6.6.92-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 6.6.92-rc1 review
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 22 May 2025 12:57:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.92-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.92-rc1
Alex Deucher <[email protected]>
drm/amdgpu: fix pm notifier handling
Dan Carpenter <[email protected]>
phy: tegra: xusb: remove a stray unlock
Filipe Manana <[email protected]>
btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
Eric Dumazet <[email protected]>
sctp: add mutual exclusion in proc_sctp_do_udp_port()
Ma Wupeng <[email protected]>
hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
Tom Lendacky <[email protected]>
memblock: Accept allocated memory before use in memblock_double_array()
Huacai Chen <[email protected]>
LoongArch: Explicitly specify code model in Makefile
Peter Collingbourne <[email protected]>
bpf, arm64: Fix address emission with tag-based KASAN enabled
Puranjay Mohan <[email protected]>
bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
Zi Yan <[email protected]>
mm/migrate: correct nr_failed in migrate_pages_sync()
Feng Tang <[email protected]>
selftests/mm: compaction_test: support platform with huge mount of memory
Andrei Kuchynski <[email protected]>
usb: typec: ucsi: displayport: Fix deadlock
Neeraj Sanjay Kale <[email protected]>
Bluetooth: btnxpuart: Fix kernel panic during FW release
Kirill A. Shutemov <[email protected]>
mm/page_alloc: fix race condition in unaccepted memory handling
Pawan Gupta <[email protected]>
x86/its: Fix build error for its_static_thunk()
Shuai Xue <[email protected]>
dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
Shuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe
Shuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
Shuai Xue <[email protected]>
dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call
Shuai Xue <[email protected]>
dmaengine: idxd: Add missing cleanups in cleanup internals
Shuai Xue <[email protected]>
dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals
Shuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups
Shuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines
Shuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs
Yemike Abhilash Chandra <[email protected]>
dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy
Ronald Wahl <[email protected]>
dmaengine: ti: k3-udma: Add missing locking
Nathan Chancellor <[email protected]>
net: qede: Initialize qede_ll_ops with designated initializer
Fedor Pchelkin <[email protected]>
wifi: mt76: disable napi on driver removal
Aaron Kling <[email protected]>
spi: tegra114: Use value to check for invalid delays
Jethro Donaldson <[email protected]>
smb: client: fix memory leak during error handling for POSIX mkdir
Steve Siwinski <[email protected]>
scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
Claudiu Beznea <[email protected]>
phy: renesas: rcar-gen3-usb2: Set timing registers only once
Claudiu Beznea <[email protected]>
phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
Ma Ke <[email protected]>
phy: Fix error handling in tegra_xusb_port_init
Wayne Chang <[email protected]>
phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
Steven Rostedt <[email protected]>
tracing: samples: Initialize trace_array_printk() with the correct function
pengdonglin <[email protected]>
ftrace: Fix preemption accounting for stacktrace filter command
pengdonglin <[email protected]>
ftrace: Fix preemption accounting for stacktrace trigger command
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
Michael Kelley <[email protected]>
Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
Michael Kelley <[email protected]>
hv_netvsc: Remove rmsg_pgcnt
Michael Kelley <[email protected]>
hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
Michael Kelley <[email protected]>
hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
Hyejeong Choi <[email protected]>
dma-buf: insert memory barrier before updating num_fences
Nicolas Chauvet <[email protected]>
ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
Christian Heusel <[email protected]>
ALSA: usb-audio: Add sample rate quirk for Audioengine D1
Wentao Liang <[email protected]>
ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
Jeremy Linton <[email protected]>
ACPI: PPTT: Fix processor subtable walk
Wayne Lin <[email protected]>
drm/amd/display: Avoid flooding unnecessary info messages
Wayne Lin <[email protected]>
drm/amd/display: Correct the reply value when AUX write incomplete
Tiezhu Yang <[email protected]>
LoongArch: uprobes: Remove redundant code about resume_era
Tiezhu Yang <[email protected]>
LoongArch: uprobes: Remove user_{en,dis}able_single_step()
Huacai Chen <[email protected]>
LoongArch: Fix MAX_REG_OFFSET calculation
Huacai Chen <[email protected]>
LoongArch: Save and restore CSR.CNTC for hibernation
Tianyang Zhang <[email protected]>
LoongArch: Prevent cond_resched() occurring within kernel-fpu
Jan Kara <[email protected]>
udf: Make sure i_lenExtents is uptodate on inode eviction
Nathan Lynch <[email protected]>
dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
Trond Myklebust <[email protected]>
NFSv4/pnfs: Reset the layout state after a layoutreturn
Gerhard Engleder <[email protected]>
tsnep: fix timestamping with a stacked DSA driver
Gerhard Engleder <[email protected]>
tsnep: Inline small fragments within TX descriptor
Pengtao He <[email protected]>
net/tls: fix kernel panic when alloc_page failed
Ido Schimmel <[email protected]>
mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
Kees Cook <[email protected]>
wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
Hariprasad Kelam <[email protected]>
octeontx2-af: Fix CGX Receive counters
Bo-Cun Chen <[email protected]>
net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability
Subbaraya Sundeep <[email protected]>
octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
Cosmin Tanislav <[email protected]>
regulator: max20086: fix invalid memory access
Abdun Nihaal <[email protected]>
qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
Carolina Jubran <[email protected]>
net/mlx5e: Disable MACsec offload for uplink representor profile
Geert Uytterhoeven <[email protected]>
ALSA: sh: SND_AICA should depend on SH_DMA_API
Keith Busch <[email protected]>
nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
Kees Cook <[email protected]>
nvme-pci: make nvme_pci_npages_prp() __always_inline
Vladimir Oltean <[email protected]>
net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
Mathieu Othacehe <[email protected]>
net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
Takashi Iwai <[email protected]>
ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
Takashi Iwai <[email protected]>
ALSA: seq: Fix delivery of UMP events to group ports
Andrew Jeffery <[email protected]>
net: mctp: Ensure keys maintain only one ref to corresponding dev
Matt Johnston <[email protected]>
net: mctp: Don't access ifa_index when missing
Eric Dumazet <[email protected]>
mctp: no longer rely on net->dev_index_head[]
Hangbin Liu <[email protected]>
tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
Rahul Rameshbabu <[email protected]>
tools: ynl: ethtool.py: Output timestamping statistics from tsinfo-get operation
Cong Wang <[email protected]>
net_sched: Flush gso_skb list too during ->change()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
Geert Uytterhoeven <[email protected]>
spi: loopback-test: Do not split 1024-byte hexdumps
Li Lingfeng <[email protected]>
nfs: handle failure of nfs_get_lock_context in unlock path
Henry Martin <[email protected]>
HID: uclogic: Add NULL check in uclogic_input_configured()
Qasim Ijaz <[email protected]>
HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
David Lechner <[email protected]>
iio: chemical: sps30: use aligned_s64 for timestamp
Jonathan Cameron <[email protected]>
iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
Alex Deucher <[email protected]>
Revert "drm/amd: Stop evicting resources on APUs in suspend"
Mario Limonciello <[email protected]>
drm/amd: Add Suspend/Hibernate notification callback support
Zhigang Luo <[email protected]>
drm/amdgpu: trigger flr_work if reading pf2vf data failed
Ma Jun <[email protected]>
drm/amdgpu: Fix the runtime resume failure issue
Mario Limonciello <[email protected]>
drm/amd: Stop evicting resources on APUs in suspend
Jonathan Cameron <[email protected]>
iio: adc: ad7266: Fix potential timestamp alignment issue.
Mikhail Lobanov <[email protected]>
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
Peter Gonda <[email protected]>
KVM: SVM: Update SEV-ES shutdown intercepts with more metadata
Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix timeout checks on polling path
Luke Parkin <[email protected]>
firmware: arm_scmi: Track basic SCMI communication debug metrics
Luke Parkin <[email protected]>
firmware: arm_scmi: Add support for debug metrics at the interface
Cristian Marussi <[email protected]>
firmware: arm_scmi: Add message dump traces for bad and unexpected replies
Cristian Marussi <[email protected]>
firmware: arm_scmi: Add helper to trace bad messages
Michal Suchanek <[email protected]>
tpm: tis: Double the timeout B to 4s
Masami Hiramatsu (Google) <[email protected]>
tracing: probes: Fix a possible race in trace_probe_log APIs
Waiman Long <[email protected]>
cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks
Hans de Goede <[email protected]>
platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
Runhua He <[email protected]>
platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL)
Kees Cook <[email protected]>
binfmt_elf: Move brk for static PIE even if ASLR disabled
Kees Cook <[email protected]>
binfmt_elf: Honor PT_LOAD alignment for static PIE
Kees Cook <[email protected]>
binfmt_elf: Calculate total_size earlier
Kees Cook <[email protected]>
selftests/exec: Build both static and non-static load_address tests
Kees Cook <[email protected]>
binfmt_elf: Leave a gap between .bss and brk
Muhammad Usama Anjum <[email protected]>
selftests/exec: load_address: conform test to TAP format output
Kees Cook <[email protected]>
binfmt_elf: elf_bss no longer used by load_elf_binary()
Eric W. Biederman <[email protected]>
binfmt_elf: Support segments with 0 filesz and misaligned starts
Stephen Smalley <[email protected]>
fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
-------------
Diffstat:
Makefile | 4 +- arch/arm64/net/bpf_jit_comp.c | 12 +- arch/loongarch/Makefile | 2 +- arch/loongarch/include/asm/ptrace.h | 2 +- arch/loongarch/include/asm/uprobes.h | 1 - arch/loongarch/kernel/kfpu.c | 22 +- arch/loongarch/kernel/time.c | 2 +- arch/loongarch/kernel/uprobes.c | 11 +- arch/loongarch/power/hibernate.c | 3 + arch/x86/kernel/alternative.c | 17 +- arch/x86/kvm/smm.c | 1 + arch/x86/kvm/svm/svm.c | 19 +- block/bio.c | 2 +- drivers/acpi/pptt.c | 11 +- drivers/bluetooth/btnxpuart.c | 6 +- drivers/char/tpm/tpm_tis_core.h | 2 +- drivers/dma-buf/dma-resv.c | 5 +- drivers/dma/dmatest.c | 6 +- drivers/dma/idxd/init.c | 159 ++++++++---- drivers/dma/ti/k3-udma.c | 10 +- drivers/firmware/arm_scmi/Kconfig | 14 + drivers/firmware/arm_scmi/common.h | 35 +++ drivers/firmware/arm_scmi/driver.c | 89 ++++++- drivers/firmware/arm_scmi/mailbox.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 51 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 29 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 3 + drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c | 2 + drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c | 2 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 16 +- drivers/hid/hid-thrustmaster.c | 1 + drivers/hid/hid-uclogic-core.c | 7 +- drivers/hv/channel.c | 65 +---- drivers/iio/adc/ad7266.c | 2 +- drivers/iio/adc/ad7768-1.c | 2 +- drivers/iio/chemical/sps30.c | 2 +- drivers/infiniband/sw/rxe/rxe_cq.c | 5 +- drivers/net/dsa/sja1105/sja1105_main.c | 6 +- drivers/net/ethernet/cadence/macb_main.c | 19 +- drivers/net/ethernet/engleder/tsnep_hw.h | 2 + drivers/net/ethernet/engleder/tsnep_main.c | 131 +++++++--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 + .../ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 3 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 + drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- .../ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 7 +- drivers/net/hyperv/hyperv_net.h | 13 +- drivers/net/hyperv/netvsc.c | 57 ++++- drivers/net/hyperv/netvsc_drv.c | 62 +---- drivers/net/hyperv/rndis_filter.c | 24 +- drivers/net/wireless/mediatek/mt76/dma.c | 1 + drivers/nvme/host/pci.c | 4 +- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 38 ++- drivers/phy/tegra/xusb-tegra186.c | 46 ++-- drivers/phy/tegra/xusb.c | 8 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 + drivers/platform/x86/asus-wmi.c | 3 +- drivers/regulator/max20086-regulator.c | 7 +- drivers/scsi/sd_zbc.c | 6 +- drivers/scsi/storvsc_drv.c | 1 + drivers/spi/spi-loopback-test.c | 2 +- drivers/spi/spi-tegra114.c | 6 +- drivers/usb/gadget/function/f_midi2.c | 2 +- drivers/usb/typec/ucsi/displayport.c | 19 +- drivers/usb/typec/ucsi/ucsi.c | 34 +++ drivers/usb/typec/ucsi/ucsi.h | 2 + fs/binfmt_elf.c | 281 ++++++++++++--------- fs/btrfs/extent-tree.c | 25 +- fs/nfs/nfs4proc.c | 9 +- fs/nfs/pnfs.c | 9 + fs/smb/client/smb2pdu.c | 2 +- fs/udf/truncate.c | 2 +- fs/xattr.c | 24 ++ include/linux/bio.h | 1 + include/linux/hyperv.h | 7 - include/linux/tpm.h | 2 +- include/net/sch_generic.h | 15 ++ include/sound/ump_msg.h | 4 +- kernel/cgroup/cpuset.c | 6 +- kernel/trace/trace_dynevent.c | 16 +- kernel/trace/trace_dynevent.h | 1 + kernel/trace/trace_events_trigger.c | 2 +- kernel/trace/trace_functions.c | 6 +- kernel/trace/trace_kprobe.c | 2 +- kernel/trace/trace_probe.c | 9 + kernel/trace/trace_uprobe.c | 2 +- mm/memblock.c | 9 +- mm/memory_hotplug.c | 6 +- mm/migrate.c | 16 +- mm/page_alloc.c | 27 -- net/bluetooth/mgmt.c | 9 +- net/mac80211/main.c | 6 +- net/mctp/device.c | 65 +++-- net/mctp/route.c | 4 +- net/sched/sch_codel.c | 2 +- net/sched/sch_fq.c | 2 +- net/sched/sch_fq_codel.c | 2 +- net/sched/sch_fq_pie.c | 2 +- net/sched/sch_hhf.c | 2 +- net/sched/sch_pie.c | 2 +- net/sctp/sysctl.c | 4 + net/tls/tls_strp.c | 3 +- samples/ftrace/sample-trace-array.c | 2 +- sound/core/seq/seq_clientmgr.c | 52 ++-- sound/core/seq/seq_ump_convert.c | 18 ++ sound/core/seq/seq_ump_convert.h | 1 + sound/pci/es1968.c | 6 +- sound/sh/Kconfig | 2 +- sound/usb/quirks.c | 4 + tools/net/ynl/ethtool.py | 29 ++- tools/testing/selftests/exec/Makefile | 19 +- tools/testing/selftests/exec/load_address.c | 83 ++++-- tools/testing/selftests/mm/compaction_test.c | 19 +- 118 files changed, 1294 insertions(+), 693 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/117 fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
[ Upstream commit 8b0ba61df5a1c44e2b3cf683831a4fc5e24ea99d ]
The vfs has long had a fallback to obtain the security.* xattrs from the LSM when the filesystem does not implement its own listxattr, but shmem/tmpfs and kernfs later gained their own xattr handlers to support other xattrs. Unfortunately, as a side effect, tmpfs and kernfs-based filesystems like sysfs no longer return the synthetic security.* xattr names via listxattr unless they are explicitly set by userspace or initially set upon inode creation after policy load. coreutils has recently switched from unconditionally invoking getxattr for security.* for ls -Z via libselinux to only doing so if listxattr returns the xattr name, breaking ls -Z of such inodes.
Before:
$ getfattr -m.* /run/initramfs <no output> $ getfattr -m.* /sys/kernel/fscaps <no output> $ setfattr -n user.foo /run/initramfs $ getfattr -m.* /run/initramfs user.foo
After:
$ getfattr -m.* /run/initramfs security.selinux $ getfattr -m.* /sys/kernel/fscaps security.selinux $ setfattr -n user.foo /run/initramfs $ getfattr -m.* /run/initramfs security.selinux user.foo
--- fs/xattr.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
fs/xattr.c +24 -0
@@ -1291,6 +1291,15 @@ static bool xattr_is_trusted(const char *name)return !strncmp (name,XATTR_TRUSTED_PREFIX ,XATTR_TRUSTED_PREFIX_LEN ); } +static bool xattr_is_maclabel (const char *name) +{ +const char *suffix = name +XATTR_SECURITY_PREFIX_LEN ; + +return !strncmp (name,XATTR_SECURITY_PREFIX , +XATTR_SECURITY_PREFIX_LEN ) && +security_ismaclabel (suffix); +} +/** * simple_xattr_list - list all xattr objects * @inode: inode from which to get the xattrs
@@ -1323,6 +1332,17 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,if (err)return err; + err =security_inode_listsecurity (inode, buffer, remaining_size); +if (err <0 ) +return err; + +if (buffer) { +if (remaining_size < err) +return -ERANGE ; + buffer += err; + } + remaining_size -= err; +read_lock (&xattrs->lock);for (rbp =rb_first (&xattrs->rb_root); rbp; rbp =rb_next (rbp)) { xattr = rb_entry(rbp, struct simple_xattr, rb_node);
@@ -1331,6 +1351,10 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,if (!trusted &&xattr_is_trusted (xattr->name))continue ; +/* skip MAC labels; these are provided by LSM above */ +if (xattr_is_maclabel (xattr->name)) +continue ; + err =xattr_list_one (&buffer, &remaining_size, xattr->name);if (err)break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/117 binfmt_elf: Support segments with 0 filesz and misaligned starts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
[ Upstream commit 585a018627b4d7ed37387211f667916840b5c5ea ]
Implement a helper elf_load() that wraps elf_map() and performs all of the necessary work to ensure that when "memsz > filesz" the bytes described by "memsz > filesz" are zeroed.
An outstanding issue is if the first segment has filesz 0, and has a randomized location. But that is the same as today.
In this change I replaced an open coded padzero() that did not clear all of the way to the end of the page, with padzero() that does.
I also stopped checking the return of padzero() as there is at least one known case where testing for failure is the wrong thing to do. It looks like binfmt_elf_fdpic may have the proper set of tests for when error handling can be safely completed.
I found a couple of commits in the old history
https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git,
that look very interesting in understanding this code.
commit 39b56d902bf3 ("[PATCH] binfmt_elf: clearing bss may fail")
commit c6e2227e4a3e ("[SPARC64]: Missing user access return value checks in fs/binfmt_elf.c and fs/compat.c") commit 5bf3be033f50 ("v2.4.10.1 -> v2.4.10.2")
Looking at commit 39b56d902bf3 ("[PATCH] binfmt_elf: clearing bss may fail"):
Quoted 9 lines
commit
39b56d902bf35241e7cba6cc30b828ed937175ad
Author: Pavel Machek <[email protected]>
Date: Wed Feb 9 22:40:30 2005 -0800[PATCH]
binfmt_elf: clearing bss may failSo we discover that Borland's Kylix application builder emits weird elf files which describe a non-writeable bss segment.
Quoted 7 lines
So remove the
clear_user()check at the place where we zero out the bss. I don't _think_ there are any security implications here (plus we've never checked thatclear_user()return value, so whoops if it is a problem).Signed-off-by Pavel Machek <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>
It seems pretty clear that binfmt_elf_fdpic with skipping clear_user() for non-writable segments and otherwise calling clear_user(), aka padzero(), and checking it's return code is the right thing to do.
I just skipped the error checking as that avoids breaking things.
And notably, it looks like Borland's Kylix died in 2005 so it might be safe to just consider read-only segments with memsz > filesz an error.
Stable-dep-of: 11854fe263eb ("binfmt_elf: Move brk for static PIE even if ASLR disabled")
--- fs/binfmt_elf.c | 111 +++++++++++++++++++++--------------------------- 1 file changed, 48 insertions(+), 63 deletions(-)
fs/binfmt_elf.c +48 -63
@@ -110,25 +110,6 @@ static struct linux_binfmt elf_format = {#define BAD_ADDR (x) (unlikely((unsigned long)(x) >= TASK_SIZE)) -static int set_brk (unsigned long start,unsigned long end,int prot) -{ - start =ELF_PAGEALIGN (start); - end =ELF_PAGEALIGN (end); -if (end > start) { -/* -* Map the last of the bss segment. -* If the header is requesting these pages to be -* executable, honour that (ppc32 needs this). -*/ -int error =vm_brk_flags (start, end - start, - prot &PROT_EXEC ?VM_EXEC :0 ); -if (error) -return error; - } - current->mm->start_brk = current->mm->brk = end; -return 0 ; -} -/* We need to explicitly zero any fractional pages after the data section (i.e. bss). This would contain the junk from the file that should not
@@ -406,6 +387,51 @@ static unsigned long elf_map(struct file *filep, unsigned long addr,return (map_addr); } +static unsigned long elf_load (struct file *filep,unsigned long addr, +const struct elf_phdr *eppnt,int prot,int type, +unsigned long total_size) +{ +unsigned long zero_start, zero_end; +unsigned long map_addr; + +if (eppnt->p_filesz) { + map_addr =elf_map (filep, addr, eppnt, prot, type, total_size); +if (BAD_ADDR (map_addr)) +return map_addr; +if (eppnt->p_memsz > eppnt->p_filesz) { + zero_start = map_addr +ELF_PAGEOFFSET (eppnt->p_vaddr) + + eppnt->p_filesz; + zero_end = map_addr +ELF_PAGEOFFSET (eppnt->p_vaddr) + + eppnt->p_memsz; + +/* Zero the end of the last mapped page */ +padzero (zero_start); + } + }else { + map_addr = zero_start =ELF_PAGESTART (addr); + zero_end = zero_start +ELF_PAGEOFFSET (eppnt->p_vaddr) + + eppnt->p_memsz; + } +if (eppnt->p_memsz > eppnt->p_filesz) { +/* +* Map the last of the segment. +* If the header is requesting these pages to be +* executable, honour that (ppc32 needs this). +*/ +int error; + + zero_start =ELF_PAGEALIGN (zero_start); + zero_end =ELF_PAGEALIGN (zero_end); + + error =vm_brk_flags (zero_start, zero_end - zero_start, + prot &PROT_EXEC ?VM_EXEC :0 ); +if (error) + map_addr = error; + } +return map_addr; +} + +static unsigned long total_mapping_size (const struct elf_phdr *phdr,int nr) {elf_addr_t min_addr =-1 ;
@@ -829,7 +855,6 @@ static int load_elf_binary(struct linux_binprm *bprm)struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata =NULL ;struct elf_phdr *elf_property_phdata =NULL ;unsigned long elf_bss, elf_brk; -int bss_prot =0 ;int retval, i;unsigned long elf_entry;unsigned long e_entry;
@@ -1041,33 +1066,6 @@ static int load_elf_binary(struct linux_binprm *bprm)if (elf_ppnt->p_type !=PT_LOAD )continue ; -if (unlikely (elf_brk > elf_bss)) { -unsigned long nbyte; - -/* There was a PT_LOAD segment with p_memsz > p_filesz -before this one. Map anonymous pages, if needed, -and clear the area. */ - retval =set_brk (elf_bss + load_bias, - elf_brk + load_bias, - bss_prot); -if (retval) - goto out_free_dentry; - nbyte =ELF_PAGEOFFSET (elf_bss); -if (nbyte) { - nbyte =ELF_MIN_ALIGN - nbyte; -if (nbyte > elf_brk - elf_bss) - nbyte = elf_brk - elf_bss; -if (clear_user ((void __user *)elf_bss + - load_bias, nbyte)) { -/* -* This bss-zeroing can fail if the ELF -* file specifies odd protections. So -* we don't check the return value -*/ - } - } - } - elf_prot =make_prot (elf_ppnt->p_flags, &arch_state, !!interpreter, false);
@@ -1163,7 +1161,7 @@ static int load_elf_binary(struct linux_binprm *bprm) } } - error =elf_map (bprm->file, load_bias + vaddr, elf_ppnt, + error =elf_load (bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags, total_size);if (BAD_ADDR (error)) { retval = IS_ERR_VALUE(error) ?
@@ -1218,10 +1216,8 @@ static int load_elf_binary(struct linux_binprm *bprm)if (end_data < k) end_data = k; k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; -if (k > elf_brk) { - bss_prot = elf_prot; +if (k > elf_brk) elf_brk = k; - } } e_entry = elf_ex->e_entry + load_bias;
@@ -1233,18 +1229,7 @@ static int load_elf_binary(struct linux_binprm *bprm) start_data += load_bias; end_data += load_bias; -/* Calling set_brk effectively mmaps the pages that we need -* for the bss and break sections. We must do this before -* mapping in the interpreter, to make sure it doesn't wind -* up getting placed where the bss needs to go. -*/ - retval =set_brk (elf_bss, elf_brk, bss_prot); -if (retval) - goto out_free_dentry; -if (likely (elf_bss != elf_brk) &&unlikely (padzero (elf_bss))) { - retval = -EFAULT ;/* Nobody gets to see this, but.. */ - goto out_free_dentry; - } + current->mm->start_brk = current->mm->brk =ELF_PAGEALIGN (elf_brk);if (interpreter) { elf_entry = load_elf_interp(interp_elf_ex,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/117 binfmt_elf: elf_bss no longer used by load_elf_binary()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 8ed2ef21ff564cf4a25c098ace510ee6513c9836 ]
With the BSS handled generically via the new filesz/memsz mismatch handling logic in elf_load(), elf_bss no longer needs to be tracked. Drop the variable.
Stable-dep-of: 11854fe263eb ("binfmt_elf: Move brk for static PIE even if ASLR disabled")
--- fs/binfmt_elf.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
fs/binfmt_elf.c +1 -5
@@ -854,7 +854,7 @@ static int load_elf_binary(struct linux_binprm *bprm)unsigned long error;struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata =NULL ;struct elf_phdr *elf_property_phdata =NULL ; -unsigned long elf_bss, elf_brk; +unsigned long elf_brk;int retval, i;unsigned long elf_entry;unsigned long e_entry;
@@ -1046,7 +1046,6 @@ static int load_elf_binary(struct linux_binprm *bprm)if (retval <0 ) goto out_free_dentry; - elf_bss =0 ; elf_brk =0 ; start_code = ~0UL ;
@@ -1209,8 +1208,6 @@ static int load_elf_binary(struct linux_binprm *bprm) k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; -if (k > elf_bss) - elf_bss = k;if ((elf_ppnt->p_flags &PF_X ) && end_code < k) end_code = k;if (end_data < k)
@@ -1222,7 +1219,6 @@ static int load_elf_binary(struct linux_binprm *bprm) e_entry = elf_ex->e_entry + load_bias; phdr_addr += load_bias; - elf_bss += load_bias; elf_brk += load_bias; start_code += load_bias; end_code += load_bias;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/117 selftests/exec: load_address: conform test to TAP format output
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
[ Upstream commit c4095067736b7ed50316a2bc7c9577941e87ad45 ]
Conform the layout, informational and status messages to TAP. No functional change is intended other than the layout of output messages.
Stable-dep-of: 11854fe263eb ("binfmt_elf: Move brk for static PIE even if ASLR disabled")
--- tools/testing/selftests/exec/load_address.c | 34 +++++++++------------ 1 file changed, 15 insertions(+), 19 deletions(-)
tools/testing/selftests/exec/load_address.c +15 -19
@@ -5,6 +5,7 @@#include <link.h> #include <stdio.h> #include <stdlib.h> +#include "../kselftest.h" struct Statistics {unsigned long long load_address;
@@ -41,28 +42,23 @@ int main(int argc, char **argv)unsigned long long misalign;int ret; +ksft_print_header (); +ksft_set_plan (1 ); + ret =dl_iterate_phdr (ExtractStatistics, &extracted); -if (ret !=1 ) { -fprintf (stderr,"FAILED\n" ); -return 1 ; - } +if (ret !=1 ) +ksft_exit_fail_msg ("FAILED: dl_iterate_phdr\n" ); -if (extracted.alignment ==0 ) { -fprintf (stderr,"No alignment found\n" ); -return 1 ; - }else if (extracted.alignment & (extracted.alignment -1 )) { -fprintf (stderr,"Alignment is not a power of 2\n" ); -return 1 ; - } +if (extracted.alignment ==0 ) +ksft_exit_fail_msg ("FAILED: No alignment found\n" ); +else if (extracted.alignment & (extracted.alignment -1 )) +ksft_exit_fail_msg ("FAILED: Alignment is not a power of 2\n" ); misalign = extracted.load_address & (extracted.alignment -1 ); -if (misalign) { -printf ("alignment = %llu, load_address = %llu\n" , - extracted.alignment, extracted.load_address); -fprintf (stderr,"FAILED\n" ); -return 1 ; - } +if (misalign) +ksft_exit_fail_msg ("FAILED: alignment = %llu, load_address = %llu\n" , + extracted.alignment, extracted.load_address); -fprintf (stderr,"PASS\n" ); -return 0 ; +ksft_test_result_pass ("Completed\n" ); +ksft_finished (); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/117 binfmt_elf: Leave a gap between .bss and brk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 2a5eb9995528441447d33838727f6ec1caf08139 ]
Currently the brk starts its randomization immediately after .bss, which means there is a chance that when the random offset is 0, linear overflows from .bss can reach into the brk area. Leave at least a single page gap between .bss and brk (when it has not already been explicitly relocated into the mmap range).
Stable-dep-of: 11854fe263eb ("binfmt_elf: Move brk for static PIE even if ASLR disabled")
--- fs/binfmt_elf.c | 3 +++ 1 file changed, 3 insertions(+)
fs/binfmt_elf.c +3 -0
@@ -1293,6 +1293,9 @@ static int load_elf_binary(struct linux_binprm *bprm)if (IS_ENABLED (CONFIG_ARCH_HAS_ELF_RANDOMIZE ) && elf_ex->e_type ==ET_DYN && !interpreter) { mm->brk = mm->start_brk =ELF_ET_DYN_BASE ; + }else { +/* Otherwise leave a gap between .bss and brk. */ + mm->brk = mm->start_brk = mm->brk +PAGE_SIZE ; } mm->brk = mm->start_brk =arch_randomize_brk (mm);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/117 selftests/exec: Build both static and non-static load_address tests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit b57a2907c9d96c56494ef25f8ec821cd0b355dd6 ]
After commit 4d1cd3b2c5c1 ("tools/testing/selftests/exec: fix link error"), the load address alignment tests tried to build statically. This was silently ignored in some cases. However, after attempting to further fix the build by switching to "-static-pie", the test started failing. This appears to be due to non-PT_INTERP ET_DYN execs ("static PIE") not doing alignment correctly, which remains unfixed[1]. See commit aeb7923733d1 ("revert "fs/binfmt_elf: use PT_LOAD p_align values for static PIE"") for more details.
Provide rules to build both static and non-static PIE binaries, improve debug reporting, and perform several test steps instead of a single all-or-nothing test. However, do not actually enable static-pie tests; alignment specification is only supported for ET_DYN with PT_INTERP ("regular PIE").
Stable-dep-of: 11854fe263eb ("binfmt_elf: Move brk for static PIE even if ASLR disabled")
--- tools/testing/selftests/exec/Makefile | 19 +++--- tools/testing/selftests/exec/load_address.c | 67 +++++++++++++++++---- 2 files changed, 66 insertions(+), 20 deletions(-)
tools/testing/selftests/exec/Makefile +12 -7
@@ -3,8 +3,13 @@ CFLAGS = -Wall CFLAGS += -Wno-nonnull CFLAGS += -D_GNU_SOURCE +ALIGNS := 0x1000 0x200000 0x1000000 +ALIGN_PIES := $(patsubst %,load_address.%,$(ALIGNS)) +ALIGN_STATIC_PIES := $(patsubst %,load_address.static.%,$(ALIGNS)) +ALIGNMENT_TESTS := $(ALIGN_PIES) + TEST_PROGS := binfmt_script.py -TEST_GEN_PROGS := execveat load_address_4096 load_address_2097152 load_address_16777216 non-regular +TEST_GEN_PROGS := execveat non-regular $(ALIGNMENT_TESTS) TEST_GEN_FILES := execveat.symlink execveat.denatured script subdir # Makefile is a run-time dependency, since it's accessed by the execveat test TEST_FILES := Makefile
@@ -28,9 +33,9 @@ $(OUTPUT)/execveat.symlink: $(OUTPUT)/execveat $(OUTPUT)/execveat.denatured: $(OUTPUT)/execveat cp $< $@ chmod -x $@ -$(OUTPUT)/load_address_4096: load_address.c - $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000 -pie -static $< -o $@ -$(OUTPUT)/load_address_2097152: load_address.c - $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x200000 -pie -static $< -o $@ -$(OUTPUT)/load_address_16777216: load_address.c - $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000000 -pie -static $< -o $@ +$(OUTPUT)/load_address.0x%: load_address.c + $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=$(lastword $(subst ., ,$@)) \ + -fPIE -pie $< -o $@ +$(OUTPUT)/load_address.static.0x%: load_address.c + $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=$(lastword $(subst ., ,$@)) \ + -fPIE -static-pie $< -o $@
tools/testing/selftests/exec/load_address.c +54 -13
103 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/117 binfmt_elf: Calculate total_size earlier
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 2d4cf7b190bbfadd4986bf5c34da17c1a88adf8e ]
In preparation to support PT_LOAD with large p_align values on non-PT_INTERP ET_DYN executables (i.e. "static pie"), we'll need to use the total_size details earlier. Move this separately now to make the next patch more readable. As total_size and load_bias are currently calculated separately, this has no behavioral impact.
Stable-dep-of: 11854fe263eb ("binfmt_elf: Move brk for static PIE even if ASLR disabled")
--- fs/binfmt_elf.c | 52 +++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 25 deletions(-)
fs/binfmt_elf.c +27 -25
@@ -1092,7 +1092,34 @@ static int load_elf_binary(struct linux_binprm *bprm)* Header for ET_DYN binaries to calculate the * randomization (load_bias) for all the LOAD * Program Headers. +*/ + +/* +* Calculate the entire size of the ELF mapping +* (total_size), used for the initial mapping, +* due to load_addr_set which is set to true later +* once the initial mapping is performed. +* +* Note that this is only sensible when the LOAD +* segments are contiguous (or overlapping). If +* used for LOADs that are far apart, this would +* cause the holes between LOADs to be mapped, +* running the risk of having the mapping fail, +* as it would be larger than the ELF file itself. * +* As a result, only ET_DYN does this, since +* some ET_EXEC (e.g. ia64) may have large virtual +* memory holes between LOADs. +* +*/ + total_size =total_mapping_size (elf_phdata, + elf_ex->e_phnum); +if (!total_size) { + retval = -EINVAL ; + goto out_free_dentry; + } + +/* * There are effectively two types of ET_DYN * binaries: programs (i.e. PIE: ET_DYN with INTERP) * and loaders (ET_DYN without INTERP, since they
@@ -1133,31 +1160,6 @@ static int load_elf_binary(struct linux_binprm *bprm)* is then page aligned. */ load_bias =ELF_PAGESTART (load_bias - vaddr); - -/* -* Calculate the entire size of the ELF mapping -* (total_size), used for the initial mapping, -* due to load_addr_set which is set to true later -* once the initial mapping is performed. -* -* Note that this is only sensible when the LOAD -* segments are contiguous (or overlapping). If -* used for LOADs that are far apart, this would -* cause the holes between LOADs to be mapped, -* running the risk of having the mapping fail, -* as it would be larger than the ELF file itself. -* -* As a result, only ET_DYN does this, since -* some ET_EXEC (e.g. ia64) may have large virtual -* memory holes between LOADs. -* -*/ - total_size =total_mapping_size (elf_phdata, - elf_ex->e_phnum); -if (!total_size) { - retval = -EINVAL ; - goto out_free_dentry; - } } error = elf_load(bprm->file, load_bias + vaddr, elf_ppnt,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/117 binfmt_elf: Honor PT_LOAD alignment for static PIE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 3545deff0ec7a37de7ed9632e262598582b140e9 ]
The p_align values in PT_LOAD were ignored for static PIE executables (i.e. ET_DYN without PT_INTERP). This is because there is no way to request a non-fixed mmap region with a specific alignment. ET_DYN with PT_INTERP uses a separate base address (ELF_ET_DYN_BASE) and binfmt_elf performs the ASLR itself, which means it can also apply alignment. For the mmap region, the address selection happens deep within the vm_mmap() implementation (when the requested address is 0).
The earlier attempt to implement this:
commit 9630f0d60fec ("fs/binfmt_elf: use PT_LOAD p_align values for static PIE") commit 925346c129da ("fs/binfmt_elf: fix PT_LOAD p_align values for loaders")
did not take into account the different base address origins, and were eventually reverted:
aeb7923733d1 ("revert "fs/binfmt_elf: use PT_LOAD p_align values for static PIE"")
In order to get the correct alignment from an mmap base, binfmt_elf must perform a 0-address load first, then tear down the mapping and perform alignment on the resulting address. Since this is slightly more overhead, only do this when it is needed (i.e. the alignment is not the default ELF alignment). This does, however, have the benefit of being able to use MAP_FIXED_NOREPLACE, to avoid potential collisions.
With this fixed, enable the static PIE self tests again.
