6.12.42-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.12.42-rc1 review
This is the start of the stable review cycle for the 6.12.42 release. There are 369 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 14 Aug 2025 17:27:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.42-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.42-rc1
Tao Xue <[email protected]>
usb: gadget : fix use-after-free in composite_dev_cleanup()
Yuhao Jiang <[email protected]>
USB: gadget: f_hid: Fix memory leak in hidg_bind error path
Qasim Ijaz <[email protected]>
HID: apple: validate feature-report field count to prevent NULL pointer dereference
Julien Massot <[email protected]>
media: ti: j721e-csi2rx: fix list_del corruption
Robin Murphy <[email protected]>
perf/arm-ni: Set initial IRQ affinity
Kemeng Shi <[email protected]>
mm: swap: fix potential buffer overflow in setup_clusters()
Kemeng Shi <[email protected]>
mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop
Andy Shevchenko <[email protected]>
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
Jiaxun Yang <[email protected]>
MIPS: mm: tlb-r4k: Uniquify TLB entries on init
Gerald Schaefer <[email protected]>
s390/mm: Remove possible false-positive warning in pte_free_defer()
Dave Hansen <[email protected]>
x86/fpu: Delay instruction pointer fixup until after warning
Michael J. Ruhl <[email protected]>
platform/x86/intel/pmt: fix a crashlog NULL pointer access
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
Thorsten Blum <[email protected]>
ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
Tom Lendacky <[email protected]>
x86/sev: Evict cache lines during SNP memory validation
Ammar Faizi <[email protected]>
net: usbnet: Fix the wrong netif_carrier_on() call
John Ernberg <[email protected]>
net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
Zenm Chen <[email protected]>
Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
Ilpo Järvinen <[email protected]>
PCI/ASPM: Fix L1SS saving
Jian-Hong Pan <[email protected]>
PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state()
Slark Xiao <[email protected]>
USB: serial: option: add Foxconn T99W709
Thorsten Blum <[email protected]>
smb: server: Fix extension string in ksmbd_extract_shortname()
Namjae Jeon <[email protected]>
ksmbd: limit repeated connections from clients with the same IP
Namjae Jeon <[email protected]>
ksmbd: fix corrupted mtime and ctime in smb2_open
Namjae Jeon <[email protected]>
ksmbd: fix Preauh_HashValue race condition
Namjae Jeon <[email protected]>
ksmbd: fix null pointer dereference error in generate_encryptionkey
Jani Nikula <[email protected]>
drm/i915/ddi: only call shutdown hooks for valid encoders
Jani Nikula <[email protected]>
drm/i915/display: add intel_encoder_is_hdmi()
Jani Nikula <[email protected]>
drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector()
Jani Nikula <[email protected]>
drm/i915/hdmi: add error handling in g4x_hdmi_init()
Jani Nikula <[email protected]>
drm/i915/hdmi: propagate errors from intel_hdmi_init_connector()
Jani Nikula <[email protected]>
drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type
Alexei Starovoitov <[email protected]>
selftests/bpf: Fix build error with llvm 19
Alexei Starovoitov <[email protected]>
selftests/bpf: Add a test for arena range tree algorithm
Anton Nadezhdin <[email protected]>
ice/ptp: fix crosstimestamp reporting
Kuan-Wei Chiu <[email protected]>
Revert "bcache: remove heap-related macros and switch to generic min_heap"
Andrzej Kacprowski <[email protected]>
accel/ivpu: Fix reset_engine debugfs file logic
Budimir Markovic <[email protected]>
vsock: Do not allow binding to VMADDR_PORT_ANY
Quang Le <[email protected]>
net/packet: fix a race in packet_set_ring() and packet_notifier()
Lorenzo Stoakes <[email protected]>
selftests/perf_events: Add a mmap() correctness test
Thomas Gleixner <[email protected]>
perf/core: Prevent VMA split of buffer mappings
Thomas Gleixner <[email protected]>
perf/core: Exit early on perf_mmap() fail
Thomas Gleixner <[email protected]>
perf/core: Don't leak AUX buffer refcount on allocation failure
Olga Kornievskaia <[email protected]>
sunrpc: fix handling of server side tls alerts
Stefan Metzmacher <[email protected]>
smb: client: return an error if rdma_connect does not return within 5 seconds
Eric Dumazet <[email protected]>
pptp: fix pptp_xmit() error path
Mohamed Khalfella <[email protected]>
nvmet: exit debugfs after discovery subsystem exits
Stefan Metzmacher <[email protected]>
smb: client: let recv_done() avoid touching data_transfer after cleanup/move
Stefan Metzmacher <[email protected]>
smb: client: let recv_done() cleanup before notifying the callers.
Stefan Metzmacher <[email protected]>
smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
Stefan Metzmacher <[email protected]>
smb: client: remove separate empty_packet_queue
Stefan Metzmacher <[email protected]>
smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
Stefan Metzmacher <[email protected]>
smb: server: let recv_done() avoid touching data_transfer after cleanup/move
Stefan Metzmacher <[email protected]>
smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
Stefan Metzmacher <[email protected]>
smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
Stefan Metzmacher <[email protected]>
smb: server: remove separate empty_recvmsg_queue
Takashi Iwai <[email protected]>
ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
Arnd Bergmann <[email protected]>
irqchip: Build IMX_MU_MSI only on ARM
Jakub Kicinski <[email protected]>
eth: fbnic: remove the debugging trick of super high page bias
Sumanth Korikkar <[email protected]>
s390/mm: Allocate page table with PAGE_SIZE granularity
Maher Azzouzi <[email protected]>
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
Michal Schmidt <[email protected]>
benet: fix BUG when creating VFs
Thomas Gleixner <[email protected]>
x86/irq: Plug vector setup race
Olga Kornievskaia <[email protected]>
sunrpc: fix client side handling of tls alerts
Takamitsu Iwai <[email protected]>
net/sched: taprio: enforce minimum value for picos_per_byte
Wang Liang <[email protected]>
net: drop UFO packets in udp_rcv_segment()
Florian Fainelli <[email protected]>
net: mdio: mdio-bcm-unimac: Correct rate fallback logic
Eric Dumazet <[email protected]>
ipv6: reject malicious packets in ipv6_gso_segment()
Christoph Paasch <[email protected]>
net/mlx5: Correctly set gso_segs when LRO is used
Simon Trimmer <[email protected]>
spi: cs42l43: Property entry should be a null-terminated array
Baojun Xu <[email protected]>
ASoC: tas2781: Fix the wrong step for TLV on tas2781
Christoph Hellwig <[email protected]>
block: ensure discard_granularity is zero when discard is not supported
Guenter Roeck <[email protected]>
block: Fix default IO priority if there is no IO context
Jakub Kicinski <[email protected]>
netlink: specs: ethtool: fix module EEPROM input/output arguments
Harald Freudenberger <[email protected]>
s390/ap: Unmask SLCF bit in card and queue ap functions sysfs
Mohamed Khalfella <[email protected]>
nvmet: initialize discovery subsys after debugfs is initialized
Eric Dumazet <[email protected]>
pptp: ensure minimal skb length in pptp_xmit()
Luca Weiss <[email protected]>
net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
Horatiu Vultur <[email protected]>
phy: mscc: Fix parsing of unicast frames
Jakub Kicinski <[email protected]>
netpoll: prevent hanging NAPI when netcons gets enabled
Heming Zhao <[email protected]>
md/md-cluster: handle REMOVE message earlier
Benjamin Coddington <[email protected]>
NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
Olga Kornievskaia <[email protected]>
NFSv4.2: another fix for listxattr
Trond Myklebust <[email protected]>
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
Trond Myklebust <[email protected]>
NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
NeilBrown <[email protected]>
sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
Tigran Mkrtchyan <[email protected]>
pNFS/flexfiles: don't attempt pnfs on fatal DS errors
Timothy Pearson <[email protected]>
PCI: pnv_php: Fix surprise plug detection and recovery
Timothy Pearson <[email protected]>
powerpc/eeh: Make EEH driver device hotplug safe
Timothy Pearson <[email protected]>
powerpc/eeh: Export eeh_unfreeze_pe()
Timothy Pearson <[email protected]>
PCI: pnv_php: Work around switches with broken presence detection
Timothy Pearson <[email protected]>
PCI: pnv_php: Clean up allocated IRQs on unplug
Peter Zijlstra <[email protected]>
sched/psi: Fix psi_seq initialization
Masahiro Yamada <[email protected]>
kconfig: qconf: fix ConfigList::updateListAllforAll()
Salomon Dushimirimana <[email protected]>
scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
Seunghui Lee <[email protected]>
scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
Li Lingfeng <[email protected]>
scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
Tomas Henzl <[email protected]>
scsi: mpt3sas: Fix a fw_event memory leak
Alex Williamson <[email protected]>
vfio/pci: Separate SR-IOV VF dev_set
Brett Creeley <[email protected]>
vfio/pds: Fix missing detach_ioas op
Jacob Pan <[email protected]>
vfio: Prevent open_count decrement to negative
Jacob Pan <[email protected]>
vfio: Fix unbalanced vfio_df_close call in no-iommu mode
Christophe JAILLET <[email protected]>
i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe()
Zhengxu Zhang <[email protected]>
exfat: fdatasync flag should be same like generic_write_sync()
Chao Yu <[email protected]>
f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
Chao Yu <[email protected]>
f2fs: fix to calculate dirty data during has_not_enough_free_secs()
Chao Yu <[email protected]>
f2fs: fix to update upper_p in __get_secs_required() correctly
Jan Prusakowski <[email protected]>
f2fs: vm_unmap_ram() may be called from an invalid context
Chao Yu <[email protected]>
f2fs: fix to avoid out-of-boundary access in devs.path
Chao Yu <[email protected]>
f2fs: fix to avoid panic in f2fs_evict_inode
Chao Yu <[email protected]>
f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
Chao Yu <[email protected]>
f2fs: doc: fix wrong quota mount option description
Chao Yu <[email protected]>
f2fs: fix to check upper boundary for gc_no_zoned_gc_percent
Chao Yu <[email protected]>
f2fs: fix to check upper boundary for gc_valid_thresh_ratio
yohan.joung <[email protected]>
f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent
Abinash Singh <[email protected]>
f2fs: fix KMSAN uninit-value in extent_info usage
Sheng Yong <[email protected]>
f2fs: fix bio memleak when committing super block
Daeho Jeong <[email protected]>
f2fs: turn off one_time when forcibly set to foreground GC
Brian Masney <[email protected]>
rtc: rv3028: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: pcf8563: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: pcf85063: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: nct3018y: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: hym8563: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: ds1307: fix incorrect maximum clock rate handling
Uros Bizjak <[email protected]>
ucount: fix atomic_long_inc_below() argument type
Petr Pavlu <[email protected]>
module: Restore the moduleparam prefix length check
Helge Deller <[email protected]>
apparmor: Fix unaligned memory accesses in KUnit test
Ryan Lee <[email protected]>
apparmor: fix loop detection used in conflicting attachment resolution
Ryan Lee <[email protected]>
apparmor: ensure WB_HISTORY_SIZE value is a power of 2
Paul Chaignon <[email protected]>
bpf: Check netfilter ctx accesses are aligned
Paul Chaignon <[email protected]>
bpf: Check flow_dissector ctx accesses are aligned
Cindy Lu <[email protected]>
vhost: Reintroduce kthread API and add mode selection
Anders Roxell <[email protected]>
vdpa: Fix IDR memory leak in VDUSE module exit
Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix release of uninitialized resources on error path
Mike Christie <[email protected]>
vhost-scsi: Fix log flooding with target does not exist errors
Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix needs_teardown flag calculation
Namhyung Kim <[email protected]>
perf record: Cache build-ID of hit DSOs only
WangYuli <[email protected]>
selftests: ALSA: fix memory leak in utimer test
Lukasz Laguna <[email protected]>
drm/xe/vf: Disable CSC support on VF
Balamanikandan Gunasundar <[email protected]>
mtd: rawnand: atmel: set pmecc data setup time
Thomas Fourier <[email protected]>
mtd: rawnand: rockchip: Add missing check after DMA map
Thomas Fourier <[email protected]>
mtd: rawnand: atmel: Fix dma_mapping_error() address
Zheng Yu <[email protected]>
jfs: fix metapage reference count leak in dbAllocCtl
Chenyuan Yang <[email protected]>
fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
Giovanni Cabiddu <[email protected]>
crypto: qat - fix seq_file position update in adf_ring_next()
Giovanni Cabiddu <[email protected]>
crypto: qat - fix DMA direction for compression on GEN2 devices
Chen Pei <[email protected]>
perf tools: Remove libtraceevent in .gitignore
Ben Hutchings <[email protected]>
sh: Do not use hyphen in exported variable name
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: get channel status data when PHY is not exists
Thomas Fourier <[email protected]>
dmaengine: nbpfaxi: Add missing check after DMA map
Thomas Fourier <[email protected]>
dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
Dan Carpenter <[email protected]>
fs/orangefs: Allow 2 more characters in do_c_string()
Tanmay Shah <[email protected]>
remoteproc: xlnx: Disable unsupported features
Laurentiu Palcu <[email protected]>
clk: imx95-blk-ctl: Fix synchronous abort
Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
Bard Liao <[email protected]>
soundwire: stream: restore params when prepare ports fail
Bairavi Alagappan <[email protected]>
crypto: qat - disable ZUC-256 capability for QAT GEN5
Thomas Fourier <[email protected]>
crypto: img-hash - Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
crypto: keembay - Fix dma_unmap_sg() nents value
Ovidiu Panait <[email protected]>
hwrng: mtk - handle devm_pm_runtime_enable errors
Varshini Rajendran <[email protected]>
clk: at91: sam9x7: update pll clk ranges
Jan Kara <[email protected]>
ext4: Make sure BH_New bit is cleared in ->write_end handler
Dan Carpenter <[email protected]>
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
Thomas Fourier <[email protected]>
scsi: isci: Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
scsi: mvsas: Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
scsi: elx: efct: Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
Paul Kocialkowski <[email protected]>
clk: sunxi-ng: v3s: Fix de clock definition
Yao Zi <[email protected]>
clk: thead: th1520-ap: Correctly refer the parent of osc_12m
Shiraz Saleem <[email protected]>
RDMA/mana_ib: Fix DSCP value in modify QP
Leo Yan <[email protected]>
perf tests bp_account: Fix leaked file descriptor
Mukesh Ojha <[email protected]>
pinmux: fix race causing mux_owner NULL with active mux_usecount
wangzijie <[email protected]>
proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
Arnd Bergmann <[email protected]>
kernel: trace: preemptirq_delay_test: use offstack cpu mask
Junxian Huang <[email protected]>
RDMA/hns: Fix -Wframe-larger-than issue
Junxian Huang <[email protected]>
RDMA/hns: Drop GFP_NOWARN
Junxian Huang <[email protected]>
RDMA/hns: Fix accessing uninitialized resources
Junxian Huang <[email protected]>
RDMA/hns: Get message length of ack_req from FW
Mengbiao Xiong <[email protected]>
crypto: ccp - Fix crash when rebind ccp device for ccp.ko
Thomas Fourier <[email protected]>
crypto: inside-secure - Fix dma_unmap_sg() nents value
Alexey Kardashevskiy <[email protected]>
crypto: ccp - Fix locking on alloc failure handling
wenglianfa <[email protected]>
RDMA/hns: Fix HW configurations not cleared in error flow
wenglianfa <[email protected]>
RDMA/hns: Fix double destruction of rsv_qp
Namhyung Kim <[email protected]>
perf sched: Fix memory leaks in 'perf sched latency'
Namhyung Kim <[email protected]>
perf sched: Use RC_CHK_EQUAL() to compare pointers
Namhyung Kim <[email protected]>
perf sched: Fix memory leaks for evsel->priv in timehist
Namhyung Kim <[email protected]>
perf sched: Fix memory leaks in 'perf sched map'
Namhyung Kim <[email protected]>
perf sched: Free thread->priv using priv_destructor
Namhyung Kim <[email protected]>
perf sched: Make sure it frees the usage string
Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
Ian Rogers <[email protected]>
perf dso: Add missed dso__put to dso__load_kcore
Namhyung Kim <[email protected]>
perf tools: Fix use-after-free in help_unknown_cmd()
Thomas Fourier <[email protected]>
Fix dma_unmap_sg() nents value
Nuno Sá <[email protected]>
clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
Amir Goldstein <[email protected]>
fanotify: sanitize handle_type values when reporting fid
Luca Weiss <[email protected]>
phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
Krzysztof Kozlowski <[email protected]>
dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
Yuan Chen <[email protected]>
pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state()
Yuan Chen <[email protected]>
pinctrl: sunxi: Fix memory leak on krealloc failure
Jerome Brunet <[email protected]>
PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
Arnd Bergmann <[email protected]>
crypto: arm/aes-neonbs - work around gcc-15 warning
Charles Han <[email protected]>
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
Charles Han <[email protected]>
power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
Rohit Visavalia <[email protected]>
clk: xilinx: vcu: unregister pll_post only if registered correctly
James Cowgill <[email protected]>
media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
Henry Martin <[email protected]>
clk: davinci: Add NULL check in davinci_lpsc_clk_register()
Ivan Stepchenko <[email protected]>
mtd: fix possible integer overflow in erase_xfer()
Svyatoslav Pankratov <[email protected]>
crypto: qat - fix state restore for banks with exceptions
Ahsan Atta <[email protected]>
crypto: qat - allow enabling VFs in the absence of IOMMU
Herbert Xu <[email protected]>
crypto: marvell/cesa - Fix engine load inaccuracy
Suman Kumar Chakraborty <[email protected]>
crypto: qat - use unmanaged allocation for dc_data
Ovidiu Panait <[email protected]>
crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
Lad Prabhakar <[email protected]>
clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks
Hans Zhang <[email protected]>
PCI: rockchip-host: Fix "Unexpected Completion" log message
Kees Cook <[email protected]>
fortify: Fix incorrect reporting of read buffer size
Kees Cook <[email protected]>
staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()
Puranjay Mohan <[email protected]>
bpf, arm64: Fix fp initialization for exception boundary
Thomas Weißschuh <[email protected]>
bpf/preload: Don't select USERMODE_DRIVER
Eric Dumazet <[email protected]>
ipv6: annotate data-races around rt->fib6_nsiblings
Eric Dumazet <[email protected]>
ipv6: fix possible infinite loop in fib6_info_uses_dev()
Eric Dumazet <[email protected]>
ipv6: prevent infinite loop in rt6_nlmsg_size()
Stanislav Fomichev <[email protected]>
vrf: Drop existing dst reference in vrf_ip6_input_dst
Xiumei Mu <[email protected]>
selftests: rtnetlink.sh: remove esp4_offload after test
Jason Xing <[email protected]>
stmmac: xsk: fix negative overflow of budget in zerocopy mode
Tristram Ha <[email protected]>
net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863
Jianbo Liu <[email protected]>
net/mlx5e: Remove skb secpath if xfrm state is not found
Alexei Lazar <[email protected]>
net/mlx5e: Clear Read-Only port buffer size in PBMC before update
Florian Westphal <[email protected]>
netfilter: xt_nfacct: don't assume acct name is null-terminated
Jimmy Assarsson <[email protected]>
can: kvaser_usb: Assign netdev.dev_port based on device channel index
Jimmy Assarsson <[email protected]>
can: kvaser_pciefd: Store device channel index
Stephane Grosjean <[email protected]>
can: peak_usb: fix USB FD devices potential malfunction
Gal Pressman <[email protected]>
selftests: drv-net: Fix remote command checking in require_cmd()
Gabriele Monaco <[email protected]>
tools/rv: Do not skip idle in trace
Kuniyuki Iwashima <[email protected]>
bpf: Disable migration in nf_hook_run_bpf().
Chris Down <[email protected]>
Bluetooth: hci_event: Mask data status from LE ext adv reports
Arseniy Krasnov <[email protected]>
Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
Matthew Wilcox (Oracle) <[email protected]>
memcg_slabinfo: Fix use of PG_slab
Marco Elver <[email protected]>
kcsan: test: Initialize dummy variable
Steven Rostedt <[email protected]>
ring-buffer: Remove ring_buffer_read_prepare_sync()
Kees Cook <[email protected]>
wifi: nl80211: Set num_sub_specs before looping through sub_specs
Kees Cook <[email protected]>
wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
Tamizh Chelvam Raja <[email protected]>
wifi: ath12k: fix endianness handling while accessing wmi service bit
Remi Pommarel <[email protected]>
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
Remi Pommarel <[email protected]>
wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
Alexander Wetzel <[email protected]>
wifi: mac80211: Don't call fq_flow_idx() for management frames
Alexander Wetzel <[email protected]>
wifi: mac80211: Do not schedule stopped TXQs
Murad Masimov <[email protected]>
wifi: plfxlc: Fix error handling in usb driver probe
Moon Hee Lee <[email protected]>
wifi: mac80211: reject TDLS operations when station is not associated
Tze-nan Wu <[email protected]>
rcu: Fix delayed execution of hurry callbacks
Jason Gunthorpe <[email protected]>
iommu/amd: Fix geometry.aperture_end for V2 tables
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: fix kiq locking in KCQ reset
Alex Deucher <[email protected]>
drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: fix kiq locking in KCQ reset
Baochen Qiang <[email protected]>
wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
Thomas Fourier <[email protected]>
mwl8k: Add missing check after DMA map
Bitterblue Smith <[email protected]>
wifi: rtw88: Fix macid assigned to TDLS station
Martin Kaistra <[email protected]>
wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
Eric Dumazet <[email protected]>
tcp: call tcp_measure_rcv_mss() for ooo packets
Juergen Gross <[email protected]>
xen/gntdev: remove struct gntdev_copy_batch from stack
Al Viro <[email protected]>
xen: fix UAF in dmabuf_exp_from_pages()
Edward Srouji <[email protected]>
RDMA/mlx5: Fix UMR modifying of mkey page size
Eric Dumazet <[email protected]>
net_sched: act_ctinfo: use atomic64_t for three counters
William Liu <[email protected]>
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
Easwar Hariharan <[email protected]>
iommu/amd: Enable PASID and ATS capabilities in the correct order
Tiwei Bie <[email protected]>
um: rtc: Avoid shadowing err in uml_rtc_start()
Johan Korsnes <[email protected]>
arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
Fedor Pchelkin <[email protected]>
netfilter: nf_tables: adjust lockdep assertions handling
Phil Sutter <[email protected]>
netfilter: nf_tables: Drop dead code from fill_*_info routines
Shixiong Ou <[email protected]>
fbcon: Fix outdated registered_fb reference in comment
Peter Zijlstra <[email protected]>
sched/psi: Optimize psi_group_change() cpu_clock() usage
Fedor Pchelkin <[email protected]>
drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
Artem Sadovnikov <[email protected]>
refscale: Check that nreaders and loops multiplication doesn't overflow
Finn Thain <[email protected]>
m68k: Don't unregister boot console needlessly
Konrad Dybcio <[email protected]>
drm/msm/dpu: Fill in min_prefill_lines for SC8180X
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Ensure RCU lock is held around bpf_prog_ksym_find
Mark Brown <[email protected]>
kselftest/arm64: Fix check for setting new VLs in sve-ptrace
Eric Dumazet <[email protected]>
net: dst: annotate data-races around dst->output
Eric Dumazet <[email protected]>
net: dst: annotate data-races around dst->input
Stav Aviram <[email protected]>
net/mlx5: Check device memory pointer before usage
xin.guo <[email protected]>
tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
Sergey Senozhatsky <[email protected]>
wifi: ath11k: clear initialized flag for deinit-ed srng lists
Jiasheng Jiang <[email protected]>
iwlwifi: Add missing check for alloc_ordered_workqueue
Xiu Jianfeng <[email protected]>
wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
Daniil Dulov <[email protected]>
wifi: rtl818x: Kill URBs before clearing tx status queue
Zong-Zhe Yang <[email protected]>
wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
Arnd Bergmann <[email protected]>
caif: reduce stack size, again
Haren Myneni <[email protected]>
powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add
Yuan Chen <[email protected]>
bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
Lijo Lazar <[email protected]>
drm/amdgpu: Remove nbiov7.9 replay count reporting
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
Petr Machata <[email protected]>
net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
Mykyta Yatsenko <[email protected]>
selftests/bpf: Fix unintentional switch case fall through
Fushuai Wang <[email protected]>
selftests/bpf: fix signedness bug in redir_partial()
Jiayuan Chen <[email protected]>
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
Jiayuan Chen <[email protected]>
bpf, sockmap: Fix psock incorrectly pointing to sk
Boris Brezillon <[email protected]>
drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
Adrián Larumbe <[email protected]>
drm/panfrost: Fix panfrost device variable name in devfreq
Andy Yan <[email protected]>
drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
Steven Rostedt <[email protected]>
selftests/tracing: Fix false failure of subsystem event test
Alok Tiwari <[email protected]>
staging: nvec: Fix incorrect null termination of battery manufacturer
Slark Xiao <[email protected]>
bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
Dmitry Baryshkov <[email protected]>
interconnect: qcom: sc8180x: specify num_nodes
Dmitry Baryshkov <[email protected]>
interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
Johan Hovold <[email protected]>
soc: qcom: pmic_glink: fix OF node leak
Brahmajit Das <[email protected]>
samples: mei: Fix building on musl libc
Greg Kroah-Hartman <[email protected]>
staging: greybus: gbphy: fix up const issue with the match callback
Lifeng Zheng <[email protected]>
cpufreq: Init policy->rwsem before it may be possibly used
Lifeng Zheng <[email protected]>
cpufreq: Initialize cpufreq-based frequency-invariance later
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
Chanwoo Choi <[email protected]>
PM / devfreq: Fix a index typo in trans_stat
Lifeng Zheng <[email protected]>
PM / devfreq: Check governor before using governor->name
Adam Ford <[email protected]>
arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
Adam Ford <[email protected]>
arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
Annette Kobou <[email protected]>
ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
Moon Hee Lee <[email protected]>
selftests: breakpoints: use suspend_stats to reliably check suspend success
Patrick Delaunay <[email protected]>
arm64: dts: st: fix timer used for ticks
Sumit Gupta <[email protected]>
soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
Albin Törnqvist <[email protected]>
arm: dts: ti: omap: Fixup pinheader typo
Lucas De Marchi <[email protected]>
usb: early: xhci-dbc: Fix early_ioremap leak
Sivan Zohar-Kotzer <[email protected]>
powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
Greg Kroah-Hartman <[email protected]>
Revert "vmci: Prevent the dispatching of uninitialized payloads"
Thomas Weißschuh <[email protected]>
selftests: vDSO: chacha: Correctly skip test if necessary
Denis OSTERLAND-HEIM <[email protected]>
pps: fix poll support
Lizhi Xu <[email protected]>
vmci: Prevent the dispatching of uninitialized payloads
Abdun Nihaal <[email protected]>
staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
Clément Le Goffic <[email protected]>
spi: stm32: Check for cfg availability in stm32_spi_probe
Hans de Goede <[email protected]>
mei: vsc: Unset the event callback on remove and probe errors
Hans de Goede <[email protected]>
mei: vsc: Event notifier fixes
Hans de Goede <[email protected]>
mei: vsc: Destroy mutex after freeing the IRQ
Dmitry Baryshkov <[email protected]>
usb: typec: ucsi: yoga-c630: fix error and remove paths
Sibi Sankar <[email protected]>
firmware: arm_scmi: Fix up turbo frequencies selection
Arnd Bergmann <[email protected]>
cpufreq: armada-8k: make both cpu masks static
Michael Walle <[email protected]>
arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size
Wadim Egorov <[email protected]>
arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
Charalampos Mitrodimas <[email protected]>
usb: misc: apple-mfi-fastcharge: Make power supply names unique
Seungjin Bae <[email protected]>
usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
Krzysztof Kozlowski <[email protected]>
ARM: dts: vfxxx: Correctly use two tuples for timer address
André Apitzsch <[email protected]>
arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
Lijuan Gao <[email protected]>
arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc
Will Deacon <[email protected]>
arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sc7180: Expand IMEM region
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sdm845: Expand IMEM region
Alexander Wilhelm <[email protected]>
soc: qcom: QMI encoding/decoding for big endian
Dmitry Vyukov <[email protected]>
selftests: Fix errno checking in syscall_user_dispatch test
Alexander Stein <[email protected]>
arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
Chen-Yu Tsai <[email protected]>
ASoC: mediatek: use reserved memory or enable buffer pre-allocation
Arnd Bergmann <[email protected]>
ASoC: ops: dynamically allocate struct snd_ctl_elem_value
Kuninori Morimoto <[email protected]>
ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
Randy Dunlap <[email protected]>
io_uring: fix breakage in EXPERT menu
Andreas Gruenbacher <[email protected]>
gfs2: No more self recovery
Konstantin Komarov <[email protected]>
Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
Yangtao Li <[email protected]>
hfsplus: remove mutex_lock check in hfsplus_free_extents
Yangtao Li <[email protected]>
hfs: make splice write available again
Yangtao Li <[email protected]>
hfsplus: make splice write available again
Caleb Sander Mateos <[email protected]>
ublk: use vmalloc for ublk_device's __queues
Edward Adam Davis <[email protected]>
fs/ntfs3: cancle set bad inode after removing name fails
RubenKelevra <[email protected]>
fs_context: fix parameter name in infofc() macro
Al Viro <[email protected]>
parse_longname(): strrchr() expects NUL-terminated string
Richard Guy Briggs <[email protected]>
audit,module: restore audit logging in load failure case
Alexandru Andries <[email protected]>
ASoC: amd: yc: add DMI quirk for ASUS M6501RM
Arnd Bergmann <[email protected]>
ASoC: Intel: fix SND_SOC_SOF dependencies
Richard Fitzgerald <[email protected]>
ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
Adam Queler <[email protected]>
ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
Arnd Bergmann <[email protected]>
ethernet: intel: fix building with large NR_CPUS
Lane Odenbach <[email protected]>
ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
-------------
Diffstat:
Documentation/filesystems/f2fs.rst | 6 +- Documentation/netlink/specs/ethtool.yaml | 6 +- Makefile | 4 +- .../boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi | 1 - arch/arm/boot/dts/nxp/vf/vfxxx.dtsi | 2 +- arch/arm/boot/dts/ti/omap/am335x-boneblack.dts | 2 +- arch/arm/crypto/aes-neonbs-glue.c | 2 +- arch/arm64/boot/dts/exynos/google/gs101.dtsi | 3 + .../boot/dts/freescale/imx8mm-beacon-som.dtsi | 2 + .../boot/dts/freescale/imx8mn-beacon-som.dtsi | 2 + arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 6 +- arch/arm64/boot/dts/qcom/msm8976.dtsi | 2 + arch/arm64/boot/dts/qcom/sa8775p.dtsi | 10 +- arch/arm64/boot/dts/qcom/sc7180.dtsi | 10 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 10 +- arch/arm64/boot/dts/st/stm32mp251.dtsi | 2 +- .../boot/dts/ti/k3-am62p-j722s-common-main.dtsi | 2 +- .../boot/dts/ti/k3-am642-phyboard-electra-rdk.dts | 2 + arch/arm64/net/bpf_jit_comp.c | 1 + arch/m68k/Kconfig.debug | 2 +- arch/m68k/kernel/early_printk.c | 42 +-- arch/m68k/kernel/head.S | 8 +- arch/mips/mm/tlb-r4k.c | 56 +++- arch/powerpc/configs/ppc6xx_defconfig | 1 - arch/powerpc/kernel/eeh.c | 1 + arch/powerpc/kernel/eeh_driver.c | 48 ++-- arch/powerpc/kernel/eeh_pe.c | 10 +- arch/powerpc/kernel/pci-hotplug.c | 3 + arch/powerpc/platforms/pseries/dlpar.c | 52 +++- arch/s390/include/asm/ap.h | 2 +- arch/s390/mm/pgalloc.c | 5 - arch/s390/mm/vmem.c | 5 +- arch/sh/Makefile | 10 +- arch/sh/boot/compressed/Makefile | 4 +- arch/sh/boot/romimage/Makefile | 4 +- arch/um/drivers/rtc_user.c | 2 +- arch/x86/boot/cpuflags.c | 13 + arch/x86/coco/sev/shared.c | 46 ++++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/hw_irq.h | 12 +- arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/irq.c | 63 +++-- arch/x86/mm/extable.c | 5 +- block/blk-settings.c | 13 +- drivers/accel/ivpu/ivpu_debugfs.c | 42 +-- drivers/block/ublk_drv.c | 4 +- drivers/bluetooth/btusb.c | 4 + drivers/bus/mhi/host/pci_generic.c | 8 +- drivers/char/hw_random/mtk-rng.c | 4 +- drivers/clk/at91/sam9x7.c | 20 +- drivers/clk/clk-axi-clkgen.c | 2 +- drivers/clk/davinci/psc.c | 5 + drivers/clk/imx/clk-imx95-blk-ctl.c | 13 +- drivers/clk/renesas/rzv2h-cpg.c | 1 + drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 3 +- drivers/clk/thead/clk-th1520-ap.c | 9 +- drivers/clk/xilinx/xlnx_vcu.c | 4 +- drivers/cpufreq/armada-8k-cpufreq.c | 3 +- drivers/cpufreq/cpufreq.c | 21 +- drivers/cpufreq/intel_pstate.c | 4 +- .../crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 4 +- drivers/crypto/ccp/ccp-debugfs.c | 3 + drivers/crypto/ccp/sev-dev.c | 8 +- drivers/crypto/img-hash.c | 2 +- drivers/crypto/inside-secure/safexcel_hash.c | 8 +- .../crypto/intel/keembay/keembay-ocs-hcu-core.c | 8 +- .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 9 +- .../crypto/intel/qat/qat_common/adf_gen4_hw_data.c | 29 +- drivers/crypto/intel/qat/qat_common/adf_sriov.c | 1 - .../intel/qat/qat_common/adf_transport_debug.c | 4 +- drivers/crypto/intel/qat/qat_common/qat_bl.c | 6 +- .../crypto/intel/qat/qat_common/qat_compression.c | 8 +- drivers/crypto/marvell/cesa/cipher.c | 4 +- drivers/crypto/marvell/cesa/hash.c | 5 +- drivers/devfreq/devfreq.c | 12 +- drivers/dma/mmp_tdma.c | 2 +- drivers/dma/mv_xor.c | 21 +- drivers/dma/nbpfaxi.c | 13 + drivers/firmware/arm_scmi/perf.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 6 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 3 +- drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 20 -- .../gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c | 2 +- drivers/gpu/drm/i915/display/g4x_hdmi.c | 35 ++- drivers/gpu/drm/i915/display/g4x_hdmi.h | 5 +- drivers/gpu/drm/i915/display/intel_ddi.c | 37 ++- drivers/gpu/drm/i915/display/intel_display_types.h | 13 + drivers/gpu/drm/i915/display/intel_hdmi.c | 10 +- drivers/gpu/drm/i915/display/intel_hdmi.h | 2 +- .../drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 1 + drivers/gpu/drm/panfrost/panfrost_devfreq.c | 4 +- drivers/gpu/drm/rockchip/rockchip_drm_fb.c | 9 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 2 +- drivers/gpu/drm/xe/xe_device.c | 1 + drivers/hid/hid-apple.c | 3 +- drivers/i2c/muxes/i2c-mux-mule.c | 3 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 3 +- drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_hem.c | 18 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 87 ++++-- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 8 +- drivers/infiniband/hw/hns/hns_roce_main.c | 22 +- drivers/infiniband/hw/mana/qp.c | 2 +- drivers/infiniband/hw/mlx5/dm.c | 2 +- drivers/infiniband/hw/mlx5/umr.c | 6 +- drivers/interconnect/qcom/sc8180x.c | 6 + drivers/interconnect/qcom/sc8280xp.c | 1 + drivers/iommu/amd/iommu.c | 19 +- drivers/irqchip/Kconfig | 1 + drivers/md/bcache/alloc.c | 64 ++--- drivers/md/bcache/bcache.h | 2 +- drivers/md/bcache/bset.c | 124 ++++----- drivers/md/bcache/bset.h | 40 +-- drivers/md/bcache/btree.c | 69 ++--- drivers/md/bcache/extents.c | 51 ++-- drivers/md/bcache/movinggc.c | 41 +-- drivers/md/bcache/super.c | 3 +- drivers/md/bcache/sysfs.c | 4 +- drivers/md/bcache/util.h | 67 ++++- drivers/md/bcache/writeback.c | 13 +- drivers/md/md.c | 9 +- .../media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 1 + drivers/media/v4l2-core/v4l2-ctrls-core.c | 8 +- drivers/misc/mei/platform-vsc.c | 5 + drivers/misc/mei/vsc-tp.c | 20 +- drivers/mtd/ftl.c | 2 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 2 +- drivers/mtd/nand/raw/atmel/pmecc.c | 6 + drivers/mtd/nand/raw/rockchip-nand-controller.c | 15 ++ drivers/mtd/spi-nor/spansion.c | 31 +++ drivers/net/can/kvaser_pciefd.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 17 +- drivers/net/dsa/microchip/ksz8.c | 3 + drivers/net/dsa/microchip/ksz8_reg.h | 4 +- drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k.h | 3 +- drivers/net/ethernet/intel/i40e/i40e.h | 2 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 1 + drivers/net/ethernet/intel/ixgbe/ixgbe.h | 3 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 + .../mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 - drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 6 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ipa/ipa_sysfs.c | 6 +- drivers/net/mdio/mdio-bcm-unimac.c | 5 +- drivers/net/phy/mscc/mscc_ptp.c | 1 + drivers/net/phy/mscc/mscc_ptp.h | 1 + drivers/net/ppp/pptp.c | 18 +- drivers/net/usb/usbnet.c | 11 +- drivers/net/vrf.c | 2 + drivers/net/wireless/ath/ath11k/hal.c | 4 + drivers/net/wireless/ath/ath11k/mac.c | 12 +- drivers/net/wireless/ath/ath12k/wmi.c | 12 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 8 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 11 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 4 +- drivers/net/wireless/marvell/mwl8k.c | 4 + drivers/net/wireless/purelifi/plfxlc/mac.c | 11 +- drivers/net/wireless/purelifi/plfxlc/mac.h | 2 +- drivers/net/wireless/purelifi/plfxlc/usb.c | 29 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 2 +- drivers/net/wireless/realtek/rtw88/main.c | 4 +- drivers/net/wireless/realtek/rtw89/core.c | 5 + drivers/nvme/target/core.c | 18 +- drivers/pci/controller/pcie-rockchip-host.c | 2 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 4 +- drivers/pci/hotplug/pnv_php.c | 235 ++++++++++++++-- drivers/pci/pcie/aspm.c | 32 ++- drivers/perf/arm-ni.c | 2 + drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 83 +++--- drivers/pinctrl/berlin/berlin.c | 8 +- drivers/pinctrl/pinmux.c | 20 +- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 11 +- drivers/platform/x86/intel/pmt/class.c | 3 +- drivers/platform/x86/intel/pmt/class.h | 1 + drivers/power/supply/cpcap-charger.c | 5 +- drivers/power/supply/max14577_charger.c | 4 +- drivers/powercap/dtpm_cpu.c | 2 + drivers/pps/pps.c | 11 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 2 + drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-hym8563.c | 2 +- drivers/rtc/rtc-nct3018y.c | 2 +- drivers/rtc/rtc-pcf85063.c | 2 +- drivers/rtc/rtc-pcf8563.c | 2 +- drivers/rtc/rtc-rv3028.c | 2 +- drivers/s390/crypto/ap_bus.h | 2 +- drivers/scsi/elx/efct/efct_lio.c | 2 +- drivers/scsi/ibmvscsi_tgt/libsrp.c | 6 +- drivers/scsi/isci/request.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 3 +- drivers/scsi/mvsas/mv_sas.c | 4 +- drivers/scsi/scsi_transport_iscsi.c | 2 + drivers/scsi/sd.c | 4 +- drivers/soc/qcom/pmic_glink.c | 9 +- drivers/soc/qcom/qmi_encdec.c | 46 +++- drivers/soc/tegra/cbb/tegra234-cbb.c | 2 + drivers/soundwire/stream.c | 2 +- drivers/spi/spi-cs42l43.c | 2 +- drivers/spi/spi-stm32.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 1 + drivers/staging/greybus/gbphy.c | 6 +- .../media/atomisp/pci/atomisp_gmin_platform.c | 9 +- drivers/staging/nvec/nvec_power.c | 2 +- drivers/ufs/core/ufshcd.c | 10 +- drivers/usb/early/xhci-dbc.c | 4 + drivers/usb/gadget/composite.c | 5 + drivers/usb/gadget/function/f_hid.c | 7 +- drivers/usb/host/xhci-plat.c | 2 +- drivers/usb/misc/apple-mfi-fastcharge.c | 24 +- drivers/usb/serial/option.c | 2 + drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 19 +- drivers/vdpa/mlx5/core/mr.c | 3 + drivers/vdpa/mlx5/net/mlx5_vnet.c | 12 +- drivers/vdpa/vdpa_user/vduse_dev.c | 1 + drivers/vfio/group.c | 7 +- drivers/vfio/iommufd.c | 4 + drivers/vfio/pci/pds/vfio_dev.c | 1 + drivers/vfio/pci/vfio_pci_core.c | 2 +- drivers/vfio/vfio_main.c | 3 +- drivers/vhost/Kconfig | 18 ++ drivers/vhost/scsi.c | 4 +- drivers/vhost/vhost.c | 244 +++++++++++++++-- drivers/vhost/vhost.h | 22 ++ drivers/video/fbdev/core/fbcon.c | 4 +- drivers/video/fbdev/imxfb.c | 9 +- drivers/watchdog/ziirave_wdt.c | 3 + drivers/xen/gntdev-common.h | 4 + drivers/xen/gntdev-dmabuf.c | 28 +- drivers/xen/gntdev.c | 71 +++-- fs/ceph/crypto.c | 31 +-- fs/exfat/file.c | 5 +- fs/ext4/inline.c | 2 + fs/ext4/inode.c | 3 +- fs/f2fs/data.c | 7 +- fs/f2fs/extent_cache.c | 2 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/gc.c | 1 + fs/f2fs/inode.c | 21 +- fs/f2fs/segment.h | 5 +- fs/f2fs/super.c | 1 + fs/f2fs/sysfs.c | 21 ++ fs/gfs2/util.c | 37 +-- fs/hfs/inode.c | 1 + fs/hfsplus/extents.c | 3 - fs/hfsplus/inode.c | 1 + fs/jfs/jfs_dmap.c | 4 +- fs/nfs/dir.c | 4 +- fs/nfs/export.c | 11 +- fs/nfs/flexfilelayout/flexfilelayout.c | 26 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 6 +- fs/nfs/internal.h | 9 +- fs/nfs/nfs4proc.c | 10 +- fs/notify/fanotify/fanotify.c | 8 +- fs/ntfs3/file.c | 5 +- fs/ntfs3/frecord.c | 7 +- fs/ntfs3/namei.c | 10 +- fs/ntfs3/ntfs_fs.h | 3 +- fs/orangefs/orangefs-debugfs.c | 6 +- fs/proc/generic.c | 2 + fs/proc/inode.c | 2 +- fs/proc/internal.h | 5 + fs/smb/client/cifs_debug.c | 6 +- fs/smb/client/smbdirect.c | 130 +++------ fs/smb/client/smbdirect.h | 4 - fs/smb/server/connection.h | 1 + fs/smb/server/smb2pdu.c | 22 +- fs/smb/server/smb_common.c | 2 +- fs/smb/server/transport_rdma.c | 97 +++---- fs/smb/server/transport_tcp.c | 17 ++ fs/smb/server/vfs.c | 3 +- include/linux/audit.h | 9 +- include/linux/fortify-string.h | 2 +- include/linux/fs_context.h | 2 +- include/linux/ioprio.h | 3 +- include/linux/mlx5/device.h | 1 + include/linux/moduleparam.h | 5 +- include/linux/pps_kernel.h | 1 + include/linux/proc_fs.h | 1 + include/linux/psi_types.h | 6 +- include/linux/ring_buffer.h | 4 +- include/linux/skbuff.h | 23 ++ include/linux/usb/usbnet.h | 1 + include/linux/wait_bit.h | 60 +++++ include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 6 + include/net/dst.h | 4 +- include/net/lwtunnel.h | 8 +- include/net/tc_act/tc_ctinfo.h | 6 +- include/net/udp.h | 24 +- include/sound/tas2781-tlv.h | 2 +- include/uapi/drm/panthor_drm.h | 3 + include/uapi/linux/vhost.h | 29 ++ init/Kconfig | 2 +- kernel/audit.h | 2 +- kernel/auditsc.c | 2 +- kernel/bpf/core.c | 5 +- kernel/bpf/helpers.c | 11 +- kernel/bpf/preload/Kconfig | 1 - kernel/events/core.c | 20 +- kernel/kcsan/kcsan_test.c | 2 +- kernel/module/main.c | 6 +- kernel/rcu/refscale.c | 10 +- kernel/rcu/tree_nocb.h | 2 +- kernel/sched/psi.c | 123 +++++---- kernel/trace/preemptirq_delay_test.c | 13 +- kernel/trace/ring_buffer.c | 63 +---- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- kernel/ucount.c | 2 +- mm/hmm.c | 2 +- mm/swapfile.c | 63 ++--- net/bluetooth/hci_event.c | 8 +- net/caif/cfctrl.c | 294 ++++++++++----------- net/core/dst.c | 4 +- net/core/filter.c | 3 + net/core/netpoll.c | 7 + net/core/skmsg.c | 7 + net/ipv4/route.c | 4 +- net/ipv4/tcp_input.c | 4 +- net/ipv6/ip6_fib.c | 24 +- net/ipv6/ip6_offload.c | 4 +- net/ipv6/ip6mr.c | 3 +- net/ipv6/route.c | 60 +++-- net/mac80211/cfg.c | 2 +- net/mac80211/tdls.c | 2 +- net/mac80211/tx.c | 14 +- net/netfilter/nf_bpf_link.c | 5 +- net/netfilter/nf_tables_api.c | 29 +- net/netfilter/xt_nfacct.c | 4 +- net/packet/af_packet.c | 12 +- net/sched/act_ctinfo.c | 19 +- net/sched/sch_mqprio.c | 2 +- net/sched/sch_netem.c | 40 +++ net/sched/sch_taprio.c | 21 +- net/sunrpc/svcsock.c | 43 ++- net/sunrpc/xprtsock.c | 40 ++- net/tls/tls_sw.c | 13 + net/vmw_vsock/af_vsock.c | 3 +- net/wireless/nl80211.c | 1 + samples/mei/mei-amt-version.c | 2 +- scripts/kconfig/qconf.cc | 2 +- security/apparmor/include/match.h | 8 +- security/apparmor/match.c | 23 +- security/apparmor/policy_unpack_test.c | 6 +- sound/pci/hda/cs35l56_hda.c | 114 +++++--- sound/pci/hda/patch_ca0132.c | 5 +- sound/pci/hda/patch_realtek.c | 3 + sound/soc/amd/yc/acp6x-mach.c | 21 ++ sound/soc/fsl/fsl_xcvr.c | 20 ++ sound/soc/intel/boards/Kconfig | 2 +- .../soc/mediatek/common/mtk-afe-platform-driver.c | 4 +- sound/soc/mediatek/common/mtk-base-afe.h | 1 + sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 7 + sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 7 + sound/soc/mediatek/mt8186/mt8186-afe-pcm.c | 7 + sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 7 + sound/soc/soc-dai.c | 16 +- sound/soc/soc-ops.c | 28 +- sound/usb/mixer_scarlett2.c | 7 + sound/x86/intel_hdmi_audio.c | 2 +- tools/bpf/bpftool/net.c | 15 +- tools/cgroup/memcg_slabinfo.py | 4 +- tools/lib/subcmd/help.c | 12 +- tools/perf/.gitignore | 2 - tools/perf/builtin-sched.c | 99 +++++-- tools/perf/tests/bp_account.c | 1 + tools/perf/util/build-id.c | 2 +- tools/perf/util/evsel.c | 11 + tools/perf/util/evsel.h | 2 + tools/perf/util/symbol.c | 1 + tools/testing/selftests/alsa/utimer-test.c | 1 + tools/testing/selftests/arm64/fp/sve-ptrace.c | 2 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 2 + .../selftests/bpf/progs/verifier_arena_large.c | 110 +++++++- tools/testing/selftests/bpf/veristat.c | 1 + .../breakpoints/step_after_suspend_test.c | 41 ++- tools/testing/selftests/drivers/net/lib/py/env.py | 2 +- .../ftrace/test.d/event/subsystem-enable.tc | 28 +- tools/testing/selftests/net/rtnetlink.sh | 6 + tools/testing/selftests/perf_events/.gitignore | 1 + tools/testing/selftests/perf_events/Makefile | 2 +- tools/testing/selftests/perf_events/mmap.c | 236 +++++++++++++++++ .../selftests/syscall_user_dispatch/sud_test.c | 50 ++-- tools/testing/selftests/vDSO/vdso_test_chacha.c | 3 +- tools/verification/rv/src/in_kernel.c | 4 +- 393 files changed, 3781 insertions(+), 1906 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/369 ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lane Odenbach <[email protected]>
[ Upstream commit 7bab1bd9fdf15b9fa7e6a4b0151deab93df3c80d ]
This fixes the internal microphone in the stated device
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -577,6 +577,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_BOARD_NAME, "8A7F"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), + DMI_MATCH(DMI_BOARD_NAME, "8A81"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/369 ethernet: intel: fix building with large NR_CPUS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 24171a5a4a952c26568ff0d2a0bc8c4708a95e1d ]
With large values of CONFIG_NR_CPUS, three Intel ethernet drivers fail to compile like:
In function ‘i40e_free_q_vector’,
inlined from ‘i40e_vsi_alloc_q_vectors’ at drivers/net/ethernet/intel/i40e/i40e_main.c:12112:3:
571 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)include/linux/rcupdate.h:1084:17: note: in expansion of macro ‘BUILD_BUG_ON’
1084 | BUILD_BUG_ON(offsetof(typeof(*(ptr)), rhf) >= 4096); \drivers/net/ethernet/intel/i40e/i40e_main.c:5113:9: note: in expansion of macro ‘kfree_rcu’
5113 | kfree_rcu(q_vector, rcu);
| ^~~~~~~~~The problem is that the 'rcu' member in 'q_vector' is too far from the start of the structure. Move this member before the CPU mask instead, in all three drivers.
