6.6.99-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.6.99-rc1 review
This is the start of the stable review cycle for the 6.6.99 release. There are 109 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 17 Jul 2025 13:07:32 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.99-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.99-rc1
Namjae Jeon <[email protected]>
ksmbd: fix potential use-after-free in oplock/lease break ack
Yeoreum Yun <[email protected]>
kasan: remove kasan_find_vm_area() to prevent possible deadlock
Paulo Alcantara <[email protected]>
smb: client: fix potential race in cifs_put_tcon()
Willem de Bruijn <[email protected]>
selftests/bpf: adapt one more case in test_lru_map to the new target_free
Hans de Goede <[email protected]>
Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
Chia-Lin Kao (AceLan) <[email protected]>
HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
Zhang Heng <[email protected]>
HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
Willem de Bruijn <[email protected]>
bpf: Adjust free target to avoid global starvation of LRU map
Nicolas Pitre <[email protected]>
vt: add missing notification when switching back to text mode
Filipe Manana <[email protected]>
btrfs: fix assertion when building free space tree
Long Li <[email protected]>
net: mana: Record doorbell physical address in PF mode
Akira Inoue <[email protected]>
HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
Xiaowei Li <[email protected]>
net: usb: qmi_wwan: add SIMCom 8230C composition
Yasmin Fitzgerald <[email protected]>
ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
Yuzuru10 <[email protected]>
ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
Fengnan Chang <[email protected]>
io_uring: make fallocate be hashed work
Tiwei Bie <[email protected]>
um: vector: Reduce stack usage in vector_eth_configure()
Thomas Fourier <[email protected]>
atm: idt77252: Add missing `dma_map_error()`
Ronnie Sahlberg <[email protected]>
ublk: sanity check add_dev input for underflow
Somnath Kotur <[email protected]>
bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
Shravya KN <[email protected]>
bnxt_en: Fix DCB ETS validation
Alok Tiwari <[email protected]>
net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
Sean Nyekjaer <[email protected]>
can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
Oleksij Rempel <[email protected]>
net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
Mingming Cao <[email protected]>
ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
Kito Xu <[email protected]>
net: appletalk: Fix device refcount leak in atrtr_create()
Eric Dumazet <[email protected]>
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
Zheng Qixing <[email protected]>
nbd: fix uaf in nbd_genl_connect() error path
Nigel Croxon <[email protected]>
raid10: cleanup memleak at raid10_make_request
Wang Jinchao <[email protected]>
md/raid1: Fix stack memory use after return in raid1_reshape
Mikko Perttunen <[email protected]>
drm/tegra: nvdec: Fix dma_alloc_coherent error check
Daniil Dulov <[email protected]>
wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
Shyam Prasad N <[email protected]>
cifs: all initializations for tcon should happen in tcon_info_alloc
Paulo Alcantara <[email protected]>
smb: client: fix DFS interlink failover
Paulo Alcantara <[email protected]>
smb: client: avoid unnecessary reconnects when refreshing referrals
Kuen-Han Tsai <[email protected]>
usb: dwc3: Abort suspend on soft disconnect failure
Pawel Laszczak <[email protected]>
usb: cdnsp: Fix issue with CV Bad Descriptor test
Lee Jones <[email protected]>
usb: cdnsp: Replace snprintf() with the safer scnprintf() variant
Pawel Laszczak <[email protected]>
usb:cdnsp: remove TRB_FLUSH_ENDPOINT command
Filipe Manana <[email protected]>
btrfs: fix inode lookup error handling during log replay
Filipe Manana <[email protected]>
btrfs: return a btrfs_inode from btrfs_iget_logging()
Filipe Manana <[email protected]>
btrfs: remove redundant root argument from fixup_inode_link_count()
Filipe Manana <[email protected]>
btrfs: remove redundant root argument from btrfs_update_inode_fallback()
Filipe Manana <[email protected]>
btrfs: remove noinline from btrfs_update_inode()
Jakub Kicinski <[email protected]>
netlink: make sure we allow at least one dump skb
Kuniyuki Iwashima <[email protected]>
netlink: Fix rmem check in netlink_broadcast_deliver().
Chao Yu <[email protected]>
erofs: fix to add missing tracepoint in erofs_read_folio()
Al Viro <[email protected]>
ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
Stefan Metzmacher <[email protected]>
smb: server: make use of rdma_destroy_qp()
Jann Horn <[email protected]>
x86/mm: Disable hugetlb page table sharing on 32-bit
Mikhail Paulyshka <[email protected]>
x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
Uwe Kleine-König <[email protected]>
pwm: mediatek: Ensure to disable clocks in error path
Alexander Gordeev <[email protected]>
mm/vmalloc: leave lazy MMU mode on PTE mapping error
Florian Fainelli <[email protected]>
scripts/gdb: fix interrupts.py after maple tree conversion
Florian Fainelli <[email protected]>
scripts/gdb: de-reference per-CPU MCE interrupts
Florian Fainelli <[email protected]>
scripts/gdb: fix interrupts display after MCP on x86
Baolin Wang <[email protected]>
mm: fix the inaccurate memory statistics issue for users
Wei Yang <[email protected]>
maple_tree: fix mt_destroy_walk() on root leaf node
Achill Gilgenast <[email protected]>
kallsyms: fix build without execinfo
Rafael J. Wysocki <[email protected]>
Revert "ACPI: battery: negate current when discharging"
Thomas Zimmermann <[email protected]>
drm/framebuffer: Acquire internal references on GEM handles
Kuen-Han Tsai <[email protected]>
Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
Kuen-Han Tsai <[email protected]>
usb: gadget: u_serial: Fix race condition in TTY wakeup
Simona Vetter <[email protected]>
drm/gem: Fix race in drm_gem_handle_create_tail()
Christian König <[email protected]>
drm/ttm: fix error handling in ttm_buffer_object_transfer
Matthew Brost <[email protected]>
drm/sched: Increment job count before swapping tail spsc queue
Thomas Zimmermann <[email protected]>
drm/gem: Acquire references on GEM handles for framebuffers
Mathy Vanhoef <[email protected]>
wifi: prevent A-MSDU attacks in mesh networks
Bartosz Golaszewski <[email protected]>
pinctrl: qcom: msm: mark certain pins as invalid for interrupts
Håkon Bugge <[email protected]>
md/md-bitmap: fix GPF in bitmap_get_stats()
Guillaume Nault <[email protected]>
gre: Fix IPv6 multicast route creation.
Sean Christopherson <[email protected]>
KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
David Woodhouse <[email protected]>
KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
JP Kobryn <[email protected]>
x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
Yazen Ghannam <[email protected]>
x86/mce: Don't remove sysfs if thresholding sysfs init fails
Yazen Ghannam <[email protected]>
x86/mce/amd: Fix threshold limit reset
Yazen Ghannam <[email protected]>
x86/mce/amd: Add default names for MCA banks and blocks
Dan Carpenter <[email protected]>
ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
David Howells <[email protected]>
rxrpc: Fix oops due to non-existence of prealloc backlog struct
Christian Eggers <[email protected]>
Bluetooth: HCI: Set extended advertising data synchronously
Leo Yan <[email protected]>
perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
Liam R. Howlett <[email protected]>
maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
David Howells <[email protected]>
rxrpc: Fix bug due to prealloc collision
Victor Nogueira <[email protected]>
net/sched: Abort __tc_modify_qdisc if parent class does not exist
Yue Haibing <[email protected]>
atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
Kuniyuki Iwashima <[email protected]>
atm: clip: Fix infinite recursive call of clip_push().
Kuniyuki Iwashima <[email protected]>
atm: clip: Fix memory leak of struct clip_vcc.
Kuniyuki Iwashima <[email protected]>
atm: clip: Fix potential null-ptr-deref in to_atmarpd().
Oleksij Rempel <[email protected]>
net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
Oleksij Rempel <[email protected]>
net: phy: smsc: Force predictable MDI-X state on LAN87xx
Oleksij Rempel <[email protected]>
net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
EricChan <[email protected]>
net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
Michal Luczaj <[email protected]>
vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also transport_local
Michal Luczaj <[email protected]>
vsock: Fix transport_* TOCTOU
Michal Luczaj <[email protected]>
vsock: Fix transport_{g2h,h2g} TOCTOU
Jiayuan Chen <[email protected]>
tcp: Correct signedness in skb remaining space calculation
Kuniyuki Iwashima <[email protected]>
tipc: Fix use-after-free in tipc_conn_close().
Stefano Garzarella <[email protected]>
vsock: fix vsock_proto declaration
Kuniyuki Iwashima <[email protected]>
netlink: Fix wraparounds of sk->sk_rmem_alloc.
Al Viro <[email protected]>
fix proc_sys_compare() handling of in-lookup dentries
Mario Limonciello <[email protected]>
pinctrl: amd: Clear GPIO debounce for suspend
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix not disabling advertising instance
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: probe() should fail if the device ID is not recognized
Peter Zijlstra <[email protected]>
perf: Revert to requiring CAP_SYS_ADMIN for uprobes
Luo Gengkun <[email protected]>
perf/core: Fix the WARN_ON_ONCE is out of lock protected region
Shengjiu Wang <[email protected]>
ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
Kaustabh Chakraborty <[email protected]>
drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
Linus Torvalds <[email protected]>
eventpoll: don't decrement ep refcount while still holding the ep mutex
-------------
Diffstat:
Documentation/bpf/map_hash.rst | 8 +- Documentation/bpf/map_lru_hash_update.dot | 6 +- Makefile | 4 +- arch/um/drivers/vector_kern.c | 42 +-- arch/x86/Kconfig | 2 +- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/cpu/amd.c | 7 + arch/x86/kernel/cpu/mce/amd.c | 28 +- arch/x86/kernel/cpu/mce/core.c | 8 +- arch/x86/kernel/cpu/mce/intel.c | 1 + arch/x86/kvm/svm/sev.c | 4 + arch/x86/kvm/xen.c | 15 +- drivers/acpi/battery.c | 19 +- drivers/atm/idt77252.c | 5 + drivers/block/nbd.c | 6 +- drivers/block/ublk_drv.c | 3 +- drivers/char/ipmi/ipmi_msghandler.c | 3 +- drivers/gpu/drm/drm_framebuffer.c | 31 +- drivers/gpu/drm/drm_gem.c | 74 ++++- drivers/gpu/drm/drm_internal.h | 2 + drivers/gpu/drm/exynos/exynos7_drm_decon.c | 4 + drivers/gpu/drm/tegra/nvdec.c | 6 +- drivers/gpu/drm/ttm/ttm_bo_util.c | 13 +- drivers/hid/hid-ids.h | 6 + drivers/hid/hid-lenovo.c | 8 + drivers/hid/hid-multitouch.c | 8 +- drivers/hid/hid-quirks.c | 3 + drivers/input/keyboard/atkbd.c | 3 +- drivers/md/md-bitmap.c | 3 +- drivers/md/raid1.c | 1 + drivers/md/raid10.c | 10 +- drivers/net/can/m_can/m_can.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- drivers/net/ethernet/ibm/ibmvnic.h | 8 +- drivers/net/ethernet/microsoft/mana/gdma_main.c | 3 + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 24 +- drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- drivers/net/phy/microchip.c | 2 +- drivers/net/phy/smsc.c | 57 +++- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/zydas/zd1211rw/zd_mac.c | 6 +- drivers/pinctrl/pinctrl-amd.c | 11 + drivers/pinctrl/qcom/pinctrl-msm.c | 20 ++ drivers/pwm/pwm-mediatek.c | 13 +- drivers/tty/vt/vt.c | 1 + drivers/usb/cdns3/cdnsp-debug.h | 358 ++++++++++----------- drivers/usb/cdns3/cdnsp-ep0.c | 18 +- drivers/usb/cdns3/cdnsp-gadget.c | 6 +- drivers/usb/cdns3/cdnsp-gadget.h | 11 +- drivers/usb/cdns3/cdnsp-ring.c | 27 +- drivers/usb/dwc3/core.c | 9 +- drivers/usb/dwc3/gadget.c | 22 +- drivers/usb/gadget/function/u_serial.c | 12 +- fs/btrfs/btrfs_inode.h | 2 +- fs/btrfs/free-space-tree.c | 16 +- fs/btrfs/inode.c | 18 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-log.c | 331 +++++++++++-------- fs/erofs/data.c | 2 + fs/eventpoll.c | 12 +- fs/proc/inode.c | 2 +- fs/proc/proc_sysctl.c | 18 +- fs/proc/task_mmu.c | 14 +- fs/smb/client/cifsglob.h | 3 + fs/smb/client/cifsproto.h | 13 +- fs/smb/client/connect.c | 47 ++- fs/smb/client/dfs.c | 73 ++--- fs/smb/client/dfs.h | 42 ++- fs/smb/client/dfs_cache.c | 198 +++++++----- fs/smb/client/fs_context.h | 1 + fs/smb/client/misc.c | 9 + fs/smb/client/namespace.c | 2 +- fs/smb/server/smb2pdu.c | 29 +- fs/smb/server/transport_rdma.c | 5 +- fs/smb/server/vfs.c | 1 + include/drm/drm_file.h | 3 + include/drm/drm_framebuffer.h | 7 + include/drm/spsc_queue.h | 4 +- include/linux/mm.h | 5 + include/net/af_vsock.h | 2 +- include/net/netfilter/nf_flow_table.h | 2 +- io_uring/opdef.c | 1 + kernel/bpf/bpf_lru_list.c | 9 +- kernel/bpf/bpf_lru_list.h | 1 + kernel/events/core.c | 6 +- lib/maple_tree.c | 14 +- mm/kasan/report.c | 13 +- mm/vmalloc.c | 22 +- net/appletalk/ddp.c | 1 + net/atm/clip.c | 64 +++- net/bluetooth/hci_event.c | 39 +-- net/bluetooth/hci_sync.c | 215 ++++++++----- net/ipv4/tcp.c | 2 +- net/ipv6/addrconf.c | 9 +- net/netlink/af_netlink.c | 90 +++--- net/rxrpc/call_accept.c | 4 + net/sched/sch_api.c | 23 +- net/tipc/topsrv.c | 2 + net/vmw_vsock/af_vsock.c | 57 +++- net/wireless/util.c | 52 ++- scripts/gdb/linux/constants.py.in | 7 + scripts/gdb/linux/interrupts.py | 16 +- scripts/gdb/linux/mapletree.py | 252 +++++++++++++++ scripts/gdb/linux/xarray.py | 28 ++ sound/pci/hda/patch_realtek.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/cs35l56-shared.c | 2 +- sound/soc/fsl/fsl_asrc.c | 3 +- tools/arch/x86/include/asm/msr-index.h | 1 + tools/build/feature/Makefile | 25 +- tools/include/linux/kallsyms.h | 4 + tools/perf/Makefile.perf | 27 +- tools/testing/selftests/bpf/test_lru_map.c | 105 +++--- 114 files changed, 1887 insertions(+), 1029 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/109 eventpoll: dont decrement ep refcount while still holding the ep mutex
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 8c2e52ebbe885c7eeaabd3b7ddcdc1246fc400d2 upstream.
Jann Horn points out that epoll is decrementing the ep refcount and then doing a
mutex_unlock(&ep->mtx);
afterwards. That's very wrong, because it can lead to a use-after-free.
That pattern is actually fine for the very last reference, because the code in question will delay the actual call to "ep_free(ep)" until after it has unlocked the mutex.
But it's wrong for the much subtler "next to last" case when somebody *else* may also be dropping their reference and free the ep while we're still using the mutex.
Note that this is true even if that other user is also using the same ep
mutex: mutexes, unlike spinlocks, can not be used for object ownership, even if they guarantee mutual exclusion.
A mutex "unlock" operation is not atomic, and as one user is still accessing the mutex as part of unlocking it, another user can come in and get the now released mutex and free the data structure while the first user is still cleaning up.
See our mutex documentation in Documentation/locking/mutex-design.rst, in particular the section [1] about semantics:
"mutex_unlock() may access the mutex structure even after it has
internally released the lock already - so it's not safe for another context to acquire the mutex and assume that the mutex_unlock() context is not using the structure anymore"
So if we drop our ep ref before the mutex unlock, but we weren't the last one, we may then unlock the mutex, another user comes in, drops _their_ reference and releases the 'ep' as it now has no users - all while the mutex_unlock() is still accessing it.
Fix this by simply moving the ep refcount dropping to outside the mutex:
the refcount itself is atomic, and doesn't need mutex protection (that's the whole _point_ of refcounts: unlike mutexes, they are inherently about object lifetimes).
--- fs/eventpoll.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
fs/eventpoll.c +5 -7
@@ -772,7 +772,7 @@ static bool __ep_remove(struct eventpollcall_rcu (&epi->rcu, epi_rcu_free);percpu_counter_dec (&ep->user->epoll_watches); -return ep_refcount_dec_and_test (ep); +return true; }/*
@@ -780,14 +780,14 @@ static bool __ep_remove(struct eventpoll*/ static void ep_remove_safe (struct eventpoll *ep,struct epitem *epi) { -WARN_ON_ONCE (__ep_remove (ep, epi, false)); +if (__ep_remove (ep, epi, false)) +WARN_ON_ONCE (ep_refcount_dec_and_test (ep)); }static void ep_clear_and_put (struct eventpoll *ep) {struct rb_node *rbp, *next;struct epitem *epi; -bool dispose;/* We need to release all tasks waiting for these file */ if (waitqueue_active (&ep->poll_wait))
@@ -820,10 +820,8 @@ static void ep_clear_and_put(struct evencond_resched (); } - dispose =ep_refcount_dec_and_test (ep);mutex_unlock (&ep->mtx); - -if (dispose) +if (ep_refcount_dec_and_test (ep))ep_free (ep); }
@@ -1003,7 +1001,7 @@ again: dispose =__ep_remove (ep, epi, true);mutex_unlock (&ep->mtx); -if (dispose) +if (dispose &&ep_refcount_dec_and_test (ep))ep_free (ep); goto again; }
Greg Kroah-Hartman
maintainerPATCH 2/109 drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaustabh Chakraborty <[email protected]>
commit b846350aa272de99bf6fecfa6b08e64ebfb13173 upstream.
If there's support for another console device (such as a TTY serial), the kernel occasionally panics during boot. The panic message and a relevant snippet of the call stack is as follows:
Unable to handle kernel NULL pointer dereference at virtual address 000000000000000
Call trace:
drm_crtc_handle_vblank+0x10/0x30 (P)
decon_irq_handler+0x88/0xb4
[...]Otherwise, the panics don't happen. This indicates that it's some sort of race condition.
Add a check to validate if the drm device can handle vblanks before calling drm_crtc_handle_vblank() to avoid this.
--- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/exynos/exynos7_drm_decon.c +4 -0
@@ -601,6 +601,10 @@ static irqreturn_t decon_irq_handler(intif (!ctx->drm_dev) goto out; +/* check if crtc and vblank have been initialized properly */ +if (!drm_dev_has_vblank (ctx->drm_dev)) + goto out; +if (!ctx->i80_if) {drm_crtc_handle_vblank (&ctx->crtc->base);
Greg Kroah-Hartman
maintainerPATCH 3/109 ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit cbe876121633dadb2b0ce52711985328638e9aab ]
When USRC=0, there is underrun issue for the non-ideal ratio mode; according to the reference mannual, the internal measured ratio can be used with USRC=1 and IDRC=0.
--- sound/soc/fsl/fsl_asrc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_asrc.c +2 -1
@@ -517,7 +517,8 @@ static int fsl_asrc_config_pair(struct fsl_asrc_pair *pair, bool use_ideal_rate)regmap_update_bits (asrc->regmap,REG_ASRCTR ,ASRCTR_ATSi_MASK (index),ASRCTR_ATS (index));regmap_update_bits (asrc->regmap,REG_ASRCTR , -ASRCTR_USRi_MASK (index),0 ); +ASRCTR_IDRi_MASK (index) |ASRCTR_USRi_MASK (index), +ASRCTR_USR (index));/* Set the input and output clock sources */ regmap_update_bits(asrc->regmap, REG_ASRCSR,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/109 perf/core: Fix the WARN_ON_ONCE is out of lock protected region
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Gengkun <[email protected]>
[ Upstream commit 7b4c5a37544ba22c6ebe72c0d4ea56c953459fa5 ]
commit 3172fb986666 ("perf/core: Fix WARN in perf_cgroup_switch()") try to fix a concurrency problem between perf_cgroup_switch and perf_cgroup_event_disable. But it does not to move the WARN_ON_ONCE into lock-protected region, so the warning is still be triggered.
--- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/events/core.c +2 -2
@@ -873,8 +873,6 @@ static void perf_cgroup_switch(struct task_struct *task)if (READ_ONCE (cpuctx->cgrp) ==NULL )return ; -WARN_ON_ONCE (cpuctx->ctx.nr_cgroups ==0 ); - cgrp =perf_cgroup_from_task (task,NULL );if (READ_ONCE (cpuctx->cgrp) == cgrp)return ;
@@ -886,6 +884,8 @@ static void perf_cgroup_switch(struct task_struct *task)if (READ_ONCE (cpuctx->cgrp) ==NULL )return ; +WARN_ON_ONCE (cpuctx->ctx.nr_cgroups ==0 ); +perf_ctx_disable (&cpuctx->ctx, true);ctx_sched_out (&cpuctx->ctx,EVENT_ALL |EVENT_CGROUP );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/109 perf: Revert to requiring CAP_SYS_ADMIN for uprobes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit ba677dbe77af5ffe6204e0f3f547f3ba059c6302 ]
Jann reports that uprobes can be used destructively when used in the middle of an instruction. The kernel only verifies there is a valid instruction at the requested offset, but due to variable instruction length cannot determine if this is an instruction as seen by the intended execution stream.
Additionally, Mark Rutland notes that on architectures that mix data in the text segment (like arm64), a similar things can be done if the data word is 'mistaken' for an instruction.
As such, require CAP_SYS_ADMIN for uprobes.
--- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/core.c +1 -1
@@ -10473,7 +10473,7 @@ static int perf_uprobe_event_init(struct perf_event *event)if (event->attr.type != perf_uprobe.type)return -ENOENT ; -if (!perfmon_capable ()) +if (!capable (CAP_SYS_ADMIN ))return -EACCES ;/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/109 ASoC: cs35l56: probe() should fail if the device ID is not recognized
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 3b3312f28ee2d9c386602f8521e419cfc69f4823 ]
Return an error from driver probe if the DEVID read from the chip is not one supported by this driver.
In cs35l56_hw_init() there is a check for valid DEVID, but the invalid case was returning the value of ret. At this point in the code ret == 0 so the caller would think that cs35l56_hw_init() was successful.
--- sound/soc/codecs/cs35l56-shared.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/cs35l56-shared.c +1 -1
@@ -661,7 +661,7 @@ int cs35l56_hw_init(struct cs35l56_base *cs35l56_base)break ;default :dev_err (cs35l56_base->dev,"Unknown device %x\n" , devid); -return ret; +return -ENODEV ; } ret =regmap_read (cs35l56_base->regmap,CS35L56_DSP_RESTRICT_STS1 , &secured);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/109 Bluetooth: hci_sync: Fix not disabling advertising instance
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit ef9675b0ef030d135413e8638989f3a7d1f3217a ]
As the code comments on hci_setup_ext_adv_instance_sync suggests the advertising instance needs to be disabled in order to update its parameters, but it was wrongly checking that !adv->pending.
--- net/bluetooth/hci_sync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/hci_sync.c +1 -1
@@ -1247,7 +1247,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)* Command Disallowed error, so we must first disable the * instance if it is active. */ -if (adv && !adv->pending) { +if (adv) { err =hci_disable_ext_adv_instance_sync (hdev, instance);if (err)return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/109 Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit c7349772c268ec3c91d83cbfbbcf63f1bd7c256c ]
Upon receiving HCI_EVT_LE_BIG_SYNC_ESTABLISHED with status 0x00 (success) the corresponding BIS hci_conn state shall be set to BT_CONNECTED otherwise they will be left with BT_OPEN which is invalid at that point, also create the debugfs and sysfs entries following the same logic as the likes of Broadcast Source BIS and CIS connections.
--- net/bluetooth/hci_event.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/hci_event.c +3 -0
@@ -6916,7 +6916,10 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, bis->iso_qos.bcast.in.sdu =le16_to_cpu (ev->max_pdu);if (!ev->status) { + bis->state =BT_CONNECTED ;set_bit (HCI_CONN_BIG_SYNC , &bis->flags); +hci_debugfs_create_conn (bis); +hci_conn_add_sysfs (bis);hci_iso_setup_path (bis); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/109 pinctrl: amd: Clear GPIO debounce for suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 8ff4fb276e2384a87ae7f65f3c28e1e139dbb3fe ]
soc-button-array hardcodes a debounce value by means of gpio_keys which uses pinctrl-amd as a backend to program debounce for a GPIO.
This hardcoded value doesn't match what the firmware intended to be programmed in _AEI. The hardcoded debounce leads to problems waking from suspend. There isn't appetite to conditionalize the behavior in soc-button-array or gpio-keys so clear it when the system suspends to avoid problems with being able to resume.
--- drivers/pinctrl/pinctrl-amd.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/pinctrl/pinctrl-amd.c +11 -0
@@ -933,6 +933,17 @@ static int amd_gpio_suspend_hibernate_common(struct device *dev, bool is_suspend pin, is_suspend ? "suspend" : "hibernate"); } +/* +* debounce enabled over suspend has shown issues with a GPIO +* being unable to wake the system, as we're only interested in +* the actual wakeup event, clear it. +*/ +if (gpio_dev->saved_regs[i] & (DB_CNTRl_MASK <<DB_CNTRL_OFF )) { +amd_gpio_set_debounce (gpio_dev, pin,0 ); +pm_pr_dbg ("Clearing debounce for GPIO #%d during %s.\n" , + pin, is_suspend ?"suspend" :"hibernate" ); + } +raw_spin_unlock_irqrestore (&gpio_dev->lock, flags); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/109 fix proc_sys_compare() handling of in-lookup dentries
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit b969f9614885c20f903e1d1f9445611daf161d6d ]
There's one case where ->d_compare() can be called for an in-lookup dentry; usually that's nothing special from ->d_compare() point of view, but... proc_sys_compare() is weird.
The thing is, /proc/sys subdirectories can look differently for different processes. Up to and including having the same name resolve to different dentries - all of them hashed.
The way it's done is ->d_compare() refusing to admit a match unless this dentry is supposed to be visible to this caller. The information needed to discriminate between them is stored in inode; it is set during proc_sys_lookup() and until it's done d_splice_alias() we really can't tell who should that dentry be visible for.
Normally there's no negative dentries in /proc/sys; we can run into a dying dentry in RCU dcache lookup, but those can be safely rejected.
However, ->d_compare() is also called for in-lookup dentries, before they get positive - or hashed, for that matter. In case of match we will wait until dentry leaves in-lookup state and repeat ->d_compare() afterwards. In other words, the right behaviour is to treat the name match as sufficient for in-lookup dentries; if dentry is not for us, we'll see that when we recheck once proc_sys_lookup() is done with it.
While we are at it, fix the misspelled READ_ONCE and WRITE_ONCE there.
--- fs/proc/inode.c | 2 +- fs/proc/proc_sysctl.c | 18 +++++++++++------- 2 files changed, 12 insertions(+), 8 deletions(-)
fs/proc/inode.c +1 -1
@@ -52,7 +52,7 @@ static void proc_evict_inode(struct inode *inode) head = ei->sysctl;if (head) { -RCU_INIT_POINTER (ei->sysctl,NULL ); +WRITE_ONCE (ei->sysctl,NULL );proc_sys_evict_inode (inode, head); } }
fs/proc/proc_sysctl.c +11 -7
@@ -920,17 +920,21 @@ static int proc_sys_compare(const struct dentry *dentry,struct ctl_table_header *head;struct inode *inode; -/* Although proc doesn't have negative dentries, rcu-walk means -* that inode here can be NULL */ -/* AV: can it, indeed? */ - inode =d_inode_rcu (dentry); -if (!inode) -return 1 ;if (name->len != len)return 1 ;if (memcmp (name->name, str, len))return 1 ; - head =rcu_dereference (PROC_I (inode)->sysctl); + +// false positive is fine here - we'll recheck anyway +if (d_in_lookup (dentry)) +return 0 ; + + inode =d_inode_rcu (dentry); +// we just might have run into dentry in the middle of __dentry_kill() +if (!inode) +return 1 ; + + head =READ_ONCE (PROC_I (inode)->sysctl);return !head || !sysctl_is_seen (head); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/109 netlink: Fix wraparounds of sk->sk_rmem_alloc.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit ae8f160e7eb24240a2a79fc4c815c6a0d4ee16cc ]
Netlink has this pattern in some places
if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc);
, which has the same problem fixed by commit 5a465a0da13e ("udp:
Fix multiple wraparounds of sk->sk_rmem_alloc.").
For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition is always false as the two operands are of int.
Then, a single socket can eat as many skb as possible until OOM happens, and we can see multiple wraparounds of sk->sk_rmem_alloc.
Let's fix it by using atomic_add_return() and comparing the two variables as unsigned int.
Before:
[root@fedora ~]# ss -f netlink
Recv-Q Send-Q Local Address:Port Peer Address:Port
-1668710080 0 rtnl:nl_wraparound/293 *
After:
[root@fedora ~]# ss -f netlink
Recv-Q Send-Q Local Address:Port Peer Address:Port
2147483072 0 rtnl:nl_wraparound/290 *
^
`--- INT_MAX - 576
--- net/netlink/af_netlink.c | 81 ++++++++++++++++++++++++---------------- 1 file changed, 49 insertions(+), 32 deletions(-)
net/netlink/af_netlink.c +49 -32
@@ -387,7 +387,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)WARN_ON (skb->sk !=NULL ); skb->sk = sk; skb->destructor = netlink_skb_destructor; -atomic_add (skb->truesize, &sk->sk_rmem_alloc);sk_mem_charge (sk, skb->truesize); }
@@ -1223,41 +1222,48 @@ static struct sk_buff *netlink_alloc_large_skb(unsigned int size,int netlink_attachskb (struct sock *sk,struct sk_buff *skb,long *timeo,struct sock *ssk) { +DECLARE_WAITQUEUE (wait, current);struct netlink_sock *nlk; +unsigned int rmem; nlk =nlk_sk (sk); + rmem =atomic_add_return (skb->truesize, &sk->sk_rmem_alloc); -if ((atomic_read (&sk->sk_rmem_alloc) > sk->sk_rcvbuf || -test_bit (NETLINK_S_CONGESTED , &nlk->state))) { -DECLARE_WAITQUEUE (wait, current); -if (!*timeo) { -if (!ssk ||netlink_is_kernel (ssk)) -netlink_overrun (sk); -sock_put (sk); -kfree_skb (skb); -return -EAGAIN ; - } - -__set_current_state (TASK_INTERRUPTIBLE ); -add_wait_queue (&nlk->wait, &wait); +if ((rmem == skb->truesize || rmem <READ_ONCE (sk->sk_rcvbuf)) && + !test_bit (NETLINK_S_CONGESTED , &nlk->state)) { +netlink_skb_set_owner_r (skb, sk); +return 0 ; + } -if ((atomic_read (&sk->sk_rmem_alloc) > sk->sk_rcvbuf || -test_bit (NETLINK_S_CONGESTED , &nlk->state)) && - !sock_flag (sk,SOCK_DEAD )) - *timeo =schedule_timeout (*timeo); +atomic_sub (skb->truesize, &sk->sk_rmem_alloc); -__set_current_state (TASK_RUNNING ); -remove_wait_queue (&nlk->wait, &wait); +if (!*timeo) { +if (!ssk ||netlink_is_kernel (ssk)) +netlink_overrun (sk);sock_put (sk); +kfree_skb (skb); +return -EAGAIN ; + } -if (signal_pending (current)) { -kfree_skb (skb); -return sock_intr_errno (*timeo); - } -return 1 ; +__set_current_state (TASK_INTERRUPTIBLE ); +add_wait_queue (&nlk->wait, &wait); + rmem =atomic_read (&sk->sk_rmem_alloc); + +if (((rmem && rmem + skb->truesize >READ_ONCE (sk->sk_rcvbuf)) || +test_bit (NETLINK_S_CONGESTED , &nlk->state)) && + !sock_flag (sk,SOCK_DEAD )) + *timeo =schedule_timeout (*timeo); + +__set_current_state (TASK_RUNNING ); +remove_wait_queue (&nlk->wait, &wait); +sock_put (sk); + +if (signal_pending (current)) { +kfree_skb (skb); +return sock_intr_errno (*timeo); } -netlink_skb_set_owner_r (skb, sk); -return 0 ; + +return 1 ; }static int __netlink_sendskb (struct sock *sk,struct sk_buff *skb)
@@ -1317,6 +1323,7 @@ static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb, ret = -ECONNREFUSED ;if (nlk->netlink_rcv !=NULL ) { ret = skb->len; +atomic_add (skb->truesize, &sk->sk_rmem_alloc);netlink_skb_set_owner_r (skb, sk);NETLINK_CB (skb).sk = ssk;netlink_deliver_tap_kernel (sk, ssk, skb);
@@ -1393,13 +1400,19 @@ EXPORT_SYMBOL_GPL(netlink_strict_get_check);static int netlink_broadcast_deliver (struct sock *sk,struct sk_buff *skb) {struct netlink_sock *nlk =nlk_sk (sk); +unsigned int rmem, rcvbuf; -if (atomic_read (&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && + rmem =atomic_add_return (skb->truesize, &sk->sk_rmem_alloc); + rcvbuf =READ_ONCE (sk->sk_rcvbuf); + +if ((rmem != skb->truesize || rmem <= rcvbuf) && !test_bit (NETLINK_S_CONGESTED , &nlk->state)) {netlink_skb_set_owner_r (skb, sk);__netlink_sendskb (sk, skb); -return atomic_read (&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >>1 ); +return rmem > (rcvbuf >>1 ); } + +atomic_sub (skb->truesize, &sk->sk_rmem_alloc);return -1 ; }
@@ -2190,6 +2203,7 @@ static int netlink_dump(struct sock *sk, bool lock_taken)struct module *module;int err = -ENOBUFS ;int alloc_min_size; +unsigned int rmem;int alloc_size;if (!lock_taken)
@@ -2199,9 +2213,6 @@ static int netlink_dump(struct sock *sk, bool lock_taken) goto errout_skb; } -if (atomic_read (&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) - goto errout_skb; -/* NLMSG_GOODSIZE is small to avoid high order allocations being * required, but it makes sense to _attempt_ a 16K bytes allocation * to reduce number of system calls on dump operations, if user
@@ -2224,6 +2235,12 @@ static int netlink_dump(struct sock *sk, bool lock_taken)if (!skb) goto errout_skb; + rmem =atomic_add_return (skb->truesize, &sk->sk_rmem_alloc); +if (rmem >=READ_ONCE (sk->sk_rcvbuf)) { +atomic_sub (skb->truesize, &sk->sk_rmem_alloc); + goto errout_skb; + } +/* Trim skb to allocated size. User is expected to provide buffer as * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at * netlink_recvmsg())). dump will pack as many smaller messages as
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/109 vsock: fix `vsock_proto` declaration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
[ Upstream commit 1e3b66e326015f77bc4b36976bebeedc2ac0f588 ]
Quoted 1 line
From commit
634f1a7110b4("vsock: support sockmap"), `struct proto
vsock_proto`, defined in af_vsock.c, is not static anymore, since it's used by vsock_bpf.c.
If CONFIG_BPF_SYSCALL is not defined, make C=2 will print a warning:
$ make O=build C=2 W=1 net/vmw_vsock/
...