Stable-dep-of: 11854fe263eb ("binfmt_elf: Move brk for static PIE even if ASLR disabled")
--- fs/binfmt_elf.c | 42 +++++++++++++++++++++++---- tools/testing/selftests/exec/Makefile | 2 +- 2 files changed, 38 insertions(+), 6 deletions(-)
fs/binfmt_elf.c +37 -5
@@ -1119,10 +1119,13 @@ static int load_elf_binary(struct linux_binprm *bprm) goto out_free_dentry; } +/* Calculate any requested alignment. */ + alignment =maximum_alignment (elf_phdata, elf_ex->e_phnum); +/* * There are effectively two types of ET_DYN -* binaries: programs (i.e. PIE: ET_DYN with INTERP) -* and loaders (ET_DYN without INTERP, since they +* binaries: programs (i.e. PIE: ET_DYN with PT_INTERP) +* and loaders (ET_DYN without PT_INTERP, since they * _are_ the ELF interpreter). The loaders must * be loaded away from programs since the program * may otherwise collide with the loader (especially
@@ -1142,15 +1145,44 @@ static int load_elf_binary(struct linux_binprm *bprm)* without MAP_FIXED nor MAP_FIXED_NOREPLACE). */ if (interpreter) { +/* On ET_DYN with PT_INTERP, we do the ASLR. */ load_bias =ELF_ET_DYN_BASE ;if (current->flags &PF_RANDOMIZE ) load_bias +=arch_mmap_rnd (); - alignment =maximum_alignment (elf_phdata, elf_ex->e_phnum); +/* Adjust alignment as requested. */ if (alignment) load_bias &= ~(alignment -1 ); elf_flags |=MAP_FIXED_NOREPLACE ; - }else - load_bias =0 ; + }else { +/* +* For ET_DYN without PT_INTERP, we rely on +* the architectures's (potentially ASLR) mmap +* base address (via a load_bias of 0). +* +* When a large alignment is requested, we +* must do the allocation at address "0" right +* now to discover where things will load so +* that we can adjust the resulting alignment. +* In this case (load_bias != 0), we can use +* MAP_FIXED_NOREPLACE to make sure the mapping +* doesn't collide with anything. +*/ +if (alignment >ELF_MIN_ALIGN ) { + load_bias =elf_load (bprm->file,0 , elf_ppnt, + elf_prot, elf_flags, total_size); +if (BAD_ADDR (load_bias)) { + retval =IS_ERR_VALUE (load_bias) ? +PTR_ERR ((void *)load_bias) : -EINVAL ; + goto out_free_dentry; + } +vm_munmap (load_bias, total_size); +/* Adjust alignment as requested. */ +if (alignment) + load_bias &= ~(alignment -1 ); + elf_flags |=MAP_FIXED_NOREPLACE ; + }else + load_bias =0 ; + }/* * Since load_bias is used for all subsequent loading
tools/testing/selftests/exec/Makefile +1 -1
@@ -6,7 +6,7 @@ CFLAGS += -D_GNU_SOURCE ALIGNS := 0x1000 0x200000 0x1000000 ALIGN_PIES := $(patsubst %,load_address.%,$(ALIGNS)) ALIGN_STATIC_PIES := $(patsubst %,load_address.static.%,$(ALIGNS)) -ALIGNMENT_TESTS := $(ALIGN_PIES) +ALIGNMENT_TESTS := $(ALIGN_PIES) $(ALIGN_STATIC_PIES) TEST_PROGS := binfmt_script.py TEST_GEN_PROGS := execveat non-regular $(ALIGNMENT_TESTS)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/117 binfmt_elf: Move brk for static PIE even if ASLR disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 11854fe263eb1b9a8efa33b0c087add7719ea9b4 ]
In commit bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing direct loader exec"), the brk was moved out of the mmap region when loading static PIE binaries (ET_DYN without INTERP). The common case for these binaries was testing new ELF loaders, so the brk needed to be away from mmap to avoid colliding with stack, future mmaps (of the loader-loaded binary), etc. But this was only done when ASLR was enabled, in an attempt to minimize changes to memory layouts.
After adding support to respect alignment requirements for static PIE binaries in commit 3545deff0ec7 ("binfmt_elf: Honor PT_LOAD alignment for static PIE"), it became possible to have a large gap after the final PT_LOAD segment and the top of the mmap region. This means that future mmap allocations might go after the last PT_LOAD segment (where brk might be if ASLR was disabled) instead of before them (where they traditionally ended up).
On arm64, running with ASLR disabled, Ubuntu 22.04's "ldconfig" binary, a static PIE, has alignment requirements that leaves a gap large enough after the last PT_LOAD segment to fit the vdso and vvar, but still leave enough space for the brk (which immediately follows the last PT_LOAD segment) to be allocated by the binary.
fffff7f20000-fffff7fde000 r-xp 00000000 fe:02 8110426 /sbin/ldconfig.real fffff7fee000-fffff7ff5000 rw-p 000be000 fe:02 8110426 /sbin/ldconfig.real fffff7ff5000-fffff7ffa000 rw-p 00000000 00:00 0
***[brk will go here at fffff7ffa000]***
fffff7ffc000-fffff7ffe000 r--p 00000000 00:00 0 [vvar] fffff7ffe000-fffff8000000 r-xp 00000000 00:00 0 [vdso] fffffffdf000-1000000000000 rw-p 00000000 00:00 0 [stack]
After commit 0b3bc3354eb9 ("arm64: vdso: Switch to generic storage implementation"), the arm64 vvar grew slightly, and suddenly the brk collided with the allocation.
fffff7f20000-fffff7fde000 r-xp 00000000 fe:02 8110426 /sbin/ldconfig.real fffff7fee000-fffff7ff5000 rw-p 000be000 fe:02 8110426 /sbin/ldconfig.real fffff7ff5000-fffff7ffa000 rw-p 00000000 00:00 0
***[oops, no room any more, vvar is at fffff7ffa000!]***
fffff7ffa000-fffff7ffe000 r--p 00000000 00:00 0 [vvar] fffff7ffe000-fffff8000000 r-xp 00000000 00:00 0 [vdso] fffffffdf000-1000000000000 rw-p 00000000 00:00 0 [stack]
The solution is to unconditionally move the brk out of the mmap region for static PIE binaries. Whether ASLR is enabled or not does not change if there may be future mmap allocation collisions with a growing brk region.
Update memory layout comments (with kernel-doc headings), consolidate the setting of mm->brk to later (it isn't needed early), move static PIE brk out of mmap unconditionally, and make sure brk(2) knows to base brk position off of mm->start_brk not mm->end_data no matter what the cause of moving it is (via current->brk_randomized).
For the CONFIG_COMPAT_BRK case, though, leave the logic unchanged, as we can never safely move the brk. These systems, however, are not using specially aligned static PIE binaries.
--- fs/binfmt_elf.c | 71 ++++++++++++++++++++++++++++++++----------------- 1 file changed, 47 insertions(+), 24 deletions(-)
fs/binfmt_elf.c +47 -24
@@ -855,6 +855,7 @@ static int load_elf_binary(struct linux_binprm *bprm)struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata =NULL ;struct elf_phdr *elf_property_phdata =NULL ;unsigned long elf_brk; +bool brk_moved = false;int retval, i;unsigned long elf_entry;unsigned long e_entry;
@@ -1122,15 +1123,19 @@ static int load_elf_binary(struct linux_binprm *bprm)/* Calculate any requested alignment. */ alignment =maximum_alignment (elf_phdata, elf_ex->e_phnum); -/* -* There are effectively two types of ET_DYN -* binaries: programs (i.e. PIE: ET_DYN with PT_INTERP) -* and loaders (ET_DYN without PT_INTERP, since they -* _are_ the ELF interpreter). The loaders must -* be loaded away from programs since the program -* may otherwise collide with the loader (especially -* for ET_EXEC which does not have a randomized -* position). For example to handle invocations of +/** +* DOC: PIE handling +* +* There are effectively two types of ET_DYN ELF +* binaries: programs (i.e. PIE: ET_DYN with +* PT_INTERP) and loaders (i.e. static PIE: ET_DYN +* without PT_INTERP, usually the ELF interpreter +* itself). Loaders must be loaded away from programs +* since the program may otherwise collide with the +* loader (especially for ET_EXEC which does not have +* a randomized position). +* +* For example, to handle invocations of * "./ld.so someprog" to test out a new version of * the loader, the subsequent program that the * loader loads must avoid the loader itself, so
@@ -1143,6 +1148,9 @@ static int load_elf_binary(struct linux_binprm *bprm)* ELF_ET_DYN_BASE and loaders are loaded into the * independently randomized mmap region (0 load_bias * without MAP_FIXED nor MAP_FIXED_NOREPLACE). +* +* See below for "brk" handling details, which is +* also affected by program vs loader and ASLR. */ if (interpreter) {/* On ET_DYN with PT_INTERP, we do the ASLR. */
@@ -1259,8 +1267,6 @@ static int load_elf_binary(struct linux_binprm *bprm) start_data += load_bias; end_data += load_bias; - current->mm->start_brk = current->mm->brk =ELF_PAGEALIGN (elf_brk); -if (interpreter) { elf_entry = load_elf_interp(interp_elf_ex, interpreter,
@@ -1316,27 +1322,44 @@ static int load_elf_binary(struct linux_binprm *bprm) mm->end_data = end_data; mm->start_stack = bprm->p; -if ((current->flags &PF_RANDOMIZE ) && (snapshot_randomize_va_space >1 )) { +/** +* DOC: "brk" handling +* +* For architectures with ELF randomization, when executing a +* loader directly (i.e. static PIE: ET_DYN without PT_INTERP), +* move the brk area out of the mmap region and into the unused +* ELF_ET_DYN_BASE region. Since "brk" grows up it may collide +* early with the stack growing down or other regions being put +* into the mmap region by the kernel (e.g. vdso). +* +* In the CONFIG_COMPAT_BRK case, though, everything is turned +* off because we're not allowed to move the brk at all. +*/ +if (!IS_ENABLED (CONFIG_COMPAT_BRK ) && +IS_ENABLED (CONFIG_ARCH_HAS_ELF_RANDOMIZE ) && + elf_ex->e_type ==ET_DYN && !interpreter) { + elf_brk =ELF_ET_DYN_BASE ; +/* This counts as moving the brk, so let brk(2) know. */ + brk_moved = true; + } + mm->start_brk = mm->brk =ELF_PAGEALIGN (elf_brk); + +if ((current->flags &PF_RANDOMIZE ) && snapshot_randomize_va_space >1 ) {/* -* For architectures with ELF randomization, when executing -* a loader directly (i.e. no interpreter listed in ELF -* headers), move the brk area out of the mmap region -* (since it grows up, and may collide early with the stack -* growing down), and into the unused ELF_ET_DYN_BASE region. +* If we didn't move the brk to ELF_ET_DYN_BASE (above), +* leave a gap between .bss and brk. */ -if (IS_ENABLED (CONFIG_ARCH_HAS_ELF_RANDOMIZE ) && - elf_ex->e_type ==ET_DYN && !interpreter) { - mm->brk = mm->start_brk =ELF_ET_DYN_BASE ; - }else { -/* Otherwise leave a gap between .bss and brk. */ +if (!brk_moved) mm->brk = mm->start_brk = mm->brk +PAGE_SIZE ; - } mm->brk = mm->start_brk =arch_randomize_brk (mm); + brk_moved = true; + } +#ifdef compat_brk_randomized +if (brk_moved) current->brk_randomized =1 ;#endif - }if (current->personality &MMAP_PAGE_ZERO ) {/* Why this, you ask??? Well SVr4 maps page 0 as read-only,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/117 platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runhua He <[email protected]>
[ Upstream commit 0887817e4953885fbd6a5c1bec2fdd339261eb19 ]
MECHREVO Wujie 14XA (GX4HRXL) wakes up immediately after s2idle entry. This happens regardless of whether the laptop is plugged into AC power, or whether any peripheral is plugged into the laptop.
Similar to commit a55bdad5dfd1 ("platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13"), the MECHREVO Wujie 14XA wakes up almost instantly after s2idle suspend entry (IRQ1 is the keyboard):
2025-04-18 17:23:57,588 DEBUG: PM: Triggering wakeup from IRQ 9 2025-04-18 17:23:57,588 DEBUG: PM: Triggering wakeup from IRQ 1
Add this model to the spurious_8042 quirk to workaround this.
This patch does not affect the wake-up function of the built-in keyboard. Because the firmware of this machine adds an insurance for keyboard wake-up events, as it always triggers an additional IRQ 9 to wake up the system.
--- drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/platform/x86/amd/pmc/pmc-quirks.c +7 -0
@@ -217,6 +217,13 @@ static const struct dmi_system_id fwbug_list[] = { DMI_MATCH(DMI_BIOS_VERSION, "03.05"), } }, + { + .ident = "MECHREVO Wujie 14X (GX4HRXL)", + .driver_data = &quirk_spurious_8042, + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"), + } + }, {} };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/117 platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit bfcfe6d335a967f8ea0c1980960e6f0205b5de6e ]
The wlan_ctrl_by_user detection was introduced by commit a50bd128f28c ("asus-wmi: record wlan status while controlled by userapp").
Quoting from that commit's commit message:
"""
When you call WMIMethod(DSTS, 0x00010011) to get WLAN status, it may return
(1) 0x00050001 (On)
(2) 0x00050000 (Off)
(3) 0x00030001 (On)
(4) 0x00030000 (Off)
(5) 0x00000002 (Unknown)
(1), (2) means that the model has hardware GPIO for WLAN, you can call WMIMethod(DEVS, 0x00010011, 1 or 0) to turn WLAN on/off.
(3), (4) means that the model doesn’t have hardware GPIO, you need to use API or driver library to turn WLAN on/off, and call WMIMethod(DEVS, 0x00010012, 1 or 0) to set WLAN LED status. After you set WLAN LED status, you can see the WLAN status is changed with WMIMethod(DSTS, 0x00010011). Because the status is recorded lastly (ex: Windows), you can use it for synchronization.
(5) means that the model doesn’t have WLAN device.
WLAN is the ONLY special case with upper rule.
"""
The wlan_ctrl_by_user flag should be set on 0x0003000? ((3), (4) above) return values, but the flag mistakenly also gets set on laptops with 0x0005000? ((1), (2)) return values. This is causing rfkill problems on laptops where 0x0005000? is returned.
Fix the check to only set the wlan_ctrl_by_user flag for 0x0003000? return values.
--- drivers/platform/x86/asus-wmi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/platform/x86/asus-wmi.c +2 -1
@@ -4404,7 +4404,8 @@ static int asus_wmi_add(struct platform_device *pdev) goto fail_leds;asus_wmi_get_devstate (asus,ASUS_WMI_DEVID_WLAN , &result); -if (result & (ASUS_WMI_DSTS_PRESENCE_BIT |ASUS_WMI_DSTS_USER_BIT )) +if ((result & (ASUS_WMI_DSTS_PRESENCE_BIT |ASUS_WMI_DSTS_USER_BIT )) == + (ASUS_WMI_DSTS_PRESENCE_BIT |ASUS_WMI_DSTS_USER_BIT )) asus->driver->wlan_ctrl_by_user =1 ;if (!(asus->driver->wlan_ctrl_by_user &&ashs_present ())) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/117 cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
[ Upstream commit 39b5ef791d109dd54c7c2e6e87933edfcc0ad1ac ]
Commit ec5fbdfb99d1 ("cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset") enabled us to pull CPUs dedicated to child partitions from tasks in top_cpuset by ignoring per cpu kthreads. However, there can be other kthreads that are not per cpu but have PF_NO_SETAFFINITY flag set to indicate that we shouldn't mess with their CPU affinity. For other kthreads, their affinity will be changed to skip CPUs dedicated to child partitions whether it is an isolating or a scheduling one.
As all the per cpu kthreads have PF_NO_SETAFFINITY set, the PF_NO_SETAFFINITY tasks are essentially a superset of per cpu kthreads. Fix this issue by dropping the kthread_is_per_cpu() check and checking the PF_NO_SETAFFINITY flag instead.
--- kernel/cgroup/cpuset.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/cgroup/cpuset.c +4 -2
@@ -1229,9 +1229,11 @@ static void update_tasks_cpumask(struct cpuset *cs, struct cpumask *new_cpus)if (top_cs) {/* -* Percpu kthreads in top_cpuset are ignored +* PF_NO_SETAFFINITY tasks are ignored. +* All per cpu kthreads should have PF_NO_SETAFFINITY +* flag set, see kthread_set_per_cpu(). */ -if (kthread_is_per_cpu (task)) +if (task->flags &PF_NO_SETAFFINITY )continue ;cpumask_andnot (new_cpus, possible_mask, cs->subparts_cpus); }else {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/117 tracing: probes: Fix a possible race in trace_probe_log APIs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit fd837de3c9cb1a162c69bc1fb1f438467fe7f2f5 ]
Since the shared trace_probe_log variable can be accessed and modified via probe event create operation of kprobe_events, uprobe_events, and dynamic_events, it should be protected. In the dynamic_events, all operations are serialized by dyn_event_ops_mutex. But kprobe_events and uprobe_events interfaces are not serialized.
To solve this issue, introduces dyn_event_create(), which runs create() operation under the mutex, for kprobe_events and uprobe_events. This also uses lockdep to check the mutex is held when using trace_probe_log* APIs.
--- kernel/trace/trace_dynevent.c | 16 +++++++++++++++- kernel/trace/trace_dynevent.h | 1 + kernel/trace/trace_kprobe.c | 2 +- kernel/trace/trace_probe.c | 9 +++++++++ kernel/trace/trace_uprobe.c | 2 +- 5 files changed, 27 insertions(+), 3 deletions(-)
kernel/trace/trace_dynevent.c +15 -1
@@ -16,7 +16,7 @@#include "trace_output.h" /* for trace_event_sem */ #include "trace_dynevent.h" -static DEFINE_MUTEX (dyn_event_ops_mutex); +DEFINE_MUTEX (dyn_event_ops_mutex);static LIST_HEAD (dyn_event_ops_list);bool trace_event_dyn_try_get_ref (struct trace_event_call *dyn_call)
@@ -125,6 +125,20 @@ int dyn_event_release(const char *raw_command, struct dyn_event_operations *typereturn ret; } +/* +* Locked version of event creation. The event creation must be protected by +* dyn_event_ops_mutex because of protecting trace_probe_log. +*/ +int dyn_event_create (const char *raw_command,struct dyn_event_operations *type) +{ +int ret; + +mutex_lock (&dyn_event_ops_mutex); + ret = type->create (raw_command); +mutex_unlock (&dyn_event_ops_mutex); +return ret; +} +static int create_dyn_event (const char *raw_command) {struct dyn_event_operations *ops;
kernel/trace/trace_dynevent.h +1 -0
@@ -100,6 +100,7 @@ void *dyn_event_seq_next(struct seq_file *m, void *v, loff_t *pos);void dyn_event_seq_stop (struct seq_file *m,void *v);int dyn_events_release_all (struct dyn_event_operations *type);int dyn_event_release (const char *raw_command,struct dyn_event_operations *type); +int dyn_event_create (const char *raw_command,struct dyn_event_operations *type);/* * for_each_dyn_event - iterate over the dyn_event list
kernel/trace/trace_kprobe.c +1 -1
@@ -1004,7 +1004,7 @@ static int create_or_delete_trace_kprobe(const char *raw_command)if (raw_command[0 ] =='-' )return dyn_event_release (raw_command, &trace_kprobe_ops); - ret =trace_kprobe_create (raw_command); + ret =dyn_event_create (raw_command, &trace_kprobe_ops);return ret == -ECANCELED ? -EINVAL : ret; }
kernel/trace/trace_probe.c +9 -0
@@ -153,9 +153,12 @@ static const struct fetch_type *find_fetch_type(const char *type, unsigned long }static struct trace_probe_log trace_probe_log; +extern struct mutex dyn_event_ops_mutex;void trace_probe_log_init (const char *subsystem,int argc,const char **argv) { +lockdep_assert_held (&dyn_event_ops_mutex); + trace_probe_log.subsystem = subsystem; trace_probe_log.argc = argc; trace_probe_log.argv = argv;
@@ -164,11 +167,15 @@ void trace_probe_log_init(const char *subsystem, int argc, const char **argv)void trace_probe_log_clear (void ) { +lockdep_assert_held (&dyn_event_ops_mutex); +memset (&trace_probe_log,0 ,sizeof (trace_probe_log)); }void trace_probe_log_set_index (int index) { +lockdep_assert_held (&dyn_event_ops_mutex); + trace_probe_log.index = index; }
@@ -177,6 +184,8 @@ void __trace_probe_log_err(int offset, int err_type)char *command, *p;int i, len =0 , pos =0 ; +lockdep_assert_held (&dyn_event_ops_mutex); +if (!trace_probe_log.argv)return ;
kernel/trace/trace_uprobe.c +1 -1
@@ -730,7 +730,7 @@ static int create_or_delete_trace_uprobe(const char *raw_command)if (raw_command[0 ] =='-' )return dyn_event_release (raw_command, &trace_uprobe_ops); - ret =trace_uprobe_create (raw_command); + ret =dyn_event_create (raw_command, &trace_uprobe_ops);return ret == -ECANCELED ? -EINVAL : ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/117 tpm: tis: Double the timeout B to 4s
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Suchanek <[email protected]>
[ Upstream commit 2f661f71fda1fc0c42b7746ca5b7da529eb6b5be ]
With some Infineon chips the timeouts in tpm_tis_send_data (both B and
C) can reach up to about 2250 ms.
Timeout C is retried since
commit de9e33df7762 ("tpm, tpm_tis: Workaround failed command reception on Infineon devices")
Timeout B still needs to be extended.
The problem is most commonly encountered with context related operation such as load context/save context. These are issued directly by the kernel, and there is no retry logic for them.
When a filesystem is set up to use the TPM for unlocking the boot fails, and restarting the userspace service is ineffective. This is likely because ignoring a load context/save context result puts the real TPM state and the TPM state expected by the kernel out of sync.
Chips known to be affected:tpm_tis IFX1522:00: 2.0 TPM (device-id 0x1D, rev-id 54)
Description: SLB9672
Firmware Revision: 15.22
tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1B, rev-id 22) Firmware Revision: 7.83
tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1A, rev-id 16) Firmware Revision: 5.63
--- drivers/char/tpm/tpm_tis_core.h | 2 +- include/linux/tpm.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.h +1 -1
@@ -54,7 +54,7 @@ enum tis_int_flags {enum tis_defaults {TIS_MEM_LEN =0x5000 ,TIS_SHORT_TIMEOUT =750 ,/* ms */ -TIS_LONG_TIMEOUT =2000 ,/* 2 sec */ +TIS_LONG_TIMEOUT =4000 ,/* 4 secs */ TIS_TIMEOUT_MIN_ATML =14700 ,/* usecs */ TIS_TIMEOUT_MAX_ATML =15000 ,/* usecs */ };
include/linux/tpm.h +1 -1
@@ -181,7 +181,7 @@ enum tpm2_const {enum tpm2_timeouts {TPM2_TIMEOUT_A =750 , -TPM2_TIMEOUT_B =2000 , +TPM2_TIMEOUT_B =4000 ,TPM2_TIMEOUT_C =200 ,TPM2_TIMEOUT_D =30 ,TPM2_DURATION_SHORT =20 ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/117 firmware: arm_scmi: Add helper to trace bad messages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit 5dc0e0b1f0ea2b55031f84a365962b9b45869b98 ]
Upon reception of malformed and unexpected timed-out SCMI messages, it is not possible to trace those bad messages in their entirety, because usually we cannot even retrieve the payload, or it is just not reliable.
Add a helper to trace at least the content of the header of the received message while associating a meaningful tag and error code.
Stable-dep-of: c23c03bf1faa ("firmware: arm_scmi: Fix timeout checks on polling path")
--- drivers/firmware/arm_scmi/common.h | 11 +++++++++ drivers/firmware/arm_scmi/driver.c | 39 ++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+)
drivers/firmware/arm_scmi/common.h +11 -0
@@ -303,6 +303,17 @@ extern const struct scmi_desc scmi_optee_desc;void scmi_rx_callback (struct scmi_chan_info *cinfo,u32 msg_hdr,void *priv); +enum scmi_bad_msg { +MSG_UNEXPECTED =-1 , +MSG_INVALID =-2 , +MSG_UNKNOWN =-3 , +MSG_NOMEM =-4 , +MSG_MBOX_SPURIOUS =-5 , +}; + +void scmi_bad_message_trace (struct scmi_chan_info *cinfo,u32 msg_hdr, +enum scmi_bad_msg err); +/* shmem related declarations */ struct scmi_shared_mem ;
drivers/firmware/arm_scmi/driver.c +39 -0
@@ -687,6 +687,45 @@ scmi_xfer_lookup_unlocked(struct scmi_xfers_info *minfo, u16 xfer_id)return xfer ?:ERR_PTR (-EINVAL ); } +/** +* scmi_bad_message_trace - A helper to trace weird messages +* +* @cinfo: A reference to the channel descriptor on which the message was +* received +* @msg_hdr: Message header to track +* @err: A specific error code used as a status value in traces. +* +* This helper can be used to trace any kind of weird, incomplete, unexpected, +* timed-out message that arrives and as such, can be traced only referring to +* the header content, since the payload is missing/unreliable. +*/ +void scmi_bad_message_trace (struct scmi_chan_info *cinfo,u32 msg_hdr, +enum scmi_bad_msg err) +{ +char *tag; +struct scmi_info *info =handle_to_scmi_info (cinfo->handle); + +switch (MSG_XTRACT_TYPE (msg_hdr)) { +case MSG_TYPE_COMMAND : + tag ="!RESP" ; +break ; +case MSG_TYPE_DELAYED_RESP : + tag ="!DLYD" ; +break ; +case MSG_TYPE_NOTIFICATION : + tag ="!NOTI" ; +break ; +default : + tag ="!UNKN" ; +break ; + } + +trace_scmi_msg_dump (info->id, cinfo->id, +MSG_XTRACT_PROT_ID (msg_hdr), +MSG_XTRACT_ID (msg_hdr), tag, +MSG_XTRACT_TOKEN (msg_hdr), err,NULL ,0 ); +} +/** * scmi_msg_response_validate - Validate message type against state of related * xfer
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/117 firmware: arm_scmi: Add message dump traces for bad and unexpected replies
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit 5076ab66db1671a5cd9ecfb857d1949e36a33142 ]
It is useful to have message dump traces for any invalid/bad/unexpected replies. Let us add traces for the same as well as late-timed-out, out-of-order and unexpected/spurious messages.
Stable-dep-of: c23c03bf1faa ("firmware: arm_scmi: Fix timeout checks on polling path")
--- drivers/firmware/arm_scmi/driver.c | 10 ++++++++++ drivers/firmware/arm_scmi/mailbox.c | 3 +++ 2 files changed, 13 insertions(+)
drivers/firmware/arm_scmi/driver.c +10 -0
@@ -852,6 +852,9 @@ scmi_xfer_command_acquire(struct scmi_chan_info *cinfo, u32 msg_hdr)"Message for %d type %d is not expected!\n" , xfer_id, msg_type);spin_unlock_irqrestore (&minfo->xfer_lock, flags); + +scmi_bad_message_trace (cinfo, msg_hdr,MSG_UNEXPECTED ); +return xfer; }refcount_inc (&xfer->users);
@@ -876,6 +879,9 @@ scmi_xfer_command_acquire(struct scmi_chan_info *cinfo, u32 msg_hdr)dev_err (cinfo->dev,"Invalid message type:%d for %d - HDR:0x%X state:%d\n" , msg_type, xfer_id, msg_hdr, xfer->state); + +scmi_bad_message_trace (cinfo, msg_hdr,MSG_INVALID ); +/* On error the refcount incremented above has to be dropped */ __scmi_xfer_put (minfo, xfer); xfer =ERR_PTR (-EINVAL );
@@ -917,6 +923,9 @@ static void scmi_handle_notification(struct scmi_chan_info *cinfo,if (IS_ERR (xfer)) {dev_err (dev,"failed to get free message slot (%ld)\n" ,PTR_ERR (xfer)); + +scmi_bad_message_trace (cinfo, msg_hdr,MSG_NOMEM ); +scmi_clear_channel (info, cinfo);return ; }
@@ -1036,6 +1045,7 @@ void scmi_rx_callback(struct scmi_chan_info *cinfo, u32 msg_hdr, void *priv)break ;default :WARN_ONCE (1 ,"received unknown msg_type:%d\n" , msg_type); +scmi_bad_message_trace (cinfo, msg_hdr,MSG_UNKNOWN );break ; } }
drivers/firmware/arm_scmi/mailbox.c +3 -0
@@ -58,6 +58,9 @@ static void rx_callback(struct mbox_client *cl, void *m)*/ if (cl->knows_txdone && !shmem_channel_free (smbox->shmem)) {dev_warn (smbox->cinfo->dev,"Ignoring spurious A2P IRQ !\n" ); +scmi_bad_message_trace (smbox->cinfo, +shmem_read_header (smbox->shmem), +MSG_MBOX_SPURIOUS );return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/117 firmware: arm_scmi: Add support for debug metrics at the interface
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke Parkin <[email protected]>
[ Upstream commit 1b18d4295f9d1125bc7a799fc12924cd45fc04b1 ]
Since SCMI involves interaction with the entity(software, firmware and/or hardware) providing services or features, it is quite useful to track certain metrics(for pure debugging purposes) like how many messages were sent or received, were there any failures, what kind of failures, ..etc.
Add a new optional config option for the above purpose and the initial support for counting such key debug metrics.
Message-Id: <[email protected]>
Stable-dep-of: c23c03bf1faa ("firmware: arm_scmi: Fix timeout checks on polling path")
--- drivers/firmware/arm_scmi/Kconfig | 14 ++++++++++++++ drivers/firmware/arm_scmi/common.h | 10 ++++++++++ drivers/firmware/arm_scmi/driver.c | 2 ++ 3 files changed, 26 insertions(+)
drivers/firmware/arm_scmi/Kconfig +14 -0
@@ -55,6 +55,20 @@ config ARM_SCMI_RAW_MODE_SUPPORT_COEX operate normally, thing which could make an SCMI test suite using the SCMI Raw mode support unreliable. If unsure, say N. +config ARM_SCMI_DEBUG_COUNTERS + bool "Enable SCMI communication debug metrics tracking" + select ARM_SCMI_NEED_DEBUGFS + depends on DEBUG_FS + default n + help + Enables tracking of some key communication metrics for debug + purposes. It may track metrics like how many messages were sent + or received, were there any failures, what kind of failures, ..etc. + + Enable this option to create a new debugfs directory which contains + such useful debug counters. This can be helpful for debugging and + SCMI monitoring. + config ARM_SCMI_HAVE_TRANSPORT bool help
drivers/firmware/arm_scmi/common.h +10 -0
@@ -303,6 +303,16 @@ extern const struct scmi_desc scmi_optee_desc;void scmi_rx_callback (struct scmi_chan_info *cinfo,u32 msg_hdr,void *priv); +enum debug_counters { +SCMI_DEBUG_COUNTERS_LAST +}; + +static inline void scmi_inc_count (atomic_t *arr,int stat) +{ +if (IS_ENABLED (CONFIG_ARM_SCMI_DEBUG_COUNTERS )) +atomic_inc (&arr[stat]); +} +enum scmi_bad_msg {MSG_UNEXPECTED =-1 ,MSG_INVALID =-2 ,
drivers/firmware/arm_scmi/driver.c +2 -0
@@ -108,12 +108,14 @@ struct scmi_protocol_instance {* @name: Name of this SCMI instance * @type: Type of this SCMI instance * @is_atomic: Flag to state if the transport of this instance is atomic +* @counters: An array of atomic_c's used for tracking statistics (if enabled) */ struct scmi_debug_info {struct dentry *top_dentry;const char *name;const char *type;bool is_atomic; +atomic_t counters[SCMI_DEBUG_COUNTERS_LAST ]; };/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/117 firmware: arm_scmi: Track basic SCMI communication debug metrics
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke Parkin <[email protected]>
[ Upstream commit 0b3d48c4726e1b20dffd2ff81a9d94d5d930220b ]
Add the support for counting some of the SCMI communication debug metrics like how many were sent successfully or with some errors, responses received, notifications and delayed responses, transfer timeouts and errors from the firmware/platform.
In many cases, the traces exists. But the traces are not always necessarily enabled and getting such cumulative SCMI communication debug metrics helps in understanding if there are any possible improvements that can be made on either side of SCMI communication.
Message-Id: <[email protected]>
Stable-dep-of: c23c03bf1faa ("firmware: arm_scmi: Fix timeout checks on polling path")
--- drivers/firmware/arm_scmi/common.h | 14 ++++++++++++++ drivers/firmware/arm_scmi/driver.c | 25 ++++++++++++++++++++----- 2 files changed, 34 insertions(+), 5 deletions(-)
drivers/firmware/arm_scmi/common.h +14 -0
@@ -304,6 +304,20 @@ extern const struct scmi_desc scmi_optee_desc;void scmi_rx_callback (struct scmi_chan_info *cinfo,u32 msg_hdr,void *priv);enum debug_counters { +SENT_OK , +SENT_FAIL , +SENT_FAIL_POLLING_UNSUPPORTED , +SENT_FAIL_CHANNEL_NOT_FOUND , +RESPONSE_OK , +NOTIFICATION_OK , +DELAYED_RESPONSE_OK , +XFERS_RESPONSE_TIMEOUT , +XFERS_RESPONSE_POLLED_TIMEOUT , +RESPONSE_POLLED_OK , +ERR_MSG_UNEXPECTED , +ERR_MSG_INVALID , +ERR_MSG_NOMEM , +ERR_PROTOCOL ,SCMI_DEBUG_COUNTERS_LAST };
drivers/firmware/arm_scmi/driver.c +20 -5
@@ -856,6 +856,7 @@ scmi_xfer_command_acquire(struct scmi_chan_info *cinfo, u32 msg_hdr)spin_unlock_irqrestore (&minfo->xfer_lock, flags);scmi_bad_message_trace (cinfo, msg_hdr,MSG_UNEXPECTED ); +scmi_inc_count (info->dbg->counters,ERR_MSG_UNEXPECTED );return xfer; }
@@ -883,6 +884,8 @@ scmi_xfer_command_acquire(struct scmi_chan_info *cinfo, u32 msg_hdr) msg_type, xfer_id, msg_hdr, xfer->state);scmi_bad_message_trace (cinfo, msg_hdr,MSG_INVALID ); +scmi_inc_count (info->dbg->counters,ERR_MSG_INVALID ); +/* On error the refcount incremented above has to be dropped */ __scmi_xfer_put (minfo, xfer);
@@ -927,6 +930,7 @@ static void scmi_handle_notification(struct scmi_chan_info *cinfo, PTR_ERR(xfer));scmi_bad_message_trace (cinfo, msg_hdr,MSG_NOMEM ); +scmi_inc_count (info->dbg->counters,ERR_MSG_NOMEM );scmi_clear_channel (info, cinfo);return ;
@@ -942,6 +946,7 @@ static void scmi_handle_notification(struct scmi_chan_info *cinfo,trace_scmi_msg_dump (info->id, cinfo->id, xfer->hdr.protocol_id, xfer->hdr.id,"NOTI" , xfer->hdr.seq, xfer->hdr.status, xfer->rx.buf, xfer->rx.len); +scmi_inc_count (info->dbg->counters,NOTIFICATION_OK );scmi_notify (cinfo->handle, xfer->hdr.protocol_id, xfer->hdr.id, xfer->rx.buf, xfer->rx.len, ts);
@@ -1001,8 +1006,10 @@ static void scmi_handle_response(struct scmi_chan_info *cinfo,if (xfer->hdr.type ==MSG_TYPE_DELAYED_RESP ) {scmi_clear_channel (info, cinfo);complete (xfer->async_done); +scmi_inc_count (info->dbg->counters,DELAYED_RESPONSE_OK ); }else {complete (&xfer->done); +scmi_inc_count (info->dbg->counters,RESPONSE_OK ); }if (IS_ENABLED (CONFIG_ARM_SCMI_RAW_MODE_SUPPORT )) {
@@ -1086,6 +1093,7 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc, struct scmi_xfer *xfer, unsigned int timeout_ms) { int ret = 0; +struct scmi_info *info =handle_to_scmi_info (cinfo->handle);if (xfer->hdr.poll_completion) {/*
@@ -1106,13 +1114,12 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc,"timed out in resp(caller: %pS) - polling\n" , (void *)_RET_IP_); ret = -ETIMEDOUT ; +scmi_inc_count (info->dbg->counters,XFERS_RESPONSE_POLLED_TIMEOUT ); } }if (!ret) {unsigned long flags; -struct scmi_info *info = -handle_to_scmi_info (cinfo->handle);/* * Do not fetch_response if an out-of-order delayed
@@ -1132,6 +1139,7 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc, "RESP" : "resp", xfer->hdr.seq, xfer->hdr.status, xfer->rx.buf, xfer->rx.len); +scmi_inc_count (info->dbg->counters,RESPONSE_POLLED_OK );if (IS_ENABLED (CONFIG_ARM_SCMI_RAW_MODE_SUPPORT )) { struct scmi_info *info =
@@ -1149,6 +1157,7 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc,dev_err (dev,"timed out in resp(caller: %pS)\n" , (void *)_RET_IP_); ret = -ETIMEDOUT ; +scmi_inc_count (info->dbg->counters,XFERS_RESPONSE_TIMEOUT ); } }
@@ -1232,13 +1241,15 @@ static int do_xfer(const struct scmi_protocol_handle *ph, !is_transport_polling_capable(info->desc)) {dev_warn_once (dev,"Polling mode is not supported by transport.\n" ); +scmi_inc_count (info->dbg->counters,SENT_FAIL_POLLING_UNSUPPORTED );return -EINVAL ; } cinfo =idr_find (&info->tx_idr, pi->proto->id); -if (unlikely (!cinfo)) +if (unlikely (!cinfo)) { +scmi_inc_count (info->dbg->counters,SENT_FAIL_CHANNEL_NOT_FOUND );return -EINVAL ; - + }/* True ONLY if also supported by transport. */ if (is_polling_enabled (cinfo, info->desc)) xfer->hdr.poll_completion = true;
@@ -1270,16 +1281,20 @@ static int do_xfer(const struct scmi_protocol_handle *ph, ret = info->desc->ops->send_message (cinfo, xfer);if (ret <0 ) {dev_dbg (dev,"Failed to send message %d\n" , ret); +scmi_inc_count (info->dbg->counters,SENT_FAIL );return ret; }trace_scmi_msg_dump (info->id, cinfo->id, xfer->hdr.protocol_id, xfer->hdr.id,"CMND" , xfer->hdr.seq, xfer->hdr.status, xfer->tx.buf, xfer->tx.len); +scmi_inc_count (info->dbg->counters,SENT_OK ); ret =scmi_wait_for_message_response (cinfo, xfer); -if (!ret && xfer->hdr.status) +if (!ret && xfer->hdr.status) { ret =scmi_to_linux_errno (xfer->hdr.status); +scmi_inc_count (info->dbg->counters,ERR_PROTOCOL ); + }if (info->desc->ops->mark_txdone) info->desc->ops->mark_txdone (cinfo, ret, xfer);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/117 firmware: arm_scmi: Fix timeout checks on polling path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit c23c03bf1faa1e76be1eba35bad6da6a2a7c95ee ]
Polling mode transactions wait for a reply busy-looping without holding a spinlock, but currently the timeout checks are based only on elapsed time:
as a result we could hit a false positive whenever our busy-looping thread is pre-empted and scheduled out for a time greater than the polling timeout.
