6.15.10-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.15.10-rc1 review
This is the start of the stable review cycle for the 6.15.10 release. There are 480 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 14 Aug 2025 17:42:20 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.15.10-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.15.10-rc1
Suren Baghdasaryan <[email protected]>
mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped
Tao Xue <[email protected]>
usb: gadget : fix use-after-free in composite_dev_cleanup()
Aditya Garg <[email protected]>
HID: apple: avoid setting up battery timer for devices without battery
Alan Stern <[email protected]>
HID: core: Harden s32ton() against conversion to 0 bits
Yuhao Jiang <[email protected]>
USB: gadget: f_hid: Fix memory leak in hidg_bind error path
Qasim Ijaz <[email protected]>
HID: apple: validate feature-report field count to prevent NULL pointer dereference
Julien Massot <[email protected]>
media: ti: j721e-csi2rx: fix list_del corruption
Robin Murphy <[email protected]>
perf/arm-ni: Set initial IRQ affinity
Akash Kumar <[email protected]>
usb: gadget: uvc: Initialize frame-based format color matching descriptor
Baolin Wang <[email protected]>
mm: shmem: fix the shmem large folio allocation for the i915 driver
Kemeng Shi <[email protected]>
mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()
Kemeng Shi <[email protected]>
mm: swap: fix potential buffer overflow in setup_clusters()
Kemeng Shi <[email protected]>
mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop
Andy Shevchenko <[email protected]>
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
Jiaxun Yang <[email protected]>
MIPS: mm: tlb-r4k: Uniquify TLB entries on init
Gerald Schaefer <[email protected]>
s390/mm: Remove possible false-positive warning in pte_free_defer()
Sean Christopherson <[email protected]>
KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
Dave Hansen <[email protected]>
x86/fpu: Delay instruction pointer fixup until after warning
Michael J. Ruhl <[email protected]>
platform/x86/intel/pmt: fix a crashlog NULL pointer access
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
Edip Hazuri <[email protected]>
ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
Thorsten Blum <[email protected]>
ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
Tom Lendacky <[email protected]>
x86/sev: Evict cache lines during SNP memory validation
Ammar Faizi <[email protected]>
net: usbnet: Fix the wrong netif_carrier_on() call
John Ernberg <[email protected]>
net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
Zenm Chen <[email protected]>
Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
Slark Xiao <[email protected]>
USB: serial: option: add Foxconn T99W709
Thorsten Blum <[email protected]>
smb: server: Fix extension string in ksmbd_extract_shortname()
Namjae Jeon <[email protected]>
ksmbd: limit repeated connections from clients with the same IP
Paulo Alcantara <[email protected]>
smb: client: default to nonativesocket under POSIX mounts
Paulo Alcantara <[email protected]>
smb: client: set symlink type as native for POSIX mounts
Wang Zhaolong <[email protected]>
smb: client: fix netns refcount leak after net_passive changes
Namjae Jeon <[email protected]>
ksmbd: fix corrupted mtime and ctime in smb2_open
Namjae Jeon <[email protected]>
ksmbd: fix Preauh_HashValue race condition
Namjae Jeon <[email protected]>
ksmbd: fix null pointer dereference error in generate_encryptionkey
Budimir Markovic <[email protected]>
vsock: Do not allow binding to VMADDR_PORT_ANY
Quang Le <[email protected]>
net/packet: fix a race in packet_set_ring() and packet_notifier()
Lorenzo Stoakes <[email protected]>
selftests/perf_events: Add a mmap() correctness test
Thomas Gleixner <[email protected]>
perf/core: Prevent VMA split of buffer mappings
Thomas Gleixner <[email protected]>
perf/core: Handle buffer mapping fail correctly in perf_mmap()
Thomas Gleixner <[email protected]>
perf/core: Exit early on perf_mmap() fail
Thomas Gleixner <[email protected]>
perf/core: Don't leak AUX buffer refcount on allocation failure
Thomas Gleixner <[email protected]>
perf/core: Preserve AUX buffer allocation failure result
Olga Kornievskaia <[email protected]>
sunrpc: fix handling of server side tls alerts
NeilBrown <[email protected]>
nfsd: avoid ref leak in nfsd_open_local_fh()
Jeff Layton <[email protected]>
nfsd: don't set the ctime on delegated atime updates
Zhang Rui <[email protected]>
tools/power turbostat: Fix bogus SysWatt for forked program
Stefan Metzmacher <[email protected]>
smb: client: return an error if rdma_connect does not return within 5 seconds
Eric Dumazet <[email protected]>
pptp: fix pptp_xmit() error path
Mohamed Khalfella <[email protected]>
nvmet: exit debugfs after discovery subsystem exits
Stefan Metzmacher <[email protected]>
smb: client: let recv_done() avoid touching data_transfer after cleanup/move
Stefan Metzmacher <[email protected]>
smb: client: let recv_done() cleanup before notifying the callers.
Stefan Metzmacher <[email protected]>
smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
Stefan Metzmacher <[email protected]>
smb: client: remove separate empty_packet_queue
Stefan Metzmacher <[email protected]>
smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
Stefan Metzmacher <[email protected]>
smb: server: let recv_done() avoid touching data_transfer after cleanup/move
Stefan Metzmacher <[email protected]>
smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
Stefan Metzmacher <[email protected]>
smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
Stefan Metzmacher <[email protected]>
smb: server: remove separate empty_recvmsg_queue
Mikhail Zaslonko <[email protected]>
s390/boot: Fix startup debugging log
Takashi Iwai <[email protected]>
ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
Arnd Bergmann <[email protected]>
ASoC: SOF: Intel: hda-sdw-bpt: fix SND_SOF_SOF_HDA_SDW_BPT dependencies
Arnd Bergmann <[email protected]>
irqchip: Build IMX_MU_MSI only on ARM
Meghana Malladi <[email protected]>
net: ti: icssg-prueth: Fix skb handling for XDP_PASS
Trond Myklebust <[email protected]>
NFS/localio: nfs_uuid_put() fix the wake up after unlinking the file
Trond Myklebust <[email protected]>
NFS/localio: nfs_uuid_put() fix races with nfs_open/close_local_fh()
Trond Myklebust <[email protected]>
NFS/localio: nfs_close_local_fh() fix check for file closed
Jakub Kicinski <[email protected]>
eth: fbnic: remove the debugging trick of super high page bias
Sumanth Korikkar <[email protected]>
s390/mm: Allocate page table with PAGE_SIZE granularity
Maher Azzouzi <[email protected]>
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
Michal Schmidt <[email protected]>
benet: fix BUG when creating VFs
Lorenzo Bianconi <[email protected]>
net: airoha: npu: Add missing MODULE_FIRMWARE macros
Jakub Kicinski <[email protected]>
eth: fbnic: unlink NAPIs from queues on error to open
Thomas Gleixner <[email protected]>
x86/irq: Plug vector setup race
Michal Wajdeczko <[email protected]>
drm/xe/pf: Disable PF restart worker on device removal
Olga Kornievskaia <[email protected]>
sunrpc: fix client side handling of tls alerts
Takamitsu Iwai <[email protected]>
net/sched: taprio: enforce minimum value for picos_per_byte
Wang Liang <[email protected]>
net: drop UFO packets in udp_rcv_segment()
Florian Fainelli <[email protected]>
net: mdio: mdio-bcm-unimac: Correct rate fallback logic
Eric Dumazet <[email protected]>
ipv6: reject malicious packets in ipv6_gso_segment()
Christoph Paasch <[email protected]>
net/mlx5: Correctly set gso_segs when LRO is used
Simon Trimmer <[email protected]>
spi: cs42l43: Property entry should be a null-terminated array
Baojun Xu <[email protected]>
ASoC: tas2781: Fix the wrong step for TLV on tas2781
Christoph Hellwig <[email protected]>
block: ensure discard_granularity is zero when discard is not supported
Guenter Roeck <[email protected]>
block: Fix default IO priority if there is no IO context
Jakub Kicinski <[email protected]>
netlink: specs: ethtool: fix module EEPROM input/output arguments
Alexander Gordeev <[email protected]>
s390/mm: Set high_memory at the end of the identity mapping
Harald Freudenberger <[email protected]>
s390/ap: Unmask SLCF bit in card and queue ap functions sysfs
Mohamed Khalfella <[email protected]>
nvmet: initialize discovery subsys after debugfs is initialized
Eric Dumazet <[email protected]>
pptp: ensure minimal skb length in pptp_xmit()
Luca Weiss <[email protected]>
net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
Horatiu Vultur <[email protected]>
phy: mscc: Fix parsing of unicast frames
Jakub Kicinski <[email protected]>
netpoll: prevent hanging NAPI when netcons gets enabled
Heming Zhao <[email protected]>
md/md-cluster: handle REMOVE message earlier
Benjamin Coddington <[email protected]>
NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
Olga Kornievskaia <[email protected]>
NFSv4.2: another fix for listxattr
Trond Myklebust <[email protected]>
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
Trond Myklebust <[email protected]>
NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
Tigran Mkrtchyan <[email protected]>
pNFS/flexfiles: don't attempt pnfs on fatal DS errors
Len Brown <[email protected]>
tools/power turbostat: regression fix: --show C1E%
Timothy Pearson <[email protected]>
PCI: pnv_php: Fix surprise plug detection and recovery
Timothy Pearson <[email protected]>
powerpc/eeh: Make EEH driver device hotplug safe
Timothy Pearson <[email protected]>
powerpc/eeh: Export eeh_unfreeze_pe()
Timothy Pearson <[email protected]>
PCI: pnv_php: Work around switches with broken presence detection
Timothy Pearson <[email protected]>
PCI: pnv_php: Clean up allocated IRQs on unplug
Herbert Xu <[email protected]>
padata: Remove comment for reorder_work
Peter Zijlstra <[email protected]>
sched/psi: Fix psi_seq initialization
Jason Gunthorpe <[email protected]>
vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD
Masahiro Yamada <[email protected]>
kconfig: qconf: fix ConfigList::updateListAllforAll()
Salomon Dushimirimana <[email protected]>
scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
Seunghui Lee <[email protected]>
scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
Li Lingfeng <[email protected]>
scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
Tomas Henzl <[email protected]>
scsi: mpt3sas: Fix a fw_event memory leak
Alex Williamson <[email protected]>
vfio/pci: Separate SR-IOV VF dev_set
Brett Creeley <[email protected]>
vfio/pds: Fix missing detach_ioas op
Jacob Pan <[email protected]>
vfio: Prevent open_count decrement to negative
Jacob Pan <[email protected]>
vfio: Fix unbalanced vfio_df_close call in no-iommu mode
Christophe JAILLET <[email protected]>
i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe()
Zhengxu Zhang <[email protected]>
exfat: fdatasync flag should be same like generic_write_sync()
Chao Yu <[email protected]>
f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
Chao Yu <[email protected]>
f2fs: fix to calculate dirty data during has_not_enough_free_secs()
Chao Yu <[email protected]>
f2fs: fix to update upper_p in __get_secs_required() correctly
Jan Prusakowski <[email protected]>
f2fs: vm_unmap_ram() may be called from an invalid context
Chao Yu <[email protected]>
f2fs: fix to avoid out-of-boundary access in devs.path
Chao Yu <[email protected]>
f2fs: fix to avoid panic in f2fs_evict_inode
Chao Yu <[email protected]>
f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
Chao Yu <[email protected]>
f2fs: doc: fix wrong quota mount option description
Chao Yu <[email protected]>
f2fs: fix to check upper boundary for gc_no_zoned_gc_percent
Chao Yu <[email protected]>
f2fs: fix to check upper boundary for gc_valid_thresh_ratio
yohan.joung <[email protected]>
f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent
Abinash Singh <[email protected]>
f2fs: fix KMSAN uninit-value in extent_info usage
Chao Yu <[email protected]>
f2fs: fix to avoid invalid wait context issue
Sheng Yong <[email protected]>
f2fs: fix bio memleak when committing super block
Daeho Jeong <[email protected]>
f2fs: turn off one_time when forcibly set to foreground GC
Brian Masney <[email protected]>
rtc: rv3028: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: pcf8563: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: pcf85063: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: nct3018y: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: hym8563: fix incorrect maximum clock rate handling
Brian Masney <[email protected]>
rtc: ds1307: fix incorrect maximum clock rate handling
Uros Bizjak <[email protected]>
ucount: fix atomic_long_inc_below() argument type
Petr Pavlu <[email protected]>
module: Restore the moduleparam prefix length check
Stanley Chu <[email protected]>
i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk
Helge Deller <[email protected]>
apparmor: Fix unaligned memory accesses in KUnit test
Johannes Berg <[email protected]>
scripts: gdb: move MNT_* constants to gdb-parsed
Ryan Lee <[email protected]>
apparmor: fix loop detection used in conflicting attachment resolution
Ryan Lee <[email protected]>
apparmor: ensure WB_HISTORY_SIZE value is a power of 2
Paul Chaignon <[email protected]>
bpf: Check netfilter ctx accesses are aligned
Paul Chaignon <[email protected]>
bpf: Check flow_dissector ctx accesses are aligned
Cindy Lu <[email protected]>
vhost: Reintroduce kthread API and add mode selection
Anders Roxell <[email protected]>
vdpa: Fix IDR memory leak in VDUSE module exit
Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix release of uninitialized resources on error path
Alok Tiwari <[email protected]>
vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit
Mike Christie <[email protected]>
vhost-scsi: Fix log flooding with target does not exist errors
Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix needs_teardown flag calculation
Namhyung Kim <[email protected]>
perf record: Cache build-ID of hit DSOs only
Takashi Iwai <[email protected]>
ALSA: usb: scarlett2: Fix missing NULL check
WangYuli <[email protected]>
selftests: ALSA: fix memory leak in utimer test
Lukasz Laguna <[email protected]>
drm/xe/vf: Disable CSC support on VF
Balamanikandan Gunasundar <[email protected]>
mtd: rawnand: atmel: set pmecc data setup time
Thomas Fourier <[email protected]>
mtd: rawnand: rockchip: Add missing check after DMA map
Thomas Fourier <[email protected]>
mtd: rawnand: atmel: Fix dma_mapping_error() address
Zheng Yu <[email protected]>
jfs: fix metapage reference count leak in dbAllocCtl
Paulo Alcantara <[email protected]>
smb: client: allow parsing zero-length AV pairs
Chenyuan Yang <[email protected]>
fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
Giovanni Cabiddu <[email protected]>
crypto: qat - fix seq_file position update in adf_ring_next()
Giovanni Cabiddu <[email protected]>
crypto: qat - fix DMA direction for compression on GEN2 devices
Shubhrajyoti Datta <[email protected]>
clk: clocking-wizard: Fix the round rate handling for versal
Chen Pei <[email protected]>
perf tools: Remove libtraceevent in .gitignore
Ben Hutchings <[email protected]>
sh: Do not use hyphen in exported variable name
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: get channel status data with firmware exists
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: get channel status data when PHY is not exists
Charles Keepax <[email protected]>
ASoC: SDCA: Fix some holes in the regmap readable/writeable helpers
Shree Ramamoorthy <[email protected]>
mfd: tps65219: Update TPS65214 MFD cell's GPIO compatible string
Thomas Fourier <[email protected]>
dmaengine: nbpfaxi: Add missing check after DMA map
Thomas Fourier <[email protected]>
dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
Ian Rogers <[email protected]>
tools subcmd: Tighten the filename size in check_if_command_finished
Dan Carpenter <[email protected]>
fs/orangefs: Allow 2 more characters in do_c_string()
Tanmay Shah <[email protected]>
remoteproc: xlnx: Disable unsupported features
Laurentiu Palcu <[email protected]>
clk: imx95-blk-ctl: Fix synchronous abort
Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
Bard Liao <[email protected]>
soundwire: stream: restore params when prepare ports fail
Eric Biggers <[email protected]>
crypto: krb5 - Fix memory leak in krb5_test_one_prf()
Bairavi Alagappan <[email protected]>
crypto: qat - disable ZUC-256 capability for QAT GEN5
Thomas Fourier <[email protected]>
crypto: img-hash - Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
crypto: keembay - Fix dma_unmap_sg() nents value
Ovidiu Panait <[email protected]>
hwrng: mtk - handle devm_pm_runtime_enable errors
Varshini Rajendran <[email protected]>
clk: at91: sam9x7: update pll clk ranges
Jan Kara <[email protected]>
ext4: Make sure BH_New bit is cleared in ->write_end handler
Baokun Li <[email protected]>
ext4: fix inode use after free in ext4_end_io_rsv_work()
Dan Carpenter <[email protected]>
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
Robin Murphy <[email protected]>
PCI: Fix driver_managed_dma check
Thomas Fourier <[email protected]>
scsi: isci: Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
scsi: mvsas: Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
scsi: elx: efct: Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
Paul Kocialkowski <[email protected]>
clk: sunxi-ng: v3s: Fix de clock definition
Yao Zi <[email protected]>
clk: thead: th1520-ap: Correctly refer the parent of osc_12m
Shiraz Saleem <[email protected]>
RDMA/mana_ib: Fix DSCP value in modify QP
Ian Rogers <[email protected]>
perf hwmon_pmu: Avoid shortening hwmon PMU name
Leo Yan <[email protected]>
perf tests bp_account: Fix leaked file descriptor
Mukesh Ojha <[email protected]>
pinmux: fix race causing mux_owner NULL with active mux_usecount
wangzijie <[email protected]>
proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
Arnd Bergmann <[email protected]>
kernel: trace: preemptirq_delay_test: use offstack cpu mask
Steven Rostedt <[email protected]>
tracing: Use queue_rcu_work() to free filters
Junxian Huang <[email protected]>
RDMA/hns: Fix -Wframe-larger-than issue
Junxian Huang <[email protected]>
RDMA/hns: Drop GFP_NOWARN
Junxian Huang <[email protected]>
RDMA/hns: Fix accessing uninitialized resources
Junxian Huang <[email protected]>
RDMA/hns: Get message length of ack_req from FW
Mengbiao Xiong <[email protected]>
crypto: ccp - Fix crash when rebind ccp device for ccp.ko
Thomas Fourier <[email protected]>
crypto: inside-secure - Fix dma_unmap_sg() nents value
Alexey Kardashevskiy <[email protected]>
crypto: ccp - Fix locking on alloc failure handling
wenglianfa <[email protected]>
RDMA/hns: Fix HW configurations not cleared in error flow
wenglianfa <[email protected]>
RDMA/hns: Fix double destruction of rsv_qp
Namhyung Kim <[email protected]>
perf sched: Fix memory leaks in 'perf sched latency'
Namhyung Kim <[email protected]>
perf sched: Use RC_CHK_EQUAL() to compare pointers
Namhyung Kim <[email protected]>
perf sched: Fix memory leaks for evsel->priv in timehist
Namhyung Kim <[email protected]>
perf sched: Fix thread leaks in 'perf sched timehist'
Namhyung Kim <[email protected]>
perf sched: Fix memory leaks in 'perf sched map'
Namhyung Kim <[email protected]>
perf sched: Free thread->priv using priv_destructor
Namhyung Kim <[email protected]>
perf sched: Make sure it frees the usage string
Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
Ian Rogers <[email protected]>
perf dso: Add missed dso__put to dso__load_kcore
Namhyung Kim <[email protected]>
perf tools: Fix use-after-free in help_unknown_cmd()
Thomas Fourier <[email protected]>
Fix dma_unmap_sg() nents value
Nuno Sá <[email protected]>
clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
Amir Goldstein <[email protected]>
fanotify: sanitize handle_type values when reporting fid
Luca Weiss <[email protected]>
phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
Rodrigo Gobbi <[email protected]>
soundwire: debugfs: move debug statement outside of error handling
Krzysztof Kozlowski <[email protected]>
dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
Charles Keepax <[email protected]>
soundwire: Correct some property names
Jiwei Sun <[email protected]>
PCI: Adjust the position of reading the Link Control 2 register
Ze Huang <[email protected]>
pinctrl: canaan: k230: Fix order of DT parse and pinctrl register
Ze Huang <[email protected]>
pinctrl: canaan: k230: add NULL check in DT parse
Yuan Chen <[email protected]>
pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state()
Yuan Chen <[email protected]>
pinctrl: sunxi: Fix memory leak on krealloc failure
Jerome Brunet <[email protected]>
PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
Arnd Bergmann <[email protected]>
crypto: arm/aes-neonbs - work around gcc-15 warning
Thomas Antoine <[email protected]>
power: supply: max1720x correct capacity computation
Casey Connolly <[email protected]>
power: supply: qcom_pmi8998_charger: fix wakeirq
Charles Han <[email protected]>
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
Charles Han <[email protected]>
power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
Rohit Visavalia <[email protected]>
clk: xilinx: vcu: unregister pll_post only if registered correctly
Namhyung Kim <[email protected]>
perf parse-events: Set default GH modifier properly
James Cowgill <[email protected]>
media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
Henry Martin <[email protected]>
clk: davinci: Add NULL check in davinci_lpsc_clk_register()
Ivan Stepchenko <[email protected]>
mtd: fix possible integer overflow in erase_xfer()
Svyatoslav Pankratov <[email protected]>
crypto: qat - fix state restore for banks with exceptions
Ahsan Atta <[email protected]>
crypto: qat - allow enabling VFs in the absence of IOMMU
Herbert Xu <[email protected]>
padata: Fix pd UAF once and for all
Herbert Xu <[email protected]>
crypto: marvell/cesa - Fix engine load inaccuracy
Suman Kumar Chakraborty <[email protected]>
crypto: qat - use unmanaged allocation for dc_data
Ovidiu Panait <[email protected]>
crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
Lad Prabhakar <[email protected]>
clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks
Hans Zhang <[email protected]>
PCI: rockchip-host: Fix "Unexpected Completion" log message
Bjorn Andersson <[email protected]>
remoteproc: qcom: pas: Conclude the rename from adsp
Kees Cook <[email protected]>
fortify: Fix incorrect reporting of read buffer size
Kees Cook <[email protected]>
staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()
Gabriele Monaco <[email protected]>
rv: Adjust monitor dependencies
Samuel Holland <[email protected]>
RISC-V: KVM: Fix inclusion of Smnpm in the guest ISA bitmap
Puranjay Mohan <[email protected]>
bpf, arm64: Fix fp initialization for exception boundary
Thomas Weißschuh <[email protected]>
bpf/preload: Don't select USERMODE_DRIVER
Eric Dumazet <[email protected]>
ipv6: annotate data-races around rt->fib6_nsiblings
Eric Dumazet <[email protected]>
ipv6: fix possible infinite loop in fib6_info_uses_dev()
Eric Dumazet <[email protected]>
ipv6: prevent infinite loop in rt6_nlmsg_size()
Stanislav Fomichev <[email protected]>
vrf: Drop existing dst reference in vrf_ip6_input_dst
Xiumei Mu <[email protected]>
selftests: rtnetlink.sh: remove esp4_offload after test
Jason Xing <[email protected]>
igb: xsk: solve negative overflow of nb_pkts in zerocopy mode
Jason Xing <[email protected]>
stmmac: xsk: fix negative overflow of budget in zerocopy mode
Kuniyuki Iwashima <[email protected]>
neighbour: Fix null-ptr-deref in neigh_flush_dev().
Tristram Ha <[email protected]>
net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863
Stanislav Fomichev <[email protected]>
macsec: set IFF_UNICAST_FLT priv flag
Jianbo Liu <[email protected]>
net/mlx5e: Remove skb secpath if xfrm state is not found
Alexei Lazar <[email protected]>
net/mlx5e: Clear Read-Only port buffer size in PBMC before update
Florian Westphal <[email protected]>
netfilter: xt_nfacct: don't assume acct name is null-terminated
Jimmy Assarsson <[email protected]>
can: kvaser_usb: Assign netdev.dev_port based on device channel index
Jimmy Assarsson <[email protected]>
can: kvaser_pciefd: Store device channel index
Stephane Grosjean <[email protected]>
can: peak_usb: fix USB FD devices potential malfunction
Daniel Zahka <[email protected]>
selftests: drv-net: tso: fix non-tunneled tso6 test case name
Daniel Zahka <[email protected]>
selftests: drv-net: tso: fix vxlan tunnel flags to get correct gso_type
Daniel Zahka <[email protected]>
selftests: drv-net: tso: enable test cases based on hw_features
Gal Pressman <[email protected]>
selftests: drv-net: Fix remote command checking in require_cmd()
Gabriele Monaco <[email protected]>
tools/rv: Do not skip idle in trace
Kuniyuki Iwashima <[email protected]>
bpf: Disable migration in nf_hook_run_bpf().
Chris Down <[email protected]>
Bluetooth: hci_event: Mask data status from LE ext adv reports
Ivan Pravdin <[email protected]>
Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv
Arseniy Krasnov <[email protected]>
Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
Benjamin Berg <[email protected]>
wifi: iwlwifi: mld: decode EOF bit for AMPDUs
Jeremy Linton <[email protected]>
arm64/gcs: task_gcs_el0_enable() should use passed task
Johannes Berg <[email protected]>
wifi: mac80211: fix WARN_ON for monitor mode on some devices
Matthew Wilcox (Oracle) <[email protected]>
memcg_slabinfo: Fix use of PG_slab
Marco Elver <[email protected]>
kcsan: test: Initialize dummy variable
Steven Rostedt <[email protected]>
ring-buffer: Remove ring_buffer_read_prepare_sync()
Kees Cook <[email protected]>
wifi: nl80211: Set num_sub_specs before looping through sub_specs
Kees Cook <[email protected]>
wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
Steven Rostedt <[email protected]>
PM: cpufreq: powernv/tracing: Move powernv_throttle trace event
Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
Tamizh Chelvam Raja <[email protected]>
wifi: ath12k: fix endianness handling while accessing wmi service bit
Remi Pommarel <[email protected]>
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
Remi Pommarel <[email protected]>
wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
Alexander Wetzel <[email protected]>
wifi: mac80211: Don't call fq_flow_idx() for management frames
Alexander Wetzel <[email protected]>
wifi: mac80211: Do not schedule stopped TXQs
Alexander Wetzel <[email protected]>
wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
Murad Masimov <[email protected]>
wifi: plfxlc: Fix error handling in usb driver probe
Moon Hee Lee <[email protected]>
wifi: mac80211: reject TDLS operations when station is not associated
Tze-nan Wu <[email protected]>
rcu: Fix delayed execution of hurry callbacks
Jason Gunthorpe <[email protected]>
iommu/amd: Fix geometry.aperture_end for V2 tables
Puranjay Mohan <[email protected]>
selftests/bpf: fix implementation of smp_mb()
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: fix kiq locking in KCQ reset
Alex Deucher <[email protected]>
drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: fix kiq locking in KCQ reset
Baochen Qiang <[email protected]>
wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
Aaradhana Sahu <[email protected]>
wifi: ath12k: Use HTT_TCL_METADATA_VER_V1 in FTM mode
Thomas Fourier <[email protected]>
mwl8k: Add missing check after DMA map
Bitterblue Smith <[email protected]>
wifi: rtw88: Fix macid assigned to TDLS station
Martin Kaistra <[email protected]>
wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
Eric Dumazet <[email protected]>
tcp: call tcp_measure_rcv_mss() for ooo packets
Juergen Gross <[email protected]>
xen/gntdev: remove struct gntdev_copy_batch from stack
Dmitry Baryshkov <[email protected]>
iommu/arm-smmu: disable PRR on SM8250
Jason Gunthorpe <[email protected]>
iommu/vt-d: Do not wipe out the page table NID when devices detach
Juri Lelli <[email protected]>
sched/deadline: Reset extra_bw to max_bw when clearing root domains
Juri Lelli <[email protected]>
sched/deadline: Initialize dl_servers after SMP
Al Viro <[email protected]>
xen: fix UAF in dmabuf_exp_from_pages()
Edward Srouji <[email protected]>
RDMA/mlx5: Fix UMR modifying of mkey page size
Eric Dumazet <[email protected]>
net_sched: act_ctinfo: use atomic64_t for three counters
William Liu <[email protected]>
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
Easwar Hariharan <[email protected]>
iommu/amd: Enable PASID and ATS capabilities in the correct order
Tiwei Bie <[email protected]>
um: rtc: Avoid shadowing err in uml_rtc_start()
Johan Korsnes <[email protected]>
arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
Fedor Pchelkin <[email protected]>
netfilter: nf_tables: adjust lockdep assertions handling
Phil Sutter <[email protected]>
netfilter: nf_tables: Drop dead code from fill_*_info routines
Shixiong Ou <[email protected]>
fbcon: Fix outdated registered_fb reference in comment
Peter Zijlstra <[email protected]>
sched/deadline: Less agressive dl_server handling
Peter Zijlstra <[email protected]>
sched/psi: Optimize psi_group_change() cpu_clock() usage
Andy Yan <[email protected]>
drm/rockchip: vop2: Fix the update of LAYER/PORT select registers when there are multi display output on rk3588/rk3568
Heiko Stuebner <[email protected]>
drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port
Aaradhana Sahu <[email protected]>
wifi: ath12k: Block radio bring-up in FTM mode
Fedor Pchelkin <[email protected]>
drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Fix valid_links bitmask in mt7996_mac_sta_{add,remove}Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx()
Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: Fix secondary link lookup in mt7996_mcu_sta_mld_setup_tlv()
Artem Sadovnikov <[email protected]>
refscale: Check that nreaders and loops multiplication doesn't overflow
Finn Thain <[email protected]>
m68k: Don't unregister boot console needlessly
Konrad Dybcio <[email protected]>
drm/msm/dpu: Fill in min_prefill_lines for SC8180X
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Ensure RCU lock is held around bpf_prog_ksym_find
Mark Brown <[email protected]>
kselftest/arm64: Fix check for setting new VLs in sve-ptrace
Dan Carpenter <[email protected]>
wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
Eric Dumazet <[email protected]>
net: dst: add four helpers to annotate data-races around dst->dev
Eric Dumazet <[email protected]>
net: dst: annotate data-races around dst->output
Eric Dumazet <[email protected]>
net: dst: annotate data-races around dst->input
Stav Aviram <[email protected]>
net/mlx5: Check device memory pointer before usage
xin.guo <[email protected]>
tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
Thiraviyam Mariyappan <[email protected]>
wifi: ath12k: Clear auth flag only for actual association in security mode
Sergey Senozhatsky <[email protected]>
wifi: ath11k: clear initialized flag for deinit-ed srng lists
Stanislav Fomichev <[email protected]>
team: replace team lock with rtnl lock
Jiasheng Jiang <[email protected]>
iwlwifi: Add missing check for alloc_ordered_workqueue
Xiu Jianfeng <[email protected]>
wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
Daniil Dulov <[email protected]>
wifi: rtl818x: Kill URBs before clearing tx status queue
Zong-Zhe Yang <[email protected]>
wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
Arnd Bergmann <[email protected]>
caif: reduce stack size, again
Tamizh Chelvam Raja <[email protected]>
wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
P Praneesh <[email protected]>
wifi: ath12k: Fix double budget decrement while reaping monitor ring
Rameshkumar Sundaram <[email protected]>
wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss
Haren Myneni <[email protected]>
powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add
Yuan Chen <[email protected]>
bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
Lijo Lazar <[email protected]>
drm/amdgpu: Remove nbiov7.9 replay count reporting
Jonathan Corbet <[email protected]>
slub: Fix a documentation build error for krealloc()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
Petr Machata <[email protected]>
net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
Mykyta Yatsenko <[email protected]>
selftests/bpf: Fix unintentional switch case fall through
Eduard Zingerman <[email protected]>
bpf: handle jset (if a & b ...) as a jump in CFG computation
Fushuai Wang <[email protected]>
selftests/bpf: fix signedness bug in redir_partial()
Jiayuan Chen <[email protected]>
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
Breno Leitao <[email protected]>
netconsole: Only register console drivers when targets are configured
Jiayuan Chen <[email protected]>
bpf, sockmap: Fix psock incorrectly pointing to sk
Kuan-Chung Chen <[email protected]>
wifi: rtw89: fix EHT 20MHz TX rate for non-AP STA
Boris Brezillon <[email protected]>
drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
Adrián Larumbe <[email protected]>
drm/panfrost: Fix panfrost device variable name in devfreq
Cristian Ciocaltea <[email protected]>
drm/connector: hdmi: Evaluate limited range after computing format
Andy Yan <[email protected]>
drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
Steven Rostedt <[email protected]>
selftests/tracing: Fix false failure of subsystem event test
Alok Tiwari <[email protected]>
staging: nvec: Fix incorrect null termination of battery manufacturer
Michael J. Ruhl <[email protected]>
drm/xe: Correct BMG VSEC header sizing
Michael J. Ruhl <[email protected]>
drm/xe: Correct the rev value for the DVSEC entries
Slark Xiao <[email protected]>
bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
Konrad Dybcio <[email protected]>
interconnect: qcom: qcs615: Drop IP0 interconnects
Dmitry Baryshkov <[email protected]>
interconnect: qcom: sc8180x: specify num_nodes
Dmitry Baryshkov <[email protected]>
interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
Johan Hovold <[email protected]>
soc: qcom: pmic_glink: fix OF node leak
Brahmajit Das <[email protected]>
samples: mei: Fix building on musl libc
Greg Kroah-Hartman <[email protected]>
staging: greybus: gbphy: fix up const issue with the match callback
Charles Keepax <[email protected]>
ASoC: SDCA: Allow read-only controls to be deferrable
Lifeng Zheng <[email protected]>
cpufreq: Init policy->rwsem before it may be possibly used
Lifeng Zheng <[email protected]>
cpufreq: Initialize cpufreq-based frequency-invariance later
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
Chanwoo Choi <[email protected]>
PM / devfreq: Fix a index typo in trans_stat
Lifeng Zheng <[email protected]>
PM / devfreq: Check governor before using governor->name
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Fix pinctrl node names for RK3528
Adam Ford <[email protected]>
arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
Adam Ford <[email protected]>
arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
Annette Kobou <[email protected]>
ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
Moon Hee Lee <[email protected]>
selftests: breakpoints: use suspend_stats to reliably check suspend success
Patrick Delaunay <[email protected]>
arm64: dts: st: fix timer used for ticks
Sebastian Reichel <[email protected]>
arm64: dts: rockchip: fix PHY handling for ROCK 4D
Sumit Gupta <[email protected]>
soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
Christophe JAILLET <[email protected]>
staging: gpib: Fix error handling paths in cb_gpib_probe()
Harshit Mogalapalli <[email protected]>
staging: gpib: Fix error code in board_type_ioctl()
Albin Törnqvist <[email protected]>
arm: dts: ti: omap: Fixup pinheader typo
Lucas De Marchi <[email protected]>
usb: early: xhci-dbc: Fix early_ioremap leak
Sivan Zohar-Kotzer <[email protected]>
powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
Greg Kroah-Hartman <[email protected]>
Revert "vmci: Prevent the dispatching of uninitialized payloads"
Thomas Weißschuh <[email protected]>
selftests: vDSO: chacha: Correctly skip test if necessary
Tim Harvey <[email protected]>
arm64: dts: imx8mp-venice-gw74xx: update name of M2SKT_WDIS2# gpio
Denis OSTERLAND-HEIM <[email protected]>
pps: fix poll support
Lizhi Xu <[email protected]>
vmci: Prevent the dispatching of uninitialized payloads
Shankari Anand <[email protected]>
rust: miscdevice: clarify invariant for MiscDeviceRegistration
Abdun Nihaal <[email protected]>
staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Enable eMMC HS200 mode on Radxa E20C
Konrad Dybcio <[email protected]>
power: sequencing: qcom-wcn: fix bluetooth-wifi copypasta for WCN6855
Greg Kroah-Hartman <[email protected]>
drivers: misc: sram: fix up some const issues with recent attribute changes
Clément Le Goffic <[email protected]>
spi: stm32: Check for cfg availability in stm32_spi_probe
Hans de Goede <[email protected]>
