5.15.186-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.15.186-rc1 review
This is the start of the stable review cycle for the 5.15.186 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.186-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.186-rc1
Vitaliy Shevtsov <[email protected]>
scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
Tengda Wu <[email protected]>
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
Peter Zijlstra <[email protected]>
perf: Fix sample vs do_exit()
Heiko Carstens <[email protected]>
s390/pci: Fix __pcilg_mio_inuser() inline assembly
Paul Chaignon <[email protected]>
bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
Paul Chaignon <[email protected]>
net: Fix checksum update for ILA adj-transport
Jan Kara <[email protected]>
ext4: avoid remount errors with 'abort' mount option
Jan Kara <[email protected]>
ext4: make 'abort' mount option handling standard
Gavin Guo <[email protected]>
mm/huge_memory: fix dereferencing invalid pmd migration entry
Eric Dumazet <[email protected]>
net_sched: sch_sfq: reject invalid perturb period
Octavian Purdila <[email protected]>
net_sched: sch_sfq: move the limit validation
Octavian Purdila <[email protected]>
net_sched: sch_sfq: use a temporary work area for validating configuration
Octavian Purdila <[email protected]>
net_sched: sch_sfq: don't allow 1 packet limit
Eric Dumazet <[email protected]>
net_sched: sch_sfq: handle bigger packets
Eric Dumazet <[email protected]>
net_sched: sch_sfq: annotate data-races around q->perturb_period
James Morse <[email protected]>
arm64: proton-pack: Add new CPUs 'k' values for branch mitigation
James Morse <[email protected]>
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
James Morse <[email protected]>
arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
Liu Song <[email protected]>
arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually
James Morse <[email protected]>
arm64: proton-pack: Expose whether the branchy loop k value
James Morse <[email protected]>
arm64: proton-pack: Expose whether the platform is mitigated by firmware
James Morse <[email protected]>
arm64: insn: Add support for encoding DSB
Hou Tao <[email protected]>
arm64: insn: add encoders for atomic operations
Hou Tao <[email protected]>
arm64: move AARCH64_BREAK_FAULT into insn-def.h
Jon Hunter <[email protected]>
Revert "cpufreq: tegra186: Share policy per cluster"
Claudiu Beznea <[email protected]>
serial: sh-sci: Increment the runtime usage counter for the earlycon device
Geert Uytterhoeven <[email protected]>
ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
Colin Foster <[email protected]>
ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
Shengyu Qu <[email protected]>
ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
Eric Dumazet <[email protected]>
net: atm: fix /proc/net/atm/lec handling
Eric Dumazet <[email protected]>
net: atm: add lec_mutex
Kuniyuki Iwashima <[email protected]>
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
Haixia Qu <[email protected]>
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
Neal Cardwell <[email protected]>
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
Kuniyuki Iwashima <[email protected]>
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
Kuniyuki Iwashima <[email protected]>
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
Dmitry Antipov <[email protected]>
wifi: carl9170: do not ping device which has failed to load firmware
Vladimir Oltean <[email protected]>
ptp: fix breakage after ptp_vclock_in_use() rework
Krishna Kumar <[email protected]>
net: ice: Perform accurate aRFS flow match
Justin Sanders <[email protected]>
aoe: clean device rq_list in aoedev_downdev()
Simon Horman <[email protected]>
pldmfw: Select CRC32 when PLDMFW is selected
Arnd Bergmann <[email protected]>
hwmon: (occ) fix unaligned accesses
Arnd Bergmann <[email protected]>
hwmon: (occ) Rework attribute registration for stack usage
Eddie James <[email protected]>
hwmon: (occ) Add soft minimum power cap attribute
Jacob Keller <[email protected]>
drm/nouveau/bl: increase buffer size to avoid truncate warning
Krzysztof Kozlowski <[email protected]>
drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
Gao Xiang <[email protected]>
erofs: remove unused trace event erofs_destroy_inode
Jann Horn <[email protected]>
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
Liu Shixin <[email protected]>
mm: hugetlb: independent PMD page table shared count
Jann Horn <[email protected]>
mm/hugetlb: unshare page tables during VMA split, not before
Sean Nyekjaer <[email protected]>
iio: accel: fxls8962af: Fix temperature calculation
Jonathan Lane <[email protected]>
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
Takashi Iwai <[email protected]>
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
wangdicheng <[email protected]>
ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
WangYuli <[email protected]>
Input: sparcspkr - avoid unannotated fall-through
Christoph Hellwig <[email protected]>
block: default BLOCK_LEGACY_AUTOLOAD to y
Terry Junge <[email protected]>
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
Kuniyuki Iwashima <[email protected]>
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
Stephen Smalley <[email protected]>
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
Xin Li (Intel) <[email protected]>
selftests/x86: Add a test to detect infinite SIGTRAP handler loop
Marek Szyprowski <[email protected]>
udmabuf: use sgtable-based scatterlist wrappers
Peter Oberparleiter <[email protected]>
scsi: s390: zfcp: Ensure synchronous unit_add
Dexuan Cui <[email protected]>
scsi: storvsc: Increase the timeouts to storvsc_timeout
Fedor Pchelkin <[email protected]>
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
Artem Sadovnikov <[email protected]>
jffs2: check that raw node were preallocated before writing summary
Andrew Morton <[email protected]>
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
Breno Leitao <[email protected]>
Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
Narayana Murty N <[email protected]>
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
Stuart Hayes <[email protected]>
platform/x86: dell_rbu: Stop overwriting data buffer
Stuart Hayes <[email protected]>
platform/x86: dell_rbu: Fix list usage
Alexander Sverdlin <[email protected]>
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
Jann Horn <[email protected]>
tee: Prevent size calculation wraparound on 32-bit kernels
Sukrut Bellary <[email protected]>
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
Laurentiu Tudor <[email protected]>
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
Marcus Folkesson <[email protected]>
watchdog: da9052_wdt: respect TWDMIN
Wentao Liang <[email protected]>
octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
Jiayuan Chen <[email protected]>
bpf, sockmap: Fix data lost during EAGAIN retries
Kyungwook Boo <[email protected]>
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
Zijun Hu <[email protected]>
sock: Correct error checking condition for (assign|release)_proto_idx()
Daniel Wagner <[email protected]>
scsi: lpfc: Use memcpy() for BIOS version
Mike Looijmans <[email protected]>
pinctrl: mcp23s08: Reset all pins to input at probe
Zijun Hu <[email protected]>
software node: Correct a OOB check in software_node_get_reference_args()
Ido Schimmel <[email protected]>
vxlan: Do not treat dst cache initialization errors as fatal
Yong Wang <[email protected]>
net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
Sean Christopherson <[email protected]>
iommu/amd: Ensure GA log notifier callbacks finish running before module unload
Justin Tee <[email protected]>
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
Alan Maguire <[email protected]>
libbpf: Add identical pointer detection to btf_dedup_is_equiv()
Heiko Stuebner <[email protected]>
clk: rockchip: rk3036: mark ddrphy as critical
Benjamin Berg <[email protected]>
wifi: mac80211: do not offer a mesh path if forwarding is disabled
Jason Xing <[email protected]>
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
Jason Xing <[email protected]>
net: atlantic: generate software timestamp just before the doorbell
Sebastian Andrzej Siewior <[email protected]>
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
Eric Dumazet <[email protected]>
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
Eric Dumazet <[email protected]>
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
Moon Yeounsu <[email protected]>
net: dlink: add synchronization for stats update
Tali Perry <[email protected]>
i2c: npcm: Add clock toggle recovery
Mike Tipton <[email protected]>
cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
Petr Malat <[email protected]>
sctp: Do not wake readers in __sctp_write_space()
Henk Vergonet <[email protected]>
wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
Alok Tiwari <[email protected]>
emulex/benet: correct command version selection in be_cmd_get_stats()
Tan En De <[email protected]>
i2c: designware: Invoke runtime suspend on quick slave re-registration
Zilin Guan <[email protected]>
tipc: use kfree_sensitive() for aead cleanup
Sergio Perez Gonzalez <[email protected]>
net: macb: Check return value of dma_set_mask_and_coherent()
Viresh Kumar <[email protected]>
cpufreq: Force sync policy boost with global boost on sysfs update
George Moussalem <[email protected]>
thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+
Sukrut Bellary <[email protected]>
pmdomain: ti: Fix STANDBY handling of PER power domain
Simon Schuster <[email protected]>
nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
Shravan Chippa <[email protected]>
media: i2c: imx334: update mode_3840x2160_regs array
Wentao Liang <[email protected]>
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
Hans Verkuil <[email protected]>
media: tc358743: ignore video while HPD is low
Amber Lin <[email protected]>
drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: don't select single flush for active CTL blocks
Dylan Wolff <[email protected]>
jfs: Fix null-ptr-deref in jfs_ioc_trim
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: fix CSIB handling
Alex Deucher <[email protected]>
drm/amdgpu/gfx8: fix CSIB handling
Zhang Yi <[email protected]>
ext4: prevent stale extent cache entries caused by concurrent get es_cache
Long Li <[email protected]>
sunrpc: fix race in cache cleanup causing stale nextcheck time
Nicolas Dufresne <[email protected]>
media: rkvdec: Initialize the m2m context before the controls
Tomi Valkeinen <[email protected]>
media: ti: cal: Fix wrong goto on error path
Aditya Dutt <[email protected]>
jfs: fix array-index-out-of-bounds read in add_missing_indices
Zhang Yi <[email protected]>
ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space()
Alex Deucher <[email protected]>
drm/amdgpu/gfx7: fix CSIB handling
Nas Chung <[email protected]>
media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition
Sakari Ailus <[email protected]>
media: ccs-pll: Better validate VT PLL branch
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: fix CSIB handling
Tarang Raval <[email protected]>
media: i2c: imx334: Fix runtime PM handling in remove function
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Increase HFI response timeout
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
Nas Chung <[email protected]>
media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
Dmitry Baryshkov <[email protected]>
drm/msm/hdmi: add runtime PM calls to DDC transfer function
Tarang Raval <[email protected]>
media: i2c: imx334: Enable runtime PM before sub-device registration
Ayushi Makhija <[email protected]>
drm/bridge: anx7625: change the gpiod_set_value API
Namjae Jeon <[email protected]>
exfat: fix double free in delayed_free
Damon Ding <[email protected]>
drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
Long Li <[email protected]>
sunrpc: update nextcheck time when adding new cache entries
Alex Deucher <[email protected]>
drm/amdgpu/gfx6: fix CSIB handling
Peter Marheine <[email protected]>
ACPI: battery: negate current when discharging
Charan Teja Kalla <[email protected]>
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
Yuanjun Gong <[email protected]>
ASoC: tegra210_ahub: Add check to of_device_get_match_data()
gldrk <[email protected]>
ACPICA: utilities: Fix overflow check in vsnprintf()
Jerry Lv <[email protected]>
power: supply: bq27xxx: Retrieve again when busy
Seunghun Han <[email protected]>
ACPICA: fix acpi parse and parseext cache leaks
Armin Wolf <[email protected]>
ACPI: bus: Bail out if acpi_kobj registration fails
Hector Martin <[email protected]>
ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
Ahmed Salem <[email protected]>
ACPICA: Avoid sequence overread in call to strncmp()
Guilherme G. Piccoli <[email protected]>
clocksource: Fix the CPUs' choice in the watchdog per CPU verification
Seunghun Han <[email protected]>
ACPICA: fix acpi operand cache leak in dswstate.c
David Lechner <[email protected]>
iio: adc: ad7606_spi: fix reg write value mask
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Fix temperature calculation
Sean Nyekjaer <[email protected]>
iio: accel: fxls8962af: Fix temperature scan element sign
Diederik de Haas <[email protected]>
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
Ilpo Järvinen <[email protected]>
PCI: Fix lock symmetry in pci_slot_unlock()
Huacai Chen <[email protected]>
PCI: Add ACS quirk for Loongson PCIe
Niklas Cassel <[email protected]>
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
Long Li <[email protected]>
uio_hv_generic: Use correct size for interrupt and monitor pages
Xiaolei Wang <[email protected]>
remoteproc: core: Release rproc->clean_table after rproc_attach() fails
Xiaolei Wang <[email protected]>
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
Wentao Liang <[email protected]>
regulator: max14577: Add error check for max14577_read_reg()
Khem Raj <[email protected]>
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
Gabriel Shahrouzi <[email protected]>
staging: iio: ad5933: Correct settling cycles encoding per datasheet
Qasim Ijaz <[email protected]>
net: ch9200: fix uninitialised access during mii_nway_restart
Ye Bin <[email protected]>
ftrace: Fix UAF when lookup kallsym after ftrace disabled
Mikulas Patocka <[email protected]>
dm-mirror: fix a tiny race condition
Wentao Liang <[email protected]>
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
Wentao Liang <[email protected]>
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
Jinliang Zheng <[email protected]>
mm: fix ratelimit_pages update error in dirty_ratio_handler()
Shin'ichiro Kawasaki <[email protected]>
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
Jeongjun Park <[email protected]>
ipc: fix to protect IPCS lookups using RCU
Da Xue <[email protected]>
clk: meson-g12a: add missing fclk_div2 to spicc
Arnd Bergmann <[email protected]>
parisc: fix building with gcc-15
GONG Ruiqi <[email protected]>
vgacon: Add check for vc_origin address range in vgacon_scroll()
Murad Masimov <[email protected]>
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
Niravkumar L Rabara <[email protected]>
EDAC/altera: Use correct write width with the INTTEST register
Krzysztof Kozlowski <[email protected]>
NFC: nci: uart: Set tty->disc_data only in success path
Chao Yu <[email protected]>
f2fs: fix to do sanity check on sit_bitmap_size
Jaegeuk Kim <[email protected]>
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
Dan Carpenter <[email protected]>
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Zhang Yi <[email protected]>
ext4: ensure i_size is smaller than maxbytes
Zhang Yi <[email protected]>
ext4: factor out ext4_get_maxbytes()
Jan Kara <[email protected]>
ext4: fix calculation of credits for extent tree modification
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: inline: fix len overflow in ext4_prepare_inline_data
Wan Junjie <[email protected]>
bus: fsl-mc: fix GET/SET_TAILDROP command ids
Ioana Ciornei <[email protected]>
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
Tasos Sahanidis <[email protected]>
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
Brett Werling <[email protected]>
can: tcan4x5x: fix power regulator retrieval during probe
Jeff Hugo <[email protected]>
bus: mhi: host: Fix conflict between power_up and SYSERR
Andreas Kemnade <[email protected]>
ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
Ross Stutterheim <[email protected]>
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix deferred probing error
Ricardo Ribalda <[email protected]>
media: uvcvideo: Send control events for partial succeeds
Ricardo Ribalda <[email protected]>
media: uvcvideo: Return the number of processed controls
Denis Arefev <[email protected]>
media: vivid: Change the siize of the composing
Edward Adam Davis <[email protected]>
media: vidtv: Terminating the subsequent process of initialization failure
Marek Szyprowski <[email protected]>
media: videobuf2: use sgtable-based scatterlist wrappers
Loic Poulain <[email protected]>
media: venus: Fix probe error handling
Ma Ke <[email protected]>
media: v4l2-dev: fix error handling in __video_register_device()
Wentao Liang <[email protected]>
media: gspca: Add error handling for stv06xx_read_sensor()
Edward Adam Davis <[email protected]>
media: cxusb: no longer judge rbuf when the write fails
Sakari Ailus <[email protected]>
media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
Sakari Ailus <[email protected]>
media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
Sakari Ailus <[email protected]>
media: ccs-pll: Start OP pre-PLL multiplier search from correct value
Sakari Ailus <[email protected]>
media: ccs-pll: Start VT pre-PLL multiplier search from correct value
Johan Hovold <[email protected]>
media: ov8856: suppress probe deferral errors
Mingcong Bai <[email protected]>
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
Jeongjun Park <[email protected]>
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
Li Lingfeng <[email protected]>
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
NeilBrown <[email protected]>
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
Christian Lamparter <[email protected]>
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
Wentao Liang <[email protected]>
net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
Wentao Liang <[email protected]>
net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
Gautam Menghani <[email protected]>
powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
Martin Blumenstingl <[email protected]>
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
Wentao Liang <[email protected]>
ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
Alexander Aring <[email protected]>
gfs2: move msleep to sleepable context
Herbert Xu <[email protected]>
crypto: marvell/cesa - Do not chain submitted requests
Zijun Hu <[email protected]>
configfs: Do not override creating attribute file failure in populate_attrs()
Darrick J. Wong <[email protected]>
xfs: allow inode inactivation during a ro mount log recovery
Arnd Bergmann <[email protected]>
kbuild: hdrcheck: fix cross build with clang
Thomas Weißschuh <[email protected]>
kbuild: userprogs: fix bitsize and target detection on clang
I Hsin Cheng <[email protected]>
drm/meson: Use 1000ULL when operating with mode->clock
Oliver Neukum <[email protected]>
net: usb: aqc111: debug info before sanitation
Eric Dumazet <[email protected]>
calipso: unlock rcu before returning -EAFNOSUPPORT
Thomas Gleixner <[email protected]>
x86/iopl: Cure TIF_IO_BITMAP inconsistencies
Stefano Stabellini <[email protected]>
xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
Amit Sunil Dhamne <[email protected]>
usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
Mathias Nyman <[email protected]>
usb: Flush altsetting 0 endpoints before reinitializating them after reset.
Pawel Laszczak <[email protected]>
usb: cdnsp: Fix issue with detecting USB 3.2 speed
Pawel Laszczak <[email protected]>
usb: cdnsp: Fix issue with detecting command completion event
Wupeng Ma <[email protected]>
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
Dave Penkler <[email protected]>
usb: usbtmc: Fix read_stb function and get_stb ioctl
Nathan Chancellor <[email protected]>
drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang
Nathan Chancellor <[email protected]>
kbuild: Add KBUILD_CPPFLAGS to as-option invocation
Masahiro Yamada <[email protected]>
kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
Nathan Chancellor <[email protected]>
kbuild: Add CLANG_FLAGS to as-instr
Nathan Chancellor <[email protected]>
mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
Nathan Chancellor <[email protected]>
drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang
Nick Desaulniers <[email protected]>
kbuild: Update assembler calls to use proper flags and language target
Nathan Chancellor <[email protected]>
MIPS: Prefer cc-option for additions to cflags
Nathan Chancellor <[email protected]>
MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option
Nick Desaulniers <[email protected]>
x86/boot/compressed: prefer cc-option for CFLAGS additions
Oleg Nesterov <[email protected]>
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
David Heimann <[email protected]>
ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
Peter Zijlstra <[email protected]>
perf: Ensure bpf_perf_link path is properly serialized
Daniel Wagner <[email protected]>
nvmet-fcloop: access fcpreq only when holding reqlock
Zijun Hu <[email protected]>
fs/filesystems: Fix potential unsigned integer underflow in fs_name()
Eric Dumazet <[email protected]>
net_sched: ets: fix a race in ets_qdisc_change()
Cong Wang <[email protected]>
sch_ets: make est_qlen_notify() idempotent
Eric Dumazet <[email protected]>
net_sched: tbf: fix a race in tbf_change()
Eric Dumazet <[email protected]>
net_sched: red: fix a race in __red_change()
Eric Dumazet <[email protected]>
net_sched: prio: fix a race in prio_tune()
Patrisious Haddad <[email protected]>
net/mlx5: Fix return value when searching for existing flow group
Moshe Shemesh <[email protected]>
net/mlx5: Ensure fw pages are always allocated on same NUMA
Jakub Raczynski <[email protected]>
net/mdiobus: Fix potential out-of-bounds read/write access
Andrew Lunn <[email protected]>
net: mdio: C22 is now optional, EOPNOTSUPP if not provided
Carlos Fernandez <[email protected]>
macsec: MACsec SCI assignment for ES = 0
Michal Luczaj <[email protected]>
net: Fix TOCTOU issue in sk_is_readable()
Robert Malz <[email protected]>
i40e: retry VFLR handling if there is ongoing VF reset
Robert Malz <[email protected]>
i40e: return false from i40e_reset_vf if reset is in progress
Martin Blumenstingl <[email protected]>
drm/meson: fix more rounding issues with 59.94Hz modes
Martin Blumenstingl <[email protected]>
drm/meson: use vclk_freq instead of pixel_freq in debug print
Martin Blumenstingl <[email protected]>
drm/meson: fix debug log statement when setting the HDMI clocks
Martin Blumenstingl <[email protected]>
drm/meson: use unsigned long long / Hz for frequency types
Haren Myneni <[email protected]>
powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
Ritesh Harjani (IBM) <[email protected]>
powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
Eric Dumazet <[email protected]>
net_sched: sch_sfq: fix a potential crash on gso_skb handling
Alok Tiwari <[email protected]>
scsi: iscsi: Fix incorrect error path labels for flashnode operations
Caleb Connolly <[email protected]>
ath10k: snoc: fix unbalanced IRQ enable in crash recovery
Jeongjun Park <[email protected]>
ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
Sanjeev Yadav <[email protected]>
scsi: core: ufs: Fix a hang in the error handler
Claudiu Beznea <[email protected]>
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Claudiu Beznea <[email protected]>
serial: sh-sci: Move runtime PM enable to sci_probe_single()
Claudiu Beznea <[email protected]>
serial: sh-sci: Check if TX data was written to device in .tx_empty()
Judith Mendez <[email protected]>
arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0
Judith Mendez <[email protected]>
arm64: dts: ti: k3-am65-main: Fix sdhci node properties
Nishanth Menon <[email protected]>
arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi - fix crash with unsupported versions of F34
zhang songyi <[email protected]>
Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
Dan Carpenter <[email protected]>
pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
Al Viro <[email protected]>
do_change_type(): refuse to operate on unmounted/not ours mounts
Al Viro <[email protected]>
fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
Ido Schimmel <[email protected]>
seg6: Fix validation of nexthop addresses
Mirco Barone <[email protected]>
wireguard: device: enable threaded NAPI
Florian Westphal <[email protected]>
netfilter: nf_set_pipapo_avx2: fix initial map fill
Alok Tiwari <[email protected]>
gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
Rafael J. Wysocki <[email protected]>
PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
Ronak Doshi <[email protected]>
vmxnet3: correctly report gso type for UDP tunnels
Álvaro Fernández Rojas <[email protected]>
net: dsa: tag_brcm: legacy: fix pskb_may_pull length
Michal Kubiak <[email protected]>
ice: create new Tx scheduler nodes for new queues only
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
Álvaro Fernández Rojas <[email protected]>
spi: bcm63xx-hsspi: fix shared reset
Álvaro Fernández Rojas <[email protected]>
spi: bcm63xx-spi: fix shared reset
Dan Carpenter <[email protected]>
net/mlx4_en: Prevent potential integer overflow calculating Hz
Yanqing Wang <[email protected]>
driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
Charalampos Mitrodimas <[email protected]>
net: tipc: fix refcount warning in tipc_aead_encrypt
Alok Tiwari <[email protected]>
gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
Quentin Schulz <[email protected]>
net: stmmac: platform: guarantee uniqueness of bus_id
Nicolas Pitre <[email protected]>
vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
WangYuli <[email protected]>
MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a
Uwe Kleine-König <[email protected]>
iio: adc: ad7124: Fix 3dB filter frequency reading
Henry Martin <[email protected]>
serial: Fix potential null-ptr-deref in mlb_usio_probe()
Lad Prabhakar <[email protected]>
usb: renesas_usbhs: Reorder clock handling and power management in probe
Bjorn Helgaas <[email protected]>
PCI/DPC: Initialize aer_err_info before using it
Henry Martin <[email protected]>
dmaengine: ti: Add NULL check in udma_probe()
Hans Zhang <[email protected]>
PCI: cadence: Fix runtime atomic count underflow
Wolfram Sang <[email protected]>
rtc: sh: assign correct interrupts with DT
Li Lingfeng <[email protected]>
nfs: ignore SB_RDONLY when remounting nfs
Li Lingfeng <[email protected]>
nfs: clear SB_RDONLY before getting superblock
Dapeng Mi <[email protected]>
perf record: Fix incorrect --user-regs comments
Leo Yan <[email protected]>
perf tests switch-tracking: Fix timestamp comparison
Alexey Gladkov <[email protected]>
mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
Christophe JAILLET <[email protected]>
mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
Dan Carpenter <[email protected]>
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
Dan Carpenter <[email protected]>
remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
Adrian Hunter <[email protected]>
perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
Henry Martin <[email protected]>
backlight: pm8941: Add NULL check in wled_configure()
Arnaldo Carvalho de Melo <[email protected]>
perf ui browser hists: Set actions->thread before calling do_zoom_thread()
Arnaldo Carvalho de Melo <[email protected]>
perf build: Warn when libdebuginfod devel files are not available
Kees Cook <[email protected]>
randstruct: gcc-plugin: Fix attribute addition
Kees Cook <[email protected]>
randstruct: gcc-plugin: Remove bogus void member
Sergey Shtylyov <[email protected]>
fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
Henry Martin <[email protected]>
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
Su Hui <[email protected]>
soc: aspeed: lpc: Fix impossible judgment condition
Quentin Schulz <[email protected]>
arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
Dmitry Baryshkov <[email protected]>
ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
Ioana Ciornei <[email protected]>
bus: fsl-mc: fix double-free on mc_dev
Ryusuke Konishi <[email protected]>
nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
Wentao Liang <[email protected]>
nilfs2: add pointer check for nilfs_direct_propagate()
Murad Masimov <[email protected]>
ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
Phillip Lougher <[email protected]>
Squashfs: check return result of sb_min_blocksize
Adam Ford <[email protected]>
arm64: dts: imx8mn-beacon: Fix RTC capacitive load
Adam Ford <[email protected]>
arm64: dts: imx8mm-beacon: Fix RTC capacitive load
Wolfram Sang <[email protected]>
ARM: dts: at91: at91sam9263: fix NAND chip selects
Wolfram Sang <[email protected]>
ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
Zhiguo Niu <[email protected]>
f2fs: fix to correct check conditions in f2fs_cross_rename
Zhiguo Niu <[email protected]>
f2fs: use d_inode(dentry) cleanup dentry->d_inode
Horatiu Vultur <[email protected]>
net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
Faicker Mo <[email protected]>
net: openvswitch: Fix the dead loop of MPLS parse
Kuniyuki Iwashima <[email protected]>
calipso: Don't call calipso functions for AF_INET sk.
Thangaraj Samynathan <[email protected]>
net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
KaFai Wan <[email protected]>
bpf: Avoid __bpf_prog_ret0_warn when jit fails
Nikita Zhandarovich <[email protected]>
net: usb: aqc111: fix error handling of usbnet read calls
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_tunnel: fix geneve_opt dump
Jiayuan Chen <[email protected]>
bpf, sockmap: Avoid using sk_socket after free when sending
Li RongQing <[email protected]>
vfio/type1: Fix error unwind in migration dirty bitmap allocation
Florian Westphal <[email protected]>
netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k_htc: Abort software beacon handling if disabled
Alexey Kodanev <[email protected]>
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
Ilya Leoshkevich <[email protected]>
s390/bpf: Store backchain even for leaf progs
Vincent Knecht <[email protected]>
clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
Tao Chen <[email protected]>
bpf: Fix WARN() in get_bpf_raw_tp_regs
Andy Shevchenko <[email protected]>
pinctrl: at91: Fix possible out-of-boundary access
Anton Protopopov <[email protected]>
libbpf: Use proper errno value in nlattr
Jiayuan Chen <[email protected]>
ktls, sockmap: Fix missing uncharge operation
Henry Martin <[email protected]>
clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
Luca Weiss <[email protected]>
clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
Anton Protopopov <[email protected]>
bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
Patrisious Haddad <[email protected]>
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
Zhongqiu Duan <[email protected]>
netfilter: nft_quota: match correctly when the quota just depleted
Huajian Yang <[email protected]>
netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
Anton Protopopov <[email protected]>
libbpf: Use proper errno value in linker
Chao Yu <[email protected]>
f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
Chao Yu <[email protected]>
f2fs: clean up w/ fscrypt_is_bounce_page()
Jason Gunthorpe <[email protected]>
iommu: Protect against overflow in iommu_pgsize()
Junxian Huang <[email protected]>
RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
Dmitry Antipov <[email protected]>
wifi: rtw88: do not ignore hardware read error during DPK
Viktor Malik <[email protected]>
libbpf: Fix buffer overflow in bpf_object__init_prog
Hari Kalavakunta <[email protected]>
net: ncsi: Fix GCPS 64-bit member variables
Chao Yu <[email protected]>
f2fs: fix to do sanity check on sbi->total_valid_block_count
Jiayuan Chen <[email protected]>
bpf, sockmap: fix duplicated data transmission
Jacob Moroni <[email protected]>
IB/cm: use rwlock for MAD agent lock
Stone Zhang <[email protected]>
wifi: ath11k: fix node corruption in ar->arvifs list
Huang Yiwei <[email protected]>
firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
Biju Das <[email protected]>
drm/tegra: rgb: Fix the unbound reference count
Kees Cook <[email protected]>
drm/vkms: Adjust vkms_state->active_planes allocation type
Biju Das <[email protected]>
drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
Neill Kapron <[email protected]>
selftests/seccomp: fix syscall_restart test for arm compat
Miaoqian Lin <[email protected]>
firmware: psci: Fix refcount leak in psci_dt_init
Finn Thain <[email protected]>
m68k: mac: Fix macintosh_config for Mac II
Andrey Vatoropin <[email protected]>
fs/ntfs3: handle hdr_first_de() return value
Jonas Karlman <[email protected]>
media: rkvdec: Fix frame size enumeration
Charles Han <[email protected]>
drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table
Geert Uytterhoeven <[email protected]>
spi: sh-msiof: Fix maximum DMA transfer size
Armin Wolf <[email protected]>
ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
Jiaqing Zhao <[email protected]>
x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
Zijun Hu <[email protected]>
PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
Alexander Shiyan <[email protected]>
power: reset: at91-reset: Optimize at91_reset()
Qiuxu Zhuo <[email protected]>
EDAC/skx_common: Fix general protection fault
Ovidiu Panait <[email protected]>
crypto: sun8i-ce - move fallback ahash_request to the end of the struct
Herbert Xu <[email protected]>
crypto: xts - Only add ecb if it is not already there
Herbert Xu <[email protected]>
crypto: lrw - Only add ecb if it is not already there
Herbert Xu <[email protected]>
crypto: marvell/cesa - Avoid empty transfer descriptor
Herbert Xu <[email protected]>
crypto: marvell/cesa - Handle zero-length skcipher requests
Ahmed S. Darwish <[email protected]>
x86/cpu: Sanitize CPUID(0x80000000) output
Corentin Labbe <[email protected]>
crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
Qing Wang <[email protected]>
perf/core: Fix broken throttling when max_samples_per_tick=1
Andreas Gruenbacher <[email protected]>
gfs2: gfs2_create_inode error handling fix
Sergey Senozhatsky <[email protected]>
thunderbolt: Do not double dequeue a configuration request
Dave Penkler <[email protected]>
usb: usbtmc: Fix timeout value in get_stb
Charles Yeh <[email protected]>
USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
Hongyu Xie <[email protected]>
usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
Jiayi Li <[email protected]>
usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
Alexandre Mergnat <[email protected]>
rtc: Fix offset calculation for .start_secs < 0
Alexandre Mergnat <[email protected]>
rtc: Make rtc_time64_to_tm() support dates before 1970
Gautham R. Shenoy <[email protected]>
acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio()
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: set GPIO output value before setting direction
Gabor Juhos <[email protected]>
pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
Pan Taixi <[email protected]>
tracing: Fix compilation warning on arm32
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 7 +- Makefile | 8 +- arch/arm/boot/dts/am335x-bone-common.dtsi | 8 + arch/arm/boot/dts/at91sam9263ek.dts | 2 +- arch/arm/boot/dts/qcom-apq8064.dtsi | 13 +- arch/arm/boot/dts/tny_a9263.dts | 2 +- arch/arm/boot/dts/usb_a9263.dts | 4 +- arch/arm/mach-omap2/clockdomain.h | 1 + arch/arm/mach-omap2/clockdomains33xx_data.c | 2 +- arch/arm/mach-omap2/cm33xx.c | 14 +- arch/arm/mach-omap2/pmic-cpcap.c | 6 +- arch/arm/mm/ioremap.c | 4 +- .../boot/dts/freescale/imx8mm-beacon-som.dtsi | 1 + .../boot/dts/freescale/imx8mn-beacon-som.dtsi | 1 + .../arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 8 - arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 20 +- arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/debug-monitors.h | 12 - arch/arm64/include/asm/insn-def.h | 14 ++ arch/arm64/include/asm/insn.h | 81 ++++++- arch/arm64/include/asm/spectre.h | 3 + arch/arm64/kernel/proton-pack.c | 21 +- arch/arm64/kernel/ptrace.c | 2 +- arch/arm64/lib/insn.c | 199 +++++++++++++++-- arch/arm64/net/bpf_jit.h | 11 +- arch/arm64/net/bpf_jit_comp.c | 58 ++++- arch/arm64/xen/hypercall.S | 21 +- arch/m68k/mac/config.c | 2 +- arch/mips/Makefile | 6 +- .../boot/dts/loongson/loongson64c_4core_ls7a.dts | 1 + arch/mips/loongson2ef/Platform | 2 +- arch/mips/vdso/Makefile | 1 + arch/nios2/include/asm/pgtable.h | 16 ++ arch/parisc/boot/compressed/Makefile | 1 + arch/powerpc/kernel/eeh.c | 2 + arch/powerpc/platforms/book3s/vas-api.c | 9 + arch/powerpc/platforms/powernv/memtrace.c | 8 +- arch/powerpc/platforms/pseries/msi.c | 7 +- arch/s390/net/bpf_jit_comp.c | 12 +- arch/s390/pci/pci_mmio.c | 2 +- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/kernel/cpu/bugs.c | 10 +- arch/x86/kernel/cpu/common.c | 17 +- arch/x86/kernel/cpu/mtrr/generic.c | 2 +- arch/x86/kernel/ioport.c | 13 +- arch/x86/kernel/process.c | 6 + block/Kconfig | 8 +- block/bdev.c | 2 +- crypto/lrw.c | 4 +- crypto/xts.c | 4 +- drivers/acpi/acpica/dsutils.c | 9 +- drivers/acpi/acpica/psobject.c | 52 ++--- drivers/acpi/acpica/utprint.c | 7 +- drivers/acpi/apei/Kconfig | 1 + drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/battery.c | 19 +- drivers/acpi/bus.c | 6 +- drivers/acpi/osi.c | 1 - drivers/ata/pata_via.c | 3 +- drivers/atm/atmtcp.c | 4 +- drivers/base/power/domain.c | 2 +- drivers/base/power/main.c | 3 +- drivers/base/power/runtime.c | 2 +- drivers/base/swnode.c | 2 +- drivers/block/aoe/aoedev.c | 8 + drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +- drivers/bus/fsl-mc/fsl-mc-uapi.c | 4 +- drivers/bus/fsl-mc/mc-io.c | 19 +- drivers/bus/fsl-mc/mc-sys.c | 2 +- drivers/bus/mhi/host/pm.c | 18 +- drivers/bus/ti-sysc.c | 49 ---- drivers/clk/bcm/clk-raspberrypi.c | 2 + drivers/clk/meson/g12a.c | 1 + drivers/clk/qcom/gcc-msm8939.c | 4 +- drivers/clk/qcom/gcc-sm6350.c | 6 + drivers/clk/rockchip/clk-rk3036.c | 1 + drivers/cpufreq/acpi-cpufreq.c | 2 +- drivers/cpufreq/cpufreq.c | 6 +- drivers/cpufreq/scmi-cpufreq.c | 36 ++- drivers/cpufreq/tegra186-cpufreq.c | 7 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 2 +- .../crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 2 +- drivers/crypto/marvell/cesa/cesa.c | 2 +- drivers/crypto/marvell/cesa/cesa.h | 9 +- drivers/crypto/marvell/cesa/cipher.c | 3 + drivers/crypto/marvell/cesa/hash.c | 2 +- drivers/crypto/marvell/cesa/tdma.c | 53 +++-- drivers/dma-buf/udmabuf.c | 5 +- drivers/dma/ti/k3-udma.c | 3 +- drivers/edac/altera_edac.c | 6 +- drivers/edac/skx_common.c | 1 + drivers/firmware/Kconfig | 1 - drivers/firmware/arm_sdei.c | 11 +- drivers/firmware/psci/psci.c | 4 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 - drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 4 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 +- drivers/gpu/drm/amd/display/dc/dcn20/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dcn21/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dml/Makefile | 3 +- .../gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 8 + drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 5 +- drivers/gpu/drm/bridge/analogix/anx7625.c | 8 +- drivers/gpu/drm/meson/meson_drv.c | 2 +- drivers/gpu/drm/meson/meson_drv.h | 2 +- drivers/gpu/drm/meson/meson_encoder_hdmi.c | 29 +-- drivers/gpu/drm/meson/meson_vclk.c | 226 ++++++++++--------- drivers/gpu/drm/meson/meson_vclk.h | 13 +- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 2 +- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 3 +- drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c | 7 + drivers/gpu/drm/msm/hdmi/hdmi_i2c.c | 14 +- drivers/gpu/drm/nouveau/nouveau_backlight.c | 2 +- drivers/gpu/drm/rcar-du/rcar_du_kms.c | 10 +- drivers/gpu/drm/tegra/rgb.c | 14 +- drivers/gpu/drm/vkms/vkms_crtc.c | 2 +- drivers/hid/hid-hyperv.c | 5 +- drivers/hid/usbhid/hid-core.c | 25 ++- drivers/hwmon/occ/common.c | 247 +++++++++------------ drivers/i2c/busses/i2c-designware-slave.c | 2 +- drivers/i2c/busses/i2c-npcm7xx.c | 12 +- drivers/iio/accel/fxls8962af-core.c | 15 +- drivers/iio/adc/ad7124.c | 4 +- drivers/iio/adc/ad7606_spi.c | 2 +- drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c | 8 +- drivers/infiniband/core/cm.c | 16 +- drivers/infiniband/core/iwcm.c | 29 +-- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 - drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 + drivers/infiniband/hw/hns/hns_roce_main.c | 1 - drivers/infiniband/hw/hns/hns_roce_restrack.c | 1 - drivers/infiniband/hw/mlx5/qpc.c | 30 ++- drivers/input/misc/ims-pcu.c | 6 + drivers/input/misc/sparcspkr.c | 22 +- drivers/input/rmi4/rmi_f34.c | 135 ++++++----- drivers/iommu/amd/iommu.c | 8 + drivers/iommu/iommu.c | 4 +- drivers/md/dm-raid1.c | 5 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 4 +- drivers/media/i2c/ccs-pll.c | 23 +- drivers/media/i2c/imx334.c | 18 +- drivers/media/i2c/ov8856.c | 9 +- drivers/media/i2c/tc358743.c | 4 + drivers/media/platform/exynos4-is/fimc-is-regs.c | 1 + drivers/media/platform/qcom/venus/core.c | 16 +- drivers/media/platform/ti-vpe/cal-video.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 2 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 2 +- drivers/media/usb/dvb-usb/cxusb.c | 3 +- drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c | 7 +- drivers/media/usb/uvc/uvc_ctrl.c | 23 +- drivers/media/usb/uvc/uvc_driver.c | 27 ++- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/exynos-lpass.c | 1 - drivers/mfd/stmpe-spi.c | 2 +- drivers/misc/vmw_vmci/vmci_host.c | 11 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 + drivers/net/can/m_can/tcan4x5x-core.c | 9 +- drivers/net/ethernet/aquantia/atlantic/aq_main.c | 1 - drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 + drivers/net/ethernet/cadence/macb_main.c | 6 +- drivers/net/ethernet/dlink/dl2k.c | 14 +- drivers/net/ethernet/dlink/dl2k.h | 2 + drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- drivers/net/ethernet/google/gve/gve_main.c | 2 +- drivers/net/ethernet/google/gve/gve_tx_dqo.c | 3 + drivers/net/ethernet/intel/i40e/i40e_common.c | 7 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 +- drivers/net/ethernet/intel/ice/ice_arfs.c | 48 ++++ drivers/net/ethernet/intel/ice/ice_sched.c | 11 +- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 9 +- drivers/net/ethernet/mediatek/mtk_star_emac.c | 4 + drivers/net/ethernet/mellanox/mlx4/en_clock.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 5 +- .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 18 +- drivers/net/ethernet/microchip/lan743x_main.c | 4 +- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 11 +- drivers/net/macsec.c | 40 +++- drivers/net/phy/mdio_bus.c | 16 +- drivers/net/phy/mscc/mscc_ptp.c | 4 +- drivers/net/usb/aqc111.c | 10 +- drivers/net/usb/ch9200.c | 7 +- drivers/net/vmxnet3/vmxnet3_drv.c | 26 +++ drivers/net/vxlan/vxlan_core.c | 8 +- drivers/net/wireguard/device.c | 1 + drivers/net/wireless/ath/ath10k/snoc.c | 4 +- drivers/net/wireless/ath/ath11k/core.c | 8 +- drivers/net/wireless/ath/ath9k/htc_drv_beacon.c | 3 + drivers/net/wireless/ath/carl9170/usb.c | 19 +- drivers/net/wireless/intersil/p54/fwio.c | 2 + drivers/net/wireless/intersil/p54/p54.h | 1 + drivers/net/wireless/intersil/p54/txrx.c | 13 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 2 + .../net/wireless/mediatek/mt76/mt76x2/usb_init.c | 13 +- drivers/net/wireless/realtek/rtlwifi/pci.c | 10 + drivers/net/wireless/realtek/rtw88/coex.c | 2 +- drivers/net/wireless/realtek/rtw88/rtw8822c.c | 3 +- drivers/nvme/target/fcloop.c | 31 +-- drivers/pci/controller/cadence/pcie-cadence-ep.c | 5 +- drivers/pci/controller/cadence/pcie-cadence-host.c | 11 +- drivers/pci/controller/dwc/pcie-dw-rockchip.c | 2 +- drivers/pci/pci.c | 3 +- drivers/pci/pcie/dpc.c | 2 +- drivers/pci/quirks.c | 23 ++ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 35 +-- drivers/pinctrl/pinctrl-at91.c | 6 +- drivers/pinctrl/pinctrl-mcp23s08.c | 8 + drivers/platform/x86/dell/dell_rbu.c | 6 +- drivers/power/reset/at91-reset.c | 5 +- drivers/power/supply/bq27xxx_battery.c | 2 +- drivers/power/supply/bq27xxx_battery_i2c.c | 13 +- drivers/ptp/ptp_private.h | 12 +- drivers/rapidio/rio_cm.c | 3 + drivers/regulator/max14577-regulator.c | 5 +- drivers/remoteproc/qcom_wcnss_iris.c | 2 + drivers/remoteproc/remoteproc_core.c | 6 +- drivers/rpmsg/qcom_smd.c | 2 +- drivers/rtc/class.c | 2 +- drivers/rtc/lib.c | 24 +- drivers/rtc/rtc-sh.c | 12 +- drivers/s390/scsi/zfcp_sysfs.c | 2 + drivers/scsi/elx/efct/efct_hw.c | 5 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +- drivers/scsi/lpfc/lpfc_sli.c | 4 +- drivers/scsi/scsi_transport_iscsi.c | 11 +- drivers/scsi/storvsc_drv.c | 10 +- drivers/scsi/ufs/ufshcd.c | 7 +- drivers/soc/aspeed/aspeed-lpc-snoop.c | 17 +- drivers/soc/ti/omap_prm.c | 8 +- drivers/spi/spi-bcm63xx-hsspi.c | 2 +- drivers/spi/spi-bcm63xx.c | 2 +- drivers/spi/spi-sh-msiof.c | 13 +- drivers/staging/iio/impedance-analyzer/ad5933.c | 2 +- drivers/staging/media/rkvdec/rkvdec.c | 24 +- drivers/tee/tee_core.c | 11 +- drivers/thermal/qcom/tsens.c | 10 +- drivers/thunderbolt/ctl.c | 5 + drivers/tty/serial/milbeaut_usio.c | 5 +- drivers/tty/serial/sh-sci.c | 97 ++++++-- drivers/tty/vt/vt_ioctl.c | 2 - drivers/uio/uio_hv_generic.c | 4 +- drivers/usb/cdns3/cdnsp-gadget.c | 21 +- drivers/usb/cdns3/cdnsp-gadget.h | 4 + drivers/usb/class/usbtmc.c | 21 +- drivers/usb/core/hub.c | 16 +- drivers/usb/core/quirks.c | 3 + drivers/usb/gadget/function/f_hid.c | 12 +- drivers/usb/renesas_usbhs/common.c | 50 ++++- drivers/usb/serial/pl2303.c | 2 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/tcpm/tcpci_maxim.c | 3 +- drivers/vfio/vfio_iommu_type1.c | 2 +- drivers/video/backlight/qcom-wled.c | 6 +- drivers/video/console/vgacon.c | 2 +- drivers/video/fbdev/core/fbcvt.c | 2 +- drivers/video/fbdev/core/fbmem.c | 4 +- drivers/watchdog/da9052_wdt.c | 1 + fs/configfs/dir.c | 2 +- fs/exfat/nls.c | 1 + fs/ext4/ext4.h | 8 + fs/ext4/extents.c | 39 ++-- fs/ext4/file.c | 7 +- fs/ext4/inline.c | 2 +- fs/ext4/inode.c | 3 +- fs/ext4/ioctl.c | 8 +- fs/ext4/super.c | 15 +- fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 10 +- fs/f2fs/namei.c | 19 +- fs/f2fs/super.c | 12 +- fs/filesystems.c | 14 +- fs/gfs2/inode.c | 3 +- fs/gfs2/lock_dlm.c | 3 +- fs/jbd2/transaction.c | 5 +- fs/jffs2/erase.c | 4 +- fs/jffs2/scan.c | 4 +- fs/jffs2/summary.c | 7 +- fs/jfs/jfs_discard.c | 3 +- fs/jfs/jfs_dtree.c | 18 +- fs/namespace.c | 6 +- fs/nfs/super.c | 19 ++ fs/nfsd/nfs4proc.c | 3 +- fs/nfsd/nfssvc.c | 6 +- fs/nilfs2/btree.c | 4 +- fs/nilfs2/direct.c | 3 + fs/ntfs3/index.c | 8 + fs/ocfs2/quota_local.c | 2 +- fs/squashfs/super.c | 5 + fs/xfs/xfs_inode.c | 15 +- include/acpi/actypes.h | 2 +- include/linux/arm_sdei.h | 4 +- include/linux/atmdev.h | 6 + include/linux/hid.h | 3 +- include/linux/hugetlb.h | 3 + include/linux/mlx5/driver.h | 1 + include/linux/mm.h | 3 + include/linux/mm_types.h | 3 + include/net/checksum.h | 2 +- include/net/sock.h | 7 +- include/trace/events/erofs.h | 18 -- include/uapi/linux/bpf.h | 2 + include/uapi/linux/videodev2.h | 12 +- ipc/shm.c | 5 +- kernel/bpf/core.c | 2 +- kernel/events/core.c | 57 ++++- kernel/exit.c | 17 +- kernel/power/wakelock.c | 3 + kernel/time/clocksource.c | 2 +- kernel/time/posix-cpu-timers.c | 9 + kernel/trace/bpf_trace.c | 2 +- kernel/trace/ftrace.c | 10 +- kernel/trace/trace.c | 2 +- lib/Kconfig | 1 + mm/huge_memory.c | 2 +- mm/hugetlb.c | 81 +++++-- mm/mmap.c | 8 + mm/page-writeback.c | 2 +- net/atm/common.c | 1 + net/atm/lec.c | 12 +- net/atm/raw.c | 2 +- net/bluetooth/l2cap_core.c | 3 +- net/bridge/br_multicast.c | 77 ++++++- net/bridge/netfilter/nf_conntrack_bridge.c | 12 +- net/core/filter.c | 5 +- net/core/skmsg.c | 25 ++- net/core/sock.c | 4 +- net/core/utils.c | 4 +- net/dsa/tag_brcm.c | 2 +- net/ipv4/route.c | 4 + net/ipv4/tcp_input.c | 63 +++--- net/ipv6/calipso.c | 8 + net/ipv6/ila/ila_common.c | 6 +- net/ipv6/netfilter.c | 12 +- net/ipv6/netfilter/nft_fib_ipv6.c | 13 +- net/ipv6/seg6_local.c | 6 +- net/mac80211/mesh_hwmp.c | 6 +- net/mpls/af_mpls.c | 4 +- net/ncsi/internal.h | 21 +- net/ncsi/ncsi-pkt.h | 23 +- net/ncsi/ncsi-rsp.c | 21 +- net/netfilter/nft_quota.c | 20 +- net/netfilter/nft_set_pipapo_avx2.c | 21 +- net/netfilter/nft_tunnel.c | 8 +- net/netlabel/netlabel_kapi.c | 5 + net/nfc/nci/uart.c | 8 +- net/openvswitch/flow.c | 2 +- net/sched/sch_ets.c | 10 +- net/sched/sch_prio.c | 2 +- net/sched/sch_red.c | 2 +- net/sched/sch_sfq.c | 121 ++++++---- net/sched/sch_tbf.c | 2 +- net/sctp/socket.c | 3 +- net/sunrpc/cache.c | 17 +- net/tipc/crypto.c | 8 +- net/tipc/udp_media.c | 4 +- net/tls/tls_sw.c | 7 + scripts/Kconfig.include | 2 +- scripts/Makefile.clang | 3 +- scripts/Makefile.compiler | 8 +- scripts/as-version.sh | 2 +- scripts/gcc-plugins/gcc-common.h | 32 +++ scripts/gcc-plugins/randomize_layout_plugin.c | 40 +--- security/selinux/xfrm.c | 2 +- sound/pci/hda/hda_intel.c | 2 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/tas2770.c | 30 ++- sound/soc/meson/meson-card-utils.c | 2 +- sound/soc/qcom/sdm845.c | 4 + sound/soc/tegra/tegra210_ahub.c | 2 + sound/usb/implicit.c | 1 + sound/usb/mixer_maps.c | 12 + tools/include/uapi/linux/bpf.h | 2 + tools/lib/bpf/bpf_core_read.h | 6 + tools/lib/bpf/btf.c | 16 ++ tools/lib/bpf/libbpf.c | 2 +- tools/lib/bpf/linker.c | 4 +- tools/lib/bpf/nlattr.c | 15 +- tools/perf/Makefile.config | 2 + tools/perf/builtin-record.c | 2 +- tools/perf/scripts/python/exported-sql-viewer.py | 5 +- tools/perf/tests/switch-tracking.c | 2 +- tools/perf/ui/browsers/hists.c | 2 +- tools/testing/selftests/seccomp/seccomp_bpf.c | 7 +- tools/testing/selftests/x86/Makefile | 2 +- tools/testing/selftests/x86/sigtrap_loop.c | 101 +++++++++ usr/include/Makefile | 2 +- 392 files changed, 3155 insertions(+), 1436 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/411 tracing: Fix compilation warning on arm32
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Taixi <[email protected]>
commit 2fbdb6d8e03b70668c0876e635506540ae92ab05 upstream.