Change the checks at the end of the busy-loop to make sure that the polling wasn't indeed successful or an out-of-order reply caused the polling to be forcibly terminated.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/driver.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/firmware/arm_scmi/driver.c +8 -5
@@ -1075,7 +1075,8 @@ static void xfer_put(const struct scmi_protocol_handle *ph, }static bool scmi_xfer_done_no_timeout (struct scmi_chan_info *cinfo, -struct scmi_xfer *xfer,ktime_t stop) +struct scmi_xfer *xfer,ktime_t stop, +bool *ooo) {struct scmi_info *info =handle_to_scmi_info (cinfo->handle);
@@ -1084,7 +1085,7 @@ static bool scmi_xfer_done_no_timeout(struct scmi_chan_info *cinfo,* in case of out-of-order receptions of delayed responses */ return info->desc->ops->poll_done (cinfo, xfer) || -try_wait_for_completion (&xfer->done) || + (*ooo =try_wait_for_completion (&xfer->done)) ||ktime_after (ktime_get (), stop); }
@@ -1101,15 +1102,17 @@ static int scmi_wait_for_reply(struct device *dev, const struct scmi_desc *desc,* itself to support synchronous commands replies. */ if (!desc->sync_cmds_completed_on_ret) { +bool ooo = false; +/* * Poll on xfer using transport provided .poll_done(); * assumes no completion interrupt was available. */ ktime_t stop =ktime_add_ms (ktime_get (), timeout_ms); -spin_until_cond (scmi_xfer_done_no_timeout (cinfo, - xfer, stop)); -if (ktime_after (ktime_get (), stop)) { +spin_until_cond (scmi_xfer_done_no_timeout (cinfo, xfer, + stop, &ooo)); +if (!ooo && !info->desc->ops->poll_done (cinfo, xfer)) {dev_err (dev,"timed out in resp(caller: %pS) - polling\n" , (void *)_RET_IP_);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/117 KVM: SVM: Update SEV-ES shutdown intercepts with more metadata
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Gonda <[email protected]>
[ Upstream commit bc3d7c5570a03ab45bde4bae83697c80900fb714 ]
Currently if an SEV-ES VM shuts down userspace sees KVM_RUN struct with only errno=EINVAL. This is a very limited amount of information to debug the situation. Instead return KVM_EXIT_SHUTDOWN to alert userspace the VM is shutting down and is not usable any further.
Stable-dep-of: a2620f8932fa ("KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception")
--- arch/x86/kvm/svm/svm.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
arch/x86/kvm/svm/svm.c +7 -8
@@ -2211,12 +2211,6 @@ static int shutdown_interception(struct kvm_vcpu *vcpu)struct kvm_run *kvm_run = vcpu->run;struct vcpu_svm *svm =to_svm (vcpu); -/* -* The VM save area has already been encrypted so it -* cannot be reinitialized - just terminate. -*/ -if (sev_es_guest (vcpu->kvm)) -return -EINVAL ;/* * VMCB is undefined after a SHUTDOWN intercept. INIT the vCPU to put
@@ -2225,9 +2219,14 @@ static int shutdown_interception(struct kvm_vcpu *vcpu)* userspace. At a platform view, INIT is acceptable behavior as * there exist bare metal platforms that automatically INIT the CPU * in response to shutdown. +* +* The VM save area for SEV-ES guests has already been encrypted so it +* cannot be reinitialized, i.e. synthesizing INIT is futile. */ -clear_page (svm->vmcb); -kvm_vcpu_reset (vcpu, true); +if (!sev_es_guest (vcpu->kvm)) { +clear_page (svm->vmcb); +kvm_vcpu_reset (vcpu, true); + } kvm_run->exit_reason =KVM_EXIT_SHUTDOWN ;return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/117 KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Lobanov <[email protected]>
[ Upstream commit a2620f8932fa9fdabc3d78ed6efb004ca409019f ]
Previously, commit ed129ec9057f ("KVM: x86: forcibly leave nested mode on vCPU reset") addressed an issue where a triple fault occurring in nested mode could lead to use-after-free scenarios. However, the commit did not handle the analogous situation for System Management Mode (SMM).
This omission results in triggering a WARN when KVM forces a vCPU INIT after SHUTDOWN interception while the vCPU is in SMM. This situation was reprodused using Syzkaller by:
1) Creating a KVM VM and vCPU
2) Sending a KVM_SMI ioctl to explicitly enter SMM
3) Executing invalid instructions causing consecutive exceptions and eventually a triple fault
The issue manifests as follows:
WARNING: CPU: 0 PID: 25506 at arch/x86/kvm/x86.c:12112 kvm_vcpu_reset+0x1d2/0x1530 arch/x86/kvm/x86.c:12112 Modules linked in: CPU: 0 PID: 25506 Comm: syz-executor.0 Not tainted 6.1.130-syzkaller-00157-g164fe5dde9b6 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:kvm_vcpu_reset+0x1d2/0x1530 arch/x86/kvm/x86.c:12112 Call Trace: <TASK> shutdown_interception+0x66/0xb0 arch/x86/kvm/svm/svm.c:2136 svm_invoke_exit_handler+0x110/0x530 arch/x86/kvm/svm/svm.c:3395 svm_handle_exit+0x424/0x920 arch/x86/kvm/svm/svm.c:3457 vcpu_enter_guest arch/x86/kvm/x86.c:10959 [inline] vcpu_run+0x2c43/0x5a90 arch/x86/kvm/x86.c:11062 kvm_arch_vcpu_ioctl_run+0x50f/0x1cf0 arch/x86/kvm/x86.c:11283 kvm_vcpu_ioctl+0x570/0xf00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4122 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Architecturally, INIT is blocked when the CPU is in SMM, hence KVM's WARN() in kvm_vcpu_reset() to guard against KVM bugs, e.g. to detect improper emulation of INIT. SHUTDOWN on SVM is a weird edge case where KVM needs to do _something_ sane with the VMCB, since it's technically undefined, and INIT is the least awful choice given KVM's ABI.
So, double down on stuffing INIT on SHUTDOWN, and force the vCPU out of SMM to avoid any weirdness (and the WARN).
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- arch/x86/kvm/smm.c | 1 + arch/x86/kvm/svm/svm.c | 4 ++++ 2 files changed, 5 insertions(+)
arch/x86/kvm/smm.c +1 -0
@@ -131,6 +131,7 @@ void kvm_smm_changed(struct kvm_vcpu *vcpu, bool entering_smm)kvm_mmu_reset_context (vcpu); } +EXPORT_SYMBOL_GPL (kvm_smm_changed);void process_smi (struct kvm_vcpu *vcpu) {
arch/x86/kvm/svm/svm.c +4 -0
@@ -2225,6 +2225,10 @@ static int shutdown_interception(struct kvm_vcpu *vcpu)*/ if (!sev_es_guest (vcpu->kvm)) {clear_page (svm->vmcb); +#ifdef CONFIG_KVM_SMM +if (is_smm (vcpu)) +kvm_smm_changed (vcpu, false); +#endif kvm_vcpu_reset (vcpu, true); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/117 iio: adc: ad7266: Fix potential timestamp alignment issue.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit 52d349884738c346961e153f195f4c7fe186fcf4 ]
On architectures where an s64 is only 32-bit aligned insufficient padding would be left between the earlier elements and the timestamp. Use aligned_s64 to enforce the correct placement and ensure the storage is large enough.
--- drivers/iio/adc/ad7266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7266.c +1 -1
@@ -44,7 +44,7 @@ struct ad7266_state {*/ struct {__be16 sample[2 ]; -s64 timestamp; +aligned_s64 timestamp; } data__aligned(IIO_DMA_MINALIGN) ; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/117 drm/amd: Stop evicting resources on APUs in suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 226db36032c61d8717dfdd052adac351b22d3e83 ]
commit 5095d5418193 ("drm/amd: Evict resources during PM ops prepare() callback") intentionally moved the eviction of resources to earlier in the suspend process, but this introduced a subtle change that it occurs before adev->in_s0ix or adev->in_s3 are set. This meant that APUs actually started to evict resources at suspend time as well.
Explicitly set s0ix or s3 in the prepare() stage, and unset them if the prepare() stage failed.
v2: squash in warning fix from Stephen Rothwell
Stable-dep-of: d0ce1aaa8531 ("Revert "drm/amd: Stop evicting resources on APUs in suspend"")
--- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 +++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +++++++++-- 3 files changed, 26 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu.h +2 -0
@@ -1458,9 +1458,11 @@ static inline int amdgpu_acpi_smart_shift_update(struct drm_device *dev,#if defined(CONFIG_ACPI ) && defined(CONFIG_SUSPEND )bool amdgpu_acpi_is_s3_active (struct amdgpu_device *adev);bool amdgpu_acpi_is_s0ix_active (struct amdgpu_device *adev); +void amdgpu_choose_low_power_state (struct amdgpu_device *adev);#else static inline bool amdgpu_acpi_is_s0ix_active (struct amdgpu_device *adev) {return false; }static inline bool amdgpu_acpi_is_s3_active (struct amdgpu_device *adev) {return false; } +static inline void amdgpu_choose_low_power_state (struct amdgpu_device *adev) { }#endif #if defined(CONFIG_DRM_AMD_DC )
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +15 -0
@@ -1525,4 +1525,19 @@ bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev) #endif /* CONFIG_AMD_PMC */ } +/** +* amdgpu_choose_low_power_state +* +* @adev: amdgpu_device_pointer +* +* Choose the target low power state for the GPU +*/ +void amdgpu_choose_low_power_state (struct amdgpu_device *adev) +{ +if (amdgpu_acpi_is_s0ix_active (adev)) + adev->in_s0ix = true; +else if (amdgpu_acpi_is_s3_active (adev)) + adev->in_s3 = true; +} +#endif /* CONFIG_SUSPEND */
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +9 -2
@@ -4121,13 +4121,15 @@ int amdgpu_device_prepare(struct drm_device *dev)struct amdgpu_device *adev =drm_to_adev (dev);int i, r; +amdgpu_choose_low_power_state (adev); +if (dev->switch_power_state ==DRM_SWITCH_POWER_OFF )return 0 ;/* Evict the majority of BOs before starting suspend sequence */ r =amdgpu_device_evict_resources (adev);if (r) -return r; + goto unprepare;flush_delayed_work (&adev->gfx.gfx_off_delay_work);
@@ -4138,10 +4140,15 @@ int amdgpu_device_prepare(struct drm_device *dev)continue ; r = adev->ip_blocks[i].version->funcs->prepare_suspend ((void *)adev);if (r) -return r; + goto unprepare; }return 0 ; + +unprepare: + adev->in_s0ix = adev->in_s3 = false; + +return r; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/117 drm/amdgpu: Fix the runtime resume failure issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit bbfaf2aea7164db59739728d62d9cc91d64ff856 ]
Don't set power state flag when system enter runtime suspend, or it may cause runtime resume failure issue.
Stable-dep-of: d0ce1aaa8531 ("Revert "drm/amd: Stop evicting resources on APUs in suspend"")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +3 -0
@@ -1534,6 +1534,9 @@ bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev)*/ void amdgpu_choose_low_power_state (struct amdgpu_device *adev) { +if (adev->in_runpm) +return ; +if (amdgpu_acpi_is_s0ix_active (adev)) adev->in_s0ix = true;else if (amdgpu_acpi_is_s3_active (adev))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/117 drm/amdgpu: trigger flr_work if reading pf2vf data failed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhigang Luo <[email protected]>
[ Upstream commit ab66c832847fcdffc97d4591ba5547e3990d9d33 ]
if reading pf2vf data failed 30 times continuously, it means something is wrong. Need to trigger flr_work to recover the issue.
also use dev_err to print the error message to get which device has issue and add warning message if waiting IDH_FLR_NOTIFICATION_CMPL timeout.
Stable-dep-of: d0ce1aaa8531 ("Revert "drm/amd: Stop evicting resources on APUs in suspend"")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 15 +++++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 29 ++++++++++++++++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 3 +++ drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c | 2 ++ drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c | 2 ++ 5 files changed, 41 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +10 -5
@@ -141,6 +141,8 @@ const char *amdgpu_asic_name[] = { "LAST", }; +static inline void amdgpu_device_stop_pending_resets (struct amdgpu_device *adev); +/** * DOC: pcie_replay_count *
@@ -4558,6 +4560,8 @@ static int amdgpu_device_reset_sriov(struct amdgpu_device *adev, retry:amdgpu_amdkfd_pre_reset (adev); +amdgpu_device_stop_pending_resets (adev); +if (from_hypervisor) r =amdgpu_virt_request_full_gpu (adev, true);else
@@ -5354,11 +5358,12 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, tmp_adev->asic_reset_res = r; } -/* -* Drop all pending non scheduler resets. Scheduler resets -* were already dropped during drm_sched_stop -*/ -amdgpu_device_stop_pending_resets (tmp_adev); +if (!amdgpu_sriov_vf (tmp_adev)) +/* +* Drop all pending non scheduler resets. Scheduler resets +* were already dropped during drm_sched_stop +*/ +amdgpu_device_stop_pending_resets (tmp_adev); }/* Actual ASIC resets if needed.*/
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +24 -5
@@ -32,6 +32,7 @@#include "amdgpu.h" #include "amdgpu_ras.h" +#include "amdgpu_reset.h" #include "vi.h" #include "soc15.h" #include "nv.h"
@@ -468,7 +469,7 @@ static int amdgpu_virt_read_pf2vf_data(struct amdgpu_device *adev)return -EINVAL ;if (pf2vf_info->size >1024 ) { -DRM_ERROR ("invalid pf2vf message size\n" ); +dev_err (adev->dev,"invalid pf2vf message size: 0x%x\n" , pf2vf_info->size);return -EINVAL ; }
@@ -479,7 +480,9 @@ static int amdgpu_virt_read_pf2vf_data(struct amdgpu_device *adev) adev->virt.fw_reserve.p_pf2vf, pf2vf_info->size, adev->virt.fw_reserve.checksum_key, checksum);if (checksum != checkval) { -DRM_ERROR ("invalid pf2vf message\n" ); +dev_err (adev->dev, +"invalid pf2vf message: header checksum=0x%x calculated checksum=0x%x\n" , + checksum, checkval);return -EINVAL ; }
@@ -493,7 +496,9 @@ static int amdgpu_virt_read_pf2vf_data(struct amdgpu_device *adev) adev->virt.fw_reserve.p_pf2vf, pf2vf_info->size, 0, checksum);if (checksum != checkval) { -DRM_ERROR ("invalid pf2vf message\n" ); +dev_err (adev->dev, +"invalid pf2vf message: header checksum=0x%x calculated checksum=0x%x\n" , + checksum, checkval);return -EINVAL ; }
@@ -529,7 +534,7 @@ static int amdgpu_virt_read_pf2vf_data(struct amdgpu_device *adev) ((struct amd_sriov_msg_pf2vf_info *)pf2vf_info)->uuid;break ;default : -DRM_ERROR ("invalid pf2vf version\n" ); +dev_err (adev->dev,"invalid pf2vf version: 0x%x\n" , pf2vf_info->version);return -EINVAL ; }
@@ -628,8 +633,21 @@ static void amdgpu_virt_update_vf2pf_work_item(struct work_struct *work)int ret; ret =amdgpu_virt_read_pf2vf_data (adev); -if (ret) +if (ret) { + adev->virt.vf2pf_update_retry_cnt++; +if ((adev->virt.vf2pf_update_retry_cnt >=AMDGPU_VF2PF_UPDATE_MAX_RETRY_LIMIT ) && +amdgpu_sriov_runtime (adev) && !amdgpu_in_reset (adev)) { +if (amdgpu_reset_domain_schedule (adev->reset_domain, + &adev->virt.flr_work)) +return ; +else +dev_err (adev->dev,"Failed to queue work! at %s" , __func__); + } + goto out; + } + + adev->virt.vf2pf_update_retry_cnt =0 ;amdgpu_virt_write_vf2pf_data (adev); out:
@@ -650,6 +668,7 @@ void amdgpu_virt_init_data_exchange(struct amdgpu_device *adev) adev->virt.fw_reserve.p_pf2vf =NULL ; adev->virt.fw_reserve.p_vf2pf =NULL ; adev->virt.vf2pf_update_interval_ms =0 ; + adev->virt.vf2pf_update_retry_cnt =0 ;if (adev->mman.fw_vram_usage_va && adev->mman.drv_vram_usage_va) {DRM_WARN ("Currently fw_vram and drv_vram should not have values at the same time!" );
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +3 -0
@@ -51,6 +51,8 @@/* tonga/fiji use this offset */ #define mmBIF_IOV_FUNC_IDENTIFIER 0x1503 +#define AMDGPU_VF2PF_UPDATE_MAX_RETRY_LIMIT 30 +enum amdgpu_sriov_vf_mode {SRIOV_VF_MODE_BARE_METAL =0 ,SRIOV_VF_MODE_ONE_VF ,
@@ -253,6 +255,7 @@ struct amdgpu_virt {/* vf2pf message */ struct delayed_work vf2pf_work;uint32_t vf2pf_update_interval_ms; +int vf2pf_update_retry_cnt;/* multimedia bandwidth config */ bool is_mm_bw_enabled;
drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c +2 -0
@@ -276,6 +276,8 @@ static void xgpu_ai_mailbox_flr_work(struct work_struct *work) timeout -=10 ; }while (timeout >1 ); +dev_warn (adev->dev,"waiting IDH_FLR_NOTIFICATION_CMPL timeout\n" ); + flr_done:atomic_set (&adev->reset_domain->in_gpu_reset,0 );up_write (&adev->reset_domain->sem);
drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c +2 -0
@@ -298,6 +298,8 @@ static void xgpu_nv_mailbox_flr_work(struct work_struct *work) timeout -=10 ; }while (timeout >1 ); +dev_warn (adev->dev,"waiting IDH_FLR_NOTIFICATION_CMPL timeout\n" ); + flr_done:atomic_set (&adev->reset_domain->in_gpu_reset,0 );up_write (&adev->reset_domain->sem);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/117 drm/amd: Add Suspend/Hibernate notification callback support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 2965e6355dcdf157b5fafa25a2715f00064da8bf ]
As part of the suspend sequence VRAM needs to be evicted on dGPUs. In order to make suspend/resume more reliable we moved this into the pmops prepare() callback so that the suspend sequence would fail but the system could remain operational under high memory usage suspend.
Another class of issues exist though where due to memory fragementation there isn't a large enough contiguous space and swap isn't accessible.
Add support for a suspend/hibernate notification callback that could evict VRAM before tasks are frozen. This should allow paging out to swap if necessary.
Stable-dep-of: d0ce1aaa8531 ("Revert "drm/amd: Stop evicting resources on APUs in suspend"")
--- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 46 +++++++++++++++++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 - 3 files changed, 46 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu.h +1 -0
@@ -788,6 +788,7 @@ struct amdgpu_device {bool need_swiotlb;bool accel_working;struct notifier_block acpi_nb; +struct notifier_block pm_nb;struct amdgpu_i2c_chan *i2c_bus[AMDGPU_MAX_I2C_BUS ];struct debugfs_blob_wrapper debugfs_vbios_blob;struct debugfs_blob_wrapper debugfs_discovery_blob;
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +45 -1
76 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +0 -1
@@ -2463,7 +2463,6 @@ static int amdgpu_pmops_freeze(struct device *dev)struct amdgpu_device *adev =drm_to_adev (drm_dev);int r; - adev->in_s4 = true; r =amdgpu_device_suspend (drm_dev, true);if (r)return r;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/117 Revert "drm/amd: Stop evicting resources on APUs in suspend"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit d0ce1aaa8531a4a4707711cab5721374751c51b0 ]
This reverts commit 3a9626c816db901def438dc2513622e281186d39.
This breaks S4 because we end up setting the s3/s0ix flags even when we are entering s4 since prepare is used by both flows. The causes both the S3/s0ix and s4 flags to be set which breaks several checks in the driver which assume they are mutually exclusive.
--- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 -- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 18 ------------------ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 ++--------- 3 files changed, 2 insertions(+), 29 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu.h +0 -2
@@ -1459,11 +1459,9 @@ static inline int amdgpu_acpi_smart_shift_update(struct drm_device *dev,#if defined(CONFIG_ACPI ) && defined(CONFIG_SUSPEND )bool amdgpu_acpi_is_s3_active (struct amdgpu_device *adev);bool amdgpu_acpi_is_s0ix_active (struct amdgpu_device *adev); -void amdgpu_choose_low_power_state (struct amdgpu_device *adev);#else static inline bool amdgpu_acpi_is_s0ix_active (struct amdgpu_device *adev) {return false; }static inline bool amdgpu_acpi_is_s3_active (struct amdgpu_device *adev) {return false; } -static inline void amdgpu_choose_low_power_state (struct amdgpu_device *adev) { }#endif #if defined(CONFIG_DRM_AMD_DC )
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +0 -18
@@ -1525,22 +1525,4 @@ bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev) #endif /* CONFIG_AMD_PMC */ } -/** -* amdgpu_choose_low_power_state -* -* @adev: amdgpu_device_pointer -* -* Choose the target low power state for the GPU -*/ -void amdgpu_choose_low_power_state (struct amdgpu_device *adev) -{ -if (adev->in_runpm) -return ; - -if (amdgpu_acpi_is_s0ix_active (adev)) - adev->in_s0ix = true; -else if (amdgpu_acpi_is_s3_active (adev)) - adev->in_s3 = true; -} -#endif /* CONFIG_SUSPEND */
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -9
@@ -4167,15 +4167,13 @@ int amdgpu_device_prepare(struct drm_device *dev)struct amdgpu_device *adev =drm_to_adev (dev);int i, r; -amdgpu_choose_low_power_state (adev); -if (dev->switch_power_state ==DRM_SWITCH_POWER_OFF )return 0 ;/* Evict the majority of BOs before starting suspend sequence */ r =amdgpu_device_evict_resources (adev);if (r) - goto unprepare; +return r;flush_delayed_work (&adev->gfx.gfx_off_delay_work);
@@ -4186,15 +4184,10 @@ int amdgpu_device_prepare(struct drm_device *dev)continue ; r = adev->ip_blocks[i].version->funcs->prepare_suspend ((void *)adev);if (r) - goto unprepare; +return r; }return 0 ; - -unprepare: - adev->in_s0ix = adev->in_s3 = adev->in_s4 = false; - -return r; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/117 iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit ffbc26bc91c1f1eb3dcf5d8776e74cbae21ee13a ]
On architectures where an s64 is not 64-bit aligned, this may result insufficient alignment of the timestamp and the structure being too small. Use aligned_s64 to force the alignment.
--- drivers/iio/adc/ad7768-1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7768-1.c +1 -1
@@ -169,7 +169,7 @@ struct ad7768_state {union {struct {__be32 chan; -s64 timestamp; +aligned_s64 timestamp; } scan;__be32 d32;u8 d8[2 ];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/117 iio: chemical: sps30: use aligned_s64 for timestamp
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit bb49d940344bcb8e2b19e69d7ac86f567887ea9a ]
Follow the pattern of other drivers and use aligned_s64 for the timestamp. This will ensure that the timestamp is correctly aligned on all architectures.
--- drivers/iio/chemical/sps30.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/chemical/sps30.c +1 -1
@@ -108,7 +108,7 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p)int ret;struct {s32 data[4 ];/* PM1, PM2P5, PM4, PM10 */ -s64 ts; +aligned_s64 ts; } scan;mutex_lock (&state->lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/117 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <[email protected]>
[ Upstream commit f81b33582f9339d2dc17c69b92040d3650bb4bae ]
Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcf/0x610 mm/kasan/report.c:489 kasan_report+0xb5/0xe0 mm/kasan/report.c:602 rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195 rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132 __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232 rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109 create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052 ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095 ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679 vfs_write fs/read_write.c:677 [inline] vfs_write+0x26a/0xcc0 fs/read_write.c:659 ksys_write+0x1b8/0x200 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
In the function rxe_create_cq, when rxe_cq_from_init fails, the function rxe_cleanup will be called to handle the allocated resources. In fact, some memory resources have already been freed in the function rxe_cq_from_init. Thus, this problem will occur.
The solution is to let rxe_cleanup do all the work.
--- drivers/infiniband/sw/rxe/rxe_cq.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/infiniband/sw/rxe/rxe_cq.c +1 -4
@@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, err =do_mmap_info (rxe, uresp ? &uresp->mi :NULL , udata, cq->queue->buf, cq->queue->buf_size, &cq->queue->ip); -if (err) { -vfree (cq->queue->buf); -kfree (cq->queue); +if (err)return err; - } cq->is_user = uresp;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/117 HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
[ Upstream commit 09d546303b370113323bfff456c4e8cff8756005 ]
In thrustmaster_interrupts(), the allocated send_buf is not freed if the usb_check_int_endpoints() check fails, leading to a memory leak.
Fix this by ensuring send_buf is freed before returning in the error path.
--- drivers/hid/hid-thrustmaster.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/hid-thrustmaster.c +1 -0
@@ -174,6 +174,7 @@ static void thrustmaster_interrupts(struct hid_device *hdev)u8 ep_addr[2 ] = {b_ep,0 };if (!usb_check_int_endpoints (usbif, ep_addr)) { +kfree (send_buf);hid_err (hdev,"Unexpected non-int endpoint\n" );return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/117 HID: uclogic: Add NULL check in uclogic_input_configured()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit bd07f751208ba190f9b0db5e5b7f35d5bb4a8a1e ]
devm_kasprintf() returns NULL when memory allocation fails. Currently, uclogic_input_configured() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devm_kasprintf() to prevent this issue.
--- drivers/hid/hid-uclogic-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/hid/hid-uclogic-core.c +4 -3
@@ -142,11 +142,12 @@ static int uclogic_input_configured(struct hid_device *hdev, suffix ="System Control" ;break ; } - } - -if (suffix) + }else { hi->input->name =devm_kasprintf (&hdev->dev,GFP_KERNEL ,"%s %s" , hdev->name, suffix); +if (!hi->input->name) +return -ENOMEM ; + }return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/117 nfs: handle failure of nfs_get_lock_context in unlock path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
[ Upstream commit c457dc1ec770a22636b473ce5d35614adfe97636 ]
When memory is insufficient, the allocation of nfs_lock_context in nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM) as valid and proceed to execute rpc_run_task(), this will trigger a NULL pointer dereference in nfs4_locku_prepare. For example:
BUG: kernel NULL pointer dereference, address: 000000000000000c PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 15 UID: 0 PID: 12 Comm: kworker/u64:0 Not tainted 6.15.0-rc2-dirty #60 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 Workqueue: rpciod rpc_async_schedule RIP: 0010:nfs4_locku_prepare+0x35/0xc2 Code: 89 f2 48 89 fd 48 c7 c7 68 69 ef b5 53 48 8b 8e 90 00 00 00 48 89 f3 RSP: 0018:ffffbbafc006bdb8 EFLAGS: 00010246 RAX: 000000000000004b RBX: ffff9b964fc1fa00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: fffffffffffffff4 RDI: ffff9ba53fddbf40 RBP: ffff9ba539934000 R08: 0000000000000000 R09: ffffbbafc006bc38 R10: ffffffffb6b689c8 R11: 0000000000000003 R12: ffff9ba539934030 R13: 0000000000000001 R14: 0000000004248060 R15: ffffffffb56d1c30 FS: 0000000000000000(0000) GS:ffff9ba5881f0000(0000) knlGS:00000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000c CR3: 000000093f244000 CR4: 00000000000006f0 Call Trace: <TASK> __rpc_execute+0xbc/0x480 rpc_async_schedule+0x2f/0x40 process_one_work+0x232/0x5d0 worker_thread+0x1da/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0x10d/0x240 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: CR2: 000000000000000c ---[ end trace 0000000000000000 ]---
Free the allocated nfs4_unlockdata when nfs_get_lock_context() fails and return NULL to terminate subsequent rpc_run_task, preventing NULL pointer dereference.
--- fs/nfs/nfs4proc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/nfs/nfs4proc.c +8 -1
@@ -6880,10 +6880,18 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,struct nfs4_unlockdata *p;struct nfs4_state *state = lsp->ls_state;struct inode *inode = state->inode; +struct nfs_lock_context *l_ctx; p =kzalloc (sizeof (*p),GFP_KERNEL );if (p ==NULL )return NULL ; + l_ctx =nfs_get_lock_context (ctx); +if (!IS_ERR (l_ctx)) { + p->l_ctx = l_ctx; + }else { +kfree (p); +return NULL ; + } p->arg.fh =NFS_FH (inode); p->arg.fl = &p->fl; p->arg.seqid = seqid;
@@ -6891,7 +6899,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, p->lsp = lsp;/* Ensure we don't close file until we're done freeing locks! */ p->ctx =get_nfs_open_context (ctx); - p->l_ctx =nfs_get_lock_context (ctx);locks_init_lock (&p->fl);locks_copy_lock (&p->fl, fl); p->server =NFS_SERVER (inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/117 spi: loopback-test: Do not split 1024-byte hexdumps
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit a73fa3690a1f3014d6677e368dce4e70767a6ba2 ]
spi_test_print_hex_dump() prints buffers holding less than 1024 bytes in full. Larger buffers are truncated: only the first 512 and the last 512 bytes are printed, separated by a truncation message. The latter is confusing in case the buffer holds exactly 1024 bytes, as all data is printed anyway.
Fix this by printing buffers holding up to and including 1024 bytes in full.
--- drivers/spi/spi-loopback-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-loopback-test.c +1 -1
@@ -421,7 +421,7 @@ MODULE_LICENSE("GPL");static void spi_test_print_hex_dump (char *pre,const void *ptr,size_t len) {/* limit the hex_dump */ -if (len <1024 ) { +if (len <=1024 ) {print_hex_dump (KERN_INFO , pre,DUMP_PREFIX_OFFSET ,16 ,1 , ptr, len,0 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/117 Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 1e2e3044c1bc64a64aa0eaf7c17f7832c26c9775 ]
Device flags could be updated in the meantime while MGMT_OP_ADD_DEVICE is pending on hci_update_passive_scan_sync so instead of setting the current_flags as cmd->user_data just do a lookup using hci_conn_params_lookup and use the latest stored flags.
--- net/bluetooth/mgmt.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/bluetooth/mgmt.c +6 -3
@@ -7605,11 +7605,16 @@ static void add_device_complete(struct hci_dev *hdev, void *data, int err)struct mgmt_cp_add_device *cp = cmd->param;if (!err) { +struct hci_conn_params *params; + + params =hci_conn_params_lookup (hdev, &cp->addr.bdaddr, +le_addr_type (cp->addr.type)); +device_added (cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);device_flags_changed (NULL , hdev, &cp->addr.bdaddr, cp->addr.type, hdev->conn_flags, -PTR_UINT (cmd->user_data)); + params ? params->flags :0 ); } mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE,
@@ -7712,8 +7717,6 @@ static int add_device(struct sock *sk, struct hci_dev *hdev, goto unlock; } - cmd->user_data =UINT_PTR (current_flags); - err =hci_cmd_sync_queue (hdev, add_device_sync, cmd, add_device_complete);if (err <0 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/117 net_sched: Flush gso_skb list too during ->change()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <[email protected]>
[ Upstream commit 2d3cbfd6d54a2c39ce3244f33f85c595844bd7b8 ]
Previously, when reducing a qdisc's limit via the ->change() operation, only the main skb queue was trimmed, potentially leaving packets in the gso_skb list. This could result in NULL pointer dereference when we only check sch->limit against sch->q.qlen.
This patch introduces a new helper, qdisc_dequeue_internal(), which ensures both the gso_skb list and the main queue are properly flushed when trimming excess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie) are updated to use this helper in their ->change() routines.
--- include/net/sch_generic.h | 15 +++++++++++++++ net/sched/sch_codel.c | 2 +- net/sched/sch_fq.c | 2 +- net/sched/sch_fq_codel.c | 2 +- net/sched/sch_fq_pie.c | 2 +- net/sched/sch_hhf.c | 2 +- net/sched/sch_pie.c | 2 +- 7 files changed, 21 insertions(+), 6 deletions(-)
include/net/sch_generic.h +15 -0
@@ -1029,6 +1029,21 @@ static inline struct sk_buff *__qdisc_dequeue_head(struct qdisc_skb_head *qh)return skb; } +static inline struct sk_buff *qdisc_dequeue_internal (struct Qdisc *sch,bool direct) +{ +struct sk_buff *skb; + + skb =__skb_dequeue (&sch->gso_skb); +if (skb) { + sch->q.qlen--; +return skb; + } +if (direct) +return __qdisc_dequeue_head (&sch->q); +else +return sch->dequeue (sch); +} +static inline struct sk_buff *qdisc_dequeue_head (struct Qdisc *sch) {struct sk_buff *skb =__qdisc_dequeue_head (&sch->q);
net/sched/sch_codel.c +1 -1
@@ -168,7 +168,7 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt, qlen = sch->q.qlen;while (sch->q.qlen > sch->limit) { -struct sk_buff *skb =__qdisc_dequeue_head (&sch->q); +struct sk_buff *skb =qdisc_dequeue_internal (sch, true); dropped +=qdisc_pkt_len (skb);qdisc_qstats_backlog_dec (sch, skb);
net/sched/sch_fq.c +1 -1
@@ -901,7 +901,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt,sch_tree_lock (sch); }while (sch->q.qlen > sch->limit) { -struct sk_buff *skb =fq_dequeue (sch); +struct sk_buff *skb =qdisc_dequeue_internal (sch, false);if (!skb)break ;
net/sched/sch_fq_codel.c +1 -1
@@ -431,7 +431,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,while (sch->q.qlen > sch->limit || q->memory_usage > q->memory_limit) { -struct sk_buff *skb =fq_codel_dequeue (sch); +struct sk_buff *skb =qdisc_dequeue_internal (sch, false); q->cstats.drop_len +=qdisc_pkt_len (skb);rtnl_kfree_skbs (skb, skb);
net/sched/sch_fq_pie.c +1 -1
@@ -357,7 +357,7 @@ static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt,/* Drop excess packets if new limit is lower */ while (sch->q.qlen > sch->limit) { -struct sk_buff *skb =fq_pie_qdisc_dequeue (sch); +struct sk_buff *skb =qdisc_dequeue_internal (sch, false); len_dropped +=qdisc_pkt_len (skb); num_dropped +=1 ;
net/sched/sch_hhf.c +1 -1
@@ -560,7 +560,7 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt, qlen = sch->q.qlen; prev_backlog = sch->qstats.backlog;while (sch->q.qlen > sch->limit) { -struct sk_buff *skb =hhf_dequeue (sch); +struct sk_buff *skb =qdisc_dequeue_internal (sch, false);rtnl_kfree_skbs (skb, skb); }
net/sched/sch_pie.c +1 -1
@@ -190,7 +190,7 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt,/* Drop excess packets if new limit is lower */ qlen = sch->q.qlen;while (sch->q.qlen > sch->limit) { -struct sk_buff *skb =__qdisc_dequeue_head (&sch->q); +struct sk_buff *skb =qdisc_dequeue_internal (sch, true); dropped +=qdisc_pkt_len (skb);qdisc_qstats_backlog_dec (sch, skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/117 tools: ynl: ethtool.py: Output timestamping statistics from tsinfo-get operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Rameshbabu <[email protected]>
[ Upstream commit 2e0e148c727061009d3db5f436f51890bbb49a80 ]
Print the nested stats attribute containing timestamping statistics when the --show-time-stamping flag is used.
[root@binary-eater-vm-01 linux-ethtool-ts]# ./tools/net/ynl/ethtool.py --show-time-stamping mlx5_1 Time stamping parameters for mlx5_1:
Capabilities:
hardware-transmit
hardware-receive
hardware-raw-clock
PTP Hardware Clock: 0
Hardware Transmit Timestamp Modes:
off
on
Hardware Receive Filter Modes:
none
all
Statistics:
tx-pkts: 8
tx-lost: 0
tx-err: 0Stable-dep-of: 45375814eb3f ("tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing")
--- tools/net/ynl/ethtool.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
tools/net/ynl/ethtool.py +10 -1
@@ -320,7 +320,13 @@ def main(): return if args.show_time_stamping: - tsinfo = dumpit(ynl, args, 'tsinfo-get') + req = { + 'header': { + 'flags': 'stats', + }, + } + + tsinfo = dumpit(ynl, args, 'tsinfo-get', req) print(f'Time stamping parameters for {args.device}:')
@@ -334,6 +340,9 @@ def main(): print('Hardware Receive Filter Modes:') [print(f'\t{v}') for v in bits_to_dict(tsinfo['rx-filters'])] + + print('Statistics:') + [print(f'\t{k}: {v}') for k, v in tsinfo['stats'].items()] return print(f'Settings for {args.device}:')
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/117 tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 45375814eb3f4245956c0c85092a4eee4441d167 ]
Fix a crash in the ethtool YNL implementation when Hardware Clock information is not present in the response. This ensures graceful handling of devices or drivers that do not provide this optional field. e.g.