mei: vsc: Unset the event callback on remove and probe errors
Hans de Goede <[email protected]>
mei: vsc: Event notifier fixes
Hans de Goede <[email protected]>
mei: vsc: Destroy mutex after freeing the IRQ
Hans de Goede <[email protected]>
mei: vsc: Don't re-init VSC from mei_vsc_hw_reset() on stop
Dmitry Baryshkov <[email protected]>
usb: typec: ucsi: yoga-c630: fix error and remove paths
Sibi Sankar <[email protected]>
firmware: arm_scmi: Fix up turbo frequencies selection
Arnd Bergmann <[email protected]>
cpufreq: armada-8k: make both cpu masks static
Ryan Wanner <[email protected]>
ARM: dts: microchip: sam9x7: Add clock name property
Ryan Wanner <[email protected]>
ARM: dts: microchip: sama7d65: Add clock name property
Michael Walle <[email protected]>
arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size
Wadim Egorov <[email protected]>
arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
Charalampos Mitrodimas <[email protected]>
usb: misc: apple-mfi-fastcharge: Make power supply names unique
Seungjin Bae <[email protected]>
usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
Krzysztof Kozlowski <[email protected]>
ARM: dts: vfxxx: Correctly use two tuples for timer address
Gautham R. Shenoy <[email protected]>
pm: cpupower: Fix printing of CORE, CPU fields in cpupower-monitor
André Apitzsch <[email protected]>
arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
Lijuan Gao <[email protected]>
arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc
Will Deacon <[email protected]>
arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
Jie Gan <[email protected]>
arm64: dts: qcom: qcs615: disable the CTI device of the camera block
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sc7180: Expand IMEM region
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sdm845: Expand IMEM region
Jie Gan <[email protected]>
arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight
Alexander Wilhelm <[email protected]>
soc: qcom: QMI encoding/decoding for big endian
Dmitry Vyukov <[email protected]>
selftests: Fix errno checking in syscall_user_dispatch test
Alexander Stein <[email protected]>
arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
Chen-Yu Tsai <[email protected]>
ASoC: mediatek: use reserved memory or enable buffer pre-allocation
Arnd Bergmann <[email protected]>
ASoC: ops: dynamically allocate struct snd_ctl_elem_value
Venkata Prasad Potturu <[email protected]>
ASoC: amd: acp: Fix pointer assignments for snd_soc_acpi_mach structures
Kuninori Morimoto <[email protected]>
ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
Sun YangKai <[email protected]>
btrfs: remove partial support for lowest level from btrfs_search_forward()
Randy Dunlap <[email protected]>
io_uring: fix breakage in EXPERT menu
John Garry <[email protected]>
block: sanitize chunk_sectors for atomic write limits
Andreas Gruenbacher <[email protected]>
gfs2: No more self recovery
Kees Cook <[email protected]>
kunit/fortify: Add back "volatile" for sizeof() constants
Zheng Qixing <[email protected]>
md: allow removing faulty rdev during resync
Andreas Gruenbacher <[email protected]>
gfs2: Minor do_xmote cancelation fix
Thomas Fourier <[email protected]>
block: mtip32xx: Fix usage of dma_map_sg()
Konstantin Komarov <[email protected]>
Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
Yangtao Li <[email protected]>
hfsplus: remove mutex_lock check in hfsplus_free_extents
Yangtao Li <[email protected]>
hfs: make splice write available again
Yangtao Li <[email protected]>
hfsplus: make splice write available again
Caleb Sander Mateos <[email protected]>
ublk: use vmalloc for ublk_device's __queues
Tingmao Wang <[email protected]>
landlock: Fix warning from KUnit tests
Edward Adam Davis <[email protected]>
fs/ntfs3: cancle set bad inode after removing name fails
Song Liu <[email protected]>
selftests/landlock: Fix build of audit_test
Mickaël Salaün <[email protected]>
selftests/landlock: Fix readlink check
RubenKelevra <[email protected]>
fs_context: fix parameter name in infofc() macro
Al Viro <[email protected]>
parse_longname(): strrchr() expects NUL-terminated string
Richard Guy Briggs <[email protected]>
audit,module: restore audit logging in load failure case
Alexandru Andries <[email protected]>
ASoC: amd: yc: add DMI quirk for ASUS M6501RM
Arnd Bergmann <[email protected]>
ASoC: Intel: fix SND_SOC_SOF dependencies
Jackie Dong <[email protected]>
ALSA: hda/realtek: Support mute LED for Yoga with ALC287
Richard Fitzgerald <[email protected]>
ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
Adam Queler <[email protected]>
ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
Arnd Bergmann <[email protected]>
ethernet: intel: fix building with large NR_CPUS
Lane Odenbach <[email protected]>
ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
Thomas Zimmermann <[email protected]>
drm/radeon: Do not hold console lock while suspending clients
-------------
Diffstat:
Documentation/filesystems/f2fs.rst | 6 +- Documentation/netlink/specs/ethtool.yaml | 6 +- Makefile | 4 +- arch/arm/boot/dts/microchip/sam9x7.dtsi | 2 + arch/arm/boot/dts/microchip/sama7d65.dtsi | 2 + .../boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi | 1 - arch/arm/boot/dts/nxp/vf/vfxxx.dtsi | 2 +- arch/arm/boot/dts/ti/omap/am335x-boneblack.dts | 2 +- arch/arm/crypto/aes-neonbs-glue.c | 2 +- arch/arm64/boot/dts/exynos/google/gs101.dtsi | 3 + .../boot/dts/freescale/imx8mm-beacon-som.dtsi | 2 + .../boot/dts/freescale/imx8mn-beacon-som.dtsi | 2 + .../boot/dts/freescale/imx8mp-venice-gw74xx.dts | 8 +- arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 6 +- arch/arm64/boot/dts/qcom/msm8976.dtsi | 2 + arch/arm64/boot/dts/qcom/qcs615.dtsi | 4 + arch/arm64/boot/dts/qcom/sa8775p.dtsi | 10 +- arch/arm64/boot/dts/qcom/sc7180.dtsi | 10 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 10 +- arch/arm64/boot/dts/rockchip/rk3528-pinctrl.dtsi | 20 +- arch/arm64/boot/dts/rockchip/rk3528-radxa-e20c.dts | 1 + arch/arm64/boot/dts/rockchip/rk3576-rock-4d.dts | 6 +- arch/arm64/boot/dts/st/stm32mp251.dtsi | 2 +- .../boot/dts/ti/k3-am62p-j722s-common-main.dtsi | 2 +- .../boot/dts/ti/k3-am642-phyboard-electra-rdk.dts | 2 + arch/arm64/include/asm/gcs.h | 2 +- arch/arm64/kernel/process.c | 6 +- arch/arm64/net/bpf_jit_comp.c | 1 + arch/m68k/Kconfig.debug | 2 +- arch/m68k/kernel/early_printk.c | 42 +- arch/m68k/kernel/head.S | 8 +- arch/mips/mm/tlb-r4k.c | 56 +- arch/powerpc/configs/ppc6xx_defconfig | 1 - arch/powerpc/kernel/eeh.c | 1 + arch/powerpc/kernel/eeh_driver.c | 48 +- arch/powerpc/kernel/eeh_pe.c | 10 +- arch/powerpc/kernel/pci-hotplug.c | 3 + arch/powerpc/platforms/pseries/dlpar.c | 52 +- arch/riscv/kvm/vcpu_onereg.c | 83 ++- arch/s390/boot/startup.c | 2 +- arch/s390/include/asm/ap.h | 2 +- arch/s390/kernel/setup.c | 6 + arch/s390/mm/pgalloc.c | 5 - arch/s390/mm/vmem.c | 5 +- arch/sh/Makefile | 10 +- arch/sh/boot/compressed/Makefile | 4 +- arch/sh/boot/romimage/Makefile | 4 +- arch/um/drivers/rtc_user.c | 2 +- arch/x86/boot/cpuflags.c | 13 + arch/x86/coco/sev/shared.c | 46 ++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/hw_irq.h | 12 +- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/irq.c | 63 ++- arch/x86/kvm/vmx/vmx.c | 4 + arch/x86/mm/extable.c | 5 +- block/blk-settings.c | 19 +- crypto/krb5/selftest.c | 1 + drivers/block/mtip32xx/mtip32xx.c | 27 +- drivers/block/ublk_drv.c | 4 +- drivers/bluetooth/btusb.c | 4 + drivers/bus/mhi/host/pci_generic.c | 8 +- drivers/char/hw_random/mtk-rng.c | 4 +- drivers/clk/at91/sam9x7.c | 20 +- drivers/clk/clk-axi-clkgen.c | 2 +- drivers/clk/davinci/psc.c | 5 + drivers/clk/imx/clk-imx95-blk-ctl.c | 13 +- drivers/clk/renesas/rzv2h-cpg.c | 1 + drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 3 +- drivers/clk/thead/clk-th1520-ap.c | 9 +- drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +- drivers/clk/xilinx/xlnx_vcu.c | 4 +- drivers/cpufreq/Makefile | 1 + drivers/cpufreq/armada-8k-cpufreq.c | 3 +- drivers/cpufreq/cpufreq.c | 21 +- drivers/cpufreq/intel_pstate.c | 4 +- drivers/cpufreq/powernv-cpufreq.c | 4 +- drivers/cpufreq/powernv-trace.h | 44 ++ .../crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 4 +- drivers/crypto/ccp/ccp-debugfs.c | 3 + drivers/crypto/ccp/sev-dev.c | 8 +- drivers/crypto/img-hash.c | 2 +- drivers/crypto/inside-secure/safexcel_hash.c | 8 +- .../crypto/intel/keembay/keembay-ocs-hcu-core.c | 8 +- .../crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 9 +- .../crypto/intel/qat/qat_common/adf_gen4_hw_data.c | 29 +- drivers/crypto/intel/qat/qat_common/adf_sriov.c | 1 - .../intel/qat/qat_common/adf_transport_debug.c | 4 +- drivers/crypto/intel/qat/qat_common/qat_bl.c | 6 +- .../crypto/intel/qat/qat_common/qat_compression.c | 8 +- drivers/crypto/marvell/cesa/cipher.c | 4 +- drivers/crypto/marvell/cesa/hash.c | 5 +- drivers/devfreq/devfreq.c | 12 +- drivers/dma/mmp_tdma.c | 2 +- drivers/dma/mv_xor.c | 21 +- drivers/dma/nbpfaxi.c | 13 + drivers/firmware/arm_scmi/perf.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 6 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 3 +- drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 20 - .../gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c | 2 +- drivers/gpu/drm/display/drm_hdmi_state_helper.c | 4 +- .../drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 1 + drivers/gpu/drm/panfrost/panfrost_devfreq.c | 4 +- drivers/gpu/drm/radeon/radeon_device.c | 8 +- drivers/gpu/drm/rockchip/rockchip_drm_fb.c | 9 +- drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 29 +- drivers/gpu/drm/rockchip/rockchip_drm_vop2.h | 33 ++ drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 89 ++- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 2 +- drivers/gpu/drm/xe/xe_device.c | 1 + drivers/gpu/drm/xe/xe_gt_sriov_pf.c | 32 +- drivers/gpu/drm/xe/xe_vsec.c | 20 +- drivers/hid/hid-apple.c | 20 +- drivers/hid/hid-core.c | 6 +- drivers/i2c/muxes/i2c-mux-mule.c | 3 +- drivers/i3c/master/svc-i3c-master.c | 20 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 3 +- drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_hem.c | 18 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 87 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 8 +- drivers/infiniband/hw/hns/hns_roce_main.c | 22 +- drivers/infiniband/hw/mana/qp.c | 2 +- drivers/infiniband/hw/mlx5/dm.c | 2 +- drivers/infiniband/hw/mlx5/umr.c | 6 +- drivers/interconnect/qcom/qcs615.c | 42 -- drivers/interconnect/qcom/sc8180x.c | 6 + drivers/interconnect/qcom/sc8280xp.c | 1 + drivers/iommu/amd/iommu.c | 19 +- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 3 +- drivers/iommu/intel/iommu.c | 1 - drivers/irqchip/Kconfig | 1 + drivers/md/md.c | 33 +- .../media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 1 + drivers/media/v4l2-core/v4l2-ctrls-core.c | 8 +- drivers/mfd/tps65219.c | 2 +- drivers/misc/mei/platform-vsc.c | 8 + drivers/misc/mei/vsc-tp.c | 20 +- drivers/misc/sram.c | 10 +- drivers/mtd/ftl.c | 2 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 2 +- drivers/mtd/nand/raw/atmel/pmecc.c | 6 + drivers/mtd/nand/raw/rockchip-nand-controller.c | 15 + drivers/mtd/spi-nor/spansion.c | 31 ++ drivers/net/can/kvaser_pciefd.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 17 +- drivers/net/dsa/microchip/ksz8.c | 3 + drivers/net/dsa/microchip/ksz8_reg.h | 4 +- drivers/net/ethernet/airoha/airoha_npu.c | 2 + drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k.h | 3 +- drivers/net/ethernet/intel/i40e/i40e.h | 2 +- drivers/net/ethernet/intel/igb/igb_xsk.c | 3 +- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 3 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 + .../mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 - drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 6 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/ti/icssg/icssg_common.c | 15 +- drivers/net/ipa/ipa_sysfs.c | 6 +- drivers/net/macsec.c | 2 +- drivers/net/mdio/mdio-bcm-unimac.c | 5 +- drivers/net/netconsole.c | 30 +- drivers/net/phy/mscc/mscc_ptp.c | 1 + drivers/net/phy/mscc/mscc_ptp.h | 1 + drivers/net/ppp/pptp.c | 18 +- drivers/net/team/team_core.c | 96 ++-- drivers/net/team/team_mode_activebackup.c | 3 +- drivers/net/team/team_mode_loadbalance.c | 13 +- drivers/net/usb/usbnet.c | 11 +- drivers/net/vrf.c | 2 + drivers/net/wireless/ath/ath11k/hal.c | 4 + drivers/net/wireless/ath/ath11k/mac.c | 12 +- drivers/net/wireless/ath/ath12k/dp.h | 1 + drivers/net/wireless/ath/ath12k/dp_mon.c | 1 - drivers/net/wireless/ath/ath12k/dp_tx.c | 10 +- drivers/net/wireless/ath/ath12k/mac.c | 29 +- drivers/net/wireless/ath/ath12k/p2p.c | 3 +- drivers/net/wireless/ath/ath12k/wmi.c | 14 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 8 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 12 +- drivers/net/wireless/intel/iwlwifi/mld/rx.c | 9 + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 4 +- drivers/net/wireless/marvell/mwl8k.c | 4 + drivers/net/wireless/mediatek/mt76/mt7996/main.c | 21 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +- drivers/net/wireless/purelifi/plfxlc/mac.c | 11 +- drivers/net/wireless/purelifi/plfxlc/mac.h | 2 +- drivers/net/wireless/purelifi/plfxlc/usb.c | 29 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 2 +- drivers/net/wireless/realtek/rtw88/main.c | 4 +- drivers/net/wireless/realtek/rtw89/core.c | 5 + drivers/net/wireless/realtek/rtw89/phy.c | 12 +- drivers/nvme/target/core.c | 18 +- drivers/pci/controller/pcie-rockchip-host.c | 2 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 4 +- drivers/pci/hotplug/pnv_php.c | 235 +++++++- drivers/pci/pci-driver.c | 6 +- drivers/pci/quirks.c | 6 +- drivers/perf/arm-ni.c | 2 + drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 83 +-- drivers/pinctrl/berlin/berlin.c | 8 +- drivers/pinctrl/pinctrl-k230.c | 13 +- drivers/pinctrl/pinmux.c | 20 +- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 11 +- drivers/platform/x86/intel/pmt/class.c | 3 +- drivers/platform/x86/intel/pmt/class.h | 1 + drivers/power/sequencing/pwrseq-qcom-wcn.c | 2 +- drivers/power/supply/cpcap-charger.c | 5 +- drivers/power/supply/max14577_charger.c | 4 +- drivers/power/supply/max1720x_battery.c | 11 +- drivers/power/supply/qcom_pmi8998_charger.c | 4 +- drivers/powercap/dtpm_cpu.c | 2 + drivers/pps/pps.c | 11 +- drivers/remoteproc/Kconfig | 11 +- drivers/remoteproc/qcom_q6v5_pas.c | 615 ++++++++++----------- drivers/remoteproc/xlnx_r5_remoteproc.c | 2 + drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-hym8563.c | 2 +- drivers/rtc/rtc-nct3018y.c | 2 +- drivers/rtc/rtc-pcf85063.c | 2 +- drivers/rtc/rtc-pcf8563.c | 2 +- drivers/rtc/rtc-rv3028.c | 2 +- drivers/s390/crypto/ap_bus.h | 2 +- drivers/scsi/elx/efct/efct_lio.c | 2 +- drivers/scsi/ibmvscsi_tgt/libsrp.c | 6 +- drivers/scsi/isci/request.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 3 +- drivers/scsi/mvsas/mv_sas.c | 4 +- drivers/scsi/scsi_transport_iscsi.c | 2 + drivers/scsi/sd.c | 4 +- drivers/soc/qcom/pmic_glink.c | 9 +- drivers/soc/qcom/qmi_encdec.c | 46 +- drivers/soc/tegra/cbb/tegra234-cbb.c | 2 + drivers/soundwire/debugfs.c | 6 +- drivers/soundwire/mipi_disco.c | 4 +- drivers/soundwire/stream.c | 2 +- drivers/spi/spi-cs42l43.c | 2 +- drivers/spi/spi-stm32.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 1 + drivers/staging/gpib/cb7210/cb7210.c | 15 +- drivers/staging/gpib/common/gpib_os.c | 2 +- drivers/staging/greybus/gbphy.c | 6 +- .../media/atomisp/pci/atomisp_gmin_platform.c | 9 +- drivers/staging/nvec/nvec_power.c | 2 +- drivers/ufs/core/ufshcd.c | 10 +- drivers/usb/early/xhci-dbc.c | 4 + drivers/usb/gadget/composite.c | 5 + drivers/usb/gadget/function/f_hid.c | 7 +- drivers/usb/gadget/function/uvc_configfs.c | 10 + drivers/usb/host/xhci-plat.c | 2 +- drivers/usb/misc/apple-mfi-fastcharge.c | 24 +- drivers/usb/serial/option.c | 2 + drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 19 +- drivers/vdpa/mlx5/core/mr.c | 3 + drivers/vdpa/mlx5/net/mlx5_vnet.c | 12 +- drivers/vdpa/vdpa_user/vduse_dev.c | 1 + drivers/vfio/device_cdev.c | 38 +- drivers/vfio/group.c | 7 +- drivers/vfio/iommufd.c | 4 + drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 + drivers/vfio/pci/mlx5/main.c | 1 + drivers/vfio/pci/nvgrace-gpu/main.c | 2 + drivers/vfio/pci/pds/vfio_dev.c | 2 + drivers/vfio/pci/qat/main.c | 1 + drivers/vfio/pci/vfio_pci.c | 1 + drivers/vfio/pci/vfio_pci_core.c | 24 +- drivers/vfio/pci/virtio/main.c | 3 + drivers/vfio/vfio_main.c | 3 +- drivers/vhost/Kconfig | 18 + drivers/vhost/scsi.c | 6 +- drivers/vhost/vhost.c | 244 +++++++- drivers/vhost/vhost.h | 22 + drivers/video/fbdev/core/fbcon.c | 4 +- drivers/video/fbdev/imxfb.c | 9 +- drivers/watchdog/ziirave_wdt.c | 3 + drivers/xen/gntdev-common.h | 4 + drivers/xen/gntdev-dmabuf.c | 28 +- drivers/xen/gntdev.c | 71 ++- fs/btrfs/ctree.c | 18 +- fs/ceph/crypto.c | 31 +- fs/exfat/file.c | 5 +- fs/ext4/inline.c | 2 + fs/ext4/inode.c | 3 +- fs/ext4/page-io.c | 16 +- fs/f2fs/data.c | 7 +- fs/f2fs/debug.c | 17 +- fs/f2fs/extent_cache.c | 2 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/gc.c | 1 + fs/f2fs/inode.c | 21 +- fs/f2fs/segment.h | 5 +- fs/f2fs/super.c | 1 + fs/f2fs/sysfs.c | 21 + fs/gfs2/glock.c | 3 +- fs/gfs2/util.c | 37 +- fs/hfs/inode.c | 1 + fs/hfsplus/extents.c | 3 - fs/hfsplus/inode.c | 1 + fs/jfs/jfs_dmap.c | 4 +- fs/nfs/dir.c | 4 +- fs/nfs/export.c | 11 +- fs/nfs/flexfilelayout/flexfilelayout.c | 26 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 6 +- fs/nfs/internal.h | 9 +- fs/nfs/nfs4proc.c | 10 +- fs/nfs_common/nfslocalio.c | 28 +- fs/nfsd/localio.c | 5 +- fs/nfsd/vfs.c | 10 +- fs/notify/fanotify/fanotify.c | 8 +- fs/ntfs3/file.c | 5 +- fs/ntfs3/frecord.c | 7 +- fs/ntfs3/namei.c | 10 +- fs/ntfs3/ntfs_fs.h | 3 +- fs/orangefs/orangefs-debugfs.c | 6 +- fs/proc/generic.c | 2 + fs/proc/inode.c | 2 +- fs/proc/internal.h | 5 + fs/smb/client/cifs_debug.c | 6 +- fs/smb/client/cifsencrypt.c | 4 +- fs/smb/client/cifsfs.c | 2 +- fs/smb/client/connect.c | 9 +- fs/smb/client/fs_context.c | 19 +- fs/smb/client/fs_context.h | 18 +- fs/smb/client/link.c | 11 +- fs/smb/client/reparse.c | 2 +- fs/smb/client/smbdirect.c | 130 ++--- fs/smb/client/smbdirect.h | 4 - fs/smb/server/connection.h | 1 + fs/smb/server/smb2pdu.c | 22 +- fs/smb/server/smb_common.c | 2 +- fs/smb/server/transport_rdma.c | 97 ++-- fs/smb/server/transport_tcp.c | 17 + fs/smb/server/vfs.c | 3 +- include/linux/audit.h | 9 +- include/linux/fortify-string.h | 2 +- include/linux/fs_context.h | 2 +- include/linux/if_team.h | 3 - include/linux/ioprio.h | 3 +- include/linux/mlx5/device.h | 1 + include/linux/mm.h | 30 + include/linux/moduleparam.h | 5 +- include/linux/padata.h | 4 - include/linux/pps_kernel.h | 1 + include/linux/proc_fs.h | 1 + include/linux/psi_types.h | 6 +- include/linux/ring_buffer.h | 4 +- include/linux/sched.h | 1 + include/linux/skbuff.h | 23 + include/linux/usb/usbnet.h | 1 + include/linux/vfio.h | 4 + include/linux/vfio_pci_core.h | 2 + include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 6 + include/net/dst.h | 24 +- include/net/lwtunnel.h | 8 +- include/net/tc_act/tc_ctinfo.h | 6 +- include/net/udp.h | 24 +- include/sound/tas2781-tlv.h | 2 +- include/trace/events/power.h | 22 - include/uapi/drm/panthor_drm.h | 3 + include/uapi/linux/vfio.h | 12 +- include/uapi/linux/vhost.h | 29 + init/Kconfig | 2 +- kernel/audit.h | 2 +- kernel/auditsc.c | 2 +- kernel/bpf/core.c | 5 +- kernel/bpf/helpers.c | 11 +- kernel/bpf/preload/Kconfig | 1 - kernel/bpf/verifier.c | 1 + kernel/events/core.c | 38 +- kernel/kcsan/kcsan_test.c | 2 +- kernel/module/main.c | 6 +- kernel/padata.c | 132 ++--- kernel/rcu/refscale.c | 10 +- kernel/rcu/tree_nocb.h | 2 +- kernel/sched/core.c | 2 + kernel/sched/deadline.c | 78 ++- kernel/sched/fair.c | 9 - kernel/sched/psi.c | 123 +++-- kernel/sched/sched.h | 1 + kernel/trace/power-traces.c | 1 - kernel/trace/preemptirq_delay_test.c | 13 +- kernel/trace/ring_buffer.c | 63 +-- kernel/trace/rv/monitors/scpd/Kconfig | 2 +- kernel/trace/rv/monitors/sncid/Kconfig | 2 +- kernel/trace/rv/monitors/snep/Kconfig | 2 +- kernel/trace/rv/monitors/wip/Kconfig | 2 +- kernel/trace/trace.c | 14 +- kernel/trace/trace_events_filter.c | 28 +- kernel/trace/trace_kdb.c | 8 +- kernel/ucount.c | 2 +- lib/tests/fortify_kunit.c | 4 +- mm/hmm.c | 2 +- mm/memory.c | 3 +- mm/shmem.c | 4 +- mm/slub.c | 10 +- mm/swapfile.c | 65 +-- net/bluetooth/coredump.c | 6 +- net/bluetooth/hci_event.c | 8 +- net/caif/cfctrl.c | 294 +++++----- net/core/dst.c | 8 +- net/core/filter.c | 3 + net/core/neighbour.c | 88 ++- net/core/netpoll.c | 7 + net/core/skmsg.c | 7 + net/core/sock.c | 8 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_input.c | 4 +- net/ipv6/ip6_fib.c | 24 +- net/ipv6/ip6_offload.c | 4 +- net/ipv6/ip6mr.c | 3 +- net/ipv6/route.c | 60 +- net/mac80211/cfg.c | 2 +- net/mac80211/main.c | 13 +- net/mac80211/tdls.c | 2 +- net/mac80211/tx.c | 14 +- net/netfilter/nf_bpf_link.c | 5 +- net/netfilter/nf_tables_api.c | 29 +- net/netfilter/xt_nfacct.c | 4 +- net/packet/af_packet.c | 12 +- net/sched/act_ctinfo.c | 19 +- net/sched/sch_mqprio.c | 2 +- net/sched/sch_netem.c | 40 ++ net/sched/sch_taprio.c | 21 +- net/sunrpc/svcsock.c | 43 +- net/sunrpc/xprtsock.c | 40 +- net/tls/tls_sw.c | 13 + net/vmw_vsock/af_vsock.c | 3 +- net/wireless/nl80211.c | 1 + net/wireless/reg.c | 2 + rust/kernel/miscdevice.rs | 8 +- samples/mei/mei-amt-version.c | 2 +- scripts/gdb/linux/constants.py.in | 12 +- scripts/kconfig/qconf.cc | 2 +- security/apparmor/include/match.h | 8 +- security/apparmor/match.c | 23 +- security/apparmor/policy_unpack_test.c | 6 +- security/landlock/id.c | 69 ++- sound/pci/hda/cs35l56_hda.c | 114 +++- sound/pci/hda/patch_ca0132.c | 5 +- sound/pci/hda/patch_realtek.c | 6 + sound/soc/amd/acp/acp-pci.c | 8 +- sound/soc/amd/acp/amd-acpi-mach.c | 4 +- sound/soc/amd/acp/amd.h | 8 +- sound/soc/amd/yc/acp6x-mach.c | 21 + sound/soc/fsl/fsl_xcvr.c | 25 +- sound/soc/intel/boards/Kconfig | 2 +- .../soc/mediatek/common/mtk-afe-platform-driver.c | 4 +- sound/soc/mediatek/common/mtk-base-afe.h | 1 + sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 7 + sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 7 + sound/soc/mediatek/mt8186/mt8186-afe-pcm.c | 7 + sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 7 + sound/soc/sdca/sdca_functions.c | 3 +- sound/soc/sdca/sdca_regmap.c | 16 +- sound/soc/soc-dai.c | 16 +- sound/soc/soc-ops.c | 28 +- sound/soc/sof/intel/Kconfig | 3 +- sound/usb/mixer_scarlett2.c | 14 +- sound/x86/intel_hdmi_audio.c | 2 +- tools/bpf/bpftool/net.c | 15 +- tools/cgroup/memcg_slabinfo.py | 4 +- tools/lib/subcmd/help.c | 12 +- tools/lib/subcmd/run-command.c | 15 +- tools/perf/.gitignore | 2 - tools/perf/builtin-sched.c | 147 +++-- tools/perf/tests/bp_account.c | 1 + tools/perf/util/build-id.c | 2 +- tools/perf/util/evsel.c | 11 + tools/perf/util/evsel.h | 2 + tools/perf/util/hwmon_pmu.c | 2 +- tools/perf/util/parse-events.c | 11 +- tools/perf/util/symbol.c | 1 + .../cpupower/utils/idle_monitor/cpupower-monitor.c | 4 - tools/power/x86/turbostat/turbostat.c | 5 +- tools/testing/selftests/alsa/utimer-test.c | 1 + tools/testing/selftests/arm64/fp/sve-ptrace.c | 2 +- tools/testing/selftests/bpf/bpf_atomic.h | 2 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 2 + tools/testing/selftests/bpf/veristat.c | 1 + .../breakpoints/step_after_suspend_test.c | 41 +- tools/testing/selftests/drivers/net/hw/tso.py | 99 ++-- tools/testing/selftests/drivers/net/lib/py/env.py | 2 +- .../ftrace/test.d/event/subsystem-enable.tc | 28 +- tools/testing/selftests/landlock/audit.h | 7 +- tools/testing/selftests/landlock/audit_test.c | 1 + tools/testing/selftests/net/rtnetlink.sh | 6 + tools/testing/selftests/perf_events/.gitignore | 1 + tools/testing/selftests/perf_events/Makefile | 2 +- tools/testing/selftests/perf_events/mmap.c | 236 ++++++++ .../selftests/syscall_user_dispatch/sud_test.c | 50 +- tools/testing/selftests/vDSO/vdso_test_chacha.c | 3 +- tools/verification/rv/src/in_kernel.c | 4 +- 504 files changed, 4855 insertions(+), 2641 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/480 drm/radeon: Do not hold console lock while suspending clients
6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 5dd0b96118e09a3725e3f83543e133b1fd02c18c ]
The radeon driver holds the console lock while suspending in-kernel DRM clients. This creates a circular dependency with the client-list mutex, which is supposed to be acquired first. Reported when combining radeon with another DRM driver.
Therefore, do not take the console lock in radeon, but let the fbdev DRM client acquire the lock when needed. This is what all other DRM drivers so.
--- drivers/gpu/drm/radeon/radeon_device.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/gpu/drm/radeon/radeon_device.c +3 -5
@@ -1635,11 +1635,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend,pci_set_power_state (pdev, PCI_D3hot); } -if (notify_clients) { -console_lock (); -drm_client_dev_suspend (dev, true); -console_unlock (); - } +if (notify_clients) +drm_client_dev_suspend (dev, false); +return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 2/480 ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lane Odenbach <[email protected]>
[ Upstream commit 7bab1bd9fdf15b9fa7e6a4b0151deab93df3c80d ]
This fixes the internal microphone in the stated device
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -577,6 +577,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_BOARD_NAME, "8A7F"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), + DMI_MATCH(DMI_BOARD_NAME, "8A81"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 3/480 ethernet: intel: fix building with large NR_CPUS
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 24171a5a4a952c26568ff0d2a0bc8c4708a95e1d ]
With large values of CONFIG_NR_CPUS, three Intel ethernet drivers fail to compile like:
In function ‘i40e_free_q_vector’,
inlined from ‘i40e_vsi_alloc_q_vectors’ at drivers/net/ethernet/intel/i40e/i40e_main.c:12112:3:
571 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)include/linux/rcupdate.h:1084:17: note: in expansion of macro ‘BUILD_BUG_ON’
1084 | BUILD_BUG_ON(offsetof(typeof(*(ptr)), rhf) >= 4096); \drivers/net/ethernet/intel/i40e/i40e_main.c:5113:9: note: in expansion of macro ‘kfree_rcu’
5113 | kfree_rcu(q_vector, rcu);
| ^~~~~~~~~The problem is that the 'rcu' member in 'q_vector' is too far from the start of the structure. Move this member before the CPU mask instead, in all three drivers.
--- drivers/net/ethernet/intel/fm10k/fm10k.h | 3 ++- drivers/net/ethernet/intel/i40e/i40e.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/fm10k/fm10k.h +2 -1
@@ -189,13 +189,14 @@ struct fm10k_q_vector {struct fm10k_ring_container rx, tx;struct napi_struct napi; +struct rcu_head rcu;/* to avoid race with update stats on free */ +cpumask_t affinity_mask;char name[IFNAMSIZ +9 ];#ifdef CONFIG_DEBUG_FS struct dentry *dbg_q_vector;#endif /* CONFIG_DEBUG_FS */ -struct rcu_head rcu;/* to avoid race with update stats on free */ /* for dynamic allocation of rings associated with this q_vector */ struct fm10k_ring ring[]____cacheline_internodealigned_in_smp ;
drivers/net/ethernet/intel/i40e/i40e.h +1 -1
@@ -945,6 +945,7 @@ struct i40e_q_vector {u16 reg_idx;/* register index of the interrupt */ struct napi_struct napi; +struct rcu_head rcu;/* to avoid race with update stats on free */ struct i40e_ring_container rx;struct i40e_ring_container tx;
@@ -955,7 +956,6 @@ struct i40e_q_vector {cpumask_t affinity_mask;struct irq_affinity_notify affinity_notify; -struct rcu_head rcu;/* to avoid race with update stats on free */ char name[I40E_INT_NAME_STR_LEN ];bool arm_wb_state;bool in_busy_poll;
drivers/net/ethernet/intel/ixgbe/ixgbe.h +2 -1
@@ -505,9 +505,10 @@ struct ixgbe_q_vector {struct ixgbe_ring_container rx, tx;struct napi_struct napi; +struct rcu_head rcu;/* to avoid race with update stats on free */ +cpumask_t affinity_mask;int numa_node; -struct rcu_head rcu;/* to avoid race with update stats on free */ char name[IFNAMSIZ +9 ];/* for dynamic allocation of rings associated with this q_vector */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/480 ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Queler <[email protected]>
[ Upstream commit 949ddec3728f3a793a13c1c9003028b9b159aefc ]
This model requires an additional detection quirk to enable the internal microphone.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -528,6 +528,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16z-n000"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Victus by HP Gaming Laptop 15-fb1xxx"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/480 ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 40b1c2f9b299295ed0482e1fee6f46521e6e79e5 ]
The Lenovo Yoga Book 9i GenX has the wrong values in the cirrus,dev-index _DSD property. Add a fixup for this model to ignore the property and hardcode the index from the I2C bus address.
The error in the cirrus,dev-index property would prevent the second amp instance from probing. The component binding would never see all the required instances and so there would not be a binding between patch_realtek.c and the cs35l56 driver.
--- sound/pci/hda/cs35l56_hda.c | 110 +++++++++++++++++++++++++++--------- 1 file changed, 82 insertions(+), 28 deletions(-)
sound/pci/hda/cs35l56_hda.c +82 -28
@@ -874,6 +874,52 @@ static int cs35l56_hda_system_resume(struct device *dev)return 0 ; } +static int cs35l56_hda_fixup_yoga9 (struct cs35l56_hda *cs35l56,int *bus_addr) +{ +/* The cirrus,dev-index property has the wrong values */ +switch (*bus_addr) { +case 0x30 : + cs35l56->index =1 ; +return 0 ; +case 0x31 : + cs35l56->index =0 ; +return 0 ; +default : +/* There is a pseudo-address for broadcast to both amps - ignore it */ +dev_dbg (cs35l56->base.dev,"Ignoring I2C address %#x\n" , *bus_addr); +return 0 ; + } +} + +static const struct { +const char *sub; +int (*fixup_fn)(struct cs35l56_hda *cs35l56,int *bus_addr); +} cs35l56_hda_fixups[] = { + { + .sub ="17AA390B" ,/* Lenovo Yoga Book 9i GenX */ + .fixup_fn = cs35l56_hda_fixup_yoga9, + }, +}; + +static int cs35l56_hda_apply_platform_fixups (struct cs35l56_hda *cs35l56,const char *sub, +int *bus_addr) +{ +int i; + +if (IS_ERR (sub)) +return 0 ; + +for (i =0 ; i <ARRAY_SIZE (cs35l56_hda_fixups); i++) { +if (strcasecmp (cs35l56_hda_fixups[i].sub, sub) ==0 ) { +dev_dbg (cs35l56->base.dev,"Applying fixup for %s\n" , + cs35l56_hda_fixups[i].sub); +return (cs35l56_hda_fixups[i].fixup_fn)(cs35l56, bus_addr); + } + } + +return 0 ; +} +static int cs35l56_hda_read_acpi (struct cs35l56_hda *cs35l56,int hid,int id) {u32 values[HDA_MAX_COMPONENTS ];
@@ -898,39 +944,47 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *cs35l56, int hid, int id)ACPI_COMPANION_SET (cs35l56->base.dev, adev); } - property ="cirrus,dev-index" ; - ret =device_property_count_u32 (cs35l56->base.dev, property); -if (ret <=0 ) - goto err; - -if (ret >ARRAY_SIZE (values)) { - ret = -EINVAL ; - goto err; - } - nval = ret; +/* Initialize things that could be overwritten by a fixup */ + cs35l56->index =-1 ; - ret =device_property_read_u32_array (cs35l56->base.dev, property, values, nval); + sub =acpi_get_subsystem_id (ACPI_HANDLE (cs35l56->base.dev)); + ret =cs35l56_hda_apply_platform_fixups (cs35l56, sub, &id);if (ret) - goto err; +return ret; - cs35l56->index =-1 ; -for (i =0 ; i < nval; i++) { -if (values[i] == id) { - cs35l56->index = i; -break ; - } - } -/* -* It's not an error for the ID to be missing: for I2C there can be -* an alias address that is not a real device. So reject silently. -*/ if (cs35l56->index ==-1 ) { -dev_dbg (cs35l56->base.dev,"No index found in %s\n" , property); - ret = -ENODEV ; - goto err; - } + property ="cirrus,dev-index" ; + ret =device_property_count_u32 (cs35l56->base.dev, property); +if (ret <=0 ) + goto err; - sub =acpi_get_subsystem_id (ACPI_HANDLE (cs35l56->base.dev)); +if (ret >ARRAY_SIZE (values)) { + ret = -EINVAL ; + goto err; + } + nval = ret; + + ret =device_property_read_u32_array (cs35l56->base.dev, property, values, nval); +if (ret) + goto err; + +for (i =0 ; i < nval; i++) { +if (values[i] == id) { + cs35l56->index = i; +break ; + } + } + +/* +* It's not an error for the ID to be missing: for I2C there can be +* an alias address that is not a real device. So reject silently. +*/ +if (cs35l56->index ==-1 ) { +dev_dbg (cs35l56->base.dev,"No index found in %s\n" , property); + ret = -ENODEV ; + goto err; + } + }if (IS_ERR (sub)) { dev_info(cs35l56->base.dev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/480 ALSA: hda/realtek: Support mute LED for Yoga with ALC287
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jackie Dong <[email protected]>
[ Upstream commit 4722727373533b53489b66d3436b50ac156f23bf ]
Support mute LED on keyboard for Lenovo Yoga series products with Realtek ALC287 chipset.
Tested on Lenovo Slim Pro 7 14APH8.
[ slight comment cleanup by tiwai ]
--- sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/patch_realtek.c +3 -0
@@ -7497,6 +7497,9 @@ static void alc287_fixup_yoga9_14iap7_bass_spk_pin(struct hda_codec *codec, };struct alc_spec *spec = codec->spec; +/* Support Audio mute LED and Mic mute LED on keyboard */ +hda_fixup_ideapad_acpi (codec, fix, action); +switch (action) {case HDA_FIXUP_ACT_PRE_PROBE :snd_hda_apply_pincfgs (codec, pincfgs);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/480 ASoC: Intel: fix SND_SOC_SOF dependencies
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit e837b59f8b411b5baf5e3de7a5aea10b1c545a63 ]
It is currently possible to configure a kernel with all Intel SoC configs as loadable modules, but the board config as built-in. This causes a link failure in the reference to the snd_soc_sof.ko module:
x86_64-linux-ld: sound/soc/intel/boards/sof_rt5682.o: in function `sof_rt5682_hw_params':
sof_rt5682.c:(.text+0x1f9): undefined reference to `sof_dai_get_mclk'
x86_64-linux-ld: sof_rt5682.c:(.text+0x234): undefined reference to `sof_dai_get_bclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_rt5682.o: in function `sof_rt5682_codec_init':
sof_rt5682.c:(.text+0x3e0): undefined reference to `sof_dai_get_mclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_cs42l42.o: in function `sof_cs42l42_hw_params':
sof_cs42l42.c:(.text+0x2a): undefined reference to `sof_dai_get_bclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_nau8825.o: in function `sof_nau8825_hw_params':
sof_nau8825.c:(.text+0x7f): undefined reference to `sof_dai_get_bclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_da7219.o: in function `da7219_codec_init':
sof_da7219.c:(.text+0xbf): undefined reference to `sof_dai_get_mclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_maxim_common.o: in function `max_98373_hw_params':
sof_maxim_common.c:(.text+0x6f9): undefined reference to `sof_dai_get_tdm_slots'
x86_64-linux-ld: sound/soc/intel/boards/sof_realtek_common.o: in function `rt1015_hw_params':
sof_realtek_common.c:(.text+0x54c): undefined reference to `sof_dai_get_bclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_realtek_common.o: in function `rt1308_hw_params':
sof_realtek_common.c:(.text+0x702): undefined reference to `sof_dai_get_mclk'
x86_64-linux-ld: sound/soc/intel/boards/sof_cirrus_common.o: in function `cs35l41_hw_params':
sof_cirrus_common.c:(.text+0x2f): undefined reference to `sof_dai_get_bclk'
Add an optional dependency on SND_SOC_SOF_INTEL_COMMON, to ensure that whenever the SOF support is in a loadable module, none of the board code can be built-in.
This may be be a little heavy-handed, but I also don't see a reason why one would want the boards to be built-in but not the SoC, so it shouldn't actually cause any usability problems.
--- sound/soc/intel/boards/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/boards/Kconfig +1 -1
@@ -11,7 +11,7 @@ menuconfig SND_SOC_INTEL_MACH kernel: saying N will just cause the configurator to skip all the questions about Intel ASoC machine drivers. -if SND_SOC_INTEL_MACH +if SND_SOC_INTEL_MACH && (SND_SOC_SOF_INTEL_COMMON || !SND_SOC_SOF_INTEL_COMMON) config SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES bool "Use more user friendly long card names"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/480 ASoC: amd: yc: add DMI quirk for ASUS M6501RM
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Andries <[email protected]>
[ Upstream commit 6f80be548588429100eb1f5e25dc2a714d583ffe ]
add DMI entry for ASUS Vivobook PRO 15X (M6501RM)
to make the internal microphone function
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -409,6 +409,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "M6501RM"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/480 audit,module: restore audit logging in load failure case
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Guy Briggs <[email protected]>
[ Upstream commit ae1ae11fb277f1335d6bcd4935ba0ea985af3c32 ]
The move of the module sanity check to earlier skipped the audit logging call in the case of failure and to a place where the previously used context is unavailable.
Add an audit logging call for the module loading failure case and get the module name when possible.