CC [M] net/vmw_vsock/af_vsock.o
CHECK ../net/vmw_vsock/af_vsock.c
../net/vmw_vsock/af_vsock.c:123:14: warning: symbol 'vsock_proto' was not declared. Should it be static?Declare vsock_proto regardless of CONFIG_BPF_SYSCALL, since it's defined in af_vsock.c, which is built regardless of CONFIG_BPF_SYSCALL.
--- include/net/af_vsock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/af_vsock.h +1 -1
@@ -236,8 +236,8 @@ int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,int vsock_dgram_recvmsg (struct socket *sock,struct msghdr *msg,size_t len,int flags); -#ifdef CONFIG_BPF_SYSCALL extern struct proto vsock_proto; +#ifdef CONFIG_BPF_SYSCALL int vsock_bpf_update_proto (struct sock *sk,struct sk_psock *psock,bool restore);void __init vsock_bpf_build_proto (void );#else
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/109 tipc: Fix use-after-free in tipc_conn_close().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 667eeab4999e981c96b447a4df5f20bdf5c26f13 ]
syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0]
tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr and calls tipc_conn_close() for each tipc_conn.
The problem is that tipc_conn_close() is called after releasing the IDR lock.
At the same time, there might be tipc_conn_recv_work() running and it could call tipc_conn_close() for the same tipc_conn and release its last ->kref.
Once we release the IDR lock in tipc_topsrv_stop(), there is no guarantee that the tipc_conn is alive.
Let's hold the ref before releasing the lock and put the ref after tipc_conn_close() in tipc_topsrv_stop().
[0]:
BUG: KASAN: use-after-free in tipc_conn_close+0x122/0x140 net/tipc/topsrv.c:165
Read of size 8 at addr ffff888099305a08 by task kworker/u4:3/435
CPU: 0 PID: 435 Comm: kworker/u4:3 Not tainted 4.19.204-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
tipc_conn_close+0x122/0x140 net/tipc/topsrv.c:165
tipc_topsrv_stop net/tipc/topsrv.c:701 [inline]
tipc_topsrv_exit_net+0x27b/0x5c0 net/tipc/topsrv.c:722
ops_exit_list+0xa5/0x150 net/core/net_namespace.c:153
cleanup_net+0x3b4/0x8b0 net/core/net_namespace.c:553
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Allocated by task 23:
kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
tipc_conn_alloc+0x43/0x4f0 net/tipc/topsrv.c:192
tipc_topsrv_accept+0x1b5/0x280 net/tipc/topsrv.c:470
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Freed by task 23:
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
tipc_conn_kref_release net/tipc/topsrv.c:150 [inline]
kref_put include/linux/kref.h:70 [inline]
conn_put+0x2cd/0x3a0 net/tipc/topsrv.c:155
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
The buggy address belongs to the object at ffff888099305a00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 8 bytes inside of
512-byte region [ffff888099305a00, ffff888099305c00)
The buggy address belongs to the page:
page:ffffea000264c140 count:1 mapcount:0 mapping:ffff88813bff0940 index:0x0
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea00028b6b88 ffffea0002cd2b08 ffff88813bff0940
raw: 0000000000000000 ffff888099305000 0000000100000006 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888099305900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888099305980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888099305a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888099305a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888099305b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- net/tipc/topsrv.c | 2 ++ 1 file changed, 2 insertions(+)
net/tipc/topsrv.c +2 -0
@@ -704,8 +704,10 @@ static void tipc_topsrv_stop(struct net *net)for (id =0 ; srv->idr_in_use; id++) { con =idr_find (&srv->conn_idr, id);if (con) { +conn_get (con);spin_unlock_bh (&srv->idr_lock);tipc_conn_close (con); +conn_put (con);spin_lock_bh (&srv->idr_lock); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/109 tcp: Correct signedness in skb remaining space calculation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit d3a5f2871adc0c61c61869f37f3e697d97f03d8c ]
Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow.
When we send data, if an skb exists at the tail of the write queue, the kernel will attempt to append the new data to that skb. However, the code that checks for available space in the skb is flawed:
'''
copy = size_goal - skb->len
'''
The types of the variables involved are:
'''
copy: ssize_t (s64 on 64-bit systems)size_goal: intskb->len: unsigned int
'''
Due to C's type promotion rules, the signed size_goal is converted to an unsigned int to match skb->len before the subtraction. The result is an unsigned int.
When this unsigned int result is then assigned to the s64 copy variable, it is zero-extended, preserving its non-negative value. Consequently, copy is always >= 0.
Assume we are sending 2GB of data and size_goal has been adjusted to a value smaller than skb->len. The subtraction will result in copy holding a very large positive integer. In the subsequent logic, this large value is used to update sk->sk_forward_alloc, which can easily cause it to overflow.
The syzkaller reproducer uses TCP_REPAIR to reliably create this condition. However, this can also occur in real-world scenarios. The tcp_bound_to_half_wnd() function can also reduce size_goal to a small value. This would cause the subsequent tcp_wmem_schedule() to set sk->sk_forward_alloc to a value close to INT_MAX. Further memory allocation requests would then cause sk_forward_alloc to wrap around and become negative.
[1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47
--- net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp.c +1 -1
@@ -1132,7 +1132,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) goto do_error;while (msg_data_left (msg)) { -ssize_t copy =0 ; +int copy =0 ; skb =tcp_write_queue_tail (sk);if (skb)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/109 vsock: Fix transport_{g2h,h2g} TOCTOU
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 209fd720838aaf1420416494c5505096478156b4 ]
vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload. transport_{g2h,h2g} may become NULL after the NULL check.
Introduce vsock_transport_local_cid() to protect from a potential null-ptr-deref.
KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_find_cid+0x47/0x90 Call Trace: __vsock_bind+0x4b2/0x720 vsock_bind+0x90/0xe0 __sys_bind+0x14d/0x1e0 __x64_sys_bind+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0 Call Trace: __x64_sys_ioctl+0x12d/0x190 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
--- net/vmw_vsock/af_vsock.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-)
net/vmw_vsock/af_vsock.c +21 -6
@@ -530,9 +530,25 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) }EXPORT_SYMBOL_GPL (vsock_assign_transport); +/* +* Provide safe access to static transport_{h2g,g2h,dgram,local} callbacks. +* Otherwise we may race with module removal. Do not use on `vsk->transport`. +*/ +static u32 vsock_registered_transport_cid (const struct vsock_transport **transport) +{ +u32 cid =VMADDR_CID_ANY ; + +mutex_lock (&vsock_register_mutex); +if (*transport) + cid = (*transport)->get_local_cid (); +mutex_unlock (&vsock_register_mutex); + +return cid; +} +bool vsock_find_cid (unsigned int cid) { -if (transport_g2h && cid == transport_g2h->get_local_cid ()) +if (cid ==vsock_registered_transport_cid (&transport_g2h))return true;if (transport_h2g && cid ==VMADDR_CID_HOST )
@@ -2391,18 +2407,17 @@ static long vsock_dev_do_ioctl(struct file *filp, unsigned int cmd, void __user *ptr) { u32 __user *p = ptr; -u32 cid =VMADDR_CID_ANY ;int retval =0 ; +u32 cid;switch (cmd) {case IOCTL_VM_SOCKETS_GET_LOCAL_CID :/* To be compatible with the VMCI behavior, we prioritize the * guest CID instead of well-know host CID (VMADDR_CID_HOST). */ -if (transport_g2h) - cid = transport_g2h->get_local_cid (); -else if (transport_h2g) - cid = transport_h2g->get_local_cid (); + cid =vsock_registered_transport_cid (&transport_g2h); +if (cid ==VMADDR_CID_ANY ) + cid =vsock_registered_transport_cid (&transport_h2g);if (put_user (cid, p) !=0 ) retval = -EFAULT ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/109 vsock: Fix transport_* TOCTOU
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 687aa0c5581b8d4aa87fd92973e4ee576b550cdf ]
Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer.
This also takes care of an insecure call in vsock_use_local_transport(); add a lockdep assert.
BUG: unable to handle page fault for address: fffffbfff8056000 Oops: Oops: 0000 [#1] SMP KASAN RIP: 0010:vsock_assign_transport+0x366/0x600 Call Trace: vsock_connect+0x59c/0xc40 __sys_connect+0xe8/0x100 __x64_sys_connect+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
--- net/vmw_vsock/af_vsock.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-)
net/vmw_vsock/af_vsock.c +23 -5
@@ -406,6 +406,8 @@ EXPORT_SYMBOL_GPL(vsock_enqueue_accept);static bool vsock_use_local_transport (unsigned int remote_cid) { +lockdep_assert_held (&vsock_register_mutex); +if (!transport_local)return false;
@@ -463,6 +465,8 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) remote_flags = vsk->remote_addr.svm_flags; +mutex_lock (&vsock_register_mutex); +switch (sk->sk_type) {case SOCK_DGRAM : new_transport = transport_dgram;
@@ -478,12 +482,15 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) new_transport = transport_h2g;break ;default : -return -ESOCKTNOSUPPORT ; + ret = -ESOCKTNOSUPPORT ; + goto err; }if (vsk->transport) { -if (vsk->transport == new_transport) -return 0 ; +if (vsk->transport == new_transport) { + ret =0 ; + goto err; + }/* transport->release() must be called with sock lock acquired. * This path can only be taken during vsock_connect(), where we
@@ -507,8 +514,16 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)/* We increase the module refcnt to prevent the transport unloading * while there are open sockets assigned to it. */ -if (!new_transport || !try_module_get (new_transport->module)) -return -ENODEV ; +if (!new_transport || !try_module_get (new_transport->module)) { + ret = -ENODEV ; + goto err; + } + +/* It's safe to release the mutex after a successful try_module_get(). +* Whichever transport `new_transport` points at, it won't go away until +* the last module_put() below or in vsock_deassign_transport(). +*/ +mutex_unlock (&vsock_register_mutex);if (sk->sk_type ==SOCK_SEQPACKET ) { if (!new_transport->seqpacket_allow ||
@@ -527,6 +542,9 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) vsk->transport = new_transport;return 0 ; +err: +mutex_unlock (&vsock_register_mutex); +return ret; }EXPORT_SYMBOL_GPL (vsock_assign_transport);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/109 vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 1e7d9df379a04ccd0c2f82f39fbb69d482e864cc ]
Support returning VMADDR_CID_LOCAL in case no other vsock transport is available.
--- net/vmw_vsock/af_vsock.c | 2 ++ 1 file changed, 2 insertions(+)
net/vmw_vsock/af_vsock.c +2 -0
@@ -2436,6 +2436,8 @@ static long vsock_dev_do_ioctl(struct file *filp, cid =vsock_registered_transport_cid (&transport_g2h);if (cid ==VMADDR_CID_ANY ) cid =vsock_registered_transport_cid (&transport_h2g); +if (cid ==VMADDR_CID_ANY ) + cid =vsock_registered_transport_cid (&transport_local);if (put_user (cid, p) !=0 ) retval = -EFAULT ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/109 net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: EricChan <[email protected]>
[ Upstream commit 78b7920a03351a8402de2f81914c1d2e2bdf24b7 ]
According to the Synopsys Controller IP XGMAC-10G Ethernet MAC Databook v3.30a (section 2.7.2), when the INTM bit in the DMA_Mode register is set to 2, the sbd_perch_tx_intr_o[] and sbd_perch_rx_intr_o[] signals operate in level-triggered mode. However, in this configuration, the DMA does not assert the XGMAC_NIS status bit for Rx or Tx interrupt events.
This creates a functional regression where the condition
if (likely(intr_status & XGMAC_NIS)) in dwxgmac2_dma_interrupt() will never evaluate to true, preventing proper interrupt handling for level-triggered mode. The hardware specification explicitly states that "The DMA does not assert the NIS status bit for the Rx or Tx interrupt events" (Synopsys DWC_XGMAC2 Databook v3.30a, sec. 2.7.2).
The fix ensures correct handling of both edge and level-triggered interrupts while maintaining backward compatibility with existing configurations. It has been tested on the hardware device (not publicly available), and it can properly trigger the RX and TX interrupt handling in both the INTM=0 and INTM=2 configurations.
--- .../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 24 +++++++++---------- 1 file changed, 11 insertions(+), 13 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +11 -13
@@ -364,19 +364,17 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv, }/* TX/RX NORMAL interrupts */ -if (likely (intr_status &XGMAC_NIS )) { -if (likely (intr_status &XGMAC_RI )) { -u64_stats_update_begin (&stats->syncp); -u64_stats_inc (&stats->rx_normal_irq_n[chan]); -u64_stats_update_end (&stats->syncp); - ret |= handle_rx; - } -if (likely (intr_status & (XGMAC_TI |XGMAC_TBU ))) { -u64_stats_update_begin (&stats->syncp); -u64_stats_inc (&stats->tx_normal_irq_n[chan]); -u64_stats_update_end (&stats->syncp); - ret |= handle_tx; - } +if (likely (intr_status &XGMAC_RI )) { +u64_stats_update_begin (&stats->syncp); +u64_stats_inc (&stats->rx_normal_irq_n[chan]); +u64_stats_update_end (&stats->syncp); + ret |= handle_rx; + } +if (likely (intr_status & (XGMAC_TI |XGMAC_TBU ))) { +u64_stats_update_begin (&stats->syncp); +u64_stats_inc (&stats->tx_normal_irq_n[chan]); +u64_stats_update_end (&stats->syncp); + ret |= handle_tx; }/* Clear interrupts */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/109 net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit a141af8eb2272ab0f677a7f2653874840bc9b214 ]
Correct the Auto-MDIX configuration to ensure userspace settings are respected when the feature is disabled by the AUTOMDIX_EN hardware strap.
The LAN9500 PHY allows its default MDI-X mode to be configured via a hardware strap. If this strap sets the default to "MDI-X off", the driver was previously unable to enable Auto-MDIX from userspace.
When handling the ETH_TP_MDI_AUTO case, the driver would set the SPECIAL_CTRL_STS_AMDIX_ENABLE_ bit but neglected to set the required SPECIAL_CTRL_STS_OVRRD_AMDIX_ bit. Without the override flag, the PHY falls back to its hardware strap default, ignoring the software request.
This patch corrects the behavior by also setting the override bit when enabling Auto-MDIX. This ensures that the userspace configuration takes precedence over the hardware strap, allowing Auto-MDIX to be enabled correctly in all scenarios.
--- drivers/net/phy/smsc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/phy/smsc.c +2 -1
@@ -167,7 +167,8 @@ static int lan87xx_config_aneg(struct phy_device *phydev)SPECIAL_CTRL_STS_AMDIX_STATE_ ;break ;case ETH_TP_MDI_AUTO : - val =SPECIAL_CTRL_STS_AMDIX_ENABLE_ ; + val =SPECIAL_CTRL_STS_OVRRD_AMDIX_ | +SPECIAL_CTRL_STS_AMDIX_ENABLE_ ;break ;default :return genphy_config_aneg (phydev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/109 net: phy: smsc: Force predictable MDI-X state on LAN87xx
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit 0713e55533c88a20edb53eea6517dc56786a0078 ]
Override the hardware strap configuration for MDI-X mode to ensure a predictable initial state for the driver. The initial mode of the LAN87xx PHY is determined by the AUTOMDIX_EN strap pin, but the driver has no documented way to read its latched status.
This unpredictability means the driver cannot know if the PHY has initialized with Auto-MDIX enabled or disabled, preventing it from providing a reliable interface to the user.
This patch introduces a config_init hook that forces the PHY into a known state by explicitly enabling Auto-MDIX.
--- drivers/net/phy/smsc.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-)
drivers/net/phy/smsc.c +28 -1
@@ -262,6 +262,33 @@ int lan87xx_read_status(struct phy_device *phydev) }EXPORT_SYMBOL_GPL (lan87xx_read_status); +static int lan87xx_phy_config_init (struct phy_device *phydev) +{ +int rc; + +/* The LAN87xx PHY's initial MDI-X mode is determined by the AUTOMDIX_EN +* hardware strap, but the driver cannot read the strap's status. This +* creates an unpredictable initial state. +* +* To ensure consistent and reliable behavior across all boards, +* override the strap configuration on initialization and force the PHY +* into a known state with Auto-MDIX enabled, which is the expected +* default for modern hardware. +*/ + rc =phy_modify (phydev,SPECIAL_CTRL_STS , +SPECIAL_CTRL_STS_OVRRD_AMDIX_ | +SPECIAL_CTRL_STS_AMDIX_ENABLE_ | +SPECIAL_CTRL_STS_AMDIX_STATE_ , +SPECIAL_CTRL_STS_OVRRD_AMDIX_ | +SPECIAL_CTRL_STS_AMDIX_ENABLE_ ); +if (rc <0 ) +return rc; + + phydev->mdix_ctrl =ETH_TP_MDI_AUTO ; + +return smsc_phy_config_init (phydev); +} +static int lan874x_phy_config_init (struct phy_device *phydev) {u16 val;
@@ -697,7 +724,7 @@ static struct phy_driver smsc_phy_driver[] = {/* basic functions */ .read_status = lan87xx_read_status, - .config_init = smsc_phy_config_init, + .config_init = lan87xx_phy_config_init, .soft_reset = smsc_phy_reset, .config_aneg = lan87xx_config_aneg,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/109 net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit 9dfe110cc0f6ef42af8e81ce52aef34a647d0b8a ]
Force a fixed MDI-X mode when auto-negotiation is disabled to prevent link instability.
When forcing the link speed and duplex on a LAN9500 PHY (e.g., with ethtool -s eth0 autoneg off ...) while leaving MDI-X control in auto mode, the PHY fails to establish a stable link. This occurs because the PHY's Auto-MDIX algorithm is not designed to operate when auto-negotiation is disabled. In this state, the PHY continuously toggles the TX/RX signal pairs, which prevents the link partner from synchronizing.
This patch resolves the issue by detecting when auto-negotiation is disabled. If the MDI-X control mode is set to 'auto', the driver now forces a specific, stable mode (ETH_TP_MDI) to prevent the pair toggling. This choice of a fixed MDI mode mirrors the behavior the hardware would exhibit if the AUTOMDIX_EN strap were configured for a fixed MDI connection.
--- drivers/net/phy/smsc.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-)
drivers/net/phy/smsc.c +22 -3
@@ -155,10 +155,29 @@ static int smsc_phy_reset(struct phy_device *phydev)static int lan87xx_config_aneg (struct phy_device *phydev) { -int rc; +u8 mdix_ctrl;int val; +int rc; + +/* When auto-negotiation is disabled (forced mode), the PHY's +* Auto-MDIX will continue toggling the TX/RX pairs. +* +* To establish a stable link, we must select a fixed MDI mode. +* If the user has not specified a fixed MDI mode (i.e., mdix_ctrl is +* 'auto'), we default to ETH_TP_MDI. This choice of a ETH_TP_MDI mode +* mirrors the behavior the hardware would exhibit if the AUTOMDIX_EN +* strap were configured for a fixed MDI connection. +*/ +if (phydev->autoneg ==AUTONEG_DISABLE ) { +if (phydev->mdix_ctrl ==ETH_TP_MDI_AUTO ) + mdix_ctrl =ETH_TP_MDI ; +else + mdix_ctrl = phydev->mdix_ctrl; + }else { + mdix_ctrl = phydev->mdix_ctrl; + } -switch (phydev->mdix_ctrl) { +switch (mdix_ctrl) {case ETH_TP_MDI : val =SPECIAL_CTRL_STS_OVRRD_AMDIX_ ;break ;
@@ -184,7 +203,7 @@ static int lan87xx_config_aneg(struct phy_device *phydev) rc |= val;phy_write (phydev,SPECIAL_CTRL_STS , rc); - phydev->mdix = phydev->mdix_ctrl; + phydev->mdix = mdix_ctrl;return genphy_config_aneg (phydev); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/109 atm: clip: Fix potential null-ptr-deref in to_atmarpd().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 706cc36477139c1616a9b2b96610a8bb520b7119 ]
atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip causes unregister hang").
However, it is not enough because to_atmarpd() is called without RTNL, especially clip_neigh_solicit() / neigh_ops->solicit() is unsleepable.
Also, there is no RTNL dependency around atmarpd.
Let's use a private mutex and RCU to protect access to atmarpd in to_atmarpd().
--- net/atm/clip.c | 44 +++++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 15 deletions(-)
net/atm/clip.c +29 -15
@@ -45,7 +45,8 @@#include <net/atmclip.h> static struct net_device *clip_devs; -static struct atm_vcc *atmarpd; +static struct atm_vcc __rcu *atmarpd; +static DEFINE_MUTEX (atmarpd_lock);static struct timer_list idle_timer;static const struct neigh_ops clip_neigh_ops;
@@ -53,24 +54,35 @@ static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip) {struct sock *sk;struct atmarp_ctrl *ctrl; +struct atm_vcc *vcc;struct sk_buff *skb; +int err =0 ;pr_debug ("(%d)\n" , type); -if (!atmarpd) -return -EUNATCH ; + +rcu_read_lock (); + vcc =rcu_dereference (atmarpd); +if (!vcc) { + err = -EUNATCH ; + goto unlock; + } skb =alloc_skb (sizeof (struct atmarp_ctrl ),GFP_ATOMIC ); -if (!skb) -return -ENOMEM ; +if (!skb) { + err = -ENOMEM ; + goto unlock; + } ctrl =skb_put (skb,sizeof (struct atmarp_ctrl )); ctrl->type = type; ctrl->itf_num = itf; ctrl->ip = ip; -atm_force_charge (atmarpd, skb->truesize); +atm_force_charge (vcc, skb->truesize); - sk =sk_atm (atmarpd); + sk =sk_atm (vcc);skb_queue_tail (&sk->sk_receive_queue, skb); sk->sk_data_ready (sk); -return 0 ; +unlock: +rcu_read_unlock (); +return err; }static void link_vcc (struct clip_vcc *clip_vcc,struct atmarp_entry *entry)
@@ -607,10 +619,12 @@ static void atmarpd_close(struct atm_vcc *vcc) {pr_debug ("\n" ); -rtnl_lock (); - atmarpd =NULL ; +mutex_lock (&atmarpd_lock); +RCU_INIT_POINTER (atmarpd,NULL ); +mutex_unlock (&atmarpd_lock); + +synchronize_rcu ();skb_queue_purge (&sk_atm (vcc)->sk_receive_queue); -rtnl_unlock ();pr_debug ("(done)\n" );module_put (THIS_MODULE );
@@ -631,15 +645,15 @@ static struct atm_dev atmarpd_dev = {static int atm_init_atmarp (struct atm_vcc *vcc) { -rtnl_lock (); +mutex_lock (&atmarpd_lock);if (atmarpd) { -rtnl_unlock (); +mutex_unlock (&atmarpd_lock);return -EADDRINUSE ; }mod_timer (&idle_timer, jiffies +CLIP_CHECK_INTERVAL *HZ ); - atmarpd = vcc; +rcu_assign_pointer (atmarpd, vcc);set_bit (ATM_VF_META , &vcc->flags);set_bit (ATM_VF_READY , &vcc->flags);/* allow replies and avoid getting closed if signaling dies */
@@ -648,7 +662,7 @@ static int atm_init_atmarp(struct atm_vcc *vcc) vcc->push =NULL ; vcc->pop =NULL ;/* crash */ vcc->push_oam =NULL ;/* crash */ -rtnl_unlock (); +mutex_unlock (&atmarpd_lock);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/109 atm: clip: Fix memory leak of struct clip_vcc.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 62dba28275a9a3104d4e33595c7b3328d4032d8d ]
ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back.
The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc.
However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak.
Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atmarp() to prevent memleak.
--- net/atm/clip.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/atm/clip.c +8 -0
@@ -645,6 +645,9 @@ static struct atm_dev atmarpd_dev = {static int atm_init_atmarp (struct atm_vcc *vcc) { +if (vcc->push == clip_push) +return -EINVAL ; +mutex_lock (&atmarpd_lock);if (atmarpd) {mutex_unlock (&atmarpd_lock);
@@ -669,6 +672,7 @@ static int atm_init_atmarp(struct atm_vcc *vcc)static int clip_ioctl (struct socket *sock,unsigned int cmd,unsigned long arg) {struct atm_vcc *vcc =ATM_SD (sock); +struct sock *sk = sock->sk;int err =0 ;switch (cmd) {
@@ -689,14 +693,18 @@ static int clip_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) err =clip_create (arg);break ;case ATMARPD_CTRL : +lock_sock (sk); err =atm_init_atmarp (vcc);if (!err) { sock->state =SS_CONNECTED ;__module_get (THIS_MODULE ); } +release_sock (sk);break ;case ATMARP_MKIP : +lock_sock (sk); err =clip_mkip (vcc, arg); +release_sock (sk);break ;case ATMARP_SETENTRY : err =clip_setentry (vcc, (__force __be32 )arg);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/109 atm: clip: Fix infinite recursive call of clip_push().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit c489f3283dbfc0f3c00c312149cae90d27552c45 ]
syzbot reported the splat below. [0]
This happens if we call ioctl(ATMARP_MKIP) more than once.
During the first call, clip_mkip() sets clip_push() to vcc->push(), and the second call copies it to clip_vcc->old_push().
Later, when the socket is close()d, vcc_destroy_socket() passes NULL skb to clip_push(), which calls clip_vcc->old_push(), triggering the infinite recursion.
Let's prevent the second ioctl(ATMARP_MKIP) by checking vcc->user_back, which is allocated by the first call as clip_vcc.
Note also that we use lock_sock() to prevent racy calls.
[0]:
BUG: TASK stack guard page was hit at ffffc9000d66fff8 (stack is ffffc9000d670000..ffffc9000d678000) Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:clip_push+0x5/0x720 net/atm/clip.c:191 Code: e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 f3 49 89 fd 48 bd 00 RSP: 0018:ffffc9000d670000 EFLAGS: 00010246 RAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000 RBP: dffffc0000000000 R08: ffffffff8fa104f7 R09: 1ffffffff1f4209e R10: dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300 R13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578 FS: 000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d66fff8 CR3: 0000000043172000 CR4: 0000000000352ef0 Call Trace: <TASK> clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 ... clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 vcc_destroy_socket net/atm/common.c:183 [inline] vcc_release+0x157/0x460 net/atm/common.c:205 __sock_release net/socket.c:647 [inline] sock_close+0xc0/0x240 net/socket.c:1391 __fput+0x449/0xa70 fs/file_table.c:465 task_work_run+0x1d1/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff31c98e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f R10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c R13: 00007ff31cbb6080 R14: ffffffffffffffff R15: 00007fffb5aa2090 </TASK> Modules linked in:
--- net/atm/clip.c | 2 ++ 1 file changed, 2 insertions(+)
net/atm/clip.c +2 -0
@@ -429,6 +429,8 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)if (!vcc->push)return -EBADFD ; +if (vcc->user_back) +return -EINVAL ; clip_vcc =kmalloc (sizeof (struct clip_vcc ),GFP_KERNEL );if (!clip_vcc)return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/109 atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit 22fc46cea91df3dce140a7dc6847c6fcf0354505 ]
atmarpd_dev_ops does not implement the send method, which may cause crash as bellow.
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0010 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.15.0-rc6-syzkaller-00346-g5723cc3450bc #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0018:ffffc9000d3cf778 EFLAGS: 00010246 RAX: 1ffffffff1910dd1 RBX: 00000000000000c0 RCX: dffffc0000000000 RDX: ffffc9000dc82000 RSI: ffff88803e4c4640 RDI: ffff888052cd0000 RBP: ffffc9000d3cf8d0 R08: ffff888052c9143f R09: 1ffff1100a592287 R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff92001a79f00 R13: ffff888052cd0000 R14: ffff88803e4c4640 R15: ffffffff8c886e88 FS: 00007fbc762566c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 0000000041f1b000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> vcc_sendmsg+0xa10/0xc50 net/atm/common.c:644 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 ____sys_sendmsg+0x52d/0x830 net/socket.c:2566 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620 __sys_sendmmsg+0x227/0x430 net/socket.c:2709 __do_sys_sendmmsg net/socket.c:2736 [inline] __se_sys_sendmmsg net/socket.c:2733 [inline] __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2733 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/atm/clip.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/atm/clip.c +9 -1
@@ -632,8 +632,16 @@ static void atmarpd_close(struct atm_vcc *vcc)module_put (THIS_MODULE ); } +static int atmarpd_send (struct atm_vcc *vcc,struct sk_buff *skb) +{ +atm_return_tx (vcc, skb); +dev_kfree_skb_any (skb); +return 0 ; +} +static const struct atmdev_ops atmarpd_dev_ops = { - .close = atmarpd_close + .close = atmarpd_close, + .send = atmarpd_send };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/109 net/sched: Abort __tc_modify_qdisc if parent class does not exist
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Nogueira <[email protected]>
[ Upstream commit ffdde7bf5a439aaa1955ebd581f5c64ab1533963 ]
Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands:
sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq
Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null.
The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class.
In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called.
[1] https://lore.kernel.org/netdev/[email protected]/
--- net/sched/sch_api.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
net/sched/sch_api.c +16 -7
@@ -334,17 +334,22 @@ struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle)return q; } -static struct Qdisc *qdisc_leaf (struct Qdisc *p,u32 classid) +static struct Qdisc *qdisc_leaf (struct Qdisc *p,u32 classid, +struct netlink_ext_ack *extack) {unsigned long cl;const struct Qdisc_class_ops *cops = p->ops->cl_ops; -if (cops ==NULL ) -return NULL ; +if (cops ==NULL ) { +NL_SET_ERR_MSG (extack,"Parent qdisc is not classful" ); +return ERR_PTR (-EOPNOTSUPP ); + } cl = cops->find (p, classid); -if (cl ==0 ) -return NULL ; +if (cl ==0 ) { +NL_SET_ERR_MSG (extack,"Specified class not found" ); +return ERR_PTR (-ENOENT ); + }return cops->leaf (p, cl); }
@@ -1497,7 +1502,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,NL_SET_ERR_MSG (extack,"Failed to find qdisc with specified classid" );return -ENOENT ; } - q =qdisc_leaf (p, clid); + q =qdisc_leaf (p, clid, extack); }else if (dev_ingress_queue (dev)) { q =rtnl_dereference (dev_ingress_queue (dev)->qdisc_sleeping); }
@@ -1508,6 +1513,8 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,NL_SET_ERR_MSG (extack,"Cannot find specified qdisc on specified device" );return -ENOENT ; } +if (IS_ERR (q)) +return PTR_ERR (q);if (tcm->tcm_handle && q->handle != tcm->tcm_handle) {NL_SET_ERR_MSG (extack,"Invalid handle" );
@@ -1601,7 +1608,9 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,NL_SET_ERR_MSG (extack,"Failed to find specified qdisc" );return -ENOENT ; } - q =qdisc_leaf (p, clid); + q =qdisc_leaf (p, clid, extack); +if (IS_ERR (q)) +return PTR_ERR (q); }else if (dev_ingress_queue_create (dev)) { q =rtnl_dereference (dev_ingress_queue (dev)->qdisc_sleeping); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/109 rxrpc: Fix bug due to prealloc collision
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 69e4186773c6445b258fb45b6e1df18df831ec45 ]
When userspace is using AF_RXRPC to provide a server, it has to preallocate incoming calls and assign to them call IDs that will be used to thread related recvmsg() and sendmsg() together. The preallocated call IDs will automatically be attached to calls as they come in until the pool is empty.
To the kernel, the call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer to prepared structs. In any case, the user isn't permitted to create two calls with the same call ID (call IDs become available again when the call ends) and EBADSLT should result from sendmsg() if an attempt is made to preallocate a call with an in-use call ID.
However, the cleanup in the error handling will trigger both assertions in rxrpc_cleanup_call() because the call isn't marked complete and isn't marked as having been released.
Fix this by setting the call state in rxrpc_service_prealloc_one() and then marking it as being released before calling the cleanup function.
--- net/rxrpc/call_accept.c | 1 + 1 file changed, 1 insertion(+)
net/rxrpc/call_accept.c +1 -0
@@ -149,6 +149,7 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx, id_in_use:write_unlock (&rx->call_lock); +rxrpc_prefail_call (call,RXRPC_CALL_LOCAL_ERROR , -EBADSLT );rxrpc_cleanup_call (call);_leave (" = -EBADSLT" );return -EBADSLT ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/109 maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam R. Howlett <[email protected]>
commit fba46a5d83ca8decb338722fb4899026d8d9ead2 upstream.
Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_STATE_PREALLOC flag is set. This flag is meant to avoid re-allocating in bulk allocation mode, and to detect issues with preallocation calculations.
The MA_STATE_PREALLOC flag should also always be set on zero allocations so that detection of underflow allocations will print a WARN_ON() during consumption.
User visible effect of this flaw is a WARN_ON() followed by a null pointer dereference when subsequent requests for larger number of nodes is ignored, such as the vma merge retry in mmap_region() caused by drivers altering the vma flags (which happens in v6.6, at least)
--- lib/maple_tree.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
lib/maple_tree.c +8 -5
@@ -5497,7 +5497,7 @@ int mas_preallocate(struct ma_state *mas/* At this point, we are at the leaf node that needs to be altered. */ /* Exact fit, no nodes needed. */ if (wr_mas.r_min == mas->index && wr_mas.r_max == mas->last) -return 0 ; + goto set_flag;mas_wr_end_piv (&wr_mas); node_size =mas_wr_new_end (&wr_mas);
@@ -5506,10 +5506,10 @@ int mas_preallocate(struct ma_state *masif (node_size == wr_mas.node_end) {/* reuse node */ if (!mt_in_rcu (mas->tree)) -return 0 ; + goto set_flag;/* shifting boundary */ if (wr_mas.offset_end - mas->offset ==1 ) -return 0 ; + goto set_flag; }if (node_size >= mt_slots[wr_mas.type]) {
@@ -5528,10 +5528,13 @@ int mas_preallocate(struct ma_state *mas/* node store, slot store needs one node */ ask_now: + mas->mas_flags &= ~MA_STATE_PREALLOC ;mas_node_count_gfp (mas, request, gfp); - mas->mas_flags |=MA_STATE_PREALLOC ; -if (likely (!mas_is_err (mas))) +if (likely (!mas_is_err (mas))) { +set_flag: + mas->mas_flags |=MA_STATE_PREALLOC ;return 0 ; + }mas_set_alloc_req (mas,0 ); ret =xa_err (mas->node);
Greg Kroah-Hartman
maintainerPATCH 29/109 perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
commit 440cf77625e300e683ca0edc39fbc4b6f3175feb upstream.
On recent Linux distros like Ubuntu Noble and Debian Bookworm, the 'pkg-config-aarch64-linux-gnu' package is missing. As a result, the aarch64-linux-gnu-pkg-config command is not available, which causes build failures.
When a build passes the environment variables PKG_CONFIG_LIBDIR or PKG_CONFIG_PATH, like a user uses make command or a build system (like Yocto, Buildroot, etc) prepares the variables and passes to the Perf's Makefile, the commit keeps these variables for package configuration. Otherwise, this commit sets the PKG_CONFIG_LIBDIR variable to use the Multiarch libs for the cross compilation.