Traceback (most recent call last):
File "/net/tools/net/ynl/pyynl/./ethtool.py", line 438, in <module>
main()
~~~~^^
File "/net/tools/net/ynl/pyynl/./ethtool.py", line 341, in main
print(f'PTP Hardware Clock: {tsinfo["phc-index"]}')
~~~~~~^^^^^^^^^^^^^KeyError: 'phc-index'
--- tools/net/ynl/ethtool.py | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
tools/net/ynl/ethtool.py +15 -7
@@ -333,16 +333,24 @@ def main(): print('Capabilities:') [print(f'\t{v}') for v in bits_to_dict(tsinfo['timestamping'])] - print(f'PTP Hardware Clock: {tsinfo["phc-index"]}') + print(f'PTP Hardware Clock: {tsinfo.get("phc-index", "none")}') - print('Hardware Transmit Timestamp Modes:') - [print(f'\t{v}') for v in bits_to_dict(tsinfo['tx-types'])] + if 'tx-types' in tsinfo: + print('Hardware Transmit Timestamp Modes:') + [print(f'\t{v}') for v in bits_to_dict(tsinfo['tx-types'])] + else: + print('Hardware Transmit Timestamp Modes: none') + + if 'rx-filters' in tsinfo: + print('Hardware Receive Filter Modes:') + [print(f'\t{v}') for v in bits_to_dict(tsinfo['rx-filters'])] + else: + print('Hardware Receive Filter Modes: none') - print('Hardware Receive Filter Modes:') - [print(f'\t{v}') for v in bits_to_dict(tsinfo['rx-filters'])] + if 'stats' in tsinfo and tsinfo['stats']: + print('Statistics:') + [print(f'\t{k}: {v}') for k, v in tsinfo['stats'].items()] - print('Statistics:') - [print(f'\t{k}: {v}') for k, v in tsinfo['stats'].items()] return print(f'Settings for {args.device}:')
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/117 mctp: no longer rely on net->dev_index_head[]
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2d20773aec14996b6cc4db92d885028319be683d ]
mctp_dump_addrinfo() is one of the last users of
net->dev_index_head[] in the control path.
Switch to for_each_netdev_dump() for better scalability.
Use C99 for mctp_device_rtnl_msg_handlers[] to prepare future RTNL removal from mctp_dump_addrinfo()
(mdev->addrs is not yet RCU protected)
Stable-dep-of: f11cf946c0a9 ("net: mctp: Don't access ifa_index when missing")
--- net/mctp/device.c | 50 ++++++++++++++++++----------------------------- 1 file changed, 19 insertions(+), 31 deletions(-)
net/mctp/device.c +19 -31
@@ -20,8 +20,7 @@#include <net/sock.h> struct mctp_dump_cb { -int h; -int idx; +unsigned long ifindex;size_t a_idx; };
@@ -115,43 +114,29 @@ static int mctp_dump_addrinfo(struct sk_buff *skb, struct netlink_callback *cb) {struct mctp_dump_cb *mcb = (void *)cb->ctx;struct net *net =sock_net (skb->sk); -struct hlist_head *head;struct net_device *dev;struct ifaddrmsg *hdr;struct mctp_dev *mdev; -int ifindex; -int idx =0 , rc; +int ifindex, rc; hdr =nlmsg_data (cb->nlh);// filter by ifindex if requested ifindex = hdr->ifa_index;rcu_read_lock (); -for (; mcb->h <NETDEV_HASHENTRIES ; mcb->h++, mcb->idx =0 ) { - idx =0 ; - head = &net->dev_index_head[mcb->h]; -hlist_for_each_entry_rcu (dev, head, index_hlist) { -if (idx >= mcb->idx && - (ifindex ==0 || ifindex == dev->ifindex)) { - mdev =__mctp_dev_get (dev); -if (mdev) { - rc =mctp_dump_dev_addrinfo (mdev, - skb, cb); -mctp_dev_put (mdev); -// Error indicates full buffer, this -// callback will get retried. -if (rc <0 ) - goto out; - } - } - idx++; -// reset for next iteration - mcb->a_idx =0 ; - } +for_each_netdev_dump (net, dev, mcb->ifindex) { +if (ifindex && ifindex != dev->ifindex) +continue ; + mdev =__mctp_dev_get (dev); +if (!mdev) +continue ; + rc =mctp_dump_dev_addrinfo (mdev, skb, cb); +mctp_dev_put (mdev); +if (rc <0 ) +break ; + mcb->a_idx =0 ; } -out:rcu_read_unlock (); - mcb->idx = idx;return skb->len; }
@@ -525,9 +510,12 @@ static struct notifier_block mctp_dev_nb = { };static const struct rtnl_msg_handler mctp_device_rtnl_msg_handlers[] = { - {THIS_MODULE ,PF_MCTP ,RTM_NEWADDR , mctp_rtm_newaddr,NULL ,0 }, - {THIS_MODULE ,PF_MCTP ,RTM_DELADDR , mctp_rtm_deladdr,NULL ,0 }, - {THIS_MODULE ,PF_MCTP ,RTM_GETADDR ,NULL , mctp_dump_addrinfo,0 }, + {.owner =THIS_MODULE , .protocol =PF_MCTP , .msgtype =RTM_NEWADDR , + .doit = mctp_rtm_newaddr}, + {.owner =THIS_MODULE , .protocol =PF_MCTP , .msgtype =RTM_DELADDR , + .doit = mctp_rtm_deladdr}, + {.owner =THIS_MODULE , .protocol =PF_MCTP , .msgtype =RTM_GETADDR , + .dumpit = mctp_dump_addrinfo}, };int __init mctp_device_init (void )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/117 net: mctp: Dont access ifa_index when missing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Johnston <[email protected]>
[ Upstream commit f11cf946c0a92c560a890d68e4775723353599e1 ]
In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but only when the struct ifaddrmsg is provided. Otherwise it will be comparing to uninitialised memory - reproducible in the syzkaller case from dhcpd, or busybox "ip addr show".
The kernel MCTP implementation has always filtered by ifa_index, so existing userspace programs expecting to dump MCTP addresses must already be passing a valid ifa_index value (either 0 or a real index).
BUG: KMSAN: uninit-value in mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128 mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128 rtnl_dump_all+0x3ec/0x5b0 net/core/rtnetlink.c:4380 rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6824 netlink_dump+0x97b/0x1690 net/netlink/af_netlink.c:2309
--- net/mctp/device.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
net/mctp/device.c +12 -5
@@ -117,11 +117,18 @@ static int mctp_dump_addrinfo(struct sk_buff *skb, struct netlink_callback *cb)struct net_device *dev;struct ifaddrmsg *hdr;struct mctp_dev *mdev; -int ifindex, rc; - - hdr =nlmsg_data (cb->nlh); -// filter by ifindex if requested - ifindex = hdr->ifa_index; +int ifindex =0 , rc; + +/* Filter by ifindex if a header is provided */ +if (cb->nlh->nlmsg_len >=nlmsg_msg_size (sizeof (*hdr))) { + hdr =nlmsg_data (cb->nlh); + ifindex = hdr->ifa_index; + }else { +if (cb->strict_check) { +NL_SET_ERR_MSG (cb->extack,"mctp: Invalid header for addr dump request" ); +return -EINVAL ; + } + }rcu_read_lock ();for_each_netdev_dump (net, dev, mcb->ifindex) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/117 net: mctp: Ensure keys maintain only one ref to corresponding dev
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Jeffery <[email protected]>
[ Upstream commit e4f349bd6e58051df698b82f94721f18a02a293d ]
mctp_flow_prepare_output() is called in mctp_route_output(), which places outbound packets onto a given interface. The packet may represent a message fragment, in which case we provoke an unbalanced reference count to the underlying device. This causes trouble if we ever attempt to remove the interface:
[ 48.702195] usb 1-1: USB disconnect, device number 2
[ 58.883056] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2
[ 69.022548] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2
[ 79.172568] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2
...Predicate the invocation of mctp_dev_set_key() in mctp_flow_prepare_output() on not already having associated the device with the key. It's not yet realistic to uphold the property that the key maintains only one device reference earlier in the transmission sequence as the route (and therefore the device) may not be known at the time the key is associated with the socket.
--- net/mctp/route.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mctp/route.c +3 -1
@@ -274,8 +274,10 @@ static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) key = flow->key; -if (WARN_ON (key->dev && key->dev != dev)) +if (key->dev) { +WARN_ON (key->dev != dev);return ; + }mctp_dev_set_key (dev, key); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/117 ALSA: seq: Fix delivery of UMP events to group ports
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit ff7b190aef6cccdb6f14d20c5753081fe6420e0b ]
When an event with UMP message is sent to a UMP client, the EP port receives always no matter where the event is sent to, as it's a catch-all port. OTOH, if an event is sent to EP port, and if the event has a certain UMP Group, it should have been delivered to the associated UMP Group port, too, but this was ignored, so far.
This patch addresses the behavior. Now a UMP event sent to the Endpoint port will be delivered to the subscribers of the UMP group port the event is associated with.
The patch also does a bit of refactoring to simplify the code about __deliver_to_subscribers().
--- sound/core/seq/seq_clientmgr.c | 52 ++++++++++++++++++++------------ sound/core/seq/seq_ump_convert.c | 18 +++++++++++ sound/core/seq/seq_ump_convert.h | 1 + 3 files changed, 52 insertions(+), 19 deletions(-)
sound/core/seq/seq_clientmgr.c +33 -19
@@ -736,15 +736,21 @@ static int snd_seq_deliver_single_event(struct snd_seq_client *client,*/ static int __deliver_to_subscribers (struct snd_seq_client *client,struct snd_seq_event *event, -struct snd_seq_client_port *src_port, -int atomic,int hop) +int port,int atomic,int hop) { +struct snd_seq_client_port *src_port;struct snd_seq_subscribers *subs;int err, result =0 , num_ev =0 ;union __snd_seq_event event_saved;size_t saved_size;struct snd_seq_port_subs_info *grp; +if (port <0 ) +return 0 ; + src_port =snd_seq_port_use_ptr (client, port); +if (!src_port) +return 0 ; +/* save original event record */ saved_size =snd_seq_event_packet_size (event);memcpy (&event_saved, event, saved_size);
@@ -780,6 +786,7 @@ static int __deliver_to_subscribers(struct snd_seq_client *client,read_unlock (&grp->list_lock); else up_read(&grp->list_mutex); +snd_seq_port_unlock (src_port);memcpy (event, &event_saved, saved_size);return (result <0 ) ? result : num_ev; }
@@ -788,25 +795,32 @@ static int deliver_to_subscribers(struct snd_seq_client *client,struct snd_seq_event *event, int atomic, int hop) { - struct snd_seq_client_port *src_port; -int ret =0 , ret2; - - src_port =snd_seq_port_use_ptr (client, event->source.port); -if (src_port) { - ret =__deliver_to_subscribers (client, event, src_port, atomic, hop); -snd_seq_port_unlock (src_port); - } - -if (client->ump_endpoint_port <0 || - event->source.port == client->ump_endpoint_port) -return ret; + int ret; +#if IS_ENABLED (CONFIG_SND_SEQ_UMP ) +int ret2; +#endif - src_port =snd_seq_port_use_ptr (client, client->ump_endpoint_port); -if (!src_port) + ret =__deliver_to_subscribers (client, event, + event->source.port, atomic, hop); +#if IS_ENABLED (CONFIG_SND_SEQ_UMP ) +if (!snd_seq_client_is_ump (client) || client->ump_endpoint_port <0 )return ret; - ret2 =__deliver_to_subscribers (client, event, src_port, atomic, hop); -snd_seq_port_unlock (src_port); -return ret2 <0 ? ret2 : ret; +/* If it's an event from EP port (and with a UMP group), +* deliver to subscribers of the corresponding UMP group port, too. +* Or, if it's from non-EP port, deliver to subscribers of EP port, too. +*/ +if (event->source.port == client->ump_endpoint_port) + ret2 =__deliver_to_subscribers (client, event, +snd_seq_ump_group_port (event), + atomic, hop); +else + ret2 =__deliver_to_subscribers (client, event, + client->ump_endpoint_port, + atomic, hop); +if (ret2 <0 ) +return ret2; +#endif +return ret; }/* deliver an event to the destination port(s).
sound/core/seq/seq_ump_convert.c +18 -0
@@ -1284,3 +1284,21 @@ int snd_seq_deliver_to_ump(struct snd_seq_client *source,else return cvt_to_ump_midi1 (dest, dest_port, event, atomic, hop); } + +/* return the UMP group-port number of the event; +* return -1 if groupless or non-UMP event +*/ +int snd_seq_ump_group_port (const struct snd_seq_event *event) +{ +const struct snd_seq_ump_event *ump_ev = + (const struct snd_seq_ump_event *)event; +unsigned char type; + +if (!snd_seq_ev_is_ump (event)) +return -1 ; + type =ump_message_type (ump_ev->ump[0 ]); +if (ump_is_groupless_msg (type)) +return -1 ; +/* group-port number starts from 1 */ +return ump_message_group (ump_ev->ump[0 ]) +1 ; +}
sound/core/seq/seq_ump_convert.h +1 -0
@@ -18,5 +18,6 @@ int snd_seq_deliver_to_ump(struct snd_seq_client *source,struct snd_seq_client_port *dest_port, struct snd_seq_event *event, int atomic, int hop); +int snd_seq_ump_group_port (const struct snd_seq_event *event);#endif /* __SEQ_UMP_CONVERT_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/117 ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit dd33993a9721ab1dae38bd37c9f665987d554239 ]
s/devince/device/
It's used only internally, so no any behavior changes.
--- drivers/usb/gadget/function/f_midi2.c | 2 +- include/sound/ump_msg.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/usb/gadget/function/f_midi2.c +1 -1
@@ -475,7 +475,7 @@ static void reply_ump_stream_ep_info(struct f_midi2_ep *ep)/* reply a UMP EP device info */ static void reply_ump_stream_ep_device (struct f_midi2_ep *ep) { -struct snd_ump_stream_msg_devince_info rep = { +struct snd_ump_stream_msg_device_info rep = { .type =UMP_MSG_TYPE_STREAM , .status =UMP_STREAM_MSG_STATUS_DEVICE_INFO , .manufacture_id = ep->info.manufacturer,
include/sound/ump_msg.h +2 -2
@@ -604,7 +604,7 @@ struct snd_ump_stream_msg_ep_info { } __packed;/* UMP Stream Message: Device Info Notification (128bit) */ -struct snd_ump_stream_msg_devince_info { +struct snd_ump_stream_msg_device_info {#ifdef __BIG_ENDIAN_BITFIELD/* 0 */ u32 type:4 ;
@@ -754,7 +754,7 @@ struct snd_ump_stream_msg_fb_name {union snd_ump_stream_msg {struct snd_ump_stream_msg_ep_discovery ep_discovery;struct snd_ump_stream_msg_ep_info ep_info; -struct snd_ump_stream_msg_devince_info device_info; +struct snd_ump_stream_msg_device_info device_info;struct snd_ump_stream_msg_stream_cfg stream_cfg;struct snd_ump_stream_msg_fb_discovery fb_discovery;struct snd_ump_stream_msg_fb_info fb_info;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/117 net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Othacehe <[email protected]>
[ Upstream commit c92d6089d8ad7d4d815ebcedee3f3907b539ff1f ]
There is a situation where after THALT is set high, TGO stays high as well. Because jiffies are never updated, as we are in a context with interrupts disabled, we never exit that loop and have a deadlock.
That deadlock was noticed on a sama5d4 device that stayed locked for days.
Use retries instead of jiffies so that the timeout really works and we do not have a deadlock anymore.
--- drivers/net/ethernet/cadence/macb_main.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +6 -13
@@ -1016,22 +1016,15 @@ static void macb_update_stats(struct macb *bp)static int macb_halt_tx (struct macb *bp) { -unsigned long halt_time, timeout; -u32 status; +u32 status;macb_writel (bp,NCR ,macb_readl (bp,NCR ) |MACB_BIT (THALT )); - timeout = jiffies +usecs_to_jiffies (MACB_HALT_TIMEOUT ); -do { - halt_time = jiffies; - status =macb_readl (bp,TSR ); -if (!(status &MACB_BIT (TGO ))) -return 0 ; - -udelay (250 ); - }while (time_before (halt_time, timeout)); - -return -ETIMEDOUT ; +/* Poll TSR until TGO is cleared or timeout. */ +return read_poll_timeout_atomic (macb_readl, status, + !(status &MACB_BIT (TGO )), +250 ,MACB_HALT_TIMEOUT , false, + bp,TSR ); }static void macb_tx_unmap (struct macb *bp,struct macb_tx_skb *tx_skb,int budget)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/117 net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 498625a8ab2c8e1c9ab5105744310e8d6952cc01 ]
It has been reported that when under a bridge with stp_state=1, the logs get spammed with this message:
[ 251.734607] fsl_dpaa2_eth dpni.5 eth0: Couldn't decode source port
Further debugging shows the following info associated with packets:
source_port=-1, switch_id=-1, vid=-1, vbid=1
In other words, they are data plane packets which are supposed to be decoded by dsa_tag_8021q_find_port_by_vbid(), but the latter (correctly) refuses to do so, because no switch port is currently in BR_STATE_LEARNING or BR_STATE_FORWARDING - so the packet is effectively unexpected.
The error goes away after the port progresses to BR_STATE_LEARNING in 15 seconds (the default forward_time of the bridge), because then, dsa_tag_8021q_find_port_by_vbid() can correctly associate the data plane packets with a plausible bridge port in a plausible STP state.
Re-reading IEEE 802.1D-1990, I see the following:
"4.4.2 Learning: (...) The Forwarding Process shall discard received frames."
IEEE 802.1D-2004 further clarifies:
"DISABLED, BLOCKING, LISTENING, and BROKEN all correspond to the DISCARDING port state. While those dot1dStpPortStates serve to distinguish reasons for discarding frames, the operation of the Forwarding and Learning processes is the same for all of them. (...) LISTENING represents a port that the spanning tree algorithm has selected to be part of the active topology (computing a Root Port or Designated Port role) but is temporarily discarding frames to guard against loops or incorrect learning."
Well, this is not what the driver does - instead it sets mac[port].ingress = true.
To get rid of the log spam, prevent unexpected data plane packets to be received by software by discarding them on ingress in the LISTENING state.
In terms of blame attribution: the prints only date back to commit d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID"). However, the settings would permit a LISTENING port to forward to a FORWARDING port, and the standard suggests that's not OK.
--- drivers/net/dsa/sja1105/sja1105_main.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/net/dsa/sja1105/sja1105_main.c +1 -5
@@ -2076,6 +2076,7 @@ static void sja1105_bridge_stp_state_set(struct dsa_switch *ds, int port,switch (state) {case BR_STATE_DISABLED :case BR_STATE_BLOCKING : +case BR_STATE_LISTENING :/* From UM10944 description of DRPDTAG (why put this there?): * "Management traffic flows to the port regardless of the state * of the INGRESS flag". So BPDUs are still be allowed to pass.
@@ -2085,11 +2086,6 @@ static void sja1105_bridge_stp_state_set(struct dsa_switch *ds, int port, mac[port].egress = false; mac[port].dyn_learn = false;break ; -case BR_STATE_LISTENING : - mac[port].ingress = true; - mac[port].egress = false; - mac[port].dyn_learn = false; -break ;case BR_STATE_LEARNING : mac[port].ingress = true; mac[port].egress = false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/117 nvme-pci: make nvme_pci_npages_prp() __always_inline
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 40696426b8c8c4f13cf6ac52f0470eed144be4b2 ]
The only reason nvme_pci_npages_prp() could be used as a compile-time known result in BUILD_BUG_ON() is because the compiler was always choosing to inline the function. Under special circumstances (sanitizer coverage functions disabled for __init functions on ARCH=um), the compiler decided to stop inlining it:
drivers/nvme/host/pci.c: In function 'nvme_init':
include/linux/compiler_types.h:557:45: error: call to '__compiletime_assert_678' declared with attribute error: BUILD_BUG_ON failed: nvme_pci_npages_prp() > NVME_MAX_NR_ALLOCATIONS
557 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:538:25: note: in definition of macro '__compiletime_assert'
538 | prefix ## suffix(); \
| ^~~~~~
include/linux/compiler_types.h:557:9: note: in expansion of macro '_compiletime_assert'
557 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert'
39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:50:9: note: in expansion of macro 'BUILD_BUG_ON_MSG'
50 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
| ^~~~~~~~~~~~~~~~
drivers/nvme/host/pci.c:3804:9: note: in expansion of macro 'BUILD_BUG_ON'
3804 | BUILD_BUG_ON(nvme_pci_npages_prp() > NVME_MAX_NR_ALLOCATIONS);
| ^~~~~~~~~~~~Force it to be __always_inline to make sure it is always available for use with BUILD_BUG_ON().
--- drivers/nvme/host/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/pci.c +1 -1
@@ -386,7 +386,7 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db,* as it only leads to a small amount of wasted memory for the lifetime of * the I/O. */ -static int nvme_pci_npages_prp (void ) +static __always_inline int nvme_pci_npages_prp(void) {unsigned max_bytes = (NVME_MAX_KB_SZ *1024 ) +NVME_CTRL_PAGE_SIZE ;unsigned nprps =DIV_ROUND_UP (max_bytes,NVME_CTRL_PAGE_SIZE );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/117 nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 3d8932133dcecbd9bef1559533c1089601006f45 ]
We need to lock this queue for that condition because the timeout work executes per-namespace and can poll the poll CQ.
--- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/pci.c +2 -0
@@ -1107,7 +1107,9 @@ static void nvme_poll_irqdisable(struct nvme_queue *nvmeq)WARN_ON_ONCE (test_bit (NVMEQ_POLLED , &nvmeq->flags));disable_irq (pci_irq_vector (pdev, nvmeq->cq_vector)); +spin_lock (&nvmeq->cq_poll_lock);nvme_poll_cq (nvmeq,NULL ); +spin_unlock (&nvmeq->cq_poll_lock);enable_irq (pci_irq_vector (pdev, nvmeq->cq_vector)); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/117 ALSA: sh: SND_AICA should depend on SH_DMA_API
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 66e48ef6ef506c89ec1b3851c6f9f5f80b5835ff ]
If CONFIG_SH_DMA_API=n:
WARNING: unmet direct dependencies detected for G2_DMA
Depends on [n]: SH_DREAMCAST [=y] && SH_DMA_API [=n]
Selected by [y]:
- SND_AICA [=y] && SOUND [=y] && SND [=y] && SND_SUPERH [=y] && SH_DREAMCAST [=y]
SND_AICA selects G2_DMA. As the latter depends on SH_DMA_API, the former should depend on SH_DMA_API, too.
--- sound/sh/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/sh/Kconfig +1 -1
@@ -14,7 +14,7 @@ if SND_SUPERH config SND_AICA tristate "Dreamcast Yamaha AICA sound" - depends on SH_DREAMCAST + depends on SH_DREAMCAST && SH_DMA_API select SND_PCM select G2_DMA help
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/117 net/mlx5e: Disable MACsec offload for uplink representor profile
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit 588431474eb7572e57a927fa8558c9ba2f8af143 ]
MACsec offload is not supported in switchdev mode for uplink representors. When switching to the uplink representor profile, the MACsec offload feature must be cleared from the netdevice's features.
If left enabled, attempts to add offloads result in a null pointer dereference, as the uplink representor does not support MACsec offload even though the feature bit remains set.
Clear NETIF_F_HW_MACSEC in mlx5e_fix_uplink_rep_features().
Kernel log:
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] CPU: 29 UID: 0 PID: 4714 Comm: ip Not tainted 6.14.0-rc4_for_upstream_debug_2025_03_02_17_35 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__mutex_lock+0x128/0x1dd0 Code: d0 7c 08 84 d2 0f 85 ad 15 00 00 8b 35 91 5c fe 03 85 f6 75 29 49 8d 7e 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a6 15 00 00 4d 3b 76 60 0f 85 fd 0b 00 00 65 ff RSP: 0018:ffff888147a4f160 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000078 RBP: ffff888147a4f2e0 R08: ffffffffa05d2c19 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888152de0000 FS: 00007f855e27d800(0000) GS:ffff88881ee80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004e5768 CR3: 000000013ae7c005 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 Call Trace: <TASK> ? die_addr+0x3d/0xa0 ? exc_general_protection+0x144/0x220 ? asm_exc_general_protection+0x22/0x30 ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] ? __mutex_lock+0x128/0x1dd0 ? lockdep_set_lock_cmp_fn+0x190/0x190 ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] ? mutex_lock_io_nested+0x1ae0/0x1ae0 ? lock_acquire+0x1c2/0x530 ? macsec_upd_offload+0x145/0x380 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? kasan_save_stack+0x30/0x40 ? kasan_save_stack+0x20/0x40 ? kasan_save_track+0x10/0x30 ? __kasan_kmalloc+0x77/0x90 ? __kmalloc_noprof+0x249/0x6b0 ? genl_family_rcv_msg_attrs_parse.constprop.0+0xb5/0x240 ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] ? mlx5e_macsec_add_rxsa+0x11a0/0x11a0 [mlx5_core] macsec_update_offload+0x26c/0x820 ? macsec_set_mac_address+0x4b0/0x4b0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? _raw_spin_unlock_irqrestore+0x47/0x50 macsec_upd_offload+0x2c8/0x380 ? macsec_update_offload+0x820/0x820 ? __nla_parse+0x22/0x30 ? genl_family_rcv_msg_attrs_parse.constprop.0+0x15e/0x240 genl_family_rcv_msg_doit+0x1cc/0x2a0 ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240 ? cap_capable+0xd4/0x330 genl_rcv_msg+0x3ea/0x670 ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0 ? lockdep_set_lock_cmp_fn+0x190/0x190 ? macsec_update_offload+0x820/0x820 netlink_rcv_skb+0x12b/0x390 ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0 ? netlink_ack+0xd80/0xd80 ? rwsem_down_read_slowpath+0xf90/0xf90 ? netlink_deliver_tap+0xcd/0xac0 ? netlink_deliver_tap+0x155/0xac0 ? _copy_from_iter+0x1bb/0x12c0 genl_rcv+0x24/0x40 netlink_unicast+0x440/0x700 ? netlink_attachskb+0x760/0x760 ? lock_acquire+0x1c2/0x530 ? __might_fault+0xbb/0x170 netlink_sendmsg+0x749/0xc10 ? netlink_unicast+0x700/0x700 ? __might_fault+0xbb/0x170 ? netlink_unicast+0x700/0x700 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x53f/0x760 ? import_iovec+0x7/0x10 ? kernel_sendmsg+0x30/0x30 ? __copy_msghdr+0x3c0/0x3c0 ? filter_irq_stacks+0x90/0x90 ? stack_depot_save_flags+0x28/0xa30 ___sys_sendmsg+0xeb/0x170 ? kasan_save_stack+0x30/0x40 ? copy_msghdr_from_user+0x110/0x110 ? do_syscall_64+0x6d/0x140 ? lock_acquire+0x1c2/0x530 ? __virt_addr_valid+0x116/0x3b0 ? __virt_addr_valid+0x1da/0x3b0 ? lock_downgrade+0x680/0x680 ? __delete_object+0x21/0x50 __sys_sendmsg+0xf7/0x180 ? __sys_sendmsg_sock+0x20/0x20 ? kmem_cache_free+0x14c/0x4e0 ? __x64_sys_close+0x78/0xd0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f855e113367 Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RSP: 002b:00007ffd15e90c88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f855e113367 RDX: 0000000000000000 RSI: 00007ffd15e90cf0 RDI: 0000000000000004 RBP: 00007ffd15e90dbc R08: 0000000000000028 R09: 000000000045d100 R10: 00007f855e011dd8 R11: 0000000000000246 R12: 0000000000000019 R13: 0000000067c6b785 R14: 00000000004a1e80 R15: 0000000000000000 </TASK> Modules linked in: 8021q garp mrp sch_ingress openvswitch nsh mlx5_ib mlx5_fwctl mlx5_dpll mlx5_core rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: mlx5_core] ---[ end trace 0000000000000000 ]---
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +4 -0
@@ -4136,6 +4136,10 @@ static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdevif (netdev->features &NETIF_F_HW_VLAN_CTAG_FILTER )netdev_warn (netdev,"Disabling HW_VLAN CTAG FILTERING, not supported in switchdev mode\n" ); + features &= ~NETIF_F_HW_MACSEC ; +if (netdev->features &NETIF_F_HW_MACSEC ) +netdev_warn (netdev,"Disabling HW MACsec offload, not supported in switchdev mode\n" ); +return features; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/117 qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 9d8a99c5a7c7f4f7eca2c168a4ec254409670035 ]
In one of the error paths in qlcnic_sriov_channel_cfg_cmd(), the memory allocated in qlcnic_sriov_alloc_bc_mbx_args() for mailbox arguments is not freed. Fix that by jumping to the error path that frees them, by calling qlcnic_free_mbx_args(). This was found using static analysis.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +5 -2
@@ -1484,8 +1484,11 @@ static int qlcnic_sriov_channel_cfg_cmd(struct qlcnic_adapter *adapter, u8 cmd_o } cmd_op = (cmd.rsp.arg[0 ] &0xff ); -if (cmd.rsp.arg[0 ] >>25 ==2 ) -return 2 ; +if (cmd.rsp.arg[0 ] >>25 ==2 ) { + ret =2 ; + goto out; + } +if (cmd_op ==QLCNIC_BC_CMD_CHANNEL_INIT )set_bit (QLC_BC_VF_STATE , &vf->state);else
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/117 regulator: max20086: fix invalid memory access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <[email protected]>
[ Upstream commit 6b0cd72757c69bc2d45da42b41023e288d02e772 ]
max20086_parse_regulators_dt() calls of_regulator_match() using an array of struct of_regulator_match allocated on the stack for the matches argument.
of_regulator_match() calls devm_of_regulator_put_matches(), which calls devres_alloc() to allocate a struct devm_of_regulator_matches which will be de-allocated using devm_of_regulator_put_matches().
struct devm_of_regulator_matches is populated with the stack allocated matches array.
If the device fails to probe, devm_of_regulator_put_matches() will be called and will try to call of_node_put() on that stack pointer, generating the following dmesg entries:
max20086 6-0028: Failed to read DEVICE_ID reg: -121
kobject: '\xc0$\xa5\x03' (000000002cebcb7a): is not initialized, yet kobject_put() is being called.
Followed by a stack trace matching the call flow described above.
Switch to allocating the matches array using devm_kcalloc() to avoid accessing the stack pointer long after it's out of scope.
This also has the advantage of allowing multiple max20086 to probe without overriding the data stored inside the global of_regulator_match.
--- drivers/regulator/max20086-regulator.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/regulator/max20086-regulator.c +6 -1
@@ -132,7 +132,7 @@ static int max20086_regulators_register(struct max20086 *chip)static int max20086_parse_regulators_dt (struct max20086 *chip,bool *boot_on) { -struct of_regulator_match matches[MAX20086_MAX_REGULATORS ] = { }; +struct of_regulator_match *matches;struct device_node *node;unsigned int i;int ret;
@@ -143,6 +143,11 @@ static int max20086_parse_regulators_dt(struct max20086 *chip, bool *boot_on)return -ENODEV ; } + matches =devm_kcalloc (chip->dev, chip->info->num_outputs, +sizeof (*matches),GFP_KERNEL ); +if (!matches) +return -ENOMEM ; +for (i =0 ; i < chip->info->num_outputs; ++i) matches[i].name = max20086_output_names[i];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/117 octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit 865ab2461375e3a5a2526f91f9a9f17b8931bc9e ]
MASCEC hardware block has a field called maximum transmit size for TX secy. Max packet size going out of MCS block has be programmed taking into account full packet size which has L2 header,SecTag and ICV. MACSEC offload driver is configuring max transmit size as macsec interface MTU which is incorrect. Say with 1500 MTU of real device, macsec interface created on top of real device will have MTU of 1468(1500 - (SecTag + ICV)). This is causing packets from macsec interface of size greater than or equal to 1468 are not getting transmitted out because driver programmed max transmit size as 1468 instead of 1514(1500 + ETH_HDR_LEN).
--- drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c +2 -1
@@ -533,7 +533,8 @@ static int cn10k_mcs_write_tx_secy(struct otx2_nic *pfvf,if (sw_tx_sc->encrypt) sectag_tci |= (MCS_TCI_E |MCS_TCI_C ); - policy =FIELD_PREP (MCS_TX_SECY_PLCY_MTU , secy->netdev->mtu); + policy =FIELD_PREP (MCS_TX_SECY_PLCY_MTU , + pfvf->netdev->mtu +OTX2_ETH_HLEN );/* Write SecTag excluding AN bits(1..0) */ policy |=FIELD_PREP (MCS_TX_SECY_PLCY_ST_TCI , sectag_tci >>2 ); policy |=FIELD_PREP (MCS_TX_SECY_PLCY_ST_OFFSET , tag_offset);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/117 net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo-Cun Chen <[email protected]>
[ Upstream commit 1bdea6fad6fb985ff13828373c48e337c4e939f9 ]
Since MTK_ESW_BIT is a bit number rather than a bitmap, it causes MTK_HAS_CAPS to produce incorrect results. This leads to the ETH driver not declaring MAC capabilities correctly for the MT7988 ESW.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +1 -1
@@ -4628,7 +4628,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np) }if (mtk_is_netsys_v3_or_greater (mac->hw) && -MTK_HAS_CAPS (mac->hw->soc->caps,MTK_ESW_BIT ) && +MTK_HAS_CAPS (mac->hw->soc->caps,MTK_ESW ) && id ==MTK_GMAC1_ID ) { mac->phylink_config.mac_capabilities =MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/117 octeontx2-af: Fix CGX Receive counters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hariprasad Kelam <[email protected]>
[ Upstream commit bf449f35e77fd44017abf991fac1f9ab7705bbe0 ]
Each CGX block supports 4 logical MACs (LMACS). Receive counters CGX_CMR_RX_STAT0-8 are per LMAC and CGX_CMR_RX_STAT9-12 are per CGX.
Due a bug in previous patch, stale Per CGX counters values observed.
--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +5 -0
@@ -707,6 +707,11 @@ int cgx_get_rx_stats(void *cgxd, int lmac_id, int idx, u64 *rx_stat)if (!is_lmac_valid (cgx, lmac_id))return -ENODEV ; + +/* pass lmac as 0 for CGX_CMR_RX_STAT9-12 */ +if (idx >=CGX_RX_STAT_GLOBAL_INDEX ) + lmac_id =0 ; + *rx_stat =cgx_read (cgx, lmac_id,CGXX_CMRX_RX_STAT0 + (idx *8 ));return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/117 wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 82bbe02b2500ef0a62053fe2eb84773fe31c5a0a ]
Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller:
UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5
index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
This was missed in the initial conversions because I failed to locate the allocation likely due to the "sizeof(void *)" not matching the "channels" array type.
--- net/mac80211/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/mac80211/main.c +4 -2
@@ -1186,10 +1186,12 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)return -EINVAL ; } - local->int_scan_req =kzalloc (sizeof (*local->int_scan_req) + -sizeof (void *) * channels,GFP_KERNEL ); + local->int_scan_req =kzalloc (struct_size (local->int_scan_req, + channels, channels), +GFP_KERNEL );if (!local->int_scan_req)return -ENOMEM ; + local->int_scan_req->n_channels = channels;eth_broadcast_addr (local->int_scan_req->bssid);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/117 mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 92ec4855034b2c4d13f117558dc73d20581fa9ff ]
The driver only offloads neighbors that are constructed on top of net devices registered by it or their uppers (which are all Ethernet). The device supports GRE encapsulation and decapsulation of forwarded traffic, but the driver will not offload dummy neighbors constructed on top of GRE net devices as they are not uppers of its net devices:
# ip link add name gre1 up type gre tos inherit local 192.0.2.1 remote 198.51.100.1 # ip neigh add 0.0.0.0 lladdr 0.0.0.0 nud noarp dev gre1 $ ip neigh show dev gre1 nud noarp 0.0.0.0 lladdr 0.0.0.0 NOARP
(Note that the neighbor is not marked with 'offload')
When the driver is reloaded and the existing configuration is replayed, the driver does not perform the same check regarding existing neighbors and offloads the previously added one:
# devlink dev reload pci/0000:01:00.0 $ ip neigh show dev gre1 nud noarp 0.0.0.0 lladdr 0.0.0.0 offload NOARP
If the neighbor is later deleted, the driver will ignore the notification (given the GRE net device is not its upper) and will therefore keep referencing freed memory, resulting in a use-after-free
[1] when the net device is deleted:
# ip neigh del 0.0.0.0 lladdr 0.0.0.0 dev gre1 # ip link del dev gre1
Fix by skipping neighbor replay if the net device for which the replay is performed is not our upper.
[1]
BUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x1ea/0x200 Read of size 8 at addr ffff888155b0e420 by task ip/2282 [...] Call Trace: <TASK> dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x6f/0x350 print_report+0x108/0x205 kasan_report+0xdf/0x110 mlxsw_sp_neigh_entry_update+0x1ea/0x200 mlxsw_sp_router_rif_gone_sync+0x2a8/0x440 mlxsw_sp_rif_destroy+0x1e9/0x750 mlxsw_sp_netdevice_ipip_ol_event+0x3c9/0xdc0 mlxsw_sp_router_netdevice_event+0x3ac/0x15e0 notifier_call_chain+0xca/0x150 call_netdevice_notifiers_info+0x7f/0x100 unregister_netdevice_many_notify+0xc8c/0x1d90 rtnl_dellink+0x34e/0xa50 rtnetlink_rcv_msg+0x6fb/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +3 -0
@@ -3013,6 +3013,9 @@ static int mlxsw_sp_neigh_rif_made_sync(struct mlxsw_sp *mlxsw_sp, .rif = rif, }; +if (!mlxsw_sp_dev_lower_is_port (mlxsw_sp_rif_dev (rif))) +return 0 ; +neigh_for_each (&arp_tbl, mlxsw_sp_neigh_rif_made_sync_each, &rms);if (rms.err) goto err_arp;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/117 net/tls: fix kernel panic when alloc_page failed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengtao He <[email protected]>
[ Upstream commit 491deb9b8c4ad12fe51d554a69b8165b9ef9429f ]
We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_sock is called.