--- include/linux/audit.h | 9 ++++----- kernel/audit.h | 2 +- kernel/auditsc.c | 2 +- kernel/module/main.c | 6 ++++-- 4 files changed, 10 insertions(+), 9 deletions(-)
include/linux/audit.h +4 -5
@@ -417,7 +417,7 @@ extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,extern void __audit_log_capset (const struct cred *new,const struct cred *old);extern void __audit_mmap_fd (int fd,int flags);extern void __audit_openat2_how (struct open_how *how); -extern void __audit_log_kern_module (char *name); +extern void __audit_log_kern_module (const char *name);extern void __audit_fanotify (u32 response,struct fanotify_response_info_audit_rule *friar);extern void __audit_tk_injoffset (struct timespec64 offset);extern void __audit_ntp_log (const struct audit_ntp_data *ad);
@@ -519,7 +519,7 @@ static inline void audit_openat2_how(struct open_how *how)__audit_openat2_how (how); } -static inline void audit_log_kern_module (char *name) +static inline void audit_log_kern_module (const char *name) {if (!audit_dummy_context ())__audit_log_kern_module (name);
@@ -677,9 +677,8 @@ static inline void audit_mmap_fd(int fd, int flags)static inline void audit_openat2_how (struct open_how *how) { } -static inline void audit_log_kern_module (char *name) -{ -} +static inline void audit_log_kern_module (const char *name) +{ }static inline void audit_fanotify (u32 response,struct fanotify_response_info_audit_rule *friar) { }
kernel/audit.h +1 -1
@@ -200,7 +200,7 @@ struct audit_context {int argc; } execve;struct { -char *name; +const char *name; } module;struct {struct audit_ntp_data ntp_data;
kernel/auditsc.c +1 -1
@@ -2864,7 +2864,7 @@ void __audit_openat2_how(struct open_how *how) context->type =AUDIT_OPENAT2 ; } -void __audit_log_kern_module (char *name) +void __audit_log_kern_module (const char *name) {struct audit_context *context =audit_context ();
kernel/module/main.c +4 -2
@@ -3298,7 +3298,7 @@ static int load_module(struct load_info *info, const char __user *uargs, module_allocated = true; -audit_log_kern_module (mod->name); +audit_log_kern_module (info->name);/* Reserve our place in the list. */ err =add_unformed_module (mod);
@@ -3460,8 +3460,10 @@ static int load_module(struct load_info *info, const char __user *uargs,* failures once the proper module was allocated and * before that. */ -if (!module_allocated) +if (!module_allocated) { +audit_log_kern_module (info->name ? info->name :"?" );mod_stat_bump_becoming (info, flags); + }free_copy (info, flags);return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/480 parse_longname(): strrchr() expects NUL-terminated string
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 101841c38346f4ca41dc1802c867da990ffb32eb ]
... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it.
Just get a NUL-terminated copy of the entire thing and be done with that...
--- fs/ceph/crypto.c | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-)
fs/ceph/crypto.c +12 -19
@@ -215,35 +215,31 @@ static struct inode *parse_longname(const struct inode *parent,struct ceph_client *cl =ceph_inode_to_client (parent);struct inode *dir =NULL ;struct ceph_vino vino = { .snap =CEPH_NOSNAP }; -char *inode_number; -char *name_end; -int orig_len = *name_len; +char *name_end, *inode_number;int ret = -EIO ; - +/* NUL-terminate */ + char *str __free(kfree) = kmemdup_nul(name, *name_len, GFP_KERNEL); +if (!str) +return ERR_PTR (-ENOMEM );/* Skip initial '_' */ - name++; - name_end =strrchr (name,'_' ); + str++; + name_end =strrchr (str,'_' );if (!name_end) { -doutc (cl,"failed to parse long snapshot name: %s\n" , name); +doutc (cl,"failed to parse long snapshot name: %s\n" , str);return ERR_PTR (-EIO ); } - *name_len = (name_end - name); + *name_len = (name_end - str);if (*name_len <=0 ) {pr_err_client (cl,"failed to parse long snapshot name\n" );return ERR_PTR (-EIO ); }/* Get the inode number */ - inode_number =kmemdup_nul (name_end +1 , - orig_len - *name_len -2 , -GFP_KERNEL ); -if (!inode_number) -return ERR_PTR (-ENOMEM ); + inode_number = name_end +1 ; ret =kstrtou64 (inode_number,10 , &vino.ino);if (ret) { -doutc (cl,"failed to parse inode number: %s\n" , name); - dir =ERR_PTR (ret); - goto out; +doutc (cl,"failed to parse inode number: %s\n" , str); +return ERR_PTR (ret); }/* And finally the inode */
@@ -254,9 +250,6 @@ static struct inode *parse_longname(const struct inode *parent,if (IS_ERR (dir))doutc (cl,"can't find inode %s (%s)\n" , inode_number, name); } - -out: -kfree (inode_number);return dir; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/480 fs_context: fix parameter name in infofc() macro
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: RubenKelevra <[email protected]>
[ Upstream commit ffaf1bf3737f706e4e9be876de4bc3c8fc578091 ]
The macro takes a parameter called "p" but references "fc" internally. This happens to compile as long as callers pass a variable named fc, but breaks otherwise. Rename the first parameter to “fc” to match the usage and to be consistent with warnfc() / errorfc().
--- include/linux/fs_context.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/fs_context.h +1 -1
@@ -200,7 +200,7 @@ void logfc(struct fc_log *log, const char *prefix, char level, const char *fmt,*/ #define infof (fc, fmt, ...) __logfc(fc, 'i', fmt, ## __VA_ARGS__)#define info_plog (p, fmt, ...) __plog(p, 'i', fmt, ## __VA_ARGS__) -#define infofc (p, fmt, ...) __plog((&(fc)->log), 'i', fmt, ## __VA_ARGS__) +#define infofc (fc, fmt, ...) __plog((&(fc)->log), 'i', fmt, ## __VA_ARGS__)/** * warnf - Store supplementary warning message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/480 selftests/landlock: Fix readlink check
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <[email protected]>
[ Upstream commit 94a7ce26428d3a7ceb46c503ed726160578b9fcc ]
The audit_init_filter_exe() helper incorrectly checks the readlink(2) error because an unsigned integer is used to store the result. Use a signed integer for this check.
--- tools/testing/selftests/landlock/audit.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
tools/testing/selftests/landlock/audit.h +4 -3
@@ -403,11 +403,12 @@ static int audit_init_filter_exe(struct audit_filter *filter, const char *path)/* It is assume that there is not already filtering rules. */ filter->record_type =AUDIT_EXE ;if (!path) { - filter->exe_len =readlink ("/proc/self/exe" , filter->exe, -sizeof (filter->exe) -1 ); -if (filter->exe_len <0 ) +int ret =readlink ("/proc/self/exe" , filter->exe, +sizeof (filter->exe) -1 ); +if (ret <0 )return -errno; + filter->exe_len = ret;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/480 selftests/landlock: Fix build of audit_test
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Liu <[email protected]>
[ Upstream commit dc58130bc38f09b162aa3b216f8b8f1e0a56127b ]
We are hitting build error on CentOS 9:
audit_test.c:232:40: error: ‘O_CLOEXEC’ undeclared (...)
Fix this by including fcntl.h.
--- tools/testing/selftests/landlock/audit_test.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/landlock/audit_test.c +1 -0
@@ -7,6 +7,7 @@#define _GNU_SOURCE#include <errno.h> +#include <fcntl.h> #include <limits.h> #include <linux/landlock.h> #include <pthread.h>
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/480 fs/ntfs3: cancle set bad inode after removing name fails
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d99208b91933fd2a58ed9ed321af07dacd06ddc3 ]
The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted.
The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier".
In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles".
--- fs/ntfs3/frecord.c | 7 +++---- fs/ntfs3/namei.c | 10 +++------- fs/ntfs3/ntfs_fs.h | 3 +-- 3 files changed, 7 insertions(+), 13 deletions(-)
fs/ntfs3/frecord.c +3 -4
@@ -3003,8 +3003,7 @@ int ni_add_name(struct ntfs_inode *dir_ni, struct ntfs_inode *ni,* ni_rename - Remove one name and insert new name. */ int ni_rename (struct ntfs_inode *dir_ni,struct ntfs_inode *new_dir_ni, -struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de, -bool *is_bad) +struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de) {int err;struct NTFS_DE *de2 =NULL ;
@@ -3027,8 +3026,8 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni, err =ni_add_name (new_dir_ni, ni, new_de);if (!err) { err =ni_remove_name (dir_ni, ni, de, &de2, &undo); -if (err &&ni_remove_name (new_dir_ni, ni, new_de, &de2, &undo)) - *is_bad = true; +WARN_ON (err &&ni_remove_name (new_dir_ni, ni, new_de, &de2, + &undo)); }/*
fs/ntfs3/namei.c +3 -7
@@ -244,7 +244,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,struct ntfs_inode *ni =ntfs_i (inode);struct inode *new_inode =d_inode (new_dentry);struct NTFS_DE *de, *new_de; -bool is_same, is_bad; +bool is_same;/* * de - memory of PATH_MAX bytes: * [0-1024) - original name (dentry->d_name)
@@ -313,12 +313,8 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,if (dir_ni != new_dir_ni)ni_lock_dir2 (new_dir_ni); - is_bad = false; - err =ni_rename (dir_ni, new_dir_ni, ni, de, new_de, &is_bad); -if (is_bad) { -/* Restore after failed rename failed too. */ -_ntfs_bad_inode (inode); - }else if (!err) { + err =ni_rename (dir_ni, new_dir_ni, ni, de, new_de); +if (!err) {simple_rename_timestamp (dir, dentry, new_dir, new_dentry);mark_inode_dirty (inode);mark_inode_dirty (dir);
fs/ntfs3/ntfs_fs.h +1 -2
@@ -581,8 +581,7 @@ int ni_add_name(struct ntfs_inode *dir_ni, struct ntfs_inode *ni, struct NTFS_DE *de);int ni_rename (struct ntfs_inode *dir_ni,struct ntfs_inode *new_dir_ni, -struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de, -bool *is_bad); +struct ntfs_inode *ni,struct NTFS_DE *de,struct NTFS_DE *new_de);bool ni_is_dirty (struct inode *inode);int ni_set_compress (struct inode *inode,bool compr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/480 landlock: Fix warning from KUnit tests
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tingmao Wang <[email protected]>
[ Upstream commit e0a69cf2c03e61bd8069becb97f66c173d0d1fa1 ]
get_id_range() expects a positive value as first argument but get_random_u8() can return 0. Fix this by clamping it.
Validated by running the test in a for loop for 1000 times.
Note that MAX() is wrong as it is only supposed to be used for constants, but max() is good here.
[..] ok 9 test_range2_rand1 [..] ok 10 test_range2_rand2 [..] ok 11 test_range2_rand15
[..] ------------[ cut here ]------------
[..] WARNING: CPU: 6 PID: 104 at security/landlock/id.c:99 test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1)) [..] Modules linked in:
[..] CPU: 6 UID: 0 PID: 104 Comm: kunit_try_catch Tainted: G N 6.16.0-rc1-dev-00001-g314a2f98b65f #1 PREEMPT(undef)
[..] Tainted: [N]=TEST
[..] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[..] RIP: 0010:test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1))
[..] Code: 49 c7 c0 10 70 30 82 4c 89 ff 48 c7 c6 a0 63 1e 83 49 c7 45 a0 e0 63 1e 83 e8 3f 95 17 00 e9 1f ff ff ff 0f 0b e9 df fd ff ff <0f> 0b ba 01 00 00 00 e9 68 fe ff ff 49 89 45 a8 49 8d 4d a0 45 31
[..] RSP: 0000:ffff888104eb7c78 EFLAGS: 00010246
[..] RAX: 0000000000000000 RBX: 000000000870822c RCX: 0000000000000000
^^^^^^^^^^^^^^^^
[..]
[..] Call Trace:
[..]
[..] ---[ end trace 0000000000000000 ]---
[..] ok 12 test_range2_rand16
[..] # landlock_id: pass:12 fail:0 skip:0 total:12 [..] # Totals: pass:12 fail:0 skip:0 total:12 [..] ok 1 landlock_id
--- security/landlock/id.c | 69 +++++++++++++++++++++++++----------------- 1 file changed, 42 insertions(+), 27 deletions(-)
security/landlock/id.c +42 -27
@@ -119,6 +119,12 @@ static u64 get_id_range(size_t number_of_ids, atomic64_t *const counter,#ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST +static u8 get_random_u8_positive (void ) +{ +/* max() evaluates its arguments once. */ +return max (1 ,get_random_u8 ()); +} +static void test_range1_rand0 (struct kunit *const test) {atomic64_t counter;
@@ -127,9 +133,10 @@ static void test_range1_rand0(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (1 , &counter,0 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +1 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +1 ); }static void test_range1_rand1 (struct kunit *const test)
@@ -140,9 +147,10 @@ static void test_range1_rand1(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (1 , &counter,1 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +2 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +2 ); }static void test_range1_rand15 (struct kunit *const test)
@@ -153,9 +161,10 @@ static void test_range1_rand15(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (1 , &counter,15 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +16 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +16 ); }static void test_range1_rand16 (struct kunit *const test)
@@ -166,9 +175,10 @@ static void test_range1_rand16(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (1 , &counter,16 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +1 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +1 ); }static void test_range2_rand0 (struct kunit *const test)
@@ -179,9 +189,10 @@ static void test_range2_rand0(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,0 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +2 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +2 ); }static void test_range2_rand1 (struct kunit *const test)
@@ -192,9 +203,10 @@ static void test_range2_rand1(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,1 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +3 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +3 ); }static void test_range2_rand2 (struct kunit *const test)
@@ -205,9 +217,10 @@ static void test_range2_rand2(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,2 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +4 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +4 ); }static void test_range2_rand15 (struct kunit *const test)
@@ -218,9 +231,10 @@ static void test_range2_rand15(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,15 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init +17 ); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init +17 ); }static void test_range2_rand16 (struct kunit *const test)
@@ -231,9 +245,10 @@ static void test_range2_rand16(struct kunit *const test) init =get_random_u32 ();atomic64_set (&counter, init);KUNIT_EXPECT_EQ (test,get_id_range (2 , &counter,16 ), init); -KUNIT_EXPECT_EQ ( - test,get_id_range (get_random_u8 (), &counter,get_random_u8 ()), - init + 2); +KUNIT_EXPECT_EQ (test, +get_id_range (get_random_u8_positive (), &counter, +get_random_u8 ()), + init + 2); }#endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/480 ublk: use vmalloc for ublk_devices __queues
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Caleb Sander Mateos <[email protected]>
[ Upstream commit c2f48453b7806d41f5a3270f206a5cd5640ed207 ]
struct ublk_device's __queues points to an allocation with up to UBLK_MAX_NR_QUEUES (4096) queues, each of which have:
- struct ublk_queue (48 bytes)
- Tail array of up to UBLK_MAX_QUEUE_DEPTH (4096) struct ublk_io's, 32 bytes each
This means the full allocation can exceed 512 MB, which may well be impossible to service with contiguous physical pages. Switch to kvcalloc() and kvfree(), since there is no need for physically contiguous memory.
--- drivers/block/ublk_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/block/ublk_drv.c +2 -2
@@ -2373,7 +2373,7 @@ static void ublk_deinit_queues(struct ublk_device *ub)for (i =0 ; i < nr_queues; i++)ublk_deinit_queue (ub, i); -kfree (ub->__queues); +kvfree (ub->__queues); }static int ublk_init_queues (struct ublk_device *ub)
@@ -2384,7 +2384,7 @@ static int ublk_init_queues(struct ublk_device *ub)int i, ret = -ENOMEM ; ub->queue_size = ubq_size; - ub->__queues =kcalloc (nr_queues, ubq_size,GFP_KERNEL ); + ub->__queues =kvcalloc (nr_queues, ubq_size,GFP_KERNEL );if (!ub->__queues)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/480 hfsplus: make splice write available again
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 2eafb669da0bf71fac0838bff13594970674e2b4 ]
Since 5.10, splice() or sendfile() return EINVAL. This was caused by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops").
This patch initializes the splice_write field in file_operations, like most file systems do, to restore the functionality.
--- fs/hfsplus/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfsplus/inode.c +1 -0
@@ -368,6 +368,7 @@ static const struct file_operations hfsplus_file_operations = { .write_iter = generic_file_write_iter, .mmap = generic_file_mmap, .splice_read = filemap_splice_read, + .splice_write = iter_file_splice_write, .fsync = hfsplus_file_fsync, .open = hfsplus_file_open, .release = hfsplus_file_release,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/480 hfs: make splice write available again
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 4c831f30475a222046ded25560c3810117a6cff6 ]
Since 5.10, splice() or sendfile() return EINVAL. This was caused by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops").
This patch initializes the splice_write field in file_operations, like most file systems do, to restore the functionality.
--- fs/hfs/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfs/inode.c +1 -0
@@ -692,6 +692,7 @@ static const struct file_operations hfs_file_operations = { .write_iter = generic_file_write_iter, .mmap = generic_file_mmap, .splice_read = filemap_splice_read, + .splice_write = iter_file_splice_write, .fsync = hfs_file_fsync, .open = hfs_file_open, .release = hfs_file_release,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/480 hfsplus: remove mutex_lock check in hfsplus_free_extents
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit fcb96956c921f1aae7e7b477f2435c56f77a31b4 ]
Syzbot reported an issue in hfsplus filesystem:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346 hfsplus_free_extents+0x700/0xad0 Call Trace: <TASK> hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606 hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56 cont_expand_zero fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347 hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263 notify_change+0xe38/0x10f0 fs/attr.c:420 do_truncate+0x1fb/0x2e0 fs/open.c:65 do_sys_ftruncate+0x2eb/0x380 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") unlock extree before hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_free_extents().
However, when operations such as hfsplus_file_release, hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed concurrently in different files, it is very likely to trigger the WARN_ON, which will lead syzbot and xfstest to consider it as an abnormality.
The comment above this warning also describes one of the easy triggering situations, which can easily trigger and cause xfstest&syzbot to report errors.
[task A] [task B]
->hfsplus_file_release
->hfsplus_file_truncate
->hfs_find_init
->mutex_lock
->mutex_unlock
->hfsplus_write_begin
->hfsplus_get_block
->hfsplus_file_extend
->hfsplus_ext_read_extent
->hfs_find_init
->mutex_lock
->hfsplus_free_extents
WARN_ON(mutex_is_locked) !!!Several threads could try to lock the shared extents tree. And warning can be triggered in one thread when another thread has locked the tree. This is the wrong behavior of the code and we need to remove the warning.
--- fs/hfsplus/extents.c | 3 --- 1 file changed, 3 deletions(-)
fs/hfsplus/extents.c +0 -3
@@ -342,9 +342,6 @@ static int hfsplus_free_extents(struct super_block *sb,int i;int err =0 ; -/* Mapping the allocation file may lock the extent tree */ -WARN_ON (mutex_is_locked (&HFSPLUS_SB (sb)->ext_tree->tree_lock)); -hfsplus_dump_extent (extent);for (i =0 ; i <8 ; extent++, i++) { count =be32_to_cpu (extent->block_count);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/480 Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit a49f0abd8959048af18c6c690b065eb0d65b2d21 ]
This reverts commit 69505fe98f198ee813898cbcaf6770949636430b.
Initially, conditional lock acquisition was removed to fix an xfstest bug that was observed during internal testing. The deadlock reported by syzbot is resolved by reintroducing conditional acquisition. The xfstest bug no longer occurs on kernel version 6.16-rc1 during internal testing. I assume that changes in other modules may have contributed to this.
--- fs/ntfs3/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ntfs3/file.c +4 -1
@@ -394,7 +394,10 @@ static int ntfs_file_mmap(struct file *file, struct vm_area_struct *vma) }if (ni->i_valid < to) { -inode_lock (inode); +if (!inode_trylock (inode)) { + err = -EAGAIN ; + goto out; + } err =ntfs_extend_initialized_size (file, ni, ni->i_valid, to);inode_unlock (inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/480 block: mtip32xx: Fix usage of dma_map_sg()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit 8e1fab9cccc7b806b0cffdceabb09b310b83b553 ]
The dma_map_sg() can fail and, in case of failure, returns 0. If it fails, mtip_hw_submit_io() returns an error.
The dma_unmap_sg() requires the nents parameter to be the same as the one passed to dma_map_sg(). This patch saves the nents in command->scatter_ents.
--- drivers/block/mtip32xx/mtip32xx.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +17 -10
@@ -2040,11 +2040,12 @@ static int mtip_hw_ioctl(struct driver_data *dd, unsigned int cmd,* @dir Direction (read or write) * * return value -* None +* 0 The IO completed successfully. +* -ENOMEM The DMA mapping failed. */ -static void mtip_hw_submit_io (struct driver_data *dd,struct request *rq, -struct mtip_cmd *command, -struct blk_mq_hw_ctx *hctx) +static int mtip_hw_submit_io (struct driver_data *dd,struct request *rq, +struct mtip_cmd *command, +struct blk_mq_hw_ctx *hctx) {struct mtip_cmd_hdr *hdr = dd->port->command_list +sizeof (struct mtip_cmd_hdr ) * rq->tag;
@@ -2056,12 +2057,14 @@ static void mtip_hw_submit_io(struct driver_data *dd, struct request *rq,unsigned int nents;/* Map the scatter list for DMA access */ - nents =blk_rq_map_sg (rq, command->sg); - nents =dma_map_sg (&dd->pdev->dev, command->sg, nents, dma_dir); + command->scatter_ents =blk_rq_map_sg (rq, command->sg); + nents =dma_map_sg (&dd->pdev->dev, command->sg, + command->scatter_ents, dma_dir); +if (!nents) +return -ENOMEM ; -prefetch (&port->flags); - command->scatter_ents = nents; +prefetch (&port->flags);/* * The number of retries for this command before it is
@@ -2112,11 +2115,13 @@ static void mtip_hw_submit_io(struct driver_data *dd, struct request *rq,if (unlikely (port->flags &MTIP_PF_PAUSE_IO )) {set_bit (rq->tag, port->cmds_to_issue);set_bit (MTIP_PF_ISSUE_CMDS_BIT , &port->flags); -return ; +return 0 ; }/* Issue the command to the hardware */ mtip_issue_ncq_command (port, rq->tag); + +return 0 ; }/*
@@ -3315,7 +3320,9 @@ static blk_status_t mtip_queue_rq(struct blk_mq_hw_ctx *hctx,blk_mq_start_request (rq); -mtip_hw_submit_io (dd, rq, cmd, hctx); +if (mtip_hw_submit_io (dd, rq, cmd, hctx)) +return BLK_STS_IOERR ; +return BLK_STS_OK ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/480 gfs2: Minor do_xmote cancelation fix
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 75bb2ddea9640b663e4b2eaa06e15196f6f11a95 ]
Commit 6cb3b1c2df87 changed how finish_xmote() clears the GLF_LOCK flag, but it failed to adjust the equivalent code in do_xmote(). Fix that.
--- fs/gfs2/glock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/gfs2/glock.c +2 -1
@@ -802,7 +802,8 @@ __acquires(&gl->gl_lockref.lock)* We skip telling dlm to do the locking, so we won't get a * reply that would otherwise clear GLF_LOCK. So we clear it here. */ -clear_bit (GLF_LOCK , &gl->gl_flags); +if (!test_bit (GLF_CANCELING , &gl->gl_flags)) +clear_bit (GLF_LOCK , &gl->gl_flags);clear_bit (GLF_DEMOTE_IN_PROGRESS , &gl->gl_flags);gfs2_glock_queue_work (gl,GL_GLOCK_DFT_HOLD );return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/480 md: allow removing faulty rdev during resync
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit c0ffeb648000acdc932da7a9d33fd65e9263c54c ]
During RAID resync, faulty rdev cannot be removed and will result in "Device or resource busy" error when attempting hot removal.
Reproduction steps:
mdadm -Cv /dev/md0 -l1 -n3 -e1.2 /dev/sd{b..d}
mdadm /dev/md0 -f /dev/sdb
mdadm /dev/md0 -r /dev/sdb
-> mdadm: hot remove failed for /dev/sdb: Device or resource busy
After commit 4b10a3bc67c1 ("md: ensure resync is prioritized over recovery"), when a device becomes faulty during resync, the md_choose_sync_action() function returns early without calling remove_and_add_spares(), preventing faulty device removal.
This patch extracts a helper function remove_spares() to support removing faulty devices during RAID resync operations.
--- drivers/md/md.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/md/md.c +17 -7
@@ -9380,17 +9380,11 @@ static bool md_spares_need_change(struct mddev *mddev)return false; } -static int remove_and_add_spares (struct mddev *mddev, -struct md_rdev *this) +static int remove_spares (struct mddev *mddev,struct md_rdev *this) {struct md_rdev *rdev; -int spares =0 ;int removed =0 ; -if (this &&test_bit (MD_RECOVERY_RUNNING , &mddev->recovery)) -/* Mustn't remove devices when resync thread is running */ -return 0 ; -rdev_for_each (rdev, mddev) {if ((this ==NULL || rdev == this) &&rdev_removeable (rdev) && !mddev->pers->hot_remove_disk (mddev, rdev)) {
@@ -9404,6 +9398,21 @@ static int remove_and_add_spares(struct mddev *mddev,if (removed && mddev->kobj.sd)sysfs_notify_dirent_safe (mddev->sysfs_degraded); +return removed; +} + +static int remove_and_add_spares (struct mddev *mddev, +struct md_rdev *this) +{ +struct md_rdev *rdev; +int spares =0 ; +int removed =0 ; + +if (this &&test_bit (MD_RECOVERY_RUNNING , &mddev->recovery)) +/* Mustn't remove devices when resync thread is running */ +return 0 ; + + removed =remove_spares (mddev, this);if (this && removed) goto no_add;
@@ -9446,6 +9455,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)/* Check if resync is in progress. */ if (mddev->recovery_cp < MaxSector) { +remove_spares (mddev,NULL );set_bit (MD_RECOVERY_SYNC , &mddev->recovery);clear_bit (MD_RECOVERY_RECOVER , &mddev->recovery);return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/480 kunit/fortify: Add back "volatile" for sizeof() constants
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 10299c07c94aa0997fa43523b53301e713a6415d ]
It seems the Clang can see through OPTIMIZER_HIDE_VAR when the constant is coming from sizeof. Adding "volatile" back to these variables solves this false positive without reintroducing the issues that originally led to switching to OPTIMIZER_HIDE_VAR in the first place[1].
--- lib/tests/fortify_kunit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/tests/fortify_kunit.c +2 -2
@@ -1003,8 +1003,8 @@ static void fortify_test_memcmp(struct kunit *test) {char one[] ="My mind is going ..." ;char two[] ="My mind is going ... I can feel it." ; -size_t one_len =sizeof (one) -1 ; -size_t two_len =sizeof (two) -1 ; +volatile size_t one_len =sizeof (one) -1 ; +volatile size_t two_len =sizeof (two) -1 ;OPTIMIZER_HIDE_VAR (one_len);OPTIMIZER_HIDE_VAR (two_len);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/480 gfs2: No more self recovery
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit deb016c1669002e48c431d6fd32ea1c20ef41756 ]
When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. Not only is that a very bad idea, it has also never worked because gfs2_recover_func() will refuse to do anything during a withdraw.
However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before commit 04133b607a78 ("gfs2: Prevent double iput for journal on error") and is a NULL pointer dereference since then.
Simply get rid of self recovery to fix that.
--- fs/gfs2/util.c | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-)
fs/gfs2/util.c +11 -20
@@ -232,32 +232,23 @@ static void signal_our_withdraw(struct gfs2_sbd *sdp)*/ ret =gfs2_glock_nq (&sdp->sd_live_gh); +gfs2_glock_put (live_gl);/* drop extra reference we acquired */ +clear_bit (SDF_WITHDRAW_RECOVERY , &sdp->sd_flags); +/* * If we actually got the "live" lock in EX mode, there are no other -* nodes available to replay our journal. So we try to replay it -* ourselves. We hold the "live" glock to prevent other mounters -* during recovery, then just dequeue it and reacquire it in our -* normal SH mode. Just in case the problem that caused us to -* withdraw prevents us from recovering our journal (e.g. io errors -* and such) we still check if the journal is clean before proceeding -* but we may wait forever until another mounter does the recovery. +* nodes available to replay our journal. */ if (ret ==0 ) { -fs_warn (sdp,"No other mounters found. Trying to recover our " -"own journal jid %d.\n" , sdp->sd_lockstruct.ls_jid); -if (gfs2_recover_journal (sdp->sd_jdesc,1 )) -fs_warn (sdp,"Unable to recover our journal jid %d.\n" , - sdp->sd_lockstruct.ls_jid); -gfs2_glock_dq_wait (&sdp->sd_live_gh); -gfs2_holder_reinit (LM_ST_SHARED , -LM_FLAG_NOEXP |GL_EXACT |GL_NOPID , - &sdp->sd_live_gh); -gfs2_glock_nq (&sdp->sd_live_gh); +fs_warn (sdp,"No other mounters found.\n" ); +/* +* We are about to release the lockspace. By keeping live_gl +* locked here, we ensure that the next mounter coming along +* will be a "first" mounter which will perform recovery. +*/ + goto skip_recovery; } -gfs2_glock_put (live_gl);/* drop extra reference we acquired */ -clear_bit (SDF_WITHDRAW_RECOVERY , &sdp->sd_flags); -/* * At this point our journal is evicted, so we need to get a new inode * for it. Once done, we need to call gfs2_find_jhead which
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/480 block: sanitize chunk_sectors for atomic write limits
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 1de67e8e28fc47d71ee06ffa0185da549b378ffb ]
Currently we just ensure that a non-zero value in chunk_sectors aligns with any atomic write boundary, as the blk boundary functionality uses both these values.
However it is also improper to have atomic write unit max > chunk_sectors (for non-zero chunk_sectors), as this would lead to splitting of atomic write bios (which is disallowed).
Sanitize atomic write unit max against chunk_sectors to avoid any potential problems.
--- block/blk-settings.c | 6 ++++++ 1 file changed, 6 insertions(+)
block/blk-settings.c +6 -0
@@ -186,6 +186,8 @@ static void blk_atomic_writes_update_limits(struct queue_limits *lim)static void blk_validate_atomic_write_limits (struct queue_limits *lim) {unsigned int boundary_sectors; +unsigned int atomic_write_hw_max_sectors = + lim->atomic_write_hw_max >>SECTOR_SHIFT ;if (!(lim->features &BLK_FEAT_ATOMIC_WRITES )) goto unsupported;
@@ -207,6 +209,10 @@ static void blk_validate_atomic_write_limits(struct queue_limits *lim) lim->atomic_write_hw_max)) goto unsupported; +if (WARN_ON_ONCE (lim->chunk_sectors && + atomic_write_hw_max_sectors > lim->chunk_sectors)) + goto unsupported; + boundary_sectors = lim->atomic_write_hw_boundary >>SECTOR_SHIFT ;if (boundary_sectors) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/480 io_uring: fix breakage in EXPERT menu
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit d1fbe1ebf4a12cabd7945335d5e47718cb2bef99 ]
Add a dependency for IO_URING for the GCOV_PROFILE_URING symbol.
Without this patch the EXPERT config menu ends with "Enable IO uring support" and the menu prompts for GCOV_PROFILE_URING and IO_URING_MOCK_FILE are not subordinate to it. This causes all of the EXPERT Kconfig options that follow GCOV_PROFILE_URING to be display in the "upper" menu (General setup), just following the EXPERT menu.
--- init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
init/Kconfig +1 -1
@@ -1761,7 +1761,7 @@ config IO_URING config GCOV_PROFILE_URING bool "Enable GCOV profiling on the io_uring subsystem" - depends on GCOV_KERNEL + depends on IO_URING && GCOV_KERNEL help Enable GCOV profiling on the io_uring subsystem, to facilitate code coverage testing.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/480 btrfs: remove partial support for lowest level from btrfs_search_forward()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sun YangKai <[email protected]>
[ Upstream commit 27260dd1904bb409cf84709928ba9bc5506fbe8e ]
Commit 323ac95bce44 ("Btrfs: don't read leaf blocks containing only checksums during truncate") changed the condition from level == 0 to level == path->lowest_level, while its original purpose was just to do some leaf node handling (calling btrfs_item_key_to_cpu()) and skip some code that doesn't fit leaf nodes.
After changing the condition, the code path:
1. Also handles the non-leaf nodes when path->lowest_level is nonzero, which is wrong. However btrfs_search_forward() is never called with a nonzero path->lowest_level, which makes this bug not found before.
2. Makes the later if block with the same condition, which was originally used to handle non-leaf node (calling btrfs_node_key_to_cpu()) when lowest_level is not zero, dead code.
Since btrfs_search_forward() is never called for a path with a lowest_level different from zero, just completely remove the partial support for a non-zero lowest_level, simplifying a bit the code, and assert that lowest_level is zero at the start of the function.
--- fs/btrfs/ctree.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-)
fs/btrfs/ctree.c +5 -13
@@ -4585,16 +4585,13 @@ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,/* * A helper function to walk down the tree starting at min_key, and looking -* for nodes or leaves that are have a minimum transaction id. +* for leaves that have a minimum transaction id. * This is used by the btree defrag code, and tree logging * * This does not cow, but it does stuff the starting key it finds back * into min_key, so you can call btrfs_search_slot with cow=1 on the * key and get a writable path. * -* This honors path->lowest_level to prevent descent past a given level -* of the tree. -* * min_trans indicates the oldest transaction that you are interested * in walking through. Any nodes or leaves older than min_trans are * skipped over (without reading them).
@@ -4615,6 +4612,7 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key,int keep_locks = path->keep_locks;ASSERT (!path->nowait); +ASSERT (path->lowest_level ==0 ); path->keep_locks =1 ; again: cur =btrfs_read_lock_root_node (root);
@@ -4636,8 +4634,8 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key, goto out; } -/* at the lowest level, we're done, setup the path and exit */ -if (level == path->lowest_level) { +/* At level 0 we're done, setup the path and exit. */ +if (level ==0 ) {if (slot >= nritems) goto find_next_key; ret =0 ;
@@ -4678,12 +4676,6 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key, goto out; } } -if (level == path->lowest_level) { - ret =0 ; -/* Save our key for returning back. */ -btrfs_node_key_to_cpu (cur, min_key, slot); - goto out; - } cur =btrfs_read_node_slot (cur, slot);if (IS_ERR (cur)) { ret =PTR_ERR (cur);
@@ -4699,7 +4691,7 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key, out: path->keep_locks = keep_locks;if (ret ==0 ) -btrfs_unlock_up_safe (path, path->lowest_level +1 ); +btrfs_unlock_up_safe (path,1 );return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/480 ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit f4c77d5af0a9cd0ee22617baa8b49d0e151fbda7 ]
commit 7f1186a8d738661 ("ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()") checks return value of xlate_tdm_slot_mask() (A1)(A2).
/*
* ...
(Y) * TDM mode can be disabled by passing 0 for @slots. In this case @tx_mask,
* @rx_mask and @slot_width will be ignored.
* ...
*/
int snd_soc_dai_set_tdm_slot(...)
{
...
if (...)
(A1) ret = dai->driver->ops->xlate_tdm_slot_mask(...);
else
(A2) ret = snd_soc_xlate_tdm_slot_mask(...);
if (ret)
goto err;
...
}snd_soc_xlate_tdm_slot_mask() (A2) will return -EINVAL if slots was 0 (X), but snd_soc_dai_set_tdm_slot() allow to use it (Y).
(A) static int snd_soc_xlate_tdm_slot_mask(...)
{
...
if (!slots)
(X) return -EINVAL;
...
}Call xlate_tdm_slot_mask() only if slots was non zero.
--- sound/soc/soc-dai.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
sound/soc/soc-dai.c +9 -7
@@ -259,13 +259,15 @@ int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, &rx_mask, }; -if (dai->driver->ops && - dai->driver->ops->xlate_tdm_slot_mask) - ret = dai->driver->ops->xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); -else - ret =snd_soc_xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); -if (ret) - goto err; +if (slots) { +if (dai->driver->ops && + dai->driver->ops->xlate_tdm_slot_mask) + ret = dai->driver->ops->xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); +else + ret =snd_soc_xlate_tdm_slot_mask (slots, &tx_mask, &rx_mask); +if (ret) + goto err; + }for_each_pcm_streams (stream)snd_soc_dai_tdm_mask_set (dai, stream, *tdm_mask[stream]);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/480 ASoC: amd: acp: Fix pointer assignments for snd_soc_acpi_mach structures
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Venkata Prasad Potturu <[email protected]>
[ Upstream commit 0779c0ad2a7cc0ae1865860c9bc8732613cc56b1 ]
This patch modifies the assignment of machine structure pointers in the acp_pci_probe function. Previously, the machine pointers were assigned using the address-of operator (&), which caused incompatibility issues in type assignments.
Additionally, the declarations of the machine arrays in amd.h have been updated to reflect that they are indeed arrays ([]). The code is further cleaned up by declaring the codec structures in amd-acpi-mach.c as static, reflecting their intended usage.
error: symbol 'amp_rt1019' was not declared. Should it be static?
error: symbol 'amp_max' was not declared. Should it be static?
error: symbol 'snd_soc_acpi_amd_acp_machines' was not declared. Should it be static?
error: symbol 'snd_soc_acpi_amd_rmb_acp_machines' was not declared. Should it be static?
error: symbol 'snd_soc_acpi_amd_acp63_acp_machines' was not declared. Should it be static?
error: symbol 'snd_soc_acpi_amd_acp70_acp_machines' was not declared. Should it be static?
--- sound/soc/amd/acp/acp-pci.c | 8 ++++---- sound/soc/amd/acp/amd-acpi-mach.c | 4 ++-- sound/soc/amd/acp/amd.h | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-)
sound/soc/amd/acp/acp-pci.c +4 -4
@@ -137,26 +137,26 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id chip->name ="acp_asoc_renoir" ; chip->rsrc = &rn_rsrc; chip->acp_hw_ops_init = acp31_hw_ops_init; - chip->machines = &snd_soc_acpi_amd_acp_machines; + chip->machines = snd_soc_acpi_amd_acp_machines;break ;case 0x6f : chip->name ="acp_asoc_rembrandt" ; chip->rsrc = &rmb_rsrc; chip->acp_hw_ops_init = acp6x_hw_ops_init; - chip->machines = &snd_soc_acpi_amd_rmb_acp_machines; + chip->machines = snd_soc_acpi_amd_rmb_acp_machines;break ;case 0x63 : chip->name ="acp_asoc_acp63" ; chip->rsrc = &acp63_rsrc; chip->acp_hw_ops_init = acp63_hw_ops_init; - chip->machines = &snd_soc_acpi_amd_acp63_acp_machines; + chip->machines = snd_soc_acpi_amd_acp63_acp_machines;break ;case 0x70 :case 0x71 : chip->name ="acp_asoc_acp70" ; chip->rsrc = &acp70_rsrc; chip->acp_hw_ops_init = acp70_hw_ops_init; - chip->machines = &snd_soc_acpi_amd_acp70_acp_machines; + chip->machines = snd_soc_acpi_amd_acp70_acp_machines;break ;default :dev_err (dev,"Unsupported device revision:0x%x\n" , pci->revision);
sound/soc/amd/acp/amd-acpi-mach.c +2 -2
@@ -8,12 +8,12 @@#include <sound/soc-acpi.h> -struct snd_soc_acpi_codecs amp_rt1019 = { +static struct snd_soc_acpi_codecs amp_rt1019 = { .num_codecs =1 , .codecs = {"10EC1019" } }; -struct snd_soc_acpi_codecs amp_max = { +static struct snd_soc_acpi_codecs amp_max = { .num_codecs =1 , .codecs = {"MX98360A" } };
sound/soc/amd/acp/amd.h +4 -4
@@ -243,10 +243,10 @@ extern struct acp_resource rmb_rsrc;extern struct acp_resource acp63_rsrc;extern struct acp_resource acp70_rsrc; -extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp_machines; -extern struct snd_soc_acpi_mach snd_soc_acpi_amd_rmb_acp_machines; -extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp63_acp_machines; -extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp70_acp_machines; +extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_amd_rmb_acp_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp63_acp_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp70_acp_machines[];extern const struct snd_soc_dai_ops asoc_acp_cpu_dai_ops;extern const struct snd_soc_dai_ops acp_dmic_dai_ops;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/480 ASoC: ops: dynamically allocate struct snd_ctl_elem_value
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 7e10d7242ea8a5947878880b912ffa5806520705 ]
This structure is really too larget to be allocated on the stack:
sound/soc/soc-ops.c:435:5: error: stack frame size (1296) exceeds limit (1280) in 'snd_soc_limit_volume' [-Werror,-Wframe-larger-than]
Change the function to dynamically allocate it instead.
