5.4.295-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.4.295-rc1 review
This is the start of the stable review cycle for the 5.4.295 release. There are 222 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.295-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.295-rc1
Tengda Wu <[email protected]>
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
Peter Zijlstra <[email protected]>
perf: Fix sample vs do_exit()
Heiko Carstens <[email protected]>
s390/pci: Fix __pcilg_mio_inuser() inline assembly
David Gow <[email protected]>
rtc: test: Fix invalid format specifier.
Jeongjun Park <[email protected]>
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
Gavin Guo <[email protected]>
mm/huge_memory: fix dereferencing invalid pmd migration entry
Alexandre Mergnat <[email protected]>
rtc: Make rtc_time64_to_tm() support dates before 1970
Cassio Neri <[email protected]>
rtc: Improve performance of rtc_time64_to_tm(). Add tests.
Dan Aloni <[email protected]>
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
Oleg Nesterov <[email protected]>
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
Geert Uytterhoeven <[email protected]>
ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
Colin Foster <[email protected]>
ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
Shengyu Qu <[email protected]>
ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
Eric Dumazet <[email protected]>
net: atm: fix /proc/net/atm/lec handling
Eric Dumazet <[email protected]>
net: atm: add lec_mutex
Kuniyuki Iwashima <[email protected]>
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
Haixia Qu <[email protected]>
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
Neal Cardwell <[email protected]>
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
Kuniyuki Iwashima <[email protected]>
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
Kuniyuki Iwashima <[email protected]>
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
Dmitry Antipov <[email protected]>
wifi: carl9170: do not ping device which has failed to load firmware
Justin Sanders <[email protected]>
aoe: clean device rq_list in aoedev_downdev()
Arnd Bergmann <[email protected]>
hwmon: (occ) fix unaligned accesses
Jacob Keller <[email protected]>
drm/nouveau/bl: increase buffer size to avoid truncate warning
Gao Xiang <[email protected]>
erofs: remove unused trace event erofs_destroy_inode
Jonathan Lane <[email protected]>
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
Takashi Iwai <[email protected]>
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
WangYuli <[email protected]>
Input: sparcspkr - avoid unannotated fall-through
Terry Junge <[email protected]>
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
Kuniyuki Iwashima <[email protected]>
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
Stephen Smalley <[email protected]>
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
Peter Oberparleiter <[email protected]>
scsi: s390: zfcp: Ensure synchronous unit_add
Dexuan Cui <[email protected]>
scsi: storvsc: Increase the timeouts to storvsc_timeout
Fedor Pchelkin <[email protected]>
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
Artem Sadovnikov <[email protected]>
jffs2: check that raw node were preallocated before writing summary
Andrew Morton <[email protected]>
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
Breno Leitao <[email protected]>
Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
Narayana Murty N <[email protected]>
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
Stuart Hayes <[email protected]>
platform/x86: dell_rbu: Stop overwriting data buffer
Maximilian Luz <[email protected]>
platform: Add Surface platform directory
Alexander Sverdlin <[email protected]>
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
Jann Horn <[email protected]>
tee: Prevent size calculation wraparound on 32-bit kernels
Sukrut Bellary <[email protected]>
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
Laurentiu Tudor <[email protected]>
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
Marcus Folkesson <[email protected]>
watchdog: da9052_wdt: respect TWDMIN
Kyungwook Boo <[email protected]>
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
Zijun Hu <[email protected]>
sock: Correct error checking condition for (assign|release)_proto_idx()
Daniel Wagner <[email protected]>
scsi: lpfc: Use memcpy() for BIOS version
Ido Schimmel <[email protected]>
vxlan: Do not treat dst cache initialization errors as fatal
Heiko Stuebner <[email protected]>
clk: rockchip: rk3036: mark ddrphy as critical
Benjamin Berg <[email protected]>
wifi: mac80211: do not offer a mesh path if forwarding is disabled
Jason Xing <[email protected]>
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
Sebastian Andrzej Siewior <[email protected]>
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
Eric Dumazet <[email protected]>
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
Eric Dumazet <[email protected]>
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
Moon Yeounsu <[email protected]>
net: dlink: add synchronization for stats update
Petr Malat <[email protected]>
sctp: Do not wake readers in __sctp_write_space()
Alok Tiwari <[email protected]>
emulex/benet: correct command version selection in be_cmd_get_stats()
Tan En De <[email protected]>
i2c: designware: Invoke runtime suspend on quick slave re-registration
Sergio Perez Gonzalez <[email protected]>
net: macb: Check return value of dma_set_mask_and_coherent()
Viresh Kumar <[email protected]>
cpufreq: Force sync policy boost with global boost on sysfs update
Simon Schuster <[email protected]>
nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
Wentao Liang <[email protected]>
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
Hans Verkuil <[email protected]>
media: tc358743: ignore video while HPD is low
Amber Lin <[email protected]>
drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
Dylan Wolff <[email protected]>
jfs: Fix null-ptr-deref in jfs_ioc_trim
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: fix CSIB handling
Alex Deucher <[email protected]>
drm/amdgpu/gfx8: fix CSIB handling
Aditya Dutt <[email protected]>
jfs: fix array-index-out-of-bounds read in add_missing_indices
Alex Deucher <[email protected]>
drm/amdgpu/gfx7: fix CSIB handling
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: fix CSIB handling
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Increase HFI response timeout
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
Nas Chung <[email protected]>
media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
Dmitry Baryshkov <[email protected]>
drm/msm/hdmi: add runtime PM calls to DDC transfer function
Damon Ding <[email protected]>
drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
Long Li <[email protected]>
sunrpc: update nextcheck time when adding new cache entries
Alex Deucher <[email protected]>
drm/amdgpu/gfx6: fix CSIB handling
Peter Marheine <[email protected]>
ACPI: battery: negate current when discharging
Charan Teja Kalla <[email protected]>
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
Jerry Lv <[email protected]>
power: supply: bq27xxx: Retrieve again when busy
Seunghun Han <[email protected]>
ACPICA: fix acpi parse and parseext cache leaks
Ahmed Salem <[email protected]>
ACPICA: Avoid sequence overread in call to strncmp()
Seunghun Han <[email protected]>
ACPICA: fix acpi operand cache leak in dswstate.c
David Lechner <[email protected]>
iio: adc: ad7606_spi: fix reg write value mask
Ilpo Järvinen <[email protected]>
PCI: Fix lock symmetry in pci_slot_unlock()
Huacai Chen <[email protected]>
PCI: Add ACS quirk for Loongson PCIe
Long Li <[email protected]>
uio_hv_generic: Use correct size for interrupt and monitor pages
Wentao Liang <[email protected]>
regulator: max14577: Add error check for max14577_read_reg()
Khem Raj <[email protected]>
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
Gabriel Shahrouzi <[email protected]>
staging: iio: ad5933: Correct settling cycles encoding per datasheet
Qasim Ijaz <[email protected]>
net: ch9200: fix uninitialised access during mii_nway_restart
Ye Bin <[email protected]>
ftrace: Fix UAF when lookup kallsym after ftrace disabled
Mikulas Patocka <[email protected]>
dm-mirror: fix a tiny race condition
Wentao Liang <[email protected]>
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
Wentao Liang <[email protected]>
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
Jinliang Zheng <[email protected]>
mm: fix ratelimit_pages update error in dirty_ratio_handler()
Jeongjun Park <[email protected]>
ipc: fix to protect IPCS lookups using RCU
Arnd Bergmann <[email protected]>
parisc: fix building with gcc-15
GONG Ruiqi <[email protected]>
vgacon: Add check for vc_origin address range in vgacon_scroll()
Murad Masimov <[email protected]>
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
Niravkumar L Rabara <[email protected]>
EDAC/altera: Use correct write width with the INTTEST register
Krzysztof Kozlowski <[email protected]>
NFC: nci: uart: Set tty->disc_data only in success path
Jaegeuk Kim <[email protected]>
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
Dan Carpenter <[email protected]>
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Jan Kara <[email protected]>
ext4: fix calculation of credits for extent tree modification
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: inline: fix len overflow in ext4_prepare_inline_data
Ioana Ciornei <[email protected]>
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
Tasos Sahanidis <[email protected]>
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
Ross Stutterheim <[email protected]>
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
Ma Ke <[email protected]>
media: v4l2-dev: fix error handling in __video_register_device()
Wentao Liang <[email protected]>
media: gspca: Add error handling for stv06xx_read_sensor()
Mingcong Bai <[email protected]>
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
NeilBrown <[email protected]>
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
Christian Lamparter <[email protected]>
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
Alexander Aring <[email protected]>
gfs2: move msleep to sleepable context
Zijun Hu <[email protected]>
configfs: Do not override creating attribute file failure in populate_attrs()
Oliver Neukum <[email protected]>
net: usb: aqc111: debug info before sanitation
Eric Dumazet <[email protected]>
calipso: unlock rcu before returning -EAFNOSUPPORT
Stefano Stabellini <[email protected]>
xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
Mathias Nyman <[email protected]>
usb: Flush altsetting 0 endpoints before reinitializating them after reset.
Zijun Hu <[email protected]>
fs/filesystems: Fix potential unsigned integer underflow in fs_name()
Jakub Raczynski <[email protected]>
net/mdiobus: Fix potential out-of-bounds read/write access
Nathan Chancellor <[email protected]>
drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang
Nathan Chancellor <[email protected]>
kbuild: Add KBUILD_CPPFLAGS to as-option invocation
Masahiro Yamada <[email protected]>
kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
Nathan Chancellor <[email protected]>
kbuild: Add CLANG_FLAGS to as-instr
Nathan Chancellor <[email protected]>
mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
Nathan Chancellor <[email protected]>
drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang
Nick Desaulniers <[email protected]>
kbuild: Update assembler calls to use proper flags and language target
Nathan Chancellor <[email protected]>
MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option
Nick Desaulniers <[email protected]>
x86/boot/compressed: prefer cc-option for CFLAGS additions
Andrew Lunn <[email protected]>
net: mdio: C22 is now optional, EOPNOTSUPP if not provided
Eric Dumazet <[email protected]>
net_sched: tbf: fix a race in tbf_change()
Eric Dumazet <[email protected]>
net_sched: red: fix a race in __red_change()
Eric Dumazet <[email protected]>
net_sched: prio: fix a race in prio_tune()
Patrisious Haddad <[email protected]>
net/mlx5: Fix return value when searching for existing flow group
Paul Blakey <[email protected]>
net/mlx5: Wait for inactive autogroups
Robert Malz <[email protected]>
i40e: retry VFLR handling if there is ongoing VF reset
Robert Malz <[email protected]>
i40e: return false from i40e_reset_vf if reset is in progress
Eric Dumazet <[email protected]>
net_sched: sch_sfq: fix a potential crash on gso_skb handling
Alok Tiwari <[email protected]>
scsi: iscsi: Fix incorrect error path labels for flashnode operations
Chuck Lever <[email protected]>
NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
Chuck Lever <[email protected]>
NFSD: Fix ia_size underflow
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi - fix crash with unsupported versions of F34
zhang songyi <[email protected]>
Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
Dan Carpenter <[email protected]>
pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
Al Viro <[email protected]>
do_change_type(): refuse to operate on unmounted/not ours mounts
Rafael J. Wysocki <[email protected]>
PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
Michal Kubiak <[email protected]>
ice: create new Tx scheduler nodes for new queues only
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
Dan Carpenter <[email protected]>
net/mlx4_en: Prevent potential integer overflow calculating Hz
Nicolas Pitre <[email protected]>
vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
Henry Martin <[email protected]>
serial: Fix potential null-ptr-deref in mlb_usio_probe()
Lad Prabhakar <[email protected]>
usb: renesas_usbhs: Reorder clock handling and power management in probe
Alexandre Mergnat <[email protected]>
rtc: Fix offset calculation for .start_secs < 0
Wolfram Sang <[email protected]>
rtc: sh: assign correct interrupts with DT
Dapeng Mi <[email protected]>
perf record: Fix incorrect --user-regs comments
Leo Yan <[email protected]>
perf tests switch-tracking: Fix timestamp comparison
Alexey Gladkov <[email protected]>
mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
Christophe JAILLET <[email protected]>
mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
Dan Carpenter <[email protected]>
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
Adrian Hunter <[email protected]>
perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
Arnaldo Carvalho de Melo <[email protected]>
perf ui browser hists: Set actions->thread before calling do_zoom_thread()
Kees Cook <[email protected]>
randstruct: gcc-plugin: Fix attribute addition
Kees Cook <[email protected]>
randstruct: gcc-plugin: Remove bogus void member
Sergey Shtylyov <[email protected]>
fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
Henry Martin <[email protected]>
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
Su Hui <[email protected]>
soc: aspeed: lpc: Fix impossible judgment condition
Quentin Schulz <[email protected]>
arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
Dmitry Baryshkov <[email protected]>
ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
Ioana Ciornei <[email protected]>
bus: fsl-mc: fix double-free on mc_dev
Ryusuke Konishi <[email protected]>
nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
Wentao Liang <[email protected]>
nilfs2: add pointer check for nilfs_direct_propagate()
Phillip Lougher <[email protected]>
Squashfs: check return result of sb_min_blocksize
Wolfram Sang <[email protected]>
ARM: dts: at91: at91sam9263: fix NAND chip selects
Wolfram Sang <[email protected]>
ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
Zhiguo Niu <[email protected]>
f2fs: fix to correct check conditions in f2fs_cross_rename
Zhiguo Niu <[email protected]>
f2fs: use d_inode(dentry) cleanup dentry->d_inode
Kuniyuki Iwashima <[email protected]>
calipso: Don't call calipso functions for AF_INET sk.
Thangaraj Samynathan <[email protected]>
net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
Nikita Zhandarovich <[email protected]>
net: usb: aqc111: fix error handling of usbnet read calls
Florian Westphal <[email protected]>
netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k_htc: Abort software beacon handling if disabled
Tao Chen <[email protected]>
bpf: Fix WARN() in get_bpf_raw_tp_regs
Andy Shevchenko <[email protected]>
pinctrl: at91: Fix possible out-of-boundary access
Jiayuan Chen <[email protected]>
ktls, sockmap: Fix missing uncharge operation
Huajian Yang <[email protected]>
netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
Chao Yu <[email protected]>
f2fs: clean up w/ fscrypt_is_bounce_page()
Junxian Huang <[email protected]>
RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
Dmitry Antipov <[email protected]>
wifi: rtw88: do not ignore hardware read error during DPK
Hari Kalavakunta <[email protected]>
net: ncsi: Fix GCPS 64-bit member variables
Chao Yu <[email protected]>
f2fs: fix to do sanity check on sbi->total_valid_block_count
Biju Das <[email protected]>
drm/tegra: rgb: Fix the unbound reference count
Kees Cook <[email protected]>
drm/vkms: Adjust vkms_state->active_planes allocation type
Biju Das <[email protected]>
drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
Neill Kapron <[email protected]>
selftests/seccomp: fix syscall_restart test for arm compat
Miaoqian Lin <[email protected]>
firmware: psci: Fix refcount leak in psci_dt_init
Finn Thain <[email protected]>
m68k: mac: Fix macintosh_config for Mac II
Ian Forbes <[email protected]>
drm/vmwgfx: Add seqno waiter for sync_files
Geert Uytterhoeven <[email protected]>
spi: sh-msiof: Fix maximum DMA transfer size
Armin Wolf <[email protected]>
ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
Jiaqing Zhao <[email protected]>
x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
Zijun Hu <[email protected]>
PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
Qiuxu Zhuo <[email protected]>
EDAC/skx_common: Fix general protection fault
Herbert Xu <[email protected]>
crypto: marvell/cesa - Avoid empty transfer descriptor
Herbert Xu <[email protected]>
crypto: marvell/cesa - Handle zero-length skcipher requests
Ahmed S. Darwish <[email protected]>
x86/cpu: Sanitize CPUID(0x80000000) output
Qing Wang <[email protected]>
perf/core: Fix broken throttling when max_samples_per_tick=1
Andreas Gruenbacher <[email protected]>
gfs2: gfs2_create_inode error handling fix
Florian Westphal <[email protected]>
netfilter: nft_socket: fix sk refcount leaks
Sergey Senozhatsky <[email protected]>
thunderbolt: Do not double dequeue a configuration request
Dave Penkler <[email protected]>
usb: usbtmc: Fix timeout value in get_stb
Hongyu Xie <[email protected]>
usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
Jiayi Li <[email protected]>
usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: set GPIO output value before setting direction
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
Pan Taixi <[email protected]>
tracing: Fix compilation warning on arm32
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 2 - MAINTAINERS | 9 ++ Makefile | 7 +- arch/arm/boot/dts/am335x-bone-common.dtsi | 8 ++ arch/arm/boot/dts/at91sam9263ek.dts | 2 +- arch/arm/boot/dts/qcom-apq8064.dtsi | 13 +- arch/arm/boot/dts/tny_a9263.dts | 2 +- arch/arm/boot/dts/usb_a9263.dts | 4 +- arch/arm/mach-omap2/clockdomain.h | 1 + arch/arm/mach-omap2/clockdomains33xx_data.c | 2 +- arch/arm/mach-omap2/cm33xx.c | 14 ++- arch/arm/mm/ioremap.c | 4 +- .../arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 8 -- arch/arm64/kernel/ptrace.c | 2 +- arch/arm64/xen/hypercall.S | 21 +++- arch/m68k/mac/config.c | 2 +- arch/mips/Makefile | 4 +- arch/mips/vdso/Makefile | 1 + arch/nios2/include/asm/pgtable.h | 16 +++ arch/parisc/boot/compressed/Makefile | 1 + arch/powerpc/kernel/eeh.c | 2 + arch/s390/pci/pci_mmio.c | 2 +- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/kernel/cpu/bugs.c | 10 +- arch/x86/kernel/cpu/common.c | 17 +-- arch/x86/kernel/cpu/mtrr/generic.c | 2 +- drivers/acpi/acpica/dsutils.c | 9 +- drivers/acpi/acpica/psobject.c | 52 +++----- drivers/acpi/battery.c | 19 ++- drivers/acpi/osi.c | 1 - drivers/ata/pata_via.c | 3 +- drivers/atm/atmtcp.c | 4 +- drivers/base/power/domain.c | 2 +- drivers/base/power/main.c | 3 +- drivers/base/power/runtime.c | 2 +- drivers/block/aoe/aoedev.c | 8 ++ drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +- drivers/bus/fsl-mc/mc-io.c | 19 ++- drivers/bus/fsl-mc/mc-sys.c | 2 +- drivers/bus/ti-sysc.c | 49 -------- drivers/clk/rockchip/clk-rk3036.c | 1 + drivers/cpufreq/cpufreq.c | 6 +- drivers/crypto/marvell/cipher.c | 3 + drivers/crypto/marvell/hash.c | 2 +- drivers/edac/altera_edac.c | 6 +- drivers/edac/skx_common.c | 1 + drivers/firmware/psci/psci.c | 4 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 - drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 4 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 ++- drivers/gpu/drm/amd/display/dc/dcn20/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dcn21/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dml/Makefile | 3 +- drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 2 +- drivers/gpu/drm/msm/hdmi/hdmi_i2c.c | 14 ++- drivers/gpu/drm/nouveau/nouveau_backlight.c | 2 +- drivers/gpu/drm/rcar-du/rcar_du_kms.c | 10 +- drivers/gpu/drm/tegra/rgb.c | 14 ++- drivers/gpu/drm/vkms/vkms_crtc.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 26 ++++ drivers/hid/hid-hyperv.c | 5 +- drivers/hid/usbhid/hid-core.c | 25 ++-- drivers/hwmon/occ/common.c | 28 ++--- drivers/i2c/busses/i2c-designware-slave.c | 2 +- drivers/iio/adc/ad7606_spi.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 - drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 + drivers/infiniband/hw/hns/hns_roce_restrack.c | 1 - drivers/input/misc/ims-pcu.c | 6 + drivers/input/misc/sparcspkr.c | 22 +++- drivers/input/rmi4/rmi_f34.c | 135 ++++++++++++--------- drivers/md/dm-raid1.c | 5 +- drivers/media/i2c/tc358743.c | 4 + drivers/media/platform/exynos4-is/fimc-is-regs.c | 1 + drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c | 7 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +-- drivers/mfd/exynos-lpass.c | 1 - drivers/mfd/stmpe-spi.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 + drivers/net/ethernet/cadence/macb_main.c | 6 +- drivers/net/ethernet/dlink/dl2k.c | 14 ++- drivers/net/ethernet/dlink/dl2k.h | 2 + drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 7 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 +- drivers/net/ethernet/intel/ice/ice_sched.c | 11 +- drivers/net/ethernet/mellanox/mlx4/en_clock.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 13 +- drivers/net/ethernet/microchip/lan743x_main.c | 4 +- drivers/net/phy/mdio_bus.c | 16 ++- drivers/net/usb/aqc111.c | 10 +- drivers/net/usb/ch9200.c | 7 +- drivers/net/vxlan.c | 8 +- drivers/net/wireless/ath/ath9k/htc_drv_beacon.c | 3 + drivers/net/wireless/ath/carl9170/usb.c | 19 ++- drivers/net/wireless/intersil/p54/fwio.c | 2 + drivers/net/wireless/intersil/p54/p54.h | 1 + drivers/net/wireless/intersil/p54/txrx.c | 13 +- drivers/net/wireless/realtek/rtlwifi/pci.c | 10 ++ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 3 +- drivers/pci/pci.c | 3 +- drivers/pci/quirks.c | 23 ++++ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 35 +++--- drivers/pinctrl/pinctrl-at91.c | 6 +- drivers/platform/Kconfig | 2 + drivers/platform/Makefile | 1 + drivers/platform/surface/Kconfig | 14 +++ drivers/platform/surface/Makefile | 5 + drivers/platform/x86/dell_rbu.c | 2 +- drivers/power/supply/bq27xxx_battery.c | 2 +- drivers/power/supply/bq27xxx_battery_i2c.c | 13 +- drivers/rapidio/rio_cm.c | 3 + drivers/regulator/max14577-regulator.c | 5 +- drivers/rpmsg/qcom_smd.c | 2 +- drivers/rtc/Kconfig | 10 ++ drivers/rtc/Makefile | 1 + drivers/rtc/class.c | 2 +- drivers/rtc/lib.c | 121 +++++++++++++----- drivers/rtc/lib_test.c | 79 ++++++++++++ drivers/rtc/rtc-sh.c | 12 +- drivers/s390/scsi/zfcp_sysfs.c | 2 + drivers/scsi/lpfc/lpfc_sli.c | 4 +- drivers/scsi/scsi_transport_iscsi.c | 11 +- drivers/scsi/storvsc_drv.c | 10 +- drivers/soc/aspeed/aspeed-lpc-snoop.c | 17 ++- drivers/spi/spi-sh-msiof.c | 13 +- drivers/staging/iio/impedance-analyzer/ad5933.c | 2 +- drivers/tee/tee_core.c | 11 +- drivers/thunderbolt/ctl.c | 5 + drivers/tty/serial/milbeaut_usio.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 - drivers/uio/uio_hv_generic.c | 4 +- drivers/usb/class/usbtmc.c | 4 +- drivers/usb/core/hub.c | 16 ++- drivers/usb/core/quirks.c | 3 + drivers/usb/gadget/function/f_hid.c | 12 +- drivers/usb/renesas_usbhs/common.c | 50 ++++++-- drivers/usb/storage/unusual_uas.h | 7 ++ drivers/video/console/vgacon.c | 2 +- drivers/video/fbdev/core/fbcvt.c | 2 +- drivers/video/fbdev/core/fbmem.c | 4 +- drivers/watchdog/da9052_wdt.c | 1 + fs/configfs/dir.c | 2 +- fs/ext4/extents.c | 11 +- fs/ext4/inline.c | 2 +- fs/f2fs/data.c | 2 +- fs/f2fs/f2fs.h | 10 +- fs/f2fs/namei.c | 19 ++- fs/f2fs/super.c | 4 +- fs/filesystems.c | 14 ++- fs/gfs2/inode.c | 3 +- fs/gfs2/lock_dlm.c | 3 +- fs/jbd2/transaction.c | 3 +- fs/jffs2/erase.c | 4 +- fs/jffs2/scan.c | 4 +- fs/jffs2/summary.c | 7 +- fs/jfs/jfs_discard.c | 3 +- fs/jfs/jfs_dtree.c | 18 ++- fs/namespace.c | 4 + fs/nfsd/nfs3xdr.c | 2 +- fs/nfsd/nfs4proc.c | 3 +- fs/nfsd/vfs.c | 4 + fs/nilfs2/btree.c | 4 +- fs/nilfs2/direct.c | 3 + fs/squashfs/super.c | 5 + include/acpi/actypes.h | 2 +- include/linux/atmdev.h | 6 + include/linux/hid.h | 3 +- include/trace/events/erofs.h | 18 --- include/uapi/linux/videodev2.h | 1 - ipc/shm.c | 5 +- kernel/events/core.c | 23 ++-- kernel/exit.c | 17 +-- kernel/power/wakelock.c | 3 + kernel/time/posix-cpu-timers.c | 9 ++ kernel/trace/bpf_trace.c | 2 +- kernel/trace/ftrace.c | 10 +- kernel/trace/trace.c | 2 +- mm/huge_memory.c | 2 +- mm/page-writeback.c | 2 +- net/atm/common.c | 1 + net/atm/lec.c | 12 +- net/atm/raw.c | 2 +- net/bluetooth/l2cap_core.c | 3 +- net/bridge/netfilter/nf_conntrack_bridge.c | 12 +- net/core/sock.c | 4 +- net/ipv4/route.c | 4 + net/ipv4/tcp_input.c | 63 +++++----- net/ipv6/calipso.c | 8 ++ net/ipv6/netfilter.c | 12 +- net/ipv6/netfilter/nft_fib_ipv6.c | 13 +- net/mac80211/mesh_hwmp.c | 6 +- net/mpls/af_mpls.c | 4 +- net/ncsi/internal.h | 21 ++-- net/ncsi/ncsi-pkt.h | 23 ++-- net/ncsi/ncsi-rsp.c | 21 ++-- net/netfilter/nft_socket.c | 3 +- net/netlabel/netlabel_kapi.c | 5 + net/nfc/nci/uart.c | 8 +- net/sched/sch_prio.c | 2 +- net/sched/sch_red.c | 2 +- net/sched/sch_sfq.c | 5 +- net/sched/sch_tbf.c | 2 +- net/sctp/socket.c | 3 +- net/sunrpc/cache.c | 2 + net/sunrpc/xprtrdma/verbs.c | 2 + net/tipc/udp_media.c | 4 +- net/tls/tls_sw.c | 7 ++ scripts/Kbuild.include | 8 +- scripts/gcc-plugins/gcc-common.h | 32 +++++ scripts/gcc-plugins/randomize_layout_plugin.c | 40 ++---- security/selinux/xfrm.c | 2 +- sound/pci/hda/hda_intel.c | 2 + sound/pci/hda/patch_realtek.c | 1 + tools/perf/builtin-record.c | 2 +- tools/perf/scripts/python/exported-sql-viewer.py | 5 +- tools/perf/tests/switch-tracking.c | 2 +- tools/perf/ui/browsers/hists.c | 2 +- tools/testing/selftests/seccomp/seccomp_bpf.c | 7 +- 225 files changed, 1344 insertions(+), 683 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/222 tracing: Fix compilation warning on arm32
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Taixi <[email protected]>
commit 2fbdb6d8e03b70668c0876e635506540ae92ab05 upstream.
On arm32, size_t is defined to be unsigned int, while PAGE_SIZE is unsigned long. This hence triggers a compilation warning as min() asserts the type of two operands to be equal. Casting PAGE_SIZE to size_t solves this issue and works on other target architectures as well.
Compilation warning details:
kernel/trace/trace.c: In function 'tracing_splice_read_pipe':./include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast
(!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
^
./include/linux/minmax.h:26:4: note: in expansion of macro '__typecheck'
(__typecheck(x, y) && __no_side_effects(x, y))
^~~~~~~~~~~...
kernel/trace/trace.c:6771:8: note: in expansion of macro 'min'
min((size_t)trace_seq_used(&iter->seq),
^~~--- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace.c +1 -1
@@ -6332,7 +6332,7 @@ static ssize_t tracing_splice_read_pipe( ret =trace_seq_to_buffer (&iter->seq,page_address (spd.pages[i]),min ((size_t )trace_seq_used (&iter->seq), -PAGE_SIZE )); + (size_t )PAGE_SIZE ));if (ret <0 ) {__free_page (spd.pages[i]);break ;
Greg Kroah-Hartman
maintainerPATCH 2/222 pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit 947c93eb29c2a581c0b0b6d5f21af3c2b7ff6d25 upstream.
The controller has two consecutive OUTPUT_VAL registers and both holds output value for 32 GPIOs. Due to a missing adjustment, the current code always uses the first register while setting the output value whereas it should use the second one for GPIOs > 31.
Add the missing armada_37xx_update_reg() call to adjust the register according to the 'offset' parameter of the function to fix the issue.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +3 -0
@@ -409,6 +409,7 @@ static int armada_37xx_gpio_direction_ou unsigned int offset, int value) {struct armada_37xx_pinctrl *info =gpiochip_get_data (chip); +unsigned int val_offset = offset;unsigned int reg =OUTPUT_EN ;unsigned int mask, val, ret;
@@ -421,6 +422,8 @@ static int armada_37xx_gpio_direction_oureturn ret; reg =OUTPUT_VAL ; +armada_37xx_update_reg (®, &val_offset); + val = value ? mask :0 ;regmap_update_bits (info->regmap, reg, mask, val);
Greg Kroah-Hartman
maintainerPATCH 3/222 pinctrl: armada-37xx: set GPIO output value before setting direction
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit e6ebd4942981f8ad37189bbb36a3c8495e21ef4c upstream.
Changing the direction before updating the output value in the OUTPUT_VAL register may result in a glitch on the output line if the previous value in the OUTPUT_VAL register is different from the one we want to set.
In order to avoid that, update the output value before changing the direction.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +7 -8
@@ -409,23 +409,22 @@ static int armada_37xx_gpio_direction_ou unsigned int offset, int value) {struct armada_37xx_pinctrl *info =gpiochip_get_data (chip); -unsigned int val_offset = offset; -unsigned int reg =OUTPUT_EN ; +unsigned int en_offset = offset; +unsigned int reg =OUTPUT_VAL ;unsigned int mask, val, ret;armada_37xx_update_reg (®, &offset); mask =BIT (offset); + val = value ? mask :0 ; - ret =regmap_update_bits (info->regmap, reg, mask, mask); - + ret =regmap_update_bits (info->regmap, reg, mask, val);if (ret)return ret; - reg =OUTPUT_VAL ; -armada_37xx_update_reg (®, &val_offset); + reg =OUTPUT_EN ; +armada_37xx_update_reg (®, &en_offset); - val = value ? mask :0 ; -regmap_update_bits (info->regmap, reg, mask, val); +regmap_update_bits (info->regmap, reg, mask, mask);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 4/222 usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
commit 19f795591947596b5b9efa86fd4b9058e45786e9 upstream.
This device exhibits I/O errors during file transfers due to unstable link power management (LPM) behavior. The kernel logs show repeated warm resets and eventual disconnection when LPM is enabled:
[ 3467.810740] hub 2-0:1.0: state 7 ports 6 chg 0000 evt 0020 [ 3467.810740] usb usb2-port5: do warm reset [ 3467.866444] usb usb2-port5: not warm reset yet, waiting 50ms [ 3467.907407] sd 0:0:0:0: [sda] tag#12 sense submit err -19 [ 3467.994423] usb usb2-port5: status 02c0, change 0001, 10.0 Gb/s [ 3467.994453] usb 2-5: USB disconnect, device number 4
The error -19 (ENODEV) occurs when the device disappears during write operations. Adding USB_QUIRK_NO_LPM disables link power management for this specific device, resolving the stability issues.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -369,6 +369,9 @@ static const struct usb_device_id usb_qu/* SanDisk Corp. SanDisk 3.2Gen1 */ { USB_DEVICE(0x0781, 0x55a3), .driver_info = USB_QUIRK_DELAY_INIT }, + /* SanDisk Extreme 55AE */ + { USB_DEVICE(0x0781, 0x55ae), .driver_info = USB_QUIRK_NO_LPM }, + /* Realforce 87U Keyboard */ { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM },
Greg Kroah-Hartman
maintainerPATCH 5/222 usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyu Xie <[email protected]>
commit a541acceedf4f639f928f41fbb676b75946dc295 upstream.
SanDisk 3.2 Gen2 storage device(0781:55e8) doesn't work well with UAS. Log says,
[ 6.507865][ 3] [ T159] usb 2-1.4: new SuperSpeed Gen 1 USB device number 4 using xhci_hcd [ 6.540314][ 3] [ T159] usb 2-1.4: New USB device found, idVendor=0781, idProduct=55e8, bcdDevice= 0.01 [ 6.576304][ 3] [ T159] usb 2-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 6.584727][ 3] [ T159] usb 2-1.4: Product: SanDisk 3.2 Gen2 [ 6.590459][ 3] [ T159] usb 2-1.4: Manufacturer: SanDisk [ 6.595845][ 3] [ T159] usb 2-1.4: SerialNumber: 03021707022525140940 [ 7.230852][ 0] [ T265] usbcore: registered new interface driver usb-storage [ 7.251247][ 0] [ T265] scsi host3: uas [ 7.255280][ 0] [ T265] usbcore: registered new interface driver uas [ 7.270498][ 1] [ T192] scsi 3:0:0:0: Direct-Access SanDisk Extreme Pro DDE1 0110 PQ: 0 ANSI: 6 [ 7.299588][ 3] [ T192] scsi 3:0:0:1: Enclosure SanDisk SES Device 0110 PQ: 0 ANSI: 6 [ 7.321681][ 3] [ T192] sd 3:0:0:0: Attached scsi generic sg1 type 0 [ 7.328185][ 3] [ T192] scsi 3:0:0:1: Attached scsi generic sg2 type 13 [ 7.328804][ 0] [ T191] sd 3:0:0:0: [sda] 976773168 512-byte logical blocks: (500 GB/466 GiB) [ 7.343486][ 0] [ T191] sd 3:0:0:0: [sda] 4096-byte physical blocks [ 7.364611][ 0] [ T191] sd 3:0:0:0: [sda] Write Protect is off [ 7.370524][ 0] [ T191] sd 3:0:0:0: [sda] Mode Sense: 3d 00 10 00 [ 7.390655][ 0] [ T191] sd 3:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA [ 7.401363][ 0] [ T191] sd 3:0:0:0: [sda] Optimal transfer size 1048576 bytes [ 7.436010][ 0] [ T191] sda: sda1 [ 7.450850][ 0] [ T191] sd 3:0:0:0: [sda] Attached SCSI disk [ 7.470218][ 4] [ T262] scsi 3:0:0:1: Failed to get diagnostic page 0x1 [ 7.474869][ 0] [ C0] sd 3:0:0:0: [sda] tag#0 data cmplt err -75 uas-tag 2 inflight: CMD [ 7.476911][ 4] [ T262] scsi 3:0:0:1: Failed to bind enclosure -19 [ 7.485330][ 0] [ C0] sd 3:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 00 00 28 00 00 10 00 [ 7.491593][ 4] [ T262] ses 3:0:0:1: Attached Enclosure device [ 38.066980][ 4] [ T192] sd 3:0:0:0: [sda] tag#4 uas_eh_abort_handler 0 uas-tag 5 inflight: CMD IN [ 38.076012][ 4] [ T192] sd 3:0:0:0: [sda] tag#4 CDB: Read(10) 28 00 00 00 01 08 00 00 f8 00 [ 38.086485][ 4] [ T192] sd 3:0:0:0: [sda] tag#3 uas_eh_abort_handler 0 uas-tag 1 inflight: CMD IN [ 38.095515][ 4] [ T192] sd 3:0:0:0: [sda] tag#3 CDB: Read(10) 28 00 00 00 00 10 00 00 08 00 [ 38.104122][ 4] [ T192] sd 3:0:0:0: [sda] tag#2 uas_eh_abort_handler 0 uas-tag 4 inflight: CMD IN [ 38.113152][ 4] [ T192] sd 3:0:0:0: [sda] tag#2 CDB: Read(10) 28 00 00 00 00 88 00 00 78 00 [ 38.121761][ 4] [ T192] sd 3:0:0:0: [sda] tag#1 uas_eh_abort_handler 0 uas-tag 3 inflight: CMD IN [ 38.130791][ 4] [ T192] sd 3:0:0:0: [sda] tag#1 CDB: Read(10) 28 00 00 00 00 48 00 00 30 00 [ 38.139401][ 4] [ T192] sd 3:0:0:0: [sda] tag#0 uas_eh_abort_handler 0 uas-tag 2 inflight: CMD [ 38.148170][ 4] [ T192] sd 3:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 00 00 28 00 00 10 00 [ 38.178980][ 2] [ T304] scsi host3: uas_eh_device_reset_handler start [ 38.901540][ 2] [ T304] usb 2-1.4: reset SuperSpeed Gen 1 USB device number 4 using xhci_hcd [ 38.936791][ 2] [ T304] scsi host3: uas_eh_device_reset_handler success
Device decriptor is below,
Bus 002 Device 006: ID 0781:55e8 SanDisk Corp. SanDisk 3.2 Gen2 Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 3.20
bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 9 idVendor 0x0781 SanDisk Corp. idProduct 0x55e8 bcdDevice 0.01 iManufacturer 1 SanDisk iProduct 2 SanDisk 3.2 Gen2 iSerial 3 03021707022525140940 bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0079
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 896mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk-Only
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 1
bNumEndpoints 4
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 98
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 0
Command pipe (0x01)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x84 EP 4 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
MaxStreams 32
Status pipe (0x02)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
MaxStreams 32
Data-in pipe (0x03)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x03 EP 3 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
MaxStreams 32
Data-out pipe (0x04)
Binary Object Store Descriptor:
bLength 5
bDescriptorType 15
wTotalLength 0x002a
bNumDeviceCaps 3
USB 2.0 Extension Device Capability:
bLength 7
bDescriptorType 16
bDevCapabilityType 2
bmAttributes 0x0000f41e
BESL Link Power Management (LPM) Supported
BESL value 1024 us
Deep BESL value 61440 us
SuperSpeed USB Device Capability:
bLength 10
bDescriptorType 16
bDevCapabilityType 3
bmAttributes 0x00
wSpeedsSupported 0x000e
Device can operate at Full Speed (12Mbps)
Device can operate at High Speed (480Mbps)
Device can operate at SuperSpeed (5Gbps)
bFunctionalitySupport 1
Lowest fully-functional device speed is Full Speed (12Mbps)
bU1DevExitLat 10 micro seconds
bU2DevExitLat 2047 micro seconds
SuperSpeedPlus USB Device Capability:
bLength 20
bDescriptorType 16
bDevCapabilityType 10 bmAttributes 0x00000001
Sublink Speed Attribute count 1
Sublink Speed ID count 0
wFunctionalitySupport 0x1100
bmSublinkSpeedAttr[0] 0x000a4030
Speed Attribute ID: 0 10Gb/s Symmetric RX SuperSpeedPlus
bmSublinkSpeedAttr[1] 0x000a40b0
Speed Attribute ID: 0 10Gb/s Symmetric TX SuperSpeedPlus
Device Status: 0x0000
(Bus Powered)
So ignore UAS driver for this device.
