6.6.95-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.6.95-rc1 review
This is the start of the stable review cycle for the 6.6.95 release. There are 290 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.95-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.95-rc1
Pali Rohár <[email protected]>
cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
David Thompson <[email protected]>
gpio: mlxbf3: only get IRQ for device instance 0
Ian Rogers <[email protected]>
perf evsel: Missed close() when probing hybrid core PMUs
Anup Patel <[email protected]>
RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
Anup Patel <[email protected]>
RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
Vitaliy Shevtsov <[email protected]>
scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
Tengda Wu <[email protected]>
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
Luo Gengkun <[email protected]>
perf/core: Fix WARN in perf_cgroup_switch()
Peter Zijlstra <[email protected]>
perf: Fix cgroup state vs ERROR
Peter Zijlstra <[email protected]>
perf: Fix sample vs do_exit()
Heiko Carstens <[email protected]>
s390/pci: Fix __pcilg_mio_inuser() inline assembly
Yao Zi <[email protected]>
platform/loongarch: laptop: Add backlight power control support
zhangjian <[email protected]>
smb: client: fix first command failure during re-negotiation
Jon Hunter <[email protected]>
Revert "cpufreq: tegra186: Share policy per cluster"
Geert Uytterhoeven <[email protected]>
ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
Colin Foster <[email protected]>
ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
Renato Caldas <[email protected]>
platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys
Claudiu Beznea <[email protected]>
serial: sh-sci: Increment the runtime usage counter for the earlycon device
Jakub Kicinski <[email protected]>
net: make for_each_netdev_dump() a little more bug-proof
Paul Aurich <[email protected]>
smb: Log an error when close_all_cached_dirs fails
Akhil R <[email protected]>
dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
Avadhut Naik <[email protected]>
EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
Eric Dumazet <[email protected]>
net: atm: fix /proc/net/atm/lec handling
Eric Dumazet <[email protected]>
net: atm: add lec_mutex
Kuniyuki Iwashima <[email protected]>
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
Ronnie Sahlberg <[email protected]>
ublk: santizize the arguments from userspace when adding a device
Alexey Kodanev <[email protected]>
net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
Rengarajan S <[email protected]>
net: microchip: lan743x: Reduce PTP timeout on HW failure
David Wei <[email protected]>
tcp: fix passive TFO socket having invalid NAPI ID
Haixia Qu <[email protected]>
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
Neal Cardwell <[email protected]>
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
Kuniyuki Iwashima <[email protected]>
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
Kuniyuki Iwashima <[email protected]>
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
Dmitry Antipov <[email protected]>
wifi: carl9170: do not ping device which has failed to load firmware
Vladimir Oltean <[email protected]>
ptp: allow reading of currently dialed frequency to succeed on free-running clocks
Vladimir Oltean <[email protected]>
ptp: fix breakage after ptp_vclock_in_use() rework
Vitaly Lifshits <[email protected]>
e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
Krishna Kumar <[email protected]>
net: ice: Perform accurate aRFS flow match
Justin Sanders <[email protected]>
aoe: clean device rq_list in aoedev_downdev()
Simon Horman <[email protected]>
pldmfw: Select CRC32 when PLDMFW is selected
Arnd Bergmann <[email protected]>
hwmon: (occ) fix unaligned accesses
Arnd Bergmann <[email protected]>
hwmon: (occ) Rework attribute registration for stack usage
Tzung-Bi Shih <[email protected]>
drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
Jacob Keller <[email protected]>
drm/nouveau/bl: increase buffer size to avoid truncate warning
Brett Creeley <[email protected]>
ionic: Prevent driver/fw getting out of sync on devcmd(s)
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
James A. MacInnes <[email protected]>
drm/msm/disp: Correct porch timing for SDM845
Bharath SM <[email protected]>
smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
Jeff Layton <[email protected]>
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
Gao Xiang <[email protected]>
erofs: remove unused trace event erofs_destroy_inode
Paul Chaignon <[email protected]>
bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
Paul Chaignon <[email protected]>
net: Fix checksum update for ILA adj-transport
Gavin Guo <[email protected]>
mm/huge_memory: fix dereferencing invalid pmd migration entry
Jann Horn <[email protected]>
mm/hugetlb: unshare page tables during VMA split, not before
Sean Nyekjaer <[email protected]>
iio: accel: fxls8962af: Fix temperature calculation
Jonathan Lane <[email protected]>
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
Takashi Iwai <[email protected]>
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
wangdicheng <[email protected]>
ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
Dev Jain <[email protected]>
arm64: Restrict pagetable teardown to avoid false warning
Chin-Yen Lee <[email protected]>
wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE
Edward Adam Davis <[email protected]>
wifi: cfg80211: init wiphy_work before allocating rfkill fails
WangYuli <[email protected]>
Input: sparcspkr - avoid unannotated fall-through
Kuniyuki Iwashima <[email protected]>
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
Srinivas Pandruvada <[email protected]>
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
Stephen Smalley <[email protected]>
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
Namjae Jeon <[email protected]>
ksmbd: fix null pointer dereference in destroy_previous_session
Xin Li (Intel) <[email protected]>
selftests/x86: Add a test to detect infinite SIGTRAP handler loop
Marek Szyprowski <[email protected]>
udmabuf: use sgtable-based scatterlist wrappers
Jakub Kicinski <[email protected]>
net: clear the dst when changing skb protocol
Eric Dumazet <[email protected]>
net_sched: sch_sfq: reject invalid perturb period
Peter Oberparleiter <[email protected]>
scsi: s390: zfcp: Ensure synchronous unit_add
Dexuan Cui <[email protected]>
scsi: storvsc: Increase the timeouts to storvsc_timeout
Bharath SM <[email protected]>
smb: improve directory cache reuse for readdir operations
Shyam Prasad N <[email protected]>
cifs: do not disable interface polling on failure
Shyam Prasad N <[email protected]>
cifs: serialize other channels when query server interfaces is pending
Shyam Prasad N <[email protected]>
cifs: deal with the channel loading lag while picking channels
Fedor Pchelkin <[email protected]>
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
Artem Sadovnikov <[email protected]>
jffs2: check that raw node were preallocated before writing summary
Tianyang Zhang <[email protected]>
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
Huacai Chen <[email protected]>
LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
Yao Zi <[email protected]>
platform/loongarch: laptop: Unregister generic_sub_drivers on exit
Yao Zi <[email protected]>
platform/loongarch: laptop: Get brightness setting from EC on probe
Andrew Morton <[email protected]>
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
Penglei Jiang <[email protected]>
io_uring: fix task leak issue in io_wq_create()
Breno Leitao <[email protected]>
Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
Narayana Murty N <[email protected]>
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
Christophe Leroy <[email protected]>
powerpc/vdso: Fix build of VDSO32 with pcrel
Stuart Hayes <[email protected]>
platform/x86: dell_rbu: Stop overwriting data buffer
Stuart Hayes <[email protected]>
platform/x86: dell_rbu: Fix list usage
Mario Limonciello <[email protected]>
platform/x86/amd: pmc: Clear metrics table at start of cycle
Stephen Smalley <[email protected]>
fs/xattr.c: fix simple_xattr_list()
Alexander Sverdlin <[email protected]>
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
Jann Horn <[email protected]>
tee: Prevent size calculation wraparound on 32-bit kernels
Sukrut Bellary <[email protected]>
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
Laurentiu Tudor <[email protected]>
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
Marcus Folkesson <[email protected]>
watchdog: da9052_wdt: respect TWDMIN
Kees Cook <[email protected]>
fbcon: Make sure modelist not set on unregistered console
Suraj P Kizhakkethil <[email protected]>
wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
Balamurugan S <[email protected]>
wifi: ath12k: fix incorrect CE addresses
Hari Chandrakanthan <[email protected]>
wifi: ath12k: fix link valid field initialization in the monitor Rx
Baochen Qiang <[email protected]>
wifi: ath11k: determine PM policy based on machine model
Wentao Liang <[email protected]>
octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
Linus Walleij <[email protected]>
net: ethernet: cortina: Use TOE/TSO on all TCP
Jiayuan Chen <[email protected]>
bpf, sockmap: Fix data lost during EAGAIN retries
Chao Yu <[email protected]>
f2fs: fix to set atomic write status more clear
Krzysztof Hałasa <[email protected]>
usbnet: asix AX88772: leave the carrier control to phylink
Mateusz Pacuszka <[email protected]>
ice: fix check for existing switch rule
Kyungwook Boo <[email protected]>
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
Zijun Hu <[email protected]>
sock: Correct error checking condition for (assign|release)_proto_idx()
Daniel Wagner <[email protected]>
scsi: lpfc: Use memcpy() for BIOS version
Aditya Kumar Singh <[email protected]>
wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
Mike Looijmans <[email protected]>
pinctrl: mcp23s08: Reset all pins to input at probe
Zijun Hu <[email protected]>
software node: Correct a OOB check in software_node_get_reference_args()
Michael Walle <[email protected]>
net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
Ido Schimmel <[email protected]>
vxlan: Do not treat dst cache initialization errors as fatal
Yong Wang <[email protected]>
net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
Yong Wang <[email protected]>
net: bridge: mcast: update multicast contex when vlan state is changed
Víctor Gonzalo <[email protected]>
wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
Muna Sinada <[email protected]>
wifi: mac80211: VLAN traffic in multicast path
Edward Adam Davis <[email protected]>
wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
Miri Korenblit <[email protected]>
wifi: iwlwifi: pcie: make sure to lock rxq->read
Sean Christopherson <[email protected]>
iommu/amd: Ensure GA log notifier callbacks finish running before module unload
Justin Tee <[email protected]>
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
Alan Maguire <[email protected]>
libbpf: Add identical pointer detection to btf_dedup_is_equiv()
Heiko Stuebner <[email protected]>
clk: rockchip: rk3036: mark ddrphy as critical
Martin KaFai Lau <[email protected]>
bpftool: Fix cgroup command to only show cgroup bpf programs
Benjamin Berg <[email protected]>
wifi: mac80211: do not offer a mesh path if forwarding is disabled
Salah Triki <[email protected]>
wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
Stefan Wahren <[email protected]>
net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
Jason Xing <[email protected]>
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
Jason Xing <[email protected]>
net: atlantic: generate software timestamp just before the doorbell
Sebastian Andrzej Siewior <[email protected]>
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
Andrew Zaborowski <[email protected]>
x86/sgx: Prevent attempts to reclaim poisoned pages
Eric Dumazet <[email protected]>
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
Eric Dumazet <[email protected]>
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
Dian-Syuan Yang <[email protected]>
wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
Muhammad Usama Anjum <[email protected]>
wifi: ath11k: Fix QMI memory reuse logic
Baochen Qiang <[email protected]>
wifi: ath12k: fix a possible dead lock caused by ab->base_lock
Kang Yang <[email protected]>
wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
Moon Yeounsu <[email protected]>
net: dlink: add synchronization for stats update
Tali Perry <[email protected]>
i2c: npcm: Add clock toggle recovery
Akhil R <[email protected]>
i2c: tegra: check msg length in SMBUS block read
Mike Tipton <[email protected]>
cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
Petr Malat <[email protected]>
sctp: Do not wake readers in __sctp_write_space()
Samuel Williams <[email protected]>
wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
Henk Vergonet <[email protected]>
wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
Alok Tiwari <[email protected]>
emulex/benet: correct command version selection in be_cmd_get_stats()
Benjamin Lin <[email protected]>
wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
Tan En De <[email protected]>
i2c: designware: Invoke runtime suspend on quick slave re-registration
Hou Tao <[email protected]>
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
Chao Yu <[email protected]>
f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
Zilin Guan <[email protected]>
tipc: use kfree_sensitive() for aead cleanup
Rengarajan S <[email protected]>
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
Sergio Perez Gonzalez <[email protected]>
net: macb: Check return value of dma_set_mask_and_coherent()
Peter Marheine <[email protected]>
ACPI: battery: negate current when discharging
Charan Teja Kalla <[email protected]>
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
Peng Fan <[email protected]>
gpiolib: of: Add polarity quirk for s5m8767
Yuanjun Gong <[email protected]>
ASoC: tegra210_ahub: Add check to of_device_get_match_data()
gldrk <[email protected]>
ACPICA: utilities: Fix overflow check in vsnprintf()
Jerry Lv <[email protected]>
power: supply: bq27xxx: Retrieve again when busy
Seunghun Han <[email protected]>
ACPICA: fix acpi parse and parseext cache leaks
Mario Limonciello <[email protected]>
ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
Armin Wolf <[email protected]>
ACPI: bus: Bail out if acpi_kobj registration fails
Hector Martin <[email protected]>
ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
Luke Wang <[email protected]>
mmc: sdhci-esdhc-imx: Save tuning value when card stays powered in suspend
Ahmed Salem <[email protected]>
ACPICA: Avoid sequence overread in call to strncmp()
Erick Shepherd <[email protected]>
mmc: Add quirk to disable DDR50 tuning
Krzysztof Kozlowski <[email protected]>
power: supply: collie: Fix wakeup source leaks on device unbind
Guilherme G. Piccoli <[email protected]>
clocksource: Fix the CPUs' choice in the watchdog per CPU verification
Talhah Peerbhai <[email protected]>
ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
Seunghun Han <[email protected]>
ACPICA: fix acpi operand cache leak in dswstate.c
David Lechner <[email protected]>
iio: adc: ad7606_spi: fix reg write value mask
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Fix temperature calculation
Jann Horn <[email protected]>
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
Sean Nyekjaer <[email protected]>
iio: accel: fxls8962af: Fix temperature scan element sign
Diederik de Haas <[email protected]>
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
Ilpo Järvinen <[email protected]>
PCI: Fix lock symmetry in pci_slot_unlock()
Huacai Chen <[email protected]>
PCI: Add ACS quirk for Loongson PCIe
Niklas Cassel <[email protected]>
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
Long Li <[email protected]>
uio_hv_generic: Use correct size for interrupt and monitor pages
Long Li <[email protected]>
Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
Ruben Devos <[email protected]>
smb: client: add NULL check in automount_fullpath
Shyam Prasad N <[email protected]>
cifs: dns resolution is needed only for primary channel
Shyam Prasad N <[email protected]>
cifs: update dstaddr whenever channel iface is updated
Shyam Prasad N <[email protected]>
cifs: reset connections for all channels when reconnect requested
Xiaolei Wang <[email protected]>
remoteproc: core: Release rproc->clean_table after rproc_attach() fails
Xiaolei Wang <[email protected]>
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
Wentao Liang <[email protected]>
regulator: max14577: Add error check for max14577_read_reg()
Khem Raj <[email protected]>
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
Gabriel Shahrouzi <[email protected]>
staging: iio: ad5933: Correct settling cycles encoding per datasheet
Thomas Zimmermann <[email protected]>
video: screen_info: Relocate framebuffers behind PCI bridges
Lorenzo Stoakes <[email protected]>
KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
Qasim Ijaz <[email protected]>
net: ch9200: fix uninitialised access during mii_nway_restart
Xu Yang <[email protected]>
phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
Ye Bin <[email protected]>
ftrace: Fix UAF when lookup kallsym after ftrace disabled
Md Sadre Alam <[email protected]>
mtd: rawnand: qcom: Fix read len for onfi param page
Mikulas Patocka <[email protected]>
dm-verity: fix a memory leak if some arguments are specified multiple times
Mikulas Patocka <[email protected]>
dm-mirror: fix a tiny race condition
Chao Gao <[email protected]>
KVM: VMX: Flush shadow VMCS on emergency reboot
Yosry Ahmed <[email protected]>
KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
Wentao Liang <[email protected]>
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
Wentao Liang <[email protected]>
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
Jinliang Zheng <[email protected]>
mm: fix ratelimit_pages update error in dirty_ratio_handler()
Shin'ichiro Kawasaki <[email protected]>
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
Luo Gengkun <[email protected]>
watchdog: fix watchdog may detect false positive of softlockup
Jeongjun Park <[email protected]>
ipc: fix to protect IPCS lookups using RCU
Da Xue <[email protected]>
clk: meson-g12a: add missing fclk_div2 to spicc
Arnd Bergmann <[email protected]>
parisc: fix building with gcc-15
GONG Ruiqi <[email protected]>
vgacon: Add check for vc_origin address range in vgacon_scroll()
Helge Deller <[email protected]>
parisc/unaligned: Fix hex output to show 8 hex chars
Murad Masimov <[email protected]>
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
Niravkumar L Rabara <[email protected]>
EDAC/altera: Use correct write width with the INTTEST register
Murad Masimov <[email protected]>
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
Heiner Kallweit <[email protected]>
net: ftgmac100: select FIXED_PHY
Hyunwoo Kim <[email protected]>
net/sched: fix use-after-free in taprio_dev_notifier
Krzysztof Kozlowski <[email protected]>
NFC: nci: uart: Set tty->disc_data only in success path
Gui-Dong Han <[email protected]>
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
Chao Yu <[email protected]>
f2fs: fix to do sanity check on sit_bitmap_size
Jaegeuk Kim <[email protected]>
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
Chao Yu <[email protected]>
f2fs: fix to do sanity check on ino and xnid
Gatien Chevallier <[email protected]>
Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
Dan Carpenter <[email protected]>
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Brian Foster <[email protected]>
ext4: only dirty folios when data journaling regular files
Zhang Yi <[email protected]>
ext4: ensure i_size is smaller than maxbytes
Zhang Yi <[email protected]>
ext4: factor out ext4_get_maxbytes()
Jan Kara <[email protected]>
ext4: fix calculation of credits for extent tree modification
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: inline: fix len overflow in ext4_prepare_inline_data
Wan Junjie <[email protected]>
bus: fsl-mc: fix GET/SET_TAILDROP command ids
Ioana Ciornei <[email protected]>
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
Tasos Sahanidis <[email protected]>
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
Chen Ridong <[email protected]>
cgroup,freezer: fix incomplete freezing when attaching tasks
Dennis Marttinen <[email protected]>
ceph: set superblock s_magic for IMA fsmagic matching
Brett Werling <[email protected]>
can: tcan4x5x: fix power regulator retrieval during probe
Jeff Hugo <[email protected]>
bus: mhi: host: Fix conflict between power_up and SYSERR
Sumit Kumar <[email protected]>
bus: mhi: ep: Update read pointer only after buffer is written
Andreas Kemnade <[email protected]>
ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
Ross Stutterheim <[email protected]>
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
Ryan Roberts <[email protected]>
arm64/mm: Close theoretical race where stale TLB entry remains valid
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix deferred probing error
Ricardo Ribalda <[email protected]>
media: uvcvideo: Send control events for partial succeeds
Ricardo Ribalda <[email protected]>
media: uvcvideo: Return the number of processed controls
Ming Qian <[email protected]>
media: imx-jpeg: Cleanup after an allocation error
Ming Qian <[email protected]>
media: imx-jpeg: Reset slot data pointers when freed
Ming Qian <[email protected]>
media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
Ming Qian <[email protected]>
media: imx-jpeg: Drop the first error frames
Denis Arefev <[email protected]>
media: vivid: Change the siize of the composing
Edward Adam Davis <[email protected]>
media: vidtv: Terminating the subsequent process of initialization failure
Marek Szyprowski <[email protected]>
media: videobuf2: use sgtable-based scatterlist wrappers
Loic Poulain <[email protected]>
media: venus: Fix probe error handling
Ma Ke <[email protected]>
media: v4l2-dev: fix error handling in __video_register_device()
Marek Szyprowski <[email protected]>
media: omap3isp: use sgtable-based scatterlist wrappers
Fei Shao <[email protected]>
media: mediatek: vcodec: Correct vsi_core framebuffer size
Wentao Liang <[email protected]>
media: gspca: Add error handling for stv06xx_read_sensor()
Dmitry Nikiforov <[email protected]>
media: davinci: vpif: Fix memory leak in probe error path
Edward Adam Davis <[email protected]>
media: cxusb: no longer judge rbuf when the write fails
Sakari Ailus <[email protected]>
media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
Sakari Ailus <[email protected]>
media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
Sakari Ailus <[email protected]>
media: ccs-pll: Start OP pre-PLL multiplier search from correct value
Sakari Ailus <[email protected]>
media: ccs-pll: Start VT pre-PLL multiplier search from correct value
Tomi Valkeinen <[email protected]>
media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
Laurentiu Palcu <[email protected]>
media: nxp: imx8-isi: better handle the m2m usage_count
Johan Hovold <[email protected]>
media: ov5675: suppress probe deferral errors
Johan Hovold <[email protected]>
media: ov8856: suppress probe deferral errors
Mingcong Bai <[email protected]>
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
Bitterblue Smith <[email protected]>
wifi: rtw88: usb: Reduce control message timeout to 500 ms
Jeongjun Park <[email protected]>
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
Johan Hovold <[email protected]>
wifi: ath12k: fix ring-buffer corruption
Max Kellermann <[email protected]>
fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
Chuck Lever <[email protected]>
SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
Li Lingfeng <[email protected]>
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
NeilBrown <[email protected]>
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
Johan Hovold <[email protected]>
wifi: ath11k: fix ring-buffer corruption
Johan Hovold <[email protected]>
wifi: ath11k: fix rx completion meta data corruption
Christian Lamparter <[email protected]>
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
Wentao Liang <[email protected]>
net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
Wentao Liang <[email protected]>
net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
João Paulo Gonçalves <[email protected]>
regulator: max20086: Change enable gpio to optional
João Paulo Gonçalves <[email protected]>
regulator: max20086: Fix MAX200086 chip id
Gautam Menghani <[email protected]>
powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
Pavel Begunkov <[email protected]>
io_uring/kbuf: account ring io_buffer_list memory
Pavel Begunkov <[email protected]>
io_uring: account drain memory to cgroup
Martin Blumenstingl <[email protected]>
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
Wentao Liang <[email protected]>
ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
Alexander Aring <[email protected]>
gfs2: move msleep to sleepable context
Herbert Xu <[email protected]>
crypto: marvell/cesa - Do not chain submitted requests
Zijun Hu <[email protected]>
configfs: Do not override creating attribute file failure in populate_attrs()
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 2 - .../bindings/i2c/nvidia,tegra20-i2c.yaml | 24 ++- Makefile | 4 +- arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi | 2 +- arch/arm/mach-omap2/clockdomain.h | 1 + arch/arm/mach-omap2/clockdomains33xx_data.c | 2 +- arch/arm/mach-omap2/cm33xx.c | 14 +- arch/arm/mach-omap2/pmic-cpcap.c | 6 +- arch/arm/mm/ioremap.c | 4 +- arch/arm64/include/asm/tlbflush.h | 9 +- arch/arm64/kernel/ptrace.c | 2 +- arch/arm64/mm/mmu.c | 3 +- arch/loongarch/include/asm/irqflags.h | 16 +- arch/loongarch/mm/hugetlbpage.c | 3 +- arch/mips/vdso/Makefile | 1 + arch/parisc/boot/compressed/Makefile | 1 + arch/parisc/kernel/unaligned.c | 2 +- arch/powerpc/include/asm/ppc_asm.h | 2 +- arch/powerpc/kernel/eeh.c | 2 + arch/powerpc/kernel/vdso/Makefile | 2 +- arch/powerpc/platforms/pseries/msi.c | 7 +- arch/riscv/kvm/vcpu_sbi_replace.c | 8 +- arch/s390/kvm/gaccess.c | 8 +- arch/s390/pci/pci_mmio.c | 2 +- arch/x86/kernel/cpu/bugs.c | 10 +- arch/x86/kernel/cpu/sgx/main.c | 2 + arch/x86/kvm/svm/svm.c | 2 +- arch/x86/kvm/vmx/vmx.c | 5 +- drivers/acpi/acpica/dsutils.c | 9 +- drivers/acpi/acpica/psobject.c | 52 ++--- drivers/acpi/acpica/utprint.c | 7 +- drivers/acpi/battery.c | 19 +- drivers/acpi/bus.c | 6 +- drivers/ata/pata_via.c | 3 +- drivers/atm/atmtcp.c | 4 +- drivers/base/power/runtime.c | 2 +- drivers/base/swnode.c | 2 +- drivers/block/aoe/aoedev.c | 8 + drivers/block/ublk_drv.c | 3 + drivers/bus/fsl-mc/fsl-mc-uapi.c | 4 +- drivers/bus/fsl-mc/mc-io.c | 19 +- drivers/bus/fsl-mc/mc-sys.c | 2 +- drivers/bus/mhi/ep/ring.c | 16 +- drivers/bus/mhi/host/pm.c | 18 +- drivers/bus/ti-sysc.c | 49 ----- drivers/clk/meson/g12a.c | 1 + drivers/clk/rockchip/clk-rk3036.c | 1 + drivers/cpufreq/scmi-cpufreq.c | 36 +++- drivers/cpufreq/tegra186-cpufreq.c | 7 - drivers/crypto/marvell/cesa/cesa.c | 2 +- drivers/crypto/marvell/cesa/cesa.h | 9 +- drivers/crypto/marvell/cesa/tdma.c | 53 +++-- drivers/dma-buf/udmabuf.c | 5 +- drivers/edac/altera_edac.c | 6 +- drivers/edac/amd64_edac.c | 1 + drivers/gpio/gpio-mlxbf3.c | 52 +++-- drivers/gpio/gpiolib-of.c | 9 + drivers/gpu/drm/i915/i915_pmu.c | 4 +- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 14 +- drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c | 7 + drivers/gpu/drm/nouveau/nouveau_backlight.c | 2 +- drivers/hv/connection.c | 23 +- drivers/hwmon/ftsteutates.c | 9 +- drivers/hwmon/occ/common.c | 238 +++++++++------------ drivers/i2c/busses/i2c-designware-slave.c | 2 +- drivers/i2c/busses/i2c-npcm7xx.c | 12 +- drivers/i2c/busses/i2c-tegra.c | 5 + drivers/iio/accel/fxls8962af-core.c | 15 +- drivers/iio/adc/ad7606_spi.c | 2 +- drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c | 8 +- drivers/infiniband/core/iwcm.c | 29 +-- drivers/input/keyboard/gpio_keys.c | 2 + drivers/input/misc/ims-pcu.c | 6 + drivers/input/misc/sparcspkr.c | 22 +- drivers/iommu/amd/iommu.c | 8 + drivers/md/dm-raid1.c | 5 +- drivers/md/dm-verity-fec.c | 4 + drivers/md/dm-verity-target.c | 8 +- drivers/md/dm-verity-verify-sig.c | 17 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 4 +- drivers/media/i2c/ccs-pll.c | 11 +- drivers/media/i2c/ds90ub913.c | 4 +- drivers/media/i2c/ov5675.c | 5 +- drivers/media/i2c/ov8856.c | 9 +- .../vcodec/decoder/vdec/vdec_hevc_req_multi_if.c | 2 +- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 59 +++-- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 14 +- drivers/media/platform/qcom/venus/core.c | 16 +- drivers/media/platform/ti/davinci/vpif.c | 4 +- drivers/media/platform/ti/omap3isp/ispccdc.c | 8 +- drivers/media/platform/ti/omap3isp/ispstat.c | 6 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 2 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 2 +- drivers/media/usb/dvb-usb/cxusb.c | 3 +- drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c | 7 +- drivers/media/usb/uvc/uvc_ctrl.c | 23 +- drivers/media/usb/uvc/uvc_driver.c | 27 ++- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mmc/core/card.h | 6 + drivers/mmc/core/quirks.h | 10 + drivers/mmc/core/sd.c | 32 ++- drivers/mmc/host/sdhci-esdhc-imx.c | 88 +++++++- drivers/mtd/nand/raw/qcom_nandc.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 + drivers/net/can/m_can/tcan4x5x-core.c | 9 +- drivers/net/ethernet/aquantia/atlantic/aq_main.c | 1 - drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 + drivers/net/ethernet/cadence/macb_main.c | 6 +- drivers/net/ethernet/cortina/gemini.c | 37 +++- drivers/net/ethernet/dlink/dl2k.c | 14 +- drivers/net/ethernet/dlink/dl2k.h | 2 + drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- drivers/net/ethernet/faraday/Kconfig | 1 + drivers/net/ethernet/intel/e1000e/netdev.c | 14 +- drivers/net/ethernet/intel/e1000e/ptp.c | 8 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 7 +- drivers/net/ethernet/intel/ice/ice_arfs.c | 48 +++++ drivers/net/ethernet/intel/ice/ice_switch.c | 4 +- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 9 +- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/vport.c | 18 +- drivers/net/ethernet/microchip/lan743x_ethtool.c | 18 +- drivers/net/ethernet/microchip/lan743x_ptp.c | 2 +- drivers/net/ethernet/microchip/lan743x_ptp.h | 5 +- drivers/net/ethernet/pensando/ionic/ionic_main.c | 3 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 24 ++- drivers/net/ethernet/vertexcom/mse102x.c | 15 +- drivers/net/usb/asix.h | 1 - drivers/net/usb/asix_common.c | 22 -- drivers/net/usb/asix_devices.c | 17 +- drivers/net/usb/ch9200.c | 7 +- drivers/net/vxlan/vxlan_core.c | 8 +- drivers/net/wireless/ath/ath11k/ce.c | 11 +- drivers/net/wireless/ath/ath11k/core.c | 55 +++++ drivers/net/wireless/ath/ath11k/core.h | 7 + drivers/net/wireless/ath/ath11k/dp_rx.c | 25 ++- drivers/net/wireless/ath/ath11k/hal.c | 4 +- drivers/net/wireless/ath/ath11k/qmi.c | 9 + drivers/net/wireless/ath/ath12k/ce.c | 11 +- drivers/net/wireless/ath/ath12k/ce.h | 6 +- drivers/net/wireless/ath/ath12k/dp_mon.c | 2 + drivers/net/wireless/ath/ath12k/hal.c | 4 +- drivers/net/wireless/ath/ath12k/hal_desc.h | 2 +- drivers/net/wireless/ath/ath12k/pci.c | 3 + drivers/net/wireless/ath/ath12k/wmi.c | 20 +- drivers/net/wireless/ath/carl9170/usb.c | 19 +- drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 3 + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 6 + drivers/net/wireless/intersil/p54/fwio.c | 2 + drivers/net/wireless/intersil/p54/p54.h | 1 + drivers/net/wireless/intersil/p54/txrx.c | 13 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 2 + .../net/wireless/mediatek/mt76/mt76x2/usb_init.c | 13 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 5 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 8 + drivers/net/wireless/purelifi/plfxlc/usb.c | 4 +- drivers/net/wireless/realtek/rtlwifi/pci.c | 10 + drivers/net/wireless/realtek/rtw88/usb.c | 2 +- drivers/net/wireless/realtek/rtw89/cam.c | 3 + drivers/net/wireless/realtek/rtw89/pci.c | 69 +++++- drivers/net/wireless/realtek/rtw89/pci.h | 1 + drivers/net/wireless/virtual/mac80211_hwsim.c | 5 + drivers/pci/controller/cadence/pcie-cadence-ep.c | 5 +- drivers/pci/controller/dwc/pcie-dw-rockchip.c | 2 +- drivers/pci/pci.c | 3 +- drivers/pci/quirks.c | 23 ++ drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 10 +- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 21 +- drivers/pinctrl/pinctrl-mcp23s08.c | 8 + drivers/platform/loongarch/loongson-laptop.c | 87 ++++---- drivers/platform/x86/amd/pmc/pmc.c | 2 + drivers/platform/x86/dell/dell_rbu.c | 6 +- drivers/platform/x86/ideapad-laptop.c | 3 + .../intel/uncore-frequency/uncore-frequency-tpmi.c | 9 +- drivers/power/supply/bq27xxx_battery.c | 2 +- drivers/power/supply/bq27xxx_battery_i2c.c | 13 +- drivers/power/supply/collie_battery.c | 1 + drivers/ptp/ptp_clock.c | 3 +- drivers/ptp/ptp_private.h | 22 +- drivers/rapidio/rio_cm.c | 3 + drivers/regulator/max14577-regulator.c | 5 +- drivers/regulator/max20086-regulator.c | 4 +- drivers/remoteproc/remoteproc_core.c | 6 +- drivers/s390/scsi/zfcp_sysfs.c | 2 + drivers/scsi/elx/efct/efct_hw.c | 5 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +- drivers/scsi/lpfc/lpfc_sli.c | 4 +- drivers/scsi/storvsc_drv.c | 10 +- drivers/staging/iio/impedance-analyzer/ad5933.c | 2 +- drivers/tee/tee_core.c | 11 +- drivers/tty/serial/sh-sci.c | 16 ++ drivers/uio/uio_hv_generic.c | 4 +- drivers/video/console/vgacon.c | 2 +- drivers/video/fbdev/core/fbcon.c | 7 +- drivers/video/fbdev/core/fbmem.c | 22 +- drivers/video/screen_info_pci.c | 75 ++++--- drivers/watchdog/da9052_wdt.c | 1 + fs/ceph/super.c | 1 + fs/configfs/dir.c | 2 +- fs/ext4/ext4.h | 7 + fs/ext4/extents.c | 18 +- fs/ext4/file.c | 7 +- fs/ext4/inline.c | 2 +- fs/ext4/inode.c | 10 +- fs/f2fs/compress.c | 23 +- fs/f2fs/f2fs.h | 5 + fs/f2fs/inode.c | 10 +- fs/f2fs/namei.c | 9 + fs/f2fs/segment.c | 6 + fs/f2fs/super.c | 12 +- fs/gfs2/lock_dlm.c | 3 +- fs/jbd2/transaction.c | 5 +- fs/jffs2/erase.c | 4 +- fs/jffs2/scan.c | 4 +- fs/jffs2/summary.c | 7 +- fs/nfs/read.c | 3 +- fs/nfsd/nfs4proc.c | 3 +- fs/nfsd/nfssvc.c | 6 +- fs/smb/client/cached_dir.c | 14 +- fs/smb/client/cached_dir.h | 8 +- fs/smb/client/cifsglob.h | 1 + fs/smb/client/connect.c | 17 +- fs/smb/client/namespace.c | 3 + fs/smb/client/readdir.c | 28 +-- fs/smb/client/reparse.c | 1 - fs/smb/client/sess.c | 7 +- fs/smb/client/smb2pdu.c | 33 ++- fs/smb/client/transport.c | 14 +- fs/smb/server/smb2pdu.c | 11 +- fs/xattr.c | 1 + include/acpi/actypes.h | 2 +- include/linux/acpi.h | 9 +- include/linux/atmdev.h | 6 + include/linux/hugetlb.h | 3 + include/linux/mmc/card.h | 1 + include/linux/netdevice.h | 3 +- include/net/checksum.h | 2 +- include/trace/events/erofs.h | 18 -- include/uapi/linux/bpf.h | 2 + io_uring/io-wq.c | 4 +- io_uring/io_uring.c | 2 +- io_uring/kbuf.c | 2 +- ipc/shm.c | 5 +- kernel/bpf/helpers.c | 3 +- kernel/cgroup/legacy_freezer.c | 3 +- kernel/events/core.c | 80 +++++-- kernel/exit.c | 17 +- kernel/time/clocksource.c | 2 +- kernel/trace/ftrace.c | 10 +- kernel/watchdog.c | 41 ++-- lib/Kconfig | 1 + mm/huge_memory.c | 11 +- mm/hugetlb.c | 67 ++++-- mm/mmap.c | 6 + mm/page-writeback.c | 2 +- net/atm/common.c | 1 + net/atm/lec.c | 12 +- net/atm/raw.c | 2 +- net/bridge/br_mst.c | 4 +- net/bridge/br_multicast.c | 103 ++++++++- net/bridge/br_private.h | 11 +- net/core/filter.c | 24 ++- net/core/skmsg.c | 3 +- net/core/sock.c | 4 +- net/core/utils.c | 4 +- net/ipv4/route.c | 4 + net/ipv4/tcp_fastopen.c | 3 + net/ipv4/tcp_input.c | 63 +++--- net/ipv6/calipso.c | 8 + net/ipv6/ila/ila_common.c | 6 +- net/mac80211/mesh_hwmp.c | 6 +- net/mac80211/tx.c | 6 +- net/mpls/af_mpls.c | 4 +- net/nfc/nci/uart.c | 8 +- net/sched/sch_sfq.c | 10 +- net/sched/sch_taprio.c | 6 +- net/sctp/socket.c | 3 +- net/sunrpc/svc.c | 11 +- net/sunrpc/xprtsock.c | 5 + net/tipc/crypto.c | 2 +- net/tipc/udp_media.c | 4 +- net/wireless/core.c | 6 +- security/selinux/xfrm.c | 2 +- sound/pci/hda/hda_intel.c | 2 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 9 +- sound/soc/codecs/tas2770.c | 30 ++- sound/soc/meson/meson-card-utils.c | 2 +- sound/soc/qcom/sdm845.c | 4 + sound/soc/tegra/tegra210_ahub.c | 2 + sound/usb/mixer_maps.c | 12 ++ tools/bpf/bpftool/cgroup.c | 12 +- tools/include/uapi/linux/bpf.h | 2 + tools/lib/bpf/btf.c | 16 ++ tools/perf/util/print-events.c | 1 + tools/testing/selftests/x86/Makefile | 2 +- tools/testing/selftests/x86/sigtrap_loop.c | 101 +++++++++ 297 files changed, 2410 insertions(+), 1082 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/290 configfs: Do not override creating attribute file failure in populate_attrs()
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
commit f830edbae247b89228c3e09294151b21e0dc849c upstream.
populate_attrs() may override failure for creating attribute files by success for creating subsequent bin attribute files, and have wrong return value.
Fix by creating bin attribute files under successfully creating attribute files.
--- fs/configfs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/configfs/dir.c +1 -1
@@ -593,7 +593,7 @@ static int populate_attrs(struct config_break ; } } -if (t->ct_bin_attrs) { +if (!error && t->ct_bin_attrs) {for (i =0 ; (bin_attr = t->ct_bin_attrs[i]) !=NULL ; i++) { error =configfs_create_bin_file (item, bin_attr);if (error)
Greg Kroah-Hartman
maintainerPATCH 2/290 crypto: marvell/cesa - Do not chain submitted requests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 0413bcf0fc460a68a2a7a8354aee833293d7d693 upstream.
This driver tries to chain requests together before submitting them to hardware in order to reduce completion interrupts.
However, it even extends chains that have already been submitted to hardware. This is dangerous because there is no way of knowing whether the hardware has already read the DMA memory in question or not.
Fix this by splitting the chain list into two. One for submitted requests and one for requests that have not yet been submitted. Only extend the latter.
--- drivers/crypto/marvell/cesa/cesa.c | 2 - drivers/crypto/marvell/cesa/cesa.h | 9 ++++-- drivers/crypto/marvell/cesa/tdma.c | 53 ++++++++++++++++++++++--------------- 3 files changed, 39 insertions(+), 25 deletions(-)
drivers/crypto/marvell/cesa/cesa.c +1 -1
@@ -94,7 +94,7 @@ static int mv_cesa_std_process(struct mvstatic int mv_cesa_int_process (struct mv_cesa_engine *engine,u32 status) { -if (engine->chain.first && engine->chain.last) +if (engine->chain_hw.first && engine->chain_hw.last)return mv_cesa_tdma_process (engine, status);return mv_cesa_std_process (engine, status);
drivers/crypto/marvell/cesa/cesa.h +6 -3
@@ -440,8 +440,10 @@ struct mv_cesa_dev {* SRAM * @queue: fifo of the pending crypto requests * @load: engine load counter, useful for load balancing -* @chain: list of the current tdma descriptors being processed -* by this engine. +* @chain_hw: list of the current tdma descriptors being processed +* by the hardware. +* @chain_sw: list of the current tdma descriptors that will be +* submitted to the hardware. * @complete_queue: fifo of the processed requests by the engine * * Structure storing CESA engine information.
@@ -463,7 +465,8 @@ struct mv_cesa_engine {struct gen_pool *pool;struct crypto_queue queue;atomic_t load; -struct mv_cesa_tdma_chain chain; +struct mv_cesa_tdma_chain chain_hw; +struct mv_cesa_tdma_chain chain_sw;struct list_head complete_queue;int irq; };
drivers/crypto/marvell/cesa/tdma.c +32 -21
82 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 3/290 gfs2: move msleep to sleepable context
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
commit ac5ee087d31ed93b6e45d2968a66828c6f621d8c upstream.
This patch moves the msleep_interruptible() out of the non-sleepable context by moving the ls->ls_recover_spin spinlock around so msleep_interruptible() will be called in a sleepable context.
--- fs/gfs2/lock_dlm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/gfs2/lock_dlm.c +2 -1
@@ -959,14 +959,15 @@ locks_done:if (sdp->sd_args.ar_spectator) {fs_info (sdp,"Recovery is required. Waiting for a " "non-spectator to mount.\n" ); +spin_unlock (&ls->ls_recover_spin);msleep_interruptible (1000 ); }else {fs_info (sdp,"control_mount wait1 block %u start %u " "mount %u lvb %u flags %lx\n" , block_gen, start_gen, mount_gen, lvb_gen, ls->ls_recover_flags); +spin_unlock (&ls->ls_recover_spin); } -spin_unlock (&ls->ls_recover_spin); goto restart; }
Greg Kroah-Hartman
maintainerPATCH 4/290 ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 688abe2860fd9c644705b9e11cb9649eb891b879 upstream.
The function sdm845_slim_snd_hw_params() calls the functuion snd_soc_dai_set_channel_map() but does not check its return value. A proper implementation can be found in msm_snd_hw_params().
Add error handling for snd_soc_dai_set_channel_map(). If the function fails and it is not a unsupported error, return the error code immediately.