On arm32, size_t is defined to be unsigned int, while PAGE_SIZE is unsigned long. This hence triggers a compilation warning as min() asserts the type of two operands to be equal. Casting PAGE_SIZE to size_t solves this issue and works on other target architectures as well.
Compilation warning details:
kernel/trace/trace.c: In function 'tracing_splice_read_pipe':./include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast
(!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
^
./include/linux/minmax.h:26:4: note: in expansion of macro '__typecheck'
(__typecheck(x, y) && __no_side_effects(x, y))
^~~~~~~~~~~...
kernel/trace/trace.c:6771:8: note: in expansion of macro 'min'
min((size_t)trace_seq_used(&iter->seq),
^~~--- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace.c +1 -1
@@ -7030,7 +7030,7 @@ static ssize_t tracing_splice_read_pipe( ret =trace_seq_to_buffer (&iter->seq,page_address (spd.pages[i]),min ((size_t )trace_seq_used (&iter->seq), -PAGE_SIZE )); + (size_t )PAGE_SIZE ));if (ret <0 ) {__free_page (spd.pages[i]);break ;
Greg Kroah-Hartman
maintainerPATCH 2/411 pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit 947c93eb29c2a581c0b0b6d5f21af3c2b7ff6d25 upstream.
The controller has two consecutive OUTPUT_VAL registers and both holds output value for 32 GPIOs. Due to a missing adjustment, the current code always uses the first register while setting the output value whereas it should use the second one for GPIOs > 31.
Add the missing armada_37xx_update_reg() call to adjust the register according to the 'offset' parameter of the function to fix the issue.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +3 -0
@@ -413,6 +413,7 @@ static int armada_37xx_gpio_direction_ou unsigned int offset, int value) {struct armada_37xx_pinctrl *info =gpiochip_get_data (chip); +unsigned int val_offset = offset;unsigned int reg =OUTPUT_EN ;unsigned int mask, val, ret;
@@ -425,6 +426,8 @@ static int armada_37xx_gpio_direction_oureturn ret; reg =OUTPUT_VAL ; +armada_37xx_update_reg (®, &val_offset); + val = value ? mask :0 ;regmap_update_bits (info->regmap, reg, mask, val);
Greg Kroah-Hartman
maintainerPATCH 3/411 pinctrl: armada-37xx: set GPIO output value before setting direction
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit e6ebd4942981f8ad37189bbb36a3c8495e21ef4c upstream.
Changing the direction before updating the output value in the OUTPUT_VAL register may result in a glitch on the output line if the previous value in the OUTPUT_VAL register is different from the one we want to set.
In order to avoid that, update the output value before changing the direction.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +7 -8
@@ -413,23 +413,22 @@ static int armada_37xx_gpio_direction_ou unsigned int offset, int value) {struct armada_37xx_pinctrl *info =gpiochip_get_data (chip); -unsigned int val_offset = offset; -unsigned int reg =OUTPUT_EN ; +unsigned int en_offset = offset; +unsigned int reg =OUTPUT_VAL ;unsigned int mask, val, ret;armada_37xx_update_reg (®, &offset); mask =BIT (offset); + val = value ? mask :0 ; - ret =regmap_update_bits (info->regmap, reg, mask, mask); - + ret =regmap_update_bits (info->regmap, reg, mask, val);if (ret)return ret; - reg =OUTPUT_VAL ; -armada_37xx_update_reg (®, &val_offset); + reg =OUTPUT_EN ; +armada_37xx_update_reg (®, &en_offset); - val = value ? mask :0 ; -regmap_update_bits (info->regmap, reg, mask, val); +regmap_update_bits (info->regmap, reg, mask, mask);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 4/411 acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
commit cb6a85f38f456b086c366e346ebb67ffa70c7243 upstream.
commit 083466754596 ("cpufreq: ACPI: Fix max-frequency computation") modified get_max_boost_ratio() to return the nominal_freq advertised in the _CPC object. This was for the purposes of computing the maximum frequency. The frequencies advertised in _CPC objects are in MHz. However, cpufreq expects the frequency to be in KHz. Since the nominal_freq returned by get_max_boost_ratio() was not in KHz but instead in MHz,the cpuinfo_max_frequency that was computed using this nominal_freq was incorrect and an invalid value which resulted in cpufreq reporting the P0 frequency as the cpuinfo_max_freq.
Fix this by converting the nominal_freq to KHz before returning the same from get_max_boost_ratio().
--- drivers/cpufreq/acpi-cpufreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/acpi-cpufreq.c +1 -1
@@ -661,7 +661,7 @@ static u64 get_max_boost_ratio(unsigned nominal_perf = perf_caps.nominal_perf;if (nominal_freq) - *nominal_freq = perf_caps.nominal_freq; + *nominal_freq = perf_caps.nominal_freq *1000 ;if (!highest_perf || !nominal_perf) {pr_debug ("CPU%d: highest or nominal performance missing\n" , cpu);
Greg Kroah-Hartman
maintainerPATCH 5/411 rtc: Make rtc_time64_to_tm() support dates before 1970
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Mergnat <[email protected]>
commit 7df4cfef8b351fec3156160bedfc7d6d29de4cce upstream.
Conversion of dates before 1970 is still relevant today because these dates are reused on some hardwares to store dates bigger than the maximal date that is representable in the device's native format. This prominently and very soon affects the hardware covered by the rtc-mt6397 driver that can only natively store dates in the interval 1900-01-01 up to 2027-12-31. So to store the date 2028-01-01 00:00:00 to such a device, rtc_time64_to_tm() must do the right thing for time=-2208988800.
--- drivers/rtc/lib.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
drivers/rtc/lib.c +19 -5
@@ -46,24 +46,38 @@ EXPORT_SYMBOL(rtc_year_days);* rtc_time64_to_tm - converts time64_t to rtc_time. * * @time: The number of seconds since 01-01-1970 00:00:00. -* (Must be positive.) +* Works for values since at least 1900 * @tm: Pointer to the struct rtc_time. */ void rtc_time64_to_tm (time64_t time,struct rtc_time *tm) { -unsigned int secs; -int days; +int days, secs;u64 u64tmp;u32 u32tmp, udays, century, day_of_century, year_of_century, year, day_of_year, month, day;bool is_Jan_or_Feb, is_leap_year; -/* time must be positive */ +/* +* Get days and seconds while preserving the sign to +* handle negative time values (dates before 1970-01-01) +*/ days =div_s64_rem (time,86400 , &secs); +/* +* We need 0 <= secs < 86400 which isn't given for negative +* values of time. Fixup accordingly. +*/ +if (secs <0 ) { + days -=1 ; + secs +=86400 ; + } +/* day of the week, 1970-01-01 was a Thursday */ tm->tm_wday = (days +4 ) %7 ; +/* Ensure tm_wday is always positive */ +if (tm->tm_wday <0 ) + tm->tm_wday +=7 ;/* * The following algorithm is, basically, Proposition 6.3 of Neri
@@ -93,7 +107,7 @@ void rtc_time64_to_tm(time64_t time, str* thus, is slightly different from [1]. */ - udays = ((u32 ) days) +719468 ; + udays = days +719468 ; u32tmp =4 * udays +3 ; century = u32tmp /146097 ;
Greg Kroah-Hartman
maintainerPATCH 6/411 rtc: Fix offset calculation for .start_secs < 0
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Mergnat <[email protected]>
commit fe9f5f96cfe8b82d0f24cbfa93718925560f4f8d upstream.
The comparison
rtc->start_secs > rtc->range_max
has a signed left-hand side and an unsigned right-hand side. So the comparison might become true for negative start_secs which is interpreted as a (possibly very large) positive value.
As a negative value can never be bigger than an unsigned value the correct representation of the (mathematical) comparison
rtc->start_secs > rtc->range_max
in C is:
rtc->start_secs >= 0 && rtc->start_secs > rtc->range_max
Use that to fix the offset calculation currently used in the rtc-mt6397 driver.
--- drivers/rtc/class.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/class.c +1 -1
@@ -322,7 +322,7 @@ static void rtc_device_get_offset(struct* * Otherwise the offset seconds should be 0. */ -if (rtc->start_secs > rtc->range_max || +if ((rtc->start_secs >=0 && rtc->start_secs > rtc->range_max) || rtc->start_secs + range_secs -1 < rtc->range_min) rtc->offset_secs = rtc->start_secs - rtc->range_min;else if (rtc->start_secs > rtc->range_min)
Greg Kroah-Hartman
maintainerPATCH 7/411 usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
commit 19f795591947596b5b9efa86fd4b9058e45786e9 upstream.
This device exhibits I/O errors during file transfers due to unstable link power management (LPM) behavior. The kernel logs show repeated warm resets and eventual disconnection when LPM is enabled:
[ 3467.810740] hub 2-0:1.0: state 7 ports 6 chg 0000 evt 0020 [ 3467.810740] usb usb2-port5: do warm reset [ 3467.866444] usb usb2-port5: not warm reset yet, waiting 50ms [ 3467.907407] sd 0:0:0:0: [sda] tag#12 sense submit err -19 [ 3467.994423] usb usb2-port5: status 02c0, change 0001, 10.0 Gb/s [ 3467.994453] usb 2-5: USB disconnect, device number 4
The error -19 (ENODEV) occurs when the device disappears during write operations. Adding USB_QUIRK_NO_LPM disables link power management for this specific device, resolving the stability issues.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -369,6 +369,9 @@ static const struct usb_device_id usb_qu/* SanDisk Corp. SanDisk 3.2Gen1 */ { USB_DEVICE(0x0781, 0x55a3), .driver_info = USB_QUIRK_DELAY_INIT }, + /* SanDisk Extreme 55AE */ + { USB_DEVICE(0x0781, 0x55ae), .driver_info = USB_QUIRK_NO_LPM }, + /* Realforce 87U Keyboard */ { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM },
Greg Kroah-Hartman
maintainerPATCH 8/411 usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyu Xie <[email protected]>
commit a541acceedf4f639f928f41fbb676b75946dc295 upstream.
SanDisk 3.2 Gen2 storage device(0781:55e8) doesn't work well with UAS. Log says,
[ 6.507865][ 3] [ T159] usb 2-1.4: new SuperSpeed Gen 1 USB device number 4 using xhci_hcd [ 6.540314][ 3] [ T159] usb 2-1.4: New USB device found, idVendor=0781, idProduct=55e8, bcdDevice= 0.01 [ 6.576304][ 3] [ T159] usb 2-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 6.584727][ 3] [ T159] usb 2-1.4: Product: SanDisk 3.2 Gen2 [ 6.590459][ 3] [ T159] usb 2-1.4: Manufacturer: SanDisk [ 6.595845][ 3] [ T159] usb 2-1.4: SerialNumber: 03021707022525140940 [ 7.230852][ 0] [ T265] usbcore: registered new interface driver usb-storage [ 7.251247][ 0] [ T265] scsi host3: uas [ 7.255280][ 0] [ T265] usbcore: registered new interface driver uas [ 7.270498][ 1] [ T192] scsi 3:0:0:0: Direct-Access SanDisk Extreme Pro DDE1 0110 PQ: 0 ANSI: 6 [ 7.299588][ 3] [ T192] scsi 3:0:0:1: Enclosure SanDisk SES Device 0110 PQ: 0 ANSI: 6 [ 7.321681][ 3] [ T192] sd 3:0:0:0: Attached scsi generic sg1 type 0 [ 7.328185][ 3] [ T192] scsi 3:0:0:1: Attached scsi generic sg2 type 13 [ 7.328804][ 0] [ T191] sd 3:0:0:0: [sda] 976773168 512-byte logical blocks: (500 GB/466 GiB) [ 7.343486][ 0] [ T191] sd 3:0:0:0: [sda] 4096-byte physical blocks [ 7.364611][ 0] [ T191] sd 3:0:0:0: [sda] Write Protect is off [ 7.370524][ 0] [ T191] sd 3:0:0:0: [sda] Mode Sense: 3d 00 10 00 [ 7.390655][ 0] [ T191] sd 3:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA [ 7.401363][ 0] [ T191] sd 3:0:0:0: [sda] Optimal transfer size 1048576 bytes [ 7.436010][ 0] [ T191] sda: sda1 [ 7.450850][ 0] [ T191] sd 3:0:0:0: [sda] Attached SCSI disk [ 7.470218][ 4] [ T262] scsi 3:0:0:1: Failed to get diagnostic page 0x1 [ 7.474869][ 0] [ C0] sd 3:0:0:0: [sda] tag#0 data cmplt err -75 uas-tag 2 inflight: CMD [ 7.476911][ 4] [ T262] scsi 3:0:0:1: Failed to bind enclosure -19 [ 7.485330][ 0] [ C0] sd 3:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 00 00 28 00 00 10 00 [ 7.491593][ 4] [ T262] ses 3:0:0:1: Attached Enclosure device [ 38.066980][ 4] [ T192] sd 3:0:0:0: [sda] tag#4 uas_eh_abort_handler 0 uas-tag 5 inflight: CMD IN [ 38.076012][ 4] [ T192] sd 3:0:0:0: [sda] tag#4 CDB: Read(10) 28 00 00 00 01 08 00 00 f8 00 [ 38.086485][ 4] [ T192] sd 3:0:0:0: [sda] tag#3 uas_eh_abort_handler 0 uas-tag 1 inflight: CMD IN [ 38.095515][ 4] [ T192] sd 3:0:0:0: [sda] tag#3 CDB: Read(10) 28 00 00 00 00 10 00 00 08 00 [ 38.104122][ 4] [ T192] sd 3:0:0:0: [sda] tag#2 uas_eh_abort_handler 0 uas-tag 4 inflight: CMD IN [ 38.113152][ 4] [ T192] sd 3:0:0:0: [sda] tag#2 CDB: Read(10) 28 00 00 00 00 88 00 00 78 00 [ 38.121761][ 4] [ T192] sd 3:0:0:0: [sda] tag#1 uas_eh_abort_handler 0 uas-tag 3 inflight: CMD IN [ 38.130791][ 4] [ T192] sd 3:0:0:0: [sda] tag#1 CDB: Read(10) 28 00 00 00 00 48 00 00 30 00 [ 38.139401][ 4] [ T192] sd 3:0:0:0: [sda] tag#0 uas_eh_abort_handler 0 uas-tag 2 inflight: CMD [ 38.148170][ 4] [ T192] sd 3:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 00 00 28 00 00 10 00 [ 38.178980][ 2] [ T304] scsi host3: uas_eh_device_reset_handler start [ 38.901540][ 2] [ T304] usb 2-1.4: reset SuperSpeed Gen 1 USB device number 4 using xhci_hcd [ 38.936791][ 2] [ T304] scsi host3: uas_eh_device_reset_handler success
Device decriptor is below,
Bus 002 Device 006: ID 0781:55e8 SanDisk Corp. SanDisk 3.2 Gen2 Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 3.20
bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 9 idVendor 0x0781 SanDisk Corp. idProduct 0x55e8 bcdDevice 0.01 iManufacturer 1 SanDisk iProduct 2 SanDisk 3.2 Gen2 iSerial 3 03021707022525140940 bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0079
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 896mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk-Only
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 1
bNumEndpoints 4
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 98
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 0
Command pipe (0x01)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x84 EP 4 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
MaxStreams 32
Status pipe (0x02)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
MaxStreams 32
Data-in pipe (0x03)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x03 EP 3 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 15
MaxStreams 32
Data-out pipe (0x04)
Binary Object Store Descriptor:
bLength 5
bDescriptorType 15
wTotalLength 0x002a
bNumDeviceCaps 3
USB 2.0 Extension Device Capability:
bLength 7
bDescriptorType 16
bDevCapabilityType 2
bmAttributes 0x0000f41e
BESL Link Power Management (LPM) Supported
BESL value 1024 us
Deep BESL value 61440 us
SuperSpeed USB Device Capability:
bLength 10
bDescriptorType 16
bDevCapabilityType 3
bmAttributes 0x00
wSpeedsSupported 0x000e
Device can operate at Full Speed (12Mbps)
Device can operate at High Speed (480Mbps)
Device can operate at SuperSpeed (5Gbps)
bFunctionalitySupport 1
Lowest fully-functional device speed is Full Speed (12Mbps)
bU1DevExitLat 10 micro seconds
bU2DevExitLat 2047 micro seconds
SuperSpeedPlus USB Device Capability:
bLength 20
bDescriptorType 16
bDevCapabilityType 10 bmAttributes 0x00000001
Sublink Speed Attribute count 1
Sublink Speed ID count 0
wFunctionalitySupport 0x1100
bmSublinkSpeedAttr[0] 0x000a4030
Speed Attribute ID: 0 10Gb/s Symmetric RX SuperSpeedPlus
bmSublinkSpeedAttr[1] 0x000a40b0
Speed Attribute ID: 0 10Gb/s Symmetric TX SuperSpeedPlus
Device Status: 0x0000
(Bus Powered)
So ignore UAS driver for this device.
--- drivers/usb/storage/unusual_uas.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_uas.h +7 -0
@@ -52,6 +52,13 @@ UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x99 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME), +/* Reported-by: Zhihong Zhou <[email protected]> */ +UNUSUAL_DEV (0x0781 ,0x55e8 ,0x0000 ,0x9999 , +"SanDisk" , +"" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_IGNORE_UAS ), +/* Reported-by: Hongling Zeng <[email protected]> */ UNUSUAL_DEV(0x090c, 0x2000, 0x0000, 0x9999, "Hiksemi",
Greg Kroah-Hartman
maintainerPATCH 9/411 USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Yeh <[email protected]>
commit d3a889482bd5abf2bbdc1ec3d2d49575aa160c9c upstream.
Add new bcd (0x905) to support PL2303GT-2AB (TYPE_HXN). Add new bcd (0x1005) to support PL2303GC-Q20 (TYPE_HXN).
--- drivers/usb/serial/pl2303.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +2 -0
@@ -457,6 +457,8 @@ static int pl2303_detect_type(struct usbcase 0x605 :case 0x700 :/* GR */ case 0x705 : +case 0x905 :/* GT-2AB */ +case 0x1005 :/* GC-Q20 */ return TYPE_HXN ; }break ;
Greg Kroah-Hartman
maintainerPATCH 10/411 usb: usbtmc: Fix timeout value in get_stb
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
commit 342e4955a1f1ce28c70a589999b76365082dbf10 upstream.
wait_event_interruptible_timeout requires a timeout argument in units of jiffies. It was being called in usbtmc_get_stb with the usb timeout value which is in units of milliseconds.
Pass the timeout argument converted to jiffies.
--- drivers/usb/class/usbtmc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/class/usbtmc.c +3 -1
@@ -483,6 +483,7 @@ static int usbtmc_get_stb(struct usbtmc_u8 tag;int rv;long wait_rv; +unsigned long expire;dev_dbg (dev,"Enter ioctl_read_stb iin_ep_present: %d\n" , data->iin_ep_present);
@@ -512,10 +513,11 @@ static int usbtmc_get_stb(struct usbtmc_ }if (data->iin_ep_present) { + expire =msecs_to_jiffies (file_data->timeout); wait_rv =wait_event_interruptible_timeout ( data->waitq,atomic_read (&data->iin_data_valid) !=0 , - file_data->timeout); + expire);if (wait_rv <0 ) {dev_dbg (dev,"wait interrupted %ld\n" , wait_rv); rv = wait_rv;
Greg Kroah-Hartman
maintainerPATCH 11/411 thunderbolt: Do not double dequeue a configuration request
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
commit 0f73628e9da1ee39daf5f188190cdbaee5e0c98c upstream.
Some of our devices crash in tb_cfg_request_dequeue():
general protection fault, probably for non-canonical address 0xdead000000000122 CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65 RIP: 0010:tb_cfg_request_dequeue+0x2d/0xa0 Call Trace: <TASK> ? tb_cfg_request_dequeue+0x2d/0xa0 tb_cfg_request_work+0x33/0x80 worker_thread+0x386/0x8f0 kthread+0xed/0x110 ret_from_fork+0x38/0x50 ret_from_fork_asm+0x1b/0x30
The circumstances are unclear, however, the theory is that tb_cfg_request_work() can be scheduled twice for a request:
first time via frame.callback from ring_work() and second time from tb_cfg_request(). Both times kworkers will execute tb_cfg_request_dequeue(), which results in double list_del() from the ctl->request_queue (the list poison deference hints at it: 0xdead000000000122).
Do not dequeue requests that don't have TB_CFG_REQUEST_ACTIVE bit set.
--- drivers/thunderbolt/ctl.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/thunderbolt/ctl.c +5 -0
@@ -143,6 +143,11 @@ static void tb_cfg_request_dequeue(strucstruct tb_ctl *ctl = req->ctl;mutex_lock (&ctl->request_queue_lock); +if (!test_bit (TB_CFG_REQUEST_ACTIVE , &req->flags)) { +mutex_unlock (&ctl->request_queue_lock); +return ; + } +list_del (&req->list);clear_bit (TB_CFG_REQUEST_ACTIVE , &req->flags);if (test_bit (TB_CFG_REQUEST_CANCELED , &req->flags))
Greg Kroah-Hartman
maintainerPATCH 12/411 gfs2: gfs2_create_inode error handling fix
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit af4044fd0b77e915736527dd83011e46e6415f01 ]
When gfs2_create_inode() finds a directory, make sure to return -EISDIR.
--- fs/gfs2/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/gfs2/inode.c +2 -1
@@ -640,7 +640,8 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,if (!IS_ERR (inode)) {if (S_ISDIR (inode->i_mode)) {iput (inode); - inode =ERR_PTR (-EISDIR ); + inode =NULL ; + error = -EISDIR ; goto fail_gunlock; }d_instantiate (dentry, inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/411 perf/core: Fix broken throttling when max_samples_per_tick=1
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qing Wang <[email protected]>
[ Upstream commit f51972e6f8b9a737b2b3eb588069acb538fa72de ]
According to the throttling mechanism, the pmu interrupts number can not exceed the max_samples_per_tick in one tick. But this mechanism is ineffective when max_samples_per_tick=1, because the throttling check is skipped during the first interrupt and only performed when the second interrupt arrives.
Perhaps this bug may cause little influence in one tick, but if in a larger time scale, the problem can not be underestimated.
When max_samples_per_tick = 1:
Allowed-interrupts-per-second max-samples-per-second default-HZ ARCH 200 100 100 X86 500 250 250 ARM64
...
Obviously, the pmu interrupt number far exceed the user's expect.
--- kernel/events/core.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
kernel/events/core.c +8 -8
@@ -9401,14 +9401,14 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle) hwc->interrupts =1 ; }else { hwc->interrupts++; -if (unlikely (throttle && - hwc->interrupts > max_samples_per_tick)) { -__this_cpu_inc (perf_throttled_count); -tick_dep_set_cpu (smp_processor_id (),TICK_DEP_BIT_PERF_EVENTS ); - hwc->interrupts =MAX_INTERRUPTS ; -perf_log_throttle (event,0 ); - ret =1 ; - } + } + +if (unlikely (throttle && hwc->interrupts >= max_samples_per_tick)) { +__this_cpu_inc (perf_throttled_count); +tick_dep_set_cpu (smp_processor_id (),TICK_DEP_BIT_PERF_EVENTS ); + hwc->interrupts =MAX_INTERRUPTS ; +perf_log_throttle (event,0 ); + ret =1 ; }if (event->attr.freq) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/411 crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corentin Labbe <[email protected]>
[ Upstream commit 2dfc7cd74a5e062a5405560447517e7aab1c7341 ]
When testing sun8i-ss with multi_v7_defconfig, all CBC algorithm fail crypto selftests.
This is strange since on sunxi_defconfig, everything was ok.
The problem was in the IV setup loop which never run because sg_dma_len was 0.
--- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +1 -1
@@ -117,7 +117,7 @@ static int sun8i_ss_setup_ivs(struct skcipher_request *areq)/* we need to copy all IVs from source in case DMA is bi-directionnal */ while (sg && len) { -if (sg_dma_len (sg) ==0 ) { +if (sg->length ==0 ) { sg =sg_next (sg);continue ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/411 x86/cpu: Sanitize CPUID(0x80000000) output
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
[ Upstream commit cc663ba3fe383a628a812f893cc98aafff39ab04 ]
CPUID(0x80000000).EAX returns the max extended CPUID leaf available. On x86-32 machines without an extended CPUID range, a CPUID(0x80000000) query will just repeat the output of the last valid standard CPUID leaf on the CPU; i.e., a garbage values. Current tip:x86/cpu code protects against this by doing:
eax = cpuid_eax(0x80000000);
c->extended_cpuid_level = eax;
if ((eax & 0xffff0000) == 0x80000000) {
// CPU has an extended CPUID range. Check for 0x80000001
if (eax >= 0x80000001) {
cpuid(0x80000001, ...);
}
}This is correct so far. Afterwards though, the same possibly broken EAX value is used to check the availability of other extended CPUID leaves:
if (c->extended_cpuid_level >= 0x80000007) ... if (c->extended_cpuid_level >= 0x80000008) ... if (c->extended_cpuid_level >= 0x8000000a) ... if (c->extended_cpuid_level >= 0x8000001f) ...
which is invalid. Fix this by immediately setting the CPU's max extended CPUID leaf to zero if CPUID(0x80000000).EAX doesn't indicate a valid CPUID extended range.
While at it, add a comment, similar to kernel/head_32.S, clarifying the CPUID(0x80000000) sanity check.
References: 8a50e5135af0 ("x86-32: Use symbolic constants, safer CPUID when enabling EFER.NX")
--- arch/x86/kernel/cpu/common.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
arch/x86/kernel/cpu/common.c +9 -8
@@ -937,17 +937,18 @@ void get_cpu_cap(struct cpuinfo_x86 *c) c->x86_capability[CPUID_D_1_EAX ] = eax; } -/* AMD-defined flags: level 0x80000001 */ +/* +* Check if extended CPUID leaves are implemented: Max extended +* CPUID leaf must be in the 0x80000001-0x8000ffff range. +*/ eax =cpuid_eax (0x80000000 ); - c->extended_cpuid_level = eax; + c->extended_cpuid_level = ((eax &0xffff0000 ) ==0x80000000 ) ? eax :0 ; -if ((eax &0xffff0000 ) ==0x80000000 ) { -if (eax >=0x80000001 ) { -cpuid (0x80000001 , &eax, &ebx, &ecx, &edx); +if (c->extended_cpuid_level >=0x80000001 ) { +cpuid (0x80000001 , &eax, &ebx, &ecx, &edx); - c->x86_capability[CPUID_8000_0001_ECX ] = ecx; - c->x86_capability[CPUID_8000_0001_EDX ] = edx; - } + c->x86_capability[CPUID_8000_0001_ECX ] = ecx; + c->x86_capability[CPUID_8000_0001_EDX ] = edx; }if (c->extended_cpuid_level >=0x80000007 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/411 crypto: marvell/cesa - Handle zero-length skcipher requests
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 8a4e047c6cc07676f637608a9dd675349b5de0a7 ]
Do not access random memory for zero-length skcipher requests. Just return 0.
--- drivers/crypto/marvell/cesa/cipher.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/marvell/cesa/cipher.c +3 -0
@@ -459,6 +459,9 @@ static int mv_cesa_skcipher_queue_req(struct skcipher_request *req,struct mv_cesa_skcipher_req *creq =skcipher_request_ctx (req);struct mv_cesa_engine *engine; +if (!req->cryptlen) +return 0 ; + ret =mv_cesa_skcipher_req_init (req, tmpl);if (ret)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/411 crypto: marvell/cesa - Avoid empty transfer descriptor
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 1bafd82d9a40cf09c6c40f1c09cc35b7050b1a9f ]
The user may set req->src even if req->nbytes == 0. If there is no data to hash from req->src, do not generate an empty TDMA descriptor.
--- drivers/crypto/marvell/cesa/hash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/marvell/cesa/hash.c +1 -1
@@ -663,7 +663,7 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req)if (ret) goto err_free_tdma; -if (iter.src.sg) { +if (iter.base.len > iter.src.op_offset) {/* * Add all the new data, inserting an operation block and * launch command between each full SRAM block-worth of
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/411 crypto: lrw - Only add ecb if it is not already there
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 3d73909bddc2ebb3224a8bc2e5ce00e9df70c15d ]
Only add ecb to the cipher name if it isn't already ecb.
Also use memcmp instead of strncmp since these strings are all stored in an array of length CRYPTO_MAX_ALG_NAME.
--- crypto/lrw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
crypto/lrw.c +2 -2
@@ -322,7 +322,7 @@ static int lrw_create(struct crypto_template *tmpl, struct rtattr **tb) err =crypto_grab_skcipher (spawn,skcipher_crypto_instance (inst), cipher_name,0 , mask); -if (err == -ENOENT ) { +if (err == -ENOENT &&memcmp (cipher_name,"ecb(" ,4 )) { err = -ENAMETOOLONG ;if (snprintf (ecb_name,CRYPTO_MAX_ALG_NAME ,"ecb(%s)" , cipher_name) >=CRYPTO_MAX_ALG_NAME )
@@ -356,7 +356,7 @@ static int lrw_create(struct crypto_template *tmpl, struct rtattr **tb)/* Alas we screwed up the naming so we have to mangle the * cipher name. */ -if (!strncmp (cipher_name,"ecb(" ,4 )) { +if (!memcmp (cipher_name,"ecb(" ,4 )) {int len; len =strscpy (ecb_name, cipher_name +4 ,sizeof (ecb_name));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/411 crypto: xts - Only add ecb if it is not already there
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 270b6f13454cb7f2f7058c50df64df409c5dcf55 ]
Only add ecb to the cipher name if it isn't already ecb.