--- drivers/usb/storage/unusual_uas.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_uas.h +7 -0
@@ -52,6 +52,13 @@ UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x99 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME), +/* Reported-by: Zhihong Zhou <[email protected]> */ +UNUSUAL_DEV (0x0781 ,0x55e8 ,0x0000 ,0x9999 , +"SanDisk" , +"" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_IGNORE_UAS ), +/* Reported-by: Hongling Zeng <[email protected]> */ UNUSUAL_DEV(0x090c, 0x2000, 0x0000, 0x9999, "Hiksemi",
Greg Kroah-Hartman
maintainerPATCH 6/222 usb: usbtmc: Fix timeout value in get_stb
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
commit 342e4955a1f1ce28c70a589999b76365082dbf10 upstream.
wait_event_interruptible_timeout requires a timeout argument in units of jiffies. It was being called in usbtmc_get_stb with the usb timeout value which is in units of milliseconds.
Pass the timeout argument converted to jiffies.
--- drivers/usb/class/usbtmc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/class/usbtmc.c +3 -1
@@ -486,6 +486,7 @@ static int usbtmc488_ioctl_read_stb(stru__u8 stb;int rv;long wait_rv; +unsigned long expire;dev_dbg (dev,"Enter ioctl_read_stb iin_ep_present: %d\n" , data->iin_ep_present);
@@ -528,10 +529,11 @@ static int usbtmc488_ioctl_read_stb(stru }if (data->iin_ep_present) { + expire =msecs_to_jiffies (file_data->timeout); wait_rv =wait_event_interruptible_timeout ( data->waitq,atomic_read (&data->iin_data_valid) !=0 , - file_data->timeout); + expire);if (wait_rv <0 ) {dev_dbg (dev,"wait interrupted %ld\n" , wait_rv); rv = wait_rv;
Greg Kroah-Hartman
maintainerPATCH 7/222 thunderbolt: Do not double dequeue a configuration request
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
commit 0f73628e9da1ee39daf5f188190cdbaee5e0c98c upstream.
Some of our devices crash in tb_cfg_request_dequeue():
general protection fault, probably for non-canonical address 0xdead000000000122 CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65 RIP: 0010:tb_cfg_request_dequeue+0x2d/0xa0 Call Trace: <TASK> ? tb_cfg_request_dequeue+0x2d/0xa0 tb_cfg_request_work+0x33/0x80 worker_thread+0x386/0x8f0 kthread+0xed/0x110 ret_from_fork+0x38/0x50 ret_from_fork_asm+0x1b/0x30
The circumstances are unclear, however, the theory is that tb_cfg_request_work() can be scheduled twice for a request:
first time via frame.callback from ring_work() and second time from tb_cfg_request(). Both times kworkers will execute tb_cfg_request_dequeue(), which results in double list_del() from the ctl->request_queue (the list poison deference hints at it: 0xdead000000000122).
Do not dequeue requests that don't have TB_CFG_REQUEST_ACTIVE bit set.
--- drivers/thunderbolt/ctl.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/thunderbolt/ctl.c +5 -0
@@ -131,6 +131,11 @@ static void tb_cfg_request_dequeue(strucstruct tb_ctl *ctl = req->ctl;mutex_lock (&ctl->request_queue_lock); +if (!test_bit (TB_CFG_REQUEST_ACTIVE , &req->flags)) { +mutex_unlock (&ctl->request_queue_lock); +return ; + } +list_del (&req->list);clear_bit (TB_CFG_REQUEST_ACTIVE , &req->flags);if (test_bit (TB_CFG_REQUEST_CANCELED , &req->flags))
Greg Kroah-Hartman
maintainerPATCH 8/222 netfilter: nft_socket: fix sk refcount leaks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c upstream.
We must put 'sk' reference before returning.
--- net/netfilter/nft_socket.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nft_socket.c +2 -1
@@ -69,7 +69,7 @@ static void nft_socket_eval(const struct *dest = sk->sk_mark; }else { regs->verdict.code =NFT_BREAK ; -return ; + goto out_put_sk; }break ;default :
@@ -77,6 +77,7 @@ static void nft_socket_eval(const struct regs->verdict.code =NFT_BREAK ; } +out_put_sk:if (sk != skb->sk)sock_gen_put (sk); }
Greg Kroah-Hartman
maintainerPATCH 9/222 gfs2: gfs2_create_inode error handling fix
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit af4044fd0b77e915736527dd83011e46e6415f01 ]
When gfs2_create_inode() finds a directory, make sure to return -EISDIR.
--- fs/gfs2/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/gfs2/inode.c +2 -1
@@ -616,7 +616,8 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,if (!IS_ERR (inode)) {if (S_ISDIR (inode->i_mode)) {iput (inode); - inode =ERR_PTR (-EISDIR ); + inode =NULL ; + error = -EISDIR ; goto fail_gunlock; }d_instantiate (dentry, inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/222 perf/core: Fix broken throttling when max_samples_per_tick=1
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qing Wang <[email protected]>
[ Upstream commit f51972e6f8b9a737b2b3eb588069acb538fa72de ]
According to the throttling mechanism, the pmu interrupts number can not exceed the max_samples_per_tick in one tick. But this mechanism is ineffective when max_samples_per_tick=1, because the throttling check is skipped during the first interrupt and only performed when the second interrupt arrives.
Perhaps this bug may cause little influence in one tick, but if in a larger time scale, the problem can not be underestimated.
When max_samples_per_tick = 1:
Allowed-interrupts-per-second max-samples-per-second default-HZ ARCH 200 100 100 X86 500 250 250 ARM64
...
Obviously, the pmu interrupt number far exceed the user's expect.
--- kernel/events/core.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
kernel/events/core.c +8 -8
@@ -8266,14 +8266,14 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle) hwc->interrupts =1 ; }else { hwc->interrupts++; -if (unlikely (throttle && - hwc->interrupts > max_samples_per_tick)) { -__this_cpu_inc (perf_throttled_count); -tick_dep_set_cpu (smp_processor_id (),TICK_DEP_BIT_PERF_EVENTS ); - hwc->interrupts =MAX_INTERRUPTS ; -perf_log_throttle (event,0 ); - ret =1 ; - } + } + +if (unlikely (throttle && hwc->interrupts >= max_samples_per_tick)) { +__this_cpu_inc (perf_throttled_count); +tick_dep_set_cpu (smp_processor_id (),TICK_DEP_BIT_PERF_EVENTS ); + hwc->interrupts =MAX_INTERRUPTS ; +perf_log_throttle (event,0 ); + ret =1 ; }if (event->attr.freq) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/222 x86/cpu: Sanitize CPUID(0x80000000) output
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
[ Upstream commit cc663ba3fe383a628a812f893cc98aafff39ab04 ]
CPUID(0x80000000).EAX returns the max extended CPUID leaf available. On x86-32 machines without an extended CPUID range, a CPUID(0x80000000) query will just repeat the output of the last valid standard CPUID leaf on the CPU; i.e., a garbage values. Current tip:x86/cpu code protects against this by doing:
eax = cpuid_eax(0x80000000);
c->extended_cpuid_level = eax;
if ((eax & 0xffff0000) == 0x80000000) {
// CPU has an extended CPUID range. Check for 0x80000001
if (eax >= 0x80000001) {
cpuid(0x80000001, ...);
}
}This is correct so far. Afterwards though, the same possibly broken EAX value is used to check the availability of other extended CPUID leaves:
if (c->extended_cpuid_level >= 0x80000007) ... if (c->extended_cpuid_level >= 0x80000008) ... if (c->extended_cpuid_level >= 0x8000000a) ... if (c->extended_cpuid_level >= 0x8000001f) ...
which is invalid. Fix this by immediately setting the CPU's max extended CPUID leaf to zero if CPUID(0x80000000).EAX doesn't indicate a valid CPUID extended range.
While at it, add a comment, similar to kernel/head_32.S, clarifying the CPUID(0x80000000) sanity check.
References: 8a50e5135af0 ("x86-32: Use symbolic constants, safer CPUID when enabling EFER.NX")
--- arch/x86/kernel/cpu/common.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
arch/x86/kernel/cpu/common.c +9 -8
@@ -934,17 +934,18 @@ void get_cpu_cap(struct cpuinfo_x86 *c) c->x86_capability[CPUID_D_1_EAX ] = eax; } -/* AMD-defined flags: level 0x80000001 */ +/* +* Check if extended CPUID leaves are implemented: Max extended +* CPUID leaf must be in the 0x80000001-0x8000ffff range. +*/ eax =cpuid_eax (0x80000000 ); - c->extended_cpuid_level = eax; + c->extended_cpuid_level = ((eax &0xffff0000 ) ==0x80000000 ) ? eax :0 ; -if ((eax &0xffff0000 ) ==0x80000000 ) { -if (eax >=0x80000001 ) { -cpuid (0x80000001 , &eax, &ebx, &ecx, &edx); +if (c->extended_cpuid_level >=0x80000001 ) { +cpuid (0x80000001 , &eax, &ebx, &ecx, &edx); - c->x86_capability[CPUID_8000_0001_ECX ] = ecx; - c->x86_capability[CPUID_8000_0001_EDX ] = edx; - } + c->x86_capability[CPUID_8000_0001_ECX ] = ecx; + c->x86_capability[CPUID_8000_0001_EDX ] = edx; }if (c->extended_cpuid_level >=0x80000007 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/222 crypto: marvell/cesa - Handle zero-length skcipher requests
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 8a4e047c6cc07676f637608a9dd675349b5de0a7 ]
Do not access random memory for zero-length skcipher requests. Just return 0.
--- drivers/crypto/marvell/cipher.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/marvell/cipher.c +3 -0
@@ -447,6 +447,9 @@ static int mv_cesa_skcipher_queue_req(struct skcipher_request *req,struct mv_cesa_skcipher_req *creq =skcipher_request_ctx (req);struct mv_cesa_engine *engine; +if (!req->cryptlen) +return 0 ; + ret =mv_cesa_skcipher_req_init (req, tmpl);if (ret)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/222 crypto: marvell/cesa - Avoid empty transfer descriptor
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 1bafd82d9a40cf09c6c40f1c09cc35b7050b1a9f ]
The user may set req->src even if req->nbytes == 0. If there is no data to hash from req->src, do not generate an empty TDMA descriptor.
--- drivers/crypto/marvell/hash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/marvell/hash.c +1 -1
@@ -630,7 +630,7 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req)if (ret) goto err_free_tdma; -if (iter.src.sg) { +if (iter.base.len > iter.src.op_offset) {/* * Add all the new data, inserting an operation block and * launch command between each full SRAM block-worth of
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/222 EDAC/skx_common: Fix general protection fault
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 20d2d476b3ae18041be423671a8637ed5ffd6958 ]
After loading i10nm_edac (which automatically loads skx_edac_common), if unload only i10nm_edac, then reload it and perform error injection testing, a general protection fault may occur:
mce: [Hardware Error]: Machine check events logged
Oops: general protection fault ... ... Workqueue: events mce_gen_pool_process RIP: 0010:string+0x53/0xe0 ... Call Trace: <TASK> ? die_addr+0x37/0x90 ? exc_general_protection+0x1e7/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? string+0x53/0xe0 vsnprintf+0x23e/0x4c0 snprintf+0x4d/0x70 skx_adxl_decode+0x16a/0x330 [skx_edac_common] skx_mce_check_error.part.0+0xf8/0x220 [skx_edac_common] skx_mce_check_error+0x17/0x20 [skx_edac_common] ...
The issue arose was because the variable 'adxl_component_count' (inside skx_edac_common), which counts the ADXL components, was not reset. During the reloading of i10nm_edac, the count was incremented by the actual number of ADXL components again, resulting in a count that was double the real number of ADXL components. This led to an out-of-bounds reference to the ADXL component array, causing the general protection fault above.
Fix this issue by resetting the 'adxl_component_count' in adxl_put(), which is called during the unloading of {skx,i10nm}_edac.
--- drivers/edac/skx_common.c | 1 + 1 file changed, 1 insertion(+)
drivers/edac/skx_common.c +1 -0
@@ -112,6 +112,7 @@ EXPORT_SYMBOL_GPL(skx_adxl_get);void skx_adxl_put (void ) { + adxl_component_count =0 ;kfree (adxl_values);kfree (adxl_msg); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/222 PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit f0050a3e214aa941b78ad4caf122a735a24d81a6 ]
pm_show_wakelocks() is called to generate a string when showing attributes /sys/power/wake_(lock|unlock), but the string ends with an unwanted space that was added back by mistake by commit c9d967b2ce40 ("PM: wakeup: simplify the output logic of pm_show_wakelocks()").
Remove the unwanted space.
--- kernel/power/wakelock.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/power/wakelock.c +3 -0
@@ -49,6 +49,9 @@ ssize_t pm_show_wakelocks(char *buf, bool show_active) len +=sysfs_emit_at (buf, len,"%s " , wl->name); } +if (len >0 ) + --len; + len +=sysfs_emit_at (buf, len,"\n" );mutex_unlock (&wakelocks_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/222 x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaqing Zhao <[email protected]>
[ Upstream commit 824c6384e8d9275d4ec7204f3f79a4ac6bc10379 ]
When suspending, save_processor_state() calls mtrr_save_fixed_ranges() to save fixed-range MTRRs.
On platforms without fixed-range MTRRs like the ACRN hypervisor which has removed fixed-range MTRR emulation, accessing these MSRs will trigger an unchecked MSR access error. Make sure fixed-range MTRRs are supported before access to prevent such error.
Since mtrr_state.have_fixed is only set when MTRRs are present and enabled, checking the CPU feature flag in mtrr_save_fixed_ranges() is unnecessary.
--- arch/x86/kernel/cpu/mtrr/generic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/mtrr/generic.c +1 -1
@@ -350,7 +350,7 @@ static void get_fixed_ranges(mtrr_type *frs)void mtrr_save_fixed_ranges (void *info) { -if (boot_cpu_has (X86_FEATURE_MTRR )) +if (mtrr_state.have_fixed)get_fixed_ranges (mtrr_state.fixed_ranges); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/222 ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 8cf4fdac9bdead7bca15fc56fdecdf78d11c3ec6 ]
As specified in section 5.7.2 of the ACPI specification the feature group string "3.0 _SCP Extensions" implies that the operating system evaluates the _SCP control method with additional parameters.
However the ACPI thermal driver evaluates the _SCP control method without those additional parameters, conflicting with the above feature group string advertised to the firmware thru _OSI.
Stop advertising support for this feature string to avoid confusing the ACPI firmware.
--- drivers/acpi/osi.c | 1 - 1 file changed, 1 deletion(-)
drivers/acpi/osi.c +0 -1
@@ -42,7 +42,6 @@ static struct acpi_osi_entry osi_setup_entries[OSI_STRING_ENTRIES_MAX] __initdata = { {"Module Device", true}, {"Processor Device", true}, - {"3.0 _SCP Extensions", true}, {"Processor Aggregator Device", true},/* * Linux-Dell-Video is used by BIOS to disable RTD3 for NVidia graphics
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/222 spi: sh-msiof: Fix maximum DMA transfer size
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 0941d5166629cb766000530945e54b4e49680c68 ]
The maximum amount of data to transfer in a single DMA request is calculated from the FIFO sizes (which is technically not 100% correct, but a simplification, as it is limited by the maximum word count values in the Transmit and Control Data Registers). However, in case there is both data to transmit and to receive, the transmit limit is overwritten by the receive limit.
Fix this by using the minimum applicable FIFO size instead. Move the calculation outside the loop, so it is not repeated for each individual DMA transfer.
As currently tx_fifo_size is always equal to rx_fifo_size, this bug had no real impact.
--- drivers/spi/spi-sh-msiof.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/spi/spi-sh-msiof.c +7 -6
@@ -918,6 +918,7 @@ static int sh_msiof_transfer_one(struct spi_controller *ctlr,void *rx_buf = t->rx_buf;unsigned int len = t->len;unsigned int bits = t->bits_per_word; +unsigned int max_wdlen =256 ;unsigned int bytes_per_word;unsigned int words;int n;
@@ -931,17 +932,17 @@ static int sh_msiof_transfer_one(struct spi_controller *ctlr,if (!spi_controller_is_slave (p->ctlr))sh_msiof_spi_set_clk_regs (p,clk_get_rate (p->clk), t->speed_hz); +if (tx_buf) + max_wdlen =min (max_wdlen, p->tx_fifo_size); +if (rx_buf) + max_wdlen =min (max_wdlen, p->rx_fifo_size); +while (ctlr->dma_tx && len >15 ) {/* * DMA supports 32-bit words only, hence pack 8-bit and 16-bit * words, with byte resp. word swapping. */ -unsigned int l =0 ; - -if (tx_buf) - l =min (round_down (len,4 ), p->tx_fifo_size *4 ); -if (rx_buf) - l =min (round_down (len,4 ), p->rx_fifo_size *4 ); +unsigned int l =min (round_down (len,4 ), max_wdlen *4 );if (bits <=8 ) { copy32 = copy_bswap32;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/222 drm/vmwgfx: Add seqno waiter for sync_files
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 0039a3b35b10d9c15d3d26320532ab56cc566750 ]
Because sync_files are passive waiters they do not participate in the processing of fences like the traditional vmw_fence_wait IOCTL. If userspace exclusively uses sync_files for synchronization then nothing in the kernel actually processes fence updates as interrupts for fences are masked and ignored if the kernel does not indicate to the SVGA device that there are active waiters.
This oversight results in a bug where the entire GUI can freeze waiting on a sync_file that will never be signalled as we've masked the interrupts to signal its completion. This bug is incredibly racy as any process which interacts with the fencing code via the 3D stack can process the stuck fences on behalf of the stuck process causing it to run again. Even a simple app like eglinfo is enough to resume the stuck process. Usually this bug is seen at a login screen like GDM because there are no other 3D apps running.
By adding a seqno waiter we re-enable interrupt based processing of the dma_fences associated with the sync_file which is signalled as part of a dma_fence_callback.
This has likely been broken since it was initially added to the kernel in 2017 but has gone unnoticed until mutter recently started using sync_files heavily over the course of 2024 as part of their explicit sync support.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 26 +++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +26 -0
@@ -3621,6 +3621,23 @@ static int vmw_execbuf_tie_context(struct vmw_private *dev_priv,return 0 ; } +/* +* DMA fence callback to remove a seqno_waiter +*/ +struct seqno_waiter_rm_context { +struct dma_fence_cb base; +struct vmw_private *dev_priv; +}; + +static void seqno_waiter_rm_cb (struct dma_fence *f,struct dma_fence_cb *cb) +{ +struct seqno_waiter_rm_context *ctx = + container_of(cb, struct seqno_waiter_rm_context, base); + +vmw_seqno_waiter_remove (ctx->dev_priv); +kfree (ctx); +} + int vmw_execbuf_process(struct drm_file *file_priv, struct vmw_private *dev_priv, void __user *user_commands, void *kernel_commands,
@@ -3814,6 +3831,15 @@ int vmw_execbuf_process(struct drm_file *file_priv, }else {/* Link the fence with the FD created earlier */ fd_install (out_fence_fd, sync_file->file); +struct seqno_waiter_rm_context *ctx = +kmalloc (sizeof (*ctx),GFP_KERNEL ); + ctx->dev_priv = dev_priv; +vmw_seqno_waiter_add (dev_priv); +if (dma_fence_add_callback (&fence->base, &ctx->base, + seqno_waiter_rm_cb) <0 ) { +vmw_seqno_waiter_remove (dev_priv); +kfree (ctx); + } } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/222 m68k: mac: Fix macintosh_config for Mac II
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 52ae3f5da7e5adbe3d1319573b55dac470abb83c ]
When booted on my Mac II, the kernel prints this:
Detected Macintosh model: 6
Apple Macintosh Unknown
The catch-all entry ("Unknown") is mac_data_table[0] which is only needed in the unlikely event that the bootinfo model ID can't be matched. When model ID is 6, the search should begin and end at mac_data_table[1]. Fix the off-by-one error that causes this problem.
--- arch/m68k/mac/config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/mac/config.c +1 -1
@@ -804,7 +804,7 @@ static void __init mac_identify(void) } macintosh_config = mac_data_table; -for (m = macintosh_config; m->ident !=-1 ; m++) { +for (m = &mac_data_table[1 ]; m->ident !=-1 ; m++) {if (m->ident == model) { macintosh_config = m;break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/222 firmware: psci: Fix refcount leak in psci_dt_init
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
[ Upstream commit 7ff37d29fd5c27617b9767e1b8946d115cf93a1e ]
Fix a reference counter leak in psci_dt_init() where of_node_put(np) was missing after of_find_matching_node_and_match() when np is unavailable.
--- drivers/firmware/psci/psci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firmware/psci/psci.c +3 -1
@@ -573,8 +573,10 @@ int __init psci_dt_init(void) np =of_find_matching_node_and_match (NULL , psci_of_match, &matched_np); -if (!np || !of_device_is_available (np)) +if (!np || !of_device_is_available (np)) { +of_node_put (np);return -ENODEV ; + } init_fn = (psci_initcall_t )matched_np->data; ret =init_fn (np);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/222 selftests/seccomp: fix syscall_restart test for arm compat
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neill Kapron <[email protected]>
[ Upstream commit 797002deed03491215a352ace891749b39741b69 ]
The inconsistencies in the systcall ABI between arm and arm-compat can can cause a failure in the syscall_restart test due to the logic attempting to work around the differences. The 'machine' field for an ARM64 device running in compat mode can report 'armv8l' or 'armv8b' which matches with the string 'arm' when only examining the first three characters of the string.
This change adds additional validation to the workaround logic to make sure we only take the arm path when running natively, not in arm-compat.
--- tools/testing/selftests/seccomp/seccomp_bpf.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/testing/selftests/seccomp/seccomp_bpf.c +5 -2
@@ -2875,12 +2875,15 @@ TEST(syscall_restart) ret =get_syscall (_metadata, child_pid);#if defined(__arm__)/* -* FIXME: * - native ARM registers do NOT expose true syscall. * - compat ARM registers on ARM64 DO expose true syscall. +* - values of utsbuf.machine include 'armv8l' or 'armb8b' +* for ARM64 running in compat mode. */ ASSERT_EQ (0 ,uname (&utsbuf)); -if (strncmp (utsbuf.machine,"arm" ,3 ) ==0 ) { +if ((strncmp (utsbuf.machine,"arm" ,3 ) ==0 ) && + (strncmp (utsbuf.machine,"armv8l" ,6 ) !=0 ) && + (strncmp (utsbuf.machine,"armv8b" ,6 ) !=0 )) {EXPECT_EQ (__NR_nanosleep, ret); } else#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/222 drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 91e3bf09a90bb4340c0c3c51396e7531555efda4 ]
The rcar_du_vsps_init() doesn't free the np allocated by of_parse_phandle_with_fixed_args() for the non-error case.
Fix memory leak for the non-error case.
While at it, replace the label 'error'->'done' as it applies to non-error case as well and update the error check condition for rcar_du_vsp_init() to avoid breakage in future, if it returns positive value.
--- drivers/gpu/drm/rcar-du/rcar_du_kms.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/gpu/drm/rcar-du/rcar_du_kms.c +4 -6
@@ -567,7 +567,7 @@ static int rcar_du_vsps_init(struct rcar_du_device *rcdu) ret =of_parse_phandle_with_fixed_args (np,"vsps" , cells, i, &args);if (ret <0 ) - goto error; + goto done;/* * Add the VSP to the list or update the corresponding existing
@@ -601,13 +601,11 @@ static int rcar_du_vsps_init(struct rcar_du_device *rcdu) vsp->dev = rcdu; ret =rcar_du_vsp_init (vsp, vsps[i].np, vsps[i].crtcs_mask); -if (ret <0 ) - goto error; +if (ret) + goto done; } -return 0 ; - -error: +done:for (i =0 ; i <ARRAY_SIZE (vsps); ++i)of_node_put (vsps[i].np);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/222 drm/vkms: Adjust vkms_state->active_planes allocation type
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 258aebf100540d36aba910f545d4d5ddf4ecaf0b ]
In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.)
The assigned type is "struct vkms_plane_state **", but the returned type will be "struct drm_plane **". These are the same size (pointer size), but the types don't match. Adjust the allocation type to match the assignment.
--- drivers/gpu/drm/vkms/vkms_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vkms/vkms_crtc.c +1 -1
@@ -187,7 +187,7 @@ static int vkms_crtc_atomic_check(struct drm_crtc *crtc, i++; } - vkms_state->active_planes =kcalloc (i,sizeof (plane),GFP_KERNEL ); + vkms_state->active_planes =kcalloc (i,sizeof (*vkms_state->active_planes),GFP_KERNEL );if (!vkms_state->active_planes)return -ENOMEM ; vkms_state->num_active_planes = i;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/222 drm/tegra: rgb: Fix the unbound reference count
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 3c3642335065c3bde0742b0edc505b6ea8fdc2b3 ]
The of_get_child_by_name() increments the refcount in tegra_dc_rgb_probe, but the driver does not decrement the refcount during unbind. Fix the unbound reference count using devm_add_action_or_reset() helper.
--- drivers/gpu/drm/tegra/rgb.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/gpu/drm/tegra/rgb.c +13 -1
@@ -211,6 +211,11 @@ static const struct drm_encoder_helper_funcs tegra_rgb_encoder_helper_funcs = { .atomic_check = tegra_rgb_encoder_atomic_check, }; +static void tegra_dc_of_node_put (void *data) +{ +of_node_put (data); +} +int tegra_dc_rgb_probe (struct tegra_dc *dc) {struct device_node *np;
@@ -218,7 +223,14 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)int err; np =of_get_child_by_name (dc->dev->of_node,"rgb" ); -if (!np || !of_device_is_available (np)) +if (!np) +return -ENODEV ; + + err =devm_add_action_or_reset (dc->dev, tegra_dc_of_node_put, np); +if (err <0 ) +return err; + +if (!of_device_is_available (np))return -ENODEV ; rgb =devm_kzalloc (dc->dev,sizeof (*rgb),GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/222 f2fs: fix to do sanity check on sbi->total_valid_block_count
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 05872a167c2cab80ef186ef23cc34a6776a1a30c ]
syzbot reported a f2fs bug as below:
------------[ cut here ]------------ kernel BUG at fs/f2fs/f2fs.h:2521! RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521 Call Trace: f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695 truncate_dnode+0x417/0x740 fs/f2fs/node.c:973 truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014 f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197 f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810 f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838 f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888 f2fs_setattr+0xc4f/0x12f0 fs/f2fs/file.c:1112 notify_change+0xbca/0xe90 fs/attr.c:552 do_truncate+0x222/0x310 fs/open.c:65 handle_truncate fs/namei.c:3466 [inline] do_open fs/namei.c:3849 [inline] path_openat+0x2e4f/0x35d0 fs/namei.c:4004 do_filp_open+0x284/0x4e0 fs/namei.c:4031 do_sys_openat2+0x12b/0x1d0 fs/open.c:1429 do_sys_open fs/open.c:1444 [inline] __do_sys_creat fs/open.c:1522 [inline] __se_sys_creat fs/open.c:1516 [inline] __x64_sys_creat+0x124/0x170 fs/open.c:1516 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
The reason is: in fuzzed image, sbi->total_valid_block_count is inconsistent w/ mapped blocks indexed by inode, so, we should not trigger panic for such case, instead, let's print log and set fsck flag.
--- fs/f2fs/f2fs.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/f2fs/f2fs.h +8 -2
@@ -1867,8 +1867,14 @@ static inline void dec_valid_block_count(struct f2fs_sb_info *sbi,blkcnt_t sectors = count <<F2FS_LOG_SECTORS_PER_BLOCK ;spin_lock (&sbi->stat_lock); -f2fs_bug_on (sbi, sbi->total_valid_block_count < (block_t ) count); - sbi->total_valid_block_count -= (block_t )count; +if (unlikely (sbi->total_valid_block_count < count)) { +f2fs_warn (sbi,"Inconsistent total_valid_block_count:%u, ino:%lu, count:%u" , + sbi->total_valid_block_count, inode->i_ino, count); + sbi->total_valid_block_count =0 ; +set_sbi_flag (sbi,SBI_NEED_FSCK ); + }else { + sbi->total_valid_block_count -= count; + }if (sbi->reserved_blocks && sbi->current_reserved_blocks < sbi->reserved_blocks) sbi->current_reserved_blocks = min(sbi->reserved_blocks,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/222 net: ncsi: Fix GCPS 64-bit member variables
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hari Kalavakunta <[email protected]>
[ Upstream commit e8a1bd8344054ce27bebf59f48e3f6bc10bc419b ]
Correct Get Controller Packet Statistics (GCPS) 64-bit wide member variables, as per DSP0222 v1.0.0 and forward specs. The Driver currently collects these stats, but they are yet to be exposed to the user. Therefore, no user impact.
Statistics fixes:
Total Bytes Received (byte range 28..35)
Total Bytes Transmitted (byte range 36..43) Total Unicast Packets Received (byte range 44..51) Total Multicast Packets Received (byte range 52..59) Total Broadcast Packets Received (byte range 60..67) Total Unicast Packets Transmitted (byte range 68..75) Total Multicast Packets Transmitted (byte range 76..83) Total Broadcast Packets Transmitted (byte range 84..91) Valid Bytes Received (byte range 204..11)
--- net/ncsi/internal.h | 21 ++++++++++----------- net/ncsi/ncsi-pkt.h | 23 +++++++++++------------ net/ncsi/ncsi-rsp.c | 21 ++++++++++----------- 3 files changed, 31 insertions(+), 34 deletions(-)
net/ncsi/internal.h +10 -11
@@ -119,16 +119,15 @@ struct ncsi_channel_vlan_filter { };struct ncsi_channel_stats { -u32 hnc_cnt_hi;/* Counter cleared */ -u32 hnc_cnt_lo;/* Counter cleared */ -u32 hnc_rx_bytes;/* Rx bytes */ -u32 hnc_tx_bytes;/* Tx bytes */ -u32 hnc_rx_uc_pkts;/* Rx UC packets */ -u32 hnc_rx_mc_pkts;/* Rx MC packets */ -u32 hnc_rx_bc_pkts;/* Rx BC packets */ -u32 hnc_tx_uc_pkts;/* Tx UC packets */ -u32 hnc_tx_mc_pkts;/* Tx MC packets */ -u32 hnc_tx_bc_pkts;/* Tx BC packets */ +u64 hnc_cnt;/* Counter cleared */ +u64 hnc_rx_bytes;/* Rx bytes */ +u64 hnc_tx_bytes;/* Tx bytes */ +u64 hnc_rx_uc_pkts;/* Rx UC packets */ +u64 hnc_rx_mc_pkts;/* Rx MC packets */ +u64 hnc_rx_bc_pkts;/* Rx BC packets */ +u64 hnc_tx_uc_pkts;/* Tx UC packets */ +u64 hnc_tx_mc_pkts;/* Tx MC packets */ +u64 hnc_tx_bc_pkts;/* Tx BC packets */ u32 hnc_fcs_err;/* FCS errors */ u32 hnc_align_err;/* Alignment errors */ u32 hnc_false_carrier;/* False carrier detection */
@@ -157,7 +156,7 @@ struct ncsi_channel_stats {u32 hnc_tx_1023_frames;/* Tx 512-1023 bytes frames */ u32 hnc_tx_1522_frames;/* Tx 1024-1522 bytes frames */ u32 hnc_tx_9022_frames;/* Tx 1523-9022 bytes frames */ -u32 hnc_rx_valid_bytes;/* Rx valid bytes */ +u64 hnc_rx_valid_bytes;/* Rx valid bytes */ u32 hnc_rx_runt_pkts;/* Rx error runt packets */ u32 hnc_rx_jabber_pkts;/* Rx error jabber packets */ u32 ncsi_rx_cmds;/* Rx NCSI commands */
net/ncsi/ncsi-pkt.h +11 -12
@@ -246,16 +246,15 @@ struct ncsi_rsp_gp_pkt {/* Get Controller Packet Statistics */ struct ncsi_rsp_gcps_pkt {struct ncsi_rsp_pkt_hdr rsp;/* Response header */ -__be32 cnt_hi;/* Counter cleared */ -__be32 cnt_lo;/* Counter cleared */ -__be32 rx_bytes;/* Rx bytes */ -__be32 tx_bytes;/* Tx bytes */ -__be32 rx_uc_pkts;/* Rx UC packets */ -__be32 rx_mc_pkts;/* Rx MC packets */ -__be32 rx_bc_pkts;/* Rx BC packets */ -__be32 tx_uc_pkts;/* Tx UC packets */ -__be32 tx_mc_pkts;/* Tx MC packets */ -__be32 tx_bc_pkts;/* Tx BC packets */ +__be64 cnt;/* Counter cleared */ +__be64 rx_bytes;/* Rx bytes */ +__be64 tx_bytes;/* Tx bytes */ +__be64 rx_uc_pkts;/* Rx UC packets */ +__be64 rx_mc_pkts;/* Rx MC packets */ +__be64 rx_bc_pkts;/* Rx BC packets */ +__be64 tx_uc_pkts;/* Tx UC packets */ +__be64 tx_mc_pkts;/* Tx MC packets */ +__be64 tx_bc_pkts;/* Tx BC packets */ __be32 fcs_err;/* FCS errors */ __be32 align_err;/* Alignment errors */ __be32 false_carrier;/* False carrier detection */
@@ -284,11 +283,11 @@ struct ncsi_rsp_gcps_pkt {__be32 tx_1023_frames;/* Tx 512-1023 bytes frames */ __be32 tx_1522_frames;/* Tx 1024-1522 bytes frames */ __be32 tx_9022_frames;/* Tx 1523-9022 bytes frames */ -__be32 rx_valid_bytes;/* Rx valid bytes */ +__be64 rx_valid_bytes;/* Rx valid bytes */ __be32 rx_runt_pkts;/* Rx error runt packets */ __be32 rx_jabber_pkts;/* Rx error jabber packets */ __be32 checksum;/* Checksum */ -}; +} __packed__aligned(4) ;/* Get NCSI Statistics */ struct ncsi_rsp_gns_pkt {
net/ncsi/ncsi-rsp.c +10 -11
@@ -931,16 +931,15 @@ static int ncsi_rsp_handler_gcps(struct ncsi_request *nr)/* Update HNC's statistics */ ncs = &nc->stats; - ncs->hnc_cnt_hi =ntohl (rsp->cnt_hi); - ncs->hnc_cnt_lo =ntohl (rsp->cnt_lo); - ncs->hnc_rx_bytes =ntohl (rsp->rx_bytes); - ncs->hnc_tx_bytes =ntohl (rsp->tx_bytes); - ncs->hnc_rx_uc_pkts =ntohl (rsp->rx_uc_pkts); - ncs->hnc_rx_mc_pkts =ntohl (rsp->rx_mc_pkts); - ncs->hnc_rx_bc_pkts =ntohl (rsp->rx_bc_pkts); - ncs->hnc_tx_uc_pkts =ntohl (rsp->tx_uc_pkts); - ncs->hnc_tx_mc_pkts =ntohl (rsp->tx_mc_pkts); - ncs->hnc_tx_bc_pkts =ntohl (rsp->tx_bc_pkts); + ncs->hnc_cnt =be64_to_cpu (rsp->cnt); + ncs->hnc_rx_bytes =be64_to_cpu (rsp->rx_bytes); + ncs->hnc_tx_bytes =be64_to_cpu (rsp->tx_bytes); + ncs->hnc_rx_uc_pkts =be64_to_cpu (rsp->rx_uc_pkts); + ncs->hnc_rx_mc_pkts =be64_to_cpu (rsp->rx_mc_pkts); + ncs->hnc_rx_bc_pkts =be64_to_cpu (rsp->rx_bc_pkts); + ncs->hnc_tx_uc_pkts =be64_to_cpu (rsp->tx_uc_pkts); + ncs->hnc_tx_mc_pkts =be64_to_cpu (rsp->tx_mc_pkts); + ncs->hnc_tx_bc_pkts =be64_to_cpu (rsp->tx_bc_pkts); ncs->hnc_fcs_err =ntohl (rsp->fcs_err); ncs->hnc_align_err =ntohl (rsp->align_err); ncs->hnc_false_carrier =ntohl (rsp->false_carrier);
@@ -969,7 +968,7 @@ static int ncsi_rsp_handler_gcps(struct ncsi_request *nr) ncs->hnc_tx_1023_frames =ntohl (rsp->tx_1023_frames); ncs->hnc_tx_1522_frames =ntohl (rsp->tx_1522_frames); ncs->hnc_tx_9022_frames =ntohl (rsp->tx_9022_frames); - ncs->hnc_rx_valid_bytes =ntohl (rsp->rx_valid_bytes); + ncs->hnc_rx_valid_bytes =be64_to_cpu (rsp->rx_valid_bytes); ncs->hnc_rx_runt_pkts =ntohl (rsp->rx_runt_pkts); ncs->hnc_rx_jabber_pkts =ntohl (rsp->rx_jabber_pkts);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/222 wifi: rtw88: do not ignore hardware read error during DPK
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 20d3c19bd8f9b498173c198eadf54580c8caa336 ]
In 'rtw8822c_dpk_cal_coef1()', do not ignore error returned by 'check_hw_ready()' but issue a warning to denote possible DPK issue. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/realtek/rtw88/rtw8822c.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw88/rtw8822c.c +2 -1
@@ -2857,7 +2857,8 @@ void rtw8822c_dpk_cal_coef1(struct rtw_dev *rtwdev)rtw_write32 (rtwdev,REG_NCTL0 ,0x00001148 );rtw_write32 (rtwdev,REG_NCTL0 ,0x00001149 ); -check_hw_ready (rtwdev,0x2d9c ,MASKBYTE0 ,0x55 ); +if (!check_hw_ready (rtwdev,0x2d9c ,MASKBYTE0 ,0x55 )) +rtw_warn (rtwdev,"DPK stuck, performance may be suboptimal" );rtw_write8 (rtwdev,0x1b10 ,0x0 );rtw_write32_mask (rtwdev,REG_NCTL0 ,BIT_SUBPAGE ,0x0000000c );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/222 RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit 2b11d33de23262cb20d1dcb24b586dbb8f54d463 ]
hns_roce_hw_v2.h has a direct dependency on hnae3.h due to the inline function hns_roce_write64(), but it doesn't include this header currently. This leads to that files including hns_roce_hw_v2.h must also include hnae3.h to avoid compilation errors, even if they themselves don't really rely on hnae3.h. This doesn't make sense, hns_roce_hw_v2.h should include hnae3.h directly.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 - drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 + drivers/infiniband/hw/hns/hns_roce_restrack.c | 1 - 3 files changed, 1 insertion(+), 2 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +0 -1
@@ -41,7 +41,6 @@#include <rdma/ib_umem.h> #include <rdma/uverbs_ioctl.h> -#include "hnae3.h" #include "hns_roce_common.h" #include "hns_roce_device.h" #include "hns_roce_cmd.h"
drivers/infiniband/hw/hns/hns_roce_hw_v2.h +1 -0
@@ -34,6 +34,7 @@#define _HNS_ROCE_HW_V2_H#include <linux/bitops.h> +#include "hnae3.h" #define HNS_ROCE_VF_QPC_BT_NUM 256#define HNS_ROCE_VF_SCCC_BT_NUM 64
drivers/infiniband/hw/hns/hns_roce_restrack.c +0 -1
@@ -4,7 +4,6 @@#include <rdma/rdma_cm.h> #include <rdma/restrack.h> #include <uapi/rdma/rdma_netlink.h> -#include "hnae3.h" #include "hns_roce_common.h" #include "hns_roce_device.h" #include "hns_roce_hw_v2.h"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/222 f2fs: clean up w/ fscrypt_is_bounce_page()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 0c708e35cf26449ca317fcbfc274704660b6d269 ]
Just cleanup, no logic changes.