--- sound/soc/qcom/sdm845.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/qcom/sdm845.c +4 -0
@@ -90,6 +90,10 @@ static int sdm845_slim_snd_hw_params(strelse ret =snd_soc_dai_set_channel_map (cpu_dai, tx_ch_cnt, tx_ch,0 ,NULL ); +if (ret !=0 && ret != -ENOTSUPP ) { +dev_err (rtd->dev,"failed to set cpu chan map, err:%d\n" , ret); +return ret; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 5/290 ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
commit 171eb6f71e9e3ba6a7410a1d93f3ac213f39dae2 upstream.
Commit c141ecc3cecd ("of: Warn when of_property_read_bool() is used on non-boolean properties") added a warning when trying to parse a property with a value (boolean properties are defined as: absent = false, present without any value = true). This causes a warning from meson-card-utils.
meson-card-utils needs to know about the existence of the "audio-routing" and/or "audio-widgets" properties in order to properly parse them. Switch to of_property_present() in order to silence the following warning messages during boot:
OF: /sound: Read of boolean property 'audio-routing' with a value.
OF: /sound: Read of boolean property 'audio-widgets' with a value.
--- sound/soc/meson/meson-card-utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/meson/meson-card-utils.c +1 -1
@@ -231,7 +231,7 @@ static int meson_card_parse_of_optional( const char *p)) {/* If property is not provided, don't fail ... */ -if (!of_property_read_bool (card->dev->of_node, propname)) +if (!of_property_present (card->dev->of_node, propname))return 0 ;/* ... but do fail if it is provided and the parsing fails */
Greg Kroah-Hartman
maintainerPATCH 6/290 io_uring: account drain memory to cgroup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit f979c20547e72568e3c793bc92c7522bc3166246 upstream.
Account drain allocations against memcg. It's not a big problem as each such allocation is paired with a request, which is accounted, but it's nicer to follow the limits more closely.
--- io_uring/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/io_uring.c +1 -1
@@ -1808,7 +1808,7 @@ queue:spin_unlock (&ctx->completion_lock);io_prep_async_link (req); - de =kmalloc (sizeof (*de),GFP_KERNEL ); + de =kmalloc (sizeof (*de),GFP_KERNEL_ACCOUNT );if (!de) { ret = -ENOMEM ;io_req_defer_failed (req, ret);
Greg Kroah-Hartman
maintainerPATCH 7/290 io_uring/kbuf: account ring io_buffer_list memory
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit 475a8d30371604a6363da8e304a608a5959afc40 upstream.
Follow the non-ringed pbuf struct io_buffer_list allocations and account it against the memcg. There is low chance of that being an actual problem as ring provided buffer should either pin user memory or allocate it, which is already accounted.
--- io_uring/kbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/kbuf.c +1 -1
@@ -560,7 +560,7 @@ int io_register_pbuf_ring(struct io_ringio_destroy_bl (ctx, bl); } - free_bl = bl =kzalloc (sizeof (*bl),GFP_KERNEL ); + free_bl = bl =kzalloc (sizeof (*bl),GFP_KERNEL_ACCOUNT );if (!bl)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 8/290 powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautam Menghani <[email protected]>
commit 9cc0eafd28c7faef300822992bb08d79cab2a36c upstream.
When a system is being suspended to RAM, the PCI devices are also suspended and the PPC code ends up calling pseries_msi_compose_msg() and this triggers the BUG_ON() in __pci_read_msi_msg() because the device at this point is in reduced power state. In reduced power state, the memory mapped registers of the PCI device are not accessible.
To replicate the bug:
1. Make sure deep sleep is selected
# cat /sys/power/mem_sleep s2idle [deep]
2. Make sure console is not suspended (so that dmesg logs are visible) echo N > /sys/module/printk/parameters/console_suspend
3. Suspend the system
echo mem > /sys/power/state
To fix this behaviour, read the cached msi message of the device when the device is not in PCI_D0 power state instead of touching the hardware.
--- arch/powerpc/platforms/pseries/msi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/powerpc/platforms/pseries/msi.c +6 -1
@@ -519,7 +519,12 @@ static struct msi_domain_info pseries_msstatic void pseries_msi_compose_msg (struct irq_data *data,struct msi_msg *msg) { -__pci_read_msi_msg (irq_data_get_msi_desc (data), msg); +struct pci_dev *dev =msi_desc_to_pci_dev (irq_data_get_msi_desc (data)); + +if (dev->current_state ==PCI_D0 ) +__pci_read_msi_msg (irq_data_get_msi_desc (data), msg); +else +get_cached_msi_msg (data->irq, msg); }static struct irq_chip pseries_msi_irq_chip = {
Greg Kroah-Hartman
maintainerPATCH 9/290 regulator: max20086: Fix MAX200086 chip id
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: João Paulo Gonçalves <[email protected]>
commit 71406b6d1155d883c80c1b4405939a52f723aa05 upstream.
Quoted 1 line
From MAX20086-MAX20089 datasheet, the id for a MAX20086 is
0x30and not
0x40. With the current code, the driver will fail on probe when the driver tries to identify the chip id from a MAX20086 device over I2C.
--- drivers/regulator/max20086-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/max20086-regulator.c +1 -1
@@ -29,7 +29,7 @@#define MAX20086_REG_ADC4 0x09/* DEVICE IDs */ -#define MAX20086_DEVICE_ID_MAX20086 0x40 +#define MAX20086_DEVICE_ID_MAX20086 0x30#define MAX20086_DEVICE_ID_MAX20087 0x20#define MAX20086_DEVICE_ID_MAX20088 0x10#define MAX20086_DEVICE_ID_MAX20089 0x00
Greg Kroah-Hartman
maintainerPATCH 10/290 regulator: max20086: Change enable gpio to optional
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: João Paulo Gonçalves <[email protected]>
commit e8ac7336dd62f0443a675ed80b17f0f0e6846e20 upstream.
The enable pin can be configured as always enabled by the hardware. Make the enable gpio request optional so the driver doesn't fail to probe when enable-gpios property is not present in the device tree.
--- drivers/regulator/max20086-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/max20086-regulator.c +1 -1
@@ -264,7 +264,7 @@ static int max20086_i2c_probe(struct i2c* shutdown. */ flags = boot_on ?GPIOD_OUT_HIGH :GPIOD_OUT_LOW ; - chip->ena_gpiod =devm_gpiod_get (chip->dev,"enable" , flags); + chip->ena_gpiod =devm_gpiod_get_optional (chip->dev,"enable" , flags);if (IS_ERR (chip->ena_gpiod)) { ret =PTR_ERR (chip->ena_gpiod);dev_err (chip->dev,"Failed to get enable GPIO: %d\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 11/290 net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit f0b50730bdd8f2734e548de541e845c0d40dceb6 upstream.
The function mlx5_query_nic_vport_qkey_viol_cntr() calls the function mlx5_query_nic_vport_context() but does not check its return value. This could lead to undefined behavior if the query fails. A proper implementation can be found in mlx5_nic_vport_query_local_lb().
Add error handling for mlx5_query_nic_vport_context(). If it fails, free the out buffer via kvfree() and return error code.
--- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/vport.c +6 -3
@@ -498,19 +498,22 @@ int mlx5_query_nic_vport_qkey_viol_cntr( {u32 *out;int outlen =MLX5_ST_SZ_BYTES (query_nic_vport_context_out); +int err; out =kvzalloc (outlen,GFP_KERNEL );if (!out)return -ENOMEM ; -mlx5_query_nic_vport_context (mdev,0 , out); + err =mlx5_query_nic_vport_context (mdev,0 , out); +if (err) + goto out; *qkey_viol_cntr =MLX5_GET (query_nic_vport_context_out, out, nic_vport_context.qkey_violation_counter); - +out:kvfree (out); -return 0 ; +return err; }EXPORT_SYMBOL_GPL (mlx5_query_nic_vport_qkey_viol_cntr);
Greg Kroah-Hartman
maintainerPATCH 12/290 net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit c6bb8a21cdad8c975a3a646b9e5c8df01ad29783 upstream.
The function mlx5_query_nic_vport_node_guid() calls the function mlx5_query_nic_vport_context() but does not check its return value. A proper implementation can be found in mlx5_nic_vport_query_local_lb().
Add error handling for mlx5_query_nic_vport_context(). If it fails, free the out buffer via kvfree() and return error code.
--- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/vport.c +6 -3
@@ -444,19 +444,22 @@ int mlx5_query_nic_vport_node_guid(struc {u32 *out;int outlen =MLX5_ST_SZ_BYTES (query_nic_vport_context_out); +int err; out =kvzalloc (outlen,GFP_KERNEL );if (!out)return -ENOMEM ; -mlx5_query_nic_vport_context (mdev,0 , out); + err =mlx5_query_nic_vport_context (mdev,0 , out); +if (err) + goto out; *node_guid =MLX5_GET64 (query_nic_vport_context_out, out, nic_vport_context.node_guid); - +out:kvfree (out); -return 0 ; +return err; }EXPORT_SYMBOL_GPL (mlx5_query_nic_vport_node_guid);
Greg Kroah-Hartman
maintainerPATCH 13/290 wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <[email protected]>
commit da1b9a55ff116cb040528ef664c70a4eec03ae99 upstream.
Robert Morris reported:
|If a malicious USB device pretends to be an Intersil p54 wifi
|interface and generates an eeprom_readback message with a large
|eeprom->v1.len, p54_rx_eeprom_readback() will copy data from the
|message beyond the end of priv->eeprom.
|
|static void p54_rx_eeprom_readback(struct p54_common *priv,
| struct sk_buff *skb)
|{
| struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
| struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr->data;
|
| if (priv->fw_var >= 0x509) {
| memcpy(priv->eeprom, eeprom->v2.data,
| le16_to_cpu(eeprom->v2.len));
| } else {
| memcpy(priv->eeprom, eeprom->v1.data,
| le16_to_cpu(eeprom->v1.len));
| }
| [...]The eeprom->v{1,2}.len is set by the driver in p54_download_eeprom(). The device is supposed to provide the same length back to the driver. But yes, it's possible (like shown in the report) to alter the value to something that causes a crash/panic due to overrun.
This patch addresses the issue by adding the size to the common device context, so p54_rx_eeprom_readback no longer relies on possibly tampered values... That said, it also checks if the "firmware" altered the value and no longer copies them.
The one, small saving grace is: Before the driver tries to read the eeprom, it needs to upload >a< firmware. the vendor firmware has a proprietary license and as a reason, it is not present on most distributions by default.
--- drivers/net/wireless/intersil/p54/fwio.c | 2 ++ drivers/net/wireless/intersil/p54/p54.h | 1 + drivers/net/wireless/intersil/p54/txrx.c | 13 +++++++++---- 3 files changed, 12 insertions(+), 4 deletions(-)
drivers/net/wireless/intersil/p54/fwio.c +2 -0
@@ -231,6 +231,7 @@ int p54_download_eeprom(struct p54_commomutex_lock (&priv->eeprom_mutex); priv->eeprom = buf; + priv->eeprom_slice_size = len; eeprom_hdr =skb_put (skb, eeprom_hdr_size + len);if (priv->fw_var <0x509 ) {
@@ -253,6 +254,7 @@ int p54_download_eeprom(struct p54_commo ret = -EBUSY ; } priv->eeprom =NULL ; + priv->eeprom_slice_size =0 ;mutex_unlock (&priv->eeprom_mutex);return ret; }
drivers/net/wireless/intersil/p54/p54.h +1 -0
@@ -258,6 +258,7 @@ struct p54_common {/* eeprom handling */ void *eeprom; +size_t eeprom_slice_size;struct completion eeprom_comp;struct mutex eeprom_mutex; };
drivers/net/wireless/intersil/p54/txrx.c +9 -4
@@ -496,14 +496,19 @@ static void p54_rx_eeprom_readback(strucreturn ;if (priv->fw_var >=0x509 ) { -memcpy (priv->eeprom, eeprom->v2.data, -le16_to_cpu (eeprom->v2.len)); +if (le16_to_cpu (eeprom->v2.len) != priv->eeprom_slice_size) +return ; + +memcpy (priv->eeprom, eeprom->v2.data, priv->eeprom_slice_size); }else { -memcpy (priv->eeprom, eeprom->v1.data, -le16_to_cpu (eeprom->v1.len)); +if (le16_to_cpu (eeprom->v1.len) != priv->eeprom_slice_size) +return ; + +memcpy (priv->eeprom, eeprom->v1.data, priv->eeprom_slice_size); } priv->eeprom =NULL ; + priv->eeprom_slice_size =0 ; tmp =p54_find_and_unlink_skb (priv, hdr->req_id);dev_kfree_skb_any (tmp);complete (&priv->eeprom_comp);
Greg Kroah-Hartman
maintainerPATCH 14/290 wifi: ath11k: fix rx completion meta data corruption
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ab52e3e44fe9b666281752e2481d11e25b0e3fdd upstream.
Add the missing memory barrier to make sure that the REO dest ring descriptor is read after the head pointer to avoid using stale data on weakly ordered architectures like aarch64.
This may fix the ring-buffer corruption worked around by commit f9fff67d2d7c ("wifi: ath11k: Fix SKB corruption in REO destination ring") by silently discarding data, and may possibly also address user reported errors like:
ath11k_pci 0006:01:00.0: msdu_done bit in attention is not set
Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +16 -9
@@ -2649,7 +2649,7 @@ int ath11k_dp_process_rx(struct ath11k_bstruct ath11k *ar;struct hal_reo_dest_ring *desc;enum hal_reo_dest_ring_push_reason push_reason; -u32 cookie; +u32 cookie, info0, rx_msdu_info0, rx_mpdu_info0;int i;for (i =0 ; i <MAX_RADIOS ; i++)
@@ -2662,11 +2662,14 @@ int ath11k_dp_process_rx(struct ath11k_b try_again:ath11k_hal_srng_access_begin (ab, srng); +/* Make sure descriptor is read after the head pointer. */ +dma_rmb (); +while (likely (desc = (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry (ab, srng))) { cookie =FIELD_GET (BUFFER_ADDR_INFO1_SW_COOKIE , - desc->buf_addr_info.info1); +READ_ONCE (desc->buf_addr_info.info1)); buf_id =FIELD_GET (DP_RXDMA_BUF_COOKIE_BUF_ID , cookie); mac_id =FIELD_GET (DP_RXDMA_BUF_COOKIE_PDEV_ID , cookie);
@@ -2695,8 +2698,9 @@ try_again: num_buffs_reaped[mac_id]++; + info0 =READ_ONCE (desc->info0); push_reason =FIELD_GET (HAL_REO_DEST_RING_INFO0_PUSH_REASON , - desc->info0); + info0);if (unlikely (push_reason !=HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION )) {dev_kfree_skb_any (msdu);
@@ -2704,18 +2708,21 @@ try_again:continue ; } - rxcb->is_first_msdu = !!(desc->rx_msdu_info.info0 & + rx_msdu_info0 =READ_ONCE (desc->rx_msdu_info.info0); + rx_mpdu_info0 =READ_ONCE (desc->rx_mpdu_info.info0); + + rxcb->is_first_msdu = !!(rx_msdu_info0 &RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU ); - rxcb->is_last_msdu = !!(desc->rx_msdu_info.info0 & + rxcb->is_last_msdu = !!(rx_msdu_info0 &RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU ); - rxcb->is_continuation = !!(desc->rx_msdu_info.info0 & + rxcb->is_continuation = !!(rx_msdu_info0 &RX_MSDU_DESC_INFO0_MSDU_CONTINUATION ); rxcb->peer_id =FIELD_GET (RX_MPDU_DESC_META_DATA_PEER_ID , - desc->rx_mpdu_info.meta_data); +READ_ONCE (desc->rx_mpdu_info.meta_data)); rxcb->seq_no =FIELD_GET (RX_MPDU_DESC_INFO0_SEQ_NUM , - desc->rx_mpdu_info.info0); + rx_mpdu_info0); rxcb->tid =FIELD_GET (HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM , - desc->info0); + info0); rxcb->mac_id = mac_id;__skb_queue_tail (&msdu_list[mac_id], msdu);
Greg Kroah-Hartman
maintainerPATCH 15/290 wifi: ath11k: fix ring-buffer corruption
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6d037a372f817e9fcb56482f37917545596bd776 upstream.
Users of the Lenovo ThinkPad X13s have reported that Wi-Fi sometimes breaks and the log fills up with errors like:
ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1484, expected 1492
ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1484which based on a quick look at the driver seemed to indicate some kind of ring-buffer corruption.
Miaoqing Pan tracked it down to the host seeing the updated destination ring head pointer before the updated descriptor, and the error handling for that in turn leaves the ring buffer in an inconsistent state.
Add the missing memory barrier to make sure that the descriptor is read after the head pointer to address the root cause of the corruption while fixing up the error handling in case there are ever any (ordering) bugs on the device side.
Note that the READ_ONCE() are only needed to avoid compiler mischief in case the ring-buffer helpers are ever inlined.
Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
--- drivers/net/wireless/ath/ath11k/ce.c | 11 +++++------ drivers/net/wireless/ath/ath11k/hal.c | 4 ++-- 2 files changed, 7 insertions(+), 8 deletions(-)
drivers/net/wireless/ath/ath11k/ce.c +5 -6
@@ -393,11 +393,10 @@ static int ath11k_ce_completed_recv_next goto err; } +/* Make sure descriptor is read after the head pointer. */ +dma_rmb (); + *nbytes =ath11k_hal_ce_dst_status_get_length (desc); -if (*nbytes ==0 ) { - ret = -EIO ; - goto err; - } *skb = pipe->dest_ring->skb[sw_index]; pipe->dest_ring->skb[sw_index] =NULL ;
@@ -430,8 +429,8 @@ static void ath11k_ce_recv_process_cb(stdma_unmap_single (ab->dev,ATH11K_SKB_RXCB (skb)->paddr, max_nbytes,DMA_FROM_DEVICE ); -if (unlikely (max_nbytes < nbytes)) { -ath11k_warn (ab,"rxed more than expected (nbytes %d, max %d)" , +if (unlikely (max_nbytes < nbytes || nbytes ==0 )) { +ath11k_warn (ab,"unexpected rx length (nbytes %d, max %d)" , nbytes, max_nbytes);dev_kfree_skb_any (skb);continue ;
drivers/net/wireless/ath/ath11k/hal.c +2 -2
@@ -601,7 +601,7 @@ u32 ath11k_hal_ce_dst_status_get_length( (struct hal_ce_srng_dst_status_desc *)buf;u32 len; - len =FIELD_GET (HAL_CE_DST_STATUS_DESC_FLAGS_LEN , desc->flags); + len =FIELD_GET (HAL_CE_DST_STATUS_DESC_FLAGS_LEN ,READ_ONCE (desc->flags)); desc->flags &= ~HAL_CE_DST_STATUS_DESC_FLAGS_LEN ;return len;
@@ -802,7 +802,7 @@ void ath11k_hal_srng_access_begin(struct srng->u.src_ring.cached_tp = *(volatile u32 *)srng->u.src_ring.tp_addr; }else { - srng->u.dst_ring.cached_hp = *srng->u.dst_ring.hp_addr; + srng->u.dst_ring.cached_hp =READ_ONCE (*srng->u.dst_ring.hp_addr);/* Try to prefetch the next descriptor in the ring */ if (srng->flags &HAL_SRNG_FLAGS_CACHED )
Greg Kroah-Hartman
maintainerPATCH 16/290 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 1244f0b2c3cecd3f349a877006e67c9492b41807 upstream.
If the request being processed is not a v4 compound request, then examining the cstate can have undefined results.
This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure.
--- fs/nfsd/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +2 -1
@@ -3580,7 +3580,8 @@ bool nfsd4_spo_must_allow(struct svc_rqsstruct nfs4_op_map *allow = &cstate->clp->cl_spo_must_allow;u32 opiter; -if (!cstate->minorversion) +if (rqstp->rq_procinfo != &nfsd_version4.vs_proc[NFSPROC4_COMPOUND ] || + cstate->minorversion ==0 )return false;if (cstate->spo_must_allowed)
Greg Kroah-Hartman
maintainerPATCH 17/290 nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
commit b31da62889e6d610114d81dc7a6edbcaa503fcf8 upstream.
In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference.
Normally the delayed start of laundromat_work allows sufficient time for nfsd_ssc initialization to complete. However, when the kernel waits too long for userspace responses (e.g. in nfs4_state_start_net -> nfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done -> cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the delayed work may start before nfsd_ssc initialization finishes.
Fix this by moving nfsd_ssc initialization before starting laundromat_work.
--- fs/nfsd/nfssvc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/nfsd/nfssvc.c +3 -3
@@ -432,13 +432,13 @@ static int nfsd_startup_net(struct net *if (ret) goto out_filecache; +#ifdef CONFIG_NFSD_V4_2_INTER_SSC +nfsd4_ssc_init_umount_work (nn); +#endif ret =nfs4_state_start_net (net);if (ret) goto out_reply_cache; -#ifdef CONFIG_NFSD_V4_2_INTER_SSC -nfsd4_ssc_init_umount_work (nn); -#endif nn->nfsd_net_up = true;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 18/290 SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit 0bd2f6b8996d4f1ca4573652454987826730a04a upstream.
Engineers at Hammerspace noticed that sometimes mounting with "xprtsec=tls" hangs for a minute or so, and then times out, even when the NFS server is reachable and responsive.
kTLS shuts off data_ready callbacks if strp->msg_ready is set to mitigate data_ready callbacks when a full TLS record is not yet ready to be read from the socket.
Normally msg_ready is clear when the first TLS record arrives on a socket. However, I observed that sometimes tls_setsockopt() sets strp->msg_ready, and that prevents forward progress because tls_data_ready() becomes a no-op.
Moreover, Jakub says: "If there's a full record queued at the time when [tlshd] passes the socket back to the kernel, it's up to the reader to read the already queued data out." So SunRPC cannot expect a data_ready call when ingress data is already waiting.
Add an explicit poll after SunRPC's upper transport is set up to pick up any data that arrived after the TLS handshake but before transport set-up is complete.
--- net/sunrpc/xprtsock.c | 5 +++++ 1 file changed, 5 insertions(+)
net/sunrpc/xprtsock.c +5 -0
@@ -2724,6 +2724,11 @@ static void xs_tcp_tls_setup_socket(stru }rpc_shutdown_client (lower_clnt); +/* Check for ingress data that arrived before the socket's +* ->data_ready callback was set up. +*/ +xs_poll_check_readable (upper_transport); + out_unlock:current_restore_flags (pflags,PF_MEMALLOC ); upper_transport->clnt =NULL ;
Greg Kroah-Hartman
maintainerPATCH 19/290 fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
commit 4c10fa44bc5f700e2ea21de2fbae520ba21f19d9 upstream.
Sometimes, when a file was read while it was being truncated by another NFS client, the kernel could deadlock because folio_unlock() was called twice, and the second call would XOR back the PG_locked flag.
Most of the time (depending on the timing of the truncation), nobody notices the problem because folio_unlock() gets called three times, which flips PG_locked back off:
1. vfs_read, nfs_read_folio, ... nfs_read_add_folio, nfs_return_empty_folio
2. vfs_read, nfs_read_folio, ... netfs_read_collection, netfs_unlock_abandoned_read_pages
3. vfs_read, ... nfs_do_read_folio, nfs_read_add_folio, nfs_return_empty_folio
The problem is that nfs_read_add_folio() is not supposed to unlock the folio if fscache is enabled, and a nfs_netfs_folio_unlock() check is missing in nfs_return_empty_folio().
Rarely this leads to a warning in netfs_read_collection():
------------[ cut here ]------------ R=0000031c: folio 10 is not locked WARNING: CPU: 0 PID: 29 at fs/netfs/read_collect.c:133 netfs_read_collection+0x7c0/0xf00 [...] Workqueue: events_unbound netfs_read_collection_worker RIP: 0010:netfs_read_collection+0x7c0/0xf00 [...] Call Trace: <TASK> netfs_read_collection_worker+0x67/0x80 process_one_work+0x12e/0x2c0 worker_thread+0x295/0x3a0
Most of the time, however, processes just get stuck forever in folio_wait_bit_common(), waiting for PG_locked to disappear, which never happens because nobody is really holding the folio lock.
--- fs/nfs/read.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfs/read.c +2 -1
@@ -56,7 +56,8 @@ static int nfs_return_empty_folio(struct {folio_zero_segment (folio,0 ,folio_size (folio));folio_mark_uptodate (folio); -folio_unlock (folio); +if (nfs_netfs_folio_unlock (folio)) +folio_unlock (folio);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 20/290 wifi: ath12k: fix ring-buffer corruption
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6b67d2cf14ea997061f61e9c8afd4e1c0f22acb9 upstream.
Users of the Lenovo ThinkPad X13s have reported that Wi-Fi sometimes breaks and the log fills up with errors like:
ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1484, expected 1492
ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1484which based on a quick look at the ath11k driver seemed to indicate some kind of ring-buffer corruption.
Miaoqing Pan tracked it down to the host seeing the updated destination ring head pointer before the updated descriptor, and the error handling for that in turn leaves the ring buffer in an inconsistent state.
While this has not yet been observed with ath12k, the ring-buffer implementation is very similar to the ath11k one and it suffers from the same bugs.
Add the missing memory barrier to make sure that the descriptor is read after the head pointer to address the root cause of the corruption while fixing up the error handling in case there are ever any (ordering) bugs on the device side.
Note that the READ_ONCE() are only needed to avoid compiler mischief in case the ring-buffer helpers are ever inlined.
Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/ce.c | 11 +++++------ drivers/net/wireless/ath/ath12k/hal.c | 4 ++-- 2 files changed, 7 insertions(+), 8 deletions(-)
drivers/net/wireless/ath/ath12k/ce.c +5 -6
@@ -343,11 +343,10 @@ static int ath12k_ce_completed_recv_next goto err; } +/* Make sure descriptor is read after the head pointer. */ +dma_rmb (); + *nbytes =ath12k_hal_ce_dst_status_get_length (desc); -if (*nbytes ==0 ) { - ret = -EIO ; - goto err; - } *skb = pipe->dest_ring->skb[sw_index]; pipe->dest_ring->skb[sw_index] =NULL ;
@@ -380,8 +379,8 @@ static void ath12k_ce_recv_process_cb(stdma_unmap_single (ab->dev,ATH12K_SKB_RXCB (skb)->paddr, max_nbytes,DMA_FROM_DEVICE ); -if (unlikely (max_nbytes < nbytes)) { -ath12k_warn (ab,"rxed more than expected (nbytes %d, max %d)" , +if (unlikely (max_nbytes < nbytes || nbytes ==0 )) { +ath12k_warn (ab,"unexpected rx length (nbytes %d, max %d)" , nbytes, max_nbytes);dev_kfree_skb_any (skb);continue ;
drivers/net/wireless/ath/ath12k/hal.c +2 -2
@@ -1565,7 +1565,7 @@ u32 ath12k_hal_ce_dst_status_get_length( {u32 len; - len =le32_get_bits (desc->flags,HAL_CE_DST_STATUS_DESC_FLAGS_LEN ); + len =le32_get_bits (READ_ONCE (desc->flags),HAL_CE_DST_STATUS_DESC_FLAGS_LEN ); desc->flags &= ~cpu_to_le32 (HAL_CE_DST_STATUS_DESC_FLAGS_LEN );return len;
@@ -1734,7 +1734,7 @@ void ath12k_hal_srng_access_begin(struct srng->u.src_ring.cached_tp = *(volatile u32 *)srng->u.src_ring.tp_addr; else - srng->u.dst_ring.cached_hp = *srng->u.dst_ring.hp_addr; + srng->u.dst_ring.cached_hp = READ_ONCE(*srng->u.dst_ring.hp_addr); }/* Update cached ring head/tail pointers to HW. ath12k_hal_srng_access_begin()
Greg Kroah-Hartman
maintainerPATCH 21/290 jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit af98b0157adf6504fade79b3e6cb260c4ff68e37 upstream.
Since handle->h_transaction may be a NULL pointer, so we should change it to call is_handle_aborted(handle) first before dereferencing it.
And the following data-race was reported in my fuzzer:
==================================================================
BUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata
write to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1:
jbd2_journal_dirty_metadata+0x2a5/0x770 fs/jbd2/transaction.c:1556 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103
....
read to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0:
jbd2_journal_dirty_metadata+0xf2/0x770 fs/jbd2/transaction.c:1512 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103
....
value changed: 0x00000000 -> 0x00000001
==================================================================
This issue is caused by missing data-race annotation for jh->b_modified. Therefore, the missing annotation needs to be added.
--- fs/jbd2/transaction.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/jbd2/transaction.c +3 -2
@@ -1499,7 +1499,7 @@ int jbd2_journal_dirty_metadata(handle_t jh->b_next_transaction == transaction);spin_unlock (&jh->b_state_lock); } -if (jh->b_modified ==1 ) { +if (data_race (jh->b_modified ==1 )) {/* If it's in our transaction it must be in BJ_Metadata list. */ if (data_race (jh->b_transaction == transaction && jh->b_jlist != BJ_Metadata)) {
@@ -1518,7 +1518,6 @@ int jbd2_journal_dirty_metadata(handle_t goto out; } - journal = transaction->t_journal;spin_lock (&jh->b_state_lock);if (is_handle_aborted (handle)) {
@@ -1533,6 +1532,8 @@ int jbd2_journal_dirty_metadata(handle_t goto out_unlock_bh; } + journal = transaction->t_journal; +if (jh->b_modified ==0 ) {/* * This buffer's got modified and becoming part
Greg Kroah-Hartman
maintainerPATCH 22/290 wifi: rtw88: usb: Reduce control message timeout to 500 ms
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
commit 490340faddea461319652ce36dbc7c1b4482c35e upstream.
RTL8811AU stops responding during the firmware download on some systems:
[ 809.256440] rtw_8821au 5-2.1:1.0: Firmware version 42.4.0, H2C version 0 [ 812.759142] rtw_8821au 5-2.1:1.0 wlp48s0f4u2u1: renamed from wlan0 [ 837.315388] rtw_8821au 1-4:1.0: write register 0x1ef4 failed with -110 [ 867.524259] rtw_8821au 1-4:1.0: write register 0x1ef8 failed with -110 [ 868.930976] rtw_8821au 5-2.1:1.0 wlp48s0f4u2u1: entered promiscuous mode [ 897.730952] rtw_8821au 1-4:1.0: write register 0x1efc failed with -110
Each write takes 30 seconds to fail because that's the timeout currently used for control messages in rtw_usb_write().
In this scenario the firmware download takes at least 2000 seconds. Because this is done from the USB probe function, the long delay makes other things in the system hang.
Reduce the timeout to 500 ms. This is the value used by the official USB wifi drivers from Realtek.
Of course this only makes things hang for ~30 seconds instead of ~30 minutes. It doesn't fix the firmware download.
Tested with RTL8822CU, RTL8812BU, RTL8811CU, RTL8814AU, RTL8811AU, RTL8812AU, RTL8821AU, RTL8723DU.
--- drivers/net/wireless/realtek/rtw88/usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw88/usb.c +1 -1
@@ -133,7 +133,7 @@ static void rtw_usb_write(struct rtw_dev ret =usb_control_msg (udev,usb_sndctrlpipe (udev,0 ),RTW_USB_CMD_REQ ,RTW_USB_CMD_WRITE , - addr,0 , data, len,30000 ); + addr,0 , data, len,500 );if (ret <0 && ret != -ENODEV && count++ <4 )rtw_err (rtwdev,"write register 0x%x failed with %d\n" , addr, ret);
Greg Kroah-Hartman
maintainerPATCH 23/290 wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingcong Bai <[email protected]>
commit 77a6407c6ab240527166fb19ee96e95f5be4d3cd upstream.
RTL8723BE found on some ASUSTek laptops, such as F441U and X555UQ with subsystem ID 11ad:1723 are known to output large amounts of PCIe AER errors during and after boot up, causing heavy lags and at times lock-ups:
pcieport 0000:00:1c.5: AER: Correctable error message received from 0000:00:1c.5 pcieport 0000:00:1c.5: PCIe Bus Error: severity=Correctable, type=Physical Layer, (Receiver ID)
pcieport 0000:00:1c.5: device [8086:9d15] error status/mask=00000001/00002000
pcieport 0000:00:1c.5: [ 0] RxErr
Disable ASPM on this combo as a quirk.
This patch is a revision of a previous patch (linked below) which attempted to disable ASPM for RTL8723BE on all Intel Skylake and Kaby Lake PCIe bridges. I take a more conservative approach as all known reports point to ASUSTek laptops of these two generations with this particular wireless card.
Please note, however, before the rtl8723be finishes probing, the AER errors remained. After the module finishes probing, all AER errors would indeed be eliminated, along with heavy lags, poor network throughput, and/or occasional lock-ups.
--- drivers/net/wireless/realtek/rtlwifi/pci.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/wireless/realtek/rtlwifi/pci.c +10 -0
@@ -155,6 +155,16 @@ static void _rtl_pci_update_default_settif (rtlpriv->rtlhal.hw_type ==HARDWARE_TYPE_RTL8192SE && init_aspm ==0x43 ) ppsc->support_aspm = false; + +/* RTL8723BE found on some ASUSTek laptops, such as F441U and +* X555UQ with subsystem ID 11ad:1723 are known to output large +* amounts of PCIe AER errors during and after boot up, causing +* heavy lags, poor network throughput, and occasional lock-ups. +*/ +if (rtlpriv->rtlhal.hw_type ==HARDWARE_TYPE_RTL8723BE && + (rtlpci->pdev->subsystem_vendor ==0x11ad && + rtlpci->pdev->subsystem_device ==0x1723 )) + ppsc->support_aspm = false; } static bool _rtl_pci_platform_switch_device_pci_aspm(
Greg Kroah-Hartman
maintainerPATCH 24/290 media: ov8856: suppress probe deferral errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e3d86847fba58cf71f66e81b6a2515e07039ae17 upstream.
Probe deferral should not be logged as an error:
ov8856 24-0010: failed to get HW configuration: -517
Use dev_err_probe() for the clock lookup and drop the (mostly) redundant dev_err() from sensor probe() to suppress it.
Note that errors during regulator lookup is already correctly logged using dev_err_probe().
--- drivers/media/i2c/ov8856.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/media/i2c/ov8856.c +3 -6
@@ -2323,8 +2323,8 @@ static int ov8856_get_hwcfg(struct ov885if (!is_acpi_node (fwnode)) { ov8856->xvclk =devm_clk_get (dev,"xvclk" );if (IS_ERR (ov8856->xvclk)) { -dev_err (dev,"could not get xvclk clock (%pe)\n" , - ov8856->xvclk); +dev_err_probe (dev,PTR_ERR (ov8856->xvclk), +"could not get xvclk clock\n" );return PTR_ERR (ov8856->xvclk); }
@@ -2429,11 +2429,8 @@ static int ov8856_probe(struct i2c_clienreturn -ENOMEM ; ret =ov8856_get_hwcfg (ov8856, &client->dev); -if (ret) { -dev_err (&client->dev,"failed to get HW configuration: %d" , - ret); +if (ret)return ret; - }v4l2_i2c_subdev_init (&ov8856->sd, client, &ov8856_subdev_ops);
Greg Kroah-Hartman
maintainerPATCH 25/290 media: ov5675: suppress probe deferral errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 8268da3c474a43a79a6540fb06c5d3b730a0d5a5 upstream.
Probe deferral should not be logged as an error:
ov5675 24-0010: failed to get HW configuration: -517
Drop the (mostly) redundant dev_err() from sensor probe() to suppress it.
Note that errors during clock and regulator lookup are already correctly logged using dev_err_probe().
--- drivers/media/i2c/ov5675.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/media/i2c/ov5675.c +1 -4
@@ -1339,11 +1339,8 @@ static int ov5675_probe(struct i2c_clienreturn -ENOMEM ; ret =ov5675_get_hwcfg (ov5675, &client->dev); -if (ret) { -dev_err (&client->dev,"failed to get HW configuration: %d" , - ret); +if (ret)return ret; - }v4l2_i2c_subdev_init (&ov5675->sd, client, &ov5675_subdev_ops);
Greg Kroah-Hartman
maintainerPATCH 26/290 media: nxp: imx8-isi: better handle the m2m usage_count
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurentiu Palcu <[email protected]>
commit 910efa649076be9c2e1326059830327cf4228cf6 upstream.
Currently, if streamon/streamoff calls are imbalanced we can either end up with a negative ISI m2m usage_count (if streamoff() is called more times than streamon()) in which case we'll not be able to restart the ISI pipe next time, or the usage_count never gets to 0 and the pipe is never switched off.
To avoid that, add a 'streaming' flag to mxc_isi_m2m_ctx_queue_data and use it in the streamon/streamoff to avoid incrementing/decrementing the usage_count uselessly, if called multiple times from the same context.
--- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c +13 -1
@@ -43,6 +43,7 @@ struct mxc_isi_m2m_ctx_queue_data {struct v4l2_pix_format_mplane format;const struct mxc_isi_format_info *info;u32 sequence; +bool streaming; };struct mxc_isi_m2m_ctx {
@@ -486,15 +487,18 @@ static int mxc_isi_m2m_streamon(struct f enum v4l2_buf_type type) {struct mxc_isi_m2m_ctx *ctx =to_isi_m2m_ctx (fh); +struct mxc_isi_m2m_ctx_queue_data *q =mxc_isi_m2m_ctx_qdata (ctx, type);const struct v4l2_pix_format_mplane *out_pix = &ctx->queues.out.format;const struct v4l2_pix_format_mplane *cap_pix = &ctx->queues.cap.format;const struct mxc_isi_format_info *cap_info = ctx->queues.cap.info;const struct mxc_isi_format_info *out_info = ctx->queues.out.info;struct mxc_isi_m2m *m2m = ctx->m2m;bool bypass; -int ret; +if (q->streaming) +return 0 ; +mutex_lock (&m2m->lock);if (m2m->usage_count ==INT_MAX ) {
@@ -547,6 +551,8 @@ static int mxc_isi_m2m_streamon(struct f goto unchain; } + q->streaming = true; +return 0 ; unchain:
@@ -569,10 +575,14 @@ static int mxc_isi_m2m_streamoff(struct enum v4l2_buf_type type) {struct mxc_isi_m2m_ctx *ctx =to_isi_m2m_ctx (fh); +struct mxc_isi_m2m_ctx_queue_data *q =mxc_isi_m2m_ctx_qdata (ctx, type);struct mxc_isi_m2m *m2m = ctx->m2m;v4l2_m2m_ioctl_streamoff (file, fh, type); +if (!q->streaming) +return 0 ; +mutex_lock (&m2m->lock);/*
@@ -598,6 +608,8 @@ static int mxc_isi_m2m_streamoff(structmutex_unlock (&m2m->lock); + q->streaming = false; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 27/290 media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
commit ef205273132bdc9bcfa1540eef8105475a453300 upstream.
When setting the sink pad's stream format, set_fmt accidentally changes the returned format's code to 'outcode', while the purpose is to only use the 'outcode' for the propagated source stream format.
--- drivers/media/i2c/ds90ub913.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/ds90ub913.c +2 -2
@@ -453,10 +453,10 @@ static int ub913_set_fmt(struct v4l2_subif (!fmt)return -EINVAL ; - format->format.code = finfo->outcode; - *fmt = format->format; + fmt->code = finfo->outcode; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 28/290 media: ccs-pll: Start VT pre-PLL multiplier search from correct value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit 06d2d478b09e6764fb6161d1621fc10d9f0f2860 upstream.
The ccs_pll_calculate_vt_tree() function does a search over possible VT PLL configurations to find the "best" one. If the sensor does not support odd pre-PLL divisors and the minimum value (with constraints) isn't 1, other odd values could be errorneously searched (and selected) for the pre-PLL divisor. Fix this.
--- drivers/media/i2c/ccs-pll.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/i2c/ccs-pll.c +2 -0
@@ -397,6 +397,8 @@ static int ccs_pll_calculate_vt_tree(str min_pre_pll_clk_div =max_t (u16, min_pre_pll_clk_div, pll->ext_clk_freq_hz / lim_fr->max_pll_ip_clk_freq_hz); +if (!(pll->flags &CCS_PLL_FLAG_EXT_IP_PLL_DIVIDER )) + min_pre_pll_clk_div =clk_div_even (min_pre_pll_clk_div);dev_dbg (dev,"vt min/max_pre_pll_clk_div: %u,%u\n" , min_pre_pll_clk_div, max_pre_pll_clk_div);
Greg Kroah-Hartman
maintainerPATCH 29/290 media: ccs-pll: Start OP pre-PLL multiplier search from correct value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit 660e613d05e449766784c549faf5927ffaf281f1 upstream.
The ccs_pll_calculate() function does a search over possible PLL configurations to find the "best" one. If the sensor does not support odd pre-PLL divisors and the minimum value (with constraints) isn't 1, other odd values could be errorneously searched (and selected) for the pre-PLL divisor. Fix this.
--- drivers/media/i2c/ccs-pll.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/i2c/ccs-pll.c +2 -0
@@ -817,6 +817,8 @@ int ccs_pll_calculate(struct device *devone_or_more (DIV_ROUND_UP (op_lim_fr->max_pll_op_clk_freq_hz, pll->ext_clk_freq_hz)))); +if (!(pll->flags &CCS_PLL_FLAG_EXT_IP_PLL_DIVIDER )) + min_op_pre_pll_clk_div =clk_div_even (min_op_pre_pll_clk_div);dev_dbg (dev,"pll_op check: min / max op_pre_pll_clk_div: %u / %u\n" , min_op_pre_pll_clk_div, max_op_pre_pll_clk_div);
Greg Kroah-Hartman
maintainerPATCH 30/290 media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit f639494db450770fa30d6845d9c84b9cb009758f upstream.
The PLL calculator does a search of the PLL configuration space for all valid OP pre-PLL clock dividers. The maximum did not take into account the CCS PLL flag CCS_PLL_FLAG_EXT_IP_PLL_DIVIDER in which case also odd PLL dividers (other than 1) are valid. Do that now.