--- tools/build/feature/Makefile | 25 ++++++++++++++++++++++++- tools/perf/Makefile.perf | 27 ++++++++++++++++++++++++++- 2 files changed, 50 insertions(+), 2 deletions(-)
tools/build/feature/Makefile +24 -1
@@ -80,7 +80,30 @@ FILES= FILES := $(addprefix $(OUTPUT),$(FILES)) -PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config +# Some distros provide the command $(CROSS_COMPILE)pkg-config for +# searching packges installed with Multiarch. Use it for cross +# compilation if it is existed. +ifneq (, $(shell which $(CROSS_COMPILE)pkg-config)) + PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config +else + PKG_CONFIG ?= pkg-config + + # PKG_CONFIG_PATH or PKG_CONFIG_LIBDIR, alongside PKG_CONFIG_SYSROOT_DIR + # for modified system root, are required for the cross compilation. + # If these PKG_CONFIG environment variables are not set, Multiarch library + # paths are used instead. + ifdef CROSS_COMPILE + ifeq ($(PKG_CONFIG_LIBDIR)$(PKG_CONFIG_PATH)$(PKG_CONFIG_SYSROOT_DIR),) + CROSS_ARCH = $(shell $(CC) -dumpmachine) + PKG_CONFIG_LIBDIR := /usr/local/$(CROSS_ARCH)/lib/pkgconfig/ + PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/local/lib/$(CROSS_ARCH)/pkgconfig/ + PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/lib/$(CROSS_ARCH)/pkgconfig/ + PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/local/share/pkgconfig/ + PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/share/pkgconfig/ + export PKG_CONFIG_LIBDIR + endif + endif +endif all: $(FILES)
tools/perf/Makefile.perf +26 -1
@@ -188,7 +188,32 @@ HOSTLD ?= ld HOSTAR ?= ar CLANG ?= clang -PKG_CONFIG = $(CROSS_COMPILE)pkg-config +# Some distros provide the command $(CROSS_COMPILE)pkg-config for +# searching packges installed with Multiarch. Use it for cross +# compilation if it is existed. +ifneq (, $(shell which $(CROSS_COMPILE)pkg-config)) + PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config +else + PKG_CONFIG ?= pkg-config + + # PKG_CONFIG_PATH or PKG_CONFIG_LIBDIR, alongside PKG_CONFIG_SYSROOT_DIR + # for modified system root, is required for the cross compilation. + # If these PKG_CONFIG environment variables are not set, Multiarch library + # paths are used instead. + ifdef CROSS_COMPILE + ifeq ($(PKG_CONFIG_LIBDIR)$(PKG_CONFIG_PATH)$(PKG_CONFIG_SYSROOT_DIR),) + CROSS_ARCH = $(shell $(CC) -dumpmachine) + PKG_CONFIG_LIBDIR := /usr/local/$(CROSS_ARCH)/lib/pkgconfig/ + PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/local/lib/$(CROSS_ARCH)/pkgconfig/ + PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/lib/$(CROSS_ARCH)/pkgconfig/ + PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/local/share/pkgconfig/ + PKG_CONFIG_LIBDIR := $(PKG_CONFIG_LIBDIR):/usr/share/pkgconfig/ + export PKG_CONFIG_LIBDIR + $(warning Missing PKG_CONFIG_LIBDIR, PKG_CONFIG_PATH and PKG_CONFIG_SYSROOT_DIR for cross compilation,) + $(warning set PKG_CONFIG_LIBDIR for using Multiarch libs.) + endif + endif +endif RM = rm -f LN = ln -f
Greg Kroah-Hartman
maintainerPATCH 30/109 Bluetooth: HCI: Set extended advertising data synchronously
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <[email protected]>
commit 89fb8acc38852116d38d721ad394aad7f2871670 upstream.
Currently, for controllers with extended advertising, the advertising data is set in the asynchronous response handler for extended adverstising params. As most advertising settings are performed in a synchronous context, the (asynchronous) setting of the advertising data is done too late (after enabling the advertising).
Move setting of adverstising data from asynchronous response handler into synchronous context to fix ordering of HCI commands.
v2: https://lore.kernel.org/linux-bluetooth/[email protected]/
[ This patch deviates from the upstream version because 3 functions in
hci_sync.c (hci_set_ext_adv_data_sync, hci_set_adv_data_sync and hci_update_adv_data_sync) had to be moved up within the file. The content of these functions differs between 6.6 and newer kernels. ]
--- net/bluetooth/hci_event.c | 36 ------- net/bluetooth/hci_sync.c | 213 ++++++++++++++++++++++++++++------------------ 2 files changed, 133 insertions(+), 116 deletions(-)
net/bluetooth/hci_event.c +0 -36
@@ -2139,40 +2139,6 @@ static u8 hci_cc_set_adv_param(struct hcreturn rp->status; } -static u8 hci_cc_set_ext_adv_param (struct hci_dev *hdev,void *data, -struct sk_buff *skb) -{ -struct hci_rp_le_set_ext_adv_params *rp = data; -struct hci_cp_le_set_ext_adv_params *cp; -struct adv_info *adv_instance; - -bt_dev_dbg (hdev,"status 0x%2.2x" , rp->status); - -if (rp->status) -return rp->status; - - cp =hci_sent_cmd_data (hdev,HCI_OP_LE_SET_EXT_ADV_PARAMS ); -if (!cp) -return rp->status; - -hci_dev_lock (hdev); - hdev->adv_addr_type = cp->own_addr_type; -if (!cp->handle) { -/* Store in hdev for instance 0 */ - hdev->adv_tx_power = rp->tx_power; - }else { - adv_instance =hci_find_adv_instance (hdev, cp->handle); -if (adv_instance) - adv_instance->tx_power = rp->tx_power; - } -/* Update adv data as tx power is known now */ -hci_update_adv_data (hdev, cp->handle); - -hci_dev_unlock (hdev); - -return rp->status; -} -static u8 hci_cc_read_rssi (struct hci_dev *hdev,void *data,struct sk_buff *skb) {
@@ -4153,8 +4119,6 @@ static const struct hci_cc {HCI_CC (HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS , hci_cc_le_read_num_adv_sets,sizeof (struct hci_rp_le_read_num_supported_adv_sets )), -HCI_CC (HCI_OP_LE_SET_EXT_ADV_PARAMS , hci_cc_set_ext_adv_param, -sizeof (struct hci_rp_le_set_ext_adv_params )),HCI_CC_STATUS (HCI_OP_LE_SET_EXT_ADV_ENABLE , hci_cc_le_set_ext_adv_enable), HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
net/bluetooth/hci_sync.c +133 -80
246 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 31/109 rxrpc: Fix oops due to non-existence of prealloc backlog struct
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 880a88f318cf1d2a0f4c0a7ff7b07e2062b434a4 upstream.
If an AF_RXRPC service socket is opened and bound, but calls are preallocated, then rxrpc_alloc_incoming_call() will oops because the rxrpc_backlog struct doesn't get allocated until the first preallocation is made.
Fix this by returning NULL from rxrpc_alloc_incoming_call() if there is no backlog struct. This will cause the incoming call to be aborted.
--- net/rxrpc/call_accept.c | 3 +++ 1 file changed, 3 insertions(+)
net/rxrpc/call_accept.c +3 -0
@@ -254,6 +254,9 @@ static struct rxrpc_call *rxrpc_alloc_inunsigned short call_tail, conn_tail, peer_tail;unsigned short call_count, conn_count; +if (!b) +return NULL ; +/* #calls >= #conns >= #peers must hold true. */ call_head =smp_load_acquire (&b->call_backlog_head); call_tail = b->call_backlog_tail;
Greg Kroah-Hartman
maintainerPATCH 32/109 ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit fa332f5dc6fc662ad7d3200048772c96b861cf6b upstream.
The "intf" list iterator is an invalid pointer if the correct "intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on and invalid pointer will lead to memory corruption.
We don't really need to call atomic_dec() if we haven't called atomic_add_return() so update the if (intf->in_shutdown) path as well.
Message-ID: <[email protected]>
[ - Dropped change to the if (intf->in_shutdown) block since that logic
doesn't exist yet.
- Modified out_unlock to release the srcu lock instead of the mutex since we don't have the mutex here yet. ]
--- drivers/char/ipmi/ipmi_msghandler.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/char/ipmi/ipmi_msghandler.c +2 -1
@@ -1241,7 +1241,7 @@ int ipmi_create_user(unsigned int }/* Not found, return an error */ rv = -EINVAL ; - goto out_kfree; + goto out_unlock; found:if (atomic_add_return (1 , &intf->nr_users) > max_users) {
@@ -1283,6 +1283,7 @@ int ipmi_create_user(unsigned int out_kfree:atomic_dec (&intf->nr_users); +out_unlock:srcu_read_unlock (&ipmi_interfaces_srcu, index);vfree (new_user);return rv;
Greg Kroah-Hartman
maintainerPATCH 33/109 x86/mce/amd: Add default names for MCA banks and blocks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yazen Ghannam <[email protected]>
commit d66e1e90b16055d2f0ee76e5384e3f119c3c2773 upstream.
Ensure that sysfs init doesn't fail for new/unrecognized bank types or if a bank has additional blocks available.
Most MCA banks have a single thresholding block, so the block takes the same name as the bank.
Unified Memory Controllers (UMCs) are a special case where there are two blocks and each has a unique name.
However, the microarchitecture allows for five blocks. Any new MCA bank types with more than one block will be missing names for the extra blocks. The MCE sysfs will fail to initialize in this case.
--- arch/x86/kernel/cpu/mce/amd.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
arch/x86/kernel/cpu/mce/amd.c +10 -3
@@ -1049,13 +1049,20 @@ static const char *get_name(unsigned int } bank_type =smca_get_bank_type (cpu, bank); -if (bank_type >=N_SMCA_BANK_TYPES ) -return NULL ;if (b && (bank_type ==SMCA_UMC || bank_type ==SMCA_UMC_V2 )) {if (b->block <ARRAY_SIZE (smca_umc_block_names))return smca_umc_block_names[b->block]; -return NULL ; + } + +if (b && b->block) { +snprintf (buf_mcatype,MAX_MCATYPE_NAME_LEN ,"th_block_%u" , b->block); +return buf_mcatype; + } + +if (bank_type >=N_SMCA_BANK_TYPES ) { +snprintf (buf_mcatype,MAX_MCATYPE_NAME_LEN ,"th_bank_%u" , bank); +return buf_mcatype; }if (per_cpu (smca_bank_counts, cpu)[bank_type] ==1 )
Greg Kroah-Hartman
maintainerPATCH 34/109 x86/mce/amd: Fix threshold limit reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yazen Ghannam <[email protected]>
commit 5f6e3b720694ad771911f637a51930f511427ce1 upstream.
The MCA threshold limit must be reset after servicing the interrupt.
Currently, the restart function doesn't have an explicit check for this. It makes some assumptions based on the current limit and what's in the registers. These assumptions don't always hold, so the limit won't be reset in some cases.
Make the reset condition explicit. Either an interrupt/overflow has occurred or the bank is being initialized.
--- arch/x86/kernel/cpu/mce/amd.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
arch/x86/kernel/cpu/mce/amd.c +7 -8
@@ -335,7 +335,6 @@ static void smca_configure(unsigned intstruct thresh_restart {struct threshold_block *b; -int reset;int set_lvt_off;int lvt_off;u16 old_limit;
@@ -430,13 +429,13 @@ static void threshold_restart_bank(voidrdmsr (tr->b->address, lo, hi); -if (tr->b->threshold_limit < (hi &THRESHOLD_MAX )) - tr->reset =1 ;/* limit cannot be lower than err count */ - -if (tr->reset) {/* reset err count and overflow bit */ - hi = - (hi & ~(MASK_ERR_COUNT_HI |MASK_OVERFLOW_HI )) | - (THRESHOLD_MAX - tr->b->threshold_limit); +/* +* Reset error count and overflow bit. +* This is done during init or after handling an interrupt. +*/ +if (hi &MASK_OVERFLOW_HI || tr->set_lvt_off) { + hi &= ~(MASK_ERR_COUNT_HI |MASK_OVERFLOW_HI ); + hi |=THRESHOLD_MAX - tr->b->threshold_limit; }else if (tr->old_limit) {/* change limit w/o reset */ int new_count = (hi &THRESHOLD_MAX ) + (tr->old_limit - tr->b->threshold_limit);
Greg Kroah-Hartman
maintainerPATCH 35/109 x86/mce: Dont remove sysfs if thresholding sysfs init fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yazen Ghannam <[email protected]>
commit 4c113a5b28bfd589e2010b5fc8867578b0135ed7 upstream.
Currently, the MCE subsystem sysfs interface will be removed if the thresholding sysfs interface fails to be created. A common failure is due to new MCA bank types that are not recognized and don't have a short name set.
The MCA thresholding feature is optional and should not break the common MCE sysfs interface. Also, new MCA bank types are occasionally introduced, and updates will be needed to recognize them. But likewise, this should not break the common sysfs interface.
Keep the MCE sysfs interface regardless of the status of the thresholding sysfs interface.
--- arch/x86/kernel/cpu/mce/core.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
arch/x86/kernel/cpu/mce/core.c +1 -7
@@ -2704,15 +2704,9 @@ static int mce_cpu_dead(unsigned int cpustatic int mce_cpu_online (unsigned int cpu) {struct timer_list *t =this_cpu_ptr (&mce_timer); -int ret;mce_device_create (cpu); - - ret =mce_threshold_create_device (cpu); -if (ret) { -mce_device_remove (cpu); -return ret; - } +mce_threshold_create_device (cpu);mce_reenable_cpu ();mce_start_timer (t);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 36/109 x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: JP Kobryn <[email protected]>
commit 30ad231a5029bfa16e46ce868497b1a5cdd3c24d upstream.
CMCI banks are not cleared during shutdown on Intel CPUs. As a side effect, when a kexec is performed, CPUs coming back online are unable to rediscover/claim these occupied banks which breaks MCE reporting.
Clear the CPU ownership during shutdown via cmci_clear() so the banks can be reclaimed and MCE reporting will become functional once more.
[ bp: Massage commit message. ]
--- arch/x86/kernel/cpu/mce/intel.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/cpu/mce/intel.c +1 -0
@@ -517,6 +517,7 @@ void mce_intel_feature_init(struct cpuinvoid mce_intel_feature_clear (struct cpuinfo_x86 *c) {intel_clear_lmce (); +cmci_clear (); }bool intel_filter_mce (struct mce *m)
Greg Kroah-Hartman
maintainerPATCH 37/109 KVM: x86/xen: Allow out of range event channel ports in IRQ routing table.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <[email protected]>
commit a7f4dff21fd744d08fa956c243d2b1795f23cbf7 upstream.
To avoid imposing an ordering constraint on userspace, allow 'invalid' event channel targets to be configured in the IRQ routing table.
This is the same as accepting interrupts targeted at vCPUs which don't exist yet, which is already the case for both Xen event channels *and* for MSIs (which don't do any filtering of permitted APIC ID targets at all).
If userspace actually *triggers* an IRQ with an invalid target, that will fail cleanly, as kvm_xen_set_evtchn_fast() also does the same range check.
If KVM enforced that the IRQ target must be valid at the time it is *configured*, that would force userspace to create all vCPUs and do various other parts of setup (in this case, setting the Xen long_mode) before restoring the IRQ table.
--- arch/x86/kvm/xen.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
arch/x86/kvm/xen.c +13 -2
@@ -1737,8 +1737,19 @@ int kvm_xen_setup_evtchn(struct kvm *kvm {struct kvm_vcpu *vcpu; -if (ue->u.xen_evtchn.port >=max_evtchn_port (kvm)) -return -EINVAL ; +/* +* Don't check for the port being within range of max_evtchn_port(). +* Userspace can configure what ever targets it likes; events just won't +* be delivered if/while the target is invalid, just like userspace can +* configure MSIs which target non-existent APICs. +* +* This allow on Live Migration and Live Update, the IRQ routing table +* can be restored *independently* of other things like creating vCPUs, +* without imposing an ordering dependency on userspace. In this +* particular case, the problematic ordering would be with setting the +* Xen 'long mode' flag, which changes max_evtchn_port() to allow 4096 +* instead of 1024 event channels. +*/ /* We only support 2 level event channels for now */ if (ue->u.xen_evtchn.priority !=KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL )
Greg Kroah-Hartman
maintainerPATCH 38/109 KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01 upstream.
Reject migration of SEV{-ES} state if either the source or destination VM is actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the section between incrementing created_vcpus and online_vcpus. The bulk of vCPU creation runs _outside_ of kvm->lock to allow creating multiple vCPUs in parallel, and so sev_info.es_active can get toggled from false=>true in the destination VM after (or during) svm_vcpu_create(), resulting in an SEV{-ES} VM effectively having a non-SEV{-ES} vCPU.
The issue manifests most visibly as a crash when trying to free a vCPU's NULL VMSA page in an SEV-ES VM, but any number of things can go wrong.
BUG: unable to handle page fault for address: ffffebde00000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G U O 6.15.0-smp-DEV #2 NONE Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024 RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline] RIP: 0010:PageHead include/linux/page-flags.h:866 [inline] RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067 Code: <49> f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0 RSP: 0018:ffff8984551978d0 EFLAGS: 00010246 RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000 RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000 R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000 R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000 FS: 0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169 svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515 kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396 kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline] kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490 kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895 kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310 kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369 __fput+0x3e4/0x9e0 fs/file_table.c:465 task_work_run+0x1a9/0x220 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x7f0/0x25b0 kernel/exit.c:953 do_group_exit+0x203/0x2d0 kernel/exit.c:1102 get_signal+0x1357/0x1480 kernel/signal.c:3034 arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218 do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f87a898e969 </TASK> Modules linked in: gq(O) gsmi: Log Shutdown Reason 0x03 CR2: ffffebde00000000 ---[ end trace 0000000000000000 ]---
Deliberately don't check for a NULL VMSA when freeing the vCPU, as crashing the host is likely desirable due to the VMSA being consumed by hardware. E.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a bogus VMSA page. Accessing PFN 0 is "fine"-ish now that it's sequestered away thanks to L1TF, but panicking in this scenario is preferable to potentially running with corrupted state.
--- arch/x86/kvm/svm/sev.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/kvm/svm/sev.c +4 -0
@@ -1782,6 +1782,10 @@ static int sev_check_source_vcpus(structstruct kvm_vcpu *src_vcpu;unsigned long i; +if (src->created_vcpus !=atomic_read (&src->online_vcpus) || + dst->created_vcpus !=atomic_read (&dst->online_vcpus)) +return -EBUSY ; +if (!sev_es_guest (src))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 39/109 gre: Fix IPv6 multicast route creation.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
commit 4e914ef063de40397e25a025c70d9737a9e45a8c upstream.
Use addrconf_add_dev() instead of ipv6_find_idev() in addrconf_gre_config() so that we don't just get the inet6_dev, but also install the default ff00::/8 multicast route.
Before commit 3e6a0243ff00 ("gre: Fix again IPv6 link-local address generation."), the multicast route was created at the end of the function by addrconf_add_mroute(). But this code path is now only taken in one particular case (gre devices not bound to a local IP address and in EUI64 mode). For all other cases, the function exits early and addrconf_add_mroute() is not called anymore.
Using addrconf_add_dev() instead of ipv6_find_idev() in addrconf_gre_config(), fixes the problem as it will create the default multicast route for all gre devices. This also brings addrconf_gre_config() a bit closer to the normal netdevice IPv6 configuration code (addrconf_dev_config()).
--- net/ipv6/addrconf.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
net/ipv6/addrconf.c +2 -7
@@ -3499,11 +3499,9 @@ static void addrconf_gre_config(struct nASSERT_RTNL (); - idev =ipv6_find_idev (dev); -if (IS_ERR (idev)) { -pr_debug ("%s: add_dev failed\n" , __func__); + idev =addrconf_add_dev (dev); +if (IS_ERR (idev))return ; - }/* Generate the IPv6 link-local address using addrconf_addr_gen(), * unless we have an IPv4 GRE device not bound to an IP address and
@@ -3517,9 +3515,6 @@ static void addrconf_gre_config(struct n }add_v4_addrs (idev); - -if (dev->flags &IFF_POINTOPOINT ) -addrconf_add_mroute (dev); }#endif
Greg Kroah-Hartman
maintainerPATCH 40/109 md/md-bitmap: fix GPF in bitmap_get_stats()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Håkon Bugge <[email protected]>
commit c17fb542dbd1db745c9feac15617056506dd7195 upstream.
The commit message of commit 6ec1f0239485 ("md/md-bitmap: fix stats collection for external bitmaps") states:
Remove the external bitmap check as the statistics should be available regardless of bitmap storage location.
Return -EINVAL only for invalid bitmap with no storage (neither in superblock nor in external file).
But, the code does not adhere to the above, as it does only check for a valid super-block for "internal" bitmaps. Hence, we observe:
Oops: GPF, probably for non-canonical address 0x1cd66f1f40000028 RIP: 0010:bitmap_get_stats+0x45/0xd0 Call Trace: seq_read_iter+0x2b9/0x46a seq_read+0x12f/0x180 proc_reg_read+0x57/0xb0 vfs_read+0xf6/0x380 ksys_read+0x6d/0xf0 do_syscall_64+0x8c/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
We fix this by checking the existence of a super-block for both the internal and external case.
--- drivers/md/md-bitmap.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/md/md-bitmap.c +1 -2
@@ -2119,8 +2119,7 @@ int md_bitmap_get_stats(struct bitmap *bif (!bitmap)return -ENOENT ; -if (!bitmap->mddev->bitmap_info.external && - !bitmap->storage.sb_page) +if (!bitmap->storage.sb_page)return -EINVAL ; sb =kmap_local_page (bitmap->storage.sb_page); stats->sync_size =le64_to_cpu (sb->sync_size);
Greg Kroah-Hartman
maintainerPATCH 41/109 pinctrl: qcom: msm: mark certain pins as invalid for interrupts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 93712205ce2f1fb047739494c0399a26ea4f0890 upstream.
On some platforms, the UFS-reset pin has no interrupt logic in TLMM but is nevertheless registered as a GPIO in the kernel. This enables the user-space to trigger a BUG() in the pinctrl-msm driver by running, for
example: gpiomon -c 0 113 on RB2.
The exact culprit is requesting pins whose intr_detection_width setting is not 1 or 2 for interrupts. This hits a BUG() in msm_gpio_irq_set_type(). Potentially crashing the kernel due to an invalid request from user-space is not optimal, so let's go through the pins and mark those that would fail the check as invalid for the irq chip as we should not even register them as available irqs.
This function can be extended if we determine that there are more corner-cases like this.
--- drivers/pinctrl/qcom/pinctrl-msm.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/pinctrl/qcom/pinctrl-msm.c +20 -0
@@ -1031,6 +1031,25 @@ static bool msm_gpio_needs_dual_edge_partest_bit (d->hwirq, pctrl->skip_wake_irqs); } +static void msm_gpio_irq_init_valid_mask (struct gpio_chip *gc, +unsigned long *valid_mask, +unsigned int ngpios) +{ +struct msm_pinctrl *pctrl =gpiochip_get_data (gc); +const struct msm_pingroup *g; +int i; + +bitmap_fill (valid_mask, ngpios); + +for (i =0 ; i < ngpios; i++) { + g = &pctrl->soc->groups[i]; + +if (g->intr_detection_width !=1 && + g->intr_detection_width !=2 ) +clear_bit (i, valid_mask); + } +} +static int msm_gpio_irq_set_type (struct irq_data *d,unsigned int type) {struct gpio_chip *gc =irq_data_get_irq_chip_data (d);
@@ -1392,6 +1411,7 @@ static int msm_gpio_init(struct msm_pinc girq->default_type =IRQ_TYPE_NONE ; girq->handler = handle_bad_irq; girq->parents[0 ] = pctrl->irq; + girq->init_valid_mask = msm_gpio_irq_init_valid_mask; ret =gpiochip_add_data (&pctrl->chip, pctrl);if (ret) {
Greg Kroah-Hartman
maintainerPATCH 42/109 wifi: prevent A-MSDU attacks in mesh networks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathy Vanhoef <[email protected]>
commit 737bb912ebbe4571195c56eba557c4d7315b26fb upstream.
This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 but for mesh networks.
This patch tries to detect if a standard MSDU was turned into an A-MSDU by an adversary. This is done by parsing a received A-MSDU as a standard MSDU, calculating the length of the Mesh Control header, and seeing if the 6 bytes after this header equal the start of an rfc1042 header. If equal, this is a strong indication of an ongoing attack attempt.
This defense was tested with mac80211_hwsim against a mesh network that uses an empty Mesh Address Extension field, i.e., when four addresses are used, and when using a 12-byte Mesh Address Extension field, i.e., when six addresses are used. Functionality of normal MSDUs and A-MSDUs was also tested, and confirmed working, when using both an empty and 12-byte Mesh Address Extension field.
It was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh networks keep being detected and prevented.
Note that the vulnerability being patched, and the defense being implemented, was also discussed in the following paper and in the following IEEE 802.11 presentation:
https://papers.mathyvanhoef.com/wisec2025.pdf
https://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx
--- net/wireless/util.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 50 insertions(+), 2 deletions(-)
net/wireless/util.c +50 -2
@@ -826,6 +826,52 @@ bool ieee80211_is_valid_amsdu(struct sk_ }EXPORT_SYMBOL (ieee80211_is_valid_amsdu); + +/* +* Detects if an MSDU frame was maliciously converted into an A-MSDU +* frame by an adversary. This is done by parsing the received frame +* as if it were a regular MSDU, even though the A-MSDU flag is set. +* +* For non-mesh interfaces, detection involves checking whether the +* payload, when interpreted as an MSDU, begins with a valid RFC1042 +* header. This is done by comparing the A-MSDU subheader's destination +* address to the start of the RFC1042 header. +* +* For mesh interfaces, the MSDU includes a 6-byte Mesh Control field +* and an optional variable-length Mesh Address Extension field before +* the RFC1042 header. The position of the RFC1042 header must therefore +* be calculated based on the mesh header length. +* +* Since this function intentionally parses an A-MSDU frame as an MSDU, +* it only assumes that the A-MSDU subframe header is present, and +* beyond this it performs its own bounds checks under the assumption +* that the frame is instead parsed as a non-aggregated MSDU. +*/ +static bool +is_amsdu_aggregation_attack (struct ethhdr *eth,struct sk_buff *skb, +enum nl80211_iftype iftype) +{ +int offset; + +/* Non-mesh case can be directly compared */ +if (iftype !=NL80211_IFTYPE_MESH_POINT ) +return ether_addr_equal (eth->h_dest, rfc1042_header); + + offset =__ieee80211_get_mesh_hdrlen (eth->h_dest[0 ]); +if (offset ==6 ) { +/* Mesh case with empty address extension field */ +return ether_addr_equal (eth->h_source, rfc1042_header); + }else if (offset +ETH_ALEN <= skb->len) { +/* Mesh case with non-empty address extension field */ +u8 temp[ETH_ALEN ]; + +skb_copy_bits (skb, offset, temp,ETH_ALEN ); +return ether_addr_equal (temp, rfc1042_header); + } + +return false; +} + void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, const u8 *addr, enum nl80211_iftype iftype, const unsigned int extra_headroom,
@@ -867,8 +913,10 @@ void ieee80211_amsdu_to_8023s(struct sk_/* the last MSDU has no padding */ if (subframe_len > remaining) goto purge; -/* mitigate A-MSDU aggregation injection attacks */ -if (ether_addr_equal (hdr.eth.h_dest, rfc1042_header)) +/* mitigate A-MSDU aggregation injection attacks, to be +* checked when processing first subframe (offset == 0). +*/ +if (offset ==0 &&is_amsdu_aggregation_attack (&hdr.eth, skb, iftype)) goto purge; offset +=sizeof (struct ethhdr );
Greg Kroah-Hartman
maintainerPATCH 43/109 drm/gem: Acquire references on GEM handles for framebuffers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit 5307dce878d4126e1b375587318955bd019c3741 upstream.
A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. [1] Trying to use the framebuffer in further mode-setting operations leads to a segmentation fault. Most easily happens with driver that use shadow planes for vmap-ing the dma-buf during a page flip. An example is shown below.
[ 156.791968] ------------[ cut here ]------------ [ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430 [...] [ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430 [ 157.043420] Call Trace: [ 157.045898] <TASK> [ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710 [ 157.065567] ? dma_buf_vmap+0x224/0x430 [ 157.069446] ? __warn.cold+0x58/0xe4 [ 157.073061] ? dma_buf_vmap+0x224/0x430 [ 157.077111] ? report_bug+0x1dd/0x390 [ 157.080842] ? handle_bug+0x5e/0xa0 [ 157.084389] ? exc_invalid_op+0x14/0x50 [ 157.088291] ? asm_exc_invalid_op+0x16/0x20 [ 157.092548] ? dma_buf_vmap+0x224/0x430 [ 157.096663] ? dma_resv_get_singleton+0x6d/0x230 [ 157.101341] ? __pfx_dma_buf_vmap+0x10/0x10 [ 157.105588] ? __pfx_dma_resv_get_singleton+0x10/0x10 [ 157.110697] drm_gem_shmem_vmap+0x74/0x710 [ 157.114866] drm_gem_vmap+0xa9/0x1b0 [ 157.118763] drm_gem_vmap_unlocked+0x46/0xa0 [ 157.123086] drm_gem_fb_vmap+0xab/0x300 [ 157.126979] drm_atomic_helper_prepare_planes.part.0+0x487/0xb10 [ 157.133032] ? lockdep_init_map_type+0x19d/0x880 [ 157.137701] drm_atomic_helper_commit+0x13d/0x2e0 [ 157.142671] ? drm_atomic_nonblocking_commit+0xa0/0x180 [ 157.147988] drm_mode_atomic_ioctl+0x766/0xe40 [...] [ 157.346424] ---[ end trace 0000000000000000 ]---
Acquiring GEM handles for the framebuffer's GEM buffer objects prevents this from happening. The framebuffer's cleanup later puts the handle references.
Commit 1a148af06000 ("drm/gem-shmem: Use dma_buf from GEM object instance") triggers the segmentation fault easily by using the dma-buf field more widely. The underlying issue with reference counting has been present before.
v2:
- acquire the handle instead of the BO (Christian)
- fix comment style (Christian)
- drop the Fixes tag (Christian)
- rename err_ gotos
- add missing Link tag
--- drivers/gpu/drm/drm_gem.c | 44 ++++++++++++++++++++++++--- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 16 +++++---- drivers/gpu/drm/drm_internal.h | 2 + 3 files changed, 51 insertions(+), 11 deletions(-)
drivers/gpu/drm/drm_gem.c +40 -4
@@ -186,6 +186,35 @@ void drm_gem_private_object_fini(struct }EXPORT_SYMBOL (drm_gem_private_object_fini); +static void drm_gem_object_handle_get (struct drm_gem_object *obj) +{ +struct drm_device *dev = obj->dev; + +drm_WARN_ON (dev, !mutex_is_locked (&dev->object_name_lock)); + +if (obj->handle_count++ ==0 ) +drm_gem_object_get (obj); +} + +/** +* drm_gem_object_handle_get_unlocked - acquire reference on user-space handles +* @obj: GEM object +* +* Acquires a reference on the GEM buffer object's handle. Required +* to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked() +* to release the reference. +*/ +void drm_gem_object_handle_get_unlocked (struct drm_gem_object *obj) +{ +struct drm_device *dev = obj->dev; + +guard (mutex)(&dev->object_name_lock); + +drm_WARN_ON (dev, !obj->handle_count);/* first ref taken in create-tail helper */ +drm_gem_object_handle_get (obj); +} +EXPORT_SYMBOL (drm_gem_object_handle_get_unlocked); +/** * drm_gem_object_handle_free - release resources bound to userspace handles * @obj: GEM object to clean up.
@@ -216,8 +245,14 @@ static void drm_gem_object_exported_dma_ } } -static void -drm_gem_object_handle_put_unlocked (struct drm_gem_object *obj) +/** +* drm_gem_object_handle_put_unlocked - releases reference on user-space handles +* @obj: GEM object +* +* Releases a reference on the GEM buffer object's handle. Possibly releases +* the GEM buffer object and associated dma-buf objects. +*/ +void drm_gem_object_handle_put_unlocked (struct drm_gem_object *obj) {struct drm_device *dev = obj->dev;bool final = false;
@@ -242,6 +277,7 @@ drm_gem_object_handle_put_unlocked(strucif (final)drm_gem_object_put (obj); } +EXPORT_SYMBOL (drm_gem_object_handle_put_unlocked);/* * Called at device or object close to release the file's
@@ -363,8 +399,8 @@ drm_gem_handle_create_tail(struct drm_fiint ret;WARN_ON (!mutex_is_locked (&dev->object_name_lock)); -if (obj->handle_count++ ==0 ) -drm_gem_object_get (obj); + +drm_gem_object_handle_get (obj);/* * Get the user-visible handle using idr. Preload and perform
drivers/gpu/drm/drm_gem_framebuffer_helper.c +9 -7
@@ -99,7 +99,7 @@ void drm_gem_fb_destroy(struct drm_frameunsigned int i;for (i =0 ; i < fb->format->num_planes; i++) -drm_gem_object_put (fb->obj[i]); +drm_gem_object_handle_put_unlocked (fb->obj[i]);drm_framebuffer_cleanup (fb);kfree (fb);
@@ -182,8 +182,10 @@ int drm_gem_fb_init_with_funcs(struct drif (!objs[i]) {drm_dbg_kms (dev,"Failed to lookup GEM object\n" ); ret = -ENOENT ; - goto err_gem_object_put; + goto err_gem_object_handle_put_unlocked; } +drm_gem_object_handle_get_unlocked (objs[i]); +drm_gem_object_put (objs[i]); min_size = (height -1 ) * mode_cmd->pitches[i] +drm_format_info_min_pitch (info, i, width)
@@ -193,22 +195,22 @@ int drm_gem_fb_init_with_funcs(struct drdrm_dbg_kms (dev,"GEM object size (%zu) smaller than minimum size (%u) for plane %d\n" , objs[i]->size, min_size, i); -drm_gem_object_put (objs[i]); +drm_gem_object_handle_put_unlocked (objs[i]); ret = -EINVAL ; - goto err_gem_object_put; + goto err_gem_object_handle_put_unlocked; } } ret =drm_gem_fb_init (dev, fb, mode_cmd, objs, i, funcs);if (ret) - goto err_gem_object_put; + goto err_gem_object_handle_put_unlocked;return 0 ; -err_gem_object_put: +err_gem_object_handle_put_unlocked:while (i >0 ) { --i; -drm_gem_object_put (objs[i]); +drm_gem_object_handle_put_unlocked (objs[i]); }return ret; }
drivers/gpu/drm/drm_internal.h +2 -0
@@ -155,6 +155,8 @@ void drm_sysfs_lease_event(struct drm_de/* drm_gem.c */ int drm_gem_init (struct drm_device *dev); +void drm_gem_object_handle_get_unlocked (struct drm_gem_object *obj); +void drm_gem_object_handle_put_unlocked (struct drm_gem_object *obj);int drm_gem_handle_create_tail (struct drm_file *file_priv,struct drm_gem_object *obj,u32 *handlep);
Greg Kroah-Hartman
maintainerPATCH 44/109 drm/sched: Increment job count before swapping tail spsc queue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
commit 8af39ec5cf2be522c8eb43a3d8005ed59e4daaee upstream.
A small race exists between spsc_queue_push and the run-job worker, in which spsc_queue_push may return not-first while the run-job worker has already idled due to the job count being zero. If this race occurs, job scheduling stops, leading to hangs while waiting on the job’s DMA fences.
Seal this race by incrementing the job count before appending to the SPSC queue.
This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in an SVM test case.