Also use memcmp instead of strncmp since these strings are all stored in an array of length CRYPTO_MAX_ALG_NAME.
--- crypto/xts.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
crypto/xts.c +2 -2
@@ -361,7 +361,7 @@ static int xts_create(struct crypto_template *tmpl, struct rtattr **tb) err =crypto_grab_skcipher (&ctx->spawn,skcipher_crypto_instance (inst), cipher_name,0 , mask); -if (err == -ENOENT ) { +if (err == -ENOENT &&memcmp (cipher_name,"ecb(" ,4 )) { err = -ENAMETOOLONG ;if (snprintf (ctx->name,CRYPTO_MAX_ALG_NAME ,"ecb(%s)" , cipher_name) >=CRYPTO_MAX_ALG_NAME )
@@ -395,7 +395,7 @@ static int xts_create(struct crypto_template *tmpl, struct rtattr **tb)/* Alas we screwed up the naming so we have to mangle the * cipher name. */ -if (!strncmp (cipher_name,"ecb(" ,4 )) { +if (!memcmp (cipher_name,"ecb(" ,4 )) {int len; len =strscpy (ctx->name, cipher_name +4 ,sizeof (ctx->name));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/411 crypto: sun8i-ce - move fallback ahash_request to the end of the struct
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit c822831b426307a6ca426621504d3c7f99765a39 ]
'struct ahash_request' has a flexible array at the end, so it must be the last member in a struct, to avoid overwriting other struct members.
Therefore, move 'fallback_req' to the end of the 'sun8i_ce_hash_reqctx' struct.
--- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h +1 -1
@@ -296,8 +296,8 @@ struct sun8i_ce_hash_tfm_ctx {* @flow: the flow to use for this request */ struct sun8i_ce_hash_reqctx { -struct ahash_request fallback_req;int flow; +struct ahash_request fallback_req;// keep at the end };/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/411 EDAC/skx_common: Fix general protection fault
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 20d2d476b3ae18041be423671a8637ed5ffd6958 ]
After loading i10nm_edac (which automatically loads skx_edac_common), if unload only i10nm_edac, then reload it and perform error injection testing, a general protection fault may occur:
mce: [Hardware Error]: Machine check events logged
Oops: general protection fault ... ... Workqueue: events mce_gen_pool_process RIP: 0010:string+0x53/0xe0 ... Call Trace: <TASK> ? die_addr+0x37/0x90 ? exc_general_protection+0x1e7/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? string+0x53/0xe0 vsnprintf+0x23e/0x4c0 snprintf+0x4d/0x70 skx_adxl_decode+0x16a/0x330 [skx_edac_common] skx_mce_check_error.part.0+0xf8/0x220 [skx_edac_common] skx_mce_check_error+0x17/0x20 [skx_edac_common] ...
The issue arose was because the variable 'adxl_component_count' (inside skx_edac_common), which counts the ADXL components, was not reset. During the reloading of i10nm_edac, the count was incremented by the actual number of ADXL components again, resulting in a count that was double the real number of ADXL components. This led to an out-of-bounds reference to the ADXL component array, causing the general protection fault above.
Fix this issue by resetting the 'adxl_component_count' in adxl_put(), which is called during the unloading of {skx,i10nm}_edac.
--- drivers/edac/skx_common.c | 1 + 1 file changed, 1 insertion(+)
drivers/edac/skx_common.c +1 -0
@@ -112,6 +112,7 @@ EXPORT_SYMBOL_GPL(skx_adxl_get);void skx_adxl_put (void ) { + adxl_component_count =0 ;kfree (adxl_values);kfree (adxl_msg); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/411 power: reset: at91-reset: Optimize at91_reset()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <[email protected]>
[ Upstream commit 62d48983f215bf1dd48665913318101fa3414dcf ]
This patch adds a small optimization to the low-level at91_reset() function, which includes:
- Removes the extra branch, since the following store operations already have proper condition checks.
- Removes the definition of the clobber register r4, since it is no longer used in the code.
--- drivers/power/reset/at91-reset.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/power/reset/at91-reset.c +2 -3
@@ -81,12 +81,11 @@ static int at91_reset(struct notifier_block *this, unsigned long mode," str %4, [%0, %6]\n\t" /* Disable SDRAM1 accesses */ "1: tst %1, #0\n\t" -" beq 2f\n\t" " strne %3, [%1, #" __stringify(AT91_DDRSDRC_RTR) "]\n\t"/* Power down SDRAM1 */ " strne %4, [%1, %6]\n\t" /* Reset CPU */ - "2: str %5, [%2, #" __stringify(AT91_RSTC_CR) "]\n\t" + " str %5, [%2, #" __stringify(AT91_RSTC_CR) "]\n\t"" b .\n\t" :
@@ -97,7 +96,7 @@ static int at91_reset(struct notifier_block *this, unsigned long mode,"r" cpu_to_le32(AT91_DDRSDRC_LPCB_POWER_DOWN ),"r" (reset->args),"r" (reset->ramc_lpr) - : "r4"); + );return NOTIFY_DONE ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/411 PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit f0050a3e214aa941b78ad4caf122a735a24d81a6 ]
pm_show_wakelocks() is called to generate a string when showing attributes /sys/power/wake_(lock|unlock), but the string ends with an unwanted space that was added back by mistake by commit c9d967b2ce40 ("PM: wakeup: simplify the output logic of pm_show_wakelocks()").
Remove the unwanted space.
--- kernel/power/wakelock.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/power/wakelock.c +3 -0
@@ -49,6 +49,9 @@ ssize_t pm_show_wakelocks(char *buf, bool show_active) len +=sysfs_emit_at (buf, len,"%s " , wl->name); } +if (len >0 ) + --len; + len +=sysfs_emit_at (buf, len,"\n" );mutex_unlock (&wakelocks_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/411 x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaqing Zhao <[email protected]>
[ Upstream commit 824c6384e8d9275d4ec7204f3f79a4ac6bc10379 ]
When suspending, save_processor_state() calls mtrr_save_fixed_ranges() to save fixed-range MTRRs.
On platforms without fixed-range MTRRs like the ACRN hypervisor which has removed fixed-range MTRR emulation, accessing these MSRs will trigger an unchecked MSR access error. Make sure fixed-range MTRRs are supported before access to prevent such error.
Since mtrr_state.have_fixed is only set when MTRRs are present and enabled, checking the CPU feature flag in mtrr_save_fixed_ranges() is unnecessary.
--- arch/x86/kernel/cpu/mtrr/generic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/mtrr/generic.c +1 -1
@@ -349,7 +349,7 @@ static void get_fixed_ranges(mtrr_type *frs)void mtrr_save_fixed_ranges (void *info) { -if (boot_cpu_has (X86_FEATURE_MTRR )) +if (mtrr_state.have_fixed)get_fixed_ranges (mtrr_state.fixed_ranges); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/411 ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 8cf4fdac9bdead7bca15fc56fdecdf78d11c3ec6 ]
As specified in section 5.7.2 of the ACPI specification the feature group string "3.0 _SCP Extensions" implies that the operating system evaluates the _SCP control method with additional parameters.
However the ACPI thermal driver evaluates the _SCP control method without those additional parameters, conflicting with the above feature group string advertised to the firmware thru _OSI.
Stop advertising support for this feature string to avoid confusing the ACPI firmware.
--- drivers/acpi/osi.c | 1 - 1 file changed, 1 deletion(-)
drivers/acpi/osi.c +0 -1
@@ -42,7 +42,6 @@ static struct acpi_osi_entry osi_setup_entries[OSI_STRING_ENTRIES_MAX] __initdata = { {"Module Device", true}, {"Processor Device", true}, - {"3.0 _SCP Extensions", true}, {"Processor Aggregator Device", true},/* * Linux-Dell-Video is used by BIOS to disable RTD3 for NVidia graphics
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/411 spi: sh-msiof: Fix maximum DMA transfer size
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 0941d5166629cb766000530945e54b4e49680c68 ]
The maximum amount of data to transfer in a single DMA request is calculated from the FIFO sizes (which is technically not 100% correct, but a simplification, as it is limited by the maximum word count values in the Transmit and Control Data Registers). However, in case there is both data to transmit and to receive, the transmit limit is overwritten by the receive limit.
Fix this by using the minimum applicable FIFO size instead. Move the calculation outside the loop, so it is not repeated for each individual DMA transfer.
As currently tx_fifo_size is always equal to rx_fifo_size, this bug had no real impact.
--- drivers/spi/spi-sh-msiof.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/spi/spi-sh-msiof.c +7 -6
@@ -919,6 +919,7 @@ static int sh_msiof_transfer_one(struct spi_controller *ctlr,void *rx_buf = t->rx_buf;unsigned int len = t->len;unsigned int bits = t->bits_per_word; +unsigned int max_wdlen =256 ;unsigned int bytes_per_word;unsigned int words;int n;
@@ -932,17 +933,17 @@ static int sh_msiof_transfer_one(struct spi_controller *ctlr,if (!spi_controller_is_slave (p->ctlr))sh_msiof_spi_set_clk_regs (p, t); +if (tx_buf) + max_wdlen =min (max_wdlen, p->tx_fifo_size); +if (rx_buf) + max_wdlen =min (max_wdlen, p->rx_fifo_size); +while (ctlr->dma_tx && len >15 ) {/* * DMA supports 32-bit words only, hence pack 8-bit and 16-bit * words, with byte resp. word swapping. */ -unsigned int l =0 ; - -if (tx_buf) - l =min (round_down (len,4 ), p->tx_fifo_size *4 ); -if (rx_buf) - l =min (round_down (len,4 ), p->rx_fifo_size *4 ); +unsigned int l =min (round_down (len,4 ), max_wdlen *4 );if (bits <=8 ) { copy32 = copy_bswap32;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/411 drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit 820116a39f96bdc7d426c33a804b52f53700a919 ]
The function atomctrl_initialize_mc_reg_table() and atomctrl_initialize_mc_reg_table_v2_2() does not check the return value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to retrieve vram_info, it returns NULL which is later dereferenced.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +8 -0
@@ -144,6 +144,10 @@ int atomctrl_initialize_mc_reg_table( vram_info = (ATOM_VRAM_INFO_HEADER_V2_1 *)smu_atom_get_data_table (hwmgr->adev,GetIndexIntoMasterTable (DATA , VRAM_Info), &size, &frev, &crev); +if (!vram_info) { +pr_err ("Could not retrieve the VramInfo table!" ); +return -EINVAL ; + }if (module_index >= vram_info->ucNumOfVRAMModule) {pr_err ("Invalid VramInfo table." );
@@ -181,6 +185,10 @@ int atomctrl_initialize_mc_reg_table_v2_2( vram_info = (ATOM_VRAM_INFO_HEADER_V2_2 *)smu_atom_get_data_table (hwmgr->adev,GetIndexIntoMasterTable (DATA , VRAM_Info), &size, &frev, &crev); +if (!vram_info) { +pr_err ("Could not retrieve the VramInfo table!" ); +return -EINVAL ; + }if (module_index >= vram_info->ucNumOfVRAMModule) {pr_err ("Invalid VramInfo table." );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/411 media: rkvdec: Fix frame size enumeration
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit f270005b99fa19fee9a6b4006e8dee37c10f1944 ]
The VIDIOC_ENUM_FRAMESIZES ioctl should return all frame sizes (i.e. width and height in pixels) that the device supports for the given pixel format.
It doesn't make a lot of sense to return the frame-sizes in a stepwise manner, which is used to enforce hardware alignments requirements for CAPTURE buffers, for coded formats.
Instead, applications should receive an indication, about the maximum supported frame size for that hardware decoder, via a continuous frame-size enumeration.
--- drivers/staging/media/rkvdec/rkvdec.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/staging/media/rkvdec/rkvdec.c +8 -2
@@ -188,8 +188,14 @@ static int rkvdec_enum_framesizes(struct file *file, void *priv,if (!fmt)return -EINVAL ; - fsize->type =V4L2_FRMSIZE_TYPE_STEPWISE ; - fsize->stepwise = fmt->frmsize; + fsize->type =V4L2_FRMSIZE_TYPE_CONTINUOUS ; + fsize->stepwise.min_width =1 ; + fsize->stepwise.max_width = fmt->frmsize.max_width; + fsize->stepwise.step_width =1 ; + fsize->stepwise.min_height =1 ; + fsize->stepwise.max_height = fmt->frmsize.max_height; + fsize->stepwise.step_height =1 ; +return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/411 fs/ntfs3: handle hdr_first_de() return value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vatoropin <[email protected]>
[ Upstream commit af5cab0e5b6f8edb0be51a9f47f3f620e0b4fd70 ]
The hdr_first_de() function returns a pointer to a struct NTFS_DE. This pointer may be NULL. To handle the NULL error effectively, it is important to implement an error handler. This will help manage potential errors consistently.
Additionally, error handling for the return value already exists at other points where this function is called.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- fs/ntfs3/index.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ntfs3/index.c +8 -0
@@ -2173,6 +2173,10 @@ static int indx_get_entry_to_replace(struct ntfs_index *indx, e =hdr_first_de (&n->index->ihdr);fnd_push (fnd, n, e); +if (!e) { + err = -EINVAL ; + goto out; + }if (!de_is_last (e)) {/*
@@ -2194,6 +2198,10 @@ static int indx_get_entry_to_replace(struct ntfs_index *indx, n = fnd->nodes[level]; te =hdr_first_de (&n->index->ihdr); +if (!te) { + err = -EINVAL ; + goto out; + }/* Copy the candidate entry into the replacement entry buffer. */ re =kmalloc (le16_to_cpu (te->size) +sizeof (u64),GFP_NOFS );if (!re) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/411 m68k: mac: Fix macintosh_config for Mac II
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 52ae3f5da7e5adbe3d1319573b55dac470abb83c ]
When booted on my Mac II, the kernel prints this:
Detected Macintosh model: 6
Apple Macintosh Unknown
The catch-all entry ("Unknown") is mac_data_table[0] which is only needed in the unlikely event that the bootinfo model ID can't be matched. When model ID is 6, the search should begin and end at mac_data_table[1]. Fix the off-by-one error that causes this problem.
--- arch/m68k/mac/config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/mac/config.c +1 -1
@@ -798,7 +798,7 @@ static void __init mac_identify(void) } macintosh_config = mac_data_table; -for (m = macintosh_config; m->ident !=-1 ; m++) { +for (m = &mac_data_table[1 ]; m->ident !=-1 ; m++) {if (m->ident == model) { macintosh_config = m;break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/411 firmware: psci: Fix refcount leak in psci_dt_init
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
[ Upstream commit 7ff37d29fd5c27617b9767e1b8946d115cf93a1e ]
Fix a reference counter leak in psci_dt_init() where of_node_put(np) was missing after of_find_matching_node_and_match() when np is unavailable.
--- drivers/firmware/psci/psci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firmware/psci/psci.c +3 -1
@@ -619,8 +619,10 @@ int __init psci_dt_init(void) np =of_find_matching_node_and_match (NULL , psci_of_match, &matched_np); -if (!np || !of_device_is_available (np)) +if (!np || !of_device_is_available (np)) { +of_node_put (np);return -ENODEV ; + } init_fn = (psci_initcall_t )matched_np->data; ret =init_fn (np);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/411 selftests/seccomp: fix syscall_restart test for arm compat
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neill Kapron <[email protected]>
[ Upstream commit 797002deed03491215a352ace891749b39741b69 ]
The inconsistencies in the systcall ABI between arm and arm-compat can can cause a failure in the syscall_restart test due to the logic attempting to work around the differences. The 'machine' field for an ARM64 device running in compat mode can report 'armv8l' or 'armv8b' which matches with the string 'arm' when only examining the first three characters of the string.
This change adds additional validation to the workaround logic to make sure we only take the arm path when running natively, not in arm-compat.
--- tools/testing/selftests/seccomp/seccomp_bpf.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/testing/selftests/seccomp/seccomp_bpf.c +5 -2
@@ -3085,12 +3085,15 @@ TEST(syscall_restart) ret =get_syscall (_metadata, child_pid);#if defined(__arm__)/* -* FIXME: * - native ARM registers do NOT expose true syscall. * - compat ARM registers on ARM64 DO expose true syscall. +* - values of utsbuf.machine include 'armv8l' or 'armb8b' +* for ARM64 running in compat mode. */ ASSERT_EQ (0 ,uname (&utsbuf)); -if (strncmp (utsbuf.machine,"arm" ,3 ) ==0 ) { +if ((strncmp (utsbuf.machine,"arm" ,3 ) ==0 ) && + (strncmp (utsbuf.machine,"armv8l" ,6 ) !=0 ) && + (strncmp (utsbuf.machine,"armv8b" ,6 ) !=0 )) {EXPECT_EQ (__NR_nanosleep, ret); } else#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/411 drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 91e3bf09a90bb4340c0c3c51396e7531555efda4 ]
The rcar_du_vsps_init() doesn't free the np allocated by of_parse_phandle_with_fixed_args() for the non-error case.
Fix memory leak for the non-error case.
While at it, replace the label 'error'->'done' as it applies to non-error case as well and update the error check condition for rcar_du_vsp_init() to avoid breakage in future, if it returns positive value.
--- drivers/gpu/drm/rcar-du/rcar_du_kms.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/gpu/drm/rcar-du/rcar_du_kms.c +4 -6
@@ -627,7 +627,7 @@ static int rcar_du_vsps_init(struct rcar_du_device *rcdu) ret =of_parse_phandle_with_fixed_args (np, vsps_prop_name, cells, i, &args);if (ret <0 ) - goto error; + goto done;/* * Add the VSP to the list or update the corresponding existing
@@ -665,13 +665,11 @@ static int rcar_du_vsps_init(struct rcar_du_device *rcdu) vsp->dev = rcdu; ret =rcar_du_vsp_init (vsp, vsps[i].np, vsps[i].crtcs_mask); -if (ret <0 ) - goto error; +if (ret) + goto done; } -return 0 ; - -error: +done:for (i =0 ; i <ARRAY_SIZE (vsps); ++i)of_node_put (vsps[i].np);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/411 drm/vkms: Adjust vkms_state->active_planes allocation type
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 258aebf100540d36aba910f545d4d5ddf4ecaf0b ]
In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.)
The assigned type is "struct vkms_plane_state **", but the returned type will be "struct drm_plane **". These are the same size (pointer size), but the types don't match. Adjust the allocation type to match the assignment.
--- drivers/gpu/drm/vkms/vkms_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vkms/vkms_crtc.c +1 -1
@@ -202,7 +202,7 @@ static int vkms_crtc_atomic_check(struct drm_crtc *crtc, i++; } - vkms_state->active_planes =kcalloc (i,sizeof (plane),GFP_KERNEL ); + vkms_state->active_planes =kcalloc (i,sizeof (*vkms_state->active_planes),GFP_KERNEL );if (!vkms_state->active_planes)return -ENOMEM ; vkms_state->num_active_planes = i;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/411 drm/tegra: rgb: Fix the unbound reference count
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 3c3642335065c3bde0742b0edc505b6ea8fdc2b3 ]
The of_get_child_by_name() increments the refcount in tegra_dc_rgb_probe, but the driver does not decrement the refcount during unbind. Fix the unbound reference count using devm_add_action_or_reset() helper.
--- drivers/gpu/drm/tegra/rgb.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/gpu/drm/tegra/rgb.c +13 -1
@@ -193,6 +193,11 @@ static const struct drm_encoder_helper_funcs tegra_rgb_encoder_helper_funcs = { .atomic_check = tegra_rgb_encoder_atomic_check, }; +static void tegra_dc_of_node_put (void *data) +{ +of_node_put (data); +} +int tegra_dc_rgb_probe (struct tegra_dc *dc) {struct device_node *np;
@@ -200,7 +205,14 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)int err; np =of_get_child_by_name (dc->dev->of_node,"rgb" ); -if (!np || !of_device_is_available (np)) +if (!np) +return -ENODEV ; + + err =devm_add_action_or_reset (dc->dev, tegra_dc_of_node_put, np); +if (err <0 ) +return err; + +if (!of_device_is_available (np))return -ENODEV ; rgb =devm_kzalloc (dc->dev,sizeof (*rgb),GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/411 firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Yiwei <[email protected]>
[ Upstream commit 59529bbe642de4eb2191a541d9b4bae7eb73862e ]
SDEI usually initialize with the ACPI table, but on platforms where ACPI is not used, the SDEI feature can still be used to handle specific firmware calls or other customized purposes. Therefore, it is not necessary for ARM_SDE_INTERFACE to depend on ACPI_APEI_GHES.
In commit dc4e8c07e9e2 ("ACPI: APEI: explicit init of HEST and GHES in acpi_init()"), to make APEI ready earlier, sdei_init was moved into acpi_ghes_init instead of being a standalone initcall, adding ACPI_APEI_GHES dependency to ARM_SDE_INTERFACE. This restricts the flexibility and usability of SDEI.
This patch corrects the dependency in Kconfig and splits sdei_init() into two separate functions: sdei_init() and acpi_sdei_init(). sdei_init() will be called by arch_initcall and will only initialize the platform driver, while acpi_sdei_init() will initialize the device from acpi_ghes_init() when ACPI is ready. This allows the initialization of SDEI without ACPI_APEI_GHES enabled.
--- drivers/acpi/apei/Kconfig | 1 + drivers/acpi/apei/ghes.c | 2 +- drivers/firmware/Kconfig | 1 - drivers/firmware/arm_sdei.c | 11 ++++++++--- include/linux/arm_sdei.h | 4 ++-- 5 files changed, 12 insertions(+), 7 deletions(-)
drivers/acpi/apei/Kconfig +1 -0
@@ -23,6 +23,7 @@ config ACPI_APEI_GHES select ACPI_HED select IRQ_WORK select GENERIC_ALLOCATOR + select ARM_SDE_INTERFACE if ARM64 help Generic Hardware Error Source provides a way to report platform hardware errors (such as that from chipset). It
drivers/acpi/apei/ghes.c +1 -1
@@ -1478,7 +1478,7 @@ void __init ghes_init(void) {int rc; -sdei_init (); +acpi_sdei_init ();if (acpi_disabled)return ;
drivers/firmware/Kconfig +0 -1
@@ -40,7 +40,6 @@ config ARM_SCPI_POWER_DOMAIN config ARM_SDE_INTERFACE bool "ARM Software Delegated Exception Interface (SDEI)" depends on ARM64 - depends on ACPI_APEI_GHES help The Software Delegated Exception Interface (SDEI) is an ARM standard for registering callbacks from the platform firmware
drivers/firmware/arm_sdei.c +8 -3
@@ -1062,13 +1062,12 @@ static bool __init sdei_present_acpi(void)return true; } -void __init sdei_init (void ) +void __init acpi_sdei_init (void ) {struct platform_device *pdev;int ret; - ret =platform_driver_register (&sdei_driver); -if (ret || !sdei_present_acpi ()) +if (!sdei_present_acpi ())return ; pdev = platform_device_register_simple(sdei_driver.driver.name,
@@ -1081,6 +1080,12 @@ void __init sdei_init(void) } } +static int __init sdei_init (void ) +{ +return platform_driver_register (&sdei_driver); +} +arch_initcall (sdei_init); +int sdei_event_handler (struct pt_regs *regs,struct sdei_registered_event *arg) {
include/linux/arm_sdei.h +2 -2
@@ -46,12 +46,12 @@ int sdei_unregister_ghes(struct ghes *ghes);/* For use by arch code when CPU hotplug notifiers are not appropriate. */ int sdei_mask_local_cpu (void );int sdei_unmask_local_cpu (void ); -void __init sdei_init (void ); +void __init acpi_sdei_init (void );void sdei_handler_abort (void );#else static inline int sdei_mask_local_cpu (void ) {return 0 ; }static inline int sdei_unmask_local_cpu (void ) {return 0 ; } -static inline void sdei_init (void ) { } +static inline void acpi_sdei_init (void ) { }static inline void sdei_handler_abort (void ) { }#endif /* CONFIG_ARM_SDE_INTERFACE */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/411 wifi: ath11k: fix node corruption in ar->arvifs list
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stone Zhang <[email protected]>
[ Upstream commit 31e98e277ae47f56632e4d663b1d4fd12ba33ea8 ]
In current WLAN recovery code flow, ath11k_core_halt() only reinitializes the "arvifs" list head. This will cause the list node immediately following the list head to become an invalid list node. Because the prev of that node still points to the list head "arvifs", but the next of the list head "arvifs" no longer points to that list node.
When a WLAN recovery occurs during the execution of a vif removal, and it happens before the spin_lock_bh(&ar->data_lock) in ath11k_mac_op_remove_interface(), list_del() will detect the previously mentioned situation, thereby triggering a kernel panic.
The fix is to remove and reinitialize all vif list nodes from the list head "arvifs" during WLAN halt. The reinitialization is to make the list nodes valid, ensuring that the list_del() in ath11k_mac_op_remove_interface() can execute normally.
Call trace: __list_del_entry_valid_or_report+0xb8/0xd0 ath11k_mac_op_remove_interface+0xb0/0x27c [ath11k] drv_remove_interface+0x48/0x194 [mac80211] ieee80211_do_stop+0x6e0/0x844 [mac80211] ieee80211_stop+0x44/0x17c [mac80211] __dev_close_many+0xac/0x150 __dev_change_flags+0x194/0x234 dev_change_flags+0x24/0x6c devinet_ioctl+0x3a0/0x670 inet_ioctl+0x200/0x248 sock_do_ioctl+0x60/0x118 sock_ioctl+0x274/0x35c __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x48/0x114
...
Tested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04591-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
--- drivers/net/wireless/ath/ath11k/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/core.c +7 -1
@@ -968,6 +968,7 @@ static int ath11k_core_reconfigure_on_crash(struct ath11k_base *ab)void ath11k_core_halt (struct ath11k *ar) {struct ath11k_base *ab = ar->ab; +struct list_head *pos, *n;lockdep_assert_held (&ar->conf_mutex);
@@ -981,7 +982,12 @@ void ath11k_core_halt(struct ath11k *ar)rcu_assign_pointer (ab->pdevs_active[ar->pdev_idx],NULL );synchronize_rcu (); -INIT_LIST_HEAD (&ar->arvifs); + +spin_lock_bh (&ar->data_lock); +list_for_each_safe (pos, n, &ar->arvifs) +list_del_init (pos); +spin_unlock_bh (&ar->data_lock); +idr_init (&ar->txmgmt_idr); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/411 IB/cm: use rwlock for MAD agent lock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit 4dab26bed543584577b64b36aadb8b5b165bf44f ]
In workloads where there are many processes establishing connections using RDMA CM in parallel (large scale MPI), there can be heavy contention for mad_agent_lock in cm_alloc_msg.
This contention can occur while inside of a spin_lock_irq region, leading to interrupts being disabled for extended durations on many cores. Furthermore, it leads to the serialization of rdma_create_ah calls, which has negative performance impacts for NICs which are capable of processing multiple address handle creations in parallel.
The end result is the machine becoming unresponsive, hung task warnings, netdev TX timeouts, etc.
Since the lock appears to be only for protection from cm_remove_one, it can be changed to a rwlock to resolve these issues.
Reproducer:
Server:
for i in $(seq 1 512); do
ucmatose -c 32 -p $((i + 5000)) &
done
Client:
for i in $(seq 1 512); do
ucmatose -c 32 -p $((i + 5000)) -s 10.2.0.52 &
done
--- drivers/infiniband/core/cm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/infiniband/core/cm.c +8 -8
@@ -166,7 +166,7 @@ struct cm_port {struct cm_device {struct kref kref;struct list_head list; -spinlock_t mad_agent_lock; +rwlock_t mad_agent_lock;struct ib_device *ib_device;u8 ack_delay;int going_down;
@@ -283,7 +283,7 @@ static struct ib_mad_send_buf *cm_alloc_msg(struct cm_id_private *cm_id_priv)if (!cm_id_priv->av.port)return ERR_PTR (-EINVAL ); -spin_lock (&cm_id_priv->av.port->cm_dev->mad_agent_lock); +read_lock (&cm_id_priv->av.port->cm_dev->mad_agent_lock); mad_agent = cm_id_priv->av.port->mad_agent;if (!mad_agent) { m =ERR_PTR (-EINVAL );
@@ -314,7 +314,7 @@ static struct ib_mad_send_buf *cm_alloc_msg(struct cm_id_private *cm_id_priv) m->context[0 ] = cm_id_priv; out: -spin_unlock (&cm_id_priv->av.port->cm_dev->mad_agent_lock); +read_unlock (&cm_id_priv->av.port->cm_dev->mad_agent_lock);return m; }
@@ -1310,10 +1310,10 @@ static __be64 cm_form_tid(struct cm_id_private *cm_id_priv)if (!cm_id_priv->av.port)return cpu_to_be64 (low_tid); -spin_lock (&cm_id_priv->av.port->cm_dev->mad_agent_lock); +read_lock (&cm_id_priv->av.port->cm_dev->mad_agent_lock);if (cm_id_priv->av.port->mad_agent) hi_tid = ((u64 )cm_id_priv->av.port->mad_agent->hi_tid) <<32 ; -spin_unlock (&cm_id_priv->av.port->cm_dev->mad_agent_lock); +read_unlock (&cm_id_priv->av.port->cm_dev->mad_agent_lock);return cpu_to_be64 (hi_tid | low_tid); }
@@ -4365,7 +4365,7 @@ static int cm_add_one(struct ib_device *ib_device)return -ENOMEM ;kref_init (&cm_dev->kref); -spin_lock_init (&cm_dev->mad_agent_lock); +rwlock_init (&cm_dev->mad_agent_lock); cm_dev->ib_device = ib_device; cm_dev->ack_delay = ib_device->attrs.local_ca_ack_delay; cm_dev->going_down =0 ;
@@ -4481,9 +4481,9 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)* The above ensures no call paths from the work are running, * the remaining paths all take the mad_agent_lock. */ -spin_lock (&cm_dev->mad_agent_lock); +write_lock (&cm_dev->mad_agent_lock); port->mad_agent =NULL ; -spin_unlock (&cm_dev->mad_agent_lock); +write_unlock (&cm_dev->mad_agent_lock);ib_unregister_mad_agent (mad_agent);ib_port_unregister_client_groups (ib_device, i, cm_counter_groups);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/411 bpf, sockmap: fix duplicated data transmission
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 3b4f14b794287be137ea2c6158765d1ea1e018a4 ]
In the !ingress path under sk_psock_handle_skb(), when sending data to the remote under snd_buf limitations, partial skb data might be transmitted.
Although we preserved the partial transmission state (offset/length), the state wasn't properly consumed during retries. This caused the retry path to resend the entire skb data instead of continuing from the previous offset, resulting in data overlap at the receiver side.
--- net/core/skmsg.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
net/core/skmsg.c +9 -5
@@ -639,11 +639,6 @@ static void sk_psock_backlog(struct work_struct *work)int ret;mutex_lock (&psock->work_mutex); -if (unlikely (state->len)) { - len = state->len; - off = state->off; - } -while ((skb =skb_peek (&psock->ingress_skb))) { len = skb->len; off =0 ;
@@ -653,6 +648,13 @@ static void sk_psock_backlog(struct work_struct *work) off = stm->offset; len = stm->full_len; } + +/* Resume processing from previous partial state */ +if (unlikely (state->len)) { + len = state->len; + off = state->off; + } + ingress =skb_bpf_ingress (skb);skb_bpf_redirect_clear (skb); do {
@@ -680,6 +682,8 @@ static void sk_psock_backlog(struct work_struct *work) len -= ret; }while (len); +/* The entire skb sent, clear state */ +sk_psock_skb_state (psock, state,0 ,0 ); skb =skb_dequeue (&psock->ingress_skb);if (!ingress) {kfree_skb (skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/411 f2fs: fix to do sanity check on sbi->total_valid_block_count
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 05872a167c2cab80ef186ef23cc34a6776a1a30c ]
syzbot reported a f2fs bug as below:
------------[ cut here ]------------ kernel BUG at fs/f2fs/f2fs.h:2521! RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521 Call Trace: f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695 truncate_dnode+0x417/0x740 fs/f2fs/node.c:973 truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014 f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197 f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810 f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838 f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888 f2fs_setattr+0xc4f/0x12f0 fs/f2fs/file.c:1112 notify_change+0xbca/0xe90 fs/attr.c:552 do_truncate+0x222/0x310 fs/open.c:65 handle_truncate fs/namei.c:3466 [inline] do_open fs/namei.c:3849 [inline] path_openat+0x2e4f/0x35d0 fs/namei.c:4004 do_filp_open+0x284/0x4e0 fs/namei.c:4031 do_sys_openat2+0x12b/0x1d0 fs/open.c:1429 do_sys_open fs/open.c:1444 [inline] __do_sys_creat fs/open.c:1522 [inline] __se_sys_creat fs/open.c:1516 [inline] __x64_sys_creat+0x124/0x170 fs/open.c:1516 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
The reason is: in fuzzed image, sbi->total_valid_block_count is inconsistent w/ mapped blocks indexed by inode, so, we should not trigger panic for such case, instead, let's print log and set fsck flag.
--- fs/f2fs/f2fs.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/f2fs/f2fs.h +8 -2
@@ -2260,8 +2260,14 @@ static inline void dec_valid_block_count(struct f2fs_sb_info *sbi,blkcnt_t sectors = count <<F2FS_LOG_SECTORS_PER_BLOCK ;spin_lock (&sbi->stat_lock); -f2fs_bug_on (sbi, sbi->total_valid_block_count < (block_t ) count); - sbi->total_valid_block_count -= (block_t )count; +if (unlikely (sbi->total_valid_block_count < count)) { +f2fs_warn (sbi,"Inconsistent total_valid_block_count:%u, ino:%lu, count:%u" , + sbi->total_valid_block_count, inode->i_ino, count); + sbi->total_valid_block_count =0 ; +set_sbi_flag (sbi,SBI_NEED_FSCK ); + }else { + sbi->total_valid_block_count -= count; + }if (sbi->reserved_blocks && sbi->current_reserved_blocks < sbi->reserved_blocks) sbi->current_reserved_blocks = min(sbi->reserved_blocks,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/411 net: ncsi: Fix GCPS 64-bit member variables
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hari Kalavakunta <[email protected]>
[ Upstream commit e8a1bd8344054ce27bebf59f48e3f6bc10bc419b ]
Correct Get Controller Packet Statistics (GCPS) 64-bit wide member variables, as per DSP0222 v1.0.0 and forward specs. The Driver currently collects these stats, but they are yet to be exposed to the user. Therefore, no user impact.
Statistics fixes:
Total Bytes Received (byte range 28..35)
Total Bytes Transmitted (byte range 36..43) Total Unicast Packets Received (byte range 44..51) Total Multicast Packets Received (byte range 52..59) Total Broadcast Packets Received (byte range 60..67) Total Unicast Packets Transmitted (byte range 68..75) Total Multicast Packets Transmitted (byte range 76..83) Total Broadcast Packets Transmitted (byte range 84..91) Valid Bytes Received (byte range 204..11)
--- net/ncsi/internal.h | 21 ++++++++++----------- net/ncsi/ncsi-pkt.h | 23 +++++++++++------------ net/ncsi/ncsi-rsp.c | 21 ++++++++++----------- 3 files changed, 31 insertions(+), 34 deletions(-)
net/ncsi/internal.h +10 -11
@@ -143,16 +143,15 @@ struct ncsi_channel_vlan_filter { };struct ncsi_channel_stats { -u32 hnc_cnt_hi;/* Counter cleared */ -u32 hnc_cnt_lo;/* Counter cleared */ -u32 hnc_rx_bytes;/* Rx bytes */ -u32 hnc_tx_bytes;/* Tx bytes */ -u32 hnc_rx_uc_pkts;/* Rx UC packets */ -u32 hnc_rx_mc_pkts;/* Rx MC packets */ -u32 hnc_rx_bc_pkts;/* Rx BC packets */ -u32 hnc_tx_uc_pkts;/* Tx UC packets */ -u32 hnc_tx_mc_pkts;/* Tx MC packets */ -u32 hnc_tx_bc_pkts;/* Tx BC packets */ +u64 hnc_cnt;/* Counter cleared */ +u64 hnc_rx_bytes;/* Rx bytes */ +u64 hnc_tx_bytes;/* Tx bytes */ +u64 hnc_rx_uc_pkts;/* Rx UC packets */ +u64 hnc_rx_mc_pkts;/* Rx MC packets */ +u64 hnc_rx_bc_pkts;/* Rx BC packets */ +u64 hnc_tx_uc_pkts;/* Tx UC packets */ +u64 hnc_tx_mc_pkts;/* Tx MC packets */ +u64 hnc_tx_bc_pkts;/* Tx BC packets */ u32 hnc_fcs_err;/* FCS errors */ u32 hnc_align_err;/* Alignment errors */ u32 hnc_false_carrier;/* False carrier detection */
@@ -181,7 +180,7 @@ struct ncsi_channel_stats {u32 hnc_tx_1023_frames;/* Tx 512-1023 bytes frames */ u32 hnc_tx_1522_frames;/* Tx 1024-1522 bytes frames */ u32 hnc_tx_9022_frames;/* Tx 1523-9022 bytes frames */ -u32 hnc_rx_valid_bytes;/* Rx valid bytes */ +u64 hnc_rx_valid_bytes;/* Rx valid bytes */ u32 hnc_rx_runt_pkts;/* Rx error runt packets */ u32 hnc_rx_jabber_pkts;/* Rx error jabber packets */ u32 ncsi_rx_cmds;/* Rx NCSI commands */
net/ncsi/ncsi-pkt.h +11 -12
@@ -252,16 +252,15 @@ struct ncsi_rsp_gp_pkt {/* Get Controller Packet Statistics */ struct ncsi_rsp_gcps_pkt {struct ncsi_rsp_pkt_hdr rsp;/* Response header */ -__be32 cnt_hi;/* Counter cleared */ -__be32 cnt_lo;/* Counter cleared */ -__be32 rx_bytes;/* Rx bytes */ -__be32 tx_bytes;/* Tx bytes */ -__be32 rx_uc_pkts;/* Rx UC packets */ -__be32 rx_mc_pkts;/* Rx MC packets */ -__be32 rx_bc_pkts;/* Rx BC packets */ -__be32 tx_uc_pkts;/* Tx UC packets */ -__be32 tx_mc_pkts;/* Tx MC packets */ -__be32 tx_bc_pkts;/* Tx BC packets */ +__be64 cnt;/* Counter cleared */ +__be64 rx_bytes;/* Rx bytes */ +__be64 tx_bytes;/* Tx bytes */ +__be64 rx_uc_pkts;/* Rx UC packets */ +__be64 rx_mc_pkts;/* Rx MC packets */ +__be64 rx_bc_pkts;/* Rx BC packets */ +__be64 tx_uc_pkts;/* Tx UC packets */ +__be64 tx_mc_pkts;/* Tx MC packets */ +__be64 tx_bc_pkts;/* Tx BC packets */ __be32 fcs_err;/* FCS errors */ __be32 align_err;/* Alignment errors */ __be32 false_carrier;/* False carrier detection */
@@ -290,11 +289,11 @@ struct ncsi_rsp_gcps_pkt {__be32 tx_1023_frames;/* Tx 512-1023 bytes frames */ __be32 tx_1522_frames;/* Tx 1024-1522 bytes frames */ __be32 tx_9022_frames;/* Tx 1523-9022 bytes frames */ -__be32 rx_valid_bytes;/* Rx valid bytes */ +__be64 rx_valid_bytes;/* Rx valid bytes */ __be32 rx_runt_pkts;/* Rx error runt packets */ __be32 rx_jabber_pkts;/* Rx error jabber packets */ __be32 checksum;/* Checksum */ -}; +} __packed__aligned(4) ;/* Get NCSI Statistics */ struct ncsi_rsp_gns_pkt {
net/ncsi/ncsi-rsp.c +10 -11
@@ -926,16 +926,15 @@ static int ncsi_rsp_handler_gcps(struct ncsi_request *nr)/* Update HNC's statistics */ ncs = &nc->stats; - ncs->hnc_cnt_hi =ntohl (rsp->cnt_hi); - ncs->hnc_cnt_lo =ntohl (rsp->cnt_lo); - ncs->hnc_rx_bytes =ntohl (rsp->rx_bytes); - ncs->hnc_tx_bytes =ntohl (rsp->tx_bytes); - ncs->hnc_rx_uc_pkts =ntohl (rsp->rx_uc_pkts); - ncs->hnc_rx_mc_pkts =ntohl (rsp->rx_mc_pkts); - ncs->hnc_rx_bc_pkts =ntohl (rsp->rx_bc_pkts); - ncs->hnc_tx_uc_pkts =ntohl (rsp->tx_uc_pkts); - ncs->hnc_tx_mc_pkts =ntohl (rsp->tx_mc_pkts); - ncs->hnc_tx_bc_pkts =ntohl (rsp->tx_bc_pkts); + ncs->hnc_cnt =be64_to_cpu (rsp->cnt); + ncs->hnc_rx_bytes =be64_to_cpu (rsp->rx_bytes); + ncs->hnc_tx_bytes =be64_to_cpu (rsp->tx_bytes); + ncs->hnc_rx_uc_pkts =be64_to_cpu (rsp->rx_uc_pkts); + ncs->hnc_rx_mc_pkts =be64_to_cpu (rsp->rx_mc_pkts); + ncs->hnc_rx_bc_pkts =be64_to_cpu (rsp->rx_bc_pkts); + ncs->hnc_tx_uc_pkts =be64_to_cpu (rsp->tx_uc_pkts); + ncs->hnc_tx_mc_pkts =be64_to_cpu (rsp->tx_mc_pkts); + ncs->hnc_tx_bc_pkts =be64_to_cpu (rsp->tx_bc_pkts); ncs->hnc_fcs_err =ntohl (rsp->fcs_err); ncs->hnc_align_err =ntohl (rsp->align_err); ncs->hnc_false_carrier =ntohl (rsp->false_carrier);
@@ -964,7 +963,7 @@ static int ncsi_rsp_handler_gcps(struct ncsi_request *nr) ncs->hnc_tx_1023_frames =ntohl (rsp->tx_1023_frames); ncs->hnc_tx_1522_frames =ntohl (rsp->tx_1522_frames); ncs->hnc_tx_9022_frames =ntohl (rsp->tx_9022_frames); - ncs->hnc_rx_valid_bytes =ntohl (rsp->rx_valid_bytes); + ncs->hnc_rx_valid_bytes =be64_to_cpu (rsp->rx_valid_bytes); ncs->hnc_rx_runt_pkts =ntohl (rsp->rx_runt_pkts); ncs->hnc_rx_jabber_pkts =ntohl (rsp->rx_jabber_pkts);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/411 libbpf: Fix buffer overflow in bpf_object__init_prog
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <[email protected]>
[ Upstream commit ee684de5c1b0ac01821320826baec7da93f3615b ]
As shown in [1], it is possible to corrupt a BPF ELF file such that arbitrary BPF instructions are loaded by libbpf. This can be done by setting a symbol (BPF program) section offset to a large (unsigned) number such that <section start + symbol offset> overflows and points before the section data in the memory.