There is probably a better way to do it since only two integer fields inside of that structure are actually used, but this is the simplest rework for the moment.
--- sound/soc/soc-ops.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
sound/soc/soc-ops.c +15 -11
@@ -399,28 +399,32 @@ EXPORT_SYMBOL_GPL(snd_soc_put_volsw_sx);static int snd_soc_clip_to_platform_max (struct snd_kcontrol *kctl) {struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; -struct snd_ctl_elem_value uctl; +struct snd_ctl_elem_value *uctl;int ret;if (!mc->platform_max)return 0 ; - ret = kctl->get (kctl, &uctl); + uctl =kzalloc (sizeof (*uctl),GFP_KERNEL ); +if (!uctl) +return -ENOMEM ; + + ret = kctl->get (kctl, uctl);if (ret <0 ) -return ret; + goto out; -if (uctl.value.integer.value[0 ] > mc->platform_max) - uctl.value.integer.value[0 ] = mc->platform_max; +if (uctl->value.integer.value[0 ] > mc->platform_max) + uctl->value.integer.value[0 ] = mc->platform_max;if (snd_soc_volsw_is_stereo (mc) && - uctl.value.integer.value[1 ] > mc->platform_max) - uctl.value.integer.value[1 ] = mc->platform_max; + uctl->value.integer.value[1 ] > mc->platform_max) + uctl->value.integer.value[1 ] = mc->platform_max; - ret = kctl->put (kctl, &uctl); -if (ret <0 ) -return ret; + ret = kctl->put (kctl, uctl); -return 0 ; +out: +kfree (uctl); +return ret; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/480 ASoC: mediatek: use reserved memory or enable buffer pre-allocation
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit ec4a10ca4a68ec97f12f4d17d7abb74db34987db ]
In commit 32c9c06adb5b ("ASoC: mediatek: disable buffer pre-allocation") buffer pre-allocation was disabled to accommodate newer platforms that have a limited reserved memory region for the audio frontend.
Turns out disabling pre-allocation across the board impacts platforms that don't have this reserved memory region. Buffer allocation failures have been observed on MT8173 and MT8183 based Chromebooks under low memory conditions, which results in no audio playback for the user.
Since some MediaTek platforms already have dedicated reserved memory pools for the audio frontend, the plan is to enable this for all of them. This requires device tree changes. As a fallback, reinstate the original policy of pre-allocating audio buffers at probe time of the reserved memory pool cannot be found or used.
This patch covers the MT8173, MT8183, MT8186 and MT8192 platforms for now, the reason being that existing MediaTek platform drivers that supported reserved memory were all platforms that mainly supported ChromeOS, and is also the set of devices that I can verify.
--- sound/soc/mediatek/common/mtk-afe-platform-driver.c | 4 +++- sound/soc/mediatek/common/mtk-base-afe.h | 1 + sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 7 +++++++ sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 7 +++++++ sound/soc/mediatek/mt8186/mt8186-afe-pcm.c | 7 +++++++ sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 7 +++++++ 6 files changed, 32 insertions(+), 1 deletion(-)
sound/soc/mediatek/common/mtk-afe-platform-driver.c +3 -1
@@ -120,7 +120,9 @@ int mtk_afe_pcm_new(struct snd_soc_component *component,struct mtk_base_afe *afe =snd_soc_component_get_drvdata (component); size = afe->mtk_afe_hardware->buffer_bytes_max; -snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , afe->dev,0 , size); +snd_pcm_set_managed_buffer_all (pcm,SNDRV_DMA_TYPE_DEV , afe->dev, + afe->preallocate_buffers ? size :0 , + size);return 0 ; }
sound/soc/mediatek/common/mtk-base-afe.h +1 -0
@@ -117,6 +117,7 @@ struct mtk_base_afe {struct mtk_base_afe_irq *irqs;int irqs_size;int memif_32bit_supported; +bool preallocate_buffers;struct list_head sub_dais;struct snd_soc_dai_driver *dai_drivers;
sound/soc/mediatek/mt8173/mt8173-afe-pcm.c +7 -0
@@ -13,6 +13,7 @@#include <linux/module.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/dma-mapping.h> #include <linux/pm_runtime.h> #include <sound/soc.h>
@@ -1070,6 +1071,12 @@ static int mt8173_afe_pcm_dev_probe(struct platform_device *pdev) afe->dev = &pdev->dev; + ret =of_reserved_mem_device_init (&pdev->dev); +if (ret) { +dev_info (&pdev->dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } + irq_id =platform_get_irq (pdev,0 );if (irq_id <=0 )return irq_id <0 ? irq_id : -ENXIO ;
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +7 -0
@@ -10,6 +10,7 @@#include <linux/mfd/syscon.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/pm_runtime.h> #include <linux/reset.h>
@@ -1094,6 +1095,12 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) afe->dev = &pdev->dev; dev = afe->dev; + ret =of_reserved_mem_device_init (dev); +if (ret) { +dev_info (dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } +/* initial audio related clock */ ret =mt8183_init_clock (afe);if (ret) {
sound/soc/mediatek/mt8186/mt8186-afe-pcm.c +7 -0
@@ -10,6 +10,7 @@#include <linux/module.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/pm_runtime.h> #include <linux/reset.h> #include <sound/soc.h>
@@ -2835,6 +2836,12 @@ static int mt8186_afe_pcm_dev_probe(struct platform_device *pdev) afe_priv = afe->platform_priv; afe->dev = &pdev->dev; + ret =of_reserved_mem_device_init (dev); +if (ret) { +dev_info (dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } + afe->base_addr =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (afe->base_addr))return PTR_ERR (afe->base_addr);
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +7 -0
@@ -12,6 +12,7 @@#include <linux/mfd/syscon.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/of_reserved_mem.h> #include <linux/pm_runtime.h> #include <linux/reset.h> #include <sound/soc.h>
@@ -2179,6 +2180,12 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) afe->dev = dev; + ret =of_reserved_mem_device_init (dev); +if (ret) { +dev_info (dev,"no reserved memory found, pre-allocating buffers instead\n" ); + afe->preallocate_buffers = true; + } +/* init audio related clock */ ret =mt8192_init_clock (afe);if (ret) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/480 arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 696a4c325fad8af95da6a9d797766d1613831622 ]
TQMa9352 is only using LPDDR4X, so the BUCK2 regulator should be fixed at 600MV.
--- arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi +3 -3
@@ -1,6 +1,6 @@ // SPDX-License-Identifier: (GPL-2.0-or-later OR MIT) /* - * Copyright (c) 2022 TQ-Systems GmbH <[email protected]>, + * Copyright (c) 2022-2025 TQ-Systems GmbH <[email protected]>, * D-82229 Seefeld, Germany. * Author: Markus Niebel */
@@ -110,11 +110,11 @@ buck1: BUCK1 { regulator-ramp-delay = <3125>; }; - /* V_DDRQ - 1.1 LPDDR4 or 0.6 LPDDR4X */ + /* V_DDRQ - 0.6 V for LPDDR4X */ buck2: BUCK2 { regulator-name = "BUCK2"; regulator-min-microvolt = <600000>; - regulator-max-microvolt = <1100000>; + regulator-max-microvolt = <600000>; regulator-boot-on; regulator-always-on; regulator-ramp-delay = <3125>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/480 selftests: Fix errno checking in syscall_user_dispatch test
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Vyukov <[email protected]>
[ Upstream commit b89732c8c8357487185f260a723a060b3476144e ]
Successful syscalls don't change errno, so checking errno is wrong to ensure that a syscall has failed. For example for the following sequence:
prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0xff, 0); EXPECT_EQ(EINVAL, errno); prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0x0, &sel); EXPECT_EQ(EINVAL, errno);
only the first syscall may fail and set errno, but the second may succeed and keep errno intact, and the check will falsely pass.
Or if errno happened to be EINVAL before, even the first check may falsely pass.
Also use EXPECT/ASSERT consistently. Currently there is an inconsistent mix without obvious reasons for usage of one or another.
--- .../syscall_user_dispatch/sud_test.c | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-)
tools/testing/selftests/syscall_user_dispatch/sud_test.c +25 -25
@@ -79,6 +79,21 @@ TEST_SIGNAL(dispatch_trigger_sigsys, SIGSYS) } } +static void prctl_valid (struct __test_metadata *_metadata, +unsigned long op,unsigned long off, +unsigned long size,void *sel) +{ +EXPECT_EQ (0 ,prctl (PR_SET_SYSCALL_USER_DISPATCH , op, off, size, sel)); +} + +static void prctl_invalid (struct __test_metadata *_metadata, +unsigned long op,unsigned long off, +unsigned long size,void *sel,int err) +{ +EXPECT_EQ (-1 ,prctl (PR_SET_SYSCALL_USER_DISPATCH , op, off, size, sel)); +EXPECT_EQ (err, errno); +} +TEST (bad_prctl_param) {char sel =SYSCALL_DISPATCH_FILTER_ALLOW ;
@@ -86,57 +101,42 @@ TEST(bad_prctl_param)/* Invalid op */ op =-1 ; -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0 ,0 , &sel); -ASSERT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0 ,0 , &sel,EINVAL );/* PR_SYS_DISPATCH_OFF */ op =PR_SYS_DISPATCH_OFF ;/* offset != 0 */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x1 ,0x0 ,0 ); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x1 ,0x0 ,0 ,EINVAL );/* len != 0 */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0xff ,0 ); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x0 ,0xff ,0 ,EINVAL );/* sel != NULL */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0x0 , &sel); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x0 ,0x0 , &sel,EINVAL );/* Valid parameter */ - errno =0 ; -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0x0 ,0x0 ); -EXPECT_EQ (0 , errno); +prctl_valid (_metadata, op,0x0 ,0x0 ,0x0 );/* PR_SYS_DISPATCH_ON */ op =PR_SYS_DISPATCH_ON ;/* Dispatcher region is bad (offset > 0 && len == 0) */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x1 ,0x0 , &sel); -EXPECT_EQ (EINVAL , errno); -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,-1L ,0x0 , &sel); -EXPECT_EQ (EINVAL , errno); +prctl_invalid (_metadata, op,0x1 ,0x0 , &sel,EINVAL ); +prctl_invalid (_metadata, op,-1L ,0x0 , &sel,EINVAL );/* Invalid selector */ -prctl (PR_SET_SYSCALL_USER_DISPATCH , op,0x0 ,0x1 , (void *)-1 ); -ASSERT_EQ (EFAULT , errno); +prctl_invalid (_metadata, op,0x0 ,0x1 , (void *)-1 ,EFAULT );/* * Dispatcher range overflows unsigned long */ -prctl (PR_SET_SYSCALL_USER_DISPATCH ,PR_SYS_DISPATCH_ON ,1 ,-1L , &sel); - ASSERT_EQ(EINVAL, errno) { -TH_LOG ("Should reject bad syscall range" ); - } +prctl_invalid (_metadata,PR_SYS_DISPATCH_ON ,1 ,-1L , &sel,EINVAL );/* * Allowed range overflows usigned long */ -prctl (PR_SET_SYSCALL_USER_DISPATCH ,PR_SYS_DISPATCH_ON ,-1L ,0x1 , &sel); - ASSERT_EQ(EINVAL, errno) { -TH_LOG ("Should reject bad syscall range" ); - } +prctl_invalid (_metadata,PR_SYS_DISPATCH_ON ,-1L ,0x1 , &sel,EINVAL ); }/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/480 soc: qcom: QMI encoding/decoding for big endian
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Wilhelm <[email protected]>
[ Upstream commit 3ced38da5f7de4c260f9eaa86fc805827953243a ]
The QMI_DATA_LEN type may have different sizes. Taking the element's address of that type and interpret it as a smaller sized ones works fine for little endian platforms but not for big endian ones. Instead use temporary variables of smaller sized types and cast them correctly to support big endian platforms.
--- drivers/soc/qcom/qmi_encdec.c | 46 +++++++++++++++++++++++++++++------ 1 file changed, 38 insertions(+), 8 deletions(-)
drivers/soc/qcom/qmi_encdec.c +38 -8
@@ -304,6 +304,8 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf,const void *buf_src;int encode_tlv =0 ;int rc; +u8 val8; +u16 val16;if (!ei_array)return 0 ;
@@ -338,7 +340,6 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf,break ;case QMI_DATA_LEN : -memcpy (&data_len_value, buf_src, temp_ei->elem_size); data_len_sz = temp_ei->elem_size ==sizeof (u8) ?sizeof (u8) :sizeof (u16);/* Check to avoid out of range buffer access */
@@ -348,8 +349,17 @@ static int qmi_encode(const struct qmi_elem_info *ei_array, void *out_buf, __func__);return -ETOOSMALL ; } - rc =qmi_encode_basic_elem (buf_dst, &data_len_value, -1 , data_len_sz); +if (data_len_sz ==sizeof (u8)) { + val8 = *(u8 *)buf_src; + data_len_value = (u32 )val8; + rc =qmi_encode_basic_elem (buf_dst, &val8, +1 , data_len_sz); + }else { + val16 = *(u16 *)buf_src; + data_len_value = (u32 )le16_to_cpu (val16); + rc =qmi_encode_basic_elem (buf_dst, &val16, +1 , data_len_sz); + }UPDATE_ENCODE_VARIABLES (temp_ei, buf_dst, encoded_bytes, tlv_len, encode_tlv, rc);
@@ -523,14 +533,23 @@ static int qmi_decode_string_elem(const struct qmi_elem_info *ei_array,u32 string_len =0 ;u32 string_len_sz =0 ;const struct qmi_elem_info *temp_ei = ei_array; +u8 val8; +u16 val16;if (dec_level ==1 ) { string_len = tlv_len; }else { string_len_sz = temp_ei->elem_len <=U8_MAX ?sizeof (u8) :sizeof (u16); - rc =qmi_decode_basic_elem (&string_len, buf_src, -1 , string_len_sz); +if (string_len_sz ==sizeof (u8)) { + rc =qmi_decode_basic_elem (&val8, buf_src, +1 , string_len_sz); + string_len = (u32 )val8; + }else { + rc =qmi_decode_basic_elem (&val16, buf_src, +1 , string_len_sz); + string_len = (u32 )val16; + } decoded_bytes += rc; }
@@ -604,6 +623,9 @@ static int qmi_decode(const struct qmi_elem_info *ei_array, void *out_c_struct,u32 decoded_bytes =0 ;const void *buf_src = in_buf;int rc; +u8 val8; +u16 val16; +u32 val32;while (decoded_bytes < in_buf_len) {if (dec_level >=2 && temp_ei->data_type ==QMI_EOTI )
@@ -642,9 +664,17 @@ static int qmi_decode(const struct qmi_elem_info *ei_array, void *out_c_struct,if (temp_ei->data_type ==QMI_DATA_LEN ) { data_len_sz = temp_ei->elem_size ==sizeof (u8) ?sizeof (u8) :sizeof (u16); - rc =qmi_decode_basic_elem (&data_len_value, buf_src, -1 , data_len_sz); -memcpy (buf_dst, &data_len_value,sizeof (u32)); +if (data_len_sz ==sizeof (u8)) { + rc =qmi_decode_basic_elem (&val8, buf_src, +1 , data_len_sz); + data_len_value = (u32 )val8; + }else { + rc =qmi_decode_basic_elem (&val16, buf_src, +1 , data_len_sz); + data_len_value = (u32 )val16; + } + val32 =cpu_to_le32 (data_len_value); +memcpy (buf_dst, &val32,sizeof (u32)); temp_ei = temp_ei +1 ; buf_dst = out_c_struct + temp_ei->offset; tlv_len -= data_len_sz;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/480 arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Gan <[email protected]>
[ Upstream commit bd4f35786d5f0798cc1f8c187a81a7c998e6c58f ]
An infinite loop has been created by the Coresight devices. When only a source device is enabled, the coresight_find_activated_sysfs_sink function is recursively invoked in an attempt to locate an active sink device, ultimately leading to a stack overflow and system crash. Therefore, disable the replicator1 to break the infinite loop and prevent a potential stack overflow.
replicator1_out -> funnel_swao_in6 -> tmc_etf_swao_in -> tmc_etf_swao_out
| |
replicator1_in replicator_swao_in
| |
replicator0_out1 replicator_swao_out0
| |
replicator0_in funnel_in1_in3
| |tmc_etf_out <- tmc_etf_in <- funnel_merg_out <- funnel_merg_in1 <- funnel_in1_out
[call trace]
dump_backtrace+0x9c/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x28 panic+0x340/0x3b0 nmi_panic+0x94/0xa0 panic_bad_stack+0x114/0x138 handle_bad_stack+0x34/0xb8 __bad_stack+0x78/0x80 coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] ... coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_enable_sysfs+0x80/0x2a0 [coresight]
side effect after the change:
Only trace data originating from AOSS can reach the ETF_SWAO and EUD sinks.
--- arch/arm64/boot/dts/qcom/qcs615.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/qcom/qcs615.dtsi +1 -0
@@ -1868,6 +1868,7 @@ replicator@604a000 { clocks = <&aoss_qmp>; clock-names = "apb_pclk"; + status = "disabled"; in-ports { port {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/480 arm64: dts: qcom: sdm845: Expand IMEM region
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 81a4a7de3d4031e77b5796479ef21aefb0862807 ]
We need more than what is currently described, expand the region to its actual boundaries.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/qcom/sdm845.dtsi +5 -5
@@ -5078,18 +5078,18 @@ spmi_bus: spmi@c440000 { #interrupt-cells = <4>; }; - sram@146bf000 { + sram@14680000 { compatible = "qcom,sdm845-imem", "syscon", "simple-mfd"; - reg = <0 0x146bf000 0 0x1000>; + reg = <0 0x14680000 0 0x40000>; #address-cells = <1>; #size-cells = <1>; - ranges = <0 0 0x146bf000 0x1000>; + ranges = <0 0 0x14680000 0x40000>; - pil-reloc@94c { + pil-reloc@3f94c { compatible = "qcom,pil-reloc-info"; - reg = <0x94c 0xc8>; + reg = <0x3f94c 0xc8>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/480 arm64: dts: qcom: sc7180: Expand IMEM region
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 965e28cad4739b11f1bc58c0a9935e025938bb1f ]
We need more than what is currently described, expand the region to its actual boundaries.
--- arch/arm64/boot/dts/qcom/sc7180.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/qcom/sc7180.dtsi +5 -5
@@ -3523,18 +3523,18 @@ spmi_bus: spmi@c440000 { #interrupt-cells = <4>; }; - sram@146aa000 { + sram@14680000 { compatible = "qcom,sc7180-imem", "syscon", "simple-mfd"; - reg = <0 0x146aa000 0 0x2000>; + reg = <0 0x14680000 0 0x2e000>; #address-cells = <1>; #size-cells = <1>; - ranges = <0 0 0x146aa000 0x2000>; + ranges = <0 0 0x14680000 0x2e000>; - pil-reloc@94c { + pil-reloc@2a94c { compatible = "qcom,pil-reloc-info"; - reg = <0x94c 0xc8>; + reg = <0x2a94c 0xc8>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/480 arm64: dts: qcom: qcs615: disable the CTI device of the camera block
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Gan <[email protected]>
[ Upstream commit 1b7fc8a281cae9e3176584558a4ac551ce0f777d ]
Disable the CTI device of the camera block to prevent potential NoC errors during AMBA bus device matching.
The clocks for the Qualcomm Debug Subsystem (QDSS) are managed by aoss_qmp through a mailbox. However, the camera block resides outside the AP domain, meaning its QDSS clock cannot be controlled via aoss_qmp.
--- arch/arm64/boot/dts/qcom/qcs615.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/qcom/qcs615.dtsi +3 -0
@@ -2428,6 +2428,9 @@ cti@6c13000 { clocks = <&aoss_qmp>; clock-names = "apb_pclk"; + + /* Not all required clocks can be enabled from the OS */ + status = "fail"; }; cti@6c20000 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/480 arm64: dts: exynos: gs101: Add local-timer-stop to cpuidle nodes
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
[ Upstream commit b649082312dd1a4c3989bbdb7c25eb711e9b1d94 ]
In preparation for switching to the architected timer as the primary clockevents device, mark the cpuidle nodes with the 'local-timer-stop' property to indicate that an alternative clockevents device must be used for waking up from the "c2" idle state.
--- arch/arm64/boot/dts/exynos/google/gs101.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/exynos/google/gs101.dtsi +3 -0
@@ -155,6 +155,7 @@ ananke_cpu_sleep: cpu-ananke-sleep { idle-state-name = "c2"; compatible = "arm,idle-state"; arm,psci-suspend-param = <0x0010000>; + local-timer-stop; entry-latency-us = <70>; exit-latency-us = <160>; min-residency-us = <2000>;
@@ -164,6 +165,7 @@ enyo_cpu_sleep: cpu-enyo-sleep { idle-state-name = "c2"; compatible = "arm,idle-state"; arm,psci-suspend-param = <0x0010000>; + local-timer-stop; entry-latency-us = <150>; exit-latency-us = <190>; min-residency-us = <2500>;
@@ -173,6 +175,7 @@ hera_cpu_sleep: cpu-hera-sleep { idle-state-name = "c2"; compatible = "arm,idle-state"; arm,psci-suspend-param = <0x0010000>; + local-timer-stop; entry-latency-us = <235>; exit-latency-us = <220>; min-residency-us = <3500>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/480 arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijuan Gao <[email protected]>
[ Upstream commit 7bd7209e9cb11c8864e601d915008da088476f0c ]
Fix the incorrect IRQ numbers for ready and handover on sa8775p. The correct values are as follows:
Fatal interrupt - 0
Ready interrupt - 1
Handover interrupt - 2
Stop acknowledge interrupt - 3
--- arch/arm64/boot/dts/qcom/sa8775p.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/qcom/sa8775p.dtsi +5 -5
@@ -4663,8 +4663,8 @@ remoteproc_gpdsp0: remoteproc@20c00000 { interrupts-extended = <&intc GIC_SPI 768 IRQ_TYPE_EDGE_RISING>, <&smp2p_gpdsp0_in 0 0>, - <&smp2p_gpdsp0_in 2 0>, <&smp2p_gpdsp0_in 1 0>, + <&smp2p_gpdsp0_in 2 0>, <&smp2p_gpdsp0_in 3 0>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -4706,8 +4706,8 @@ remoteproc_gpdsp1: remoteproc@21c00000 { interrupts-extended = <&intc GIC_SPI 624 IRQ_TYPE_EDGE_RISING>, <&smp2p_gpdsp1_in 0 0>, - <&smp2p_gpdsp1_in 2 0>, <&smp2p_gpdsp1_in 1 0>, + <&smp2p_gpdsp1_in 2 0>, <&smp2p_gpdsp1_in 3 0>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -4847,8 +4847,8 @@ remoteproc_cdsp0: remoteproc@26300000 { interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp0_in 0 IRQ_TYPE_EDGE_RISING>, - <&smp2p_cdsp0_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp0_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp0_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp0_in 3 IRQ_TYPE_EDGE_RISING>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -4979,8 +4979,8 @@ remoteproc_cdsp1: remoteproc@2a300000 { interrupts-extended = <&intc GIC_SPI 798 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp1_in 0 IRQ_TYPE_EDGE_RISING>, - <&smp2p_cdsp1_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp1_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_cdsp1_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp1_in 3 IRQ_TYPE_EDGE_RISING>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
@@ -5135,8 +5135,8 @@ remoteproc_adsp: remoteproc@30000000 { interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, - <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, + <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>; interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/480 arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Apitzsch <[email protected]>
[ Upstream commit 76270a18dbdf0bb50615f1b29d2cae8d683da01e ]
The blsp_dma controller is shared between the different subsystems, which is why it is already initialized by the firmware. We should not reinitialize it from Linux to avoid potential other users of the DMA engine to misbehave.
In mainline this can be described using the "qcom,controlled-remotely" property. In the downstream/vendor kernel from Qualcomm there is an opposite "qcom,managed-locally" property. This property is *not* set for the qcom,sps-dma@7884000 and qcom,sps-dma@7ac4000 [1] so adding "qcom,controlled-remotely" upstream matches the behavior of the downstream/vendor kernel.
Adding this fixes booting Longcheer L9360.
--- arch/arm64/boot/dts/qcom/msm8976.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/msm8976.dtsi +2 -0
@@ -1330,6 +1330,7 @@ blsp1_dma: dma-controller@7884000 { clock-names = "bam_clk"; #dma-cells = <1>; qcom,ee = <0>; + qcom,controlled-remotely; }; blsp1_uart1: serial@78af000 {
@@ -1450,6 +1451,7 @@ blsp2_dma: dma-controller@7ac4000 { clock-names = "bam_clk"; #dma-cells = <1>; qcom,ee = <0>; + qcom,controlled-remotely; }; blsp2_uart2: serial@7af0000 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/480 pm: cpupower: Fix printing of CORE, CPU fields in cpupower-monitor
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 14a3318b4ac8ae0ca2e1132a89de167e1030fbdb ]
After the commit 0014f65e3df0 ("pm: cpupower: remove hard-coded topology depth values"), "cpupower monitor" output ceased to print the CORE and the CPU fields on a multi-socket platform.
The reason for this is that the patch changed the behaviour to break out of the switch-case after printing the PKG details, while prior to the patch, the CORE and the CPU details would also get printed since the "if" condition check would pass for any level whose topology depth was lesser than that of a package.
Fix this ensuring all the details below a desired topology depth are printed in the cpupower monitor output.
--- tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c | 4 ---- 1 file changed, 4 deletions(-)
tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c +0 -4
@@ -121,10 +121,8 @@ void print_header(int topology_depth)switch (topology_depth) {case TOPOLOGY_DEPTH_PKG :printf (" PKG|" ); -break ;case TOPOLOGY_DEPTH_CORE :printf ("CORE|" ); -break ;case TOPOLOGY_DEPTH_CPU :printf (" CPU|" );break ;
@@ -167,10 +165,8 @@ void print_results(int topology_depth, int cpu)switch (topology_depth) {case TOPOLOGY_DEPTH_PKG :printf ("%4d|" , cpu_top.core_info[cpu].pkg); -break ;case TOPOLOGY_DEPTH_CORE :printf ("%4d|" , cpu_top.core_info[cpu].core); -break ;case TOPOLOGY_DEPTH_CPU :printf ("%4d|" , cpu_top.core_info[cpu].cpu);break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/480 ARM: dts: vfxxx: Correctly use two tuples for timer address
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f3440dcf8b994197c968fbafe047ce27eed226e8 ]
Address and size-cells are 1 and the ftm timer node takes two address spaces in "reg" property, so this should be in two <> tuples. Change has no functional impact, but original code is confusing/less readable.
--- arch/arm/boot/dts/nxp/vf/vfxxx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nxp/vf/vfxxx.dtsi +1 -1
@@ -603,7 +603,7 @@ usbmisc1: usb@400b4800 { ftm: ftm@400b8000 { compatible = "fsl,ftm-timer"; - reg = <0x400b8000 0x1000 0x400b9000 0x1000>; + reg = <0x400b8000 0x1000>, <0x400b9000 0x1000>; interrupts = <44 IRQ_TYPE_LEVEL_HIGH>; clock-names = "ftm-evt", "ftm-src", "ftm-evt-counter-en", "ftm-src-counter-en";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/480 usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit d9e496a9fb4021a9e6b11e7ba221a41a2597ac27 ]
The variable of_match was incorrectly declared as a bool. It is assigned the return value of of_match_device(), which is a pointer of type const struct of_device_id *.
--- drivers/usb/host/xhci-plat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +1 -1
@@ -152,7 +152,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const sint ret;int irq;struct xhci_plat_priv *priv =NULL ; -bool of_match; +const struct of_device_id *of_match;if (usb_disabled ())return -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/480 usb: misc: apple-mfi-fastcharge: Make power supply names unique
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charalampos Mitrodimas <[email protected]>
[ Upstream commit 43007b89fb2de746443fbbb84aedd1089afdf582 ]
When multiple Apple devices are connected concurrently, the apple-mfi-fastcharge driver fails to probe the subsequent devices with the following error:
sysfs: cannot create duplicate filename '/class/power_supply/apple_mfi_fastcharge' apple-mfi-fastcharge 5-2.4.3.3: probe of 5-2.4.3.3 failed with error -17
This happens because the driver uses a fixed power supply name ("apple_mfi_fastcharge") for all devices, causing a sysfs name conflict when a second device is connected.
Fix this by generating unique names using the USB bus and device number (e.g., "apple_mfi_fastcharge_5-12"). This ensures each connected device gets a unique power supply entry in sysfs.
The change requires storing a copy of the power_supply_desc structure in the per-device mfi_device struct, since the name pointer needs to remain valid for the lifetime of the power supply registration.
--- drivers/usb/misc/apple-mfi-fastcharge.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)
drivers/usb/misc/apple-mfi-fastcharge.c +21 -3
@@ -44,6 +44,7 @@ MODULE_DEVICE_TABLE(usb, mfi_fc_id_table);struct mfi_device {struct usb_device *udev;struct power_supply *battery; +struct power_supply_desc battery_desc;int charge_type; };
@@ -178,6 +179,7 @@ static int mfi_fc_probe(struct usb_device *udev) {struct power_supply_config battery_cfg = {};struct mfi_device *mfi =NULL ; +char *battery_name;int err;if (!mfi_fc_match (udev))
@@ -187,23 +189,38 @@ static int mfi_fc_probe(struct usb_device *udev)if (!mfi)return -ENOMEM ; + battery_name =kasprintf (GFP_KERNEL ,"apple_mfi_fastcharge_%d-%d" , + udev->bus->busnum, udev->devnum); +if (!battery_name) { + err = -ENOMEM ; + goto err_free_mfi; + } + + mfi->battery_desc = apple_mfi_fc_desc; + mfi->battery_desc.name = battery_name; + battery_cfg.drv_data = mfi; mfi->charge_type =POWER_SUPPLY_CHARGE_TYPE_TRICKLE ; mfi->battery =power_supply_register (&udev->dev, - &apple_mfi_fc_desc, + &mfi->battery_desc, &battery_cfg);if (IS_ERR (mfi->battery)) {dev_err (&udev->dev,"Can't register battery\n" ); err =PTR_ERR (mfi->battery); -kfree (mfi); -return err; + goto err_free_name; } mfi->udev =usb_get_dev (udev);dev_set_drvdata (&udev->dev, mfi);return 0 ; + +err_free_name: +kfree (battery_name); +err_free_mfi: +kfree (mfi); +return err; }static void mfi_fc_disconnect (struct usb_device *udev)
@@ -213,6 +230,7 @@ static void mfi_fc_disconnect(struct usb_device *udev) mfi =dev_get_drvdata (&udev->dev);if (mfi->battery)power_supply_unregister (mfi->battery); +kfree (mfi->battery_desc.name);dev_set_drvdata (&udev->dev,NULL );usb_put_dev (mfi->udev);kfree (mfi);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/480 arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wadim Egorov <[email protected]>
[ Upstream commit 945e48a39c957924bc84d1a6c137da039e13855b ]
For the ICSSG PHYs to operate correctly, a 25 MHz reference clock must be supplied on CLKOUT0. Previously, our bootloader configured this clock, which is why the PRU Ethernet ports appeared to work, but the change never made it into the device tree.
Add clock properties to make EXT_REFCLK1.CLKOUT0 output a 25MHz clock.
--- arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-rdk.dts +2 -0
@@ -322,6 +322,8 @@ AM64X_IOPAD(0x0040, PIN_OUTPUT, 7) /* (U21) GPMC0_AD1.GPIO0_16 */ &icssg0_mdio { pinctrl-names = "default"; pinctrl-0 = <&icssg0_mdio_pins_default &clkout0_pins_default>; + assigned-clocks = <&k3_clks 157 123>; + assigned-clock-parents = <&k3_clks 157 125>; status = "okay"; icssg0_phy1: ethernet-phy@1 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/480 arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit fdc8ad019ab9a2308b8cef54fbc366f482fb746f ]
Pinmux registers ends at 0x000f42ac (including). Thus, the size argument of the pinctrl-single node has to be 0x2b0. Fix it.
This will fix the following error:
pinctrl-single f4000.pinctrl: mux offset out of range: 0x2ac (0x2ac)
--- arch/arm64/boot/dts/ti/k3-am62p-j722s-common-main.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am62p-j722s-common-main.dtsi +1 -1
@@ -250,7 +250,7 @@ secure_proxy_sa3: mailbox@43600000 { main_pmx0: pinctrl@f4000 { compatible = "pinctrl-single"; - reg = <0x00 0xf4000 0x00 0x2ac>; + reg = <0x00 0xf4000 0x00 0x2b0>; #pinctrl-cells = <1>; pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0xffffffff>;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/480 ARM: dts: microchip: sama7d65: Add clock name property
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Wanner <[email protected]>
[ Upstream commit 0029468132ba2e00a3010865038783d9b2e6cc07 ]
Add clock-output-names to the xtal nodes, so the driver can correctly register the main and slow xtal.
This fixes the issue of the SoC clock driver not being able to find the main xtal and slow xtal correctly causing a bad clock tree.
--- arch/arm/boot/dts/microchip/sama7d65.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/microchip/sama7d65.dtsi +2 -0
@@ -38,11 +38,13 @@ cpu0: cpu@0 { clocks { main_xtal: clock-mainxtal { compatible = "fixed-clock"; + clock-output-names = "main_xtal"; #clock-cells = <0>; }; slow_xtal: clock-slowxtal { compatible = "fixed-clock"; + clock-output-names = "slow_xtal"; #clock-cells = <0>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/480 ARM: dts: microchip: sam9x7: Add clock name property
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Wanner <[email protected]>
[ Upstream commit 2e24723492b28ffdccb0e3e68725673e299e3823 ]
Add clock-output-names to the xtal nodes, so the driver can correctly register the main and slow xtal.
This fixes the issue of the SoC clock driver not being able to find the main xtal and slow xtal correctly causing a bad clock tree.
--- arch/arm/boot/dts/microchip/sam9x7.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/microchip/sam9x7.dtsi +2 -0
@@ -45,11 +45,13 @@ cpu@0 { clocks { slow_xtal: clock-slowxtal { compatible = "fixed-clock"; + clock-output-names = "slow_xtal"; #clock-cells = <0>; }; main_xtal: clock-mainxtal { compatible = "fixed-clock"; + clock-output-names = "main_xtal"; #clock-cells = <0>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/480 cpufreq: armada-8k: make both cpu masks static
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit b1b41bc072baf7301b1ae95fe417de09a5ad47e2 ]
An earlier patch marked one of the two CPU masks as 'static' to reduce stack usage, but if CONFIG_NR_CPUS is large enough, the function still produces a warning for compile testing:
drivers/cpufreq/armada-8k-cpufreq.c: In function 'armada_8k_cpufreq_init':drivers/cpufreq/armada-8k-cpufreq.c:203:1: error: the frame size of 1416 bytes is larger than 1408 bytes [-Werror=frame-larger-than=]
Normally this should be done using alloc_cpumask_var(), but since the driver already has a static mask and the probe function is not called concurrently, use the same trick for both.
--- drivers/cpufreq/armada-8k-cpufreq.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/cpufreq/armada-8k-cpufreq.c +1 -2
@@ -132,7 +132,7 @@ static int __init armada_8k_cpufreq_init(void)int ret =0 , opps_index =0 , cpu, nb_cpus;struct freq_table *freq_tables;struct device_node *node; -static struct cpumask cpus; +static struct cpumask cpus, shared_cpus; node =of_find_matching_node_and_match (NULL , armada_8k_cpufreq_of_match,NULL );
@@ -154,7 +154,6 @@ static int __init armada_8k_cpufreq_init(void)* divisions of it). */ for_each_cpu (cpu, &cpus) { -struct cpumask shared_cpus;struct device *cpu_dev;struct clk *clk;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/480 firmware: arm_scmi: Fix up turbo frequencies selection
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sibi Sankar <[email protected]>
[ Upstream commit ad28fc31dd702871764e9294d4f2314ad78d24a9 ]
Sustained frequency when greater than or equal to 4Ghz on 64-bit devices currently result in marking all frequencies as turbo. Address the turbo frequency selection bug by fixing the truncation.
Message-Id: <[email protected]>
--- drivers/firmware/arm_scmi/perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_scmi/perf.c +1 -1
@@ -892,7 +892,7 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph, freq = dom->opp[idx].indicative_freq * dom->mult_factor;/* All OPPs above the sustained frequency are treated as turbo */ - data.turbo = freq > dom->sustained_freq_khz *1000 ; + data.turbo = freq > dom->sustained_freq_khz *1000UL ; data.level = dom->opp[idx].perf; data.freq = freq;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/480 usb: typec: ucsi: yoga-c630: fix error and remove paths
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 168c3896f32e78e7b87f6aa9e85af36e47a9f96c ]
Fix memory leak and call ucsi_destroy() from the driver's remove function and probe's error path in order to remove debugfs files and free the memory. Also call yoga_c630_ec_unregister_notify() in the probe's error path.
--- drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/usb/typec/ucsi/ucsi_yoga_c630.c +16 -3
@@ -133,17 +133,30 @@ static int yoga_c630_ucsi_probe(struct auxiliary_device *adev, ret =yoga_c630_ec_register_notify (ec, &uec->nb);if (ret) -return ret; + goto err_destroy; + + ret =ucsi_register (uec->ucsi); +if (ret) + goto err_unregister; + +return 0 ; -return ucsi_register (uec->ucsi); +err_unregister: +yoga_c630_ec_unregister_notify (uec->ec, &uec->nb); + +err_destroy: +ucsi_destroy (uec->ucsi); + +return ret; }static void yoga_c630_ucsi_remove (struct auxiliary_device *adev) {struct yoga_c630_ucsi *uec =auxiliary_get_drvdata (adev); -yoga_c630_ec_unregister_notify (uec->ec, &uec->nb);ucsi_unregister (uec->ucsi); +yoga_c630_ec_unregister_notify (uec->ec, &uec->nb); +ucsi_destroy (uec->ucsi); }static const struct auxiliary_device_id yoga_c630_ucsi_id_table[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/480 mei: vsc: Dont re-init VSC from mei_vsc_hw_reset() on stop
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 880af854d6343b796f05b9a8b52b68a88535625b ]
mei_vsc_hw_reset() gets called from mei_start() and mei_stop() in the latter case we do not need to re-init the VSC by calling vsc_tp_init().
mei_stop() only happens on shutdown and driver unbind. On shutdown we don't need to load + boot the firmware and if the driver later is bound to the device again then mei_start() will do another reset.
The intr_enable flag is true when called from mei_start() and false on mei_stop(). Skip vsc_tp_init() when intr_enable is false.
This avoids unnecessarily uploading the firmware, which takes 11 seconds. This change reduces the poweroff/reboot time by 11 seconds.
--- drivers/misc/mei/platform-vsc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/misc/mei/platform-vsc.c +3 -0
@@ -256,6 +256,9 @@ static int mei_vsc_hw_reset(struct mei_device *mei_dev, bool intr_enable)vsc_tp_reset (hw->tp); +if (!intr_enable) +return 0 ; +return vsc_tp_init (hw->tp, mei_dev->dev); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/480 mei: vsc: Destroy mutex after freeing the IRQ
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 35b7f3525fe0a7283de7116e3c75ee3ccb3b14c9 ]
The event_notify callback which runs from vsc_tp_thread_isr may call vsc_tp_xfer() which locks the mutex. So the ISR depends on the mutex.