--- drivers/net/ethernet/intel/fm10k/fm10k.h | 3 ++- drivers/net/ethernet/intel/i40e/i40e.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/fm10k/fm10k.h +2 -1
@@ -189,13 +189,14 @@ struct fm10k_q_vector {struct fm10k_ring_container rx, tx;struct napi_struct napi; +struct rcu_head rcu;/* to avoid race with update stats on free */ +cpumask_t affinity_mask;char name[IFNAMSIZ +9 ];#ifdef CONFIG_DEBUG_FS struct dentry *dbg_q_vector;#endif /* CONFIG_DEBUG_FS */ -struct rcu_head rcu;/* to avoid race with update stats on free */ /* for dynamic allocation of rings associated with this q_vector */ struct fm10k_ring ring[]____cacheline_internodealigned_in_smp ;
drivers/net/ethernet/intel/i40e/i40e.h +1 -1
@@ -943,6 +943,7 @@ struct i40e_q_vector {u16 reg_idx;/* register index of the interrupt */ struct napi_struct napi; +struct rcu_head rcu;/* to avoid race with update stats on free */ struct i40e_ring_container rx;struct i40e_ring_container tx;
@@ -953,7 +954,6 @@ struct i40e_q_vector {cpumask_t affinity_mask;struct irq_affinity_notify affinity_notify; -struct rcu_head rcu;/* to avoid race with update stats on free */ char name[I40E_INT_NAME_STR_LEN ];bool arm_wb_state;bool in_busy_poll;
drivers/net/ethernet/intel/ixgbe/ixgbe.h +2 -1
@@ -503,9 +503,10 @@ struct ixgbe_q_vector {struct ixgbe_ring_container rx, tx;struct napi_struct napi; +struct rcu_head rcu;/* to avoid race with update stats on free */ +cpumask_t affinity_mask;int numa_node; -struct rcu_head rcu;/* to avoid race with update stats on free */ char name[IFNAMSIZ +9 ];/* for dynamic allocation of rings associated with this q_vector */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/369 ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Queler <[email protected]>
[ Upstream commit 949ddec3728f3a793a13c1c9003028b9b159aefc ]
This model requires an additional detection quirk to enable the internal microphone.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -528,6 +528,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16z-n000"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Victus by HP Gaming Laptop 15-fb1xxx"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/369 ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 40b1c2f9b299295ed0482e1fee6f46521e6e79e5 ]
The Lenovo Yoga Book 9i GenX has the wrong values in the cirrus,dev-index _DSD property. Add a fixup for this model to ignore the property and hardcode the index from the I2C bus address.
The error in the cirrus,dev-index property would prevent the second amp instance from probing. The component binding would never see all the required instances and so there would not be a binding between patch_realtek.c and the cs35l56 driver.
--- sound/pci/hda/cs35l56_hda.c | 110 +++++++++++++++++++++++++++--------- 1 file changed, 82 insertions(+), 28 deletions(-)
sound/pci/hda/cs35l56_hda.c +82 -28
@@ -876,6 +876,52 @@ static int cs35l56_hda_system_resume(struct device *dev)return 0 ; } +static int cs35l56_hda_fixup_yoga9 (struct cs35l56_hda *cs35l56,int *bus_addr) +{ +/* The cirrus,dev-index property has the wrong values */ +switch (*bus_addr) { +case 0x30 : + cs35l56->index =1 ; +return 0 ; +case 0x31 : + cs35l56->index =0 ; +return 0 ; +default : +/* There is a pseudo-address for broadcast to both amps - ignore it */ +dev_dbg (cs35l56->base.dev,"Ignoring I2C address %#x\n" , *bus_addr); +return 0 ; + } +} + +static const struct { +const char *sub; +int (*fixup_fn)(struct cs35l56_hda *cs35l56,int *bus_addr); +} cs35l56_hda_fixups[] = { + { + .sub ="17AA390B" ,/* Lenovo Yoga Book 9i GenX */ + .fixup_fn = cs35l56_hda_fixup_yoga9, + }, +}; + +static int cs35l56_hda_apply_platform_fixups (struct cs35l56_hda *cs35l56,const char *sub, +int *bus_addr) +{ +int i; + +if (IS_ERR (sub)) +return 0 ; + +for (i =0 ; i <ARRAY_SIZE (cs35l56_hda_fixups); i++) { +if (strcasecmp (cs35l56_hda_fixups[i].sub, sub) ==0 ) { +dev_dbg (cs35l56->base.dev,"Applying fixup for %s\n" , + cs35l56_hda_fixups[i].sub); +return (cs35l56_hda_fixups[i].fixup_fn)(cs35l56, bus_addr); + } + } + +return 0 ; +} +static int cs35l56_hda_read_acpi (struct cs35l56_hda *cs35l56,int hid,int id) {u32 values[HDA_MAX_COMPONENTS ];
@@ -900,39 +946,47 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *cs35l56, int hid, int id)ACPI_COMPANION_SET (cs35l56->base.dev, adev); } - property ="cirrus,dev-index" ; - ret =device_property_count_u32 (cs35l56->base.dev, property); -if (ret <=0 ) - goto err; - -if (ret >ARRAY_SIZE (values)) { - ret = -EINVAL ; - goto err; - } - nval = ret; +/* Initialize things that could be overwritten by a fixup */ + cs35l56->index =-1 ; - ret =device_property_read_u32_array (cs35l56->base.dev, property, values, nval); + sub =acpi_get_subsystem_id (ACPI_HANDLE (cs35l56->base.dev)); + ret =cs35l56_hda_apply_platform_fixups (cs35l56, sub, &id);if (ret) - goto err; +return ret; - cs35l56->index =-1 ; -for (i =0 ; i < nval; i++) { -if (values[i] == id) { - cs35l56->index = i; -break ; - } - } -/* -* It's not an error for the ID to be missing: for I2C there can be -* an alias address that is not a real device. So reject silently. -*/ if (cs35l56->index ==-1 ) { -dev_dbg (cs35l56->base.dev,"No index found in %s\n" , property); - ret = -ENODEV ; - goto err; - } + property ="cirrus,dev-index" ; + ret =device_property_count_u32 (cs35l56->base.dev, property); +if (ret <=0 ) + goto err; - sub =acpi_get_subsystem_id (ACPI_HANDLE (cs35l56->base.dev)); +if (ret >ARRAY_SIZE (values)) { + ret = -EINVAL ; + goto err; + } + nval = ret; + + ret =device_property_read_u32_array (cs35l56->base.dev, property, values, nval); +if (ret) + goto err; + +for (i =0 ; i < nval; i++) { +if (values[i] == id) { + cs35l56->index = i; +break ; + } + } + +/* +* It's not an error for the ID to be missing: for I2C there can be +* an alias address that is not a real device. So reject silently. +*/ +if (cs35l56->index ==-1 ) { +dev_dbg (cs35l56->base.dev,"No index found in %s\n" , property); + ret = -ENODEV ; + goto err; + } + }if (IS_ERR (sub)) { dev_info(cs35l56->base.dev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/369 ASoC: Intel: fix SND_SOC_SOF dependencies
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit e837b59f8b411b5baf5e3de7a5aea10b1c545a63 ]
It is currently possible to configure a kernel with all Intel SoC configs as loadable modules, but the board config as built-in. This causes a link failure in the reference to the snd_soc_sof.ko module:
x86_64-linux-ld: sound/soc/intel/boards/sof_rt5682.o: in function `sof_rt5682_hw_params':
sof_rt5682.c:(.text+0x1f9): undefined reference to `sof_dai_get_mclk'
x86_64-linux-ld: sof_rt5682.c:(.text+0x234): undefined reference to `sof_dai_get_bclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_rt5682.o: in function `sof_rt5682_codec_init':
sof_rt5682.c:(.text+0x3e0): undefined reference to `sof_dai_get_mclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_cs42l42.o: in function `sof_cs42l42_hw_params':
sof_cs42l42.c:(.text+0x2a): undefined reference to `sof_dai_get_bclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_nau8825.o: in function `sof_nau8825_hw_params':
sof_nau8825.c:(.text+0x7f): undefined reference to `sof_dai_get_bclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_da7219.o: in function `da7219_codec_init':
sof_da7219.c:(.text+0xbf): undefined reference to `sof_dai_get_mclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_maxim_common.o: in function `max_98373_hw_params':
sof_maxim_common.c:(.text+0x6f9): undefined reference to `sof_dai_get_tdm_slots'
x86_64-linux-ld: sound/soc/intel/boards/sof_realtek_common.o: in function `rt1015_hw_params':
sof_realtek_common.c:(.text+0x54c): undefined reference to `sof_dai_get_bclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_realtek_common.o: in function `rt1308_hw_params':
sof_realtek_common.c:(.text+0x702): undefined reference to `sof_dai_get_mclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_cirrus_common.o: in function `cs35l41_hw_params':
sof_cirrus_common.c:(.text+0x2f): undefined reference to `sof_dai_get_bclk'
Add an optional dependency on SND_SOC_SOF_INTEL_COMMON, to ensure that whenever the SOF support is in a loadable module, none of the board code can be built-in.
This may be be a little heavy-handed, but I also don't see a reason why one would want the boards to be built-in but not the SoC, so it shouldn't actually cause any usability problems.
--- sound/soc/intel/boards/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/boards/Kconfig +1 -1
@@ -11,7 +11,7 @@ menuconfig SND_SOC_INTEL_MACH kernel: saying N will just cause the configurator to skip all the questions about Intel ASoC machine drivers. -if SND_SOC_INTEL_MACH +if SND_SOC_INTEL_MACH && (SND_SOC_SOF_INTEL_COMMON || !SND_SOC_SOF_INTEL_COMMON) config SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES bool "Use more user friendly long card names"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/369 ASoC: amd: yc: add DMI quirk for ASUS M6501RM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Andries <[email protected]>
[ Upstream commit 6f80be548588429100eb1f5e25dc2a714d583ffe ]
add DMI entry for ASUS Vivobook PRO 15X (M6501RM)
to make the internal microphone function
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -409,6 +409,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "M6501RM"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/369 audit,module: restore audit logging in load failure case
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Guy Briggs <[email protected]>
[ Upstream commit ae1ae11fb277f1335d6bcd4935ba0ea985af3c32 ]
The move of the module sanity check to earlier skipped the audit logging call in the case of failure and to a place where the previously used context is unavailable.
Add an audit logging call for the module loading failure case and get the module name when possible.
--- include/linux/audit.h | 9 ++++----- kernel/audit.h | 2 +- kernel/auditsc.c | 2 +- kernel/module/main.c | 6 ++++-- 4 files changed, 10 insertions(+), 9 deletions(-)
include/linux/audit.h +4 -5
@@ -417,7 +417,7 @@ extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,extern void __audit_log_capset (const struct cred *new,const struct cred *old);extern void __audit_mmap_fd (int fd,int flags);extern void __audit_openat2_how (struct open_how *how); -extern void __audit_log_kern_module (char *name); +extern void __audit_log_kern_module (const char *name);extern void __audit_fanotify (u32 response,struct fanotify_response_info_audit_rule *friar);extern void __audit_tk_injoffset (struct timespec64 offset);extern void __audit_ntp_log (const struct audit_ntp_data *ad);
@@ -519,7 +519,7 @@ static inline void audit_openat2_how(struct open_how *how)__audit_openat2_how (how); } -static inline void audit_log_kern_module (char *name) +static inline void audit_log_kern_module (const char *name) {if (!audit_dummy_context ())__audit_log_kern_module (name);
@@ -677,9 +677,8 @@ static inline void audit_mmap_fd(int fd, int flags)static inline void audit_openat2_how (struct open_how *how) { } -static inline void audit_log_kern_module (char *name) -{ -} +static inline void audit_log_kern_module (const char *name) +{ }static inline void audit_fanotify (u32 response,struct fanotify_response_info_audit_rule *friar) { }
kernel/audit.h +1 -1
@@ -199,7 +199,7 @@ struct audit_context {int argc; } execve;struct { -char *name; +const char *name; } module;struct {struct audit_ntp_data ntp_data;
kernel/auditsc.c +1 -1
@@ -2870,7 +2870,7 @@ void __audit_openat2_how(struct open_how *how) context->type =AUDIT_OPENAT2 ; } -void __audit_log_kern_module (char *name) +void __audit_log_kern_module (const char *name) {struct audit_context *context =audit_context ();
kernel/module/main.c +4 -2
@@ -2898,7 +2898,7 @@ static int load_module(struct load_info *info, const char __user *uargs, module_allocated = true; -audit_log_kern_module (mod->name); +audit_log_kern_module (info->name);/* Reserve our place in the list. */ err =add_unformed_module (mod);
@@ -3058,8 +3058,10 @@ static int load_module(struct load_info *info, const char __user *uargs,* failures once the proper module was allocated and * before that. */ -if (!module_allocated) +if (!module_allocated) { +audit_log_kern_module (info->name ? info->name :"?" );mod_stat_bump_becoming (info, flags); + }free_copy (info, flags);return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/369 parse_longname(): strrchr() expects NUL-terminated string
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 101841c38346f4ca41dc1802c867da990ffb32eb ]
... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it.
Just get a NUL-terminated copy of the entire thing and be done with that...
--- fs/ceph/crypto.c | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-)
fs/ceph/crypto.c +12 -19
@@ -215,35 +215,31 @@ static struct inode *parse_longname(const struct inode *parent,struct ceph_client *cl =ceph_inode_to_client (parent);struct inode *dir =NULL ;struct ceph_vino vino = { .snap =CEPH_NOSNAP }; -char *inode_number; -char *name_end; -int orig_len = *name_len; +char *name_end, *inode_number;int ret = -EIO ; - +/* NUL-terminate */ + char *str __free(kfree) = kmemdup_nul(name, *name_len, GFP_KERNEL); +if (!str) +return ERR_PTR (-ENOMEM );/* Skip initial '_' */ - name++; - name_end =strrchr (name,'_' ); + str++; + name_end =strrchr (str,'_' );if (!name_end) { -doutc (cl,"failed to parse long snapshot name: %s\n" , name); +doutc (cl,"failed to parse long snapshot name: %s\n" , str);return ERR_PTR (-EIO ); } - *name_len = (name_end - name); + *name_len = (name_end - str);if (*name_len <=0 ) {pr_err_client (cl,"failed to parse long snapshot name\n" );return ERR_PTR (-EIO ); }/* Get the inode number */ - inode_number =kmemdup_nul (name_end +1 , - orig_len - *name_len -2 , -GFP_KERNEL ); -if (!inode_number) -return ERR_PTR (-ENOMEM ); + inode_number = name_end +1 ; ret =kstrtou64 (inode_number,10 , &vino.ino);if (ret) { -doutc (cl,"failed to parse inode number: %s\n" , name); - dir =ERR_PTR (ret); - goto out; +doutc (cl,"failed to parse inode number: %s\n" , str); +return ERR_PTR (ret); }/* And finally the inode */
@@ -254,9 +250,6 @@ static struct inode *parse_longname(const struct inode *parent,if (IS_ERR (dir))doutc (cl,"can't find inode %s (%s)\n" , inode_number, name); } - -out: -kfree (inode_number);return dir; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/369 fs_context: fix parameter name in infofc() macro
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: RubenKelevra <[email protected]>
[ Upstream commit ffaf1bf3737f706e4e9be876de4bc3c8fc578091 ]
The macro takes a parameter called "p" but references "fc" internally. This happens to compile as long as callers pass a variable named fc, but breaks otherwise. Rename the first parameter to “fc” to match the usage and to be consistent with warnfc() / errorfc().
--- include/linux/fs_context.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/fs_context.h +1 -1
@@ -202,7 +202,7 @@ void logfc(struct fc_log *log, const char *prefix, char level, const char *fmt,*/ #define infof (fc, fmt, ...) __logfc(fc, 'i', fmt, ## __VA_ARGS__)#define info_plog (p, fmt, ...) __plog(p, 'i', fmt, ## __VA_ARGS__) -#define infofc (p, fmt, ...) __plog((&(fc)->log), 'i', fmt, ## __VA_ARGS__) +#define infofc (fc, fmt, ...) __plog((&(fc)->log), 'i', fmt, ## __VA_ARGS__)/** * warnf - Store supplementary warning message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/369 fs/ntfs3: cancle set bad inode after removing name fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d99208b91933fd2a58ed9ed321af07dacd06ddc3 ]
The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted.
The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier".
In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles".
--- fs/ntfs3/frecord.c | 7 +++---- fs/ntfs3/namei.c | 10 +++------- fs/ntfs3/ntfs_fs.h | 3 +-- 3 files changed, 7 insertions(+), 13 deletions(-)
fs/ntfs3/frecord.c +3 -4
@@ -3057,8 +3057,7 @@ int ni_add_name(struct ntfs_inode *dir_ni, struct ntfs_inode *ni,* ni_rename - Remove one name and insert new name. */ int ni_rename (struct ntfs_inode *dir_ni,struct ntfs_inode *new_dir_ni, -struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de, -bool *is_bad) +struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de) {int err;struct NTFS_DE *de2 =NULL ;
@@ -3081,8 +3080,8 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni, err =ni_add_name (new_dir_ni, ni, new_de);if (!err) { err =ni_remove_name (dir_ni, ni, de, &de2, &undo); -if (err &&ni_remove_name (new_dir_ni, ni, new_de, &de2, &undo)) - *is_bad = true; +WARN_ON (err &&ni_remove_name (new_dir_ni, ni, new_de, &de2, + &undo)); }/*
fs/ntfs3/namei.c +3 -7
@@ -244,7 +244,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,struct ntfs_inode *ni =ntfs_i (inode);struct inode *new_inode =d_inode (new_dentry);struct NTFS_DE *de, *new_de; -bool is_same, is_bad; +bool is_same;/* * de - memory of PATH_MAX bytes: * [0-1024) - original name (dentry->d_name)
@@ -313,12 +313,8 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,if (dir_ni != new_dir_ni)ni_lock_dir2 (new_dir_ni); - is_bad = false; - err =ni_rename (dir_ni, new_dir_ni, ni, de, new_de, &is_bad); -if (is_bad) { -/* Restore after failed rename failed too. */ -_ntfs_bad_inode (inode); - }else if (!err) { + err =ni_rename (dir_ni, new_dir_ni, ni, de, new_de); +if (!err) {simple_rename_timestamp (dir, dentry, new_dir, new_dentry);mark_inode_dirty (inode);mark_inode_dirty (dir);
fs/ntfs3/ntfs_fs.h +1 -2
@@ -584,8 +584,7 @@ int ni_add_name(struct ntfs_inode *dir_ni, struct ntfs_inode *ni, struct NTFS_DE *de);int ni_rename (struct ntfs_inode *dir_ni,struct ntfs_inode *new_dir_ni, -struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de, -bool *is_bad); +struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de);bool ni_is_dirty (struct inode *inode);int ni_set_compress (struct inode *inode,bool compr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/369 ublk: use vmalloc for ublk_devices __queues
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Caleb Sander Mateos <[email protected]>
[ Upstream commit c2f48453b7806d41f5a3270f206a5cd5640ed207 ]
struct ublk_device's __queues points to an allocation with up to UBLK_MAX_NR_QUEUES (4096) queues, each of which have:
- struct ublk_queue (48 bytes)
- Tail array of up to UBLK_MAX_QUEUE_DEPTH (4096) struct ublk_io's, 32 bytes each
This means the full allocation can exceed 512 MB, which may well be impossible to service with contiguous physical pages. Switch to kvcalloc() and kvfree(), since there is no need for physically contiguous memory.
--- drivers/block/ublk_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/block/ublk_drv.c +2 -2
@@ -2116,7 +2116,7 @@ static void ublk_deinit_queues(struct ublk_device *ub)for (i =0 ; i < nr_queues; i++)ublk_deinit_queue (ub, i); -kfree (ub->__queues); +kvfree (ub->__queues); }static int ublk_init_queues (struct ublk_device *ub)
@@ -2127,7 +2127,7 @@ static int ublk_init_queues(struct ublk_device *ub)int i, ret = -ENOMEM ; ub->queue_size = ubq_size; - ub->__queues =kcalloc (nr_queues, ubq_size,GFP_KERNEL ); + ub->__queues =kvcalloc (nr_queues, ubq_size,GFP_KERNEL );if (!ub->__queues)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/369 hfsplus: make splice write available again
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 2eafb669da0bf71fac0838bff13594970674e2b4 ]
Since 5.10, splice() or sendfile() return EINVAL. This was caused by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops").
This patch initializes the splice_write field in file_operations, like most file systems do, to restore the functionality.
--- fs/hfsplus/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfsplus/inode.c +1 -0
@@ -368,6 +368,7 @@ static const struct file_operations hfsplus_file_operations = { .write_iter = generic_file_write_iter, .mmap = generic_file_mmap, .splice_read = filemap_splice_read, + .splice_write = iter_file_splice_write, .fsync = hfsplus_file_fsync, .open = hfsplus_file_open, .release = hfsplus_file_release,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/369 hfs: make splice write available again
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 4c831f30475a222046ded25560c3810117a6cff6 ]
Since 5.10, splice() or sendfile() return EINVAL. This was caused by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops").
This patch initializes the splice_write field in file_operations, like most file systems do, to restore the functionality.
--- fs/hfs/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfs/inode.c +1 -0
@@ -692,6 +692,7 @@ static const struct file_operations hfs_file_operations = { .write_iter = generic_file_write_iter, .mmap = generic_file_mmap, .splice_read = filemap_splice_read, + .splice_write = iter_file_splice_write, .fsync = hfs_file_fsync, .open = hfs_file_open, .release = hfs_file_release,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/369 hfsplus: remove mutex_lock check in hfsplus_free_extents
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit fcb96956c921f1aae7e7b477f2435c56f77a31b4 ]
Syzbot reported an issue in hfsplus filesystem:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346 hfsplus_free_extents+0x700/0xad0 Call Trace: <TASK> hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606 hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56 cont_expand_zero fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347 hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263 notify_change+0xe38/0x10f0 fs/attr.c:420 do_truncate+0x1fb/0x2e0 fs/open.c:65 do_sys_ftruncate+0x2eb/0x380 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") unlock extree before hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_free_extents().
However, when operations such as hfsplus_file_release, hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed concurrently in different files, it is very likely to trigger the WARN_ON, which will lead syzbot and xfstest to consider it as an abnormality.
The comment above this warning also describes one of the easy triggering situations, which can easily trigger and cause xfstest&syzbot to report errors.
[task A] [task B]
->hfsplus_file_release
->hfsplus_file_truncate
->hfs_find_init
->mutex_lock
->mutex_unlock
->hfsplus_write_begin
->hfsplus_get_block
->hfsplus_file_extend
->hfsplus_ext_read_extent
->hfs_find_init
->mutex_lock
->hfsplus_free_extents
WARN_ON(mutex_is_locked) !!!Several threads could try to lock the shared extents tree. And warning can be triggered in one thread when another thread has locked the tree. This is the wrong behavior of the code and we need to remove the warning.
--- fs/hfsplus/extents.c | 3 --- 1 file changed, 3 deletions(-)
fs/hfsplus/extents.c +0 -3
@@ -342,9 +342,6 @@ static int hfsplus_free_extents(struct super_block *sb,int i;int err =0 ; -/* Mapping the allocation file may lock the extent tree */ -WARN_ON (mutex_is_locked (&HFSPLUS_SB (sb)->ext_tree->tree_lock)); -hfsplus_dump_extent (extent);for (i =0 ; i <8 ; extent++, i++) { count =be32_to_cpu (extent->block_count);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/369 Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit a49f0abd8959048af18c6c690b065eb0d65b2d21 ]
This reverts commit 69505fe98f198ee813898cbcaf6770949636430b.
Initially, conditional lock acquisition was removed to fix an xfstest bug that was observed during internal testing. The deadlock reported by syzbot is resolved by reintroducing conditional acquisition. The xfstest bug no longer occurs on kernel version 6.16-rc1 during internal testing. I assume that changes in other modules may have contributed to this.
--- fs/ntfs3/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ntfs3/file.c +4 -1
@@ -392,7 +392,10 @@ static int ntfs_file_mmap(struct file *file, struct vm_area_struct *vma) }if (ni->i_valid < to) { -inode_lock (inode); +if (!inode_trylock (inode)) { + err = -EAGAIN ; + goto out; + } err =ntfs_extend_initialized_size (file, ni, ni->i_valid, to);inode_unlock (inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/369 gfs2: No more self recovery
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit deb016c1669002e48c431d6fd32ea1c20ef41756 ]
When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. Not only is that a very bad idea, it has also never worked because gfs2_recover_func() will refuse to do anything during a withdraw.
However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before commit 04133b607a78 ("gfs2: Prevent double iput for journal on error") and is a NULL pointer dereference since then.
Simply get rid of self recovery to fix that.
--- fs/gfs2/util.c | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-)
fs/gfs2/util.c +11 -20
@@ -232,32 +232,23 @@ static void signal_our_withdraw(struct gfs2_sbd *sdp)*/ ret =gfs2_glock_nq (&sdp->sd_live_gh); +gfs2_glock_put (live_gl);/* drop extra reference we acquired */ +clear_bit (SDF_WITHDRAW_RECOVERY , &sdp->sd_flags); +/* * If we actually got the "live" lock in EX mode, there are no other -* nodes available to replay our journal. So we try to replay it -* ourselves. We hold the "live" glock to prevent other mounters -* during recovery, then just dequeue it and reacquire it in our -* normal SH mode. Just in case the problem that caused us to -* withdraw prevents us from recovering our journal (e.g. io errors -* and such) we still check if the journal is clean before proceeding -* but we may wait forever until another mounter does the recovery. +* nodes available to replay our journal. */ if (ret ==0 ) { -fs_warn (sdp,"No other mounters found. Trying to recover our " -"own journal jid %d.\n" , sdp->sd_lockstruct.ls_jid); -if (gfs2_recover_journal (sdp->sd_jdesc,1 )) -fs_warn (sdp,"Unable to recover our journal jid %d.\n" , - sdp->sd_lockstruct.ls_jid); -gfs2_glock_dq_wait (&sdp->sd_live_gh); -gfs2_holder_reinit (LM_ST_SHARED , -LM_FLAG_NOEXP |GL_EXACT |GL_NOPID , - &sdp->sd_live_gh); -gfs2_glock_nq (&sdp->sd_live_gh); +fs_warn (sdp,"No other mounters found.\n" ); +/* +* We are about to release the lockspace. By keeping live_gl +* locked here, we ensure that the next mounter coming along +* will be a "first" mounter which will perform recovery. +*/ + goto skip_recovery; } -gfs2_glock_put (live_gl);/* drop extra reference we acquired */ -clear_bit (SDF_WITHDRAW_RECOVERY , &sdp->sd_flags); -/* * At this point our journal is evicted, so we need to get a new inode * for it. Once done, we need to call gfs2_find_jhead which
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/369 io_uring: fix breakage in EXPERT menu
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit d1fbe1ebf4a12cabd7945335d5e47718cb2bef99 ]
Add a dependency for IO_URING for the GCOV_PROFILE_URING symbol.
Without this patch the EXPERT config menu ends with "Enable IO uring support" and the menu prompts for GCOV_PROFILE_URING and IO_URING_MOCK_FILE are not subordinate to it. This causes all of the EXPERT Kconfig options that follow GCOV_PROFILE_URING to be display in the "upper" menu (General setup), just following the EXPERT menu.
--- init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
init/Kconfig +1 -1
@@ -1741,7 +1741,7 @@ config IO_URING config GCOV_PROFILE_URING bool "Enable GCOV profiling on the io_uring subsystem" - depends on GCOV_KERNEL + depends on IO_URING && GCOV_KERNEL help Enable GCOV profiling on the io_uring subsystem, to facilitate code coverage testing.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/369 ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit f4c77d5af0a9cd0ee22617baa8b49d0e151fbda7 ]
commit 7f1186a8d738661 ("ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()") checks return value of xlate_tdm_slot_mask() (A1)(A2).
/*
* ...
(Y) * TDM mode can be disabled by passing 0 for @slots. In this case @tx_mask,
* @rx_mask and @slot_width will be ignored.
