6.12.43-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.12.43-rc1 review
This is the start of the stable review cycle for the 6.12.43 release. There are 444 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 20 Aug 2025 12:43:43 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.43-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.43-rc1
Lukas Wunner <[email protected]>
PCI: Honor Max Link Speed when determining supported speeds
Shin'ichiro Kawasaki <[email protected]>
dm: split write BIOs on zone boundaries when zone append is not emulated
Frederic Weisbecker <[email protected]>
rcu: Fix racy re-initialization of irq_work causing hangs
Yu Kuai <[email protected]>
md: fix create on open mddev lifetime regression
Ivan Lipski <[email protected]>
drm/amd/display: Allow DCN301 to clear update flags
Arnd Bergmann <[email protected]>
firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS
Jens Axboe <[email protected]>
io_uring/rw: cast rw->flags assignment to rwf_t
Damien Le Moal <[email protected]>
ata: libata-sata: Add link_power_management_supported sysfs attribute
Miguel Ojeda <[email protected]>
rust: workaround rustdoc target modifiers bug
Miguel Ojeda <[email protected]>
rust: kbuild: clean output before running rustdoc
Siddharth Vadapalli <[email protected]>
arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C
Hrushikesh Salunke <[email protected]>
arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C
Lukas Wunner <[email protected]>
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
Manivannan Sadhasivam <[email protected]>
PCI: Allow PCI bridges to go to D3Hot on all non-x86
Ilpo Järvinen <[email protected]>
PCI: Store all PCIe Supported Link Speeds
Wang Zhaolong <[email protected]>
smb: client: fix netns refcount leak after net_passive changes
Eric Dumazet <[email protected]>
net: better track kernel sockets lifetime
Kuniyuki Iwashima <[email protected]>
net: Add net_passive_inc() and net_passive_dec().
Thomas Weißschuh <[email protected]>
mfd: cros_ec: Separate charge-control probing from USB-PD
Aditya Garg <[email protected]>
HID: apple: avoid setting up battery timer for devices without battery
Naman Jain <[email protected]>
tools/hv: fcopy: Fix irregularities with size of ring buffer
Mikhail Lobanov <[email protected]>
wifi: mac80211: check basic rates validity in sta_link_apply_parameters
Aditya Garg <[email protected]>
HID: magicmouse: avoid setting up battery timer when not needed
Pedro Falcato <[email protected]>
RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
Willy Tarreau <[email protected]>
tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
Marek Szyprowski <[email protected]>
media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
Ricardo Ribalda <[email protected]>
media: uvcvideo: Do not mark valid metadata as invalid
Vedang Nagar <[email protected]>
media: venus: Fix OOB read due to missing payload bound check
Youngjun Lee <[email protected]>
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
Breno Leitao <[email protected]>
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
Waiman Long <[email protected]>
mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
Anshuman Khandual <[email protected]>
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
Vlastimil Babka <[email protected]>
mm, slab: restore NUMA policy support for large kmalloc
Randy Dunlap <[email protected]>
parisc: Makefile: fix a typo in palo.conf
Haiyang Zhang <[email protected]>
hv_netvsc: Fix panic during namespace deletion with VF
Davide Caratti <[email protected]>
net/sched: ets: use old 'nbands' while purging unused classes
Sravan Kumar Gundu <[email protected]>
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
Suren Baghdasaryan <[email protected]>
userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
Andrey Albershteyn <[email protected]>
xfs: fix scrub trace with null pointer in quotacheck
Qu Wenruo <[email protected]>
btrfs: do not allow relocation of partially dropped subvolumes
Boris Burkov <[email protected]>
btrfs: fix iteration bug in __qgroup_excl_accounting()
Naohiro Aota <[email protected]>
btrfs: zoned: do not select metadata BG as finish target
Filipe Manana <[email protected]>
btrfs: error on missing block group when unaccounting log tree extent buffers
Filipe Manana <[email protected]>
btrfs: fix log tree replay failure due to file with 0 links and extents
Filipe Manana <[email protected]>
btrfs: clear dirty status from extent buffer on error at insert_new_root()
Filipe Manana <[email protected]>
btrfs: don't skip remaining extrefs if dir not found during log replay
Filipe Manana <[email protected]>
btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled
Qu Wenruo <[email protected]>
btrfs: populate otime when logging an inode item
Boris Burkov <[email protected]>
btrfs: fix ssd_spread overallocation
Filipe Manana <[email protected]>
btrfs: don't ignore inode missing when replaying log tree
Filipe Manana <[email protected]>
btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations
Naohiro Aota <[email protected]>
btrfs: zoned: do not remove unwritten non-data block group
Filipe Manana <[email protected]>
btrfs: abort transaction during log replay if walk_log_tree() failed
Johannes Thumshirn <[email protected]>
btrfs: zoned: use filesystem size not disk size for reclaim decision
Oliver Neukum <[email protected]>
cdc-acm: fix race between initial clearing halt and open
Eric Biggers <[email protected]>
thunderbolt: Fix copy+paste error in match_service_id()
Ian Abbott <[email protected]>
comedi: fix race between polling and detaching
Myrrh Periwinkle <[email protected]>
usb: typec: ucsi: Update power_supply on power role change
Ricky Wu <[email protected]>
misc: rtsx: usb: Ensure mmc child device is active when card is present
Xinyu Liu <[email protected]>
usb: core: config: Prevent OOB read in SS endpoint companion parsing
Zhang Yi <[email protected]>
ext4: initialize superblock fields in the kballoc-test.c kunit tests
Baokun Li <[email protected]>
ext4: fix largest free orders lists corruption on mb_optimize_scan switch
Baokun Li <[email protected]>
ext4: fix zombie groups in average fragment size lists
Jason Gunthorpe <[email protected]>
iommufd: Prevent ALIGN() overflow
Nicolin Chen <[email protected]>
iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
Alexey Klimov <[email protected]>
iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
Lu Baolu <[email protected]>
iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes
Shyam Prasad N <[email protected]>
cifs: reset iface weights when we cannot find a candidate
Christian Marangi <[email protected]>
clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src
Damien Le Moal <[email protected]>
dm: Always split write BIOs to zoned device limits
Damien Le Moal <[email protected]>
block: Introduce bio_needs_zone_write_plugging()
Bijan Tabatabai <[email protected]>
mm/damon/core: commit damos->target_nid
Jack Xiao <[email protected]>
drm/amdgpu: fix incorrect vm flags to map bo
YiPeng Chai <[email protected]>
drm/amdgpu: fix vram reservation issue
David Howells <[email protected]>
cifs: Fix collect_sample() to handle any iterator type
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: replace regmap_write with regmap_update_bits
Jiasheng Jiang <[email protected]>
scsi: lpfc: Remove redundant assignment to avoid memory leak
Meagan Lloyd <[email protected]>
rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
Sergey Bashirov <[email protected]>
pNFS: Fix uninited ptr deref in block/scsi layout
Sergey Bashirov <[email protected]>
pNFS: Handle RPC size limit for layoutcommits
Sergey Bashirov <[email protected]>
pNFS: Fix disk addr range check in block/scsi layout
Sergey Bashirov <[email protected]>
pNFS: Fix stripe mapping in block/scsi layout
John Garry <[email protected]>
block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Fix uninitialized pointer error in probe()
Buday Csaba <[email protected]>
net: phy: smsc: add proper reset flags for LAN8710A
Thomas Croft <[email protected]>
ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table
Yu Kuai <[email protected]>
lib/sbitmap: convert shallow_depth from one word to the whole sbitmap
Stefan Metzmacher <[email protected]>
smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in _smbd_get_connection
Calvin Owens <[email protected]>
tools/power turbostat: Handle cap_get_proc() ENOSYS
Calvin Owens <[email protected]>
tools/power turbostat: Fix build with musl
Len Brown <[email protected]>
tools/power turbostat: Handle non-root legacy-uncore sysfs permissions
Corey Minyard <[email protected]>
ipmi: Fix strcpy source and destination the same
Yann E. MORIN <[email protected]>
kconfig: lxdialog: fix 'space' to (de)select options
Masahiro Yamada <[email protected]>
kconfig: gconf: fix potential memory leak in renderer_edited()
Masahiro Yamada <[email protected]>
kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
Breno Leitao <[email protected]>
ipmi: Use dev_warn_ratelimited() for incorrect message warnings
Artem Sadovnikov <[email protected]>
vfio/mlx5: fix possible overflow in tracking max message size
John Garry <[email protected]>
scsi: aacraid: Stop using PCI_IRQ_AFFINITY
Maurizio Lombardi <[email protected]>
scsi: target: core: Generate correct identifiers for PR OUT transport IDs
Ranjan Kumar <[email protected]>
scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
Shankari Anand <[email protected]>
kconfig: nconf: Ensure null termination where strncpy is used
Keith Busch <[email protected]>
vfio/type1: conditional rescheduling while pinning
Suchit Karunakaran <[email protected]>
kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
John Ogness <[email protected]>
printk: nbcon: Allow reacquire during panic
Jaegeuk Kim <[email protected]>
f2fs: check the generic conditions first
Yuezhang Mo <[email protected]>
exfat: add cluster chain loop check for dir
fangzhong.zhou <[email protected]>
i2c: Force DLL0945 touchpad i2c freq to 100khz
John Johansen <[email protected]>
apparmor: fix x_table_lookup when stacking is not the first entry
Mateusz Guzik <[email protected]>
apparmor: use the condition in AA_BUG_FMT even with debug disabled
Benjamin Marzinski <[email protected]>
dm-table: fix checking for rq stackable devices
Mikulas Patocka <[email protected]>
dm-mpath: don't print the "loaded" message if registering fails
Jorge Marques <[email protected]>
i3c: master: Initialize ret in i3c_i2c_notifier_call()
Wolfram Sang <[email protected]>
i3c: don't fail if GETHDRCAP is unsupported
Gabriel Totev <[email protected]>
apparmor: shift ouid when mediating hard links in userns
Meagan Lloyd <[email protected]>
rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
Wolfram Sang <[email protected]>
i3c: add missing include to internal header
Petr Pavlu <[email protected]>
module: Prevent silent truncation of module name in delete_module(2)
Purva Yeshi <[email protected]>
md: dm-zoned-target: Initialize return variable r to avoid uninitialized use
Charles Keepax <[email protected]>
soundwire: Move handle_nested_irq outside of sdw_dev_lock
Vijendar Mukunda <[email protected]>
soundwire: amd: cancel pending slave status handling workqueue during remove sequence
Vijendar Mukunda <[email protected]>
soundwire: amd: serialize amd manager resume sequence during pm_prepare
Claudiu Beznea <[email protected]>
clk: renesas: rzg2l: Postpone updating priv->clks[]
Mario Limonciello <[email protected]>
crypto: ccp - Add missing bootloader info reg for pspv6
Bharat Bhushan <[email protected]>
crypto: octeontx2 - add timeout for load_fvc completion poll
chenchangcheng <[email protected]>
media: uvcvideo: Fix bandwidth issue for Alcor camera
Ricardo Ribalda <[email protected]>
media: uvcvideo: Add quirk for HP Webcam HD 2300
Alex Guo <[email protected]>
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
Alex Guo <[email protected]>
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
Wolfram Sang <[email protected]>
media: usb: hdpvr: disable zero-length read messages
Dave Stevenson <[email protected]>
media: tc358743: Increase FIFO trigger level to 374
Dave Stevenson <[email protected]>
media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
Dave Stevenson <[email protected]>
media: tc358743: Check I2C succeeded during probe
Cheick Traore <[email protected]>
pinctrl: stm32: Manage irq affinity settings
Damien Le Moal <[email protected]>
scsi: mpi3mr: Correctly handle ATA device errors
Damien Le Moal <[email protected]>
scsi: mpt3sas: Correctly handle ATA device errors
Abel Vesa <[email protected]>
power: supply: qcom_battmgr: Add lithium-polymer entry
Justin Tee <[email protected]>
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
Justin Tee <[email protected]>
scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk
Arnd Bergmann <[email protected]>
RDMA/core: reduce stack using in nldev_stat_get_doit()
Yury Norov [NVIDIA] <[email protected]>
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
Amelie Delaunay <[email protected]>
dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs
Johan Adolfsson <[email protected]>
leds: leds-lp50xx: Handle reg to get correct multi_index
Niklas Söderlund <[email protected]>
media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control
Daniel Scally <[email protected]>
media: ipu-bridge: Add _HID for OV5670
Michal Wilczynski <[email protected]>
clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED
Shiji Yang <[email protected]>
MIPS: lantiq: falcon: sysctrl: fix request memory check logic
Thomas Weißschuh <[email protected]>
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
Markus Theil <[email protected]>
crypto: jitter - fix intermediary handling
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM
Hans de Goede <[email protected]>
media: hi556: Fix reset GPIO timings
Arnaud Lecomte <[email protected]>
jfs: upper bound check of tree index in dbAllocAG
Edward Adam Davis <[email protected]>
jfs: Regular file corruption check
Lizhi Xu <[email protected]>
jfs: truncate good inode pages when hard link is 0
jackysliu <[email protected]>
scsi: bfa: Double-free fix
Ziyan Fu <[email protected]>
watchdog: iTCO_wdt: Report error if timeout configuration fails
Shiji Yang <[email protected]>
MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}George Moussalem <[email protected]>
clk: qcom: ipq5018: keep XO clock always on
Florin Leotescu <[email protected]>
hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state
Sebastian Reichel <[email protected]>
watchdog: dw_wdt: Fix default timeout
Amir Mohammad Jahangirzad <[email protected]>
fs/orangefs: use snprintf() instead of sprintf()
Showrya M N <[email protected]>
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
Geraldo Nascimento <[email protected]>
phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
Chen-Yu Tsai <[email protected]>
mfd: axp20x: Set explicit ID for AXP313 regulator
Pei Xiao <[email protected]>
clk: tegra: periph: Fix error handling and resolve unsigned compare warning
Theodore Ts'o <[email protected]>
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
Zhiqi Song <[email protected]>
crypto: hisilicon/hpre - fix dma unmap sequence
Yongzhen Zhang <[email protected]>
fbdev: fix potential buffer overflow in do_register_framebuffer()
Pali Rohár <[email protected]>
cifs: Fix calling CIFSFindFirst() for root path without msearch
Aaron Plattner <[email protected]>
watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition
Roman Li <[email protected]>
drm/amd/display: Disable dsc_power_gate for dcn314 by default
Mario Limonciello <[email protected]>
drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
Mario Limonciello <[email protected]>
drm/amd/display: Only finalize atomic_obj if it was initialized
Jason Wang <[email protected]>
vhost: fail early when __vhost_add_used() fails
Will Deacon <[email protected]>
vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
Joel Fernandes <[email protected]>
rcu: Fix rcu_read_unlock() deadloop due to IRQ work
Tvrtko Ursulin <[email protected]>
drm/ttm: Respect the shrinker core free target
Wayne Lin <[email protected]>
drm/amd/display: Avoid trying AUX transactions on disconnected ports
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Update DMCUB loading sequence for DCN3.5
Yonghong Song <[email protected]>
selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
Yonghong Song <[email protected]>
selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size
Ihor Solodrai <[email protected]>
bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
Jakub Kicinski <[email protected]>
uapi: in6: restore visibility of most IPv6 socket options
Emily Deng <[email protected]>
drm/ttm: Should to return the evict error
Lad Prabhakar <[email protected]>
drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
Hari Kalavakunta <[email protected]>
net: ncsi: Fix buffer overflow in fetching version id
Tvrtko Ursulin <[email protected]>
drm/xe: Make dma-fences compliant with the safe access rules
Shannon Nelson <[email protected]>
ionic: clean dbpage in de-init
Thomas Fourier <[email protected]>
wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
Chih-Kang Chang <[email protected]>
wifi: rtw89: scan abort when assign/unassign_vif
Breno Leitao <[email protected]>
ptp: Use ratelimite for freerun error message
Yuan Chen <[email protected]>
bpftool: Fix JSON writer resource leak in version command
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent DIS_LEARNING access on BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: ensure BCM5325 PHYs are enabled
Alok Tiwari <[email protected]>
gve: Return error for unknown admin queue command
Gal Pressman <[email protected]>
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
Gal Pressman <[email protected]>
net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
Mario Limonciello <[email protected]>
drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual
Heiner Kallweit <[email protected]>
dpaa_eth: don't use fixed_phy_change_carrier
Nicolas Escande <[email protected]>
neighbour: add support for NUD_PERMANENT proxy entries
Stanislaw Gruszka <[email protected]>
wifi: iwlegacy: Check rate_idx range after addition
Mark Rutland <[email protected]>
arm64: stacktrace: Check kretprobe_find_ret_addr() return value
Mina Almasry <[email protected]>
netmem: fix skb_frag_address_safe with unreadable skbs
Thomas Fourier <[email protected]>
powerpc: floppy: Add missing checks after DMA map
Karthikeyan Kathirvel <[email protected]>
wifi: ath12k: Decrement TID on RX peer frag setup error handling
Raj Kumar Bhagat <[email protected]>
wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
Thomas Fourier <[email protected]>
wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_rx_interrupt().
Ramya Gnanasekar <[email protected]>
wifi: mac80211: update radar_required in channel context after channel switch
Alex Hung <[email protected]>
drm/amd/display: Initialize mode_select to 0
Wen Chen <[email protected]>
drm/amd/display: Fix 'failed to blank crtc!'
Pagadala Yesu Anjaneyulu <[email protected]>
wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
Rand Deeb <[email protected]>
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
Nathan Lynch <[email protected]>
lib: packing: Include necessary headers
Hari Chandrakanthan <[email protected]>
wifi: ath12k: Fix station association with MBSSID Non-TX BSS
Sarika Sharma <[email protected]>
wifi: ath12k: Add memset and update default rate value in wmi tx completion
Kang Yang <[email protected]>
wifi: ath10k: shutdown driver when hardware is unreliable
Ilya Bakoulin <[email protected]>
drm/amd/display: Separate set_gsl from set_gsl_source_select
Jonas Rebmann <[email protected]>
net: fec: allow disable coalescing
RubenKelevra <[email protected]>
net: ieee8021q: fix insufficient table-size assertion
Li Chen <[email protected]>
ACPI: Suppress misleading SPCR console message when SPCR table is absent
Eric Work <[email protected]>
net: atlantic: add set_power to fw_ops for atl2 to fix wol
Aakash Kumar S <[email protected]>
xfrm: Duplicate SPI Handling
zhangjianrong <[email protected]>
net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
zhangjianrong <[email protected]>
net: thunderbolt: Enable end-to-end flow control also in transmit
Matt Roper <[email protected]>
drm/xe/xe_query: Use separate iterator while filling GT list
Mark Brown <[email protected]>
kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
David Bauer <[email protected]>
wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
Bitterblue Smith <[email protected]>
wifi: rtw89: Fix rtw89_mac_power_switch() for USB
Alessio Belle <[email protected]>
drm/imagination: Clear runtime PM errors while resetting the GPU
Robin Murphy <[email protected]>
perf/arm: Add missing .suppress_bind_attrs
Yuan Chen <[email protected]>
drm/msm: Add error handling for krealloc in metadata setup
Rob Clark <[email protected]>
drm/msm: use trylock for debugfs
Hari Chandrakanthan <[email protected]>
wifi: mac80211: fix rx link assignment for non-MLO stations
Zqiang <[email protected]>
rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc().
Thomas Fourier <[email protected]>
(powerpc/512) Fix possible dma_unmap_single() on uninitialized pointer
Heiko Carstens <[email protected]>
s390/early: Copy last breaking event address to pt_regs
Miri Korenblit <[email protected]>
wifi: mac80211: avoid weird state in error path
Johannes Berg <[email protected]>
wifi: mac80211: don't complete management TX on SAE commit
Chris Mason <[email protected]>
sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
Kamil Horák - 2N <[email protected]>
net: phy: bcm54811: PHY initialization
Sven Schnelle <[email protected]>
s390/stp: Remove udelay from stp_sync_clock()
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: fix scan request validation
Thomas Weißschuh <[email protected]>
um: Re-evaluate thread flags repeatedly
Miri Korenblit <[email protected]>
wifi: iwlwifi: mvm: set gtk id also in older FWs
Paul Chaignon <[email protected]>
bpf: Forget ranges when refining tnum after JSET
Juri Lelli <[email protected]>
sched/deadline: Fix accounting after global limits change
Alok Tiwari <[email protected]>
perf/cxlpmu: Remove unintended newline from IRQ name format string
Biju Das <[email protected]>
net: phy: micrel: Add ksz9131_resume()
Alok Tiwari <[email protected]>
net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
Oscar Maes <[email protected]>
net: ipv4: fix incorrect MTU in broadcast routes
Johannes Berg <[email protected]>
wifi: mac80211: don't unreserve never reserved chanctx
Ilan Peer <[email protected]>
wifi: cfg80211: Fix interface type validation
Matt Johnston <[email protected]>
net: mctp: Prevent duplicate binds
Vincent Mailhol <[email protected]>
can: ti_hecc: fix -Woverflow compiler warning
Charlene Liu <[email protected]>
drm/amd/display: limit clear_update_flags to dcn32 and above
Paul E. McKenney <[email protected]>
rcu: Protect ->defer_qs_iw_pending from data race
Umio Yasuno <[email protected]>
drm/amd/pm: fix null pointer access
Breno Leitao <[email protected]>
arm64: Mark kernel as tainted on SAE and SError panic
Jack Ping CHNG <[email protected]>
net: pcs: xpcs: mask readl() return value to 16 bits
Leon Romanovsky <[email protected]>
net/mlx5e: Properly access RCU protected qdisc_sleeping variable
Thomas Fourier <[email protected]>
net: ag71xx: Add missing check after DMA map
Thomas Fourier <[email protected]>
et131x: Add missing check after DMA map
Bitterblue Smith <[email protected]>
wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
Chin-Yen Lee <[email protected]>
wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode
Ahmed Zaki <[email protected]>
idpf: preserve coalescing settings across resets
Eduard Zingerman <[email protected]>
libbpf: Verify that arena map exists when adding arena relocations
Alok Tiwari <[email protected]>
be2net: Use correct byte order and format string for TCP seq and ack_seq
Sven Schnelle <[email protected]>
s390/time: Use monotonic clock in get_cycles()
Johannes Berg <[email protected]>
wifi: cfg80211: reject HTC bit for management frames
Steven Rostedt <[email protected]>
ktest.pl: Prevent recursion of default variable options
Sarika Sharma <[email protected]>
wifi: ath12k: Correct tid cleanup when tid setup fails
Oliver Neukum <[email protected]>
net: usb: cdc-ncm: check for filtering capability
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn
Anthoine Bourgeois <[email protected]>
xen/netfront: Fix TX response spurious interrupts
Zijun Hu <[email protected]>
Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
En-Wei Wu <[email protected]>
Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925
Ben Hutchings <[email protected]>
bootconfig: Fix unaligned access when building footer
Steven Rostedt <[email protected]>
powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
Sebastian Andrzej Siewior <[email protected]>
selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps
Srinivas Kandagatla <[email protected]>
ASoC: qcom: use drvdata instead of component to keep id
Xinxin Wan <[email protected]>
ASoC: codecs: rt5640: Retry DEVICE_ID verification
Jonathan Santos <[email protected]>
iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
Cristian Ciocaltea <[email protected]>
ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
Christophe Leroy <[email protected]>
ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
Lucy Thrun <[email protected]>
ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
Tomasz Michalec <[email protected]>
platform/chrome: cros_ec_typec: Defer probe on missing EC parent
Kees Cook <[email protected]>
platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
Bjorn Andersson <[email protected]>
soc: qcom: mdt_loader: Actually use the e_phoff
Krzysztof Hałasa <[email protected]>
imx8m-blk-ctrl: set ISI panic write hurry level
Gautham R. Shenoy <[email protected]>
pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
Oliver Neukum <[email protected]>
usb: core: usb_submit_urb: downgrade type check
Tomasz Michalec <[email protected]>
usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
Peter Ujfalusi <[email protected]>
ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
Joseph Tilahun <[email protected]>
tty: serial: fix print format specifiers
Peter Ujfalusi <[email protected]>
ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode
Alok Tiwari <[email protected]>
ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
Mark Brown <[email protected]>
ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
Pawan Gupta <[email protected]>
x86/bugs: Avoid warning when overriding return thunk
Takashi Iwai <[email protected]>
ALSA: hda: Disable jack polling at shutdown
Takashi Iwai <[email protected]>
ALSA: hda: Handle the jack polling always via a work
Gwendal Grignou <[email protected]>
platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready
Ulf Hansson <[email protected]>
mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
Hans de Goede <[email protected]>
mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
Zijun Hu <[email protected]>
char: misc: Fix improper and inaccurate error code returned by misc_init()
Peter Robinson <[email protected]>
reset: brcmstb: Enable reset drivers for ARCH_BCM2835
Eliav Farber <[email protected]>
pps: clients: gpio: fix interrupt handling order in remove path
Thomas Weißschuh <[email protected]>
selftests: vDSO: vdso_test_getrandom: Always print TAP header
Breno Leitao <[email protected]>
ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
Sebastian Ott <[email protected]>
ACPI: processor: fix acpi_object initialization
tuhaowen <[email protected]>
PM: sleep: console: Fix the black screen issue
Hsin-Te Yuan <[email protected]>
thermal: sysfs: Return ENODATA instead of EAGAIN for reads
Rafael J. Wysocki <[email protected]>
PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
Thierry Reding <[email protected]>
firmware: tegra: Fix IVC dependency problems
Peng Fan <[email protected]>
firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume
Zhu Qiyu <[email protected]>
ACPI: PRM: Reduce unnecessary printing to avoid user confusion
Masami Hiramatsu (Google) <[email protected]>
selftests: tracing: Use mutex_unlock for testing glob filter
Thomas Weißschuh <[email protected]>
tools/build: Fix s390(x) cross-compilation with clang
Aaron Kling <[email protected]>
ARM: tegra: Use I/O memcpy to write to IRAM
Michael Walle <[email protected]>
mfd: tps6594: Add TI TPS652G1 support
Bartosz Golaszewski <[email protected]>
gpio: tps65912: check the return value of regmap_update_bits()
David Lechner <[email protected]>
iio: adc: ad_sigma_delta: don't overallocate scan buffer
Thomas Weißschuh <[email protected]>
tools/nolibc: define time_t in terms of __kernel_old_time_t
David Collins <[email protected]>
thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
Kuninori Morimoto <[email protected]>
ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
Shubhrajyoti Datta <[email protected]>
EDAC/synopsys: Clear the ECC counters on init
Lifeng Zheng <[email protected]>
PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
Alexander Kochetkov <[email protected]>
ARM: rockchip: fix kernel hang during smp initialization
Li RongQing <[email protected]>
cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
Lifeng Zheng <[email protected]>
cpufreq: Exit governor when failed to start old governor
Bartosz Golaszewski <[email protected]>
gpio: wcd934x: check the return value of regmap_update_bits()
Guillaume La Roque <[email protected]>
pmdomain: ti: Select PM_GENERIC_DOMAINS
André Draszik <[email protected]>
usb: typec: tcpm/tcpci_maxim: fix irq wake usage
Hiago De Franco <[email protected]>
remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
Shuai Xue <[email protected]>
ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
Maulik Shah <[email protected]>
soc: qcom: rpmh-rsc: Add RSC version 4 support
Bartosz Golaszewski <[email protected]>
firmware: qcom: scm: initialize tzmem before marking SCM as available
Mario Limonciello <[email protected]>
usb: xhci: Avoid showing errors during surprise removal
Jay Chen <[email protected]>
usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
Mario Limonciello <[email protected]>
usb: xhci: Avoid showing warnings for dying controller
Benson Leung <[email protected]>
usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
Cynthia Huang <[email protected]>
selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
Prashant Malani <[email protected]>
cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
Mario Limonciello <[email protected]>
platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
Su Hui <[email protected]>
usb: xhci: print xhci->xhc_state when queue_command failed
Steven Rostedt <[email protected]>
tracefs: Add d_delete to remove negative dentries
Al Viro <[email protected]>
securityfs: don't pin dentries twice, once is enough...
Al Viro <[email protected]>
fix locking in efi_secret_unlink()
Wei Gao <[email protected]>
ext2: Handle fiemap on empty files to prevent EINVAL
Christian Brauner <[email protected]>
pidfs: raise SB_I_NODEV and SB_I_NOEXEC
Xiao Ni <[email protected]>
md: Don't clear MD_CLOSING until mddev is freed
Rong Zhang <[email protected]>
fs/ntfs3: correctly create symlink for relative path
Lizhi Xu <[email protected]>
fs/ntfs3: Add sanity check for file name
Damien Le Moal <[email protected]>
ata: libata-sata: Disallow changing LPM state if not supported
Damien Le Moal <[email protected]>
ata: ahci: Disable DIPM if host lacks support
Damien Le Moal <[email protected]>
ata: ahci: Disallow LPM policy control if not supported
Al Viro <[email protected]>
better lockdep annotations for simple_recursive_removal()
Viacheslav Dubeyko <[email protected]>
hfs: fix not erasing deleted b-tree node issue
Sarah Newman <[email protected]>
drbd: add missing kref_get in handle_write_conflicts
Jan Kara <[email protected]>
udf: Verify partition map count
Jan Kara <[email protected]>
loop: Avoid updating block size under exclusive owner
Xiao Ni <[email protected]>
md: call del_gendisk in control path
Andrew Price <[email protected]>
gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
Andrew Price <[email protected]>
gfs2: Validate i_depth for exhash directories
Maurizio Lombardi <[email protected]>
nvme-tcp: log TLS handshake failures at error level
John Garry <[email protected]>
md/raid10: set chunk_sectors limit
John Garry <[email protected]>
dm-stripe: limit chunk_sectors to the stripe size
Keith Busch <[email protected]>
nvme-pci: try function level reset on init failure
NeilBrown <[email protected]>
smb/server: avoid deadlock when linking with ReplaceIfExists
Yeoreum Yun <[email protected]>
firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall
Kees Cook <[email protected]>
arm64: Handle KCOV __init vs inline mismatches
Tetsuo Handa <[email protected]>
hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
Viacheslav Dubeyko <[email protected]>
hfs: fix slab-out-of-bounds in hfs_bnode_read()
Viacheslav Dubeyko <[email protected]>
hfs: fix general protection fault in hfs_find_init()
Sven Stegemann <[email protected]>
net: kcm: Fix race condition in kcm_unattach()
Jakub Kicinski <[email protected]>
tls: handle data disappearing from under the TLS ULP
Jeongjun Park <[email protected]>
ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Avoid using invalid recent intervals data
Len Brown <[email protected]>
intel_idle: Allow loading ACPI tables for any family
Xin Long <[email protected]>
sctp: linearize cloned gso packets in sctp_rcv
Alok Tiwari <[email protected]>
net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
MD Danish Anwar <[email protected]>
net: ti: icssg-prueth: Fix emac link speed handling
Florian Westphal <[email protected]>
netfilter: ctnetlink: fix refcount leak on table dump
Sabrina Dubroca <[email protected]>
udp: also consider secpath when evaluating ipsec use for checksumming
Jinjiang Tu <[email protected]>
mm/smaps: fix race between smaps_hugetlb_range and migration
Al Viro <[email protected]>
habanalabs: fix UAF in export_dmabuf()
Maxim Levitsky <[email protected]>
KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest
Maxim Levitsky <[email protected]>
KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
Maxim Levitsky <[email protected]>
KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
Sean Christopherson <[email protected]>
KVM: VMX: Extract checking of guest's DEBUGCTL into helper
Sean Christopherson <[email protected]>
KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
Sean Christopherson <[email protected]>
KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
Sean Christopherson <[email protected]>
KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap
Stefan Metzmacher <[email protected]>
smb: client: don't wait for info->send_pending == 0 on error
Stefan Metzmacher <[email protected]>
smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
Li Zhijian <[email protected]>
mm/memory-tier: fix abstract distance calculation overflow
Damien Le Moal <[email protected]>
block: Make REQ_OP_ZONE_FINISH a write operation
Rafael J. Wysocki <[email protected]>
ACPI: processor: perflib: Move problematic pr->performance check
Jiayi Li <[email protected]>
ACPI: processor: perflib: Fix initial _PPC limit application
Andy Shevchenko <[email protected]>
Documentation: ACPI: Fix parent device references
Jann Horn <[email protected]>
eventpoll: Fix semi-unbounded recursion
Sasha Levin <[email protected]>
fs: Prevent file descriptor table allocations exceeding INT_MAX
Eric Biggers <[email protected]>
fscrypt: Don't use problematic non-inline crypto engines
André Draszik <[email protected]>
clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock
André Draszik <[email protected]>
clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD
André Draszik <[email protected]>
clk: samsung: exynos850: fix a comment
Ma Ke <[email protected]>
sunvdc: Balance device refcount in vdc_port_mpgroup_check
Yao Zi <[email protected]>
LoongArch: Avoid in-place string operation on FDT content
Huacai Chen <[email protected]>
LoongArch: Make relocate_new_kernel_size be a .quad value
Thomas Weißschuh <[email protected]>
LoongArch: Don't use %pK through printk() in unwinder
Haoran Jiang <[email protected]>
LoongArch: BPF: Fix jump offset calculation in tailcall
Huacai Chen <[email protected]>
PCI: Extend isolated function probing to LoongArch
Trond Myklebust <[email protected]>
NFS: Fix the setting of capabilities when automounting a new filesystem
Dai Ngo <[email protected]>
NFSD: detect mismatch of file handle and delegation stateid in OPEN op
Jeff Layton <[email protected]>
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
Xu Yang <[email protected]>
net: usb: asix_devices: add phy_mask for ax88772 mdio bus
Johan Hovold <[email protected]>
net: dpaa: fix device leak when querying time stamp info
Johan Hovold <[email protected]>
net: ti: icss-iep: fix device and OF node leaks at probe
Johan Hovold <[email protected]>
net: mtk_eth_soc: fix device leak at probe
Johan Hovold <[email protected]>
net: enetc: fix device and OF node leak at probe
Johan Hovold <[email protected]>
net: gianfar: fix device leak when querying time stamp info
Heiner Kallweit <[email protected]>
net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect
Florian Larysch <[email protected]>
net: phy: micrel: fix KSZ8081/KSZ8091 cable test
Fedor Pchelkin <[email protected]>
netlink: avoid infinite retry looping in netlink_unicast()
Daniel Golle <[email protected]>
Revert "leds: trigger: netdev: Configure LED blink interval for HW offload"
Krzysztof Kozlowski <[email protected]>
leds: flash: leds-qcom-flash: Fix registry access after re-bind
David Thompson <[email protected]>
gpio: mlxbf3: use platform_get_irq_optional()
David Thompson <[email protected]>
Revert "gpio: mlxbf3: only get IRQ for device instance 0"
David Thompson <[email protected]>
gpio: mlxbf2: use platform_get_irq_optional()
Harald Mommer <[email protected]>
gpio: virtio: Fix config space reading.