Move the mutex_destroy() call to after free_irq() to ensure that the ISR is not running while the mutex is destroyed.
--- drivers/misc/mei/vsc-tp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/misc/mei/vsc-tp.c +4 -4
@@ -552,10 +552,10 @@ static int vsc_tp_probe(struct spi_device *spi)return 0 ; err_destroy_lock: -mutex_destroy (&tp->mutex); -free_irq (spi->irq, tp); +mutex_destroy (&tp->mutex); +return ret; }
@@ -565,9 +565,9 @@ static void vsc_tp_remove(struct spi_device *spi)platform_device_unregister (tp->pdev); -mutex_destroy (&tp->mutex); -free_irq (spi->irq, tp); + +mutex_destroy (&tp->mutex); }static void vsc_tp_shutdown (struct spi_device *spi)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/480 mei: vsc: Event notifier fixes
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 18f14b2e7f73c7ec272d833d570b632286467c7d ]
vsc_tp_register_event_cb() can race with vsc_tp_thread_isr(), add a mutex to protect against this.
--- drivers/misc/mei/vsc-tp.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/misc/mei/vsc-tp.c +9 -3
@@ -79,9 +79,8 @@ struct vsc_tp {vsc_tp_event_cb_t event_notify;void *event_notify_context; - -/* used to protect command download */ -struct mutex mutex; +struct mutex event_notify_mutex;/* protects event_notify + context */ +struct mutex mutex;/* protects command download */ };/* GPIO resources */
@@ -113,6 +112,8 @@ static irqreturn_t vsc_tp_thread_isr(int irq, void *data) {struct vsc_tp *tp = data; +guard (mutex)(&tp->event_notify_mutex); +if (tp->event_notify) tp->event_notify (tp->event_notify_context);
@@ -399,6 +400,8 @@ EXPORT_SYMBOL_NS_GPL(vsc_tp_need_read, "VSC_TP");int vsc_tp_register_event_cb (struct vsc_tp *tp,vsc_tp_event_cb_t event_cb,void *context) { +guard (mutex)(&tp->event_notify_mutex); + tp->event_notify = event_cb; tp->event_notify_context = context;
@@ -530,6 +533,7 @@ static int vsc_tp_probe(struct spi_device *spi)return ret;mutex_init (&tp->mutex); +mutex_init (&tp->event_notify_mutex);/* only one child acpi device */ ret = acpi_dev_for_each_child(ACPI_COMPANION(dev),
@@ -554,6 +558,7 @@ static int vsc_tp_probe(struct spi_device *spi) err_destroy_lock:free_irq (spi->irq, tp); +mutex_destroy (&tp->event_notify_mutex);mutex_destroy (&tp->mutex);return ret;
@@ -567,6 +572,7 @@ static void vsc_tp_remove(struct spi_device *spi)free_irq (spi->irq, tp); +mutex_destroy (&tp->event_notify_mutex);mutex_destroy (&tp->mutex); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/480 mei: vsc: Unset the event callback on remove and probe errors
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 6175c6974095f8ca7e5f8d593171512f3e5bd453 ]
Make mei_vsc_remove() properly unset the callback to avoid a dead callback sticking around after probe errors or unbinding of the platform driver.
--- drivers/misc/mei/platform-vsc.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/misc/mei/platform-vsc.c +5 -0
@@ -380,6 +380,8 @@ static int mei_vsc_probe(struct platform_device *pdev) err_cancel:mei_cancel_work (mei_dev); +vsc_tp_register_event_cb (tp,NULL ,NULL ); +mei_disable_interrupts (mei_dev);return ret;
@@ -388,11 +390,14 @@ static int mei_vsc_probe(struct platform_device *pdev)static void mei_vsc_remove (struct platform_device *pdev) {struct mei_device *mei_dev =platform_get_drvdata (pdev); +struct mei_vsc_hw *hw =mei_dev_to_vsc_hw (mei_dev);pm_runtime_disable (mei_dev->dev);mei_stop (mei_dev); +vsc_tp_register_event_cb (hw->tp,NULL ,NULL ); +mei_disable_interrupts (mei_dev);mei_deregister (mei_dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/480 spi: stm32: Check for cfg availability in stm32_spi_probe
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Le Goffic <[email protected]>
[ Upstream commit 21f1c800f6620e43f31dfd76709dbac8ebaa5a16 ]
The stm32_spi_probe function now includes a check to ensure that the pointer returned by of_device_get_match_data is not NULL before accessing its members. This resolves a warning where a potential NULL pointer dereference could occur when accessing cfg->has_device_mode.
Before accessing the 'has_device_mode' member, we verify that 'cfg' is not NULL. If 'cfg' is NULL, an error message is logged.
This change ensures that the driver does not attempt to access configuration data if it is not available, thus preventing a potential system crash due to a NULL pointer dereference.
--- drivers/spi/spi-stm32.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/spi/spi-stm32.c +7 -1
@@ -2069,9 +2069,15 @@ static int stm32_spi_probe(struct platform_device *pdev)struct resource *res;struct reset_control *rst;struct device_node *np = pdev->dev.of_node; +const struct stm32_spi_cfg *cfg;bool device_mode;int ret; -const struct stm32_spi_cfg *cfg =of_device_get_match_data (&pdev->dev); + + cfg =of_device_get_match_data (&pdev->dev); +if (!cfg) { +dev_err (&pdev->dev,"Failed to get match data for platform\n" ); +return -ENODEV ; + } device_mode =of_property_read_bool (np,"spi-slave" );if (!cfg->has_device_mode && device_mode) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/480 drivers: misc: sram: fix up some const issues with recent attribute changes
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit bf7b4a0e25569ce39c6749afe363aefe5723d326 ]
The binary attribute const changes recently for the sram driver were made in a way that hid the fact that we would be casting a const pointer to a non-const one. So explicitly make the cast so that it is obvious and preserve the const pointer in the sram_reserve_cmp() function.
--- drivers/misc/sram.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/misc/sram.c +6 -4
@@ -28,7 +28,8 @@ static ssize_t sram_read(struct file *filp, struct kobject *kobj, {struct sram_partition *part; - part = container_of(attr, struct sram_partition, battr); +/* Cast away the const as the attribute is part of a larger structure */ + part = (struct sram_partition *)container_of(attr, struct sram_partition, battr);mutex_lock (&part->lock);memcpy_fromio (buf, part->base + pos, count);
@@ -43,7 +44,8 @@ static ssize_t sram_write(struct file *filp, struct kobject *kobj, {struct sram_partition *part; - part = container_of(attr, struct sram_partition, battr); +/* Cast away the const as the attribute is part of a larger structure */ + part = (struct sram_partition *)container_of(attr, struct sram_partition, battr);mutex_lock (&part->lock);memcpy_toio (part->base + pos, buf, count);
@@ -164,8 +166,8 @@ static void sram_free_partitions(struct sram_dev *sram)static int sram_reserve_cmp (void *priv,const struct list_head *a,const struct list_head *b) { - struct sram_reserve *ra = list_entry(a, struct sram_reserve, list); - struct sram_reserve *rb = list_entry(b, struct sram_reserve, list); + const struct sram_reserve *ra = list_entry(a, struct sram_reserve, list); + const struct sram_reserve *rb = list_entry(b, struct sram_reserve, list);return ra->start - rb->start; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/480 power: sequencing: qcom-wcn: fix bluetooth-wifi copypasta for WCN6855
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 07d59dec6795428983a840de85aa02febaf7e01b ]
Prevent a name conflict (which is surprisingly not caught by the framework).
--- drivers/power/sequencing/pwrseq-qcom-wcn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/sequencing/pwrseq-qcom-wcn.c +1 -1
@@ -155,7 +155,7 @@ static const struct pwrseq_unit_data pwrseq_qcom_wcn_bt_unit_data = { };static const struct pwrseq_unit_data pwrseq_qcom_wcn6855_bt_unit_data = { - .name ="wlan-enable" , + .name ="bluetooth-enable" , .deps = pwrseq_qcom_wcn6855_unit_deps, .enable = pwrseq_qcom_wcn_bt_enable, .disable = pwrseq_qcom_wcn_bt_disable,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/480 arm64: dts: rockchip: Enable eMMC HS200 mode on Radxa E20C
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 6e3071f4e03997ca0e4388ca61aa06df2802dcd1 ]
eMMC HS200 mode (1.8V I/O) is supported by the MMC host controller on RK3528 and works with the optional on-board eMMC module on Radxa E20C.
Be explicit about HS200 support in the device tree for Radxa E20C.
--- arch/arm64/boot/dts/rockchip/rk3528-radxa-e20c.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3528-radxa-e20c.dts +1 -0
@@ -140,6 +140,7 @@ &saradc { &sdhci { bus-width = <8>; cap-mmc-highspeed; + mmc-hs200-1_8v; no-sd; no-sdio; non-removable;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/480 staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit eb2cb7dab60f9be0b435ac4a674255429a36d72c ]
In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for info->pagerefs is not freed. Fix that by adding the cleanup function on the error path.
--- drivers/staging/fbtft/fbtft-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/fbtft/fbtft-core.c +1 -0
@@ -692,6 +692,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,return info; release_framebuf: +fb_deferred_io_cleanup (info);framebuffer_release (info); alloc_fail:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/480 rust: miscdevice: clarify invariant for `MiscDeviceRegistration`
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shankari Anand <[email protected]>
[ Upstream commit b9ff1c2a26fa31216be18e9b14c419ff8fe39e72 ]
Reword and expand the invariant documentation for MiscDeviceRegistration to clarify what it means for the inner device to be "registered". It expands to explain:
- inner points to a miscdevice registered via misc_register.
- This registration stays valid for the entire lifetime of the object.
- Deregistration is guaranteed on Drop, via misc_deregister.
--- rust/kernel/miscdevice.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
rust/kernel/miscdevice.rs +7 -1
@@ -44,7 +44,13 @@ pub const fn into_raw<T: MiscDevice>(self) -> bindings::miscdevice {/// /// # Invariants /// -/// `inner` is a registered misc device. +/// - `inner` contains a `struct miscdevice` that is registered using +/// `misc_register()`. +/// - This registration remains valid for the entire lifetime of the +/// [`MiscDeviceRegistration`] instance. +/// - Deregistration occurs exactly once in [`Drop`] via `misc_deregister()`. +/// - `inner` wraps a valid, pinned `miscdevice` created using +/// [`MiscDeviceOptions::into_raw`]. #[repr(transparent)] #[pin_data( PinnedDrop )] pub struct MiscDeviceRegistration <T > {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/480 vmci: Prevent the dispatching of uninitialized payloads
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit bfb4cf9fb97e4063f0aa62e9e398025fb6625031 ]
The reproducer executes the host's unlocked_ioctl call in two different tasks. When init_context fails, the struct vmci_event_ctx is not fully initialized when executing vmci_datagram_dispatch() to send events to all vm contexts. This affects the datagram taken from the datagram queue of its context by another task, because the datagram payload is not initialized according to the size payload_size, which causes the kernel data to leak to the user space.
Before dispatching the datagram, and before setting the payload content, explicitly set the payload content to 0 to avoid data leakage caused by incomplete payload initialization.
--- drivers/misc/vmw_vmci/vmci_context.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/vmw_vmci/vmci_context.c +2 -0
@@ -251,6 +251,8 @@ static int ctx_fire_notification(u32 context_id, u32 priv_flags) ev.msg.hdr.src =vmci_make_handle (VMCI_HYPERVISOR_CONTEXT_ID ,VMCI_CONTEXT_RESOURCE_ID ); ev.msg.hdr.payload_size =sizeof (ev) -sizeof (ev.msg.hdr); +memset ((char *)&ev.msg.hdr +sizeof (ev.msg.hdr),0 , + ev.msg.hdr.payload_size); ev.msg.event_data.event =VMCI_EVENT_CTX_REMOVED ; ev.payload.context_id = context_id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/480 pps: fix poll support
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis OSTERLAND-HEIM <[email protected]>
[ Upstream commit 12c409aa1ec2592280a2ddcc66ff8f3c7f7bb171 ]
Because pps_cdev_poll() returns unconditionally EPOLLIN,
a user space program that calls select/poll get always an immediate data ready-to-read response. As a result the intended use to wait until next data becomes ready does not work.
User space snippet:
struct pollfd pollfd = {
.fd = open("/dev/pps0", O_RDONLY),
.events = POLLIN|POLLERR,
.revents = 0 };
while(1) {
poll(&pollfd, 1, 2000/*ms*/); // returns immediate, but should wait
if(revents & EPOLLIN) { // always true
struct pps_fdata fdata;
memset(&fdata, 0, sizeof(memdata));
ioctl(PPS_FETCH, &fdata); // currently fetches data at max speed
}
}Lets remember the last fetch event counter and compare this value in pps_cdev_poll() with most recent event counter
and return 0 if they are equal.
--- drivers/pps/pps.c | 11 +++++++++-- include/linux/pps_kernel.h | 1 + 2 files changed, 10 insertions(+), 2 deletions(-)
drivers/pps/pps.c +9 -2
@@ -41,6 +41,9 @@ static __poll_t pps_cdev_poll(struct file *file, poll_table *wait)poll_wait (file, &pps->queue, wait); +if (pps->last_fetched_ev == pps->last_ev) +return 0 ; +return EPOLLIN |EPOLLRDNORM ; }
@@ -186,9 +189,11 @@ static long pps_cdev_ioctl(struct file *file,if (err)return err; -/* Return the fetched timestamp */ +/* Return the fetched timestamp and save last fetched event */ spin_lock_irq (&pps->lock); + pps->last_fetched_ev = pps->last_ev; + fdata.info.assert_sequence = pps->assert_sequence; fdata.info.clear_sequence = pps->clear_sequence; fdata.info.assert_tu = pps->assert_tu;
@@ -272,9 +277,11 @@ static long pps_cdev_compat_ioctl(struct file *file,if (err)return err; -/* Return the fetched timestamp */ +/* Return the fetched timestamp and save last fetched event */ spin_lock_irq (&pps->lock); + pps->last_fetched_ev = pps->last_ev; + compat.info.assert_sequence = pps->assert_sequence; compat.info.clear_sequence = pps->clear_sequence; compat.info.current_mode = pps->current_mode;
include/linux/pps_kernel.h +1 -0
@@ -52,6 +52,7 @@ struct pps_device {int current_mode;/* PPS mode at event time */ unsigned int last_ev;/* last PPS event id */ +unsigned int last_fetched_ev;/* last fetched PPS event id */ wait_queue_head_t queue;/* PPS event queue */ unsigned int id;/* PPS source unique ID */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/480 arm64: dts: imx8mp-venice-gw74xx: update name of M2SKT_WDIS2# gpio
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
[ Upstream commit 26a6a9cde64a890997708007d9de25809970eac9 ]
The GW74xx D revision has added a M2SKT_WDIS2# GPIO which routes to the W_DISABLE2# pin of the M.2 socket. Update the gpio name for consistency.
--- arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +4 -4
@@ -301,7 +301,7 @@ &gpio2 { &gpio3 { gpio-line-names = "", "", "", "", "", "", "m2_rst", "", - "", "", "", "", "", "", "m2_gpio10", "", + "", "", "", "", "", "", "m2_wdis2#", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""; };
@@ -310,7 +310,7 @@ &gpio4 { gpio-line-names = "", "", "m2_off#", "", "", "", "", "", "", "", "", "", "", "", "", "", - "", "", "m2_wdis#", "", "", "", "", "", + "", "", "m2_wdis1#", "", "", "", "", "", "", "", "", "", "", "", "", "rs485_en"; };
@@ -811,14 +811,14 @@ pinctrl_hog: hoggrp { MX8MP_IOMUXC_GPIO1_IO09__GPIO1_IO09 0x40000040 /* DIO0 */ MX8MP_IOMUXC_GPIO1_IO11__GPIO1_IO11 0x40000040 /* DIO1 */ MX8MP_IOMUXC_SAI1_RXD0__GPIO4_IO02 0x40000040 /* M2SKT_OFF# */ - MX8MP_IOMUXC_SAI1_TXD6__GPIO4_IO18 0x40000150 /* M2SKT_WDIS# */ + MX8MP_IOMUXC_SAI1_TXD6__GPIO4_IO18 0x40000150 /* M2SKT_WDIS1# */ MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 0x40000040 /* M2SKT_PIN20 */ MX8MP_IOMUXC_SD1_STROBE__GPIO2_IO11 0x40000040 /* M2SKT_PIN22 */ MX8MP_IOMUXC_SD2_CLK__GPIO2_IO13 0x40000150 /* PCIE1_WDIS# */ MX8MP_IOMUXC_SD2_CMD__GPIO2_IO14 0x40000150 /* PCIE3_WDIS# */ MX8MP_IOMUXC_SD2_DATA3__GPIO2_IO18 0x40000150 /* PCIE2_WDIS# */ MX8MP_IOMUXC_NAND_DATA00__GPIO3_IO06 0x40000040 /* M2SKT_RST# */ - MX8MP_IOMUXC_NAND_DQS__GPIO3_IO14 0x40000040 /* M2SKT_GPIO10 */ + MX8MP_IOMUXC_NAND_DQS__GPIO3_IO14 0x40000150 /* M2KST_WDIS2# */ MX8MP_IOMUXC_SAI3_TXD__GPIO5_IO01 0x40000104 /* UART_TERM */ MX8MP_IOMUXC_SAI3_TXFS__GPIO4_IO31 0x40000104 /* UART_RS485 */ MX8MP_IOMUXC_SAI3_TXC__GPIO5_IO00 0x40000104 /* UART_HALF */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/480 selftests: vDSO: chacha: Correctly skip test if necessary
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 2c0a4428f5d6005ff0db12057cc35273593fc040 ]
According to kselftest.h ksft_exit_skip() is not meant to be called when a plan has already been printed.
Use the recommended function ksft_test_result_skip().
This fixes a bug, where the TAP output would be invalid when skipping:
TAP version 13
1..1
ok 2 # SKIP Not implemented on architecture
The SKIP line should start with "ok 1" as the plan only contains one test.
--- tools/testing/selftests/vDSO/vdso_test_chacha.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/vDSO/vdso_test_chacha.c +2 -1
@@ -76,7 +76,8 @@ static void reference_chacha20_blocks(uint8_t *dst_bytes, const uint32_t *key, uvoid __weak __arch_chacha20_blocks_nostack (uint8_t *dst_bytes,const uint32_t *key,uint32_t *counter,size_t nblocks) { -ksft_exit_skip ("Not implemented on architecture\n" ); +ksft_test_result_skip ("Not implemented on architecture\n" ); +ksft_finished (); }int main (int argc,char *argv[])
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/480 Revert "vmci: Prevent the dispatching of uninitialized payloads"
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 8f5d9bed6122b8d96508436e5ad2498bb797eb6b ]
This reverts commit bfb4cf9fb97e4063f0aa62e9e398025fb6625031.
While the code "looks" correct, the compiler has no way to know that doing "fun" pointer math like this really isn't a write off the end of the structure as there is no hint anywhere that the structure has data at the end of it.
This causes the following build warning:
In function 'fortify_memset_chk',
inlined from 'ctx_fire_notification.isra' at drivers/misc/vmw_vmci/vmci_context.c:254:3:include/linux/fortify-string.h:480:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
480 | __write_overflow_field(p_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~So revert it for now and it can come back in the future in a "sane" way that either correctly makes the structure know that there is trailing data, OR just the payload structure is properly referenced and zeroed out.
--- drivers/misc/vmw_vmci/vmci_context.c | 2 -- 1 file changed, 2 deletions(-)
drivers/misc/vmw_vmci/vmci_context.c +0 -2
@@ -251,8 +251,6 @@ static int ctx_fire_notification(u32 context_id, u32 priv_flags) ev.msg.hdr.src =vmci_make_handle (VMCI_HYPERVISOR_CONTEXT_ID ,VMCI_CONTEXT_RESOURCE_ID ); ev.msg.hdr.payload_size =sizeof (ev) -sizeof (ev.msg.hdr); -memset ((char *)&ev.msg.hdr +sizeof (ev.msg.hdr),0 , - ev.msg.hdr.payload_size); ev.msg.event_data.event =VMCI_EVENT_CTX_REMOVED ; ev.payload.context_id = context_id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/480 powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sivan Zohar-Kotzer <[email protected]>
[ Upstream commit 46dc57406887dd02565cb264224194a6776d882b ]
The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which propagates through em_cpu_get() and leads to a crash when em_span_cpus() dereferences the NULL pointer.
Add a NULL check after em_cpu_get() and return 0 if unavailable, matching the existing fallback behavior in __dtpm_cpu_setup().
--- drivers/powercap/dtpm_cpu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/powercap/dtpm_cpu.c +2 -0
@@ -96,6 +96,8 @@ static u64 get_pd_power_uw(struct dtpm *dtpm)int i; pd =em_cpu_get (dtpm_cpu->cpu); +if (!pd) +return 0 ; pd_mask =em_span_cpus (pd);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/480 usb: early: xhci-dbc: Fix early_ioremap leak
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <[email protected]>
[ Upstream commit 2b7eec2ec3015f52fc74cf45d0408925e984ecd1 ]
Using the kernel param earlyprintk=xdbc,keep without proper hardware setup leads to this:
[ ] xhci_dbc:early_xdbc_parse_parameter: dbgp_num: 0 ... [ ] xhci_dbc:early_xdbc_setup_hardware: failed to setup the connection to host ... [ ] calling kmemleak_late_init+0x0/0xa0 @ 1 [ ] kmemleak: Kernel memory leak detector initialized (mem pool available: 14919) [ ] kmemleak: Automatic memory scanning thread started [ ] initcall kmemleak_late_init+0x0/0xa0 returned 0 after 417 usecs [ ] calling check_early_ioremap_leak+0x0/0x70 @ 1 [ ] ------------[ cut here ]------------ [ ] Debug warning: early ioremap leak of 1 areas detected. please boot with early_ioremap_debug and report the dmesg. [ ] WARNING: CPU: 11 PID: 1 at mm/early_ioremap.c:90 check_early_ioremap_leak+0x4e/0x70
When early_xdbc_setup_hardware() fails, make sure to call early_iounmap() since xdbc_init() won't handle it.
--- drivers/usb/early/xhci-dbc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/early/xhci-dbc.c +4 -0
@@ -681,6 +681,10 @@ int __init early_xdbc_setup_hardware(void) xdbc.table_base =NULL ; xdbc.out_buf =NULL ; + +early_iounmap (xdbc.xhci_base, xdbc.xhci_length); + xdbc.xhci_base =NULL ; + xdbc.xhci_length =0 ; }return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/480 arm: dts: ti: omap: Fixup pinheader typo
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Albin Törnqvist <[email protected]>
[ Upstream commit a3a4be32b69c99fc20a66e0de83b91f8c882bf4c ]
This commit fixes a typo introduced in commitee368a10d0df ("ARM: dts: am335x-boneblack.dts: unique gpio-line-names"). gpio0_7 is located on the P9 header on the BBB.
This was verified with a BeagleBone Black by toggling the pin and checking with a multimeter that it corresponds to pin 42 on the P9 header.
--- arch/arm/boot/dts/ti/omap/am335x-boneblack.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/ti/omap/am335x-boneblack.dts +1 -1
@@ -35,7 +35,7 @@ &gpio0 { "P9_18 [spi0_d1]", "P9_17 [spi0_cs0]", "[mmc0_cd]", - "P8_42A [ecappwm0]", + "P9_42A [ecappwm0]", "P8_35 [lcd d12]", "P8_33 [lcd d13]", "P8_31 [lcd d14]",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/480 staging: gpib: Fix error code in board_type_ioctl()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
[ Upstream commit aa07b790d79226f9bd0731d2c065db2823867cc5 ]
When copy_from_user() fails it return number of bytes it wasn't able to copy. So the correct return value when copy_from_user() fails is -EFAULT.
--- drivers/staging/gpib/common/gpib_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/gpib/common/gpib_os.c +1 -1
@@ -819,7 +819,7 @@ static int board_type_ioctl(gpib_file_private_t *file_priv, struct gpib_board *b retval =copy_from_user (&cmd, (void __user *)arg,sizeof (board_type_ioctl_t));if (retval) -return retval; +return -EFAULT ;for (list_ptr = registered_drivers.next; list_ptr != ®istered_drivers; list_ptr = list_ptr->next) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/480 staging: gpib: Fix error handling paths in cb_gpib_probe()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 1b0ee85ee7967a4d7a68080c3f6a66af69e4e0b4 ]
If cb_gpib_config() fails, 'info' needs to be freed, as already done in the remove function.
While at it, remove a pointless comment related to gpib_attach().
--- drivers/staging/gpib/cb7210/cb7210.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/staging/gpib/cb7210/cb7210.c +11 -4
@@ -1183,8 +1183,7 @@ struct local_info {static int cb_gpib_probe (struct pcmcia_device *link) {struct local_info *info; - -// int ret, i; +int ret;/* Allocate space for private device-specific data */ info =kzalloc (sizeof (*info),GFP_KERNEL );
@@ -1210,8 +1209,16 @@ static int cb_gpib_probe(struct pcmcia_device *link)/* Register with Card Services */ curr_dev = link; -return cb_gpib_config (link); -}/* gpib_attach */ + ret =cb_gpib_config (link); +if (ret) + goto free_info; + +return 0 ; + +free_info: +kfree (info); +return ret; +}/* * This deletes a driver "instance". The device is de-registered
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/480 soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <[email protected]>
[ Upstream commit a0647bca8966db04b79af72851ebd04224a4da40 ]
When error is injected with the ERR_FORCE register, then this register is not auto cleared on clearing the ERR_STATUS register. This causes repeated interrupts on error injection. To fix, set the ERR_FORCE to zero along with clearing the ERR_STATUS register after handling error.
--- drivers/soc/tegra/cbb/tegra234-cbb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/soc/tegra/cbb/tegra234-cbb.c +2 -0
@@ -185,6 +185,8 @@ static void tegra234_cbb_error_clear(struct tegra_cbb *cbb) {struct tegra234_cbb *priv =to_tegra234_cbb (cbb); +writel (0 , priv->mon +FABRIC_MN_MASTER_ERR_FORCE_0 ); +writel (0x3f , priv->mon +FABRIC_MN_MASTER_ERR_STATUS_0 );dsb (sy); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/480 arm64: dts: rockchip: fix PHY handling for ROCK 4D
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <[email protected]>
[ Upstream commit cd803da7c033e376a66793a43ee98e136bc6cc25 ]
Old revisions of the ROCK 4D board have a dedicated crystal to supply the RTL8211F PHY's 25MHz clock input. At least some newer revisions instead use REFCLKO25M_GMAC0_OUT. The DT already has this half-prepared, but there are some issues:
1. The DT relies on auto-selecting the right PHY driver, which requires that it works good enough to read the ID registers. This does not work without the clock, which is handled by the PHY driver. By updating the compatible to contain the RTL8211F IDs, so that the operating system can choose the right PHY driver without relying on a pre-powered PHY.
2. Despite the name REFCLKO25M_GMAC0_OUT could also provide a different frequency, so ensure it is explicitly set to 25 MHz as expected by the PHY.
3. While at it switch from deprecated "enable-gpio" to standard "enable-gpios".
--- arch/arm64/boot/dts/rockchip/rk3576-rock-4d.dts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3576-rock-4d.dts +4 -2
@@ -641,14 +641,16 @@ hym8563: rtc@51 { &mdio0 { rgmii_phy0: ethernet-phy@1 { - compatible = "ethernet-phy-ieee802.3-c22"; + compatible = "ethernet-phy-id001c.c916"; reg = <0x1>; clocks = <&cru REFCLKO25M_GMAC0_OUT>; + assigned-clocks = <&cru REFCLKO25M_GMAC0_OUT>; + assigned-clock-rates = <25000000>; pinctrl-names = "default"; pinctrl-0 = <&rtl8211f_rst>; reset-assert-us = <20000>; reset-deassert-us = <100000>; - reset-gpio = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>; + reset-gpios = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>; }; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/480 arm64: dts: st: fix timer used for ticks
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Delaunay <[email protected]>
[ Upstream commit 9ec406ac4b7de3e8040a503429d1a5d389bfdaf6 ]
Remove always-on on generic ARM timer as the clock source provided by STGEN is deactivated in low power mode, STOP1 by example.
--- arch/arm64/boot/dts/st/stm32mp251.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/st/stm32mp251.dtsi +1 -1
@@ -150,7 +150,7 @@ timer { <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>; - always-on; + arm,no-tick-in-suspend; }; soc@0 {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/480 selftests: breakpoints: use suspend_stats to reliably check suspend success
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Hee Lee <[email protected]>
[ Upstream commit 07b7c2b4eca3f83ce9cd5ee3fa1c7c001d721c69 ]
The step_after_suspend_test verifies that the system successfully suspended and resumed by setting a timerfd and checking whether the timer fully expired. However, this method is unreliable due to timing races.
In practice, the system may take time to enter suspend, during which the timer may expire just before or during the transition. As a result, the remaining time after resume may show non-zero nanoseconds, even if suspend/resume completed successfully. This leads to false test failures.
Replace the timer-based check with a read from /sys/power/suspend_stats/success. This counter is incremented only after a full suspend/resume cycle, providing a reliable and race-free indicator.
Also remove the unused file descriptor for /sys/power/state, which remained after switching to a system() call to trigger suspend [1].
[1] https://lore.kernel.org/all/[email protected]/
--- .../breakpoints/step_after_suspend_test.c | 41 ++++++++++++++----- 1 file changed, 31 insertions(+), 10 deletions(-)
tools/testing/selftests/breakpoints/step_after_suspend_test.c +31 -10
@@ -127,22 +127,42 @@ int run_test(int cpu)return KSFT_PASS ; } +/* +* Reads the suspend success count from sysfs. +* Returns the count on success or exits on failure. +*/ +static int get_suspend_success_count_or_fail (void ) +{ +FILE *fp; +int val; + + fp =fopen ("/sys/power/suspend_stats/success" ,"r" ); +if (!fp) +ksft_exit_fail_msg ( +"Failed to open suspend_stats/success: %s\n" , +strerror (errno)); + +if (fscanf (fp,"%d" , &val) !=1 ) { +fclose (fp); +ksft_exit_fail_msg ( +"Failed to read suspend success count\n" ); + } + +fclose (fp); +return val; +} +void suspend (void ) { -int power_state_fd;int timerfd;int err; +int count_before; +int count_after;struct itimerspec spec = {};if (getuid () !=0 )ksft_exit_skip ("Please run the test as root - Exiting.\n" ); - power_state_fd =open ("/sys/power/state" ,O_RDWR ); -if (power_state_fd <0 ) -ksft_exit_fail_msg ( -"open(\"/sys/power/state\") failed %s)\n" , -strerror (errno)); - timerfd =timerfd_create (CLOCK_BOOTTIME_ALARM ,0 );if (timerfd <0 )ksft_exit_fail_msg ("timerfd_create() failed\n" );
@@ -152,14 +172,15 @@ void suspend(void)if (err <0 )ksft_exit_fail_msg ("timerfd_settime() failed\n" ); + count_before =get_suspend_success_count_or_fail (); +system ("(echo mem > /sys/power/state) 2> /dev/null" ); -timerfd_gettime (timerfd, &spec); -if (spec.it_value.tv_sec !=0 || spec.it_value.tv_nsec !=0 ) + count_after =get_suspend_success_count_or_fail (); +if (count_after <= count_before)ksft_exit_fail_msg ("Failed to enter Suspend state\n" );close (timerfd); -close (power_state_fd); }int main (int argc,char **argv)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/480 ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Annette Kobou <[email protected]>
[ Upstream commit 47ef5256124fb939d8157b13ca048c902435cf23 ]
The polarity of the DE signal of the transceiver is active-high for sending. Therefore rs485-rts-active-low is wrong and needs to be removed to make RS485 transmissions work.
--- arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx6ul-kontron-bl-common.dtsi +0 -1
@@ -168,7 +168,6 @@ &uart2 { pinctrl-0 = <&pinctrl_uart2>; linux,rs485-enabled-at-boot-time; rs485-rx-during-tx; - rs485-rts-active-low; uart-has-rtscts; status = "okay"; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/480 arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit f83f69097a302ed2a2775975ddcf12e6a5ac6ec3 ]
The reference manual for the i.MX8MM states the clock rate in MMC mode is 1/2 of the input clock, therefore to properly run at HS400 rates, the input clock must be 400MHz to operate at 200MHz. Currently the clock is set to 200MHz which is half the rate it should be, so the throughput is half of what it should be for HS400 operation.
--- arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi +2 -0
@@ -286,6 +286,8 @@ &usdhc3 { pinctrl-0 = <&pinctrl_usdhc3>; pinctrl-1 = <&pinctrl_usdhc3_100mhz>; pinctrl-2 = <&pinctrl_usdhc3_200mhz>; + assigned-clocks = <&clk IMX8MM_CLK_USDHC3>; + assigned-clock-rates = <400000000>; bus-width = <8>; non-removable; status = "okay";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/480 arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit e16ad6c79906bba5e2ac499492b6a5b29ab19d6c ]
The reference manual for the i.MX8MN states the clock rate in MMC mode is 1/2 of the input clock, therefore to properly run at HS400 rates, the input clock must be 400MHz to operate at 200MHz. Currently the clock is set to 200MHz which is half the rate it should be, so the throughput is half of what it should be for HS400 operation.
--- arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi +2 -0
@@ -297,6 +297,8 @@ &usdhc3 { pinctrl-0 = <&pinctrl_usdhc3>; pinctrl-1 = <&pinctrl_usdhc3_100mhz>; pinctrl-2 = <&pinctrl_usdhc3_200mhz>; + assigned-clocks = <&clk IMX8MN_CLK_USDHC3>; + assigned-clock-rates = <400000000>; bus-width = <8>; non-removable; status = "okay";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/480 arm64: dts: rockchip: Fix pinctrl node names for RK3528
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit f2792bf1c7a54ef23fb3a84286b66f427bfc4853 ]
Following warnings can be observed with CHECK_DTBS=y for the RK3528:
rk3528-pinctrl.dtsi:101.36-105.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym0-led_dpx: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:108.38-112.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym0-led_link: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:115.36-119.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym0-led_spd: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:122.36-126.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym1-led_dpx: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:129.38-133.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym1-led_link: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:136.36-140.5: Warning (node_name_chars_strict):
/pinctrl/fephy/fephym1-led_spd: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:782.32-790.5: Warning (node_name_chars_strict):
/pinctrl/rgmii/rgmii-rx_bus2: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:793.32-801.5: Warning (node_name_chars_strict):
/pinctrl/rgmii/rgmii-tx_bus2: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:804.36-810.5: Warning (node_name_chars_strict):
/pinctrl/rgmii/rgmii-rgmii_clk: Character '_' not recommended in node name
rk3528-pinctrl.dtsi:813.36-823.5: Warning (node_name_chars_strict):
/pinctrl/rgmii/rgmii-rgmii_bus: Character '_' not recommended in node name
Rename the affected nodes to fix these warnings.
--- .../boot/dts/rockchip/rk3528-pinctrl.dtsi | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/arm64/boot/dts/rockchip/rk3528-pinctrl.dtsi +10 -10
@@ -98,42 +98,42 @@ eth_pins: eth-pins { fephy { /omit-if-no-ref/ - fephym0_led_dpx: fephym0-led_dpx { + fephym0_led_dpx: fephym0-led-dpx { rockchip,pins = /* fephy_led_dpx_m0 */ <4 RK_PB5 2 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym0_led_link: fephym0-led_link { + fephym0_led_link: fephym0-led-link { rockchip,pins = /* fephy_led_link_m0 */ <4 RK_PC0 2 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym0_led_spd: fephym0-led_spd { + fephym0_led_spd: fephym0-led-spd { rockchip,pins = /* fephy_led_spd_m0 */ <4 RK_PB7 2 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym1_led_dpx: fephym1-led_dpx { + fephym1_led_dpx: fephym1-led-dpx { rockchip,pins = /* fephy_led_dpx_m1 */ <2 RK_PA4 5 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym1_led_link: fephym1-led_link { + fephym1_led_link: fephym1-led-link { rockchip,pins = /* fephy_led_link_m1 */ <2 RK_PA6 5 &pcfg_pull_none>; }; /omit-if-no-ref/ - fephym1_led_spd: fephym1-led_spd { + fephym1_led_spd: fephym1-led-spd { rockchip,pins = /* fephy_led_spd_m1 */ <2 RK_PA5 5 &pcfg_pull_none>;
@@ -779,7 +779,7 @@ rgmii_miim: rgmii-miim { }; /omit-if-no-ref/ - rgmii_rx_bus2: rgmii-rx_bus2 { + rgmii_rx_bus2: rgmii-rx-bus2 { rockchip,pins = /* rgmii_rxd0 */ <3 RK_PA3 2 &pcfg_pull_none>,
@@ -790,7 +790,7 @@ rgmii_rx_bus2: rgmii-rx_bus2 { }; /omit-if-no-ref/ - rgmii_tx_bus2: rgmii-tx_bus2 { + rgmii_tx_bus2: rgmii-tx-bus2 { rockchip,pins = /* rgmii_txd0 */ <3 RK_PA1 2 &pcfg_pull_none_drv_level_2>,
@@ -801,7 +801,7 @@ rgmii_tx_bus2: rgmii-tx_bus2 { }; /omit-if-no-ref/ - rgmii_rgmii_clk: rgmii-rgmii_clk { + rgmii_rgmii_clk: rgmii-rgmii-clk { rockchip,pins = /* rgmii_rxclk */ <3 RK_PA5 2 &pcfg_pull_none>,
@@ -810,7 +810,7 @@ rgmii_rgmii_clk: rgmii-rgmii_clk { }; /omit-if-no-ref/ - rgmii_rgmii_bus: rgmii-rgmii_bus { + rgmii_rgmii_bus: rgmii-rgmii-bus { rockchip,pins = /* rgmii_rxd2 */ <3 RK_PA7 2 &pcfg_pull_none>,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/480 PM / devfreq: Check governor before using governor->name
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit bab7834c03820eb11269bc48f07c3800192460d2 ]
Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But devfreq->governor may be NULL and directly using devfreq->governor->name may cause null pointer exception. Move the check of governor to before using governor->name.
--- drivers/devfreq/devfreq.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/devfreq/devfreq.c +3 -7
@@ -1382,15 +1382,11 @@ int devfreq_remove_governor(struct devfreq_governor *governor)int ret;struct device *dev = devfreq->dev.parent; +if (!devfreq->governor) +continue ; +if (!strncmp (devfreq->governor->name, governor->name,DEVFREQ_NAME_LEN )) { -/* we should have a devfreq governor! */ -if (!devfreq->governor) { -dev_warn (dev,"%s: Governor %s NOT present\n" , - __func__, governor->name); -continue ; -/* Fall through */ - } ret = devfreq->governor->event_handler (devfreq,DEVFREQ_GOV_STOP ,NULL );if (ret) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/480 PM / devfreq: Fix a index typo in trans_stat
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chanwoo Choi <[email protected]>
[ Upstream commit 78c5845fbbf6aaeb9959c5fbaee5cc53ef5f38c2 ]
--- drivers/devfreq/devfreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/devfreq/devfreq.c +1 -1
@@ -1739,7 +1739,7 @@ static ssize_t trans_stat_show(struct device *dev,for (i =0 ; i < max_state; i++) {if (len >=PAGE_SIZE -1 )break ; -if (df->freq_table[2 ] == df->previous_freq) +if (df->freq_table[i] == df->previous_freq) len +=sysfs_emit_at (buf, len,"*" );else len +=sysfs_emit_at (buf, len," " );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/480 cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 1cefe495cacba5fb0417da3a75a1a76e3546d176 ]
In the passive mode, intel_cpufreq_update_pstate() sets HWP_MIN_PERF in accordance with the target frequency to ensure delivering adequate performance, but it sets HWP_DESIRED_PERF to 0, so the processor has no indication that the desired performance level is actually equal to the floor one. This may cause it to choose a performance point way above the desired level.