This is because we don't reset full_len in tls_strp_flush_anchor_copy() so the recv path will try to continue handling the partial record on the next call but we dettached the rcvq from the frag list. Alternative fix would be to reset full_len.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Call trace: tls_strp_check_rcv+0x128/0x27c tls_strp_data_ready+0x34/0x44 tls_data_ready+0x3c/0x1f0 tcp_data_ready+0x9c/0xe4 tcp_data_queue+0xf6c/0x12d0 tcp_rcv_established+0x52c/0x798
--- net/tls/tls_strp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/tls/tls_strp.c +2 -1
@@ -395,7 +395,6 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort)return 0 ; shinfo =skb_shinfo (strp->anchor); - shinfo->frag_list =NULL ;/* If we don't know the length go max plus page for cipher overhead */ need_spc = strp->stm.full_len ?:TLS_MAX_PAYLOAD_SIZE +PAGE_SIZE ;
@@ -411,6 +410,8 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort) page, 0, 0); } + shinfo->frag_list =NULL ; + strp->copy_mode =1 ; strp->stm.offset =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/117 tsnep: Inline small fragments within TX descriptor
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerhard Engleder <[email protected]>
[ Upstream commit dccce1d7c04051bc25d3abbe7716d0ae7af9c28a ]
The tsnep network controller is able to extend the descriptor directly with data to be transmitted. In this case no TX data DMA address is necessary. Instead of the TX data DMA address the TX data buffer is placed at the end of the descriptor.
The descriptor is read with a 64 bytes DMA read by the tsnep network controller. If the sum of descriptor data and TX data is less than or equal to 64 bytes, then no additional DMA read is necessary to read the TX data. Therefore, it makes sense to inline small fragments up to this limit within the descriptor ring.
Inlined fragments need to be copied to the descriptor ring. On the other hand DMA mapping is not necessary. At most 40 bytes are copied, so copying should be faster than DMA mapping.
For A53 1.2 GHz copying takes <100ns and DMA mapping takes >200ns. So inlining small fragments should result in lower CPU load. Performance improvement is small. Thus, comparision of CPU load with and without inlining of small fragments did not show any significant difference. With this optimization less DMA reads will be done, which decreases the load of the interconnect.
Stable-dep-of: b3ca9eef6646 ("tsnep: fix timestamping with a stacked DSA driver")
--- drivers/net/ethernet/engleder/tsnep_hw.h | 2 + drivers/net/ethernet/engleder/tsnep_main.c | 103 +++++++++++++++------ 2 files changed, 79 insertions(+), 26 deletions(-)
drivers/net/ethernet/engleder/tsnep_hw.h +2 -0
@@ -181,6 +181,8 @@ struct tsnep_gcl_operation {#define TSNEP_DESC_SIZE 256#define TSNEP_DESC_SIZE_DATA_AFTER 2048#define TSNEP_DESC_OFFSET 128 +#define TSNEP_DESC_SIZE_DATA_AFTER_INLINE (64 - sizeof(struct tsnep_tx_desc) + \ + sizeof_field(struct tsnep_tx_desc, tx))#define TSNEP_DESC_OWNER_COUNTER_MASK 0xC0000000#define TSNEP_DESC_OWNER_COUNTER_SHIFT 30#define TSNEP_DESC_LENGTH_MASK 0x00003FFF
drivers/net/ethernet/engleder/tsnep_main.c +77 -26
154 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/117 tsnep: fix timestamping with a stacked DSA driver
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerhard Engleder <[email protected]>
[ Upstream commit b3ca9eef6646576ad506a96d941d87a69f66732a ]
This driver is susceptible to a form of the bug explained in commit c26a2c2ddc01 ("gianfar: Fix TX timestamping with a stacked DSA driver") and in Documentation/networking/timestamping.rst section "Other caveats for MAC drivers", specifically it timestamps any skb which has SKBTX_HW_TSTAMP, and does not consider if timestamping has been enabled in adapter->hwtstamp_config.tx_type.
Evaluate the proper TX timestamping condition only once on the TX path (in tsnep_xmit_frame_ring()) and store the result in an additional TX entry flag. Evaluate the new TX entry flag in the TX confirmation path (in tsnep_tx_poll()).
This way SKBTX_IN_PROGRESS is set by the driver as required, but never evaluated. SKBTX_IN_PROGRESS shall not be evaluated as it can be set by a stacked DSA driver and evaluating it would lead to unwanted timestamps.
--- drivers/net/ethernet/engleder/tsnep_main.c | 30 ++++++++++++++-------- 1 file changed, 19 insertions(+), 11 deletions(-)
drivers/net/ethernet/engleder/tsnep_main.c +19 -11
@@ -67,6 +67,8 @@#define TSNEP_TX_TYPE_XDP_NDO_MAP_PAGE (TSNEP_TX_TYPE_XDP_NDO | TSNEP_TX_TYPE_MAP_PAGE)#define TSNEP_TX_TYPE_XDP (TSNEP_TX_TYPE_XDP_TX | TSNEP_TX_TYPE_XDP_NDO)#define TSNEP_TX_TYPE_XSK BIT(12) +#define TSNEP_TX_TYPE_TSTAMP BIT(13) +#define TSNEP_TX_TYPE_SKB_TSTAMP (TSNEP_TX_TYPE_SKB | TSNEP_TX_TYPE_TSTAMP)#define TSNEP_XDP_TX BIT(0)#define TSNEP_XDP_REDIRECT BIT(1)
@@ -385,8 +387,7 @@ static void tsnep_tx_activate(struct tsnep_tx *tx, int index, int length,if (entry->skb) { entry->properties = length &TSNEP_DESC_LENGTH_MASK ; entry->properties |=TSNEP_DESC_INTERRUPT_FLAG ; -if ((entry->type &TSNEP_TX_TYPE_SKB ) && - (skb_shinfo (entry->skb)->tx_flags &SKBTX_IN_PROGRESS )) +if ((entry->type &TSNEP_TX_TYPE_SKB_TSTAMP ) ==TSNEP_TX_TYPE_SKB_TSTAMP ) entry->properties |=TSNEP_DESC_EXTENDED_WRITEBACK_FLAG ;/* toggle user flag to prevent false acknowledge
@@ -478,7 +479,8 @@ static int tsnep_tx_map_frag(skb_frag_t *frag, struct tsnep_tx_entry *entry,return mapped; } -static int tsnep_tx_map (struct sk_buff *skb,struct tsnep_tx *tx,int count) +static int tsnep_tx_map (struct sk_buff *skb,struct tsnep_tx *tx,int count, +bool do_tstamp) {struct device *dmadev = tx->adapter->dmadev;struct tsnep_tx_entry *entry;
@@ -504,6 +506,9 @@ static int tsnep_tx_map(struct sk_buff *skb, struct tsnep_tx *tx, int count) entry->type =TSNEP_TX_TYPE_SKB_INLINE ; mapped =0 ; } + +if (do_tstamp) + entry->type |=TSNEP_TX_TYPE_TSTAMP ; }else {skb_frag_t *frag = &skb_shinfo (skb)->frags[i -1 ];
@@ -557,11 +562,12 @@ static int tsnep_tx_unmap(struct tsnep_tx *tx, int index, int count)static netdev_tx_t tsnep_xmit_frame_ring (struct sk_buff *skb,struct tsnep_tx *tx) { -int count =1 ;struct tsnep_tx_entry *entry; +bool do_tstamp = false; +int count =1 ;int length; -int i;int retval; +int i;if (skb_shinfo (skb)->nr_frags >0 ) count +=skb_shinfo (skb)->nr_frags;
@@ -578,7 +584,13 @@ static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb, entry = &tx->entry[tx->write]; entry->skb = skb; - retval =tsnep_tx_map (skb, tx, count); +if (unlikely (skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP ) && + tx->adapter->hwtstamp_config.tx_type ==HWTSTAMP_TX_ON ) { +skb_shinfo (skb)->tx_flags |=SKBTX_IN_PROGRESS ; + do_tstamp = true; + } + + retval =tsnep_tx_map (skb, tx, count, do_tstamp);if (retval <0 ) {tsnep_tx_unmap (tx, tx->write, count);dev_kfree_skb_any (entry->skb);
@@ -590,9 +602,6 @@ static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb, } length = retval; -if (skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP ) -skb_shinfo (skb)->tx_flags |=SKBTX_IN_PROGRESS ; -for (i =0 ; i < count; i++)tsnep_tx_activate (tx, (tx->write + i) &TSNEP_RING_MASK , length, i == count -1 );
@@ -843,8 +852,7 @@ static bool tsnep_tx_poll(struct tsnep_tx *tx, int napi_budget) length =tsnep_tx_unmap (tx, tx->read, count); -if ((entry->type &TSNEP_TX_TYPE_SKB ) && - (skb_shinfo (entry->skb)->tx_flags &SKBTX_IN_PROGRESS ) && +if (((entry->type &TSNEP_TX_TYPE_SKB_TSTAMP ) ==TSNEP_TX_TYPE_SKB_TSTAMP ) && (__le32_to_cpu (entry->desc_wb->properties) &TSNEP_DESC_EXTENDED_WRITEBACK_FLAG )) {struct skb_shared_hwtstamps hwtstamps;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/117 NFSv4/pnfs: Reset the layout state after a layoutreturn
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 6d6d7f91cc8c111d40416ac9240a3bb9396c5235 ]
If there are still layout segments in the layout plh_return_lsegs list after a layout return, we should be resetting the state to ensure they eventually get returned as well.
--- fs/nfs/pnfs.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/nfs/pnfs.c +9 -0
@@ -732,6 +732,14 @@ pnfs_mark_matching_lsegs_invalid(structreturn remaining; } +static void pnfs_reset_return_info (struct pnfs_layout_hdr *lo) +{ +struct pnfs_layout_segment *lseg; + +list_for_each_entry (lseg, &lo->plh_return_segs, pls_list) +pnfs_set_plh_return_info (lo, lseg->pls_range.iomode,0 ); +} + static void pnfs_free_returned_lsegs(struct pnfs_layout_hdr *lo, struct list_head *free_me,
@@ -1180,6 +1188,7 @@ void pnfs_layoutreturn_free_lsegs(structpnfs_mark_matching_lsegs_invalid (lo, &freeme, range, seq);pnfs_free_returned_lsegs (lo, &freeme, range, seq);pnfs_set_layout_stateid (lo, stateid,NULL , true); +pnfs_reset_return_info (lo); }else pnfs_mark_layout_stateid_invalid (lo, &freeme); out_unlock:
Greg Kroah-Hartman
maintainerPATCH 61/117 dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
commit df180e65305f8c1e020d54bfc2132349fd693de1 upstream.
Several issues with this change:
* The analysis is flawed and it's unclear what problem is being fixed. There is no difference between wait_event_freezable_timeout() and wait_event_timeout() with respect to device interrupts. And of course "the interrupt notifying the finish of an operation happens during wait_event_freezable_timeout()" -- that's how it's supposed to work.
* The link at the "Closes:" tag appears to be an unrelated use-after-free in idxd.
* It introduces a regression: dmatest threads are meant to be freezable and this change breaks that.
See discussion here:
https://lore.kernel.org/dmaengine/[email protected]/
--- drivers/dma/dmatest.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/dma/dmatest.c +3 -3
@@ -827,9 +827,9 @@ static int dmatest_func(void *data) }else {dma_async_issue_pending (chan); -wait_event_timeout (thread->done_wait, - done->done, -msecs_to_jiffies (params->timeout)); +wait_event_freezable_timeout (thread->done_wait, + done->done, +msecs_to_jiffies (params->timeout)); status =dma_async_is_tx_complete (chan, cookie,NULL ,NULL );
Greg Kroah-Hartman
maintainerPATCH 62/117 udf: Make sure i_lenExtents is uptodate on inode eviction
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 55dd5b4db3bf04cf077a8d1712f6295d4517c337 upstream.
UDF maintains total length of all extents in i_lenExtents. Generally we keep extent lengths (and thus i_lenExtents) block aligned because it makes the file appending logic simpler. However the standard mandates that the inode size must match the length of all extents and thus we trim the last extent when closing the file. To catch possible bugs we also verify that i_lenExtents matches i_size when evicting inode from memory. Commit b405c1e58b73 ("udf: refactor udf_next_aext() to handle error") however broke the code updating i_lenExtents and thus udf_evict_inode() ended up spewing lots of errors about incorrectly sized extents although the extents were actually sized properly. Fix the updating of i_lenExtents to silence the errors.
--- fs/udf/truncate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/udf/truncate.c +1 -1
@@ -115,7 +115,7 @@ void udf_truncate_tail_extent(struct ino }/* This inode entry is in-memory only and thus we don't have to mark * the inode dirty */ -if (ret ==0 ) +if (ret >=0 ) iinfo->i_lenExtents = inode->i_size;brelse (epos.bh); }
Greg Kroah-Hartman
maintainerPATCH 63/117 LoongArch: Prevent cond_resched() occurring within kernel-fpu
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianyang Zhang <[email protected]>
commit 2468b0e3d5659dfde77f081f266e1111a981efb8 upstream.
When CONFIG_PREEMPT_COUNT is not configured (i.e. CONFIG_PREEMPT_NONE/ CONFIG_PREEMPT_VOLUNTARY), preempt_disable() / preempt_enable() merely acts as a barrier(). However, in these cases cond_resched() can still trigger a context switch and modify the CSR.EUEN, resulting in do_fpu() exception being activated within the kernel-fpu critical sections, as demonstrated in the following path:
dcn32_calculate_wm_and_dlg()
DC_FP_START()
dcn32_calculate_wm_and_dlg_fpu()
dcn32_find_dummy_latency_index_for_fw_based_mclk_switch()
dcn32_internal_validate_bw()
dcn32_enable_phantom_stream()
dc_create_stream_for_sink()
kzalloc(GFP_KERNEL)
__kmem_cache_alloc_node()
__cond_resched()
DC_FP_END()This patch is similar to commit d02198550423a0b (x86/fpu: Improve crypto performance by making kernel-mode FPU reliably usable in softirqs). It uses local_bh_disable() instead of preempt_disable() for non-RT kernels so it can avoid the cond_resched() issue, and also extend the kernel-fpu application scenarios to the softirq context.
--- arch/loongarch/kernel/kfpu.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
arch/loongarch/kernel/kfpu.c +20 -2
@@ -18,11 +18,28 @@ static unsigned int euen_mask = CSR_EUEN static DEFINE_PER_CPU(bool, in_kernel_fpu); static DEFINE_PER_CPU(unsigned int, euen_current); +static inline void fpregs_lock (void ) +{ +if (IS_ENABLED (CONFIG_PREEMPT_RT )) +preempt_disable (); +else +local_bh_disable (); +} + +static inline void fpregs_unlock (void ) +{ +if (IS_ENABLED (CONFIG_PREEMPT_RT )) +preempt_enable (); +else +local_bh_enable (); +} +void kernel_fpu_begin (void ) {unsigned int *euen_curr; -preempt_disable (); +if (!irqs_disabled ()) +fpregs_lock ();WARN_ON (this_cpu_read (in_kernel_fpu));
@@ -73,7 +90,8 @@ void kernel_fpu_end(void)this_cpu_write (in_kernel_fpu, false); -preempt_enable (); +if (!irqs_disabled ()) +fpregs_unlock (); }EXPORT_SYMBOL_GPL (kernel_fpu_end);
Greg Kroah-Hartman
maintainerPATCH 64/117 LoongArch: Save and restore CSR.CNTC for hibernation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit ceb9155d058a11242aa0572875c44e9713b1a2be upstream.
Save and restore CSR.CNTC for hibernation which is similar to suspend.
For host this is unnecessary because sched clock is ensured continuous, but for kvm guest sched clock isn't enough because rdtime.d should also be continuous.
Host::rdtime.d = Host::CSR.CNTC + counterGuest::rdtime.d = Host::CSR.CNTC + Host::CSR.GCNTC + Guest::CSR.CNTC + counter
so,
Guest::rdtime.d = Host::rdtime.d + Host::CSR.GCNTC + Guest::CSR.CNTC
To ensure Guest::rdtime.d continuous, Host::rdtime.d should be at first continuous, while Host::CSR.GCNTC / Guest::CSR.CNTC is maintained by KVM.
--- arch/loongarch/kernel/time.c | 2 +- arch/loongarch/power/hibernate.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
arch/loongarch/kernel/time.c +1 -1
@@ -110,7 +110,7 @@ static unsigned long __init get_loops_pereturn lpj; } -static long init_offset __nosavedata; +static long init_offset;void save_counter (void ) {
arch/loongarch/power/hibernate.c +3 -0
@@ -2,6 +2,7 @@#include <asm/fpu.h> #include <asm/loongson.h> #include <asm/sections.h> +#include <asm/time.h> #include <asm/tlbflush.h> #include <linux/suspend.h>
@@ -14,6 +15,7 @@ struct pt_regs saved_regs;void save_processor_state (void ) { +save_counter (); saved_crmd =csr_read32 (LOONGARCH_CSR_CRMD ); saved_prmd =csr_read32 (LOONGARCH_CSR_PRMD ); saved_euen =csr_read32 (LOONGARCH_CSR_EUEN );
@@ -26,6 +28,7 @@ void save_processor_state(void)void restore_processor_state (void ) { +sync_counter ();csr_write32 (saved_crmd,LOONGARCH_CSR_CRMD );csr_write32 (saved_prmd,LOONGARCH_CSR_PRMD );csr_write32 (saved_euen,LOONGARCH_CSR_EUEN );
Greg Kroah-Hartman
maintainerPATCH 65/117 LoongArch: Fix MAX_REG_OFFSET calculation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 90436d234230e9a950ccd87831108b688b27a234 upstream.
Fix MAX_REG_OFFSET calculation, make it point to the last register in 'struct pt_regs' and not to the marker itself, which could allow regs_get_register() to return an invalid offset.
--- arch/loongarch/include/asm/ptrace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/include/asm/ptrace.h +1 -1
@@ -55,7 +55,7 @@ static inline void instruction_pointer_s/* Query offset/name of register from its name/offset */ extern int regs_query_register_offset (const char *name); -#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last)) +#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last) - sizeof(unsigned long))/** * regs_get_register() - get register value from its offset
Greg Kroah-Hartman
maintainerPATCH 66/117 LoongArch: uprobes: Remove user_{en,dis}able_single_step()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
commit 0b326b2371f94e798137cc1a3c5c2eef2bc69061 upstream.
When executing the "perf probe" and "perf stat" test cases about some cryptographic algorithm, the output shows that "Trace/breakpoint trap". This is because it uses the software singlestep breakpoint for uprobes on LoongArch, and no need to use the hardware singlestep. So just remove the related function call to user_{en,dis}able_single_step() for uprobes on LoongArch.
How to reproduce:
Please make sure CONFIG_UPROBE_EVENTS is set and openssl supports sm2 algorithm, then execute the following command.
cd tools/perf && make
./perf probe -x /usr/lib64/libcrypto.so BN_mod_mul_montgomery ./perf stat -e probe_libcrypto:BN_mod_mul_montgomery openssl speed sm2
--- arch/loongarch/kernel/uprobes.c | 4 ---- 1 file changed, 4 deletions(-)
arch/loongarch/kernel/uprobes.c +0 -4
@@ -42,7 +42,6 @@ int arch_uprobe_pre_xol(struct arch_upro utask->autask.saved_trap_nr = current->thread.trap_nr; current->thread.trap_nr =UPROBE_TRAP_NR ;instruction_pointer_set (regs, utask->xol_vaddr); -user_enable_single_step (current);return 0 ; }
@@ -59,8 +58,6 @@ int arch_uprobe_post_xol(struct arch_uprelse instruction_pointer_set (regs, utask->vaddr +LOONGARCH_INSN_SIZE ); -user_disable_single_step (current); -return 0 ; }
@@ -70,7 +67,6 @@ void arch_uprobe_abort_xol(struct arch_u current->thread.trap_nr = utask->autask.saved_trap_nr;instruction_pointer_set (regs, utask->vaddr); -user_disable_single_step (current); }bool arch_uprobe_xol_was_trapped (struct task_struct *t)
Greg Kroah-Hartman
maintainerPATCH 67/117 LoongArch: uprobes: Remove redundant code about resume_era
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
commit 12614f794274f63fbdfe76771b2b332077d63848 upstream.
arch_uprobe_skip_sstep() returns true if instruction was emulated, that is to say, there is no need to single step for the emulated instructions. regs->csr_era will point to the destination address directly after the exception, so the resume_era related code is redundant, just remove them.
--- arch/loongarch/include/asm/uprobes.h | 1 - arch/loongarch/kernel/uprobes.c | 7 +------ 2 files changed, 1 insertion(+), 7 deletions(-)
arch/loongarch/include/asm/uprobes.h +0 -1
@@ -15,7 +15,6 @@ typedef u32 uprobe_opcode_t;#define UPROBE_XOLBP_INSN larch_insn_gen_break(BRK_UPROBE_XOLBP)struct arch_uprobe { -unsigned long resume_era;u32 insn[2 ];u32 ixol[2 ];bool simulate;
arch/loongarch/kernel/uprobes.c +1 -6
@@ -52,11 +52,7 @@ int arch_uprobe_post_xol(struct arch_uprWARN_ON_ONCE (current->thread.trap_nr !=UPROBE_TRAP_NR ); current->thread.trap_nr = utask->autask.saved_trap_nr; - -if (auprobe->simulate) -instruction_pointer_set (regs, auprobe->resume_era); -else -instruction_pointer_set (regs, utask->vaddr +LOONGARCH_INSN_SIZE ); +instruction_pointer_set (regs, utask->vaddr +LOONGARCH_INSN_SIZE );return 0 ; }
@@ -86,7 +82,6 @@ bool arch_uprobe_skip_sstep(struct arch_ insn.word = auprobe->insn[0 ];arch_simulate_insn (insn, regs); - auprobe->resume_era = regs->csr_era;return true; }
Greg Kroah-Hartman
maintainerPATCH 68/117 drm/amd/display: Correct the reply value when AUX write incomplete
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
commit d433981385c62c72080e26f1c00a961d18b233be upstream.
[Why]
Now forcing aux->transfer to return 0 when incomplete AUX write is inappropriate. It should return bytes have been transferred.
[How]aux->transfer is asked not to change original msg except reply field of drm_dp_aux_msg structure. Copy the msg->buffer when it's write request, and overwrite the first byte when sink reply 1 byte indicating partially written byte number. Then we can return the correct value without changing the original msg.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 10 ++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -1
@@ -11069,7 +11069,8 @@ int amdgpu_dm_process_dmub_aux_transfer_/* The reply is stored in the top nibble of the command. */ payload->reply[0 ] = (adev->dm.dmub_notify->aux_reply.command >>4 ) &0xF ; -if (!payload->write && p_notify->aux_reply.length) +/*write req may receive a byte indicating partially written number as well*/ +if (p_notify->aux_reply.length)memcpy (payload->data, p_notify->aux_reply.data, p_notify->aux_reply.length);
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +8 -2
@@ -59,6 +59,7 @@ static ssize_t dm_dp_aux_transfer(structenum aux_return_code_type operation_result;struct amdgpu_device *adev;struct ddc_service *ddc; +uint8_t copy[16 ];if (WARN_ON (msg->size >16 ))return -E2BIG ;
@@ -74,6 +75,11 @@ static ssize_t dm_dp_aux_transfer(struct (msg->request &DP_AUX_I2C_WRITE_STATUS_UPDATE ) !=0 ; payload.defer_delay =0 ; +if (payload.write) { +memcpy (copy, msg->buffer, msg->size); + payload.data = copy; + } + result =dc_link_aux_transfer_raw (TO_DM_AUX (aux)->ddc_service, &payload, &operation_result);
@@ -97,9 +103,9 @@ static ssize_t dm_dp_aux_transfer(struct*/ if (payload.write && result >=0 ) {if (result) { -/*one byte indicating partially written bytes. Force 0 to retry*/ +/*one byte indicating partially written bytes*/ drm_info (adev_to_drm (adev),"amdgpu: AUX partially written\n" ); - result =0 ; + result = payload.data[0 ]; }else if (!payload.reply[0 ])/*I2C_ACK|AUX_ACK*/ result = msg->size;
Greg Kroah-Hartman
maintainerPATCH 69/117 drm/amd/display: Avoid flooding unnecessary info messages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
commit d33724ffb743d3d2698bd969e29253ae0cff9739 upstream.
It's expected that we'll encounter temporary exceptions during aux transactions. Adjust logging from drm_info to drm_dbg_dp to prevent flooding with unnecessary log messages.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +3 -3
@@ -104,7 +104,7 @@ static ssize_t dm_dp_aux_transfer(structif (payload.write && result >=0 ) {if (result) {/*one byte indicating partially written bytes*/ -drm_info (adev_to_drm (adev),"amdgpu: AUX partially written\n" ); +drm_dbg_dp (adev_to_drm (adev),"amdgpu: AUX partially written\n" ); result = payload.data[0 ]; }else if (!payload.reply[0 ])/*I2C_ACK|AUX_ACK*/
@@ -130,11 +130,11 @@ static ssize_t dm_dp_aux_transfer(structbreak ; } -drm_info (adev_to_drm (adev),"amdgpu: DP AUX transfer fail:%d\n" , operation_result); +drm_dbg_dp (adev_to_drm (adev),"amdgpu: DP AUX transfer fail:%d\n" , operation_result); }if (payload.reply[0 ]) -drm_info (adev_to_drm (adev),"amdgpu: AUX reply command not ACK: 0x%02x." , +drm_dbg_dp (adev_to_drm (adev),"amdgpu: AUX reply command not ACK: 0x%02x." , payload.reply[0 ]);return result;
Greg Kroah-Hartman
maintainerPATCH 70/117 ACPI: PPTT: Fix processor subtable walk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Linton <[email protected]>
commit adfab6b39202481bb43286fff94def4953793fdb upstream.
The original PPTT code had a bug where the processor subtable length was not correctly validated when encountering a truncated acpi_pptt_processor node.
Commit 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls") attempted to fix this by validating the size is as large as the acpi_pptt_processor node structure. This introduced a regression where the last processor node in the PPTT table is ignored if it doesn't contain any private resources. That results errors like:
ACPI PPTT: PPTT table found, but unable to locate core XX (XX)
ACPI: SPE must be homogeneous
Furthermore, it fails in a common case where the node length isn't equal to the acpi_pptt_processor structure size, leaving the original bug in a modified form.
Correct the regression by adjusting the loop termination conditions as suggested by the bug reporters. An additional check performed after the subtable node type is detected, validates the acpi_pptt_processor node is fully contained in the PPTT table. Repeating the check in acpi_pptt_leaf_node() is largely redundant as the node is already known to be fully contained in the table.
The case where a final truncated node's parent property is accepted, but the node itself is rejected should not be considered a bug.
--- drivers/acpi/pptt.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/acpi/pptt.c +8 -3
@@ -231,16 +231,18 @@ static int acpi_pptt_leaf_node(struct ac sizeof(struct acpi_table_pptt)); proc_sz =sizeof (struct acpi_pptt_processor ); -while ((unsigned long )entry + proc_sz < table_end) { +/* ignore subtable types that are smaller than a processor node */ +while ((unsigned long )entry + proc_sz <= table_end) { cpu_node = (struct acpi_pptt_processor *)entry; +if (entry->type ==ACPI_PPTT_TYPE_PROCESSOR && cpu_node->parent == node_entry)return 0 ;if (entry->length ==0 )return 0 ; + entry = ACPI_ADD_PTR(struct acpi_subtable_header, entry, entry->length); - }return 1 ; }
@@ -273,15 +275,18 @@ static struct acpi_pptt_processor *acpi_ proc_sz =sizeof (struct acpi_pptt_processor );/* find the processor structure associated with this cpuid */ -while ((unsigned long )entry + proc_sz < table_end) { +while ((unsigned long )entry + proc_sz <= table_end) { cpu_node = (struct acpi_pptt_processor *)entry;if (entry->length ==0 ) {pr_warn ("Invalid zero length subtable\n" );break ; } +/* entry->length may not equal proc_sz, revalidate the processor structure length */ if (entry->type ==ACPI_PPTT_TYPE_PROCESSOR && acpi_cpu_id == cpu_node->acpi_processor_id && + (unsigned long )entry + entry->length <= table_end && + entry->length == proc_sz + cpu_node->number_of_priv_resources *sizeof (u32) &&acpi_pptt_leaf_node (table_hdr, cpu_node)) {return (struct acpi_pptt_processor *)entry; }
Greg Kroah-Hartman
maintainerPATCH 71/117 ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 9e000f1b7f31684cc5927e034360b87ac7919593 upstream.
The function snd_es1968_capture_open() calls the function snd_pcm_hw_constraint_pow2(), but does not check its return value. A proper implementation can be found in snd_cx25821_pcm_open().
Add error handling for snd_pcm_hw_constraint_pow2() and propagate its error code.
--- sound/pci/es1968.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/pci/es1968.c +4 -2
@@ -1569,7 +1569,7 @@ static int snd_es1968_capture_open(strucstruct snd_pcm_runtime *runtime = substream->runtime;struct es1968 *chip =snd_pcm_substream_chip (substream);struct esschan *es; -int apu1, apu2; +int err, apu1, apu2; apu1 =snd_es1968_alloc_apu_pair (chip,ESM_APU_PCM_CAPTURE );if (apu1 <0 )
@@ -1613,7 +1613,9 @@ static int snd_es1968_capture_open(struc runtime->hw = snd_es1968_capture; runtime->hw.buffer_bytes_max = runtime->hw.period_bytes_max =calc_available_memory_size (chip) -1024 ;/* keep MIXBUF size */ -snd_pcm_hw_constraint_pow2 (runtime,0 ,SNDRV_PCM_HW_PARAM_BUFFER_BYTES ); + err =snd_pcm_hw_constraint_pow2 (runtime,0 ,SNDRV_PCM_HW_PARAM_BUFFER_BYTES ); +if (err <0 ) +return err;spin_lock_irq (&chip->substream_lock);list_add (&es->list, &chip->substream_list);
Greg Kroah-Hartman
maintainerPATCH 72/117 ALSA: usb-audio: Add sample rate quirk for Audioengine D1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Heusel <[email protected]>
commit 2b24eb060c2bb9ef79e1d3bcf633ba1bc95215d6 upstream.
A user reported on the Arch Linux Forums that their device is emitting the following message in the kernel journal, which is fixed by adding the quirk as submitted in this patch:
Quoted 1 line
kernel: usb 1-2: current rate 8436480 is different from the runtime rate 48000
There also is an entry for this product line added long time ago. Their specific device has the following ID:
$ lsusb | grep Audio
Bus 001 Device 002: ID 1101:0003 EasyPass Industrial Co., Ltd Audioengine D1--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2148,6 +2148,8 @@ static const struct usb_audio_quirk_flag QUIRK_FLAG_FIXED_RATE),DEVICE_FLG (0x0fd9 ,0x0008 ,/* Hauppauge HVR-950Q */ QUIRK_FLAG_SHARE_MEDIA_DEVICE |QUIRK_FLAG_ALIGN_TRANSFER ), +DEVICE_FLG (0x1101 ,0x0003 ,/* Audioengine D1 */ +QUIRK_FLAG_GET_SAMPLE_RATE ),DEVICE_FLG (0x1224 ,0x2a25 ,/* Jieli Technology USB PHY 2.0 */ QUIRK_FLAG_GET_SAMPLE_RATE |QUIRK_FLAG_MIC_RES_16 ), DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */
Greg Kroah-Hartman
maintainerPATCH 73/117 ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Chauvet <[email protected]>
commit 7b9938a14460e8ec7649ca2e80ac0aae9815bf02 upstream.
Microdia JP001 does not support reading the sample rate which leads to many lines of "cannot get freq at ep 0x84".
This patch adds the USB ID to quirks.c and avoids those error messages.
usb 7-4: New USB device found, idVendor=0c45, idProduct=636b, bcdDevice= 1.00 usb 7-4: New USB device strings: Mfr=2, Product=1, SerialNumber=3 usb 7-4: Product: JP001
usb 7-4: Manufacturer: JP001
usb 7-4: SerialNumber: JP001
usb 7-4: 3:1: cannot get freq at ep 0x84
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2140,6 +2140,8 @@ static const struct usb_audio_quirk_flag QUIRK_FLAG_CTL_MSG_DELAY_1M),DEVICE_FLG (0x0c45 ,0x6340 ,/* Sonix HD USB Camera */ QUIRK_FLAG_GET_SAMPLE_RATE ), +DEVICE_FLG (0x0c45 ,0x636b ,/* Microdia JP001 USB Camera */ +QUIRK_FLAG_GET_SAMPLE_RATE ),DEVICE_FLG (0x0d8c ,0x0014 ,/* USB Audio Device */ QUIRK_FLAG_CTL_MSG_DELAY_1M ), DEVICE_FLG(0x0ecb, 0x205c, /* JBL Quantum610 Wireless */
Greg Kroah-Hartman
maintainerPATCH 74/117 dma-buf: insert memory barrier before updating num_fences
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyejeong Choi <[email protected]>
commit 72c7d62583ebce7baeb61acce6057c361f73be4a upstream.
smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.
--- drivers/dma-buf/dma-resv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/dma-buf/dma-resv.c +3 -2
@@ -313,8 +313,9 @@ void dma_resv_add_fence(struct dma_resv count++;dma_resv_list_set (fobj, i, fence, usage); -/* pointer update must be visible before we extend the num_fences */ -smp_store_mb (fobj->num_fences, count); +/* fence update must be visible before we extend the num_fences */ +smp_wmb (); + fobj->num_fences = count; }EXPORT_SYMBOL (dma_resv_add_fence);
Greg Kroah-Hartman
maintainerPATCH 75/117 hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit 4f98616b855cb0e3b5917918bb07b44728eb96ea upstream.
netvsc currently uses vmbus_sendpacket_pagebuffer() to send VMBus messages. This function creates a series of GPA ranges, each of which contains a single PFN. However, if the rndis header in the VMBus message crosses a page boundary, the netvsc protocol with the host requires that both PFNs for the rndis header must be in a single "GPA range" data structure, which isn't possible with vmbus_sendpacket_pagebuffer(). As the first step in fixing this, add a new function netvsc_build_mpb_array() to build a VMBus message with multiple GPA ranges, each of which may contain multiple PFNs. Use vmbus_sendpacket_mpb_desc() to send this VMBus message to the host.
There's no functional change since higher levels of netvsc don't maintain or propagate knowledge of contiguous PFNs. Based on its input, netvsc_build_mpb_array() still produces a separate GPA range for each PFN and the behavior is the same as with vmbus_sendpacket_pagebuffer(). But the groundwork is laid for a subsequent patch to provide the necessary grouping.
--- drivers/net/hyperv/netvsc.c | 50 +++++++++++++++++++++++++++++++++++++++----- 1 file changed, 45 insertions(+), 5 deletions(-)
drivers/net/hyperv/netvsc.c +45 -5
@@ -1047,6 +1047,42 @@ static int netvsc_dma_map(struct hv_devireturn 0 ; } +/* Build an "array" of mpb entries describing the data to be transferred +* over VMBus. After the desc header fields, each "array" entry is variable +* size, and each entry starts after the end of the previous entry. The +* "offset" and "len" fields for each entry imply the size of the entry. +* +* The pfns are in HV_HYP_PAGE_SIZE, because all communication with Hyper-V +* uses that granularity, even if the system page size of the guest is larger. +* Each entry in the input "pb" array must describe a contiguous range of +* guest physical memory so that the pfns are sequential if the range crosses +* a page boundary. The offset field must be < HV_HYP_PAGE_SIZE. +*/ +static inline void netvsc_build_mpb_array (struct hv_page_buffer *pb, +u32 page_buffer_count, +struct vmbus_packet_mpb_array *desc, +u32 *desc_size) +{ +struct hv_mpb_array *mpb_entry = &desc->range; +int i, j; + +for (i =0 ; i < page_buffer_count; i++) { +u32 offset = pb[i].offset; +u32 len = pb[i].len; + + mpb_entry->offset = offset; + mpb_entry->len = len; + +for (j =0 ; j <HVPFN_UP (offset + len); j++) + mpb_entry->pfn_array[j] = pb[i].pfn + j; + + mpb_entry = (struct hv_mpb_array *)&mpb_entry->pfn_array[j]; + } + + desc->rangecount = page_buffer_count; + *desc_size = (char *)mpb_entry - (char *)desc; +} + static inline int netvsc_send_pkt( struct hv_device *device, struct hv_netvsc_packet *packet,
@@ -1089,6 +1125,9 @@ static inline int netvsc_send_pkt( packet->dma_range =NULL ;if (packet->page_buf_cnt) { +struct vmbus_channel_packet_page_buffer desc; +u32 desc_size; +if (packet->cp_partial) pb += packet->rmsg_pgcnt;
@@ -1098,11 +1137,12 @@ static inline int netvsc_send_pkt( goto exit; } - ret =vmbus_sendpacket_pagebuffer (out_channel, - pb, packet->page_buf_cnt, - &nvmsg,sizeof (nvmsg), - req_id); - +netvsc_build_mpb_array (pb, packet->page_buf_cnt, + (struct vmbus_packet_mpb_array *)&desc, + &desc_size); + ret =vmbus_sendpacket_mpb_desc (out_channel, + (struct vmbus_packet_mpb_array *)&desc, + desc_size, &nvmsg,sizeof (nvmsg), req_id);if (ret)netvsc_dma_unmap (ndev_ctx->device_ctx, packet); }else {
Greg Kroah-Hartman
maintainerPATCH 76/117 hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit 41a6328b2c55276f89ea3812069fd7521e348bbf upstream.
Starting with commit dca5161f9bd0 ("hv_netvsc: Check status in SEND_RNDIS_PKT completion message") in the 6.3 kernel, the Linux driver for Hyper-V synthetic networking (netvsc) occasionally reports "nvsp_rndis_pkt_complete error status: 2".[1] This error indicates that Hyper-V has rejected a network packet transmit request from the guest, and the outgoing network packet is dropped. Higher level network protocols presumably recover and resend the packet so there is no functional error, but performance is slightly impacted. Commit dca5161f9bd0 is not the cause of the error -- it only added reporting of an error that was already happening without any notice. The error has presumably been present since the netvsc driver was originally introduced into Linux.
