6.15.8-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 6.15.8-rc1 review
This is the start of the stable review cycle for the 6.15.8 release. There are 187 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 24 Jul 2025 13:43:10 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.15.8-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.15.8-rc1
Stefan Metzmacher <[email protected]>
smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data
Matthew Brost <[email protected]>
drm/xe: Move page fault init after topology init
Balasubramani Vivekanandan <[email protected]>
drm/xe/mocs: Initialize MOCS index early
Breno Leitao <[email protected]>
sched/ext: Prevent update_locked_rq() calls with NULL rq
Chen Ridong <[email protected]>
sched,freezer: Remove unnecessary warning in __thaw_task
David Howells <[email protected]>
cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code
David Howells <[email protected]>
cifs: Fix the smbd_response slab to allow usercopy
Stefan Metzmacher <[email protected]>
smb: client: make use of common smbdirect_socket_parameters
Stefan Metzmacher <[email protected]>
smb: smbdirect: introduce smbdirect_socket_parameters
Stefan Metzmacher <[email protected]>
smb: client: make use of common smbdirect_socket
Stefan Metzmacher <[email protected]>
smb: smbdirect: add smbdirect_socket.h
Stefan Metzmacher <[email protected]>
smb: smbdirect: add smbdirect.h with public structures
Stefan Metzmacher <[email protected]>
smb: client: make use of common smbdirect_pdu.h
Stefan Metzmacher <[email protected]>
smb: smbdirect: add smbdirect_pdu.h with protocol definitions
Miguel Ojeda <[email protected]>
rust: use #[used(compiler)] to fix build and modpost with Rust >= 1.89.0
Jiawen Wu <[email protected]>
net: libwx: fix multicast packets received count
Krishna Kurapati <[email protected]>
usb: dwc3: qcom: Don't leave BCR asserted
Mathias Nyman <[email protected]>
usb: hub: Don't try to recover devices lost during warm reset.
Mathias Nyman <[email protected]>
usb: hub: Fix flushing of delayed work used for post resume purposes
Mathias Nyman <[email protected]>
usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
Mathias Nyman <[email protected]>
usb: hub: fix detection of high tier USB3 devices behind suspended hubs
Aruna Ramakrishna <[email protected]>
sched: Change nr_uninterruptible type to unsigned long
Breno Leitao <[email protected]>
efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
Andrii Nakryiko <[email protected]>
libbpf: Fix handling of BPF arena relocations
Icenowy Zheng <[email protected]>
drm/mediatek: only announce AFBC if really supported
Jason-JH Lin <[email protected]>
drm/mediatek: Add wait_event_timeout when disabling plane
Chen Ridong <[email protected]>
Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
David Howells <[email protected]>
rxrpc: Fix to use conn aborts for conn-wide failures
David Howells <[email protected]>
rxrpc: Fix transmission of an abort in response to an abort
David Howells <[email protected]>
rxrpc: Fix notification vs call-release vs recvmsg
David Howells <[email protected]>
rxrpc: Fix recv-recv race of completed call
David Howells <[email protected]>
rxrpc: Fix irq-disabled in local_bh_enable()
William Liu <[email protected]>
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
Joseph Huang <[email protected]>
net: bridge: Do not offload IGMP/MLD messages
Dong Chenchen <[email protected]>
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
Jakub Kicinski <[email protected]>
tls: always refresh the queue when reading sock
Zigit Zo <[email protected]>
virtio-net: fix recursived rtnl_lock() during probe()
Li Tian <[email protected]>
hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
Michal Wajdeczko <[email protected]>
drm/xe/pf: Resend PF provisioning after GT reset
Michal Wajdeczko <[email protected]>
drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
Tejas Upadhyay <[email protected]>
drm/xe: Dont skip TLB invalidations on VF
Florian Westphal <[email protected]>
netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
Felix Fietkau <[email protected]>
net: fix segmentation after TCP/UDP fraglist GRO
Yue Haibing <[email protected]>
ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
Alok Tiwari <[email protected]>
net: airoha: fix potential use-after-free in airoha_npu_get()
Christoph Paasch <[email protected]>
net/mlx5: Correctly set gso_size when LRO is used
Zijun Hu <[email protected]>
Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
Christian Eggers <[email protected]>
Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap
Christian Eggers <[email protected]>
Bluetooth: hci_core: add missing braces when using macro parameters
Christian Eggers <[email protected]>
Bluetooth: hci_core: fix typos in macros
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SMP: If an unallowed command is received consider it a failure
Alessandro Gasbarroni <[email protected]>
Bluetooth: hci_sync: fix connectable extended advertising when using static random address
Kuniyuki Iwashima <[email protected]>
Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
Andreas Schwab <[email protected]>
riscv: traps_misaligned: properly sign extend value in misaligned load handler
Nam Cao <[email protected]>
riscv: Enable interrupt during exception handling
Ming Lei <[email protected]>
loop: use kiocb helpers to fix lockdep warning
Oliver Neukum <[email protected]>
usb: net: sierra: check for no status endpoint
Michal Swiatkowski <[email protected]>
ice: check correct pointer in fwlog debugfs
Dave Ertman <[email protected]>
ice: add NULL check in eswitch lag check
Marius Zachmann <[email protected]>
hwmon: (corsair-cpro) Validate the size of the received input buffer
Paolo Abeni <[email protected]>
selftests: net: increase inter-packet timeout in udpgro.sh
Brett Werling <[email protected]>
can: tcan4x5x: fix reset gpio usage during probe
Johannes Berg <[email protected]>
wifi: cfg80211: remove scan request n_channels counted_by
Maurizio Lombardi <[email protected]>
nvmet-tcp: fix callback lock for TLS handshake
Yu Kuai <[email protected]>
nvme: fix misaccounting of nvme-mpath inflight I/O
Christoph Hellwig <[email protected]>
nvme: revert the cross-controller atomic write size validation
Sean Anderson <[email protected]>
net: phy: Don't register LEDs for genphy
Kuniyuki Iwashima <[email protected]>
smc: Fix various oops due to inet_sock type confusion.
John Garry <[email protected]>
nvme: fix endianness of command word prints in nvme_log_err_passthru()
Zheng Qixing <[email protected]>
nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
Al Viro <[email protected]>
fix a leak in fcntl_dirnotify()
Wang Zhaolong <[email protected]>
smb: client: fix use-after-free in cifs_oplock_break
Kuniyuki Iwashima <[email protected]>
rpl: Fix use-after-free in rpl_do_srh_inline().
Xiang Mei <[email protected]>
net/sched: sch_qfq: Fix race condition on qfq_aggregate
Ming Lei <[email protected]>
block: fix kobject leak in blk_unregister_queue
Alok Tiwari <[email protected]>
net: emaclite: Fix missing pointer increment in aligned_read()
Arnd Bergmann <[email protected]>
ALSA: compress_offload: tighten ioctl command number checks
Zizhi Wo <[email protected]>
cachefiles: Fix the incorrect return value in __cachefiles_write()
Pagadala Yesu Anjaneyulu <[email protected]>
wifi: iwlwifi: mask reserved bits in chan_state_active_bitmap
Andrea Righi <[email protected]>
selftests/sched_ext: Fix exit selftest hang on UP
Paul Chaignon <[email protected]>
bpf: Reject %p% format string in bprintf-like helpers
Richard Zhu <[email protected]>
arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep
Wei Fang <[email protected]>
arm64: dts: imx95-15x15-evk: fix the overshoot issue of NETC
Wei Fang <[email protected]>
arm64: dts: imx95-19x19-evk: fix the overshoot issue of NETC
Vijendar Mukunda <[email protected]>
soundwire: amd: fix for clearing command status register
Dmitry Baryshkov <[email protected]>
phy: use per-PHY lockdep keys
Vijendar Mukunda <[email protected]>
soundwire: amd: fix for handling slave alerts after link is down
Andy Yan <[email protected]>
arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
Andy Yan <[email protected]>
arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
Ian Abbott <[email protected]>
comedi: Fix initialization of data for instructions that write to subdevice
Ian Abbott <[email protected]>
comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
Ian Abbott <[email protected]>
comedi: Fix some signed shift left operations
Ian Abbott <[email protected]>
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
Ian Abbott <[email protected]>
comedi: comedi_test: Fix possible deletion of uninitialized timers
Ian Abbott <[email protected]>
comedi: das6402: Fix bit shift out of bounds
Ian Abbott <[email protected]>
comedi: das16m1: Fix bit shift out of bounds
Ian Abbott <[email protected]>
comedi: aio_iiro_16: Fix bit shift out of bounds
Ian Abbott <[email protected]>
comedi: pcl812: Fix bit shift out of bounds
Maud Spierings <[email protected]>
iio: common: st_sensors: Fix use of uninitialize device structs
Markus Burri <[email protected]>
iio: backend: fix out-of-bound write
Chen Ni <[email protected]>
iio: adc: stm32-adc: Fix race in installing chained IRQ handler
Fabio Estevam <[email protected]>
iio: adc: max1363: Reorder mode_list[] entries
Fabio Estevam <[email protected]>
iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
Chen-Yu Tsai <[email protected]>
iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
David Lechner <[email protected]>
iio: adc: adi-axi-adc: fix ad7606_bus_reg_read()
David Lechner <[email protected]>
iio: adc: ad7380: fix adi,gain-milli property parsing
Sean Nyekjaer <[email protected]>
iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
Christoph Hellwig <[email protected]>
xfs: don't allocate the xfs_extent_busy structure for zoned RTGs
Amit Pundir <[email protected]>
soundwire: Revert "soundwire: qcom: Add set_channel_map api support"
Andrew Jeffery <[email protected]>
soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
Andrew Jeffery <[email protected]>
soc: aspeed: lpc-snoop: Cleanup resources in stack-order
Wang Zhaolong <[email protected]>
smb: client: fix use-after-free in crypt_message when using async crypto
Ilya Leoshkevich <[email protected]>
s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
Maulik Shah <[email protected]>
pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
Jiawen Wu <[email protected]>
net: libwx: properly reset Rx ring descriptor
Jiawen Wu <[email protected]>
net: libwx: fix the using of Rx buffer DMA
Jiawen Wu <[email protected]>
net: libwx: remove duplicate page_pool_put_full_page()
Markus Blöchl <[email protected]>
net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback
Judith Mendez <[email protected]>
mmc: sdhci_am654: Workaround for Errata i2312
Edson Juliano Drosdeck <[email protected]>
mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
Thomas Fourier <[email protected]>
mmc: bcm2835: Fix dma_unmap_sg() nents value
Nathan Chancellor <[email protected]>
memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
Jan Kara <[email protected]>
isofs: Verify inode mode when loading from disk
Dan Carpenter <[email protected]>
dmaengine: nbpfaxi: Fix memory corruption in probe()
Qiu-ji Chen <[email protected]>
dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
Daniel Lezcano <[email protected]>
cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type
Yun Lu <[email protected]>
af_packet: fix soft lockup issue caused by tpacket_snd()
Yun Lu <[email protected]>
af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
Jakob Unterwurzacher <[email protected]>
arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
Alexey Charkov <[email protected]>
arm64: dts: rockchip: list all CPU supplies on ArmSoM Sige5
Tim Harvey <[email protected]>
arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
Tim Harvey <[email protected]>
arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
Tim Harvey <[email protected]>
arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency
Francesco Dolcini <[email protected]>
arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
Meng Li <[email protected]>
arm64: dts: add big-endian property back into watchdog node
Tim Harvey <[email protected]>
arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
Maor Gottlieb <[email protected]>
net/mlx5: Update the list of the PCI supported devices
Nathan Chancellor <[email protected]>
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
Paolo Abeni <[email protected]>
mptcp: reset fallback status gracefully at disconnect() time
Paolo Abeni <[email protected]>
mptcp: plug races between subflow fail and subflow creation
Paolo Abeni <[email protected]>
mptcp: make fallback action and fallback decision atomic
Steve French <[email protected]>
Fix SMB311 posix special file creation to servers which do not advertise reparse support
Pavel Begunkov <[email protected]>
io_uring/poll: fix POLLERR handling
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
David Howells <[email protected]>
netfs: Fix race between cache write completion and ALL_QUEUED being set
David Howells <[email protected]>
netfs: Fix copy-to-cache so that it performs collection with ceph+fscache
Clayton King <[email protected]>
drm/amd/display: Free memory allocation
Melissa Wen <[email protected]>
drm/amd/display: Disable CRTC degamma LUT for DCN401
Lijo Lazar <[email protected]>
drm/amdgpu: Increase reset counter only on success
Philipp Stanner <[email protected]>
drm/panfrost: Fix scheduler workqueue bug
Eeli Haapalainen <[email protected]>
drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function for Rust 1.89.0
Janne Grunau <[email protected]>
rust: init: Fix generics in *_init! macros
Tomas Glozar <[email protected]>
tracing/osnoise: Fix crash in timerlat_dump_stack()
Steven Rostedt <[email protected]>
tracing: Add down_write(trace_event_sem) when adding trace event
Nathan Chancellor <[email protected]>
tracing/probes: Avoid using params uninitialized in parse_btf_arg()
Benjamin Tissoires <[email protected]>
HID: core: do not bypass hid_hw_raw_request
Benjamin Tissoires <[email protected]>
HID: core: ensure __hid_request reserves the report ID as the first byte
Benjamin Tissoires <[email protected]>
HID: core: ensure the allocated report buffer can contain the reserved report ID
Sheng Yong <[email protected]>
dm-bufio: fix sched in atomic context
Naman Jain <[email protected]>
tools/hv: fcopy: Fix irregularities with size of ring buffer
Cheng Ming Lin <[email protected]>
spi: Add check for 8-bit transfer with 8 IO mode support
Thomas Fourier <[email protected]>
pch_uart: Fix dma_sync_sg_for_device() nents value
Nilton Perim Neto <[email protected]>
Input: xpad - set correct controller type for Acer NGR200
Michael C. Pratt <[email protected]>
nvmem: layouts: u-boot-env: remove crc32 endianness conversion
Steffen Bätz <[email protected]>
nvmem: imx-ocotp: fix MAC address byte length
Stefan Wahren <[email protected]>
Revert "staging: vchiq_arm: Create keep-alive thread during probe"
Stefan Wahren <[email protected]>
Revert "staging: vchiq_arm: Improve initial VCHIQ connect"
Alok Tiwari <[email protected]>
thunderbolt: Fix bit masking in tb_dp_port_set_hops()
Mario Limonciello <[email protected]>
thunderbolt: Fix wake on connect at runtime
Christophe JAILLET <[email protected]>
i2c: omap: Fix an error handling path in omap_i2c_probe()
Christophe JAILLET <[email protected]>
i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
Clément Le Goffic <[email protected]>
i2c: stm32f7: unmap DMA mapped buffer
Clément Le Goffic <[email protected]>
i2c: stm32: fix the device used for the DMA map
Xinyu Liu <[email protected]>
usb: gadget: configfs: Fix OOB read on empty string write
Minas Harutyunyan <[email protected]>
usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY
Drew Hamilton <[email protected]>
usb: musb: fix gadget state on disconnect
Ryan Mann (NDI) <[email protected]>
USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
Slark Xiao <[email protected]>
USB: serial: option: add Foxconn T99W640
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
Haotien Hsu <[email protected]>
phy: tegra: xusb: Disable periodic tracking on Tegra234
Wayne Chang <[email protected]>
phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
Wayne Chang <[email protected]>
phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi | 3 +- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 1 + .../boot/dts/freescale/imx8mp-venice-gw71xx.dtsi | 2 +- .../boot/dts/freescale/imx8mp-venice-gw72xx.dtsi | 2 +- .../boot/dts/freescale/imx8mp-venice-gw73xx.dtsi | 2 +- .../boot/dts/freescale/imx8mp-venice-gw74xx.dts | 2 +- arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts | 20 +- arch/arm64/boot/dts/freescale/imx95-19x19-evk.dts | 12 +- arch/arm64/boot/dts/freescale/imx95.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 23 + .../boot/dts/rockchip/rk3576-armsom-sige5.dts | 28 ++ .../arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi | 1 + arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts | 1 + arch/riscv/kernel/traps.c | 10 +- arch/riscv/kernel/traps_misaligned.c | 2 +- arch/s390/net/bpf_jit_comp.c | 10 +- block/blk-sysfs.c | 1 + drivers/block/loop.c | 5 +- drivers/bluetooth/bfusb.c | 2 +- drivers/bluetooth/bpa10x.c | 2 +- drivers/bluetooth/btbcm.c | 8 +- drivers/bluetooth/btintel.c | 30 +- drivers/bluetooth/btintel_pcie.c | 8 +- drivers/bluetooth/btmtksdio.c | 4 +- drivers/bluetooth/btmtkuart.c | 2 +- drivers/bluetooth/btnxpuart.c | 2 +- drivers/bluetooth/btqca.c | 2 +- drivers/bluetooth/btqcomsmd.c | 2 +- drivers/bluetooth/btrtl.c | 10 +- drivers/bluetooth/btsdio.c | 2 +- drivers/bluetooth/btusb.c | 148 +++--- drivers/bluetooth/hci_aml.c | 2 +- drivers/bluetooth/hci_bcm.c | 4 +- drivers/bluetooth/hci_bcm4377.c | 10 +- drivers/bluetooth/hci_intel.c | 2 +- drivers/bluetooth/hci_ldisc.c | 6 +- drivers/bluetooth/hci_ll.c | 4 +- drivers/bluetooth/hci_nokia.c | 2 +- drivers/bluetooth/hci_qca.c | 14 +- drivers/bluetooth/hci_serdev.c | 8 +- drivers/bluetooth/hci_vhci.c | 8 +- drivers/bluetooth/virtio_bt.c | 10 +- drivers/comedi/comedi_fops.c | 30 +- drivers/comedi/drivers.c | 17 +- drivers/comedi/drivers/aio_iiro_16.c | 3 +- drivers/comedi/drivers/comedi_test.c | 2 +- drivers/comedi/drivers/das16m1.c | 3 +- drivers/comedi/drivers/das6402.c | 3 +- drivers/comedi/drivers/pcl812.c | 3 +- drivers/cpuidle/cpuidle-psci.c | 23 +- drivers/dma/mediatek/mtk-cqdma.c | 4 +- drivers/dma/nbpfaxi.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 9 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 1 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 11 +- .../amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c | 3 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 36 +- drivers/gpu/drm/mediatek/mtk_crtc.h | 1 + drivers/gpu/drm/mediatek/mtk_ddp_comp.c | 1 + drivers/gpu/drm/mediatek/mtk_ddp_comp.h | 9 + drivers/gpu/drm/mediatek/mtk_disp_drv.h | 1 + drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 7 + drivers/gpu/drm/mediatek/mtk_plane.c | 12 +- drivers/gpu/drm/mediatek/mtk_plane.h | 3 +- drivers/gpu/drm/panfrost/panfrost_job.c | 2 +- drivers/gpu/drm/xe/xe_gt.c | 15 +- drivers/gpu/drm/xe/xe_gt_sriov_pf.c | 19 + drivers/gpu/drm/xe/xe_gt_sriov_pf.h | 5 + drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 27 + drivers/gpu/drm/xe/xe_ring_ops.c | 22 +- drivers/hid/hid-core.c | 21 +- drivers/hwmon/corsair-cpro.c | 5 + drivers/i2c/busses/i2c-omap.c | 7 +- drivers/i2c/busses/i2c-stm32.c | 8 +- drivers/i2c/busses/i2c-stm32f7.c | 24 +- drivers/iio/accel/fxls8962af-core.c | 2 + drivers/iio/accel/st_accel_core.c | 10 +- drivers/iio/adc/ad7380.c | 5 +- drivers/iio/adc/adi-axi-adc.c | 6 +- drivers/iio/adc/axp20x_adc.c | 1 + drivers/iio/adc/max1363.c | 43 +- drivers/iio/adc/stm32-adc-core.c | 7 +- drivers/iio/common/st_sensors/st_sensors_core.c | 36 +- drivers/iio/common/st_sensors/st_sensors_trigger.c | 20 +- drivers/iio/industrialio-backend.c | 5 +- drivers/input/joystick/xpad.c | 2 +- drivers/md/dm-bufio.c | 6 +- drivers/memstick/core/memstick.c | 2 +- drivers/mmc/host/bcm2835.c | 3 +- drivers/mmc/host/sdhci-pci-core.c | 3 +- drivers/mmc/host/sdhci_am654.c | 9 +- drivers/net/can/m_can/tcan4x5x-core.c | 61 ++- drivers/net/ethernet/airoha/airoha_npu.c | 3 +- drivers/net/ethernet/intel/ice/ice_debugfs.c | 2 +- drivers/net/ethernet/intel/ice/ice_lag.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 12 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 8 +- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 9 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 20 +- drivers/net/ethernet/wangxun/libwx/wx_type.h | 2 - drivers/net/ethernet/xilinx/xilinx_emaclite.c | 2 +- drivers/net/hyperv/netvsc_drv.c | 5 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/usb/sierra_net.c | 4 + drivers/net/virtio_net.c | 2 +- .../net/wireless/intel/iwlwifi/fw/api/nvm-reg.h | 5 +- drivers/net/wireless/intel/iwlwifi/fw/regulatory.c | 1 + .../net/wireless/intel/iwlwifi/mld/regulatory.c | 4 +- drivers/nvme/host/core.c | 27 +- drivers/nvme/target/tcp.c | 4 +- drivers/nvmem/imx-ocotp-ele.c | 5 +- drivers/nvmem/imx-ocotp.c | 5 +- drivers/nvmem/layouts/u-boot-env.c | 6 +- drivers/phy/phy-core.c | 5 +- drivers/phy/tegra/xusb-tegra186.c | 77 +-- drivers/phy/tegra/xusb.h | 1 + drivers/pmdomain/governor.c | 18 +- drivers/soc/aspeed/aspeed-lpc-snoop.c | 13 +- drivers/soundwire/amd_manager.c | 4 +- drivers/soundwire/qcom.c | 26 - drivers/spi/spi.c | 14 +- .../vc04_services/interface/vchiq_arm/vchiq_arm.c | 95 ++-- .../vc04_services/interface/vchiq_arm/vchiq_core.c | 1 - .../vc04_services/interface/vchiq_arm/vchiq_core.h | 2 - drivers/thunderbolt/switch.c | 10 +- drivers/thunderbolt/tb.h | 2 +- drivers/thunderbolt/usb4.c | 12 +- drivers/tty/serial/pch_uart.c | 2 +- drivers/usb/core/hub.c | 36 +- drivers/usb/core/hub.h | 1 + drivers/usb/dwc2/gadget.c | 40 +- drivers/usb/dwc3/dwc3-qcom.c | 8 +- drivers/usb/gadget/configfs.c | 4 + drivers/usb/musb/musb_gadget.c | 2 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 3 + drivers/usb/serial/option.c | 5 + fs/cachefiles/io.c | 2 - fs/cachefiles/ondemand.c | 4 +- fs/efivarfs/super.c | 6 + fs/isofs/inode.c | 9 +- fs/netfs/read_pgpriv2.c | 5 + fs/notify/dnotify/dnotify.c | 8 +- fs/smb/client/cifs_debug.c | 23 +- fs/smb/client/file.c | 10 +- fs/smb/client/smb2inode.c | 3 +- fs/smb/client/smb2ops.c | 24 +- fs/smb/client/smbdirect.c | 544 ++++++++++----------- fs/smb/client/smbdirect.h | 62 +-- fs/smb/common/smbdirect/smbdirect.h | 37 ++ fs/smb/common/smbdirect/smbdirect_pdu.h | 55 +++ fs/smb/common/smbdirect/smbdirect_socket.h | 43 ++ fs/xfs/libxfs/xfs_group.c | 14 +- fs/xfs/xfs_extent_busy.h | 8 + include/linux/phy/phy.h | 2 + include/net/bluetooth/hci.h | 2 + include/net/bluetooth/hci_core.h | 50 +- include/net/cfg80211.h | 2 +- include/net/netfilter/nf_conntrack.h | 15 +- include/trace/events/netfs.h | 30 ++ include/trace/events/rxrpc.h | 6 +- io_uring/net.c | 12 +- io_uring/poll.c | 2 - kernel/bpf/helpers.c | 11 +- kernel/cgroup/legacy_freezer.c | 8 +- kernel/freezer.c | 15 +- kernel/sched/ext.c | 12 +- kernel/sched/loadavg.c | 2 +- kernel/sched/sched.h | 2 +- kernel/trace/trace_events.c | 5 + kernel/trace/trace_osnoise.c | 2 +- kernel/trace/trace_probe.c | 2 +- net/8021q/vlan.c | 42 +- net/8021q/vlan.h | 1 + net/bluetooth/hci_core.c | 4 +- net/bluetooth/hci_debugfs.c | 8 +- net/bluetooth/hci_event.c | 19 +- net/bluetooth/hci_sync.c | 63 ++- net/bluetooth/l2cap_core.c | 26 +- net/bluetooth/l2cap_sock.c | 3 + net/bluetooth/mgmt.c | 38 +- net/bluetooth/msft.c | 2 +- net/bluetooth/smp.c | 21 +- net/bluetooth/smp.h | 1 + net/bridge/br_switchdev.c | 3 + net/ipv4/tcp_offload.c | 1 + net/ipv4/udp_offload.c | 1 + net/ipv6/mcast.c | 2 +- net/ipv6/rpl_iptunnel.c | 8 +- net/mptcp/options.c | 3 +- net/mptcp/pm.c | 8 +- net/mptcp/protocol.c | 56 ++- net/mptcp/protocol.h | 29 +- net/mptcp/subflow.c | 30 +- net/netfilter/nf_conntrack_core.c | 26 +- net/packet/af_packet.c | 27 +- net/phonet/pep.c | 2 +- net/rxrpc/ar-internal.h | 4 + net/rxrpc/call_accept.c | 14 +- net/rxrpc/call_object.c | 28 +- net/rxrpc/io_thread.c | 14 + net/rxrpc/output.c | 22 +- net/rxrpc/peer_object.c | 6 +- net/rxrpc/recvmsg.c | 23 +- net/rxrpc/security.c | 8 +- net/sched/sch_htb.c | 4 +- net/sched/sch_qfq.c | 30 +- net/smc/af_smc.c | 14 + net/smc/smc.h | 8 +- net/tls/tls_strp.c | 3 +- rust/Makefile | 1 + rust/kernel/firmware.rs | 2 +- rust/kernel/init.rs | 8 +- rust/kernel/kunit.rs | 2 +- rust/kernel/lib.rs | 2 + rust/macros/module.rs | 10 +- scripts/Makefile.build | 2 +- sound/core/compress_offload.c | 48 +- sound/pci/hda/patch_realtek.c | 2 + tools/hv/hv_fcopy_uio_daemon.c | 91 +++- tools/lib/bpf/libbpf.c | 20 +- tools/objtool/check.c | 1 + tools/testing/selftests/net/udpgro.sh | 8 +- tools/testing/selftests/sched_ext/exit.c | 8 + 226 files changed, 2116 insertions(+), 1239 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/187 phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
commit cefc1caee9dd06c69e2d807edc5949b329f52b22 upstream.
When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code assumed that the regulator should be disabled. However, if the regulator is marked as always-on, regulator_is_enabled() continues to return true, leading to an incorrect attempt to disable a regulator which is not enabled.
This can result in warnings such as:
[ 250.155624] WARNING: CPU: 1 PID: 7326 at drivers/regulator/core.c:3004 _regulator_disable+0xe4/0x1a0 [ 250.155652] unbalanced disables for VIN_SYS_5V0
To fix this, we move the regulator control logic into tegra186_xusb_padctl_id_override() function since it's directly related to the ID override state. The regulator is now only disabled when the role transitions from USB_ROLE_HOST to USB_ROLE_NONE, by checking the VBUS_ID register. This ensures that regulator enable/disable operations are properly balanced and only occur when actually transitioning to/from host mode.
--- drivers/phy/tegra/xusb-tegra186.c | 59 +++++++++++++++++++++++--------------- 1 file changed, 37 insertions(+), 22 deletions(-)
drivers/phy/tegra/xusb-tegra186.c +37 -22
@@ -782,13 +782,15 @@ static int tegra186_xusb_padctl_vbus_ove }static int tegra186_xusb_padctl_id_override (struct tegra_xusb_padctl *padctl, -bool status) +struct tegra_xusb_usb2_port *port,bool status) { -u32 value; +u32 value, id_override; +int err =0 ;dev_dbg (padctl->dev,"%s id override\n" , status ?"set" :"clear" ); value =padctl_readl (padctl,USB2_VBUS_ID ); + id_override = value &ID_OVERRIDE (~0 );if (status) {if (value &VBUS_OVERRIDE ) {
@@ -799,14 +801,34 @@ static int tegra186_xusb_padctl_id_overr value =padctl_readl (padctl,USB2_VBUS_ID ); } - value &= ~ID_OVERRIDE (~0 ); - value |=ID_OVERRIDE_GROUNDED ; +if (id_override !=ID_OVERRIDE_GROUNDED ) { + value &= ~ID_OVERRIDE (~0 ); + value |=ID_OVERRIDE_GROUNDED ; +padctl_writel (padctl, value,USB2_VBUS_ID ); + + err =regulator_enable (port->supply); +if (err) { +dev_err (padctl->dev,"Failed to enable regulator: %d\n" , err); +return err; + } + } }else { - value &= ~ID_OVERRIDE (~0 ); - value |=ID_OVERRIDE_FLOATING ; - } +if (id_override ==ID_OVERRIDE_GROUNDED ) { +/* +* The regulator is disabled only when the role transitions +* from USB_ROLE_HOST to USB_ROLE_NONE. +*/ + err =regulator_disable (port->supply); +if (err) { +dev_err (padctl->dev,"Failed to disable regulator: %d\n" , err); +return err; + } -padctl_writel (padctl, value,USB2_VBUS_ID ); + value &= ~ID_OVERRIDE (~0 ); + value |=ID_OVERRIDE_FLOATING ; +padctl_writel (padctl, value,USB2_VBUS_ID ); + } + }return 0 ; }
@@ -826,27 +848,20 @@ static int tegra186_utmi_phy_set_mode(stif (mode ==PHY_MODE_USB_OTG ) {if (submode ==USB_ROLE_HOST ) { -tegra186_xusb_padctl_id_override (padctl, true); - - err =regulator_enable (port->supply); + err =tegra186_xusb_padctl_id_override (padctl, port, true); +if (err) + goto out; }else if (submode ==USB_ROLE_DEVICE ) {tegra186_xusb_padctl_vbus_override (padctl, true); }else if (submode ==USB_ROLE_NONE ) { -/* -* When port is peripheral only or role transitions to -* USB_ROLE_NONE from USB_ROLE_DEVICE, regulator is not -* enabled. -*/ -if (regulator_is_enabled (port->supply)) -regulator_disable (port->supply); - -tegra186_xusb_padctl_id_override (padctl, false); + err =tegra186_xusb_padctl_id_override (padctl, port, false); +if (err) + goto out;tegra186_xusb_padctl_vbus_override (padctl, false); } } - +out:mutex_unlock (&padctl->lock); -return err; }
Greg Kroah-Hartman
maintainerPATCH 2/187 phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
commit 24c63c590adca310e0df95c77cf7aa5552bc3fc5 upstream.
The logic that drives the pad calibration values resides in the controller reset domain and so the calibration values are only being captured when the controller is out of reset. However, by clearing the CYA_TRK_CODE_UPDATE_ON_IDLE bit, the calibration values can be set while the controller is in reset.
The CYA_TRK_CODE_UPDATE_ON_IDLE bit was previously cleared based on the trk_hw_mode flag, but this dependency is not necessary. Instead, introduce a new flag, trk_update_on_idle, to independently control this bit.
--- drivers/phy/tegra/xusb-tegra186.c | 14 ++++++++------ drivers/phy/tegra/xusb.h | 1 + 2 files changed, 9 insertions(+), 6 deletions(-)
drivers/phy/tegra/xusb-tegra186.c +8 -6
@@ -648,14 +648,15 @@ static void tegra186_utmi_bias_pad_powerudelay (100 ); } -if (padctl->soc->trk_hw_mode) { - value =padctl_readl (padctl,XUSB_PADCTL_USB2_BIAS_PAD_CTL2 ); - value |=USB2_TRK_HW_MODE ; + value =padctl_readl (padctl,XUSB_PADCTL_USB2_BIAS_PAD_CTL2 ); +if (padctl->soc->trk_update_on_idle) value &= ~CYA_TRK_CODE_UPDATE_ON_IDLE ; -padctl_writel (padctl, value,XUSB_PADCTL_USB2_BIAS_PAD_CTL2 ); - }else { +if (padctl->soc->trk_hw_mode) + value |=USB2_TRK_HW_MODE ; +padctl_writel (padctl, value,XUSB_PADCTL_USB2_BIAS_PAD_CTL2 ); + +if (!padctl->soc->trk_hw_mode)clk_disable_unprepare (priv->usb2_trk_clk); - } }static void tegra186_utmi_bias_pad_power_off (struct tegra_xusb_padctl *padctl)
@@ -1726,6 +1727,7 @@ const struct tegra_xusb_padctl_soc tegra .supports_gen2 = true, .poll_trk_completed = true, .trk_hw_mode = true, + .trk_update_on_idle = true, .supports_lp_cfg_en = true, };EXPORT_SYMBOL_GPL (tegra234_xusb_padctl_soc);
drivers/phy/tegra/xusb.h +1 -0
@@ -434,6 +434,7 @@ struct tegra_xusb_padctl_soc {bool need_fake_usb3_port;bool poll_trk_completed;bool trk_hw_mode; +bool trk_update_on_idle;bool supports_lp_cfg_en; };
Greg Kroah-Hartman
maintainerPATCH 3/187 phy: tegra: xusb: Disable periodic tracking on Tegra234
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotien Hsu <[email protected]>
commit 7be54870e9bf5ed0b4fe2a23b41a630527882de5 upstream.
Periodic calibration updates (~10µs) may overlap with transfers when PCIe NVMe SSD, LPDDR, and USB2 devices operate simultaneously, causing crosstalk on Tegra234 devices. Hence disable periodic calibration updates and make this a one-time calibration.
--- drivers/phy/tegra/xusb-tegra186.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/tegra/xusb-tegra186.c +1 -1
@@ -1726,7 +1726,7 @@ const struct tegra_xusb_padctl_soc tegra .num_supplies = ARRAY_SIZE(tegra194_xusb_padctl_supply_names), .supports_gen2 = true, .poll_trk_completed = true, - .trk_hw_mode = true, + .trk_hw_mode = false, .trk_update_on_idle = true, .supports_lp_cfg_en = true, };
Greg Kroah-Hartman
maintainerPATCH 4/187 USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 upstream.
Add Telit Cinterion FE910C04 (ECM) composition:0x10c7: ECM + tty (AT) + tty (AT) + tty (diag)
usb-devices output:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c7 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -1415,6 +1415,9 @@ static const struct usb_device_id option .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ .driver_info = NCTRL(6) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 5/187 USB: serial: option: add Foxconn T99W640
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
commit 08f49cdb71f3759368fded4dbc9dde35a404ec2b upstream.
T99W640 is designed based on Qualconn SDX72 chip. There are 3 serial ports to be enumerated: Diag, NMEA and AT.
Test evidence as below:
T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 P: Vendor=0489 ProdID=e167 Rev=05.15 S: Manufacturer=QCOM S: Product=SDXPINNL USB WWAN Adapter S: SerialNumber=cc1f1d92 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2346,6 +2346,8 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ .driver_info = RSVD(5) | RSVD(6) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe167, 0xff), /* Foxconn T99W640 MBIM */ + .driver_info = RSVD(3) }, { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
Greg Kroah-Hartman
maintainerPATCH 6/187 USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Mann (NDI) <[email protected]>
commit c980666b6958d9a841597331b38115a29a32250e upstream.
NDI (Northern Digital Inc.) is introducing a new product called the EMGUIDE GEMINI that will use an FTDI chip for USB serial communications. Add the NDI EMGUIDE GEMINI product ID that uses the NDI Vendor ID rather than the FTDI Vendor ID, unlike older products.
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 3 +++ 2 files changed, 5 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -803,6 +803,8 @@ static const struct usb_device_id id_tab .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(FTDI_NDI_VID, FTDI_NDI_EMGUIDE_GEMINI_PID), + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) },
drivers/usb/serial/ftdi_sio_ids.h +3 -0
@@ -204,6 +204,9 @@#define FTDI_NDI_FUTURE_3_PID 0xDA73/* NDI future device #3 */ #define FTDI_NDI_AURORA_SCU_PID 0xDA74/* NDI Aurora SCU */ +#define FTDI_NDI_VID 0x23F2 +#define FTDI_NDI_EMGUIDE_GEMINI_PID 0x0003/* NDI Emguide Gemini */ +/* * ChamSys Limited (www.chamsys.co.uk) USB wing/interface product IDs */
Greg Kroah-Hartman
maintainerPATCH 7/187 usb: musb: fix gadget state on disconnect
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Drew Hamilton <[email protected]>
commit 67a59f82196c8c4f50c83329f0577acfb1349b50 upstream.
When unplugging the USB cable or disconnecting a gadget in usb peripheral mode with echo "" > /sys/kernel/config/usb_gadget/<your_gadget>/UDC, /sys/class/udc/musb-hdrc.0/state does not change from USB_STATE_CONFIGURED.
Testing on dwc2/3 shows they both update the state to USB_STATE_NOTATTACHED.
Add calls to usb_gadget_set_state in musb_g_disconnect and musb_gadget_stop to fix both cases.
--- drivers/usb/musb/musb_gadget.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/musb/musb_gadget.c +2 -0
@@ -1913,6 +1913,7 @@ static int musb_gadget_stop(struct usb_gadget *g)* gadget driver here and have everything work; * that currently misbehaves. */ +usb_gadget_set_state (g,USB_STATE_NOTATTACHED );/* Force check of devctl register for PM runtime */ pm_runtime_mark_last_busy (musb->controller);
@@ -2019,6 +2020,7 @@ void musb_g_disconnect(struct musb *musb)case OTG_STATE_B_PERIPHERAL :case OTG_STATE_B_IDLE :musb_set_state (musb,OTG_STATE_B_IDLE ); +usb_gadget_set_state (&musb->g,USB_STATE_NOTATTACHED );break ;case OTG_STATE_B_SRP_INIT :break ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 8/187 usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minas Harutyunyan <[email protected]>
commit 5724ff190b22bd04fcfd7287a39c6e5494e40f0b upstream.
For UTMI+ PHY, according to programming guide, first should be set PMUACTV bit then STOPPCLK bit. Otherwise, when the device issues Remote Wakeup, then host notices disconnect instead. For ULPI PHY, above mentioned bits must be set in reversed order:
STOPPCLK then PMUACTV.
--- drivers/usb/dwc2/gadget.c | 38 ++++++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 12 deletions(-)
drivers/usb/dwc2/gadget.c +26 -12
@@ -5389,20 +5389,34 @@ int dwc2_gadget_enter_hibernation(structif (gusbcfg &GUSBCFG_ULPI_UTMI_SEL ) {/* ULPI interface */ gpwrdn |=GPWRDN_ULPI_LATCH_EN_DURING_HIB_ENTRY ; - } -dwc2_writel (hsotg, gpwrdn,GPWRDN ); -udelay (10 ); +dwc2_writel (hsotg, gpwrdn,GPWRDN ); +udelay (10 ); + +/* Suspend the Phy Clock */ + pcgcctl =dwc2_readl (hsotg,PCGCTL ); + pcgcctl |=PCGCTL_STOPPCLK ; +dwc2_writel (hsotg, pcgcctl,PCGCTL ); +udelay (10 ); -/* Suspend the Phy Clock */ - pcgcctl =dwc2_readl (hsotg,PCGCTL ); - pcgcctl |=PCGCTL_STOPPCLK ; -dwc2_writel (hsotg, pcgcctl,PCGCTL ); -udelay (10 ); + gpwrdn =dwc2_readl (hsotg,GPWRDN ); + gpwrdn |=GPWRDN_PMUACTV ; +dwc2_writel (hsotg, gpwrdn,GPWRDN ); +udelay (10 ); + }else { +/* UTMI+ Interface */ +dwc2_writel (hsotg, gpwrdn,GPWRDN ); +udelay (10 ); - gpwrdn =dwc2_readl (hsotg,GPWRDN ); - gpwrdn |=GPWRDN_PMUACTV ; -dwc2_writel (hsotg, gpwrdn,GPWRDN ); -udelay (10 ); + gpwrdn =dwc2_readl (hsotg,GPWRDN ); + gpwrdn |=GPWRDN_PMUACTV ; +dwc2_writel (hsotg, gpwrdn,GPWRDN ); +udelay (10 ); + + pcgcctl =dwc2_readl (hsotg,PCGCTL ); + pcgcctl |=PCGCTL_STOPPCLK ; +dwc2_writel (hsotg, pcgcctl,PCGCTL ); +udelay (10 ); + }/* Set flag to indicate that we are in hibernation */ hsotg->hibernated =1 ;
Greg Kroah-Hartman
maintainerPATCH 9/187 usb: gadget: configfs: Fix OOB read on empty string write
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xinyu Liu <[email protected]>
commit 3014168731b7930300aab656085af784edc861f6 upstream.
When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero.
This patch fixes the vulnerability by adding a check at the beginning of os_desc_qw_sign_store() and webusb_landingPage_store() to handle the zero-length input case gracefully by returning immediately.
--- drivers/usb/gadget/configfs.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/gadget/configfs.c +4 -0
@@ -1065,6 +1065,8 @@ static ssize_t webusb_landingPage_store(unsigned int bytes_to_strip =0 ;int l = len; +if (!len) +return len;if (page[l -1 ] =='\n' ) { --l; ++bytes_to_strip;
@@ -1188,6 +1190,8 @@ static ssize_t os_desc_qw_sign_store(strstruct gadget_info *gi =os_desc_item_to_gadget_info (item);int res, l; +if (!len) +return len; l =min_t (int, len,OS_STRING_QW_SIGN_LEN >>1 );if (page[l -1 ] =='\n' ) --l;
Greg Kroah-Hartman
maintainerPATCH 10/187 i2c: stm32: fix the device used for the DMA map
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Le Goffic <[email protected]>
commit c870cbbd71fccda71d575f0acd4a8d2b7cd88861 upstream.
If the DMA mapping failed, it produced an error log with the wrong device name:
"stm32-dma3 40400000.dma-controller: rejecting DMA map of vmalloc memory" Fix this issue by replacing the dev with the I2C dev.
--- drivers/i2c/busses/i2c-stm32.c | 8 +++----- drivers/i2c/busses/i2c-stm32f7.c | 4 ++-- 2 files changed, 5 insertions(+), 7 deletions(-)
drivers/i2c/busses/i2c-stm32.c +3 -5
@@ -102,7 +102,6 @@ int stm32_i2c_prep_dma_xfer(struct devic void *dma_async_param) {struct dma_async_tx_descriptor *txdesc; -struct device *chan_dev;int ret;if (rd_wr) {
@@ -116,11 +115,10 @@ int stm32_i2c_prep_dma_xfer(struct devic } dma->dma_len = len; - chan_dev = dma->chan_using->device->dev; - dma->dma_buf =dma_map_single (chan_dev, buf, dma->dma_len, + dma->dma_buf =dma_map_single (dev, buf, dma->dma_len, dma->dma_data_dir); -if (dma_mapping_error (chan_dev, dma->dma_buf)) { +if (dma_mapping_error (dev, dma->dma_buf)) {dev_err (dev,"DMA mapping failed\n" );return -EINVAL ; }
@@ -150,7 +148,7 @@ int stm32_i2c_prep_dma_xfer(struct devicreturn 0 ; err: -dma_unmap_single (chan_dev, dma->dma_buf, dma->dma_len, +dma_unmap_single (dev, dma->dma_buf, dma->dma_len, dma->dma_data_dir);return ret; }
drivers/i2c/busses/i2c-stm32f7.c +2 -2
@@ -741,10 +741,10 @@ static void stm32f7_i2c_dma_callback(voi {struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg;struct stm32_i2c_dma *dma = i2c_dev->dma; -struct device *dev = dma->chan_using->device->dev;stm32f7_i2c_disable_dma_req (i2c_dev); -dma_unmap_single (dev, dma->dma_buf, dma->dma_len, dma->dma_data_dir); +dma_unmap_single (i2c_dev->dev, dma->dma_buf, dma->dma_len, + dma->dma_data_dir);complete (&dma->dma_complete); }
Greg Kroah-Hartman
maintainerPATCH 11/187 i2c: stm32f7: unmap DMA mapped buffer
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Le Goffic <[email protected]>
commit 6aae87fe7f180cd93a74466cdb6cf2aa9bb28798 upstream.
Before each I2C transfer using DMA, the I2C buffer is DMA'pped to make sure the memory buffer is DMA'able. This is handle in the function stm32_i2c_prep_dma_xfer().
If the transfer fails for any reason the I2C buffer must be unmap. Use the dma_callback to factorize the code and fix this issue.
Note that the stm32f7_i2c_dma_callback() is now called in case of DMA transfer success and error and that the complete() on the dma_complete completion structure is done inconditionnally in case of transfer success or error as well as the dmaengine_terminate_async(). This is allowed as a complete() in case transfer error has no effect as well as a dmaengine_terminate_async() on a transfer success.
Also fix the unneeded cast and remove not more needed variables.