--- drivers/media/i2c/ccs-pll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/ccs-pll.c +1 -1
@@ -794,7 +794,7 @@ int ccs_pll_calculate(struct device *dev op_lim_fr->min_pre_pll_clk_div, op_lim_fr->max_pre_pll_clk_div); max_op_pre_pll_clk_div =min_t (u16, op_lim_fr->max_pre_pll_clk_div, -clk_div_even (pll->ext_clk_freq_hz / +DIV_ROUND_UP (pll->ext_clk_freq_hz, op_lim_fr->min_pll_ip_clk_freq_hz)); min_op_pre_pll_clk_div = max_t(u16, op_lim_fr->min_pre_pll_clk_div,
Greg Kroah-Hartman
maintainerPATCH 31/290 media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit 6868b955acd6e5d7405a2b730c2ffb692ad50d2c upstream.
The check for VT PLL upper limit in dual PLL case was missing. Add it now.
--- drivers/media/i2c/ccs-pll.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/media/i2c/ccs-pll.c +5 -0
@@ -312,6 +312,11 @@ __ccs_pll_calculate_vt_tree(struct devicdev_dbg (dev,"more_mul2: %u\n" , more_mul); pll_fr->pll_multiplier = mul * more_mul; +if (pll_fr->pll_multiplier > lim_fr->max_pll_multiplier) { +dev_dbg (dev,"pll multiplier %u too high\n" , + pll_fr->pll_multiplier); +return -EINVAL ; + }if (pll_fr->pll_multiplier * pll_fr->pll_ip_clk_freq_hz > lim_fr->max_pll_op_clk_freq_hz)
Greg Kroah-Hartman
maintainerPATCH 32/290 media: cxusb: no longer judge rbuf when the write fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 73fb3b92da84637e3817580fa205d48065924e15 upstream.
syzbot reported a uninit-value in cxusb_i2c_xfer. [1]
Only when the write operation of usb_bulk_msg() in dvb_usb_generic_rw() succeeds and rlen is greater than 0, the read operation of usb_bulk_msg() will be executed to read rlen bytes of data from the dvb device into the rbuf.
In this case, although rlen is 1, the write operation failed which resulted in the dvb read operation not being executed, and ultimately variable i was not initialized.
[1]
BUG: KMSAN: uninit-value in cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline] BUG: KMSAN: uninit-value in cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196 cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline] cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196 __i2c_transfer+0xe25/0x3150 drivers/i2c/i2c-core-base.c:-1 i2c_transfer+0x317/0x4a0 drivers/i2c/i2c-core-base.c:2315 i2c_transfer_buffer_flags+0x125/0x1e0 drivers/i2c/i2c-core-base.c:2343 i2c_master_send include/linux/i2c.h:109 [inline] i2cdev_write+0x210/0x280 drivers/i2c/i2c-dev.c:183 do_loop_readv_writev fs/read_write.c:848 [inline] vfs_writev+0x963/0x14e0 fs/read_write.c:1057 do_writev+0x247/0x5c0 fs/read_write.c:1101 __do_sys_writev fs/read_write.c:1169 [inline] __se_sys_writev fs/read_write.c:1166 [inline] __x64_sys_writev+0x98/0xe0 fs/read_write.c:1166 x64_sys_call+0x2229/0x3c80 arch/x86/include/generated/asm/syscalls_64.h:21 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- drivers/media/usb/dvb-usb/cxusb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/usb/dvb-usb/cxusb.c +1 -2
@@ -119,9 +119,8 @@ static void cxusb_gpio_tuner(struct dvb_ o[0 ] =GPIO_TUNER ; o[1 ] = onoff; -cxusb_ctrl_msg (d,CMD_GPIO_WRITE , o,2 , &i,1 ); -if (i !=0x01 ) +if (!cxusb_ctrl_msg (d,CMD_GPIO_WRITE , o,2 , &i,1 ) && i !=0x01 )dev_info (&d->udev->dev,"gpio_write failed.\n" ); st->gpio_write_state[GPIO_TUNER ] = onoff;
Greg Kroah-Hartman
maintainerPATCH 33/290 media: davinci: vpif: Fix memory leak in probe error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Nikiforov <[email protected]>
commit 024bf40edf1155e7a587f0ec46294049777d9b02 upstream.
If an error occurs during the initialization of pdev_display, the allocated platform device pdev_capture is not released properly, leading to a memory leak.
Adjust error path handling to fix the leak.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/media/platform/ti/davinci/vpif.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/ti/davinci/vpif.c +3 -1
@@ -505,7 +505,7 @@ static int vpif_probe(struct platform_de pdev_display =kzalloc (sizeof (*pdev_display),GFP_KERNEL );if (!pdev_display) { ret = -ENOMEM ; - goto err_put_pdev_capture; + goto err_del_pdev_capture; } pdev_display->name ="vpif_display" ;
@@ -528,6 +528,8 @@ static int vpif_probe(struct platform_de err_put_pdev_display:platform_device_put (pdev_display); +err_del_pdev_capture: +platform_device_del (pdev_capture); err_put_pdev_capture:platform_device_put (pdev_capture); err_put_rpm:
Greg Kroah-Hartman
maintainerPATCH 34/290 media: gspca: Add error handling for stv06xx_read_sensor()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 398a1b33f1479af35ca915c5efc9b00d6204f8fa upstream.
In hdcs_init(), the return value of stv06xx_read_sensor() needs to be checked. A proper implementation can be found in vv6410_dump(). Add a check in loop condition and propergate error code to fix this issue.
--- drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c +4 -3
@@ -520,12 +520,13 @@ static int hdcs_init(struct sd *sd)static int hdcs_dump (struct sd *sd) {u16 reg, val; +int err =0 ;pr_info ("Dumping sensor registers:\n" ); -for (reg =HDCS_IDENT ; reg <=HDCS_ROWEXPH ; reg++) { -stv06xx_read_sensor (sd, reg, &val); +for (reg =HDCS_IDENT ; reg <=HDCS_ROWEXPH && !err; reg++) { + err =stv06xx_read_sensor (sd, reg, &val);pr_info ("reg 0x%02x = 0x%02x\n" , reg, val); } -return 0 ; +return (err <0 ) ? err :0 ; }
Greg Kroah-Hartman
maintainerPATCH 35/290 media: mediatek: vcodec: Correct vsi_core framebuffer size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fei Shao <[email protected]>
commit f19035b86382f635a0d13d177b601babaf263a12 upstream.
The framebuffer size for decoder instances was being incorrectly set - inst->vsi_core->fb.y.size was assigned twice consecutively.
Assign the second picinfo framebuffer size to the C framebuffer instead, which appears to be the intended target based on the surrounding code.
--- drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c +1 -1
@@ -821,7 +821,7 @@ static int vdec_hevc_slice_setup_core_bu inst->vsi_core->fb.y.dma_addr = y_fb_dma; inst->vsi_core->fb.y.size = ctx->picinfo.fb_sz[0 ]; inst->vsi_core->fb.c.dma_addr = c_fb_dma; - inst->vsi_core->fb.y.size = ctx->picinfo.fb_sz[1 ]; + inst->vsi_core->fb.c.size = ctx->picinfo.fb_sz[1 ]; inst->vsi_core->dec.vdec_fb_va = (unsigned long )fb;
Greg Kroah-Hartman
maintainerPATCH 36/290 media: omap3isp: use sgtable-based scatterlist wrappers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 3de572fe2189a4a0bd80295e1f478401e739498e upstream.
Use common wrappers operating directly on the struct sg_table objects to fix incorrect use of scatterlists sync calls. dma_sync_sg_for_*() functions have to be called with the number of elements originally passed to dma_map_sg_*() function, not the one returned in sgtable's nents.
--- drivers/media/platform/ti/omap3isp/ispccdc.c | 8 ++++---- drivers/media/platform/ti/omap3isp/ispstat.c | 6 ++---- 2 files changed, 6 insertions(+), 8 deletions(-)
drivers/media/platform/ti/omap3isp/ispccdc.c +4 -4
@@ -446,8 +446,8 @@ static int ccdc_lsc_config(struct isp_ccif (ret <0 ) goto done; -dma_sync_sg_for_cpu (isp->dev, req->table.sgt.sgl, - req->table.sgt.nents,DMA_TO_DEVICE ); +dma_sync_sgtable_for_cpu (isp->dev, &req->table.sgt, +DMA_TO_DEVICE );if (copy_from_user (req->table.addr, config->lsc, req->config.size)) {
@@ -455,8 +455,8 @@ static int ccdc_lsc_config(struct isp_cc goto done; } -dma_sync_sg_for_device (isp->dev, req->table.sgt.sgl, - req->table.sgt.nents,DMA_TO_DEVICE ); +dma_sync_sgtable_for_device (isp->dev, &req->table.sgt, +DMA_TO_DEVICE ); }spin_lock_irqsave (&ccdc->lsc.req_lock, flags);
drivers/media/platform/ti/omap3isp/ispstat.c +2 -4
@@ -161,8 +161,7 @@ static void isp_stat_buf_sync_for_deviceif (ISP_STAT_USES_DMAENGINE (stat))return ; -dma_sync_sg_for_device (stat->isp->dev, buf->sgt.sgl, - buf->sgt.nents,DMA_FROM_DEVICE ); +dma_sync_sgtable_for_device (stat->isp->dev, &buf->sgt,DMA_FROM_DEVICE ); } static void isp_stat_buf_sync_for_cpu(struct ispstat *stat,
@@ -171,8 +170,7 @@ static void isp_stat_buf_sync_for_cpu(stif (ISP_STAT_USES_DMAENGINE (stat))return ; -dma_sync_sg_for_cpu (stat->isp->dev, buf->sgt.sgl, - buf->sgt.nents,DMA_FROM_DEVICE ); +dma_sync_sgtable_for_cpu (stat->isp->dev, &buf->sgt,DMA_FROM_DEVICE ); }static void isp_stat_buf_clear (struct ispstat *stat)
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.95 release. There are 290 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:53 +0000. Anything received after that time might be too late.
Build issue:
In file included from main.h:14,
from cgroup.c:20:
cgroup.c: In function 'do_show':
cgroup.c:339:36: error: 'cgroup_attach_types' undeclared (first use in this function); did you mean 'parse_attach_type'?
339 | for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++) {
| ^~~~~~~~~~~~~~~~~~~BPF tool build is failing:
Culprit looks like:
commit: 27db5e6b493b ("bpftool: Fix cgroup command to only show cgroup bpf programs")
Thanks,
Harshit
Quoted 10 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.95-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Greg Kroah-Hartman
maintainerQuoted 24 lines · Harshit Mogalapalli
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.95 release. There are 290 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:53 +0000. Anything received after that time might be too late.
Build issue:
In file included from main.h:14,
from cgroup.c:20: cgroup.c: In function 'do_show': cgroup.c:339:36: error: 'cgroup_attach_types' undeclared (first use in this function); did you mean 'parse_attach_type'? 339 | for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++) { | ^~~~~~~~~~~~~~~~~~~
Quoted 8 lines
BPF tool build is failing:
Culprit looks like:
commit:
27db5e6b493b("bpftool: Fix cgroup command to only show cgroup bpf programs")
Odd that 6.1.y isn't failing as well. I'll go drop this from all branches older than 6.15.y for now.
thanks,
greg k-h
Hi Greg,
Quoted 15 lines
Quoted 15 lines
Build issue:
In file included from main.h:14,
from cgroup.c:20: cgroup.c: In function 'do_show': cgroup.c:339:36: error: 'cgroup_attach_types' undeclared (first use in this function); did you mean 'parse_attach_type'? 339 | for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++) { | ^~~~~~~~~~~~~~~~~~~BPF tool build is failing:
Quoted 9 lines
Quoted 5 lines
Culprit looks like:
commit:
27db5e6b493b("bpftool: Fix cgroup command to only show cgroup bpf programs")Odd that 6.1.y isn't failing as well. I'll go drop this from all branches older than 6.15.y for now.
I did test 6.12.y and 6.6.y but not 6.1.y.
So didn't report 6.1.y - but the issue is there as well.
Let us not drop it from 6.12.y greg. Why ?
The problem is because this commit was missing in 6.6.y causing the build to fail. but this commit: 98b303c9bf05 ("bpftool: Query only cgroup-related attach types") is present in 6.12.y. So lets us not drop backport of commit: b69d4413aa19 ("bpftool: Fix cgroup command to only show cgroup bpf programs") from 6.12.y
mainline : v6.11-rc1 - 98b303c9bf05 bpftool: Query only
cgroup-related attach types
├── stable-6.11 : v6.11-rc1 - 98b303c9bf05 ├── stable-6.12 : v6.11-rc1 - 98b303c9bf05 ├── stable-6.13 : v6.11-rc1 - 98b303c9bf05 ├── stable-6.14 : v6.11-rc1 - 98b303c9bf05 ├── stable-6.15 : v6.11-rc1 - 98b303c9bf05
Summary: Drop the patch we are talking about: upstream commit: b69d4413aa19 ("bpftool: Fix cgroup command to only show cgroup bpf programs") from 6.1.y and 6.6.y but not from 6.12.y
Thanks,
Harshit
Quoted 4 lines
thanks,
greg k-h
Greg Kroah-Hartman
maintainerQuoted 50 lines · Harshit Mogalapalli
Hi Greg,
Quoted 15 lines
Quoted 15 lines
Build issue:
In file included from main.h:14,
from cgroup.c:20: cgroup.c: In function 'do_show': cgroup.c:339:36: error: 'cgroup_attach_types' undeclared (first use in this function); did you mean 'parse_attach_type'? 339 | for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++) { | ^~~~~~~~~~~~~~~~~~~BPF tool build is failing:
Quoted 9 lines
Quoted 5 lines
Culprit looks like:
commit:
27db5e6b493b("bpftool: Fix cgroup command to only show cgroup bpf programs")Odd that 6.1.y isn't failing as well. I'll go drop this from all branches older than 6.15.y for now.
I did test 6.12.y and 6.6.y but not 6.1.y.
So didn't report 6.1.y - but the issue is there as well.
Let us not drop it from 6.12.y greg. Why ?
The problem is because this commit was missing in 6.6.y causing the build to fail. but this commit:
98b303c9bf05("bpftool: Query only cgroup-related attach types") is present in 6.12.y. So lets us not drop backport of commit:b69d4413aa19("bpftool: Fix cgroup command to only show cgroup bpf programs") from 6.12.ymainline : v6.11-rc1 -
98b303c9bf05bpftool: Query only
cgroup-related attach types├── stable-6.11 : v6.11-rc1 - 98b303c9bf05 ├── stable-6.12 : v6.11-rc1 - 98b303c9bf05 ├── stable-6.13 : v6.11-rc1 - 98b303c9bf05 ├── stable-6.14 : v6.11-rc1 - 98b303c9bf05 ├── stable-6.15 : v6.11-rc1 - 98b303c9bf05
Quoted 3 lines
Summary: Drop the patch we are talking about: upstream commit:
b69d4413aa19("bpftool: Fix cgroup command to only show cgroup bpf programs") from 6.1.y and 6.6.y but not from 6.12.y
Ok, I just assumed that this was also broken on 6.12.y, so dropped it there. I've now added it back, thanks for letting me know.
greg k-h
Am 23.06.2025 um 15:04 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.6.95 release. There are 290 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Greg Kroah-Hartman
maintainerPATCH 37/290 media: v4l2-dev: fix error handling in __video_register_device()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a upstream.
Once device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it could cause memory leak. And move callback function v4l2_device_release() and v4l2_device_get() before put_device().
As comment of device_register() says, 'NOTE: _Never_ directly free @dev after calling this function, even if it returned an error! Always use put_device() to give up the reference initialized in this function instead.'
Found by code review.
--- drivers/media/v4l2-core/v4l2-dev.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/media/v4l2-core/v4l2-dev.c +7 -7
@@ -1033,25 +1033,25 @@ int __video_register_device(struct video vdev->dev.class = &video_class; vdev->dev.devt =MKDEV (VIDEO_MAJOR , vdev->minor); vdev->dev.parent = vdev->dev_parent; + vdev->dev.release = v4l2_device_release;dev_set_name (&vdev->dev,"%s%d" , name_base, vdev->num); + +/* Increase v4l2_device refcount */ +v4l2_device_get (vdev->v4l2_dev); +mutex_lock (&videodev_lock); ret =device_register (&vdev->dev);if (ret <0 ) {mutex_unlock (&videodev_lock);pr_err ("%s: device_register failed\n" , __func__); - goto cleanup; +put_device (&vdev->dev); +return ret; } -/* Register the release callback that will be called when the last -reference to the device goes away. */ - vdev->dev.release = v4l2_device_release;if (nr !=-1 && nr != vdev->num && warn_if_nr_in_use)pr_warn ("%s: requested %s%d, got %s\n" , __func__, name_base, nr,video_device_node_name (vdev)); -/* Increase v4l2_device refcount */ -v4l2_device_get (vdev->v4l2_dev); -/* Part 5: Register the entity. */ ret =video_register_media_controller (vdev);
Greg Kroah-Hartman
maintainerPATCH 38/290 media: venus: Fix probe error handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
commit 523cea3a19f0b3b020a4745344c136a636e6ffd7 upstream.
Video device registering has been moved earlier in the probe function, but the new order has not been propagated to error handling. This means we can end with unreleased resources on error (e.g dangling video device on missing firmware probe aborting).
--- drivers/media/platform/qcom/venus/core.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/media/platform/qcom/venus/core.c +8 -8
@@ -348,7 +348,7 @@ static int venus_probe(struct platform_d ret =v4l2_device_register (dev, &core->v4l2_dev);if (ret) - goto err_core_deinit; + goto err_hfi_destroy;platform_set_drvdata (pdev, core);
@@ -380,24 +380,24 @@ static int venus_probe(struct platform_d ret =venus_enumerate_codecs (core,VIDC_SESSION_TYPE_DEC );if (ret) - goto err_venus_shutdown; + goto err_core_deinit; ret =venus_enumerate_codecs (core,VIDC_SESSION_TYPE_ENC );if (ret) - goto err_venus_shutdown; + goto err_core_deinit; ret =pm_runtime_put_sync (dev);if (ret) {pm_runtime_get_noresume (dev); - goto err_dev_unregister; + goto err_core_deinit; }venus_dbgfs_init (core);return 0 ; -err_dev_unregister: -v4l2_device_unregister (&core->v4l2_dev); +err_core_deinit: +hfi_core_deinit (core, false); err_venus_shutdown:venus_shutdown (core); err_firmware_deinit:
@@ -408,9 +408,9 @@ err_runtime_disable:pm_runtime_put_noidle (dev);pm_runtime_disable (dev);pm_runtime_set_suspended (dev); +v4l2_device_unregister (&core->v4l2_dev); +err_hfi_destroy:hfi_destroy (core); -err_core_deinit: -hfi_core_deinit (core, false); err_core_put:if (core->pm_ops->core_put) core->pm_ops->core_put (core);
Greg Kroah-Hartman
maintainerPATCH 39/290 media: videobuf2: use sgtable-based scatterlist wrappers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit a704a3c503ae1cfd9de8a2e2d16a0c9430e98162 upstream.
Use common wrappers operating directly on the struct sg_table objects to fix incorrect use of scatterlists sync calls. dma_sync_sg_for_*() functions have to be called with the number of elements originally passed to dma_map_sg_*() function, not the one returned in sgt->nents.
--- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/common/videobuf2/videobuf2-dma-sg.c +2 -2
@@ -469,7 +469,7 @@ vb2_dma_sg_dmabuf_ops_begin_cpu_access(sstruct vb2_dma_sg_buf *buf = dbuf->priv;struct sg_table *sgt = buf->dma_sgt; -dma_sync_sg_for_cpu (buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); +dma_sync_sgtable_for_cpu (buf->dev, sgt, buf->dma_dir);return 0 ; }
@@ -480,7 +480,7 @@ vb2_dma_sg_dmabuf_ops_end_cpu_access(strstruct vb2_dma_sg_buf *buf = dbuf->priv;struct sg_table *sgt = buf->dma_sgt; -dma_sync_sg_for_device (buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); +dma_sync_sgtable_for_device (buf->dev, sgt, buf->dma_dir);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 40/290 media: vidtv: Terminating the subsequent process of initialization failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 1d5f88f053480326873115092bc116b7d14916ba upstream.
syzbot reported a slab-use-after-free Read in vidtv_mux_init. [1]
After PSI initialization fails, the si member is accessed again, resulting in this uaf.
After si initialization fails, the subsequent process needs to be exited.
[1]
BUG: KASAN: slab-use-after-free in vidtv_mux_pid_ctx_init drivers/media/test-drivers/vidtv/vidtv_mux.c:78 [inline] BUG: KASAN: slab-use-after-free in vidtv_mux_init+0xac2/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:524 Read of size 8 at addr ffff88802fa42acc by task syz.2.37/6059 CPU: 0 UID: 0 PID: 6059 Comm: syz.2.37 Not tainted 6.14.0-rc5-syzkaller #0 Hardware name: Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xd9/0x110 mm/kasan/report.c:634 vidtv_mux_pid_ctx_init drivers/media/test-drivers/vidtv/vidtv_mux.c:78 vidtv_mux_init+0xac2/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:524 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 vidtv_start_feed drivers/media/test-drivers/vidtv/vidtv_bridge.c:239 dmx_section_feed_start_filtering drivers/media/dvb-core/dvb_demux.c:973 dvb_dmxdev_feed_start drivers/media/dvb-core/dmxdev.c:508 [inline] dvb_dmxdev_feed_restart.isra.0 drivers/media/dvb-core/dmxdev.c:537 dvb_dmxdev_filter_stop+0x2b4/0x3a0 drivers/media/dvb-core/dmxdev.c:564 dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:840 [inline] dvb_demux_release+0x92/0x550 drivers/media/dvb-core/dmxdev.c:1246 __fput+0x3ff/0xb70 fs/file_table.c:464 task_work_run+0x14e/0x250 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xad8/0x2d70 kernel/exit.c:938 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1096 x64_sys_call+0x151f/0x1720 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f871d58d169 Code: Unable to access opcode bytes at 0x7f871d58d13f. RSP: 002b:00007fff4b19a788 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f871d58d169 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fff4b19a7ec R08: 0000000b4b19a87f R09: 00000000000927c0 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000003 R13: 00000000000927c0 R14: 000000000001d553 R15: 00007fff4b19a840 </TASK> Allocated by task 6059: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] vidtv_psi_pat_table_init drivers/media/test-drivers/vidtv/vidtv_psi.c:970 vidtv_channel_si_init drivers/media/test-drivers/vidtv/vidtv_channel.c:423 vidtv_mux_init drivers/media/test-drivers/vidtv/vidtv_mux.c:519 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 vidtv_start_feed drivers/media/test-drivers/vidtv/vidtv_bridge.c:239 dmx_section_feed_start_filtering drivers/media/dvb-core/dvb_demux.c:973 dvb_dmxdev_feed_start drivers/media/dvb-core/dmxdev.c:508 [inline] dvb_dmxdev_feed_restart.isra.0 drivers/media/dvb-core/dmxdev.c:537 dvb_dmxdev_filter_stop+0x2b4/0x3a0 drivers/media/dvb-core/dmxdev.c:564 dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:840 [inline] dvb_demux_release+0x92/0x550 drivers/media/dvb-core/dmxdev.c:1246 __fput+0x3ff/0xb70 fs/file_table.c:464 task_work_run+0x14e/0x250 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xad8/0x2d70 kernel/exit.c:938 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1096 x64_sys_call arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6059: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4609 [inline] kfree+0x2c4/0x4d0 mm/slub.c:4757 vidtv_channel_si_init drivers/media/test-drivers/vidtv/vidtv_channel.c:499 vidtv_mux_init drivers/media/test-drivers/vidtv/vidtv_mux.c:519 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 vidtv_start_feed drivers/media/test-drivers/vidtv/vidtv_bridge.c:239 dmx_section_feed_start_filtering drivers/media/dvb-core/dvb_demux.c:973 dvb_dmxdev_feed_start drivers/media/dvb-core/dmxdev.c:508 [inline] dvb_dmxdev_feed_restart.isra.0 drivers/media/dvb-core/dmxdev.c:537 dvb_dmxdev_filter_stop+0x2b4/0x3a0 drivers/media/dvb-core/dmxdev.c:564 dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:840 [inline] dvb_demux_release+0x92/0x550 drivers/media/dvb-core/dmxdev.c:1246 __fput+0x3ff/0xb70 fs/file_table.c:464 task_work_run+0x14e/0x250 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xad8/0x2d70 kernel/exit.c:938 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1096 x64_sys_call arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- drivers/media/test-drivers/vidtv/vidtv_channel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/test-drivers/vidtv/vidtv_channel.c +1 -1
@@ -497,7 +497,7 @@ free_sdt:vidtv_psi_sdt_table_destroy (m->si.sdt); free_pat:vidtv_psi_pat_table_destroy (m->si.pat); -return 0 ; +return -EINVAL ; }void vidtv_channel_si_destroy (struct vidtv_mux *m)
Greg Kroah-Hartman
maintainerPATCH 41/290 media: vivid: Change the siize of the composing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <[email protected]>
commit f83ac8d30c43fd902af7c84c480f216157b60ef0 upstream.
syzkaller found a bug:
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 1440 at addr ffffc9000d0ffda0 by task vivid-000-vid-c/5304 CPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline] vivid_thread_vid_cap_tick+0xf8e/0x60d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x8aa/0xf30 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
The composition size cannot be larger than the size of fmt_cap_rect. So execute v4l2_rect_map_inside() even if has_compose_cap == 0.
--- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/test-drivers/vivid/vivid-vid-cap.c +1 -1
@@ -954,8 +954,8 @@ int vivid_vid_cap_s_selection(struct filif (dev->has_compose_cap) {v4l2_rect_set_min_size (compose, &min_rect);v4l2_rect_set_max_size (compose, &max_rect); -v4l2_rect_map_inside (compose, &fmt); } +v4l2_rect_map_inside (compose, &fmt); dev->fmt_cap_rect = fmt;tpg_s_buf_height (&dev->tpg, fmt.height); }else if (dev->has_compose_cap) {
Greg Kroah-Hartman
maintainerPATCH 42/290 media: imx-jpeg: Drop the first error frames
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit d52b9b7e2f10d22a49468128540533e8d76910cd upstream.
When an output buffer contains error frame header, v4l2_jpeg_parse_header() will return error, then driver will mark this buffer and a capture buffer done with error flag in device_run().
But if the error occurs in the first frames, before setup the capture queue, there is no chance to schedule device_run(), and there may be no capture to mark error.
So we need to drop this buffer with error flag, and make the decoding can continue.
--- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +11 -1
@@ -1913,9 +1913,19 @@ static void mxc_jpeg_buf_queue(struct vb jpeg_src_buf =vb2_to_mxc_buf (vb); jpeg_src_buf->jpeg_parse_error = false; ret =mxc_jpeg_parse (ctx, vb); -if (ret) +if (ret) { jpeg_src_buf->jpeg_parse_error = true; +/* +* if the capture queue is not setup, the device_run() won't be scheduled, +* need to drop the error buffer, so that the decoding can continue +*/ +if (!vb2_is_streaming (v4l2_m2m_get_dst_vq (ctx->fh.m2m_ctx))) { +v4l2_m2m_buf_done (vbuf,VB2_BUF_STATE_ERROR ); +return ; + } + } + end:v4l2_m2m_buf_queue (ctx->fh.m2m_ctx, vbuf); }
Greg Kroah-Hartman
maintainerPATCH 43/290 media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit 46e9c092f850bd7b4d06de92d3d21877f49a3fcb upstream.
Move function mxc_jpeg_free_slot_data() above mxc_jpeg_alloc_slot_data() allowing to call that function during allocation failures. No functional changes are made.
--- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 40 ++++++++++++------------- 1 file changed, 20 insertions(+), 20 deletions(-)
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +20 -20
@@ -752,6 +752,26 @@ static int mxc_get_free_slot(struct mxc_return -1 ; } +static void mxc_jpeg_free_slot_data (struct mxc_jpeg_dev *jpeg) +{ +/* free descriptor for decoding/encoding phase */ +dma_free_coherent (jpeg->dev,sizeof (struct mxc_jpeg_desc ), + jpeg->slot_data.desc, + jpeg->slot_data.desc_handle); + +/* free descriptor for encoder configuration phase / decoder DHT */ +dma_free_coherent (jpeg->dev,sizeof (struct mxc_jpeg_desc ), + jpeg->slot_data.cfg_desc, + jpeg->slot_data.cfg_desc_handle); + +/* free configuration stream */ +dma_free_coherent (jpeg->dev,MXC_JPEG_MAX_CFG_STREAM , + jpeg->slot_data.cfg_stream_vaddr, + jpeg->slot_data.cfg_stream_handle); + + jpeg->slot_data.used = false; +} +static bool mxc_jpeg_alloc_slot_data (struct mxc_jpeg_dev *jpeg) {struct mxc_jpeg_desc *desc;
@@ -798,26 +818,6 @@ err:return false; } -static void mxc_jpeg_free_slot_data (struct mxc_jpeg_dev *jpeg) -{ -/* free descriptor for decoding/encoding phase */ -dma_free_coherent (jpeg->dev,sizeof (struct mxc_jpeg_desc ), - jpeg->slot_data.desc, - jpeg->slot_data.desc_handle); - -/* free descriptor for encoder configuration phase / decoder DHT */ -dma_free_coherent (jpeg->dev,sizeof (struct mxc_jpeg_desc ), - jpeg->slot_data.cfg_desc, - jpeg->slot_data.cfg_desc_handle); - -/* free configuration stream */ -dma_free_coherent (jpeg->dev,MXC_JPEG_MAX_CFG_STREAM , - jpeg->slot_data.cfg_stream_vaddr, - jpeg->slot_data.cfg_stream_handle); - - jpeg->slot_data.used = false; -} -static void mxc_jpeg_check_and_set_last_buffer (struct mxc_jpeg_ctx *ctx,struct vb2_v4l2_buffer *src_buf,struct vb2_v4l2_buffer *dst_buf)
Greg Kroah-Hartman
maintainerPATCH 44/290 media: imx-jpeg: Reset slot data pointers when freed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit faa8051b128f4b34277ea8a026d02d83826f8122 upstream.
Ensure that the slot data pointers are reset to NULL and handles are set to 0 after freeing the coherent memory. This makes he function mxc_jpeg_alloc_slot_data() and mxc_jpeg_free_slot_data() safe to be called multiple times.
--- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +6 -0
@@ -758,16 +758,22 @@ static void mxc_jpeg_free_slot_data(strudma_free_coherent (jpeg->dev,sizeof (struct mxc_jpeg_desc ), jpeg->slot_data.desc, jpeg->slot_data.desc_handle); + jpeg->slot_data.desc =NULL ; + jpeg->slot_data.desc_handle =0 ;/* free descriptor for encoder configuration phase / decoder DHT */ dma_free_coherent (jpeg->dev,sizeof (struct mxc_jpeg_desc ), jpeg->slot_data.cfg_desc, jpeg->slot_data.cfg_desc_handle); + jpeg->slot_data.cfg_desc_handle =0 ; + jpeg->slot_data.cfg_desc =NULL ;/* free configuration stream */ dma_free_coherent (jpeg->dev,MXC_JPEG_MAX_CFG_STREAM , jpeg->slot_data.cfg_stream_vaddr, jpeg->slot_data.cfg_stream_handle); + jpeg->slot_data.cfg_stream_vaddr =NULL ; + jpeg->slot_data.cfg_stream_handle =0 ; jpeg->slot_data.used = false; }
Greg Kroah-Hartman
maintainerPATCH 45/290 media: imx-jpeg: Cleanup after an allocation error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit 7500bb9cf164edbb2c8117d57620227b1a4a8369 upstream.
When allocation failures are not cleaned up by the driver, further allocation errors will be false-positives, which will cause buffers to remain uninitialized and cause NULL pointer dereferences. Ensure proper cleanup of failed allocations to prevent these issues.
--- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +1 -0
@@ -820,6 +820,7 @@ skip_alloc:return true; err:dev_err (jpeg->dev,"Could not allocate descriptors for slot %d" , jpeg->slot_data.slot); +mxc_jpeg_free_slot_data (jpeg);return false; }
Greg Kroah-Hartman
maintainerPATCH 46/290 media: uvcvideo: Return the number of processed controls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
commit ba4fafb02ad6a4eb2e00f861893b5db42ba54369 upstream.
If we let know our callers that we have not done anything, they will be able to optimize their decisions.
Message-ID: <[email protected]>
--- drivers/media/usb/uvc/uvc_ctrl.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_ctrl.c +10 -1
@@ -1783,12 +1783,17 @@ int uvc_ctrl_begin(struct uvc_video_chaireturn mutex_lock_interruptible (&chain->ctrl_mutex) ? -ERESTARTSYS :0 ; } +/* +* Returns the number of uvc controls that have been correctly set, or a +* negative number if there has been an error. +*/ static int uvc_ctrl_commit_entity (struct uvc_device *dev,struct uvc_fh *handle,struct uvc_entity *entity,int rollback,struct uvc_control **err_ctrl) { +unsigned int processed_ctrls =0 ;struct uvc_control *ctrl;unsigned int i;int ret;
@@ -1823,6 +1828,9 @@ static int uvc_ctrl_commit_entity(structelse ret =0 ; +if (!ret) + processed_ctrls++; +if (rollback || ret <0 ) memcpy(uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT), uvc_ctrl_data(ctrl, UVC_CTRL_DATA_BACKUP),
@@ -1841,7 +1849,7 @@ static int uvc_ctrl_commit_entity(structuvc_ctrl_set_handle (handle, ctrl, handle); } -return 0 ; +return processed_ctrls; } static int uvc_ctrl_find_ctrl_idx(struct uvc_entity *entity,
@@ -1888,6 +1896,7 @@ int __uvc_ctrl_commit(struct uvc_fh *hanif (!rollback)uvc_ctrl_send_events (handle, ctrls->controls, ctrls->count); + ret =0 ; done:mutex_unlock (&chain->ctrl_mutex);return ret;
Greg Kroah-Hartman
maintainerPATCH 47/290 media: uvcvideo: Send control events for partial succeeds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
commit 5c791467aea6277430da5f089b9b6c2a9d8a4af7 upstream.
Today, when we are applying a change to entities A, B. If A succeeds and B fails the events for A are not sent.
This change changes the code so the events for A are send right after they happen.
Message-ID: <[email protected]>
--- drivers/media/usb/uvc/uvc_ctrl.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/media/usb/uvc/uvc_ctrl.c +9 -3
@@ -1642,7 +1642,9 @@ static bool uvc_ctrl_xctrls_has_control( }static void uvc_ctrl_send_events (struct uvc_fh *handle, -const struct v4l2_ext_control *xctrls,unsigned int xctrls_count) +struct uvc_entity *entity, +const struct v4l2_ext_control *xctrls, +unsigned int xctrls_count) {struct uvc_control_mapping *mapping;struct uvc_control *ctrl;
@@ -1653,6 +1655,9 @@ static void uvc_ctrl_send_events(structu32 changes =V4L2_EVENT_CTRL_CH_VALUE ; ctrl =uvc_find_control (handle->chain, xctrls[i].id, &mapping); +if (ctrl->entity != entity) +continue ; +if (ctrl->info.flags &UVC_CTRL_FLAG_ASYNCHRONOUS )/* Notification will be sent from an Interrupt event. */ continue ;
@@ -1891,11 +1896,12 @@ int __uvc_ctrl_commit(struct uvc_fh *hanuvc_ctrl_find_ctrl_idx (entity, ctrls, err_ctrl); goto done; + }else if (ret >0 && !rollback) { +uvc_ctrl_send_events (handle, entity, + ctrls->controls, ctrls->count); } } -if (!rollback) -uvc_ctrl_send_events (handle, ctrls->controls, ctrls->count); ret =0 ; done:mutex_unlock (&chain->ctrl_mutex);
Greg Kroah-Hartman
maintainerPATCH 48/290 media: uvcvideo: Fix deferred probing error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
commit 387e8939307192d5a852a2afeeb83427fa477151 upstream.
uvc_gpio_parse() can return -EPROBE_DEFER when the GPIOs it depends on have not yet been probed. This return code should be propagated to the caller of uvc_probe() to ensure that probing is retried when the required GPIOs become available.
Currently, this error code is incorrectly converted to -ENODEV, causing some internal cameras to be ignored.
This commit fixes this issue by propagating the -EPROBE_DEFER error.
Message-ID: <[email protected]>
--- drivers/media/usb/uvc/uvc_driver.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +19 -8
@@ -2217,13 +2217,16 @@ static int uvc_probe(struct usb_interfac#endif /* Parse the Video Class control descriptor. */ -if (uvc_parse_control (dev) <0 ) { + ret =uvc_parse_control (dev); +if (ret <0 ) { + ret = -ENODEV ;uvc_dbg (dev,PROBE ,"Unable to parse UVC descriptors\n" ); goto error; }/* Parse the associated GPIOs. */ -if (uvc_gpio_parse (dev) <0 ) { + ret =uvc_gpio_parse (dev); +if (ret <0 ) {uvc_dbg (dev,PROBE ,"Unable to parse UVC GPIOs\n" ); goto error; }
@@ -2249,24 +2252,32 @@ static int uvc_probe(struct usb_interfac }/* Register the V4L2 device. */ -if (v4l2_device_register (&intf->dev, &dev->vdev) <0 ) + ret =v4l2_device_register (&intf->dev, &dev->vdev); +if (ret <0 ) goto error;/* Scan the device for video chains. */ -if (uvc_scan_device (dev) <0 ) +if (uvc_scan_device (dev) <0 ) { + ret = -ENODEV ; goto error; + }/* Initialize controls. */ -if (uvc_ctrl_init_device (dev) <0 ) +if (uvc_ctrl_init_device (dev) <0 ) { + ret = -ENODEV ; goto error; + }/* Register video device nodes. */ -if (uvc_register_chains (dev) <0 ) +if (uvc_register_chains (dev) <0 ) { + ret = -ENODEV ; goto error; + }#ifdef CONFIG_MEDIA_CONTROLLER /* Register the media device node */ -if (media_device_register (&dev->mdev) <0 ) + ret =media_device_register (&dev->mdev); +if (ret <0 ) goto error;#endif /* Save our data pointer in the interface data. */
@@ -2300,7 +2311,7 @@ static int uvc_probe(struct usb_interfac error:uvc_unregister_video (dev);kref_put (&dev->ref, uvc_delete); -return -ENODEV ; +return ret; }static void uvc_disconnect (struct usb_interface *intf)
Greg Kroah-Hartman
maintainerPATCH 49/290 arm64/mm: Close theoretical race where stale TLB entry remains valid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
commit 4b634918384c0f84c33aeb4dd9fd4c38e7be5ccb upstream.
Commit 3ea277194daa ("mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries") describes a race that, prior to the commit, could occur between reclaim and operations such as mprotect() when using reclaim's tlbbatch mechanism. See that commit for details but the summary is:
"""
Nadav Amit identified a theoritical race between page reclaim and mprotect due to TLB flushes being batched outside of the PTL being held.
He described the race as follows:
CPU0 CPU1 ---- ---- user accesses memory using RW PTE [PTE now cached in TLB] try_to_unmap_one() ==> ptep_get_and_clear() ==> set_tlb_ubc_flush_pending() mprotect(addr, PROT_READ) ==> change_pte_range() ==> [ PTE non-present - no flush ] user writes using cached RW PTE ... try_to_unmap_flush()
"""
The solution was to insert flush_tlb_batched_pending() in mprotect() and friends to explcitly drain any pending reclaim TLB flushes. In the modern version of this solution, arch_flush_tlb_batched_pending() is called to do that synchronisation.
arm64's tlbbatch implementation simply issues TLBIs at queue-time (arch_tlbbatch_add_pending()), eliding the trailing dsb(ish). The trailing dsb(ish) is finally issued in arch_tlbbatch_flush() at the end of the batch to wait for all the issued TLBIs to complete.
Now, the Arm ARM states:
"""
The completion of the TLB maintenance instruction is guaranteed only by the execution of a DSB by the observer that performed the TLB maintenance instruction. The execution of a DSB by a different observer does not have this effect, even if the DSB is known to be executed after the TLB maintenance instruction is observed by that different observer. """
arch_tlbbatch_add_pending() and arch_tlbbatch_flush() conform to this requirement because they are called from the same task (either kswapd or caller of madvise(MADV_PAGEOUT)), so either they are on the same CPU or if the task was migrated, __switch_to() contains an extra dsb(ish).
HOWEVER, arm64's arch_flush_tlb_batched_pending() is also implemented as a dsb(ish). But this may be running on a CPU remote from the one that issued the outstanding TLBIs. So there is no architectural gurantee of synchonization. Therefore we are still vulnerable to the theoretical race described in Commit 3ea277194daa ("mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries").
Fix this by flushing the entire mm in arch_flush_tlb_batched_pending(). This aligns with what the other arches that implement the tlbbatch feature do.
--- arch/arm64/include/asm/tlbflush.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/arm64/include/asm/tlbflush.h +5 -4
@@ -311,13 +311,14 @@ static inline void arch_tlbbatch_add_pen }/* -* If mprotect/munmap/etc occurs during TLB batched flushing, we need to -* synchronise all the TLBI issued with a DSB to avoid the race mentioned in -* flush_tlb_batched_pending(). +* If mprotect/munmap/etc occurs during TLB batched flushing, we need to ensure +* all the previously issued TLBIs targeting mm have completed. But since we +* can be executing on a remote CPU, a DSB cannot guarantee this like it can +* for arch_tlbbatch_flush(). Our only option is to flush the entire mm. */ static inline void arch_flush_tlb_batched_pending (struct mm_struct *mm) { -dsb (ish); +flush_tlb_mm (mm); }/*
Greg Kroah-Hartman
maintainerPATCH 50/290 ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Stutterheim <[email protected]>
commit 96e0b355883006554a0bee3697da475971d6bba8 upstream.
arm/memremap: fix arch_memremap_can_ram_remap()
commit 260364d112bc ("arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map") added the definition of arch_memremap_can_ram_remap() for arm[64] specific filtering of what pages can be used from the linear mapping. memblock_is_map_memory() was called with the pfn of the address given to arch_memremap_can_ram_remap(); however, memblock_is_map_memory() expects to be given an address for arm, not a pfn.