--- include/drm/spsc_queue.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
include/drm/spsc_queue.h +3 -1
@@ -70,9 +70,11 @@ static inline bool spsc_queue_push(strucpreempt_disable (); +atomic_inc (&queue->job_count); +smp_mb__after_atomic (); + tail = (struct spsc_node **)atomic_long_xchg (&queue->tail, (long )&node->next);WRITE_ONCE (*tail, node); -atomic_inc (&queue->job_count);/* * In case of first element verify new node will be visible to the consumer
Greg Kroah-Hartman
maintainerPATCH 45/109 drm/ttm: fix error handling in ttm_buffer_object_transfer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
commit 97e000acf2e20a86a50a0ec8c2739f0846f37509 upstream.
Unlocking the resv object was missing in the error path, additionally to that we should move over the resource only after the fence slot was reserved.
--- drivers/gpu/drm/ttm/ttm_bo_util.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/gpu/drm/ttm/ttm_bo_util.c +7 -6
@@ -254,6 +254,13 @@ static int ttm_buffer_object_transfer(st ret =dma_resv_trylock (&fbo->base.base._resv);WARN_ON (!ret); + ret =dma_resv_reserve_fences (&fbo->base.base._resv,1 ); +if (ret) { +dma_resv_unlock (&fbo->base.base._resv); +kfree (fbo); +return ret; + } +if (fbo->base.resource) {ttm_resource_set_bo (fbo->base.resource, &fbo->base); bo->resource =NULL ;
@@ -262,12 +269,6 @@ static int ttm_buffer_object_transfer(st fbo->base.bulk_move =NULL ; } - ret =dma_resv_reserve_fences (&fbo->base.base._resv,1 ); -if (ret) { -kfree (fbo); -return ret; - } -ttm_bo_get (bo); fbo->bo = bo;
Greg Kroah-Hartman
maintainerPATCH 46/109 drm/gem: Fix race in drm_gem_handle_create_tail()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simona Vetter <[email protected]>
commit bd46cece51a36ef088f22ef0416ac13b0a46d5b0 upstream.
Object creation is a careful dance where we must guarantee that the object is fully constructed before it is visible to other threads, and GEM buffer objects are no difference.
Final publishing happens by calling drm_gem_handle_create(). After that the only allowed thing to do is call drm_gem_object_put() because a concurrent call to the GEM_CLOSE ioctl with a correctly guessed id (which is trivial since we have a linear allocator) can already tear down the object again.
Luckily most drivers get this right, the very few exceptions I've pinged the relevant maintainers for. Unfortunately we also need drm_gem_handle_create() when creating additional handles for an already existing object (e.g. GETFB ioctl or the various bo import ioctl), and hence we cannot have a drm_gem_handle_create_and_put() as the only exported function to stop these issues from happening.
Now unfortunately the implementation of drm_gem_handle_create() isn't living up to standards: It does correctly finishe object initialization at the global level, and hence is safe against a concurrent tear down. But it also sets up the file-private aspects of the handle, and that part goes wrong: We fully register the object in the drm_file.object_idr before calling drm_vma_node_allow() or obj->funcs->open, which opens up races against concurrent removal of that handle in drm_gem_handle_delete().
Fix this with the usual two-stage approach of first reserving the handle id, and then only registering the object after we've completed the file-private setup.
Jacek reported this with a testcase of concurrently calling GEM_CLOSE on a freshly-created object (which also destroys the object), but it should be possible to hit this with just additional handles created through import or GETFB without completed destroying the underlying object with the concurrent GEM_CLOSE ioctl calls.
Note that the close-side of this race was fixed in f6cd7daecff5 ("drm:
Release driver references to handle before making it available again"), which means a cool 9 years have passed until someone noticed that we need to make this symmetry or there's still gaps left :-/ Without the 2-stage close approach we'd still have a race, therefore that's an integral part of this bugfix.
More importantly, this means we can have NULL pointers behind allocated id in our drm_file.object_idr. We need to check for that now:
- drm_gem_handle_delete() checks for ERR_OR_NULL already
- drm_gem.c:object_lookup() also chekcs for NULL
- drm_gem_release() should never be called if there's another thread still existing that could call into an IOCTL that creates a new handle, so cannot race. For paranoia I added a NULL check to drm_gem_object_release_handle() though.
- most drivers (etnaviv, i915, msm) are find because they use idr_find(), which maps both ENOENT and NULL to NULL.
- drivers using idr_for_each_entry() should also be fine, because idr_get_next does filter out NULL entries and continues the iteration.
- The same holds for drm_show_memory_stats().
v2: Use drm_WARN_ON (Thomas)
--- drivers/gpu/drm/drm_gem.c | 10 +++++++++- include/drm/drm_file.h | 3 +++ 2 files changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_gem.c +9 -1
@@ -289,6 +289,9 @@ drm_gem_object_release_handle(int id, vostruct drm_file *file_priv = data;struct drm_gem_object *obj = ptr; +if (drm_WARN_ON (obj->dev, !data)) +return 0 ; +if (obj->funcs->close) obj->funcs->close (obj, file_priv);
@@ -409,7 +412,7 @@ drm_gem_handle_create_tail(struct drm_fiidr_preload (GFP_KERNEL );spin_lock (&file_priv->table_lock); - ret =idr_alloc (&file_priv->object_idr, obj,1 ,0 ,GFP_NOWAIT ); + ret =idr_alloc (&file_priv->object_idr,NULL ,1 ,0 ,GFP_NOWAIT );spin_unlock (&file_priv->table_lock);idr_preload_end ();
@@ -430,6 +433,11 @@ drm_gem_handle_create_tail(struct drm_fi goto err_revoke; } +/* mirrors drm_gem_handle_delete to avoid races */ +spin_lock (&file_priv->table_lock); + obj =idr_replace (&file_priv->object_idr, obj, handle); +WARN_ON (obj !=NULL ); +spin_unlock (&file_priv->table_lock); *handlep = handle;return 0 ;
include/drm/drm_file.h +3 -0
@@ -302,6 +302,9 @@ struct drm_file {* * Mapping of mm object handles to object pointers. Used by the GEM * subsystem. Protected by @table_lock. +* +* Note that allocated entries might be NULL as a transient state when +* creating or deleting a handle. */ struct idr object_idr;
Greg Kroah-Hartman
maintainerPATCH 47/109 usb: gadget: u_serial: Fix race condition in TTY wakeup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
commit c529c3730bd09115684644e26bf01ecbd7e2c2c9 upstream.
A race condition occurs when gs_start_io() calls either gs_start_rx() or gs_start_tx(), as those functions briefly drop the port_lock for usb_ep_queue(). This allows gs_close() and gserial_disconnect() to clear port.tty and port_usb, respectively.
Use the null-safe TTY Port helper function to wake up TTY.
Example
CPU1: CPU2:
gserial_connect() // lock
gs_close() // await lock
gs_start_rx() // unlock
usb_ep_queue()
gs_close() // lock, reset port.tty and unlock
gs_start_rx() // lock
tty_wakeup() // NPE
--- drivers/usb/gadget/function/u_serial.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/gadget/function/u_serial.c +3 -3
@@ -291,8 +291,8 @@ __acquires(&port->port_lock)break ; } -if (do_tty_wake && port->port.tty) -tty_wakeup (port->port.tty); +if (do_tty_wake) +tty_port_tty_wakeup (&port->port);return status; }
@@ -573,7 +573,7 @@ static int gs_start_io(struct gs_port *pgs_start_tx (port);/* Unblock any pending writes into our circular buffer, in case * we didn't in gs_start_tx() */ -tty_wakeup (port->port.tty); +tty_port_tty_wakeup (&port->port); }else {/* Free reqs only if we are still connected */ if (port->port_usb) {
Greg Kroah-Hartman
maintainerPATCH 48/109 Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
commit f6c7bc4a6823a0a959f40866a1efe99bd03c2c5b upstream.
This reverts commit ffd603f214237e250271162a5b325c6199a65382.
Commit ffd603f21423 ("usb: gadget: u_serial: Add null pointer check in gs_start_io") adds null pointer checks at the beginning of the gs_start_io() function to prevent a null pointer dereference. However, these checks are redundant because the function's comment already requires callers to hold the port_lock and ensure port.tty and port_usb are not null. All existing callers already follow these rules.
The true cause of the null pointer dereference is a race condition. When gs_start_io() calls either gs_start_rx() or gs_start_tx(), the port_lock is temporarily released for usb_ep_queue(). This allows port.tty and port_usb to be cleared.
--- drivers/usb/gadget/function/u_serial.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/usb/gadget/function/u_serial.c +1 -5
@@ -539,20 +539,16 @@ static int gs_alloc_requests(struct usb_static int gs_start_io (struct gs_port *port) {struct list_head *head = &port->read_pool; -struct usb_ep *ep; +struct usb_ep *ep = port->port_usb->out;int status;unsigned started; -if (!port->port_usb || !port->port.tty) -return -EIO ; -/* Allocate RX and TX I/O buffers. We can't easily do this much * earlier (with GFP_KERNEL) because the requests are coupled to * endpoints, as are the packet sizes we'll be using. Different * configurations may use different endpoints with a given port; * and high speed vs full speed changes packet sizes too. */ - ep = port->port_usb->out; status =gs_alloc_requests (ep, head, gs_read_complete, &port->read_allocated);if (status)
Greg Kroah-Hartman
maintainerPATCH 49/109 drm/framebuffer: Acquire internal references on GEM handles
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit f6bfc9afc7510cb5e6fbe0a17c507917b0120280 upstream.
Acquire GEM handles in drm_framebuffer_init() and release them in the corresponding drm_framebuffer_cleanup(). Ties the handle's lifetime to the framebuffer. Not all GEM buffer objects have GEM handles. If not set, no refcounting takes place. This is the case for some fbdev emulation. This is not a problem as these GEM objects do not use dma-bufs and drivers will not release them while fbdev emulation is running. Framebuffer flags keep a bit per color plane of which the framebuffer holds a GEM handle reference.
As all drivers use drm_framebuffer_init(), they will now all hold dma-buf references as fixed in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers").
In the GEM framebuffer helpers, restore the original ref counting on buffer objects. As the helpers for handle refcounting are now no longer called from outside the DRM core, unexport the symbols.
v3:
- don't mix internal flags with mode flags (Christian) v2:
- track framebuffer handle refs by flag
- drop gma500 cleanup (Christian)
--- drivers/gpu/drm/drm_framebuffer.c | 31 ++++++++++++++++++++-- drivers/gpu/drm/drm_gem.c | 38 +++++++++++++++++---------- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 16 ++++------- drivers/gpu/drm/drm_internal.h | 2 - include/drm/drm_framebuffer.h | 7 ++++ 5 files changed, 68 insertions(+), 26 deletions(-)
drivers/gpu/drm/drm_framebuffer.c +29 -2
@@ -844,11 +844,23 @@ void drm_framebuffer_free(struct kref *kint drm_framebuffer_init (struct drm_device *dev,struct drm_framebuffer *fb,const struct drm_framebuffer_funcs *funcs) { +unsigned int i;int ret; +bool exists;if (WARN_ON_ONCE (fb->dev != dev || !fb->format))return -EINVAL ; +for (i =0 ; i < fb->format->num_planes; i++) { +if (drm_WARN_ON_ONCE (dev, fb->internal_flags &DRM_FRAMEBUFFER_HAS_HANDLE_REF (i))) + fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF (i); +if (fb->obj[i]) { + exists =drm_gem_object_handle_get_if_exists_unlocked (fb->obj[i]); +if (exists) + fb->internal_flags |=DRM_FRAMEBUFFER_HAS_HANDLE_REF (i); + } + } +INIT_LIST_HEAD (&fb->filp_head); fb->funcs = funcs;
@@ -857,7 +869,7 @@ int drm_framebuffer_init(struct drm_devi ret =__drm_mode_object_add (dev, &fb->base,DRM_MODE_OBJECT_FB , false, drm_framebuffer_free);if (ret) - goto out; + goto err;mutex_lock (&dev->mode_config.fb_lock); dev->mode_config.num_fb++;
@@ -865,7 +877,16 @@ int drm_framebuffer_init(struct drm_devimutex_unlock (&dev->mode_config.fb_lock);drm_mode_object_register (dev, &fb->base); -out: + +return 0 ; + +err: +for (i =0 ; i < fb->format->num_planes; i++) { +if (fb->internal_flags &DRM_FRAMEBUFFER_HAS_HANDLE_REF (i)) { +drm_gem_object_handle_put_unlocked (fb->obj[i]); + fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF (i); + } + }return ret; }EXPORT_SYMBOL (drm_framebuffer_init);
@@ -942,6 +963,12 @@ EXPORT_SYMBOL(drm_framebuffer_unregistervoid drm_framebuffer_cleanup (struct drm_framebuffer *fb) {struct drm_device *dev = fb->dev; +unsigned int i; + +for (i =0 ; i < fb->format->num_planes; i++) { +if (fb->internal_flags &DRM_FRAMEBUFFER_HAS_HANDLE_REF (i)) +drm_gem_object_handle_put_unlocked (fb->obj[i]); + }mutex_lock (&dev->mode_config.fb_lock);list_del (&fb->head);
drivers/gpu/drm/drm_gem.c +24 -14
@@ -197,23 +197,34 @@ static void drm_gem_object_handle_get(st }/** -* drm_gem_object_handle_get_unlocked - acquire reference on user-space handles +* drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any * @obj: GEM object * -* Acquires a reference on the GEM buffer object's handle. Required -* to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked() -* to release the reference. +* Acquires a reference on the GEM buffer object's handle. Required to keep +* the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked() +* to release the reference. Does nothing if the buffer object has no handle. +* +* Returns: +* True if a handle exists, or false otherwise */ -void drm_gem_object_handle_get_unlocked (struct drm_gem_object *obj) +bool drm_gem_object_handle_get_if_exists_unlocked (struct drm_gem_object *obj) {struct drm_device *dev = obj->dev;guard (mutex)(&dev->object_name_lock); -drm_WARN_ON (dev, !obj->handle_count);/* first ref taken in create-tail helper */ +/* +* First ref taken during GEM object creation, if any. Some +* drivers set up internal framebuffers with GEM objects that +* do not have a GEM handle. Hence, this counter can be zero. +*/ +if (!obj->handle_count) +return false; +drm_gem_object_handle_get (obj); + +return true; } -EXPORT_SYMBOL (drm_gem_object_handle_get_unlocked);/** * drm_gem_object_handle_free - release resources bound to userspace handles
@@ -246,7 +257,7 @@ static void drm_gem_object_exported_dma_ }/** -* drm_gem_object_handle_put_unlocked - releases reference on user-space handles +* drm_gem_object_handle_put_unlocked - releases reference on user-space handle * @obj: GEM object * * Releases a reference on the GEM buffer object's handle. Possibly releases
@@ -257,14 +268,14 @@ void drm_gem_object_handle_put_unlocked(struct drm_device *dev = obj->dev;bool final = false; -if (WARN_ON (READ_ONCE (obj->handle_count) ==0 )) +if (drm_WARN_ON (dev,READ_ONCE (obj->handle_count) ==0 ))return ;/* -* Must bump handle count first as this may be the last -* ref, in which case the object would disappear before we -* checked for a name -*/ +* Must bump handle count first as this may be the last +* ref, in which case the object would disappear before +* we checked for a name. +*/ mutex_lock (&dev->object_name_lock);if (--obj->handle_count ==0 ) {
@@ -277,7 +288,6 @@ void drm_gem_object_handle_put_unlocked(if (final)drm_gem_object_put (obj); } -EXPORT_SYMBOL (drm_gem_object_handle_put_unlocked);/* * Called at device or object close to release the file's
drivers/gpu/drm/drm_gem_framebuffer_helper.c +7 -9
@@ -99,7 +99,7 @@ void drm_gem_fb_destroy(struct drm_frameunsigned int i;for (i =0 ; i < fb->format->num_planes; i++) -drm_gem_object_handle_put_unlocked (fb->obj[i]); +drm_gem_object_put (fb->obj[i]);drm_framebuffer_cleanup (fb);kfree (fb);
@@ -182,10 +182,8 @@ int drm_gem_fb_init_with_funcs(struct drif (!objs[i]) {drm_dbg_kms (dev,"Failed to lookup GEM object\n" ); ret = -ENOENT ; - goto err_gem_object_handle_put_unlocked; + goto err_gem_object_put; } -drm_gem_object_handle_get_unlocked (objs[i]); -drm_gem_object_put (objs[i]); min_size = (height -1 ) * mode_cmd->pitches[i] +drm_format_info_min_pitch (info, i, width)
@@ -195,22 +193,22 @@ int drm_gem_fb_init_with_funcs(struct drdrm_dbg_kms (dev,"GEM object size (%zu) smaller than minimum size (%u) for plane %d\n" , objs[i]->size, min_size, i); -drm_gem_object_handle_put_unlocked (objs[i]); +drm_gem_object_put (objs[i]); ret = -EINVAL ; - goto err_gem_object_handle_put_unlocked; + goto err_gem_object_put; } } ret =drm_gem_fb_init (dev, fb, mode_cmd, objs, i, funcs);if (ret) - goto err_gem_object_handle_put_unlocked; + goto err_gem_object_put;return 0 ; -err_gem_object_handle_put_unlocked: +err_gem_object_put:while (i >0 ) { --i; -drm_gem_object_handle_put_unlocked (objs[i]); +drm_gem_object_put (objs[i]); }return ret; }
drivers/gpu/drm/drm_internal.h +1 -1
@@ -155,7 +155,7 @@ void drm_sysfs_lease_event(struct drm_de/* drm_gem.c */ int drm_gem_init (struct drm_device *dev); -void drm_gem_object_handle_get_unlocked (struct drm_gem_object *obj); +bool drm_gem_object_handle_get_if_exists_unlocked (struct drm_gem_object *obj);void drm_gem_object_handle_put_unlocked (struct drm_gem_object *obj); int drm_gem_handle_create_tail(struct drm_file *file_priv, struct drm_gem_object *obj,
include/drm/drm_framebuffer.h +7 -0
@@ -23,6 +23,7 @@#ifndef __DRM_FRAMEBUFFER_H__#define __DRM_FRAMEBUFFER_H__ +#include <linux/bits.h> #include <linux/ctype.h> #include <linux/list.h> #include <linux/sched.h>
@@ -100,6 +101,8 @@ struct drm_framebuffer_funcs { unsigned num_clips); }; +#define DRM_FRAMEBUFFER_HAS_HANDLE_REF (_i) BIT(0u + (_i)) +/** * struct drm_framebuffer - frame buffer object *
@@ -189,6 +192,10 @@ struct drm_framebuffer {*/ int flags;/** +* @internal_flags: Framebuffer flags like DRM_FRAMEBUFFER_HAS_HANDLE_REF. +*/ +unsigned int internal_flags; +/** * @hot_x: X coordinate of the cursor hotspot. Used by the legacy cursor * IOCTL when the driver supports cursor through a DRM_PLANE_TYPE_CURSOR * universal plane.
Greg Kroah-Hartman
maintainerPATCH 50/109 Revert "ACPI: battery: negate current when discharging"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit de1675de39aa945bad5937d1fde4df3682670639 upstream.
Revert commit 234f71555019 ("ACPI: battery: negate current when discharging") breaks not one but several userspace implementations of battery monitoring: Steam and MangoHud. Perhaps it breaks more, but those are the two that have been tested.
--- drivers/acpi/battery.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-)
drivers/acpi/battery.c +3 -16
@@ -243,23 +243,10 @@ static int acpi_battery_get_property(strbreak ;case POWER_SUPPLY_PROP_CURRENT_NOW :case POWER_SUPPLY_PROP_POWER_NOW : -if (battery->rate_now ==ACPI_BATTERY_VALUE_UNKNOWN ) { +if (battery->rate_now ==ACPI_BATTERY_VALUE_UNKNOWN ) ret = -ENODEV ; -break ; - } - - val->intval = battery->rate_now *1000 ; -/* -* When discharging, the current should be reported as a -* negative number as per the power supply class interface -* definition. -*/ -if (psp ==POWER_SUPPLY_PROP_CURRENT_NOW && - (battery->state &ACPI_BATTERY_STATE_DISCHARGING ) && -acpi_battery_handle_discharging (battery) - ==POWER_SUPPLY_STATUS_DISCHARGING ) - val->intval = -val->intval; - +else + val->intval = battery->rate_now *1000 ;break ;case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN :case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN :
Greg Kroah-Hartman
maintainerPATCH 51/109 kallsyms: fix build without execinfo
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Achill Gilgenast <[email protected]>
commit a95743b53031b015e8949e845a9f6fdfb2656347 upstream.
Some libc's like musl libc don't provide execinfo.h since it's not part of POSIX. In order to fix compilation on musl, only include execinfo.h if available (HAVE_BACKTRACE_SUPPORT)
This was discovered with c104c16073b7 ("Kunit to check the longest symbol length") which starts to include linux/kallsyms.h with Alpine Linux' configs.
--- tools/include/linux/kallsyms.h | 4 ++++ 1 file changed, 4 insertions(+)
tools/include/linux/kallsyms.h +4 -0
@@ -18,6 +18,7 @@ static inline const char *kallsyms_lookureturn NULL ; } +#ifdef HAVE_BACKTRACE_SUPPORT #include <execinfo.h> #include <stdlib.h> static inline void print_ip_sym (const char *loglvl,unsigned long ip)
@@ -30,5 +31,8 @@ static inline void print_ip_sym(const chfree (name); } +#else +static inline void print_ip_sym (const char *loglvl,unsigned long ip) {} +#endif #endif
Greg Kroah-Hartman
maintainerPATCH 52/109 maple_tree: fix mt_destroy_walk() on root leaf node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
commit ea9b77f98d94c4d5c1bd1ac1db078f78b40e8bf5 upstream.
On destroy, we should set each node dead. But current code miss this when the maple tree has only the root node.
The reason is mt_destroy_walk() leverage mte_destroy_descend() to set node dead, but this is skipped since the only root node is a leaf.
Fixes this by setting the node dead if it is a leaf.
--- lib/maple_tree.c | 1 + 1 file changed, 1 insertion(+)
lib/maple_tree.c +1 -0
@@ -5270,6 +5270,7 @@ static void mt_destroy_walk(struct maplestruct maple_enode *start;if (mte_is_leaf (enode)) { +mte_set_node_dead (enode); node->type =mte_node_type (enode); goto free_leaf; }
Greg Kroah-Hartman
maintainerPATCH 53/109 mm: fix the inaccurate memory statistics issue for users
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Wang <[email protected]>
commit 82241a83cd15aaaf28200a40ad1a8b480012edaf upstream.
On some large machines with a high number of CPUs running a 64K pagesize kernel, we found that the 'RES' field is always 0 displayed by the top command for some processes, which will cause a lot of confusion for users.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
875525 root 20 0 12480 0 0 R 0.3 0.0 0:00.08 top
1 root 20 0 172800 0 0 S 0.0 0.0 0:04.52 systemdThe main reason is that the batch size of the percpu counter is quite large on these machines, caching a significant percpu value, since converting mm's rss stats into percpu_counter by commit f1a7941243c1 ("mm:
convert mm's rss stats into percpu_counter"). Intuitively, the batch number should be optimized, but on some paths, performance may take precedence over statistical accuracy. Therefore, introducing a new interface to add the percpu statistical count and display it to users, which can remove the confusion. In addition, this change is not expected to be on a performance-critical path, so the modification should be acceptable.
In addition, the 'mm->rss_stat' is updated by using add_mm_counter() and dec/inc_mm_counter(), which are all wrappers around percpu_counter_add_batch(). In percpu_counter_add_batch(), there is percpu batch caching to avoid 'fbc->lock' contention. This patch changes task_mem() and task_statm() to get the accurate mm counters under the 'fbc->lock', but this should not exacerbate kernel 'mm->rss_stat' lock contention due to the percpu batch caching of the mm counters. The following test also confirm the theoretical analysis.
I run the stress-ng that stresses anon page faults in 32 threads on my 32 cores machine, while simultaneously running a script that starts 32 threads to busy-loop pread each stress-ng thread's /proc/pid/status interface. From the following data, I did not observe any obvious impact of this patch on the stress-ng tests.
w/o patch:
stress-ng: info: [6848] 4,399,219,085,152 CPU Cycles 67.327 B/sec
stress-ng: info: [6848] 1,616,524,844,832 Instructions 24.740 B/sec (0.367 instr. per cycle)
stress-ng: info: [6848] 39,529,792 Page Faults Total 0.605 M/sec
stress-ng: info: [6848] 39,529,792 Page Faults Minor 0.605 M/sec
w/patch:
stress-ng: info: [2485] 4,462,440,381,856 CPU Cycles 68.382 B/sec
stress-ng: info: [2485] 1,615,101,503,296 Instructions 24.750 B/sec (0.362 instr. per cycle)
stress-ng: info: [2485] 39,439,232 Page Faults Total 0.604 M/sec
stress-ng: info: [2485] 39,439,232 Page Faults Minor 0.604 M/sec
On comparing a very simple app which just allocates & touches some memory against v6.1 (which doesn't have f1a7941243c1) and latest Linus tree (4c06e63b9203) I can see that on latest Linus tree the values for VmRSS, RssAnon and RssFile from /proc/self/status are all zeroes while they do report values on v6.1 and a Linus tree with this patch.
Tested-by Donet Tom <[email protected]>
--- fs/proc/task_mmu.c | 14 +++++++------- include/linux/mm.h | 5 +++++ 2 files changed, 12 insertions(+), 7 deletions(-)
fs/proc/task_mmu.c +7 -7
@@ -33,9 +33,9 @@ void task_mem(struct seq_file *m, structunsigned long text, lib, swap, anon, file, shmem;unsigned long hiwater_vm, total_vm, hiwater_rss, total_rss; - anon =get_mm_counter (mm,MM_ANONPAGES ); - file =get_mm_counter (mm,MM_FILEPAGES ); - shmem =get_mm_counter (mm,MM_SHMEMPAGES ); + anon =get_mm_counter_sum (mm,MM_ANONPAGES ); + file =get_mm_counter_sum (mm,MM_FILEPAGES ); + shmem =get_mm_counter_sum (mm,MM_SHMEMPAGES );/* * Note: to minimize their overhead, mm maintains hiwater_vm and
@@ -56,7 +56,7 @@ void task_mem(struct seq_file *m, struct text =min (text, mm->exec_vm <<PAGE_SHIFT ); lib = (mm->exec_vm <<PAGE_SHIFT ) - text; - swap =get_mm_counter (mm,MM_SWAPENTS ); + swap =get_mm_counter_sum (mm,MM_SWAPENTS );SEQ_PUT_DEC ("VmPeak:\t" , hiwater_vm);SEQ_PUT_DEC (" kB\nVmSize:\t" , total_vm);SEQ_PUT_DEC (" kB\nVmLck:\t" , mm->locked_vm);
@@ -89,12 +89,12 @@ unsigned long task_statm(struct mm_struc unsigned long *shared, unsigned long *text, unsigned long *data, unsigned long *resident) { - *shared =get_mm_counter (mm,MM_FILEPAGES ) + -get_mm_counter (mm,MM_SHMEMPAGES ); + *shared =get_mm_counter_sum (mm,MM_FILEPAGES ) + +get_mm_counter_sum (mm,MM_SHMEMPAGES ); *text = (PAGE_ALIGN (mm->end_code) - (mm->start_code &PAGE_MASK )) >>PAGE_SHIFT ; *data = mm->data_vm + mm->stack_vm; - *resident = *shared +get_mm_counter (mm,MM_ANONPAGES ); + *resident = *shared +get_mm_counter_sum (mm,MM_ANONPAGES );return mm->total_vm; }
include/linux/mm.h +5 -0
@@ -2551,6 +2551,11 @@ static inline unsigned long get_mm_countreturn percpu_counter_read_positive (&mm->rss_stat[member]); } +static inline unsigned long get_mm_counter_sum (struct mm_struct *mm,int member) +{ +return percpu_counter_sum_positive (&mm->rss_stat[member]); +} +void mm_trace_rss_stat (struct mm_struct *mm,int member);static inline void add_mm_counter (struct mm_struct *mm,int member,long value)
Greg Kroah-Hartman
maintainerPATCH 54/109 scripts/gdb: fix interrupts display after MCP on x86
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit 7627b459aa0737bdd62a8591a1481cda467f20e3 upstream.
The text line would not be appended to as it should have, it should have been a '+=' but ended up being a '==', fix that.
--- scripts/gdb/linux/interrupts.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/gdb/linux/interrupts.py +1 -1
@@ -142,7 +142,7 @@ def x86_show_interupts(prec): if constants.LX_CONFIG_X86_MCE: text += x86_show_mce(prec, "&mce_exception_count", "MCE", "Machine check exceptions") - text == x86_show_mce(prec, "&mce_poll_count", "MCP", "Machine check polls") + text += x86_show_mce(prec, "&mce_poll_count", "MCP", "Machine check polls") text += show_irq_err_count(prec)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 55/109 scripts/gdb: de-reference per-CPU MCE interrupts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit 50f4d2ba26d5c3a4687ae0569be3bbf1c8f0cbed upstream.
The per-CPU MCE interrupts are looked up by reference and need to be de-referenced before printing, otherwise we print the addresses of the variables instead of their contents:
MCE: 18379471554386948492 Machine check exceptions
MCP: 18379471554386948488 Machine check polls
The corrected output looks like this instead now:
MCE: 0 Machine check exceptions MCP: 1 Machine check polls
--- scripts/gdb/linux/interrupts.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/gdb/linux/interrupts.py +1 -1
@@ -110,7 +110,7 @@ def x86_show_mce(prec, var, pfx, desc): pvar = gdb.parse_and_eval(var) text = "%*s: " % (prec, pfx) for cpu in cpus.each_online_cpu(): - text += "%10u " % (cpus.per_cpu(pvar, cpu)) + text += "%10u " % (cpus.per_cpu(pvar, cpu).dereference()) text += " %s\n" % (desc) return text
Greg Kroah-Hartman
maintainerPATCH 56/109 scripts/gdb: fix interrupts.py after maple tree conversion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit a02b0cde8ee515ee0c8efd33e7fbe6830c282e69 upstream.
In commit 721255b9826b ("genirq: Use a maple tree for interrupt descriptor management"), the irq_desc_tree was replaced with a sparse_irqs tree using a maple tree structure. Since the script looked for the irq_desc_tree symbol which is no longer available, no interrupts would be printed and the script output would not be useful anymore.
In addition to looking up the correct symbol (sparse_irqs), a new module (mapletree.py) is added whose mtree_load() implementation is largely copied after the C version and uses the same variable and intermediate function names wherever possible to ensure that both the C and Python version be updated in the future.
This restores the scripts' output to match that of /proc/interrupts.
--- scripts/gdb/linux/constants.py.in | 7 + scripts/gdb/linux/interrupts.py | 12 - scripts/gdb/linux/mapletree.py | 252 ++++++++++++++++++++++++++++++++++++++ scripts/gdb/linux/xarray.py | 28 ++++ 4 files changed, 293 insertions(+), 6 deletions(-) create mode 100644 scripts/gdb/linux/mapletree.py create mode 100644 scripts/gdb/linux/xarray.py
scripts/gdb/linux/constants.py.in +7 -0
@@ -20,6 +20,7 @@ #include <linux/of_fdt.h> #include <linux/page_ext.h> #include <linux/radix-tree.h> +#include <linux/maple_tree.h> #include <linux/slab.h> #include <linux/threads.h> #include <linux/vmalloc.h>
@@ -93,6 +94,12 @@ LX_GDBPARSED(RADIX_TREE_MAP_SIZE) LX_GDBPARSED(RADIX_TREE_MAP_SHIFT) LX_GDBPARSED(RADIX_TREE_MAP_MASK) +/* linux/maple_tree.h */ +LX_VALUE(MAPLE_NODE_SLOTS) +LX_VALUE(MAPLE_RANGE64_SLOTS) +LX_VALUE(MAPLE_ARANGE64_SLOTS) +LX_GDBPARSED(MAPLE_NODE_MASK) + /* linux/vmalloc.h */ LX_VALUE(VM_IOREMAP) LX_VALUE(VM_ALLOC)
scripts/gdb/linux/interrupts.py +6 -6
@@ -7,7 +7,7 @@ import gdb from linux import constants from linux import cpus from linux import utils -from linux import radixtree +from linux import mapletree irq_desc_type = utils.CachedType("struct irq_desc")
@@ -23,12 +23,12 @@ def irqd_is_level(desc): def show_irq_desc(prec, irq): text = "" - desc = radixtree.lookup(gdb.parse_and_eval("&irq_desc_tree"), irq) + desc = mapletree.mtree_load(gdb.parse_and_eval("&sparse_irqs"), irq) if desc is None: return text - desc = desc.cast(irq_desc_type.get_type()) - if desc is None: + desc = desc.cast(irq_desc_type.get_type().pointer()) + if desc == 0: return text if irq_settings_is_hidden(desc):
@@ -221,8 +221,8 @@ class LxInterruptList(gdb.Command): gdb.write("CPU%-8d" % cpu) gdb.write("\n") - if utils.gdb_eval_or_none("&irq_desc_tree") is None: - return + if utils.gdb_eval_or_none("&sparse_irqs") is None: + raise gdb.GdbError("Unable to find the sparse IRQ tree, is CONFIG_SPARSE_IRQ enabled?") for irq in range(nr_irqs): gdb.write(show_irq_desc(prec, irq))
scripts/gdb/linux/mapletree.py new file +252 -0
252 lines not on this page · raw message
scripts/gdb/linux/xarray.py new file +28 -0
@@ -0,0 +1,28 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# Xarray helpers +# +# Copyright (c) 2025 Broadcom +# +# Authors: +# Florian Fainelli <[email protected]> + +import gdb + +from linux import utils +from linux import constants + +def xa_is_internal(entry): + ulong_type = utils.get_ulong_type() + return ((entry.cast(ulong_type) & 3) == 2) + +def xa_mk_internal(v): + return ((v << 2) | 2) + +def xa_is_zero(entry): + ulong_type = utils.get_ulong_type() + return entry.cast(ulong_type) == xa_mk_internal(257) + +def xa_is_node(entry): + ulong_type = utils.get_ulong_type() + return xa_is_internal(entry) and (entry.cast(ulong_type) > 4096)
Greg Kroah-Hartman
maintainerPATCH 57/109 mm/vmalloc: leave lazy MMU mode on PTE mapping error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Gordeev <[email protected]>
commit fea18c686320a53fce7ad62a87a3e1d10ad02f31 upstream.
vmap_pages_pte_range() enters the lazy MMU mode, but fails to leave it in case an error is encountered.
--- mm/vmalloc.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
mm/vmalloc.c +15 -7
@@ -459,6 +459,7 @@ static int vmap_pages_pte_range(pmd_t *p unsigned long end, pgprot_t prot, struct page **pages, int *nr, pgtbl_mod_mask *mask) { + int err = 0;pte_t *pte;/*
@@ -472,18 +473,25 @@ static int vmap_pages_pte_range(pmd_t *pdo {struct page *page = pages[*nr]; -if (WARN_ON (!pte_none (ptep_get (pte)))) -return -EBUSY ; -if (WARN_ON (!page)) -return -ENOMEM ; -if (WARN_ON (!pfn_valid (page_to_pfn (page)))) -return -EINVAL ; +if (WARN_ON (!pte_none (ptep_get (pte)))) { + err = -EBUSY ; +break ; + } +if (WARN_ON (!page)) { + err = -ENOMEM ; +break ; + } +if (WARN_ON (!pfn_valid (page_to_pfn (page)))) { + err = -EINVAL ; +break ; + }set_pte_at (&init_mm, addr, pte,mk_pte (page, prot)); (*nr)++; }while (pte++, addr +=PAGE_SIZE , addr != end); *mask |=PGTBL_PTE_MODIFIED ; -return 0 ; + +return err; } static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,
Greg Kroah-Hartman
maintainerPATCH 58/109 pwm: mediatek: Ensure to disable clocks in error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit 505b730ede7f5c4083ff212aa955155b5b92e574 upstream.