Wang Zhaolong <[email protected]>
smb: client: remove redundant lstrp update in negotiate protocol
Steve French <[email protected]>
smb3: fix for slab out of bounds on mount to ksmbd
Christopher Eby <[email protected]>
ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
Vasiliy Kovalev <[email protected]>
ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
Takashi Iwai <[email protected]>
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
Takashi Iwai <[email protected]>
ALSA: usb-audio: Validate UAC3 power domain descriptors, too
Pavel Begunkov <[email protected]>
io_uring: don't use int for ABI
-------------
Diffstat:
Documentation/filesystems/fscrypt.rst | 37 +++---- Documentation/firmware-guide/acpi/i2c-muxes.rst | 8 +- Makefile | 4 +- arch/arm/mach-rockchip/platsmp.c | 15 +-- arch/arm/mach-tegra/reset.c | 2 +- arch/arm64/boot/dts/ti/k3-j722s-evm.dts | 4 +- arch/arm64/include/asm/acpi.h | 2 +- arch/arm64/kernel/acpi.c | 10 +- arch/arm64/kernel/stacktrace.c | 2 + arch/arm64/kernel/traps.c | 1 + arch/arm64/mm/fault.c | 1 + arch/arm64/mm/ptdump_debugfs.c | 3 - arch/loongarch/kernel/env.c | 13 ++- arch/loongarch/kernel/relocate_kernel.S | 2 +- arch/loongarch/kernel/unwind_orc.c | 2 +- arch/loongarch/net/bpf_jit.c | 21 +--- arch/mips/include/asm/vpe.h | 8 ++ arch/mips/kernel/process.c | 16 +-- arch/mips/lantiq/falcon/sysctrl.c | 23 ++--- arch/parisc/Makefile | 2 +- arch/powerpc/include/asm/floppy.h | 5 +- arch/powerpc/platforms/512x/mpc512x_lpbfifo.c | 6 +- arch/riscv/mm/ptdump.c | 3 - arch/s390/include/asm/timex.h | 13 ++- arch/s390/kernel/early.c | 1 + arch/s390/kernel/time.c | 2 +- arch/s390/mm/dump_pagetables.c | 2 - arch/um/include/asm/thread_info.h | 4 + arch/um/kernel/process.c | 18 ++-- arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 15 ++- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/cpu/bugs.c | 5 +- arch/x86/kvm/svm/svm.c | 14 +-- arch/x86/kvm/vmx/main.c | 3 +- arch/x86/kvm/vmx/nested.c | 21 +++- arch/x86/kvm/vmx/pmu_intel.c | 8 +- arch/x86/kvm/vmx/vmx.c | 57 ++++++----- arch/x86/kvm/vmx/vmx.h | 26 +++++ arch/x86/kvm/vmx/x86_ops.h | 2 +- arch/x86/kvm/x86.c | 25 ++++- block/bfq-iosched.c | 35 +++---- block/bfq-iosched.h | 3 +- block/blk-mq.c | 6 +- block/blk-settings.c | 2 +- block/blk-zoned.c | 20 +--- block/kyber-iosched.c | 9 +- block/mq-deadline.c | 16 +-- crypto/jitterentropy-kcapi.c | 9 +- drivers/accel/habanalabs/common/memory.c | 23 ++--- drivers/acpi/acpi_processor.c | 2 +- drivers/acpi/apei/ghes.c | 13 +++ drivers/acpi/prmt.c | 26 ++++- drivers/acpi/processor_perflib.c | 11 +++ drivers/ata/ahci.c | 12 ++- drivers/ata/ata_piix.c | 1 + drivers/ata/libahci.c | 1 + drivers/ata/libata-sata.c | 52 ++++++++-- drivers/base/power/runtime.c | 5 + drivers/block/drbd/drbd_receiver.c | 6 +- drivers/block/loop.c | 38 ++++++-- drivers/block/sunvdc.c | 4 +- drivers/bluetooth/btusb.c | 2 + drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_watchdog.c | 59 ++++++++---- drivers/char/misc.c | 4 +- drivers/clk/qcom/gcc-ipq5018.c | 2 +- drivers/clk/qcom/gcc-ipq8074.c | 6 +- drivers/clk/renesas/rzg2l-cpg.c | 8 +- drivers/clk/samsung/clk-exynos850.c | 2 +- drivers/clk/samsung/clk-gs101.c | 4 +- drivers/clk/tegra/clk-periph.c | 4 +- drivers/clk/thead/clk-th1520-ap.c | 5 +- drivers/comedi/comedi_fops.c | 33 +++++-- drivers/comedi/comedi_internal.h | 1 + drivers/comedi/drivers.c | 13 ++- drivers/cpufreq/cppc_cpufreq.c | 2 +- drivers/cpufreq/cpufreq.c | 8 +- drivers/cpufreq/intel_pstate.c | 2 + drivers/cpuidle/governors/menu.c | 21 +++- drivers/crypto/ccp/sp-pci.c | 1 + drivers/crypto/hisilicon/hpre/hpre_crypto.c | 8 +- .../crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 16 ++- drivers/devfreq/governor_userspace.c | 6 +- drivers/dma/stm32/stm32-dma.c | 2 +- drivers/edac/synopsys_edac.c | 93 +++++++++--------- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/arm_scmi/scmi_power_control.c | 22 ++++- drivers/firmware/qcom/qcom_scm.c | 53 +++++----- drivers/firmware/tegra/Kconfig | 5 +- drivers/gpio/gpio-mlxbf2.c | 2 +- drivers/gpio/gpio-mlxbf3.c | 52 ++++------ drivers/gpio/gpio-tps65912.c | 7 +- drivers/gpio/gpio-virtio.c | 9 +- drivers/gpio/gpio-wcd934x.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +- .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 11 +-- drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 +- .../gpu/drm/amd/display/dc/mpc/dcn401/dcn401_mpc.c | 2 +- .../display/dc/resource/dcn314/dcn314_resource.c | 1 + drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c | 16 +-- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 + drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 37 +++---- drivers/gpu/drm/imagination/pvr_power.c | 59 +++++++++++- drivers/gpu/drm/msm/msm_drv.c | 9 +- drivers/gpu/drm/msm/msm_gem.c | 3 +- drivers/gpu/drm/msm/msm_gem.h | 6 ++ drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 3 + drivers/gpu/drm/ttm/ttm_pool.c | 8 +- drivers/gpu/drm/ttm/ttm_resource.c | 3 + drivers/gpu/drm/xe/xe_guc_exec_queue_types.h | 2 + drivers/gpu/drm/xe/xe_guc_submit.c | 7 +- drivers/gpu/drm/xe/xe_hw_fence.c | 3 + drivers/gpu/drm/xe/xe_query.c | 27 +++--- drivers/hid/hid-apple.c | 17 ++-- drivers/hid/hid-magicmouse.c | 56 +++++++---- drivers/hwmon/emc2305.c | 10 +- drivers/i2c/i2c-core-acpi.c | 1 + drivers/i3c/internals.h | 1 + drivers/i3c/master.c | 4 +- drivers/idle/intel_idle.c | 2 +- drivers/iio/adc/ad7768-1.c | 23 ++++- drivers/iio/adc/ad_sigma_delta.c | 2 +- drivers/infiniband/core/nldev.c | 22 +++-- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/infiniband/hw/hfi1/affinity.c | 44 +++++---- drivers/infiniband/sw/siw/siw_qp_tx.c | 5 +- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 + drivers/iommu/intel/iommu.c | 19 +++- drivers/iommu/intel/iommu.h | 3 + drivers/iommu/iommufd/io_pagetable.c | 48 +++++---- drivers/leds/flash/leds-qcom-flash.c | 15 ++- drivers/leds/leds-lp50xx.c | 11 ++- drivers/leds/trigger/ledtrig-netdev.c | 16 +-- drivers/md/dm-ps-historical-service-time.c | 4 +- drivers/md/dm-ps-queue-length.c | 4 +- drivers/md/dm-ps-round-robin.c | 4 +- drivers/md/dm-ps-service-time.c | 4 +- drivers/md/dm-stripe.c | 1 + drivers/md/dm-table.c | 10 +- drivers/md/dm-zoned-target.c | 2 +- drivers/md/dm.c | 37 ++++--- drivers/md/md.c | 51 ++++++---- drivers/md/md.h | 26 ++++- drivers/md/raid10.c | 1 + drivers/media/dvb-frontends/dib7000p.c | 8 ++ drivers/media/i2c/hi556.c | 7 +- drivers/media/i2c/tc358743.c | 86 ++++++++++------- drivers/media/pci/intel/ipu-bridge.c | 2 + drivers/media/platform/qcom/venus/hfi_msgs.c | 83 +++++++++++----- drivers/media/usb/hdpvr/hdpvr-i2c.c | 6 ++ drivers/media/usb/uvc/uvc_driver.c | 12 +++ drivers/media/usb/uvc/uvc_video.c | 21 ++-- drivers/media/v4l2-core/v4l2-common.c | 14 ++- drivers/mfd/axp20x.c | 3 +- drivers/mfd/cros_ec_dev.c | 10 +- drivers/mfd/tps6594-core.c | 88 +++++++++++++++-- drivers/mfd/tps6594-i2c.c | 10 +- drivers/mfd/tps6594-spi.c | 10 +- drivers/misc/cardreader/rtsx_usb.c | 16 +-- drivers/misc/mei/bus.c | 6 ++ drivers/mmc/host/rtsx_usb_sdmmc.c | 4 +- drivers/mmc/host/sdhci-msm.c | 14 +++ drivers/net/can/ti_hecc.c | 2 +- drivers/net/dsa/b53/b53_common.c | 76 ++++++++++++--- drivers/net/dsa/b53/b53_regs.h | 7 +- drivers/net/ethernet/agere/et131x.c | 36 +++++++ drivers/net/ethernet/aquantia/atlantic/aq_hw.h | 2 + .../aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c | 39 ++++++++ drivers/net/ethernet/atheros/ag71xx.c | 9 ++ drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 8 +- drivers/net/ethernet/faraday/ftgmac100.c | 7 +- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 - drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 4 +- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 14 ++- drivers/net/ethernet/freescale/fec_main.c | 34 +++---- drivers/net/ethernet/freescale/gianfar_ethtool.c | 4 +- drivers/net/ethernet/google/gve/gve_adminq.c | 1 + drivers/net/ethernet/intel/idpf/idpf.h | 19 ++++ drivers/net/ethernet/intel/idpf/idpf_ethtool.c | 36 +++++-- drivers/net/ethernet/intel/idpf/idpf_lib.c | 18 +++- drivers/net/ethernet/intel/idpf/idpf_main.c | 1 + drivers/net/ethernet/intel/idpf/idpf_txrx.c | 13 ++- drivers/net/ethernet/mediatek/mtk_wed.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 2 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 7 +- drivers/net/ethernet/ti/icssg/icss_iep.c | 26 +++-- drivers/net/ethernet/ti/icssg/icssg_prueth.c | 6 ++ drivers/net/hyperv/hyperv_net.h | 3 + drivers/net/hyperv/netvsc_drv.c | 29 +++++- drivers/net/pcs/pcs-xpcs-plat.c | 4 +- drivers/net/phy/broadcom.c | 25 ++++- drivers/net/phy/micrel.c | 12 ++- drivers/net/phy/smsc.c | 1 + drivers/net/thunderbolt/main.c | 21 ++-- drivers/net/usb/asix_devices.c | 1 + drivers/net/usb/cdc_ncm.c | 20 +++- drivers/net/wireless/ath/ath10k/core.c | 48 ++++++++- drivers/net/wireless/ath/ath10k/core.h | 11 ++- drivers/net/wireless/ath/ath10k/mac.c | 7 +- drivers/net/wireless/ath/ath10k/wmi.c | 6 ++ drivers/net/wireless/ath/ath12k/dp.c | 3 +- drivers/net/wireless/ath/ath12k/hw.c | 2 +- drivers/net/wireless/ath/ath12k/mac.c | 1 + drivers/net/wireless/ath/ath12k/wmi.c | 5 + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 5 +- drivers/net/wireless/intel/iwlwifi/dvm/rs.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 7 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 5 + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 25 +++-- drivers/net/wireless/realtek/rtlwifi/pci.c | 23 +++-- drivers/net/wireless/realtek/rtw89/chan.c | 6 ++ drivers/net/wireless/realtek/rtw89/fw.c | 9 +- drivers/net/wireless/realtek/rtw89/fw.h | 2 + drivers/net/wireless/realtek/rtw89/mac.c | 19 ++++ drivers/net/wireless/realtek/rtw89/reg.h | 1 + drivers/net/wireless/realtek/rtw89/wow.c | 5 +- drivers/net/xen-netfront.c | 5 - drivers/nvme/host/pci.c | 24 ++++- drivers/nvme/host/tcp.c | 11 ++- drivers/pci/pci-acpi.c | 4 +- drivers/pci/pci.c | 94 ++++++++++++------ drivers/pci/pci.h | 1 + drivers/pci/probe.c | 5 +- drivers/perf/arm-cmn.c | 1 + drivers/perf/arm-ni.c | 1 + drivers/perf/cxl_pmu.c | 2 +- drivers/phy/rockchip/phy-rockchip-pcie.c | 3 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + drivers/platform/chrome/cros_ec_sensorhub.c | 23 ++++- drivers/platform/chrome/cros_ec_typec.c | 4 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 ++ drivers/platform/x86/thinkpad_acpi.c | 4 +- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 10 ++ drivers/pmdomain/ti/Kconfig | 2 +- drivers/power/supply/qcom_battmgr.c | 2 + drivers/pps/clients/pps-gpio.c | 5 +- drivers/ptp/ptp_clock.c | 2 +- drivers/ptp/ptp_private.h | 5 + drivers/ptp/ptp_vclock.c | 7 ++ drivers/remoteproc/imx_rproc.c | 4 +- drivers/reset/Kconfig | 10 +- drivers/rtc/rtc-ds1307.c | 15 ++- drivers/scsi/aacraid/comminit.c | 3 +- drivers/scsi/bfa/bfad_im.c | 1 + drivers/scsi/libiscsi.c | 3 +- drivers/scsi/lpfc/lpfc_debugfs.c | 1 - drivers/scsi/lpfc/lpfc_hbadisc.c | 3 +- drivers/scsi/lpfc/lpfc_scsi.c | 4 + drivers/scsi/mpi3mr/mpi3mr_os.c | 20 +++- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 19 ++++ drivers/scsi/scsi_scan.c | 2 +- drivers/scsi/scsi_transport_sas.c | 62 +++++++++--- drivers/soc/qcom/mdt_loader.c | 10 +- drivers/soc/qcom/rpmh-rsc.c | 2 +- drivers/soundwire/amd_manager.c | 7 +- drivers/soundwire/bus.c | 6 +- drivers/target/target_core_fabric_lib.c | 65 ++++++++++--- drivers/target/target_core_internal.h | 4 +- drivers/target/target_core_pr.c | 18 ++-- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 43 +++++++-- drivers/thermal/thermal_sysfs.c | 9 +- drivers/thunderbolt/domain.c | 2 +- drivers/tty/serial/serial_core.c | 44 ++++----- drivers/usb/class/cdc-acm.c | 11 ++- drivers/usb/core/config.c | 10 +- drivers/usb/core/urb.c | 2 +- drivers/usb/host/xhci-mem.c | 2 + drivers/usb/host/xhci-ring.c | 10 +- drivers/usb/host/xhci.c | 6 +- drivers/usb/typec/mux/intel_pmc_mux.c | 2 +- drivers/usb/typec/tcpm/tcpci_maxim_core.c | 46 ++++++--- drivers/usb/typec/ucsi/psy.c | 2 +- drivers/usb/typec/ucsi/ucsi.c | 1 + drivers/usb/typec/ucsi/ucsi.h | 7 +- drivers/vfio/pci/mlx5/cmd.c | 4 +- drivers/vfio/vfio_iommu_type1.c | 7 ++ drivers/vhost/vhost.c | 3 + drivers/video/fbdev/core/fbcon.c | 9 +- drivers/video/fbdev/core/fbmem.c | 3 + drivers/virt/coco/efi_secret/efi_secret.c | 10 +- drivers/watchdog/dw_wdt.c | 2 + drivers/watchdog/iTCO_wdt.c | 6 +- drivers/watchdog/sbsa_gwdt.c | 50 +++++++++- fs/btrfs/block-group.c | 27 +++++- fs/btrfs/ctree.c | 1 + fs/btrfs/extent-tree.c | 33 ++++--- fs/btrfs/qgroup.c | 13 ++- fs/btrfs/relocation.c | 19 ++++ fs/btrfs/transaction.c | 6 +- fs/btrfs/tree-log.c | 107 ++++++++++++++------- fs/btrfs/zoned.c | 5 +- fs/crypto/fscrypt_private.h | 17 ++++ fs/crypto/hkdf.c | 2 +- fs/crypto/keysetup.c | 3 +- fs/crypto/keysetup_v1.c | 3 +- fs/eventpoll.c | 60 +++++++++--- fs/exfat/dir.c | 12 +++ fs/exfat/fatent.c | 10 ++ fs/exfat/namei.c | 5 + fs/exfat/super.c | 32 +++--- fs/ext2/inode.c | 12 ++- fs/ext4/inline.c | 19 +++- fs/ext4/mballoc-test.c | 9 ++ fs/ext4/mballoc.c | 69 ++++++------- fs/f2fs/file.c | 24 ++--- fs/file.c | 15 +++ fs/gfs2/dir.c | 6 +- fs/gfs2/glops.c | 6 ++ fs/gfs2/meta_io.c | 2 + fs/hfs/bfind.c | 3 + fs/hfs/bnode.c | 93 ++++++++++++++++++ fs/hfs/btree.c | 57 ++++++++--- fs/hfs/extent.c | 2 +- fs/hfs/hfs_fs.h | 1 + fs/hfsplus/bnode.c | 92 ++++++++++++++++++ fs/hfsplus/unicode.c | 7 ++ fs/hfsplus/xattr.c | 6 +- fs/jfs/file.c | 3 + fs/jfs/inode.c | 2 +- fs/jfs/jfs_dmap.c | 6 ++ fs/libfs.c | 4 +- fs/nfs/blocklayout/blocklayout.c | 4 +- fs/nfs/blocklayout/dev.c | 5 +- fs/nfs/blocklayout/extent_tree.c | 20 +++- fs/nfs/client.c | 44 ++++++++- fs/nfs/internal.h | 2 +- fs/nfs/nfs4client.c | 20 +--- fs/nfs/nfs4proc.c | 2 +- fs/nfs/pnfs.c | 11 ++- fs/nfsd/nfs4state.c | 34 ++++++- fs/ntfs3/dir.c | 3 + fs/ntfs3/inode.c | 31 +++--- fs/orangefs/orangefs-debugfs.c | 2 +- fs/pidfs.c | 2 + fs/proc/task_mmu.c | 6 +- fs/smb/client/cifssmb.c | 10 ++ fs/smb/client/compress.c | 61 +++--------- fs/smb/client/connect.c | 10 +- fs/smb/client/sess.c | 9 ++ fs/smb/client/smb2ops.c | 11 ++- fs/smb/client/smbdirect.c | 25 ++--- fs/smb/server/smb2pdu.c | 16 +-- fs/tracefs/inode.c | 11 +++ fs/udf/super.c | 13 ++- fs/xfs/scrub/trace.h | 2 +- include/linux/blk_types.h | 6 +- include/linux/blkdev.h | 55 +++++++++++ include/linux/hypervisor.h | 3 + include/linux/if_vlan.h | 21 ++-- include/linux/libata.h | 1 + include/linux/memory-tiers.h | 2 +- include/linux/mfd/tps6594.h | 1 + include/linux/packing.h | 6 +- include/linux/pci.h | 16 ++- include/linux/sbitmap.h | 6 +- include/linux/skbuff.h | 8 +- include/linux/usb/cdc_ncm.h | 1 + include/linux/virtio_vsock.h | 7 +- include/net/cfg80211.h | 2 +- include/net/kcm.h | 1 - include/net/mac80211.h | 4 + include/net/neighbour.h | 1 + include/net/net_namespace.h | 16 +++ include/net/sock.h | 1 + include/trace/events/thp.h | 2 + include/uapi/linux/in6.h | 4 +- include/uapi/linux/io_uring.h | 2 +- include/uapi/linux/pci_regs.h | 1 + io_uring/rw.c | 2 +- kernel/bpf/verifier.c | 7 +- kernel/module/main.c | 10 +- kernel/power/console.c | 7 +- kernel/printk/nbcon.c | 63 +++++++----- kernel/rcu/tree.c | 2 + kernel/rcu/tree.h | 14 ++- kernel/rcu/tree_nocb.h | 5 +- kernel/rcu/tree_plugin.h | 44 ++++++--- kernel/sched/deadline.c | 4 +- kernel/sched/fair.c | 19 +++- kernel/sched/rt.c | 6 ++ lib/sbitmap.c | 56 +++++------ mm/damon/core.c | 1 + mm/kmemleak.c | 10 +- mm/ptdump.c | 2 + mm/slub.c | 7 +- mm/userfaultfd.c | 15 +-- net/bluetooth/hci_sock.c | 2 +- net/core/ieee8021q_helpers.c | 44 +++------ net/core/neighbour.c | 12 ++- net/core/net_namespace.c | 8 +- net/core/sock.c | 27 +++++- net/ipv4/route.c | 1 - net/ipv4/udp_offload.c | 2 +- net/ipv6/addrconf.c | 7 +- net/ipv6/mcast.c | 11 +-- net/kcm/kcmsock.c | 10 +- net/mac80211/cfg.c | 12 +-- net/mac80211/chan.c | 1 + net/mac80211/link.c | 9 +- net/mac80211/mlme.c | 12 ++- net/mac80211/rx.c | 12 ++- net/mctp/af_mctp.c | 28 +++++- net/mptcp/subflow.c | 5 +- net/ncsi/internal.h | 2 +- net/ncsi/ncsi-rsp.c | 1 + net/netfilter/nf_conntrack_netlink.c | 24 ++--- net/netfilter/nft_set_pipapo.c | 9 +- net/netlink/af_netlink.c | 12 +-- net/rds/tcp.c | 8 +- net/sched/sch_ets.c | 11 ++- net/sctp/input.c | 2 +- net/smc/af_smc.c | 5 +- net/sunrpc/svcsock.c | 5 +- net/sunrpc/xprtsock.c | 8 +- net/tls/tls.h | 2 +- net/tls/tls_strp.c | 11 ++- net/tls/tls_sw.c | 3 +- net/vmw_vsock/virtio_transport.c | 2 +- net/wireless/mlme.c | 3 +- net/xfrm/xfrm_state.c | 74 ++++++++------ rust/Makefile | 13 ++- scripts/kconfig/gconf.c | 8 +- scripts/kconfig/lxdialog/inputbox.c | 6 +- scripts/kconfig/lxdialog/menubox.c | 2 +- scripts/kconfig/nconf.c | 2 + scripts/kconfig/nconf.gui.c | 1 + security/apparmor/domain.c | 52 +++++----- security/apparmor/file.c | 6 +- security/apparmor/include/lib.h | 6 +- security/inode.c | 2 - sound/core/pcm_native.c | 19 +++- sound/pci/hda/hda_codec.c | 44 +++------ sound/pci/hda/patch_ca0132.c | 2 +- sound/pci/hda/patch_realtek.c | 3 + sound/pci/intel8x0.c | 2 +- sound/soc/codecs/hdac_hdmi.c | 10 +- sound/soc/codecs/rt5640.c | 5 + sound/soc/fsl/fsl_sai.c | 20 ++-- sound/soc/intel/avs/core.c | 3 +- sound/soc/qcom/lpass-platform.c | 27 ++++-- sound/soc/soc-core.c | 3 + sound/soc/soc-dapm.c | 4 + sound/soc/sof/topology.c | 15 ++- sound/usb/mixer_quirks.c | 14 +-- sound/usb/stream.c | 25 ++++- sound/usb/validate.c | 12 +++ tools/bootconfig/main.c | 24 ++--- tools/bpf/bpftool/main.c | 6 +- tools/hv/hv_fcopy_uio_daemon.c | 91 ++++++++++++++++-- tools/include/nolibc/std.h | 4 +- tools/include/nolibc/types.h | 4 +- tools/lib/bpf/libbpf.c | 5 + .../cpupower/utils/idle_monitor/mperf_monitor.c | 4 +- tools/power/x86/turbostat/turbostat.c | 14 ++- tools/scripts/Makefile.include | 4 +- tools/testing/ktest/ktest.pl | 5 +- tools/testing/selftests/arm64/fp/sve-ptrace.c | 3 +- tools/testing/selftests/bpf/prog_tests/ringbuf.c | 4 +- .../selftests/bpf/prog_tests/user_ringbuf.c | 10 +- .../selftests/bpf/progs/test_ringbuf_write.c | 4 +- .../testing/selftests/bpf/progs/verifier_unpriv.c | 2 +- .../ftrace/test.d/ftrace/func-filter-glob.tc | 2 +- tools/testing/selftests/futex/include/futextest.h | 11 +++ tools/testing/selftests/net/netfilter/config | 2 +- tools/testing/selftests/vDSO/vdso_test_getrandom.c | 6 +- 473 files changed, 4331 insertions(+), 1862 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/444 io_uring: dont use int for ABI
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit cf73d9970ea4f8cace5d8f02d2565a2723003112 upstream.
__kernel_rwf_t is defined as int, the actual size of which is implementation defined. It won't go well if some compiler / archs ever defines it as i64, so replace it with __u32, hoping that there is no one using i16 for it.
--- include/uapi/linux/io_uring.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/io_uring.h +1 -1
@@ -50,7 +50,7 @@ struct io_uring_sqe { };__u32 len;/* buffer size or number of iovecs */ union { -__kernel_rwf_t rw_flags; +__u32 rw_flags;__u32 fsync_flags;__u16 poll_events;/* compatibility */ __u32 poll32_events;/* word-reversed for BE */
Greg Kroah-Hartman
maintainerPATCH 2/444 ALSA: usb-audio: Validate UAC3 power domain descriptors, too
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit d832ccbc301fbd9e5a1d691bdcf461cdb514595f upstream.
UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.
--- sound/usb/validate.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/usb/validate.c +12 -0
@@ -221,6 +221,17 @@ static bool validate_uac3_feature_unit(creturn d->bLength >=sizeof (*d) +4 +2 ; } +static bool validate_uac3_power_domain_unit (const void *p, +const struct usb_desc_validator *v) +{ +const struct uac3_power_domain_descriptor *d = p; + +if (d->bLength <sizeof (*d)) +return false; +/* baEntities[] + wPDomainDescrStr */ +return d->bLength >=sizeof (*d) + d->bNrEntities +2 ; +} +static bool validate_midi_out_jack (const void *p,const struct usb_desc_validator *v) {
@@ -285,6 +296,7 @@ static const struct usb_desc_validator a struct uac3_clock_multiplier_descriptor), /* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */ /* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */ + FUNC(UAC_VERSION_3, UAC3_POWER_DOMAIN, validate_uac3_power_domain_unit), { }/* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 3/444 ALSA: usb-audio: Validate UAC3 cluster segment descriptors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ecfd41166b72b67d3bdeb88d224ff445f6163869 upstream.
UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.
--- sound/usb/stream.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-)
sound/usb/stream.c +22 -3
@@ -341,20 +341,28 @@ snd_pcm_chmap_elem *convert_chmap_v3(str len =le16_to_cpu (cluster->wLength); c =0 ; - p +=sizeof (struct uac3_cluster_header_descriptor ); + p +=sizeof (*cluster); + len -=sizeof (*cluster); -while (((p - (void *)cluster) < len) && (c < channels)) { +while (len >0 && (c < channels)) {struct uac3_cluster_segment_descriptor *cs_desc = p;u16 cs_len;u8 cs_type; +if (len <sizeof (*p)) +break ; cs_len =le16_to_cpu (cs_desc->wLength); +if (len < cs_len) +break ; cs_type = cs_desc->bSegmentType;if (cs_type ==UAC3_CHANNEL_INFORMATION ) {struct uac3_cluster_information_segment_descriptor *is = p;unsigned char map; +if (cs_len <sizeof (*is)) +break ; +/* * TODO: this conversion is not complete, update it * after adding UAC3 values to asound.h
@@ -456,6 +464,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(str chmap->map[c++] = map; } p += cs_len; + len -= cs_len; }if (channels < c)
@@ -880,7 +889,7 @@ snd_usb_get_audioformat_uac3(struct snd_u64 badd_formats =0 ;unsigned int num_channels;struct audioformat *fp; -u16 cluster_id, wLength; +u16 cluster_id, wLength, cluster_wLength;int clock =0 ;int err;
@@ -1008,6 +1017,16 @@ snd_usb_get_audioformat_uac3(struct snd_ iface_no, altno);kfree (cluster);return ERR_PTR (-EIO ); + } + + cluster_wLength =le16_to_cpu (cluster->wLength); +if (cluster_wLength <sizeof (*cluster) || + cluster_wLength > wLength) { +dev_err (&dev->dev, +"%u:%d : invalid Cluster Descriptor size\n" , + iface_no, altno); +kfree (cluster); +return ERR_PTR (-EIO ); } num_channels = cluster->bNrChannels;
Greg Kroah-Hartman
maintainerPATCH 4/444 ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit b26e2afb3834d4a61ce54c8484ff6014bef0b4b7 upstream.
Add a PCI quirk to enable microphone input on the headphone jack on the HONOR BRB-X M1010 laptop.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -11331,6 +11331,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x1d72 ,0x1901 ,"RedmiBook 14" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ), +SND_PCI_QUIRK (0x1ee7 ,0x2078 ,"HONOR BRB-X M1010" ,ALC2XX_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1f66 ,0x0105 ,"Ayaneo Portable Game Player" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x2014 ,0x800a ,"Positivo ARN50" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
Greg Kroah-Hartman
maintainerPATCH 5/444 ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Eby <[email protected]>
commit 0db77eccd964b11ab2b757031d1354fcc5a025ea upstream.
Framework Laptop 13 (AMD Ryzen AI 300) requires the same quirk for headset detection as other Framework 13 models.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -11348,6 +11348,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0009 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0xf111 ,0x000b ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x000c ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0
Greg Kroah-Hartman
maintainerPATCH 6/444 smb3: fix for slab out of bounds on mount to ksmbd
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 7d34ec36abb84fdfb6632a0f2cbda90379ae21fc upstream.
With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below):
BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]
--- fs/smb/client/smb2ops.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/smb/client/smb2ops.c +10 -1
@@ -772,6 +772,13 @@ next_iface: bytes_left -=sizeof (*p);break ; } +/* Validate that Next doesn't point beyond the buffer */ +if (next > bytes_left) { +cifs_dbg (VFS ,"%s: invalid Next pointer %zu > %zd\n" , + __func__, next, bytes_left); + rc = -EINVAL ; + goto out; + } p = (struct network_interface_info_ioctl_rsp *)((u8 *)p+next); bytes_left -= next; }
@@ -783,7 +790,9 @@ next_iface: }/* Azure rounds the buffer size up 8, to a 16 byte boundary */ -if ((bytes_left >8 ) || p->Next) +if ((bytes_left >8 ) || + (bytes_left >= offsetof(struct network_interface_info_ioctl_rsp , Next) + +sizeof (p->Next) && p->Next))cifs_dbg (VFS ,"%s: incomplete interface info\n" , __func__); ses->iface_last_update = jiffies;
Greg Kroah-Hartman
maintainerPATCH 7/444 smb: client: remove redundant lstrp update in negotiate protocol
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Zhaolong <[email protected]>
commit e19d8dd694d261ac26adb2a26121a37c107c81ad upstream.
Commit 34331d7beed7 ("smb: client: fix first command failure during re-negotiation") addressed a race condition by updating lstrp before entering negotiate state. However, this approach may have some unintended side effects.
The lstrp field is documented as "when we got last response from this server", and updating it before actually receiving a server response could potentially affect other mechanisms that rely on this timestamp. For example, the SMB echo detection logic also uses lstrp as a reference point. In scenarios with frequent user operations during reconnect states, the repeated calls to cifs_negotiate_protocol() might continuously update lstrp, which could interfere with the echo detection timing.
Additionally, commit 266b5d02e14f ("smb: client: fix race condition in negotiate timeout by using more precise timing") introduced a dedicated neg_start field specifically for tracking negotiate start time. This provides a more precise solution for the original race condition while preserving the intended semantics of lstrp.
Since the race condition is now properly handled by the neg_start mechanism, the lstrp update in cifs_negotiate_protocol() is no longer necessary and can be safely removed.
--- fs/smb/client/connect.c | 1 - 1 file changed, 1 deletion(-)
fs/smb/client/connect.c +0 -1
@@ -4001,7 +4001,6 @@ retry:return 0 ; } - server->lstrp = jiffies; server->tcpStatus = CifsInNegotiate; server->neg_start = jiffies;spin_unlock (&server->srv_lock);
Greg Kroah-Hartman
maintainerPATCH 8/444 gpio: virtio: Fix config space reading.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Mommer <[email protected]>
commit 4740e1e2f320061c2f0dbadc0dd3dfb58df986d5 upstream.
Quote from the virtio specification chapter 4.2.2.2:
"For the device-specific configuration space, the driver MUST use 8 bit wide accesses for 8 bit wide fields, 16 bit wide and aligned accesses for 16 bit wide fields and 32 bit wide and aligned accesses for 32 and 64 bit wide fields."
--- drivers/gpio/gpio-virtio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpio/gpio-virtio.c +5 -4
@@ -539,7 +539,6 @@ static const char **virtio_gpio_get_namestatic int virtio_gpio_probe (struct virtio_device *vdev) { -struct virtio_gpio_config config;struct device *dev = &vdev->dev;struct virtio_gpio *vgpio;u32 gpio_names_size;
@@ -551,9 +550,11 @@ static int virtio_gpio_probe(struct virtreturn -ENOMEM ;/* Read configuration */ -virtio_cread_bytes (vdev,0 , &config,sizeof (config)); - gpio_names_size =le32_to_cpu (config.gpio_names_size); - ngpio =le16_to_cpu (config.ngpio); + gpio_names_size = +virtio_cread32 (vdev, offsetof(struct virtio_gpio_config , + gpio_names_size)); + ngpio =virtio_cread16 (vdev, offsetof(struct virtio_gpio_config , + ngpio));if (!ngpio) {dev_err (dev,"Number of GPIOs can't be zero\n" );return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 9/444 gpio: mlxbf2: use platform_get_irq_optional()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
commit 63c7bc53a35e785accdc2ceab8f72d94501931ab upstream.
The gpio-mlxbf2 driver interfaces with four GPIO controllers, device instances 0-3. There are two IRQ resources shared between the four controllers, and they are found in the ACPI table for instances 0 and 3. The driver should not use platform_get_irq(), otherwise this error is logged when probing instances 1 and 2:
mlxbf2_gpio MLNXBF22:01: error -ENXIO: IRQ index 0 not found
--- drivers/gpio/gpio-mlxbf2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-mlxbf2.c +1 -1
@@ -397,7 +397,7 @@ mlxbf2_gpio_probe(struct platform_device gc->ngpio = npins; gc->owner =THIS_MODULE ; - irq =platform_get_irq (pdev,0 ); + irq =platform_get_irq_optional (pdev,0 );if (irq >=0 ) { girq = &gs->gc.irq;gpio_irq_chip_set_chip (girq, &mlxbf2_gpio_irq_chip);
Greg Kroah-Hartman
maintainerPATCH 10/444 Revert "gpio: mlxbf3: only get IRQ for device instance 0"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
commit 56bdf7270ff4f870e2d4bfacdc00161e766dba2d upstream.
This reverts commit 10af0273a35ab4513ca1546644b8c853044da134.
While this change was merged, it is not the preferred solution. During review of a similar change to the gpio-mlxbf2 driver, the use of "platform_get_irq_optional" was identified as the preferred solution, so let's use it for gpio-mlxbf3 driver as well.
--- drivers/gpio/gpio-mlxbf3.c | 54 +++++++++++++++------------------------------ 1 file changed, 19 insertions(+), 35 deletions(-)
drivers/gpio/gpio-mlxbf3.c +19 -35
@@ -190,9 +190,7 @@ static int mlxbf3_gpio_probe(struct platstruct mlxbf3_gpio_context *gs;struct gpio_irq_chip *girq;struct gpio_chip *gc; -char *colon_ptr;int ret, irq; -long num; gs =devm_kzalloc (dev,sizeof (*gs),GFP_KERNEL );if (!gs)
@@ -229,39 +227,25 @@ static int mlxbf3_gpio_probe(struct plat gc->owner =THIS_MODULE ; gc->add_pin_ranges = mlxbf3_gpio_add_pin_ranges; - colon_ptr =strchr (dev_name (dev),':' ); -if (!colon_ptr) { -dev_err (dev,"invalid device name format\n" ); -return -EINVAL ; - } - - ret =kstrtol (++colon_ptr,16 , &num); -if (ret) { -dev_err (dev,"invalid device instance\n" ); -return ret; - } - -if (!num) { - irq =platform_get_irq (pdev,0 ); -if (irq >=0 ) { - girq = &gs->gc.irq; -gpio_irq_chip_set_chip (girq, &gpio_mlxbf3_irqchip); - girq->default_type =IRQ_TYPE_NONE ; -/* This will let us handle the parent IRQ in the driver */ - girq->num_parents =0 ; - girq->parents =NULL ; - girq->parent_handler =NULL ; - girq->handler = handle_bad_irq; - -/* -* Directly request the irq here instead of passing -* a flow-handler because the irq is shared. -*/ - ret =devm_request_irq (dev, irq, mlxbf3_gpio_irq_handler, -IRQF_SHARED ,dev_name (dev), gs); -if (ret) -return dev_err_probe (dev, ret,"failed to request IRQ" ); - } + irq =platform_get_irq (pdev,0 ); +if (irq >=0 ) { + girq = &gs->gc.irq; +gpio_irq_chip_set_chip (girq, &gpio_mlxbf3_irqchip); + girq->default_type =IRQ_TYPE_NONE ; +/* This will let us handle the parent IRQ in the driver */ + girq->num_parents =0 ; + girq->parents =NULL ; + girq->parent_handler =NULL ; + girq->handler = handle_bad_irq; + +/* +* Directly request the irq here instead of passing +* a flow-handler because the irq is shared. +*/ + ret =devm_request_irq (dev, irq, mlxbf3_gpio_irq_handler, +IRQF_SHARED ,dev_name (dev), gs); +if (ret) +return dev_err_probe (dev, ret,"failed to request IRQ" ); }platform_set_drvdata (pdev, gs);
Greg Kroah-Hartman
maintainerPATCH 11/444 gpio: mlxbf3: use platform_get_irq_optional()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
commit 810bd9066fb1871b8a9528f31f2fdbf2a8b73bf2 upstream.
The gpio-mlxbf3 driver interfaces with two GPIO controllers, device instance 0 and 1. There is a single IRQ resource shared between the two controllers, and it is found in the ACPI table for device instance 0. The driver should not use platform_get_irq(), otherwise this error is logged when probing instance 1:
mlxbf3_gpio MLNXBF33:01: error -ENXIO: IRQ index 0 not found
--- drivers/gpio/gpio-mlxbf3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-mlxbf3.c +1 -1
@@ -227,7 +227,7 @@ static int mlxbf3_gpio_probe(struct plat gc->owner =THIS_MODULE ; gc->add_pin_ranges = mlxbf3_gpio_add_pin_ranges; - irq =platform_get_irq (pdev,0 ); + irq =platform_get_irq_optional (pdev,0 );if (irq >=0 ) { girq = &gs->gc.irq;gpio_irq_chip_set_chip (girq, &gpio_mlxbf3_irqchip);
Greg Kroah-Hartman
maintainerPATCH 12/444 leds: flash: leds-qcom-flash: Fix registry access after re-bind
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit fab15f57360b1e6620a1d0d6b0fbee896e6c1f07 upstream.
Driver in probe() updates each of 'reg_field' with 'reg_base':
for (i = 0; i < REG_MAX_COUNT; i++) regs[i].reg += reg_base;
'reg_field' array (under variable 'regs' above) is statically allocated, thus each re-bind would add another 'reg_base' leading to bogus register addresses. Constify the local 'reg_field' array and duplicate it in probe to solve this.
--- drivers/leds/flash/leds-qcom-flash.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/leds/flash/leds-qcom-flash.c +11 -4
@@ -117,7 +117,7 @@ enum { REG_MAX_COUNT, }; -static struct reg_field mvflash_3ch_regs[REG_MAX_COUNT ] = { +static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT ] = {REG_FIELD (0x08 ,0 ,7 ),/* status1 */ REG_FIELD (0x09 ,0 ,7 ),/* status2 */ REG_FIELD (0x0a ,0 ,7 ),/* status3 */
@@ -132,7 +132,7 @@ static struct reg_field mvflash_3ch_regs REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */ }; -static struct reg_field mvflash_4ch_regs[REG_MAX_COUNT ] = { +static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT ] = {REG_FIELD (0x06 ,0 ,7 ),/* status1 */ REG_FIELD (0x07 ,0 ,6 ),/* status2 */ REG_FIELD (0x09 ,0 ,7 ),/* status3 */
@@ -855,11 +855,17 @@ static int qcom_flash_led_probe(struct pif (val ==FLASH_SUBTYPE_3CH_PM8150_VAL || val ==FLASH_SUBTYPE_3CH_PMI8998_VAL ) { flash_data->hw_type =QCOM_MVFLASH_3CH ; flash_data->max_channels =3 ; - regs = mvflash_3ch_regs; + regs =devm_kmemdup (dev, mvflash_3ch_regs,sizeof (mvflash_3ch_regs), +GFP_KERNEL ); +if (!regs) +return -ENOMEM ; }else if (val ==FLASH_SUBTYPE_4CH_VAL ) { flash_data->hw_type =QCOM_MVFLASH_4CH ; flash_data->max_channels =4 ; - regs = mvflash_4ch_regs; + regs =devm_kmemdup (dev, mvflash_4ch_regs,sizeof (mvflash_4ch_regs), +GFP_KERNEL ); +if (!regs) +return -ENOMEM ; rc =regmap_read (regmap, reg_base +FLASH_REVISION_REG , &val);if (rc <0 ) {
@@ -881,6 +887,7 @@ static int qcom_flash_led_probe(struct pdev_err (dev,"Failed to allocate regmap field, rc=%d\n" , rc);return rc; } +devm_kfree (dev, regs);/* devm_regmap_field_bulk_alloc() makes copies */ platform_set_drvdata (pdev, flash_data);mutex_init (&flash_data->lock);
Greg Kroah-Hartman
maintainerPATCH 13/444 Revert "leds: trigger: netdev: Configure LED blink interval for HW offload"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <[email protected]>
commit 26f732791f2bcab18f59c61915bbe35225f30136 upstream.
This reverts commit c629c972b310af41e9e072febb6dae9a299edde6.
While .led_blink_set() would previously put an LED into an unconditional permanently blinking state, the offending commit now uses same operation to (also?) set the blink timing of the netdev trigger when offloading.
This breaks many if not all of the existing PHY drivers which offer offloading LED operations, as those drivers would just put the LED into blinking state after .led_blink_set() has been called.
Unfortunately the change even made it into stable kernels for unknown reasons, so it should be reverted there as well.
--- drivers/leds/trigger/ledtrig-netdev.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
drivers/leds/trigger/ledtrig-netdev.c +3 -13
@@ -68,7 +68,6 @@ struct led_netdev_data {unsigned int last_activity;unsigned long mode; -unsigned long blink_delay;int link_speed;__ETHTOOL_DECLARE_LINK_MODE_MASK (supported_link_modes);u8 duplex;
@@ -87,10 +86,6 @@ static void set_baseline_state(struct le/* Already validated, hw control is possible with the requested mode */ if (trigger_data->hw_control) { led_cdev->hw_control_set (led_cdev, trigger_data->mode); -if (led_cdev->blink_set) { - led_cdev->blink_set (led_cdev, &trigger_data->blink_delay, - &trigger_data->blink_delay); - }return ; }
@@ -459,11 +454,10 @@ static ssize_t interval_store(struct dev size_t size) {struct led_netdev_data *trigger_data =led_trigger_get_drvdata (dev); -struct led_classdev *led_cdev = trigger_data->led_cdev;unsigned long value;int ret; -if (trigger_data->hw_control && !led_cdev->blink_set) +if (trigger_data->hw_control)return -EINVAL ; ret =kstrtoul (buf,0 , &value);
@@ -472,13 +466,9 @@ static ssize_t interval_store(struct dev/* impose some basic bounds on the timer interval */ if (value >=5 && value <=10000 ) { -if (trigger_data->hw_control) { - trigger_data->blink_delay = value; - }else { -cancel_delayed_work_sync (&trigger_data->work); +cancel_delayed_work_sync (&trigger_data->work); -atomic_set (&trigger_data->interval,msecs_to_jiffies (value)); - } +atomic_set (&trigger_data->interval,msecs_to_jiffies (value));set_baseline_state (trigger_data);/* resets timer */ }
Greg Kroah-Hartman
maintainerPATCH 14/444 netlink: avoid infinite retry looping in netlink_unicast()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
commit 759dfc7d04bab1b0b86113f1164dc1fec192b859 upstream.
netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has:
rmem < READ_ONCE(sk->sk_rcvbuf)
to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under:
rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)
The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as:
rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: <IRQ> dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 </IRQ> netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304
Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code.
Found by Linux Verification Center (linuxtesting.org).
--- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netlink/af_netlink.c +1 -1
@@ -1222,7 +1222,7 @@ int netlink_attachskb(struct sock *sk, s nlk =nlk_sk (sk); rmem =atomic_add_return (skb->truesize, &sk->sk_rmem_alloc); -if ((rmem == skb->truesize || rmem <READ_ONCE (sk->sk_rcvbuf)) && +if ((rmem == skb->truesize || rmem <=READ_ONCE (sk->sk_rcvbuf)) && !test_bit (NETLINK_S_CONGESTED , &nlk->state)) {netlink_skb_set_owner_r (skb, sk);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 15/444 net: phy: micrel: fix KSZ8081/KSZ8091 cable test
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Larysch <[email protected]>
commit 49db61c27c4bbd24364086dc0892bd3e14c1502e upstream.
Commit 21b688dabecb ("net: phy: micrel: Cable Diag feature for lan8814 phy") introduced cable_test support for the LAN8814 that reuses parts of the KSZ886x logic and introduced the cable_diag_reg and pair_mask parameters to account for differences between those chips.
However, it did not update the ksz8081_type struct, so those members are now 0, causing no pairs to be tested in ksz886x_cable_test_get_status and ksz886x_cable_test_wait_for_completion to poll the wrong register for the affected PHYs (Basic Control/Reset, which is 0 in normal operation) and exit immediately.
Fix this by setting both struct members accordingly.
--- drivers/net/phy/micrel.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/phy/micrel.c +2 -0
@@ -470,6 +470,8 @@ static const struct kszphy_type ksz8051_static const struct kszphy_type ksz8081_type = { .led_mode_reg =MII_KSZPHY_CTRL_2 , + .cable_diag_reg =KSZ8081_LMD , + .pair_mask =KSZPHY_WIRE_PAIR_MASK , .has_broadcast_disable = true, .has_nand_tree_disable = true, .has_rmii_ref_clk_sel = true,
Greg Kroah-Hartman
maintainerPATCH 16/444 net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
commit e88fbc30dda1cb7438515303704ceddb3ade4ecd upstream.
After the call to phy_disconnect() netdev->phydev is reset to NULL. So fixed_phy_unregister() would be called with a NULL pointer as argument. Therefore cache the phy_device before this call.
--- drivers/net/ethernet/faraday/ftgmac100.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/faraday/ftgmac100.c +4 -3
@@ -1730,16 +1730,17 @@ err_register_mdiobus:static void ftgmac100_phy_disconnect (struct net_device *netdev) {struct ftgmac100 *priv =netdev_priv (netdev); +struct phy_device *phydev = netdev->phydev; -if (!netdev->phydev) +if (!phydev)return ; -phy_disconnect (netdev->phydev); +phy_disconnect (phydev);if (of_phy_is_fixed_link (priv->dev->of_node))of_phy_deregister_fixed_link (priv->dev->of_node);if (priv->use_ncsi) -fixed_phy_unregister (netdev->phydev); +fixed_phy_unregister (phydev); }static void ftgmac100_destroy_mdio (struct net_device *netdev)
Greg Kroah-Hartman
maintainerPATCH 17/444 net: gianfar: fix device leak when querying time stamp info
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit da717540acd34e5056e3fa35791d50f6b3303f55 upstream.
Make sure to drop the reference to the ptp device taken by of_find_device_by_node() when querying the time stamping capabilities.
Note that holding a reference to the ptp device does not prevent its driver data from going away.
--- drivers/net/ethernet/freescale/gianfar_ethtool.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/gianfar_ethtool.c +3 -1
@@ -1464,8 +1464,10 @@ static int gfar_get_ts_info(struct net_dif (ptp_node) { ptp_dev =of_find_device_by_node (ptp_node);of_node_put (ptp_node); -if (ptp_dev) +if (ptp_dev) { ptp =platform_get_drvdata (ptp_dev); +put_device (&ptp_dev->dev); + } }if (ptp)
Greg Kroah-Hartman
maintainerPATCH 18/444 net: enetc: fix device and OF node leak at probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 70458f8a6b44daf3ad39f0d9b6d1097c8a7780ed upstream.
Make sure to drop the references to the IERB OF node and platform device taken by of_parse_phandle() and of_find_device_by_node() during probe.
--- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc_pf.c +12 -2
@@ -1182,19 +1182,29 @@ static int enetc_pf_register_with_ierb(s {struct platform_device *ierb_pdev;struct device_node *ierb_node; +int ret; ierb_node =of_find_compatible_node (NULL ,NULL ,"fsl,ls1028a-enetc-ierb" ); -if (!ierb_node || !of_device_is_available (ierb_node)) +if (!ierb_node)return -ENODEV ; +if (!of_device_is_available (ierb_node)) { +of_node_put (ierb_node); +return -ENODEV ; + } + ierb_pdev =of_find_device_by_node (ierb_node);of_node_put (ierb_node);if (!ierb_pdev)return -EPROBE_DEFER ; -return enetc_ierb_register_pf (ierb_pdev, pdev); + ret =enetc_ierb_register_pf (ierb_pdev, pdev); + +put_device (&ierb_pdev->dev); + +return ret; }static struct enetc_si *enetc_psi_create (struct pci_dev *pdev)
Greg Kroah-Hartman
maintainerPATCH 19/444 net: mtk_eth_soc: fix device leak at probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3e13274ca8750823e8b68181bdf185d238febe0d upstream.
The reference count to the WED devices has already been incremented when looking them up using of_find_device_by_node() so drop the bogus additional reference taken during probe.
--- drivers/net/ethernet/mediatek/mtk_wed.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_wed.c +0 -1
@@ -2794,7 +2794,6 @@ void mtk_wed_add_hw(struct device_node *if (!pdev) goto err_of_node_put; -get_device (&pdev->dev); irq =platform_get_irq (pdev,0 );if (irq <0 ) goto err_put_device;
Greg Kroah-Hartman
maintainerPATCH 20/444 net: ti: icss-iep: fix device and OF node leaks at probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e05c54974a05ab19658433545d6ced88d9075cf0 upstream.
Make sure to drop the references to the IEP OF node and device taken by of_parse_phandle() and of_find_device_by_node() when looking up IEP devices during probe.
Drop the bogus additional reference taken on successful lookup so that the device is released correctly by icss_iep_put().
--- drivers/net/ethernet/ti/icssg/icss_iep.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/net/ethernet/ti/icssg/icss_iep.c +18 -5
@@ -685,11 +685,17 @@ struct icss_iep *icss_iep_get_idx(structstruct platform_device *pdev;struct device_node *iep_np;struct icss_iep *iep; +int ret; iep_np =of_parse_phandle (np,"ti,iep" , idx); -if (!iep_np || !of_device_is_available (iep_np)) +if (!iep_np)return ERR_PTR (-ENODEV ); +if (!of_device_is_available (iep_np)) { +of_node_put (iep_np); +return ERR_PTR (-ENODEV ); + } + pdev =of_find_device_by_node (iep_np);of_node_put (iep_np);
@@ -698,21 +704,28 @@ struct icss_iep *icss_iep_get_idx(structreturn ERR_PTR (-EPROBE_DEFER ); iep =platform_get_drvdata (pdev); -if (!iep) -return ERR_PTR (-EPROBE_DEFER ); +if (!iep) { + ret = -EPROBE_DEFER ; + goto err_put_pdev; + }device_lock (iep->dev);if (iep->client_np) {device_unlock (iep->dev);dev_err (iep->dev,"IEP is already acquired by %s" , iep->client_np->name); -return ERR_PTR (-EBUSY ); + ret = -EBUSY ; + goto err_put_pdev; } iep->client_np = np;device_unlock (iep->dev); -get_device (iep->dev);return iep; + +err_put_pdev: +put_device (&pdev->dev); + +return ERR_PTR (ret); }EXPORT_SYMBOL_GPL (icss_iep_get_idx);
Greg Kroah-Hartman
maintainerPATCH 21/444 net: dpaa: fix device leak when querying time stamp info
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3fa840230f534385b34a4f39c8dd313fbe723f05 upstream.
Make sure to drop the reference to the ptp device taken by of_find_device_by_node() when querying the time stamping capabilities.
Note that holding a reference to the ptp device does not prevent its driver data from going away.
--- drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c +3 -1
@@ -415,8 +415,10 @@ static int dpaa_get_ts_info(struct net_dof_node_put (ptp_node); } -if (ptp_dev) +if (ptp_dev) { ptp =platform_get_drvdata (ptp_dev); +put_device (&ptp_dev->dev); + }if (ptp) info->phc_index = ptp->phc_index;
Greg Kroah-Hartman
maintainerPATCH 22/444 net: usb: asix_devices: add phy_mask for ax88772 mdio bus
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit 4faff70959d51078f9ee8372f8cff0d7045e4114 upstream.
Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.
--- drivers/net/usb/asix_devices.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/asix_devices.c +1 -0
@@ -676,6 +676,7 @@ static int ax88772_init_mdio(struct usbn priv->mdio->read = &asix_mdio_bus_read; priv->mdio->write = &asix_mdio_bus_write; priv->mdio->name ="Asix MDIO Bus" ; + priv->mdio->phy_mask = ~(BIT (priv->phy_addr) |BIT (AX_EMBD_PHY_ADDR ));/* mii bus name is usb-<usb bus number>-<usb device number> */ snprintf (priv->mdio->id,MII_BUS_ID_SIZE ,"usb-%03d:%03d" , dev->udev->bus->busnum, dev->udev->devnum);
Greg Kroah-Hartman
maintainerPATCH 23/444 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit 908e4ead7f757504d8b345452730636e298cbf68 upstream.
Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF.
Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all.
In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().
--- fs/nfsd/nfs4state.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
fs/nfsd/nfs4state.c +15 -5
@@ -4550,10 +4550,16 @@ nfsd4_setclientid_confirm(struct svc_rqs } status = nfs_ok;if (conf) { - old = unconf; -unhash_client_locked (old); -nfsd4_change_callback (conf, &unconf->cl_cb_conn); - }else { +if (get_client_locked (conf) == nfs_ok) { + old = unconf; +unhash_client_locked (old); +nfsd4_change_callback (conf, &unconf->cl_cb_conn); + }else { + conf =NULL ; + } + } + +if (!conf) { old =find_confirmed_client_by_name (&unconf->cl_name, nn);if (old) { status = nfserr_clid_inuse;
@@ -4570,10 +4576,14 @@ nfsd4_setclientid_confirm(struct svc_rqs }trace_nfsd_clid_replaced (&old->cl_clientid); } + status =get_client_locked (unconf); +if (status != nfs_ok) { + old =NULL ; + goto out; + }move_to_confirmed (unconf); conf = unconf; } -get_client_locked (conf);spin_unlock (&nn->client_lock);if (conf == unconf)fsnotify_dentry (conf->cl_nfsd_info_dentry,FS_MODIFY );
Greg Kroah-Hartman
maintainerPATCH 24/444 NFSD: detect mismatch of file handle and delegation stateid in OPEN op
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
commit 9c65001c57164033ad08b654c8b5ae35512ddf4a upstream.
When the client sends an OPEN with claim type CLAIM_DELEG_CUR_FH or CLAIM_DELEGATION_CUR, the delegation stateid and the file handle must belong to the same file, otherwise return NFS4ERR_INVAL.
Note that RFC8881, section 8.2.4, mandates the server to return NFS4ERR_BAD_STATEID if the selected table entry does not match the current filehandle. However returning NFS4ERR_BAD_STATEID in the OPEN causes the client to retry the operation and therefor get the client into a loop. To avoid this situation we return NFS4ERR_INVAL instead.
--- fs/nfsd/nfs4state.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/nfsd/nfs4state.c +14 -0
@@ -6150,6 +6150,20 @@ nfsd4_process_open2(struct svc_rqst *rqs status =nfs4_check_deleg (cl, open, &dp);if (status) goto out; +if (dp &&nfsd4_is_deleg_cur (open) && + (dp->dl_stid.sc_file != fp)) { +/* +* RFC8881 section 8.2.4 mandates the server to return +* NFS4ERR_BAD_STATEID if the selected table entry does +* not match the current filehandle. However returning +* NFS4ERR_BAD_STATEID in the OPEN can cause the client +* to repeatedly retry the operation with the same +* stateid, since the stateid itself is valid. To avoid +* this situation NFSD returns NFS4ERR_INVAL instead. +*/ + status = nfserr_inval; + goto out; + } stp =nfsd4_find_and_lock_existing_open (fp, open); }else { open->op_file =NULL ;
Greg Kroah-Hartman
maintainerPATCH 25/444 NFS: Fix the setting of capabilities when automounting a new filesystem
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit b01f21cacde9f2878492cf318fee61bf4ccad323 upstream.
Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.
--- fs/nfs/client.c | 44 ++++++++++++++++++++++++++++++++++++++++++-- fs/nfs/internal.h | 2 +- fs/nfs/nfs4client.c | 20 +------------------- fs/nfs/nfs4proc.c | 2 +- 4 files changed, 45 insertions(+), 23 deletions(-)
fs/nfs/client.c +42 -2
@@ -676,6 +676,44 @@ struct nfs_client *nfs_init_client(struc }EXPORT_SYMBOL_GPL (nfs_init_client); +static void nfs4_server_set_init_caps (struct nfs_server *server) +{ +#if IS_ENABLED (CONFIG_NFS_V4 ) +/* Set the basic capabilities */ + server->caps = server->nfs_client->cl_mvops->init_caps; +if (server->flags &NFS_MOUNT_NORDIRPLUS ) + server->caps &= ~NFS_CAP_READDIRPLUS ; +if (server->nfs_client->cl_proto ==XPRT_TRANSPORT_RDMA ) + server->caps &= ~NFS_CAP_READ_PLUS ; + +/* +* Don't use NFS uid/gid mapping if we're using AUTH_SYS or lower +* authentication. +*/ +if (nfs4_disable_idmapping && + server->client->cl_auth->au_flavor ==RPC_AUTH_UNIX ) + server->caps |=NFS_CAP_UIDGID_NOMAP ; +#endif +} + +void nfs_server_set_init_caps (struct nfs_server *server) +{ +switch (server->nfs_client->rpc_ops->version) { +case 2 : + server->caps =NFS_CAP_HARDLINKS |NFS_CAP_SYMLINKS ; +break ; +case 3 : + server->caps =NFS_CAP_HARDLINKS |NFS_CAP_SYMLINKS ; +if (!(server->flags &NFS_MOUNT_NORDIRPLUS )) + server->caps |=NFS_CAP_READDIRPLUS ; +break ; +default : +nfs4_server_set_init_caps (server); +break ; + } +} +EXPORT_SYMBOL_GPL (nfs_server_set_init_caps); +/* * Create a version 2 or 3 client */
@@ -717,7 +755,6 @@ static int nfs_init_server(struct nfs_se/* Initialise the client representation from the mount data */ server->flags = ctx->flags; server->options = ctx->options; - server->caps |=NFS_CAP_HARDLINKS |NFS_CAP_SYMLINKS ;switch (clp->rpc_ops->version) {case 2 :
@@ -753,6 +790,8 @@ static int nfs_init_server(struct nfs_seif (error <0 ) goto error; +nfs_server_set_init_caps (server); +/* Preserve the values of mount_server-related mount options */ if (ctx->mount_server.addrlen) { memcpy(&server->mountd_address, &ctx->mount_server.address,
@@ -927,7 +966,6 @@ void nfs_server_copy_userdata(struct nfs target->acregmax = source->acregmax; target->acdirmin = source->acdirmin; target->acdirmax = source->acdirmax; - target->caps = source->caps; target->options = source->options; target->auth_info = source->auth_info; target->port = source->port;
@@ -1161,6 +1199,8 @@ struct nfs_server *nfs_clone_server(struif (error <0 ) goto out_free_server; +nfs_server_set_init_caps (server); +/* probe the filesystem info for this server filesystem */ error =nfs_probe_server (server, fh);if (error <0 )
fs/nfs/internal.h +1 -1
@@ -231,7 +231,7 @@ extern struct nfs_client * nfs4_find_client_sessionid(struct net *, const struct sockaddr *, struct nfs4_sessionid *, u32);extern struct nfs_server *nfs_create_server (struct fs_context *); -extern void nfs4_server_set_init_caps (struct nfs_server *); +extern void nfs_server_set_init_caps (struct nfs_server *);extern struct nfs_server *nfs4_create_server (struct fs_context *);extern struct nfs_server *nfs4_create_referral_server (struct fs_context *); extern int nfs4_update_server(struct nfs_server *server, const char *hostname,
fs/nfs/nfs4client.c +1 -19
@@ -1081,24 +1081,6 @@ static void nfs4_session_limit_xasize(st#endif } -void nfs4_server_set_init_caps (struct nfs_server *server) -{ -/* Set the basic capabilities */ - server->caps |= server->nfs_client->cl_mvops->init_caps; -if (server->flags &NFS_MOUNT_NORDIRPLUS ) - server->caps &= ~NFS_CAP_READDIRPLUS ; -if (server->nfs_client->cl_proto ==XPRT_TRANSPORT_RDMA ) - server->caps &= ~NFS_CAP_READ_PLUS ; - -/* -* Don't use NFS uid/gid mapping if we're using AUTH_SYS or lower -* authentication. -*/ -if (nfs4_disable_idmapping && - server->client->cl_auth->au_flavor ==RPC_AUTH_UNIX ) - server->caps |=NFS_CAP_UIDGID_NOMAP ; -} -static int nfs4_server_common_setup (struct nfs_server *server,struct nfs_fh *mntfh,bool auth_probe) {
@@ -1113,7 +1095,7 @@ static int nfs4_server_common_setup(struif (error <0 ) goto out; -nfs4_server_set_init_caps (server); +nfs_server_set_init_caps (server);/* Probe the root fh to retrieve its FSID and filehandle */ error =nfs4_get_rootfh (server, mntfh, auth_probe);
fs/nfs/nfs4proc.c +1 -1
@@ -4064,7 +4064,7 @@ int nfs4_server_capabilities(struct nfs_ };int err; -nfs4_server_set_init_caps (server); +nfs_server_set_init_caps (server); do { err = nfs4_handle_exception(server, _nfs4_server_capabilities(server, fhandle),
Greg Kroah-Hartman
maintainerPATCH 26/444 PCI: Extend isolated function probing to LoongArch
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit a02fd05661d73a8507dd70dd820e9b984490c545 upstream.
Like s390 and the jailhouse hypervisor, LoongArch's PCI architecture allows passing isolated PCI functions to a guest OS instance. So it is possible that there is a multi-function device without function 0 for the host or guest.
Allow probing such functions by adding a IS_ENABLED(CONFIG_LOONGARCH) case in the hypervisor_isolated_pci_functions() helper.
This is similar to commit 189c6c33ff42 ("PCI: Extend isolated function probing to s390").
--- include/linux/hypervisor.h | 3 +++ 1 file changed, 3 insertions(+)
include/linux/hypervisor.h +3 -0
@@ -37,6 +37,9 @@ static inline bool hypervisor_isolated_pif (IS_ENABLED (CONFIG_S390 ))return true; +if (IS_ENABLED (CONFIG_LOONGARCH )) +return true; +return jailhouse_paravirt (); }
Greg Kroah-Hartman
maintainerPATCH 27/444 LoongArch: BPF: Fix jump offset calculation in tailcall
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoran Jiang <[email protected]>
commit cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 upstream.
The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by
"#define jmp_offset (out_offset - (cur_offset))"
is a negative number, which is wrong. The final generated assembly are as follow.
54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c
Before apply this patch, the follow test case will reveal soft lock issues.
cd tools/testing/selftests/bpf/
./test_progs --allow=tailcalls/tailcall_bpf2bpf_1
dmesg:
watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]
--- arch/loongarch/net/bpf_jit.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-)
arch/loongarch/net/bpf_jit.c +5 -16
@@ -208,11 +208,9 @@ bool bpf_jit_supports_far_kfunc_call(voireturn true; } -/* initialized on the first pass of build_body() */ -static int out_offset =-1 ; -static int emit_bpf_tail_call (struct jit_ctx *ctx) +static int emit_bpf_tail_call (struct jit_ctx *ctx,int insn) { -int off; +int off, tc_ninsn =0 ;u8 tcc =tail_call_reg (ctx);u8 a1 =LOONGARCH_GPR_A1 ;u8 a2 =LOONGARCH_GPR_A2 ;
@@ -222,7 +220,7 @@ static int emit_bpf_tail_call(struct jitconst int idx0 = ctx->idx;#define cur_offset (ctx->idx - idx0) -#define jmp_offset (out_offset - (cur_offset)) +#define jmp_offset (tc_ninsn - (cur_offset))/* * a0: &ctx
@@ -232,6 +230,7 @@ static int emit_bpf_tail_call(struct jit* if (index >= array->map.max_entries) * goto out; */ + tc_ninsn = insn ? ctx->offset[insn+1 ] - ctx->offset[insn] : ctx->offset[0 ]; off = offsetof(struct bpf_array, map.max_entries);emit_insn (ctx, ldwu, t1, a1, off);/* bgeu $a2, $t1, jmp_offset */
@@ -263,15 +262,6 @@ static int emit_bpf_tail_call(struct jitemit_insn (ctx, ldd, t3, t2, off);__build_epilogue (ctx, true); -/* out: */ -if (out_offset ==-1 ) - out_offset = cur_offset; -if (cur_offset != out_offset) { -pr_err_once ("tail_call out_offset = %d, expected %d!\n" , - cur_offset, out_offset); -return -1 ; - } -return 0 ; toofar:
@@ -916,7 +906,7 @@ static int build_insn(const struct bpf_i/* tail call */ case BPF_JMP |BPF_TAIL_CALL :mark_tail_call (ctx); -if (emit_bpf_tail_call (ctx) <0 ) +if (emit_bpf_tail_call (ctx, i) <0 )return -EINVAL ;break ;
@@ -1342,7 +1332,6 @@ out:if (tmp_blinded)bpf_jit_prog_release_other (prog, prog == orig_prog ? tmp : orig_prog); - out_offset =-1 ;return prog;
Greg Kroah-Hartman
maintainerPATCH 28/444 LoongArch: Dont use %pK through printk() in unwinder
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 2362e8124ed21445c6886806e5deaee717629ddd upstream.
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue.
Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
--- arch/loongarch/kernel/unwind_orc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/kernel/unwind_orc.c +1 -1
@@ -507,7 +507,7 @@ bool unwind_next_frame(struct unwind_sta state->pc =bt_address (pc);if (!state->pc) { -pr_err ("cannot find unwind pc at %pK\n" , (void *)pc); +pr_err ("cannot find unwind pc at %p\n" , (void *)pc); goto err; }
Greg Kroah-Hartman
maintainerPATCH 29/444 LoongArch: Make relocate_new_kernel_size be a .quad value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit a1a81b5477196ca1290b367404a461e046e647d5 upstream.
Now relocate_new_kernel_size is a .long value, which means 32bit, so its high 32bit is undefined. This causes memcpy((void *)reboot_code_buffer, relocate_new_kernel, relocate_new_kernel_size) in machine_kexec_prepare() access out of range memories in some cases, and then end up with an ADE exception.
So make relocate_new_kernel_size be a .quad value, which means 64bit, to avoid such errors.
--- arch/loongarch/kernel/relocate_kernel.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/kernel/relocate_kernel.S +1 -1
@@ -109,4 +109,4 @@ SYM_CODE_END(kexec_smp_wait) relocate_new_kernel_end: .section ".data" -SYM_DATA(relocate_new_kernel_size, .long relocate_new_kernel_end - relocate_new_kernel) +SYM_DATA(relocate_new_kernel_size, .quad relocate_new_kernel_end - relocate_new_kernel)
Greg Kroah-Hartman
maintainerPATCH 30/444 LoongArch: Avoid in-place string operation on FDT content
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao Zi <[email protected]>
commit 70a2365e18affc5ebdaab1ca6a0b3c4f3aac2ee8 upstream.
In init_cpu_fullname(), a constant pointer to "model" property is retrieved. It's later modified by the strsep() function, which is illegal and corrupts kernel's FDT copy. This is shown by dmesg,
OF: fdt: not creating '/sys/firmware/fdt': CRC check failed
Create a mutable copy of the model property and do in-place operations on the mutable copy instead. loongson_sysconf.cpuname lives across the kernel lifetime, thus manually releasing isn't necessary.
Also move the of_node_put() call for the root node after the usage of its property, since of_node_put() decreases the reference counter thus usage after the call is unsafe.
--- arch/loongarch/kernel/env.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
arch/loongarch/kernel/env.c +8 -5
@@ -39,16 +39,19 @@ void __init init_environ(void)static int __init init_cpu_fullname (void ) { -struct device_node *root;int cpu, ret; -char *model; +char *cpuname; +const char *model; +struct device_node *root;/* Parsing cpuname from DTS model property */ root =of_find_node_by_path ("/" ); - ret =of_property_read_string (root,"model" , (const char **)&model); + ret =of_property_read_string (root,"model" , &model); +if (ret ==0 ) { + cpuname =kstrdup (model,GFP_KERNEL ); + loongson_sysconf.cpuname =strsep (&cpuname," " ); + }of_node_put (root); -if (ret ==0 ) - loongson_sysconf.cpuname =strsep (&model," " );if (loongson_sysconf.cpuname && !strncmp (loongson_sysconf.cpuname,"Loongson" ,8 )) {for (cpu =0 ; cpu <NR_CPUS ; cpu++)
Greg Kroah-Hartman
maintainerPATCH 31/444 sunvdc: Balance device refcount in vdc_port_mpgroup_check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 63ce53724637e2e7ba51fe3a4f78351715049905 upstream.
Using device_find_child() to locate a probed virtual-device-port node causes a device refcount imbalance, as device_find_child() internally calls get_device() to increment the device’s reference count before returning its pointer. vdc_port_mpgroup_check() directly returns true upon finding a matching device without releasing the reference via put_device(). We should call put_device() to decrement refcount.
As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'.
Found by code review.
--- drivers/block/sunvdc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/block/sunvdc.c +3 -1
@@ -957,8 +957,10 @@ static bool vdc_port_mpgroup_check(struc dev =device_find_child (vdev->dev.parent, &port_data, vdc_device_probed); -if (dev) +if (dev) { +put_device (dev);return true; + }return false; }
Greg Kroah-Hartman
maintainerPATCH 32/444 clk: samsung: exynos850: fix a comment
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
commit 320e7efce30e2613c2c7877acc46a8e71192cdcd upstream.
The code below the updated comment is for CMU_CPUCL1, not CMU_CPUCL0.
--- drivers/clk/samsung/clk-exynos850.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/samsung/clk-exynos850.c +1 -1
@@ -1360,7 +1360,7 @@ static const unsigned long cpucl1_clk_re CLK_CON_GAT_GATE_CLK_CPUCL1_CPU, }; -/* List of parent clocks for Muxes in CMU_CPUCL0 */ +/* List of parent clocks for Muxes in CMU_CPUCL1 */ PNAME (mout_pll_cpucl1_p) = {"oscclk" ,"fout_cpucl1_pll" };PNAME (mout_cpucl1_switch_user_p) = {"oscclk" ,"dout_cpucl1_switch" };PNAME (mout_cpucl1_dbg_user_p) = {"oscclk" ,"dout_cpucl1_dbg" };
Greg Kroah-Hartman
maintainerPATCH 33/444 clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
commit 29a9361f0b50be2b16d308695e30ee030fedea2c upstream.
Use the correct Linux clock ID when instantiating the G3D_BUSD div_clock.
--- drivers/clk/samsung/clk-gs101.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/samsung/clk-gs101.c +1 -1
@@ -1154,7 +1154,7 @@ static const struct samsung_div_clock cm CLK_CON_DIV_CLKCMU_G2D_MSCL, 0, 4),DIV (CLK_DOUT_CMU_G3AA_G3AA ,"dout_cmu_g3aa_g3aa" ,"gout_cmu_g3aa_g3aa" ,CLK_CON_DIV_CLKCMU_G3AA_G3AA ,0 ,4 ), -DIV (CLK_DOUT_CMU_G3D_SWITCH ,"dout_cmu_g3d_busd" ,"gout_cmu_g3d_busd" , +DIV (CLK_DOUT_CMU_G3D_BUSD ,"dout_cmu_g3d_busd" ,"gout_cmu_g3d_busd" ,CLK_CON_DIV_CLKCMU_G3D_BUSD ,0 ,4 ),DIV (CLK_DOUT_CMU_G3D_GLB ,"dout_cmu_g3d_glb" ,"gout_cmu_g3d_glb" , CLK_CON_DIV_CLKCMU_G3D_GLB, 0, 4),
Greg Kroah-Hartman
maintainerPATCH 34/444 clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
commit ca243e653f71d8c4724a68c9033923f945b1084d upstream.
The alternate parent clock for this mux is mout_pll_usb, not the pll itself.
--- drivers/clk/samsung/clk-gs101.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/samsung/clk-gs101.c +1 -1
@@ -2129,7 +2129,7 @@ PNAME(mout_hsi0_usbdpdbg_user_p) = { "os "dout_cmu_hsi0_usbdpdbg" };PNAME (mout_hsi0_bus_p) = {"mout_hsi0_bus_user" ,"mout_hsi0_alt_user" }; -PNAME (mout_hsi0_usb20_ref_p) = {"fout_usb_pll" , +PNAME (mout_hsi0_usb20_ref_p) = {"mout_pll_usb" ,"mout_hsi0_tcxo_user" };PNAME (mout_hsi0_usb31drd_p) = {"fout_usb_pll" ,"mout_hsi0_usb31drd_user" ,
Greg Kroah-Hartman
maintainerPATCH 35/444 fscrypt: Dont use problematic non-inline crypto engines
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit b41c1d8d07906786c60893980d52688f31d114a6 upstream.
Make fscrypt no longer use Crypto API drivers for non-inline crypto engines, even when the Crypto API prioritizes them over CPU-based code (which unfortunately it often does). These drivers tend to be really problematic, especially for fscrypt's workload. This commit has no effect on inline crypto engines, which are different and do work well.
Specifically, exclude drivers that have CRYPTO_ALG_KERN_DRIVER_ONLY or CRYPTO_ALG_ALLOCATES_MEMORY set. (Later, CRYPTO_ALG_ASYNC should be excluded too. That's omitted for now to keep this commit backportable, since until recently some CPU-based code had CRYPTO_ALG_ASYNC set.)
There are two major issues with these drivers: bugs and performance.
First, these drivers tend to be buggy. They're fundamentally much more error-prone and harder to test than the CPU-based code. They often don't get tested before kernel releases, and even if they do, the crypto self-tests don't properly test these drivers. Released drivers have en/decrypted or hashed data incorrectly. These bugs cause issues for fscrypt users who often didn't even want to use these drivers, e.g.:
- https://github.com/google/fscryptctl/issues/32
- https://github.com/google/fscryptctl/issues/9
- https://lore.kernel.org/r/PH0PR02MB731916ECDB6C613665863B6CFFAA2@PH0PR02MB7319.namprd02.prod.outlook.com
These drivers have also similarly caused issues for dm-crypt users, including data corruption and deadlocks. Since Linux v5.10, dm-crypt has disabled most of them by excluding CRYPTO_ALG_ALLOCATES_MEMORY.
Second, these drivers tend to be *much* slower than the CPU-based code. This may seem counterintuitive, but benchmarks clearly show it. There's a *lot* of overhead associated with going to a hardware driver, off the CPU, and back again. To prove this, I gathered as many systems with this type of crypto engine as I could, and I measured synchronous encryption of 4096-byte messages (which matches fscrypt's workload):
Intel Emerald Rapids server:
AES-256-XTS:
xts-aes-vaes-avx512 16171 MB/s [CPU-based, Vector AES]
qat_aes_xts 289 MB/s [Offload, Intel QuickAssist]
Qualcomm SM8650 HDK:
AES-256-XTS:
xts-aes-ce 4301 MB/s [CPU-based, ARMv8 Crypto Extensions]
xts-aes-qce 73 MB/s [Offload, Qualcomm Crypto Engine]
i.MX 8M Nano LPDDR4 EVK:
AES-256-XTS:
xts-aes-ce 647 MB/s [CPU-based, ARMv8 Crypto Extensions]
xts(ecb-aes-caam) 20 MB/s [Offload, CAAM]
AES-128-CBC-ESSIV:
essiv(cbc-aes-caam,sha256-lib) 23 MB/s [Offload, CAAM]
STM32MP157F-DK2:
AES-256-XTS:
xts-aes-neonbs 13.2 MB/s [CPU-based, ARM NEON]
xts(stm32-ecb-aes) 3.1 MB/s [Offload, STM32 crypto engine]
AES-128-CBC-ESSIV:
essiv(cbc-aes-neonbs,sha256-lib)
14.7 MB/s [CPU-based, ARM NEON]
essiv(stm32-cbc-aes,sha256-lib)
3.2 MB/s [Offload, STM32 crypto engine] Adiantum:
adiantum(xchacha12-arm,aes-arm,nhpoly1305-neon)
52.8 MB/s [CPU-based, ARM scalar + NEON]
So, there was no case in which the crypto engine was even *close* to being faster. On the first three, which have AES instructions in the CPU, the CPU was 30 to 55 times faster (!). Even on STM32MP157F-DK2 which has a Cortex-A7 CPU that doesn't have AES instructions, AES was over 4 times faster on the CPU. And Adiantum encryption, which is what actually should be used on CPUs like that, was over 17 times faster.
Other justifications that have been given for these non-inline crypto engines (almost always coming from the hardware vendors, not actual users) don't seem very plausible either:
- The crypto engine throughput could be improved by processing multiple requests concurrently. Currently irrelevant to fscrypt, since it doesn't do that. This would also be complex, and unhelpful in many cases. 2 of the 4 engines I tested even had only one queue.
- Some of the engines, e.g. STM32, support hardware keys. Also currently irrelevant to fscrypt, since it doesn't support these. Interestingly, the STM32 driver itself doesn't support this either.
- Free up CPU for other tasks and/or reduce energy usage. Not very plausible considering the "short" message length, driver overhead, and scheduling overhead. There's just very little time for the CPU to do something else like run another task or enter low-power state, before the message finishes and it's time to process the next one.
- Some of these engines resist power analysis and electromagnetic attacks, while the CPU-based crypto generally does not. In theory, this sounds great. In practice, if this benefit requires the use of an off-CPU offload that massively regresses performance and has a low-quality, buggy driver, the price for this hardening (which is not relevant to most fscrypt users, and tends to be incomplete) is just too high. Inline crypto engines are much more promising here, as are on-CPU solutions like RISC-V High Assurance Cryptography.
--- Documentation/filesystems/fscrypt.rst | 37 +++++++++++++--------------------- fs/crypto/fscrypt_private.h | 17 +++++++++++++++ fs/crypto/hkdf.c | 2 - fs/crypto/keysetup.c | 3 +- fs/crypto/keysetup_v1.c | 3 +- 5 files changed, 37 insertions(+), 25 deletions(-)
Documentation/filesystems/fscrypt.rst +15 -22
@@ -141,9 +141,8 @@ However, these ioctls have some limitati CONFIG_PAGE_POISONING=y in your kernel config and add page_poison=1 to your kernel command line. However, this has a performance cost. -- Secret keys might still exist in CPU registers, in crypto - accelerator hardware (if used by the crypto API to implement any of - the algorithms), or in other places not explicitly considered here. +- Secret keys might still exist in CPU registers or in other places + not explicitly considered here. Limitations of v1 policies ~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -378,9 +377,12 @@ the work is done by XChaCha12, which is acceleration is unavailable. For more information about Adiantum, see `the Adiantum paper <https://eprint.iacr.org/2018/720.pdf>`_. -The (AES-128-CBC-ESSIV, AES-128-CBC-CTS) pair exists only to support -systems whose only form of AES acceleration is an off-CPU crypto -accelerator such as CAAM or CESA that does not support XTS. +The (AES-128-CBC-ESSIV, AES-128-CBC-CTS) pair was added to try to +provide a more efficient option for systems that lack AES instructions +in the CPU but do have a non-inline crypto engine such as CAAM or CESA +that supports AES-CBC (and not AES-XTS). This is deprecated. It has +been shown that just doing AES on the CPU is actually faster. +Moreover, Adiantum is faster still and is recommended on such systems. The remaining mode pairs are the "national pride ciphers":
@@ -1289,22 +1291,13 @@ this by validating all top-level encrypt Inline encryption support ========================= -By default, fscrypt uses the kernel crypto API for all cryptographic -operations (other than HKDF, which fscrypt partially implements -itself). The kernel crypto API supports hardware crypto accelerators, -but only ones that work in the traditional way where all inputs and -outputs (e.g. plaintexts and ciphertexts) are in memory. fscrypt can -take advantage of such hardware, but the traditional acceleration -model isn't particularly efficient and fscrypt hasn't been optimized -for it. - -Instead, many newer systems (especially mobile SoCs) have *inline -encryption hardware* that can encrypt/decrypt data while it is on its -way to/from the storage device. Linux supports inline encryption -through a set of extensions to the block layer called *blk-crypto*. -blk-crypto allows filesystems to attach encryption contexts to bios -(I/O requests) to specify how the data will be encrypted or decrypted -in-line. For more information about blk-crypto, see +Many newer systems (especially mobile SoCs) have *inline encryption +hardware* that can encrypt/decrypt data while it is on its way to/from +the storage device. Linux supports inline encryption through a set of +extensions to the block layer called *blk-crypto*. blk-crypto allows +filesystems to attach encryption contexts to bios (I/O requests) to +specify how the data will be encrypted or decrypted in-line. For more +information about blk-crypto, see :ref:`Documentation/block/inline-encryption.rst <inline_encryption>`. On supported filesystems (currently ext4 and f2fs), fscrypt can use
fs/crypto/fscrypt_private.h +17 -0
@@ -27,6 +27,23 @@*/ #define FSCRYPT_MIN_KEY_SIZE 16 +/* +* This mask is passed as the third argument to the crypto_alloc_*() functions +* to prevent fscrypt from using the Crypto API drivers for non-inline crypto +* engines. Those drivers have been problematic for fscrypt. fscrypt users +* have reported hangs and even incorrect en/decryption with these drivers. +* Since going to the driver, off CPU, and back again is really slow, such +* drivers can be over 50 times slower than the CPU-based code for fscrypt's +* workload. Even on platforms that lack AES instructions on the CPU, using the +* offloads has been shown to be slower, even staying with AES. (Of course, +* Adiantum is faster still, and is the recommended option on such platforms...) +* +* Note that fscrypt also supports inline crypto engines. Those don't use the +* Crypto API and work much better than the old-style (non-inline) engines. +*/ +#define FSCRYPT_CRYPTOAPI_MASK \ + (CRYPTO_ALG_ALLOCATES_MEMORY | CRYPTO_ALG_KERN_DRIVER_ONLY) +#define FSCRYPT_CONTEXT_V1 1#define FSCRYPT_CONTEXT_V2 2
fs/crypto/hkdf.c +1 -1
@@ -72,7 +72,7 @@ int fscrypt_init_hkdf(struct fscrypt_hkdu8 prk[HKDF_HASHLEN ];int err; - hmac_tfm =crypto_alloc_shash (HKDF_HMAC_ALG ,0 ,0 ); + hmac_tfm =crypto_alloc_shash (HKDF_HMAC_ALG ,0 ,FSCRYPT_CRYPTOAPI_MASK );if (IS_ERR (hmac_tfm)) {fscrypt_err (NULL ,"Error allocating " HKDF_HMAC_ALG ": %ld" ,PTR_ERR (hmac_tfm));
fs/crypto/keysetup.c +2 -1
@@ -103,7 +103,8 @@ fscrypt_allocate_skcipher(struct fscryptstruct crypto_skcipher *tfm;int err; - tfm =crypto_alloc_skcipher (mode->cipher_str,0 ,0 ); + tfm =crypto_alloc_skcipher (mode->cipher_str,0 , +FSCRYPT_CRYPTOAPI_MASK );if (IS_ERR (tfm)) {if (PTR_ERR (tfm) == -ENOENT ) { fscrypt_warn(inode,
fs/crypto/keysetup_v1.c +2 -1
@@ -52,7 +52,8 @@ static int derive_key_aes(const u8 *maststruct skcipher_request *req =NULL ;DECLARE_CRYPTO_WAIT (wait);struct scatterlist src_sg, dst_sg; -struct crypto_skcipher *tfm =crypto_alloc_skcipher ("ecb(aes)" ,0 ,0 ); +struct crypto_skcipher *tfm = +crypto_alloc_skcipher ("ecb(aes)" ,0 ,FSCRYPT_CRYPTOAPI_MASK );if (IS_ERR (tfm)) { res =PTR_ERR (tfm);
Greg Kroah-Hartman
maintainerPATCH 36/444 fs: Prevent file descriptor table allocations exceeding INT_MAX
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <[email protected]>
commit 04a2c4b4511d186b0fce685da21085a5d4acd370 upstream.
When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c:
WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288
This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN.
Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate:
- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes
- Multiple bitmaps: ~400MB
- Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647)
Reproducer:
1. Set /proc/sys/fs/nr_open to 1073741816:
# echo 1073741816 > /proc/sys/fs/nr_open
2. Run a program that uses a high file descriptor:
#include <unistd.h>
#include <sys/resource.h>
int main() {
struct rlimit rlim = {1073741824, 1073741824};
setrlimit(RLIMIT_NOFILE, &rlim);
dup2(2, 1073741880); // Triggers the warning
return 0;
}3. Observe WARNING in dmesg at mm/slub.c:5027
systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that:
1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting
2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations
3. The resulting allocations (>8GB) are impractical and will always fail
systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors.
While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue.
Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.
--- fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/file.c +15 -0
@@ -126,6 +126,21 @@ static struct fdtable * alloc_fdtable(unif (unlikely (nr > sysctl_nr_open)) nr = ((sysctl_nr_open -1 ) | (BITS_PER_LONG -1 )) +1 ; +/* +* Check if the allocation size would exceed INT_MAX. kvmalloc_array() +* and kvmalloc() will warn if the allocation size is greater than +* INT_MAX, as filp_cachep objects are not __GFP_NOWARN. +* +* This can happen when sysctl_nr_open is set to a very high value and +* a process tries to use a file descriptor near that limit. For example, +* if sysctl_nr_open is set to 1073741816 (0x3ffffff8) - which is what +* systemd typically sets it to - then trying to use a file descriptor +* close to that value will require allocating a file descriptor table +* that exceeds 8GB in size. +*/ +if (unlikely (nr >INT_MAX /sizeof (struct file *))) +return ERR_PTR (-EMFILE ); + fdt =kmalloc (sizeof (struct fdtable ),GFP_KERNEL_ACCOUNT );if (!fdt) goto out;
Greg Kroah-Hartman
maintainerPATCH 37/444 eventpoll: Fix semi-unbounded recursion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit f2e467a48287c868818085aa35389a224d226732 upstream.
Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links.
Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons:
- They don't look upwards in the tree.
- If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed ("epoll: limit paths").
Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops.
A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files.
As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion problem").)
To fix it:
1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited.
2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk.
3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.
--- fs/eventpoll.c | 60 +++++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 46 insertions(+), 14 deletions(-)
fs/eventpoll.c +46 -14
@@ -218,6 +218,7 @@ struct eventpoll {/* used to optimize loop detection check */ u64 gen;struct hlist_head refs; +u8 loop_check_depth;/* * usage count, used together with epitem->dying to
@@ -2091,23 +2092,24 @@ static int ep_poll(struct eventpoll *ep, }/** -* ep_loop_check_proc - verify that adding an epoll file inside another -* epoll structure does not violate the constraints, in -* terms of closed loops, or too deep chains (which can -* result in excessive stack usage). +* ep_loop_check_proc - verify that adding an epoll file @ep inside another +* epoll file does not create closed loops, and +* determine the depth of the subtree starting at @ep * * @ep: the &struct eventpoll to be currently checked. * @depth: Current depth of the path being checked. * -* Return: %zero if adding the epoll @file inside current epoll -* structure @ep does not violate the constraints, or %-1 otherwise. +* Return: depth of the subtree, or INT_MAX if we found a loop or went too deep. */ static int ep_loop_check_proc (struct eventpoll *ep,int depth) { -int error =0 ; +int result =0 ;struct rb_node *rbp;struct epitem *epi; +if (ep->gen == loop_check_gen) +return ep->loop_check_depth; +mutex_lock_nested (&ep->mtx, depth +1 ); ep->gen = loop_check_gen;for (rbp =rb_first_cached (&ep->rbr); rbp; rbp =rb_next (rbp)) {
@@ -2115,13 +2117,11 @@ static int ep_loop_check_proc(struct eveif (unlikely (is_file_epoll (epi->ffd.file))) {struct eventpoll *ep_tovisit; ep_tovisit = epi->ffd.file->private_data; -if (ep_tovisit->gen == loop_check_gen) -continue ;if (ep_tovisit == inserting_into || depth >EP_MAX_NESTS ) - error =-1 ; + result =INT_MAX ;else - error =ep_loop_check_proc (ep_tovisit, depth +1 ); -if (error !=0 ) + result =max (result,ep_loop_check_proc (ep_tovisit, depth +1 ) +1 ); +if (result >EP_MAX_NESTS )break ; }else {/*
@@ -2135,9 +2135,27 @@ static int ep_loop_check_proc(struct evelist_file (epi->ffd.file); } } + ep->loop_check_depth = result;mutex_unlock (&ep->mtx); -return error; +return result; +} + +/** +* ep_get_upwards_depth_proc - determine depth of @ep when traversed upwards +*/ +static int ep_get_upwards_depth_proc (struct eventpoll *ep,int depth) +{ +int result =0 ; +struct epitem *epi; + +if (ep->gen == loop_check_gen) +return ep->loop_check_depth; +hlist_for_each_entry_rcu (epi, &ep->refs, fllink) + result =max (result,ep_get_upwards_depth_proc (epi->ep, depth +1 ) +1 ); + ep->gen = loop_check_gen; + ep->loop_check_depth = result; +return result; }/**
@@ -2153,8 +2171,22 @@ static int ep_loop_check_proc(struct eve*/ static int ep_loop_check (struct eventpoll *ep,struct eventpoll *to) { +int depth, upwards_depth; + inserting_into = ep; -return ep_loop_check_proc (to,0 ); +/* +* Check how deep down we can get from @to, and whether it is possible +* to loop up to @ep. +*/ + depth =ep_loop_check_proc (to,0 ); +if (depth >EP_MAX_NESTS ) +return -1 ; +/* Check how far up we can go from @ep. */ +rcu_read_lock (); + upwards_depth =ep_get_upwards_depth_proc (ep,0 ); +rcu_read_unlock (); + +return (depth+1 +upwards_depth >EP_MAX_NESTS ) ?-1 :0 ; }static void clear_tfile_check_list (void )
Greg Kroah-Hartman
maintainerPATCH 38/444 Documentation: ACPI: Fix parent device references
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit e65cb011349e653ded541dddd6469c2ca813edcf upstream.