This results in calls to memremap() returning a newly mapped area when it should return an address in the existing linear mapping.
Fix this by removing the address to pfn translation and pass the address directly.
--- arch/arm/mm/ioremap.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/arm/mm/ioremap.c +1 -3
@@ -515,7 +515,5 @@ void __init early_ioremap_init(void)bool arch_memremap_can_ram_remap (resource_size_t offset,size_t size,unsigned long flags) { -unsigned long pfn =PHYS_PFN (offset); - -return memblock_is_map_memory (pfn); +return memblock_is_map_memory (offset); }
Greg Kroah-Hartman
maintainerPATCH 51/290 ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <[email protected]>
commit 7397daf1029d5bfd3415ec8622f5179603d5702d upstream.
The late init call just writes to omap4 registers as soon as CONFIG_MFD_CPCAP is enabled without checking whether the cpcap driver is actually there or the SoC is indeed an OMAP4.
Rather do these things only with the right device combination.
Fixes booting the BT200 with said configuration enabled and non-factory X-Loader and probably also some surprising behavior on other devices.
--- arch/arm/mach-omap2/pmic-cpcap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/pmic-cpcap.c +5 -1
@@ -264,7 +264,11 @@ int __init omap4_cpcap_init(void)static int __init cpcap_late_init (void ) { -omap4_vc_set_pmic_signaling (PWRDM_POWER_RET ); +if (!of_find_compatible_node (NULL ,NULL ,"motorola,cpcap" )) +return 0 ; + +if (soc_is_omap443x () ||soc_is_omap446x () ||soc_is_omap447x ()) +omap4_vc_set_pmic_signaling (PWRDM_POWER_RET );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 52/290 bus: mhi: ep: Update read pointer only after buffer is written
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Kumar <[email protected]>
commit 6f18d174b73d0ceeaa341f46c0986436b3aefc9a upstream.
Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated read pointer before the buffer is actually written. Updating rd_offset prematurely can lead to the host accessing an uninitialized or incomplete element, resulting in data corruption.
Invoke the buffer write before updating rd_offset to ensure the element is fully written before signaling its availability.
--- drivers/bus/mhi/ep/ring.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/bus/mhi/ep/ring.c +10 -6
@@ -131,19 +131,23 @@ int mhi_ep_ring_add_element(struct mhi_e } old_offset = ring->rd_offset; -mhi_ep_ring_inc_index (ring);dev_dbg (dev,"Adding an element to ring at offset (%zu)\n" , ring->rd_offset); + buf_info.host_addr = ring->rbase + (old_offset *sizeof (*el)); + buf_info.dev_addr = el; + buf_info.size =sizeof (*el); + + ret = mhi_cntrl->write_sync (mhi_cntrl, &buf_info); +if (ret) +return ret; + +mhi_ep_ring_inc_index (ring);/* Update rp in ring context */ rp =cpu_to_le64 (ring->rd_offset *sizeof (*el) + ring->rbase);memcpy_toio ((void __iomem *) &ring->ring_ctx->generic.rp, &rp,sizeof (u64)); - buf_info.host_addr = ring->rbase + (old_offset *sizeof (*el)); - buf_info.dev_addr = el; - buf_info.size =sizeof (*el); - -return mhi_cntrl->write_sync (mhi_cntrl, &buf_info); +return ret; }void mhi_ep_ring_init (struct mhi_ep_ring *ring,enum mhi_ep_ring_type type,u32 id)
Greg Kroah-Hartman
maintainerPATCH 53/290 bus: mhi: host: Fix conflict between power_up and SYSERR
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Hugo <[email protected]>
commit 4d92e7c5ccadc79764674ffc2c88d329aabbb7e0 upstream.
When mhi_async_power_up() enables IRQs, it is possible that we could receive a SYSERR notification from the device if the firmware has crashed for some reason. Then the SYSERR notification queues a work item that cannot execute until the pm_mutex is released by mhi_async_power_up().
So the SYSERR work item will be pending. If mhi_async_power_up() detects the SYSERR, it will handle it. If the device is in PBL, then the PBL state transition event will be queued, resulting in a work item after the pending SYSERR work item. Once mhi_async_power_up() releases the pm_mutex, the SYSERR work item can run. It will blindly attempt to reset the MHI state machine, which is the recovery action for SYSERR. PBL/SBL are not interrupt driven and will ignore the MHI Reset unless SYSERR is actively advertised. This will cause the SYSERR work item to timeout waiting for reset to be cleared, and will leave the host state in SYSERR processing. The PBL transition work item will then run, and immediately fail because SYSERR processing is not a valid state for PBL transition.
This leaves the device uninitialized.
This issue has a fairly unique signature in the kernel log:
mhi mhi3: Requested to power ON
Qualcomm Cloud AI 100 0000:36:00.0: Fatal error received from device. Attempting to recover
mhi mhi3: Power on setup success
mhi mhi3: Device failed to exit MHI Reset state mhi mhi3: Device MHI is not in valid state
We cannot remove the SYSERR handling from mhi_async_power_up() because the device may be in the SYSERR state, but we missed the notification as the irq was fired before irqs were enabled. We also can't queue the SYSERR work item from mhi_async_power_up() if SYSERR is detected because that may result in a duplicate work item, and cause the same issue since the duplicate item will blindly issue MHI reset even if SYSERR is no longer active.
Instead, add a check in the SYSERR work item to make sure that MHI reset is only issued if the device is in SYSERR state for PBL or SBL EEs.
--- drivers/bus/mhi/host/pm.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/bus/mhi/host/pm.c +17 -1
@@ -586,6 +586,7 @@ static void mhi_pm_sys_error_transition(struct mhi_cmd *mhi_cmd;struct mhi_event_ctxt *er_ctxt;struct device *dev = &mhi_cntrl->mhi_dev->dev; +bool reset_device = false;int ret, i; dev_dbg(dev, "Transitioning from PM state: %s to: %s\n",
@@ -614,8 +615,23 @@ static void mhi_pm_sys_error_transition(/* Wake up threads waiting for state transition */ wake_up_all (&mhi_cntrl->state_event); -/* Trigger MHI RESET so that the device will not access host memory */ if (MHI_REG_ACCESS_VALID (prev_state)) { +/* +* If the device is in PBL or SBL, it will only respond to +* RESET if the device is in SYSERR state. SYSERR might +* already be cleared at this point. +*/ +enum mhi_state cur_state =mhi_get_mhi_state (mhi_cntrl); +enum mhi_ee_type cur_ee =mhi_get_exec_env (mhi_cntrl); + +if (cur_state ==MHI_STATE_SYS_ERR ) + reset_device = true; +else if (cur_ee !=MHI_EE_PBL && cur_ee !=MHI_EE_SBL ) + reset_device = true; + } + +/* Trigger MHI RESET so that the device will not access host memory */ +if (reset_device) {u32 in_reset =-1 ;unsigned long timeout =msecs_to_jiffies (mhi_cntrl->timeout_ms);
Greg Kroah-Hartman
maintainerPATCH 54/290 can: tcan4x5x: fix power regulator retrieval during probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brett Werling <[email protected]>
commit db22720545207f734aaa9d9f71637bfc8b0155e0 upstream.
Fixes the power regulator retrieval in tcan4x5x_can_probe() by ensuring the regulator pointer is not set to NULL in the successful return from devm_regulator_get_optional().
--- drivers/net/can/m_can/tcan4x5x-core.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/net/can/m_can/tcan4x5x-core.c +5 -4
@@ -385,10 +385,11 @@ static int tcan4x5x_can_probe(struct spi priv =cdev_to_priv (mcan_class); priv->power =devm_regulator_get_optional (&spi->dev,"vsup" ); -if (PTR_ERR (priv->power) == -EPROBE_DEFER ) { - ret = -EPROBE_DEFER ; - goto out_m_can_class_free_dev; - }else { +if (IS_ERR (priv->power)) { +if (PTR_ERR (priv->power) == -EPROBE_DEFER ) { + ret = -EPROBE_DEFER ; + goto out_m_can_class_free_dev; + } priv->power =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 55/290 ceph: set superblock s_magic for IMA fsmagic matching
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Marttinen <[email protected]>
commit 72386d5245b249f5a0a8fabb881df7ad947b8ea4 upstream.
The CephFS kernel driver forgets to set the filesystem magic signature in its superblock. As a result, IMA policy rules based on fsmagic matching do not apply as intended. This causes a major performance regression in Talos Linux [1] when mounting CephFS volumes, such as when deploying Rook Ceph [2]. Talos Linux ships a hardened kernel with the following IMA policy (irrelevant lines omitted):
[...]dont_measure fsmagic=0xc36400 # CEPH_SUPER_MAGIC
[...]
measure func=FILE_CHECK mask=^MAY_READ euid=0
measure func=FILE_CHECK mask=^MAY_READ uid=0
[...]
Currently, IMA compares 0xc36400 == 0x0 for CephFS files, resulting in all files opened with O_RDONLY or O_RDWR getting measured with SHA512 on every open(2):
10 69990c87e8af323d47e2d6ae4... ima-ng sha512:<hash> /data/cephfs/test-file
Since O_WRONLY is rare, this results in an order of magnitude lower performance than expected for practically all file operations. Properly setting CEPH_SUPER_MAGIC in the CephFS superblock resolves the regression.
Tests performed on a 3x replicated Ceph v19.3.0 cluster across three i5-7200U nodes each equipped with one Micron 7400 MAX M.2 disk (BlueStore) and Gigabit ethernet, on Talos Linux v1.10.2:
FS-Mark 3.3
Test: 500 Files, Empty
Files/s > Higher Is Better
6.12.27-talos . 16.6 |====
+twelho patch . 208.4 |====================================================
FS-Mark 3.3
Test: 500 Files, 1KB Size
Files/s > Higher Is Better
6.12.27-talos . 15.6 |=======
+twelho patch . 118.6 |====================================================
FS-Mark 3.3
Test: 500 Files, 32 Sub Dirs, 1MB Size
Files/s > Higher Is Better
6.12.27-talos . 12.7 |===============
+twelho patch . 44.7 |=====================================================
IO500 [3] 2fcd6d6 results (benchmarks within variance omitted):
| IO500 benchmark | 6.12.27-talos | +twelho patch | Speedup | |-------------------|----------------|----------------|-----------| | mdtest-easy-write | 0.018524 kIOPS | 1.135027 kIOPS | 6027.33 % | | mdtest-hard-write | 0.018498 kIOPS | 0.973312 kIOPS | 5161.71 % | | ior-easy-read | 0.064727 GiB/s | 0.155324 GiB/s | 139.97 % | | mdtest-hard-read | 0.018246 kIOPS | 0.780800 kIOPS | 4179.29 % |
This applies outside of synthetic benchmarks as well, for example, the time to rsync a 55 MiB directory with ~12k of mostly small files drops from an unusable 10m5s to a reasonable 26s (23x the throughput).
[1]: https://www.talos.dev/
[2]: https://www.talos.dev/v1.10/kubernetes-guides/configuration/ceph-with-rook/
[3]: https://github.com/IO500/io500
--- fs/ceph/super.c | 1 + 1 file changed, 1 insertion(+)
fs/ceph/super.c +1 -0
@@ -1220,6 +1220,7 @@ static int ceph_set_super(struct super_b s->s_time_min =0 ; s->s_time_max =U32_MAX ; s->s_flags |=SB_NODIRATIME |SB_NOATIME ; + s->s_magic =CEPH_SUPER_MAGIC ;ceph_fscrypt_set_ops (s);
Greg Kroah-Hartman
maintainerPATCH 56/290 cgroup,freezer: fix incomplete freezing when attaching tasks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
commit 37fb58a7273726e59f9429c89ade5116083a213d upstream.
An issue was found:
# cd /sys/fs/cgroup/freezer/ # mkdir test # echo FROZEN > test/freezer.state # cat test/freezer.state FROZEN # sleep 1000 & [1] 863 # echo 863 > test/cgroup.procs # cat test/freezer.state FREEZING
When tasks are migrated to a frozen cgroup, the freezer fails to immediately freeze the tasks, causing the cgroup to remain in the "FREEZING".
The freeze_task() function is called before clearing the CGROUP_FROZEN flag. This causes the freezing() check to incorrectly return false, preventing __freeze_task() from being invoked for the migrated task.
To fix this issue, clear the CGROUP_FROZEN state before calling freeze_task().
--- kernel/cgroup/legacy_freezer.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/cgroup/legacy_freezer.c +1 -2
@@ -189,13 +189,12 @@ static void freezer_attach(struct cgroupif (!(freezer->state &CGROUP_FREEZING )) {__thaw_task (task); }else { -freeze_task (task); -/* clear FROZEN and propagate upwards */ while (freezer && (freezer->state &CGROUP_FROZEN )) { freezer->state &= ~CGROUP_FROZEN ; freezer =parent_freezer (freezer); } +freeze_task (task); } }
Greg Kroah-Hartman
maintainerPATCH 57/290 ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tasos Sahanidis <[email protected]>
commit d29fc02caad7f94b62d56ee1b01c954f9c961ba7 upstream.
The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also prevent the system from booting.
In this case, the system hangs when reading the ATIP from optical media with cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an Optiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4, running at UDMA/33.
The issue can be reproduced by running the same command with a cygwin build of cdrecord on WinXP, although it requires more attempts to cause it. The hang in that case is also resolved by forcing PIO. It doesn't appear that VIA has produced any drivers for that OS, thus no known workaround exists.
HDDs attached to the controller do not suffer from any DMA issues.
--- drivers/ata/pata_via.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/ata/pata_via.c +2 -1
@@ -368,7 +368,8 @@ static unsigned int via_mode_filter(stru }if (dev->class ==ATA_DEV_ATAPI && -dmi_check_system (no_atapi_dma_dmi_table)) { + (dmi_check_system (no_atapi_dma_dmi_table) || + config->id ==PCI_DEVICE_ID_VIA_6415 )) {ata_dev_warn (dev,"controller locks up on ATAPI DMA, forcing PIO\n" ); mask &=ATA_MASK_PIO ; }
Greg Kroah-Hartman
maintainerPATCH 58/290 bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <[email protected]>
commit dd7d8e012b23de158ca0188239c7a1f2a83b4484 upstream.
The fsl-mc bus associated to the root DPRC in a DPAA2 system exports a device file for userspace access to the MC firmware. In case the DPRC's local MC portal (DPMCP) is currently in use, a new DPMCP device is allocated through the fsl_mc_portal_allocate() function.
In this case, the call to fsl_mc_portal_allocate() will fail with -EINVAL when trying to add a device link between the root DPRC (consumer) and the newly allocated DPMCP device (supplier). This is because the DPMCP is a dependent of the DPRC device (the bus).
Fix this by not adding a device link in case the DPMCP is allocated for the root DPRC's usage.
--- drivers/bus/fsl-mc/mc-io.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/bus/fsl-mc/mc-io.c +13 -6
@@ -214,12 +214,19 @@ int __must_check fsl_mc_portal_allocate(if (error <0 ) goto error_cleanup_resource; - dpmcp_dev->consumer_link =device_link_add (&mc_dev->dev, - &dpmcp_dev->dev, -DL_FLAG_AUTOREMOVE_CONSUMER ); -if (!dpmcp_dev->consumer_link) { - error = -EINVAL ; - goto error_cleanup_mc_io; +/* If the DPRC device itself tries to allocate a portal (usually for +* UAPI interaction), don't add a device link between them since the +* DPMCP device is an actual child device of the DPRC and a reverse +* dependency is not allowed. +*/ +if (mc_dev != mc_bus_dev) { + dpmcp_dev->consumer_link =device_link_add (&mc_dev->dev, + &dpmcp_dev->dev, +DL_FLAG_AUTOREMOVE_CONSUMER ); +if (!dpmcp_dev->consumer_link) { + error = -EINVAL ; + goto error_cleanup_mc_io; + } } *new_mc_io = mc_io;
Greg Kroah-Hartman
maintainerPATCH 59/290 bus: fsl-mc: fix GET/SET_TAILDROP command ids
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wan Junjie <[email protected]>
commit c78230ad34f82c6c0e0e986865073aeeef1f5d30 upstream.
Command ids for taildrop get/set can not pass the check when they are using from the restool user space utility. Correct them according to the user manual.
--- drivers/bus/fsl-mc/fsl-mc-uapi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bus/fsl-mc/fsl-mc-uapi.c +2 -2
@@ -275,13 +275,13 @@ static struct fsl_mc_cmd_desc fsl_mc_acc .size = 8, }, [DPSW_GET_TAILDROP] = { - .cmdid_value = 0x0A80, + .cmdid_value = 0x0A90, .cmdid_mask = 0xFFF0, .token = true, .size = 14, }, [DPSW_SET_TAILDROP] = { - .cmdid_value = 0x0A90, + .cmdid_value = 0x0A80, .cmdid_mask = 0xFFF0, .token = true, .size = 24,
Greg Kroah-Hartman
maintainerPATCH 60/290 ext4: inline: fix len overflow in ext4_prepare_inline_data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit 227cb4ca5a6502164f850d22aec3104d7888b270 upstream.
When running the following code on an ext4 filesystem with inline_data feature enabled, it will lead to the bug below.
fd = open("file1", O_RDWR | O_CREAT | O_TRUNC, 0666);
ftruncate(fd, 30);
pwrite(fd, "a", 1, (1UL << 40) + 5UL);That happens because write_begin will succeed as when ext4_generic_write_inline_data calls ext4_prepare_inline_data, pos + len will be truncated, leading to ext4_prepare_inline_data parameter to be 6 instead of 0x10000000006.
Then, later when write_end is called, we hit:
BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);
at ext4_write_inline_data.
Fix it by using a loff_t type for the len parameter in ext4_prepare_inline_data instead of an unsigned int.
[ 44.545164] ------------[ cut here ]------------ [ 44.545530] kernel BUG at fs/ext4/inline.c:240! [ 44.545834] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 44.546172] CPU: 3 UID: 0 PID: 343 Comm: test Not tainted 6.15.0-rc2-00003-g9080916f4863 #45 PREEMPT(full) 112853fcebfdb93254270a7959841d2c6aa2c8bb [ 44.546523] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 44.546523] RIP: 0010:ext4_write_inline_data+0xfe/0x100 [ 44.546523] Code: 3c 0e 48 83 c7 48 48 89 de 5b 41 5c 41 5d 41 5e 41 5f 5d e9 e4 fa 43 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 0f 0b <0f> 0b 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 20 49 [ 44.546523] RSP: 0018:ffffb342008b79a8 EFLAGS: 00010216 [ 44.546523] RAX: 0000000000000001 RBX: ffff9329c579c000 RCX: 0000010000000006 [ 44.546523] RDX: 000000000000003c RSI: ffffb342008b79f0 RDI: ffff9329c158e738 [ 44.546523] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 44.546523] R10: 00007ffffffff000 R11: ffffffff9bd0d910 R12: 0000006210000000 [ 44.546523] R13: fffffc7e4015e700 R14: 0000010000000005 R15: ffff9329c158e738 [ 44.546523] FS: 00007f4299934740(0000) GS:ffff932a60179000(0000) knlGS:0000000000000000 [ 44.546523] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.546523] CR2: 00007f4299a1ec90 CR3: 0000000002886002 CR4: 0000000000770eb0 [ 44.546523] PKRU: 55555554 [ 44.546523] Call Trace: [ 44.546523] <TASK> [ 44.546523] ext4_write_inline_data_end+0x126/0x2d0 [ 44.546523] generic_perform_write+0x17e/0x270 [ 44.546523] ext4_buffered_write_iter+0xc8/0x170 [ 44.546523] vfs_write+0x2be/0x3e0 [ 44.546523] __x64_sys_pwrite64+0x6d/0xc0 [ 44.546523] do_syscall_64+0x6a/0xf0 [ 44.546523] ? __wake_up+0x89/0xb0 [ 44.546523] ? xas_find+0x72/0x1c0 [ 44.546523] ? next_uptodate_folio+0x317/0x330 [ 44.546523] ? set_pte_range+0x1a6/0x270 [ 44.546523] ? filemap_map_pages+0x6ee/0x840 [ 44.546523] ? ext4_setattr+0x2fa/0x750 [ 44.546523] ? do_pte_missing+0x128/0xf70 [ 44.546523] ? security_inode_post_setattr+0x3e/0xd0 [ 44.546523] ? ___pte_offset_map+0x19/0x100 [ 44.546523] ? handle_mm_fault+0x721/0xa10 [ 44.546523] ? do_user_addr_fault+0x197/0x730 [ 44.546523] ? do_syscall_64+0x76/0xf0 [ 44.546523] ? arch_exit_to_user_mode_prepare+0x1e/0x60 [ 44.546523] ? irqentry_exit_to_user_mode+0x79/0x90 [ 44.546523] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 44.546523] RIP: 0033:0x7f42999c6687 [ 44.546523] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 44.546523] RSP: 002b:00007ffeae4a7930 EFLAGS: 00000202 ORIG_RAX: 0000000000000012 [ 44.546523] RAX: ffffffffffffffda RBX: 00007f4299934740 RCX: 00007f42999c6687 [ 44.546523] RDX: 0000000000000001 RSI: 000055ea6149200f RDI: 0000000000000003 [ 44.546523] RBP: 00007ffeae4a79a0 R08: 0000000000000000 R09: 0000000000000000 [ 44.546523] R10: 0000010000000005 R11: 0000000000000202 R12: 0000000000000000 [ 44.546523] R13: 00007ffeae4a7ac8 R14: 00007f4299b86000 R15: 000055ea61493dd8 [ 44.546523] </TASK> [ 44.546523] Modules linked in: [ 44.568501] ---[ end trace 0000000000000000 ]--- [ 44.568889] RIP: 0010:ext4_write_inline_data+0xfe/0x100 [ 44.569328] Code: 3c 0e 48 83 c7 48 48 89 de 5b 41 5c 41 5d 41 5e 41 5f 5d e9 e4 fa 43 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 0f 0b <0f> 0b 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 20 49 [ 44.570931] RSP: 0018:ffffb342008b79a8 EFLAGS: 00010216 [ 44.571356] RAX: 0000000000000001 RBX: ffff9329c579c000 RCX: 0000010000000006 [ 44.571959] RDX: 000000000000003c RSI: ffffb342008b79f0 RDI: ffff9329c158e738 [ 44.572571] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 44.573148] R10: 00007ffffffff000 R11: ffffffff9bd0d910 R12: 0000006210000000 [ 44.573748] R13: fffffc7e4015e700 R14: 0000010000000005 R15: ffff9329c158e738 [ 44.574335] FS: 00007f4299934740(0000) GS:ffff932a60179000(0000) knlGS:0000000000000000 [ 44.575027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.575520] CR2: 00007f4299a1ec90 CR3: 0000000002886002 CR4: 0000000000770eb0 [ 44.576112] PKRU: 55555554 [ 44.576338] Kernel panic - not syncing: Fatal exception [ 44.576517] Kernel Offset: 0x1a600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
--- fs/ext4/inline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/inline.c +1 -1
@@ -392,7 +392,7 @@ out: }static int ext4_prepare_inline_data (handle_t *handle,struct inode *inode, -unsigned int len) +loff_t len) {int ret, size, no_expand;struct ext4_inode_info *ei =EXT4_I (inode);
Greg Kroah-Hartman
maintainerPATCH 61/290 ext4: fix calculation of credits for extent tree modification
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 32a93f5bc9b9812fc710f43a4d8a6830f91e4988 upstream.
Luis and David are reporting that after running generic/750 test for 90+ hours on 2k ext4 filesystem, they are able to trigger a warning in jbd2_journal_dirty_metadata() complaining that there are not enough credits in the running transaction started in ext4_do_writepages().
Indeed the code in ext4_do_writepages() is racy and the extent tree can change between the time we compute credits necessary for extent tree computation and the time we actually modify the extent tree. Thus it may happen that the number of credits actually needed is higher. Modify ext4_ext_index_trans_blocks() to count with the worst case of maximum tree depth. This can reduce the possible number of writers that can operate in the system in parallel (because the credit estimates now won't fit in one transaction) but for reasonably sized journals this shouldn't really be an issue. So just go with a safe and simple fix.
--- fs/ext4/extents.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/ext4/extents.c +6 -5
@@ -2374,18 +2374,19 @@ int ext4_ext_calc_credits_for_single_extint ext4_ext_index_trans_blocks (struct inode *inode,int extents) {int index; -int depth;/* If we are converting the inline data, only one is needed here. */ if (ext4_has_inline_data (inode))return 1 ; - depth =ext_depth (inode); - +/* +* Extent tree can change between the time we estimate credits and +* the time we actually modify the tree. Assume the worst case. +*/ if (extents <=1 ) - index = depth *2 ; + index =EXT4_MAX_EXTENT_DEPTH *2 ;else - index = depth *3 ; + index =EXT4_MAX_EXTENT_DEPTH *3 ;return index; }
Greg Kroah-Hartman
maintainerPATCH 62/290 ext4: factor out ext4_get_maxbytes()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit dbe27f06fa38b9bfc598f8864ae1c5d5831d9992 upstream.
There are several locations that get the correct maxbytes value based on the inode's block type. It would be beneficial to extract a common helper function to make the code more clear.
--- fs/ext4/ext4.h | 7 +++++++ fs/ext4/extents.c | 7 +------ fs/ext4/file.c | 7 +------ 3 files changed, 9 insertions(+), 12 deletions(-)
fs/ext4/ext4.h +7 -0
@@ -3351,6 +3351,13 @@ static inline unsigned int ext4_flex_bg_return 1 << sbi->s_log_groups_per_flex; } +static inline loff_t ext4_get_maxbytes (struct inode *inode) +{ +if (ext4_test_inode_flag (inode,EXT4_INODE_EXTENTS )) +return inode->i_sb->s_maxbytes; +return EXT4_SB (inode->i_sb)->s_bitmap_maxbytes; +} +#define ext4_std_error (sb, errno) \ do { \ if ((errno)) \
fs/ext4/extents.c +1 -6
@@ -4970,12 +4970,7 @@ static const struct iomap_ops ext4_iomapstatic int ext4_fiemap_check_ranges (struct inode *inode,u64 start,u64 *len) { -u64 maxbytes; - -if (ext4_test_inode_flag (inode,EXT4_INODE_EXTENTS )) - maxbytes = inode->i_sb->s_maxbytes; -else - maxbytes =EXT4_SB (inode->i_sb)->s_bitmap_maxbytes; +u64 maxbytes =ext4_get_maxbytes (inode);if (*len ==0 )return -EINVAL ;
fs/ext4/file.c +1 -6
@@ -898,12 +898,7 @@ static int ext4_file_open(struct inode *loff_t ext4_llseek (struct file *file,loff_t offset,int whence) {struct inode *inode = file->f_mapping->host; -loff_t maxbytes; - -if (!(ext4_test_inode_flag (inode,EXT4_INODE_EXTENTS ))) - maxbytes =EXT4_SB (inode->i_sb)->s_bitmap_maxbytes; -else - maxbytes = inode->i_sb->s_maxbytes; +loff_t maxbytes =ext4_get_maxbytes (inode);switch (whence) {default :
Greg Kroah-Hartman
maintainerPATCH 63/290 ext4: ensure i_size is smaller than maxbytes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
commit 1a77a028a392fab66dd637cdfac3f888450d00af upstream.
The inode i_size cannot be larger than maxbytes, check it while loading inode from the disk.
--- fs/ext4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/inode.c +2 -1
@@ -4939,7 +4939,8 @@ struct inode *__ext4_iget(struct super_b ei->i_file_acl |= ((__u64 )le16_to_cpu (raw_inode->i_file_acl_high)) <<32 ; inode->i_size =ext4_isize (sb, raw_inode); -if ((size =i_size_read (inode)) <0 ) { + size =i_size_read (inode); +if (size <0 || size >ext4_get_maxbytes (inode)) {ext4_error_inode (inode, function, line,0 ,"iget: bad i_size value: %lld" , size); ret = -EFSCORRUPTED ;
Greg Kroah-Hartman
maintainerPATCH 64/290 ext4: only dirty folios when data journaling regular files
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Foster <[email protected]>
commit e26268ff1dcae5662c1b96c35f18cfa6ab73d9de upstream.
fstest generic/388 occasionally reproduces a crash that looks as follows:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> ext4_block_zero_page_range+0x30c/0x380 [ext4] ext4_truncate+0x436/0x440 [ext4] ext4_process_orphan+0x5d/0x110 [ext4] ext4_orphan_cleanup+0x124/0x4f0 [ext4] ext4_fill_super+0x262d/0x3110 [ext4] get_tree_bdev_flags+0x132/0x1d0 vfs_get_tree+0x26/0xd0 vfs_cmd_create+0x59/0xe0 __do_sys_fsconfig+0x4ed/0x6b0 do_syscall_64+0x82/0x170 ...
This occurs when processing a symlink inode from the orphan list. The partial block zeroing code in the truncate path calls ext4_dirty_journalled_data() -> folio_mark_dirty(). The latter calls mapping->a_ops->dirty_folio(), but symlink inodes are not assigned an a_ops vector in ext4, hence the crash.
To avoid this problem, update the ext4_dirty_journalled_data() helper to only mark the folio dirty on regular files (for which a_ops is assigned). This also matches the journaling logic in the ext4_symlink() creation path, where ext4_handle_dirty_metadata() is called directly.
--- fs/ext4/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inode.c +6 -1
@@ -1011,7 +1011,12 @@ int ext4_walk_page_buffers(handle_t *han*/ static int ext4_dirty_journalled_data (handle_t *handle,struct buffer_head *bh) { -folio_mark_dirty (bh->b_folio); +struct folio *folio = bh->b_folio; +struct inode *inode = folio->mapping->host; + +/* only regular files have a_ops */ +if (S_ISREG (inode->i_mode)) +folio_mark_dirty (folio);return ext4_handle_dirty_metadata (handle,NULL , bh); }
Greg Kroah-Hartman
maintainerPATCH 65/290 Input: ims-pcu - check record size in ims_pcu_flash_firmware()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit a95ef0199e80f3384eb992889322957d26c00102 upstream.
The "len" variable comes from the firmware and we generally do trust firmware, but it's always better to double check. If the "len" is too large it could result in memory corruption when we do "memcpy(fragment->data, rec->data, len);"
--- drivers/input/misc/ims-pcu.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/input/misc/ims-pcu.c +6 -0
@@ -845,6 +845,12 @@ static int ims_pcu_flash_firmware(struct addr =be32_to_cpu (rec->addr) /2 ; len =be16_to_cpu (rec->len); +if (len >sizeof (pcu->cmd_buf) -1 -sizeof (*fragment)) { +dev_err (pcu->dev, +"Invalid record length in firmware: %d\n" , len); +return -EINVAL ; + } + fragment = (void *)&pcu->cmd_buf[1 ];put_unaligned_le32 (addr, &fragment->addr); fragment->len = len;
Greg Kroah-Hartman
maintainerPATCH 66/290 Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gatien Chevallier <[email protected]>
commit 8f38219fa139623c29db2cb0f17d0a197a86e344 upstream.
gpio_keys_irq_isr() and gpio_keys_irq_timer() access the same resources. There could be a concurrent access if a GPIO interrupt occurs in parallel of a HR timer interrupt.
Guard back those resources with a spinlock.
--- drivers/input/keyboard/gpio_keys.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/keyboard/gpio_keys.c +2 -0
@@ -455,6 +455,8 @@ static enum hrtimer_restart gpio_keys_ir release_timer);struct input_dev *input = bdata->input; +guard (spinlock_irqsave)(&bdata->lock); +if (bdata->key_pressed) {input_report_key (input, *bdata->code,0 );input_sync (input);
Greg Kroah-Hartman
maintainerPATCH 67/290 f2fs: fix to do sanity check on ino and xnid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 061cf3a84bde038708eb0f1d065b31b7c2456533 upstream.
syzbot reported a f2fs bug as below:
INFO: task syz-executor140:5308 blocked for more than 143 seconds.
Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor140 state:D stack:24016 pid:5308 tgid:5308 ppid:5306 task_flags:0x400140 flags:0x00000006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5378 [inline]
__schedule+0x190e/0x4c90 kernel/sched/core.c:6765
__schedule_loop kernel/sched/core.c:6842 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6857
io_schedule+0x8d/0x110 kernel/sched/core.c:7690
folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317
__folio_lock mm/filemap.c:1664 [inline]
folio_lock include/linux/pagemap.h:1163 [inline]
__filemap_get_folio+0x147/0xb40 mm/filemap.c:1917
pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87
find_get_page_flags include/linux/pagemap.h:842 [inline]
f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776
__get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463
read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306
lookup_all_xattrs fs/f2fs/xattr.c:355 [inline]
f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533
__f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179
f2fs_acl_create fs/f2fs/acl.c:375 [inline]
f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418
f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539
f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666
f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765
f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808
f2fs_add_link fs/f2fs/f2fs.h:3616 [inline]
f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766
vfs_mknod+0x36d/0x3b0 fs/namei.c:4191
unix_bind_bsd net/unix/af_unix.c:1286 [inline]
unix_bind+0x563/0xe30 net/unix/af_unix.c:1379
__sys_bind_socket net/socket.c:1817 [inline]
__sys_bind+0x1e4/0x290 net/socket.c:1848
__do_sys_bind net/socket.c:1853 [inline]
__se_sys_bind net/socket.c:1851 [inline]
__x64_sys_bind+0x7a/0x90 net/socket.c:1851
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7fLet's dump and check metadata of corrupted inode, it shows its xattr_nid is the same to its i_ino.
dump.f2fs -i 3 chaseyu.img.rawi_xattr_nid [0x 3 : 3]
So that, during mknod in the corrupted directory, it tries to get and lock inode page twice, result in deadlock.
- f2fs_mknod
- f2fs_add_inline_entry
- f2fs_get_inode_page --- lock dir's inode page
- f2fs_init_acl
- f2fs_acl_create(dir,..)
- __f2fs_get_acl
- f2fs_getxattr
- lookup_all_xattrs
- __get_node_page --- try to lock dir's inode page
In order to fix this, let's add sanity check on ino and xnid.
--- fs/f2fs/inode.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/f2fs/inode.c +6 -0
@@ -285,6 +285,12 @@ static bool sanity_check_inode(struct inreturn false; } +if (ino_of_node (node_page) == fi->i_xattr_nid) { +f2fs_warn (sbi,"%s: corrupted inode i_ino=%lx, xnid=%x, run fsck to fix." , + __func__, inode->i_ino, fi->i_xattr_nid); +return false; + } +if (f2fs_has_extra_attr (inode)) {if (!f2fs_sb_has_extra_attr (sbi)) { f2fs_warn(sbi, "%s: inode (ino=%lx) is with extra_attr, but extra_attr feature is off",
Greg Kroah-Hartman
maintainerPATCH 68/290 f2fs: prevent kernel warning due to negative i_nlink from corrupted image
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 42cb74a92adaf88061039601ddf7c874f58b554e upstream.
WARNING: CPU: 1 PID: 9426 at fs/inode.c:417 drop_nlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Modules linked in: CPU: 1 UID: 0 PID: 9426 Comm: syz-executor568 Not tainted 6.14.0-12627-g94d471a4f428 #2 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:drop_nlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Code: 48 8b 5d 28 be 08 00 00 00 48 8d bb 70 07 00 00 e8 f9 67 e6 ff f0 48 ff 83 70 07 00 00 5b 5d e9 9a 12 82 ff e8 95 12 82 ff 90 <0f> 0b 90 c7 45 48 ff ff ff ff 5b 5d e9 83 12 82 ff e8 fe 5f e6 ff RSP: 0018:ffffc900026b7c28 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8239710f RDX: ffff888041345a00 RSI: ffffffff8239717b RDI: 0000000000000005 RBP: ffff888054509ad0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff9ab36f08 R12: ffff88804bb40000 R13: ffff8880545091e0 R14: 0000000000008000 R15: ffff8880545091e0 FS: 000055555d0c5880(0000) GS:ffff8880eb3e3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f915c55b178 CR3: 0000000050d20000 CR4: 0000000000352ef0 Call Trace: <task> f2fs_i_links_write home/cc/linux/fs/f2fs/f2fs.h:3194 [inline] f2fs_drop_nlink+0xd1/0x3c0 home/cc/linux/fs/f2fs/dir.c:845 f2fs_delete_entry+0x542/0x1450 home/cc/linux/fs/f2fs/dir.c:909 f2fs_unlink+0x45c/0x890 home/cc/linux/fs/f2fs/namei.c:581 vfs_unlink+0x2fb/0x9b0 home/cc/linux/fs/namei.c:4544 do_unlinkat+0x4c5/0x6a0 home/cc/linux/fs/namei.c:4608 __do_sys_unlink home/cc/linux/fs/namei.c:4654 [inline] __se_sys_unlink home/cc/linux/fs/namei.c:4652 [inline] __x64_sys_unlink+0xc5/0x110 home/cc/linux/fs/namei.c:4652 do_syscall_x64 home/cc/linux/arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x250 home/cc/linux/arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb3d092324b Code: 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66
2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdc232d938 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb3d092324b
RDX: 00007ffdc232d960 RSI: 00007ffdc232d960 RDI: 00007ffdc232d9f0
RBP: 00007ffdc232d9f0 R08: 0000000000000001 R09: 00007ffdc232d7c0
R10: 00000000fffffffd R11: 0000000000000206 R12: 00007ffdc232eaf0
R13: 000055555d0cebb0 R14: 00007ffdc232d958 R15: 0000000000000001
</task>
--- fs/f2fs/namei.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/f2fs/namei.c +9 -0
@@ -560,6 +560,15 @@ static int f2fs_unlink(struct inode *dir goto fail; } +if (unlikely (inode->i_nlink ==0 )) { +f2fs_warn (F2FS_I_SB (inode),"%s: inode (ino=%lx) has zero i_nlink" , + __func__, inode->i_ino); + err = -EFSCORRUPTED ; +set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_FSCK ); +f2fs_put_page (page,0 ); + goto fail; + } +f2fs_balance_fs (sbi, true);f2fs_lock_op (sbi);
Greg Kroah-Hartman
maintainerPATCH 69/290 f2fs: fix to do sanity check on sit_bitmap_size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 5db0d252c64e91ba1929c70112352e85dc5751e7 upstream.
w/ below testcase, resize will generate a corrupted image which contains inconsistent metadata, so when mounting such image, it will trigger kernel panic:
touch img
truncate -s $((512*1024*1024*1024)) img
mkfs.f2fs -f img $((256*1024*1024))
resize.f2fs -s -i img -t $((1024*1024*1024))
mount img /mnt/f2fs
------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.h:863! Oops: invalid opcode: 0000 [#1] SMP PTI CPU: 11 UID: 0 PID: 3922 Comm: mount Not tainted 6.15.0-rc1+ #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_ra_meta_pages+0x47c/0x490 Call Trace: f2fs_build_segment_manager+0x11c3/0x2600 f2fs_fill_super+0xe97/0x2840 mount_bdev+0xf4/0x140 legacy_get_tree+0x2b/0x50 vfs_get_tree+0x29/0xd0 path_mount+0x487/0xaf0 __x64_sys_mount+0x116/0x150 do_syscall_64+0x82/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fdbfde1bcfe
The reaseon is:
sit_i->bitmap_size is 192, so size of sit bitmap is 192*8=1536, at maximum there are 1536 sit blocks, however MAIN_SEGS is 261893, so that sit_blk_cnt is 4762, build_sit_entries() -> current_sit_addr() tries to access out-of-boundary in sit_bitmap at offset from [1536, 4762), once sit_bitmap and sit_bitmap_mirror is not the same, it will trigger f2fs_bug_on().
Let's add sanity check in f2fs_sanity_check_ckpt() to avoid panic.
--- fs/f2fs/super.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/f2fs/super.c +8 -0
@@ -3608,6 +3608,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sblock_t user_block_count, valid_user_blocks;block_t avail_node_count, valid_node_count;unsigned int nat_blocks, nat_bits_bytes, nat_bits_blocks; +unsigned int sit_blk_cnt;int i, j; total =le32_to_cpu (raw_super->segment_count);
@@ -3719,6 +3720,13 @@ skip_cross:return 1 ; } + sit_blk_cnt =DIV_ROUND_UP (main_segs,SIT_ENTRY_PER_BLOCK ); +if (sit_bitmap_size *8 < sit_blk_cnt) { +f2fs_err (sbi,"Wrong bitmap size: sit: %u, sit_blk_cnt:%u" , + sit_bitmap_size, sit_blk_cnt); +return 1 ; + } + cp_pack_start_sum =__start_sum_addr (sbi); cp_payload =__cp_payload (sbi); if (cp_pack_start_sum < cp_payload + 1 ||
Greg Kroah-Hartman
maintainerPATCH 70/290 hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
commit 14c9ede9ca4cd078ad76a6ab9617b81074eb58bf upstream.
In the fts_read() function, when handling hwmon_pwm_auto_channels_temp, the code accesses the shared variable data->fan_source[channel] twice without holding any locks. It is first checked against FTS_FAN_SOURCE_INVALID, and if the check passes, it is read again when used as an argument to the BIT() macro.