Consider the situation below where:
- prog_start = sec_start + symbol_offset <-- size_t overflow here
- prog_end = prog_start + prog_size
prog_start sec_start prog_end sec_end
| | | |
v v v v
.....................|################################|............
The report in [1] also provides a corrupted BPF ELF which can be used as a reproducer:
$ readelf -S crash
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
...
[ 2] uretprobe.mu[...] PROGBITS 0000000000000000 00000040
0000000000000068 0000000000000000 AX 0 0 8 $ readelf -s crash
Symbol table '.symtab' contains 8 entries:
Num: Value Size Type Bind Vis Ndx Name
...
6: ffffffffffffffb8 104 FUNC GLOBAL DEFAULT 2 handle_tpHere, the handle_tp prog has section offset ffffffffffffffb8, i.e. will point before the actual memory where section 2 is allocated.
This is also reported by AddressSanitizer:
=================================================================
==1232==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c7302fe0000 at pc 0x7fc3046e4b77 bp 0x7ffe64677cd0 sp 0x7ffe64677490
READ of size 104 at 0x7c7302fe0000 thread T0
#0 0x7fc3046e4b76 in memcpy (/lib64/libasan.so.8+0xe4b76)
#1 0x00000040df3e in bpf_object__init_prog /src/libbpf/src/libbpf.c:856
#2 0x00000040df3e in bpf_object__add_programs /src/libbpf/src/libbpf.c:928
#3 0x00000040df3e in bpf_object__elf_collect /src/libbpf/src/libbpf.c:3930
#4 0x00000040df3e in bpf_object_open /src/libbpf/src/libbpf.c:8067
#5 0x00000040f176 in bpf_object__open_file /src/libbpf/src/libbpf.c:8090
#6 0x000000400c16 in main /poc/poc.c:8
#7 0x7fc3043d25b4 in __libc_start_call_main (/lib64/libc.so.6+0x35b4)
#8 0x7fc3043d2667 in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x3667)
#9 0x000000400b34 in _start (/poc/poc+0x400b34)
0x7c7302fe0000 is located 64 bytes before 104-byte region [0x7c7302fe0040,0x7c7302fe00a8)
allocated by thread T0 here:
#0 0x7fc3046e716b in malloc (/lib64/libasan.so.8+0xe716b)
#1 0x7fc3045ee600 in __libelf_set_rawdata_wrlock (/lib64/libelf.so.1+0xb600)
#2 0x7fc3045ef018 in __elf_getdata_rdlock (/lib64/libelf.so.1+0xc018)
#3 0x00000040642f in elf_sec_data /src/libbpf/src/libbpf.c:3740The problem here is that currently, libbpf only checks that the program end is within the section bounds. There used to be a check while (sec_off < sec_sz) in bpf_object__add_programs, however, it was removed by commit 6245947c1b3c ("libbpf: Allow gaps in BPF program sections to support overriden weak functions").
Add a check for detecting the overflow of sec_off + prog_sz to bpf_object__init_prog to fix this issue.
[1] https://github.com/lmarch2/poc/blob/main/libbpf/libbpf.md
--- tools/lib/bpf/libbpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/libbpf.c +1 -1
@@ -692,7 +692,7 @@ bpf_object__add_programs(struct bpf_object *obj, Elf_Data *sec_data,return -LIBBPF_ERRNO__FORMAT ; } -if (sec_off + prog_sz > sec_sz) { +if (sec_off + prog_sz > sec_sz || sec_off + prog_sz < sec_off) {pr_warn ("sec '%s': program at offset %zu crosses section boundary\n" , sec_name, sec_off);return -LIBBPF_ERRNO__FORMAT ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/411 wifi: rtw88: do not ignore hardware read error during DPK
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 20d3c19bd8f9b498173c198eadf54580c8caa336 ]
In 'rtw8822c_dpk_cal_coef1()', do not ignore error returned by 'check_hw_ready()' but issue a warning to denote possible DPK issue. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/realtek/rtw88/rtw8822c.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw88/rtw8822c.c +2 -1
@@ -3946,7 +3946,8 @@ static void rtw8822c_dpk_cal_coef1(struct rtw_dev *rtwdev)rtw_write32 (rtwdev,REG_NCTL0 ,0x00001148 );rtw_write32 (rtwdev,REG_NCTL0 ,0x00001149 ); -check_hw_ready (rtwdev,0x2d9c ,MASKBYTE0 ,0x55 ); +if (!check_hw_ready (rtwdev,0x2d9c ,MASKBYTE0 ,0x55 )) +rtw_warn (rtwdev,"DPK stuck, performance may be suboptimal" );rtw_write8 (rtwdev,0x1b10 ,0x0 );rtw_write32_mask (rtwdev,REG_NCTL0 ,BIT_SUBPAGE ,0x0000000c );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/411 iommu: Protect against overflow in iommu_pgsize()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit e586e22974d2b7acbef3c6c3e01b2d5ce69efe33 ]
On a 32 bit system calling:
iommu_map(0, 0x40000000)
When using the AMD V1 page table type with a domain->pgsize of 0xfffff000 causes iommu_pgsize() to miscalculate a result of:
size=0x40000000 count=2
count should be 1. This completely corrupts the mapping process.
This is because the final test to adjust the pagesize malfunctions when the addition overflows. Use check_add_overflow() to prevent this.
--- drivers/iommu/iommu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iommu/iommu.c +3 -1
@@ -2411,6 +2411,7 @@ static size_t iommu_pgsize(struct iommu_domain *domain, unsigned long iova,unsigned int pgsize_idx, pgsize_idx_next;unsigned long pgsizes;size_t offset, pgsize, pgsize_next; +size_t offset_end;unsigned long addr_merge = paddr | iova;/* Page sizes supported by the hardware and small enough for @size */
@@ -2451,7 +2452,8 @@ static size_t iommu_pgsize(struct iommu_domain *domain, unsigned long iova,* If size is big enough to accommodate the larger page, reduce * the number of smaller pages. */ -if (offset + pgsize_next <= size) +if (!check_add_overflow (offset, pgsize_next, &offset_end) && + offset_end <= size) size = offset; out_set_count:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/411 f2fs: clean up w/ fscrypt_is_bounce_page()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 0c708e35cf26449ca317fcbfc274704660b6d269 ]
Just cleanup, no logic changes.
--- fs/f2fs/data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/data.c +1 -1
@@ -56,7 +56,7 @@ static bool __is_cp_guaranteed(struct page *page)struct inode *inode;struct f2fs_sb_info *sbi; -if (!mapping) +if (fscrypt_is_bounce_page (page))return false; inode = mapping->host;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/411 f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit aa1be8dd64163eca4dde7fd2557eb19927a06a47 ]
Jan Prusakowski reported a f2fs bug as below:
f2fs/007 will hang kernel during testing w/ below configs:
kernel 6.12.18 (from pixel-kernel/android16-6.12)
export MKFS_OPTIONS="-O encrypt -O extra_attr -O project_quota -O quota"
export F2FS_MOUNT_OPTIONS="test_dummy_encryption,discard,fsync_mode=nobarrier,reserve_root=32768,checkpoint_merge,atgc"
cat /proc/<umount_proc_id>/stack
f2fs_wait_on_all_pages+0xa3/0x130 do_checkpoint+0x40c/0x5d0 f2fs_write_checkpoint+0x258/0x550 kill_f2fs_super+0x14f/0x190 deactivate_locked_super+0x30/0xb0 cleanup_mnt+0xba/0x150 task_work_run+0x59/0xa0 syscall_exit_to_user_mode+0x12d/0x130 do_syscall_64+0x57/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e
cat /sys/kernel/debug/f2fs/status
- IO_W (CP: -256, Data: 256, Flush: ( 0 0 1), Discard: ( 0 0)) cmd: 0 undiscard: 0
CP IOs reference count becomes negative.
The root cause is:
After 4961acdd65c9 ("f2fs: fix to tag gcing flag on page during block migration"), we will tag page w/ gcing flag for raw page of cluster during its migration.
However, if the inode is both encrypted and compressed, during ioc_decompress(), it will tag page w/ gcing flag, and it increase F2FS_WB_DATA reference count:
- f2fs_write_multi_page
- f2fs_write_raw_page
- f2fs_write_single_page
- do_write_page
- f2fs_submit_page_write
- WB_DATA_TYPE(bio_page, fio->compressed_page)
: bio_page is encrypted, so mapping is NULL, and fio->compressed_page
is NULL, it returns F2FS_WB_DATA
- inc_page_count(.., F2FS_WB_DATA)
Then, during end_io(), it decrease F2FS_WB_CP_DATA reference count:
- f2fs_write_end_io
- f2fs_compress_write_end_io
- fscrypt_pagecache_folio
: get raw page from encrypted page
- WB_DATA_TYPE(&folio->page, false)
: raw page has gcing flag, it returns F2FS_WB_CP_DATA
- dec_page_count(.., F2FS_WB_CP_DATA)
In order to fix this issue, we need to detect gcing flag in raw page in f2fs_is_cp_guaranteed().
--- fs/f2fs/data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/data.c +1 -1
@@ -57,7 +57,7 @@ static bool __is_cp_guaranteed(struct page *page)struct f2fs_sb_info *sbi;if (fscrypt_is_bounce_page (page)) -return false; +return page_private_gcing (fscrypt_pagecache_page (page)); inode = mapping->host; sbi =F2FS_I_SB (inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/411 libbpf: Use proper errno value in linker
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit 358b1c0f56ebb6996fcec7dcdcf6bae5dcbc8b6c ]
Return values of the linker_append_sec_data() and the linker_append_elf_relos() functions are propagated all the way up to users of libbpf API. In some error cases these functions return -1 which will be seen as -EPERM from user's point of view. Instead, return a more reasonable -EINVAL.
--- tools/lib/bpf/linker.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/lib/bpf/linker.c +2 -2
@@ -1181,7 +1181,7 @@ static int linker_append_sec_data(struct bpf_linker *linker, struct src_obj *obj }else {if (!secs_match (dst_sec, src_sec)) {pr_warn ("ELF sections %s are incompatible\n" , src_sec->sec_name); -return -1 ; +return -EINVAL ; }/* "license" and "version" sections are deduped */
@@ -2027,7 +2027,7 @@ static int linker_append_elf_relos(struct bpf_linker *linker, struct src_obj *ob } }else if (!secs_match (dst_sec, src_sec)) {pr_warn ("sections %s are not compatible\n" , src_sec->sec_name); -return -1 ; +return -EINVAL ; }/* add_dst_sec() above could have invalidated linker->secs */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/411 netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huajian Yang <[email protected]>
[ Upstream commit aa04c6f45b9224b949aa35d4fa5f8d0ba07b23d4 ]
The config NF_CONNTRACK_BRIDGE will change the bridge forwarding for fragmented packets.
The original bridge does not know that it is a fragmented packet and forwards it directly, after NF_CONNTRACK_BRIDGE is enabled, function nf_br_ip_fragment and br_ip6_fragment will check the headroom.
In original br_forward, insufficient headroom of skb may indeed exist, but there's still a way to save the skb in the device driver after dev_queue_xmit.So droping the skb will change the original bridge forwarding in some cases.
--- net/bridge/netfilter/nf_conntrack_bridge.c | 12 ++++++------ net/ipv6/netfilter.c | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-)
net/bridge/netfilter/nf_conntrack_bridge.c +6 -6
@@ -59,19 +59,19 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk,struct ip_fraglist_iter iter;struct sk_buff *frag; -if (first_len - hlen > mtu || -skb_headroom (skb) < ll_rs) +if (first_len - hlen > mtu) goto blackhole; -if (skb_cloned (skb)) +if (skb_cloned (skb) || +skb_headroom (skb) < ll_rs) goto slow_path; skb_walk_frags(skb, frag) { -if (frag->len > mtu || -skb_headroom (frag) < hlen + ll_rs) +if (frag->len > mtu) goto blackhole; -if (skb_shared (frag)) +if (skb_shared (frag) || +skb_headroom (frag) < hlen + ll_rs) goto slow_path; }
net/ipv6/netfilter.c +6 -6
@@ -163,20 +163,20 @@ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,struct ip6_fraglist_iter iter;struct sk_buff *frag2; -if (first_len - hlen > mtu || -skb_headroom (skb) < (hroom +sizeof (struct frag_hdr ))) +if (first_len - hlen > mtu) goto blackhole; -if (skb_cloned (skb)) +if (skb_cloned (skb) || +skb_headroom (skb) < (hroom +sizeof (struct frag_hdr ))) goto slow_path; skb_walk_frags(skb, frag2) { -if (frag2->len > mtu || -skb_headroom (frag2) < (hlen + hroom +sizeof (struct frag_hdr ))) +if (frag2->len > mtu) goto blackhole;/* Partially cloned skb? */ -if (skb_shared (frag2)) +if (skb_shared (frag2) || +skb_headroom (frag2) < (hlen + hroom +sizeof (struct frag_hdr ))) goto slow_path; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/411 netfilter: nft_quota: match correctly when the quota just depleted
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Duan <[email protected]>
[ Upstream commit bfe7cfb65c753952735c3eed703eba9a8b96a18d ]
The xt_quota compares skb length with remaining quota, but the nft_quota compares it with consumed bytes.
The xt_quota can match consumed bytes up to quota at maximum. But the nft_quota break match when consumed bytes equal to quota.
i.e., nft_quota match consumed bytes in [0, quota - 1], not [0, quota].
--- net/netfilter/nft_quota.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
net/netfilter/nft_quota.c +13 -7
@@ -19,10 +19,16 @@ struct nft_quota { };static inline bool nft_overquota (struct nft_quota *priv, -const struct sk_buff *skb) +const struct sk_buff *skb, +bool *report) { -return atomic64_add_return (skb->len, priv->consumed) >= -atomic64_read (&priv->quota); +u64 consumed =atomic64_add_return (skb->len, priv->consumed); +u64 quota =atomic64_read (&priv->quota); + +if (report) + *report = consumed >= quota; + +return consumed > quota; }static inline bool nft_quota_invert (struct nft_quota *priv)
@@ -34,7 +40,7 @@ static inline void nft_quota_do_eval(struct nft_quota *priv,struct nft_regs *regs, const struct nft_pktinfo *pkt) { - if (nft_overquota(priv, pkt->skb) ^ nft_quota_invert(priv)) + if (nft_overquota(priv, pkt->skb, NULL) ^ nft_quota_invert(priv)) regs->verdict.code = NFT_BREAK; }
@@ -51,13 +57,13 @@ static void nft_quota_obj_eval(struct nft_object *obj, const struct nft_pktinfo *pkt) {struct nft_quota *priv =nft_obj_data (obj); -bool overquota; +bool overquota, report; - overquota =nft_overquota (priv, pkt->skb); + overquota =nft_overquota (priv, pkt->skb, &report);if (overquota ^nft_quota_invert (priv)) regs->verdict.code =NFT_BREAK ; -if (overquota && +if (report && !test_and_set_bit (NFT_QUOTA_DEPLETED_BIT , &priv->flags))nft_obj_notify (nft_net (pkt), obj->key.table, obj,0 ,0 ,NFT_MSG_NEWOBJ ,0 ,nft_pf (pkt),0 ,GFP_ATOMIC );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/411 RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 5d2ea5aebbb2f3ebde4403f9c55b2b057e5dd2d6 ]
Upon RQ destruction if the firmware command fails which is the last resource to be destroyed some SW resources were already cleaned regardless of the failure.
Now properly rollback the object to its original state upon such failure.
In order to avoid a use-after free in case someone tries to destroy the object again, which results in the following kernel trace:refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 37589 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) rfkill mlx5_core(OE) mlxdevm(OE) ib_uverbs(OE) ib_core(OE) psample mlxfw(OE) mlx_compat(OE) macsec tls pci_hyperv_intf sunrpc vfat fat virtio_net net_failover failover fuse loop nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_console virtio_gpu virtio_blk virtio_dma_buf virtio_mmio dm_mirror dm_region_hash dm_log dm_mod xpmem(OE) CPU: 0 UID: 0 PID: 37589 Comm: python3 Kdump: loaded Tainted: G OE ------- --- 6.12.0-54.el10.aarch64 #1 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0xf4/0x148 lr : refcount_warn_saturate+0xf4/0x148
sp : ffff80008b81b7e0
x29: ffff80008b81b7e0 x28: ffff000133d51600 x27: 0000000000000001
x26: 0000000000000000 x25: 00000000ffffffea x24: ffff00010ae80f00
x23: ffff00010ae80f80 x22: ffff0000c66e5d08 x21: 0000000000000000
x20: ffff0000c66e0000 x19: ffff00010ae80340 x18: 0000000000000006
x17: 0000000000000000 x16: 0000000000000020 x15: ffff80008b81b37f
x14: 0000000000000000 x13: 2e656572662d7265 x12: ffff80008283ef78
x11: ffff80008257efd0 x10: ffff80008283efd0 x9 : ffff80008021ed90 x8 : 0000000000000001 x7 : 00000000000bffe8 x6 : c0000000ffff7fff x5 : ffff0001fb8e3408 x4 : 0000000000000000 x3 : ffff800179993000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000133d51600
Call trace: refcount_warn_saturate+0xf4/0x148 mlx5_core_put_rsc+0x88/0xa0 [mlx5_ib] mlx5_core_destroy_rq_tracked+0x64/0x98 [mlx5_ib] mlx5_ib_destroy_wq+0x34/0x80 [mlx5_ib] ib_destroy_wq_user+0x30/0xc0 [ib_core] uverbs_free_wq+0x28/0x58 [ib_uverbs] destroy_hw_idr_uobject+0x34/0x78 [ib_uverbs] uverbs_destroy_uobject+0x48/0x240 [ib_uverbs] __uverbs_cleanup_ufile+0xd4/0x1a8 [ib_uverbs] uverbs_destroy_ufile_hw+0x48/0x120 [ib_uverbs] ib_uverbs_close+0x2c/0x100 [ib_uverbs] __fput+0xd8/0x2f0 __fput_sync+0x50/0x70 __arm64_sys_close+0x40/0x90 invoke_syscall.constprop.0+0x74/0xd0 do_el0_svc+0x48/0xe8 el0_svc+0x44/0x1d0 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x1a4/0x1a8
--- drivers/infiniband/hw/mlx5/qpc.c | 30 ++++++++++++++++++++++++++++-- include/linux/mlx5/driver.h | 1 + 2 files changed, 29 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/qpc.c +28 -2
@@ -21,8 +21,10 @@ mlx5_get_rsc(struct mlx5_qp_table *table, u32 rsn)spin_lock_irqsave (&table->lock, flags); common =radix_tree_lookup (&table->tree, rsn); -if (common) +if (common && !common->invalid)refcount_inc (&common->refcount); +else + common =NULL ;spin_unlock_irqrestore (&table->lock, flags);
@@ -172,6 +174,18 @@ static int create_resource_common(struct mlx5_ib_dev *dev,return 0 ; } +static void modify_resource_common_state (struct mlx5_ib_dev *dev, +struct mlx5_core_qp *qp, +bool invalid) +{ +struct mlx5_qp_table *table = &dev->qp_table; +unsigned long flags; + +spin_lock_irqsave (&table->lock, flags); + qp->common.invalid = invalid; +spin_unlock_irqrestore (&table->lock, flags); +} +static void destroy_resource_common (struct mlx5_ib_dev *dev,struct mlx5_core_qp *qp) {
@@ -584,8 +598,20 @@ int mlx5_core_create_rq_tracked(struct mlx5_ib_dev *dev, u32 *in, int inlen,int mlx5_core_destroy_rq_tracked (struct mlx5_ib_dev *dev,struct mlx5_core_qp *rq) { +int ret; + +/* The rq destruction can be called again in case it fails, hence we +* mark the common resource as invalid and only once FW destruction +* is completed successfully we actually destroy the resources. +*/ +modify_resource_common_state (dev, rq, true); + ret =destroy_rq_tracked (dev, rq->qpn, rq->uid); +if (ret) { +modify_resource_common_state (dev, rq, false); +return ret; + }destroy_resource_common (dev, rq); -return destroy_rq_tracked (dev, rq->qpn, rq->uid); +return 0 ; }static void destroy_sq_tracked (struct mlx5_ib_dev *dev,u32 sqn,u16 uid)
include/linux/mlx5/driver.h +1 -0
@@ -388,6 +388,7 @@ struct mlx5_core_rsc_common {enum mlx5_res_type res;refcount_t refcount;struct completion free; +bool invalid; };struct mlx5_uars_page {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/411 bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit 41d4ce6df3f4945341ec509a840cc002a413b6cc ]
With the latest LLVM bpf selftests build will fail with the following error message:
progs/profiler.inc.h:710:31: error: default initialization of an object of type 'typeof ((parent_task)->real_cred->uid.val)' (aka 'const unsigned int') leaves the object uninitialized and is incompatible with C++ [-Werror,-Wdefault-const-init-unsafe]
710 | proc_exec_data->parent_uid = BPF_CORE_READ(parent_task, real_cred, uid.val);
| ^
tools/testing/selftests/bpf/tools/include/bpf/bpf_core_read.h:520:35: note: expanded from macro 'BPF_CORE_READ'
520 | ___type((src), a, ##__VA_ARGS__) __r; \
| ^This happens because BPF_CORE_READ (and other macro) declare the variable __r using the ___type macro which can inherit const modifier from intermediate types.
Fix this by using __typeof_unqual__, when supported. (And when it is not supported, the problem shouldn't appear, as older compilers haven't complained.)
--- tools/lib/bpf/bpf_core_read.h | 6 ++++++ 1 file changed, 6 insertions(+)
tools/lib/bpf/bpf_core_read.h +6 -0
@@ -272,7 +272,13 @@ enum bpf_enum_value_kind {#define ___arrow10 (a, b, c, d, e, f, g, h, i, j) a->b->c->d->e->f->g->h->i->j#define ___arrow (...) ___apply(___arrow, ___narg(__VA_ARGS__))(__VA_ARGS__) +#if defined(__clang__) && (__clang_major__ >=19 ) +#define ___type (...) __typeof_unqual__(___arrow(__VA_ARGS__)) +#elif defined(__GNUC__) && (__GNUC__ >=14 ) +#define ___type (...) __typeof_unqual__(___arrow(__VA_ARGS__)) +#else #define ___type (...) typeof(___arrow(__VA_ARGS__)) +#endif #define ___read (read_fn, dst, src_type, src, accessor) \ read_fn((void *)(dst), sizeof(*(dst)), &((src_type)(src))->accessor)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/411 clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit afdfd829a99e467869e3ca1955fb6c6e337c340a ]
Compared to the msm-4.19 driver the mainline GDSC driver always sets the bits for en_rest, en_few & clk_dis, and if those values are not set per-GDSC in the respective driver then the default value from the GDSC driver is used. The downstream driver only conditionally sets clk_dis_wait_val if qcom,clk-dis-wait-val is given in devicetree.
Correct this situation by explicitly setting those values. For all GDSCs the reset value of those bits are used.
--- drivers/clk/qcom/gcc-sm6350.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/clk/qcom/gcc-sm6350.c +6 -0
@@ -2319,6 +2319,9 @@ static struct clk_branch gcc_video_xo_clk = {static struct gdsc usb30_prim_gdsc = { .gdscr =0x1a004 , + .en_rest_wait_val =0x2 , + .en_few_wait_val =0x2 , + .clk_dis_wait_val =0xf , .pd = { .name ="usb30_prim_gdsc" , },
@@ -2327,6 +2330,9 @@ static struct gdsc usb30_prim_gdsc = {static struct gdsc ufs_phy_gdsc = { .gdscr =0x3a004 , + .en_rest_wait_val =0x2 , + .en_few_wait_val =0x2 , + .clk_dis_wait_val =0xf , .pd = { .name ="ufs_phy_gdsc" , },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/411 clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit 73c46d9a93d071ca69858dea3f569111b03e549e ]
devm_kasprintf() returns NULL when memory allocation fails. Currently, raspberrypi_clk_register() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devm_kasprintf() to prevent this issue.
--- drivers/clk/bcm/clk-raspberrypi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/clk/bcm/clk-raspberrypi.c +2 -0
@@ -199,6 +199,8 @@ static struct clk_hw *raspberrypi_clk_register(struct raspberrypi_clk *rpi, init.name =devm_kasprintf (rpi->dev,GFP_KERNEL ,"fw-clk-%s" , rpi_firmware_clk_names[id]); +if (!init.name) +return ERR_PTR (-ENOMEM ); init.ops = &raspberrypi_firmware_clk_ops; init.flags =CLK_GET_RATE_NOCACHE ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/411 ktls, sockmap: Fix missing uncharge operation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 79f0c39ae7d3dc628c01b02f23ca5d01f9875040 ]
When we specify apply_bytes, we divide the msg into multiple segments, each with a length of 'send', and every time we send this part of the data using tcp_bpf_sendmsg_redir(), we use sk_msg_return_zero() to uncharge the memory of the specified 'send' size.
However, if the first segment of data fails to send, for example, the peer's buffer is full, we need to release all of the msg. When releasing the msg, we haven't uncharged the memory of the subsequent segments.
This modification does not make significant logical changes, but only fills in the missing uncharge places.
This issue has existed all along, until it was exposed after we added the
apply test in test_sockmap:
commit 3448ad23b34e ("selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap")
--- net/tls/tls_sw.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/tls/tls_sw.c +7 -0
@@ -893,6 +893,13 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, &msg_redir, send, flags);lock_sock (sk);if (err <0 ) { +/* Regardless of whether the data represented by +* msg_redir is sent successfully, we have already +* uncharged it via sk_msg_return_zero(). The +* msg->sg.size represents the remaining unprocessed +* data, which needs to be uncharged here. +*/ +sk_mem_uncharge (sk, msg->sg.size); *copied -=sk_msg_free_nocharge (sk, &msg_redir); msg->sg.size =0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/411 libbpf: Use proper errno value in nlattr
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit fd5fd538a1f4b34cee6823ba0ddda2f7a55aca96 ]
Return value of the validate_nla() function can be propagated all the way up to users of libbpf API. In case of error this libbpf version of validate_nla returns -1 which will be seen as -EPERM from user's point of view. Instead, return a more reasonable -EINVAL.
--- tools/lib/bpf/nlattr.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
tools/lib/bpf/nlattr.c +7 -8
@@ -63,16 +63,16 @@ static int validate_nla(struct nlattr *nla, int maxtype, minlen = nla_attr_minlen[pt->type];if (libbpf_nla_len (nla) < minlen) -return -1 ; +return -EINVAL ;if (pt->maxlen &&libbpf_nla_len (nla) > pt->maxlen) -return -1 ; +return -EINVAL ;if (pt->type ==LIBBPF_NLA_STRING ) {char *data =libbpf_nla_data (nla);if (data[libbpf_nla_len (nla) -1 ] !='\0' ) -return -1 ; +return -EINVAL ; }return 0 ;
@@ -118,19 +118,18 @@ int libbpf_nla_parse(struct nlattr *tb[], int maxtype, struct nlattr *head,if (policy) { err =validate_nla (nla, maxtype, policy);if (err <0 ) - goto errout; +return err; } -if (tb[type]) +if (tb[type]) {pr_warn ("Attribute of type %#x found multiple times in message, " "previous attribute is being ignored.\n" , type); + } tb[type] = nla; } - err =0 ; -errout: -return err; +return 0 ; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/411 pinctrl: at91: Fix possible out-of-boundary access
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 762ef7d1e6eefad9896560bfcb9bcf7f1b6df9c1 ]
at91_gpio_probe() doesn't check that given OF alias is not available or something went wrong when trying to get it. This might have consequences when accessing gpio_chips array with that value as an index. Note, that BUG() can be compiled out and hence won't actually perform the required checks.
--- drivers/pinctrl/pinctrl-at91.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-at91.c +5 -1
@@ -1820,12 +1820,16 @@ static int at91_gpio_probe(struct platform_device *pdev)struct at91_gpio_chip *at91_chip =NULL ;struct gpio_chip *chip;struct pinctrl_gpio_range *range; +int alias_idx;int ret =0 ;int irq, i; -int alias_idx =of_alias_get_id (np,"gpio" );uint32_t ngpio;char **names; + alias_idx =of_alias_get_id (np,"gpio" ); +if (alias_idx <0 ) +return alias_idx; +BUG_ON (alias_idx >=ARRAY_SIZE (gpio_chips));if (gpio_chips[alias_idx]) { ret = -EBUSY ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/411 bpf: Fix WARN() in get_bpf_raw_tp_regs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit 3880cdbed1c4607e378f58fa924c5d6df900d1d3 ]
syzkaller reported an issue:
WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 Modules linked in: CPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 RSP: 0018:ffffc90003636fa8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff81c6bc4c RDX: ffff888032efc880 RSI: ffffffff81c6bc83 RDI: 0000000000000005 RBP: ffff88806a730860 R08: 0000000000000005 R09: 0000000000000003 R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000004 R13: 0000000000000001 R14: ffffc90003637008 R15: 0000000000000900 FS: 0000000000000000(0000) GS:ffff8880d6cdf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7baee09130 CR3: 0000000029f5a000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1934 [inline] bpf_get_stack_raw_tp+0x24/0x160 kernel/trace/bpf_trace.c:1931 bpf_prog_ec3b2eefa702d8d3+0x43/0x47 bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline] bpf_trace_run3+0x23f/0x5a0 kernel/trace/bpf_trace.c:2405 __bpf_trace_mmap_lock_acquire_returned+0xfc/0x140 include/trace/events/mmap_lock.h:47 __traceiter_mmap_lock_acquire_returned+0x79/0xc0 include/trace/events/mmap_lock.h:47 __do_trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline] trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline] __mmap_lock_do_trace_acquire_returned+0x138/0x1f0 mm/mmap_lock.c:35 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:204 [inline] stack_map_get_build_id_offset+0x535/0x6f0 kernel/bpf/stackmap.c:157 __bpf_get_stack+0x307/0xa10 kernel/bpf/stackmap.c:483 ____bpf_get_stack kernel/bpf/stackmap.c:499 [inline] bpf_get_stack+0x32/0x40 kernel/bpf/stackmap.c:496 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1941 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1931 bpf_prog_ec3b2eefa702d8d3+0x43/0x47
Tracepoint like trace_mmap_lock_acquire_returned may cause nested call as the corner case show above, which will be resolved with more general method in the future. As a result, WARN_ON_ONCE will be triggered. As Alexei suggested, remove the WARN_ON_ONCE first.
--- kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/bpf_trace.c +1 -1
@@ -1408,7 +1408,7 @@ static struct pt_regs *get_bpf_raw_tp_regs(void)struct bpf_raw_tp_regs *tp_regs =this_cpu_ptr (&bpf_raw_tp_regs);int nest_level =this_cpu_inc_return (bpf_raw_tp_nest_level); -if (WARN_ON_ONCE (nest_level >ARRAY_SIZE (tp_regs->regs))) { +if (nest_level >ARRAY_SIZE (tp_regs->regs)) {this_cpu_dec (bpf_raw_tp_nest_level);return ERR_PTR (-EBUSY ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/411 clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Knecht <[email protected]>
[ Upstream commit 9e7acf70cf6aa7b22f67d911f50a8cd510e8fb00 ]
Fix mclk0 & mclk1 parent map to use correct GPLL6 configuration and freq_tbl to use GPLL6 instead of GPLL0 so that they tick at 24 MHz.
--- drivers/clk/qcom/gcc-msm8939.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/gcc-msm8939.c +2 -2
@@ -433,7 +433,7 @@ static const struct parent_map gcc_xo_gpll0_gpll1a_gpll6_sleep_map[] = { { P_XO, 0 }, { P_GPLL0, 1 }, { P_GPLL1_AUX, 2 }, - { P_GPLL6, 2 }, + { P_GPLL6, 3 }, { P_SLEEP_CLK, 6 }, };
@@ -1087,7 +1087,7 @@ static struct clk_rcg2 jpeg0_clk_src = { };static const struct freq_tbl ftbl_gcc_camss_mclk0_1_clk[] = { -F (24000000 ,P_GPLL0 ,1 ,1 ,45 ), +F (24000000 ,P_GPLL6 ,1 ,1 ,45 ),F (66670000 ,P_GPLL0 ,12 ,0 ,0 ), { } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/411 s390/bpf: Store backchain even for leaf progs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Leoshkevich <[email protected]>
[ Upstream commit 5f55f2168432298f5a55294831ab6a76a10cb3c3 ]
Currently a crash in a leaf prog (caused by a bug) produces the following call trace:
[<000003ff600ebf00>] bpf_prog_6df0139e1fbf2789_fentry+0x20/0x78
[<0000000000000000>] 0x0This is because leaf progs do not store backchain. Fix by making all progs do it. This is what GCC and Clang-generated code does as well. Now the call trace looks like this:
[<000003ff600eb0f2>] bpf_prog_6df0139e1fbf2789_fentry+0x2a/0x80
[<000003ff600ed096>] bpf_trampoline_201863462940+0x96/0xf4
[<000003ff600e3a40>] bpf_prog_05f379658fdd72f2_classifier_0+0x58/0xc0
[<000003ffe0aef070>] bpf_test_run+0x210/0x390
[<000003ffe0af0dc2>] bpf_prog_test_run_skb+0x25a/0x668
[<000003ffe038a90e>] __sys_bpf+0xa46/0xdb0
[<000003ffe038ad0c>] __s390x_sys_bpf+0x44/0x50
[<000003ffe0defea8>] __do_syscall+0x150/0x280
[<000003ffe0e01d5c>] system_call+0x74/0x98--- arch/s390/net/bpf_jit_comp.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
arch/s390/net/bpf_jit_comp.c +5 -7
@@ -543,17 +543,15 @@ static void bpf_jit_prologue(struct bpf_jit *jit, u32 stack_depth) }/* Setup stack and backchain */ if (is_first_pass (jit) || (jit->seen &SEEN_STACK )) { -if (is_first_pass (jit) || (jit->seen &SEEN_FUNC )) -/* lgr %w1,%r15 (backchain) */ -EMIT4 (0xb9040000 ,REG_W1 ,REG_15 ); +/* lgr %w1,%r15 (backchain) */ +EMIT4 (0xb9040000 ,REG_W1 ,REG_15 );/* la %bfp,STK_160_UNUSED(%r15) (BPF frame pointer) */ EMIT4_DISP (0x41000000 ,BPF_REG_FP ,REG_15 ,STK_160_UNUSED );/* aghi %r15,-STK_OFF */ EMIT4_IMM (0xa70b0000 ,REG_15 , -(STK_OFF + stack_depth)); -if (is_first_pass (jit) || (jit->seen &SEEN_FUNC )) -/* stg %w1,152(%r15) (backchain) */ -EMIT6_DISP_LH (0xe3000000 ,0x0024 ,REG_W1 ,REG_0 , -REG_15 ,152 ); +/* stg %w1,152(%r15) (backchain) */ +EMIT6_DISP_LH (0xe3000000 ,0x0024 ,REG_W1 ,REG_0 , +REG_15 ,152 ); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/411 wifi: rtw88: fix the para buffer size to avoid reading out of bounds
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <[email protected]>
[ Upstream commit 4c2c372de2e108319236203cce6de44d70ae15cd ]
Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', which reads 5 bytes:
void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)
{
...
SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);
SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));
...
SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));Detected using the static analysis tool - Svace.
--- drivers/net/wireless/realtek/rtw88/coex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw88/coex.c +1 -1
@@ -305,7 +305,7 @@ static void rtw_coex_tdma_timer_base(struct rtw_dev *rtwdev, u8 type) {struct rtw_coex *coex = &rtwdev->coex;struct rtw_coex_stat *coex_stat = &coex->stat; -u8 para[2 ] = {0 }; +u8 para[6 ] = {};u8 times;u16 tbtt_interval = coex_stat->wl_beacon_interval;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/411 wifi: ath9k_htc: Abort software beacon handling if disabled
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit ac4e317a95a1092b5da5b9918b7118759342641c ]
A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds read.
Prevent this by aborting the handling in ath9k_htc_swba() if beacons are not enabled.
--- drivers/net/wireless/ath/ath9k/htc_drv_beacon.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath9k/htc_drv_beacon.c +3 -0
@@ -290,6 +290,9 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv,struct ath_common *common =ath9k_hw_common (priv->ah);int slot; +if (!priv->cur_beacon_conf.enable_beacon) +return ; +if (swba->beacon_pending !=0 ) { priv->beacon.bmisscnt++;if (priv->beacon.bmisscnt >BSTUCK_THRESHOLD ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/411 netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 8b53f46eb430fe5b42d485873b85331d2de2c469 ]
With a VRF, ipv4 and ipv6 FIB expression behave differently.
fib daddr . iif oif
Will return the input interface name for ipv4, but the real device for ipv6. Example:
If VRF device name is tvrf and real (incoming) device is veth0. First round is ok, both ipv4 and ipv6 will yield 'veth0'.
But in the second round (incoming device will be set to "tvrf"), ipv4 will yield "tvrf" whereas ipv6 returns "veth0" for the second round too.
This makes ipv6 behave like ipv4.