--- drivers/i2c/busses/i2c-stm32f7.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-)
drivers/i2c/busses/i2c-stm32f7.c +7 -13
@@ -739,10 +739,11 @@ static void stm32f7_i2c_disable_dma_req(static void stm32f7_i2c_dma_callback (void *arg) { -struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg; +struct stm32f7_i2c_dev *i2c_dev = arg;struct stm32_i2c_dma *dma = i2c_dev->dma;stm32f7_i2c_disable_dma_req (i2c_dev); +dmaengine_terminate_async (dma->chan_using);dma_unmap_single (i2c_dev->dev, dma->dma_buf, dma->dma_len, dma->dma_data_dir);complete (&dma->dma_complete);
@@ -1510,7 +1511,6 @@ static irqreturn_t stm32f7_i2c_handle_isu16 addr = f7_msg->addr;void __iomem *base = i2c_dev->base;struct device *dev = i2c_dev->dev; -struct stm32_i2c_dma *dma = i2c_dev->dma;/* Bus error */ if (status &STM32F7_I2C_ISR_BERR ) {
@@ -1551,10 +1551,8 @@ static irqreturn_t stm32f7_i2c_handle_is }/* Disable dma */ -if (i2c_dev->use_dma) { -stm32f7_i2c_disable_dma_req (i2c_dev); -dmaengine_terminate_async (dma->chan_using); - } +if (i2c_dev->use_dma) +stm32f7_i2c_dma_callback (i2c_dev); i2c_dev->master_mode = false;complete (&i2c_dev->complete);
@@ -1600,7 +1598,6 @@ static irqreturn_t stm32f7_i2c_isr_event {struct stm32f7_i2c_dev *i2c_dev = data;struct stm32f7_i2c_msg *f7_msg = &i2c_dev->f7_msg; -struct stm32_i2c_dma *dma = i2c_dev->dma;void __iomem *base = i2c_dev->base;u32 status, mask;int ret;
@@ -1619,10 +1616,8 @@ static irqreturn_t stm32f7_i2c_isr_eventdev_dbg (i2c_dev->dev,"<%s>: Receive NACK (addr %x)\n" , __func__, f7_msg->addr);writel_relaxed (STM32F7_I2C_ICR_NACKCF , base +STM32F7_I2C_ICR ); -if (i2c_dev->use_dma) { -stm32f7_i2c_disable_dma_req (i2c_dev); -dmaengine_terminate_async (dma->chan_using); - } +if (i2c_dev->use_dma) +stm32f7_i2c_dma_callback (i2c_dev); f7_msg->result = -ENXIO ; }
@@ -1640,8 +1635,7 @@ static irqreturn_t stm32f7_i2c_isr_event ret =wait_for_completion_timeout (&i2c_dev->dma->dma_complete,HZ );if (!ret) {dev_dbg (i2c_dev->dev,"<%s>: Timed out\n" , __func__); -stm32f7_i2c_disable_dma_req (i2c_dev); -dmaengine_terminate_async (dma->chan_using); +stm32f7_i2c_dma_callback (i2c_dev); f7_msg->result = -ETIMEDOUT ; } }
Greg Kroah-Hartman
maintainerPATCH 12/187 i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit a9503a2ecd95e23d7243bcde7138192de8c1c281 upstream.
omap_i2c_init() can fail. Handle this error in omap_i2c_probe().
--- drivers/i2c/busses/i2c-omap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-omap.c +4 -1
@@ -1472,7 +1472,9 @@ omap_i2c_probe(struct platform_device *p }/* reset ASAP, clearing any IRQs */ -omap_i2c_init (omap); + r =omap_i2c_init (omap); +if (r) + goto err_mux_state_deselect;if (omap->rev <OMAP_I2C_OMAP1_REV_2 ) r = devm_request_irq(&pdev->dev, omap->irq, omap_i2c_omap1_isr,
@@ -1515,6 +1517,7 @@ omap_i2c_probe(struct platform_device *p err_unuse_clocks:omap_i2c_write_reg (omap,OMAP_I2C_CON_REG ,0 ); +err_mux_state_deselect:if (omap->mux_state)mux_state_deselect (omap->mux_state); err_put_pm:
Greg Kroah-Hartman
maintainerPATCH 13/187 i2c: omap: Fix an error handling path in omap_i2c_probe()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit 60c016afccac7acb78a43b9c75480887ed3ce48e upstream.
If an error occurs after pm_runtime_use_autosuspend(), a corresponding pm_runtime_dont_use_autosuspend() should be called.
In case of error in pm_runtime_resume_and_get(), it is not the case because the error handling path is wrongly ordered.
Fix it.
--- drivers/i2c/busses/i2c-omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-omap.c +1 -1
@@ -1521,9 +1521,9 @@ err_mux_state_deselect:if (omap->mux_state)mux_state_deselect (omap->mux_state); err_put_pm: -pm_runtime_dont_use_autosuspend (omap->dev);pm_runtime_put_sync (omap->dev); err_disable_pm: +pm_runtime_dont_use_autosuspend (omap->dev);pm_runtime_disable (&pdev->dev);return r;
Greg Kroah-Hartman
maintainerPATCH 14/187 thunderbolt: Fix wake on connect at runtime
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 58d71d4242ce057955c783a14c82270c71f9e1e8 upstream.
commit 1a760d10ded37 ("thunderbolt: Fix a logic error in wake on connect") fixated on the USB4 port sysfs wakeup file not working properly to control policy, but it had an unintended side effect that the sysfs file controls policy both at runtime and at suspend time. The sysfs file is supposed to only control behavior while system is suspended.
Pass whether programming a port for runtime into usb4_switch_set_wake() and if runtime then ignore the value in the sysfs file.
--- drivers/thunderbolt/switch.c | 8 ++++---- drivers/thunderbolt/tb.h | 2 +- drivers/thunderbolt/usb4.c | 12 +++++------- 3 files changed, 10 insertions(+), 12 deletions(-)
drivers/thunderbolt/switch.c +4 -4
@@ -3437,7 +3437,7 @@ void tb_sw_set_unplugged(struct tb_switc } } -static int tb_switch_set_wake (struct tb_switch *sw,unsigned int flags) +static int tb_switch_set_wake (struct tb_switch *sw,unsigned int flags,bool runtime) {if (flags)tb_sw_dbg (sw,"enabling wakeup: %#x\n" , flags);
@@ -3445,7 +3445,7 @@ static int tb_switch_set_wake(struct tb_tb_sw_dbg (sw,"disabling wakeup\n" );if (tb_switch_is_usb4 (sw)) -return usb4_switch_set_wake (sw, flags); +return usb4_switch_set_wake (sw, flags, runtime);return tb_lc_set_wake (sw, flags); }
@@ -3521,7 +3521,7 @@ int tb_switch_resume(struct tb_switch *stb_switch_check_wakes (sw);/* Disable wakes */ -tb_switch_set_wake (sw,0 ); +tb_switch_set_wake (sw,0 , true); err =tb_switch_tmu_init (sw);if (err)
@@ -3602,7 +3602,7 @@ void tb_switch_suspend(struct tb_switch flags |=TB_WAKE_ON_USB4 |TB_WAKE_ON_USB3 |TB_WAKE_ON_PCIE ; } -tb_switch_set_wake (sw, flags); +tb_switch_set_wake (sw, flags, runtime);if (tb_switch_is_usb4 (sw))usb4_switch_set_sleep (sw);
drivers/thunderbolt/tb.h +1 -1
@@ -1304,7 +1304,7 @@ int usb4_switch_read_uid(struct tb_switcint usb4_switch_drom_read (struct tb_switch *sw,unsigned int address,void *buf,size_t size);bool usb4_switch_lane_bonding_possible (struct tb_switch *sw); -int usb4_switch_set_wake (struct tb_switch *sw,unsigned int flags); +int usb4_switch_set_wake (struct tb_switch *sw,unsigned int flags,bool runtime);int usb4_switch_set_sleep (struct tb_switch *sw);int usb4_switch_nvm_sector_size (struct tb_switch *sw); int usb4_switch_nvm_read(struct tb_switch *sw, unsigned int address, void *buf,
drivers/thunderbolt/usb4.c +5 -7
@@ -403,12 +403,12 @@ bool usb4_switch_lane_bonding_possible(s* usb4_switch_set_wake() - Enabled/disable wake * @sw: USB4 router * @flags: Wakeup flags (%0 to disable) +* @runtime: Wake is being programmed during system runtime * * Enables/disables router to wake up from sleep. */ -int usb4_switch_set_wake (struct tb_switch *sw,unsigned int flags) +int usb4_switch_set_wake (struct tb_switch *sw,unsigned int flags,bool runtime) { -struct usb4_port *usb4;struct tb_port *port;u64 route =tb_route (sw);u32 val;
@@ -438,13 +438,11 @@ int usb4_switch_set_wake(struct tb_switc val |=PORT_CS_19_WOU4 ; }else {bool configured = val &PORT_CS_19_PC ; - usb4 = port->usb4; +bool wakeup = runtime ||device_may_wakeup (&port->usb4->dev); -if (((flags &TB_WAKE_ON_CONNECT ) && -device_may_wakeup (&usb4->dev)) && !configured) +if ((flags &TB_WAKE_ON_CONNECT ) && wakeup && !configured) val |=PORT_CS_19_WOC ; -if (((flags &TB_WAKE_ON_DISCONNECT ) && -device_may_wakeup (&usb4->dev)) && configured) +if ((flags &TB_WAKE_ON_DISCONNECT ) && wakeup && configured) val |=PORT_CS_19_WOD ;if ((flags &TB_WAKE_ON_USB4 ) && configured) val |=PORT_CS_19_WOU4 ;
Greg Kroah-Hartman
maintainerPATCH 15/187 thunderbolt: Fix bit masking in tb_dp_port_set_hops()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
commit 2cdde91c14ec358087f43287513946d493aef940 upstream.
The tb_dp_port_set_hops() function was incorrectly clearing ADP_DP_CS_1_AUX_RX_HOPID_MASK twice. According to the function's purpose, it should clear both TX and RX AUX HopID fields. Replace the first instance with ADP_DP_CS_1_AUX_TX_HOPID_MASK to ensure proper configuration of both AUX directions.
--- drivers/thunderbolt/switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thunderbolt/switch.c +1 -1
@@ -1450,7 +1450,7 @@ int tb_dp_port_set_hops(struct tb_port *return ret; data[0 ] &= ~ADP_DP_CS_0_VIDEO_HOPID_MASK ; - data[1 ] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK ; + data[1 ] &= ~ADP_DP_CS_1_AUX_TX_HOPID_MASK ; data[1 ] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK ; data[0] |= (video << ADP_DP_CS_0_VIDEO_HOPID_SHIFT) &
Greg Kroah-Hartman
maintainerPATCH 16/187 Revert "staging: vchiq_arm: Improve initial VCHIQ connect"
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
commit ebe0b2ecb7b8285852414a0f20044432e37d9b4c upstream.
The commit 3e5def4249b9 ("staging: vchiq_arm: Improve initial VCHIQ connect") based on the assumption that in good case the VCHIQ connect always happen and therefore the keep-alive thread is guaranteed to be woken up. This is wrong, because in certain configurations there are no VCHIQ users and so the VCHIQ connect never happen. So revert it.
--- .../interface/vchiq_arm/vchiq_arm.c | 28 ++++++++++++++----- .../interface/vchiq_arm/vchiq_core.c | 1 - .../interface/vchiq_arm/vchiq_core.h | 2 -- 3 files changed, 21 insertions(+), 10 deletions(-)
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +21 -7
@@ -97,6 +97,13 @@ struct vchiq_arm_state {* tracked separately with the state. */ int peer_use_count; + +/* +* Flag to indicate that the first vchiq connect has made it through. +* This means that both sides should be fully ready, and we should +* be able to suspend after this point. +*/ +int first_connect; }; static int
@@ -1329,19 +1336,26 @@ vchiq_check_service(struct vchiq_service *service)return ret; } -void vchiq_platform_connected (struct vchiq_state *state) -{ -struct vchiq_arm_state *arm_state =vchiq_platform_get_arm_state (state); - -wake_up_process (arm_state->ka_thread); -} -void vchiq_platform_conn_state_changed (struct vchiq_state *state,enum vchiq_connstate oldstate,enum vchiq_connstate newstate) { +struct vchiq_arm_state *arm_state =vchiq_platform_get_arm_state (state); +dev_dbg (state->dev,"suspend: %d: %s->%s\n" , state->id,get_conn_state_name (oldstate),get_conn_state_name (newstate)); +if (state->conn_state !=VCHIQ_CONNSTATE_CONNECTED ) +return ; + +write_lock_bh (&arm_state->susp_res_lock); +if (arm_state->first_connect) { +write_unlock_bh (&arm_state->susp_res_lock); +return ; + } + + arm_state->first_connect =1 ; +write_unlock_bh (&arm_state->susp_res_lock); +wake_up_process (arm_state->ka_thread); }static const struct of_device_id vchiq_of_match[] = {
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +0 -1
@@ -3343,7 +3343,6 @@ vchiq_connect_internal(struct vchiq_state *state, struct vchiq_instance *instancreturn -EAGAIN ;vchiq_set_conn_state (state,VCHIQ_CONNSTATE_CONNECTED ); -vchiq_platform_connected (state);complete (&state->connect); }
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h +0 -2
@@ -575,8 +575,6 @@ int vchiq_send_remote_use(struct vchiq_state *state);int vchiq_send_remote_use_active (struct vchiq_state *state); -void vchiq_platform_connected (struct vchiq_state *state); -void vchiq_platform_conn_state_changed (struct vchiq_state *state,enum vchiq_connstate oldstate,enum vchiq_connstate newstate);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 17/187 Revert "staging: vchiq_arm: Create keep-alive thread during probe"
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
commit 228af5a58524fba09ec4b7d184694db4f7fe96f5 upstream.
The commit 86bc88217006 ("staging: vchiq_arm: Create keep-alive thread during probe") introduced a regression for certain configurations, which doesn't have a VCHIQ user. This results in a unused and hanging keep-alive thread:
INFO: task vchiq-keep/0:85 blocked for more than 120 seconds.
Not tainted 6.12.34-v8-+ #13
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:vchiq-keep/0 state:D stack:0 pid:85 tgid:85 ppid:2
Call trace:
__switch_to+0x188/0x230
__schedule+0xa54/0xb28
schedule+0x80/0x120
schedule_preempt_disabled+0x30/0x50
kthread+0xd4/0x1a0
ret_from_fork+0x10/0x20--- drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 69 +++++----- 1 file changed, 35 insertions(+), 34 deletions(-)
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +35 -34
@@ -280,6 +280,29 @@ static int vchiq_platform_init(struct plreturn 0 ; } +int +vchiq_platform_init_state (struct vchiq_state *state) +{ +struct vchiq_arm_state *platform_state; + + platform_state =devm_kzalloc (state->dev,sizeof (*platform_state),GFP_KERNEL ); +if (!platform_state) +return -ENOMEM ; + +rwlock_init (&platform_state->susp_res_lock); + +init_completion (&platform_state->ka_evt); +atomic_set (&platform_state->ka_use_count,0 ); +atomic_set (&platform_state->ka_use_ack_count,0 ); +atomic_set (&platform_state->ka_release_count,0 ); + + platform_state->state = state; + + state->platform_state = (struct opaque_platform_state *)platform_state; + +return 0 ; +} +static struct vchiq_arm_state *vchiq_platform_get_arm_state (struct vchiq_state *state) {return (struct vchiq_arm_state *)state->platform_state;
@@ -989,39 +1012,6 @@ exit: }int -vchiq_platform_init_state (struct vchiq_state *state) -{ -struct vchiq_arm_state *platform_state; -char threadname[16 ]; - - platform_state =devm_kzalloc (state->dev,sizeof (*platform_state),GFP_KERNEL ); -if (!platform_state) -return -ENOMEM ; - -snprintf (threadname,sizeof (threadname),"vchiq-keep/%d" , - state->id); - platform_state->ka_thread =kthread_create (&vchiq_keepalive_thread_func, - (void *)state, threadname); -if (IS_ERR (platform_state->ka_thread)) { -dev_err (state->dev,"couldn't create thread %s\n" , threadname); -return PTR_ERR (platform_state->ka_thread); - } - -rwlock_init (&platform_state->susp_res_lock); - -init_completion (&platform_state->ka_evt); -atomic_set (&platform_state->ka_use_count,0 ); -atomic_set (&platform_state->ka_use_ack_count,0 ); -atomic_set (&platform_state->ka_release_count,0 ); - - platform_state->state = state; - - state->platform_state = (struct opaque_platform_state *)platform_state; - -return 0 ; -} - -int vchiq_use_internal (struct vchiq_state *state,struct vchiq_service *service,enum USE_TYPE_E use_type) {
@@ -1341,6 +1331,7 @@ void vchiq_platform_conn_state_changed(s enum vchiq_connstate newstate) {struct vchiq_arm_state *arm_state =vchiq_platform_get_arm_state (state); +char threadname[16 ];dev_dbg (state->dev,"suspend: %d: %s->%s\n" , state->id,get_conn_state_name (oldstate),get_conn_state_name (newstate));
@@ -1355,7 +1346,17 @@ void vchiq_platform_conn_state_changed(s arm_state->first_connect =1 ;write_unlock_bh (&arm_state->susp_res_lock); -wake_up_process (arm_state->ka_thread); +snprintf (threadname,sizeof (threadname),"vchiq-keep/%d" , + state->id); + arm_state->ka_thread =kthread_create (&vchiq_keepalive_thread_func, + (void *)state, + threadname); +if (IS_ERR (arm_state->ka_thread)) { +dev_err (state->dev,"suspend: Couldn't create thread %s\n" , + threadname); + }else { +wake_up_process (arm_state->ka_thread); + } }static const struct of_device_id vchiq_of_match[] = {
Greg Kroah-Hartman
maintainerPATCH 18/187 nvmem: imx-ocotp: fix MAC address byte length
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Bätz <[email protected]>
commit 2aa4ad626ee7f817a8f4715a47b318cfdc1714c9 upstream.
The commit "13bcd440f2ff nvmem: core: verify cell's raw_len" caused an extension of the "mac-address" cell from 6 to 8 bytes due to word_size of 4 bytes. This led to a required byte swap of the full buffer length, which caused truncation of the mac-address when read.
Previously, the mac-address was incorrectly truncated from 70:B3:D5:14:E9:0E to 00:00:70:B3:D5:14.
Fix the issue by swapping only the first 6 bytes to correctly pass the mac-address to the upper layers.
--- drivers/nvmem/imx-ocotp-ele.c | 5 ++++- drivers/nvmem/imx-ocotp.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/nvmem/imx-ocotp-ele.c +4 -1
@@ -12,6 +12,7 @@#include <linux/of.h> #include <linux/platform_device.h> #include <linux/slab.h> +#include <linux/if_ether.h> /* ETH_ALEN */ enum fuse_type {FUSE_FSB =BIT (0 ),
@@ -118,9 +119,11 @@ static int imx_ocotp_cell_pp(void *conteint i;/* Deal with some post processing of nvmem cell data */ -if (id && !strcmp (id,"mac-address" )) +if (id && !strcmp (id,"mac-address" )) { + bytes =min (bytes,ETH_ALEN );for (i =0 ; i < bytes /2 ; i++)swap (buf[i], buf[bytes - i -1 ]); + }return 0 ; }
drivers/nvmem/imx-ocotp.c +4 -1
@@ -23,6 +23,7 @@#include <linux/platform_device.h> #include <linux/slab.h> #include <linux/delay.h> +#include <linux/if_ether.h> /* ETH_ALEN */ #define IMX_OCOTP_OFFSET_B0W0 0x400/* Offset from base address of the * OTP Bank0 Word0
@@ -227,9 +228,11 @@ static int imx_ocotp_cell_pp(void *conteint i;/* Deal with some post processing of nvmem cell data */ -if (id && !strcmp (id,"mac-address" )) +if (id && !strcmp (id,"mac-address" )) { + bytes =min (bytes,ETH_ALEN );for (i =0 ; i < bytes /2 ; i++)swap (buf[i], buf[bytes - i -1 ]); + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 19/187 nvmem: layouts: u-boot-env: remove crc32 endianness conversion
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael C. Pratt <[email protected]>
commit 2d7521aa26ec2dc8b877bb2d1f2611a2df49a3cf upstream.
On 11 Oct 2022, it was reported that the crc32 verification of the u-boot environment failed only on big-endian systems for the u-boot-env nvmem layout driver with the following error.
Invalid calculated CRC32: 0x88cd6f09 (expected: 0x096fcd88)
This problem has been present since the driver was introduced, and before it was made into a layout driver.
The suggested fix at the time was to use further endianness conversion macros in order to have both the stored and calculated crc32 values to compare always represented in the system's endianness. This was not accepted due to sparse warnings
and some disagreement on how to handle the situation.
Later on in a newer revision of the patch, it was proposed to use cpu_to_le32() for both values to compare instead of le32_to_cpu() and store the values as __le32 type to remove compilation errors.
The necessity of this is based on the assumption that the use of crc32() requires endianness conversion because the algorithm uses little-endian, however, this does not prove to be the case and the issue is unrelated.
Upon inspecting the current kernel code,
there already is an existing use of le32_to_cpu() in this driver, which suggests there already is special handling for big-endian systems, however, it is big-endian systems that have the problem.
This, being the only functional difference between architectures in the driver combined with the fact that the suggested fix was to use the exact same endianness conversion for the values brings up the possibility that it was not necessary to begin with, as the same endianness conversion for two values expected to be the same is expected to be equivalent to no conversion at all.
After inspecting the u-boot environment of devices of both endianness and trying to remove the existing endianness conversion,
the problem is resolved in an equivalent way as the other suggested fixes.
Ultimately, it seems that u-boot is agnostic to endianness at least for the purpose of environment variables.
In other words, u-boot reads and writes the stored crc32 value with the same endianness that the crc32 value is calculated with in whichever endianness a certain architecture runs on.
Therefore, the u-boot-env driver does not need to convert endianness. Remove the usage of endianness macros in the u-boot-env driver, and change the type of local variables to maintain the same return type.
If there is a special situation in the case of endianness,
it would be a corner case and should be handled by a unique "compatible".
Even though it is not necessary to use endianness conversion macros here, it may be useful to use them in the future for consistent error printing.
--- drivers/nvmem/layouts/u-boot-env.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/nvmem/layouts/u-boot-env.c +3 -3
@@ -92,7 +92,7 @@ int u_boot_env_parse(struct device *dev,size_t crc32_data_offset;size_t crc32_data_len;size_t crc32_offset; -__le32 *crc32_addr; +uint32_t *crc32_addr;size_t data_offset;size_t data_len;size_t dev_size;
@@ -143,8 +143,8 @@ int u_boot_env_parse(struct device *dev, goto err_kfree; } - crc32_addr = (__le32 *)(buf + crc32_offset); - crc32 =le32_to_cpu (*crc32_addr); + crc32_addr = (uint32_t *)(buf + crc32_offset); + crc32 = *crc32_addr; crc32_data_len = dev_size - crc32_data_offset; data_len = dev_size - data_offset;
Greg Kroah-Hartman
maintainerPATCH 20/187 Input: xpad - set correct controller type for Acer NGR200
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilton Perim Neto <[email protected]>
commit bcce05041b21888f10b80ea903dcfe51a25c586e upstream.
The controller should have been set as XTYPE_XBOX360 and not XTYPE_XBOX. Also the entry is in the wrong place. Fix it.
--- drivers/input/joystick/xpad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/joystick/xpad.c +1 -1
@@ -169,12 +169,12 @@ static const struct xpad_device { { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX }, { 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX }, { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 }, + { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX360 }, { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 }, { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX }, { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX }, { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX }, { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX }, - { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX }, { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX }, { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX }, { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX },
Greg Kroah-Hartman
maintainerPATCH 21/187 pch_uart: Fix dma_sync_sg_for_device() nents value
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 6c0e9f05c9d7875995b0e92ace71be947f280bbd upstream.
The dma_sync_sg_for_device() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned according to the documentation in Documentation/core-api/dma-api.rst:450:
With the sync_sg API, all the parameters must be the same as those passed into the sg mapping API.
--- drivers/tty/serial/pch_uart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/pch_uart.c +1 -1
@@ -954,7 +954,7 @@ static unsigned int dma_handle_tx(struct __func__);return 0 ; } -dma_sync_sg_for_device (port->dev, priv->sg_tx_p, nent,DMA_TO_DEVICE ); +dma_sync_sg_for_device (port->dev, priv->sg_tx_p, num,DMA_TO_DEVICE ); priv->desc_tx = desc; desc->callback = pch_dma_tx_complete; desc->callback_param = priv;
Greg Kroah-Hartman
maintainerPATCH 22/187 spi: Add check for 8-bit transfer with 8 IO mode support
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Ming Lin <[email protected]>
commit 710505212e3272396394f8cf78e3ddfd05df3f22 upstream.
The current SPI framework does not verify if the SPI device supports 8 IO mode when doing an 8-bit transfer. This patch adds a check to ensure that if the transfer tx_nbits or rx_nbits is 8, the SPI mode must support 8 IO. If not, an error is returned, preventing undefined behavior.
--- drivers/spi/spi.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/spi/spi.c +10 -4
@@ -4133,10 +4133,13 @@ static int __spi_validate(struct spi_dev xfer->tx_nbits != SPI_NBITS_OCTAL)return -EINVAL ;if ((xfer->tx_nbits ==SPI_NBITS_DUAL ) && - !(spi->mode & (SPI_TX_DUAL |SPI_TX_QUAD ))) + !(spi->mode & (SPI_TX_DUAL |SPI_TX_QUAD |SPI_TX_OCTAL )))return -EINVAL ;if ((xfer->tx_nbits ==SPI_NBITS_QUAD ) && - !(spi->mode &SPI_TX_QUAD )) + !(spi->mode & (SPI_TX_QUAD |SPI_TX_OCTAL ))) +return -EINVAL ; +if ((xfer->tx_nbits ==SPI_NBITS_OCTAL ) && + !(spi->mode &SPI_TX_OCTAL ))return -EINVAL ; }/* Check transfer rx_nbits */
@@ -4149,10 +4152,13 @@ static int __spi_validate(struct spi_dev xfer->rx_nbits != SPI_NBITS_OCTAL)return -EINVAL ;if ((xfer->rx_nbits ==SPI_NBITS_DUAL ) && - !(spi->mode & (SPI_RX_DUAL |SPI_RX_QUAD ))) + !(spi->mode & (SPI_RX_DUAL |SPI_RX_QUAD |SPI_RX_OCTAL )))return -EINVAL ;if ((xfer->rx_nbits ==SPI_NBITS_QUAD ) && - !(spi->mode &SPI_RX_QUAD )) + !(spi->mode & (SPI_RX_QUAD |SPI_RX_OCTAL ))) +return -EINVAL ; +if ((xfer->rx_nbits ==SPI_NBITS_OCTAL ) && + !(spi->mode &SPI_RX_OCTAL ))return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 23/187 tools/hv: fcopy: Fix irregularities with size of ring buffer
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naman Jain <[email protected]>
commit a4131a50d072b369bfed0b41e741c41fd8048641 upstream.
Size of ring buffer, as defined in uio_hv_generic driver, is no longer fixed to 16 KB. This creates a problem in fcopy, since this size was hardcoded. With the change in place to make ring sysfs node actually reflect the size of underlying ring buffer, it is safe to get the size of ring sysfs file and use it for ring buffer size in fcopy daemon. Fix the issue of disparity in ring buffer size, by making it dynamic in fcopy uio daemon.
Message-ID: <[email protected]>
--- tools/hv/hv_fcopy_uio_daemon.c | 91 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 81 insertions(+), 10 deletions(-)
tools/hv/hv_fcopy_uio_daemon.c +81 -10
@@ -35,7 +35,10 @@#define WIN8_SRV_MINOR 1#define WIN8_SRV_VERSION (WIN8_SRV_MAJOR << 16 | WIN8_SRV_MINOR) -#define FCOPY_UIO "/sys/bus/vmbus/devices/eb765408-105f-49b6-b4aa-c123b64d17d4/uio" +#define FCOPY_DEVICE_PATH (subdir) \ + "/sys/bus/vmbus/devices/eb765408-105f-49b6-b4aa-c123b64d17d4/" #subdir +#define FCOPY_UIO_PATH FCOPY_DEVICE_PATH(uio) +#define FCOPY_CHANNELS_PATH FCOPY_DEVICE_PATH(channels)#define FCOPY_VER_COUNT 1static const int fcopy_versions[] = {
@@ -47,9 +50,62 @@ static const int fw_versions[] = {UTIL_FW_VERSION }; -#define HV_RING_SIZE 0x4000/* 16KB ring buffer size */ +static uint32_t get_ring_buffer_size (void ) +{ +char ring_path[PATH_MAX ]; +DIR *dir; +struct dirent *entry; +struct stat st; +uint32_t ring_size =0 ; +int retry_count =0 ; -static unsigned char desc[HV_RING_SIZE ]; +/* Find the channel directory */ + dir =opendir (FCOPY_CHANNELS_PATH ); +if (!dir) { +usleep (100 *1000 );/* Avoid race with kernel, wait 100ms and retry once */ + dir =opendir (FCOPY_CHANNELS_PATH ); +if (!dir) { +syslog (LOG_ERR ,"Failed to open channels directory: %s" ,strerror (errno)); +return 0 ; + } + } + +retry_once: +while ((entry =readdir (dir)) !=NULL ) { +if (entry->d_type ==DT_DIR &&strcmp (entry->d_name,"." ) !=0 && +strcmp (entry->d_name,".." ) !=0 ) { +snprintf (ring_path,sizeof (ring_path),"%s/%s/ring" , +FCOPY_CHANNELS_PATH , entry->d_name); + +if (stat (ring_path, &st) ==0 ) { +/* +* stat returns size of Tx, Rx rings combined, +* so take half of it for individual ring size. +*/ + ring_size = (uint32_t )st.st_size /2 ; +syslog (LOG_INFO ,"Ring buffer size from %s: %u bytes" , + ring_path, ring_size); +break ; + } + } + } + +if (!ring_size && retry_count ==0 ) { + retry_count =1 ; +rewinddir (dir); +usleep (100 *1000 );/* Wait 100ms and retry once */ + goto retry_once; + } + +closedir (dir); + +if (!ring_size) +syslog (LOG_ERR ,"Could not determine ring size" ); + +return ring_size; +} + +static unsigned char *desc;static int target_fd;static char target_fname[PATH_MAX ];
@@ -406,7 +462,7 @@ int main(int argc, char *argv[])int daemonize =1 , long_index =0 , opt, ret = -EINVAL ;struct vmbus_br txbr, rxbr;void *ring; -uint32_t len =HV_RING_SIZE ; +uint32_t ring_size, len;char uio_name[NAME_MAX ] = {0 };char uio_dev_path[PATH_MAX ] = {0 };
@@ -437,7 +493,20 @@ int main(int argc, char *argv[])openlog ("HV_UIO_FCOPY" ,0 ,LOG_USER );syslog (LOG_INFO ,"starting; pid is:%d" ,getpid ()); -fcopy_get_first_folder (FCOPY_UIO , uio_name); + ring_size =get_ring_buffer_size (); +if (!ring_size) { + ret = -ENODEV ; + goto exit; + } + + desc =malloc (ring_size *sizeof (unsigned char )); +if (!desc) { +syslog (LOG_ERR ,"malloc failed for desc buffer" ); + ret = -ENOMEM ; + goto exit; + } + +fcopy_get_first_folder (FCOPY_UIO_PATH , uio_name);snprintf (uio_dev_path,sizeof (uio_dev_path),"/dev/%s" , uio_name); fcopy_fd =open (uio_dev_path,O_RDWR );
@@ -445,17 +514,17 @@ int main(int argc, char *argv[])syslog (LOG_ERR ,"open %s failed; error: %d %s" , uio_dev_path, errno,strerror (errno)); ret = fcopy_fd; - goto exit; + goto free_desc; } - ring =vmbus_uio_map (&fcopy_fd,HV_RING_SIZE ); + ring =vmbus_uio_map (&fcopy_fd, ring_size);if (!ring) { ret = errno;syslog (LOG_ERR ,"mmap ringbuffer failed; error: %d %s" , ret,strerror (ret)); goto close; } -vmbus_br_setup (&txbr, ring,HV_RING_SIZE ); -vmbus_br_setup (&rxbr, (char *)ring +HV_RING_SIZE ,HV_RING_SIZE ); +vmbus_br_setup (&txbr, ring, ring_size); +vmbus_br_setup (&rxbr, (char *)ring + ring_size, ring_size); rxbr.vbr->imask =0 ;
@@ -472,7 +541,7 @@ int main(int argc, char *argv[]) goto close; } - len =HV_RING_SIZE ; + len = ring_size; ret =rte_vmbus_chan_recv_raw (&rxbr, desc, &len);if (unlikely (ret <=0 )) {/* This indicates a failure to communicate (or worse) */
@@ -492,6 +561,8 @@ int main(int argc, char *argv[]) } close:close (fcopy_fd); +free_desc: +free (desc); exit:return ret; }
Greg Kroah-Hartman
maintainerPATCH 24/187 dm-bufio: fix sched in atomic context
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheng Yong <[email protected]>
commit b1bf1a782fdf5c482215c0c661b5da98b8e75773 upstream.
If "try_verify_in_tasklet" is set for dm-verity, DM_BUFIO_CLIENT_NO_SLEEP is enabled for dm-bufio. However, when bufio tries to evict buffers, there is a chance to trigger scheduling in spin_lock_bh, the following warning is hit:
BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2745
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 123, name: kworker/2:2preempt_count: 201, expected: 0
RCU nest depth: 0, expected: 0
4 locks held by kworker/2:2/123:
#0: ffff88800a2d1548 ((wq_completion)dm_bufio_cache){....}-{0:0}, at: process_one_work+0xe46/0x1970 #1: ffffc90000d97d20 ((work_completion)(&dm_bufio_replacement_work)){....}-{0:0}, at: process_one_work+0x763/0x1970 #2: ffffffff8555b528 (dm_bufio_clients_lock){....}-{3:3}, at: do_global_cleanup+0x1ce/0x710
#3: ffff88801d5820b8 (&c->spinlock){....}-{2:2}, at: do_global_cleanup+0x2a5/0x710
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 2 UID: 0 PID: 123 Comm: kworker/2:2 Not tainted 6.16.0-rc3-g90548c634bd0 #305 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: dm_bufio_cache do_global_cleanup Call Trace: <TASK> dump_stack_lvl+0x53/0x70 __might_resched+0x360/0x4e0 do_global_cleanup+0x2f5/0x710 process_one_work+0x7db/0x1970 worker_thread+0x518/0xea0 kthread+0x359/0x690 ret_from_fork+0xf3/0x1b0 ret_from_fork_asm+0x1a/0x30 </TASK>
That can be reproduced by:
veritysetup format --data-block-size=4096 --hash-block-size=4096 /dev/vda /dev/vdb SIZE=$(blockdev --getsz /dev/vda) dmsetup create myverity -r --table "0 $SIZE verity 1 /dev/vda /dev/vdb 4096 4096 <data_blocks> 1 sha256 <root_hash> <salt> 1 try_verify_in_tasklet" mount /dev/dm-0 /mnt -o ro echo 102400 > /sys/module/dm_bufio/parameters/max_cache_size_bytes [read files in /mnt]
--- drivers/md/dm-bufio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/md/dm-bufio.c +5 -1
@@ -2750,7 +2750,11 @@ static unsigned long __evict_many(struct__make_buffer_clean (b);__free_buffer_wake (b); -cond_resched (); +if (need_resched ()) { +dm_bufio_unlock (c); +cond_resched (); +dm_bufio_lock (c); + } }return count;
Greg Kroah-Hartman
maintainerPATCH 25/187 HID: core: ensure the allocated report buffer can contain the reserved report ID
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 4f15ee98304b96e164ff2340e1dfd6181c3f42aa upstream.
When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7.
--- drivers/hid/hid-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/hid/hid-core.c +4 -1
@@ -1883,9 +1883,12 @@ u8 *hid_alloc_report_buf(struct hid_repo/* * 7 extra bytes are necessary to achieve proper functionality * of implement() working on 8 byte chunks +* 1 extra byte for the report ID if it is null (not used) so +* we can reserve that extra byte in the first position of the buffer +* when sending it to .raw_request() */ -u32 len =hid_report_len (report) +7 ; +u32 len =hid_report_len (report) +7 + (report->id ==0 );return kzalloc (len, flags); }
Greg Kroah-Hartman
maintainerPATCH 26/187 HID: core: ensure __hid_request reserves the report ID as the first byte
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 0d0777ccaa2d46609d05b66ba0096802a2746193 upstream.
The low level transport driver expects the first byte to be the report ID, even when the report ID is not use (in which case they just shift the buffer).
However, __hid_request() whas not offsetting the buffer it used by one in this case, meaning that the raw_request() callback emitted by the transport driver would be stripped of the first byte.
Note: this changes the API for uhid devices when a request is made through hid_hw_request. However, several considerations makes me think this is fine:
- every request to a HID device made through hid_hw_request() would see that change, but every request made through hid_hw_raw_request() already has the new behaviour. So that means that the users are already facing situations where they might have or not the first byte being the null report ID when it is 0. We are making things more straightforward in the end.
- uhid is mainly used for BLE devices
- uhid is also used for testing, but I don't see that change a big issue
- for BLE devices, we can check which kernel module is calling hid_hw_request()
- and in those modules, we can check which are using a Bluetooth device
- and then we can check if the command is used with a report ID or not.
- surprise: none of the kernel module are using a report ID 0
- and finally, bluez, in its function set_report()[0], does the same shift if the report ID is 0 and the given buffer has a size > 0.
[0] https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/profiles/input/hog-lib.c#n879
--- drivers/hid/hid-core.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/hid/hid-core.c +9 -2
@@ -1976,7 +1976,7 @@ static struct hid_report *hid_get_reportint __hid_request (struct hid_device *hid,struct hid_report *report,enum hid_class_request reqtype) { -char *buf; +char *buf, *data_buf;int ret;u32 len;
@@ -1984,10 +1984,17 @@ int __hid_request(struct hid_device *hidif (!buf)return -ENOMEM ; + data_buf = buf; len =hid_report_len (report); +if (report->id ==0 ) { +/* reserve the first byte for the report ID */ + data_buf++; + len++; + } +if (reqtype ==HID_REQ_SET_REPORT ) -hid_output_report (report, buf); +hid_output_report (report, data_buf); ret = hid->ll_driver->raw_request (hid, report->id, buf, len, report->type, reqtype);
Greg Kroah-Hartman
maintainerPATCH 27/187 HID: core: do not bypass hid_hw_raw_request
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit c2ca42f190b6714d6c481dfd3d9b62ea091c946b upstream.
hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used.
--- drivers/hid/hid-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/hid/hid-core.c +1 -2
@@ -1996,8 +1996,7 @@ int __hid_request(struct hid_device *hidif (reqtype ==HID_REQ_SET_REPORT )hid_output_report (report, data_buf); - ret = hid->ll_driver->raw_request (hid, report->id, buf, len, - report->type, reqtype); + ret =hid_hw_raw_request (hid, report->id, buf, len, report->type, reqtype);if (ret <0 ) {dbg_hid ("unable to complete request: %d\n" , ret); goto out;
Greg Kroah-Hartman
maintainerPATCH 28/187 tracing/probes: Avoid using params uninitialized in parse_btf_arg()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 1ed171a3afe81531b3ace96bd151a372dda3ee25 upstream.
After a recent change in clang to strengthen uninitialized warnings [1], it points out that in one of the error paths in parse_btf_arg(), params is used uninitialized:
kernel/trace/trace_probe.c:660:19: warning: variable 'params' is uninitialized when used here [-Wuninitialized]
660 | return PTR_ERR(params);
| ^~~~~~Match many other NO_BTF_ENTRY error cases and return -ENOENT, clearing up the warning.
--- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_probe.c +1 -1
@@ -657,7 +657,7 @@ static int parse_btf_arg(char *varname, ret =query_btf_context (ctx);if (ret <0 || ctx->nr_params ==0 ) {trace_probe_log_err (ctx->offset,NO_BTF_ENTRY ); -return PTR_ERR (params); +return -ENOENT ; } } params = ctx->params;
Greg Kroah-Hartman
maintainerPATCH 29/187 tracing: Add down_write(trace_event_sem) when adding trace event
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit b5e8acc14dcb314a9b61ff19dcd9fdd0d88f70df upstream.
When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk formats to replace enum names with their values.
If two modules are loaded at the same time, the adding of the event to the ftrace_events list can corrupt the walking of the list in the code that is modifying the printk format strings and crash the kernel.
The addition of the event should take the trace_event_sem for write while it adds the new event.
Also add a lockdep_assert_held() on that semaphore in __trace_add_event_dirs() as it iterates the list.
--- kernel/trace/trace_events.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/trace/trace_events.c +5 -0
@@ -3125,7 +3125,10 @@ __register_event(struct trace_event_callif (ret <0 )return ret; +down_write (&trace_event_sem);list_add (&call->list, &ftrace_events); +up_write (&trace_event_sem); +if (call->flags &TRACE_EVENT_FL_DYNAMIC )atomic_set (&call->refcnt,0 );else
@@ -3739,6 +3742,8 @@ __trace_add_event_dirs(struct trace_arrastruct trace_event_call *call;int ret; +lockdep_assert_held (&trace_event_sem); +list_for_each_entry (call, &ftrace_events, list) { ret =__trace_add_new_event (call, tr);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 30/187 tracing/osnoise: Fix crash in timerlat_dump_stack()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
commit 85a3bce695b361d85fc528e6fbb33e4c8089c806 upstream.
We have observed kernel panics when using timerlat with stack saving, with the following dmesg output:
memcpy: detected buffer overflow: 88 byte write of buffer size 0
WARNING: CPU: 2 PID: 8153 at lib/string_helpers.c:1032 __fortify_report+0x55/0xa0 CPU: 2 UID: 0 PID: 8153 Comm: timerlatu/2 Kdump: loaded Not tainted 6.15.3-200.fc42.x86_64 #1 PREEMPT(lazy) Call Trace: <TASK> ? trace_buffer_lock_reserve+0x2a/0x60 __fortify_panic+0xd/0xf __timerlat_dump_stack.cold+0xd/0xd timerlat_dump_stack.part.0+0x47/0x80 timerlat_fd_read+0x36d/0x390 vfs_read+0xe2/0x390 ? syscall_exit_to_user_mode+0x1d5/0x210 ksys_read+0x73/0xe0 do_syscall_64+0x7b/0x160 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
__timerlat_dump_stack() constructs the ftrace stack entry like this:
struct stack_entry *entry;
...memcpy(&entry->caller, fstack->calls, size);entry->size = fstack->nr_entries;
Since commit e7186af7fb26 ("tracing: Add back FORTIFY_SOURCE logic to kernel_stack event structure"), struct stack_entry marks its caller field with __counted_by(size). At the time of the memcpy, entry->size contains garbage from the ringbuffer, which under some circumstances is zero, triggering a kernel panic by buffer overflow.
Populate the size field before the memcpy so that the out-of-bounds check knows the correct size. This is analogous to __ftrace_trace_stack().
--- kernel/trace/trace_osnoise.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_osnoise.c +1 -1
@@ -637,8 +637,8 @@ __timerlat_dump_stack(struct trace_buffe entry =ring_buffer_event_data (event); -memcpy (&entry->caller, fstack->calls, size); entry->size = fstack->nr_entries; +memcpy (&entry->caller, fstack->calls, size);trace_buffer_unlock_commit_nostack (buffer, event); }
Greg Kroah-Hartman
maintainerPATCH 31/187 rust: init: Fix generics in *_init! macros
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <[email protected]>
commit fe49aae0fcb348b656bbde2eb1d1c75d8a1a5c3c upstream.
The match pattern for a optional trailing comma in the list of generics is erroneously repeated in the code block resulting in following error:
| error: attempted to repeat an expression containing no syntax variables matched as repeating at this depth
| --> rust/kernel/init.rs:301:73
| |
| 301 | ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? {
| | ^^^Remove "$(,)?" from all code blocks in the try_init! and try_pin_init! definitions.
--- rust/kernel/init.rs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
rust/kernel/init.rs +4 -4
@@ -231,14 +231,14 @@ macro_rules! try_init { ($(&$this:ident in)? $t:ident $(::<$($generics:ty),* $(,)?>)? { $($fields:tt)* }) => { - ::pin_init::try_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { + ::pin_init::try_init!($(&$this in)? $t $(::<$($generics),*>)? { $($fields)* }? $crate ::error::Error ) }; ($(&$this:ident in)? $t:ident $(::<$($generics:ty),* $(,)?>)? { $($fields:tt)* }? $err:ty) => { - ::pin_init::try_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { + ::pin_init::try_init!($(&$this in)? $t $(::<$($generics),*>)? { $($fields)* }? $err) };
@@ -291,14 +291,14 @@ macro_rules! try_pin_init { ($(&$this:ident in)? $t:ident $(::<$($generics:ty),* $(,)?>)? { $($fields:tt)* }) => { - ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { + ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),*>)? { $($fields)* }? $crate ::error::Error ) }; ($(&$this:ident in)? $t:ident $(::<$($generics:ty),* $(,)?>)? { $($fields:tt)* }? $err:ty) => { - ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { + ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),*>)? { $($fields)* }? $err) };
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 32/187 objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit aa7b65c2a29e8b07057b13624102c6810597c0d5 upstream.
Starting with Rust 1.89.0 (expected 2025-08-07), under CONFIG_RUST_DEBUG_ASSERTIONS=y, objtool may report:
rust/kernel.o: warning: objtool: _R..._6kernel4pageNtB5_4Page8read_raw() falls through to next function _R..._6kernel4pageNtB5_4Page9write_raw()
(and many others) due to calls to the noreturn symbol:
core::panicking::panic_nounwind_fmt
Thus add the mangled one to the list so that objtool knows it is actually noreturn.
See commit 56d680dd23c3 ("objtool/rust: list noreturn Rust functions") for more details.