After enabling the clocks each error path must disable the clocks again. One of them failed to do so. Unify the error paths to use goto to make it harder for future changes to add a similar bug.
--- drivers/pwm/pwm-mediatek.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/pwm/pwm-mediatek.c +8 -5
@@ -133,8 +133,10 @@ static int pwm_mediatek_config(struct pwreturn ret; clk_rate =clk_get_rate (pc->clk_pwms[pwm->hwpwm]); -if (!clk_rate) -return -EINVAL ; +if (!clk_rate) { + ret = -EINVAL ; + goto out; + }/* Make sure we use the bus clock and not the 26MHz clock */ if (pc->soc->has_ck_26m_sel)
@@ -153,9 +155,9 @@ static int pwm_mediatek_config(struct pw }if (clkdiv >PWM_CLK_DIV_MAX ) { -pwm_mediatek_clk_disable (chip, pwm);dev_err (chip->dev,"period of %d ns not supported\n" , period_ns); -return -EINVAL ; + ret = -EINVAL ; + goto out; }if (pc->soc->pwm45_fixup && pwm->hwpwm >2 ) {
@@ -172,9 +174,10 @@ static int pwm_mediatek_config(struct pwpwm_mediatek_writel (pc, pwm->hwpwm, reg_width, cnt_period);pwm_mediatek_writel (pc, pwm->hwpwm, reg_thres, cnt_duty); +out:pwm_mediatek_clk_disable (chip, pwm); -return 0 ; +return ret; }static int pwm_mediatek_enable (struct pwm_chip *chip,struct pwm_device *pwm)
Greg Kroah-Hartman
maintainerPATCH 59/109 x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Paulyshka <[email protected]>
commit 5b937a1ed64ebeba8876e398110a5790ad77407c upstream.
AMD Cyan Skillfish (Family 17h, Model 47h, Stepping 0h) has an error that causes RDSEED to always return 0xffffffff, while RDRAND works correctly.
Mask the RDSEED cap for this CPU so that both /proc/cpuinfo and direct CPUID read report RDSEED as unavailable.
[ bp: Move to amd.c, massage. ]
--- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/cpu/amd.c | 7 +++++++ tools/arch/x86/include/asm/msr-index.h | 1 + 3 files changed, 9 insertions(+)
arch/x86/include/asm/msr-index.h +1 -0
@@ -575,6 +575,7 @@#define MSR_AMD64_OSVW_STATUS 0xc0010141#define MSR_AMD_PPIN_CTL 0xc00102f0#define MSR_AMD_PPIN 0xc00102f1 +#define MSR_AMD64_CPUID_FN_7 0xc0011002#define MSR_AMD64_CPUID_FN_1 0xc0011004#define MSR_AMD64_LS_CFG 0xc0011020#define MSR_AMD64_DC_CFG 0xc0011022
arch/x86/kernel/cpu/amd.c +7 -0
@@ -1154,6 +1154,13 @@ static void init_amd_zen2(struct cpuinfo {fix_erratum_1386 (c);zen2_zenbleed_check (c); + +/* Disable RDSEED on AMD Cyan Skillfish because of an error. */ +if (c->x86_model ==0x47 && c->x86_stepping ==0x0 ) { +clear_cpu_cap (c,X86_FEATURE_RDSEED ); +msr_clear_bit (MSR_AMD64_CPUID_FN_7 ,18 ); +pr_emerg ("RDSEED is not reliable on this platform; disabling.\n" ); + } }static void init_amd_zen3 (struct cpuinfo_x86 *c)
tools/arch/x86/include/asm/msr-index.h +1 -0
@@ -550,6 +550,7 @@#define MSR_AMD64_OSVW_STATUS 0xc0010141#define MSR_AMD_PPIN_CTL 0xc00102f0#define MSR_AMD_PPIN 0xc00102f1 +#define MSR_AMD64_CPUID_FN_7 0xc0011002#define MSR_AMD64_CPUID_FN_1 0xc0011004#define MSR_AMD64_LS_CFG 0xc0011020#define MSR_AMD64_DC_CFG 0xc0011022
Greg Kroah-Hartman
maintainerPATCH 60/109 x86/mm: Disable hugetlb page table sharing on 32-bit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 76303ee8d54bff6d9a6d55997acd88a6c2ba63cf upstream.
Only select ARCH_WANT_HUGE_PMD_SHARE on 64-bit x86.
Page table sharing requires at least three levels because it involves shared references to PMD tables; 32-bit x86 has either two-level paging (without PAE) or three-level paging (with PAE), but even with three-level paging, having a dedicated PGD entry for hugetlb is only barely possible (because the PGD only has four entries), and it seems unlikely anyone's actually using PMD sharing on 32-bit.
Having ARCH_WANT_HUGE_PMD_SHARE enabled on non-PAE 32-bit X86 (which has 2-level paging) became particularly problematic after commit 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count"), since that changes struct ptdesc such that the pt_mm (for PGDs) and the pt_share_count (for PMDs) share the same union storage - and with 2-level paging, PMDs are PGDs.
(For comparison, arm64 also gates ARCH_WANT_HUGE_PMD_SHARE on the configuration of page tables such that it is never enabled with 2-level paging.)
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -128,7 +128,7 @@ config X86 select ARCH_WANTS_DYNAMIC_TASK_STRUCT select ARCH_WANTS_NO_INSTR select ARCH_WANT_GENERAL_HUGETLB - select ARCH_WANT_HUGE_PMD_SHARE + select ARCH_WANT_HUGE_PMD_SHARE if X86_64 select ARCH_WANT_LD_ORPHAN_WARN select ARCH_WANT_OPTIMIZE_DAX_VMEMMAP if X86_64 select ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP if X86_64
Greg Kroah-Hartman
maintainerPATCH 61/109 smb: server: make use of rdma_destroy_qp()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
commit 0c2b53997e8f5e2ec9e0fbd17ac0436466b65488 upstream.
The qp is created by rdma_create_qp() as t->cm_id->qp and t->qp is just a shortcut.
rdma_destroy_qp() also calls ib_destroy_qp(cm_id->qp) internally, but it is protected by a mutex, clears the cm_id and also calls trace_cm_qp_destroy().
This should make the tracing more useful as both rdma_create_qp() and rdma_destroy_qp() are traces and it makes the code look more sane as functions from the same layer are used for the specific qp object.
trace-cmd stream -e rdma_cma:cm_qp_create -e rdma_cma:cm_qp_destroy shows this now while doing a mount and unmount from a client:
<...>-80 [002] 378.514182: cm_qp_create: cm.id=1 src=172.31.9.167:5445 dst=172.31.9.166:37113 tos=0 pd.id=0 qp_type=RC send_wr=867 recv_wr=255 qp_num=1 rc=0
<...>-6283 [001] 381.686172: cm_qp_destroy: cm.id=1 src=172.31.9.167:5445 dst=172.31.9.166:37113 tos=0 qp_num=1
Before we only saw the first line.
--- fs/smb/server/transport_rdma.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/smb/server/transport_rdma.c +3 -2
@@ -426,7 +426,8 @@ static void free_transport(struct smb_diif (t->qp) {ib_drain_qp (t->qp);ib_mr_pool_destroy (t->qp, &t->qp->rdma_mrs); -ib_destroy_qp (t->qp); + t->qp =NULL ; +rdma_destroy_qp (t->cm_id); }ksmbd_debug (RDMA ,"drain the reassembly queue\n" );
@@ -1934,8 +1935,8 @@ static int smb_direct_create_qpair(strucreturn 0 ; err:if (t->qp) { -ib_destroy_qp (t->qp); t->qp =NULL ; +rdma_destroy_qp (t->cm_id); }if (t->recv_cq) {ib_destroy_cq (t->recv_cq);
Greg Kroah-Hartman
maintainerPATCH 62/109 ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 277627b431a0a6401635c416a21b2a0f77a77347 upstream.
If the call of ksmbd_vfs_lock_parent() fails, we drop the parent_path references and return an error. We need to drop the write access we just got on parent_path->mnt before we drop the mount reference - callers assume that ksmbd_vfs_kern_path_locked() returns with mount write access grabbed if and only if it has returned 0.
--- fs/smb/server/vfs.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/server/vfs.c +1 -0
@@ -1293,6 +1293,7 @@ out1: err =ksmbd_vfs_lock_parent (parent_path->dentry, path->dentry);if (err) { +mnt_drop_write (parent_path->mnt);path_put (path);path_put (parent_path); }
Greg Kroah-Hartman
maintainerPATCH 63/109 erofs: fix to add missing tracepoint in erofs_read_folio()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 99f7619a77a0a2e3e2bcae676d0f301769167754 upstream.
Commit 771c994ea51f ("erofs: convert all uncompressed cases to iomap") converts to use iomap interface, it removed trace_erofs_readpage() tracepoint in the meantime, let's add it back.
--- fs/erofs/data.c | 2 ++ 1 file changed, 2 insertions(+)
fs/erofs/data.c +2 -0
@@ -358,6 +358,8 @@ int erofs_fiemap(struct inode *inode, st*/ static int erofs_read_folio (struct file *file,struct folio *folio) { +trace_erofs_read_folio (folio, true); +return iomap_read_folio (folio, &erofs_iomap_ops); }
Greg Kroah-Hartman
maintainerPATCH 64/109 netlink: Fix rmem check in netlink_broadcast_deliver().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit a3c4a125ec725cefb40047eb05ff9eafd57830b4 upstream.
We need to allow queuing at least one skb even when skb is larger than sk->sk_rcvbuf.
The cited commit made a mistake while converting a condition in netlink_broadcast_deliver().
Let's correct the rmem check for the allow-one-skb rule.
--- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netlink/af_netlink.c +1 -1
@@ -1405,7 +1405,7 @@ static int netlink_broadcast_deliver(str rmem =atomic_add_return (skb->truesize, &sk->sk_rmem_alloc); rcvbuf =READ_ONCE (sk->sk_rcvbuf); -if ((rmem != skb->truesize || rmem <= rcvbuf) && +if ((rmem == skb->truesize || rmem <= rcvbuf) && !test_bit (NETLINK_S_CONGESTED , &nlk->state)) {netlink_skb_set_owner_r (skb, sk);__netlink_sendskb (sk, skb);
Greg Kroah-Hartman
maintainerPATCH 65/109 netlink: make sure we allow at least one dump skb
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
commit a215b5723922f8099078478122f02100e489cb80 upstream.
Commit under Fixes tightened up the memory accounting for Netlink sockets. Looks like the accounting is too strict for some existing use cases, Marek reported issues with nl80211 / WiFi iw CLI.
To reduce number of iterations Netlink dumps try to allocate messages based on the size of the buffer passed to previous recvmsg() calls. If user space uses a larger buffer in recvmsg() than sk_rcvbuf we will allocate an skb we won't be able to queue.
Make sure we always allow at least one skb to be queued. Same workaround is already present in netlink_attachskb(). Alternative would be to cap the allocation size to
rcvbuf - rmem_alloc
but as I said, the workaround is already present in other places.
--- net/netlink/af_netlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/netlink/af_netlink.c +3 -2
@@ -2199,11 +2199,11 @@ static int netlink_dump(struct sock *sk,struct netlink_ext_ack extack = {};struct netlink_callback *cb;struct sk_buff *skb =NULL ; +unsigned int rmem, rcvbuf;size_t max_recvmsg_len;struct module *module;int err = -ENOBUFS ;int alloc_min_size; -unsigned int rmem;int alloc_size;if (!lock_taken)
@@ -2235,8 +2235,9 @@ static int netlink_dump(struct sock *sk,if (!skb) goto errout_skb; + rcvbuf =READ_ONCE (sk->sk_rcvbuf); rmem =atomic_add_return (skb->truesize, &sk->sk_rmem_alloc); -if (rmem >=READ_ONCE (sk->sk_rcvbuf)) { +if (rmem != skb->truesize && rmem >= rcvbuf) {atomic_sub (skb->truesize, &sk->sk_rmem_alloc); goto errout_skb; }
Greg Kroah-Hartman
maintainerPATCH 66/109 btrfs: remove noinline from btrfs_update_inode()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit cddaaacca9339d2f13599a822dc2f68be71d2e0d ]
The noinline attribute of btrfs_update_inode() is pointless as the function is exported and widely used, so remove it.
Stable-dep-of: 5f61b961599a ("btrfs: fix inode lookup error handling during log replay")
--- fs/btrfs/inode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/btrfs/inode.c +3 -3
@@ -4014,9 +4014,9 @@ static noinline int btrfs_update_inode_item(struct btrfs_trans_handle *trans,/* * copy everything in the in-memory inode into the btree. */ -noinline int btrfs_update_inode(struct btrfs_trans_handle *trans, -struct btrfs_root *root, -struct btrfs_inode *inode) +int btrfs_update_inode (struct btrfs_trans_handle *trans, +struct btrfs_root *root, +struct btrfs_inode *inode) {struct btrfs_fs_info *fs_info = root->fs_info;int ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/109 btrfs: remove redundant root argument from btrfs_update_inode_fallback()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 0a5d0dc55fcb15da016fa28d27bf50ca7f17ec11 ]
The root argument for btrfs_update_inode_fallback() always matches the root of the given inode, so remove the root argument and get it from the inode argument.
Stable-dep-of: 5f61b961599a ("btrfs: fix inode lookup error handling during log replay")
--- fs/btrfs/btrfs_inode.h | 2 +- fs/btrfs/inode.c | 12 ++++++------ fs/btrfs/transaction.c | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-)
fs/btrfs/btrfs_inode.h +1 -1
@@ -488,7 +488,7 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,int btrfs_update_inode (struct btrfs_trans_handle *trans,struct btrfs_root *root,struct btrfs_inode *inode);int btrfs_update_inode_fallback (struct btrfs_trans_handle *trans, -struct btrfs_root *root,struct btrfs_inode *inode); +struct btrfs_inode *inode);int btrfs_orphan_add (struct btrfs_trans_handle *trans,struct btrfs_inode *inode);int btrfs_orphan_cleanup (struct btrfs_root *root);int btrfs_cont_expand (struct btrfs_inode *inode,loff_t oldsize,loff_t size);
fs/btrfs/inode.c +6 -6
@@ -3077,7 +3077,7 @@ int btrfs_finish_one_ordered(struct btrfs_ordered_extent *ordered_extent) goto out; } trans->block_rsv = &inode->block_rsv; - ret =btrfs_update_inode_fallback (trans, root, inode); + ret =btrfs_update_inode_fallback (trans, inode);if (ret)/* -ENOMEM or corruption */ btrfs_abort_transaction (trans, ret); goto out;
@@ -3143,7 +3143,7 @@ int btrfs_finish_one_ordered(struct btrfs_ordered_extent *ordered_extent) &cached_state);btrfs_inode_safe_disk_i_size_write (inode,0 ); - ret =btrfs_update_inode_fallback (trans, root, inode); + ret =btrfs_update_inode_fallback (trans, inode);if (ret) {/* -ENOMEM or corruption */ btrfs_abort_transaction (trans, ret); goto out;
@@ -4043,13 +4043,13 @@ int btrfs_update_inode(struct btrfs_trans_handle *trans, }int btrfs_update_inode_fallback (struct btrfs_trans_handle *trans, -struct btrfs_root *root,struct btrfs_inode *inode) +struct btrfs_inode *inode) {int ret; - ret =btrfs_update_inode (trans, root, inode); + ret =btrfs_update_inode (trans, inode->root, inode);if (ret == -ENOSPC ) -return btrfs_update_inode_item (trans, root, inode); +return btrfs_update_inode_item (trans, inode->root, inode);return ret; }
@@ -4327,7 +4327,7 @@ static int btrfs_unlink_subvol(struct btrfs_trans_handle *trans,btrfs_i_size_write (dir, dir->vfs_inode.i_size - fname.disk_name.len *2 );inode_inc_iversion (&dir->vfs_inode); dir->vfs_inode.i_mtime =inode_set_ctime_current (&dir->vfs_inode); - ret =btrfs_update_inode_fallback (trans, root, dir); + ret =btrfs_update_inode_fallback (trans, dir);if (ret)btrfs_abort_transaction (trans, ret); out:
fs/btrfs/transaction.c +1 -1
@@ -1860,7 +1860,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,btrfs_i_size_write (BTRFS_I (parent_inode), parent_inode->i_size + fname.disk_name.len *2 ); parent_inode->i_mtime =inode_set_ctime_current (parent_inode); - ret =btrfs_update_inode_fallback (trans, parent_root,BTRFS_I (parent_inode)); + ret =btrfs_update_inode_fallback (trans,BTRFS_I (parent_inode));if (ret) {btrfs_abort_transaction (trans, ret); goto fail;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/109 btrfs: remove redundant root argument from fixup_inode_link_count()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 8befc61cbba2d4567122d400542da8900a352971 ]
The root argument for fixup_inode_link_count() always matches the root of the given inode, so remove the root argument and get it from the inode argument. This also applies to the helpers count_inode_extrefs() and count_inode_refs() used by fixup_inode_link_count() - they don't need the root argument, as it always matches the root of the inode passed to them.
Stable-dep-of: 5f61b961599a ("btrfs: fix inode lookup error handling during log replay")
--- fs/btrfs/tree-log.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
fs/btrfs/tree-log.c +9 -11
@@ -1504,8 +1504,7 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,return ret; } -static int count_inode_extrefs (struct btrfs_root *root, -struct btrfs_inode *inode,struct btrfs_path *path) +static int count_inode_extrefs (struct btrfs_inode *inode,struct btrfs_path *path) {int ret =0 ;int name_len;
@@ -1519,8 +1518,8 @@ static int count_inode_extrefs(struct btrfs_root *root,struct extent_buffer *leaf;while (1 ) { - ret =btrfs_find_one_extref (root, inode_objectid, offset, path, - &extref, &offset); + ret =btrfs_find_one_extref (inode->root, inode_objectid, offset, + path, &extref, &offset);if (ret)break ;
@@ -1548,8 +1547,7 @@ static int count_inode_extrefs(struct btrfs_root *root,return nlink; } -static int count_inode_refs (struct btrfs_root *root, -struct btrfs_inode *inode,struct btrfs_path *path) +static int count_inode_refs (struct btrfs_inode *inode,struct btrfs_path *path) {int ret;struct btrfs_key key;
@@ -1564,7 +1562,7 @@ static int count_inode_refs(struct btrfs_root *root, key.offset = (u64)-1 ;while (1 ) { - ret =btrfs_search_slot (NULL , root, &key, path,0 ,0 ); + ret =btrfs_search_slot (NULL , inode->root, &key, path,0 ,0 );if (ret <0 )break ;if (ret >0 ) {
@@ -1616,9 +1614,9 @@ static int count_inode_refs(struct btrfs_root *root,* will free the inode. */ static noinline int fixup_inode_link_count(struct btrfs_trans_handle *trans, -struct btrfs_root *root,struct inode *inode) { +struct btrfs_root *root =BTRFS_I (inode)->root;struct btrfs_path *path;int ret;u64 nlink =0 ;
@@ -1628,13 +1626,13 @@ static noinline int fixup_inode_link_count(struct btrfs_trans_handle *trans,if (!path)return -ENOMEM ; - ret =count_inode_refs (root,BTRFS_I (inode), path); + ret =count_inode_refs (BTRFS_I (inode), path);if (ret <0 ) goto out; nlink = ret; - ret =count_inode_extrefs (root,BTRFS_I (inode), path); + ret =count_inode_extrefs (BTRFS_I (inode), path);if (ret <0 ) goto out;
@@ -1706,7 +1704,7 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans,break ; } - ret =fixup_inode_link_count (trans, root, inode); + ret =fixup_inode_link_count (trans, inode);iput (inode);if (ret)break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/109 btrfs: return a btrfs_inode from btrfs_iget_logging()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit a488d8ac2c4d96ecc7da59bb35a573277204ac6b ]
All callers of btrfs_iget_logging() are interested in the btrfs_inode structure rather than the VFS inode, so make btrfs_iget_logging() return the btrfs_inode instead, avoiding lots of BTRFS_I() calls.
Stable-dep-of: 5f61b961599a ("btrfs: fix inode lookup error handling during log replay")
--- fs/btrfs/tree-log.c | 94 ++++++++++++++++++++++----------------------- 1 file changed, 45 insertions(+), 49 deletions(-)
fs/btrfs/tree-log.c +45 -49
@@ -140,7 +140,7 @@ static void wait_log_commit(struct btrfs_root *root, int transid);* and once to do all the other items. */ -static struct inode *btrfs_iget_logging (u64 objectid,struct btrfs_root *root) +static struct btrfs_inode *btrfs_iget_logging (u64 objectid,struct btrfs_root *root) {unsigned int nofs_flag;struct inode *inode;
@@ -156,7 +156,10 @@ static struct inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *root) inode =btrfs_iget (root->fs_info->sb, objectid, root);memalloc_nofs_restore (nofs_flag); -return inode; +if (IS_ERR (inode)) +return ERR_CAST (inode); + +return BTRFS_I (inode); }/*
@@ -620,12 +623,12 @@ static int read_alloc_one_name(struct extent_buffer *eb, void *start, int len, static noinline struct inode *read_one_inode(struct btrfs_root *root,u64 objectid) { -struct inode *inode; +struct btrfs_inode *inode; inode =btrfs_iget_logging (objectid, root);if (IS_ERR (inode)) - inode =NULL ; -return inode; +return NULL ; +return &inode->vfs_inode; }/* replays a single extent in 'eb' at 'slot' with 'key' into the
@@ -5419,7 +5422,6 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans,ihold (&curr_inode->vfs_inode);while (true) { -struct inode *vfs_inode;struct btrfs_key key;struct btrfs_key found_key;u64 next_index;
@@ -5435,7 +5437,7 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans,struct extent_buffer *leaf = path->nodes[0 ];struct btrfs_dir_item *di;struct btrfs_key di_key; -struct inode *di_inode; +struct btrfs_inode *di_inode;int log_mode =LOG_INODE_EXISTS ;int type;
@@ -5462,17 +5464,16 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, goto out; } -if (!need_log_inode (trans,BTRFS_I (di_inode))) { -btrfs_add_delayed_iput (BTRFS_I (di_inode)); +if (!need_log_inode (trans, di_inode)) { +btrfs_add_delayed_iput (di_inode);break ; } ctx->log_new_dentries = false;if (type ==BTRFS_FT_DIR ) log_mode =LOG_INODE_ALL ; - ret =btrfs_log_inode (trans,BTRFS_I (di_inode), - log_mode, ctx); -btrfs_add_delayed_iput (BTRFS_I (di_inode)); + ret =btrfs_log_inode (trans, di_inode, log_mode, ctx); +btrfs_add_delayed_iput (di_inode);if (ret) goto out;if (ctx->log_new_dentries) {
@@ -5514,14 +5515,13 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans,kfree (dir_elem);btrfs_add_delayed_iput (curr_inode); - curr_inode =NULL ; - vfs_inode =btrfs_iget_logging (ino, root); -if (IS_ERR (vfs_inode)) { - ret =PTR_ERR (vfs_inode); + curr_inode =btrfs_iget_logging (ino, root); +if (IS_ERR (curr_inode)) { + ret =PTR_ERR (curr_inode); + curr_inode =NULL ;break ; } - curr_inode =BTRFS_I (vfs_inode); } out:btrfs_free_path (path);
@@ -5599,7 +5599,7 @@ static int add_conflicting_inode(struct btrfs_trans_handle *trans, struct btrfs_log_ctx *ctx) {struct btrfs_ino_list *ino_elem; -struct inode *inode; +struct btrfs_inode *inode;/* * It's rare to have a lot of conflicting inodes, in practice it is not
@@ -5690,12 +5690,12 @@ static int add_conflicting_inode(struct btrfs_trans_handle *trans,* inode in LOG_INODE_EXISTS mode and rename operations update the log, * so that the log ends up with the new name and without the old name. */ -if (!need_log_inode (trans,BTRFS_I (inode))) { -btrfs_add_delayed_iput (BTRFS_I (inode)); +if (!need_log_inode (trans, inode)) { +btrfs_add_delayed_iput (inode);return 0 ; } -btrfs_add_delayed_iput (BTRFS_I (inode)); +btrfs_add_delayed_iput (inode); ino_elem =kmalloc (sizeof (*ino_elem),GFP_NOFS );if (!ino_elem)
@@ -5731,7 +5731,7 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans,*/ while (!list_empty (&ctx->conflict_inodes)) {struct btrfs_ino_list *curr; -struct inode *inode; +struct btrfs_inode *inode;u64 ino;u64 parent;
@@ -5767,9 +5767,8 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans,* dir index key range logged for the directory. So we * must make sure the deletion is recorded. */ - ret =btrfs_log_inode (trans,BTRFS_I (inode), -LOG_INODE_ALL , ctx); -btrfs_add_delayed_iput (BTRFS_I (inode)); + ret =btrfs_log_inode (trans, inode,LOG_INODE_ALL , ctx); +btrfs_add_delayed_iput (inode);if (ret)break ;continue ;
@@ -5785,8 +5784,8 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans,* it again because if some other task logged the inode after * that, we can avoid doing it again. */ -if (!need_log_inode (trans,BTRFS_I (inode))) { -btrfs_add_delayed_iput (BTRFS_I (inode)); +if (!need_log_inode (trans, inode)) { +btrfs_add_delayed_iput (inode);continue ; }
@@ -5797,8 +5796,8 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans,* well because during a rename we pin the log and update the * log with the new name before we unpin it. */ - ret =btrfs_log_inode (trans,BTRFS_I (inode),LOG_INODE_EXISTS , ctx); -btrfs_add_delayed_iput (BTRFS_I (inode)); + ret =btrfs_log_inode (trans, inode,LOG_INODE_EXISTS , ctx); +btrfs_add_delayed_iput (inode);if (ret)break ; }
@@ -6290,7 +6289,7 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans,list_for_each_entry (item, delayed_ins_list, log_list) {struct btrfs_dir_item *dir_item; -struct inode *di_inode; +struct btrfs_inode *di_inode;struct btrfs_key key;int log_mode =LOG_INODE_EXISTS ;
@@ -6306,8 +6305,8 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans,break ; } -if (!need_log_inode (trans,BTRFS_I (di_inode))) { -btrfs_add_delayed_iput (BTRFS_I (di_inode)); +if (!need_log_inode (trans, di_inode)) { +btrfs_add_delayed_iput (di_inode);continue ; }
@@ -6315,12 +6314,12 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans, log_mode =LOG_INODE_ALL ; ctx->log_new_dentries = false; - ret =btrfs_log_inode (trans,BTRFS_I (di_inode), log_mode, ctx); + ret =btrfs_log_inode (trans, di_inode, log_mode, ctx);if (!ret && ctx->log_new_dentries) - ret =log_new_dir_dentries (trans,BTRFS_I (di_inode), ctx); + ret =log_new_dir_dentries (trans, di_inode, ctx); -btrfs_add_delayed_iput (BTRFS_I (di_inode)); +btrfs_add_delayed_iput (di_inode);if (ret)break ;
@@ -6728,7 +6727,7 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, ptr =btrfs_item_ptr_offset (leaf, slot);while (cur_offset < item_size) {struct btrfs_key inode_key; -struct inode *dir_inode; +struct btrfs_inode *dir_inode; inode_key.type =BTRFS_INODE_ITEM_KEY ; inode_key.offset =0 ;
@@ -6777,18 +6776,16 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, goto out; } -if (!need_log_inode (trans,BTRFS_I (dir_inode))) { -btrfs_add_delayed_iput (BTRFS_I (dir_inode)); +if (!need_log_inode (trans, dir_inode)) { +btrfs_add_delayed_iput (dir_inode);continue ; } ctx->log_new_dentries = false; - ret =btrfs_log_inode (trans,BTRFS_I (dir_inode), -LOG_INODE_ALL , ctx); + ret =btrfs_log_inode (trans, dir_inode,LOG_INODE_ALL , ctx);if (!ret && ctx->log_new_dentries) - ret =log_new_dir_dentries (trans, -BTRFS_I (dir_inode), ctx); -btrfs_add_delayed_iput (BTRFS_I (dir_inode)); + ret =log_new_dir_dentries (trans, dir_inode, ctx); +btrfs_add_delayed_iput (dir_inode);if (ret) goto out; }
@@ -6813,7 +6810,7 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans,struct extent_buffer *leaf;int slot;struct btrfs_key search_key; -struct inode *inode; +struct btrfs_inode *inode;u64 ino;int ret =0 ;
@@ -6828,11 +6825,10 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans,if (IS_ERR (inode))return PTR_ERR (inode); -if (BTRFS_I (inode)->generation >= trans->transid && -need_log_inode (trans,BTRFS_I (inode))) - ret =btrfs_log_inode (trans,BTRFS_I (inode), -LOG_INODE_EXISTS , ctx); -btrfs_add_delayed_iput (BTRFS_I (inode)); +if (inode->generation >= trans->transid && +need_log_inode (trans, inode)) + ret =btrfs_log_inode (trans, inode,LOG_INODE_EXISTS , ctx); +btrfs_add_delayed_iput (inode);if (ret)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/109 btrfs: fix inode lookup error handling during log replay
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 5f61b961599acbd2bed028d3089105a1f7d224b8 ]
When replaying log trees we use read_one_inode() to get an inode, which is just a wrapper around btrfs_iget_logging(), which in turn is a wrapper for btrfs_iget(). But read_one_inode() always returns NULL for any error that btrfs_iget_logging() / btrfs_iget() may return and this is a problem because:
1) In many callers of read_one_inode() we convert the NULL into -EIO, which is not accurate since btrfs_iget() may return -ENOMEM and -ENOENT for example, besides -EIO and other errors. So during log replay we may end up reporting a false -EIO, which is confusing since we may not have had any IO error at all;
2) When replaying directory deletes, at replay_dir_deletes(), we assume the NULL returned from read_one_inode() means that the inode doesn't exist and then proceed as if no error had happened. This is wrong because unless btrfs_iget() returned ERR_PTR(-ENOENT), we had an actual error and the target inode may exist in the target subvolume root - this may later result in the log replay code failing at a later stage (if we are "lucky") or succeed but leaving some inconsistency in the filesystem.
So fix this by not ignoring errors from btrfs_iget_logging() and as a consequence remove the read_one_inode() wrapper and just use btrfs_iget_logging() directly. Also since btrfs_iget_logging() is supposed to be called only against subvolume roots, just like read_one_inode() which had a comment about it, add an assertion to btrfs_iget_logging() to check that the target root corresponds to a subvolume root.