Moreover, this is inconsistent with intel_cpufreq_adjust_perf() which actually sets HWP_DESIRED_PERF in accordance with the target performance value.
Address this by adjusting intel_cpufreq_update_pstate() to pass target_pstate as both the minimum and the desired performance levels to intel_cpufreq_hwp_update().
--- drivers/cpufreq/intel_pstate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpufreq/intel_pstate.c +2 -2
@@ -3130,8 +3130,8 @@ static int intel_cpufreq_update_pstate(struct cpufreq_policy *policy,int max_pstate = policy->strict_target ? target_pstate : cpu->max_perf_ratio; -intel_cpufreq_hwp_update (cpu, target_pstate, max_pstate,0 , - fast_switch); +intel_cpufreq_hwp_update (cpu, target_pstate, max_pstate, + target_pstate, fast_switch); }else if (target_pstate != old_pstate) {intel_cpufreq_perf_ctl_update (cpu, target_pstate, fast_switch); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/480 cpufreq: Initialize cpufreq-based frequency-invariance later
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 2a6c727387062a2ea79eb6cf5004820cb1b0afe2 ]
The cpufreq-based invariance is enabled in cpufreq_register_driver(), but never disabled after registration fails. Move the invariance initialization to where all other initializations have been successfully done to solve this problem.
--- drivers/cpufreq/cpufreq.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/cpufreq/cpufreq.c +9 -9
@@ -3009,15 +3009,6 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) cpufreq_driver = driver_data;write_unlock_irqrestore (&cpufreq_driver_lock, flags); -/* -* Mark support for the scheduler's frequency invariance engine for -* drivers that implement target(), target_index() or fast_switch(). -*/ -if (!cpufreq_driver->setpolicy) { -static_branch_enable_cpuslocked (&cpufreq_freq_invariance); -pr_debug ("supports frequency invariance" ); - } -if (driver_data->setpolicy) driver_data->flags |=CPUFREQ_CONST_LOOPS ;
@@ -3048,6 +3039,15 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) hp_online = ret; ret =0 ; +/* +* Mark support for the scheduler's frequency invariance engine for +* drivers that implement target(), target_index() or fast_switch(). +*/ +if (!cpufreq_driver->setpolicy) { +static_branch_enable_cpuslocked (&cpufreq_freq_invariance); +pr_debug ("supports frequency invariance" ); + } +pr_debug ("driver %s up and running\n" , driver_data->name); goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/480 cpufreq: Init policy->rwsem before it may be possibly used
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit d1378d1d7edb3a4c4935a44fe834ae135be03564 ]
In cpufreq_policy_put_kobj(), policy->rwsem is used. But in cpufreq_policy_alloc(), if freq_qos_add_notifier() returns an error, error path via err_kobj_remove or err_min_qos_notifier will be reached and cpufreq_policy_put_kobj() will be called before policy->rwsem is initialized. Thus, the calling of init_rwsem() should be moved to where before these two error paths can be reached.
--- drivers/cpufreq/cpufreq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/cpufreq/cpufreq.c +2 -1
@@ -1323,6 +1323,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu) goto err_free_real_cpus; } +init_rwsem (&policy->rwsem); +freq_constraints_init (&policy->constraints); policy->nb_min.notifier_call = cpufreq_notifier_min;
@@ -1345,7 +1347,6 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu) }INIT_LIST_HEAD (&policy->policy_list); -init_rwsem (&policy->rwsem);spin_lock_init (&policy->transition_lock);init_waitqueue_head (&policy->transition_wait);INIT_WORK (&policy->update, handle_update);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/480 ASoC: SDCA: Allow read-only controls to be deferrable
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 4eb6ad5d2080681b531db2c1764246f9a868062f ]
The current SDCA Control parsing only checks the deferrable flag for Read/Write and Dual Ranked controls. However, reads can defer as well as writes so Read Only controls should also check for the deferrable flag. Add the handling for this into find_sdca_entity_control().
--- sound/soc/sdca/sdca_functions.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/sdca/sdca_functions.c +2 -1
@@ -880,7 +880,8 @@ static int find_sdca_entity_control(struct device *dev, struct sdca_entity *enti control->value = tmp; control->has_fixed = true; } - + fallthrough; +case SDCA_ACCESS_MODE_RO : control->deferrable =fwnode_property_read_bool (control_node,"mipi-sdca-control-deferrable" );break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/480 staging: greybus: gbphy: fix up const issue with the match callback
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit ce32eff1cf3ae8ac2596171dd0af1657634c83eb ]
gbphy_dev_match_id() should be taking a const pointer, as the pointer passed to it from the container_of() call was const to start with (it was accidentally cast away with the call.) Fix this all up by correctly marking the pointer types.
--- drivers/staging/greybus/gbphy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/greybus/gbphy.c +3 -3
@@ -102,8 +102,8 @@ static int gbphy_dev_uevent(const struct device *dev, struct kobj_uevent_env *en }static const struct gbphy_device_id * -gbphy_dev_match_id (struct gbphy_device *gbphy_dev, -struct gbphy_driver *gbphy_drv) +gbphy_dev_match_id (const struct gbphy_device *gbphy_dev, +const struct gbphy_driver *gbphy_drv) {const struct gbphy_device_id *id = gbphy_drv->id_table;
@@ -119,7 +119,7 @@ gbphy_dev_match_id(struct gbphy_device *gbphy_dev,static int gbphy_dev_match (struct device *dev,const struct device_driver *drv) { -struct gbphy_driver *gbphy_drv =to_gbphy_driver (drv); +const struct gbphy_driver *gbphy_drv =to_gbphy_driver (drv);struct gbphy_device *gbphy_dev =to_gbphy_dev (dev);const struct gbphy_device_id *id;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/480 samples: mei: Fix building on musl libc
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 239df3e4b4752524e7c0fb3417c218d8063654b4 ]
The header bits/wordsize.h is glibc specific and on building on musl with allyesconfig results in
samples/mei/mei-amt-version.c:77:10: fatal error: bits/wordsize.h: No such file or directory
77 | #include <bits/wordsize.h>
| ^~~~~~~~~~~~~~~~~
mei-amt-version.c build file without bits/wordsize.h on musl and glibc.
However on musl we get the follwing error without sys/time.h
samples/mei/mei-amt-version.c: In function 'mei_recv_msg':samples/mei/mei-amt-version.c:159:24: error: storage size of 'tv' isn't known
159 | struct timeval tv;
| ^~samples/mei/mei-amt-version.c:160:9: error: unknown type name 'fd_set'
160 | fd_set set;
| ^~~~~~
samples/mei/mei-amt-version.c:168:9: error: implicit declaration of function 'FD_ZERO' [-Wimplicit-function-declaration]
168 | FD_ZERO(&set);
| ^~~~~~~
samples/mei/mei-amt-version.c:169:9: error: implicit declaration of function 'FD_SET'; did you mean 'L_SET'? [-Wimplicit-function-declaration]
169 | FD_SET(me->fd, &set);
| ^~~~~~
| L_SET
samples/mei/mei-amt-version.c:170:14: error: implicit declaration of function 'select' [-Wimplicit-function-declaration]
170 | rc = select(me->fd + 1, &set, NULL, NULL, &tv);
| ^~~~~~
samples/mei/mei-amt-version.c:171:23: error: implicit declaration of function 'FD_ISSET' [-Wimplicit-function-declaration]
171 | if (rc > 0 && FD_ISSET(me->fd, &set)) {
| ^~~~~~~~samples/mei/mei-amt-version.c:159:24: warning: unused variable 'tv' [-Wunused-variable]
159 | struct timeval tv;
| ^~
Hence the the file has been included.
--- samples/mei/mei-amt-version.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/mei/mei-amt-version.c +1 -1
@@ -69,11 +69,11 @@#include <string.h> #include <fcntl.h> #include <sys/ioctl.h> +#include <sys/time.h> #include <unistd.h> #include <errno.h> #include <stdint.h> #include <stdbool.h> -#include <bits/wordsize.h> #include <linux/mei.h> /*****************************************************************************
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/480 soc: qcom: pmic_glink: fix OF node leak
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 65702c3d293e45d3cac5e4e175296a9c90404326 ]
Make sure to drop the OF node reference taken when registering the auxiliary devices when the devices are later released.
--- drivers/soc/qcom/pmic_glink.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/soc/qcom/pmic_glink.c +7 -2
@@ -167,7 +167,10 @@ static int pmic_glink_rpmsg_callback(struct rpmsg_device *rpdev, void *data,return 0 ; } -static void pmic_glink_aux_release (struct device *dev) {} +static void pmic_glink_aux_release (struct device *dev) +{ +of_node_put (dev->of_node); +} static int pmic_glink_add_aux_device(struct pmic_glink *pg, struct auxiliary_device *aux,
@@ -181,8 +184,10 @@ static int pmic_glink_add_aux_device(struct pmic_glink *pg, aux->dev.release = pmic_glink_aux_release;device_set_of_node_from_dev (&aux->dev, parent); ret =auxiliary_device_init (aux); -if (ret) +if (ret) { +of_node_put (aux->dev.of_node);return ret; + } ret =auxiliary_device_add (aux);if (ret)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/480 interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 02ee375506dceb7d32007821a2bff31504d64b99 ]
The qnm_a1noc_cfg declaration didn't include .num_links definition, fix it.
--- drivers/interconnect/qcom/sc8280xp.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sc8280xp.c +1 -0
@@ -48,6 +48,7 @@ static struct qcom_icc_node qnm_a1noc_cfg = { .id = SC8280XP_MASTER_A1NOC_CFG, .channels = 1, .buswidth = 4, + .num_links = 1, .links = { SC8280XP_SLAVE_SERVICE_A1NOC }, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/480 interconnect: qcom: sc8180x: specify num_nodes
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7e0b59496a02d25828612721e846ea4b717a97b9 ]
Specify .num_nodes for several BCMs which missed this declaration.
--- drivers/interconnect/qcom/sc8180x.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/interconnect/qcom/sc8180x.c +6 -0
@@ -1492,34 +1492,40 @@ static struct qcom_icc_bcm bcm_sh3 = {static struct qcom_icc_bcm bcm_sn0 = { .name ="SN0" , + .num_nodes =1 , .nodes = { &slv_qns_gemnoc_sf } };static struct qcom_icc_bcm bcm_sn1 = { .name ="SN1" , + .num_nodes =1 , .nodes = { &slv_qxs_imem } };static struct qcom_icc_bcm bcm_sn2 = { .name ="SN2" , .keepalive = true, + .num_nodes =1 , .nodes = { &slv_qns_gemnoc_gc } };static struct qcom_icc_bcm bcm_co2 = { .name ="CO2" , + .num_nodes =1 , .nodes = { &mas_qnm_npu } };static struct qcom_icc_bcm bcm_sn3 = { .name ="SN3" , .keepalive = true, + .num_nodes =2 , .nodes = { &slv_srvc_aggre1_noc, &slv_qns_cnoc } };static struct qcom_icc_bcm bcm_sn4 = { .name ="SN4" , + .num_nodes =1 , .nodes = { &slv_qxs_pimem } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/480 interconnect: qcom: qcs615: Drop IP0 interconnects
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit cbabc73e85be9e706a5051c9416de4a8d391cf57 ]
In the same spirit as e.g. Commit b136d257ee0b ("interconnect: qcom:
sc8280xp: Drop IP0 interconnects"), drop the resources that should be taken care of through the clk-rpmh driver.
--- drivers/interconnect/qcom/qcs615.c | 42 ------------------------------ 1 file changed, 42 deletions(-)
drivers/interconnect/qcom/qcs615.c +0 -42
@@ -342,15 +342,6 @@ static struct qcom_icc_node qnm_snoc_sf = { .links = { QCS615_SLAVE_LLCC }, }; -static struct qcom_icc_node ipa_core_master = { - .name ="ipa_core_master" , - .id =QCS615_MASTER_IPA_CORE , - .channels =1 , - .buswidth =8 , - .num_links =1 , - .links = {QCS615_SLAVE_IPA_CORE }, -}; -static struct qcom_icc_node llcc_mc = { .name ="llcc_mc" , .id = QCS615_MASTER_LLCC,
@@ -942,14 +933,6 @@ static struct qcom_icc_node srvc_gemnoc = { .num_links = 0, }; -static struct qcom_icc_node ipa_core_slave = { - .name ="ipa_core_slave" , - .id =QCS615_SLAVE_IPA_CORE , - .channels =1 , - .buswidth =8 , - .num_links =0 , -}; -static struct qcom_icc_node ebi = { .name ="ebi" , .id =QCS615_SLAVE_EBI1 ,
@@ -1113,12 +1096,6 @@ static struct qcom_icc_bcm bcm_cn1 = { &qhs_sdc1, &qhs_sdc2 }, }; -static struct qcom_icc_bcm bcm_ip0 = { - .name ="IP0" , - .num_nodes =1 , - .nodes = { &ipa_core_slave }, -}; -static struct qcom_icc_bcm bcm_mc0 = { .name ="MC0" , .keepalive = true,
@@ -1260,7 +1237,6 @@ static struct qcom_icc_bcm * const aggre1_noc_bcms[] = { &bcm_qup0, &bcm_sn3, &bcm_sn14, - &bcm_ip0, }; static struct qcom_icc_node * const aggre1_noc_nodes[] = {
@@ -1411,22 +1387,6 @@ static const struct qcom_icc_desc qcs615_gem_noc = { .num_bcms = ARRAY_SIZE(gem_noc_bcms), }; -static struct qcom_icc_bcm *const ipa_virt_bcms[] = { - &bcm_ip0, -}; - -static struct qcom_icc_node *const ipa_virt_nodes[] = { - [MASTER_IPA_CORE ] = &ipa_core_master, - [SLAVE_IPA_CORE ] = &ipa_core_slave, -}; - -static const struct qcom_icc_desc qcs615_ipa_virt = { - .nodes = ipa_virt_nodes, - .num_nodes =ARRAY_SIZE (ipa_virt_nodes), - .bcms = ipa_virt_bcms, - .num_bcms =ARRAY_SIZE (ipa_virt_bcms), -}; -static struct qcom_icc_bcm *const mc_virt_bcms[] = { &bcm_acv, &bcm_mc0,
@@ -1525,8 +1485,6 @@ static const struct of_device_id qnoc_of_match[] = { .data = &qcs615_dc_noc}, { .compatible = "qcom,qcs615-gem-noc", .data = &qcs615_gem_noc}, - { .compatible = "qcom,qcs615-ipa-virt", - .data = &qcs615_ipa_virt}, { .compatible = "qcom,qcs615-mc-virt", .data = &qcs615_mc_virt}, { .compatible = "qcom,qcs615-mmss-noc",
Signature · 1 line
2.39.5
Re: [PATCH 6.15 093/480] interconnect: qcom: qcs615: Drop IP0 interconnects
Quoted 12 lines · Greg Kroah-Hartman
6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit
cbabc73e85be9e706a5051c9416de4a8d391cf57]In the same spirit as e.g. Commit
b136d257ee0b("interconnect: qcom:
sc8280xp: Drop IP0 interconnects"), drop the resources that should be taken care of through the clk-rpmh driver.
Quoted 7 lines
Fixes 77d79677b04b ("interconnect: qcom: add QCS615 interconnect provider driver")Signed-off-by Konrad Dybcio <[email protected]>Reviewed-by Dmitry Baryshkov <[email protected]>Signed-off-by Georgi Djakov <[email protected]>Signed-off-by Sasha Levin <[email protected]>---
Please drop, this has cross-dependencies and even if we applied all of them, the series had no visible impact
Konrad
Greg Kroah-Hartman
maintainerPATCH 94/480 bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
[ Upstream commit ae5a34264354087aef38cdd07961827482a51c5a ]
T99W640 was mistakenly mentioned as T99W515. T99W515 is a LGA device, not a M.2 modem device. So correct it's name to avoid name mismatch issue.
--- drivers/bus/mhi/host/pci_generic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/bus/mhi/host/pci_generic.c +4 -4
@@ -593,8 +593,8 @@ static const struct mhi_pci_dev_info mhi_foxconn_dw5932e_info = { .sideband_wake = false, }; -static const struct mhi_pci_dev_info mhi_foxconn_t99w515_info = { - .name ="foxconn-t99w515" , +static const struct mhi_pci_dev_info mhi_foxconn_t99w640_info = { + .name ="foxconn-t99w640" , .edl ="qcom/sdx72m/foxconn/edl.mbn" , .edl_trigger = true, .config = &modem_foxconn_sdx72_config,
@@ -920,9 +920,9 @@ static const struct pci_device_id mhi_pci_id_table[] = {/* DW5932e (sdx62), Non-eSIM */ { PCI_DEVICE(PCI_VENDOR_ID_FOXCONN, 0xe0f9), .driver_data = (kernel_ulong_t) &mhi_foxconn_dw5932e_info }, -/* T99W515 (sdx72) */ +/* T99W640 (sdx72) */ { PCI_DEVICE(PCI_VENDOR_ID_FOXCONN, 0xe118), - .driver_data = (kernel_ulong_t) &mhi_foxconn_t99w515_info }, + .driver_data = (kernel_ulong_t) &mhi_foxconn_t99w640_info },/* DW5934e(sdx72), With eSIM */ { PCI_DEVICE(PCI_VENDOR_ID_FOXCONN, 0xe11d), .driver_data = (kernel_ulong_t) &mhi_foxconn_dw5934e_info },
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/480 drm/xe: Correct the rev value for the DVSEC entries
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <[email protected]>
[ Upstream commit 0ba9e9cf76f2487654bc9bca38218780fa53030e ]
By definition, the Designated Vendor Specific Extended Capability (DVSEC) revision should be 1.
Add the rev value to be correct.
--- drivers/gpu/drm/xe/xe_vsec.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/xe/xe_vsec.c +3 -0
@@ -24,6 +24,7 @@#define BMG_DEVICE_ID 0xE2F8static struct intel_vsec_header bmg_telemetry = { + .rev =1 , .length =0x10 , .id =VSEC_ID_TELEMETRY , .num_entries =2 ,
@@ -33,6 +34,7 @@ static struct intel_vsec_header bmg_telemetry = { };static struct intel_vsec_header bmg_punit_crashlog = { + .rev =1 , .length =0x10 , .id =VSEC_ID_CRASHLOG , .num_entries =1 ,
@@ -42,6 +44,7 @@ static struct intel_vsec_header bmg_punit_crashlog = { };static struct intel_vsec_header bmg_oobmsm_crashlog = { + .rev =1 , .length =0x10 , .id =VSEC_ID_CRASHLOG , .num_entries =1 ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/480 drm/xe: Correct BMG VSEC header sizing
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <[email protected]>
[ Upstream commit 5b27388171a18cf6842c700520086ec50194e858 ]
The intel_vsec_header information for the crashlog feature is incorrect.
Update the VSEC header with correct sizing and count.
Since the crashlog entries are "merged" (num_entries = 2), the separate capabilities entries must be merged as well.
--- drivers/gpu/drm/xe/xe_vsec.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-)
drivers/gpu/drm/xe/xe_vsec.c +4 -15
@@ -33,30 +33,19 @@ static struct intel_vsec_header bmg_telemetry = { .offset = BMG_DISCOVERY_OFFSET, }; -static struct intel_vsec_header bmg_punit_crashlog = { +static struct intel_vsec_header bmg_crashlog = { .rev =1 , .length =0x10 , .id =VSEC_ID_CRASHLOG , - .num_entries =1 , - .entry_size =4 , + .num_entries =2 , + .entry_size =6 , .tbir =0 , .offset =BMG_DISCOVERY_OFFSET +0x60 , }; -static struct intel_vsec_header bmg_oobmsm_crashlog = { - .rev =1 , - .length =0x10 , - .id =VSEC_ID_CRASHLOG , - .num_entries =1 , - .entry_size =4 , - .tbir =0 , - .offset =BMG_DISCOVERY_OFFSET +0x78 , -}; -static struct intel_vsec_header *bmg_capabilities[] = { &bmg_telemetry, - &bmg_punit_crashlog, - &bmg_oobmsm_crashlog, + &bmg_crashlog,NULL };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/480 staging: nvec: Fix incorrect null termination of battery manufacturer
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit a8934352ba01081c51d2df428e9d540aae0e88b5 ]
The battery manufacturer string was incorrectly null terminated using bat_model instead of bat_manu. This could result in an unintended write to the wrong field and potentially incorrect behavior.
fixe the issue by correctly null terminating the bat_manu string.
--- drivers/staging/nvec/nvec_power.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/nvec/nvec_power.c +1 -1
@@ -194,7 +194,7 @@ static int nvec_power_bat_notifier(struct notifier_block *nb,break ;case MANUFACTURER :memcpy (power->bat_manu, &res->plc, res->length -2 ); - power->bat_model[res->length -2 ] ='\0' ; + power->bat_manu[res->length -2 ] ='\0' ;break ;case MODEL :memcpy (power->bat_model, &res->plc, res->length -2 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/480 selftests/tracing: Fix false failure of subsystem event test
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit 213879061a9c60200ba971330dbefec6df3b4a30 ]
The subsystem event test enables all "sched" events and makes sure there's at least 3 different events in the output. It used to cat the entire trace file to | wc -l, but on slow machines, that could last a very long time. To solve that, it was changed to just read the first 100 lines of the trace file. This can cause false failures as some events repeat so often, that the 100 lines that are examined could possibly be of only one event.
Instead, create an awk script that looks for 3 different events and will exit out after it finds them. This will find the 3 events the test looks for (eventually if it works), and still exit out after the test is satisfied and not cause slower machines to run forever.
--- .../ftrace/test.d/event/subsystem-enable.tc | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-)
tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc +26 -2
@@ -14,11 +14,35 @@ fail() { #msg exit_fail } +# As reading trace can last forever, simply look for 3 different +# events then exit out of reading the file. If there's not 3 different +# events, then the test has failed. +check_unique() { + cat trace | grep -v '^#' | awk ' + BEGIN { cnt = 0; } + { + for (i = 0; i < cnt; i++) { + if (event[i] == $5) { + break; + } + } + if (i == cnt) { + event[cnt++] = $5; + if (cnt > 2) { + exit; + } + } + } + END { + printf "%d", cnt; + }' +} + echo 'sched:*' > set_event yield -count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`check_unique` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
@@ -29,7 +53,7 @@ echo 1 > events/sched/enable yield -count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`check_unique` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/480 drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Yan <[email protected]>
[ Upstream commit 099593a28138b48feea5be8ce700e5bc4565e31d ]
In the function drm_gem_fb_init_with_funcs, the framebuffer (fb) and its corresponding object ID have already been registered.
So we need to cleanup the drm framebuffer if the subsequent execution of drm_gem_fb_afbc_init fails.
Directly call drm_framebuffer_put to ensure that all fb related resources are cleanup.
--- drivers/gpu/drm/rockchip/rockchip_drm_fb.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/gpu/drm/rockchip/rockchip_drm_fb.c +1 -8
@@ -52,16 +52,9 @@ rockchip_fb_create(struct drm_device *dev, struct drm_file *file, }if (drm_is_afbc (mode_cmd->modifier[0 ])) { -int ret, i; - ret =drm_gem_fb_afbc_init (dev, mode_cmd, afbc_fb);if (ret) { -struct drm_gem_object **obj = afbc_fb->base.obj; - -for (i =0 ; i < info->num_planes; ++i) -drm_gem_object_put (obj[i]); - -kfree (afbc_fb); +drm_framebuffer_put (&afbc_fb->base);return ERR_PTR (ret); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/480 drm/connector: hdmi: Evaluate limited range after computing format
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 21f627139652dd8329a88e281df6600f3866d238 ]
Evaluating the requirement to use a limited RGB quantization range involves a verification of the output format, among others, but this is currently performed before actually computing the format, hence relying on the old connector state.
Move the call to hdmi_is_limited_range() after hdmi_compute_config() to ensure the verification is done on the updated output format.
--- drivers/gpu/drm/display/drm_hdmi_state_helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/display/drm_hdmi_state_helper.c +2 -2
@@ -506,12 +506,12 @@ int drm_atomic_helper_connector_hdmi_check(struct drm_connector *connector,if (!new_conn_state->crtc || !new_conn_state->best_encoder)return 0 ; - new_conn_state->hdmi.is_limited_range =hdmi_is_limited_range (connector, new_conn_state); - ret =hdmi_compute_config (connector, new_conn_state, mode);if (ret)return ret; + new_conn_state->hdmi.is_limited_range =hdmi_is_limited_range (connector, new_conn_state); + ret =hdmi_generate_infoframes (connector, new_conn_state);if (ret)return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/480 drm/panfrost: Fix panfrost device variable name in devfreq
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit 6048f5587614bb4919c54966913452c1a0a43138 ]
Commit 64111a0e22a9 ("drm/panfrost: Fix incorrect updating of current device frequency") was a Panfrost port of a similar fix in Panthor.
Fix the Panfrost device pointer variable name so that it follows Panfrost naming conventions.
--- drivers/gpu/drm/panfrost/panfrost_devfreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panfrost/panfrost_devfreq.c +2 -2
@@ -29,7 +29,7 @@ static void panfrost_devfreq_update_utilization(struct panfrost_devfreq *pfdevfrstatic int panfrost_devfreq_target (struct device *dev,unsigned long *freq,u32 flags) { -struct panfrost_device *ptdev =dev_get_drvdata (dev); +struct panfrost_device *pfdev =dev_get_drvdata (dev);struct dev_pm_opp *opp;int err;
@@ -40,7 +40,7 @@ static int panfrost_devfreq_target(struct device *dev, unsigned long *freq, err =dev_pm_opp_set_rate (dev, *freq);if (!err) - ptdev->pfdevfreq.current_frequency = *freq; + pfdev->pfdevfreq.current_frequency = *freq;return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/480 drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <[email protected]>
[ Upstream commit 95cbab48782bf62e4093837dc15ac6133902c12f ]
drm_panthor_gpu_info::shader_present is currently automatically offset by 4 byte to meet Arm's 32-bit/64-bit field alignment rules, but those constraints don't stand on 32-bit x86 and cause a mismatch when running an x86 binary in a user emulated environment like FEX. It's also generally agreed that uAPIs should explicitly pad their struct fields, which we originally intended to do, but a mistake slipped through during the submission process, leading drm_panthor_gpu_info::shader_present to be misaligned.
This uAPI change doesn't break any of the existing users of panthor which are either arm32 or arm64 where the 64-bit alignment of u64 fields is already enforced a the compiler level.
Changes in v2:
- Rename the garbage field into pad0 and adjust the comment accordingly
- Add Liviu's A-b
Changes in v3:
- Add R-bs
--- include/uapi/drm/panthor_drm.h | 3 +++ 1 file changed, 3 insertions(+)
include/uapi/drm/panthor_drm.h +3 -0
@@ -293,6 +293,9 @@ struct drm_panthor_gpu_info {/** @as_present: Bitmask encoding the number of address-space exposed by the MMU. */ __u32 as_present; +/** @pad0: MBZ. */ +__u32 pad0; +/** @shader_present: Bitmask encoding the shader cores exposed by the GPU. */ __u64 shader_present;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/480 wifi: rtw89: fix EHT 20MHz TX rate for non-AP STA
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Chung Chen <[email protected]>
[ Upstream commit fe30a8ae853bade282fce63e740b5f34bdc55f6e ]
The 4-octet EHT MCS/NSS subfield is only used for 20 MHz-only non-AP STA. Correct the interpretation of this subfield to prevent improper rate limitations.
--- drivers/net/wireless/realtek/rtw89/phy.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/net/wireless/realtek/rtw89/phy.c +7 -5
@@ -119,10 +119,12 @@ static u64 get_eht_mcs_ra_mask(u8 *max_nss, u8 start_mcs, u8 n_nss)return mask; } -static u64 get_eht_ra_mask (struct ieee80211_link_sta *link_sta) +static u64 get_eht_ra_mask (struct rtw89_vif_link *rtwvif_link, +struct ieee80211_link_sta *link_sta) { -struct ieee80211_sta_eht_cap *eht_cap = &link_sta->eht_cap; +struct ieee80211_vif *vif =rtwvif_link_to_vif (rtwvif_link);struct ieee80211_eht_mcs_nss_supp_20mhz_only *mcs_nss_20mhz; +struct ieee80211_sta_eht_cap *eht_cap = &link_sta->eht_cap;struct ieee80211_eht_mcs_nss_supp_bw *mcs_nss;u8 *he_phy_cap = link_sta->he_cap.he_cap_elem.phy_cap_info;
@@ -136,8 +138,8 @@ static u64 get_eht_ra_mask(struct ieee80211_link_sta *link_sta)/* MCS 9, 11, 13 */ return get_eht_mcs_ra_mask (mcs_nss->rx_tx_max_nss,9 ,3 );case IEEE80211_STA_RX_BW_20 : -if (!(he_phy_cap[0 ] & -IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK_ALL )) { +if (vif->type ==NL80211_IFTYPE_AP && + !(he_phy_cap[0 ] &IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK_ALL )) { mcs_nss_20mhz = &eht_cap->eht_mcs_nss_supp.only_20mhz;/* MCS 7, 9, 11, 13 */ return get_eht_mcs_ra_mask (mcs_nss_20mhz->rx_tx_max_nss,7 ,4 );
@@ -332,7 +334,7 @@ static void rtw89_phy_ra_sta_update(struct rtw89_dev *rtwdev,/* Set the ra mask from sta's capability */ if (link_sta->eht_cap.has_eht) { mode |=RTW89_RA_MODE_EHT ; - ra_mask |=get_eht_ra_mask (link_sta); + ra_mask |=get_eht_ra_mask (rtwvif_link, link_sta);if (rtwdev->hal.no_mcs_12_13) high_rate_masks = rtw89_ra_mask_eht_mcs0_11;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/480 bpf, sockmap: Fix psock incorrectly pointing to sk
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 76be5fae32febb1fdb848ba09f78c4b2c76cb337 ]
We observed an issue from the latest selftest: sockmap_redir where sk_psock(psock->sk) != psock in the backlog. The root cause is the special behavior in sockmap_redir - it frequently performs map_update() and map_delete() on the same socket. During map_update(), we create a new psock and during map_delete(), we eventually free the psock via rcu_work in sk_psock_drop(). However, pending workqueues might still exist and not be processed yet. If users immediately perform another map_update(), a new psock will be allocated for the same sk, resulting in two psocks pointing to the same sk.
When the pending workqueue is later triggered, it uses the old psock to access sk for I/O operations, which is incorrect.
Timing Diagram:
cpu0 cpu1
map_update(sk):
sk->psock = psock1
psock1->sk = skmap_delete(sk):
rcu_work_free(psock1)
map_update(sk):
sk->psock = psock2
psock2->sk = sk
workqueue:
wakeup with psock1, but the sk of psock1 doesn't belong to psock1rcu_handler:
clean psock1
free(psock1)
Previously, we used reference counting to address the concurrency issue between backlog and sock_map_close(). This logic remains necessary as it prevents the sk from being freed while processing the backlog. But this patch prevents pending backlogs from using a psock after it has been stopped.
Note: We cannot call cancel_delayed_work_sync() in map_delete() since this might be invoked in BPF context by BPF helper, and the function may sleep.
--- net/core/skmsg.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/core/skmsg.c +7 -0
@@ -656,6 +656,13 @@ static void sk_psock_backlog(struct work_struct *work)bool ingress;int ret; +/* If sk is quickly removed from the map and then added back, the old +* psock should not be scheduled, because there are now two psocks +* pointing to the same sk. +*/ +if (!sk_psock_test_state (psock,SK_PSOCK_TX_ENABLED )) +return ; +/* Increment the psock refcnt to synchronize with close(fd) path in * sock_map_close(), ensuring we wait for backlog thread completion * before sk_socket freed. If refcnt increment fails, it indicates
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/480 netconsole: Only register console drivers when targets are configured
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit bc0cb64db1c765a81f69997d5a28f539e1731bc0 ]
The netconsole driver currently registers the basic console driver unconditionally during initialization, even when only extended targets are configured. This results in unnecessary console registration and performance overhead, as the write_msg() callback is invoked for every log message only to return early when no matching targets are found.
Optimize the driver by conditionally registering console drivers based on the actual target configuration. The basic console driver is now registered only when non-extended targets exist, same as the extended console. The implementation also handles dynamic target creation through the configfs interface.
This change eliminates unnecessary console driver registrations, redundant write_msg() callbacks for unused console types, and associated lock contention and target list iterations. The optimization is particularly beneficial for systems using only the most common extended console type.
--- drivers/net/netconsole.c | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-)
drivers/net/netconsole.c +22 -8
@@ -86,10 +86,10 @@ static DEFINE_SPINLOCK(target_list_lock);static DEFINE_MUTEX (target_cleanup_list_lock);/* -* Console driver for extended netconsoles. Registered on the first use to -* avoid unnecessarily enabling ext message formatting. +* Console driver for netconsoles. Register only consoles that have +* an associated target of the same type. */ -static struct console netconsole_ext; +static struct console netconsole_ext, netconsole;struct netconsole_target_stats {u64_stats_t xmit_drop_count;
@@ -97,6 +97,11 @@ struct netconsole_target_stats {struct u64_stats_sync syncp; }; +enum console_type { +CONS_BASIC =BIT (0 ), +CONS_EXTENDED =BIT (1 ), +}; +/* Features enabled in sysdata. Contrary to userdata, this data is populated by * the kernel. The fields are designed as bitwise flags, allowing multiple * features to be set in sysdata_fields.
@@ -491,6 +496,12 @@ static ssize_t enabled_store(struct config_item *item,if (nt->extended && !console_is_registered (&netconsole_ext))register_console (&netconsole_ext); +/* User might be enabling the basic format target for the very +* first time, make sure the console is registered. +*/ +if (!nt->extended && !console_is_registered (&netconsole)) +register_console (&netconsole); +/* * Skip netpoll_parse_options() -- all the attributes are * already configured via configfs. Just print them out.
@@ -1690,8 +1701,8 @@ static int __init init_netconsole(void) {int err;struct netconsole_target *nt, *tmp; +u32 console_type_needed =0 ;unsigned int count =0 ; -bool extended = false;unsigned long flags;char *target_config;char *input = config;
@@ -1707,9 +1718,10 @@ static int __init init_netconsole(void) }/* Dump existing printks when we register */ if (nt->extended) { - extended = true; + console_type_needed |=CONS_EXTENDED ; netconsole_ext.flags |=CON_PRINTBUFFER ; }else { + console_type_needed |=CONS_BASIC ; netconsole.flags |=CON_PRINTBUFFER ; }
@@ -1728,9 +1740,10 @@ static int __init init_netconsole(void)if (err) goto undonotifier; -if (extended) +if (console_type_needed &CONS_EXTENDED )register_console (&netconsole_ext); -register_console (&netconsole); +if (console_type_needed &CONS_BASIC ) +register_console (&netconsole);pr_info ("network logging started\n" );return err;
@@ -1760,7 +1773,8 @@ static void __exit cleanup_netconsole(void)if (console_is_registered (&netconsole_ext))unregister_console (&netconsole_ext); -unregister_console (&netconsole); +if (console_is_registered (&netconsole)) +unregister_console (&netconsole);dynamic_netconsole_exit ();unregister_netdevice_notifier (&netconsole_netdev_notifier);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/480 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 178f6a5c8cb3b6be1602de0964cd440243f493c9 ]
When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to recalculate the ciphertext length.
This results in transmitting buffers containing uninitialized data during ciphertext transmission.
This causes uninitialized bytes to be appended after a complete "Application Data" packet, leading to errors on the receiving end when parsing TLS record.
--- net/tls/tls_sw.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/tls/tls_sw.c +13 -0
@@ -872,6 +872,19 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, delta = msg->sg.size; psock->eval =sk_psock_msg_verdict (sk, psock, msg); delta -= msg->sg.size; + +if ((s32 )delta >0 ) { +/* It indicates that we executed bpf_msg_pop_data(), +* causing the plaintext data size to decrease. +* Therefore the encrypted data size also needs to +* correspondingly decrease. We only need to subtract +* delta to calculate the new ciphertext length since +* ktls does not support block encryption. +*/ +struct sk_msg *enc = &ctx->open_rec->msg_encrypted; + +sk_msg_trim (sk, enc, enc->sg.size - delta); + } }if (msg->cork_bytes && msg->cork_bytes > msg->sg.size && !enospc && !full_record) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/480 selftests/bpf: fix signedness bug in redir_partial()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fushuai Wang <[email protected]>
[ Upstream commit 6a4bd31f680a1d1cf06492fe6dc4f08da09769e6 ]
When xsend() returns -1 (error), the check 'n < sizeof(buf)' incorrectly treats it as success due to unsigned promotion. Explicitly check for -1 first.
--- tools/testing/selftests/bpf/prog_tests/sockmap_listen.c | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/bpf/prog_tests/sockmap_listen.c +2 -0
@@ -924,6 +924,8 @@ static void redir_partial(int family, int sotype, int sock_map, int parser_map) goto close; n =xsend (c1, buf,sizeof (buf),0 ); +if (n ==-1 ) + goto close;if (n <sizeof (buf))FAIL ("incomplete write" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/480 bpf: handle jset (if a & b ...) as a jump in CFG computation
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit 3157f7e2999616ac91f4d559a8566214f74000a5 ]
BPF_JSET is a conditional jump and currently verifier.c:can_jump() does not know about that. This can lead to incorrect live registers and SCC computation.
E.g. in the following example:
1: r0 = 1; 2: r2 = 2; 3: if r1 & 0x7 goto +1; 4: exit; 5: r0 = r2; 6: exit;
W/o this fix insn_successors(3) will return only (4), a jump to (5) would be missed and r2 won't be marked as alive at (3).
--- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+)
kernel/bpf/verifier.c +1 -0
@@ -23657,6 +23657,7 @@ static bool can_jump(struct bpf_insn *insn)case BPF_JSLT :case BPF_JSLE :case BPF_JCOND : +case BPF_JSET :return true; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/480 selftests/bpf: Fix unintentional switch case fall through
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mykyta Yatsenko <[email protected]>
[ Upstream commit 66ab68c9de89672366fdc474f4f185bb58cecf2d ]
Break from switch expression after parsing -n CLI argument in veristat, instead of falling through and enabling comparison mode.
--- tools/testing/selftests/bpf/veristat.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/veristat.c +1 -0
@@ -344,6 +344,7 @@ static error_t parse_arg(int key, char *arg, struct argp_state *state)fprintf (stderr,"invalid top N specifier: %s\n" , arg);argp_usage (state); } +break ;case 'C' : env.comparison_mode = true;break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/480 net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Machata <[email protected]>
[ Upstream commit 3365afd3abda5f6a54f4a822dad5c9314e94c3fc ]
The netfilter hook is invoked with skb->dev for input netdevice, and vif_dev for output netdevice. However at the point of invocation, skb->dev is already set to vif_dev, and MR-forwarded packets are reported with in=out:
# ip6tables -A FORWARD -j LOG --log-prefix '[forw]' # cd tools/testing/selftests/net/forwarding # ./router_multicast.sh # dmesg | fgrep '[forw]' [ 1670.248245] [forw]IN=v5 OUT=v5 [...]
For reference, IPv4 MR code shows in and out as appropriate. Fix by caching skb->dev and using the updated value for output netdev.