A followup patch will add a test case for this, without this change it will fail with:
get element inet t fibif6iif { tvrf . dead:1::99 . tvrf } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
FAIL: did not find tvrf . dead:1::99 . tvrf in fibif6iif
Alternatively we could either not do anything at all or change ipv4 to also return the lower/real device, however, nft (userspace) doc says "iif: if fib lookup provides a route then check its output interface is identical to the packets input interface." which is what the nft fib ipv4 behaviour is.
--- net/ipv6/netfilter/nft_fib_ipv6.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/ipv6/netfilter/nft_fib_ipv6.c +9 -4
@@ -154,6 +154,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, {const struct nft_fib *priv =nft_expr_priv (expr);int noff =skb_network_offset (pkt->skb); +const struct net_device *found =NULL ;const struct net_device *oif =NULL ;u32 *dest = ®s->data[priv->dreg];struct ipv6hdr *iph, _iph;
@@ -198,11 +199,15 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,if (rt->rt6i_flags & (RTF_REJECT |RTF_ANYCAST |RTF_LOCAL )) goto put_rt_err; -if (oif && oif != rt->rt6i_idev->dev && -l3mdev_master_ifindex_rcu (rt->rt6i_idev->dev) != oif->ifindex) - goto put_rt_err; +if (!oif) { + found = rt->rt6i_idev->dev; + }else { +if (oif == rt->rt6i_idev->dev || +l3mdev_master_ifindex_rcu (rt->rt6i_idev->dev) == oif->ifindex) + found = oif; + } -nft_fib_store_result (dest, priv, rt->rt6i_idev->dev); +nft_fib_store_result (dest, priv, found); put_rt_err:ip6_rt_put (rt); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/411 vfio/type1: Fix error unwind in migration dirty bitmap allocation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 4518e5a60c7fbf0cdff393c2681db39d77b4f87e ]
When setting up dirty page tracking at the vfio IOMMU backend for device migration, if an error is encountered allocating a tracking bitmap, the unwind loop fails to free previously allocated tracking bitmaps. This occurs because the wrong loop index is used to generate the tracking object. This results in unintended memory usage for the life of the current DMA mappings where bitmaps were successfully allocated.
Use the correct loop index to derive the tracking object for freeing during unwind.
--- drivers/vfio/vfio_iommu_type1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vfio/vfio_iommu_type1.c +1 -1
@@ -303,7 +303,7 @@ static int vfio_dma_bitmap_alloc_all(struct vfio_iommu *iommu, size_t pgsize)struct rb_node *p;for (p =rb_prev (n); p; p =rb_prev (p)) { -struct vfio_dma *dma =rb_entry (n, +struct vfio_dma *dma =rb_entry (p, struct vfio_dma, node);vfio_dma_bitmap_free (dma);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/411 bpf, sockmap: Avoid using sk_socket after free when sending
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 8259eb0e06d8f64c700f5fbdb28a5c18e10de291 ]
The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected.
Race conditions:
'''
CPU0 CPU1
backlog::skb_send_sock
sendmsg_unlocked
sock_sendmsg
sock_sendmsg_nosec
close(fd):
...
ops->release() -> sock_map_close()
sk_socket->ops = NULL
free(socket)
sock->ops->sendmsg
^
panic here'''
The ref of psock become 0 after sock_map_close() executed. '''
void sock_map_close()
{
...
if (likely(psock)) {
...
// !! here we remove psock and the ref of psock become 0
sock_map_remove_links(sk, psock)
psock = sk_psock_get(sk);
if (unlikely(!psock))
goto no_psock; <=== Control jumps here via goto
...
cancel_delayed_work_sync(&psock->work); <=== not executed
sk_psock_put(sk, psock);
...
}'''
Based on the fact that we already wait for the workqueue to finish in sock_map_close() if psock is held, we simply increase the psock reference count to avoid race conditions.
With this patch, if the backlog thread is running, sock_map_close() will wait for the backlog thread to complete and cancel all pending work.
If no backlog running, any pending work that hasn't started by then will fail when invoked by sk_psock_get(), as the psock reference count have been zeroed, and sk_psock_drop() will cancel all jobs via cancel_delayed_work_sync().
In summary, we require synchronization to coordinate the backlog thread and close() thread.
The panic I catched:
'''
Workqueue: events sk_psock_backlog RIP: 0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ? __pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80
...
'''
--- net/core/skmsg.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/core/skmsg.c +8 -0
@@ -638,6 +638,13 @@ static void sk_psock_backlog(struct work_struct *work)bool ingress;int ret; +/* Increment the psock refcnt to synchronize with close(fd) path in +* sock_map_close(), ensuring we wait for backlog thread completion +* before sk_socket freed. If refcnt increment fails, it indicates +* sock_map_close() completed with sk_socket potentially already freed. +*/ +if (!sk_psock_get (psock->sk)) +return ;mutex_lock (&psock->work_mutex);while ((skb =skb_peek (&psock->ingress_skb))) { len = skb->len;
@@ -691,6 +698,7 @@ static void sk_psock_backlog(struct work_struct *work) } end:mutex_unlock (&psock->work_mutex); +sk_psock_put (psock->sk, psock); }struct sk_psock *sk_psock_init (struct sock *sk,int node)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/411 netfilter: nft_tunnel: fix geneve_opt dump
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 22a9613de4c29d7d0770bfb8a5a9d73eb8df7dad ]
When dumping a nft_tunnel with more than one geneve_opt configured the netlink attribute hierarchy should be as follow:
NFTA_TUNNEL_KEY_OPTS
| |--NFTA_TUNNEL_KEY_OPTS_GENEVE | | | |--NFTA_TUNNEL_KEY_GENEVE_CLASS | |--NFTA_TUNNEL_KEY_GENEVE_TYPE | |--NFTA_TUNNEL_KEY_GENEVE_DATA | |--NFTA_TUNNEL_KEY_OPTS_GENEVE | | | |--NFTA_TUNNEL_KEY_GENEVE_CLASS | |--NFTA_TUNNEL_KEY_GENEVE_TYPE | |--NFTA_TUNNEL_KEY_GENEVE_DATA | |--NFTA_TUNNEL_KEY_OPTS_GENEVE
...
Otherwise, userspace tools won't be able to fetch the geneve options configured correctly.
--- net/netfilter/nft_tunnel.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/nft_tunnel.c +4 -4
@@ -588,10 +588,10 @@ static int nft_tunnel_opts_dump(struct sk_buff *skb,struct geneve_opt *opt;int offset =0 ; - inner =nla_nest_start_noflag (skb,NFTA_TUNNEL_KEY_OPTS_GENEVE ); -if (!inner) - goto failure;while (opts->len > offset) { + inner =nla_nest_start_noflag (skb,NFTA_TUNNEL_KEY_OPTS_GENEVE ); +if (!inner) + goto failure; opt = (struct geneve_opt *)(opts->u.data + offset); if (nla_put_be16(skb, NFTA_TUNNEL_KEY_GENEVE_CLASS, opt->opt_class) ||
@@ -601,8 +601,8 @@ static int nft_tunnel_opts_dump(struct sk_buff *skb, opt->length * 4, opt->opt_data)) goto inner_failure; offset +=sizeof (*opt) + opt->length *4 ; +nla_nest_end (skb, inner); } -nla_nest_end (skb, inner); }nla_nest_end (skb, nest);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/411 net: usb: aqc111: fix error handling of usbnet read calls
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 405b0d610745fb5e84fc2961d9b960abb9f3d107 ]
Syzkaller, courtesy of syzbot, identified an error (see report [1]) in aqc111 driver, caused by incomplete sanitation of usb read calls' results. This problem is quite similar to the one fixed in commit 920a9fa27e78 ("net: asix: add proper error handling of usb read errors").
For instance, usbnet_read_cmd() may read fewer than 'size' bytes, even if the caller expected the full amount, and aqc111_read_cmd() will not check its result properly. As [1] shows, this may lead to MAC address in aqc111_bind() being only partly initialized, triggering KMSAN warnings.
Fix the issue by verifying that the number of bytes read is as expected and not less.
[1] Partial syzbot report:
BUG: KMSAN: uninit-value in is_valid_ether_addr include/linux/etherdevice.h:208 [inline] BUG: KMSAN: uninit-value in usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 is_valid_ether_addr include/linux/etherdevice.h:208 [inline] usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x4d1/0xd90 drivers/base/dd.c:658 __driver_probe_device+0x268/0x380 drivers/base/dd.c:800
...
Uninit was stored to memory at:
dev_addr_mod+0xb0/0x550 net/core/dev_addr_lists.c:582 __dev_addr_set include/linux/netdevice.h:4874 [inline] eth_hw_addr_set include/linux/etherdevice.h:325 [inline] aqc111_bind+0x35f/0x1150 drivers/net/usb/aqc111.c:717 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396
...
Uninit was stored to memory at:
ether_addr_copy include/linux/etherdevice.h:305 [inline] aqc111_read_perm_mac drivers/net/usb/aqc111.c:663 [inline] aqc111_bind+0x794/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline]
...
Local variable buf.i created at:
aqc111_read_perm_mac drivers/net/usb/aqc111.c:656 [inline] aqc111_bind+0x221/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772
--- drivers/net/usb/aqc111.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/usb/aqc111.c +8 -2
@@ -30,10 +30,13 @@ static int aqc111_read_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value, ret =usbnet_read_cmd_nopm (dev, cmd,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , value, index, data, size); -if (unlikely (ret <0 )) +if (unlikely (ret < size)) { + ret = ret <0 ? ret : -ENODATA ; +netdev_warn (dev->net,"Failed to read(0x%x) reg index 0x%04x: %d\n" , cmd, index, ret); + }return ret; }
@@ -46,10 +49,13 @@ static int aqc111_read_cmd(struct usbnet *dev, u8 cmd, u16 value, ret =usbnet_read_cmd (dev, cmd,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , value, index, data, size); -if (unlikely (ret <0 )) +if (unlikely (ret < size)) { + ret = ret <0 ? ret : -ENODATA ; +netdev_warn (dev->net,"Failed to read(0x%x) reg index 0x%04x: %d\n" , cmd, index, ret); + }return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/411 bpf: Avoid __bpf_prog_ret0_warn when jit fails
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: KaFai Wan <[email protected]>
[ Upstream commit 86bc9c742426a16b52a10ef61f5b721aecca2344 ]
syzkaller reported an issue:
WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357 Modules linked in: CPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 RIP: 0010:__bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357 Call Trace: <TASK> bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] cls_bpf_classify+0x74a/0x1110 net/sched/cls_bpf.c:105 ...
When creating bpf program, 'fp->jit_requested' depends on bpf_jit_enable. This issue is triggered because of CONFIG_BPF_JIT_ALWAYS_ON is not set and bpf_jit_enable is set to 1, causing the arch to attempt JIT the prog, but jit failed due to FAULT_INJECTION. As a result, incorrectly treats the program as valid, when the program runs it calls __bpf_prog_ret0_warn and triggers the WARN_ON_ONCE(1).
--- kernel/bpf/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/core.c +1 -1
@@ -1909,7 +1909,7 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err)/* In case of BPF to BPF calls, verifier did all the prep * work with regards to JITing, etc. */ -bool jit_needed = false; +bool jit_needed = fp->jit_requested;if (fp->bpf_func) goto finalize;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/411 net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thangaraj Samynathan <[email protected]>
[ Upstream commit 68927eb52d0af04863584930db06075d2610e194 ]
rename the function to lan743x_hw_reset_phy to better describe it operation.
--- drivers/net/ethernet/microchip/lan743x_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/microchip/lan743x_main.c +2 -2
@@ -910,7 +910,7 @@ static int lan743x_mac_set_mtu(struct lan743x_adapter *adapter, int new_mtu) }/* PHY */ -static int lan743x_phy_reset (struct lan743x_adapter *adapter) +static int lan743x_hw_reset_phy (struct lan743x_adapter *adapter) {u32 data;
@@ -944,7 +944,7 @@ static void lan743x_phy_update_flowcontrol(struct lan743x_adapter *adapter,static int lan743x_phy_init (struct lan743x_adapter *adapter) { -return lan743x_phy_reset (adapter); +return lan743x_hw_reset_phy (adapter); }static void lan743x_phy_link_status_change (struct net_device *netdev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/411 calipso: Dont call calipso functions for AF_INET sk.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 6e9f2df1c550ead7cecb3e450af1105735020c92 ]
syzkaller reported a null-ptr-deref in txopt_get(). [0]
The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.
However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.
The root cause is missing validation in netlbl_conn_setattr().
netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.
The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.
We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.
Let's copy the validation to netlbl_conn_setattr().
[0]:
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:txopt_get include/net/ipv6.h:390 [inline] RIP: 0010: Code: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00 RSP: 0018:ffff88811b8afc48 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: 1ffff11023715f8a RCX: ffffffff841ab00c RDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070 RBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e R10: ffffed1023715f9d R11: 0000000000000003 R12: ffff888123075f00 R13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80 FS: 00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <TASK> calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557 netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177 selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569 selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline] selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615 selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931 security_socket_connect+0x50/0xa0 security/security.c:4598 __sys_connect_file+0xa4/0x190 net/socket.c:2067 __sys_connect+0x12c/0x170 net/socket.c:2088 __do_sys_connect net/socket.c:2098 [inline] __se_sys_connect net/socket.c:2095 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:2095 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f901b61a12d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f901b925fa0 RCX: 00007f901b61a12d RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000 </TASK> Modules linked in:
--- net/netlabel/netlabel_kapi.c | 3 +++ 1 file changed, 3 insertions(+)
net/netlabel/netlabel_kapi.c +3 -0
@@ -1140,6 +1140,9 @@ int netlbl_conn_setattr(struct sock *sk,break ;#if IS_ENABLED (CONFIG_IPV6 )case AF_INET6 : +if (sk->sk_family !=AF_INET6 ) +return -EAFNOSUPPORT ; + addr6 = (struct sockaddr_in6 *)addr; entry =netlbl_domhsh_getentry_af6 (secattr->domain, &addr6->sin6_addr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/411 net: openvswitch: Fix the dead loop of MPLS parse
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Faicker Mo <[email protected]>
[ Upstream commit 0bdc924bfb319fb10d1113cbf091fc26fb7b1f99 ]
The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck finally.
stack backtrace: UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 index -1 is out of range for type '__be32 [3]' CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-generic #131-Ubuntu Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021 Call Trace: <IRQ> show_stack+0x52/0x5c dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36 __ubsan_handle_out_of_bounds.cold+0x44/0x49 key_extract_l3l4+0x82a/0x840 [openvswitch] ? kfree_skbmem+0x52/0xa0 key_extract+0x9c/0x2b0 [openvswitch] ovs_flow_key_extract+0x124/0x350 [openvswitch] ovs_vport_receive+0x61/0xd0 [openvswitch] ? kernel_init_free_pages.part.0+0x4a/0x70 ? get_page_from_freelist+0x353/0x540 netdev_port_receive+0xc4/0x180 [openvswitch] ? netdev_port_receive+0x180/0x180 [openvswitch] netdev_frame_hook+0x1f/0x40 [openvswitch] __netif_receive_skb_core.constprop.0+0x23a/0xf00 __netif_receive_skb_list_core+0xfa/0x240 netif_receive_skb_list_internal+0x18e/0x2a0 napi_complete_done+0x7a/0x1c0 bnxt_poll+0x155/0x1c0 [bnxt_en] __napi_poll+0x30/0x180 net_rx_action+0x126/0x280 ? bnxt_msix+0x67/0x80 [bnxt_en] handle_softirqs+0xda/0x2d0 irq_exit_rcu+0x96/0xc0 common_interrupt+0x8e/0xa0 </IRQ>
--- net/openvswitch/flow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/openvswitch/flow.c +1 -1
@@ -644,7 +644,7 @@ static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key)memset (&key->ipv4,0 ,sizeof (key->ipv4)); } }else if (eth_p_mpls (key->eth.type)) { -u8 label_count =1 ; +size_t label_count =1 ;memset (&key->mpls,0 ,sizeof (key->mpls));skb_set_inner_network_header (skb, skb->mac_len);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/411 net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit 57a92d14659df3e7e7e0052358c8cc68bbbc3b5e ]
We have noticed that when PHY timestamping is enabled, L2 frames seems to be modified by changing two 2 bytes with a value of 0. The place were these 2 bytes seems to be random(or I couldn't find a pattern). In most of the cases the userspace can ignore these frames but if for example those 2 bytes are in the correction field there is nothing to do. This seems to happen when configuring the HW for IPv4 even that the flow is not enabled.
These 2 bytes correspond to the UDPv4 checksum and once we don't enable clearing the checksum when using L2 frames then the frame doesn't seem to be changed anymore.
--- drivers/net/phy/mscc/mscc_ptp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/phy/mscc/mscc_ptp.c +3 -1
@@ -943,7 +943,9 @@ static int vsc85xx_ip1_conf(struct phy_device *phydev, enum ts_blk blk,/* UDP checksum offset in IPv4 packet * according to: https://tools.ietf.org/html/rfc768 */ - val |=IP1_NXT_PROT_UDP_CHKSUM_OFF (26 ) |IP1_NXT_PROT_UDP_CHKSUM_CLEAR ; + val |=IP1_NXT_PROT_UDP_CHKSUM_OFF (26 ); +if (enable) + val |=IP1_NXT_PROT_UDP_CHKSUM_CLEAR ;vsc85xx_ts_write_csr (phydev, blk,MSCC_ANA_IP1_NXT_PROT_UDP_CHKSUM , val);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/411 f2fs: use d_inode(dentry) cleanup dentry->d_inode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiguo Niu <[email protected]>
[ Upstream commit a6c397a31f58a1d577c2c8d04b624e9baa31951c ]
no logic changes.
--- fs/f2fs/namei.c | 8 ++++---- fs/f2fs/super.c | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-)
fs/f2fs/namei.c +4 -4
@@ -406,7 +406,7 @@ static int f2fs_link(struct dentry *old_dentry, struct inode *dir,if (is_inode_flag_set (dir,FI_PROJ_INHERIT ) && (!projid_eq (F2FS_I (dir)->i_projid, -F2FS_I (old_dentry->d_inode)->i_projid))) +F2FS_I (inode)->i_projid)))return -EXDEV ; err =f2fs_dquot_initialize (dir);
@@ -885,7 +885,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,if (is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && (!projid_eq (F2FS_I (new_dir)->i_projid, -F2FS_I (old_dentry->d_inode)->i_projid))) +F2FS_I (old_inode)->i_projid)))return -EXDEV ;/*
@@ -1075,10 +1075,10 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,if ((is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && !projid_eq (F2FS_I (new_dir)->i_projid, -F2FS_I (old_dentry->d_inode)->i_projid)) || +F2FS_I (old_inode)->i_projid)) || (is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && !projid_eq (F2FS_I (old_dir)->i_projid, -F2FS_I (new_dentry->d_inode)->i_projid))) +F2FS_I (new_inode)->i_projid)))return -EXDEV ; err =f2fs_dquot_initialize (old_dir);
fs/f2fs/super.c +2 -2
@@ -1811,9 +1811,9 @@ static int f2fs_statfs(struct dentry *dentry, struct kstatfs *buf) buf->f_fsid =u64_to_fsid (id);#ifdef CONFIG_QUOTA -if (is_inode_flag_set (dentry->d_inode,FI_PROJ_INHERIT ) && +if (is_inode_flag_set (d_inode (dentry),FI_PROJ_INHERIT ) &&sb_has_quota_limits_enabled (sb,PRJQUOTA )) { -f2fs_statfs_project (sb,F2FS_I (dentry->d_inode)->i_projid, buf); +f2fs_statfs_project (sb,F2FS_I (d_inode (dentry))->i_projid, buf); }#endif return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/411 f2fs: fix to correct check conditions in f2fs_cross_rename
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiguo Niu <[email protected]>
[ Upstream commit 9883494c45a13dc88d27dde4f988c04823b42a2f ]
Should be "old_dir" here.
--- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/namei.c +1 -1
@@ -1076,7 +1076,7 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,if ((is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && !projid_eq (F2FS_I (new_dir)->i_projid,F2FS_I (old_inode)->i_projid)) || - (is_inode_flag_set (new_dir,FI_PROJ_INHERIT ) && + (is_inode_flag_set (old_dir,FI_PROJ_INHERIT ) && !projid_eq (F2FS_I (old_dir)->i_projid,F2FS_I (new_inode)->i_projid)))return -EXDEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/411 ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 67ba341e57ab158423818ed33bfa1c40eb0e5e7e ]
Dataflash did not work on my board. After checking schematics and using the proper GPIO, it works now. Also, make it active low to avoid:
flash@0 enforce active low on GPIO handle
--- arch/arm/boot/dts/usb_a9263.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/usb_a9263.dts +1 -1
@@ -58,7 +58,7 @@ }; spi0: spi@fffa4000 { - cs-gpios = <&pioB 15 GPIO_ACTIVE_HIGH>; + cs-gpios = <&pioA 5 GPIO_ACTIVE_LOW>; status = "okay"; mtd_dataflash@0 { compatible = "atmel,at45", "atmel,dataflash";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/411 ARM: dts: at91: at91sam9263: fix NAND chip selects
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit c72ede1c24be689733bcd2233a3a56f2478429c8 ]
NAND did not work on my USB-A9263. I discovered that the offending commit converted the PIO bank for chip selects wrongly, so all A9263 boards need to be fixed.
--- arch/arm/boot/dts/at91sam9263ek.dts | 2 +- arch/arm/boot/dts/tny_a9263.dts | 2 +- arch/arm/boot/dts/usb_a9263.dts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/at91sam9263ek.dts +1 -1
@@ -148,7 +148,7 @@ nand@3 { reg = <0x3 0x0 0x800000>; rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>; - cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>; + cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>; nand-bus-width = <8>; nand-ecc-mode = "soft"; nand-on-flash-bbt;
arch/arm/boot/dts/tny_a9263.dts +1 -1
@@ -64,7 +64,7 @@ nand@3 { reg = <0x3 0x0 0x800000>; rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>; - cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>; + cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>; nand-bus-width = <8>; nand-ecc-mode = "soft"; nand-on-flash-bbt;
arch/arm/boot/dts/usb_a9263.dts +1 -1
@@ -84,7 +84,7 @@ nand@3 { reg = <0x3 0x0 0x800000>; rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>; - cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>; + cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>; nand-bus-width = <8>; nand-ecc-mode = "soft"; nand-on-flash-bbt;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/411 arm64: dts: imx8mm-beacon: Fix RTC capacitive load
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit 2e98d456666d63f897ba153210bcef9d78ba0f3a ]
Although not noticeable when used every day, the RTC appears to drift when left to sit over time. This is due to the capacitive load not being properly set. Fix RTC drift by correcting the capacitive load setting from 7000 to 12500, which matches the actual hardware configuration.
--- arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi +1 -0
@@ -231,6 +231,7 @@ rtc: rtc@51 { compatible = "nxp,pcf85263"; reg = <0x51>; + quartz-load-femtofarads = <12500>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/411 arm64: dts: imx8mn-beacon: Fix RTC capacitive load
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit c3f03bec30efd5082b55876846d57b5d17dae7b9 ]
Although not noticeable when used every day, the RTC appears to drift when left to sit over time. This is due to the capacitive load not being properly set. Fix RTC drift by correcting the capacitive load setting from 7000 to 12500, which matches the actual hardware configuration.
--- arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi +1 -0
@@ -240,6 +240,7 @@ rtc: rtc@51 { compatible = "nxp,pcf85263"; reg = <0x51>; + quartz-load-femtofarads = <12500>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/411 Squashfs: check return result of sb_min_blocksize
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
[ Upstream commit 734aa85390ea693bb7eaf2240623d41b03705c84 ]
Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug.
Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails.
----msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize);
----
sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0.
As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64.
This subsequently causes the
UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36
shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long')
This commit adds a check for a 0 return by sb_min_blocksize().
--- fs/squashfs/super.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/squashfs/super.c +5 -0
@@ -136,6 +136,11 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc) msblk->panic_on_errors = (opts->errors == Opt_errors_panic); msblk->devblksize =sb_min_blocksize (sb,SQUASHFS_DEVBLK_SIZE ); +if (!msblk->devblksize) { +errorf (fc,"squashfs: unable to set blocksize\n" ); +return -EINVAL ; + } + msblk->devblksize_log2 =ffz (~msblk->devblksize);mutex_init (&msblk->meta_index_mutex);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/411 ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
[ Upstream commit cdc3ed3035d0fe934aa1d9b78ce256752fd3bb7d ]
If ocfs2_finish_quota_recovery() exits due to an error before passing all rc_list elements to ocfs2_recover_local_quota_file() then it can lead to a memory leak as rc_list may still contain elements that have to be freed.
Release all memory allocated by ocfs2_add_recovery_chunk() using ocfs2_free_quota_recovery() instead of kfree().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- fs/ocfs2/quota_local.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ocfs2/quota_local.c +1 -1
@@ -671,7 +671,7 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb,break ; } out: -kfree (rec); +ocfs2_free_quota_recovery (rec);return status; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/411 nilfs2: add pointer check for nilfs_direct_propagate()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit f43f02429295486059605997bc43803527d69791 ]
Patch series "nilfs2: improve sanity checks in dirty state propagation".
This fixes one missed check for block mapping anomalies and one improper return of an error code during a preparation step for log writing, thereby improving checking for filesystem corruption on writeback.
This patch (of 2):
In nilfs_direct_propagate(), the printer get from nilfs_direct_get_ptr() need to be checked to ensure it is not an invalid pointer.
If the pointer value obtained by nilfs_direct_get_ptr() is NILFS_BMAP_INVALID_PTR, means that the metadata (in this case, i_bmap in the nilfs_inode_info struct) that should point to the data block at the buffer head of the argument is corrupted and the data block is orphaned, meaning that the file system has lost consistency.
Add a value check and return -EINVAL when it is an invalid pointer.
--- fs/nilfs2/direct.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nilfs2/direct.c +3 -0
@@ -273,6 +273,9 @@ static int nilfs_direct_propagate(struct nilfs_bmap *bmap, dat =nilfs_bmap_get_dat (bmap); key =nilfs_bmap_data_get_key (bmap, bh); ptr =nilfs_direct_get_ptr (bmap, key); +if (ptr ==NILFS_BMAP_INVALID_PTR ) +return -EINVAL ; +if (!buffer_nilfs_volatile (bh)) { oldreq.pr_entry_nr = ptr; newreq.pr_entry_nr = ptr;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/411 nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit 8e39fbb1edbb4ec9d7c1124f403877fc167fcecd ]
In preparation for writing logs, in nilfs_btree_propagate(), which makes parent and ancestor node blocks dirty starting from a modified data block or b-tree node block, if the starting block does not belong to the b-tree, i.e. is isolated, nilfs_btree_do_lookup() called within the function fails with -ENOENT.
In this case, even though -ENOENT is an internal code, it is propagated to the log writer via nilfs_bmap_propagate() and may be erroneously returned to system calls such as fsync().
Fix this issue by changing the error code to -EINVAL in this case, and having the bmap layer detect metadata corruption and convert the error code appropriately.
--- fs/nilfs2/btree.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nilfs2/btree.c +3 -1
@@ -2096,11 +2096,13 @@ static int nilfs_btree_propagate(struct nilfs_bmap *btree, ret =nilfs_btree_do_lookup (btree, path, key,NULL , level +1 ,0 );if (ret <0 ) { -if (unlikely (ret == -ENOENT )) +if (unlikely (ret == -ENOENT )) {nilfs_crit (btree->b_inode->i_sb,"writing node/leaf block does not appear in b-tree (ino=%lu) at key=%llu, level=%d" , btree->b_inode->i_ino, (unsigned long long )key, level); + ret = -EINVAL ; + } goto out; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/411 bus: fsl-mc: fix double-free on mc_dev
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <[email protected]>
[ Upstream commit d694bf8a9acdbd061596f3e7549bc8cb70750a60 ]
The blamed commit tried to simplify how the deallocations are done but, in the process, introduced a double-free on the mc_dev variable.
In case the MC device is a DPRC, a new mc_bus is allocated and the mc_dev variable is just a reference to one of its fields. In this circumstance, on the error path only the mc_bus should be freed.
This commit introduces back the following checkpatch warning which is a false-positive.
WARNING: kfree(NULL) is safe and this check is probably not required
+ if (mc_bus)
+ kfree(mc_bus);
--- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/bus/fsl-mc/fsl-mc-bus.c +4 -2
@@ -907,8 +907,10 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc, error_cleanup_dev:kfree (mc_dev->regions); -kfree (mc_bus); -kfree (mc_dev); +if (mc_bus) +kfree (mc_bus); +else +kfree (mc_dev);return error; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/411 ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 325c6a441ae1f8fcb1db9bb945b8bdbd3142141e ]
Follow up the expected way of describing the SFPB hwspinlock and merge hwspinlock node into corresponding syscon node, fixing several dt-schema warnings.
--- arch/arm/boot/dts/qcom-apq8064.dtsi | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
arch/arm/boot/dts/qcom-apq8064.dtsi +4 -9
@@ -211,12 +211,6 @@ }; }; - sfpb_mutex: hwmutex { - compatible = "qcom,sfpb-mutex"; - syscon = <&sfpb_wrapper_mutex 0x604 0x4>; - #hwlock-cells = <1>; - }; - smem { compatible = "qcom,smem"; memory-region = <&smem_region>;
@@ -360,9 +354,10 @@ pinctrl-0 = <&ps_hold>; }; - sfpb_wrapper_mutex: syscon@1200000 { - compatible = "syscon"; - reg = <0x01200000 0x8000>; + sfpb_mutex: hwmutex@1200600 { + compatible = "qcom,sfpb-mutex"; + reg = <0x01200600 0x100>; + #hwlock-cells = <1>; }; intc: interrupt-controller@2000000 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/411 arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
[ Upstream commit febd8c6ab52c683b447fe22fc740918c86feae43 ]
The u2phy0_host port is the part of the USB PHY0 (namely the HOST0_DP/DM lanes) which routes directly to the USB2.0 HOST controller[1]. The other lanes of the PHY are routed to the USB3.0 OTG controller (dwc3), which we do use.
The HOST0_DP/DM lanes aren't routed on RK3399 Puma so let's simply disable the USB2.0 controllers.
USB3 OTG has been known to be unstable on RK3399 Puma Haikou for a while, one of the recurring issues being that only USB2 is detected and not USB3 in host mode. Reading the justification above and seeing that we are keeping u2phy0_host in the Haikou carrierboard DTS probably may have bothered you since it should be changed to u2phy0_otg. The issue is that if it's switched to that, USB OTG on Haikou is entirely broken. I have checked the routing in the Gerber file, the lanes are going to the expected ball pins (that is, NOT HOST0_DP/DM).u2phy0_host is for sure the wrong part of the PHY to use, but it's the only one that works at the moment for that board so keep it until we figure out what exactly is broken.
No intended functional change.
[1] https://rockchip.fr/Rockchip%20RK3399%20TRM%20V1.3%20Part2.pdf
Chapter 2 USB2.0 PHY
--- arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 8 -------- 1 file changed, 8 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts +0 -8
@@ -251,14 +251,6 @@ status = "okay"; }; -&usb_host0_ehci { - status = "okay"; -}; - -&usb_host0_ohci { - status = "okay"; -}; - &vopb { status = "okay"; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/411 soc: aspeed: lpc: Fix impossible judgment condition
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit d9f0a97e859bdcef51f9c187b1eb712eb13fd3ff ]
smatch error：drivers/soc/aspeed/aspeed-lpc-snoop.c:169 aspeed_lpc_snoop_config_irq() warn: platform_get_irq() does not return zero
platform_get_irq() return non-zero IRQ number or negative error code, change '!lpc_snoop->irq' to 'lpc_snoop->irq < 0' to fix this.
--- drivers/soc/aspeed/aspeed-lpc-snoop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/aspeed/aspeed-lpc-snoop.c +1 -1
@@ -167,7 +167,7 @@ static int aspeed_lpc_snoop_config_irq(struct aspeed_lpc_snoop *lpc_snoop,int rc; lpc_snoop->irq =platform_get_irq (pdev,0 ); -if (!lpc_snoop->irq) +if (lpc_snoop->irq <0 )return -ENODEV ; rc = devm_request_irq(dev, lpc_snoop->irq,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/411 soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit f1706e0e1a74b095cbc60375b9b1e6205f5f4c98 ]
devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devm_kasprintf() to prevent this issue.
--- drivers/soc/aspeed/aspeed-lpc-snoop.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/soc/aspeed/aspeed-lpc-snoop.c +13 -2
@@ -201,11 +201,15 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, lpc_snoop->chan[channel].miscdev.minor =MISC_DYNAMIC_MINOR ; lpc_snoop->chan[channel].miscdev.name =devm_kasprintf (dev,GFP_KERNEL ,"%s%d" ,DEVICE_NAME , channel); +if (!lpc_snoop->chan[channel].miscdev.name) { + rc = -ENOMEM ; + goto err_free_fifo; + } lpc_snoop->chan[channel].miscdev.fops = &snoop_fops; lpc_snoop->chan[channel].miscdev.parent = dev; rc =misc_register (&lpc_snoop->chan[channel].miscdev);if (rc) -return rc; + goto err_free_fifo;/* Enable LPC snoop channel at requested port */ switch (channel) {
@@ -222,7 +226,8 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, hicrb_en =HICRB_ENSNP1D ;break ;default : -return -EINVAL ; + rc = -EINVAL ; + goto err_misc_deregister; }regmap_update_bits (lpc_snoop->regmap,HICR5 , hicr5_en, hicr5_en);
@@ -232,6 +237,12 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop,regmap_update_bits (lpc_snoop->regmap,HICRB , hicrb_en, hicrb_en); +return 0 ; + +err_misc_deregister: +misc_deregister (&lpc_snoop->chan[channel].miscdev); +err_free_fifo: +kfifo_free (&lpc_snoop->chan[channel].fifo);return rc; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/411 fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit 3f6dae09fc8c306eb70fdfef70726e1f154e173a ]
In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow...
Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.
--- drivers/video/fbdev/core/fbcvt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/core/fbcvt.c +1 -1
@@ -312,7 +312,7 @@ int fb_find_mode_cvt(struct fb_videomode *mode, int margins, int rb) cvt.f_refresh = cvt.refresh; cvt.interlace =1 ; -if (!cvt.xres || !cvt.yres || !cvt.refresh) { +if (!cvt.xres || !cvt.yres || !cvt.refresh || cvt.f_refresh >INT_MAX ) {printk (KERN_INFO "fbcvt: Invalid input parameters\n" );return 1 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/411 randstruct: gcc-plugin: Remove bogus void member
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit e136a4062174a9a8d1c1447ca040ea81accfa6a8 ]
When building the randomized replacement tree of struct members, the randstruct GCC plugin would insert, as the first member, a 0-sized void member. This appears as though it was done to catch non-designated ("unnamed") static initializers, which wouldn't be stable since they depend on the original struct layout order.
This was accomplished by having the side-effect of the "void member" tripping an assert in GCC internals (count_type_elements) if the member list ever needed to be counted (e.g. for figuring out the order of members during a non-designated initialization), which would catch impossible type (void) in the struct:
security/landlock/fs.c: In function ‘hook_file_ioctl_common’:security/landlock/fs.c:1745:61: internal compiler error: in count_type_elements, at expr.cc:7075
1745 | .u.op = &(struct lsm_ioctlop_audit) {
| ^
static HOST_WIDE_INTcount_type_elements (const_tree type, bool for_ctor_p) {
switch (TREE_CODE (type))
...
case VOID_TYPE:
default:
gcc_unreachable ();
}
}However this is a redundant safety measure since randstruct uses the __designated_initializer attribute both internally and within the __randomized_layout attribute macro so that this would be enforced by the compiler directly even when randstruct was not enabled (via -Wdesignated-init).
A recent change in Landlock ended up tripping the same member counting routine when using a full-struct copy initializer as part of an anonymous initializer. This, however, is a false positive as the initializer is copying between identical structs (and hence identical layouts). The "path" member is "struct path", a randomized struct, and is being copied to from another "struct path", the "f_path" member:
landlock_log_denial(landlock_cred(file->f_cred), &(struct landlock_request) {
.type = LANDLOCK_REQUEST_FS_ACCESS,
.audit = {
.type = LSM_AUDIT_DATA_IOCTL_OP,
.u.op = &(struct lsm_ioctlop_audit) {
.path = file->f_path,
.cmd = cmd,
},
},
...As can be seen with the coming randstruct KUnit test, there appears to be no behavioral problems with this kind of initialization when the void member is removed from the randstruct GCC plugin, so remove it.
--- scripts/gcc-plugins/randomize_layout_plugin.c | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-)
scripts/gcc-plugins/randomize_layout_plugin.c +1 -17
@@ -377,29 +377,13 @@ static int relayout_struct(tree type)shuffle (type, (tree *)newtree, shuffle_length); -/* -* set up a bogus anonymous struct field designed to error out on unnamed struct initializers -* as gcc provides no other way to detect such code -*/ - list =make_node (FIELD_DECL ); -TREE_CHAIN (list) = newtree[0 ]; -TREE_TYPE (list) = void_type_node; -DECL_SIZE (list) = bitsize_zero_node; -DECL_NONADDRESSABLE_P (list) =1 ; -DECL_FIELD_BIT_OFFSET (list) = bitsize_zero_node; -DECL_SIZE_UNIT (list) = size_zero_node; -DECL_FIELD_OFFSET (list) = size_zero_node; -DECL_CONTEXT (list) = type; -// to satisfy the constify plugin -TREE_READONLY (list) =1 ; -for (i =0 ; i < num_fields -1 ; i++)TREE_CHAIN (newtree[i]) = newtree[i+1 ];TREE_CHAIN (newtree[num_fields -1 ]) =NULL_TREE ; main_variant =TYPE_MAIN_VARIANT (type);for (variant = main_variant; variant; variant =TYPE_NEXT_VARIANT (variant)) { -TYPE_FIELDS (variant) = list; +TYPE_FIELDS (variant) = newtree[0 ];TYPE_ATTRIBUTES (variant) =copy_list (TYPE_ATTRIBUTES (variant));TYPE_ATTRIBUTES (variant) =tree_cons (get_identifier ("randomize_performed" ),NULL_TREE ,TYPE_ATTRIBUTES (variant));TYPE_ATTRIBUTES (variant) =tree_cons (get_identifier ("designated_init" ),NULL_TREE ,TYPE_ATTRIBUTES (variant));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/411 randstruct: gcc-plugin: Fix attribute addition
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit f39f18f3c3531aa802b58a20d39d96e82eb96c14 ]
Based on changes in the 2021 public version of the randstruct out-of-tree GCC plugin[1], more carefully update the attributes on resulting decls, to avoid tripping checks in GCC 15's comptypes_check_enum_int() when it has been configured with "--enable-checking=misc":
arch/arm64/kernel/kexec_image.c:132:14: internal compiler error: in comptypes_check_enum_int, at c/c-typeck.cc:1519
132 | const struct kexec_file_ops kexec_image_ops = {
| ^~~~~~~~~~~~~~ internal_error(char const*, ...), at gcc/gcc/diagnostic-global-context.cc:517 fancy_abort(char const*, int, char const*), at gcc/gcc/diagnostic.cc:1803 comptypes_check_enum_int(tree_node*, tree_node*, bool*), at gcc/gcc/c/c-typeck.cc:1519
...