--- fs/f2fs/data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/data.c +1 -1
@@ -37,7 +37,7 @@ static bool __is_cp_guaranteed(struct page *page)struct inode *inode;struct f2fs_sb_info *sbi; -if (!mapping) +if (fscrypt_is_bounce_page (page))return false; inode = mapping->host;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/222 netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huajian Yang <[email protected]>
[ Upstream commit aa04c6f45b9224b949aa35d4fa5f8d0ba07b23d4 ]
The config NF_CONNTRACK_BRIDGE will change the bridge forwarding for fragmented packets.
The original bridge does not know that it is a fragmented packet and forwards it directly, after NF_CONNTRACK_BRIDGE is enabled, function nf_br_ip_fragment and br_ip6_fragment will check the headroom.
In original br_forward, insufficient headroom of skb may indeed exist, but there's still a way to save the skb in the device driver after dev_queue_xmit.So droping the skb will change the original bridge forwarding in some cases.
--- net/bridge/netfilter/nf_conntrack_bridge.c | 12 ++++++------ net/ipv6/netfilter.c | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-)
net/bridge/netfilter/nf_conntrack_bridge.c +6 -6
@@ -59,19 +59,19 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk,struct ip_fraglist_iter iter;struct sk_buff *frag; -if (first_len - hlen > mtu || -skb_headroom (skb) < ll_rs) +if (first_len - hlen > mtu) goto blackhole; -if (skb_cloned (skb)) +if (skb_cloned (skb) || +skb_headroom (skb) < ll_rs) goto slow_path; skb_walk_frags(skb, frag) { -if (frag->len > mtu || -skb_headroom (frag) < hlen + ll_rs) +if (frag->len > mtu) goto blackhole; -if (skb_shared (frag)) +if (skb_shared (frag) || +skb_headroom (frag) < hlen + ll_rs) goto slow_path; }
net/ipv6/netfilter.c +6 -6
@@ -155,20 +155,20 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,struct ip6_fraglist_iter iter;struct sk_buff *frag2; -if (first_len - hlen > mtu || -skb_headroom (skb) < (hroom +sizeof (struct frag_hdr ))) +if (first_len - hlen > mtu) goto blackhole; -if (skb_cloned (skb)) +if (skb_cloned (skb) || +skb_headroom (skb) < (hroom +sizeof (struct frag_hdr ))) goto slow_path; skb_walk_frags(skb, frag2) { -if (frag2->len > mtu || -skb_headroom (frag2) < (hlen + hroom +sizeof (struct frag_hdr ))) +if (frag2->len > mtu) goto blackhole;/* Partially cloned skb? */ -if (skb_shared (frag2)) +if (skb_shared (frag2) || +skb_headroom (frag2) < (hlen + hroom +sizeof (struct frag_hdr ))) goto slow_path; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/222 ktls, sockmap: Fix missing uncharge operation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 79f0c39ae7d3dc628c01b02f23ca5d01f9875040 ]
When we specify apply_bytes, we divide the msg into multiple segments, each with a length of 'send', and every time we send this part of the data using tcp_bpf_sendmsg_redir(), we use sk_msg_return_zero() to uncharge the memory of the specified 'send' size.
However, if the first segment of data fails to send, for example, the peer's buffer is full, we need to release all of the msg. When releasing the msg, we haven't uncharged the memory of the subsequent segments.
This modification does not make significant logical changes, but only fills in the missing uncharge places.
This issue has existed all along, until it was exposed after we added the
apply test in test_sockmap:
commit 3448ad23b34e ("selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap")
--- net/tls/tls_sw.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/tls/tls_sw.c +7 -0
@@ -856,6 +856,13 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, err =tcp_bpf_sendmsg_redir (sk_redir, &msg_redir, send, flags);lock_sock (sk);if (err <0 ) { +/* Regardless of whether the data represented by +* msg_redir is sent successfully, we have already +* uncharged it via sk_msg_return_zero(). The +* msg->sg.size represents the remaining unprocessed +* data, which needs to be uncharged here. +*/ +sk_mem_uncharge (sk, msg->sg.size); *copied -=sk_msg_free_nocharge (sk, &msg_redir); msg->sg.size =0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/222 pinctrl: at91: Fix possible out-of-boundary access
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 762ef7d1e6eefad9896560bfcb9bcf7f1b6df9c1 ]
at91_gpio_probe() doesn't check that given OF alias is not available or something went wrong when trying to get it. This might have consequences when accessing gpio_chips array with that value as an index. Note, that BUG() can be compiled out and hence won't actually perform the required checks.
--- drivers/pinctrl/pinctrl-at91.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-at91.c +5 -1
@@ -1819,12 +1819,16 @@ static int at91_gpio_probe(struct platform_device *pdev)struct at91_gpio_chip *at91_chip =NULL ;struct gpio_chip *chip;struct pinctrl_gpio_range *range; +int alias_idx;int ret =0 ;int irq, i; -int alias_idx =of_alias_get_id (np,"gpio" );uint32_t ngpio;char **names; + alias_idx =of_alias_get_id (np,"gpio" ); +if (alias_idx <0 ) +return alias_idx; +BUG_ON (alias_idx >=ARRAY_SIZE (gpio_chips));if (gpio_chips[alias_idx]) { ret = -EBUSY ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/222 bpf: Fix WARN() in get_bpf_raw_tp_regs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit 3880cdbed1c4607e378f58fa924c5d6df900d1d3 ]
syzkaller reported an issue:
WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 Modules linked in: CPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 RSP: 0018:ffffc90003636fa8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff81c6bc4c RDX: ffff888032efc880 RSI: ffffffff81c6bc83 RDI: 0000000000000005 RBP: ffff88806a730860 R08: 0000000000000005 R09: 0000000000000003 R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000004 R13: 0000000000000001 R14: ffffc90003637008 R15: 0000000000000900 FS: 0000000000000000(0000) GS:ffff8880d6cdf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7baee09130 CR3: 0000000029f5a000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1934 [inline] bpf_get_stack_raw_tp+0x24/0x160 kernel/trace/bpf_trace.c:1931 bpf_prog_ec3b2eefa702d8d3+0x43/0x47 bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline] bpf_trace_run3+0x23f/0x5a0 kernel/trace/bpf_trace.c:2405 __bpf_trace_mmap_lock_acquire_returned+0xfc/0x140 include/trace/events/mmap_lock.h:47 __traceiter_mmap_lock_acquire_returned+0x79/0xc0 include/trace/events/mmap_lock.h:47 __do_trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline] trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline] __mmap_lock_do_trace_acquire_returned+0x138/0x1f0 mm/mmap_lock.c:35 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:204 [inline] stack_map_get_build_id_offset+0x535/0x6f0 kernel/bpf/stackmap.c:157 __bpf_get_stack+0x307/0xa10 kernel/bpf/stackmap.c:483 ____bpf_get_stack kernel/bpf/stackmap.c:499 [inline] bpf_get_stack+0x32/0x40 kernel/bpf/stackmap.c:496 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1941 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1931 bpf_prog_ec3b2eefa702d8d3+0x43/0x47
Tracepoint like trace_mmap_lock_acquire_returned may cause nested call as the corner case show above, which will be resolved with more general method in the future. As a result, WARN_ON_ONCE will be triggered. As Alexei suggested, remove the WARN_ON_ONCE first.
--- kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/bpf_trace.c +1 -1
@@ -956,7 +956,7 @@ static struct pt_regs *get_bpf_raw_tp_regs(void)struct bpf_raw_tp_regs *tp_regs =this_cpu_ptr (&bpf_raw_tp_regs);int nest_level =this_cpu_inc_return (bpf_raw_tp_nest_level); -if (WARN_ON_ONCE (nest_level >ARRAY_SIZE (tp_regs->regs))) { +if (nest_level >ARRAY_SIZE (tp_regs->regs)) {this_cpu_dec (bpf_raw_tp_nest_level);return ERR_PTR (-EBUSY ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/222 wifi: ath9k_htc: Abort software beacon handling if disabled
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit ac4e317a95a1092b5da5b9918b7118759342641c ]
A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds read.
Prevent this by aborting the handling in ath9k_htc_swba() if beacons are not enabled.
--- drivers/net/wireless/ath/ath9k/htc_drv_beacon.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath9k/htc_drv_beacon.c +3 -0
@@ -290,6 +290,9 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv,struct ath_common *common =ath9k_hw_common (priv->ah);int slot; +if (!priv->cur_beacon_conf.enable_beacon) +return ; +if (swba->beacon_pending !=0 ) { priv->beacon.bmisscnt++;if (priv->beacon.bmisscnt >BSTUCK_THRESHOLD ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/222 netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 8b53f46eb430fe5b42d485873b85331d2de2c469 ]
With a VRF, ipv4 and ipv6 FIB expression behave differently.
fib daddr . iif oif
Will return the input interface name for ipv4, but the real device for ipv6. Example:
If VRF device name is tvrf and real (incoming) device is veth0. First round is ok, both ipv4 and ipv6 will yield 'veth0'.
But in the second round (incoming device will be set to "tvrf"), ipv4 will yield "tvrf" whereas ipv6 returns "veth0" for the second round too.
This makes ipv6 behave like ipv4.
A followup patch will add a test case for this, without this change it will fail with:
get element inet t fibif6iif { tvrf . dead:1::99 . tvrf } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
FAIL: did not find tvrf . dead:1::99 . tvrf in fibif6iif
Alternatively we could either not do anything at all or change ipv4 to also return the lower/real device, however, nft (userspace) doc says "iif: if fib lookup provides a route then check its output interface is identical to the packets input interface." which is what the nft fib ipv4 behaviour is.
--- net/ipv6/netfilter/nft_fib_ipv6.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/ipv6/netfilter/nft_fib_ipv6.c +9 -4
@@ -143,6 +143,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, {const struct nft_fib *priv =nft_expr_priv (expr);int noff =skb_network_offset (pkt->skb); +const struct net_device *found =NULL ;const struct net_device *oif =NULL ;u32 *dest = ®s->data[priv->dreg];struct ipv6hdr *iph, _iph;
@@ -182,11 +183,15 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,if (rt->rt6i_flags & (RTF_REJECT |RTF_ANYCAST |RTF_LOCAL )) goto put_rt_err; -if (oif && oif != rt->rt6i_idev->dev && -l3mdev_master_ifindex_rcu (rt->rt6i_idev->dev) != oif->ifindex) - goto put_rt_err; +if (!oif) { + found = rt->rt6i_idev->dev; + }else { +if (oif == rt->rt6i_idev->dev || +l3mdev_master_ifindex_rcu (rt->rt6i_idev->dev) == oif->ifindex) + found = oif; + } -nft_fib_store_result (dest, priv, rt->rt6i_idev->dev); +nft_fib_store_result (dest, priv, found); put_rt_err:ip6_rt_put (rt); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/222 net: usb: aqc111: fix error handling of usbnet read calls
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 405b0d610745fb5e84fc2961d9b960abb9f3d107 ]
Syzkaller, courtesy of syzbot, identified an error (see report [1]) in aqc111 driver, caused by incomplete sanitation of usb read calls' results. This problem is quite similar to the one fixed in commit 920a9fa27e78 ("net: asix: add proper error handling of usb read errors").
For instance, usbnet_read_cmd() may read fewer than 'size' bytes, even if the caller expected the full amount, and aqc111_read_cmd() will not check its result properly. As [1] shows, this may lead to MAC address in aqc111_bind() being only partly initialized, triggering KMSAN warnings.
Fix the issue by verifying that the number of bytes read is as expected and not less.
[1] Partial syzbot report:
BUG: KMSAN: uninit-value in is_valid_ether_addr include/linux/etherdevice.h:208 [inline] BUG: KMSAN: uninit-value in usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 is_valid_ether_addr include/linux/etherdevice.h:208 [inline] usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x4d1/0xd90 drivers/base/dd.c:658 __driver_probe_device+0x268/0x380 drivers/base/dd.c:800
...
Uninit was stored to memory at:
dev_addr_mod+0xb0/0x550 net/core/dev_addr_lists.c:582 __dev_addr_set include/linux/netdevice.h:4874 [inline] eth_hw_addr_set include/linux/etherdevice.h:325 [inline] aqc111_bind+0x35f/0x1150 drivers/net/usb/aqc111.c:717 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396
...
Uninit was stored to memory at:
ether_addr_copy include/linux/etherdevice.h:305 [inline] aqc111_read_perm_mac drivers/net/usb/aqc111.c:663 [inline] aqc111_bind+0x794/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline]
...
Local variable buf.i created at:
aqc111_read_perm_mac drivers/net/usb/aqc111.c:656 [inline] aqc111_bind+0x221/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772
--- drivers/net/usb/aqc111.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/usb/aqc111.c +8 -2
@@ -30,10 +30,13 @@ static int aqc111_read_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value, ret =usbnet_read_cmd_nopm (dev, cmd,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , value, index, data, size); -if (unlikely (ret <0 )) +if (unlikely (ret < size)) { + ret = ret <0 ? ret : -ENODATA ; +netdev_warn (dev->net,"Failed to read(0x%x) reg index 0x%04x: %d\n" , cmd, index, ret); + }return ret; }
@@ -46,10 +49,13 @@ static int aqc111_read_cmd(struct usbnet *dev, u8 cmd, u16 value, ret =usbnet_read_cmd (dev, cmd,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , value, index, data, size); -if (unlikely (ret <0 )) +if (unlikely (ret < size)) { + ret = ret <0 ? ret : -ENODATA ; +netdev_warn (dev->net,"Failed to read(0x%x) reg index 0x%04x: %d\n" , cmd, index, ret); + }return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/222 net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thangaraj Samynathan <[email protected]>
[ Upstream commit 68927eb52d0af04863584930db06075d2610e194 ]
rename the function to lan743x_hw_reset_phy to better describe it operation.
--- drivers/net/ethernet/microchip/lan743x_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/microchip/lan743x_main.c +2 -2
@@ -912,7 +912,7 @@ static int lan743x_mac_set_mtu(struct lan743x_adapter *adapter, int new_mtu) }/* PHY */ -static int lan743x_phy_reset (struct lan743x_adapter *adapter) +static int lan743x_hw_reset_phy (struct lan743x_adapter *adapter) {u32 data;
@@ -946,7 +946,7 @@ static void lan743x_phy_update_flowcontrol(struct lan743x_adapter *adapter,static int lan743x_phy_init (struct lan743x_adapter *adapter) { -return lan743x_phy_reset (adapter); +return lan743x_hw_reset_phy (adapter); }static void lan743x_phy_link_status_change (struct net_device *netdev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/222 calipso: Dont call calipso functions for AF_INET sk.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 6e9f2df1c550ead7cecb3e450af1105735020c92 ]
syzkaller reported a null-ptr-deref in txopt_get(). [0]
The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.
However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.
The root cause is missing validation in netlbl_conn_setattr().
netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.
The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.
We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.
Let's copy the validation to netlbl_conn_setattr().
[0]:
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:txopt_get include/net/ipv6.h:390 [inline] RIP: 0010: Code: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00 RSP: 0018:ffff88811b8afc48 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: 1ffff11023715f8a RCX: ffffffff841ab00c RDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070 RBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e R10: ffffed1023715f9d R11: 0000000000000003 R12: ffff888123075f00 R13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80 FS: 00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <TASK> calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557 netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177 selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569 selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline] selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615 selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931 security_socket_connect+0x50/0xa0 security/security.c:4598 __sys_connect_file+0xa4/0x190 net/socket.c:2067 __sys_connect+0x12c/0x170 net/socket.c:2088 __do_sys_connect net/socket.c:2098 [inline] __se_sys_connect net/socket.c:2095 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:2095 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f901b61a12d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f901b925fa0 RCX: 00007f901b61a12d RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000 </TASK> Modules linked in:
--- net/netlabel/netlabel_kapi.c | 3 +++ 1 file changed, 3 insertions(+)
net/netlabel/netlabel_kapi.c +3 -0
@@ -1140,6 +1140,9 @@ int netlbl_conn_setattr(struct sock *sk,break ;#if IS_ENABLED (CONFIG_IPV6 )case AF_INET6 : +if (sk->sk_family !=AF_INET6 ) +return -EAFNOSUPPORT ; + addr6 = (struct sockaddr_in6 *)addr; entry =netlbl_domhsh_getentry_af6 (secattr->domain, &addr6->sin6_addr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/222 f2fs: use d_inode(dentry) cleanup dentry->d_inode
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiguo Niu <[email protected]>
[ Upstream commit a6c397a31f58a1d577c2c8d04b624e9baa31951c ]
no logic changes.
--- fs/f2fs/namei.c | 8 ++++---- fs/f2fs/super.c | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-)
fs/f2fs/namei.c +4 -4
@@ -329,7 +329,7 @@ static int f2fs_link(struct dentry *old_dentry, struct inode *dir,if (is_inode_flag_set (dir,FI_PROJ_INHERIT ) && (!projid_eq (F2FS_I (dir)->i_projid, -F2FS_I (old_dentry->d_inode)->i_projid))) +F2FS_I (inode)->i_projid)))return -EXDEV ; err =dquot_initialize (dir);
@@ -869,7 +869,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,if (is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && (!projid_eq (F2FS_I (new_dir)->i_projid, -F2FS_I (old_dentry->d_inode)->i_projid))) +F2FS_I (old_inode)->i_projid)))return -EXDEV ;if (flags &RENAME_WHITEOUT ) {
@@ -1066,10 +1066,10 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,if ((is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && !projid_eq (F2FS_I (new_dir)->i_projid, -F2FS_I (old_dentry->d_inode)->i_projid)) || +F2FS_I (old_inode)->i_projid)) || (is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && !projid_eq (F2FS_I (old_dir)->i_projid, -F2FS_I (new_dentry->d_inode)->i_projid))) +F2FS_I (new_inode)->i_projid)))return -EXDEV ; err =dquot_initialize (old_dir);
fs/f2fs/super.c +2 -2
@@ -1342,9 +1342,9 @@ static int f2fs_statfs(struct dentry *dentry, struct kstatfs *buf) buf->f_fsid.val[1 ] = (u32)(id >>32 );#ifdef CONFIG_QUOTA -if (is_inode_flag_set (dentry->d_inode,FI_PROJ_INHERIT ) && +if (is_inode_flag_set (d_inode (dentry),FI_PROJ_INHERIT ) &&sb_has_quota_limits_enabled (sb,PRJQUOTA )) { -f2fs_statfs_project (sb,F2FS_I (dentry->d_inode)->i_projid, buf); +f2fs_statfs_project (sb,F2FS_I (d_inode (dentry))->i_projid, buf); }#endif return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/222 f2fs: fix to correct check conditions in f2fs_cross_rename
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiguo Niu <[email protected]>
[ Upstream commit 9883494c45a13dc88d27dde4f988c04823b42a2f ]
Should be "old_dir" here.
--- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/namei.c +1 -1
@@ -1067,7 +1067,7 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,if ((is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && !projid_eq (F2FS_I (new_dir)->i_projid,F2FS_I (old_inode)->i_projid)) || - (is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && + (is_inode_flag_set (old_dir,FI_PROJ_INHERIT ) && !projid_eq (F2FS_I (old_dir)->i_projid,F2FS_I (new_inode)->i_projid)))return -EXDEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/222 ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 67ba341e57ab158423818ed33bfa1c40eb0e5e7e ]
Dataflash did not work on my board. After checking schematics and using the proper GPIO, it works now. Also, make it active low to avoid:
flash@0 enforce active low on GPIO handle
--- arch/arm/boot/dts/usb_a9263.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/usb_a9263.dts +1 -1
@@ -58,7 +58,7 @@ }; spi0: spi@fffa4000 { - cs-gpios = <&pioB 15 GPIO_ACTIVE_HIGH>; + cs-gpios = <&pioA 5 GPIO_ACTIVE_LOW>; status = "okay"; mtd_dataflash@0 { compatible = "atmel,at45", "atmel,dataflash";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/222 ARM: dts: at91: at91sam9263: fix NAND chip selects
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit c72ede1c24be689733bcd2233a3a56f2478429c8 ]
NAND did not work on my USB-A9263. I discovered that the offending commit converted the PIO bank for chip selects wrongly, so all A9263 boards need to be fixed.
--- arch/arm/boot/dts/at91sam9263ek.dts | 2 +- arch/arm/boot/dts/tny_a9263.dts | 2 +- arch/arm/boot/dts/usb_a9263.dts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/at91sam9263ek.dts +1 -1
@@ -147,7 +147,7 @@ nand@3 { reg = <0x3 0x0 0x800000>; rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>; - cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>; + cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>; nand-bus-width = <8>; nand-ecc-mode = "soft"; nand-on-flash-bbt;
arch/arm/boot/dts/tny_a9263.dts +1 -1
@@ -64,7 +64,7 @@ nand@3 { reg = <0x3 0x0 0x800000>; rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>; - cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>; + cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>; nand-bus-width = <8>; nand-ecc-mode = "soft"; nand-on-flash-bbt;
arch/arm/boot/dts/usb_a9263.dts +1 -1
@@ -84,7 +84,7 @@ nand@3 { reg = <0x3 0x0 0x800000>; rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>; - cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>; + cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>; nand-bus-width = <8>; nand-ecc-mode = "soft"; nand-on-flash-bbt;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/222 Squashfs: check return result of sb_min_blocksize
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
[ Upstream commit 734aa85390ea693bb7eaf2240623d41b03705c84 ]
Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug.
Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails.
----msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize);
----
sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0.
As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64.
This subsequently causes the
UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36
shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long')
This commit adds a check for a 0 return by sb_min_blocksize().
--- fs/squashfs/super.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/squashfs/super.c +5 -0
@@ -86,6 +86,11 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc) msblk = sb->s_fs_info; msblk->devblksize =sb_min_blocksize (sb,SQUASHFS_DEVBLK_SIZE ); +if (!msblk->devblksize) { +errorf (fc,"squashfs: unable to set blocksize\n" ); +return -EINVAL ; + } + msblk->devblksize_log2 =ffz (~msblk->devblksize);mutex_init (&msblk->meta_index_mutex);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/222 nilfs2: add pointer check for nilfs_direct_propagate()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit f43f02429295486059605997bc43803527d69791 ]
Patch series "nilfs2: improve sanity checks in dirty state propagation".
This fixes one missed check for block mapping anomalies and one improper return of an error code during a preparation step for log writing, thereby improving checking for filesystem corruption on writeback.
This patch (of 2):
In nilfs_direct_propagate(), the printer get from nilfs_direct_get_ptr() need to be checked to ensure it is not an invalid pointer.
If the pointer value obtained by nilfs_direct_get_ptr() is NILFS_BMAP_INVALID_PTR, means that the metadata (in this case, i_bmap in the nilfs_inode_info struct) that should point to the data block at the buffer head of the argument is corrupted and the data block is orphaned, meaning that the file system has lost consistency.
Add a value check and return -EINVAL when it is an invalid pointer.
--- fs/nilfs2/direct.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nilfs2/direct.c +3 -0
@@ -273,6 +273,9 @@ static int nilfs_direct_propagate(struct nilfs_bmap *bmap, dat =nilfs_bmap_get_dat (bmap); key =nilfs_bmap_data_get_key (bmap, bh); ptr =nilfs_direct_get_ptr (bmap, key); +if (ptr ==NILFS_BMAP_INVALID_PTR ) +return -EINVAL ; +if (!buffer_nilfs_volatile (bh)) { oldreq.pr_entry_nr = ptr; newreq.pr_entry_nr = ptr;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/222 nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit 8e39fbb1edbb4ec9d7c1124f403877fc167fcecd ]
In preparation for writing logs, in nilfs_btree_propagate(), which makes parent and ancestor node blocks dirty starting from a modified data block or b-tree node block, if the starting block does not belong to the b-tree, i.e. is isolated, nilfs_btree_do_lookup() called within the function fails with -ENOENT.
In this case, even though -ENOENT is an internal code, it is propagated to the log writer via nilfs_bmap_propagate() and may be erroneously returned to system calls such as fsync().
Fix this issue by changing the error code to -EINVAL in this case, and having the bmap layer detect metadata corruption and convert the error code appropriately.
--- fs/nilfs2/btree.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nilfs2/btree.c +3 -1
@@ -2097,11 +2097,13 @@ static int nilfs_btree_propagate(struct nilfs_bmap *btree, ret =nilfs_btree_do_lookup (btree, path, key,NULL , level +1 ,0 );if (ret <0 ) { -if (unlikely (ret == -ENOENT )) +if (unlikely (ret == -ENOENT )) {nilfs_crit (btree->b_inode->i_sb,"writing node/leaf block does not appear in b-tree (ino=%lu) at key=%llu, level=%d" , btree->b_inode->i_ino, (unsigned long long )key, level); + ret = -EINVAL ; + } goto out; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/222 bus: fsl-mc: fix double-free on mc_dev
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <[email protected]>
[ Upstream commit d694bf8a9acdbd061596f3e7549bc8cb70750a60 ]
The blamed commit tried to simplify how the deallocations are done but, in the process, introduced a double-free on the mc_dev variable.
In case the MC device is a DPRC, a new mc_bus is allocated and the mc_dev variable is just a reference to one of its fields. In this circumstance, on the error path only the mc_bus should be freed.
This commit introduces back the following checkpatch warning which is a false-positive.
WARNING: kfree(NULL) is safe and this check is probably not required
+ if (mc_bus)
+ kfree(mc_bus);
--- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/bus/fsl-mc/fsl-mc-bus.c +4 -2
@@ -679,8 +679,10 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc, error_cleanup_dev:kfree (mc_dev->regions); -kfree (mc_bus); -kfree (mc_dev); +if (mc_bus) +kfree (mc_bus); +else +kfree (mc_dev);return error; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/222 ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 325c6a441ae1f8fcb1db9bb945b8bdbd3142141e ]
Follow up the expected way of describing the SFPB hwspinlock and merge hwspinlock node into corresponding syscon node, fixing several dt-schema warnings.
--- arch/arm/boot/dts/qcom-apq8064.dtsi | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
arch/arm/boot/dts/qcom-apq8064.dtsi +4 -9
@@ -211,12 +211,6 @@ }; }; - sfpb_mutex: hwmutex { - compatible = "qcom,sfpb-mutex"; - syscon = <&sfpb_wrapper_mutex 0x604 0x4>; - #hwlock-cells = <1>; - }; - smem { compatible = "qcom,smem"; memory-region = <&smem_region>;
@@ -359,9 +353,10 @@ pinctrl-0 = <&ps_hold>; }; - sfpb_wrapper_mutex: syscon@1200000 { - compatible = "syscon"; - reg = <0x01200000 0x8000>; + sfpb_mutex: hwmutex@1200600 { + compatible = "qcom,sfpb-mutex"; + reg = <0x01200600 0x100>; + #hwlock-cells = <1>; }; intc: interrupt-controller@2000000 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/222 arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
[ Upstream commit febd8c6ab52c683b447fe22fc740918c86feae43 ]
The u2phy0_host port is the part of the USB PHY0 (namely the HOST0_DP/DM lanes) which routes directly to the USB2.0 HOST controller[1]. The other lanes of the PHY are routed to the USB3.0 OTG controller (dwc3), which we do use.
The HOST0_DP/DM lanes aren't routed on RK3399 Puma so let's simply disable the USB2.0 controllers.
USB3 OTG has been known to be unstable on RK3399 Puma Haikou for a while, one of the recurring issues being that only USB2 is detected and not USB3 in host mode. Reading the justification above and seeing that we are keeping u2phy0_host in the Haikou carrierboard DTS probably may have bothered you since it should be changed to u2phy0_otg. The issue is that if it's switched to that, USB OTG on Haikou is entirely broken. I have checked the routing in the Gerber file, the lanes are going to the expected ball pins (that is, NOT HOST0_DP/DM).u2phy0_host is for sure the wrong part of the PHY to use, but it's the only one that works at the moment for that board so keep it until we figure out what exactly is broken.
No intended functional change.
[1] https://rockchip.fr/Rockchip%20RK3399%20TRM%20V1.3%20Part2.pdf
Chapter 2 USB2.0 PHY
--- arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 8 -------- 1 file changed, 8 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts +0 -8
@@ -246,14 +246,6 @@ status = "okay"; }; -&usb_host0_ehci { - status = "okay"; -}; - -&usb_host0_ohci { - status = "okay"; -}; - &vopb { status = "okay"; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/222 soc: aspeed: lpc: Fix impossible judgment condition
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit d9f0a97e859bdcef51f9c187b1eb712eb13fd3ff ]
smatch error：drivers/soc/aspeed/aspeed-lpc-snoop.c:169 aspeed_lpc_snoop_config_irq() warn: platform_get_irq() does not return zero
platform_get_irq() return non-zero IRQ number or negative error code, change '!lpc_snoop->irq' to 'lpc_snoop->irq < 0' to fix this.
--- drivers/soc/aspeed/aspeed-lpc-snoop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/aspeed/aspeed-lpc-snoop.c +1 -1
@@ -168,7 +168,7 @@ static int aspeed_lpc_snoop_config_irq(struct aspeed_lpc_snoop *lpc_snoop,int rc; lpc_snoop->irq =platform_get_irq (pdev,0 ); -if (!lpc_snoop->irq) +if (lpc_snoop->irq <0 )return -ENODEV ; rc = devm_request_irq(dev, lpc_snoop->irq,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/222 soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit f1706e0e1a74b095cbc60375b9b1e6205f5f4c98 ]
devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devm_kasprintf() to prevent this issue.
--- drivers/soc/aspeed/aspeed-lpc-snoop.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/soc/aspeed/aspeed-lpc-snoop.c +13 -2
@@ -202,11 +202,15 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, lpc_snoop->chan[channel].miscdev.minor =MISC_DYNAMIC_MINOR ; lpc_snoop->chan[channel].miscdev.name =devm_kasprintf (dev,GFP_KERNEL ,"%s%d" ,DEVICE_NAME , channel); +if (!lpc_snoop->chan[channel].miscdev.name) { + rc = -ENOMEM ; + goto err_free_fifo; + } lpc_snoop->chan[channel].miscdev.fops = &snoop_fops; lpc_snoop->chan[channel].miscdev.parent = dev; rc =misc_register (&lpc_snoop->chan[channel].miscdev);if (rc) -return rc; + goto err_free_fifo;/* Enable LPC snoop channel at requested port */ switch (channel) {
@@ -223,7 +227,8 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, hicrb_en =HICRB_ENSNP1D ;break ;default : -return -EINVAL ; + rc = -EINVAL ; + goto err_misc_deregister; }regmap_update_bits (lpc_snoop->regmap,HICR5 , hicr5_en, hicr5_en);
@@ -233,6 +238,12 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop,regmap_update_bits (lpc_snoop->regmap,HICRB , hicrb_en, hicrb_en); +return 0 ; + +err_misc_deregister: +misc_deregister (&lpc_snoop->chan[channel].miscdev); +err_free_fifo: +kfifo_free (&lpc_snoop->chan[channel].fifo);return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/222 fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit 3f6dae09fc8c306eb70fdfef70726e1f154e173a ]
In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow...
Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.
--- drivers/video/fbdev/core/fbcvt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/core/fbcvt.c +1 -1
@@ -312,7 +312,7 @@ int fb_find_mode_cvt(struct fb_videomode *mode, int margins, int rb) cvt.f_refresh = cvt.refresh; cvt.interlace =1 ; -if (!cvt.xres || !cvt.yres || !cvt.refresh) { +if (!cvt.xres || !cvt.yres || !cvt.refresh || cvt.f_refresh >INT_MAX ) {printk (KERN_INFO "fbcvt: Invalid input parameters\n" );return 1 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/222 randstruct: gcc-plugin: Remove bogus void member
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit e136a4062174a9a8d1c1447ca040ea81accfa6a8 ]
When building the randomized replacement tree of struct members, the randstruct GCC plugin would insert, as the first member, a 0-sized void member. This appears as though it was done to catch non-designated ("unnamed") static initializers, which wouldn't be stable since they depend on the original struct layout order.
This was accomplished by having the side-effect of the "void member" tripping an assert in GCC internals (count_type_elements) if the member list ever needed to be counted (e.g. for figuring out the order of members during a non-designated initialization), which would catch impossible type (void) in the struct:
security/landlock/fs.c: In function ‘hook_file_ioctl_common’:security/landlock/fs.c:1745:61: internal compiler error: in count_type_elements, at expr.cc:7075
1745 | .u.op = &(struct lsm_ioctlop_audit) {
| ^
static HOST_WIDE_INTcount_type_elements (const_tree type, bool for_ctor_p) {
switch (TREE_CODE (type))
...
case VOID_TYPE:
default:
gcc_unreachable ();
}
}However this is a redundant safety measure since randstruct uses the __designated_initializer attribute both internally and within the __randomized_layout attribute macro so that this would be enforced by the compiler directly even when randstruct was not enabled (via -Wdesignated-init).
A recent change in Landlock ended up tripping the same member counting routine when using a full-struct copy initializer as part of an anonymous initializer. This, however, is a false positive as the initializer is copying between identical structs (and hence identical layouts). The "path" member is "struct path", a randomized struct, and is being copied to from another "struct path", the "f_path" member:
landlock_log_denial(landlock_cred(file->f_cred), &(struct landlock_request) {
.type = LANDLOCK_REQUEST_FS_ACCESS,
.audit = {
.type = LSM_AUDIT_DATA_IOCTL_OP,
.u.op = &(struct lsm_ioctlop_audit) {
.path = file->f_path,
.cmd = cmd,
},
},
...As can be seen with the coming randstruct KUnit test, there appears to be no behavioral problems with this kind of initialization when the void member is removed from the randstruct GCC plugin, so remove it.
--- scripts/gcc-plugins/randomize_layout_plugin.c | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-)
scripts/gcc-plugins/randomize_layout_plugin.c +1 -17
@@ -377,29 +377,13 @@ static int relayout_struct(tree type)shuffle (type, (tree *)newtree, shuffle_length); -/* -* set up a bogus anonymous struct field designed to error out on unnamed struct initializers -* as gcc provides no other way to detect such code -*/ - list =make_node (FIELD_DECL ); -TREE_CHAIN (list) = newtree[0 ]; -TREE_TYPE (list) = void_type_node; -DECL_SIZE (list) = bitsize_zero_node; -DECL_NONADDRESSABLE_P (list) =1 ; -DECL_FIELD_BIT_OFFSET (list) = bitsize_zero_node; -DECL_SIZE_UNIT (list) = size_zero_node; -DECL_FIELD_OFFSET (list) = size_zero_node; -DECL_CONTEXT (list) = type; -// to satisfy the constify plugin -TREE_READONLY (list) =1 ; -for (i =0 ; i < num_fields -1 ; i++)TREE_CHAIN (newtree[i]) = newtree[i+1 ];TREE_CHAIN (newtree[num_fields -1 ]) =NULL_TREE ; main_variant =TYPE_MAIN_VARIANT (type);for (variant = main_variant; variant; variant =TYPE_NEXT_VARIANT (variant)) { -TYPE_FIELDS (variant) = list; +TYPE_FIELDS (variant) = newtree[0 ];TYPE_ATTRIBUTES (variant) =copy_list (TYPE_ATTRIBUTES (variant));TYPE_ATTRIBUTES (variant) =tree_cons (get_identifier ("randomize_performed" ),NULL_TREE ,TYPE_ATTRIBUTES (variant));TYPE_ATTRIBUTES (variant) =tree_cons (get_identifier ("designated_init" ),NULL_TREE ,TYPE_ATTRIBUTES (variant));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/222 randstruct: gcc-plugin: Fix attribute addition
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit f39f18f3c3531aa802b58a20d39d96e82eb96c14 ]
Based on changes in the 2021 public version of the randstruct out-of-tree GCC plugin[1], more carefully update the attributes on resulting decls, to avoid tripping checks in GCC 15's comptypes_check_enum_int() when it has been configured with "--enable-checking=misc":
arch/arm64/kernel/kexec_image.c:132:14: internal compiler error: in comptypes_check_enum_int, at c/c-typeck.cc:1519
132 | const struct kexec_file_ops kexec_image_ops = {
| ^~~~~~~~~~~~~~ internal_error(char const*, ...), at gcc/gcc/diagnostic-global-context.cc:517 fancy_abort(char const*, int, char const*), at gcc/gcc/diagnostic.cc:1803 comptypes_check_enum_int(tree_node*, tree_node*, bool*), at gcc/gcc/c/c-typeck.cc:1519
...