--- tools/objtool/check.c | 1 + 1 file changed, 1 insertion(+)
tools/objtool/check.c +1 -0
@@ -224,6 +224,7 @@ static bool is_rust_noreturn(const strucstr_ends_with (func->name,"_4core9panicking14panic_explicit" ) ||str_ends_with (func->name,"_4core9panicking14panic_nounwind" ) ||str_ends_with (func->name,"_4core9panicking18panic_bounds_check" ) || +str_ends_with (func->name,"_4core9panicking18panic_nounwind_fmt" ) ||str_ends_with (func->name,"_4core9panicking19assert_failed_inner" ) ||str_ends_with (func->name,"_4core9panicking30panic_null_pointer_dereference" ) || str_ends_with(func->name, "_4core9panicking36panic_misaligned_pointer_dereference") ||
Greg Kroah-Hartman
maintainerPATCH 33/187 drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eeli Haapalainen <[email protected]>
commit 83261934015c434fabb980a3e613b01d9976e877 upstream.
Commit 42cdf6f687da ("drm/amdgpu/gfx8: always restore kcq MQDs") made the ring pointer always to be reset on resume from suspend. This caused compute rings to fail since the reset was done without also resetting it for the firmware. Reset wptr on the GPU to avoid a disconnect between the driver and firmware wptr.
--- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +1 -0
@@ -4664,6 +4664,7 @@ static int gfx_v8_0_kcq_init_queue(strucmemcpy (mqd, adev->gfx.mec.mqd_backup[mqd_idx],sizeof (struct vi_mqd_allocation ));/* reset ring buffer */ ring->wptr =0 ; +atomic64_set ((atomic64_t *)ring->wptr_cpu_addr,0 );amdgpu_ring_clear_ring (ring); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 34/187 drm/panfrost: Fix scheduler workqueue bug
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
commit cb345f954eacd162601e7d07ca2f0f0a17b54ee3 upstream.
When the GPU scheduler was ported to using a struct for its initialization parameters, it was overlooked that panfrost creates a distinct workqueue for timeout handling.
The pointer to this new workqueue is not initialized to the struct, resulting in NULL being passed to the scheduler, which then uses the system_wq for timeout handling.
Set the correct workqueue to the init args struct.
--- drivers/gpu/drm/panfrost/panfrost_job.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panfrost/panfrost_job.c +1 -1
@@ -841,7 +841,6 @@ int panfrost_job_init(struct panfrost_device *pfdev) .num_rqs = DRM_SCHED_PRIORITY_COUNT, .credit_limit = 2, .timeout = msecs_to_jiffies(JOB_TIMEOUT_MS), - .timeout_wq = pfdev->reset.wq, .name = "pan_js", .dev = pfdev->dev, };
@@ -879,6 +878,7 @@ int panfrost_job_init(struct panfrost_device *pfdev) pfdev->reset.wq =alloc_ordered_workqueue ("panfrost-reset" ,0 );if (!pfdev->reset.wq)return -ENOMEM ; + args.timeout_wq = pfdev->reset.wq;for (j =0 ; j <NUM_JOB_SLOTS ; j++) { js->queue[j].fence_context =dma_fence_context_alloc (1 );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 35/187 drm/amdgpu: Increase reset counter only on success
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
commit 86790e300d8b7bbadaad5024e308c52f1222128f upstream.
Increment the reset counter only if soft recovery succeeded. This is consistent with a ring hard reset behaviour where counter gets incremented only if hard reset succeeded.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +7 -2
@@ -463,6 +463,7 @@ bool amdgpu_ring_soft_recovery(struct am {unsigned long flags;ktime_t deadline; +bool ret;if (unlikely (ring->adev->debug_disable_soft_recovery))return false;
@@ -477,12 +478,16 @@ bool amdgpu_ring_soft_recovery(struct amdma_fence_set_error (fence, -ENODATA );spin_unlock_irqrestore (fence->lock, flags); -atomic_inc (&ring->adev->gpu_reset_counter);while (!dma_fence_is_signaled (fence) &&ktime_to_ns (ktime_sub (deadline,ktime_get ())) >0 ) ring->funcs->soft_recovery (ring, vmid); -return dma_fence_is_signaled (fence); + ret =dma_fence_is_signaled (fence); +/* increment the counter only if soft reset worked */ +if (ret) +atomic_inc (&ring->adev->gpu_reset_counter); + +return ret; }/*
Greg Kroah-Hartman
maintainerPATCH 36/187 drm/amd/display: Disable CRTC degamma LUT for DCN401
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melissa Wen <[email protected]>
commit 97a0f2b5f4d4afcec34376e4428e157ce95efa71 upstream.
In DCN401 pre-blending degamma LUT isn't affecting cursor as in previous DCN version. As this is not the behavior close to what is expected for CRTC degamma LUT, disable CRTC degamma LUT property in this HW.
---
When enabling HDR on KDE, it takes the first CRTC 1D LUT available and apply a color transformation (Gamma 2.2 -> PQ). AMD driver usually advertises a CRTC degamma LUT as the first CRTC 1D LUT, but it's actually applied pre-blending. In previous HW version, it seems to work fine because the 1D LUT was applied to cursor too, but DCN401 presents a different behavior and the 1D LUT isn't affecting the hardware cursor.
To address the wrong gamma on cursor with HDR (see the link), I came up with this patch that disables CRTC degamma LUT in this hw, since it presents a different behavior than others. With this KDE sees CRTC regamma LUT as the first post-blending 1D LUT available. This is actually more consistent with AMD color pipeline. It was tested by the reporter, since I don't have the HW available for local testing and debugging.
Melissa
---
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +10 -1
@@ -737,7 +737,16 @@ int amdgpu_dm_crtc_init(struct amdgpu_di* support programmable degamma anywhere. */ is_dcn = dm->adev->dm.dc->caps.color.dpp.dcn_arch; -drm_crtc_enable_color_mgmt (&acrtc->base, is_dcn ?MAX_COLOR_LUT_ENTRIES :0 , +/* Dont't enable DRM CRTC degamma property for DCN401 since the +* pre-blending degamma LUT doesn't apply to cursor, and therefore +* can't work similar to a post-blending degamma LUT as in other hw +* versions. +* TODO: revisit it once KMS plane color API is merged. +*/ +drm_crtc_enable_color_mgmt (&acrtc->base, + (is_dcn && + dm->adev->dm.dc->ctx->dce_version !=DCN_VERSION_4_01 ) ? +MAX_COLOR_LUT_ENTRIES :0 , true,MAX_COLOR_LUT_ENTRIES );drm_mode_crtc_set_gamma_size (&acrtc->base,MAX_COLOR_LEGACY_LUT_ENTRIES );
Greg Kroah-Hartman
maintainerPATCH 37/187 drm/amd/display: Free memory allocation
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clayton King <[email protected]>
commit b2ee9fa0fe6416e16c532f61b909c79b5d4ed282 upstream.
[WHY]
Free memory to avoid memory leak
--- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c +2 -1
@@ -1565,7 +1565,7 @@ struct clk_mgr_internal *dcn401_clk_mgr_ clk_mgr->base.bw_params =kzalloc (sizeof (*clk_mgr->base.bw_params),GFP_KERNEL );if (!clk_mgr->base.bw_params) {BREAK_TO_DEBUGGER (); -kfree (clk_mgr); +kfree (clk_mgr401);return NULL ; }
@@ -1576,6 +1576,7 @@ struct clk_mgr_internal *dcn401_clk_mgr_if (!clk_mgr->wm_range_table) {BREAK_TO_DEBUGGER ();kfree (clk_mgr->base.bw_params); +kfree (clk_mgr401);return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 38/187 netfs: Fix copy-to-cache so that it performs collection with ceph+fscache
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 4c238e30774e3022a505fa54311273add7570f13 upstream.
The netfs copy-to-cache that is used by Ceph with local caching sets up a new request to write data just read to the cache. The request is started and then left to look after itself whilst the app continues. The request gets notified by the backing fs upon completion of the async DIO write, but then tries to wake up the app because NETFS_RREQ_OFFLOAD_COLLECTION isn't set - but the app isn't waiting there, and so the request just hangs.
Fix this by setting NETFS_RREQ_OFFLOAD_COLLECTION which causes the notification from the backing filesystem to put the collection onto a work queue instead.
--- fs/netfs/read_pgpriv2.c | 1 + 1 file changed, 1 insertion(+)
fs/netfs/read_pgpriv2.c +1 -0
@@ -110,6 +110,7 @@ static struct netfs_io_request *netfs_pgpriv2_begin_copy_to_cache(if (!creq->io_streams[1 ].avail) goto cancel_put; +__set_bit (NETFS_RREQ_OFFLOAD_COLLECTION , &creq->flags);trace_netfs_write (creq, netfs_write_trace_copy_to_cache);netfs_stat (&netfs_n_wh_copy_to_cache); rreq->copy_to_cache = creq;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 39/187 netfs: Fix race between cache write completion and ALL_QUEUED being set
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 89635eae076cd8eaa5cb752f66538c9dc6c9fdc3 upstream.
When netfslib is issuing subrequests, the subrequests start processing immediately and may complete before we reach the end of the issuing function. At the end of the issuing function we set NETFS_RREQ_ALL_QUEUED to indicate to the collector that we aren't going to issue any more subreqs and that it can do the final notifications and cleanup.
Now, this isn't a problem if the request is synchronous (NETFS_RREQ_OFFLOAD_COLLECTION is unset) as the result collection will be done in-thread and we're guaranteed an opportunity to run the collector.
However, if the request is asynchronous, collection is primarily triggered by the termination of subrequests queuing it on a workqueue. Now, a race can occur here if the app thread sets ALL_QUEUED after the last subrequest terminates.
This can happen most easily with the copy2cache code (as used by Ceph) where, in the collection routine of a read request, an asynchronous write request is spawned to copy data to the cache. Folios are added to the write request as they're unlocked, but there may be a delay before ALL_QUEUED is set as the write subrequests may complete before we get there.
If all the write subreqs have finished by the ALL_QUEUED point, no further events happen and the collection never happens, leaving the request hanging.
Fix this by queuing the collector after setting ALL_QUEUED. This is a bit heavy-handed and it may be sufficient to do it only if there are no extant subreqs.
Also add a tracepoint to cross-reference both requests in a copy-to-request operation and add a trace to the netfs_rreq tracepoint to indicate the setting of ALL_QUEUED.
--- fs/netfs/read_pgpriv2.c | 4 ++++ include/trace/events/netfs.h | 30 ++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+)
fs/netfs/read_pgpriv2.c +4 -0
@@ -111,6 +111,7 @@ static struct netfs_io_request *netfs_pg goto cancel_put;__set_bit (NETFS_RREQ_OFFLOAD_COLLECTION , &creq->flags); +trace_netfs_copy2cache (rreq, creq);trace_netfs_write (creq, netfs_write_trace_copy_to_cache);netfs_stat (&netfs_n_wh_copy_to_cache); rreq->copy_to_cache = creq;
@@ -155,6 +156,9 @@ void netfs_pgpriv2_end_copy_to_cache(strnetfs_issue_write (creq, &creq->io_streams[1 ]);smp_wmb ();/* Write lists before ALL_QUEUED. */ set_bit (NETFS_RREQ_ALL_QUEUED , &creq->flags); +trace_netfs_rreq (rreq, netfs_rreq_trace_end_copy_to_cache); +if (list_empty_careful (&creq->io_streams[1 ].subrequests)) +netfs_wake_collector (creq);netfs_put_request (creq, netfs_rreq_trace_put_return); creq->copy_to_cache =NULL ;
include/trace/events/netfs.h +30 -0
@@ -55,6 +55,7 @@ EM(netfs_rreq_trace_complete, "COMPLET") \ EM(netfs_rreq_trace_dirty, "DIRTY ") \ EM(netfs_rreq_trace_done, "DONE ") \ + EM(netfs_rreq_trace_end_copy_to_cache, "END-C2C") \ EM(netfs_rreq_trace_free, "FREE ") \ EM(netfs_rreq_trace_recollect, "RECLLCT") \EM (netfs_rreq_trace_redirty,"REDIRTY" ) \
@@ -550,6 +551,35 @@ TRACE_EVENT(netfs_write, __entry->start, __entry->start + __entry->len - 1) ); +TRACE_EVENT (netfs_copy2cache, + TP_PROTO(const struct netfs_io_request *rreq, + const struct netfs_io_request *creq), + +TP_ARGS (rreq, creq), + +TP_STRUCT__entry ( + __field(unsigned int, rreq) + __field(unsigned int, creq) + __field(unsigned int, cookie) + __field(unsigned int, ino) + ), + +TP_fast_assign ( + struct netfs_inode *__ctx = netfs_inode(rreq->inode); + struct fscache_cookie *__cookie = netfs_i_cookie(__ctx); + __entry->rreq = rreq->debug_id; + __entry->creq = creq->debug_id; + __entry->cookie = __cookie ? __cookie->debug_id : 0; + __entry->ino = rreq->inode->i_ino; + ), + +TP_printk ("R=%08x CR=%08x c=%08x i=%x " , + __entry->rreq, + __entry->creq, + __entry->cookie, + __entry->ino) + ); + TRACE_EVENT(netfs_collect, TP_PROTO(const struct netfs_io_request *wreq),
Greg Kroah-Hartman
maintainerPATCH 40/187 ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edip Hazuri <[email protected]>
commit d9b99eb3d76a603442311926617654f0e35581d4 upstream.
The mute led on this laptop is using ALC245 but requires a quirk to work This patch enables the existing quirk for the device.
Tested on Victus 16-r0xxx Laptop. The LED behaviour works as intended.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10791,6 +10791,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x103c ,0x8b97 ,"HP" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8bb3 ,"HP Slim OMEN" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8bb4 ,"HP Slim OMEN" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x103c ,0x8bbe ,"HP Victus 16-r0xxx (MB 8BBE)" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8bc8 ,"HP Victus 15-fa1xxx" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8bcd ,"HP Omen 16-xd0xxx" ,ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT ), SND_PCI_QUIRK(0x103c, 0x8bdd, "HP Envy 17", ALC287_FIXUP_CS35L41_I2C_2),
Greg Kroah-Hartman
maintainerPATCH 41/187 ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit e201c19ddeed6b37f05617e529d8efa079657ed7 upstream.
ASUS ROG Strix G712LWS (PCI SSID 1043:1a83) requires the quirk for ALC294 headset mode in order to make the speaker and headset I/O working properly.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10983,6 +10983,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x1043 ,0x1a13 ,"Asus G73Jw" ,ALC269_FIXUP_ASUS_G73JW ),SND_PCI_QUIRK (0x1043 ,0x1a63 ,"ASUS UX3405MA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1a83 ,"ASUS UM5302LA" ,ALC294_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x1043 ,0x1a8e ,"ASUS G712LWS" ,ALC294_FIXUP_LENOVO_MIC_LOCATION ),SND_PCI_QUIRK (0x1043 ,0x1a8f ,"ASUS UX582ZS" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1b11 ,"ASUS UX431DA" ,ALC294_FIXUP_ASUS_COEF_1B ), SND_PCI_QUIRK(0x1043, 0x1b13, "ASUS U41SV/GA403U", ALC285_FIXUP_ASUS_GA403U_HEADSET_MIC),
Greg Kroah-Hartman
maintainerPATCH 42/187 io_uring/poll: fix POLLERR handling
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit c7cafd5b81cc07fb402e3068d134c21e60ea688c upstream.
8c8492ca64e7 ("io_uring/net: don't retry connect operation on EPOLLERR") is a little dirty hack that
1) wrongfully assumes that POLLERR equals to a failed request, which breaks all POLLERR users, e.g. all error queue recv interfaces.
2) deviates the connection request behaviour from connect(2), and
3) racy and solved at a wrong level.
Nothing can be done with 2) now, and 3) is beyond the scope of the patch. At least solve 1) by moving the hack out of generic poll handling into io_connect().
--- io_uring/net.c | 12 ++++++++---- io_uring/poll.c | 2 -- 2 files changed, 8 insertions(+), 6 deletions(-)
io_uring/net.c +8 -4
@@ -1749,9 +1749,11 @@ int io_connect(struct io_kiocb *req, unsint ret;bool force_nonblock = issue_flags &IO_URING_F_NONBLOCK ; -if (unlikely (req->flags &REQ_F_FAIL )) { - ret = -ECONNRESET ; - goto out; +if (connect->in_progress) { +struct poll_table_struct pt = { ._key =EPOLLERR }; + +if (vfs_poll (req->file, &pt) &EPOLLERR ) + goto get_sock_err; } file_flags = force_nonblock ?O_NONBLOCK :0 ;
@@ -1776,8 +1778,10 @@ int io_connect(struct io_kiocb *req, uns* which means the previous result is good. For both of these, * grab the sock_error() and use that for the completion. */ -if (ret == -EBADFD || ret == -EISCONN ) +if (ret == -EBADFD || ret == -EISCONN ) { +get_sock_err: ret =sock_error (sock_from_file (req->file)->sk); + } }if (ret == -ERESTARTSYS ) ret = -EINTR ;
io_uring/poll.c +0 -2
@@ -273,8 +273,6 @@ static int io_poll_check_events(struct ireturn IOU_POLL_REISSUE ; } } -if (unlikely (req->cqe.res &EPOLLERR )) -req_set_fail (req);if (req->apoll_events &EPOLLONESHOT )return IOU_POLL_DONE ;
Greg Kroah-Hartman
maintainerPATCH 43/187 Fix SMB311 posix special file creation to servers which do not advertise reparse support
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 8767cb3fbd514c4cf85b4f516ca30388e846f540 upstream.
Some servers (including Samba), support the SMB3.1.1 POSIX Extensions (which use reparse points for handling special files) but do not properly advertise file system attribute FILE_SUPPORTS_REPARSE_POINTS. Although we don't check for this attribute flag when querying special file information, we do check it when creating special files which
causes them to fail unnecessarily. If we have negotiated SMB3.1.1 POSIX Extensions
with the server we can expect the server to support creating special files via reparse points, and even if the server fails the operation due to really forbidding creating special files, then it should be no problem and is more likely to return a more accurate rc in any case (e.g. EACCES instead of EOPNOTSUPP).
Allow creating special files as long as the server supports either reparse points or the SMB3.1.1 POSIX Extensions (note that if the "sfu" mount option is specified it uses a different way of storing special files that does not rely on reparse points).
--- fs/smb/client/smb2inode.c | 3 ++- fs/smb/client/smb2ops.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
fs/smb/client/smb2inode.c +2 -1
@@ -1346,7 +1346,8 @@ struct inode *smb2_get_reparse_inode(str* empty object on the server. */ if (!(le32_to_cpu (tcon->fsAttrInfo.Attributes) &FILE_SUPPORTS_REPARSE_POINTS )) -return ERR_PTR (-EOPNOTSUPP ); +if (!tcon->posix_extensions) +return ERR_PTR (-EOPNOTSUPP ); oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, SYNCHRONIZE | DELETE |
fs/smb/client/smb2ops.c +2 -1
@@ -5246,7 +5246,8 @@ static int smb2_make_node(unsigned int xif (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_UNX_EMUL ) { rc =cifs_sfu_make_node (xid, inode, dentry, tcon, full_path, mode, dev); - }else if (le32_to_cpu (tcon->fsAttrInfo.Attributes) &FILE_SUPPORTS_REPARSE_POINTS ) { + }else if ((le32_to_cpu (tcon->fsAttrInfo.Attributes) &FILE_SUPPORTS_REPARSE_POINTS ) + || (tcon->posix_extensions)) { rc =smb2_mknod_reparse (xid, inode, dentry, tcon, full_path, mode, dev); }
Greg Kroah-Hartman
maintainerPATCH 44/187 mptcp: make fallback action and fallback decision atomic
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit f8a1d9b18c5efc76784f5a326e905f641f839894 upstream.
Syzkaller reported the following splat:
WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: <IRQ> tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 </IRQ> <TASK> __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4/0xe0 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x245/0x360 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc92f8a36ad Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf52802d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffcf52803a8 RCX: 00007fc92f8a36ad RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007fc92fae7ba0 R08: 0000000000000001 R09: 0000002800000000 R10: 00007fc92f700000 R11: 0000000000000246 R12: 00007fc92fae5fac R13: 00007fc92fae5fa0 R14: 0000000000026d00 R15: 0000000000026c51 </TASK> irq event stamp: 4068 hardirqs last enabled at (4076): [<ffffffff81544816>] __up_console_sem+0x76/0x80 kernel/printk/printk.c:344 hardirqs last disabled at (4085): [<ffffffff815447fb>] __up_console_sem+0x5b/0x80 kernel/printk/printk.c:342 softirqs last enabled at (3096): [<ffffffff840e1be0>] local_bh_enable include/linux/bottom_half.h:33 [inline] softirqs last enabled at (3096): [<ffffffff840e1be0>] inet_csk_listen_stop+0x2c0/0x1070 net/ipv4/inet_connection_sock.c:1524 softirqs last disabled at (3097): [<ffffffff813b6b9f>] do_softirq+0x3f/0x90 kernel/softirq.c:480
Since we need to track the 'fallback is possible' condition and the fallback status separately, there are a few possible races open between the check and the actual fallback action.
Add a spinlock to protect the fallback related information and use it close all the possible related races. While at it also remove the too-early clearing of allow_infinite_fallback in __mptcp_subflow_connect():
the field will be correctly cleared by subflow_finish_connect() if/when the connection will complete successfully.
If fallback is not possible, as per RFC, reset the current subflow.
Since the fallback operation can now fail and return value should be checked, rename the helper accordingly.
--- net/mptcp/options.c | 3 ++- net/mptcp/protocol.c | 40 +++++++++++++++++++++++++++++++++++----- net/mptcp/protocol.h | 26 +++++++++++++++++++------- net/mptcp/subflow.c | 11 +++++------ 4 files changed, 61 insertions(+), 19 deletions(-)
net/mptcp/options.c +2 -1
@@ -978,8 +978,9 @@ static bool check_fully_established(struif (subflow->mp_join) goto reset; subflow->mp_capable =0 ; +if (!mptcp_try_fallback (ssk)) + goto reset;pr_fallback (msk); -mptcp_do_fallback (ssk);return false; }
net/mptcp/protocol.c +35 -5
@@ -558,10 +558,9 @@ static bool mptcp_check_data_fin(structstatic void mptcp_dss_corruption (struct mptcp_sock *msk,struct sock *ssk) { -if (READ_ONCE (msk->allow_infinite_fallback)) { +if (mptcp_try_fallback (ssk)) {MPTCP_INC_STATS (sock_net (ssk),MPTCP_MIB_DSSCORRUPTIONFALLBACK ); -mptcp_do_fallback (ssk); }else {MPTCP_INC_STATS (sock_net (ssk),MPTCP_MIB_DSSCORRUPTIONRESET );mptcp_subflow_reset (ssk);
@@ -801,6 +800,14 @@ static bool __mptcp_finish_join(struct mif (sk->sk_state !=TCP_ESTABLISHED )return false; +spin_lock_bh (&msk->fallback_lock); +if (__mptcp_check_fallback (msk)) { +spin_unlock_bh (&msk->fallback_lock); +return false; + } +mptcp_subflow_joined (msk, ssk); +spin_unlock_bh (&msk->fallback_lock); +/* attach to msk socket only after we are sure we will deal with it * at close time */
@@ -809,7 +816,6 @@ static bool __mptcp_finish_join(struct mmptcp_subflow_ctx (ssk)->subflow_id = msk->subflow_id++;mptcp_sockopt_sync_locked (msk, ssk); -mptcp_subflow_joined (msk, ssk);mptcp_stop_tout_timer (sk);__mptcp_propagate_sndbuf (sk, ssk);return true;
@@ -1134,10 +1140,14 @@ static void mptcp_update_infinite_map(st mpext->infinite_map =1 ; mpext->data_len =0 ; +if (!mptcp_try_fallback (ssk)) { +mptcp_subflow_reset (ssk); +return ; + } +MPTCP_INC_STATS (sock_net (ssk),MPTCP_MIB_INFINITEMAPTX );mptcp_subflow_ctx (ssk)->send_infinite_map =0 ;pr_fallback (msk); -mptcp_do_fallback (ssk); }#define MPTCP_MAX_GSO_SIZE (GSO_LEGACY_MAX_SIZE - (MAX_TCP_HEADER + 1))
@@ -2541,9 +2551,9 @@ static void mptcp_check_fastclose(structstatic void __mptcp_retrans (struct sock *sk) { +struct mptcp_sendmsg_info info = { .data_lock_held = true, };struct mptcp_sock *msk =mptcp_sk (sk);struct mptcp_subflow_context *subflow; -struct mptcp_sendmsg_info info = {};struct mptcp_data_frag *dfrag;struct sock *ssk;int ret, err;
@@ -2588,6 +2598,18 @@ static void __mptcp_retrans(struct sock info.sent =0 ; info.limit =READ_ONCE (msk->csum_enabled) ? dfrag->data_len : dfrag->already_sent; + +/* +* make the whole retrans decision, xmit, disallow +* fallback atomic +*/ +spin_lock_bh (&msk->fallback_lock); +if (__mptcp_check_fallback (msk)) { +spin_unlock_bh (&msk->fallback_lock); +release_sock (ssk); +return ; + } +while (info.sent < info.limit) { ret =mptcp_sendmsg_frag (sk, ssk, dfrag, &info);if (ret <=0 )
@@ -2603,6 +2625,7 @@ static void __mptcp_retrans(struct sock info.size_goal);WRITE_ONCE (msk->allow_infinite_fallback, false); } +spin_unlock_bh (&msk->fallback_lock);release_sock (ssk); }
@@ -2736,6 +2759,7 @@ static void __mptcp_init_sock(struct soc msk->last_ack_recv = tcp_jiffies32;mptcp_pm_data_init (msk); +spin_lock_init (&msk->fallback_lock);/* re-use the csk retrans timer for MPTCP-level retrans */ timer_setup (&msk->sk.icsk_retransmit_timer, mptcp_retransmit_timer,0 );
@@ -3522,7 +3546,13 @@ bool mptcp_finish_join(struct sock *ssk)/* active subflow, already present inside the conn_list */ if (!list_empty (&subflow->node)) { +spin_lock_bh (&msk->fallback_lock); +if (__mptcp_check_fallback (msk)) { +spin_unlock_bh (&msk->fallback_lock); +return false; + }mptcp_subflow_joined (msk, ssk); +spin_unlock_bh (&msk->fallback_lock);mptcp_propagate_sndbuf (parent, ssk);return true; }
net/mptcp/protocol.h +19 -7
@@ -350,6 +350,10 @@ struct mptcp_sock {u32 subflow_id;u32 setsockopt_seq;char ca_name[TCP_CA_NAME_MAX ]; + +spinlock_t fallback_lock;/* protects fallback and +* allow_infinite_fallback +*/ };#define mptcp_data_lock (sk) spin_lock_bh(&(sk)->sk_lock.slock)
@@ -1208,15 +1212,21 @@ static inline bool mptcp_check_fallback(return __mptcp_check_fallback (msk); } -static inline void __mptcp_do_fallback (struct mptcp_sock *msk) +static inline bool __mptcp_try_fallback (struct mptcp_sock *msk) {if (__mptcp_check_fallback (msk)) {pr_debug ("TCP fallback already done (msk=%p)\n" , msk); -return ; +return true; } -if (WARN_ON_ONCE (!READ_ONCE (msk->allow_infinite_fallback))) -return ; +spin_lock_bh (&msk->fallback_lock); +if (!msk->allow_infinite_fallback) { +spin_unlock_bh (&msk->fallback_lock); +return false; + } +set_bit (MPTCP_FALLBACK_DONE , &msk->flags); +spin_unlock_bh (&msk->fallback_lock); +return true; }static inline bool __mptcp_has_initial_subflow (const struct mptcp_sock *msk)
@@ -1228,14 +1238,15 @@ static inline bool __mptcp_has_initial_s TCPF_SYN_RECV | TCPF_LISTEN)); } -static inline void mptcp_do_fallback (struct sock *ssk) +static inline bool mptcp_try_fallback (struct sock *ssk) {struct mptcp_subflow_context *subflow =mptcp_subflow_ctx (ssk);struct sock *sk = subflow->conn;struct mptcp_sock *msk; msk =mptcp_sk (sk); -__mptcp_do_fallback (msk); +if (!__mptcp_try_fallback (msk)) +return false;if (READ_ONCE (msk->snd_data_fin_enable) && !(ssk->sk_shutdown &SEND_SHUTDOWN )) {gfp_t saved_allocation = ssk->sk_allocation;
@@ -1247,6 +1258,7 @@ static inline void mptcp_do_fallback(strtcp_shutdown (ssk,SEND_SHUTDOWN ); ssk->sk_allocation = saved_allocation; } +return true; }#define pr_fallback (a) pr_debug("%s:fallback to TCP (msk=%p)\n", __func__, a)
@@ -1256,7 +1268,7 @@ static inline void mptcp_subflow_early_f {pr_fallback (msk); subflow->request_mptcp =0 ; -__mptcp_do_fallback (msk); +WARN_ON_ONCE (!__mptcp_try_fallback (msk)); }static inline bool mptcp_check_infinite_map (struct sk_buff *skb)
net/mptcp/subflow.c +5 -6
@@ -543,9 +543,11 @@ static void subflow_finish_connect(strucmptcp_get_options (skb, &mp_opt);if (subflow->request_mptcp) {if (!(mp_opt.suboptions &OPTION_MPTCP_MPC_SYNACK )) { +if (!mptcp_try_fallback (sk)) + goto do_reset; +MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_MPCAPABLEACTIVEFALLBACK ); -mptcp_do_fallback (sk);pr_fallback (msk); goto fallback; }
@@ -1397,7 +1399,7 @@ fallback:return true; } -if (!READ_ONCE (msk->allow_infinite_fallback)) { +if (!mptcp_try_fallback (ssk)) {/* fatal protocol error, close the socket. * subflow_error_report() will introduce the appropriate barriers */
@@ -1415,8 +1417,6 @@ reset:WRITE_ONCE (subflow->data_avail, false);return false; } - -mptcp_do_fallback (ssk); } skb =skb_peek (&ssk->sk_receive_queue);
@@ -1681,7 +1681,6 @@ int __mptcp_subflow_connect(struct sock/* discard the subflow socket */ mptcp_sock_graft (ssk, sk->sk_socket);iput (SOCK_INODE (sf)); -WRITE_ONCE (msk->allow_infinite_fallback, false);mptcp_stop_tout_timer (sk);return 0 ;
@@ -1853,7 +1852,7 @@ static void subflow_state_change(struct msk =mptcp_sk (parent);if (subflow_simultaneous_connect (sk)) { -mptcp_do_fallback (sk); +WARN_ON_ONCE (!mptcp_try_fallback (sk));pr_fallback (msk); subflow->conn_finished =1 ;mptcp_propagate_state (parent, sk, subflow,NULL );
Greg Kroah-Hartman
maintainerPATCH 45/187 mptcp: plug races between subflow fail and subflow creation
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit def5b7b2643ebba696fc60ddf675dca13f073486 upstream.
We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger.
The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock.
The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option.
The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write.
--- net/mptcp/pm.c | 8 +++++++- net/mptcp/protocol.c | 11 ++++++----- net/mptcp/protocol.h | 7 +++++-- net/mptcp/subflow.c | 19 ++++++++++++++----- 4 files changed, 32 insertions(+), 13 deletions(-)
net/mptcp/pm.c +7 -1
@@ -761,8 +761,14 @@ void mptcp_pm_mp_fail_received(struct sopr_debug ("fail_seq=%llu\n" , fail_seq); -if (!READ_ONCE (msk->allow_infinite_fallback)) +/* After accepting the fail, we can't create any other subflows */ +spin_lock_bh (&msk->fallback_lock); +if (!msk->allow_infinite_fallback) { +spin_unlock_bh (&msk->fallback_lock);return ; + } + msk->allow_subflows = false; +spin_unlock_bh (&msk->fallback_lock);if (!subflow->fail_tout) {pr_debug ("send MP_FAIL response and infinite map\n" );
net/mptcp/protocol.c +6 -5
@@ -789,7 +789,7 @@ void mptcp_data_ready(struct sock *sk, sstatic void mptcp_subflow_joined (struct mptcp_sock *msk,struct sock *ssk) {mptcp_subflow_ctx (ssk)->map_seq =READ_ONCE (msk->ack_seq); -WRITE_ONCE (msk->allow_infinite_fallback, false); + msk->allow_infinite_fallback = false;mptcp_event (MPTCP_EVENT_SUB_ESTABLISHED , msk, ssk,GFP_ATOMIC ); }
@@ -801,7 +801,7 @@ static bool __mptcp_finish_join(struct mreturn false;spin_lock_bh (&msk->fallback_lock); -if (__mptcp_check_fallback (msk)) { +if (!msk->allow_subflows) {spin_unlock_bh (&msk->fallback_lock);return false; }
@@ -2623,7 +2623,7 @@ static void __mptcp_retrans(struct sock len =max (copied, len);tcp_push (ssk,0 , info.mss_now,tcp_sk (ssk)->nonagle, info.size_goal); -WRITE_ONCE (msk->allow_infinite_fallback, false); + msk->allow_infinite_fallback = false; }spin_unlock_bh (&msk->fallback_lock);
@@ -2751,7 +2751,8 @@ static void __mptcp_init_sock(struct socWRITE_ONCE (msk->first,NULL );inet_csk (sk)->icsk_sync_mss = mptcp_sync_mss;WRITE_ONCE (msk->csum_enabled,mptcp_is_checksum_enabled (sock_net (sk))); -WRITE_ONCE (msk->allow_infinite_fallback, true); + msk->allow_infinite_fallback = true; + msk->allow_subflows = true; msk->recovery = false; msk->subflow_id =1 ; msk->last_data_sent = tcp_jiffies32;
@@ -3547,7 +3548,7 @@ bool mptcp_finish_join(struct sock *ssk)/* active subflow, already present inside the conn_list */ if (!list_empty (&subflow->node)) {spin_lock_bh (&msk->fallback_lock); -if (__mptcp_check_fallback (msk)) { +if (!msk->allow_subflows) {spin_unlock_bh (&msk->fallback_lock);return false; }
net/mptcp/protocol.h +5 -2
@@ -346,13 +346,15 @@ struct mptcp_sock {u64 rtt_us;/* last maximum rtt of subflows */ } rcvq_space;u8 scaling_ratio; +bool allow_subflows;u32 subflow_id;u32 setsockopt_seq;char ca_name[TCP_CA_NAME_MAX ]; -spinlock_t fallback_lock;/* protects fallback and -* allow_infinite_fallback +spinlock_t fallback_lock;/* protects fallback, +* allow_infinite_fallback and +* allow_join */ };
@@ -1224,6 +1226,7 @@ static inline bool __mptcp_try_fallback(return false; } + msk->allow_subflows = false;set_bit (MPTCP_FALLBACK_DONE , &msk->flags);spin_unlock_bh (&msk->fallback_lock);return true;
net/mptcp/subflow.c +14 -5
@@ -1304,20 +1304,29 @@ static void subflow_sched_work_if_closedmptcp_schedule_work (sk); } -static void mptcp_subflow_fail (struct mptcp_sock *msk,struct sock *ssk) +static bool mptcp_subflow_fail (struct mptcp_sock *msk,struct sock *ssk) {struct mptcp_subflow_context *subflow =mptcp_subflow_ctx (ssk);unsigned long fail_tout; +/* we are really failing, prevent any later subflow join */ +spin_lock_bh (&msk->fallback_lock); +if (!msk->allow_infinite_fallback) { +spin_unlock_bh (&msk->fallback_lock); +return false; + } + msk->allow_subflows = false; +spin_unlock_bh (&msk->fallback_lock); +/* graceful failure can happen only on the MPC subflow */ if (WARN_ON_ONCE (ssk !=READ_ONCE (msk->first))) -return ; +return false;/* since the close timeout take precedence on the fail one, * no need to start the latter when the first is already set */ if (sock_flag ((struct sock *)msk,SOCK_DEAD )) -return ; +return true;/* we don't need extreme accuracy here, use a zero fail_tout as special * value meaning no fail timeout at all;
@@ -1329,6 +1338,7 @@ static void mptcp_subflow_fail(struct mptcp_send_ack (ssk);mptcp_reset_tout_timer (msk, subflow->fail_tout); +return true; }static bool subflow_check_data_avail (struct sock *ssk)
@@ -1389,12 +1399,11 @@ fallback: (subflow->mp_join || subflow->valid_csum_seen)) { subflow->send_mp_fail =1 ; -if (!READ_ONCE (msk->allow_infinite_fallback)) { +if (!mptcp_subflow_fail (msk, ssk)) { subflow->reset_transient =0 ; subflow->reset_reason =MPTCP_RST_EMIDDLEBOX ; goto reset; } -mptcp_subflow_fail (msk, ssk);WRITE_ONCE (subflow->data_avail, true);return true; }
Greg Kroah-Hartman
maintainerPATCH 46/187 mptcp: reset fallback status gracefully at disconnect() time
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit da9b2fc7b73d147d88abe1922de5ab72d72d7756 upstream.
mptcp_disconnect() clears the fallback bit unconditionally, without touching the associated flags.
The bit clear is safe, as no fallback operation can race with that -- all subflow are already in TCP_CLOSE status thanks to the previous FASTCLOSE -- but we need to consistently reset all the fallback related status.
Also acquire the relevant lock, to avoid fouling static analyzers.
--- net/mptcp/protocol.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/mptcp/protocol.c +9 -0
@@ -3140,7 +3140,16 @@ static int mptcp_disconnect(struct sock* subflow */ mptcp_destroy_common (msk,MPTCP_CF_FASTCLOSE ); + +/* The first subflow is already in TCP_CLOSE status, the following +* can't overlap with a fallback anymore +*/ +spin_lock_bh (&msk->fallback_lock); + msk->allow_subflows = true; + msk->allow_infinite_fallback = true;WRITE_ONCE (msk->flags,0 ); +spin_unlock_bh (&msk->fallback_lock); + msk->cb_flags =0 ; msk->recovery = false;WRITE_ONCE (msk->can_ack, false);
Greg Kroah-Hartman
maintainerPATCH 47/187 phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 17ba793f381eb813596d6de1cc6820bcbda5ed8b upstream.
A new warning in clang [1] points out a place in pep_sock_accept() where dst is uninitialized then passed as a const pointer to pep_find_pipe():
net/phonet/pep.c:829:37: error: variable 'dst' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
829 | newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle);
| ^~~:Move the call to pn_skb_get_dst_sockaddr(), which initializes dst, to before the call to pep_find_pipe(), so that dst is consistently used initialized throughout the function.
--- net/phonet/pep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/phonet/pep.c +1 -1
@@ -826,6 +826,7 @@ static struct sock *pep_sock_accept(stru }/* Check for duplicate pipe handle */ +pn_skb_get_dst_sockaddr (skb, &dst); newsk =pep_find_pipe (&pn->hlist, &dst, pipe_handle);if (unlikely (newsk)) {__sock_put (newsk);
@@ -850,7 +851,6 @@ static struct sock *pep_sock_accept(stru newsk->sk_destruct = pipe_destruct; newpn =pep_sk (newsk); -pn_skb_get_dst_sockaddr (skb, &dst);pn_skb_get_src_sockaddr (skb, &src); newpn->pn_sk.sobject =pn_sockaddr_get_object (&dst); newpn->pn_sk.dobject =pn_sockaddr_get_object (&src);
Greg Kroah-Hartman
maintainerPATCH 48/187 net/mlx5: Update the list of the PCI supported devices
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maor Gottlieb <[email protected]>
commit ad4f6df4f384905bc85f9fbfc1c0c198fb563286 upstream.
Add the upcoming ConnectX-10 device ID to the table of supported PCI device IDs.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/main.c +1 -0
@@ -2257,6 +2257,7 @@ static const struct pci_device_id mlx5_c { PCI_VDEVICE(MELLANOX, 0x1021) }, /* ConnectX-7 */ { PCI_VDEVICE(MELLANOX, 0x1023) }, /* ConnectX-8 */ { PCI_VDEVICE(MELLANOX, 0x1025) }, /* ConnectX-9 */ + { PCI_VDEVICE(MELLANOX, 0x1027) }, /* ConnectX-10 */ { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */ { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */ { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */
Greg Kroah-Hartman
maintainerPATCH 49/187 arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
commit 0bdaca0922175478ddeadf8e515faa5269f6fae6 upstream.
The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency depends on the pins the interface is muxed behind with ECSPI2 muxed behind ECSPI2 supporting up to 25MHz.
Adjust the spi-max-frequency based on these findings.
[1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC
--- arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +1 -1
@@ -201,7 +201,7 @@ tpm@0 { compatible = "atmel,attpm20p", "tcg,tpm_tis-spi"; reg = <0x0>; - spi-max-frequency = <36000000>; + spi-max-frequency = <25000000>; }; };
Greg Kroah-Hartman
maintainerPATCH 50/187 arm64: dts: add big-endian property back into watchdog node
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meng Li <[email protected]>
commit 720fd1cbc0a0f3acdb26aedb3092ab10fe05e7ae upstream.
Watchdog doesn't work on NXP ls1046ardb board because in commit 7c8ffc5555cb("arm64: dts: layerscape: remove big-endian for mmc nodes"), it intended to remove the big-endian from mmc node, but the big-endian of watchdog node is also removed by accident. So, add watchdog big-endian property back.
In addition, add compatible string fsl,ls1046a-wdt, which allow big-endian property.
--- arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi +2 -1
@@ -687,11 +687,12 @@ }; wdog0: watchdog@2ad0000 { - compatible = "fsl,imx21-wdt"; + compatible = "fsl,ls1046a-wdt", "fsl,imx21-wdt"; reg = <0x0 0x2ad0000 0x0 0x10000>; interrupts = <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(2)>; + big-endian; }; edma0: dma-controller@2c00000 {
Greg Kroah-Hartman
maintainerPATCH 51/187 arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit fbe94be09fa81343d623a86ec64a742759b669b3 upstream.
LDO5 regulator is used to power the i.MX8MM NVCC_SD2 I/O supply, that is used for the SD2 card interface and also for some GPIOs.
When the SD card interface is not enabled the regulator subsystem could turn off this supply, since it is not used anywhere else, however this will also remove the power to some other GPIOs, for example one I/O that is used to power the ethernet phy, leading to a non working ethernet interface.
[ 31.820515] On-module +V3.3_1.8_SD (LDO5): disabling [ 31.821761] PMIC_USDHC_VSELECT: disabling [ 32.764949] fec 30be0000.ethernet end0: Link is Down
Fix this keeping the LDO5 supply always on.
--- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +1 -0
@@ -464,6 +464,7 @@ }; reg_nvcc_sd: LDO5 { + regulator-always-on; regulator-max-microvolt = <3300000>; regulator-min-microvolt = <1800000>; regulator-name = "On-module +V3.3_1.8_SD (LDO5)";
Greg Kroah-Hartman
maintainerPATCH 52/187 arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
commit 528e2d3125ad8d783e922033a0a8e2adb17b400e upstream.
The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency depends on the pins the interface is muxed behind with ECSPI2 muxed behind ECSPI2 supporting up to 25MHz.
Adjust the spi-max-frequency based on these findings.
[1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC
--- arch/arm64/boot/dts/freescale/imx8mp-venice-gw71xx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mp-venice-gw71xx.dtsi +1 -1
@@ -70,7 +70,7 @@ tpm@1 { compatible = "atmel,attpm20p", "tcg,tpm_tis-spi"; reg = <0x1>; - spi-max-frequency = <36000000>; + spi-max-frequency = <25000000>; }; };
Greg Kroah-Hartman
maintainerPATCH 53/187 arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
commit b25344753c53a5524ba80280ce68f2046e559ce0 upstream.
The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency depends on the pins the interface is muxed behind with ECSPI2 muxed behind ECSPI2 supporting up to 25MHz.
Adjust the spi-max-frequency based on these findings.
[1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC
--- arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi +1 -1
@@ -110,7 +110,7 @@ tpm@1 { compatible = "atmel,attpm20p", "tcg,tpm_tis-spi"; reg = <0x1>; - spi-max-frequency = <36000000>; + spi-max-frequency = <25000000>; }; };
Greg Kroah-Hartman
maintainerPATCH 54/187 arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
commit 1fc02c2086003c5fdaa99cde49a987992ff1aae4 upstream.
The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency depends on the pins the interface is muxed behind with ECSPI2 muxed behind ECSPI2 supporting up to 25MHz.
Adjust the spi-max-frequency based on these findings.
[1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC
--- arch/arm64/boot/dts/freescale/imx8mp-venice-gw73xx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mp-venice-gw73xx.dtsi +1 -1
@@ -122,7 +122,7 @@ tpm@1 { compatible = "atmel,attpm20p", "tcg,tpm_tis-spi"; reg = <0x1>; - spi-max-frequency = <36000000>; + spi-max-frequency = <25000000>; }; };
Greg Kroah-Hartman
maintainerPATCH 55/187 arm64: dts: rockchip: list all CPU supplies on ArmSoM Sige5
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <[email protected]>
commit c76bcc7d1f24e90a2d7b98d1e523d7524269fc56 upstream.
List both CPU supply regulators which drive the little and big CPU clusters, respectively, so that cpufreq can pick them up.
Without this patch the cpufreq governor attempts to raise the big CPU frequency under high load, while its supply voltage stays at 850000 uV. This causes system instability and, in my case, random reboots.
With this patch, supply voltages are adjusted in step with frequency changes from 700000-737000 uV in idle to 950000 uV under full load, and the system appears to be stable.
While at this, list all CPU supplies for completeness.