The _CRS resources in many cases want to have ResourceSource field to be a type of ACPI String. This means that to compile properly we need to enclosure the name path into double quotes. This will in practice defer the interpretation to a run-time stage, However, this may be interpreted differently on different OSes and ACPI interpreter implementations. In particular ACPICA might not correctly recognize the leading '^' (caret) character and will not resolve the relative name path properly. On top of that, this piece may be used in SSDTs which are loaded after the DSDT and on itself may also not resolve relative name paths outside of their own scopes. With this all said, fix documentation to use fully-qualified name paths always to avoid any misinterpretations, which is proven to work.
--- Documentation/firmware-guide/acpi/i2c-muxes.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
Documentation/firmware-guide/acpi/i2c-muxes.rst +4 -4
@@ -14,7 +14,7 @@ Consider this topology:: | | | 0x70 |--CH01--> i2c client B (0x50) +------+ +------+ -which corresponds to the following ASL:: +which corresponds to the following ASL (in the scope of \_SB):: Device (SMB1) {
@@ -24,7 +24,7 @@ which corresponds to the following ASL:: Name (_HID, ...) Name (_CRS, ResourceTemplate () { I2cSerialBus (0x70, ControllerInitiated, I2C_SPEED, - AddressingMode7Bit, "^SMB1", 0x00, + AddressingMode7Bit, "\\_SB.SMB1", 0x00, ResourceConsumer,,) }
@@ -37,7 +37,7 @@ which corresponds to the following ASL:: Name (_HID, ...) Name (_CRS, ResourceTemplate () { I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED, - AddressingMode7Bit, "^CH00", 0x00, + AddressingMode7Bit, "\\_SB.SMB1.CH00", 0x00, ResourceConsumer,,) } }
@@ -52,7 +52,7 @@ which corresponds to the following ASL:: Name (_HID, ...) Name (_CRS, ResourceTemplate () { I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED, - AddressingMode7Bit, "^CH01", 0x00, + AddressingMode7Bit, "\\_SB.SMB1.CH01", 0x00, ResourceConsumer,,) } }
Greg Kroah-Hartman
maintainerPATCH 39/444 ACPI: processor: perflib: Fix initial _PPC limit application
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
commit d33bd88ac0ebb49e7f7c8f29a8c7ee9eae85d765 upstream.
If the BIOS sets a _PPC frequency limit upfront, it will fail to take effect due to a call ordering issue. Namely, freq_qos_update_request() is called before freq_qos_add_request() for the given request causing the constraint update to be ignored. The call sequence in question is as follows:
cpufreq_policy_online()
acpi_cpufreq_cpu_init()
acpi_processor_register_performance()
acpi_processor_get_performance_info()
acpi_processor_get_platform_limit()
freq_qos_update_request(&perflib_req) <- inactive QoS request
blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
CPUFREQ_CREATE_POLICY)
acpi_processor_notifier()
acpi_processor_ppc_init()
freq_qos_add_request(&perflib_req) <- QoS request activation
Address this by adding an acpi_processor_get_platform_limit() call to acpi_processor_ppc_init(), after the perflib_req activation via freq_qos_add_request(), which causes the initial _PPC limit to be picked up as appropriate. However, also ensure that the _PPC limit will not be picked up in the cases when the cpufreq driver does not call acpi_processor_register_performance() by adding a pr->performance check to the related_cpus loop in acpi_processor_ppc_init().
--- drivers/acpi/processor_perflib.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/acpi/processor_perflib.c +9 -1
@@ -174,11 +174,14 @@ void acpi_processor_ppc_init(struct cpuf {unsigned int cpu; +if (ignore_ppc ==1 ) +return ; +for_each_cpu (cpu, policy->related_cpus) {struct acpi_processor *pr =per_cpu (processors, cpu);int ret; -if (!pr) +if (!pr || !pr->performance)continue ;/*
@@ -194,6 +197,11 @@ void acpi_processor_ppc_init(struct cpufif (ret <0 )pr_err ("Failed to add freq constraint for CPU%d (%d)\n" , cpu, ret); + + ret =acpi_processor_get_platform_limit (pr); +if (ret) +pr_err ("Failed to update freq constraint for CPU%d (%d)\n" , + cpu, ret); } }
Greg Kroah-Hartman
maintainerPATCH 40/444 ACPI: processor: perflib: Move problematic pr->performance check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit d405ec23df13e6df599f5bd965a55d13420366b8 upstream.
Commit d33bd88ac0eb ("ACPI: processor: perflib: Fix initial _PPC limit application") added a pr->performance check that prevents the frequency QoS request from being added when the given processor has no performance object. Unfortunately, this causes a WARN() in freq_qos_remove_request() to trigger on an attempt to take the given CPU offline later because the frequency QoS object has not been added for it due to the missing performance object.
Address this by moving the pr->performance check before calling acpi_processor_get_platform_limit() so it only prevents a limit from being set for the CPU if the performance object is not present. This way, the frequency QoS request is added as it was before the above commit and it is present all the time along with the CPU's cpufreq policy regardless of whether or not the CPU is online.
--- drivers/acpi/processor_perflib.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/acpi/processor_perflib.c +4 -1
@@ -181,7 +181,7 @@ void acpi_processor_ppc_init(struct cpufstruct acpi_processor *pr =per_cpu (processors, cpu);int ret; -if (!pr || !pr->performance) +if (!pr)continue ;/*
@@ -198,6 +198,9 @@ void acpi_processor_ppc_init(struct cpufpr_err ("Failed to add freq constraint for CPU%d (%d)\n" , cpu, ret); +if (!pr->performance) +continue ; + ret =acpi_processor_get_platform_limit (pr);if (ret) pr_err("Failed to update freq constraint for CPU%d (%d)\n",
Greg Kroah-Hartman
maintainerPATCH 41/444 block: Make REQ_OP_ZONE_FINISH a write operation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 3f66ccbaaef3a0c5bd844eab04e3207b4061c546 upstream.
REQ_OP_ZONE_FINISH is defined as "12", which makes op_is_write(REQ_OP_ZONE_FINISH) return false, despite the fact that a zone finish operation is an operation that modifies a zone (transition it to full) and so should be considered as a write operation (albeit one that does not transfer any data to the device).
Fix this by redefining REQ_OP_ZONE_FINISH to be an odd number (13), and redefine REQ_OP_ZONE_RESET and REQ_OP_ZONE_RESET_ALL using sequential odd numbers from that new value.
--- include/linux/blk_types.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
include/linux/blk_types.h +3 -3
@@ -342,11 +342,11 @@ enum req_op {/* Close a zone */ REQ_OP_ZONE_CLOSE = (__force blk_opf_t )11 ,/* Transition a zone to full */ -REQ_OP_ZONE_FINISH = (__force blk_opf_t )12 , +REQ_OP_ZONE_FINISH = (__force blk_opf_t )13 ,/* reset a zone write pointer */ -REQ_OP_ZONE_RESET = (__force blk_opf_t )13 , +REQ_OP_ZONE_RESET = (__force blk_opf_t )15 ,/* reset all the zone present on the device */ -REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t )15 , +REQ_OP_ZONE_RESET_ALL = (__force blk_opf_t )17 ,/* Driver private requests */ REQ_OP_DRV_IN = (__force blk_opf_t)34,
Greg Kroah-Hartman
maintainerPATCH 42/444 mm/memory-tier: fix abstract distance calculation overflow
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
commit cce35103135c7ffc7bebc32ebfc74fe1f2c3cb5d upstream.
In mt_perf_to_adistance(), the calculation of abstract distance (adist) involves multiplying several int values including MEMTIER_ADISTANCE_DRAM.
*adist = MEMTIER_ADISTANCE_DRAM *
(perf->read_latency + perf->write_latency) / (default_dram_perf.read_latency + default_dram_perf.write_latency) * (default_dram_perf.read_bandwidth + default_dram_perf.write_bandwidth) / (perf->read_bandwidth + perf->write_bandwidth);
Since these values can be large, the multiplication may exceed the maximum value of an int (INT_MAX) and overflow (Our platform did), leading to an incorrect adist.
User-visible impact:
The memory tiering subsystem will misinterpret slow memory (like CXL) as faster than DRAM, causing inappropriate demotion of pages from CXL (slow memory) to DRAM (fast memory).
For example, we will see the following demotion chains from the dmesg, where Node0,1 are DRAM, and Node2,3 are CXL node:
Demotion targets for Node 0: null
Demotion targets for Node 1: null
Demotion targets for Node 2: preferred: 0-1, fallback: 0-1 Demotion targets for Node 3: preferred: 0-1, fallback: 0-1
Change MEMTIER_ADISTANCE_DRAM to be a long constant by writing it with the 'L' suffix. This prevents the overflow because the multiplication will then be done in the long type which has a larger range.
--- include/linux/memory-tiers.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/memory-tiers.h +1 -1
@@ -18,7 +18,7 @@* adistance value (slightly faster) than default DRAM adistance to be part of * the same memory tier. */ -#define MEMTIER_ADISTANCE_DRAM ((4 * MEMTIER_CHUNK_SIZE) + (MEMTIER_CHUNK_SIZE >> 1)) +#define MEMTIER_ADISTANCE_DRAM ((4L * MEMTIER_CHUNK_SIZE) + (MEMTIER_CHUNK_SIZE >> 1))struct memory_tier ;struct memory_dev_type {
Greg Kroah-Hartman
maintainerPATCH 43/444 smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
commit 5349ae5e05fa37409fd48a1eb483b199c32c889b upstream.
We should call ib_dma_unmap_single() and mempool_free() before calling smbd_disconnect_rdma_connection().
And smbd_disconnect_rdma_connection() needs to be the last function to call as all other state might already be gone after it returns.
--- fs/smb/client/smbdirect.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
fs/smb/client/smbdirect.c +8 -6
@@ -277,18 +277,20 @@ static void send_done(struct ib_cq *cq,log_rdma_send (INFO ,"smbd_request 0x%p completed wc->status=%d\n" , request, wc->status); -if (wc->status !=IB_WC_SUCCESS || wc->opcode !=IB_WC_SEND ) { -log_rdma_send (ERR ,"wc->status=%d wc->opcode=%d\n" , - wc->status, wc->opcode); -smbd_disconnect_rdma_connection (request->info); - } -for (i =0 ; i < request->num_sge; i++)ib_dma_unmap_single (sc->ib.dev, request->sge[i].addr, request->sge[i].length,DMA_TO_DEVICE ); +if (wc->status !=IB_WC_SUCCESS || wc->opcode !=IB_WC_SEND ) { +log_rdma_send (ERR ,"wc->status=%d wc->opcode=%d\n" , + wc->status, wc->opcode); +mempool_free (request, info->request_mempool); +smbd_disconnect_rdma_connection (info); +return ; + } +if (atomic_dec_and_test (&request->info->send_pending))wake_up (&request->info->wait_send_pending);
Greg Kroah-Hartman
maintainerPATCH 44/444 smb: client: dont wait for info->send_pending == 0 on error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
commit 8c48e1c7520321cc87ff651e96093e2f412785fb upstream.
We already called ib_drain_qp() before and that makes sure send_done() was called with IB_WC_WR_FLUSH_ERR, but didn't called atomic_dec_and_test(&sc->send_io.pending.count)
So we may never reach the info->send_pending == 0 condition.
--- fs/smb/client/smbdirect.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/smb/client/smbdirect.c +5 -5
@@ -1316,10 +1316,6 @@ void smbd_destroy(struct TCP_Server_Infolog_rdma_event (INFO ,"cancelling idle timer\n" );cancel_delayed_work_sync (&info->idle_timer_work); -log_rdma_event (INFO ,"wait for all send posted to IB to finish\n" ); -wait_event (info->wait_send_pending, -atomic_read (&info->send_pending) ==0 ); -/* It's not possible for upper layer to get to reassembly */ log_rdma_event (INFO ,"drain the reassembly queue\n" ); do {
@@ -1965,7 +1961,11 @@ int smbd_send(struct TCP_Server_Info *se*/ wait_event (info->wait_send_pending, -atomic_read (&info->send_pending) ==0 ); +atomic_read (&info->send_pending) ==0 || + sc->status !=SMBDIRECT_SOCKET_CONNECTED ); + +if (sc->status !=SMBDIRECT_SOCKET_CONNECTED && rc ==0 ) + rc = -EAGAIN ;return rc; }
Greg Kroah-Hartman
maintainerPATCH 45/444 KVM: x86: Convert vcpu_run()s immediate exit param into a generic bitmap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 2478b1b220c49d25cb1c3f061ec4f9b351d9a131 ]
Convert kvm_x86_ops.vcpu_run()'s "force_immediate_exit" boolean parameter into an a generic bitmap so that similar "take action" information can be passed to vendor code without creating a pile of boolean parameters.
This will allow dropping kvm_x86_ops.set_dr6() in favor of a new flag, and will also allow for adding similar functionality for re-loading debugctl in the active VMCS.
Opportunistically massage the TDX WARN and comment to prepare for adding more run_flags, all of which are expected to be mutually exclusive with TDX, i.e. should be WARNed on.
No functional change intended.
--- arch/x86/include/asm/kvm_host.h | 6 +++++- arch/x86/kvm/svm/svm.c | 4 ++-- arch/x86/kvm/vmx/vmx.c | 3 ++- arch/x86/kvm/vmx/x86_ops.h | 2 +- arch/x86/kvm/x86.c | 11 ++++++++--- 5 files changed, 18 insertions(+), 8 deletions(-)
arch/x86/include/asm/kvm_host.h +5 -1
@@ -1627,6 +1627,10 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical)return dest_mode_logical ?APIC_DEST_LOGICAL :APIC_DEST_PHYSICAL ; } +enum kvm_x86_run_flags { +KVM_RUN_FORCE_IMMEDIATE_EXIT =BIT (0 ), +}; +struct kvm_x86_ops {const char *name;
@@ -1706,7 +1710,7 @@ struct kvm_x86_ops {int (*vcpu_pre_run)(struct kvm_vcpu *vcpu);enum exit_fastpath_completion (*vcpu_run)(struct kvm_vcpu *vcpu, -bool force_immediate_exit); +u64 run_flags);int (*handle_exit)(struct kvm_vcpu *vcpu,enum exit_fastpath_completion exit_fastpath);int (*skip_emulated_instruction)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +2 -2
@@ -4226,9 +4226,9 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_inguest_state_exit_irqoff (); } -static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, -bool force_immediate_exit) +static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags) { +bool force_immediate_exit = run_flags &KVM_RUN_FORCE_IMMEDIATE_EXIT ;struct vcpu_svm *svm =to_svm (vcpu);bool spec_ctrl_intercepted =msr_write_intercepted (vcpu,MSR_IA32_SPEC_CTRL );
arch/x86/kvm/vmx/vmx.c +2 -1
@@ -7353,8 +7353,9 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu,guest_state_exit_irqoff (); } -fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,bool force_immediate_exit) +fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,u64 run_flags) { +bool force_immediate_exit = run_flags &KVM_RUN_FORCE_IMMEDIATE_EXIT ;struct vcpu_vmx *vmx =to_vmx (vcpu);unsigned long cr3, cr4;
arch/x86/kvm/vmx/x86_ops.h +1 -1
@@ -21,7 +21,7 @@ void vmx_vm_destroy(struct kvm *kvm);int vmx_vcpu_precreate (struct kvm *kvm);int vmx_vcpu_create (struct kvm_vcpu *vcpu);int vmx_vcpu_pre_run (struct kvm_vcpu *vcpu); -fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,bool force_immediate_exit); +fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,u64 run_flags);void vmx_vcpu_free (struct kvm_vcpu *vcpu);void vmx_vcpu_reset (struct kvm_vcpu *vcpu,bool init_event);void vmx_vcpu_load (struct kvm_vcpu *vcpu,int cpu);
arch/x86/kvm/x86.c +8 -3
@@ -10711,6 +10711,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)dm_request_for_irq_injection (vcpu) &&kvm_cpu_accept_dm_intr (vcpu);fastpath_t exit_fastpath; +u64 run_flags;bool req_immediate_exit = false;
@@ -10955,8 +10956,11 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) goto cancel_injection; } -if (req_immediate_exit) + run_flags =0 ; +if (req_immediate_exit) { + run_flags |=KVM_RUN_FORCE_IMMEDIATE_EXIT ;kvm_make_request (KVM_REQ_EVENT , vcpu); + }fpregs_assert_state_consistent ();if (test_thread_flag (TIF_NEED_FPU_LOAD ))
@@ -10992,8 +10996,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)WARN_ON_ONCE ((kvm_vcpu_apicv_activated (vcpu) !=kvm_vcpu_apicv_active (vcpu)) && (kvm_get_apic_mode (vcpu) !=LAPIC_MODE_DISABLED )); - exit_fastpath =kvm_x86_call (vcpu_run)(vcpu, - req_immediate_exit); + exit_fastpath =kvm_x86_call (vcpu_run)(vcpu, run_flags);if (likely (exit_fastpath !=EXIT_FASTPATH_REENTER_GUEST ))break ;
@@ -11005,6 +11008,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)break ; } + run_flags =0 ; +/* Note, VM-Exits that go down the "slow" path are accounted below. */ ++vcpu->stat.exits; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 46/444 KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 80c64c7afea1da6a93ebe88d3d29d8a60377ef80 ]
Instruct vendor code to load the guest's DR6 into hardware via a new KVM_RUN flag, and remove kvm_x86_ops.set_dr6(), whose sole purpose was to load vcpu->arch.dr6 into hardware when DR6 can be read/written directly by the guest.
Note, TDX already WARNs on any run_flag being set, i.e. will yell if KVM thinks DR6 needs to be reloaded. TDX vCPUs force KVM_DEBUGREG_AUTO_SWITCH and never clear the flag, i.e. should never observe KVM_RUN_LOAD_GUEST_DR6.
--- arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/svm/svm.c | 10 ++++++---- arch/x86/kvm/vmx/main.c | 1 - arch/x86/kvm/vmx/vmx.c | 9 +++------ arch/x86/kvm/x86.c | 2 +- 6 files changed, 11 insertions(+), 14 deletions(-)
arch/x86/include/asm/kvm-x86-ops.h +0 -1
@@ -47,7 +47,6 @@ KVM_X86_OP(set_idt) KVM_X86_OP(get_gdt) KVM_X86_OP(set_gdt) KVM_X86_OP(sync_dirty_debug_regs) -KVM_X86_OP(set_dr6) KVM_X86_OP(set_dr7) KVM_X86_OP(cache_reg) KVM_X86_OP(get_rflags)
arch/x86/include/asm/kvm_host.h +1 -1
@@ -1629,6 +1629,7 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical)enum kvm_x86_run_flags {KVM_RUN_FORCE_IMMEDIATE_EXIT =BIT (0 ), +KVM_RUN_LOAD_GUEST_DR6 =BIT (1 ), };struct kvm_x86_ops {
@@ -1679,7 +1680,6 @@ struct kvm_x86_ops {void (*get_gdt)(struct kvm_vcpu *vcpu,struct desc_ptr *dt);void (*set_gdt)(struct kvm_vcpu *vcpu,struct desc_ptr *dt);void (*sync_dirty_debug_regs)(struct kvm_vcpu *vcpu); -void (*set_dr6)(struct kvm_vcpu *vcpu,unsigned long value);void (*set_dr7)(struct kvm_vcpu *vcpu,unsigned long value);void (*cache_reg)(struct kvm_vcpu *vcpu,enum kvm_reg reg);unsigned long (*get_rflags)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +6 -4
@@ -4270,10 +4270,13 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)svm_hv_update_vp_id (svm->vmcb, vcpu);/* -* Run with all-zero DR6 unless needed, so that we can get the exact cause -* of a #DB. +* Run with all-zero DR6 unless the guest can write DR6 freely, so that +* KVM can get the exact cause of a #DB. Note, loading guest DR6 from +* KVM's snapshot is only necessary when DR accesses won't exit. */ -if (likely (!(vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT ))) +if (unlikely (run_flags &KVM_RUN_LOAD_GUEST_DR6 )) +svm_set_dr6 (vcpu, vcpu->arch.dr6); +else if (likely (!(vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT )))svm_set_dr6 (vcpu,DR6_ACTIVE_LOW );clgi ();
@@ -5084,7 +5087,6 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { .set_idt = svm_set_idt, .get_gdt = svm_get_gdt, .set_gdt = svm_set_gdt, - .set_dr6 = svm_set_dr6, .set_dr7 = svm_set_dr7, .sync_dirty_debug_regs = svm_sync_dirty_debug_regs, .cache_reg = svm_cache_reg,
arch/x86/kvm/vmx/main.c +0 -1
@@ -60,7 +60,6 @@ struct kvm_x86_ops vt_x86_ops __initdata = { .set_idt = vmx_set_idt, .get_gdt = vmx_get_gdt, .set_gdt = vmx_set_gdt, - .set_dr6 = vmx_set_dr6, .set_dr7 = vmx_set_dr7, .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs, .cache_reg = vmx_cache_reg,
arch/x86/kvm/vmx/vmx.c +3 -6
@@ -5630,12 +5630,6 @@ void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)set_debugreg (DR6_RESERVED ,6 ); } -void vmx_set_dr6 (struct kvm_vcpu *vcpu,unsigned long val) -{ -lockdep_assert_irqs_disabled (); -set_debugreg (vcpu->arch.dr6,6 ); -} -void vmx_set_dr7 (struct kvm_vcpu *vcpu,unsigned long val) {vmcs_writel (GUEST_DR7 , val);
@@ -7400,6 +7394,9 @@ fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)vmcs_writel (GUEST_RIP , vcpu->arch.regs[VCPU_REGS_RIP ]); vcpu->arch.regs_dirty =0 ; +if (run_flags &KVM_RUN_LOAD_GUEST_DR6 ) +set_debugreg (vcpu->arch.dr6,6 ); +/* * Refresh vmcs.HOST_CR3 if necessary. This must be done immediately * prior to VM-Enter, as the kernel may load a new ASID (PCID) any time
arch/x86/kvm/x86.c +1 -1
@@ -10977,7 +10977,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)set_debugreg (vcpu->arch.eff_db[3 ],3 );/* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ if (unlikely (vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT )) -kvm_x86_call (set_dr6)(vcpu, vcpu->arch.dr6); + run_flags |=KVM_RUN_LOAD_GUEST_DR6 ; }else if (unlikely (hw_breakpoint_active ())) {set_debugreg (DR7_FIXED_1 ,7 ); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 47/444 KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 17ec2f965344ee3fd6620bef7ef68792f4ac3af0 ]
Let the guest set DEBUGCTL.RTM_DEBUG if RTM is supported according to the guest CPUID model, as debug support is supposed to be available if RTM is supported, and there are no known downsides to letting the guest debug RTM aborts.
Note, there are no known bug reports related to RTM_DEBUG, the primary motivation is to reduce the probability of breaking existing guests when a future change adds a missing consistency check on vmcs12.GUEST_DEBUGCTL (KVM currently lets L2 run with whatever hardware supports; whoops).
Note #2, KVM already emulates DR6.RTM, and doesn't restrict access to DR7.RTM.
--- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kvm/vmx/vmx.c | 4 ++++ 2 files changed, 5 insertions(+)
arch/x86/include/asm/msr-index.h +1 -0
@@ -417,6 +417,7 @@#define DEBUGCTLMSR_FREEZE_PERFMON_ON_PMI (1UL << 12)#define DEBUGCTLMSR_FREEZE_IN_SMM_BIT 14#define DEBUGCTLMSR_FREEZE_IN_SMM (1UL << DEBUGCTLMSR_FREEZE_IN_SMM_BIT) +#define DEBUGCTLMSR_RTM_DEBUG BIT(15)#define MSR_PEBS_FRONTEND 0x000003f7
arch/x86/kvm/vmx/vmx.c +4 -0
@@ -2185,6 +2185,10 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated (host_initiated || intel_pmu_lbr_is_enabled(vcpu))) debugctl |=DEBUGCTLMSR_LBR |DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ; +if (boot_cpu_has (X86_FEATURE_RTM ) && + (host_initiated ||guest_cpuid_has (vcpu,X86_FEATURE_RTM ))) + debugctl |=DEBUGCTLMSR_RTM_DEBUG ; +return debugctl; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 48/444 KVM: VMX: Extract checking of guests DEBUGCTL into helper
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 8a4351ac302cd8c19729ba2636acfd0467c22ae8 ]
Move VMX's logic to check DEBUGCTL values into a standalone helper so that the code can be used by nested VM-Enter to apply the same logic to the value being loaded from vmcs12.
KVM needs to explicitly check vmcs12->guest_ia32_debugctl on nested VM-Enter, as hardware may support features that KVM does not, i.e. relying on hardware to detect invalid guest state will result in false negatives. Unfortunately, that means applying KVM's funky suppression of BTF and LBR to vmcs12 so as not to break existing guests.
No functional change intended.
Stable-dep-of: 7d0cce6cbe71 ("KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs")
--- arch/x86/kvm/vmx/vmx.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-)
arch/x86/kvm/vmx/vmx.c +17 -12
@@ -2192,6 +2192,19 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiatedreturn debugctl; } +static bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data, +bool host_initiated) +{ +u64 invalid; + + invalid = data & ~vmx_get_supported_debugctl (vcpu, host_initiated); +if (invalid & (DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR )) { +kvm_pr_unimpl_wrmsr (vcpu,MSR_IA32_DEBUGCTLMSR , data); + invalid &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); + } +return !invalid; +} +/* * Writes msr value into the appropriate "register". * Returns 0 on success, non-0 otherwise.
@@ -2260,19 +2273,12 @@ int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) }vmcs_writel (GUEST_SYSENTER_ESP , data);break ; -case MSR_IA32_DEBUGCTLMSR : { -u64 invalid; - - invalid = data & ~vmx_get_supported_debugctl (vcpu, msr_info->host_initiated); -if (invalid & (DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR )) { -kvm_pr_unimpl_wrmsr (vcpu, msr_index, data); - data &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); - invalid &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); - } - -if (invalid) +case MSR_IA32_DEBUGCTLMSR : +if (!vmx_is_valid_debugctl (vcpu, data, msr_info->host_initiated))return 1 ; + data &=vmx_get_supported_debugctl (vcpu, msr_info->host_initiated); +if (is_guest_mode (vcpu) &&get_vmcs12 (vcpu)->vm_exit_controls &VM_EXIT_SAVE_DEBUG_CONTROLS )get_vmcs12 (vcpu)->guest_ia32_debugctl = data;
@@ -2282,7 +2288,6 @@ int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) (data & DEBUGCTLMSR_LBR))intel_pmu_create_guest_lbr_event (vcpu);return 0 ; - }case MSR_IA32_BNDCFGS : if (!kvm_mpx_supported() || (!msr_info->host_initiated &&
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 49/444 KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
[ Upstream commit 095686e6fcb4150f0a55b1a25987fad3d8af58d6 ]
Add a consistency check for L2's guest_ia32_debugctl, as KVM only supports a subset of hardware functionality, i.e. KVM can't rely on hardware to detect illegal/unsupported values. Failure to check the vmcs12 value would allow the guest to load any harware-supported value while running L2.
Take care to exempt BTF and LBR from the validity check in order to match KVM's behavior for writes via WRMSR, but without clobbering vmcs12. Even if VM_EXIT_SAVE_DEBUG_CONTROLS is set in vmcs12, L1 can reasonably expect that vmcs12->guest_ia32_debugctl will not be modified if writes to the MSR are being intercepted.
Arguably, KVM _should_ update vmcs12 if VM_EXIT_SAVE_DEBUG_CONTROLS is set *and* writes to MSR_IA32_DEBUGCTLMSR are not being intercepted by L1, but that would incur non-trivial complexity and wouldn't change the fact that KVM's handling of DEBUGCTL is blatantly broken. I.e. the extra complexity is not worth carrying.
Stable-dep-of: 7d0cce6cbe71 ("KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs")
--- arch/x86/kvm/vmx/nested.c | 12 ++++++++++-- arch/x86/kvm/vmx/vmx.c | 5 ++--- arch/x86/kvm/vmx/vmx.h | 3 +++ 3 files changed, 15 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx/nested.c +10 -2
@@ -2653,7 +2653,8 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,if (vmx->nested.nested_run_pending && (vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS )) {kvm_set_dr (vcpu,7 , vmcs12->guest_dr7); -vmcs_write64 (GUEST_IA32_DEBUGCTL , vmcs12->guest_ia32_debugctl); +vmcs_write64 (GUEST_IA32_DEBUGCTL , vmcs12->guest_ia32_debugctl & +vmx_get_supported_debugctl (vcpu, false)); }else {kvm_set_dr (vcpu,7 , vcpu->arch.dr7);vmcs_write64 (GUEST_IA32_DEBUGCTL , vmx->nested.pre_vmenter_debugctl);
@@ -3135,7 +3136,8 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,return -EINVAL ;if ((vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS ) && -CC (!kvm_dr7_valid (vmcs12->guest_dr7))) + (CC (!kvm_dr7_valid (vmcs12->guest_dr7)) || +CC (!vmx_is_valid_debugctl (vcpu, vmcs12->guest_ia32_debugctl, false))))return -EINVAL ; if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&
@@ -4576,6 +4578,12 @@ static void sync_vmcs02_to_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) (vmcs12->vm_entry_controls & ~VM_ENTRY_IA32E_MODE ) | (vm_entry_controls_get (to_vmx (vcpu)) &VM_ENTRY_IA32E_MODE ); +/* +* Note! Save DR7, but intentionally don't grab DEBUGCTL from vmcs02. +* Writes to DEBUGCTL that aren't intercepted by L1 are immediately +* propagated to vmcs12 (see vmx_set_msr()), as the value loaded into +* vmcs02 doesn't strictly track vmcs12. +*/ if (vmcs12->vm_exit_controls &VM_EXIT_SAVE_DEBUG_CONTROLS ) vmcs12->guest_dr7 = vcpu->arch.dr7;
arch/x86/kvm/vmx/vmx.c +2 -3
@@ -2173,7 +2173,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu,return (unsigned long )data; } -static u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated) +u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated) {u64 debugctl =0 ;
@@ -2192,8 +2192,7 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiatedreturn debugctl; } -static bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data, -bool host_initiated) +bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data,bool host_initiated) {u64 invalid;
arch/x86/kvm/vmx/vmx.h +3 -0
@@ -435,6 +435,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,void vmx_update_cpu_dirty_logging (struct kvm_vcpu *vcpu); +u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated); +bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data,bool host_initiated); +/* * Note, early Intel manuals have the write-low and read-high bitmap offsets * the wrong way round. The bitmaps control MSRs 0x00000000-0x00001fff and
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 50/444 KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
[ Upstream commit 7d0cce6cbe71af6e9c1831bff101a2b9c249c4a2 ]
Introduce vmx_guest_debugctl_{read,write}() to handle all accesses to vmcs.GUEST_IA32_DEBUGCTL. This will allow stuffing FREEZE_IN_SMM into GUEST_IA32_DEBUGCTL based on the host setting without bleeding the state into the guest, and without needing to copy+paste the FREEZE_IN_SMM logic into every patch that accesses GUEST_IA32_DEBUGCTL.
No functional change intended.
--- arch/x86/kvm/vmx/nested.c | 10 +++++----- arch/x86/kvm/vmx/pmu_intel.c | 8 ++++---- arch/x86/kvm/vmx/vmx.c | 8 +++++--- arch/x86/kvm/vmx/vmx.h | 10 ++++++++++ 4 files changed, 24 insertions(+), 12 deletions(-)
arch/x86/kvm/vmx/nested.c +5 -5
@@ -2653,11 +2653,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,if (vmx->nested.nested_run_pending && (vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS )) {kvm_set_dr (vcpu,7 , vmcs12->guest_dr7); -vmcs_write64 (GUEST_IA32_DEBUGCTL , vmcs12->guest_ia32_debugctl & -vmx_get_supported_debugctl (vcpu, false)); +vmx_guest_debugctl_write (vcpu, vmcs12->guest_ia32_debugctl & +vmx_get_supported_debugctl (vcpu, false)); }else {kvm_set_dr (vcpu,7 , vcpu->arch.dr7); -vmcs_write64 (GUEST_IA32_DEBUGCTL , vmx->nested.pre_vmenter_debugctl); +vmx_guest_debugctl_write (vcpu, vmx->nested.pre_vmenter_debugctl); }if (kvm_mpx_supported () && (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls &VM_ENTRY_LOAD_BNDCFGS )))
@@ -3527,7 +3527,7 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu,if (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS )) - vmx->nested.pre_vmenter_debugctl =vmcs_read64 (GUEST_IA32_DEBUGCTL ); + vmx->nested.pre_vmenter_debugctl =vmx_guest_debugctl_read ();if (kvm_mpx_supported () && (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls &VM_ENTRY_LOAD_BNDCFGS )))
@@ -4774,7 +4774,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,__vmx_set_segment (vcpu, &seg,VCPU_SREG_LDTR );kvm_set_dr (vcpu,7 ,0x400 ); -vmcs_write64 (GUEST_IA32_DEBUGCTL ,0 ); +vmx_guest_debugctl_write (vcpu,0 );if (nested_vmx_load_msr (vcpu, vmcs12->vm_exit_msr_load_addr, vmcs12->vm_exit_msr_load_count))
arch/x86/kvm/vmx/pmu_intel.c +4 -4
@@ -605,11 +605,11 @@ static void intel_pmu_reset(struct kvm_vcpu *vcpu)*/ static void intel_pmu_legacy_freezing_lbrs_on_pmi (struct kvm_vcpu *vcpu) { -u64 data =vmcs_read64 (GUEST_IA32_DEBUGCTL ); +u64 data =vmx_guest_debugctl_read ();if (data &DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ) { data &= ~DEBUGCTLMSR_LBR ; -vmcs_write64 (GUEST_IA32_DEBUGCTL , data); +vmx_guest_debugctl_write (vcpu, data); } }
@@ -679,7 +679,7 @@ void vmx_passthrough_lbr_msrs(struct kvm_vcpu *vcpu)if (!lbr_desc->event) {vmx_disable_lbr_msrs_passthrough (vcpu); -if (vmcs_read64 (GUEST_IA32_DEBUGCTL ) &DEBUGCTLMSR_LBR ) +if (vmx_guest_debugctl_read () &DEBUGCTLMSR_LBR ) goto warn;if (test_bit (INTEL_PMC_IDX_FIXED_VLBR , pmu->pmc_in_use)) goto warn;
@@ -701,7 +701,7 @@ void vmx_passthrough_lbr_msrs(struct kvm_vcpu *vcpu)static void intel_pmu_cleanup (struct kvm_vcpu *vcpu) { -if (!(vmcs_read64 (GUEST_IA32_DEBUGCTL ) &DEBUGCTLMSR_LBR )) +if (!(vmx_guest_debugctl_read () &DEBUGCTLMSR_LBR ))intel_pmu_release_guest_lbr_event (vcpu); }
arch/x86/kvm/vmx/vmx.c +5 -3
@@ -2148,7 +2148,7 @@ int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) msr_info->data = vmx->pt_desc.guest.addr_a[index /2 ];break ;case MSR_IA32_DEBUGCTLMSR : - msr_info->data =vmcs_read64 (GUEST_IA32_DEBUGCTL ); + msr_info->data =vmx_guest_debugctl_read ();break ;default : find_uret_msr:
@@ -2282,7 +2282,8 @@ int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) VM_EXIT_SAVE_DEBUG_CONTROLS) get_vmcs12(vcpu)->guest_ia32_debugctl = data; - vmcs_write64(GUEST_IA32_DEBUGCTL, data); + vmx_guest_debugctl_write(vcpu, data); + if (intel_pmu_lbr_is_enabled(vcpu) && !to_vmx(vcpu)->lbr_desc.event && (data & DEBUGCTLMSR_LBR)) intel_pmu_create_guest_lbr_event(vcpu);
@@ -4831,7 +4832,8 @@ static void init_vmcs(struct vcpu_vmx *vmx)vmcs_write32 (GUEST_SYSENTER_CS ,0 );vmcs_writel (GUEST_SYSENTER_ESP ,0 );vmcs_writel (GUEST_SYSENTER_EIP ,0 ); -vmcs_write64 (GUEST_IA32_DEBUGCTL ,0 ); + +vmx_guest_debugctl_write (&vmx->vcpu,0 );if (cpu_has_vmx_tpr_shadow ()) {vmcs_write64 (VIRTUAL_APIC_PAGE_ADDR ,0 );
arch/x86/kvm/vmx/vmx.h +10 -0
@@ -438,6 +438,16 @@ void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated);bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data,bool host_initiated); +static inline void vmx_guest_debugctl_write (struct kvm_vcpu *vcpu,u64 val) +{ +vmcs_write64 (GUEST_IA32_DEBUGCTL , val); +} + +static inline u64 vmx_guest_debugctl_read (void ) +{ +return vmcs_read64 (GUEST_IA32_DEBUGCTL ); +} +/* * Note, early Intel manuals have the write-low and read-high bitmap offsets * the wrong way round. The bitmaps control MSRs 0x00000000-0x00001fff and
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 51/444 KVM: VMX: Preserve hosts DEBUGCTLMSR_FREEZE_IN_SMM while running the guest
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
[ Upstream commit 6b1dd26544d045f6a79e8c73572c0c0db3ef3c1a ]
Set/clear DEBUGCTLMSR_FREEZE_IN_SMM in GUEST_IA32_DEBUGCTL based on the host's pre-VM-Enter value, i.e. preserve the host's FREEZE_IN_SMM setting while running the guest. When running with the "default treatment of SMIs" in effect (the only mode KVM supports), SMIs do not generate a VM-Exit that is visible to host (non-SMM) software, and instead transitions directly from VMX non-root to SMM. And critically, DEBUGCTL isn't context switched by hardware on SMI or RSM, i.e. SMM will run with whatever value was resident in hardware at the time of the SMI.
Failure to preserve FREEZE_IN_SMM results in the PMU unexpectedly counting events while the CPU is executing in SMM, which can pollute profiling and potentially leak information into the guest.
Check for changes in FREEZE_IN_SMM prior to every entry into KVM's inner run loop, as the bit can be toggled in IRQ context via IPI callback (SMP function call), by way of /sys/devices/cpu/freeze_on_smi.
Add a field in kvm_x86_ops to communicate which DEBUGCTL bits need to be preserved, as FREEZE_IN_SMM is only supported and defined for Intel CPUs, i.e. explicitly checking FREEZE_IN_SMM in common x86 is at best weird, and at worst could lead to undesirable behavior in the future if AMD CPUs ever happened to pick up a collision with the bit.
Exempt TDX vCPUs, i.e. protected guests, from the check, as the TDX Module owns and controls GUEST_IA32_DEBUGCTL.
WARN in SVM if KVM_RUN_LOAD_DEBUGCTL is set, mostly to document that the lack of handling isn't a KVM bug (TDX already WARNs on any run_flag).
Lastly, explicitly reload GUEST_IA32_DEBUGCTL on a VM-Fail that is missed by KVM but detected by hardware, i.e. in nested_vmx_restore_host_state(). Doing so avoids the need to track host_debugctl on a per-VMCS basis, as GUEST_IA32_DEBUGCTL is unconditionally written by prepare_vmcs02() and load_vmcs12_host_state(). For the VM-Fail case, even though KVM won't have actually entered the guest, vcpu_enter_guest() will have run with vmcs02 active and thus could result in vmcs01 being run with a stale value.
--- arch/x86/include/asm/kvm_host.h | 7 +++++++ arch/x86/kvm/vmx/main.c | 2 ++ arch/x86/kvm/vmx/nested.c | 3 +++ arch/x86/kvm/vmx/vmx.c | 3 +++ arch/x86/kvm/vmx/vmx.h | 15 ++++++++++++++- arch/x86/kvm/x86.c | 14 ++++++++++++-- 6 files changed, 41 insertions(+), 3 deletions(-)
arch/x86/include/asm/kvm_host.h +7 -0
@@ -1630,6 +1630,7 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical)enum kvm_x86_run_flags {KVM_RUN_FORCE_IMMEDIATE_EXIT =BIT (0 ),KVM_RUN_LOAD_GUEST_DR6 =BIT (1 ), +KVM_RUN_LOAD_DEBUGCTL =BIT (2 ), };struct kvm_x86_ops {
@@ -1659,6 +1660,12 @@ struct kvm_x86_ops {void (*vcpu_load)(struct kvm_vcpu *vcpu,int cpu);void (*vcpu_put)(struct kvm_vcpu *vcpu); +/* +* Mask of DEBUGCTL bits that are owned by the host, i.e. that need to +* match the host's value even while the guest is active. +*/ +const u64 HOST_OWNED_DEBUGCTL ; +void (*update_exception_bitmap)(struct kvm_vcpu *vcpu);int (*get_msr)(struct kvm_vcpu *vcpu,struct msr_data *msr);int (*set_msr)(struct kvm_vcpu *vcpu,struct msr_data *msr);
arch/x86/kvm/vmx/main.c +2 -0
@@ -42,6 +42,8 @@ struct kvm_x86_ops vt_x86_ops __initdata = { .vcpu_load = vmx_vcpu_load, .vcpu_put = vmx_vcpu_put, + .HOST_OWNED_DEBUGCTL = DEBUGCTLMSR_FREEZE_IN_SMM, + .update_exception_bitmap = vmx_update_exception_bitmap, .get_feature_msr = vmx_get_feature_msr, .get_msr = vmx_get_msr,
arch/x86/kvm/vmx/nested.c +3 -0
@@ -4829,6 +4829,9 @@ static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu)WARN_ON (kvm_set_dr (vcpu,7 ,vmcs_readl (GUEST_DR7 ))); } +/* Reload DEBUGCTL to ensure vmcs01 has a fresh FREEZE_IN_SMM value. */ +vmx_reload_guest_debugctl (vcpu); +/* * Note that calling vmx_set_{efer,cr0,cr4} is important as they * handle a variety of side effects to KVM's software model.
arch/x86/kvm/vmx/vmx.c +3 -0
@@ -7407,6 +7407,9 @@ fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)if (run_flags &KVM_RUN_LOAD_GUEST_DR6 )set_debugreg (vcpu->arch.dr6,6 ); +if (run_flags &KVM_RUN_LOAD_DEBUGCTL ) +vmx_reload_guest_debugctl (vcpu); +/* * Refresh vmcs.HOST_CR3 if necessary. This must be done immediately * prior to VM-Enter, as the kernel may load a new ASID (PCID) any time
arch/x86/kvm/vmx/vmx.h +14 -1
@@ -440,12 +440,25 @@ bool vmx_is_valid_debugctl(struct kvm_vcpu *vcpu, u64 data, bool host_initiated)static inline void vmx_guest_debugctl_write (struct kvm_vcpu *vcpu,u64 val) { +WARN_ON_ONCE (val &DEBUGCTLMSR_FREEZE_IN_SMM ); + + val |= vcpu->arch.host_debugctl &DEBUGCTLMSR_FREEZE_IN_SMM ;vmcs_write64 (GUEST_IA32_DEBUGCTL , val); }static inline u64 vmx_guest_debugctl_read (void ) { -return vmcs_read64 (GUEST_IA32_DEBUGCTL ); +return vmcs_read64 (GUEST_IA32_DEBUGCTL ) & ~DEBUGCTLMSR_FREEZE_IN_SMM ; +} + +static inline void vmx_reload_guest_debugctl (struct kvm_vcpu *vcpu) +{ +u64 val =vmcs_read64 (GUEST_IA32_DEBUGCTL ); + +if (!((val ^ vcpu->arch.host_debugctl) &DEBUGCTLMSR_FREEZE_IN_SMM )) +return ; + +vmx_guest_debugctl_write (vcpu, val & ~DEBUGCTLMSR_FREEZE_IN_SMM ); }/*
arch/x86/kvm/x86.c +12 -2
@@ -10711,7 +10711,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)dm_request_for_irq_injection (vcpu) &&kvm_cpu_accept_dm_intr (vcpu);fastpath_t exit_fastpath; -u64 run_flags; +u64 run_flags, debug_ctl;bool req_immediate_exit = false;
@@ -10982,7 +10982,17 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)set_debugreg (DR7_FIXED_1 ,7 ); } - vcpu->arch.host_debugctl =get_debugctlmsr (); +/* +* Refresh the host DEBUGCTL snapshot after disabling IRQs, as DEBUGCTL +* can be modified in IRQ context, e.g. via SMP function calls. Inform +* vendor code if any host-owned bits were changed, e.g. so that the +* value loaded into hardware while running the guest can be updated. +*/ + debug_ctl =get_debugctlmsr (); +if ((debug_ctl ^ vcpu->arch.host_debugctl) & kvm_x86_ops.HOST_OWNED_DEBUGCTL && + !vcpu->arch.guest_state_protected) + run_flags |=KVM_RUN_LOAD_DEBUGCTL ; + vcpu->arch.host_debugctl = debug_ctl;guest_timing_enter_irqoff ();
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 52/444 habanalabs: fix UAF in export_dmabuf()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 33927f3d0ecdcff06326d6e4edb6166aed42811c ]
As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF.
dma_buf_fd() is a combination of reserving a descriptor and fd_install(). habanalabs export_dmabuf() calls it and then proceeds to access the objects destroyed on close. In particular, it grabs an extra reference to another struct file that will be dropped as part of ->release() for ours; that "will be" is actually "might have already been".