* ...
*/
int snd_soc_dai_set_tdm_slot(...)
{
...
if (...)
(A1) ret = dai->driver->ops->xlate_tdm_slot_mask(...);
else
(A2) ret = snd_soc_xlate_tdm_slot_mask(...);
if (ret)
goto err;
...
}snd_soc_xlate_tdm_slot_mask() (A2) will return -EINVAL if slots was 0 (X), but snd_soc_dai_set_tdm_slot() allow to use it (Y).
(A) static int snd_soc_xlate_tdm_slot_mask(...)
{
...
if (!slots)
(X) return -EINVAL;
...
}Call xlate_tdm_slot_mask() only if slots was non zero.
--- sound/soc/soc-dai.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
sound/soc/soc-dai.c +9 -7
@@ -273,13 +273,15 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, &rx_mask, }; -if (dai->driver->ops && - dai->driver->ops->xlate_tdm_slot_mask) - ret = dai->driver->ops->xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); -else - ret =snd_soc_xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); -if (ret) - goto err; +if (slots) { +if (dai->driver->ops && + dai->driver->ops->xlate_tdm_slot_mask) + ret = dai->driver->ops->xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); +else + ret =snd_soc_xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); +if (ret) + goto err; + }for_each_pcm_streams (stream)snd_soc_dai_tdm_mask_set (dai, stream, *tdm_mask[stream]);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/369 ASoC: ops: dynamically allocate struct snd_ctl_elem_value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 7e10d7242ea8a5947878880b912ffa5806520705 ]
This structure is really too larget to be allocated on the stack:
sound/soc/soc-ops.c:435:5: error: stack frame size (1296) exceeds limit (1280) in 'snd_soc_limit_volume' [-Werror,-Wframe-larger-than]
Change the function to dynamically allocate it instead.
There is probably a better way to do it since only two integer fields inside of that structure are actually used, but this is the simplest rework for the moment.
--- sound/soc/soc-ops.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
sound/soc/soc-ops.c +15 -11
@@ -642,28 +642,32 @@ EXPORT_SYMBOL_GPL(snd_soc_get_volsw_range);static int snd_soc_clip_to_platform_max (struct snd_kcontrol *kctl) {struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; -struct snd_ctl_elem_value uctl; +struct snd_ctl_elem_value *uctl;int ret;if (!mc->platform_max)return 0 ; - ret = kctl->get (kctl, &uctl); + uctl =kzalloc (sizeof (*uctl),GFP_KERNEL ); +if (!uctl) +return -ENOMEM ; + + ret = kctl->get (kctl, uctl);if (ret <0 ) -return ret; + goto out; -if (uctl.value.integer.value[0 ] > mc->platform_max) - uctl.value.integer.value[0 ] = mc->platform_max; +if (uctl->value.integer.value[0 ] > mc->platform_max) + uctl->value.integer.value[0 ] = mc->platform_max;if (snd_soc_volsw_is_stereo (mc) && - uctl.value.integer.value[1 ] > mc->platform_max) - uctl.value.integer.value[1 ] = mc->platform_max; + uctl->value.integer.value[1 ] > mc->platform_max) + uctl->value.integer.value[1 ] = mc->platform_max; - ret = kctl->put (kctl, &uctl); -if (ret <0 ) -return ret; + ret = kctl->put (kctl, uctl); -return 0 ; +out: +kfree (uctl); +return ret; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/369 ASoC: mediatek: use reserved memory or enable buffer pre-allocation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit ec4a10ca4a68ec97f12f4d17d7abb74db34987db ]
In commit 32c9c06adb5b ("ASoC: mediatek: disable buffer pre-allocation") buffer pre-allocation was disabled to accommodate newer platforms that have a limited reserved memory region for the audio frontend.
Turns out disabling pre-allocation across the board impacts platforms that don't have this reserved memory region. Buffer allocation failures have been observed on MT8173 and MT8183 based Chromebooks under low memory conditions, which results in no audio playback for the user.
Since some MediaTek platforms already have dedicated reserved memory pools for the audio frontend, the plan is to enable this for all of them. This requires device tree changes. As a fallback, reinstate the original policy of pre-allocating audio buffers at probe time of the reserved memory pool cannot be found or used.
This patch covers the MT8173, MT8183, MT8186 and MT8192 platforms for now, the reason being that existing MediaTek platform drivers that supported reserved memory were all platforms that mainly supported ChromeOS, and is also the set of devices that I can verify.
--- sound/soc/mediatek/common/mtk-afe-platform-driver.c | 4 +++- sound/soc/mediatek/common/mtk-base-afe.h | 1 + sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 7 +++++++ sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 7 +++++++ sound/soc/mediatek/mt8186/mt8186-afe-pcm.c | 7 +++++++ sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 7 +++++++ 6 files changed, 32 insertions(+), 1 deletion(-)
sound/soc/mediatek/common/mtk-afe-platform-driver.c +3 -1
@@ -120,7 +120,9 @@ int mtk_afe_pcm_new(struct snd_soc_component *component,struct mtk_base_afe *afe =snd_soc_component_get_drvdata (component); size = afe->mtk_afe_hardware->buffer_bytes_max; -snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , afe->dev,0 , size); +snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , afe->dev, + afe->preallocate_buffers ? size :0 , + size);return 0 ; }
sound/soc/mediatek/common/mtk-base-afe.h +1 -0
@@ -117,6 +117,7 @@ struct mtk_base_afe {struct mtk_base_afe_irq *irqs;int irqs_size;int memif_32bit_supported; +bool preallocate_buffers;struct list_head sub_dais;struct snd_soc_dai_driver *dai_drivers;
sound/soc/mediatek/mt8173/mt8173-afe-pcm.c +7 -0
@@ -13,6 +13,7 @@#include <linux/module.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/dma-mapping.h> #include <linux/pm_runtime.h> #include <sound/soc.h>
@@ -1070,6 +1071,12 @@ static int mt8173_afe_pcm_dev_probe(struct platform_device *pdev) afe->dev = &pdev->dev; + ret =of_reserved_mem_device_init (&pdev->dev); +if (ret) { +dev_info (&pdev->dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } + irq_id =platform_get_irq (pdev,0 );if (irq_id <=0 )return irq_id <0 ? irq_id : -ENXIO ;
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +7 -0
@@ -10,6 +10,7 @@#include <linux/mfd/syscon.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/pm_runtime.h> #include <linux/reset.h>
@@ -1094,6 +1095,12 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) afe->dev = &pdev->dev; dev = afe->dev; + ret =of_reserved_mem_device_init (dev); +if (ret) { +dev_info (dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } +/* initial audio related clock */ ret =mt8183_init_clock (afe);if (ret) {
sound/soc/mediatek/mt8186/mt8186-afe-pcm.c +7 -0
@@ -10,6 +10,7 @@#include <linux/module.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/pm_runtime.h> #include <linux/reset.h> #include <sound/soc.h>
@@ -2835,6 +2836,12 @@ static int mt8186_afe_pcm_dev_probe(struct platform_device *pdev) afe_priv = afe->platform_priv; afe->dev = &pdev->dev; + ret =of_reserved_mem_device_init (dev); +if (ret) { +dev_info (dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } + afe->base_addr =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (afe->base_addr))return PTR_ERR (afe->base_addr);
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +7 -0
@@ -12,6 +12,7 @@#include <linux/mfd/syscon.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/pm_runtime.h> #include <linux/reset.h> #include <sound/soc.h>
@@ -2180,6 +2181,12 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) afe->dev = &pdev->dev; dev = afe->dev; + ret =of_reserved_mem_device_init (dev); +if (ret) { +dev_info (dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } +/* init audio related clock */ ret =mt8192_init_clock (afe);if (ret) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/369 arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 696a4c325fad8af95da6a9d797766d1613831622 ]
TQMa9352 is only using LPDDR4X, so the BUCK2 regulator should be fixed at 600MV.
--- arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi +3 -3
@@ -1,6 +1,6 @@ // SPDX-License-Identifier: (GPL-2.0-or-later OR MIT) /* - * Copyright (c) 2022 TQ-Systems GmbH <[email protected]>, + * Copyright (c) 2022-2025 TQ-Systems GmbH <[email protected]>, * D-82229 Seefeld, Germany. * Author: Markus Niebel */
@@ -110,11 +110,11 @@ buck1: BUCK1 { regulator-ramp-delay = <3125>; }; - /* V_DDRQ - 1.1 LPDDR4 or 0.6 LPDDR4X */ + /* V_DDRQ - 0.6 V for LPDDR4X */ buck2: BUCK2 { regulator-name = "BUCK2"; regulator-min-microvolt = <600000>; - regulator-max-microvolt = <1100000>; + regulator-max-microvolt = <600000>; regulator-boot-on; regulator-always-on; regulator-ramp-delay = <3125>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/369 selftests: Fix errno checking in syscall_user_dispatch test
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Vyukov <[email protected]>
[ Upstream commit b89732c8c8357487185f260a723a060b3476144e ]
Successful syscalls don't change errno, so checking errno is wrong to ensure that a syscall has failed. For example for the following sequence:
prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0xff, 0); EXPECT_EQ(EINVAL, errno); prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0x0, &sel); EXPECT_EQ(EINVAL, errno);
only the first syscall may fail and set errno, but the second may succeed and keep errno intact, and the check will falsely pass.
Or if errno happened to be EINVAL before, even the first check may falsely pass.
Also use EXPECT/ASSERT consistently. Currently there is an inconsistent mix without obvious reasons for usage of one or another.
--- .../syscall_user_dispatch/sud_test.c | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-)
tools/testing/selftests/syscall_user_dispatch/sud_test.c +25 -25
@@ -79,6 +79,21 @@ TEST_SIGNAL(dispatch_trigger_sigsys, SIGSYS) } } +static void prctl_valid (struct __test_metadata *_metadata, +unsigned long op,unsigned long off, +unsigned long size,void *sel) +{ +EXPECT_EQ (0 ,prctl (PR_SET_SYSCALL_USER_DISPATCH , op, off, size, sel)); +} + +static void prctl_invalid (struct __test_metadata *_metadata, +unsigned long op,unsigned long off, +unsigned long size,void *sel,int err) +{ +EXPECT_EQ (-1 ,prctl (PR_SET_SYSCALL_USER_DISPATCH , op, off, size, sel)); +EXPECT_EQ (err, errno); +} +TEST (bad_prctl_param) {char sel =SYSCALL_DISPATCH_FILTER_ALLOW ;
@@ -86,57 +101,42 @@ TEST(bad_prctl_param)/* Invalid op */ op =-1 ; -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0 ,0 , &sel); -ASSERT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0 ,0 , &sel,EINVAL );/* PR_SYS_DISPATCH_OFF */ op =PR_SYS_DISPATCH_OFF ;/* offset != 0 */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x1 ,0x0 ,0 ); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x1 ,0x0 ,0 ,EINVAL );/* len != 0 */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0xff ,0 ); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x0 ,0xff ,0 ,EINVAL );/* sel != NULL */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0x0 , &sel); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x0 ,0x0 , &sel,EINVAL );/* Valid parameter */ - errno =0 ; -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0x0 ,0x0 ); -EXPECT_EQ (0 , errno); +prctl_valid (_metadata, op,0x0 ,0x0 ,0x0 );/* PR_SYS_DISPATCH_ON */ op =PR_SYS_DISPATCH_ON ;/* Dispatcher region is bad (offset > 0 && len == 0) */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x1 ,0x0 , &sel); -EXPECT_EQ (EINVAL , errno); -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,-1L ,0x0 , &sel); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x1 ,0x0 , &sel,EINVAL ); +prctl_invalid (_metadata, op,-1L ,0x0 , &sel,EINVAL );/* Invalid selector */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0x1 , (void *)-1 ); -ASSERT_EQ (EFAULT , errno); +prctl_invalid (_metadata, op,0x0 ,0x1 , (void *)-1 ,EFAULT );/* * Dispatcher range overflows unsigned long */ -prctl (PR_SET_SYSCALL_USER_DISPATCH ,PR_SYS_DISPATCH_ON ,1 ,-1L , &sel); - ASSERT_EQ(EINVAL, errno) { -TH_LOG ("Should reject bad syscall range" ); - } +prctl_invalid (_metadata,PR_SYS_DISPATCH_ON ,1 ,-1L , &sel,EINVAL );/* * Allowed range overflows usigned long */ -prctl (PR_SET_SYSCALL_USER_DISPATCH ,PR_SYS_DISPATCH_ON ,-1L ,0x1 , &sel); - ASSERT_EQ(EINVAL, errno) { -TH_LOG ("Should reject bad syscall range" ); - } +prctl_invalid (_metadata,PR_SYS_DISPATCH_ON ,-1L ,0x1 , &sel,EINVAL ); }/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/369 soc: qcom: QMI encoding/decoding for big endian
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Wilhelm <[email protected]>
[ Upstream commit 3ced38da5f7de4c260f9eaa86fc805827953243a ]
The QMI_DATA_LEN type may have different sizes. Taking the element's address of that type and interpret it as a smaller sized ones works fine for little endian platforms but not for big endian ones. Instead use temporary variables of smaller sized types and cast them correctly to support big endian platforms.
--- drivers/soc/qcom/qmi_encdec.c | 46 +++++++++++++++++++++++++++++------ 1 file changed, 38 insertions(+), 8 deletions(-)
drivers/soc/qcom/qmi_encdec.c +38 -8
@@ -304,6 +304,8 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf,const void *buf_src;int encode_tlv =0 ;int rc; +u8 val8; +u16 val16;if (!ei_array)return 0 ;
@@ -338,7 +340,6 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf,break ;case QMI_DATA_LEN : -memcpy (&data_len_value, buf_src, temp_ei->elem_size); data_len_sz = temp_ei->elem_size ==sizeof (u8) ?sizeof (u8) :sizeof (u16);/* Check to avoid out of range buffer access */
@@ -348,8 +349,17 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf, __func__);return -ETOOSMALL ; } - rc =qmi_encode_basic_elem (buf_dst, &data_len_value, -1 , data_len_sz); +if (data_len_sz ==sizeof (u8)) { + val8 = *(u8 *)buf_src; + data_len_value = (u32 )val8; + rc =qmi_encode_basic_elem (buf_dst, &val8, +1 , data_len_sz); + }else { + val16 = *(u16 *)buf_src; + data_len_value = (u32 )le16_to_cpu (val16); + rc =qmi_encode_basic_elem (buf_dst, &val16, +1 , data_len_sz); + }UPDATE_ENCODE_VARIABLES (temp_ei, buf_dst, encoded_bytes, tlv_len, encode_tlv, rc);
@@ -523,14 +533,23 @@ static int qmi_decode_string_elem(const struct qmi_elem_info *ei_array,u32 string_len =0 ;u32 string_len_sz =0 ;const struct qmi_elem_info *temp_ei = ei_array; +u8 val8; +u16 val16;if (dec_level ==1 ) { string_len = tlv_len; }else { string_len_sz = temp_ei->elem_len <=U8_MAX ?sizeof (u8) :sizeof (u16); - rc =qmi_decode_basic_elem (&string_len, buf_src, -1 , string_len_sz); +if (string_len_sz ==sizeof (u8)) { + rc =qmi_decode_basic_elem (&val8, buf_src, +1 , string_len_sz); + string_len = (u32 )val8; + }else { + rc =qmi_decode_basic_elem (&val16, buf_src, +1 , string_len_sz); + string_len = (u32 )val16; + } decoded_bytes += rc; }
@@ -604,6 +623,9 @@ static int qmi_decode(const struct qmi_elem_info *ei_array, void *out_c_struct,u32 decoded_bytes =0 ;const void *buf_src = in_buf;int rc; +u8 val8; +u16 val16; +u32 val32;while (decoded_bytes < in_buf_len) {if (dec_level >=2 && temp_ei->data_type ==QMI_EOTI )
@@ -642,9 +664,17 @@ static int qmi_decode(const struct qmi_elem_info *ei_array, void *out_c_struct,if (temp_ei->data_type ==QMI_DATA_LEN ) { data_len_sz = temp_ei->elem_size ==sizeof (u8) ?sizeof (u8) :sizeof (u16); - rc =qmi_decode_basic_elem (&data_len_value, buf_src, -1 , data_len_sz); -memcpy (buf_dst, &data_len_value,sizeof (u32)); +if (data_len_sz ==sizeof (u8)) { + rc =qmi_decode_basic_elem (&val8, buf_src, +1 , data_len_sz); + data_len_value = (u32 )val8; + }else { + rc =qmi_decode_basic_elem (&val16, buf_src, +1 , data_len_sz); + data_len_value = (u32 )val16; + } + val32 =cpu_to_le32 (data_len_value); +memcpy (buf_dst, &val32,sizeof (u32)); temp_ei = temp_ei +1 ; buf_dst = out_c_struct + temp_ei->offset; tlv_len -= data_len_sz;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/369 arm64: dts: qcom: sdm845: Expand IMEM region
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 81a4a7de3d4031e77b5796479ef21aefb0862807 ]
We need more than what is currently described, expand the region to its actual boundaries.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/qcom/sdm845.dtsi +5 -5
@@ -5074,18 +5074,18 @@ spmi_bus: spmi@c440000 { #interrupt-cells = <4>; }; - sram@146bf000 { + sram@14680000 { compatible = "qcom,sdm845-imem", "syscon", "simple-mfd"; - reg = <0 0x146bf000 0 0x1000>; + reg = <0 0x14680000 0 0x40000>; #address-cells = <1>; #size-cells = <1>; - ranges = <0 0 0x146bf000 0x1000>; + ranges = <0 0 0x14680000 0x40000>; - pil-reloc@94c { + pil-reloc@3f94c { compatible = "qcom,pil-reloc-info"; - reg = <0x94c 0xc8>; + reg = <0x3f94c 0xc8>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/369 arm64: dts: qcom: sc7180: Expand IMEM region
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 965e28cad4739b11f1bc58c0a9935e025938bb1f ]
We need more than what is currently described, expand the region to its actual boundaries.
--- arch/arm64/boot/dts/qcom/sc7180.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/qcom/sc7180.dtsi +5 -5
@@ -3524,18 +3524,18 @@ spmi_bus: spmi@c440000 { #interrupt-cells = <4>; }; - sram@146aa000 { + sram@14680000 { compatible = "qcom,sc7180-imem", "syscon", "simple-mfd"; - reg = <0 0x146aa000 0 0x2000>; + reg = <0 0x14680000 0 0x2e000>; #address-cells = <1>; #size-cells = <1>; - ranges = <0 0 0x146aa000 0x2000>; + ranges = <0 0 0x14680000 0x2e000>; - pil-reloc@94c { + pil-reloc@2a94c { compatible = "qcom,pil-reloc-info"; - reg = <0x94c 0xc8>; + reg = <0x2a94c 0xc8>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/369 arm64: dts: exynos: gs101: Add local-timer-stop to cpuidle nodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
[ Upstream commit b649082312dd1a4c3989bbdb7c25eb711e9b1d94 ]
In preparation for switching to the architected timer as the primary clockevents device, mark the cpuidle nodes with the 'local-timer-stop' property to indicate that an alternative clockevents device must be used for waking up from the "c2" idle state.
--- arch/arm64/boot/dts/exynos/google/gs101.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/exynos/google/gs101.dtsi +3 -0
@@ -155,6 +155,7 @@ ANANKE_CPU_SLEEP: cpu-ananke-sleep { idle-state-name = "c2"; compatible = "arm,idle-state"; arm,psci-suspend-param = <0x0010000>; + local-timer-stop; entry-latency-us = <70>; exit-latency-us = <160>; min-residency-us = <2000>;
@@ -164,6 +165,7 @@ ENYO_CPU_SLEEP: cpu-enyo-sleep { idle-state-name = "c2"; compatible = "arm,idle-state"; arm,psci-suspend-param = <0x0010000>; + local-timer-stop; entry-latency-us = <150>; exit-latency-us = <190>; min-residency-us = <2500>;
@@ -173,6 +175,7 @@ HERA_CPU_SLEEP: cpu-hera-sleep { idle-state-name = "c2"; compatible = "arm,idle-state"; arm,psci-suspend-param = <0x0010000>; + local-timer-stop; entry-latency-us = <235>; exit-latency-us = <220>; min-residency-us = <3500>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/369 arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijuan Gao <[email protected]>
[ Upstream commit 7bd7209e9cb11c8864e601d915008da088476f0c ]
Fix the incorrect IRQ numbers for ready and handover on sa8775p. The correct values are as follows:
Fatal interrupt - 0
Ready interrupt - 1
Handover interrupt - 2
Stop acknowledge interrupt - 3
--- arch/arm64/boot/dts/qcom/sa8775p.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/qcom/sa8775p.dtsi +5 -5
@@ -3797,8 +3797,8 @@ remoteproc_gpdsp0: remoteproc@20c00000 { interrupts-extended = <&intc GIC_SPI 768 IRQ_TYPE_EDGE_RISING>, <&smp2p_gpdsp0_in 0 0>, - <&smp2p_gpdsp0_in 2 0>, <&smp2p_gpdsp0_in 1 0>, + <&smp2p_gpdsp0_in 2 0>, <&smp2p_gpdsp0_in 3 0>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -3840,8 +3840,8 @@ remoteproc_gpdsp1: remoteproc@21c00000 { interrupts-extended = <&intc GIC_SPI 624 IRQ_TYPE_EDGE_RISING>, <&smp2p_gpdsp1_in 0 0>, - <&smp2p_gpdsp1_in 2 0>, <&smp2p_gpdsp1_in 1 0>, + <&smp2p_gpdsp1_in 2 0>, <&smp2p_gpdsp1_in 3 0>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -3965,8 +3965,8 @@ remoteproc_cdsp0: remoteproc@26300000 { interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp0_in 0 IRQ_TYPE_EDGE_RISING>, - <&smp2p_cdsp0_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp0_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp0_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp0_in 3 IRQ_TYPE_EDGE_RISING>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -4097,8 +4097,8 @@ remoteproc_cdsp1: remoteproc@2a300000 { interrupts-extended = <&intc GIC_SPI 798 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp1_in 0 IRQ_TYPE_EDGE_RISING>, - <&smp2p_cdsp1_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp1_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp1_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp1_in 3 IRQ_TYPE_EDGE_RISING>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -4253,8 +4253,8 @@ remoteproc_adsp: remoteproc@30000000 { interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, - <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/369 arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Apitzsch <[email protected]>
[ Upstream commit 76270a18dbdf0bb50615f1b29d2cae8d683da01e ]
The blsp_dma controller is shared between the different subsystems, which is why it is already initialized by the firmware. We should not reinitialize it from Linux to avoid potential other users of the DMA engine to misbehave.
In mainline this can be described using the "qcom,controlled-remotely" property. In the downstream/vendor kernel from Qualcomm there is an opposite "qcom,managed-locally" property. This property is *not* set for the qcom,sps-dma@7884000 and qcom,sps-dma@7ac4000 [1] so adding "qcom,controlled-remotely" upstream matches the behavior of the downstream/vendor kernel.
Adding this fixes booting Longcheer L9360.
--- arch/arm64/boot/dts/qcom/msm8976.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8976.dtsi +2 -0
@@ -1330,6 +1330,7 @@ blsp1_dma: dma-controller@7884000 { clock-names = "bam_clk"; #dma-cells = <1>; qcom,ee = <0>; + qcom,controlled-remotely; }; blsp1_uart1: serial@78af000 {
@@ -1450,6 +1451,7 @@ blsp2_dma: dma-controller@7ac4000 { clock-names = "bam_clk"; #dma-cells = <1>; qcom,ee = <0>; + qcom,controlled-remotely; }; blsp2_uart2: serial@7af0000 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/369 ARM: dts: vfxxx: Correctly use two tuples for timer address
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f3440dcf8b994197c968fbafe047ce27eed226e8 ]
Address and size-cells are 1 and the ftm timer node takes two address spaces in "reg" property, so this should be in two <> tuples. Change has no functional impact, but original code is confusing/less readable.
--- arch/arm/boot/dts/nxp/vf/vfxxx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nxp/vf/vfxxx.dtsi +1 -1
@@ -604,7 +604,7 @@ usbmisc1: usb@400b4800 { ftm: ftm@400b8000 { compatible = "fsl,ftm-timer"; - reg = <0x400b8000 0x1000 0x400b9000 0x1000>; + reg = <0x400b8000 0x1000>, <0x400b9000 0x1000>; interrupts = <44 IRQ_TYPE_LEVEL_HIGH>; clock-names = "ftm-evt", "ftm-src", "ftm-evt-counter-en", "ftm-src-counter-en";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/369 usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit d9e496a9fb4021a9e6b11e7ba221a41a2597ac27 ]
The variable of_match was incorrectly declared as a bool. It is assigned the return value of of_match_device(), which is a pointer of type const struct of_device_id *.
--- drivers/usb/host/xhci-plat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +1 -1
@@ -152,7 +152,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const sint ret;int irq;struct xhci_plat_priv *priv =NULL ; -bool of_match; +const struct of_device_id *of_match;if (usb_disabled ())return -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/369 usb: misc: apple-mfi-fastcharge: Make power supply names unique
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charalampos Mitrodimas <[email protected]>
[ Upstream commit 43007b89fb2de746443fbbb84aedd1089afdf582 ]
When multiple Apple devices are connected concurrently, the apple-mfi-fastcharge driver fails to probe the subsequent devices with the following error:
sysfs: cannot create duplicate filename '/class/power_supply/apple_mfi_fastcharge' apple-mfi-fastcharge 5-2.4.3.3: probe of 5-2.4.3.3 failed with error -17
This happens because the driver uses a fixed power supply name ("apple_mfi_fastcharge") for all devices, causing a sysfs name conflict when a second device is connected.
Fix this by generating unique names using the USB bus and device number (e.g., "apple_mfi_fastcharge_5-12"). This ensures each connected device gets a unique power supply entry in sysfs.
The change requires storing a copy of the power_supply_desc structure in the per-device mfi_device struct, since the name pointer needs to remain valid for the lifetime of the power supply registration.
--- drivers/usb/misc/apple-mfi-fastcharge.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)
drivers/usb/misc/apple-mfi-fastcharge.c +21 -3
@@ -44,6 +44,7 @@ MODULE_DEVICE_TABLE(usb, mfi_fc_id_table);struct mfi_device {struct usb_device *udev;struct power_supply *battery; +struct power_supply_desc battery_desc;int charge_type; };
@@ -178,6 +179,7 @@ static int mfi_fc_probe(struct usb_device *udev) {struct power_supply_config battery_cfg = {};struct mfi_device *mfi =NULL ; +char *battery_name;int err;if (!mfi_fc_match (udev))
@@ -187,23 +189,38 @@ static int mfi_fc_probe(struct usb_device *udev)if (!mfi)return -ENOMEM ; + battery_name =kasprintf (GFP_KERNEL ,"apple_mfi_fastcharge_%d-%d" , + udev->bus->busnum, udev->devnum); +if (!battery_name) { + err = -ENOMEM ; + goto err_free_mfi; + } + + mfi->battery_desc = apple_mfi_fc_desc; + mfi->battery_desc.name = battery_name; + battery_cfg.drv_data = mfi; mfi->charge_type =POWER_SUPPLY_CHARGE_TYPE_TRICKLE ; mfi->battery =power_supply_register (&udev->dev, - &apple_mfi_fc_desc, + &mfi->battery_desc, &battery_cfg);if (IS_ERR (mfi->battery)) {dev_err (&udev->dev,"Can't register battery\n" ); err =PTR_ERR (mfi->battery); -kfree (mfi); -return err; + goto err_free_name; } mfi->udev =usb_get_dev (udev);dev_set_drvdata (&udev->dev, mfi);return 0 ; + +err_free_name: +kfree (battery_name); +err_free_mfi: +kfree (mfi); +return err; }static void mfi_fc_disconnect (struct usb_device *udev)
@@ -213,6 +230,7 @@ static void mfi_fc_disconnect(struct usb_device *udev) mfi =dev_get_drvdata (&udev->dev);if (mfi->battery)power_supply_unregister (mfi->battery); +kfree (mfi->battery_desc.name);dev_set_drvdata (&udev->dev,NULL );usb_put_dev (mfi->udev);kfree (mfi);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/369 arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wadim Egorov <[email protected]>
[ Upstream commit 945e48a39c957924bc84d1a6c137da039e13855b ]
For the ICSSG PHYs to operate correctly, a 25 MHz reference clock must be supplied on CLKOUT0. Previously, our bootloader configured this clock, which is why the PRU Ethernet ports appeared to work, but the change never made it into the device tree.
Add clock properties to make EXT_REFCLK1.CLKOUT0 output a 25MHz clock.
--- arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts +2 -0
@@ -319,6 +319,8 @@ AM64X_IOPAD(0x0040, PIN_OUTPUT, 7) /* (U21) GPMC0_AD1.GPIO0_16 */ &icssg0_mdio { pinctrl-names = "default"; pinctrl-0 = <&icssg0_mdio_pins_default &clkout0_pins_default>; + assigned-clocks = <&k3_clks 157 123>; + assigned-clock-parents = <&k3_clks 157 125>; status = "okay"; icssg0_phy1: ethernet-phy@1 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/369 arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit fdc8ad019ab9a2308b8cef54fbc366f482fb746f ]
Pinmux registers ends at 0x000f42ac (including). Thus, the size argument of the pinctrl-single node has to be 0x2b0. Fix it.
This will fix the following error:
pinctrl-single f4000.pinctrl: mux offset out of range: 0x2ac (0x2ac)
--- arch/arm64/boot/dts/ti/k3-am62p-j722s-common-main.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62p-j722s-common-main.dtsi +1 -1
@@ -250,7 +250,7 @@ secure_proxy_sa3: mailbox@43600000 { main_pmx0: pinctrl@f4000 { compatible = "pinctrl-single"; - reg = <0x00 0xf4000 0x00 0x2ac>; + reg = <0x00 0xf4000 0x00 0x2b0>; #pinctrl-cells = <1>; pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0xffffffff>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/369 cpufreq: armada-8k: make both cpu masks static
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit b1b41bc072baf7301b1ae95fe417de09a5ad47e2 ]
An earlier patch marked one of the two CPU masks as 'static' to reduce stack usage, but if CONFIG_NR_CPUS is large enough, the function still produces a warning for compile testing:
drivers/cpufreq/armada-8k-cpufreq.c: In function 'armada_8k_cpufreq_init':drivers/cpufreq/armada-8k-cpufreq.c:203:1: error: the frame size of 1416 bytes is larger than 1408 bytes [-Werror=frame-larger-than=]
Normally this should be done using alloc_cpumask_var(), but since the driver already has a static mask and the probe function is not called concurrently, use the same trick for both.
--- drivers/cpufreq/armada-8k-cpufreq.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/cpufreq/armada-8k-cpufreq.c +1 -2
@@ -132,7 +132,7 @@ static int __init armada_8k_cpufreq_init(void)int ret =0 , opps_index =0 , cpu, nb_cpus;struct freq_table *freq_tables;struct device_node *node; -static struct cpumask cpus; +static struct cpumask cpus, shared_cpus; node =of_find_matching_node_and_match (NULL , armada_8k_cpufreq_of_match,NULL );
@@ -154,7 +154,6 @@ static int __init armada_8k_cpufreq_init(void)* divisions of it). */ for_each_cpu (cpu, &cpus) { -struct cpumask shared_cpus;struct device *cpu_dev;struct clk *clk;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/369 firmware: arm_scmi: Fix up turbo frequencies selection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sibi Sankar <[email protected]>
[ Upstream commit ad28fc31dd702871764e9294d4f2314ad78d24a9 ]
Sustained frequency when greater than or equal to 4Ghz on 64-bit devices currently result in marking all frequencies as turbo. Address the turbo frequency selection bug by fixing the truncation.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_scmi/perf.c +1 -1
@@ -892,7 +892,7 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph, freq = dom->opp[idx].indicative_freq * dom->mult_factor;/* All OPPs above the sustained frequency are treated as turbo */ - data.turbo = freq > dom->sustained_freq_khz *1000 ; + data.turbo = freq > dom->sustained_freq_khz *1000UL ; data.level = dom->opp[idx].perf; data.freq = freq;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/369 usb: typec: ucsi: yoga-c630: fix error and remove paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 168c3896f32e78e7b87f6aa9e85af36e47a9f96c ]
Fix memory leak and call ucsi_destroy() from the driver's remove function and probe's error path in order to remove debugfs files and free the memory. Also call yoga_c630_ec_unregister_notify() in the probe's error path.
--- drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/usb/typec/ucsi/ucsi_yoga_c630.c +16 -3
@@ -133,17 +133,30 @@ static int yoga_c630_ucsi_probe(struct auxiliary_device *adev, ret =yoga_c630_ec_register_notify (ec, &uec->nb);if (ret) -return ret; + goto err_destroy; + + ret =ucsi_register (uec->ucsi); +if (ret) + goto err_unregister; + +return 0 ; -return ucsi_register (uec->ucsi); +err_unregister: +yoga_c630_ec_unregister_notify (uec->ec, &uec->nb); + +err_destroy: +ucsi_destroy (uec->ucsi); + +return ret; }static void yoga_c630_ucsi_remove (struct auxiliary_device *adev) {struct yoga_c630_ucsi *uec =auxiliary_get_drvdata (adev); -yoga_c630_ec_unregister_notify (uec->ec, &uec->nb);ucsi_unregister (uec->ucsi); +yoga_c630_ec_unregister_notify (uec->ec, &uec->nb); +ucsi_destroy (uec->ucsi); }static const struct auxiliary_device_id yoga_c630_ucsi_id_table[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/369 mei: vsc: Destroy mutex after freeing the IRQ
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 35b7f3525fe0a7283de7116e3c75ee3ccb3b14c9 ]
The event_notify callback which runs from vsc_tp_thread_isr may call vsc_tp_xfer() which locks the mutex. So the ISR depends on the mutex.
Move the mutex_destroy() call to after free_irq() to ensure that the ISR is not running while the mutex is destroyed.
--- drivers/misc/mei/vsc-tp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/misc/mei/vsc-tp.c +4 -4
@@ -554,10 +554,10 @@ static int vsc_tp_probe(struct spi_device *spi)return 0 ; err_destroy_lock: -mutex_destroy (&tp->mutex); -free_irq (spi->irq, tp); +mutex_destroy (&tp->mutex); +return ret; }
@@ -567,9 +567,9 @@ static void vsc_tp_remove(struct spi_device *spi)platform_device_unregister (tp->pdev); -mutex_destroy (&tp->mutex); -free_irq (spi->irq, tp); + +mutex_destroy (&tp->mutex); }static void vsc_tp_shutdown (struct spi_device *spi)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/369 mei: vsc: Event notifier fixes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 18f14b2e7f73c7ec272d833d570b632286467c7d ]
vsc_tp_register_event_cb() can race with vsc_tp_thread_isr(), add a mutex to protect against this.
--- drivers/misc/mei/vsc-tp.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/misc/mei/vsc-tp.c +9 -3
@@ -79,9 +79,8 @@ struct vsc_tp {vsc_tp_event_cb_t event_notify;void *event_notify_context; - -/* used to protect command download */ -struct mutex mutex; +struct mutex event_notify_mutex;/* protects event_notify + context */ +struct mutex mutex;/* protects command download */ };/* GPIO resources */
@@ -113,6 +112,8 @@ static irqreturn_t vsc_tp_thread_isr(int irq, void *data) {struct vsc_tp *tp = data; +guard (mutex)(&tp->event_notify_mutex); +if (tp->event_notify) tp->event_notify (tp->event_notify_context);
@@ -401,6 +402,8 @@ EXPORT_SYMBOL_NS_GPL(vsc_tp_need_read, VSC_TP);int vsc_tp_register_event_cb (struct vsc_tp *tp,vsc_tp_event_cb_t event_cb,void *context) { +guard (mutex)(&tp->event_notify_mutex); + tp->event_notify = event_cb; tp->event_notify_context = context;
@@ -532,6 +535,7 @@ static int vsc_tp_probe(struct spi_device *spi)return ret;mutex_init (&tp->mutex); +mutex_init (&tp->event_notify_mutex);/* only one child acpi device */ ret = acpi_dev_for_each_child(ACPI_COMPANION(dev),
@@ -556,6 +560,7 @@ static int vsc_tp_probe(struct spi_device *spi) err_destroy_lock:free_irq (spi->irq, tp); +mutex_destroy (&tp->event_notify_mutex);mutex_destroy (&tp->mutex);return ret;
@@ -569,6 +574,7 @@ static void vsc_tp_remove(struct spi_device *spi)free_irq (spi->irq, tp); +mutex_destroy (&tp->event_notify_mutex);mutex_destroy (&tp->mutex); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/369 mei: vsc: Unset the event callback on remove and probe errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 6175c6974095f8ca7e5f8d593171512f3e5bd453 ]
Make mei_vsc_remove() properly unset the callback to avoid a dead callback sticking around after probe errors or unbinding of the platform driver.
--- drivers/misc/mei/platform-vsc.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/misc/mei/platform-vsc.c +5 -0
@@ -379,6 +379,8 @@ static int mei_vsc_probe(struct platform_device *pdev) err_cancel:mei_cancel_work (mei_dev); +vsc_tp_register_event_cb (tp,NULL ,NULL ); +mei_disable_interrupts (mei_dev);return ret;
@@ -387,11 +389,14 @@ static int mei_vsc_probe(struct platform_device *pdev)static void mei_vsc_remove (struct platform_device *pdev) {struct mei_device *mei_dev =platform_get_drvdata (pdev); +struct mei_vsc_hw *hw =mei_dev_to_vsc_hw (mei_dev);pm_runtime_disable (mei_dev->dev);mei_stop (mei_dev); +vsc_tp_register_event_cb (hw->tp,NULL ,NULL ); +mei_disable_interrupts (mei_dev);mei_deregister (mei_dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/369 spi: stm32: Check for cfg availability in stm32_spi_probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Le Goffic <[email protected]>
[ Upstream commit 21f1c800f6620e43f31dfd76709dbac8ebaa5a16 ]
The stm32_spi_probe function now includes a check to ensure that the pointer returned by of_device_get_match_data is not NULL before accessing its members. This resolves a warning where a potential NULL pointer dereference could occur when accessing cfg->has_device_mode.
Before accessing the 'has_device_mode' member, we verify that 'cfg' is not NULL. If 'cfg' is NULL, an error message is logged.
This change ensures that the driver does not attempt to access configuration data if it is not available, thus preventing a potential system crash due to a NULL pointer dereference.
--- drivers/spi/spi-stm32.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/spi/spi-stm32.c +7 -1
@@ -2069,9 +2069,15 @@ static int stm32_spi_probe(struct platform_device *pdev)struct resource *res;struct reset_control *rst;struct device_node *np = pdev->dev.of_node; +const struct stm32_spi_cfg *cfg;bool device_mode;int ret; -const struct stm32_spi_cfg *cfg =of_device_get_match_data (&pdev->dev); + + cfg =of_device_get_match_data (&pdev->dev); +if (!cfg) { +dev_err (&pdev->dev,"Failed to get match data for platform\n" ); +return -ENODEV ; + } device_mode =of_property_read_bool (np,"spi-slave" );if (!cfg->has_device_mode && device_mode) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/369 staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit eb2cb7dab60f9be0b435ac4a674255429a36d72c ]
In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for info->pagerefs is not freed. Fix that by adding the cleanup function on the error path.