--- fs/btrfs/tree-log.c | 223 +++++++++++++++++++++++++++++--------------- 1 file changed, 146 insertions(+), 77 deletions(-)
fs/btrfs/tree-log.c +146 -77
@@ -145,6 +145,9 @@ static struct btrfs_inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *runsigned int nofs_flag;struct inode *inode; +/* Only meant to be called for subvolume roots and not for log roots. */ +ASSERT (is_fstree (btrfs_root_id (root))); +/* * We're holding a transaction handle whether we are logging or * replaying a log tree, so we must make sure NOFS semantics apply
@@ -616,20 +619,6 @@ static int read_alloc_one_name(struct extent_buffer *eb, void *start, int len,return 0 ; } -/* -* simple helper to read an inode off the disk from a given root -* This can only be called for subvolume roots and not for the log -*/ -static noinline struct inode *read_one_inode(struct btrfs_root *root, -u64 objectid) -{ -struct btrfs_inode *inode; - - inode =btrfs_iget_logging (objectid, root); -if (IS_ERR (inode)) -return NULL ; -return &inode->vfs_inode; -}/* replays a single extent in 'eb' at 'slot' with 'key' into the * subvolume 'root'. path is released on entry and should be released
@@ -684,10 +673,15 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans, goto out; } - inode =read_one_inode (root, key->objectid); -if (!inode) { - ret = -EIO ; - goto out; + { +struct btrfs_inode *btrfs_inode; + + btrfs_inode =btrfs_iget_logging (key->objectid, root); +if (IS_ERR (btrfs_inode)) { + ret =PTR_ERR (btrfs_inode); + goto out; + } + inode = &btrfs_inode->vfs_inode; }/*
@@ -966,10 +960,16 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans,btrfs_release_path (path); - inode =read_one_inode (root, location.objectid); -if (!inode) { - ret = -EIO ; - goto out; + { +struct btrfs_inode *btrfs_inode; + + btrfs_inode =btrfs_iget_logging (location.objectid, root); +if (IS_ERR (btrfs_inode)) { + ret =PTR_ERR (btrfs_inode); + inode =NULL ; + goto out; + } + inode = &btrfs_inode->vfs_inode; } ret =link_to_fixup_dir (trans, root, path, location.objectid);
@@ -1186,18 +1186,21 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans,kfree (victim_name.name);return ret; }else if (!ret) { - ret = -ENOENT ; - victim_parent =read_one_inode (root, - parent_objectid); -if (victim_parent) { +struct btrfs_inode *btrfs_victim; + + btrfs_victim =btrfs_iget_logging (parent_objectid, root); +if (IS_ERR (btrfs_victim)) { + ret =PTR_ERR (btrfs_victim); + }else { + victim_parent = &btrfs_victim->vfs_inode;inc_nlink (&inode->vfs_inode);btrfs_release_path (path); ret =unlink_inode_for_log_replay (trans,BTRFS_I (victim_parent), inode, &victim_name); +iput (victim_parent); } -iput (victim_parent);kfree (victim_name.name);if (ret)return ret;
@@ -1334,11 +1337,16 @@ static int unlink_old_inode_refs(struct btrfs_trans_handle *trans,struct inode *dir;btrfs_release_path (path); - dir =read_one_inode (root, parent_id); -if (!dir) { - ret = -ENOENT ; -kfree (name.name); - goto out; + { +struct btrfs_inode *btrfs_dir; + + btrfs_dir =btrfs_iget_logging (parent_id, root); +if (IS_ERR (btrfs_dir)) { + ret =PTR_ERR (btrfs_dir); +kfree (name.name); + goto out; + } + dir = &btrfs_dir->vfs_inode; } ret =unlink_inode_for_log_replay (trans,BTRFS_I (dir), inode, &name);
@@ -1409,16 +1417,28 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,* copy the back ref in. The link count fixup code will take * care of the rest */ - dir =read_one_inode (root, parent_objectid); -if (!dir) { - ret = -ENOENT ; - goto out; + { +struct btrfs_inode *btrfs_dir; + + btrfs_dir =btrfs_iget_logging (parent_objectid, root); +if (IS_ERR (btrfs_dir)) { + ret =PTR_ERR (btrfs_dir); + dir =NULL ; + goto out; + } + dir = &btrfs_dir->vfs_inode; } - inode =read_one_inode (root, inode_objectid); -if (!inode) { - ret = -EIO ; - goto out; + { +struct btrfs_inode *btrfs_inode; + + btrfs_inode =btrfs_iget_logging (inode_objectid, root); +if (IS_ERR (btrfs_inode)) { + ret =PTR_ERR (btrfs_inode); + inode =NULL ; + goto out; + } + inode = &btrfs_inode->vfs_inode; }while (ref_ptr < ref_end) {
@@ -1429,11 +1449,16 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,* parent object can change from one array * item to another. */ -if (!dir) - dir =read_one_inode (root, parent_objectid);if (!dir) { - ret = -ENOENT ; - goto out; +struct btrfs_inode *btrfs_dir; + + btrfs_dir =btrfs_iget_logging (parent_objectid, root); +if (IS_ERR (btrfs_dir)) { + ret =PTR_ERR (btrfs_dir); + dir =NULL ; + goto out; + } + dir = &btrfs_dir->vfs_inode; } }else { ret =ref_get_fields (eb, ref_ptr, &name, &ref_index);
@@ -1701,10 +1726,15 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans,break ;btrfs_release_path (path); - inode =read_one_inode (root, key.offset); -if (!inode) { - ret = -EIO ; -break ; + { +struct btrfs_inode *btrfs_inode; + + btrfs_inode =btrfs_iget_logging (key.offset, root); +if (IS_ERR (btrfs_inode)) { + ret =PTR_ERR (btrfs_inode); +break ; + } + inode = &btrfs_inode->vfs_inode; } ret =fixup_inode_link_count (trans, inode);
@@ -1738,9 +1768,14 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans,int ret =0 ;struct inode *inode; - inode =read_one_inode (root, objectid); -if (!inode) -return -EIO ; + { +struct btrfs_inode *btrfs_inode; + + btrfs_inode =btrfs_iget_logging (objectid, root); +if (IS_ERR (btrfs_inode)) +return PTR_ERR (btrfs_inode); + inode = &btrfs_inode->vfs_inode; + } key.objectid =BTRFS_TREE_LOG_FIXUP_OBJECTID ; key.type =BTRFS_ORPHAN_ITEM_KEY ;
@@ -1778,14 +1813,24 @@ static noinline int insert_one_name(struct btrfs_trans_handle *trans,struct inode *dir;int ret; - inode =read_one_inode (root, location->objectid); -if (!inode) -return -ENOENT ; + { +struct btrfs_inode *btrfs_inode; - dir =read_one_inode (root, dirid); -if (!dir) { -iput (inode); -return -EIO ; + btrfs_inode =btrfs_iget_logging (location->objectid, root); +if (IS_ERR (btrfs_inode)) +return PTR_ERR (btrfs_inode); + inode = &btrfs_inode->vfs_inode; + } + + { +struct btrfs_inode *btrfs_dir; + + btrfs_dir =btrfs_iget_logging (dirid, root); +if (IS_ERR (btrfs_dir)) { +iput (inode); +return PTR_ERR (btrfs_dir); + } + dir = &btrfs_dir->vfs_inode; } ret = btrfs_add_link(trans, BTRFS_I(dir), BTRFS_I(inode), name,
@@ -1863,9 +1908,14 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,bool update_size = true;bool name_added = false; - dir =read_one_inode (root, key->objectid); -if (!dir) -return -EIO ; + { +struct btrfs_inode *btrfs_dir; + + btrfs_dir =btrfs_iget_logging (key->objectid, root); +if (IS_ERR (btrfs_dir)) +return PTR_ERR (btrfs_dir); + dir = &btrfs_dir->vfs_inode; + } ret =read_alloc_one_name (eb, di +1 ,btrfs_dir_name_len (eb, di), &name);if (ret)
@@ -2167,10 +2217,16 @@ static noinline int check_item_in_log(struct btrfs_trans_handle *trans,btrfs_dir_item_key_to_cpu (eb, di, &location);btrfs_release_path (path);btrfs_release_path (log_path); - inode =read_one_inode (root, location.objectid); -if (!inode) { - ret = -EIO ; - goto out; + { +struct btrfs_inode *btrfs_inode; + + btrfs_inode =btrfs_iget_logging (location.objectid, root); +if (IS_ERR (btrfs_inode)) { + ret =PTR_ERR (btrfs_inode); + inode =NULL ; + goto out; + } + inode = &btrfs_inode->vfs_inode; } ret =link_to_fixup_dir (trans, root, path, location.objectid);
@@ -2321,14 +2377,22 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans,if (!log_path)return -ENOMEM ; - dir =read_one_inode (root, dirid); -/* it isn't an error if the inode isn't there, that can happen -* because we replay the deletes before we copy in the inode item -* from the log -*/ -if (!dir) { -btrfs_free_path (log_path); -return 0 ; + { +struct btrfs_inode *btrfs_dir; + + btrfs_dir =btrfs_iget_logging (dirid, root); +/* +* It isn't an error if the inode isn't there, that can happen because +* we replay the deletes before we copy in the inode item from the log. +*/ +if (IS_ERR (btrfs_dir)) { +btrfs_free_path (log_path); + ret =PTR_ERR (btrfs_dir); +if (ret == -ENOENT ) + ret =0 ; +return ret; + } + dir = &btrfs_dir->vfs_inode; } range_start =0 ;
@@ -2487,10 +2551,15 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,struct inode *inode;u64 from; - inode =read_one_inode (root, key.objectid); -if (!inode) { - ret = -EIO ; -break ; + { +struct btrfs_inode *btrfs_inode; + + btrfs_inode =btrfs_iget_logging (key.objectid, root); +if (IS_ERR (btrfs_inode)) { + ret =PTR_ERR (btrfs_inode); +break ; + } + inode = &btrfs_inode->vfs_inode; } from =ALIGN (i_size_read (inode), root->fs_info->sectorsize);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/109 usb:cdnsp: remove TRB_FLUSH_ENDPOINT command
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Laszczak <[email protected]>
[ Upstream commit 2998874736bca1031ca84b0a3235a2cd09dfa426 ]
Patch removes TRB_FLUSH_ENDPOINT command from driver. This command is not supported by controller and USBSSP returns TRB Error completion code for it.
Stable-dep-of: 2831a81077f5 ("usb: cdnsp: Fix issue with CV Bad Descriptor test")
--- drivers/usb/cdns3/cdnsp-debug.h | 3 --- drivers/usb/cdns3/cdnsp-gadget.c | 6 +----- drivers/usb/cdns3/cdnsp-gadget.h | 5 ----- drivers/usb/cdns3/cdnsp-ring.c | 24 ------------------------ 4 files changed, 1 insertion(+), 37 deletions(-)
drivers/usb/cdns3/cdnsp-debug.h +0 -3
@@ -131,8 +131,6 @@ static inline const char *cdnsp_trb_type_string(u8 type)return "Endpoint Not ready" ;case TRB_HALT_ENDPOINT :return "Halt Endpoint" ; -case TRB_FLUSH_ENDPOINT : -return "FLush Endpoint" ;default :return "UNKNOWN" ; }
@@ -328,7 +326,6 @@ static inline const char *cdnsp_decode_trb(char *str, size_t size, u32 field0,break ;case TRB_RESET_EP :case TRB_HALT_ENDPOINT : -case TRB_FLUSH_ENDPOINT : ret = snprintf(str, size, "%s: ep%d%s(%d) ctx %08x%08x slot %ld flags %c", cdnsp_trb_type_string(type),
drivers/usb/cdns3/cdnsp-gadget.c +1 -5
@@ -1061,10 +1061,8 @@ static int cdnsp_gadget_ep_disable(struct usb_ep *ep) pep->ep_state |=EP_DIS_IN_RROGRESS ;/* Endpoint was unconfigured by Reset Device command. */ -if (!(pep->ep_state &EP_UNCONFIGURED )) { +if (!(pep->ep_state &EP_UNCONFIGURED ))cdnsp_cmd_stop_ep (pdev, pep); -cdnsp_cmd_flush_ep (pdev, pep); - }/* Remove all queued USB requests. */ while (!list_empty (&pep->pending_list)) {
@@ -1461,8 +1459,6 @@ static void cdnsp_stop(struct cdnsp_device *pdev) {u32 temp; -cdnsp_cmd_flush_ep (pdev, &pdev->eps[0 ]); -/* Remove internally queued request for ep0. */ if (!list_empty (&pdev->eps[0 ].pending_list)) {struct cdnsp_request *req;
drivers/usb/cdns3/cdnsp-gadget.h +0 -5
@@ -1138,8 +1138,6 @@ union cdnsp_trb {#define TRB_HALT_ENDPOINT 54/* Doorbell Overflow Event. */ #define TRB_DRB_OVERFLOW 57 -/* Flush Endpoint Command. */ -#define TRB_FLUSH_ENDPOINT 58#define TRB_TYPE_LINK (x) (((x) & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK))#define TRB_TYPE_LINK_LE32 (x) (((x) & cpu_to_le32(TRB_TYPE_BITMASK)) == \
@@ -1552,8 +1550,6 @@ void cdnsp_queue_configure_endpoint(struct cdnsp_device *pdev,void cdnsp_queue_reset_ep (struct cdnsp_device *pdev,unsigned int ep_index);void cdnsp_queue_halt_endpoint (struct cdnsp_device *pdev,unsigned int ep_index); -void cdnsp_queue_flush_endpoint (struct cdnsp_device *pdev, -unsigned int ep_index);void cdnsp_force_header_wakeup (struct cdnsp_device *pdev,int intf_num);void cdnsp_queue_reset_device (struct cdnsp_device *pdev); void cdnsp_queue_new_dequeue_state(struct cdnsp_device *pdev,
@@ -1587,7 +1583,6 @@ void cdnsp_irq_reset(struct cdnsp_device *pdev);int cdnsp_halt_endpoint (struct cdnsp_device *pdev,struct cdnsp_ep *pep,int value);int cdnsp_cmd_stop_ep (struct cdnsp_device *pdev,struct cdnsp_ep *pep); -int cdnsp_cmd_flush_ep (struct cdnsp_device *pdev,struct cdnsp_ep *pep);void cdnsp_setup_analyze (struct cdnsp_device *pdev);int cdnsp_status_stage (struct cdnsp_device *pdev);int cdnsp_reset_device (struct cdnsp_device *pdev);
drivers/usb/cdns3/cdnsp-ring.c +0 -24
@@ -2159,19 +2159,6 @@ int cdnsp_cmd_stop_ep(struct cdnsp_device *pdev, struct cdnsp_ep *pep)return ret; } -int cdnsp_cmd_flush_ep (struct cdnsp_device *pdev,struct cdnsp_ep *pep) -{ -int ret; - -cdnsp_queue_flush_endpoint (pdev, pep->idx); -cdnsp_ring_cmd_db (pdev); - ret =cdnsp_wait_for_cmd_compl (pdev); - -trace_cdnsp_handle_cmd_flush_ep (pep->out_ctx); - -return ret; -} -/* * The transfer burst count field of the isochronous TRB defines the number of * bursts that are required to move all packets in this TD. Only SuperSpeed
@@ -2501,17 +2488,6 @@ void cdnsp_queue_halt_endpoint(struct cdnsp_device *pdev, unsigned int ep_index) EP_ID_FOR_TRB(ep_index)); } -/* -* Queue a flush endpoint request on the command ring. -*/ -void cdnsp_queue_flush_endpoint (struct cdnsp_device *pdev, -unsigned int ep_index) -{ -cdnsp_queue_command (pdev,0 ,0 ,0 ,TRB_TYPE (TRB_FLUSH_ENDPOINT ) | -SLOT_ID_FOR_TRB (pdev->slot_id) | -EP_ID_FOR_TRB (ep_index)); -} -void cdnsp_force_header_wakeup (struct cdnsp_device *pdev,int intf_num) {u32 lo, mid;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/109 usb: cdnsp: Replace snprintf() with the safer scnprintf() variant
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit b385ef088c7aab20a2c0dc20d390d69a6620f0f3 ]
There is a general misunderstanding amongst engineers that {v}snprintf() returns the length of the data *actually* encoded into the destination array. However, as per the C99 standard {v}snprintf() really returns the length of the data that *would have been* written if there were enough space for it. This misunderstanding has led to buffer-overruns in the past. It's generally considered safer to use the {v}scnprintf() variants in their place (or even sprintf() in simple cases). So let's do that.
The uses in this file all seem to assume that data *has been* written!
Stable-dep-of: 2831a81077f5 ("usb: cdnsp: Fix issue with CV Bad Descriptor test")
--- drivers/usb/cdns3/cdnsp-debug.h | 354 ++++++++++++++++---------------- 1 file changed, 177 insertions(+), 177 deletions(-)
drivers/usb/cdns3/cdnsp-debug.h +177 -177
@@ -187,202 +187,202 @@ static inline const char *cdnsp_decode_trb(char *str, size_t size, u32 field0,switch (type) {case TRB_LINK : - ret =snprintf (str, size, -"LINK %08x%08x intr %ld type '%s' flags %c:%c:%c:%c" , - field1, field0,GET_INTR_TARGET (field2), -cdnsp_trb_type_string (type), - field3 &TRB_IOC ?'I' :'i' , - field3 &TRB_CHAIN ?'C' :'c' , - field3 &TRB_TC ?'T' :'t' , - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"LINK %08x%08x intr %ld type '%s' flags %c:%c:%c:%c" , + field1, field0,GET_INTR_TARGET (field2), +cdnsp_trb_type_string (type), + field3 &TRB_IOC ?'I' :'i' , + field3 &TRB_CHAIN ?'C' :'c' , + field3 &TRB_TC ?'T' :'t' , + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_TRANSFER :case TRB_COMPLETION :case TRB_PORT_STATUS :case TRB_HC_EVENT : - ret =snprintf (str, size, -"ep%d%s(%d) type '%s' TRB %08x%08x status '%s'" -" len %ld slot %ld flags %c:%c" , - ep_num, ep_id %2 ?"out" :"in" , -TRB_TO_EP_INDEX (field3), -cdnsp_trb_type_string (type), field1, field0, -cdnsp_trb_comp_code_string (GET_COMP_CODE (field2)), -EVENT_TRB_LEN (field2),TRB_TO_SLOT_ID (field3), - field3 &EVENT_DATA ?'E' :'e' , - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"ep%d%s(%d) type '%s' TRB %08x%08x status '%s'" +" len %ld slot %ld flags %c:%c" , + ep_num, ep_id %2 ?"out" :"in" , +TRB_TO_EP_INDEX (field3), +cdnsp_trb_type_string (type), field1, field0, +cdnsp_trb_comp_code_string (GET_COMP_CODE (field2)), +EVENT_TRB_LEN (field2),TRB_TO_SLOT_ID (field3), + field3 &EVENT_DATA ?'E' :'e' , + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_MFINDEX_WRAP : - ret =snprintf (str, size,"%s: flags %c" , -cdnsp_trb_type_string (type), - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size,"%s: flags %c" , +cdnsp_trb_type_string (type), + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_SETUP : - ret =snprintf (str, size, -"type '%s' bRequestType %02x bRequest %02x " -"wValue %02x%02x wIndex %02x%02x wLength %d " -"length %ld TD size %ld intr %ld Setup ID %ld " -"flags %c:%c:%c" , -cdnsp_trb_type_string (type), - field0 &0xff , - (field0 &0xff00 ) >>8 , - (field0 &0xff000000 ) >>24 , - (field0 &0xff0000 ) >>16 , - (field1 &0xff00 ) >>8 , - field1 &0xff , - (field1 &0xff000000 ) >>16 | - (field1 &0xff0000 ) >>16 , -TRB_LEN (field2),GET_TD_SIZE (field2), -GET_INTR_TARGET (field2), -TRB_SETUPID_TO_TYPE (field3), - field3 &TRB_IDT ?'D' :'d' , - field3 &TRB_IOC ?'I' :'i' , - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"type '%s' bRequestType %02x bRequest %02x " +"wValue %02x%02x wIndex %02x%02x wLength %d " +"length %ld TD size %ld intr %ld Setup ID %ld " +"flags %c:%c:%c" , +cdnsp_trb_type_string (type), + field0 &0xff , + (field0 &0xff00 ) >>8 , + (field0 &0xff000000 ) >>24 , + (field0 &0xff0000 ) >>16 , + (field1 &0xff00 ) >>8 , + field1 &0xff , + (field1 &0xff000000 ) >>16 | + (field1 &0xff0000 ) >>16 , +TRB_LEN (field2),GET_TD_SIZE (field2), +GET_INTR_TARGET (field2), +TRB_SETUPID_TO_TYPE (field3), + field3 &TRB_IDT ?'D' :'d' , + field3 &TRB_IOC ?'I' :'i' , + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_DATA : - ret =snprintf (str, size, -"type '%s' Buffer %08x%08x length %ld TD size %ld " -"intr %ld flags %c:%c:%c:%c:%c:%c:%c" , -cdnsp_trb_type_string (type), - field1, field0,TRB_LEN (field2), -GET_TD_SIZE (field2), -GET_INTR_TARGET (field2), - field3 &TRB_IDT ?'D' :'i' , - field3 &TRB_IOC ?'I' :'i' , - field3 &TRB_CHAIN ?'C' :'c' , - field3 &TRB_NO_SNOOP ?'S' :'s' , - field3 &TRB_ISP ?'I' :'i' , - field3 &TRB_ENT ?'E' :'e' , - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"type '%s' Buffer %08x%08x length %ld TD size %ld " +"intr %ld flags %c:%c:%c:%c:%c:%c:%c" , +cdnsp_trb_type_string (type), + field1, field0,TRB_LEN (field2), +GET_TD_SIZE (field2), +GET_INTR_TARGET (field2), + field3 &TRB_IDT ?'D' :'i' , + field3 &TRB_IOC ?'I' :'i' , + field3 &TRB_CHAIN ?'C' :'c' , + field3 &TRB_NO_SNOOP ?'S' :'s' , + field3 &TRB_ISP ?'I' :'i' , + field3 &TRB_ENT ?'E' :'e' , + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_STATUS : - ret =snprintf (str, size, -"Buffer %08x%08x length %ld TD size %ld intr" -"%ld type '%s' flags %c:%c:%c:%c" , - field1, field0,TRB_LEN (field2), -GET_TD_SIZE (field2), -GET_INTR_TARGET (field2), -cdnsp_trb_type_string (type), - field3 &TRB_IOC ?'I' :'i' , - field3 &TRB_CHAIN ?'C' :'c' , - field3 &TRB_ENT ?'E' :'e' , - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"Buffer %08x%08x length %ld TD size %ld intr" +"%ld type '%s' flags %c:%c:%c:%c" , + field1, field0,TRB_LEN (field2), +GET_TD_SIZE (field2), +GET_INTR_TARGET (field2), +cdnsp_trb_type_string (type), + field3 &TRB_IOC ?'I' :'i' , + field3 &TRB_CHAIN ?'C' :'c' , + field3 &TRB_ENT ?'E' :'e' , + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_NORMAL :case TRB_ISOC :case TRB_EVENT_DATA :case TRB_TR_NOOP : - ret =snprintf (str, size, -"type '%s' Buffer %08x%08x length %ld " -"TD size %ld intr %ld " -"flags %c:%c:%c:%c:%c:%c:%c:%c:%c" , -cdnsp_trb_type_string (type), - field1, field0,TRB_LEN (field2), -GET_TD_SIZE (field2), -GET_INTR_TARGET (field2), - field3 &TRB_BEI ?'B' :'b' , - field3 &TRB_IDT ?'T' :'t' , - field3 &TRB_IOC ?'I' :'i' , - field3 &TRB_CHAIN ?'C' :'c' , - field3 &TRB_NO_SNOOP ?'S' :'s' , - field3 &TRB_ISP ?'I' :'i' , - field3 &TRB_ENT ?'E' :'e' , - field3 &TRB_CYCLE ?'C' :'c' , - !(field3 &TRB_EVENT_INVALIDATE ) ?'V' :'v' ); + ret =scnprintf (str, size, +"type '%s' Buffer %08x%08x length %ld " +"TD size %ld intr %ld " +"flags %c:%c:%c:%c:%c:%c:%c:%c:%c" , +cdnsp_trb_type_string (type), + field1, field0,TRB_LEN (field2), +GET_TD_SIZE (field2), +GET_INTR_TARGET (field2), + field3 &TRB_BEI ?'B' :'b' , + field3 &TRB_IDT ?'T' :'t' , + field3 &TRB_IOC ?'I' :'i' , + field3 &TRB_CHAIN ?'C' :'c' , + field3 &TRB_NO_SNOOP ?'S' :'s' , + field3 &TRB_ISP ?'I' :'i' , + field3 &TRB_ENT ?'E' :'e' , + field3 &TRB_CYCLE ?'C' :'c' , + !(field3 &TRB_EVENT_INVALIDATE ) ?'V' :'v' );break ;case TRB_CMD_NOOP :case TRB_ENABLE_SLOT : - ret =snprintf (str, size,"%s: flags %c" , -cdnsp_trb_type_string (type), - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size,"%s: flags %c" , +cdnsp_trb_type_string (type), + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_DISABLE_SLOT : - ret =snprintf (str, size,"%s: slot %ld flags %c" , -cdnsp_trb_type_string (type), -TRB_TO_SLOT_ID (field3), - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size,"%s: slot %ld flags %c" , +cdnsp_trb_type_string (type), +TRB_TO_SLOT_ID (field3), + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_ADDR_DEV : - ret =snprintf (str, size, -"%s: ctx %08x%08x slot %ld flags %c:%c" , -cdnsp_trb_type_string (type), field1, field0, -TRB_TO_SLOT_ID (field3), - field3 &TRB_BSR ?'B' :'b' , - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"%s: ctx %08x%08x slot %ld flags %c:%c" , +cdnsp_trb_type_string (type), field1, field0, +TRB_TO_SLOT_ID (field3), + field3 &TRB_BSR ?'B' :'b' , + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_CONFIG_EP : - ret =snprintf (str, size, -"%s: ctx %08x%08x slot %ld flags %c:%c" , -cdnsp_trb_type_string (type), field1, field0, -TRB_TO_SLOT_ID (field3), - field3 &TRB_DC ?'D' :'d' , - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"%s: ctx %08x%08x slot %ld flags %c:%c" , +cdnsp_trb_type_string (type), field1, field0, +TRB_TO_SLOT_ID (field3), + field3 &TRB_DC ?'D' :'d' , + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_EVAL_CONTEXT : - ret =snprintf (str, size, -"%s: ctx %08x%08x slot %ld flags %c" , -cdnsp_trb_type_string (type), field1, field0, -TRB_TO_SLOT_ID (field3), - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"%s: ctx %08x%08x slot %ld flags %c" , +cdnsp_trb_type_string (type), field1, field0, +TRB_TO_SLOT_ID (field3), + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_RESET_EP :case TRB_HALT_ENDPOINT : - ret =snprintf (str, size, -"%s: ep%d%s(%d) ctx %08x%08x slot %ld flags %c" , -cdnsp_trb_type_string (type), - ep_num, ep_id %2 ?"out" :"in" , -TRB_TO_EP_INDEX (field3), field1, field0, -TRB_TO_SLOT_ID (field3), - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"%s: ep%d%s(%d) ctx %08x%08x slot %ld flags %c" , +cdnsp_trb_type_string (type), + ep_num, ep_id %2 ?"out" :"in" , +TRB_TO_EP_INDEX (field3), field1, field0, +TRB_TO_SLOT_ID (field3), + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_STOP_RING : - ret =snprintf (str, size, -"%s: ep%d%s(%d) slot %ld sp %d flags %c" , -cdnsp_trb_type_string (type), - ep_num, ep_id %2 ?"out" :"in" , -TRB_TO_EP_INDEX (field3), -TRB_TO_SLOT_ID (field3), -TRB_TO_SUSPEND_PORT (field3), - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"%s: ep%d%s(%d) slot %ld sp %d flags %c" , +cdnsp_trb_type_string (type), + ep_num, ep_id %2 ?"out" :"in" , +TRB_TO_EP_INDEX (field3), +TRB_TO_SLOT_ID (field3), +TRB_TO_SUSPEND_PORT (field3), + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_SET_DEQ : - ret =snprintf (str, size, -"%s: ep%d%s(%d) deq %08x%08x stream %ld slot %ld flags %c" , -cdnsp_trb_type_string (type), - ep_num, ep_id %2 ?"out" :"in" , -TRB_TO_EP_INDEX (field3), field1, field0, -TRB_TO_STREAM_ID (field2), -TRB_TO_SLOT_ID (field3), - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"%s: ep%d%s(%d) deq %08x%08x stream %ld slot %ld flags %c" , +cdnsp_trb_type_string (type), + ep_num, ep_id %2 ?"out" :"in" , +TRB_TO_EP_INDEX (field3), field1, field0, +TRB_TO_STREAM_ID (field2), +TRB_TO_SLOT_ID (field3), + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_RESET_DEV : - ret =snprintf (str, size,"%s: slot %ld flags %c" , -cdnsp_trb_type_string (type), -TRB_TO_SLOT_ID (field3), - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size,"%s: slot %ld flags %c" , +cdnsp_trb_type_string (type), +TRB_TO_SLOT_ID (field3), + field3 &TRB_CYCLE ?'C' :'c' );break ;case TRB_ENDPOINT_NRDY : temp =TRB_TO_HOST_STREAM (field2); - ret =snprintf (str, size, -"%s: ep%d%s(%d) H_SID %x%s%s D_SID %lx flags %c:%c" , -cdnsp_trb_type_string (type), - ep_num, ep_id %2 ?"out" :"in" , -TRB_TO_EP_INDEX (field3), temp, - temp ==STREAM_PRIME_ACK ?"(PRIME)" :"" , - temp ==STREAM_REJECTED ?"(REJECTED)" :"" , -TRB_TO_DEV_STREAM (field0), - field3 &TRB_STAT ?'S' :'s' , - field3 &TRB_CYCLE ?'C' :'c' ); + ret =scnprintf (str, size, +"%s: ep%d%s(%d) H_SID %x%s%s D_SID %lx flags %c:%c" , +cdnsp_trb_type_string (type), + ep_num, ep_id %2 ?"out" :"in" , +TRB_TO_EP_INDEX (field3), temp, + temp ==STREAM_PRIME_ACK ?"(PRIME)" :"" , + temp ==STREAM_REJECTED ?"(REJECTED)" :"" , +TRB_TO_DEV_STREAM (field0), + field3 &TRB_STAT ?'S' :'s' , + field3 &TRB_CYCLE ?'C' :'c' );break ;default : - ret =snprintf (str, size, -"type '%s' -> raw %08x %08x %08x %08x" , -cdnsp_trb_type_string (type), - field0, field1, field2, field3); + ret =scnprintf (str, size, +"type '%s' -> raw %08x %08x %08x %08x" , +cdnsp_trb_type_string (type), + field0, field1, field2, field3); } -if (ret >= size) -pr_info ("CDNSP: buffer overflowed.\n" ); +if (ret == size -1 ) +pr_info ("CDNSP: buffer may be truncated.\n" );return str; }
@@ -465,32 +465,32 @@ static inline const char *cdnsp_decode_portsc(char *str, size_t size, {int ret; - ret =snprintf (str, size,"%s %s %s Link:%s PortSpeed:%d " , - portsc &PORT_POWER ?"Powered" :"Powered-off" , - portsc &PORT_CONNECT ?"Connected" :"Not-connected" , - portsc &PORT_PED ?"Enabled" :"Disabled" , -cdnsp_portsc_link_state_string (portsc), -DEV_PORT_SPEED (portsc)); + ret =scnprintf (str, size,"%s %s %s Link:%s PortSpeed:%d " , + portsc &PORT_POWER ?"Powered" :"Powered-off" , + portsc &PORT_CONNECT ?"Connected" :"Not-connected" , + portsc &PORT_PED ?"Enabled" :"Disabled" , +cdnsp_portsc_link_state_string (portsc), +DEV_PORT_SPEED (portsc));if (portsc &PORT_RESET ) - ret +=snprintf (str + ret, size - ret,"In-Reset " ); + ret +=scnprintf (str + ret, size - ret,"In-Reset " ); - ret +=snprintf (str + ret, size - ret,"Change: " ); + ret +=scnprintf (str + ret, size - ret,"Change: " );if (portsc &PORT_CSC ) - ret +=snprintf (str + ret, size - ret,"CSC " ); + ret +=scnprintf (str + ret, size - ret,"CSC " );if (portsc &PORT_WRC ) - ret +=snprintf (str + ret, size - ret,"WRC " ); + ret +=scnprintf (str + ret, size - ret,"WRC " );if (portsc &PORT_RC ) - ret +=snprintf (str + ret, size - ret,"PRC " ); + ret +=scnprintf (str + ret, size - ret,"PRC " );if (portsc &PORT_PLC ) - ret +=snprintf (str + ret, size - ret,"PLC " ); + ret +=scnprintf (str + ret, size - ret,"PLC " );if (portsc &PORT_CEC ) - ret +=snprintf (str + ret, size - ret,"CEC " ); - ret +=snprintf (str + ret, size - ret,"Wake: " ); + ret +=scnprintf (str + ret, size - ret,"CEC " ); + ret +=scnprintf (str + ret, size - ret,"Wake: " );if (portsc &PORT_WKCONN_E ) - ret +=snprintf (str + ret, size - ret,"WCE " ); + ret +=scnprintf (str + ret, size - ret,"WCE " );if (portsc &PORT_WKDISC_E ) - ret +=snprintf (str + ret, size - ret,"WDE " ); + ret +=scnprintf (str + ret, size - ret,"WDE " );return str; }
@@ -562,20 +562,20 @@ static inline const char *cdnsp_decode_ep_context(char *str, size_t size, avg =EP_AVG_TRB_LENGTH (tx_info); - ret =snprintf (str, size,"State %s mult %d max P. Streams %d %s" , -cdnsp_ep_state_string (ep_state), mult, - max_pstr, lsa ?"LSA " :"" ); + ret =scnprintf (str, size,"State %s mult %d max P. Streams %d %s" , +cdnsp_ep_state_string (ep_state), mult, + max_pstr, lsa ?"LSA " :"" ); - ret +=snprintf (str + ret, size - ret, -"interval %d us max ESIT payload %d CErr %d " , - (1 << interval) *125 , esit, cerr); + ret +=scnprintf (str + ret, size - ret, +"interval %d us max ESIT payload %d CErr %d " , + (1 << interval) *125 , esit, cerr); - ret +=snprintf (str + ret, size - ret, -"Type %s %sburst %d maxp %d deq %016llx " , -cdnsp_ep_type_string (ep_type), hid ?"HID" :"" , - burst, maxp, deq); + ret +=scnprintf (str + ret, size - ret, +"Type %s %sburst %d maxp %d deq %016llx " , +cdnsp_ep_type_string (ep_type), hid ?"HID" :"" , + burst, maxp, deq); - ret +=snprintf (str + ret, size - ret,"avg trb len %d" , avg); + ret +=scnprintf (str + ret, size - ret,"avg trb len %d" , avg);return str; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/109 usb: cdnsp: Fix issue with CV Bad Descriptor test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Laszczak <[email protected]>
[ Upstream commit 2831a81077f5162f104ba5a97a7d886eb371c21c ]
The SSP2 controller has extra endpoint state preserve bit (ESP) which setting causes that endpoint state will be preserved during Halt Endpoint command. It is used only for EP0.
Without this bit the Command Verifier "TD 9.10 Bad Descriptor Test" failed.
Setting this bit doesn't have any impact for SSP controller.
--- drivers/usb/cdns3/cdnsp-debug.h | 5 +++-- drivers/usb/cdns3/cdnsp-ep0.c | 18 +++++++++++++++--- drivers/usb/cdns3/cdnsp-gadget.h | 6 ++++++ drivers/usb/cdns3/cdnsp-ring.c | 3 ++- 4 files changed, 26 insertions(+), 6 deletions(-)
drivers/usb/cdns3/cdnsp-debug.h +3 -2
@@ -327,12 +327,13 @@ static inline const char *cdnsp_decode_trb(char *str, size_t size, u32 field0,case TRB_RESET_EP :case TRB_HALT_ENDPOINT : ret =scnprintf (str, size, -"%s: ep%d%s(%d) ctx %08x%08x slot %ld flags %c" , +"%s: ep%d%s(%d) ctx %08x%08x slot %ld flags %c %c" ,cdnsp_trb_type_string (type), ep_num, ep_id %2 ?"out" :"in" ,TRB_TO_EP_INDEX (field3), field1, field0,TRB_TO_SLOT_ID (field3), - field3 &TRB_CYCLE ?'C' :'c' ); + field3 &TRB_CYCLE ?'C' :'c' , + field3 &TRB_ESP ?'P' :'p' );break ;case TRB_STOP_RING : ret = scnprintf(str, size,
drivers/usb/cdns3/cdnsp-ep0.c +15 -3
@@ -414,6 +414,7 @@ static int cdnsp_ep0_std_request(struct cdnsp_device *pdev,void cdnsp_setup_analyze (struct cdnsp_device *pdev) {struct usb_ctrlrequest *ctrl = &pdev->setup; +struct cdnsp_ep *pep;int ret = -EINVAL ;u16 len;
@@ -427,10 +428,21 @@ void cdnsp_setup_analyze(struct cdnsp_device *pdev) goto out; } + pep = &pdev->eps[0 ]; +/* Restore the ep0 to Stopped/Running state. */ -if (pdev->eps[0 ].ep_state &EP_HALTED ) { -trace_cdnsp_ep0_halted ("Restore to normal state" ); -cdnsp_halt_endpoint (pdev, &pdev->eps[0 ],0 ); +if (pep->ep_state &EP_HALTED ) { +if (GET_EP_CTX_STATE (pep->out_ctx) ==EP_STATE_HALTED ) +cdnsp_halt_endpoint (pdev, pep,0 ); + +/* +* Halt Endpoint Command for SSP2 for ep0 preserve current +* endpoint state and driver has to synchronize the +* software endpoint state with endpoint output context +* state. +*/ + pep->ep_state &= ~EP_HALTED ; + pep->ep_state |=EP_STOPPED ; }/*
drivers/usb/cdns3/cdnsp-gadget.h +6 -0
@@ -987,6 +987,12 @@ enum cdnsp_setup_dev {#define STREAM_ID_FOR_TRB (p) ((((p)) << 16) & GENMASK(31, 16))#define SCT_FOR_TRB (p) (((p) << 1) & 0x7) +/* +* Halt Endpoint Command TRB field. +* The ESP bit only exists in the SSP2 controller. +*/ +#define TRB_ESP BIT(9) +/* Link TRB specific fields. */ #define TRB_TC BIT(1)
drivers/usb/cdns3/cdnsp-ring.c +2 -1
@@ -2485,7 +2485,8 @@ void cdnsp_queue_halt_endpoint(struct cdnsp_device *pdev, unsigned int ep_index) {cdnsp_queue_command (pdev,0 ,0 ,0 ,TRB_TYPE (TRB_HALT_ENDPOINT ) |SLOT_ID_FOR_TRB (pdev->slot_id) | -EP_ID_FOR_TRB (ep_index)); +EP_ID_FOR_TRB (ep_index) | + (!ep_index ?TRB_ESP :0 )); }void cdnsp_force_header_wakeup (struct cdnsp_device *pdev,int intf_num)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/109 usb: dwc3: Abort suspend on soft disconnect failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 630a1dec3b0eba2a695b9063f1c205d585cbfec9 ]
When dwc3_gadget_soft_disconnect() fails, dwc3_suspend_common() keeps going with the suspend, resulting in a period where the power domain is off, but the gadget driver remains connected. Within this time frame, invoking vbus_event_work() will cause an error as it attempts to access DWC3 registers for endpoint disabling after the power domain has been completely shut down.
Abort the suspend sequence when dwc3_gadget_suspend() cannot halt the controller and proceeds with a soft connect.