--- scripts/gcc-plugins/gcc-common.h | 32 +++++++++++++++++++ scripts/gcc-plugins/randomize_layout_plugin.c | 22 ++++++------- 2 files changed, 43 insertions(+), 11 deletions(-)
scripts/gcc-plugins/gcc-common.h +32 -0
@@ -137,6 +137,38 @@ static inline tree build_const_char_string(int len, const char *str)return cstr; } +static inline void __add_type_attr (tree type,const char *attr,tree args) +{ +tree oldattr; + +if (type ==NULL_TREE ) +return ; + oldattr =lookup_attribute (attr,TYPE_ATTRIBUTES (type)); +if (oldattr !=NULL_TREE ) { +gcc_assert (TREE_VALUE (oldattr) == args ||TREE_VALUE (TREE_VALUE (oldattr)) ==TREE_VALUE (args)); +return ; + } + +TYPE_ATTRIBUTES (type) =copy_list (TYPE_ATTRIBUTES (type)); +TYPE_ATTRIBUTES (type) =tree_cons (get_identifier (attr), args,TYPE_ATTRIBUTES (type)); +} + +static inline void add_type_attr (tree type,const char *attr,tree args) +{ +tree main_variant =TYPE_MAIN_VARIANT (type); + +__add_type_attr (TYPE_CANONICAL (type), attr, args); +__add_type_attr (TYPE_CANONICAL (main_variant), attr, args); +__add_type_attr (main_variant, attr, args); + +for (type =TYPE_NEXT_VARIANT (main_variant); type; type =TYPE_NEXT_VARIANT (type)) { +if (!lookup_attribute (attr,TYPE_ATTRIBUTES (type))) +TYPE_ATTRIBUTES (type) =TYPE_ATTRIBUTES (main_variant); + +__add_type_attr (TYPE_CANONICAL (type), attr, args); + } +} +#define PASS_INFO (NAME ,REF ,ID ,POS ) \ struct register_pass_info NAME##_pass_info = { \ .pass = make_##NAME##_pass(), \
scripts/gcc-plugins/randomize_layout_plugin.c +11 -11
@@ -95,6 +95,9 @@ static tree handle_randomize_layout_attr(tree *node, tree name, tree args, int fif (TYPE_P (*node)) { type = *node; + }else if (TREE_CODE (*node) ==FIELD_DECL ) { + *no_add_attrs = false; +return NULL_TREE ; }else {gcc_assert (TREE_CODE (*node) ==TYPE_DECL ); type =TREE_TYPE (*node);
@@ -381,15 +384,14 @@ static int relayout_struct(tree type)TREE_CHAIN (newtree[i]) = newtree[i+1 ];TREE_CHAIN (newtree[num_fields -1 ]) =NULL_TREE ; +add_type_attr (type,"randomize_performed" ,NULL_TREE ); +add_type_attr (type,"designated_init" ,NULL_TREE ); +if (has_flexarray) +add_type_attr (type,"has_flexarray" ,NULL_TREE ); + main_variant =TYPE_MAIN_VARIANT (type); -for (variant = main_variant; variant; variant =TYPE_NEXT_VARIANT (variant)) { +for (variant = main_variant; variant; variant =TYPE_NEXT_VARIANT (variant))TYPE_FIELDS (variant) = newtree[0 ]; -TYPE_ATTRIBUTES (variant) =copy_list (TYPE_ATTRIBUTES (variant)); -TYPE_ATTRIBUTES (variant) =tree_cons (get_identifier ("randomize_performed" ),NULL_TREE ,TYPE_ATTRIBUTES (variant)); -TYPE_ATTRIBUTES (variant) =tree_cons (get_identifier ("designated_init" ),NULL_TREE ,TYPE_ATTRIBUTES (variant)); -if (has_flexarray) -TYPE_ATTRIBUTES (type) =tree_cons (get_identifier ("has_flexarray" ),NULL_TREE ,TYPE_ATTRIBUTES (type)); - }/* * force a re-layout of the main variant
@@ -457,10 +459,8 @@ static void randomize_type(tree type)if (lookup_attribute ("randomize_layout" ,TYPE_ATTRIBUTES (TYPE_MAIN_VARIANT (type))) ||is_pure_ops_struct (type))relayout_struct (type); -for (variant =TYPE_MAIN_VARIANT (type); variant; variant =TYPE_NEXT_VARIANT (variant)) { -TYPE_ATTRIBUTES (type) =copy_list (TYPE_ATTRIBUTES (type)); -TYPE_ATTRIBUTES (type) =tree_cons (get_identifier ("randomize_considered" ),NULL_TREE ,TYPE_ATTRIBUTES (type)); - } +add_type_attr (type,"randomize_considered" ,NULL_TREE ); +#ifdef __DEBUG_PLUGINfprintf (stderr,"Marking randomize_considered on struct %s\n" ,ORIG_TYPE_NAME (type));#ifdef __DEBUG_VERBOSE
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/411 perf build: Warn when libdebuginfod devel files are not available
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 4fce4b91fd1aabb326c46e237eb4b19ab72598f8 ]
While working on 'perf version --build-options' I noticed that:
$ perf version --build-options
perf version 6.15.rc1.g312a07a00d31
aio: [ on ] # HAVE_AIO_SUPPORT
bpf: [ on ] # HAVE_LIBBPF_SUPPORT
bpf_skeletons: [ on ] # HAVE_BPF_SKEL
debuginfod: [ OFF ] # HAVE_DEBUGINFOD_SUPPORT
<SNIP>And looking at tools/perf/Makefile.config I also noticed that it is not opt-in, meaning we will attempt to build with it in all normal cases.
So add the usual warning at build time to let the user know that something recommended is missing, now we see:
Makefile.config:563: No elfutils/debuginfod.h found, no debuginfo server support, please install elfutils-debuginfod-client-devel or equivalent
And after following the recommendation:
$ perf check feature debuginfod
debuginfod: [ on ] # HAVE_DEBUGINFOD_SUPPORT
$ ldd ~/bin/perf | grep debuginfo
libdebuginfod.so.1 => /lib64/libdebuginfod.so.1 (0x00007fee5cf5f000)
$With this feature on several perf tools will fetch what is needed and not require all the contents of the debuginfo packages, for instance:
# rpm -qa | grep kernel-debuginfo
# pahole --running_kernel_vmlinux
pahole: couldn't find a vmlinux that matches the running kernel
HINT: Maybe you're inside a container or missing a debuginfo package?
#
# perf trace -e open* perf probe --vars icmp_rcv
0.000 ( 0.005 ms): perf/97391 openat(dfd: CWD, filename: "/etc/ld.so.cache", flags: RDONLY|CLOEXEC) = 3
0.014 ( 0.004 ms): perf/97391 openat(dfd: CWD, filename: "/lib64/libm.so.6", flags: RDONLY|CLOEXEC) = 3
<SNIP>
32130.100 ( 0.008 ms): perf/97391 openat(dfd: CWD, filename: "/root/.cache/debuginfod_client/aa3c82b4a13f9c0e0301bebb20fe958c4db6f362/debuginfo") = 3
<SNIP>
Available variables at icmp_rcv
@<icmp_rcv+0>
struct sk_buff* skb
<SNIP>
#
# pahole --running_kernel_vmlinux
/root/.cache/debuginfod_client/aa3c82b4a13f9c0e0301bebb20fe958c4db6f362/debuginfo
# file /root/.cache/debuginfod_client/aa3c82b4a13f9c0e0301bebb20fe958c4db6f362/debuginfo
/root/.cache/debuginfod_client/aa3c82b4a13f9c0e0301bebb20fe958c4db6f362/debuginfo: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=aa3c82b4a13f9c0e0301bebb20fe958c4db6f362, with debug_info, not stripped
# ls -la /root/.cache/debuginfod_client/aa3c82b4a13f9c0e0301bebb20fe958c4db6f362/debuginfo
-r--------. 1 root root 475401512 Mar 27 21:00 /root/.cache/debuginfod_client/aa3c82b4a13f9c0e0301bebb20fe958c4db6f362/debuginfo
#Then, cached:
# perf stat --null perf probe --vars icmp_rcv
Available variables at icmp_rcv
@<icmp_rcv+0>
struct sk_buff* skb Performance counter stats for 'perf probe --vars icmp_rcv':
0.671389041 seconds time elapsed
0.519176000 seconds user
0.150860000 seconds sys--- tools/perf/Makefile.config | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/Makefile.config +2 -0
@@ -538,6 +538,8 @@ ifndef NO_LIBELF ifeq ($(feature-libdebuginfod), 1) CFLAGS += -DHAVE_DEBUGINFOD_SUPPORT EXTLIBS += -ldebuginfod + else + $(warning No elfutils/debuginfod.h found, no debuginfo server support, please install libdebuginfod-dev/elfutils-debuginfod-client-devel or equivalent) endif endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/411 perf ui browser hists: Set actions->thread before calling do_zoom_thread()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 1741189d843a1d5ef38538bc52a3760e2e46cb2e ]
In 7cecb7fe8388d5c3 ("perf hists: Move sort__has_comm into struct perf_hpp_list") it assumes that act->thread is set prior to calling do_zoom_thread().
This doesn't happen when we use ESC or the Left arrow key to Zoom out of a specific thread, making this operation not to work and we get stuck into the thread zoom.
In 6422184b087ff435 ("perf hists browser: Simplify zooming code using pstack_peek()") it says no need to set actions->thread, and at that point that was true, but in 7cecb7fe8388d5c3 a actions->thread == NULL check was added before the zoom out of thread could kick in.
We can zoom out using the alternative 't' thread zoom toggle hotkey to finally set actions->thread before calling do_zoom_thread() and zoom out, but lets also fix the ESC/Zoom out of thread case.
--- tools/perf/ui/browsers/hists.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/ui/browsers/hists.c +1 -1
@@ -3238,10 +3238,10 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h/* * No need to set actions->dso here since * it's just to remove the current filter. -* Ditto for thread below. */ do_zoom_dso (browser, actions); }else if (top == &browser->hists->thread_filter) { + actions->thread = thread;do_zoom_thread (browser, actions); }else if (top == &browser->hists->socket_filter) {do_zoom_socket (browser, actions);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/411 backlight: pm8941: Add NULL check in wled_configure()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit e12d3e1624a02706cdd3628bbf5668827214fa33 ]
devm_kasprintf() returns NULL when memory allocation fails. Currently, wled_configure() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devm_kasprintf() to prevent this issue.
--- drivers/video/backlight/qcom-wled.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/video/backlight/qcom-wled.c +4 -2
@@ -1404,9 +1404,11 @@ static int wled_configure(struct wled *wled) wled->ctrl_addr =be32_to_cpu (*prop_addr); rc =of_property_read_string (dev->of_node,"label" , &wled->name); -if (rc) +if (rc) { wled->name =devm_kasprintf (dev,GFP_KERNEL ,"%pOFn" , dev->of_node); - +if (!wled->name) +return -ENOMEM ; + }switch (wled->version) {case 3 : u32_opts = wled3_opts;
Signature · 1 line
2.39.5
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.186 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.186-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm64 allyesconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.15.186-rc1.
Regressions found on arm64
* arm64, build
- gcc-12-allyesconfig
Regression Analysis:
- New regression? Yes
- Reproducibility? Yes
Build regression: stable-rc 5.15.186-rc1 arm64 drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute
## Build errorsdrivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute [-Werror=designated-init]
702 | {
| ^drivers/scsi/qedf/qedf_main.c:702:9: note: (near initialization for 'qedf_cb_ops')
cc1: all warnings being treated as errors
## Source
* Kernel version: 5.15.186-rc1
* Git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* Git sha: cab9785699236a7505c3f740e006a05ae70f47b0
* Git describe: v5.15.185-412-gcab978569923
* Project details:
https://regressions.linaro.org/lkft/linux-stable-rc-linux-5.15.y/v5.15.185-412-gcab978569923/
* Architectures: arm64
* Toolchains: gcc-12
* Kconfigs: allyesconfig
## Build arm64
* Build log: https://qa-reports.linaro.org/api/testruns/28835767/log_file/
* Build details:
https://regressions.linaro.org/lkft/linux-stable-rc-linux-5.15.y/v5.15.185-412-gcab978569923/build/gcc-12-allyesconfig/
* Build link: https://storage.tuxsuite.com/public/linaro/lkft/builds/2yuYENOCa5bRAG0bKRLJc7p69cI/
* Kernel config:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2yuYENOCa5bRAG0bKRLJc7p69cI/config
## Steps to reproduce
- tuxmake --runtime podman --target-arch arm64 --toolchain gcc-12
--kconfig allyesconfig
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerQuoted 42 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.186 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.186-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm64 allyesconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.15.186-rc1.
Regressions found on arm64
* arm64, build
- gcc-12-allyesconfigRegression Analysis:
- New regression? Yes
- Reproducibility? YesBuild regression: stable-rc 5.15.186-rc1 arm64
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute## Build errors
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute [-Werror=designated-init]
Quoted 5 lines
702 | { | ^
drivers/scsi/qedf/qedf_main.c:702:9: note: (near initialization for 'qedf_cb_ops')
cc1: all warnings being treated as errors
I saw this locally, at times, it's random, not always showing up. Turn off the gcc randconfig build option and it goes away, which explains the randomness I guess.
If you can bisect this to a real change that causes it, please let me know, I couldn't figure it out and so just gave up as I doubt anyone is really using that gcc plugin for that kernel version.
thanks,
greg k-h
Quoted 50 lines · Greg Kroah-Hartman
Quoted 42 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.186 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.186-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm64 allyesconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.15.186-rc1.
Regressions found on arm64
* arm64, build
- gcc-12-allyesconfigRegression Analysis:
- New regression? Yes
- Reproducibility? YesBuild regression: stable-rc 5.15.186-rc1 arm64
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute## Build errors
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute [-Werror=designated-init]Quoted 5 lines
702 | { | ^
drivers/scsi/qedf/qedf_main.c:702:9: note: (near initialization for 'qedf_cb_ops')
cc1: all warnings being treated as errors
Quoted 7 lines
I saw this locally, at times, it's random, not always showing up. Turn off the gcc randconfig build option and it goes away, which explains the randomness I guess.
If you can bisect this to a real change that causes it, please let me know, I couldn't figure it out and so just gave up as I doubt anyone is really using that gcc plugin for that kernel version.
You are right !
The reported arm64 allyesconfig build failures are due to,
randstruct: gcc-plugin: Remove bogus void member
[ Upstream commit e136a4062174a9a8d1c1447ca040ea81accfa6a8 ]
- Naresh
Quoted 4 lines
thanks,
greg k-h
Greg Kroah-Hartman
maintainerQuoted 60 lines · Naresh Kamboju
Quoted 50 lines · Greg Kroah-Hartman
Quoted 42 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.186 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.186-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm64 allyesconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.15.186-rc1.
Regressions found on arm64
* arm64, build
- gcc-12-allyesconfigRegression Analysis:
- New regression? Yes
- Reproducibility? YesBuild regression: stable-rc 5.15.186-rc1 arm64
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute## Build errors
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute [-Werror=designated-init]Quoted 5 lines
702 | { | ^
drivers/scsi/qedf/qedf_main.c:702:9: note: (near initialization for 'qedf_cb_ops')
cc1: all warnings being treated as errorsQuoted 7 lines
I saw this locally, at times, it's random, not always showing up. Turn off the gcc randconfig build option and it goes away, which explains the randomness I guess.
If you can bisect this to a real change that causes it, please let me know, I couldn't figure it out and so just gave up as I doubt anyone is really using that gcc plugin for that kernel version.
Quoted 5 lines
You are right !
The reported arm64 allyesconfig build failures are due to,randstruct: gcc-plugin: Remove bogus void member
[ Upstream commite136a4062174a9a8d1c1447ca040ea81accfa6a8]
Thanks for the bisection, for some reason that wasn't working for me. I've dropped this, and the other randstruct change from 5.15.y and older kernels now.
greg k-h
Quoted 64 lines · Greg Kroah-Hartman
Quoted 63 lines · Naresh Kamboju
Quoted 50 lines · Greg Kroah-Hartman
Quoted 42 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.186 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.186-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm64 allyesconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.15.186-rc1.
Regressions found on arm64
* arm64, build
- gcc-12-allyesconfigRegression Analysis:
- New regression? Yes
- Reproducibility? YesBuild regression: stable-rc 5.15.186-rc1 arm64
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute## Build errors
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute [-Werror=designated-init]Quoted 5 lines
702 | { | ^
drivers/scsi/qedf/qedf_main.c:702:9: note: (near initialization for 'qedf_cb_ops')
cc1: all warnings being treated as errorsQuoted 7 lines
I saw this locally, at times, it's random, not always showing up. Turn off the gcc randconfig build option and it goes away, which explains the randomness I guess.
If you can bisect this to a real change that causes it, please let me know, I couldn't figure it out and so just gave up as I doubt anyone is really using that gcc plugin for that kernel version.
You are right !
The reported arm64 allyesconfig build failures are due to,
Quoted 6 lines
Quoted 2 lines
randstruct: gcc-plugin: Remove bogus void member
[ Upstream commite136a4062174a9a8d1c1447ca040ea81accfa6a8]Thanks for the bisection, for some reason that wasn't working for me. I've dropped this, and the other randstruct change from 5.15.y and older kernels now.
This thread got pointed out to me. You can put this back in if you want; you just need the other associated fix (which had a bit of an obscure Fixes tag):
d8720235d5b5 ("scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops")
-Kees
Signature · 1 line
Kees Cook
Greg Kroah-Hartman
maintainerQuoted 68 lines · Kees Cook
Quoted 67 lines · Greg Kroah-Hartman
Quoted 65 lines · Naresh Kamboju
Quoted 50 lines · Greg Kroah-Hartman
Quoted 42 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.186 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.186-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm64 allyesconfig builds with gcc-12 and clang failed on the Linux stable-rc 5.15.186-rc1.
Regressions found on arm64
* arm64, build
- gcc-12-allyesconfigRegression Analysis:
- New regression? Yes
- Reproducibility? YesBuild regression: stable-rc 5.15.186-rc1 arm64
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute## Build errors
drivers/scsi/qedf/qedf_main.c:702:9: error: positional initialization of field in 'struct' declared with 'designated_init' attribute [-Werror=designated-init]Quoted 5 lines
702 | { | ^
drivers/scsi/qedf/qedf_main.c:702:9: note: (near initialization for 'qedf_cb_ops')
cc1: all warnings being treated as errorsQuoted 7 lines
I saw this locally, at times, it's random, not always showing up. Turn off the gcc randconfig build option and it goes away, which explains the randomness I guess.
If you can bisect this to a real change that causes it, please let me know, I couldn't figure it out and so just gave up as I doubt anyone is really using that gcc plugin for that kernel version.
You are right !
The reported arm64 allyesconfig build failures are due to,randstruct: gcc-plugin: Remove bogus void member
[ Upstream commite136a4062174a9a8d1c1447ca040ea81accfa6a8]
Quoted 7 lines
Quoted 3 lines
Thanks for the bisection, for some reason that wasn't working for me. I've dropped this, and the other randstruct change from 5.15.y and older kernels now.
This thread got pointed out to me. You can put this back in if you want; you just need the other associated fix (which had a bit of an obscure Fixes tag):
What exactly is "this" commit?
Quoted 1 line
d8720235d5b5("scsi: qedf: Use designated initializer for structqed_fcoe_cb_ops")
Can you give a list of git ids asked for here? This thread is confusing :)
thanks,
greg k-h
Quoted 11 lines · Greg Kroah-Hartman
Quoted 3 lines · Kees Cook
This thread got pointed out to me. You can put this back in if you want; you just need the other associated fix (which had a bit of an obscure Fixes tag):
What exactly is "this" commit?
Quoted 1 line
d8720235d5b5("scsi: qedf: Use designated initializer for structqed_fcoe_cb_ops")Can you give a list of git ids asked for here? This thread is confusing :)
Sorry! For stable, you want these, if they're not already present:
960013ec5b5e ("net: qede: Initialize qede_ll_ops with designated initializer") d8720235d5b5 ("scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops") e136a4062174 ("randstruct: gcc-plugin: Remove bogus void member") f39f18f3c353 ("randstruct: gcc-plugin: Fix attribute addition")
An additional bit of confusion is that the fix in 960013ec5b5e landed twice via 2 trees:6b3ab7f2cbfa ("net: qede: Initialize qede_ll_ops with designated initializer") 960013ec5b5e ("net: qede: Initialize qede_ll_ops with designated initializer")
Obviously either is fine.
Signature · 1 line
Kees Cook
Greg Kroah-Hartman
maintainerQuoted 21 lines · Kees Cook
Quoted 11 lines · Greg Kroah-Hartman
Quoted 3 lines · Kees Cook
This thread got pointed out to me. You can put this back in if you want; you just need the other associated fix (which had a bit of an obscure Fixes tag):
What exactly is "this" commit?
Quoted 1 line
d8720235d5b5("scsi: qedf: Use designated initializer for structqed_fcoe_cb_ops")Can you give a list of git ids asked for here? This thread is confusing :)
Sorry! For stable, you want these, if they're not already present:
960013ec5b5e("net: qede: Initializeqede_ll_opswith designated initializer")d8720235d5b5("scsi: qedf: Use designated initializer for structqed_fcoe_cb_ops")e136a4062174("randstruct: gcc-plugin: Remove bogus void member")f39f18f3c353("randstruct: gcc-plugin: Fix attribute addition")
Quoted 4 lines
An additional bit of confusion is that the fix in
960013ec5b5elanded twice via 2 trees:6b3ab7f2cbfa("net: qede: Initializeqede_ll_opswith designated initializer")960013ec5b5e("net: qede: Initializeqede_ll_opswith designated initializer")
Ugh, that's why we got confused. This only backported to 6.1.y, but not earlier. I'll go queue it up to the older ones as well. All of the other commits listed above are already in stable releases.
thanks,
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.186 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 25 Jun 2025 13:05:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.186-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Greg Kroah-Hartman
maintainerPATCH 94/411 perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 17e548405a81665fd14cee960db7d093d1396400 ]
The script allows the user to enter patterns to find symbols.
The pattern matching characters are converted for use in SQL.
For PostgreSQL the conversion involves using the Python maketrans() method which is slightly different in Python 3 compared with Python 2.
Fix to work in Python 3.
--- tools/perf/scripts/python/exported-sql-viewer.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/scripts/python/exported-sql-viewer.py +4 -1
@@ -680,7 +680,10 @@ class CallGraphModelBase(TreeModel): s = value.replace("%", "\%") s = s.replace("_", "\_") # Translate * and ? into SQL LIKE pattern characters % and _ - trans = string.maketrans("*?", "%_") + if sys.version_info[0] == 3: + trans = str.maketrans("*?", "%_") + else: + trans = string.maketrans("*?", "%_") match = " LIKE '" + str(s).translate(trans) + "'" else: match = " GLOB '" + str(value) + "'"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/411 remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 0cb4b1b97041d8a1f773425208ded253c1cb5869 ]
The device_del() call matches with the device_add() but we also need to call put_device() to trigger the qcom_iris_release().
--- drivers/remoteproc/qcom_wcnss_iris.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/remoteproc/qcom_wcnss_iris.c +2 -0
@@ -196,6 +196,7 @@ struct qcom_iris *qcom_iris_probe(struct device *parent, bool *use_48mhz_xo) err_device_del:device_del (&iris->dev); +put_device (&iris->dev);return ERR_PTR (ret); }
@@ -203,4 +204,5 @@ struct qcom_iris *qcom_iris_probe(struct device *parent, bool *use_48mhz_xo)void qcom_iris_remove (struct qcom_iris *iris) {device_del (&iris->dev); +put_device (&iris->dev); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/411 rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 5de775df3362090a6e90046d1f2d83fe62489aa0 ]
The "ret" variable isn't initialized if we don't enter the loop. For example, if "channel->state" is not SMD_CHANNEL_OPENED.
--- drivers/rpmsg/qcom_smd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rpmsg/qcom_smd.c +1 -1
@@ -746,7 +746,7 @@ static int __qcom_smd_send(struct qcom_smd_channel *channel, const void *data,__le32 hdr[5 ] = {cpu_to_le32 (len), };int tlen =sizeof (hdr) + len;unsigned long flags; -int ret; +int ret =0 ;/* Word aligned channels only accept word size aligned data */ if (channel->info_word && len %4 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/411 mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit b70b84556eeca5262d290e8619fe0af5b7664a52 ]
exynos_lpass_disable() is called twice in the remove function. Remove one of these calls.
--- drivers/mfd/exynos-lpass.c | 1 - 1 file changed, 1 deletion(-)
drivers/mfd/exynos-lpass.c +0 -1
@@ -144,7 +144,6 @@ static int exynos_lpass_remove(struct platform_device *pdev) {struct exynos_lpass *lpass =platform_get_drvdata (pdev); -exynos_lpass_disable (lpass);pm_runtime_disable (&pdev->dev);if (!pm_runtime_status_suspended (&pdev->dev))exynos_lpass_disable (lpass);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/411 mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Gladkov <[email protected]>
[ Upstream commit 59d60c16ed41475f3b5f7b605e75fbf8e3628720 ]
The name used in the macro does not exist.
drivers/mfd/stmpe-spi.c:132:26: error: use of undeclared identifier 'stmpe_id'
132 | MODULE_DEVICE_TABLE(spi, stmpe_id);
--- drivers/mfd/stmpe-spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/stmpe-spi.c +1 -1
@@ -129,7 +129,7 @@ static const struct spi_device_id stmpe_spi_id[] = { { "stmpe2403", STMPE2403 }, { } }; -MODULE_DEVICE_TABLE(spi, stmpe_id); +MODULE_DEVICE_TABLE(spi, stmpe_spi_id); static struct spi_driver stmpe_spi_driver = { .driver = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/411 perf tests switch-tracking: Fix timestamp comparison
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 628e124404b3db5e10e17228e680a2999018ab33 ]
The test might fail on the Arm64 platform with the error:
# perf test -vvv "Track with sched_switch" Missing sched_switch events #
The issue is caused by incorrect handling of timestamp comparisons. The comparison result, a signed 64-bit value, was being directly cast to an int, leading to incorrect sorting for sched events.
The case does not fail everytime, usually I can trigger the failure after run 20 ~ 30 times:
# while true; do perf test "Track with sched_switch"; done 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : FAILED! 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok 106: Track with sched_switch : FAILED! 106: Track with sched_switch : Ok 106: Track with sched_switch : Ok
I used cross compiler to build Perf tool on my host machine and tested on Debian / Juno board. Generally, I think this issue is not very specific to GCC versions. As both internal CI and my local env can reproduce the issue.
My Host Build compiler:
# aarch64-linux-gnu-gcc --version aarch64-linux-gnu-gcc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0
Juno Board:
# lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 12 (bookworm) Release: 12 Codename: bookworm
Fix this by explicitly returning 0, 1, or -1 based on whether the result is zero, positive, or negative.
--- tools/perf/tests/switch-tracking.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/tests/switch-tracking.c +1 -1
@@ -256,7 +256,7 @@ static int compar(const void *a, const void *b)const struct event_node *nodeb = b;s64 cmp = nodea->event_time - nodeb->event_time; -return cmp; +return cmp <0 ?-1 : (cmp >0 ?1 :0 ); } static int process_events(struct evlist *evlist,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/411 perf record: Fix incorrect --user-regs comments
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <[email protected]>
[ Upstream commit a4a859eb6704a8aa46aa1cec5396c8d41383a26b ]
The comment of "--user-regs" option is not correct, fix it.
"on interrupt," -> "in user space,"
--- tools/perf/builtin-record.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-record.c +1 -1
@@ -2547,7 +2547,7 @@ static struct option __record_options[] = { "sample selected machine registers on interrupt," " use '-I?' to list register names", parse_intr_regs),OPT_CALLBACK_OPTARG (0 ,"user-regs" , &record.opts.sample_user_regs,NULL ,"any register" , -"sample selected machine registers on interrupt," +"sample selected machine registers in user space," " use '--user-regs=?' to list register names" , parse_user_regs),OPT_BOOLEAN (0 ,"running-time" , &record.opts.running_time, "Record running/enabled time of read (:S) events"),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/411 nfs: clear SB_RDONLY before getting superblock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
[ Upstream commit 8cd9b785943c57a136536250da80ba1eb6f8eb18 ]
As described in the link, commit 52cb7f8f1778 ("nfs: ignore SB_RDONLY when mounting nfs") removed the check for the ro flag when determining whether to share the superblock, which caused issues when mounting different subdirectories under the same export directory via NFSv3. However, this change did not affect NFSv4.
For NFSv3:
1) A single superblock is created for the initial mount.
2) When mounted read-only, this superblock carries the SB_RDONLY flag.
3) Before commit 52cb7f8f1778 ("nfs: ignore SB_RDONLY when mounting nfs"):
Subsequent rw mounts would not share the existing ro superblock due to flag mismatch, creating a new superblock without SB_RDONLY. After the commit:
The SB_RDONLY flag is ignored during superblock comparison, and this leads to sharing the existing superblock even for rw mounts. Ultimately results in write operations being rejected at the VFS layer.
For NFSv4:
1) Multiple superblocks are created and the last one will be kept.
2) The actually used superblock for ro mounts doesn't carry SB_RDONLY flag. Therefore, commit 52cb7f8f1778 doesn't affect NFSv4 mounts.
Clear SB_RDONLY before getting superblock when NFS_MOUNT_UNSHARED is not set to fix it.
--- fs/nfs/super.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/nfs/super.c +9 -0
@@ -1269,8 +1269,17 @@ int nfs_get_tree_common(struct fs_context *fc)if (IS_ERR (server))return PTR_ERR (server); +/* +* When NFS_MOUNT_UNSHARED is not set, NFS forces the sharing of a +* superblock among each filesystem that mounts sub-directories +* belonging to a single exported root path. +* To prevent interference between different filesystems, the +* SB_RDONLY flag should be removed from the superblock. +*/ if (server->flags &NFS_MOUNT_UNSHARED ) compare_super =NULL ; +else + fc->sb_flags &= ~SB_RDONLY ;/* -o noac implies -o sync */ if (server->flags &NFS_MOUNT_NOAC )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/411 nfs: ignore SB_RDONLY when remounting nfs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
[ Upstream commit 80c4de6ab44c14e910117a02f2f8241ffc6ec54a ]
In some scenarios, when mounting NFS, more than one superblock may be created. The final superblock used is the last one created, but only the first superblock carries the ro flag passed from user space. If a ro flag is added to the superblock via remount, it will trigger the issue described in Link[1].
Link[2] attempted to address this by marking the superblock as ro during the initial mount. However, this introduced a new problem in scenarios where multiple mount points share the same superblock:
[root@a ~]# mount /dev/sdb /mnt/sdb
[root@a ~]# echo "/mnt/sdb *(rw,no_root_squash)" > /etc/exports [root@a ~]# echo "/mnt/sdb/test_dir2 *(ro,no_root_squash)" >> /etc/exports [root@a ~]# systemctl restart nfs-server
[root@a ~]# mount -t nfs -o rw 127.0.0.1:/mnt/sdb/test_dir1 /mnt/test_mp1 [root@a ~]# mount | grep nfs4
127.0.0.1:/mnt/sdb/test_dir1 on /mnt/test_mp1 type nfs4 (rw,relatime,... [root@a ~]# mount -t nfs -o ro 127.0.0.1:/mnt/sdb/test_dir2 /mnt/test_mp2 [root@a ~]# mount | grep nfs4
127.0.0.1:/mnt/sdb/test_dir1 on /mnt/test_mp1 type nfs4 (ro,relatime,... 127.0.0.1:/mnt/sdb/test_dir2 on /mnt/test_mp2 type nfs4 (ro,relatime,... [root@a ~]#
When mounting the second NFS, the shared superblock is marked as ro, causing the previous NFS mount to become read-only.
To resolve both issues, the ro flag is no longer applied to the superblock during remount. Instead, the ro flag on the mount is used to control whether the mount point is read-only.
Link[1]: https://lore.kernel.org/all/[email protected]/
Link[2]: https://lore.kernel.org/all/[email protected]/
--- fs/nfs/super.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/nfs/super.c +10 -0
@@ -1017,6 +1017,16 @@ int nfs_reconfigure(struct fs_context *fc)sync_filesystem (sb); +/* +* The SB_RDONLY flag has been removed from the superblock during +* mounts to prevent interference between different filesystems. +* Similarly, it is also necessary to ignore the SB_RDONLY flag +* during reconfiguration; otherwise, it may also result in the +* creation of redundant superblocks when mounting a directory with +* different rw and ro flags multiple times. +*/ + fc->sb_flags_mask &= ~SB_RDONLY ; +/* * Userspace mount programs that send binary options generally send * them populated with default values. We have no way to know which
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/411 rtc: sh: assign correct interrupts with DT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 8f2efdbc303fe7baa83843d3290dd6ea5ba3276c ]
The DT bindings for this driver define the interrupts in the order as they are numbered in the interrupt controller. The old platform_data, however, listed them in a different order. So, for DT based platforms, they are mixed up. Assign them specifically for DT, so we can keep the bindings stable. After the fix, 'rtctest' passes again on the Renesas Genmai board (RZ-A1 / R7S72100).
--- drivers/rtc/rtc-sh.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/rtc/rtc-sh.c +9 -3
@@ -485,9 +485,15 @@ static int __init sh_rtc_probe(struct platform_device *pdev)return -ENOENT ; } - rtc->periodic_irq = ret; - rtc->carry_irq =platform_get_irq (pdev,1 ); - rtc->alarm_irq =platform_get_irq (pdev,2 ); +if (!pdev->dev.of_node) { + rtc->periodic_irq = ret; + rtc->carry_irq =platform_get_irq (pdev,1 ); + rtc->alarm_irq =platform_get_irq (pdev,2 ); + }else { + rtc->alarm_irq = ret; + rtc->periodic_irq =platform_get_irq (pdev,1 ); + rtc->carry_irq =platform_get_irq (pdev,2 ); + } res =platform_get_resource (pdev,IORESOURCE_IO ,0 );if (!res)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/411 PCI: cadence: Fix runtime atomic count underflow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit 8805f32a96d3b97cef07999fa6f52112678f7e65 ]
If the call to pci_host_probe() in cdns_pcie_host_setup() fails, PM runtime count is decremented in the error path using pm_runtime_put_sync(). But the runtime count is not incremented by this driver, but only by the callers (cdns_plat_pcie_probe/j721e_pcie_probe). And the callers also decrement the runtime PM count in their error path. So this leads to the below warning from the PM core:
"runtime PM usage count underflow!"
So fix it by getting rid of pm_runtime_put_sync() in the error path and directly return the errno.
--- drivers/pci/controller/cadence/pcie-cadence-host.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-host.c +1 -10
@@ -548,14 +548,5 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)if (!bridge->ops) bridge->ops = &cdns_pcie_host_ops; - ret =pci_host_probe (bridge); -if (ret <0 ) - goto err_init; - -return 0 ; - - err_init: -pm_runtime_put_sync (dev); - -return ret; +return pci_host_probe (bridge); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/411 dmaengine: ti: Add NULL check in udma_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit fd447415e74bccd7362f760d4ea727f8e1ebfe91 ]
devm_kasprintf() returns NULL when memory allocation fails. Currently, udma_probe() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devm_kasprintf() to prevent this issue.
--- drivers/dma/ti/k3-udma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/dma/ti/k3-udma.c +2 -1
@@ -5425,7 +5425,8 @@ static int udma_probe(struct platform_device *pdev) uc->config.dir =DMA_MEM_TO_MEM ; uc->name =devm_kasprintf (dev,GFP_KERNEL ,"%s chan%d" ,dev_name (dev), i); - +if (!uc->name) +return -ENOMEM ;vchan_init (&uc->vc, &ud->ddev);/* Use custom vchan completion handling */ tasklet_setup (&uc->vc.task, udma_vchan_complete);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/411 PCI/DPC: Initialize aer_err_info before using it
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit a424b598e6a6c1e69a2bb801d6fd16e805ab2c38 ]
Previously the struct aer_err_info "info" was allocated on the stack without being initialized, so it contained junk except for the fields we explicitly set later.
Initialize "info" at declaration so it starts as all zeros.
--- drivers/pci/pcie/dpc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/pcie/dpc.c +1 -1
@@ -263,7 +263,7 @@ static int dpc_get_aer_uncorrect_severity(struct pci_dev *dev,void dpc_process_error (struct pci_dev *pdev) {u16 cap = pdev->dpc_cap, status, source, reason, ext_reason; -struct aer_err_info info; +struct aer_err_info info = {};pci_read_config_word (pdev, cap +PCI_EXP_DPC_STATUS , &status);pci_read_config_word (pdev, cap +PCI_EXP_DPC_SOURCE_ID , &source);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/411 usb: renesas_usbhs: Reorder clock handling and power management in probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit ffb34a60ce86656ba12d46e91f1ccc71dd221251 ]
Reorder the initialization sequence in usbhs_probe() to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks.
Currently, in the probe path, registers are accessed before enabling the clocks, leading to a synchronous external abort on the RZ/V2H SoC. The problematic call flow is as follows:
usbhs_probe()
usbhs_sys_clock_ctrl()
usbhs_bset()
usbhs_write()
iowrite16() <-- Register access before enabling clocks
Since iowrite16() is performed without ensuring the required clocks are enabled, this can lead to access errors. To fix this, enable PM runtime early in the probe function and ensure clocks are acquired before register access, preventing crashes like the following on RZ/V2H:
[13.272640] Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP [13.280814] Modules linked in: cec renesas_usbhs(+) drm_kms_helper fuse drm backlight ipv6 [13.289088] CPU: 1 UID: 0 PID: 195 Comm: (udev-worker) Not tainted 6.14.0-rc7+ #98 [13.296640] Hardware name: Renesas RZ/V2H EVK Board based on r9a09g057h44 (DT) [13.303834] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [13.310770] pc : usbhs_bset+0x14/0x4c [renesas_usbhs] [13.315831] lr : usbhs_probe+0x2e4/0x5ac [renesas_usbhs] [13.321138] sp : ffff8000827e3850 [13.324438] x29: ffff8000827e3860 x28: 0000000000000000 x27: ffff8000827e3ca0 [13.331554] x26: ffff8000827e3ba0 x25: ffff800081729668 x24: 0000000000000025 [13.338670] x23: ffff0000c0f08000 x22: 0000000000000000 x21: ffff0000c0f08010 [13.345783] x20: 0000000000000000 x19: ffff0000c3b52080 x18: 00000000ffffffff [13.352895] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000827e36ce [13.360009] x14: 00000000000003d7 x13: 00000000000003d7 x12: 0000000000000000 [13.367122] x11: 0000000000000000 x10: 0000000000000aa0 x9 : ffff8000827e3750 [13.374235] x8 : ffff0000c1850b00 x7 : 0000000003826060 x6 : 000000000000001c [13.381347] x5 : 000000030d5fcc00 x4 : ffff8000825c0000 x3 : 0000000000000000 [13.388459] x2 : 0000000000000400 x1 : 0000000000000000 x0 : ffff0000c3b52080 [13.395574] Call trace: [13.398013] usbhs_bset+0x14/0x4c [renesas_usbhs] (P) [13.403076] platform_probe+0x68/0xdc [13.406738] really_probe+0xbc/0x2c0 [13.410306] __driver_probe_device+0x78/0x120 [13.414653] driver_probe_device+0x3c/0x154 [13.418825] __driver_attach+0x90/0x1a0 [13.422647] bus_for_each_dev+0x7c/0xe0 [13.426470] driver_attach+0x24/0x30 [13.430032] bus_add_driver+0xe4/0x208 [13.433766] driver_register+0x68/0x130 [13.437587] __platform_driver_register+0x24/0x30 [13.442273] renesas_usbhs_driver_init+0x20/0x1000 [renesas_usbhs] [13.448450] do_one_initcall+0x60/0x1d4 [13.452276] do_init_module+0x54/0x1f8 [13.456014] load_module+0x1754/0x1c98 [13.459750] init_module_from_file+0x88/0xcc [13.464004] __arm64_sys_finit_module+0x1c4/0x328 [13.468689] invoke_syscall+0x48/0x104 [13.472426] el0_svc_common.constprop.0+0xc0/0xe0 [13.477113] do_el0_svc+0x1c/0x28 [13.480415] el0_svc+0x30/0xcc [13.483460] el0t_64_sync_handler+0x10c/0x138 [13.487800] el0t_64_sync+0x198/0x19c [13.491453] Code: 2a0103e1 12003c42 12003c63 8b010084 (79400084) [13.497522] ---[ end trace 0000000000000000 ]---
--- drivers/usb/renesas_usbhs/common.c | 50 +++++++++++++++++++++++------- 1 file changed, 38 insertions(+), 12 deletions(-)
drivers/usb/renesas_usbhs/common.c +38 -12
@@ -678,10 +678,29 @@ static int usbhs_probe(struct platform_device *pdev)INIT_DELAYED_WORK (&priv->notify_hotplug_work, usbhsc_notify_hotplug);spin_lock_init (usbhs_priv_to_lock (priv)); +/* +* Acquire clocks and enable power management (PM) early in the +* probe process, as the driver accesses registers during +* initialization. Ensure the device is active before proceeding. +*/ +pm_runtime_enable (dev); + + ret =usbhsc_clk_get (dev, priv); +if (ret) + goto probe_pm_disable; + + ret =pm_runtime_resume_and_get (dev); +if (ret) + goto probe_clk_put; + + ret =usbhsc_clk_prepare_enable (priv); +if (ret) + goto probe_pm_put; +/* call pipe and module init */ ret =usbhs_pipe_probe (priv);if (ret <0 ) -return ret; + goto probe_clk_dis_unprepare; ret =usbhs_fifo_probe (priv);if (ret <0 )
@@ -698,10 +717,6 @@ static int usbhs_probe(struct platform_device *pdev)if (ret) goto probe_fail_rst; - ret =usbhsc_clk_get (dev, priv); -if (ret) - goto probe_fail_clks; -/* * deviece reset here because * USB device might be used in boot loader.