--- drivers/staging/fbtft/fbtft-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/fbtft/fbtft-core.c +1 -0
@@ -694,6 +694,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,return info; release_framebuf: +fb_deferred_io_cleanup (info);framebuffer_release (info); alloc_fail:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/369 vmci: Prevent the dispatching of uninitialized payloads
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit bfb4cf9fb97e4063f0aa62e9e398025fb6625031 ]
The reproducer executes the host's unlocked_ioctl call in two different tasks. When init_context fails, the struct vmci_event_ctx is not fully initialized when executing vmci_datagram_dispatch() to send events to all vm contexts. This affects the datagram taken from the datagram queue of its context by another task, because the datagram payload is not initialized according to the size payload_size, which causes the kernel data to leak to the user space.
Before dispatching the datagram, and before setting the payload content, explicitly set the payload content to 0 to avoid data leakage caused by incomplete payload initialization.
--- drivers/misc/vmw_vmci/vmci_context.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/vmw_vmci/vmci_context.c +2 -0
@@ -251,6 +251,8 @@ static int ctx_fire_notification(u32 context_id, u32 priv_flags) ev.msg.hdr.src =vmci_make_handle (VMCI_HYPERVISOR_CONTEXT_ID ,VMCI_CONTEXT_RESOURCE_ID ); ev.msg.hdr.payload_size =sizeof (ev) -sizeof (ev.msg.hdr); +memset ((char *)&ev.msg.hdr +sizeof (ev.msg.hdr),0 , + ev.msg.hdr.payload_size); ev.msg.event_data.event =VMCI_EVENT_CTX_REMOVED ; ev.payload.context_id = context_id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/369 pps: fix poll support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis OSTERLAND-HEIM <[email protected]>
[ Upstream commit 12c409aa1ec2592280a2ddcc66ff8f3c7f7bb171 ]
Because pps_cdev_poll() returns unconditionally EPOLLIN,
a user space program that calls select/poll get always an immediate data ready-to-read response. As a result the intended use to wait until next data becomes ready does not work.
User space snippet:
struct pollfd pollfd = {
.fd = open("/dev/pps0", O_RDONLY),
.events = POLLIN|POLLERR,
.revents = 0 };
while(1) {
poll(&pollfd, 1, 2000/*ms*/); // returns immediate, but should wait
if(revents & EPOLLIN) { // always true
struct pps_fdata fdata;
memset(&fdata, 0, sizeof(memdata));
ioctl(PPS_FETCH, &fdata); // currently fetches data at max speed
}
}Lets remember the last fetch event counter and compare this value in pps_cdev_poll() with most recent event counter
and return 0 if they are equal.
--- drivers/pps/pps.c | 11 +++++++++-- include/linux/pps_kernel.h | 1 + 2 files changed, 10 insertions(+), 2 deletions(-)
drivers/pps/pps.c +9 -2
@@ -41,6 +41,9 @@ static __poll_t pps_cdev_poll(struct file *file, poll_table *wait)poll_wait (file, &pps->queue, wait); +if (pps->last_fetched_ev == pps->last_ev) +return 0 ; +return EPOLLIN |EPOLLRDNORM ; }
@@ -186,9 +189,11 @@ static long pps_cdev_ioctl(struct file *file,if (err)return err; -/* Return the fetched timestamp */ +/* Return the fetched timestamp and save last fetched event */ spin_lock_irq (&pps->lock); + pps->last_fetched_ev = pps->last_ev; + fdata.info.assert_sequence = pps->assert_sequence; fdata.info.clear_sequence = pps->clear_sequence; fdata.info.assert_tu = pps->assert_tu;
@@ -272,9 +277,11 @@ static long pps_cdev_compat_ioctl(struct file *file,if (err)return err; -/* Return the fetched timestamp */ +/* Return the fetched timestamp and save last fetched event */ spin_lock_irq (&pps->lock); + pps->last_fetched_ev = pps->last_ev; + compat.info.assert_sequence = pps->assert_sequence; compat.info.clear_sequence = pps->clear_sequence; compat.info.current_mode = pps->current_mode;
include/linux/pps_kernel.h +1 -0
@@ -52,6 +52,7 @@ struct pps_device {int current_mode;/* PPS mode at event time */ unsigned int last_ev;/* last PPS event id */ +unsigned int last_fetched_ev;/* last fetched PPS event id */ wait_queue_head_t queue;/* PPS event queue */ unsigned int id;/* PPS source unique ID */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/369 selftests: vDSO: chacha: Correctly skip test if necessary
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 2c0a4428f5d6005ff0db12057cc35273593fc040 ]
According to kselftest.h ksft_exit_skip() is not meant to be called when a plan has already been printed.
Use the recommended function ksft_test_result_skip().
This fixes a bug, where the TAP output would be invalid when skipping:
TAP version 13
1..1
ok 2 # SKIP Not implemented on architecture
The SKIP line should start with "ok 1" as the plan only contains one test.
--- tools/testing/selftests/vDSO/vdso_test_chacha.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/vDSO/vdso_test_chacha.c +2 -1
@@ -76,7 +76,8 @@ static void reference_chacha20_blocks(uint8_t *dst_bytes, const uint32_t *key, uvoid __weak __arch_chacha20_blocks_nostack (uint8_t *dst_bytes,const uint32_t *key,uint32_t *counter,size_t nblocks) { -ksft_exit_skip ("Not implemented on architecture\n" ); +ksft_test_result_skip ("Not implemented on architecture\n" ); +ksft_finished (); }int main (int argc,char *argv[])
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/369 Revert "vmci: Prevent the dispatching of uninitialized payloads"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 8f5d9bed6122b8d96508436e5ad2498bb797eb6b ]
This reverts commit bfb4cf9fb97e4063f0aa62e9e398025fb6625031.
While the code "looks" correct, the compiler has no way to know that doing "fun" pointer math like this really isn't a write off the end of the structure as there is no hint anywhere that the structure has data at the end of it.
This causes the following build warning:
In function 'fortify_memset_chk',
inlined from 'ctx_fire_notification.isra' at drivers/misc/vmw_vmci/vmci_context.c:254:3:include/linux/fortify-string.h:480:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
480 | __write_overflow_field(p_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~So revert it for now and it can come back in the future in a "sane" way that either correctly makes the structure know that there is trailing data, OR just the payload structure is properly referenced and zeroed out.
--- drivers/misc/vmw_vmci/vmci_context.c | 2 -- 1 file changed, 2 deletions(-)
drivers/misc/vmw_vmci/vmci_context.c +0 -2
@@ -251,8 +251,6 @@ static int ctx_fire_notification(u32 context_id, u32 priv_flags) ev.msg.hdr.src =vmci_make_handle (VMCI_HYPERVISOR_CONTEXT_ID ,VMCI_CONTEXT_RESOURCE_ID ); ev.msg.hdr.payload_size =sizeof (ev) -sizeof (ev.msg.hdr); -memset ((char *)&ev.msg.hdr +sizeof (ev.msg.hdr),0 , - ev.msg.hdr.payload_size); ev.msg.event_data.event =VMCI_EVENT_CTX_REMOVED ; ev.payload.context_id = context_id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/369 powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sivan Zohar-Kotzer <[email protected]>
[ Upstream commit 46dc57406887dd02565cb264224194a6776d882b ]
The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which propagates through em_cpu_get() and leads to a crash when em_span_cpus() dereferences the NULL pointer.
Add a NULL check after em_cpu_get() and return 0 if unavailable, matching the existing fallback behavior in __dtpm_cpu_setup().
--- drivers/powercap/dtpm_cpu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/powercap/dtpm_cpu.c +2 -0
@@ -96,6 +96,8 @@ static u64 get_pd_power_uw(struct dtpm *dtpm)int i; pd =em_cpu_get (dtpm_cpu->cpu); +if (!pd) +return 0 ; pd_mask =em_span_cpus (pd);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/369 usb: early: xhci-dbc: Fix early_ioremap leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <[email protected]>
[ Upstream commit 2b7eec2ec3015f52fc74cf45d0408925e984ecd1 ]
Using the kernel param earlyprintk=xdbc,keep without proper hardware setup leads to this:
[ ] xhci_dbc:early_xdbc_parse_parameter: dbgp_num: 0 ... [ ] xhci_dbc:early_xdbc_setup_hardware: failed to setup the connection to host ... [ ] calling kmemleak_late_init+0x0/0xa0 @ 1 [ ] kmemleak: Kernel memory leak detector initialized (mem pool available: 14919) [ ] kmemleak: Automatic memory scanning thread started [ ] initcall kmemleak_late_init+0x0/0xa0 returned 0 after 417 usecs [ ] calling check_early_ioremap_leak+0x0/0x70 @ 1 [ ] ------------[ cut here ]------------ [ ] Debug warning: early ioremap leak of 1 areas detected. please boot with early_ioremap_debug and report the dmesg. [ ] WARNING: CPU: 11 PID: 1 at mm/early_ioremap.c:90 check_early_ioremap_leak+0x4e/0x70
When early_xdbc_setup_hardware() fails, make sure to call early_iounmap() since xdbc_init() won't handle it.
--- drivers/usb/early/xhci-dbc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/early/xhci-dbc.c +4 -0
@@ -681,6 +681,10 @@ int __init early_xdbc_setup_hardware(void) xdbc.table_base =NULL ; xdbc.out_buf =NULL ; + +early_iounmap (xdbc.xhci_base, xdbc.xhci_length); + xdbc.xhci_base =NULL ; + xdbc.xhci_length =0 ; }return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/369 arm: dts: ti: omap: Fixup pinheader typo
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Albin Törnqvist <[email protected]>
[ Upstream commit a3a4be32b69c99fc20a66e0de83b91f8c882bf4c ]
This commit fixes a typo introduced in commitee368a10d0df ("ARM: dts: am335x-boneblack.dts: unique gpio-line-names"). gpio0_7 is located on the P9 header on the BBB.
This was verified with a BeagleBone Black by toggling the pin and checking with a multimeter that it corresponds to pin 42 on the P9 header.
--- arch/arm/boot/dts/ti/omap/am335x-boneblack.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/ti/omap/am335x-boneblack.dts +1 -1
@@ -35,7 +35,7 @@ &gpio0 { "P9_18 [spi0_d1]", "P9_17 [spi0_cs0]", "[mmc0_cd]", - "P8_42A [ecappwm0]", + "P9_42A [ecappwm0]", "P8_35 [lcd d12]", "P8_33 [lcd d13]", "P8_31 [lcd d14]",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/369 soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <[email protected]>
[ Upstream commit a0647bca8966db04b79af72851ebd04224a4da40 ]
When error is injected with the ERR_FORCE register, then this register is not auto cleared on clearing the ERR_STATUS register. This causes repeated interrupts on error injection. To fix, set the ERR_FORCE to zero along with clearing the ERR_STATUS register after handling error.
--- drivers/soc/tegra/cbb/tegra234-cbb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/soc/tegra/cbb/tegra234-cbb.c +2 -0
@@ -185,6 +185,8 @@ static void tegra234_cbb_error_clear(struct tegra_cbb *cbb) {struct tegra234_cbb *priv =to_tegra234_cbb (cbb); +writel (0 , priv->mon +FABRIC_MN_MASTER_ERR_FORCE_0 ); +writel (0x3f , priv->mon +FABRIC_MN_MASTER_ERR_STATUS_0 );dsb (sy); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/369 arm64: dts: st: fix timer used for ticks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Delaunay <[email protected]>
[ Upstream commit 9ec406ac4b7de3e8040a503429d1a5d389bfdaf6 ]
Remove always-on on generic ARM timer as the clock source provided by STGEN is deactivated in low power mode, STOP1 by example.
--- arch/arm64/boot/dts/st/stm32mp251.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/st/stm32mp251.dtsi +1 -1
@@ -149,7 +149,7 @@ timer { <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>; - always-on; + arm,no-tick-in-suspend; }; soc@0 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/369 selftests: breakpoints: use suspend_stats to reliably check suspend success
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Hee Lee <[email protected]>
[ Upstream commit 07b7c2b4eca3f83ce9cd5ee3fa1c7c001d721c69 ]
The step_after_suspend_test verifies that the system successfully suspended and resumed by setting a timerfd and checking whether the timer fully expired. However, this method is unreliable due to timing races.
In practice, the system may take time to enter suspend, during which the timer may expire just before or during the transition. As a result, the remaining time after resume may show non-zero nanoseconds, even if suspend/resume completed successfully. This leads to false test failures.
Replace the timer-based check with a read from /sys/power/suspend_stats/success. This counter is incremented only after a full suspend/resume cycle, providing a reliable and race-free indicator.
Also remove the unused file descriptor for /sys/power/state, which remained after switching to a system() call to trigger suspend [1].
[1] https://lore.kernel.org/all/[email protected]/
--- .../breakpoints/step_after_suspend_test.c | 41 ++++++++++++++----- 1 file changed, 31 insertions(+), 10 deletions(-)
tools/testing/selftests/breakpoints/step_after_suspend_test.c +31 -10
@@ -127,22 +127,42 @@ int run_test(int cpu)return KSFT_PASS ; } +/* +* Reads the suspend success count from sysfs. +* Returns the count on success or exits on failure. +*/ +static int get_suspend_success_count_or_fail (void ) +{ +FILE *fp; +int val; + + fp =fopen ("/sys/power/suspend_stats/success" ,"r" ); +if (!fp) +ksft_exit_fail_msg ( +"Failed to open suspend_stats/success: %s\n" , +strerror (errno)); + +if (fscanf (fp,"%d" , &val) !=1 ) { +fclose (fp); +ksft_exit_fail_msg ( +"Failed to read suspend success count\n" ); + } + +fclose (fp); +return val; +} +void suspend (void ) { -int power_state_fd;int timerfd;int err; +int count_before; +int count_after;struct itimerspec spec = {};if (getuid () !=0 )ksft_exit_skip ("Please run the test as root - Exiting.\n" ); - power_state_fd =open ("/sys/power/state" ,O_RDWR ); -if (power_state_fd <0 ) -ksft_exit_fail_msg ( -"open(\"/sys/power/state\") failed %s)\n" , -strerror (errno)); - timerfd =timerfd_create (CLOCK_BOOTTIME_ALARM ,0 );if (timerfd <0 )ksft_exit_fail_msg ("timerfd_create() failed\n" );
@@ -152,14 +172,15 @@ void suspend(void)if (err <0 )ksft_exit_fail_msg ("timerfd_settime() failed\n" ); + count_before =get_suspend_success_count_or_fail (); +system ("(echo mem > /sys/power/state) 2> /dev/null" ); -timerfd_gettime (timerfd, &spec); -if (spec.it_value.tv_sec !=0 || spec.it_value.tv_nsec !=0 ) + count_after =get_suspend_success_count_or_fail (); +if (count_after <= count_before)ksft_exit_fail_msg ("Failed to enter Suspend state\n" );close (timerfd); -close (power_state_fd); }int main (int argc,char **argv)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/369 ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Annette Kobou <[email protected]>
[ Upstream commit 47ef5256124fb939d8157b13ca048c902435cf23 ]
The polarity of the DE signal of the transceiver is active-high for sending. Therefore rs485-rts-active-low is wrong and needs to be removed to make RS485 transmissions work.
--- arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi +0 -1
@@ -168,7 +168,6 @@ &uart2 { pinctrl-0 = <&pinctrl_uart2>; linux,rs485-enabled-at-boot-time; rs485-rx-during-tx; - rs485-rts-active-low; uart-has-rtscts; status = "okay"; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/369 arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit f83f69097a302ed2a2775975ddcf12e6a5ac6ec3 ]
The reference manual for the i.MX8MM states the clock rate in MMC mode is 1/2 of the input clock, therefore to properly run at HS400 rates, the input clock must be 400MHz to operate at 200MHz. Currently the clock is set to 200MHz which is half the rate it should be, so the throughput is half of what it should be for HS400 operation.
--- arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi +2 -0
@@ -286,6 +286,8 @@ &usdhc3 { pinctrl-0 = <&pinctrl_usdhc3>; pinctrl-1 = <&pinctrl_usdhc3_100mhz>; pinctrl-2 = <&pinctrl_usdhc3_200mhz>; + assigned-clocks = <&clk IMX8MM_CLK_USDHC3>; + assigned-clock-rates = <400000000>; bus-width = <8>; non-removable; status = "okay";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/369 arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit e16ad6c79906bba5e2ac499492b6a5b29ab19d6c ]
The reference manual for the i.MX8MN states the clock rate in MMC mode is 1/2 of the input clock, therefore to properly run at HS400 rates, the input clock must be 400MHz to operate at 200MHz. Currently the clock is set to 200MHz which is half the rate it should be, so the throughput is half of what it should be for HS400 operation.
--- arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi +2 -0
@@ -297,6 +297,8 @@ &usdhc3 { pinctrl-0 = <&pinctrl_usdhc3>; pinctrl-1 = <&pinctrl_usdhc3_100mhz>; pinctrl-2 = <&pinctrl_usdhc3_200mhz>; + assigned-clocks = <&clk IMX8MN_CLK_USDHC3>; + assigned-clock-rates = <400000000>; bus-width = <8>; non-removable; status = "okay";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/369 PM / devfreq: Check governor before using governor->name
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit bab7834c03820eb11269bc48f07c3800192460d2 ]
Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But devfreq->governor may be NULL and directly using devfreq->governor->name may cause null pointer exception. Move the check of governor to before using governor->name.
--- drivers/devfreq/devfreq.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/devfreq/devfreq.c +3 -7
@@ -1382,15 +1382,11 @@ int devfreq_remove_governor(struct devfreq_governor *governor)int ret;struct device *dev = devfreq->dev.parent; +if (!devfreq->governor) +continue ; +if (!strncmp (devfreq->governor->name, governor->name,DEVFREQ_NAME_LEN )) { -/* we should have a devfreq governor! */ -if (!devfreq->governor) { -dev_warn (dev,"%s: Governor %s NOT present\n" , - __func__, governor->name); -continue ; -/* Fall through */ - } ret = devfreq->governor->event_handler (devfreq,DEVFREQ_GOV_STOP ,NULL );if (ret) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/369 PM / devfreq: Fix a index typo in trans_stat
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chanwoo Choi <[email protected]>
[ Upstream commit 78c5845fbbf6aaeb9959c5fbaee5cc53ef5f38c2 ]
--- drivers/devfreq/devfreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/devfreq/devfreq.c +1 -1
@@ -1739,7 +1739,7 @@ static ssize_t trans_stat_show(struct device *dev,for (i =0 ; i < max_state; i++) {if (len >=PAGE_SIZE -1 )break ; -if (df->freq_table[2 ] == df->previous_freq) +if (df->freq_table[i] == df->previous_freq) len +=sysfs_emit_at (buf, len,"*" );else len +=sysfs_emit_at (buf, len," " );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/369 cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 1cefe495cacba5fb0417da3a75a1a76e3546d176 ]
In the passive mode, intel_cpufreq_update_pstate() sets HWP_MIN_PERF in accordance with the target frequency to ensure delivering adequate performance, but it sets HWP_DESIRED_PERF to 0, so the processor has no indication that the desired performance level is actually equal to the floor one. This may cause it to choose a performance point way above the desired level.
Moreover, this is inconsistent with intel_cpufreq_adjust_perf() which actually sets HWP_DESIRED_PERF in accordance with the target performance value.
Address this by adjusting intel_cpufreq_update_pstate() to pass target_pstate as both the minimum and the desired performance levels to intel_cpufreq_hwp_update().
--- drivers/cpufreq/intel_pstate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpufreq/intel_pstate.c +2 -2
@@ -3128,8 +3128,8 @@ static int intel_cpufreq_update_pstate(struct cpufreq_policy *policy,int max_pstate = policy->strict_target ? target_pstate : cpu->max_perf_ratio; -intel_cpufreq_hwp_update (cpu, target_pstate, max_pstate,0 , - fast_switch); +intel_cpufreq_hwp_update (cpu, target_pstate, max_pstate, + target_pstate, fast_switch); }else if (target_pstate != old_pstate) {intel_cpufreq_perf_ctl_update (cpu, target_pstate, fast_switch); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/369 cpufreq: Initialize cpufreq-based frequency-invariance later
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 2a6c727387062a2ea79eb6cf5004820cb1b0afe2 ]
The cpufreq-based invariance is enabled in cpufreq_register_driver(), but never disabled after registration fails. Move the invariance initialization to where all other initializations have been successfully done to solve this problem.
--- drivers/cpufreq/cpufreq.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/cpufreq/cpufreq.c +9 -9
@@ -2961,15 +2961,6 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) cpufreq_driver = driver_data;write_unlock_irqrestore (&cpufreq_driver_lock, flags); -/* -* Mark support for the scheduler's frequency invariance engine for -* drivers that implement target(), target_index() or fast_switch(). -*/ -if (!cpufreq_driver->setpolicy) { -static_branch_enable_cpuslocked (&cpufreq_freq_invariance); -pr_debug ("supports frequency invariance" ); - } -if (driver_data->setpolicy) driver_data->flags |=CPUFREQ_CONST_LOOPS ;
@@ -3000,6 +2991,15 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) hp_online = ret; ret =0 ; +/* +* Mark support for the scheduler's frequency invariance engine for +* drivers that implement target(), target_index() or fast_switch(). +*/ +if (!cpufreq_driver->setpolicy) { +static_branch_enable_cpuslocked (&cpufreq_freq_invariance); +pr_debug ("supports frequency invariance" ); + } +pr_debug ("driver %s up and running\n" , driver_data->name); goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/369 cpufreq: Init policy->rwsem before it may be possibly used
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit d1378d1d7edb3a4c4935a44fe834ae135be03564 ]
In cpufreq_policy_put_kobj(), policy->rwsem is used. But in cpufreq_policy_alloc(), if freq_qos_add_notifier() returns an error, error path via err_kobj_remove or err_min_qos_notifier will be reached and cpufreq_policy_put_kobj() will be called before policy->rwsem is initialized. Thus, the calling of init_rwsem() should be moved to where before these two error paths can be reached.
--- drivers/cpufreq/cpufreq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/cpufreq/cpufreq.c +2 -1
@@ -1275,6 +1275,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu) goto err_free_real_cpus; } +init_rwsem (&policy->rwsem); +freq_constraints_init (&policy->constraints); policy->nb_min.notifier_call = cpufreq_notifier_min;
@@ -1297,7 +1299,6 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu) }INIT_LIST_HEAD (&policy->policy_list); -init_rwsem (&policy->rwsem);spin_lock_init (&policy->transition_lock);init_waitqueue_head (&policy->transition_wait);INIT_WORK (&policy->update, handle_update);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/369 staging: greybus: gbphy: fix up const issue with the match callback
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit ce32eff1cf3ae8ac2596171dd0af1657634c83eb ]
gbphy_dev_match_id() should be taking a const pointer, as the pointer passed to it from the container_of() call was const to start with (it was accidentally cast away with the call.) Fix this all up by correctly marking the pointer types.
--- drivers/staging/greybus/gbphy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/greybus/gbphy.c +3 -3
@@ -102,8 +102,8 @@ static int gbphy_dev_uevent(const struct device *dev, struct kobj_uevent_env *en }static const struct gbphy_device_id * -gbphy_dev_match_id (struct gbphy_device *gbphy_dev, -struct gbphy_driver *gbphy_drv) +gbphy_dev_match_id (const struct gbphy_device *gbphy_dev, +const struct gbphy_driver *gbphy_drv) {const struct gbphy_device_id *id = gbphy_drv->id_table;
@@ -119,7 +119,7 @@ gbphy_dev_match_id(struct gbphy_device *gbphy_dev,static int gbphy_dev_match (struct device *dev,const struct device_driver *drv) { -struct gbphy_driver *gbphy_drv =to_gbphy_driver (drv); +const struct gbphy_driver *gbphy_drv =to_gbphy_driver (drv);struct gbphy_device *gbphy_dev =to_gbphy_dev (dev);const struct gbphy_device_id *id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/369 samples: mei: Fix building on musl libc
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 239df3e4b4752524e7c0fb3417c218d8063654b4 ]
The header bits/wordsize.h is glibc specific and on building on musl with allyesconfig results in
samples/mei/mei-amt-version.c:77:10: fatal error: bits/wordsize.h: No such file or directory
77 | #include <bits/wordsize.h>
| ^~~~~~~~~~~~~~~~~
mei-amt-version.c build file without bits/wordsize.h on musl and glibc.
However on musl we get the follwing error without sys/time.h
samples/mei/mei-amt-version.c: In function 'mei_recv_msg':samples/mei/mei-amt-version.c:159:24: error: storage size of 'tv' isn't known
159 | struct timeval tv;
| ^~samples/mei/mei-amt-version.c:160:9: error: unknown type name 'fd_set'
160 | fd_set set;
| ^~~~~~
samples/mei/mei-amt-version.c:168:9: error: implicit declaration of function 'FD_ZERO' [-Wimplicit-function-declaration]
168 | FD_ZERO(&set);
| ^~~~~~~
samples/mei/mei-amt-version.c:169:9: error: implicit declaration of function 'FD_SET'; did you mean 'L_SET'? [-Wimplicit-function-declaration]
169 | FD_SET(me->fd, &set);
| ^~~~~~
| L_SET
samples/mei/mei-amt-version.c:170:14: error: implicit declaration of function 'select' [-Wimplicit-function-declaration]
170 | rc = select(me->fd + 1, &set, NULL, NULL, &tv);
| ^~~~~~
samples/mei/mei-amt-version.c:171:23: error: implicit declaration of function 'FD_ISSET' [-Wimplicit-function-declaration]
171 | if (rc > 0 && FD_ISSET(me->fd, &set)) {
| ^~~~~~~~samples/mei/mei-amt-version.c:159:24: warning: unused variable 'tv' [-Wunused-variable]
159 | struct timeval tv;
| ^~
Hence the the file has been included.
--- samples/mei/mei-amt-version.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/mei/mei-amt-version.c +1 -1
@@ -69,11 +69,11 @@#include <string.h> #include <fcntl.h> #include <sys/ioctl.h> +#include <sys/time.h> #include <unistd.h> #include <errno.h> #include <stdint.h> #include <stdbool.h> -#include <bits/wordsize.h> #include <linux/mei.h> /*****************************************************************************
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/369 soc: qcom: pmic_glink: fix OF node leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 65702c3d293e45d3cac5e4e175296a9c90404326 ]
Make sure to drop the OF node reference taken when registering the auxiliary devices when the devices are later released.
--- drivers/soc/qcom/pmic_glink.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/soc/qcom/pmic_glink.c +7 -2
@@ -169,7 +169,10 @@ static int pmic_glink_rpmsg_callback(struct rpmsg_device *rpdev, void *data,return 0 ; } -static void pmic_glink_aux_release (struct device *dev) {} +static void pmic_glink_aux_release (struct device *dev) +{ +of_node_put (dev->of_node); +} static int pmic_glink_add_aux_device(struct pmic_glink *pg, struct auxiliary_device *aux,
@@ -183,8 +186,10 @@ static int pmic_glink_add_aux_device(struct pmic_glink *pg, aux->dev.release = pmic_glink_aux_release;device_set_of_node_from_dev (&aux->dev, parent); ret =auxiliary_device_init (aux); -if (ret) +if (ret) { +of_node_put (aux->dev.of_node);return ret; + } ret =auxiliary_device_add (aux);if (ret)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/369 interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 02ee375506dceb7d32007821a2bff31504d64b99 ]
The qnm_a1noc_cfg declaration didn't include .num_links definition, fix it.
--- drivers/interconnect/qcom/sc8280xp.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sc8280xp.c +1 -0
@@ -48,6 +48,7 @@ static struct qcom_icc_node qnm_a1noc_cfg = { .id = SC8280XP_MASTER_A1NOC_CFG, .channels = 1, .buswidth = 4, + .num_links = 1, .links = { SC8280XP_SLAVE_SERVICE_A1NOC }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/369 interconnect: qcom: sc8180x: specify num_nodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7e0b59496a02d25828612721e846ea4b717a97b9 ]
Specify .num_nodes for several BCMs which missed this declaration.
--- drivers/interconnect/qcom/sc8180x.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/interconnect/qcom/sc8180x.c +6 -0
@@ -1492,34 +1492,40 @@ static struct qcom_icc_bcm bcm_sh3 = {static struct qcom_icc_bcm bcm_sn0 = { .name ="SN0" , + .num_nodes =1 , .nodes = { &slv_qns_gemnoc_sf } };static struct qcom_icc_bcm bcm_sn1 = { .name ="SN1" , + .num_nodes =1 , .nodes = { &slv_qxs_imem } };static struct qcom_icc_bcm bcm_sn2 = { .name ="SN2" , .keepalive = true, + .num_nodes =1 , .nodes = { &slv_qns_gemnoc_gc } };static struct qcom_icc_bcm bcm_co2 = { .name ="CO2" , + .num_nodes =1 , .nodes = { &mas_qnm_npu } };static struct qcom_icc_bcm bcm_sn3 = { .name ="SN3" , .keepalive = true, + .num_nodes =2 , .nodes = { &slv_srvc_aggre1_noc, &slv_qns_cnoc } };static struct qcom_icc_bcm bcm_sn4 = { .name ="SN4" , + .num_nodes =1 , .nodes = { &slv_qxs_pimem } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/369 bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
[ Upstream commit ae5a34264354087aef38cdd07961827482a51c5a ]
T99W640 was mistakenly mentioned as T99W515. T99W515 is a LGA device, not a M.2 modem device. So correct it's name to avoid name mismatch issue.
--- drivers/bus/mhi/host/pci_generic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/bus/mhi/host/pci_generic.c +4 -4
@@ -509,8 +509,8 @@ static const struct mhi_pci_dev_info mhi_foxconn_dw5932e_info = { .sideband_wake = false, }; -static const struct mhi_pci_dev_info mhi_foxconn_t99w515_info = { - .name ="foxconn-t99w515" , +static const struct mhi_pci_dev_info mhi_foxconn_t99w640_info = { + .name ="foxconn-t99w640" , .edl ="qcom/sdx72m/foxconn/edl.mbn" , .edl_trigger = true, .config = &modem_foxconn_sdx72_config,
@@ -792,9 +792,9 @@ static const struct pci_device_id mhi_pci_id_table[] = {/* DW5932e (sdx62), Non-eSIM */ { PCI_DEVICE(PCI_VENDOR_ID_FOXCONN, 0xe0f9), .driver_data = (kernel_ulong_t) &mhi_foxconn_dw5932e_info }, -/* T99W515 (sdx72) */ +/* T99W640 (sdx72) */ { PCI_DEVICE(PCI_VENDOR_ID_FOXCONN, 0xe118), - .driver_data = (kernel_ulong_t) &mhi_foxconn_t99w515_info }, + .driver_data = (kernel_ulong_t) &mhi_foxconn_t99w640_info },/* DW5934e(sdx72), With eSIM */ { PCI_DEVICE(PCI_VENDOR_ID_FOXCONN, 0xe11d), .driver_data = (kernel_ulong_t) &mhi_foxconn_dw5934e_info },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/369 staging: nvec: Fix incorrect null termination of battery manufacturer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit a8934352ba01081c51d2df428e9d540aae0e88b5 ]
The battery manufacturer string was incorrectly null terminated using bat_model instead of bat_manu. This could result in an unintended write to the wrong field and potentially incorrect behavior.
fixe the issue by correctly null terminating the bat_manu string.
--- drivers/staging/nvec/nvec_power.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/nvec/nvec_power.c +1 -1
@@ -194,7 +194,7 @@ static int nvec_power_bat_notifier(struct notifier_block *nb,break ;case MANUFACTURER :memcpy (power->bat_manu, &res->plc, res->length -2 ); - power->bat_model[res->length -2 ] ='\0' ; + power->bat_manu[res->length -2 ] ='\0' ;break ;case MODEL :memcpy (power->bat_model, &res->plc, res->length -2 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/369 selftests/tracing: Fix false failure of subsystem event test
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit 213879061a9c60200ba971330dbefec6df3b4a30 ]
The subsystem event test enables all "sched" events and makes sure there's at least 3 different events in the output. It used to cat the entire trace file to | wc -l, but on slow machines, that could last a very long time. To solve that, it was changed to just read the first 100 lines of the trace file. This can cause false failures as some events repeat so often, that the 100 lines that are examined could possibly be of only one event.
Instead, create an awk script that looks for 3 different events and will exit out after it finds them. This will find the 3 events the test looks for (eventually if it works), and still exit out after the test is satisfied and not cause slower machines to run forever.
--- .../ftrace/test.d/event/subsystem-enable.tc | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-)
tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc +26 -2
@@ -14,11 +14,35 @@ fail() { #msg exit_fail } +# As reading trace can last forever, simply look for 3 different +# events then exit out of reading the file. If there's not 3 different +# events, then the test has failed. +check_unique() { + cat trace | grep -v '^#' | awk ' + BEGIN { cnt = 0; } + { + for (i = 0; i < cnt; i++) { + if (event[i] == $5) { + break; + } + } + if (i == cnt) { + event[cnt++] = $5; + if (cnt > 2) { + exit; + } + } + } + END { + printf "%d", cnt; + }' +} + echo 'sched:*' > set_event yield -count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`check_unique` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
@@ -29,7 +53,7 @@ echo 1 > events/sched/enable yield -count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`check_unique` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/369 drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Yan <[email protected]>
[ Upstream commit 099593a28138b48feea5be8ce700e5bc4565e31d ]
In the function drm_gem_fb_init_with_funcs, the framebuffer (fb) and its corresponding object ID have already been registered.
So we need to cleanup the drm framebuffer if the subsequent execution of drm_gem_fb_afbc_init fails.
Directly call drm_framebuffer_put to ensure that all fb related resources are cleanup.
--- drivers/gpu/drm/rockchip/rockchip_drm_fb.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/gpu/drm/rockchip/rockchip_drm_fb.c +1 -8
@@ -52,16 +52,9 @@ rockchip_fb_create(struct drm_device *dev, struct drm_file *file, }if (drm_is_afbc (mode_cmd->modifier[0 ])) { -int ret, i; - ret =drm_gem_fb_afbc_init (dev, mode_cmd, afbc_fb);if (ret) { -struct drm_gem_object **obj = afbc_fb->base.obj; - -for (i =0 ; i < info->num_planes; ++i) -drm_gem_object_put (obj[i]); - -kfree (afbc_fb); +drm_framebuffer_put (&afbc_fb->base);return ERR_PTR (ret); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/369 drm/panfrost: Fix panfrost device variable name in devfreq
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit 6048f5587614bb4919c54966913452c1a0a43138 ]
Commit 64111a0e22a9 ("drm/panfrost: Fix incorrect updating of current device frequency") was a Panfrost port of a similar fix in Panthor.
Fix the Panfrost device pointer variable name so that it follows Panfrost naming conventions.
--- drivers/gpu/drm/panfrost/panfrost_devfreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panfrost/panfrost_devfreq.c +2 -2
@@ -29,7 +29,7 @@ static void panfrost_devfreq_update_utilization(struct panfrost_devfreq *pfdevfrstatic int panfrost_devfreq_target (struct device *dev,unsigned long *freq,u32 flags) { -struct panfrost_device *ptdev =dev_get_drvdata (dev); +struct panfrost_device *pfdev =dev_get_drvdata (dev);struct dev_pm_opp *opp;int err;
@@ -40,7 +40,7 @@ static int panfrost_devfreq_target(struct device *dev, unsigned long *freq, err =dev_pm_opp_set_rate (dev, *freq);if (!err) - ptdev->pfdevfreq.current_frequency = *freq; + pfdev->pfdevfreq.current_frequency = *freq;return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/369 drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <[email protected]>
[ Upstream commit 95cbab48782bf62e4093837dc15ac6133902c12f ]
drm_panthor_gpu_info::shader_present is currently automatically offset by 4 byte to meet Arm's 32-bit/64-bit field alignment rules, but those constraints don't stand on 32-bit x86 and cause a mismatch when running an x86 binary in a user emulated environment like FEX. It's also generally agreed that uAPIs should explicitly pad their struct fields, which we originally intended to do, but a mistake slipped through during the submission process, leading drm_panthor_gpu_info::shader_present to be misaligned.
This uAPI change doesn't break any of the existing users of panthor which are either arm32 or arm64 where the 64-bit alignment of u64 fields is already enforced a the compiler level.
Changes in v2:
- Rename the garbage field into pad0 and adjust the comment accordingly
- Add Liviu's A-b
Changes in v3:
- Add R-bs
--- include/uapi/drm/panthor_drm.h | 3 +++ 1 file changed, 3 insertions(+)
include/uapi/drm/panthor_drm.h +3 -0
@@ -327,6 +327,9 @@ struct drm_panthor_gpu_info {/** @as_present: Bitmask encoding the number of address-space exposed by the MMU. */ __u32 as_present; +/** @pad0: MBZ. */ +__u32 pad0; +/** @shader_present: Bitmask encoding the shader cores exposed by the GPU. */ __u64 shader_present;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/369 bpf, sockmap: Fix psock incorrectly pointing to sk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 76be5fae32febb1fdb848ba09f78c4b2c76cb337 ]
We observed an issue from the latest selftest: sockmap_redir where sk_psock(psock->sk) != psock in the backlog. The root cause is the special behavior in sockmap_redir - it frequently performs map_update() and map_delete() on the same socket. During map_update(), we create a new psock and during map_delete(), we eventually free the psock via rcu_work in sk_psock_drop(). However, pending workqueues might still exist and not be processed yet. If users immediately perform another map_update(), a new psock will be allocated for the same sk, resulting in two psocks pointing to the same sk.
When the pending workqueue is later triggered, it uses the old psock to access sk for I/O operations, which is incorrect.
Timing Diagram:
cpu0 cpu1
map_update(sk):
sk->psock = psock1
psock1->sk = skmap_delete(sk):
rcu_work_free(psock1)
map_update(sk):
sk->psock = psock2
psock2->sk = sk
workqueue:
wakeup with psock1, but the sk of psock1 doesn't belong to psock1rcu_handler:
clean psock1
free(psock1)
Previously, we used reference counting to address the concurrency issue between backlog and sock_map_close(). This logic remains necessary as it prevents the sk from being freed while processing the backlog. But this patch prevents pending backlogs from using a psock after it has been stopped.
Note: We cannot call cancel_delayed_work_sync() in map_delete() since this might be invoked in BPF context by BPF helper, and the function may sleep.
--- net/core/skmsg.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/core/skmsg.c +7 -0
@@ -655,6 +655,13 @@ static void sk_psock_backlog(struct work_struct *work)bool ingress;int ret; +/* If sk is quickly removed from the map and then added back, the old +* psock should not be scheduled, because there are now two psocks +* pointing to the same sk. +*/ +if (!sk_psock_test_state (psock,SK_PSOCK_TX_ENABLED )) +return ; +/* Increment the psock refcnt to synchronize with close(fd) path in * sock_map_close(), ensuring we wait for backlog thread completion * before sk_socket freed. If refcnt increment fails, it indicates
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/369 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 178f6a5c8cb3b6be1602de0964cd440243f493c9 ]
When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to recalculate the ciphertext length.
This results in transmitting buffers containing uninitialized data during ciphertext transmission.