This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition. Another thread executing fts_update_device() can modify the value of data->fan_source[channel] between the check and its use. If the value is changed to FTS_FAN_SOURCE_INVALID (0xff) during this window, the BIT() macro will be called with a large shift value (BIT(255)). A bit shift by a value greater than or equal to the type width is undefined behavior and can lead to a crash or incorrect values being returned to userspace.
Fix this by reading data->fan_source[channel] into a local variable once, eliminating the race condition. Additionally, add a bounds check to ensure the value is less than BITS_PER_LONG before passing it to the BIT() macro, making the code more robust against undefined behavior.
This possible bug was found by an experimental static analysis tool developed by our team.
--- drivers/hwmon/ftsteutates.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/hwmon/ftsteutates.c +6 -3
@@ -423,13 +423,16 @@ static int fts_read(struct device *dev,break ;case hwmon_pwm:switch (attr) { -case hwmon_pwm_auto_channels_temp: -if (data->fan_source[channel] ==FTS_FAN_SOURCE_INVALID ) +case hwmon_pwm_auto_channels_temp: { +u8 fan_source = data->fan_source[channel]; + +if (fan_source ==FTS_FAN_SOURCE_INVALID || fan_source >=BITS_PER_LONG ) *val =0 ;else - *val =BIT (data->fan_source[channel]); + *val =BIT (fan_source);return 0 ; + }default :break ; }
Greg Kroah-Hartman
maintainerPATCH 73/290 net: ftgmac100: select FIXED_PHY
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
commit ae409629e022fbebbc6d31a1bfeccdbbeee20fd6 upstream.
Depending on e.g. DT configuration this driver uses a fixed link. So we shouldn't rely on the user to enable FIXED_PHY, select it in Kconfig instead. We may end up with a non-functional driver otherwise.
--- drivers/net/ethernet/faraday/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/faraday/Kconfig +1 -0
@@ -31,6 +31,7 @@ config FTGMAC100 depends on ARM || COMPILE_TEST depends on !64BIT || BROKEN select PHYLIB + select FIXED_PHY select MDIO_ASPEED if MACH_ASPEED_G6 select CRC32 help
Greg Kroah-Hartman
maintainerPATCH 74/290 fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
commit 17186f1f90d34fa701e4f14e6818305151637b9e upstream.
If fb_add_videomode() in do_register_framebuffer() fails to allocate memory for fb_videomode, it will later lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================
Even though fbcon_init() checks beforehand if fb_match_mode() in var_to_display() fails, it can not prevent the panic because fbcon_init() does not return error code. Considering this and the comment in the code about fb_match_mode() returning NULL - "This should not happen" - it is better to prevent registering the fb_info if its mode was not set successfully. Also move fb_add_videomode() closer to the beginning of do_register_framebuffer() to avoid having to do the cleanup on fail.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/video/fbdev/core/fbmem.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/video/fbdev/core/fbmem.c +11 -7
@@ -928,7 +928,7 @@ static int fb_check_foreignness(struct fstatic int do_register_framebuffer (struct fb_info *fb_info) { -int i; +int i, err =0 ;struct fb_videomode mode;if (fb_check_foreignness (fb_info))
@@ -937,10 +937,18 @@ static int do_register_framebuffer(strucif (num_registered_fb ==FB_MAX )return -ENXIO ; - num_registered_fb++;for (i =0 ; i <FB_MAX ; i++)if (!registered_fb[i])break ; + +if (!fb_info->modelist.prev || !fb_info->modelist.next) +INIT_LIST_HEAD (&fb_info->modelist); + +fb_var_to_videomode (&mode, &fb_info->var); + err =fb_add_videomode (&mode, &fb_info->modelist); +if (err <0 ) +return err; + fb_info->node = i;refcount_set (&fb_info->count,1 );mutex_init (&fb_info->lock);
@@ -966,16 +974,12 @@ static int do_register_framebuffer(strucif (!fb_info->pixmap.blit_y) fb_info->pixmap.blit_y = ~(u32 )0 ; -if (!fb_info->modelist.prev || !fb_info->modelist.next) -INIT_LIST_HEAD (&fb_info->modelist); -if (fb_info->skip_vt_switch)pm_vt_switch_required (fb_info->device, false);else pm_vt_switch_required (fb_info->device, true); -fb_var_to_videomode (&mode, &fb_info->var); -fb_add_videomode (&mode, &fb_info->modelist); + num_registered_fb++; registered_fb[i] = fb_info;#ifdef CONFIG_GUMSTIX_AM200EPD
Greg Kroah-Hartman
maintainerPATCH 75/290 EDAC/altera: Use correct write width with the INTTEST register
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <[email protected]>
commit e5ef4cd2a47f27c0c9d8ff6c0f63a18937c071a3 upstream.
On the SoCFPGA platform, the INTTEST register supports only 16-bit writes. A 32-bit write triggers an SError to the CPU so do 16-bit accesses only.
[ bp: AI-massage the commit message. ]
--- drivers/edac/altera_edac.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/edac/altera_edac.c +3 -3
@@ -1756,9 +1756,9 @@ altr_edac_a10_device_trig(struct file *flocal_irq_save (flags);if (trig_type ==ALTR_UE_TRIGGER_CHAR ) -writel (priv->ue_set_mask, set_addr); +writew (priv->ue_set_mask, set_addr);else -writel (priv->ce_set_mask, set_addr); +writew (priv->ce_set_mask, set_addr);/* Ensure the interrupt test bits are set */ wmb ();
@@ -1788,7 +1788,7 @@ altr_edac_a10_device_trig2(struct file *local_irq_save (flags);if (trig_type ==ALTR_UE_TRIGGER_CHAR ) { -writel (priv->ue_set_mask, set_addr); +writew (priv->ue_set_mask, set_addr); }else {/* Setup read/write of 4 bytes */ writel (ECC_WORD_WRITE , drvdata->base +ECC_BLK_DBYTECTRL_OFST );
Greg Kroah-Hartman
maintainerPATCH 76/290 fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
commit 05f6e183879d9785a3cdf2f08a498bc31b7a20aa upstream.
If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================
The reason is that fb_info->var is being modified in fb_set_var(), and then fb_videomode_to_var() is called. If it fails to add the mode to fb_info->modelist, fb_set_var() returns error, but does not restore the old value of fb_info->var. Restore fb_info->var on failure the same way it is done earlier in the function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/video/fbdev/core/fbmem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/core/fbmem.c +3 -1
@@ -868,8 +868,10 @@ fb_set_var(struct fb_info *info, struct !list_empty(&info->modelist)) ret =fb_add_videomode (&mode, &info->modelist); -if (ret) +if (ret) { + info->var = old_var;return ret; + } event.info = info; event.data = &mode;
Greg Kroah-Hartman
maintainerPATCH 77/290 parisc/unaligned: Fix hex output to show 8 hex chars
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 213205889d5ffc19cb8df06aa6778b2d4724c887 upstream.
Change back printk format to 0x%08lx instead of %#08lx, since the latter does not seem to reliably format the value to 8 hex chars.
--- arch/parisc/kernel/unaligned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/parisc/kernel/unaligned.c +1 -1
@@ -24,7 +24,7 @@ #define DPRINTF(fmt, args...)#endif -#define RFMT "%#08lx" +#define RFMT "0x%08lx"/* 1111 1100 0000 0000 0001 0011 1100 0000 */ #define OPCODE1 (a,b,c) ((a)<<26|(b)<<12|(c)<<6)
@kernel.org>
--- drivers/i2c/busses/i2c-npcm7xx.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-npcm7xx.c +8 -4
@@ -2178,10 +2178,14 @@ static int npcm_i2c_init_module(struct npcm_i2c *bus, enum i2c_mode mode,/* Check HW is OK: SDA and SCL should be high at this point. */ if ((npcm_i2c_get_SDA (&bus->adap) ==0 ) || (npcm_i2c_get_SCL (&bus->adap) ==0 )) { -dev_err (bus->dev,"I2C%d init fail: lines are low\n" , bus->num); -dev_err (bus->dev,"SDA=%d SCL=%d\n" ,npcm_i2c_get_SDA (&bus->adap), -npcm_i2c_get_SCL (&bus->adap)); -return -ENXIO ; +dev_warn (bus->dev," I2C%d SDA=%d SCL=%d, attempting to recover\n" , bus->num, +npcm_i2c_get_SDA (&bus->adap),npcm_i2c_get_SCL (&bus->adap)); +if (npcm_i2c_recovery_tgclk (&bus->adap)) { +dev_err (bus->dev,"I2C%d init fail: SDA=%d SCL=%d\n" , + bus->num,npcm_i2c_get_SDA (&bus->adap), +npcm_i2c_get_SCL (&bus->adap)); +return -ENXIO ; + } }npcm_i2c_int_enable (bus, true);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/290 vgacon: Add check for vc_origin address range in vgacon_scroll()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: GONG Ruiqi <[email protected]>
commit 864f9963ec6b4b76d104d595ba28110b87158003 upstream.
Our in-house Syzkaller reported the following BUG (twice), which we believed was the same issue with [1]:
==================================================================
BUG: KASAN: slab-out-of-bounds in vcs_scr_readw+0xc2/0xd0 drivers/tty/vt/vt.c:4740 Read of size 2 at addr ffff88800f5bef60 by task syz.7.2620/12393 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 print_address_description.constprop.0+0x6b/0x3d0 mm/kasan/report.c:364 print_report+0xba/0x280 mm/kasan/report.c:475 kasan_report+0xa9/0xe0 mm/kasan/report.c:588 vcs_scr_readw+0xc2/0xd0 drivers/tty/vt/vt.c:4740 vcs_write_buf_noattr drivers/tty/vt/vc_screen.c:493 [inline] vcs_write+0x586/0x840 drivers/tty/vt/vc_screen.c:690 vfs_write+0x219/0x960 fs/read_write.c:584 ksys_write+0x12e/0x260 fs/read_write.c:639 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 ... </TASK> Allocated by task 5614: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:201 [inline] __do_kmalloc_node mm/slab_common.c:1007 [inline] __kmalloc+0x62/0x140 mm/slab_common.c:1020 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:721 [inline] vc_do_resize+0x235/0xf40 drivers/tty/vt/vt.c:1193 vgacon_adjust_height+0x2d4/0x350 drivers/video/console/vgacon.c:1007 vgacon_font_set+0x1f7/0x240 drivers/video/console/vgacon.c:1031 con_font_set drivers/tty/vt/vt.c:4628 [inline] con_font_op+0x4da/0xa20 drivers/tty/vt/vt.c:4675 vt_k_ioctl+0xa10/0xb30 drivers/tty/vt/vt_ioctl.c:474 vt_ioctl+0x14c/0x1870 drivers/tty/vt/vt_ioctl.c:752 tty_ioctl+0x655/0x1510 drivers/tty/tty_io.c:2779 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x12d/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492 __call_rcu_common.constprop.0+0xc3/0xa10 kernel/rcu/tree.c:2713 netlink_release+0x620/0xc20 net/netlink/af_netlink.c:802 __sock_release+0xb5/0x270 net/socket.c:663 sock_close+0x1e/0x30 net/socket.c:1425 __fput+0x408/0xab0 fs/file_table.c:384 __fput_sync+0x4c/0x60 fs/file_table.c:465 __do_sys_close fs/open.c:1580 [inline] __se_sys_close+0x68/0xd0 fs/open.c:1565 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492 __call_rcu_common.constprop.0+0xc3/0xa10 kernel/rcu/tree.c:2713 netlink_release+0x620/0xc20 net/netlink/af_netlink.c:802 __sock_release+0xb5/0x270 net/socket.c:663 sock_close+0x1e/0x30 net/socket.c:1425 __fput+0x408/0xab0 fs/file_table.c:384 task_work_run+0x154/0x240 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:45 [inline] do_exit+0x8e5/0x1320 kernel/exit.c:874 do_group_exit+0xcd/0x280 kernel/exit.c:1023 get_signal+0x1675/0x1850 kernel/signal.c:2905 arch_do_signal_or_restart+0x80/0x3b0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x1b3/0x1e0 kernel/entry/common.c:218 do_syscall_64+0x66/0x110 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x78/0xe2 The buggy address belongs to the object at ffff88800f5be000 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 2656 bytes to the right of
allocated 1280-byte region [ffff88800f5be000, ffff88800f5be500)
...
Memory state around the buggy address:
ffff88800f5bee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800f5bee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88800f5bef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88800f5bef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800f5bf000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================By analyzing the vmcore, we found that vc->vc_origin was somehow placed one line prior to vc->vc_screenbuf when vc was in KD_TEXT mode, and further writings to /dev/vcs caused out-of-bounds reads (and writes right after) in vcs_write_buf_noattr().
Our further experiments show that in most cases, vc->vc_origin equals to vga_vram_base when the console is in KD_TEXT mode, and it's around vc->vc_screenbuf for the KD_GRAPHICS mode. But via triggerring a TIOCL_SETVESABLANK ioctl beforehand, we can make vc->vc_origin be around vc->vc_screenbuf while the console is in KD_TEXT mode, and then by writing the special 'ESC M' control sequence to the tty certain times (depends on the value of vc->state.y - vc->vc_top), we can eventually move vc->vc_origin prior to vc->vc_screenbuf. Here's the PoC, tested on QEMU:
```
int main() {
const int RI_NUM = 10; // should be greater than `vc->state.y - vc->vc_top`
int tty_fd, vcs_fd;
const char *tty_path = "/dev/tty0";
const char *vcs_path = "/dev/vcs";
const char escape_seq[] = "\x1bM"; // ESC + M
const char trigger_seq[] = "Let's trigger an OOB write.";
struct vt_sizes vt_size = { 70, 2 };
int blank = TIOCL_BLANKSCREEN;
tty_fd = open(tty_path, O_RDWR);
char vesa_mode[] = { TIOCL_SETVESABLANK, 1 };
ioctl(tty_fd, TIOCLINUX, vesa_mode);
ioctl(tty_fd, TIOCLINUX, &blank);
ioctl(tty_fd, VT_RESIZE, &vt_size);
for (int i = 0; i < RI_NUM; ++i)
write(tty_fd, escape_seq, sizeof(escape_seq) - 1);
vcs_fd = open(vcs_path, O_RDWR);
write(vcs_fd, trigger_seq, sizeof(trigger_seq));
close(vcs_fd);
close(tty_fd);
return 0;
}
```To solve this problem, add an address range validation check in vgacon_scroll(), ensuring vc->vc_origin never precedes vc_screenbuf.
--- drivers/video/console/vgacon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/console/vgacon.c +1 -1
@@ -1139,7 +1139,7 @@ static bool vgacon_scroll(struct vc_data c->vc_screenbuf_size - delta); c->vc_origin = vga_vram_end - c->vc_screenbuf_size; vga_rolled_over =0 ; - }else + }else if (oldo - delta >= (unsigned long )c->vc_screenbuf) c->vc_origin -= delta; c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size; scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char,
Greg Kroah-Hartman
maintainerPATCH 80/290 clk: meson-g12a: add missing fclk_div2 to spicc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Da Xue <[email protected]>
commit daf004f87c3520c414992893e2eadd5db5f86a5a upstream.
SPICC is missing fclk_div2, which means fclk_div5 and fclk_div7 indexes are wrong on this clock. This causes the spicc module to output sclk at 2.5x the expected rate when clock index 3 is picked.
Adding the missing fclk_div2 resolves this.
--- drivers/clk/meson/g12a.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/meson/g12a.c +1 -0
@@ -3971,6 +3971,7 @@ static const struct clk_parent_data spic { .hw = &g12a_clk81.hw }, { .hw = &g12a_fclk_div4.hw }, { .hw = &g12a_fclk_div3.hw }, + { .hw = &g12a_fclk_div2.hw }, { .hw = &g12a_fclk_div5.hw }, { .hw = &g12a_fclk_div7.hw }, };
Greg Kroah-Hartman
maintainerPATCH 81/290 ipc: fix to protect IPCS lookups using RCU
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit d66adabe91803ef34a8b90613c81267b5ded1472 upstream.
syzbot reported that it discovered a use-after-free vulnerability, [0]
[0]: https://lore.kernel.org/all/[email protected]/
idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read.
Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned().
--- ipc/shm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
ipc/shm.c +4 -1
@@ -430,8 +430,11 @@ static int shm_try_destroy_orphaned(intvoid shm_destroy_orphaned (struct ipc_namespace *ns) {down_write (&shm_ids (ns).rwsem); -if (shm_ids (ns).in_use) +if (shm_ids (ns).in_use) { +rcu_read_lock ();idr_for_each (&shm_ids (ns).ipcs_idr, &shm_try_destroy_orphaned, ns); +rcu_read_unlock (); + }up_write (&shm_ids (ns).rwsem); }
Greg Kroah-Hartman
maintainerPATCH 82/290 watchdog: fix watchdog may detect false positive of softlockup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Gengkun <[email protected]>
commit 7123dbbef88cfd9f09e8a7899b0911834600cfa3 upstream.
When updating watchdog_thresh, there is a race condition between writing the new watchdog_thresh value and stopping the old watchdog timer. If the old timer triggers during this window, it may falsely detect a softlockup due to the old interval and the new watchdog_thresh value being used. The problem can be described as follow:
# We asuume previous watchdog_thresh is 60, so the watchdog timer is
# coming every 24s. echo 10 > /proc/sys/kernel/watchdog_thresh (User space) | +------>+ update watchdog_thresh (We are in kernel now) | | # using old interval and new `watchdog_thresh` +------>+ watchdog hrtimer (irq context: detect softlockup) | | +-------+ | | + softlockup_stop_all
To fix this problem, introduce a shadow variable for watchdog_thresh. The update to the actual watchdog_thresh is delayed until after the old timer is stopped, preventing false positives.
The following testcase may help to understand this problem.
---------------------------------------------
echo RT_RUNTIME_SHARE > /sys/kernel/debug/sched/features echo -1 > /proc/sys/kernel/sched_rt_runtime_us
echo 0 > /sys/kernel/debug/sched/fair_server/cpu3/runtime echo 60 > /proc/sys/kernel/watchdog_thresh
taskset -c 3 chrt -r 99 /bin/bash -c "while true;do true; done" & echo 10 > /proc/sys/kernel/watchdog_thresh &
---------------------------------------------
The test case above first removes the throttling restrictions for real-time tasks. It then sets watchdog_thresh to 60 and executes a real-time task ,a simple while(1) loop, on cpu3. Consequently, the final command gets blocked because the presence of this real-time thread prevents kworker:3 from being selected by the scheduler. This eventually triggers a softlockup detection on cpu3 due to watchdog_timer_fn operating with inconsistent variable - using both the old interval and the updated watchdog_thresh simultaneously.
--- kernel/watchdog.c | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-)
kernel/watchdog.c +27 -14
@@ -40,6 +40,7 @@ int __read_mostly watchdog_user_enabledstatic int __read_mostly watchdog_hardlockup_user_enabled =WATCHDOG_HARDLOCKUP_DEFAULT ;static int __read_mostly watchdog_softlockup_user_enabled =1 ;int __read_mostly watchdog_thresh =10 ; +static int __read_mostly watchdog_thresh_next;static int __read_mostly watchdog_hardlockup_available;struct cpumask watchdog_cpumask__read_mostly ;
@@ -627,12 +628,20 @@ int lockup_detector_offline_cpu(unsignedreturn 0 ; } -static void __lockup_detector_reconfigure (void ) +static void __lockup_detector_reconfigure (bool thresh_changed) {cpus_read_lock ();watchdog_hardlockup_stop ();softlockup_stop_all (); +/* +* To prevent watchdog_timer_fn from using the old interval and +* the new watchdog_thresh at the same time, which could lead to +* false softlockup reports, it is necessary to update the +* watchdog_thresh after the softlockup is completed. +*/ +if (thresh_changed) + watchdog_thresh =READ_ONCE (watchdog_thresh_next);set_sample_period ();lockup_detector_update_enable ();if (watchdog_enabled && watchdog_thresh)
@@ -650,7 +659,7 @@ static void __lockup_detector_reconfigurvoid lockup_detector_reconfigure (void ) {mutex_lock (&watchdog_mutex); -__lockup_detector_reconfigure (); +__lockup_detector_reconfigure (false);mutex_unlock (&watchdog_mutex); }
@@ -670,27 +679,29 @@ static __init void lockup_detector_setupreturn ;mutex_lock (&watchdog_mutex); -__lockup_detector_reconfigure (); +__lockup_detector_reconfigure (false); softlockup_initialized = true; mutex_unlock(&watchdog_mutex); }#else /* CONFIG_SOFTLOCKUP_DETECTOR */ -static void __lockup_detector_reconfigure (void ) +static void __lockup_detector_reconfigure (bool thresh_changed) {cpus_read_lock ();watchdog_hardlockup_stop (); +if (thresh_changed) + watchdog_thresh =READ_ONCE (watchdog_thresh_next);lockup_detector_update_enable ();watchdog_hardlockup_start ();cpus_read_unlock (); }void lockup_detector_reconfigure (void ) { -__lockup_detector_reconfigure (); +__lockup_detector_reconfigure (false); }static inline void lockup_detector_setup (void ) { -__lockup_detector_reconfigure (); +__lockup_detector_reconfigure (false); }#endif /* !CONFIG_SOFTLOCKUP_DETECTOR */
@@ -726,11 +737,11 @@ void lockup_detector_soft_poweroff(void)#ifdef CONFIG_SYSCTL /* Propagate any changes to the watchdog infrastructure */ -static void proc_watchdog_update (void ) +static void proc_watchdog_update (bool thresh_changed) {/* Remove impossible cpus to keep sysctl output clean. */ cpumask_and (&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask); -__lockup_detector_reconfigure (); +__lockup_detector_reconfigure (thresh_changed); }/*
@@ -763,7 +774,7 @@ static int proc_watchdog_common(int whic old =READ_ONCE (*param); err =proc_dointvec_minmax (table, write, buffer, lenp, ppos);if (!err && old !=READ_ONCE (*param)) -proc_watchdog_update (); +proc_watchdog_update (false); }mutex_unlock (&watchdog_mutex);return err;
@@ -812,11 +823,13 @@ int proc_watchdog_thresh(struct ctl_tablmutex_lock (&watchdog_mutex); - old =READ_ONCE (watchdog_thresh); + watchdog_thresh_next =READ_ONCE (watchdog_thresh); + + old = watchdog_thresh_next; err =proc_dointvec_minmax (table, write, buffer, lenp, ppos); -if (!err && write && old !=READ_ONCE (watchdog_thresh)) -proc_watchdog_update (); +if (!err && write && old !=READ_ONCE (watchdog_thresh_next)) +proc_watchdog_update (true);mutex_unlock (&watchdog_mutex);return err;
@@ -837,7 +850,7 @@ int proc_watchdog_cpumask(struct ctl_tab err =proc_do_large_bitmap (table, write, buffer, lenp, ppos);if (!err && write) -proc_watchdog_update (); +proc_watchdog_update (false);mutex_unlock (&watchdog_mutex);return err;
@@ -857,7 +870,7 @@ static struct ctl_table watchdog_sysctls }, { .procname = "watchdog_thresh", - .data = &watchdog_thresh, + .data = &watchdog_thresh_next, .maxlen = sizeof(int), .mode = 0644, .proc_handler = proc_watchdog_thresh,
Greg Kroah-Hartman
maintainerPATCH 83/290 RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <[email protected]>
commit 6883b680e703c6b2efddb4e7a8d891ce1803d06b upstream.
The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing cm_id once all references to the cm_id were removed. The references are removed either upon completion of iw_cm event handlers or when the application destroys the cm_id. This commit introduced the use-after-free condition where cm_id_private object could still be in use by event handler works during the destruction of cm_id. The commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs") addressed this use-after- free by flushing all pending works at the cm_id destruction.
However, still another use-after-free possibility remained. It happens with the work objects allocated for each cm_id_priv within alloc_work_entries() during cm_id creation, and subsequently freed in dealloc_work_entries() once all references to the cm_id are removed. If the cm_id's last reference is decremented in the event handler work, the work object for the work itself gets removed, and causes the use- after-free BUG below:
BUG: KASAN: slab-use-after-free in __pwq_activate_work+0x1ff/0x250 Read of size 8 at addr ffff88811f9cf800 by task kworker/u16:1/147091 CPU: 2 UID: 0 PID: 147091 Comm: kworker/u16:1 Not tainted 6.15.0-rc2+ #27 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Workqueue: 0x0 (iw_cm_wq) Call Trace: <TASK> dump_stack_lvl+0x6a/0x90 print_report+0x174/0x554 ? __virt_addr_valid+0x208/0x430 ? __pwq_activate_work+0x1ff/0x250 kasan_report+0xae/0x170 ? __pwq_activate_work+0x1ff/0x250 __pwq_activate_work+0x1ff/0x250 pwq_dec_nr_in_flight+0x8c5/0xfb0 process_one_work+0xc11/0x1460 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x16c/0x240 worker_thread+0x5ef/0xfd0 ? __pfx_worker_thread+0x10/0x10 kthread+0x3b0/0x770 ? __pfx_kthread+0x10/0x10 ? rcu_is_watching+0x11/0xb0 ? _raw_spin_unlock_irq+0x24/0x50 ? rcu_is_watching+0x11/0xb0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 147416: kasan_save_stack+0x2c/0x50 kasan_save_track+0x10/0x30 __kasan_kmalloc+0xa6/0xb0 alloc_work_entries+0xa9/0x260 [iw_cm] iw_cm_connect+0x23/0x4a0 [iw_cm] rdma_connect_locked+0xbfd/0x1920 [rdma_cm] nvme_rdma_cm_handler+0x8e5/0x1b60 [nvme_rdma] cma_cm_event_handler+0xae/0x320 [rdma_cm] cma_work_handler+0x106/0x1b0 [rdma_cm] process_one_work+0x84f/0x1460 worker_thread+0x5ef/0xfd0 kthread+0x3b0/0x770 ret_from_fork+0x30/0x70 ret_from_fork_asm+0x1a/0x30 Freed by task 147091: kasan_save_stack+0x2c/0x50 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kfree+0x13a/0x4b0 dealloc_work_entries+0x125/0x1f0 [iw_cm] iwcm_deref_id+0x6f/0xa0 [iw_cm] cm_work_handler+0x136/0x1ba0 [iw_cm] process_one_work+0x84f/0x1460 worker_thread+0x5ef/0xfd0 kthread+0x3b0/0x770 ret_from_fork+0x30/0x70 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x2c/0x50 kasan_record_aux_stack+0xa3/0xb0 __queue_work+0x2ff/0x1390 queue_work_on+0x67/0xc0 cm_event_handler+0x46a/0x820 [iw_cm] siw_cm_upcall+0x330/0x650 [siw] siw_cm_work_handler+0x6b9/0x2b20 [siw] process_one_work+0x84f/0x1460 worker_thread+0x5ef/0xfd0 kthread+0x3b0/0x770 ret_from_fork+0x30/0x70 ret_from_fork_asm+0x1a/0x30
This BUG is reproducible by repeating the blktests test case nvme/061 for the rdma transport and the siw driver.
To avoid the use-after-free of cm_id_private work objects, ensure that the last reference to the cm_id is decremented not in the event handler works, but in the cm_id destruction context. For that purpose, move iwcm_deref_id() call from destroy_cm_id() to the callers of destroy_cm_id(). In iw_destroy_cm_id(), call iwcm_deref_id() after flushing the pending works.
During the fix work, I noticed that iw_destroy_cm_id() is called from cm_work_handler() and process_event() context. However, the comment of iw_destroy_cm_id() notes that the function "cannot be called by the event thread". Drop the false comment.
--- drivers/infiniband/core/iwcm.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-)
drivers/infiniband/core/iwcm.c +15 -14
@@ -367,12 +367,9 @@ EXPORT_SYMBOL(iw_cm_disconnect);/* * CM_ID <-- DESTROYING * -* Clean up all resources associated with the connection and release -* the initial reference taken by iw_create_cm_id. -* -* Returns true if and only if the last cm_id_priv reference has been dropped. +* Clean up all resources associated with the connection. */ -static bool destroy_cm_id (struct iw_cm_id *cm_id) +static void destroy_cm_id (struct iw_cm_id *cm_id) {struct iwcm_id_private *cm_id_priv;struct ib_qp *qp;
@@ -441,20 +438,22 @@ static bool destroy_cm_id(struct iw_cm_iiwpm_remove_mapinfo (&cm_id->local_addr, &cm_id->m_local_addr);iwpm_remove_mapping (&cm_id->local_addr,RDMA_NL_IWCM ); } - -return iwcm_deref_id (cm_id_priv); }/* -* This function is only called by the application thread and cannot -* be called by the event thread. The function will wait for all -* references to be released on the cm_id and then kfree the cm_id -* object. +* Destroy cm_id. If the cm_id still has other references, wait for all +* references to be released on the cm_id and then release the initial +* reference taken by iw_create_cm_id. */ void iw_destroy_cm_id (struct iw_cm_id *cm_id) { -if (!destroy_cm_id (cm_id)) +struct iwcm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct iwcm_id_private, id); +destroy_cm_id (cm_id); +if (refcount_read (&cm_id_priv->refcount) >1 )flush_workqueue (iwcm_wq); +iwcm_deref_id (cm_id_priv); }EXPORT_SYMBOL (iw_destroy_cm_id);
@@ -1037,8 +1036,10 @@ static void cm_work_handler(struct work_if (!test_bit (IWCM_F_DROP_EVENTS , &cm_id_priv->flags)) { ret =process_event (cm_id_priv, &levent); -if (ret) -WARN_ON_ONCE (destroy_cm_id (&cm_id_priv->id)); +if (ret) { +destroy_cm_id (&cm_id_priv->id); +WARN_ON_ONCE (iwcm_deref_id (cm_id_priv)); + } }else pr_debug ("dropping event %d\n" , levent.event);if (iwcm_deref_id (cm_id_priv))
Greg Kroah-Hartman
maintainerPATCH 84/290 mm: fix ratelimit_pages update error in dirty_ratio_handler()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinliang Zheng <[email protected]>
commit f83f362d40ccceb647f7d80eb92206733d76a36b upstream.
In dirty_ratio_handler(), vm_dirty_bytes must be set to zero before calling writeback_set_ratelimit(), as global_dirty_limits() always prioritizes the value of vm_dirty_bytes.
It's domain_dirty_limits() that's relevant here, not node_dirty_ok:
dirty_ratio_handler
writeback_set_ratelimit
global_dirty_limits(&dirty_thresh) <- ratelimit_pages based on dirty_thresh
domain_dirty_limits
if (bytes) <- bytes = vm_dirty_bytes <--------+
thresh = f1(bytes) <- prioritizes vm_dirty_bytes |
else |
thresh = f2(ratio) |
ratelimit_pages = f3(dirty_thresh) |
vm_dirty_bytes = 0 <- it's late! ---------------------+
This causes ratelimit_pages to still use the value calculated based on vm_dirty_bytes, which is wrong now.
The impact visible to userspace is difficult to capture directly because there is no procfs/sysfs interface exported to user space. However, it will have a real impact on the balance of dirty pages.
For example:
1. On default, we have vm_dirty_ratio=40, vm_dirty_bytes=0
2. echo 8192 > dirty_bytes, then vm_dirty_bytes=8192, vm_dirty_ratio=0, and ratelimit_pages is calculated based on vm_dirty_bytes now.
3. echo 20 > dirty_ratio, then since vm_dirty_bytes is not reset to zero when writeback_set_ratelimit() -> global_dirty_limits() -> domain_dirty_limits() is called, reallimit_pages is still calculated based on vm_dirty_bytes instead of vm_dirty_ratio. This does not conform to the actual intent of the user.
--- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/page-writeback.c +1 -1
@@ -541,8 +541,8 @@ static int dirty_ratio_handler(struct ct ret =proc_dointvec_minmax (table, write, buffer, lenp, ppos);if (ret ==0 && write && vm_dirty_ratio != old_ratio) { -writeback_set_ratelimit (); vm_dirty_bytes =0 ; +writeback_set_ratelimit (); }return ret; }
Greg Kroah-Hartman
maintainerPATCH 85/290 mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 44ed1f5ff73e9e115b6f5411744d5a22ea1c855b upstream.
The function sunxi_nfc_hw_ecc_write_chunk() calls the sunxi_nfc_hw_ecc_write_chunk(), but does not call the configuration function sunxi_nfc_randomizer_config(). Consequently, the randomization might not conduct correctly, which will affect the lifespan of NAND flash. A proper implementation can be found in sunxi_nfc_hw_ecc_write_page_dma().
Add the sunxi_nfc_randomizer_config() to config randomizer.
--- drivers/mtd/nand/raw/sunxi_nand.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/nand/raw/sunxi_nand.c +1 -0
@@ -1049,6 +1049,7 @@ static int sunxi_nfc_hw_ecc_write_chunk(if (ret)return ret; +sunxi_nfc_randomizer_config (nand, page, false);sunxi_nfc_randomizer_enable (nand);sunxi_nfc_hw_ecc_set_prot_oob_bytes (nand, oob,0 , bbm, page);
Greg Kroah-Hartman
maintainerPATCH 86/290 mtd: nand: sunxi: Add randomizer configuration before randomizer enable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 4a5a99bc79cdc4be63933653682b0261a67a0c9f upstream.
In sunxi_nfc_hw_ecc_read_chunk(), the sunxi_nfc_randomizer_enable() is called without the config of randomizer. A proper implementation can be found in sunxi_nfc_hw_ecc_read_chunks_dma().
Add sunxi_nfc_randomizer_config() before the start of randomization.
--- drivers/mtd/nand/raw/sunxi_nand.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/nand/raw/sunxi_nand.c +1 -0
@@ -817,6 +817,7 @@ static int sunxi_nfc_hw_ecc_read_chunk(sif (ret)return ret; +sunxi_nfc_randomizer_config (nand, page, false);sunxi_nfc_randomizer_enable (nand);writel (NFC_DATA_TRANS |NFC_DATA_SWAP_METHOD |NFC_ECC_OP , nfc->regs +NFC_REG_CMD );
Greg Kroah-Hartman
maintainerPATCH 87/290 KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <[email protected]>
commit 1bee4838eb3a2c689f23c7170ea66ae87ea7d93a upstream.
When freeing a vCPU and thus its VMCB, clear current_vmcb for all possible CPUs, not just online CPUs, as it's theoretically possible a CPU could go offline and come back online in conjunction with KVM reusing the page for a new VMCB.
--- arch/x86/kvm/svm/svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/svm/svm.c +1 -1
@@ -1503,7 +1503,7 @@ static void svm_clear_current_vmcb(struc {int i; -for_each_online_cpu (i) +for_each_possible_cpu (i)cmpxchg (per_cpu_ptr (&svm_data.current_vmcb, i), vmcb,NULL ); }
Greg Kroah-Hartman
maintainerPATCH 88/290 KVM: VMX: Flush shadow VMCS on emergency reboot
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Gao <[email protected]>
commit a0ee1d5faff135e28810f29e0f06328c66f89852 upstream.
Ensure the shadow VMCS cache is evicted during an emergency reboot to prevent potential memory corruption if the cache is evicted after reboot.
This issue was identified through code inspection, as __loaded_vmcs_clear() flushes both the normal VMCS and the shadow VMCS.
Avoid checking the "launched" state during an emergency reboot, unlike the behavior in __loaded_vmcs_clear(). This is important because reboot NMIs can interfere with operations like copy_shadow_to_vmcs12(), where shadow VMCSes are loaded directly using VMPTRLD. In such cases, if NMIs occur right after the VMCS load, the shadow VMCSes will be active but the "launched" state may not be set.
--- arch/x86/kvm/vmx/vmx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/kvm/vmx/vmx.c +4 -1
@@ -787,8 +787,11 @@ static void vmx_emergency_disable(void)return ;list_for_each_entry (v, &per_cpu (loaded_vmcss_on_cpu, cpu), - loaded_vmcss_on_cpu_link) + loaded_vmcss_on_cpu_link) {vmcs_clear (v->vmcs); +if (v->shadow_vmcs) +vmcs_clear (v->shadow_vmcs); + }kvm_cpu_vmxoff (); }
Greg Kroah-Hartman
maintainerPATCH 89/290 dm-mirror: fix a tiny race condition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 829451beaed6165eb11d7a9fb4e28eb17f489980 upstream.
There's a tiny race condition in dm-mirror. The functions queue_bio and write_callback grab a spinlock, add a bio to the list, drop the spinlock and wake up the mirrord thread that processes bios in the list.
It may be possible that the mirrord thread processes the bio just after spin_unlock_irqrestore is called, before wakeup_mirrord. This spurious wake-up is normally harmless, however if the device mapper device is unloaded just after the bio was processed, it may be possible that wakeup_mirrord(ms) uses invalid "ms" pointer.
Fix this bug by moving wakeup_mirrord inside the spinlock.
--- drivers/md/dm-raid1.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/md/dm-raid1.c +2 -3
@@ -133,10 +133,9 @@ static void queue_bio(struct mirror_setspin_lock_irqsave (&ms->lock, flags); should_wake = !(bl->head);bio_list_add (bl, bio); -spin_unlock_irqrestore (&ms->lock, flags); -if (should_wake)wakeup_mirrord (ms); +spin_unlock_irqrestore (&ms->lock, flags); }static void dispatch_bios (void *context,struct bio_list *bio_list)
@@ -646,9 +645,9 @@ static void write_callback(unsigned longif (!ms->failures.head) should_wake =1 ;bio_list_add (&ms->failures, bio); -spin_unlock_irqrestore (&ms->lock, flags);if (should_wake)wakeup_mirrord (ms); +spin_unlock_irqrestore (&ms->lock, flags); }static void do_write (struct mirror_set *ms,struct bio *bio)
Greg Kroah-Hartman
maintainerPATCH 90/290 dm-verity: fix a memory leak if some arguments are specified multiple times
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 66be40a14e496689e1f0add50118408e22c96169 upstream.
If some of the arguments "check_at_most_once", "ignore_zero_blocks", "use_fec_from_device", "root_hash_sig_key_desc" were specified more than once on the target line, a memory leak would happen.
This commit fixes the memory leak. It also fixes error handling in verity_verify_sig_parse_opt_args.
--- drivers/md/dm-verity-fec.c | 4 ++++ drivers/md/dm-verity-target.c | 8 +++++++- drivers/md/dm-verity-verify-sig.c | 17 +++++++++++++---- 3 files changed, 24 insertions(+), 5 deletions(-)
drivers/md/dm-verity-fec.c +4 -0
@@ -624,6 +624,10 @@ int verity_fec_parse_opt_args(struct dm_ (*argc)--;if (!strcasecmp (arg_name,DM_VERITY_OPT_FEC_DEV )) { +if (v->fec->dev) { + ti->error ="FEC device already specified" ; +return -EINVAL ; + } r =dm_get_device (ti, arg_value,BLK_OPEN_READ , &v->fec->dev);if (r) { ti->error ="FEC device lookup failed" ;
drivers/md/dm-verity-target.c +7 -1
@@ -1043,6 +1043,9 @@ static int verity_alloc_most_once(struct {struct dm_target *ti = v->ti; +if (v->validated_blocks) +return 0 ; +/* the bitset can only handle INT_MAX blocks */ if (v->data_blocks >INT_MAX ) { ti->error ="device too large to use check_at_most_once" ;
@@ -1066,6 +1069,9 @@ static int verity_alloc_zero_digest(strustruct ahash_request *req;u8 *zero_data; +if (v->zero_digest) +return 0 ; + v->zero_digest =kmalloc (v->digest_size,GFP_KERNEL );if (!v->zero_digest)
@@ -1405,7 +1411,7 @@ static int verity_ctr(struct dm_target * goto bad; } -/* Root hash signature is a optional parameter*/ +/* Root hash signature is an optional parameter */ r = verity_verify_root_hash(root_hash_digest_to_validate, strlen(root_hash_digest_to_validate), verify_args.sig,
drivers/md/dm-verity-verify-sig.c +13 -4
@@ -71,9 +71,14 @@ int verity_verify_sig_parse_opt_args(str const char *arg_name) {struct dm_target *ti = v->ti; -int ret =0 ; +int ret;const char *sig_key =NULL ; +if (v->signature_key_desc) { + ti->error =DM_VERITY_VERIFY_ERR ("root_hash_sig_key_desc already specified" ); +return -EINVAL ; + } +if (!*argc) { ti->error =DM_VERITY_VERIFY_ERR ("Signature key not specified" );return -EINVAL ;
@@ -83,14 +88,18 @@ int verity_verify_sig_parse_opt_args(str (*argc)--; ret =verity_verify_get_sig_from_key (sig_key, sig_opts); -if (ret <0 ) +if (ret <0 ) { ti->error =DM_VERITY_VERIFY_ERR ("Invalid key specified" ); +return ret; + } v->signature_key_desc =kstrdup (sig_key,GFP_KERNEL ); -if (!v->signature_key_desc) +if (!v->signature_key_desc) { + ti->error =DM_VERITY_VERIFY_ERR ("Could not allocate memory for signature key" );return -ENOMEM ; + } -return ret; +return 0 ; }/*
Greg Kroah-Hartman
maintainerPATCH 91/290 mtd: rawnand: qcom: Fix read len for onfi param page
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Sadre Alam <[email protected]>
commit e6031b11544b44966ba020c867fe438bccd3bdfa upstream.
The minimum size to fetch the data from device to QPIC buffer is 512-bytes. If size is less than 512-bytes the data will not be protected by ECC as per QPIC standard. So while reading onfi parameter page from NAND device set nandc->buf_count = 512.