The root cause of the problem is that the netvsc driver in Linux may send an incorrectly formatted VMBus message to Hyper-V when transmitting the network packet. The incorrect formatting occurs when the rndis header of the VMBus message crosses a page boundary due to how the Linux skb head memory is aligned. In such a case, two PFNs are required to describe the location of the rndis header, even though they are contiguous in guest physical address (GPA) space. Hyper-V requires that two rndis header PFNs be in a single "GPA range" data struture, but current netvsc code puts each PFN in its own GPA range, which Hyper-V rejects as an error.
The incorrect formatting occurs only for larger packets that netvsc must transmit via a VMBus "GPA Direct" message. There's no problem when netvsc transmits a smaller packet by copying it into a pre- allocated send buffer slot because the pre-allocated slots don't have page crossing issues.
After commit 14ad6ed30a10 ("net: allow small head cache usage with large MAX_SKB_FRAGS values") in the 6.14-rc4 kernel, the error occurs much more frequently in VMs with 16 or more vCPUs. It may occur every few seconds, or even more frequently, in an ssh session that outputs a lot of text. Commit 14ad6ed30a10 subtly changes how skb head memory is allocated, making it much more likely that the rndis header will cross a page boundary when the vCPU count is 16 or more. The changes in commit 14ad6ed30a10 are perfectly valid -- they just had the side effect of making the netvsc bug more prominent.
Current code in init_page_array() creates a separate page buffer array entry for each PFN required to identify the data to be transmitted. Contiguous PFNs get separate entries in the page buffer array, and any information about contiguity is lost.
Fix the core issue by having init_page_array() construct the page buffer array to represent contiguous ranges rather than individual pages. When these ranges are subsequently passed to netvsc_build_mpb_array(), it can build GPA ranges that contain multiple PFNs, as required to avoid the error "nvsp_rndis_pkt_complete error status: 2". If instead the network packet is sent by copying into a pre-allocated send buffer slot, the copy proceeds using the contiguous ranges rather than individual pages, but the result of the copying is the same. Also fix rndis_filter_send_request() to construct a contiguous range, since it has its own page buffer array.
This change has a side benefit in CoCo VMs in that netvsc_dma_map() calls dma_map_single() on each contiguous range instead of on each page. This results in fewer calls to dma_map_single() but on larger chunks of memory, which should reduce contention on the swiotlb.
Since the page buffer array now contains one entry for each contiguous range instead of for each individual page, the number of entries in the array can be reduced, saving 208 bytes of stack space in netvsc_xmit() when MAX_SKG_FRAGS has the default value of 17.
[1] https://bugzilla.kernel.org/show_bug.cgi?id=217503
--- drivers/net/hyperv/hyperv_net.h | 12 +++++++ drivers/net/hyperv/netvsc_drv.c | 65 +++++++++----------------------------- drivers/net/hyperv/rndis_filter.c | 24 ++------------ 3 files changed, 33 insertions(+), 68 deletions(-)
drivers/net/hyperv/hyperv_net.h +12 -0
@@ -893,6 +893,18 @@ struct nvsp_message { sizeof(struct nvsp_message))#define NETVSC_MIN_IN_MSG_SIZE sizeof(struct vmpacket_descriptor) +/* Maximum # of contiguous data ranges that can make up a trasmitted packet. +* Typically it's the max SKB fragments plus 2 for the rndis packet and the +* linear portion of the SKB. But if MAX_SKB_FRAGS is large, the value may +* need to be limited to MAX_PAGE_BUFFER_COUNT, which is the max # of entries +* in a GPA direct packet sent to netvsp over VMBus. +*/ +#if MAX_SKB_FRAGS +2 <MAX_PAGE_BUFFER_COUNT +#define MAX_DATA_RANGES (MAX_SKB_FRAGS + 2) +#else +#define MAX_DATA_RANGES MAX_PAGE_BUFFER_COUNT +#endif +/* Estimated requestor size: * out_ring_size/min_out_msg_size + in_ring_size/min_in_msg_size */
drivers/net/hyperv/netvsc_drv.c +16 -49
94 lines not on this page · raw message
drivers/net/hyperv/rndis_filter.c +5 -19
@@ -226,8 +226,7 @@ static int rndis_filter_send_request(str struct rndis_request *req) {struct hv_netvsc_packet *packet; -struct hv_page_buffer page_buf[2 ]; -struct hv_page_buffer *pb = page_buf; +struct hv_page_buffer pb;int ret;/* Setup the packet to send it */
@@ -236,27 +235,14 @@ static int rndis_filter_send_request(str packet->total_data_buflen = req->request_msg.msg_len; packet->page_buf_cnt =1 ; - pb[0 ].pfn =virt_to_phys (&req->request_msg) >> -HV_HYP_PAGE_SHIFT ; - pb[0 ].len = req->request_msg.msg_len; - pb[0 ].offset =offset_in_hvpage (&req->request_msg); - -/* Add one page_buf when request_msg crossing page boundary */ -if (pb[0 ].offset + pb[0 ].len >HV_HYP_PAGE_SIZE ) { - packet->page_buf_cnt++; - pb[0 ].len =HV_HYP_PAGE_SIZE - - pb[0 ].offset; - pb[1 ].pfn =virt_to_phys ((void *)&req->request_msg - + pb[0 ].len) >>HV_HYP_PAGE_SHIFT ; - pb[1 ].offset =0 ; - pb[1 ].len = req->request_msg.msg_len - - pb[0 ].len; - } + pb.pfn =virt_to_phys (&req->request_msg) >>HV_HYP_PAGE_SHIFT ; + pb.len = req->request_msg.msg_len; + pb.offset =offset_in_hvpage (&req->request_msg);trace_rndis_send (dev->ndev,0 , &req->request_msg);rcu_read_lock_bh (); - ret =netvsc_send (dev->ndev, packet,NULL , pb,NULL , false); + ret =netvsc_send (dev->ndev, packet,NULL , &pb,NULL , false);rcu_read_unlock_bh ();return ret;
Greg Kroah-Hartman
maintainerPATCH 77/117 hv_netvsc: Remove rmsg_pgcnt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit 5bbc644bbf4e97a05bc0cb052189004588ff8a09 upstream.
init_page_array() now always creates a single page buffer array entry for the rndis message, even if the rndis message crosses a page boundary. As such, the number of page buffer array entries used for the rndis message must no longer be tracked -- it is always just 1. Remove the rmsg_pgcnt field and use "1" where the value is needed.
--- drivers/net/hyperv/hyperv_net.h | 1 - drivers/net/hyperv/netvsc.c | 7 +++---- drivers/net/hyperv/netvsc_drv.c | 1 - 3 files changed, 3 insertions(+), 6 deletions(-)
drivers/net/hyperv/hyperv_net.h +0 -1
@@ -158,7 +158,6 @@ struct hv_netvsc_packet {u8 cp_partial;/* partial copy into send buffer */ u8 rmsg_size;/* RNDIS header and PPI size */ -u8 rmsg_pgcnt;/* page count of RNDIS header and PPI */ u8 page_buf_cnt;u16 q_idx;
drivers/net/hyperv/netvsc.c +3 -4
@@ -945,8 +945,7 @@ static void netvsc_copy_to_send_buf(stru + pend_size;int i;u32 padding =0 ; -u32 page_count = packet->cp_partial ? packet->rmsg_pgcnt : - packet->page_buf_cnt; +u32 page_count = packet->cp_partial ?1 : packet->page_buf_cnt;u32 remain;/* Add padding */
@@ -1129,7 +1128,7 @@ static inline int netvsc_send_pkt(u32 desc_size;if (packet->cp_partial) - pb += packet->rmsg_pgcnt; + pb++; ret =netvsc_dma_map (ndev_ctx->device_ctx, packet, pb);if (ret) {
@@ -1291,7 +1290,7 @@ int netvsc_send(struct net_device *ndev, packet->send_buf_index = section_index;if (packet->cp_partial) { - packet->page_buf_cnt -= packet->rmsg_pgcnt; + packet->page_buf_cnt--; packet->total_data_buflen = msd_len + packet->rmsg_size; }else { packet->page_buf_cnt =0 ;
drivers/net/hyperv/netvsc_drv.c +0 -1
@@ -342,7 +342,6 @@ static u32 init_page_array(void *hdr, u3 pb[0 ].len = len; pb[0 ].pfn =virt_to_hvpfn (hdr); packet->rmsg_size = len; - packet->rmsg_pgcnt =1 ; pb[1 ].offset =offset_in_hvpage (skb->data); pb[1 ].len =skb_headlen (skb);
Greg Kroah-Hartman
maintainerPATCH 78/117 Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit 380b75d3078626aadd0817de61f3143f5db6e393 upstream.
vmbus_sendpacket_mpb_desc() is currently used only by the storvsc driver and is hardcoded to create a single GPA range. To allow it to also be used by the netvsc driver to create multiple GPA ranges, no longer hardcode as having a single GPA range. Allow the calling driver to specify the rangecount in the supplied descriptor.
Update the storvsc driver to reflect this new approach.
--- drivers/hv/channel.c | 6 +++--- drivers/scsi/storvsc_drv.c | 1 + 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/hv/channel.c +3 -3
@@ -1172,9 +1172,10 @@ int vmbus_sendpacket_pagebuffer(struct vEXPORT_SYMBOL_GPL (vmbus_sendpacket_pagebuffer);/* -* vmbus_sendpacket_multipagebuffer - Send a multi-page buffer packet +* vmbus_sendpacket_mpb_desc - Send one or more multi-page buffer packets * using a GPADL Direct packet type. -* The buffer includes the vmbus descriptor. +* The desc argument must include space for the VMBus descriptor. The +* rangecount field must already be set. */ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel, struct vmbus_packet_mpb_array *desc,
@@ -1196,7 +1197,6 @@ int vmbus_sendpacket_mpb_desc(struct vmb desc->length8 = (u16)(packetlen_aligned >>3 ); desc->transactionid =VMBUS_RQST_ERROR ;/* will be updated in hv_ringbuffer_write() */ desc->reserved =0 ; - desc->rangecount =1 ; bufferlist[0 ].iov_base = desc; bufferlist[0 ].iov_len = desc_size;
drivers/scsi/storvsc_drv.c +1 -0
@@ -1819,6 +1819,7 @@ static int storvsc_queuecommand(struct Sreturn SCSI_MLQUEUE_DEVICE_BUSY ; } + payload->rangecount =1 ; payload->range.len = length; payload->range.offset = offset_in_hvpg;
Greg Kroah-Hartman
maintainerPATCH 79/117 Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit 45a442fe369e6c4e0b4aa9f63b31c3f2f9e2090e upstream.
With the netvsc driver changed to use vmbus_sendpacket_mpb_desc() instead of vmbus_sendpacket_pagebuffer(), the latter has no remaining callers. Remove it.
--- drivers/hv/channel.c | 59 ------------------------------------------------- include/linux/hyperv.h | 7 ----- 2 files changed, 66 deletions(-)
drivers/hv/channel.c +0 -59
@@ -1113,65 +1113,6 @@ int vmbus_sendpacket(struct vmbus_channeEXPORT_SYMBOL (vmbus_sendpacket);/* -* vmbus_sendpacket_pagebuffer - Send a range of single-page buffer -* packets using a GPADL Direct packet type. This interface allows you -* to control notifying the host. This will be useful for sending -* batched data. Also the sender can control the send flags -* explicitly. -*/ -int vmbus_sendpacket_pagebuffer (struct vmbus_channel *channel, -struct hv_page_buffer pagebuffers[], -u32 pagecount,void *buffer,u32 bufferlen, -u64 requestid) -{ -int i; -struct vmbus_channel_packet_page_buffer desc; -u32 descsize; -u32 packetlen; -u32 packetlen_aligned; -struct kvec bufferlist[3 ]; -u64 aligned_data =0 ; - -if (pagecount >MAX_PAGE_BUFFER_COUNT ) -return -EINVAL ; - -/* -* Adjust the size down since vmbus_channel_packet_page_buffer is the -* largest size we support -*/ - descsize =sizeof (struct vmbus_channel_packet_page_buffer ) - - ((MAX_PAGE_BUFFER_COUNT - pagecount) * -sizeof (struct hv_page_buffer )); - packetlen = descsize + bufferlen; - packetlen_aligned =ALIGN (packetlen,sizeof (u64)); - -/* Setup the descriptor */ - desc.type =VM_PKT_DATA_USING_GPA_DIRECT ; - desc.flags =VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED ; - desc.dataoffset8 = descsize >>3 ;/* in 8-bytes granularity */ - desc.length8 = (u16)(packetlen_aligned >>3 ); - desc.transactionid =VMBUS_RQST_ERROR ;/* will be updated in hv_ringbuffer_write() */ - desc.reserved =0 ; - desc.rangecount = pagecount; - -for (i =0 ; i < pagecount; i++) { - desc.range[i].len = pagebuffers[i].len; - desc.range[i].offset = pagebuffers[i].offset; - desc.range[i].pfn = pagebuffers[i].pfn; - } - - bufferlist[0 ].iov_base = &desc; - bufferlist[0 ].iov_len = descsize; - bufferlist[1 ].iov_base = buffer; - bufferlist[1 ].iov_len = bufferlen; - bufferlist[2 ].iov_base = &aligned_data; - bufferlist[2 ].iov_len = (packetlen_aligned - packetlen); - -return hv_ringbuffer_write (channel, bufferlist,3 , requestid,NULL ); -} -EXPORT_SYMBOL_GPL (vmbus_sendpacket_pagebuffer); - -/* * vmbus_sendpacket_mpb_desc - Send one or more multi-page buffer packets * using a GPADL Direct packet type. * The desc argument must include space for the VMBus descriptor. The
include/linux/hyperv.h +0 -7
@@ -1224,13 +1224,6 @@ extern int vmbus_sendpacket(struct vmbusenum vmbus_packet_type type, u32 flags); -extern int vmbus_sendpacket_pagebuffer (struct vmbus_channel *channel, -struct hv_page_buffer pagebuffers[], -u32 pagecount, -void *buffer, -u32 bufferlen, -u64 requestid); - extern int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel, struct vmbus_packet_mpb_array *mpb, u32 desc_size,
Greg Kroah-Hartman
maintainerPATCH 80/117 ftrace: Fix preemption accounting for stacktrace trigger command
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: pengdonglin <[email protected]>
commit e333332657f615ac2b55aa35565c4a882018bbe9 upstream.
When using the stacktrace trigger command to trace syscalls, the preemption count was consistently reported as 1 when the system call event itself had 0 (".").
For example:
root@ubuntu22-vm:/sys/kernel/tracing/events/syscalls/sys_enter_read
$ echo stacktrace > trigger $ echo 1 > enable
sshd-416 [002] ..... 232.864910: sys_read(fd: a, buf: 556b1f3221d0, count: 8000)
sshd-416 [002] ...1. 232.864913: <stack trace> => ftrace_syscall_enter
=> syscall_trace_enter
=> do_syscall_64
=> entry_SYSCALL_64_after_hwframe
The root cause is that the trace framework disables preemption in __DO_TRACE before invoking the trigger callback.
Use the tracing_gen_ctx_dec() that will accommodate for the increase of the preemption count in __DO_TRACE when calling the callback. The result is the accurate reporting of:
sshd-410 [004] ..... 210.117660: sys_read(fd: 4, buf: 559b725ba130, count: 40000)
sshd-410 [004] ..... 210.117662: <stack trace> => ftrace_syscall_enter
=> syscall_trace_enter
=> do_syscall_64
=> entry_SYSCALL_64_after_hwframe
--- kernel/trace/trace_events_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_events_trigger.c +1 -1
@@ -1554,7 +1554,7 @@ stacktrace_trigger(struct event_trigger_struct trace_event_file *file = data->private_data;if (file) -__trace_stack (file->tr,tracing_gen_ctx (),STACK_SKIP ); +__trace_stack (file->tr,tracing_gen_ctx_dec (),STACK_SKIP );else trace_dump_stack (STACK_SKIP ); }
Greg Kroah-Hartman
maintainerPATCH 81/117 ftrace: Fix preemption accounting for stacktrace filter command
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: pengdonglin <[email protected]>
commit 11aff32439df6ca5b3b891b43032faf88f4a6a29 upstream.
The preemption count of the stacktrace filter command to trace ksys_read is consistently incorrect:
$ echo ksys_read:stacktrace > set_ftrace_filter
<...>-453 [004] ...1. 38.308956: <stack trace>
=> ksys_read
=> do_syscall_64
=> entry_SYSCALL_64_after_hwframe
The root cause is that the trace framework disables preemption when invoking the filter command callback in function_trace_probe_call:
preempt_disable_notrace(); probe_ops->func(ip, parent_ip, probe_opsbe->tr, probe_ops, probe->data); preempt_enable_notrace();
Use tracing_gen_ctx_dec() to account for the preempt_disable_notrace(), which will output the correct preemption count:
$ echo ksys_read:stacktrace > set_ftrace_filter
<...>-410 [006] ..... 31.420396: <stack trace>
=> ksys_read
=> do_syscall_64
=> entry_SYSCALL_64_after_hwframe
--- kernel/trace/trace_functions.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
kernel/trace/trace_functions.c +1 -5
@@ -561,11 +561,7 @@ ftrace_traceoff(unsigned long ip, unsign static __always_inline void trace_stack(struct trace_array *tr) { -unsigned int trace_ctx; - - trace_ctx =tracing_gen_ctx (); - -__trace_stack (tr, trace_ctx,FTRACE_STACK_SKIP ); +__trace_stack (tr,tracing_gen_ctx_dec (),FTRACE_STACK_SKIP ); } static void
Greg Kroah-Hartman
maintainerPATCH 82/117 tracing: samples: Initialize trace_array_printk() with the correct function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 1b0c192c92ea1fe2dcb178f84adf15fe37c3e7c8 upstream.
When using trace_array_printk() on a created instance, the correct function to use to initialize it is:
trace_array_init_printk()
Not
trace_printk_init_buffer()
The former is a proper function to use, the latter is for initializing trace_printk() and causes the NOTICE banner to be displayed.
--- samples/ftrace/sample-trace-array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/ftrace/sample-trace-array.c +1 -1
@@ -112,7 +112,7 @@ static int __init sample_trace_array_ini/* * If context specific per-cpu buffers havent already been allocated. */ -trace_printk_init_buffers (); +trace_array_init_printk (tr); simple_tsk =kthread_run (simple_thread,NULL ,"sample-instance" );if (IS_ERR (simple_tsk)) {
Greg Kroah-Hartman
maintainerPATCH 83/117 phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
commit b47158fb42959c417ff2662075c0d46fb783d5d1 upstream.
The current implementation uses bias_pad_enable as a reference count to manage the shared bias pad for all UTMI PHYs. However, during system suspension with connected USB devices, multiple power-down requests for the UTMI pad result in a mismatch in the reference count, which in turn produces warnings such as:
[ 237.762967] WARNING: CPU: 10 PID: 1618 at tegra186_utmi_pad_power_down+0x160/0x170 [ 237.763103] Call trace: [ 237.763104] tegra186_utmi_pad_power_down+0x160/0x170 [ 237.763107] tegra186_utmi_phy_power_off+0x10/0x30 [ 237.763110] phy_power_off+0x48/0x100 [ 237.763113] tegra_xusb_enter_elpg+0x204/0x500 [ 237.763119] tegra_xusb_suspend+0x48/0x140 [ 237.763122] platform_pm_suspend+0x2c/0xb0 [ 237.763125] dpm_run_callback.isra.0+0x20/0xa0 [ 237.763127] __device_suspend+0x118/0x330 [ 237.763129] dpm_suspend+0x10c/0x1f0 [ 237.763130] dpm_suspend_start+0x88/0xb0 [ 237.763132] suspend_devices_and_enter+0x120/0x500 [ 237.763135] pm_suspend+0x1ec/0x270
The root cause was traced back to the dynamic power-down changes introduced in commit a30951d31b25 ("xhci: tegra: USB2 pad power controls"), where the UTMI pad was being powered down without verifying its current state. This unbalanced behavior led to discrepancies in the reference count.
To rectify this issue, this patch replaces the single reference counter with a bitmask, renamed to utmi_pad_enabled. Each bit in the mask corresponds to one of the four USB2 PHYs, allowing us to track each pad's enablement status individually.
With this change:
- The bias pad is powered on only when the mask is clear.
- Each UTMI pad is powered on or down based on its corresponding bit in the mask, preventing redundant operations.
- The overall power state of the shared bias pad is maintained correctly during suspend/resume cycles.
The mutex used to prevent race conditions during UTMI pad enable/disable operations has been moved from the tegra186_utmi_bias_pad_power_on/off functions to the parent functions tegra186_utmi_pad_power_on/down. This change ensures that there are no race conditions when updating the bitmask.
--- drivers/phy/tegra/xusb-tegra186.c | 44 +++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 17 deletions(-)
drivers/phy/tegra/xusb-tegra186.c +27 -17
@@ -237,6 +237,8 @@#define DATA0_VAL_PD BIT(1)#define USE_XUSB_AO BIT(4) +#define TEGRA_UTMI_PAD_MAX 4 +#define TEGRA186_LANE (_name, _offset, _shift, _mask, _type) \ { \ .name = _name, \
@@ -269,7 +271,7 @@ struct tegra186_xusb_padctl {/* UTMI bias and tracking */ struct clk *usb2_trk_clk; -unsigned int bias_pad_enable; +DECLARE_BITMAP (utmi_pad_enabled,TEGRA_UTMI_PAD_MAX );/* padctl context */ struct tegra186_xusb_padctl_context context;
@@ -603,12 +605,8 @@ static void tegra186_utmi_bias_pad_poweru32 value;int err; -mutex_lock (&padctl->lock); - -if (priv->bias_pad_enable++ >0 ) { -mutex_unlock (&padctl->lock); +if (!bitmap_empty (priv->utmi_pad_enabled,TEGRA_UTMI_PAD_MAX ))return ; - } err =clk_prepare_enable (priv->usb2_trk_clk);if (err <0 )
@@ -667,17 +665,8 @@ static void tegra186_utmi_bias_pad_powerstruct tegra186_xusb_padctl *priv =to_tegra186_xusb_padctl (padctl);u32 value; -mutex_lock (&padctl->lock); - -if (WARN_ON (priv->bias_pad_enable ==0 )) { -mutex_unlock (&padctl->lock); -return ; - } - -if (--priv->bias_pad_enable >0 ) { -mutex_unlock (&padctl->lock); +if (!bitmap_empty (priv->utmi_pad_enabled,TEGRA_UTMI_PAD_MAX ))return ; - } value =padctl_readl (padctl,XUSB_PADCTL_USB2_BIAS_PAD_CTL1 ); value |=USB2_PD_TRK ;
@@ -690,13 +679,13 @@ static void tegra186_utmi_bias_pad_powerclk_disable_unprepare (priv->usb2_trk_clk); } -mutex_unlock (&padctl->lock); }static void tegra186_utmi_pad_power_on (struct phy *phy) {struct tegra_xusb_lane *lane =phy_get_drvdata (phy);struct tegra_xusb_padctl *padctl = lane->pad->padctl; +struct tegra186_xusb_padctl *priv =to_tegra186_xusb_padctl (padctl);struct tegra_xusb_usb2_port *port;struct device *dev = padctl->dev;unsigned int index = lane->index;
@@ -705,9 +694,16 @@ static void tegra186_utmi_pad_power_on(sif (!phy)return ; +mutex_lock (&padctl->lock); +if (test_bit (index, priv->utmi_pad_enabled)) { +mutex_unlock (&padctl->lock); +return ; + } + port =tegra_xusb_find_usb2_port (padctl, index);if (!port) {dev_err (dev,"no port found for USB2 lane %u\n" , index); +mutex_unlock (&padctl->lock);return ; }
@@ -724,18 +720,28 @@ static void tegra186_utmi_pad_power_on(s value =padctl_readl (padctl,XUSB_PADCTL_USB2_OTG_PADX_CTL1 (index)); value &= ~USB2_OTG_PD_DR ;padctl_writel (padctl, value,XUSB_PADCTL_USB2_OTG_PADX_CTL1 (index)); + +set_bit (index, priv->utmi_pad_enabled); +mutex_unlock (&padctl->lock); }static void tegra186_utmi_pad_power_down (struct phy *phy) {struct tegra_xusb_lane *lane =phy_get_drvdata (phy);struct tegra_xusb_padctl *padctl = lane->pad->padctl; +struct tegra186_xusb_padctl *priv =to_tegra186_xusb_padctl (padctl);unsigned int index = lane->index;u32 value;if (!phy)return ; +mutex_lock (&padctl->lock); +if (!test_bit (index, priv->utmi_pad_enabled)) { +mutex_unlock (&padctl->lock); +return ; + } +dev_dbg (padctl->dev,"power down UTMI pad %u\n" , index); value =padctl_readl (padctl,XUSB_PADCTL_USB2_OTG_PADX_CTL0 (index));
@@ -748,7 +754,11 @@ static void tegra186_utmi_pad_power_downudelay (2 ); +clear_bit (index, priv->utmi_pad_enabled); +tegra186_utmi_bias_pad_power_off (padctl); + +mutex_unlock (&padctl->lock); } static int tegra186_xusb_padctl_vbus_override(struct tegra_xusb_padctl *padctl,
Greg Kroah-Hartman
maintainerPATCH 84/117 phy: Fix error handling in tegra_xusb_port_init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit b2ea5f49580c0762d17d80d8083cb89bc3acf74f upstream.
If device_add() fails, do not use device_unregister() for error handling. device_unregister() consists two functions: device_del() and put_device(). device_unregister() should only be called after device_add() succeeded because device_del() undoes what device_add() does if successful. Change device_unregister() to put_device() call before returning from the function.
As comment of device_add() says, 'if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count'.
Found by code review.
--- drivers/phy/tegra/xusb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/phy/tegra/xusb.c +4 -4
@@ -548,16 +548,16 @@ static int tegra_xusb_port_init(struct t err =dev_set_name (&port->dev,"%s-%u" , name, index);if (err <0 ) - goto unregister; + goto put_device; err =device_add (&port->dev);if (err <0 ) - goto unregister; + goto put_device;return 0 ; -unregister: -device_unregister (&port->dev); +put_device: +put_device (&port->dev);return err; }
Greg Kroah-Hartman
maintainerPATCH 85/117 phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 54c4c58713aaff76c2422ff5750e557ab3b100d7 upstream.
It has been observed on the Renesas RZ/G3S SoC that unbinding and binding the PHY driver leads to role autodetection failures. This issue occurs when PHY 3 is the first initialized PHY. PHY 3 does not have an interrupt associated with the USB2_INT_ENABLE register (as rcar_gen3_int_enable[3] = 0). As a result, rcar_gen3_init_otg() is called to initialize OTG without enabling PHY interrupts.
To resolve this, add rcar_gen3_is_any_otg_rphy_initialized() and call it in role_store(), role_show(), and rcar_gen3_init_otg(). At the same time, rcar_gen3_init_otg() is only called when initialization for a PHY with interrupt bits is in progress. As a result, the
struct rcar_gen3_phy::otg_initialized is no longer needed.
--- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 33 +++++++++++++------------------ 1 file changed, 14 insertions(+), 19 deletions(-)
drivers/phy/renesas/phy-rcar-gen3-usb2.c +14 -19
@@ -101,7 +101,6 @@ struct rcar_gen3_phy {struct rcar_gen3_chan *ch;u32 int_enable_bits;bool initialized; -bool otg_initialized;bool powered; };
@@ -309,16 +308,15 @@ static bool rcar_gen3_is_any_rphy_initiareturn false; } -static bool rcar_gen3_needs_init_otg (struct rcar_gen3_chan *ch) +static bool rcar_gen3_is_any_otg_rphy_initialized (struct rcar_gen3_chan *ch) { -int i; - -for (i =0 ; i <NUM_OF_PHYS ; i++) { -if (ch->rphys[i].otg_initialized) -return false; +for (enum rcar_gen3_phy_index i =PHY_INDEX_BOTH_HC ; i <=PHY_INDEX_EHCI ; + i++) { +if (ch->rphys[i].initialized) +return true; } -return true; +return false; }static bool rcar_gen3_are_all_rphys_power_off (struct rcar_gen3_chan *ch)
@@ -340,7 +338,7 @@ static ssize_t role_store(struct devicebool is_b_device;enum phy_mode cur_mode, new_mode; -if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized (ch)) +if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized (ch))return -EIO ;if (sysfs_streq (buf,"host" ))
@@ -378,7 +376,7 @@ static ssize_t role_show(struct device * {struct rcar_gen3_chan *ch =dev_get_drvdata (dev); -if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized (ch)) +if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized (ch))return -EIO ; return sprintf(buf, "%s\n", rcar_gen3_is_host(ch) ? "host" :
@@ -391,6 +389,9 @@ static void rcar_gen3_init_otg(struct rcvoid __iomem *usb2_base = ch->base;u32 val; +if (!ch->is_otg_channel ||rcar_gen3_is_any_otg_rphy_initialized (ch)) +return ; +/* Should not use functions of read-modify-write a register */ val =readl (usb2_base +USB2_LINECTRL1 ); val = (val & ~USB2_LINECTRL1_DP_RPD) | USB2_LINECTRL1_DPRPD_EN |
@@ -454,12 +455,9 @@ static int rcar_gen3_phy_usb2_init(strucwritel (USB2_SPD_RSM_TIMSET_INIT , usb2_base +USB2_SPD_RSM_TIMSET );writel (USB2_OC_TIMSET_INIT , usb2_base +USB2_OC_TIMSET ); -/* Initialize otg part */ -if (channel->is_otg_channel) { -if (rcar_gen3_needs_init_otg (channel)) -rcar_gen3_init_otg (channel); - rphy->otg_initialized = true; - } +/* Initialize otg part (only if we initialize a PHY with IRQs). */ +if (rphy->int_enable_bits) +rcar_gen3_init_otg (channel); rphy->initialized = true;
@@ -475,9 +473,6 @@ static int rcar_gen3_phy_usb2_exit(struc rphy->initialized = false; -if (channel->is_otg_channel) - rphy->otg_initialized = false; - val =readl (usb2_base +USB2_INT_ENABLE ); val &= ~rphy->int_enable_bits;if (!rcar_gen3_is_any_rphy_initialized (channel))
Greg Kroah-Hartman
maintainerPATCH 86/117 phy: renesas: rcar-gen3-usb2: Set timing registers only once
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 86e70849f4b2b4597ac9f7c7931f2a363774be25 upstream.
phy-rcar-gen3-usb2 driver exports 4 PHYs. The timing registers are common to all PHYs. There is no need to set them every time a PHY is initialized. Set timing register only when the 1st PHY is initialized.
--- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/phy/renesas/phy-rcar-gen3-usb2.c +5 -2
@@ -452,8 +452,11 @@ static int rcar_gen3_phy_usb2_init(struc val =readl (usb2_base +USB2_INT_ENABLE ); val |=USB2_INT_ENABLE_UCOM_INTEN | rphy->int_enable_bits;writel (val, usb2_base +USB2_INT_ENABLE ); -writel (USB2_SPD_RSM_TIMSET_INIT , usb2_base +USB2_SPD_RSM_TIMSET ); -writel (USB2_OC_TIMSET_INIT , usb2_base +USB2_OC_TIMSET ); + +if (!rcar_gen3_is_any_rphy_initialized (channel)) { +writel (USB2_SPD_RSM_TIMSET_INIT , usb2_base +USB2_SPD_RSM_TIMSET ); +writel (USB2_OC_TIMSET_INIT , usb2_base +USB2_OC_TIMSET ); + }/* Initialize otg part (only if we initialize a PHY with IRQs). */ if (rphy->int_enable_bits)
Greg Kroah-Hartman
maintainerPATCH 87/117 scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Siwinski <[email protected]>
commit e8007fad5457ea547ca63bb011fdb03213571c7e upstream.
The REPORT ZONES buffer size is currently limited by the HBA's maximum segment count to ensure the buffer can be mapped. However, the block layer further limits the number of iovec entries to 1024 when allocating a bio.
To avoid allocation of buffers too large to be mapped, further restrict the maximum buffer size to BIO_MAX_INLINE_VECS.
Replace the UIO_MAXIOV symbolic name with the more contextually appropriate BIO_MAX_INLINE_VECS.
--- block/bio.c | 2 +- drivers/scsi/sd_zbc.c | 6 +++++- include/linux/bio.h | 1 + 3 files changed, 7 insertions(+), 2 deletions(-)
block/bio.c +1 -1
@@ -600,7 +600,7 @@ struct bio *bio_kmalloc(unsigned short n {struct bio *bio; -if (nr_vecs >UIO_MAXIOV ) +if (nr_vecs >BIO_MAX_INLINE_VECS )return NULL ;return kmalloc (struct_size (bio, bi_inline_vecs, nr_vecs), gfp_mask); }
drivers/scsi/sd_zbc.c +5 -1
@@ -202,6 +202,7 @@ static void *sd_zbc_alloc_report_buffer( unsigned int nr_zones, size_t *buflen) { struct request_queue *q = sdkp->disk->queue; +unsigned int max_segments;size_t bufsize;void *buf;
@@ -213,12 +214,15 @@ static void *sd_zbc_alloc_report_buffer(* Furthermore, since the report zone command cannot be split, make * sure that the allocated buffer can always be mapped by limiting the * number of pages allocated to the HBA max segments limit. +* Since max segments can be larger than the max inline bio vectors, +* further limit the allocated buffer to BIO_MAX_INLINE_VECS. */ nr_zones =min (nr_zones, sdkp->zone_info.nr_zones); bufsize =roundup ((nr_zones +1 ) *64 ,SECTOR_SIZE ); bufsize =min_t (size_t, bufsize,queue_max_hw_sectors (q) <<SECTOR_SHIFT ); - bufsize =min_t (size_t, bufsize,queue_max_segments (q) <<PAGE_SHIFT ); + max_segments =min (BIO_MAX_INLINE_VECS ,queue_max_segments (q)); + bufsize =min_t (size_t, bufsize, max_segments <<PAGE_SHIFT );while (bufsize >=SECTOR_SIZE ) { buf =kvzalloc (bufsize,GFP_KERNEL | __GFP_NORETRY);
include/linux/bio.h +1 -0
@@ -11,6 +11,7 @@#include <linux/uio.h> #define BIO_MAX_VECS 256U +#define BIO_MAX_INLINE_VECS UIO_MAXIOVstruct queue_limits ;
Greg Kroah-Hartman
maintainerPATCH 88/117 smb: client: fix memory leak during error handling for POSIX mkdir
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jethro Donaldson <[email protected]>
commit 1fe4a44b7fa3955bcb7b4067c07b778fe90d8ee7 upstream.
The response buffer for the CREATE request handled by smb311_posix_mkdir() is leaked on the error path (goto err_free_rsp_buf) because the structure pointer *rsp passed to free_rsp_buf() is not assigned until *after* the error condition is checked.
As *rsp is initialised to NULL, free_rsp_buf() becomes a no-op and the leak is instead reported by __kmem_cache_shutdown() upon subsequent rmmod of cifs.ko if (and only if) the error path has been hit.
Pass rsp_iov.iov_base to free_rsp_buf() instead, similar to the code in other functions in smb2pdu.c for which *rsp is assigned late.
--- fs/smb/client/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/smb2pdu.c +1 -1
@@ -2979,7 +2979,7 @@ replay_again:/* Eventually save off posix specific response info and timestaps */ err_free_rsp_buf: -free_rsp_buf (resp_buftype, rsp); +free_rsp_buf (resp_buftype, rsp_iov.iov_base);kfree (pc_buf); err_free_req:cifs_small_buf_release (req);
Greg Kroah-Hartman
maintainerPATCH 89/117 spi: tegra114: Use value to check for invalid delays
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
commit e979a7c79fbc706f6dac913af379ef4caa04d3d5 upstream.
A delay unit of 0 is a valid entry, thus it is not valid to check for unused delays. Instead, check the value field; if that is zero, the given delay is unset.
--- drivers/spi/spi-tegra114.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/spi/spi-tegra114.c +3 -3
@@ -728,9 +728,9 @@ static int tegra_spi_set_hw_cs_timing(stu32 inactive_cycles;u8 cs_state; -if ((setup->unit && setup->unit !=SPI_DELAY_UNIT_SCK ) || - (hold->unit && hold->unit !=SPI_DELAY_UNIT_SCK ) || - (inactive->unit && inactive->unit !=SPI_DELAY_UNIT_SCK )) { +if ((setup->value && setup->unit !=SPI_DELAY_UNIT_SCK ) || + (hold->value && hold->unit !=SPI_DELAY_UNIT_SCK ) || + (inactive->value && inactive->unit !=SPI_DELAY_UNIT_SCK )) {dev_err (&spi->dev,"Invalid delay unit %d, should be SPI_DELAY_UNIT_SCK\n" ,SPI_DELAY_UNIT_SCK );
Greg Kroah-Hartman
maintainerPATCH 90/117 wifi: mt76: disable napi on driver removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
commit 78ab4be549533432d97ea8989d2f00b508fa68d8 upstream.
A warning on driver removal started occurring after commit 9dd05df8403b ("net: warn if NAPI instance wasn't shut down"). Disable tx napi before deleting it in mt76_dma_cleanup().
WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_locked+0xf0/0x100 CPU: 4 UID: 0 PID: 18828 Comm: modprobe Not tainted 6.15.0-rc4 #4 PREEMPT(lazy) Hardware name: ASUS System Product Name/PRIME X670E-PRO WIFI, BIOS 3035 09/05/2024 RIP: 0010:__netif_napi_del_locked+0xf0/0x100 Call Trace: <TASK> mt76_dma_cleanup+0x54/0x2f0 [mt76] mt7921_pci_remove+0xd5/0x190 [mt7921e] pci_device_remove+0x47/0xc0 device_release_driver_internal+0x19e/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x6d/0xf0 pci_unregister_driver+0x2e/0xb0 __do_sys_delete_module.isra.0+0x197/0x2e0 do_syscall_64+0x7b/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Tested with mt7921e but the same pattern can be actually applied to other mt76 drivers calling mt76_dma_cleanup() during removal. Tx napi is enabled in their *_dma_init() functions and only toggled off and on again inside their suspend/resume/reset paths. So it should be okay to disable tx napi in such a generic way.