--- scripts/gcc-plugins/gcc-common.h | 32 +++++++++++++++++++ scripts/gcc-plugins/randomize_layout_plugin.c | 22 ++++++------- 2 files changed, 43 insertions(+), 11 deletions(-)
scripts/gcc-plugins/gcc-common.h +32 -0
@@ -182,6 +182,38 @@ static inline tree build_const_char_string(int len, const char *str)return cstr; } +static inline void __add_type_attr (tree type,const char *attr,tree args) +{ +tree oldattr; + +if (type ==NULL_TREE ) +return ; + oldattr =lookup_attribute (attr,TYPE_ATTRIBUTES (type)); +if (oldattr !=NULL_TREE ) { +gcc_assert (TREE_VALUE (oldattr) == args ||TREE_VALUE (TREE_VALUE (oldattr)) ==TREE_VALUE (args)); +return ; + } + +TYPE_ATTRIBUTES (type) =copy_list (TYPE_ATTRIBUTES (type)); +TYPE_ATTRIBUTES (type) =tree_cons (get_identifier (attr), args,TYPE_ATTRIBUTES (type)); +} + +static inline void add_type_attr (tree type,const char *attr,tree args) +{ +tree main_variant =TYPE_MAIN_VARIANT (type); + +__add_type_attr (TYPE_CANONICAL (type), attr, args); +__add_type_attr (TYPE_CANONICAL (main_variant), attr, args); +__add_type_attr (main_variant, attr, args); + +for (type =TYPE_NEXT_VARIANT (main_variant); type; type =TYPE_NEXT_VARIANT (type)) { +if (!lookup_attribute (attr,TYPE_ATTRIBUTES (type))) +TYPE_ATTRIBUTES (type) =TYPE_ATTRIBUTES (main_variant); + +__add_type_attr (TYPE_CANONICAL (type), attr, args); + } +} +#define PASS_INFO (NAME ,REF ,ID ,POS ) \ struct register_pass_info NAME##_pass_info = { \ .pass = make_##NAME##_pass(), \
scripts/gcc-plugins/randomize_layout_plugin.c +11 -11
@@ -95,6 +95,9 @@ static tree handle_randomize_layout_attr(tree *node, tree name, tree args, int fif (TYPE_P (*node)) { type = *node; + }else if (TREE_CODE (*node) ==FIELD_DECL ) { + *no_add_attrs = false; +return NULL_TREE ; }else {gcc_assert (TREE_CODE (*node) ==TYPE_DECL ); type =TREE_TYPE (*node);
@@ -381,15 +384,14 @@ static int relayout_struct(tree type)TREE_CHAIN (newtree[i]) = newtree[i+1 ];TREE_CHAIN (newtree[num_fields -1 ]) =NULL_TREE ; +add_type_attr (type,"randomize_performed" ,NULL_TREE ); +add_type_attr (type,"designated_init" ,NULL_TREE ); +if (has_flexarray) +add_type_attr (type,"has_flexarray" ,NULL_TREE ); + main_variant =TYPE_MAIN_VARIANT (type); -for (variant = main_variant; variant; variant =TYPE_NEXT_VARIANT (variant)) { +for (variant = main_variant; variant; variant =TYPE_NEXT_VARIANT (variant))TYPE_FIELDS (variant) = newtree[0 ]; -TYPE_ATTRIBUTES (variant) =copy_list (TYPE_ATTRIBUTES (variant)); -TYPE_ATTRIBUTES (variant) =tree_cons (get_identifier ("randomize_performed" ),NULL_TREE ,TYPE_ATTRIBUTES (variant)); -TYPE_ATTRIBUTES (variant) =tree_cons (get_identifier ("designated_init" ),NULL_TREE ,TYPE_ATTRIBUTES (variant)); -if (has_flexarray) -TYPE_ATTRIBUTES (type) =tree_cons (get_identifier ("has_flexarray" ),NULL_TREE ,TYPE_ATTRIBUTES (type)); - }/* * force a re-layout of the main variant
@@ -457,10 +459,8 @@ static void randomize_type(tree type)if (lookup_attribute ("randomize_layout" ,TYPE_ATTRIBUTES (TYPE_MAIN_VARIANT (type))) ||is_pure_ops_struct (type))relayout_struct (type); -for (variant =TYPE_MAIN_VARIANT (type); variant; variant =TYPE_NEXT_VARIANT (variant)) { -TYPE_ATTRIBUTES (type) =copy_list (TYPE_ATTRIBUTES (type)); -TYPE_ATTRIBUTES (type) =tree_cons (get_identifier ("randomize_considered" ),NULL_TREE ,TYPE_ATTRIBUTES (type)); - } +add_type_attr (type,"randomize_considered" ,NULL_TREE ); +#ifdef __DEBUG_PLUGINfprintf (stderr,"Marking randomize_considered on struct %s\n" ,ORIG_TYPE_NAME (type));#ifdef __DEBUG_VERBOSE
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/222 perf ui browser hists: Set actions->thread before calling do_zoom_thread()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 1741189d843a1d5ef38538bc52a3760e2e46cb2e ]
In 7cecb7fe8388d5c3 ("perf hists: Move sort__has_comm into struct perf_hpp_list") it assumes that act->thread is set prior to calling do_zoom_thread().
This doesn't happen when we use ESC or the Left arrow key to Zoom out of a specific thread, making this operation not to work and we get stuck into the thread zoom.
In 6422184b087ff435 ("perf hists browser: Simplify zooming code using pstack_peek()") it says no need to set actions->thread, and at that point that was true, but in 7cecb7fe8388d5c3 a actions->thread == NULL check was added before the zoom out of thread could kick in.
We can zoom out using the alternative 't' thread zoom toggle hotkey to finally set actions->thread before calling do_zoom_thread() and zoom out, but lets also fix the ESC/Zoom out of thread case.
--- tools/perf/ui/browsers/hists.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/ui/browsers/hists.c +1 -1
@@ -3065,10 +3065,10 @@ static int perf_evsel__hists_browse(struct evsel *evsel, int nr_events,/* * No need to set actions->dso here since * it's just to remove the current filter. -* Ditto for thread below. */ do_zoom_dso (browser, actions); }else if (top == &browser->hists->thread_filter) { + actions->thread = thread;do_zoom_thread (browser, actions); }else if (top == &browser->hists->socket_filter) {do_zoom_socket (browser, actions);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/222 perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 17e548405a81665fd14cee960db7d093d1396400 ]
The script allows the user to enter patterns to find symbols.
The pattern matching characters are converted for use in SQL.
For PostgreSQL the conversion involves using the Python maketrans() method which is slightly different in Python 3 compared with Python 2.
Fix to work in Python 3.
--- tools/perf/scripts/python/exported-sql-viewer.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/scripts/python/exported-sql-viewer.py +4 -1
@@ -667,7 +667,10 @@ class CallGraphModelBase(TreeModel): s = value.replace("%", "\%") s = s.replace("_", "\_") # Translate * and ? into SQL LIKE pattern characters % and _ - trans = string.maketrans("*?", "%_") + if sys.version_info[0] == 3: + trans = str.maketrans("*?", "%_") + else: + trans = string.maketrans("*?", "%_") match = " LIKE '" + str(s).translate(trans) + "'" else: match = " GLOB '" + str(value) + "'"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/222 rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 5de775df3362090a6e90046d1f2d83fe62489aa0 ]
The "ret" variable isn't initialized if we don't enter the loop. For example, if "channel->state" is not SMD_CHANNEL_OPENED.
--- drivers/rpmsg/qcom_smd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rpmsg/qcom_smd.c +1 -1
@@ -746,7 +746,7 @@ static int __qcom_smd_send(struct qcom_smd_channel *channel, const void *data,__le32 hdr[5 ] = {cpu_to_le32 (len), };int tlen =sizeof (hdr) + len;unsigned long flags; -int ret; +int ret =0 ;/* Word aligned channels only accept word size aligned data */ if (channel->info_word && len %4 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/222 mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit b70b84556eeca5262d290e8619fe0af5b7664a52 ]
exynos_lpass_disable() is called twice in the remove function. Remove one of these calls.
--- drivers/mfd/exynos-lpass.c | 1 - 1 file changed, 1 deletion(-)
drivers/mfd/exynos-lpass.c +0 -1
@@ -144,7 +144,6 @@ static int exynos_lpass_remove(struct platform_device *pdev) {struct exynos_lpass *lpass =platform_get_drvdata (pdev); -exynos_lpass_disable (lpass);pm_runtime_disable (&pdev->dev);if (!pm_runtime_status_suspended (&pdev->dev))exynos_lpass_disable (lpass);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/222 mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Gladkov <[email protected]>
[ Upstream commit 59d60c16ed41475f3b5f7b605e75fbf8e3628720 ]
The name used in the macro does not exist.
drivers/mfd/stmpe-spi.c:132:26: error: use of undeclared identifier 'stmpe_id'
132 | MODULE_DEVICE_TABLE(spi, stmpe_id);
--- drivers/mfd/stmpe-spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/stmpe-spi.c +1 -1
@@ -129,7 +129,7 @@ static const struct spi_device_id stmpe_spi_id[] = { { "stmpe2403", STMPE2403 }, { } }; -MODULE_DEVICE_TABLE(spi, stmpe_id); +MODULE_DEVICE_TABLE(spi, stmpe_spi_id); static struct spi_driver stmpe_spi_driver = { .driver = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/222 perf tests switch-tracking: Fix timestamp comparison
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 628e124404b3db5e10e17228e680a2999018ab33 ]
The test might fail on the Arm64 platform with the error:
# perf test -vvv "Track with sched_switch" Missing sched_switch events #
The issue is caused by incorrect handling of timestamp comparisons. The comparison result, a signed 64-bit value, was being directly cast to an int, leading to incorrect sorting for sched events.
The case does not fail everytime, usually I can trigger the failure after run 20 ~ 30 times:
# while true; do perf test "Track with sched_switch"; done 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : FAILED! 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : FAILED! 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok
I used cross compiler to build Perf tool on my host machine and tested on Debian / Juno board. Generally, I think this issue is not very specific to GCC versions. As both internal CI and my local env can reproduce the issue.
My Host Build compiler:
# aarch64-linux-gnu-gcc --version aarch64-linux-gnu-gcc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0
Juno Board:
# lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 12 (bookworm) Release: 12 Codename: bookworm
Fix this by explicitly returning 0, 1, or -1 based on whether the result is zero, positive, or negative.
--- tools/perf/tests/switch-tracking.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/tests/switch-tracking.c +1 -1
@@ -254,7 +254,7 @@ static int compar(const void *a, const void *b)const struct event_node *nodeb = b;s64 cmp = nodea->event_time - nodeb->event_time; -return cmp; +return cmp <0 ?-1 : (cmp >0 ?1 :0 ); } static int process_events(struct evlist *evlist,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/222 perf record: Fix incorrect --user-regs comments
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <[email protected]>
[ Upstream commit a4a859eb6704a8aa46aa1cec5396c8d41383a26b ]
The comment of "--user-regs" option is not correct, fix it.
"on interrupt," -> "in user space,"
--- tools/perf/builtin-record.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-record.c +1 -1
@@ -2215,7 +2215,7 @@ static struct option __record_options[] = { "sample selected machine registers on interrupt," " use '-I?' to list register names", parse_intr_regs),OPT_CALLBACK_OPTARG (0 ,"user-regs" , &record.opts.sample_user_regs,NULL ,"any register" , -"sample selected machine registers on interrupt," +"sample selected machine registers in user space," " use '--user-regs=?' to list register names" , parse_user_regs),OPT_BOOLEAN (0 ,"running-time" , &record.opts.running_time, "Record running/enabled time of read (:S) events"),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/222 rtc: sh: assign correct interrupts with DT
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 8f2efdbc303fe7baa83843d3290dd6ea5ba3276c ]
The DT bindings for this driver define the interrupts in the order as they are numbered in the interrupt controller. The old platform_data, however, listed them in a different order. So, for DT based platforms, they are mixed up. Assign them specifically for DT, so we can keep the bindings stable. After the fix, 'rtctest' passes again on the Renesas Genmai board (RZ-A1 / R7S72100).
--- drivers/rtc/rtc-sh.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/rtc/rtc-sh.c +9 -3
@@ -485,9 +485,15 @@ static int __init sh_rtc_probe(struct platform_device *pdev)return -ENOENT ; } - rtc->periodic_irq = ret; - rtc->carry_irq =platform_get_irq (pdev,1 ); - rtc->alarm_irq =platform_get_irq (pdev,2 ); +if (!pdev->dev.of_node) { + rtc->periodic_irq = ret; + rtc->carry_irq =platform_get_irq (pdev,1 ); + rtc->alarm_irq =platform_get_irq (pdev,2 ); + }else { + rtc->alarm_irq = ret; + rtc->periodic_irq =platform_get_irq (pdev,1 ); + rtc->carry_irq =platform_get_irq (pdev,2 ); + } res =platform_get_resource (pdev,IORESOURCE_IO ,0 );if (!res)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/222 rtc: Fix offset calculation for .start_secs < 0
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Mergnat <[email protected]>
[ Upstream commit fe9f5f96cfe8b82d0f24cbfa93718925560f4f8d ]
The comparison
rtc->start_secs > rtc->range_max
has a signed left-hand side and an unsigned right-hand side. So the comparison might become true for negative start_secs which is interpreted as a (possibly very large) positive value.
As a negative value can never be bigger than an unsigned value the correct representation of the (mathematical) comparison
rtc->start_secs > rtc->range_max
in C is:
rtc->start_secs >= 0 && rtc->start_secs > rtc->range_max
Use that to fix the offset calculation currently used in the rtc-mt6397 driver.
--- drivers/rtc/class.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/class.c +1 -1
@@ -270,7 +270,7 @@ static void rtc_device_get_offset(struct rtc_device *rtc)* * Otherwise the offset seconds should be 0. */ -if (rtc->start_secs > rtc->range_max || +if ((rtc->start_secs >=0 && rtc->start_secs > rtc->range_max) || rtc->start_secs + range_secs -1 < rtc->range_min) rtc->offset_secs = rtc->start_secs - rtc->range_min;else if (rtc->start_secs > rtc->range_min)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/222 usb: renesas_usbhs: Reorder clock handling and power management in probe
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit ffb34a60ce86656ba12d46e91f1ccc71dd221251 ]
Reorder the initialization sequence in usbhs_probe() to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks.
Currently, in the probe path, registers are accessed before enabling the clocks, leading to a synchronous external abort on the RZ/V2H SoC. The problematic call flow is as follows:
usbhs_probe()
usbhs_sys_clock_ctrl()
usbhs_bset()
usbhs_write()
iowrite16() <-- Register access before enabling clocks
Since iowrite16() is performed without ensuring the required clocks are enabled, this can lead to access errors. To fix this, enable PM runtime early in the probe function and ensure clocks are acquired before register access, preventing crashes like the following on RZ/V2H:
[13.272640] Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP [13.280814] Modules linked in: cec renesas_usbhs(+) drm_kms_helper fuse drm backlight ipv6 [13.289088] CPU: 1 UID: 0 PID: 195 Comm: (udev-worker) Not tainted 6.14.0-rc7+ #98 [13.296640] Hardware name: Renesas RZ/V2H EVK Board based on r9a09g057h44 (DT) [13.303834] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [13.310770] pc : usbhs_bset+0x14/0x4c [renesas_usbhs] [13.315831] lr : usbhs_probe+0x2e4/0x5ac [renesas_usbhs] [13.321138] sp : ffff8000827e3850 [13.324438] x29: ffff8000827e3860 x28: 0000000000000000 x27: ffff8000827e3ca0 [13.331554] x26: ffff8000827e3ba0 x25: ffff800081729668 x24: 0000000000000025 [13.338670] x23: ffff0000c0f08000 x22: 0000000000000000 x21: ffff0000c0f08010 [13.345783] x20: 0000000000000000 x19: ffff0000c3b52080 x18: 00000000ffffffff [13.352895] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000827e36ce [13.360009] x14: 00000000000003d7 x13: 00000000000003d7 x12: 0000000000000000 [13.367122] x11: 0000000000000000 x10: 0000000000000aa0 x9 : ffff8000827e3750 [13.374235] x8 : ffff0000c1850b00 x7 : 0000000003826060 x6 : 000000000000001c [13.381347] x5 : 000000030d5fcc00 x4 : ffff8000825c0000 x3 : 0000000000000000 [13.388459] x2 : 0000000000000400 x1 : 0000000000000000 x0 : ffff0000c3b52080 [13.395574] Call trace: [13.398013] usbhs_bset+0x14/0x4c [renesas_usbhs] (P) [13.403076] platform_probe+0x68/0xdc [13.406738] really_probe+0xbc/0x2c0 [13.410306] __driver_probe_device+0x78/0x120 [13.414653] driver_probe_device+0x3c/0x154 [13.418825] __driver_attach+0x90/0x1a0 [13.422647] bus_for_each_dev+0x7c/0xe0 [13.426470] driver_attach+0x24/0x30 [13.430032] bus_add_driver+0xe4/0x208 [13.433766] driver_register+0x68/0x130 [13.437587] __platform_driver_register+0x24/0x30 [13.442273] renesas_usbhs_driver_init+0x20/0x1000 [renesas_usbhs] [13.448450] do_one_initcall+0x60/0x1d4 [13.452276] do_init_module+0x54/0x1f8 [13.456014] load_module+0x1754/0x1c98 [13.459750] init_module_from_file+0x88/0xcc [13.464004] __arm64_sys_finit_module+0x1c4/0x328 [13.468689] invoke_syscall+0x48/0x104 [13.472426] el0_svc_common.constprop.0+0xc0/0xe0 [13.477113] do_el0_svc+0x1c/0x28 [13.480415] el0_svc+0x30/0xcc [13.483460] el0t_64_sync_handler+0x10c/0x138 [13.487800] el0t_64_sync+0x198/0x19c [13.491453] Code: 2a0103e1 12003c42 12003c63 8b010084 (79400084) [13.497522] ---[ end trace 0000000000000000 ]---
--- drivers/usb/renesas_usbhs/common.c | 50 +++++++++++++++++++++++------- 1 file changed, 38 insertions(+), 12 deletions(-)
drivers/usb/renesas_usbhs/common.c +38 -12
@@ -680,10 +680,29 @@ static int usbhs_probe(struct platform_device *pdev)INIT_DELAYED_WORK (&priv->notify_hotplug_work, usbhsc_notify_hotplug);spin_lock_init (usbhs_priv_to_lock (priv)); +/* +* Acquire clocks and enable power management (PM) early in the +* probe process, as the driver accesses registers during +* initialization. Ensure the device is active before proceeding. +*/ +pm_runtime_enable (dev); + + ret =usbhsc_clk_get (dev, priv); +if (ret) + goto probe_pm_disable; + + ret =pm_runtime_resume_and_get (dev); +if (ret) + goto probe_clk_put; + + ret =usbhsc_clk_prepare_enable (priv); +if (ret) + goto probe_pm_put; +/* call pipe and module init */ ret =usbhs_pipe_probe (priv);if (ret <0 ) -return ret; + goto probe_clk_dis_unprepare; ret =usbhs_fifo_probe (priv);if (ret <0 )
@@ -700,10 +719,6 @@ static int usbhs_probe(struct platform_device *pdev)if (ret) goto probe_fail_rst; - ret =usbhsc_clk_get (dev, priv); -if (ret) - goto probe_fail_clks; -/* * deviece reset here because * USB device might be used in boot loader.
@@ -719,7 +734,7 @@ static int usbhs_probe(struct platform_device *pdev)dev_warn (dev,"USB function not selected (GPIO %d)\n" , priv->dparam.enable_gpio); ret = -ENOTSUPP ; - goto probe_end_mod_exit; + goto probe_assert_rest; } }
@@ -733,14 +748,19 @@ static int usbhs_probe(struct platform_device *pdev) ret =usbhs_platform_call (priv, hardware_init, pdev);if (ret <0 ) {dev_err (dev,"platform init failed.\n" ); - goto probe_end_mod_exit; + goto probe_assert_rest; }/* reset phy for connection */ usbhs_platform_call (priv, phy_reset, pdev); -/* power control */ -pm_runtime_enable (dev); +/* +* Disable the clocks that were enabled earlier in the probe path, +* and let the driver handle the clocks beyond this point. +*/ +usbhsc_clk_disable_unprepare (priv); +pm_runtime_put (dev); +if (!usbhs_get_dparam (priv, runtime_pwctrl)) {usbhsc_power_ctrl (priv,1 );usbhs_mod_autonomy_mode (priv);
@@ -757,9 +777,7 @@ static int usbhs_probe(struct platform_device *pdev)return ret; -probe_end_mod_exit: -usbhsc_clk_put (priv); -probe_fail_clks: +probe_assert_rest:reset_control_assert (priv->rsts); probe_fail_rst:usbhs_mod_remove (priv);
@@ -767,6 +785,14 @@ static int usbhs_probe(struct platform_device *pdev)usbhs_fifo_remove (priv); probe_end_pipe_exit:usbhs_pipe_remove (priv); +probe_clk_dis_unprepare: +usbhsc_clk_disable_unprepare (priv); +probe_pm_put: +pm_runtime_put (dev); +probe_clk_put: +usbhsc_clk_put (priv); +probe_pm_disable: +pm_runtime_disable (dev);dev_info (dev,"probe failed (%d)\n" , ret);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/222 serial: Fix potential null-ptr-deref in mlb_usio_probe()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit 86bcae88c9209e334b2f8c252f4cc66beb261886 ]
devm_ioremap() can return NULL on error. Currently, mlb_usio_probe() does not check for this case, which could result in a NULL pointer dereference.
Add NULL check after devm_ioremap() to prevent this issue.
--- drivers/tty/serial/milbeaut_usio.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/tty/serial/milbeaut_usio.c +4 -1
@@ -527,7 +527,10 @@ static int mlb_usio_probe(struct platform_device *pdev) } port->membase =devm_ioremap (&pdev->dev, res->start,resource_size (res)); - +if (!port->membase) { + ret = -ENOMEM ; + goto failed; + } ret =platform_get_irq_byname (pdev,"rx" ); mlb_usio_irq[index][RX ] = ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/222 vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Pitre <[email protected]>
[ Upstream commit c4c7ead7b86c1e7f11c64915b7e5bb6d2e242691 ]
They are listed amon those cmd values that "treat 'arg' as an integer" which is wrong. They should instead fall into the default case. Probably nobody ever relied on that code since 2009 but still.
--- drivers/tty/vt/vt_ioctl.c | 2 -- 1 file changed, 2 deletions(-)
drivers/tty/vt/vt_ioctl.c +0 -2
@@ -1106,8 +1106,6 @@ long vt_compat_ioctl(struct tty_struct *tty,case VT_WAITACTIVE :case VT_RELDISP :case VT_DISALLOCATE : -case VT_RESIZE : -case VT_RESIZEX :return vt_ioctl (tty, cmd, arg);/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/222 net/mlx4_en: Prevent potential integer overflow calculating Hz
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 54d34165b4f786d7fea8412a18fb4a54c1eab623 ]
The "freq" variable is in terms of MHz and "max_val_cycles" is in terms of Hz. The fact that "max_val_cycles" is a u64 suggests that support for high frequency is intended but the "freq_khz * 1000" would overflow the u32 type if we went above 4GHz. Use unsigned long long type for the mutliplication to prevent that.
--- drivers/net/ethernet/mellanox/mlx4/en_clock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_clock.c +1 -1
@@ -251,7 +251,7 @@ static const struct ptp_clock_info mlx4_en_ptp_clock_info = {static u32 freq_to_shift (u16 freq) {u32 freq_khz = freq *1000 ; -u64 max_val_cycles = freq_khz *1000 *MLX4_EN_WRAP_AROUND_SEC ; +u64 max_val_cycles = freq_khz *1000ULL *MLX4_EN_WRAP_AROUND_SEC ;u64 max_val_cycles_rounded =1ULL <<fls64 (max_val_cycles -1 );/* calculate max possible multiplier in order to fit in 64bit */ u64 max_mul =div64_u64 (ULLONG_MAX , max_val_cycles_rounded);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/222 Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 03dba9cea72f977e873e4e60e220fa596959dd8f ]
Depending on the security set the response to L2CAP_LE_CONN_REQ shall be just L2CAP_CR_LE_ENCRYPTION if only encryption when BT_SECURITY_MEDIUM is selected since that means security mode 2 which doesn't require authentication which is something that is covered in the qualification test L2CAP/LE/CFC/BV-25-C.
--- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bluetooth/l2cap_core.c +2 -1
@@ -5578,7 +5578,8 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,if (!smp_sufficient_security (conn->hcon, pchan->sec_level,SMP_ALLOW_STK )) { - result =L2CAP_CR_LE_AUTHENTICATION ; + result = pchan->sec_level ==BT_SECURITY_MEDIUM ? +L2CAP_CR_LE_ENCRYPTION :L2CAP_CR_LE_AUTHENTICATION ; chan =NULL ; goto response_unlock; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/222 ice: create new Tx scheduler nodes for new queues only
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kubiak <[email protected]>
[ Upstream commit 6fa2942578472c9cab13a8fc1dae0d830193e0a1 ]
The current implementation of the Tx scheduler tree attempts to create nodes for all Tx queues, ignoring the fact that some queues may already exist in the tree. For example, if the VSI already has 128 Tx queues and the user requests for 16 new queues, the Tx scheduler will compute the tree for 272 queues (128 existing queues + 144 new queues), instead of 144 queues (128 existing queues and 16 new queues).
Fix that by modifying the node count calculation algorithm to skip the queues that already exist in the tree.
--- drivers/net/ethernet/intel/ice/ice_sched.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/net/ethernet/intel/ice/ice_sched.c +6 -5
@@ -1188,16 +1188,16 @@ ice_sched_get_vsi_node(struct ice_hw *hw, struct ice_sched_node *tc_node,/** * ice_sched_calc_vsi_child_nodes - calculate number of VSI child nodes * @hw: pointer to the HW struct -* @num_qs: number of queues +* @num_new_qs: number of new queues that will be added to the tree * @num_nodes: num nodes array * * This function calculates the number of VSI child nodes based on the * number of queues. */ static void -ice_sched_calc_vsi_child_nodes (struct ice_hw *hw,u16 num_qs,u16 *num_nodes) +ice_sched_calc_vsi_child_nodes (struct ice_hw *hw,u16 num_new_qs,u16 *num_nodes) { -u16 num = num_qs; +u16 num = num_new_qs;u8 i, qgl, vsil; qgl =ice_sched_get_qgrp_layer (hw);
@@ -1438,8 +1438,9 @@ ice_sched_update_vsi_child_nodes(struct ice_port_info *pi, u16 vsi_handle,if (status)return status; -if (new_numqs) -ice_sched_calc_vsi_child_nodes (hw, new_numqs, new_num_nodes); +ice_sched_calc_vsi_child_nodes (hw, new_numqs - prev_numqs, + new_num_nodes); +/* Keep the max number of queue configuration all the time. Update the * tree only if number of queues > previous number of queues. This may * leave some extra nodes in the tree if number of queues < previous
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/222 PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit d46c4c839c20a599a0eb8d73708ce401f9c7d06d ]
Commit 03f1444016b7 ("PM: sleep: Fix handling devices with direct_complete set on errors") caused power.is_suspended to be set for devices with power.direct_complete set, but it forgot to ensure the clearing of that flag for them in device_resume(), so power.is_suspended is still set for them during the next system suspend-resume cycle.
If that cycle is aborted in dpm_suspend(), the subsequent invocation of dpm_resume() will trigger a device_resume() call for every device and because power.is_suspended is set for the devices in question, they will not be skipped by device_resume() as expected which causes scary error messages to be logged (as appropriate).
To address this issue, move the clearing of power.is_suspended in device_resume() immediately after the power.is_suspended check so it will be always cleared for all devices processed by that function.
--- drivers/base/power/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/base/power/main.c +2 -1
@@ -971,6 +971,8 @@ static int device_resume(struct device *dev, pm_message_t state, bool async)if (!dev->power.is_suspended) goto Complete; + dev->power.is_suspended = false; +if (dev->power.direct_complete) {/* Match the pm_runtime_disable() in __device_suspend(). */ pm_runtime_enable (dev);
@@ -1026,7 +1028,6 @@ static int device_resume(struct device *dev, pm_message_t state, bool async) End: error =dpm_run_callback (callback, dev, state, info); - dev->power.is_suspended = false;device_unlock (dev);dpm_watchdog_clear (&wd);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/222 do_change_type(): refuse to operate on unmounted/not ours mounts
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 12f147ddd6de7382dad54812e65f3f08d05809fc ]
Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount(2).
--- fs/namespace.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/namespace.c +4 -0
@@ -2246,6 +2246,10 @@ static int do_change_type(struct path *path, int ms_flags)return -EINVAL ;namespace_lock (); +if (!check_mnt (mnt)) { + err = -EINVAL ; + goto out_unlock; + }if (type ==MS_SHARED ) { err =invent_group_ids (mnt, recurse);if (err)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/222 pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 0f5757667ec0aaf2456c3b76fcf0c6c3ea3591fe ]
The error checking for of_count_phandle_with_args() does not handle negative error codes correctly. The problem is that "index" is a u32 so in the condition "if (index >= num_domains)" negative error codes stored in "num_domains" are type promoted to very high positive values and "index" is always going to be valid.
Test for negative error codes first and then test if "index" is valid.
--- drivers/base/power/domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/domain.c +1 -1
@@ -2509,7 +2509,7 @@ struct device *genpd_dev_pm_attach_by_id(struct device *dev,/* Verify that the index is within a valid range. */ num_domains =of_count_phandle_with_args (dev->of_node,"power-domains" ,"#power-domain-cells" ); -if (index >= num_domains) +if (num_domains <0 || index >= num_domains)return NULL ;/* Allocate and register device on the genpd bus. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/222 Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhang songyi <[email protected]>
[ Upstream commit 9dedc915937c33302df7fcab01c45e7936d6195a ]
Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space.
Stable-dep-of: ca39500f6af9 ("Input: synaptics-rmi - fix crash with unsupported versions of F34")
--- drivers/input/rmi4/rmi_f34.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/input/rmi4/rmi_f34.c +8 -8
@@ -321,13 +321,13 @@ static ssize_t rmi_driver_bootloader_id_show(struct device *dev, f34 =dev_get_drvdata (&fn->dev);if (f34->bl_version ==5 ) -return scnprintf (buf,PAGE_SIZE ,"%c%c\n" , - f34->bootloader_id[0 ], - f34->bootloader_id[1 ]); +return sysfs_emit (buf,"%c%c\n" , + f34->bootloader_id[0 ], + f34->bootloader_id[1 ]);else -return scnprintf (buf,PAGE_SIZE ,"V%d.%d\n" , - f34->bootloader_id[1 ], - f34->bootloader_id[0 ]); +return sysfs_emit (buf,"V%d.%d\n" , + f34->bootloader_id[1 ], + f34->bootloader_id[0 ]); }return 0 ;
@@ -346,7 +346,7 @@ static ssize_t rmi_driver_configuration_id_show(struct device *dev,if (fn) { f34 =dev_get_drvdata (&fn->dev); -return scnprintf (buf,PAGE_SIZE ,"%s\n" , f34->configuration_id); +return sysfs_emit (buf,"%s\n" , f34->configuration_id); }return 0 ;
@@ -499,7 +499,7 @@ static ssize_t rmi_driver_update_fw_status_show(struct device *dev,if (data->f34_container) update_status =rmi_f34_status (data->f34_container); -return scnprintf (buf,PAGE_SIZE ,"%d\n" , update_status); +return sysfs_emit (buf,"%d\n" , update_status); } static DEVICE_ATTR(update_fw_status, 0444,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/222 Input: synaptics-rmi - fix crash with unsupported versions of F34
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 ]
Sysfs interface for updating firmware for RMI devices is available even when F34 probe fails. The code checks for presence of F34 "container" pointer and then tries to use the function data attached to the sub-device. F34 assigns the function data early, before it knows if probe will succeed, leaving behind a stale pointer.
Fix this by expanding checks to not only test for presence of F34 "container" but also check if there is driver data assigned to the sub-device, and call dev_set_drvdata() only after we are certain that probe is successful.
This is not a complete fix, since F34 will be freed during firmware update, so there is still a race when fetching and accessing this pointer. This race will be addressed in follow-up changes.
--- drivers/input/rmi4/rmi_f34.c | 135 ++++++++++++++++++++--------------- 1 file changed, 76 insertions(+), 59 deletions(-)
drivers/input/rmi4/rmi_f34.c +76 -59
@@ -4,6 +4,7 @@* Copyright (C) 2016 Zodiac Inflight Innovations */ +#include "linux/device.h" #include <linux/kernel.h> #include <linux/rmi.h> #include <linux/firmware.h>
@@ -298,39 +299,30 @@ static int rmi_f34_update_firmware(struct f34_data *f34,return ret; } -static int rmi_f34_status (struct rmi_function *fn) -{ -struct f34_data *f34 =dev_get_drvdata (&fn->dev); - -/* -* The status is the percentage complete, or once complete, -* zero for success or a negative return code. -*/ -return f34->update_status; -} -static ssize_t rmi_driver_bootloader_id_show (struct device *dev,struct device_attribute *dattr,char *buf) {struct rmi_driver_data *data =dev_get_drvdata (dev); -struct rmi_function *fn = data->f34_container; +struct rmi_function *fn;struct f34_data *f34; -if (fn) { - f34 =dev_get_drvdata (&fn->dev); - -if (f34->bl_version ==5 ) -return sysfs_emit (buf,"%c%c\n" , - f34->bootloader_id[0 ], - f34->bootloader_id[1 ]); -else -return sysfs_emit (buf,"V%d.%d\n" , - f34->bootloader_id[1 ], - f34->bootloader_id[0 ]); - } + fn = data->f34_container; +if (!fn) +return -ENODEV ; -return 0 ; + f34 =dev_get_drvdata (&fn->dev); +if (!f34) +return -ENODEV ; + +if (f34->bl_version ==5 ) +return sysfs_emit (buf,"%c%c\n" , + f34->bootloader_id[0 ], + f34->bootloader_id[1 ]); +else +return sysfs_emit (buf,"V%d.%d\n" , + f34->bootloader_id[1 ], + f34->bootloader_id[0 ]); } static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL);
@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_id_show(struct device *dev,struct rmi_function *fn = data->f34_container;struct f34_data *f34; -if (fn) { - f34 =dev_get_drvdata (&fn->dev); + fn = data->f34_container; +if (!fn) +return -ENODEV ; -return sysfs_emit (buf,"%s\n" , f34->configuration_id); - } + f34 =dev_get_drvdata (&fn->dev); +if (!f34) +return -ENODEV ; -return 0 ; + +return sysfs_emit (buf,"%s\n" , f34->configuration_id); } static DEVICE_ATTR(configuration_id, 0444,
@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rmi_driver_data *data,if (!data->f34_container) {dev_warn (dev,"%s: No F34 present!\n" , __func__); -return -EINVAL ; +return -ENODEV ; } f34 =dev_get_drvdata (&data->f34_container->dev); +if (!f34) { +dev_warn (dev,"%s: No valid F34 present!\n" , __func__); +return -ENODEV ; + }if (f34->bl_version ==7 ) {if (data->pdt_props &HAS_BSR ) {
@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_status_show(struct device *dev, char *buf) {struct rmi_driver_data *data =dev_get_drvdata (dev); -int update_status =0 ; +struct f34_data *f34; +int update_status = -ENODEV ; -if (data->f34_container) - update_status =rmi_f34_status (data->f34_container); +/* +* The status is the percentage complete, or once complete, +* zero for success or a negative return code. +*/ +if (data->f34_container) { + f34 =dev_get_drvdata (&data->f34_container->dev); +if (f34) + update_status = f34->update_status; + }return sysfs_emit (buf,"%d\n" , update_status); }
@@ -517,33 +524,21 @@ static const struct attribute_group rmi_firmware_attr_group = { .attrs = rmi_firmware_attrs, }; -static int rmi_f34_probe (struct rmi_function *fn) +static int rmi_f34v5_probe (struct f34_data *f34) { -struct f34_data *f34; -unsigned char f34_queries[9 ]; +struct rmi_function *fn = f34->fn; +u8 f34_queries[9 ];bool has_config_id; -u8 version = fn->fd.function_version; -int ret; - - f34 =devm_kzalloc (&fn->dev,sizeof (struct f34_data ),GFP_KERNEL ); -if (!f34) -return -ENOMEM ; - - f34->fn = fn; -dev_set_drvdata (&fn->dev, f34); - -/* v5 code only supported version 0, try V7 probe */ -if (version >0 ) -return rmi_f34v7_probe (f34); +int error; f34->bl_version =5 ; - ret =rmi_read_block (fn->rmi_dev, fn->fd.query_base_addr, - f34_queries,sizeof (f34_queries)); -if (ret) { + error =rmi_read_block (fn->rmi_dev, fn->fd.query_base_addr, + f34_queries,sizeof (f34_queries)); +if (error) {dev_err (&fn->dev,"%s: Failed to query properties\n" , __func__); -return ret; +return error; } snprintf(f34->bootloader_id, sizeof(f34->bootloader_id),
@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_function *fn) f34->v5.config_blocks);if (has_config_id) { - ret =rmi_read_block (fn->rmi_dev, fn->fd.control_base_addr, - f34_queries,sizeof (f34_queries)); -if (ret) { + error =rmi_read_block (fn->rmi_dev, fn->fd.control_base_addr, + f34_queries,sizeof (f34_queries)); +if (error) {dev_err (&fn->dev,"Failed to read F34 config ID\n" ); -return ret; +return error; } snprintf(f34->configuration_id, sizeof(f34->configuration_id),
@@ -582,12 +577,34 @@ static int rmi_f34_probe(struct rmi_function *fn) f34_queries[2], f34_queries[3]);rmi_dbg (RMI_DEBUG_FN , &fn->dev,"Configuration ID: %s\n" , - f34->configuration_id); + f34->configuration_id); }return 0 ; } +static int rmi_f34_probe (struct rmi_function *fn) +{ +struct f34_data *f34; +u8 version = fn->fd.function_version; +int error; + + f34 =devm_kzalloc (&fn->dev,sizeof (struct f34_data ),GFP_KERNEL ); +if (!f34) +return -ENOMEM ; + + f34->fn = fn; + +/* v5 code only supported version 0 */ + error = version ==0 ?rmi_f34v5_probe (f34) :rmi_f34v7_probe (f34); +if (error) +return error; + +dev_set_drvdata (&fn->dev, f34); + +return 0 ; +} +int rmi_f34_create_sysfs (struct rmi_device *rmi_dev) {return sysfs_create_group (&rmi_dev->dev.kobj, &rmi_firmware_attr_group);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/222 NFSD: Fix ia_size underflow
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit e6faac3f58c7c4176b66f63def17a34232a17b0e ]
iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle.
Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr().
[Larry: backport to 5.4.y. Minor conflict resolved due to missing commit 2f221d6f7b88
attr: handle idmapped mounts]
--- fs/nfsd/vfs.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/nfsd/vfs.c +4 -0
@@ -448,6 +448,10 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, .ia_size = iap->ia_size, }; + host_err = -EFBIG ; +if (iap->ia_size <0 ) + goto out_unlock; + host_err =notify_change (dentry, &size_attr,NULL );if (host_err) goto out_unlock;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/222 NFSD: Fix NFSv3 SETATTR/CREATEs handling of large file sizes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit a648fdeb7c0e17177a2280344d015dba3fbe3314 ]
iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger than s64_max without corrupting the value.
Silently capping the value results in storing a different value than the client passed in which is unexpected behavior, so remove the min_t() check in decode_sattr3().
Note that RFC 1813 permits only the WRITE procedure to return NFS3ERR_FBIG. We believe that NFSv3 reference implementations also return NFS3ERR_FBIG when ia_size is too large.
[Larry: backport to 5.4.y. Minor conflict resolved due to missing commit 9cde9360d18d
NFSD: Update the SETATTR3args decoder to use struct xdr_stream]
--- fs/nfsd/nfs3xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs3xdr.c +1 -1
@@ -122,7 +122,7 @@ decode_sattr3(__be32 *p, struct iattr *iap, struct user_namespace *userns) iap->ia_valid |=ATTR_SIZE ; p =xdr_decode_hyper (p, &newsize); - iap->ia_size =min_t (u64, newsize,NFS_OFFSET_MAX ); + iap->ia_size = newsize; }if ((tmp =ntohl (*p++)) ==1 ) {/* set to server time */ iap->ia_valid |=ATTR_ATIME ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/222 scsi: iscsi: Fix incorrect error path labels for flashnode operations
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 9b17621366d210ffee83262a8754086ebbde5e55 ]
Correct the error handling goto labels used when host lookup fails in various flashnode-related event handlers:
- iscsi_new_flashnode()
- iscsi_del_flashnode()
- iscsi_login_flashnode()
- iscsi_logout_flashnode()
- iscsi_logout_flashnode_sid()
scsi_host_put() is not required when shost is NULL, so jumping to the correct label avoids unnecessary operations. These functions previously jumped to the wrong goto label (put_host), which did not match the intended cleanup logic.