--- arch/arm64/boot/dts/rockchip/rk3576-armsom-sige5.dts | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+)
arch/arm64/boot/dts/rockchip/rk3576-armsom-sige5.dts +28 -0
@@ -177,10 +177,38 @@ }; }; +&cpu_b0 { + cpu-supply = <&vdd_cpu_big_s0>; +}; + +&cpu_b1 { + cpu-supply = <&vdd_cpu_big_s0>; +}; + +&cpu_b2 { + cpu-supply = <&vdd_cpu_big_s0>; +}; + +&cpu_b3 { + cpu-supply = <&vdd_cpu_big_s0>; +}; + &cpu_l0 { cpu-supply = <&vdd_cpu_lit_s0>; }; +&cpu_l1 { + cpu-supply = <&vdd_cpu_lit_s0>; +}; + +&cpu_l2 { + cpu-supply = <&vdd_cpu_lit_s0>; +}; + +&cpu_l3 { + cpu-supply = <&vdd_cpu_lit_s0>; +}; + &gmac0 { phy-mode = "rgmii-id"; clock_in_out = "output";
Greg Kroah-Hartman
maintainerPATCH 56/187 arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakob Unterwurzacher <[email protected]>
commit 53b6445ad08f07b6f4a84f1434f543196009ed89 upstream.
Hardware CS has a very slow rise time of about 6us, causing transmission errors when CS does not reach high between transaction.
It looks like it's not driven actively when transitioning from low to high but switched to input, so only the CPU pull-up pulls it high, slowly. Transitions from high to low are fast. On the oscilloscope, CS looks like an irregular sawtooth pattern like this:
_____
^ / |
^ /| / |
/| / | / |
/ | / | / |
___/ |___/ |_____/ |___
With cs-gpios we have a CS rise time of about 20ns, as it should be, and CS looks rectangular.
This fixes the data errors when running a flashcp loop against a m25p40 spi flash.
With the Rockchip 6.1 kernel we see the same slow rise time, but for some reason CS is always high for long enough to reach a solid high.
The RK3399 and RK3588 SoCs use the same SPI driver, so we also checked our "Puma" (RK3399) and "Tiger" (RK3588) boards. They do not have this problem. Hardware CS rise time is good.
--- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi +23 -0
@@ -363,6 +363,18 @@ <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_up>; }; }; + + spi1 { + spi1_csn0_gpio_pin: spi1-csn0-gpio-pin { + rockchip,pins = + <3 RK_PB1 RK_FUNC_GPIO &pcfg_pull_up_4ma>; + }; + + spi1_csn1_gpio_pin: spi1-csn1-gpio-pin { + rockchip,pins = + <3 RK_PB2 RK_FUNC_GPIO &pcfg_pull_up_4ma>; + }; + }; }; &pmu_io_domains {
@@ -380,6 +392,17 @@ vqmmc-supply = <&vccio_sd>; }; +&spi1 { + /* + * Hardware CS has a very slow rise time of about 6us, + * causing transmission errors. + * With cs-gpios we have a rise time of about 20ns. + */ + cs-gpios = <&gpio3 RK_PB1 GPIO_ACTIVE_LOW>, <&gpio3 RK_PB2 GPIO_ACTIVE_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&spi1_clk &spi1_csn0_gpio_pin &spi1_csn1_gpio_pin &spi1_miso &spi1_mosi>; +}; + &tsadc { status = "okay"; };
Greg Kroah-Hartman
maintainerPATCH 57/187 af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Lu <[email protected]>
commit c1ba3c0cbdb5e53a8ec5d708e99cd4c497028a13 upstream.
Due to the changes in commit 581073f626e3 ("af_packet: do not call packet_read_pending() from tpacket_destruct_skb()"), every time tpacket_destruct_skb() is executed, the skb_completion is marked as completed. When wait_for_completion_interruptible_timeout() returns completed, the pending_refcnt has not yet been reduced to zero. Therefore, when ph is NULL, the wait function may need to be called multiple times until packet_read_pending() finally returns zero.
We should call sock_sndtimeo() only once, otherwise the SO_SNDTIMEO constraint could be way off.
--- net/packet/af_packet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/packet/af_packet.c +2 -2
@@ -2785,7 +2785,7 @@ static int tpacket_snd(struct packet_socint len_sum =0 ;int status =TP_STATUS_AVAILABLE ;int hlen, tlen, copylen =0 ; -long timeo =0 ; +long timeo;mutex_lock (&po->pg_vec_lock);
@@ -2839,6 +2839,7 @@ static int tpacket_snd(struct packet_socif ((size_max > dev->mtu + reserve +VLAN_HLEN ) && !vnet_hdr_sz) size_max = dev->mtu + reserve +VLAN_HLEN ; + timeo =sock_sndtimeo (&po->sk, msg->msg_flags &MSG_DONTWAIT );reinit_completion (&po->skb_completion); do {
@@ -2846,7 +2847,6 @@ static int tpacket_snd(struct packet_soc TP_STATUS_SEND_REQUEST);if (unlikely (ph ==NULL )) {if (need_wait && skb) { - timeo =sock_sndtimeo (&po->sk, msg->msg_flags &MSG_DONTWAIT ); timeo =wait_for_completion_interruptible_timeout (&po->skb_completion, timeo);if (timeo <=0 ) { err = !timeo ? -ETIMEDOUT : -ERESTARTSYS ;
Greg Kroah-Hartman
maintainerPATCH 58/187 af_packet: fix soft lockup issue caused by tpacket_snd()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Lu <[email protected]>
commit 55f0bfc0370539213202f4ce1a07615327ac4713 upstream.
When MSG_DONTWAIT is not set, the tpacket_snd operation will wait for pending_refcnt to decrement to zero before returning. The pending_refcnt is decremented by 1 when the skb->destructor function is called, indicating that the skb has been successfully sent and needs to be destroyed.
If an error occurs during this process, the tpacket_snd() function will exit and return error, but pending_refcnt may not yet have decremented to zero. Assuming the next send operation is executed immediately, but there are no available frames to be sent in tx_ring (i.e., packet_current_frame returns NULL), and skb is also NULL, the function will not execute wait_for_completion_interruptible_timeout() to yield the CPU. Instead, it will enter a do-while loop, waiting for pending_refcnt to be zero. Even if the previous skb has completed transmission, the skb->destructor function can only be invoked in the ksoftirqd thread (assuming NAPI threading is enabled). When both the ksoftirqd thread and the tpacket_snd operation happen to run on the same CPU, and the CPU trapped in the do-while loop without yielding, the ksoftirqd thread will not get scheduled to run. As a result, pending_refcnt will never be reduced to zero, and the do-while loop cannot exit, eventually leading to a CPU soft lockup issue.
In fact, skb is true for all but the first iterations of that loop, and as long as pending_refcnt is not zero, even if incremented by a previous call, wait_for_completion_interruptible_timeout() should be executed to yield the CPU, allowing the ksoftirqd thread to be scheduled. Therefore, the execution condition of this function should be modified to check if pending_refcnt is not zero, instead of check skb.
- if (need_wait && skb) {
+ if (need_wait && packet_read_pending(&po->tx_ring)) {
As a result, the judgment conditions are duplicated with the end code of the while loop, and packet_read_pending() is a very expensive function. Actually, this loop can only exit when ph is NULL, so the loop condition can be changed to while (1), and in the "ph = NULL" branch, if the subsequent condition of if is not met, the loop can break directly. Now, the loop logic remains the same as origin but is clearer and more obvious.
--- net/packet/af_packet.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
net/packet/af_packet.c +11 -12
@@ -2846,15 +2846,21 @@ static int tpacket_snd(struct packet_soc ph =packet_current_frame (po, &po->tx_ring,TP_STATUS_SEND_REQUEST );if (unlikely (ph ==NULL )) { -if (need_wait && skb) { +/* Note: packet_read_pending() might be slow if we +* have to call it as it's per_cpu variable, but in +* fast-path we don't have to call it, only when ph +* is NULL, we need to check the pending_refcnt. +*/ +if (need_wait &&packet_read_pending (&po->tx_ring)) { timeo =wait_for_completion_interruptible_timeout (&po->skb_completion, timeo);if (timeo <=0 ) { err = !timeo ? -ETIMEDOUT : -ERESTARTSYS ; goto out_put; } - } -/* check for additional frames */ -continue ; +/* check for additional frames */ +continue ; + }else +break ; } skb =NULL ;
@@ -2943,14 +2949,7 @@ tpacket_error: }packet_increment_head (&po->tx_ring); len_sum += tp_len; - }while (likely ((ph !=NULL ) || -/* Note: packet_read_pending() might be slow if we have -* to call it as it's per_cpu variable, but in fast-path -* we already short-circuit the loop with the first -* condition, and luckily don't have to go that path -* anyway. -*/ - (need_wait &&packet_read_pending (&po->tx_ring)))); + }while (1 ); err = len_sum; goto out_put;
Greg Kroah-Hartman
maintainerPATCH 59/187 Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
commit 6ec3185fbc3528f2284c347fb9bd8be6fa672ed4 upstream.
Due to what seem to be a bug with variant version returned by some firmwares the code may set hdev->classify_pkt_type with btintel_classify_pkt_type when in fact the controller doesn't even support ISO channels feature but may use the handle range expected from a controllers that does causing the packets to be reclassified as ISO causing several bugs.
To fix the above btintel_classify_pkt_type will attempt to check if the controller really supports ISO channels and in case it doesn't don't reclassify even if the handle range is considered to be ISO, this is considered safer than trying to fix the specific controller/firmware version as that could change over time and causing similar problems in the future.
--- drivers/bluetooth/btintel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/btintel.c +1 -1
@@ -2670,7 +2670,7 @@ static u8 btintel_classify_pkt_type(stru* Distinguish ISO data packets form ACL data packets * based on their connection handle value range. */ -if (hci_skb_pkt_type (skb) ==HCI_ACLDATA_PKT ) { +if (iso_capable (hdev) &&hci_skb_pkt_type (skb) ==HCI_ACLDATA_PKT ) {__u16 handle =__le16_to_cpu (hci_acl_hdr (skb)->handle);if (hci_handle (handle) >=BTINTEL_ISODATA_HANDLE_BASE )
Greg Kroah-Hartman
maintainerPATCH 60/187 cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
commit 621a88dbfe9006c318a0cafbd12e677ccfe006e7 upstream.
Currently cpu hotplug with the PREEMPT_RT option set in the kernel is not supported because the underlying generic power domain functions used in the cpu hotplug callbacks are incompatible from a lock point of view. This situation prevents the suspend to idle to reach the deepest idle state for the "cluster" as identified in the undermentioned commit.
Use the compatible ones when PREEMPT_RT is enabled and remove the boolean disabling the hotplug callbacks with this option.
With this change the platform can reach the deepest idle state allowing at suspend time to consume less power.
Tested-on Lenovo T14s with the following script:
echo 0 > /sys/devices/system/cpu/cpu3/online
BEFORE=$(cat /sys/kernel/debug/pm_genpd/power-domain-cpu-cluster0/idle_states | grep S0 | awk '{ print $3 }') ; rtcwake -s 1 -m mem;
AFTER=$(cat /sys/kernel/debug/pm_genpd/power-domain-cpu-cluster0/idle_states | grep S0 | awk '{ print $3 }'); if [ $BEFORE -lt $AFTER ]; then
echo "Test successful"
else
echo "Test failed"
fi
echo 1 > /sys/devices/system/cpu/cpu3/online
--- drivers/cpuidle/cpuidle-psci.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
drivers/cpuidle/cpuidle-psci.c +12 -11
@@ -39,7 +39,6 @@ struct psci_cpuidle_data { static DEFINE_PER_CPU_READ_MOSTLY(struct psci_cpuidle_data, psci_cpuidle_data); static DEFINE_PER_CPU(u32, domain_state);static bool psci_cpuidle_use_syscore; -static bool psci_cpuidle_use_cpuhp;void psci_set_domain_state (u32 state) {
@@ -108,8 +107,12 @@ static int psci_idle_cpuhp_up(unsigned i {struct device *pd_dev =__this_cpu_read (psci_cpuidle_data.dev); -if (pd_dev) -pm_runtime_get_sync (pd_dev); +if (pd_dev) { +if (!IS_ENABLED (CONFIG_PREEMPT_RT )) +pm_runtime_get_sync (pd_dev); +else +dev_pm_genpd_resume (pd_dev); + }return 0 ; }
@@ -119,7 +122,11 @@ static int psci_idle_cpuhp_down(unsignedstruct device *pd_dev =__this_cpu_read (psci_cpuidle_data.dev);if (pd_dev) { -pm_runtime_put_sync (pd_dev); +if (!IS_ENABLED (CONFIG_PREEMPT_RT )) +pm_runtime_put_sync (pd_dev); +else +dev_pm_genpd_suspend (pd_dev); +/* Clear domain state to start fresh at next online. */ psci_set_domain_state (0 ); }
@@ -180,9 +187,6 @@ static void psci_idle_init_cpuhp(void) {int err; -if (!psci_cpuidle_use_cpuhp) -return ; - err = cpuhp_setup_state_nocalls(CPUHP_AP_CPU_PM_STARTING, "cpuidle/psci:online", psci_idle_cpuhp_up,
@@ -243,10 +247,8 @@ static int psci_dt_cpu_init_topology(str* s2ram and s2idle. */ drv->states[state_count -1 ].enter_s2idle = psci_enter_s2idle_domain_idle_state; -if (!IS_ENABLED (CONFIG_PREEMPT_RT )) { +if (!IS_ENABLED (CONFIG_PREEMPT_RT )) drv->states[state_count -1 ].enter = psci_enter_domain_idle_state; - psci_cpuidle_use_cpuhp = true; - }return 0 ; }
@@ -323,7 +325,6 @@ static void psci_cpu_deinit_idle(int cpudt_idle_detach_cpu (data->dev); psci_cpuidle_use_syscore = false; - psci_cpuidle_use_cpuhp = false; }static int psci_idle_init_cpu (struct device *dev,int cpu)
Greg Kroah-Hartman
maintainerPATCH 61/187 dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiu-ji Chen <[email protected]>
commit 8eba2187391e5ab49940cd02d6bd45a5617f4daf upstream.
Fixed a flag reuse bug in the mtk_cqdma_tx_status() function.
--- drivers/dma/mediatek/mtk-cqdma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/mediatek/mtk-cqdma.c +2 -2
@@ -449,9 +449,9 @@ static enum dma_status mtk_cqdma_tx_status(struct dma_chan *c,return ret;spin_lock_irqsave (&cvc->pc->lock, flags); -spin_lock_irqsave (&cvc->vc.lock, flags); +spin_lock (&cvc->vc.lock); vd =mtk_cqdma_find_active_desc (c, cookie); -spin_unlock_irqrestore (&cvc->vc.lock, flags); +spin_unlock (&cvc->vc.lock);spin_unlock_irqrestore (&cvc->pc->lock, flags);if (vd) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 62/187 dmaengine: nbpfaxi: Fix memory corruption in probe()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 188c6ba1dd925849c5d94885c8bbdeb0b3dcf510 upstream.
The nbpf->chan[] array is allocated earlier in the nbpf_probe() function and it has "num_channels" elements. These three loops iterate one element farther than they should and corrupt memory.
The changes to the second loop are more involved. In this case, we're copying data from the irqbuf[] array into the nbpf->chan[] array. If the data in irqbuf[i] is the error IRQ then we skip it, so the iterators are not in sync. I added a check to ensure that we don't go beyond the end of the irqbuf[] array. I'm pretty sure this can't happen, but it seemed harmless to add a check.
On the other hand, after the loop has ended there is a check to ensure that the "chan" iterator is where we expect it to be. In the original code we went one element beyond the end of the array so the iterator wasn't in the correct place and it would always return -EINVAL. However, now it will always be in the correct place. I deleted the check since we know the result.
--- drivers/dma/nbpfaxi.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/dma/nbpfaxi.c +5 -6
@@ -1351,7 +1351,7 @@ static int nbpf_probe(struct platform_deif (irqs ==1 ) { eirq = irqbuf[0 ]; -for (i =0 ; i <= num_channels; i++) +for (i =0 ; i < num_channels; i++) nbpf->chan[i].irq = irqbuf[0 ]; }else { eirq =platform_get_irq_byname (pdev,"error" );
@@ -1361,16 +1361,15 @@ static int nbpf_probe(struct platform_deif (irqs == num_channels +1 ) {struct nbpf_channel *chan; -for (i =0 , chan = nbpf->chan; i <= num_channels; +for (i =0 , chan = nbpf->chan; i < num_channels; i++, chan++) {/* Skip the error IRQ */ if (irqbuf[i] == eirq) i++; +if (i >=ARRAY_SIZE (irqbuf)) +return -EINVAL ; chan->irq = irqbuf[i]; } - -if (chan != nbpf->chan + num_channels) -return -EINVAL ; }else {/* 2 IRQs and more than one channel */ if (irqbuf[0 ] == eirq)
@@ -1378,7 +1377,7 @@ static int nbpf_probe(struct platform_deelse irq = irqbuf[0 ]; -for (i =0 ; i <= num_channels; i++) +for (i =0 ; i < num_channels; i++) nbpf->chan[i].irq = irq; } }
Greg Kroah-Hartman
maintainerPATCH 63/187 isofs: Verify inode mode when loading from disk
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 0a9e7405131380b57e155f10242b2e25d2e51852 upstream.
Verify that the inode mode is sane when loading it from the disk to avoid complaints from VFS about setting up invalid inodes.
--- fs/isofs/inode.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/isofs/inode.c +8 -1
@@ -1440,9 +1440,16 @@ static int isofs_read_inode(struct inode inode->i_op = &page_symlink_inode_operations;inode_nohighmem (inode); inode->i_data.a_ops = &isofs_symlink_aops; - }else + }else if (S_ISCHR (inode->i_mode) ||S_ISBLK (inode->i_mode) || +S_ISFIFO (inode->i_mode) ||S_ISSOCK (inode->i_mode)) {/* XXX - parse_rock_ridge_inode() had already set i_rdev. */ init_special_inode (inode, inode->i_mode, inode->i_rdev); + }else { +printk (KERN_DEBUG "ISOFS: Invalid file type 0%04o for inode %lu.\n" , + inode->i_mode, inode->i_ino); + ret = -EIO ; + goto fail; + } ret =0 ; out:
Greg Kroah-Hartman
maintainerPATCH 64/187 memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 21b34a3a204ed616373a12ec17dc127ebe51eab3 upstream.
A new warning in clang [1] points out that id_reg is uninitialized then passed to memstick_init_req() as a const pointer:
drivers/memstick/core/memstick.c:330:59: error: variable 'id_reg' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
330 | memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg,
| ^~~~~~Commit de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") intentionally passed this variable uninitialized to avoid an -Wnonnull warning from a NULL value that was previously there because id_reg is never read from the call to memstick_init_req() in h_memstick_read_dev_id(). Just zero initialize id_reg to avoid the warning, which is likely happening in the majority of builds using modern compilers that support '-ftrivial-auto-var-init=zero'.
--- drivers/memstick/core/memstick.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/memstick/core/memstick.c +1 -1
@@ -324,7 +324,7 @@ EXPORT_SYMBOL(memstick_init_req);static int h_memstick_read_dev_id (struct memstick_dev *card,struct memstick_request **mrq) { -struct ms_id_register id_reg; +struct ms_id_register id_reg = {};if (!(*mrq)) { memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg,
Greg Kroah-Hartman
maintainerPATCH 65/187 mmc: bcm2835: Fix dma_unmap_sg() nents value
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit ff09b71bf9daeca4f21d6e5e449641c9fad75b53 upstream.
The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned.
--- drivers/mmc/host/bcm2835.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/host/bcm2835.c +2 -1
@@ -503,7 +503,8 @@ void bcm2835_prepare_dma(struct bcm2835_ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);if (!desc) { -dma_unmap_sg (dma_chan->device->dev, data->sg, sg_len, dir_data); +dma_unmap_sg (dma_chan->device->dev, data->sg, data->sg_len, + dir_data);return ; }
Greg Kroah-Hartman
maintainerPATCH 66/187 mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edson Juliano Drosdeck <[email protected]>
commit 50c78f398e92fafa1cbba3469c95fe04b2e4206d upstream.
Disable command queuing on Intel GLK-based Positivo models.
Without this quirk, CQE (Command Queuing Engine) causes instability or I/O errors during operation. Disabling it ensures stable operation on affected devices.
--- drivers/mmc/host/sdhci-pci-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/host/sdhci-pci-core.c +2 -1
@@ -913,7 +913,8 @@ static bool glk_broken_cqhci(struct sdhc {return slot->chip->pdev->device ==PCI_DEVICE_ID_INTEL_GLK_EMMC && (dmi_match (DMI_BIOS_VENDOR ,"LENOVO" ) || -dmi_match (DMI_SYS_VENDOR ,"IRBIS" )); +dmi_match (DMI_SYS_VENDOR ,"IRBIS" ) || +dmi_match (DMI_SYS_VENDOR ,"Positivo Tecnologia SA" )); }static bool jsl_broken_hs400es (struct sdhci_pci_slot *slot)
Greg Kroah-Hartman
maintainerPATCH 67/187 mmc: sdhci_am654: Workaround for Errata i2312
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
commit 6d0b1c01847fedd7c85a5cdf59b8cfc7d14512e6 upstream.
Errata i2312 [0] for K3 silicon mentions the maximum obtainable timeout through MMC host controller is 700ms. And for commands taking longer than 700ms, hardware timeout should be disabled and software timeout should be used.
The workaround for Errata i2312 can be achieved by adding SDHCI_QUIRK2_DISABLE_HW_TIMEOUT quirk in sdhci_am654.
[0] https://www.ti.com/lit/pdf/sprz487
--- drivers/mmc/host/sdhci_am654.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/mmc/host/sdhci_am654.c +6 -3
@@ -613,7 +613,8 @@ static const struct sdhci_ops sdhci_am65static const struct sdhci_pltfm_data sdhci_am654_pdata = { .ops = &sdhci_am654_ops, .quirks =SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 , - .quirks2 =SDHCI_QUIRK2_PRESET_VALUE_BROKEN , + .quirks2 =SDHCI_QUIRK2_PRESET_VALUE_BROKEN | +SDHCI_QUIRK2_DISABLE_HW_TIMEOUT , };static const struct sdhci_am654_driver_data sdhci_am654_sr1_drvdata = {
@@ -643,7 +644,8 @@ static const struct sdhci_ops sdhci_j721static const struct sdhci_pltfm_data sdhci_j721e_8bit_pdata = { .ops = &sdhci_j721e_8bit_ops, .quirks =SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 , - .quirks2 =SDHCI_QUIRK2_PRESET_VALUE_BROKEN , + .quirks2 =SDHCI_QUIRK2_PRESET_VALUE_BROKEN | +SDHCI_QUIRK2_DISABLE_HW_TIMEOUT , };static const struct sdhci_am654_driver_data sdhci_j721e_8bit_drvdata = {
@@ -667,7 +669,8 @@ static const struct sdhci_ops sdhci_j721static const struct sdhci_pltfm_data sdhci_j721e_4bit_pdata = { .ops = &sdhci_j721e_4bit_ops, .quirks =SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 , - .quirks2 =SDHCI_QUIRK2_PRESET_VALUE_BROKEN , + .quirks2 =SDHCI_QUIRK2_PRESET_VALUE_BROKEN | +SDHCI_QUIRK2_DISABLE_HW_TIMEOUT , };static const struct sdhci_am654_driver_data sdhci_j721e_4bit_drvdata = {
Greg Kroah-Hartman
maintainerPATCH 68/187 net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Blöchl <[email protected]>
commit e6176ab107ec6e57a752a97ba9f7c34a23034262 upstream.
get_time_fn() callback implementations are expected to fill out the entire system_counterval_t struct as it may be initially uninitialized.
This broke with the removal of convert_art_to_tsc() helper functions which left use_nsecs uninitialized.
Initially assign the entire struct with default values.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +7 -1
@@ -433,6 +433,12 @@ static int intel_crosststamp(ktime_t *dereturn -ETIMEDOUT ; } + *system = (struct system_counterval_t ) { + .cycles =0 , + .cs_id =CSID_X86_ART , + .use_nsecs = false, + }; + num_snapshot = (readl (ioaddr +GMAC_TIMESTAMP_STATUS ) &GMAC_TIMESTAMP_ATSNS_MASK ) >>GMAC_TIMESTAMP_ATSNS_SHIFT ;
@@ -448,7 +454,7 @@ static int intel_crosststamp(ktime_t *de } system->cycles *= intel_priv->crossts_adj; - system->cs_id =CSID_X86_ART ; + priv->plat->flags &= ~STMMAC_FLAG_INT_SNAPSHOT_EN ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 69/187 net: libwx: remove duplicate page_pool_put_full_page()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
commit 1b7e585c04cd5f0731dd25ffd396277e55fae0e6 upstream.
page_pool_put_full_page() should only be invoked when freeing Rx buffers or building a skb if the size is too short. At other times, the pages need to be reused. So remove the redundant page put. In the original code, double free pages cause kernel panic:
[ 876.949834] __irq_exit_rcu+0xc7/0x130 [ 876.949836] common_interrupt+0xb8/0xd0 [ 876.949838] </IRQ> [ 876.949838] <TASK> [ 876.949840] asm_common_interrupt+0x22/0x40 [ 876.949841] RIP: 0010:cpuidle_enter_state+0xc2/0x420 [ 876.949843] Code: 00 00 e8 d1 1d 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 cd fc 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 876.949844] RSP: 0018:ffffaa7340267e78 EFLAGS: 00000246 [ 876.949845] RAX: ffff9e3f135be000 RBX: 0000000000000002 RCX: 0000000000000000 [ 876.949846] RDX: 000000cc2dc4cb7c RSI: ffffffff89ee49ae RDI: ffffffff89ef9f9e [ 876.949847] RBP: ffff9e378f940800 R08: 0000000000000002 R09: 00000000000000ed [ 876.949848] R10: 000000000000afc8 R11: ffff9e3e9e5a9b6c R12: ffffffff8a6d8580 [ 876.949849] R13: 000000cc2dc4cb7c R14: 0000000000000002 R15: 0000000000000000 [ 876.949852] ? cpuidle_enter_state+0xb3/0x420 [ 876.949855] cpuidle_enter+0x29/0x40 [ 876.949857] cpuidle_idle_call+0xfd/0x170 [ 876.949859] do_idle+0x7a/0xc0 [ 876.949861] cpu_startup_entry+0x25/0x30 [ 876.949862] start_secondary+0x117/0x140 [ 876.949864] common_startup_64+0x13e/0x148 [ 876.949867] </TASK> [ 876.949868] ---[ end trace 0000000000000000 ]--- [ 876.949869] ------------[ cut here ]------------ [ 876.949870] list_del corruption, ffffead40445a348->next is NULL [ 876.949873] WARNING: CPU: 14 PID: 0 at lib/list_debug.c:52 __list_del_entry_valid_or_report+0x67/0x120 [ 876.949875] Modules linked in: snd_hrtimer(E) bnep(E) binfmt_misc(E) amdgpu(E) squashfs(E) vfat(E) loop(E) fat(E) amd_atl(E) snd_hda_codec_realtek(E) intel_rapl_msr(E) snd_hda_codec_generic(E) intel_rapl_common(E) snd_hda_scodec_component(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) edac_mce_amd(E) snd_intel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) amdxcp(E) kvm_amd(E) snd_hwdep(E) gpu_sched(E) drm_panel_backlight_quirks(E) cec(E) snd_pcm(E) drm_buddy(E) snd_seq_dummy(E) drm_ttm_helper(E) btusb(E) kvm(E) snd_seq_oss(E) btrtl(E) ttm(E) btintel(E) snd_seq_midi(E) btbcm(E) drm_exec(E) snd_seq_midi_event(E) i2c_algo_bit(E) snd_rawmidi(E) bluetooth(E) drm_suballoc_helper(E) irqbypass(E) snd_seq(E) ghash_clmulni_intel(E) sha512_ssse3(E) drm_display_helper(E) aesni_intel(E) snd_seq_device(E) rfkill(E) snd_timer(E) gf128mul(E) drm_client_lib(E) drm_kms_helper(E) snd(E) i2c_piix4(E) joydev(E) soundcore(E) wmi_bmof(E) ccp(E) k10temp(E) i2c_smbus(E) gpio_amdpt(E) i2c_designware_platform(E) gpio_generic(E) sg(E) [ 876.949914] i2c_designware_core(E) sch_fq_codel(E) parport_pc(E) drm(E) ppdev(E) lp(E) parport(E) fuse(E) nfnetlink(E) ip_tables(E) ext4 crc16 mbcache jbd2 sd_mod sfp mdio_i2c i2c_core txgbe ahci ngbe pcs_xpcs libahci libwx r8169 phylink libata realtek ptp pps_core video wmi [ 876.949933] CPU: 14 UID: 0 PID: 0 Comm: swapper/14 Kdump: loaded Tainted: G W E 6.16.0-rc2+ #20 PREEMPT(voluntary) [ 876.949935] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [ 876.949936] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 [ 876.949936] RIP: 0010:__list_del_entry_valid_or_report+0x67/0x120 [ 876.949938] Code: 00 00 00 48 39 7d 08 0f 85 a6 00 00 00 5b b8 01 00 00 00 5d 41 5c e9 73 0d 93 ff 48 89 fe 48 c7 c7 a0 31 e8 89 e8 59 7c b3 ff <0f> 0b 31 c0 5b 5d 41 5c e9 57 0d 93 ff 48 89 fe 48 c7 c7 c8 31 e8 [ 876.949940] RSP: 0018:ffffaa73405d0c60 EFLAGS: 00010282 [ 876.949941] RAX: 0000000000000000 RBX: ffffead40445a348 RCX: 0000000000000000 [ 876.949942] RDX: 0000000000000105 RSI: 0000000000000001 RDI: 00000000ffffffff [ 876.949943] RBP: 0000000000000000 R08: 000000010006dfde R09: ffffffff8a47d150 [ 876.949944] R10: ffffffff8a47d150 R11: 0000000000000003 R12: dead000000000122 [ 876.949945] R13: ffff9e3e9e5af700 R14: ffffead40445a348 R15: ffff9e3e9e5af720 [ 876.949946] FS: 0000000000000000(0000) GS:ffff9e3f135be000(0000) knlGS:0000000000000000 [ 876.949947] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 876.949948] CR2: 00007fa58b480048 CR3: 0000000156724000 CR4: 0000000000750ef0 [ 876.949949] PKRU: 55555554 [ 876.949950] Call Trace: [ 876.949951] <IRQ> [ 876.949952] __rmqueue_pcplist+0x53/0x2c0 [ 876.949955] alloc_pages_bulk_noprof+0x2e0/0x660 [ 876.949958] __page_pool_alloc_pages_slow+0xa9/0x400 [ 876.949961] page_pool_alloc_pages+0xa/0x20 [ 876.949963] wx_alloc_rx_buffers+0xd7/0x110 [libwx] [ 876.949967] wx_clean_rx_irq+0x262/0x430 [libwx] [ 876.949971] wx_poll+0x92/0x130 [libwx] [ 876.949975] __napi_poll+0x28/0x190 [ 876.949977] net_rx_action+0x301/0x3f0 [ 876.949980] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949981] ? profile_tick+0x30/0x70 [ 876.949983] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949984] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949986] ? timerqueue_add+0xa3/0xc0 [ 876.949988] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949989] ? __raise_softirq_irqoff+0x16/0x70 [ 876.949991] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949993] ? srso_alias_return_thunk+0x5/0xfbef5 [ 876.949994] ? wx_msix_clean_rings+0x41/0x50 [libwx] [ 876.949998] handle_softirqs+0xf9/0x2c0
--- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 11 ----------- drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 - 2 files changed, 12 deletions(-)
drivers/net/ethernet/wangxun/libwx/wx_lib.c +0 -11
@@ -173,10 +173,6 @@ static void wx_dma_sync_frag(struct wx_rskb_frag_off (frag),skb_frag_size (frag), DMA_FROM_DEVICE); - -/* If the page was released, just unmap it. */ -if (unlikely (WX_CB (skb)->page_released)) -page_pool_put_full_page (rx_ring->page_pool, rx_buffer->page, false); } static struct wx_rx_buffer *wx_get_rx_buffer(struct wx_ring *rx_ring,
@@ -226,10 +222,6 @@ static void wx_put_rx_buffer(struct wx_r struct sk_buff *skb, int rx_buffer_pgcnt) { -if (!IS_ERR (skb) &&WX_CB (skb)->dma == rx_buffer->dma) -/* the page has been released from the ring */ -WX_CB (skb)->page_released = true; -/* clear contents of rx_buffer */ rx_buffer->page =NULL ; rx_buffer->skb =NULL ;
@@ -2288,9 +2280,6 @@ static void wx_clean_rx_ring(struct wx_rif (rx_buffer->skb) {struct sk_buff *skb = rx_buffer->skb; -if (WX_CB (skb)->page_released) -page_pool_put_full_page (rx_ring->page_pool, rx_buffer->page, false); -dev_kfree_skb (skb); }
drivers/net/ethernet/wangxun/libwx/wx_type.h +0 -1
@@ -859,7 +859,6 @@ enum wx_reset_type {struct wx_cb {dma_addr_t dma;u16 append_cnt;/* number of skb's appended */ -bool page_released;bool dma_released; };
Greg Kroah-Hartman
maintainerPATCH 70/187 net: libwx: fix the using of Rx buffer DMA
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
commit 5fd77cc6bd9b368431a815a780e407b7781bcca0 upstream.
The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths.
This could lead to undefined behavior, including DMA errors or use-after-free, if the uninitialized 'dma' was used. Althrough such error has not yet occurred, it is worth fixing in the code.
--- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 4 ++-- drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 - 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/wangxun/libwx/wx_lib.c +2 -2
@@ -306,7 +306,7 @@ static bool wx_alloc_mapped_page(structreturn false; dma =page_pool_get_dma_addr (page); - bi->page_dma = dma; + bi->dma = dma; bi->page = page; bi->page_offset =0 ;
@@ -343,7 +343,7 @@ void wx_alloc_rx_buffers(struct wx_ring DMA_FROM_DEVICE); rx_desc->read.pkt_addr = -cpu_to_le64 (bi->page_dma + bi->page_offset); +cpu_to_le64 (bi->dma + bi->page_offset); rx_desc++; bi++;
drivers/net/ethernet/wangxun/libwx/wx_type.h +0 -1
@@ -947,7 +947,6 @@ struct wx_tx_buffer {struct wx_rx_buffer {struct sk_buff *skb;dma_addr_t dma; -dma_addr_t page_dma;struct page *page;unsigned int page_offset; };
Greg Kroah-Hartman
maintainerPATCH 71/187 net: libwx: properly reset Rx ring descriptor
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
commit d992ed7e1b687ad7df0763d3e015a5358646210b upstream.
When device reset is triggered by feature changes such as toggling Rx VLAN offload, wx->do_reset() is called to reinitialize Rx rings. The hardware descriptor ring may retain stale values from previous sessions. And only set the length to 0 in rx_desc[0] would result in building malformed SKBs. Fix it to ensure a clean slate after device reset.
[ 549.186435] [ C16] ------------[ cut here ]------------ [ 549.186457] [ C16] kernel BUG at net/core/skbuff.c:2814! [ 549.186468] [ C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 549.186472] [ C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary) [ 549.186476] [ C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 [ 549.186478] [ C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510 [ 549.186484] [ C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8 [ 549.186487] [ C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282 [ 549.186490] [ C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2 [ 549.186492] [ C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40 [ 549.186494] [ C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e [ 549.186496] [ C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200 [ 549.186497] [ C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2 [ 549.186499] [ C16] FS: 0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000 [ 549.186502] [ C16] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 549.186503] [ C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0 [ 549.186505] [ C16] PKRU: 55555554 [ 549.186507] [ C16] Call Trace: [ 549.186510] [ C16] <IRQ> [ 549.186513] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186517] [ C16] __skb_pad+0xc7/0xf0 [ 549.186523] [ C16] wx_clean_rx_irq+0x355/0x3b0 [libwx] [ 549.186533] [ C16] wx_poll+0x92/0x120 [libwx] [ 549.186540] [ C16] __napi_poll+0x28/0x190 [ 549.186544] [ C16] net_rx_action+0x301/0x3f0 [ 549.186548] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186551] [ C16] ? __raw_spin_lock_irqsave+0x1e/0x50 [ 549.186554] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186557] [ C16] ? wake_up_nohz_cpu+0x35/0x160 [ 549.186559] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186563] [ C16] handle_softirqs+0xf9/0x2c0 [ 549.186568] [ C16] __irq_exit_rcu+0xc7/0x130 [ 549.186572] [ C16] common_interrupt+0xb8/0xd0 [ 549.186576] [ C16] </IRQ> [ 549.186577] [ C16] <TASK> [ 549.186579] [ C16] asm_common_interrupt+0x22/0x40 [ 549.186582] [ C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420 [ 549.186585] [ C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 549.186587] [ C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246 [ 549.186590] [ C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000 [ 549.186591] [ C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3 [ 549.186593] [ C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000 [ 549.186595] [ C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40 [ 549.186596] [ C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000 [ 549.186601] [ C16] ? cpuidle_enter_state+0xb3/0x420 [ 549.186605] [ C16] cpuidle_enter+0x29/0x40 [ 549.186609] [ C16] cpuidle_idle_call+0xfd/0x170 [ 549.186613] [ C16] do_idle+0x7a/0xc0 [ 549.186616] [ C16] cpu_startup_entry+0x25/0x30 [ 549.186618] [ C16] start_secondary+0x117/0x140 [ 549.186623] [ C16] common_startup_64+0x13e/0x148 [ 549.186628] [ C16] </TASK>
--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +++---- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 5 +++++ 2 files changed, 8 insertions(+), 4 deletions(-)
drivers/net/ethernet/wangxun/libwx/wx_hw.c +3 -4
@@ -1699,7 +1699,6 @@ static void wx_configure_rx_ring(struct struct wx_ring *ring) {u16 reg_idx = ring->reg_idx; -union wx_rx_desc *rx_desc;u64 rdba = ring->dma;u32 rxdctl;
@@ -1729,9 +1728,9 @@ static void wx_configure_rx_ring(structmemset (ring->rx_buffer_info,0 ,sizeof (struct wx_rx_buffer ) * ring->count); -/* initialize Rx descriptor 0 */ - rx_desc =WX_RX_DESC (ring,0 ); - rx_desc->wb.upper.length =0 ; +/* reset ntu and ntc to place SW in sync with hardware */ + ring->next_to_clean =0 ; + ring->next_to_use =0 ;/* enable receive descriptor ring */ wr32m(wx, WX_PX_RR_CFG(reg_idx),
drivers/net/ethernet/wangxun/libwx/wx_lib.c +5 -0
@@ -356,6 +356,8 @@ void wx_alloc_rx_buffers(struct wx_ring/* clear the status bits for the next_to_use descriptor */ rx_desc->wb.upper.status_error =0 ; +/* clear the length for the next_to_use descriptor */ + rx_desc->wb.upper.length =0 ; cleaned_count--; }while (cleaned_count);
@@ -2303,6 +2305,9 @@ static void wx_clean_rx_ring(struct wx_r } } +/* Zero out the descriptor ring */ +memset (rx_ring->desc,0 , rx_ring->size); + rx_ring->next_to_alloc =0 ; rx_ring->next_to_clean =0 ; rx_ring->next_to_use =0 ;
Greg Kroah-Hartman
maintainerPATCH 72/187 pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maulik Shah <[email protected]>
commit 500ba33284416255b9a5b50ace24470b6fe77ea5 upstream.
pm_domain_cpu_gov is selecting a cluster idle state but does not consider latency tolerance of child CPUs. This results in deeper cluster idle state whose latency does not meet latency tolerance requirement.
Select deeper idle state only if global and device latency tolerance of all child CPUs meet.
Test results on SM8750 with 300 usec PM-QoS on CPU0 which is less than domain idle state entry (2150) + exit (1983) usec latency mentioned in devicetree, demonstrate the issue.
# echo 300 > /sys/devices/system/cpu/cpu0/power/pm_qos_resume_latency_us
Before: (Usage is incrementing)
======
# cat /sys/kernel/debug/pm_genpd/power-domain-cluster0/idle_states State Time Spent(ms) Usage Rejected Above Below S0 29817 537 8 270 0
# cat /sys/kernel/debug/pm_genpd/power-domain-cluster0/idle_states State Time Spent(ms) Usage Rejected Above Below S0 30348 542 8 271 0
After: (Usage is not incrementing due to latency tolerance)
======
# cat /sys/kernel/debug/pm_genpd/power-domain-cluster0/idle_states State Time Spent(ms) Usage Rejected Above Below S0 39319 626 14 307 0
# cat /sys/kernel/debug/pm_genpd/power-domain-cluster0/idle_states State Time Spent(ms) Usage Rejected Above Below S0 39319 626 14 307 0
--- drivers/pmdomain/governor.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/pmdomain/governor.c +16 -2
@@ -8,6 +8,7 @@#include <linux/pm_domain.h> #include <linux/pm_qos.h> #include <linux/hrtimer.h> +#include <linux/cpu.h> #include <linux/cpuidle.h> #include <linux/cpumask.h> #include <linux/ktime.h>
@@ -349,6 +350,8 @@ static bool cpu_power_down_ok(struct devstruct cpuidle_device *dev;ktime_t domain_wakeup, next_hrtimer;ktime_t now =ktime_get (); +struct device *cpu_dev; +s64 cpu_constraint, global_constraint;s64 idle_duration_ns;int cpu, i;
@@ -359,6 +362,7 @@ static bool cpu_power_down_ok(struct devif (!(genpd->flags &GENPD_FLAG_CPU_DOMAIN ))return true; + global_constraint =cpu_latency_qos_limit ();/* * Find the next wakeup for any of the online CPUs within the PM domain * and its subdomains. Note, we only need the genpd->cpus, as it already
@@ -372,8 +376,16 @@ static bool cpu_power_down_ok(struct devif (ktime_before (next_hrtimer, domain_wakeup)) domain_wakeup = next_hrtimer; } + + cpu_dev =get_cpu_device (cpu); +if (cpu_dev) { + cpu_constraint =dev_pm_qos_raw_resume_latency (cpu_dev); +if (cpu_constraint < global_constraint) + global_constraint = cpu_constraint; + } } + global_constraint *=NSEC_PER_USEC ;/* The minimum idle duration is from now - until the next wakeup. */ idle_duration_ns =ktime_to_ns (ktime_sub (domain_wakeup, now));if (idle_duration_ns <=0 )
@@ -389,8 +401,10 @@ static bool cpu_power_down_ok(struct dev*/ i = genpd->state_idx; do { - if (idle_duration_ns >= (genpd->states[i].residency_ns + - genpd->states[i].power_off_latency_ns)) { + if ((idle_duration_ns >= (genpd->states[i].residency_ns + + genpd->states[i].power_off_latency_ns)) && + (global_constraint >= (genpd->states[i].power_on_latency_ns + + genpd->states[i].power_off_latency_ns))) { genpd->state_idx = i; return true; }
Greg Kroah-Hartman
maintainerPATCH 73/187 s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Leoshkevich <[email protected]>
commit 6a5abf8cf182f577c7ae6c62f14debc9754ec986 upstream.
Commit 7ded842b356d ("s390/bpf: Fix bpf_plt pointer arithmetic") has accidentally removed the critical piece of commit c730fce7c70c ("s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL"), causing intermittent kernel panics in e.g. perf's on_switch() prog to reappear.
Restore the fix and add a comment.
--- arch/s390/net/bpf_jit_comp.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/s390/net/bpf_jit_comp.c +9 -1
@@ -544,7 +544,15 @@ static void bpf_jit_plt(struct bpf_plt * {memcpy (plt, &bpf_plt,sizeof (*plt)); plt->ret = ret; - plt->target = target; +/* +* (target == NULL) implies that the branch to this PLT entry was +* patched and became a no-op. However, some CPU could have jumped +* to this PLT entry before patching and may be still executing it. +* +* Since the intention in this case is to make the PLT entry a no-op, +* make the target point to the return label instead of NULL. +*/ + plt->target = target ?: ret; }/*
Greg Kroah-Hartman
maintainerPATCH 74/187 smb: client: fix use-after-free in crypt_message when using async crypto
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Zhaolong <[email protected]>
commit b220bed63330c0e1733dc06ea8e75d5b9962b6b6 upstream.
The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are synchronous. However, when hardware crypto accelerators are used, this can cause use-after-free crashes:
crypt_message()
// Allocate the creq buffer containing the req
creq = smb2_get_aead_req(..., &req);
// Async encryption returns -EINPROGRESS immediately
rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);
// Free creq while async operation is still in progress
kvfree_sensitive(creq, ...);Hardware crypto modules often implement async AEAD operations for performance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS, the operation completes asynchronously. Without crypto_wait_req(), the function immediately frees the request buffer, leading to crashes when the driver later accesses the freed memory.
This results in a use-after-free condition when the hardware crypto driver later accesses the freed request structure, leading to kernel crashes with NULL pointer dereferences.
The issue occurs because crypto_alloc_aead() with mask=0 doesn't guarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in the mask, async implementations can be selected.
Fix by restoring the async crypto handling:
- DECLARE_CRYPTO_WAIT(wait) for completion tracking
- aead_request_set_callback() for async completion notification
- crypto_wait_req() to wait for operation completion
This ensures the request buffer isn't freed until the crypto operation completes, whether synchronous or asynchronous, while preserving the CVE-2024-50047 fix.