This causes uninitialized bytes to be appended after a complete "Application Data" packet, leading to errors on the receiving end when parsing TLS record.
--- net/tls/tls_sw.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/tls/tls_sw.c +13 -0
@@ -872,6 +872,19 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, delta = msg->sg.size; psock->eval =sk_psock_msg_verdict (sk, psock, msg); delta -= msg->sg.size; + +if ((s32 )delta >0 ) { +/* It indicates that we executed bpf_msg_pop_data(), +* causing the plaintext data size to decrease. +* Therefore the encrypted data size also needs to +* correspondingly decrease. We only need to subtract +* delta to calculate the new ciphertext length since +* ktls does not support block encryption. +*/ +struct sk_msg *enc = &ctx->open_rec->msg_encrypted; + +sk_msg_trim (sk, enc, enc->sg.size - delta); + } }if (msg->cork_bytes && msg->cork_bytes > msg->sg.size && !enospc && !full_record) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/369 selftests/bpf: fix signedness bug in redir_partial()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fushuai Wang <[email protected]>
[ Upstream commit 6a4bd31f680a1d1cf06492fe6dc4f08da09769e6 ]
When xsend() returns -1 (error), the check 'n < sizeof(buf)' incorrectly treats it as success due to unsigned promotion. Explicitly check for -1 first.
--- tools/testing/selftests/bpf/prog_tests/sockmap_listen.c | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/bpf/prog_tests/sockmap_listen.c +2 -0
@@ -924,6 +924,8 @@ static void redir_partial(int family, int sotype, int sock_map, int parser_map) goto close; n =xsend (c1, buf,sizeof (buf),0 ); +if (n ==-1 ) + goto close;if (n <sizeof (buf))FAIL ("incomplete write" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/369 selftests/bpf: Fix unintentional switch case fall through
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mykyta Yatsenko <[email protected]>
[ Upstream commit 66ab68c9de89672366fdc474f4f185bb58cecf2d ]
Break from switch expression after parsing -n CLI argument in veristat, instead of falling through and enabling comparison mode.
--- tools/testing/selftests/bpf/veristat.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/veristat.c +1 -0
@@ -309,6 +309,7 @@ static error_t parse_arg(int key, char *arg, struct argp_state *state)fprintf (stderr,"invalid top N specifier: %s\n" , arg);argp_usage (state); } +break ;case 'C' : env.comparison_mode = true;break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/369 net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Machata <[email protected]>
[ Upstream commit 3365afd3abda5f6a54f4a822dad5c9314e94c3fc ]
The netfilter hook is invoked with skb->dev for input netdevice, and vif_dev for output netdevice. However at the point of invocation, skb->dev is already set to vif_dev, and MR-forwarded packets are reported with in=out:
# ip6tables -A FORWARD -j LOG --log-prefix '[forw]' # cd tools/testing/selftests/net/forwarding # ./router_multicast.sh # dmesg | fgrep '[forw]' [ 1670.248245] [forw]IN=v5 OUT=v5 [...]
For reference, IPv4 MR code shows in and out as appropriate. Fix by caching skb->dev and using the updated value for output netdev.
--- net/ipv6/ip6mr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/ip6mr.c +2 -1
@@ -2032,6 +2032,7 @@ static int ip6mr_forward2(struct net *net, struct mr_table *mrt, struct sk_buff *skb, int vifi) {struct vif_device *vif = &mrt->vif_table[vifi]; +struct net_device *indev = skb->dev;struct net_device *vif_dev;struct ipv6hdr *ipv6h;struct dst_entry *dst;
@@ -2094,7 +2095,7 @@ static int ip6mr_forward2(struct net *net, struct mr_table *mrt,IP6CB (skb)->flags |=IP6SKB_FORWARDED ;return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD , - net,NULL , skb, skb->dev, vif_dev, + net,NULL , skb, indev, skb->dev, ip6mr_forward2_finish); out_free:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/369 drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 7872997c048e989c7689c2995d230fdca7798000 ]
Running 3D applications with SVGA_FORCE_HOST_BACKED=1 or using an ancient version of mesa was broken because the buffer was pinned in VMW_BO_DOMAIN_SYS and could not be moved to VMW_BO_DOMAIN_MOB during validation.
The compat_shader buffer should not pinned.
--- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c +1 -1
@@ -896,7 +896,7 @@ int vmw_compat_shader_add(struct vmw_private *dev_priv, .busy_domain = VMW_BO_DOMAIN_SYS, .bo_type = ttm_bo_type_device, .size = size, - .pin = true, + .pin = false, .keep_resv = true, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/369 drm/amdgpu: Remove nbiov7.9 replay count reporting
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit 0f566f0e9c614aa3d95082246f5b8c9e8a09c8b3 ]
Direct pcie replay count reporting is not available on nbio v7.9. Reporting is done through firmware.
--- drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 20 -------------------- 1 file changed, 20 deletions(-)
drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c +0 -20
@@ -32,9 +32,6 @@#define NPS_MODE_MASK 0x000000FFL -/* Core 0 Port 0 counter */ -#define smnPCIEP_NAK_COUNTER 0x1A340218 -static void nbio_v7_9_remap_hdp_registers (struct amdgpu_device *adev) { WREG32_SOC15(NBIO, 0, regBIF_BX0_REMAP_HDP_MEM_FLUSH_CNTL,
@@ -453,22 +450,6 @@ static void nbio_v7_9_init_registers(struct amdgpu_device *adev) } } -static u64 nbio_v7_9_get_pcie_replay_count (struct amdgpu_device *adev) -{ -u32 val, nak_r, nak_g; - -if (adev->flags &AMD_IS_APU ) -return 0 ; - -/* Get the number of NAKs received and generated */ - val =RREG32_PCIE (smnPCIEP_NAK_COUNTER); - nak_r = val &0xFFFF ; - nak_g = val >>16 ; - -/* Add the total number of NAKs, i.e the number of replays */ -return (nak_r + nak_g); -} -#define MMIO_REG_HOLE_OFFSET 0x1A000static void nbio_v7_9_set_reg_remap (struct amdgpu_device *adev)
@@ -509,7 +490,6 @@ const struct amdgpu_nbio_funcs nbio_v7_9_funcs = { .get_compute_partition_mode = nbio_v7_9_get_compute_partition_mode, .get_memory_partition_mode = nbio_v7_9_get_memory_partition_mode, .init_registers = nbio_v7_9_init_registers, - .get_pcie_replay_count = nbio_v7_9_get_pcie_replay_count, .set_reg_remap = nbio_v7_9_set_reg_remap, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/369 bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Chen <[email protected]>
[ Upstream commit 99fe8af069a9fa5b09140518b1364e35713a642e ]
In function dump_xx_nlmsg(), when realloc() fails to allocate memory, the original pointer to the buffer is overwritten with NULL. This causes a memory leak because the previously allocated buffer becomes unreachable without being freed.
--- tools/bpf/bpftool/net.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
tools/bpf/bpftool/net.c +9 -6
@@ -366,17 +366,18 @@ static int dump_link_nlmsg(void *cookie, void *msg, struct nlattr **tb) {struct bpf_netdev_t *netinfo = cookie;struct ifinfomsg *ifinfo = msg; +struct ip_devname_ifindex *tmp;if (netinfo->filter_idx >0 && netinfo->filter_idx != ifinfo->ifi_index)return 0 ;if (netinfo->used_len == netinfo->array_len) { - netinfo->devices =realloc (netinfo->devices, - (netinfo->array_len +16 ) * -sizeof (struct ip_devname_ifindex )); -if (!netinfo->devices) + tmp =realloc (netinfo->devices, + (netinfo->array_len +16 ) *sizeof (struct ip_devname_ifindex )); +if (!tmp)return -ENOMEM ; + netinfo->devices = tmp; netinfo->array_len +=16 ; } netinfo->devices[netinfo->used_len].ifindex = ifinfo->ifi_index;
@@ -395,6 +396,7 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb) {struct bpf_tcinfo_t *tcinfo = cookie;struct tcmsg *info = msg; +struct tc_kind_handle *tmp;if (tcinfo->is_qdisc) {/* skip clsact qdisc */
@@ -406,11 +408,12 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb) }if (tcinfo->used_len == tcinfo->array_len) { - tcinfo->handle_array =realloc (tcinfo->handle_array, + tmp =realloc (tcinfo->handle_array, (tcinfo->array_len +16 ) *sizeof (struct tc_kind_handle )); -if (!tcinfo->handle_array) +if (!tmp)return -ENOMEM ; + tcinfo->handle_array = tmp; tcinfo->array_len +=16 ; } tcinfo->handle_array[tcinfo->used_len].handle = info->tcm_handle;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/369 powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haren Myneni <[email protected]>
[ Upstream commit 41a1452759a8b1121df9cf7310acf31d766ba70b ]
IO hotplug add event is handled in the user space with drmgr tool. After the device is enabled, the user space uses /sys/kernel/dlpar interface with “dt add index <drc_index>” to update the device tree. The kernel interface (dlpar_hp_dt_add()) finds the parent node for the specified ‘drc_index’ from ibm,drc-info property. The recent FW provides this property from 2017 onwards. But KVM guest code in some releases is still using the older SLOF firmware which has ibm,drc-indexes property instead of ibm,drc-info.
If the ibm,drc-info is not available, this patch adds changes to search ‘drc_index’ from the indexes array in ibm,drc-indexes property to support old FW.
--- arch/powerpc/platforms/pseries/dlpar.c | 52 +++++++++++++++++++++++++- 1 file changed, 50 insertions(+), 2 deletions(-)
arch/powerpc/platforms/pseries/dlpar.c +50 -2
@@ -404,6 +404,45 @@ get_device_node_with_drc_info(u32 index)return NULL ; } +static struct device_node * +get_device_node_with_drc_indexes (u32 drc_index) +{ +struct device_node *np =NULL ; +u32 nr_indexes, index; +int i, rc; + +for_each_node_with_property (np,"ibm,drc-indexes" ) { +/* +* First element in the array is the total number of +* DRC indexes returned. +*/ + rc =of_property_read_u32_index (np,"ibm,drc-indexes" , +0 , &nr_indexes); +if (rc) + goto out_put_np; + +/* +* Retrieve DRC index from the list and return the +* device node if matched with the specified index. +*/ +for (i =0 ; i < nr_indexes; i++) { + rc =of_property_read_u32_index (np,"ibm,drc-indexes" , + i+1 , &index); +if (rc) + goto out_put_np; + +if (drc_index == index) +return np; + } + } + +return NULL ; + +out_put_np: +of_node_put (np); +return NULL ; +} +static int dlpar_hp_dt_add (u32 index) {struct device_node *np, *nodes;
@@ -423,10 +462,19 @@ static int dlpar_hp_dt_add(u32 index) goto out; } +/* +* Recent FW provides ibm,drc-info property. So search +* for the user specified DRC index from ibm,drc-info +* property. If this property is not available, search +* in the indexes array from ibm,drc-indexes property. +*/ np =get_device_node_with_drc_info (index); -if (!np) -return -EIO ; +if (!np) { + np =get_device_node_with_drc_indexes (index); +if (!np) +return -EIO ; + }/* Next, configure the connector. */ nodes =dlpar_configure_connector (cpu_to_be32 (index), np);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/369 caif: reduce stack size, again
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit b630c781bcf6ff87657146661816d0d30a902139 ]
I tried to fix the stack usage in this function a couple of years ago, but there is still a problem with the latest gcc versions in some configurations:
net/caif/cfctrl.c:553:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
Reduce this once again, with a separate cfctrl_link_setup() function that holds the bulk of all the local variables. It also turns out that the param[] array that takes up a large portion of the stack is write-only and can be left out here.
--- net/caif/cfctrl.c | 294 +++++++++++++++++++++++----------------------- 1 file changed, 144 insertions(+), 150 deletions(-)
net/caif/cfctrl.c +144 -150
@@ -351,17 +351,154 @@ int cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer)return found; } +static int cfctrl_link_setup (struct cfctrl *cfctrl,struct cfpkt *pkt,u8 cmdrsp) +{ +u8 len; +u8 linkid =0 ; +enum cfctrl_srv serv; +enum cfctrl_srv servtype; +u8 endpoint; +u8 physlinkid; +u8 prio; +u8 tmp; +u8 *cp; +int i; +struct cfctrl_link_param linkparam; +struct cfctrl_request_info rsp, *req; + +memset (&linkparam,0 ,sizeof (linkparam)); + + tmp =cfpkt_extr_head_u8 (pkt); + + serv = tmp &CFCTRL_SRV_MASK ; + linkparam.linktype = serv; + + servtype = tmp >>4 ; + linkparam.chtype = servtype; + + tmp =cfpkt_extr_head_u8 (pkt); + physlinkid = tmp &0x07 ; + prio = tmp >>3 ; + + linkparam.priority = prio; + linkparam.phyid = physlinkid; + endpoint =cfpkt_extr_head_u8 (pkt); + linkparam.endpoint = endpoint &0x03 ; + +switch (serv) { +case CFCTRL_SRV_VEI : +case CFCTRL_SRV_DBG : +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); +break ; +case CFCTRL_SRV_VIDEO : + tmp =cfpkt_extr_head_u8 (pkt); + linkparam.u.video.connid = tmp; +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); +break ; + +case CFCTRL_SRV_DATAGRAM : + linkparam.u.datagram.connid =cfpkt_extr_head_u32 (pkt); +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); +break ; +case CFCTRL_SRV_RFM : +/* Construct a frame, convert +* DatagramConnectionID +* to network format long and copy it out... +*/ + linkparam.u.rfm.connid =cfpkt_extr_head_u32 (pkt); + cp = (u8 *) linkparam.u.rfm.volume; +for (tmp =cfpkt_extr_head_u8 (pkt); +cfpkt_more (pkt) && tmp !='\0' ; + tmp =cfpkt_extr_head_u8 (pkt)) + *cp++ = tmp; + *cp ='\0' ; + +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); + +break ; +case CFCTRL_SRV_UTIL : +/* Construct a frame, convert +* DatagramConnectionID +* to network format long and copy it out... +*/ +/* Fifosize KB */ + linkparam.u.utility.fifosize_kb =cfpkt_extr_head_u16 (pkt); +/* Fifosize bufs */ + linkparam.u.utility.fifosize_bufs =cfpkt_extr_head_u16 (pkt); +/* name */ + cp = (u8 *) linkparam.u.utility.name; +caif_assert (sizeof (linkparam.u.utility.name) + >=UTILITY_NAME_LENGTH ); +for (i =0 ; i <UTILITY_NAME_LENGTH &&cfpkt_more (pkt); i++) { + tmp =cfpkt_extr_head_u8 (pkt); + *cp++ = tmp; + } +/* Length */ + len =cfpkt_extr_head_u8 (pkt); + linkparam.u.utility.paramlen = len; +/* Param Data */ + cp = linkparam.u.utility.params; +while (cfpkt_more (pkt) && len--) { + tmp =cfpkt_extr_head_u8 (pkt); + *cp++ = tmp; + } +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); +/* Length */ + len =cfpkt_extr_head_u8 (pkt); +/* Param Data */ +cfpkt_extr_head (pkt,NULL , len); +break ; +default : +pr_warn ("Request setup, invalid type (%d)\n" , serv); +return -1 ; + } + + rsp.cmd =CFCTRL_CMD_LINK_SETUP ; + rsp.param = linkparam; +spin_lock_bh (&cfctrl->info_list_lock); + req =cfctrl_remove_req (cfctrl, &rsp); + +if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) || +cfpkt_erroneous (pkt)) { +pr_err ("Invalid O/E bit or parse error " +"on CAIF control channel\n" ); + cfctrl->res.reject_rsp (cfctrl->serv.layer.up,0 , + req ? req->client_layer :NULL ); + }else { + cfctrl->res.linksetup_rsp (cfctrl->serv.layer.up, linkid, + serv, physlinkid, + req ? req->client_layer :NULL ); + } + +kfree (req); + +spin_unlock_bh (&cfctrl->info_list_lock); + +return 0 ; +} +static int cfctrl_recv (struct cflayer *layer,struct cfpkt *pkt) {u8 cmdrsp;u8 cmd; -int ret =-1 ; -u8 len; -u8 param[255 ]; +int ret =0 ;u8 linkid =0 ;struct cfctrl *cfctrl =container_obj (layer); -struct cfctrl_request_info rsp, *req; - cmdrsp =cfpkt_extr_head_u8 (pkt); cmd = cmdrsp &CFCTRL_CMD_MASK ;
@@ -374,150 +511,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)switch (cmd) {case CFCTRL_CMD_LINK_SETUP : - { -enum cfctrl_srv serv; -enum cfctrl_srv servtype; -u8 endpoint; -u8 physlinkid; -u8 prio; -u8 tmp; -u8 *cp; -int i; -struct cfctrl_link_param linkparam; -memset (&linkparam,0 ,sizeof (linkparam)); - - tmp =cfpkt_extr_head_u8 (pkt); - - serv = tmp &CFCTRL_SRV_MASK ; - linkparam.linktype = serv; - - servtype = tmp >>4 ; - linkparam.chtype = servtype; - - tmp =cfpkt_extr_head_u8 (pkt); - physlinkid = tmp &0x07 ; - prio = tmp >>3 ; - - linkparam.priority = prio; - linkparam.phyid = physlinkid; - endpoint =cfpkt_extr_head_u8 (pkt); - linkparam.endpoint = endpoint &0x03 ; - -switch (serv) { -case CFCTRL_SRV_VEI : -case CFCTRL_SRV_DBG : -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); -break ; -case CFCTRL_SRV_VIDEO : - tmp =cfpkt_extr_head_u8 (pkt); - linkparam.u.video.connid = tmp; -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); -break ; - -case CFCTRL_SRV_DATAGRAM : - linkparam.u.datagram.connid = -cfpkt_extr_head_u32 (pkt); -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); -break ; -case CFCTRL_SRV_RFM : -/* Construct a frame, convert -* DatagramConnectionID -* to network format long and copy it out... -*/ - linkparam.u.rfm.connid = -cfpkt_extr_head_u32 (pkt); - cp = (u8 *) linkparam.u.rfm.volume; -for (tmp =cfpkt_extr_head_u8 (pkt); -cfpkt_more (pkt) && tmp !='\0' ; - tmp =cfpkt_extr_head_u8 (pkt)) - *cp++ = tmp; - *cp ='\0' ; - -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); - -break ; -case CFCTRL_SRV_UTIL : -/* Construct a frame, convert -* DatagramConnectionID -* to network format long and copy it out... -*/ -/* Fifosize KB */ - linkparam.u.utility.fifosize_kb = -cfpkt_extr_head_u16 (pkt); -/* Fifosize bufs */ - linkparam.u.utility.fifosize_bufs = -cfpkt_extr_head_u16 (pkt); -/* name */ - cp = (u8 *) linkparam.u.utility.name; -caif_assert (sizeof (linkparam.u.utility.name) - >=UTILITY_NAME_LENGTH ); -for (i =0 ; - i <UTILITY_NAME_LENGTH - &&cfpkt_more (pkt); i++) { - tmp =cfpkt_extr_head_u8 (pkt); - *cp++ = tmp; - } -/* Length */ - len =cfpkt_extr_head_u8 (pkt); - linkparam.u.utility.paramlen = len; -/* Param Data */ - cp = linkparam.u.utility.params; -while (cfpkt_more (pkt) && len--) { - tmp =cfpkt_extr_head_u8 (pkt); - *cp++ = tmp; - } -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); -/* Length */ - len =cfpkt_extr_head_u8 (pkt); -/* Param Data */ -cfpkt_extr_head (pkt, ¶m, len); -break ; -default : -pr_warn ("Request setup, invalid type (%d)\n" , - serv); - goto error; - } - - rsp.cmd = cmd; - rsp.param = linkparam; -spin_lock_bh (&cfctrl->info_list_lock); - req =cfctrl_remove_req (cfctrl, &rsp); - -if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) || -cfpkt_erroneous (pkt)) { -pr_err ("Invalid O/E bit or parse error " -"on CAIF control channel\n" ); - cfctrl->res.reject_rsp (cfctrl->serv.layer.up, -0 , - req ? req->client_layer - :NULL ); - }else { - cfctrl->res.linksetup_rsp (cfctrl->serv. - layer.up, linkid, - serv, physlinkid, - req ? req-> - client_layer :NULL ); - } - -kfree (req); - -spin_unlock_bh (&cfctrl->info_list_lock); - } + ret =cfctrl_link_setup (cfctrl, pkt, cmdrsp);break ;case CFCTRL_CMD_LINK_DESTROY : linkid =cfpkt_extr_head_u8 (pkt);
@@ -544,9 +538,9 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)break ;default :pr_err ("Unrecognized Control Frame\n" ); + ret =-1 ; goto error; } - ret =0 ; error:cfpkt_destroy (pkt);return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/369 wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 7e04f01bb94fe61c73cc59f0495c3b6c16a83231 ]
With a quite rare chance, RX report might be problematic to make SW think a packet is received on 6 GHz band even if the chip does not support 6 GHz band actually. Since SW won't initialize stuffs for unsupported bands, NULL dereference will happen then in the sequence, rtw89_vif_rx_stats_iter() -> rtw89_core_cancel_6ghz_probe_tx(). So, add a check to avoid it.
The following is a crash log for this case.
BUG: kernel NULL pointer dereference, address: 0000000000000032 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1907 Comm: irq/131-rtw89_p Tainted: G U 6.6.56-05896-g89f5fb0eb30b #1 (HASH:1400 4) Hardware name: Google Telith/Telith, BIOS Google_Telith.15217.747.0 11/12/2024 RIP: 0010:rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core] Code: 4c 89 7d c8 48 89 55 c0 49 8d 44 24 02 48 89 45 b8 45 31 ff eb 11 41 c6 45 3a 01 41 b7 01 4d 8b 6d 00 4d 39 f5 74 42 8b 43 10 <41> 33 45 32 0f b7 4b 14 66 41 33 4d 36 0f b7 c9 09 c1 74 d8 4d 85 RSP: 0018:ffff9f3080138ca0 EFLAGS: 00010246 RAX: 00000000b8bf5770 RBX: ffff91b5e8c639c0 RCX: 0000000000000011 RDX: ffff91b582de1be8 RSI: 0000000000000000 RDI: ffff91b5e8c639e6 RBP: ffff9f3080138d00 R08: 0000000000000000 R09: 0000000000000000 R10: ffff91b59de70000 R11: ffffffffc069be50 R12: ffff91b5e8c639e4 R13: 0000000000000000 R14: ffff91b5828020b8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff91b8efa40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000032 CR3: 00000002bf838000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: <IRQ> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x4f/0xa0 ? asm_exc_page_fault+0x22/0x30 ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ? rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core (HASH:1400 5)] __iterate_interfaces+0x59/0x110 [mac80211 (HASH:1400 6)] ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ieee80211_iterate_active_interfaces_atomic+0x36/0x50 [mac80211 (HASH:1400 6)] rtw89_core_rx_to_mac80211+0xfd/0x1b0 [rtw89_core (HASH:1400 5)] rtw89_core_rx+0x43a/0x980 [rtw89_core (HASH:1400 5)]
--- drivers/net/wireless/realtek/rtw89/core.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/realtek/rtw89/core.c +5 -0
@@ -2014,6 +2014,11 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,if (rx_status->band !=NL80211_BAND_6GHZ )return ; +if (unlikely (!(rtwdev->chip->support_bands &BIT (NL80211_BAND_6GHZ )))) { +rtw89_debug (rtwdev,RTW89_DBG_UNEXP ,"invalid rx on unsupported 6 GHz\n" ); +return ; + } + ssid_ie =cfg80211_find_ie (WLAN_EID_SSID , ies, skb->len);list_for_each_entry (info, &pkt_list[NL80211_BAND_6GHZ ], list) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/369 wifi: rtl818x: Kill URBs before clearing tx status queue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
[ Upstream commit 16d8fd74dbfca0ea58645cd2fca13be10cae3cdd ]
In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before freeing such skb.
BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211] Call Trace: <IRQ> rtl8187_tx_cb+0x116/0x150 [rtl8187] __usb_hcd_giveback_urb+0x9d/0x120 usb_giveback_urb_bh+0xbb/0x140 process_one_work+0x19b/0x3c0 bh_worker+0x1a7/0x210 tasklet_action+0x10/0x30 handle_softirqs+0xf0/0x340 __irq_exit_rcu+0xcd/0xf0 common_interrupt+0x85/0xa0 </IRQ>
Tested on RTL8187BvE device.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +2 -1
@@ -1041,10 +1041,11 @@ static void rtl8187_stop(struct ieee80211_hw *dev, bool suspend)rtl818x_iowrite8 (priv, &priv->map->CONFIG4, reg |RTL818X_CONFIG4_VCOOFF );rtl818x_iowrite8 (priv, &priv->map->EEPROM_CMD,RTL818X_EEPROM_CMD_NORMAL ); +usb_kill_anchored_urbs (&priv->anchored); +while ((skb =skb_dequeue (&priv->b_tx_status.queue)))dev_kfree_skb_any (skb); -usb_kill_anchored_urbs (&priv->anchored);mutex_unlock (&priv->conf_mutex);if (!priv->is_rtl8187b)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/369 wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiu Jianfeng <[email protected]>
[ Upstream commit ed2e916c890944633d6826dce267579334f63ea5 ]
When iwl_opmode_register() fails, it does not unregster rate control, which will cause a memory leak issue, this patch fixes it.
--- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/ops.c +3 -1
@@ -61,8 +61,10 @@ static int __init iwl_mvm_init(void) } ret =iwl_opmode_register ("iwlmvm" , &iwl_mvm_ops); -if (ret) +if (ret) {pr_err ("Unable to register MVM op_mode: %d\n" , ret); +iwl_mvm_rate_control_unregister (); + }return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/369 iwlwifi: Add missing check for alloc_ordered_workqueue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit 90a0d9f339960448a3acc1437a46730f975efd6a ]
Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer.
--- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/dvm/main.c +9 -2
@@ -1048,9 +1048,11 @@ static void iwl_bg_restart(struct work_struct *data)* *****************************************************************************/ -static void iwl_setup_deferred_work (struct iwl_priv *priv) +static int iwl_setup_deferred_work (struct iwl_priv *priv) { priv->workqueue =alloc_ordered_workqueue (DRV_NAME ,0 ); +if (!priv->workqueue) +return -ENOMEM ;INIT_WORK (&priv->restart, iwl_bg_restart);INIT_WORK (&priv->beacon_update, iwl_bg_beacon_update);
@@ -1067,6 +1069,8 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)timer_setup (&priv->statistics_periodic, iwl_bg_statistics_periodic,0 );timer_setup (&priv->ucode_trace, iwl_bg_ucode_trace,0 ); + +return 0 ; }void iwl_cancel_deferred_work (struct iwl_priv *priv)
@@ -1454,7 +1458,9 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,/******************** * 6. Setup services ********************/ -iwl_setup_deferred_work (priv); +if (iwl_setup_deferred_work (priv)) + goto out_uninit_drv; +iwl_setup_rx_handlers (priv);iwl_power_initialize (priv);
@@ -1492,6 +1498,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,iwl_cancel_deferred_work (priv);destroy_workqueue (priv->workqueue); priv->workqueue =NULL ; +out_uninit_drv:iwl_uninit_drv (priv); out_free_eeprom_blob:kfree (priv->eeprom_blob);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/369 wifi: ath11k: clear initialized flag for deinit-ed srng lists
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
[ Upstream commit a5b46aa7cf5f05c213316a018e49a8e086efd98e ]
In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances:
1) First ath11k_hal_dump_srng_stats() call
Last interrupt received for each group:
ath11k_pci 0000:01:00.0: group_id 0 22511ms before
ath11k_pci 0000:01:00.0: group_id 1 14440788ms before
[..]
ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. ath11k_pci 0000:01:00.0: Service connect timeout
ath11k_pci 0000:01:00.0: failed to connect to HTT: -110
ath11k_pci 0000:01:00.0: failed to start core: -110
ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM
ath11k_pci 0000:01:00.0: already resetting count 2
ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110 ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110 ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery [..]
2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit() which destroys srng lists. However, it does not reset per-list ->initialized flag.
3) Second ath11k_hal_dump_srng_stats() call sees stale ->initialized flag and attempts to dump srng stats:
Last interrupt received for each group:
ath11k_pci 0000:01:00.0: group_id 0 66785ms before ath11k_pci 0000:01:00.0: group_id 1 14485062ms before ath11k_pci 0000:01:00.0: group_id 2 14485062ms before ath11k_pci 0000:01:00.0: group_id 3 14485062ms before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath11k_pci 0000:01:00.0: group_id 6 14485062ms before ath11k_pci 0000:01:00.0: group_id 7 66814ms before ath11k_pci 0000:01:00.0: group_id 8 68997ms before ath11k_pci 0000:01:00.0: group_id 9 67588ms before ath11k_pci 0000:01:00.0: group_id 10 69511ms before
BUG: unable to handle page fault for address: ffffa007404eb010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 10022d067 PMD 100b01067 PTE 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k] Call Trace: <TASK> ? __die_body+0xae/0xb0 ? page_fault_oops+0x381/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k (HASH:6cea 4)] ath11k_qmi_driver_event_work+0xbd/0x1050 [ath11k (HASH:6cea 4)] worker_thread+0x389/0x930 kthread+0x149/0x170
Clear per-list ->initialized flag in ath11k_hal_srng_deinit().
--- drivers/net/wireless/ath/ath11k/hal.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/ath/ath11k/hal.c +4 -0
@@ -1346,6 +1346,10 @@ EXPORT_SYMBOL(ath11k_hal_srng_init);void ath11k_hal_srng_deinit (struct ath11k_base *ab) {struct ath11k_hal *hal = &ab->hal; +int i; + +for (i =0 ; i <HAL_SRNG_RING_ID_MAX ; i++) + ab->hal.srng_list[i].initialized =0 ;ath11k_hal_unregister_srng_key (ab);ath11k_hal_free_cont_rdp (ab);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/369 tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: xin.guo <[email protected]>
[ Upstream commit a041f70e573e185d5d5fdbba53f0db2fbe7257ad ]
If the new coming segment covers more than one skbs in the ofo queue, and which seq is equal to rcv_nxt, then the sequence range that is duplicated will be sent as DUP SACK, the detail as below, in step6, the {501,2001} range is clearly including too much DUP SACK range, in violation of RFC 2883 rules.
1. client > server: Flags [.], seq 501:1001, ack 1325288529, win 20000, length 500
2. server > client: Flags [.], ack 1, [nop,nop,sack 1 {501:1001}], length 0
3. client > server: Flags [.], seq 1501:2001, ack 1325288529, win 20000, length 500
4. server > client: Flags [.], ack 1, [nop,nop,sack 2 {1501:2001} {501:1001}], length 0
5. client > server: Flags [.], seq 1:2001, ack 1325288529, win 20000, length 2000
6. server > client: Flags [.], ack 2001, [nop,nop,sack 1 {501:2001}], length 0
After this fix, the final ACK is as below:
6. server > client: Flags [.], ack 2001, options [nop,nop,sack 1 {501:1001}], length 0
[edumazet] added a new packetdrill test in the following patch.
--- net/ipv4/tcp_input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/tcp_input.c +2 -1
@@ -4970,8 +4970,9 @@ static void tcp_ofo_queue(struct sock *sk)if (before (TCP_SKB_CB (skb)->seq, dsack_high)) {__u32 dsack = dsack_high; +if (before (TCP_SKB_CB (skb)->end_seq, dsack_high)) - dsack_high =TCP_SKB_CB (skb)->end_seq; + dsack =TCP_SKB_CB (skb)->end_seq;tcp_dsack_extend (sk,TCP_SKB_CB (skb)->seq, dsack); } p =rb_next (p);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/369 net/mlx5: Check device memory pointer before usage
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stav Aviram <[email protected]>
[ Upstream commit 70f238c902b8c0461ae6fbb8d1a0bbddc4350eea ]
Add a NULL check before accessing device memory to prevent a crash if dev->dm allocation in mlx5_init_once() fails.
--- drivers/infiniband/hw/mlx5/dm.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 ++-- drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 --- 3 files changed, 3 insertions(+), 6 deletions(-)
drivers/infiniband/hw/mlx5/dm.c +1 -1
@@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx,int err;u64 address; -if (!MLX5_CAP_DEV_MEM (dm_db->dev, memic)) +if (!dm_db || !MLX5_CAP_DEV_MEM (dm_db->dev, memic))return ERR_PTR (-EOPNOTSUPP ); dm =kzalloc (sizeof (*dm),GFP_KERNEL );
drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c +2 -2
@@ -30,7 +30,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) dm =kzalloc (sizeof (*dm),GFP_KERNEL );if (!dm) -return ERR_PTR (-ENOMEM ); +return NULL ;spin_lock_init (&dm->lock);
@@ -96,7 +96,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) err_steering:kfree (dm); -return ERR_PTR (-ENOMEM ); +return NULL ; }void mlx5_dm_cleanup (struct mlx5_core_dev *dev)
drivers/net/ethernet/mellanox/mlx5/core/main.c +0 -3
@@ -1092,9 +1092,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) } dev->dm =mlx5_dm_create (dev); -if (IS_ERR (dev->dm)) -mlx5_core_warn (dev,"Failed to init device memory %ld\n" ,PTR_ERR (dev->dm)); - dev->tracer =mlx5_fw_tracer_create (dev); dev->hv_vhca =mlx5_hv_vhca_create (dev); dev->rsc_dump =mlx5_rsc_dump_create (dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/369 net: dst: annotate data-races around dst->input
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit f1c5fd34891a1c242885f48c2e4dc52df180f311 ]
dst_dev_put() can overwrite dst->input while other cpus might read this field (for instance from dst_input())
Add READ_ONCE()/WRITE_ONCE() annotations to suppress potential issues.
We will likely need full RCU protection later.
--- include/net/dst.h | 2 +- include/net/lwtunnel.h | 4 ++-- net/core/dst.c | 2 +- net/ipv4/route.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-)
include/net/dst.h +1 -1
@@ -466,7 +466,7 @@ INDIRECT_CALLABLE_DECLARE(int ip_local_deliver(struct sk_buff *));/* Input packet from network to transport. */ static inline int dst_input (struct sk_buff *skb) { -return INDIRECT_CALL_INET (skb_dst (skb)->input, +return INDIRECT_CALL_INET (READ_ONCE (skb_dst (skb)->input), ip6_input, ip_local_deliver, skb); }
include/net/lwtunnel.h +2 -2
@@ -142,8 +142,8 @@ static inline void lwtunnel_set_redirect(struct dst_entry *dst) dst->output = lwtunnel_output; }if (lwtunnel_input_redirect (dst->lwtstate)) { - dst->lwtstate->orig_input = dst->input; - dst->input = lwtunnel_input; + dst->lwtstate->orig_input =READ_ONCE (dst->input); +WRITE_ONCE (dst->input, lwtunnel_input); } }#else
net/core/dst.c +1 -1
@@ -148,7 +148,7 @@ void dst_dev_put(struct dst_entry *dst) dst->obsolete =DST_OBSOLETE_DEAD ;if (dst->ops->ifdown) dst->ops->ifdown (dst, dev); - dst->input = dst_discard; +WRITE_ONCE (dst->input, dst_discard); dst->output = dst_discard_out; dst->dev = blackhole_netdev; netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker,
net/ipv4/route.c +1 -1
@@ -1684,7 +1684,7 @@ struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt)else if (rt->rt_gw_family ==AF_INET6 ) new_rt->rt_gw6 = rt->rt_gw6; - new_rt->dst.input = rt->dst.input; + new_rt->dst.input =READ_ONCE (rt->dst.input); new_rt->dst.output = rt->dst.output; new_rt->dst.error = rt->dst.error; new_rt->dst.lastuse = jiffies;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/369 net: dst: annotate data-races around dst->output
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2dce8c52a98995c4719def6f88629ab1581c0b82 ]
dst_dev_put() can overwrite dst->output while other cpus might read this field (for instance from dst_output())
Add READ_ONCE()/WRITE_ONCE() annotations to suppress potential issues.
We will likely need RCU protection in the future.
--- include/net/dst.h | 2 +- include/net/lwtunnel.h | 4 ++-- net/core/dst.c | 2 +- net/ipv4/route.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-)
include/net/dst.h +1 -1
@@ -456,7 +456,7 @@ INDIRECT_CALLABLE_DECLARE(int ip_output(struct net *, struct sock *,/* Output packet to network from transport. */ static inline int dst_output (struct net *net,struct sock *sk,struct sk_buff *skb) { -return INDIRECT_CALL_INET (skb_dst (skb)->output, +return INDIRECT_CALL_INET (READ_ONCE (skb_dst (skb)->output), ip6_output, ip_output, net, sk, skb); }
include/net/lwtunnel.h +2 -2
@@ -138,8 +138,8 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len,static inline void lwtunnel_set_redirect (struct dst_entry *dst) {if (lwtunnel_output_redirect (dst->lwtstate)) { - dst->lwtstate->orig_output = dst->output; - dst->output = lwtunnel_output; + dst->lwtstate->orig_output =READ_ONCE (dst->output); +WRITE_ONCE (dst->output, lwtunnel_output); }if (lwtunnel_input_redirect (dst->lwtstate)) { dst->lwtstate->orig_input =READ_ONCE (dst->input);
net/core/dst.c +1 -1
@@ -149,7 +149,7 @@ void dst_dev_put(struct dst_entry *dst)if (dst->ops->ifdown) dst->ops->ifdown (dst, dev);WRITE_ONCE (dst->input, dst_discard); - dst->output = dst_discard_out; +WRITE_ONCE (dst->output, dst_discard_out); dst->dev = blackhole_netdev;netdev_ref_replace (dev, blackhole_netdev, &dst->dev_tracker,GFP_ATOMIC );
net/ipv4/route.c +1 -1
@@ -1685,7 +1685,7 @@ struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt) new_rt->rt_gw6 = rt->rt_gw6; new_rt->dst.input =READ_ONCE (rt->dst.input); - new_rt->dst.output = rt->dst.output; + new_rt->dst.output =READ_ONCE (rt->dst.output); new_rt->dst.error = rt->dst.error; new_rt->dst.lastuse = jiffies; new_rt->dst.lwtstate =lwtstate_get (rt->dst.lwtstate);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/369 kselftest/arm64: Fix check for setting new VLs in sve-ptrace
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 867446f090589626497638f70b10be5e61a0b925 ]
The check that the new vector length we set was the expected one was typoed to an assignment statement which for some reason the compilers didn't spot, most likely due to the macros involved.
--- tools/testing/selftests/arm64/fp/sve-ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/arm64/fp/sve-ptrace.c +1 -1
@@ -251,7 +251,7 @@ static void ptrace_set_get_vl(pid_t child, const struct vec_type *type,return ; } -ksft_test_result (new_sve->vl = prctl_vl,"Set %s VL %u\n" , +ksft_test_result (new_sve->vl == prctl_vl,"Set %s VL %u\n" , type->name, vl);free (new_sve);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/369 bpf: Ensure RCU lock is held around bpf_prog_ksym_find
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit d090326860096df9dac6f27cff76d3f8df44d4f1 ]
Add a warning to ensure RCU lock is held around tree lookup, and then fix one of the invocations in bpf_stack_walker. The program has an active stack frame and won't disappear. Use the opportunity to remove unneeded invocation of is_bpf_text_address.
