 1 ; +} +/** * ep_poll - Retrieves ready events, and delivers them to the caller-supplied * event buffer.
@@ -2103,7 +2111,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,write_unlock_irq (&ep->lock); -if (!eavail) +if (!eavail &&ep_schedule_timeout (to)) timed_out = !schedule_hrtimeout_range (to, slack,HRTIMER_MODE_ABS );__set_current_state (TASK_RUNNING );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/241 fs: move the bdex_statx call to vfs_getattr_nosec
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 777d0961ff95b26d5887fdae69900374364976f3 ]
Currently bdex_statx is only called from the very high-level vfs_statx_path function, and thus bypassing it for in-kernel calls to vfs_getattr or vfs_getattr_nosec.
This breaks querying the block ѕize of the underlying device in the loop driver and also is a pitfall for any other new kernel caller.
Move the call into the lowest level helper to ensure all callers get the right results.
--- block/bdev.c | 3 +-- fs/stat.c | 32 ++++++++++++++++++-------------- include/linux/blkdev.h | 6 +++--- 3 files changed, 22 insertions(+), 19 deletions(-)
block/bdev.c +1 -2
@@ -1268,8 +1268,7 @@ void sync_bdevs(bool wait)/* * Handle STATX_{DIOALIGN, WRITE_ATOMIC} for block devices. */ -void bdev_statx (struct path *path,struct kstat *stat, -u32 request_mask) +void bdev_statx (const struct path *path,struct kstat *stat,u32 request_mask) {struct inode *backing_inode;struct block_device *bdev;
fs/stat.c +18 -14
@@ -204,12 +204,25 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat, STATX_ATTR_DAX); idmap =mnt_idmap (path->mnt); -if (inode->i_op->getattr) -return inode->i_op->getattr (idmap, path, stat, - request_mask, - query_flags); +if (inode->i_op->getattr) { +int ret; + + ret = inode->i_op->getattr (idmap, path, stat, request_mask, + query_flags); +if (ret) +return ret; + }else { +generic_fillattr (idmap, request_mask, inode, stat); + } + +/* +* If this is a block device inode, override the filesystem attributes +* with the block device specific parameters that need to be obtained +* from the bdev backing inode. +*/ +if (S_ISBLK (stat->mode)) +bdev_statx (path, stat, request_mask); -generic_fillattr (idmap, request_mask, inode, stat);return 0 ; }EXPORT_SYMBOL (vfs_getattr_nosec);
@@ -295,15 +308,6 @@ static int vfs_statx_path(struct path *path, int flags, struct kstat *stat,if (path_mounted (path)) stat->attributes |=STATX_ATTR_MOUNT_ROOT ; stat->attributes_mask |=STATX_ATTR_MOUNT_ROOT ; - -/* -* If this is a block device inode, override the filesystem -* attributes with the block device specific parameters that need to be -* obtained from the bdev backing inode. -*/ -if (S_ISBLK (stat->mode)) -bdev_statx (path, stat, request_mask); -return 0 ; }
include/linux/blkdev.h +3 -3
@@ -1664,7 +1664,7 @@ int sync_blockdev(struct block_device *bdev);int sync_blockdev_range (struct block_device *bdev,loff_t lstart,loff_t lend);int sync_blockdev_nowait (struct block_device *bdev);void sync_bdevs (bool wait); -void bdev_statx (struct path *,struct kstat *,u32 ); +void bdev_statx (const struct path *path,struct kstat *stat,u32 request_mask);void printk_all_partitions (void );int __init early_lookup_bdev (const char *pathname,dev_t *dev);#else
@@ -1682,8 +1682,8 @@ static inline int sync_blockdev_nowait(struct block_device *bdev)static inline void sync_bdevs (bool wait) { } -static inline void bdev_statx (struct path *path,struct kstat *stat, -u32 request_mask) +static inline void bdev_statx (const struct path *path,struct kstat *stat, +u32 request_mask) { }static inline void printk_all_partitions (void )
Signature · 1 line
2.39.5
Re: [PATCH 6.14 122/241] fs: move the bdex_statx call to vfs_getattr_nosec
Quoted 1 line · Greg Kroah-Hartman
6.14-stable review patch. If anyone has any objections, please let me know.
You might want to hold this patch (for 6.14 and 6.12) until "devtmpfs:
don't use vfs_getattr_nosec to query i_mode" lands, since (AFAICT) it's needed to fix a hang introduced by this patch.
(Unless that's already queued for stable, but afaict it isn't)
--D
Quoted 123 lines
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit
777d0961ff95b26d5887fdae69900374364976f3]Currently
bdex_statxis only called from the very high-levelvfs_statx_pathfunction, and thus bypassing it for in-kernel calls tovfs_getattrorvfs_getattr_nosec.This breaks querying the block ѕize of the underlying device in the loop driver and also is a pitfall for any other new kernel caller.
Move the call into the lowest level helper to ensure all callers get the right results.