Fix that by reserving descriptor before anything else and do fd_install() only when everything had been set up. As a side benefit, we no longer have the failure exit with file already created, but reference to underlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet; unlike dma_buf_fd(), fd_install() can't fail.
--- drivers/accel/habanalabs/common/memory.c | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-)
drivers/accel/habanalabs/common/memory.c +7 -16
@@ -1829,9 +1829,6 @@ static void hl_release_dmabuf(struct dma_buf *dmabuf)struct hl_dmabuf_priv *hl_dmabuf = dmabuf->priv;struct hl_ctx *ctx; -if (!hl_dmabuf) -return ; - ctx = hl_dmabuf->ctx;if (hl_dmabuf->memhash_hnode)
@@ -1859,7 +1856,12 @@ static int export_dmabuf(struct hl_ctx *ctx, {DEFINE_DMA_BUF_EXPORT_INFO (exp_info);struct hl_device *hdev = ctx->hdev; -int rc, fd; +CLASS (get_unused_fd, fd)(flags); + +if (fd <0 ) { +dev_err (hdev->dev,"failed to get a file descriptor for a dma-buf, %d\n" , fd); +return fd; + } exp_info.ops = &habanalabs_dmabuf_ops; exp_info.size = total_size;
@@ -1872,13 +1874,6 @@ static int export_dmabuf(struct hl_ctx *ctx,return PTR_ERR (hl_dmabuf->dmabuf); } - fd =dma_buf_fd (hl_dmabuf->dmabuf, flags); -if (fd <0 ) { -dev_err (hdev->dev,"failed to get a file descriptor for a dma-buf, %d\n" , fd); - rc = fd; - goto err_dma_buf_put; - } - hl_dmabuf->ctx = ctx;hl_ctx_get (hl_dmabuf->ctx);atomic_inc (&ctx->hdev->dmabuf_export_cnt);
@@ -1890,13 +1885,9 @@ static int export_dmabuf(struct hl_ctx *ctx,get_file (ctx->hpriv->file_priv->filp); *dmabuf_fd = fd; +fd_install (take_fd (fd), hl_dmabuf->dmabuf->file);return 0 ; - -err_dma_buf_put: - hl_dmabuf->dmabuf->priv =NULL ; -dma_buf_put (hl_dmabuf->dmabuf); -return rc; }static int validate_export_params_common (struct hl_device *hdev,u64 addr,u64 size,u64 offset)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 53/444 mm/smaps: fix race between smaps_hugetlb_range and migration
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjiang Tu <[email protected]>
[ Upstream commit 45d19b4b6c2d422771c29b83462d84afcbb33f01 ]
smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page(). The race is as follows.
smaps_hugetlb_range migrate_pages
huge_ptep_get
remove_migration_ptes folio_unlock
pfn_swap_entry_folio
BUG_ON
To fix it, hold ptl lock in smaps_hugetlb_range().
--- fs/proc/task_mmu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/proc/task_mmu.c +5 -1
@@ -1007,10 +1007,13 @@ static int smaps_hugetlb_range(pte_t *pte, unsigned long hmask, {struct mem_size_stats *mss = walk->private;struct vm_area_struct *vma = walk->vma; -pte_t ptent =huge_ptep_get (walk->mm, addr, pte);struct folio *folio =NULL ;bool present = false; +spinlock_t *ptl; +pte_t ptent; + ptl =huge_pte_lock (hstate_vma (vma), walk->mm, pte); + ptent =huge_ptep_get (walk->mm, addr, pte);if (pte_present (ptent)) { folio =page_folio (pte_page (ptent)); present = true;
@@ -1029,6 +1032,7 @@ static int smaps_hugetlb_range(pte_t *pte, unsigned long hmask, else mss->private_hugetlb += huge_page_size(hstate_vma(vma)); } +spin_unlock (ptl);return 0 ; }#else
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 54/444 udp: also consider secpath when evaluating ipsec use for checksumming
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 1118aaa3b35157777890fffab91d8c1da841b20b ]
Commit b40c5f4fde22 ("udp: disable inner UDP checksum offloads in IPsec case") tried to fix checksumming in UFO when the packets are going through IPsec, so that we can't rely on offloads because the UDP header and payload will be encrypted.
But when doing a TCP test over VXLAN going through IPsec transport mode with GSO enabled (esp4_offload module loaded), I'm seeing broken UDP checksums on the encap after successful decryption.
The skbs get to udp4_ufo_fragment/__skb_udp_tunnel_segment via __dev_queue_xmit -> validate_xmit_skb -> skb_gso_segment and at this point we've already dropped the dst (unless the device sets IFF_XMIT_DST_RELEASE, which is not common), so need_ipsec is false and we proceed with checksum offload.
Make need_ipsec also check the secpath, which is not dropped on this callpath.
--- net/ipv4/udp_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/udp_offload.c +1 -1
@@ -61,7 +61,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb, remcsum = !!(skb_shinfo (skb)->gso_type &SKB_GSO_TUNNEL_REMCSUM ); skb->remcsum_offload = remcsum; - need_ipsec =skb_dst (skb) &&dst_xfrm (skb_dst (skb)); + need_ipsec = (skb_dst (skb) &&dst_xfrm (skb_dst (skb))) ||skb_sec_path (skb);/* Try to offload checksum if possible */ offload_csum = !!(need_csum && !need_ipsec &&
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 55/444 netfilter: ctnetlink: fix refcount leak on table dump
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit de788b2e6227462b6dcd0e07474e72c089008f74 ]
There is a reference count leak in ctnetlink_dump_table():
if (res < 0) {
nf_conntrack_get(&ct->ct_general); // HERE
cb->args[1] = (unsigned long)ct;
...While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone.
This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0.
This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever.
This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list.
One fix would to change this to:
if (res < 0) {
if (ct != last)
nf_conntrack_get(&ct->ct_general);But this reference counting isn't needed in the first place. We can just store a cookie value instead.
A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.
--- net/netfilter/nf_conntrack_netlink.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
net/netfilter/nf_conntrack_netlink.c +13 -11
@@ -860,8 +860,6 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item)static int ctnetlink_done (struct netlink_callback *cb) { -if (cb->args[1 ]) -nf_ct_put ((struct nf_conn *)cb->args[1 ]);kfree (cb->data);return 0 ; }
@@ -1184,19 +1182,26 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data)return 0 ; } +static unsigned long ctnetlink_get_id (const struct nf_conn *ct) +{ +unsigned long id =nf_ct_get_id (ct); + +return id ? id :1 ; +} +static int ctnetlink_dump_table (struct sk_buff *skb,struct netlink_callback *cb) {unsigned int flags = cb->data ?NLM_F_DUMP_FILTERED :0 ;struct net *net =sock_net (skb->sk); -struct nf_conn *ct, *last; +unsigned long last_id = cb->args[1 ];struct nf_conntrack_tuple_hash *h;struct hlist_nulls_node *n;struct nf_conn *nf_ct_evict[8 ]; +struct nf_conn *ct;int res, i;spinlock_t *lockp; - last = (struct nf_conn *)cb->args[1 ]; i =0 ;local_bh_disable ();
@@ -1233,7 +1238,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)continue ;if (cb->args[1 ]) { -if (ct != last) +if (ctnetlink_get_id (ct) != last_id)continue ; cb->args[1 ] =0 ; }
@@ -1246,8 +1251,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)NFNL_MSG_TYPE (cb->nlh->nlmsg_type), ct, true, flags);if (res <0 ) { -nf_conntrack_get (&ct->ct_general); - cb->args[1 ] = (unsigned long )ct; + cb->args[1 ] =ctnetlink_get_id (ct);spin_unlock (lockp); goto out; }
@@ -1260,12 +1264,10 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) } out:local_bh_enable (); -if (last) { +if (last_id) {/* nf ct hash resize happened, now clear the leftover. */ -if ((struct nf_conn *)cb->args[1 ] == last) +if (cb->args[1 ] == last_id) cb->args[1 ] =0 ; - -nf_ct_put (last); }while (i) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 56/444 net: ti: icssg-prueth: Fix emac link speed handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: MD Danish Anwar <[email protected]>
[ Upstream commit 06feac15406f4f66f4c0c6ea60b10d44775d4133 ]
When link settings are changed emac->speed is populated by emac_adjust_link(). The link speed and other settings are then written into the DRAM. However if both ports are brought down after this and brought up again or if the operating mode is changed and a firmware reload is needed, the DRAM is cleared by icssg_config(). As a result the link settings are lost.
Fix this by calling emac_adjust_link() after icssg_config(). This re populates the settings in the DRAM after a new firmware load.
Message-ID: <[email protected]>
--- drivers/net/ethernet/ti/icssg/icssg_prueth.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/ti/icssg/icssg_prueth.c +6 -0
@@ -50,6 +50,8 @@/* CTRLMMR_ICSSG_RGMII_CTRL register bits */ #define ICSSG_CTRL_RGMII_ID_MODE BIT(24) +static void emac_adjust_link (struct net_device *ndev); +static int emac_get_tx_ts (struct prueth_emac *emac,struct emac_tx_ts_response *rsp) {
@@ -266,6 +268,10 @@ static int prueth_emac_common_start(struct prueth *prueth) ret =icssg_config (prueth, emac, slice);if (ret) goto disable_class; + +mutex_lock (&emac->ndev->phydev->lock); +emac_adjust_link (emac->ndev); +mutex_unlock (&emac->ndev->phydev->lock); } ret =prueth_emac_start (prueth);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 57/444 net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 5f1d1d14db7dabce9c815e7d7cd351f8d58b8585 ]
The variable ret in icss_iep_extts_enable() was incorrectly declared as u32, while the function returns int and may return negative error codes. This will cause sign extension issues and incorrect error propagation. Update ret to be int to fix error handling.
This change corrects the declaration to avoid potential type mismatch.
--- drivers/net/ethernet/ti/icssg/icss_iep.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/ti/icssg/icss_iep.c +2 -1
@@ -621,7 +621,8 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on)static int icss_iep_extts_enable (struct icss_iep *iep,u32 index,int on) { -u32 val, cap, ret =0 ; +u32 val, cap; +int ret =0 ;mutex_lock (&iep->ptp_clk_mutex);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 58/444 sctp: linearize cloned gso packets in sctp_rcv
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit fd60d8a086191fe33c2d719732d2482052fa6805 ]
A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs.
syzbot reported two use-of-uninitialized-memory bugs caused by this:
BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline]
and
BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline]
This patch fixes it by linearizing cloned gso packets in sctp_rcv().
--- net/sctp/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/input.c +1 -1
@@ -117,7 +117,7 @@ int sctp_rcv(struct sk_buff *skb)* it's better to just linearize it otherwise crc computing * takes longer. */ -if ((!is_gso &&skb_linearize (skb)) || +if (((!is_gso ||skb_cloned (skb)) &&skb_linearize (skb)) || !pskb_may_pull (skb,sizeof (struct sctphdr ))) goto discard_it;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 59/444 intel_idle: Allow loading ACPI tables for any family
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit e91a158b694d7f4bd937763dde79ed0afa472d8a ]
There is no reason to limit intel_idle's loading of ACPI tables to family 6. Upcoming Intel processors are not in family 6.
Below "Fixes" really means "applies cleanly until". That syntax commit didn't change the previous logic, but shows this patch applies back 5-years.
--- drivers/idle/intel_idle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/idle/intel_idle.c +1 -1
@@ -1608,7 +1608,7 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = { };static const struct x86_cpu_id intel_mwait_ids[]__initconst = { -X86_MATCH_VENDOR_FAM_FEATURE (INTEL ,6 ,X86_FEATURE_MWAIT ,NULL ), +X86_MATCH_VENDOR_FAM_FEATURE (INTEL ,X86_FAMILY_ANY ,X86_FEATURE_MWAIT ,NULL ), {} };
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 60/444 cpuidle: governors: menu: Avoid using invalid recent intervals data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit fa3fa55de0d6177fdcaf6fc254f13cc8f33c3eed ]
Marc has reported that commit 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") caused the number of wakeup interrupts to increase on an idle system [1], which was not expected to happen after merely allowing shallower idle states to be selected by the governor in some cases.
However, on the system in question, all of the idle states deeper than WFI are rejected by the driver due to a firmware issue [2]. This causes the governor to only consider the recent interval duriation data corresponding to attempts to enter WFI that are successful and the recent invervals table is filled with values lower than the scheduler tick period. Consequently, the governor predicts an idle duration below the scheduler tick period length and avoids stopping the tick more often which leads to the observed symptom.
Address it by modifying the governor to update the recent intervals table also when entering the previously selected idle state fails, so it knows that the short idle intervals might have been the minority had the selected idle states been actually entered every time.
--- drivers/cpuidle/governors/menu.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/cpuidle/governors/menu.c +17 -4
@@ -153,6 +153,14 @@ static inline int performance_multiplier(unsigned int nr_iowaiters) static DEFINE_PER_CPU(struct menu_device, menu_devices); +static void menu_update_intervals (struct menu_device *data,unsigned int interval_us) +{ +/* Update the repeating-pattern data. */ + data->intervals[data->interval_ptr++] = interval_us; +if (data->interval_ptr >=INTERVALS ) + data->interval_ptr =0 ; +} +static void menu_update (struct cpuidle_driver *drv,struct cpuidle_device *dev);/*
@@ -277,6 +285,14 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,if (data->needs_update) {menu_update (drv, dev); data->needs_update =0 ; + }else if (!dev->last_residency_ns) { +/* +* This happens when the driver rejects the previously selected +* idle state and returns an error, so update the recent +* intervals table to prevent invalid information from being +* used going forward. +*/ +menu_update_intervals (data,UINT_MAX ); } nr_iowaiters =nr_iowait_cpu (dev->cpu);
@@ -546,10 +562,7 @@ static void menu_update(struct cpuidle_driver *drv, struct cpuidle_device *dev) data->correction_factor[data->bucket] = new_factor; -/* update the repeating-pattern data */ - data->intervals[data->interval_ptr++] =ktime_to_us (measured_ns); -if (data->interval_ptr >=INTERVALS ) - data->interval_ptr =0 ; +menu_update_intervals (data,ktime_to_us (measured_ns)); }/**
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 61/444 ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit 2efe41234dbd0a83fdb7cd38226c2f70039a2cd3 ]
syzbot reported the following ABBA deadlock:
CPU0 CPU1
---- ----
n_vclocks_store()
lock(&ptp->n_vclocks_mux) [1]
(physical clock)
pc_clock_adjtime()
lock(&clk->rwsem) [2]
(physical clock)
...
ptp_clock_freerun()
ptp_vclock_in_use()
lock(&ptp->n_vclocks_mux) [3]
(physical clock)
ptp_clock_unregister()
posix_clock_unregister()
lock(&clk->rwsem) [4]
(virtual clock)Since ptp virtual clock is registered only under ptp physical clock, both ptp_clock and posix_clock must be physical clocks for ptp_vclock_in_use() to lock &ptp->n_vclocks_mux and check ptp->n_vclocks.
However, when unregistering vclocks in n_vclocks_store(), the locking ptp->n_vclocks_mux is a physical clock lock, but clk->rwsem of ptp_clock_unregister() called through device_for_each_child_reverse() is a virtual clock lock.
Therefore, clk->rwsem used in CPU0 and clk->rwsem used in CPU1 are different locks, but in lockdep, a false positive occurs because the possibility of deadlock is determined through lock-class.
To solve this, lock subclass annotation must be added to the posix_clock rwsem of the vclock.
--- drivers/ptp/ptp_private.h | 5 +++++ drivers/ptp/ptp_vclock.c | 7 +++++++ 2 files changed, 12 insertions(+)
drivers/ptp/ptp_private.h +5 -0
@@ -24,6 +24,11 @@#define PTP_DEFAULT_MAX_VCLOCKS 20#define PTP_MAX_CHANNELS 2048 +enum { +PTP_LOCK_PHYSICAL =0 , +PTP_LOCK_VIRTUAL , +}; +struct timestamp_event_queue {struct ptp_extts_event buf[PTP_MAX_TIMESTAMPS ];int head;
drivers/ptp/ptp_vclock.c +7 -0
@@ -154,6 +154,11 @@ static long ptp_vclock_refresh(struct ptp_clock_info *ptp)return PTP_VCLOCK_REFRESH_INTERVAL ; } +static void ptp_vclock_set_subclass (struct ptp_clock *ptp) +{ +lockdep_set_subclass (&ptp->clock.rwsem,PTP_LOCK_VIRTUAL ); +} +static const struct ptp_clock_info ptp_vclock_info = { .owner =THIS_MODULE , .name ="ptp virtual clock" ,
@@ -213,6 +218,8 @@ struct ptp_vclock *ptp_vclock_register(struct ptp_clock *pclock)return NULL ; } +ptp_vclock_set_subclass (vclock->clock); +timecounter_init (&vclock->tc, &vclock->cc,0 );ptp_schedule_worker (vclock->clock,PTP_VCLOCK_REFRESH_INTERVAL );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 62/444 tls: handle data disappearing from under the TLS ULP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 6db015fc4b5d5f63a64a193f65d98da3a7fc811d ]
TLS expects that it owns the receive queue of the TCP socket. This cannot be guaranteed in case the reader of the TCP socket entered before the TLS ULP was installed, or uses some non-standard read API (eg. zerocopy ones). Replace the WARN_ON() and a buggy early exit (which leaves anchor pointing to a freed skb) with real error handling. Wipe the parsing state and tell the reader to retry.
We already reload the anchor every time we (re)acquire the socket lock, so the only condition we need to avoid is an out of bounds read (not having enough bytes in the socket for previously parsed record len).
If some data was read from under TLS but there's enough in the queue we'll reload and decrypt what is most likely not a valid TLS record. Leading to some undefined behavior from TLS perspective (corrupting a stream? missing an alert? missing an attack?) but no kernel crash should take place.
--- net/tls/tls.h | 2 +- net/tls/tls_strp.c | 11 ++++++++--- net/tls/tls_sw.c | 3 ++- 3 files changed, 11 insertions(+), 5 deletions(-)
net/tls/tls.h +1 -1
@@ -195,7 +195,7 @@ void tls_strp_msg_done(struct tls_strparser *strp);int tls_rx_msg_size (struct tls_strparser *strp,struct sk_buff *skb);void tls_rx_msg_ready (struct tls_strparser *strp); -void tls_strp_msg_load (struct tls_strparser *strp,bool force_refresh); +bool tls_strp_msg_load (struct tls_strparser *strp,bool force_refresh);int tls_strp_msg_cow (struct tls_sw_context_rx *ctx);struct sk_buff *tls_strp_msg_detach (struct tls_sw_context_rx *ctx);int tls_strp_msg_hold (struct tls_strparser *strp,struct sk_buff_head *dst);
net/tls/tls_strp.c +8 -3
@@ -475,7 +475,7 @@ static void tls_strp_load_anchor_with_queue(struct tls_strparser *strp, int len) strp->stm.offset = offset; } -void tls_strp_msg_load (struct tls_strparser *strp,bool force_refresh) +bool tls_strp_msg_load (struct tls_strparser *strp,bool force_refresh) {struct strp_msg *rxm;struct tls_msg *tlm;
@@ -484,8 +484,11 @@ void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh)DEBUG_NET_WARN_ON_ONCE (!strp->stm.full_len);if (!strp->copy_mode && force_refresh) { -if (WARN_ON (tcp_inq (strp->sk) < strp->stm.full_len)) -return ; +if (unlikely (tcp_inq (strp->sk) < strp->stm.full_len)) { +WRITE_ONCE (strp->msg_ready,0 ); +memset (&strp->stm,0 ,sizeof (strp->stm)); +return false; + }tls_strp_load_anchor_with_queue (strp, strp->stm.full_len); }
@@ -495,6 +498,8 @@ void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh) rxm->offset = strp->stm.offset; tlm =tls_msg (strp->anchor); tlm->control = strp->mark; + +return true; }/* Called with lock held on lower socket */
net/tls/tls_sw.c +2 -1
@@ -1380,7 +1380,8 @@ tls_rx_rec_wait(struct sock *sk, struct sk_psock *psock, bool nonblock,return sock_intr_errno (timeo); } -tls_strp_msg_load (&ctx->strp, released); +if (unlikely (!tls_strp_msg_load (&ctx->strp, released))) +return tls_rx_rec_wait (sk, psock, nonblock, false);return 1 ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 63/444 net: kcm: Fix race condition in kcm_unattach()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Stegemann <[email protected]>
[ Upstream commit 52565a935213cd6a8662ddb8efe5b4219343a25d ]
syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time.
kcm_unattach() is missing a check of the flagkcm->tx_stopped before calling queue_work().
If the kcm has a reserved psock, kcm_unattach() might get executed between cancel_work_sync() and unreserve_psock() in kcm_release(), requeuing kcm->tx_work right before kcm gets freed in kcm_done().
Remove kcm->tx_stopped and replace it by the less
error-prone disable_work_sync().
--- include/net/kcm.h | 1 - net/kcm/kcmsock.c | 10 ++-------- 2 files changed, 2 insertions(+), 9 deletions(-)
include/net/kcm.h +0 -1
@@ -71,7 +71,6 @@ struct kcm_sock {struct list_head wait_psock_list;struct sk_buff *seq_skb;struct mutex tx_mutex; - u32 tx_stopped : 1;/* Don't use bit fields here, these are set under different locks */ bool tx_wait;
net/kcm/kcmsock.c +2 -8
@@ -429,7 +429,7 @@ static void psock_write_space(struct sock *sk)/* Check if the socket is reserved so someone is waiting for sending. */ kcm = psock->tx_kcm; -if (kcm && !unlikely (kcm->tx_stopped)) +if (kcm)queue_work (kcm_wq, &kcm->tx_work);spin_unlock_bh (&mux->lock);
@@ -1696,12 +1696,6 @@ static int kcm_release(struct socket *sock)*/ __skb_queue_purge (&sk->sk_write_queue); -/* Set tx_stopped. This is checked when psock is bound to a kcm and we -* get a writespace callback. This prevents further work being queued -* from the callback (unbinding the psock occurs after canceling work. -*/ - kcm->tx_stopped =1 ; -release_sock (sk);spin_lock_bh (&mux->lock);
@@ -1717,7 +1711,7 @@ static int kcm_release(struct socket *sock)/* Cancel work. After this point there should be no outside references * to the kcm socket. */ -cancel_work_sync (&kcm->tx_work); +disable_work_sync (&kcm->tx_work);lock_sock (sk); psock = kcm->tx_psock;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 64/444 hfs: fix general protection fault in hfs_find_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 736a0516a16268995f4898eded49bfef077af709 ]
The hfs_find_init() method can trigger the crash
if tree pointer is NULL:
[ 45.746290][ T9787] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KAI [ 45.747287][ T9787] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 45.748716][ T9787] CPU: 2 UID: 0 PID: 9787 Comm: repro Not tainted 6.16.0-rc3 #10 PREEMPT(full) [ 45.750250][ T9787] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 45.751983][ T9787] RIP: 0010:hfs_find_init+0x86/0x230 [ 45.752834][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc [ 45.755574][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202 [ 45.756432][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09 [ 45.757457][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8 [ 45.758282][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000 [ 45.758943][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004 [ 45.759619][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000 [ 45.760293][ T9787] FS: 00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000 [ 45.761050][ T9787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.761606][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0 [ 45.762286][ T9787] Call Trace: [ 45.762570][ T9787] <TASK> [ 45.762824][ T9787] hfs_ext_read_extent+0x190/0x9d0 [ 45.763269][ T9787] ? submit_bio_noacct_nocheck+0x2dd/0xce0 [ 45.763766][ T9787] ? __pfx_hfs_ext_read_extent+0x10/0x10 [ 45.764250][ T9787] hfs_get_block+0x55f/0x830 [ 45.764646][ T9787] block_read_full_folio+0x36d/0x850 [ 45.765105][ T9787] ? __pfx_hfs_get_block+0x10/0x10 [ 45.765541][ T9787] ? const_folio_flags+0x5b/0x100 [ 45.765972][ T9787] ? __pfx_hfs_read_folio+0x10/0x10 [ 45.766415][ T9787] filemap_read_folio+0xbe/0x290 [ 45.766840][ T9787] ? __pfx_filemap_read_folio+0x10/0x10 [ 45.767325][ T9787] ? __filemap_get_folio+0x32b/0xbf0 [ 45.767780][ T9787] do_read_cache_folio+0x263/0x5c0 [ 45.768223][ T9787] ? __pfx_hfs_read_folio+0x10/0x10 [ 45.768666][ T9787] read_cache_page+0x5b/0x160 [ 45.769070][ T9787] hfs_btree_open+0x491/0x1740 [ 45.769481][ T9787] hfs_mdb_get+0x15e2/0x1fb0 [ 45.769877][ T9787] ? __pfx_hfs_mdb_get+0x10/0x10 [ 45.770316][ T9787] ? find_held_lock+0x2b/0x80 [ 45.770731][ T9787] ? lockdep_init_map_type+0x5c/0x280 [ 45.771200][ T9787] ? lockdep_init_map_type+0x5c/0x280 [ 45.771674][ T9787] hfs_fill_super+0x38e/0x720 [ 45.772092][ T9787] ? __pfx_hfs_fill_super+0x10/0x10 [ 45.772549][ T9787] ? snprintf+0xbe/0x100 [ 45.772931][ T9787] ? __pfx_snprintf+0x10/0x10 [ 45.773350][ T9787] ? do_raw_spin_lock+0x129/0x2b0 [ 45.773796][ T9787] ? find_held_lock+0x2b/0x80 [ 45.774215][ T9787] ? set_blocksize+0x40a/0x510 [ 45.774636][ T9787] ? sb_set_blocksize+0x176/0x1d0 [ 45.775087][ T9787] ? setup_bdev_super+0x369/0x730 [ 45.775533][ T9787] get_tree_bdev_flags+0x384/0x620 [ 45.775985][ T9787] ? __pfx_hfs_fill_super+0x10/0x10 [ 45.776453][ T9787] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 45.776950][ T9787] ? bpf_lsm_capable+0x9/0x10 [ 45.777365][ T9787] ? security_capable+0x80/0x260 [ 45.777803][ T9787] vfs_get_tree+0x8e/0x340 [ 45.778203][ T9787] path_mount+0x13de/0x2010 [ 45.778604][ T9787] ? kmem_cache_free+0x2b0/0x4c0 [ 45.779052][ T9787] ? __pfx_path_mount+0x10/0x10 [ 45.779480][ T9787] ? getname_flags.part.0+0x1c5/0x550 [ 45.779954][ T9787] ? putname+0x154/0x1a0 [ 45.780335][ T9787] __x64_sys_mount+0x27b/0x300 [ 45.780758][ T9787] ? __pfx___x64_sys_mount+0x10/0x10 [ 45.781232][ T9787] do_syscall_64+0xc9/0x480 [ 45.781631][ T9787] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.782149][ T9787] RIP: 0033:0x7ffb7265b6ca [ 45.782539][ T9787] Code: 48 8b 0d c9 17 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 [ 45.784212][ T9787] RSP: 002b:00007ffc0c10cfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 45.784935][ T9787] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffb7265b6ca [ 45.785626][ T9787] RDX: 0000200000000240 RSI: 0000200000000280 RDI: 00007ffc0c10d100 [ 45.786316][ T9787] RBP: 00007ffc0c10d190 R08: 00007ffc0c10d000 R09: 0000000000000000 [ 45.787011][ T9787] R10: 0000000000000048 R11: 0000000000000206 R12: 0000560246733250 [ 45.787697][ T9787] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 45.788393][ T9787] </TASK> [ 45.788665][ T9787] Modules linked in: [ 45.789058][ T9787] ---[ end trace 0000000000000000 ]--- [ 45.789554][ T9787] RIP: 0010:hfs_find_init+0x86/0x230 [ 45.790028][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc [ 45.792364][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202 [ 45.793155][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09 [ 45.794123][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8 [ 45.795105][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000 [ 45.796135][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004 [ 45.797114][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000 [ 45.798024][ T9787] FS: 00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000 [ 45.799019][ T9787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.799822][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0 [ 45.800747][ T9787] Kernel panic - not syncing: Fatal exception
The hfs_fill_super() calls hfs_mdb_get() method that tries to construct Extents Tree and Catalog Tree:
HFS_SB(sb)->ext_tree = hfs_btree_open(sb, HFS_EXT_CNID, hfs_ext_keycmp);
if (!HFS_SB(sb)->ext_tree) {
pr_err("unable to open extent tree\n");
goto out;
}
HFS_SB(sb)->cat_tree = hfs_btree_open(sb, HFS_CAT_CNID, hfs_cat_keycmp);
if (!HFS_SB(sb)->cat_tree) {
pr_err("unable to open catalog tree\n");
goto out;
}However, hfs_btree_open() calls read_mapping_page() that calls hfs_get_block(). And this method calls hfs_ext_read_extent():
static int hfs_ext_read_extent(struct inode *inode, u16 block)
{
struct hfs_find_data fd;
int res;
if (block >= HFS_I(inode)->cached_start &&
block < HFS_I(inode)->cached_start + HFS_I(inode)->cached_blocks)
return 0;
res = hfs_find_init(HFS_SB(inode->i_sb)->ext_tree, &fd);
if (!res) {
res = __hfs_ext_cache_extent(&fd, inode, block);
hfs_find_exit(&fd);
}
return res;
}The problem here that hfs_find_init() is trying to use HFS_SB(inode->i_sb)->ext_tree that is not initialized yet. It will be initailized when hfs_btree_open() finishes the execution.
The patch adds checking of tree pointer in hfs_find_init() and it reworks the logic of hfs_btree_open() by reading the b-tree's header directly from the volume. The read_mapping_page() is exchanged on filemap_grab_folio() that grab the folio from mapping. Then, sb_bread() extracts the b-tree's header content and copy it into the folio.
--- fs/hfs/bfind.c | 3 +++ fs/hfs/btree.c | 57 +++++++++++++++++++++++++++++++++++++++---------- fs/hfs/extent.c | 2 +- fs/hfs/hfs_fs.h | 1 + 4 files changed, 51 insertions(+), 12 deletions(-)
fs/hfs/bfind.c +3 -0
@@ -16,6 +16,9 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) {void *ptr; +if (!tree || !fd) +return -EINVAL ; + fd->tree = tree; fd->bnode =NULL ; ptr =kmalloc (tree->max_key_len *2 +4 ,GFP_KERNEL );
fs/hfs/btree.c +46 -11
100 lines not on this page · raw message
fs/hfs/extent.c +1 -1
@@ -71,7 +71,7 @@ int hfs_ext_keycmp(const btree_key *key1, const btree_key *key2)* * Find a block within an extent record */ -static u16 hfs_ext_find_block (struct hfs_extent *ext,u16 off) +u16 hfs_ext_find_block (struct hfs_extent *ext,u16 off) {int i;u16 count;
fs/hfs/hfs_fs.h +1 -0
@@ -190,6 +190,7 @@ extern const struct inode_operations hfs_dir_inode_operations;/* extent.c */ extern int hfs_ext_keycmp (const btree_key *,const btree_key *); +extern u16 hfs_ext_find_block (struct hfs_extent *ext,u16 off);extern int hfs_free_fork (struct super_block *,struct hfs_cat_file *,int );extern int hfs_ext_write_extent (struct inode *);extern int hfs_extend_file (struct inode *);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/444 hfs: fix slab-out-of-bounds in hfs_bnode_read()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit a431930c9bac518bf99d6b1da526a7f37ddee8d8 ]
This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.
--- fs/hfs/bnode.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+)
fs/hfs/bnode.c +92 -0
@@ -15,6 +15,48 @@#include "btree.h" +static inline +bool is_bnode_offset_valid (struct hfs_bnode *node,int off) +{ +bool is_valid = off < node->tree->node_size; + +if (!is_valid) { +pr_err ("requested invalid offset: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off); + } + +return is_valid; +} + +static inline +int check_and_correct_requested_length (struct hfs_bnode *node,int off,int len) +{ +unsigned int node_size; + +if (!is_bnode_offset_valid (node, off)) +return 0 ; + + node_size = node->tree->node_size; + +if ((off + len) > node_size) { +int new_len = (int )node_size - off; + +pr_err ("requested length has been corrected: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, " +"requested_len %d, corrected_len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len, new_len); + +return new_len; + } + +return len; +} +void hfs_bnode_read (struct hfs_bnode *node,void *buf,int off,int len) {struct page *page;
@@ -22,6 +64,20 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)int bytes_read;int bytes_to_read; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagenum = off >>PAGE_SHIFT ; off &= ~PAGE_MASK ;/* compute page offset for the first page */
@@ -80,6 +136,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len) {struct page *page; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; page = node->page[0 ];
@@ -104,6 +174,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len) {struct page *page; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; page = node->page[0 ];
@@ -119,6 +203,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,hfs_dbg (BNODE_MOD ,"copybytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (src_node, src, len); + len =check_and_correct_requested_length (dst_node, dst, len); + src += src_node->page_offset; dst += dst_node->page_offset; src_page = src_node->page[0 ];
@@ -136,6 +224,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)hfs_dbg (BNODE_MOD ,"movebytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (node, src, len); + len =check_and_correct_requested_length (node, dst, len); + src += node->page_offset; dst += node->page_offset; page = node->page[0 ];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/444 hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2 ]
The hfsplus_bnode_read() method can trigger the issue:
[ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] <TASK> [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] </TASK> [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x320 [ 174.883144][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.883595][ T9784] hfsplus_rmdir+0x106/0x1b0 [ 174.884004][ T9784] vfs_rmdir+0x206/0x690 [ 174.884379][ T9784] do_rmdir+0x2b7/0x390 [ 174.884751][ T9784] __x64_sys_rmdir+0xc5/0x110 [ 174.885167][ T9784] do_syscall_64+0xc9/0x480 [ 174.885568][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.886083][ T9784] [ 174.886293][ T9784] The buggy address belongs to the object at ffff88810b5fc600 [ 174.886293][ T9784] which belongs to the cache kmalloc-192 of size 192 [ 174.887507][ T9784] The buggy address is located 40 bytes to the right of [ 174.887507][ T9784] allocated 152-byte region [ffff88810b5fc600, ffff88810b5fc698) [ 174.888766][ T9784] [ 174.888976][ T9784] The buggy address belongs to the physical page: [ 174.889533][ T9784] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b5fc [ 174.890295][ T9784] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 174.890927][ T9784] page_type: f5(slab) [ 174.891284][ T9784] raw: 057ff00000000000 ffff88801b4423c0 ffffea000426dc80 dead000000000002 [ 174.892032][ T9784] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 174.892774][ T9784] page dumped because: kasan: bad access detected [ 174.893327][ T9784] page_owner tracks the page as allocated [ 174.893825][ T9784] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c00(GFP_NOIO|__GFP_NOWARN|__GFP_NO1 [ 174.895373][ T9784] post_alloc_hook+0x1c0/0x230 [ 174.895801][ T9784] get_page_from_freelist+0xdeb/0x3b30 [ 174.896284][ T9784] __alloc_frozen_pages_noprof+0x25c/0x2460 [ 174.896810][ T9784] alloc_pages_mpol+0x1fb/0x550 [ 174.897242][ T9784] new_slab+0x23b/0x340 [ 174.897614][ T9784] ___slab_alloc+0xd81/0x1960 [ 174.898028][ T9784] __slab_alloc.isra.0+0x56/0xb0 [ 174.898468][ T9784] __kmalloc_noprof+0x2b0/0x550 [ 174.898896][ T9784] usb_alloc_urb+0x73/0xa0 [ 174.899289][ T9784] usb_control_msg+0x1cb/0x4a0 [ 174.899718][ T9784] usb_get_string+0xab/0x1a0 [ 174.900133][ T9784] usb_string_sub+0x107/0x3c0 [ 174.900549][ T9784] usb_string+0x307/0x670 [ 174.900933][ T9784] usb_cache_string+0x80/0x150 [ 174.901355][ T9784] usb_new_device+0x1d0/0x19d0 [ 174.901786][ T9784] register_root_hub+0x299/0x730 [ 174.902231][ T9784] page last free pid 10 tgid 10 stack trace: [ 174.902757][ T9784] __free_frozen_pages+0x80c/0x1250 [ 174.903217][ T9784] vfree.part.0+0x12b/0xab0 [ 174.903645][ T9784] delayed_vfree_work+0x93/0xd0 [ 174.904073][ T9784] process_one_work+0x9b5/0x1b80 [ 174.904519][ T9784] worker_thread+0x630/0xe60 [ 174.904927][ T9784] kthread+0x3a8/0x770 [ 174.905291][ T9784] ret_from_fork+0x517/0x6e0 [ 174.905709][ T9784] ret_from_fork_asm+0x1a/0x30 [ 174.906128][ T9784] [ 174.906338][ T9784] Memory state around the buggy address: [ 174.906828][ T9784] ffff88810b5fc580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.907528][ T9784] ffff88810b5fc600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 174.908222][ T9784] >ffff88810b5fc680: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 174.908917][ T9784] ^ [ 174.909481][ T9784] ffff88810b5fc700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 174.910432][ T9784] ffff88810b5fc780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.911401][ T9784] ==================================================================
The reason of the issue that code doesn't check the correctness of the requested offset and length. As a result, incorrect value of offset or/and length could result in access out of allocated memory.
This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfsplus_bnode_read(), hfsplus_bnode_write(), hfsplus_bnode_clear(), hfsplus_bnode_copy(), and hfsplus_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.