--- kernel/bpf/core.c | 5 ++++- kernel/bpf/helpers.c | 11 +++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-)
kernel/bpf/core.c +4 -1
@@ -778,7 +778,10 @@ bool is_bpf_text_address(unsigned long addr)struct bpf_prog *bpf_prog_ksym_find (unsigned long addr) { -struct bpf_ksym *ksym =bpf_ksym_find (addr); +struct bpf_ksym *ksym; + +WARN_ON_ONCE (!rcu_read_lock_held ()); + ksym =bpf_ksym_find (addr);return ksym && ksym->prog ? container_of(ksym, struct bpf_prog_aux, ksym)->prog :
kernel/bpf/helpers.c +9 -2
@@ -2781,9 +2781,16 @@ static bool bpf_stack_walker(void *cookie, u64 ip, u64 sp, u64 bp)struct bpf_throw_ctx *ctx = cookie;struct bpf_prog *prog; -if (!is_bpf_text_address (ip)) -return !ctx->cnt; +/* +* The RCU read lock is held to safely traverse the latch tree, but we +* don't need its protection when accessing the prog, since it has an +* active stack frame on the current stack trace, and won't disappear. +*/ +rcu_read_lock (); prog =bpf_prog_ksym_find (ip); +rcu_read_unlock (); +if (!prog) +return !ctx->cnt; ctx->cnt++;if (bpf_is_subprog (prog))return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/369 drm/msm/dpu: Fill in min_prefill_lines for SC8180X
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 5136acc40afc0261802e5cb01b04f871bf6d876b ]
Based on the downstream release, predictably same value as for SM8150.
Patchwork: https://patchwork.freedesktop.org/patch/657794/
--- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h +1 -0
@@ -383,6 +383,7 @@ static const struct dpu_perf_cfg sc8180x_perf_data = { .min_core_ib = 2400000, .min_llcc_ib = 800000, .min_dram_ib = 800000, + .min_prefill_lines = 24, .danger_lut_tbl = {0xf, 0xffff, 0x0}, .safe_lut_tbl = {0xfff0, 0xf000, 0xffff}, .qos_lut_tbl = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/369 m68k: Dont unregister boot console needlessly
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 83f672a7f69ec38b1bbb27221e342937f68c11c7 ]
When MACH_IS_MVME147, the boot console calls mvme147_scc_write() to generate console output. That will continue to work even after debug_cons_nputs() becomes unavailable so there's no need to unregister the boot console.
Take the opportunity to remove a repeated MACH_IS_* test. Use the actual .write method (instead of a wrapper) and test that pointer instead. This means adding an unused parameter to debug_cons_nputs() for consistency with the struct console API.
early_printk.c is only built when CONFIG_EARLY_PRINTK=y. As of late, head.S is only built when CONFIG_MMU_MOTOROLA=y. So let the former symbol depend on the latter, to obviate some ifdef conditionals.
--- arch/m68k/Kconfig.debug | 2 +- arch/m68k/kernel/early_printk.c | 42 +++++++++++---------------------- arch/m68k/kernel/head.S | 8 +++---- 3 files changed, 19 insertions(+), 33 deletions(-)
arch/m68k/Kconfig.debug +1 -1
@@ -10,7 +10,7 @@ config BOOTPARAM_STRING config EARLY_PRINTK bool "Early printk" - depends on !(SUN3 || M68000 || COLDFIRE) + depends on MMU_MOTOROLA help Write kernel log output directly to a serial port. Where implemented, output goes to the framebuffer as well.
arch/m68k/kernel/early_printk.c +14 -28
65 lines not on this page · raw message
arch/m68k/kernel/head.S +4 -4
@@ -3263,8 +3263,8 @@ func_return putn * turns around and calls the internal routines. This routine * is used by the boot console. * - * The calling parameters are: - * void debug_cons_nputs(const char *str, unsigned length) + * The function signature is - + * void debug_cons_nputs(struct console *c, const char *s, unsigned int n) * * This routine does NOT understand variable arguments only * simple strings!
@@ -3273,8 +3273,8 @@ ENTRY(debug_cons_nputs) moveml %d0/%d1/%a0,%sp@- movew %sr,%sp@- ori #0x0700,%sr - movel %sp@(18),%a0 /* fetch parameter */ - movel %sp@(22),%d1 /* fetch parameter */ + movel %sp@(22),%a0 /* char *s */ + movel %sp@(26),%d1 /* unsigned int n */ jra 2f 1: #ifdef CONSOLE_DEBUG
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/369 refscale: Check that nreaders and loops multiplication doesnt overflow
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Sadovnikov <[email protected]>
[ Upstream commit 005b6187705bc9723518ce19c5cb911fc1f7ef07 ]
The nreaders and loops variables are exposed as module parameters, which, in certain combinations, can lead to multiplication overflow.
Besides, loops parameter is defined as long, while through the code is used as int, which can cause truncation on 64-bit kernels and possible zeroes where they shouldn't appear.
Since code uses result of multiplication as int anyway, it only makes sense to replace loops with int. Multiplication overflow check is also added due to possible multiplication between two very big numbers.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- kernel/rcu/refscale.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
kernel/rcu/refscale.c +7 -3
@@ -81,7 +81,7 @@ torture_param(int, holdoff, IS_BUILTIN(CONFIG_RCU_REF_SCALE_TEST) ? 10 : 0,// Number of typesafe_lookup structures, that is, the degree of concurrency. torture_param (long, lookup_instances,0 ,"Number of typesafe_lookup structures." );// Number of loops per experiment, all readers execute operations concurrently. -torture_param (long, loops,10000 ,"Number of loops per experiment." ); +torture_param (int, loops,10000 ,"Number of loops per experiment." );// Number of readers, with -1 defaulting to about 75% of the CPUs. torture_param (int, nreaders,-1 ,"Number of readers, -1 for 75% of CPUs." );// Number of runs.
@@ -1029,7 +1029,7 @@ static void ref_scale_print_module_parms(const struct ref_scale_ops *cur_ops, const char *tag) { pr_alert("%s" SCALE_FLAG -"--- %s: verbose=%d verbose_batched=%d shutdown=%d holdoff=%d lookup_instances=%ld loops=%ld nreaders=%d nruns=%d readdelay=%d\n" , scale_type, tag, +"--- %s: verbose=%d verbose_batched=%d shutdown=%d holdoff=%d lookup_instances=%ld loops=%d nreaders=%d nruns=%d readdelay=%d\n" , scale_type, tag, verbose, verbose_batched, shutdown, holdoff, lookup_instances, loops, nreaders, nruns, readdelay); }
@@ -1126,12 +1126,16 @@ ref_scale_init(void)// Reader tasks (default to ~75% of online CPUs). if (nreaders <0 ) nreaders = (num_online_cpus () >>1 ) + (num_online_cpus () >>2 ); -if (WARN_ONCE (loops <=0 ,"%s: loops = %ld, adjusted to 1\n" , __func__, loops)) +if (WARN_ONCE (loops <=0 ,"%s: loops = %d, adjusted to 1\n" , __func__, loops)) loops =1 ;if (WARN_ONCE (nreaders <=0 ,"%s: nreaders = %d, adjusted to 1\n" , __func__, nreaders)) nreaders =1 ;if (WARN_ONCE (nruns <=0 ,"%s: nruns = %d, adjusted to 1\n" , __func__, nruns)) nruns =1 ; +if (WARN_ONCE (loops >INT_MAX / nreaders, +"%s: nreaders * loops will overflow, adjusted loops to %d" , + __func__,INT_MAX / nreaders)) + loops =INT_MAX / nreaders; reader_tasks =kcalloc (nreaders,sizeof (reader_tasks[0 ]),GFP_KERNEL );if (!reader_tasks) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/369 drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit a54e4639c4ef37a0241bac7d2a77f2e6ffb57099 ]
There is a small typo in phm_wait_on_indirect_register().
Swap mask and value arguments provided to phm_wait_on_register() so that they satisfy the function signature and actual usage scheme.
Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
In practice this doesn't fix any issues because the only place this function is used uses the same value for the value and mask.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c +1 -1
@@ -149,7 +149,7 @@ int phm_wait_on_indirect_register(struct pp_hwmgr *hwmgr, }cgs_write_register (hwmgr->device, indirect_port, index); -return phm_wait_on_register (hwmgr, indirect_port +1 , mask, value); +return phm_wait_on_register (hwmgr, indirect_port +1 , value, mask); } int phm_wait_for_register_unequal(struct pp_hwmgr *hwmgr,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/369 sched/psi: Optimize psi_group_change() cpu_clock() usage
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 570c8efd5eb79c3725ba439ce105ed1bedc5acd9 ]
Dietmar reported that commit 3840cbe24cf0 ("sched: psi: fix bogus pressure spikes from aggregation race") caused a regression for him on a high context switch rate benchmark (schbench) due to the now repeating cpu_clock() calls.
In particular the problem is that get_recent_times() will extrapolate the current state to 'now'. But if an update uses a timestamp from before the start of the update, it is possible to get two reads with inconsistent results. It is effectively back-dating an update.
(note that this all hard-relies on the clock being synchronized across CPUs -- if this is not the case, all bets are off).
Combine this problem with the fact that there are per-group-per-cpu seqcounts, the commit in question pushed the clock read into the group iteration, causing tree-depth cpu_clock() calls. On architectures where cpu_clock() has appreciable overhead, this hurts.
Instead move to a per-cpu seqcount, which allows us to have a single clock read for all group updates, increasing internal consistency and lowering update overhead. This comes at the cost of a longer update side (proportional to the tree depth) which can cause the read side to retry more often.
--- include/linux/psi_types.h | 6 +- kernel/sched/psi.c | 121 +++++++++++++++++++++----------------- 2 files changed, 68 insertions(+), 59 deletions(-)
include/linux/psi_types.h +2 -4
@@ -84,11 +84,9 @@ enum psi_aggregators {struct psi_group_cpu {/* 1st cacheline updated by the scheduler */ -/* Aggregator needs to know of concurrent changes */ -seqcount_t seq____cacheline_aligned_in_smp ; -/* States of the tasks belonging to this group */ -unsigned int tasks[NR_PSI_TASK_COUNTS ]; +unsigned int tasks[NR_PSI_TASK_COUNTS ] +____cacheline_aligned_in_smp ;/* Aggregate pressure state derived from the tasks */ u32 state_mask;
kernel/sched/psi.c +66 -55
255 lines not on this page · raw message
Signature · 1 line
2.39.5
Re: [PATCH 6.12 096/369] sched/psi: Optimize psi_group_change() cpu_clock() usage
IIRC, there was a small bug with this which Peter already fixed
https://lkml.kernel.org/r/[email protected]
but I'm not sure whether this fix 'sched/psi: Fix psi_seq initialization' is already available for pulling?
-- Dietmar
Quoted 334 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit
570c8efd5eb79c3725ba439ce105ed1bedc5acd9]Dietmar reported that commit
3840cbe24cf0("sched: psi: fix bogus pressure spikes from aggregation race") caused a regression for him on a high context switch rate benchmark (schbench) due to the now repeatingcpu_clock()calls.In particular the problem is that
get_recent_times()will extrapolate the current state to 'now'. But if an update uses a timestamp from before the start of the update, it is possible to get two reads with inconsistent results. It is effectively back-dating an update.(note that this all hard-relies on the clock being synchronized across CPUs -- if this is not the case, all bets are off).
Combine this problem with the fact that there are per-group-per-cpu seqcounts, the commit in question pushed the clock read into the group iteration, causing tree-depth
cpu_clock()calls. On architectures wherecpu_clock()has appreciable overhead, this hurts.Instead move to a per-cpu seqcount, which allows us to have a single clock read for all group updates, increasing internal consistency and lowering update overhead. This comes at the cost of a longer update side (proportional to the tree depth) which can cause the read side to retry more often.
Fixes 3840cbe24cf0 ("sched: psi: fix bogus pressure spikes from aggregation race")Reported-by Dietmar Eggemann <[email protected]>Signed-off-by Peter Zijlstra (Intel) <[email protected]>Acked-by Johannes Weiner <[email protected]>Tested-by Dietmar Eggemann <[email protected]>,Signed-off-by Sasha Levin <[email protected]>--- include/linux/psi_types.h | 6 +- kernel/sched/psi.c | 121 +++++++++++++++++++++----------------- 2 files changed, 68 insertions(+), 59 deletions(-)include/linux/psi_types.h +2
-4@@ -84,11 +84,9 @@ enum psi_aggregators {struct psi_group_cpu {/* 1st cacheline updated by the scheduler */ -/* Aggregator needs to know of concurrent changes */ -seqcount_t seq____cacheline_aligned_in_smp ; -/* States of the tasks belonging to this group */ -unsigned int tasks[NR_PSI_TASK_COUNTS ]; +unsigned int tasks[NR_PSI_TASK_COUNTS ] +____cacheline_aligned_in_smp ;/* Aggregate pressure state derived from the tasks */ u32 state_mask;kernel/sched/psi.c +66
-55@@ -172,6 +172,28 @@ struct psi_group psi_system = { .pcpu = &system_group_pcpu, }; +static DEFINE_PER_CPU(seqcount_t, psi_seq); + +static inline void psi_write_begin (int cpu) +{ +write_seqcount_begin (per_cpu_ptr (&psi_seq, cpu)); +} + +static inline void psi_write_end (int cpu) +{ +write_seqcount_end (per_cpu_ptr (&psi_seq, cpu)); +} + +static inline u32 psi_read_begin (int cpu) +{ +return read_seqcount_begin (per_cpu_ptr (&psi_seq, cpu)); +} + +static inline bool psi_read_retry (int cpu,u32 seq) +{ +return read_seqcount_retry (per_cpu_ptr (&psi_seq, cpu), seq); +} +static void psi_avgs_work (struct work_struct *work);static void poll_timer_fn (struct timer_list *t);@@ -182,7 +204,7 @@ static void group_init(struct psi_group *group) group->enabled = true;for_each_possible_cpu (cpu) -seqcount_init (&per_cpu_ptr (group->pcpu, cpu)->seq); +seqcount_init (per_cpu_ptr (&psi_seq, cpu)); group->avg_last_update =sched_clock (); group->avg_next_update = group->avg_last_update + psi_period;mutex_init (&group->avgs_lock);@@ -262,14 +284,14 @@ static void get_recent_times(struct psi_group *group, int cpu,/* Snapshot a coherent view of the CPU state */ do { - seq =read_seqcount_begin (&groupc->seq); + seq =psi_read_begin (cpu); now =cpu_clock (cpu);memcpy (times, groupc->times,sizeof (groupc->times)); state_mask = groupc->state_mask; state_start = groupc->state_start;if (cpu == current_cpu)memcpy (tasks, groupc->tasks,sizeof (groupc->tasks)); - }while (read_seqcount_retry (&groupc->seq, seq)); + }while (psi_read_retry (cpu, seq));/* Calculate state time deltas against the previous snapshot */ for (s =0 ; s <NR_PSI_STATES ; s++) {@@ -768,30 +790,20 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) groupc->times[PSI_NONIDLE ] += delta; } +#define for_each_group (iter, group) \ + for (typeof(group) iter = group; iter; iter = iter->parent) +static void psi_group_change (struct psi_group *group,int cpu,unsigned int clear,unsigned int set, -bool wake_clock) +u64 now,bool wake_clock) {struct psi_group_cpu *groupc;unsigned int t, m;u32 state_mask; -u64 now;lockdep_assert_rq_held (cpu_rq (cpu)); groupc =per_cpu_ptr (group->pcpu, cpu); -/* -* First we update the task counts according to the state -* change requested through the @clear and @set bits. -* -* Then if the cgroup PSI stats accounting enabled, we -* assess the aggregate resource states this CPU's tasks -* have been in since the last change, and account any -* SOME and FULL time these may have resulted in. -*/ -write_seqcount_begin (&groupc->seq); - now =cpu_clock (cpu); -/* * Start with TSK_ONCPU, which doesn't have a corresponding * task count - it's just a boolean flag directly encoded in @@ -843,7 +855,6 @@ static void psi_group_change(struct psi_group *group, int cpu, groupc->state_mask = state_mask; -write_seqcount_end (&groupc->seq);return ; }@@ -864,8 +875,6 @@ static void psi_group_change(struct psi_group *group, int cpu, groupc->state_mask = state_mask; -write_seqcount_end (&groupc->seq); -if (state_mask & group->rtpoll_states)psi_schedule_rtpoll_work (group,1 , false);@@ -900,24 +909,29 @@ static void psi_flags_change(struct task_struct *task, int clear, int set)void psi_task_change (struct task_struct *task,int clear,int set) {int cpu =task_cpu (task); -struct psi_group *group; +u64 now;if (!task->pid)return ;psi_flags_change (task, clear, set); - group =task_psi_group (task); -do { -psi_group_change (group, cpu, clear, set, true); - }while ((group = group->parent)); +psi_write_begin (cpu); + now =cpu_clock (cpu); +for_each_group (group,task_psi_group (task)) +psi_group_change (group, cpu, clear, set, now, true); +psi_write_end (cpu); }void psi_task_switch (struct task_struct *prev,struct task_struct *next,bool sleep) { -struct psi_group *group, *common =NULL ; +struct psi_group *common =NULL ;int cpu =task_cpu (prev); +u64 now; + +psi_write_begin (cpu); + now =cpu_clock (cpu);if (next->pid) {psi_flags_change (next,0 ,TSK_ONCPU );@@ -926,16 +940,15 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next,* ancestors with @prev, those will already have @prev's * TSK_ONCPU bit set, and we can stop the iteration there. */ - group =task_psi_group (next); -do { -if (per_cpu_ptr (group->pcpu, cpu)->state_mask & -PSI_ONCPU ) { +for_each_group (group,task_psi_group (next)) { +struct psi_group_cpu *groupc =per_cpu_ptr (group->pcpu, cpu); + +if (groupc->state_mask &PSI_ONCPU ) { common = group;break ; } - -psi_group_change (group, cpu,0 ,TSK_ONCPU , true); - }while ((group = group->parent)); +psi_group_change (group, cpu,0 ,TSK_ONCPU , now, true); + } }if (prev->pid) {@@ -968,12 +981,11 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next,psi_flags_change (prev, clear, set); - group =task_psi_group (prev); -do { +for_each_group (group,task_psi_group (prev)) {if (group == common)break ; -psi_group_change (group, cpu, clear, set, wake_clock); - }while ((group = group->parent)); +psi_group_change (group, cpu, clear, set, now, wake_clock); + }/* * TSK_ONCPU is handled up to the common ancestor. If there are @@ -983,20 +995,21 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next,*/ if ((prev->psi_flags ^ next->psi_flags) & ~TSK_ONCPU ) { clear &= ~TSK_ONCPU ; -for (; group; group = group->parent) -psi_group_change (group, cpu, clear, set, wake_clock); +for_each_group (group, common) +psi_group_change (group, cpu, clear, set, now, wake_clock); } } +psi_write_end (cpu); }#ifdef CONFIG_IRQ_TIME_ACCOUNTING void psi_account_irqtime (struct rq *rq,struct task_struct *curr,struct task_struct *prev) {int cpu =task_cpu (curr); -struct psi_group *group;struct psi_group_cpu *groupc;s64 delta;u64 irq; +u64 now;if (static_branch_likely (&psi_disabled))return ;@@ -1005,8 +1018,7 @@ void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_streturn ;lockdep_assert_rq_held (rq); - group =task_psi_group (curr); -if (prev &&task_psi_group (prev) == group) +if (prev &&task_psi_group (prev) ==task_psi_group (curr))return ; irq =irq_time_read (cpu);@@ -1015,25 +1027,22 @@ void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_streturn ; rq->psi_irq_time = irq; -do { -u64 now; +psi_write_begin (cpu); + now =cpu_clock (cpu); +for_each_group (group,task_psi_group (curr)) {if (!group->enabled)continue ; groupc =per_cpu_ptr (group->pcpu, cpu); -write_seqcount_begin (&groupc->seq); - now =cpu_clock (cpu); -record_times (groupc, now); groupc->times[PSI_IRQ_FULL ] += delta; -write_seqcount_end (&groupc->seq); -if (group->rtpoll_states & (1 <<PSI_IRQ_FULL ))psi_schedule_rtpoll_work (group,1 , false); - } while ((group = group->parent)); + } + psi_write_end(cpu); }#endif @@ -1221,12 +1230,14 @@ void psi_cgroup_restart(struct psi_group *group)return ;for_each_possible_cpu (cpu) { -struct rq *rq =cpu_rq (cpu); -struct rq_flags rf; +u64 now; -rq_lock_irq (rq, &rf); -psi_group_change (group, cpu,0 ,0 , true); -rq_unlock_irq (rq, &rf); +guard (rq_lock_irq)(cpu_rq (cpu)); + +psi_write_begin (cpu); + now =cpu_clock (cpu); +psi_group_change (group, cpu,0 ,0 , now, true); +psi_write_end (cpu); } }#endif /* CONFIG_CGROUPS */
Re: [PATCH 6.12 096/369] sched/psi: Optimize psi_group_change() cpu_clock() usage
Quoted 6 lines · Dietmar Eggemann
IIRC, there was a small bug with this which Peter already fixed
https://lkml.kernel.org/r/[email protected]
but I'm not sure whether this fix 'sched/psi: Fix
psi_seqinitialization' is already available for pulling?
It's included later in the series:
https://lore.kernel.org/stable/[email protected]/T/#m0ddd243fe107dea7488d119cb60e8a9e18e2c9a1
Linus just didn't keep the CC list when he picked up the fix.
Re: [PATCH 6.12 096/369] sched/psi: Optimize psi_group_change() cpu_clock() usage
Quoted 5 lines · Johannes Weiner
Quoted 4 lines · Dietmar Eggemann
IIRC, there was a small bug with this which Peter already fixed
Quoted 8 lines
Quoted 2 lines
but I'm not sure whether this fix 'sched/psi: Fix
psi_seqinitialization' is already available for pulling?It's included later in the series:
https://lore.kernel.org/stable/[email protected]/T/#m0ddd243fe107dea7488d119cb60e8a9e18e2c9a1
Linus just didn't keep the CC list when he picked up the fix.
Ah, I see. Thanks!
Greg Kroah-Hartman
maintainerPATCH 97/369 fbcon: Fix outdated registered_fb reference in comment
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shixiong Ou <[email protected]>
[ Upstream commit 0f168e7be696a17487e83d1d47e5a408a181080f ]
The variable was renamed to fbcon_registered_fb, but this comment was not updated along with the change. Correct it to avoid confusion.
--- drivers/video/fbdev/core/fbcon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/fbdev/core/fbcon.c +2 -2
@@ -953,13 +953,13 @@ static const char *fbcon_startup(void)int rows, cols;/* -* If num_registered_fb is zero, this is a call for the dummy part. +* If fbcon_num_registered_fb is zero, this is a call for the dummy part. * The frame buffer devices weren't initialized yet. */ if (!fbcon_num_registered_fb || info_idx ==-1 )return display_desc;/* -* Instead of blindly using registered_fb[0], we use info_idx, set by +* Instead of blindly using fbcon_registered_fb[0], we use info_idx, set by * fbcon_fb_registered(); */ info = fbcon_registered_fb[info_idx];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/369 netfilter: nf_tables: Drop dead code from fill_*_info routines
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 8080357a8c6cf4905bbd8969412c19d34be3395e ]
This practically reverts commit 28339b21a365 ("netfilter: nf_tables: do not send complete notification of deletions"): The feature was never effective, due to prior modification of 'event' variable the conditional early return never happened.
User space also relies upon the current behaviour, so better reintroduce the shortened deletion notifications once it is fixed.
--- net/netfilter/nf_tables_api.c | 25 ------------------------- 1 file changed, 25 deletions(-)
net/netfilter/nf_tables_api.c +0 -25
@@ -1029,11 +1029,6 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, NFTA_TABLE_PAD)) goto nla_put_failure; -if (event ==NFT_MSG_DELTABLE ) { -nlmsg_end (skb, nlh); -return 0 ; - } -if (nla_put_be32 (skb,NFTA_TABLE_FLAGS ,htonl (table->flags &NFT_TABLE_F_MASK ))) goto nla_put_failure;
@@ -1889,11 +1884,6 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, NFTA_CHAIN_PAD)) goto nla_put_failure; -if (event ==NFT_MSG_DELCHAIN && !hook_list) { -nlmsg_end (skb, nlh); -return 0 ; - } -if (nft_is_base_chain (chain)) {const struct nft_base_chain *basechain =nft_base_chain (chain);struct nft_stats __percpu *stats;
@@ -4678,11 +4668,6 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, NFTA_SET_PAD)) goto nla_put_failure; -if (event ==NFT_MSG_DELSET ) { -nlmsg_end (skb, nlh); -return 0 ; - } -if (set->flags !=0 )if (nla_put_be32 (skb,NFTA_SET_FLAGS ,htonl (set->flags))) goto nla_put_failure;
@@ -8017,11 +8002,6 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, NFTA_OBJ_PAD)) goto nla_put_failure; -if (event ==NFT_MSG_DELOBJ ) { -nlmsg_end (skb, nlh); -return 0 ; - } -if (nla_put_be32 (skb,NFTA_OBJ_TYPE ,htonl (obj->ops->type->type)) ||nla_put_be32 (skb,NFTA_OBJ_USE ,htonl (obj->use)) ||nft_object_dump (skb,NFTA_OBJ_DATA , obj, reset))
@@ -9040,11 +9020,6 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, NFTA_FLOWTABLE_PAD)) goto nla_put_failure; -if (event ==NFT_MSG_DELFLOWTABLE && !hook_list) { -nlmsg_end (skb, nlh); -return 0 ; - } -if (nla_put_be32 (skb,NFTA_FLOWTABLE_USE ,htonl (flowtable->use)) ||nla_put_be32 (skb,NFTA_FLOWTABLE_FLAGS ,htonl (flowtable->data.flags))) goto nla_put_failure;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/369 netfilter: nf_tables: adjust lockdep assertions handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit 8df1b40de76979bb8e975201d07b71103d5de820 ]
It's needed to check the return value of lockdep_commit_lock_is_held(), otherwise there's no point in this assertion as it doesn't print any debug information on itself.
Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
--- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +2 -2
@@ -3874,7 +3874,7 @@ void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule)/* can only be used if rule is no longer visible to dumps */ static void nf_tables_rule_release (const struct nft_ctx *ctx,struct nft_rule *rule) { -lockdep_commit_lock_is_held (ctx->net); +WARN_ON_ONCE (!lockdep_commit_lock_is_held (ctx->net));nft_rule_expr_deactivate (ctx, rule,NFT_TRANS_RELEASE );nf_tables_rule_destroy (ctx, rule);
@@ -5659,7 +5659,7 @@ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,struct nft_set_binding *binding, enum nft_trans_phase phase) { - lockdep_commit_lock_is_held(ctx->net); + WARN_ON_ONCE(!lockdep_commit_lock_is_held(ctx->net));switch (phase) {case NFT_TRANS_PREPARE_ERROR :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/369 arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Korsnes <[email protected]>
[ Upstream commit 75cd37c5f28b85979fd5a65174013010f6b78f27 ]
This option was removed from the Kconfig in commit 8c710f75256b ("net/sched: Retire tcindex classifier") but it was not removed from the defconfigs.
--- arch/powerpc/configs/ppc6xx_defconfig | 1 - 1 file changed, 1 deletion(-)
arch/powerpc/configs/ppc6xx_defconfig +0 -1
@@ -253,7 +253,6 @@ CONFIG_NET_SCH_DSMARK=m CONFIG_NET_SCH_NETEM=m CONFIG_NET_SCH_INGRESS=m CONFIG_NET_CLS_BASIC=m -CONFIG_NET_CLS_TCINDEX=m CONFIG_NET_CLS_ROUTE4=m CONFIG_NET_CLS_FW=m CONFIG_NET_CLS_U32=m
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/369 um: rtc: Avoid shadowing err in uml_rtc_start()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <[email protected]>
[ Upstream commit 4c916e3b224a02019b3cc3983a15f32bfd9a22df ]
Remove the declaration of 'err' inside the 'if (timetravel)' block, as it would otherwise be unavailable outside that block, potentially leading to uml_rtc_start() returning an uninitialized value.
--- arch/um/drivers/rtc_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/um/drivers/rtc_user.c +1 -1
@@ -28,7 +28,7 @@ int uml_rtc_start(bool timetravel)int err;if (timetravel) { -int err =os_pipe (uml_rtc_irq_fds,1 ,1 ); + err =os_pipe (uml_rtc_irq_fds,1 ,1 );if (err) goto fail; }else {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/369 iommu/amd: Enable PASID and ATS capabilities in the correct order
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Easwar Hariharan <[email protected]>
[ Upstream commit c694bc8b612ddd0dd70e122a00f39cb1e2e6927f ]
Per the PCIe spec, behavior of the PASID capability is undefined if the value of the PASID Enable bit changes while the Enable bit of the function's ATS control register is Set. Unfortunately, pdev_enable_caps() does exactly that by ordering enabling ATS for the device before enabling PASID.
--- drivers/iommu/amd/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd/iommu.c +1 -1
@@ -483,8 +483,8 @@ static inline void pdev_disable_cap_pasid(struct pci_dev *pdev)static void pdev_enable_caps (struct pci_dev *pdev) { -pdev_enable_cap_ats (pdev);pdev_enable_cap_pasid (pdev); +pdev_enable_cap_ats (pdev);pdev_enable_cap_pri (pdev); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/369 net/sched: Restrict conditions for adding duplicating netems to qdisc tree
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Liu <[email protected]>
[ Upstream commit ec8e0e3d7adef940cdf9475e2352c0680189d14e ]
netem_enqueue's duplication prevention logic breaks when a netem resides in a qdisc tree with other netems - this can lead to a soft lockup and OOM loop in netem_dequeue, as seen in [1]. Ensure that a duplicating netem cannot exist in a tree with other netems.
Previous approaches suggested in discussions in chronological order:
1) Track duplication status or ttl in the sk_buff struct. Considered too specific a use case to extend such a struct, though this would be a resilient fix and address other previous and potential future DOS bugs like the one described in loopy fun [2].
2) Restrict netem_enqueue recursion depth like in act_mirred with a per cpu variable. However, netem_dequeue can call enqueue on its child, and the depth restriction could be bypassed if the child is a netem.
3) Use the same approach as in 2, but add metadata in netem_skb_cb to handle the netem_dequeue case and track a packet's involvement in duplication. This is an overly complex approach, and Jamal notes that the skb cb can be overwritten to circumvent this safeguard.
4) Prevent the addition of a netem to a qdisc tree if its ancestral path contains a netem. However, filters and actions can cause a packet to change paths when re-enqueued to the root from netem duplication, leading us to the current solution: prevent a duplicating netem from inhabiting the same tree as other netems.
[1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/
[2] https://lwn.net/Articles/719297/
--- net/sched/sch_netem.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+)
net/sched/sch_netem.c +40 -0
@@ -972,6 +972,41 @@ static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,return 0 ; } +static const struct Qdisc_class_ops netem_class_ops; + +static int check_netem_in_tree (struct Qdisc *sch,bool duplicates, +struct netlink_ext_ack *extack) +{ +struct Qdisc *root, *q; +unsigned int i; + + root =qdisc_root_sleeping (sch); + +if (sch != root && root->ops->cl_ops == &netem_class_ops) { +if (duplicates || + ((struct netem_sched_data *)qdisc_priv (root))->duplicate) + goto err; + } + +if (!qdisc_dev (root)) +return 0 ; + +hash_for_each (qdisc_dev (root)->qdisc_hash, i, q, hash) { +if (sch != q && q->ops->cl_ops == &netem_class_ops) { +if (duplicates || + ((struct netem_sched_data *)qdisc_priv (q))->duplicate) + goto err; + } + } + +return 0 ; + +err: +NL_SET_ERR_MSG (extack, +"netem: cannot mix duplicating netems with other netems in tree" ); +return -EINVAL ; +} +/* Parse netlink message to set options */ static int netem_change (struct Qdisc *sch,struct nlattr *opt,struct netlink_ext_ack *extack)
@@ -1030,6 +1065,11 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt, q->gap = qopt->gap; q->counter =0 ; q->loss = qopt->loss; + + ret =check_netem_in_tree (sch, qopt->duplicate, extack); +if (ret) + goto unlock; + q->duplicate = qopt->duplicate;/* for compatibility with earlier versions.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/369 net_sched: act_ctinfo: use atomic64_t for three counters
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d300335b4e18672913dd792ff9f49e6cccf41d26 ]
Commit 21c167aa0ba9 ("net/sched: act_ctinfo: use percpu stats") missed that stats_dscp_set, stats_dscp_error and stats_cpmark_set might be written (and read) locklessly.
Use atomic64_t for these three fields, I doubt act_ctinfo is used heavily on big SMP hosts anyway.
--- include/net/tc_act/tc_ctinfo.h | 6 +++--- net/sched/act_ctinfo.c | 19 +++++++++++-------- 2 files changed, 14 insertions(+), 11 deletions(-)
include/net/tc_act/tc_ctinfo.h +3 -3
@@ -18,9 +18,9 @@ struct tcf_ctinfo_params {struct tcf_ctinfo {struct tc_action common;struct tcf_ctinfo_params __rcu *params; -u64 stats_dscp_set; -u64 stats_dscp_error; -u64 stats_cpmark_set; +atomic64_t stats_dscp_set; +atomic64_t stats_dscp_error; +atomic64_t stats_cpmark_set; };enum {
net/sched/act_ctinfo.c +11 -8
@@ -44,9 +44,9 @@ static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca,ipv4_change_dsfield (ip_hdr (skb),INET_ECN_MASK , newdscp); - ca->stats_dscp_set++; +atomic64_inc (&ca->stats_dscp_set); }else { - ca->stats_dscp_error++; +atomic64_inc (&ca->stats_dscp_error); } }break ;
@@ -57,9 +57,9 @@ static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca,ipv6_change_dsfield (ipv6_hdr (skb),INET_ECN_MASK , newdscp); - ca->stats_dscp_set++; +atomic64_inc (&ca->stats_dscp_set); }else { - ca->stats_dscp_error++; +atomic64_inc (&ca->stats_dscp_error); } }break ;
@@ -72,7 +72,7 @@ static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca,struct tcf_ctinfo_params *cp, struct sk_buff *skb) { - ca->stats_cpmark_set++; + atomic64_inc(&ca->stats_cpmark_set); skb->mark =READ_ONCE (ct->mark) & cp->cpmarkmask; }
@@ -323,15 +323,18 @@ static int tcf_ctinfo_dump(struct sk_buff *skb, struct tc_action *a, }if (nla_put_u64_64bit (skb,TCA_CTINFO_STATS_DSCP_SET , - ci->stats_dscp_set,TCA_CTINFO_PAD )) +atomic64_read (&ci->stats_dscp_set), +TCA_CTINFO_PAD )) goto nla_put_failure;if (nla_put_u64_64bit (skb,TCA_CTINFO_STATS_DSCP_ERROR , - ci->stats_dscp_error,TCA_CTINFO_PAD )) +atomic64_read (&ci->stats_dscp_error), +TCA_CTINFO_PAD )) goto nla_put_failure;if (nla_put_u64_64bit (skb,TCA_CTINFO_STATS_CPMARK_SET , - ci->stats_cpmark_set,TCA_CTINFO_PAD )) +atomic64_read (&ci->stats_cpmark_set), +TCA_CTINFO_PAD )) goto nla_put_failure;spin_unlock_bh (&ci->tcf_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/369 RDMA/mlx5: Fix UMR modifying of mkey page size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Srouji <[email protected]>
[ Upstream commit c4f96972c3c206ac8f6770b5ecd5320b561d0058 ]
When changing the page size on an mkey, the driver needs to set the appropriate bits in the mkey mask to indicate which fields are being modified.
The 6th bit of a page size in mlx5 driver is considered an extension, and this bit has a dedicated capability and mask bits.
Previously, the driver was not setting this mask in the mkey mask when performing page size changes, regardless of its hardware support, potentially leading to an incorrect page size updates.
This fixes the issue by setting the relevant bit in the mkey mask when performing page size changes on an mkey and the 6th bit of this field is supported by the hardware.
--- drivers/infiniband/hw/mlx5/umr.c | 6 ++++-- include/linux/mlx5/device.h | 1 + 2 files changed, 5 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/umr.c +4 -2
@@ -32,13 +32,15 @@ static __be64 get_umr_disable_mr_mask(void)return cpu_to_be64 (result); } -static __be64 get_umr_update_translation_mask (void ) +static __be64 get_umr_update_translation_mask (struct mlx5_ib_dev *dev) {u64 result; result =MLX5_MKEY_MASK_LEN |MLX5_MKEY_MASK_PAGE_SIZE |MLX5_MKEY_MASK_START_ADDR ; +if (MLX5_CAP_GEN_2 (dev->mdev, umr_log_entity_size_5)) + result |=MLX5_MKEY_MASK_PAGE_SIZE_5 ;return cpu_to_be64 (result); }
@@ -654,7 +656,7 @@ static void mlx5r_umr_final_update_xlt(struct mlx5_ib_dev *dev, flags &MLX5_IB_UPD_XLT_ENABLE || flags &MLX5_IB_UPD_XLT_ADDR ;if (update_translation) { - wqe->ctrl_seg.mkey_mask |=get_umr_update_translation_mask (); + wqe->ctrl_seg.mkey_mask |=get_umr_update_translation_mask (dev);if (!mr->ibmr.length)MLX5_SET (mkc, &wqe->mkey_seg, length64,1 ); }
include/linux/mlx5/device.h +1 -0
@@ -280,6 +280,7 @@ enum {MLX5_MKEY_MASK_SMALL_FENCE =1ull <<23 ,MLX5_MKEY_MASK_RELAXED_ORDERING_WRITE =1ull <<25 ,MLX5_MKEY_MASK_FREE =1ull <<29 , +MLX5_MKEY_MASK_PAGE_SIZE_5 =1ull <<42 , MLX5_MKEY_MASK_RELAXED_ORDERING_READ = 1ull << 47, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/369 xen: fix UAF in dmabuf_exp_from_pages()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 532c8b51b3a8676cbf533a291f8156774f30ea87 ]
[dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks]
As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF.
dma_buf_fd() is a combination of reserving a descriptor and fd_install(). gntdev dmabuf_exp_from_pages() calls it and then proceeds to access the objects destroyed on close - starting with gntdev_dmabuf itself.
Fix that by doing reserving descriptor before anything else and do fd_install() only when everything had been set up.