@@ -714,7 +729,7 @@ static int usbhs_probe(struct platform_device *pdev)if (ret) {dev_warn (dev,"USB function not selected (GPIO)\n" ); ret = -ENOTSUPP ; - goto probe_end_mod_exit; + goto probe_assert_rest; } }
@@ -728,14 +743,19 @@ static int usbhs_probe(struct platform_device *pdev) ret =usbhs_platform_call (priv, hardware_init, pdev);if (ret <0 ) {dev_err (dev,"platform init failed.\n" ); - goto probe_end_mod_exit; + goto probe_assert_rest; }/* reset phy for connection */ usbhs_platform_call (priv, phy_reset, pdev); -/* power control */ -pm_runtime_enable (dev); +/* +* Disable the clocks that were enabled earlier in the probe path, +* and let the driver handle the clocks beyond this point. +*/ +usbhsc_clk_disable_unprepare (priv); +pm_runtime_put (dev); +if (!usbhs_get_dparam (priv, runtime_pwctrl)) {usbhsc_power_ctrl (priv,1 );usbhs_mod_autonomy_mode (priv);
@@ -752,9 +772,7 @@ static int usbhs_probe(struct platform_device *pdev)return ret; -probe_end_mod_exit: -usbhsc_clk_put (priv); -probe_fail_clks: +probe_assert_rest:reset_control_assert (priv->rsts); probe_fail_rst:usbhs_mod_remove (priv);
@@ -762,6 +780,14 @@ static int usbhs_probe(struct platform_device *pdev)usbhs_fifo_remove (priv); probe_end_pipe_exit:usbhs_pipe_remove (priv); +probe_clk_dis_unprepare: +usbhsc_clk_disable_unprepare (priv); +probe_pm_put: +pm_runtime_put (dev); +probe_clk_put: +usbhsc_clk_put (priv); +probe_pm_disable: +pm_runtime_disable (dev);dev_info (dev,"probe failed (%d)\n" , ret);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/411 serial: Fix potential null-ptr-deref in mlb_usio_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henry Martin <[email protected]>
[ Upstream commit 86bcae88c9209e334b2f8c252f4cc66beb261886 ]
devm_ioremap() can return NULL on error. Currently, mlb_usio_probe() does not check for this case, which could result in a NULL pointer dereference.
Add NULL check after devm_ioremap() to prevent this issue.
--- drivers/tty/serial/milbeaut_usio.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/tty/serial/milbeaut_usio.c +4 -1
@@ -523,7 +523,10 @@ static int mlb_usio_probe(struct platform_device *pdev) } port->membase =devm_ioremap (&pdev->dev, res->start,resource_size (res)); - +if (!port->membase) { + ret = -ENOMEM ; + goto failed; + } ret =platform_get_irq_byname (pdev,"rx" ); mlb_usio_irq[index][RX ] = ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/411 iio: adc: ad7124: Fix 3dB filter frequency reading
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 8712e4986e7ce42a14c762c4c350f290989986a5 ]
The sinc4 filter has a factor 0.23 between Output Data Rate and f_{3dB} and for sinc3 the factor is 0.272 according to the data sheets for ad7124-4 (Rev. E.) and ad7124-8 (Rev. F).
--- drivers/iio/adc/ad7124.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/ad7124.c +2 -2
@@ -297,9 +297,9 @@ static int ad7124_get_3db_filter_freq(struct ad7124_state *st,switch (st->channels[channel].cfg.filter_type) {case AD7124_SINC3_FILTER : -return DIV_ROUND_CLOSEST (fadc *230 ,1000 ); +return DIV_ROUND_CLOSEST (fadc *272 ,1000 );case AD7124_SINC4_FILTER : -return DIV_ROUND_CLOSEST (fadc *262 ,1000 ); +return DIV_ROUND_CLOSEST (fadc *230 ,1000 );default :return -EINVAL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/411 MIPS: Loongson64: Add missing #interrupt-cells for loongson64c_ls7a
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
[ Upstream commit 6d223b8ffcd1593d032b71875def2daa71c53111 ]
Similar to commit 98a9e2ac3755 ("MIPS: Loongson64: DTS: Fix msi node for ls7a").
Fix follow warnings:
arch/mips/boot/dts/loongson/loongson64c_4core_ls7a.dts:28.31-36.4: Warning (interrupt_provider): /bus@10000000/msi-controller@2ff00000: Missing '#interrupt-cells' in interrupt provider arch/mips/boot/dts/loongson/loongson64c_4core_ls7a.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider'
--- arch/mips/boot/dts/loongson/loongson64c_4core_ls7a.dts | 1 + 1 file changed, 1 insertion(+)
arch/mips/boot/dts/loongson/loongson64c_4core_ls7a.dts +1 -0
@@ -29,6 +29,7 @@ compatible = "loongson,pch-msi-1.0"; reg = <0 0x2ff00000 0 0x8>; interrupt-controller; + #interrupt-cells = <1>; msi-controller; loongson,msi-base-vec = <64>; loongson,msi-num-vecs = <64>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/411 vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Pitre <[email protected]>
[ Upstream commit c4c7ead7b86c1e7f11c64915b7e5bb6d2e242691 ]
They are listed amon those cmd values that "treat 'arg' as an integer" which is wrong. They should instead fall into the default case. Probably nobody ever relied on that code since 2009 but still.
--- drivers/tty/vt/vt_ioctl.c | 2 -- 1 file changed, 2 deletions(-)
drivers/tty/vt/vt_ioctl.c +0 -2
@@ -1103,8 +1103,6 @@ long vt_compat_ioctl(struct tty_struct *tty,case VT_WAITACTIVE :case VT_RELDISP :case VT_DISALLOCATE : -case VT_RESIZE : -case VT_RESIZEX :return vt_ioctl (tty, cmd, arg);/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/411 net: stmmac: platform: guarantee uniqueness of bus_id
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
[ Upstream commit eb7fd7aa35bfcc1e1fda4ecc42ccfcb526cdc780 ]
bus_id is currently derived from the ethernetX alias. If one is missing for the device, 0 is used. If ethernet0 points to another stmmac device or if there are 2+ stmmac devices without an ethernet alias, then bus_id will be 0 for all of those.
This is an issue because the bus_id is used to generate the mdio bus id (new_bus->id in drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c stmmac_mdio_register) and this needs to be unique.
This allows to avoid needing to define ethernet aliases for devices with multiple stmmac controllers (such as the Rockchip RK3588) for multiple stmmac devices to probe properly.
Obviously, the bus_id isn't guaranteed to be stable across reboots if no alias is set for the device but that is easily fixed by simply adding an alias if this is desired.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +9 -2
@@ -417,6 +417,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac)struct device_node *np = pdev->dev.of_node;struct plat_stmmacenet_data *plat;struct stmmac_dma_cfg *dma_cfg; +static int bus_id = -ENODEV ;int phy_mode;void *ret;int rc;
@@ -453,8 +454,14 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac)of_property_read_u32 (np,"max-speed" , &plat->max_speed); plat->bus_id =of_alias_get_id (np,"ethernet" ); -if (plat->bus_id <0 ) - plat->bus_id =0 ; +if (plat->bus_id <0 ) { +if (bus_id <0 ) + bus_id =of_alias_get_highest_id ("ethernet" ); +/* No ethernet alias found, init at -1 so first bus_id is 0 */ +if (bus_id <0 ) + bus_id =-1 ; + plat->bus_id = ++bus_id; + }/* Default to phy auto-detection */ plat->phy_addr =-1 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/411 gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit f41a94aade120dc60322865f363cee7865f2df01 ]
Previously, the RX_BUFFERS_POSTED stat incorrectly reported the fill_cnt from RX queue 0 for all queues, resulting in inaccurate per-queue statistics.
Fix this by correctly indexing priv->rx[idx].fill_cnt for each RX queue.
--- drivers/net/ethernet/google/gve/gve_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/google/gve/gve_main.c +1 -1
@@ -1299,7 +1299,7 @@ void gve_handle_report_stats(struct gve_priv *priv) }; stats[stats_idx++] = (struct stats ) { .stat_name =cpu_to_be32 (RX_BUFFERS_POSTED ), - .value =cpu_to_be64 (priv->rx[0 ].fill_cnt), + .value =cpu_to_be64 (priv->rx[idx].fill_cnt), .queue_id =cpu_to_be32 (idx), }; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/411 net: tipc: fix refcount warning in tipc_aead_encrypt
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charalampos Mitrodimas <[email protected]>
[ Upstream commit f29ccaa07cf3d35990f4d25028cc55470d29372b ]
syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup.
The recently added get_net() call in commit e279024617134 ("net/tipc:
fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning.
Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference.
[1]: https://lore.kernel.org/all/[email protected]/T/#m12019cf9ae77e1954f666914640efa36d52704a2
--- net/tipc/crypto.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/tipc/crypto.c +5 -1
@@ -829,7 +829,11 @@ static int tipc_aead_encrypt(struct tipc_aead *aead, struct sk_buff *skb, }/* Get net to avoid freed tipc_crypto when delete namespace */ -get_net (aead->crypto->net); +if (!maybe_get_net (aead->crypto->net)) { +tipc_bearer_put (b); + rc = -ENODEV ; + goto exit; + }/* Now, do encrypt */ rc =crypto_aead_encrypt (req);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/411 driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanqing Wang <[email protected]>
[ Upstream commit ba99c627aac85bc746fb4a6e2d79edb3ad100326 ]
Identify the cause of the suspend/resume hang: netif_carrier_off() is called during link state changes and becomes stuck while executing linkwatch_work().
To resolve this issue, call netif_device_detach() during the Ethernet suspend process to temporarily detach the network device from the kernel and prevent the suspend/resume hang.
--- drivers/net/ethernet/mediatek/mtk_star_emac.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mediatek/mtk_star_emac.c +4 -0
@@ -1464,6 +1464,8 @@ static __maybe_unused int mtk_star_suspend(struct device *dev)if (netif_running (ndev))mtk_star_disable (ndev); +netif_device_detach (ndev); +clk_bulk_disable_unprepare (MTK_STAR_NCLKS , priv->clks);return 0 ;
@@ -1488,6 +1490,8 @@ static __maybe_unused int mtk_star_resume(struct device *dev)clk_bulk_disable_unprepare (MTK_STAR_NCLKS , priv->clks); } +netif_device_attach (ndev); +return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/411 net/mlx4_en: Prevent potential integer overflow calculating Hz
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 54d34165b4f786d7fea8412a18fb4a54c1eab623 ]
The "freq" variable is in terms of MHz and "max_val_cycles" is in terms of Hz. The fact that "max_val_cycles" is a u64 suggests that support for high frequency is intended but the "freq_khz * 1000" would overflow the u32 type if we went above 4GHz. Use unsigned long long type for the mutliplication to prevent that.
--- drivers/net/ethernet/mellanox/mlx4/en_clock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_clock.c +1 -1
@@ -251,7 +251,7 @@ static const struct ptp_clock_info mlx4_en_ptp_clock_info = {static u32 freq_to_shift (u16 freq) {u32 freq_khz = freq *1000 ; -u64 max_val_cycles = freq_khz *1000 *MLX4_EN_WRAP_AROUND_SEC ; +u64 max_val_cycles = freq_khz *1000ULL *MLX4_EN_WRAP_AROUND_SEC ;u64 max_val_cycles_rounded =1ULL <<fls64 (max_val_cycles -1 );/* calculate max possible multiplier in order to fit in 64bit */ u64 max_mul =div64_u64 (ULLONG_MAX , max_val_cycles_rounded);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/411 spi: bcm63xx-spi: fix shared reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit 5ad20e3d8cfe3b2e42bbddc7e0ebaa74479bb589 ]
Some bmips SoCs (bcm6362, bcm63268) share the same SPI reset for both SPI and HSSPI controllers, so reset shouldn't be exclusive.
--- drivers/spi/spi-bcm63xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-bcm63xx.c +1 -1
@@ -533,7 +533,7 @@ static int bcm63xx_spi_probe(struct platform_device *pdev)return PTR_ERR (clk); } - reset =devm_reset_control_get_optional_exclusive (dev,NULL ); + reset =devm_reset_control_get_optional_shared (dev,NULL );if (IS_ERR (reset))return PTR_ERR (reset);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/411 spi: bcm63xx-hsspi: fix shared reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit 3d6d84c8f2f66d3fd6a43a1e2ce8e6b54c573960 ]
Some bmips SoCs (bcm6362, bcm63268) share the same SPI reset for both SPI and HSSPI controllers, so reset shouldn't be exclusive.
--- drivers/spi/spi-bcm63xx-hsspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-bcm63xx-hsspi.c +1 -1
@@ -357,7 +357,7 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)if (IS_ERR (clk))return PTR_ERR (clk); - reset =devm_reset_control_get_optional_exclusive (dev,NULL ); + reset =devm_reset_control_get_optional_shared (dev,NULL );if (IS_ERR (reset))return PTR_ERR (reset);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/411 Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 03dba9cea72f977e873e4e60e220fa596959dd8f ]
Depending on the security set the response to L2CAP_LE_CONN_REQ shall be just L2CAP_CR_LE_ENCRYPTION if only encryption when BT_SECURITY_MEDIUM is selected since that means security mode 2 which doesn't require authentication which is something that is covered in the qualification test L2CAP/LE/CFC/BV-25-C.
--- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bluetooth/l2cap_core.c +2 -1
@@ -5859,7 +5859,8 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,if (!smp_sufficient_security (conn->hcon, pchan->sec_level,SMP_ALLOW_STK )) { - result =L2CAP_CR_LE_AUTHENTICATION ; + result = pchan->sec_level ==BT_SECURITY_MEDIUM ? +L2CAP_CR_LE_ENCRYPTION :L2CAP_CR_LE_AUTHENTICATION ; chan =NULL ; goto response_unlock; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/411 ice: create new Tx scheduler nodes for new queues only
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kubiak <[email protected]>
[ Upstream commit 6fa2942578472c9cab13a8fc1dae0d830193e0a1 ]
The current implementation of the Tx scheduler tree attempts to create nodes for all Tx queues, ignoring the fact that some queues may already exist in the tree. For example, if the VSI already has 128 Tx queues and the user requests for 16 new queues, the Tx scheduler will compute the tree for 272 queues (128 existing queues + 144 new queues), instead of 144 queues (128 existing queues and 16 new queues).
Fix that by modifying the node count calculation algorithm to skip the queues that already exist in the tree.
--- drivers/net/ethernet/intel/ice/ice_sched.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/net/ethernet/intel/ice/ice_sched.c +6 -5
@@ -1576,16 +1576,16 @@ ice_sched_get_agg_node(struct ice_port_info *pi, struct ice_sched_node *tc_node,/** * ice_sched_calc_vsi_child_nodes - calculate number of VSI child nodes * @hw: pointer to the HW struct -* @num_qs: number of queues +* @num_new_qs: number of new queues that will be added to the tree * @num_nodes: num nodes array * * This function calculates the number of VSI child nodes based on the * number of queues. */ static void -ice_sched_calc_vsi_child_nodes (struct ice_hw *hw,u16 num_qs,u16 *num_nodes) +ice_sched_calc_vsi_child_nodes (struct ice_hw *hw,u16 num_new_qs,u16 *num_nodes) { -u16 num = num_qs; +u16 num = num_new_qs;u8 i, qgl, vsil; qgl =ice_sched_get_qgrp_layer (hw);
@@ -1833,8 +1833,9 @@ ice_sched_update_vsi_child_nodes(struct ice_port_info *pi, u16 vsi_handle,return status; } -if (new_numqs) -ice_sched_calc_vsi_child_nodes (hw, new_numqs, new_num_nodes); +ice_sched_calc_vsi_child_nodes (hw, new_numqs - prev_numqs, + new_num_nodes); +/* Keep the max number of queue configuration all the time. Update the * tree only if number of queues > previous number of queues. This may * leave some extra nodes in the tree if number of queues < previous
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/411 net: dsa: tag_brcm: legacy: fix pskb_may_pull length
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit efdddc4484859082da6c7877ed144c8121c8ea55 ]
BRCM_LEG_PORT_ID was incorrectly used for pskb_may_pull length. The correct check is BRCM_LEG_TAG_LEN + VLAN_HLEN, or 10 bytes.
--- net/dsa/tag_brcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/dsa/tag_brcm.c +1 -1
@@ -253,7 +253,7 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb,int source_port;u8 *brcm_tag; -if (unlikely (!pskb_may_pull (skb,BRCM_LEG_PORT_ID ))) +if (unlikely (!pskb_may_pull (skb,BRCM_LEG_TAG_LEN +VLAN_HLEN )))return NULL ; brcm_tag =dsa_etype_header_pos_rx (skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/411 vmxnet3: correctly report gso type for UDP tunnels
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronak Doshi <[email protected]>
[ Upstream commit 982d30c30eaa2ec723df42e3bf526c014c1dbb88 ]
Commit 3d010c8031e3 ("udp: do not accept non-tunnel GSO skbs landing in a tunnel") added checks in linux stack to not accept non-tunnel GRO packets landing in a tunnel. This exposed an issue in vmxnet3 which was not correctly reporting GRO packets for tunnel packets.
This patch fixes this issue by setting correct GSO type for the tunnel packets.
Currently, vmxnet3 does not support reporting inner fields for LRO tunnel packets. The issue is not seen for egress drivers that do not use skb inner fields. The workaround is to enable tnl-segmentation offload on the egress interfaces if the driver supports it. This problem pre-exists this patch fix and can be addressed as a separate future patch.
--- drivers/net/vmxnet3/vmxnet3_drv.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/net/vmxnet3/vmxnet3_drv.c +26 -0
@@ -1361,6 +1361,30 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,return (hlen + (hdr.tcp->doff <<2 )); } +static void +vmxnet3_lro_tunnel (struct sk_buff *skb,__be16 ip_proto) +{ +struct udphdr *uh =NULL ; + +if (ip_proto ==htons (ETH_P_IP )) { +struct iphdr *iph = (struct iphdr *)skb->data; + +if (iph->protocol ==IPPROTO_UDP ) + uh = (struct udphdr *)(iph +1 ); + }else { +struct ipv6hdr *iph = (struct ipv6hdr *)skb->data; + +if (iph->nexthdr ==IPPROTO_UDP ) + uh = (struct udphdr *)(iph +1 ); + } +if (uh) { +if (uh->check) +skb_shinfo (skb)->gso_type |=SKB_GSO_UDP_TUNNEL_CSUM ; +else +skb_shinfo (skb)->gso_type |=SKB_GSO_UDP_TUNNEL ; + } +} +static int vmxnet3_rq_rx_complete (struct vmxnet3_rx_queue *rq,struct vmxnet3_adapter *adapter,int quota)
@@ -1615,6 +1639,8 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,if (segCnt !=0 && mss !=0 ) {skb_shinfo (skb)->gso_type = rcd->v4 ?SKB_GSO_TCPV4 :SKB_GSO_TCPV6 ; +if (encap_lro) +vmxnet3_lro_tunnel (skb, skb->protocol);skb_shinfo (skb)->gso_size = mss;skb_shinfo (skb)->gso_segs = segCnt; }else if ((segCnt !=0 || skb->len > mtu) && !encap_lro) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/411 PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit d46c4c839c20a599a0eb8d73708ce401f9c7d06d ]
Commit 03f1444016b7 ("PM: sleep: Fix handling devices with direct_complete set on errors") caused power.is_suspended to be set for devices with power.direct_complete set, but it forgot to ensure the clearing of that flag for them in device_resume(), so power.is_suspended is still set for them during the next system suspend-resume cycle.
If that cycle is aborted in dpm_suspend(), the subsequent invocation of dpm_resume() will trigger a device_resume() call for every device and because power.is_suspended is set for the devices in question, they will not be skipped by device_resume() as expected which causes scary error messages to be logged (as appropriate).
To address this issue, move the clearing of power.is_suspended in device_resume() immediately after the power.is_suspended check so it will be always cleared for all devices processed by that function.
--- drivers/base/power/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/base/power/main.c +2 -1
@@ -900,6 +900,8 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)if (!dev->power.is_suspended) goto Complete; + dev->power.is_suspended = false; +if (dev->power.direct_complete) {/* Match the pm_runtime_disable() in __device_suspend(). */ pm_runtime_enable (dev);
@@ -955,7 +957,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async) End: error =dpm_run_callback (callback, dev, state, info); - dev->power.is_suspended = false;device_unlock (dev);dpm_watchdog_clear (&wd);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/411 gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 12c331b29c7397ac3b03584e12902990693bc248 ]
gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo() did not check for this case before dereferencing the returned pointer.
Add a missing NULL check to prevent a potential NULL pointer dereference when allocation fails.
This improves robustness in low-memory scenarios.
--- drivers/net/ethernet/google/gve/gve_tx_dqo.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/google/gve/gve_tx_dqo.c +3 -0
@@ -462,6 +462,9 @@ static int gve_tx_add_skb_no_copy_dqo(struct gve_tx_ring *tx,int i; pkt =gve_alloc_pending_packet (tx); +if (!pkt) +return -ENOMEM ; + pkt->skb = skb; pkt->num_bufs =0 ; completion_tag = pkt - tx->dqo.pending_packets;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/411 netfilter: nf_set_pipapo_avx2: fix initial map fill
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit ea77c397bff8b6d59f6d83dae1425b08f465e8b5 ]
If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map.
The early fix was incomplete and did only fix up the generic C implementation.
A followup patch adds a test case to nft_concat_range.sh.
--- net/netfilter/nft_set_pipapo_avx2.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
net/netfilter/nft_set_pipapo_avx2.c +20 -1
@@ -1115,6 +1115,25 @@ bool nft_pipapo_avx2_estimate(const struct nft_set_desc *desc, u32 features,return true; } +/** +* pipapo_resmap_init_avx2() - Initialise result map before first use +* @m: Matching data, including mapping table +* @res_map: Result map +* +* Like pipapo_resmap_init() but do not set start map bits covered by the first field. +*/ +static inline void pipapo_resmap_init_avx2 (const struct nft_pipapo_match *m,unsigned long *res_map) +{ +const struct nft_pipapo_field *f = m->f; +int i; + +/* Starting map doesn't need to be set to all-ones for this implementation, +* but we do need to zero the remaining bits, if any. +*/ +for (i = f->bsize; i < m->bsize_max; i++) + res_map[i] =0ul ; +} +/** * nft_pipapo_avx2_lookup() - Lookup function for AVX2 implementation * @net: Network namespace
@@ -1173,7 +1192,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, res = scratch->map + (map_index ? m->bsize_max :0 ); fill = scratch->map + (map_index ?0 : m->bsize_max); -/* Starting map doesn't need to be set for this implementation */ +pipapo_resmap_init_avx2 (m, res);nft_pipapo_avx2_prepare ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/411 wireguard: device: enable threaded NAPI
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mirco Barone <[email protected]>
[ Upstream commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e ]
Enable threaded NAPI by default for WireGuard devices in response to low performance behavior that we observed when multiple tunnels (and thus multiple wg devices) are deployed on a single host. This affects any kind of multi-tunnel deployment, regardless of whether the tunnels share the same endpoints or not (i.e., a VPN concentrator type of gateway would also be affected).
The problem is caused by the fact that, in case of a traffic surge that involves multiple tunnels at the same time, the polling of the NAPI instance of all these wg devices tends to converge onto the same core, causing underutilization of the CPU and bottlenecking performance.
This happens because NAPI polling is hosted by default in softirq context, but the WireGuard driver only raises this softirq after the rx peer queue has been drained, which doesn't happen during high traffic. In this case, the softirq already active on a core is reused instead of raising a new one.
As a result, once two or more tunnel softirqs have been scheduled on the same core, they remain pinned there until the surge ends.
In our experiments, this almost always leads to all tunnel NAPIs being handled on a single core shortly after a surge begins, limiting scalability to less than 3× the performance of a single tunnel, despite plenty of unused CPU cores being available.
The proposed mitigation is to enable threaded NAPI for all WireGuard devices. This moves the NAPI polling context to a dedicated per-device kernel thread, allowing the scheduler to balance the load across all available cores.
On our 32-core gateways, enabling threaded NAPI yields a ~4× performance improvement with 16 tunnels, increasing throughput from ~13 Gbps to ~48 Gbps. Meanwhile, CPU usage on the receiver (which is the bottleneck) jumps from 20% to 100%.
We have found no performance regressions in any scenario we tested. Single-tunnel throughput remains unchanged.
More details are available in our Netdev paper.
--- drivers/net/wireguard/device.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireguard/device.c +1 -0
@@ -352,6 +352,7 @@ static int wg_newlink(struct net *src_net, struct net_device *dev,if (ret <0 ) goto err_free_handshake_queue; +dev_set_threaded (dev, true); ret =register_netdevice (dev);if (ret <0 ) goto err_uninit_ratelimiter;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/411 seg6: Fix validation of nexthop addresses
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 7632fedb266d93ed0ed9f487133e6c6314a9b2d1 ]
The kernel currently validates that the length of the provided nexthop address does not exceed the specified length. This can lead to the kernel reading uninitialized memory if user space provided a shorter length than the specified one.
Fix by validating that the provided length exactly matches the specified one.
--- net/ipv6/seg6_local.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/ipv6/seg6_local.c +2 -4
@@ -1123,10 +1123,8 @@ static const struct nla_policy seg6_local_policy[SEG6_LOCAL_MAX + 1] = { [SEG6_LOCAL_SRH] = { .type = NLA_BINARY }, [SEG6_LOCAL_TABLE] = { .type = NLA_U32 }, [SEG6_LOCAL_VRFTABLE] = { .type = NLA_U32 }, - [SEG6_LOCAL_NH4] = { .type = NLA_BINARY, - .len = sizeof(struct in_addr) }, - [SEG6_LOCAL_NH6] = { .type = NLA_BINARY, - .len = sizeof(struct in6_addr) }, + [SEG6_LOCAL_NH4] = NLA_POLICY_EXACT_LEN(sizeof(struct in_addr)), + [SEG6_LOCAL_NH6] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), [SEG6_LOCAL_IIF] = { .type = NLA_U32 }, [SEG6_LOCAL_OIF] = { .type = NLA_U32 }, [SEG6_LOCAL_BPF] = { .type = NLA_NESTED },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/411 fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit d8cc0362f918d020ca1340d7694f07062dc30f36 ]
9ffb14ef61ba "move_mount: allow to add a mount into an existing group" breaks assertions on ->mnt_share/->mnt_slave. For once, the data structures in question are actually documented.
Documentation/filesystem/sharedsubtree.rst:
All vfsmounts in a peer group have the same ->mnt_master. If it is non-NULL, they form a contiguous (ordered) segment of slave list.
do_set_group() puts a mount into the same place in propagation graph as the old one. As the result, if old mount gets events from somewhere and is not a pure event sink, new one needs to be placed next to the old one in the slave list the old one's on. If it is a pure event sink, we only need to make sure the new one doesn't end up in the middle of some peer group.
"move_mount: allow to add a mount into an existing group" ends up putting the new one in the beginning of list; that's definitely not going to be in the middle of anything, so that's fine for case when old is not marked shared. In case when old one _is_ marked shared (i.e. is not a pure event sink), that breaks the assumptions of propagation graph iterators.
Put the new mount next to the old one on the list - that does the right thing in "old is marked shared" case and is just as correct as the current behaviour if old is not marked shared (kudos to Pavel for pointing that out - my original suggested fix changed behaviour in the "nor marked" case, which complicated things for no good reason).
--- fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/namespace.c +1 -1
@@ -2765,7 +2765,7 @@ static int do_set_group(struct path *from_path, struct path *to_path)if (IS_MNT_SLAVE (from)) {struct mount *m = from->mnt_master; -list_add (&to->mnt_slave, &m->mnt_slave_list); +list_add (&to->mnt_slave, &from->mnt_slave); to->mnt_master = m; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/411 do_change_type(): refuse to operate on unmounted/not ours mounts
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 12f147ddd6de7382dad54812e65f3f08d05809fc ]
Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount(2).
--- fs/namespace.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/namespace.c +4 -0
@@ -2327,6 +2327,10 @@ static int do_change_type(struct path *path, int ms_flags)return -EINVAL ;namespace_lock (); +if (!check_mnt (mnt)) { + err = -EINVAL ; + goto out_unlock; + }if (type ==MS_SHARED ) { err =invent_group_ids (mnt, recurse);if (err)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/411 pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 0f5757667ec0aaf2456c3b76fcf0c6c3ea3591fe ]
The error checking for of_count_phandle_with_args() does not handle negative error codes correctly. The problem is that "index" is a u32 so in the condition "if (index >= num_domains)" negative error codes stored in "num_domains" are type promoted to very high positive values and "index" is always going to be valid.
Test for negative error codes first and then test if "index" is valid.
--- drivers/base/power/domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/domain.c +1 -1
@@ -2773,7 +2773,7 @@ struct device *genpd_dev_pm_attach_by_id(struct device *dev,/* Verify that the index is within a valid range. */ num_domains =of_count_phandle_with_args (dev->of_node,"power-domains" ,"#power-domain-cells" ); -if (index >= num_domains) +if (num_domains <0 || index >= num_domains)return NULL ;/* Allocate and register device on the genpd bus. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/411 Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhang songyi <[email protected]>
[ Upstream commit 9dedc915937c33302df7fcab01c45e7936d6195a ]
Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space.
Stable-dep-of: ca39500f6af9 ("Input: synaptics-rmi - fix crash with unsupported versions of F34")
--- drivers/input/rmi4/rmi_f34.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/input/rmi4/rmi_f34.c +8 -8
@@ -321,13 +321,13 @@ static ssize_t rmi_driver_bootloader_id_show(struct device *dev, f34 =dev_get_drvdata (&fn->dev);if (f34->bl_version ==5 ) -return scnprintf (buf,PAGE_SIZE ,"%c%c\n" , - f34->bootloader_id[0 ], - f34->bootloader_id[1 ]); +return sysfs_emit (buf,"%c%c\n" , + f34->bootloader_id[0 ], + f34->bootloader_id[1 ]);else -return scnprintf (buf,PAGE_SIZE ,"V%d.%d\n" , - f34->bootloader_id[1 ], - f34->bootloader_id[0 ]); +return sysfs_emit (buf,"V%d.%d\n" , + f34->bootloader_id[1 ], + f34->bootloader_id[0 ]); }return 0 ;
@@ -346,7 +346,7 @@ static ssize_t rmi_driver_configuration_id_show(struct device *dev,if (fn) { f34 =dev_get_drvdata (&fn->dev); -return scnprintf (buf,PAGE_SIZE ,"%s\n" , f34->configuration_id); +return sysfs_emit (buf,"%s\n" , f34->configuration_id); }return 0 ;
@@ -499,7 +499,7 @@ static ssize_t rmi_driver_update_fw_status_show(struct device *dev,if (data->f34_container) update_status =rmi_f34_status (data->f34_container); -return scnprintf (buf,PAGE_SIZE ,"%d\n" , update_status); +return sysfs_emit (buf,"%d\n" , update_status); } static DEVICE_ATTR(update_fw_status, 0444,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/411 Input: synaptics-rmi - fix crash with unsupported versions of F34
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 ]
Sysfs interface for updating firmware for RMI devices is available even when F34 probe fails. The code checks for presence of F34 "container" pointer and then tries to use the function data attached to the sub-device. F34 assigns the function data early, before it knows if probe will succeed, leaving behind a stale pointer.
Fix this by expanding checks to not only test for presence of F34 "container" but also check if there is driver data assigned to the sub-device, and call dev_set_drvdata() only after we are certain that probe is successful.
This is not a complete fix, since F34 will be freed during firmware update, so there is still a race when fetching and accessing this pointer. This race will be addressed in follow-up changes.
--- drivers/input/rmi4/rmi_f34.c | 135 ++++++++++++++++++++--------------- 1 file changed, 76 insertions(+), 59 deletions(-)
drivers/input/rmi4/rmi_f34.c +76 -59
@@ -4,6 +4,7 @@* Copyright (C) 2016 Zodiac Inflight Innovations */ +#include "linux/device.h" #include <linux/kernel.h> #include <linux/rmi.h> #include <linux/firmware.h>
@@ -298,39 +299,30 @@ static int rmi_f34_update_firmware(struct f34_data *f34,return ret; } -static int rmi_f34_status (struct rmi_function *fn) -{ -struct f34_data *f34 =dev_get_drvdata (&fn->dev); - -/* -* The status is the percentage complete, or once complete, -* zero for success or a negative return code. -*/ -return f34->update_status; -} -static ssize_t rmi_driver_bootloader_id_show (struct device *dev,struct device_attribute *dattr,char *buf) {struct rmi_driver_data *data =dev_get_drvdata (dev); -struct rmi_function *fn = data->f34_container; +struct rmi_function *fn;struct f34_data *f34; -if (fn) { - f34 =dev_get_drvdata (&fn->dev); - -if (f34->bl_version ==5 ) -return sysfs_emit (buf,"%c%c\n" , - f34->bootloader_id[0 ], - f34->bootloader_id[1 ]); -else -return sysfs_emit (buf,"V%d.%d\n" , - f34->bootloader_id[1 ], - f34->bootloader_id[0 ]); - } + fn = data->f34_container; +if (!fn) +return -ENODEV ; -return 0 ; + f34 =dev_get_drvdata (&fn->dev); +if (!f34) +return -ENODEV ; + +if (f34->bl_version ==5 ) +return sysfs_emit (buf,"%c%c\n" , + f34->bootloader_id[0 ], + f34->bootloader_id[1 ]); +else +return sysfs_emit (buf,"V%d.%d\n" , + f34->bootloader_id[1 ], + f34->bootloader_id[0 ]); } static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL);
@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_id_show(struct device *dev,struct rmi_function *fn = data->f34_container;struct f34_data *f34; -if (fn) { - f34 =dev_get_drvdata (&fn->dev); + fn = data->f34_container; +if (!fn) +return -ENODEV ; -return sysfs_emit (buf,"%s\n" , f34->configuration_id); - } + f34 =dev_get_drvdata (&fn->dev); +if (!f34) +return -ENODEV ; -return 0 ; + +return sysfs_emit (buf,"%s\n" , f34->configuration_id); } static DEVICE_ATTR(configuration_id, 0444,
@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rmi_driver_data *data,if (!data->f34_container) {dev_warn (dev,"%s: No F34 present!\n" , __func__); -return -EINVAL ; +return -ENODEV ; } f34 =dev_get_drvdata (&data->f34_container->dev); +if (!f34) { +dev_warn (dev,"%s: No valid F34 present!\n" , __func__); +return -ENODEV ; + }if (f34->bl_version ==7 ) {if (data->pdt_props &HAS_BSR ) {
@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_status_show(struct device *dev, char *buf) {struct rmi_driver_data *data =dev_get_drvdata (dev); -int update_status =0 ; +struct f34_data *f34; +int update_status = -ENODEV ; -if (data->f34_container) - update_status =rmi_f34_status (data->f34_container); +/* +* The status is the percentage complete, or once complete, +* zero for success or a negative return code. +*/ +if (data->f34_container) { + f34 =dev_get_drvdata (&data->f34_container->dev); +if (f34) + update_status = f34->update_status; + }return sysfs_emit (buf,"%d\n" , update_status); }
@@ -517,33 +524,21 @@ static const struct attribute_group rmi_firmware_attr_group = { .attrs = rmi_firmware_attrs, }; -static int rmi_f34_probe (struct rmi_function *fn) +static int rmi_f34v5_probe (struct f34_data *f34) { -struct f34_data *f34; -unsigned char f34_queries[9 ]; +struct rmi_function *fn = f34->fn; +u8 f34_queries[9 ];bool has_config_id; -u8 version = fn->fd.function_version; -int ret; - - f34 =devm_kzalloc (&fn->dev,sizeof (struct f34_data ),GFP_KERNEL ); -if (!f34) -return -ENOMEM ; - - f34->fn = fn; -dev_set_drvdata (&fn->dev, f34); - -/* v5 code only supported version 0, try V7 probe */ -if (version >0 ) -return rmi_f34v7_probe (f34); +int error; f34->bl_version =5 ; - ret =rmi_read_block (fn->rmi_dev, fn->fd.query_base_addr, - f34_queries,sizeof (f34_queries)); -if (ret) { + error =rmi_read_block (fn->rmi_dev, fn->fd.query_base_addr, + f34_queries,sizeof (f34_queries)); +if (error) {dev_err (&fn->dev,"%s: Failed to query properties\n" , __func__); -return ret; +return error; } snprintf(f34->bootloader_id, sizeof(f34->bootloader_id),
@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_function *fn) f34->v5.config_blocks);if (has_config_id) { - ret =rmi_read_block (fn->rmi_dev, fn->fd.control_base_addr, - f34_queries,sizeof (f34_queries)); -if (ret) { + error =rmi_read_block (fn->rmi_dev, fn->fd.control_base_addr, + f34_queries,sizeof (f34_queries)); +if (error) {dev_err (&fn->dev,"Failed to read F34 config ID\n" ); -return ret; +return error; } snprintf(f34->configuration_id, sizeof(f34->configuration_id),
@@ -582,12 +577,34 @@ static int rmi_f34_probe(struct rmi_function *fn) f34_queries[2], f34_queries[3]);rmi_dbg (RMI_DEBUG_FN , &fn->dev,"Configuration ID: %s\n" , - f34->configuration_id); + f34->configuration_id); }return 0 ; } +static int rmi_f34_probe (struct rmi_function *fn) +{ +struct f34_data *f34; +u8 version = fn->fd.function_version; +int error; + + f34 =devm_kzalloc (&fn->dev,sizeof (struct f34_data ),GFP_KERNEL ); +if (!f34) +return -ENOMEM ; + + f34->fn = fn; + +/* v5 code only supported version 0 */ + error = version ==0 ?rmi_f34v5_probe (f34) :rmi_f34v7_probe (f34); +if (error) +return error; + +dev_set_drvdata (&fn->dev, f34); + +return 0 ; +} +int rmi_f34_create_sysfs (struct rmi_device *rmi_dev) {return sysfs_create_group (&rmi_dev->dev.kobj, &rmi_firmware_attr_group);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/411 arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
[ Upstream commit 2b9bb988742d1794e78d4297a99658f38477eedd ]
ti,otap-del-sel has been deprecated in favor of ti,otap-del-sel-legacy.
Drop the duplicate and misleading ti,otap-del-sel property.
Stable-dep-of: f55c9f087cc2 ("arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0")
--- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am65-main.dtsi +0 -1
@@ -294,7 +294,6 @@ sdhci1: mmc@4fa0000 { ti,otap-del-sel-ddr52 = <0x4>; ti,otap-del-sel-hs200 = <0x7>; ti,clkbuf-sel = <0x7>; - ti,otap-del-sel = <0x2>; ti,trm-icp = <0x8>; dma-coherent; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/411 arm64: dts: ti: k3-am65-main: Fix sdhci node properties
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
[ Upstream commit 8ffe9cb889f2b831a9d5bbb1f7ad42d30e31170f ]
Update otap-del-sel properties as per datasheet [0].
Add missing clkbuf-sel and itap-del-sel values also as per datasheet [0].
Move clkbuf-sel and ti,trm-icp above the otap-del-sel properties so the sdhci nodes could be more uniform across platforms.