Found by Linux Verification Center (linuxtesting.org).
--- drivers/net/wireless/mediatek/mt76/dma.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mediatek/mt76/dma.c +1 -0
@@ -957,6 +957,7 @@ void mt76_dma_cleanup(struct mt76_dev *dint i;mt76_worker_disable (&dev->tx_worker); +napi_disable (&dev->tx_napi);netif_napi_del (&dev->tx_napi);for (i =0 ; i <ARRAY_SIZE (dev->phys); i++) {
Greg Kroah-Hartman
maintainerPATCH 91/117 net: qede: Initialize qede_ll_ops with designated initializer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 6b3ab7f2cbfaeb6580709cd8ef4d72cfd01bfde4 upstream.
After a recent change [1] in clang's randstruct implementation to randomize structures that only contain function pointers, there is an error because qede_ll_ops get randomized but does not use a designated initializer for the first member:
drivers/net/ethernet/qlogic/qede/qede_main.c:206:2: error: a randomized struct can only be initialized with a designated initializer
206 | {
| ^Explicitly initialize the common member using a designated initializer to fix the build.
--- drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qede/qede_main.c +1 -1
@@ -203,7 +203,7 @@ static struct pci_driver qede_pci_driver };static struct qed_eth_cb_ops qede_ll_ops = { - { + .common = { #ifdef CONFIG_RFS_ACCEL .arfs_filter_op = qede_arfs_filter_op, #endif
Greg Kroah-Hartman
maintainerPATCH 92/117 dmaengine: ti: k3-udma: Add missing locking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Wahl <[email protected]>
commit fca280992af8c2fbd511bc43f65abb4a17363f2f upstream.
Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled:
[ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238 [ 4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/0:3 Not tainted 6.12.9-arm64 #28 [ 4.144867] Hardware name: pp-v12 (DT) [ 4.148648] Workqueue: events udma_check_tx_completion [ 4.153841] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 4.160834] pc : udma_start.isra.0+0x34/0x238 [ 4.165227] lr : udma_start.isra.0+0x30/0x238 [ 4.169618] sp : ffffffc083cabcf0 [ 4.172963] x29: ffffffc083cabcf0 x28: 0000000000000000 x27: ffffff800001b005 [ 4.180167] x26: ffffffc0812f0000 x25: 0000000000000000 x24: 0000000000000000 [ 4.187370] x23: 0000000000000001 x22: 00000000e21eabe9 x21: ffffff8000fa0670 [ 4.194571] x20: ffffff8001b6bf00 x19: ffffff8000fa0430 x18: ffffffc083b95030 [ 4.201773] x17: 0000000000000000 x16: 00000000f0000000 x15: 0000000000000048 [ 4.208976] x14: 0000000000000048 x13: 0000000000000000 x12: 0000000000000001 [ 4.216179] x11: ffffffc08151a240 x10: 0000000000003ea1 x9 : ffffffc08046ab68 [ 4.223381] x8 : ffffffc083cabac0 x7 : ffffffc081df3718 x6 : 0000000000029fc8 [ 4.230583] x5 : ffffffc0817ee6d8 x4 : 0000000000000bc0 x3 : 0000000000000000 [ 4.237784] x2 : 0000000000000000 x1 : 00000000001fffff x0 : 0000000000000000 [ 4.244986] Call trace: [ 4.247463] udma_start.isra.0+0x34/0x238 [ 4.251509] udma_check_tx_completion+0xd0/0xdc [ 4.256076] process_one_work+0x244/0x3fc [ 4.260129] process_scheduled_works+0x6c/0x74 [ 4.264610] worker_thread+0x150/0x1dc [ 4.268398] kthread+0xd8/0xe8 [ 4.271492] ret_from_fork+0x10/0x20 [ 4.275107] irq event stamp: 220 [ 4.278363] hardirqs last enabled at (219): [<ffffffc080a27c7c>] _raw_spin_unlock_irq+0x38/0x50 [ 4.287183] hardirqs last disabled at (220): [<ffffffc080a1c154>] el1_dbg+0x24/0x50 [ 4.294879] softirqs last enabled at (182): [<ffffffc080037e68>] handle_softirqs+0x1c0/0x3cc [ 4.303437] softirqs last disabled at (177): [<ffffffc080010170>] __do_softirq+0x1c/0x28 [ 4.311559] ---[ end trace 0000000000000000 ]---
This commit adds the missing locking.
--- drivers/dma/ti/k3-udma.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/dma/ti/k3-udma.c +7 -0
@@ -1091,8 +1091,11 @@ static void udma_check_tx_completion(stru32 residue_diff;ktime_t time_diff;unsigned long delay; +unsigned long flags;while (1 ) { +spin_lock_irqsave (&uc->vc.lock, flags); +if (uc->desc) {/* Get previous residue and time stamp */ residue_diff = uc->tx_drain.residue;
@@ -1127,6 +1130,8 @@ static void udma_check_tx_completion(strbreak ; } +spin_unlock_irqrestore (&uc->vc.lock, flags); +usleep_range (ktime_to_us (delay),ktime_to_us (delay) +10 );continue ;
@@ -1143,6 +1148,8 @@ static void udma_check_tx_completion(strbreak ; } + +spin_unlock_irqrestore (&uc->vc.lock, flags); }static irqreturn_t udma_ring_irq_handler (int irq,void *data)
Greg Kroah-Hartman
maintainerPATCH 93/117 dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yemike Abhilash Chandra <[email protected]>
commit 8ca9590c39b69b55a8de63d2b21b0d44f523b43a upstream.
Currently, a local dma_cap_mask_t variable is used to store device cap_mask within udma_of_xlate(). However, the DMA_PRIVATE flag in the device cap_mask can get cleared when the last channel is released. This can happen right after storing the cap_mask locally in udma_of_xlate(), and subsequent dma_request_channel() can fail due to mismatch in the cap_mask. Fix this by removing the local dma_cap_mask_t variable and directly using the one from the dma_device structure.
--- drivers/dma/ti/k3-udma.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/dma/ti/k3-udma.c +1 -2
@@ -4221,7 +4221,6 @@ static struct dma_chan *udma_of_xlate(st struct of_dma *ofdma) {struct udma_dev *ud = ofdma->of_dma_data; -dma_cap_mask_t mask = ud->ddev.cap_mask;struct udma_filter_param filter_param;struct dma_chan *chan;
@@ -4253,7 +4252,7 @@ static struct dma_chan *udma_of_xlate(st } } - chan =__dma_request_channel (&mask, udma_dma_filter_fn, &filter_param, + chan =__dma_request_channel (&ud->ddev.cap_mask, udma_dma_filter_fn, &filter_param, ofdma->of_node);if (!chan) {dev_err (ud->dev,"get channel fail in %s.\n" , __func__);
Greg Kroah-Hartman
maintainerPATCH 94/117 dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit 3fd2f4bc010cdfbc07dd21018dc65bd9370eb7a4 upstream.
Memory allocated for wqs is not freed if an error occurs during idxd_setup_wqs(). To fix it, free the allocated memory in the reverse order of allocation before exiting the function in case of an error.
--- drivers/dma/idxd/init.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-)
drivers/dma/idxd/init.c +21 -9
@@ -159,8 +159,8 @@ static int idxd_setup_wqs(struct idxd_de idxd->wq_enable_map =bitmap_zalloc_node (idxd->max_wqs,GFP_KERNEL ,dev_to_node (dev));if (!idxd->wq_enable_map) { -kfree (idxd->wqs); -return -ENOMEM ; + rc = -ENOMEM ; + goto err_bitmap; }for (i =0 ; i < idxd->max_wqs; i++) {
@@ -179,10 +179,8 @@ static int idxd_setup_wqs(struct idxd_de conf_dev->bus = &dsa_bus_type; conf_dev->type = &idxd_wq_device_type; rc =dev_set_name (conf_dev,"wq%d.%d" , idxd->id, wq->id); -if (rc <0 ) { -put_device (conf_dev); +if (rc <0 ) goto err; - }mutex_init (&wq->wq_lock);init_waitqueue_head (&wq->err_queue);
@@ -193,7 +191,6 @@ static int idxd_setup_wqs(struct idxd_de wq->enqcmds_retries =IDXD_ENQCMDS_RETRIES ; wq->wqcfg =kzalloc_node (idxd->wqcfg_size,GFP_KERNEL ,dev_to_node (dev));if (!wq->wqcfg) { -put_device (conf_dev); rc = -ENOMEM ; goto err; }
@@ -201,9 +198,8 @@ static int idxd_setup_wqs(struct idxd_deif (idxd->hw.wq_cap.op_config) { wq->opcap_bmap =bitmap_zalloc (IDXD_MAX_OPCAP_BITS ,GFP_KERNEL );if (!wq->opcap_bmap) { -put_device (conf_dev); rc = -ENOMEM ; - goto err; + goto err_opcap_bmap; }bitmap_copy (wq->opcap_bmap, idxd->opcap_bmap,IDXD_MAX_OPCAP_BITS ); }
@@ -214,12 +210,28 @@ static int idxd_setup_wqs(struct idxd_dereturn 0 ; - err: +err_opcap_bmap: +kfree (wq->wqcfg); + +err: +put_device (conf_dev); +kfree (wq); +while (--i >=0 ) { wq = idxd->wqs[i]; +if (idxd->hw.wq_cap.op_config) +bitmap_free (wq->opcap_bmap); +kfree (wq->wqcfg); conf_dev =wq_confdev (wq);put_device (conf_dev); +kfree (wq); + } +bitmap_free (idxd->wq_enable_map); + +err_bitmap: +kfree (idxd->wqs); +return rc; }
Greg Kroah-Hartman
maintainerPATCH 95/117 dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit 817bced19d1dbdd0b473580d026dc0983e30e17b upstream.
Memory allocated for engines is not freed if an error occurs during idxd_setup_engines(). To fix it, free the allocated memory in the reverse order of allocation before exiting the function in case of an error.
--- drivers/dma/idxd/init.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/dma/idxd/init.c +4 -0
@@ -265,6 +265,7 @@ static int idxd_setup_engines(struct idx rc =dev_set_name (conf_dev,"engine%d.%d" , idxd->id, engine->id);if (rc <0 ) {put_device (conf_dev); +kfree (engine); goto err; }
@@ -278,7 +279,10 @@ static int idxd_setup_engines(struct idx engine = idxd->engines[i]; conf_dev =engine_confdev (engine);put_device (conf_dev); +kfree (engine); } +kfree (idxd->engines); +return rc; }
Greg Kroah-Hartman
maintainerPATCH 96/117 dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit aa6f4f945b10eac57aed46154ae7d6fada7fccc7 upstream.
Memory allocated for groups is not freed if an error occurs during idxd_setup_groups(). To fix it, free the allocated memory in the reverse order of allocation before exiting the function in case of an error.
--- drivers/dma/idxd/init.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/dma/idxd/init.c +4 -0
@@ -316,6 +316,7 @@ static int idxd_setup_groups(struct idxd rc =dev_set_name (conf_dev,"group%d.%d" , idxd->id, group->id);if (rc <0 ) {put_device (conf_dev); +kfree (group); goto err; }
@@ -340,7 +341,10 @@ static int idxd_setup_groups(struct idxdwhile (--i >=0 ) { group = idxd->groups[i];put_device (group_confdev (group)); +kfree (group); } +kfree (idxd->groups); +return rc; }
Greg Kroah-Hartman
maintainerPATCH 97/117 dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit 61259fb96e023f7299c442c48b13e72c441fc0f2 upstream.
The idxd_setup_internals() is missing some cleanup when things fail in the middle.
Add the appropriate cleanup routines:
- cleanup groups
- cleanup enginces
- cleanup wqs
to make sure it exits gracefully.
--- drivers/dma/idxd/init.c | 58 ++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 51 insertions(+), 7 deletions(-)
drivers/dma/idxd/init.c +51 -7
@@ -145,6 +145,25 @@ static void idxd_cleanup_interrupts(strupci_free_irq_vectors (pdev); } +static void idxd_clean_wqs (struct idxd_device *idxd) +{ +struct idxd_wq *wq; +struct device *conf_dev; +int i; + +for (i =0 ; i < idxd->max_wqs; i++) { + wq = idxd->wqs[i]; +if (idxd->hw.wq_cap.op_config) +bitmap_free (wq->opcap_bmap); +kfree (wq->wqcfg); + conf_dev =wq_confdev (wq); +put_device (conf_dev); +kfree (wq); + } +bitmap_free (idxd->wq_enable_map); +kfree (idxd->wqs); +} +static int idxd_setup_wqs (struct idxd_device *idxd) {struct device *dev = &idxd->pdev->dev;
@@ -235,6 +254,21 @@ err_bitmap:return rc; } +static void idxd_clean_engines (struct idxd_device *idxd) +{ +struct idxd_engine *engine; +struct device *conf_dev; +int i; + +for (i =0 ; i < idxd->max_engines; i++) { + engine = idxd->engines[i]; + conf_dev =engine_confdev (engine); +put_device (conf_dev); +kfree (engine); + } +kfree (idxd->engines); +} +static int idxd_setup_engines (struct idxd_device *idxd) {struct idxd_engine *engine;
@@ -286,6 +320,19 @@ static int idxd_setup_engines(struct idxreturn rc; } +static void idxd_clean_groups (struct idxd_device *idxd) +{ +struct idxd_group *group; +int i; + +for (i =0 ; i < idxd->max_groups; i++) { + group = idxd->groups[i]; +put_device (group_confdev (group)); +kfree (group); + } +kfree (idxd->groups); +} +static int idxd_setup_groups (struct idxd_device *idxd) {struct device *dev = &idxd->pdev->dev;
@@ -400,7 +447,7 @@ static int idxd_init_evl(struct idxd_devstatic int idxd_setup_internals (struct idxd_device *idxd) {struct device *dev = &idxd->pdev->dev; -int rc, i; +int rc;init_waitqueue_head (&idxd->cmd_waitq);
@@ -431,14 +478,11 @@ static int idxd_setup_internals(struct i err_evl:destroy_workqueue (idxd->wq); err_wkq_create: -for (i =0 ; i < idxd->max_groups; i++) -put_device (group_confdev (idxd->groups[i])); +idxd_clean_groups (idxd); err_group: -for (i =0 ; i < idxd->max_engines; i++) -put_device (engine_confdev (idxd->engines[i])); +idxd_clean_engines (idxd); err_engine: -for (i =0 ; i < idxd->max_wqs; i++) -put_device (wq_confdev (idxd->wqs[i])); +idxd_clean_wqs (idxd); err_wqs:return rc; }
Greg Kroah-Hartman
maintainerPATCH 98/117 dmaengine: idxd: Add missing cleanups in cleanup internals
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit 61d651572b6c4fe50c7b39a390760f3a910c7ccf upstream.
The idxd_cleanup_internals() function only decreases the reference count of groups, engines, and wqs but is missing the step to release memory resources.
To fix this, use the cleanup helper to properly release the memory resources.
--- drivers/dma/idxd/init.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/dma/idxd/init.c +3 -8
@@ -397,14 +397,9 @@ static int idxd_setup_groups(struct idxdstatic void idxd_cleanup_internals (struct idxd_device *idxd) { -int i; - -for (i =0 ; i < idxd->max_groups; i++) -put_device (group_confdev (idxd->groups[i])); -for (i =0 ; i < idxd->max_engines; i++) -put_device (engine_confdev (idxd->engines[i])); -for (i =0 ; i < idxd->max_wqs; i++) -put_device (wq_confdev (idxd->wqs[i])); +idxd_clean_groups (idxd); +idxd_clean_engines (idxd); +idxd_clean_wqs (idxd);destroy_workqueue (idxd->wq); }
Greg Kroah-Hartman
maintainerPATCH 99/117 dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit d5449ff1b04dfe9ed8e455769aa01e4c2ccf6805 upstream.
The remove call stack is missing idxd cleanup to free bitmap, ida and the idxd_device. Call idxd_free() helper routines to make sure we exit gracefully.
--- drivers/dma/idxd/init.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/idxd/init.c +1 -0
@@ -901,6 +901,7 @@ static void idxd_remove(struct pci_dev *destroy_workqueue (idxd->wq);perfmon_pmu_remove (idxd);put_device (idxd_confdev (idxd)); +idxd_free (idxd); }static struct pci_driver idxd_pci_driver = {
Greg Kroah-Hartman
maintainerPATCH 100/117 dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit 46a5cca76c76c86063000a12936f8e7875295838 upstream.
Memory allocated for idxd is not freed if an error occurs during idxd_alloc(). To fix it, free the allocated memory in the reverse order of allocation before exiting the function in case of an error.
--- drivers/dma/idxd/init.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
drivers/dma/idxd/init.c +15 -9
@@ -594,28 +594,34 @@ static struct idxd_device *idxd_alloc(stidxd_dev_set_type (&idxd->idxd_dev, idxd->data->type); idxd->id =ida_alloc (&idxd_ida,GFP_KERNEL );if (idxd->id <0 ) -return NULL ; + goto err_ida; idxd->opcap_bmap =bitmap_zalloc_node (IDXD_MAX_OPCAP_BITS ,GFP_KERNEL ,dev_to_node (dev)); -if (!idxd->opcap_bmap) { -ida_free (&idxd_ida, idxd->id); -return NULL ; - } +if (!idxd->opcap_bmap) + goto err_opcap;device_initialize (conf_dev); conf_dev->parent = dev; conf_dev->bus = &dsa_bus_type; conf_dev->type = idxd->data->dev_type; rc =dev_set_name (conf_dev,"%s%d" , idxd->data->name_prefix, idxd->id); -if (rc <0 ) { -put_device (conf_dev); -return NULL ; - } +if (rc <0 ) + goto err_name;spin_lock_init (&idxd->dev_lock);spin_lock_init (&idxd->cmd_lock);return idxd; + +err_name: +put_device (conf_dev); +bitmap_free (idxd->opcap_bmap); +err_opcap: +ida_free (&idxd_ida, idxd->id); +err_ida: +kfree (idxd); + +return NULL ; }static int idxd_enable_system_pasid (struct idxd_device *idxd)
Greg Kroah-Hartman
maintainerPATCH 101/117 dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit 90022b3a6981ec234902be5dbf0f983a12c759fc upstream.
Memory allocated for idxd is not freed if an error occurs during idxd_pci_probe(). To fix it, free the allocated memory in the reverse order of allocation before exiting the function in case of an error.
--- drivers/dma/idxd/init.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/dma/idxd/init.c +12 -1
@@ -577,6 +577,17 @@ static void idxd_read_caps(struct idxd_d idxd->hw.iaa_cap.bits =ioread64 (idxd->reg_base +IDXD_IAACAP_OFFSET ); } +static void idxd_free (struct idxd_device *idxd) +{ +if (!idxd) +return ; + +put_device (idxd_confdev (idxd)); +bitmap_free (idxd->opcap_bmap); +ida_free (&idxd_ida, idxd->id); +kfree (idxd); +} +static struct idxd_device *idxd_alloc (struct pci_dev *pdev,struct idxd_driver_data *data) {struct device *dev = &pdev->dev;
@@ -843,7 +854,7 @@ static int idxd_pci_probe(struct pci_dev err:pci_iounmap (pdev, idxd->reg_base); err_iomap: -put_device (idxd_confdev (idxd)); +idxd_free (idxd); err_idxd_alloc:pci_disable_device (pdev);return rc;
Greg Kroah-Hartman
maintainerPATCH 102/117 dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit a409e919ca321cc0e28f8abf96fde299f0072a81 upstream.
The idxd_cleanup() helper cleans up perfmon, interrupts, internals and so on. Refactor remove call with the idxd_cleanup() helper to avoid code duplication. Note, this also fixes the missing put_device() for idxd groups, enginces and wqs.
--- drivers/dma/idxd/init.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
drivers/dma/idxd/init.c +2 -12
@@ -891,7 +891,6 @@ static void idxd_shutdown(struct pci_devstatic void idxd_remove (struct pci_dev *pdev) {struct idxd_device *idxd =pci_get_drvdata (pdev); -struct idxd_irq_entry *irq_entry;idxd_unregister_devices (idxd);/*
@@ -904,21 +903,12 @@ static void idxd_remove(struct pci_dev *get_device (idxd_confdev (idxd));device_unregister (idxd_confdev (idxd));idxd_shutdown (pdev); -if (device_pasid_enabled (idxd)) -idxd_disable_system_pasid (idxd);idxd_device_remove_debugfs (idxd); - - irq_entry =idxd_get_ie (idxd,0 ); -free_irq (irq_entry->vector, irq_entry); -pci_free_irq_vectors (pdev); +idxd_cleanup (idxd);pci_iounmap (pdev, idxd->reg_base); -if (device_user_pasid_enabled (idxd)) -idxd_disable_sva (pdev); -pci_disable_device (pdev); -destroy_workqueue (idxd->wq); -perfmon_pmu_remove (idxd);put_device (idxd_confdev (idxd));idxd_free (idxd); +pci_disable_device (pdev); }static struct pci_driver idxd_pci_driver = {
Greg Kroah-Hartman
maintainerPATCH 103/117 x86/its: Fix build error for its_static_thunk()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
Due to a likely merge resolution error of backport commit 772934d9062a ("x86/its: FineIBT-paranoid vs ITS"), the function its_static_thunk() was placed in the wrong ifdef block, causing a build error when CONFIG_MITIGATION_ITS and CONFIG_FINEIBT are both disabled:
/linux-6.6/arch/x86/kernel/alternative.c:1452:5: error: redefinition of 'its_static_thunk'
1452 | u8 *its_static_thunk(int reg)
| ^~~~~~~~~~~~~~~~
Fix it by moving its_static_thunk() under CONFIG_MITIGATION_ITS.
--- arch/x86/kernel/alternative.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
arch/x86/kernel/alternative.c +9 -8
@@ -730,7 +730,15 @@ static bool cpu_wants_indirect_its_thunk/* Lower-half of the cacheline? */ return !(addr & 0x20); } -#endif + +u8 *its_static_thunk (int reg) +{ +u8 *thunk = __x86_indirect_its_thunk_array[reg]; + +return thunk; +} + +#endif /* CONFIG_MITIGATION_ITS */ /* * Rewrite the compiler generated retpoline thunk calls.
@@ -1449,13 +1457,6 @@ static void __apply_fineibt(s32 *start_rstatic void poison_cfi (void *addr) { }#endif -u8 *its_static_thunk (int reg) -{ -u8 *thunk = __x86_indirect_its_thunk_array[reg]; - -return thunk; -} -#endif void apply_fineibt(s32 *start_retpoline, s32 *end_retpoline,
Greg Kroah-Hartman
maintainerPATCH 104/117 mm/page_alloc: fix race condition in unaccepted memory handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <[email protected]>
commit fefc075182275057ce607effaa3daa9e6e3bdc73 upstream.
The page allocator tracks the number of zones that have unaccepted memory using static_branch_enc/dec() and uses that static branch in hot paths to determine if it needs to deal with unaccepted memory.
Borislav and Thomas pointed out that the tracking is racy: operations on static_branch are not serialized against adding/removing unaccepted pages to/from the zone.
Sanity checks inside static_branch machinery detects it:
WARNING: CPU: 0 PID: 10 at kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0
The comment around the WARN() explains the problem:
/*
* Warn about the '-1' case though; since that means a
* decrement is concurrent with a first (0->1) increment. IOW
* people are trying to disable something that wasn't yet fully
* enabled. This suggests an ordering problem on the user side. */
The effect of this static_branch optimization is only visible on microbenchmark.
Instead of adding more complexity around it, remove it altogether.
--- mm/page_alloc.c | 27 --------------------------- 1 file changed, 27 deletions(-)
mm/page_alloc.c +0 -27
@@ -303,7 +303,6 @@ EXPORT_SYMBOL(nr_online_nodes);static bool page_contains_unaccepted (struct page *page,unsigned int order);static void accept_page (struct page *page,unsigned int order);static bool cond_accept_memory (struct zone *zone,unsigned int order); -static inline bool has_unaccepted_memory (void );static bool __free_unaccepted (struct page *page);int page_group_by_mobility_disabled__read_mostly ;
@@ -6586,9 +6585,6 @@ bool has_managed_dma(void)#ifdef CONFIG_UNACCEPTED_MEMORY -/* Counts number of zones with unaccepted pages. */ -static DEFINE_STATIC_KEY_FALSE (zones_with_unaccepted_pages); -static bool lazy_accept = true;static int __init accept_memory_parse (char *p)
@@ -6624,7 +6620,6 @@ static bool try_to_accept_memory_one(str {unsigned long flags;struct page *page; -bool last;spin_lock_irqsave (&zone->lock, flags); page = list_first_entry_or_null(&zone->unaccepted_pages,
@@ -6635,7 +6630,6 @@ static bool try_to_accept_memory_one(str }list_del (&page->lru); - last =list_empty (&zone->unaccepted_pages);__mod_zone_freepage_state (zone, -MAX_ORDER_NR_PAGES ,MIGRATE_MOVABLE );__mod_zone_page_state (zone,NR_UNACCEPTED , -MAX_ORDER_NR_PAGES );
@@ -6645,9 +6639,6 @@ static bool try_to_accept_memory_one(str__free_pages_ok (page,MAX_ORDER ,FPI_TO_TAIL ); -if (last) -static_branch_dec (&zones_with_unaccepted_pages); -return true; }
@@ -6656,9 +6647,6 @@ static bool cond_accept_memory(struct zolong to_accept, wmark;bool ret = false; -if (!has_unaccepted_memory ()) -return false; -if (list_empty (&zone->unaccepted_pages))return false;
@@ -6688,30 +6676,20 @@ static bool cond_accept_memory(struct zoreturn ret; } -static inline bool has_unaccepted_memory (void ) -{ -return static_branch_unlikely (&zones_with_unaccepted_pages); -} -static bool __free_unaccepted (struct page *page) {struct zone *zone =page_zone (page);unsigned long flags; -bool first = false;if (!lazy_accept)return false;spin_lock_irqsave (&zone->lock, flags); - first =list_empty (&zone->unaccepted_pages);list_add_tail (&page->lru, &zone->unaccepted_pages);__mod_zone_freepage_state (zone,MAX_ORDER_NR_PAGES ,MIGRATE_MOVABLE );__mod_zone_page_state (zone,NR_UNACCEPTED ,MAX_ORDER_NR_PAGES );spin_unlock_irqrestore (&zone->lock, flags); -if (first) -static_branch_inc (&zones_with_unaccepted_pages); -return true; }
@@ -6730,11 +6708,6 @@ static bool cond_accept_memory(struct zo {return false; } - -static inline bool has_unaccepted_memory (void ) -{ -return false; -}static bool __free_unaccepted (struct page *page) {
Greg Kroah-Hartman
maintainerPATCH 105/117 Bluetooth: btnxpuart: Fix kernel panic during FW release
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neeraj Sanjay Kale <[email protected]>
commit 1f77c05408c96bc0b58ae476a9cadc9e5b9cfd0f upstream.
This fixes a kernel panic seen during release FW in a stress test scenario where WLAN and BT FW download occurs simultaneously, and due to a HW bug, chip sends out only 1 bootloader signatures.
When driver receives the bootloader signature, it enters FW download mode, but since no consequtive bootloader signatures seen, FW file is not requested.
After 60 seconds, when FW download times out, release_firmware causes a kernel panic.
[ 2601.949184] Unable to handle kernel paging request at virtual address 0000312e6f006573 [ 2601.992076] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000111802000 [ 2601.992080] [0000312e6f006573] pgd=0000000000000000, p4d=0000000000000000 [ 2601.992087] Internal error: Oops: 0000000096000021 [#1] PREEMPT SMP [ 2601.992091] Modules linked in: algif_hash algif_skcipher af_alg btnxpuart(O) pciexxx(O) mlan(O) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce snd_soc_fsl_easrc snd_soc_fsl_asoc_card imx8_media_dev(C) snd_soc_fsl_micfil polyval_generic snd_soc_fsl_xcvr snd_soc_fsl_sai snd_soc_imx_audmux snd_soc_fsl_asrc snd_soc_imx_card snd_soc_imx_hdmi snd_soc_fsl_aud2htx snd_soc_fsl_utils imx_pcm_dma dw_hdmi_cec flexcan can_dev [ 2602.001825] CPU: 2 PID: 20060 Comm: hciconfig Tainted: G C O 6.6.23-lts-next-06236-gb586a521770e #1 [ 2602.010182] Hardware name: NXP i.MX8MPlus EVK board (DT) [ 2602.010185] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 2602.010191] pc : _raw_spin_lock+0x34/0x68 [ 2602.010201] lr : free_fw_priv+0x20/0xfc [ 2602.020561] sp : ffff800089363b30 [ 2602.020563] x29: ffff800089363b30 x28: ffff0000d0eb5880 x27: 0000000000000000 [ 2602.020570] x26: 0000000000000000 x25: ffff0000d728b330 x24: 0000000000000000 [ 2602.020577] x23: ffff0000dc856f38 [ 2602.033797] x22: ffff800089363b70 x21: ffff0000dc856000 [ 2602.033802] x20: ff00312e6f006573 x19: ffff0000d0d9ea80 x18: 0000000000000000 [ 2602.033809] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaad80dd480 [ 2602.083320] x14: 0000000000000000 x13: 00000000000001b9 x12: 0000000000000002 [ 2602.083326] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff800089363a30 [ 2602.083333] x8 : ffff0001793d75c0 x7 : ffff0000d6dbc400 x6 : 0000000000000000 [ 2602.083339] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000001 [ 2602.083346] x2 : 0000000000000000 x1 : 0000000000000001 x0 : ff00312e6f006573 [ 2602.083354] Call trace: [ 2602.083356] _raw_spin_lock+0x34/0x68 [ 2602.083364] release_firmware+0x48/0x6c [ 2602.083370] nxp_setup+0x3c4/0x540 [btnxpuart] [ 2602.083383] hci_dev_open_sync+0xf0/0xa34 [ 2602.083391] hci_dev_open+0xd8/0x178 [ 2602.083399] hci_sock_ioctl+0x3b0/0x590 [ 2602.083405] sock_do_ioctl+0x60/0x118 [ 2602.083413] sock_ioctl+0x2f4/0x374 [ 2602.091430] __arm64_sys_ioctl+0xac/0xf0 [ 2602.091437] invoke_syscall+0x48/0x110 [ 2602.091445] el0_svc_common.constprop.0+0xc0/0xe0 [ 2602.091452] do_el0_svc+0x1c/0x28 [ 2602.091457] el0_svc+0x40/0xe4 [ 2602.091465] el0t_64_sync_handler+0x120/0x12c [ 2602.091470] el0t_64_sync+0x190/0x194
--- drivers/bluetooth/btnxpuart.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/bluetooth/btnxpuart.c +4 -2
@@ -601,8 +601,10 @@ static int nxp_download_firmware(struct &nxpdev->tx_state), msecs_to_jiffies(60000)); -release_firmware (nxpdev->fw); -memset (nxpdev->fw_name,0 ,sizeof (nxpdev->fw_name)); +if (nxpdev->fw &&strlen (nxpdev->fw_name)) { +release_firmware (nxpdev->fw); +memset (nxpdev->fw_name,0 ,sizeof (nxpdev->fw_name)); + }if (err ==0 ) { bt_dev_err(hdev, "FW Download Timeout. offset: %d",
Greg Kroah-Hartman
maintainerPATCH 106/117 usb: typec: ucsi: displayport: Fix deadlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Kuchynski <[email protected]>
commit 364618c89d4c57c85e5fc51a2446cd939bf57802 upstream.
This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector mutex is only locked if a connection is established and the partner pointer is valid. This resolves a deadlock scenario where ucsi_displayport_remove_partner holds con->mutex waiting for dp_altmode_work to complete while dp_altmode_work attempts to acquire it.
--- drivers/usb/typec/ucsi/displayport.c | 19 +++++++++++-------- drivers/usb/typec/ucsi/ucsi.c | 34 ++++++++++++++++++++++++++++++++++ drivers/usb/typec/ucsi/ucsi.h | 2 ++ 3 files changed, 47 insertions(+), 8 deletions(-)
drivers/usb/typec/ucsi/displayport.c +11 -8
@@ -54,7 +54,8 @@ static int ucsi_displayport_enter(structu8 cur =0 ;int ret; -mutex_lock (&dp->con->lock); +if (!ucsi_con_mutex_lock (dp->con)) +return -ENOTCONN ;if (!dp->override && dp->initialized) {const struct typec_altmode *p =typec_altmode_get_partner (alt);
@@ -100,7 +101,7 @@ static int ucsi_displayport_enter(structschedule_work (&dp->work); ret =0 ; err_unlock: -mutex_unlock (&dp->con->lock); +ucsi_con_mutex_unlock (dp->con);return ret; }
@@ -112,7 +113,8 @@ static int ucsi_displayport_exit(structu64 command;int ret =0 ; -mutex_lock (&dp->con->lock); +if (!ucsi_con_mutex_lock (dp->con)) +return -ENOTCONN ;if (!dp->override) {const struct typec_altmode *p =typec_altmode_get_partner (alt);
@@ -144,7 +146,7 @@ static int ucsi_displayport_exit(structschedule_work (&dp->work); out_unlock: -mutex_unlock (&dp->con->lock); +ucsi_con_mutex_unlock (dp->con);return ret; }
@@ -202,20 +204,21 @@ static int ucsi_displayport_vdm(struct tint cmd =PD_VDO_CMD (header);int svdm_version; -mutex_lock (&dp->con->lock); +if (!ucsi_con_mutex_lock (dp->con)) +return -ENOTCONN ;if (!dp->override && dp->initialized) {const struct typec_altmode *p =typec_altmode_get_partner (alt);dev_warn (&p->dev,"firmware doesn't support alternate mode overriding\n" ); -mutex_unlock (&dp->con->lock); +ucsi_con_mutex_unlock (dp->con);return -EOPNOTSUPP ; } svdm_version =typec_altmode_get_svdm_version (alt);if (svdm_version <0 ) { -mutex_unlock (&dp->con->lock); +ucsi_con_mutex_unlock (dp->con);return svdm_version; }
@@ -259,7 +262,7 @@ static int ucsi_displayport_vdm(struct tbreak ; } -mutex_unlock (&dp->con->lock); +ucsi_con_mutex_unlock (dp->con);return 0 ; }
drivers/usb/typec/ucsi/ucsi.c +34 -0
@@ -1560,6 +1560,40 @@ void ucsi_set_drvdata(struct ucsi *ucsi,EXPORT_SYMBOL_GPL (ucsi_set_drvdata);/** +* ucsi_con_mutex_lock - Acquire the connector mutex +* @con: The connector interface to lock +* +* Returns true on success, false if the connector is disconnected +*/ +bool ucsi_con_mutex_lock (struct ucsi_connector *con) +{ +bool mutex_locked = false; +bool connected = true; + +while (connected && !mutex_locked) { + mutex_locked =mutex_trylock (&con->lock) !=0 ; + connected = con->status.flags &UCSI_CONSTAT_CONNECTED ; +if (connected && !mutex_locked) +msleep (20 ); + } + + connected = connected && con->partner; +if (!connected && mutex_locked) +mutex_unlock (&con->lock); + +return connected; +} + +/** +* ucsi_con_mutex_unlock - Release the connector mutex +* @con: The connector interface to unlock +*/ +void ucsi_con_mutex_unlock (struct ucsi_connector *con) +{ +mutex_unlock (&con->lock); +} + +/** * ucsi_create - Allocate UCSI instance * @dev: Device interface to the PPM (Platform Policy Manager) * @ops: I/O routines
drivers/usb/typec/ucsi/ucsi.h +2 -0
@@ -79,6 +79,8 @@ int ucsi_register(struct ucsi *ucsi);void ucsi_unregister (struct ucsi *ucsi);void *ucsi_get_drvdata (struct ucsi *ucsi);void ucsi_set_drvdata (struct ucsi *ucsi,void *data); +bool ucsi_con_mutex_lock (struct ucsi_connector *con); +void ucsi_con_mutex_unlock (struct ucsi_connector *con);void ucsi_connector_change (struct ucsi *ucsi,u8 num);
Greg Kroah-Hartman
maintainerPATCH 107/117 selftests/mm: compaction_test: support platform with huge mount of memory
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
commit ab00ddd802f80e31fc9639c652d736fe3913feae upstream.
When running mm selftest to verify mm patches, 'compaction_test' case failed on an x86 server with 1TB memory. And the root cause is that it has too much free memory than what the test supports.
The test case tries to allocate 100000 huge pages, which is about 200 GB for that x86 server, and when it succeeds, it expects it's large than 1/3 of 80% of the free memory in system. This logic only works for platform with 750 GB ( 200 / (1/3) / 80% ) or less free memory, and may raise false alarm for others.
Fix it by changing the fixed page number to self-adjustable number according to the real number of free memory.
--- tools/testing/selftests/mm/compaction_test.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
tools/testing/selftests/mm/compaction_test.c +14 -5
@@ -89,6 +89,8 @@ int check_compaction(unsigned long mem_fint compaction_index =0 ;char initial_nr_hugepages[20 ] = {0 };char nr_hugepages[20 ] = {0 }; +char target_nr_hugepages[24 ] = {0 }; +int slen;/* We want to test with 80% of available memory. Else, OOM killer comes in to play */
@@ -119,11 +121,18 @@ int check_compaction(unsigned long mem_flseek (fd,0 ,SEEK_SET ); -/* Request a large number of huge pages. The Kernel will allocate -as much as it can */ -if (write (fd,"100000" , (6 *sizeof (char ))) != (6 *sizeof (char ))) { -ksft_print_msg ("Failed to write 100000 to /proc/sys/vm/nr_hugepages: %s\n" , -strerror (errno)); +/* +* Request huge pages for about half of the free memory. The Kernel +* will allocate as much as it can, and we expect it will get at least 1/3 +*/ + nr_hugepages_ul = mem_free / hugepage_size /2 ; +snprintf (target_nr_hugepages,sizeof (target_nr_hugepages), +"%lu" , nr_hugepages_ul); + + slen =strlen (target_nr_hugepages); +if (write (fd, target_nr_hugepages, slen) != slen) { +ksft_print_msg ("Failed to write %lu to /proc/sys/vm/nr_hugepages: %s\n" , + nr_hugepages_ul,strerror (errno)); goto close_fd; }
Greg Kroah-Hartman
maintainerPATCH 108/117 mm/migrate: correct nr_failed in migrate_pages_sync()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zi Yan <[email protected]>
commit a259945efe6ada94087ef666e9b38f8e34ea34ba upstream.
nr_failed was missing the large folio splits from migrate_pages_batch() and can cause a mismatch between migrate_pages() return value and the number of not migrated pages, i.e., when the return value of migrate_pages() is 0, there are still pages left in the from page list. It will happen when a non-PMD THP large folio fails to migrate due to -ENOMEM and is split successfully but not all the split pages are not migrated, migrate_pages_batch() would return non-zero, but astats.nr_thp_split = 0. nr_failed would be 0 and returned to the caller of migrate_pages(), but the not migrated pages are left in the from page list without being added back to LRU lists.