--- fs/smb/client/smb2ops.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/smb/client/smb2ops.c +6 -1
@@ -4307,6 +4307,7 @@ crypt_message(struct TCP_Server_Info *seu8 key[SMB3_ENC_DEC_KEY_SIZE ];struct aead_request *req;u8 *iv; +DECLARE_CRYPTO_WAIT (wait);unsigned int crypt_len =le32_to_cpu (tr_hdr->OriginalMessageSize);void *creq;size_t sensitive_size;
@@ -4357,7 +4358,11 @@ crypt_message(struct TCP_Server_Info *seaead_request_set_crypt (req, sg, sg, crypt_len, iv);aead_request_set_ad (req, assoc_data_len); - rc = enc ?crypto_aead_encrypt (req) :crypto_aead_decrypt (req); +aead_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG , + crypto_req_done, &wait); + + rc =crypto_wait_req (enc ?crypto_aead_encrypt (req) + :crypto_aead_decrypt (req), &wait);if (!rc && enc)memcpy (&tr_hdr->Signature, sign,SMB2_SIGNATURE_SIZE );
Greg Kroah-Hartman
maintainerPATCH 75/187 soc: aspeed: lpc-snoop: Cleanup resources in stack-order
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Jeffery <[email protected]>
commit 8481d59be606d2338dbfe14b04cdbd1a3402c150 upstream.
Free the kfifo after unregistering the miscdev in aspeed_lpc_disable_snoop() as the kfifo is initialised before the miscdev in aspeed_lpc_enable_snoop().
--- drivers/soc/aspeed/aspeed-lpc-snoop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/aspeed/aspeed-lpc-snoop.c +1 -1
@@ -263,8 +263,8 @@ static void aspeed_lpc_disable_snoop(strreturn ; } -kfifo_free (&lpc_snoop->chan[channel].fifo);misc_deregister (&lpc_snoop->chan[channel].miscdev); +kfifo_free (&lpc_snoop->chan[channel].fifo); }static int aspeed_lpc_snoop_probe (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 76/187 soc: aspeed: lpc-snoop: Dont disable channels that arent enabled
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Jeffery <[email protected]>
commit 56448e78a6bb4e1a8528a0e2efe94eff0400c247 upstream.
Mitigate e.g. the following:
# echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind
...
[ 120.363594] Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write
[ 120.373866] [00000004] *pgd=00000000
[ 120.377910] Internal error: Oops: 805 [#1] SMP ARM
[ 120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh Not tainted 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NONE
...
[ 120.679543] Call trace:
[ 120.679559] misc_deregister from aspeed_lpc_snoop_remove+0x84/0xac
[ 120.692462] aspeed_lpc_snoop_remove from platform_remove+0x28/0x38
[ 120.700996] platform_remove from device_release_driver_internal+0x188/0x200
...--- drivers/soc/aspeed/aspeed-lpc-snoop.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/soc/aspeed/aspeed-lpc-snoop.c +11 -0
@@ -58,6 +58,7 @@ struct aspeed_lpc_snoop_model_data { };struct aspeed_lpc_snoop_channel { +bool enabled;struct kfifo fifo;wait_queue_head_t wq;struct miscdevice miscdev;
@@ -190,6 +191,9 @@ static int aspeed_lpc_enable_snoop(strucconst struct aspeed_lpc_snoop_model_data *model_data =of_device_get_match_data (dev); +if (WARN_ON (lpc_snoop->chan[channel].enabled)) +return -EBUSY ; +init_waitqueue_head (&lpc_snoop->chan[channel].wq);/* Create FIFO datastructure */ rc = kfifo_alloc(&lpc_snoop->chan[channel].fifo,
@@ -236,6 +240,8 @@ static int aspeed_lpc_enable_snoop(strucregmap_update_bits (lpc_snoop->regmap,HICRB , hicrb_en, hicrb_en); + lpc_snoop->chan[channel].enabled = true; +return 0 ; err_misc_deregister:
@@ -248,6 +254,9 @@ err_free_fifo:static void aspeed_lpc_disable_snoop (struct aspeed_lpc_snoop *lpc_snoop,int channel) { +if (!lpc_snoop->chan[channel].enabled) +return ; +switch (channel) {case 0 : regmap_update_bits(lpc_snoop->regmap, HICR5,
@@ -263,6 +272,8 @@ static void aspeed_lpc_disable_snoop(strreturn ; } + lpc_snoop->chan[channel].enabled = false; +/* Consider improving safety wrt concurrent reader(s) */ misc_deregister (&lpc_snoop->chan[channel].miscdev);kfifo_free (&lpc_snoop->chan[channel].fifo); }
Greg Kroah-Hartman
maintainerPATCH 77/187 soundwire: Revert "soundwire: qcom: Add set_channel_map api support"
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Pundir <[email protected]>
commit 834bce6a715ae9a9c4dce7892454a19adf22b013 upstream.
This reverts commit 7796c97df6b1b2206681a07f3c80f6023a6593d5.
This patch broke Dragonboard 845c (sdm845). I see:
Unexpected kernel BRK exception at EL1
Internal error: BRK handler: 00000000f20003e8 [#1] SMP
pc : qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom]
lr : snd_soc_dai_set_channel_map+0x34/0x78
Call trace:
qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] (P)
sdm845_dai_init+0x18c/0x2e0 [snd_soc_sdm845]
snd_soc_link_init+0x28/0x6c
snd_soc_bind_card+0x5f4/0xb0c
snd_soc_register_card+0x148/0x1a4
devm_snd_soc_register_card+0x50/0xb0
sdm845_snd_platform_probe+0x124/0x148 [snd_soc_sdm845]
platform_probe+0x6c/0xd0
really_probe+0xc0/0x2a4
__driver_probe_device+0x7c/0x130
driver_probe_device+0x40/0x118
__device_attach_driver+0xc4/0x108
bus_for_each_drv+0x8c/0xf0
__device_attach+0xa4/0x198
device_initial_probe+0x18/0x28
bus_probe_device+0xb8/0xbc
deferred_probe_work_func+0xac/0xfc
process_one_work+0x244/0x658
worker_thread+0x1b4/0x360
kthread+0x148/0x228
ret_from_fork+0x10/0x20
Kernel panic - not syncing: BRK handler: Fatal exceptionDan has also reported following issues with the original patch
https://lore.kernel.org/all/[email protected]/
Bug #1:
The zeroeth element of ctrl->pconfig[] is supposed to be unused. We start counting at 1. However this code sets ctrl->pconfig[0].ch_mask = 128.
Bug #2:
There are SLIM_MAX_TX_PORTS (16) elements in tx_ch[] array but only QCOM_SDW_MAX_PORTS + 1 (15) in the ctrl->pconfig[] array so it corrupts memory like Yongqin Liu pointed out.
Bug 3:
Like Jie Gan pointed out, it erases all the tx information with the rx information.
--- drivers/soundwire/qcom.c | 26 -------------------------- 1 file changed, 26 deletions(-)
drivers/soundwire/qcom.c +0 -26
@@ -156,7 +156,6 @@ struct qcom_swrm_port_config {u8 word_length;u8 blk_group_count;u8 lane_control; -u8 ch_mask; };/*
@@ -1049,13 +1048,9 @@ static int qcom_swrm_port_enable(struct sdw_bus *bus, {u32 reg =SWRM_DP_PORT_CTRL_BANK (enable_ch->port_num, bank);struct qcom_swrm_ctrl *ctrl =to_qcom_sdw (bus); -struct qcom_swrm_port_config *pcfg;u32 val; - pcfg = &ctrl->pconfig[enable_ch->port_num]; ctrl->reg_read (ctrl, reg, &val); -if (pcfg->ch_mask !=SWR_INVALID_PARAM && pcfg->ch_mask !=0 ) - enable_ch->ch_mask = pcfg->ch_mask;if (enable_ch->enable) val |= (enable_ch->ch_mask <<SWRM_DP_PORT_CTRL_EN_CHAN_SHFT );
@@ -1275,26 +1270,6 @@ static void *qcom_swrm_get_sdw_stream(struct snd_soc_dai *dai, int direction)return ctrl->sruntime[dai->id]; } -static int qcom_swrm_set_channel_map (struct snd_soc_dai *dai, -unsigned int tx_num,const unsigned int *tx_slot, -unsigned int rx_num,const unsigned int *rx_slot) -{ -struct qcom_swrm_ctrl *ctrl =dev_get_drvdata (dai->dev); -int i; - -if (tx_slot) { -for (i =0 ; i < tx_num; i++) - ctrl->pconfig[i].ch_mask = tx_slot[i]; - } - -if (rx_slot) { -for (i =0 ; i < rx_num; i++) - ctrl->pconfig[i].ch_mask = rx_slot[i]; - } - -return 0 ; -} -static int qcom_swrm_startup (struct snd_pcm_substream *substream,struct snd_soc_dai *dai) {
@@ -1331,7 +1306,6 @@ static const struct snd_soc_dai_ops qcom_swrm_pdm_dai_ops = { .shutdown = qcom_swrm_shutdown, .set_stream = qcom_swrm_set_sdw_stream, .get_stream = qcom_swrm_get_sdw_stream, - .set_channel_map = qcom_swrm_set_channel_map, };static const struct snd_soc_component_driver qcom_swrm_dai_component = {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 78/187 xfs: dont allocate the xfs_extent_busy structure for zoned RTGs
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit 5948705adbf1a7afcecfe9a13ff39221ef61e16b upstream.
Busy extent tracking is primarily used to ensure that freed blocks are not reused for data allocations before the transaction that deleted them has been committed to stable storage, and secondarily to drive online discard. None of the use cases applies to zoned RTGs, as the zoned allocator can't overwrite blocks before resetting the zone, which already flushes out all transactions touching the RTGs.
So the busy extent tracking is not needed for zoned RTGs, and also not called for zoned RTGs. But somehow the code to skip allocating and freeing the structure got lost during the zoned XFS upstreaming process. This not only causes these structures to unnecessarily allocated, but can also lead to memory leaks as the xg_busy_extents pointer in the xfs_group structure is overlayed with the pointer for the linked list of to be reset zones.
Stop allocating and freeing the structure to not pointlessly allocate memory which is then leaked when the zone is reset.
--- fs/xfs/libxfs/xfs_group.c | 14 +++++++++----- fs/xfs/xfs_extent_busy.h | 8 ++++++++ 2 files changed, 17 insertions(+), 5 deletions(-)
fs/xfs/libxfs/xfs_group.c +9 -5
@@ -163,7 +163,8 @@ xfs_group_free(xfs_defer_drain_free (&xg->xg_intents_drain);#ifdef __KERNEL__ -kfree (xg->xg_busy_extents); +if (xfs_group_has_extent_busy (xg->xg_mount, xg->xg_type)) +kfree (xg->xg_busy_extents);#endif if (uninit)
@@ -189,9 +190,11 @@ xfs_group_insert( xg->xg_type = type;#ifdef __KERNEL__ - xg->xg_busy_extents =xfs_extent_busy_alloc (); -if (!xg->xg_busy_extents) -return -ENOMEM ; +if (xfs_group_has_extent_busy (mp, type)) { + xg->xg_busy_extents =xfs_extent_busy_alloc (); +if (!xg->xg_busy_extents) +return -ENOMEM ; + }spin_lock_init (&xg->xg_state_lock);xfs_hooks_init (&xg->xg_rmap_update_hooks);#endif
@@ -210,7 +213,8 @@ xfs_group_insert( out_drain:xfs_defer_drain_free (&xg->xg_intents_drain);#ifdef __KERNEL__ -kfree (xg->xg_busy_extents); +if (xfs_group_has_extent_busy (xg->xg_mount, xg->xg_type)) +kfree (xg->xg_busy_extents);#endif return error; }
fs/xfs/xfs_extent_busy.h +8 -0
@@ -68,4 +68,12 @@ static inline void xfs_extent_busy_sort(struct list_head *list) list_sort(NULL, list, xfs_extent_busy_ag_cmp); } +/* +* Zoned RTGs don't need to track busy extents, as the actual block freeing only +* happens by a zone reset, which forces out all transactions that touched the +* to be reset zone first. +*/ +#define xfs_group_has_extent_busy (mp, type) \ + ((type) == XG_TYPE_AG || !xfs_has_zoned((mp))) +#endif /* __XFS_EXTENT_BUSY_H__ */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 79/187 iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
commit 1fe16dc1a2f5057772e5391ec042ed7442966c9a upstream.
fxls8962af_fifo_flush() uses indio_dev->active_scan_mask (with iio_for_each_active_channel()) without making sure the indio_dev stays in buffer mode.
There is a race if indio_dev exits buffer mode in the middle of the interrupt that flushes the fifo. Fix this by calling synchronize_irq() to ensure that no interrupt is currently running when disabling buffer mode.
Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read
[...]_find_first_bit_le from fxls8962af_fifo_flush+0x17c/0x290 fxls8962af_fifo_flush from fxls8962af_interrupt+0x80/0x178 fxls8962af_interrupt from irq_thread_fn+0x1c/0x7c irq_thread_fn from irq_thread+0x110/0x1f4 irq_thread from kthread+0xe0/0xfc
kthread from ret_from_fork+0x14/0x2c
--- drivers/iio/accel/fxls8962af-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/accel/fxls8962af-core.c +2 -0
@@ -877,6 +877,8 @@ static int fxls8962af_buffer_predisable(if (ret)return ret; +synchronize_irq (data->irq); + ret =__fxls8962af_fifo_set_mode (data, false);if (data->enable_event)
Greg Kroah-Hartman
maintainerPATCH 80/187 iio: adc: ad7380: fix adi,gain-milli property parsing
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 24fa69894ea3f76ecb13d7160692ee574a912803 upstream.
Change the data type of the "adi,gain-milli" property from u32 to u16. The devicetree binding specifies it as uint16, so we need to read it as such to avoid an -EOVERFLOW error when parsing the property.
--- drivers/iio/adc/ad7380.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/iio/adc/ad7380.c +3 -2
@@ -1920,8 +1920,9 @@ static int ad7380_probe(struct spi_devicif (st->chip_info->has_hardware_gain) {device_for_each_child_node_scoped (dev, node) { -unsigned int channel, gain; +unsigned int channel;int gain_idx; +u16 gain; ret =fwnode_property_read_u32 (node,"reg" , &channel);if (ret)
@@ -1933,7 +1934,7 @@ static int ad7380_probe(struct spi_devic"Invalid channel number %i\n" , channel); - ret =fwnode_property_read_u32 (node,"adi,gain-milli" , + ret =fwnode_property_read_u16 (node,"adi,gain-milli" , &gain);if (ret && ret != -EINVAL ) return dev_err_probe(dev, ret,
Greg Kroah-Hartman
maintainerPATCH 81/187 iio: adc: adi-axi-adc: fix ad7606_bus_reg_read()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 6ac609d1fba19d5d40fb3c81201ffadcb6d00fb3 upstream.
Mask the value read before returning it. The value read over the parallel bus via the AXI ADC IP block contains both the address and the data, but callers expect val to only contain the data.
axi_adc_raw_write() takes a u32 parameter, so addr was the wrong type. This wasn't causing any issues but is corrected anyway since we are touching the same line to add a new variable.
--- drivers/iio/adc/adi-axi-adc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/iio/adc/adi-axi-adc.c +4 -2
@@ -445,7 +445,7 @@ static int axi_adc_raw_read(struct iio_backend *back, u32 *val)static int ad7606_bus_reg_read (struct iio_backend *back,u32 reg,u32 *val) {struct adi_axi_adc_state *st =iio_backend_get_priv (back); -int addr; +u32 addr, reg_val;guard (mutex)(&st->lock);
@@ -455,7 +455,9 @@ static int ad7606_bus_reg_read(struct iio_backend *back, u32 reg, u32 *val)*/ addr =FIELD_PREP (ADI_AXI_REG_ADDRESS_MASK , reg) |ADI_AXI_REG_READ_BIT ;axi_adc_raw_write (back, addr); -axi_adc_raw_read (back, val); +axi_adc_raw_read (back, ®_val); + + *val =FIELD_GET (ADI_AXI_REG_VALUE_MASK , reg_val);/* Write 0x0 on the bus to get back to ADC mode */ axi_adc_raw_write (back,0 );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 82/187 iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
commit 3281ddcea6429f7bc1fdb39d407752dd1371aba9 upstream.
The AXP717 ADC channel maps is missing a sentinel entry at the end. This causes a KASAN warning.
Add the missing sentinel entry.
--- drivers/iio/adc/axp20x_adc.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/adc/axp20x_adc.c +1 -0
@@ -187,6 +187,7 @@ static struct iio_map axp717_maps[] = { .consumer_channel = "batt_chrg_i", .adc_channel_label = "batt_chrg_i", }, + { } };/*
Greg Kroah-Hartman
maintainerPATCH 83/187 iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 6d21f2c2dd843bceefd9455f2919f6bb526797f0 upstream.
Since commit 2718f15403fb ("iio: sanity check available_scan_masks array"), booting a board populated with a MAX11601 results in a flood of warnings:
max1363 1-0064: available_scan_mask 8 subset of 0. Never used max1363 1-0064: available_scan_mask 9 subset of 0. Never used max1363 1-0064: available_scan_mask 10 subset of 0. Never used max1363 1-0064: available_scan_mask 11 subset of 0. Never used max1363 1-0064: available_scan_mask 12 subset of 0. Never used max1363 1-0064: available_scan_mask 13 subset of 0. Never used
...
These warnings are caused by incorrect offsets used for differential channels in the MAX1363_4X_CHANS() and MAX1363_8X_CHANS() macros.
The max1363_mode_table[] defines the differential channel mappings as follows:
MAX1363_MODE_DIFF_SINGLE(0, 1, 1 << 12),MAX1363_MODE_DIFF_SINGLE(2, 3, 1 << 13),MAX1363_MODE_DIFF_SINGLE(4, 5, 1 << 14),MAX1363_MODE_DIFF_SINGLE(6, 7, 1 << 15),MAX1363_MODE_DIFF_SINGLE(8, 9, 1 << 16),MAX1363_MODE_DIFF_SINGLE(10, 11, 1 << 17),MAX1363_MODE_DIFF_SINGLE(1, 0, 1 << 18),MAX1363_MODE_DIFF_SINGLE(3, 2, 1 << 19),MAX1363_MODE_DIFF_SINGLE(5, 4, 1 << 20),MAX1363_MODE_DIFF_SINGLE(7, 6, 1 << 21),MAX1363_MODE_DIFF_SINGLE(9, 8, 1 << 22),MAX1363_MODE_DIFF_SINGLE(11, 10, 1 << 23),
Update the macros to follow this same pattern, ensuring that the scan masks are valid and preventing the warnings.
--- drivers/iio/adc/max1363.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/iio/adc/max1363.c +12 -12
@@ -511,10 +511,10 @@ static const struct iio_event_spec max13MAX1363_CHAN_U (1 , _s1,1 , bits, ev_spec, num_ev_spec), \MAX1363_CHAN_U (2 , _s2,2 , bits, ev_spec, num_ev_spec), \MAX1363_CHAN_U (3 , _s3,3 , bits, ev_spec, num_ev_spec), \ -MAX1363_CHAN_B (0 ,1 , d0m1,4 , bits, ev_spec, num_ev_spec), \ -MAX1363_CHAN_B (2 ,3 , d2m3,5 , bits, ev_spec, num_ev_spec), \ -MAX1363_CHAN_B (1 ,0 , d1m0,6 , bits, ev_spec, num_ev_spec), \ -MAX1363_CHAN_B (3 ,2 , d3m2,7 , bits, ev_spec, num_ev_spec), \ +MAX1363_CHAN_B (0 ,1 , d0m1,12 , bits, ev_spec, num_ev_spec), \ +MAX1363_CHAN_B (2 ,3 , d2m3,13 , bits, ev_spec, num_ev_spec), \ +MAX1363_CHAN_B (1 ,0 , d1m0,18 , bits, ev_spec, num_ev_spec), \ +MAX1363_CHAN_B (3 ,2 , d3m2,19 , bits, ev_spec, num_ev_spec), \ IIO_CHAN_SOFT_TIMESTAMP(8) \ }
@@ -609,14 +609,14 @@ static const enum max1363_modes max11608MAX1363_CHAN_U (5 , _s5,5 , bits,NULL ,0 ), \MAX1363_CHAN_U (6 , _s6,6 , bits,NULL ,0 ), \MAX1363_CHAN_U (7 , _s7,7 , bits,NULL ,0 ), \ -MAX1363_CHAN_B (0 ,1 , d0m1,8 , bits,NULL ,0 ), \ -MAX1363_CHAN_B (2 ,3 , d2m3,9 , bits,NULL ,0 ), \ -MAX1363_CHAN_B (4 ,5 , d4m5,10 , bits,NULL ,0 ), \ -MAX1363_CHAN_B (6 ,7 , d6m7,11 , bits,NULL ,0 ), \ -MAX1363_CHAN_B (1 ,0 , d1m0,12 , bits,NULL ,0 ), \ -MAX1363_CHAN_B (3 ,2 , d3m2,13 , bits,NULL ,0 ), \ -MAX1363_CHAN_B (5 ,4 , d5m4,14 , bits,NULL ,0 ), \ -MAX1363_CHAN_B (7 ,6 , d7m6,15 , bits,NULL ,0 ), \ +MAX1363_CHAN_B (0 ,1 , d0m1,12 , bits,NULL ,0 ), \ +MAX1363_CHAN_B (2 ,3 , d2m3,13 , bits,NULL ,0 ), \ +MAX1363_CHAN_B (4 ,5 , d4m5,14 , bits,NULL ,0 ), \ +MAX1363_CHAN_B (6 ,7 , d6m7,15 , bits,NULL ,0 ), \ +MAX1363_CHAN_B (1 ,0 , d1m0,18 , bits,NULL ,0 ), \ +MAX1363_CHAN_B (3 ,2 , d3m2,19 , bits,NULL ,0 ), \ +MAX1363_CHAN_B (5 ,4 , d5m4,20 , bits,NULL ,0 ), \ +MAX1363_CHAN_B (7 ,6 , d7m6,21 , bits,NULL ,0 ), \ IIO_CHAN_SOFT_TIMESTAMP(16) \ } static const struct iio_chan_spec max11602_channels[] = MAX1363_8X_CHANS(8);
Greg Kroah-Hartman
maintainerPATCH 84/187 iio: adc: max1363: Reorder mode_list[] entries
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 8d8d7c1dbc46aa07a76acab7336a42ddd900be10 upstream.
The IIO core issues warnings when a scan mask is a subset of a previous entry in the available_scan_masks array.
On a board using a MAX11601, the following warning is observed:
max1363 1-0064: available_scan_mask 7 subset of 6. Never used
This occurs because the entries in the max11607_mode_list[] array are not ordered correctly. To fix this, reorder the entries so that no scan mask is a subset of an earlier one.
While at it, reorder the mode_list[] arrays for other supported chips as well, to prevent similar warnings on different variants.
Note fixes tag dropped as these were introduced over many commits a long time back and the side effect until recently was a reduction in sampling rate due to reading too many channels when only a few were desired. Now we have a sanity check that reports this error but that is not where the issue was introduced.
--- drivers/iio/adc/max1363.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/iio/adc/max1363.c +9 -10
@@ -532,23 +532,23 @@ static const struct iio_chan_spec max136/* Applies to max1236, max1237 */ static const enum max1363_modes max1236_mode_list[] = { _s0, _s1, _s2, _s3, - s0to1, s0to2, s0to3, + s0to1, s0to2, s2to3, s0to3, d0m1, d2m3, d1m0, d3m2, d0m1to2m3, d1m0to3m2, - s2to3, };/* Applies to max1238, max1239 */ static const enum max1363_modes max1238_mode_list[] = { _s0, _s1, _s2, _s3, _s4, _s5, _s6, _s7, _s8, _s9, _s10, _s11, s0to1, s0to2, s0to3, s0to4, s0to5, s0to6, + s6to7, s6to8, s6to9, s6to10, s6to11, s0to7, s0to8, s0to9, s0to10, s0to11, d0m1, d2m3, d4m5, d6m7, d8m9, d10m11, d1m0, d3m2, d5m4, d7m6, d9m8, d11m10, - d0m1to2m3, d0m1to4m5, d0m1to6m7, d0m1to8m9, d0m1to10m11, - d1m0to3m2, d1m0to5m4, d1m0to7m6, d1m0to9m8, d1m0to11m10, - s6to7, s6to8, s6to9, s6to10, s6to11, - d6m7to8m9, d6m7to10m11, d7m6to9m8, d7m6to11m10, + d0m1to2m3, d0m1to4m5, d0m1to6m7, d6m7to8m9, + d0m1to8m9, d6m7to10m11, d0m1to10m11, d1m0to3m2, + d1m0to5m4, d1m0to7m6, d7m6to9m8, d1m0to9m8, + d7m6to11m10, d1m0to11m10, };#define MAX1363_12X_CHANS (bits) { \
@@ -584,16 +584,15 @@ static const struct iio_chan_spec max123static const enum max1363_modes max11607_mode_list[] = { _s0, _s1, _s2, _s3, - s0to1, s0to2, s0to3, - s2to3, + s0to1, s0to2, s2to3, + s0to3, d0m1, d2m3, d1m0, d3m2, d0m1to2m3, d1m0to3m2, };static const enum max1363_modes max11608_mode_list[] = { _s0, _s1, _s2, _s3, _s4, _s5, _s6, _s7, - s0to1, s0to2, s0to3, s0to4, s0to5, s0to6, s0to7, - s6to7, + s0to1, s0to2, s0to3, s0to4, s0to5, s0to6, s6to7, s0to7, d0m1, d2m3, d4m5, d6m7, d1m0, d3m2, d5m4, d7m6, d0m1to2m3, d0m1to4m5, d0m1to6m7,
Greg Kroah-Hartman
maintainerPATCH 85/187 iio: adc: stm32-adc: Fix race in installing chained IRQ handler
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
commit e8ad595064f6ebd5d2d1a5d5d7ebe0efce623091 upstream.
Fix a race where a pending interrupt could be received and the handler called before the handler's data has been setup, by converting to irq_set_chained_handler_and_data().
--- drivers/iio/adc/stm32-adc-core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/iio/adc/stm32-adc-core.c +3 -4
@@ -429,10 +429,9 @@ static int stm32_adc_irq_probe(struct plreturn -ENOMEM ; } -for (i =0 ; i < priv->cfg->num_irqs; i++) { -irq_set_chained_handler (priv->irq[i], stm32_adc_irq_handler); -irq_set_handler_data (priv->irq[i], priv); - } +for (i =0 ; i < priv->cfg->num_irqs; i++) +irq_set_chained_handler_and_data (priv->irq[i], + stm32_adc_irq_handler, priv);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 86/187 iio: backend: fix out-of-bound write
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Burri <[email protected]>
commit da9374819eb3885636934c1006d450c3cb1a02ed upstream.
The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". But afterwards a string terminator is written to the buffer at offset count without boundary check. The zero termination is written OUT-OF-BOUND.
Add a check that the given buffer is smaller then the buffer to prevent.
--- drivers/iio/industrialio-backend.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iio/industrialio-backend.c +4 -1
@@ -155,11 +155,14 @@ static ssize_t iio_backend_debugfs_writessize_t rc;int ret; +if (count >=sizeof (buf)) +return -ENOSPC ; + rc =simple_write_to_buffer (buf,sizeof (buf) -1 , ppos, userbuf, count);if (rc <0 )return rc; - buf[count] ='\0' ; + buf[rc] ='\0' ; ret =sscanf (buf,"%i %i" , &back->cached_reg_addr, &val);
Greg Kroah-Hartman
maintainerPATCH 87/187 iio: common: st_sensors: Fix use of uninitialize device structs
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maud Spierings <[email protected]>
commit 9f92e93e257b33e73622640a9205f8642ec16ddd upstream.
Throughout the various probe functions &indio_dev->dev is used before it is initialized. This caused a kernel panic in st_sensors_power_enable() when the call to devm_regulator_bulk_get_enable() fails and then calls dev_err_probe() with the uninitialized device.
This seems to only cause a panic with dev_err_probe(), dev_err(), dev_warn() and dev_info() don't seem to cause a panic, but are fixed as well.
The issue is reported and traced here: [1]
--- drivers/iio/accel/st_accel_core.c | 10 ++--- drivers/iio/common/st_sensors/st_sensors_core.c | 36 +++++++++------------ drivers/iio/common/st_sensors/st_sensors_trigger.c | 20 +++++------ 3 files changed, 31 insertions(+), 35 deletions(-)
drivers/iio/accel/st_accel_core.c +5 -5
@@ -1353,6 +1353,7 @@ static int apply_acpi_orientation(structunion acpi_object *ont;union acpi_object *elements;acpi_status status; +struct device *parent = indio_dev->dev.parent;int ret = -EINVAL ;unsigned int val;int i, j;
@@ -1371,7 +1372,7 @@ static int apply_acpi_orientation(struct }; - adev =ACPI_COMPANION (indio_dev->dev.parent); + adev =ACPI_COMPANION (parent);if (!adev)return -ENXIO ;
@@ -1380,8 +1381,7 @@ static int apply_acpi_orientation(structif (status ==AE_NOT_FOUND ) {return -ENXIO ; }else if (ACPI_FAILURE (status)) { -dev_warn (&indio_dev->dev,"failed to execute _ONT: %d\n" , - status); +dev_warn (parent,"failed to execute _ONT: %d\n" , status);return status; }
@@ -1457,12 +1457,12 @@ static int apply_acpi_orientation(struct } ret =0 ; -dev_info (&indio_dev->dev,"computed mount matrix from ACPI\n" ); +dev_info (parent,"computed mount matrix from ACPI\n" ); out:kfree (buffer.pointer);if (ret) -dev_dbg (&indio_dev->dev, +dev_dbg (parent,"failed to apply ACPI orientation data: %d\n" , ret);return ret;
drivers/iio/common/st_sensors/st_sensors_core.c +17 -19
@@ -154,7 +154,7 @@ static int st_sensors_set_fullscale(strureturn err; st_accel_set_fullscale_error: -dev_err (&indio_dev->dev,"failed to set new fullscale.\n" ); +dev_err (indio_dev->dev.parent,"failed to set new fullscale.\n" );return err; }
@@ -231,8 +231,7 @@ int st_sensors_power_enable(struct iio_dARRAY_SIZE (regulator_names), regulator_names);if (err) -return dev_err_probe (&indio_dev->dev, err, -"unable to enable supplies\n" ); +return dev_err_probe (parent, err,"unable to enable supplies\n" );return 0 ; }
@@ -241,13 +240,14 @@ EXPORT_SYMBOL_NS(st_sensors_power_enablestatic int st_sensors_set_drdy_int_pin (struct iio_dev *indio_dev,struct st_sensors_platform_data *pdata) { +struct device *parent = indio_dev->dev.parent;struct st_sensor_data *sdata =iio_priv (indio_dev);/* Sensor does not support interrupts */ if (!sdata->sensor_settings->drdy_irq.int1.addr && !sdata->sensor_settings->drdy_irq.int2.addr) {if (pdata->drdy_int_pin) -dev_info (&indio_dev->dev, +dev_info (parent,"DRDY on pin INT%d specified, but sensor does not support interrupts\n" , pdata->drdy_int_pin);return 0 ;
@@ -256,29 +256,27 @@ static int st_sensors_set_drdy_int_pin(sswitch (pdata->drdy_int_pin) {case 1 :if (!sdata->sensor_settings->drdy_irq.int1.mask) { -dev_err (&indio_dev->dev, -"DRDY on INT1 not available.\n" ); +dev_err (parent,"DRDY on INT1 not available.\n" );return -EINVAL ; } sdata->drdy_int_pin =1 ;break ;case 2 :if (!sdata->sensor_settings->drdy_irq.int2.mask) { -dev_err (&indio_dev->dev, -"DRDY on INT2 not available.\n" ); +dev_err (parent,"DRDY on INT2 not available.\n" );return -EINVAL ; } sdata->drdy_int_pin =2 ;break ;default : -dev_err (&indio_dev->dev,"DRDY on pdata not valid.\n" ); +dev_err (parent,"DRDY on pdata not valid.\n" );return -EINVAL ; }if (pdata->open_drain) {if (!sdata->sensor_settings->drdy_irq.int1.addr_od && !sdata->sensor_settings->drdy_irq.int2.addr_od) -dev_err (&indio_dev->dev, +dev_err (parent,"open drain requested but unsupported.\n" );else sdata->int_pin_open_drain = true;
@@ -336,6 +334,7 @@ EXPORT_SYMBOL_NS(st_sensors_dev_name_proint st_sensors_init_sensor (struct iio_dev *indio_dev,struct st_sensors_platform_data *pdata) { +struct device *parent = indio_dev->dev.parent;struct st_sensor_data *sdata =iio_priv (indio_dev);struct st_sensors_platform_data *of_pdata;int err =0 ;
@@ -343,7 +342,7 @@ int st_sensors_init_sensor(struct iio_demutex_init (&sdata->odr_lock);/* If OF/DT pdata exists, it will take precedence of anything else */ - of_pdata =st_sensors_dev_probe (indio_dev->dev.parent, pdata); + of_pdata =st_sensors_dev_probe (parent, pdata);if (IS_ERR (of_pdata))return PTR_ERR (of_pdata);if (of_pdata)
@@ -370,7 +369,7 @@ int st_sensors_init_sensor(struct iio_deif (err <0 )return err; }else -dev_info (&indio_dev->dev,"Full-scale not possible\n" ); +dev_info (parent,"Full-scale not possible\n" ); err =st_sensors_set_odr (indio_dev, sdata->odr);if (err <0 )
@@ -405,7 +404,7 @@ int st_sensors_init_sensor(struct iio_de mask = sdata->sensor_settings->drdy_irq.int2.mask_od; } -dev_info (&indio_dev->dev, +dev_info (parent,"set interrupt line to open drain mode on pin %d\n" , sdata->drdy_int_pin); err = st_sensors_write_data_with_mask(indio_dev, addr,
@@ -594,21 +593,20 @@ EXPORT_SYMBOL_NS(st_sensors_get_settingsint st_sensors_verify_id (struct iio_dev *indio_dev) {struct st_sensor_data *sdata =iio_priv (indio_dev); +struct device *parent = indio_dev->dev.parent;int wai, err;if (sdata->sensor_settings->wai_addr) { err =regmap_read (sdata->regmap, sdata->sensor_settings->wai_addr, &wai);if (err <0 ) { -dev_err (&indio_dev->dev, -"failed to read Who-Am-I register.\n" ); -return err; +return dev_err_probe (parent, err, +"failed to read Who-Am-I register.\n" ); }if (sdata->sensor_settings->wai != wai) { -dev_warn (&indio_dev->dev, -"%s: WhoAmI mismatch (0x%x).\n" , - indio_dev->name, wai); +dev_warn (parent,"%s: WhoAmI mismatch (0x%x).\n" , + indio_dev->name, wai); } }
drivers/iio/common/st_sensors/st_sensors_trigger.c +9 -11
@@ -127,7 +127,7 @@ int st_sensors_allocate_trigger(struct i sdata->trig =devm_iio_trigger_alloc (parent,"%s-trigger" , indio_dev->name);if (sdata->trig ==NULL ) { -dev_err (&indio_dev->dev,"failed to allocate iio trigger.\n" ); +dev_err (parent,"failed to allocate iio trigger.\n" );return -ENOMEM ; }
@@ -143,7 +143,7 @@ int st_sensors_allocate_trigger(struct icase IRQF_TRIGGER_FALLING :case IRQF_TRIGGER_LOW :if (!sdata->sensor_settings->drdy_irq.addr_ihl) { -dev_err (&indio_dev->dev, +dev_err (parent,"falling/low specified for IRQ but hardware supports only rising/high: will request rising/high\n" );if (irq_trig ==IRQF_TRIGGER_FALLING ) irq_trig =IRQF_TRIGGER_RISING ;
@@ -156,21 +156,19 @@ int st_sensors_allocate_trigger(struct i sdata->sensor_settings->drdy_irq.mask_ihl, 1);if (err <0 )return err; -dev_info (&indio_dev->dev, +dev_info (parent,"interrupts on the falling edge or active low level\n" ); }break ;case IRQF_TRIGGER_RISING : -dev_info (&indio_dev->dev, -"interrupts on the rising edge\n" ); +dev_info (parent,"interrupts on the rising edge\n" );break ;case IRQF_TRIGGER_HIGH : -dev_info (&indio_dev->dev, -"interrupts active high level\n" ); +dev_info (parent,"interrupts active high level\n" );break ;default :/* This is the most preferred mode, if possible */ -dev_err (&indio_dev->dev, +dev_err (parent,"unsupported IRQ trigger specified (%lx), enforce rising edge\n" , irq_trig); irq_trig =IRQF_TRIGGER_RISING ; }
@@ -179,7 +177,7 @@ int st_sensors_allocate_trigger(struct iif (irq_trig ==IRQF_TRIGGER_FALLING || irq_trig ==IRQF_TRIGGER_RISING ) {if (!sdata->sensor_settings->drdy_irq.stat_drdy.addr) { -dev_err (&indio_dev->dev, +dev_err (parent,"edge IRQ not supported w/o stat register.\n" );return -EOPNOTSUPP ; }
@@ -214,13 +212,13 @@ int st_sensors_allocate_trigger(struct i sdata->trig->name, sdata->trig);if (err) { -dev_err (&indio_dev->dev,"failed to request trigger IRQ.\n" ); +dev_err (parent,"failed to request trigger IRQ.\n" );return err; } err =devm_iio_trigger_register (parent, sdata->trig);if (err <0 ) { -dev_err (&indio_dev->dev,"failed to register iio trigger.\n" ); +dev_err (parent,"failed to register iio trigger.\n" );return err; } indio_dev->trig =iio_trigger_get (sdata->trig);
Greg Kroah-Hartman
maintainerPATCH 88/187 comedi: pcl812: Fix bit shift out of bounds
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit b14b076ce593f72585412fc7fd3747e03a5e3632 upstream.
When checking for a supported IRQ number, the following test is used:
if ((1 << it->options[1]) & board->irq_bits) {However, it->options[i] is an unchecked int value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring it->options[1] to be within bounds before proceeding with the original test. Valid it->options[1] values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts.
--- drivers/comedi/drivers/pcl812.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/comedi/drivers/pcl812.c +2 -1
@@ -1149,7 +1149,8 @@ static int pcl812_attach(struct comedi_dif (IS_ERR (dev->pacer))return PTR_ERR (dev->pacer); -if ((1 << it->options[1 ]) & board->irq_bits) { +if (it->options[1 ] >0 && it->options[1 ] <16 && + (1 << it->options[1 ]) & board->irq_bits) { ret =request_irq (it->options[1 ], pcl812_interrupt,0 , dev->board_name, dev);if (ret ==0 )
Greg Kroah-Hartman
maintainerPATCH 89/187 comedi: aio_iiro_16: Fix bit shift out of bounds
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 66acb1586737a22dd7b78abc63213b1bcaa100e4 upstream.
When checking for a supported IRQ number, the following test is used:
if ((1 << it->options[1]) & 0xdcfc) {However, it->options[i] is an unchecked int value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring it->options[1] to be within bounds before proceeding with the original test. Valid it->options[1] values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts.
--- drivers/comedi/drivers/aio_iiro_16.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/comedi/drivers/aio_iiro_16.c +2 -1
@@ -177,7 +177,8 @@ static int aio_iiro_16_attach(struct com* Digital input change of state interrupts are optionally supported * using IRQ 2-7, 10-12, 14, or 15. */ -if ((1 << it->options[1 ]) &0xdcfc ) { +if (it->options[1 ] >0 && it->options[1 ] <16 && + (1 << it->options[1 ]) &0xdcfc ) { ret =request_irq (it->options[1 ], aio_iiro_16_cos,0 , dev->board_name, dev);if (ret ==0 )
Greg Kroah-Hartman
maintainerPATCH 90/187 comedi: das16m1: Fix bit shift out of bounds
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit ed93c6f68a3be06e4e0c331c6e751f462dee3932 upstream.
When checking for a supported IRQ number, the following test is used:
/* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */
if ((1 << it->options[1]) & 0xdcfc) {However, it->options[i] is an unchecked int value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring it->options[1] to be within bounds before proceeding with the original test.
--- drivers/comedi/drivers/das16m1.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/comedi/drivers/das16m1.c +2 -1
@@ -522,7 +522,8 @@ static int das16m1_attach(struct comedi_ devpriv->extra_iobase = dev->iobase +DAS16M1_8255_IOBASE ;/* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */ -if ((1 << it->options[1 ]) &0xdcfc ) { +if (it->options[1 ] >=2 && it->options[1 ] <=15 && + (1 << it->options[1 ]) &0xdcfc ) { ret =request_irq (it->options[1 ], das16m1_interrupt,0 , dev->board_name, dev);if (ret ==0 )
Greg Kroah-Hartman
maintainerPATCH 91/187 comedi: das6402: Fix bit shift out of bounds
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 70f2b28b5243df557f51c054c20058ae207baaac upstream.
When checking for a supported IRQ number, the following test is used:
/* IRQs 2,3,5,6,7, 10,11,15 are valid for "enhanced" mode */
if ((1 << it->options[1]) & 0x8cec) {However, it->options[i] is an unchecked int value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring it->options[1] to be within bounds before proceeding with the original test. Valid it->options[1] values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts.
--- drivers/comedi/drivers/das6402.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/comedi/drivers/das6402.c +2 -1
@@ -567,7 +567,8 @@ static int das6402_attach(struct comedi_das6402_reset (dev);/* IRQs 2,3,5,6,7, 10,11,15 are valid for "enhanced" mode */ -if ((1 << it->options[1 ]) &0x8cec ) { +if (it->options[1 ] >0 && it->options[1 ] <16 && + (1 << it->options[1 ]) &0x8cec ) { ret =request_irq (it->options[1 ], das6402_interrupt,0 , dev->board_name, dev);if (ret ==0 ) {
Greg Kroah-Hartman
maintainerPATCH 92/187 comedi: comedi_test: Fix possible deletion of uninitialized timers
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 1b98304c09a0192598d0767f1eb8c83d7e793091 upstream.
In waveform_common_attach(), the two timers &devpriv->ai_timer and &devpriv->ao_timer are initialized after the allocation of the device private data by comedi_alloc_devpriv() and the subdevices by comedi_alloc_subdevices(). The function may return with an error between those function calls. In that case, waveform_detach() will be called by the Comedi core to clean up. The check that waveform_detach() uses to decide whether to delete the timers is incorrect. It only checks that the device private data was allocated, but that does not guarantee that the timers were initialized. It also needs to check that the subdevices were allocated. Fix it.
--- drivers/comedi/drivers/comedi_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/comedi/drivers/comedi_test.c +1 -1
@@ -790,7 +790,7 @@ static void waveform_detach(struct comed {struct waveform_private *devpriv = dev->private; -if (devpriv) { +if (devpriv && dev->n_subdevices) {timer_delete_sync (&devpriv->ai_timer);timer_delete_sync (&devpriv->ao_timer); }
Greg Kroah-Hartman
maintainerPATCH 93/187 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 08ae4b20f5e82101d77326ecab9089e110f224cc upstream.
The handling of the COMEDI_INSNLIST ioctl allocates a kernel buffer to hold the array of struct comedi_insn, getting the length from the n_insns member of the struct comedi_insnlist supplied by the user. The allocation will fail with a WARNING and a stack dump if it is too large.
Avoid that by failing with an -EINVAL error if the supplied n_insns value is unreasonable.
Define the limit on the n_insns value in the MAX_INSNS macro. Set this to the same value as MAX_SAMPLES (65536), which is the maximum allowed sum of the values of the member n in the array of struct comedi_insn, and sensible comedi instructions will have an n of at least 1.
--- drivers/comedi/comedi_fops.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/comedi/comedi_fops.c +16 -0
@@ -1589,6 +1589,16 @@ error:return i; } +#define MAX_INSNS MAX_SAMPLES +static int check_insnlist_len (struct comedi_device *dev,unsigned int n_insns) +{ +if (n_insns >MAX_INSNS ) { +dev_dbg (dev->class_dev,"insnlist length too large\n" ); +return -EINVAL ; + } +return 0 ; +} +/* * COMEDI_INSN ioctl * synchronous instruction
@@ -2239,6 +2249,9 @@ static long comedi_unlocked_ioctl(struct rc = -EFAULT ;break ; } + rc =check_insnlist_len (dev, insnlist.n_insns); +if (rc) +break ; insns =kcalloc (insnlist.n_insns,sizeof (*insns),GFP_KERNEL );if (!insns) { rc = -ENOMEM ;
@@ -3090,6 +3103,9 @@ static int compat_insnlist(struct file *if (copy_from_user (&insnlist32,compat_ptr (arg),sizeof (insnlist32)))return -EFAULT ; + rc =check_insnlist_len (dev, insnlist32.n_insns); +if (rc) +return rc; insns =kcalloc (insnlist32.n_insns,sizeof (*insns),GFP_KERNEL );if (!insns)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 94/187 comedi: Fix some signed shift left operations
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit ab705c8c35e18652abc6239c07cf3441f03e2cda upstream.
Correct some left shifts of the signed integer constant 1 by some unsigned number less than 32. Change the constant to 1U to avoid shifting a 1 into the sign bit.
The corrected functions are comedi_dio_insn_config(), comedi_dio_update_state(), and __comedi_device_postconfig().
--- drivers/comedi/drivers.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/comedi/drivers.c +7 -7
@@ -339,10 +339,10 @@ int comedi_dio_insn_config(struct comedi unsigned int *data, unsigned int mask) { -unsigned int chan_mask =1 <<CR_CHAN (insn->chanspec); +unsigned int chan =CR_CHAN (insn->chanspec); -if (!mask) - mask = chan_mask; +if (!mask && chan <32 ) + mask =1U << chan;switch (data[0 ]) {case INSN_CONFIG_DIO_INPUT :
@@ -382,7 +382,7 @@ EXPORT_SYMBOL_GPL(comedi_dio_insn_configunsigned int comedi_dio_update_state (struct comedi_subdevice *s,unsigned int *data) { -unsigned int chanmask = (s->n_chan <32 ) ? ((1 << s->n_chan) -1 ) +unsigned int chanmask = (s->n_chan <32 ) ? ((1U << s->n_chan) -1 ) :0xffffffff ;unsigned int mask = data[0 ] & chanmask;unsigned int bits = data[1 ];
@@ -625,8 +625,8 @@ static int insn_rw_emulate_bits(struct cif (insn->insn ==INSN_WRITE ) {if (!(s->subdev_flags &SDF_WRITABLE ))return -EINVAL ; - _data[0 ] =1 << (chan - base_chan);/* mask */ - _data[1 ] = data[0 ] ? (1 << (chan - base_chan)) :0 ;/* bits */ + _data[0 ] =1U << (chan - base_chan);/* mask */ + _data[1 ] = data[0 ] ? (1U << (chan - base_chan)) :0 ;/* bits */ } ret = s->insn_bits (dev, s, &_insn, _data);
@@ -709,7 +709,7 @@ static int __comedi_device_postconfig(stif (s->type ==COMEDI_SUBD_DO ) {if (s->n_chan <32 ) - s->io_bits = (1 << s->n_chan) -1 ; + s->io_bits = (1U << s->n_chan) -1 ;else s->io_bits =0xffffffff ; }
Greg Kroah-Hartman
maintainerPATCH 95/187 comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit e9cb26291d009243a4478a7ffb37b3a9175bfce9 upstream.