Message-ID: <20250712050916.GY1880847@ZenIV>
--- drivers/xen/gntdev-dmabuf.c | 28 ++++++++++------------------ 1 file changed, 10 insertions(+), 18 deletions(-)
drivers/xen/gntdev-dmabuf.c +10 -18
@@ -357,8 +357,11 @@ struct gntdev_dmabuf_export_args {static int dmabuf_exp_from_pages (struct gntdev_dmabuf_export_args *args) {DEFINE_DMA_BUF_EXPORT_INFO (exp_info); -struct gntdev_dmabuf *gntdev_dmabuf; -int ret; + struct gntdev_dmabuf *gntdev_dmabuf __free(kfree) = NULL; +CLASS (get_unused_fd, ret)(O_CLOEXEC ); + +if (ret <0 ) +return ret; gntdev_dmabuf =kzalloc (sizeof (*gntdev_dmabuf),GFP_KERNEL );if (!gntdev_dmabuf)
@@ -383,32 +386,21 @@ static int dmabuf_exp_from_pages(struct gntdev_dmabuf_export_args *args) exp_info.priv = gntdev_dmabuf; gntdev_dmabuf->dmabuf =dma_buf_export (&exp_info); -if (IS_ERR (gntdev_dmabuf->dmabuf)) { - ret =PTR_ERR (gntdev_dmabuf->dmabuf); - gntdev_dmabuf->dmabuf =NULL ; - goto fail; - } - - ret =dma_buf_fd (gntdev_dmabuf->dmabuf,O_CLOEXEC ); -if (ret <0 ) - goto fail; +if (IS_ERR (gntdev_dmabuf->dmabuf)) +return PTR_ERR (gntdev_dmabuf->dmabuf); gntdev_dmabuf->fd = ret; args->fd = ret;pr_debug ("Exporting DMA buffer with fd %d\n" , ret); +get_file (gntdev_dmabuf->priv->filp);mutex_lock (&args->dmabuf_priv->lock);list_add (&gntdev_dmabuf->next, &args->dmabuf_priv->exp_list);mutex_unlock (&args->dmabuf_priv->lock); -get_file (gntdev_dmabuf->priv->filp); -return 0 ; -fail: -if (gntdev_dmabuf->dmabuf) -dma_buf_put (gntdev_dmabuf->dmabuf); -kfree (gntdev_dmabuf); -return ret; +fd_install (take_fd (ret),no_free_ptr (gntdev_dmabuf)->dmabuf->file); +return 0 ; } static struct gntdev_grant_map *
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/369 xen/gntdev: remove struct gntdev_copy_batch from stack
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit 70045cf6593cbf0740956ea9b7b4269142c6ee38 ]
When compiling the kernel with LLVM, the following warning was issued:
drivers/xen/gntdev.c:991: warning: stack frame size (1160) exceeds limit (1024) in function 'gntdev_ioctl'
The main reason is struct gntdev_copy_batch which is located on the stack and has a size of nearly 1kb.
For performance reasons it shouldn't by just dynamically allocated instead, so allocate a new instance when needed and instead of freeing it put it into a list of free structs anchored in struct gntdev_priv.
Message-ID: <[email protected]>
--- drivers/xen/gntdev-common.h | 4 +++ drivers/xen/gntdev.c | 71 ++++++++++++++++++++++++++----------- 2 files changed, 54 insertions(+), 21 deletions(-)
drivers/xen/gntdev-common.h +4 -0
@@ -26,6 +26,10 @@ struct gntdev_priv {/* lock protects maps and freeable_maps. */ struct mutex lock; +/* Free instances of struct gntdev_copy_batch. */ +struct gntdev_copy_batch *batch; +struct mutex batch_lock; +#ifdef CONFIG_XEN_GRANT_DMA_ALLOC /* Device for which DMA memory is allocated. */ struct device *dma_dev;
drivers/xen/gntdev.c +50 -21
127 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/369 tcp: call tcp_measure_rcv_mss() for ooo packets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 38d7e444336567bae1c7b21fc18b7ceaaa5643a0 ]
tcp_measure_rcv_mss() is used to update icsk->icsk_ack.rcv_mss (tcpi_rcv_mss in tcp_info) and tp->scaling_ratio.
Calling it from tcp_data_queue_ofo() makes sure these fields are updated, and permits a better tuning of sk->sk_rcvbuf, in the case a new flow receives many ooo packets.
--- net/ipv4/tcp_input.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/tcp_input.c +1 -0
@@ -5040,6 +5040,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)return ; } +tcp_measure_rcv_mss (sk, skb);/* Disable header prediction. */ tp->pred_flags =0 ;inet_csk_schedule_ack (sk);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/369 wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaistra <[email protected]>
[ Upstream commit d76a1abcf57734d2bcd4a7ec051617edd4513d7f ]
Commit 1e5b3b3fe9e0 ("rtl8xxxu: Adjust RX skb size to include space for phystats") increased the skb size when aggregation is enabled but decreased it for the aggregation disabled case.
As a result, if a frame near the maximum size is received, rtl8xxxu_rx_complete() is called with status -EOVERFLOW and then the driver starts to malfunction and no further communication is possible.
Restore the skb size in the aggregation disabled case.
--- drivers/net/wireless/realtek/rtl8xxxu/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl8xxxu/core.c +1 -1
@@ -6617,7 +6617,7 @@ static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_priv *priv, skb_size = fops->rx_agg_buf_size; skb_size += (rx_desc_sz +sizeof (struct rtl8723au_phy_stats )); }else { - skb_size =IEEE80211_MAX_FRAME_LEN ; + skb_size =IEEE80211_MAX_FRAME_LEN + rx_desc_sz; } skb =__netdev_alloc_skb (NULL , skb_size,GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/369 wifi: rtw88: Fix macid assigned to TDLS station
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
[ Upstream commit 526b000991b557c40ea53e64ba24bb9e0fff0071 ]
When working in station mode, TDLS peers are assigned macid 0, even though 0 was already assigned to the AP. This causes the connection with the AP to stop working after the TDLS connection is torn down.
Assign the next available macid to TDLS peers, same as client stations in AP mode.
--- drivers/net/wireless/realtek/rtw88/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw88/main.c +2 -2
@@ -329,7 +329,7 @@ int rtw_sta_add(struct rtw_dev *rtwdev, struct ieee80211_sta *sta,struct rtw_vif *rtwvif = (struct rtw_vif *)vif->drv_priv;int i; -if (vif->type ==NL80211_IFTYPE_STATION ) { +if (vif->type ==NL80211_IFTYPE_STATION && !sta->tdls) { si->mac_id = rtwvif->mac_id; }else { si->mac_id =rtw_acquire_macid (rtwdev);
@@ -366,7 +366,7 @@ void rtw_sta_remove(struct rtw_dev *rtwdev, struct ieee80211_sta *sta,cancel_work_sync (&si->rc_work); -if (vif->type !=NL80211_IFTYPE_STATION ) +if (vif->type !=NL80211_IFTYPE_STATION || sta->tdls)rtw_release_macid (rtwdev, si->mac_id);if (fw_exist)rtw_fw_media_status_report (rtwdev, si->mac_id, false);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/369 mwl8k: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit 50459501b9a212dbe7a673727589ee105a8a9954 ]
The DMA map functions can fail and should be tested for errors. If the mapping fails, unmap and return an error.
--- drivers/net/wireless/marvell/mwl8k.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/marvell/mwl8k.c +4 -0
@@ -1227,6 +1227,10 @@ static int rxq_refill(struct ieee80211_hw *hw, int index, int limit) addr =dma_map_single (&priv->pdev->dev, skb->data,MWL8K_RX_MAXSZ ,DMA_FROM_DEVICE ); +if (dma_mapping_error (&priv->pdev->dev, addr)) { +kfree_skb (skb); +break ; + } rxq->rxd_count++; rx = rxq->tail++;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/369 wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 65c12b104cb942d588a1a093acc4537fb3d3b129 ]
ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to ieee80211_iterate_stations_atomic(). Note in this case the iterator is required to be atomic, however ath11k_mac_disable_peer_fixed_rate() does not follow it as it might sleep. Consequently below warning is seen:
BUG: sleeping function called from invalid context at wmi.c:304 Call Trace: <TASK> dump_stack_lvl __might_resched.cold ath11k_wmi_cmd_send ath11k_wmi_set_peer_param ath11k_mac_disable_peer_fixed_rate ieee80211_iterate_stations_atomic ath11k_mac_op_set_bitrate_mask.cold
Change to ieee80211_iterate_stations_mtx() to fix this issue.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
--- drivers/net/wireless/ath/ath11k/mac.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +6 -6
@@ -8681,9 +8681,9 @@ ath11k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw, arvif->vdev_id, ret);return ret; } -ieee80211_iterate_stations_atomic (ar->hw, - ath11k_mac_disable_peer_fixed_rate, - arvif); +ieee80211_iterate_stations_mtx (ar->hw, + ath11k_mac_disable_peer_fixed_rate, + arvif); }else if (ath11k_mac_bitrate_mask_get_single_nss (ar, arvif, band, mask, &single_nss)) { rate =WMI_FIXED_RATE_NONE ;
@@ -8750,9 +8750,9 @@ ath11k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw, }mutex_lock (&ar->conf_mutex); -ieee80211_iterate_stations_atomic (ar->hw, - ath11k_mac_disable_peer_fixed_rate, - arvif); +ieee80211_iterate_stations_mtx (ar->hw, + ath11k_mac_disable_peer_fixed_rate, + arvif); arvif->bitrate_mask = *mask; ieee80211_iterate_stations_atomic(ar->hw,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/369 drm/amdgpu/gfx9: fix kiq locking in KCQ reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 730ea5074dac1b105717316be5d9c18b09829385 ]
The ring test needs to be inside the lock.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +1 -1
@@ -7318,8 +7318,8 @@ static int gfx_v9_0_reset_kcq(struct amdgpu_ring *ring, } kiq->pmf->kiq_map_queues (kiq_ring, ring);amdgpu_ring_commit (kiq_ring); -spin_unlock_irqrestore (&kiq->ring_lock, flags); r =amdgpu_ring_test_ring (kiq_ring); +spin_unlock_irqrestore (&kiq->ring_lock, flags);if (r) {DRM_ERROR ("fail to remap queue\n" );return r;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/369 drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 08f116c59310728ea8b7e9dc3086569006c861cf ]
The ring test needs to be inside the lock.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +1 -2
@@ -3640,9 +3640,8 @@ static int gfx_v9_4_3_reset_kcq(struct amdgpu_ring *ring, } kiq->pmf->kiq_map_queues (kiq_ring, ring);amdgpu_ring_commit (kiq_ring); -spin_unlock_irqrestore (&kiq->ring_lock, flags); - r =amdgpu_ring_test_ring (kiq_ring); +spin_unlock_irqrestore (&kiq->ring_lock, flags);if (r) {dev_err (adev->dev,"fail to remap queue\n" );return r;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/369 drm/amdgpu/gfx10: fix kiq locking in KCQ reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit a4b2ba8f631d3e44b30b9b46ee290fbfe608b7d0 ]
The ring test needs to be inside the lock.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +2 -4
@@ -9510,9 +9510,8 @@ static int gfx_v10_0_reset_kcq(struct amdgpu_ring *ring, kiq->pmf->kiq_unmap_queues (kiq_ring, ring,RESET_QUEUES ,0 ,0 );amdgpu_ring_commit (kiq_ring); -spin_unlock_irqrestore (&kiq->ring_lock, flags); - r =amdgpu_ring_test_ring (kiq_ring); +spin_unlock_irqrestore (&kiq->ring_lock, flags);if (r)return r;
@@ -9559,9 +9558,8 @@ static int gfx_v10_0_reset_kcq(struct amdgpu_ring *ring, } kiq->pmf->kiq_map_queues (kiq_ring, ring);amdgpu_ring_commit (kiq_ring); -spin_unlock_irqrestore (&kiq->ring_lock, flags); - r =amdgpu_ring_test_ring (kiq_ring); +spin_unlock_irqrestore (&kiq->ring_lock, flags);if (r)return r;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/369 iommu/amd: Fix geometry.aperture_end for V2 tables
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit 8637afa79cfa6123f602408cfafe8c9a73620ff1 ]
The AMD IOMMU documentation seems pretty clear that the V2 table follows the normal CPU expectation of sign extension. This is shown in
Figure 25: AMD64 Long Mode 4-Kbyte Page Address Translation
Where bits Sign-Extend [63:57] == [56]. This is typical for x86 which would have three regions in the page table: lower, non-canonical, upper.
The manual describes that the V1 table does not sign extend in section 2.2.4 Sharing AMD64 Processor and IOMMU Page Tables GPA-to-SPA
Further, Vasant has checked this and indicates the HW has an addtional behavior that the manual does not yet describe. The AMDv2 table does not have the sign extended behavior when attached to PASID 0, which may explain why this has gone unnoticed.
The iommu domain geometry does not directly support sign extended page tables. The driver should report only one of the lower/upper spaces. Solve this by removing the top VA bit from the geometry to use only the lower space.
This will also make the iommu_domain work consistently on all PASID 0 and PASID != 1.
Adjust dma_max_address() to remove the top VA bit. It now returns:
5 Level:
Before 0x1ffffffffffffff
After 0x0ffffffffffffff
4 Level:
Before 0xffffffffffff
After 0x7fffffffffff
--- drivers/iommu/amd/iommu.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/iommu/amd/iommu.c +15 -2
@@ -2352,8 +2352,21 @@ static inline u64 dma_max_address(void)if (amd_iommu_pgtable ==AMD_IOMMU_V1 )return ~0ULL ; -/* V2 with 4/5 level page table */ -return ((1ULL <<PM_LEVEL_SHIFT (amd_iommu_gpt_level)) -1 ); +/* +* V2 with 4/5 level page table. Note that "2.2.6.5 AMD64 4-Kbyte Page +* Translation" shows that the V2 table sign extends the top of the +* address space creating a reserved region in the middle of the +* translation, just like the CPU does. Further Vasant says the docs are +* incomplete and this only applies to non-zero PASIDs. If the AMDv2 +* page table is assigned to the 0 PASID then there is no sign extension +* check. +* +* Since the IOMMU must have a fixed geometry, and the core code does +* not understand sign extended addressing, we have to chop off the high +* bit to get consistent behavior with attachments of the domain to any +* PASID. +*/ +return ((1ULL << (PM_LEVEL_SHIFT (amd_iommu_gpt_level) -1 )) -1 ); }static bool amd_iommu_hd_support (struct amd_iommu *iommu)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/369 rcu: Fix delayed execution of hurry callbacks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tze-nan Wu <[email protected]>
[ Upstream commit 463d46044f04013306a4893242f65788b8a16b2e ]
We observed a regression in our customer’s environment after enabling CONFIG_LAZY_RCU. In the Android Update Engine scenario, where ioctl() is used heavily, we found that callbacks queued via call_rcu_hurry (such as percpu_ref_switch_to_atomic_rcu) can sometimes be delayed by up to 5 seconds before execution. This occurs because the new grace period does not start immediately after the previous one completes.
The root cause is that the wake_nocb_gp_defer() function now checks "rdp->nocb_defer_wakeup" instead of "rdp_gp->nocb_defer_wakeup". On CPUs that are not rcuog, "rdp->nocb_defer_wakeup" may always be RCU_NOCB_WAKE_NOT. This can cause "rdp_gp->nocb_defer_wakeup" to be downgraded and the "rdp_gp->nocb_timer" to be postponed by up to 10 seconds, delaying the execution of hurry RCU callbacks.
The trace log of one scenario we encountered is as follow:
// previous GP ends at this point
rcu_preempt [000] d..1. 137.240210: rcu_grace_period: rcu_preempt 8369 end rcu_preempt [000] ..... 137.240212: rcu_grace_period: rcu_preempt 8372 reqwait // call_rcu_hurry enqueues "percpu_ref_switch_to_atomic_rcu", the callback waited on by UpdateEngine update_engine [002] d..1. 137.301593: __call_rcu_common: wyy: unlikely p_ref = 00000000********. lazy = 0 // FirstQ on cpu 2 rdp_gp->nocb_timer is set to fire after 1 jiffy (4ms) // and the rdp_gp->nocb_defer_wakeup is set to RCU_NOCB_WAKE update_engine [002] d..2. 137.301595: rcu_nocb_wake: rcu_preempt 2 FirstQ on cpu2 with rdp_gp (cpu0). // FirstBQ event on cpu2 during the 1 jiffy, make the timer postpond 10 seconds later. // also, the rdp_gp->nocb_defer_wakeup is overwrite to RCU_NOCB_WAKE_LAZY update_engine [002] d..1. 137.301601: rcu_nocb_wake: rcu_preempt 2 WakeEmptyIsDeferred ... ... ... // before the 10 seconds timeout, cpu0 received another call_rcu_hurry // reset the timer to jiffies+1 and set the waketype = RCU_NOCB_WAKE. kworker/u32:0 [000] d..2. 142.557564: rcu_nocb_wake: rcu_preempt 0 FirstQ kworker/u32:0 [000] d..1. 142.557576: rcu_nocb_wake: rcu_preempt 0 WakeEmptyIsDeferred kworker/u32:0 [000] d..1. 142.558296: rcu_nocb_wake: rcu_preempt 0 WakeNot kworker/u32:0 [000] d..1. 142.558562: rcu_nocb_wake: rcu_preempt 0 WakeNot // idle(do_nocb_deferred_wakeup) wake rcuog due to waketype == RCU_NOCB_WAKE <idle> [000] d..1. 142.558786: rcu_nocb_wake: rcu_preempt 0 DoWake <idle> [000] dN.1. 142.558839: rcu_nocb_wake: rcu_preempt 0 DeferredWake rcuog/0 [000] ..... 142.558871: rcu_nocb_wake: rcu_preempt 0 EndSleep rcuog/0 [000] ..... 142.558877: rcu_nocb_wake: rcu_preempt 0 Check // finally rcuog request a new GP at this point (5 seconds after the FirstQ event) rcuog/0 [000] d..2. 142.558886: rcu_grace_period: rcu_preempt 8372 newreq rcu_preempt [001] d..1. 142.559458: rcu_grace_period: rcu_preempt 8373 start ... rcu_preempt [000] d..1. 142.564258: rcu_grace_period: rcu_preempt 8373 end rcuop/2 [000] D..1. 142.566337: rcu_batch_start: rcu_preempt CBs=219 bl=10
// the hurry CB is invoked at this point
rcuop/2 [000] b.... 142.566352: blk_queue_usage_counter_release: wyy: wakeup. p_ref = 00000000********.
This patch changes the condition to check "rdp_gp->nocb_defer_wakeup" in the lazy path. This prevents an already scheduled "rdp_gp->nocb_timer" from being postponed and avoids overwriting "rdp_gp->nocb_defer_wakeup" when it is not RCU_NOCB_WAKE_NOT.
--- kernel/rcu/tree_nocb.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/rcu/tree_nocb.h +1 -1
@@ -276,7 +276,7 @@ static void wake_nocb_gp_defer(struct rcu_data *rdp, int waketype,* callback storms, no need to wake up too early. */ if (waketype ==RCU_NOCB_WAKE_LAZY && - rdp->nocb_defer_wakeup ==RCU_NOCB_WAKE_NOT ) { + rdp_gp->nocb_defer_wakeup ==RCU_NOCB_WAKE_NOT ) {mod_timer (&rdp_gp->nocb_timer, jiffies +rcu_get_jiffies_lazy_flush ());WRITE_ONCE (rdp_gp->nocb_defer_wakeup, waketype); }else if (waketype ==RCU_NOCB_WAKE_BYPASS ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/369 wifi: mac80211: reject TDLS operations when station is not associated
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Hee Lee <[email protected]>
[ Upstream commit 16ecdab5446f15a61ec88eb0d23d25d009821db0 ]
syzbot triggered a WARN in ieee80211_tdls_oper() by sending NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT, before association completed and without prior TDLS setup.
This left internal state like sdata->u.mgd.tdls_peer uninitialized, leading to a WARN_ON() in code paths that assumed it was valid.
Reject the operation early if not in station mode or not associated.
--- net/mac80211/tdls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/tdls.c +1 -1
@@ -1421,7 +1421,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,if (!(wiphy->flags &WIPHY_FLAG_SUPPORTS_TDLS ))return -EOPNOTSUPP ; -if (sdata->vif.type !=NL80211_IFTYPE_STATION ) +if (sdata->vif.type !=NL80211_IFTYPE_STATION || !sdata->vif.cfg.assoc)return -EINVAL ;switch (oper) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/369 wifi: plfxlc: Fix error handling in usb driver probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
[ Upstream commit 3fe79a25c3cd54d25d30bc235c0c57f8a123d9d5 ]
If probe fails before ieee80211_register_hw() is successfully done, ieee80211_unregister_hw() will be called anyway. This may lead to various bugs as the implementation of ieee80211_unregister_hw() assumes that ieee80211_register_hw() has been called.
Divide error handling section into relevant subsections, so that ieee80211_unregister_hw() is called only when it is appropriate. Correct the order of the calls: ieee80211_unregister_hw() should go before plfxlc_mac_release(). Also move ieee80211_free_hw() to plfxlc_mac_release() as it supposed to be the opposite to plfxlc_mac_alloc_hw() that calls ieee80211_alloc_hw().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/wireless/purelifi/plfxlc/mac.c | 11 ++++---- drivers/net/wireless/purelifi/plfxlc/mac.h | 2 +- drivers/net/wireless/purelifi/plfxlc/usb.c | 29 +++++++++++----------- 3 files changed, 21 insertions(+), 21 deletions(-)
drivers/net/wireless/purelifi/plfxlc/mac.c +6 -5
@@ -99,11 +99,6 @@ int plfxlc_mac_init_hw(struct ieee80211_hw *hw)return r; } -void plfxlc_mac_release (struct plfxlc_mac *mac) -{ -plfxlc_chip_release (&mac->chip); -} -int plfxlc_op_start (struct ieee80211_hw *hw) {plfxlc_hw_mac (hw)->chip.usb.initialized =1 ;
@@ -755,3 +750,9 @@ struct ieee80211_hw *plfxlc_mac_alloc_hw(struct usb_interface *intf)SET_IEEE80211_DEV (hw, &intf->dev);return hw; } + +void plfxlc_mac_release_hw (struct ieee80211_hw *hw) +{ +plfxlc_chip_release (&plfxlc_hw_mac (hw)->chip); +ieee80211_free_hw (hw); +}
drivers/net/wireless/purelifi/plfxlc/mac.h +1 -1
@@ -168,7 +168,7 @@ static inline u8 *plfxlc_mac_get_perm_addr(struct plfxlc_mac *mac) }struct ieee80211_hw *plfxlc_mac_alloc_hw (struct usb_interface *intf); -void plfxlc_mac_release (struct plfxlc_mac *mac); +void plfxlc_mac_release_hw (struct ieee80211_hw *hw);int plfxlc_mac_preinit_hw (struct ieee80211_hw *hw,const u8 *hw_address);int plfxlc_mac_init_hw (struct ieee80211_hw *hw);
drivers/net/wireless/purelifi/plfxlc/usb.c +14 -15
@@ -604,7 +604,7 @@ static int probe(struct usb_interface *intf, r =plfxlc_upload_mac_and_serial (intf, hw_address, serial_number);if (r) {dev_err (&intf->dev,"MAC and Serial upload failed (%d)\n" , r); - goto error; + goto error_free_hw; } chip->unit_type =STA ;
@@ -613,13 +613,13 @@ static int probe(struct usb_interface *intf, r =plfxlc_mac_preinit_hw (hw, hw_address);if (r) {dev_err (&intf->dev,"Init mac failed (%d)\n" , r); - goto error; + goto error_free_hw; } r =ieee80211_register_hw (hw);if (r) {dev_err (&intf->dev,"Register device failed (%d)\n" , r); - goto error; + goto error_free_hw; } if ((le16_to_cpu(interface_to_usbdev(intf)->descriptor.idVendor) ==
@@ -632,7 +632,7 @@ static int probe(struct usb_interface *intf, }if (r !=0 ) {dev_err (&intf->dev,"FPGA download failed (%d)\n" , r); - goto error; + goto error_unreg_hw; } tx->mac_fifo_full =0 ;
@@ -642,21 +642,21 @@ static int probe(struct usb_interface *intf, r =plfxlc_usb_init_hw (usb);if (r <0 ) {dev_err (&intf->dev,"usb_init_hw failed (%d)\n" , r); - goto error; + goto error_unreg_hw; }msleep (PLF_MSLEEP_TIME ); r =plfxlc_chip_switch_radio (chip,PLFXLC_RADIO_ON );if (r <0 ) {dev_dbg (&intf->dev,"chip_switch_radio_on failed (%d)\n" , r); - goto error; + goto error_unreg_hw; }msleep (PLF_MSLEEP_TIME ); r =plfxlc_chip_set_rate (chip,8 );if (r <0 ) {dev_dbg (&intf->dev,"chip_set_rate failed (%d)\n" , r); - goto error; + goto error_unreg_hw; }msleep (PLF_MSLEEP_TIME );
@@ -664,7 +664,7 @@ static int probe(struct usb_interface *intf, hw_address, ETH_ALEN, USB_REQ_MAC_WR);if (r <0 ) {dev_dbg (&intf->dev,"MAC_WR failure (%d)\n" , r); - goto error; + goto error_unreg_hw; }plfxlc_chip_enable_rxtx (chip);
@@ -691,12 +691,12 @@ static int probe(struct usb_interface *intf,plfxlc_mac_init_hw (hw); usb->initialized = true;return 0 ; + +error_unreg_hw: +ieee80211_unregister_hw (hw); +error_free_hw: +plfxlc_mac_release_hw (hw); error: -if (hw) { -plfxlc_mac_release (plfxlc_hw_mac (hw)); -ieee80211_unregister_hw (hw); -ieee80211_free_hw (hw); - }dev_err (&intf->dev,"pureLifi:Device error" );return r; }
@@ -730,8 +730,7 @@ static void disconnect(struct usb_interface *intf)*/ usb_reset_device (interface_to_usbdev (intf)); -plfxlc_mac_release (mac); -ieee80211_free_hw (hw); +plfxlc_mac_release_hw (hw); }static void plfxlc_usb_resume (struct plfxlc_usb *usb)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/369 wifi: mac80211: Do not schedule stopped TXQs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Wetzel <[email protected]>
[ Upstream commit 11e3e22fa533f5d7cf04e32343b05a27eda3c7a5 ]
Ignore TXQs with the flag IEEE80211_TXQ_STOP when scheduling a queue.
The flag is only set after all fragments have been dequeued and won't allow dequeueing other frames as long as the flag is set.
For drivers using ieee80211_txq_schedule_start() this prevents an loop trying to push the queued frames while IEEE80211_TXQ_STOP is set:
After setting IEEE80211_TXQ_STOP the driver will call ieee80211_return_txq(). Which calls __ieee80211_schedule_txq(), detects that there sill are frames in the queue and immediately restarts the stopped TXQ. Which can't dequeue any frame and thus starts over the loop.
--- net/mac80211/tx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mac80211/tx.c +3 -1
@@ -4106,7 +4106,9 @@ void __ieee80211_schedule_txq(struct ieee80211_hw *hw,spin_lock_bh (&local->active_txq_lock[txq->ac]); - has_queue = force ||txq_has_queue (txq); + has_queue = force || + (!test_bit (IEEE80211_TXQ_STOP , &txqi->flags) && +txq_has_queue (txq));if (list_empty (&txqi->schedule_order) && (has_queue ||ieee80211_txq_keep_active (txqi))) {/* If airtime accounting is active, always enqueue STAs at the
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/369 wifi: mac80211: Dont call fq_flow_idx() for management frames
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Wetzel <[email protected]>
[ Upstream commit cb3bb3d88dfcd177a1050c0a009a3ee147b2e5b9 ]
skb_get_hash() can only be used when the skb is linked to a netdev device.
--- net/mac80211/tx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/tx.c +2 -1
@@ -1437,7 +1437,7 @@ static void ieee80211_txq_enqueue(struct ieee80211_local *local, {struct fq *fq = &local->fq;struct fq_tin *tin = &txqi->tin; -u32 flow_idx =fq_flow_idx (fq, skb); +u32 flow_idx;ieee80211_set_skb_enqueue_time (skb);
@@ -1453,6 +1453,7 @@ static void ieee80211_txq_enqueue(struct ieee80211_local *local,IEEE80211_TX_INTCFL_NEED_TXPROCESSING ;__skb_queue_tail (&txqi->frags, skb); }else { + flow_idx =fq_flow_idx (fq, skb);fq_tin_enqueue (fq, tin, flow_idx, skb, fq_skb_free_func); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/369 wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
[ Upstream commit 4037c468d1b3c508d69e6df0ef47fdee3d440e39 ]
With 802.11 encapsulation offloading, ieee80211_tx_h_select_key() is called on 802.3 frames. In that case do not try to use skb data as valid 802.11 headers.
--- net/mac80211/tx.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/mac80211/tx.c +6 -0
@@ -622,6 +622,12 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)else tx->key =NULL ; +if (info->flags &IEEE80211_TX_CTL_HW_80211_ENCAP ) { +if (tx->key && tx->key->flags &KEY_FLAG_UPLOADED_TO_HARDWARE ) + info->control.hw_key = &tx->key->conf; +return TX_CONTINUE ; + } +if (tx->key) {bool skip_hw = false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/369 Reapply "wifi: mac80211: Update skbs control block key in ieee80211_tx_dequeue()"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
[ Upstream commit 754fe848b3b297fc85ec24cd959bad22b6df8cb8 ]
This reverts commit 0937cb5f345c ("Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"").
This commit broke TX with 802.11 encapsulation HW offloading, now that this is fixed, reapply it.
--- net/mac80211/tx.c | 1 + 1 file changed, 1 insertion(+)
net/mac80211/tx.c +1 -0
@@ -3892,6 +3892,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,* The key can be removed while the packet was queued, so need to call * this here to get the current key. */ + info->control.hw_key =NULL ; r =ieee80211_tx_h_select_key (&tx);if (r !=TX_CONTINUE ) {ieee80211_free_txskb (&local->hw, skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/369 wifi: ath12k: fix endianness handling while accessing wmi service bit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamizh Chelvam Raja <[email protected]>
[ Upstream commit 8f1a078842d4af4877fb686f3907788024d0d1b7 ]
Currently there is no endian conversion in ath12k_wmi_tlv_services_parser() so the service bit parsing will be incorrect on a big endian platform and to fix this by using appropriate endian conversion.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00217-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/wmi.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/net/wireless/ath/ath12k/wmi.c +7 -5
@@ -6589,7 +6589,7 @@ static int ath12k_wmi_tlv_services_parser(struct ath12k_base *ab, void *data) {const struct wmi_service_available_event *ev; -u32 *wmi_ext2_service_bitmap; +__le32 *wmi_ext2_service_bitmap;int i, j;u16 expected_len;
@@ -6621,12 +6621,12 @@ static int ath12k_wmi_tlv_services_parser(struct ath12k_base *ab, ev->wmi_service_segment_bitmap[3]);break ;case WMI_TAG_ARRAY_UINT32 : - wmi_ext2_service_bitmap = (u32 *)ptr; + wmi_ext2_service_bitmap = (__le32 *)ptr;for (i =0 , j =WMI_MAX_EXT_SERVICE ; i <WMI_SERVICE_SEGMENT_BM_SIZE32 && j <WMI_MAX_EXT2_SERVICE ; i++) {do { -if (wmi_ext2_service_bitmap[i] & +if (__le32_to_cpu (wmi_ext2_service_bitmap[i]) &BIT (j %WMI_AVAIL_SERVICE_BITS_IN_SIZE32 ))set_bit (j, ab->wmi_ab.svc_map); }while (++j %WMI_AVAIL_SERVICE_BITS_IN_SIZE32 );
@@ -6634,8 +6634,10 @@ static int ath12k_wmi_tlv_services_parser(struct ath12k_base *ab,ath12k_dbg (ab,ATH12K_DBG_WMI ,"wmi_ext2_service_bitmap 0x%04x 0x%04x 0x%04x 0x%04x" , - wmi_ext2_service_bitmap[0 ], wmi_ext2_service_bitmap[1 ], - wmi_ext2_service_bitmap[2 ], wmi_ext2_service_bitmap[3 ]); +__le32_to_cpu (wmi_ext2_service_bitmap[0 ]), +__le32_to_cpu (wmi_ext2_service_bitmap[1 ]), +__le32_to_cpu (wmi_ext2_service_bitmap[2 ]), +__le32_to_cpu (wmi_ext2_service_bitmap[3 ]));break ; }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/369 wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Sivakumar <[email protected]>
[ Upstream commit 579bf8037b70b644a674c126a32bbb2212cf5c21 ]
After commit bd99a3013bdc ("brcmfmac: move configuration of probe request IEs"), the probe request MGMT IE addition operation brcmf_vif_set_mgmt_ie() got moved from the brcmf_p2p_scan_prep() to the brcmf_cfg80211_scan().
Because of this, as part of the scan request handler for the P2P Discovery, vif struct used for adding the Probe Request P2P IE in firmware got changed from the P2PAPI_BSSCFG_DEVICE vif to P2PAPI_BSSCFG_PRIMARY vif incorrectly. So the firmware stopped adding P2P IE to the outgoing P2P Discovery probe requests frames and the other P2P peers were unable to discover this device causing a regression on the P2P feature.
To fix this, while setting the P2P IE in firmware, properly use the vif of the P2P discovery wdev on which the driver received the P2P scan request. This is done by not changing the vif pointer, until brcmf_vif_set_mgmt_ie() is completed.
--- .../net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +4 -4
@@ -1541,10 +1541,6 @@ brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)return -EAGAIN ; } -/* If scan req comes for p2p0, send it over primary I/F */ -if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE ].vif) - vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY ].vif; -brcmf_dbg (SCAN ,"START ESCAN\n" ); cfg->scan_request = request;
@@ -1560,6 +1556,10 @@ brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)if (err) goto scan_out; +/* If scan req comes for p2p0, send it over primary I/F */ +if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE ].vif) + vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY ].vif; + err =brcmf_do_escan (vif->ifp, request);if (err) goto scan_out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/369 wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit a37192c432adaec9e8ef29e4ddb319ea2f443aa6 ]
While I caught the need for setting cnt early in nl80211_parse_rnr_elems() in the original annotation of struct cfg80211_rnr_elems with __counted_by, I missed a similar pattern in ieee80211_copy_rnr_beacon(). Fix this by moving the cnt assignment to before the loop.
--- net/mac80211/cfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/cfg.c +1 -1
@@ -1078,13 +1078,13 @@ ieee80211_copy_rnr_beacon(u8 *pos, struct cfg80211_rnr_elems *dst, {int i, offset =0 ; + dst->cnt = src->cnt;for (i =0 ; i < src->cnt; i++) {memcpy (pos + offset, src->elem[i].data, src->elem[i].len); dst->elem[i].len = src->elem[i].len; dst->elem[i].data = pos + offset; offset += dst->elem[i].len; } - dst->cnt = src->cnt;return offset; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/369 wifi: nl80211: Set num_sub_specs before looping through sub_specs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 2ed9a9fc9976262109d04f1a3c75c46de8ce4f22 ]
The processing of the struct cfg80211_sar_specs::sub_specs flexible array requires its counter, num_sub_specs, to be assigned before the loop in nl80211_set_sar_specs(). Leave the final assignment after the loop in place in case fewer ended up in the array.
--- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/nl80211.c +1 -0
@@ -16789,6 +16789,7 @@ static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)if (!sar_spec)return -ENOMEM ; + sar_spec->num_sub_specs = specs; sar_spec->type = type; specs =0 ;nla_for_each_nested (spec_list, tb[NL80211_SAR_ATTR_SPECS ], rem) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/369 ring-buffer: Remove ring_buffer_read_prepare_sync()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit 119a5d573622ae90ba730d18acfae9bb75d77b9a ]
When the ring buffer was first introduced, reading the non-consuming "trace" file required disabling the writing of the ring buffer. To make sure the writing was fully disabled before iterating the buffer with a non-consuming read, it would set the disable flag of the buffer and then call an RCU synchronization to make sure all the buffers were synchronized.
The function ring_buffer_read_start() originally would initialize the iterator and call an RCU synchronization, but this was for each individual per CPU buffer where this would get called many times on a machine with many CPUs before the trace file could be read. The commit 72c9ddfd4c5bf ("ring-buffer: Make non-consuming read less expensive with lots of cpus.") separated ring_buffer_read_start into ring_buffer_read_prepare(), ring_buffer_read_sync() and then ring_buffer_read_start() to allow each of the per CPU buffers to be prepared, call the read_buffer_read_sync() once, and then the ring_buffer_read_start() for each of the CPUs which made things much faster.
The commit 1039221cc278 ("ring-buffer: Do not disable recording when there is an iterator") removed the requirement of disabling the recording of the ring buffer in order to iterate it, but it did not remove the synchronization that was happening that was required to wait for all the buffers to have no more writers. It's now OK for the buffers to have writers and no synchronization is needed.
Remove the synchronization and put back the interface for the ring buffer iterator back before commit 72c9ddfd4c5bf was applied.
--- include/linux/ring_buffer.h | 4 +-- kernel/trace/ring_buffer.c | 63 ++++++------------------------------- kernel/trace/trace.c | 14 +++------ kernel/trace/trace_kdb.c | 8 ++--- 4 files changed, 18 insertions(+), 71 deletions(-)
include/linux/ring_buffer.h +1 -3
@@ -152,9 +152,7 @@ ring_buffer_consume(struct trace_buffer *buffer, int cpu, u64 *ts, unsigned long *lost_events);struct ring_buffer_iter * -ring_buffer_read_prepare (struct trace_buffer *buffer,int cpu,gfp_t flags); -void ring_buffer_read_prepare_sync (void ); -void ring_buffer_read_start (struct ring_buffer_iter *iter); +ring_buffer_read_start (struct trace_buffer *buffer,int cpu,gfp_t flags);void ring_buffer_read_finish (struct ring_buffer_iter *iter); struct ring_buffer_event *
kernel/trace/ring_buffer.c +10 -53
85 lines not on this page · raw message
kernel/trace/trace.c +4 -10
@@ -4648,21 +4648,15 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)if (iter->cpu_file ==RING_BUFFER_ALL_CPUS ) {for_each_tracing_cpu (cpu) { iter->buffer_iter[cpu] = -ring_buffer_read_prepare (iter->array_buffer->buffer, - cpu,GFP_KERNEL ); - } -ring_buffer_read_prepare_sync (); -for_each_tracing_cpu (cpu) { -ring_buffer_read_start (iter->buffer_iter[cpu]); +ring_buffer_read_start (iter->array_buffer->buffer, + cpu,GFP_KERNEL );tracing_iter_reset (iter, cpu); } }else { cpu = iter->cpu_file; iter->buffer_iter[cpu] = -ring_buffer_read_prepare (iter->array_buffer->buffer, - cpu,GFP_KERNEL ); -ring_buffer_read_prepare_sync (); -ring_buffer_read_start (iter->buffer_iter[cpu]); +ring_buffer_read_start (iter->array_buffer->buffer, + cpu,GFP_KERNEL );tracing_iter_reset (iter, cpu); }
kernel/trace/trace_kdb.c +3 -5
@@ -43,17 +43,15 @@ static void ftrace_dump_buf(int skip_entries, long cpu_file)if (cpu_file ==RING_BUFFER_ALL_CPUS ) {for_each_tracing_cpu (cpu) { iter.buffer_iter[cpu] = -ring_buffer_read_prepare (iter.array_buffer->buffer, - cpu,GFP_ATOMIC ); -ring_buffer_read_start (iter.buffer_iter[cpu]); +ring_buffer_read_start (iter.array_buffer->buffer, + cpu,GFP_ATOMIC );tracing_iter_reset (&iter, cpu); } }else { iter.cpu_file = cpu_file; iter.buffer_iter[cpu_file] = -ring_buffer_read_prepare (iter.array_buffer->buffer, +ring_buffer_read_start (iter.array_buffer->buffer, cpu_file,GFP_ATOMIC ); -ring_buffer_read_start (iter.buffer_iter[cpu_file]);tracing_iter_reset (&iter, cpu_file); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/369 kcsan: test: Initialize dummy variable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit 9872916ad1a1a5e7d089e05166c85dbd65e5b0e8 ]
Newer compiler versions rightfully point out:
kernel/kcsan/kcsan_test.c:591:41: error: variable 'dummy' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
591 | KCSAN_EXPECT_READ_BARRIER(atomic_read(&dummy), false);
| ^~~~~
1 error generated.