--- fs/hfsplus/bnode.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+)
fs/hfsplus/bnode.c +92 -0
@@ -18,12 +18,68 @@#include "hfsplus_fs.h" #include "hfsplus_raw.h" +static inline +bool is_bnode_offset_valid (struct hfs_bnode *node,int off) +{ +bool is_valid = off < node->tree->node_size; + +if (!is_valid) { +pr_err ("requested invalid offset: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off); + } + +return is_valid; +} + +static inline +int check_and_correct_requested_length (struct hfs_bnode *node,int off,int len) +{ +unsigned int node_size; + +if (!is_bnode_offset_valid (node, off)) +return 0 ; + + node_size = node->tree->node_size; + +if ((off + len) > node_size) { +int new_len = (int )node_size - off; + +pr_err ("requested length has been corrected: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, " +"requested_len %d, corrected_len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len, new_len); + +return new_len; + } + +return len; +} +/* Copy a specified range of bytes from the raw data of a node */ void hfs_bnode_read (struct hfs_bnode *node,void *buf,int off,int len) {struct page **pagep;int l; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); off &= ~PAGE_MASK ;
@@ -81,6 +137,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)struct page **pagep;int l; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); off &= ~PAGE_MASK ;
@@ -109,6 +179,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len)struct page **pagep;int l; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); off &= ~PAGE_MASK ;
@@ -133,6 +217,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,hfs_dbg (BNODE_MOD ,"copybytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (src_node, src, len); + len =check_and_correct_requested_length (dst_node, dst, len); + src += src_node->page_offset; dst += dst_node->page_offset; src_page = src_node->page + (src >>PAGE_SHIFT );
@@ -187,6 +275,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)hfs_dbg (BNODE_MOD ,"movebytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (node, src, len); + len =check_and_correct_requested_length (node, dst, len); + src += node->page_offset; dst += node->page_offset;if (dst > src) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/444 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 94458781aee6045bd3d0ad4b80b02886b9e2219b ]
The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc():
[ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] <TASK> [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.152580][ T9805] [ 667.152798][ T9805] The buggy address belongs to the physical page: [ 667.153373][ T9805] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25928 [ 667.154157][ T9805] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 667.154916][ T9805] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 667.155631][ T9805] page_type: f5(slab) [ 667.155997][ T9805] raw: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001 [ 667.156770][ T9805] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 667.157536][ T9805] head: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001 [ 667.158317][ T9805] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 667.159088][ T9805] head: 00fff00000000003 ffffea0000964a01 00000000ffffffff 00000000ffffffff [ 667.159865][ T9805] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 667.160643][ T9805] page dumped because: kasan: bad access detected [ 667.161216][ T9805] page_owner tracks the page as allocated [ 667.161732][ T9805] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN9 [ 667.163566][ T9805] post_alloc_hook+0x1c0/0x230 [ 667.164003][ T9805] get_page_from_freelist+0xdeb/0x3b30 [ 667.164503][ T9805] __alloc_frozen_pages_noprof+0x25c/0x2460 [ 667.165040][ T9805] alloc_pages_mpol+0x1fb/0x550 [ 667.165489][ T9805] new_slab+0x23b/0x340 [ 667.165872][ T9805] ___slab_alloc+0xd81/0x1960 [ 667.166313][ T9805] __slab_alloc.isra.0+0x56/0xb0 [ 667.166767][ T9805] __kmalloc_cache_noprof+0x255/0x3e0 [ 667.167255][ T9805] psi_cgroup_alloc+0x52/0x2d0 [ 667.167693][ T9805] cgroup_mkdir+0x694/0x1210 [ 667.168118][ T9805] kernfs_iop_mkdir+0x111/0x190 [ 667.168568][ T9805] vfs_mkdir+0x59b/0x8d0 [ 667.168956][ T9805] do_mkdirat+0x2ed/0x3d0 [ 667.169353][ T9805] __x64_sys_mkdir+0xef/0x140 [ 667.169784][ T9805] do_syscall_64+0xc9/0x480 [ 667.170195][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.170730][ T9805] page last free pid 1257 tgid 1257 stack trace: [ 667.171304][ T9805] __free_frozen_pages+0x80c/0x1250 [ 667.171770][ T9805] vfree.part.0+0x12b/0xab0 [ 667.172182][ T9805] delayed_vfree_work+0x93/0xd0 [ 667.172612][ T9805] process_one_work+0x9b5/0x1b80 [ 667.173067][ T9805] worker_thread+0x630/0xe60 [ 667.173486][ T9805] kthread+0x3a8/0x770 [ 667.173857][ T9805] ret_from_fork+0x517/0x6e0 [ 667.174278][ T9805] ret_from_fork_asm+0x1a/0x30 [ 667.174703][ T9805] [ 667.174917][ T9805] Memory state around the buggy address: [ 667.175411][ T9805] ffff88802592f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 667.176114][ T9805] ffff88802592f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 667.176830][ T9805] >ffff88802592f400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.177547][ T9805] ^ [ 667.177933][ T9805] ffff88802592f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.178640][ T9805] ffff88802592f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.179350][ T9805] ==================================================================
The hfsplus_uni2asc() method operates by struct hfsplus_unistr:
struct hfsplus_unistr {
__be16 length;
hfsplus_unichr unicode[HFSPLUS_MAX_STRLEN];
} __packed;where HFSPLUS_MAX_STRLEN is 255 bytes. The issue happens if length of the structure instance has value bigger than 255 (for example, 65283). In such case, pointer on unicode buffer is going beyond of the allocated memory.
The patch fixes the issue by checking the length value of hfsplus_unistr instance and using 255 value in the case if length value is bigger than HFSPLUS_MAX_STRLEN. Potential reason of such situation could be a corruption of Catalog File b-tree's node.
--- fs/hfsplus/unicode.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/hfsplus/unicode.c +7 -0
@@ -132,7 +132,14 @@ int hfsplus_uni2asc(struct super_block *sb, op = astr; ip = ustr->unicode; + ustrlen =be16_to_cpu (ustr->length); +if (ustrlen >HFSPLUS_MAX_STRLEN ) { + ustrlen =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (ustr->length), ustrlen); + } + len = *len_p; ce1 =NULL ; compose = !test_bit (HFSPLUS_SB_NODECOMPOSE , &HFSPLUS_SB (sb)->flags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/444 hfsplus: dont use BUG_ON() in hfsplus_create_attributes_file()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit c7c6363ca186747ebc2df10c8a1a51e66e0e32d9 ]
When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.
--- fs/hfsplus/xattr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/hfsplus/xattr.c +5 -1
@@ -172,7 +172,11 @@ static int hfsplus_create_attributes_file(struct super_block *sb)return PTR_ERR (attr_file); } -BUG_ON (i_size_read (attr_file) !=0 ); +if (i_size_read (attr_file) !=0 ) { + err = -EIO ; +pr_err ("detected inconsistent attributes file, running fsck.hfsplus is recommended.\n" ); + goto end_attr_file_creation; + } hip =HFSPLUS_I (attr_file);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/444 arm64: Handle KCOV __init vs inline mismatches
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 65c430906efffee9bd7551d474f01a6b1197df90 ]
GCC appears to have kind of fragile inlining heuristics, in the sense that it can change whether or not it inlines something based on optimizations. It looks like the kcov instrumentation being added (or in this case, removed) from a function changes the optimization results, and some functions marked "inline" are _not_ inlined. In that case, we end up with __init code calling a function not marked __init, and we get the build warnings I'm trying to eliminate in the coming patch that adds __no_sanitize_coverage to __init functions:
WARNING: modpost: vmlinux: section mismatch in reference: acpi_get_enable_method+0x1c (section: .text.unlikely) -> acpi_psci_present (section: .init.text)
This problem is somewhat fragile (though using either __always_inline or __init will deterministically solve it), but we've tripped over this before with GCC and the solution has usually been to just use __always_inline and move on.
For arm64 this requires forcing one ACPI function to be inlined with __always_inline.
--- arch/arm64/include/asm/acpi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/acpi.h +1 -1
@@ -150,7 +150,7 @@ acpi_set_mailbox_entry(int cpu, struct acpi_madt_generic_interrupt *processor) {}#endif -static inline const char *acpi_get_enable_method (int cpu) +static __always_inline const char *acpi_get_enable_method(int cpu) {if (acpi_psci_present ())return "psci" ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/444 firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeoreum Yun <[email protected]>
[ Upstream commit 0e0546eabcd6c19765a8dbf5b5db3723e7b0ea75 ]
The Linux IMA (Integrity Measurement Architecture) subsystem used for secure boot, file integrity, or remote attestation cannot be a loadable module for few reasons listed below:
o Boot-Time Integrity: IMA’s main role is to measure and appraise files before they are used. This includes measuring critical system files during early boot (e.g., init, init scripts, login binaries). If IMA were a module, it would be loaded too late to cover those.
o TPM Dependency: IMA integrates tightly with the TPM to record measurements into PCRs. The TPM must be initialized early (ideally before init_ima()), which aligns with IMA being built-in.
o Security Model: IMA is part of a Trusted Computing Base (TCB). Making it a module would weaken the security model, as a potentially compromised system could delay or tamper with its initialization.
IMA must be built-in to ensure it starts measuring from the earliest possible point in boot which inturn implies TPM must be initialised and ready to use before IMA.
To enable integration of tpm_event_log with the IMA subsystem, the TPM drivers (tpm_crb and tpm_crb_ffa) also needs to be built-in. However with FF-A driver also being initialised at device initcall level, it can lead to an initialization order issue where:
- crb_acpi_driver_init() may run before tpm_crb_ffa_driver()_init and ffa_init()
- As a result, probing the TPM device via CRB over FFA is deferred
- ima_init() (called as a late initcall) runs before deferred probe completes, IMA fails to find the TPM and logs the below error:
| ima: No TPM chip found, activating TPM-bypass!
Eventually it fails to generate boot_aggregate with PCR values.
Because of the above stated dependency, the ffa driver needs to initialised before tpm_crb_ffa module to ensure IMA finds the TPM successfully when present.
[ jarkko: reformatted some of the paragraphs because they were going past
the 75 character boundary. ]
--- drivers/firmware/arm_ffa/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_ffa/driver.c +1 -1
@@ -1815,7 +1815,7 @@ static int __init ffa_init(void)kfree (drv_info);return ret; } -module_init (ffa_init); +rootfs_initcall (ffa_init); static void __exit ffa_exit(void) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/444 smb/server: avoid deadlock when linking with ReplaceIfExists
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694 ]
If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen.
ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock.
This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.
--- fs/smb/server/smb2pdu.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
fs/smb/server/smb2pdu.c +4 -12
@@ -6023,7 +6023,6 @@ static int smb2_create_link(struct ksmbd_work *work, { char *link_name = NULL, *target_name = NULL, *pathname = NULL; struct path path, parent_path; - bool file_present = false; int rc; if (buf_len < (u64)sizeof(struct smb2_file_link_info) +
@@ -6056,11 +6055,8 @@ static int smb2_create_link(struct ksmbd_work *work,if (rc) {if (rc != -ENOENT ) goto out; - }else - file_present = true; - -if (file_info->ReplaceIfExists) { -if (file_present) { + }else { +if (file_info->ReplaceIfExists) { rc =ksmbd_vfs_remove_file (work, &path);if (rc) { rc = -EINVAL ;
@@ -6068,21 +6064,17 @@ static int smb2_create_link(struct ksmbd_work *work, link_name); goto out; } - } - }else { -if (file_present) { + }else { rc = -EEXIST ;ksmbd_debug (SMB ,"link already exists\n" ); goto out; } +ksmbd_vfs_kern_path_unlock (&parent_path, &path); } - rc =ksmbd_vfs_link (work, target_name, link_name);if (rc) rc = -EINVAL ; out: -if (file_present) -ksmbd_vfs_kern_path_unlock (&parent_path, &path);if (!IS_ERR (link_name))kfree (link_name);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/444 nvme-pci: try function level reset on init failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 5b2c214a95942f7997d1916a4c44017becbc3cac ]
NVMe devices from multiple vendors appear to get stuck in a reset state that we can't get out of with an NVMe level Controller Reset. The kernel would report these with messages that look like:
Device not ready; aborting reset, CSTS=0x1
These have historically required a power cycle to make them usable again, but in many cases, a PCIe FLR is sufficient to restart operation without a power cycle. Try it if the initial controller reset fails during any nvme reset attempt.
--- drivers/nvme/host/pci.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
drivers/nvme/host/pci.c +22 -2
@@ -1888,8 +1888,28 @@ static int nvme_pci_configure_admin_queue(struct nvme_dev *dev)* might be pointing at! */ result =nvme_disable_ctrl (&dev->ctrl, false); -if (result <0 ) -return result; +if (result <0 ) { +struct pci_dev *pdev =to_pci_dev (dev->dev); + +/* +* The NVMe Controller Reset method did not get an expected +* CSTS.RDY transition, so something with the device appears to +* be stuck. Use the lower level and bigger hammer PCIe +* Function Level Reset to attempt restoring the device to its +* initial state, and try again. +*/ + result =pcie_reset_flr (pdev, false); +if (result <0 ) +return result; + +pci_restore_state (pdev); + result =nvme_disable_ctrl (&dev->ctrl, false); +if (result <0 ) +return result; + +dev_info (dev->ctrl.device, +"controller reset completed after pcie flr\n" ); + } result =nvme_alloc_queue (dev,0 ,NVME_AQ_DEPTH );if (result)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/444 dm-stripe: limit chunk_sectors to the stripe size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 5fb9d4341b782a80eefa0dc1664d131ac3c8885d ]
Same as done for raid0, set chunk_sectors limit to appropriately set the atomic write size limit.
Setting chunk_sectors limit in this way overrides the stacked limit already calculated based on the bottom device limits. This is ok, as when any bios are sent to the bottom devices, the block layer will still respect the bottom device chunk_sectors.
--- drivers/md/dm-stripe.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/dm-stripe.c +1 -0
@@ -459,6 +459,7 @@ static void stripe_io_hints(struct dm_target *ti,struct stripe_c *sc = ti->private;unsigned int chunk_size = sc->chunk_size <<SECTOR_SHIFT ; + limits->chunk_sectors = sc->chunk_size; limits->io_min = chunk_size; limits->io_opt = chunk_size * sc->stripes; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/444 md/raid10: set chunk_sectors limit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 7ef50c4c6a9c36fa3ea6f1681a80c0bf9a797345 ]
Same as done for raid0, set chunk_sectors limit to appropriately set the atomic write size limit.
--- drivers/md/raid10.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/raid10.c +1 -0
@@ -3968,6 +3968,7 @@ static int raid10_set_queue_limits(struct mddev *mddev)md_init_stacking_limits (&lim); lim.max_write_zeroes_sectors =0 ; lim.io_min = mddev->chunk_sectors <<9 ; + lim.chunk_sectors = mddev->chunk_sectors; lim.io_opt = lim.io_min *raid10_nr_stripes (conf); err =mddev_stack_rdev_limits (mddev, &lim,MDDEV_STACK_INTEGRITY );if (err)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/444 nvme-tcp: log TLS handshake failures at error level
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 5a58ac9bfc412a58c3cf26c6a7e54d4308e9d109 ]
Update the nvme_tcp_start_tls() function to use dev_err() instead of dev_dbg() when a TLS error is detected. This ensures that handshake failures are visible by default, aiding in debugging.
--- drivers/nvme/host/tcp.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/nvme/host/tcp.c +8 -3
@@ -1777,9 +1777,14 @@ static int nvme_tcp_start_tls(struct nvme_ctrl *nctrl, qid, ret);tls_handshake_cancel (queue->sock->sk); }else { -dev_dbg (nctrl->device, -"queue %d: TLS handshake complete, error %d\n" , - qid, queue->tls_err); +if (queue->tls_err) { +dev_err (nctrl->device, +"queue %d: TLS handshake complete, error %d\n" , + qid, queue->tls_err); + }else { +dev_dbg (nctrl->device, +"queue %d: TLS handshake complete\n" , qid); + } ret = queue->tls_err; }return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/444 gfs2: Validate i_depth for exhash directories
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Price <[email protected]>
[ Upstream commit 557c024ca7250bb65ae60f16c02074106c2f197b ]
A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at:
index = hash >> (32 - dip->i_depth);
As calculated in an open-coded way in dir_make_exhash(), the minimum depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time.
So we can avoid the undefined behaviour by checking for depth values lower than the minimum in gfs2_dinode_in(). Values greater than the maximum are already being checked for there.
Also switch the calculation in dir_make_exhash() to use ilog2() to clarify how the depth is calculated.
Tested with the syzkaller repro.c and xfstests '-g quick'.
--- fs/gfs2/dir.c | 6 ++---- fs/gfs2/glops.c | 6 ++++++ 2 files changed, 8 insertions(+), 4 deletions(-)
fs/gfs2/dir.c +2 -4
@@ -60,6 +60,7 @@#include <linux/crc32.h> #include <linux/vmalloc.h> #include <linux/bio.h> +#include <linux/log2.h> #include "gfs2.h" #include "incore.h"
@@ -912,7 +913,6 @@ static int dir_make_exhash(struct inode *inode)struct qstr args;struct buffer_head *bh, *dibh;struct gfs2_leaf *leaf; -int y;u32 x;__be64 *lp;u64 bn;
@@ -979,9 +979,7 @@ static int dir_make_exhash(struct inode *inode)i_size_write (inode, sdp->sd_sb.sb_bsize /2 );gfs2_add_inode_blocks (&dip->i_inode,1 ); dip->i_diskflags |=GFS2_DIF_EXHASH ; - -for (x = sdp->sd_hash_ptrs, y =-1 ; x; x >>=1 , y++) ; - dip->i_depth = y; + dip->i_depth =ilog2 (sdp->sd_hash_ptrs);gfs2_dinode_out (dip, dibh->b_data);
fs/gfs2/glops.c +6 -0
@@ -11,6 +11,7 @@#include <linux/bio.h> #include <linux/posix_acl.h> #include <linux/security.h> +#include <linux/log2.h> #include "gfs2.h" #include "incore.h"
@@ -450,6 +451,11 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)gfs2_consist_inode (ip);return -EIO ; } +if ((ip->i_diskflags &GFS2_DIF_EXHASH ) && + depth <ilog2 (sdp->sd_hash_ptrs)) { +gfs2_consist_inode (ip); +return -EIO ; + } ip->i_depth = (u8 )depth; ip->i_entries =be32_to_cpu (str->di_entries);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/444 gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Price <[email protected]>
[ Upstream commit 5c8f12cf1e64e0e8e6cb80b0c935389973e8be8d ]
Clears up the warning added in 7ee3647243e5 ("migrate: Remove call to ->writepage") that occurs in various xfstests, causing "something found in dmesg" failures.
[ 341.136573] gfs2_meta_aops does not implement migrate_folio [ 341.136953] WARNING: CPU: 1 PID: 36 at mm/migrate.c:944 move_to_new_folio+0x2f8/0x300
--- fs/gfs2/meta_io.c | 2 ++ 1 file changed, 2 insertions(+)
fs/gfs2/meta_io.c +2 -0
@@ -103,6 +103,7 @@ const struct address_space_operations gfs2_meta_aops = { .invalidate_folio = block_invalidate_folio, .writepages = gfs2_aspace_writepages, .release_folio = gfs2_release_folio, + .migrate_folio = buffer_migrate_folio_norefs, };const struct address_space_operations gfs2_rgrp_aops = {
@@ -110,6 +111,7 @@ const struct address_space_operations gfs2_rgrp_aops = { .invalidate_folio = block_invalidate_folio, .writepages = gfs2_aspace_writepages, .release_folio = gfs2_release_folio, + .migrate_folio = buffer_migrate_folio_norefs, };/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/444 md: call del_gendisk in control path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Ni <[email protected]>
[ Upstream commit 9e59d609763f70a992a8f3808dabcce60f14eb5c ]
Now del_gendisk and put_disk are called asynchronously in workqueue work. The asynchronous way has a problem that the device node can still exist after mdadm --stop command returns in a short window. So udev rule can open this device node and create the struct mddev in kernel again. So put del_gendisk in control path and still leave put_disk in md_kobj_release to avoid uaf of gendisk.
Function del_gendisk can't be called with reconfig_mutex. If it's called with reconfig mutex, a deadlock can happen. del_gendisk waits all sysfs files access to finish and sysfs file access waits reconfig mutex. So put del_gendisk after releasing reconfig mutex.
But there is still a window that sysfs can be accessed between mddev_unlock and del_gendisk. So some actions (add disk, change level, .e.g) can happen which lead unexpected results. MD_DELETED is used to resolve this problem. MD_DELETED is set before releasing reconfig mutex and it should be checked for these sysfs access which need reconfig mutex. For sysfs access which don't need reconfig mutex, del_gendisk will wait them to finish.
But it doesn't need to do this in function mddev_lock_nointr. There are ten places that call it.
* Five of them are in dm raid which we don't need to care. MD_DELETED is only used for md raid.
* stop_sync_thread, md_do_sync and md_start_sync are related sync request, and it needs to wait sync thread to finish before stopping an array.
* md_ioctl: md_open is called before md_ioctl, so ->openers is added. It will fail to stop the array. So it doesn't need to check MD_DELETED here
* md_set_readonly:
It needs to call mddev_set_closing_and_sync_blockdev when setting readonly or read_auto. So it will fail to stop the array too because MD_CLOSING is already set.
--- drivers/md/md.c | 33 +++++++++++++++++++++++---------- drivers/md/md.h | 26 ++++++++++++++++++++++++-- 2 files changed, 47 insertions(+), 12 deletions(-)
drivers/md/md.c +23 -10
@@ -619,9 +619,6 @@ static void __mddev_put(struct mddev *mddev) mddev->ctime || mddev->hold_active)return ; -/* Array is not configured at all, and not held active, so destroy it */ -set_bit (MD_DELETED , &mddev->flags); -/* * Call queue_work inside the spinlock so that flush_workqueue() after * mddev_find will succeed in waiting for the work to be done.
@@ -856,6 +853,16 @@ void mddev_unlock(struct mddev *mddev)kobject_del (&rdev->kobj);export_rdev (rdev, mddev); } + +/* Call del_gendisk after release reconfig_mutex to avoid +* deadlock (e.g. call del_gendisk under the lock and an +* access to sysfs files waits the lock) +* And MD_DELETED is only used for md raid which is set in +* do_md_stop. dm raid only uses md_stop to stop. So dm raid +* doesn't need to check MD_DELETED when getting reconfig lock +*/ +if (test_bit (MD_DELETED , &mddev->flags)) +del_gendisk (mddev->gendisk); }EXPORT_SYMBOL_GPL (mddev_unlock);
@@ -5720,19 +5727,30 @@ md_attr_store(struct kobject *kobj, struct attribute *attr, struct md_sysfs_entry *entry = container_of(attr, struct md_sysfs_entry, attr); struct mddev *mddev = container_of(kobj, struct mddev, kobj);ssize_t rv; +struct kernfs_node *kn =NULL ;if (!entry->store)return -EIO ;if (!capable (CAP_SYS_ADMIN ))return -EACCES ; + +if (entry->store == array_state_store &&cmd_match (page,"clear" )) + kn =sysfs_break_active_protection (kobj, attr); +spin_lock (&all_mddevs_lock);if (!mddev_get (mddev)) {spin_unlock (&all_mddevs_lock); +if (kn) +sysfs_unbreak_active_protection (kn);return -EBUSY ; }spin_unlock (&all_mddevs_lock); rv = entry->store (mddev, page, length);mddev_put (mddev); + +if (kn) +sysfs_unbreak_active_protection (kn); +return rv; }
@@ -5740,12 +5758,6 @@ static void md_kobj_release(struct kobject *ko) { struct mddev *mddev = container_of(ko, struct mddev, kobj); -if (mddev->sysfs_state) -sysfs_put (mddev->sysfs_state); -if (mddev->sysfs_level) -sysfs_put (mddev->sysfs_level); - -del_gendisk (mddev->gendisk);put_disk (mddev->gendisk); }
@@ -6601,8 +6613,9 @@ static int do_md_stop(struct mddev *mddev, int mode) mddev->bitmap_info.offset =0 ;export_array (mddev); -md_clean (mddev); +set_bit (MD_DELETED , &mddev->flags); +if (mddev->hold_active ==UNTIL_STOP ) mddev->hold_active =0 ; }
drivers/md/md.h +24 -2
@@ -669,11 +669,26 @@ static inline bool reshape_interrupted(struct mddev *mddev)static inline int __must_check mddev_lock (struct mddev *mddev) { -return mutex_lock_interruptible (&mddev->reconfig_mutex); +int ret; + + ret =mutex_lock_interruptible (&mddev->reconfig_mutex); + +/* MD_DELETED is set in do_md_stop with reconfig_mutex. +* So check it here. +*/ +if (!ret &&test_bit (MD_DELETED , &mddev->flags)) { + ret = -ENODEV ; +mutex_unlock (&mddev->reconfig_mutex); + } + +return ret; }/* Sometimes we need to take the lock in a situation where * failure due to interrupts is not acceptable. +* It doesn't need to check MD_DELETED here, the owner which +* holds the lock here can't be stopped. And all paths can't +* call this function after do_md_stop. */ static inline void mddev_lock_nointr (struct mddev *mddev) {
@@ -682,7 +697,14 @@ static inline void mddev_lock_nointr(struct mddev *mddev)static inline int mddev_trylock (struct mddev *mddev) { -return mutex_trylock (&mddev->reconfig_mutex); +int ret; + + ret =mutex_trylock (&mddev->reconfig_mutex); +if (!ret &&test_bit (MD_DELETED , &mddev->flags)) { + ret = -ENODEV ; +mutex_unlock (&mddev->reconfig_mutex); + } +return ret; }extern void mddev_unlock (struct mddev *mddev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/444 loop: Avoid updating block size under exclusive owner
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 7e49538288e523427beedd26993d446afef1a6fb ]
Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size.
Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it.
--- drivers/block/loop.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-)
drivers/block/loop.c +30 -8
@@ -1404,16 +1404,33 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg)return error; } -static int loop_set_block_size (struct loop_device *lo,unsigned long arg) +static int loop_set_block_size (struct loop_device *lo,blk_mode_t mode, +struct block_device *bdev,unsigned long arg) {struct queue_limits lim;int err =0 ; -if (lo->lo_state != Lo_bound) -return -ENXIO ; +/* +* If we don't hold exclusive handle for the device, upgrade to it +* here to avoid changing device under exclusive owner. +*/ +if (!(mode &BLK_OPEN_EXCL )) { + err =bd_prepare_to_claim (bdev, loop_set_block_size,NULL ); +if (err) +return err; + } + + err =mutex_lock_killable (&lo->lo_mutex); +if (err) + goto abort_claim; + +if (lo->lo_state != Lo_bound) { + err = -ENXIO ; + goto unlock; + }if (lo->lo_queue->limits.logical_block_size == arg) -return 0 ; + goto unlock;sync_blockdev (lo->lo_device);invalidate_bdev (lo->lo_device);
@@ -1425,6 +1442,11 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg)loop_update_dio (lo);blk_mq_unfreeze_queue (lo->lo_queue); +unlock: +mutex_unlock (&lo->lo_mutex); +abort_claim: +if (!(mode &BLK_OPEN_EXCL )) +bd_abort_claiming (bdev, loop_set_block_size);return err; }
@@ -1443,9 +1465,6 @@ static int lo_simple_ioctl(struct loop_device *lo, unsigned int cmd,case LOOP_SET_DIRECT_IO : err =loop_set_dio (lo, arg);break ; -case LOOP_SET_BLOCK_SIZE : - err =loop_set_block_size (lo, arg); -break ;default : err = -EINVAL ; }
@@ -1500,9 +1519,12 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode,break ;case LOOP_GET_STATUS64 :return loop_get_status64 (lo, argp); +case LOOP_SET_BLOCK_SIZE : +if (!(mode &BLK_OPEN_WRITE ) && !capable (CAP_SYS_ADMIN )) +return -EPERM ; +return loop_set_block_size (lo, mode, bdev, arg);case LOOP_SET_CAPACITY :case LOOP_SET_DIRECT_IO : -case LOOP_SET_BLOCK_SIZE :if (!(mode &BLK_OPEN_WRITE ) && !capable (CAP_SYS_ADMIN ))return -EPERM ; fallthrough;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/444 udf: Verify partition map count
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 1a11201668e8635602577dcf06f2e96c591d8819 ]
Verify that number of partition maps isn't insanely high which can lead to large allocation in udf_sb_alloc_partition_maps(). All partition maps have to fit in the LVD which is in a single block.
--- fs/udf/super.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/udf/super.c +11 -2
@@ -1440,7 +1440,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,struct genericPartitionMap *gpm;uint16_t ident;struct buffer_head *bh; -unsigned int table_len; +unsigned int table_len, part_map_count;int ret; bh =udf_read_tagged (sb, block, block, &ident);
@@ -1461,7 +1461,16 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, "logical volume");if (ret) goto out_bh; - ret =udf_sb_alloc_partition_maps (sb,le32_to_cpu (lvd->numPartitionMaps)); + + part_map_count =le32_to_cpu (lvd->numPartitionMaps); +if (part_map_count > table_len /sizeof (struct genericPartitionMap1 )) { +udf_err (sb,"error loading logical volume descriptor: " +"Too many partition maps (%u > %u)\n" , part_map_count, + table_len / (unsigned )sizeof (struct genericPartitionMap1 )); + ret = -EIO ; + goto out_bh; + } + ret =udf_sb_alloc_partition_maps (sb, part_map_count);if (ret) goto out_bh;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/444 drbd: add missing kref_get in handle_write_conflicts
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Newman <[email protected]>
[ Upstream commit 00c9c9628b49e368d140cfa61d7df9b8922ec2a8 ]
With two-primaries enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed.
In handling "superseeded" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms.
Relevance: No one should use DRBD as a random data generator, and apparently all users of "two-primaries" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node.
Which means that other than for "test cases",
this code path is never taken in real life.
FYI, in DRBD 9, things are handled differently nowadays. We still detect "write conflicts", but no longer try to be smart about them.
We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault.
--- drivers/block/drbd/drbd_receiver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/block/drbd/drbd_receiver.c +5 -1
@@ -2500,7 +2500,11 @@ static int handle_write_conflicts(struct drbd_device *device, peer_req->w.cb = superseded ? e_send_superseded : e_send_retry_write;list_add_tail (&peer_req->w.list, &device->done_ee); -queue_work (connection->ack_sender, &peer_req->peer_device->send_acks_work); +/* put is in drbd_send_acks_wf() */ +kref_get (&device->kref); +if (!queue_work (connection->ack_sender, + &peer_req->peer_device->send_acks_work)) +kref_put (&device->kref, drbd_destroy_device); err = -ENOENT ; goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/444 hfs: fix not erasing deleted b-tree node issue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit d3ed6d6981f4756f145766753c872482bc3b28d3 ]
The generic/001 test of xfstests suite fails and corrupts the HFS volume:
sudo ./check generic/001
FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2> MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/001 32s ... _check_generic_filesystem: filesystem on /dev/loop50 is inconsistent (see /home/slavad/XFSTESTS-2/xfstests-dev/results//generic/001.full for details)
Ran: generic/001
Failures: generic/001
Failed 1 of 1 tests
fsck.hfs -d -n ./test-image.bin
** ./test-image.bin (NO WRITE)
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking HFS volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
Unused node is not erased (node = 2)
Unused node is not erased (node = 4)
<skipped>
Unused node is not erased (node = 253)
Unused node is not erased (node = 254)
Unused node is not erased (node = 255)
Unused node is not erased (node = 256)
** Checking catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
CBTStat = 0x0004 CatStat = 0x00000000 ** The volume untitled was found corrupt and needs to be repaired. volume type is HFS primary MDB is at block 2 0x02 alternate MDB is at block 20971518 0x13ffffe primary VHB is at block 0 0x00 alternate VHB is at block 0 0x00 sector size = 512 0x200 VolumeObject flags = 0x19 total sectors for volume = 20971520 0x1400000 total sectors for embedded volume = 0 0x00
This patch adds logic of clearing the deleted b-tree node.
sudo ./check generic/001
FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2025 MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/001 9s ... 32s
Ran: generic/001
Passed all 1 tests
fsck.hfs -d -n ./test-image.bin
** ./test-image.bin (NO WRITE)
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking HFS volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
** Checking catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
** The volume untitled appears to be OK.
--- fs/hfs/bnode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfs/bnode.c +1 -0
@@ -574,6 +574,7 @@ void hfs_bnode_put(struct hfs_bnode *node)if (test_bit (HFS_BNODE_DELETED , &node->flags)) {hfs_bnode_unhash (node);spin_unlock (&tree->hash_lock); +hfs_bnode_clear (node,0 , tree->node_size);hfs_bmap_free (node);hfs_bnode_free (node);return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/444 better lockdep annotations for simple_recursive_removal()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 2a8061ee5e41034eb14170ec4517b5583dbeff9f ]
We want a class that nests outside of I_MUTEX_NORMAL (for the sake of callbacks that might want to lock the victim) and inside I_MUTEX_PARENT (so that a variant of that could be used with parent of the victim held locked by the caller).
In reality, simple_recursive_removal()
* never holds two locks at once
* holds the lock on parent of dentry passed to callback
* is used only on the trees with fixed topology, so the depths
are not changing.
So the locking order is actually fine.
AFAICS, the best solution is to assign I_MUTEX_CHILD to the locks grabbed by that thing.
--- fs/libfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/libfs.c +2 -2
@@ -608,7 +608,7 @@ void simple_recursive_removal(struct dentry *dentry,struct dentry *victim =NULL , *child;struct inode *inode = this->d_inode; -inode_lock (inode); +inode_lock_nested (inode,I_MUTEX_CHILD );if (d_is_dir (this)) inode->i_flags |=S_DEAD ;while ((child =find_next_child (this, victim)) ==NULL ) {
@@ -620,7 +620,7 @@ void simple_recursive_removal(struct dentry *dentry, victim = this; this = this->d_parent; inode = this->d_inode; -inode_lock (inode); +inode_lock_nested (inode,I_MUTEX_CHILD );if (simple_positive (victim)) {d_invalidate (victim);// avoid lost mounts if (d_is_dir (victim))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/444 ata: ahci: Disallow LPM policy control if not supported
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 65b2c92f69d3df81422d27e5be012e357e733241 ]
Commit fa997b0576c9 ("ata: ahci: Do not enable LPM if no LPM states are supported by the HBA") introduced an early return in ahci_update_initial_lpm_policy() to ensure that the target_lpm_policy of ports belonging to a host that does not support the Partial, Slumber and DevSleep power states is unchanged and remains set to ATA_LPM_UNKNOWN and thus prevents the execution of ata_eh_link_set_lpm().
However, a user or a system daemon (e.g. systemd-udevd) may still attempt changing the LPM policy through the sysfs link_power_management_policy of the host.
Improve this to prevent sysfs LPM policy changes by setting the flag ATA_FLAG_NO_LPM for the port of such host, and initialize the port target_lpm_policy to ATA_LPM_MAX_POWER to guarantee that no unsupported low power state is being used on the port and its link.
--- drivers/ata/ahci.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/ata/ahci.c +4 -1
@@ -1785,7 +1785,10 @@ static void ahci_update_initial_lpm_policy(struct ata_port *ap)if ((ap->host->flags &ATA_HOST_NO_PART ) && (ap->host->flags &ATA_HOST_NO_SSC ) && (ap->host->flags &ATA_HOST_NO_DEVSLP )) { -ata_port_dbg (ap,"no LPM states supported, not enabling LPM\n" ); +ata_port_dbg (ap, +"No LPM states supported, forcing LPM max_power\n" ); + ap->flags |=ATA_FLAG_NO_LPM ; + ap->target_lpm_policy =ATA_LPM_MAX_POWER ;return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/444 ata: ahci: Disable DIPM if host lacks support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit f7870e8d345cdabfb94bcbdcba6a07e050f8705e ]
The AHCI specification version 1.3.1 section 8.3.1.4 (Software Requirements and Precedence) states that:
If CAP.SSC or CAP.PSC is cleared to ‘0’, software should disable device-initiated power management by issuing the appropriate SET FEATURES command to the device.
To satisfy this constraint and force ata_dev_configure to disable the device DIPM feature, modify ahci_update_initial_lpm_policy() to set the ATA_FLAG_NO_DIPM flag on ports that have a host with either the ATA_HOST_NO_PART flag set or the ATA_HOST_NO_SSC flag set.
--- drivers/ata/ahci.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/ata/ahci.c +7 -0
@@ -1781,6 +1781,13 @@ static void ahci_update_initial_lpm_policy(struct ata_port *ap)return ; } +/* If no Partial or no Slumber, we cannot support DIPM. */ +if ((ap->host->flags &ATA_HOST_NO_PART ) || + (ap->host->flags &ATA_HOST_NO_SSC )) { +ata_port_dbg (ap,"Host does not support DIPM\n" ); + ap->flags |=ATA_FLAG_NO_DIPM ; + } +/* If no LPM states are supported by the HBA, do not bother with LPM */ if ((ap->host->flags & ATA_HOST_NO_PART) && (ap->host->flags & ATA_HOST_NO_SSC) &&
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/444 ata: libata-sata: Disallow changing LPM state if not supported
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 413e800cadbf67550d76c77c230b2ecd96bce83a ]
Modify ata_scsi_lpm_store() to return an error if a user attempts to set a link power management policy for a port that does not support LPM, that is, ports flagged with ATA_FLAG_NO_LPM.
--- drivers/ata/libata-sata.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/ata/libata-sata.c +5 -0
@@ -924,6 +924,11 @@ static ssize_t ata_scsi_lpm_store(struct device *device,spin_lock_irqsave (ap->lock, flags); +if (ap->flags &ATA_FLAG_NO_LPM ) { + count = -EOPNOTSUPP ; + goto out_unlock; + } +ata_for_each_link (link, ap,EDGE ) {ata_for_each_dev (dev, &ap->link,ENABLED ) {if (dev->quirks &ATA_QUIRK_NOLPM ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/444 fs/ntfs3: Add sanity check for file name
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit e841ecb139339602bc1853f5f09daa5d1ea920a2 ]
The length of the file name should be smaller than the directory entry size.
--- fs/ntfs3/dir.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ntfs3/dir.c +3 -0
@@ -304,6 +304,9 @@ static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi,if (sbi->options->nohidden && (fname->dup.fa &FILE_ATTRIBUTE_HIDDEN ))return true; +if (fname->name_len +sizeof (struct NTFS_DE ) >le16_to_cpu (e->size)) +return true; + name_len =ntfs_utf16_to_nls (sbi, fname->name, fname->name_len, name,PATH_MAX );if (name_len <=0 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/444 fs/ntfs3: correctly create symlink for relative path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Zhang <[email protected]>
[ Upstream commit b1e9d89408f402858c00103f9831b25ffa0994d3 ]
After applying this patch, could correctly create symlink:
ln -s "relative/path/to/file" symlink
[[email protected]: added cpu_to_le32 macro to rs->Flags assignment]
--- fs/ntfs3/inode.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
fs/ntfs3/inode.c +18 -13
@@ -1102,10 +1102,10 @@ int inode_read_data(struct inode *inode, void *data, size_t bytes)* Number of bytes for REPARSE_DATA_BUFFER(IO_REPARSE_TAG_SYMLINK) * for unicode string of @uni_len length. */ -static inline u32 ntfs_reparse_bytes (u32 uni_len) +static inline u32 ntfs_reparse_bytes (u32 uni_len,bool is_absolute) {/* Header + unicode string + decorated unicode string. */ -return sizeof (short ) * (2 * uni_len +4 ) + +return sizeof (short ) * (2 * uni_len + (is_absolute ?4 :0 )) + offsetof(struct REPARSE_DATA_BUFFER , SymbolicLinkReparseBuffer.PathBuffer); }
@@ -1118,8 +1118,11 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,struct REPARSE_DATA_BUFFER *rp;__le16 *rp_name;typeof (rp->SymbolicLinkReparseBuffer) *rs; +bool is_absolute; - rp =kzalloc (ntfs_reparse_bytes (2 * size +2 ),GFP_NOFS ); + is_absolute = (strlen (symname) >1 && symname[1 ] ==':' ); + + rp =kzalloc (ntfs_reparse_bytes (2 * size +2 , is_absolute),GFP_NOFS );if (!rp)return ERR_PTR (-ENOMEM );
@@ -1134,7 +1137,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname, goto out;/* err = the length of unicode name of symlink. */ - *nsize =ntfs_reparse_bytes (err); + *nsize =ntfs_reparse_bytes (err, is_absolute);if (*nsize > sbi->reparse.max_size) { err = -EFBIG ;
@@ -1154,7 +1157,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,/* PrintName + SubstituteName. */ rs->SubstituteNameOffset =cpu_to_le16 (sizeof (short ) * err); - rs->SubstituteNameLength =cpu_to_le16 (sizeof (short ) * err +8 ); + rs->SubstituteNameLength =cpu_to_le16 (sizeof (short ) * err + (is_absolute ?8 :0 )); rs->PrintNameLength = rs->SubstituteNameOffset;/*
@@ -1162,16 +1165,18 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,* parse this path. * 0-absolute path 1- relative path (SYMLINK_FLAG_RELATIVE). */ - rs->Flags =0 ; + rs->Flags =cpu_to_le32 (is_absolute ?0 :SYMLINK_FLAG_RELATIVE ); -memmove (rp_name + err +4 , rp_name,sizeof (short ) * err); +memmove (rp_name + err + (is_absolute ?4 :0 ), rp_name,sizeof (short ) * err); -/* Decorate SubstituteName. */ - rp_name += err; - rp_name[0 ] =cpu_to_le16 ('\\' ); - rp_name[1 ] =cpu_to_le16 ('?' ); - rp_name[2 ] =cpu_to_le16 ('?' ); - rp_name[3 ] =cpu_to_le16 ('\\' ); +if (is_absolute) { +/* Decorate SubstituteName. */ + rp_name += err; + rp_name[0 ] =cpu_to_le16 ('\\' ); + rp_name[1 ] =cpu_to_le16 ('?' ); + rp_name[2 ] =cpu_to_le16 ('?' ); + rp_name[3 ] =cpu_to_le16 ('\\' ); + }return rp; out:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/444 md: Dont clear MD_CLOSING until mddev is freed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Ni <[email protected]>
[ Upstream commit 5f286f33553d600e6c2fb5a23dd6afcf99b3ebac ]
UNTIL_STOP is used to avoid mddev is freed on the last close before adding disks to mddev. And it should be cleared when stopping an array which is mentioned in commit efeb53c0e572 ("md: Allow md devices to be created by name."). So reset ->hold_active to 0 in md_clean.
And MD_CLOSING should be kept until mddev is freed to avoid reopen.
--- drivers/md/md.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/md/md.c +4 -12
@@ -6380,15 +6380,10 @@ static void md_clean(struct mddev *mddev) mddev->persistent =0 ; mddev->level =LEVEL_NONE ; mddev->clevel[0 ] =0 ; -/* -* Don't clear MD_CLOSING, or mddev can be opened again. -* 'hold_active != 0' means mddev is still in the creation -* process and will be used later. -*/ -if (mddev->hold_active) - mddev->flags =0 ; -else - mddev->flags &=BIT_ULL_MASK (MD_CLOSING ); +/* if UNTIL_STOP is set, it's cleared here */ + mddev->hold_active =0 ; +/* Don't clear MD_CLOSING, or mddev can be opened again. */ + mddev->flags &=BIT_ULL_MASK (MD_CLOSING ); mddev->sb_flags =0 ; mddev->ro =MD_RDWR ; mddev->metadata_type[0 ] =0 ;
@@ -6615,9 +6610,6 @@ static int do_md_stop(struct mddev *mddev, int mode)export_array (mddev);md_clean (mddev);set_bit (MD_DELETED , &mddev->flags); - -if (mddev->hold_active ==UNTIL_STOP ) - mddev->hold_active =0 ; }md_new_event ();sysfs_notify_dirent_safe (mddev->sysfs_state);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/444 pidfs: raise SB_I_NODEV and SB_I_NOEXEC
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
[ Upstream commit 1a1ad73aa1a66787f05f7f10f686b74bab77be72 ]
Similar to commit 1ed95281c0c7 ("anon_inode: raise SB_I_NODEV and SB_I_NOEXEC"):
it shouldn't be possible to execute pidfds via execveat(fd_anon_inode, "", NULL, NULL, AT_EMPTY_PATH)
so raise SB_I_NOEXEC so that no one gets any creative ideas.
Also raise SB_I_NODEV as we don't expect or support any devices on pidfs.