--- net/ipv6/ip6mr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/ip6mr.c +2 -1
@@ -2039,6 +2039,7 @@ static int ip6mr_forward2(struct net *net, struct mr_table *mrt, struct sk_buff *skb, int vifi) {struct vif_device *vif = &mrt->vif_table[vifi]; +struct net_device *indev = skb->dev;struct net_device *vif_dev;struct ipv6hdr *ipv6h;struct dst_entry *dst;
@@ -2101,7 +2102,7 @@ static int ip6mr_forward2(struct net *net, struct mr_table *mrt,IP6CB (skb)->flags |=IP6SKB_FORWARDED ;return NF_HOOK (NFPROTO_IPV6 ,NF_INET_FORWARD , - net,NULL , skb, skb->dev, vif_dev, + net,NULL , skb, indev, skb->dev, ip6mr_forward2_finish); out_free:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/480 drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 7872997c048e989c7689c2995d230fdca7798000 ]
Running 3D applications with SVGA_FORCE_HOST_BACKED=1 or using an ancient version of mesa was broken because the buffer was pinned in VMW_BO_DOMAIN_SYS and could not be moved to VMW_BO_DOMAIN_MOB during validation.
The compat_shader buffer should not pinned.
--- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c +1 -1
@@ -896,7 +896,7 @@ int vmw_compat_shader_add(struct vmw_private *dev_priv, .busy_domain = VMW_BO_DOMAIN_SYS, .bo_type = ttm_bo_type_device, .size = size, - .pin = true, + .pin = false, .keep_resv = true, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/480 slub: Fix a documentation build error for krealloc()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Corbet <[email protected]>
[ Upstream commit e8a45f198e3ae2434108f815bc28f37f6fe6742b ]
The kerneldoc comment for krealloc() contains an unmarked literal block, leading to these warnings in the docs build:
./mm/slub.c:4936: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] ./mm/slub.c:4936: ERROR: Undefined substitution referenced: "--------". [docutils]
Mark up and indent the block properly to bring a bit of peace to our build logs.
--- mm/slub.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
mm/slub.c +5 -5
@@ -4929,12 +4929,12 @@ __do_krealloc(const void *p, size_t new_size, gfp_t flags)* When slub_debug_orig_size() is off, krealloc() only knows about the bucket * size of an allocation (but not the exact size it was allocated with) and * hence implements the following semantics for shrinking and growing buffers -* with __GFP_ZERO. +* with __GFP_ZERO:: * -* new bucket -* 0 size size -* |--------|----------------| -* | keep | zero | +* new bucket +* 0 size size +* |--------|----------------| +* | keep | zero | * * Otherwise, the original allocation size 'orig_size' could be used to * precisely clear the requested size, and the new size will also be stored
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/480 drm/amdgpu: Remove nbiov7.9 replay count reporting
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit 0f566f0e9c614aa3d95082246f5b8c9e8a09c8b3 ]
Direct pcie replay count reporting is not available on nbio v7.9. Reporting is done through firmware.
--- drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 20 -------------------- 1 file changed, 20 deletions(-)
drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c +0 -20
@@ -31,9 +31,6 @@#define NPS_MODE_MASK 0x000000FFL -/* Core 0 Port 0 counter */ -#define smnPCIEP_NAK_COUNTER 0x1A340218 -static void nbio_v7_9_remap_hdp_registers (struct amdgpu_device *adev) { WREG32_SOC15(NBIO, 0, regBIF_BX0_REMAP_HDP_MEM_FLUSH_CNTL,
@@ -463,22 +460,6 @@ static void nbio_v7_9_init_registers(struct amdgpu_device *adev) } } -static u64 nbio_v7_9_get_pcie_replay_count (struct amdgpu_device *adev) -{ -u32 val, nak_r, nak_g; - -if (adev->flags &AMD_IS_APU ) -return 0 ; - -/* Get the number of NAKs received and generated */ - val =RREG32_PCIE (smnPCIEP_NAK_COUNTER); - nak_r = val &0xFFFF ; - nak_g = val >>16 ; - -/* Add the total number of NAKs, i.e the number of replays */ -return (nak_r + nak_g); -} -#define MMIO_REG_HOLE_OFFSET 0x1A000static void nbio_v7_9_set_reg_remap (struct amdgpu_device *adev)
@@ -520,7 +501,6 @@ const struct amdgpu_nbio_funcs nbio_v7_9_funcs = { .get_memory_partition_mode = nbio_v7_9_get_memory_partition_mode, .is_nps_switch_requested = nbio_v7_9_is_nps_switch_requested, .init_registers = nbio_v7_9_init_registers, - .get_pcie_replay_count = nbio_v7_9_get_pcie_replay_count, .set_reg_remap = nbio_v7_9_set_reg_remap, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/480 bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Chen <[email protected]>
[ Upstream commit 99fe8af069a9fa5b09140518b1364e35713a642e ]
In function dump_xx_nlmsg(), when realloc() fails to allocate memory, the original pointer to the buffer is overwritten with NULL. This causes a memory leak because the previously allocated buffer becomes unreachable without being freed.
--- tools/bpf/bpftool/net.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
tools/bpf/bpftool/net.c +9 -6
@@ -366,17 +366,18 @@ static int dump_link_nlmsg(void *cookie, void *msg, struct nlattr **tb) {struct bpf_netdev_t *netinfo = cookie;struct ifinfomsg *ifinfo = msg; +struct ip_devname_ifindex *tmp;if (netinfo->filter_idx >0 && netinfo->filter_idx != ifinfo->ifi_index)return 0 ;if (netinfo->used_len == netinfo->array_len) { - netinfo->devices =realloc (netinfo->devices, - (netinfo->array_len +16 ) * -sizeof (struct ip_devname_ifindex )); -if (!netinfo->devices) + tmp =realloc (netinfo->devices, + (netinfo->array_len +16 ) *sizeof (struct ip_devname_ifindex )); +if (!tmp)return -ENOMEM ; + netinfo->devices = tmp; netinfo->array_len +=16 ; } netinfo->devices[netinfo->used_len].ifindex = ifinfo->ifi_index;
@@ -395,6 +396,7 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb) {struct bpf_tcinfo_t *tcinfo = cookie;struct tcmsg *info = msg; +struct tc_kind_handle *tmp;if (tcinfo->is_qdisc) {/* skip clsact qdisc */
@@ -406,11 +408,12 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb) }if (tcinfo->used_len == tcinfo->array_len) { - tcinfo->handle_array =realloc (tcinfo->handle_array, + tmp =realloc (tcinfo->handle_array, (tcinfo->array_len +16 ) *sizeof (struct tc_kind_handle )); -if (!tcinfo->handle_array) +if (!tmp)return -ENOMEM ; + tcinfo->handle_array = tmp; tcinfo->array_len +=16 ; } tcinfo->handle_array[tcinfo->used_len].handle = info->tcm_handle;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/480 powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haren Myneni <[email protected]>
[ Upstream commit 41a1452759a8b1121df9cf7310acf31d766ba70b ]
IO hotplug add event is handled in the user space with drmgr tool. After the device is enabled, the user space uses /sys/kernel/dlpar interface with “dt add index <drc_index>” to update the device tree. The kernel interface (dlpar_hp_dt_add()) finds the parent node for the specified ‘drc_index’ from ibm,drc-info property. The recent FW provides this property from 2017 onwards. But KVM guest code in some releases is still using the older SLOF firmware which has ibm,drc-indexes property instead of ibm,drc-info.
If the ibm,drc-info is not available, this patch adds changes to search ‘drc_index’ from the indexes array in ibm,drc-indexes property to support old FW.
--- arch/powerpc/platforms/pseries/dlpar.c | 52 +++++++++++++++++++++++++- 1 file changed, 50 insertions(+), 2 deletions(-)
arch/powerpc/platforms/pseries/dlpar.c +50 -2
@@ -404,6 +404,45 @@ get_device_node_with_drc_info(u32 index)return NULL ; } +static struct device_node * +get_device_node_with_drc_indexes (u32 drc_index) +{ +struct device_node *np =NULL ; +u32 nr_indexes, index; +int i, rc; + +for_each_node_with_property (np,"ibm,drc-indexes" ) { +/* +* First element in the array is the total number of +* DRC indexes returned. +*/ + rc =of_property_read_u32_index (np,"ibm,drc-indexes" , +0 , &nr_indexes); +if (rc) + goto out_put_np; + +/* +* Retrieve DRC index from the list and return the +* device node if matched with the specified index. +*/ +for (i =0 ; i < nr_indexes; i++) { + rc =of_property_read_u32_index (np,"ibm,drc-indexes" , + i+1 , &index); +if (rc) + goto out_put_np; + +if (drc_index == index) +return np; + } + } + +return NULL ; + +out_put_np: +of_node_put (np); +return NULL ; +} +static int dlpar_hp_dt_add (u32 index) {struct device_node *np, *nodes;
@@ -423,10 +462,19 @@ static int dlpar_hp_dt_add(u32 index) goto out; } +/* +* Recent FW provides ibm,drc-info property. So search +* for the user specified DRC index from ibm,drc-info +* property. If this property is not available, search +* in the indexes array from ibm,drc-indexes property. +*/ np =get_device_node_with_drc_info (index); -if (!np) -return -EIO ; +if (!np) { + np =get_device_node_with_drc_indexes (index); +if (!np) +return -EIO ; + }/* Next, configure the connector. */ nodes =dlpar_configure_connector (cpu_to_be32 (index), np);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/480 wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rameshkumar Sundaram <[email protected]>
[ Upstream commit 36670b67de18f1e5d34900c5d2ac60a8970c293c ]
During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the radio object (ar) via arvif->deflink->ar.
However, after commit aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO"), arvif is linked to a radio only after vdev creation, typically when a channel is assigned or a scan is requested.
For P2P capable devices, a default P2P interface is created by wpa_supplicant along with regular station interfaces, these serve as dummy interfaces for P2P-capable stations, lack an associated netdev and initiate frequent scans to discover neighbor p2p devices. When a scan is initiated on such P2P vifs, driver selects destination radio (ar) based on scan frequency, creates a scan vdev, and attaches arvif to the radio. Once the scan completes or is aborted, the scan vdev is deleted, detaching arvif from the radio and leaving arvif->ar uninitialized.
While handling beacon miss for station interfaces, P2P interface is also encountered in the vif iteration and ath12k_mac_handle_beacon_miss_iter() tries to dereference the uninitialized arvif->deflink->ar.
Fix this by verifying that vdev is created for the arvif before accessing its ar during beacon miss handling and similar vif iterator callbacks.
==========================================================================
wlp6s0: detected beacon loss from AP (missed 7 beacons) - probing
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt-ath+ #2 PREEMPT(full) RIP: 0010:ath12k_mac_handle_beacon_miss_iter+0xb5/0x1a0 [ath12k] Call Trace: __iterate_interfaces+0x11a/0x410 [mac80211] ieee80211_iterate_active_interfaces_atomic+0x61/0x140 [mac80211] ath12k_mac_handle_beacon_miss+0xa1/0xf0 [ath12k] ath12k_roam_event+0x393/0x560 [ath12k] ath12k_wmi_op_rx+0x1486/0x28c0 [ath12k] ath12k_htc_process_trailer.isra.0+0x2fb/0x620 [ath12k] ath12k_htc_rx_completion_handler+0x448/0x830 [ath12k] ath12k_ce_recv_process_cb+0x549/0x9e0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] process_one_work+0xe3a/0x1430
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/mac.c | 15 +++++++++------ drivers/net/wireless/ath/ath12k/p2p.c | 3 ++- 2 files changed, 11 insertions(+), 7 deletions(-)
drivers/net/wireless/ath/ath12k/mac.c +9 -6
@@ -685,6 +685,9 @@ static void ath12k_get_arvif_iter(void *data, u8 *mac,if (WARN_ON (!arvif))continue ; +if (!arvif->is_created) +continue ; +if (arvif->vdev_id == arvif_iter->vdev_id && arvif->ar == arvif_iter->ar) { arvif_iter->arvif = arvif;
@@ -1844,7 +1847,7 @@ static void ath12k_mac_handle_beacon_iter(void *data, u8 *mac,struct ath12k_vif *ahvif =ath12k_vif_to_ahvif (vif);struct ath12k_link_vif *arvif = &ahvif->deflink; -if (vif->type !=NL80211_IFTYPE_STATION ) +if (vif->type !=NL80211_IFTYPE_STATION || !arvif->is_created)return ;if (!ether_addr_equal (mgmt->bssid, vif->bss_conf.bssid))
@@ -1867,16 +1870,16 @@ static void ath12k_mac_handle_beacon_miss_iter(void *data, u8 *mac,u32 *vdev_id = data;struct ath12k_vif *ahvif =ath12k_vif_to_ahvif (vif);struct ath12k_link_vif *arvif = &ahvif->deflink; -struct ath12k *ar = arvif->ar; -struct ieee80211_hw *hw =ath12k_ar_to_hw (ar); +struct ieee80211_hw *hw; -if (arvif->vdev_id != *vdev_id) +if (!arvif->is_created || arvif->vdev_id != *vdev_id)return ;if (!arvif->is_up)return ;ieee80211_beacon_loss (vif); + hw =ath12k_ar_to_hw (arvif->ar);/* Firmware doesn't report beacon loss events repeatedly. If AP probe * (done by mac80211) succeeds but beacons do not resume then it
@@ -9165,7 +9168,7 @@ ath12k_mac_change_chanctx_cnt_iter(void *data, u8 *mac,if (WARN_ON (!arvif))continue ; -if (arvif->ar != arg->ar) +if (!arvif->is_created || arvif->ar != arg->ar)continue ; link_conf = wiphy_dereference(ahvif->ah->hw->wiphy,
@@ -9200,7 +9203,7 @@ ath12k_mac_change_chanctx_fill_iter(void *data, u8 *mac,if (WARN_ON (!arvif))continue ; -if (arvif->ar != arg->ar) +if (!arvif->is_created || arvif->ar != arg->ar)continue ; link_conf = wiphy_dereference(ahvif->ah->hw->wiphy,
drivers/net/wireless/ath/ath12k/p2p.c +2 -1
@@ -1,6 +1,7 @@// SPDX-License-Identifier: BSD-3-Clause-Clear /* * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include <net/mac80211.h>
@@ -124,7 +125,7 @@ static void ath12k_p2p_noa_update_vdev_iter(void *data, u8 *mac,WARN_ON (!rcu_read_lock_any_held ()); arvif = &ahvif->deflink; -if (arvif->ar != arg->ar || arvif->vdev_id != arg->vdev_id) +if (!arvif->is_created || arvif->ar != arg->ar || arvif->vdev_id != arg->vdev_id)return ;ath12k_p2p_noa_update (arvif, arg->noa);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/480 wifi: ath12k: Fix double budget decrement while reaping monitor ring
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: P Praneesh <[email protected]>
[ Upstream commit 54c350055b1da2767f18a49c11e4fcc42cf33ff8 ]
Currently, the budget for monitor ring is reduced during each ring entry reaping and again when the end reason is HAL_MON_END_OF_PPDU, leading to inefficient budget use. The below mentioned commit intended to decrement the budget only for HAL_MON_END_OF_PPDU but did not remove the other decrement. Fix this by eliminating the budget decrement for each ring entry reaping, ensuring the driver always reaps one full PPDU worth of entries from the monitor destination ring.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/dp_mon.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/ath/ath12k/dp_mon.c +0 -1
@@ -3528,7 +3528,6 @@ int ath12k_dp_mon_srng_process(struct ath12k *ar, int *budget,ath12k_hal_srng_access_begin (ab, srng);while (likely (*budget)) { - *budget -=1 ; mon_dst_desc =ath12k_hal_srng_dst_peek (ab, srng);if (unlikely (!mon_dst_desc))break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/480 wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamizh Chelvam Raja <[email protected]>
[ Upstream commit 05062834350f0bf7ad1abcebc2807220e90220eb ]
In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kernel panic.
Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it directly to avoid panic and unnecessary dereferencing.
PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]"
LR points to "ath12k_dp_tx+0xc8/0x988 [ath12k]".
The Backtrace obtained is as follows:
ath12k_dp_tx+0x228/0x988 [ath12k] ath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k] ieee80211_process_measurement_req+0x320/0x348 [mac80211] ieee80211_tx_dequeue+0x9ac/0x1518 [mac80211] ieee80211_tx_dequeue+0xb14/0x1518 [mac80211] ieee80211_tx_prepare_skb+0x224/0x254 [mac80211] ieee80211_xmit+0xec/0x100 [mac80211] __ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211] ieee80211_subif_start_xmit+0x2e8/0x308 [mac80211] netdev_start_xmit+0x150/0x18c dev_hard_start_xmit+0x74/0xc0
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/dp_tx.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath12k/dp_tx.c +2 -3
@@ -12,10 +12,9 @@#include "mac.h" static enum hal_tcl_encap_type -ath12k_dp_tx_get_encap_type (struct ath12k_link_vif *arvif,struct sk_buff *skb) +ath12k_dp_tx_get_encap_type (struct ath12k_base *ab,struct sk_buff *skb) {struct ieee80211_tx_info *tx_info =IEEE80211_SKB_CB (skb); -struct ath12k_base *ab = arvif->ar->ab;if (test_bit (ATH12K_FLAG_RAW_MODE , &ab->dev_flags))return HAL_TCL_ENCAP_TYPE_RAW ;
@@ -302,7 +301,7 @@ int ath12k_dp_tx(struct ath12k *ar, struct ath12k_link_vif *arvif,u32_encode_bits (mcbc_gsn,HTT_TCL_META_DATA_GLOBAL_SEQ_NUM ); } - ti.encap_type =ath12k_dp_tx_get_encap_type (arvif, skb); + ti.encap_type =ath12k_dp_tx_get_encap_type (ab, skb); ti.addr_search_flags = arvif->hal_addr_search_flags; ti.search_type = arvif->search_type; ti.type =HAL_TCL_DESC_TYPE_BUFFER ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/480 caif: reduce stack size, again
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit b630c781bcf6ff87657146661816d0d30a902139 ]
I tried to fix the stack usage in this function a couple of years ago, but there is still a problem with the latest gcc versions in some configurations:
net/caif/cfctrl.c:553:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
Reduce this once again, with a separate cfctrl_link_setup() function that holds the bulk of all the local variables. It also turns out that the param[] array that takes up a large portion of the stack is write-only and can be left out here.
--- net/caif/cfctrl.c | 294 +++++++++++++++++++++++----------------------- 1 file changed, 144 insertions(+), 150 deletions(-)
net/caif/cfctrl.c +144 -150
@@ -351,17 +351,154 @@ int cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer)return found; } +static int cfctrl_link_setup (struct cfctrl *cfctrl,struct cfpkt *pkt,u8 cmdrsp) +{ +u8 len; +u8 linkid =0 ; +enum cfctrl_srv serv; +enum cfctrl_srv servtype; +u8 endpoint; +u8 physlinkid; +u8 prio; +u8 tmp; +u8 *cp; +int i; +struct cfctrl_link_param linkparam; +struct cfctrl_request_info rsp, *req; + +memset (&linkparam,0 ,sizeof (linkparam)); + + tmp =cfpkt_extr_head_u8 (pkt); + + serv = tmp &CFCTRL_SRV_MASK ; + linkparam.linktype = serv; + + servtype = tmp >>4 ; + linkparam.chtype = servtype; + + tmp =cfpkt_extr_head_u8 (pkt); + physlinkid = tmp &0x07 ; + prio = tmp >>3 ; + + linkparam.priority = prio; + linkparam.phyid = physlinkid; + endpoint =cfpkt_extr_head_u8 (pkt); + linkparam.endpoint = endpoint &0x03 ; + +switch (serv) { +case CFCTRL_SRV_VEI : +case CFCTRL_SRV_DBG : +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); +break ; +case CFCTRL_SRV_VIDEO : + tmp =cfpkt_extr_head_u8 (pkt); + linkparam.u.video.connid = tmp; +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); +break ; + +case CFCTRL_SRV_DATAGRAM : + linkparam.u.datagram.connid =cfpkt_extr_head_u32 (pkt); +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); +break ; +case CFCTRL_SRV_RFM : +/* Construct a frame, convert +* DatagramConnectionID +* to network format long and copy it out... +*/ + linkparam.u.rfm.connid =cfpkt_extr_head_u32 (pkt); + cp = (u8 *) linkparam.u.rfm.volume; +for (tmp =cfpkt_extr_head_u8 (pkt); +cfpkt_more (pkt) && tmp !='\0' ; + tmp =cfpkt_extr_head_u8 (pkt)) + *cp++ = tmp; + *cp ='\0' ; + +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); + +break ; +case CFCTRL_SRV_UTIL : +/* Construct a frame, convert +* DatagramConnectionID +* to network format long and copy it out... +*/ +/* Fifosize KB */ + linkparam.u.utility.fifosize_kb =cfpkt_extr_head_u16 (pkt); +/* Fifosize bufs */ + linkparam.u.utility.fifosize_bufs =cfpkt_extr_head_u16 (pkt); +/* name */ + cp = (u8 *) linkparam.u.utility.name; +caif_assert (sizeof (linkparam.u.utility.name) + >=UTILITY_NAME_LENGTH ); +for (i =0 ; i <UTILITY_NAME_LENGTH &&cfpkt_more (pkt); i++) { + tmp =cfpkt_extr_head_u8 (pkt); + *cp++ = tmp; + } +/* Length */ + len =cfpkt_extr_head_u8 (pkt); + linkparam.u.utility.paramlen = len; +/* Param Data */ + cp = linkparam.u.utility.params; +while (cfpkt_more (pkt) && len--) { + tmp =cfpkt_extr_head_u8 (pkt); + *cp++ = tmp; + } +if (CFCTRL_ERR_BIT & cmdrsp) +break ; +/* Link ID */ + linkid =cfpkt_extr_head_u8 (pkt); +/* Length */ + len =cfpkt_extr_head_u8 (pkt); +/* Param Data */ +cfpkt_extr_head (pkt,NULL , len); +break ; +default : +pr_warn ("Request setup, invalid type (%d)\n" , serv); +return -1 ; + } + + rsp.cmd =CFCTRL_CMD_LINK_SETUP ; + rsp.param = linkparam; +spin_lock_bh (&cfctrl->info_list_lock); + req =cfctrl_remove_req (cfctrl, &rsp); + +if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) || +cfpkt_erroneous (pkt)) { +pr_err ("Invalid O/E bit or parse error " +"on CAIF control channel\n" ); + cfctrl->res.reject_rsp (cfctrl->serv.layer.up,0 , + req ? req->client_layer :NULL ); + }else { + cfctrl->res.linksetup_rsp (cfctrl->serv.layer.up, linkid, + serv, physlinkid, + req ? req->client_layer :NULL ); + } + +kfree (req); + +spin_unlock_bh (&cfctrl->info_list_lock); + +return 0 ; +} +static int cfctrl_recv (struct cflayer *layer,struct cfpkt *pkt) {u8 cmdrsp;u8 cmd; -int ret =-1 ; -u8 len; -u8 param[255 ]; +int ret =0 ;u8 linkid =0 ;struct cfctrl *cfctrl =container_obj (layer); -struct cfctrl_request_info rsp, *req; - cmdrsp =cfpkt_extr_head_u8 (pkt); cmd = cmdrsp &CFCTRL_CMD_MASK ;
@@ -374,150 +511,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)switch (cmd) {case CFCTRL_CMD_LINK_SETUP : - { -enum cfctrl_srv serv; -enum cfctrl_srv servtype; -u8 endpoint; -u8 physlinkid; -u8 prio; -u8 tmp; -u8 *cp; -int i; -struct cfctrl_link_param linkparam; -memset (&linkparam,0 ,sizeof (linkparam)); - - tmp =cfpkt_extr_head_u8 (pkt); - - serv = tmp &CFCTRL_SRV_MASK ; - linkparam.linktype = serv; - - servtype = tmp >>4 ; - linkparam.chtype = servtype; - - tmp =cfpkt_extr_head_u8 (pkt); - physlinkid = tmp &0x07 ; - prio = tmp >>3 ; - - linkparam.priority = prio; - linkparam.phyid = physlinkid; - endpoint =cfpkt_extr_head_u8 (pkt); - linkparam.endpoint = endpoint &0x03 ; - -switch (serv) { -case CFCTRL_SRV_VEI : -case CFCTRL_SRV_DBG : -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); -break ; -case CFCTRL_SRV_VIDEO : - tmp =cfpkt_extr_head_u8 (pkt); - linkparam.u.video.connid = tmp; -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); -break ; - -case CFCTRL_SRV_DATAGRAM : - linkparam.u.datagram.connid = -cfpkt_extr_head_u32 (pkt); -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); -break ; -case CFCTRL_SRV_RFM : -/* Construct a frame, convert -* DatagramConnectionID -* to network format long and copy it out... -*/ - linkparam.u.rfm.connid = -cfpkt_extr_head_u32 (pkt); - cp = (u8 *) linkparam.u.rfm.volume; -for (tmp =cfpkt_extr_head_u8 (pkt); -cfpkt_more (pkt) && tmp !='\0' ; - tmp =cfpkt_extr_head_u8 (pkt)) - *cp++ = tmp; - *cp ='\0' ; - -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); - -break ; -case CFCTRL_SRV_UTIL : -/* Construct a frame, convert -* DatagramConnectionID -* to network format long and copy it out... -*/ -/* Fifosize KB */ - linkparam.u.utility.fifosize_kb = -cfpkt_extr_head_u16 (pkt); -/* Fifosize bufs */ - linkparam.u.utility.fifosize_bufs = -cfpkt_extr_head_u16 (pkt); -/* name */ - cp = (u8 *) linkparam.u.utility.name; -caif_assert (sizeof (linkparam.u.utility.name) - >=UTILITY_NAME_LENGTH ); -for (i =0 ; - i <UTILITY_NAME_LENGTH - &&cfpkt_more (pkt); i++) { - tmp =cfpkt_extr_head_u8 (pkt); - *cp++ = tmp; - } -/* Length */ - len =cfpkt_extr_head_u8 (pkt); - linkparam.u.utility.paramlen = len; -/* Param Data */ - cp = linkparam.u.utility.params; -while (cfpkt_more (pkt) && len--) { - tmp =cfpkt_extr_head_u8 (pkt); - *cp++ = tmp; - } -if (CFCTRL_ERR_BIT & cmdrsp) -break ; -/* Link ID */ - linkid =cfpkt_extr_head_u8 (pkt); -/* Length */ - len =cfpkt_extr_head_u8 (pkt); -/* Param Data */ -cfpkt_extr_head (pkt, ¶m, len); -break ; -default : -pr_warn ("Request setup, invalid type (%d)\n" , - serv); - goto error; - } - - rsp.cmd = cmd; - rsp.param = linkparam; -spin_lock_bh (&cfctrl->info_list_lock); - req =cfctrl_remove_req (cfctrl, &rsp); - -if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) || -cfpkt_erroneous (pkt)) { -pr_err ("Invalid O/E bit or parse error " -"on CAIF control channel\n" ); - cfctrl->res.reject_rsp (cfctrl->serv.layer.up, -0 , - req ? req->client_layer - :NULL ); - }else { - cfctrl->res.linksetup_rsp (cfctrl->serv. - layer.up, linkid, - serv, physlinkid, - req ? req-> - client_layer :NULL ); - } - -kfree (req); - -spin_unlock_bh (&cfctrl->info_list_lock); - } + ret =cfctrl_link_setup (cfctrl, pkt, cmdrsp);break ;case CFCTRL_CMD_LINK_DESTROY : linkid =cfpkt_extr_head_u8 (pkt);
@@ -544,9 +538,9 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)break ;default :pr_err ("Unrecognized Control Frame\n" ); + ret =-1 ; goto error; } - ret =0 ; error:cfpkt_destroy (pkt);return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/480 wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 7e04f01bb94fe61c73cc59f0495c3b6c16a83231 ]
With a quite rare chance, RX report might be problematic to make SW think a packet is received on 6 GHz band even if the chip does not support 6 GHz band actually. Since SW won't initialize stuffs for unsupported bands, NULL dereference will happen then in the sequence, rtw89_vif_rx_stats_iter() -> rtw89_core_cancel_6ghz_probe_tx(). So, add a check to avoid it.
The following is a crash log for this case.
BUG: kernel NULL pointer dereference, address: 0000000000000032 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1907 Comm: irq/131-rtw89_p Tainted: G U 6.6.56-05896-g89f5fb0eb30b #1 (HASH:1400 4) Hardware name: Google Telith/Telith, BIOS Google_Telith.15217.747.0 11/12/2024 RIP: 0010:rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core] Code: 4c 89 7d c8 48 89 55 c0 49 8d 44 24 02 48 89 45 b8 45 31 ff eb 11 41 c6 45 3a 01 41 b7 01 4d 8b 6d 00 4d 39 f5 74 42 8b 43 10 <41> 33 45 32 0f b7 4b 14 66 41 33 4d 36 0f b7 c9 09 c1 74 d8 4d 85 RSP: 0018:ffff9f3080138ca0 EFLAGS: 00010246 RAX: 00000000b8bf5770 RBX: ffff91b5e8c639c0 RCX: 0000000000000011 RDX: ffff91b582de1be8 RSI: 0000000000000000 RDI: ffff91b5e8c639e6 RBP: ffff9f3080138d00 R08: 0000000000000000 R09: 0000000000000000 R10: ffff91b59de70000 R11: ffffffffc069be50 R12: ffff91b5e8c639e4 R13: 0000000000000000 R14: ffff91b5828020b8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff91b8efa40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000032 CR3: 00000002bf838000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: <IRQ> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x4f/0xa0 ? asm_exc_page_fault+0x22/0x30 ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ? rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core (HASH:1400 5)] __iterate_interfaces+0x59/0x110 [mac80211 (HASH:1400 6)] ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ieee80211_iterate_active_interfaces_atomic+0x36/0x50 [mac80211 (HASH:1400 6)] rtw89_core_rx_to_mac80211+0xfd/0x1b0 [rtw89_core (HASH:1400 5)] rtw89_core_rx+0x43a/0x980 [rtw89_core (HASH:1400 5)]
--- drivers/net/wireless/realtek/rtw89/core.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/realtek/rtw89/core.c +5 -0
@@ -2110,6 +2110,11 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,if (rx_status->band !=NL80211_BAND_6GHZ )return ; +if (unlikely (!(rtwdev->chip->support_bands &BIT (NL80211_BAND_6GHZ )))) { +rtw89_debug (rtwdev,RTW89_DBG_UNEXP ,"invalid rx on unsupported 6 GHz\n" ); +return ; + } + ssid_ie =cfg80211_find_ie (WLAN_EID_SSID , ies, skb->len);list_for_each_entry (info, &pkt_list[NL80211_BAND_6GHZ ], list) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/480 wifi: rtl818x: Kill URBs before clearing tx status queue
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
[ Upstream commit 16d8fd74dbfca0ea58645cd2fca13be10cae3cdd ]
In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before freeing such skb.
BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211] Call Trace: <IRQ> rtl8187_tx_cb+0x116/0x150 [rtl8187] __usb_hcd_giveback_urb+0x9d/0x120 usb_giveback_urb_bh+0xbb/0x140 process_one_work+0x19b/0x3c0 bh_worker+0x1a7/0x210 tasklet_action+0x10/0x30 handle_softirqs+0xf0/0x340 __irq_exit_rcu+0xcd/0xf0 common_interrupt+0x85/0xa0 </IRQ>
Tested on RTL8187BvE device.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +2 -1
@@ -1041,10 +1041,11 @@ static void rtl8187_stop(struct ieee80211_hw *dev, bool suspend)rtl818x_iowrite8 (priv, &priv->map->CONFIG4, reg |RTL818X_CONFIG4_VCOOFF );rtl818x_iowrite8 (priv, &priv->map->EEPROM_CMD,RTL818X_EEPROM_CMD_NORMAL ); +usb_kill_anchored_urbs (&priv->anchored); +while ((skb =skb_dequeue (&priv->b_tx_status.queue)))dev_kfree_skb_any (skb); -usb_kill_anchored_urbs (&priv->anchored);mutex_unlock (&priv->conf_mutex);if (!priv->is_rtl8187b)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/480 wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiu Jianfeng <[email protected]>
[ Upstream commit ed2e916c890944633d6826dce267579334f63ea5 ]
When iwl_opmode_register() fails, it does not unregster rate control, which will cause a memory leak issue, this patch fixes it.
--- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/ops.c +3 -1
@@ -61,8 +61,10 @@ static int __init iwl_mvm_init(void) } ret =iwl_opmode_register ("iwlmvm" , &iwl_mvm_ops); -if (ret) +if (ret) {pr_err ("Unable to register MVM op_mode: %d\n" , ret); +iwl_mvm_rate_control_unregister (); + }return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/480 iwlwifi: Add missing check for alloc_ordered_workqueue
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit 90a0d9f339960448a3acc1437a46730f975efd6a ]
Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer.
--- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/dvm/main.c +9 -2
@@ -1048,9 +1048,11 @@ static void iwl_bg_restart(struct work_struct *data)* *****************************************************************************/ -static void iwl_setup_deferred_work (struct iwl_priv *priv) +static int iwl_setup_deferred_work (struct iwl_priv *priv) { priv->workqueue =alloc_ordered_workqueue (DRV_NAME ,0 ); +if (!priv->workqueue) +return -ENOMEM ;INIT_WORK (&priv->restart, iwl_bg_restart);INIT_WORK (&priv->beacon_update, iwl_bg_beacon_update);
@@ -1067,6 +1069,8 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)timer_setup (&priv->statistics_periodic, iwl_bg_statistics_periodic,0 );timer_setup (&priv->ucode_trace, iwl_bg_ucode_trace,0 ); + +return 0 ; }void iwl_cancel_deferred_work (struct iwl_priv *priv)
@@ -1464,7 +1468,9 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,/******************** * 6. Setup services ********************/ -iwl_setup_deferred_work (priv); +if (iwl_setup_deferred_work (priv)) + goto out_uninit_drv; +iwl_setup_rx_handlers (priv);iwl_power_initialize (priv);
@@ -1503,6 +1509,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,iwl_cancel_deferred_work (priv);destroy_workqueue (priv->workqueue); priv->workqueue =NULL ; +out_uninit_drv:iwl_uninit_drv (priv); out_free_eeprom_blob:kfree (priv->eeprom_blob);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/480 team: replace team lock with rtnl lock
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Fomichev <[email protected]>
[ Upstream commit bfb4fb77f9a8ce33ce357224569eae5564eec573 ]
syszbot reports various ordering issues for lower instance locks and team lock. Switch to using rtnl lock for protecting team device, similar to bonding. Based on the patch by Tetsuo Handa.