--- drivers/mtd/nand/raw/qcom_nandc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/qcom_nandc.c +1 -1
@@ -2917,7 +2917,7 @@ static int qcom_param_page_type_exec(strwrite_reg_dma (nandc,NAND_DEV_CMD1 ,1 ,NAND_BAM_NEXT_SGL ); } - nandc->buf_count = len; + nandc->buf_count =512 ;memset (nandc->data_buffer,0xff , nandc->buf_count);config_nand_single_cw_page_read (chip, false,0 );
Greg Kroah-Hartman
maintainerPATCH 92/290 ftrace: Fix UAF when lookup kallsym after ftrace disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit f914b52c379c12288b7623bb814d0508dbe7481d upstream.
The following issue happens with a buggy module:
BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS RIP: 0010:sized_strscpy+0x81/0x2f0 RSP: 0018:ffff88812d76fa08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000 RDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d RBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68 R10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038 R13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff FS: 00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ftrace_mod_get_kallsym+0x1ac/0x590 update_iter_mod+0x239/0x5b0 s_next+0x5b/0xa0 seq_read_iter+0x8c9/0x1070 seq_read+0x249/0x3b0 proc_reg_read+0x1b0/0x280 vfs_read+0x17f/0x920 ksys_read+0xf3/0x1c0 do_syscall_64+0x5f/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The above issue may happen as follows:
(1) Add kprobe tracepoint;
(2) insmod test.ko;
(3) Module triggers ftrace disabled;
(4) rmmod test.ko;
(5) cat /proc/kallsyms; --> Will trigger UAF as test.ko already removed; ftrace_mod_get_kallsym()
...strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN);
...
The problem is when a module triggers an issue with ftrace and sets ftrace_disable. The ftrace_disable is set when an anomaly is discovered and to prevent any more damage, ftrace stops all text modification. The issue that happened was that the ftrace_disable stops more than just the text modification.
When a module is loaded, its init functions can also be traced. Because kallsyms deletes the init functions after a module has loaded, ftrace saves them when the module is loaded and function tracing is enabled. This allows the output of the function trace to show the init function names instead of just their raw memory addresses.
When a module is removed, ftrace_release_mod() is called, and if ftrace_disable is set, it just returns without doing anything more. The problem here is that it leaves the mod_list still around and if kallsyms is called, it will call into this code and access the module memory that has already been freed as it will return:
strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN);
Where the "mod" no longer exists and triggers a UAF bug.
--- kernel/trace/ftrace.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
kernel/trace/ftrace.c +7 -3
@@ -6772,9 +6772,10 @@ void ftrace_release_mod(struct module *mmutex_lock (&ftrace_lock); -if (ftrace_disabled) - goto out_unlock; - +/* +* To avoid the UAF problem after the module is unloaded, the +* 'mod_map' resource needs to be released unconditionally. +*/ list_for_each_entry_safe (mod_map, n, &ftrace_mod_maps, list) {if (mod_map->mod == mod) {list_del_rcu (&mod_map->list);
@@ -6783,6 +6784,9 @@ void ftrace_release_mod(struct module *m } } +if (ftrace_disabled) + goto out_unlock; +/* * Each module has its own ftrace_pages, remove * them from the list.
Greg Kroah-Hartman
maintainerPATCH 93/290 phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit b15ee09ddb987a122e74fb0fdf1bd6e864959fd3 upstream.
The description of TX_VBOOST_LVL is wrong in register PHY_CTRL3 bit[31:29].
The updated description as below:
011: Corresponds to a launch amplitude of 0.844 V. 100: Corresponds to a launch amplitude of 1.008 V. 101: Corresponds to a launch amplitude of 1.156 V.
This will fix the parsing function phy_tx_vboost_level_from_property() to return correct value.
--- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/phy/freescale/phy-fsl-imx8mq-usb.c +5 -5
@@ -95,12 +95,12 @@ static u32 phy_tx_preemp_amp_tune_from_pstatic u32 phy_tx_vboost_level_from_property (u32 microvolt) {switch (microvolt) { - case 0 ... 960: -return 0 ; - case 961 ... 1160: -return 2 ; -default : +case 1156 : +return 5 ; +case 844 :return 3 ; +default : +return 4 ; } }
Greg Kroah-Hartman
maintainerPATCH 94/290 net: ch9200: fix uninitialised access during mii_nway_restart
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit 9ad0452c0277b816a435433cca601304cfac7c21 upstream.
In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff", which is initialised with control_read(). However "buff" is conditionally initialised inside control_read():
if (err == size) {
memcpy(data, buf, size);
}If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200_mdio_read():
return (buff[0] | buff[1] << 8);
The problem stems from the fact that ch9200_mdio_read() ignores the return value of control_read(), leading to uinit-access of "buff".
To fix this we should check the return value ofcontrol_read() and return early on error.
--- drivers/net/usb/ch9200.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/usb/ch9200.c +5 -2
@@ -178,6 +178,7 @@ static int ch9200_mdio_read(struct net_d {struct usbnet *dev =netdev_priv (netdev);unsigned char buff[2 ]; +int ret;netdev_dbg (netdev,"%s phy_id:%02x loc:%02x\n" , __func__, phy_id, loc);
@@ -185,8 +186,10 @@ static int ch9200_mdio_read(struct net_dif (phy_id !=0 )return -ENODEV ; -control_read (dev,REQUEST_READ ,0 , loc *2 , buff,0x02 , -CONTROL_TIMEOUT_MS ); + ret =control_read (dev,REQUEST_READ ,0 , loc *2 , buff,0x02 , +CONTROL_TIMEOUT_MS ); +if (ret <0 ) +return ret;return (buff[0 ] | buff[1 ] <<8 ); }
Greg Kroah-Hartman
maintainerPATCH 95/290 KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
commit 15ac613f124e51a6623975efad9657b1f3ee47e7 upstream.
The enum type prot_type declared in arch/s390/kvm/gaccess.c declares an unfortunate identifier within it - PROT_NONE.
This clashes with the protection bit define from the uapi for mmap() declared in include/uapi/asm-generic/mman-common.h, which is indeed what those casually reading this code would assume this to refer to.
This means that any changes which subsequently alter headers in any way which results in the uapi header being imported here will cause build errors.
Resolve the issue by renaming PROT_NONE to PROT_TYPE_DUMMY.
--- arch/s390/kvm/gaccess.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/s390/kvm/gaccess.c +4 -4
@@ -490,7 +490,7 @@ enum prot_type {PROT_TYPE_DAT =3 ,PROT_TYPE_IEP =4 ,/* Dummy value for passing an initialized value when code != PGM_PROTECTION */ - PROT_NONE, + PROT_TYPE_DUMMY, }; static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva, u8 ar,
@@ -506,7 +506,7 @@ static int trans_exc_ending(struct kvm_vswitch (code) {case PGM_PROTECTION :switch (prot) { -case PROT_NONE : +case PROT_TYPE_DUMMY :/* We should never get here, acts like termination */ WARN_ON_ONCE (1 );break ;
@@ -976,7 +976,7 @@ static int guest_range_to_gpas(struct kv gpa =kvm_s390_real_to_abs (vcpu, ga);if (kvm_is_error_gpa (vcpu->kvm, gpa)) { rc =PGM_ADDRESSING ; - prot =PROT_NONE ; + prot =PROT_TYPE_DUMMY ; } }if (rc)
@@ -1134,7 +1134,7 @@ int access_guest_with_key(struct kvm_vcpif (rc ==PGM_PROTECTION ) prot =PROT_TYPE_KEYC ;else - prot =PROT_NONE ; + prot =PROT_TYPE_DUMMY ; rc =trans_exc_ending (vcpu, rc, ga, ar, mode, prot, terminate); } out_unlock:
Greg Kroah-Hartman
maintainerPATCH 96/290 video: screen_info: Relocate framebuffers behind PCI bridges
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit 2f29b5c231011b94007d2c8a6d793992f2275db1 upstream.
Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes invalid access to I/O memory.
Resources behind a PCI host bridge can be relocated by a certain offset in the kernel's CPU address range used for I/O. The framebuffer memory range stored in screen_info refers to the CPU addresses as seen during boot (where the offset is 0). During boot up, firmware may assign a different memory offset to the PCI host bridge and thereby relocating the framebuffer address of the PCI graphics device as seen by the kernel. The information in screen_info must be updated as well.
The helper pcibios_bus_to_resource() performs the relocation of the screen_info's framebuffer resource (given in PCI bus addresses). The result matches the I/O-memory resource of the PCI graphics device (given in CPU addresses). As before, we store away the information necessary to later update the information in screen_info itself.
Commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated EFI framebuffers") added the code for updating screen_info. It is based on similar functionality that pre-existed in efifb. Efifb uses a pointer to the PCI resource, while the newer code does a memcpy of the region. Hence efifb sees any updates to the PCI resource and avoids the issue.
v3:
- Only use struct pci_bus_region for PCI bus addresses (Bjorn)
- Clarify address semantics in commit messages and comments (Bjorn) v2:
- Fixed tags (Takashi, Ivan)
- Updated information on efifb
--- drivers/video/screen_info_pci.c | 75 +++++++++++++++++++++------------ 1 file changed, 48 insertions(+), 27 deletions(-)
drivers/video/screen_info_pci.c +48 -27
@@ -7,8 +7,8 @@static struct pci_dev *screen_info_lfb_pdev;static size_t screen_info_lfb_bar; -static resource_size_t screen_info_lfb_offset; -static struct resource screen_info_lfb_res =DEFINE_RES_MEM (0 ,0 ); +static resource_size_t screen_info_lfb_res_start;// original start of resource +static resource_size_t screen_info_lfb_offset;// framebuffer offset within resource static bool __screen_info_relocation_is_valid (const struct screen_info *si,struct resource *pr) {
@@ -31,7 +31,7 @@ void screen_info_apply_fixups(void)if (screen_info_lfb_pdev) {struct resource *pr = &screen_info_lfb_pdev->resource[screen_info_lfb_bar]; -if (pr->start != screen_info_lfb_res.start) { +if (pr->start != screen_info_lfb_res_start) {if (__screen_info_relocation_is_valid (si, pr)) {/* * Only update base if we have an actual
@@ -47,46 +47,67 @@ void screen_info_apply_fixups(void) } } +static int __screen_info_lfb_pci_bus_region (const struct screen_info *si,unsigned int type, +struct pci_bus_region *r) +{ +u64 base, size; + + base =__screen_info_lfb_base (si); +if (!base) +return -EINVAL ; + + size =__screen_info_lfb_size (si, type); +if (!size) +return -EINVAL ; + + r->start = base; + r->end = base + size -1 ; + +return 0 ; +} +static void screen_info_fixup_lfb (struct pci_dev *pdev) {unsigned int type; -struct resource res[SCREEN_INFO_MAX_RESOURCES ]; -size_t i, numres; +struct pci_bus_region bus_region;int ret; +struct resource r = { + .flags =IORESOURCE_MEM , + }; +const struct resource *pr;const struct screen_info *si = &screen_info;if (screen_info_lfb_pdev)return ;// already found type =screen_info_video_type (si); -if (type !=VIDEO_TYPE_EFI ) -return ;// only applies to EFI +if (!__screen_info_has_lfb (type)) +return ;// only applies to EFI; maybe VESA - ret =screen_info_resources (si, res,ARRAY_SIZE (res)); + ret =__screen_info_lfb_pci_bus_region (si, type, &bus_region);if (ret <0 )return ; - numres = ret; -for (i =0 ; i < numres; ++i) { -struct resource *r = &res[i]; -const struct resource *pr; +/* +* Translate the PCI bus address to resource. Account +* for an offset if the framebuffer is behind a PCI host +* bridge. +*/ +pcibios_bus_to_resource (pdev->bus, &r, &bus_region); -if (!(r->flags &IORESOURCE_MEM )) -continue ; - pr =pci_find_resource (pdev, r); -if (!pr) -continue ; + pr =pci_find_resource (pdev, &r); +if (!pr) +return ; -/* -* We've found a PCI device with the framebuffer -* resource. Store away the parameters to track -* relocation of the framebuffer aperture. -*/ - screen_info_lfb_pdev = pdev; - screen_info_lfb_bar = pr - pdev->resource; - screen_info_lfb_offset = r->start - pr->start; -memcpy (&screen_info_lfb_res, r,sizeof (screen_info_lfb_res)); - } +/* +* We've found a PCI device with the framebuffer +* resource. Store away the parameters to track +* relocation of the framebuffer aperture. +*/ + screen_info_lfb_pdev = pdev; + screen_info_lfb_bar = pr - pdev->resource; + screen_info_lfb_offset = r.start - pr->start; + screen_info_lfb_res_start = bus_region.start; }DECLARE_PCI_FIXUP_CLASS_HEADER (PCI_ANY_ID ,PCI_ANY_ID ,PCI_BASE_CLASS_DISPLAY ,16 , screen_info_fixup_lfb);
Signature · 1 line
2.50.0
Greg Kroah-Hartman
maintainerPATCH 97/290 staging: iio: ad5933: Correct settling cycles encoding per datasheet
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Shahrouzi <[email protected]>
commit 60638e2a2d4bc03798f00d5ab65ce9b83cb8b03b upstream.
The AD5933 datasheet (Table 13) lists the maximum cycles to be 0x7FC (2044).
Clamp the user input to the maximum effective value of 0x7FC cycles.
--- drivers/staging/iio/impedance-analyzer/ad5933.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/impedance-analyzer/ad5933.c +1 -1
@@ -412,7 +412,7 @@ static ssize_t ad5933_store(struct devic ret =ad5933_cmd (st,0 );break ;case AD5933_OUT_SETTLING_CYCLES : - val =clamp (val, (u16 )0 , (u16 )0x7FF ); + val =clamp (val, (u16 )0 , (u16 )0x7FC ); st->settling_cycles = val;/* 2x, 4x handling, see datasheet */
Greg Kroah-Hartman
maintainerPATCH 98/290 mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khem Raj <[email protected]>
commit 0f4ae7c6ecb89bfda026d210dcf8216fb67d2333 upstream.
GCC 15 changed the default C standard dialect from gnu17 to gnu23, which should not have impacted the kernel because it explicitly requests the gnu11 standard in the main Makefile. However, mips/vdso code uses its own CFLAGS without a '-std=' value, which break with this dialect change because of the kernel's own definitions of bool, false, and true conflicting with the C23 reserved keywords.
include/linux/stddef.h:11:9: error: cannot use keyword 'false' as enumeration constant
11 | false = 0,
| ^~~~~
include/linux/stddef.h:11:9: note: 'false' is a keyword with '-std=c23' onwards
include/linux/types.h:35:33: error: 'bool' cannot be defined via 'typedef'
35 | typedef _Bool bool;
| ^~~~ include/linux/types.h:35:33: note: 'bool' is a keyword with '-std=c23' onwards
Add -std as specified in KBUILD_CFLAGS to the decompressor and purgatory CFLAGS to eliminate these errors and make the C standard version of these areas match the rest of the kernel.
--- arch/mips/vdso/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/mips/vdso/Makefile +1 -0
@@ -30,6 +30,7 @@ endif # offsets. cflags-vdso := $(ccflags-vdso) \ $(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \ + $(filter -std=%,$(KBUILD_CFLAGS)) \ -O3 -g -fPIC -fno-strict-aliasing -fno-common -fno-builtin -G 0 \ -mrelax-pic-calls $(call cc-option, -mexplicit-relocs) \ -fno-stack-protector -fno-jump-tables -DDISABLE_BRANCH_PROFILING \
Greg Kroah-Hartman
maintainerPATCH 99/290 regulator: max14577: Add error check for max14577_read_reg()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit 65271f868cb1dca709ff69e45939bbef8d6d0b70 upstream.
The function max14577_reg_get_current_limit() calls the function max14577_read_reg(), but does not check its return value. A proper implementation can be found in max14577_get_online().
Add a error check for the max14577_read_reg() and return error code if the function fails.
--- drivers/regulator/max14577-regulator.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/regulator/max14577-regulator.c +4 -1
@@ -40,11 +40,14 @@ static int max14577_reg_get_current_limistruct max14577 *max14577 =rdev_get_drvdata (rdev);const struct maxim_charger_current *limits = &maxim_charger_currents[max14577->dev_type]; +int ret;if (rdev_get_id (rdev) !=MAX14577_CHARGER )return -EINVAL ; -max14577_read_reg (rmap,MAX14577_CHG_REG_CHG_CTRL4 , ®_data); + ret =max14577_read_reg (rmap,MAX14577_CHG_REG_CHG_CTRL4 , ®_data); +if (ret <0 ) +return ret;if ((reg_data &CHGCTRL4_MBCICHWRCL_MASK ) ==0 )return limits->min;
Greg Kroah-Hartman
maintainerPATCH 100/290 remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
commit 7692c9fbedd9087dc9050903f58095915458d9b1 upstream.
When rproc->state = RPROC_DETACHED and rproc_attach() is used to attach to the remote processor, if rproc_handle_resources() returns a failure, the resources allocated by imx_rproc_prepare() should be released, otherwise the following memory leak will occur.
Since almost the same thing is done in imx_rproc_prepare() and rproc_resource_cleanup(), Function rproc_resource_cleanup() is able to deal with empty lists so it is better to fix the "goto" statements in rproc_attach(). replace the "unprepare_device" goto statement with "clean_up_resources" and get rid of the "unprepare_device" label.
unreferenced object 0xffff0000861c5d00 (size 128):
comm "kworker/u12:3", pid 59, jiffies 4294893509 (age 149.220s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 02 88 00 00 00 00 00 00 10 00 00 00 00 00 ............ backtrace:
[<00000000f949fe18>] slab_post_alloc_hook+0x98/0x37c [<00000000adbfb3e7>] __kmem_cache_alloc_node+0x138/0x2e0 [<00000000521c0345>] kmalloc_trace+0x40/0x158 [<000000004e330a49>] rproc_mem_entry_init+0x60/0xf8 [<000000002815755e>] imx_rproc_prepare+0xe0/0x180 [<0000000003f61b4e>] rproc_boot+0x2ec/0x528 [<00000000e7e994ac>] rproc_add+0x124/0x17c [<0000000048594076>] imx_rproc_probe+0x4ec/0x5d4 [<00000000efc298a1>] platform_probe+0x68/0xd8 [<00000000110be6fe>] really_probe+0x110/0x27c [<00000000e245c0ae>] __driver_probe_device+0x78/0x12c [<00000000f61f6f5e>] driver_probe_device+0x3c/0x118 [<00000000a7874938>] __device_attach_driver+0xb8/0xf8 [<0000000065319e69>] bus_for_each_drv+0x84/0xe4 [<00000000db3eb243>] __device_attach+0xfc/0x18c [<0000000072e4e1a4>] device_initial_probe+0x14/0x20
--- drivers/remoteproc/remoteproc_core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/remoteproc/remoteproc_core.c +2 -3
@@ -1616,7 +1616,7 @@ static int rproc_attach(struct rproc *rp ret =rproc_set_rsc_table (rproc);if (ret) {dev_err (dev,"can't load resource table: %d\n" , ret); - goto unprepare_device; + goto clean_up_resources; }/* reset max_notifyid */
@@ -1633,7 +1633,7 @@ static int rproc_attach(struct rproc *rp ret =rproc_handle_resources (rproc, rproc_loading_handlers);if (ret) {dev_err (dev,"Failed to process resources: %d\n" , ret); - goto unprepare_device; + goto clean_up_resources; }/* Allocate carveout resources associated to rproc */
@@ -1652,7 +1652,6 @@ static int rproc_attach(struct rproc *rp clean_up_resources:rproc_resource_cleanup (rproc); -unprepare_device:/* release HW resources if needed */ rproc_unprepare_device (rproc); disable_iommu:
Greg Kroah-Hartman
maintainerPATCH 101/290 remoteproc: core: Release rproc->clean_table after rproc_attach() fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
commit bcd241230fdbc6005230f80a4f8646ff5a84f15b upstream.
When rproc->state = RPROC_DETACHED is attached to remote processor through rproc_attach(), if rproc_handle_resources() returns failure, then the clean table should be released, otherwise the following memory leak will occur.
unreferenced object 0xffff000086a99800 (size 1024):
comm "kworker/u12:3", pid 59, jiffies 4294893670 (age 121.140s) hex dump (first 32 bytes):
00 00 00 00 00 80 00 00 00 00 00 00 00 00 10 00 ............ 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 ............ backtrace:
[<000000008bbe4ca8>] slab_post_alloc_hook+0x98/0x3fc [<000000003b8a272b>] __kmem_cache_alloc_node+0x13c/0x230 [<000000007a507c51>] __kmalloc_node_track_caller+0x5c/0x260 [<0000000037818dae>] kmemdup+0x34/0x60 [<00000000610f7f57>] rproc_boot+0x35c/0x56c [<0000000065f8871a>] rproc_add+0x124/0x17c [<00000000497416ee>] imx_rproc_probe+0x4ec/0x5d4 [<000000003bcaa37d>] platform_probe+0x68/0xd8 [<00000000771577f9>] really_probe+0x110/0x27c [<00000000531fea59>] __driver_probe_device+0x78/0x12c [<0000000080036a04>] driver_probe_device+0x3c/0x118 [<000000007e0bddcb>] __device_attach_driver+0xb8/0xf8 [<000000000cf1fa33>] bus_for_each_drv+0x84/0xe4 [<000000001a53b53e>] __device_attach+0xfc/0x18c [<00000000d1a2a32c>] device_initial_probe+0x14/0x20 [<00000000d8f8b7ae>] bus_probe_device+0xb0/0xb4 unreferenced object 0xffff0000864c9690 (size 16):
--- drivers/remoteproc/remoteproc_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/remoteproc/remoteproc_core.c +1 -0
@@ -1654,6 +1654,7 @@ clean_up_resources:rproc_resource_cleanup (rproc);/* release HW resources if needed */ rproc_unprepare_device (rproc); +kfree (rproc->clean_table); disable_iommu:rproc_disable_iommu (rproc);return ret;
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.95 release. There are 290 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.95-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on parisc, s390 allmodconfig builds with gcc-13 and gcc-11 failed on the Linux stable-rc 6.6.95-rc1.
Regressions found on s390
* parisc, build
- gcc-11-allmodconfig
* s390, build
- gcc-13-allmodconfig
Regression Analysis:
- New regression? Yes
- Reproducibility? Yes
Build regression: stable-rc 6.6.95-rc1 s390 parisc allmodconfig sdhci-esdhc-imx.c 'sdhc_esdhc_tuning_restore' defined but not used
## Build errorsdrivers/mmc/host/sdhci-esdhc-imx.c:1571:13: error:
'sdhc_esdhc_tuning_restore' defined but not used [-Werror=unused-function]
1571 | static void sdhc_esdhc_tuning_restore(struct sdhci_host *host)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
drivers/mmc/host/sdhci-esdhc-imx.c:1549:13: error:
'sdhc_esdhc_tuning_save' defined but not used [-Werror=unused-function]
1549 | static void sdhc_esdhc_tuning_save(struct sdhci_host *host)
| ^~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
## Source
* Kernel version: 6.6.95-rc1
* Git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* Git sha: 44f41e69469d0de714a6e7e56848c3e423ac2bb9
* Git describe: v6.6.94-291-g44f41e69469d
* Project details:
https://regressions.linaro.org/lkft/linux-stable-rc-linux-6.6.y/v6.6.94-291-g44f41e69469d/
* Architectures: parisc, s390
* Toolchains: gcc-11, gcc-13
* Kconfigs: allmodconfig
## Build s390
* Build log: https://qa-reports.linaro.org/api/testruns/28839625/log_file/
* Build details:
https://regressions.linaro.org/lkft/linux-stable-rc-linux-6.6.y/v6.6.94-291-g44f41e69469d/build/gcc-13-allmodconfig/
* Build link: https://storage.tuxsuite.com/public/linaro/lkft/builds/2yuYHPJ5UcFEMxXVXUOIqaCBQWP/
* Kernel config:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2yuYHPJ5UcFEMxXVXUOIqaCBQWP/config
## Steps to reproduce
- tuxmake --runtime podman --target-arch s390 --toolchain gcc-13
--kconfig allmodconfig
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerPATCH 102/290 cifs: reset connections for all channels when reconnect requested
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
commit 1f396b9bfe39aaf55ea74a7005806164b236653d upstream.
cifs_reconnect can be called with a flag to mark the session as needing reconnect too. When this is done, we expect the connections of all channels to be reconnected too, which is not happening today.
Without doing this, we have seen bad things happen when primary and secondary channels are connected to different servers (in case of cloud services like Azure Files SMB).
This change would force all connections to reconnect as well, not just the sessions and tcons.
--- fs/smb/client/connect.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/smb/client/connect.c +7 -0
@@ -393,6 +393,13 @@ static int __cifs_reconnect(struct TCP_Sif (!cifs_tcp_ses_needs_reconnect (server,1 ))return 0 ; +/* +* if smb session has been marked for reconnect, also reconnect all +* connections. This way, the other connections do not end up bad. +*/ +if (mark_smb_session) +cifs_signal_cifsd_for_reconnect (server, mark_smb_session); +cifs_mark_tcp_ses_conns_for_reconnect (server, mark_smb_session);cifs_abort_connection (server);
Greg Kroah-Hartman
maintainerPATCH 103/290 cifs: update dstaddr whenever channel iface is updated
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
commit c1846893991f3b4ec8a0cc12219ada153f0814d6 upstream.
When the server interface info changes (more common in clustered servers like Azure Files), the per-channel iface gets updated. However, this did not update the corresponding dstaddr. As a result these channels will still connect (or try connecting) to older addresses.
--- fs/smb/client/sess.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/smb/client/sess.c +4 -0
@@ -485,6 +485,10 @@ cifs_chan_update_iface(struct cifs_ses * ses->chans[chan_index].iface = iface;spin_unlock (&ses->chan_lock); + +spin_lock (&server->srv_lock); +memcpy (&server->dstaddr, &iface->sockaddr,sizeof (server->dstaddr)); +spin_unlock (&server->srv_lock); }/*
Greg Kroah-Hartman
maintainerPATCH 104/290 cifs: dns resolution is needed only for primary channel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
commit b4f60a053a2534c3e510ba0c1f8727566adf8317 upstream.
When calling cifs_reconnect, before the connection to the server is reestablished, the code today does a DNS resolution and updates server->dstaddr.
However, this is not necessary for secondary channels. Secondary channels use the interface list returned by the server to decide which address to connect to. And that happens after tcon is reconnected and server interfaces are requested.
--- fs/smb/client/connect.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/smb/client/connect.c +2 -1
@@ -408,7 +408,8 @@ static int __cifs_reconnect(struct TCP_Stry_to_freeze ();cifs_server_lock (server); -if (!cifs_swn_set_server_dstaddr (server)) { +if (!cifs_swn_set_server_dstaddr (server) && + !SERVER_IS_CHAN (server)) {/* resolve the hostname again to make sure that IP address is up-to-date */ rc =reconn_set_ipaddr_from_hostname (server);cifs_dbg (FYI ,"%s: reconn_set_ipaddr_from_hostname: rc=%d\n" , __func__, rc);
Greg Kroah-Hartman
maintainerPATCH 105/290 smb: client: add NULL check in automount_fullpath
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruben Devos <[email protected]>
commit f1e7a277a1736e12cc4bd6d93b8a5c439b8ca20c upstream.
page is checked for null in __build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not set. However, the check is missing when it is set.
Add a check to prevent a potential NULL pointer dereference.
--- fs/smb/client/namespace.c | 3 +++ 1 file changed, 3 insertions(+)
fs/smb/client/namespace.c +3 -0
@@ -146,6 +146,9 @@ static char *automount_fullpath(struct d }spin_unlock (&tcon->tc_lock); +if (unlikely (!page)) +return ERR_PTR (-ENOMEM ); + s =dentry_path_raw (dentry, page,PATH_MAX );if (IS_ERR (s))return s;
Greg Kroah-Hartman
maintainerPATCH 106/290 Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit 09eea7ad0b8e973dcf5ed49902838e5d68177f8e upstream.
There are use cases that interrupt and monitor pages are mapped to user-mode through UIO, so they need to be system page aligned. Some Hyper-V allocation APIs introduced earlier broke those requirements.
Fix this by using page allocation functions directly for interrupt and monitor pages.
Message-ID: <[email protected]>
--- drivers/hv/connection.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/hv/connection.c +17 -6
@@ -207,10 +207,19 @@ int vmbus_connect(void)mutex_init (&vmbus_connection.channel_mutex);/* +* The following Hyper-V interrupt and monitor pages can be used by +* UIO for mapping to user-space, so they should always be allocated on +* system page boundaries. The system page size must be >= the Hyper-V +* page size. +*/ +BUILD_BUG_ON (PAGE_SIZE <HV_HYP_PAGE_SIZE ); + +/* * Setup the vmbus event connection for channel interrupt * abstraction stuff */ - vmbus_connection.int_page =hv_alloc_hyperv_zeroed_page (); + vmbus_connection.int_page = + (void *)__get_free_page (GFP_KERNEL | __GFP_ZERO);if (vmbus_connection.int_page ==NULL ) { ret = -ENOMEM ; goto cleanup;
@@ -225,8 +234,8 @@ int vmbus_connect(void)* Setup the monitor notification facility. The 1st page for * parent->child and the 2nd page for child->parent */ - vmbus_connection.monitor_pages[0 ] =hv_alloc_hyperv_page (); - vmbus_connection.monitor_pages[1 ] =hv_alloc_hyperv_page (); + vmbus_connection.monitor_pages[0 ] = (void *)__get_free_page (GFP_KERNEL ); + vmbus_connection.monitor_pages[1 ] = (void *)__get_free_page (GFP_KERNEL );if ((vmbus_connection.monitor_pages[0 ] ==NULL ) || (vmbus_connection.monitor_pages[1 ] ==NULL )) { ret = -ENOMEM ;
@@ -342,21 +351,23 @@ void vmbus_disconnect(void)destroy_workqueue (vmbus_connection.work_queue);if (vmbus_connection.int_page) { -hv_free_hyperv_page (vmbus_connection.int_page); +free_page ((unsigned long )vmbus_connection.int_page); vmbus_connection.int_page =NULL ; }if (vmbus_connection.monitor_pages[0 ]) {if (!set_memory_encrypted ( (unsigned long )vmbus_connection.monitor_pages[0 ],1 )) -hv_free_hyperv_page (vmbus_connection.monitor_pages[0 ]); +free_page ((unsigned long ) + vmbus_connection.monitor_pages[0 ]); vmbus_connection.monitor_pages[0 ] =NULL ; }if (vmbus_connection.monitor_pages[1 ]) {if (!set_memory_encrypted ( (unsigned long )vmbus_connection.monitor_pages[1 ],1 )) -hv_free_hyperv_page (vmbus_connection.monitor_pages[1 ]); +free_page ((unsigned long ) + vmbus_connection.monitor_pages[1 ]); vmbus_connection.monitor_pages[1 ] =NULL ; } }
Greg Kroah-Hartman
maintainerPATCH 107/290 uio_hv_generic: Use correct size for interrupt and monitor pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit c951ab8fd3589cf6991ed4111d2130816f2e3ac2 upstream.
Interrupt and monitor pages should be in Hyper-V page size (4k bytes). This can be different from the system page size.
This size is read and used by the user-mode program to determine the mapped data region. An example of such user-mode program is the VMBus driver in DPDK.
Message-ID: <[email protected]>
--- drivers/uio/uio_hv_generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/uio/uio_hv_generic.c +2 -2
@@ -288,13 +288,13 @@ hv_uio_probe(struct hv_device *dev, pdata->info.mem[INT_PAGE_MAP ].name ="int_page" ; pdata->info.mem[INT_PAGE_MAP ].addr = (uintptr_t )vmbus_connection.int_page; - pdata->info.mem[INT_PAGE_MAP ].size =PAGE_SIZE ; + pdata->info.mem[INT_PAGE_MAP ].size =HV_HYP_PAGE_SIZE ; pdata->info.mem[INT_PAGE_MAP ].memtype =UIO_MEM_LOGICAL ; pdata->info.mem[MON_PAGE_MAP ].name ="monitor_page" ; pdata->info.mem[MON_PAGE_MAP ].addr = (uintptr_t )vmbus_connection.monitor_pages[1 ]; - pdata->info.mem[MON_PAGE_MAP ].size =PAGE_SIZE ; + pdata->info.mem[MON_PAGE_MAP ].size =HV_HYP_PAGE_SIZE ; pdata->info.mem[MON_PAGE_MAP ].memtype =UIO_MEM_LOGICAL ; pdata->recv_buf =vzalloc (RECV_BUFFER_SIZE );
Greg Kroah-Hartman
maintainerPATCH 108/290 PCI: cadence-ep: Correct PBA offset in .set_msix() callback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit c8bcb01352a86bc5592403904109c22b66bd916e upstream.
While cdns_pcie_ep_set_msix() writes the Table Size field correctly (N-1), the calculation of the PBA offset is wrong because it calculates space for (N-1) entries instead of N.
This results in the following QEMU error when using PCI passthrough on a device which relies on the PCI endpoint subsystem:
failed to add PCI capability 0x11[0x50]@0xb0: table & pba overlap, or they don't fit in BARs, or don't align
Fix the calculation of PBA offset in the MSI-X capability.
[bhelgaas: more specific subject and commit log]
--- drivers/pci/controller/cadence/pcie-cadence-ep.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-ep.c +3 -2
@@ -294,13 +294,14 @@ static int cdns_pcie_ep_set_msix(structstruct cdns_pcie *pcie = &ep->pcie;u32 cap =CDNS_PCIE_EP_FUNC_MSIX_CAP_OFFSET ;u32 val, reg; +u16 actual_interrupts = interrupts +1 ; fn =cdns_pcie_get_fn_from_vfn (pcie, fn, vfn); reg = cap +PCI_MSIX_FLAGS ; val =cdns_pcie_ep_fn_readw (pcie, fn, reg); val &= ~PCI_MSIX_FLAGS_QSIZE ; - val |= interrupts; + val |= interrupts;/* 0's based value */ cdns_pcie_ep_fn_writew (pcie, fn, reg, val);/* Set MSIX BAR and offset */
@@ -310,7 +311,7 @@ static int cdns_pcie_ep_set_msix(struct/* Set PBA BAR and offset. BAR must match MSIX BAR */ reg = cap +PCI_MSIX_PBA ; - val = (offset + (interrupts *PCI_MSIX_ENTRY_SIZE )) | bir; + val = (offset + (actual_interrupts *PCI_MSIX_ENTRY_SIZE )) | bir;cdns_pcie_ep_fn_writel (pcie, fn, reg, val);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 109/290 PCI: Add ACS quirk for Loongson PCIe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 1f3303aa92e15fa273779acac2d0023609de30f1 upstream.
Loongson PCIe Root Ports don't advertise an ACS capability, but they do not allow peer-to-peer transactions between Root Ports. Add an ACS quirk so each Root Port can be in a separate IOMMU group.
--- drivers/pci/quirks.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/pci/quirks.c +23 -0
@@ -4988,6 +4988,18 @@ static int pci_quirk_brcm_acs(struct pci PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); } +static int pci_quirk_loongson_acs (struct pci_dev *dev,u16 acs_flags) +{ +/* +* Loongson PCIe Root Ports don't advertise an ACS capability, but +* they do not allow peer-to-peer transactions between Root Ports. +* Allow each Root Port to be in a separate IOMMU group by masking +* SV/RR/CR/UF bits. +*/ +return pci_acs_ctrl_enabled (acs_flags, +PCI_ACS_SV |PCI_ACS_RR |PCI_ACS_CR |PCI_ACS_UF ); +} +/* * Wangxun 40G/25G/10G/1G NICs have no ACS capability, but on * multi-function devices, the hardware isolates the functions by
@@ -5121,6 +5133,17 @@ static const struct pci_dev_acs_enabled { PCI_VENDOR_ID_BROADCOM, 0x1762, pci_quirk_mf_endpoint_acs }, { PCI_VENDOR_ID_BROADCOM, 0x1763, pci_quirk_mf_endpoint_acs }, { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, +/* Loongson PCIe Root Ports */ + { PCI_VENDOR_ID_LOONGSON, 0x3C09, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x3C19, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x3C29, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A09, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A19, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A29, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A39, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A49, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A59, pci_quirk_loongson_acs }, + { PCI_VENDOR_ID_LOONGSON, 0x7A69, pci_quirk_loongson_acs },/* Amazon Annapurna Labs */ { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs }, /* Zhaoxin multi-function devices */
Greg Kroah-Hartman
maintainerPATCH 110/290 PCI: Fix lock symmetry in pci_slot_unlock()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit f3efb9569b4a21354ef2caf7ab0608a3e14cc6e4 upstream.
The commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") made the lock function to call depend on dev->subordinate but left pci_slot_unlock() unmodified creating locking asymmetry compared with pci_slot_lock().
Because of the asymmetric lock handling, the same bridge device is unlocked twice. First pci_bus_unlock() unlocks bus->self and then pci_slot_unlock() will unconditionally unlock the same bridge device.
Move pci_dev_unlock() inside an else branch to match the logic in pci_slot_lock().
--- drivers/pci/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/pci.c +2 -1
@@ -5823,7 +5823,8 @@ static void pci_slot_unlock(struct pci_scontinue ;if (dev->subordinate)pci_bus_unlock (dev->subordinate); -pci_dev_unlock (dev); +else +pci_dev_unlock (dev); } }
Greg Kroah-Hartman
maintainerPATCH 111/290 PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diederik de Haas <[email protected]>
commit 286ed198b899739862456f451eda884558526a9d upstream.
The documentation for the phy_power_off() function explicitly says that it must be called before phy_exit().
Hence, follow the same rule in rockchip_pcie_phy_deinit().
--- drivers/pci/controller/dwc/pcie-dw-rockchip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-dw-rockchip.c +1 -1
@@ -275,8 +275,8 @@ static int rockchip_pcie_phy_init(structstatic void rockchip_pcie_phy_deinit (struct rockchip_pcie *rockchip) { -phy_exit (rockchip->phy);phy_power_off (rockchip->phy); +phy_exit (rockchip->phy); }static const struct dw_pcie_ops dw_pcie_ops = {
Greg Kroah-Hartman
maintainerPATCH 112/290 iio: accel: fxls8962af: Fix temperature scan element sign
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
commit 9c78317b42e7c32523c91099859bc4721e9f75dd upstream.
Mark the temperature element signed, data read from the TEMP_OUT register is in two's complement format.
This will avoid the temperature being mishandled and miss displayed.
--- drivers/iio/accel/fxls8962af-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/accel/fxls8962af-core.c +1 -0
@@ -737,6 +737,7 @@ static const struct iio_event_spec fxls8BIT (IIO_CHAN_INFO_OFFSET ),\ .scan_index = -1, \ .scan_type = { \ + .sign ='s' , \ .realbits =8 , \ .storagebits =8 , \ }, \
Greg Kroah-Hartman
maintainerPATCH 113/290 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 1013af4f585fccc4d3e5c5824d174de2257f7d6d upstream.
huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.
If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.
Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.
--- mm/hugetlb.c | 7 +++++++ 1 file changed, 7 insertions(+)
mm/hugetlb.c +7 -0
@@ -7062,6 +7062,13 @@ int huge_pmd_unshare(struct mm_struct *mreturn 0 ;pud_clear (pud); +/* +* Once our caller drops the rmap lock, some other process might be +* using this page table as a normal, non-hugetlb page table. +* Wait for pending gup_fast() in other threads to finish before letting +* that happen. +*/ +tlb_remove_table_sync_one ();ptdesc_pmd_pts_dec (virt_to_ptdesc (ptep));mm_dec_nr_pmds (mm);return 1 ;
Greg Kroah-Hartman
maintainerPATCH 114/290 iio: imu: inv_icm42600: Fix temperature calculation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
commit e2f820014239df9360064079ae93f838ff3b7f8c upstream.
Quoted 1 line
From the documentation:
"offset to be added to <type>[Y]_raw prior toscaling by <type>[Y]_scale" Offset should be applied before multiplying scale, so divide offset by scale to make this correct.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c +5 -3
@@ -67,16 +67,18 @@ int inv_icm42600_temp_read_raw(struct iireturn IIO_VAL_INT ;/* * T°C = (temp / 132.48) + 25 -* Tm°C = 1000 * ((temp * 100 / 13248) + 25) +* Tm°C = 1000 * ((temp / 132.48) + 25) +* Tm°C = 7.548309 * temp + 25000 +* Tm°C = (temp + 3312) * 7.548309 * scale: 100000 / 13248 ~= 7.548309 -* offset: 25000 +* offset: 3312 */ case IIO_CHAN_INFO_SCALE : *val =7 ; *val2 =548309 ;return IIO_VAL_INT_PLUS_MICRO ;case IIO_CHAN_INFO_OFFSET : - *val =25000 ; + *val =3312 ;return IIO_VAL_INT ;default :return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 115/290 iio: adc: ad7606_spi: fix reg write value mask
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 89944d88f8795c6c89b9514cb365998145511cd4 upstream.
Fix incorrect value mask for register write. Register values are 8-bit, not 9. If this function was called with a value > 0xFF and an even addr, it would cause writing to the next register.
--- drivers/iio/adc/ad7606_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7606_spi.c +1 -1
@@ -151,7 +151,7 @@ static int ad7606_spi_reg_write(struct astruct spi_device *spi =to_spi_device (st->dev); st->d16[0 ] =cpu_to_be16 ((st->bops->rd_wr_cmd (addr,1 ) <<8 ) | - (val &0x1FF )); + (val &0xFF ));return spi_write (spi, &st->d16[0 ],sizeof (st->d16[0 ])); }
Greg Kroah-Hartman
maintainerPATCH 116/290 ACPICA: fix acpi operand cache leak in dswstate.c
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seunghun Han <[email protected]>
[ Upstream commit 156fd20a41e776bbf334bd5e45c4f78dfc90ce1c ]
ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732
I found an ACPI cache leak in ACPI early termination and boot continuing case.