--- fs/pidfs.c | 2 ++ 1 file changed, 2 insertions(+)
fs/pidfs.c +2 -0
@@ -382,6 +382,8 @@ static int pidfs_init_fs_context(struct fs_context *fc)if (!ctx)return -ENOMEM ; + fc->s_iflags |=SB_I_NOEXEC ; + fc->s_iflags |=SB_I_NODEV ; ctx->ops = &pidfs_sops; ctx->dops = &pidfs_dentry_operations; fc->s_fs_info = (void *)&pidfs_stashed_ops;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/444 ext2: Handle fiemap on empty files to prevent EINVAL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Gao <[email protected]>
[ Upstream commit a099b09a3342a0b28ea330e405501b5b4d0424b4 ]
Previously, ext2_fiemap would unconditionally apply "len = min_t(u64, len, i_size_read(inode));", When inode->i_size was 0 (for an empty file), this would reduce the requested len to 0. Passing len = 0 to iomap_fiemap could then result in an -EINVAL error, even for valid queries on empty files.
--- fs/ext2/inode.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/ext2/inode.c +11 -1
@@ -895,9 +895,19 @@ int ext2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, u64 start, u64 len) { int ret; +loff_t i_size;inode_lock (inode); - len =min_t (u64, len,i_size_read (inode)); + i_size =i_size_read (inode); +/* +* iomap_fiemap() returns EINVAL for 0 length. Make sure we don't trim +* length to 0 but still trim the range as much as possible since +* ext2_get_blocks() iterates unmapped space block by block which is +* slow. +*/ +if (i_size ==0 ) + i_size =1 ; + len =min_t (u64, len, i_size); ret =iomap_fiemap (inode, fieinfo, start, len, &ext2_iomap_ops);inode_unlock (inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/444 fix locking in efi_secret_unlink()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 2c58d42de71f9c73e40afacc9d062892d2cc8862 ]
We used to need securityfs_remove() to undo simple_pin_fs() done when the file had been created and to drop the second extra reference taken at the same time. Now that neither is needed (or done by securityfs_remove()), we can simply call simple_unlink() and be done with that - the broken games with locking had been there only for the sake of securityfs_remove().
--- drivers/virt/coco/efi_secret/efi_secret.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-)
drivers/virt/coco/efi_secret/efi_secret.c +1 -9
@@ -136,15 +136,7 @@ static int efi_secret_unlink(struct inode *dir, struct dentry *dentry)if (s->fs_files[i] == dentry) s->fs_files[i] =NULL ; -/* -* securityfs_remove tries to lock the directory's inode, but we reach -* the unlink callback when it's already locked -*/ -inode_unlock (dir); -securityfs_remove (dentry); -inode_lock (dir); - -return 0 ; +return simple_unlink (inode, dentry); }static const struct inode_operations efi_secret_dir_inode_operations = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/444 securityfs: dont pin dentries twice, once is enough...
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 27cd1bf1240d482e4f02ca4f9812e748f3106e4f ]
incidentally, securityfs_recursive_remove() is broken without that - it leaks dentries, since simple_recursive_removal() does not expect anything of that sort. It could be worked around by dput() in remove_one() callback, but it's easier to just drop that double-get stuff.
--- security/inode.c | 2 -- 1 file changed, 2 deletions(-)
security/inode.c +0 -2
@@ -159,7 +159,6 @@ static struct dentry *securityfs_create_dentry(const char *name, umode_t mode, inode->i_fop = fops; }d_instantiate (dentry, inode); -dget (dentry);inode_unlock (dir);return dentry;
@@ -306,7 +305,6 @@ void securityfs_remove(struct dentry *dentry)simple_rmdir (dir, dentry); elsesimple_unlink (dir ,dentry ); -dput (dentry); }inode_unlock (dir);simple_release_fs (&mount, &mount_count);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/444 tracefs: Add d_delete to remove negative dentries
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit d9b13cdad80dc11d74408cf201939a946e9303a6 ]
If a lookup in tracefs is done on a file that does not exist, it leaves a dentry hanging around until memory pressure removes it. But eventfs dentries should hang around as when their ref count goes to zero, it requires more work to recreate it. For the rest of the tracefs dentries, they hang around as their dentry is used as a descriptor for the tracing system. But if a file lookup happens for a file in tracefs that does not exist, it should be deleted.
Add a .d_delete callback that checks if dentry->fsdata is set or not. Only eventfs dentries set fsdata so if it has content it should not be deleted and should hang around in the cache.
--- fs/tracefs/inode.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
fs/tracefs/inode.c +11 -0
@@ -464,9 +464,20 @@ static int tracefs_d_revalidate(struct dentry *dentry, unsigned int flags)return !(ei && ei->is_freed); } +static int tracefs_d_delete (const struct dentry *dentry) +{ +/* +* We want to keep eventfs dentries around but not tracefs +* ones. eventfs dentries have content in d_fsdata. +* Use d_fsdata to determine if it's a eventfs dentry or not. +*/ +return dentry->d_fsdata ==NULL ; +} +static const struct dentry_operations tracefs_dentry_operations = { .d_revalidate = tracefs_d_revalidate, .d_release = tracefs_d_release, + .d_delete = tracefs_d_delete, };static int tracefs_fill_super (struct super_block *sb,struct fs_context *fc)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/444 usb: xhci: print xhci->xhc_state when queue_command failed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 7919407eca2ef562fa6c98c41cfdf6f6cdd69d92 ]
When encounters some errors like these:xhci_hcd 0000:4a:00.2: xHCI dying or halted, can't queue_command xhci_hcd 0000:4a:00.2: FIXME: allocate a command ring segment usb usb5-port6: couldn't allocate usb_device
It's hard to know whether xhc_state is dying or halted. So it's better to print xhc_state's value which can help locate the resaon of the bug.
--- drivers/usb/host/xhci-ring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-ring.c +2 -1
@@ -4378,7 +4378,8 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,if ((xhci->xhc_state &XHCI_STATE_DYING ) || (xhci->xhc_state &XHCI_STATE_HALTED )) { -xhci_dbg (xhci,"xHCI dying or halted, can't queue_command\n" ); +xhci_dbg (xhci,"xHCI dying or halted, can't queue_command. state: 0x%x\n" , + xhci->xhc_state);return -ESHUTDOWN ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/444 platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 4ff3aeb664f7dfe824ba91ffb0b203397a8d431e ]
The Lenovo Yoga 6 13ACL6 82ND has a similar BIOS problem as other Lenovo laptops from that vintage that causes a rather long resume from suspend.
Add it to the quirk list that manipulates the scratch register to avoid the issue.
--- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/amd/pmc/pmc-quirks.c +9 -0
@@ -189,6 +189,15 @@ static const struct dmi_system_id fwbug_list[] = { DMI_MATCH(DMI_PRODUCT_NAME, "82XQ"), } }, +/* https://gitlab.freedesktop.org/drm/amd/-/issues/4434 */ + { + .ident = "Lenovo Yoga 6 13ALC6", + .driver_data = &quirk_s2idle_bug, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "82ND"), + } + }, /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */ { .ident = "HP Laptop 15s-eq2xxx",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/444 cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashant Malani <[email protected]>
[ Upstream commit 0a1416a49e63c320f6e6c1c8d07e1b58c0d4a3f3 ]
AMU counters on certain CPPC-based platforms tend to yield inaccurate delivered performance measurements on systems that are idle/mostly idle. This results in an inaccurate frequency being stored by cpufreq in its policy structure when the CPU is brought online. [1]
Consequently, if the userspace governor tries to set the frequency to a new value, there is a possibility that it would be the erroneous value stored earlier. In such a scenario, cpufreq would assume that the requested frequency has already been set and return early, resulting in the correct/new frequency request never making it to the hardware.
Since the operating frequency is liable to this sort of inconsistency, mark the CPPC driver with CPUFREQ_NEED_UPDATE_LIMITS so that it is always invoked when a target frequency update is requested.
--- drivers/cpufreq/cppc_cpufreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/cppc_cpufreq.c +1 -1
@@ -841,7 +841,7 @@ static struct freq_attr *cppc_cpufreq_attr[] = { };static struct cpufreq_driver cppc_cpufreq_driver = { - .flags =CPUFREQ_CONST_LOOPS , + .flags =CPUFREQ_CONST_LOOPS |CPUFREQ_NEED_UPDATE_LIMITS , .verify = cppc_verify_policy, .target = cppc_cpufreq_set_target, .get = cppc_cpufreq_get_rate,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/444 selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cynthia Huang <[email protected]>
[ Upstream commit 04850819c65c8242072818655d4341e70ae998b5 ]
The kernel does not provide sys_futex() on 32-bit architectures that do not support 32-bit time representations, such as riscv32.
As a result, glibc cannot define SYS_futex, causing compilation failures in tests that rely on this syscall. Define SYS_futex as SYS_futex_time64 in such cases to ensure successful compilation and compatibility.
--- tools/testing/selftests/futex/include/futextest.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/testing/selftests/futex/include/futextest.h +11 -0
@@ -47,6 +47,17 @@ typedef volatile u_int32_t futex_t; FUTEX_PRIVATE_FLAG)#endif +/* +* SYS_futex is expected from system C library, in glibc some 32-bit +* architectures (e.g. RV32) are using 64-bit time_t, therefore it doesn't have +* SYS_futex defined but just SYS_futex_time64. Define SYS_futex as +* SYS_futex_time64 in this situation to ensure the compilation and the +* compatibility. +*/ +#if !defined(SYS_futex) && defined(SYS_futex_time64) +#define SYS_futex SYS_futex_time64 +#endif +/** * futex() - SYS_futex syscall wrapper * @uaddr: address of first futex
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/444 usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benson Leung <[email protected]>
[ Upstream commit af833e7f7db3cf4c82f063668e1b52297a30ec18 ]
ucsi_psy_get_current_max would return 0mA as the maximum current if UCSI detected a BC or a Default USB Power sporce.
The comment in this function is true that we can't tell the difference between DCP/CDP or SDP chargers, but we can guarantee that at least 1-unit of USB 1.1/2.0 power is available, which is 100mA, which is a better fallback value than 0, which causes some userspaces, including the ChromeOS power manager, to regard this as a power source that is not providing any power.
In reality, 100mA is guaranteed from all sources in these classes.
--- drivers/usb/typec/ucsi/psy.c | 2 +- drivers/usb/typec/ucsi/ucsi.h | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/usb/typec/ucsi/psy.c +1 -1
@@ -164,7 +164,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,case UCSI_CONSTAT_PWR_OPMODE_DEFAULT :/* UCSI can't tell b/w DCP/CDP or USB2/3x1/3x2 SDP chargers */ default : - val->intval =0 ; + val->intval =UCSI_TYPEC_DEFAULT_CURRENT *1000 ;break ; }return 0 ;
drivers/usb/typec/ucsi/ucsi.h +4 -3
@@ -412,9 +412,10 @@ struct ucsi {#define UCSI_MAX_SVID 5#define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6) -#define UCSI_TYPEC_VSAFE5V 5000 -#define UCSI_TYPEC_1_5_CURRENT 1500 -#define UCSI_TYPEC_3_0_CURRENT 3000 +#define UCSI_TYPEC_VSAFE5V 5000 +#define UCSI_TYPEC_DEFAULT_CURRENT 100 +#define UCSI_TYPEC_1_5_CURRENT 1500 +#define UCSI_TYPEC_3_0_CURRENT 3000struct ucsi_connector {int num;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/444 usb: xhci: Avoid showing warnings for dying controller
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 65fc0fc137b5da3ee1f4ca4f61050fcb203d7582 ]
When a USB4 dock is unplugged from a system it won't respond to ring events. The PCI core handles the surprise removal event and notifies all PCI drivers. The XHCI PCI driver sets a flag that the device is being removed, and when the device stops responding a flag is also added to indicate it's dying.
When that flag is set don't bother to show warnings about a missing controller.
--- drivers/usb/host/xhci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +4 -2
@@ -119,7 +119,8 @@ int xhci_halt(struct xhci_hcd *xhci) ret =xhci_handshake (&xhci->op_regs->status,STS_HALT ,STS_HALT ,XHCI_MAX_HALT_USEC );if (ret) { -xhci_warn (xhci,"Host halt failed, %d\n" , ret); +if (!(xhci->xhc_state &XHCI_STATE_DYING )) +xhci_warn (xhci,"Host halt failed, %d\n" , ret);return ret; }
@@ -178,7 +179,8 @@ int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) state =readl (&xhci->op_regs->status);if (state == ~(u32 )0 ) { -xhci_warn (xhci,"Host not accessible, reset failed.\n" ); +if (!(xhci->xhc_state &XHCI_STATE_DYING )) +xhci_warn (xhci,"Host not accessible, reset failed.\n" );return -ENODEV ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/444 usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Chen <[email protected]>
[ Upstream commit f72b9aa821a2bfe4b6dfec4be19f264d0673b008 ]
There is a subtle contradiction between sections of the xHCI 1.2 spec regarding the initialization of Input Endpoint Context fields. Section 4.8.2 ("Endpoint Context Initialization") states that all fields should be initialized to 0. However, Section 6.2.3 ("Endpoint Context", p.453) specifies that the Average TRB Length (avg_trb_len) field shall be greater than 0, and explicitly notes (p.454): "Software shall set Average TRB Length to '8' for control endpoints."
Strictly setting all fields to 0 during initialization conflicts with the specific recommendation for control endpoints. In practice, setting avg_trb_len = 0 is not meaningful for the hardware/firmware, as the value is used for bandwidth calculation.
Motivation: Our company is developing a custom Virtual xHC hardware platform that strictly follows the xHCI spec and its recommendations. During validation, we observed that enumeration fails and a parameter error (TRB Completion Code = 5) is reported if avg_trb_len for EP0 is not set to 8 as recommended by Section 6.2.3. This demonstrates the importance of assigning a meaningful, non-zero value to avg_trb_len, even in virtualized or emulated environments.
This patch explicitly sets avg_trb_len to 8 for EP0 in xhci_setup_addressable_virt_dev(), as recommended in Section 6.2.3, to prevent potential issues with xHCI host controllers that enforce the spec strictly.
--- drivers/usb/host/xhci-mem.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/host/xhci-mem.c +2 -0
@@ -1172,6 +1172,8 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud ep0_ctx->deq =cpu_to_le64 (dev->eps[0 ].ring->first_seg->dma | dev->eps[0 ].ring->cycle_state); + ep0_ctx->tx_info =cpu_to_le32 (EP_AVG_TRB_LENGTH (8 )); +trace_xhci_setup_addressable_virt_device (dev);/* Steps 7 and 8 were done in xhci_alloc_virt_device() */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/444 usb: xhci: Avoid showing errors during surprise removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 4b9c60e440525b729ac5f071e00bcee12e0a7e84 ]
When a USB4 dock is unplugged from a system it won't respond to ring events. The PCI core handles the surprise removal event and notifies all PCI drivers. The XHCI PCI driver sets a flag that the device is being removed as well.
When that flag is set don't show messages in the cleanup path for marking the controller dead.
--- drivers/usb/host/xhci-ring.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-ring.c +5 -2
@@ -1313,12 +1313,15 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci,*/ void xhci_hc_died (struct xhci_hcd *xhci) { +bool notify;int i, j;if (xhci->xhc_state &XHCI_STATE_DYING )return ; -xhci_err (xhci,"xHCI host controller not responding, assume dead\n" ); + notify = !(xhci->xhc_state &XHCI_STATE_REMOVING ); +if (notify) +xhci_err (xhci,"xHCI host controller not responding, assume dead\n" ); xhci->xhc_state |=XHCI_STATE_DYING ;xhci_cleanup_command_queue (xhci);
@@ -1332,7 +1335,7 @@ void xhci_hc_died(struct xhci_hcd *xhci) }/* inform usb core hc died if PCI remove isn't already handling it */ -if (!(xhci->xhc_state &XHCI_STATE_REMOVING )) +if (notify)usb_hc_died (xhci_to_hcd (xhci)); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/444 firmware: qcom: scm: initialize tzmem before marking SCM as available
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 87be3e7a2d0030cda6314d2ec96b37991f636ccd ]
Now that qcom_scm_shm_bridge_enable() uses the struct device passed to it as argument to make the QCOM_SCM_MP_SHM_BRIDGE_ENABLE SCM call, we can move the TZMem initialization before the assignment of the __scm pointer in the SCM driver (which marks SCM as ready to users) thus fixing the potential race between consumer calls and the memory pool initialization.
--- drivers/firmware/qcom/qcom_scm.c | 53 ++++++++++++++++---------------- 1 file changed, 26 insertions(+), 27 deletions(-)
drivers/firmware/qcom/qcom_scm.c +26 -27
@@ -2000,7 +2000,32 @@ static int qcom_scm_probe(struct platform_device *pdev)if (ret)return ret; -/* Paired with smp_load_acquire() in qcom_scm_is_available(). */ + ret =of_reserved_mem_device_init (scm->dev); +if (ret && ret != -ENODEV ) +return dev_err_probe (scm->dev, ret, +"Failed to setup the reserved memory region for TZ mem\n" ); + + ret =qcom_tzmem_enable (scm->dev); +if (ret) +return dev_err_probe (scm->dev, ret, +"Failed to enable the TrustZone memory allocator\n" ); + +memset (&pool_config,0 ,sizeof (pool_config)); + pool_config.initial_size =0 ; + pool_config.policy =QCOM_TZMEM_POLICY_ON_DEMAND ; + pool_config.max_size =SZ_256K ; + + scm->mempool =devm_qcom_tzmem_pool_new (scm->dev, &pool_config); +if (IS_ERR (scm->mempool)) +return dev_err_probe (scm->dev,PTR_ERR (scm->mempool), +"Failed to create the SCM memory pool\n" ); + +/* +* Paired with smp_load_acquire() in qcom_scm_is_available(). +* +* This marks the SCM API as ready to accept user calls and can only +* be called after the TrustZone memory pool is initialized. +*/ smp_store_release (&__scm, scm); irq =platform_get_irq_optional (pdev,0 );
@@ -2033,32 +2058,6 @@ static int qcom_scm_probe(struct platform_device *pdev)if (of_property_read_bool (pdev->dev.of_node,"qcom,sdi-enabled" ) || !download_mode)qcom_scm_disable_sdi (); - ret =of_reserved_mem_device_init (__scm->dev); -if (ret && ret != -ENODEV ) { -dev_err_probe (__scm->dev, ret, -"Failed to setup the reserved memory region for TZ mem\n" ); - goto err; - } - - ret =qcom_tzmem_enable (__scm->dev); -if (ret) { -dev_err_probe (__scm->dev, ret, -"Failed to enable the TrustZone memory allocator\n" ); - goto err; - } - -memset (&pool_config,0 ,sizeof (pool_config)); - pool_config.initial_size =0 ; - pool_config.policy =QCOM_TZMEM_POLICY_ON_DEMAND ; - pool_config.max_size =SZ_256K ; - - __scm->mempool =devm_qcom_tzmem_pool_new (__scm->dev, &pool_config); -if (IS_ERR (__scm->mempool)) { - ret =dev_err_probe (__scm->dev,PTR_ERR (__scm->mempool), -"Failed to create the SCM memory pool\n" ); - goto err; - } -/* * Initialize the QSEECOM interface. *
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/444 soc: qcom: rpmh-rsc: Add RSC version 4 support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maulik Shah <[email protected]>
[ Upstream commit 84684c57c9cd47b86c883a7170dd68222d97ef13 ]
Register offsets for v3 and v4 versions are backward compatible. Assign v3 offsets for v4 and all higher versions to avoid end up using v2 offsets.
--- drivers/soc/qcom/rpmh-rsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/rpmh-rsc.c +1 -1
@@ -1075,7 +1075,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev) drv->ver.minor = rsc_id & (MINOR_VER_MASK <<MINOR_VER_SHIFT ); drv->ver.minor >>=MINOR_VER_SHIFT ; -if (drv->ver.major ==3 ) +if (drv->ver.major >=3 ) drv->regs = rpmh_rsc_reg_offset_ver_3_0;else drv->regs = rpmh_rsc_reg_offset_ver_2_7;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/444 ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
[ Upstream commit 79a5ae3c4c5eb7e38e0ebe4d6bf602d296080060 ]
If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, the CPU will take a synchronous error exception such as Synchronous External Abort (SEA) on Arm64. The kernel will queue a memory_failure() work which poisons the related page, unmaps the page, and then sends a SIGBUS to the process, so that a system wide panic can be avoided.
However, no memory_failure() work will be queued when abnormal synchronous errors occur. These errors can include situations like invalid PA, unexpected severity, no memory failure config support, invalid GUID section, etc. In such a case, the user-space process will trigger SEA again. This loop can potentially exceed the platform firmware threshold or even trigger a kernel hard lockup, leading to a system reboot.
Fix it by performing a force kill if no memory_failure() work is queued for synchronous errors.
--- drivers/acpi/apei/ghes.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/acpi/apei/ghes.c +11 -0
@@ -799,6 +799,17 @@ static bool ghes_do_proc(struct ghes *ghes, } } +/* +* If no memory failure work is queued for abnormal synchronous +* errors, do a force kill. +*/ +if (sync && !queued) { +dev_err (ghes->dev, + HW_ERR GHES_PFX "%s:%d: synchronous unrecoverable error (SIGBUS)\n", + current->comm,task_pid_nr (current)); +force_sig (SIGBUS ); + } +return queued; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/444 remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiago De Franco <[email protected]>
[ Upstream commit 496deecb020d14ba89ba7084fbc3024f91687023 ]
For the i.MX8X and i.MX8 family SoCs, when the Cortex-M core is powered up and started by the Cortex-A core using the bootloader (e.g., via the U-Boot bootaux command), both M-core and Linux run within the same SCFW (System Controller Firmware) partition. With that, Linux has permission to control the M-core.
But once the M-core is started by the bootloader, the SCFW automatically enables its clock and sets the clock rate. If Linux later attempts to enable the same clock via clk_prepare_enable(), the SCFW returns a 'LOCKED' error, as the clock is already configured by the SCFW. This causes the probe function in imx_rproc.c to fail, leading to the M-core power domain being shut down while the core is still running. This results in a fault from the SCU (System Controller Unit) and triggers a system reset.
To address this issue, ignore handling the clk for i.MX8X and i.MX8 M-core, as SCFW already takes care of enabling and configuring the clock.
--- drivers/remoteproc/imx_rproc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/remoteproc/imx_rproc.c +2 -2
@@ -1029,8 +1029,8 @@ static int imx_rproc_clk_enable(struct imx_rproc *priv)struct device *dev = priv->dev;int ret; -/* Remote core is not under control of Linux */ -if (dcfg->method ==IMX_RPROC_NONE ) +/* Remote core is not under control of Linux or it is managed by SCU API */ +if (dcfg->method ==IMX_RPROC_NONE || dcfg->method ==IMX_RPROC_SCU_API )return 0 ; priv->clk =devm_clk_get (dev,NULL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/444 usb: typec: tcpm/tcpci_maxim: fix irq wake usage
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
[ Upstream commit 31611223fb34a3e9320cdfc4f4395072a13ea78e ]
This driver calls enable_irq_wake() during probe() unconditionally, and never issues the required corresponding disable_irq_wake() to disable hardware interrupt wakeup signals.
Additionally, whether or not a device should wake-up the system is meant to be a policy decision based on sysfs (.../power/wakeup) in the first place.
Update the driver to use the standard approach to enable/disable IRQ wake during the suspend/resume callbacks. This solves both issues described above.
--- drivers/usb/typec/tcpm/tcpci_maxim_core.c | 46 +++++++++++++++-------- 1 file changed, 30 insertions(+), 16 deletions(-)
drivers/usb/typec/tcpm/tcpci_maxim_core.c +30 -16
@@ -421,21 +421,6 @@ static irqreturn_t max_tcpci_isr(int irq, void *dev_id)return IRQ_WAKE_THREAD ; } -static int max_tcpci_init_alert (struct max_tcpci_chip *chip,struct i2c_client *client) -{ -int ret; - - ret =devm_request_threaded_irq (chip->dev, client->irq, max_tcpci_isr, max_tcpci_irq, - (IRQF_TRIGGER_LOW |IRQF_ONESHOT ),dev_name (chip->dev), - chip); - -if (ret <0 ) -return ret; - -enable_irq_wake (client->irq); -return 0 ; -} -static int max_tcpci_start_toggling (struct tcpci *tcpci,struct tcpci_data *tdata,enum typec_cc_status cc) {
@@ -532,7 +517,9 @@ static int max_tcpci_probe(struct i2c_client *client) chip->port =tcpci_get_tcpm_port (chip->tcpci); - ret =max_tcpci_init_alert (chip, client); + ret =devm_request_threaded_irq (&client->dev, client->irq, max_tcpci_isr, max_tcpci_irq, + (IRQF_TRIGGER_LOW |IRQF_ONESHOT ),dev_name (chip->dev), + chip);if (ret <0 )return dev_err_probe (&client->dev, ret,"IRQ initialization failed\n" );
@@ -541,6 +528,32 @@ static int max_tcpci_probe(struct i2c_client *client)return 0 ; } +#ifdef CONFIG_PM_SLEEP +static int max_tcpci_resume (struct device *dev) +{ +struct i2c_client *client =to_i2c_client (dev); +int ret =0 ; + +if (client->irq &&device_may_wakeup (dev)) + ret =disable_irq_wake (client->irq); + +return ret; +} + +static int max_tcpci_suspend (struct device *dev) +{ +struct i2c_client *client =to_i2c_client (dev); +int ret =0 ; + +if (client->irq &&device_may_wakeup (dev)) + ret =enable_irq_wake (client->irq); + +return ret; +} +#endif /* CONFIG_PM_SLEEP */ + +static SIMPLE_DEV_PM_OPS(max_tcpci_pm_ops, max_tcpci_suspend, max_tcpci_resume); +static const struct i2c_device_id max_tcpci_id[] = { {"maxtcpc" }, { }
@@ -559,6 +572,7 @@ static struct i2c_driver max_tcpci_i2c_driver = { .driver = { .name = "maxtcpc", .of_match_table = of_match_ptr(max_tcpci_of_match), + .pm = &max_tcpci_pm_ops, }, .probe = max_tcpci_probe, .id_table = max_tcpci_id,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/444 pmdomain: ti: Select PM_GENERIC_DOMAINS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume La Roque <[email protected]>
[ Upstream commit fcddcb7e8f38a40db99f87a962c5d0a153a76566 ]
Select PM_GENERIC_DOMAINS instead of depending on it to ensure it is always enabled when TI_SCI_PM_DOMAINS is selected. Since PM_GENERIC_DOMAINS is an implicit symbol, it can only be enabled through 'select' and cannot be explicitly enabled in configuration. This simplifies the dependency chain and prevents build issues
--- drivers/pmdomain/ti/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pmdomain/ti/Kconfig +1 -1
@@ -10,7 +10,7 @@ if SOC_TI config TI_SCI_PM_DOMAINS tristate "TI SCI PM Domains Driver" depends on TI_SCI_PROTOCOL - depends on PM_GENERIC_DOMAINS + select PM_GENERIC_DOMAINS if PM help Generic power domain implementation for TI device implementing the TI SCI protocol.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/444 gpio: wcd934x: check the return value of regmap_update_bits()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit ff0f0d7c6587e38c308be9905e36f86e98fb9c1f ]
regmap_update_bits() can fail so check its return value in wcd_gpio_direction_output() for consistency with the rest of the code and propagate any errors.
--- drivers/gpio/gpio-wcd934x.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpio/gpio-wcd934x.c +5 -2
@@ -46,9 +46,12 @@ static int wcd_gpio_direction_output(struct gpio_chip *chip, unsigned int pin, int val) {struct wcd_gpio_data *data =gpiochip_get_data (chip); +int ret; -regmap_update_bits (data->map,WCD_REG_DIR_CTL_OFFSET , -WCD_PIN_MASK (pin),WCD_PIN_MASK (pin)); + ret =regmap_update_bits (data->map,WCD_REG_DIR_CTL_OFFSET , +WCD_PIN_MASK (pin),WCD_PIN_MASK (pin)); +if (ret) +return ret; return regmap_update_bits(data->map, WCD_REG_VAL_CTL_OFFSET, WCD_PIN_MASK(pin),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/444 cpufreq: Exit governor when failed to start old governor
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 0ae204405095abfbc2d694ee0fbb49bcbbe55c57 ]
Detect the result of starting old governor in cpufreq_set_policy(). If it fails, exit the governor and clear policy->governor.
--- drivers/cpufreq/cpufreq.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/cpufreq/cpufreq.c +5 -3
@@ -2724,10 +2724,12 @@ static int cpufreq_set_policy(struct cpufreq_policy *policy,pr_debug ("starting governor %s failed\n" , policy->governor->name);if (old_gov) { policy->governor = old_gov; -if (cpufreq_init_governor (policy)) +if (cpufreq_init_governor (policy)) { policy->governor =NULL ; -else -cpufreq_start_governor (policy); + }else if (cpufreq_start_governor (policy)) { +cpufreq_exit_governor (policy); + policy->governor =NULL ; + } }return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/444 cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit fc64e0421598aaa87d61184f6777b52614a095be ]
Users may disable HWP in firmware, in which case intel_pstate wouldn't load unless the CPU model is explicitly supported.
--- drivers/cpufreq/intel_pstate.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/cpufreq/intel_pstate.c +2 -0
@@ -2654,6 +2654,8 @@ static const struct x86_cpu_id intel_pstate_cpu_ids[] = {X86_MATCH (INTEL_TIGERLAKE , core_funcs),X86_MATCH (INTEL_SAPPHIRERAPIDS_X , core_funcs),X86_MATCH (INTEL_EMERALDRAPIDS_X , core_funcs), +X86_MATCH (INTEL_GRANITERAPIDS_D , core_funcs), +X86_MATCH (INTEL_GRANITERAPIDS_X , core_funcs), {} };MODULE_DEVICE_TABLE (x86cpu, intel_pstate_cpu_ids);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/444 ARM: rockchip: fix kernel hang during smp initialization
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Kochetkov <[email protected]>
[ Upstream commit 7cdb433bb44cdc87dc5260cdf15bf03cc1cd1814 ]
In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect.
The patch moves SRAM initialization step to the point where all secondary CPUs are powered down.
That fixes rarely hangs on RK3188:
[ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4
--- arch/arm/mach-rockchip/platsmp.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
arch/arm/mach-rockchip/platsmp.c +9 -6
@@ -279,11 +279,6 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus) }if (read_cpuid_part () ==ARM_CPU_PART_CORTEX_A9 ) { -if (rockchip_smp_prepare_sram (node)) { -of_node_put (node); -return ; - } -/* enable the SCU power domain */ pmu_set_power_domain (PMU_PWRDN_SCU , true);
@@ -316,11 +311,19 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus) asm ("mrc p15, 1, %0, c9, c0, 2\n" :"=r" (l2ctlr)); ncores = ((l2ctlr >>24 ) &0x3 ) +1 ; } -of_node_put (node);/* Make sure that all cores except the first are really off */ for (i =1 ; i < ncores; i++)pmu_set_power_domain (0 + i, false); + +if (read_cpuid_part () ==ARM_CPU_PART_CORTEX_A9 ) { +if (rockchip_smp_prepare_sram (node)) { +of_node_put (node); +return ; + } + } + +of_node_put (node); }static void __init rk3036_smp_prepare_cpus (unsigned int max_cpus)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/444 PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 914cc799b28f17d369d5b4db3b941957d18157e8 ]
Replace sscanf() with kstrtoul() in set_freq_store() and check the result to avoid invalid input.
--- drivers/devfreq/governor_userspace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/devfreq/governor_userspace.c +5 -1
@@ -9,6 +9,7 @@#include <linux/slab.h> #include <linux/device.h> #include <linux/devfreq.h> +#include <linux/kstrtox.h> #include <linux/pm.h> #include <linux/mutex.h> #include <linux/module.h>
@@ -39,10 +40,13 @@ static ssize_t set_freq_store(struct device *dev, struct device_attribute *attr,unsigned long wanted;int err =0 ; + err =kstrtoul (buf,0 , &wanted); +if (err) +return err; +mutex_lock (&devfreq->lock); data = devfreq->governor_data; -sscanf (buf,"%lu" , &wanted); data->user_frequency = wanted; data->valid = true; err =update_devfreq (devfreq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/444 EDAC/synopsys: Clear the ECC counters on init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <[email protected]>
[ Upstream commit b1dc7f097b78eb8d25b071ead2384b07a549692b ]
Clear the ECC error and counter registers during initialization/probe to avoid reporting stale errors that may have occurred before EDAC registration.
For that, unify the Zynq and ZynqMP ECC state reading paths and simplify the code.
[ bp: Massage commit message.
Fix an -Wsometimes-uninitialized warning as reported by
--- drivers/edac/synopsys_edac.c | 97 +++++++++++++++++------------------- 1 file changed, 46 insertions(+), 51 deletions(-)
drivers/edac/synopsys_edac.c +46 -51
@@ -332,20 +332,26 @@ struct synps_edac_priv {#endif }; +enum synps_platform_type { +ZYNQ , +ZYNQMP , +SYNPS , +}; +/** * struct synps_platform_data - synps platform data structure. +* @platform: Identifies the target hardware platform * @get_error_info: Get EDAC error info. * @get_mtype: Get mtype. * @get_dtype: Get dtype. -* @get_ecc_state: Get ECC state. * @get_mem_info: Get EDAC memory info * @quirks: To differentiate IPs. */ struct synps_platform_data { +enum synps_platform_type platform;int (*get_error_info)(struct synps_edac_priv *priv);enum mem_type (*get_mtype)(const void __iomem *base);enum dev_type (*get_dtype)(const void __iomem *base); -bool (*get_ecc_state)(void __iomem *base);#ifdef CONFIG_EDAC_DEBUG u64 (*get_mem_info)(struct synps_edac_priv *priv);#endif
@@ -720,51 +726,38 @@ static enum dev_type zynqmp_get_dtype(const void __iomem *base)return dt; } -/** -* zynq_get_ecc_state - Return the controller ECC enable/disable status. -* @base: DDR memory controller base address. -* -* Get the ECC enable/disable status of the controller. -* -* Return: true if enabled, otherwise false. -*/ -static bool zynq_get_ecc_state (void __iomem *base) +static bool get_ecc_state (struct synps_edac_priv *priv) { +u32 ecctype, clearval;enum dev_type dt; -u32 ecctype; - - dt =zynq_get_dtype (base); -if (dt ==DEV_UNKNOWN ) -return false; - ecctype =readl (base +SCRUB_OFST ) &SCRUB_MODE_MASK ; -if ((ecctype ==SCRUB_MODE_SECDED ) && (dt ==DEV_X2 )) -return true; - -return false; -} - -/** -* zynqmp_get_ecc_state - Return the controller ECC enable/disable status. -* @base: DDR memory controller base address. -* -* Get the ECC enable/disable status for the controller. -* -* Return: a ECC status boolean i.e true/false - enabled/disabled. -*/ -static bool zynqmp_get_ecc_state (void __iomem *base) -{ -enum dev_type dt; -u32 ecctype; - - dt =zynqmp_get_dtype (base); -if (dt ==DEV_UNKNOWN ) -return false; - - ecctype =readl (base +ECC_CFG0_OFST ) &SCRUB_MODE_MASK ; -if ((ecctype ==SCRUB_MODE_SECDED ) && - ((dt ==DEV_X2 ) || (dt ==DEV_X4 ) || (dt ==DEV_X8 ))) -return true; +if (priv->p_data->platform ==ZYNQ ) { + dt =zynq_get_dtype (priv->baseaddr); +if (dt ==DEV_UNKNOWN ) +return false; + + ecctype =readl (priv->baseaddr +SCRUB_OFST ) &SCRUB_MODE_MASK ; +if (ecctype ==SCRUB_MODE_SECDED && dt ==DEV_X2 ) { + clearval =ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_UE_ERR ; +writel (clearval, priv->baseaddr +ECC_CTRL_OFST ); +writel (0x0 , priv->baseaddr +ECC_CTRL_OFST ); +return true; + } + }else { + dt =zynqmp_get_dtype (priv->baseaddr); +if (dt ==DEV_UNKNOWN ) +return false; + + ecctype =readl (priv->baseaddr +ECC_CFG0_OFST ) &SCRUB_MODE_MASK ; +if (ecctype ==SCRUB_MODE_SECDED && + (dt ==DEV_X2 || dt ==DEV_X4 || dt ==DEV_X8 )) { + clearval =readl (priv->baseaddr +ECC_CLR_OFST ) | +ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_CE_ERRCNT | +ECC_CTRL_CLR_UE_ERR |ECC_CTRL_CLR_UE_ERRCNT ; +writel (clearval, priv->baseaddr +ECC_CLR_OFST ); +return true; + } + }return false; }
@@ -934,18 +927,18 @@ static int setup_irq(struct mem_ctl_info *mci, }static const struct synps_platform_data zynq_edac_def = { + .platform =ZYNQ , .get_error_info = zynq_get_error_info, .get_mtype = zynq_get_mtype, .get_dtype = zynq_get_dtype, - .get_ecc_state = zynq_get_ecc_state, .quirks =0 , };static const struct synps_platform_data zynqmp_edac_def = { + .platform =ZYNQMP , .get_error_info = zynqmp_get_error_info, .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, - .get_ecc_state = zynqmp_get_ecc_state, #ifdef CONFIG_EDAC_DEBUG .get_mem_info = zynqmp_get_mem_info, #endif
@@ -957,10 +950,10 @@ static const struct synps_platform_data zynqmp_edac_def = { };static const struct synps_platform_data synopsys_edac_def = { + .platform =SYNPS , .get_error_info = zynqmp_get_error_info, .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, - .get_ecc_state = zynqmp_get_ecc_state, .quirks = (DDR_ECC_INTR_SUPPORT | DDR_ECC_INTR_SELF_CLEAR #ifdef CONFIG_EDAC_DEBUG | DDR_ECC_DATA_POISON_SUPPORT
@@ -1390,10 +1383,6 @@ static int mc_probe(struct platform_device *pdev)if (!p_data)return -ENODEV ; -if (!p_data->get_ecc_state (baseaddr)) { -edac_printk (KERN_INFO ,EDAC_MC ,"ECC not enabled\n" ); -return -ENXIO ; - } layers[0 ].type =EDAC_MC_LAYER_CHIP_SELECT ; layers[0 ].size =SYNPS_EDAC_NR_CSROWS ;
@@ -1413,6 +1402,12 @@ static int mc_probe(struct platform_device *pdev) priv = mci->pvt_info; priv->baseaddr = baseaddr; priv->p_data = p_data; +if (!get_ecc_state (priv)) { +edac_printk (KERN_INFO ,EDAC_MC ,"ECC not enabled\n" ); + rc = -ENODEV ; + goto free_edac_mc; + } +spin_lock_init (&priv->reglock);mc_init (mci, pdev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/444 ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit f40ecc2743652c0b0f19935f81baf57c601eb7f0 ]
ASoC has 2 functions to set bias level.
(A) snd_soc_dapm_force_bias_level() (B) snd_soc_dapm_set_bias_level()
snd_soc_dapm_force_bias_level() (A) will set dapm->bias_level (a) if successed.
(A) int snd_soc_dapm_force_bias_level(...)
{
...
if (ret == 0)
(a) dapm->bias_level = level;
...
}snd_soc_dapm_set_bias_level() (B) is also a function that sets bias_level. It will call snd_soc_dapm_force_bias_level() (A) inside, but doesn't set dapm->bias_level by itself. One note is that (A) might not be called.
(B) static int snd_soc_dapm_set_bias_level(...)
{
...
ret = snd_soc_card_set_bias_level(...);
...
if (dapm != &card->dapm)
(A) ret = snd_soc_dapm_force_bias_level(...);
...
ret = snd_soc_card_set_bias_level_post(...);
...
}dapm->bias_level will be set if (A) was called, but might not be set if (B) was called, even though it calles set_bias_level() function.
We should set dapm->bias_level if we callssnd_soc_dapm_set_bias_level() (B), too.
--- sound/soc/soc-dapm.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/soc-dapm.c +4 -0
@@ -740,6 +740,10 @@ static int snd_soc_dapm_set_bias_level(struct snd_soc_dapm_context *dapm, out:trace_snd_soc_bias_level_done (dapm, level); +/* success */ +if (ret ==0 ) +snd_soc_dapm_init_bias_level (dapm, level); +return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/444 thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Collins <[email protected]>
[ Upstream commit f8e157ff2df46ddabd930815d196895976227831 ]
Certain TEMP_ALARM GEN2 PMIC peripherals need over-temperature stage 2 automatic PMIC partial shutdown. This will ensure that in the event of reaching the hotter stage 3 over-temperature threshold, repeated faults will be avoided during the automatic PMIC hardware full shutdown. Modify the stage 2 shutdown control logic to ensure that stage 2 shutdown is enabled on all affected PMICs. Read the digital major and minor revision registers to identify these PMICs.
--- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 43 ++++++++++++++++----- 1 file changed, 34 insertions(+), 9 deletions(-)
drivers/thermal/qcom/qcom-spmi-temp-alarm.c +34 -9
@@ -1,6 +1,7 @@// SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2011-2015, 2017, 2020, The Linux Foundation. All rights reserved. +* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include <linux/bitops.h>
@@ -16,6 +17,7 @@#include "../thermal_hwmon.h" +#define QPNP_TM_REG_DIG_MINOR 0x00#define QPNP_TM_REG_DIG_MAJOR 0x01#define QPNP_TM_REG_TYPE 0x04#define QPNP_TM_REG_SUBTYPE 0x05
@@ -31,7 +33,7 @@#define STATUS_GEN2_STATE_MASK GENMASK(6, 4)#define STATUS_GEN2_STATE_SHIFT 4 -#define SHUTDOWN_CTRL1_OVERRIDE_S2 BIT(6) +#define SHUTDOWN_CTRL1_OVERRIDE_STAGE2 BIT(6)#define SHUTDOWN_CTRL1_THRESHOLD_MASK GENMASK(1, 0)#define SHUTDOWN_CTRL1_RATE_25HZ BIT(3)
@@ -78,6 +80,7 @@ struct qpnp_tm_chip {/* protects .thresh, .stage and chip registers */ struct mutex lock;bool initialized; +bool require_stage2_shutdown;struct iio_channel *adc;const long (*temp_map)[THRESH_COUNT ][STAGE_COUNT ];
@@ -220,13 +223,13 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, {long stage2_threshold_min = (*chip->temp_map)[THRESH_MIN ][1 ];long stage2_threshold_max = (*chip->temp_map)[THRESH_MAX ][1 ]; -bool disable_s2_shutdown = false; +bool disable_stage2_shutdown = false;u8 reg;WARN_ON (!mutex_is_locked (&chip->lock));/* -* Default: S2 and S3 shutdown enabled, thresholds at +* Default: Stage 2 and Stage 3 shutdown enabled, thresholds at * lowest threshold set, monitoring at 25Hz */ reg =SHUTDOWN_CTRL1_RATE_25HZ ;
@@ -241,12 +244,12 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, chip->thresh =THRESH_MAX - ((stage2_threshold_max - temp) /TEMP_THRESH_STEP ); - disable_s2_shutdown = true; + disable_stage2_shutdown = true; }else { chip->thresh =THRESH_MAX ;if (chip->adc) - disable_s2_shutdown = true; + disable_stage2_shutdown = true;else dev_warn(chip->dev, "No ADC is configured and critical temperature %d mC is above the maximum stage 2 threshold of %ld mC! Configuring stage 2 shutdown at %ld mC.\n",
@@ -255,8 +258,8 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, skip: reg |= chip->thresh; -if (disable_s2_shutdown) - reg |=SHUTDOWN_CTRL1_OVERRIDE_S2 ; +if (disable_stage2_shutdown && !chip->require_stage2_shutdown) + reg |=SHUTDOWN_CTRL1_OVERRIDE_STAGE2 ;return qpnp_tm_write (chip,QPNP_TM_REG_SHUTDOWN_CTRL1 , reg); }
@@ -350,8 +353,8 @@ static int qpnp_tm_probe(struct platform_device *pdev) {struct qpnp_tm_chip *chip;struct device_node *node; -u8 type, subtype, dig_major; -u32 res; +u8 type, subtype, dig_major, dig_minor; +u32 res, dig_revision;int ret, irq; node = pdev->dev.of_node;
@@ -403,6 +406,11 @@ static int qpnp_tm_probe(struct platform_device *pdev)return dev_err_probe (&pdev->dev, ret,"could not read dig_major\n" ); + ret =qpnp_tm_read (chip,QPNP_TM_REG_DIG_MINOR , &dig_minor); +if (ret <0 ) +return dev_err_probe (&pdev->dev, ret, +"could not read dig_minor\n" ); +if (type !=QPNP_TM_TYPE || (subtype !=QPNP_TM_SUBTYPE_GEN1 && subtype !=QPNP_TM_SUBTYPE_GEN2 )) { dev_err(&pdev->dev, "invalid type 0x%02x or subtype 0x%02x\n",
@@ -416,6 +424,23 @@ static int qpnp_tm_probe(struct platform_device *pdev)else chip->temp_map = &temp_map_gen1; +if (chip->subtype ==QPNP_TM_SUBTYPE_GEN2 ) { + dig_revision = (dig_major <<8 ) | dig_minor; +/* +* Check if stage 2 automatic partial shutdown must remain +* enabled to avoid potential repeated faults upon reaching +* over-temperature stage 3. +*/ +switch (dig_revision) { +case 0x0001 : +case 0x0002 : +case 0x0100 : +case 0x0101 : + chip->require_stage2_shutdown = true; +break ; + } + } +/* * Register the sensor before initializing the hardware to be able to * read the trip points. get_temp() returns the default temperature
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/444 tools/nolibc: define time_t in terms of __kernel_old_time_t
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit d5094bcb5bfdfea2cf0de8aaf77cc65db56cbdb5 ]
Nolibc assumes that the kernel ABI is using a time values that are as large as a long integer. For most ABIs this holds true.
But for x32 this is not correct, as it uses 32bit longs but 64bit times.
Also the 'struct stat' implementation of nolibc relies on timespec::tv_sec and time_t being the same type. While timespec::tv_sec comes from the kernel and is of type __kernel_old_time_t, time_t is defined within nolibc.
Switch to the __kernel_old_time_t to always get the correct type.
--- tools/include/nolibc/std.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/include/nolibc/std.h +3 -1
@@ -20,6 +20,8 @@#include "stdint.h" +#include <linux/types.h> +/* those are commonly provided by sys/types.h */ typedef unsigned int dev_t ;typedef unsigned long ino_t ;
@@ -31,6 +33,6 @@ typedef unsigned long nlink_t;typedef signed long off_t ;typedef signed long blksize_t ;typedef signed long blkcnt_t ; -typedef signed long time_t ; +typedef __kernel_old_time_t time_t ;#endif /* _NOLIBC_STD_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/444 iio: adc: ad_sigma_delta: dont overallocate scan buffer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 5a2f15c5a8e017d0951e6dc62aa7b5b634f56881 ]
Fix overallocating the size of the scan buffer by converting bits to bytes. The size is meant to be in bytes, so scanbits needs to be divided by 8.
--- drivers/iio/adc/ad_sigma_delta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad_sigma_delta.c +1 -1
@@ -379,7 +379,7 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev)return ret; } - samples_buf_size =ALIGN (slot * indio_dev->channels[0 ].scan_type.storagebits,8 ); + samples_buf_size =ALIGN (slot * indio_dev->channels[0 ].scan_type.storagebits /8 ,8 ); samples_buf_size +=sizeof (int64_t ); samples_buf =devm_krealloc (&sigma_delta->spi->dev, sigma_delta->samples_buf, samples_buf_size,GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/444 gpio: tps65912: check the return value of regmap_update_bits()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit a0b2a6bbff8c26aafdecd320f38f52c341d5cafa ]
regmap_update_bits() can fail, check its return value like we do elsewhere in the driver.
--- drivers/gpio/gpio-tps65912.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpio/gpio-tps65912.c +5 -2
@@ -49,10 +49,13 @@ static int tps65912_gpio_direction_output(struct gpio_chip *gc, unsigned offset, int value) {struct tps65912_gpio *gpio =gpiochip_get_data (gc); +int ret;/* Set the initial value */ -regmap_update_bits (gpio->tps->regmap,TPS65912_GPIO1 + offset, -GPIO_SET_MASK , value ?GPIO_SET_MASK :0 ); + ret =regmap_update_bits (gpio->tps->regmap,TPS65912_GPIO1 + offset, +GPIO_SET_MASK , value ?GPIO_SET_MASK :0 ); +if (ret) +return ret;return regmap_update_bits (gpio->tps->regmap,TPS65912_GPIO1 + offset,GPIO_CFG_MASK ,GPIO_CFG_MASK );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/444 mfd: tps6594: Add TI TPS652G1 support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit 626bb0a45584d544d84eab909795ccb355062bcc ]
The TPS652G1 is a stripped down version of the TPS65224. From a software point of view, it lacks any voltage monitoring, the watchdog, the ESM and the ADC.
--- drivers/mfd/tps6594-core.c | 88 ++++++++++++++++++++++++++++++++++--- drivers/mfd/tps6594-i2c.c | 10 ++++- drivers/mfd/tps6594-spi.c | 10 ++++- include/linux/mfd/tps6594.h | 1 + 4 files changed, 99 insertions(+), 10 deletions(-)
drivers/mfd/tps6594-core.c +82 -6
@@ -1,6 +1,11 @@// SPDX-License-Identifier: GPL-2.0 /* -* Core functions for TI TPS65224/TPS6594/TPS6593/LP8764 PMICs +* Core functions for following TI PMICs: +* - LP8764 +* - TPS65224 +* - TPS652G1 +* - TPS6593 +* - TPS6594 * * Copyright (C) 2023 BayLibre Incorporated - https://www.baylibre.com/ */
@@ -414,6 +419,61 @@ static const unsigned int tps65224_irq_reg[] = { TPS6594_REG_INT_FSM_ERR, }; +/* TPS652G1 Resources */ + +static const struct mfd_cell tps652g1_common_cells[] = { +MFD_CELL_RES ("tps6594-pfsm" , tps65224_pfsm_resources), +MFD_CELL_RES ("tps6594-pinctrl" , tps65224_pinctrl_resources), +MFD_CELL_NAME ("tps6594-regulator" ), +}; + +static const struct regmap_irq tps652g1_irqs[] = { +/* INT_GPIO register */ +REGMAP_IRQ_REG (TPS65224_IRQ_GPIO1 ,2 ,TPS65224_BIT_GPIO1_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_GPIO2 ,2 ,TPS65224_BIT_GPIO2_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_GPIO3 ,2 ,TPS65224_BIT_GPIO3_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_GPIO4 ,2 ,TPS65224_BIT_GPIO4_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_GPIO5 ,2 ,TPS65224_BIT_GPIO5_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_GPIO6 ,2 ,TPS65224_BIT_GPIO6_INT ), + +/* INT_STARTUP register */ +REGMAP_IRQ_REG (TPS65224_IRQ_VSENSE ,3 ,TPS65224_BIT_VSENSE_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_ENABLE ,3 ,TPS6594_BIT_ENABLE_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_PB_SHORT ,3 ,TPS65224_BIT_PB_SHORT_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_FSD ,3 ,TPS6594_BIT_FSD_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_SOFT_REBOOT ,3 ,TPS6594_BIT_SOFT_REBOOT_INT ), + +/* INT_MISC register */ +REGMAP_IRQ_REG (TPS65224_IRQ_BIST_PASS ,4 ,TPS6594_BIT_BIST_PASS_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_EXT_CLK ,4 ,TPS6594_BIT_EXT_CLK_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_REG_UNLOCK ,4 ,TPS65224_BIT_REG_UNLOCK_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_TWARN ,4 ,TPS6594_BIT_TWARN_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_PB_LONG ,4 ,TPS65224_BIT_PB_LONG_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_PB_FALL ,4 ,TPS65224_BIT_PB_FALL_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_PB_RISE ,4 ,TPS65224_BIT_PB_RISE_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_ADC_CONV_READY ,4 ,TPS65224_BIT_ADC_CONV_READY_INT ), + +/* INT_MODERATE_ERR register */ +REGMAP_IRQ_REG (TPS65224_IRQ_TSD_ORD ,5 ,TPS6594_BIT_TSD_ORD_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_BIST_FAIL ,5 ,TPS6594_BIT_BIST_FAIL_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_REG_CRC_ERR ,5 ,TPS6594_BIT_REG_CRC_ERR_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_RECOV_CNT ,5 ,TPS6594_BIT_RECOV_CNT_INT ), + +/* INT_SEVERE_ERR register */ +REGMAP_IRQ_REG (TPS65224_IRQ_TSD_IMM ,6 ,TPS6594_BIT_TSD_IMM_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_VCCA_OVP ,6 ,TPS6594_BIT_VCCA_OVP_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_PFSM_ERR ,6 ,TPS6594_BIT_PFSM_ERR_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_BG_XMON ,6 ,TPS65224_BIT_BG_XMON_INT ), + +/* INT_FSM_ERR register */ +REGMAP_IRQ_REG (TPS65224_IRQ_IMM_SHUTDOWN ,7 ,TPS6594_BIT_IMM_SHUTDOWN_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_ORD_SHUTDOWN ,7 ,TPS6594_BIT_ORD_SHUTDOWN_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_MCU_PWR_ERR ,7 ,TPS6594_BIT_MCU_PWR_ERR_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_SOC_PWR_ERR ,7 ,TPS6594_BIT_SOC_PWR_ERR_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_COMM_ERR ,7 ,TPS6594_BIT_COMM_ERR_INT ), +REGMAP_IRQ_REG (TPS65224_IRQ_I2C2_ERR ,7 ,TPS65224_BIT_I2C2_ERR_INT ), +}; +static inline unsigned int tps6594_get_irq_reg (struct regmap_irq_chip_data *data,unsigned int base,int index) {
@@ -443,7 +503,7 @@ static int tps6594_handle_post_irq(void *irq_drv_data)* a new interrupt. */ if (tps->use_crc) { -if (tps->chip_id ==TPS65224 ) { +if (tps->chip_id ==TPS65224 || tps->chip_id ==TPS652G1 ) { regmap_reg =TPS6594_REG_INT_FSM_ERR ; mask_val =TPS6594_BIT_COMM_ERR_INT ; }else {
@@ -481,6 +541,18 @@ static struct regmap_irq_chip tps65224_irq_chip = { .handle_post_irq = tps6594_handle_post_irq, }; +static struct regmap_irq_chip tps652g1_irq_chip = { + .ack_base =TPS6594_REG_INT_BUCK , + .ack_invert =1 , + .clear_ack =1 , + .init_ack_masked =1 , + .num_regs =ARRAY_SIZE (tps65224_irq_reg), + .irqs = tps652g1_irqs, + .num_irqs =ARRAY_SIZE (tps652g1_irqs), + .get_irq_reg = tps65224_get_irq_reg, + .handle_post_irq = tps6594_handle_post_irq, +}; +static const struct regmap_range tps6594_volatile_ranges[] = {regmap_reg_range (TPS6594_REG_INT_TOP ,TPS6594_REG_STAT_READBACK_ERR ),regmap_reg_range (TPS6594_REG_RTC_STATUS ,TPS6594_REG_RTC_STATUS ),
@@ -507,7 +579,7 @@ static int tps6594_check_crc_mode(struct tps6594 *tps, bool primary_pmic)int ret;unsigned int regmap_reg, mask_val; -if (tps->chip_id ==TPS65224 ) { +if (tps->chip_id ==TPS65224 || tps->chip_id ==TPS652G1 ) { regmap_reg =TPS6594_REG_CONFIG_2 ; mask_val =TPS65224_BIT_I2C1_SPI_CRC_EN ; }else {
@@ -537,7 +609,7 @@ static int tps6594_set_crc_feature(struct tps6594 *tps)int ret;unsigned int regmap_reg, mask_val; -if (tps->chip_id ==TPS65224 ) { +if (tps->chip_id ==TPS65224 || tps->chip_id ==TPS652G1 ) { regmap_reg =TPS6594_REG_CONFIG_2 ; mask_val =TPS65224_BIT_I2C1_SPI_CRC_EN ; }else {
@@ -628,6 +700,10 @@ int tps6594_device_init(struct tps6594 *tps, bool enable_crc) irq_chip = &tps65224_irq_chip; n_cells =ARRAY_SIZE (tps65224_common_cells); cells = tps65224_common_cells; + }else if (tps->chip_id ==TPS652G1 ) { + irq_chip = &tps652g1_irq_chip; + n_cells =ARRAY_SIZE (tps652g1_common_cells); + cells = tps652g1_common_cells; }else { irq_chip = &tps6594_irq_chip; n_cells =ARRAY_SIZE (tps6594_common_cells);
@@ -651,8 +727,8 @@ int tps6594_device_init(struct tps6594 *tps, bool enable_crc)if (ret)return dev_err_probe (dev, ret,"Failed to add common child devices\n" ); -/* No RTC for LP8764 and TPS65224 */ -if (tps->chip_id !=LP8764 && tps->chip_id !=TPS65224 ) { +/* No RTC for LP8764, TPS65224 and TPS652G1 */ +if (tps->chip_id !=LP8764 && tps->chip_id !=TPS65224 && tps->chip_id !=TPS652G1 ) { ret =devm_mfd_add_devices (dev,PLATFORM_DEVID_AUTO , tps6594_rtc_cells,ARRAY_SIZE (tps6594_rtc_cells),NULL ,0 ,regmap_irq_get_domain (tps->irq_data));
drivers/mfd/tps6594-i2c.c +8 -2
@@ -1,6 +1,11 @@// SPDX-License-Identifier: GPL-2.0 /* -* I2C access driver for TI TPS65224/TPS6594/TPS6593/LP8764 PMICs +* I2C access driver for the following TI PMICs: +* - LP8764 +* - TPS65224 +* - TPS652G1 +* - TPS6593 +* - TPS6594 * * Copyright (C) 2023 BayLibre Incorporated - https://www.baylibre.com/ */
@@ -197,6 +202,7 @@ static const struct of_device_id tps6594_i2c_of_match_table[] = { { .compatible = "ti,tps6593-q1", .data = (void *)TPS6593, }, { .compatible = "ti,lp8764-q1", .data = (void *)LP8764, }, { .compatible = "ti,tps65224-q1", .data = (void *)TPS65224, }, + { .compatible = "ti,tps652g1", .data = (void *)TPS652G1, }, {} }; MODULE_DEVICE_TABLE(of, tps6594_i2c_of_match_table);
@@ -222,7 +228,7 @@ static int tps6594_i2c_probe(struct i2c_client *client)return dev_err_probe (dev, -EINVAL ,"Failed to find matching chip ID\n" ); tps->chip_id = (unsigned long )match->data; -if (tps->chip_id ==TPS65224 ) +if (tps->chip_id ==TPS65224 || tps->chip_id ==TPS652G1 ) tps6594_i2c_regmap_config.volatile_table = &tps65224_volatile_table; tps->regmap =devm_regmap_init (dev,NULL , client, &tps6594_i2c_regmap_config);
drivers/mfd/tps6594-spi.c +8 -2
@@ -1,6 +1,11 @@// SPDX-License-Identifier: GPL-2.0 /* -* SPI access driver for TI TPS65224/TPS6594/TPS6593/LP8764 PMICs +* SPI access driver for the following TI PMICs: +* - LP8764 +* - TPS65224 +* - TPS652G1 +* - TPS6593 +* - TPS6594 * * Copyright (C) 2023 BayLibre Incorporated - https://www.baylibre.com/ */
@@ -82,6 +87,7 @@ static const struct of_device_id tps6594_spi_of_match_table[] = { { .compatible = "ti,tps6593-q1", .data = (void *)TPS6593, }, { .compatible = "ti,lp8764-q1", .data = (void *)LP8764, }, { .compatible = "ti,tps65224-q1", .data = (void *)TPS65224, }, + { .compatible = "ti,tps652g1", .data = (void *)TPS652G1, }, {} }; MODULE_DEVICE_TABLE(of, tps6594_spi_of_match_table);
@@ -107,7 +113,7 @@ static int tps6594_spi_probe(struct spi_device *spi)return dev_err_probe (dev, -EINVAL ,"Failed to find matching chip ID\n" ); tps->chip_id = (unsigned long )match->data; -if (tps->chip_id ==TPS65224 ) +if (tps->chip_id ==TPS65224 || tps->chip_id ==TPS652G1 ) tps6594_spi_regmap_config.volatile_table = &tps65224_volatile_table; tps->regmap =devm_regmap_init (dev,NULL , spi, &tps6594_spi_regmap_config);
include/linux/mfd/tps6594.h +1 -0
@@ -19,6 +19,7 @@ enum pmic_id {TPS6593 ,LP8764 ,TPS65224 , + TPS652G1, };/* Macro to get page index from register address */
Signature · 1 line
2.39.5
Re: [PATCH 6.12 120/444] mfd: tps6594: Add TI TPS652G1 support
Quoted 1 line · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
This patch on its own doesn't make much sense. Have a look at
https://lore.kernel.org/all/[email protected]/
-michael
Greg Kroah-Hartman
maintainerPATCH 121/444 ARM: tegra: Use I/O memcpy to write to IRAM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 398e67e0f5ae04b29bcc9cbf342e339fe9d3f6f1 ]
Kasan crashes the kernel trying to check boundaries when using the normal memcpy.
--- arch/arm/mach-tegra/reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-tegra/reset.c +1 -1
@@ -63,7 +63,7 @@ static void __init tegra_cpu_reset_handler_enable(void)BUG_ON (is_enabled);BUG_ON (tegra_cpu_reset_handler_size >TEGRA_IRAM_RESET_HANDLER_SIZE ); -memcpy (iram_base, (void *)__tegra_cpu_reset_handler_start, +memcpy_toio (iram_base, (void *)__tegra_cpu_reset_handler_start, tegra_cpu_reset_handler_size); err =call_firmware_op (set_cpu_boot_addr,0 , reset_address);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/444 tools/build: Fix s390(x) cross-compilation with clang
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit a40f0cdce78be8a559ee8a85c908049c65a410b2 ]
The heuristic to derive a clang target triple from a GCC one does not work for s390. GCC uses "s390-linux" while clang expects "s390x-linux" or "powerz-linux".
Add an explicit override.
--- tools/scripts/Makefile.include | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/scripts/Makefile.include +3 -1
@@ -98,7 +98,9 @@ else ifneq ($(CROSS_COMPILE),) # Allow userspace to override CLANG_CROSS_FLAGS to specify their own # sysroots and flags or to avoid the GCC call in pure Clang builds. ifeq ($(CLANG_CROSS_FLAGS),) -CLANG_CROSS_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%)) +CLANG_TARGET := $(notdir $(CROSS_COMPILE:%-=%)) +CLANG_TARGET := $(subst s390-linux,s390x-linux,$(CLANG_TARGET)) +CLANG_CROSS_FLAGS := --target=$(CLANG_TARGET) GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)gcc 2>/dev/null)) ifneq ($(GCC_TOOLCHAIN_DIR),) CLANG_CROSS_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/444 selftests: tracing: Use mutex_unlock for testing glob filter
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit a089bb2822a49b0c5777a8936f82c1f8629231fb ]
Since commit c5b6ababd21a ("locking/mutex: implement mutex_trylock_nested") makes mutex_trylock() as an inlined function if CONFIG_DEBUG_LOCK_ALLOC=y, we can not use mutex_trylock() for testing the glob filter of ftrace.
Use mutex_unlock instead.
--- .../testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc +1 -1
@@ -29,7 +29,7 @@ ftrace_filter_check 'schedule*' '^schedule.*$' ftrace_filter_check '*pin*lock' '.*pin.*lock$' # filter by start*mid* -ftrace_filter_check 'mutex*try*' '^mutex.*try.*' +ftrace_filter_check 'mutex*unl*' '^mutex.*unl.*' # Advanced full-glob matching feature is recently supported. # Skip the tests if we are sure the kernel does not support it.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/444 ACPI: PRM: Reduce unnecessary printing to avoid user confusion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Qiyu <[email protected]>
[ Upstream commit 3db5648c4d608b5483470efc1da9780b081242dd ]
Commit 088984c8d54c ("ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context") introduced non-essential printing "Failed to find VA for GUID: xxxx, PA: 0x0" which may confuse users to think that something wrong is going on while it is not the case.
According to the PRM Spec Section 4.1.2 [1], both static data buffer address and ACPI parameter buffer address may be NULL if they are not needed, so there is no need to print out the "Failed to find VA ... " in those cases.
--- drivers/acpi/prmt.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-)
drivers/acpi/prmt.c +24 -2
@@ -85,8 +85,6 @@ static u64 efi_pa_va_lookup(efi_guid_t *guid, u64 pa) } } -pr_warn ("Failed to find VA for GUID: %pUL, PA: 0x%llx" , guid, pa); -return 0 ; }
@@ -154,13 +152,37 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)guid_copy (&th->guid, (guid_t *)handler_info->handler_guid); th->handler_addr = (void *)efi_pa_va_lookup (&th->guid, handler_info->handler_address); +/* +* Print a warning message if handler_addr is zero which is not expected to +* ever happen. +*/ +if (unlikely (!th->handler_addr)) +pr_warn ("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx" , + &th->guid, handler_info->handler_address); th->static_data_buffer_addr =efi_pa_va_lookup (&th->guid, handler_info->static_data_buffer_address); +/* +* According to the PRM specification, static_data_buffer_address can be zero, +* so avoid printing a warning message in that case. Otherwise, if the +* return value of efi_pa_va_lookup() is zero, print the message. +*/ +if (unlikely (!th->static_data_buffer_addr && handler_info->static_data_buffer_address)) +pr_warn ("Failed to find VA of static data buffer for GUID: %pUL, PA: 0x%llx" , + &th->guid, handler_info->static_data_buffer_address); th->acpi_param_buffer_addr =efi_pa_va_lookup (&th->guid, handler_info->acpi_param_buffer_address); +/* +* According to the PRM specification, acpi_param_buffer_address can be zero, +* so avoid printing a warning message in that case. Otherwise, if the +* return value of efi_pa_va_lookup() is zero, print the message. +*/ +if (unlikely (!th->acpi_param_buffer_addr && handler_info->acpi_param_buffer_address)) +pr_warn ("Failed to find VA of acpi param buffer for GUID: %pUL, PA: 0x%llx" , + &th->guid, handler_info->acpi_param_buffer_address); + }while (++cur_handler < tm->handler_count && (handler_info =get_next_handler (handler_info)));return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/444 firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 9a0658d3991e6c82df87584b253454842f22f965 ]
Fix a race condition where a second suspend notification from another SCMI agent wakes the system before SCMI_SYSPOWER_IDLE is set, leading to ignored suspend requests. This is due to interrupts triggering early execution of scmi_userspace_notifier() before the SCMI state is updated.
To resolve this, set SCMI_SYSPOWER_IDLE earlier in the device resume path, prior to thaw_processes(). This ensures the SCMI state is correct when the notifier runs, allowing the system to suspend again as expected.
On some platforms using SCMI, SCP cannot distinguish between CPU idle and suspend since both result in cluster power-off. By explicitly setting the idle state early, the Linux SCMI agent can correctly re-suspend in response to external notifications.
Message-Id: <[email protected]>
--- .../firmware/arm_scmi/scmi_power_control.c | 22 ++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/firmware/arm_scmi/scmi_power_control.c +17 -5
@@ -46,6 +46,7 @@#include <linux/math.h> #include <linux/module.h> #include <linux/mutex.h> +#include <linux/pm.h> #include <linux/printk.h> #include <linux/reboot.h> #include <linux/scmi_protocol.h>
@@ -324,12 +325,7 @@ static int scmi_userspace_notifier(struct notifier_block *nb,static void scmi_suspend_work_func (struct work_struct *work) { -struct scmi_syspower_conf *sc = - container_of(work, struct scmi_syspower_conf, suspend_work); -pm_suspend (PM_SUSPEND_MEM ); - - sc->state =SCMI_SYSPOWER_IDLE ; }static int scmi_syspower_probe (struct scmi_device *sdev)
@@ -354,6 +350,7 @@ static int scmi_syspower_probe(struct scmi_device *sdev) sc->required_transition =SCMI_SYSTEM_MAX ; sc->userspace_nb.notifier_call = &scmi_userspace_notifier; sc->dev = &sdev->dev; +dev_set_drvdata (&sdev->dev, sc);INIT_WORK (&sc->suspend_work, scmi_suspend_work_func);
@@ -363,6 +360,18 @@ static int scmi_syspower_probe(struct scmi_device *sdev) NULL, &sc->userspace_nb); } +static int scmi_system_power_resume (struct device *dev) +{ +struct scmi_syspower_conf *sc =dev_get_drvdata (dev); + + sc->state =SCMI_SYSPOWER_IDLE ; +return 0 ; +} + +static const struct dev_pm_ops scmi_system_power_pmops = { +SET_SYSTEM_SLEEP_PM_OPS (NULL , scmi_system_power_resume) +}; +static const struct scmi_device_id scmi_id_table[] = { {SCMI_PROTOCOL_SYSTEM ,"syspower" }, { },
@@ -370,6 +379,9 @@ static const struct scmi_device_id scmi_id_table[] = {MODULE_DEVICE_TABLE (scmi, scmi_id_table);static struct scmi_driver scmi_system_power_driver = { + .driver = { + .pm = &scmi_system_power_pmops, + }, .name ="scmi-system-power" , .probe = scmi_syspower_probe, .id_table = scmi_id_table,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/444 firmware: tegra: Fix IVC dependency problems
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thierry Reding <[email protected]>
[ Upstream commit 78eb18020a88a4eed15f5af7700ed570642ff8f1 ]
The IVC code is library code that other drivers need to select if they need that library. However, if the symbol is user-selectable this can lead to conflicts.
Fix this by making the symbol only selectable for COMPILE_TEST and add a select TEGRA_IVC to TEGRA_BPMP, which is currently the only user.
--- drivers/firmware/tegra/Kconfig | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/firmware/tegra/Kconfig +3 -2
@@ -2,7 +2,7 @@ menu "Tegra firmware driver" config TEGRA_IVC - bool "Tegra IVC protocol" + bool "Tegra IVC protocol" if COMPILE_TEST depends on ARCH_TEGRA help IVC (Inter-VM Communication) protocol is part of the IPC
@@ -13,8 +13,9 @@ config TEGRA_IVC config TEGRA_BPMP bool "Tegra BPMP driver" - depends on ARCH_TEGRA && TEGRA_HSP_MBOX && TEGRA_IVC + depends on ARCH_TEGRA && TEGRA_HSP_MBOX depends on !CPU_BIG_ENDIAN + select TEGRA_IVC help BPMP (Boot and Power Management Processor) is designed to off-loading the PM functions which include clock/DVFS/thermal/power from the CPU.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/444 PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 89d9cec3b1e9c49bae9375a2db6dc49bc7468af0 ]
Clear power.needs_force_resume in pm_runtime_reinit() in case it has been set by pm_runtime_force_suspend() invoked from a driver remove callback.
--- drivers/base/power/runtime.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/base/power/runtime.c +5 -0
@@ -1787,6 +1787,11 @@ void pm_runtime_reinit(struct device *dev)pm_runtime_put (dev->parent); } } +/* +* Clear power.needs_force_resume in case it has been set by +* pm_runtime_force_suspend() invoked from a driver remove callback. +*/ + dev->power.needs_force_resume = false; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/444 thermal: sysfs: Return ENODATA instead of EAGAIN for reads
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Te Yuan <[email protected]>
[ Upstream commit 1a4aabc27e95674837f2e25f4ef340c0469e6203 ]
According to POSIX spec, EAGAIN returned by read with O_NONBLOCK set means the read would block. Hence, the common implementation in nonblocking model will poll the file when the nonblocking read returns EAGAIN. However, when the target file is thermal zone, this mechanism will totally malfunction because thermal zone doesn't implement sysfs notification and thus the poll will never return.
For example, the read in Golang implemnts such method and sometimes hangs at reading some thermal zones via sysfs.
Change to return -ENODATA instead of -EAGAIN to userspace.
--- drivers/thermal/thermal_sysfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/thermal/thermal_sysfs.c +6 -3
@@ -40,10 +40,13 @@ temp_show(struct device *dev, struct device_attribute *attr, char *buf) ret =thermal_zone_get_temp (tz, &temperature); -if (ret) -return ret; +if (!ret) +return sprintf (buf,"%d\n" , temperature); -return sprintf (buf,"%d\n" , temperature); +if (ret == -EAGAIN ) +return -ENODATA ; + +return ret; } static ssize_t
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/444 PM: sleep: console: Fix the black screen issue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: tuhaowen <[email protected]>
[ Upstream commit 4266e8fa56d3d982bf451d382a410b9db432015c ]
When the computer enters sleep status without a monitor connected, the system switches the console to the virtual terminal tty63(SUSPEND_CONSOLE).
If a monitor is subsequently connected before waking up, the system skips the required VT restoration process during wake-up, leaving the console on tty63 instead of switching back to tty1.
To fix this issue, a global flag vt_switch_done is introduced to record whether the system has successfully switched to the suspend console via vt_move_to_console() during suspend.
If the switch was completed, vt_switch_done is set to 1. Later during resume, this flag is checked to ensure that the original console is restored properly by calling vt_move_to_console(orig_fgconsole, 0).
This prevents scenarios where the resume logic skips console restoration due to incorrect detection of the console state, especially when a monitor is reconnected before waking up.
--- kernel/power/console.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/power/console.c +6 -1
@@ -16,6 +16,7 @@#define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)static int orig_fgconsole, orig_kmsg; +static bool vt_switch_done;static DEFINE_MUTEX (vt_switch_mutex);
@@ -136,17 +137,21 @@ void pm_prepare_console(void)if (orig_fgconsole <0 )return ; + vt_switch_done = true; + orig_kmsg =vt_kmsg_redirect (SUSPEND_CONSOLE );return ; }void pm_restore_console (void ) { -if (!pm_vt_switch ()) +if (!pm_vt_switch () && !vt_switch_done)return ;if (orig_fgconsole >=0 ) {vt_move_to_console (orig_fgconsole,0 );vt_kmsg_redirect (orig_kmsg); } + + vt_switch_done = false; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/444 ACPI: processor: fix acpi_object initialization
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Ott <[email protected]>
[ Upstream commit 13edf7539211d8f7d0068ce3ed143005f1da3547 ]
Initialization of the local acpi_object in acpi_processor_get_info() only sets the first 4 bytes to zero and is thus incomplete. This is indicated by messages like:
acpi ACPI0007:be: Invalid PBLK length [166288104]
Fix this by initializing all 16 bytes of the processor member of that union.
--- drivers/acpi/acpi_processor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpi_processor.c +1 -1
@@ -275,7 +275,7 @@ static inline int acpi_processor_hotadd_init(struct acpi_processor *pr,static int acpi_processor_get_info (struct acpi_device *device) { -union acpi_object object = {0 }; +union acpi_object object = { .processor = {0 } };struct acpi_buffer buffer = {sizeof (union acpi_object ), &object };struct acpi_processor *pr =acpi_driver_data (device);int device_declaration =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/444 mmc: sdhci-msm: Ensure SD card power isnt ON when card removed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <[email protected]>
[ Upstream commit db58532188ebf51d52b1d7693d9e94c76b926e9f ]
Many mobile phones feature multi-card tray designs, where the same tray is used for both SD and SIM cards. If the SD card is placed at the outermost location in the tray, the SIM card may come in contact with SD card power-supply while removing the tray, possibly resulting in SIM damage.
To prevent that, make sure the SD card is really inserted by reading the Card Detect pin state. If it's not, turn off the power in sdhci_msm_check_power_status() and also set the BUS_FAIL power state on the controller as part of pwr_irq handling for BUS_ON request.
--- drivers/mmc/host/sdhci-msm.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/mmc/host/sdhci-msm.c +14 -0
@@ -1564,6 +1564,7 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type) {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_msm_host *msm_host =sdhci_pltfm_priv (pltfm_host); +struct mmc_host *mmc = host->mmc;bool done = false;u32 val =SWITCHABLE_SIGNALING_VOLTAGE ; const struct sdhci_msm_offset *msm_offset =
@@ -1621,6 +1622,12 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type)"%s: pwr_irq for req: (%d) timed out\n" , mmc_hostname(host->mmc), req_type); } + +if ((req_type &REQ_BUS_ON ) && mmc->card && !mmc->ops->get_cd (mmc)) { +sdhci_writeb (host,0 ,SDHCI_POWER_CONTROL ); + host->pwr =0 ; + } +pr_debug ("%s: %s: request %d done\n" ,mmc_hostname (host->mmc), __func__, req_type); }
@@ -1679,6 +1686,13 @@ static void sdhci_msm_handle_pwr_irq(struct sdhci_host *host, int irq)udelay (10 ); } +if ((irq_status &CORE_PWRCTL_BUS_ON ) && mmc->card && + !mmc->ops->get_cd (mmc)) { +msm_host_writel (msm_host,CORE_PWRCTL_BUS_FAIL , host, + msm_offset->core_pwrctl_ctl); +return ; + } +/* Handle BUS ON/OFF*/ if (irq_status &CORE_PWRCTL_BUS_ON ) { pwr_state =REQ_BUS_ON ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/444 ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 4734c8b46b901cff2feda8b82abc710b65dc31c1 ]
When a GHES (Generic Hardware Error Source) triggers a panic, add the TAINT_MACHINE_CHECK taint flag to the kernel. This explicitly marks the kernel as tainted due to a machine check event, improving diagnostics and post-mortem analysis. The taint is set with LOCKDEP_STILL_OK to indicate lockdep remains valid.
At large scale deployment, this helps to quickly determine panics that are coming due to hardware failures.
--- drivers/acpi/apei/ghes.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/apei/ghes.c +2 -0
@@ -996,6 +996,8 @@ static void __ghes_panic(struct ghes *ghes,__ghes_print_estatus (KERN_EMERG , ghes->generic, estatus); +add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_STILL_OK ); +ghes_clear_estatus (ghes, estatus, buf_paddr, fixmap_idx);if (!panic_timeout)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/444 selftests: vDSO: vdso_test_getrandom: Always print TAP header
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 1158220b24674edaf885433153deb4f0e5c7d331 ]
The TAP specification requires that the output begins with a header line. If vgetrandom_init() fails and skips the test, that header line is missing.
Call vgetrandom_init() after ksft_print_header().
--- tools/testing/selftests/vDSO/vdso_test_getrandom.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/testing/selftests/vDSO/vdso_test_getrandom.c +4 -2
@@ -242,6 +242,7 @@ static void kselftest(void)pid_t child;ksft_print_header (); +vgetrandom_init ();ksft_set_plan (2 );for (size_t i =0 ; i <1000 ; ++i) {
@@ -295,8 +296,6 @@ static void usage(const char *argv0)int main (int argc,char *argv[]) { -vgetrandom_init (); -if (argc ==1 ) {kselftest ();return 0 ;
@@ -306,6 +305,9 @@ int main(int argc, char *argv[])usage (argv[0 ]);return 1 ; } + +vgetrandom_init (); +if (!strcmp (argv[1 ],"bench-single" ))bench_single ();else if (!strcmp (argv[1 ],"bench-multi" ))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/444 pps: clients: gpio: fix interrupt handling order in remove path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliav Farber <[email protected]>
[ Upstream commit 6bca1e955830808dc90e0506b2951b4256b81bbb ]
The interrupt handler in pps_gpio_probe() is registered after calling pps_register_source() using devm_request_irq(). However, in the corresponding remove function, pps_unregister_source() is called before the IRQ is freed, since devm-managed resources are released after the remove function completes.
This creates a potential race condition where an interrupt may occur after the PPS source is unregistered but before the handler is removed, possibly leading to a kernel panic.
To prevent this, switch from devm-managed IRQ registration to manual management by using request_irq() and calling free_irq() explicitly in the remove path before unregistering the PPS source. This ensures the interrupt handler is safely removed before deactivating the PPS source.
--- drivers/pps/clients/pps-gpio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/pps/clients/pps-gpio.c +3 -2
@@ -206,8 +206,8 @@ static int pps_gpio_probe(struct platform_device *pdev) }/* register IRQ interrupt handler */ - ret =devm_request_irq (dev, data->irq, pps_gpio_irq_handler, -get_irqf_trigger_flags (data), data->info.name, data); + ret =request_irq (data->irq, pps_gpio_irq_handler, +get_irqf_trigger_flags (data), data->info.name, data);if (ret) {pps_unregister_source (data->pps);dev_err (dev,"failed to acquire IRQ %d\n" , data->irq);
@@ -224,6 +224,7 @@ static void pps_gpio_remove(struct platform_device *pdev) {struct pps_gpio_device_data *data =platform_get_drvdata (pdev); +free_irq (data->irq, data);pps_unregister_source (data->pps);del_timer_sync (&data->echo_timer);/* reset echo pin in any case */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/444 reset: brcmstb: Enable reset drivers for ARCH_BCM2835
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Robinson <[email protected]>
[ Upstream commit 1d99f92f71b6b4b2eee776562c991428490f71ef ]
The BRCMSTB and BRCMSTB_RESCAL reset drivers are also used in the BCM2712, AKA the RPi5. The RPi platforms have typically used the ARCH_BCM2835, and the PCIe support for this SoC can use this config which depends on these drivers so enable building them when just that arch option is enabled to ensure the platform works as expected.
--- drivers/reset/Kconfig | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/reset/Kconfig +5 -5
@@ -51,8 +51,8 @@ config RESET_BERLIN config RESET_BRCMSTB tristate "Broadcom STB reset controller" - depends on ARCH_BRCMSTB || COMPILE_TEST - default ARCH_BRCMSTB + depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST + default ARCH_BRCMSTB || ARCH_BCM2835 help This enables the reset controller driver for Broadcom STB SoCs using a SUN_TOP_CTRL_SW_INIT style controller.
@@ -60,11 +60,11 @@ config RESET_BRCMSTB config RESET_BRCMSTB_RESCAL tristate "Broadcom STB RESCAL reset controller" depends on HAS_IOMEM - depends on ARCH_BRCMSTB || COMPILE_TEST - default ARCH_BRCMSTB + depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST + default ARCH_BRCMSTB || ARCH_BCM2835 help This enables the RESCAL reset controller for SATA, PCIe0, or PCIe1 on - BCM7216. + BCM7216 or the BCM2712. config RESET_EYEQ bool "Mobileye EyeQ reset controller"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/444 char: misc: Fix improper and inaccurate error code returned by misc_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 0ef1fe4bc38673db72e39b700b29c50dfcc5a415 ]
misc_init() returns -EIO for __register_chrdev() invocation failure, but:
- -EIO is for I/O error normally, but __register_chrdev() does not do I/O.
- -EIO can not cover various error codes returned by __register_chrdev().
Fix by returning error code of __register_chrdev().
--- drivers/char/misc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/misc.c +2 -2
@@ -314,8 +314,8 @@ static int __init misc_init(void)if (err) goto fail_remove; - err = -EIO ; -if (__register_chrdev (MISC_MAJOR ,0 ,MINORMASK +1 ,"misc" , &misc_fops)) + err =__register_chrdev (MISC_MAJOR ,0 ,MINORMASK +1 ,"misc" , &misc_fops); +if (err <0 ) goto fail_printk;return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 137/444 mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 ]
mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl) belonging to the device being released.
If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers, the mei-client being freed might still be part of the mei_device's file_list and iterating over this list after the freeing will then trigger a use-afer-free bug.
Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed mei-client is not on the mei_device's file_list.
--- drivers/misc/mei/bus.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/misc/mei/bus.c +6 -0
@@ -1353,10 +1353,16 @@ static void mei_dev_bus_put(struct mei_device *bus)static void mei_cl_bus_dev_release (struct device *dev) {struct mei_cl_device *cldev =to_mei_cl_device (dev); +struct mei_device *mdev = cldev->cl->dev; +struct mei_cl *cl;mei_cl_flush_queues (cldev->cl,NULL );mei_me_cl_put (cldev->me_cl);mei_dev_bus_put (cldev->bus); + +list_for_each_entry (cl, &mdev->file_list, link) +WARN_ON (cl == cldev->cl); +kfree (cldev->cl);kfree (cldev); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 138/444 mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
[ Upstream commit 47a255f7d2eabee06cfbf5b1c2379749442fd01d ]
In the error path of sd_set_power_mode() we don't update host->power_mode, which could lead to an imbalance of the runtime PM usage count. Fix this by always updating host->power_mode.
--- drivers/mmc/host/rtsx_usb_sdmmc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/mmc/host/rtsx_usb_sdmmc.c +1 -3
@@ -1032,9 +1032,7 @@ static int sd_set_power_mode(struct rtsx_usb_sdmmc *host, err =sd_power_on (host); } -if (!err) - host->power_mode = power_mode; - + host->power_mode = power_mode;return err; }
Signature · 1 line
2.39.5