[0] https://www.ti.com/lit/ds/symlink/am6548.pdf
Stable-dep-of: f55c9f087cc2 ("arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0")
--- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/ti/k3-am65-main.dtsi +11 -6
@@ -261,6 +261,8 @@ sdhci0: mmc@4f80000 { interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>; mmc-ddr-1_8v; mmc-hs200-1_8v; + ti,clkbuf-sel = <0x7>; + ti,trm-icp = <0x8>; ti,otap-del-sel-legacy = <0x0>; ti,otap-del-sel-mmc-hs = <0x0>; ti,otap-del-sel-sd-hs = <0x0>;
@@ -271,8 +273,7 @@ sdhci0: mmc@4f80000 { ti,otap-del-sel-ddr50 = <0x5>; ti,otap-del-sel-ddr52 = <0x5>; ti,otap-del-sel-hs200 = <0x5>; - ti,otap-del-sel-hs400 = <0x0>; - ti,trm-icp = <0x8>; + ti,itap-del-sel-ddr52 = <0x0>; dma-coherent; };
@@ -283,18 +284,22 @@ sdhci1: mmc@4fa0000 { clocks = <&k3_clks 48 0>, <&k3_clks 48 1>; clock-names = "clk_ahb", "clk_xin"; interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>; + ti,clkbuf-sel = <0x7>; + ti,trm-icp = <0x8>; ti,otap-del-sel-legacy = <0x0>; ti,otap-del-sel-mmc-hs = <0x0>; ti,otap-del-sel-sd-hs = <0x0>; - ti,otap-del-sel-sdr12 = <0x0>; - ti,otap-del-sel-sdr25 = <0x0>; + ti,otap-del-sel-sdr12 = <0xf>; + ti,otap-del-sel-sdr25 = <0xf>; ti,otap-del-sel-sdr50 = <0x8>; ti,otap-del-sel-sdr104 = <0x7>; ti,otap-del-sel-ddr50 = <0x4>; ti,otap-del-sel-ddr52 = <0x4>; ti,otap-del-sel-hs200 = <0x7>; - ti,clkbuf-sel = <0x7>; - ti,trm-icp = <0x8>; + ti,itap-del-sel-legacy = <0xa>; + ti,itap-del-sel-sd-hs = <0x1>; + ti,itap-del-sel-sdr12 = <0xa>; + ti,itap-del-sel-sdr25 = <0x1>; dma-coherent; };
Signature · 56 lines
2.39.5
task_update_io_bitmap(void)
{
+ struct task_struct *tsk = current;
struct thread_struct *t = &tsk->thread;
if (t->iopl_emul == 3 || t->io_bitmap) {
@@ -54,7 +55,12 @@ void io_bitmap_exit(struct task_struct *
struct io_bitmap *iobm = tsk->thread.io_bitmap;
tsk->thread.io_bitmap = NULL;
- task_update_io_bitmap(tsk);
+ /*
+ * Don't touch the TSS when invoked on a failed fork(). TSS
+ * reflects the state of @current and not the state of @tsk.
+ */
+ if (tsk == current)
+ task_update_io_bitmap();
if (iobm && refcount_dec_and_test(&iobm->refcnt))
kfree(iobm);
}
@@ -192,8 +198,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, leve
}
t->iopl_emul = level;
- task_update_io_bitmap(current);
-
+ task_update_io_bitmap();
return 0;
}
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -143,6 +143,7 @@ int copy_thread(unsigned long clone_flag
frame->ret_addr = (unsigned long) ret_from_fork;
p->thread.sp = (unsigned long) fork_frame;
p->thread.io_bitmap = NULL;
+ clear_tsk_thread_flag(p, TIF_IO_BITMAP);
p->thread.iopl_warn = 0;
memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
@@ -401,6 +402,11 @@ void native_tss_update_io_bitmap(void)
} else {
struct io_bitmap *iobm = t->io_bitmap;
+ if (WARN_ON_ONCE(!iobm)) {
+ clear_thread_flag(TIF_IO_BITMAP);
+ native_tss_invalidate_io_bitmap();
+ }
+
/*
* Only copy bitmap data when the sequence number differs. The
* update time is accounted to the incoming task.Greg Kroah-Hartman
maintainerPATCH 135/411 arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
[ Upstream commit f55c9f087cc2e2252d44ffd9d58def2066fc176e ]
For am65x, add missing ITAPDLYSEL values for Default Speed and High Speed SDR modes to sdhci0 node according to the device datasheet [0].
[0] https://www.ti.com/lit/gpn/am6548
--- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/ti/k3-am65-main.dtsi +2 -0
@@ -273,6 +273,8 @@ sdhci0: mmc@4f80000 { ti,otap-del-sel-ddr50 = <0x5>; ti,otap-del-sel-ddr52 = <0x5>; ti,otap-del-sel-hs200 = <0x5>; + ti,itap-del-sel-legacy = <0xa>; + ti,itap-del-sel-mmc-hs = <0x1>; ti,itap-del-sel-ddr52 = <0x0>; dma-coherent; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/411 serial: sh-sci: Check if TX data was written to device in .tx_empty()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 7cc0e0a43a91052477c2921f924a37d9c3891f0c upstream.
On the Renesas RZ/G3S, when doing suspend to RAM, the uart_suspend_port() is called. The uart_suspend_port() calls 3 times the
struct uart_port::ops::tx_empty() before shutting down the port.
According to the documentation, the struct uart_port::ops::tx_empty() API tests whether the transmitter FIFO and shifter for the port is empty.
The Renesas RZ/G3S SCIFA IP reports the number of data units stored in the transmit FIFO through the FDR (FIFO Data Count Register). The data units in the FIFOs are written in the shift register and transmitted from there. The TEND bit in the Serial Status Register reports if the data was transmitted from the shift register.
In the previous code, in the tx_empty() API implemented by the sh-sci driver, it is considered that the TX is empty if the hardware reports the TEND bit set and the number of data units in the FIFO is zero.
According to the HW manual, the TEND bit has the following meaning:
0: Transmission is in the waiting state or in progress. 1: Transmission is completed.
It has been noticed that when opening the serial device w/o using it and then switch to a power saving mode, the tx_empty() call in the uart_port_suspend() function fails, leading to the "Unable to drain transmitter" message being printed on the console. This is because the TEND=0 if nothing has been transmitted and the FIFOs are empty. As the TEND=0 has double meaning (waiting state, in progress) we can't determined the scenario described above.
Add a software workaround for this. This sets a variable if any data has been sent on the serial console (when using PIO) or if the DMA callback has been called (meaning something has been transmitted). In the tx_empty() API the status of the DMA transaction is also checked and if it is completed or in progress the code falls back in checking the hardware registers instead of relying on the software variable.
[claudiu.beznea: fixed conflict by:
- keeping serial_port_out() instead of sci_port_out() in sci_transmit_chars()
- keeping !uart_circ_empty(xmit) condition in sci_dma_tx_complete(), after s->tx_occurred = true; assignement]
--- drivers/tty/serial/sh-sci.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/tty/serial/sh-sci.c +29 -0
@@ -157,6 +157,7 @@ struct sci_port {bool has_rtscts;bool autorts; +bool tx_occurred; };#define SCI_NPORTS CONFIG_SERIAL_SH_SCI_NR_UARTS
@@ -807,6 +808,7 @@ static void sci_transmit_chars(struct uart_port *port) {struct circ_buf *xmit = &port->state->xmit;unsigned int stopped =uart_tx_stopped (port); +struct sci_port *s =to_sci_port (port);unsigned short status;unsigned short ctrl;int count;
@@ -838,6 +840,7 @@ static void sci_transmit_chars(struct uart_port *port) }serial_port_out (port, SCxTDR, c); + s->tx_occurred = true; port->icount.tx++; }while (--count >0 );
@@ -1202,6 +1205,8 @@ static void sci_dma_tx_complete(void *arg)if (uart_circ_chars_pending (xmit) <WAKEUP_CHARS )uart_write_wakeup (port); + s->tx_occurred = true; +if (!uart_circ_empty (xmit)) { s->cookie_tx =0 ;schedule_work (&s->work_tx);
@@ -1684,6 +1689,19 @@ static void sci_flush_buffer(struct uart_port *port) s->cookie_tx = -EINVAL; } } + +static void sci_dma_check_tx_occurred (struct sci_port *s) +{ +struct dma_tx_state state; +enum dma_status status; + +if (!s->chan_tx) +return ; + + status =dmaengine_tx_status (s->chan_tx, s->cookie_tx, &state); +if (status ==DMA_COMPLETE || status ==DMA_IN_PROGRESS ) + s->tx_occurred = true; +}#else /* !CONFIG_SERIAL_SH_SCI_DMA */ static inline void sci_request_dma (struct uart_port *port) {
@@ -1693,6 +1711,10 @@ static inline void sci_free_dma(struct uart_port *port) { } +static void sci_dma_check_tx_occurred (struct sci_port *s) +{ +} +#define sci_flush_buffer NULL#endif /* !CONFIG_SERIAL_SH_SCI_DMA */
@@ -2005,6 +2027,12 @@ static unsigned int sci_tx_empty(struct uart_port *port) {unsigned short status =serial_port_in (port, SCxSR);unsigned short in_tx_fifo =sci_txfill (port); +struct sci_port *s =to_sci_port (port); + +sci_dma_check_tx_occurred (s); + +if (!s->tx_occurred) +return TIOCSER_TEMT ;return (status &SCxSR_TEND (port)) && !in_tx_fifo ?TIOCSER_TEMT :0 ; }
@@ -2175,6 +2203,7 @@ static int sci_startup(struct uart_port *port)dev_dbg (port->dev,"%s(%d)\n" , __func__, port->line); + s->tx_occurred = false;sci_request_dma (port); ret =sci_request_irq (s);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/411 serial: sh-sci: Move runtime PM enable to sci_probe_single()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 239f11209e5f282e16f5241b99256e25dd0614b6 upstream.
Relocate the runtime PM enable operation to sci_probe_single(). This change prepares the codebase for upcoming fixes.
While at it, replace the existing logic with a direct call to devm_pm_runtime_enable() and remove sci_cleanup_single(). The devm_pm_runtime_enable() function automatically handles disabling runtime PM during driver removal.
--- drivers/tty/serial/sh-sci.c | 24 ++++++------------------ 1 file changed, 6 insertions(+), 18 deletions(-)
drivers/tty/serial/sh-sci.c +6 -18
@@ -2993,10 +2993,6 @@ static int sci_init_single(struct platform_device *dev, ret =sci_init_clocks (sci_port, &dev->dev);if (ret <0 )return ret; - - port->dev = &dev->dev; - -pm_runtime_enable (&dev->dev); } port->type = p->type;
@@ -3026,11 +3022,6 @@ static int sci_init_single(struct platform_device *dev,return 0 ; } -static void sci_cleanup_single (struct sci_port *port) -{ -pm_runtime_disable (port->port.dev); -} -#if defined(CONFIG_SERIAL_SH_SCI_CONSOLE ) || \ defined(CONFIG_SERIAL_SH_SCI_EARLYCON )static void serial_console_putchar (struct uart_port *port,int ch)
@@ -3188,8 +3179,6 @@ static int sci_remove(struct platform_device *dev) sci_ports_in_use &= ~BIT (port->port.line);uart_remove_one_port (&sci_uart_driver, &port->port); -sci_cleanup_single (port); -if (port->port.fifosize >1 )device_remove_file (&dev->dev, &dev_attr_rx_fifo_trigger);if (type ==PORT_SCIFA || type ==PORT_SCIFB || type ==PORT_HSCIF )
@@ -3324,6 +3313,11 @@ static int sci_probe_single(struct platform_device *dev,if (ret)return ret; + sciport->port.dev = &dev->dev; + ret =devm_pm_runtime_enable (&dev->dev); +if (ret) +return ret; + sciport->gpios =mctrl_gpio_init (&sciport->port,0 );if (IS_ERR (sciport->gpios))return PTR_ERR (sciport->gpios);
@@ -3337,13 +3331,7 @@ static int sci_probe_single(struct platform_device *dev, sciport->port.flags |=UPF_HARD_FLOW ; } - ret =uart_add_one_port (&sci_uart_driver, &sciport->port); -if (ret) { -sci_cleanup_single (sciport); -return ret; - } - -return 0 ; +return uart_add_one_port (&sci_uart_driver, &sciport->port); }static int sci_probe (struct platform_device *dev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/411 serial: sh-sci: Clean sci_ports[0] after at earlycon exit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 5f1017069933489add0c08659673443c9905659e upstream.
The early_console_setup() function initializes sci_ports[0].port with an object of type struct uart_port obtained from the struct earlycon_device passed as an argument to early_console_setup().
Later, during serial port probing, the serial port used as earlycon (e.g., port A) might be remapped to a different position in the sci_ports[] array, and a different serial port (e.g., port B) might be assigned to slot
0. For example:
sci_ports[0] = port B
sci_ports[X] = port A
In this scenario, the new port mapped at index zero (port B) retains the data associated with the earlycon configuration. Consequently, after the Linux boot process, any access to the serial port now mapped to sci_ports[0] (port B) will block the original earlycon port (port A).
To address this, introduce an early_console_exit() function to clean up sci_ports[0] when earlycon is exited.
To prevent the cleanup of sci_ports[0] while the serial device is still being used by earlycon, introduce the struct sci_port::probing flag and account for it in early_console_exit().
--- drivers/tty/serial/sh-sci.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-)
drivers/tty/serial/sh-sci.c +30 -2
@@ -166,6 +166,7 @@ static struct sci_port sci_ports[SCI_NPORTS];static unsigned long sci_ports_in_use;static struct uart_driver sci_uart_driver;static bool sci_uart_earlycon; +static bool sci_uart_earlycon_dev_probing;static inline struct sci_port *to_sci_port (struct uart_port *uart)
@@ -3284,7 +3285,8 @@ static struct plat_sci_port *sci_parse_dt(struct platform_device *pdev,static int sci_probe_single (struct platform_device *dev,unsigned int index,struct plat_sci_port *p, -struct sci_port *sciport) +struct sci_port *sciport, +struct resource *sci_res) {int ret;
@@ -3331,6 +3333,14 @@ static int sci_probe_single(struct platform_device *dev, sciport->port.flags |=UPF_HARD_FLOW ; } +if (sci_uart_earlycon && sci_ports[0 ].port.mapbase == sci_res->start) { +/* +* Skip cleanup the sci_port[0] in early_console_exit(), this +* port is the same as the earlycon one. +*/ + sci_uart_earlycon_dev_probing = true; + } +return uart_add_one_port (&sci_uart_driver, &sciport->port); }
@@ -3389,7 +3399,7 @@ static int sci_probe(struct platform_device *dev)platform_set_drvdata (dev, sp); - ret =sci_probe_single (dev, dev_id, p, sp); + ret =sci_probe_single (dev, dev_id, p, sp, res);if (ret)return ret;
@@ -3472,6 +3482,22 @@ sh_early_platform_init_buffer("earlyprintk", &sci_driver,#ifdef CONFIG_SERIAL_SH_SCI_EARLYCON static struct plat_sci_port port_cfg; +static int early_console_exit (struct console *co) +{ +struct sci_port *sci_port = &sci_ports[0 ]; + +/* +* Clean the slot used by earlycon. A new SCI device might +* map to this slot. +*/ +if (!sci_uart_earlycon_dev_probing) { +memset (sci_port,0 ,sizeof (*sci_port)); + sci_uart_earlycon = false; + } + +return 0 ; +} +static int __init early_console_setup (struct earlycon_device *device,int type) {
@@ -3491,6 +3517,8 @@ static int __init early_console_setup(struct earlycon_device *device, SCSCR_RE | SCSCR_TE | port_cfg.scscr); device->con->write = serial_console_write; + device->con->exit = early_console_exit; +return 0 ; } static int __init sci_early_console_setup(struct earlycon_device *device,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/411 scsi: core: ufs: Fix a hang in the error handler
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjeev Yadav <[email protected]>
[ Upstream commit 8a3514d348de87a9d5e2ac00fbac4faae0b97996 ]
ufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter function can only succeed if UFSHCD_EH_IN_PROGRESS is not set because resuming involves submitting a SCSI command and ufshcd_queuecommand() returns SCSI_MLQUEUE_HOST_BUSY if UFSHCD_EH_IN_PROGRESS is set. Fix this hang by setting UFSHCD_EH_IN_PROGRESS after ufshcd_rpm_get_sync() has been called instead of before.
Backtrace: __switch_to+0x174/0x338 __schedule+0x600/0x9e4 schedule+0x7c/0xe8 schedule_timeout+0xa4/0x1c8 io_schedule_timeout+0x48/0x70 wait_for_common_io+0xa8/0x160 //waiting on START_STOP wait_for_completion_io_timeout+0x10/0x20 blk_execute_rq+0xe4/0x1e4 scsi_execute_cmd+0x108/0x244 ufshcd_set_dev_pwr_mode+0xe8/0x250 __ufshcd_wl_resume+0x94/0x354 ufshcd_wl_runtime_resume+0x3c/0x174 scsi_runtime_resume+0x64/0xa4 rpm_resume+0x15c/0xa1c __pm_runtime_resume+0x4c/0x90 // Runtime resume ongoing ufshcd_err_handler+0x1a0/0xd08 process_one_work+0x174/0x808 worker_thread+0x15c/0x490 kthread+0xf4/0x1ec ret_from_fork+0x10/0x20
--- drivers/scsi/ufs/ufshcd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +6 -1
@@ -6073,9 +6073,14 @@ static void ufshcd_err_handler(struct work_struct *work)up (&hba->host_sem);return ; } -ufshcd_set_eh_in_progress (hba);spin_unlock_irqrestore (hba->host->host_lock, flags); +ufshcd_err_handling_prepare (hba); + +spin_lock_irqsave (hba->host->host_lock, flags); +ufshcd_set_eh_in_progress (hba); +spin_unlock_irqrestore (hba->host->host_lock, flags); +/* Complete requests that have door-bell cleared by h/w */ ufshcd_complete_requests (hba);spin_lock_irqsave (hba->host->host_lock, flags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/411 ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit 87f7ce260a3c838b49e1dc1ceedf1006795157a2 ]
There is no disagreement that we should check both ptp->is_virtual_clock and ptp->n_vclocks to check if the ptp virtual clock is in use.
However, when we acquire ptp->n_vclocks_mux to read ptp->n_vclocks in ptp_vclock_in_use(), we observe a recursive lock in the call trace starting from n_vclocks_store().
============================================
WARNING: possible recursive locking detected 6.15.0-rc6 #1 Not tainted
--------------------------------------------
syz.0.1540/13807 is trying to acquire lock:ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:
ptp_vclock_in_use drivers/ptp/ptp_private.h:103 [inline]ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:
ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415
but task is already holding lock:ffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:
n_vclocks_store+0xf1/0x6d0 drivers/ptp/ptp_sysfs.c:215
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&ptp->n_vclocks_mux);
lock(&ptp->n_vclocks_mux);
*** DEADLOCK ***
....
============================================
The best way to solve this is to remove the logic that checks ptp->n_vclocks in ptp_vclock_in_use().
The reason why this is appropriate is that any path that uses ptp->n_vclocks must unconditionally check if ptp->n_vclocks is greater than 0 before unregistering vclocks, and all functions are already written this way. And in the function that uses ptp->n_vclocks, we already get ptp->n_vclocks_mux before unregistering vclocks.
Therefore, we need to remove the redundant check for ptp->n_vclocks in ptp_vclock_in_use() to prevent recursive locking.
--- drivers/ptp/ptp_private.h | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
drivers/ptp/ptp_private.h +1 -11
@@ -87,17 +87,7 @@ static inline int queue_cnt(const struct timestamp_event_queue *q)/* Check if ptp virtual clock is in use */ static inline bool ptp_vclock_in_use (struct ptp_clock *ptp) { -bool in_use = false; - -if (mutex_lock_interruptible (&ptp->n_vclocks_mux)) -return true; - -if (!ptp->is_virtual_clock && ptp->n_vclocks) - in_use = true; - -mutex_unlock (&ptp->n_vclocks_mux); - -return in_use; +return !ptp->is_virtual_clock; }extern struct class *ptp_class;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/411 ath10k: snoc: fix unbalanced IRQ enable in crash recovery
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Caleb Connolly <[email protected]>
[ Upstream commit 1650d32b92b01db03a1a95d69ee74fcbc34d4b00 ]
In ath10k_snoc_hif_stop() we skip disabling the IRQs in the crash recovery flow, but we still unconditionally call enable again in ath10k_snoc_hif_start().
We can't check the ATH10K_FLAG_CRASH_FLUSH bit since it is cleared before hif_start() is called, so instead check the ATH10K_SNOC_FLAG_RECOVERY flag and skip enabling the IRQs during crash recovery.
This fixes unbalanced IRQ enable splats that happen after recovering from a crash.
--- drivers/net/wireless/ath/ath10k/snoc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/snoc.c +3 -1
@@ -936,7 +936,9 @@ static int ath10k_snoc_hif_start(struct ath10k *ar)bitmap_clear (ar_snoc->pending_ce_irqs,0 ,CE_COUNT_MAX );ath10k_core_napi_enable (ar); -ath10k_snoc_irq_enable (ar); +/* IRQs are left enabled when we restart due to a firmware crash */ +if (!test_bit (ATH10K_SNOC_FLAG_RECOVERY , &ar_snoc->flags)) +ath10k_snoc_irq_enable (ar);ath10k_snoc_rx_post (ar);clear_bit (ATH10K_SNOC_FLAG_RECOVERY , &ar_snoc->flags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/411 scsi: iscsi: Fix incorrect error path labels for flashnode operations
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 9b17621366d210ffee83262a8754086ebbde5e55 ]
Correct the error handling goto labels used when host lookup fails in various flashnode-related event handlers:
- iscsi_new_flashnode()
- iscsi_del_flashnode()
- iscsi_login_flashnode()
- iscsi_logout_flashnode()
- iscsi_logout_flashnode_sid()
scsi_host_put() is not required when shost is NULL, so jumping to the correct label avoids unnecessary operations. These functions previously jumped to the wrong goto label (put_host), which did not match the intended cleanup logic.
Use the correct exit labels (exit_new_fnode, exit_del_fnode, etc.) to ensure proper error handling. Also remove the unused put_host label under iscsi_new_flashnode() as it is no longer needed.
No functional changes beyond accurate error path correction.
--- drivers/scsi/scsi_transport_iscsi.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/scsi/scsi_transport_iscsi.c +5 -6
@@ -3545,7 +3545,7 @@ static int iscsi_new_flashnode(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.new_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_new_fnode; } index = transport->new_flashnode (shost, data, len);
@@ -3555,7 +3555,6 @@ static int iscsi_new_flashnode(struct iscsi_transport *transport,else err = -EIO ; -put_host:scsi_host_put (shost); exit_new_fnode:
@@ -3580,7 +3579,7 @@ static int iscsi_del_flashnode(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.del_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_del_fnode; } idx = ev->u.del_flashnode.flashnode_idx;
@@ -3622,7 +3621,7 @@ static int iscsi_login_flashnode(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.login_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_login_fnode; } idx = ev->u.login_flashnode.flashnode_idx;
@@ -3674,7 +3673,7 @@ static int iscsi_logout_flashnode(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.logout_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_logout_fnode; } idx = ev->u.logout_flashnode.flashnode_idx;
@@ -3724,7 +3723,7 @@ static int iscsi_logout_flashnode_sid(struct iscsi_transport *transport,pr_err ("%s could not find host no %u\n" , __func__, ev->u.logout_flashnode.host_no); err = -ENODEV ; - goto put_host; + goto exit_logout_sid; } session =iscsi_session_lookup (ev->u.logout_flashnode_sid.sid);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/411 net_sched: sch_sfq: fix a potential crash on gso_skb handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 82ffbe7776d0ac084031f114167712269bf3d832 ]
SFQ has an assumption of always being able to queue at least one packet.
However, after the blamed commit, sch->q.len can be inflated by packets in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed by an immediate drop.
Fix sfq_drop() to properly clear q->tail in this situation.
Tested:
ip netns add lb
ip link add dev to-lb type veth peer name in-lb netns lb
ethtool -K to-lb tso off # force qdisc to requeue gso_skb
ip netns exec lb ethtool -K in-lb gro on # enable NAPI ip link set dev to-lb up
ip -netns lb link set dev in-lb up
ip addr add dev to-lb 192.168.20.1/24
ip -netns lb addr add dev in-lb 192.168.20.2/24 tc qdisc replace dev to-lb root sfq limit 100
ip netns exec lb netserver
netperf -H 192.168.20.2 -l 100 &
netperf -H 192.168.20.2 -l 100 &
netperf -H 192.168.20.2 -l 100 &
netperf -H 192.168.20.2 -l 100 &
--- net/sched/sch_sfq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/sched/sch_sfq.c +4 -1
@@ -317,7 +317,10 @@ static unsigned int sfq_drop(struct Qdisc *sch, struct sk_buff **to_free)/* It is difficult to believe, but ALL THE SLOTS HAVE LENGTH 1. */ x = q->tail->next; slot = &q->slots[x]; - q->tail->next = slot->next; +if (slot->next == x) + q->tail =NULL ;/* no more active slots */ +else + q->tail->next = slot->next; q->ht[slot->hash] =SFQ_EMPTY_SLOT ; goto drop; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 144/411 powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
[ Upstream commit cd097df4596f3a1e9d75eb8520162de1eb8485b2 ]
memtrace mmap issue has an out of bounds issue. This patch fixes the by checking that the requested mapping region size should stay within the allocated region size.
--- arch/powerpc/platforms/powernv/memtrace.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/powerpc/platforms/powernv/memtrace.c +6 -2
@@ -48,11 +48,15 @@ static ssize_t memtrace_read(struct file *filp, char __user *ubuf,static int memtrace_mmap (struct file *filp,struct vm_area_struct *vma) {struct memtrace_entry *ent = filp->private_data; +unsigned long ent_nrpages = ent->size >>PAGE_SHIFT ; +unsigned long vma_nrpages =vma_pages (vma); -if (ent->size < vma->vm_end - vma->vm_start) +/* The requested page offset should be within object's page count */ +if (vma->vm_pgoff >= ent_nrpages)return -EINVAL ; -if (vma->vm_pgoff <<PAGE_SHIFT >= ent->size) +/* The requested mapping range should remain within the bounds */ +if (vma_nrpages > ent_nrpages - vma->vm_pgoff)return -EINVAL ; vma->vm_page_prot =pgprot_noncached (vma->vm_page_prot);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 145/411 powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haren Myneni <[email protected]>
[ Upstream commit 0d67f0dee6c9176bc09a5482dd7346e3a0f14d0b ]
The user space calls mmap() to map VAS window paste address and the kernel returns the complete mapped page for each window. So return -EINVAL if non-zero is passed for offset parameter to mmap().
See Documentation/arch/powerpc/vas-api.rst for mmap() restrictions.
--- arch/powerpc/platforms/book3s/vas-api.c | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/powerpc/platforms/book3s/vas-api.c +9 -0
@@ -367,6 +367,15 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma)return -EINVAL ; } +/* +* Map complete page to the paste address. So the user +* space should pass 0ULL to the offset parameter. +*/ +if (vma->vm_pgoff) { +pr_debug ("Page offset unsupported to map paste address\n" ); +return -EINVAL ; + } +/* Ensure instance has an open send window */ if (!txwin) {pr_err ("%s(): No send window open?\n" , __func__);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 146/411 drm/meson: use unsigned long long / Hz for frequency types
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit 1017560164b6bbcbc93579266926e6e96675262a ]
Christian reports that 4K output using YUV420 encoding fails with the following error:
Fatal Error, invalid HDMI vclk freq 593406
Modetest shows the following:
3840x2160 59.94 3840 4016 4104 4400 2160 2168 2178 2250 593407 flags: xxxx, xxxx, drm calculated value -------------------------------------^
This indicates that there's a (1kHz) mismatch between the clock calculated by the drm framework and the meson driver.
Relevant function call stack:
(drm framework)
-> meson_encoder_hdmi_atomic_enable()
-> meson_encoder_hdmi_set_vclk()
-> meson_vclk_setup()The video clock requested by the drm framework is 593407kHz. This is passed by meson_encoder_hdmi_atomic_enable() to meson_encoder_hdmi_set_vclk() and the following formula is applied:
- the frequency is halved (which would be 296703.5kHz) and rounded down to the next full integer, which is 296703kHz
- TMDS clock is calculated (296703kHz * 10)
- video encoder clock is calculated - this needs to match a table from meson_vclk.c and so it doubles the previously halved value again (resulting in 593406kHz)
- meson_vclk_setup() can't find (either directly, or by deriving it from 594000kHz * 1000 / 1001 and rounding to the closest integer value - which is 593407kHz as originally requested by the drm framework) a matching clock in it's internal table and errors out with "invalid HDMI vclk freq"
Fix the division precision by switching the whole meson driver to use unsigned long long (64-bit) Hz values for clock frequencies instead of unsigned int (32-bit) kHz to fix the rouding error.
Stable-dep-of: d17e61ab63fb ("drm/meson: fix debug log statement when setting the HDMI clocks")
--- drivers/gpu/drm/meson/meson_drv.c | 2 +- drivers/gpu/drm/meson/meson_drv.h | 2 +- drivers/gpu/drm/meson/meson_encoder_hdmi.c | 29 +-- drivers/gpu/drm/meson/meson_vclk.c | 195 +++++++++++---------- drivers/gpu/drm/meson/meson_vclk.h | 13 +- 5 files changed, 126 insertions(+), 115 deletions(-)
drivers/gpu/drm/meson/meson_drv.c +1 -1
@@ -166,7 +166,7 @@ static const struct meson_drm_soc_attr meson_drm_soc_attrs[] = {/* S805X/S805Y HDMI PLL won't lock for HDMI PHY freq > 1,65GHz */ { .limits = { - .max_hdmi_phy_freq = 1650000, + .max_hdmi_phy_freq = 1650000000, }, .attrs = (const struct soc_device_attribute []) { { .soc_id = "GXL (S805*)", },
drivers/gpu/drm/meson/meson_drv.h +1 -1
@@ -31,7 +31,7 @@ struct meson_drm_match_data { };struct meson_drm_soc_limits { -unsigned int max_hdmi_phy_freq; +unsigned long long max_hdmi_phy_freq; };struct meson_drm {
drivers/gpu/drm/meson/meson_encoder_hdmi.c +16 -13
@@ -68,12 +68,12 @@ static void meson_encoder_hdmi_set_vclk(struct meson_encoder_hdmi *encoder_hdmi, {struct meson_drm *priv = encoder_hdmi->priv;int vic =drm_match_cea_mode (mode); -unsigned int phy_freq; -unsigned int vclk_freq; -unsigned int venc_freq; -unsigned int hdmi_freq; +unsigned long long phy_freq; +unsigned long long vclk_freq; +unsigned long long venc_freq; +unsigned long long hdmi_freq; - vclk_freq = mode->clock; + vclk_freq = mode->clock *1000 ;/* For 420, pixel clock is half unlike venc clock */ if (encoder_hdmi->output_bus_fmt ==MEDIA_BUS_FMT_UYYVYY8_0_5X24 )
@@ -105,7 +105,8 @@ static void meson_encoder_hdmi_set_vclk(struct meson_encoder_hdmi *encoder_hdmi,if (mode->flags &DRM_MODE_FLAG_DBLCLK ) venc_freq /=2 ; -dev_dbg (priv->dev,"vclk:%d phy=%d venc=%d hdmi=%d enci=%d\n" , +dev_dbg (priv->dev, +"vclk:%lluHz phy=%lluHz venc=%lluHz hdmi=%lluHz enci=%d\n" , phy_freq, vclk_freq, venc_freq, hdmi_freq, priv->venc.hdmi_use_enci);
@@ -120,10 +121,11 @@ static enum drm_mode_status meson_encoder_hdmi_mode_valid(struct drm_bridge *bristruct meson_encoder_hdmi *encoder_hdmi =bridge_to_meson_encoder_hdmi (bridge);struct meson_drm *priv = encoder_hdmi->priv;bool is_hdmi2_sink = display_info->hdmi.scdc.supported; -unsigned int phy_freq; -unsigned int vclk_freq; -unsigned int venc_freq; -unsigned int hdmi_freq; +unsigned long long clock = mode->clock *1000 ; +unsigned long long phy_freq; +unsigned long long vclk_freq; +unsigned long long venc_freq; +unsigned long long hdmi_freq;int vic =drm_match_cea_mode (mode);enum drm_mode_status status;
@@ -142,12 +144,12 @@ static enum drm_mode_status meson_encoder_hdmi_mode_valid(struct drm_bridge *briif (status !=MODE_OK )return status; -return meson_vclk_dmt_supported_freq (priv, mode->clock); +return meson_vclk_dmt_supported_freq (priv, clock);/* Check against supported VIC modes */ }else if (!meson_venc_hdmi_supported_vic (vic))return MODE_BAD ; - vclk_freq = mode->clock; + vclk_freq = clock;/* For 420, pixel clock is half unlike venc clock */ if (drm_mode_is_420_only(display_info, mode) ||
@@ -177,7 +179,8 @@ static enum drm_mode_status meson_encoder_hdmi_mode_valid(struct drm_bridge *briif (mode->flags &DRM_MODE_FLAG_DBLCLK ) venc_freq /=2 ; -dev_dbg (priv->dev,"%s: vclk:%d phy=%d venc=%d hdmi=%d\n" , +dev_dbg (priv->dev, +"%s: vclk:%lluHz phy=%lluHz venc=%lluHz hdmi=%lluHz\n" , __func__, phy_freq, vclk_freq, venc_freq, hdmi_freq);return meson_vclk_vic_supported_freq (priv, phy_freq, vclk_freq);
drivers/gpu/drm/meson/meson_vclk.c +101 -94
425 lines not on this page · raw message
drivers/gpu/drm/meson/meson_vclk.h +7 -6
@@ -20,17 +20,18 @@ enum { };/* 27MHz is the CVBS Pixel Clock */ -#define MESON_VCLK_CVBS 27000 +#define MESON_VCLK_CVBS (27 * 1000 * 1000)enum drm_mode_status -meson_vclk_dmt_supported_freq (struct meson_drm *priv,unsigned int freq); +meson_vclk_dmt_supported_freq (struct meson_drm *priv,unsigned long long freq);enum drm_mode_status -meson_vclk_vic_supported_freq (struct meson_drm *priv,unsigned int phy_freq, -unsigned int vclk_freq); +meson_vclk_vic_supported_freq (struct meson_drm *priv, +unsigned long long phy_freq, +unsigned long long vclk_freq);void meson_vclk_setup (struct meson_drm *priv,unsigned int target, -unsigned int phy_freq,unsigned int vclk_freq, -unsigned int venc_freq,unsigned int dac_freq, +unsigned long long phy_freq,unsigned long long vclk_freq, +unsigned long long venc_freq,unsigned long long dac_freq,bool hdmi_use_enci);#endif /* __MESON_VCLK_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 147/411 drm/meson: fix debug log statement when setting the HDMI clocks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit d17e61ab63fb7747b340d6a66bf1408cd5c6562b ]
The "phy" and "vclk" frequency labels were swapped, making it more difficult to debug driver errors. Swap the label order to make them match with the actual frequencies printed to correct this.
--- drivers/gpu/drm/meson/meson_encoder_hdmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/meson/meson_encoder_hdmi.c +1 -1
@@ -106,7 +106,7 @@ static void meson_encoder_hdmi_set_vclk(struct meson_encoder_hdmi *encoder_hdmi, venc_freq /=2 ;dev_dbg (priv->dev, -"vclk:%lluHz phy=%lluHz venc=%lluHz hdmi=%lluHz enci=%d\n" , +"phy:%lluHz vclk=%lluHz venc=%lluHz hdmi=%lluHz enci=%d\n" , phy_freq, vclk_freq, venc_freq, hdmi_freq, priv->venc.hdmi_use_enci);
Signature · 79 lines
2.39.5 ies them. The one, small saving grace is: Before the driver tries to read the eeprom, it needs to upload >a< firmware. the vendor firmware has a proprietary license and as a reason, it is not present on most distributions by default. Cc: <[email protected]> Reported-by: Robert Morris <[email protected]> Closes: https://lore.kernel.org/linux-wireless/28782.1747258414@localhost/ Fixes: 7cb770729ba8 ("p54: move eeprom code into common library") Signed-off-by: Christian Lamparter <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> --- drivers/net/wireless/intersil/p54/fwio.c | 2 ++ drivers/net/wireless/intersil/p54/p54.h | 1 + drivers/net/wireless/intersil/p54/txrx.c | 13 +++++++++---- 3 files changed, 12 insertions(+), 4 deletions(-) --- a/drivers/net/wireless/intersil/p54/fwio.c +++ b/drivers/net/wireless/intersil/p54/fwio.c @@ -233,6 +233,7 @@ int p54_download_eeprom(struct p54_commo mutex_lock(&priv->eeprom_mutex); priv->eeprom = buf; + priv->eeprom_slice_size = len; eeprom_hdr = skb_put(skb, eeprom_hdr_size + len); if (priv->fw_var < 0x509) { @@ -255,6 +256,7 @@ int p54_download_eeprom(struct p54_commo ret = -EBUSY; } priv->eeprom = NULL; + priv->eeprom_slice_size = 0; mutex_unlock(&priv->eeprom_mutex); return ret; } --- a/drivers/net/wireless/intersil/p54/p54.h +++ b/drivers/net/wireless/intersil/p54/p54.h @@ -258,6 +258,7 @@ struct p54_common { /* eeprom handling */ void *eeprom; + size_t eeprom_slice_size; struct completion eeprom_comp; struct mutex eeprom_mutex; }; --- a/drivers/net/wireless/intersil/p54/txrx.c +++ b/drivers/net/wireless/intersil/p54/txrx.c @@ -500,14 +500,19 @@ static void p54_rx_eeprom_readback(struc return ; if (priv->fw_var >= 0x509) { - memcpy(priv->eeprom, eeprom->v2.data, - le16_to_cpu(eeprom->v2.len)); + if (le16_to_cpu(eeprom->v2.len) != priv->eeprom_slice_size) + return; + + memcpy(priv->eeprom, eeprom->v2.data, priv->eeprom_slice_size); } else { - memcpy(priv->eeprom, eeprom->v1.data, - le16_to_cpu(eeprom->v1.len)); + if (le16_to_cpu(eeprom->v1.len) != priv->eeprom_slice_size) + return; + + memcpy(priv->eeprom, eeprom->v1.data, priv->eeprom_slice_size); } priv->eeprom = NULL; + priv->eeprom_slice_size = 0; tmp = p54_find_and_unlink_skb(priv, hdr->req_id); dev_kfree_skb_any(tmp); complete(&priv->eeprom_comp);
Greg Kroah-Hartman
maintainerPATCH 148/411 drm/meson: use vclk_freq instead of pixel_freq in debug print
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit faf2f8382088e8c74bd6eeb236c8c9190e61615e ]
meson_vclk_vic_supported_freq() has a debug print which includes the pixel freq. However, within the whole function the pixel freq is irrelevant, other than checking the end of the params array. Switch to printing the vclk_freq which is being compared / matched against the inputs to the function to avoid confusion when analyzing error reports from users.
--- drivers/gpu/drm/meson/meson_vclk.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/meson/meson_vclk.c +3 -3
@@ -790,9 +790,9 @@ meson_vclk_vic_supported_freq(struct meson_drm *priv, }for (i =0 ; params[i].pixel_freq ; ++i) { -DRM_DEBUG_DRIVER ("i = %d pixel_freq = %lluHz alt = %lluHz\n" , - i, params[i].pixel_freq, -PIXEL_FREQ_1000_1001 (params[i].pixel_freq)); +DRM_DEBUG_DRIVER ("i = %d vclk_freq = %lluHz alt = %lluHz\n" , + i, params[i].vclk_freq, +PIXEL_FREQ_1000_1001 (params[i].vclk_freq));DRM_DEBUG_DRIVER ("i = %d phy_freq = %lluHz alt = %lluHz\n" , i, params[i].phy_freq,PHY_FREQ_1000_1001 (params[i].phy_freq));
Signature · 1 line
2.39.5