Fix it by adding a new nr_split counter for large folio splits and adding it to nr_failed in migrate_page_sync() after migrate_pages_batch() is done.
--- mm/migrate.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
mm/migrate.c +13 -3
@@ -1504,6 +1504,7 @@ struct migrate_pages_stats {int nr_thp_succeeded;/* THP migrated successfully */ int nr_thp_failed;/* THP failed to be migrated */ int nr_thp_split;/* THP split before migrating */ +int nr_split;/* Large folio (include THP) split before migrating */ };/*
@@ -1623,6 +1624,7 @@ static int migrate_pages_batch(struct liint nr_retry_pages =0 ;int pass =0 ;bool is_thp = false; +bool is_large = false;struct folio *folio, *folio2, *dst =NULL , *dst2;int rc, rc_saved =0 , nr_pages;LIST_HEAD (unmap_folios);
@@ -1638,7 +1640,8 @@ static int migrate_pages_batch(struct li nr_retry_pages =0 ;list_for_each_entry_safe (folio, folio2, from, lru) { - is_thp =folio_test_large (folio) &&folio_test_pmd_mappable (folio); + is_large =folio_test_large (folio); + is_thp = is_large &&folio_test_pmd_mappable (folio); nr_pages =folio_nr_pages (folio);cond_resched ();
@@ -1658,6 +1661,7 @@ static int migrate_pages_batch(struct li stats->nr_thp_failed++;if (!try_split_folio (folio, split_folios)) { stats->nr_thp_split++; + stats->nr_split++;continue ; } stats->nr_failed_pages += nr_pages;
@@ -1686,11 +1690,12 @@ static int migrate_pages_batch(struct li nr_failed++; stats->nr_thp_failed += is_thp;/* Large folio NUMA faulting doesn't split to retry. */ -if (folio_test_large (folio) && !nosplit) { +if (is_large && !nosplit) {int ret =try_split_folio (folio, split_folios);if (!ret) { stats->nr_thp_split += is_thp; + stats->nr_split += is_large;break ; }else if (reason ==MR_LONGTERM_PIN && ret == -EAGAIN ) {
@@ -1836,6 +1841,7 @@ static int migrate_pages_sync(struct lis stats->nr_succeeded += astats.nr_succeeded; stats->nr_thp_succeeded += astats.nr_thp_succeeded; stats->nr_thp_split += astats.nr_thp_split; + stats->nr_split += astats.nr_split;if (rc <0 ) { stats->nr_failed_pages += astats.nr_failed_pages; stats->nr_thp_failed += astats.nr_thp_failed;
@@ -1843,7 +1849,11 @@ static int migrate_pages_sync(struct lisreturn rc; } stats->nr_thp_failed += astats.nr_thp_split; - nr_failed += astats.nr_thp_split; +/* +* Do not count rc, as pages will be retried below. +* Count nr_split only, since it includes nr_thp_split. +*/ + nr_failed += astats.nr_split;/* * Fall back to migrate all failed folios one by one synchronously. All * failed folios except split THPs will be retried, so their failure
Greg Kroah-Hartman
maintainerPATCH 109/117 bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
commit 19d3c179a37730caf600a97fed3794feac2b197b upstream.
When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls __bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them the struct bpf_tramp_image *im pointer as an argument in R0.
The trampoline generation code uses emit_addr_mov_i64() to emit instructions for moving the bpf_tramp_image address into R0, but emit_addr_mov_i64() assumes the address to be in the vmalloc() space and uses only 48 bits. Because bpf_tramp_image is allocated using kzalloc(), its address can use more than 48-bits, in this case the trampoline will pass an invalid address to __bpf_tramp_enter/exit() causing a kernel crash.
Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64() as it can work with addresses that are greater than 48-bits.
--- arch/arm64/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/net/bpf_jit_comp.c +2 -2
@@ -2001,7 +2001,7 @@ static int prepare_trampoline(struct jitemit (A64_STR64I (A64_R (20 ),A64_SP , regs_off +8 ), ctx);if (flags &BPF_TRAMP_F_CALL_ORIG ) { -emit_addr_mov_i64 (A64_R (0 ), (const u64 )im, ctx); +emit_a64_mov_i64 (A64_R (0 ), (const u64 )im, ctx);emit_call ((const u64 )__bpf_tramp_enter, ctx); }
@@ -2045,7 +2045,7 @@ static int prepare_trampoline(struct jitif (flags &BPF_TRAMP_F_CALL_ORIG ) { im->ip_epilogue = ctx->image + ctx->idx; -emit_addr_mov_i64 (A64_R (0 ), (const u64 )im, ctx); +emit_a64_mov_i64 (A64_R (0 ), (const u64 )im, ctx);emit_call ((const u64 )__bpf_tramp_exit, ctx); }
Greg Kroah-Hartman
maintainerPATCH 110/117 bpf, arm64: Fix address emission with tag-based KASAN enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Collingbourne <[email protected]>
commit a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c upstream.
When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit_a64_mov_i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpf_tramp_image address emission.
--- arch/arm64/net/bpf_jit_comp.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
arch/arm64/net/bpf_jit_comp.c +10 -2
@@ -2001,7 +2001,11 @@ static int prepare_trampoline(struct jitemit (A64_STR64I (A64_R (20 ),A64_SP , regs_off +8 ), ctx);if (flags &BPF_TRAMP_F_CALL_ORIG ) { -emit_a64_mov_i64 (A64_R (0 ), (const u64 )im, ctx); +/* for the first pass, assume the worst case */ +if (!ctx->image) + ctx->idx +=4 ; +else +emit_a64_mov_i64 (A64_R (0 ), (const u64 )im, ctx);emit_call ((const u64 )__bpf_tramp_enter, ctx); }
@@ -2045,7 +2049,11 @@ static int prepare_trampoline(struct jitif (flags &BPF_TRAMP_F_CALL_ORIG ) { im->ip_epilogue = ctx->image + ctx->idx; -emit_a64_mov_i64 (A64_R (0 ), (const u64 )im, ctx); +/* for the first pass, assume the worst case */ +if (!ctx->image) + ctx->idx +=4 ; +else +emit_a64_mov_i64 (A64_R (0 ), (const u64 )im, ctx);emit_call ((const u64 )__bpf_tramp_exit, ctx); }
Greg Kroah-Hartman
maintainerPATCH 111/117 LoongArch: Explicitly specify code model in Makefile
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit e67e0eb6a98b261caf45048f9eb95fd7609289c0 upstream.
LoongArch's toolchain may change the default code model from normal to medium. This is unnecessary for kernel, and generates some relocations which cannot be handled by the module loader. So explicitly specify the code model to normal in Makefile (for Rust 'normal' is 'small').
--- arch/loongarch/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/Makefile +1 -1
@@ -43,7 +43,7 @@ endif ifdef CONFIG_64BIT ld-emul = $(64bit-emul) -cflags-y += -mabi=lp64s +cflags-y += -mabi=lp64s -mcmodel=normal endif cflags-y += -pipe -msoft-float
Greg Kroah-Hartman
maintainerPATCH 112/117 memblock: Accept allocated memory before use in memblock_double_array()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <[email protected]>
commit da8bf5daa5e55a6af2b285ecda460d6454712ff4 upstream.
When increasing the array size in memblock_double_array() and the slab is not yet available, a call to memblock_find_in_range() is used to reserve/allocate memory. However, the range returned may not have been accepted, which can result in a crash when booting an SNP guest:
RIP: 0010:memcpy_orig+0x68/0x130 Code: ... RSP: 0000:ffffffff9cc03ce8 EFLAGS: 00010006 RAX: ff11001ff83e5000 RBX: 0000000000000000 RCX: fffffffffffff000 RDX: 0000000000000bc0 RSI: ffffffff9dba8860 RDI: ff11001ff83e5c00 RBP: 0000000000002000 R08: 0000000000000000 R09: 0000000000002000 R10: 000000207fffe000 R11: 0000040000000000 R12: ffffffff9d06ef78 R13: ff11001ff83e5000 R14: ffffffff9dba7c60 R15: 0000000000000c00 memblock_double_array+0xff/0x310 memblock_add_range+0x1fb/0x2f0 memblock_reserve+0x4f/0xa0 memblock_alloc_range_nid+0xac/0x130 memblock_alloc_internal+0x53/0xc0 memblock_alloc_try_nid+0x3d/0xa0 swiotlb_init_remap+0x149/0x2f0 mem_init+0xb/0xb0 mm_core_init+0x8f/0x350 start_kernel+0x17e/0x5d0 x86_64_start_reservations+0x14/0x30 x86_64_start_kernel+0x92/0xa0 secondary_startup_64_no_verify+0x194/0x19b
Mitigate this by calling accept_memory() on the memory range returned before the slab is available.
Prior to v6.12, the accept_memory() interface used a 'start' and 'end' parameter instead of 'start' and 'size', therefore the accept_memory() call must be adjusted to specify 'start + size' for 'end' when applying to kernels prior to v6.12.
--- mm/memblock.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
mm/memblock.c +8 -1
@@ -460,7 +460,14 @@ static int __init_memblock memblock_doubmin (new_area_start, memblock.current_limit), new_alloc_size, PAGE_SIZE); - new_array = addr ?__va (addr) :NULL ; +if (addr) { +/* The memory may not have been accepted, yet. */ +accept_memory (addr, addr + new_alloc_size); + + new_array =__va (addr); + }else { + new_array =NULL ; + } }if (!addr) { pr_err("memblock: Failed to double %s array from %ld to %ld entries !\n",
Greg Kroah-Hartman
maintainerPATCH 113/117 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Wupeng <[email protected]>
commit af288a426c3e3552b62595c6138ec6371a17dbba upstream.
Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_range in order to make offline hwpoisoned page possible by introducing isolate_lru_page and try_to_unmap for hwpoisoned page. However folio lock must be held before calling try_to_unmap. Add it to fix this problem.
Warning will be produced if folio is not locked during unmap:
------------[ cut here ]------------ kernel BUG at ./include/linux/swapops.h:400! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G W 6.13.0-rc1-00016-g3c434c7ee82a-dirty #41 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : try_to_unmap_one+0xb08/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0xb08/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000) ---[ end trace 0000000000000000 ]---
--- mm/memory_hotplug.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
mm/memory_hotplug.c +5 -1
@@ -1735,8 +1735,12 @@ static void do_migrate_range(unsigned loif (PageHWPoison (page)) {if (WARN_ON (folio_test_lru (folio)))folio_isolate_lru (folio); -if (folio_mapped (folio)) +if (folio_mapped (folio)) { +folio_lock (folio);try_to_unmap (folio,TTU_IGNORE_MLOCK ); +folio_unlock (folio); + } +continue ; }
Greg Kroah-Hartman
maintainerPATCH 114/117 sctp: add mutual exclusion in proc_sctp_do_udp_port()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 10206302af856791fbcc27a33ed3c3eb09b2793d upstream.
We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start() or risk a crash as syzbot reported:
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000d: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 UID: 0 PID: 6551 Comm: syz.1.44 Not tainted 6.14.0-syzkaller-g7f2ff7b62617 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:kernel_sock_shutdown+0x47/0x70 net/socket.c:3653 Call Trace: <TASK> udp_tunnel_sock_release+0x68/0x80 net/ipv4/udp_tunnel_core.c:181 sctp_udp_sock_stop+0x71/0x160 net/sctp/protocol.c:930 proc_sctp_do_udp_port+0x264/0x450 net/sctp/sysctl.c:553 proc_sys_call_handler+0x3d0/0x5b0 fs/proc/proc_sysctl.c:601 iter_file_splice_write+0x91c/0x1150 fs/splice.c:738 do_splice_from fs/splice.c:935 [inline] direct_splice_actor+0x18f/0x6c0 fs/splice.c:1158 splice_direct_to_actor+0x342/0xa30 fs/splice.c:1102 do_splice_direct_actor fs/splice.c:1201 [inline] do_splice_direct+0x174/0x240 fs/splice.c:1227 do_sendfile+0xafd/0xe50 fs/read_write.c:1368 __do_sys_sendfile64 fs/read_write.c:1429 [inline] __se_sys_sendfile64 fs/read_write.c:1415 [inline] __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1415 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
--- net/sctp/sysctl.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sctp/sysctl.c +4 -0
@@ -529,6 +529,8 @@ static int proc_sctp_do_auth(struct ctl_return ret; } +static DEFINE_MUTEX (sctp_sysctl_mutex); +static int proc_sctp_do_udp_port (struct ctl_table *ctl,int write,void *buffer,size_t *lenp,loff_t *ppos) {
@@ -553,6 +555,7 @@ static int proc_sctp_do_udp_port(structif (new_value > max || new_value < min)return -EINVAL ; +mutex_lock (&sctp_sysctl_mutex); net->sctp.udp_port = new_value;sctp_udp_sock_stop (net);if (new_value) {
@@ -565,6 +568,7 @@ static int proc_sctp_do_udp_port(structlock_sock (sk);sctp_sk (sk)->udp_port =htons (net->sctp.udp_port);release_sock (sk); +mutex_unlock (&sctp_sysctl_mutex); }return ret;
Greg Kroah-Hartman
maintainerPATCH 115/117 btrfs: dont BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 28cb13f29faf6290597b24b728dc3100c019356f upstream.
Instead of doing a BUG_ON() handle the error by returning -EUCLEAN, aborting the transaction and logging an error message.
--- fs/btrfs/extent-tree.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-)
fs/btrfs/extent-tree.c +20 -5
@@ -164,6 +164,14 @@ search_again: ei =btrfs_item_ptr (leaf, path->slots[0 ], struct btrfs_extent_item); num_refs =btrfs_extent_refs (leaf, ei); +if (unlikely (num_refs ==0 )) { + ret = -EUCLEAN ; +btrfs_err (fs_info, +"unexpected zero reference count for extent item (%llu %u %llu)" , + key.objectid, key.type, key.offset); +btrfs_abort_transaction (trans, ret); + goto out_free; + } extent_flags =btrfs_extent_flags (leaf, ei); }else { ret = -EUCLEAN ;
@@ -177,8 +185,6 @@ search_again: goto out_free; } - -BUG_ON (num_refs ==0 ); }else { num_refs =0 ; extent_flags =0 ;
@@ -208,10 +214,19 @@ search_again: goto search_again; }spin_lock (&head->lock); -if (head->extent_op && head->extent_op->update_flags) +if (head->extent_op && head->extent_op->update_flags) { extent_flags |= head->extent_op->flags_to_set; -else -BUG_ON (num_refs ==0 ); + }else if (unlikely (num_refs ==0 )) { +spin_unlock (&head->lock); +mutex_unlock (&head->mutex); +spin_unlock (&delayed_refs->lock); + ret = -EUCLEAN ; +btrfs_err (fs_info, +"unexpected zero reference count for extent %llu (%s)" , + bytenr, metadata ?"metadata" :"data" ); +btrfs_abort_transaction (trans, ret); + goto out_free; + } num_refs += head->ref_mod;spin_unlock (&head->lock);
Greg Kroah-Hartman
maintainerPATCH 116/117 phy: tegra: xusb: remove a stray unlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 83c178470e0bf690d34c8c08440f2421b82e881c upstream.
We used to take a lock in tegra186_utmi_bias_pad_power_on() but now we have moved the lock into the caller. Unfortunately, when we moved the lock this unlock was left behind and it results in a double unlock. Delete it now.
--- drivers/phy/tegra/xusb-tegra186.c | 2 -- 1 file changed, 2 deletions(-)
drivers/phy/tegra/xusb-tegra186.c +0 -2
@@ -656,8 +656,6 @@ static void tegra186_utmi_bias_pad_power }else {clk_disable_unprepare (priv->usb2_trk_clk); } - -mutex_unlock (&padctl->lock); }static void tegra186_utmi_bias_pad_power_off (struct tegra_xusb_padctl *padctl)
Greg Kroah-Hartman
maintainerPATCH 117/117 drm/amdgpu: fix pm notifier handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 4aaffc85751da5722e858e4333e8cf0aa4b6c78f upstream.
Set the s3/s0ix and s4 flags in the pm notifier so that we can skip the resource evictions properly in pm prepare based on whether we are suspending or hibernating. Drop the eviction as processes are not frozen at this time, we we can end up getting stuck trying to evict VRAM while applications continue to submit work which causes the buffers to get pulled back into VRAM.
v2: Move suspend flags out of pm notifier (Mario)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 18 +++++------------- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 10 +--------- 2 files changed, 6 insertions(+), 22 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +5 -13
@@ -4125,28 +4125,20 @@ static int amdgpu_device_evict_resources* @data: data * * This function is called when the system is about to suspend or hibernate. -* It is used to evict resources from the device before the system goes to -* sleep while there is still access to swap. +* It is used to set the appropriate flags so that eviction can be optimized +* in the pm prepare callback. */ static int amdgpu_device_pm_notifier (struct notifier_block *nb,unsigned long mode,void *data) { struct amdgpu_device *adev = container_of(nb, struct amdgpu_device, pm_nb); -int r;switch (mode) {case PM_HIBERNATION_PREPARE : adev->in_s4 = true; - fallthrough; -case PM_SUSPEND_PREPARE : - r =amdgpu_device_evict_resources (adev); -/* -* This is considered non-fatal at this time because -* amdgpu_device_prepare() will also fatally evict resources. -* See https://gitlab.freedesktop.org/drm/amd/-/issues/3781 -*/ -if (r) -drm_warn (adev_to_drm (adev),"Failed to evict resources, freeze active processes if problems occur: %d\n" , r); +break ; +case PM_POST_HIBERNATION : + adev->in_s4 = false;break ; }
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +1 -9
@@ -2475,13 +2475,8 @@ static int amdgpu_pmops_freeze(struct destatic int amdgpu_pmops_thaw (struct device *dev) {struct drm_device *drm_dev =dev_get_drvdata (dev); -struct amdgpu_device *adev =drm_to_adev (drm_dev); -int r; - r =amdgpu_device_resume (drm_dev, true); - adev->in_s4 = false; - -return r; +return amdgpu_device_resume (drm_dev, true); }static int amdgpu_pmops_poweroff (struct device *dev)
@@ -2494,9 +2489,6 @@ static int amdgpu_pmops_poweroff(structstatic int amdgpu_pmops_restore (struct device *dev) {struct drm_device *drm_dev =dev_get_drvdata (dev); -struct amdgpu_device *adev =drm_to_adev (drm_dev); - - adev->in_s4 = false;return amdgpu_device_resume (drm_dev, true); }
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 22 May 2025 12:57:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.92-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 8 lines · On Tue, 20 May 2025 15:49:25 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 22 May 2025 12:57:37 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64:
Thanks!
Cheers,
Miguel
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 22 May 2025 12:57:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.92-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 22 May 2025 12:57:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.92-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 22 May 2025 12:57:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.92-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.6:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
116 tests: 116 pass, 0 failLinux version: 6.6.92-rc1-g18952a1fc4ac
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 22 May 2025 12:57:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.92-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.6.92-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 18952a1fc4ac790deb4faa116f18310d7010a9fb
* git describe: v6.6.91-118-g18952a1fc4ac
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.91-118-g18952a1fc4ac
## Test Regressions (compared to v6.6.90-114-g477cfead3566)
## Metric Regressions (compared to v6.6.90-114-g477cfead3566)
## Test Fixes (compared to v6.6.90-114-g477cfead3566)
## Metric Fixes (compared to v6.6.90-114-g477cfead3566)
## Test result summary
total: 236734, pass: 211762, fail: 5845, skip: 18530, xfail: 597
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 129 total, 129 passed, 0 failed
* arm64: 44 total, 44 passed, 0 failed
* i386: 23 total, 20 passed, 3 failed
* mips: 26 total, 22 passed, 4 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 32 total, 31 passed, 1 failed
* riscv: 20 total, 20 passed, 0 failed
* s390: 14 total, 13 passed, 1 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 7 total, 7 passed, 0 failed
* x86_64: 37 total, 33 passed, 4 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* modules
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Am 20.05.2025 um 15:49 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
The kernel, bpf tool and perf tool builds fine for v6.6.92-rc1 on x86 and arm64 Azure VM.
Thanks,
Hardik
Quoted 501 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.92 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 22 May 2025 12:57:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.92-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 6.6.92-rc1Alex Deucher <[email protected]>
drm/amdgpu: fix pm notifier handlingDan Carpenter <[email protected]>
phy: tegra: xusb: remove a stray unlockFilipe Manana <[email protected]>
btrfs: don'tBUG_ON()when 0 reference count atbtrfs_lookup_extent_info()Eric Dumazet <[email protected]>
sctp: add mutual exclusion inproc_sctp_do_udp_port()Ma Wupeng <[email protected]>
hwpoison,memory_hotplug: lock folio before unmap hwpoisoned folioTom Lendacky <[email protected]>
memblock: Accept allocated memory before use inmemblock_double_array()Huacai Chen <[email protected]>
LoongArch: Explicitly specify code model inMakefilePeter Collingbourne <[email protected]>
bpf, arm64: Fix address emission with tag-based KASAN enabledPuranjay Mohan <[email protected]>
bpf, arm64: Fix trampoline forBPF_TRAMP_F_CALL_ORIGZi Yan <[email protected]>
mm/migrate: correctnr_failedinmigrate_pages_sync()Feng Tang <[email protected]>
selftests/mm:compaction_test: support platform with huge mount of memoryAndrei Kuchynski <[email protected]>
usb: typec: ucsi: displayport: Fix deadlockNeeraj Sanjay Kale <[email protected]>
Bluetooth: btnxpuart: Fix kernel panic during FW releaseKirill A. Shutemov <[email protected]>
mm/page_alloc: fix race condition in unaccepted memory handlingPawan Gupta <[email protected]>
x86/its: Fix build error forits_static_thunk()Shuai Xue <[email protected]>
dmaengine: idxd: Refactor remove call withidxd_cleanup()helperShuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path ofidxd_pci_probeShuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path ofidxd_allocShuai Xue <[email protected]>
dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove callShuai Xue <[email protected]>
dmaengine: idxd: Add missing cleanups in cleanup internalsShuai Xue <[email protected]>
dmaengine: idxd: Add missing cleanup for early error out inidxd_setup_internalsShuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path ofidxd_setup_groupsShuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path ofidxd_setup_enginesShuai Xue <[email protected]>
dmaengine: idxd: fix memory leak in error handling path ofidxd_setup_wqsYemike Abhilash Chandra <[email protected]>
dmaengine: ti: k3-udma: Usecap_maskdirectly fromdma_devicestructure instead of a local copyRonald Wahl <[email protected]>
dmaengine: ti: k3-udma: Add missing lockingNathan Chancellor <[email protected]>
net: qede: Initializeqede_ll_opswith designated initializerFedor Pchelkin <[email protected]>
wifi: mt76: disable napi on driver removalAaron Kling <[email protected]>
spi: tegra114: Use value to check for invalid delaysJethro Donaldson <[email protected]>
smb: client: fix memory leak during error handling for POSIX mkdirSteve Siwinski <[email protected]>
scsi:sd_zbc: block: Respect bio vector limits for REPORT ZONES bufferClaudiu Beznea <[email protected]>
phy: renesas: rcar-gen3-usb2: Set timing registers only onceClaudiu Beznea <[email protected]>
phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bindMa Ke <[email protected]>
phy: Fix error handling integra_xusb_port_initWayne Chang <[email protected]>
phy: tegra: xusb: Use a bitmask for UTMI pad power state trackingSteven Rostedt <[email protected]>
tracing: samples: Initializetrace_array_printk()with the correct functionpengdonglin <[email protected]>
ftrace: Fix preemption accounting for stacktrace filter commandpengdonglin <[email protected]>
ftrace: Fix preemption accounting for stacktrace trigger commandMichael Kelley <[email protected]>
Drivers: hv: vmbus: Removevmbus_sendpacket_pagebuffer()Michael Kelley <[email protected]>
Drivers: hv: Allowvmbus_sendpacket_mpb_desc()to create multiple rangesMichael Kelley <[email protected]>
hv_netvsc: Removermsg_pgcntMichael Kelley <[email protected]>
hv_netvsc: Preserve contiguous PFN grouping in the page buffer arrayMichael Kelley <[email protected]>
hv_netvsc: Usevmbus_sendpacket_mpb_desc()to send VMBus messagesHyejeong Choi <[email protected]>
dma-buf: insert memory barrier before updatingnum_fencesNicolas Chauvet <[email protected]>
ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB CameraChristian Heusel <[email protected]>
ALSA: usb-audio: Add sample rate quirk for Audioengine D1Wentao Liang <[email protected]>
ALSA: es1968: Add error handling forsnd_pcm_hw_constraint_pow2()Jeremy Linton <[email protected]>
ACPI: PPTT: Fix processor subtable walkWayne Lin <[email protected]>
drm/amd/display: Avoid flooding unnecessary info messagesWayne Lin <[email protected]>
drm/amd/display: Correct the reply value when AUX write incompleteTiezhu Yang <[email protected]>
LoongArch: uprobes: Remove redundant code aboutresume_eraTiezhu Yang <[email protected]>
LoongArch: uprobes: Remove user_{en,dis}able_single_step()Huacai Chen <[email protected]>
LoongArch: FixMAX_REG_OFFSETcalculationHuacai Chen <[email protected]>
LoongArch: Save and restore CSR.CNTC for hibernationTianyang Zhang <[email protected]>
LoongArch: Preventcond_resched()occurring within kernel-fpuJan Kara <[email protected]>
udf: Make surei_lenExtentsis uptodate on inode evictionNathan Lynch <[email protected]>
dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"Trond Myklebust <[email protected]>
NFSv4/pnfs: Reset the layout state after a layoutreturnGerhard Engleder <[email protected]>
tsnep: fix timestamping with a stacked DSA driverGerhard Engleder <[email protected]>
tsnep: Inline small fragments within TX descriptorPengtao He <[email protected]>
net/tls: fix kernel panic whenalloc_pagefailedIdo Schimmel <[email protected]>
mlxsw:spectrum_router: Fix use-after-free when deleting GRE net devicesKees Cook <[email protected]>
wifi: mac80211: Setn_channelsafter allocating structcfg80211_scan_requestHariprasad Kelam <[email protected]>
octeontx2-af: Fix CGX Receive countersBo-Cun Chen <[email protected]>
net: ethernet:mtk_eth_soc: fix typo for declaration MT7988 ESW capabilitySubbaraya Sundeep <[email protected]>
octeontx2-pf: macsec: Fix incorrect max transmit size in TX secyCosmin Tanislav <[email protected]>
regulator: max20086: fix invalid memory accessAbdun Nihaal <[email protected]>
qlcnic: fix memory leak inqlcnic_sriov_channel_cfg_cmd()Carolina Jubran <[email protected]>
net/mlx5e: Disable MACsec offload for uplink representor profileGeert Uytterhoeven <[email protected]>
ALSA: sh:SND_AICAshould depend onSH_DMA_APIKeith Busch <[email protected]>
nvme-pci: acquirecq_poll_lockinnvme_poll_irqdisableKees Cook <[email protected]>
nvme-pci: makenvme_pci_npages_prp()__always_inlineVladimir Oltean <[email protected]>
net: dsa: sja1105: discard incoming frames inBR_STATE_LISTENINGMathieu Othacehe <[email protected]>
net: cadence: macb: Fix a possible deadlock inmacb_halt_tx.Takashi Iwai <[email protected]>
ALSA: ump: Fix a typo ofsnd_ump_stream_msg_device_infoTakashi Iwai <[email protected]>
ALSA: seq: Fix delivery of UMP events to group portsAndrew Jeffery <[email protected]>
net: mctp: Ensure keys maintain only one ref to corresponding devMatt Johnston <[email protected]>
net: mctp: Don't accessifa_indexwhen missingEric Dumazet <[email protected]>
mctp: no longer rely on net->dev_index_head[]Hangbin Liu <[email protected]>
tools/net/ynl: ethtool: fix crash when Hardware Clock info is missingRahul Rameshbabu <[email protected]>
tools: ynl:ethtool.py: Output timestamping statistics from tsinfo-get operationCong Wang <[email protected]>
net_sched: Flush gso_skb list too during ->change()Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: FixMGMT_OP_ADD_DEVICEinvalid device flagsGeert Uytterhoeven <[email protected]>
spi: loopback-test: Do not split 1024-byte hexdumpsLi Lingfeng <[email protected]>
nfs: handle failure ofnfs_get_lock_contextin unlock pathHenry Martin <[email protected]>
HID: uclogic: Add NULL check inuclogic_input_configured()Qasim Ijaz <[email protected]>
HID: thrustmaster: fix memory leak inthrustmaster_interrupts()Zhu Yanjun <[email protected]>
RDMA/rxe: Fix slab-use-after-free Read inrxe_queue_cleanupbugDavid Lechner <[email protected]>
iio: chemical: sps30: usealigned_s64for timestampJonathan Cameron <[email protected]>
iio: adc: ad7768-1: Fix insufficient alignment of timestamp.Alex Deucher <[email protected]>
Revert "drm/amd: Stop evicting resources on APUs in suspend"Mario Limonciello <[email protected]>
drm/amd: Add Suspend/Hibernate notification callback supportZhigang Luo <[email protected]>
drm/amdgpu: triggerflr_workif reading pf2vf data failedMa Jun <[email protected]>
drm/amdgpu: Fix the runtime resume failure issueMario Limonciello <[email protected]>
drm/amd: Stop evicting resources on APUs in suspendJonathan Cameron <[email protected]>
iio: adc: ad7266: Fix potential timestamp alignment issue.Mikhail Lobanov <[email protected]>
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interceptionPeter Gonda <[email protected]>
KVM: SVM: Update SEV-ES shutdown intercepts with more metadataCristian Marussi <[email protected]>
firmware:arm_scmi: Fix timeout checks on polling pathLuke Parkin <[email protected]>
firmware:arm_scmi: Track basic SCMI communication debug metricsLuke Parkin <[email protected]>
firmware:arm_scmi: Add support for debug metrics at the interfaceCristian Marussi <[email protected]>
firmware:arm_scmi: Add message dump traces for bad and unexpected repliesCristian Marussi <[email protected]>
firmware:arm_scmi: Add helper to trace bad messagesMichal Suchanek <[email protected]>
tpm: tis: Double the timeout B to 4sMasami Hiramatsu (Google) <[email protected]>
tracing: probes: Fix a possible race intrace_probe_logAPIsWaiman Long <[email protected]>
cgroup/cpuset: Extendkthread_is_per_cpu()check to allPF_NO_SETAFFINITYtasksHans de Goede <[email protected]>
platform/x86: asus-wmi: Fixwlan_ctrl_by_userdetectionRunhua He <[email protected]>
platform/x86/amd/pmc: Declarequirk_spurious_8042for MECHREVO Wujie 14XA (GX4HRXL)Kees Cook <[email protected]>
binfmt_elf: Move brk for static PIE even if ASLR disabledKees Cook <[email protected]>
binfmt_elf: HonorPT_LOADalignment for static PIEKees Cook <[email protected]>
binfmt_elf: Calculatetotal_sizeearlierKees Cook <[email protected]>
selftests/exec: Build both static and non-staticload_addresstestsKees Cook <[email protected]>
binfmt_elf: Leave a gap between .bss and brkMuhammad Usama Anjum <[email protected]>
selftests/exec:load_address: conform test to TAP format outputKees Cook <[email protected]>
binfmt_elf:elf_bssno longer used byload_elf_binary()Eric W. Biederman <[email protected]>
binfmt_elf: Support segments with 0 filesz and misaligned startsStephen Smalley <[email protected]>
fs/xattr.c: fixsimple_xattr_listto always include security.* xattrs-------------
Diffstat:
Makefile | 4 +- arch/arm64/net/bpf_jit_comp.c | 12 +- arch/loongarch/Makefile | 2 +- arch/loongarch/include/asm/ptrace.h | 2 +- arch/loongarch/include/asm/uprobes.h | 1 - arch/loongarch/kernel/kfpu.c | 22 +- arch/loongarch/kernel/time.c | 2 +- arch/loongarch/kernel/uprobes.c | 11 +- arch/loongarch/power/hibernate.c | 3 + arch/x86/kernel/alternative.c | 17 +- arch/x86/kvm/smm.c | 1 + arch/x86/kvm/svm/svm.c | 19 +- block/bio.c | 2 +- drivers/acpi/pptt.c | 11 +- drivers/bluetooth/btnxpuart.c | 6 +- drivers/char/tpm/tpm_tis_core.h | 2 +- drivers/dma-buf/dma-resv.c | 5 +- drivers/dma/dmatest.c | 6 +- drivers/dma/idxd/init.c | 159 ++++++++---- drivers/dma/ti/k3-udma.c | 10 +- drivers/firmware/arm_scmi/Kconfig | 14 + drivers/firmware/arm_scmi/common.h | 35 +++ drivers/firmware/arm_scmi/driver.c | 89 ++++++- drivers/firmware/arm_scmi/mailbox.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 51 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 29 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 3 + drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c | 2 + drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c | 2 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 16 +- drivers/hid/hid-thrustmaster.c | 1 + drivers/hid/hid-uclogic-core.c | 7 +- drivers/hv/channel.c | 65 +---- drivers/iio/adc/ad7266.c | 2 +- drivers/iio/adc/ad7768-1.c | 2 +- drivers/iio/chemical/sps30.c | 2 +- drivers/infiniband/sw/rxe/rxe_cq.c | 5 +- drivers/net/dsa/sja1105/sja1105_main.c | 6 +- drivers/net/ethernet/cadence/macb_main.c | 19 +- drivers/net/ethernet/engleder/tsnep_hw.h | 2 + drivers/net/ethernet/engleder/tsnep_main.c | 131 +++++++--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 + .../ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 3 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 + drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- .../ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 7 +- drivers/net/hyperv/hyperv_net.h | 13 +- drivers/net/hyperv/netvsc.c | 57 ++++- drivers/net/hyperv/netvsc_drv.c | 62 +---- drivers/net/hyperv/rndis_filter.c | 24 +- drivers/net/wireless/mediatek/mt76/dma.c | 1 + drivers/nvme/host/pci.c | 4 +- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 38 ++- drivers/phy/tegra/xusb-tegra186.c | 46 ++-- drivers/phy/tegra/xusb.c | 8 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 + drivers/platform/x86/asus-wmi.c | 3 +- drivers/regulator/max20086-regulator.c | 7 +- drivers/scsi/sd_zbc.c | 6 +- drivers/scsi/storvsc_drv.c | 1 + drivers/spi/spi-loopback-test.c | 2 +- drivers/spi/spi-tegra114.c | 6 +- drivers/usb/gadget/function/f_midi2.c | 2 +- drivers/usb/typec/ucsi/displayport.c | 19 +- drivers/usb/typec/ucsi/ucsi.c | 34 +++ drivers/usb/typec/ucsi/ucsi.h | 2 + fs/binfmt_elf.c | 281 ++++++++++++--------- fs/btrfs/extent-tree.c | 25 +- fs/nfs/nfs4proc.c | 9 +- fs/nfs/pnfs.c | 9 + fs/smb/client/smb2pdu.c | 2 +- fs/udf/truncate.c | 2 +- fs/xattr.c | 24 ++ include/linux/bio.h | 1 + include/linux/hyperv.h | 7 - include/linux/tpm.h | 2 +- include/net/sch_generic.h | 15 ++ include/sound/ump_msg.h | 4 +- kernel/cgroup/cpuset.c | 6 +- kernel/trace/trace_dynevent.c | 16 +- kernel/trace/trace_dynevent.h | 1 + kernel/trace/trace_events_trigger.c | 2 +- kernel/trace/trace_functions.c | 6 +- kernel/trace/trace_kprobe.c | 2 +- kernel/trace/trace_probe.c | 9 + kernel/trace/trace_uprobe.c | 2 +- mm/memblock.c | 9 +- mm/memory_hotplug.c | 6 +- mm/migrate.c | 16 +- mm/page_alloc.c | 27 -- net/bluetooth/mgmt.c | 9 +- net/mac80211/main.c | 6 +- net/mctp/device.c | 65 +++-- net/mctp/route.c | 4 +- net/sched/sch_codel.c | 2 +- net/sched/sch_fq.c | 2 +- net/sched/sch_fq_codel.c | 2 +- net/sched/sch_fq_pie.c | 2 +- net/sched/sch_hhf.c | 2 +- net/sched/sch_pie.c | 2 +- net/sctp/sysctl.c | 4 + net/tls/tls_strp.c | 3 +- samples/ftrace/sample-trace-array.c | 2 +- sound/core/seq/seq_clientmgr.c | 52 ++-- sound/core/seq/seq_ump_convert.c | 18 ++ sound/core/seq/seq_ump_convert.h | 1 + sound/pci/es1968.c | 6 +- sound/sh/Kconfig | 2 +- sound/usb/quirks.c | 4 + tools/net/ynl/ethtool.py | 29 ++- tools/testing/selftests/exec/Makefile | 19 +- tools/testing/selftests/exec/load_address.c | 83 ++++-- tools/testing/selftests/mm/compaction_test.c | 19 +- 118 files changed, 1294 insertions(+), 693 deletions(-)