Fixes 2d985f8c6b91 ("vfs: support STATX_DIOALIGN on block devices")Fixes f4774e92aab8 ("loop: take the file system minimum dio alignment into account")Reported-by "Darrick J. Wong" <[email protected]>Signed-off-by Christoph Hellwig <[email protected]>Signed-off-by Christian Brauner <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- block/bdev.c | 3 +-- fs/stat.c | 32 ++++++++++++++++++-------------- include/linux/blkdev.h | 6 +++--- 3 files changed, 22 insertions(+), 19 deletions(-)block/bdev.c +1
-2@@ -1268,8 +1268,7 @@ void sync_bdevs(bool wait)/* * Handle STATX_{DIOALIGN, WRITE_ATOMIC} for block devices. */ -void bdev_statx (struct path *path,struct kstat *stat, -u32 request_mask) +void bdev_statx (const struct path *path,struct kstat *stat,u32 request_mask) {struct inode *backing_inode;struct block_device *bdev;fs/stat.c +18
-14@@ -204,12 +204,25 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat, STATX_ATTR_DAX); idmap =mnt_idmap (path->mnt); -if (inode->i_op->getattr) -return inode->i_op->getattr (idmap, path, stat, - request_mask, - query_flags); +if (inode->i_op->getattr) { +int ret; + + ret = inode->i_op->getattr (idmap, path, stat, request_mask, + query_flags); +if (ret) +return ret; + }else { +generic_fillattr (idmap, request_mask, inode, stat); + } + +/* +* If this is a block device inode, override the filesystem attributes +* with the block device specific parameters that need to be obtained +* from the bdev backing inode. +*/ +if (S_ISBLK (stat->mode)) +bdev_statx (path, stat, request_mask); -generic_fillattr (idmap, request_mask, inode, stat);return 0 ; }EXPORT_SYMBOL (vfs_getattr_nosec);@@ -295,15 +308,6 @@ static int vfs_statx_path(struct path *path, int flags, struct kstat *stat,if (path_mounted (path)) stat->attributes |=STATX_ATTR_MOUNT_ROOT ; stat->attributes_mask |=STATX_ATTR_MOUNT_ROOT ; - -/* -* If this is a block device inode, override the filesystem -* attributes with the block device specific parameters that need to be -* obtained from the bdev backing inode. -*/ -if (S_ISBLK (stat->mode)) -bdev_statx (path, stat, request_mask); -return 0 ; }include/linux/blkdev.h +3
-3@@ -1664,7 +1664,7 @@ int sync_blockdev(struct block_device *bdev);int sync_blockdev_range (struct block_device *bdev,loff_t lstart,loff_t lend);int sync_blockdev_nowait (struct block_device *bdev);void sync_bdevs (bool wait); -void bdev_statx (struct path *,struct kstat *,u32 ); +void bdev_statx (const struct path *path,struct kstat *stat,u32 request_mask);void printk_all_partitions (void );int __init early_lookup_bdev (const char *pathname,dev_t *dev);#else @@ -1682,8 +1682,8 @@ static inline int sync_blockdev_nowait(struct block_device *bdev)static inline void sync_bdevs (bool wait) { } -static inline void bdev_statx (struct path *path,struct kstat *stat, -u32 request_mask) +static inline void bdev_statx (const struct path *path,struct kstat *stat, +u32 request_mask) { }static inline void printk_all_partitions (void )Signature · 1 line
2.39.5
Re: [PATCH 6.14 122/241] fs: move the bdex_statx call to vfs_getattr_nosec
Quoted 6 lines · Darrick J. Wong
Quoted 1 line · Greg Kroah-Hartman
6.14-stable review patch. If anyone has any objections, please let me know.
You might want to hold this patch (for 6.14 and 6.12) until "devtmpfs:
don't usevfs_getattr_nosecto queryi_mode" lands, since (AFAICT) it's needed to fix a hang introduced by this patch.
Thanks, I was just going to say that.
Greg Kroah-Hartman
maintainerRe: [PATCH 6.14 122/241] fs: move the bdex_statx call to vfs_getattr_nosec
Quoted 9 lines · Christoph Hellwig
Quoted 6 lines · Darrick J. Wong
Quoted 1 line · Greg Kroah-Hartman
6.14-stable review patch. If anyone has any objections, please let me know.
You might want to hold this patch (for 6.14 and 6.12) until "devtmpfs:
don't usevfs_getattr_nosecto queryi_mode" lands, since (AFAICT) it's needed to fix a hang introduced by this patch.Thanks, I was just going to say that.
Great, dropped from everywhere for now, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 123/241 ftrace: fix incorrect hash size in register_ftrace_direct()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit 92f1d3b40179b15630d72e2c6e4e25a899b67ba9 ]
The maximum of the ftrace hash bits is made fls(32) in register_ftrace_direct(), which seems illogical. So, we fix it by making the max hash bits FTRACE_HASH_MAX_BITS instead.
--- kernel/trace/ftrace.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/trace/ftrace.c +4 -3
@@ -5912,9 +5912,10 @@ int register_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)/* Make a copy hash to place the new and the old entries in */ size = hash->count + direct_functions->count; -if (size >32 ) - size =32 ; - new_hash =alloc_ftrace_hash (fls (size)); + size =fls (size); +if (size >FTRACE_HASH_MAX_BITS ) + size =FTRACE_HASH_MAX_BITS ; + new_hash =alloc_ftrace_hash (size);if (!new_hash) goto out_unlock;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/241 drm/msm/a6xx+: Dont let IB_SIZE overflow
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 9d78f02503227d3554d26cf8ca73276105c98f3e ]
IB_SIZE is only b0..b19. Starting with a6xx gen3, additional fields were added above the IB_SIZE. Accidentially setting them can cause badness. Fix this by properly defining the CP_INDIRECT_BUFFER packet and using the generated builder macro to ensure unintended bits are not set.
v2: add missing type attribute for IB_BASE
v3: fix offset attribute in xml
Patchwork: https://patchwork.freedesktop.org/patch/643396/
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 8 ++++---- drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml | 7 +++++++ 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +4 -4
@@ -242,10 +242,10 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)break ; fallthrough;case MSM_SUBMIT_CMD_BUF : -OUT_PKT7 (ring,CP_INDIRECT_BUFFER_PFE ,3 ); +OUT_PKT7 (ring,CP_INDIRECT_BUFFER ,3 );OUT_RING (ring,lower_32_bits (submit->cmd[i].iova));OUT_RING (ring,upper_32_bits (submit->cmd[i].iova)); -OUT_RING (ring, submit->cmd[i].size); +OUT_RING (ring,A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE (submit->cmd[i].size)); ibs++;break ; }
@@ -377,10 +377,10 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)break ; fallthrough;case MSM_SUBMIT_CMD_BUF : -OUT_PKT7 (ring,CP_INDIRECT_BUFFER_PFE ,3 ); +OUT_PKT7 (ring,CP_INDIRECT_BUFFER ,3 );OUT_RING (ring,lower_32_bits (submit->cmd[i].iova));OUT_RING (ring,upper_32_bits (submit->cmd[i].iova)); -OUT_RING (ring, submit->cmd[i].size); +OUT_RING (ring,A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE (submit->cmd[i].size)); ibs++;break ; }
drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml +7 -0
@@ -2259,5 +2259,12 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords) </reg32> </domain> +<domain name="CP_INDIRECT_BUFFER" width="32" varset="chip" prefix="chip" variants="A5XX-"> + <reg64 offset="0" name="IB_BASE" type="address"/> + <reg32 offset="2" name="2"> + <bitfield name="IB_SIZE" low="0" high="19"/> + </reg32> +</domain> + </database>
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/241 Bluetooth: l2cap: Process valid commands in too long frame
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frédéric Danis <[email protected]>
commit e2e49e214145a8f6ece6ecd52fec63ebc2b27ce9 upstream.
This is required for passing PTS test cases:
- L2CAP/COS/CED/BI-14-C
Multiple Signaling Command in one PDU, Data Truncated, BR/EDR, Connection Request
- L2CAP/COS/CED/BI-15-C
Multiple Signaling Command in one PDU, Data Truncated, BR/EDR, Disconnection Request
The test procedure defined in L2CAP.TS.p39 for both tests is:
1. The Lower Tester sends a C-frame to the IUT with PDU Length set to 8 and Channel ID set to the correct signaling channel for the logical link. The Information payload contains one L2CAP_ECHO_REQ packet with Data Length set to 0 with 0 octets of echo data and one command packet and Data Length set as specified in Table 4.6 and the correct command data.