Use the correct exit labels (exit_new_fnode, exit_del_fnode, etc.) to ensure proper error handling. Also remove the unused put_host label under iscsi_new_flashnode() as it is no longer needed.
No functional changes beyond accurate error path correction.
--- drivers/scsi/scsi_transport_iscsi.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/scsi/scsi_transport_iscsi.c +5 -6
@@ -3235,7 +3235,7 @@ static int iscsi_new_flashnode(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.new_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_new_fnode; } index = transport->new_flashnode (shost, data, len);
@@ -3245,7 +3245,6 @@ static int iscsi_new_flashnode(struct iscsi_transport *transport,else err = -EIO ; -put_host:scsi_host_put (shost); exit_new_fnode:
@@ -3270,7 +3269,7 @@ static int iscsi_del_flashnode(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.del_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_del_fnode; } idx = ev->u.del_flashnode.flashnode_idx;
@@ -3312,7 +3311,7 @@ static int iscsi_login_flashnode(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.login_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_login_fnode; } idx = ev->u.login_flashnode.flashnode_idx;
@@ -3364,7 +3363,7 @@ static int iscsi_logout_flashnode(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.logout_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_logout_fnode; } idx = ev->u.logout_flashnode.flashnode_idx;
@@ -3414,7 +3413,7 @@ static int iscsi_logout_flashnode_sid(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.logout_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_logout_sid; } session =iscsi_session_lookup (ev->u.logout_flashnode_sid.sid);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/222 net_sched: sch_sfq: fix a potential crash on gso_skb handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 82ffbe7776d0ac084031f114167712269bf3d832 ]
SFQ has an assumption of always being able to queue at least one packet.
However, after the blamed commit, sch->q.len can be inflated by packets in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed by an immediate drop.
Fix sfq_drop() to properly clear q->tail in this situation.
Tested:
ip netns add lb
ip link add dev to-lb type veth peer name in-lb netns lb
ethtool -K to-lb tso off # force qdisc to requeue gso_skb
ip netns exec lb ethtool -K in-lb gro on # enable NAPI ip link set dev to-lb up
ip -netns lb link set dev in-lb up
ip addr add dev to-lb 192.168.20.1/24
ip -netns lb addr add dev in-lb 192.168.20.2/24 tc qdisc replace dev to-lb root sfq limit 100
ip netns exec lb netserver
netperf -H 192.168.20.2 -l 100 &
netperf -H 192.168.20.2 -l 100 &
netperf -H 192.168.20.2 -l 100 &
netperf -H 192.168.20.2 -l 100 &
--- net/sched/sch_sfq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/sched/sch_sfq.c +4 -1
@@ -317,7 +317,10 @@ static unsigned int sfq_drop(struct Qdisc *sch, struct sk_buff **to_free)/* It is difficult to believe, but ALL THE SLOTS HAVE LENGTH 1. */ x = q->tail->next; slot = &q->slots[x]; - q->tail->next = slot->next; +if (slot->next == x) + q->tail =NULL ;/* no more active slots */ +else + q->tail->next = slot->next; q->ht[slot->hash] =SFQ_EMPTY_SLOT ; goto drop; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/222 i40e: return false from i40e_reset_vf if reset is in progress
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Malz <[email protected]>
[ Upstream commit a2c90d63b71223d69a813333c1abf4fdacddbbe5 ]
The function i40e_vc_reset_vf attempts, up to 20 times, to handle a VF reset request, using the return value of i40e_reset_vf as an indicator of whether the reset was successfully triggered. Currently, i40e_reset_vf always returns true, which causes new reset requests to be ignored if a different VF reset is already in progress.
This patch updates the return value of i40e_reset_vf to reflect when another VF reset is in progress, allowing the caller to properly use the retry mechanism.
--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +3 -3
@@ -1456,8 +1456,8 @@ static void i40e_cleanup_reset_vf(struct i40e_vf *vf)* @vf: pointer to the VF structure * @flr: VFLR was issued or not * -* Returns true if the VF is in reset, resets successfully, or resets -* are disabled and false otherwise. +* Return: True if reset was performed successfully or if resets are disabled. +* False if reset is already in progress. **/ bool i40e_reset_vf (struct i40e_vf *vf,bool flr) {
@@ -1476,7 +1476,7 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)/* If VF is being reset already we don't need to continue. */ if (test_and_set_bit (I40E_VF_STATE_RESETTING , &vf->vf_states)) -return true; +return false;i40e_trigger_vf_reset (vf, flr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/222 i40e: retry VFLR handling if there is ongoing VF reset
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Malz <[email protected]>
[ Upstream commit fb4e9239e029954a37a00818b21e837cebf2aa10 ]
When a VFLR interrupt is received during a VF reset initiated from a different source, the VFLR may be not fully handled. This can leave the VF in an undefined state.
To address this, set the I40E_VFLR_EVENT_PENDING bit again during VFLR handling if the reset is not yet complete. This ensures the driver will properly complete the VF reset in such scenarios.
--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +4 -1
@@ -4125,7 +4125,10 @@ int i40e_vc_process_vflr_event(struct i40e_pf *pf) reg =rd32 (hw,I40E_GLGEN_VFLRSTAT (reg_idx));if (reg &BIT (bit_idx))/* i40e_reset_vf will clear the bit in GLGEN_VFLRSTAT */ -i40e_reset_vf (vf, true); +if (!i40e_reset_vf (vf, true)) { +/* At least one VF did not finish resetting, retry next time */ +set_bit (__I40E_VFLR_EVENT_PENDING, pf->state); + } }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/222 net/mlx5: Wait for inactive autogroups
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Blakey <[email protected]>
[ Upstream commit 49c0355d301b4e0e01e0f19ddbb023bd7d0ee48c ]
Currently, if one thread tries to add an entry to an autogrouped table with no free matching group, while another thread is in the process of creating a new matching autogroup, it doesn't wait for the new group creation, and creates an unnecessary new autogroup.
Instead of skipping inactive, wait on the write lock of those groups.
Stable-dep-of: 8ec40e3f1f72 ("net/mlx5: Fix return value when searching for existing flow group")
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +5 -3
@@ -1768,11 +1768,13 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft,list_for_each_entry (iter, match_head, list) { g = iter->g; -if (!g->node.active) -continue ; -nested_down_write_ref_node (&g->node,FS_LOCK_PARENT ); +if (!g->node.active) { +up_write_ref_node (&g->node, false); +continue ; + } + err =insert_fte (g, fte);if (err) {up_write_ref_node (&g->node, false);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/222 net/mlx5: Fix return value when searching for existing flow group
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 8ec40e3f1f72bf8f8accf18020d487caa99f46a4 ]
When attempting to add a rule to an existing flow group, if a matching flow group exists but is not active, the error code returned should be EAGAIN, so that the rule can be added to the matching flow group once it is active, rather than ENOENT, which indicates that no matching flow group was found.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +4 -1
@@ -1716,6 +1716,7 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft,struct mlx5_flow_handle *rule;struct match_list *iter;bool take_write = false; +bool try_again = false;struct fs_fte *fte;u64 version;int err;
@@ -1771,6 +1772,7 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft,nested_down_write_ref_node (&g->node,FS_LOCK_PARENT );if (!g->node.active) { + try_again = true;up_write_ref_node (&g->node, false);continue ; }
@@ -1792,7 +1794,8 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft,tree_put_node (&fte->node, false);return rule; } - rule =ERR_PTR (-ENOENT ); + err = try_again ? -EAGAIN : -ENOENT ; + rule =ERR_PTR (err); out:kmem_cache_free (steering->ftes_cache, fte);return rule;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/222 net_sched: prio: fix a race in prio_tune()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d35acc1be3480505b5931f17e4ea9b7617fea4d3 ]
Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time.
The race is as follows:
CPU 0 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
| | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() |
[4]: qdisc_put()
This can be abused to underflow a parent's qlen.
Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
--- net/sched/sch_prio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_prio.c +1 -1
@@ -213,7 +213,7 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt,memcpy (q->prio2band, qopt->priomap,TC_PRIO_MAX +1 );for (i = q->bands; i < oldbands; i++) -qdisc_tree_flush_backlog (q->queues[i]); +qdisc_purge_queue (q->queues[i]);for (i = oldbands; i < q->bands; i++) { q->queues[i] = queues[i];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/222 net_sched: red: fix a race in __red_change()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 85a3e0ede38450ea3053b8c45d28cf55208409b8 ]
Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time.
The race is as follows:
CPU 0 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
| | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() |
[4]: qdisc_put()
This can be abused to underflow a parent's qlen.
Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
--- net/sched/sch_red.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_red.c +1 -1
@@ -235,7 +235,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt, q->flags = ctl->flags; q->limit = ctl->limit;if (child) { -qdisc_tree_flush_backlog (q->qdisc); +qdisc_purge_queue (q->qdisc); old_child = q->qdisc; q->qdisc = child; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/222 net_sched: tbf: fix a race in tbf_change()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 43eb466041216d25dedaef1c383ad7bd89929cbc ]
Gerrard Tai reported a race condition in TBF, whenever SFQ perturb timer fires at the wrong time.
The race is as follows:
CPU 0 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
| | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() |
[4]: qdisc_put()
This can be abused to underflow a parent's qlen.
Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
--- net/sched/sch_tbf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_tbf.c +1 -1
@@ -394,7 +394,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt,sch_tree_lock (sch);if (child) { -qdisc_tree_flush_backlog (q->qdisc); +qdisc_purge_queue (q->qdisc); old = q->qdisc; q->qdisc = child; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/222 net: mdio: C22 is now optional, EOPNOTSUPP if not provided
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
[ Upstream commit b063b1924fd9bf0bc157cf644764dc2151d04ccc ]
When performing a C22 operation, check that the bus driver actually provides the methods, and return -EOPNOTSUPP if not. C45 only busses do exist, and in future their C22 methods will be NULL.
Stable-dep-of: 0e629694126c ("net/mdiobus: Fix potential out-of-bounds read/write access")
--- drivers/net/phy/mdio_bus.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/phy/mdio_bus.c +8 -2
@@ -565,7 +565,10 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum)WARN_ON_ONCE (!mutex_is_locked (&bus->mdio_lock)); - retval = bus->read (bus, addr, regnum); +if (bus->read) + retval = bus->read (bus, addr, regnum); +else + retval = -EOPNOTSUPP ;trace_mdio_access (bus,1 , addr, regnum, retval, retval);
@@ -590,7 +593,10 @@ int __mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val)WARN_ON_ONCE (!mutex_is_locked (&bus->mdio_lock)); - err = bus->write (bus, addr, regnum, val); +if (bus->write) + err = bus->write (bus, addr, regnum, val); +else + err = -EOPNOTSUPP ;trace_mdio_access (bus,0 , addr, regnum, val, err);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/222 x86/boot/compressed: prefer cc-option for CFLAGS additions
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Desaulniers <[email protected]>
commit 994f5f7816ff963f49269cfc97f63cb2e4edb84f upstream.
as-option tests new options using KBUILD_CFLAGS, which causes problems when using as-option to update KBUILD_AFLAGS because many compiler options are not valid assembler options.
This will be fixed in a follow up patch. Before doing so, move the assembler test for -Wa,-mrelax-relocations=no from using as-option to cc-option.
--- arch/x86/boot/compressed/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/boot/compressed/Makefile +1 -1
@@ -39,7 +39,7 @@ KBUILD_CFLAGS += $(call cc-disable-warni KBUILD_CFLAGS += $(call cc-disable-warning, gnu) KBUILD_CFLAGS += -Wno-pointer-sign # Disable relocation relaxation in case the link is not PIE. -KBUILD_CFLAGS += $(call as-option,-Wa$(comma)-mrelax-relocations=no) +KBUILD_CFLAGS += $(call cc-option,-Wa$(comma)-mrelax-relocations=no) KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ GCOV_PROFILE := n
Greg Kroah-Hartman
maintainerPATCH 88/222 MIPS: Move -Wa,-msoft-float check from as-option to cc-option
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
This patch is for linux-6.1.y and earlier, it has no direct mainline equivalent.
In order to backport commit d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper flags and language target") to resolve a separate issue regarding PowerPC, the problem noticed and fixed by commit 80a20d2f8288 ("MIPS: Always use -Wa,-msoft-float and eliminate GAS_HAS_SET_HARDFLOAT") needs to be addressed. Unfortunately, 6.1 and earlier do not contain commit e4412739472b ("Documentation: raise minimum supported version of binutils to 2.25"), so it cannot be assumed that all supported versions of GNU as have support for -msoft-float.
In order to switch from KBUILD_CFLAGS to KBUILD_AFLAGS in as-option without consequence, move the '-Wa,-msoft-float' check to cc-option, including '$(cflags-y)' directly to avoid the issue mentioned in commit 80a20d2f8288 ("MIPS: Always use -Wa,-msoft-float and eliminate GAS_HAS_SET_HARDFLOAT").
--- arch/mips/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/Makefile +1 -1
@@ -107,7 +107,7 @@ endif # (specifically newer than 2.24.51.20140728) we then also need to explicitly # set ".set hardfloat" in all files which manipulate floating point registers. # -ifneq ($(call as-option,-Wa$(comma)-msoft-float,),) +ifneq ($(call cc-option,$(cflags-y) -Wa$(comma)-msoft-float,),) cflags-y += -DGAS_HAS_SET_HARDFLOAT -Wa,-msoft-float endif
Greg Kroah-Hartman
maintainerPATCH 89/222 kbuild: Update assembler calls to use proper flags and language target
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Desaulniers <[email protected]>
commit d5c8d6e0fa61401a729e9eb6a9c7077b2d3aebb0 upstream.
as-instr uses KBUILD_AFLAGS, but as-option uses KBUILD_CFLAGS. This can cause as-option to fail unexpectedly when CONFIG_WERROR is set, because clang will emit -Werror,-Wunused-command-line-argument for various -m and -f flags in KBUILD_CFLAGS for assembler sources.
Callers of as-option and as-instr should be adding flags to KBUILD_AFLAGS / aflags-y, not KBUILD_CFLAGS / cflags-y. Use KBUILD_AFLAGS in all macros to clear up the initial problem.
Unfortunately, -Wunused-command-line-argument can still be triggered with clang by the presence of warning flags or macro definitions because '-x assembler' is used, instead of '-x assembler-with-cpp', which will consume these flags. Switch to '-x assembler-with-cpp' in places where '-x assembler' is used, as the compiler is always used as the driver for out of line assembler sources in the kernel.
Finally, add -Werror to these macros so that they behave consistently whether or not CONFIG_WERROR is set.
[nathan: Reworded and expanded on problems in commit message
Use '-x assembler-with-cpp' in a couple more places]
--- scripts/Kbuild.include | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
scripts/Kbuild.include +4 -4
@@ -99,16 +99,16 @@ try-run = $(shell set -e; \ fi) # as-option -# Usage: cflags-y += $(call as-option,-Wa$(comma)-isa=foo,) +# Usage: aflags-y += $(call as-option,-Wa$(comma)-isa=foo,) as-option = $(call try-run,\ - $(CC) $(KBUILD_CFLAGS) $(1) -c -x assembler /dev/null -o "$$TMP",$(1),$(2)) + $(CC) -Werror $(KBUILD_AFLAGS) $(1) -c -x assembler-with-cpp /dev/null -o "$$TMP",$(1),$(2)) # as-instr -# Usage: cflags-y += $(call as-instr,instr,option1,option2) +# Usage: aflags-y += $(call as-instr,instr,option1,option2) as-instr = $(call try-run,\ - printf "%b\n" "$(1)" | $(CC) $(KBUILD_AFLAGS) -c -x assembler -o "$$TMP" -,$(2),$(3)) + printf "%b\n" "$(1)" | $(CC) -Werror $(KBUILD_AFLAGS) -c -x assembler-with-cpp -o "$$TMP" -,$(2),$(3)) # __cc-option # Usage: MY_CFLAGS += $(call __cc-option,$(CC),$(MY_CFLAGS),-march=winchip-c6,-march=i586)
Greg Kroah-Hartman
maintainerPATCH 90/222 drm/amd/display: Do not add -mhard-float to dml_ccflags for clang
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 7db038d9790eda558dd6c1dde4cdd58b64789c47 upstream.
When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it warns:
clang-16: error: argument unused during compilation: '-mhard-float' [-Werror,-Wunused-command-line-argument]
Similar to commit 84edc2eff827 ("selftest/fpu: avoid clang warning"), just add this flag to GCC builds. Commit 0f0727d971f6 ("drm/amd/display:
readd -msse2 to prevent Clang from emitting libcalls to undefined SW FP routines") added '-msse2' to prevent clang from emitting software floating point routines.
--- drivers/gpu/drm/amd/display/dc/dml/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/Makefile +2 -1
@@ -24,7 +24,8 @@ # It provides the general basic services required by other DAL # subcomponents. -dml_ccflags := -mhard-float -msse +dml_ccflags-$(CONFIG_CC_IS_GCC) := -mhard-float +dml_ccflags := $(dml_ccflags-y) -msse ifdef CONFIG_CC_IS_GCC ifeq ($(call cc-ifversion, -lt, 0701, y), y)
Greg Kroah-Hartman
maintainerPATCH 91/222 mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 08f6554ff90ef189e6b8f0303e57005bddfdd6a7 upstream.
A future change will move CLANG_FLAGS from KBUILD_{A,C}FLAGS to KBUILD_CPPFLAGS so that '--target' is available while preprocessing. When that occurs, the following error appears when building ARCH=mips with clang (tip of tree error shown):
clang: error: unsupported option '-mabi=' for target 'x86_64-pc-linux-gnu'
Add KBUILD_CPPFLAGS in the CHECKFLAGS invocation to keep everything working after the move.
--- arch/mips/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/Makefile +1 -1
@@ -319,7 +319,7 @@ KBUILD_CFLAGS += -fno-asynchronous-unwin KBUILD_LDFLAGS += -m $(ld-emul) ifdef CONFIG_MIPS -CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \ +CHECKFLAGS += $(shell $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \ egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \ sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g') endif
Greg Kroah-Hartman
maintainerPATCH 92/222 kbuild: Add CLANG_FLAGS to as-instr
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit cff6e7f50bd315e5b39c4e46c704ac587ceb965f upstream.
A future change will move CLANG_FLAGS from KBUILD_{A,C}FLAGS to KBUILD_CPPFLAGS so that '--target' is available while preprocessing. When that occurs, the following errors appear multiple times when building ARCH=powerpc powernv_defconfig:
ld.lld: error: vmlinux.a(arch/powerpc/kernel/head_64.o):(.text+0x12d4): relocation R_PPC64_ADDR16_HI out of range: -4611686018409717520 is not in [-2147483648, 2147483647]; references '__start___soft_mask_table' ld.lld: error: vmlinux.a(arch/powerpc/kernel/head_64.o):(.text+0x12e8): relocation R_PPC64_ADDR16_HI out of range: -4611686018409717392 is not in [-2147483648, 2147483647]; references '__stop___soft_mask_table'
Diffing the .o.cmd files reveals that -DHAVE_AS_ATHIGH=1 is not present anymore, because as-instr only uses KBUILD_AFLAGS, which will no longer contain '--target'.
Mirror Kconfig's as-instr and add CLANG_FLAGS explicitly to the invocation to ensure the target information is always present.
--- scripts/Kbuild.include | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Kbuild.include +1 -1
@@ -108,7 +108,7 @@ as-option = $(call try-run,\ # Usage: aflags-y += $(call as-instr,instr,option1,option2) as-instr = $(call try-run,\ - printf "%b\n" "$(1)" | $(CC) -Werror $(KBUILD_AFLAGS) -c -x assembler-with-cpp -o "$$TMP" -,$(2),$(3)) + printf "%b\n" "$(1)" | $(CC) -Werror $(CLANG_FLAGS) $(KBUILD_AFLAGS) -c -x assembler-with-cpp -o "$$TMP" -,$(2),$(3)) # __cc-option # Usage: MY_CFLAGS += $(call __cc-option,$(CC),$(MY_CFLAGS),-march=winchip-c6,-march=i586)
Greg Kroah-Hartman
maintainerPATCH 93/222 kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
commit feb843a469fb0ab00d2d23cfb9bcc379791011bb upstream.
When preprocessing arch/*/kernel/vmlinux.lds.S, the target triple is not passed to $(CPP) because we add it only to KBUILD_{C,A}FLAGS.
As a result, the linker script is preprocessed with predefined macros for the build host instead of the target.
Assuming you use an x86 build machine, compare the following:
$ clang -dM -E -x c /dev/null $ clang -dM -E -x c /dev/null -target aarch64-linux-gnu
There is no actual problem presumably because our linker scripts do not rely on such predefined macros, but it is better to define correct ones.
Move $(CLANG_FLAGS) to KBUILD_CPPFLAGS, so that all *.c, *.S, *.lds.S will be processed with the proper target triple.
[Note]
After the patch submission, we got an actual problem that needs this commit. (CBL issue 1859)
--- Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
Makefile +1 -2
@@ -568,8 +568,7 @@ ifneq ($(LLVM_IAS),1) CLANG_FLAGS += -no-integrated-as endif CLANG_FLAGS += -Werror=unknown-warning-option -KBUILD_CFLAGS += $(CLANG_FLAGS) -KBUILD_AFLAGS += $(CLANG_FLAGS) +KBUILD_CPPFLAGS += $(CLANG_FLAGS) export CLANG_FLAGS endif
Greg Kroah-Hartman
maintainerPATCH 94/222 kbuild: Add KBUILD_CPPFLAGS to as-option invocation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 43fc0a99906e04792786edf8534d8d58d1e9de0c upstream.
After commit feb843a469fb ("kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS"), there is an error while building certain PowerPC assembly files with clang:
arch/powerpc/lib/copypage_power7.S: Assembler messages:
arch/powerpc/lib/copypage_power7.S:34: Error: junk at end of line: 0b01000' arch/powerpc/lib/copypage_power7.S:35: Error: junk at end of line: 0b01010' arch/powerpc/lib/copypage_power7.S:37: Error: junk at end of line: 0b01000' arch/powerpc/lib/copypage_power7.S:38: Error: junk at end of line: 0b01010' arch/powerpc/lib/copypage_power7.S:40: Error: junk at end of line: `0b01010'
clang: error: assembler command failed with exit code 1 (use -v to see invocation)
as-option only uses KBUILD_AFLAGS, so after removing CLANG_FLAGS from KBUILD_AFLAGS, there is no more '--target=' or '--prefix=' flags. As a result of those missing flags, the host target
will be tested during as-option calls and likely fail, meaning necessary flags may not get added when building assembly files, resulting in errors like seen above.
Add KBUILD_CPPFLAGS to as-option invocations to clear up the errors. This should have been done in commit d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper flags and language target"), which switched from using the assembler target to the assembler-with-cpp target, so flags that affect preprocessing are passed along in all relevant tests. as-option now mirrors cc-option.
--- scripts/Kbuild.include | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Kbuild.include +1 -1
@@ -102,7 +102,7 @@ try-run = $(shell set -e; \ # Usage: aflags-y += $(call as-option,-Wa$(comma)-isa=foo,) as-option = $(call try-run,\ - $(CC) -Werror $(KBUILD_AFLAGS) $(1) -c -x assembler-with-cpp /dev/null -o "$$TMP",$(1),$(2)) + $(CC) -Werror $(KBUILD_CPPFLAGS) $(KBUILD_AFLAGS) $(1) -c -x assembler-with-cpp /dev/null -o "$$TMP",$(1),$(2)) # as-instr # Usage: aflags-y += $(call as-instr,instr,option1,option2)
Greg Kroah-Hartman
maintainerPATCH 95/222 drm/amd/display: Do not add -mhard-float to dcn2{1,0}_resource.o for clang
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
This patch is for linux-5.15.y and earlier only. It is functionally equivalent to upstream commit 7db038d9790e ("drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang"), which was created after all files that require '-mhard-float' were moved under the dml folder. In kernels older than 5.18, which do not contain upstream commits
22f87d998326 ("drm/amd/display: move FPU operations from dcn21 to dml/dcn20 folder") cf689e869cf0 ("drm/amd/display: move FPU-related code from dcn20 to dml folder")
newer versions of clang error with
clang: error: unsupported option '-mhard-float' for target 'x86_64-linux-gnu'
make[6]: *** [scripts/Makefile.build:289: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_resource.o] Error 1
clang: error: unsupported option '-mhard-float' for target 'x86_64-linux-gnu'
make[6]: *** [scripts/Makefile.build:289: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn21/dcn21_resource.o] Error 1
Apply a functionally equivalent change to prevent adding '-mhard-float' with clang for these files.
--- drivers/gpu/drm/amd/display/dc/dcn20/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dcn21/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn20/Makefile +1 -1
@@ -10,7 +10,7 @@ ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT DCN20 += dcn20_dsc.o endif -CFLAGS_$(AMDDALPATH)/dc/dcn20/dcn20_resource.o := -mhard-float -msse +CFLAGS_$(AMDDALPATH)/dc/dcn20/dcn20_resource.o := $(if $(CONFIG_CC_IS_GCC), -mhard-float) -msse ifdef CONFIG_CC_IS_GCC ifeq ($(call cc-ifversion, -lt, 0701, y), y)
drivers/gpu/drm/amd/display/dc/dcn21/Makefile +1 -1
@@ -3,7 +3,7 @@ DCN21 = dcn21_hubp.o dcn21_hubbub.o dcn21_resource.o -CFLAGS_$(AMDDALPATH)/dc/dcn21/dcn21_resource.o := -mhard-float -msse +CFLAGS_$(AMDDALPATH)/dc/dcn21/dcn21_resource.o := $(if $(CONFIG_CC_IS_GCC), -mhard-float) -msse ifdef CONFIG_CC_IS_GCC ifeq ($(call cc-ifversion, -lt, 0701, y), y)
Greg Kroah-Hartman
maintainerPATCH 96/222 net/mdiobus: Fix potential out-of-bounds read/write access
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Raczynski <[email protected]>
[ Upstream commit 0e629694126ca388916f059453a1c36adde219c4 ]
When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write.
Fix that by adding address verification before read/write operation. While this excludes this access from any statistics, it improves security of read/write operation.
--- drivers/net/phy/mdio_bus.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/phy/mdio_bus.c +6 -0
@@ -565,6 +565,9 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum)WARN_ON_ONCE (!mutex_is_locked (&bus->mdio_lock)); +if (addr >=PHY_MAX_ADDR ) +return -ENXIO ; +if (bus->read) retval = bus->read (bus, addr, regnum);else
@@ -593,6 +596,9 @@ int __mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val)WARN_ON_ONCE (!mutex_is_locked (&bus->mdio_lock)); +if (addr >=PHY_MAX_ADDR ) +return -ENXIO ; +if (bus->write) err = bus->write (bus, addr, regnum, val);else
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/222 fs/filesystems: Fix potential unsigned integer underflow in fs_name()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 1363c134ade81e425873b410566e957fecebb261 ]
fs_name() has @index as unsigned int, so there is underflow risk for operation '@index--'.
Fix by breaking the for loop when '@index == 0' which is also more proper than '@index <= 0' for unsigned integer comparison.
--- fs/filesystems.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/filesystems.c +9 -5
@@ -155,15 +155,19 @@ static int fs_index(const char __user *static int fs_name (unsigned int index,char __user * buf) {struct file_system_type * tmp; -int len, res; +int len, res = -EINVAL ;read_lock (&file_systems_lock); -for (tmp = file_systems; tmp; tmp = tmp->next, index--) -if (index <=0 &&try_module_get (tmp->owner)) +for (tmp = file_systems; tmp; tmp = tmp->next, index--) { +if (index ==0 ) { +if (try_module_get (tmp->owner)) + res =0 ;break ; + } + }read_unlock (&file_systems_lock); -if (!tmp) -return -EINVAL ; +if (res) +return res;/* OK, we got the reference, so we can safely block */ len =strlen (tmp->name) +1 ;
Greg Kroah-Hartman
maintainerPATCH 98/222 usb: Flush altsetting 0 endpoints before reinitializating them after reset.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 89bb3dc13ac29a563f4e4c555e422882f64742bd upstream.
usb core avoids sending a Set-Interface altsetting 0 request after device reset, and instead relies on calling usb_disable_interface() and usb_enable_interface() to flush and reset host-side of those endpoints.
xHCI hosts allocate and set up endpoint ring buffers and host_ep->hcpriv during usb_hcd_alloc_bandwidth() callback, which in this case is called before flushing the endpoint in usb_disable_interface().
Call usb_disable_interface() before usb_hcd_alloc_bandwidth() to ensure URBs are flushed before new ring buffers for the endpoints are allocated.
Otherwise host driver will attempt to find and remove old stale URBs from a freshly allocated new ringbuffer.
--- drivers/usb/core/hub.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/usb/core/hub.c +14 -2
@@ -5826,6 +5826,7 @@ static int usb_reset_and_verify_device(sstruct usb_hub *parent_hub;struct usb_hcd *hcd =bus_to_hcd (udev->bus);struct usb_device_descriptor descriptor = udev->descriptor; +struct usb_interface *intf;struct usb_host_bos *bos;int i, j, ret =0 ;int port1 = udev->portnum;
@@ -5887,6 +5888,18 @@ static int usb_reset_and_verify_device(sif (!udev->actconfig) goto done; +/* +* Some devices can't handle setting default altsetting 0 with a +* Set-Interface request. Disable host-side endpoints of those +* interfaces here. Enable and reset them back after host has set +* its internal endpoint structures during usb_hcd_alloc_bandwith() +*/ +for (i =0 ; i < udev->actconfig->desc.bNumInterfaces; i++) { + intf = udev->actconfig->interface[i]; +if (intf->cur_altsetting->desc.bAlternateSetting ==0 ) +usb_disable_interface (udev, intf, true); + } +mutex_lock (hcd->bandwidth_mutex); ret =usb_hcd_alloc_bandwidth (udev, udev->actconfig,NULL ,NULL );if (ret <0 ) {
@@ -5918,12 +5931,11 @@ static int usb_reset_and_verify_device(s*/ for (i =0 ; i < udev->actconfig->desc.bNumInterfaces; i++) {struct usb_host_config *config = udev->actconfig; -struct usb_interface *intf = config->interface[i];struct usb_interface_descriptor *desc; + intf = config->interface[i]; desc = &intf->cur_altsetting->desc;if (desc->bAlternateSetting ==0 ) { -usb_disable_interface (udev, intf, true);usb_enable_interface (udev, intf, true); ret =0 ; }else {
Greg Kroah-Hartman
maintainerPATCH 99/222 xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Stabellini <[email protected]>
commit 7f9bbc1140ff8796230bc2634055763e271fd692 upstream.
dm_op hypercalls might come from userspace and pass memory addresses as parameters. The memory addresses typically correspond to buffers allocated in userspace to hold extra hypercall parameters.
On ARM, when CONFIG_ARM64_SW_TTBR0_PAN is enabled, they might not be accessible by Xen, as a result ioreq hypercalls might fail. See the existing comment in arch/arm64/xen/hypercall.S regarding privcmd_call for reference.
For privcmd_call, Linux calls uaccess_ttbr0_enable before issuing the hypercall thanks to commit 9cf09d68b89a. We need to do the same for dm_op. This resolves the problem.
Message-ID: <alpine.DEB.2.22.394.2505121446370.8380@ubuntu-linux-20-04-desktop>
--- arch/arm64/xen/hypercall.S | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
arch/arm64/xen/hypercall.S +20 -1
@@ -84,7 +84,26 @@ HYPERCALL1(tmem_op); HYPERCALL1(platform_op_raw); HYPERCALL2(multicall); HYPERCALL2(vm_assist); -HYPERCALL3(dm_op); + +SYM_FUNC_START(HYPERVISOR_dm_op) + mov x16, #__HYPERVISOR_dm_op; \ + /* + * dm_op hypercalls are issued by the userspace. The kernel needs to + * enable access to TTBR0_EL1 as the hypervisor would issue stage 1 + * translations to user memory via AT instructions. Since AT + * instructions are not affected by the PAN bit (ARMv8.1), we only + * need the explicit uaccess_enable/disable if the TTBR0 PAN emulation + * is enabled (it implies that hardware UAO and PAN disabled). + */ + uaccess_ttbr0_enable x6, x7, x8 + hvc XEN_IMM + + /* + * Disable userspace access from kernel once the hyp call completed. + */ + uaccess_ttbr0_disable x6, x7 + ret +SYM_FUNC_END(HYPERVISOR_dm_op); ENTRY(privcmd_call) mov x16, x0
Greg Kroah-Hartman
maintainerPATCH 100/222 calipso: unlock rcu before returning -EAFNOSUPPORT
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 3cae906e1a6184cdc9e4d260e4dbdf9a118d94ad upstream.
syzbot reported that a recent patch forgot to unlock rcu in the error path.
Adopt the convention that netlbl_conn_setattr() is already using.
--- net/netlabel/netlabel_kapi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netlabel/netlabel_kapi.c +4 -2
@@ -1140,8 +1140,10 @@ int netlbl_conn_setattr(struct sock *sk,break ;#if IS_ENABLED (CONFIG_IPV6 )case AF_INET6 : -if (sk->sk_family !=AF_INET6 ) -return -EAFNOSUPPORT ; +if (sk->sk_family !=AF_INET6 ) { + ret_val = -EAFNOSUPPORT ; + goto conn_setattr_return; + } addr6 = (struct sockaddr_in6 *)addr; entry = netlbl_domhsh_getentry_af6(secattr->domain,
Greg Kroah-Hartman
maintainerPATCH 101/222 net: usb: aqc111: debug info before sanitation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit d3faab9b5a6a0477d69c38bd11c43aa5e936f929 upstream.
If we sanitize error returns, the debug statements need to come before that so that we don't lose information.
--- drivers/net/usb/aqc111.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/usb/aqc111.c +4 -4
@@ -31,11 +31,11 @@ static int aqc111_read_cmd_nopm(struct u USB_RECIP_DEVICE, value, index, data, size);if (unlikely (ret < size)) { - ret = ret <0 ? ret : -ENODATA ; -netdev_warn (dev->net,"Failed to read(0x%x) reg index 0x%04x: %d\n" , cmd, index, ret); + + ret = ret <0 ? ret : -ENODATA ; }return ret;
@@ -50,11 +50,11 @@ static int aqc111_read_cmd(struct usbnet USB_RECIP_DEVICE, value, index, data, size);if (unlikely (ret < size)) { - ret = ret <0 ? ret : -ENODATA ; -netdev_warn (dev->net,"Failed to read(0x%x) reg index 0x%04x: %d\n" , cmd, index, ret); + + ret = ret <0 ? ret : -ENODATA ; }return ret;
Greg Kroah-Hartman
maintainerPATCH 102/222 configfs: Do not override creating attribute file failure in populate_attrs()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
commit f830edbae247b89228c3e09294151b21e0dc849c upstream.
populate_attrs() may override failure for creating attribute files by success for creating subsequent bin attribute files, and have wrong return value.
Fix by creating bin attribute files under successfully creating attribute files.
--- fs/configfs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/configfs/dir.c +1 -1
@@ -619,7 +619,7 @@ static int populate_attrs(struct config_break ; } } -if (t->ct_bin_attrs) { +if (!error && t->ct_bin_attrs) {for (i =0 ; (bin_attr = t->ct_bin_attrs[i]) !=NULL ; i++) { error =configfs_create_bin_file (item, bin_attr);if (error)
Greg Kroah-Hartman
maintainerPATCH 103/222 gfs2: move msleep to sleepable context
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
commit ac5ee087d31ed93b6e45d2968a66828c6f621d8c upstream.
This patch moves the msleep_interruptible() out of the non-sleepable context by moving the ls->ls_recover_spin spinlock around so msleep_interruptible() will be called in a sleepable context.
--- fs/gfs2/lock_dlm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/gfs2/lock_dlm.c +2 -1
@@ -905,14 +905,15 @@ locks_done:if (sdp->sd_args.ar_spectator) {fs_info (sdp,"Recovery is required. Waiting for a " "non-spectator to mount.\n" ); +spin_unlock (&ls->ls_recover_spin);msleep_interruptible (1000 ); }else {fs_info (sdp,"control_mount wait1 block %u start %u " "mount %u lvb %u flags %lx\n" , block_gen, start_gen, mount_gen, lvb_gen, ls->ls_recover_flags); +spin_unlock (&ls->ls_recover_spin); } -spin_unlock (&ls->ls_recover_spin); goto restart; }
Greg Kroah-Hartman
maintainerPATCH 104/222 wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <[email protected]>
commit da1b9a55ff116cb040528ef664c70a4eec03ae99 upstream.
Robert Morris reported:
|If a malicious USB device pretends to be an Intersil p54 wifi
|interface and generates an eeprom_readback message with a large
|eeprom->v1.len, p54_rx_eeprom_readback() will copy data from the
|message beyond the end of priv->eeprom.
|
|static void p54_rx_eeprom_readback(struct p54_common *priv,
| struct sk_buff *skb)
|{
| struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
| struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr->data;
|
| if (priv->fw_var >= 0x509) {
| memcpy(priv->eeprom, eeprom->v2.data,
| le16_to_cpu(eeprom->v2.len));
| } else {
| memcpy(priv->eeprom, eeprom->v1.data,
| le16_to_cpu(eeprom->v1.len));
| }
| [...]The eeprom->v{1,2}.len is set by the driver in p54_download_eeprom(). The device is supposed to provide the same length back to the driver. But yes, it's possible (like shown in the report) to alter the value to something that causes a crash/panic due to overrun.
This patch addresses the issue by adding the size to the common device context, so p54_rx_eeprom_readback no longer relies on possibly tampered values... That said, it also checks if the "firmware" altered the value and no longer copies them.
The one, small saving grace is: Before the driver tries to read the eeprom, it needs to upload >a< firmware. the vendor firmware has a proprietary license and as a reason, it is not present on most distributions by default.