--- drivers/net/team/team_core.c | 96 +++++++++++------------ drivers/net/team/team_mode_activebackup.c | 3 +- drivers/net/team/team_mode_loadbalance.c | 13 ++- include/linux/if_team.h | 3 - 4 files changed, 50 insertions(+), 65 deletions(-)
drivers/net/team/team_core.c +44 -52
@@ -933,7 +933,7 @@ static bool team_port_find(const struct team *team,* Enable/disable port by adding to enabled port hashlist and setting * port->index (Might be racy so reader could see incorrect ifindex when * processing a flying packet, but that is not a problem). Write guarded -* by team->lock. +* by RTNL. */ static void team_port_enable (struct team *team,struct team_port *port)
@@ -1660,8 +1660,6 @@ static int team_init(struct net_device *dev) goto err_options_register;netif_carrier_off (dev); -lockdep_register_key (&team->team_lock_key); -__mutex_init (&team->lock,"team->team_lock_key" , &team->team_lock_key);netdev_lockdep_set_classes (dev);return 0 ;
@@ -1682,7 +1680,8 @@ static void team_uninit(struct net_device *dev)struct team_port *port;struct team_port *tmp; -mutex_lock (&team->lock); +ASSERT_RTNL (); +list_for_each_entry_safe (port, tmp, &team->port_list, list)team_port_del (team, port->dev);
@@ -1691,9 +1690,7 @@ static void team_uninit(struct net_device *dev)team_mcast_rejoin_fini (team);team_notify_peers_fini (team);team_queue_override_fini (team); -mutex_unlock (&team->lock);netdev_change_features (dev); -lockdep_unregister_key (&team->team_lock_key); }static void team_destructor (struct net_device *dev)
@@ -1778,7 +1775,8 @@ static void team_change_rx_flags(struct net_device *dev, int change)struct team_port *port;int inc; -mutex_lock (&team->lock); +ASSERT_RTNL (); +list_for_each_entry (port, &team->port_list, list) {if (change &IFF_PROMISC ) { inc = dev->flags &IFF_PROMISC ?1 :-1 ;
@@ -1789,7 +1787,6 @@ static void team_change_rx_flags(struct net_device *dev, int change)dev_set_allmulti (port->dev, inc); } } -mutex_unlock (&team->lock); }static void team_set_rx_mode (struct net_device *dev)
@@ -1811,14 +1808,14 @@ static int team_set_mac_address(struct net_device *dev, void *p)struct team *team =netdev_priv (dev);struct team_port *port; +ASSERT_RTNL (); +if (dev->type ==ARPHRD_ETHER && !is_valid_ether_addr (addr->sa_data))return -EADDRNOTAVAIL ;dev_addr_set (dev, addr->sa_data); -mutex_lock (&team->lock);list_for_each_entry (port, &team->port_list, list)if (team->ops.port_change_dev_addr) team->ops.port_change_dev_addr (team, port); -mutex_unlock (&team->lock);return 0 ; }
@@ -1828,11 +1825,8 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)struct team_port *port;int err; -/* -* Alhough this is reader, it's guarded by team lock. It's not possible -* to traverse list in reverse under rcu_read_lock -*/ -mutex_lock (&team->lock); +ASSERT_RTNL (); + team->port_mtu_change_allowed = true;list_for_each_entry (port, &team->port_list, list) { err =dev_set_mtu (port->dev, new_mtu);
@@ -1843,7 +1837,6 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) } } team->port_mtu_change_allowed = false; -mutex_unlock (&team->lock);WRITE_ONCE (dev->mtu, new_mtu);
@@ -1853,7 +1846,6 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)list_for_each_entry_continue_reverse (port, &team->port_list, list)dev_set_mtu (port->dev, dev->mtu); team->port_mtu_change_allowed = false; -mutex_unlock (&team->lock);return err; }
@@ -1903,24 +1895,19 @@ static int team_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)struct team_port *port;int err; -/* -* Alhough this is reader, it's guarded by team lock. It's not possible -* to traverse list in reverse under rcu_read_lock -*/ -mutex_lock (&team->lock); +ASSERT_RTNL (); +list_for_each_entry (port, &team->port_list, list) { err =vlan_vid_add (port->dev, proto, vid);if (err) goto unwind; } -mutex_unlock (&team->lock);return 0 ; unwind:list_for_each_entry_continue_reverse (port, &team->port_list, list)vlan_vid_del (port->dev, proto, vid); -mutex_unlock (&team->lock);return err; }
@@ -1930,10 +1917,10 @@ static int team_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)struct team *team =netdev_priv (dev);struct team_port *port; -mutex_lock (&team->lock); +ASSERT_RTNL (); +list_for_each_entry (port, &team->port_list, list)vlan_vid_del (port->dev, proto, vid); -mutex_unlock (&team->lock);return 0 ; }
@@ -1955,9 +1942,9 @@ static void team_netpoll_cleanup(struct net_device *dev) {struct team *team =netdev_priv (dev); -mutex_lock (&team->lock); +ASSERT_RTNL (); +__team_netpoll_cleanup (team); -mutex_unlock (&team->lock); }static int team_netpoll_setup (struct net_device *dev)
@@ -1966,7 +1953,8 @@ static int team_netpoll_setup(struct net_device *dev)struct team_port *port;int err =0 ; -mutex_lock (&team->lock); +ASSERT_RTNL (); +list_for_each_entry (port, &team->port_list, list) { err =__team_port_enable_netpoll (port);if (err) {
@@ -1974,7 +1962,6 @@ static int team_netpoll_setup(struct net_device *dev) break; } } -mutex_unlock (&team->lock);return err; }#endif
@@ -1985,9 +1972,9 @@ static int team_add_slave(struct net_device *dev, struct net_device *port_dev,struct team *team =netdev_priv (dev);int err; -mutex_lock (&team->lock); +ASSERT_RTNL (); + err =team_port_add (team, port_dev, extack); -mutex_unlock (&team->lock);if (!err)netdev_change_features (dev);
@@ -2000,18 +1987,13 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)struct team *team =netdev_priv (dev);int err; -mutex_lock (&team->lock); +ASSERT_RTNL (); + err =team_port_del (team, port_dev); -mutex_unlock (&team->lock);if (err)return err; -if (netif_is_team_master (port_dev)) { -lockdep_unregister_key (&team->team_lock_key); -lockdep_register_key (&team->team_lock_key); -lockdep_set_class (&team->lock, &team->team_lock_key); - }netdev_change_features (dev);return err;
@@ -2304,9 +2286,10 @@ int team_nl_noop_doit(struct sk_buff *skb, struct genl_info *info)static struct team *team_nl_team_get (struct genl_info *info) {struct net *net =genl_info_net (info); -int ifindex;struct net_device *dev; -struct team *team; +int ifindex; + +ASSERT_RTNL ();if (!info->attrs[TEAM_ATTR_TEAM_IFINDEX ])return NULL ;
@@ -2318,14 +2301,11 @@ static struct team *team_nl_team_get(struct genl_info *info)return NULL ; } - team =netdev_priv (dev); -mutex_lock (&team->lock); -return team; +return netdev_priv (dev); }static void team_nl_team_put (struct team *team) { -mutex_unlock (&team->lock);dev_put (team->dev); }
@@ -2515,9 +2495,13 @@ int team_nl_options_get_doit(struct sk_buff *skb, struct genl_info *info)int err;LIST_HEAD (sel_opt_inst_list); +rtnl_lock (); + team =team_nl_team_get (info); -if (!team) -return -EINVAL ; +if (!team) { + err = -EINVAL ; + goto rtnl_unlock; + }list_for_each_entry (opt_inst, &team->option_inst_list, list)list_add_tail (&opt_inst->tmp_list, &sel_opt_inst_list);
@@ -2527,6 +2511,9 @@ int team_nl_options_get_doit(struct sk_buff *skb, struct genl_info *info)team_nl_team_put (team); +rtnl_unlock: +rtnl_unlock (); +return err; }
@@ -2805,15 +2792,22 @@ int team_nl_port_list_get_doit(struct sk_buff *skb,struct team *team;int err; +rtnl_lock (); + team =team_nl_team_get (info); -if (!team) -return -EINVAL ; +if (!team) { + err = -EINVAL ; + goto rtnl_unlock; + } err =team_nl_send_port_list_get (team, info->snd_portid, info->snd_seq,NLM_F_ACK , team_nl_send_unicast,NULL );team_nl_team_put (team); +rtnl_unlock: +rtnl_unlock (); +return err; }
@@ -2961,11 +2955,9 @@ static void __team_port_change_port_removed(struct team_port *port)static void team_port_change_check (struct team_port *port,bool linkup) { -struct team *team = port->team; +ASSERT_RTNL (); -mutex_lock (&team->lock);__team_port_change_check (port, linkup); -mutex_unlock (&team->lock); }
drivers/net/team/team_mode_activebackup.c +1 -2
@@ -67,8 +67,7 @@ static void ab_active_port_get(struct team *team, struct team_gsetter_ctx *ctx) {struct team_port *active_port; - active_port =rcu_dereference_protected (ab_priv (team)->active_port, -lockdep_is_held (&team->lock)); + active_port =rtnl_dereference (ab_priv (team)->active_port);if (active_port) ctx->data.u32_val = active_port->dev->ifindex;else
drivers/net/team/team_mode_loadbalance.c +5 -8
@@ -301,8 +301,7 @@ static int lb_bpf_func_set(struct team *team, struct team_gsetter_ctx *ctx)if (lb_priv->ex->orig_fprog) {/* Clear old filter data */ __fprog_destroy (lb_priv->ex->orig_fprog); - orig_fp =rcu_dereference_protected (lb_priv->fp, -lockdep_is_held (&team->lock)); + orig_fp =rtnl_dereference (lb_priv->fp); }rcu_assign_pointer (lb_priv->fp, fp);
@@ -324,8 +323,7 @@ static void lb_bpf_func_free(struct team *team)return ;__fprog_destroy (lb_priv->ex->orig_fprog); - fp =rcu_dereference_protected (lb_priv->fp, -lockdep_is_held (&team->lock)); + fp =rtnl_dereference (lb_priv->fp);bpf_prog_destroy (fp); }
@@ -335,8 +333,7 @@ static void lb_tx_method_get(struct team *team, struct team_gsetter_ctx *ctx)lb_select_tx_port_func_t *func;char *name; - func =rcu_dereference_protected (lb_priv->select_tx_port_func, -lockdep_is_held (&team->lock)); + func =rtnl_dereference (lb_priv->select_tx_port_func); name =lb_select_tx_port_get_name (func);BUG_ON (!name); ctx->data.str_val = name;
@@ -478,7 +475,7 @@ static void lb_stats_refresh(struct work_struct *work) team = lb_priv_ex->team; lb_priv =get_lb_priv (team); -if (!mutex_trylock (&team->lock)) { +if (!rtnl_trylock ()) {schedule_delayed_work (&lb_priv_ex->stats.refresh_dw,0 );return ; }
@@ -515,7 +512,7 @@ static void lb_stats_refresh(struct work_struct *work)schedule_delayed_work (&lb_priv_ex->stats.refresh_dw, (lb_priv_ex->stats.refresh_interval *HZ ) /10 ); -mutex_unlock (&team->lock); +rtnl_unlock (); } static void lb_stats_refresh_interval_get(struct team *team,
include/linux/if_team.h +0 -3
@@ -191,8 +191,6 @@ struct team {const struct header_ops *header_ops_cache; -struct mutex lock;/* used for overall locking, e.g. port lists write */ -/* * List of enabled ports and their count */
@@ -223,7 +221,6 @@ struct team {atomic_t count_pending;struct delayed_work dw; } mcast_rejoin; -struct lock_class_key team_lock_key;long mode_priv[TEAM_MODE_PRIV_LONGS ]; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/480 wifi: ath11k: clear initialized flag for deinit-ed srng lists
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
[ Upstream commit a5b46aa7cf5f05c213316a018e49a8e086efd98e ]
In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances:
1) First ath11k_hal_dump_srng_stats() call
Last interrupt received for each group:
ath11k_pci 0000:01:00.0: group_id 0 22511ms before
ath11k_pci 0000:01:00.0: group_id 1 14440788ms before
[..]
ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. ath11k_pci 0000:01:00.0: Service connect timeout
ath11k_pci 0000:01:00.0: failed to connect to HTT: -110
ath11k_pci 0000:01:00.0: failed to start core: -110
ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM
ath11k_pci 0000:01:00.0: already resetting count 2
ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110 ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110 ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery [..]
2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit() which destroys srng lists. However, it does not reset per-list ->initialized flag.
3) Second ath11k_hal_dump_srng_stats() call sees stale ->initialized flag and attempts to dump srng stats:
Last interrupt received for each group:
ath11k_pci 0000:01:00.0: group_id 0 66785ms before ath11k_pci 0000:01:00.0: group_id 1 14485062ms before ath11k_pci 0000:01:00.0: group_id 2 14485062ms before ath11k_pci 0000:01:00.0: group_id 3 14485062ms before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath11k_pci 0000:01:00.0: group_id 6 14485062ms before ath11k_pci 0000:01:00.0: group_id 7 66814ms before ath11k_pci 0000:01:00.0: group_id 8 68997ms before ath11k_pci 0000:01:00.0: group_id 9 67588ms before ath11k_pci 0000:01:00.0: group_id 10 69511ms before
BUG: unable to handle page fault for address: ffffa007404eb010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 10022d067 PMD 100b01067 PTE 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k] Call Trace: <TASK> ? __die_body+0xae/0xb0 ? page_fault_oops+0x381/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k (HASH:6cea 4)] ath11k_qmi_driver_event_work+0xbd/0x1050 [ath11k (HASH:6cea 4)] worker_thread+0x389/0x930 kthread+0x149/0x170
Clear per-list ->initialized flag in ath11k_hal_srng_deinit().
--- drivers/net/wireless/ath/ath11k/hal.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/ath/ath11k/hal.c +4 -0
@@ -1346,6 +1346,10 @@ EXPORT_SYMBOL(ath11k_hal_srng_init);void ath11k_hal_srng_deinit (struct ath11k_base *ab) {struct ath11k_hal *hal = &ab->hal; +int i; + +for (i =0 ; i <HAL_SRNG_RING_ID_MAX ; i++) + ab->hal.srng_list[i].initialized =0 ;ath11k_hal_unregister_srng_key (ab);ath11k_hal_free_cont_rdp (ab);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/480 wifi: ath12k: Clear auth flag only for actual association in security mode
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thiraviyam Mariyappan <[email protected]>
[ Upstream commit c27bb624b3d789a337df3bbcc020a575680555cc ]
When setting a new bitrate, WMI peer association command is sent from the host without the peer authentication bit set in peer_flags for security mode, which causes ping failure.
The firmware handles peer_flags when the client is associating, as the peer authentication bit in peer_flags is set after the key exchange. When the WMI peer association command is sent from the host to update the new bitrate for an associated STA, the firmware expects the WMI peer authentication bit to be set in peer_flags.
Fix this issue by ensuring that the WMI peer auth bit is set in peer_flags in WMI peer association command when updating the new bitrate.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/mac.c | 4 ++++ drivers/net/wireless/ath/ath12k/wmi.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/mac.c +4 -0
@@ -3315,6 +3315,7 @@ static void ath12k_bss_assoc(struct ath12k *ar,rcu_read_unlock (); + peer_arg->is_assoc = true; ret =ath12k_wmi_send_peer_assoc_cmd (ar, peer_arg);if (ret) { ath12k_warn(ar->ab, "failed to run peer assoc for %pM vdev %i: %d\n",
@@ -5087,6 +5088,8 @@ static int ath12k_mac_station_assoc(struct ath12k *ar, "invalid peer NSS %d\n", peer_arg->peer_nss);return -EINVAL ; } + + peer_arg->is_assoc = true; ret =ath12k_wmi_send_peer_assoc_cmd (ar, peer_arg);if (ret) { ath12k_warn(ar->ab, "failed to run peer assoc for STA %pM vdev %i: %d\n",
@@ -5333,6 +5336,7 @@ static void ath12k_sta_rc_update_wk(struct wiphy *wiphy, struct wiphy_work *wk)ath12k_peer_assoc_prepare (ar, arvif, arsta, peer_arg, true); + peer_arg->is_assoc = false; err =ath12k_wmi_send_peer_assoc_cmd (ar, peer_arg);if (err) ath12k_warn(ar->ab, "failed to run peer assoc for STA %pM vdev %i: %d\n",
drivers/net/wireless/ath/ath12k/wmi.c +1 -1
@@ -2136,7 +2136,7 @@ static void ath12k_wmi_copy_peer_flags(struct wmi_peer_assoc_complete_cmd *cmd, cmd->peer_flags |=cpu_to_le32 (WMI_PEER_AUTH );if (arg->need_ptk_4_way) { cmd->peer_flags |=cpu_to_le32 (WMI_PEER_NEED_PTK_4_WAY ); -if (!hw_crypto_disabled) +if (!hw_crypto_disabled && arg->is_assoc) cmd->peer_flags &=cpu_to_le32 (~WMI_PEER_AUTH ); }if (arg->need_gtk_2_way)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/480 tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: xin.guo <[email protected]>
[ Upstream commit a041f70e573e185d5d5fdbba53f0db2fbe7257ad ]
If the new coming segment covers more than one skbs in the ofo queue, and which seq is equal to rcv_nxt, then the sequence range that is duplicated will be sent as DUP SACK, the detail as below, in step6, the {501,2001} range is clearly including too much DUP SACK range, in violation of RFC 2883 rules.
1. client > server: Flags [.], seq 501:1001, ack 1325288529, win 20000, length 500
2. server > client: Flags [.], ack 1, [nop,nop,sack 1 {501:1001}], length 0
3. client > server: Flags [.], seq 1501:2001, ack 1325288529, win 20000, length 500
4. server > client: Flags [.], ack 1, [nop,nop,sack 2 {1501:2001} {501:1001}], length 0
5. client > server: Flags [.], seq 1:2001, ack 1325288529, win 20000, length 2000
6. server > client: Flags [.], ack 2001, [nop,nop,sack 1 {501:2001}], length 0
After this fix, the final ACK is as below:
6. server > client: Flags [.], ack 2001, options [nop,nop,sack 1 {501:1001}], length 0
[edumazet] added a new packetdrill test in the following patch.
--- net/ipv4/tcp_input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/tcp_input.c +2 -1
@@ -4986,8 +4986,9 @@ static void tcp_ofo_queue(struct sock *sk)if (before (TCP_SKB_CB (skb)->seq, dsack_high)) {__u32 dsack = dsack_high; +if (before (TCP_SKB_CB (skb)->end_seq, dsack_high)) - dsack_high =TCP_SKB_CB (skb)->end_seq; + dsack =TCP_SKB_CB (skb)->end_seq;tcp_dsack_extend (sk,TCP_SKB_CB (skb)->seq, dsack); } p =rb_next (p);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/480 net/mlx5: Check device memory pointer before usage
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stav Aviram <[email protected]>
[ Upstream commit 70f238c902b8c0461ae6fbb8d1a0bbddc4350eea ]
Add a NULL check before accessing device memory to prevent a crash if dev->dm allocation in mlx5_init_once() fails.
--- drivers/infiniband/hw/mlx5/dm.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c | 4 ++-- drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 --- 3 files changed, 3 insertions(+), 6 deletions(-)
drivers/infiniband/hw/mlx5/dm.c +1 -1
@@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx,int err;u64 address; -if (!MLX5_CAP_DEV_MEM (dm_db->dev, memic)) +if (!dm_db || !MLX5_CAP_DEV_MEM (dm_db->dev, memic))return ERR_PTR (-EOPNOTSUPP ); dm =kzalloc (sizeof (*dm),GFP_KERNEL );
drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c +2 -2
@@ -30,7 +30,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) dm =kzalloc (sizeof (*dm),GFP_KERNEL );if (!dm) -return ERR_PTR (-ENOMEM ); +return NULL ;spin_lock_init (&dm->lock);
@@ -96,7 +96,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) err_steering:kfree (dm); -return ERR_PTR (-ENOMEM ); +return NULL ; }void mlx5_dm_cleanup (struct mlx5_core_dev *dev)
drivers/net/ethernet/mellanox/mlx5/core/main.c +0 -3
@@ -1102,9 +1102,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) } dev->dm =mlx5_dm_create (dev); -if (IS_ERR (dev->dm)) -mlx5_core_warn (dev,"Failed to init device memory %ld\n" ,PTR_ERR (dev->dm)); - dev->tracer =mlx5_fw_tracer_create (dev); dev->hv_vhca =mlx5_hv_vhca_create (dev); dev->rsc_dump =mlx5_rsc_dump_create (dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/480 net: dst: annotate data-races around dst->input
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit f1c5fd34891a1c242885f48c2e4dc52df180f311 ]
dst_dev_put() can overwrite dst->input while other cpus might read this field (for instance from dst_input())
Add READ_ONCE()/WRITE_ONCE() annotations to suppress potential issues.
We will likely need full RCU protection later.
--- include/net/dst.h | 2 +- include/net/lwtunnel.h | 4 ++-- net/core/dst.c | 2 +- net/ipv4/route.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-)
include/net/dst.h +1 -1
@@ -466,7 +466,7 @@ INDIRECT_CALLABLE_DECLARE(int ip_local_deliver(struct sk_buff *));/* Input packet from network to transport. */ static inline int dst_input (struct sk_buff *skb) { -return INDIRECT_CALL_INET (skb_dst (skb)->input, +return INDIRECT_CALL_INET (READ_ONCE (skb_dst (skb)->input), ip6_input, ip_local_deliver, skb); }
include/net/lwtunnel.h +2 -2
@@ -144,8 +144,8 @@ static inline void lwtunnel_set_redirect(struct dst_entry *dst) dst->output = lwtunnel_output; }if (lwtunnel_input_redirect (dst->lwtstate)) { - dst->lwtstate->orig_input = dst->input; - dst->input = lwtunnel_input; + dst->lwtstate->orig_input =READ_ONCE (dst->input); +WRITE_ONCE (dst->input, lwtunnel_input); } }#else
net/core/dst.c +1 -1
@@ -148,7 +148,7 @@ void dst_dev_put(struct dst_entry *dst) dst->obsolete =DST_OBSOLETE_DEAD ;if (dst->ops->ifdown) dst->ops->ifdown (dst, dev); - dst->input = dst_discard; +WRITE_ONCE (dst->input, dst_discard); dst->output = dst_discard_out; dst->dev = blackhole_netdev; netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker,
net/ipv4/route.c +1 -1
@@ -1684,7 +1684,7 @@ struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt)else if (rt->rt_gw_family ==AF_INET6 ) new_rt->rt_gw6 = rt->rt_gw6; - new_rt->dst.input = rt->dst.input; + new_rt->dst.input =READ_ONCE (rt->dst.input); new_rt->dst.output = rt->dst.output; new_rt->dst.error = rt->dst.error; new_rt->dst.lastuse = jiffies;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/480 net: dst: annotate data-races around dst->output
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2dce8c52a98995c4719def6f88629ab1581c0b82 ]
dst_dev_put() can overwrite dst->output while other cpus might read this field (for instance from dst_output())
Add READ_ONCE()/WRITE_ONCE() annotations to suppress potential issues.
We will likely need RCU protection in the future.
--- include/net/dst.h | 2 +- include/net/lwtunnel.h | 4 ++-- net/core/dst.c | 2 +- net/ipv4/route.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-)
include/net/dst.h +1 -1
@@ -456,7 +456,7 @@ INDIRECT_CALLABLE_DECLARE(int ip_output(struct net *, struct sock *,/* Output packet to network from transport. */ static inline int dst_output (struct net *net,struct sock *sk,struct sk_buff *skb) { -return INDIRECT_CALL_INET (skb_dst (skb)->output, +return INDIRECT_CALL_INET (READ_ONCE (skb_dst (skb)->output), ip6_output, ip_output, net, sk, skb); }
include/net/lwtunnel.h +2 -2
@@ -140,8 +140,8 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len,static inline void lwtunnel_set_redirect (struct dst_entry *dst) {if (lwtunnel_output_redirect (dst->lwtstate)) { - dst->lwtstate->orig_output = dst->output; - dst->output = lwtunnel_output; + dst->lwtstate->orig_output =READ_ONCE (dst->output); +WRITE_ONCE (dst->output, lwtunnel_output); }if (lwtunnel_input_redirect (dst->lwtstate)) { dst->lwtstate->orig_input =READ_ONCE (dst->input);
net/core/dst.c +1 -1
@@ -149,7 +149,7 @@ void dst_dev_put(struct dst_entry *dst)if (dst->ops->ifdown) dst->ops->ifdown (dst, dev);WRITE_ONCE (dst->input, dst_discard); - dst->output = dst_discard_out; +WRITE_ONCE (dst->output, dst_discard_out); dst->dev = blackhole_netdev;netdev_ref_replace (dev, blackhole_netdev, &dst->dev_tracker,GFP_ATOMIC );
net/ipv4/route.c +1 -1
@@ -1685,7 +1685,7 @@ struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt) new_rt->rt_gw6 = rt->rt_gw6; new_rt->dst.input =READ_ONCE (rt->dst.input); - new_rt->dst.output = rt->dst.output; + new_rt->dst.output =READ_ONCE (rt->dst.output); new_rt->dst.error = rt->dst.error; new_rt->dst.lastuse = jiffies; new_rt->dst.lwtstate =lwtstate_get (rt->dst.lwtstate);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/480 net: dst: add four helpers to annotate data-races around dst->dev
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 88fe14253e181878c2ddb51a298ae8c468a63010 ]
dst->dev is read locklessly in many contexts,
and written in dst_dev_put().
Fixing all the races is going to need many changes.
We probably will have to add full RCU protection.
Add three helpers to ease this painful process.
static inline struct net_device *dst_dev(const struct dst_entry *dst)
{
return READ_ONCE(dst->dev);
}static inline struct net_device *skb_dst_dev(const struct sk_buff *skb)
{
return dst_dev(skb_dst(skb));
}static inline struct net *skb_dst_dev_net(const struct sk_buff *skb)
{
return dev_net(skb_dst_dev(skb));
}static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb)
{
return dev_net_rcu(skb_dst_dev(skb));
}--- include/net/dst.h | 20 ++++++++++++++++++++ net/core/dst.c | 4 ++-- net/core/sock.c | 8 ++++---- 3 files changed, 26 insertions(+), 6 deletions(-)
include/net/dst.h +20 -0
@@ -561,6 +561,26 @@ static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu) dst->ops->update_pmtu (dst,NULL , skb, mtu, false); } +static inline struct net_device *dst_dev (const struct dst_entry *dst) +{ +return READ_ONCE (dst->dev); +} + +static inline struct net_device *skb_dst_dev (const struct sk_buff *skb) +{ +return dst_dev (skb_dst (skb)); +} + +static inline struct net *skb_dst_dev_net (const struct sk_buff *skb) +{ +return dev_net (skb_dst_dev (skb)); +} + +static inline struct net *skb_dst_dev_net_rcu (const struct sk_buff *skb) +{ +return dev_net_rcu (skb_dst_dev (skb)); +} +struct dst_entry *dst_blackhole_check (struct dst_entry *dst,u32 cookie);void dst_blackhole_update_pmtu (struct dst_entry *dst,struct sock *sk,struct sk_buff *skb,u32 mtu,bool confirm_neigh);
net/core/dst.c +2 -2
@@ -150,7 +150,7 @@ void dst_dev_put(struct dst_entry *dst) dst->ops->ifdown (dst, dev);WRITE_ONCE (dst->input, dst_discard);WRITE_ONCE (dst->output, dst_discard_out); - dst->dev = blackhole_netdev; +WRITE_ONCE (dst->dev, blackhole_netdev);netdev_ref_replace (dev, blackhole_netdev, &dst->dev_tracker,GFP_ATOMIC ); }
@@ -263,7 +263,7 @@ unsigned int dst_blackhole_mtu(const struct dst_entry *dst) {unsigned int mtu =dst_metric_raw (dst,RTAX_MTU ); -return mtu ? : dst->dev->mtu; +return mtu ? :dst_dev (dst)->mtu; }EXPORT_SYMBOL_GPL (dst_blackhole_mtu);
net/core/sock.c +4 -4
@@ -2557,8 +2557,8 @@ static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst) !ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr));#endif /* pairs with the WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */ - max_size = is_ipv6 ?READ_ONCE (dst->dev->gso_max_size) : -READ_ONCE (dst->dev->gso_ipv4_max_size); + max_size = is_ipv6 ?READ_ONCE (dst_dev (dst)->gso_max_size) : +READ_ONCE (dst_dev (dst)->gso_ipv4_max_size);if (max_size >GSO_LEGACY_MAX_SIZE && !sk_is_tcp (sk)) max_size =GSO_LEGACY_MAX_SIZE ;
@@ -2569,7 +2569,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) {u32 max_segs =1 ; - sk->sk_route_caps = dst->dev->features; + sk->sk_route_caps =dst_dev (dst)->features;if (sk_is_tcp (sk)) {struct inet_connection_sock *icsk =inet_csk (sk);
@@ -2587,7 +2587,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) sk->sk_route_caps |=NETIF_F_SG |NETIF_F_HW_CSUM ; sk->sk_gso_max_size =sk_dst_gso_max_size (sk, dst);/* pairs with the WRITE_ONCE() in netif_set_gso_max_segs() */ - max_segs =max_t (u32,READ_ONCE (dst->dev->gso_max_segs),1 ); + max_segs =max_t (u32,READ_ONCE (dst_dev (dst)->gso_max_segs),1 ); } } sk->sk_gso_max_segs = max_segs;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/480 wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6 ]
Preserve the error code if iwl_setup_deferred_work() fails. The current code returns ERR_PTR(0) (which is NULL) on this path. I believe the missing error code potentially leads to a use after free involving debugfs.
--- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/dvm/main.c +2 -1
@@ -1468,7 +1468,8 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,/******************** * 6. Setup services ********************/ -if (iwl_setup_deferred_work (priv)) + err =iwl_setup_deferred_work (priv); +if (err) goto out_uninit_drv;iwl_setup_rx_handlers (priv);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/480 kselftest/arm64: Fix check for setting new VLs in sve-ptrace
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 867446f090589626497638f70b10be5e61a0b925 ]
The check that the new vector length we set was the expected one was typoed to an assignment statement which for some reason the compilers didn't spot, most likely due to the macros involved.
--- tools/testing/selftests/arm64/fp/sve-ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/arm64/fp/sve-ptrace.c +1 -1
@@ -253,7 +253,7 @@ static void ptrace_set_get_vl(pid_t child, const struct vec_type *type,return ; } -ksft_test_result (new_sve->vl = prctl_vl,"Set %s VL %u\n" , +ksft_test_result (new_sve->vl == prctl_vl,"Set %s VL %u\n" , type->name, vl);free (new_sve);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/480 bpf: Ensure RCU lock is held around bpf_prog_ksym_find
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit d090326860096df9dac6f27cff76d3f8df44d4f1 ]
Add a warning to ensure RCU lock is held around tree lookup, and then fix one of the invocations in bpf_stack_walker. The program has an active stack frame and won't disappear. Use the opportunity to remove unneeded invocation of is_bpf_text_address.
--- kernel/bpf/core.c | 5 ++++- kernel/bpf/helpers.c | 11 +++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-)
kernel/bpf/core.c +4 -1
@@ -778,7 +778,10 @@ bool is_bpf_text_address(unsigned long addr)struct bpf_prog *bpf_prog_ksym_find (unsigned long addr) { -struct bpf_ksym *ksym =bpf_ksym_find (addr); +struct bpf_ksym *ksym; + +WARN_ON_ONCE (!rcu_read_lock_held ()); + ksym =bpf_ksym_find (addr);return ksym && ksym->prog ? container_of(ksym, struct bpf_prog_aux, ksym)->prog :
kernel/bpf/helpers.c +9 -2
@@ -2864,9 +2864,16 @@ static bool bpf_stack_walker(void *cookie, u64 ip, u64 sp, u64 bp)struct bpf_throw_ctx *ctx = cookie;struct bpf_prog *prog; -if (!is_bpf_text_address (ip)) -return !ctx->cnt; +/* +* The RCU read lock is held to safely traverse the latch tree, but we +* don't need its protection when accessing the prog, since it has an +* active stack frame on the current stack trace, and won't disappear. +*/ +rcu_read_lock (); prog =bpf_prog_ksym_find (ip); +rcu_read_unlock (); +if (!prog) +return !ctx->cnt; ctx->cnt++;if (bpf_is_subprog (prog))return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/480 drm/msm/dpu: Fill in min_prefill_lines for SC8180X
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 5136acc40afc0261802e5cb01b04f871bf6d876b ]
Based on the downstream release, predictably same value as for SM8150.
Patchwork: https://patchwork.freedesktop.org/patch/657794/
--- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h +1 -0
@@ -383,6 +383,7 @@ static const struct dpu_perf_cfg sc8180x_perf_data = { .min_core_ib = 2400000, .min_llcc_ib = 800000, .min_dram_ib = 800000, + .min_prefill_lines = 24, .danger_lut_tbl = {0xf, 0xffff, 0x0}, .safe_lut_tbl = {0xfff0, 0xf000, 0xffff}, .qos_lut_tbl = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/480 m68k: Dont unregister boot console needlessly
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 83f672a7f69ec38b1bbb27221e342937f68c11c7 ]
When MACH_IS_MVME147, the boot console calls mvme147_scc_write() to generate console output. That will continue to work even after debug_cons_nputs() becomes unavailable so there's no need to unregister the boot console.
Take the opportunity to remove a repeated MACH_IS_* test. Use the actual .write method (instead of a wrapper) and test that pointer instead. This means adding an unused parameter to debug_cons_nputs() for consistency with the struct console API.
early_printk.c is only built when CONFIG_EARLY_PRINTK=y. As of late, head.S is only built when CONFIG_MMU_MOTOROLA=y. So let the former symbol depend on the latter, to obviate some ifdef conditionals.
--- arch/m68k/Kconfig.debug | 2 +- arch/m68k/kernel/early_printk.c | 42 +++++++++++---------------------- arch/m68k/kernel/head.S | 8 +++---- 3 files changed, 19 insertions(+), 33 deletions(-)
arch/m68k/Kconfig.debug +1 -1
@@ -10,7 +10,7 @@ config BOOTPARAM_STRING config EARLY_PRINTK bool "Early printk" - depends on !(SUN3 || M68000 || COLDFIRE) + depends on MMU_MOTOROLA help Write kernel log output directly to a serial port. Where implemented, output goes to the framebuffer as well.
arch/m68k/kernel/early_printk.c +14 -28
65 lines not on this page · raw message
arch/m68k/kernel/head.S +4 -4
@@ -3263,8 +3263,8 @@ func_return putn * turns around and calls the internal routines. This routine * is used by the boot console. * - * The calling parameters are: - * void debug_cons_nputs(const char *str, unsigned length) + * The function signature is - + * void debug_cons_nputs(struct console *c, const char *s, unsigned int n) * * This routine does NOT understand variable arguments only * simple strings!
@@ -3273,8 +3273,8 @@ ENTRY(debug_cons_nputs) moveml %d0/%d1/%a0,%sp@- movew %sr,%sp@- ori #0x0700,%sr - movel %sp@(18),%a0 /* fetch parameter */ - movel %sp@(22),%d1 /* fetch parameter */ + movel %sp@(22),%a0 /* char *s */ + movel %sp@(26),%d1 /* unsigned int n */ jra 2f 1: #ifdef CONSOLE_DEBUG
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/480 refscale: Check that nreaders and loops multiplication doesnt overflow
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Sadovnikov <[email protected]>
[ Upstream commit 005b6187705bc9723518ce19c5cb911fc1f7ef07 ]
The nreaders and loops variables are exposed as module parameters, which, in certain combinations, can lead to multiplication overflow.
Besides, loops parameter is defined as long, while through the code is used as int, which can cause truncation on 64-bit kernels and possible zeroes where they shouldn't appear.
Since code uses result of multiplication as int anyway, it only makes sense to replace loops with int. Multiplication overflow check is also added due to possible multiplication between two very big numbers.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- kernel/rcu/refscale.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
kernel/rcu/refscale.c +7 -3
@@ -85,7 +85,7 @@ torture_param(int, holdoff, IS_BUILTIN(CONFIG_RCU_REF_SCALE_TEST) ? 10 : 0,// Number of typesafe_lookup structures, that is, the degree of concurrency. torture_param (long, lookup_instances,0 ,"Number of typesafe_lookup structures." );// Number of loops per experiment, all readers execute operations concurrently. -torture_param (long, loops,10000 ,"Number of loops per experiment." ); +torture_param (int, loops,10000 ,"Number of loops per experiment." );// Number of readers, with -1 defaulting to about 75% of the CPUs. torture_param (int, nreaders,-1 ,"Number of readers, -1 for 75% of CPUs." );// Number of runs.
@@ -1140,7 +1140,7 @@ static void ref_scale_print_module_parms(const struct ref_scale_ops *cur_ops, const char *tag) { pr_alert("%s" SCALE_FLAG -"--- %s: verbose=%d verbose_batched=%d shutdown=%d holdoff=%d lookup_instances=%ld loops=%ld nreaders=%d nruns=%d readdelay=%d\n" , scale_type, tag, +"--- %s: verbose=%d verbose_batched=%d shutdown=%d holdoff=%d lookup_instances=%ld loops=%d nreaders=%d nruns=%d readdelay=%d\n" , scale_type, tag, verbose, verbose_batched, shutdown, holdoff, lookup_instances, loops, nreaders, nruns, readdelay); }
@@ -1238,12 +1238,16 @@ ref_scale_init(void)// Reader tasks (default to ~75% of online CPUs). if (nreaders <0 ) nreaders = (num_online_cpus () >>1 ) + (num_online_cpus () >>2 ); -if (WARN_ONCE (loops <=0 ,"%s: loops = %ld, adjusted to 1\n" , __func__, loops)) +if (WARN_ONCE (loops <=0 ,"%s: loops = %d, adjusted to 1\n" , __func__, loops)) loops =1 ;if (WARN_ONCE (nreaders <=0 ,"%s: nreaders = %d, adjusted to 1\n" , __func__, nreaders)) nreaders =1 ;if (WARN_ONCE (nruns <=0 ,"%s: nruns = %d, adjusted to 1\n" , __func__, nruns)) nruns =1 ; +if (WARN_ONCE (loops >INT_MAX / nreaders, +"%s: nreaders * loops will overflow, adjusted loops to %d" , + __func__,INT_MAX / nreaders)) + loops =INT_MAX / nreaders; reader_tasks =kcalloc (nreaders,sizeof (reader_tasks[0 ]),GFP_KERNEL );if (!reader_tasks) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/480 wifi: mt76: mt7996: Fix secondary link lookup in mt7996_mcu_sta_mld_setup_tlv()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit e8d7eef07199887161cd6f3c062406628781f8b6 ]
Use proper link_id value for secondary link lookup in mt7996_mcu_sta_mld_setup_tlv routine.
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +1 -2
@@ -2307,8 +2307,7 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,if (nlinks >1 ) { link_id =__ffs (links & ~BIT (msta->deflink_id)); - msta_link =mt76_dereference (msta->link[msta->deflink_id], - &dev->mt76); + msta_link =mt76_dereference (msta->link[link_id], &dev->mt76);if (!msta_link)return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 139/480 wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx()
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 64cbf0d7ce9afe20666da90ec6ecaec6ba5ac64b ]
Fis possible Out-Of-Boundary access in mt7996_tx routine if link_id is set to IEEE80211_LINK_UNSPECIFIED
--- .../net/wireless/mediatek/mt76/mt7996/main.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +12 -5
@@ -1216,10 +1216,17 @@ static void mt7996_tx(struct ieee80211_hw *hw,if (vif) {struct mt7996_vif *mvif = (void *)vif->drv_priv; -struct mt76_vif_link *mlink; +struct mt76_vif_link *mlink = &mvif->deflink.mt76; - mlink =rcu_dereference (mvif->mt76.link[link_id]); -if (mlink && mlink->wcid) +if (link_id <IEEE80211_LINK_UNSPECIFIED ) + mlink =rcu_dereference (mvif->mt76.link[link_id]); + +if (!mlink) { +ieee80211_free_txskb (hw, skb); + goto unlock; + } + +if (mlink->wcid) wcid = mlink->wcid; if (mvif->mt76.roc_phy &&
@@ -1228,7 +1235,7 @@ static void mt7996_tx(struct ieee80211_hw *hw,if (mphy->roc_link) wcid = mphy->roc_link->wcid; }else { - mphy =mt76_vif_link_phy (&mvif->deflink.mt76); + mphy =mt76_vif_link_phy (mlink); } }
@@ -1237,7 +1244,7 @@ static void mt7996_tx(struct ieee80211_hw *hw, goto unlock; } -if (control->sta) { +if (control->sta && link_id <IEEE80211_LINK_UNSPECIFIED ) {struct mt7996_sta *msta = (void *)control->sta->drv_priv;struct mt7996_sta_link *msta_link;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 140/480 wifi: mt76: mt7996: Fix valid_links bitmask in mt7996_mac_sta_{add,remove}
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit a59650a2270190905fdab79431140371feb35251 ]
sta->valid_links bitmask can be set even for non-MLO client.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +2 -2
@@ -1061,7 +1061,7 @@ mt7996_mac_sta_add(struct mt76_phy *mphy, struct ieee80211_vif *vif, struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv; -unsigned long links = sta->mlo ? sta->valid_links :BIT (0 ); +unsigned long links = sta->valid_links ? sta->valid_links :BIT (0 );int err;mutex_lock (&mdev->mutex);
@@ -1155,7 +1155,7 @@ mt7996_mac_sta_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif, {struct mt76_dev *mdev = mphy->dev; struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); -unsigned long links = sta->mlo ? sta->valid_links :BIT (0 ); +unsigned long links = sta->valid_links ? sta->valid_links :BIT (0 );mutex_lock (&mdev->mutex);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 141/480 drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit a54e4639c4ef37a0241bac7d2a77f2e6ffb57099 ]
There is a small typo in phm_wait_on_indirect_register().
Swap mask and value arguments provided to phm_wait_on_register() so that they satisfy the function signature and actual usage scheme.
Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
In practice this doesn't fix any issues because the only place this function is used uses the same value for the value and mask.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c +1 -1
@@ -149,7 +149,7 @@ int phm_wait_on_indirect_register(struct pp_hwmgr *hwmgr, }cgs_write_register (hwmgr->device, indirect_port, index); -return phm_wait_on_register (hwmgr, indirect_port +1 , mask, value); +return phm_wait_on_register (hwmgr, indirect_port +1 , value, mask); } int phm_wait_for_register_unequal(struct pp_hwmgr *hwmgr,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 142/480 wifi: ath12k: Block radio bring-up in FTM mode
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <[email protected]>
[ Upstream commit 80570587e418f361e7ce3f9200477f728b38c94b ]
Ensure that all radios remain down when the driver operates in Factory Test Mode (FTM). Reject any userspace attempts to bring up an interface in this mode.
Currently, the driver allows userspace to bring up the interface even though it operates in FTM mode, which violates FTM constraints and leads to FTM command failures.
Hence, block the radio start when the driver is in FTM mode. Also, remove ath12k_ftm_mode check from ath12k_drain_tx() because FTM mode check is already handled in the caller function (ath12k_mac_op_start()).
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/mac.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath12k/mac.c +4 -6
@@ -7689,14 +7689,9 @@ static int ath12k_mac_start(struct ath12k *ar)static void ath12k_drain_tx (struct ath12k_hw *ah) { -struct ath12k *ar = ah->radio; +struct ath12k *ar;int i; -if (ath12k_ftm_mode) { -ath12k_err (ar->ab,"fail to start mac operations in ftm mode\n" ); -return ; - } -lockdep_assert_wiphy (ah->hw->wiphy);for_each_ar (ah, ar, i)
@@ -7709,6 +7704,9 @@ static int ath12k_mac_op_start(struct ieee80211_hw *hw)struct ath12k *ar;int ret, i; +if (ath12k_ftm_mode) +return -EPERM ; +lockdep_assert_wiphy (hw->wiphy);ath12k_drain_tx (ah);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 143/480 drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port
In reply to Greg Kroah-Hartman6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <[email protected]>
[ Upstream commit f9f68bf1d0efeadb6c427c9dbb30f307a7def19b ]
Each window of a vop2 is usable by a specific set of video ports, so while binding the vop2, we look through the list of available windows trying to find one designated as primary-plane and usable by that specific port.
The code later wants to use drm_crtc_init_with_planes with that found primary plane, but nothing has checked so far if a primary plane was actually found.
For whatever reason, the rk3576 vp2 does not have a usable primary window (if vp0 is also in use) which brought the issue to light and ended in a null-pointer dereference further down.
As we expect a primary-plane to exist for a video-port, add a check at the end of the window-iteration and fail probing if none was found.
--- drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +4 -0
@@ -2422,6 +2422,10 @@ static int vop2_create_crtcs(struct vop2 *vop2)break ; } } + +if (!vp->primary_plane) +return dev_err_probe (drm->dev, -ENOENT , +"no primary plane for vp %d\n" , i); }/* Register all unused window as overlay plane */
Signature · 1 line
2.39.5