2. The IUT sends an L2CAP_ECHO_RSP PDU to the Lower Tester.
3. Perform alternative 3A, 3B, 3C, or 3D depending on the IUT’s response.
Alternative 3A (IUT terminates the link):
3A.1 The IUT terminates the link.
3A.2 The test ends with a Pass verdict.
Alternative 3B (IUT discards the frame):
3B.1 The IUT does not send a reply to the Lower Tester.
Alternative 3C (IUT rejects PDU):
3C.1 The IUT sends an L2CAP_COMMAND_REJECT_RSP PDU to the
Lower Tester.
Alternative 3D (Any other IUT response):
3D.1 The Upper Tester issues a warning and the test ends.
4. The Lower Tester sends a C-frame to the IUT with PDU Length set to 4 and Channel ID set to the correct signaling channel for the logical link. The Information payload contains Data Length set to 0 with an L2CAP_ECHO_REQ packet with 0 octets of echo data.
5. The IUT sends an L2CAP_ECHO_RSP PDU to the Lower Tester.
With expected outcome:
In Steps 2 and 5, the IUT responds with an L2CAP_ECHO_RSP. In Step 3A.1, the IUT terminates the link.
In Step 3B.1, the IUT does not send a reply to the Lower Tester. In Step 3C.1, the IUT rejects the PDU.
In Step 3D.1, the IUT sends any valid response.
Currently PTS fails with the following logs:
Failed to receive ECHO RESPONSE.
And HCI logs:
Quoted 1 line
ACL Data RX: Handle 11 flags
0x02dlen 20
L2CAP: Information Response (0x0b) ident 2 len 12
Type: Fixed channels supported (0x0003)
Result: Success (0x0000)
Channels: 0x000000000000002e
L2CAP Signaling (BR/EDR)
Connectionless reception
AMP Manager Protocol
L2CAP Signaling (LE)Quoted 1 line
ACL Data RX: Handle 11 flags
0x02dlen 13
frame too long
08 01 00 00 08 02 01 00 aa .........
--- net/bluetooth/l2cap_core.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
net/bluetooth/l2cap_core.c +17 -1
@@ -7504,8 +7504,24 @@ void l2cap_recv_acldata(struct hci_connif (skb->len > len) {BT_ERR ("Frame is too long (len %u, expected len %d)" , skb->len, len); +/* PTS test cases L2CAP/COS/CED/BI-14-C and BI-15-C +* (Multiple Signaling Command in one PDU, Data +* Truncated, BR/EDR) send a C-frame to the IUT with +* PDU Length set to 8 and Channel ID set to the +* correct signaling channel for the logical link. +* The Information payload contains one L2CAP_ECHO_REQ +* packet with Data Length set to 0 with 0 octets of +* echo data and one invalid command packet due to +* data truncated in PDU but present in HCI packet. +* +* Shorter the socket buffer to the PDU length to +* allow to process valid commands from the PDU before +* setting the socket unreliable. +*/ + skb->len = len; +l2cap_recv_frame (conn, skb);l2cap_conn_unreliable (conn,ECOMM ); - goto drop; + goto unlock; }/* Append fragment into frame (with header) */
Greg Kroah-Hartman
maintainerPATCH 126/241 Bluetooth: vhci: Avoid needless snprintf() calls
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 875db86e1ec75fe633f1e85ed2f92c731cdbf760 upstream.
Avoid double-copying of string literals. Use a "const char *" for each string instead of copying from .rodata into stack and then into the skb. We can go directly from .rodata to the skb.
This also works around a Clang bug (that has since been fixed[1]).
--- drivers/bluetooth/hci_vhci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/bluetooth/hci_vhci.c +5 -5
@@ -289,18 +289,18 @@ static void vhci_coredump(struct hci_devstatic void vhci_coredump_hdr (struct hci_dev *hdev,struct sk_buff *skb) { -char buf[80 ]; +const char *buf; -snprintf (buf,sizeof (buf),"Controller Name: vhci_ctrl\n" ); + buf ="Controller Name: vhci_ctrl\n" ;skb_put_data (skb, buf,strlen (buf)); -snprintf (buf,sizeof (buf),"Firmware Version: vhci_fw\n" ); + buf ="Firmware Version: vhci_fw\n" ;skb_put_data (skb, buf,strlen (buf)); -snprintf (buf,sizeof (buf),"Driver: vhci_drv\n" ); + buf ="Driver: vhci_drv\n" ;skb_put_data (skb, buf,strlen (buf)); -snprintf (buf,sizeof (buf),"Vendor: vhci\n" ); + buf ="Vendor: vhci\n" ;skb_put_data (skb, buf,strlen (buf)); }
Greg Kroah-Hartman
maintainerPATCH 127/241 btrfs: ioctl: dont free iov when btrfs_encoded_read() returns -EAGAIN
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidong Yang <[email protected]>
commit 8e587ab43cb92a9e57f99ea8d6c069ee65863707 upstream.
Fix a bug in encoded read that mistakenly frees the iov in case btrfs_encoded_read() returns -EAGAIN assuming the structure will be reused. This can happen when when receiving requests concurrently, the io_uring subsystem does not reset the data, and the last free will happen in btrfs_uring_read_finished().
Handle the -EAGAIN error and skip freeing iov.
--- fs/btrfs/ioctl.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/ioctl.c +2 -0
@@ -4903,6 +4903,8 @@ static int btrfs_uring_encoded_read(stru ret =btrfs_encoded_read (&kiocb, &data->iter, &data->args, &cached_state, &disk_bytenr, &disk_io_size); +if (ret == -EAGAIN ) + goto out_acct;if (ret <0 && ret != -EIOCBQUEUED ) goto out_free;
Greg Kroah-Hartman
maintainerPATCH 128/241 btrfs: correctly escape subvol in btrfs_show_options()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Kimmel <[email protected]>
commit dc08c58696f8555e4a802f1f23c894a330d80ab7 upstream.
Currently, displaying the btrfs subvol mount option doesn't escape ','. This makes parsing /proc/self/mounts and /proc/self/mountinfo ambiguous for subvolume names that contain commas. The text after the comma could be mistaken for another option (think "subvol=foo,ro", where ro is actually part of the subvolumes name).
Replace the manual escape characters list with a call to seq_show_option(). Thanks to Calvin Walton for suggesting this approach.