--- drivers/net/wireless/intersil/p54/fwio.c | 2 ++ drivers/net/wireless/intersil/p54/p54.h | 1 + drivers/net/wireless/intersil/p54/txrx.c | 13 +++++++++---- 3 files changed, 12 insertions(+), 4 deletions(-)
drivers/net/wireless/intersil/p54/fwio.c +2 -0
@@ -233,6 +233,7 @@ int p54_download_eeprom(struct p54_commomutex_lock (&priv->eeprom_mutex); priv->eeprom = buf; + priv->eeprom_slice_size = len; eeprom_hdr =skb_put (skb, eeprom_hdr_size + len);if (priv->fw_var <0x509 ) {
@@ -255,6 +256,7 @@ int p54_download_eeprom(struct p54_commo ret = -EBUSY ; } priv->eeprom =NULL ; + priv->eeprom_slice_size =0 ;mutex_unlock (&priv->eeprom_mutex);return ret; }
drivers/net/wireless/intersil/p54/p54.h +1 -0
@@ -258,6 +258,7 @@ struct p54_common {/* eeprom handling */ void *eeprom; +size_t eeprom_slice_size;struct completion eeprom_comp;struct mutex eeprom_mutex; };
drivers/net/wireless/intersil/p54/txrx.c +9 -4
@@ -500,14 +500,19 @@ static void p54_rx_eeprom_readback(strucreturn ;if (priv->fw_var >=0x509 ) { -memcpy (priv->eeprom, eeprom->v2.data, -le16_to_cpu (eeprom->v2.len)); +if (le16_to_cpu (eeprom->v2.len) != priv->eeprom_slice_size) +return ; + +memcpy (priv->eeprom, eeprom->v2.data, priv->eeprom_slice_size); }else { -memcpy (priv->eeprom, eeprom->v1.data, -le16_to_cpu (eeprom->v1.len)); +if (le16_to_cpu (eeprom->v1.len) != priv->eeprom_slice_size) +return ; + +memcpy (priv->eeprom, eeprom->v1.data, priv->eeprom_slice_size); } priv->eeprom =NULL ; + priv->eeprom_slice_size =0 ; tmp =p54_find_and_unlink_skb (priv, hdr->req_id);dev_kfree_skb_any (tmp);complete (&priv->eeprom_comp);
Greg Kroah-Hartman
maintainerPATCH 105/222 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 1244f0b2c3cecd3f349a877006e67c9492b41807 upstream.
If the request being processed is not a v4 compound request, then examining the cstate can have undefined results.
This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure.
--- fs/nfsd/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +2 -1
@@ -2750,7 +2750,8 @@ bool nfsd4_spo_must_allow(struct svc_rqsstruct nfs4_op_map *allow = &cstate->clp->cl_spo_must_allow;u32 opiter; -if (!cstate->minorversion) +if (rqstp->rq_procinfo != &nfsd_version4.vs_proc[NFSPROC4_COMPOUND ] || + cstate->minorversion ==0 )return false;if (cstate->spo_must_allowed == true)
Greg Kroah-Hartman
maintainerPATCH 106/222 wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingcong Bai <[email protected]>
commit 77a6407c6ab240527166fb19ee96e95f5be4d3cd upstream.
RTL8723BE found on some ASUSTek laptops, such as F441U and X555UQ with subsystem ID 11ad:1723 are known to output large amounts of PCIe AER errors during and after boot up, causing heavy lags and at times lock-ups:
pcieport 0000:00:1c.5: AER: Correctable error message received from 0000:00:1c.5 pcieport 0000:00:1c.5: PCIe Bus Error: severity=Correctable, type=Physical Layer, (Receiver ID)
pcieport 0000:00:1c.5: device [8086:9d15] error status/mask=00000001/00002000
pcieport 0000:00:1c.5: [ 0] RxErr
Disable ASPM on this combo as a quirk.
This patch is a revision of a previous patch (linked below) which attempted to disable ASPM for RTL8723BE on all Intel Skylake and Kaby Lake PCIe bridges. I take a more conservative approach as all known reports point to ASUSTek laptops of these two generations with this particular wireless card.
Please note, however, before the rtl8723be finishes probing, the AER errors remained. After the module finishes probing, all AER errors would indeed be eliminated, along with heavy lags, poor network throughput, and/or occasional lock-ups.
--- drivers/net/wireless/realtek/rtlwifi/pci.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/wireless/realtek/rtlwifi/pci.c +10 -0
@@ -155,6 +155,16 @@ static void _rtl_pci_update_default_settif (rtlpriv->rtlhal.hw_type ==HARDWARE_TYPE_RTL8192SE && init_aspm ==0x43 ) ppsc->support_aspm = false; + +/* RTL8723BE found on some ASUSTek laptops, such as F441U and +* X555UQ with subsystem ID 11ad:1723 are known to output large +* amounts of PCIe AER errors during and after boot up, causing +* heavy lags, poor network throughput, and occasional lock-ups. +*/ +if (rtlpriv->rtlhal.hw_type ==HARDWARE_TYPE_RTL8723BE && + (rtlpci->pdev->subsystem_vendor ==0x11ad && + rtlpci->pdev->subsystem_device ==0x1723 )) + ppsc->support_aspm = false; } static bool _rtl_pci_platform_switch_device_pci_aspm(
Greg Kroah-Hartman
maintainerPATCH 107/222 media: gspca: Add error handling for stv06xx_read_sensor()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 398a1b33f1479af35ca915c5efc9b00d6204f8fa upstream.
In hdcs_init(), the return value of stv06xx_read_sensor() needs to be checked. A proper implementation can be found in vv6410_dump(). Add a check in loop condition and propergate error code to fix this issue.
--- drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c +4 -3
@@ -520,12 +520,13 @@ static int hdcs_init(struct sd *sd)static int hdcs_dump (struct sd *sd) {u16 reg, val; +int err =0 ;pr_info ("Dumping sensor registers:\n" ); -for (reg =HDCS_IDENT ; reg <=HDCS_ROWEXPH ; reg++) { -stv06xx_read_sensor (sd, reg, &val); +for (reg =HDCS_IDENT ; reg <=HDCS_ROWEXPH && !err; reg++) { + err =stv06xx_read_sensor (sd, reg, &val);pr_info ("reg 0x%02x = 0x%02x\n" , reg, val); } -return 0 ; +return (err <0 ) ? err :0 ; }
Greg Kroah-Hartman
maintainerPATCH 108/222 media: v4l2-dev: fix error handling in __video_register_device()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a upstream.
Once device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it could cause memory leak. And move callback function v4l2_device_release() and v4l2_device_get() before put_device().
As comment of device_register() says, 'NOTE: _Never_ directly free @dev after calling this function, even if it returned an error! Always use put_device() to give up the reference initialized in this function instead.'
Found by code review.
--- drivers/media/v4l2-core/v4l2-dev.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/media/v4l2-core/v4l2-dev.c +7 -7
@@ -1010,25 +1010,25 @@ int __video_register_device(struct video vdev->dev.class = &video_class; vdev->dev.devt =MKDEV (VIDEO_MAJOR , vdev->minor); vdev->dev.parent = vdev->dev_parent; + vdev->dev.release = v4l2_device_release;dev_set_name (&vdev->dev,"%s%d" , name_base, vdev->num); + +/* Increase v4l2_device refcount */ +v4l2_device_get (vdev->v4l2_dev); +mutex_lock (&videodev_lock); ret =device_register (&vdev->dev);if (ret <0 ) {mutex_unlock (&videodev_lock);pr_err ("%s: device_register failed\n" , __func__); - goto cleanup; +put_device (&vdev->dev); +return ret; } -/* Register the release callback that will be called when the last -reference to the device goes away. */ - vdev->dev.release = v4l2_device_release;if (nr !=-1 && nr != vdev->num && warn_if_nr_in_use)pr_warn ("%s: requested %s%d, got %s\n" , __func__, name_base, nr,video_device_node_name (vdev)); -/* Increase v4l2_device refcount */ -v4l2_device_get (vdev->v4l2_dev); -/* Part 5: Register the entity. */ ret =video_register_media_controller (vdev);
Greg Kroah-Hartman
maintainerPATCH 109/222 ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Stutterheim <[email protected]>
commit 96e0b355883006554a0bee3697da475971d6bba8 upstream.
arm/memremap: fix arch_memremap_can_ram_remap()
commit 260364d112bc ("arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map") added the definition of arch_memremap_can_ram_remap() for arm[64] specific filtering of what pages can be used from the linear mapping. memblock_is_map_memory() was called with the pfn of the address given to arch_memremap_can_ram_remap(); however, memblock_is_map_memory() expects to be given an address for arm, not a pfn.
This results in calls to memremap() returning a newly mapped area when it should return an address in the existing linear mapping.
Fix this by removing the address to pfn translation and pass the address directly.
--- arch/arm/mm/ioremap.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/arm/mm/ioremap.c +1 -3
@@ -504,7 +504,5 @@ void __init early_ioremap_init(void)bool arch_memremap_can_ram_remap (resource_size_t offset,size_t size,unsigned long flags) { -unsigned long pfn =PHYS_PFN (offset); - -return memblock_is_map_memory (pfn); +return memblock_is_map_memory (offset); }
Greg Kroah-Hartman
maintainerPATCH 110/222 ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tasos Sahanidis <[email protected]>
commit d29fc02caad7f94b62d56ee1b01c954f9c961ba7 upstream.
The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also prevent the system from booting.
In this case, the system hangs when reading the ATIP from optical media with cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an Optiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4, running at UDMA/33.
The issue can be reproduced by running the same command with a cygwin build of cdrecord on WinXP, although it requires more attempts to cause it. The hang in that case is also resolved by forcing PIO. It doesn't appear that VIA has produced any drivers for that OS, thus no known workaround exists.
HDDs attached to the controller do not suffer from any DMA issues.
--- drivers/ata/pata_via.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/ata/pata_via.c +2 -1
@@ -368,7 +368,8 @@ static unsigned long via_mode_filter(str }if (dev->class ==ATA_DEV_ATAPI && -dmi_check_system (no_atapi_dma_dmi_table)) { + (dmi_check_system (no_atapi_dma_dmi_table) || + config->id ==PCI_DEVICE_ID_VIA_6415 )) {ata_dev_warn (dev,"controller locks up on ATAPI DMA, forcing PIO\n" ); mask &=ATA_MASK_PIO ; }
Greg Kroah-Hartman
maintainerPATCH 111/222 bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <[email protected]>
commit dd7d8e012b23de158ca0188239c7a1f2a83b4484 upstream.
The fsl-mc bus associated to the root DPRC in a DPAA2 system exports a device file for userspace access to the MC firmware. In case the DPRC's local MC portal (DPMCP) is currently in use, a new DPMCP device is allocated through the fsl_mc_portal_allocate() function.
In this case, the call to fsl_mc_portal_allocate() will fail with -EINVAL when trying to add a device link between the root DPRC (consumer) and the newly allocated DPMCP device (supplier). This is because the DPMCP is a dependent of the DPRC device (the bus).
Fix this by not adding a device link in case the DPMCP is allocated for the root DPRC's usage.
--- drivers/bus/fsl-mc/mc-io.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/bus/fsl-mc/mc-io.c +13 -6
@@ -214,12 +214,19 @@ int __must_check fsl_mc_portal_allocate(if (error <0 ) goto error_cleanup_resource; - dpmcp_dev->consumer_link =device_link_add (&mc_dev->dev, - &dpmcp_dev->dev, -DL_FLAG_AUTOREMOVE_CONSUMER ); -if (!dpmcp_dev->consumer_link) { - error = -EINVAL ; - goto error_cleanup_mc_io; +/* If the DPRC device itself tries to allocate a portal (usually for +* UAPI interaction), don't add a device link between them since the +* DPMCP device is an actual child device of the DPRC and a reverse +* dependency is not allowed. +*/ +if (mc_dev != mc_bus_dev) { + dpmcp_dev->consumer_link =device_link_add (&mc_dev->dev, + &dpmcp_dev->dev, +DL_FLAG_AUTOREMOVE_CONSUMER ); +if (!dpmcp_dev->consumer_link) { + error = -EINVAL ; + goto error_cleanup_mc_io; + } } *new_mc_io = mc_io;
Greg Kroah-Hartman
maintainerPATCH 112/222 ext4: inline: fix len overflow in ext4_prepare_inline_data
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit 227cb4ca5a6502164f850d22aec3104d7888b270 upstream.
When running the following code on an ext4 filesystem with inline_data feature enabled, it will lead to the bug below.
fd = open("file1", O_RDWR | O_CREAT | O_TRUNC, 0666);
ftruncate(fd, 30);
pwrite(fd, "a", 1, (1UL << 40) + 5UL);That happens because write_begin will succeed as when ext4_generic_write_inline_data calls ext4_prepare_inline_data, pos + len will be truncated, leading to ext4_prepare_inline_data parameter to be 6 instead of 0x10000000006.
Then, later when write_end is called, we hit:
BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);
at ext4_write_inline_data.
Fix it by using a loff_t type for the len parameter in ext4_prepare_inline_data instead of an unsigned int.
[ 44.545164] ------------[ cut here ]------------ [ 44.545530] kernel BUG at fs/ext4/inline.c:240! [ 44.545834] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 44.546172] CPU: 3 UID: 0 PID: 343 Comm: test Not tainted 6.15.0-rc2-00003-g9080916f4863 #45 PREEMPT(full) 112853fcebfdb93254270a7959841d2c6aa2c8bb [ 44.546523] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 44.546523] RIP: 0010:ext4_write_inline_data+0xfe/0x100 [ 44.546523] Code: 3c 0e 48 83 c7 48 48 89 de 5b 41 5c 41 5d 41 5e 41 5f 5d e9 e4 fa 43 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 0f 0b <0f> 0b 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 20 49 [ 44.546523] RSP: 0018:ffffb342008b79a8 EFLAGS: 00010216 [ 44.546523] RAX: 0000000000000001 RBX: ffff9329c579c000 RCX: 0000010000000006 [ 44.546523] RDX: 000000000000003c RSI: ffffb342008b79f0 RDI: ffff9329c158e738 [ 44.546523] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 44.546523] R10: 00007ffffffff000 R11: ffffffff9bd0d910 R12: 0000006210000000 [ 44.546523] R13: fffffc7e4015e700 R14: 0000010000000005 R15: ffff9329c158e738 [ 44.546523] FS: 00007f4299934740(0000) GS:ffff932a60179000(0000) knlGS:0000000000000000 [ 44.546523] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.546523] CR2: 00007f4299a1ec90 CR3: 0000000002886002 CR4: 0000000000770eb0 [ 44.546523] PKRU: 55555554 [ 44.546523] Call Trace: [ 44.546523] <TASK> [ 44.546523] ext4_write_inline_data_end+0x126/0x2d0 [ 44.546523] generic_perform_write+0x17e/0x270 [ 44.546523] ext4_buffered_write_iter+0xc8/0x170 [ 44.546523] vfs_write+0x2be/0x3e0 [ 44.546523] __x64_sys_pwrite64+0x6d/0xc0 [ 44.546523] do_syscall_64+0x6a/0xf0 [ 44.546523] ? __wake_up+0x89/0xb0 [ 44.546523] ? xas_find+0x72/0x1c0 [ 44.546523] ? next_uptodate_folio+0x317/0x330 [ 44.546523] ? set_pte_range+0x1a6/0x270 [ 44.546523] ? filemap_map_pages+0x6ee/0x840 [ 44.546523] ? ext4_setattr+0x2fa/0x750 [ 44.546523] ? do_pte_missing+0x128/0xf70 [ 44.546523] ? security_inode_post_setattr+0x3e/0xd0 [ 44.546523] ? ___pte_offset_map+0x19/0x100 [ 44.546523] ? handle_mm_fault+0x721/0xa10 [ 44.546523] ? do_user_addr_fault+0x197/0x730 [ 44.546523] ? do_syscall_64+0x76/0xf0 [ 44.546523] ? arch_exit_to_user_mode_prepare+0x1e/0x60 [ 44.546523] ? irqentry_exit_to_user_mode+0x79/0x90 [ 44.546523] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 44.546523] RIP: 0033:0x7f42999c6687 [ 44.546523] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 44.546523] RSP: 002b:00007ffeae4a7930 EFLAGS: 00000202 ORIG_RAX: 0000000000000012 [ 44.546523] RAX: ffffffffffffffda RBX: 00007f4299934740 RCX: 00007f42999c6687 [ 44.546523] RDX: 0000000000000001 RSI: 000055ea6149200f RDI: 0000000000000003 [ 44.546523] RBP: 00007ffeae4a79a0 R08: 0000000000000000 R09: 0000000000000000 [ 44.546523] R10: 0000010000000005 R11: 0000000000000202 R12: 0000000000000000 [ 44.546523] R13: 00007ffeae4a7ac8 R14: 00007f4299b86000 R15: 000055ea61493dd8 [ 44.546523] </TASK> [ 44.546523] Modules linked in: [ 44.568501] ---[ end trace 0000000000000000 ]--- [ 44.568889] RIP: 0010:ext4_write_inline_data+0xfe/0x100 [ 44.569328] Code: 3c 0e 48 83 c7 48 48 89 de 5b 41 5c 41 5d 41 5e 41 5f 5d e9 e4 fa 43 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 0f 0b <0f> 0b 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 20 49 [ 44.570931] RSP: 0018:ffffb342008b79a8 EFLAGS: 00010216 [ 44.571356] RAX: 0000000000000001 RBX: ffff9329c579c000 RCX: 0000010000000006 [ 44.571959] RDX: 000000000000003c RSI: ffffb342008b79f0 RDI: ffff9329c158e738 [ 44.572571] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 44.573148] R10: 00007ffffffff000 R11: ffffffff9bd0d910 R12: 0000006210000000 [ 44.573748] R13: fffffc7e4015e700 R14: 0000010000000005 R15: ffff9329c158e738 [ 44.574335] FS: 00007f4299934740(0000) GS:ffff932a60179000(0000) knlGS:0000000000000000 [ 44.575027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.575520] CR2: 00007f4299a1ec90 CR3: 0000000002886002 CR4: 0000000000770eb0 [ 44.576112] PKRU: 55555554 [ 44.576338] Kernel panic - not syncing: Fatal exception [ 44.576517] Kernel Offset: 0x1a600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
--- fs/ext4/inline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/inline.c +1 -1
@@ -389,7 +389,7 @@ out: }static int ext4_prepare_inline_data (handle_t *handle,struct inode *inode, -unsigned int len) +loff_t len) {int ret, size, no_expand;struct ext4_inode_info *ei =EXT4_I (inode);
Greg Kroah-Hartman
maintainerPATCH 113/222 ext4: fix calculation of credits for extent tree modification
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 32a93f5bc9b9812fc710f43a4d8a6830f91e4988 upstream.
Luis and David are reporting that after running generic/750 test for 90+ hours on 2k ext4 filesystem, they are able to trigger a warning in jbd2_journal_dirty_metadata() complaining that there are not enough credits in the running transaction started in ext4_do_writepages().
Indeed the code in ext4_do_writepages() is racy and the extent tree can change between the time we compute credits necessary for extent tree computation and the time we actually modify the extent tree. Thus it may happen that the number of credits actually needed is higher. Modify ext4_ext_index_trans_blocks() to count with the worst case of maximum tree depth. This can reduce the possible number of writers that can operate in the system in parallel (because the credit estimates now won't fit in one transaction) but for reasonably sized journals this shouldn't really be an issue. So just go with a safe and simple fix.
--- fs/ext4/extents.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/ext4/extents.c +6 -5
@@ -2592,18 +2592,19 @@ int ext4_ext_calc_credits_for_single_extint ext4_ext_index_trans_blocks (struct inode *inode,int extents) {int index; -int depth;/* If we are converting the inline data, only one is needed here. */ if (ext4_has_inline_data (inode))return 1 ; - depth =ext_depth (inode); - +/* +* Extent tree can change between the time we estimate credits and +* the time we actually modify the tree. Assume the worst case. +*/ if (extents <=1 ) - index = depth *2 ; + index =EXT4_MAX_EXTENT_DEPTH *2 ;else - index = depth *3 ; + index =EXT4_MAX_EXTENT_DEPTH *3 ;return index; }
Greg Kroah-Hartman
maintainerPATCH 114/222 Input: ims-pcu - check record size in ims_pcu_flash_firmware()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit a95ef0199e80f3384eb992889322957d26c00102 upstream.
The "len" variable comes from the firmware and we generally do trust firmware, but it's always better to double check. If the "len" is too large it could result in memory corruption when we do "memcpy(fragment->data, rec->data, len);"
--- drivers/input/misc/ims-pcu.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/input/misc/ims-pcu.c +6 -0
@@ -845,6 +845,12 @@ static int ims_pcu_flash_firmware(struct addr =be32_to_cpu (rec->addr) /2 ; len =be16_to_cpu (rec->len); +if (len >sizeof (pcu->cmd_buf) -1 -sizeof (*fragment)) { +dev_err (pcu->dev, +"Invalid record length in firmware: %d\n" , len); +return -EINVAL ; + } + fragment = (void *)&pcu->cmd_buf[1 ];put_unaligned_le32 (addr, &fragment->addr); fragment->len = len;
Greg Kroah-Hartman
maintainerPATCH 115/222 f2fs: prevent kernel warning due to negative i_nlink from corrupted image
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 42cb74a92adaf88061039601ddf7c874f58b554e upstream.
WARNING: CPU: 1 PID: 9426 at fs/inode.c:417 drop_nlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Modules linked in: CPU: 1 UID: 0 PID: 9426 Comm: syz-executor568 Not tainted 6.14.0-12627-g94d471a4f428 #2 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:drop_nlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Code: 48 8b 5d 28 be 08 00 00 00 48 8d bb 70 07 00 00 e8 f9 67 e6 ff f0 48 ff 83 70 07 00 00 5b 5d e9 9a 12 82 ff e8 95 12 82 ff 90 <0f> 0b 90 c7 45 48 ff ff ff ff 5b 5d e9 83 12 82 ff e8 fe 5f e6 ff RSP: 0018:ffffc900026b7c28 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8239710f RDX: ffff888041345a00 RSI: ffffffff8239717b RDI: 0000000000000005 RBP: ffff888054509ad0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff9ab36f08 R12: ffff88804bb40000 R13: ffff8880545091e0 R14: 0000000000008000 R15: ffff8880545091e0 FS: 000055555d0c5880(0000) GS:ffff8880eb3e3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f915c55b178 CR3: 0000000050d20000 CR4: 0000000000352ef0 Call Trace: <task> f2fs_i_links_write home/cc/linux/fs/f2fs/f2fs.h:3194 [inline] f2fs_drop_nlink+0xd1/0x3c0 home/cc/linux/fs/f2fs/dir.c:845 f2fs_delete_entry+0x542/0x1450 home/cc/linux/fs/f2fs/dir.c:909 f2fs_unlink+0x45c/0x890 home/cc/linux/fs/f2fs/namei.c:581 vfs_unlink+0x2fb/0x9b0 home/cc/linux/fs/namei.c:4544 do_unlinkat+0x4c5/0x6a0 home/cc/linux/fs/namei.c:4608 __do_sys_unlink home/cc/linux/fs/namei.c:4654 [inline] __se_sys_unlink home/cc/linux/fs/namei.c:4652 [inline] __x64_sys_unlink+0xc5/0x110 home/cc/linux/fs/namei.c:4652 do_syscall_x64 home/cc/linux/arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x250 home/cc/linux/arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb3d092324b Code: 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66
2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdc232d938 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb3d092324b
RDX: 00007ffdc232d960 RSI: 00007ffdc232d960 RDI: 00007ffdc232d9f0
RBP: 00007ffdc232d9f0 R08: 0000000000000001 R09: 00007ffdc232d7c0
R10: 00000000fffffffd R11: 0000000000000206 R12: 00007ffdc232eaf0
R13: 000055555d0cebb0 R14: 00007ffdc232d958 R15: 0000000000000001
</task>
--- fs/f2fs/namei.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/f2fs/namei.c +9 -0
@@ -536,6 +536,15 @@ static int f2fs_unlink(struct inode *dir goto fail; } +if (unlikely (inode->i_nlink ==0 )) { +f2fs_warn (F2FS_I_SB (inode),"%s: inode (ino=%lx) has zero i_nlink" , + __func__, inode->i_ino); + err = -EFSCORRUPTED ; +set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_FSCK ); +f2fs_put_page (page,0 ); + goto fail; + } +f2fs_balance_fs (sbi, true);f2fs_lock_op (sbi);
Greg Kroah-Hartman
maintainerPATCH 116/222 NFC: nci: uart: Set tty->disc_data only in success path
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit fc27ab48904ceb7e4792f0c400f1ef175edf16fe upstream.
Setting tty->disc_data before opening the NCI device means we need to clean it up on error paths. This also opens some short window if device starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded (broken hardware?). Close the window by exposing tty->disc_data only on the success path, when opening of the NCI device and try_module_get() succeeds.
The code differs in error path in one aspect: tty->disc_data won't be ever assigned thus NULL-ified. This however should not be relevant difference, because of "tty->disc_data=NULL" in nci_uart_tty_open().
--- net/nfc/nci/uart.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/nfc/nci/uart.c +4 -4
@@ -131,22 +131,22 @@ static int nci_uart_set_driver(struct ttmemcpy (nu, nci_uart_drivers[driver],sizeof (struct nci_uart )); nu->tty = tty; - tty->disc_data = nu;skb_queue_head_init (&nu->tx_q);INIT_WORK (&nu->write_work, nci_uart_write_work);spin_lock_init (&nu->rx_lock); ret = nu->ops.open (nu);if (ret) { - tty->disc_data =NULL ;kfree (nu); +return ret; }else if (!try_module_get (nu->owner)) { nu->ops.close (nu); - tty->disc_data =NULL ;kfree (nu);return -ENOENT ; } -return ret; + tty->disc_data = nu; + +return 0 ; }/* ------ LDISC part ------ */
Greg Kroah-Hartman
maintainerPATCH 117/222 EDAC/altera: Use correct write width with the INTTEST register
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <[email protected]>
commit e5ef4cd2a47f27c0c9d8ff6c0f63a18937c071a3 upstream.
On the SoCFPGA platform, the INTTEST register supports only 16-bit writes. A 32-bit write triggers an SError to the CPU so do 16-bit accesses only.
[ bp: AI-massage the commit message. ]
--- drivers/edac/altera_edac.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/edac/altera_edac.c +3 -3
@@ -1804,9 +1804,9 @@ static ssize_t altr_edac_a10_device_triglocal_irq_save (flags);if (trig_type ==ALTR_UE_TRIGGER_CHAR ) -writel (priv->ue_set_mask, set_addr); +writew (priv->ue_set_mask, set_addr);else -writel (priv->ce_set_mask, set_addr); +writew (priv->ce_set_mask, set_addr);/* Ensure the interrupt test bits are set */ wmb ();
@@ -1836,7 +1836,7 @@ static ssize_t altr_edac_a10_device_triglocal_irq_save (flags);if (trig_type ==ALTR_UE_TRIGGER_CHAR ) { -writel (priv->ue_set_mask, set_addr); +writew (priv->ue_set_mask, set_addr); }else {/* Setup read/write of 4 bytes */ writel (ECC_WORD_WRITE , drvdata->base +ECC_BLK_DBYTECTRL_OFST );
Greg Kroah-Hartman
maintainerPATCH 118/222 fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
commit 05f6e183879d9785a3cdf2f08a498bc31b7a20aa upstream.
If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================
The reason is that fb_info->var is being modified in fb_set_var(), and then fb_videomode_to_var() is called. If it fails to add the mode to fb_info->modelist, fb_set_var() returns error, but does not restore the old value of fb_info->var. Restore fb_info->var on failure the same way it is done earlier in the function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/video/fbdev/core/fbmem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/core/fbmem.c +3 -1
@@ -1057,8 +1057,10 @@ fb_set_var(struct fb_info *info, struct !list_empty(&info->modelist)) ret =fb_add_videomode (&mode, &info->modelist); -if (ret) +if (ret) { + info->var = old_var;return ret; + } event.info = info; event.data = &mode;
Greg Kroah-Hartman
maintainerPATCH 119/222 vgacon: Add check for vc_origin address range in vgacon_scroll()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: GONG Ruiqi <[email protected]>
commit 864f9963ec6b4b76d104d595ba28110b87158003 upstream.
Our in-house Syzkaller reported the following BUG (twice), which we believed was the same issue with [1]:
==================================================================
BUG: KASAN: slab-out-of-bounds in vcs_scr_readw+0xc2/0xd0 drivers/tty/vt/vt.c:4740 Read of size 2 at addr ffff88800f5bef60 by task syz.7.2620/12393 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 print_address_description.constprop.0+0x6b/0x3d0 mm/kasan/report.c:364 print_report+0xba/0x280 mm/kasan/report.c:475 kasan_report+0xa9/0xe0 mm/kasan/report.c:588 vcs_scr_readw+0xc2/0xd0 drivers/tty/vt/vt.c:4740 vcs_write_buf_noattr drivers/tty/vt/vc_screen.c:493 [inline] vcs_write+0x586/0x840 drivers/tty/vt/vc_screen.c:690 vfs_write+0x219/0x960 fs/read_write.c:584 ksys_write+0x12e/0x260 fs/read_write.c:639 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 ... </TASK> Allocated by task 5614: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:201 [inline] __do_kmalloc_node mm/slab_common.c:1007 [inline] __kmalloc+0x62/0x140 mm/slab_common.c:1020 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:721 [inline] vc_do_resize+0x235/0xf40 drivers/tty/vt/vt.c:1193 vgacon_adjust_height+0x2d4/0x350 drivers/video/console/vgacon.c:1007 vgacon_font_set+0x1f7/0x240 drivers/video/console/vgacon.c:1031 con_font_set drivers/tty/vt/vt.c:4628 [inline] con_font_op+0x4da/0xa20 drivers/tty/vt/vt.c:4675 vt_k_ioctl+0xa10/0xb30 drivers/tty/vt/vt_ioctl.c:474 vt_ioctl+0x14c/0x1870 drivers/tty/vt/vt_ioctl.c:752 tty_ioctl+0x655/0x1510 drivers/tty/tty_io.c:2779 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x12d/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492 __call_rcu_common.constprop.0+0xc3/0xa10 kernel/rcu/tree.c:2713 netlink_release+0x620/0xc20 net/netlink/af_netlink.c:802 __sock_release+0xb5/0x270 net/socket.c:663 sock_close+0x1e/0x30 net/socket.c:1425 __fput+0x408/0xab0 fs/file_table.c:384 __fput_sync+0x4c/0x60 fs/file_table.c:465 __do_sys_close fs/open.c:1580 [inline] __se_sys_close+0x68/0xd0 fs/open.c:1565 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492 __call_rcu_common.constprop.0+0xc3/0xa10 kernel/rcu/tree.c:2713 netlink_release+0x620/0xc20 net/netlink/af_netlink.c:802 __sock_release+0xb5/0x270 net/socket.c:663 sock_close+0x1e/0x30 net/socket.c:1425 __fput+0x408/0xab0 fs/file_table.c:384 task_work_run+0x154/0x240 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:45 [inline] do_exit+0x8e5/0x1320 kernel/exit.c:874 do_group_exit+0xcd/0x280 kernel/exit.c:1023 get_signal+0x1675/0x1850 kernel/signal.c:2905 arch_do_signal_or_restart+0x80/0x3b0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x1b3/0x1e0 kernel/entry/common.c:218 do_syscall_64+0x66/0x110 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x78/0xe2 The buggy address belongs to the object at ffff88800f5be000 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 2656 bytes to the right of
allocated 1280-byte region [ffff88800f5be000, ffff88800f5be500)
...
Memory state around the buggy address:
ffff88800f5bee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800f5bee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88800f5bef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88800f5bef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800f5bf000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================By analyzing the vmcore, we found that vc->vc_origin was somehow placed one line prior to vc->vc_screenbuf when vc was in KD_TEXT mode, and further writings to /dev/vcs caused out-of-bounds reads (and writes right after) in vcs_write_buf_noattr().
Our further experiments show that in most cases, vc->vc_origin equals to vga_vram_base when the console is in KD_TEXT mode, and it's around vc->vc_screenbuf for the KD_GRAPHICS mode. But via triggerring a TIOCL_SETVESABLANK ioctl beforehand, we can make vc->vc_origin be around vc->vc_screenbuf while the console is in KD_TEXT mode, and then by writing the special 'ESC M' control sequence to the tty certain times (depends on the value of vc->state.y - vc->vc_top), we can eventually move vc->vc_origin prior to vc->vc_screenbuf. Here's the PoC, tested on QEMU:
```
int main() {
const int RI_NUM = 10; // should be greater than `vc->state.y - vc->vc_top`
int tty_fd, vcs_fd;
const char *tty_path = "/dev/tty0";
const char *vcs_path = "/dev/vcs";
const char escape_seq[] = "\x1bM"; // ESC + M
const char trigger_seq[] = "Let's trigger an OOB write.";
struct vt_sizes vt_size = { 70, 2 };
int blank = TIOCL_BLANKSCREEN;
tty_fd = open(tty_path, O_RDWR);
char vesa_mode[] = { TIOCL_SETVESABLANK, 1 };
ioctl(tty_fd, TIOCLINUX, vesa_mode);
ioctl(tty_fd, TIOCLINUX, &blank);
ioctl(tty_fd, VT_RESIZE, &vt_size);
for (int i = 0; i < RI_NUM; ++i)
write(tty_fd, escape_seq, sizeof(escape_seq) - 1);
vcs_fd = open(vcs_path, O_RDWR);
write(vcs_fd, trigger_seq, sizeof(trigger_seq));
close(vcs_fd);
close(tty_fd);
return 0;
}
```To solve this problem, add an address range validation check in vgacon_scroll(), ensuring vc->vc_origin never precedes vc_screenbuf.
--- drivers/video/console/vgacon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/console/vgacon.c +1 -1
@@ -1198,7 +1198,7 @@ static bool vgacon_scroll(struct vc_data c->vc_screenbuf_size - delta); c->vc_origin = vga_vram_end - c->vc_screenbuf_size; vga_rolled_over =0 ; - }else + }else if (oldo - delta >= (unsigned long )c->vc_screenbuf) c->vc_origin -= delta; c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size; scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char,
Greg Kroah-Hartman
maintainerPATCH 120/222 parisc: fix building with gcc-15
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 7cbb015e2d3d6f180256cde0c908eab21268e7b9 upstream.
The decompressor is built with the default C dialect, which is now gnu23 on gcc-15, and this clashes with the kernel's bool type definition:
In file included from include/uapi/linux/posix_types.h:5,
from arch/parisc/boot/compressed/misc.c:7:include/linux/stddef.h:11:9: error: cannot use keyword 'false' as enumeration constant
11 | false = 0,
Add the -std=gnu11 argument here, as we do for all other architectures.
--- arch/parisc/boot/compressed/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/parisc/boot/compressed/Makefile +1 -0
@@ -21,6 +21,7 @@ KBUILD_CFLAGS += -fno-PIE -mno-space-reg ifndef CONFIG_64BIT KBUILD_CFLAGS += -mfast-indirect-calls endif +KBUILD_CFLAGS += -std=gnu11 OBJECTS += $(obj)/head.o $(obj)/real2.o $(obj)/firmware.o $(obj)/misc.o $(obj)/piggy.o
Greg Kroah-Hartman
maintainerPATCH 121/222 ipc: fix to protect IPCS lookups using RCU
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit d66adabe91803ef34a8b90613c81267b5ded1472 upstream.
syzbot reported that it discovered a use-after-free vulnerability, [0]
[0]: https://lore.kernel.org/all/[email protected]/
idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read.
Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned().
--- ipc/shm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
ipc/shm.c +4 -1
@@ -417,8 +417,11 @@ static int shm_try_destroy_orphaned(intvoid shm_destroy_orphaned (struct ipc_namespace *ns) {down_write (&shm_ids (ns).rwsem); -if (shm_ids (ns).in_use) +if (shm_ids (ns).in_use) { +rcu_read_lock ();idr_for_each (&shm_ids (ns).ipcs_idr, &shm_try_destroy_orphaned, ns); +rcu_read_unlock (); + }up_write (&shm_ids (ns).rwsem); }
Greg Kroah-Hartman
maintainerPATCH 122/222 mm: fix ratelimit_pages update error in dirty_ratio_handler()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinliang Zheng <[email protected]>
commit f83f362d40ccceb647f7d80eb92206733d76a36b upstream.
In dirty_ratio_handler(), vm_dirty_bytes must be set to zero before calling writeback_set_ratelimit(), as global_dirty_limits() always prioritizes the value of vm_dirty_bytes.
It's domain_dirty_limits() that's relevant here, not node_dirty_ok:
dirty_ratio_handler
writeback_set_ratelimit
global_dirty_limits(&dirty_thresh) <- ratelimit_pages based on dirty_thresh
domain_dirty_limits
if (bytes) <- bytes = vm_dirty_bytes <--------+
thresh = f1(bytes) <- prioritizes vm_dirty_bytes |
else |
thresh = f2(ratio) |
ratelimit_pages = f3(dirty_thresh) |
vm_dirty_bytes = 0 <- it's late! ---------------------+
This causes ratelimit_pages to still use the value calculated based on vm_dirty_bytes, which is wrong now.
The impact visible to userspace is difficult to capture directly because there is no procfs/sysfs interface exported to user space. However, it will have a real impact on the balance of dirty pages.
For example:
1. On default, we have vm_dirty_ratio=40, vm_dirty_bytes=0
2. echo 8192 > dirty_bytes, then vm_dirty_bytes=8192, vm_dirty_ratio=0, and ratelimit_pages is calculated based on vm_dirty_bytes now.
3. echo 20 > dirty_ratio, then since vm_dirty_bytes is not reset to zero when writeback_set_ratelimit() -> global_dirty_limits() -> domain_dirty_limits() is called, reallimit_pages is still calculated based on vm_dirty_bytes instead of vm_dirty_ratio. This does not conform to the actual intent of the user.
--- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/page-writeback.c +1 -1
@@ -562,8 +562,8 @@ int dirty_ratio_handler(struct ctl_table ret =proc_dointvec_minmax (table, write, buffer, lenp, ppos);if (ret ==0 && write && vm_dirty_ratio != old_ratio) { -writeback_set_ratelimit (); vm_dirty_bytes =0 ; +writeback_set_ratelimit (); }return ret; }
Greg Kroah-Hartman
maintainerPATCH 123/222 mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 44ed1f5ff73e9e115b6f5411744d5a22ea1c855b upstream.
The function sunxi_nfc_hw_ecc_write_chunk() calls the sunxi_nfc_hw_ecc_write_chunk(), but does not call the configuration function sunxi_nfc_randomizer_config(). Consequently, the randomization might not conduct correctly, which will affect the lifespan of NAND flash. A proper implementation can be found in sunxi_nfc_hw_ecc_write_page_dma().
Add the sunxi_nfc_randomizer_config() to config randomizer.
--- drivers/mtd/nand/raw/sunxi_nand.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/nand/raw/sunxi_nand.c +1 -0
@@ -1045,6 +1045,7 @@ static int sunxi_nfc_hw_ecc_write_chunk(if (ret)return ret; +sunxi_nfc_randomizer_config (nand, page, false);sunxi_nfc_randomizer_enable (nand);sunxi_nfc_hw_ecc_set_prot_oob_bytes (nand, oob,0 , bbm, page);
Greg Kroah-Hartman
maintainerPATCH 124/222 mtd: nand: sunxi: Add randomizer configuration before randomizer enable
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 4a5a99bc79cdc4be63933653682b0261a67a0c9f upstream.
In sunxi_nfc_hw_ecc_read_chunk(), the sunxi_nfc_randomizer_enable() is called without the config of randomizer. A proper implementation can be found in sunxi_nfc_hw_ecc_read_chunks_dma().
Add sunxi_nfc_randomizer_config() before the start of randomization.