When early termination occurs due to malicious ACPI table, Linux kernel terminates ACPI function and continues to boot process. While kernel terminates ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.
Boot log of ACPI operand cache leak is as follows:
Quoted 32 lines
[ 0.585957] ACPI: Added _OSI(Module Device) [ 0.587218] ACPI: Added _OSI(Processor Device) [ 0.588530] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.589790] ACPI: Added _OSI(Processor Aggregator Device) [ 0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155) [ 0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88) [ 0.597858] ACPI: Unable to start the ACPI Interpreter [ 0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects [ 0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26 [ 0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.609177] Call Trace: [ 0.610063] ? dump_stack+0x5c/0x81 [ 0.611118] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.612632] ? acpi_sleep_proc_init+0x27/0x27 [ 0.613906] ? acpi_os_delete_cache+0xa/0x10 [ 0.617986] ? acpi_ut_delete_caches+0x3f/0x7b [ 0.619293] ? acpi_terminate+0xa/0x14 [ 0.620394] ? acpi_init+0x2af/0x34f [ 0.621616] ? __class_create+0x4c/0x80 [ 0.623412] ? video_setup+0x7f/0x7f [ 0.624585] ? acpi_sleep_proc_init+0x27/0x27 [ 0.625861] ? do_one_initcall+0x4e/0x1a0 [ 0.627513] ? kernel_init_freeable+0x19e/0x21f [ 0.628972] ? rest_init+0x80/0x80 [ 0.630043] ? kernel_init+0xa/0x100 [ 0.631084] ? ret_from_fork+0x25/0x30 [ 0.633343] vgaarb: loaded [ 0.635036] EDAC MC: Ver: 3.0.0 [ 0.638601] PCI: Probing PCI hardware [ 0.639833] PCI host bridge to bus 0000:00 [ 0.641031] pci_bus 0000:00: root bus resource [io 0x0000-0xffff]
Quoted 1 line
... Continue to boot and log is omitted ...
I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_ delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push() function uses walk_state->operand_index for start position of the top, but acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it. Therefore, this causes acpi operand memory leak.
This cache leak causes a security threat because an old kernel (<= 4.9) shows memory locations of kernel functions in stack dump. Some malicious users could use this information to neutralize kernel ASLR.
I made a patch to fix ACPI operand cache leak.
--- drivers/acpi/acpica/dsutils.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/acpi/acpica/dsutils.c +8 -1
@@ -668,6 +668,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS ];u32 arg_count =0 ;u32 index = walk_state->num_operands; +u32 prev_num_operands = walk_state->num_operands; +u32 new_num_operands;u32 i;ACPI_FUNCTION_TRACE_PTR (ds_create_operands, first_arg);
@@ -696,6 +698,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,/* Create the interpreter arguments, in reverse order */ + new_num_operands = index; index--;for (i =0 ; i < arg_count; i++) { arg = arguments[index];
@@ -720,7 +723,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,* pop everything off of the operand stack and delete those * objects */ -acpi_ds_obj_stack_pop_and_delete (arg_count, walk_state); + walk_state->num_operands = i; +acpi_ds_obj_stack_pop_and_delete (new_num_operands, walk_state); + +/* Restore operand count */ + walk_state->num_operands = prev_num_operands;ACPI_EXCEPTION ((AE_INFO , status,"While creating Arg %u" , index));return_ACPI_STATUS (status);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/290 ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Talhah Peerbhai <[email protected]>
[ Upstream commit a28206060dc5848a1a2a15b7f6ac6223d869084d ]
Similar to many other Lenovo models with AMD chips, the Lenovo Yoga Pro 7 14ASP9 (product name 83HN) requires a specific quirk to ensure internal mic detection. This patch adds a quirk fixing this.
--- sound/soc/amd/yc/acp6x-mach.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
sound/soc/amd/yc/acp6x-mach.c +8 -1
@@ -311,6 +311,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "83AS"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "83HN"), + } + }, { .driver_data = &acp6x_card, .matches = {
@@ -360,7 +367,7 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "M5402RA"), } }, - { + { .driver_data = &acp6x_card, .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/290 clocksource: Fix the CPUs choice in the watchdog per CPU verification
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guilherme G. Piccoli <[email protected]>
[ Upstream commit 08d7becc1a6b8c936e25d827becabfe3bff72a36 ]
Right now, if the clocksource watchdog detects a clocksource skew, it might perform a per CPU check, for example in the TSC case on x86. In other
words: supposing TSC is detected as unstable by the clocksource watchdog running at CPU1, as part of marking TSC unstable the kernel will also run a check of TSC readings on some CPUs to be sure it is synced between them all.
But that check happens only on some CPUs, not all of them; this choice is based on the parameter "verify_n_cpus" and in some random cpumask calculation. So, the watchdog runs such per CPU checks on up to "verify_n_cpus" random CPUs among all online CPUs, with the risk of repeating CPUs (that aren't double checked) in the cpumask random calculation.
But if "verify_n_cpus" > num_online_cpus(), it should skip the random calculation and just go ahead and check the clocksource sync between all online CPUs, without the risk of skipping some CPUs due to duplicity in the random cpumask calculation.
Tests in a 4 CPU laptop with TSC skew detected led to some cases of the per CPU verification skipping some CPU even with verify_n_cpus=8, due to the duplicity on random cpumask generation. Skipping the randomization when the number of online CPUs is smaller than verify_n_cpus, solves that.
--- kernel/time/clocksource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/clocksource.c +1 -1
@@ -288,7 +288,7 @@ static void clocksource_verify_choose_cpus(void) {int cpu, i, n = verify_n_cpus; -if (n <0 ) { +if (n <0 || n >=num_online_cpus ()) {/* Check all of the CPUs. */ cpumask_copy (&cpus_chosen, cpu_online_mask);cpumask_clear_cpu (smp_processor_id (), &cpus_chosen);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/290 power: supply: collie: Fix wakeup source leaks on device unbind
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit c73d19f89cb03c43abbbfa3b9caa1b8fc719764c ]
Device can be unbound, so driver must also release memory for the wakeup source.
--- drivers/power/supply/collie_battery.c | 1 + 1 file changed, 1 insertion(+)
drivers/power/supply/collie_battery.c +1 -0
@@ -440,6 +440,7 @@ static int collie_bat_probe(struct ucb1x00_dev *dev)static void collie_bat_remove (struct ucb1x00_dev *dev) { +device_init_wakeup (&ucb->dev,0 );free_irq (gpiod_to_irq (collie_bat_main.gpio_full), &collie_bat_main);power_supply_unregister (collie_bat_bu.psy);power_supply_unregister (collie_bat_main.psy);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/290 mmc: Add quirk to disable DDR50 tuning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Shepherd <[email protected]>
[ Upstream commit 9510b38dc0ba358c93cbf5ee7c28820afb85937b ]
Adds the MMC_QUIRK_NO_UHS_DDR50_TUNING quirk and updates mmc_execute_tuning() to return 0 if that quirk is set. This fixes an issue on certain Swissbit SD cards that do not support DDR50 tuning where tuning requests caused I/O errors to be thrown.
--- drivers/mmc/core/card.h | 6 ++++++ drivers/mmc/core/quirks.h | 10 ++++++++++ drivers/mmc/core/sd.c | 32 ++++++++++++++++++++++++-------- include/linux/mmc/card.h | 1 + 4 files changed, 41 insertions(+), 8 deletions(-)
drivers/mmc/core/card.h +6 -0
@@ -86,6 +86,7 @@ struct mmc_fixup {#define CID_MANFID_MICRON 0x13#define CID_MANFID_SAMSUNG 0x15#define CID_MANFID_APACER 0x27 +#define CID_MANFID_SWISSBIT 0x5D#define CID_MANFID_KINGSTON 0x70#define CID_MANFID_HYNIX 0x90#define CID_MANFID_KINGSTON_SD 0x9F
@@ -291,4 +292,9 @@ static inline int mmc_card_broken_sd_poweroff_notify(const struct mmc_card *c) return c->quirks & MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY; } +static inline int mmc_card_no_uhs_ddr50_tuning (const struct mmc_card *c) +{ +return c->quirks &MMC_QUIRK_NO_UHS_DDR50_TUNING ; +} +#endif
drivers/mmc/core/quirks.h +10 -0
@@ -34,6 +34,16 @@ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = { MMC_QUIRK_BROKEN_SD_CACHE | MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY, EXT_CSD_REV_ANY), +/* +* Swissbit series S46-u cards throw I/O errors during tuning requests +* after the initial tuning request expectedly times out. This has +* only been observed on cards manufactured on 01/2019 that are using +* Bay Trail host controllers. +*/ +_FIXUP_EXT ("0016G" ,CID_MANFID_SWISSBIT ,0x5342 ,2019 ,1 , +0 ,-1ull ,SDIO_ANY_ID ,SDIO_ANY_ID , add_quirk_sd, +MMC_QUIRK_NO_UHS_DDR50_TUNING ,EXT_CSD_REV_ANY ), + END_FIXUP };
drivers/mmc/core/sd.c +24 -8
@@ -618,6 +618,29 @@ static int sd_set_current_limit(struct mmc_card *card, u8 *status)return 0 ; } +/* +* Determine if the card should tune or not. +*/ +static bool mmc_sd_use_tuning (struct mmc_card *card) +{ +/* +* SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and +* SDR104 mode SD-cards. Note that tuning is mandatory for SDR104. +*/ +if (mmc_host_is_spi (card->host)) +return false; + +switch (card->host->ios.timing) { +case MMC_TIMING_UHS_SDR50 : +case MMC_TIMING_UHS_SDR104 : +return true; +case MMC_TIMING_UHS_DDR50 : +return !mmc_card_no_uhs_ddr50_tuning (card); + } + +return false; +} +/* * UHS-I specific initialization procedure */
@@ -661,14 +684,7 @@ static int mmc_sd_init_uhs_card(struct mmc_card *card)if (err) goto out; -/* -* SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and -* SDR104 mode SD-cards. Note that tuning is mandatory for SDR104. -*/ -if (!mmc_host_is_spi (card->host) && - (card->host->ios.timing ==MMC_TIMING_UHS_SDR50 || - card->host->ios.timing ==MMC_TIMING_UHS_DDR50 || - card->host->ios.timing ==MMC_TIMING_UHS_SDR104 )) { +if (mmc_sd_use_tuning (card)) { err =mmc_execute_tuning (card);/*
include/linux/mmc/card.h +1 -0
@@ -297,6 +297,7 @@ struct mmc_card {#define MMC_QUIRK_BROKEN_SD_CACHE (1<<15)/* Disable broken SD cache support */ #define MMC_QUIRK_BROKEN_CACHE_FLUSH (1<<16)/* Don't flush cache until the write has occurred */ #define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY (1<<17)/* Disable broken SD poweroff notify support */ +#define MMC_QUIRK_NO_UHS_DDR50_TUNING (1<<18)/* Disable DDR50 tuning */ bool written_flag;/* Indicates eMMC has been written since power on */ bool reenable_cmdq;/* Re-enable Command Queue */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/290 ACPICA: Avoid sequence overread in call to strncmp()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed Salem <[email protected]>
[ Upstream commit 64b9dfd0776e9c38d733094859a09f13282ce6f8 ]
ACPICA commit 8b83a8d88dfec59ea147fad35fc6deea8859c58c
ap_get_table_length() checks if tables are valid by calling ap_is_valid_header(). The latter then calls ACPI_VALIDATE_RSDP_SIG(Table->Signature).
ap_is_valid_header() accepts struct acpi_table_header as an argument, so the signature size is always fixed to 4 bytes.
The problem is when the string comparison is between ACPI-defined table signature and ACPI_SIG_RSDP. Common ACPI table header specifies the Signature field to be 4 bytes long[1], with the exception of the RSDP structure whose signature is 8 bytes long "RSD PTR " (including the trailing blank character)[2]. Calling strncmp(sig, rsdp_sig, 8) would then result in a sequence overread[3] as sig would be smaller (4 bytes) than the specified bound (8 bytes).
As a workaround, pass the bound conditionally based on the size of the signature being passed.
--- include/acpi/actypes.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/acpi/actypes.h +1 -1
@@ -527,7 +527,7 @@ typedef u64 acpi_integer;/* Support for the special RSDP signature (8 characters) */ -#define ACPI_VALIDATE_RSDP_SIG (a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, 8)) +#define ACPI_VALIDATE_RSDP_SIG (a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, (sizeof(a) < 8) ? ACPI_NAMESEG_SIZE : 8))#define ACPI_MAKE_RSDP_SIG (dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8))/* Support for OEMx signature (x can be any character) */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/290 mmc: sdhci-esdhc-imx: Save tuning value when card stays powered in suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke Wang <[email protected]>
[ Upstream commit c63d25cdc59ae2891b39ba2da950910291d9bcbf ]
For SoCs like i.MX6UL(L/Z) and i.MX7D, USDHC powers off completely during system power management (PM), causing the internal tuning status to be lost. To address this, save the tuning value when system suspend and restore it for any command issued after system resume when re-tuning is held.
A typical case involves SDIO WiFi devices with the MMC_PM_KEEP_POWER and MMC_PM_WAKE_SDIO_IRQ flag, which retain power during system PM. To conserve power, WiFi switches to 1-bit mode and restores 4-bit mode upon resume. As per the specification, tuning commands are not supported in 1-bit mode. When sending CMD52 to restore 4-bit mode, re-tuning must be held. However, CMD52 still requires a correct sample point to avoid CRC errors, necessitating preservation of the previous tuning value.
--- drivers/mmc/host/sdhci-esdhc-imx.c | 88 +++++++++++++++++++++++++++++- 1 file changed, 86 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-esdhc-imx.c +86 -2
@@ -80,6 +80,8 @@#define ESDHC_TUNE_CTRL_STEP 1#define ESDHC_TUNE_CTRL_MIN 0#define ESDHC_TUNE_CTRL_MAX ((1 << 7) - 1) +#define ESDHC_TUNE_CTRL_STATUS_TAP_SEL_PRE_MASK GENMASK(30, 24) +#define ESDHC_TUNE_CTRL_STATUS_DLY_CELL_SET_PRE_MASK GENMASK(14, 8)/* strobe dll register */ #define ESDHC_STROBE_DLL_CTRL 0x70
@@ -231,6 +233,7 @@ struct esdhc_platform_data {unsigned int tuning_step;/* The delay cell steps in tuning procedure */ unsigned int tuning_start_tap;/* The start delay cell point in tuning procedure */ unsigned int strobe_dll_delay_target;/* The delay cell for strobe pad (read clock) */ +unsigned int saved_tuning_delay_cell;/* save the value of tuning delay cell */ };struct esdhc_soc_data {
@@ -1052,7 +1055,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host) {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct pltfm_imx_data *imx_data =sdhci_pltfm_priv (pltfm_host); -u32 ctrl; +u32 ctrl, tuning_ctrl;int ret;/* Reset the tuning circuit */
@@ -1066,6 +1069,16 @@ static void esdhc_reset_tuning(struct sdhci_host *host)writel (0 , host->ioaddr +ESDHC_TUNE_CTRL_STATUS ); }else if (imx_data->socdata->flags &ESDHC_FLAG_STD_TUNING ) {writel (ctrl, host->ioaddr +ESDHC_MIX_CTRL ); +/* +* enable the std tuning just in case it cleared in +* sdhc_esdhc_tuning_restore. +*/ + tuning_ctrl =readl (host->ioaddr +ESDHC_TUNING_CTRL ); +if (!(tuning_ctrl &ESDHC_STD_TUNING_EN )) { + tuning_ctrl |=ESDHC_STD_TUNING_EN ; +writel (tuning_ctrl, host->ioaddr +ESDHC_TUNING_CTRL ); + } + ctrl =readl (host->ioaddr +SDHCI_AUTO_CMD_STATUS ); ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL ; ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE ;
@@ -1144,7 +1157,8 @@ static void esdhc_prepare_tuning(struct sdhci_host *host, u32 val) reg |=ESDHC_MIX_CTRL_EXE_TUNE |ESDHC_MIX_CTRL_SMPCLK_SEL |ESDHC_MIX_CTRL_FBCLK_SEL ;writel (reg, host->ioaddr +ESDHC_MIX_CTRL ); -writel (val <<8 , host->ioaddr +ESDHC_TUNE_CTRL_STATUS ); +writel (FIELD_PREP (ESDHC_TUNE_CTRL_STATUS_DLY_CELL_SET_PRE_MASK , val), + host->ioaddr +ESDHC_TUNE_CTRL_STATUS );dev_dbg (mmc_dev (host->mmc),"tuning with delay 0x%x ESDHC_TUNE_CTRL_STATUS 0x%x\n" , val,readl (host->ioaddr +ESDHC_TUNE_CTRL_STATUS ));
@@ -1532,6 +1546,57 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) } } +static void sdhc_esdhc_tuning_save (struct sdhci_host *host) +{ +struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host); +struct pltfm_imx_data *imx_data =sdhci_pltfm_priv (pltfm_host); +u32 reg; + +/* +* SD/eMMC do not need this tuning save because it will re-init +* after system resume back. +* Here save the tuning delay value for SDIO device since it may +* keep power during system PM. And for usdhc, only SDR50 and +* SDR104 mode for SDIO device need to do tuning, and need to +* save/restore. +*/ +if (host->timing ==MMC_TIMING_UHS_SDR50 || + host->timing ==MMC_TIMING_UHS_SDR104 ) { + reg =readl (host->ioaddr +ESDHC_TUNE_CTRL_STATUS ); + reg =FIELD_GET (ESDHC_TUNE_CTRL_STATUS_TAP_SEL_PRE_MASK , reg); + imx_data->boarddata.saved_tuning_delay_cell = reg; + } +} + +static void sdhc_esdhc_tuning_restore (struct sdhci_host *host) +{ +struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host); +struct pltfm_imx_data *imx_data =sdhci_pltfm_priv (pltfm_host); +u32 reg; + +if (host->timing ==MMC_TIMING_UHS_SDR50 || + host->timing ==MMC_TIMING_UHS_SDR104 ) { +/* +* restore the tuning delay value actually is a +* manual tuning method, so clear the standard +* tuning enable bit here. Will set back this +* ESDHC_STD_TUNING_EN in esdhc_reset_tuning() +* when trigger re-tuning. +*/ + reg =readl (host->ioaddr +ESDHC_TUNING_CTRL ); + reg &= ~ESDHC_STD_TUNING_EN ; +writel (reg, host->ioaddr +ESDHC_TUNING_CTRL ); + + reg =readl (host->ioaddr +ESDHC_MIX_CTRL ); + reg |=ESDHC_MIX_CTRL_SMPCLK_SEL |ESDHC_MIX_CTRL_FBCLK_SEL ; +writel (reg, host->ioaddr +ESDHC_MIX_CTRL ); + +writel (FIELD_PREP (ESDHC_TUNE_CTRL_STATUS_DLY_CELL_SET_PRE_MASK , + imx_data->boarddata.saved_tuning_delay_cell), + host->ioaddr +ESDHC_TUNE_CTRL_STATUS ); + } +} +static void esdhc_cqe_enable (struct mmc_host *mmc) {struct sdhci_host *host =mmc_priv (mmc);
@@ -1856,6 +1921,15 @@ static int sdhci_esdhc_suspend(struct device *dev)if (host->tuning_mode !=SDHCI_TUNING_MODE_3 )mmc_retune_needed (host->mmc); +/* +* For the device need to keep power during system PM, need +* to save the tuning delay value just in case the usdhc +* lost power during system PM. +*/ +if (mmc_card_keep_power (host->mmc) &&mmc_card_wake_sdio_irq (host->mmc) && +esdhc_is_usdhc (imx_data)) +sdhc_esdhc_tuning_save (host); + ret =sdhci_suspend_host (host);if (ret)return ret;
@@ -1872,6 +1946,8 @@ static int sdhci_esdhc_suspend(struct device *dev)static int sdhci_esdhc_resume (struct device *dev) {struct sdhci_host *host =dev_get_drvdata (dev); +struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host); +struct pltfm_imx_data *imx_data =sdhci_pltfm_priv (pltfm_host);int ret; ret =pinctrl_pm_select_default_state (dev);
@@ -1885,6 +1961,14 @@ static int sdhci_esdhc_resume(struct device *dev)if (ret)return ret; +/* +* restore the saved tuning delay value for the device which keep +* power during system PM. +*/ +if (mmc_card_keep_power (host->mmc) &&mmc_card_wake_sdio_irq (host->mmc) && +esdhc_is_usdhc (imx_data)) +sdhc_esdhc_tuning_restore (host); +if (host->mmc->caps2 &MMC_CAP2_CQE ) ret =cqhci_resume (host->mmc);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/290 ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit f529c91be8a34ac12e7599bf87c65b6f4a2c9f5c ]
The ISENSE/VSENSE blocks are only powered up when the amplifier transitions from shutdown to active. This means that if those controls are flipped on while the amplifier is already playing back audio, they will have no effect.
Fix this by forcing a power cycle around transitions in those controls.
--- sound/soc/codecs/tas2770.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-)
sound/soc/codecs/tas2770.c +28 -2
@@ -158,11 +158,37 @@ static const struct snd_kcontrol_new isense_switch =static const struct snd_kcontrol_new vsense_switch =SOC_DAPM_SINGLE ("Switch" ,TAS2770_PWR_CTRL ,2 ,1 ,1 ); +static int sense_event (struct snd_soc_dapm_widget *w, +struct snd_kcontrol *kcontrol,int event) +{ +struct snd_soc_component *component =snd_soc_dapm_to_component (w->dapm); +struct tas2770_priv *tas2770 =snd_soc_component_get_drvdata (component); + +/* +* Powering up ISENSE/VSENSE requires a trip through the shutdown state. +* Do that here to ensure that our changes are applied properly, otherwise +* we might end up with non-functional IVSENSE if playback started earlier, +* which would break software speaker protection. +*/ +switch (event) { +case SND_SOC_DAPM_PRE_REG : +return snd_soc_component_update_bits (component,TAS2770_PWR_CTRL , +TAS2770_PWR_CTRL_MASK , +TAS2770_PWR_CTRL_SHUTDOWN ); +case SND_SOC_DAPM_POST_REG : +return tas2770_update_pwr_ctrl (tas2770); +default : +return 0 ; + } +} +static const struct snd_soc_dapm_widget tas2770_dapm_widgets[] = {SND_SOC_DAPM_AIF_IN ("ASI1" ,"ASI1 Playback" ,0 ,SND_SOC_NOPM ,0 ,0 ),SND_SOC_DAPM_MUX ("ASI1 Sel" ,SND_SOC_NOPM ,0 ,0 , &tas2770_asi1_mux), -SND_SOC_DAPM_SWITCH ("ISENSE" ,TAS2770_PWR_CTRL ,3 ,1 , &isense_switch), -SND_SOC_DAPM_SWITCH ("VSENSE" ,TAS2770_PWR_CTRL ,2 ,1 , &vsense_switch), +SND_SOC_DAPM_SWITCH_E ("ISENSE" ,TAS2770_PWR_CTRL ,3 ,1 , &isense_switch, + sense_event,SND_SOC_DAPM_PRE_REG |SND_SOC_DAPM_POST_REG ), +SND_SOC_DAPM_SWITCH_E ("VSENSE" ,TAS2770_PWR_CTRL ,2 ,1 , &vsense_switch, + sense_event,SND_SOC_DAPM_PRE_REG |SND_SOC_DAPM_POST_REG ),SND_SOC_DAPM_DAC_E ("DAC" ,NULL ,SND_SOC_NOPM ,0 ,0 , tas2770_dac_event,SND_SOC_DAPM_POST_PMU |SND_SOC_DAPM_PRE_PMD ),SND_SOC_DAPM_OUTPUT ("OUT" ),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/290 ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit e1bdbbc98279164d910d2de82a745f090a8b249f ]
acpi_register_lps0_dev() and acpi_unregister_lps0_dev() may be used in drivers that don't require CONFIG_SUSPEND or compile on !X86.
Add prototypes for those cases.
--- include/linux/acpi.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
include/linux/acpi.h +8 -1
@@ -1098,13 +1098,13 @@ void acpi_os_set_prepare_extended_sleep(int (*func)(u8 sleep_state,acpi_status acpi_os_prepare_extended_sleep (u8 sleep_state,u32 val_a,u32 val_b); -#if defined(CONFIG_SUSPEND ) && defined(CONFIG_X86 )struct acpi_s2idle_dev_ops {struct list_head list_node;void (*prepare)(void );void (*check)(void );void (*restore)(void ); }; +#if defined(CONFIG_SUSPEND ) && defined(CONFIG_X86 )int acpi_register_lps0_dev (struct acpi_s2idle_dev_ops *arg);void acpi_unregister_lps0_dev (struct acpi_s2idle_dev_ops *arg);int acpi_get_lps0_constraint (struct acpi_device *adev);
@@ -1113,6 +1113,13 @@ static inline int acpi_get_lps0_constraint(struct device *dev) {return ACPI_STATE_UNKNOWN ; } +static inline int acpi_register_lps0_dev (struct acpi_s2idle_dev_ops *arg) +{ +return -ENODEV ; +} +static inline void acpi_unregister_lps0_dev (struct acpi_s2idle_dev_ops *arg) +{ +}#endif /* CONFIG_SUSPEND && CONFIG_X86 */ #ifndef CONFIG_IA64 void arch_reserve_mem_area (acpi_physical_address addr,size_t size);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/290 ACPICA: fix acpi parse and parseext cache leaks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seunghun Han <[email protected]>
[ Upstream commit bed18f0bdcd6737a938264a59d67923688696fc4 ]
ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5
I'm Seunghun Han, and I work for National Security Research Institute of South Korea.
I have been doing a research on ACPI and found an ACPI cache leak in ACPI early abort cases.
Boot log of ACPI cache leak is as follows:
[ 0.352414] ACPI: Added _OSI(Module Device) [ 0.353182] ACPI: Added _OSI(Processor Device) [ 0.353182] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.353182] ACPI: Added _OSI(Processor Aggregator Device) [ 0.356028] ACPI: Unable to start the ACPI Interpreter [ 0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects [ 0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #10 [ 0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.361873] Call Trace: [ 0.362243] ? dump_stack+0x5c/0x81 [ 0.362591] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.362944] ? acpi_sleep_proc_init+0x27/0x27 [ 0.363296] ? acpi_os_delete_cache+0xa/0x10 [ 0.363646] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.364000] ? acpi_terminate+0xa/0x14 [ 0.364000] ? acpi_init+0x2af/0x34f [ 0.364000] ? __class_create+0x4c/0x80 [ 0.364000] ? video_setup+0x7f/0x7f [ 0.364000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.364000] ? do_one_initcall+0x4e/0x1a0 [ 0.364000] ? kernel_init_freeable+0x189/0x20a [ 0.364000] ? rest_init+0xc0/0xc0 [ 0.364000] ? kernel_init+0xa/0x100 [ 0.364000] ? ret_from_fork+0x25/0x30
I analyzed this memory leak in detail. I found that “Acpi-State” cache and “Acpi-Parse” cache were merged because the size of cache objects was same slab cache size.
I finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked using SLAB_NEVER_MERGE flag in kmem_cache_create() function.
Real ACPI cache leak point is as follows:
[ 0.360101] ACPI: Added _OSI(Module Device) [ 0.360101] ACPI: Added _OSI(Processor Device) [ 0.360101] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.361043] ACPI: Added _OSI(Processor Aggregator Device) [ 0.364016] ACPI: Unable to start the ACPI Interpreter [ 0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects [ 0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #8 [ 0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.372000] Call Trace: [ 0.372000] ? dump_stack+0x5c/0x81 [ 0.372000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.372000] ? acpi_os_delete_cache+0xa/0x10 [ 0.372000] ? acpi_ut_delete_caches+0x56/0x7b [ 0.372000] ? acpi_terminate+0xa/0x14 [ 0.372000] ? acpi_init+0x2af/0x34f [ 0.372000] ? __class_create+0x4c/0x80 [ 0.372000] ? video_setup+0x7f/0x7f [ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.372000] ? do_one_initcall+0x4e/0x1a0 [ 0.372000] ? kernel_init_freeable+0x189/0x20a [ 0.372000] ? rest_init+0xc0/0xc0 [ 0.372000] ? kernel_init+0xa/0x100 [ 0.372000] ? ret_from_fork+0x25/0x30 [ 0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects [ 0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #8 [ 0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.392000] Call Trace: [ 0.392000] ? dump_stack+0x5c/0x81 [ 0.392000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.392000] ? acpi_os_delete_cache+0xa/0x10 [ 0.392000] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.392000] ? acpi_terminate+0xa/0x14 [ 0.392000] ? acpi_init+0x2af/0x34f [ 0.392000] ? __class_create+0x4c/0x80 [ 0.392000] ? video_setup+0x7f/0x7f [ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.392000] ? do_one_initcall+0x4e/0x1a0 [ 0.392000] ? kernel_init_freeable+0x189/0x20a [ 0.392000] ? rest_init+0xc0/0xc0 [ 0.392000] ? kernel_init+0xa/0x100 [ 0.392000] ? ret_from_fork+0x25/0x30
When early abort is occurred due to invalid ACPI information, Linux kernel terminates ACPI by calling acpi_terminate() function. The function calls acpi_ut_delete_caches() function to delete local caches (acpi_gbl_namespace_ cache, state_cache, operand_cache, ps_node_cache, ps_node_ext_cache).
But the deletion codes in acpi_ut_delete_caches() function only delete slab caches using kmem_cache_destroy() function, therefore the cache objects should be flushed before acpi_ut_delete_caches() function.
"Acpi-Parse" cache and "Acpi-ParseExt" cache are used in an AML parse function, acpi_ps_parse_loop(). The function should complete all ops using acpi_ps_complete_final_op() when an error occurs due to invalid AML codes.
However, the current implementation of acpi_ps_complete_final_op() does not complete all ops when it meets some errors and this cause cache leak.
This cache leak has a security threat because an old kernel (<= 4.9) shows memory locations of kernel functions in stack dump. Some malicious users could use this information to neutralize kernel ASLR.
To fix ACPI cache leak for enhancing security, I made a patch to complete all ops unconditionally for acpi_ps_complete_final_op() function.
I hope that this patch improves the security of Linux kernel.
Thank you.
--- drivers/acpi/acpica/psobject.c | 52 ++++++++++------------------------ 1 file changed, 15 insertions(+), 37 deletions(-)
drivers/acpi/acpica/psobject.c +15 -37
@@ -636,7 +636,8 @@ acpi_status acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, union acpi_parse_object *op, acpi_status status) { - acpi_status status2; + acpi_status return_status = status; +u8 ascending = TRUE;ACPI_FUNCTION_TRACE_PTR (ps_complete_final_op, walk_state);
@@ -650,7 +651,7 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, op)); do { if (op) { - if (walk_state->ascending_callback != NULL) { + if (ascending && walk_state->ascending_callback != NULL) { walk_state->op = op; walk_state->op_info = acpi_ps_get_opcode_info(op->common.
@@ -672,49 +673,26 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, }if (status ==AE_CTRL_TERMINATE ) { - status =AE_OK ; - -/* Clean up */ -do { -if (op) { - status2 = -acpi_ps_complete_this_op - (walk_state, op); -if (ACPI_FAILURE - (status2)) { -return_ACPI_STATUS - (status2); - } - } - -acpi_ps_pop_scope (& - (walk_state-> - parser_state), - &op, - &walk_state-> - arg_types, - &walk_state-> - arg_count); - - }while (op); - -return_ACPI_STATUS (status); + ascending = FALSE; + return_status =AE_CTRL_TERMINATE ; }else if (ACPI_FAILURE (status)) {/* First error is most important */ - (void ) -acpi_ps_complete_this_op (walk_state, - op); -return_ACPI_STATUS (status); + ascending = FALSE; + return_status = status; } } - status2 =acpi_ps_complete_this_op (walk_state, op); -if (ACPI_FAILURE (status2)) { -return_ACPI_STATUS (status2); + status =acpi_ps_complete_this_op (walk_state, op); +if (ACPI_FAILURE (status)) { + ascending = FALSE; +if (ACPI_SUCCESS (return_status) || + return_status ==AE_CTRL_TERMINATE ) { + return_status = status; + } } }
@@ -724,5 +702,5 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, }while (op); -return_ACPI_STATUS (status); +return_ACPI_STATUS (return_status); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/290 power: supply: bq27xxx: Retrieve again when busy
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Lv <[email protected]>
[ Upstream commit f16d9fb6cf03fdbdefa41a8b32ba1e57afb7ae3d ]
Multiple applications may access the battery gauge at the same time, so the gauge may be busy and EBUSY will be returned. The driver will set a flag to record the EBUSY state, and this flag will be kept until the next periodic update. When this flag is set, bq27xxx_battery_get_property() will just return ENODEV until the flag is updated.
Even if the gauge was busy during the last accessing attempt, returning ENODEV is not ideal, and can cause confusion in the applications layer.
Instead, retry accessing the I2C to update the flag is as expected, for the gauge typically recovers from busy state within a few milliseconds. If still failed to access the gauge, the real error code would be returned instead of ENODEV (as suggested by Pali Rohár).
--- drivers/power/supply/bq27xxx_battery.c | 2 +- drivers/power/supply/bq27xxx_battery_i2c.c | 13 ++++++++++++- 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/power/supply/bq27xxx_battery.c +1 -1
@@ -2044,7 +2044,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy,mutex_unlock (&di->lock);if (psp !=POWER_SUPPLY_PROP_PRESENT && di->cache.flags <0 ) -return -ENODEV ; +return di->cache.flags;switch (psp) {case POWER_SUPPLY_PROP_STATUS :
drivers/power/supply/bq27xxx_battery_i2c.c +12 -1
@@ -6,6 +6,7 @@* Andrew F. Davis <[email protected]> */ +#include <linux/delay.h> #include <linux/i2c.h> #include <linux/interrupt.h> #include <linux/module.h>
@@ -32,6 +33,7 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg,struct i2c_msg msg[2 ];u8 data[2 ];int ret; +int retry =0 ;if (!client->adapter)return -ENODEV ;
@@ -48,7 +50,16 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg,else msg[1 ].len =2 ; - ret =i2c_transfer (client->adapter, msg,ARRAY_SIZE (msg)); +do { + ret =i2c_transfer (client->adapter, msg,ARRAY_SIZE (msg)); +if (ret == -EBUSY && ++retry <3 ) { +/* sleep 10 milliseconds when busy */ +usleep_range (10000 ,11000 ); +continue ; + } +break ; + }while (1 ); +if (ret <0 )return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/290 ACPICA: utilities: Fix overflow check in vsnprintf()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: gldrk <[email protected]>
[ Upstream commit 12b660251007e00a3e4d47ec62dbe3a7ace7023e ]
ACPICA commit d9d59b7918514ae55063b93f3ec041b1a569bf49
The old version breaks sprintf on 64-bit systems for buffers outside [0..UINT32_MAX].
--- drivers/acpi/acpica/utprint.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/acpi/acpica/utprint.c +2 -5
@@ -333,11 +333,8 @@ int vsnprintf(char *string, acpi_size size, const char *format, va_list args) pos = string; -if (size !=ACPI_UINT32_MAX ) { - end = string + size; - }else { - end =ACPI_CAST_PTR (char,ACPI_UINT32_MAX ); - } + size =ACPI_MIN (size,ACPI_PTR_DIFF (ACPI_MAX_PTR , string)); + end = string + size;for (; *format; ++format) {if (*format !='%' ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/290 ASoC: tegra210_ahub: Add check to of_device_get_match_data()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanjun Gong <[email protected]>
[ Upstream commit 04cb269c204398763a620d426cbee43064854000 ]
In tegra_ahub_probe(), check the result of function of_device_get_match_data(), return an error code in case it fails.
--- sound/soc/tegra/tegra210_ahub.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/tegra/tegra210_ahub.c +2 -0
@@ -1359,6 +1359,8 @@ static int tegra_ahub_probe(struct platform_device *pdev)return -ENOMEM ; ahub->soc_data =of_device_get_match_data (&pdev->dev); +if (!ahub->soc_data) +return -ENODEV ;platform_set_drvdata (pdev, ahub);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/290 gpiolib: of: Add polarity quirk for s5m8767
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 4e310626eb4df52a31a142c1360fead0fcbd3793 ]
This is prepare patch for switching s5m8767 regulator driver to use GPIO descriptor. DTS for exynos5250 spring incorrectly specifies "active low" polarity for the DVS and DS line. But per datasheet, they are actually active high. So add polarity quirk for it.
--- drivers/gpio/gpiolib-of.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpio/gpiolib-of.c +9 -0
@@ -203,6 +203,15 @@ static void of_gpio_try_fixup_polarity(const struct device_node *np, */ { "lantiq,pci-xway", "gpio-reset", false }, #endif +#if IS_ENABLED(CONFIG_REGULATOR_S5M8767) + /* + * According to S5M8767, the DVS and DS pin are + * active-high signals. However, exynos5250-spring.dts use + * active-low setting. + */ + { "samsung,s5m8767-pmic", "s5m8767,pmic-buck-dvs-gpios", true }, + { "samsung,s5m8767-pmic", "s5m8767,pmic-buck-ds-gpios", true }, +#endif #if IS_ENABLED(CONFIG_TOUCHSCREEN_TSC2005) /* * DTS for Nokia N900 incorrectly specified "active high"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/290 PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charan Teja Kalla <[email protected]>
[ Upstream commit 40d3b40dce375d6f1c1dbf08d79eed3aed6c691d ]
pm_runtime_put_autosuspend() schedules a hrtimer to expire at "dev->power.timer_expires". If the hrtimer's callback, pm_suspend_timer_fn(), observes that the current time equals "dev->power.timer_expires", it unexpectedly bails out instead of proceeding with runtime suspend.
pm_suspend_timer_fn():
if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
dev->power.timer_expires = 0; rpm_suspend(..)
}
Additionally, as ->timer_expires is not cleared, all the future auto suspend requests will not schedule hrtimer to perform auto suspend.
rpm_suspend():
if ((rpmflags & RPM_AUTO) &&...) {
if (!(dev->power.timer_expires && ...) { <-- this will fail.
hrtimer_start_range_ns(&dev->power.suspend_timer,...);
}
}
Fix this by as well checking if current time reaches the set expiration.
--- drivers/base/power/runtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/runtime.c +1 -1
@@ -1001,7 +1001,7 @@ static enum hrtimer_restart pm_suspend_timer_fn(struct hrtimer *timer)* If 'expires' is after the current time, we've been called * too early. */ -if (expires >0 && expires <ktime_get_mono_fast_ns ()) { +if (expires >0 && expires <=ktime_get_mono_fast_ns ()) { dev->power.timer_expires =0 ;rpm_suspend (dev, dev->power.timer_autosuspends ? (RPM_ASYNC |RPM_AUTO ) :RPM_ASYNC );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/290 ACPI: battery: negate current when discharging
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Marheine <[email protected]>
[ Upstream commit 234f71555019d308c6bc6f98c78c5551cb8cd56a ]
The ACPI specification requires that battery rate is always positive, but the kernel ABI for POWER_SUPPLY_PROP_CURRENT_NOW (Documentation/ABI/testing/sysfs-class-power) specifies that it should be negative when a battery is discharging. When reporting CURRENT_NOW, massage the value to match the documented ABI.
This only changes the sign of current_now and not power_now because documentation doesn't describe any particular meaning for power_now so leaving power_now unchanged is less likely to confuse userspace unnecessarily, whereas becoming consistent with the documented ABI is worth potentially confusing clients that read current_now.
--- drivers/acpi/battery.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/acpi/battery.c +16 -3
@@ -243,10 +243,23 @@ static int acpi_battery_get_property(struct power_supply *psy,break ;case POWER_SUPPLY_PROP_CURRENT_NOW :case POWER_SUPPLY_PROP_POWER_NOW : -if (battery->rate_now ==ACPI_BATTERY_VALUE_UNKNOWN ) +if (battery->rate_now ==ACPI_BATTERY_VALUE_UNKNOWN ) { ret = -ENODEV ; -else - val->intval = battery->rate_now *1000 ; +break ; + } + + val->intval = battery->rate_now *1000 ; +/* +* When discharging, the current should be reported as a +* negative number as per the power supply class interface +* definition. +*/ +if (psp ==POWER_SUPPLY_PROP_CURRENT_NOW && + (battery->state &ACPI_BATTERY_STATE_DISCHARGING ) && +acpi_battery_handle_discharging (battery) + ==POWER_SUPPLY_STATUS_DISCHARGING ) + val->intval = -val->intval; +break ;case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN :case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/290 net: macb: Check return value of dma_set_mask_and_coherent()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergio Perez Gonzalez <[email protected]>
[ Upstream commit 3920a758800762917177a6b5ab39707d8e376fe6 ]
Issue flagged by coverity. Add a safety check for the return value of dma_set_mask_and_coherent, go to a safe exit if it returns error.
--- drivers/net/ethernet/cadence/macb_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +5 -1
@@ -5070,7 +5070,11 @@ static int macb_probe(struct platform_device *pdev)#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT if (GEM_BFEXT (DAW64 ,gem_readl (bp,DCFG6 ))) { -dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (44 )); + err =dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (44 )); +if (err) { +dev_err (&pdev->dev,"failed to set DMA mask\n" ); + goto err_out_free_netdev; + } bp->hw_dma_cap |=HW_DMA_CAP_64B ; }#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/290 net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rengarajan S <[email protected]>
[ Upstream commit 3b9935586a9b54d2da27901b830d3cf46ad66a1e ]
Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb and 64 Kb respectively. Adjust max size definitions and return correct EEPROM length based on device. Also prevent out-of-bound read/write.