--- fs/btrfs/super.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/super.c +1 -2
@@ -1139,8 +1139,7 @@ static int btrfs_show_options(struct seq subvol_name =btrfs_get_subvol_name_from_objectid (info,btrfs_root_id (BTRFS_I (d_inode (dentry))->root));if (!IS_ERR (subvol_name)) { -seq_puts (seq,",subvol=" ); -seq_escape (seq, subvol_name," \t\n\\" ); +seq_show_option (seq,"subvol" , subvol_name);kfree (subvol_name); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 129/241 cpufreq/sched: Explicitly synchronize limits_changed flag handling
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 79443a7e9da3c9f68290a8653837e23aba0fa89f upstream.
The handling of the limits_changed flag in struct sugov_policy needs to be explicitly synchronized to ensure that cpufreq policy limits updates will not be missed in some cases.
Without that synchronization it is theoretically possible that the limits_changed update in sugov_should_update_freq() will be reordered with respect to the reads of the policy limits in cpufreq_driver_resolve_freq() and in that case, if the limits_changed update in sugov_limits() clobbers the one in sugov_should_update_freq(), the new policy limits may not take effect for a long time.
Likewise, the limits_changed update in sugov_limits() may theoretically get reordered with respect to the updates of the policy limits in cpufreq_set_policy() and if sugov_should_update_freq() runs between them, the policy limits change may be missed.
To ensure that the above situations will not take place, add memory barriers preventing the reordering in question from taking place and add READ_ONCE() and WRITE_ONCE() annotations around all of the limits_changed flag updates to prevent the compiler from messing up with that code.
--- kernel/sched/cpufreq_schedutil.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
kernel/sched/cpufreq_schedutil.c +24 -4
@@ -81,9 +81,20 @@ static bool sugov_should_update_freq(strif (!cpufreq_this_cpu_can_update (sg_policy->policy))return false; -if (unlikely (sg_policy->limits_changed)) { - sg_policy->limits_changed = false; +if (unlikely (READ_ONCE (sg_policy->limits_changed))) { +WRITE_ONCE (sg_policy->limits_changed, false); sg_policy->need_freq_update = true; + +/* +* The above limits_changed update must occur before the reads +* of policy limits in cpufreq_driver_resolve_freq() or a policy +* limits update might be missed, so use a memory barrier to +* ensure it. +* +* This pairs with the write memory barrier in sugov_limits(). +*/ +smp_mb (); +return true; }
@@ -377,7 +388,7 @@ static inline bool sugov_hold_freq(strucstatic inline void ignore_dl_rate_limit (struct sugov_cpu *sg_cpu) {if (cpu_bw_dl (cpu_rq (sg_cpu->cpu)) > sg_cpu->bw_min) - sg_cpu->sg_policy->limits_changed = true; +WRITE_ONCE (sg_cpu->sg_policy->limits_changed, true); } static inline bool sugov_update_single_common(struct sugov_cpu *sg_cpu,
@@ -883,7 +894,16 @@ static void sugov_limits(struct cpufreq_mutex_unlock (&sg_policy->work_lock); } - sg_policy->limits_changed = true; +/* +* The limits_changed update below must take place before the updates +* of policy limits in cpufreq_set_policy() or a policy limits update +* might be missed, so use a memory barrier to ensure it. +* +* This pairs with the memory barrier in sugov_should_update_freq(). +*/ +smp_wmb (); + +WRITE_ONCE (sg_policy->limits_changed, true); }struct cpufreq_governor schedutil_gov = {
Greg Kroah-Hartman
maintainerPATCH 130/241 cpufreq: Avoid using inconsistent policy->min and policy->max
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 7491cdf46b5cbdf123fc84fbe0a07e9e3d7b7620 upstream.
Since cpufreq_driver_resolve_freq() can run in parallel with cpufreq_set_policy() and there is no synchronization between them, the former may access policy->min and policy->max while the latter is updating them and it may see intermediate values of them due to the way the update is carried out. Also the compiler is free to apply any optimizations it wants both to the stores in cpufreq_set_policy() and to the loads in cpufreq_driver_resolve_freq() which may result in additional inconsistencies.
To address this, use WRITE_ONCE() when updating policy->min and policy->max in cpufreq_set_policy() and use READ_ONCE() for reading them in cpufreq_driver_resolve_freq(). Moreover, rearrange the update in cpufreq_set_policy() to avoid storing intermediate values in policy->min and policy->max with the help of the observation that their new values are expected to be properly ordered upfront.
Also modify cpufreq_driver_resolve_freq() to take the possible reverse ordering of policy->min and policy->max, which may happen depending on the ordering of operations when this function and cpufreq_set_policy() run concurrently, into account by always honoring the max when it turns out to be less than the min (in case it comes from thermal throttling or similar).
--- drivers/cpufreq/cpufreq.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-)
drivers/cpufreq/cpufreq.c +25 -7
@@ -539,8 +539,6 @@ static unsigned int __resolve_freq(struc {unsigned int idx; - target_freq =clamp_val (target_freq, policy->min, policy->max); -if (!policy->freq_table)return target_freq;
@@ -564,7 +562,22 @@ static unsigned int __resolve_freq(strucunsigned int cpufreq_driver_resolve_freq (struct cpufreq_policy *policy,unsigned int target_freq) { -return __resolve_freq (policy, target_freq,CPUFREQ_RELATION_LE ); +unsigned int min =READ_ONCE (policy->min); +unsigned int max =READ_ONCE (policy->max); + +/* +* If this function runs in parallel with cpufreq_set_policy(), it may +* read policy->min before the update and policy->max after the update +* or the other way around, so there is no ordering guarantee. +* +* Resolve this by always honoring the max (in case it comes from +* thermal throttling or similar). +*/ +if (unlikely (min > max)) + min = max; + +return __resolve_freq (policy,clamp_val (target_freq, min, max), +CPUFREQ_RELATION_LE ); }EXPORT_SYMBOL_GPL (cpufreq_driver_resolve_freq);
@@ -2337,6 +2350,7 @@ int __cpufreq_driver_target(struct cpufrif (cpufreq_disabled ())return -ENODEV ; + target_freq =clamp_val (target_freq, policy->min, policy->max); target_freq =__resolve_freq (policy, target_freq, relation); pr_debug("target for CPU %u: %u kHz, relation %u, requested %u kHz\n",
@@ -2661,11 +2675,15 @@ static int cpufreq_set_policy(struct cpu* Resolve policy min/max to available frequencies. It ensures * no frequency resolution will neither overshoot the requested maximum * nor undershoot the requested minimum. +* +* Avoid storing intermediate values in policy->max or policy->min and +* compiler optimizations around them because they may be accessed +* concurrently by cpufreq_driver_resolve_freq() during the update. */ - policy->min = new_data.min; - policy->max = new_data.max; - policy->min =__resolve_freq (policy, policy->min,CPUFREQ_RELATION_L ); - policy->max =__resolve_freq (policy, policy->max,CPUFREQ_RELATION_H ); +WRITE_ONCE (policy->max,__resolve_freq (policy, new_data.max,CPUFREQ_RELATION_H )); + new_data.min =__resolve_freq (policy, new_data.min,CPUFREQ_RELATION_L ); +WRITE_ONCE (policy->min, new_data.min > policy->max ? policy->max : new_data.min); +trace_cpu_frequency_limits (policy);cpufreq_update_pressure (policy);
Re: [PATCH 6.14 130/241] cpufreq: Avoid using inconsistent policy->min and policy->max
Hi Greg,
Quoted 31 lines · Greg Kroah-Hartman
6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit
7491cdf46b5cbdf123fc84fbe0a07e9e3d7b7620upstream.Since
cpufreq_driver_resolve_freq()can run in parallel withcpufreq_set_policy()and there is no synchronization between them, the former may accesspolicy->minandpolicy->maxwhile the latter is updating them and it may see intermediate values of them due to the way the update is carried out. Also the compiler is free to apply any optimizations it wants both to the stores incpufreq_set_policy()and to the loads incpufreq_driver_resolve_freq()which may result in additional inconsistencies.To address this, use
WRITE_ONCE()when updatingpolicy->minandpolicy->maxincpufreq_set_policy()and useREAD_ONCE()for reading them incpufreq_driver_resolve_freq(). Moreover, rearrange the update incpufreq_set_policy()to avoid storing intermediate values inpolicy->minandpolicy->maxwith the help of the observation that their new values are expected to be properly ordered upfront.Also modify
cpufreq_driver_resolve_freq()to take the possible reverse ordering ofpolicy->minandpolicy->max, which may happen depending on the ordering of operations when this function andcpufreq_set_policy()run concurrently, into account by always honoring the max when it turns out to be less than the min (in case it comes from thermal throttling or similar).