--- drivers/mtd/nand/raw/sunxi_nand.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/nand/raw/sunxi_nand.c +1 -0
@@ -818,6 +818,7 @@ static int sunxi_nfc_hw_ecc_read_chunk(sif (ret)return ret; +sunxi_nfc_randomizer_config (nand, page, false);sunxi_nfc_randomizer_enable (nand);writel (NFC_DATA_TRANS |NFC_DATA_SWAP_METHOD |NFC_ECC_OP , nfc->regs +NFC_REG_CMD );
Greg Kroah-Hartman
maintainerPATCH 125/222 dm-mirror: fix a tiny race condition
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 829451beaed6165eb11d7a9fb4e28eb17f489980 upstream.
There's a tiny race condition in dm-mirror. The functions queue_bio and write_callback grab a spinlock, add a bio to the list, drop the spinlock and wake up the mirrord thread that processes bios in the list.
It may be possible that the mirrord thread processes the bio just after spin_unlock_irqrestore is called, before wakeup_mirrord. This spurious wake-up is normally harmless, however if the device mapper device is unloaded just after the bio was processed, it may be possible that wakeup_mirrord(ms) uses invalid "ms" pointer.
Fix this bug by moving wakeup_mirrord inside the spinlock.
--- drivers/md/dm-raid1.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/md/dm-raid1.c +2 -3
@@ -128,10 +128,9 @@ static void queue_bio(struct mirror_setspin_lock_irqsave (&ms->lock, flags); should_wake = !(bl->head);bio_list_add (bl, bio); -spin_unlock_irqrestore (&ms->lock, flags); -if (should_wake)wakeup_mirrord (ms); +spin_unlock_irqrestore (&ms->lock, flags); }static void dispatch_bios (void *context,struct bio_list *bio_list)
@@ -638,9 +637,9 @@ static void write_callback(unsigned longif (!ms->failures.head) should_wake =1 ;bio_list_add (&ms->failures, bio); -spin_unlock_irqrestore (&ms->lock, flags);if (should_wake)wakeup_mirrord (ms); +spin_unlock_irqrestore (&ms->lock, flags); }static void do_write (struct mirror_set *ms,struct bio *bio)
Greg Kroah-Hartman
maintainerPATCH 126/222 ftrace: Fix UAF when lookup kallsym after ftrace disabled
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit f914b52c379c12288b7623bb814d0508dbe7481d upstream.
The following issue happens with a buggy module:
BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS RIP: 0010:sized_strscpy+0x81/0x2f0 RSP: 0018:ffff88812d76fa08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000 RDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d RBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68 R10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038 R13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff FS: 00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ftrace_mod_get_kallsym+0x1ac/0x590 update_iter_mod+0x239/0x5b0 s_next+0x5b/0xa0 seq_read_iter+0x8c9/0x1070 seq_read+0x249/0x3b0 proc_reg_read+0x1b0/0x280 vfs_read+0x17f/0x920 ksys_read+0xf3/0x1c0 do_syscall_64+0x5f/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The above issue may happen as follows:
(1) Add kprobe tracepoint;
(2) insmod test.ko;
(3) Module triggers ftrace disabled;
(4) rmmod test.ko;
(5) cat /proc/kallsyms; --> Will trigger UAF as test.ko already removed; ftrace_mod_get_kallsym()
...strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN);
...
The problem is when a module triggers an issue with ftrace and sets ftrace_disable. The ftrace_disable is set when an anomaly is discovered and to prevent any more damage, ftrace stops all text modification. The issue that happened was that the ftrace_disable stops more than just the text modification.
When a module is loaded, its init functions can also be traced. Because kallsyms deletes the init functions after a module has loaded, ftrace saves them when the module is loaded and function tracing is enabled. This allows the output of the function trace to show the init function names instead of just their raw memory addresses.
When a module is removed, ftrace_release_mod() is called, and if ftrace_disable is set, it just returns without doing anything more. The problem here is that it leaves the mod_list still around and if kallsyms is called, it will call into this code and access the module memory that has already been freed as it will return:
strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN);
Where the "mod" no longer exists and triggers a UAF bug.
--- kernel/trace/ftrace.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
kernel/trace/ftrace.c +7 -3
@@ -5855,9 +5855,10 @@ void ftrace_release_mod(struct module *mmutex_lock (&ftrace_lock); -if (ftrace_disabled) - goto out_unlock; - +/* +* To avoid the UAF problem after the module is unloaded, the +* 'mod_map' resource needs to be released unconditionally. +*/ list_for_each_entry_safe (mod_map, n, &ftrace_mod_maps, list) {if (mod_map->mod == mod) {list_del_rcu (&mod_map->list);
@@ -5866,6 +5867,9 @@ void ftrace_release_mod(struct module *m } } +if (ftrace_disabled) + goto out_unlock; +/* * Each module has its own ftrace_pages, remove * them from the list.
Greg Kroah-Hartman
maintainerPATCH 127/222 net: ch9200: fix uninitialised access during mii_nway_restart
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit 9ad0452c0277b816a435433cca601304cfac7c21 upstream.
In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff", which is initialised with control_read(). However "buff" is conditionally initialised inside control_read():
if (err == size) {
memcpy(data, buf, size);
}If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200_mdio_read():
return (buff[0] | buff[1] << 8);
The problem stems from the fact that ch9200_mdio_read() ignores the return value of control_read(), leading to uinit-access of "buff".
To fix this we should check the return value ofcontrol_read() and return early on error.
--- drivers/net/usb/ch9200.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/usb/ch9200.c +5 -2
@@ -180,6 +180,7 @@ static int ch9200_mdio_read(struct net_d {struct usbnet *dev =netdev_priv (netdev);unsigned char buff[2 ]; +int ret;netdev_dbg (netdev,"ch9200_mdio_read phy_id:%02x loc:%02x\n" , phy_id, loc);
@@ -187,8 +188,10 @@ static int ch9200_mdio_read(struct net_dif (phy_id !=0 )return -ENODEV ; -control_read (dev,REQUEST_READ ,0 , loc *2 , buff,0x02 , -CONTROL_TIMEOUT_MS ); + ret =control_read (dev,REQUEST_READ ,0 , loc *2 , buff,0x02 , +CONTROL_TIMEOUT_MS ); +if (ret <0 ) +return ret;return (buff[0 ] | buff[1 ] <<8 ); }
Greg Kroah-Hartman
maintainerPATCH 128/222 staging: iio: ad5933: Correct settling cycles encoding per datasheet
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Shahrouzi <[email protected]>
commit 60638e2a2d4bc03798f00d5ab65ce9b83cb8b03b upstream.
The AD5933 datasheet (Table 13) lists the maximum cycles to be 0x7FC (2044).
Clamp the user input to the maximum effective value of 0x7FC cycles.
--- drivers/staging/iio/impedance-analyzer/ad5933.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/impedance-analyzer/ad5933.c +1 -1
@@ -412,7 +412,7 @@ static ssize_t ad5933_store(struct devic ret =ad5933_cmd (st,0 );break ;case AD5933_OUT_SETTLING_CYCLES : - val =clamp (val, (u16 )0 , (u16 )0x7FF ); + val =clamp (val, (u16 )0 , (u16 )0x7FC ); st->settling_cycles = val;/* 2x, 4x handling, see datasheet */
Greg Kroah-Hartman
maintainerPATCH 129/222 mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khem Raj <[email protected]>
commit 0f4ae7c6ecb89bfda026d210dcf8216fb67d2333 upstream.
GCC 15 changed the default C standard dialect from gnu17 to gnu23, which should not have impacted the kernel because it explicitly requests the gnu11 standard in the main Makefile. However, mips/vdso code uses its own CFLAGS without a '-std=' value, which break with this dialect change because of the kernel's own definitions of bool, false, and true conflicting with the C23 reserved keywords.
include/linux/stddef.h:11:9: error: cannot use keyword 'false' as enumeration constant
11 | false = 0,
| ^~~~~
include/linux/stddef.h:11:9: note: 'false' is a keyword with '-std=c23' onwards
include/linux/types.h:35:33: error: 'bool' cannot be defined via 'typedef'
35 | typedef _Bool bool;
| ^~~~ include/linux/types.h:35:33: note: 'bool' is a keyword with '-std=c23' onwards
Add -std as specified in KBUILD_CFLAGS to the decompressor and purgatory CFLAGS to eliminate these errors and make the C standard version of these areas match the rest of the kernel.
--- arch/mips/vdso/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/mips/vdso/Makefile +1 -0
@@ -25,6 +25,7 @@ ccflags-vdso := \ # offsets. cflags-vdso := $(ccflags-vdso) \ $(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \ + $(filter -std=%,$(KBUILD_CFLAGS)) \ -O3 -g -fPIC -fno-strict-aliasing -fno-common -fno-builtin -G 0 \ -fno-stack-protector -fno-jump-tables -DDISABLE_BRANCH_PROFILING \ $(call cc-option, -fno-asynchronous-unwind-tables) \
Greg Kroah-Hartman
maintainerPATCH 130/222 regulator: max14577: Add error check for max14577_read_reg()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 65271f868cb1dca709ff69e45939bbef8d6d0b70 upstream.
The function max14577_reg_get_current_limit() calls the function max14577_read_reg(), but does not check its return value. A proper implementation can be found in max14577_get_online().
Add a error check for the max14577_read_reg() and return error code if the function fails.
--- drivers/regulator/max14577-regulator.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/regulator/max14577-regulator.c +4 -1
@@ -40,11 +40,14 @@ static int max14577_reg_get_current_limistruct max14577 *max14577 =rdev_get_drvdata (rdev);const struct maxim_charger_current *limits = &maxim_charger_currents[max14577->dev_type]; +int ret;if (rdev_get_id (rdev) !=MAX14577_CHARGER )return -EINVAL ; -max14577_read_reg (rmap,MAX14577_CHG_REG_CHG_CTRL4 , ®_data); + ret =max14577_read_reg (rmap,MAX14577_CHG_REG_CHG_CTRL4 , ®_data); +if (ret <0 ) +return ret;if ((reg_data &CHGCTRL4_MBCICHWRCL_MASK ) ==0 )return limits->min;
Greg Kroah-Hartman
maintainerPATCH 131/222 uio_hv_generic: Use correct size for interrupt and monitor pages
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit c951ab8fd3589cf6991ed4111d2130816f2e3ac2 upstream.
Interrupt and monitor pages should be in Hyper-V page size (4k bytes). This can be different from the system page size.
This size is read and used by the user-mode program to determine the mapped data region. An example of such user-mode program is the VMBus driver in DPDK.
Message-ID: <[email protected]>
--- drivers/uio/uio_hv_generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/uio/uio_hv_generic.c +2 -2
@@ -288,13 +288,13 @@ hv_uio_probe(struct hv_device *dev, pdata->info.mem[INT_PAGE_MAP ].name ="int_page" ; pdata->info.mem[INT_PAGE_MAP ].addr = (uintptr_t )vmbus_connection.int_page; - pdata->info.mem[INT_PAGE_MAP ].size =PAGE_SIZE ; + pdata->info.mem[INT_PAGE_MAP ].size =HV_HYP_PAGE_SIZE ; pdata->info.mem[INT_PAGE_MAP ].memtype =UIO_MEM_LOGICAL ; pdata->info.mem[MON_PAGE_MAP ].name ="monitor_page" ; pdata->info.mem[MON_PAGE_MAP ].addr = (uintptr_t )vmbus_connection.monitor_pages[1 ]; - pdata->info.mem[MON_PAGE_MAP ].size =PAGE_SIZE ; + pdata->info.mem[MON_PAGE_MAP ].size =HV_HYP_PAGE_SIZE ; pdata->info.mem[MON_PAGE_MAP ].memtype =UIO_MEM_LOGICAL ; pdata->recv_buf =vzalloc (RECV_BUFFER_SIZE );
Greg Kroah-Hartman
maintainerPATCH 132/222 PCI: Add ACS quirk for Loongson PCIe
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 1f3303aa92e15fa273779acac2d0023609de30f1 upstream.
Loongson PCIe Root Ports don't advertise an ACS capability, but they do not allow peer-to-peer transactions between Root Ports. Add an ACS quirk so each Root Port can be in a separate IOMMU group.
--- drivers/pci/quirks.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/pci/quirks.c +23 -0
@@ -4869,6 +4869,18 @@ static int pci_quirk_brcm_acs(struct pci PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); } +static int pci_quirk_loongson_acs (struct pci_dev *dev,u16 acs_flags) +{ +/* +* Loongson PCIe Root Ports don't advertise an ACS capability, but +* they do not allow peer-to-peer transactions between Root Ports. +* Allow each Root Port to be in a separate IOMMU group by masking +* SV/RR/CR/UF bits. +*/ +return pci_acs_ctrl_enabled (acs_flags, +PCI_ACS_SV |PCI_ACS_RR |PCI_ACS_CR |PCI_ACS_UF ); +} +/* * Wangxun 40G/25G/10G/1G NICs have no ACS capability, but on * multi-function devices, the hardware isolates the functions by
@@ -5002,6 +5014,17 @@ static const struct pci_dev_acs_enabled { PCI_VENDOR_ID_BROADCOM, 0x1762, pci_quirk_mf_endpoint_acs }, { PCI_VENDOR_ID_BROADCOM, 0x1763, pci_quirk_mf_endpoint_acs }, { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, +/* Loongson PCIe Root Ports */ + { PCI_VENDOR_ID_LOONGSON, 0x3C09, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x3C19, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x3C29, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A09, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A19, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A29, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A39, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A49, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A59, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A69, pci_quirk_loongson_acs },/* Amazon Annapurna Labs */ { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs }, /* Zhaoxin multi-function devices */
Greg Kroah-Hartman
maintainerPATCH 133/222 PCI: Fix lock symmetry in pci_slot_unlock()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit f3efb9569b4a21354ef2caf7ab0608a3e14cc6e4 upstream.
The commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") made the lock function to call depend on dev->subordinate but left pci_slot_unlock() unmodified creating locking asymmetry compared with pci_slot_lock().
Because of the asymmetric lock handling, the same bridge device is unlocked twice. First pci_bus_unlock() unlocks bus->self and then pci_slot_unlock() will unconditionally unlock the same bridge device.
Move pci_dev_unlock() inside an else branch to match the logic in pci_slot_lock().
--- drivers/pci/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/pci.c +2 -1
@@ -5296,7 +5296,8 @@ static void pci_slot_unlock(struct pci_scontinue ;if (dev->subordinate)pci_bus_unlock (dev->subordinate); -pci_dev_unlock (dev); +else +pci_dev_unlock (dev); } }
Greg Kroah-Hartman
maintainerPATCH 134/222 iio: adc: ad7606_spi: fix reg write value mask
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 89944d88f8795c6c89b9514cb365998145511cd4 upstream.
Fix incorrect value mask for register write. Register values are 8-bit, not 9. If this function was called with a value > 0xFF and an even addr, it would cause writing to the next register.
--- drivers/iio/adc/ad7606_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7606_spi.c +1 -1
@@ -151,7 +151,7 @@ static int ad7606_spi_reg_write(struct astruct spi_device *spi =to_spi_device (st->dev); st->d16[0 ] =cpu_to_be16 ((st->bops->rd_wr_cmd (addr,1 ) <<8 ) | - (val &0x1FF )); + (val &0xFF ));return spi_write (spi, &st->d16[0 ],sizeof (st->d16[0 ])); }
Greg Kroah-Hartman
maintainerPATCH 135/222 ACPICA: fix acpi operand cache leak in dswstate.c
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seunghun Han <[email protected]>
[ Upstream commit 156fd20a41e776bbf334bd5e45c4f78dfc90ce1c ]
ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732
I found an ACPI cache leak in ACPI early termination and boot continuing case.
When early termination occurs due to malicious ACPI table, Linux kernel terminates ACPI function and continues to boot process. While kernel terminates ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.
Boot log of ACPI operand cache leak is as follows:
Quoted 32 lines
[ 0.585957] ACPI: Added _OSI(Module Device) [ 0.587218] ACPI: Added _OSI(Processor Device) [ 0.588530] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.589790] ACPI: Added _OSI(Processor Aggregator Device) [ 0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155) [ 0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88) [ 0.597858] ACPI: Unable to start the ACPI Interpreter [ 0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects [ 0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26 [ 0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.609177] Call Trace: [ 0.610063] ? dump_stack+0x5c/0x81 [ 0.611118] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.612632] ? acpi_sleep_proc_init+0x27/0x27 [ 0.613906] ? acpi_os_delete_cache+0xa/0x10 [ 0.617986] ? acpi_ut_delete_caches+0x3f/0x7b [ 0.619293] ? acpi_terminate+0xa/0x14 [ 0.620394] ? acpi_init+0x2af/0x34f [ 0.621616] ? __class_create+0x4c/0x80 [ 0.623412] ? video_setup+0x7f/0x7f [ 0.624585] ? acpi_sleep_proc_init+0x27/0x27 [ 0.625861] ? do_one_initcall+0x4e/0x1a0 [ 0.627513] ? kernel_init_freeable+0x19e/0x21f [ 0.628972] ? rest_init+0x80/0x80 [ 0.630043] ? kernel_init+0xa/0x100 [ 0.631084] ? ret_from_fork+0x25/0x30 [ 0.633343] vgaarb: loaded [ 0.635036] EDAC MC: Ver: 3.0.0 [ 0.638601] PCI: Probing PCI hardware [ 0.639833] PCI host bridge to bus 0000:00 [ 0.641031] pci_bus 0000:00: root bus resource [io 0x0000-0xffff]
Quoted 1 line
... Continue to boot and log is omitted ...
I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_ delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push() function uses walk_state->operand_index for start position of the top, but acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it. Therefore, this causes acpi operand memory leak.
This cache leak causes a security threat because an old kernel (<= 4.9) shows memory locations of kernel functions in stack dump. Some malicious users could use this information to neutralize kernel ASLR.
I made a patch to fix ACPI operand cache leak.
--- drivers/acpi/acpica/dsutils.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/acpi/acpica/dsutils.c +8 -1
@@ -668,6 +668,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS ];u32 arg_count =0 ;u32 index = walk_state->num_operands; +u32 prev_num_operands = walk_state->num_operands; +u32 new_num_operands;u32 i;ACPI_FUNCTION_TRACE_PTR (ds_create_operands, first_arg);
@@ -696,6 +698,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,/* Create the interpreter arguments, in reverse order */ + new_num_operands = index; index--;for (i =0 ; i < arg_count; i++) { arg = arguments[index];
@@ -720,7 +723,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,* pop everything off of the operand stack and delete those * objects */ -acpi_ds_obj_stack_pop_and_delete (arg_count, walk_state); + walk_state->num_operands = i; +acpi_ds_obj_stack_pop_and_delete (new_num_operands, walk_state); + +/* Restore operand count */ + walk_state->num_operands = prev_num_operands;ACPI_EXCEPTION ((AE_INFO , status,"While creating Arg %u" , index));return_ACPI_STATUS (status);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/222 ACPICA: Avoid sequence overread in call to strncmp()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed Salem <[email protected]>
[ Upstream commit 64b9dfd0776e9c38d733094859a09f13282ce6f8 ]
ACPICA commit 8b83a8d88dfec59ea147fad35fc6deea8859c58c
ap_get_table_length() checks if tables are valid by calling ap_is_valid_header(). The latter then calls ACPI_VALIDATE_RSDP_SIG(Table->Signature).
ap_is_valid_header() accepts struct acpi_table_header as an argument, so the signature size is always fixed to 4 bytes.
The problem is when the string comparison is between ACPI-defined table signature and ACPI_SIG_RSDP. Common ACPI table header specifies the Signature field to be 4 bytes long[1], with the exception of the RSDP structure whose signature is 8 bytes long "RSD PTR " (including the trailing blank character)[2]. Calling strncmp(sig, rsdp_sig, 8) would then result in a sequence overread[3] as sig would be smaller (4 bytes) than the specified bound (8 bytes).
As a workaround, pass the bound conditionally based on the size of the signature being passed.
--- include/acpi/actypes.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/acpi/actypes.h +1 -1
@@ -524,7 +524,7 @@ typedef u64 acpi_integer;/* Support for the special RSDP signature (8 characters) */ -#define ACPI_VALIDATE_RSDP_SIG (a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, 8)) +#define ACPI_VALIDATE_RSDP_SIG (a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, (sizeof(a) < 8) ? ACPI_NAMESEG_SIZE : 8))#define ACPI_MAKE_RSDP_SIG (dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8))/* Support for OEMx signature (x can be any character) */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/222 ACPICA: fix acpi parse and parseext cache leaks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seunghun Han <[email protected]>
[ Upstream commit bed18f0bdcd6737a938264a59d67923688696fc4 ]
ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5
I'm Seunghun Han, and I work for National Security Research Institute of South Korea.
I have been doing a research on ACPI and found an ACPI cache leak in ACPI early abort cases.
Boot log of ACPI cache leak is as follows:
[ 0.352414] ACPI: Added _OSI(Module Device) [ 0.353182] ACPI: Added _OSI(Processor Device) [ 0.353182] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.353182] ACPI: Added _OSI(Processor Aggregator Device) [ 0.356028] ACPI: Unable to start the ACPI Interpreter [ 0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects [ 0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #10 [ 0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.361873] Call Trace: [ 0.362243] ? dump_stack+0x5c/0x81 [ 0.362591] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.362944] ? acpi_sleep_proc_init+0x27/0x27 [ 0.363296] ? acpi_os_delete_cache+0xa/0x10 [ 0.363646] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.364000] ? acpi_terminate+0xa/0x14 [ 0.364000] ? acpi_init+0x2af/0x34f [ 0.364000] ? __class_create+0x4c/0x80 [ 0.364000] ? video_setup+0x7f/0x7f [ 0.364000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.364000] ? do_one_initcall+0x4e/0x1a0 [ 0.364000] ? kernel_init_freeable+0x189/0x20a [ 0.364000] ? rest_init+0xc0/0xc0 [ 0.364000] ? kernel_init+0xa/0x100 [ 0.364000] ? ret_from_fork+0x25/0x30
I analyzed this memory leak in detail. I found that “Acpi-State” cache and “Acpi-Parse” cache were merged because the size of cache objects was same slab cache size.
I finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked using SLAB_NEVER_MERGE flag in kmem_cache_create() function.
Real ACPI cache leak point is as follows:
[ 0.360101] ACPI: Added _OSI(Module Device) [ 0.360101] ACPI: Added _OSI(Processor Device) [ 0.360101] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.361043] ACPI: Added _OSI(Processor Aggregator Device) [ 0.364016] ACPI: Unable to start the ACPI Interpreter [ 0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects [ 0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #8 [ 0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.372000] Call Trace: [ 0.372000] ? dump_stack+0x5c/0x81 [ 0.372000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.372000] ? acpi_os_delete_cache+0xa/0x10 [ 0.372000] ? acpi_ut_delete_caches+0x56/0x7b [ 0.372000] ? acpi_terminate+0xa/0x14 [ 0.372000] ? acpi_init+0x2af/0x34f [ 0.372000] ? __class_create+0x4c/0x80 [ 0.372000] ? video_setup+0x7f/0x7f [ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.372000] ? do_one_initcall+0x4e/0x1a0 [ 0.372000] ? kernel_init_freeable+0x189/0x20a [ 0.372000] ? rest_init+0xc0/0xc0 [ 0.372000] ? kernel_init+0xa/0x100 [ 0.372000] ? ret_from_fork+0x25/0x30 [ 0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects [ 0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #8 [ 0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.392000] Call Trace: [ 0.392000] ? dump_stack+0x5c/0x81 [ 0.392000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.392000] ? acpi_os_delete_cache+0xa/0x10 [ 0.392000] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.392000] ? acpi_terminate+0xa/0x14 [ 0.392000] ? acpi_init+0x2af/0x34f [ 0.392000] ? __class_create+0x4c/0x80 [ 0.392000] ? video_setup+0x7f/0x7f [ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.392000] ? do_one_initcall+0x4e/0x1a0 [ 0.392000] ? kernel_init_freeable+0x189/0x20a [ 0.392000] ? rest_init+0xc0/0xc0 [ 0.392000] ? kernel_init+0xa/0x100 [ 0.392000] ? ret_from_fork+0x25/0x30
When early abort is occurred due to invalid ACPI information, Linux kernel terminates ACPI by calling acpi_terminate() function. The function calls acpi_ut_delete_caches() function to delete local caches (acpi_gbl_namespace_ cache, state_cache, operand_cache, ps_node_cache, ps_node_ext_cache).
But the deletion codes in acpi_ut_delete_caches() function only delete slab caches using kmem_cache_destroy() function, therefore the cache objects should be flushed before acpi_ut_delete_caches() function.
"Acpi-Parse" cache and "Acpi-ParseExt" cache are used in an AML parse function, acpi_ps_parse_loop(). The function should complete all ops using acpi_ps_complete_final_op() when an error occurs due to invalid AML codes.
However, the current implementation of acpi_ps_complete_final_op() does not complete all ops when it meets some errors and this cause cache leak.
This cache leak has a security threat because an old kernel (<= 4.9) shows memory locations of kernel functions in stack dump. Some malicious users could use this information to neutralize kernel ASLR.
To fix ACPI cache leak for enhancing security, I made a patch to complete all ops unconditionally for acpi_ps_complete_final_op() function.
I hope that this patch improves the security of Linux kernel.
Thank you.
--- drivers/acpi/acpica/psobject.c | 52 ++++++++++------------------------ 1 file changed, 15 insertions(+), 37 deletions(-)
drivers/acpi/acpica/psobject.c +15 -37
@@ -639,7 +639,8 @@ acpi_status acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, union acpi_parse_object *op, acpi_status status) { - acpi_status status2; + acpi_status return_status = status; +u8 ascending = TRUE;ACPI_FUNCTION_TRACE_PTR (ps_complete_final_op, walk_state);
@@ -653,7 +654,7 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, op)); do { if (op) { - if (walk_state->ascending_callback != NULL) { + if (ascending && walk_state->ascending_callback != NULL) { walk_state->op = op; walk_state->op_info = acpi_ps_get_opcode_info(op->common.
@@ -675,49 +676,26 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, }if (status ==AE_CTRL_TERMINATE ) { - status =AE_OK ; - -/* Clean up */ -do { -if (op) { - status2 = -acpi_ps_complete_this_op - (walk_state, op); -if (ACPI_FAILURE - (status2)) { -return_ACPI_STATUS - (status2); - } - } - -acpi_ps_pop_scope (& - (walk_state-> - parser_state), - &op, - &walk_state-> - arg_types, - &walk_state-> - arg_count); - - }while (op); - -return_ACPI_STATUS (status); + ascending = FALSE; + return_status =AE_CTRL_TERMINATE ; }else if (ACPI_FAILURE (status)) {/* First error is most important */ - (void ) -acpi_ps_complete_this_op (walk_state, - op); -return_ACPI_STATUS (status); + ascending = FALSE; + return_status = status; } } - status2 =acpi_ps_complete_this_op (walk_state, op); -if (ACPI_FAILURE (status2)) { -return_ACPI_STATUS (status2); + status =acpi_ps_complete_this_op (walk_state, op); +if (ACPI_FAILURE (status)) { + ascending = FALSE; +if (ACPI_SUCCESS (return_status) || + return_status ==AE_CTRL_TERMINATE ) { + return_status = status; + } } }
@@ -727,5 +705,5 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, }while (op); -return_ACPI_STATUS (status); +return_ACPI_STATUS (return_status); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/222 power: supply: bq27xxx: Retrieve again when busy
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Lv <[email protected]>
[ Upstream commit f16d9fb6cf03fdbdefa41a8b32ba1e57afb7ae3d ]
Multiple applications may access the battery gauge at the same time, so the gauge may be busy and EBUSY will be returned. The driver will set a flag to record the EBUSY state, and this flag will be kept until the next periodic update. When this flag is set, bq27xxx_battery_get_property() will just return ENODEV until the flag is updated.
Even if the gauge was busy during the last accessing attempt, returning ENODEV is not ideal, and can cause confusion in the applications layer.
Instead, retry accessing the I2C to update the flag is as expected, for the gauge typically recovers from busy state within a few milliseconds. If still failed to access the gauge, the real error code would be returned instead of ENODEV (as suggested by Pali Rohár).
--- drivers/power/supply/bq27xxx_battery.c | 2 +- drivers/power/supply/bq27xxx_battery_i2c.c | 13 ++++++++++++- 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/power/supply/bq27xxx_battery.c +1 -1
@@ -1780,7 +1780,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy,mutex_unlock (&di->lock);if (psp !=POWER_SUPPLY_PROP_PRESENT && di->cache.flags <0 ) -return -ENODEV ; +return di->cache.flags;switch (psp) {case POWER_SUPPLY_PROP_STATUS :
drivers/power/supply/bq27xxx_battery_i2c.c +12 -1
@@ -14,6 +14,7 @@* GNU General Public License for more details. */ +#include <linux/delay.h> #include <linux/i2c.h> #include <linux/interrupt.h> #include <linux/module.h>
@@ -40,6 +41,7 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg,struct i2c_msg msg[2 ];u8 data[2 ];int ret; +int retry =0 ;if (!client->adapter)return -ENODEV ;
@@ -56,7 +58,16 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg,else msg[1 ].len =2 ; - ret =i2c_transfer (client->adapter, msg,ARRAY_SIZE (msg)); +do { + ret =i2c_transfer (client->adapter, msg,ARRAY_SIZE (msg)); +if (ret == -EBUSY && ++retry <3 ) { +/* sleep 10 milliseconds when busy */ +usleep_range (10000 ,11000 ); +continue ; + } +break ; + }while (1 ); +if (ret <0 )return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/222 PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charan Teja Kalla <[email protected]>
[ Upstream commit 40d3b40dce375d6f1c1dbf08d79eed3aed6c691d ]
pm_runtime_put_autosuspend() schedules a hrtimer to expire at "dev->power.timer_expires". If the hrtimer's callback, pm_suspend_timer_fn(), observes that the current time equals "dev->power.timer_expires", it unexpectedly bails out instead of proceeding with runtime suspend.
pm_suspend_timer_fn():
if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
dev->power.timer_expires = 0; rpm_suspend(..)
}
Additionally, as ->timer_expires is not cleared, all the future auto suspend requests will not schedule hrtimer to perform auto suspend.
rpm_suspend():
if ((rpmflags & RPM_AUTO) &&...) {
if (!(dev->power.timer_expires && ...) { <-- this will fail.
hrtimer_start_range_ns(&dev->power.suspend_timer,...);
}
}
Fix this by as well checking if current time reaches the set expiration.
--- drivers/base/power/runtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/runtime.c +1 -1
@@ -982,7 +982,7 @@ static enum hrtimer_restart pm_suspend_timer_fn(struct hrtimer *timer)* If 'expires' is after the current time, we've been called * too early. */ -if (expires >0 && expires <ktime_get_mono_fast_ns ()) { +if (expires >0 && expires <=ktime_get_mono_fast_ns ()) { dev->power.timer_expires =0 ;rpm_suspend (dev, dev->power.timer_autosuspends ? (RPM_ASYNC |RPM_AUTO ) :RPM_ASYNC );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/222 ACPI: battery: negate current when discharging
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Marheine <[email protected]>
[ Upstream commit 234f71555019d308c6bc6f98c78c5551cb8cd56a ]
The ACPI specification requires that battery rate is always positive, but the kernel ABI for POWER_SUPPLY_PROP_CURRENT_NOW (Documentation/ABI/testing/sysfs-class-power) specifies that it should be negative when a battery is discharging. When reporting CURRENT_NOW, massage the value to match the documented ABI.
This only changes the sign of current_now and not power_now because documentation doesn't describe any particular meaning for power_now so leaving power_now unchanged is less likely to confuse userspace unnecessarily, whereas becoming consistent with the documented ABI is worth potentially confusing clients that read current_now.
--- drivers/acpi/battery.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/acpi/battery.c +16 -3
@@ -266,10 +266,23 @@ static int acpi_battery_get_property(struct power_supply *psy,break ;case POWER_SUPPLY_PROP_CURRENT_NOW :case POWER_SUPPLY_PROP_POWER_NOW : -if (battery->rate_now ==ACPI_BATTERY_VALUE_UNKNOWN ) +if (battery->rate_now ==ACPI_BATTERY_VALUE_UNKNOWN ) { ret = -ENODEV ; -else - val->intval = battery->rate_now *1000 ; +break ; + } + + val->intval = battery->rate_now *1000 ; +/* +* When discharging, the current should be reported as a +* negative number as per the power supply class interface +* definition. +*/ +if (psp ==POWER_SUPPLY_PROP_CURRENT_NOW && + (battery->state &ACPI_BATTERY_STATE_DISCHARGING ) && +acpi_battery_handle_discharging (battery) + ==POWER_SUPPLY_STATUS_DISCHARGING ) + val->intval = -val->intval; +break ;case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN :case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/222 drm/amdgpu/gfx6: fix CSIB handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 8307ebc15c1ea98a8a0b7837af1faa6c01514577 ]
We shouldn't return after the last section.
We need to update the rest of the CSIB.
--- drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +0 -2
@@ -2901,8 +2901,6 @@ static void gfx_v6_0_get_csb_buffer(struct amdgpu_device *adev, buffer[count++] =cpu_to_le32 (ext->reg_index -0xa000 );for (i =0 ; i < ext->reg_count; i++) buffer[count++] =cpu_to_le32 (ext->extent[i]); - }else { -return ; } } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/222 sunrpc: update nextcheck time when adding new cache entries
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit 5ca00634c8bbb2979c73465588f486b9632f5ed5 ]
The cache_detail structure uses a "nextcheck" field to control hash table scanning intervals. When a table scan begins, nextcheck is set to current time plus 1800 seconds. During scanning, if cache_detail is not empty and a cache entry's expiry time is earlier than the current nextcheck, the nextcheck is updated to that expiry time.
This mechanism ensures that:
1) Empty cache_details are scanned every 1800 seconds to avoid unnecessary scans
2) Non-empty cache_details are scanned based on the earliest expiry time found
However, when adding a new cache entry to an empty cache_detail, the nextcheck time was not being updated, remaining at 1800 seconds. This could delay cache cleanup for up to 1800 seconds, potentially blocking threads(such as nfsd) that are waiting for cache cleanup.
Fix this by updating the nextcheck time whenever a new cache entry is added.
--- net/sunrpc/cache.c | 2 ++ 1 file changed, 2 insertions(+)
net/sunrpc/cache.c +2 -0
@@ -114,6 +114,8 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail,hlist_add_head_rcu (&new->cache_list, head); detail->entries++; +if (detail->nextcheck > new->expiry_time) + detail->nextcheck = new->expiry_time +1 ;cache_get (new);spin_unlock (&detail->hash_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/222 drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damon Ding <[email protected]>
[ Upstream commit efab13e7d13a641a22c7508cde6e1a5285161944 ]
The IRQF_NO_AUTOEN can be used for the drivers that don't want interrupts to be enabled automatically via devm_request_threaded_irq(). Using this flag can provide be more robust compared to the way of calling disable_irq() after devm_request_threaded_irq() without the IRQF_NO_AUTOEN flag.
--- drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +2 -3
@@ -1735,10 +1735,10 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)* that we can get the current state of the GPIO. */ dp->irq =gpiod_to_irq (dp->hpd_gpiod); - irq_flags =IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING ; + irq_flags =IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_NO_AUTOEN ; }else { dp->irq =platform_get_irq (pdev,0 ); - irq_flags =0 ; + irq_flags =IRQF_NO_AUTOEN ; }if (dp->irq == -ENXIO ) {
@@ -1755,7 +1755,6 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)dev_err (&pdev->dev,"failed to request irq\n" ); goto err_disable_clk; } -disable_irq (dp->irq);return dp;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 144/222 drm/msm/hdmi: add runtime PM calls to DDC transfer function
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 531b4e2c206e5f7dead04d9da84dfa693ac57481 ]
We must be sure that the HDMI controller is powered on, while performing the DDC transfer. Add corresponding runtime PM calls to msm_hdmi_i2c_xfer().
Patchwork: https://patchwork.freedesktop.org/patch/651727/
--- drivers/gpu/drm/msm/hdmi/hdmi_i2c.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/hdmi/hdmi_i2c.c +12 -2
@@ -107,11 +107,15 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c,if (num ==0 )return num; + ret =pm_runtime_resume_and_get (&hdmi->pdev->dev); +if (ret) +return ret; +init_ddc (hdmi_i2c); ret =ddc_clear_irq (hdmi_i2c);if (ret) -return ret; + goto fail;for (i =0 ; i < num; i++) {struct i2c_msg *p = &msgs[i];
@@ -169,7 +173,7 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c,hdmi_read (hdmi,REG_HDMI_DDC_SW_STATUS ),hdmi_read (hdmi,REG_HDMI_DDC_HW_STATUS ), hdmi_read(hdmi, REG_HDMI_DDC_INT_CTRL)); -return ret; + goto fail; } ddc_status =hdmi_read (hdmi,REG_HDMI_DDC_SW_STATUS );
@@ -202,7 +206,13 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, } } +pm_runtime_put (&hdmi->pdev->dev); +return i; + +fail: +pm_runtime_put (&hdmi->pdev->dev); +return ret; }static u32 msm_hdmi_i2c_func (struct i2c_adapter *adapter)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 145/222 media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nas Chung <[email protected]>
[ Upstream commit f81f69a0e3da141bdd73a16b8676f4e542533d87 ]
V4L2_TYPE_IS_OUTPUT() returns true for V4L2_BUF_TYPE_VIDEO_OVERLAY which definitely belongs to CAPTURE.
--- include/uapi/linux/videodev2.h | 1 - 1 file changed, 1 deletion(-)
include/uapi/linux/videodev2.h +0 -1
@@ -164,7 +164,6 @@ enum v4l2_buf_type {#define V4L2_TYPE_IS_OUTPUT (type) \ ((type) == V4L2_BUF_TYPE_VIDEO_OUTPUT \ || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE \ - || (type) == V4L2_BUF_TYPE_VIDEO_OVERLAY \ || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY \ || (type) == V4L2_BUF_TYPE_VBI_OUTPUT \ || (type) == V4L2_BUF_TYPE_SLICED_VBI_OUTPUT \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 146/222 drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 3f397cd203f247879c2f1a061e90d4c8d23655de ]
This commit updates the dm_force_atomic_commit function to replace the usage of PTR_ERR_OR_ZERO with IS_ERR for checking error states after retrieving the Connector (drm_atomic_get_connector_state), CRTC (drm_atomic_get_crtc_state), and Plane (drm_atomic_get_plane_state) states.
The function utilized PTR_ERR_OR_ZERO for error checking. However, this approach is inappropriate in this context because the respective functions do not return NULL; they return pointers that encode errors.
This change ensures that error pointers are properly checked using IS_ERR before attempting to dereference.