--- .../net/ethernet/microchip/lan743x_ethtool.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/net/ethernet/microchip/lan743x_ethtool.c +16 -2
@@ -18,6 +18,8 @@#define EEPROM_MAC_OFFSET (0x01)#define MAX_EEPROM_SIZE (512)#define MAX_OTP_SIZE (1024) +#define MAX_HS_OTP_SIZE (8 * 1024) +#define MAX_HS_EEPROM_SIZE (64 * 1024)#define OTP_INDICATOR_1 (0xF3)#define OTP_INDICATOR_2 (0xF7)
@@ -272,6 +274,9 @@ static int lan743x_hs_otp_read(struct lan743x_adapter *adapter, u32 offset,int ret;int i; +if (offset + length >MAX_HS_OTP_SIZE ) +return -EINVAL ; + ret =lan743x_hs_syslock_acquire (adapter,LOCK_TIMEOUT_MAX_CNT );if (ret <0 )return ret;
@@ -320,6 +325,9 @@ static int lan743x_hs_otp_write(struct lan743x_adapter *adapter, u32 offset,int ret;int i; +if (offset + length >MAX_HS_OTP_SIZE ) +return -EINVAL ; + ret =lan743x_hs_syslock_acquire (adapter,LOCK_TIMEOUT_MAX_CNT );if (ret <0 )return ret;
@@ -497,6 +505,9 @@ static int lan743x_hs_eeprom_read(struct lan743x_adapter *adapter,u32 val;int i; +if (offset + length >MAX_HS_EEPROM_SIZE ) +return -EINVAL ; + retval =lan743x_hs_syslock_acquire (adapter,LOCK_TIMEOUT_MAX_CNT );if (retval <0 )return retval;
@@ -539,6 +550,9 @@ static int lan743x_hs_eeprom_write(struct lan743x_adapter *adapter,u32 val;int i; +if (offset + length >MAX_HS_EEPROM_SIZE ) +return -EINVAL ; + retval =lan743x_hs_syslock_acquire (adapter,LOCK_TIMEOUT_MAX_CNT );if (retval <0 )return retval;
@@ -604,9 +618,9 @@ static int lan743x_ethtool_get_eeprom_len(struct net_device *netdev)struct lan743x_adapter *adapter =netdev_priv (netdev);if (adapter->flags &LAN743X_ADAPTER_FLAG_OTP ) -return MAX_OTP_SIZE ; +return adapter->is_pci11x1x ?MAX_HS_OTP_SIZE :MAX_OTP_SIZE ; -return MAX_EEPROM_SIZE ; +return adapter->is_pci11x1x ?MAX_HS_EEPROM_SIZE :MAX_EEPROM_SIZE ; } static int lan743x_ethtool_get_eeprom(struct net_device *netdev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/290 tipc: use kfree_sensitive() for aead cleanup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit c8ef20fe7274c5766a317f9193b70bed717b6b3d ]
The tipc_aead_free() function currently uses kfree() to release the aead structure. However, this structure contains sensitive information, such as key's SALT value, which should be securely erased from memory to prevent potential leakage.
To enhance security, replace kfree() with kfree_sensitive() when freeing the aead structure. This change ensures that sensitive data is explicitly cleared before memory deallocation, aligning with the approach used in tipc_aead_init() and adhering to best practices for handling confidential information.
--- net/tipc/crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/crypto.c +1 -1
@@ -425,7 +425,7 @@ static void tipc_aead_free(struct rcu_head *rp) }free_percpu (aead->tfm_entry);kfree_sensitive (aead->key); -kfree (aead); +kfree_sensitive (aead); }static int tipc_aead_users (struct tipc_aead __rcu *aead)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/290 f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 70dd07c888451503c3e93b6821e10d1ea1ec9930 ]
.init_{,de}compress_ctx uses kvmalloc() to alloc memory, it will try to allocate physically continuous page first, it may cause more memory allocation pressure, let's use vmalloc instead to mitigate it.
[Test]
cd /data/local/tmp
touch filef2fs_io setflags compression filef2fs_io getflags file
for i in $(seq 1 10); do sync; echo 3 > /proc/sys/vm/drop_caches;\
time f2fs_io write 512 0 4096 zero osync file; truncate -s 0 file;\
done
[Result]
Before After Delta
21.243 21.694 -2.12%
For compression, we recommend to use ioctl to compress file data in background for workaround.
For decompression, only zstd will be affected.
--- fs/f2fs/compress.c | 23 ++++++++++------------- fs/f2fs/f2fs.h | 5 +++++ 2 files changed, 15 insertions(+), 13 deletions(-)
fs/f2fs/compress.c +10 -13
@@ -176,8 +176,7 @@ void f2fs_compress_ctx_add_page(struct compress_ctx *cc, struct page *page)#ifdef CONFIG_F2FS_FS_LZO static int lzo_init_compress_ctx (struct compress_ctx *cc) { - cc->private =f2fs_kvmalloc (F2FS_I_SB (cc->inode), -LZO1X_MEM_COMPRESS ,GFP_NOFS ); + cc->private =f2fs_vmalloc (LZO1X_MEM_COMPRESS );if (!cc->private)return -ENOMEM ;
@@ -187,7 +186,7 @@ static int lzo_init_compress_ctx(struct compress_ctx *cc)static void lzo_destroy_compress_ctx (struct compress_ctx *cc) { -kvfree (cc->private); +vfree (cc->private); cc->private =NULL ; }
@@ -244,7 +243,7 @@ static int lz4_init_compress_ctx(struct compress_ctx *cc) size =LZ4HC_MEM_COMPRESS ;#endif - cc->private =f2fs_kvmalloc (F2FS_I_SB (cc->inode), size,GFP_NOFS ); + cc->private =f2fs_vmalloc (size);if (!cc->private)return -ENOMEM ;
@@ -259,7 +258,7 @@ static int lz4_init_compress_ctx(struct compress_ctx *cc)static void lz4_destroy_compress_ctx (struct compress_ctx *cc) { -kvfree (cc->private); +vfree (cc->private); cc->private =NULL ; }
@@ -340,8 +339,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc) params =zstd_get_params (level, cc->rlen); workspace_size =zstd_cstream_workspace_bound (¶ms.cParams); - workspace =f2fs_kvmalloc (F2FS_I_SB (cc->inode), - workspace_size,GFP_NOFS ); + workspace =f2fs_vmalloc (workspace_size);if (!workspace)return -ENOMEM ;
@@ -349,7 +347,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc)if (!stream) {f2fs_err_ratelimited (F2FS_I_SB (cc->inode),"%s zstd_init_cstream failed" , __func__); -kvfree (workspace); +vfree (workspace);return -EIO ; }
@@ -362,7 +360,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc)static void zstd_destroy_compress_ctx (struct compress_ctx *cc) { -kvfree (cc->private); +vfree (cc->private); cc->private =NULL ; cc->private2 =NULL ; }
@@ -421,8 +419,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic) workspace_size =zstd_dstream_workspace_bound (max_window_size); - workspace =f2fs_kvmalloc (F2FS_I_SB (dic->inode), - workspace_size,GFP_NOFS ); + workspace =f2fs_vmalloc (workspace_size);if (!workspace)return -ENOMEM ;
@@ -430,7 +427,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic)if (!stream) {f2fs_err_ratelimited (F2FS_I_SB (dic->inode),"%s zstd_init_dstream failed" , __func__); -kvfree (workspace); +vfree (workspace);return -EIO ; }
@@ -442,7 +439,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic)static void zstd_destroy_decompress_ctx (struct decompress_io_ctx *dic) { -kvfree (dic->private); +vfree (dic->private); dic->private =NULL ; dic->private2 =NULL ; }
fs/f2fs/f2fs.h +5 -0
@@ -3449,6 +3449,11 @@ static inline void *f2fs_kvzalloc(struct f2fs_sb_info *sbi,return f2fs_kvmalloc (sbi, size, flags | __GFP_ZERO); } +static inline void *f2fs_vmalloc (size_t size) +{ +return vmalloc (size); +} +static inline int get_extra_isize (struct inode *inode) {return F2FS_I (inode)->i_extra_isize /sizeof (__le32);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/290 bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit d4965578267e2e81f67c86e2608481e77e9c8569 ]
bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpf_map_lookup_percpu_elem() will not be inlined. Using it in a sleepable bpf program will trigger the warning in bpf_map_lookup_percpu_elem(), because the bpf program only holds rcu_read_lock_trace lock. Therefore, add the missed check.
--- kernel/bpf/helpers.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/bpf/helpers.c +2 -1
@@ -128,7 +128,8 @@ const struct bpf_func_proto bpf_map_peek_elem_proto = { BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu) { -WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_bh_held ()); +WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_trace_held () && + !rcu_read_lock_bh_held ());return (unsigned long ) map->ops->map_lookup_percpu_elem (map, key, cpu); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/290 i2c: designware: Invoke runtime suspend on quick slave re-registration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tan En De <[email protected]>
[ Upstream commit 2fe2b969d911a09abcd6a47401a3c66c38a310e6 ]
Replaced pm_runtime_put() with pm_runtime_put_sync_suspend() to ensure the runtime suspend is invoked immediately when unregistering a slave. This prevents a race condition where suspend was skipped when unregistering and registering slave in quick succession.
For example, consider the rapid sequence ofdelete_device -> new_device -> delete_device -> new_device. In this sequence, it is observed that the dw_i2c_plat_runtime_suspend() might not be invoked after delete_device operation.
This is because after delete_device operation, when the pm_runtime_put() is about to trigger suspend, the following new_device operation might race and cancel the suspend.
If that happens, during the new_device operation, dw_i2c_plat_runtime_resume() is skipped (since there was no suspend), which means i_dev->init(), i.e. i2c_dw_init_slave(), is skipped. Since i2c_dw_init_slave() is skipped, i2c_dw_configure_fifo_slave() is skipped too, which leaves DW_IC_INTR_MASK unconfigured. If we inspect the interrupt mask register using devmem, it will show as zero.
Example shell script to reproduce the issue:
``` #!/bin/sh SLAVE_LADDR=0x1010 SLAVE_BUS=13 NEW_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/new_device DELETE_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/delete_device # Create initial device echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE sleep 2 # Rapid sequence of # delete_device -> new_device -> delete_device -> new_device echo $SLAVE_LADDR > $DELETE_DEVICE echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE echo $SLAVE_LADDR > $DELETE_DEVICE echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE # Using devmem to inspect IC_INTR_MASK will show as zero ```
--- drivers/i2c/busses/i2c-designware-slave.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-designware-slave.c +1 -1
@@ -91,7 +91,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave)i2c_dw_disable (dev);synchronize_irq (dev->irq); dev->slave =NULL ; -pm_runtime_put (dev->dev); +pm_runtime_put_sync_suspend (dev->dev);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/290 wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Lin <[email protected]>
[ Upstream commit 80fda1cd7b0a1edd0849dc71403a070d0922118d ]
IEEE 802.11 fragmentation can only be applied to unicast frames. Therefore, drop fragments with multicast or broadcast RA. This patch addresses vulnerabilities such as CVE-2020-26145.
--- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7996/mac.c +8 -0
@@ -650,6 +650,14 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb) status->last_amsdu = amsdu_info ==MT_RXD4_LAST_AMSDU_FRAME ; } +/* IEEE 802.11 fragmentation can only be applied to unicast frames. +* Hence, drop fragments with multicast/broadcast RA. +* This check fixes vulnerabilities, like CVE-2020-26145. +*/ +if ((ieee80211_has_morefrags (fc) || seq_ctrl &IEEE80211_SCTL_FRAG ) && +FIELD_GET (MT_RXD3_NORMAL_ADDR_TYPE , rxd3) !=MT_RXD3_NORMAL_U2M ) +return -EINVAL ; + hdr_gap = (u8 *)rxd - skb->data +2 * remove_pad;if (hdr_trans &&ieee80211_has_morefrags (fc)) {if (mt7996_reverse_frag0_hdr_trans (skb, hdr_gap))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/290 emulex/benet: correct command version selection in be_cmd_get_stats()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit edb888d29748cee674006a52e544925dacc7728e ]
Logic here always sets hdr->version to 2 if it is not a BE3 or Lancer chip, even if it is BE2. Use 'else if' to prevent multiple assignments, setting version 0 for BE2, version 1 for BE3 and Lancer, and version 2 for others. Fixes potential incorrect version setting when BE2_chip and BE3_chip/lancer_chip checks could both be true.
--- drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/emulex/benet/be_cmds.c +1 -1
@@ -1609,7 +1609,7 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd)/* version 1 of the cmd is not supported only by BE2 */ if (BE2_chip (adapter)) hdr->version =0 ; -if (BE3_chip (adapter) ||lancer_chip (adapter)) +else if (BE3_chip (adapter) ||lancer_chip (adapter)) hdr->version =1 ;else hdr->version =2 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/290 wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henk Vergonet <[email protected]>
[ Upstream commit 3c0e4f606d8693795a2c965d6f4987b1bfc31097 ]
Adds support for:
- LiteOn WN4516R
- LiteOn WN4519R
Both use:
- A nonstandard USB connector
- Mediatek chipset MT7600U
- ASIC revision: 76320044
Disabled VHT support on ASIC revision 76320044:
This fixes the 5G connectibity issue on LiteOn WN4519R module see https://github.com/openwrt/mt76/issues/971
And may also fix the 5G issues on the XBox One Wireless Adapter see https://github.com/openwrt/mt76/issues/200
I have looked at the FCC info related to the MT7632U chip as mentioned in here:
https://github.com/openwrt/mt76/issues/459
These confirm the chipset does not support 'ac' mode and hence VHT should be turned of.
--- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 2 ++ .../net/wireless/mediatek/mt76/mt76x2/usb_init.c | 13 ++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt76x2/usb.c +2 -0
@@ -17,6 +17,8 @@ static const struct usb_device_id mt76x2u_device_table[] = { { USB_DEVICE(0x057c, 0x8503) }, /* Avm FRITZ!WLAN AC860 */ { USB_DEVICE(0x7392, 0xb711) }, /* Edimax EW 7722 UAC */ { USB_DEVICE(0x0e8d, 0x7632) }, /* HC-M7662BU1 */ + { USB_DEVICE(0x0471, 0x2126) }, /* LiteOn WN4516R module, nonstandard USB connector */ + { USB_DEVICE(0x0471, 0x7600) }, /* LiteOn WN4519R module, nonstandard USB connector */ { USB_DEVICE(0x2c4e, 0x0103) }, /* Mercury UD13 */ { USB_DEVICE(0x0846, 0x9053) }, /* Netgear A6210 */ { USB_DEVICE(0x045e, 0x02e6) }, /* XBox One Wireless Adapter */
drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c +12 -1
@@ -191,6 +191,7 @@ int mt76x2u_register_device(struct mt76x02_dev *dev) {struct ieee80211_hw *hw =mt76_hw (dev);struct mt76_usb *usb = &dev->mt76.usb; +bool vht;int err;INIT_DELAYED_WORK (&dev->cal_work, mt76x2u_phy_calibrate);
@@ -217,7 +218,17 @@ int mt76x2u_register_device(struct mt76x02_dev *dev)/* check hw sg support in order to enable AMSDU */ hw->max_tx_fragments = dev->mt76.usb.sg_en ?MT_TX_SG_MAX_SIZE :1 ; - err =mt76_register_device (&dev->mt76, true, mt76x02_rates, +switch (dev->mt76.rev) { +case 0x76320044 : +/* these ASIC revisions do not support VHT */ + vht = false; +break ; +default : + vht = true; +break ; + } + + err =mt76_register_device (&dev->mt76, vht, mt76x02_rates,ARRAY_SIZE (mt76x02_rates));if (err) goto fail;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/290 wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Williams <[email protected]>
[ Upstream commit 7011faebe543f8f094fdb3281d0ec9e1eab81309 ]
This allows mt7922 in hostapd mode to transmit up to 1.4 Gbps.
--- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7921/main.c +5 -0
@@ -83,6 +83,11 @@ mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band, he_cap_elem->phy_cap_info[9 ] |=IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU ; + +if (is_mt7922 (phy->mt76->dev)) { + he_cap_elem->phy_cap_info[0 ] |= +IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G ; + }break ;case NL80211_IFTYPE_STATION : he_cap_elem->mac_cap_info[1] |=
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/290 sctp: Do not wake readers in __sctp_write_space()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Malat <[email protected]>
[ Upstream commit af295892a7abbf05a3c2ba7abc4d81bb448623d6 ]
Function __sctp_write_space() doesn't set poll key, which leads to ep_poll_callback() waking up all waiters, not only these waiting for the socket being writable. Set the key properly using wake_up_interruptible_poll(), which is preferred over the sync variant, as writers are not woken up before at least half of the queue is available. Also, TCP does the same.
--- net/sctp/socket.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/socket.c +2 -1
@@ -9094,7 +9094,8 @@ static void __sctp_write_space(struct sctp_association *asoc) wq =rcu_dereference (sk->sk_wq);if (wq) {if (waitqueue_active (&wq->wait)) -wake_up_interruptible (&wq->wait); +wake_up_interruptible_poll (&wq->wait,EPOLLOUT | +EPOLLWRNORM |EPOLLWRBAND );/* Note that we try to include the Async I/O support * here by modeling from the current TCP/UDP code.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 144/290 cpufreq: scmi: Skip SCMI devices that arent used by the CPUs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Tipton <[email protected]>
[ Upstream commit 6c9bb86922728c7a4cceb99f131e00dd87514f20 ]
Currently, all SCMI devices with performance domains attempt to register a cpufreq driver, even if their performance domains aren't used to control the CPUs. The cpufreq framework only supports registering a single driver, so only the first device will succeed. And if that device isn't used for the CPUs, then cpufreq will scale the wrong domains.
To avoid this, return early from scmi_cpufreq_probe() if the probing SCMI device isn't referenced by the CPU device phandles.
This keeps the existing assumption that all CPUs are controlled by a single SCMI device.
--- drivers/cpufreq/scmi-cpufreq.c | 36 +++++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-)
drivers/cpufreq/scmi-cpufreq.c +35 -1
@@ -299,6 +299,40 @@ static struct cpufreq_driver scmi_cpufreq_driver = { .register_em = scmi_cpufreq_register_em, }; +static bool scmi_dev_used_by_cpus (struct device *scmi_dev) +{ +struct device_node *scmi_np =dev_of_node (scmi_dev); +struct device_node *cpu_np, *np; +struct device *cpu_dev; +int cpu, idx; + +if (!scmi_np) +return false; + +for_each_possible_cpu (cpu) { + cpu_dev =get_cpu_device (cpu); +if (!cpu_dev) +continue ; + + cpu_np =dev_of_node (cpu_dev); + + np =of_parse_phandle (cpu_np,"clocks" ,0 ); +of_node_put (np); + +if (np == scmi_np) +return true; + + idx =of_property_match_string (cpu_np,"power-domain-names" ,"perf" ); + np =of_parse_phandle (cpu_np,"power-domains" , idx); +of_node_put (np); + +if (np == scmi_np) +return true; + } + +return false; +} +static int scmi_cpufreq_probe (struct scmi_device *sdev) {int ret;
@@ -307,7 +341,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev) handle = sdev->handle; -if (!handle) +if (!handle || !scmi_dev_used_by_cpus (dev))return -ENODEV ; perf_ops = handle->devm_protocol_get (sdev,SCMI_PROTOCOL_PERF , &ph);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 145/290 i2c: tegra: check msg length in SMBUS block read
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil R <[email protected]>
[ Upstream commit a6e04f05ce0b070ab39d5775580e65c7d943da0b ]
For SMBUS block read, do not continue to read if the message length passed from the device is '0' or greater than the maximum allowed bytes.
--- drivers/i2c/busses/i2c-tegra.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/i2c/busses/i2c-tegra.c +5 -0
@@ -1397,6 +1397,11 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], ret =tegra_i2c_xfer_msg (i2c_dev, &msgs[i],MSG_END_CONTINUE );if (ret)break ; + +/* Validate message length before proceeding */ +if (msgs[i].buf[0 ] ==0 || msgs[i].buf[0 ] >I2C_SMBUS_BLOCK_MAX ) +break ; +/* Set the msg length from first byte */ msgs[i].len += msgs[i].buf[0 ];dev_dbg (i2c_dev->dev,"reading %d bytes\n" , msgs[i].len);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 146/290 i2c: npcm: Add clock toggle recovery
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tali Perry <[email protected]>
[ Upstream commit 38010591a0fc3203f1cee45b01ab358b72dd9ab2 ]
During init of the bus, the module checks that the bus is idle. If one of the lines are stuck try to recover them first before failing. Sometimes SDA and SCL are low if improper reset occurs (e.g., reboot).
--- drivers/i2c/busses/i2c-npcm7xx.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-npcm7xx.c +8 -4
@@ -1971,10 +1971,14 @@ static int npcm_i2c_init_module(struct npcm_i2c *bus, enum i2c_mode mode,/* Check HW is OK: SDA and SCL should be high at this point. */ if ((npcm_i2c_get_SDA (&bus->adap) ==0 ) || (npcm_i2c_get_SCL (&bus->adap) ==0 )) { -dev_err (bus->dev,"I2C%d init fail: lines are low\n" , bus->num); -dev_err (bus->dev,"SDA=%d SCL=%d\n" ,npcm_i2c_get_SDA (&bus->adap), -npcm_i2c_get_SCL (&bus->adap)); -return -ENXIO ; +dev_warn (bus->dev," I2C%d SDA=%d SCL=%d, attempting to recover\n" , bus->num, +npcm_i2c_get_SDA (&bus->adap),npcm_i2c_get_SCL (&bus->adap)); +if (npcm_i2c_recovery_tgclk (&bus->adap)) { +dev_err (bus->dev,"I2C%d init fail: SDA=%d SCL=%d\n" , + bus->num,npcm_i2c_get_SDA (&bus->adap), +npcm_i2c_get_SCL (&bus->adap)); +return -ENXIO ; + } }npcm_i2c_int_enable (bus, true);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 147/290 net: dlink: add synchronization for stats update
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Yeounsu <[email protected]>
[ Upstream commit 12889ce926e9a9baf6b83d809ba316af539b89e2 ]
This patch synchronizes code that accesses from both user-space and IRQ contexts. The get_stats() function can be called from both context.
dev->stats.tx_errors and dev->stats.collisions are also updated in the tx_errors() function. Therefore, these fields must also be protected by synchronized.
There is no code that accessses dev->stats.tx_errors between the previous and updated lines, so the updating point can be moved.
--- drivers/net/ethernet/dlink/dl2k.c | 14 +++++++++++++- drivers/net/ethernet/dlink/dl2k.h | 2 ++ 2 files changed, 15 insertions(+), 1 deletion(-)
drivers/net/ethernet/dlink/dl2k.c +13 -1
@@ -146,6 +146,8 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent) np->ioaddr = ioaddr; np->chip_id = chip_idx; np->pdev = pdev; + +spin_lock_init (&np->stats_lock);spin_lock_init (&np->tx_lock);spin_lock_init (&np->rx_lock);
@@ -866,7 +868,6 @@ tx_error (struct net_device *dev, int tx_status) frame_id = (tx_status &0xffff0000 );printk (KERN_ERR "%s: Transmit error, TxStatus %4.4x, FrameId %d.\n" , dev->name, tx_status, frame_id); - dev->stats.tx_errors++;/* Ttransmit Underrun */ if (tx_status &0x10 ) { dev->stats.tx_fifo_errors++;
@@ -903,9 +904,15 @@ tx_error (struct net_device *dev, int tx_status)rio_set_led_mode (dev);/* Let TxStartThresh stay default value */ } + +spin_lock (&np->stats_lock);/* Maximum Collisions */ if (tx_status &0x08 ) dev->stats.collisions++; + + dev->stats.tx_errors++; +spin_unlock (&np->stats_lock); +/* Restart the Tx */ dw32 (MACCtrl,dr16 (MACCtrl) | TxEnable); }
@@ -1074,7 +1081,9 @@ get_stats (struct net_device *dev)int i;#endif unsigned int stat_reg; +unsigned long flags; +spin_lock_irqsave (&np->stats_lock, flags);/* All statistics registers need to be acknowledged, else statistic overflow could cause problems */
@@ -1124,6 +1133,9 @@ get_stats (struct net_device *dev)dr16 (TCPCheckSumErrors);dr16 (UDPCheckSumErrors);dr16 (IPCheckSumErrors); + +spin_unlock_irqrestore (&np->stats_lock, flags); +return &dev->stats; }
drivers/net/ethernet/dlink/dl2k.h +2 -0
@@ -372,6 +372,8 @@ struct netdev_private {struct pci_dev *pdev;void __iomem *ioaddr;void __iomem *eeprom_addr; +// To ensure synchronization when stats are updated. +spinlock_t stats_lock;spinlock_t tx_lock;spinlock_t rx_lock;unsigned int rx_buf_sz;/* Based on MTU+slack. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 148/290 wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Yang <[email protected]>
[ Upstream commit a69bbf89d751ba2d6da21d773c4e29c91c5e53c4 ]
Currently, HAL_RX_MSDU_PKT_LENGTH_GET uses u32_get_bits to obtain the MSDU length from the MSDU description.
This is not right. Because all halphy descriptions are little endian.
So use le32_get_bits for HAL_RX_MSDU_PKT_LENGTH_GET.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/hal_desc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/hal_desc.h +1 -1
@@ -683,7 +683,7 @@ enum hal_rx_msdu_desc_reo_dest_ind {#define RX_MSDU_DESC_INFO0_DECAP_FORMAT GENMASK(30, 29)#define HAL_RX_MSDU_PKT_LENGTH_GET (val) \ - (u32_get_bits((val), RX_MSDU_DESC_INFO0_MSDU_LENGTH)) + (le32_get_bits((val), RX_MSDU_DESC_INFO0_MSDU_LENGTH))struct rx_msdu_desc {__le32 info0;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 149/290 wifi: ath12k: fix a possible dead lock caused by ab->base_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit ef115c265a21e3c11deee7f73bd1061775a7bf20 ]
spin_lock/spin_unlock are used in ath12k_reg_chan_list_event to acquire/release ab->base_lock. For now this is safe because that function is only called in soft IRQ context.
But ath12k_reg_chan_list_event() will be called from process context in an upcoming patch, and this can result in a deadlock if ab->base_lock is acquired in process context and then soft IRQ occurs on the same CPU and tries to acquire that lock.
Fix it by using spin_lock_bh and spin_unlock_bh instead.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/wmi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath12k/wmi.c +2 -2
@@ -5503,7 +5503,7 @@ static int ath12k_reg_chan_list_event(struct ath12k_base *ab, struct sk_buff *sk goto fallback; } -spin_lock (&ab->base_lock); +spin_lock_bh (&ab->base_lock);if (test_bit (ATH12K_FLAG_REGISTERED , &ab->dev_flags)) {/* Once mac is registered, ar is valid and all CC events from * fw is considered to be received due to user requests
@@ -5527,7 +5527,7 @@ static int ath12k_reg_chan_list_event(struct ath12k_base *ab, struct sk_buff *sk ab->default_regd[pdev_idx] = regd; } ab->dfs_region = reg_info->dfs_region; -spin_unlock (&ab->base_lock); +spin_unlock_bh (&ab->base_lock); goto mem_free;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 150/290 wifi: ath11k: Fix QMI memory reuse logic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
[ Upstream commit cd2e7bae92bd7e65063ab8d04721d2b711ba4cbe ]
Firmware requests 2 segments at first. The first segment is of 6799360 whose allocation fails due to dma remapping not available. The success is returned to firmware. Then firmware asks for 22 smaller segments instead of 2 big ones. Those get allocated successfully. At suspend/ hibernation time, these segments aren't freed as they will be reused by firmware after resuming.
After resuming, the firmware asks for the 2 segments again with the first segment of 6799360 size. Since chunk->vaddr is not NULL, the type and size are compared with the previous type and size to know if it can be reused or not. Unfortunately, it is detected that it cannot be reused and this first smaller segment is freed. Then we continue to allocate 6799360 size memory which fails and ath11k_qmi_free_target_mem_chunk() is called which frees the second smaller segment as well. Later success is returned to firmware which asks for 22 smaller segments again. But as we had freed 2 segments already, we'll allocate the first 2 new smaller segments again and reuse the remaining 20. Hence 20 small segments are being reused instead of 22.
Add skip logic when vaddr is set, but size/type don't match. Use the same skip and success logic as used when dma_alloc_coherent() fails. By skipping, the possibility of resume failure due to kernel failing to allocate memory for QMI can be avoided.
kernel: ath11k_pci 0000:03:00.0: failed to allocate dma memory for qmi (524288 B type 1) ath11k_pci 0000:03:00.0: failed to allocate qmi target memory: -22
Tested-on: WCN6855 WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.6
--- drivers/net/wireless/ath/ath11k/qmi.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/wireless/ath/ath11k/qmi.c +9 -0
@@ -1989,6 +1989,15 @@ static int ath11k_qmi_alloc_target_mem_chunk(struct ath11k_base *ab) chunk->prev_size == chunk->size)continue ; +if (ab->qmi.mem_seg_count <=ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT ) { +ath11k_dbg (ab,ATH11K_DBG_QMI , +"size/type mismatch (current %d %u) (prev %d %u), try later with small size\n" , + chunk->size, chunk->type, + chunk->prev_size, chunk->prev_type); + ab->qmi.target_mem_delayed = true; +return 0 ; + } +/* cannot reuse the existing chunk */ dma_free_coherent (ab->dev, chunk->prev_size, chunk->vaddr, chunk->paddr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 151/290 wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dian-Syuan Yang <[email protected]>
[ Upstream commit d105652b33245162867ac769bea336976e67efb8 ]
Due to mac80211 triggering the hardware to enter idle mode, it fails to install WEP key causing connected station can't ping successfully. Currently, it forces the hardware to leave idle mode before driver adding WEP keys.
--- drivers/net/wireless/realtek/rtw89/cam.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/realtek/rtw89/cam.c +3 -0
@@ -6,6 +6,7 @@#include "debug.h" #include "fw.h" #include "mac.h" +#include "ps.h" static struct sk_buff * rtw89_cam_get_sec_key_cmd(struct rtw89_dev *rtwdev,
@@ -333,9 +334,11 @@ int rtw89_cam_sec_key_add(struct rtw89_dev *rtwdev,switch (key->cipher) {case WLAN_CIPHER_SUITE_WEP40 : +rtw89_leave_ips_by_hwflags (rtwdev); hw_key_type =RTW89_SEC_KEY_TYPE_WEP40 ;break ;case WLAN_CIPHER_SUITE_WEP104 : +rtw89_leave_ips_by_hwflags (rtwdev); hw_key_type =RTW89_SEC_KEY_TYPE_WEP104 ;break ;case WLAN_CIPHER_SUITE_CCMP :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 152/290 tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b879dcb1aeeca278eacaac0b1e2425b1c7599f9f ]
tcp_rcv_rtt_update() goal is to maintain an estimation of the RTT in tp->rcv_rtt_est.rtt_us, used by tcp_rcv_space_adjust()
When TCP TS are enabled, tcp_rcv_rtt_update() is using EWMA to smooth the samples.
Change this to immediately latch the incoming value if it is lower than tp->rcv_rtt_est.rtt_us, so that tcp_rcv_space_adjust() does not overshoot tp->rcvq_space.space and sk->sk_rcvbuf.
--- net/ipv4/tcp_input.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-)
net/ipv4/tcp_input.c +8 -14
@@ -671,10 +671,12 @@ EXPORT_SYMBOL(tcp_initialize_rcv_mss);*/ static void tcp_rcv_rtt_update (struct tcp_sock *tp,u32 sample,int win_dep) { -u32 new_sample = tp->rcv_rtt_est.rtt_us; -long m = sample; +u32 new_sample, old_sample = tp->rcv_rtt_est.rtt_us; +long m = sample <<3 ; -if (new_sample !=0 ) { +if (old_sample ==0 || m < old_sample) { + new_sample = m; + }else {/* If we sample in larger samples in the non-timestamp * case, we could grossly overestimate the RTT especially * with chatty applications or bulk transfer apps which
@@ -685,17 +687,9 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)* else with timestamps disabled convergence takes too * long. */ -if (!win_dep) { - m -= (new_sample >>3 ); - new_sample += m; - }else { - m <<=3 ; -if (m < new_sample) - new_sample = m; - } - }else { -/* No previous measure. */ - new_sample = m <<3 ; +if (win_dep) +return ; + new_sample = old_sample - (old_sample >>3 ) + sample; } tp->rcv_rtt_est.rtt_us = new_sample;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 153/290 tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cd171461b90a2d2cf230943df60d580174633718 ]
tcp_rcv_state_process() must tweak tp->advmss for TS enabled flows before the call to tcp_init_transfer() / tcp_init_buffer_space().
Otherwise tp->rcvq_space.space is off by 120 bytes (TCP_INIT_CWND * TCPOLEN_TSTAMP_ALIGNED).
--- net/ipv4/tcp_input.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv4/tcp_input.c +3 -3
@@ -6699,6 +6699,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)if (!tp->srtt_us)tcp_synack_rtt_meas (sk, req); +if (tp->rx_opt.tstamp_ok) + tp->advmss -=TCPOLEN_TSTAMP_ALIGNED ; +if (req) {tcp_rcv_synrecv_state_fastopen (sk); }else {
@@ -6723,9 +6726,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) tp->snd_wnd =ntohs (th->window) << tp->rx_opt.snd_wscale;tcp_init_wl (tp,TCP_SKB_CB (skb)->seq); -if (tp->rx_opt.tstamp_ok) - tp->advmss -=TCPOLEN_TSTAMP_ALIGNED ; -if (!inet_csk (sk)->icsk_ca_ops->cong_control)tcp_update_pacing_rate (sk);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 154/290 x86/sgx: Prevent attempts to reclaim poisoned pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Zaborowski <[email protected]>
[ Upstream commit ed16618c380c32c68c06186d0ccbb0d5e0586e59 ]
TL;DR: SGX page reclaim touches the page to copy its contents to secondary storage. SGX instructions do not gracefully handle machine checks. Despite this, the existing SGX code will try to reclaim pages that it _knows_ are poisoned. Avoid even trying to reclaim poisoned pages.
The longer story:
Pages used by an enclave only get epc_page->poison set in arch_memory_failure() but they currently stay on sgx_active_page_list until sgx_encl_release(), with the SGX_EPC_PAGE_RECLAIMER_TRACKED flag untouched.
epc_page->poison is not checked in the reclaimer logic meaning that, if other conditions are met, an attempt will be made to reclaim an EPC page that was poisoned. This is bad because 1. we don't want that page to end up added to another enclave and 2. it is likely to cause one core to shut down and the kernel to panic.
Specifically, reclaiming uses microcode operations including "EWB" which accesses the EPC page contents to encrypt and write them out to non-SGX memory. Those operations cannot handle MCEs in their accesses other than by putting the executing core into a special shutdown state (affecting both threads with HT.) The kernel will subsequently panic on the remaining cores seeing the core didn't enter MCE handler(s) in time.
Call sgx_unmark_page_reclaimable() to remove the affected EPC page from sgx_active_page_list on memory error to stop it being considered for reclaiming.
Testing epc_page->poison in sgx_reclaim_pages() would also work but I assume it's better to add code in the less likely paths.
The affected EPC page is not added to &node->sgx_poison_page_list until later in sgx_encl_release()->sgx_free_epc_page() when it is EREMOVEd. Membership on other lists doesn't change to avoid changing any of the lists' semantics except for sgx_active_page_list. There's a "TBD" comment in arch_memory_failure() about pre-emptive actions, the goal here is not to address everything that it may imply.
This also doesn't completely close the time window when a memory error notification will be fatal (for a not previously poisoned EPC page) -- the MCE can happen after sgx_reclaim_pages() has selected its candidates or even *inside* a microcode operation (actually easy to trigger due to the amount of time spent in them.)
The spinlock in sgx_unmark_page_reclaimable() is safe because memory_failure() runs in process context and no spinlocks are held, explicitly noted in a mm/memory-failure.c comment.
--- arch/x86/kernel/cpu/sgx/main.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kernel/cpu/sgx/main.c +2 -0
@@ -718,6 +718,8 @@ int arch_memory_failure(unsigned long pfn, int flags) goto out; } +sgx_unmark_page_reclaimable (page); +/* * TBD: Add additional plumbing to enable pre-emptive * action for asynchronous poison notification. Until
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 155/290 ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 1c0829788a6e6e165846b9bedd0b908ef16260b6 ]
The statistics are incremented with raw_cpu_inc() assuming it always happens with bottom half disabled. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this is no longer true.
Use this_cpu_inc() on PREEMPT_RT for the increment to not worry about preemption.
--- net/ipv4/route.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv4/route.c +4 -0
@@ -192,7 +192,11 @@ const __u8 ip_tos2prio[16] = {EXPORT_SYMBOL (ip_tos2prio); static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat); +#ifndef CONFIG_PREEMPT_RT #define RT_CACHE_STAT_INC (field) raw_cpu_inc(rt_cache_stat.field) +#else +#define RT_CACHE_STAT_INC (field) this_cpu_inc(rt_cache_stat.field) +#endif #ifdef CONFIG_PROC_FS static void *rt_cache_seq_start (struct seq_file *seq,loff_t *pos)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 156/290 net: atlantic: generate software timestamp just before the doorbell
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 285ad7477559b6b5ceed10ba7ecfed9d17c0e7c6 ]
Make sure the call of skb_tx_timestamp is as close as possible to the doorbell.
--- drivers/net/ethernet/aquantia/atlantic/aq_main.c | 1 - drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/aquantia/atlantic/aq_main.c +0 -1
@@ -123,7 +123,6 @@ static netdev_tx_t aq_ndev_start_xmit(struct sk_buff *skb, struct net_device *nd }#endif -skb_tx_timestamp (skb);return aq_nic_xmit (aq_nic, skb); }
drivers/net/ethernet/aquantia/atlantic/aq_nic.c +2 -0
@@ -898,6 +898,8 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb) frags =aq_nic_map_skb (self, skb, ring); +skb_tx_timestamp (skb); +if (likely (frags)) { err = self->aq_hw_ops->hw_ring_tx_xmit (self->aq_hw, ring, frags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 157/290 pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit 4229c28323db141eda69cb99427be75d3edba071 ]
The regmap_update_bits() function can fail, so propagate its error up to the stack instead of silently ignoring that.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +1 -3
@@ -358,9 +358,7 @@ static int armada_37xx_pmx_set_by_name(struct pinctrl_dev *pctldev, val = grp->val[func]; -regmap_update_bits (info->regmap, reg, mask, val); - -return 0 ; +return regmap_update_bits (info->regmap, reg, mask, val); } static int armada_37xx_pmx_set(struct pinctrl_dev *pctldev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 158/290 pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit 6481c0a83367b0672951ccc876fbae7ee37b594b ]
The regmap_read() function can fail, so propagate its error up to the stack instead of silently ignoring that.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +4 -1
@@ -400,10 +400,13 @@ static int armada_37xx_gpio_get_direction(struct gpio_chip *chip,struct armada_37xx_pinctrl *info =gpiochip_get_data (chip);unsigned int reg =OUTPUT_EN ;unsigned int val, mask; +int ret;armada_37xx_update_reg (®, &offset); mask =BIT (offset); -regmap_read (info->regmap, reg, &val); + ret =regmap_read (info->regmap, reg, &val); +if (ret) +return ret;if (val & mask)return GPIO_LINE_DIRECTION_OUT ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 159/290 pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit bfa0ff804ffa8b1246ade8be08de98c9eb19d16f ]
The armada_37xx_gpio_direction_{in,out}put() functions can fail, so propagate their error values back to the stack instead of silently ignoring those.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +4 -3
@@ -472,16 +472,17 @@ static int armada_37xx_pmx_gpio_set_direction(struct pinctrl_dev *pctldev, {struct armada_37xx_pinctrl *info =pinctrl_dev_get_drvdata (pctldev);struct gpio_chip *chip = range->gc; +int ret;dev_dbg (info->dev,"gpio_direction for pin %u as %s-%d to %s\n" , offset, range->name, offset, input ?"input" :"output" );if (input) -armada_37xx_gpio_direction_input (chip, offset); + ret =armada_37xx_gpio_direction_input (chip, offset);else -armada_37xx_gpio_direction_output (chip, offset,0 ); + ret =armada_37xx_gpio_direction_output (chip, offset,0 ); -return 0 ; +return ret; } static int armada_37xx_gpio_request_enable(struct pinctrl_dev *pctldev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 160/290 pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit 57273ff8bb16f3842c2597b5bbcd49e7fa12edf7 ]
The regmap_read() function can fail, so propagate its error up to the stack instead of silently ignoring that.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +4 -1
@@ -443,11 +443,14 @@ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset)struct armada_37xx_pinctrl *info =gpiochip_get_data (chip);unsigned int reg =INPUT_VAL ;unsigned int val, mask; +int ret;armada_37xx_update_reg (®, &offset); mask =BIT (offset); -regmap_read (info->regmap, reg, &val); + ret =regmap_read (info->regmap, reg, &val); +if (ret) +return ret;return (val & mask) !=0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 161/290 net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit b86bcfee30576b752302c55693fff97242b35dfd ]
As mlx4 has implemented skb_tx_timestamp() in mlx4_en_xmit(), the SOFTWARE flag is surely needed when users are trying to get timestamp information.
--- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +1 -0
@@ -1916,6 +1916,7 @@ static int mlx4_en_get_ts_info(struct net_device *dev,if (mdev->dev->caps.flags2 &MLX4_DEV_CAP_FLAG2_TS ) { info->so_timestamping |=SOF_TIMESTAMPING_TX_HARDWARE | +SOF_TIMESTAMPING_TX_SOFTWARE |SOF_TIMESTAMPING_RX_HARDWARE |SOF_TIMESTAMPING_RAW_HARDWARE ;
Signature · 1 line
2.39.5