For Comedi INSN_READ and INSN_WRITE instructions on "digital" subdevices (subdevice types COMEDI_SUBD_DI, COMEDI_SUBD_DO, and COMEDI_SUBD_DIO), it is common for the subdevice driver not to have insn_read and insn_write handler functions, but to have an insn_bits handler function for handling Comedi INSN_BITS instructions. In that case, the subdevice's insn_read and/or insn_write function handler pointers are set to point to the insn_rw_emulate_bits() function by __comedi_device_postconfig().
For INSN_WRITE, insn_rw_emulate_bits() currently assumes that the supplied data[0] value is a valid copy from user memory. It will at least exist because do_insnlist_ioctl() and do_insn_ioctl() in "comedi_fops.c" ensure at lease MIN_SAMPLES (16) elements are allocated. However, if insn->n is 0 (which is allowable for INSN_READ and INSN_WRITE instructions, then data[0] may contain uninitialized data, and certainly contains invalid data, possibly from a different instruction in the array of instructions handled by do_insnlist_ioctl(). This will result in an incorrect value being written to the digital output channel (or to the digital input/output channel if configured as an output), and may be reflected in the internal saved state of the channel.
Fix it by returning 0 early if insn->n is 0, before reaching the code that accesses data[0]. Previously, the function always returned 1 on success, but it is supposed to be the number of data samples actually read or written up to insn->n, which is 0 in this case.
--- drivers/comedi/drivers.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/comedi/drivers.c +3 -0
@@ -615,6 +615,9 @@ static int insn_rw_emulate_bits(struct cunsigned int _data[2 ];int ret; +if (insn->n ==0 ) +return 0 ; +memset (_data,0 ,sizeof (_data));memset (&_insn,0 ,sizeof (_insn)); _insn.insn =INSN_BITS ;
Greg Kroah-Hartman
maintainerPATCH 96/187 comedi: Fix initialization of data for instructions that write to subdevice
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 46d8c744136ce2454aa4c35c138cc06817f92b8e upstream.
Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first insn->n elements in some cases. The do_insn_ioctl() and do_insnlist_ioctl() functions allocate at least MIN_SAMPLES (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first insn->n data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first MIN_SAMPLES elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For do_insnlist_ioctl(), the same data buffer elements are used for handling a list of instructions, so ensure the first MIN_SAMPLES elements are initialized for each instruction that writes to the subdevice.
--- drivers/comedi/comedi_fops.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/comedi/comedi_fops.c +12 -2
@@ -1556,21 +1556,27 @@ static int do_insnlist_ioctl(struct come }for (i =0 ; i < n_insns; ++i) { +unsigned int n = insns[i].n; +if (insns[i].insn &INSN_MASK_WRITE ) {if (copy_from_user (data, insns[i].data, - insns[i].n *sizeof (unsigned int ))) { + n *sizeof (unsigned int ))) {dev_dbg (dev->class_dev,"copy_from_user failed\n" ); ret = -EFAULT ; goto error; } +if (n <MIN_SAMPLES ) { +memset (&data[n],0 , (MIN_SAMPLES - n) * +sizeof (unsigned int )); + } } ret =parse_insn (dev, insns + i, data, file);if (ret <0 ) goto error;if (insns[i].insn &INSN_MASK_READ ) {if (copy_to_user (insns[i].data, data, - insns[i].n *sizeof (unsigned int ))) { + n *sizeof (unsigned int ))) {dev_dbg (dev->class_dev,"copy_to_user failed\n" ); ret = -EFAULT ;
@@ -1643,6 +1649,10 @@ static int do_insn_ioctl(struct comedi_d ret = -EFAULT ; goto error; } +if (insn->n <MIN_SAMPLES ) { +memset (&data[insn->n],0 , + (MIN_SAMPLES - insn->n) *sizeof (unsigned int )); + } } ret =parse_insn (dev, insn, data, file);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 97/187 arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Yan <[email protected]>
[ Upstream commit e625e284172d235be5cd906a98c6c91c365bb9b1 ]
cd-gpios is used for sdcard detects for sdmmc.
--- arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi +1 -0
@@ -321,6 +321,7 @@ bus-width = <4>; cap-mmc-highspeed; cap-sd-highspeed; + cd-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_LOW>; disable-wp; max-frequency = <150000000>; no-sdio;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/187 arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Yan <[email protected]>
[ Upstream commit 98570e8cb8b0c0893810f285b4a3b1a3ab81a556 ]
cd-gpios is used for sdcard detects for sdmmc.
--- arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts +1 -0
@@ -474,6 +474,7 @@ bus-width = <4>; cap-mmc-highspeed; cap-sd-highspeed; + cd-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_LOW>; disable-wp; max-frequency = <150000000>; no-sdio;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/187 soundwire: amd: fix for handling slave alerts after link is down
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijendar Mukunda <[email protected]>
[ Upstream commit 86a4371b76976158be875dc654ceee35c574b27b ]
Sometimes, its observed that during system level suspend callback execution, after link is down, handling pending slave status workqueue results in mipi register access failures as shown below.
soundwire sdw-master-0-0: trf on Slave 1 failed:-110 read addr 0 count 1 rt722-sdca sdw:0:0:025d:0722:01: SDW_DP0_INT recheck read failed:-110 rt722-sdca sdw:0:0:025d:0722:01: Slave 1 alert handling failed: -110 amd_sdw_manager amd_sdw_manager.0: SDW0 cmd response timeout occurred amd_sdw_manager amd_sdw_manager.0: command timeout for Slave 1 soundwire sdw-master-0-0: trf on Slave 1 failed:-110 write addr 5c count 1 amd_sdw_manager amd_sdw_manager.0: SDW0 previous cmd status clear failed amd_sdw_manager amd_sdw_manager.0: command timeout for Slave 1 soundwire sdw-master-0-0: trf on Slave 1 failed:-110 write addr 5d count 1 amd_sdw_manager amd_sdw_manager.0: SDW0 previous cmd status clear failed amd_sdw_manager amd_sdw_manager.0: command timeout for Slave 1
Cancel the pending slave status workqueue prior to initiating clock stop sequence during suspend callback execution for both the power modes.
--- drivers/soundwire/amd_manager.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/soundwire/amd_manager.c +2 -0
@@ -1209,6 +1209,7 @@ static int __maybe_unused amd_suspend(struct device *dev) }if (amd_manager->power_mode_mask &AMD_SDW_CLK_STOP_MODE ) { +cancel_work_sync (&amd_manager->amd_sdw_work);amd_sdw_wake_enable (amd_manager, false);if (amd_manager->acp_rev >=ACP70_PCI_REV_ID ) { ret =amd_sdw_host_wake_enable (amd_manager, false);
@@ -1219,6 +1220,7 @@ static int __maybe_unused amd_suspend(struct device *dev)if (ret)return ret; }else if (amd_manager->power_mode_mask &AMD_SDW_POWER_OFF_MODE ) { +cancel_work_sync (&amd_manager->amd_sdw_work);amd_sdw_wake_enable (amd_manager, false);if (amd_manager->acp_rev >=ACP70_PCI_REV_ID ) { ret =amd_sdw_host_wake_enable (amd_manager, false);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/187 phy: use per-PHY lockdep keys
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit cf0233491b3a15933234a26efd9ecbc1c0764674 ]
If the PHY driver uses another PHY internally (e.g. in case of eUSB2, repeaters are represented as PHYs), then it would trigger the following lockdep splat because all PHYs use a single static lockdep key and thus lockdep can not identify whether there is a dependency or not and reports a false positive.
Make PHY subsystem use dynamic lockdep keys, assigning each driver a separate key. This way lockdep can correctly identify dependency graph between mutexes.
============================================
WARNING: possible recursive locking detected 6.15.0-rc7-next-20250522-12896-g3932f283970c #3455 Not tainted
--------------------------------------------
kworker/u51:0/78 is trying to acquire lock:
ffff0008116554f0 (&phy->mutex){+.+.}-{4:4}, at: phy_init+0x4c/0x12c
but task is already holding lock:
ffff000813c10cf0 (&phy->mutex){+.+.}-{4:4}, at: phy_init+0x4c/0x12c
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&phy->mutex);
lock(&phy->mutex);
*** DEADLOCK ***
May be due to missing lock nesting notation
4 locks held by kworker/u51:0/78:
#0: ffff000800010948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x18c/0x5ec #1: ffff80008036bdb0 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work+0x1b4/0x5ec #2: ffff0008094ac8f8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x38/0x188
#3: ffff000813c10cf0 (&phy->mutex){+.+.}-{4:4}, at: phy_init+0x4c/0x12c
stack backtrace: CPU: 0 UID: 0 PID: 78 Comm: kworker/u51:0 Not tainted 6.15.0-rc7-next-20250522-12896-g3932f283970c #3455 PREEMPT Hardware name: Qualcomm CRD, BIOS 6.0.240904.BOOT.MXF.2.4-00528.1-HAMOA-1 09/ 4/2024 Workqueue: events_unbound deferred_probe_work_func Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x90/0xd0 dump_stack+0x18/0x24 print_deadlock_bug+0x258/0x348 __lock_acquire+0x10fc/0x1f84 lock_acquire+0x1c8/0x338 __mutex_lock+0xb8/0x59c mutex_lock_nested+0x24/0x30 phy_init+0x4c/0x12c snps_eusb2_hsphy_init+0x54/0x1a0 phy_init+0xe0/0x12c dwc3_core_init+0x450/0x10b4 dwc3_core_probe+0xce4/0x15fc dwc3_probe+0x64/0xb0 platform_probe+0x68/0xc4 really_probe+0xbc/0x298 __driver_probe_device+0x78/0x12c driver_probe_device+0x3c/0x160 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x84/0xe0 __device_attach+0x9c/0x188 device_initial_probe+0x14/0x20 bus_probe_device+0xac/0xb0 deferred_probe_work_func+0x8c/0xc8 process_one_work+0x208/0x5ec worker_thread+0x1c0/0x368 kthread+0x14c/0x20c ret_from_fork+0x10/0x20
--- drivers/phy/phy-core.c | 5 ++++- include/linux/phy/phy.h | 2 ++ 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/phy/phy-core.c +4 -1
@@ -994,7 +994,8 @@ struct phy *phy_create(struct device *dev, struct device_node *node, }device_initialize (&phy->dev); -mutex_init (&phy->mutex); +lockdep_register_key (&phy->lockdep_key); +mutex_init_with_key (&phy->mutex, &phy->lockdep_key); phy->dev.class = &phy_class; phy->dev.parent = dev;
@@ -1259,6 +1260,8 @@ static void phy_release(struct device *dev)dev_vdbg (dev,"releasing '%s'\n" ,dev_name (dev));debugfs_remove_recursive (phy->debugfs);regulator_put (phy->pwr); +mutex_destroy (&phy->mutex); +lockdep_unregister_key (&phy->lockdep_key);ida_free (&phy_ida, phy->id);kfree (phy); }
include/linux/phy/phy.h +2 -0
@@ -149,6 +149,7 @@ struct phy_attrs {* @id: id of the phy device * @ops: function pointers for performing phy operations * @mutex: mutex to protect phy_ops +* @lockdep_key: lockdep information for this mutex * @init_count: used to protect when the PHY is used by multiple consumers * @power_count: used to protect when the PHY is used by multiple consumers * @attrs: used to specify PHY specific attributes
@@ -160,6 +161,7 @@ struct phy {int id;const struct phy_ops *ops;struct mutex mutex; +struct lock_class_key lockdep_key;int init_count;int power_count;struct phy_attrs attrs;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/187 soundwire: amd: fix for clearing command status register
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijendar Mukunda <[email protected]>
[ Upstream commit a628e69b6412dc02757a6a23f7f16ce0c14d71f1 ]
To clear the valid result status, 1 should be written to ACP_SDW_IMM_CMD_STS register. Update the ACP_SW_IMM_CMD_STS register value as 1.
--- drivers/soundwire/amd_manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soundwire/amd_manager.c +1 -1
@@ -238,7 +238,7 @@ static u64 amd_sdw_send_cmd_get_resp(struct amd_sdw_manager *amd_manager, u32 loif (sts &AMD_SDW_IMM_RES_VALID ) {dev_err (amd_manager->dev,"SDW%x manager is in bad state\n" , amd_manager->instance); -writel (0x00 , amd_manager->mmio +ACP_SW_IMM_CMD_STS ); +writel (AMD_SDW_IMM_RES_VALID , amd_manager->mmio +ACP_SW_IMM_CMD_STS ); }writel (upper_data, amd_manager->mmio +ACP_SW_IMM_CMD_UPPER_WORD );writel (lower_data, amd_manager->mmio +ACP_SW_IMM_CMD_LOWER_QWORD );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/187 arm64: dts: imx95-19x19-evk: fix the overshoot issue of NETC
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 36c2bf42b6f02ded87a381edc6b500cd6aac5018 ]
The overshoot of MDIO, MDC and ENET1_TDx is too high, so reduce the drive strength these pins.
--- arch/arm64/boot/dts/freescale/imx95-19x19-evk.dts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/freescale/imx95-19x19-evk.dts +6 -6
@@ -536,17 +536,17 @@ &scmi_iomuxc { pinctrl_emdio: emdiogrp{ fsl,pins = < - IMX95_PAD_ENET1_MDC__NETCMIX_TOP_NETC_MDC 0x57e - IMX95_PAD_ENET1_MDIO__NETCMIX_TOP_NETC_MDIO 0x97e + IMX95_PAD_ENET1_MDC__NETCMIX_TOP_NETC_MDC 0x50e + IMX95_PAD_ENET1_MDIO__NETCMIX_TOP_NETC_MDIO 0x90e >; }; pinctrl_enetc0: enetc0grp { fsl,pins = < - IMX95_PAD_ENET1_TD3__NETCMIX_TOP_ETH0_RGMII_TD3 0x57e - IMX95_PAD_ENET1_TD2__NETCMIX_TOP_ETH0_RGMII_TD2 0x57e - IMX95_PAD_ENET1_TD1__NETCMIX_TOP_ETH0_RGMII_TD1 0x57e - IMX95_PAD_ENET1_TD0__NETCMIX_TOP_ETH0_RGMII_TD0 0x57e + IMX95_PAD_ENET1_TD3__NETCMIX_TOP_ETH0_RGMII_TD3 0x50e + IMX95_PAD_ENET1_TD2__NETCMIX_TOP_ETH0_RGMII_TD2 0x50e + IMX95_PAD_ENET1_TD1__NETCMIX_TOP_ETH0_RGMII_TD1 0x50e + IMX95_PAD_ENET1_TD0__NETCMIX_TOP_ETH0_RGMII_TD0 0x50e IMX95_PAD_ENET1_TX_CTL__NETCMIX_TOP_ETH0_RGMII_TX_CTL 0x57e IMX95_PAD_ENET1_TXC__NETCMIX_TOP_ETH0_RGMII_TX_CLK 0x58e IMX95_PAD_ENET1_RX_CTL__NETCMIX_TOP_ETH0_RGMII_RX_CTL 0x57e
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/187 arm64: dts: imx95-15x15-evk: fix the overshoot issue of NETC
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit e0322ac2a3cf7013b7af73b1293670f1e163c92e ]
The overshoot of MDIO, MDC, ENET1_TDx and ENET2_TDx is too high, so reduce the drive strength of these pins.
--- .../boot/dts/freescale/imx95-15x15-evk.dts | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts +10 -10
@@ -558,17 +558,17 @@ &scmi_iomuxc { pinctrl_emdio: emdiogrp { fsl,pins = < - IMX95_PAD_ENET2_MDC__NETCMIX_TOP_NETC_MDC 0x57e - IMX95_PAD_ENET2_MDIO__NETCMIX_TOP_NETC_MDIO 0x97e + IMX95_PAD_ENET2_MDC__NETCMIX_TOP_NETC_MDC 0x50e + IMX95_PAD_ENET2_MDIO__NETCMIX_TOP_NETC_MDIO 0x90e >; }; pinctrl_enetc0: enetc0grp { fsl,pins = < - IMX95_PAD_ENET1_TD3__NETCMIX_TOP_ETH0_RGMII_TD3 0x57e - IMX95_PAD_ENET1_TD2__NETCMIX_TOP_ETH0_RGMII_TD2 0x57e - IMX95_PAD_ENET1_TD1__NETCMIX_TOP_ETH0_RGMII_TD1 0x57e - IMX95_PAD_ENET1_TD0__NETCMIX_TOP_ETH0_RGMII_TD0 0x57e + IMX95_PAD_ENET1_TD3__NETCMIX_TOP_ETH0_RGMII_TD3 0x50e + IMX95_PAD_ENET1_TD2__NETCMIX_TOP_ETH0_RGMII_TD2 0x50e + IMX95_PAD_ENET1_TD1__NETCMIX_TOP_ETH0_RGMII_TD1 0x50e + IMX95_PAD_ENET1_TD0__NETCMIX_TOP_ETH0_RGMII_TD0 0x50e IMX95_PAD_ENET1_TX_CTL__NETCMIX_TOP_ETH0_RGMII_TX_CTL 0x57e IMX95_PAD_ENET1_TXC__NETCMIX_TOP_ETH0_RGMII_TX_CLK 0x58e IMX95_PAD_ENET1_RX_CTL__NETCMIX_TOP_ETH0_RGMII_RX_CTL 0x57e
@@ -582,10 +582,10 @@ pinctrl_enetc1: enetc1grp { fsl,pins = < - IMX95_PAD_ENET2_TD3__NETCMIX_TOP_ETH1_RGMII_TD3 0x57e - IMX95_PAD_ENET2_TD2__NETCMIX_TOP_ETH1_RGMII_TD2 0x57e - IMX95_PAD_ENET2_TD1__NETCMIX_TOP_ETH1_RGMII_TD1 0x57e - IMX95_PAD_ENET2_TD0__NETCMIX_TOP_ETH1_RGMII_TD0 0x57e + IMX95_PAD_ENET2_TD3__NETCMIX_TOP_ETH1_RGMII_TD3 0x50e + IMX95_PAD_ENET2_TD2__NETCMIX_TOP_ETH1_RGMII_TD2 0x50e + IMX95_PAD_ENET2_TD1__NETCMIX_TOP_ETH1_RGMII_TD1 0x50e + IMX95_PAD_ENET2_TD0__NETCMIX_TOP_ETH1_RGMII_TD0 0x50e IMX95_PAD_ENET2_TX_CTL__NETCMIX_TOP_ETH1_RGMII_TX_CTL 0x57e IMX95_PAD_ENET2_TXC__NETCMIX_TOP_ETH1_RGMII_TX_CLK 0x58e IMX95_PAD_ENET2_RX_CTL__NETCMIX_TOP_ETH1_RGMII_RX_CTL 0x57e
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/187 arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Zhu <[email protected]>
[ Upstream commit 61f1065272ea3721c20c4c0a6877d346b0e237c3 ]
Correct the DMA interrupter number of pcie0_ep from 317 to 311.
--- arch/arm64/boot/dts/freescale/imx95.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx95.dtsi +1 -1
@@ -1678,7 +1678,7 @@ <0x9 0 1 0>; reg-names = "dbi","atu", "dbi2", "app", "dma", "addr_space"; num-lanes = <1>; - interrupts = <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 311 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "dma"; clocks = <&scmi_clk IMX95_CLK_HSIO>, <&scmi_clk IMX95_CLK_HSIOPLL>,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/187 bpf: Reject %p% format string in bprintf-like helpers
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <[email protected]>
[ Upstream commit f8242745871f81a3ac37f9f51853d12854fd0b58 ]
static const char fmt[] = "%p%";
bpf_trace_printk(fmt, sizeof(fmt));The above BPF program isn't rejected and causes a kernel warning at runtime:
Please remove unsupported %\x00 in format string
WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0
This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected.
--- kernel/bpf/helpers.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
kernel/bpf/helpers.c +8 -3
@@ -883,6 +883,13 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,if (fmt[i] =='p' ) { sizeof_cur_arg =sizeof (long ); +if (fmt[i +1 ] ==0 ||isspace (fmt[i +1 ]) || +ispunct (fmt[i +1 ])) { +if (tmp_buf) + cur_arg = raw_args[num_spec]; + goto nocopy_fmt; + } +if ((fmt[i +1 ] =='k' || fmt[i +1 ] =='u' ) && fmt[i +2 ] =='s' ) { fmt_ptype = fmt[i +1 ];
@@ -890,11 +897,9 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args, goto fmt_str; } -if (fmt[i +1 ] ==0 ||isspace (fmt[i +1 ]) || -ispunct (fmt[i +1 ]) || fmt[i +1 ] =='K' || +if (fmt[i +1 ] =='K' || fmt[i +1 ] =='x' || fmt[i +1 ] =='s' || fmt[i +1 ] =='S' ) { -/* just kernel pointers */ if (tmp_buf) cur_arg = raw_args[num_spec]; i++;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/187 selftests/sched_ext: Fix exit selftest hang on UP
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <[email protected]>
[ Upstream commit 7980ad7e4ca80f6c255f4473fba82a475342035a ]
On single-CPU systems, ops.select_cpu() is never called, causing the EXIT_SELECT_CPU test case to wait indefinitely.
Avoid the stall by skipping this specific sub-test when only one CPU is available.
--- tools/testing/selftests/sched_ext/exit.c | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/testing/selftests/sched_ext/exit.c +8 -0
@@ -22,6 +22,14 @@ static enum scx_test_status run(void *ctx)struct bpf_link *link;char buf[16 ]; +/* +* On single-CPU systems, ops.select_cpu() is never +* invoked, so skip this test to avoid getting stuck +* indefinitely. +*/ +if (tc ==EXIT_SELECT_CPU &&libbpf_num_possible_cpus () ==1 ) +continue ; + skel =exit__open ();SCX_ENUM_INIT (skel); skel->rodata->exit_point = tc;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/187 wifi: iwlwifi: mask reserved bits in chan_state_active_bitmap
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pagadala Yesu Anjaneyulu <[email protected]>
[ Upstream commit 5fde0fcbd7608dd5f97a5c0c23a316074d6f17f5 ]
Mask the reserved bits as firmware will assert if reserved bits are set.
--- drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h | 5 +++-- drivers/net/wireless/intel/iwlwifi/fw/regulatory.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/regulatory.c | 4 +++- 3 files changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h +3 -2
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ /* -* Copyright (C) 2012-2014, 2018-2024 Intel Corporation +* Copyright (C) 2012-2014, 2018-2025 Intel Corporation * Copyright (C) 2013-2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */
@@ -754,7 +754,7 @@ struct iwl_lari_config_change_cmd_v10 {* according to the BIOS definitions. * For LARI cmd version 11 - bits 0:4 are supported. * For LARI cmd version 12 - bits 0:6 are supported and bits 7:31 are -* reserved. No need to mask out the reserved bits. +* reserved. * @force_disable_channels_bitmap: Bitmap of disabled bands/channels. * Each bit represents a set of channels in a specific band that should be * disabled
@@ -787,6 +787,7 @@ struct iwl_lari_config_change_cmd {/* Activate UNII-1 (5.2GHz) for World Wide */ #define ACTIVATE_5G2_IN_WW_MASK BIT(4)#define CHAN_STATE_ACTIVE_BITMAP_CMD_V11 0x1F +#define CHAN_STATE_ACTIVE_BITMAP_CMD_V12 0x7F/** * struct iwl_pnvm_init_complete_ntfy - PNVM initialization complete
drivers/net/wireless/intel/iwlwifi/fw/regulatory.c +1 -0
@@ -603,6 +603,7 @@ int iwl_fill_lari_config(struct iwl_fw_runtime *fwrt, ret =iwl_bios_get_dsm (fwrt,DSM_FUNC_ACTIVATE_CHANNEL , &value);if (!ret) { + value &=CHAN_STATE_ACTIVE_BITMAP_CMD_V12 ;if (cmd_ver <8 ) value &= ~ACTIVATE_5G2_IN_WW_MASK ;
drivers/net/wireless/intel/iwlwifi/mld/regulatory.c +3 -1
@@ -251,8 +251,10 @@ void iwl_mld_configure_lari(struct iwl_mld *mld)cpu_to_le32 (value &=DSM_UNII4_ALLOW_BITMAP ); ret =iwl_bios_get_dsm (fwrt,DSM_FUNC_ACTIVATE_CHANNEL , &value); -if (!ret) +if (!ret) { + value &=CHAN_STATE_ACTIVE_BITMAP_CMD_V12 ; cmd.chan_state_active_bitmap =cpu_to_le32 (value); + } ret =iwl_bios_get_dsm (fwrt,DSM_FUNC_ENABLE_6E , &value);if (!ret)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/187 cachefiles: Fix the incorrect return value in __cachefiles_write()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zizhi Wo <[email protected]>
[ Upstream commit 6b89819b06d8d339da414f06ef3242f79508be5e ]
In __cachefiles_write(), if the return value of the write operation > 0, it is set to 0. This makes it impossible to distinguish scenarios where a partial write has occurred, and will affect the outer calling functions:
1) cachefiles_write_complete() will call "term_func" such asnetfs_write_subrequest_terminated(). When "ret" in __cachefiles_write() is used as the "transferred_or_error" of this function, it can not distinguish the amount of data written, makes the WARN meaningless.
2) cachefiles_ondemand_fd_write_iter() can only assume all writes were
successful by default when "ret" is 0, and unconditionally return the full length specified by user space.
Fix it by modifying "ret" to reflect the actual number of bytes written. Furthermore, returning a value greater than 0 from __cachefiles_write() does not affect other call paths, such as cachefiles_issue_write() and fscache_write().
--- fs/cachefiles/io.c | 2 -- fs/cachefiles/ondemand.c | 4 +--- 2 files changed, 1 insertion(+), 5 deletions(-)
fs/cachefiles/io.c +0 -2
@@ -347,8 +347,6 @@ int __cachefiles_write(struct cachefiles_object *object,default : ki->was_async = false;cachefiles_write_complete (&ki->iocb, ret); -if (ret >0 ) - ret =0 ;break ; }
fs/cachefiles/ondemand.c +1 -3
@@ -83,10 +83,8 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb,trace_cachefiles_ondemand_fd_write (object,file_inode (file), pos, len); ret =__cachefiles_write (object, file, pos, iter,NULL ,NULL ); -if (!ret) { - ret = len; +if (ret >0 ) kiocb->ki_pos += ret; - } out:fput (file);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/187 ALSA: compress_offload: tighten ioctl command number checks
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 19c4096ccdd809c6213e2e62b0d4f57c880138cd ]
The snd_compr_ioctl() ignores the upper 24 bits of the ioctl command number and only compares the number of the ioctl command, which can cause unintended behavior if an application tries to use an unsupprted command that happens to have the same _IOC_NR() value.
Remove the truncation to the low bits and compare the entire ioctl command code like every other driver does.
--- sound/core/compress_offload.c | 48 +++++++++++++++++------------------ 1 file changed, 24 insertions(+), 24 deletions(-)
sound/core/compress_offload.c +24 -24
@@ -1269,62 +1269,62 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg) stream = &data->stream;guard (mutex)(&stream->device->lock); -switch (_IOC_NR (cmd)) { -case _IOC_NR (SNDRV_COMPRESS_IOCTL_VERSION ): +switch (cmd) { +case SNDRV_COMPRESS_IOCTL_VERSION :return put_user (SNDRV_COMPRESS_VERSION , (int __user *)arg) ? -EFAULT :0 ; -case _IOC_NR (SNDRV_COMPRESS_GET_CAPS ): +case SNDRV_COMPRESS_GET_CAPS :return snd_compr_get_caps (stream, arg);#ifndef COMPR_CODEC_CAPS_OVERFLOW -case _IOC_NR (SNDRV_COMPRESS_GET_CODEC_CAPS ): +case SNDRV_COMPRESS_GET_CODEC_CAPS :return snd_compr_get_codec_caps (stream, arg);#endif -case _IOC_NR (SNDRV_COMPRESS_SET_PARAMS ): +case SNDRV_COMPRESS_SET_PARAMS :return snd_compr_set_params (stream, arg); -case _IOC_NR (SNDRV_COMPRESS_GET_PARAMS ): +case SNDRV_COMPRESS_GET_PARAMS :return snd_compr_get_params (stream, arg); -case _IOC_NR (SNDRV_COMPRESS_SET_METADATA ): +case SNDRV_COMPRESS_SET_METADATA :return snd_compr_set_metadata (stream, arg); -case _IOC_NR (SNDRV_COMPRESS_GET_METADATA ): +case SNDRV_COMPRESS_GET_METADATA :return snd_compr_get_metadata (stream, arg); }if (stream->direction ==SND_COMPRESS_ACCEL ) {#if IS_ENABLED (CONFIG_SND_COMPRESS_ACCEL ) -switch (_IOC_NR (cmd)) { -case _IOC_NR (SNDRV_COMPRESS_TASK_CREATE ): +switch (cmd) { +case SNDRV_COMPRESS_TASK_CREATE :return snd_compr_task_create (stream, arg); -case _IOC_NR (SNDRV_COMPRESS_TASK_FREE ): +case SNDRV_COMPRESS_TASK_FREE :return snd_compr_task_seq (stream, arg, snd_compr_task_free_one); -case _IOC_NR (SNDRV_COMPRESS_TASK_START ): +case SNDRV_COMPRESS_TASK_START :return snd_compr_task_start_ioctl (stream, arg); -case _IOC_NR (SNDRV_COMPRESS_TASK_STOP ): +case SNDRV_COMPRESS_TASK_STOP :return snd_compr_task_seq (stream, arg, snd_compr_task_stop_one); -case _IOC_NR (SNDRV_COMPRESS_TASK_STATUS ): +case SNDRV_COMPRESS_TASK_STATUS :return snd_compr_task_status_ioctl (stream, arg); }#endif return -ENOTTY ; } -switch (_IOC_NR (cmd)) { -case _IOC_NR (SNDRV_COMPRESS_TSTAMP ): +switch (cmd) { +case SNDRV_COMPRESS_TSTAMP :return snd_compr_tstamp (stream, arg); -case _IOC_NR (SNDRV_COMPRESS_AVAIL ): +case SNDRV_COMPRESS_AVAIL :return snd_compr_ioctl_avail (stream, arg); -case _IOC_NR (SNDRV_COMPRESS_PAUSE ): +case SNDRV_COMPRESS_PAUSE :return snd_compr_pause (stream); -case _IOC_NR (SNDRV_COMPRESS_RESUME ): +case SNDRV_COMPRESS_RESUME :return snd_compr_resume (stream); -case _IOC_NR (SNDRV_COMPRESS_START ): +case SNDRV_COMPRESS_START :return snd_compr_start (stream); -case _IOC_NR (SNDRV_COMPRESS_STOP ): +case SNDRV_COMPRESS_STOP :return snd_compr_stop (stream); -case _IOC_NR (SNDRV_COMPRESS_DRAIN ): +case SNDRV_COMPRESS_DRAIN :return snd_compr_drain (stream); -case _IOC_NR (SNDRV_COMPRESS_PARTIAL_DRAIN ): +case SNDRV_COMPRESS_PARTIAL_DRAIN :return snd_compr_partial_drain (stream); -case _IOC_NR (SNDRV_COMPRESS_NEXT_TRACK ): +case SNDRV_COMPRESS_NEXT_TRACK :return snd_compr_next_track (stream); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/187 net: emaclite: Fix missing pointer increment in aligned_read()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 7727ec1523d7973defa1dff8f9c0aad288d04008 ]
Add missing post-increment operators for byte pointers in the loop that copies remaining bytes in xemaclite_aligned_read(). Without the increment, the same byte was written repeatedly to the destination.
This update aligns with xemaclite_aligned_write()
--- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/xilinx/xilinx_emaclite.c +1 -1
@@ -286,7 +286,7 @@ static void xemaclite_aligned_read(u32 *src_ptr, u8 *dest_ptr,/* Read the remaining data */ for (; length >0 ; length--) - *to_u8_ptr = *from_u8_ptr; + *to_u8_ptr++ = *from_u8_ptr++; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/187 block: fix kobject leak in blk_unregister_queue
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit 3051247e4faa32a3d90c762a243c2c62dde310db ]
The kobject for the queue, disk->queue_kobj, is initialized with a reference count of 1 via kobject_init() in blk_register_queue(). While kobject_del() is called during the unregister path to remove the kobject from sysfs, the initial reference is never released.
Add a call to kobject_put() in blk_unregister_queue() to properly decrement the reference count and fix the leak.
--- block/blk-sysfs.c | 1 + 1 file changed, 1 insertion(+)
block/blk-sysfs.c +1 -0
@@ -964,4 +964,5 @@ void blk_unregister_queue(struct gendisk *disk)kobject_del (&disk->queue_kobj);blk_debugfs_remove (disk); +kobject_put (&disk->queue_kobj); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/187 net/sched: sch_qfq: Fix race condition on qfq_aggregate
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 5e28d5a3f774f118896aec17a3a20a9c5c9dfc64 ]
A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free.
This patch addresses the issue by:
1. Moved qfq_destroy_class into the critical section.
2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.
--- net/sched/sch_qfq.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-)
net/sched/sch_qfq.c +21 -9
@@ -412,7 +412,7 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,bool existing = false;struct nlattr *tb[TCA_QFQ_MAX +1 ];struct qfq_aggregate *new_agg =NULL ; -u32 weight, lmax, inv_w; +u32 weight, lmax, inv_w, old_weight, old_lmax;int err;int delta_w;
@@ -443,12 +443,16 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, inv_w =ONE_FP / weight; weight =ONE_FP / inv_w; -if (cl !=NULL && - lmax == cl->agg->lmax && - weight == cl->agg->class_weight) -return 0 ;/* nothing to change */ +if (cl !=NULL ) { +sch_tree_lock (sch); + old_weight = cl->agg->class_weight; + old_lmax = cl->agg->lmax; +sch_tree_unlock (sch); +if (lmax == old_lmax && weight == old_weight) +return 0 ;/* nothing to change */ + } - delta_w = weight - (cl ? cl->agg->class_weight :0 ); + delta_w = weight - (cl ? old_weight :0 );if (q->wsum + delta_w >QFQ_MAX_WSUM ) { NL_SET_ERR_MSG_FMT_MOD(extack,
@@ -555,10 +559,10 @@ static int qfq_delete_class(struct Qdisc *sch, unsigned long arg,qdisc_purge_queue (cl->qdisc);qdisc_class_hash_remove (&q->clhash, &cl->common); +qfq_destroy_class (sch, cl);sch_tree_unlock (sch); -qfq_destroy_class (sch, cl);return 0 ; }
@@ -625,6 +629,7 @@ static int qfq_dump_class(struct Qdisc *sch, unsigned long arg, {struct qfq_class *cl = (struct qfq_class *)arg;struct nlattr *nest; +u32 class_weight, lmax; tcm->tcm_parent =TC_H_ROOT ; tcm->tcm_handle = cl->common.classid;
@@ -633,8 +638,13 @@ static int qfq_dump_class(struct Qdisc *sch, unsigned long arg, nest =nla_nest_start_noflag (skb,TCA_OPTIONS );if (nest ==NULL ) goto nla_put_failure; -if (nla_put_u32 (skb,TCA_QFQ_WEIGHT , cl->agg->class_weight) || -nla_put_u32 (skb,TCA_QFQ_LMAX , cl->agg->lmax)) + +sch_tree_lock (sch); + class_weight = cl->agg->class_weight; + lmax = cl->agg->lmax; +sch_tree_unlock (sch); +if (nla_put_u32 (skb,TCA_QFQ_WEIGHT , class_weight) || +nla_put_u32 (skb,TCA_QFQ_LMAX , lmax)) goto nla_put_failure;return nla_nest_end (skb, nest);
@@ -651,8 +661,10 @@ static int qfq_dump_class_stats(struct Qdisc *sch, unsigned long arg,memset (&xstats,0 ,sizeof (xstats)); +sch_tree_lock (sch); xstats.weight = cl->agg->class_weight; xstats.lmax = cl->agg->lmax; +sch_tree_unlock (sch); if (gnet_stats_copy_basic(d, NULL, &cl->bstats, true) < 0 || gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/187 rpl: Fix use-after-free in rpl_do_srh_inline().
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit b640daa2822a39ff76e70200cb2b7b892b896dce ]
Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0].
rpl_do_srh_inline() fetches ipv6_hdr(skb) and accesses it after skb_cow_head(), which is illegal as the header could be freed then.
Let's fix it by making oldhdr to a local struct instead of a pointer.
[0]:
[root@fedora net]# ./lwt_dst_cache_ref_loop.sh
...
TEST: rpl (input)
[ 57.631529] ================================================================== BUG: KASAN: slab-use-after-free in rpl_do_srh_inline.isra.0 (net/ipv6/rpl_iptunnel.c:174) Read of size 40 at addr ffff888122bf96d8 by task ping6/1543 CPU: 50 UID: 0 PID: 1543 Comm: ping6 Not tainted 6.16.0-rc5-01302-gfadd1e6231b1 #23 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:409 mm/kasan/report.c:521) kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) kasan_check_range (mm/kasan/generic.c:175 (discriminator 1) mm/kasan/generic.c:189 (discriminator 1)) __asan_memmove (mm/kasan/shadow.c:94 (discriminator 2)) rpl_do_srh_inline.isra.0 (net/ipv6/rpl_iptunnel.c:174) rpl_input (net/ipv6/rpl_iptunnel.c:201 net/ipv6/rpl_iptunnel.c:282) lwtunnel_input (net/core/lwtunnel.c:459) ipv6_rcv (./include/net/dst.h:471 (discriminator 1) ./include/net/dst.h:469 (discriminator 1) net/ipv6/ip6_input.c:79 (discriminator 1) ./include/linux/netfilter.h:317 (discriminator 1) ./include/linux/netfilter.h:311 (discriminator 1) net/ipv6/ip6_input.c:311 (discriminator 1)) __netif_receive_skb_one_core (net/core/dev.c:5967) process_backlog (./include/linux/rcupdate.h:869 net/core/dev.c:6440) __napi_poll.constprop.0 (net/core/dev.c:7452) net_rx_action (net/core/dev.c:7518 net/core/dev.c:7643) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480 (discriminator 20)) </IRQ> <TASK> __local_bh_enable_ip (kernel/softirq.c:407) __dev_queue_xmit (net/core/dev.c:4740) ip6_finish_output2 (./include/linux/netdevice.h:3358 ./include/net/neighbour.h:526 ./include/net/neighbour.h:540 net/ipv6/ip6_output.c:141) ip6_finish_output (net/ipv6/ip6_output.c:215 net/ipv6/ip6_output.c:226) ip6_output (./include/linux/netfilter.h:306 net/ipv6/ip6_output.c:248) ip6_send_skb (net/ipv6/ip6_output.c:1983) rawv6_sendmsg (net/ipv6/raw.c:588 net/ipv6/raw.c:918) __sys_sendto (net/socket.c:714 (discriminator 1) net/socket.c:729 (discriminator 1) net/socket.c:2228 (discriminator 1)) __x64_sys_sendto (net/socket.c:2231) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f68cffb2a06 Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 RSP: 002b:00007ffefb7c53d0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000564cd69f10a0 RCX: 00007f68cffb2a06 RDX: 0000000000000040 RSI: 0000564cd69f10a4 RDI: 0000000000000003 RBP: 00007ffefb7c53f0 R08: 0000564cd6a032ac R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000202 R12: 0000564cd69f10a4 R13: 0000000000000040 R14: 00007ffefb7c66e0 R15: 0000564cd69f10a0 </TASK> Allocated by task 1543: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1)) __kasan_slab_alloc (mm/kasan/common.c:319 mm/kasan/common.c:345) kmem_cache_alloc_node_noprof (./include/linux/kasan.h:250 mm/slub.c:4148 mm/slub.c:4197 mm/slub.c:4249) kmalloc_reserve (net/core/skbuff.c:581 (discriminator 88)) __alloc_skb (net/core/skbuff.c:669) __ip6_append_data (net/ipv6/ip6_output.c:1672 (discriminator 1)) ip6_append_data (net/ipv6/ip6_output.c:1859) rawv6_sendmsg (net/ipv6/raw.c:911) __sys_sendto (net/socket.c:714 (discriminator 1) net/socket.c:729 (discriminator 1) net/socket.c:2228 (discriminator 1)) __x64_sys_sendto (net/socket.c:2231) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Freed by task 1543: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1)) kasan_save_free_info (mm/kasan/generic.c:579 (discriminator 1)) __kasan_slab_free (mm/kasan/common.c:271) kmem_cache_free (mm/slub.c:4643 (discriminator 3) mm/slub.c:4745 (discriminator 3)) pskb_expand_head (net/core/skbuff.c:2274) rpl_do_srh_inline.isra.0 (net/ipv6/rpl_iptunnel.c:158 (discriminator 1)) rpl_input (net/ipv6/rpl_iptunnel.c:201 net/ipv6/rpl_iptunnel.c:282) lwtunnel_input (net/core/lwtunnel.c:459) ipv6_rcv (./include/net/dst.h:471 (discriminator 1) ./include/net/dst.h:469 (discriminator 1) net/ipv6/ip6_input.c:79 (discriminator 1) ./include/linux/netfilter.h:317 (discriminator 1) ./include/linux/netfilter.h:311 (discriminator 1) net/ipv6/ip6_input.c:311 (discriminator 1)) __netif_receive_skb_one_core (net/core/dev.c:5967) process_backlog (./include/linux/rcupdate.h:869 net/core/dev.c:6440) __napi_poll.constprop.0 (net/core/dev.c:7452) net_rx_action (net/core/dev.c:7518 net/core/dev.c:7643) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480 (discriminator 20)) __local_bh_enable_ip (kernel/softirq.c:407) __dev_queue_xmit (net/core/dev.c:4740) ip6_finish_output2 (./include/linux/netdevice.h:3358 ./include/net/neighbour.h:526 ./include/net/neighbour.h:540 net/ipv6/ip6_output.c:141) ip6_finish_output (net/ipv6/ip6_output.c:215 net/ipv6/ip6_output.c:226) ip6_output (./include/linux/netfilter.h:306 net/ipv6/ip6_output.c:248) ip6_send_skb (net/ipv6/ip6_output.c:1983) rawv6_sendmsg (net/ipv6/raw.c:588 net/ipv6/raw.c:918) __sys_sendto (net/socket.c:714 (discriminator 1) net/socket.c:729 (discriminator 1) net/socket.c:2228 (discriminator 1)) __x64_sys_sendto (net/socket.c:2231) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) The buggy address belongs to the object at ffff888122bf96c0 which belongs to the cache skbuff_small_head of size 704
The buggy address is located 24 bytes inside of
freed 704-byte region [ffff888122bf96c0, ffff888122bf9980)
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122bf8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000040 ffff888101fc0a00 ffffea000464dc00 0000000000000002 raw: 0000000000000000 0000000080270027 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888101fc0a00 ffffea000464dc00 0000000000000002
head: 0000000000000000 0000000080270027 00000000f5000000 0000000000000000
head: 0200000000000003 ffffea00048afe01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888122bf9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888122bf9600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888122bf9680: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff888122bf9700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888122bf9780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- net/ipv6/rpl_iptunnel.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/ipv6/rpl_iptunnel.c +4 -4
@@ -129,13 +129,13 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt, struct dst_entry *cache_dst) {struct ipv6_rpl_sr_hdr *isrh, *csrh; -const struct ipv6hdr *oldhdr; +struct ipv6hdr oldhdr;struct ipv6hdr *hdr;unsigned char *buf;size_t hdrlen;int err; - oldhdr =ipv6_hdr (skb); +memcpy (&oldhdr,ipv6_hdr (skb),sizeof (oldhdr)); buf =kcalloc (struct_size (srh, segments.addr, srh->segments_left),2 ,GFP_ATOMIC );if (!buf)
@@ -147,7 +147,7 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt,memcpy (isrh, srh,sizeof (*isrh));memcpy (isrh->rpl_segaddr, &srh->rpl_segaddr[1 ], (srh->segments_left -1 ) *16 ); - isrh->rpl_segaddr[srh->segments_left -1 ] = oldhdr->daddr; + isrh->rpl_segaddr[srh->segments_left -1 ] = oldhdr.daddr;ipv6_rpl_srh_compress (csrh, isrh, &srh->rpl_segaddr[0 ], isrh->segments_left -1 );
@@ -169,7 +169,7 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt,skb_mac_header_rebuild (skb); hdr =ipv6_hdr (skb); -memmove (hdr, oldhdr,sizeof (*hdr)); +memmove (hdr, &oldhdr,sizeof (*hdr)); isrh = (void *)hdr +sizeof (*hdr);memcpy (isrh, csrh, hdrlen);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/187 smb: client: fix use-after-free in cifs_oplock_break
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Zhaolong <[email protected]>
[ Upstream commit 705c79101ccf9edea5a00d761491a03ced314210 ]
A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting:
cifs_oplock_break()
_cifsFileInfo_put(cfile)
cifsFileInfo_put_final()
cifs_sb_deactive()
[last ref, start releasing sb]
kill_sb()
kill_anon_super()
generic_shutdown_super()
evict_inodes()
dispose_list()
evict()
destroy_inode()
call_rcu(&inode->i_rcu, i_callback)
spin_lock(&cinode->open_file_lock) <- OK
[later] i_callback()
cifs_free_inode()
kmem_cache_free(cinode)
spin_unlock(&cinode->open_file_lock) <- UAF
cifs_done_oplock_break(cinode) <- UAFThe issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free.
Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes.
--- fs/smb/client/file.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/smb/client/file.c +9 -1
@@ -3084,7 +3084,8 @@ void cifs_oplock_break(struct work_struct *work) struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo, oplock_break);struct inode *inode =d_inode (cfile->dentry); -struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb); +struct super_block *sb = inode->i_sb; +struct cifs_sb_info *cifs_sb =CIFS_SB (sb);struct cifsInodeInfo *cinode =CIFS_I (inode);struct cifs_tcon *tcon;struct TCP_Server_Info *server;
@@ -3094,6 +3095,12 @@ void cifs_oplock_break(struct work_struct *work)__u64 persistent_fid, volatile_fid;__u16 net_fid; +/* +* Hold a reference to the superblock to prevent it and its inodes from +* being freed while we are accessing cinode. Otherwise, _cifsFileInfo_put() +* may release the last reference to the sb and trigger inode eviction. +*/ +cifs_sb_active (sb);wait_on_bit (&cinode->flags,CIFS_INODE_PENDING_WRITERS ,TASK_UNINTERRUPTIBLE );
@@ -3166,6 +3173,7 @@ void cifs_oplock_break(struct work_struct *work)cifs_put_tlink (tlink); out:cifs_done_oplock_break (cinode); +cifs_sb_deactive (sb); } static int cifs_swap_activate(struct swap_info_struct *sis,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/187 fix a leak in fcntl_dirnotify()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit fdfe0133473a528e3f5da69c35419ce6711d6b89 ]
[into #fixes, unless somebody objects]
Lifetime of new_dn_mark is controlled by that of its ->fsn_mark, pointed to by new_fsn_mark. Unfortunately, a failure exit had been inserted between the allocation of new_dn_mark and the call of fsnotify_init_mark(), ending up with a leak.
--- fs/notify/dnotify/dnotify.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/notify/dnotify/dnotify.c +4 -4
@@ -308,6 +308,10 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned int arg) goto out_err; } + error =file_f_owner_allocate (filp); +if (error) + goto out_err; +/* new fsnotify mark, we expect most fcntl calls to add a new mark */ new_dn_mark =kmem_cache_alloc (dnotify_mark_cache,GFP_KERNEL );if (!new_dn_mark) {
@@ -315,10 +319,6 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned int arg) goto out_err; } - error =file_f_owner_allocate (filp); -if (error) - goto out_err; -/* set up the new_fsn_mark and new_dn_mark */ new_fsn_mark = &new_dn_mark->fsn_mark;fsnotify_init_mark (new_fsn_mark, dnotify_group);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/187 nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 80d7762e0a42307ee31b21f090e21349b98c14f6 ]
When inserting a namespace into the controller's namespace list, the function uses list_add_rcu() when the namespace is inserted in the middle of the list, but falls back to a regular list_add() when adding at the head of the list.
This inconsistency could lead to race conditions during concurrent access, as users might observe a partially updated list. Fix this by consistently using list_add_rcu() in both code paths to ensure proper RCU protection throughout the entire function.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -3889,7 +3889,7 @@ static void nvme_ns_add_to_ctrl_list(struct nvme_ns *ns)return ; } } -list_add (&ns->list, &ns->ctrl->namespaces); +list_add_rcu (&ns->list, &ns->ctrl->namespaces); }static void nvme_alloc_ns (struct nvme_ctrl *ctrl,struct nvme_ns_info *info)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/187 nvme: fix endianness of command word prints in nvme_log_err_passthru()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit dd8e34afd6709cb2f9c0e63340f567e6c066ed8e ]
The command word members of struct nvme_common_command are __le32 type, so use helper le32_to_cpu() to read them properly.
--- drivers/nvme/host/core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/nvme/host/core.c +6 -6
@@ -377,12 +377,12 @@ static void nvme_log_err_passthru(struct request *req) nr->status &NVME_SC_MASK ,/* Status Code */ nr->status &NVME_STATUS_MORE ?"MORE " :"" , nr->status &NVME_STATUS_DNR ?"DNR " :"" , - nr->cmd->common.cdw10, - nr->cmd->common.cdw11, - nr->cmd->common.cdw12, - nr->cmd->common.cdw13, - nr->cmd->common.cdw14, - nr->cmd->common.cdw15); +le32_to_cpu (nr->cmd->common.cdw10), +le32_to_cpu (nr->cmd->common.cdw11), +le32_to_cpu (nr->cmd->common.cdw12), +le32_to_cpu (nr->cmd->common.cdw13), +le32_to_cpu (nr->cmd->common.cdw14), + le32_to_cpu(nr->cmd->common.cdw15)); }enum nvme_disposition {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/187 smc: Fix various oops due to inet_sock type confusion.
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 60ada4fe644edaa6c2da97364184b0425e8aeaf5 ]
syzbot reported weird splats [0][1] in cipso_v4_sock_setattr() while freeing inet_sk(sk)->inet_opt.
The address was freed multiple times even though it was read-only memory.
cipso_v4_sock_setattr() did nothing wrong, and the root cause was type confusion.
The cited commit made it possible to create smc_sock as an INET socket.
The issue is that struct smc_sock does not have struct inet_sock as the first member but hijacks AF_INET and AF_INET6 sk_family, which confuses various places.
In this case, inet_sock.inet_opt was actually smc_sock.clcsk_data_ready(), which is an address of a function in the text segment.
$ pahole -C inet_sock vmlinux
struct inet_sock {
...
struct ip_options_rcu * inet_opt; /* 784 8 */ $ pahole -C smc_sock vmlinux
struct smc_sock {
...
void (*clcsk_data_ready)(struct sock *); /* 784 8 */The same issue for another field was reported before. [2][3]
At that time, an ugly hack was suggested [4], but it makes both INET and SMC code error-prone and hard to change.
Also, yet another variant was fixed by a hacky commit 98d4435efcbf3 ("net/smc: prevent NULL pointer dereference in txopt_get").
Instead of papering over the root cause by such hacks, we should not allow non-INET socket to reuse the INET infra.
Let's add inet_sock as the first member of smc_sock.
[0]:kvfree_call_rcu(): Double-freed call. rcu_head 000000006921da73
WARNING: CPU: 0 PID: 6718 at mm/slab_common.c:1956 kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 Modules linked in: CPU: 0 UID: 0 PID: 6718 Comm: syz.0.17 Tainted: G W 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 lr : kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955
sp : ffff8000a03a7730
x29: ffff8000a03a7730 x28: 00000000fffffff5 x27: 1fffe000184823d3
x26: dfff800000000000 x25: ffff0000c2411e9e x24: ffff0000dd88da00
x23: ffff8000891ac9a0 x22: 00000000ffffffea x21: ffff8000891ac9a0
x20: ffff8000891ac9a0 x19: ffff80008afc2480 x18: 00000000ffffffff
x17: 0000000000000000 x16: ffff80008ae642c8 x15: ffff700011ede14c
x14: 1ffff00011ede14c x13: 0000000000000004 x12: ffffffffffffffff
x11: ffff700011ede14c x10: 0000000000ff0100 x9 : 5fa3c1ffaf0ff000 x8 : 5fa3c1ffaf0ff000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000a03a7078 x4 : ffff80008f766c20 x3 : ffff80008054d360 x2 : 0000000000000000 x1 : 0000000000000201 x0 : 0000000000000000
Call trace: kvfree_call_rcu+0x94/0x3f0 mm/slab_common.c:1955 (P) cipso_v4_sock_setattr+0x2f0/0x3f4 net/ipv4/cipso_ipv4.c:1914 netlbl_sock_setattr+0x240/0x334 net/netlabel/netlabel_kapi.c:1000 smack_netlbl_add+0xa8/0x158 security/smack/smack_lsm.c:2581 smack_inode_setsecurity+0x378/0x430 security/smack/smack_lsm.c:2912 security_inode_setsecurity+0x118/0x3c0 security/security.c:2706 __vfs_setxattr_noperm+0x174/0x5c4 fs/xattr.c:251 __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:295 vfs_setxattr+0x158/0x2ac fs/xattr.c:321 do_setxattr fs/xattr.c:636 [inline] file_setxattr+0x1b8/0x294 fs/xattr.c:646 path_setxattrat+0x2ac/0x320 fs/xattr.c:711 __do_sys_fsetxattr fs/xattr.c:761 [inline] __se_sys_fsetxattr fs/xattr.c:758 [inline] __arm64_sys_fsetxattr+0xc0/0xdc fs/xattr.c:758 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
[1]:
Unable to handle kernel write to read-only memory at virtual address ffff8000891ac9a8 KASAN: probably user-memory-access in range [0x0000000448d64d40-0x0000000448d64d47]
Mem abort info:
ESR = 0x000000009600004e
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x0e: level 2 permission fault
Data abort info:
ISV = 0, ISS = 0x0000004e, ISS2 = 0x00000000
CM = 0, WnR = 1, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000207144000
[ffff8000891ac9a8] pgd=0000000000000000, p4d=100000020f950003, pud=100000020f951003, pmd=0040000201000781
Internal error: Oops: 000000009600004e [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 6946 Comm: syz.0.69 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kvfree_call_rcu+0x31c/0x3f0 mm/slab_common.c:1971 lr : add_ptr_to_bulk_krc_lock mm/slab_common.c:1838 [inline] lr : kvfree_call_rcu+0xfc/0x3f0 mm/slab_common.c:1963
sp : ffff8000a28a7730
x29: ffff8000a28a7730 x28: 00000000fffffff5 x27: 1fffe00018b09bb3
x26: 0000000000000001 x25: ffff80008f66e000 x24: ffff00019beaf498
x23: ffff00019beaf4c0 x22: 0000000000000000 x21: ffff8000891ac9a0
x20: ffff8000891ac9a0 x19: 0000000000000000 x18: 00000000ffffffff
x17: ffff800093363000 x16: ffff80008052c6e4 x15: ffff700014514ecc
x14: 1ffff00014514ecc x13: 0000000000000004 x12: ffffffffffffffff
x11: ffff700014514ecc x10: 0000000000000001 x9 : 0000000000000001 x8 : ffff00019beaf7b4 x7 : ffff800080a94154 x6 : 0000000000000000 x5 : ffff8000935efa60 x4 : 0000000000000008 x3 : ffff80008052c7fc x2 : 0000000000000001 x1 : ffff8000891ac9a0 x0 : 0000000000000001
Call trace: kvfree_call_rcu+0x31c/0x3f0 mm/slab_common.c:1967 (P) cipso_v4_sock_setattr+0x2f0/0x3f4 net/ipv4/cipso_ipv4.c:1914 netlbl_sock_setattr+0x240/0x334 net/netlabel/netlabel_kapi.c:1000 smack_netlbl_add+0xa8/0x158 security/smack/smack_lsm.c:2581 smack_inode_setsecurity+0x378/0x430 security/smack/smack_lsm.c:2912 security_inode_setsecurity+0x118/0x3c0 security/security.c:2706 __vfs_setxattr_noperm+0x174/0x5c4 fs/xattr.c:251 __vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:295 vfs_setxattr+0x158/0x2ac fs/xattr.c:321 do_setxattr fs/xattr.c:636 [inline] file_setxattr+0x1b8/0x294 fs/xattr.c:646 path_setxattrat+0x2ac/0x320 fs/xattr.c:711 __do_sys_fsetxattr fs/xattr.c:761 [inline] __se_sys_fsetxattr fs/xattr.c:758 [inline] __arm64_sys_fsetxattr+0xc0/0xdc fs/xattr.c:758 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Code: aa1f03e2 52800023 97ee1e8d b4000195 (f90006b4)
--- net/smc/af_smc.c | 14 ++++++++++++++ net/smc/smc.h | 8 ++++---- 2 files changed, 18 insertions(+), 4 deletions(-)
net/smc/af_smc.c +14 -0
@@ -30,6 +30,10 @@#include <linux/splice.h> #include <net/sock.h> +#include <net/inet_common.h> +#if IS_ENABLED (CONFIG_IPV6 ) +#include <net/ipv6.h> +#endif #include <net/tcp.h> #include <net/smc.h> #include <asm/ioctls.h>
@@ -360,6 +364,16 @@ static void smc_destruct(struct sock *sk)return ;if (!sock_flag (sk,SOCK_DEAD ))return ; +switch (sk->sk_family) { +case AF_INET : +inet_sock_destruct (sk); +break ; +#if IS_ENABLED (CONFIG_IPV6 ) +case AF_INET6 : +inet6_sock_destruct (sk); +break ; +#endif + } }static struct lock_class_key smc_key;
net/smc/smc.h +4 -4
@@ -283,10 +283,10 @@ struct smc_connection { };struct smc_sock {/* smc sock container */ -struct sock sk; -#if IS_ENABLED (CONFIG_IPV6 ) -struct ipv6_pinfo *pinet6; -#endif +union { +struct sock sk; +struct inet_sock icsk_inet; + };struct socket *clcsock;/* internal tcp socket */ void (*clcsk_state_change)(struct sock *sk);/* original stat_change fct. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/187 net: phy: Dont register LEDs for genphy
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit f0f2b992d8185a0366be951685e08643aae17d6d ]
If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock:
rtnl_lock()ndo_close()
...
phy_detach()
phy_remove()
phy_leds_unregister()
led_classdev_unregister()
led_trigger_set()
netdev_trigger_deactivate()
unregister_netdevice_notifier()
rtnl_lock()There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic.
Generic PHYs do not support LEDs anyway, so don't bother registering them.
--- drivers/net/phy/phy_device.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/phy/phy_device.c +4 -2
@@ -3391,7 +3391,8 @@ static int phy_probe(struct device *dev)/* Get the LEDs from the device tree, and instantiate standard * LEDs for them. */ -if (IS_ENABLED (CONFIG_PHYLIB_LEDS )) +if (IS_ENABLED (CONFIG_PHYLIB_LEDS ) && !phy_driver_is_genphy (phydev) && + !phy_driver_is_genphy_10g (phydev)) err =of_phy_leds (phydev); out:
@@ -3408,7 +3409,8 @@ static int phy_remove(struct device *dev)cancel_delayed_work_sync (&phydev->state_queue); -if (IS_ENABLED (CONFIG_PHYLIB_LEDS )) +if (IS_ENABLED (CONFIG_PHYLIB_LEDS ) && !phy_driver_is_genphy (phydev) && + !phy_driver_is_genphy_10g (phydev))phy_leds_unregister (phydev); phydev->state =PHY_DOWN ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/187 nvme: revert the cross-controller atomic write size validation
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 1fc09f2961f5c6d8bb53bc989f17b12fdc6bc93d ]
This was originally added by commit 8695f060a029 ("nvme: all namespaces in a subsystem must adhere to a common atomic write size") to check the all controllers in a subsystem report the same atomic write size, but the check wasn't quite correct and caused problems for devices with multiple namespaces that report different LBA sizes. Commit f46d273449ba ("nvme: fix atomic write size validation") tried to fix this, but then caused problems for namespace rediscovery after a format with an LBA size change that changes the AWUPF value.
This drops the validation and essentially reverts those two commits while keeping the cleanup that went in between the two. We'll need to figure out how to properly check for the mouse trap that nvme left us, but for now revert the check to keep devices working for users who couldn't care less about the atomic write feature.
--- drivers/nvme/host/core.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/nvme/host/core.c +0 -9
@@ -3354,15 +3354,6 @@ static int nvme_init_identify(struct nvme_ctrl *ctrl)if (ret) goto out_free; } - -if (le16_to_cpu (id->awupf) != ctrl->subsys->awupf) { -dev_err_ratelimited (ctrl->device, -"inconsistent AWUPF, controller not added (%u/%u).\n" , -le16_to_cpu (id->awupf), ctrl->subsys->awupf); - ret = -EINVAL ; - goto out_free; - } -memcpy (ctrl->subsys->firmware_rev, id->fr,sizeof (ctrl->subsys->firmware_rev));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/187 nvme: fix misaccounting of nvme-mpath inflight I/O
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 71257925e83eae1cb6913d65ca71927d2220e6d1 ]
Procedures for nvme-mpath IO accounting:
1) initialize nvme_request and clear flags;
2) set NVME_MPATH_IO_STATS and increase inflight counter when IO
started;
3) check NVME_MPATH_IO_STATS and decrease inflight counter when IO is
done;However, for the case nvme_fail_nonready_command(), both step 1) and 2) are skipped, and if old nvme_request set NVME_MPATH_IO_STATS and then request is reused, step 3) will still be executed, causing inflight I/O counter to be negative.
Fix the problem by clearing nvme_request in nvme_fail_nonready_command().
--- drivers/nvme/host/core.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/nvme/host/core.c +4 -0
@@ -759,6 +759,10 @@ blk_status_t nvme_fail_nonready_command(struct nvme_ctrl *ctrl, !test_bit(NVME_CTRL_FAILFAST_EXPIRED, &ctrl->flags) && !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))return BLK_STS_RESOURCE ; + +if (!(rq->rq_flags &RQF_DONTPREP )) +nvme_clear_nvme_request (rq); +return nvme_host_path_error (rq); }EXPORT_SYMBOL_GPL (nvme_fail_nonready_command);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/187 nvmet-tcp: fix callback lock for TLS handshake
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 0523c6cc87e558c50ff4489c87c54c55068b1169 ]
When restoring the default socket callbacks during a TLS handshake, we need to acquire a write lock on sk_callback_lock. Previously, a read lock was used, which is insufficient for modifying sk_user_data and sk_data_ready.
--- drivers/nvme/target/tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/target/tcp.c +2 -2
@@ -1967,10 +1967,10 @@ static void nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port,struct sock *sk = queue->sock->sk;/* Restore the default callbacks before starting upcall */ -read_lock_bh (&sk->sk_callback_lock); +write_lock_bh (&sk->sk_callback_lock); sk->sk_user_data =NULL ; sk->sk_data_ready = port->data_ready; -read_unlock_bh (&sk->sk_callback_lock); +write_unlock_bh (&sk->sk_callback_lock);if (!nvmet_tcp_try_peek_pdu (queue)) {if (!nvmet_tcp_tls_handshake (queue))return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/187 wifi: cfg80211: remove scan request n_channels counted_by
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 444020f4bf06fb86805ee7e7ceec0375485fd94d ]
This reverts commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by").
This really has been a completely failed experiment. There were no actual bugs found, and yet at this point we already have four "fixes" to it, with nothing to show for but code churn, and it never even made the code any safer.
In all of the cases that ended up getting "fixed", the structure is also internally inconsistent after the n_channels setting as the channel list isn't actually filled yet. You cannot scan with such a structure, that's just wrong. In mac80211, the struct is also reused multiple times, so initializing it once is no good.
Some previous "fixes" (e.g. one in brcm80211) are also just setting n_channels before accessing the array, under the assumption that the code is correct and the array can be accessed, further showing that the whole thing is just pointless when the allocation count and use count are not separate.
If we really wanted to fix it, we'd need to separately track the number of channels allocated and the number of channels currently used, but given that no bugs were found despite the numerous syzbot reports, that'd just be a waste of time.
Remove the __counted_by() annotation. We really should also remove a number of the n_channels settings that are setting up a structure that's inconsistent, but that can wait.
--- include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/cfg80211.h +1 -1
@@ -2720,7 +2720,7 @@ struct cfg80211_scan_request {s8 tsf_report_link_id;/* keep last */ - struct ieee80211_channel *channels[] __counted_by(n_channels); +struct ieee80211_channel *channels[]; };static inline void get_random_mask_addr (u8 *buf,const u8 *addr,const u8 *mask)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/187 can: tcan4x5x: fix reset gpio usage during probe
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brett Werling <[email protected]>
[ Upstream commit 0f97a7588db7a545ea07ee0d512789bfad4931d8 ]
Fixes reset GPIO usage during probe by ensuring we retrieve the GPIO and take the device out of reset (if it defaults to being in reset) before we attempt to communicate with the device. This is achieved by moving the call to tcan4x5x_get_gpios() before tcan4x5x_find_version() and avoiding any device communication while getting the GPIOs. Once we determine the version, we can then take the knowledge of which GPIOs we obtained and use it to decide whether we need to disable the wake or state pin functions within the device.
This change is necessary in a situation where the reset GPIO is pulled high externally before the CPU takes control of it, meaning we need to explicitly bring the device out of reset before we can start communicating with it at all.
This also has the effect of fixing an issue where a reset of the device would occur after having called tcan4x5x_disable_wake(), making the original behavior not actually disable the wake. This patch should now disable wake or state pin functions well after the reset occurs.
--- drivers/net/can/m_can/tcan4x5x-core.c | 61 ++++++++++++++++++--------- 1 file changed, 41 insertions(+), 20 deletions(-)
drivers/net/can/m_can/tcan4x5x-core.c +41 -20
@@ -343,21 +343,19 @@ static void tcan4x5x_get_dt_data(struct m_can_classdev *cdev)of_property_read_bool (cdev->dev->of_node,"ti,nwkrq-voltage-vio" ); } -static int tcan4x5x_get_gpios (struct m_can_classdev *cdev, -const struct tcan4x5x_version_info *version_info) +static int tcan4x5x_get_gpios (struct m_can_classdev *cdev) {struct tcan4x5x_priv *tcan4x5x =cdev_to_priv (cdev);int ret; -if (version_info->has_wake_pin) { - tcan4x5x->device_wake_gpio =devm_gpiod_get (cdev->dev,"device-wake" , -GPIOD_OUT_HIGH ); -if (IS_ERR (tcan4x5x->device_wake_gpio)) { -if (PTR_ERR (tcan4x5x->device_wake_gpio) == -EPROBE_DEFER ) -return -EPROBE_DEFER ; + tcan4x5x->device_wake_gpio =devm_gpiod_get_optional (cdev->dev, +"device-wake" , +GPIOD_OUT_HIGH ); +if (IS_ERR (tcan4x5x->device_wake_gpio)) { +if (PTR_ERR (tcan4x5x->device_wake_gpio) == -EPROBE_DEFER ) +return -EPROBE_DEFER ; -tcan4x5x_disable_wake (cdev); - } + tcan4x5x->device_wake_gpio =NULL ; } tcan4x5x->reset_gpio = devm_gpiod_get_optional(cdev->dev, "reset",
@@ -369,14 +367,31 @@ static int tcan4x5x_get_gpios(struct m_can_classdev *cdev,if (ret)return ret; -if (version_info->has_state_pin) { - tcan4x5x->device_state_gpio =devm_gpiod_get_optional (cdev->dev, -"device-state" , -GPIOD_IN ); -if (IS_ERR (tcan4x5x->device_state_gpio)) { - tcan4x5x->device_state_gpio =NULL ; -tcan4x5x_disable_state (cdev); - } + tcan4x5x->device_state_gpio =devm_gpiod_get_optional (cdev->dev, +"device-state" , +GPIOD_IN ); +if (IS_ERR (tcan4x5x->device_state_gpio)) + tcan4x5x->device_state_gpio =NULL ; + +return 0 ; +} + +static int tcan4x5x_check_gpios (struct m_can_classdev *cdev, +const struct tcan4x5x_version_info *version_info) +{ +struct tcan4x5x_priv *tcan4x5x =cdev_to_priv (cdev); +int ret; + +if (version_info->has_wake_pin && !tcan4x5x->device_wake_gpio) { + ret =tcan4x5x_disable_wake (cdev); +if (ret) +return ret; + } + +if (version_info->has_state_pin && !tcan4x5x->device_state_gpio) { + ret =tcan4x5x_disable_state (cdev); +if (ret) +return ret; }return 0 ;
@@ -468,15 +483,21 @@ static int tcan4x5x_can_probe(struct spi_device *spi) goto out_m_can_class_free_dev; } + ret =tcan4x5x_get_gpios (mcan_class); +if (ret) { +dev_err (&spi->dev,"Getting gpios failed %pe\n" ,ERR_PTR (ret)); + goto out_power; + } + version_info =tcan4x5x_find_version (priv);if (IS_ERR (version_info)) { ret =PTR_ERR (version_info); goto out_power; } - ret =tcan4x5x_get_gpios (mcan_class, version_info); + ret =tcan4x5x_check_gpios (mcan_class, version_info);if (ret) { -dev_err (&spi->dev,"Getting gpios failed %pe\n" ,ERR_PTR (ret)); +dev_err (&spi->dev,"Checking gpios failed %pe\n" ,ERR_PTR (ret)); goto out_power; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/187 selftests: net: increase inter-packet timeout in udpgro.sh
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 0e9418961f897be59b1fab6e31ae1b09a0bae902 ]
The mentioned test is not very stable when running on top of debug kernel build. Increase the inter-packet timeout to allow more slack in such environments.
--- tools/testing/selftests/net/udpgro.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/udpgro.sh +4 -4
@@ -48,7 +48,7 @@ run_one() { cfg_veth - ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${rx_args} & + ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 100 ${rx_args} & local PID1=$! wait_local_port_listen ${PEER_NS} 8000 udp
@@ -95,7 +95,7 @@ run_one_nat() { # will land on the 'plain' one ip netns exec "${PEER_NS}" ./udpgso_bench_rx -G ${family} -b ${addr1} -n 0 & local PID1=$! - ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${family} -b ${addr2%/*} ${rx_args} & + ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 100 ${family} -b ${addr2%/*} ${rx_args} & local PID2=$! wait_local_port_listen "${PEER_NS}" 8000 udp
@@ -117,9 +117,9 @@ run_one_2sock() { cfg_veth - ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${rx_args} -p 12345 & + ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 100 ${rx_args} -p 12345 & local PID1=$! - ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 2000 -R 10 ${rx_args} & + ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 2000 -R 100 ${rx_args} & local PID2=$! wait_local_port_listen "${PEER_NS}" 12345 udp
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/187 hwmon: (corsair-cpro) Validate the size of the received input buffer
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marius Zachmann <[email protected]>
[ Upstream commit 495a4f0dce9c8c4478c242209748f1ee9e4d5820 ]
Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd().
--- drivers/hwmon/corsair-cpro.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwmon/corsair-cpro.c +5 -0
@@ -89,6 +89,7 @@ struct ccp_device {struct mutex mutex;/* whenever buffer is used, lock before send_usb_cmd */ u8 *cmd_buffer;u8 *buffer; +int buffer_recv_size;/* number of received bytes in buffer */ int target[6 ];DECLARE_BITMAP (temp_cnct,NUM_TEMP_SENSORS );DECLARE_BITMAP (fan_cnct,NUM_FANS );
@@ -146,6 +147,9 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,if (!t)return -ETIMEDOUT ; +if (ccp->buffer_recv_size !=IN_BUFFER_SIZE ) +return -EPROTO ; +return ccp_get_errno (ccp); }
@@ -157,6 +161,7 @@ static int ccp_raw_event(struct hid_device *hdev, struct hid_report *report, u8spin_lock (&ccp->wait_input_report_lock);if (!completion_done (&ccp->wait_input_report)) {memcpy (ccp->buffer, data,min (IN_BUFFER_SIZE , size)); + ccp->buffer_recv_size = size;complete_all (&ccp->wait_input_report); }spin_unlock (&ccp->wait_input_report_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/187 ice: add NULL check in eswitch lag check
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Ertman <[email protected]>
[ Upstream commit 3ce58b01ada408b372f15b7c992ed0519840e3cf ]
The function ice_lag_is_switchdev_running() is being called from outside of the LAG event handler code. This results in the lag->upper_netdev being NULL sometimes. To avoid a NULL-pointer dereference, there needs to be a check before it is dereferenced.
--- drivers/net/ethernet/intel/ice/ice_lag.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_lag.c +2 -1
@@ -2226,7 +2226,8 @@ bool ice_lag_is_switchdev_running(struct ice_pf *pf)struct ice_lag *lag = pf->lag;struct net_device *tmp_nd; -if (!ice_is_feature_supported (pf,ICE_F_SRIOV_LAG ) || !lag) +if (!ice_is_feature_supported (pf,ICE_F_SRIOV_LAG ) || + !lag || !lag->upper_netdev)return false;rcu_read_lock ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/187 ice: check correct pointer in fwlog debugfs
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit bedd0330a19b3a4448e67941732153ce04d3fb9b ]
pf->ice_debugfs_pf_fwlog should be checked for an error here.
--- drivers/net/ethernet/intel/ice/ice_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_debugfs.c +1 -1
@@ -606,7 +606,7 @@ void ice_debugfs_fwlog_init(struct ice_pf *pf) pf->ice_debugfs_pf_fwlog =debugfs_create_dir ("fwlog" , pf->ice_debugfs_pf); -if (IS_ERR (pf->ice_debugfs_pf)) +if (IS_ERR (pf->ice_debugfs_pf_fwlog)) goto err_create_module_files; fw_modules_dir = debugfs_create_dir("modules",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/187 usb: net: sierra: check for no status endpoint
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 4c4ca3c46167518f8534ed70f6e3b4bf86c4d158 ]
The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input.
Rectify the omission.
--- drivers/net/usb/sierra_net.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/usb/sierra_net.c +4 -0
@@ -689,6 +689,10 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf) status);return -ENODEV ; } +if (!dev->status) { +dev_err (&dev->udev->dev,"No status endpoint found" ); +return -ENODEV ; + }/* Initialize sierra private data */ priv =kzalloc (sizeof *priv,GFP_KERNEL );if (!priv)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/187 loop: use kiocb helpers to fix lockdep warning
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit c4706c5058a7bd7d7c20f3b24a8f523ecad44e83 ]
The lockdep tool can report a circular lock dependency warning in the loop driver's AIO read/write path:
```
[ 6540.587728] kworker/u96:5/72779 is trying to acquire lock:
[ 6540.593856] ff110001b5968440 (sb_writers#9){.+.+}-{0:0}, at: loop_process_work+0x11a/0xf70 [loop]
[ 6540.603786]
[ 6540.603786] but task is already holding lock:
[ 6540.610291] ff110001b5968440 (sb_writers#9){.+.+}-{0:0}, at: loop_process_work+0x11a/0xf70 [loop]
[ 6540.620210]
[ 6540.620210] other info that might help us debug this:
[ 6540.627499] Possible unsafe locking scenario:
[ 6540.627499]
[ 6540.634110] CPU0
[ 6540.636841] ----
[ 6540.639574] lock(sb_writers#9);
[ 6540.643281] lock(sb_writers#9);
[ 6540.646988]
[ 6540.646988] *** DEADLOCK ***
```This patch fixes the issue by using the AIO-specific helpers kiocb_start_write() and kiocb_end_write(). These functions are designed to be used with a kiocb and manage write sequencing correctly for asynchronous I/O without introducing the problematic lock dependency.
The kiocb is already part of the loop_cmd struct, so this change also simplifies the completion function lo_rw_aio_do_completion() by using the iocb from the cmd struct directly, instead of retrieving the loop device from the request queue.
--- drivers/block/loop.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/block/loop.c +2 -3
@@ -308,14 +308,13 @@ static void lo_complete_rq(struct request *rq)static void lo_rw_aio_do_completion (struct loop_cmd *cmd) {struct request *rq =blk_mq_rq_from_pdu (cmd); -struct loop_device *lo = rq->q->queuedata;if (!atomic_dec_and_test (&cmd->ref))return ;kfree (cmd->bvec); cmd->bvec =NULL ;if (req_op (rq) ==REQ_OP_WRITE ) -file_end_write (lo->lo_backing_file); +kiocb_end_write (&cmd->iocb);if (likely (!blk_should_fake_timeout (rq->q)))blk_mq_complete_request (rq); }
@@ -391,7 +390,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, }if (rw ==ITER_SOURCE ) { -file_start_write (lo->lo_backing_file); +kiocb_start_write (&cmd->iocb); ret = file->f_op->write_iter (&cmd->iocb, &iter); }else ret = file->f_op->read_iter (&cmd->iocb, &iter);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/187 riscv: Enable interrupt during exception handling
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
[ Upstream commit 969f028bf2c40573ef18061f702ede3ebfe12b42 ]
force_sig_fault() takes a spinlock, which is a sleeping lock with CONFIG_PREEMPT_RT=y. However, exception handling calls force_sig_fault() with interrupt disabled, causing a sleeping in atomic context warning.
This can be reproduced using userspace programs such as:
int main() { asm ("ebreak"); }
or
int main() { asm ("unimp"); }There is no reason that interrupt must be disabled while handling exceptions from userspace.
Enable interrupt while handling user exceptions. This also has the added benefit of avoiding unnecessary delays in interrupt handling.
--- arch/riscv/kernel/traps.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
arch/riscv/kernel/traps.c +6 -4
@@ -6,6 +6,7 @@#include <linux/cpu.h> #include <linux/kernel.h> #include <linux/init.h> +#include <linux/irqflags.h> #include <linux/randomize_kstack.h> #include <linux/sched.h> #include <linux/sched/debug.h>
@@ -151,7 +152,9 @@ asmlinkage __visible __trap_section void name(struct pt_regs *regs) \ { \if (user_mode (regs)) { \irqentry_enter_from_user_mode (regs); \ +local_irq_enable (); \do_trap_error (regs, signo, code, regs->epc,"Oops - " str); \ +local_irq_disable (); \irqentry_exit_to_user_mode (regs); \ }else { \irqentry_state_t state =irqentry_nmi_enter (regs); \
@@ -173,17 +176,14 @@ asmlinkage __visible __trap_section void do_trap_insn_illegal(struct pt_regs *reif (user_mode (regs)) {irqentry_enter_from_user_mode (regs); -local_irq_enable (); handled =riscv_v_first_use_handler (regs); - -local_irq_disable (); -if (!handled)do_trap_error (regs,SIGILL ,ILL_ILLOPC , regs->epc,"Oops - illegal instruction" ); +local_irq_disable ();irqentry_exit_to_user_mode (regs); }else {irqentry_state_t state =irqentry_nmi_enter (regs);
@@ -308,9 +308,11 @@ asmlinkage __visible __trap_section void do_trap_break(struct pt_regs *regs) {if (user_mode (regs)) {irqentry_enter_from_user_mode (regs); +local_irq_enable ();handle_break (regs); +local_irq_disable ();irqentry_exit_to_user_mode (regs); }else {irqentry_state_t state =irqentry_nmi_enter (regs);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/187 riscv: traps_misaligned: properly sign extend value in misaligned load handler
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Schwab <[email protected]>
[ Upstream commit b3510183ab7d63c71a3f5c89043d31686a76a34c ]
Add missing cast to signed long.
--- arch/riscv/kernel/traps_misaligned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/traps_misaligned.c +1 -1
@@ -460,7 +460,7 @@ static int handle_scalar_misaligned_load(struct pt_regs *regs) }if (!fp) -SET_RD (insn, regs, val.data_ulong << shift >> shift); +SET_RD (insn, regs, (long )(val.data_ulong << shift) >> shift);else if (len ==8 )set_f64_rd (insn, regs, val.data_u64);else
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/187 Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit a0075accbf0d76c2dad1ad3993d2e944505d99a0 ]
syzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0]
l2cap_sock_resume_cb() has a similar problem that was fixed by commit 1bff51ea59a9 ("Bluetooth: fix use-after-free error in lock_sock_nested()").
Since both l2cap_sock_kill() and l2cap_sock_resume_cb() are executed under l2cap_sock_resume_cb(), we can avoid the issue simply by checking if chan->data is NULL.
Let's not access to the killed socket in l2cap_sock_resume_cb().
[0]:
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline] BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711 Write of size 8 at addr 0000000000000570 by task kworker/u9:0/52 CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: hci0 hci_rx_work Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:501 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_report+0x58/0x84 mm/kasan/report.c:524 kasan_report+0xb0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37 instrument_atomic_write include/linux/instrumented.h:82 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711 l2cap_security_cfm+0x524/0xea0 net/bluetooth/l2cap_core.c:7357 hci_auth_cfm include/net/bluetooth/hci_core.h:2092 [inline] hci_auth_complete_evt+0x2e8/0xa4c net/bluetooth/hci_event.c:3514 hci_event_func net/bluetooth/hci_event.c:7511 [inline] hci_event_packet+0x650/0xe9c net/bluetooth/hci_event.c:7565 hci_rx_work+0x320/0xb18 net/bluetooth/hci_core.c:4070 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3321 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3402 kthread+0x5fc/0x75c kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
--- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/l2cap_sock.c +3 -0
@@ -1703,6 +1703,9 @@ static void l2cap_sock_resume_cb(struct l2cap_chan *chan) {struct sock *sk = chan->data; +if (!sk) +return ; +if (test_and_clear_bit (FLAG_PENDING_SECURITY , &chan->flags)) { sk->sk_state =BT_CONNECTED ; chan->state =BT_CONNECTED ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/187 Bluetooth: hci_sync: fix connectable extended advertising when using static random address
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessandro Gasbarroni <[email protected]>
[ Upstream commit d85edab911a4c1fcbe3f08336eff5c7feec567d0 ]
Currently, the connectable flag used by the setup of an extended advertising instance drives whether we require privacy when trying to pass a random address to the advertising parameters (Own Address). If privacy is not required, then it automatically falls back to using the controller's public address. This can cause problems when using controllers that do not have a public address set, but instead use a static random address.
e.g. Assume a BLE controller that does not have a public address set. The controller upon powering is set with a random static address by default by the kernel.
< HCI Command: LE Set Random Address (0x08|0x0005) plen 6
Address: E4:AF:26:D8:3E:3A (Static)
> HCI Event: Command Complete (0x0e) plen 4
LE Set Random Address (0x08|0x0005) ncmd 1
Status: Success (0x00)Setting non-connectable extended advertisement parameters in bluetoothctl mgmt
add-ext-adv-params -r 0x801 -x 0x802 -P 2M -g 1
correctly sets Own address type as Random
< HCI Command: LE Set Extended Advertising Parameters (0x08|0x0036) plen 25 ... Own address type: Random (0x01)
Setting connectable extended advertisement parameters in bluetoothctl mgmt
add-ext-adv-params -r 0x801 -x 0x802 -P 2M -g -c 1
mistakenly sets Own address type to Public (which causes to use Public Address 00:00:00:00:00:00)
< HCI Command: LE Set Extended Advertising Parameters (0x08|0x0036) plen 25 ... Own address type: Public (0x00)
This causes either the controller to emit an Invalid Parameters error or to mishandle the advertising.
This patch makes sure that we use the already set static random address when requesting a connectable extended advertising when we don't require privacy and our public address is not set (00:00:00:00:00:00).
--- net/bluetooth/hci_sync.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/bluetooth/hci_sync.c +2 -2
@@ -6801,8 +6801,8 @@ int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,return 0 ; } -/* No privacy so use a public address. */ - *own_addr_type =ADDR_LE_DEV_PUBLIC ; +/* No privacy, use the current address */ +hci_copy_identity_address (hdev, rand_addr, own_addr_type);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/187 Bluetooth: SMP: If an unallowed command is received consider it a failure
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit fe4840df0bdf341f376885271b7680764fe6b34e ]
If a command is received while a bonding is ongoing consider it a pairing failure so the session is cleanup properly and the device is disconnected immediately instead of continuing with other commands that may result in the session to get stuck without ever completing such as the case bellow:
Quoted 1 line
ACL Data RX: Handle 2048 flags
0x02dlen 21
SMP: Identity Information (0x08) len 16
Identity resolving key[16]: d7e08edef97d3e62cd2331f82d8073b0Quoted 1 line
ACL Data RX: Handle 2048 flags
0x02dlen 21
SMP: Signing Information (0x0a) len 16
Signature key[16]: 1716c536f94e843a9aea8b13ffde477dBluetooth: hci0: unexpected SMP command 0x0a from XX:XX:XX:XX:XX:XX
Quoted 1 line
ACL Data RX: Handle 2048 flags
0x02dlen 12
SMP: Identity Address Information (0x09) len 7
Address: XX:XX:XX:XX:XX:XX (Intel Corporate)
While accourding to core spec 6.1 the expected order is always BD_ADDR first first then CSRK:
When using LE legacy pairing, the keys shall be distributed in the following order:
LTK by the Peripheral
EDIV and Rand by the Peripheral
IRK by the Peripheral
BD_ADDR by the Peripheral
CSRK by the Peripheral
LTK by the Central
EDIV and Rand by the Central
IRK by the Central
BD_ADDR by the Central
CSRK by the Central
When using LE Secure Connections, the keys shall be distributed in the following order:
IRK by the Peripheral
BD_ADDR by the Peripheral
CSRK by the Peripheral
IRK by the Central
BD_ADDR by the Central
CSRK by the Central
According to the Core 6.1 for commands used for key distribution "Key Rejected" can be used:
'3.6.1. Key distribution and generation
A device may reject a distributed key by sending the Pairing Failed command with the reason set to "Key Rejected".
--- net/bluetooth/smp.c | 19 ++++++++++++++++++- net/bluetooth/smp.h | 1 + 2 files changed, 19 insertions(+), 1 deletion(-)
net/bluetooth/smp.c +18 -1
@@ -2977,8 +2977,25 @@ static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)if (code >SMP_CMD_MAX ) goto drop; -if (smp && !test_and_clear_bit (code, &smp->allow_cmd)) +if (smp && !test_and_clear_bit (code, &smp->allow_cmd)) { +/* If there is a context and the command is not allowed consider +* it a failure so the session is cleanup properly. +*/ +switch (code) { +case SMP_CMD_IDENT_INFO : +case SMP_CMD_IDENT_ADDR_INFO : +case SMP_CMD_SIGN_INFO : +/* 3.6.1. Key distribution and generation +* +* A device may reject a distributed key by sending the +* Pairing Failed command with the reason set to +* "Key Rejected". +*/ +smp_failure (conn,SMP_KEY_REJECTED ); +break ; + } goto drop; + }/* If we don't have a context the only allowed commands are * pairing request and security request.
net/bluetooth/smp.h +1 -0
@@ -138,6 +138,7 @@ struct smp_cmd_keypress_notify {#define SMP_NUMERIC_COMP_FAILED 0x0c#define SMP_BREDR_PAIRING_IN_PROGRESS 0x0d#define SMP_CROSS_TRANSP_NOT_ALLOWED 0x0e +#define SMP_KEY_REJECTED 0x0f#define SMP_MIN_ENC_KEY_SIZE 7#define SMP_MAX_ENC_KEY_SIZE 16
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/187 Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 6ef99c917688a8510259e565bd1b168b7146295a ]
This replaces the usage of HCI_ERROR_REMOTE_USER_TERM, which as the name suggest is to indicate a regular disconnection initiated by an user, with HCI_ERROR_AUTH_FAILURE to indicate the session has timeout thus any pairing shall be considered as failed.
--- net/bluetooth/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/smp.c +1 -1
@@ -1379,7 +1379,7 @@ static void smp_timeout(struct work_struct *work)bt_dev_dbg (conn->hcon->hdev,"conn %p" , conn); -hci_disconnect (conn->hcon,HCI_ERROR_REMOTE_USER_TERM ); +hci_disconnect (conn->hcon,HCI_ERROR_AUTH_FAILURE ); }static struct smp_chan *smp_chan_create (struct l2cap_conn *conn)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/187 Bluetooth: hci_core: fix typos in macros
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <[email protected]>
[ Upstream commit dfef8d87a031ac1a46dde3de804e0fcf3c3a6afd ]
The provided macro parameter is named 'dev' (rather than 'hdev', which may be a variable on the stack where the macro is used).
--- include/net/bluetooth/hci_core.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/net/bluetooth/hci_core.h +2 -2
@@ -1934,11 +1934,11 @@ void hci_conn_del_sysfs(struct hci_conn *conn);#define ll_privacy_capable (dev) ((dev)->le_features[0] & HCI_LE_LL_PRIVACY)#define privacy_mode_capable (dev) (ll_privacy_capable(dev) && \ - (hdev->commands[39] & 0x04)) + ((dev)->commands[39] & 0x04))#define read_key_size_capable (dev) \ ((dev)->commands[20] & 0x10 && \ - !test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks)) + !test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &(dev)->quirks))#define read_voice_setting_capable (dev) \ ((dev)->commands[9] & 0x04 && \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/187 Bluetooth: hci_core: add missing braces when using macro parameters
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <[email protected]>
[ Upstream commit cdee6a4416b2a57c89082929cc60e2275bb32a3a ]
Macro parameters should always be put into braces when accessing it.
--- include/net/bluetooth/hci_core.h | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
include/net/bluetooth/hci_core.h +11 -11
@@ -825,20 +825,20 @@ extern struct mutex hci_cb_list_lock;#define hci_dev_test_and_clear_flag (hdev, nr) test_and_clear_bit((nr), (hdev)->dev_flags)#define hci_dev_test_and_change_flag (hdev, nr) test_and_change_bit((nr), (hdev)->dev_flags) -#define hci_dev_clear_volatile_flags (hdev) \ - do { \ - hci_dev_clear_flag(hdev, HCI_LE_SCAN); \ - hci_dev_clear_flag(hdev, HCI_LE_ADV); \ - hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);\ - hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ); \ - hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); \ +#define hci_dev_clear_volatile_flags (hdev) \ + do { \ + hci_dev_clear_flag((hdev), HCI_LE_SCAN); \ + hci_dev_clear_flag((hdev), HCI_LE_ADV); \ + hci_dev_clear_flag((hdev), HCI_LL_RPA_RESOLUTION); \ + hci_dev_clear_flag((hdev), HCI_PERIODIC_INQ); \ + hci_dev_clear_flag((hdev), HCI_QUALITY_REPORT); \ } while (0)#define hci_dev_le_state_simultaneous (hdev) \ - (!test_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks) && \ - (hdev->le_states[4] & 0x08) &&/* Central */ \ - (hdev->le_states[4] & 0x40) && /* Peripheral */ \ - (hdev->le_states[3] & 0x10)) /* Simultaneous */ + (!test_bit(HCI_QUIRK_BROKEN_LE_STATES, &(hdev)->quirks) && \ + ((hdev)->le_states[4] & 0x08) &&/* Central */ \ + ((hdev)->le_states[4] & 0x40) && /* Peripheral */ \ + ((hdev)->le_states[3] & 0x10)) /* Simultaneous *//* ----- HCI interface to upper protocols ----- */ int l2cap_connect_ind (struct hci_dev *hdev,bdaddr_t *bdaddr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/187 Bluetooth: hci_dev: replace quirks integer by quirk_flags bitmap
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <[email protected]>
[ Upstream commit 6851a0c228fc040dce8e4c393004209e7372e0a3 ]
The 'quirks' member already ran out of bits on some platforms some time ago. Replace the integer member by a bitmap in order to have enough bits in future. Replace raw bit operations by accessor macros.