Although this particular test does not care about the value stored in the dummy atomic variable, let's silence the warning.
--- kernel/kcsan/kcsan_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kcsan/kcsan_test.c +1 -1
@@ -533,7 +533,7 @@ static void test_barrier_nothreads(struct kunit *test)struct kcsan_scoped_access *reorder_access =NULL ;#endif arch_spinlock_t arch_spinlock = __ARCH_SPIN_LOCK_UNLOCKED; -atomic_t dummy; +atomic_t dummy =ATOMIC_INIT (0 );KCSAN_TEST_REQUIRES (test, reorder_access !=NULL );KCSAN_TEST_REQUIRES (test,IS_ENABLED (CONFIG_SMP ));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/369 memcg_slabinfo: Fix use of PG_slab
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 7f770e94d7936e8e35d4b4d5fa4618301b03ea33 ]
Check PGTY_slab instead of PG_slab.
--- tools/cgroup/memcg_slabinfo.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/cgroup/memcg_slabinfo.py +2 -2
@@ -146,11 +146,11 @@ def detect_kernel_config(): def for_each_slab(prog): - PGSlab = ~prog.constant('PG_slab') + slabtype = prog.constant('PGTY_slab') for page in for_each_page(prog): try: - if page.page_type.value_() == PGSlab: + if (page.page_type.value_() >> 24) == slabtype: yield cast('struct slab *', page) except FaultError: pass
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/369 Bluetooth: hci_sync: fix double free in hci_discovery_filter_clear()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <[email protected]>
[ Upstream commit 2935e556850e9c94d7a00adf14d3cd7fe406ac03 ]
Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the following race:
'hci_cmd_sync_work()'
'update_passive_scan_sync()'
'hci_update_passive_scan_sync()'
'hci_discovery_filter_clear()'
kfree(uuids);
<-------------------------preempted-------------------------------->
'start_service_discovery()'
'hci_discovery_filter_clear()'
kfree(uuids); // DOUBLE FREE
<-------------------------preempted-------------------------------->
uuids = NULL;To fix it let's add locking around 'kfree()' call and NULL pointer assignment. Otherwise the following backtrace fires:
[ ] ------------[ cut here ]------------
[ ] kernel BUG at mm/slub.c:547!
[ ] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ ] CPU: 3 UID: 0 PID: 246 Comm: bluetoothd Tainted: G O 6.12.19-kernel #1 [ ] Tainted: [O]=OOT_MODULE
[ ] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ ] pc : __slab_free+0xf8/0x348
[ ] lr : __slab_free+0x48/0x348
...
[ ] Call trace:
[ ] __slab_free+0xf8/0x348 [ ] kfree+0x164/0x27c [ ] start_service_discovery+0x1d0/0x2c0 [ ] hci_sock_sendmsg+0x518/0x924 [ ] __sock_sendmsg+0x54/0x60 [ ] sock_write_iter+0x98/0xf8 [ ] do_iter_readv_writev+0xe4/0x1c8 [ ] vfs_writev+0x128/0x2b0 [ ] do_writev+0xfc/0x118 [ ] __arm64_sys_writev+0x20/0x2c [ ] invoke_syscall+0x68/0xf0 [ ] el0_svc_common.constprop.0+0x40/0xe0 [ ] do_el0_svc+0x1c/0x28 [ ] el0_svc+0x30/0xd0 [ ] el0t_64_sync_handler+0x100/0x12c [ ] el0t_64_sync+0x194/0x198
[ ] Code: 8b0002e6 eb17031f 54fffbe1 d503201f (d4210000) [ ] ---[ end trace 0000000000000000 ]---
--- include/net/bluetooth/hci_core.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/net/bluetooth/hci_core.h +6 -0
@@ -29,6 +29,7 @@#include <linux/idr.h> #include <linux/leds.h> #include <linux/rculist.h> +#include <linux/spinlock.h> #include <linux/srcu.h> #include <net/bluetooth/hci.h>
@@ -93,6 +94,7 @@ struct discovery_state {u16 uuid_count;u8 (*uuids)[16 ];unsigned long name_resolve_timeout; +spinlock_t lock; };#define SUSPEND_NOTIFIER_TIMEOUT msecs_to_jiffies(2000)/* 2 seconds */
@@ -873,6 +875,7 @@ static inline void iso_recv(struct hci_conn *hcon, struct sk_buff *skb,static inline void discovery_init (struct hci_dev *hdev) { +spin_lock_init (&hdev->discovery.lock); hdev->discovery.state =DISCOVERY_STOPPED ;INIT_LIST_HEAD (&hdev->discovery.all);INIT_LIST_HEAD (&hdev->discovery.unknown);
@@ -887,8 +890,11 @@ static inline void hci_discovery_filter_clear(struct hci_dev *hdev) hdev->discovery.report_invalid_rssi = true; hdev->discovery.rssi =HCI_RSSI_INVALID ; hdev->discovery.uuid_count =0 ; + +spin_lock (&hdev->discovery.lock);kfree (hdev->discovery.uuids); hdev->discovery.uuids =NULL ; +spin_unlock (&hdev->discovery.lock); }bool hci_discovery_active (struct hci_dev *hdev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/369 Bluetooth: hci_event: Mask data status from LE ext adv reports
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Down <[email protected]>
[ Upstream commit 0cadf8534f2a727bc3a01e8c583b085d25963ee0 ]
The Event_Type field in an LE Extended Advertising Report uses bits 5 and 6 for data status (e.g. truncation or fragmentation), not the PDU type itself.
The ext_evt_type_to_legacy() function fails to mask these status bits before evaluation. This causes valid advertisements with status bits set (e.g. a truncated non-connectable advertisement, which ends up showing as PDU type 0x40) to be misclassified as unknown and subsequently dropped. This is okay for most checks which use bitwise AND on the relevant event type bits, but it doesn't work for non-connectable types, which are checked with '== LE_EXT_ADV_NON_CONN_IND' (that is, zero).
In terms of behaviour, first the device sends a truncated report:
Quoted 1 line
HCI Event: LE Meta Event (
0x3e) plen 26
LE Extended Advertising Report (0x0d)
Entry 0
Event type: 0x0040
Data status: Incomplete, data truncated, no more to come
Address type: Random (0x01)
Address: 1D:12:46:FA:F8:6E (Non-Resolvable)
SID: 0x03
RSSI: -98 dBm (0x9e)
Data length: 0x00Then, a few seconds later, it sends the subsequent complete report:
Quoted 1 line
HCI Event: LE Meta Event (
0x3e) plen 122
LE Extended Advertising Report (0x0d)
Entry 0
Event type: 0x0000
Data status: Complete
Address type: Random (0x01)
Address: 1D:12:46:FA:F8:6E (Non-Resolvable)
SID: 0x03
RSSI: -97 dBm (0x9f)
Data length: 0x60
Service Data: Google (0xfef3)
Data[92]: ...These devices often send multiple truncated reports per second.
This patch introduces a PDU type mask to ensure only the relevant bits are evaluated, allowing for the correct translation of all valid extended advertising packets.
--- include/net/bluetooth/hci.h | 1 + net/bluetooth/hci_event.c | 8 ++++++-- 2 files changed, 7 insertions(+), 2 deletions(-)
include/net/bluetooth/hci.h +1 -0
@@ -2612,6 +2612,7 @@ struct hci_ev_le_conn_complete {#define LE_EXT_ADV_DIRECT_IND 0x0004#define LE_EXT_ADV_SCAN_RSP 0x0008#define LE_EXT_ADV_LEGACY_PDU 0x0010 +#define LE_EXT_ADV_DATA_STATUS_MASK 0x0060#define LE_EXT_ADV_EVT_TYPE_MASK 0x007f#define ADDR_LE_DEV_PUBLIC 0x00
net/bluetooth/hci_event.c +6 -2
@@ -6221,6 +6221,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,static u8 ext_evt_type_to_legacy (struct hci_dev *hdev,u16 evt_type) { +u16 pdu_type = evt_type & ~LE_EXT_ADV_DATA_STATUS_MASK ; + +if (!pdu_type) +return LE_ADV_NONCONN_IND ; +if (evt_type &LE_EXT_ADV_LEGACY_PDU ) {switch (evt_type) {case LE_LEGACY_ADV_IND :
@@ -6252,8 +6257,7 @@ static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)if (evt_type &LE_EXT_ADV_SCAN_IND )return LE_ADV_SCAN_IND ; -if (evt_type ==LE_EXT_ADV_NON_CONN_IND || - evt_type &LE_EXT_ADV_DIRECT_IND ) +if (evt_type &LE_EXT_ADV_DIRECT_IND )return LE_ADV_NONCONN_IND ; invalid:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/369 bpf: Disable migration in nf_hook_run_bpf().
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 17ce3e5949bc37557305ad46316f41c7875d6366 ]
syzbot reported that the netfilter bpf prog can be called without migration disabled in xmit path.
Then the assertion in __bpf_prog_run() fails, triggering the splat below. [0]
Let's use bpf_prog_run_pin_on_cpu() in nf_hook_run_bpf().
[0]:
BUG: assuming non migratable context at ./include/linux/filter.h:703
in_atomic(): 0, irqs_disabled(): 0, migration_disabled() 0 pid: 5829, name: sshd-session
3 locks held by sshd-session/5829:
#0: ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1667 [inline] #0: ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x20/0x50 net/ipv4/tcp.c:1395 #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x69/0x26c0 net/ipv4/ip_output.c:470 #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: nf_hook+0xb2/0x680 include/linux/netfilter.h:241
CPU: 0 UID: 0 PID: 5829 Comm: sshd-session Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 __cant_migrate kernel/sched/core.c:8860 [inline] __cant_migrate+0x1c7/0x250 kernel/sched/core.c:8834 __bpf_prog_run include/linux/filter.h:703 [inline] bpf_prog_run include/linux/filter.h:725 [inline] nf_hook_run_bpf+0x83/0x1e0 net/netfilter/nf_bpf_link.c:20 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:623 nf_hook+0x370/0x680 include/linux/netfilter.h:272 NF_HOOK_COND include/linux/netfilter.h:305 [inline] ip_output+0x1bc/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:459 [inline] ip_local_out net/ipv4/ip_output.c:129 [inline] __ip_queue_xmit+0x1d7d/0x26c0 net/ipv4/ip_output.c:527 __tcp_transmit_skb+0x2686/0x3e90 net/ipv4/tcp_output.c:1479 tcp_transmit_skb net/ipv4/tcp_output.c:1497 [inline] tcp_write_xmit+0x1274/0x84e0 net/ipv4/tcp_output.c:2838 __tcp_push_pending_frames+0xaf/0x390 net/ipv4/tcp_output.c:3021 tcp_push+0x225/0x700 net/ipv4/tcp.c:759 tcp_sendmsg_locked+0x1870/0x42b0 net/ipv4/tcp.c:1359 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1396 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] sock_write_iter+0x4aa/0x5b0 net/socket.c:1131 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x6c7/0x1150 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe7d365d407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP:
--- net/netfilter/nf_bpf_link.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_bpf_link.c +1 -1
@@ -17,7 +17,7 @@ static unsigned int nf_hook_run_bpf(void *bpf_prog, struct sk_buff *skb, .skb = skb, }; -return bpf_prog_run (prog, &ctx); +return bpf_prog_run_pin_on_cpu (prog, &ctx); }struct bpf_nf_link {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/369 tools/rv: Do not skip idle in trace
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriele Monaco <[email protected]>
[ Upstream commit f60227f3448911b682c45041c3fbd94f6d3b15a2 ]
Currently, the userspace RV tool skips trace events triggered by the RV tool itself, this can be changed by passing the parameter -s, which sets the variable config_my_pid to 0 (instead of the tool's PID). This has the side effect of skipping events generated by idle (PID 0).
Set config_my_pid to -1 (an invalid pid) to avoid skipping idle.
--- tools/verification/rv/src/in_kernel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/verification/rv/src/in_kernel.c +2 -2
@@ -353,7 +353,7 @@ ikm_event_handler(struct trace_seq *s, struct tep_record *record,if (config_has_id && (config_my_pid == id))return 0 ; -else if (config_my_pid && (config_my_pid == pid)) +else if (config_my_pid == pid)return 0 ;tep_print_event (trace_event->tep, s, record,"%16s-%-8d " ,TEP_PRINT_COMM ,TEP_PRINT_PID );
@@ -595,7 +595,7 @@ static int parse_arguments(char *monitor_name, int argc, char **argv) config_reactor = optarg;break ;case 's' : - config_my_pid =0 ; + config_my_pid =-1 ;break ;case 't' : config_trace =1 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/369 selftests: drv-net: Fix remote command checking in require_cmd()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit b4d52c698210ae1a3ceb487b189701bc70551a48 ]
The require_cmd() method was checking for command availability locally even when remote=True was specified, due to a missing host parameter.
Fix by passing host=self.remote when checking remote command availability, ensuring commands are verified on the correct host.
--- tools/testing/selftests/drivers/net/lib/py/env.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/drivers/net/lib/py/env.py +1 -1
@@ -224,7 +224,7 @@ class NetDrvEpEnv: if not self._require_cmd(comm, "local"): raise KsftSkipEx("Test requires command: " + comm) if remote: - if not self._require_cmd(comm, "remote"): + if not self._require_cmd(comm, "remote", host=self.remote): raise KsftSkipEx("Test requires (remote) command: " + comm) def wait_hw_stats_settle(self):
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/369 can: peak_usb: fix USB FD devices potential malfunction
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephane Grosjean <[email protected]>
[ Upstream commit 788199b73b6efe4ee2ade4d7457b50bb45493488 ]
The latest firmware versions of USB CAN FD interfaces export the EP numbers to be used to dialog with the device via the "type" field of a response to a vendor request structure, particularly when its value is greater than or equal to 2.
Correct the driver's test of this field.
--- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/net/can/usb/peak_usb/pcan_usb_fd.c +9 -8
@@ -49,7 +49,7 @@ struct __packed pcan_ufd_fw_info {__le32 ser_no;/* S/N */ __le32 flags;/* special functions */ -/* extended data when type == PCAN_USBFD_TYPE_EXT */ +/* extended data when type >= PCAN_USBFD_TYPE_EXT */ u8 cmd_out_ep;/* ep for cmd */ u8 cmd_in_ep;/* ep for replies */ u8 data_out_ep[2 ];/* ep for CANx TX */
@@ -982,10 +982,11 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev) dev->can.ctrlmode |=CAN_CTRLMODE_FD_NON_ISO ; } -/* if vendor rsp is of type 2, then it contains EP numbers to -* use for cmds pipes. If not, then default EP should be used. +/* if vendor rsp type is greater than or equal to 2, then it +* contains EP numbers to use for cmds pipes. If not, then +* default EP should be used. */ -if (fw_info->type !=cpu_to_le16 (PCAN_USBFD_TYPE_EXT )) { +if (le16_to_cpu (fw_info->type) <PCAN_USBFD_TYPE_EXT ) { fw_info->cmd_out_ep =PCAN_USBPRO_EP_CMDOUT ; fw_info->cmd_in_ep =PCAN_USBPRO_EP_CMDIN ; }
@@ -1018,11 +1019,11 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev) dev->can_channel_id =le32_to_cpu (pdev->usb_if->fw_info.dev_id[dev->ctrl_idx]); -/* if vendor rsp is of type 2, then it contains EP numbers to -* use for data pipes. If not, then statically defined EP are used -* (see peak_usb_create_dev()). +/* if vendor rsp type is greater than or equal to 2, then it contains EP +* numbers to use for data pipes. If not, then statically defined EP are +* used (see peak_usb_create_dev()). */ -if (fw_info->type ==cpu_to_le16 (PCAN_USBFD_TYPE_EXT )) { +if (le16_to_cpu (fw_info->type) >=PCAN_USBFD_TYPE_EXT ) { dev->ep_msg_in = fw_info->data_in_ep; dev->ep_msg_out = fw_info->data_out_ep[dev->ctrl_idx]; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/369 can: kvaser_pciefd: Store device channel index
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Assarsson <[email protected]>
[ Upstream commit d54b16b40ddadb7d0a77fff48af7b319a0cd6aae ]
Store device channel index in netdev.dev_port.
--- drivers/net/can/kvaser_pciefd.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/can/kvaser_pciefd.c +1 -0
@@ -981,6 +981,7 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie) can->completed_tx_bytes =0 ; can->bec.txerr =0 ; can->bec.rxerr =0 ; + can->can.dev->dev_port = i;init_completion (&can->start_comp);init_completion (&can->flush_comp);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/369 can: kvaser_usb: Assign netdev.dev_port based on device channel index
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Assarsson <[email protected]>
[ Upstream commit c151b06a087a61c7a1790b75ee2f1d6edb6a8a45 ]
Assign netdev.dev_port based on the device channel index, to indicate the port number of the network device.
While this driver already uses netdev.dev_id for that purpose, dev_port is more appropriate. However, retain dev_id to avoid potential regressions.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +1 -0
@@ -851,6 +851,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel) netdev->ethtool_ops = &kvaser_usb_ethtool_ops;SET_NETDEV_DEV (netdev, &dev->intf->dev); netdev->dev_id = channel; + netdev->dev_port = channel; dev->nets[channel] = priv;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/369 netfilter: xt_nfacct: dont assume acct name is null-terminated
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit bf58e667af7d96c8eb9411f926a0a0955f41ce21 ]
BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523
nfnl_acct_find_get() handles non-null input, but the error printk relied on its presence.
--- net/netfilter/xt_nfacct.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/xt_nfacct.c +2 -2
@@ -38,8 +38,8 @@ nfacct_mt_checkentry(const struct xt_mtchk_param *par) nfacct =nfnl_acct_find_get (par->net, info->name);if (nfacct ==NULL ) { -pr_info_ratelimited ("accounting object `%s' does not exists\n" , - info->name); +pr_info_ratelimited ("accounting object `%.*s' does not exist\n" , +NFACCT_NAME_MAX , info->name);return -ENOENT ; } info->nfacct = nfacct;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/369 net/mlx5e: Clear Read-Only port buffer size in PBMC before update
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit fd4b97246a23c1149479b88490946bcfbd28de63 ]
When updating the PBMC register, we read its current value, modify desired fields, then write it back.
The port_buffer_size field within PBMC is Read-Only (RO). If this RO field contains a non-zero value when read, attempting to write it back will cause the entire PBMC register update to fail.
This commit ensures port_buffer_size is explicitly cleared to zero after reading the PBMC register but before writing back the modified value.
This allows updates to other fields in the PBMC register to succeed.
--- drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +3 -0
@@ -331,6 +331,9 @@ static int port_set_buffer(struct mlx5e_priv *priv,if (err) goto out; +/* RO bits should be set to 0 on write */ +MLX5_SET (pbmc_reg, in, port_buffer_size,0 ); + err =mlx5e_port_set_pbmc (mdev, in); out:kfree (in);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/369 net/mlx5e: Remove skb secpath if xfrm state is not found
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 6d19c44b5c6dd72f9a357d0399604ec16a77de3c ]
Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed by the time of this lookup.
Currently, if the state is not found, only a counter is incremented. The secpath (sp) extension on the skb is not removed, resulting in sp->len becoming 0.
Subsequently, functions like __xfrm_policy_check() attempt to access fields such as xfrm_input_state(skb)->xso.type (which dereferences sp->xvec[sp->len - 1]) without first validating sp->len. This leads to a crash when dereferencing an invalid state pointer.
This patch prevents the crash by explicitly removing the secpath extension from the skb if the xfrm state is not found after hardware decryption. This ensures downstream functions do not operate on a zero-length secpath.
BUG: unable to handle page fault for address: ffffffff000002c8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 282e067 P4D 282e067 PUD 0 Oops: Oops: 0000 [#1] SMP CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:__xfrm_policy_check+0x61a/0xa30 Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa RSP: 0018:ffff88885fb04918 EFLAGS: 00010297 RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353 R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8 R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00 FS: 0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? try_to_wake_up+0x108/0x4c0 ? udp4_lib_lookup2+0xbe/0x150 ? udp_lib_lport_inuse+0x100/0x100 ? __udp4_lib_lookup+0x2b0/0x410 __xfrm_policy_check2.constprop.0+0x11e/0x130 udp_queue_rcv_one_skb+0x1d/0x530 udp_unicast_rcv_skb+0x76/0x90 __udp4_lib_rcv+0xa64/0xe90 ip_protocol_deliver_rcu+0x20/0x130 ip_local_deliver_finish+0x75/0xa0 ip_local_deliver+0xc1/0xd0 ? ip_protocol_deliver_rcu+0x130/0x130 ip_sublist_rcv+0x1f9/0x240 ? ip_rcv_finish_core+0x430/0x430 ip_list_rcv+0xfc/0x130 __netif_receive_skb_list_core+0x181/0x1e0 netif_receive_skb_list_internal+0x200/0x360 ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core] gro_receive_skb+0xfd/0x210 mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core] mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core] ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core] mlx5e_napi_poll+0x114/0xab0 [mlx5_core] __napi_poll+0x25/0x170 net_rx_action+0x32d/0x3a0 ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core] ? notifier_call_chain+0x33/0xa0 handle_softirqs+0xda/0x250 irq_exit_rcu+0x6d/0xc0 common_interrupt+0x81/0xa0 </IRQ>
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c +4 -0
@@ -327,6 +327,10 @@ void mlx5e_ipsec_offload_handle_rx_skb(struct net_device *netdev,if (unlikely (!sa_entry)) {rcu_read_unlock ();atomic64_inc (&ipsec->sw_stats.ipsec_rx_drop_sadb_miss); +/* Clear secpath to prevent invalid dereference +* in downstream XFRM policy checks. +*/ +secpath_reset (skb);return ; }xfrm_state_hold (sa_entry->x);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/369 net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristram Ha <[email protected]>
[ Upstream commit 165a7f5db919ab68a45ae755cceb751e067273ef ]
When KSZ8863 support was first added to KSZ driver the RX drop MIB counter was somehow defined as 0x105. The TX drop MIB counter starts at 0x100 for port 1, 0x101 for port 2, and 0x102 for port 3, so the RX drop MIB counter should start at 0x103 for port 1, 0x104 for port 2, and 0x105 for port 3.
There are 5 ports for KSZ8895, so its RX drop MIB counter starts at 0x105.
--- drivers/net/dsa/microchip/ksz8.c | 3 +++ drivers/net/dsa/microchip/ksz8_reg.h | 4 +++- 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/net/dsa/microchip/ksz8.c +3 -0
@@ -371,6 +371,9 @@ static void ksz8863_r_mib_pkt(struct ksz_device *dev, int port, u16 addr, addr -= dev->info->reg_mib_cnt; ctrl_addr = addr ?KSZ8863_MIB_PACKET_DROPPED_TX_0 :KSZ8863_MIB_PACKET_DROPPED_RX_0 ; +if (ksz_is_8895_family (dev) && + ctrl_addr ==KSZ8863_MIB_PACKET_DROPPED_RX_0 ) + ctrl_addr =KSZ8895_MIB_PACKET_DROPPED_RX_0 ; ctrl_addr += port; ctrl_addr |=IND_ACC_TABLE (TABLE_MIB |TABLE_READ );
drivers/net/dsa/microchip/ksz8_reg.h +3 -1
@@ -784,7 +784,9 @@#define KSZ8795_MIB_TOTAL_TX_1 0x105#define KSZ8863_MIB_PACKET_DROPPED_TX_0 0x100 -#define KSZ8863_MIB_PACKET_DROPPED_RX_0 0x105 +#define KSZ8863_MIB_PACKET_DROPPED_RX_0 0x103 + +#define KSZ8895_MIB_PACKET_DROPPED_RX_0 0x105#define MIB_PACKET_DROPPED 0x0000FFFF
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/369 stmmac: xsk: fix negative overflow of budget in zerocopy mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 2764ab51d5f0e8c7d3b7043af426b1883e3bde1d ]
A negative overflow can happen when the budget number of descs are consumed. as long as the budget is decreased to zero, it will again go into while (budget-- > 0) statement and get decreased by one, so the overflow issue can happen. It will lead to returning true whereas the expected value should be false.
In this case where all the budget is used up, it means zc function should return false to let the poll run again because normally we might have more data to process. Without this patch, zc function would return true instead.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +1 -1
@@ -2500,7 +2500,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget) budget =min (budget,stmmac_tx_avail (priv, queue)); -while (budget-- >0 ) { +for (; budget >0 ; budget--) {struct stmmac_metadata_request meta_req;struct xsk_tx_metadata *meta =NULL ;dma_addr_t dma_addr;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 144/369 selftests: rtnetlink.sh: remove esp4_offload after test
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiumei Mu <[email protected]>
[ Upstream commit 5b32321fdaf3fd1a92ec726af18765e225b0ee2b ]
The esp4_offload module, loaded during IPsec offload tests, should be reset to its default settings after testing.
Otherwise, leaving it enabled could unintentionally affect subsequence test cases by keeping offload active.
Without this fix:
$ lsmod | grep offload; ./rtnetlink.sh -t kci_test_ipsec_offload ; lsmod | grep offload; PASS: ipsec_offload esp4_offload 12288 0 esp4 32768 1 esp4_offload
With this fix:
$ lsmod | grep offload; ./rtnetlink.sh -t kci_test_ipsec_offload ; lsmod | grep offload; PASS: ipsec_offload
--- tools/testing/selftests/net/rtnetlink.sh | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/net/rtnetlink.sh +6 -0
@@ -738,6 +738,11 @@ kci_test_ipsec_offload() sysfsf=$sysfsd/ipsec sysfsnet=/sys/bus/netdevsim/devices/netdevsim0/net/ probed=false + esp4_offload_probed_default=false + + if lsmod | grep -q esp4_offload; then + esp4_offload_probed_default=true + fi if ! mount | grep -q debugfs; then mount -t debugfs none /sys/kernel/debug/ &> /dev/null
@@ -831,6 +836,7 @@ EOF fi # clean up any leftovers + ! "$esp4_offload_probed_default" && lsmod | grep -q esp4_offload && rmmod esp4_offload echo 0 > /sys/bus/netdevsim/del_device $probed && rmmod netdevsim
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 145/369 vrf: Drop existing dst reference in vrf_ip6_input_dst
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Fomichev <[email protected]>
[ Upstream commit f388f807eca1de9e6e70f9ffb1a573c3811c4215 ]
Commit ff3fbcdd4724 ("selftests: tc: Add generic erspan_opts matching support for tc-flower") started triggering the following kmemleak warning:
unreferenced object 0xffff888015fb0e00 (size 512):
comm "softirq", pid 0, jiffies 4294679065 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 40 d2 85 9e ff ff ff ff ........@.......
41 69 59 9d ff ff ff ff 00 00 00 00 00 00 00 00 AiY.............
backtrace (crc 30b71e8b):
__kmalloc_noprof+0x359/0x460
metadata_dst_alloc+0x28/0x490
erspan_rcv+0x4f1/0x1160 [ip_gre]
gre_rcv+0x217/0x240 [ip_gre]
gre_rcv+0x1b8/0x400 [gre]
ip_protocol_deliver_rcu+0x31d/0x3a0
ip_local_deliver_finish+0x37d/0x620
ip_local_deliver+0x174/0x460
ip_rcv+0x52b/0x6b0
__netif_receive_skb_one_core+0x149/0x1a0
process_backlog+0x3c8/0x1390
__napi_poll.constprop.0+0xa1/0x390
net_rx_action+0x59b/0xe00
handle_softirqs+0x22b/0x630
do_softirq+0xb1/0xf0
__local_bh_enable_ip+0x115/0x150vrf_ip6_input_dst unconditionally sets skb dst entry, add a call to skb_dst_drop to drop any existing entry.
--- drivers/net/vrf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/vrf.c +2 -0
@@ -1324,6 +1324,8 @@ static void vrf_ip6_input_dst(struct sk_buff *skb, struct net_device *vrf_dev,struct net *net =dev_net (vrf_dev);struct rt6_info *rt6; +skb_dst_drop (skb); + rt6 =vrf_ip6_route_lookup (net, vrf_dev, &fl6, ifindex, skb,RT6_LOOKUP_F_HAS_SADDR |RT6_LOOKUP_F_IFACE );if (unlikely (!rt6))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 146/369 ipv6: prevent infinite loop in rt6_nlmsg_size()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 54e6fe9dd3b0e7c481c2228782c9494d653546da ]
While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place:
list_for_each_entry_rcu(sibling, &f6i->fib6_siblings,
fib6_siblings) {
rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len);
}This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list.
Restart the loop if f6i->fib6_nsiblings is zero.
--- net/ipv6/ip6_fib.c | 4 ++-- net/ipv6/route.c | 34 ++++++++++++++++++---------------- 2 files changed, 20 insertions(+), 18 deletions(-)
net/ipv6/ip6_fib.c +2 -2
@@ -1251,7 +1251,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; - rt->fib6_nsiblings =0 ; +WRITE_ONCE (rt->fib6_nsiblings,0 );list_del_rcu (&rt->fib6_siblings);rt6_multipath_rebalance (next_sibling);return err;
@@ -1969,7 +1969,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,list_for_each_entry_safe (sibling, next_sibling, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; - rt->fib6_nsiblings =0 ; +WRITE_ONCE (rt->fib6_nsiblings,0 );list_del_rcu (&rt->fib6_siblings);rt6_multipath_rebalance (next_sibling); }
net/ipv6/route.c +18 -16
@@ -5587,32 +5587,34 @@ static int rt6_nh_nlmsg_size(struct fib6_nh *nh, void *arg)static size_t rt6_nlmsg_size (struct fib6_info *f6i) { +struct fib6_info *sibling; +struct fib6_nh *nh;int nexthop_len;if (f6i->nh) { nexthop_len =nla_total_size (4 );/* RTA_NH_ID */ nexthop_for_each_fib6_nh (f6i->nh, rt6_nh_nlmsg_size, &nexthop_len); - }else { -struct fib6_nh *nh = f6i->fib6_nh; -struct fib6_info *sibling; - - nexthop_len =0 ; -if (f6i->fib6_nsiblings) { -rt6_nh_nlmsg_size (nh, &nexthop_len); - -rcu_read_lock (); + goto common; + } -list_for_each_entry_rcu (sibling, &f6i->fib6_siblings, - fib6_siblings) { -rt6_nh_nlmsg_size (sibling->fib6_nh, &nexthop_len); - } +rcu_read_lock (); +retry: + nh = f6i->fib6_nh; + nexthop_len =0 ; +if (READ_ONCE (f6i->fib6_nsiblings)) { +rt6_nh_nlmsg_size (nh, &nexthop_len); -rcu_read_unlock (); +list_for_each_entry_rcu (sibling, &f6i->fib6_siblings, + fib6_siblings) { +rt6_nh_nlmsg_size (sibling->fib6_nh, &nexthop_len); +if (!READ_ONCE (f6i->fib6_nsiblings)) + goto retry; } - nexthop_len +=lwtunnel_get_encap_size (nh->fib_nh_lws); } - +rcu_read_unlock (); + nexthop_len +=lwtunnel_get_encap_size (nh->fib_nh_lws); +common:return NLMSG_ALIGN (sizeof (struct rtmsg )) +nla_total_size (16 )/* RTA_SRC */ +nla_total_size (16 )/* RTA_DST */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 147/369 ipv6: fix possible infinite loop in fib6_info_uses_dev()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit f8d8ce1b515a0a6af72b30502670a406cfb75073 ]
fib6_info_uses_dev() seems to rely on RCU without an explicit protection.
Like the prior fix in rt6_nlmsg_size(),
we need to make sure fib6_del_route() or fib6_add_rt2node() have not removed the anchor from the list, or we risk an infinite loop.
--- net/ipv6/route.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
net/ipv6/route.c +11 -6
@@ -5875,16 +5875,21 @@ static bool fib6_info_uses_dev(const struct fib6_info *f6i,if (f6i->fib6_nh->fib_nh_dev == dev)return true; -if (f6i->fib6_nsiblings) { -struct fib6_info *sibling, *next_sibling; +if (READ_ONCE (f6i->fib6_nsiblings)) { +const struct fib6_info *sibling; -list_for_each_entry_safe (sibling, next_sibling, - &f6i->fib6_siblings, fib6_siblings) { -if (sibling->fib6_nh->fib_nh_dev == dev) +rcu_read_lock (); +list_for_each_entry_rcu (sibling, &f6i->fib6_siblings, + fib6_siblings) { +if (sibling->fib6_nh->fib_nh_dev == dev) { +rcu_read_unlock ();return true; + } +if (!READ_ONCE (f6i->fib6_nsiblings)) +break ; } +rcu_read_unlock (); } -return false; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 148/369 ipv6: annotate data-races around rt->fib6_nsiblings
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 31d7d67ba1274f42494256d52e86da80ed09f3cb ]
rt->fib6_nsiblings can be read locklessly, add corresponding READ_ONCE() and WRITE_ONCE() annotations.
--- net/ipv6/ip6_fib.c | 20 +++++++++++++------- net/ipv6/route.c | 5 +++-- 2 files changed, 16 insertions(+), 9 deletions(-)
net/ipv6/ip6_fib.c +13 -7
@@ -440,15 +440,17 @@ struct fib6_dump_arg {static int fib6_rt_dump (struct fib6_info *rt,struct fib6_dump_arg *arg) {enum fib_event_type fib_event =FIB_EVENT_ENTRY_REPLACE ; +unsigned int nsiblings;int err;if (!rt || rt == arg->net->ipv6.fib6_null_entry)return 0 ; -if (rt->fib6_nsiblings) + nsiblings =READ_ONCE (rt->fib6_nsiblings); +if (nsiblings) err =call_fib6_multipath_entry_notifier (arg->nb, fib_event, rt, - rt->fib6_nsiblings, + nsiblings, arg->extack);else err = call_fib6_entry_notifier(arg->nb, fib_event, rt,
@@ -1126,7 +1128,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,if (rt6_duplicate_nexthop (iter, rt)) {if (rt->fib6_nsiblings) - rt->fib6_nsiblings =0 ; +WRITE_ONCE (rt->fib6_nsiblings,0 );if (!(iter->fib6_flags &RTF_EXPIRES ))return -EEXIST ;if (!(rt->fib6_flags &RTF_EXPIRES )) {
@@ -1155,7 +1157,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,*/ if (rt_can_ecmp &&rt6_qualify_for_ecmp (iter)) - rt->fib6_nsiblings++; +WRITE_ONCE (rt->fib6_nsiblings, + rt->fib6_nsiblings +1 ); }if (iter->fib6_metric > rt->fib6_metric)
@@ -1205,7 +1208,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, fib6_nsiblings =0 ;list_for_each_entry_safe (sibling, temp_sibling, &rt->fib6_siblings, fib6_siblings) { - sibling->fib6_nsiblings++; +WRITE_ONCE (sibling->fib6_nsiblings, + sibling->fib6_nsiblings +1 );BUG_ON (sibling->fib6_nsiblings != rt->fib6_nsiblings); fib6_nsiblings++; }
@@ -1250,7 +1254,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,list_for_each_entry_safe (sibling, next_sibling, &rt->fib6_siblings, fib6_siblings) - sibling->fib6_nsiblings--; +WRITE_ONCE (sibling->fib6_nsiblings, + sibling->fib6_nsiblings -1 );WRITE_ONCE (rt->fib6_nsiblings,0 );list_del_rcu (&rt->fib6_siblings);rt6_multipath_rebalance (next_sibling);
@@ -1968,7 +1973,8 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, notify_del = true;list_for_each_entry_safe (sibling, next_sibling, &rt->fib6_siblings, fib6_siblings) - sibling->fib6_nsiblings--; +WRITE_ONCE (sibling->fib6_nsiblings, + sibling->fib6_nsiblings -1 );WRITE_ONCE (rt->fib6_nsiblings,0 );list_del_rcu (&rt->fib6_siblings);rt6_multipath_rebalance (next_sibling);
net/ipv6/route.c +3 -2
@@ -5240,7 +5240,8 @@ static void ip6_route_mpath_notify(struct fib6_info *rt,*/ rcu_read_lock (); -if ((nlflags &NLM_F_APPEND ) && rt_last && rt_last->fib6_nsiblings) { +if ((nlflags &NLM_F_APPEND ) && rt_last && +READ_ONCE (rt_last->fib6_nsiblings)) { rt =list_first_or_null_rcu (&rt_last->fib6_siblings, struct fib6_info, fib6_siblings);
@@ -5773,7 +5774,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,if (dst->lwtstate &&lwtunnel_fill_encap (skb, dst->lwtstate,RTA_ENCAP ,RTA_ENCAP_TYPE ) <0 ) goto nla_put_failure; - }else if (rt->fib6_nsiblings) { + }else if (READ_ONCE (rt->fib6_nsiblings)) {struct fib6_info *sibling;struct nlattr *mp;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 149/369 bpf/preload: Dont select USERMODE_DRIVER
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 2b03164eee20eac7ce0fe3aa4fbda7efc1e5427a ]
The usermode driver framework is not used anymore by the BPF preload code.
--- kernel/bpf/preload/Kconfig | 1 - 1 file changed, 1 deletion(-)
kernel/bpf/preload/Kconfig +0 -1
@@ -10,7 +10,6 @@ menuconfig BPF_PRELOAD # The dependency on !COMPILE_TEST prevents it from being enabled # in allmodconfig or allyesconfig configurations depends on !COMPILE_TEST - select USERMODE_DRIVER help This builds kernel module with several embedded BPF programs that are pinned into BPF FS mount point as human readable files that are
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 150/369 bpf, arm64: Fix fp initialization for exception boundary
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit b114fcee766d5101eada1aca7bb5fd0a86c89b35 ]
In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF program, find_used_callee_regs() is not called because for a program acting as exception boundary, all callee saved registers are saved. find_used_callee_regs() sets ctx->fp_used = true; when it sees FP being used in any of the instructions.
For programs acting as exception boundary, ctx->fp_used remains false even if frame pointer is used by the program and therefore, FP is not set-up for such programs in the prologue. This can cause the kernel to crash due to a pagefault.
Fix it by setting ctx->fp_used = true for exception boundary programs as fp is always saved in such programs.
--- arch/arm64/net/bpf_jit_comp.c | 1 + 1 file changed, 1 insertion(+)
arch/arm64/net/bpf_jit_comp.c +1 -0
@@ -399,6 +399,7 @@ static void push_callee_regs(struct jit_ctx *ctx)emit (A64_PUSH (A64_R (23 ),A64_R (24 ),A64_SP ), ctx);emit (A64_PUSH (A64_R (25 ),A64_R (26 ),A64_SP ), ctx);emit (A64_PUSH (A64_R (27 ),A64_R (28 ),A64_SP ), ctx); + ctx->fp_used = true; }else {find_used_callee_regs (ctx);for (i =0 ; i +1 < ctx->nr_used_callee_reg; i +=2 ) {
Signature · 1 line
2.39.5