Quoted 7 lines
Fixes 151717690694 ("cpufreq: Make policy min/max hard requirements")Cc 5.16+ <[email protected]> # 5.16+Signed-off-by Rafael J. Wysocki <[email protected]>Reviewed-by Christian Loehle <[email protected]>Acked-by Viresh Kumar <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Please drop this patch from all stable queues for now. It is causing the CPU frequency to be stuck at minimum after temperature throttling. I reported this with more detail as reply to the original patch [1].
Thanks,
Stephan
Greg Kroah-Hartman
maintainerRe: [PATCH 6.14 130/241] cpufreq: Avoid using inconsistent policy->min and policy->max
Quoted 42 lines · Stephan Gerhold
Hi Greg,
Quoted 31 lines · Greg Kroah-Hartman
6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit
7491cdf46b5cbdf123fc84fbe0a07e9e3d7b7620upstream.Since
cpufreq_driver_resolve_freq()can run in parallel withcpufreq_set_policy()and there is no synchronization between them, the former may accesspolicy->minandpolicy->maxwhile the latter is updating them and it may see intermediate values of them due to the way the update is carried out. Also the compiler is free to apply any optimizations it wants both to the stores incpufreq_set_policy()and to the loads incpufreq_driver_resolve_freq()which may result in additional inconsistencies.To address this, use
WRITE_ONCE()when updatingpolicy->minandpolicy->maxincpufreq_set_policy()and useREAD_ONCE()for reading them incpufreq_driver_resolve_freq(). Moreover, rearrange the update incpufreq_set_policy()to avoid storing intermediate values inpolicy->minandpolicy->maxwith the help of the observation that their new values are expected to be properly ordered upfront.Also modify
cpufreq_driver_resolve_freq()to take the possible reverse ordering ofpolicy->minandpolicy->max, which may happen depending on the ordering of operations when this function andcpufreq_set_policy()run concurrently, into account by always honoring the max when it turns out to be less than the min (in case it comes from thermal throttling or similar).Quoted 7 lines
Fixes 151717690694 ("cpufreq: Make policy min/max hard requirements")Cc 5.16+ <[email protected]> # 5.16+Signed-off-by Rafael J. Wysocki <[email protected]>Reviewed-by Christian Loehle <[email protected]>Acked-by Viresh Kumar <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 3 lines
Please drop this patch from all stable queues for now. It is causing the CPU frequency to be stuck at minimum after temperature throttling. I reported this with more detail as reply to the original patch [1].
Ok, now dropped from all queues, thanks for letting us know.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 131/241 crypto: caam/qi - Fix drv_ctx refcount bug
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit b7b39df7e710b0068356e4c696af07aa10e2cd3d upstream.
Ensure refcount is raised before request is enqueued since it could be dequeued before the call returns.
--- drivers/crypto/caam/qi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/crypto/caam/qi.c +3 -3
@@ -122,12 +122,12 @@ int caam_qi_enqueue(struct device *qidevqm_fd_addr_set64 (&fd, addr); do { + refcount_inc(&req->drv_ctx->refcnt); ret = qman_enqueue(req->drv_ctx->req_fq, &fd); - if (likely(!ret)) { - refcount_inc(&req->drv_ctx->refcnt); + if (likely(!ret)) return 0; - } + refcount_dec(&req->drv_ctx->refcnt); if (ret != -EBUSY) break; num_retries++;
Greg Kroah-Hartman
maintainerPATCH 132/241 hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit bb5e07cb927724e0b47be371fa081141cfb14414 upstream.
Syzbot reported an issue in hfs subsystem:
BUG: KASAN: slab-out-of-bounds in memcpy_from_page include/linux/highmem.h:423 [inline] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read fs/hfs/bnode.c:35 [inline] BUG: KASAN: slab-out-of-bounds in hfs_bnode_read_key+0x314/0x450 fs/hfs/bnode.c:70 Write of size 94 at addr ffff8880123cd100 by task syz-executor237/5102 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 memcpy_from_page include/linux/highmem.h:423 [inline] hfs_bnode_read fs/hfs/bnode.c:35 [inline] hfs_bnode_read_key+0x314/0x450 fs/hfs/bnode.c:70 hfs_brec_insert+0x7f3/0xbd0 fs/hfs/brec.c:159 hfs_cat_create+0x41d/0xa50 fs/hfs/catalog.c:118 hfs_mkdir+0x6c/0xe0 fs/hfs/dir.c:232 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdir fs/namei.c:4300 [inline] __se_sys_mkdir fs/namei.c:4298 [inline] __x64_sys_mkdir+0x6c/0x80 fs/namei.c:4298 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbdd6057a99
Add a check for key length in hfs_bnode_read_key to prevent out-of-bounds memory access. If the key length is invalid, the key buffer is cleared, improving stability and reliability.