--- drivers/bluetooth/bfusb.c | 2 +- drivers/bluetooth/bpa10x.c | 2 +- drivers/bluetooth/btbcm.c | 8 ++-- drivers/bluetooth/btintel.c | 28 ++++++------- drivers/bluetooth/btintel_pcie.c | 8 ++-- drivers/bluetooth/btmtksdio.c | 4 +- drivers/bluetooth/btmtkuart.c | 2 +- drivers/bluetooth/btnxpuart.c | 2 +- drivers/bluetooth/btqca.c | 2 +- drivers/bluetooth/btqcomsmd.c | 2 +- drivers/bluetooth/btrtl.c | 10 ++--- drivers/bluetooth/btsdio.c | 2 +- drivers/bluetooth/btusb.c | 70 ++++++++++++++++---------------- drivers/bluetooth/hci_aml.c | 2 +- drivers/bluetooth/hci_bcm.c | 4 +- drivers/bluetooth/hci_bcm4377.c | 10 ++--- drivers/bluetooth/hci_intel.c | 2 +- drivers/bluetooth/hci_ldisc.c | 6 +-- drivers/bluetooth/hci_ll.c | 4 +- drivers/bluetooth/hci_nokia.c | 2 +- drivers/bluetooth/hci_qca.c | 14 +++---- drivers/bluetooth/hci_serdev.c | 8 ++-- drivers/bluetooth/hci_vhci.c | 8 ++-- drivers/bluetooth/virtio_bt.c | 10 ++--- include/net/bluetooth/hci.h | 2 + include/net/bluetooth/hci_core.h | 28 +++++++------ net/bluetooth/hci_core.c | 4 +- net/bluetooth/hci_debugfs.c | 8 ++-- net/bluetooth/hci_event.c | 19 ++++----- net/bluetooth/hci_sync.c | 59 +++++++++++++-------------- net/bluetooth/mgmt.c | 38 ++++++++--------- net/bluetooth/msft.c | 2 +- 32 files changed, 187 insertions(+), 185 deletions(-)
drivers/bluetooth/bfusb.c +1 -1
@@ -670,7 +670,7 @@ static int bfusb_probe(struct usb_interface *intf, const struct usb_device_id *i hdev->flush = bfusb_flush; hdev->send = bfusb_send_frame; -set_bit (HCI_QUIRK_BROKEN_LOCAL_COMMANDS , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BROKEN_LOCAL_COMMANDS );if (hci_register_dev (hdev) <0 ) {BT_ERR ("Can't register HCI device" );
drivers/bluetooth/bpa10x.c +1 -1
@@ -398,7 +398,7 @@ static int bpa10x_probe(struct usb_interface *intf, hdev->send = bpa10x_send_frame; hdev->set_diag = bpa10x_set_diag; -set_bit (HCI_QUIRK_RESET_ON_CLOSE , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_RESET_ON_CLOSE ); err =hci_register_dev (hdev);if (err <0 ) {
drivers/bluetooth/btbcm.c +4 -4
@@ -135,7 +135,7 @@ int btbcm_check_bdaddr(struct hci_dev *hdev)if (btbcm_set_bdaddr_from_efi (hdev) !=0 ) {bt_dev_info (hdev,"BCM: Using default device address (%pMR)" , &bda->bdaddr); -set_bit (HCI_QUIRK_INVALID_BDADDR , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_INVALID_BDADDR ); } }
@@ -467,7 +467,7 @@ static int btbcm_print_controller_features(struct hci_dev *hdev)/* Read DMI and disable broken Read LE Min/Max Tx Power */ if (dmi_first_match (disable_broken_read_transmit_power)) -set_bit (HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER );return 0 ; }
@@ -706,7 +706,7 @@ int btbcm_finalize(struct hci_dev *hdev, bool *fw_load_done, bool use_autobaud_mbtbcm_check_bdaddr (hdev); -set_bit (HCI_QUIRK_STRICT_DUPLICATE_FILTER , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_STRICT_DUPLICATE_FILTER );return 0 ; }
@@ -769,7 +769,7 @@ int btbcm_setup_apple(struct hci_dev *hdev)kfree_skb (skb); } -set_bit (HCI_QUIRK_STRICT_DUPLICATE_FILTER , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_STRICT_DUPLICATE_FILTER );return 0 ; }
drivers/bluetooth/btintel.c +14 -14
@@ -88,7 +88,7 @@ int btintel_check_bdaddr(struct hci_dev *hdev)if (!bacmp (&bda->bdaddr,BDADDR_INTEL )) {bt_dev_err (hdev,"Found Intel default device address (%pMR)" , &bda->bdaddr); -set_bit (HCI_QUIRK_INVALID_BDADDR , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_INVALID_BDADDR ); }kfree_skb (skb);
@@ -2027,7 +2027,7 @@ static int btintel_download_fw(struct hci_dev *hdev,*/ if (!bacmp (¶ms->otp_bdaddr,BDADDR_ANY )) {bt_dev_info (hdev,"No device address configured" ); -set_bit (HCI_QUIRK_INVALID_BDADDR , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_INVALID_BDADDR ); } download:
@@ -2295,7 +2295,7 @@ static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,*/ if (!bacmp (&ver->otp_bd_addr,BDADDR_ANY )) {bt_dev_info (hdev,"No device address configured" ); -set_bit (HCI_QUIRK_INVALID_BDADDR , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_INVALID_BDADDR ); } }
@@ -3435,9 +3435,9 @@ static int btintel_setup_combined(struct hci_dev *hdev) }/* Apply the common HCI quirks for Intel device */ -set_bit (HCI_QUIRK_STRICT_DUPLICATE_FILTER , &hdev->quirks); -set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks); -set_bit (HCI_QUIRK_NON_PERSISTENT_DIAG , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_STRICT_DUPLICATE_FILTER ); +hci_set_quirk (hdev,HCI_QUIRK_SIMULTANEOUS_DISCOVERY ); +hci_set_quirk (hdev,HCI_QUIRK_NON_PERSISTENT_DIAG );/* Set up the quality report callback for Intel devices */ hdev->set_quality_report = btintel_set_quality_report;
@@ -3475,8 +3475,8 @@ static int btintel_setup_combined(struct hci_dev *hdev)*/ if (!btintel_test_flag (hdev,INTEL_ROM_LEGACY_NO_WBS_SUPPORT )) -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , - &hdev->quirks); +hci_set_quirk (hdev, +HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED ); err =btintel_legacy_rom_setup (hdev, &ver);break ;
@@ -3491,11 +3491,11 @@ static int btintel_setup_combined(struct hci_dev *hdev)* * All Legacy bootloader devices support WBS */ -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , - &hdev->quirks); +hci_set_quirk (hdev, +HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );/* These variants don't seem to support LE Coded PHY */ -set_bit (HCI_QUIRK_BROKEN_LE_CODED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BROKEN_LE_CODED );/* Setup MSFT Extension support */ btintel_set_msft_opcode (hdev, ver.hw_variant);
@@ -3571,10 +3571,10 @@ static int btintel_setup_combined(struct hci_dev *hdev)* * All Legacy bootloader devices support WBS */ -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );/* These variants don't seem to support LE Coded PHY */ -set_bit (HCI_QUIRK_BROKEN_LE_CODED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BROKEN_LE_CODED );/* Setup MSFT Extension support */ btintel_set_msft_opcode (hdev, ver.hw_variant);
@@ -3600,7 +3600,7 @@ static int btintel_setup_combined(struct hci_dev *hdev)* * All TLV based devices support WBS */ -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );/* Setup MSFT Extension support */ btintel_set_msft_opcode(hdev,
drivers/bluetooth/btintel_pcie.c +4 -4
@@ -1941,9 +1941,9 @@ static int btintel_pcie_setup_internal(struct hci_dev *hdev) }/* Apply the common HCI quirks for Intel device */ -set_bit (HCI_QUIRK_STRICT_DUPLICATE_FILTER , &hdev->quirks); -set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks); -set_bit (HCI_QUIRK_NON_PERSISTENT_DIAG , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_STRICT_DUPLICATE_FILTER ); +hci_set_quirk (hdev,HCI_QUIRK_SIMULTANEOUS_DISCOVERY ); +hci_set_quirk (hdev,HCI_QUIRK_NON_PERSISTENT_DIAG );/* Set up the quality report callback for Intel devices */ hdev->set_quality_report = btintel_set_quality_report;
@@ -1983,7 +1983,7 @@ static int btintel_pcie_setup_internal(struct hci_dev *hdev)* * All TLV based devices support WBS */ -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );/* Setup MSFT Extension support */ btintel_set_msft_opcode(hdev,
drivers/bluetooth/btmtksdio.c +2 -2
@@ -1141,7 +1141,7 @@ static int btmtksdio_setup(struct hci_dev *hdev) }/* Enable WBS with mSBC codec */ -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );/* Enable GPIO reset mechanism */ if (bdev->reset) {
@@ -1384,7 +1384,7 @@ static int btmtksdio_probe(struct sdio_func *func,SET_HCIDEV_DEV (hdev, &func->dev); hdev->manufacturer =70 ; -set_bit (HCI_QUIRK_NON_PERSISTENT_SETUP , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_NON_PERSISTENT_SETUP );sdio_set_drvdata (func, bdev);
drivers/bluetooth/btmtkuart.c +1 -1
@@ -872,7 +872,7 @@ static int btmtkuart_probe(struct serdev_device *serdev)SET_HCIDEV_DEV (hdev, &serdev->dev); hdev->manufacturer =70 ; -set_bit (HCI_QUIRK_NON_PERSISTENT_SETUP , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_NON_PERSISTENT_SETUP );if (btmtkuart_is_standalone (bdev)) { err =clk_prepare_enable (bdev->osc);
drivers/bluetooth/btnxpuart.c +1 -1
@@ -1769,7 +1769,7 @@ static int nxp_serdev_probe(struct serdev_device *serdev)"local-bd-address" , (u8 *)&ba, sizeof(ba));if (bacmp (&ba,BDADDR_ANY )) -set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_USE_BDADDR_PROPERTY );if (hci_register_dev (hdev) <0 ) {dev_err (&serdev->dev,"Can't register HCI device\n" );
drivers/bluetooth/btqca.c +1 -1
@@ -739,7 +739,7 @@ static int qca_check_bdaddr(struct hci_dev *hdev, const struct qca_fw_config *co bda = (struct hci_rp_read_bd_addr *)skb->data;if (!bacmp (&bda->bdaddr, &config->bdaddr)) -set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_USE_BDADDR_PROPERTY );kfree_skb (skb);
drivers/bluetooth/btqcomsmd.c +1 -1
@@ -117,7 +117,7 @@ static int btqcomsmd_setup(struct hci_dev *hdev)/* Devices do not have persistent storage for BD address. Retrieve * it from the firmware node property. */ -set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_USE_BDADDR_PROPERTY );return 0 ; }
drivers/bluetooth/btrtl.c +5 -5
@@ -1287,7 +1287,7 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)/* Enable controller to do both LE scan and BR/EDR inquiry * simultaneously. */ -set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_SIMULTANEOUS_DISCOVERY );/* Enable central-peripheral role (able to create new connections with * an existing connection in slave role).
@@ -1301,7 +1301,7 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)case CHIP_ID_8851B :case CHIP_ID_8922A :case CHIP_ID_8852BT : -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );/* RTL8852C needs to transmit mSBC data continuously without * the zero length of USB packets for the ALT 6 supported chips
@@ -1312,7 +1312,8 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)if (btrtl_dev->project_id ==CHIP_ID_8852A || btrtl_dev->project_id ==CHIP_ID_8852B || btrtl_dev->project_id ==CHIP_ID_8852C ) -set_bit (HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER , &hdev->quirks); +hci_set_quirk (hdev, +HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER );hci_set_aosp_capable (hdev);break ;
@@ -1331,8 +1332,7 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)* but it doesn't support any features from page 2 - * it either responds with garbage or with error status */ -set_bit (HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2 , - &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2 );break ;default :break ;
drivers/bluetooth/btsdio.c +1 -1
@@ -327,7 +327,7 @@ static int btsdio_probe(struct sdio_func *func, hdev->send = btsdio_send_frame;if (func->vendor ==0x0104 && func->device ==0x00c5 ) -set_bit (HCI_QUIRK_RESET_ON_CLOSE , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_RESET_ON_CLOSE ); err =hci_register_dev (hdev);if (err <0 ) {
drivers/bluetooth/btusb.c +35 -35
164 lines not on this page · raw message
drivers/bluetooth/hci_aml.c +1 -1
@@ -425,7 +425,7 @@ static int aml_check_bdaddr(struct hci_dev *hdev)if (!bacmp (&paddr->bdaddr,AML_BDADDR_DEFAULT )) {bt_dev_info (hdev,"amlbt using default bdaddr (%pM)" , &paddr->bdaddr); -set_bit (HCI_QUIRK_INVALID_BDADDR , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_INVALID_BDADDR ); } exit:
drivers/bluetooth/hci_bcm.c +2 -2
@@ -643,8 +643,8 @@ static int bcm_setup(struct hci_uart *hu)* Allow the bootloader to set a valid address through the * device tree. */ -if (test_bit (HCI_QUIRK_INVALID_BDADDR , &hu->hdev->quirks)) -set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hu->hdev->quirks); +if (hci_test_quirk (hu->hdev,HCI_QUIRK_INVALID_BDADDR )) +hci_set_quirk (hu->hdev,HCI_QUIRK_USE_BDADDR_PROPERTY );if (!bcm_request_irq (bcm)) err =bcm_setup_sleep (hu);
drivers/bluetooth/hci_bcm4377.c +5 -5
@@ -1435,7 +1435,7 @@ static int bcm4377_check_bdaddr(struct bcm4377_data *bcm4377) bda = (struct hci_rp_read_bd_addr *)skb->data;if (!bcm4377_is_valid_bdaddr (bcm4377, &bda->bdaddr)) -set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &bcm4377->hdev->quirks); +hci_set_quirk (bcm4377->hdev,HCI_QUIRK_USE_BDADDR_PROPERTY );kfree_skb (skb);return 0 ;
@@ -2389,13 +2389,13 @@ static int bcm4377_probe(struct pci_dev *pdev, const struct pci_device_id *id) hdev->setup = bcm4377_hci_setup;if (bcm4377->hw->broken_mws_transport_config) -set_bit (HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG );if (bcm4377->hw->broken_ext_scan) -set_bit (HCI_QUIRK_BROKEN_EXT_SCAN , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BROKEN_EXT_SCAN );if (bcm4377->hw->broken_le_coded) -set_bit (HCI_QUIRK_BROKEN_LE_CODED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BROKEN_LE_CODED );if (bcm4377->hw->broken_le_ext_adv_report_phy) -set_bit (HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY );pci_set_drvdata (pdev, bcm4377);hci_set_drvdata (hdev, bcm4377);
drivers/bluetooth/hci_intel.c +1 -1
@@ -660,7 +660,7 @@ static int intel_setup(struct hci_uart *hu)*/ if (!bacmp (¶ms.otp_bdaddr,BDADDR_ANY )) {bt_dev_info (hdev,"No device address configured" ); -set_bit (HCI_QUIRK_INVALID_BDADDR , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_INVALID_BDADDR ); }/* With this Intel bootloader only the hardware variant and device
drivers/bluetooth/hci_ldisc.c +3 -3
@@ -667,13 +667,13 @@ static int hci_uart_register_dev(struct hci_uart *hu)SET_HCIDEV_DEV (hdev, hu->tty->dev);if (test_bit (HCI_UART_RAW_DEVICE , &hu->hdev_flags)) -set_bit (HCI_QUIRK_RAW_DEVICE , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_RAW_DEVICE );if (test_bit (HCI_UART_EXT_CONFIG , &hu->hdev_flags)) -set_bit (HCI_QUIRK_EXTERNAL_CONFIG , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_EXTERNAL_CONFIG );if (!test_bit (HCI_UART_RESET_ON_INIT , &hu->hdev_flags)) -set_bit (HCI_QUIRK_RESET_ON_CLOSE , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_RESET_ON_CLOSE );/* Only call open() for the protocol after hdev is fully initialized as * open() (or a timer/workqueue it starts) may attempt to reference it.
drivers/bluetooth/hci_ll.c +2 -2
@@ -649,11 +649,11 @@ static int ll_setup(struct hci_uart *hu)/* This means that there was an error getting the BD address * during probe, so mark the device as having a bad address. */ -set_bit (HCI_QUIRK_INVALID_BDADDR , &hu->hdev->quirks); +hci_set_quirk (hu->hdev,HCI_QUIRK_INVALID_BDADDR ); }else if (bacmp (&lldev->bdaddr,BDADDR_ANY )) { err =ll_set_bdaddr (hu->hdev, &lldev->bdaddr);if (err) -set_bit (HCI_QUIRK_INVALID_BDADDR , &hu->hdev->quirks); +hci_set_quirk (hu->hdev,HCI_QUIRK_INVALID_BDADDR ); }/* Operational speed if any */
drivers/bluetooth/hci_nokia.c +1 -1
@@ -439,7 +439,7 @@ static int nokia_setup(struct hci_uart *hu)if (btdev->man_id ==NOKIA_ID_BCM2048 ) { hu->hdev->set_bdaddr = btbcm_set_bdaddr; -set_bit (HCI_QUIRK_INVALID_BDADDR , &hu->hdev->quirks); +hci_set_quirk (hu->hdev,HCI_QUIRK_INVALID_BDADDR );dev_dbg (dev,"bcm2048 has invalid bluetooth address!" ); }
drivers/bluetooth/hci_qca.c +7 -7
@@ -1892,7 +1892,7 @@ static int qca_setup(struct hci_uart *hu)/* Enable controller to do both LE scan and BR/EDR inquiry * simultaneously. */ -set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_SIMULTANEOUS_DISCOVERY );switch (soc_type) {case QCA_QCA2066 :
@@ -1944,7 +1944,7 @@ static int qca_setup(struct hci_uart *hu)case QCA_WCN7850 : qcadev =serdev_device_get_drvdata (hu->serdev);if (qcadev->bdaddr_property_broken) -set_bit (HCI_QUIRK_BDADDR_PROPERTY_BROKEN , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BDADDR_PROPERTY_BROKEN );hci_set_aosp_capable (hdev);
@@ -2487,7 +2487,7 @@ static int qca_serdev_probe(struct serdev_device *serdev) hdev = qcadev->serdev_hu.hdev;if (power_ctrl_enabled) { -set_bit (HCI_QUIRK_NON_PERSISTENT_SETUP , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_NON_PERSISTENT_SETUP ); hdev->shutdown = qca_power_off; }
@@ -2496,11 +2496,11 @@ static int qca_serdev_probe(struct serdev_device *serdev)* be queried via hci. Same with the valid le states quirk. */ if (data->capabilities &QCA_CAP_WIDEBAND_SPEECH ) -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , - &hdev->quirks); +hci_set_quirk (hdev, +HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );if (!(data->capabilities &QCA_CAP_VALID_LE_STATES )) -set_bit (HCI_QUIRK_BROKEN_LE_STATES , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_BROKEN_LE_STATES ); }return 0 ;
@@ -2550,7 +2550,7 @@ static void qca_serdev_shutdown(struct device *dev)* invoked and the SOC is already in the initial state, so * don't also need to send the VSC. */ -if (test_bit (HCI_QUIRK_NON_PERSISTENT_SETUP , &hdev->quirks) || +if (hci_test_quirk (hdev,HCI_QUIRK_NON_PERSISTENT_SETUP ) ||hci_dev_test_flag (hdev,HCI_SETUP ))return ;
drivers/bluetooth/hci_serdev.c +4 -4
@@ -152,7 +152,7 @@ static int hci_uart_close(struct hci_dev *hdev)* BT SOC is completely powered OFF during BT OFF, holding port * open may drain the battery. */ -if (test_bit (HCI_QUIRK_NON_PERSISTENT_SETUP , &hdev->quirks)) { +if (hci_test_quirk (hdev,HCI_QUIRK_NON_PERSISTENT_SETUP )) {clear_bit (HCI_UART_PROTO_READY , &hu->flags);serdev_device_close (hu->serdev); }
@@ -358,13 +358,13 @@ int hci_uart_register_device_priv(struct hci_uart *hu,SET_HCIDEV_DEV (hdev, &hu->serdev->dev);if (test_bit (HCI_UART_NO_SUSPEND_NOTIFIER , &hu->flags)) -set_bit (HCI_QUIRK_NO_SUSPEND_NOTIFIER , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_NO_SUSPEND_NOTIFIER );if (test_bit (HCI_UART_RAW_DEVICE , &hu->hdev_flags)) -set_bit (HCI_QUIRK_RAW_DEVICE , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_RAW_DEVICE );if (test_bit (HCI_UART_EXT_CONFIG , &hu->hdev_flags)) -set_bit (HCI_QUIRK_EXTERNAL_CONFIG , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_EXTERNAL_CONFIG );if (test_bit (HCI_UART_INIT_PENDING , &hu->hdev_flags))return 0 ;
drivers/bluetooth/hci_vhci.c +4 -4
@@ -415,16 +415,16 @@ static int __vhci_create_device(struct vhci_data *data, __u8 opcode) hdev->get_codec_config_data = vhci_get_codec_config_data; hdev->wakeup = vhci_wakeup; hdev->setup = vhci_setup; -set_bit (HCI_QUIRK_NON_PERSISTENT_SETUP , &hdev->quirks); -set_bit (HCI_QUIRK_SYNC_FLOWCTL_SUPPORTED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_NON_PERSISTENT_SETUP ); +hci_set_quirk (hdev,HCI_QUIRK_SYNC_FLOWCTL_SUPPORTED );/* bit 6 is for external configuration */ if (opcode &0x40 ) -set_bit (HCI_QUIRK_EXTERNAL_CONFIG , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_EXTERNAL_CONFIG );/* bit 7 is for raw device */ if (opcode &0x80 ) -set_bit (HCI_QUIRK_RAW_DEVICE , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_RAW_DEVICE );if (hci_register_dev (hdev) <0 ) {BT_ERR ("Can't register HCI device" );
drivers/bluetooth/virtio_bt.c +5 -5
@@ -327,17 +327,17 @@ static int virtbt_probe(struct virtio_device *vdev) hdev->setup = virtbt_setup_intel; hdev->shutdown = virtbt_shutdown_generic; hdev->set_bdaddr = virtbt_set_bdaddr_intel; -set_bit (HCI_QUIRK_STRICT_DUPLICATE_FILTER , &hdev->quirks); -set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks); -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_STRICT_DUPLICATE_FILTER ); +hci_set_quirk (hdev,HCI_QUIRK_SIMULTANEOUS_DISCOVERY ); +hci_set_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );break ;case VIRTIO_BT_CONFIG_VENDOR_REALTEK : hdev->manufacturer =93 ; hdev->setup = virtbt_setup_realtek; hdev->shutdown = virtbt_shutdown_generic; -set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks); -set_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , &hdev->quirks); +hci_set_quirk (hdev,HCI_QUIRK_SIMULTANEOUS_DISCOVERY ); +hci_set_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED );break ; } }
include/net/bluetooth/hci.h +2 -0
@@ -377,6 +377,8 @@ enum {* This quirk must be set before hci_register_dev is called. */ HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE , + + __HCI_NUM_QUIRKS, };/* HCI device flags */
include/net/bluetooth/hci_core.h +16 -12
@@ -462,7 +462,7 @@ struct hci_dev {unsigned int auto_accept_delay; -unsigned long quirks; +DECLARE_BITMAP (quirk_flags, __HCI_NUM_QUIRKS);atomic_t cmd_cnt;unsigned int acl_cnt;
@@ -652,6 +652,10 @@ struct hci_dev {u8 (*classify_pkt_type)(struct hci_dev *hdev,struct sk_buff *skb); }; +#define hci_set_quirk (hdev, nr) set_bit((nr), (hdev)->quirk_flags) +#define hci_clear_quirk (hdev, nr) clear_bit((nr), (hdev)->quirk_flags) +#define hci_test_quirk (hdev, nr) test_bit((nr), (hdev)->quirk_flags) +#define HCI_PHY_HANDLE (handle) (handle & 0xff)enum conn_reasons {
@@ -835,7 +839,7 @@ extern struct mutex hci_cb_list_lock; }while (0 ) #define hci_dev_le_state_simultaneous(hdev) \ - (!test_bit (HCI_QUIRK_BROKEN_LE_STATES , &(hdev)->quirks) && \ + (!hci_test_quirk ((hdev),HCI_QUIRK_BROKEN_LE_STATES ) && \ ((hdev)->le_states[4 ] &0x08 ) &&/* Central */ \ ((hdev)->le_states[4 ] &0x40 ) &&/* Peripheral */ \ ((hdev)->le_states[3 ] &0x10 ))/* Simultaneous */
@@ -1925,8 +1929,8 @@ void hci_conn_del_sysfs(struct hci_conn *conn); ((dev)->le_rx_def_phys & HCI_LE_SET_PHY_2M))#define le_coded_capable (dev) (((dev)->le_features[1] & HCI_LE_PHY_CODED) && \ - !test_bit(HCI_QUIRK_BROKEN_LE_CODED, \ - &(dev)->quirks)) + !hci_test_quirk((dev), \ + HCI_QUIRK_BROKEN_LE_CODED))#define scan_coded (dev) (((dev)->le_tx_def_phys & HCI_LE_SET_PHY_CODED) || \ ((dev)->le_rx_def_phys & HCI_LE_SET_PHY_CODED))
@@ -1938,27 +1942,27 @@ void hci_conn_del_sysfs(struct hci_conn *conn);#define read_key_size_capable (dev) \ ((dev)->commands[20] & 0x10 && \ - !test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &(dev)->quirks)) + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE))#define read_voice_setting_capable (dev) \ ((dev)->commands[9] & 0x04 && \ - !test_bit(HCI_QUIRK_BROKEN_READ_VOICE_SETTING, &(dev)->quirks)) + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_READ_VOICE_SETTING))/* Use enhanced synchronous connection if command is supported and its quirk * has not been set. */ #define enhanced_sync_conn_capable (dev) \ (((dev)->commands[29] & 0x08) && \ - !test_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &(dev)->quirks)) + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN))/* Use ext scanning if set ext scan param and ext scan enable is supported */ #define use_ext_scan (dev) (((dev)->commands[37] & 0x20) && \ ((dev)->commands[37] & 0x40) && \ - !test_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &(dev)->quirks)) + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_EXT_SCAN))/* Use ext create connection if command is supported */ #define use_ext_conn (dev) (((dev)->commands[37] & 0x80) && \ - !test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, &(dev)->quirks)) + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_EXT_CREATE_CONN))/* Extended advertising support */ #define ext_adv_capable (dev) (((dev)->le_features[1] & HCI_LE_EXT_ADV))
@@ -1973,8 +1977,8 @@ void hci_conn_del_sysfs(struct hci_conn *conn);*/ #define use_enhanced_conn_complete (dev) ((ll_privacy_capable(dev) || \ ext_adv_capable(dev)) && \ - !test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, \ - &(dev)->quirks)) + !hci_test_quirk((dev), \ + HCI_QUIRK_BROKEN_EXT_CREATE_CONN))/* Periodic advertising support */ #define per_adv_capable (dev) (((dev)->le_features[1] & HCI_LE_PERIODIC_ADV))
@@ -1991,7 +1995,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn);#define sync_recv_capable (dev) ((dev)->le_features[3] & HCI_LE_ISO_SYNC_RECEIVER)#define mws_transport_config_capable (dev) (((dev)->commands[30] & 0x08) && \ - (!test_bit(HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG, &(dev)->quirks))) + (!hci_test_quirk((dev), HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG)))/* ----- HCI protocols ----- */ #define HCI_PROTO_DEFER 0x01
net/bluetooth/hci_core.c +2 -2
@@ -2640,7 +2640,7 @@ int hci_register_dev(struct hci_dev *hdev)/* Devices that are marked for raw-only usage are unconfigured * and should not be included in normal operation. */ -if (test_bit (HCI_QUIRK_RAW_DEVICE , &hdev->quirks)) +if (hci_test_quirk (hdev,HCI_QUIRK_RAW_DEVICE ))hci_dev_set_flag (hdev,HCI_UNCONFIGURED );/* Mark Remote Wakeup connection flag as supported if driver has wakeup
@@ -2770,7 +2770,7 @@ int hci_register_suspend_notifier(struct hci_dev *hdev)int ret =0 ;if (!hdev->suspend_notifier.notifier_call && - !test_bit (HCI_QUIRK_NO_SUSPEND_NOTIFIER , &hdev->quirks)) { + !hci_test_quirk (hdev,HCI_QUIRK_NO_SUSPEND_NOTIFIER )) { hdev->suspend_notifier.notifier_call = hci_suspend_notifier; ret =register_pm_notifier (&hdev->suspend_notifier); }
net/bluetooth/hci_debugfs.c +4 -4
@@ -38,7 +38,7 @@ static ssize_t __name ## _read(struct file *file, \struct hci_dev *hdev = file->private_data; \char buf[3 ]; \ \ - buf[0 ] =test_bit (__quirk, &hdev->quirks) ?'Y' :'N' ; \ + buf[0 ] =test_bit (__quirk, hdev->quirk_flags) ?'Y' :'N' ; \ buf[1 ] ='\n' ; \ buf[2 ] ='\0' ; \return simple_read_from_buffer (user_buf, count, ppos, buf,2 ); \
@@ -59,10 +59,10 @@ static ssize_t __name ## _write(struct file *file, \if (err) \return err; \ \ -if (enable ==test_bit (__quirk, &hdev->quirks)) \ +if (enable ==test_bit (__quirk, hdev->quirk_flags)) \return -EALREADY ; \ \ -change_bit (__quirk, &hdev->quirks); \ +change_bit (__quirk, hdev->quirk_flags); \ \return count; \ } \
@@ -1356,7 +1356,7 @@ static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,* for the vendor callback. Instead just store the desired value and * the setting will be programmed when the controller gets powered on. */ -if (test_bit (HCI_QUIRK_NON_PERSISTENT_DIAG , &hdev->quirks) && +if (hci_test_quirk (hdev,HCI_QUIRK_NON_PERSISTENT_DIAG ) && (!test_bit (HCI_RUNNING , &hdev->flags) ||hci_dev_test_flag (hdev,HCI_USER_CHANNEL ))) goto done;
net/bluetooth/hci_event.c +9 -10
@@ -908,8 +908,8 @@ static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data,return rp->status;if (hdev->max_page < rp->max_page) { -if (test_bit (HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2 , - &hdev->quirks)) +if (hci_test_quirk (hdev, +HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2 ))bt_dev_warn (hdev,"broken local ext features page 2" );else hdev->max_page = rp->max_page;
@@ -936,7 +936,7 @@ static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data, hdev->acl_pkts =__le16_to_cpu (rp->acl_max_pkt); hdev->sco_pkts =__le16_to_cpu (rp->sco_max_pkt); -if (test_bit (HCI_QUIRK_FIXUP_BUFFER_SIZE , &hdev->quirks)) { +if (hci_test_quirk (hdev,HCI_QUIRK_FIXUP_BUFFER_SIZE )) { hdev->sco_mtu =64 ; hdev->sco_pkts =8 ; }
@@ -2971,7 +2971,7 @@ static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data,* state to indicate completion. */ if (!hci_dev_test_flag (hdev,HCI_LE_SCAN ) || - !test_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks)) + !hci_test_quirk (hdev,HCI_QUIRK_SIMULTANEOUS_DISCOVERY ))hci_discovery_set_state (hdev,DISCOVERY_STOPPED ); goto unlock; }
@@ -2990,7 +2990,7 @@ static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data,* state to indicate completion. */ if (!hci_dev_test_flag (hdev,HCI_LE_SCAN ) || - !test_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks)) + !hci_test_quirk (hdev,HCI_QUIRK_SIMULTANEOUS_DISCOVERY ))hci_discovery_set_state (hdev,DISCOVERY_STOPPED ); }
@@ -3614,8 +3614,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,/* We skip the WRITE_AUTH_PAYLOAD_TIMEOUT for ATS2851 based controllers * to avoid unexpected SMP command errors when pairing. */ -if (test_bit (HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT , - &hdev->quirks)) +if (hci_test_quirk (hdev,HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT )) goto notify;/* Set the default Authenticated Payload Timeout after
@@ -5914,7 +5913,7 @@ static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,* while we have an existing one in peripheral role. */ if (hdev->conn_hash.le_num_peripheral >0 && - (test_bit (HCI_QUIRK_BROKEN_LE_STATES , &hdev->quirks) || + (hci_test_quirk (hdev,HCI_QUIRK_BROKEN_LE_STATES ) || !(hdev->le_states[3 ] &0x10 )))return NULL ;
@@ -6310,8 +6309,8 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data, evt_type =__le16_to_cpu (info->type) &LE_EXT_ADV_EVT_TYPE_MASK ; legacy_evt_type =ext_evt_type_to_legacy (hdev, evt_type); -if (test_bit (HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY , - &hdev->quirks)) { +if (hci_test_quirk (hdev, +HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY )) { info->primary_phy &=0x1f ; info->secondary_phy &=0x1f ; }
net/bluetooth/hci_sync.c +29 -30
222 lines not on this page · raw message
net/bluetooth/mgmt.c +18 -20
@@ -464,7 +464,7 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,/* Devices marked as raw-only are neither configured * nor unconfigured controllers. */ -if (test_bit (HCI_QUIRK_RAW_DEVICE , &d->quirks)) +if (hci_test_quirk (d,HCI_QUIRK_RAW_DEVICE ))continue ;if (!hci_dev_test_flag (d,HCI_UNCONFIGURED )) {
@@ -522,7 +522,7 @@ static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,/* Devices marked as raw-only are neither configured * nor unconfigured controllers. */ -if (test_bit (HCI_QUIRK_RAW_DEVICE , &d->quirks)) +if (hci_test_quirk (d,HCI_QUIRK_RAW_DEVICE ))continue ;if (hci_dev_test_flag (d,HCI_UNCONFIGURED )) {
@@ -576,7 +576,7 @@ static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,/* Devices marked as raw-only are neither configured * nor unconfigured controllers. */ -if (test_bit (HCI_QUIRK_RAW_DEVICE , &d->quirks)) +if (hci_test_quirk (d,HCI_QUIRK_RAW_DEVICE ))continue ;if (hci_dev_test_flag (d,HCI_UNCONFIGURED ))
@@ -612,12 +612,12 @@ static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,static bool is_configured (struct hci_dev *hdev) { -if (test_bit (HCI_QUIRK_EXTERNAL_CONFIG , &hdev->quirks) && +if (hci_test_quirk (hdev,HCI_QUIRK_EXTERNAL_CONFIG ) && !hci_dev_test_flag (hdev,HCI_EXT_CONFIGURED ))return false; -if ((test_bit (HCI_QUIRK_INVALID_BDADDR , &hdev->quirks) || -test_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks)) && +if ((hci_test_quirk (hdev,HCI_QUIRK_INVALID_BDADDR ) || +hci_test_quirk (hdev,HCI_QUIRK_USE_BDADDR_PROPERTY )) && !bacmp (&hdev->public_addr,BDADDR_ANY ))return false;
@@ -628,12 +628,12 @@ static __le32 get_missing_options(struct hci_dev *hdev) {u32 options =0 ; -if (test_bit (HCI_QUIRK_EXTERNAL_CONFIG , &hdev->quirks) && +if (hci_test_quirk (hdev,HCI_QUIRK_EXTERNAL_CONFIG ) && !hci_dev_test_flag (hdev,HCI_EXT_CONFIGURED )) options |=MGMT_OPTION_EXTERNAL_CONFIG ; -if ((test_bit (HCI_QUIRK_INVALID_BDADDR , &hdev->quirks) || -test_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks)) && +if ((hci_test_quirk (hdev,HCI_QUIRK_INVALID_BDADDR ) || +hci_test_quirk (hdev,HCI_QUIRK_USE_BDADDR_PROPERTY )) && !bacmp (&hdev->public_addr,BDADDR_ANY )) options |=MGMT_OPTION_PUBLIC_ADDRESS ;
@@ -669,7 +669,7 @@ static int read_config_info(struct sock *sk, struct hci_dev *hdev,memset (&rp,0 ,sizeof (rp)); rp.manufacturer =cpu_to_le16 (hdev->manufacturer); -if (test_bit (HCI_QUIRK_EXTERNAL_CONFIG , &hdev->quirks)) +if (hci_test_quirk (hdev,HCI_QUIRK_EXTERNAL_CONFIG )) options |=MGMT_OPTION_EXTERNAL_CONFIG ;if (hdev->set_bdaddr)
@@ -828,8 +828,7 @@ static u32 get_supported_settings(struct hci_dev *hdev)if (lmp_sc_capable (hdev)) settings |=MGMT_SETTING_SECURE_CONN ; -if (test_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , - &hdev->quirks)) +if (hci_test_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED )) settings |=MGMT_SETTING_WIDEBAND_SPEECH ; }
@@ -841,8 +840,7 @@ static u32 get_supported_settings(struct hci_dev *hdev) settings |=MGMT_SETTING_ADVERTISING ; } -if (test_bit (HCI_QUIRK_EXTERNAL_CONFIG , &hdev->quirks) || - hdev->set_bdaddr) +if (hci_test_quirk (hdev,HCI_QUIRK_EXTERNAL_CONFIG ) || hdev->set_bdaddr) settings |=MGMT_SETTING_CONFIGURATION ;if (cis_central_capable (hdev))
@@ -4307,7 +4305,7 @@ static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,bt_dev_dbg (hdev,"sock %p" , sk); -if (!test_bit (HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED , &hdev->quirks)) +if (!hci_test_quirk (hdev,HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED ))return mgmt_cmd_status (sk, hdev->id,MGMT_OP_SET_WIDEBAND_SPEECH ,MGMT_STATUS_NOT_SUPPORTED );
@@ -7935,7 +7933,7 @@ static int set_external_config(struct sock *sk, struct hci_dev *hdev,return mgmt_cmd_status (sk, hdev->id,MGMT_OP_SET_EXTERNAL_CONFIG ,MGMT_STATUS_INVALID_PARAMS ); -if (!test_bit (HCI_QUIRK_EXTERNAL_CONFIG , &hdev->quirks)) +if (!hci_test_quirk (hdev,HCI_QUIRK_EXTERNAL_CONFIG ))return mgmt_cmd_status (sk, hdev->id,MGMT_OP_SET_EXTERNAL_CONFIG ,MGMT_STATUS_NOT_SUPPORTED );
@@ -9338,7 +9336,7 @@ void mgmt_index_added(struct hci_dev *hdev) {struct mgmt_ev_ext_index ev; -if (test_bit (HCI_QUIRK_RAW_DEVICE , &hdev->quirks)) +if (hci_test_quirk (hdev,HCI_QUIRK_RAW_DEVICE ))return ;if (hci_dev_test_flag (hdev,HCI_UNCONFIGURED )) {
@@ -9362,7 +9360,7 @@ void mgmt_index_removed(struct hci_dev *hdev)struct mgmt_ev_ext_index ev;struct cmd_lookup match = {NULL , hdev,MGMT_STATUS_INVALID_INDEX }; -if (test_bit (HCI_QUIRK_RAW_DEVICE , &hdev->quirks)) +if (hci_test_quirk (hdev,HCI_QUIRK_RAW_DEVICE ))return ;mgmt_pending_foreach (0 , hdev, true, cmd_complete_rsp, &match);
@@ -10089,7 +10087,7 @@ static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,if (hdev->discovery.rssi !=HCI_RSSI_INVALID && (rssi ==HCI_RSSI_INVALID || (rssi < hdev->discovery.rssi && - !test_bit (HCI_QUIRK_STRICT_DUPLICATE_FILTER , &hdev->quirks)))) + !hci_test_quirk (hdev,HCI_QUIRK_STRICT_DUPLICATE_FILTER ))))return false;if (hdev->discovery.uuid_count !=0 ) {
@@ -10107,7 +10105,7 @@ static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,/* If duplicate filtering does not report RSSI changes, then restart * scanning to ensure updated result with updated RSSI values. */ -if (test_bit (HCI_QUIRK_STRICT_DUPLICATE_FILTER , &hdev->quirks)) { +if (hci_test_quirk (hdev,HCI_QUIRK_STRICT_DUPLICATE_FILTER )) {/* Validate RSSI value against the RSSI threshold once more. */ if (hdev->discovery.rssi !=HCI_RSSI_INVALID && rssi < hdev->discovery.rssi)
net/bluetooth/msft.c +1 -1
@@ -989,7 +989,7 @@ static void msft_monitor_device_evt(struct hci_dev *hdev, struct sk_buff *skb) handle_data =msft_find_handle_data (hdev, ev->monitor_handle, false); -if (!test_bit (HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER , &hdev->quirks)) { +if (!hci_test_quirk (hdev,HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER )) {if (!handle_data)return ; mgmt_handle = handle_data->mgmt_handle;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/187 Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 43015955795a619f7ca4ae69b9c0ffc994c82818 ]
For GF variant of WCN6855 without board ID programmed btusb_generate_qca_nvm_name() will chose wrong NVM 'qca/nvm_usb_00130201.bin' to download.
Fix by choosing right NVM 'qca/nvm_usb_00130201_gf.bin'. Also simplify NVM choice logic of btusb_generate_qca_nvm_name().
--- drivers/bluetooth/btusb.c | 78 ++++++++++++++++++++++----------------- 1 file changed, 44 insertions(+), 34 deletions(-)
drivers/bluetooth/btusb.c +44 -34
@@ -3230,6 +3230,32 @@ static const struct qca_device_info qca_devices_table[] = { { 0x00190200, 40, 4, 16 }, /* WCN785x 2.0 */ }; +static u16 qca_extract_board_id (const struct qca_version *ver) +{ +u16 flag =le16_to_cpu (ver->flag); +u16 board_id =0 ; + +if (((flag >>8 ) &0xff ) ==QCA_FLAG_MULTI_NVM ) { +/* The board_id should be split into two bytes +* The 1st byte is chip ID, and the 2nd byte is platform ID +* For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID +* we have several platforms, and platform IDs are continuously added +* Platform ID: +* 0x00 is for Mobile +* 0x01 is for X86 +* 0x02 is for Automotive +* 0x03 is for Consumer electronic +*/ + board_id = (ver->chip_id <<8 ) + ver->platform_id; + } + +/* Take 0xffff as invalid board ID */ +if (board_id ==0xffff ) + board_id =0 ; + +return board_id; +} +static int btusb_qca_send_vendor_req (struct usb_device *udev,u8 request,void *data,u16 size) {
@@ -3386,44 +3412,28 @@ static void btusb_generate_qca_nvm_name(char *fwname, size_t max_size, const struct qca_version *ver) {u32 rom_version =le32_to_cpu (ver->rom_version); -u16 flag =le16_to_cpu (ver->flag); +const char *variant; +int len; +u16 board_id; -if (((flag >>8 ) &0xff ) ==QCA_FLAG_MULTI_NVM ) { -/* The board_id should be split into two bytes -* The 1st byte is chip ID, and the 2nd byte is platform ID -* For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID -* we have several platforms, and platform IDs are continuously added -* Platform ID: -* 0x00 is for Mobile -* 0x01 is for X86 -* 0x02 is for Automotive -* 0x03 is for Consumer electronic -*/ -u16 board_id = (ver->chip_id <<8 ) + ver->platform_id; -const char *variant; + board_id =qca_extract_board_id (ver); -switch (le32_to_cpu (ver->ram_version)) { -case WCN6855_2_0_RAM_VERSION_GF : -case WCN6855_2_1_RAM_VERSION_GF : - variant ="_gf" ; -break ; -default : - variant ="" ; -break ; - } - -if (board_id ==0 ) { -snprintf (fwname, max_size,"qca/nvm_usb_%08x%s.bin" , - rom_version, variant); - }else { -snprintf (fwname, max_size,"qca/nvm_usb_%08x%s_%04x.bin" , - rom_version, variant, board_id); - } - }else { -snprintf (fwname, max_size,"qca/nvm_usb_%08x.bin" , - rom_version); +switch (le32_to_cpu (ver->ram_version)) { +case WCN6855_2_0_RAM_VERSION_GF : +case WCN6855_2_1_RAM_VERSION_GF : + variant ="_gf" ; +break ; +default : + variant =NULL ; +break ; } + len =snprintf (fwname, max_size,"qca/nvm_usb_%08x" , rom_version); +if (variant) + len +=snprintf (fwname + len, max_size - len,"%s" , variant); +if (board_id) + len +=snprintf (fwname + len, max_size - len,"_%04x" , board_id); + len +=snprintf (fwname + len, max_size - len,".bin" ); } static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
Signature · 1 line
2.39.5