--- drivers/usb/dwc3/core.c | 9 +++++++-- drivers/usb/dwc3/gadget.c | 22 +++++++++------------- 2 files changed, 16 insertions(+), 15 deletions(-)
drivers/usb/dwc3/core.c +7 -2
@@ -2128,6 +2128,7 @@ static int dwc3_core_init_for_resume(struct dwc3 *dwc)static int dwc3_suspend_common (struct dwc3 *dwc,pm_message_t msg) {u32 reg; +int ret;if (!pm_runtime_suspended (dwc->dev) && !PMSG_IS_AUTO (msg)) { dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) &
@@ -2146,7 +2147,9 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)case DWC3_GCTL_PRTCAP_DEVICE :if (pm_runtime_suspended (dwc->dev))break ; -dwc3_gadget_suspend (dwc); + ret =dwc3_gadget_suspend (dwc); +if (ret) +return ret;synchronize_irq (dwc->irq_gadget);dwc3_core_exit (dwc);break ;
@@ -2177,7 +2180,9 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)break ;if (dwc->current_otg_role ==DWC3_OTG_ROLE_DEVICE ) { -dwc3_gadget_suspend (dwc); + ret =dwc3_gadget_suspend (dwc); +if (ret) +return ret;synchronize_irq (dwc->irq_gadget); }
drivers/usb/dwc3/gadget.c +9 -13
@@ -4802,26 +4802,22 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)int ret; ret =dwc3_gadget_soft_disconnect (dwc); -if (ret) - goto err; - -spin_lock_irqsave (&dwc->lock, flags); -if (dwc->gadget_driver) -dwc3_disconnect_gadget (dwc); -spin_unlock_irqrestore (&dwc->lock, flags); - -return 0 ; - -err:/* * Attempt to reset the controller's state. Likely no * communication can be established until the host * performs a port reset. */ -if (dwc->softconnect) +if (ret && dwc->softconnect) {dwc3_gadget_soft_connect (dwc); +return -EAGAIN ; + } -return ret; +spin_lock_irqsave (&dwc->lock, flags); +if (dwc->gadget_driver) +dwc3_disconnect_gadget (dwc); +spin_unlock_irqrestore (&dwc->lock, flags); + +return 0 ; }int dwc3_gadget_resume (struct dwc3 *dwc)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/109 smb: client: avoid unnecessary reconnects when refreshing referrals
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 242d23efc987151ecd34bc0cae4c0b737494fc40 ]
Do not mark tcons for reconnect when current connection matches any of the targets returned by new referral even when there is no cached entry.
Stable-dep-of: 74ebd02163fd ("cifs: all initializations for tcon should happen in tcon_info_alloc")
--- fs/smb/client/dfs_cache.c | 187 ++++++++++++++++++++++++-------------- 1 file changed, 117 insertions(+), 70 deletions(-)
fs/smb/client/dfs_cache.c +117 -70
@@ -1095,16 +1095,18 @@ int dfs_cache_get_tgt_share(char *path, const struct dfs_cache_tgt_iterator *it,return 0 ; } -static bool target_share_equal (struct TCP_Server_Info *server,const char *s1,const char *s2) +static bool target_share_equal (struct cifs_tcon *tcon,const char *s1) { -char unc[sizeof ("\\\\" ) +SERVER_NAME_LENGTH ] = {0 }; +struct TCP_Server_Info *server = tcon->ses->server; +struct sockaddr_storage ss;const char *host; +const char *s2 = &tcon->tree_name[1 ];size_t hostlen; -struct sockaddr_storage ss; +char unc[sizeof ("\\\\" ) +SERVER_NAME_LENGTH ] = {0 };bool match;int rc; -if (strcasecmp (s1, s2)) +if (strcasecmp (s2, s1))return false;/*
@@ -1128,34 +1130,6 @@ static bool target_share_equal(struct TCP_Server_Info *server, const char *s1, creturn match; } -/* -* Mark dfs tcon for reconnecting when the currently connected tcon does not match any of the new -* target shares in @refs. -*/ -static void mark_for_reconnect_if_needed (struct TCP_Server_Info *server, -const char *path, -struct dfs_cache_tgt_list *old_tl, -struct dfs_cache_tgt_list *new_tl) -{ -struct dfs_cache_tgt_iterator *oit, *nit; - -for (oit =dfs_cache_get_tgt_iterator (old_tl); oit; - oit =dfs_cache_get_next_tgt (old_tl, oit)) { -for (nit =dfs_cache_get_tgt_iterator (new_tl); nit; - nit =dfs_cache_get_next_tgt (new_tl, nit)) { -if (target_share_equal (server, -dfs_cache_get_tgt_name (oit), -dfs_cache_get_tgt_name (nit))) { -dfs_cache_noreq_update_tgthint (path, nit); -return ; - } - } - } - -cifs_dbg (FYI ,"%s: no cached or matched targets. mark dfs share for reconnect.\n" , __func__); -cifs_signal_cifsd_for_reconnect (server, true); -} -static bool is_ses_good (struct cifs_ses *ses) {struct TCP_Server_Info *server = ses->server;
@@ -1172,41 +1146,35 @@ static bool is_ses_good(struct cifs_ses *ses)return ret; } -/* Refresh dfs referral of @ses and mark it for reconnect if needed */ -static void __refresh_ses_referral (struct cifs_ses *ses,bool force_refresh) +static char *get_ses_refpath (struct cifs_ses *ses) {struct TCP_Server_Info *server = ses->server; -DFS_CACHE_TGT_LIST (old_tl); -DFS_CACHE_TGT_LIST (new_tl); -bool needs_refresh = false; -struct cache_entry *ce; -unsigned int xid; -char *path =NULL ; -int rc =0 ; - - xid =get_xid (); +char *path =ERR_PTR (-ENOENT );mutex_lock (&server->refpath_lock);if (server->leaf_fullpath) { path =kstrdup (server->leaf_fullpath +1 ,GFP_ATOMIC );if (!path) - rc = -ENOMEM ; + path =ERR_PTR (-ENOMEM ); }mutex_unlock (&server->refpath_lock); -if (!path) - goto out; +return path; +} -down_read (&htable_rw_lock); - ce =lookup_cache_entry (path); - needs_refresh = force_refresh ||IS_ERR (ce) ||cache_entry_expired (ce); -if (!IS_ERR (ce)) { - rc =get_targets (ce, &old_tl); -cifs_dbg (FYI ,"%s: get_targets: %d\n" , __func__, rc); - } -up_read (&htable_rw_lock); +/* Refresh dfs referral of @ses */ +static void refresh_ses_referral (struct cifs_ses *ses) +{ +struct cache_entry *ce; +unsigned int xid; +char *path; +int rc =0 ; -if (!needs_refresh) { - rc =0 ; + xid =get_xid (); + + path =get_ses_refpath (ses); +if (IS_ERR (path)) { + rc =PTR_ERR (path); + path =NULL ; goto out; }
@@ -1217,29 +1185,106 @@ static void __refresh_ses_referral(struct cifs_ses *ses, bool force_refresh) goto out; } - ce =cache_refresh_path (xid, ses, path, true); -if (!IS_ERR (ce)) { - rc =get_targets (ce, &new_tl); + ce =cache_refresh_path (xid, ses, path, false); +if (!IS_ERR (ce))up_read (&htable_rw_lock); -cifs_dbg (FYI ,"%s: get_targets: %d\n" , __func__, rc); -mark_for_reconnect_if_needed (server, path, &old_tl, &new_tl); - } +else + rc =PTR_ERR (ce); out:free_xid (xid); -dfs_cache_free_tgts (&old_tl); -dfs_cache_free_tgts (&new_tl);kfree (path); } -static inline void refresh_ses_referral (struct cifs_ses *ses) +static int __refresh_tcon_referral (struct cifs_tcon *tcon, +const char *path, +struct dfs_info3_param *refs, +int numrefs,bool force_refresh) { -__refresh_ses_referral (ses, false); +struct cache_entry *ce; +bool reconnect = force_refresh; +int rc =0 ; +int i; + +if (unlikely (!numrefs)) +return 0 ; + +if (force_refresh) { +for (i =0 ; i < numrefs; i++) { +/* TODO: include prefix paths in the matching */ +if (target_share_equal (tcon, refs[i].node_name)) { + reconnect = false; +break ; + } + } + } + +down_write (&htable_rw_lock); + ce =lookup_cache_entry (path); +if (!IS_ERR (ce)) { +if (force_refresh ||cache_entry_expired (ce)) + rc =update_cache_entry_locked (ce, refs, numrefs); + }else if (PTR_ERR (ce) == -ENOENT ) { + ce =add_cache_entry_locked (refs, numrefs); + } +up_write (&htable_rw_lock); + +if (IS_ERR (ce)) + rc =PTR_ERR (ce); +if (reconnect) { +cifs_tcon_dbg (FYI ,"%s: mark for reconnect\n" , __func__); +cifs_signal_cifsd_for_reconnect (tcon->ses->server, true); + } +return rc; } -static inline void force_refresh_ses_referral (struct cifs_ses *ses) +static void refresh_tcon_referral (struct cifs_tcon *tcon,bool force_refresh) { -__refresh_ses_referral (ses, true); +struct dfs_info3_param *refs =NULL ; +struct cache_entry *ce; +struct cifs_ses *ses; +unsigned int xid; +bool needs_refresh; +char *path; +int numrefs =0 ; +int rc =0 ; + + xid =get_xid (); + ses = tcon->ses; + + path =get_ses_refpath (ses); +if (IS_ERR (path)) { + rc =PTR_ERR (path); + path =NULL ; + goto out; + } + +down_read (&htable_rw_lock); + ce =lookup_cache_entry (path); + needs_refresh = force_refresh ||IS_ERR (ce) ||cache_entry_expired (ce); +if (!needs_refresh) { +up_read (&htable_rw_lock); + goto out; + } +up_read (&htable_rw_lock); + + ses =CIFS_DFS_ROOT_SES (ses); +if (!is_ses_good (ses)) { +cifs_dbg (FYI ,"%s: skip cache refresh due to disconnected ipc\n" , + __func__); + goto out; + } + + rc =get_dfs_referral (xid, ses, path, &refs, &numrefs); +if (!rc) { + rc =__refresh_tcon_referral (tcon, path, refs, + numrefs, force_refresh); + } + +out: +free_xid (xid); +kfree (path); +free_dfs_info_array (refs, numrefs); }/**
@@ -1280,7 +1325,7 @@ int dfs_cache_remount_fs(struct cifs_sb_info *cifs_sb)*/ cifs_sb->mnt_cifs_flags |=CIFS_MOUNT_USE_PREFIX_PATH ; -force_refresh_ses_referral (tcon->ses); +refresh_tcon_referral (tcon, true);return 0 ; }
@@ -1291,9 +1336,11 @@ void dfs_cache_refresh(struct work_struct *work)struct cifs_ses *ses; tcon = container_of(work, struct cifs_tcon, dfs_cache_work.work); + ses = tcon->ses->dfs_root_ses; -for (ses = tcon->ses; ses; ses = ses->dfs_root_ses) +for (; ses; ses = ses->dfs_root_ses)refresh_ses_referral (ses); +refresh_tcon_referral (tcon, false);queue_delayed_work (dfscache_wq, &tcon->dfs_cache_work,atomic_read (&dfs_cache_ttl) *HZ );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/109 smb: client: fix DFS interlink failover
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 4f42a8b54b5c6e36519aef3cb1f6210e54abd451 ]
The DFS interlinks point to different DFS namespaces so make sure to use the correct DFS root server to chase any DFS links under it by storing the SMB session in dfs_ref_walk structure and then using it on every referral walk.
Stable-dep-of: 74ebd02163fd ("cifs: all initializations for tcon should happen in tcon_info_alloc")
--- fs/smb/client/cifsglob.h | 3 ++ fs/smb/client/cifsproto.h | 12 ++----- fs/smb/client/connect.c | 41 +++++++++++---------- fs/smb/client/dfs.c | 73 ++++++++++++++++++-------------------- fs/smb/client/dfs.h | 42 ++++++++++++++-------- fs/smb/client/dfs_cache.c | 3 +- fs/smb/client/fs_context.h | 1 + fs/smb/client/misc.c | 3 ++ fs/smb/client/namespace.c | 2 +- 9 files changed, 94 insertions(+), 86 deletions(-)
fs/smb/client/cifsglob.h +3 -0
@@ -830,6 +830,7 @@ struct TCP_Server_Info {* format: \\HOST\SHARE[\OPTIONAL PATH] */ char *leaf_fullpath; + bool dfs_conn:1; };static inline bool is_smb1 (struct TCP_Server_Info *server)
@@ -1065,6 +1066,7 @@ struct cifs_ses {struct list_head smb_ses_list;struct list_head rlist;/* reconnect list */ struct list_head tcon_list; +struct list_head dlist;/* dfs list */ struct cifs_tcon *tcon_ipc;spinlock_t ses_lock;/* protect anything here that is not protected */ struct mutex session_mutex;
@@ -1294,6 +1296,7 @@ struct cifs_tcon {/* BB add field for back pointer to sb struct(s)? */ #ifdef CONFIG_CIFS_DFS_UPCALL struct delayed_work dfs_cache_work; +struct list_head dfs_ses_list;#endif struct delayed_work query_interfaces;/* query interfaces workqueue job */ char *origin_fullpath;/* canonical copy of smb3_fs_context::source */
fs/smb/client/cifsproto.h +2 -10
@@ -737,15 +737,9 @@ static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options)int cifs_wait_for_server_reconnect (struct TCP_Server_Info *server,bool retry); -/* Put references of @ses and its children */ static inline void cifs_put_smb_ses (struct cifs_ses *ses) { -struct cifs_ses *next; - -do { - next = ses->dfs_root_ses; -__cifs_put_smb_ses (ses); - }while ((ses = next)); +__cifs_put_smb_ses (ses); }/* Get an active reference of @ses and its children.
@@ -759,9 +753,7 @@ static inline void cifs_put_smb_ses(struct cifs_ses *ses)static inline void cifs_smb_ses_inc_refcount (struct cifs_ses *ses) {lockdep_assert_held (&cifs_tcp_ses_lock); - -for (; ses; ses = ses->dfs_root_ses) - ses->ses_count++; + ses->ses_count++; }static inline bool dfs_src_pathname_equal (const char *s1,const char *s2)
fs/smb/client/connect.c +20 -21
121 lines not on this page · raw message
fs/smb/client/dfs.c +35 -38
169 lines not on this page · raw message
fs/smb/client/dfs.h +28 -14
83 lines not on this page · raw message
fs/smb/client/dfs_cache.c +1 -2
@@ -1336,9 +1336,8 @@ void dfs_cache_refresh(struct work_struct *work)struct cifs_ses *ses; tcon = container_of(work, struct cifs_tcon, dfs_cache_work.work); - ses = tcon->ses->dfs_root_ses; -for (; ses; ses = ses->dfs_root_ses) +list_for_each_entry (ses, &tcon->dfs_ses_list, dlist)refresh_ses_referral (ses);refresh_tcon_referral (tcon, false);
fs/smb/client/fs_context.h +1 -0
@@ -287,6 +287,7 @@ struct smb3_fs_context {struct cifs_ses *dfs_root_ses; bool dfs_automount:1; /* set for dfs automount only */enum cifs_reparse_type reparse_type; + bool dfs_conn:1; /* set for dfs mounts */ };extern const struct fs_parameter_spec smb3_fs_parameters[];
fs/smb/client/misc.c +3 -0
@@ -145,6 +145,9 @@ tcon_info_alloc(bool dir_leases_enabled, enum smb3_tcon_ref_trace trace)mutex_init (&ret_buf->fscache_lock);#endif trace_smb3_tcon_ref (ret_buf->debug_id, ret_buf->tc_count, trace); +#ifdef CONFIG_CIFS_DFS_UPCALL +INIT_LIST_HEAD (&ret_buf->dfs_ses_list); +#endif return ret_buf; }
fs/smb/client/namespace.c +1 -1
@@ -260,7 +260,7 @@ static struct vfsmount *cifs_do_automount(struct path *path) ctx->source =NULL ; goto out; } - ctx->dfs_automount =is_dfs_mount (mntpt); + ctx->dfs_automount = ctx->dfs_conn =is_dfs_mount (mntpt);cifs_dbg (FYI ,"%s: ctx: source=%s UNC=%s prepath=%s dfs_automount=%d\n" , __func__, ctx->source, ctx->UNC, ctx->prepath, ctx->dfs_automount);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/109 cifs: all initializations for tcon should happen in tcon_info_alloc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
[ Upstream commit 74ebd02163fde05baa23129e06dde4b8f0f2377a ]
Today, a few work structs inside tcon are initialized inside cifs_get_tcon and not in tcon_info_alloc. As a result, if a tcon is obtained from tcon_info_alloc, but not called as a part of cifs_get_tcon, we may trip over.
--- fs/smb/client/cifsproto.h | 1 + fs/smb/client/connect.c | 8 +------- fs/smb/client/misc.c | 6 ++++++ 3 files changed, 8 insertions(+), 7 deletions(-)
fs/smb/client/cifsproto.h +1 -0
@@ -136,6 +136,7 @@ extern int SendReceiveBlockingLock(const unsigned int xid,struct smb_hdr *out_buf, int *bytes_returned); +void smb2_query_server_interfaces (struct work_struct *work);void cifs_signal_cifsd_for_reconnect (struct TCP_Server_Info *server,bool all_channels);
fs/smb/client/connect.c +1 -7
@@ -113,7 +113,7 @@ static int reconn_set_ipaddr_from_hostname(struct TCP_Server_Info *server)return rc; } -static void smb2_query_server_interfaces (struct work_struct *work) +void smb2_query_server_interfaces (struct work_struct *work) {int rc;int xid;
@@ -2818,20 +2818,14 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb3_fs_context *ctx) tcon->max_cached_dirs = ctx->max_cached_dirs; tcon->nodelete = ctx->nodelete; tcon->local_lease = ctx->local_lease; -INIT_LIST_HEAD (&tcon->pending_opens); tcon->status =TID_GOOD ; -INIT_DELAYED_WORK (&tcon->query_interfaces, - smb2_query_server_interfaces);if (ses->server->dialect >=SMB30_PROT_ID && (ses->server->capabilities &SMB2_GLOBAL_CAP_MULTI_CHANNEL )) {/* schedule query interfaces poll */ queue_delayed_work (cifsiod_wq, &tcon->query_interfaces, (SMB_INTERFACE_POLL_INTERVAL *HZ )); } -#ifdef CONFIG_CIFS_DFS_UPCALL -INIT_DELAYED_WORK (&tcon->dfs_cache_work, dfs_cache_refresh); -#endif spin_lock (&cifs_tcp_ses_lock);list_add (&tcon->tcon_list, &ses->tcon_list);spin_unlock (&cifs_tcp_ses_lock);
fs/smb/client/misc.c +6 -0
@@ -148,6 +148,12 @@ tcon_info_alloc(bool dir_leases_enabled, enum smb3_tcon_ref_trace trace)#ifdef CONFIG_CIFS_DFS_UPCALL INIT_LIST_HEAD (&ret_buf->dfs_ses_list);#endif +INIT_LIST_HEAD (&ret_buf->pending_opens); +INIT_DELAYED_WORK (&ret_buf->query_interfaces, + smb2_query_server_interfaces); +#ifdef CONFIG_CIFS_DFS_UPCALL +INIT_DELAYED_WORK (&ret_buf->dfs_cache_work, dfs_cache_refresh); +#endif return ret_buf; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/109 wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
[ Upstream commit 74b1ec9f5d627d2bdd5e5b6f3f81c23317657023 ]
There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For example, the following is possible:
T0 T1
zd_mac_tx_to_dev()
/* len == skb_queue_len(q) */
while (len > ZD_MAC_MAX_ACK_WAITERS) {
filter_ack()
spin_lock_irqsave(&q->lock, flags);
/* position == skb_queue_len(q) */
for (i=1; i<position; i++)
skb = __skb_dequeue(q)
if (mac->type == NL80211_IFTYPE_AP)
skb = __skb_dequeue(q);
spin_unlock_irqrestore(&q->lock, flags);
skb_dequeue() -> NULLSince there is a small gap between checking skb queue length and skb being unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL. Then the pointer is passed to zd_mac_tx_status() where it is dereferenced.
In order to avoid potential NULL pointer dereference due to situations like above, check if skb is not NULL before passing it to zd_mac_tx_status().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/zydas/zd1211rw/zd_mac.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/wireless/zydas/zd1211rw/zd_mac.c +5 -1
@@ -583,7 +583,11 @@ void zd_mac_tx_to_dev(struct sk_buff *skb, int error)skb_queue_tail (q, skb);while (skb_queue_len (q) >ZD_MAC_MAX_ACK_WAITERS ) { -zd_mac_tx_status (hw,skb_dequeue (q), + skb =skb_dequeue (q); +if (!skb) +break ; + +zd_mac_tx_status (hw, skb, mac->ack_pending ? mac->ack_signal :0 ,NULL ); mac->ack_pending =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/109 drm/tegra: nvdec: Fix dma_alloc_coherent error check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit 44306a684cd1699b8562a54945ddc43e2abc9eab ]
Check for NULL return value with dma_alloc_coherent, in line with Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'.
--- drivers/gpu/drm/tegra/nvdec.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/tegra/nvdec.c +2 -4
@@ -261,10 +261,8 @@ static int nvdec_load_falcon_firmware(struct nvdec *nvdec)if (!client->group) { virt =dma_alloc_coherent (nvdec->dev, size, &iova,GFP_KERNEL ); - - err =dma_mapping_error (nvdec->dev, iova); -if (err <0 ) -return err; +if (!virt) +return -ENOMEM ; }else { virt =tegra_drm_alloc (tegra, size, &iova);if (IS_ERR (virt))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/109 md/raid1: Fix stack memory use after return in raid1_reshape
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Jinchao <[email protected]>
[ Upstream commit d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98 ]
In the raid1_reshape function, newpool is allocated on the stack and assigned to conf->r1bio_pool. This results in conf->r1bio_pool.wait.head pointing to a stack address.
Accessing this address later can lead to a kernel panic.
Example access path:
raid1_reshape()
{
// newpool is on the stack
mempool_t newpool, oldpool;
// initialize newpool.wait.head to stack address
mempool_init(&newpool, ...);
conf->r1bio_pool = newpool;
}raid1_read_request() or raid1_write_request()
{
alloc_r1bio()
{
mempool_alloc()
{
// if pool->alloc fails
remove_element()
{
--pool->curr_nr;
}
}
}
}mempool_free()
{
if (pool->curr_nr < pool->min_nr) {
// pool->wait.head is a stack address
// wake_up() will try to access this invalid address
// which leads to a kernel panic
return;
wake_up(&pool->wait);
}
}Fix:
reinit conf->r1bio_pool.wait after assigning newpool.
--- drivers/md/raid1.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/raid1.c +1 -0
@@ -3297,6 +3297,7 @@ static int raid1_reshape(struct mddev *mddev)/* ok, everything is stopped */ oldpool = conf->r1bio_pool; conf->r1bio_pool = newpool; +init_waitqueue_head (&conf->r1bio_pool.wait);for (d = d2 =0 ; d < conf->raid_disks; d++) {struct md_rdev *rdev = conf->mirrors[d].rdev;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/109 raid10: cleanup memleak at raid10_make_request
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nigel Croxon <[email protected]>
[ Upstream commit 43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24 ]
If raid10_read_request or raid10_write_request registers a new request and the REQ_NOWAIT flag is set, the code does not free the malloc from the mempool.
unreferenced object 0xffff8884802c3200 (size 192):
comm "fio", pid 9197, jiffies 4298078271 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00 .........A......
08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc c1a049a2):
__kmalloc+0x2bb/0x450
mempool_alloc+0x11b/0x320
raid10_make_request+0x19e/0x650 [raid10]
md_handle_request+0x3b3/0x9e0
__submit_bio+0x394/0x560
__submit_bio_noacct+0x145/0x530
submit_bio_noacct_nocheck+0x682/0x830
__blkdev_direct_IO_async+0x4dc/0x6b0
blkdev_read_iter+0x1e5/0x3b0
__io_read+0x230/0x1110
io_read+0x13/0x30
io_issue_sqe+0x134/0x1180
io_submit_sqes+0x48c/0xe90
__do_sys_io_uring_enter+0x574/0x8b0
do_syscall_64+0x5c/0xe0
entry_SYSCALL_64_after_hwframe+0x76/0x7eV4: changing backing tree to see if CKI tests will pass. The patch code has not changed between any versions.
--- drivers/md/raid10.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/md/raid10.c +8 -2
@@ -1205,8 +1205,11 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio,rcu_read_unlock (); } -if (!regular_request_wait (mddev, conf, bio, r10_bio->sectors)) +if (!regular_request_wait (mddev, conf, bio, r10_bio->sectors)) { +raid_end_bio_io (r10_bio);return ; + } + rdev =read_balance (conf, r10_bio, &max_sectors);if (!rdev) {if (err_rdev) {
@@ -1428,8 +1431,11 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, } sectors = r10_bio->sectors; -if (!regular_request_wait (mddev, conf, bio, sectors)) +if (!regular_request_wait (mddev, conf, bio, sectors)) { +raid_end_bio_io (r10_bio);return ; + } + if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) && (mddev->reshape_backwards ? (bio->bi_iter.bi_sector < conf->reshape_safe &&
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/109 nbd: fix uaf in nbd_genl_connect() error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit aa9552438ebf015fc5f9f890dbfe39f0c53cf37e ]
There is a use-after-free issue in nbd:
block nbd6: Receive control failed (result -104)
block nbd6: shutting down sockets
==================================================================
BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67 CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: nbd6-recv recv_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline] recv_work+0x694/0xa80 drivers/block/nbd.c:1022 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
nbd_genl_connect() does not properly stop the device on certain error paths after nbd_start_device() has been called. This causes the error path to put nbd->config while recv_work continue to use the config after putting it, leading to use-after-free in recv_work.
This patch moves nbd_start_device() after the backend file creation.
--- drivers/block/nbd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/block/nbd.c +3 -3
@@ -2120,9 +2120,7 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) goto out; } } - ret =nbd_start_device (nbd); -if (ret) - goto out; +if (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER ]) { nbd->backend =nla_strdup (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER ],GFP_KERNEL );
@@ -2138,6 +2136,8 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) goto out; }set_bit (NBD_RT_HAS_BACKEND_FILE , &config->runtime_flags); + + ret =nbd_start_device (nbd); out:mutex_unlock (&nbd->config_lock);if (!ret) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/109 netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 18cdb3d982da8976b28d57691eb256ec5688fad2 ]
syzbot found a potential access to uninit-value in nf_flow_pppoe_proto()
Blamed commit forgot the Ethernet header.
BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5742 [inline] __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837 __netif_receive_skb_one_core net/core/dev.c:5975 [inline] __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090 netif_receive_skb_internal net/core/dev.c:6176 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6235 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline]
--- include/net/netfilter/nf_flow_table.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/netfilter/nf_flow_table.h +1 -1
@@ -353,7 +353,7 @@ static inline __be16 __nf_flow_pppoe_proto(const struct sk_buff *skb)static inline bool nf_flow_pppoe_proto (struct sk_buff *skb,__be16 *inner_proto) { -if (!pskb_may_pull (skb,PPPOE_SES_HLEN )) +if (!pskb_may_pull (skb,ETH_HLEN +PPPOE_SES_HLEN ))return false; *inner_proto =__nf_flow_pppoe_proto (skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/109 net: appletalk: Fix device refcount leak in atrtr_create()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kito Xu <[email protected]>
[ Upstream commit 711c80f7d8b163d3ecd463cd96f07230f488e750 ]
When updating an existing route entry in atrtr_create(), the old device reference was not being released before assigning the new device, leading to a device refcount leak. Fix this by calling dev_put() to release the old device reference before holding the new one.
--- net/appletalk/ddp.c | 1 + 1 file changed, 1 insertion(+)
net/appletalk/ddp.c +1 -0
@@ -563,6 +563,7 @@ static int atrtr_create(struct rtentry *r, struct net_device *devhint)/* Fill in the routing entry */ rt->target = ta->sat_addr; +dev_put (rt->dev);/* Release old device */ dev_hold (devhint); rt->dev = devhint; rt->flags = r->rt_flags;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/109 ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingming Cao <[email protected]>
[ Upstream commit 01b8114b432d7baaa5e51ab229c12c4f36b8e2c6 ]
The previous hardcoded definitions of NUM_RX_STATS and NUM_TX_STATS were not updated when new fields were added to the ibmvnic_{rx,tx}_queue_stats structures. Specifically, commit 2ee73c54a615 ("ibmvnic: Add stat for tx direct vs tx batched") added a fourth TX stat, but NUM_TX_STATS remained 3, leading to a mismatch.
This patch replaces the static defines with dynamic sizeof-based calculations to ensure the stat arrays are correctly sized. This fixes incorrect indexing and prevents incomplete stat reporting in tools like ethtool.
--- drivers/net/ethernet/ibm/ibmvnic.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/ibm/ibmvnic.h +6 -2
@@ -211,7 +211,6 @@ struct ibmvnic_statistics {u8 reserved[72 ]; } __packed__aligned(8) ; -#define NUM_TX_STATS 3struct ibmvnic_tx_queue_stats {u64 batched_packets;u64 direct_packets;
@@ -219,13 +218,18 @@ struct ibmvnic_tx_queue_stats {u64 dropped_packets; }; -#define NUM_RX_STATS 3 +#define NUM_TX_STATS \ + (sizeof(struct ibmvnic_tx_queue_stats) / sizeof(u64)) +struct ibmvnic_rx_queue_stats {u64 packets;u64 bytes;u64 interrupts; }; +#define NUM_RX_STATS \ + (sizeof(struct ibmvnic_rx_queue_stats) / sizeof(u64)) +struct ibmvnic_acl_buffer {__be32 len;__be32 version;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/109 net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit dd4360c0e8504f2f7639c7f5d07c93cfd6a98333 ]
Restrict the 100Mbit forced-mode workaround to link-down transitions only, to prevent repeated link reset cycles in certain configurations.
The workaround was originally introduced to improve signal reliability when switching cables between long and short distances. It temporarily forces the PHY into 10 Mbps before returning to 100 Mbps.
However, when used with autonegotiating link partners (e.g., Intel i350), executing this workaround on every link change can confuse the partner and cause constant renegotiation loops. This results in repeated link down/up transitions and the PHY never reaching a stable state.
Limit the workaround to only run during the PHY_NOLINK state. This ensures it is triggered only once per link drop, avoiding disruptive toggling while still preserving its intended effect.
Note: I am not able to reproduce the original issue that this workaround addresses. I can only confirm that 100 Mbit mode works correctly in my test setup. Based on code inspection, I assume the workaround aims to reset some internal state machine or signal block by toggling speeds. However, a PHY reset is already performed earlier in the function via phy_init_hw(), which may achieve a similar effect. Without a reproducer, I conservatively keep the workaround but restrict its conditions.
--- drivers/net/phy/microchip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/microchip.c +1 -1
@@ -310,7 +310,7 @@ static void lan88xx_link_change_notify(struct phy_device *phydev)* As workaround, set to 10 before setting to 100 * at forced 100 F/H mode. */ -if (!phydev->autoneg && phydev->speed ==100 ) { +if (phydev->state ==PHY_NOLINK && !phydev->autoneg && phydev->speed ==100 ) {/* disable phy interrupt */ temp =phy_read (phydev,LAN88XX_INT_MASK ); temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_ ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/109 can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
[ Upstream commit 58805e9cbc6f6a28f35d90e740956e983a0e036e ]
Downgrade the "msg lost in rx" message to debug level, to prevent flooding the kernel log with error messages.
--- drivers/net/can/m_can/m_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +1 -1
@@ -606,7 +606,7 @@ static int m_can_handle_lost_msg(struct net_device *dev)struct can_frame *frame;u32 timestamp =0 ; -netdev_err (dev,"msg lost in rxf0\n" ); +netdev_dbg (dev,"msg lost in rxf0\n" ); stats->rx_errors++; stats->rx_over_errors++;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/109 net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit e81750b4e3826fedce7362dad839cb40384d60ae ]
The function ll_temac_ethtools_set_ringparam() incorrectly checked rx_pending twice, once correctly for RX and once mistakenly in place of tx_pending. This caused tx_pending to be left unchecked against TX_BD_NUM_MAX.
As a result, invalid TX ring sizes may have been accepted or valid ones wrongly rejected based on the RX limit, leading to potential misconfiguration or unexpected results.
This patch corrects the condition to properly validate tx_pending.
--- drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/xilinx/ll_temac_main.c +1 -1
@@ -1309,7 +1309,7 @@ ll_temac_ethtools_set_ringparam(struct net_device *ndev,if (ering->rx_pending >RX_BD_NUM_MAX || ering->rx_mini_pending || ering->rx_jumbo_pending || - ering->rx_pending >TX_BD_NUM_MAX ) + ering->tx_pending >TX_BD_NUM_MAX )return -EINVAL ;if (netif_running (ndev))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/109 bnxt_en: Fix DCB ETS validation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shravya KN <[email protected]>
[ Upstream commit b74c2a2e9cc471e847abd87e50a2354c07e02040 ]
In bnxt_ets_validate(), the code incorrectly loops over all possible traffic classes to check and add the ETS settings. Fix it to loop over the configured traffic classes only.
The unconfigured traffic classes will default to TSA_ETS with 0 bandwidth. Looping over these unconfigured traffic classes may cause the validation to fail and trigger this error message:
"rejecting ETS config starving a TC\n"
The .ieee_setets() will then fail.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c +2 -0
@@ -487,7 +487,9 @@ static int bnxt_ets_validate(struct bnxt *bp, struct ieee_ets *ets, u8 *tc)if ((ets->tc_tx_bw[i] || ets->tc_tsa[i]) && i > bp->max_tc)return -EINVAL ; + } +for (i =0 ; i < max_tc; i++) {switch (ets->tc_tsa[i]) {case IEEE_8021QAZ_TSA_STRICT :break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/109 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Somnath Kotur <[email protected]>
[ Upstream commit 3cdf199d4755d477972ee87110b2aebc88b3cfad ]
When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled:
WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP: 0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45
b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00
RSP: 0018:ff22d31181150c88 EFLAGS: 00010206
RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000
R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000
R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00
FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0
PKRU: 55555554
Call Trace: <IRQ> ? show_regs+0x6d/0x80 ? __warn+0x89/0x160 ? __iommu_dma_unmap+0x159/0x170 ? report_bug+0x17e/0x1b0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x18/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? __iommu_dma_unmap+0x159/0x170 ? __iommu_dma_unmap+0xb3/0x170 iommu_dma_unmap_page+0x4f/0x100 dma_unmap_page_attrs+0x52/0x220 ? srso_alias_return_thunk+0x5/0xfbef5 ? xdp_return_frame+0x2e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en]
--- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +1 -1
@@ -115,7 +115,7 @@ static void __bnxt_xmit_xdp_redirect(struct bnxt *bp, tx_buf->action =XDP_REDIRECT ; tx_buf->xdpf = xdpf;dma_unmap_addr_set (tx_buf, mapping, mapping); -dma_unmap_len_set (tx_buf, len,0 ); +dma_unmap_len_set (tx_buf, len, len); }void bnxt_tx_int_xdp (struct bnxt *bp,struct bnxt_napi *bnapi,int budget)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/109 ublk: sanity check add_dev input for underflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronnie Sahlberg <[email protected]>
[ Upstream commit 969127bf0783a4ac0c8a27e633a9e8ea1738583f ]
Add additional checks that queue depth and number of queues are non-zero.
--- drivers/block/ublk_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/ublk_drv.c +2 -1
@@ -2323,7 +2323,8 @@ static int ublk_ctrl_add_dev(struct io_uring_cmd *cmd)if (copy_from_user (&info, argp,sizeof (info)))return -EFAULT ; -if (info.queue_depth >UBLK_MAX_QUEUE_DEPTH || info.nr_hw_queues >UBLK_MAX_NR_QUEUES ) +if (info.queue_depth >UBLK_MAX_QUEUE_DEPTH || !info.queue_depth || + info.nr_hw_queues >UBLK_MAX_NR_QUEUES || !info.nr_hw_queues)return -EINVAL ;if (capable (CAP_SYS_ADMIN ))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/109 atm: idt77252: Add missing `dma_map_error()`
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit c4890963350dcf4e9a909bae23665921fba4ad27 ]
The DMA map functions can fail and should be tested for errors.