--- fs/hfs/bnode.c | 6 ++++++ fs/hfsplus/bnode.c | 6 ++++++ 2 files changed, 12 insertions(+)
fs/hfs/bnode.c +6 -0
@@ -67,6 +67,12 @@ void hfs_bnode_read_key(struct hfs_bnodeelse key_len = tree->max_key_len +1 ; +if (key_len >sizeof (hfs_btree_key) || key_len <1 ) { +memset (key,0 ,sizeof (hfs_btree_key)); +pr_err ("hfs: Invalid key length: %d\n" , key_len); +return ; + } +hfs_bnode_read (node, key, off, key_len); }
fs/hfsplus/bnode.c +6 -0
@@ -67,6 +67,12 @@ void hfs_bnode_read_key(struct hfs_bnodeelse key_len = tree->max_key_len +2 ; +if (key_len >sizeof (hfsplus_btree_key) || key_len <1 ) { +memset (key,0 ,sizeof (hfsplus_btree_key)); +pr_err ("hfsplus: Invalid key length: %d\n" , key_len); +return ; + } +hfs_bnode_read (node, key, off, key_len); }
Greg Kroah-Hartman
maintainerPATCH 133/241 i2c: cros-ec-tunnel: defer probe if parent EC is not present
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit 424eafe65647a8d6c690284536e711977153195a upstream.
When i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent device will not be found, leading to NULL pointer dereference.
That can also be reproduced by unbinding the controller driver and then loading i2c-cros-ec-tunnel module (or binding the device).
[ 271.991245] BUG: kernel NULL pointer dereference, address: 0000000000000058 [ 271.998215] #PF: supervisor read access in kernel mode [ 272.003351] #PF: error_code(0x0000) - not-present page [ 272.008485] PGD 0 P4D 0 [ 272.011022] Oops: Oops: 0000 [#1] SMP NOPTI [ 272.015207] CPU: 0 UID: 0 PID: 3859 Comm: insmod Tainted: G S 6.15.0-rc1-00004-g44722359ed83 #30 PREEMPT(full) 3c7fb39a552e7d949de2ad921a7d6588d3a4fdc5 [ 272.030312] Tainted: [S]=CPU_OUT_OF_SPEC [ 272.034233] Hardware name: HP Berknip/Berknip, BIOS Google_Berknip.13434.356.0 05/17/2021 [ 272.042400] RIP: 0010:ec_i2c_probe+0x2b/0x1c0 [i2c_cros_ec_tunnel] [ 272.048577] Code: 1f 44 00 00 41 57 41 56 41 55 41 54 53 48 83 ec 10 65 48 8b 05 06 a0 6c e7 48 89 44 24 08 4c 8d 7f 10 48 8b 47 50 4c 8b 60 78 <49> 83 7c 24 58 00 0f 84 2f 01 00 00 48 89 fb be 30 06 00 00 4c 9 [ 272.067317] RSP: 0018:ffffa32082a03940 EFLAGS: 00010282 [ 272.072541] RAX: ffff969580b6a810 RBX: ffff969580b68c10 RCX: 0000000000000000 [ 272.079672] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff969580b68c00 [ 272.086804] RBP: 00000000fffffdfb R08: 0000000000000000 R09: 0000000000000000 [ 272.093936] R10: 0000000000000000 R11: ffffffffc0600000 R12: 0000000000000000 [ 272.101067] R13: ffffffffa666fbb8 R14: ffffffffc05b5528 R15: ffff969580b68c10 [ 272.108198] FS: 00007b930906fc40(0000) GS:ffff969603149000(0000) knlGS:0000000000000000 [ 272.116282] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 272.122024] CR2: 0000000000000058 CR3: 000000012631c000 CR4: 00000000003506f0 [ 272.129155] Call Trace: [ 272.131606] <TASK> [ 272.133709] ? acpi_dev_pm_attach+0xdd/0x110 [ 272.137985] platform_probe+0x69/0xa0 [ 272.141652] really_probe+0x152/0x310 [ 272.145318] __driver_probe_device+0x77/0x110 [ 272.149678] driver_probe_device+0x1e/0x190 [ 272.153864] __driver_attach+0x10b/0x1e0 [ 272.157790] ? driver_attach+0x20/0x20 [ 272.161542] bus_for_each_dev+0x107/0x150 [ 272.165553] bus_add_driver+0x15d/0x270 [ 272.169392] driver_register+0x65/0x110 [ 272.173232] ? cleanup_module+0xa80/0xa80 [i2c_cros_ec_tunnel 3a00532f3f4af4a9eade753f86b0f8dd4e4e5698] [ 272.182617] do_one_initcall+0x110/0x350 [ 272.186543] ? security_kernfs_init_security+0x49/0xd0 [ 272.191682] ? __kernfs_new_node+0x1b9/0x240 [ 272.195954] ? security_kernfs_init_security+0x49/0xd0 [ 272.201093] ? __kernfs_new_node+0x1b9/0x240 [ 272.205365] ? kernfs_link_sibling+0x105/0x130 [ 272.209810] ? kernfs_next_descendant_post+0x1c/0xa0 [ 272.214773] ? kernfs_activate+0x57/0x70 [ 272.218699] ? kernfs_add_one+0x118/0x160 [ 272.222710] ? __kernfs_create_file+0x71/0xa0 [ 272.227069] ? sysfs_add_bin_file_mode_ns+0xd6/0x110 [ 272.232033] ? internal_create_group+0x453/0x4a0 [ 272.236651] ? __vunmap_range_noflush+0x214/0x2d0 [ 272.241355] ? __free_frozen_pages+0x1dc/0x420 [ 272.245799] ? free_vmap_area_noflush+0x10a/0x1c0 [ 272.250505] ? load_module+0x1509/0x16f0 [ 272.254431] do_init_module+0x60/0x230 [ 272.258181] __se_sys_finit_module+0x27a/0x370 [ 272.262627] do_syscall_64+0x6a/0xf0 [ 272.266206] ? do_syscall_64+0x76/0xf0 [ 272.269956] ? irqentry_exit_to_user_mode+0x79/0x90 [ 272.274836] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 272.279887] RIP: 0033:0x7b9309168d39 [ 272.283466] Code: 5b 41 5c 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d af 40 0c 00 f7 d8 64 89 01 8 [ 272.302210] RSP: 002b:00007fff50f1a288 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 272.309774] RAX: ffffffffffffffda RBX: 000058bf9b50f6d0 RCX: 00007b9309168d39 [ 272.316905] RDX: 0000000000000000 RSI: 000058bf6c103a77 RDI: 0000000000000003 [ 272.324036] RBP: 00007fff50f1a2e0 R08: 00007fff50f19218 R09: 0000000021ec4150 [ 272.331166] R10: 000058bf9b50f7f0 R11: 0000000000000246 R12: 0000000000000000 [ 272.338296] R13: 00000000fffffffe R14: 0000000000000000 R15: 000058bf6c103a77 [ 272.345428] </TASK> [ 272.347617] Modules linked in: i2c_cros_ec_tunnel(+) [ 272.364585] gsmi: Log Shutdown Reason 0x03
Returning -EPROBE_DEFER will allow the device to be bound once the controller is bound, in the case of built-in drivers.
--- drivers/i2c/busses/i2c-cros-ec-tunnel.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/i2c/busses/i2c-cros-ec-tunnel.c +3 -0
@@ -247,6 +247,9 @@ static int ec_i2c_probe(struct platform_u32 remote_bus;int err; +if (!ec) +return dev_err_probe (dev, -EPROBE_DEFER ,"couldn't find parent EC device\n" ); +if (!ec->cmd_xfer) {dev_err (dev,"Missing sendrecv\n" );return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 134/241 isofs: Prevent the use of too small fid
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 0405d4b63d082861f4eaff9d39c78ee9dc34f845 upstream.
syzbot reported a slab-out-of-bounds Read in isofs_fh_to_parent. [1]
The handle_bytes value passed in by the reproducing program is equal to 12. In handle_to_path(), only 12 bytes of memory are allocated for the structure file_handle->f_handle member, which causes an out-of-bounds access when accessing the member parent_block of the structure isofs_fid in isofs, because accessing parent_block requires at least 16 bytes of f_handle. Here, fh_len is used to indirectly confirm that the value of handle_bytes is greater than 3 before accessing parent_block.
[1]
BUG: KASAN: slab-out-of-bounds in isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183 Read of size 4 at addr ffff0000cc030d94 by task syz-executor215/6466 CPU: 1 UID: 0 PID: 6466 Comm: syz-executor215 Not tainted 6.14.0-rc7-syzkaller-ga2392f333575 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x198/0x550 mm/kasan/report.c:521 kasan_report+0xd8/0x138 mm/kasan/report.c:634 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183 exportfs_decode_fh_raw+0x2dc/0x608 fs/exportfs/expfs.c:523 do_handle_to_path+0xa0/0x198 fs/fhandle.c:257 handle_to_path fs/fhandle.c:385 [inline] do_handle_open+0x8cc/0xb8c fs/fhandle.c:403 __do_sys_open_by_handle_at fs/fhandle.c:443 [inline] __se_sys_open_by_handle_at fs/fhandle.c:434 [inline] __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Allocated by task 6466: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:562 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4294 [inline] __kmalloc_noprof+0x32c/0x54c mm/slub.c:4306 kmalloc_noprof include/linux/slab.h:905 [inline] handle_to_path fs/fhandle.c:357 [inline] do_handle_open+0x5a4/0xb8c fs/fhandle.c:403 __do_sys_open_by_handle_at fs/fhandle.c:443 [inline] __se_sys_open_by_handle_at fs/fhandle.c:434 [inline] __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
--- fs/isofs/export.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/isofs/export.c +1 -1
@@ -180,7 +180,7 @@ static struct dentry *isofs_fh_to_parentreturn NULL ;return isofs_export_iget (sb, - fh_len >2 ? ifid->parent_block :0 , + fh_len >3 ? ifid->parent_block :0 , ifid->parent_offset, fh_len >4 ? ifid->parent_generation :0 ); }
Greg Kroah-Hartman
maintainerPATCH 135/241 lib/iov_iter: fix to increase non slab folio refcount
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheng Yong <[email protected]>
commit 770c8d55c42868239c748a3ebc57c9e37755f842 upstream.
When testing EROFS file-backed mount over v9fs on qemu, I encountered a folio UAF issue. The page sanity check reports the following call trace. The root cause is that pages in bvec are coalesced across a folio bounary. The refcount of all non-slab folios should be increased to ensure p9_releas_pages can put them correctly.
BUG: Bad page state in process md5sum pfn:18300 page: refcount:0 mapcount:0 mapping:00000000d5ad8e4e index:0x60 pfn:0x18300 head: order:0 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 aops:z_erofs_aops ino:30b0f dentry name(?):"GoogleExtServicesCn.apk" flags: 0x100000000000041(locked|head|node=0|zone=1) raw: 0100000000000041 dead000000000100 dead000000000122 ffff888014b13bd0 raw: 0000000000000060 0000000000000020 00000000ffffffff 0000000000000000
head: 0100000000000041 dead000000000100 dead000000000122 ffff888014b13bd0
head: 0000000000000060 0000000000000020 00000000ffffffff 0000000000000000
head: 0100000000000000 0000000000000000 ffffffffffffffff 0000000000000000
head: 0000000000000010 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Call Trace: dump_stack_lvl+0x53/0x70 bad_page+0xd4/0x220 __free_pages_ok+0x76d/0xf30 __folio_put+0x230/0x320 p9_release_pages+0x179/0x1f0 p9_virtio_zc_request+0xa2a/0x1230 p9_client_zc_rpc.constprop.0+0x247/0x700 p9_client_read_once+0x34d/0x810 p9_client_read+0xf3/0x150 v9fs_issue_read+0x111/0x360 netfs_unbuffered_read_iter_locked+0x927/0x1390 netfs_unbuffered_read_iter+0xa2/0xe0 vfs_iocb_iter_read+0x2c7/0x460 erofs_fileio_rq_submit+0x46b/0x5b0 z_erofs_runqueue+0x1203/0x21e0 z_erofs_readahead+0x579/0x8b0 read_pages+0x19f/0xa70 page_cache_ra_order+0x4ad/0xb80 filemap_readahead.isra.0+0xe7/0x150 filemap_get_pages+0x7aa/0x1890 filemap_read+0x320/0xc80 vfs_read+0x6c6/0xa30 ksys_read+0xf9/0x1c0 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x71/0x79
--- lib/iov_iter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/iov_iter.c +1 -1
@@ -1191,7 +1191,7 @@ static ssize_t __iov_iter_get_pages_alloc(struct iov_iter *i,return -ENOMEM ; p = *pages;for (int k =0 ; k < n; k++) { -struct folio *folio =page_folio (page); +struct folio *folio =page_folio (page + k); p[k] = page + k;if (!folio_test_slab (folio))folio_get (folio);
Signature · 1 line
2.49.0
Greg Kroah-Hartman
maintainerPATCH 136/241 loop: properly send KOBJ_CHANGED uevent for disk device
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit e7bc0010ceb403d025100698586c8e760921d471 upstream.
The original commit message and the wording "uncork" in the code comment indicate that it is expected that the suppressed event instances are automatically sent after unsuppressing.
This is not the case, instead they are discarded.
In effect this means that no "changed" events are emitted on the device itself by default.
While each discovered partition does trigger a changed event on the device, devices without partitions don't have any event emitted.
This makes udev miss the device creation and prompted workarounds in userspace. See the linked util-linux/losetup bug.
Explicitly emit the events and drop the confusingly worded comments.
--- drivers/block/loop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/block/loop.c +2 -2
@@ -577,8 +577,8 @@ static int loop_change_fd(struct loop_de error =0 ; done: -/* enable and uncork uevent now that we are done */ dev_set_uevent_suppress (disk_to_dev (lo->lo_disk),0 ); +kobject_uevent (&disk_to_dev (lo->lo_disk)->kobj,KOBJ_CHANGE );return error; out_err:
@@ -1038,8 +1038,8 @@ static int loop_configure(struct loop_deif (partscan)clear_bit (GD_SUPPRESS_PART_SCAN , &lo->lo_disk->state); -/* enable and uncork uevent now that we are done */ dev_set_uevent_suppress (disk_to_dev (lo->lo_disk),0 ); +kobject_uevent (&disk_to_dev (lo->lo_disk)->kobj,KOBJ_CHANGE );loop_global_unlock (lo, is_loop);if (partscan)
Greg Kroah-Hartman
maintainerPATCH 137/241 loop: LOOP_SET_FD: send uevents for partitions
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 0dba7a05b9e47d8b546399117b0ddf2426dc6042 upstream.
Remove the suppression of the uevents before scanning for partitions. The partitions inherit their suppression settings from their parent device, which lead to the uevents being dropped.
This is similar to the same changes for LOOP_CONFIGURE done in commit bb430b694226 ("loop: LOOP_CONFIGURE: send uevents for partitions").
--- drivers/block/loop.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/loop.c +2 -1
@@ -572,12 +572,12 @@ static int loop_change_fd(struct loop_de* dependency. */ fput (old_file); +dev_set_uevent_suppress (disk_to_dev (lo->lo_disk),0 );if (partscan)loop_reread_partitions (lo); error =0 ; done: -dev_set_uevent_suppress (disk_to_dev (lo->lo_disk),0 );kobject_uevent (&disk_to_dev (lo->lo_disk)->kobj,KOBJ_CHANGE );return error;
@@ -585,6 +585,7 @@ out_err:loop_global_unlock (lo, is_loop); out_putf:fput (file); +dev_set_uevent_suppress (disk_to_dev (lo->lo_disk),0 ); goto done; }
Greg Kroah-Hartman
maintainerPATCH 138/241 mm/compaction: fix bug in hugetlb handling pathway
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishal Moola (Oracle) <[email protected]>
commit a84edd52f0a0fa193f0f685769939cf84510755b upstream.
The compaction code doesn't take references on pages until we're certain we should attempt to handle it.
In the hugetlb case, isolate_or_dissolve_huge_page() may return -EBUSY without taking a reference to the folio associated with our pfn. If our folio's refcount drops to 0, compound_nr() becomes unpredictable, making low_pfn and nr_scanned unreliable. The user-visible effect is minimal - this should rarely happen (if ever).
Fix this by storing the folio statistics earlier on the stack (just like the THP and Buddy cases).
Also revert commit 66fe1cf7f581 ("mm: compaction: use helper compound_nr in isolate_migratepages_block") to make backporting easier.
--- mm/compaction.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
mm/compaction.c +3 -3
@@ -981,13 +981,13 @@ isolate_migratepages_block(struct compac }if (PageHuge (page)) { +const unsigned int order =compound_order (page);/* * skip hugetlbfs if we are not compacting for pages * bigger than its order. THPs and other compound pages * are handled below. */ if (!cc->alloc_contig) { -const unsigned int order =compound_order (page);if (order <=MAX_PAGE_ORDER ) { low_pfn += (1UL << order) -1 ;
@@ -1011,8 +1011,8 @@ isolate_migratepages_block(struct compac/* Do not report -EBUSY down the chain */ if (ret == -EBUSY ) ret =0 ; - low_pfn +=compound_nr (page) -1 ; - nr_scanned +=compound_nr (page) -1 ; + low_pfn += (1UL << order) -1 ; + nr_scanned += (1UL << order) -1 ; goto isolate_fail; }
Greg Kroah-Hartman
maintainerPATCH 139/241 mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <[email protected]>
commit 8c03ebd7cdc06bd0d2fecb4d1a609ef1dbb7d0aa upstream.
Not like fault_in_readable() or fault_in_writeable(), in fault_in_safe_writeable() local variable 'start' is increased page by page to loop till the whole address range is handled. However, it mistakenly calculates the size of the handled range with 'uaddr - start'.
Fix it here.
Andreas said:
: In gfs2, fault_in_iov_iter_writeable() is used in
: gfs2_file_direct_read() and gfs2_file_read_iter(), so this potentially : affects buffered as well as direct reads. This bug could cause those : gfs2 functions to spin in a loop.
--- mm/gup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/gup.c +2 -2
@@ -2210,8 +2210,8 @@ size_t fault_in_safe_writeable(const cha }while (start != end);mmap_read_unlock (mm); -if (size > (unsigned long )uaddr - start) -return size - ((unsigned long )uaddr - start); +if (size > start - (unsigned long )uaddr) +return size - (start - (unsigned long )uaddr);return 0 ; }EXPORT_SYMBOL (fault_in_safe_writeable);
Greg Kroah-Hartman
maintainerPATCH 140/241 mm: fix filemap_get_folios_contig returning batches of identical folios
In reply to Greg Kroah-Hartman6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishal Moola (Oracle) <[email protected]>
commit 8ab1b16023961dc640023b10436d282f905835ad upstream.
filemap_get_folios_contig() is supposed to return distinct folios found within [start, end]. Large folios in the Xarray become multi-index entries. xas_next() can iterate through the sub-indexes before finding a sibling entry and breaking out of the loop.
This can result in a returned folio_batch containing an indeterminate number of duplicate folios, which forces the callers to skeptically handle the returned batch. This is inefficient and incurs a large maintenance overhead.
We can fix this by calling xas_advance() after we have successfully adding a folio to the batch to ensure our Xarray is positioned such that it will correctly find the next folio - similar to filemap_get_read_batch().
--- mm/filemap.c | 1 + 1 file changed, 1 insertion(+)
mm/filemap.c +1 -0
@@ -2244,6 +2244,7 @@ unsigned filemap_get_folios_contig(struc *start = folio->index + nr; goto out; } +xas_advance (&xas,folio_next_index (folio) -1 );continue ; put_folio:folio_put (folio);