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +12 -6
@@ -6505,16 +6505,20 @@ static int dm_force_atomic_commit(struct drm_connector *connector)*/ conn_state =drm_atomic_get_connector_state (state, connector); - ret =PTR_ERR_OR_ZERO (conn_state); -if (ret) +/* Check for error in getting connector state */ +if (IS_ERR (conn_state)) { + ret =PTR_ERR (conn_state); goto out; + }/* Attach crtc to drm_atomic_state*/ crtc_state =drm_atomic_get_crtc_state (state, &disconnected_acrtc->base); - ret =PTR_ERR_OR_ZERO (crtc_state); -if (ret) +/* Check for error in getting crtc state */ +if (IS_ERR (crtc_state)) { + ret =PTR_ERR (crtc_state); goto out; + }/* force a restore */ crtc_state->mode_changed = true;
@@ -6522,9 +6526,11 @@ static int dm_force_atomic_commit(struct drm_connector *connector)/* Attach plane to drm_atomic_state */ plane_state =drm_atomic_get_plane_state (state, plane); - ret =PTR_ERR_OR_ZERO (plane_state); -if (ret) +/* Check for error in getting plane state */ +if (IS_ERR (plane_state)) { + ret =PTR_ERR (plane_state); goto out; + }/* Call commit internally with the state we just constructed */ ret =drm_atomic_commit (state);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 147/222 drm/msm/a6xx: Increase HFI response timeout
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit 5f02f5e78ec9688e29b6857813185b1181796abe ]
When ACD feature is enabled, it triggers some internal calibrations which result in a pretty long delay during the first HFI perf vote. So, increase the HFI response timeout to match the downstream driver.
Patchwork: https://patchwork.freedesktop.org/patch/649344/
--- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_hfi.c +1 -1
@@ -88,7 +88,7 @@ static int a6xx_hfi_wait_for_ack(struct a6xx_gmu *gmu, u32 id, u32 seqnum,/* Wait for a response */ ret =gmu_poll_timeout (gmu,REG_A6XX_GMU_GMU2HOST_INTR_INFO , val, - val &A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ ,100 ,5000 ); + val &A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ ,100 ,1000000 );if (ret) { DRM_DEV_ERROR(gmu->dev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 148/222 drm/amdgpu/gfx10: fix CSIB handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 683308af030cd9b8d3f1de5cbc1ee51788878feb ]
We shouldn't return after the last section.
We need to update the rest of the CSIB.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +0 -2
@@ -944,8 +944,6 @@ static void gfx_v10_0_get_csb_buffer(struct amdgpu_device *adev, PACKET3_SET_CONTEXT_REG_START);for (i =0 ; i < ext->reg_count; i++) buffer[count++] =cpu_to_le32 (ext->extent[i]); - }else { -return ; } } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 149/222 drm/amdgpu/gfx7: fix CSIB handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit be7652c23d833d1ab2c67b16e173b1a4e69d1ae6 ]
We shouldn't return after the last section.
We need to update the rest of the CSIB.
--- drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +0 -2
@@ -3992,8 +3992,6 @@ static void gfx_v7_0_get_csb_buffer(struct amdgpu_device *adev, buffer[count++] =cpu_to_le32 (ext->reg_index -PACKET3_SET_CONTEXT_REG_START );for (i =0 ; i < ext->reg_count; i++) buffer[count++] =cpu_to_le32 (ext->extent[i]); - }else { -return ; } } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 150/222 jfs: fix array-index-out-of-bounds read in add_missing_indices
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Dutt <[email protected]>
[ Upstream commit 5dff41a86377563f7a2b968aae00d25b4ceb37c9 ]
stbl is s8 but it must contain offsets into slot which can go from 0 to 127.
Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.
--- fs/jfs/jfs_dtree.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
fs/jfs/jfs_dtree.c +15 -3
@@ -2909,7 +2909,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot)* fsck.jfs should really fix this, but it currently does not. * Called from jfs_readdir when bad index is detected. */ -static void add_missing_indices (struct inode *inode,s64 bn) +static int add_missing_indices (struct inode *inode,s64 bn) {struct ldtentry *d;struct dt_lock *dtlck;
@@ -2918,7 +2918,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)struct lv *lv;struct metapage *mp;dtpage_t *p; -int rc; +int rc =0 ;s8 *stbl;tid_t tid;struct tlock *tlck;
@@ -2943,6 +2943,16 @@ static void add_missing_indices(struct inode *inode, s64 bn) stbl =DT_GETSTBL (p);for (i =0 ; i < p->header.nextindex; i++) { +if (stbl[i] <0 ) { +jfs_err ("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld" , + i, stbl[i], (long )inode->i_ino, (long long )bn); + rc = -EIO ; + +DT_PUTPAGE (mp); +txAbort (tid,0 ); + goto end; + } + d = (struct ldtentry *) &p->slot[stbl[i]]; index =le32_to_cpu (d->index);if ((index <2 ) || (index >=JFS_IP (inode)->next_index)) {
@@ -2960,6 +2970,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) (void )txCommit (tid,1 , &inode,0 ); end:txEnd (tid); +return rc; }/*
@@ -3313,7 +3324,8 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) }if (fix_page) { -add_missing_indices (ip, bn); +if ((rc =add_missing_indices (ip, bn))) + goto out; page_fixed =1 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 151/222 drm/amdgpu/gfx8: fix CSIB handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit c8b8d7a4f1c5cdfbd61d75302fb3e3cdefb1a7ab ]
We shouldn't return after the last section.
We need to update the rest of the CSIB.
--- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +0 -2
@@ -1267,8 +1267,6 @@ static void gfx_v8_0_get_csb_buffer(struct amdgpu_device *adev, PACKET3_SET_CONTEXT_REG_START);for (i =0 ; i < ext->reg_count; i++) buffer[count++] =cpu_to_le32 (ext->extent[i]); - }else { -return ; } } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 152/222 drm/amdgpu/gfx9: fix CSIB handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit a4a4c0ae6742ec7d6bf1548d2c6828de440814a0 ]
We shouldn't return after the last section.
We need to update the rest of the CSIB.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +0 -2
@@ -1472,8 +1472,6 @@ static void gfx_v9_0_get_csb_buffer(struct amdgpu_device *adev, PACKET3_SET_CONTEXT_REG_START);for (i =0 ; i < ext->reg_count; i++) buffer[count++] =cpu_to_le32 (ext->extent[i]); - }else { -return ; } } }
Signature · 1 line
2.39.5
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.295 release. There are 222 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.295-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm defconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.4.295-rc1.
Regressions found on arm
* arm, build
- clang-20-axm55xx_defconfig
- clang-20-defconfig
- clang-20-lkftconfig
- clang-20-lkftconfig-no-kselftest-frag
- clang-nightly-axm55xx_defconfig
- clang-nightly-defconfig
- clang-nightly-lkftconfig
- gcc-12-axm55xx_defconfig
- gcc-12-defconfig
- gcc-12-lkftconfig
- gcc-12-lkftconfig-debug
- gcc-12-lkftconfig-kasan
- gcc-12-lkftconfig-kunit
- gcc-12-lkftconfig-libgpiod
- gcc-12-lkftconfig-no-kselftest-frag
- gcc-12-lkftconfig-perf
- gcc-12-lkftconfig-rcutorture
- gcc-8-axm55xx_defconfig
- gcc-8-defconfig
Regression Analysis:
- New regression? Yes
- Reproducibility? Yes
Build regression: stable-rc 5.4.295-rc1 arm kvm init.S Error selected processor does not support `eret' in ARM mode
## Build errorsarch/arm/kvm/init.S: Assembler messages:arch/arm/kvm/init.S:109: Error: selected processor does not support `eret' in ARM modearch/arm/kvm/init.S:116: Error: Banked registers are not available with this architecture. -- msr ELR_hyp,r1' arch/arm/kvm/init.S:145: Error: selected processor does not support eret' in ARM modearch/arm/kvm/init.S:149: Error: selected processor does not support `eret' in ARM mode
make[2]: *** [scripts/Makefile.build:345: arch/arm/kvm/init.o] Error 1
and/tmp/cc0RDxs9.s: Assembler messages:/tmp/cc0RDxs9.s:45: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:94: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:160: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:296: Error: selected processor does not support `smc #0' in ARM mode
make[3]: *** [/builds/linux/scripts/Makefile.build:262:drivers/firmware/qcom_scm-32.o] Error 1
## Source
* Kernel version: 5.4.295-rc1
* Git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* Git sha: 7ff2d32362e444f6459597db979cab7af498cdf3
* Git describe: v5.4.294-223-g7ff2d32362e4
* Project details:
https://regressions.linaro.org/lkft/linux-stable-rc-linux-5.4.y/v5.4.294-223-g7ff2d32362e4/
* Architectures: arm
* Toolchains: gcc-13
* Kconfigs: defconfig
## Build arm
* Build log: https://qa-reports.linaro.org/api/testruns/28837192/log_file/
* Build log 2: https://qa-reports.linaro.org/api/testruns/28841756/log_file/
* Build details:
https://regressions.linaro.org/lkft/linux-stable-rc-linux-5.4.y/v5.4.294-223-g7ff2d32362e4/build/gcc-12-axm55xx_defconfig/
* Build link: https://storage.tuxsuite.com/public/linaro/lkft/builds/2yuYHH1epMqFqeFlNFUWiMeDjEz/
* Kernel config:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2yuYHH1epMqFqeFlNFUWiMeDjEz/config
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerQuoted 68 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.295 release. There are 222 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.295-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm defconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.4.295-rc1.
Regressions found on arm
* arm, build
- clang-20-axm55xx_defconfig
- clang-20-defconfig
- clang-20-lkftconfig
- clang-20-lkftconfig-no-kselftest-frag
- clang-nightly-axm55xx_defconfig
- clang-nightly-defconfig
- clang-nightly-lkftconfig
- gcc-12-axm55xx_defconfig
- gcc-12-defconfig
- gcc-12-lkftconfig
- gcc-12-lkftconfig-debug
- gcc-12-lkftconfig-kasan
- gcc-12-lkftconfig-kunit
- gcc-12-lkftconfig-libgpiod
- gcc-12-lkftconfig-no-kselftest-frag
- gcc-12-lkftconfig-perf
- gcc-12-lkftconfig-rcutorture
- gcc-8-axm55xx_defconfig
- gcc-8-defconfigRegression Analysis:
- New regression? Yes
- Reproducibility? YesBuild regression: stable-rc 5.4.295-rc1 arm kvm
init.SError selected processor does not support `eret' in ARM mode## Build errors
arch/arm/kvm/init.S: Assembler messages:arch/arm/kvm/init.S:109: Error: selected processor does not support `eret' in ARM modearch/arm/kvm/init.S:116: Error: Banked registers are not available with this architecture. --msr ELR_hyp,r1' arch/arm/kvm/init.S:145: Error: selected processor does not supporteret' in ARM modearch/arm/kvm/init.S:149: Error: selected processor does not support `eret' in ARM mode
make[2]: *** [scripts/Makefile.build:345:arch/arm/kvm/init.o] Error 1
Quoted 12 lines
and
/tmp/cc0RDxs9.s: Assembler messages:/tmp/cc0RDxs9.s:45: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:94: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:160: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:296: Error: selected processor does not support `smc #0' in ARM mode
make[3]: *** [/builds/linux/scripts/Makefile.build:262:drivers/firmware/qcom_scm-32.o] Error 1
That's odd, both clang and gcc don't like this? Any chance you can do 'git bisect' to track down the offending commit?
thanks,
greg k-h
Hi!
Quoted 31 lines
Quoted 18 lines
Build regression: stable-rc 5.4.295-rc1 arm kvm
init.SError selected processor does not support `eret' in ARM mode## Build errors
arch/arm/kvm/init.S: Assembler messages:arch/arm/kvm/init.S:109: Error: selected processor does not support `eret' in ARM modearch/arm/kvm/init.S:116: Error: Banked registers are not available with this architecture. --msr ELR_hyp,r1' arch/arm/kvm/init.S:145: Error: selected processor does not supporteret' in ARM modearch/arm/kvm/init.S:149: Error: selected processor does not support `eret' in ARM mode
make[2]: *** [scripts/Makefile.build:345:arch/arm/kvm/init.o] Error 1Quoted 12 lines
and
/tmp/cc0RDxs9.s: Assembler messages:/tmp/cc0RDxs9.s:45: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:94: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:160: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:296: Error: selected processor does not support `smc #0' in ARM mode
make[3]: *** [/builds/linux/scripts/Makefile.build:262:drivers/firmware/qcom_scm-32.o] Error 1
Quoted 2 lines
That's odd, both clang and gcc don't like this? Any chance you can do 'git bisect' to track down the offending commit?
We see this one, too:
/tmp/ccJcop5R.s: Assembler messages:
2033/tmp/ccJcop5R.s:45: Error: selected processor does not support `smc #0' in ARM mode 2034/tmp/ccJcop5R.s:95: Error: selected processor does not support `smc #0' in ARM mode 2035/tmp/ccJcop5R.s:162: Error: selected processor does not support `smc #0' in ARM mode 2036/tmp/ccJcop5R.s:299: Error: selected processor does not support `smc #0' in ARM mode 2037
make[2]: *** [scripts/Makefile.build:262: drivers/firmware/qcom_scm-32.o] Error 1 2038
make[2]: *** Waiting for unfinished jobs....
2039
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/10452069686
It is probably config-dependend.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1886959470
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 83 lines · Greg Kroah-Hartman
Quoted 68 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.295 release. There are 222 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.295-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm defconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.4.295-rc1.
Regressions found on arm
* arm, build
- clang-20-axm55xx_defconfig
- clang-20-defconfig
- clang-20-lkftconfig
- clang-20-lkftconfig-no-kselftest-frag
- clang-nightly-axm55xx_defconfig
- clang-nightly-defconfig
- clang-nightly-lkftconfig
- gcc-12-axm55xx_defconfig
- gcc-12-defconfig
- gcc-12-lkftconfig
- gcc-12-lkftconfig-debug
- gcc-12-lkftconfig-kasan
- gcc-12-lkftconfig-kunit
- gcc-12-lkftconfig-libgpiod
- gcc-12-lkftconfig-no-kselftest-frag
- gcc-12-lkftconfig-perf
- gcc-12-lkftconfig-rcutorture
- gcc-8-axm55xx_defconfig
- gcc-8-defconfigRegression Analysis:
- New regression? Yes
- Reproducibility? YesBuild regression: stable-rc 5.4.295-rc1 arm kvm
init.SError selected processor does not support `eret' in ARM mode## Build errors
arch/arm/kvm/init.S: Assembler messages:arch/arm/kvm/init.S:109: Error: selected processor does not support `eret' in ARM modearch/arm/kvm/init.S:116: Error: Banked registers are not available with this architecture. --msr ELR_hyp,r1' arch/arm/kvm/init.S:145: Error: selected processor does not supporteret' in ARM modearch/arm/kvm/init.S:149: Error: selected processor does not support `eret' in ARM mode
make[2]: *** [scripts/Makefile.build:345:arch/arm/kvm/init.o] Error 1Quoted 12 lines
and
/tmp/cc0RDxs9.s: Assembler messages:/tmp/cc0RDxs9.s:45: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:94: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:160: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:296: Error: selected processor does not support `smc #0' in ARM mode
make[3]: *** [/builds/linux/scripts/Makefile.build:262:drivers/firmware/qcom_scm-32.o] Error 1
Quoted 2 lines
That's odd, both clang and gcc don't like this? Any chance you can do 'git bisect' to track down the offending commit?
The git bisection pointing to,
kbuild: Update assembler calls to use proper flags and language target commit d5c8d6e0fa61401a729e9eb6a9c7077b2d3aebb0 upstream.
- Naresh
Quoted 4 lines
thanks,
greg k-h
Greg Kroah-Hartman
maintainerQuoted 85 lines · Naresh Kamboju
Quoted 83 lines · Greg Kroah-Hartman
Quoted 80 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.295 release. There are 222 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.295-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm defconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.4.295-rc1.
Regressions found on arm
* arm, build
- clang-20-axm55xx_defconfig
- clang-20-defconfig
- clang-20-lkftconfig
- clang-20-lkftconfig-no-kselftest-frag
- clang-nightly-axm55xx_defconfig
- clang-nightly-defconfig
- clang-nightly-lkftconfig
- gcc-12-axm55xx_defconfig
- gcc-12-defconfig
- gcc-12-lkftconfig
- gcc-12-lkftconfig-debug
- gcc-12-lkftconfig-kasan
- gcc-12-lkftconfig-kunit
- gcc-12-lkftconfig-libgpiod
- gcc-12-lkftconfig-no-kselftest-frag
- gcc-12-lkftconfig-perf
- gcc-12-lkftconfig-rcutorture
- gcc-8-axm55xx_defconfig
- gcc-8-defconfigRegression Analysis:
- New regression? Yes
- Reproducibility? YesBuild regression: stable-rc 5.4.295-rc1 arm kvm
init.SError selected processor does not support `eret' in ARM mode## Build errors
arch/arm/kvm/init.S: Assembler messages:arch/arm/kvm/init.S:109: Error: selected processor does not support `eret' in ARM modearch/arm/kvm/init.S:116: Error: Banked registers are not available with this architecture. --msr ELR_hyp,r1' arch/arm/kvm/init.S:145: Error: selected processor does not supporteret' in ARM modearch/arm/kvm/init.S:149: Error: selected processor does not support `eret' in ARM mode
make[2]: *** [scripts/Makefile.build:345:arch/arm/kvm/init.o] Error 1and
/tmp/cc0RDxs9.s: Assembler messages:/tmp/cc0RDxs9.s:45: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:94: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:160: Error: selected processor does not support `smc #0' in ARM mode/tmp/cc0RDxs9.s:296: Error: selected processor does not support `smc #0' in ARM mode
make[3]: *** [/builds/linux/scripts/Makefile.build:262:drivers/firmware/qcom_scm-32.o] Error 1
Quoted 7 lines
Quoted 2 lines
That's odd, both clang and gcc don't like this? Any chance you can do 'git bisect' to track down the offending commit?
The git bisection pointing to,
kbuild: Update assembler calls to use proper flags and language target commit
d5c8d6e0fa61401a729e9eb6a9c7077b2d3aebb0upstream.
Thanks for that, I'll go drop all of the kbuild patches that Nathan submitted here and push out a -rc2
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
Quoted 4 lines · Naresh Kamboju
The git bisection pointing to,
kbuild: Update assembler calls to use proper flags and language target commit
d5c8d6e0fa61401a729e9eb6a9c7077b2d3aebb0upstream.Thanks for that, I'll go drop all of the kbuild patches that Nathan submitted here and push out a -rc2
Thanks and sorry about the breakage. This is a bug that we missed when d5c8d6e0fa61 was merged upstream because there were no uses of as-instr for arch/arm at that point but there are in this tree so [1] needs to be merged and backported with that series. I will resubmit when it lands.
[1]: https://lore.kernel.org/20250618-arm-expand-include-unified-h-path-v1-1-aef6eb4c44ca@kernel.org/
Cheers,
Nathan
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.295 release. There are 222 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.295-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Greg Kroah-Hartman
maintainerPATCH 153/222 jfs: Fix null-ptr-deref in jfs_ioc_trim
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dylan Wolff <[email protected]>
[ Upstream commit a4685408ff6c3e2af366ad9a7274f45ff3f394ee ]
[ Syzkaller Report ]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000087: 0000 [#1 KASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f] CPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tainted 6.13.0-rc6-gfbfd64d25c7a-dirty #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Sched_ext: serialise (enabled+all), task: runnable_at=-30ms RIP: 0010:jfs_ioc_trim+0x34b/0x8f0 Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 90 82 fe ff 4c 89 ff 31 f6 RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206 RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die_body+0x61/0xb0 ? die_addr+0xb1/0xe0 ? exc_general_protection+0x333/0x510 ? asm_exc_general_protection+0x26/0x30 ? jfs_ioc_trim+0x34b/0x8f0 jfs_ioctl+0x3c8/0x4f0 ? __pfx_jfs_ioctl+0x10/0x10 ? __pfx_jfs_ioctl+0x10/0x10 __se_sys_ioctl+0x269/0x350 ? __pfx___se_sys_ioctl+0x10/0x10 ? do_syscall_64+0xfb/0x210 do_syscall_64+0xee/0x210 ? syscall_exit_to_user_mode+0x1e0/0x330 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe51f4903ad Code: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d
RSP: 002b:00007fe5202250c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fe51f5cbf80 RCX: 00007fe51f4903ad
RDX: 0000000020000680 RSI: 00000000c0185879 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe520225640
R13: 000000000000000e R14: 00007fe51f44fca0 R15: 00007fe52021d000
</TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:jfs_ioc_trim+0x34b/0x8f0 Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 90 82 fe ff 4c 89 ff 31 f6 RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206 RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Kernel panic - not syncing: Fatal exception
[ Analysis ]
We believe that we have found a concurrency bug in the fs/jfs module that results in a null pointer dereference. There is a closely related issue which has been fixed:
... but, unfortunately, the accepted patch appears to still be susceptible to a null pointer dereference under some interleavings.
To trigger the bug, we think that JFS_SBI(ipbmap->i_sb)->bmap is set to NULL in dbFreeBits and then dereferenced in jfs_ioc_trim. This bug manifests quite rarely under normal circumstances, but is triggereable from a syz-program.
--- fs/jfs/jfs_discard.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/jfs/jfs_discard.c +2 -1
@@ -86,7 +86,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)down_read (&sb->s_umount); bmp =JFS_SBI (ip->i_sb)->bmap; -if (minlen > bmp->db_agsize || +if (bmp ==NULL || + minlen > bmp->db_agsize || start >= bmp->db_mapsize || range->len < sb->s_blocksize) {up_read (&sb->s_umount);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 154/222 drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amber Lin <[email protected]>
[ Upstream commit ab9fcc6362e0699fc1150aa1d8503c40fce2c1e1 ]
When submitting MQD to CP, set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB bit so it'll allow SDMA preemption if there is a massive command buffer of long-running SDMA commands.
--- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +4 -0
@@ -387,6 +387,10 @@ static void update_mqd_sdma(struct mqd_manager *mm, void *mqd, m->sdma_engine_id = q->sdma_engine_id; m->sdma_queue_id = q->sdma_queue_id; m->sdmax_rlcx_dummy_reg =SDMA_RLC_DUMMY_DEFAULT ; +/* Allow context switch so we don't cross-process starve with a massive +* command buffer of long-running SDMA commands +*/ + m->sdmax_rlcx_ib_cntl |=SDMA0_GFX_IB_CNTL__SWITCH_INSIDE_IB_MASK ; q->is_active =QUEUE_IS_ACTIVE (*q); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 155/222 media: tc358743: ignore video while HPD is low
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 6829c5b5d26b1be31880d74ec24cb32d2d75f1ae ]
If the HPD is low (happens if there is no EDID or the EDID is being updated), then return -ENOLINK in tc358743_get_detected_timings() instead of detecting video.
This avoids userspace thinking that it can start streaming when the HPD is low.
--- drivers/media/i2c/tc358743.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/media/i2c/tc358743.c +4 -0
@@ -309,6 +309,10 @@ static int tc358743_get_detected_timings(struct v4l2_subdev *sd,memset (timings,0 ,sizeof (struct v4l2_dv_timings )); +/* if HPD is low, ignore any video */ +if (!(i2c_rd8 (sd,HPD_CTL ) &MASK_HPD_OUT0 )) +return -ENOLINK ; +if (no_signal (sd)) {v4l2_dbg (1 , debug, sd,"%s: no valid signal\n" , __func__);return -ENOLINK ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 156/222 media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit bd9f6ce7d512fa21249415c16af801a4ed5d97b6 ]
In fimc_is_hw_change_mode(), the function changes camera modes without waiting for hardware completion, risking corrupted data or system hangs if subsequent operations proceed before the hardware is ready.
Add fimc_is_hw_wait_intmsr0_intmsd0() after mode configuration, ensuring hardware state synchronization and stable interrupt handling.
--- drivers/media/platform/exynos4-is/fimc-is-regs.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/exynos4-is/fimc-is-regs.c +1 -0
@@ -164,6 +164,7 @@ int fimc_is_hw_change_mode(struct fimc_is *is)if (WARN_ON (is->config_index >=ARRAY_SIZE (cmd)))return -EINVAL ; +fimc_is_hw_wait_intmsr0_intmsd0 (is);mcuctl_write (cmd[is->config_index], is,MCUCTL_REG_ISSR (0 ));mcuctl_write (is->sensor_index, is,MCUCTL_REG_ISSR (1 ));mcuctl_write (is->setfile.sub_index, is,MCUCTL_REG_ISSR (2 ));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 157/222 nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Schuster <[email protected]>
[ Upstream commit 2d8a3179ea035f9341b6a73e5ba4029fc67e983d ]
NIOS2 uses a software-managed TLB for virtual address translation. To flush a cache line, the original mapping is replaced by one to physical address 0x0 with no permissions (rwx mapped to 0) set. This can lead to TLB-permission--related traps when such a nominally flushed entry is encountered as a mapping for an otherwise valid virtual address within a process (e.g. due to an MMU-PID-namespace rollover that previously flushed the complete TLB including entries of existing, running processes).
The default ptep_set_access_flags implementation from mm/pgtable-generic.c only forces a TLB-update when the page-table entry has changed within the page table:
/*
* [...] We return whether the PTE actually changed, which in turn
* instructs the caller to do things like update__mmu_cache. [...]
*/
int ptep_set_access_flags(struct vm_area_struct *vma,
unsigned long address, pte_t *ptep,
pte_t entry, int dirty)
{
int changed = !pte_same(*ptep, entry);
if (changed) {
set_pte_at(vma->vm_mm, address, ptep, entry);
flush_tlb_fix_spurious_fault(vma, address);
}
return changed;
}However, no cross-referencing with the TLB-state occurs, so the flushing-induced pseudo entries that are responsible for the pagefault in the first place are never pre-empted from TLB on this code path.
This commit fixes this behaviour by always requesting a TLB-update in this part of the pagefault handling, fixing spurious page-faults on the way. The handling is a straightforward port of the logic from the MIPS architecture via an arch-specific ptep_set_access_flags function ported from arch/mips/include/asm/pgtable.h.
--- arch/nios2/include/asm/pgtable.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/nios2/include/asm/pgtable.h +16 -0
@@ -297,4 +297,20 @@ extern void __init mmu_init(void);extern void update_mmu_cache (struct vm_area_struct *vma,unsigned long address,pte_t *pte); +static inline int pte_same (pte_t pte_a,pte_t pte_b); + +#define __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS +static inline int ptep_set_access_flags (struct vm_area_struct *vma, +unsigned long address,pte_t *ptep, +pte_t entry,int dirty) +{ +if (!pte_same (*ptep, entry)) +set_ptes (vma->vm_mm, address, ptep, entry,1 ); +/* +* update_mmu_cache will unconditionally execute, handling both +* the case that the PTE changed and the spurious fault case. +*/ +return true; +} +#endif /* _ASM_NIOS2_PGTABLE_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 158/222 cpufreq: Force sync policy boost with global boost on sysfs update
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
[ Upstream commit 121baab7b88ed865532dadb7ef1aee6e2bea86f5 ]
If the global boost flag is enabled and policy boost flag is disabled, a call to cpufreq_boost_trigger_state(true) must enable the policy's boost state.
The current code misses that because of an optimization. Fix it.
--- drivers/cpufreq/cpufreq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/cpufreq/cpufreq.c +4 -2
@@ -2580,8 +2580,10 @@ int cpufreq_boost_trigger_state(int state)unsigned long flags;int ret =0 ; -if (cpufreq_driver->boost_enabled == state) -return 0 ; +/* +* Don't compare 'cpufreq_driver->boost_enabled' with 'state' here to +* make sure all policies are in sync with global boost flag. +*/ write_lock_irqsave (&cpufreq_driver_lock, flags); cpufreq_driver->boost_enabled = state;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 159/222 net: macb: Check return value of dma_set_mask_and_coherent()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergio Perez Gonzalez <[email protected]>
[ Upstream commit 3920a758800762917177a6b5ab39707d8e376fe6 ]
Issue flagged by coverity. Add a safety check for the return value of dma_set_mask_and_coherent, go to a safe exit if it returns error.
--- drivers/net/ethernet/cadence/macb_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +5 -1
@@ -4320,7 +4320,11 @@ static int macb_probe(struct platform_device *pdev)#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT if (GEM_BFEXT (DAW64 ,gem_readl (bp,DCFG6 ))) { -dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (44 )); + err =dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (44 )); +if (err) { +dev_err (&pdev->dev,"failed to set DMA mask\n" ); + goto err_out_free_netdev; + } bp->hw_dma_cap |=HW_DMA_CAP_64B ; }#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 160/222 i2c: designware: Invoke runtime suspend on quick slave re-registration
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tan En De <[email protected]>
[ Upstream commit 2fe2b969d911a09abcd6a47401a3c66c38a310e6 ]
Replaced pm_runtime_put() with pm_runtime_put_sync_suspend() to ensure the runtime suspend is invoked immediately when unregistering a slave. This prevents a race condition where suspend was skipped when unregistering and registering slave in quick succession.
For example, consider the rapid sequence ofdelete_device -> new_device -> delete_device -> new_device. In this sequence, it is observed that the dw_i2c_plat_runtime_suspend() might not be invoked after delete_device operation.
This is because after delete_device operation, when the pm_runtime_put() is about to trigger suspend, the following new_device operation might race and cancel the suspend.
If that happens, during the new_device operation, dw_i2c_plat_runtime_resume() is skipped (since there was no suspend), which means i_dev->init(), i.e. i2c_dw_init_slave(), is skipped. Since i2c_dw_init_slave() is skipped, i2c_dw_configure_fifo_slave() is skipped too, which leaves DW_IC_INTR_MASK unconfigured. If we inspect the interrupt mask register using devmem, it will show as zero.
Example shell script to reproduce the issue:
``` #!/bin/sh SLAVE_LADDR=0x1010 SLAVE_BUS=13 NEW_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/new_device DELETE_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/delete_device # Create initial device echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE sleep 2 # Rapid sequence of # delete_device -> new_device -> delete_device -> new_device echo $SLAVE_LADDR > $DELETE_DEVICE echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE echo $SLAVE_LADDR > $DELETE_DEVICE echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE # Using devmem to inspect IC_INTR_MASK will show as zero ```
--- drivers/i2c/busses/i2c-designware-slave.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-designware-slave.c +1 -1
@@ -96,7 +96,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave) dev->disable (dev);synchronize_irq (dev->irq); dev->slave =NULL ; -pm_runtime_put (dev->dev); +pm_runtime_put_sync_suspend (dev->dev);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 161/222 emulex/benet: correct command version selection in be_cmd_get_stats()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit edb888d29748cee674006a52e544925dacc7728e ]
Logic here always sets hdr->version to 2 if it is not a BE3 or Lancer chip, even if it is BE2. Use 'else if' to prevent multiple assignments, setting version 0 for BE2, version 1 for BE3 and Lancer, and version 2 for others. Fixes potential incorrect version setting when BE2_chip and BE3_chip/lancer_chip checks could both be true.
--- drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/emulex/benet/be_cmds.c +1 -1
@@ -1608,7 +1608,7 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd)/* version 1 of the cmd is not supported only by BE2 */ if (BE2_chip (adapter)) hdr->version =0 ; -if (BE3_chip (adapter) ||lancer_chip (adapter)) +else if (BE3_chip (adapter) ||lancer_chip (adapter)) hdr->version =1 ;else hdr->version =2 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 162/222 sctp: Do not wake readers in __sctp_write_space()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Malat <[email protected]>
[ Upstream commit af295892a7abbf05a3c2ba7abc4d81bb448623d6 ]
Function __sctp_write_space() doesn't set poll key, which leads to ep_poll_callback() waking up all waiters, not only these waiting for the socket being writable. Set the key properly using wake_up_interruptible_poll(), which is preferred over the sync variant, as writers are not woken up before at least half of the queue is available. Also, TCP does the same.
--- net/sctp/socket.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/socket.c +2 -1
@@ -8946,7 +8946,8 @@ static void __sctp_write_space(struct sctp_association *asoc) wq =rcu_dereference (sk->sk_wq);if (wq) {if (waitqueue_active (&wq->wait)) -wake_up_interruptible (&wq->wait); +wake_up_interruptible_poll (&wq->wait,EPOLLOUT | +EPOLLWRNORM |EPOLLWRBAND );/* Note that we try to include the Async I/O support * here by modeling from the current TCP/UDP code.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 163/222 net: dlink: add synchronization for stats update
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Yeounsu <[email protected]>
[ Upstream commit 12889ce926e9a9baf6b83d809ba316af539b89e2 ]
This patch synchronizes code that accesses from both user-space and IRQ contexts. The get_stats() function can be called from both context.
dev->stats.tx_errors and dev->stats.collisions are also updated in the tx_errors() function. Therefore, these fields must also be protected by synchronized.
There is no code that accessses dev->stats.tx_errors between the previous and updated lines, so the updating point can be moved.
--- drivers/net/ethernet/dlink/dl2k.c | 14 +++++++++++++- drivers/net/ethernet/dlink/dl2k.h | 2 ++ 2 files changed, 15 insertions(+), 1 deletion(-)
drivers/net/ethernet/dlink/dl2k.c +13 -1
@@ -155,6 +155,8 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent) np->ioaddr = ioaddr; np->chip_id = chip_idx; np->pdev = pdev; + +spin_lock_init (&np->stats_lock);spin_lock_init (&np->tx_lock);spin_lock_init (&np->rx_lock);
@@ -875,7 +877,6 @@ tx_error (struct net_device *dev, int tx_status) frame_id = (tx_status &0xffff0000 );printk (KERN_ERR "%s: Transmit error, TxStatus %4.4x, FrameId %d.\n" , dev->name, tx_status, frame_id); - dev->stats.tx_errors++;/* Ttransmit Underrun */ if (tx_status &0x10 ) { dev->stats.tx_fifo_errors++;
@@ -912,9 +913,15 @@ tx_error (struct net_device *dev, int tx_status)rio_set_led_mode (dev);/* Let TxStartThresh stay default value */ } + +spin_lock (&np->stats_lock);/* Maximum Collisions */ if (tx_status &0x08 ) dev->stats.collisions++; + + dev->stats.tx_errors++; +spin_unlock (&np->stats_lock); +/* Restart the Tx */ dw32 (MACCtrl,dr16 (MACCtrl) | TxEnable); }
@@ -1084,7 +1091,9 @@ get_stats (struct net_device *dev)int i;#endif unsigned int stat_reg; +unsigned long flags; +spin_lock_irqsave (&np->stats_lock, flags);/* All statistics registers need to be acknowledged, else statistic overflow could cause problems */
@@ -1134,6 +1143,9 @@ get_stats (struct net_device *dev)dr16 (TCPCheckSumErrors);dr16 (UDPCheckSumErrors);dr16 (IPCheckSumErrors); + +spin_unlock_irqrestore (&np->stats_lock, flags); +return &dev->stats; }
drivers/net/ethernet/dlink/dl2k.h +2 -0
@@ -372,6 +372,8 @@ struct netdev_private {struct pci_dev *pdev;void __iomem *ioaddr;void __iomem *eeprom_addr; +// To ensure synchronization when stats are updated. +spinlock_t stats_lock;spinlock_t tx_lock;spinlock_t rx_lock;unsigned int rx_buf_sz;/* Based on MTU+slack. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 164/222 tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b879dcb1aeeca278eacaac0b1e2425b1c7599f9f ]
tcp_rcv_rtt_update() goal is to maintain an estimation of the RTT in tp->rcv_rtt_est.rtt_us, used by tcp_rcv_space_adjust()
When TCP TS are enabled, tcp_rcv_rtt_update() is using EWMA to smooth the samples.
Change this to immediately latch the incoming value if it is lower than tp->rcv_rtt_est.rtt_us, so that tcp_rcv_space_adjust() does not overshoot tp->rcvq_space.space and sk->sk_rcvbuf.
--- net/ipv4/tcp_input.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-)
net/ipv4/tcp_input.c +8 -14
@@ -539,10 +539,12 @@ EXPORT_SYMBOL(tcp_initialize_rcv_mss);*/ static void tcp_rcv_rtt_update (struct tcp_sock *tp,u32 sample,int win_dep) { -u32 new_sample = tp->rcv_rtt_est.rtt_us; -long m = sample; +u32 new_sample, old_sample = tp->rcv_rtt_est.rtt_us; +long m = sample <<3 ; -if (new_sample !=0 ) { +if (old_sample ==0 || m < old_sample) { + new_sample = m; + }else {/* If we sample in larger samples in the non-timestamp * case, we could grossly overestimate the RTT especially * with chatty applications or bulk transfer apps which
@@ -553,17 +555,9 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)* else with timestamps disabled convergence takes too * long. */ -if (!win_dep) { - m -= (new_sample >>3 ); - new_sample += m; - }else { - m <<=3 ; -if (m < new_sample) - new_sample = m; - } - }else { -/* No previous measure. */ - new_sample = m <<3 ; +if (win_dep) +return ; + new_sample = old_sample - (old_sample >>3 ) + sample; } tp->rcv_rtt_est.rtt_us = new_sample;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 165/222 tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cd171461b90a2d2cf230943df60d580174633718 ]
tcp_rcv_state_process() must tweak tp->advmss for TS enabled flows before the call to tcp_init_transfer() / tcp_init_buffer_space().
Otherwise tp->rcvq_space.space is off by 120 bytes (TCP_INIT_CWND * TCPOLEN_TSTAMP_ALIGNED).
--- net/ipv4/tcp_input.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv4/tcp_input.c +3 -3
@@ -6333,6 +6333,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)if (!tp->srtt_us)tcp_synack_rtt_meas (sk, req); +if (tp->rx_opt.tstamp_ok) + tp->advmss -=TCPOLEN_TSTAMP_ALIGNED ; +if (req) {tcp_rcv_synrecv_state_fastopen (sk); }else {
@@ -6356,9 +6359,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) tp->snd_wnd =ntohs (th->window) << tp->rx_opt.snd_wscale;tcp_init_wl (tp,TCP_SKB_CB (skb)->seq); -if (tp->rx_opt.tstamp_ok) - tp->advmss -=TCPOLEN_TSTAMP_ALIGNED ; -if (!inet_csk (sk)->icsk_ca_ops->cong_control)tcp_update_pacing_rate (sk);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 166/222 ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 1c0829788a6e6e165846b9bedd0b908ef16260b6 ]
The statistics are incremented with raw_cpu_inc() assuming it always happens with bottom half disabled. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this is no longer true.
Use this_cpu_inc() on PREEMPT_RT for the increment to not worry about preemption.
--- net/ipv4/route.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv4/route.c +4 -0
@@ -197,7 +197,11 @@ const __u8 ip_tos2prio[16] = {EXPORT_SYMBOL (ip_tos2prio); static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat); +#ifndef CONFIG_PREEMPT_RT #define RT_CACHE_STAT_INC (field) raw_cpu_inc(rt_cache_stat.field) +#else +#define RT_CACHE_STAT_INC (field) this_cpu_inc(rt_cache_stat.field) +#endif #ifdef CONFIG_PROC_FS static void *rt_cache_seq_start (struct seq_file *seq,loff_t *pos)
Signature · 1 line
2.39.5