--- drivers/atm/idt77252.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/atm/idt77252.c +5 -0
@@ -852,6 +852,8 @@ queue_skb(struct idt77252_dev *card, struct vc_map *vc,IDT77252_PRV_PADDR (skb) =dma_map_single (&card->pcidev->dev, skb->data, skb->len,DMA_TO_DEVICE ); +if (dma_mapping_error (&card->pcidev->dev,IDT77252_PRV_PADDR (skb))) +return -ENOMEM ; error = -EINVAL ;
@@ -1857,6 +1859,8 @@ add_rx_skb(struct idt77252_dev *card, int queue, paddr =dma_map_single (&card->pcidev->dev, skb->data,skb_end_pointer (skb) - skb->data,DMA_FROM_DEVICE ); +if (dma_mapping_error (&card->pcidev->dev, paddr)) + goto outpoolrm;IDT77252_PRV_PADDR (skb) = paddr;if (push_rx_skb (card, skb, queue)) {
@@ -1871,6 +1875,7 @@ add_rx_skb(struct idt77252_dev *card, int queue,dma_unmap_single (&card->pcidev->dev,IDT77252_PRV_PADDR (skb),skb_end_pointer (skb) - skb->data,DMA_FROM_DEVICE ); +outpoolrm: handle =IDT77252_PRV_POOL (skb); card->sbpool[POOL_QUEUE (handle)].skb[POOL_INDEX (handle)] =NULL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/109 um: vector: Reduce stack usage in vector_eth_configure()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <[email protected]>
[ Upstream commit 2d65fc13be85c336c56af7077f08ccd3a3a15a4a ]
When compiling with clang (19.1.7), initializing *vp using a compound literal may result in excessive stack usage. Fix it by initializing the required fields of *vp individually.
Without this patch:
$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0 ... 0x0000000000000540 vector_eth_configure [vector_kern.o]:1472 ...
With this patch:
$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0 ... 0x0000000000000540 vector_eth_configure [vector_kern.o]:208 ...
--- arch/um/drivers/vector_kern.c | 42 +++++++++++------------------------ 1 file changed, 13 insertions(+), 29 deletions(-)
arch/um/drivers/vector_kern.c +13 -29
@@ -1600,35 +1600,19 @@ static void vector_eth_configure( device->dev = dev; - *vp = ((struct vector_private ) - { - .list =LIST_HEAD_INIT (vp->list), - .dev = dev, - .unit = n, - .options =get_transport_options (def), - .rx_irq =0 , - .tx_irq =0 , - .parsed = def, - .max_packet =get_mtu (def) +ETH_HEADER_OTHER , -/* TODO - we need to calculate headroom so that ip header -* is 16 byte aligned all the time -*/ - .headroom =get_headroom (def), - .form_header =NULL , - .verify_header =NULL , - .header_rxbuffer =NULL , - .header_txbuffer =NULL , - .header_size =0 , - .rx_header_size =0 , - .rexmit_scheduled = false, - .opened = false, - .transport_data =NULL , - .in_write_poll = false, - .coalesce =2 , - .req_size =get_req_size (def), - .in_error = false, - .bpf =NULL - }); +INIT_LIST_HEAD (&vp->list); + vp->dev = dev; + vp->unit = n; + vp->options =get_transport_options (def); + vp->parsed = def; + vp->max_packet =get_mtu (def) +ETH_HEADER_OTHER ; +/* +* TODO - we need to calculate headroom so that ip header +* is 16 byte aligned all the time +*/ + vp->headroom =get_headroom (def); + vp->coalesce =2 ; + vp->req_size =get_req_size (def); dev->features = dev->hw_features = (NETIF_F_SG |NETIF_F_FRAGLIST );INIT_WORK (&vp->reset_tx, vector_reset_tx);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/109 io_uring: make fallocate be hashed work
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fengnan Chang <[email protected]>
[ Upstream commit 88a80066af1617fab444776135d840467414beb6 ]
Like ftruncate and write, fallocate operations on the same file cannot be executed in parallel, so it is better to make fallocate be hashed work.
--- io_uring/opdef.c | 1 + 1 file changed, 1 insertion(+)
io_uring/opdef.c +1 -0
@@ -202,6 +202,7 @@ const struct io_issue_def io_issue_defs[] = { }, [IORING_OP_FALLOCATE] = { .needs_file = 1, + .hash_reg_file = 1, .prep = io_fallocate_prep, .issue = io_fallocate, },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/109 ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuzuru10 <[email protected]>
[ Upstream commit 7186b81807b4a08f8bf834b6bdc72d6ed8ba1587 ]
This patch adds DMI-based quirk for the Acer Nitro ANV15-41, allowing the internal microphone to be detected correctly on machines with "RB" as board vendor.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -346,6 +346,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"RB" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Nitro ANV15-41"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/109 ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yasmin Fitzgerald <[email protected]>
[ Upstream commit 68cc9d3c8e44afe90e43cbbd2960da15c2f31e23 ]
The HP Pavilion Laptop 15-eg100 has Realtek HDA codec ALC287. It needs the ALC287_FIXUP_HP_GPIO_LED quirk to enable the mute LED.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10151,6 +10151,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8975 ,"HP EliteBook x360 840 Aero G9" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x897d ,"HP mt440 Mobile Thin Client U74" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8981 ,"HP Elite Dragonfly G3" ,ALC245_FIXUP_CS35L41_SPI_4 ), +SND_PCI_QUIRK (0x103c ,0x898a ,"HP Pavilion 15-eg100" ,ALC287_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x898e ,"HP EliteBook 835 G9" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x898f ,"HP EliteBook 835 G9" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x103c, 0x8991, "HP EliteBook 845 G9", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/109 net: usb: qmi_wwan: add SIMCom 8230C composition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaowei Li <[email protected]>
[ Upstream commit 0b39b055b5b48cbbdf5746a1ca6e3f6b0221e537 ]
Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip. 0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9071 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=none E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1432,6 +1432,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x22de, 0x9051, 2)}, /* Hucom Wireless HM-211S/K */ {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */ + {QMI_QUIRK_SET_DTR(0x1e0e, 0x9071, 3)}, /* SIMCom 8230C ++ */ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/109 HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akira Inoue <[email protected]>
[ Upstream commit a8905238c3bbe13db90065ed74682418f23830c3 ]
Add "Thinkpad X1 Tablet Gen 2 Keyboard" PID to hid-lenovo driver to fix trackpoint not working issue.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-lenovo.c | 8 ++++++++ drivers/hid/hid-multitouch.c | 8 +++++++- 3 files changed, 16 insertions(+), 1 deletion(-)
drivers/hid/hid-ids.h +1 -0
@@ -807,6 +807,7 @@#define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067#define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085#define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3 +#define USB_DEVICE_ID_LENOVO_X1_TAB2 0x60a4#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5#define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe#define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae
drivers/hid/hid-lenovo.c +8 -0
@@ -473,6 +473,7 @@ static int lenovo_input_mapping(struct hid_device *hdev,return lenovo_input_mapping_tp10_ultrabook_kbd (hdev, hi, field, usage, bit, max);case USB_DEVICE_ID_LENOVO_X1_TAB : +case USB_DEVICE_ID_LENOVO_X1_TAB2 :case USB_DEVICE_ID_LENOVO_X1_TAB3 :return lenovo_input_mapping_x1_tab_kbd (hdev, hi, field, usage, bit, max);default :
@@ -587,6 +588,7 @@ static ssize_t attr_fn_lock_store(struct device *dev,break ;case USB_DEVICE_ID_LENOVO_TP10UBKBD :case USB_DEVICE_ID_LENOVO_X1_TAB : +case USB_DEVICE_ID_LENOVO_X1_TAB2 :case USB_DEVICE_ID_LENOVO_X1_TAB3 : ret =lenovo_led_set_tp10ubkbd (hdev,TP10UBKBD_FN_LOCK_LED , value);if (ret)
@@ -782,6 +784,7 @@ static int lenovo_event(struct hid_device *hdev, struct hid_field *field,return lenovo_event_cptkbd (hdev, field, usage, value);case USB_DEVICE_ID_LENOVO_TP10UBKBD :case USB_DEVICE_ID_LENOVO_X1_TAB : +case USB_DEVICE_ID_LENOVO_X1_TAB2 :case USB_DEVICE_ID_LENOVO_X1_TAB3 :return lenovo_event_tp10ubkbd (hdev, field, usage, value);default :
@@ -1065,6 +1068,7 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev,break ;case USB_DEVICE_ID_LENOVO_TP10UBKBD :case USB_DEVICE_ID_LENOVO_X1_TAB : +case USB_DEVICE_ID_LENOVO_X1_TAB2 :case USB_DEVICE_ID_LENOVO_X1_TAB3 : ret =lenovo_led_set_tp10ubkbd (hdev, tp10ubkbd_led[led_nr], value);break ;
@@ -1296,6 +1300,7 @@ static int lenovo_probe(struct hid_device *hdev,break ;case USB_DEVICE_ID_LENOVO_TP10UBKBD :case USB_DEVICE_ID_LENOVO_X1_TAB : +case USB_DEVICE_ID_LENOVO_X1_TAB2 :case USB_DEVICE_ID_LENOVO_X1_TAB3 : ret =lenovo_probe_tp10ubkbd (hdev);break ;
@@ -1383,6 +1388,7 @@ static void lenovo_remove(struct hid_device *hdev)break ;case USB_DEVICE_ID_LENOVO_TP10UBKBD :case USB_DEVICE_ID_LENOVO_X1_TAB : +case USB_DEVICE_ID_LENOVO_X1_TAB2 :case USB_DEVICE_ID_LENOVO_X1_TAB3 :lenovo_remove_tp10ubkbd (hdev);break ;
@@ -1433,6 +1439,8 @@ static const struct hid_device_id lenovo_devices[] = {*/ {HID_DEVICE (BUS_USB ,HID_GROUP_GENERIC , USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB2) }, { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB3) }, { }
drivers/hid/hid-multitouch.c +7 -1
@@ -2110,12 +2110,18 @@ static const struct hid_device_id mt_devices[] = { HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC, USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_7010) }, -/* Lenovo X1 TAB Gen 2 */ +/* Lenovo X1 TAB Gen 1 */ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,HID_DEVICE (BUS_USB ,HID_GROUP_MULTITOUCH_WIN_8 ,USB_VENDOR_ID_LENOVO , USB_DEVICE_ID_LENOVO_X1_TAB) }, + /* Lenovo X1 TAB Gen 2 */ + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, +HID_DEVICE (BUS_USB ,HID_GROUP_MULTITOUCH_WIN_8 , +USB_VENDOR_ID_LENOVO , + USB_DEVICE_ID_LENOVO_X1_TAB2) }, + /* Lenovo X1 TAB Gen 3 */ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/109 net: mana: Record doorbell physical address in PF mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit e0fca6f2cebff539e9317a15a37dcf432e3b851a ]
MANA supports RDMA in PF mode. The driver should record the doorbell physical address when in PF mode.
The doorbell physical address is used by the RDMA driver to map doorbell pages of the device to user-mode applications through RDMA verbs interface. In the past, they have been mapped to user-mode while the device is in VF mode. With the support for PF mode implemented, also expose those pages in PF mode.
Support for PF mode is implemented in290e5d3c49f6 ("net: mana: Add support for Multi Vports on Bare metal")
--- drivers/net/ethernet/microsoft/mana/gdma_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/microsoft/mana/gdma_main.c +3 -0
@@ -28,6 +28,9 @@ static void mana_gd_init_pf_regs(struct pci_dev *pdev) gc->db_page_base = gc->bar0_va +mana_gd_r64 (gc,GDMA_PF_REG_DB_PAGE_OFF ); + gc->phys_db_page_base = gc->bar0_pa + +mana_gd_r64 (gc,GDMA_PF_REG_DB_PAGE_OFF ); + sriov_base_off =mana_gd_r64 (gc,GDMA_SRIOV_REG_CFG_BASE_OFF ); sriov_base_va = gc->bar0_va + sriov_base_off;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/109 btrfs: fix assertion when building free space tree
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 1961d20f6fa8903266ed9bd77c691924c22c8f02 ]
When building the free space tree with the block group tree feature enabled, we can hit an assertion failure like this:
BTRFS info (device loop0 state M): rebuilding free space tree assertion failed: ret == 0, in fs/btrfs/free-space-tree.c:1102
------------[ cut here ]------------ kernel BUG at fs/btrfs/free-space-tree.c:1102! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Modules linked in: CPU: 1 UID: 0 PID: 6592 Comm: syz-executor322 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : populate_free_space_tree+0x514/0x518 fs/btrfs/free-space-tree.c:1102 lr : populate_free_space_tree+0x514/0x518 fs/btrfs/free-space-tree.c:1102 sp : ffff8000a4ce7600 x29: ffff8000a4ce76e0 x28: ffff0000c9bc6000 x27: ffff0000ddfff3d8 x26: ffff0000ddfff378 x25: dfff800000000000 x24: 0000000000000001 x23: ffff8000a4ce7660 x22: ffff70001499cecc x21: ffff0000e1d8c160 x20: ffff0000e1cb7800 x19: ffff0000e1d8c0b0 x18: 00000000ffffffff x17: ffff800092f39000 x16: ffff80008ad27e48 x15: ffff700011e740c0 x14: 1ffff00011e740c0 x13: 0000000000000004 x12: ffffffffffffffff x11: ffff700011e740c0 x10: 0000000000ff0100 x9 : 94ef24f55d2dbc00 x8 : 94ef24f55d2dbc00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000a4ce6f98 x4 : ffff80008f415ba0 x3 : ffff800080548ef0 x2 : 0000000000000000 x1 : 0000000100000000 x0 : 000000000000003e Call trace: populate_free_space_tree+0x514/0x518 fs/btrfs/free-space-tree.c:1102 (P) btrfs_rebuild_free_space_tree+0x14c/0x54c fs/btrfs/free-space-tree.c:1337 btrfs_start_pre_rw_mount+0xa78/0xe10 fs/btrfs/disk-io.c:3074 btrfs_remount_rw fs/btrfs/super.c:1319 [inline] btrfs_reconfigure+0x828/0x2418 fs/btrfs/super.c:1543 reconfigure_super+0x1d4/0x6f0 fs/super.c:1083 do_remount fs/namespace.c:3365 [inline] path_mount+0xb34/0xde0 fs/namespace.c:4200 do_mount fs/namespace.c:4221 [inline] __do_sys_mount fs/namespace.c:4432 [inline] __se_sys_mount fs/namespace.c:4409 [inline] __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4409 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Code: f0047182 91178042 528089c3 9771d47b (d4210000) ---[ end trace 0000000000000000 ]---
This happens because we are processing an empty block group, which has no extents allocated from it, there are no items for this block group, including the block group item since block group items are stored in a dedicated tree when using the block group tree feature. It also means this is the block group with the highest start offset, so there are no higher keys in the extent root, hence btrfs_search_slot_for_read() returns 1 (no higher key found).
Fix this by asserting 'ret' is 0 only if the block group tree feature is not enabled, in which case we should find a block group item for the block group since it's stored in the extent root and block group item keys are greater than extent item keys (the value for BTRFS_BLOCK_GROUP_ITEM_KEY is 192 and for BTRFS_EXTENT_ITEM_KEY and BTRFS_METADATA_ITEM_KEY the values are 168 and 169 respectively). In case 'ret' is 1, we just need to add a record to the free space tree which spans the whole block group, and we can achieve this by making 'ret == 0' as the while loop's condition.
--- fs/btrfs/free-space-tree.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
fs/btrfs/free-space-tree.c +12 -4
@@ -1104,11 +1104,21 @@ static int populate_free_space_tree(struct btrfs_trans_handle *trans, ret =btrfs_search_slot_for_read (extent_root, &key, path,1 ,0 );if (ret <0 ) goto out_locked; -ASSERT (ret ==0 ); +/* +* If ret is 1 (no key found), it means this is an empty block group, +* without any extents allocated from it and there's no block group +* item (key BTRFS_BLOCK_GROUP_ITEM_KEY) located in the extent tree +* because we are using the block group tree feature, so block group +* items are stored in the block group tree. It also means there are no +* extents allocated for block groups with a start offset beyond this +* block group's end offset (this is the last, highest, block group). +*/ +if (!btrfs_fs_compat_ro (trans->fs_info,BLOCK_GROUP_TREE )) +ASSERT (ret ==0 ); start = block_group->start; end = block_group->start + block_group->length; -while (1 ) { +while (ret ==0 ) {btrfs_item_key_to_cpu (path->nodes[0 ], &key, path->slots[0 ]); if (key.type == BTRFS_EXTENT_ITEM_KEY ||
@@ -1138,8 +1148,6 @@ static int populate_free_space_tree(struct btrfs_trans_handle *trans, ret =btrfs_next_item (extent_root, path);if (ret <0 ) goto out_locked; -if (ret) -break ; }if (start < end) { ret = __add_to_free_space_tree(trans, block_group, path2,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/109 vt: add missing notification when switching back to text mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Pitre <[email protected]>
[ Upstream commit ff78538e07fa284ce08cbbcb0730daa91ed16722 ]
Programs using poll() on /dev/vcsa to be notified when VT changes occur were missing one case: the switch from gfx to text mode.
--- drivers/tty/vt/vt.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/vt/vt.c +1 -0
@@ -4392,6 +4392,7 @@ void do_unblank_screen(int leaving_gfx)set_palette (vc);set_cursor (vc);vt_event_post (VT_EVENT_UNBLANK , vc->vc_num, vc->vc_num); +notify_update (vc); }EXPORT_SYMBOL (do_unblank_screen);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/109 bpf: Adjust free target to avoid global starvation of LRU map
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit d4adf1c9ee7722545450608bcb095fb31512f0c6 ]
BPF_MAP_TYPE_LRU_HASH can recycle most recent elements well before the map is full, due to percpu reservations and force shrink before neighbor stealing. Once a CPU is unable to borrow from the global map, it will once steal one elem from a neighbor and after that each time flush this one element to the global list and immediately recycle it.
Batch value LOCAL_FREE_TARGET (128) will exhaust a 10K element map with 79 CPUs. CPU 79 will observe this behavior even while its neighbors hold 78 * 127 + 1 * 15 == 9921 free elements (99%).
CPUs need not be active concurrently. The issue can appear with affinity migration, e.g., irqbalance. Each CPU can reserve and then hold onto its 128 elements indefinitely.
Avoid global list exhaustion by limiting aggregate percpu caches to half of map size, by adjusting LOCAL_FREE_TARGET based on cpu count. This change has no effect on sufficiently large tables.
Similar to LOCAL_NR_SCANS and lru->nr_scans, introduce a map variable lru->free_target. The extra field fits in a hole in struct bpf_lru. The cacheline is already warm where read in the hot path. The field is only accessed with the lru lock held.
--- Documentation/bpf/map_hash.rst | 8 ++- Documentation/bpf/map_lru_hash_update.dot | 6 +- kernel/bpf/bpf_lru_list.c | 9 ++- kernel/bpf/bpf_lru_list.h | 1 + tools/testing/selftests/bpf/test_lru_map.c | 72 +++++++++++----------- 5 files changed, 52 insertions(+), 44 deletions(-)
Documentation/bpf/map_hash.rst +7 -1
@@ -233,10 +233,16 @@ attempts in order to enforce the LRU property which have increasing impacts on other CPUs involved in the following operation attempts: - Attempt to use CPU-local state to batch operations -- Attempt to fetch free nodes from global lists +- Attempt to fetch ``target_free`` free nodes from global lists - Attempt to pull any node from a global list and remove it from the hashmap - Attempt to pull any node from any CPU's list and remove it from the hashmap +The number of nodes to borrow from the global list in a batch, ``target_free``, +depends on the size of the map. Larger batch size reduces lock contention, but +may also exhaust the global structure. The value is computed at map init to +avoid exhaustion, by limiting aggregate reservation by all CPUs to half the map +size. With a minimum of a single element and maximum budget of 128 at a time. + This algorithm is described visually in the following diagram. See the description in commit 3a08c2fd7634 ("bpf: LRU List") for a full explanation of the corresponding operations:
Documentation/bpf/map_lru_hash_update.dot +3 -3
@@ -35,18 +35,18 @@ digraph { fn_bpf_lru_list_pop_free_to_local [shape=rectangle,fillcolor=2, label="Flush local pending, Rotate Global list, move - LOCAL_FREE_TARGET + target_free from global -> local"] // Also corresponds to: // fn__local_list_flush() // fn_bpf_lru_list_rotate() fn___bpf_lru_node_move_to_free[shape=diamond,fillcolor=2, - label="Able to free\nLOCAL_FREE_TARGET\nnodes?"] + label="Able to free\ntarget_free\nnodes?"] fn___bpf_lru_list_shrink_inactive [shape=rectangle,fillcolor=3, label="Shrink inactive list up to remaining - LOCAL_FREE_TARGET + target_free (global LRU -> local)"] fn___bpf_lru_list_shrink [shape=diamond,fillcolor=2, label="> 0 entries in\nlocal free list?"]
kernel/bpf/bpf_lru_list.c +6 -3
@@ -337,12 +337,12 @@ static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru, list) {__bpf_lru_node_move_to_free (l, node,local_free_list (loc_l),BPF_LRU_LOCAL_LIST_T_FREE ); -if (++nfree ==LOCAL_FREE_TARGET ) +if (++nfree == lru->target_free)break ; } -if (nfree <LOCAL_FREE_TARGET ) -__bpf_lru_list_shrink (lru, l,LOCAL_FREE_TARGET - nfree, +if (nfree < lru->target_free) +__bpf_lru_list_shrink (lru, l, lru->target_free - nfree,local_free_list (loc_l),BPF_LRU_LOCAL_LIST_T_FREE );
@@ -577,6 +577,9 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf,list_add (&node->list, &l->lists[BPF_LRU_LIST_T_FREE ]); buf += elem_size; } + + lru->target_free =clamp ((nr_elems /num_possible_cpus ()) /2 , +1 ,LOCAL_FREE_TARGET ); } static void bpf_percpu_lru_populate(struct bpf_lru *lru, void *buf,
kernel/bpf/bpf_lru_list.h +1 -0
@@ -58,6 +58,7 @@ struct bpf_lru {del_from_htab_func del_from_htab;void *del_arg;unsigned int hash_offset; +unsigned int target_free;unsigned int nr_scans;bool percpu; };
tools/testing/selftests/bpf/test_lru_map.c +35 -37
156 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/109 HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
[ Upstream commit 1a8953f4f7746c6a515989774fe03047c522c613 ]
MARTLINKTECHNOLOGY is a microphone device, when the HID interface in an audio device is requested to get specific report id, the following error may occur.
[ 562.939373] usb 1-1.4.1.2: new full-speed USB device number 21 using xhci_hcd [ 563.104908] usb 1-1.4.1.2: New USB device found, idVendor=4c4a, idProduct=4155, bcdDevice= 1.00 [ 563.104910] usb 1-1.4.1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.104911] usb 1-1.4.1.2: Product: USB Composite Device [ 563.104912] usb 1-1.4.1.2: Manufacturer: SmartlinkTechnology [ 563.104913] usb 1-1.4.1.2: SerialNumber: 20201111000001 [ 563.229499] input: SmartlinkTechnology USB Composite Device as /devices/pci0000:00/0000:00:07.1/0000:04:00.3/usb1/1-1/1-1.4/1-1.4.1/1-1.4.1.2/1-1.4.1.2:1.2/0003:4C4A:4155.000F/input/input35 [ 563.291505] hid-generic 0003:4C4A:4155.000F: input,hidraw2: USB HID v2.01 Keyboard [SmartlinkTechnology USB Composite Device] on usb-0000:04:00.3-1.4.1.2/input2 [ 563.291557] usbhid 1-1.4.1.2:1.3: couldn't find an input interrupt endpoint [ 568.506654] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 573.626656] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 578.746657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 583.866655] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 588.986657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
Ignore HID interface. The device is working properly.
--- drivers/hid/hid-ids.h | 3 +++ drivers/hid/hid-quirks.c | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +3 -0
@@ -1502,4 +1502,7 @@#define USB_VENDOR_ID_SIGNOTEC 0x2133#define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018 +#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a +#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155 +#endif
drivers/hid/hid-quirks.c +1 -0
@@ -894,6 +894,7 @@ static const struct hid_device_id hid_ignore_list[] = {#endif { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, + { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) }, { } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/109 HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chia-Lin Kao (AceLan) <[email protected]>
[ Upstream commit 54bae4c17c11688339eb73a04fd24203bb6e7494 ]
The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor.
Add these 2 devices to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace.
--- drivers/hid/hid-ids.h | 2 ++ drivers/hid/hid-quirks.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +2 -0
@@ -305,6 +305,8 @@#define USB_DEVICE_ID_ASUS_AK1D 0x1125#define USB_DEVICE_ID_CHICONY_TOSHIBA_WT10A 0x1408#define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421 +#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA 0xb824 +#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2 0xb82c#define USB_VENDOR_ID_CHUNGHWAT 0x2247#define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH 0x0001
drivers/hid/hid-quirks.c +2 -0
@@ -747,6 +747,8 @@ static const struct hid_device_id hid_ignore_list[] = { { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) }, { HID_USB_DEVICE(USB_VENDOR_ID_AXENTIA, USB_DEVICE_ID_AXENTIA_FM_RADIO) }, { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2) }, { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) }, { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) }, { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI4713) },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/109 Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 upstream.
After commit 936e4d49ecbc ("Input: atkbd - skip ATKBD_CMD_GETID in translated mode") not only the getid command is skipped, but also the de-activating of the keyboard at the end of atkbd_probe(), potentially re-introducing the problem fixed by commit be2d7e4233a4 ("Input: atkbd - fix multi-byte scancode handling on reconnect").
Make sure multi-byte scancode handling on reconnect is still handled correctly by not skipping the atkbd_deactivate() call.
--- drivers/input/keyboard/atkbd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/input/keyboard/atkbd.c +2 -1
@@ -826,7 +826,7 @@ static int atkbd_probe(struct atkbd *atkif (atkbd_skip_getid (atkbd)) { atkbd->id =0xab83 ; -return 0 ; + goto deactivate_kbd; }/*
@@ -863,6 +863,7 @@ static int atkbd_probe(struct atkbd *atkreturn -1 ; } +deactivate_kbd:/* * Make sure nothing is coming from the keyboard and disturbs our * internal state.
Greg Kroah-Hartman
maintainerPATCH 106/109 selftests/bpf: adapt one more case in test_lru_map to the new target_free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
commit 5e9388f7984a9cc7e659a105113f6ccf0aebedd0 upstream.
The below commit that updated BPF_MAP_TYPE_LRU_HASH free target, also updated tools/testing/selftests/bpf/test_lru_map to match.
But that missed one case that passes with 4 cores, but fails at higher cpu counts.
Update test_lru_sanity3 to also adjust its expectation of target_free.
This time tested with 1, 4, 16, 64 and 384 cpu count.
--- tools/testing/selftests/bpf/test_lru_map.c | 33 +++++++++++++++-------------- 1 file changed, 18 insertions(+), 15 deletions(-)
tools/testing/selftests/bpf/test_lru_map.c +18 -15
@@ -138,6 +138,12 @@ static int sched_next_online(int pid, inreturn ret; } +/* Derive target_free from map_size, same as bpf_common_lru_populate */ +static unsigned int __tgt_size (unsigned int map_size) +{ +return (map_size / nr_cpus) /2 ; +} +/* Inverse of how bpf_common_lru_populate derives target_free from map_size. */ static unsigned int __map_size (unsigned int tgt_free) {
@@ -410,12 +416,12 @@ static void test_lru_sanity2(int map_typprintf ("Pass\n" ); } -/* Size of the LRU map is 2*tgt_free -* It is to test the active/inactive list rotation -* Insert 1 to 2*tgt_free (+2*tgt_free keys) -* Lookup key 1 to tgt_free*3/2 -* Add 1+2*tgt_free to tgt_free*5/2 (+tgt_free/2 keys) -* => key 1+tgt_free*3/2 to 2*tgt_free are removed from LRU +/* Test the active/inactive list rotation +* +* Fill the whole map, deplete the free list. +* Reference all except the last lru->target_free elements. +* Insert lru->target_free new elements. This triggers one shrink. +* Verify that the non-referenced elements are replaced. */ static void test_lru_sanity3 (int map_type,int map_flags,unsigned int tgt_free) {
@@ -434,8 +440,7 @@ static void test_lru_sanity3(int map_typassert (sched_next_online (0 , &next_cpu) !=-1 ); - batch_size = tgt_free /2 ; -assert (batch_size *2 == tgt_free); + batch_size =__tgt_size (tgt_free); map_size = tgt_free *2 ; lru_map_fd =create_map (map_type, map_flags, map_size);
@@ -446,23 +451,21 @@ static void test_lru_sanity3(int map_typ value[0 ] =1234 ; -/* Insert 1 to 2*tgt_free (+2*tgt_free keys) */ - end_key =1 + (2 * tgt_free); +/* Fill the map */ + end_key =1 + map_size;for (key =1 ; key < end_key; key++)assert (!bpf_map_update_elem (lru_map_fd, &key, value,BPF_NOEXIST )); -/* Lookup key 1 to tgt_free*3/2 */ - end_key = tgt_free + batch_size; +/* Reference all but the last batch_size */ + end_key =1 + map_size - batch_size;for (key =1 ; key < end_key; key++) {assert (!bpf_map_lookup_elem_with_ref_bit (lru_map_fd, key, value));assert (!bpf_map_update_elem (expected_map_fd, &key, value,BPF_NOEXIST )); } -/* Add 1+2*tgt_free to tgt_free*5/2 -* (+tgt_free/2 keys) -*/ +/* Insert new batch_size: replaces the non-referenced elements */ key =2 * tgt_free +1 ; end_key = key + batch_size;for (; key < end_key; key++) {
Greg Kroah-Hartman
maintainerPATCH 107/109 smb: client: fix potential race in cifs_put_tcon()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
commit c32b624fa4f7ca5a2ff217a0b1b2f1352bb4ec11 upstream.
dfs_cache_refresh() delayed worker could race with cifs_put_tcon(), so make sure to call list_replace_init() on @tcon->dfs_ses_list after kworker is cancelled or finished.
--- fs/smb/client/connect.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/smb/client/connect.c +1 -3
@@ -2557,9 +2557,6 @@ cifs_put_tcon(struct cifs_tcon *tcon, enlist_del_init (&tcon->tcon_list); tcon->status =TID_EXITING ; -#ifdef CONFIG_CIFS_DFS_UPCALL -list_replace_init (&tcon->dfs_ses_list, &ses_list); -#endif spin_unlock (&tcon->tc_lock);spin_unlock (&cifs_tcp_ses_lock);
@@ -2567,6 +2564,7 @@ cifs_put_tcon(struct cifs_tcon *tcon, encancel_delayed_work_sync (&tcon->query_interfaces);#ifdef CONFIG_CIFS_DFS_UPCALL cancel_delayed_work_sync (&tcon->dfs_cache_work); +list_replace_init (&tcon->dfs_ses_list, &ses_list);#endif if (tcon->use_witness) {
Greg Kroah-Hartman
maintainerPATCH 108/109 kasan: remove kasan_find_vm_area() to prevent possible deadlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeoreum Yun <[email protected]>
commit 6ee9b3d84775944fb8c8a447961cd01274ac671c upstream.
find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like:
CPU0 CPU1vmalloc();
alloc_vmap_area();
spin_lock(&vn->busy.lock)
spin_lock_bh(&some_lock);
<interrupt occurs>
<in softirq>
spin_lock(&some_lock);
<access invalid address>
kasan_report();
print_report();
print_address_description();
kasan_find_vm_area();
find_vm_area();
spin_lock(&vn->busy.lock) // deadlock!To prevent possible deadlock while kasan reports, remove kasan_find_vm_area().
--- mm/kasan/report.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
mm/kasan/report.c +2 -11
@@ -385,17 +385,8 @@ static void print_address_description(vo }if (is_vmalloc_addr (addr)) { -struct vm_struct *va =find_vm_area (addr); - -if (va) { -pr_err ("The buggy address belongs to the virtual mapping at\n" -" [%px, %px) created by:\n" -" %pS\n" , - va->addr, va->addr + va->size, va->caller); -pr_err ("\n" ); - - page =vmalloc_to_page (addr); - } +pr_err ("The buggy address %px belongs to a vmalloc virtual mapping\n" , addr); + page =vmalloc_to_page (addr); }if (page) {
Greg Kroah-Hartman
maintainerPATCH 109/109 ksmbd: fix potential use-after-free in oplock/lease break ack
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit 50f930db22365738d9387c974416f38a06e8057e upstream.
If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice.
--- fs/smb/server/smb2pdu.c | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-)
fs/smb/server/smb2pdu.c +9 -20
@@ -8503,11 +8503,6 @@ static void smb20_oplock_break_ack(struc goto err_out; } - opinfo->op_state =OPLOCK_STATE_NONE ; -wake_up_interruptible_all (&opinfo->oplock_q); -opinfo_put (opinfo); -ksmbd_fd_put (work, fp); - rsp->StructureSize =cpu_to_le16 (24 ); rsp->OplockLevel = rsp_oplevel; rsp->Reserved =0 ;
@@ -8515,16 +8510,15 @@ static void smb20_oplock_break_ack(struc rsp->VolatileFid = volatile_id; rsp->PersistentFid = persistent_id; ret =ksmbd_iov_pin_rsp (work, rsp,sizeof (struct smb2_oplock_break )); -if (!ret) -return ; - +if (ret) { err_out: +smb2_set_err_rsp (work); + } + opinfo->op_state =OPLOCK_STATE_NONE ;wake_up_interruptible_all (&opinfo->oplock_q); -opinfo_put (opinfo);ksmbd_fd_put (work, fp); -smb2_set_err_rsp (work); }static int check_lease_state (struct lease *lease,__le32 req_state)
@@ -8654,11 +8648,6 @@ static void smb21_lease_break_ack(struct } lease_state = lease->state; - opinfo->op_state =OPLOCK_STATE_NONE ; -wake_up_interruptible_all (&opinfo->oplock_q); -atomic_dec (&opinfo->breaking_cnt); -wake_up_interruptible_all (&opinfo->oplock_brk); -opinfo_put (opinfo); rsp->StructureSize =cpu_to_le16 (36 ); rsp->Reserved =0 ;
@@ -8667,16 +8656,16 @@ static void smb21_lease_break_ack(struct rsp->LeaseState = lease_state; rsp->LeaseDuration =0 ; ret =ksmbd_iov_pin_rsp (work, rsp,sizeof (struct smb2_lease_ack )); -if (!ret) -return ; - +if (ret) { err_out: +smb2_set_err_rsp (work); + } + + opinfo->op_state =OPLOCK_STATE_NONE ;wake_up_interruptible_all (&opinfo->oplock_q);atomic_dec (&opinfo->breaking_cnt);wake_up_interruptible_all (&opinfo->oplock_brk); -opinfo_put (opinfo); -smb2_set_err_rsp (work); }/**
Quoted 8 lines · On Tue, 15 Jul 2025 15:12:16 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.6.99 release. There are 109 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 17 Jul 2025 13:07:32 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64:
Thanks!
Cheers,
Miguel
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.99 release. There are 109 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 17 Jul 2025 13:07:32 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.99-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah