6.1.149-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.1.149-rc1 review
This is the start of the stable review cycle for the 6.1.149 release. There are 482 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:22 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.149-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.149-rc1
Florian Westphal <[email protected]>
netfilter: nf_reject: don't leak dst refcount for loopback packets
Peter Oberparleiter <[email protected]>
s390/hypfs: Enable limited access during lockdown
Peter Oberparleiter <[email protected]>
s390/hypfs: Avoid unnecessary ioctl registration in debugfs
Takashi Iwai <[email protected]>
ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
Hangbin Liu <[email protected]>
bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU
Aahil Awatramani <[email protected]>
bonding: Add independent control state machine
Hangbin Liu <[email protected]>
bonding: update LACP activity flag after setting lacp_active
William Liu <[email protected]>
net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
William Liu <[email protected]>
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
ValdikSS <[email protected]>
igc: fix disabling L1.2 PCI-E link substate on I226 on init
Jason Xing <[email protected]>
ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
Jordan Rhee <[email protected]>
gve: prevent ethtool ops after shutdown
Yuichiro Tsuji <[email protected]>
net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
Horatiu Vultur <[email protected]>
phy: mscc: Fix timestamping for vsc8584
Qingfang Deng <[email protected]>
ppp: fix race conditions in ppp_fill_forward_path
Qingfang Deng <[email protected]>
net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
Minhong He <[email protected]>
ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
Jakub Ramaseuski <[email protected]>
net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
Chenyuan Yang <[email protected]>
drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
Dan Carpenter <[email protected]>
ALSA: usb-audio: Fix size validation in convert_chmap_v3()
Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix the hibmc loaded failed bug
Ido Schimmel <[email protected]>
mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
Sergey Shtylyov <[email protected]>
Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
Kees Cook <[email protected]>
iommu/amd: Avoid stack buffer overflow from kernel cmdline
Dan Carpenter <[email protected]>
scsi: qla4xxx: Prevent a potential error pointer dereference
Wang Liang <[email protected]>
net: bridge: fix soft lockup in br_multicast_query_expired()
Anantha Prabhu <[email protected]>
RDMA/bnxt_re: Fix to initialize the PBL array
Boshi Yu <[email protected]>
RDMA/erdma: Fix ignored return value of init_kernel_qp
Nitin Gote <[email protected]>
iosys-map: Fix undefined behavior in iosys_map_clear()
Waiman Long <[email protected]>
cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key
Tianxiang Peng <[email protected]>
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
Jan Beulich <[email protected]>
compiler: remove __ADDRESSABLE_ASM{_STR,}() again
David Lechner <[email protected]>
iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
Jonathan Cameron <[email protected]>
iio: light: as73211: Ensure buffer holes are zeroed
Pu Lehui <[email protected]>
tracing: Limit access to parser->buffer when trace_get_user failed
Steven Rostedt <[email protected]>
tracing: Remove unneeded goto out logic
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: change invalid data error to -EBUSY
Jakub Kicinski <[email protected]>
tls: fix handling of zero-length records on the rx_list
Mikhail Lobanov <[email protected]>
wifi: mac80211: check basic rates validity in sta_link_apply_parameters
Benjamin Berg <[email protected]>
wifi: mac80211: avoid lockdep checking when removing deflink
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: pm: check flush doesn't reset limits
Timur Kristóf <[email protected]>
drm/amd/display: Don't overclock DCE 6 by 15%
Jinjiang Tu <[email protected]>
mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: Add a new function to simplify the code
Bjorn Helgaas <[email protected]>
mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values
Imre Deak <[email protected]>
drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
Geliang Tang <[email protected]>
mptcp: disable add_addr retransmission when timeout is 0
Chao Yu <[email protected]>
f2fs: fix to avoid out-of-boundary access in dnode page
Chao Yu <[email protected]>
f2fs: fix to call clear_page_private_reference in .{release,invalid}_folio
Bjorn Andersson <[email protected]>
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
Gokul krishna Krishnakumar <[email protected]>
soc: qcom: mdt_loader: Enhance split binary detection
Geraldo Nascimento <[email protected]>
PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
Geraldo Nascimento <[email protected]>
PCI: rockchip: Use standard PCIe definitions
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
Baokun Li <[email protected]>
ext4: preserve SB_I_VERSION on remount
André Draszik <[email protected]>
scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
Selvarasu Ganesan <[email protected]>
usb: dwc3: Remove WARN_ON for device endpoint command timeouts
Kuen-Han Tsai <[email protected]>
usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
Zenm Chen <[email protected]>
USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
Thorsten Blum <[email protected]>
usb: storage: realtek_cr: Use correct byte order for bcs->Residue
Mael GUERIN <[email protected]>
USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
Marek Vasut <[email protected]>
usb: renesas-xhci: Fix External ROM access timeouts
Xu Yang <[email protected]>
usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test
Ian Abbott <[email protected]>
comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()
Edward Adam Davis <[email protected]>
comedi: pcl726: Prevent invalid irq number
Ian Abbott <[email protected]>
comedi: Make insn_rw_emulate_bits() do insn->n samples
Miao Li <[email protected]>
usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
Miaoqian Lin <[email protected]>
most: core: Drop device reference after usage in get_channel()
David Lechner <[email protected]>
iio: proximity: isl29501: fix buffered read on big-endian systems
Salah Triki <[email protected]>
iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
Steven Rostedt <[email protected]>
ftrace: Also allocate and copy hash for reading of filter files
Xu Yilun <[email protected]>
fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
Al Viro <[email protected]>
use uniform permission checks for all mount propagation changes
Ye Bin <[email protected]>
fs/buffer: fix use-after-free when call bh_read() helper
Stefan Metzmacher <[email protected]>
smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
Timur Kristóf <[email protected]>
drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
Timur Kristóf <[email protected]>
drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
Timur Kristóf <[email protected]>
drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
Timur Kristóf <[email protected]>
drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
Mario Limonciello <[email protected]>
drm/amd/display: Avoid a NULL pointer dereference
Peter Oberparleiter <[email protected]>
s390/sclp: Fix SCCB present check
Evgeniy Harchenko <[email protected]>
ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
Herton R. Krzesinski <[email protected]>
mm/debug_vm_pgtable: clear page table entries at destroy_args()
Phillip Lougher <[email protected]>
squashfs: fix memory leak in squashfs_fill_super
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
Jiayi Li <[email protected]>
memstick: Fix deadlock by moving removing flag earlier
Will Deacon <[email protected]>
KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix
Chao Gao <[email protected]>
KVM: VMX: Flush shadow VMCS on emergency reboot
Sean Christopherson <[email protected]>
x86/reboot: KVM: Handle VMXOFF in KVM's reboot callback
Sean Christopherson <[email protected]>
x86/reboot: Harden virtualization hooks for emergency reboot
Thomas Weißschuh <[email protected]>
kbuild: userprogs: use correct linker when mixing clang and GNU ld
Sumanth Gavini <[email protected]>
Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync
Lorenzo Stoakes <[email protected]>
selftests/memfd: add test for mapping write-sealed memfd read-only
Lorenzo Stoakes <[email protected]>
mm: reinstate ability to map write-sealed memfd mappings read-only
Lorenzo Stoakes <[email protected]>
mm: update memfd seal write check to include F_SEAL_WRITE
Lorenzo Stoakes <[email protected]>
mm: drop the assumption that VM_SHARED always implies writable
Paolo Abeni <[email protected]>
mptcp: reset fallback status gracefully at disconnect() time
Paolo Abeni <[email protected]>
mptcp: plug races between subflow fail and subflow creation
Paolo Abeni <[email protected]>
mptcp: make fallback action and fallback decision atomic
Sean Christopherson <[email protected]>
KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
Nianyao Tang <[email protected]>
arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register
Giovanni Cabiddu <[email protected]>
crypto: qat - fix ring to service map for QAT GEN4
Sabrina Dubroca <[email protected]>
tls: separate no-async decryption request handling from async
Qu Wenruo <[email protected]>
btrfs: populate otime when logging an inode item
Damien Le Moal <[email protected]>
ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
Johan Hovold <[email protected]>
usb: dwc3: imx8mp: fix device leak at unbind
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec: remove unneeded label and if-condition
Chen-Yu Tsai <[email protected]>
platform/chrome: cros_ec: Use per-device lockdep key
Johan Hovold <[email protected]>
usb: musb: omap2430: fix device leak at unbind
Uwe Kleine-König <[email protected]>
usb: musb: omap2430: Convert to platform remove callback returning void
Vedang Nagar <[email protected]>
media: venus: Fix OOB read due to missing payload bound check
Konrad Dybcio <[email protected]>
media: venus: Introduce accessors for remapped hfi_buffer_reqs members
Anshuman Khandual <[email protected]>
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
Davide Caratti <[email protected]>
net/sched: ets: use old 'nbands' while purging unused classes
Eric Dumazet <[email protected]>
net_sched: sch_ets: implement lockless ets_dump()
Filipe Manana <[email protected]>
btrfs: send: use fallocate for hole punching with send stream v2
Christoph Hellwig <[email protected]>
xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
Filipe Manana <[email protected]>
btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
Filipe Manana <[email protected]>
btrfs: qgroup: fix race between quota disable and quota rescan ioctl
Sebastian Reichel <[email protected]>
usb: typec: fusb302: cache PD RX state
Shyam Prasad N <[email protected]>
cifs: reset iface weights when we cannot find a candidate
Lukas Wunner <[email protected]>
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
Damien Le Moal <[email protected]>
block: Make REQ_OP_ZONE_FINISH a write operation
Christoph Hellwig <[email protected]>
block: reject invalid operation in submit_bio_noacct
Eric Biggers <[email protected]>
fscrypt: Don't use problematic non-inline crypto engines
Johan Hovold <[email protected]>
net: enetc: fix device and OF node leak at probe
Lin.Cao <[email protected]>
drm/sched: Remove optimization that causes hang when killing dependent jobs
Ada Couprie Diaz <[email protected]>
arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
Nathan Chancellor <[email protected]>
ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
Filipe Manana <[email protected]>
btrfs: fix qgroup reservation leak on failure to allocate ordered extent
Eric Dumazet <[email protected]>
net: add netdev_lockdep_set_classes() to virtual drivers
Yazen Ghannam <[email protected]>
x86/mce/amd: Add default names for MCA banks and blocks
Kan Liang <[email protected]>
perf/x86/intel: Fix crash in icl_update_topdown_event()
Zhang Lixu <[email protected]>
iio: hid-sensor-prox: Fix incorrect OFFSET calculation
Zhang Lixu <[email protected]>
iio: hid-sensor-prox: Restore lost scale assignments
Chao Yu <[email protected]>
f2fs: fix to do sanity check on ino and xnid
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
Christoph Paasch <[email protected]>
mptcp: drop skb if MPTCP skb extension allocation fails
Chen Yu <[email protected]>
ACPI: pfr_update: Fix the driver update version check
Eric Biggers <[email protected]>
ipv6: sr: Fix MAC comparison to be constant-time
Jakub Acs <[email protected]>
net, hsr: reject HSR frame if skb can't hold tag
Timur Kristóf <[email protected]>
drm/amd/display: Don't overwrite dce60_clk_mgr
Amber Lin <[email protected]>
drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
Alex Deucher <[email protected]>
drm/amdgpu: update mmhub 3.0.1 client id mappings
Gang Ba <[email protected]>
drm/amdgpu: Avoid extra evict-restore process.
Mario Limonciello <[email protected]>
drm/amd: Restore cached power limit during resume
Ricardo Ribalda <[email protected]>
media: venus: venc: Clamp param smaller than 1fps and bigger than 240
Ricardo Ribalda <[email protected]>
media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
Jorge Ramirez-Ortiz <[email protected]>
media: venus: protect against spurious interrupts during probe
Jorge Ramirez-Ortiz <[email protected]>
media: venus: hfi: explicitly release IRQ during teardown
Vedang Nagar <[email protected]>
media: venus: Add a check for packet size after reading from shared memory
Vladimir Zapolskiy <[email protected]>
media: qcom: camss: cleanup media device allocated resource on error path
Zhang Shurong <[email protected]>
media: ov2659: Fix memory leaks in ov2659_probe()
Gui-Dong Han <[email protected]>
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
Ludwig Disterhof <[email protected]>
media: usbtv: Lock resolution while streaming
Sakari Ailus <[email protected]>
media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
Hans Verkuil <[email protected]>
media: vivid: fix wrong pixel_array control size
Haoxiang Li <[email protected]>
media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
Bingbu Cao <[email protected]>
media: hi556: correct the test pattern configuration
Dan Carpenter <[email protected]>
media: gspca: Add bounds checking to firmware parser
John David Anglin <[email protected]>
parisc: Update comments in make_insert_tlb
John David Anglin <[email protected]>
parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault()
John David Anglin <[email protected]>
parisc: Revise gateway LWS calls to probe user read access
John David Anglin <[email protected]>
parisc: Revise __get_user() to probe user read access
Randy Dunlap <[email protected]>
parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers
John David Anglin <[email protected]>
parisc: Check region is readable by user in raw_copy_from_user()
Jon Hunter <[email protected]>
soc/tegra: pmc: Ensure power-domains are in a known state
Baokun Li <[email protected]>
jbd2: prevent softlockup in jbd2_log_do_checkpoint()
Will Deacon <[email protected]>
vhost/vsock: Avoid allocating arbitrarily-sized SKBs
Will Deacon <[email protected]>
vsock/virtio: Validate length in packet header before skb_put()
Damien Le Moal <[email protected]>
PCI: endpoint: Fix configfs group removal on driver teardown
Damien Le Moal <[email protected]>
PCI: endpoint: Fix configfs group list head handling
Thomas Fourier <[email protected]>
mtd: rawnand: renesas: Add missing check after DMA map
Thomas Fourier <[email protected]>
mtd: rawnand: fsmc: Add missing check after DMA map
Gabor Juhos <[email protected]>
mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
Michael Walle <[email protected]>
mtd: spi-nor: Fix spi_nor_try_unlock_all()
Tim Harvey <[email protected]>
hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
Uwe Kleine-König <[email protected]>
pwm: mediatek: Fix duty and period setting
Uwe Kleine-König <[email protected]>
pwm: mediatek: Handle hardware enable and clock enable separately
Laurentiu Mihalcea <[email protected]>
pwm: imx-tpm: Reset counter if CMOD is 0
Johan Hovold <[email protected]>
wifi: ath11k: fix dest ring-buffer corruption when ring is full
Johan Hovold <[email protected]>
wifi: ath11k: fix source ring-buffer corruption
Johan Hovold <[email protected]>
wifi: ath11k: fix dest ring-buffer corruption
Nathan Chancellor <[email protected]>
wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
David Lechner <[email protected]>
iio: adc: ad_sigma_delta: change to buffer predisable
David Lechner <[email protected]>
iio: imu: bno055: fix OOB access of hw_xlate array
Marek Szyprowski <[email protected]>
zynq_fpga: use sgtable-based scatterlist wrappers
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Fix default runtime and system PM levels
Archana Patni <[email protected]>
scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
Damien Le Moal <[email protected]>
ata: libata-scsi: Fix ata_to_sense_error() status handling
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Fix race between config read submit and interrupt completion
Krzysztof Kozlowski <[email protected]>
dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints
Krzysztof Kozlowski <[email protected]>
dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
Zhang Yi <[email protected]>
ext4: fix hole length calculation overflow in non-extent inodes
Liao Yuanhong <[email protected]>
ext4: use kmalloc_array() for array space allocation
Theodore Ts'o <[email protected]>
ext4: don't try to clear the orphan_present feature block device is r/o
Ojaswin Mujoo <[email protected]>
ext4: fix reserved gdt blocks handling in fsmap
Ojaswin Mujoo <[email protected]>
ext4: fix fsmap end of range reporting with bigalloc
Andreas Dilger <[email protected]>
ext4: check fast symlink for ea_inode correctly
Namjae Jeon <[email protected]>
ksmbd: extend the connection limiting mechanism to support IPv6
Helge Deller <[email protected]>
Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
Eric Biggers <[email protected]>
lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
Myrrh Periwinkle <[email protected]>
vt: defkeymap: Map keycodes above 127 to K_HOLE
Myrrh Periwinkle <[email protected]>
vt: keyboard: Don't process Unicode characters in K_OFF mode
Youssef Samir <[email protected]>
bus: mhi: host: Detect events pointing to unexpected TREs
Alexander Wilhelm <[email protected]>
bus: mhi: host: Fix endianness of BHI vector table
Johan Hovold <[email protected]>
usb: dwc3: meson-g12a: fix device leaks at unbind
Johan Hovold <[email protected]>
usb: gadget: udc: renesas_usb3: fix device leak at unbind
Nathan Chancellor <[email protected]>
usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
Finn Thain <[email protected]>
m68k: Fix lost column on framebuffer debug console
Dan Carpenter <[email protected]>
cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
Yunhui Cui <[email protected]>
serial: 8250: fix panic due to PSLVERR
Aditya Garg <[email protected]>
HID: apple: avoid setting up battery timer for devices without battery
Aditya Garg <[email protected]>
HID: magicmouse: avoid setting up battery timer when not needed
Willy Tarreau <[email protected]>
tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
Ricardo Ribalda <[email protected]>
media: uvcvideo: Do not mark valid metadata as invalid
Youngjun Lee <[email protected]>
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
Breno Leitao <[email protected]>
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
Waiman Long <[email protected]>
mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
Randy Dunlap <[email protected]>
parisc: Makefile: fix a typo in palo.conf
Haiyang Zhang <[email protected]>
hv_netvsc: Fix panic during namespace deletion with VF
Sravan Kumar Gundu <[email protected]>
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
Qu Wenruo <[email protected]>
btrfs: do not allow relocation of partially dropped subvolumes
Filipe Manana <[email protected]>
btrfs: fix log tree replay failure due to file with 0 links and extents
Naohiro Aota <[email protected]>
btrfs: zoned: do not remove unwritten non-data block group
Filipe Manana <[email protected]>
btrfs: abort transaction during log replay if walk_log_tree() failed
Johannes Thumshirn <[email protected]>
btrfs: zoned: use filesystem size not disk size for reclaim decision
Oliver Neukum <[email protected]>
cdc-acm: fix race between initial clearing halt and open
Eric Biggers <[email protected]>
thunderbolt: Fix copy+paste error in match_service_id()
Ian Abbott <[email protected]>
comedi: fix race between polling and detaching
Myrrh Periwinkle <[email protected]>
usb: typec: ucsi: Update power_supply on power role change
Ricky Wu <[email protected]>
misc: rtsx: usb: Ensure mmc child device is active when card is present
Xinyu Liu <[email protected]>
usb: core: config: Prevent OOB read in SS endpoint companion parsing
Baokun Li <[email protected]>
ext4: fix largest free orders lists corruption on mb_optimize_scan switch
Baokun Li <[email protected]>
ext4: fix zombie groups in average fragment size lists
Jack Xiao <[email protected]>
drm/amdgpu: fix incorrect vm flags to map bo
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: replace regmap_write with regmap_update_bits
Kuninori Morimoto <[email protected]>
ASoC: fsl: merge DAI call back functions into ops
Kuninori Morimoto <[email protected]>
ASoC: soc-dai.h: merge DAI call back functions into ops
Kuninori Morimoto <[email protected]>
ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe()
Jiasheng Jiang <[email protected]>
scsi: lpfc: Remove redundant assignment to avoid memory leak
Meagan Lloyd <[email protected]>
rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
Sergey Bashirov <[email protected]>
pNFS: Fix uninited ptr deref in block/scsi layout
Sergey Bashirov <[email protected]>
pNFS: Handle RPC size limit for layoutcommits
Sergey Bashirov <[email protected]>
pNFS: Fix disk addr range check in block/scsi layout
Sergey Bashirov <[email protected]>
pNFS: Fix stripe mapping in block/scsi layout
John Garry <[email protected]>
block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Fix uninitialized pointer error in probe()
Buday Csaba <[email protected]>
net: phy: smsc: add proper reset flags for LAN8710A
Corey Minyard <[email protected]>
ipmi: Fix strcpy source and destination the same
Yann E. MORIN <[email protected]>
kconfig: lxdialog: fix 'space' to (de)select options
Masahiro Yamada <[email protected]>
kconfig: gconf: fix potential memory leak in renderer_edited()
Masahiro Yamada <[email protected]>
kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
Breno Leitao <[email protected]>
ipmi: Use dev_warn_ratelimited() for incorrect message warnings
Artem Sadovnikov <[email protected]>
vfio/mlx5: fix possible overflow in tracking max message size
John Garry <[email protected]>
scsi: aacraid: Stop using PCI_IRQ_AFFINITY
Maurizio Lombardi <[email protected]>
scsi: target: core: Generate correct identifiers for PR OUT transport IDs
Ranjan Kumar <[email protected]>
scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
Shankari Anand <[email protected]>
kconfig: nconf: Ensure null termination where strncpy is used
Keith Busch <[email protected]>
vfio/type1: conditional rescheduling while pinning
Suchit Karunakaran <[email protected]>
kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
fangzhong.zhou <[email protected]>
i2c: Force DLL0945 touchpad i2c freq to 100khz
Mateusz Guzik <[email protected]>
apparmor: use the condition in AA_BUG_FMT even with debug disabled
Benjamin Marzinski <[email protected]>
dm-table: fix checking for rq stackable devices
Mikulas Patocka <[email protected]>
dm-mpath: don't print the "loaded" message if registering fails
Jorge Marques <[email protected]>
i3c: master: Initialize ret in i3c_i2c_notifier_call()
Wolfram Sang <[email protected]>
i3c: don't fail if GETHDRCAP is unsupported
Meagan Lloyd <[email protected]>
rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
Wolfram Sang <[email protected]>
i3c: add missing include to internal header
Petr Pavlu <[email protected]>
module: Prevent silent truncation of module name in delete_module(2)
Purva Yeshi <[email protected]>
md: dm-zoned-target: Initialize return variable r to avoid uninitialized use
Bharat Bhushan <[email protected]>
crypto: octeontx2 - add timeout for load_fvc completion poll
chenchangcheng <[email protected]>
media: uvcvideo: Fix bandwidth issue for Alcor camera
Alex Guo <[email protected]>
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
Alex Guo <[email protected]>
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
Wolfram Sang <[email protected]>
media: usb: hdpvr: disable zero-length read messages
Dave Stevenson <[email protected]>
media: tc358743: Increase FIFO trigger level to 374
Dave Stevenson <[email protected]>
media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
Dave Stevenson <[email protected]>
media: tc358743: Check I2C succeeded during probe
Cheick Traore <[email protected]>
pinctrl: stm32: Manage irq affinity settings
Damien Le Moal <[email protected]>
scsi: mpi3mr: Correctly handle ATA device errors
Damien Le Moal <[email protected]>
scsi: mpt3sas: Correctly handle ATA device errors
Justin Tee <[email protected]>
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
Arnd Bergmann <[email protected]>
RDMA/core: reduce stack using in nldev_stat_get_doit()
Yury Norov [NVIDIA] <[email protected]>
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
Amelie Delaunay <[email protected]>
dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs
Johan Adolfsson <[email protected]>
leds: leds-lp50xx: Handle reg to get correct multi_index
Niklas Söderlund <[email protected]>
media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control
Shiji Yang <[email protected]>
MIPS: lantiq: falcon: sysctrl: fix request memory check logic
Thomas Weißschuh <[email protected]>
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
Arnaud Lecomte <[email protected]>
jfs: upper bound check of tree index in dbAllocAG
Edward Adam Davis <[email protected]>
jfs: Regular file corruption check
Lizhi Xu <[email protected]>
jfs: truncate good inode pages when hard link is 0
jackysliu <[email protected]>
scsi: bfa: Double-free fix
Ziyan Fu <[email protected]>
watchdog: iTCO_wdt: Report error if timeout configuration fails
Shiji Yang <[email protected]>
MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}Florin Leotescu <[email protected]>
hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state
Sebastian Reichel <[email protected]>
watchdog: dw_wdt: Fix default timeout
Amir Mohammad Jahangirzad <[email protected]>
fs/orangefs: use snprintf() instead of sprintf()
Showrya M N <[email protected]>
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
Theodore Ts'o <[email protected]>
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
Zhiqi Song <[email protected]>
crypto: hisilicon/hpre - fix dma unmap sequence
Yongzhen Zhang <[email protected]>
fbdev: fix potential buffer overflow in do_register_framebuffer()
Pali Rohár <[email protected]>
cifs: Fix calling CIFSFindFirst() for root path without msearch
Aaron Plattner <[email protected]>
watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition
Mario Limonciello <[email protected]>
drm/amd/display: Only finalize atomic_obj if it was initialized
Jason Wang <[email protected]>
vhost: fail early when __vhost_add_used() fails
Will Deacon <[email protected]>
vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
Tvrtko Ursulin <[email protected]>
drm/ttm: Respect the shrinker core free target
Yonghong Song <[email protected]>
selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
Jakub Kicinski <[email protected]>
uapi: in6: restore visibility of most IPv6 socket options
Emily Deng <[email protected]>
drm/ttm: Should to return the evict error
Hari Kalavakunta <[email protected]>
net: ncsi: Fix buffer overflow in fetching version id
Shannon Nelson <[email protected]>
ionic: clean dbpage in de-init
Thomas Fourier <[email protected]>
wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
Breno Leitao <[email protected]>
ptp: Use ratelimite for freerun error message
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent DIS_LEARNING access on BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
Alok Tiwari <[email protected]>
gve: Return error for unknown admin queue command
Gal Pressman <[email protected]>
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
Mario Limonciello <[email protected]>
drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual
Heiner Kallweit <[email protected]>
dpaa_eth: don't use fixed_phy_change_carrier
Nicolas Escande <[email protected]>
neighbour: add support for NUD_PERMANENT proxy entries
Stanislaw Gruszka <[email protected]>
wifi: iwlegacy: Check rate_idx range after addition
Mina Almasry <[email protected]>
netmem: fix skb_frag_address_safe with unreadable skbs
Thomas Fourier <[email protected]>
powerpc: floppy: Add missing checks after DMA map
Thomas Fourier <[email protected]>
wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_rx_interrupt().
Ramya Gnanasekar <[email protected]>
wifi: mac80211: update radar_required in channel context after channel switch
Wen Chen <[email protected]>
drm/amd/display: Fix 'failed to blank crtc!'
Pagadala Yesu Anjaneyulu <[email protected]>
wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
Rand Deeb <[email protected]>
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
Ilya Bakoulin <[email protected]>
drm/amd/display: Separate set_gsl from set_gsl_source_select
Jonas Rebmann <[email protected]>
net: fec: allow disable coalescing
Eric Work <[email protected]>
net: atlantic: add set_power to fw_ops for atl2 to fix wol
zhangjianrong <[email protected]>
net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
zhangjianrong <[email protected]>
net: thunderbolt: Enable end-to-end flow control also in transmit
Mark Brown <[email protected]>
kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
Bitterblue Smith <[email protected]>
wifi: rtw89: Disable deep power saving for USB/SDIO
Bitterblue Smith <[email protected]>
wifi: rtw89: Fix rtw89_mac_power_switch() for USB
Rob Clark <[email protected]>
drm/msm: use trylock for debugfs
Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc().
Thomas Fourier <[email protected]>
(powerpc/512) Fix possible dma_unmap_single() on uninitialized pointer
Johannes Berg <[email protected]>
wifi: mac80211: don't complete management TX on SAE commit
Chris Mason <[email protected]>
sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
Sven Schnelle <[email protected]>
s390/stp: Remove udelay from stp_sync_clock()
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: fix scan request validation
Thomas Weißschuh <[email protected]>
um: Re-evaluate thread flags repeatedly
Alok Tiwari <[email protected]>
net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
Oscar Maes <[email protected]>
net: ipv4: fix incorrect MTU in broadcast routes
Ilan Peer <[email protected]>
wifi: cfg80211: Fix interface type validation
Matt Johnston <[email protected]>
net: mctp: Prevent duplicate binds
Paul E. McKenney <[email protected]>
rcu: Protect ->defer_qs_iw_pending from data race
Breno Leitao <[email protected]>
arm64: Mark kernel as tainted on SAE and SError panic
Leon Romanovsky <[email protected]>
net/mlx5e: Properly access RCU protected qdisc_sleeping variable
Thomas Fourier <[email protected]>
net: ag71xx: Add missing check after DMA map
Thomas Fourier <[email protected]>
et131x: Add missing check after DMA map
Bitterblue Smith <[email protected]>
wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
Alok Tiwari <[email protected]>
be2net: Use correct byte order and format string for TCP seq and ack_seq
Sven Schnelle <[email protected]>
s390/time: Use monotonic clock in get_cycles()
Johannes Berg <[email protected]>
wifi: cfg80211: reject HTC bit for management frames
Steven Rostedt <[email protected]>
ktest.pl: Prevent recursion of default variable options
Oliver Neukum <[email protected]>
net: usb: cdc-ncm: check for filtering capability
Anthoine Bourgeois <[email protected]>
xen/netfront: Fix TX response spurious interrupts
Xinxin Wan <[email protected]>
ASoC: codecs: rt5640: Retry DEVICE_ID verification
Jonathan Santos <[email protected]>
iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
Cristian Ciocaltea <[email protected]>
ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
Christophe Leroy <[email protected]>
ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
Lucy Thrun <[email protected]>
ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
Tomasz Michalec <[email protected]>
platform/chrome: cros_ec_typec: Defer probe on missing EC parent
Kees Cook <[email protected]>
platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
Gautham R. Shenoy <[email protected]>
pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
Oliver Neukum <[email protected]>
usb: core: usb_submit_urb: downgrade type check
Tomasz Michalec <[email protected]>
usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
Peter Ujfalusi <[email protected]>
ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
Alok Tiwari <[email protected]>
ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
Mark Brown <[email protected]>
ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
Pawan Gupta <[email protected]>
x86/bugs: Avoid warning when overriding return thunk
Takashi Iwai <[email protected]>
ALSA: hda: Disable jack polling at shutdown
Takashi Iwai <[email protected]>
ALSA: hda: Handle the jack polling always via a work
Ulf Hansson <[email protected]>
mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
Hans de Goede <[email protected]>
mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
Peter Robinson <[email protected]>
reset: brcmstb: Enable reset drivers for ARCH_BCM2835
Eliav Farber <[email protected]>
pps: clients: gpio: fix interrupt handling order in remove path
Breno Leitao <[email protected]>
ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
Sebastian Ott <[email protected]>
ACPI: processor: fix acpi_object initialization
tuhaowen <[email protected]>
PM: sleep: console: Fix the black screen issue
Hsin-Te Yuan <[email protected]>
thermal: sysfs: Return ENODATA instead of EAGAIN for reads
Rafael J. Wysocki <[email protected]>
PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
Zhu Qiyu <[email protected]>
ACPI: PRM: Reduce unnecessary printing to avoid user confusion
Masami Hiramatsu (Google) <[email protected]>
selftests: tracing: Use mutex_unlock for testing glob filter
Thomas Weißschuh <[email protected]>
tools/build: Fix s390(x) cross-compilation with clang
Aaron Kling <[email protected]>
ARM: tegra: Use I/O memcpy to write to IRAM
Bartosz Golaszewski <[email protected]>
gpio: tps65912: check the return value of regmap_update_bits()
David Lechner <[email protected]>
iio: adc: ad_sigma_delta: don't overallocate scan buffer
Thomas Weißschuh <[email protected]>
tools/nolibc: define time_t in terms of __kernel_old_time_t
David Collins <[email protected]>
thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
Kuninori Morimoto <[email protected]>
ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
Shubhrajyoti Datta <[email protected]>
EDAC/synopsys: Clear the ECC counters on init
Lifeng Zheng <[email protected]>
PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
Alexander Kochetkov <[email protected]>
ARM: rockchip: fix kernel hang during smp initialization
Lifeng Zheng <[email protected]>
cpufreq: Exit governor when failed to start old governor
Bartosz Golaszewski <[email protected]>
gpio: wcd934x: check the return value of regmap_update_bits()
Hiago De Franco <[email protected]>
remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
Mario Limonciello <[email protected]>
usb: xhci: Avoid showing errors during surprise removal
Jay Chen <[email protected]>
usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
Mario Limonciello <[email protected]>
usb: xhci: Avoid showing warnings for dying controller
Benson Leung <[email protected]>
usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
Cynthia Huang <[email protected]>
selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
Prashant Malani <[email protected]>
cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
Su Hui <[email protected]>
usb: xhci: print xhci->xhc_state when queue_command failed
Al Viro <[email protected]>
securityfs: don't pin dentries twice, once is enough...
Al Viro <[email protected]>
fix locking in efi_secret_unlink()
Wei Gao <[email protected]>
ext2: Handle fiemap on empty files to prevent EINVAL
Rong Zhang <[email protected]>
fs/ntfs3: correctly create symlink for relative path
Lizhi Xu <[email protected]>
fs/ntfs3: Add sanity check for file name
Damien Le Moal <[email protected]>
ata: libata-sata: Disallow changing LPM state if not supported
Al Viro <[email protected]>
better lockdep annotations for simple_recursive_removal()
Viacheslav Dubeyko <[email protected]>
hfs: fix not erasing deleted b-tree node issue
Sarah Newman <[email protected]>
drbd: add missing kref_get in handle_write_conflicts
Jan Kara <[email protected]>
udf: Verify partition map count
NeilBrown <[email protected]>
smb/server: avoid deadlock when linking with ReplaceIfExists
Kees Cook <[email protected]>
arm64: Handle KCOV __init vs inline mismatches
Tetsuo Handa <[email protected]>
hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
Viacheslav Dubeyko <[email protected]>
hfs: fix slab-out-of-bounds in hfs_bnode_read()
Florian Westphal <[email protected]>
netfilter: ctnetlink: fix refcount leak on table dump
Sabrina Dubroca <[email protected]>
udp: also consider secpath when evaluating ipsec use for checksumming
Maxim Levitsky <[email protected]>
KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest
Maxim Levitsky <[email protected]>
KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
Maxim Levitsky <[email protected]>
KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
Sean Christopherson <[email protected]>
KVM: VMX: Extract checking of guest's DEBUGCTL into helper
Sean Christopherson <[email protected]>
KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
Sean Christopherson <[email protected]>
KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
Sean Christopherson <[email protected]>
KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap
Sean Christopherson <[email protected]>
KVM: x86: Fully defer to vendor code to decide how to force immediate exit
Sean Christopherson <[email protected]>
KVM: VMX: Handle KVM-induced preemption timer exits in fastpath for L2
Sean Christopherson <[email protected]>
KVM: x86: Move handling of is_guest_mode() into fastpath exit handlers
Sean Christopherson <[email protected]>
KVM: VMX: Handle forced exit due to preemption timer in fastpath
Sean Christopherson <[email protected]>
KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
Sean Christopherson <[email protected]>
KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
Sean Christopherson <[email protected]>
KVM: x86/pmu: Gate all "unimplemented MSR" prints on report_ignored_msrs
Sean Christopherson <[email protected]>
KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs
Sean Christopherson <[email protected]>
KVM: x86: Snapshot the host's DEBUGCTL in common x86
Chao Gao <[email protected]>
KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
Sean Christopherson <[email protected]>
KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
Sean Christopherson <[email protected]>
KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)
Sean Christopherson <[email protected]>
KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
Rafael J. Wysocki <[email protected]>
ACPI: processor: perflib: Move problematic pr->performance check
Jiayi Li <[email protected]>
ACPI: processor: perflib: Fix initial _PPC limit application
Andy Shevchenko <[email protected]>
Documentation: ACPI: Fix parent device references
Jann Horn <[email protected]>
eventpoll: Fix semi-unbounded recursion
Sasha Levin <[email protected]>
fs: Prevent file descriptor table allocations exceeding INT_MAX
Ma Ke <[email protected]>
sunvdc: Balance device refcount in vdc_port_mpgroup_check
Haoran Jiang <[email protected]>
LoongArch: BPF: Fix jump offset calculation in tailcall
Huacai Chen <[email protected]>
PCI: Extend isolated function probing to LoongArch
Trond Myklebust <[email protected]>
NFS: Fix the setting of capabilities when automounting a new filesystem
Dai Ngo <[email protected]>
NFSD: detect mismatch of file handle and delegation stateid in OPEN op
Jeff Layton <[email protected]>
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
Xu Yang <[email protected]>
net: usb: asix_devices: add phy_mask for ax88772 mdio bus
Johan Hovold <[email protected]>
net: dpaa: fix device leak when querying time stamp info
Johan Hovold <[email protected]>
net: mtk_eth_soc: fix device leak at probe
Johan Hovold <[email protected]>
net: gianfar: fix device leak when querying time stamp info
Florian Larysch <[email protected]>
net: phy: micrel: fix KSZ8081/KSZ8091 cable test
Fedor Pchelkin <[email protected]>
netlink: avoid infinite retry looping in netlink_unicast()
David Thompson <[email protected]>
gpio: mlxbf2: use platform_get_irq_optional()
Harald Mommer <[email protected]>
gpio: virtio: Fix config space reading.
Wang Zhaolong <[email protected]>
smb: client: remove redundant lstrp update in negotiate protocol
Steve French <[email protected]>
smb3: fix for slab out of bounds on mount to ksmbd
Christopher Eby <[email protected]>
ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
Vasiliy Kovalev <[email protected]>
ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
Takashi Iwai <[email protected]>
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
Takashi Iwai <[email protected]>
ALSA: usb-audio: Validate UAC3 power domain descriptors, too
Pavel Begunkov <[email protected]>
io_uring: don't use int for ABI
-------------
Diffstat:
.../bindings/display/sprd/sprd,sharkl3-dpu.yaml | 2 +- .../display/sprd/sprd,sharkl3-dsi-host.yaml | 2 +- Documentation/firmware-guide/acpi/i2c-muxes.rst | 8 +- Documentation/networking/bonding.rst | 12 ++ Documentation/networking/mptcp-sysctl.rst | 2 + Makefile | 6 +- arch/arm/Makefile | 2 +- arch/arm/mach-rockchip/platsmp.c | 15 +- arch/arm/mach-tegra/reset.c | 2 +- arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 1 - arch/arm64/include/asm/acpi.h | 2 +- arch/arm64/kernel/cpufeature.c | 1 + arch/arm64/kernel/entry.S | 6 + arch/arm64/kernel/fpsimd.c | 4 +- arch/arm64/kernel/traps.c | 1 + arch/arm64/mm/fault.c | 1 + arch/arm64/mm/ptdump_debugfs.c | 3 - arch/loongarch/net/bpf_jit.c | 21 +- arch/m68k/kernel/head.S | 31 ++- arch/mips/crypto/chacha-core.S | 20 +- arch/mips/include/asm/vpe.h | 8 + arch/mips/kernel/process.c | 16 +- arch/mips/lantiq/falcon/sysctrl.c | 23 +-- arch/parisc/Makefile | 6 +- arch/parisc/include/asm/special_insns.h | 28 +++ arch/parisc/include/asm/uaccess.h | 21 +- arch/parisc/kernel/entry.S | 17 +- arch/parisc/kernel/syscall.S | 30 ++- arch/parisc/lib/memcpy.c | 19 +- arch/parisc/mm/fault.c | 4 + arch/powerpc/include/asm/floppy.h | 5 +- arch/powerpc/platforms/512x/mpc512x_lpbfifo.c | 6 +- arch/s390/hypfs/hypfs_dbfs.c | 19 +- arch/s390/include/asm/timex.h | 13 +- arch/s390/kernel/time.c | 2 +- arch/s390/mm/dump_pagetables.c | 2 - arch/um/include/asm/thread_info.h | 4 + arch/um/kernel/process.c | 18 +- arch/x86/events/intel/core.c | 2 +- arch/x86/include/asm/kvm-x86-ops.h | 2 - arch/x86/include/asm/kvm_host.h | 24 ++- arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/reboot.h | 5 +- arch/x86/include/asm/virtext.h | 10 - arch/x86/include/asm/xen/hypercall.h | 5 +- arch/x86/kernel/cpu/bugs.c | 5 +- arch/x86/kernel/cpu/hygon.c | 3 + arch/x86/kernel/cpu/mce/amd.c | 13 +- arch/x86/kernel/reboot.c | 43 ++-- arch/x86/kvm/hyperv.c | 10 +- arch/x86/kvm/lapic.c | 61 ++++-- arch/x86/kvm/lapic.h | 1 + arch/x86/kvm/svm/svm.c | 49 +++-- arch/x86/kvm/svm/vmenter.S | 9 +- arch/x86/kvm/trace.h | 9 +- arch/x86/kvm/vmx/nested.c | 26 ++- arch/x86/kvm/vmx/pmu_intel.c | 8 +- arch/x86/kvm/vmx/vmx.c | 183 +++++++++++------ arch/x86/kvm/vmx/vmx.h | 31 ++- arch/x86/kvm/x86.c | 65 +++--- arch/x86/kvm/x86.h | 12 ++ block/blk-core.c | 26 ++- block/blk-settings.c | 2 +- drivers/acpi/acpi_processor.c | 2 +- drivers/acpi/apei/ghes.c | 2 + drivers/acpi/pfr_update.c | 2 +- drivers/acpi/prmt.c | 26 ++- drivers/acpi/processor_perflib.c | 11 + drivers/ata/Kconfig | 35 +++- drivers/ata/libata-sata.c | 5 + drivers/ata/libata-scsi.c | 20 +- drivers/base/power/runtime.c | 5 + drivers/block/drbd/drbd_receiver.c | 6 +- drivers/block/sunvdc.c | 4 +- drivers/bus/mhi/host/boot.c | 8 +- drivers/bus/mhi/host/internal.h | 4 +- drivers/bus/mhi/host/main.c | 12 +- drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_watchdog.c | 59 ++++-- drivers/comedi/comedi_fops.c | 38 +++- drivers/comedi/comedi_internal.h | 1 + drivers/comedi/drivers.c | 40 ++-- drivers/comedi/drivers/pcl726.c | 3 +- drivers/cpufreq/armada-8k-cpufreq.c | 2 +- drivers/cpufreq/cppc_cpufreq.c | 2 +- drivers/cpufreq/cpufreq.c | 8 +- drivers/crypto/hisilicon/hpre/hpre_crypto.c | 8 +- .../crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 16 +- drivers/crypto/qat/qat_4xxx/adf_4xxx_hw_data.c | 13 ++ drivers/crypto/qat/qat_common/adf_accel_devices.h | 1 + drivers/crypto/qat/qat_common/adf_gen4_hw_data.h | 6 + drivers/crypto/qat/qat_common/adf_init.c | 3 + drivers/devfreq/governor_userspace.c | 6 +- drivers/dma/stm32-dma.c | 2 +- drivers/edac/synopsys_edac.c | 93 ++++----- drivers/fpga/zynq-fpga.c | 10 +- drivers/gpio/gpio-mlxbf2.c | 2 +- drivers/gpio/gpio-tps65912.c | 7 +- drivers/gpio/gpio-virtio.c | 9 +- drivers/gpio/gpio-wcd934x.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 57 +++--- drivers/gpu/drm/amd/amdkfd/kfd_module.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../gpu/drm/amd/display/dc/bios/command_table.c | 2 +- drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 1 - .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 2 - .../amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 40 ++-- .../amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c | 31 +-- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 11 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 3 + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 + drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 37 ++-- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 4 +- drivers/gpu/drm/msm/msm_gem.c | 3 +- drivers/gpu/drm/msm/msm_gem.h | 6 + drivers/gpu/drm/scheduler/sched_entity.c | 21 +- drivers/gpu/drm/ttm/ttm_pool.c | 8 +- drivers/gpu/drm/ttm/ttm_resource.c | 3 + drivers/hid/hid-apple.c | 13 +- drivers/hid/hid-magicmouse.c | 56 ++++-- drivers/hwmon/emc2305.c | 10 +- drivers/hwmon/gsc-hwmon.c | 4 +- drivers/i2c/i2c-core-acpi.c | 1 + drivers/i3c/internals.h | 1 + drivers/i3c/master.c | 4 +- drivers/iio/adc/ad7768-1.c | 23 ++- drivers/iio/adc/ad_sigma_delta.c | 6 +- drivers/iio/imu/bno055/bno055.c | 11 +- drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c | 6 +- drivers/iio/light/as73211.c | 2 +- drivers/iio/light/hid-sensor-prox.c | 8 +- drivers/iio/pressure/bmp280-core.c | 9 +- drivers/iio/proximity/isl29501.c | 14 +- drivers/iio/temperature/maxim_thermocouple.c | 26 ++- drivers/infiniband/core/nldev.c | 22 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 + drivers/infiniband/hw/erdma/erdma_verbs.c | 4 +- drivers/infiniband/hw/hfi1/affinity.c | 44 ++-- drivers/iommu/amd/init.c | 4 +- drivers/leds/leds-lp50xx.c | 11 +- drivers/md/dm-ps-historical-service-time.c | 4 +- drivers/md/dm-ps-queue-length.c | 4 +- drivers/md/dm-ps-round-robin.c | 4 +- drivers/md/dm-ps-service-time.c | 4 +- drivers/md/dm-table.c | 10 +- drivers/md/dm-zoned-target.c | 2 +- drivers/media/cec/usb/rainshadow/rainshadow-cec.c | 3 +- drivers/media/dvb-frontends/dib7000p.c | 8 + drivers/media/i2c/hi556.c | 26 +-- drivers/media/i2c/ov2659.c | 3 +- drivers/media/i2c/tc358743.c | 86 +++++--- drivers/media/platform/qcom/camss/camss.c | 4 +- drivers/media/platform/qcom/venus/core.c | 8 +- drivers/media/platform/qcom/venus/core.h | 2 + drivers/media/platform/qcom/venus/helpers.c | 2 +- drivers/media/platform/qcom/venus/hfi_helper.h | 61 +++++- drivers/media/platform/qcom/venus/hfi_msgs.c | 85 +++++--- drivers/media/platform/qcom/venus/hfi_venus.c | 5 + drivers/media/platform/qcom/venus/vdec.c | 13 +- drivers/media/platform/qcom/venus/vdec_ctrls.c | 2 +- drivers/media/platform/qcom/venus/venc.c | 9 +- drivers/media/platform/qcom/venus/venc_ctrls.c | 2 +- drivers/media/test-drivers/vivid/vivid-ctrls.c | 3 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 4 +- drivers/media/usb/gspca/vicam.c | 10 +- drivers/media/usb/hdpvr/hdpvr-i2c.c | 6 + drivers/media/usb/usbtv/usbtv-video.c | 4 + drivers/media/usb/uvc/uvc_driver.c | 3 + drivers/media/usb/uvc/uvc_video.c | 21 +- drivers/media/v4l2-core/v4l2-common.c | 8 +- drivers/media/v4l2-core/v4l2-ctrls-core.c | 1 - drivers/memstick/core/memstick.c | 1 - drivers/memstick/host/rtsx_usb_ms.c | 1 + drivers/misc/cardreader/rtsx_usb.c | 16 +- drivers/misc/mei/bus.c | 6 + drivers/mmc/host/rtsx_usb_sdmmc.c | 4 +- drivers/mmc/host/sdhci-msm.c | 14 ++ drivers/mmc/host/sdhci-pci-gli.c | 33 +-- drivers/most/core.c | 2 +- drivers/mtd/nand/raw/fsmc_nand.c | 2 + drivers/mtd/nand/raw/renesas-nand-controller.c | 6 + drivers/mtd/nand/spi/core.c | 5 +- drivers/mtd/spi-nor/swp.c | 19 +- drivers/net/bonding/bond_3ad.c | 224 ++++++++++++++++++--- drivers/net/bonding/bond_main.c | 1 + drivers/net/bonding/bond_netlink.c | 16 ++ drivers/net/bonding/bond_options.c | 29 ++- drivers/net/dsa/b53/b53_common.c | 63 ++++-- drivers/net/dsa/b53/b53_regs.h | 2 + drivers/net/dummy.c | 1 + drivers/net/ethernet/agere/et131x.c | 36 ++++ drivers/net/ethernet/aquantia/atlantic/aq_hw.h | 2 + .../aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c | 39 ++++ drivers/net/ethernet/atheros/ag71xx.c | 9 + drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 8 +- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 - drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 4 +- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 14 +- drivers/net/ethernet/freescale/fec_main.c | 34 ++-- drivers/net/ethernet/freescale/gianfar_ethtool.c | 4 +- drivers/net/ethernet/google/gve/gve_adminq.c | 1 + drivers/net/ethernet/google/gve/gve_main.c | 2 + drivers/net/ethernet/intel/igc/igc_main.c | 14 +- drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 4 +- drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 2 + drivers/net/ethernet/mediatek/mtk_wed.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 + drivers/net/ethernet/mellanox/mlxsw/trap.h | 1 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 7 +- drivers/net/geneve.c | 1 + drivers/net/hyperv/hyperv_net.h | 3 + drivers/net/hyperv/netvsc_drv.c | 29 ++- drivers/net/loopback.c | 1 + drivers/net/phy/micrel.c | 2 + drivers/net/phy/mscc/mscc.h | 12 ++ drivers/net/phy/mscc/mscc_main.c | 12 ++ drivers/net/phy/mscc/mscc_ptp.c | 49 +++-- drivers/net/phy/smsc.c | 1 + drivers/net/ppp/ppp_generic.c | 17 +- drivers/net/thunderbolt.c | 21 +- drivers/net/usb/asix_devices.c | 1 + drivers/net/usb/cdc_ncm.c | 20 +- drivers/net/veth.c | 1 + drivers/net/vxlan/vxlan_core.c | 1 + drivers/net/wireless/ath/ath11k/ce.c | 3 - drivers/net/wireless/ath/ath11k/dp_rx.c | 3 - drivers/net/wireless/ath/ath11k/hal.c | 33 ++- .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 5 +- drivers/net/wireless/intel/iwlwifi/dvm/rs.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 7 +- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- drivers/net/wireless/realtek/rtlwifi/pci.c | 23 ++- drivers/net/wireless/realtek/rtw89/core.c | 3 + drivers/net/wireless/realtek/rtw89/fw.c | 9 +- drivers/net/wireless/realtek/rtw89/fw.h | 2 + drivers/net/wireless/realtek/rtw89/mac.c | 19 ++ drivers/net/wireless/realtek/rtw89/reg.h | 1 + drivers/net/xen-netfront.c | 5 - drivers/pci/controller/pcie-rockchip-host.c | 49 +++-- drivers/pci/controller/pcie-rockchip.h | 11 +- drivers/pci/endpoint/pci-ep-cfs.c | 1 + drivers/pci/endpoint/pci-epf-core.c | 2 +- drivers/pci/pci-acpi.c | 4 +- drivers/pci/pci.c | 8 +- drivers/pci/probe.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + drivers/platform/chrome/cros_ec.c | 19 +- drivers/platform/chrome/cros_ec_typec.c | 4 +- drivers/platform/x86/thinkpad_acpi.c | 4 +- drivers/pps/clients/pps-gpio.c | 5 +- drivers/ptp/ptp_clock.c | 2 +- drivers/pwm/pwm-imx-tpm.c | 9 + drivers/pwm/pwm-mediatek.c | 71 +++---- drivers/remoteproc/imx_rproc.c | 4 +- drivers/reset/Kconfig | 10 +- drivers/rtc/rtc-ds1307.c | 15 +- drivers/s390/char/sclp.c | 11 +- drivers/scsi/aacraid/comminit.c | 3 +- drivers/scsi/bfa/bfad_im.c | 1 + drivers/scsi/libiscsi.c | 3 +- drivers/scsi/lpfc/lpfc_debugfs.c | 1 - drivers/scsi/lpfc/lpfc_scsi.c | 4 + drivers/scsi/mpi3mr/mpi3mr.h | 6 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 17 +- drivers/scsi/mpi3mr/mpi3mr_os.c | 22 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 19 ++ drivers/scsi/qla4xxx/ql4_os.c | 2 + drivers/scsi/scsi_scan.c | 2 +- drivers/scsi/scsi_transport_sas.c | 62 ++++-- drivers/soc/qcom/mdt_loader.c | 68 ++++++- drivers/soc/tegra/pmc.c | 51 +++-- drivers/staging/media/imx/imx-media-csc-scaler.c | 2 +- drivers/target/target_core_fabric_lib.c | 65 ++++-- drivers/target/target_core_internal.h | 4 +- drivers/target/target_core_pr.c | 18 +- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 43 +++- drivers/thermal/thermal_sysfs.c | 9 +- drivers/thunderbolt/domain.c | 2 +- drivers/tty/serial/8250/8250_port.c | 3 +- drivers/tty/vt/defkeymap.c_shipped | 112 +++++++++++ drivers/tty/vt/keyboard.c | 2 +- drivers/ufs/host/ufs-exynos.c | 4 +- drivers/ufs/host/ufshcd-pci.c | 42 +++- drivers/usb/atm/cxacru.c | 172 ++++++++-------- drivers/usb/class/cdc-acm.c | 11 +- drivers/usb/core/config.c | 10 +- drivers/usb/core/hcd.c | 8 +- drivers/usb/core/quirks.c | 1 + drivers/usb/core/urb.c | 2 +- drivers/usb/dwc3/dwc3-imx8mp.c | 6 +- drivers/usb/dwc3/dwc3-meson-g12a.c | 3 + drivers/usb/dwc3/ep0.c | 20 +- drivers/usb/dwc3/gadget.c | 19 +- drivers/usb/gadget/udc/renesas_usb3.c | 1 + drivers/usb/host/xhci-mem.c | 2 + drivers/usb/host/xhci-pci-renesas.c | 7 +- drivers/usb/host/xhci-ring.c | 10 +- drivers/usb/host/xhci.c | 6 +- drivers/usb/musb/omap2430.c | 20 +- drivers/usb/storage/realtek_cr.c | 2 +- drivers/usb/storage/unusual_devs.h | 29 +++ drivers/usb/typec/mux/intel_pmc_mux.c | 2 +- drivers/usb/typec/tcpm/fusb302.c | 8 + drivers/usb/typec/ucsi/psy.c | 2 +- drivers/usb/typec/ucsi/ucsi.c | 1 + drivers/usb/typec/ucsi/ucsi.h | 7 +- drivers/vfio/pci/mlx5/cmd.c | 4 +- drivers/vfio/vfio_iommu_type1.c | 7 + drivers/vhost/vhost.c | 3 + drivers/vhost/vsock.c | 6 +- drivers/video/console/vgacon.c | 2 +- drivers/video/fbdev/core/fbcon.c | 9 +- drivers/video/fbdev/core/fbmem.c | 3 + drivers/virt/coco/efi_secret/efi_secret.c | 10 +- drivers/watchdog/dw_wdt.c | 2 + drivers/watchdog/iTCO_wdt.c | 6 +- drivers/watchdog/sbsa_gwdt.c | 50 ++++- fs/btrfs/block-group.c | 27 ++- fs/btrfs/ctree.c | 9 +- fs/btrfs/ordered-data.c | 12 +- fs/btrfs/qgroup.c | 31 ++- fs/btrfs/relocation.c | 19 ++ fs/btrfs/send.c | 39 ++++ fs/btrfs/tree-log.c | 60 ++++-- fs/btrfs/zoned.c | 3 +- fs/buffer.c | 2 +- fs/crypto/fscrypt_private.h | 17 ++ fs/crypto/hkdf.c | 2 +- fs/crypto/keysetup.c | 3 +- fs/crypto/keysetup_v1.c | 3 +- fs/eventpoll.c | 60 ++++-- fs/ext2/inode.c | 12 +- fs/ext4/fsmap.c | 23 ++- fs/ext4/indirect.c | 4 +- fs/ext4/inline.c | 19 +- fs/ext4/inode.c | 2 +- fs/ext4/mballoc.c | 69 +++---- fs/ext4/orphan.c | 5 +- fs/ext4/super.c | 8 +- fs/f2fs/data.c | 2 + fs/f2fs/f2fs.h | 1 - fs/f2fs/inode.c | 7 + fs/f2fs/node.c | 10 + fs/file.c | 15 ++ fs/hfs/bnode.c | 93 +++++++++ fs/hfsplus/bnode.c | 92 +++++++++ fs/hfsplus/unicode.c | 7 + fs/hfsplus/xattr.c | 6 +- fs/hugetlbfs/inode.c | 2 +- fs/jbd2/checkpoint.c | 1 + fs/jfs/file.c | 3 + fs/jfs/inode.c | 2 +- fs/jfs/jfs_dmap.c | 6 + fs/libfs.c | 4 +- fs/namespace.c | 34 ++-- fs/nfs/blocklayout/blocklayout.c | 4 +- fs/nfs/blocklayout/dev.c | 5 +- fs/nfs/blocklayout/extent_tree.c | 20 +- fs/nfs/client.c | 44 +++- fs/nfs/internal.h | 2 +- fs/nfs/nfs4client.c | 20 +- fs/nfs/nfs4proc.c | 2 +- fs/nfs/pnfs.c | 11 +- fs/nfsd/nfs4state.c | 34 +++- fs/ntfs3/dir.c | 3 + fs/ntfs3/inode.c | 31 +-- fs/orangefs/orangefs-debugfs.c | 2 +- fs/smb/client/cifssmb.c | 10 + fs/smb/client/connect.c | 1 - fs/smb/client/sess.c | 9 + fs/smb/client/smb2ops.c | 11 +- fs/smb/server/connection.c | 3 +- fs/smb/server/connection.h | 7 +- fs/smb/server/smb2pdu.c | 16 +- fs/smb/server/transport_rdma.c | 5 +- fs/smb/server/transport_rdma.h | 4 +- fs/smb/server/transport_tcp.c | 26 ++- fs/squashfs/super.c | 14 +- fs/udf/super.c | 13 +- fs/xfs/xfs_itable.c | 6 +- include/linux/blk_types.h | 6 +- include/linux/compiler.h | 8 - include/linux/fs.h | 4 +- include/linux/hypervisor.h | 3 + include/linux/if_vlan.h | 6 +- include/linux/iosys-map.h | 7 +- include/linux/memfd.h | 14 ++ include/linux/mm.h | 76 +++++-- include/linux/pci.h | 10 +- include/linux/platform_data/cros_ec_proto.h | 4 + include/linux/skbuff.h | 8 +- include/linux/usb/cdc_ncm.h | 1 + include/linux/virtio_vsock.h | 7 +- include/net/bond_3ad.h | 3 + include/net/bond_options.h | 1 + include/net/bonding.h | 23 +++ include/net/cfg80211.h | 2 +- include/net/mac80211.h | 2 + include/net/neighbour.h | 1 + include/sound/soc-dai.h | 13 ++ include/uapi/linux/if_link.h | 1 + include/uapi/linux/in6.h | 4 +- include/uapi/linux/io_uring.h | 2 +- include/uapi/linux/pfrut.h | 1 + kernel/cgroup/cpuset.c | 2 +- kernel/fork.c | 2 +- kernel/module/main.c | 10 +- kernel/power/console.c | 7 +- kernel/rcu/tree_plugin.h | 3 + kernel/sched/fair.c | 19 +- kernel/trace/ftrace.c | 19 +- kernel/trace/trace.c | 33 ++- kernel/trace/trace.h | 8 +- mm/debug_vm_pgtable.c | 9 +- mm/filemap.c | 2 +- mm/kmemleak.c | 10 +- mm/madvise.c | 2 +- mm/memfd.c | 2 +- mm/memory-failure.c | 8 + mm/mmap.c | 12 +- mm/ptdump.c | 2 + mm/shmem.c | 2 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_sync.c | 43 ++-- net/bridge/br_multicast.c | 16 ++ net/bridge/br_private.h | 2 + net/core/dev.c | 12 ++ net/core/neighbour.c | 12 +- net/hsr/hsr_slave.c | 8 +- net/ipv4/ip_tunnel.c | 1 + net/ipv4/netfilter/nf_reject_ipv4.c | 6 +- net/ipv4/route.c | 1 - net/ipv4/udp_offload.c | 2 +- net/ipv6/addrconf.c | 7 +- net/ipv6/ip6_gre.c | 2 + net/ipv6/ip6_tunnel.c | 1 + net/ipv6/ip6_vti.c | 1 + net/ipv6/mcast.c | 11 +- net/ipv6/netfilter/nf_reject_ipv6.c | 5 +- net/ipv6/seg6_hmac.c | 6 +- net/ipv6/sit.c | 1 + net/mac80211/cfg.c | 12 +- net/mac80211/chan.c | 1 + net/mac80211/mlme.c | 9 +- net/mac80211/sta_info.c | 5 +- net/mctp/af_mctp.c | 28 ++- net/mptcp/options.c | 9 +- net/mptcp/pm.c | 8 +- net/mptcp/pm_netlink.c | 19 +- net/mptcp/protocol.c | 55 ++++- net/mptcp/protocol.h | 27 ++- net/mptcp/subflow.c | 30 ++- net/ncsi/internal.h | 2 +- net/ncsi/ncsi-rsp.c | 1 + net/netfilter/nf_conntrack_netlink.c | 24 ++- net/netlink/af_netlink.c | 2 +- net/sched/sch_cake.c | 14 +- net/sched/sch_ets.c | 36 ++-- net/sched/sch_htb.c | 2 +- net/tls/tls_sw.c | 16 +- net/vmw_vsock/virtio_transport.c | 14 +- net/wireless/mlme.c | 3 +- scripts/kconfig/gconf.c | 8 +- scripts/kconfig/lxdialog/inputbox.c | 6 +- scripts/kconfig/lxdialog/menubox.c | 2 +- scripts/kconfig/nconf.c | 2 + scripts/kconfig/nconf.gui.c | 1 + security/apparmor/include/lib.h | 6 +- security/inode.c | 2 - sound/core/pcm_native.c | 19 +- sound/pci/hda/hda_codec.c | 44 ++-- sound/pci/hda/patch_ca0132.c | 2 +- sound/pci/hda/patch_realtek.c | 4 + sound/pci/intel8x0.c | 2 +- sound/soc/codecs/hdac_hdmi.c | 10 +- sound/soc/codecs/rt5640.c | 5 + sound/soc/fsl/fsl_asrc.c | 16 +- sound/soc/fsl/fsl_aud2htx.c | 10 +- sound/soc/fsl/fsl_easrc.c | 16 +- sound/soc/fsl/fsl_esai.c | 20 +- sound/soc/fsl/fsl_micfil.c | 14 +- sound/soc/fsl/fsl_sai.c | 44 ++-- sound/soc/fsl/fsl_spdif.c | 17 +- sound/soc/fsl/fsl_ssi.c | 3 +- sound/soc/fsl/fsl_xcvr.c | 16 +- sound/soc/generic/audio-graph-card.c | 2 +- sound/soc/intel/avs/core.c | 3 +- sound/soc/soc-core.c | 28 +++ sound/soc/soc-dai.c | 43 ++-- sound/soc/soc-dapm.c | 4 + sound/usb/mixer_quirks.c | 14 +- sound/usb/stream.c | 25 ++- sound/usb/validate.c | 14 +- tools/include/nolibc/std.h | 4 +- tools/include/nolibc/types.h | 4 +- tools/include/uapi/linux/if_link.h | 1 + .../cpupower/utils/idle_monitor/mperf_monitor.c | 4 +- tools/scripts/Makefile.include | 4 +- tools/testing/ktest/ktest.pl | 5 +- tools/testing/selftests/arm64/fp/sve-ptrace.c | 3 +- .../selftests/bpf/prog_tests/user_ringbuf.c | 10 +- .../ftrace/test.d/ftrace/func-filter-glob.tc | 2 +- tools/testing/selftests/futex/include/futextest.h | 11 + tools/testing/selftests/memfd/memfd_test.c | 43 ++++ tools/testing/selftests/net/mptcp/pm_netlink.sh | 1 + 511 files changed, 4945 insertions(+), 1976 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/482 io_uring: dont use int for ABI
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit cf73d9970ea4f8cace5d8f02d2565a2723003112 upstream.
__kernel_rwf_t is defined as int, the actual size of which is implementation defined. It won't go well if some compiler / archs ever defines it as i64, so replace it with __u32, hoping that there is no one using i16 for it.
--- include/uapi/linux/io_uring.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/io_uring.h +1 -1
@@ -38,7 +38,7 @@ struct io_uring_sqe { };__u32 len;/* buffer size or number of iovecs */ union { -__kernel_rwf_t rw_flags; +__u32 rw_flags;__u32 fsync_flags;__u16 poll_events;/* compatibility */ __u32 poll32_events;/* word-reversed for BE */
Greg Kroah-Hartman
maintainerPATCH 2/482 ALSA: usb-audio: Validate UAC3 power domain descriptors, too
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit d832ccbc301fbd9e5a1d691bdcf461cdb514595f upstream.
UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.
--- sound/usb/validate.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/usb/validate.c +12 -0
@@ -221,6 +221,17 @@ static bool validate_uac3_feature_unit(creturn d->bLength >=sizeof (*d) +4 +2 ; } +static bool validate_uac3_power_domain_unit (const void *p, +const struct usb_desc_validator *v) +{ +const struct uac3_power_domain_descriptor *d = p; + +if (d->bLength <sizeof (*d)) +return false; +/* baEntities[] + wPDomainDescrStr */ +return d->bLength >=sizeof (*d) + d->bNrEntities +2 ; +} +static bool validate_midi_out_jack (const void *p,const struct usb_desc_validator *v) {
@@ -285,6 +296,7 @@ static const struct usb_desc_validator a struct uac3_clock_multiplier_descriptor), /* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */ /* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */ + FUNC(UAC_VERSION_3, UAC3_POWER_DOMAIN, validate_uac3_power_domain_unit), { }/* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 3/482 ALSA: usb-audio: Validate UAC3 cluster segment descriptors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ecfd41166b72b67d3bdeb88d224ff445f6163869 upstream.
UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.
--- sound/usb/stream.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-)
sound/usb/stream.c +22 -3
@@ -341,20 +341,28 @@ snd_pcm_chmap_elem *convert_chmap_v3(str len =le16_to_cpu (cluster->wLength); c =0 ; - p +=sizeof (struct uac3_cluster_header_descriptor ); + p +=sizeof (*cluster); + len -=sizeof (*cluster); -while (((p - (void *)cluster) < len) && (c < channels)) { +while (len >0 && (c < channels)) {struct uac3_cluster_segment_descriptor *cs_desc = p;u16 cs_len;u8 cs_type; +if (len <sizeof (*p)) +break ; cs_len =le16_to_cpu (cs_desc->wLength); +if (len < cs_len) +break ; cs_type = cs_desc->bSegmentType;if (cs_type ==UAC3_CHANNEL_INFORMATION ) {struct uac3_cluster_information_segment_descriptor *is = p;unsigned char map; +if (cs_len <sizeof (*is)) +break ; +/* * TODO: this conversion is not complete, update it * after adding UAC3 values to asound.h
@@ -456,6 +464,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(str chmap->map[c++] = map; } p += cs_len; + len -= cs_len; }if (channels < c)
@@ -876,7 +885,7 @@ snd_usb_get_audioformat_uac3(struct snd_u64 badd_formats =0 ;unsigned int num_channels;struct audioformat *fp; -u16 cluster_id, wLength; +u16 cluster_id, wLength, cluster_wLength;int clock =0 ;int err;
@@ -1003,6 +1012,16 @@ snd_usb_get_audioformat_uac3(struct snd_ iface_no, altno);kfree (cluster);return ERR_PTR (-EIO ); + } + + cluster_wLength =le16_to_cpu (cluster->wLength); +if (cluster_wLength <sizeof (*cluster) || + cluster_wLength > wLength) { +dev_err (&dev->dev, +"%u:%d : invalid Cluster Descriptor size\n" , + iface_no, altno); +kfree (cluster); +return ERR_PTR (-EIO ); } num_channels = cluster->bNrChannels;
Greg Kroah-Hartman
maintainerPATCH 4/482 ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit b26e2afb3834d4a61ce54c8484ff6014bef0b4b7 upstream.
Add a PCI quirk to enable microphone input on the headphone jack on the HONOR BRB-X M1010 laptop.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10440,6 +10440,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1d72 ,0x1901 ,"RedmiBook 14" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ), +SND_PCI_QUIRK (0x1ee7 ,0x2078 ,"HONOR BRB-X M1010" ,ALC2XX_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1f66 ,0x0105 ,"Ayaneo Portable Game Player" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x2014 ,0x800a ,"Positivo ARN50" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
Greg Kroah-Hartman
maintainerPATCH 5/482 ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Eby <[email protected]>
commit 0db77eccd964b11ab2b757031d1354fcc5a025ea upstream.
Framework Laptop 13 (AMD Ryzen AI 300) requires the same quirk for headset detection as other Framework 13 models.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10456,6 +10456,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0009 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0xf111 ,0x000b ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x000c ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0
Greg Kroah-Hartman
maintainerPATCH 6/482 smb3: fix for slab out of bounds on mount to ksmbd
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 7d34ec36abb84fdfb6632a0f2cbda90379ae21fc upstream.
With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below):
BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]
--- fs/smb/client/smb2ops.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/smb/client/smb2ops.c +10 -1
@@ -714,6 +714,13 @@ next_iface: bytes_left -=sizeof (*p);break ; } +/* Validate that Next doesn't point beyond the buffer */ +if (next > bytes_left) { +cifs_dbg (VFS ,"%s: invalid Next pointer %zu > %zd\n" , + __func__, next, bytes_left); + rc = -EINVAL ; + goto out; + } p = (struct network_interface_info_ioctl_rsp *)((u8 *)p+next); bytes_left -= next; }
@@ -725,7 +732,9 @@ next_iface: }/* Azure rounds the buffer size up 8, to a 16 byte boundary */ -if ((bytes_left >8 ) || p->Next) +if ((bytes_left >8 ) || + (bytes_left >= offsetof(struct network_interface_info_ioctl_rsp , Next) + +sizeof (p->Next) && p->Next))cifs_dbg (VFS ,"%s: incomplete interface info\n" , __func__);
Greg Kroah-Hartman
maintainerPATCH 7/482 smb: client: remove redundant lstrp update in negotiate protocol
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Zhaolong <[email protected]>
commit e19d8dd694d261ac26adb2a26121a37c107c81ad upstream.
Commit 34331d7beed7 ("smb: client: fix first command failure during re-negotiation") addressed a race condition by updating lstrp before entering negotiate state. However, this approach may have some unintended side effects.
The lstrp field is documented as "when we got last response from this server", and updating it before actually receiving a server response could potentially affect other mechanisms that rely on this timestamp. For example, the SMB echo detection logic also uses lstrp as a reference point. In scenarios with frequent user operations during reconnect states, the repeated calls to cifs_negotiate_protocol() might continuously update lstrp, which could interfere with the echo detection timing.
Additionally, commit 266b5d02e14f ("smb: client: fix race condition in negotiate timeout by using more precise timing") introduced a dedicated neg_start field specifically for tracking negotiate start time. This provides a more precise solution for the original race condition while preserving the intended semantics of lstrp.
Since the race condition is now properly handled by the neg_start mechanism, the lstrp update in cifs_negotiate_protocol() is no longer necessary and can be safely removed.
--- fs/smb/client/connect.c | 1 - 1 file changed, 1 deletion(-)
fs/smb/client/connect.c +0 -1
@@ -4217,7 +4217,6 @@ retry:return 0 ; } - server->lstrp = jiffies; server->tcpStatus = CifsInNegotiate; server->neg_start = jiffies;spin_unlock (&server->srv_lock);
Greg Kroah-Hartman
maintainerPATCH 8/482 gpio: virtio: Fix config space reading.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Mommer <[email protected]>
commit 4740e1e2f320061c2f0dbadc0dd3dfb58df986d5 upstream.
Quote from the virtio specification chapter 4.2.2.2:
"For the device-specific configuration space, the driver MUST use 8 bit wide accesses for 8 bit wide fields, 16 bit wide and aligned accesses for 16 bit wide fields and 32 bit wide and aligned accesses for 32 and 64 bit wide fields."
--- drivers/gpio/gpio-virtio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpio/gpio-virtio.c +5 -4
@@ -539,7 +539,6 @@ static const char **virtio_gpio_get_namestatic int virtio_gpio_probe (struct virtio_device *vdev) { -struct virtio_gpio_config config;struct device *dev = &vdev->dev;struct virtio_gpio *vgpio;u32 gpio_names_size;
@@ -551,9 +550,11 @@ static int virtio_gpio_probe(struct virtreturn -ENOMEM ;/* Read configuration */ -virtio_cread_bytes (vdev,0 , &config,sizeof (config)); - gpio_names_size =le32_to_cpu (config.gpio_names_size); - ngpio =le16_to_cpu (config.ngpio); + gpio_names_size = +virtio_cread32 (vdev, offsetof(struct virtio_gpio_config , + gpio_names_size)); + ngpio =virtio_cread16 (vdev, offsetof(struct virtio_gpio_config , + ngpio));if (!ngpio) {dev_err (dev,"Number of GPIOs can't be zero\n" );return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 9/482 gpio: mlxbf2: use platform_get_irq_optional()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
commit 63c7bc53a35e785accdc2ceab8f72d94501931ab upstream.
The gpio-mlxbf2 driver interfaces with four GPIO controllers, device instances 0-3. There are two IRQ resources shared between the four controllers, and they are found in the ACPI table for instances 0 and 3. The driver should not use platform_get_irq(), otherwise this error is logged when probing instances 1 and 2:
mlxbf2_gpio MLNXBF22:01: error -ENXIO: IRQ index 0 not found
--- drivers/gpio/gpio-mlxbf2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-mlxbf2.c +1 -1
@@ -374,7 +374,7 @@ mlxbf2_gpio_probe(struct platform_device gc->ngpio = npins; gc->owner =THIS_MODULE ; - irq =platform_get_irq (pdev,0 ); + irq =platform_get_irq_optional (pdev,0 );if (irq >=0 ) { gs->irq_chip.name = name; gs->irq_chip.irq_set_type = mlxbf2_gpio_irq_set_type;
Greg Kroah-Hartman
maintainerPATCH 10/482 netlink: avoid infinite retry looping in netlink_unicast()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
commit 759dfc7d04bab1b0b86113f1164dc1fec192b859 upstream.
netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has:
rmem < READ_ONCE(sk->sk_rcvbuf)
to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under:
rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)
The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as:
rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: <IRQ> dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 </IRQ> netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304
Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code.
Found by Linux Verification Center (linuxtesting.org).
--- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netlink/af_netlink.c +1 -1
@@ -1217,7 +1217,7 @@ int netlink_attachskb(struct sock *sk, s nlk =nlk_sk (sk); rmem =atomic_add_return (skb->truesize, &sk->sk_rmem_alloc); -if ((rmem == skb->truesize || rmem <READ_ONCE (sk->sk_rcvbuf)) && +if ((rmem == skb->truesize || rmem <=READ_ONCE (sk->sk_rcvbuf)) && !test_bit (NETLINK_S_CONGESTED , &nlk->state)) {netlink_skb_set_owner_r (skb, sk);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 11/482 net: phy: micrel: fix KSZ8081/KSZ8091 cable test
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Larysch <[email protected]>
commit 49db61c27c4bbd24364086dc0892bd3e14c1502e upstream.
Commit 21b688dabecb ("net: phy: micrel: Cable Diag feature for lan8814 phy") introduced cable_test support for the LAN8814 that reuses parts of the KSZ886x logic and introduced the cable_diag_reg and pair_mask parameters to account for differences between those chips.
However, it did not update the ksz8081_type struct, so those members are now 0, causing no pairs to be tested in ksz886x_cable_test_get_status and ksz886x_cable_test_wait_for_completion to poll the wrong register for the affected PHYs (Basic Control/Reset, which is 0 in normal operation) and exit immediately.
Fix this by setting both struct members accordingly.
--- drivers/net/phy/micrel.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/phy/micrel.c +2 -0
@@ -356,6 +356,8 @@ static const struct kszphy_type ksz8051_static const struct kszphy_type ksz8081_type = { .led_mode_reg =MII_KSZPHY_CTRL_2 , + .cable_diag_reg =KSZ8081_LMD , + .pair_mask =KSZPHY_WIRE_PAIR_MASK , .has_broadcast_disable = true, .has_nand_tree_disable = true, .has_rmii_ref_clk_sel = true,
Greg Kroah-Hartman
maintainerPATCH 12/482 net: gianfar: fix device leak when querying time stamp info
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit da717540acd34e5056e3fa35791d50f6b3303f55 upstream.
Make sure to drop the reference to the ptp device taken by of_find_device_by_node() when querying the time stamping capabilities.
Note that holding a reference to the ptp device does not prevent its driver data from going away.
--- drivers/net/ethernet/freescale/gianfar_ethtool.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/gianfar_ethtool.c +3 -1
@@ -1466,8 +1466,10 @@ static int gfar_get_ts_info(struct net_dif (ptp_node) { ptp_dev =of_find_device_by_node (ptp_node);of_node_put (ptp_node); -if (ptp_dev) +if (ptp_dev) { ptp =platform_get_drvdata (ptp_dev); +put_device (&ptp_dev->dev); + } }if (ptp)
Greg Kroah-Hartman
maintainerPATCH 13/482 net: mtk_eth_soc: fix device leak at probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3e13274ca8750823e8b68181bdf185d238febe0d upstream.
The reference count to the WED devices has already been incremented when looking them up using of_find_device_by_node() so drop the bogus additional reference taken during probe.
--- drivers/net/ethernet/mediatek/mtk_wed.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_wed.c +0 -1
@@ -1074,7 +1074,6 @@ void mtk_wed_add_hw(struct device_node *if (!pdev) goto err_of_node_put; -get_device (&pdev->dev); irq =platform_get_irq (pdev,0 );if (irq <0 ) goto err_put_device;
Greg Kroah-Hartman
maintainerPATCH 14/482 net: dpaa: fix device leak when querying time stamp info
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3fa840230f534385b34a4f39c8dd313fbe723f05 upstream.
Make sure to drop the reference to the ptp device taken by of_find_device_by_node() when querying the time stamping capabilities.
Note that holding a reference to the ptp device does not prevent its driver data from going away.
--- drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c +3 -1
@@ -473,8 +473,10 @@ static int dpaa_get_ts_info(struct net_dof_node_put (ptp_node); } -if (ptp_dev) +if (ptp_dev) { ptp =platform_get_drvdata (ptp_dev); +put_device (&ptp_dev->dev); + }if (ptp) info->phc_index = ptp->phc_index;
Greg Kroah-Hartman
maintainerPATCH 15/482 net: usb: asix_devices: add phy_mask for ax88772 mdio bus
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit 4faff70959d51078f9ee8372f8cff0d7045e4114 upstream.
Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.
--- drivers/net/usb/asix_devices.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/asix_devices.c +1 -0
@@ -676,6 +676,7 @@ static int ax88772_init_mdio(struct usbn priv->mdio->read = &asix_mdio_bus_read; priv->mdio->write = &asix_mdio_bus_write; priv->mdio->name ="Asix MDIO Bus" ; + priv->mdio->phy_mask = ~(BIT (priv->phy_addr) |BIT (AX_EMBD_PHY_ADDR ));/* mii bus name is usb-<usb bus number>-<usb device number> */ snprintf (priv->mdio->id,MII_BUS_ID_SIZE ,"usb-%03d:%03d" , dev->udev->bus->busnum, dev->udev->devnum);
Greg Kroah-Hartman
maintainerPATCH 16/482 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit 908e4ead7f757504d8b345452730636e298cbf68 upstream.
Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF.
Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all.
In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().
--- fs/nfsd/nfs4state.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
fs/nfsd/nfs4state.c +15 -5
@@ -4285,10 +4285,16 @@ nfsd4_setclientid_confirm(struct svc_rqs } status = nfs_ok;if (conf) { - old = unconf; -unhash_client_locked (old); -nfsd4_change_callback (conf, &unconf->cl_cb_conn); - }else { +if (get_client_locked (conf) == nfs_ok) { + old = unconf; +unhash_client_locked (old); +nfsd4_change_callback (conf, &unconf->cl_cb_conn); + }else { + conf =NULL ; + } + } + +if (!conf) { old =find_confirmed_client_by_name (&unconf->cl_name, nn);if (old) { status = nfserr_clid_inuse;
@@ -4305,10 +4311,14 @@ nfsd4_setclientid_confirm(struct svc_rqs }trace_nfsd_clid_replaced (&old->cl_clientid); } + status =get_client_locked (unconf); +if (status != nfs_ok) { + old =NULL ; + goto out; + }move_to_confirmed (unconf); conf = unconf; } -get_client_locked (conf);spin_unlock (&nn->client_lock);if (conf == unconf)fsnotify_dentry (conf->cl_nfsd_info_dentry,FS_MODIFY );
Greg Kroah-Hartman
maintainerPATCH 17/482 NFSD: detect mismatch of file handle and delegation stateid in OPEN op
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
commit 9c65001c57164033ad08b654c8b5ae35512ddf4a upstream.
When the client sends an OPEN with claim type CLAIM_DELEG_CUR_FH or CLAIM_DELEGATION_CUR, the delegation stateid and the file handle must belong to the same file, otherwise return NFS4ERR_INVAL.
Note that RFC8881, section 8.2.4, mandates the server to return NFS4ERR_BAD_STATEID if the selected table entry does not match the current filehandle. However returning NFS4ERR_BAD_STATEID in the OPEN causes the client to retry the operation and therefor get the client into a loop. To avoid this situation we return NFS4ERR_INVAL instead.
--- fs/nfsd/nfs4state.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/nfsd/nfs4state.c +14 -0
@@ -5733,6 +5733,20 @@ nfsd4_process_open2(struct svc_rqst *rqs status =nfs4_check_deleg (cl, open, &dp);if (status) goto out; +if (dp &&nfsd4_is_deleg_cur (open) && + (dp->dl_stid.sc_file != fp)) { +/* +* RFC8881 section 8.2.4 mandates the server to return +* NFS4ERR_BAD_STATEID if the selected table entry does +* not match the current filehandle. However returning +* NFS4ERR_BAD_STATEID in the OPEN can cause the client +* to repeatedly retry the operation with the same +* stateid, since the stateid itself is valid. To avoid +* this situation NFSD returns NFS4ERR_INVAL instead. +*/ + status = nfserr_inval; + goto out; + } stp =nfsd4_find_and_lock_existing_open (fp, open); }else { open->op_file =NULL ;
Greg Kroah-Hartman
maintainerPATCH 18/482 NFS: Fix the setting of capabilities when automounting a new filesystem
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit b01f21cacde9f2878492cf318fee61bf4ccad323 upstream.
Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.
--- fs/nfs/client.c | 44 ++++++++++++++++++++++++++++++++++++++++++-- fs/nfs/internal.h | 2 +- fs/nfs/nfs4client.c | 20 +------------------- fs/nfs/nfs4proc.c | 2 +- 4 files changed, 45 insertions(+), 23 deletions(-)
fs/nfs/client.c +42 -2
@@ -657,6 +657,44 @@ struct nfs_client *nfs_init_client(struc }EXPORT_SYMBOL_GPL (nfs_init_client); +static void nfs4_server_set_init_caps (struct nfs_server *server) +{ +#if IS_ENABLED (CONFIG_NFS_V4 ) +/* Set the basic capabilities */ + server->caps = server->nfs_client->cl_mvops->init_caps; +if (server->flags &NFS_MOUNT_NORDIRPLUS ) + server->caps &= ~NFS_CAP_READDIRPLUS ; +if (server->nfs_client->cl_proto ==XPRT_TRANSPORT_RDMA ) + server->caps &= ~NFS_CAP_READ_PLUS ; + +/* +* Don't use NFS uid/gid mapping if we're using AUTH_SYS or lower +* authentication. +*/ +if (nfs4_disable_idmapping && + server->client->cl_auth->au_flavor ==RPC_AUTH_UNIX ) + server->caps |=NFS_CAP_UIDGID_NOMAP ; +#endif +} + +void nfs_server_set_init_caps (struct nfs_server *server) +{ +switch (server->nfs_client->rpc_ops->version) { +case 2 : + server->caps =NFS_CAP_HARDLINKS |NFS_CAP_SYMLINKS ; +break ; +case 3 : + server->caps =NFS_CAP_HARDLINKS |NFS_CAP_SYMLINKS ; +if (!(server->flags &NFS_MOUNT_NORDIRPLUS )) + server->caps |=NFS_CAP_READDIRPLUS ; +break ; +default : +nfs4_server_set_init_caps (server); +break ; + } +} +EXPORT_SYMBOL_GPL (nfs_server_set_init_caps); +/* * Create a version 2 or 3 client */
@@ -695,7 +733,6 @@ static int nfs_init_server(struct nfs_se/* Initialise the client representation from the mount data */ server->flags = ctx->flags; server->options = ctx->options; - server->caps |=NFS_CAP_HARDLINKS |NFS_CAP_SYMLINKS ;switch (clp->rpc_ops->version) {case 2 :
@@ -731,6 +768,8 @@ static int nfs_init_server(struct nfs_seif (error <0 ) goto error; +nfs_server_set_init_caps (server); +/* Preserve the values of mount_server-related mount options */ if (ctx->mount_server.addrlen) { memcpy(&server->mountd_address, &ctx->mount_server.address,
@@ -905,7 +944,6 @@ void nfs_server_copy_userdata(struct nfs target->acregmax = source->acregmax; target->acdirmin = source->acdirmin; target->acdirmax = source->acdirmax; - target->caps = source->caps; target->options = source->options; target->auth_info = source->auth_info; target->port = source->port;
@@ -1112,6 +1150,8 @@ struct nfs_server *nfs_clone_server(struif (error <0 ) goto out_free_server; +nfs_server_set_init_caps (server); +/* probe the filesystem info for this server filesystem */ error =nfs_probe_server (server, fh);if (error <0 )
fs/nfs/internal.h +1 -1
@@ -219,7 +219,7 @@ extern struct nfs_client * nfs4_find_client_sessionid(struct net *, const struct sockaddr *, struct nfs4_sessionid *, u32);extern struct nfs_server *nfs_create_server (struct fs_context *); -extern void nfs4_server_set_init_caps (struct nfs_server *); +extern void nfs_server_set_init_caps (struct nfs_server *);extern struct nfs_server *nfs4_create_server (struct fs_context *);extern struct nfs_server *nfs4_create_referral_server (struct fs_context *); extern int nfs4_update_server(struct nfs_server *server, const char *hostname,
fs/nfs/nfs4client.c +1 -19
@@ -1065,24 +1065,6 @@ static void nfs4_session_limit_xasize(st#endif } -void nfs4_server_set_init_caps (struct nfs_server *server) -{ -/* Set the basic capabilities */ - server->caps |= server->nfs_client->cl_mvops->init_caps; -if (server->flags &NFS_MOUNT_NORDIRPLUS ) - server->caps &= ~NFS_CAP_READDIRPLUS ; -if (server->nfs_client->cl_proto ==XPRT_TRANSPORT_RDMA ) - server->caps &= ~NFS_CAP_READ_PLUS ; - -/* -* Don't use NFS uid/gid mapping if we're using AUTH_SYS or lower -* authentication. -*/ -if (nfs4_disable_idmapping && - server->client->cl_auth->au_flavor ==RPC_AUTH_UNIX ) - server->caps |=NFS_CAP_UIDGID_NOMAP ; -} -static int nfs4_server_common_setup (struct nfs_server *server,struct nfs_fh *mntfh,bool auth_probe) {
@@ -1097,7 +1079,7 @@ static int nfs4_server_common_setup(struif (error <0 ) goto out; -nfs4_server_set_init_caps (server); +nfs_server_set_init_caps (server);/* Probe the root fh to retrieve its FSID and filehandle */ error =nfs4_get_rootfh (server, mntfh, auth_probe);
fs/nfs/nfs4proc.c +1 -1
@@ -3957,7 +3957,7 @@ int nfs4_server_capabilities(struct nfs_ };int err; -nfs4_server_set_init_caps (server); +nfs_server_set_init_caps (server); do { err = nfs4_handle_exception(server, _nfs4_server_capabilities(server, fhandle),
Greg Kroah-Hartman
maintainerPATCH 19/482 PCI: Extend isolated function probing to LoongArch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit a02fd05661d73a8507dd70dd820e9b984490c545 upstream.
Like s390 and the jailhouse hypervisor, LoongArch's PCI architecture allows passing isolated PCI functions to a guest OS instance. So it is possible that there is a multi-function device without function 0 for the host or guest.
Allow probing such functions by adding a IS_ENABLED(CONFIG_LOONGARCH) case in the hypervisor_isolated_pci_functions() helper.
This is similar to commit 189c6c33ff42 ("PCI: Extend isolated function probing to s390").
--- include/linux/hypervisor.h | 3 +++ 1 file changed, 3 insertions(+)
include/linux/hypervisor.h +3 -0
@@ -37,6 +37,9 @@ static inline bool hypervisor_isolated_pif (IS_ENABLED (CONFIG_S390 ))return true; +if (IS_ENABLED (CONFIG_LOONGARCH )) +return true; +return jailhouse_paravirt (); }
Greg Kroah-Hartman
maintainerPATCH 20/482 LoongArch: BPF: Fix jump offset calculation in tailcall
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoran Jiang <[email protected]>
commit cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 upstream.
The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by
"#define jmp_offset (out_offset - (cur_offset))"
is a negative number, which is wrong. The final generated assembly are as follow.
54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c
Before apply this patch, the follow test case will reveal soft lock issues.
cd tools/testing/selftests/bpf/
./test_progs --allow=tailcalls/tailcall_bpf2bpf_1
dmesg:
watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]
--- arch/loongarch/net/bpf_jit.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-)
arch/loongarch/net/bpf_jit.c +5 -16
@@ -201,11 +201,9 @@ bool bpf_jit_supports_kfunc_call(void)return true; } -/* initialized on the first pass of build_body() */ -static int out_offset =-1 ; -static int emit_bpf_tail_call (struct jit_ctx *ctx) +static int emit_bpf_tail_call (struct jit_ctx *ctx,int insn) { -int off; +int off, tc_ninsn =0 ;u8 tcc =tail_call_reg (ctx);u8 a1 =LOONGARCH_GPR_A1 ;u8 a2 =LOONGARCH_GPR_A2 ;
@@ -215,7 +213,7 @@ static int emit_bpf_tail_call(struct jitconst int idx0 = ctx->idx;#define cur_offset (ctx->idx - idx0) -#define jmp_offset (out_offset - (cur_offset)) +#define jmp_offset (tc_ninsn - (cur_offset))/* * a0: &ctx
@@ -225,6 +223,7 @@ static int emit_bpf_tail_call(struct jit* if (index >= array->map.max_entries) * goto out; */ + tc_ninsn = insn ? ctx->offset[insn+1 ] - ctx->offset[insn] : ctx->offset[0 ]; off = offsetof(struct bpf_array, map.max_entries);emit_insn (ctx, ldwu, t1, a1, off);/* bgeu $a2, $t1, jmp_offset */
@@ -256,15 +255,6 @@ static int emit_bpf_tail_call(struct jitemit_insn (ctx, ldd, t3, t2, off);__build_epilogue (ctx, true); -/* out: */ -if (out_offset ==-1 ) - out_offset = cur_offset; -if (cur_offset != out_offset) { -pr_err_once ("tail_call out_offset = %d, expected %d!\n" , - cur_offset, out_offset); -return -1 ; - } -return 0 ; toofar:
@@ -789,7 +779,7 @@ static int build_insn(const struct bpf_i/* tail call */ case BPF_JMP |BPF_TAIL_CALL :mark_tail_call (ctx); -if (emit_bpf_tail_call (ctx) <0 ) +if (emit_bpf_tail_call (ctx, i) <0 )return -EINVAL ;break ;
@@ -1170,7 +1160,6 @@ out:if (tmp_blinded)bpf_jit_prog_release_other (prog, prog == orig_prog ? tmp : orig_prog); - out_offset =-1 ;return prog; }
Greg Kroah-Hartman
maintainerPATCH 21/482 sunvdc: Balance device refcount in vdc_port_mpgroup_check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 63ce53724637e2e7ba51fe3a4f78351715049905 upstream.
Using device_find_child() to locate a probed virtual-device-port node causes a device refcount imbalance, as device_find_child() internally calls get_device() to increment the device’s reference count before returning its pointer. vdc_port_mpgroup_check() directly returns true upon finding a matching device without releasing the reference via put_device(). We should call put_device() to decrement refcount.
As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'.
Found by code review.
--- drivers/block/sunvdc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/block/sunvdc.c +3 -1
@@ -956,8 +956,10 @@ static bool vdc_port_mpgroup_check(struc dev =device_find_child (vdev->dev.parent, &port_data, vdc_device_probed); -if (dev) +if (dev) { +put_device (dev);return true; + }return false; }
Greg Kroah-Hartman
maintainerPATCH 22/482 fs: Prevent file descriptor table allocations exceeding INT_MAX
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <[email protected]>
commit 04a2c4b4511d186b0fce685da21085a5d4acd370 upstream.
When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c:
WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288
This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN.
Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate:
- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes
- Multiple bitmaps: ~400MB
- Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647)
Reproducer:
1. Set /proc/sys/fs/nr_open to 1073741816:
# echo 1073741816 > /proc/sys/fs/nr_open
2. Run a program that uses a high file descriptor:
#include <unistd.h>
#include <sys/resource.h>
int main() {
struct rlimit rlim = {1073741824, 1073741824};
setrlimit(RLIMIT_NOFILE, &rlim);
dup2(2, 1073741880); // Triggers the warning
return 0;
}3. Observe WARNING in dmesg at mm/slub.c:5027
systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that:
1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting
2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations
3. The resulting allocations (>8GB) are impractical and will always fail
systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors.
While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue.
Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.
--- fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/file.c +15 -0
@@ -126,6 +126,21 @@ static struct fdtable * alloc_fdtable(unif (unlikely (nr > sysctl_nr_open)) nr = ((sysctl_nr_open -1 ) | (BITS_PER_LONG -1 )) +1 ; +/* +* Check if the allocation size would exceed INT_MAX. kvmalloc_array() +* and kvmalloc() will warn if the allocation size is greater than +* INT_MAX, as filp_cachep objects are not __GFP_NOWARN. +* +* This can happen when sysctl_nr_open is set to a very high value and +* a process tries to use a file descriptor near that limit. For example, +* if sysctl_nr_open is set to 1073741816 (0x3ffffff8) - which is what +* systemd typically sets it to - then trying to use a file descriptor +* close to that value will require allocating a file descriptor table +* that exceeds 8GB in size. +*/ +if (unlikely (nr >INT_MAX /sizeof (struct file *))) +return ERR_PTR (-EMFILE ); + fdt =kmalloc (sizeof (struct fdtable ),GFP_KERNEL_ACCOUNT );if (!fdt) goto out;
Greg Kroah-Hartman
maintainerPATCH 23/482 eventpoll: Fix semi-unbounded recursion
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit f2e467a48287c868818085aa35389a224d226732 upstream.
Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links.
Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons:
- They don't look upwards in the tree.
- If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed ("epoll: limit paths").
Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops.
A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files.
As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion problem").)
To fix it:
1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited.
2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk.
3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.
--- fs/eventpoll.c | 60 +++++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 46 insertions(+), 14 deletions(-)
fs/eventpoll.c +46 -14
@@ -216,6 +216,7 @@ struct eventpoll {/* used to optimize loop detection check */ u64 gen;struct hlist_head refs; +u8 loop_check_depth;#ifdef CONFIG_NET_RX_BUSY_POLL /* used to track busy poll napi_id */
@@ -1951,23 +1952,24 @@ static int ep_poll(struct eventpoll *ep, }/** -* ep_loop_check_proc - verify that adding an epoll file inside another -* epoll structure does not violate the constraints, in -* terms of closed loops, or too deep chains (which can -* result in excessive stack usage). +* ep_loop_check_proc - verify that adding an epoll file @ep inside another +* epoll file does not create closed loops, and +* determine the depth of the subtree starting at @ep * * @ep: the &struct eventpoll to be currently checked. * @depth: Current depth of the path being checked. * -* Return: %zero if adding the epoll @file inside current epoll -* structure @ep does not violate the constraints, or %-1 otherwise. +* Return: depth of the subtree, or INT_MAX if we found a loop or went too deep. */ static int ep_loop_check_proc (struct eventpoll *ep,int depth) { -int error =0 ; +int result =0 ;struct rb_node *rbp;struct epitem *epi; +if (ep->gen == loop_check_gen) +return ep->loop_check_depth; +mutex_lock_nested (&ep->mtx, depth +1 ); ep->gen = loop_check_gen;for (rbp =rb_first_cached (&ep->rbr); rbp; rbp =rb_next (rbp)) {
@@ -1975,13 +1977,11 @@ static int ep_loop_check_proc(struct eveif (unlikely (is_file_epoll (epi->ffd.file))) {struct eventpoll *ep_tovisit; ep_tovisit = epi->ffd.file->private_data; -if (ep_tovisit->gen == loop_check_gen) -continue ;if (ep_tovisit == inserting_into || depth >EP_MAX_NESTS ) - error =-1 ; + result =INT_MAX ;else - error =ep_loop_check_proc (ep_tovisit, depth +1 ); -if (error !=0 ) + result =max (result,ep_loop_check_proc (ep_tovisit, depth +1 ) +1 ); +if (result >EP_MAX_NESTS )break ; }else {/*
@@ -1995,9 +1995,27 @@ static int ep_loop_check_proc(struct evelist_file (epi->ffd.file); } } + ep->loop_check_depth = result;mutex_unlock (&ep->mtx); -return error; +return result; +} + +/** +* ep_get_upwards_depth_proc - determine depth of @ep when traversed upwards +*/ +static int ep_get_upwards_depth_proc (struct eventpoll *ep,int depth) +{ +int result =0 ; +struct epitem *epi; + +if (ep->gen == loop_check_gen) +return ep->loop_check_depth; +hlist_for_each_entry_rcu (epi, &ep->refs, fllink) + result =max (result,ep_get_upwards_depth_proc (epi->ep, depth +1 ) +1 ); + ep->gen = loop_check_gen; + ep->loop_check_depth = result; +return result; }/**
@@ -2013,8 +2031,22 @@ static int ep_loop_check_proc(struct eve*/ static int ep_loop_check (struct eventpoll *ep,struct eventpoll *to) { +int depth, upwards_depth; + inserting_into = ep; -return ep_loop_check_proc (to,0 ); +/* +* Check how deep down we can get from @to, and whether it is possible +* to loop up to @ep. +*/ + depth =ep_loop_check_proc (to,0 ); +if (depth >EP_MAX_NESTS ) +return -1 ; +/* Check how far up we can go from @ep. */ +rcu_read_lock (); + upwards_depth =ep_get_upwards_depth_proc (ep,0 ); +rcu_read_unlock (); + +return (depth+1 +upwards_depth >EP_MAX_NESTS ) ?-1 :0 ; }static void clear_tfile_check_list (void )
Greg Kroah-Hartman
maintainerPATCH 24/482 Documentation: ACPI: Fix parent device references
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit e65cb011349e653ded541dddd6469c2ca813edcf upstream.
The _CRS resources in many cases want to have ResourceSource field to be a type of ACPI String. This means that to compile properly we need to enclosure the name path into double quotes. This will in practice defer the interpretation to a run-time stage, However, this may be interpreted differently on different OSes and ACPI interpreter implementations. In particular ACPICA might not correctly recognize the leading '^' (caret) character and will not resolve the relative name path properly. On top of that, this piece may be used in SSDTs which are loaded after the DSDT and on itself may also not resolve relative name paths outside of their own scopes. With this all said, fix documentation to use fully-qualified name paths always to avoid any misinterpretations, which is proven to work.
--- Documentation/firmware-guide/acpi/i2c-muxes.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
Documentation/firmware-guide/acpi/i2c-muxes.rst +4 -4
@@ -14,7 +14,7 @@ Consider this topology:: | | | 0x70 |--CH01--> i2c client B (0x50) +------+ +------+ -which corresponds to the following ASL:: +which corresponds to the following ASL (in the scope of \_SB):: Device (SMB1) {
@@ -24,7 +24,7 @@ which corresponds to the following ASL:: Name (_HID, ...) Name (_CRS, ResourceTemplate () { I2cSerialBus (0x70, ControllerInitiated, I2C_SPEED, - AddressingMode7Bit, "^SMB1", 0x00, + AddressingMode7Bit, "\\_SB.SMB1", 0x00, ResourceConsumer,,) }
@@ -37,7 +37,7 @@ which corresponds to the following ASL:: Name (_HID, ...) Name (_CRS, ResourceTemplate () { I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED, - AddressingMode7Bit, "^CH00", 0x00, + AddressingMode7Bit, "\\_SB.SMB1.CH00", 0x00, ResourceConsumer,,) } }
@@ -52,7 +52,7 @@ which corresponds to the following ASL:: Name (_HID, ...) Name (_CRS, ResourceTemplate () { I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED, - AddressingMode7Bit, "^CH01", 0x00, + AddressingMode7Bit, "\\_SB.SMB1.CH01", 0x00, ResourceConsumer,,) } }
Greg Kroah-Hartman
maintainerPATCH 25/482 ACPI: processor: perflib: Fix initial _PPC limit application
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
commit d33bd88ac0ebb49e7f7c8f29a8c7ee9eae85d765 upstream.
If the BIOS sets a _PPC frequency limit upfront, it will fail to take effect due to a call ordering issue. Namely, freq_qos_update_request() is called before freq_qos_add_request() for the given request causing the constraint update to be ignored. The call sequence in question is as follows:
cpufreq_policy_online()
acpi_cpufreq_cpu_init()
acpi_processor_register_performance()
acpi_processor_get_performance_info()
acpi_processor_get_platform_limit()
freq_qos_update_request(&perflib_req) <- inactive QoS request
blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
CPUFREQ_CREATE_POLICY)
acpi_processor_notifier()
acpi_processor_ppc_init()
freq_qos_add_request(&perflib_req) <- QoS request activation
Address this by adding an acpi_processor_get_platform_limit() call to acpi_processor_ppc_init(), after the perflib_req activation via freq_qos_add_request(), which causes the initial _PPC limit to be picked up as appropriate. However, also ensure that the _PPC limit will not be picked up in the cases when the cpufreq driver does not call acpi_processor_register_performance() by adding a pr->performance check to the related_cpus loop in acpi_processor_ppc_init().
--- drivers/acpi/processor_perflib.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/acpi/processor_perflib.c +9 -1
@@ -173,11 +173,14 @@ void acpi_processor_ppc_init(struct cpuf {unsigned int cpu; +if (ignore_ppc ==1 ) +return ; +for_each_cpu (cpu, policy->related_cpus) {struct acpi_processor *pr =per_cpu (processors, cpu);int ret; -if (!pr) +if (!pr || !pr->performance)continue ;/*
@@ -193,6 +196,11 @@ void acpi_processor_ppc_init(struct cpufif (ret <0 )pr_err ("Failed to add freq constraint for CPU%d (%d)\n" , cpu, ret); + + ret =acpi_processor_get_platform_limit (pr); +if (ret) +pr_err ("Failed to update freq constraint for CPU%d (%d)\n" , + cpu, ret); } }
Greg Kroah-Hartman
maintainerPATCH 26/482 ACPI: processor: perflib: Move problematic pr->performance check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit d405ec23df13e6df599f5bd965a55d13420366b8 upstream.
Commit d33bd88ac0eb ("ACPI: processor: perflib: Fix initial _PPC limit application") added a pr->performance check that prevents the frequency QoS request from being added when the given processor has no performance object. Unfortunately, this causes a WARN() in freq_qos_remove_request() to trigger on an attempt to take the given CPU offline later because the frequency QoS object has not been added for it due to the missing performance object.
Address this by moving the pr->performance check before calling acpi_processor_get_platform_limit() so it only prevents a limit from being set for the CPU if the performance object is not present. This way, the frequency QoS request is added as it was before the above commit and it is present all the time along with the CPU's cpufreq policy regardless of whether or not the CPU is online.
--- drivers/acpi/processor_perflib.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/acpi/processor_perflib.c +4 -1
@@ -180,7 +180,7 @@ void acpi_processor_ppc_init(struct cpufstruct acpi_processor *pr =per_cpu (processors, cpu);int ret; -if (!pr || !pr->performance) +if (!pr)continue ;/*
@@ -197,6 +197,9 @@ void acpi_processor_ppc_init(struct cpufpr_err ("Failed to add freq constraint for CPU%d (%d)\n" , cpu, ret); +if (!pr->performance) +continue ; + ret =acpi_processor_get_platform_limit (pr);if (ret) pr_err("Failed to update freq constraint for CPU%d (%d)\n",
Greg Kroah-Hartman
maintainerPATCH 27/482 KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit be45bc4eff33d9a7dae84a2150f242a91a617402 ]
Enable/disable local IRQs, i.e. set/clear RFLAGS.IF, in the common svm_vcpu_enter_exit() just after/before guest_state_{enter,exit}_irqoff() so that VMRUN is not executed in an STI shadow. AMD CPUs have a quirk (some would say "bug"), where the STI shadow bleeds into the guest's intr_state field if a #VMEXIT occurs during injection of an event, i.e. if the VMRUN doesn't complete before the subsequent #VMEXIT.
The spurious "interrupts masked" state is relatively benign, as it only occurs during event injection and is transient. Because KVM is already injecting an event, the guest can't be in HLT, and if KVM is querying IRQ blocking for injection, then KVM would need to force an immediate exit anyways since injecting multiple events is impossible.
However, because KVM copies int_state verbatim from vmcb02 to vmcb12, the spurious STI shadow is visible to L1 when running a nested VM, which can trip sanity checks, e.g. in VMware's VMM.
Hoist the STI+CLI all the way to C code, as the aforementioned calls to guest_state_{enter,exit}_irqoff() already inform lockdep that IRQs are enabled/disabled, and taking a fault on VMRUN with RFLAGS.IF=1 is already possible. I.e. if there's kernel code that is confused by running with RFLAGS.IF=1, then it's already a problem. In practice, since GIF=0 also blocks NMIs, the only change in exposure to non-KVM code (relative to surrounding VMRUN with STI+CLI) is exception handling code, and except for the kvm_rebooting=1 case, all exception in the core VM-Enter/VM-Exit path are fatal.
Use the "raw" variants to enable/disable IRQs to avoid tracing in the "no instrumentation" code; the guest state helpers also take care of tracing IRQ state.
Oppurtunstically document why KVM needs to do STI in the first place.
--- arch/x86/kvm/svm/svm.c | 14 ++++++++++++++ arch/x86/kvm/svm/vmenter.S | 9 +-------- 2 files changed, 15 insertions(+), 8 deletions(-)
arch/x86/kvm/svm/svm.c +14 -0
@@ -3982,6 +3982,18 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_inguest_state_enter_irqoff (); +/* +* Set RFLAGS.IF prior to VMRUN, as the host's RFLAGS.IF at the time of +* VMRUN controls whether or not physical IRQs are masked (KVM always +* runs with V_INTR_MASKING_MASK). Toggle RFLAGS.IF here to avoid the +* temptation to do STI+VMRUN+CLI, as AMD CPUs bleed the STI shadow +* into guest state if delivery of an event during VMRUN triggers a +* #VMEXIT, and the guest_state transitions already tell lockdep that +* IRQs are being enabled/disabled. Note! GIF=0 for the entirety of +* this path, so IRQs aren't actually unmasked while running host code. +*/ +raw_local_irq_enable (); +amd_clear_divider ();if (sev_es_guest (vcpu->kvm))
@@ -3989,6 +4001,8 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_inelse __svm_vcpu_run (svm, spec_ctrl_intercepted); +raw_local_irq_disable (); +guest_state_exit_irqoff (); }
arch/x86/kvm/svm/vmenter.S +1 -8
@@ -170,12 +170,8 @@ SYM_FUNC_START(__svm_vcpu_run) VM_CLEAR_CPU_BUFFERS /* Enter guest mode */ - sti - 3: vmrun %_ASM_AX 4: - cli - /* Pop @svm to RAX while it's the only available register. */ pop %_ASM_AX
@@ -343,11 +339,8 @@ SYM_FUNC_START(__svm_sev_es_vcpu_run) VM_CLEAR_CPU_BUFFERS /* Enter guest mode */ - sti - 1: vmrun %_ASM_AX - -2: cli +2: /* Pop @svm to RDI, guest registers have been saved already. */ pop %_ASM_DI
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 28/482 KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 73b42dc69be8564d4951a14d00f827929fe5ef79 ]
Re-introduce the "split" x2APIC ICR storage that KVM used prior to Intel's IPI virtualization support, but only for AMD. While not stated anywhere in the APM, despite stating the ICR is a single 64-bit register, AMD CPUs store the 64-bit ICR as two separate 32-bit values in ICR and ICR2. When IPI virtualization (IPIv on Intel, all AVIC flavors on AMD) is enabled, KVM needs to match CPU behavior as some ICR ICR writes will be handled by the CPU, not by KVM.
Add a kvm_x86_ops knob to control the underlying format used by the CPU to store the x2APIC ICR, and tune it to AMD vs. Intel regardless of whether or not x2AVIC is enabled. If KVM is handling all ICR writes, the storage format for x2APIC mode doesn't matter, and having the behavior follow AMD versus Intel will provide better test coverage and ease debugging.
--- arch/x86/include/asm/kvm_host.h | 2 ++ arch/x86/kvm/lapic.c | 42 +++++++++++++++++++++++---------- arch/x86/kvm/svm/svm.c | 2 ++ arch/x86/kvm/vmx/vmx.c | 2 ++ 4 files changed, 36 insertions(+), 12 deletions(-)
arch/x86/include/asm/kvm_host.h +2 -0
@@ -1547,6 +1547,8 @@ struct kvm_x86_ops {void (*enable_nmi_window)(struct kvm_vcpu *vcpu);void (*enable_irq_window)(struct kvm_vcpu *vcpu);void (*update_cr8_intercept)(struct kvm_vcpu *vcpu,int tpr,int irr); + +const bool x2apic_icr_is_split;bool (*check_apicv_inhibit_reasons)(enum kvm_apicv_inhibit reason);void (*refresh_apicv_exec_ctrl)(struct kvm_vcpu *vcpu);void (*hwapic_irr_update)(struct kvm_vcpu *vcpu,int max_irr);
arch/x86/kvm/lapic.c +30 -12
73 lines not on this page · raw message
arch/x86/kvm/svm/svm.c +2 -0
@@ -4851,6 +4851,8 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { .enable_nmi_window = svm_enable_nmi_window, .enable_irq_window = svm_enable_irq_window, .update_cr8_intercept = svm_update_cr8_intercept, + + .x2apic_icr_is_split = true, .set_virtual_apic_mode = avic_refresh_virtual_apic_mode, .refresh_apicv_exec_ctrl = avic_refresh_apicv_exec_ctrl, .check_apicv_inhibit_reasons = avic_check_apicv_inhibit_reasons,
arch/x86/kvm/vmx/vmx.c +2 -0
@@ -8202,6 +8202,8 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { .enable_nmi_window = vmx_enable_nmi_window, .enable_irq_window = vmx_enable_irq_window, .update_cr8_intercept = vmx_update_cr8_intercept, + + .x2apic_icr_is_split = false, .set_virtual_apic_mode = vmx_set_virtual_apic_mode, .set_apic_access_page_addr = vmx_set_apic_access_page_addr, .refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 29/482 KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 76bce9f10162cd4b36ac0b7889649b22baf70ebd ]
Pass the target vCPU to the hwapic_isr_update() vendor hook so that VMX can defer the update until after nested VM-Exit if an EOI for L1's vAPIC occurs while L2 is active.
Note, commit d39850f57d21 ("KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update()") removed the parameter with the justification that doing so "allows for a decent amount of (future) cleanup in the APIC code", but it's not at all clear what cleanup was intended, or if it was ever realized.
No functional change intended.
--- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/lapic.c | 8 ++++---- arch/x86/kvm/vmx/vmx.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -1
@@ -1552,7 +1552,7 @@ struct kvm_x86_ops {bool (*check_apicv_inhibit_reasons)(enum kvm_apicv_inhibit reason);void (*refresh_apicv_exec_ctrl)(struct kvm_vcpu *vcpu);void (*hwapic_irr_update)(struct kvm_vcpu *vcpu,int max_irr); -void (*hwapic_isr_update)(int isr); +void (*hwapic_isr_update)(struct kvm_vcpu *vcpu,int isr);bool (*guest_apic_has_interrupt)(struct kvm_vcpu *vcpu);void (*load_eoi_exitmap)(struct kvm_vcpu *vcpu,u64 *eoi_exit_bitmap);void (*set_virtual_apic_mode)(struct kvm_vcpu *vcpu);
arch/x86/kvm/lapic.c +4 -4
@@ -587,7 +587,7 @@ static inline void apic_set_isr(int vec, struct kvm_lapic *apic)* just set SVI. */ if (unlikely (apic->apicv_active)) -static_call_cond (kvm_x86_hwapic_isr_update)(vec); +static_call_cond (kvm_x86_hwapic_isr_update)(apic->vcpu, vec);else { ++apic->isr_count;BUG_ON (apic->isr_count >MAX_APIC_VECTOR );
@@ -632,7 +632,7 @@ static inline void apic_clear_isr(int vec, struct kvm_lapic *apic)* and must be left alone. */ if (unlikely (apic->apicv_active)) -static_call_cond (kvm_x86_hwapic_isr_update)(apic_find_highest_isr (apic)); +static_call_cond (kvm_x86_hwapic_isr_update)(apic->vcpu,apic_find_highest_isr (apic));else { --apic->isr_count;BUG_ON (apic->isr_count <0 );
@@ -2554,7 +2554,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)if (apic->apicv_active) {static_call_cond (kvm_x86_apicv_post_state_restore)(vcpu);static_call_cond (kvm_x86_hwapic_irr_update)(vcpu,-1 ); -static_call_cond (kvm_x86_hwapic_isr_update)(-1 ); +static_call_cond (kvm_x86_hwapic_isr_update)(vcpu,-1 ); } vcpu->arch.apic_arb_prio =0 ;
@@ -2847,7 +2847,7 @@ int kvm_apic_set_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s)if (apic->apicv_active) {static_call_cond (kvm_x86_apicv_post_state_restore)(vcpu);static_call_cond (kvm_x86_hwapic_irr_update)(vcpu,apic_find_highest_irr (apic)); -static_call_cond (kvm_x86_hwapic_isr_update)(apic_find_highest_isr (apic)); +static_call_cond (kvm_x86_hwapic_isr_update)(vcpu,apic_find_highest_isr (apic)); }kvm_make_request (KVM_REQ_EVENT , vcpu);if (ioapic_in_kernel (vcpu->kvm))
arch/x86/kvm/vmx/vmx.c +1 -1
@@ -6708,7 +6708,7 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu)put_page (page); } -static void vmx_hwapic_isr_update (int max_isr) +static void vmx_hwapic_isr_update (struct kvm_vcpu *vcpu,int max_isr) {u16 status;u8 old;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 30/482 KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Gao <[email protected]>
[ Upstream commit 04bc93cf49d16d01753b95ddb5d4f230b809a991 ]
If KVM emulates an EOI for L1's virtual APIC while L2 is active, defer updating GUEST_INTERUPT_STATUS.SVI, i.e. the VMCS's cache of the highest in-service IRQ, until L1 is active, as vmcs01, not vmcs02, needs to track vISR. The missed SVI update for vmcs01 can result in L1 interrupts being incorrectly blocked, e.g. if there is a pending interrupt with lower priority than the interrupt that was EOI'd.
This bug only affects use cases where L1's vAPIC is effectively passed through to L2, e.g. in a pKVM scenario where L2 is L1's depriveleged host, as KVM will only emulate an EOI for L1's vAPIC if Virtual Interrupt Delivery (VID) is disabled in vmc12, and L1 isn't intercepting L2 accesses to its (virtual) APIC page (or if x2APIC is enabled, the EOI MSR).
WARN() if KVM updates L1's ISR while L2 is active with VID enabled, as an EOI from L2 is supposed to affect L2's vAPIC, but still defer the update, to try to keep L1 alive. Specifically, KVM forwards all APICv-related VM-Exits to L1 via nested_vmx_l1_wants_exit():
case EXIT_REASON_APIC_ACCESS: case EXIT_REASON_APIC_WRITE: case EXIT_REASON_EOI_INDUCED: /* * The controls for "virtualize APIC accesses," "APIC- * register virtualization," and "virtual-interrupt * delivery" only come from vmcs12. */ return true;
[sean: resolve minor syntactic conflict in lapic.h, account for lack of
kvm_x86_call(), drop sanity check due to lack of wants_to_run]
--- arch/x86/kvm/lapic.c | 11 +++++++++++ arch/x86/kvm/lapic.h | 1 + arch/x86/kvm/vmx/nested.c | 5 +++++ arch/x86/kvm/vmx/vmx.c | 16 ++++++++++++++++ arch/x86/kvm/vmx/vmx.h | 1 + 5 files changed, 34 insertions(+)
arch/x86/kvm/lapic.c +11 -0
@@ -640,6 +640,17 @@ static inline void apic_clear_isr(int vec, struct kvm_lapic *apic) } } +void kvm_apic_update_hwapic_isr (struct kvm_vcpu *vcpu) +{ +struct kvm_lapic *apic = vcpu->arch.apic; + +if (WARN_ON_ONCE (!lapic_in_kernel (vcpu)) || !apic->apicv_active) +return ; + +static_call (kvm_x86_hwapic_isr_update)(vcpu,apic_find_highest_isr (apic)); +} +EXPORT_SYMBOL_GPL (kvm_apic_update_hwapic_isr); +int kvm_lapic_find_highest_irr (struct kvm_vcpu *vcpu) {/* This may race with setting of irr in __apic_accept_irq() and
arch/x86/kvm/lapic.h +1 -0
@@ -122,6 +122,7 @@ int kvm_set_apic_base(struct kvm_vcpu *vcpu, struct msr_data *msr_info);int kvm_apic_get_state (struct kvm_vcpu *vcpu,struct kvm_lapic_state *s);int kvm_apic_set_state (struct kvm_vcpu *vcpu,struct kvm_lapic_state *s);enum lapic_mode kvm_get_apic_mode (struct kvm_vcpu *vcpu); +void kvm_apic_update_hwapic_isr (struct kvm_vcpu *vcpu);int kvm_lapic_find_highest_irr (struct kvm_vcpu *vcpu);u64 kvm_get_lapic_tscdeadline_msr (struct kvm_vcpu *vcpu);
arch/x86/kvm/vmx/nested.c +5 -0
@@ -4839,6 +4839,11 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 vm_exit_reason,kvm_make_request (KVM_REQ_APICV_UPDATE , vcpu); } +if (vmx->nested.update_vmcs01_hwapic_isr) { + vmx->nested.update_vmcs01_hwapic_isr = false; +kvm_apic_update_hwapic_isr (vcpu); + } +if ((vm_exit_reason !=-1 ) && (enable_shadow_vmcs ||evmptr_is_valid (vmx->nested.hv_evmcs_vmptr))) vmx->nested.need_vmcs12_to_shadow_sync = true;
arch/x86/kvm/vmx/vmx.c +16 -0
@@ -6713,6 +6713,22 @@ static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)u16 status;u8 old; +/* +* If L2 is active, defer the SVI update until vmcs01 is loaded, as SVI +* is only relevant for if and only if Virtual Interrupt Delivery is +* enabled in vmcs12, and if VID is enabled then L2 EOIs affect L2's +* vAPIC, not L1's vAPIC. KVM must update vmcs01 on the next nested +* VM-Exit, otherwise L1 with run with a stale SVI. +*/ +if (is_guest_mode (vcpu)) { +/* +* KVM is supposed to forward intercepted L2 EOIs to L1 if VID +* is enabled in vmcs12; as above, the EOIs affect L2's vAPIC. +*/ +to_vmx (vcpu)->nested.update_vmcs01_hwapic_isr = true; +return ; + } +if (max_isr ==-1 ) max_isr =0 ;
arch/x86/kvm/vmx/vmx.h +1 -0
@@ -189,6 +189,7 @@ struct nested_vmx {bool reload_vmcs01_apic_access_page;bool update_vmcs01_cpu_dirty_logging;bool update_vmcs01_apicv_status; +bool update_vmcs01_hwapic_isr;/* * Enlightened VMCS has been enabled. It does not mean that L1 has to
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 31/482 KVM: x86: Snapshot the hosts DEBUGCTL in common x86
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit fb71c795935652fa20eaf9517ca9547f5af99a76 ]
Move KVM's snapshot of DEBUGCTL to kvm_vcpu_arch and take the snapshot in common x86, so that SVM can also use the snapshot.
Opportunistically change the field to a u64. While bits 63:32 are reserved on AMD, not mentioned at all in Intel's SDM, and managed as an "unsigned long" by the kernel, DEBUGCTL is an MSR and therefore a 64-bit value.
--- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/vmx/vmx.c | 8 ++------ arch/x86/kvm/vmx/vmx.h | 2 -- arch/x86/kvm/x86.c | 1 + 4 files changed, 4 insertions(+), 8 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -0
@@ -677,6 +677,7 @@ struct kvm_vcpu_arch {u32 pkru;u32 hflags;u64 efer; +u64 host_debugctl;u64 apic_base;struct kvm_lapic *apic;/* kernel irqchip context */ bool load_eoi_exitmap_pending;
arch/x86/kvm/vmx/vmx.c +2 -6
@@ -1418,13 +1418,9 @@ void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu,*/ static void vmx_vcpu_load (struct kvm_vcpu *vcpu,int cpu) { -struct vcpu_vmx *vmx =to_vmx (vcpu); -vmx_vcpu_load_vmcs (vcpu, cpu,NULL );vmx_vcpu_pi_load (vcpu, cpu); - - vmx->host_debugctlmsr =get_debugctlmsr (); }static void vmx_vcpu_put (struct kvm_vcpu *vcpu)
@@ -7275,8 +7271,8 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) }/* MSR_IA32_DEBUGCTLMSR is zeroed on vmexit. Restore it if needed */ -if (vmx->host_debugctlmsr) -update_debugctlmsr (vmx->host_debugctlmsr); +if (vcpu->arch.host_debugctl) +update_debugctlmsr (vcpu->arch.host_debugctl);#ifndef CONFIG_X86_64 /*
arch/x86/kvm/vmx/vmx.h +0 -2
@@ -352,8 +352,6 @@ struct vcpu_vmx {/* apic deadline value in host tsc */ u64 hv_deadline_tsc; -unsigned long host_debugctlmsr; -/* * Only bits masked by msr_ia32_feature_control_valid_bits can be set in * msr_ia32_feature_control. FEAT_CTL_LOCKED is always included
arch/x86/kvm/x86.c +1 -0
@@ -4742,6 +4742,7 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)/* Save host pkru register if supported */ vcpu->arch.host_pkru =read_pkru (); + vcpu->arch.host_debugctl =get_debugctlmsr ();/* Apply any externally detected TSC adjustments (due to suspend) */ if (unlikely (vcpu->arch.tsc_offset_adjustment)) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 32/482 KVM: x86: Snapshot the hosts DEBUGCTL after disabling IRQs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 189ecdb3e112da703ac0699f4ec76aa78122f911 ]
Snapshot the host's DEBUGCTL after disabling IRQs, as perf can toggle debugctl bits from IRQ context, e.g. when enabling/disabling events via smp_call_function_single(). Taking the snapshot (long) before IRQs are disabled could result in KVM effectively clobbering DEBUGCTL due to using a stale snapshot.
--- arch/x86/kvm/x86.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kvm/x86.c +2 -1
@@ -4742,7 +4742,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)/* Save host pkru register if supported */ vcpu->arch.host_pkru =read_pkru (); - vcpu->arch.host_debugctl =get_debugctlmsr ();/* Apply any externally detected TSC adjustments (due to suspend) */ if (unlikely (vcpu->arch.tsc_offset_adjustment)) {
@@ -10851,6 +10850,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)set_debugreg (0 ,7 ); } + vcpu->arch.host_debugctl =get_debugctlmsr (); +guest_timing_enter_irqoff ();for (;;) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 33/482 KVM: x86/pmu: Gate all "unimplemented MSR" prints on report_ignored_msrs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit e76ae52747a82a548742107b4100e90da41a624d ]
Add helpers to print unimplemented MSR accesses and condition all such prints on report_ignored_msrs, i.e. honor userspace's request to not print unimplemented MSRs. Even though vcpu_unimpl() is ratelimited, printing can still be problematic, e.g. if a print gets stalled when host userspace is writing MSRs during live migration, an effective stall can result in very noticeable disruption in the guest.
E.g. the profile below was taken while calling KVM_SET_MSRS on the PMU counters while the PMU was disabled in KVM.
- 99.75% 0.00% [.] __ioctl
- __ioctl
- 99.74% entry_SYSCALL_64_after_hwframe do_syscall_64
sys_ioctl
- do_vfs_ioctl
- 92.48% kvm_vcpu_ioctl
- kvm_arch_vcpu_ioctl
- 85.12% kvm_set_msr_ignored_check svm_set_msr kvm_set_msr_common printk
vprintk_func vprintk_default vprintk_emit console_unlock call_console_drivers univ8250_console_write serial8250_console_write uart_console_write
Stable-dep-of: 7d0cce6cbe71 ("KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs")
--- arch/x86/kvm/hyperv.c | 10 ++++------ arch/x86/kvm/svm/svm.c | 5 ++--- arch/x86/kvm/vmx/vmx.c | 4 +--- arch/x86/kvm/x86.c | 18 +++++------------- arch/x86/kvm/x86.h | 12 ++++++++++++ 5 files changed, 24 insertions(+), 25 deletions(-)
arch/x86/kvm/hyperv.c +4 -6
@@ -1406,8 +1406,7 @@ static int kvm_hv_set_msr_pw(struct kvm_vcpu *vcpu, u32 msr, u64 data, case HV_X64_MSR_SYNDBG_CONTROL ... HV_X64_MSR_SYNDBG_PENDING_BUFFER:return syndbg_set_msr (vcpu, msr, data, host);default : -vcpu_unimpl (vcpu,"Hyper-V unhandled wrmsr: 0x%x data 0x%llx\n" , - msr, data); +kvm_pr_unimpl_wrmsr (vcpu, msr, data);return 1 ; }return 0 ;
@@ -1528,8 +1527,7 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)return 1 ;break ;default : -vcpu_unimpl (vcpu,"Hyper-V unhandled wrmsr: 0x%x data 0x%llx\n" , - msr, data); +kvm_pr_unimpl_wrmsr (vcpu, msr, data);return 1 ; }
@@ -1581,7 +1579,7 @@ static int kvm_hv_get_msr_pw(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata, case HV_X64_MSR_SYNDBG_CONTROL ... HV_X64_MSR_SYNDBG_PENDING_BUFFER:return syndbg_get_msr (vcpu, msr, pdata, host);default : -vcpu_unimpl (vcpu,"Hyper-V unhandled rdmsr: 0x%x\n" , msr); +kvm_pr_unimpl_rdmsr (vcpu, msr);return 1 ; }
@@ -1646,7 +1644,7 @@ static int kvm_hv_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata, data =APIC_BUS_FREQUENCY ;break ;default : -vcpu_unimpl (vcpu,"Hyper-V unhandled rdmsr: 0x%x\n" , msr); +kvm_pr_unimpl_rdmsr (vcpu, msr);return 1 ; } *pdata = data;
arch/x86/kvm/svm/svm.c +2 -3
@@ -3035,8 +3035,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)break ;case MSR_IA32_DEBUGCTLMSR :if (!lbrv) { -vcpu_unimpl (vcpu,"%s: MSR_IA32_DEBUGCTL 0x%llx, nop\n" , - __func__, data); +kvm_pr_unimpl_wrmsr (vcpu, ecx, data);break ; }
@@ -3077,7 +3076,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)case MSR_VM_CR :return svm_set_vm_cr (vcpu, data);case MSR_VM_IGNNE : -vcpu_unimpl (vcpu,"unimplemented wrmsr: 0x%x data 0x%llx\n" , ecx, data); +kvm_pr_unimpl_wrmsr (vcpu, ecx, data);break ;case MSR_AMD64_DE_CFG : {struct kvm_msr_entry msr_entry;
arch/x86/kvm/vmx/vmx.c +1 -3
@@ -2140,9 +2140,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) invalid = data & ~vmx_get_supported_debugctl (vcpu, msr_info->host_initiated);if (invalid & (DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR )) { -if (report_ignored_msrs) -vcpu_unimpl (vcpu,"%s: BTF|LBR in IA32_DEBUGCTLMSR 0x%llx, nop\n" , - __func__, data); +kvm_pr_unimpl_wrmsr (vcpu, msr_index, data); data &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); invalid &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); }
arch/x86/kvm/x86.c +5 -13
@@ -3573,7 +3573,6 @@ static void record_steal_time(struct kvm_vcpu *vcpu)int kvm_set_msr_common (struct kvm_vcpu *vcpu,struct msr_data *msr_info) { -bool pr = false;u32 msr = msr_info->index;u64 data = msr_info->data;
@@ -3625,15 +3624,13 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)if (data ==BIT_ULL (18 )) { vcpu->arch.msr_hwcr = data; }else if (data !=0 ) { -vcpu_unimpl (vcpu,"unimplemented HWCR wrmsr: 0x%llx\n" , - data); +kvm_pr_unimpl_wrmsr (vcpu, msr, data);return 1 ; }break ;case MSR_FAM10H_MMIO_CONF_BASE :if (data !=0 ) { -vcpu_unimpl (vcpu,"unimplemented MMIO_CONF_BASE wrmsr: " -"0x%llx\n" , data); +kvm_pr_unimpl_wrmsr (vcpu, msr, data);return 1 ; }break ;
@@ -3813,16 +3810,13 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) case MSR_K7_PERFCTR0 ... MSR_K7_PERFCTR3: case MSR_P6_PERFCTR0 ... MSR_P6_PERFCTR1: - pr = true; - fallthrough; case MSR_K7_EVNTSEL0 ... MSR_K7_EVNTSEL3: case MSR_P6_EVNTSEL0 ... MSR_P6_EVNTSEL1:if (kvm_pmu_is_valid_msr (vcpu, msr))return kvm_pmu_set_msr (vcpu, msr_info); -if (pr || data !=0 ) -vcpu_unimpl (vcpu,"disabled perfctr wrmsr: " -"0x%x data 0x%llx\n" , msr, data); +if (data) +kvm_pr_unimpl_wrmsr (vcpu, msr, data);break ;case MSR_K7_CLK_CTL :/*
@@ -3849,9 +3843,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)/* Drop writes to this legacy MSR -- see rdmsr * counterpart for further detail. */ -if (report_ignored_msrs) -vcpu_unimpl (vcpu,"ignored wrmsr: 0x%x data 0x%llx\n" , - msr, data); +kvm_pr_unimpl_wrmsr (vcpu, msr, data);break ;case MSR_AMD64_OSVW_ID_LENGTH :if (!guest_cpuid_has (vcpu,X86_FEATURE_OSVW ))
arch/x86/kvm/x86.h +12 -0
@@ -331,6 +331,18 @@ extern bool report_ignored_msrs;extern bool eager_page_split; +static inline void kvm_pr_unimpl_wrmsr (struct kvm_vcpu *vcpu,u32 msr,u64 data) +{ +if (report_ignored_msrs) +vcpu_unimpl (vcpu,"Unhandled WRMSR(0x%x) = 0x%llx\n" , msr, data); +} + +static inline void kvm_pr_unimpl_rdmsr (struct kvm_vcpu *vcpu,u32 msr) +{ +if (report_ignored_msrs) +vcpu_unimpl (vcpu,"Unhandled RDMSR(0x%x)\n" , msr); +} +static inline u64 nsec_to_cycles (struct kvm_vcpu *vcpu,u64 nsec) { return pvclock_scale_delta(nsec, vcpu->arch.virtual_tsc_mult,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 34/482 KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 9c9025ea003a03f967affd690f39b4ef3452c0f5 ]
Annotate the kvm_entry() tracepoint with "immediate exit" when KVM is forcing a VM-Exit immediately after VM-Enter, e.g. when KVM wants to inject an event but needs to first complete some other operation. Knowing that KVM is (or isn't) forcing an exit is useful information when debugging issues related to event injection.
--- arch/x86/include/asm/kvm_host.h | 3 ++- arch/x86/kvm/svm/svm.c | 5 +++-- arch/x86/kvm/trace.h | 9 ++++++--- arch/x86/kvm/vmx/vmx.c | 4 ++-- arch/x86/kvm/x86.c | 2 +- 5 files changed, 14 insertions(+), 9 deletions(-)
arch/x86/include/asm/kvm_host.h +2 -1
@@ -1528,7 +1528,8 @@ struct kvm_x86_ops {void (*flush_tlb_guest)(struct kvm_vcpu *vcpu);int (*vcpu_pre_run)(struct kvm_vcpu *vcpu); -enum exit_fastpath_completion (*vcpu_run)(struct kvm_vcpu *vcpu); +enum exit_fastpath_completion (*vcpu_run)(struct kvm_vcpu *vcpu, +bool force_immediate_exit);int (*handle_exit)(struct kvm_vcpu *vcpu,enum exit_fastpath_completion exit_fastpath);int (*skip_emulated_instruction)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +3 -2
@@ -4005,12 +4005,13 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_inguest_state_exit_irqoff (); } -static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu) +static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, +bool force_immediate_exit) {struct vcpu_svm *svm =to_svm (vcpu);bool spec_ctrl_intercepted =msr_write_intercepted (vcpu,MSR_IA32_SPEC_CTRL ); -trace_kvm_entry (vcpu); +trace_kvm_entry (vcpu, force_immediate_exit); svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX ]; svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP ];
arch/x86/kvm/trace.h +6 -3
@@ -15,20 +15,23 @@* Tracepoint for guest mode entry. */ TRACE_EVENT (kvm_entry, - TP_PROTO(struct kvm_vcpu *vcpu), -TP_ARGS (vcpu), + TP_PROTO(struct kvm_vcpu *vcpu, bool force_immediate_exit), +TP_ARGS (vcpu, force_immediate_exit),TP_STRUCT__entry ( __field( unsigned int, vcpu_id ) __field( unsigned long, rip ) +__field ( bool, immediate_exit ) ),TP_fast_assign ( __entry->vcpu_id = vcpu->vcpu_id; __entry->rip = kvm_rip_read(vcpu); + __entry->immediate_exit = force_immediate_exit; ), -TP_printk ("vcpu %u, rip 0x%lx" , __entry->vcpu_id, __entry->rip) +TP_printk ("vcpu %u, rip 0x%lx%s" , __entry->vcpu_id, __entry->rip, + __entry->immediate_exit ?"[immediate exit]" :"" ) );/*
arch/x86/kvm/vmx/vmx.c +2 -2
@@ -7171,7 +7171,7 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu,guest_state_exit_irqoff (); } -static fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu) +static fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,bool force_immediate_exit) {struct vcpu_vmx *vmx =to_vmx (vcpu);unsigned long cr3, cr4;
@@ -7198,7 +7198,7 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu)return EXIT_FASTPATH_NONE ; } -trace_kvm_entry (vcpu); +trace_kvm_entry (vcpu, force_immediate_exit);if (vmx->ple_window_dirty) { vmx->ple_window_dirty = false;
arch/x86/kvm/x86.c +1 -1
@@ -10856,7 +10856,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)WARN_ON_ONCE ((kvm_vcpu_apicv_activated (vcpu) !=kvm_vcpu_apicv_active (vcpu)) && (kvm_get_apic_mode (vcpu) !=LAPIC_MODE_DISABLED )); - exit_fastpath =static_call (kvm_x86_vcpu_run)(vcpu); + exit_fastpath =static_call (kvm_x86_vcpu_run)(vcpu, req_immediate_exit);if (likely (exit_fastpath !=EXIT_FASTPATH_REENTER_GUEST ))break ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 35/482 KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit e6b5d16bbd2d4c8259ad76aa33de80d561aba5f9 ]
Re-enter the guest in the fast path if VMX preeemption timer VM-Exit was "spurious", i.e. if KVM "soft disabled" the timer by writing -1u and by some miracle the timer expired before any other VM-Exit occurred. This is just an intermediate step to cleaning up the preemption timer handling, optimizing these types of spurious VM-Exits is not interesting as they are extremely rare/infrequent.
--- arch/x86/kvm/vmx/vmx.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/vmx.c +9 -2
@@ -5933,8 +5933,15 @@ static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu) {struct vcpu_vmx *vmx =to_vmx (vcpu); -if (!vmx->req_immediate_exit && - !unlikely (vmx->loaded_vmcs->hv_timer_soft_disabled)) { +/* +* In the *extremely* unlikely scenario that this is a spurious VM-Exit +* due to the timer expiring while it was "soft" disabled, just eat the +* exit and re-enter the guest. +*/ +if (unlikely (vmx->loaded_vmcs->hv_timer_soft_disabled)) +return EXIT_FASTPATH_REENTER_GUEST ; + +if (!vmx->req_immediate_exit) {kvm_lapic_expired_hv_timer (vcpu);return EXIT_FASTPATH_REENTER_GUEST ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 36/482 KVM: VMX: Handle forced exit due to preemption timer in fastpath
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 11776aa0cfa7d007ad1799b1553bdcbd830e5010 ]
Handle VMX preemption timer VM-Exits due to KVM forcing an exit in the exit fastpath, i.e. avoid calling back into handle_preemption_timer() for the same exit. There is no work to be done for forced exits, as the name suggests the goal is purely to get control back in KVM.
In addition to shaving a few cycles, this will allow cleanly separating handle_fastpath_preemption_timer() from handle_preemption_timer(), e.g. it's not immediately obvious why _apparently_ calling handle_fastpath_preemption_timer() twice on a "slow" exit is necessary:
the "slow" call is necessary to handle exits from L2, which are excluded from the fastpath by vmx_vcpu_run().
--- arch/x86/kvm/vmx/vmx.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx/vmx.c +8 -5
@@ -5941,12 +5941,15 @@ static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu)if (unlikely (vmx->loaded_vmcs->hv_timer_soft_disabled))return EXIT_FASTPATH_REENTER_GUEST ; -if (!vmx->req_immediate_exit) { -kvm_lapic_expired_hv_timer (vcpu); -return EXIT_FASTPATH_REENTER_GUEST ; - } +/* +* If the timer expired because KVM used it to force an immediate exit, +* then mission accomplished. +*/ +if (vmx->req_immediate_exit) +return EXIT_FASTPATH_EXIT_HANDLED ; -return EXIT_FASTPATH_NONE ; +kvm_lapic_expired_hv_timer (vcpu); +return EXIT_FASTPATH_REENTER_GUEST ; }static int handle_preemption_timer (struct kvm_vcpu *vcpu)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 37/482 KVM: x86: Move handling of is_guest_mode() into fastpath exit handlers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit bf1a49436ea37b98dd2f37c57608951d0e28eecc ]
Let the fastpath code decide which exits can/can't be handled in the fastpath when L2 is active, e.g. when KVM generates a VMX preemption timer exit to forcefully regain control, there is no "work" to be done and so such exits can be handled in the fastpath regardless of whether L1 or L2 is active.
Moving the is_guest_mode() check into the fastpath code also makes it easier to see that L2 isn't allowed to use the fastpath in most cases, e.g. it's not immediately obvious why handle_fastpath_preemption_timer() is called from the fastpath and the normal path.
--- arch/x86/kvm/svm/svm.c | 6 +++--- arch/x86/kvm/vmx/vmx.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/x86/kvm/svm/svm.c +3 -3
@@ -3964,6 +3964,9 @@ static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu) {struct vmcb_control_area *control = &to_svm (vcpu)->vmcb->control; +if (is_guest_mode (vcpu)) +return EXIT_FASTPATH_NONE ; +/* * Note, the next RIP must be provided as SRCU isn't held, i.e. KVM * can't read guest memory (dereference memslots) to decode the WRMSR.
@@ -4127,9 +4130,6 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu,svm_complete_interrupts (vcpu); -if (is_guest_mode (vcpu)) -return EXIT_FASTPATH_NONE ; -return svm_exit_handlers_fastpath (vcpu); }
arch/x86/kvm/vmx/vmx.c +3 -3
@@ -7138,6 +7138,9 @@ void noinstr vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx,static fastpath_t vmx_exit_handlers_fastpath (struct kvm_vcpu *vcpu) { +if (is_guest_mode (vcpu)) +return EXIT_FASTPATH_NONE ; +switch (to_vmx (vcpu)->exit_reason.basic) {case EXIT_REASON_MSR_WRITE :return handle_fastpath_set_msr_irqoff (vcpu);
@@ -7337,9 +7340,6 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, bool force_immediate_exit)vmx_recover_nmi_blocking (vmx);vmx_complete_interrupts (vmx); -if (is_guest_mode (vcpu)) -return EXIT_FASTPATH_NONE ; -return vmx_exit_handlers_fastpath (vcpu); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 38/482 KVM: VMX: Handle KVM-induced preemption timer exits in fastpath for L2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 7b3d1bbf8d68d76fb21210932a5e8ed8ea80dbcc ]
Eat VMX treemption timer exits in the fastpath regardless of whether L1 or L2 is active. The VM-Exit is 100% KVM-induced, i.e. there is nothing directly related to the exit that KVM needs to do on behalf of the guest, thus there is no reason to wait until the slow path to do nothing.
Opportunistically add comments explaining why preemption timer exits for emulating the guest's APIC timer need to go down the slow path.
--- arch/x86/kvm/vmx/vmx.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/vmx.c +20 -2
@@ -5948,13 +5948,26 @@ static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu)if (vmx->req_immediate_exit)return EXIT_FASTPATH_EXIT_HANDLED ; +/* +* If L2 is active, go down the slow path as emulating the guest timer +* expiration likely requires synthesizing a nested VM-Exit. +*/ +if (is_guest_mode (vcpu)) +return EXIT_FASTPATH_NONE ; +kvm_lapic_expired_hv_timer (vcpu);return EXIT_FASTPATH_REENTER_GUEST ; }static int handle_preemption_timer (struct kvm_vcpu *vcpu) { -handle_fastpath_preemption_timer (vcpu); +/* +* This non-fastpath handler is reached if and only if the preemption +* timer was being used to emulate a guest timer while L2 is active. +* All other scenarios are supposed to be handled in the fastpath. +*/ +WARN_ON_ONCE (!is_guest_mode (vcpu)); +kvm_lapic_expired_hv_timer (vcpu);return 1 ; }
@@ -7138,7 +7151,12 @@ void noinstr vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx,static fastpath_t vmx_exit_handlers_fastpath (struct kvm_vcpu *vcpu) { -if (is_guest_mode (vcpu)) +/* +* If L2 is active, some VMX preemption timer exits can be handled in +* the fastpath even, all other exits must use the slow path. +*/ +if (is_guest_mode (vcpu) && +to_vmx (vcpu)->exit_reason.basic !=EXIT_REASON_PREEMPTION_TIMER )return EXIT_FASTPATH_NONE ;switch (to_vmx (vcpu)->exit_reason.basic) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 39/482 KVM: x86: Fully defer to vendor code to decide how to force immediate exit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 0ec3d6d1f169baa7fc512ae4b78d17e7c94b7763 ]
Now that vmx->req_immediate_exit is used only in the scope of vmx_vcpu_run(), use force_immediate_exit to detect that KVM should usurp the VMX preemption to force a VM-Exit and let vendor code fully handle forcing a VM-Exit.
Opportunsitically drop __kvm_request_immediate_exit() and just have vendor code call smp_send_reschedule() directly. SVM already does this when injecting an event while also trying to single-step an IRET, i.e. it's not exactly secret knowledge that KVM uses a reschedule IPI to force an exit.
--- arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 3 --- arch/x86/kvm/svm/svm.c | 7 ++++--- arch/x86/kvm/vmx/vmx.c | 32 +++++++++++++----------------- arch/x86/kvm/vmx/vmx.h | 2 -- arch/x86/kvm/x86.c | 10 +--------- 6 files changed, 19 insertions(+), 36 deletions(-)
arch/x86/include/asm/kvm-x86-ops.h +0 -1
@@ -100,7 +100,6 @@ KVM_X86_OP(write_tsc_multiplier) KVM_X86_OP(get_exit_info) KVM_X86_OP(check_intercept) KVM_X86_OP(handle_exit_irqoff) -KVM_X86_OP(request_immediate_exit) KVM_X86_OP(sched_in) KVM_X86_OP_OPTIONAL(update_cpu_dirty_logging) KVM_X86_OP_OPTIONAL(vcpu_blocking)
arch/x86/include/asm/kvm_host.h +0 -3
@@ -1590,8 +1590,6 @@ struct kvm_x86_ops { struct x86_exception *exception);void (*handle_exit_irqoff)(struct kvm_vcpu *vcpu); -void (*request_immediate_exit)(struct kvm_vcpu *vcpu); -void (*sched_in)(struct kvm_vcpu *kvm,int cpu);/*
@@ -2059,7 +2057,6 @@ extern bool kvm_find_async_pf_gfn(struct kvm_vcpu *vcpu, gfn_t gfn);int kvm_skip_emulated_instruction (struct kvm_vcpu *vcpu);int kvm_complete_insn_gp (struct kvm_vcpu *vcpu,int err); -void __kvm_request_immediate_exit (struct kvm_vcpu *vcpu);void __user *__x86_set_memory_region (struct kvm *kvm,int id,gpa_t gpa,u32 size);
arch/x86/kvm/svm/svm.c +4 -3
@@ -4033,9 +4033,12 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu,* is enough to force an immediate vmexit. */ disable_nmi_singlestep (svm); -smp_send_reschedule (vcpu->cpu); + force_immediate_exit = true; } +if (force_immediate_exit) +smp_send_reschedule (vcpu->cpu); +pre_svm_run (vcpu);sync_lapic_to_cr8 (vcpu);
@@ -4874,8 +4877,6 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { .check_intercept = svm_check_intercept, .handle_exit_irqoff = svm_handle_exit_irqoff, - .request_immediate_exit = __kvm_request_immediate_exit, - .sched_in = svm_sched_in, .nested_ops = &svm_nested_ops,
arch/x86/kvm/vmx/vmx.c +14 -18
@@ -49,6 +49,8 @@#include <asm/virtext.h> #include <asm/vmx.h> +#include <trace/events/ipi.h> +#include "capabilities.h" #include "cpuid.h" #include "evmcs.h"
@@ -1223,8 +1225,6 @@ void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)u16 fs_sel, gs_sel;int i; - vmx->req_immediate_exit = false; -/* * Note that guest MSRs to be saved/restored can also be changed * when guest state is loaded. This happens when guest transitions
@@ -5929,7 +5929,8 @@ static int handle_pml_full(struct kvm_vcpu *vcpu)return 1 ; } -static fastpath_t handle_fastpath_preemption_timer (struct kvm_vcpu *vcpu) +static fastpath_t handle_fastpath_preemption_timer (struct kvm_vcpu *vcpu, +bool force_immediate_exit) {struct vcpu_vmx *vmx =to_vmx (vcpu);
@@ -5945,7 +5946,7 @@ static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu)* If the timer expired because KVM used it to force an immediate exit, * then mission accomplished. */ -if (vmx->req_immediate_exit) +if (force_immediate_exit)return EXIT_FASTPATH_EXIT_HANDLED ;/*
@@ -7090,13 +7091,13 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx) msrs[i].host, false); } -static void vmx_update_hv_timer (struct kvm_vcpu *vcpu) +static void vmx_update_hv_timer (struct kvm_vcpu *vcpu,bool force_immediate_exit) {struct vcpu_vmx *vmx =to_vmx (vcpu);u64 tscl;u32 delta_tsc; -if (vmx->req_immediate_exit) { +if (force_immediate_exit) {vmcs_write32 (VMX_PREEMPTION_TIMER_VALUE ,0 ); vmx->loaded_vmcs->hv_timer_soft_disabled = false; }else if (vmx->hv_deadline_tsc !=-1 ) {
@@ -7149,7 +7150,8 @@ void noinstr vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx,barrier_nospec (); } -static fastpath_t vmx_exit_handlers_fastpath (struct kvm_vcpu *vcpu) +static fastpath_t vmx_exit_handlers_fastpath (struct kvm_vcpu *vcpu, +bool force_immediate_exit) {/* * If L2 is active, some VMX preemption timer exits can be handled in
@@ -7163,7 +7165,7 @@ static fastpath_t vmx_exit_handlers_fastpath(struct kvm_vcpu *vcpu)case EXIT_REASON_MSR_WRITE :return handle_fastpath_set_msr_irqoff (vcpu);case EXIT_REASON_PREEMPTION_TIMER : -return handle_fastpath_preemption_timer (vcpu); +return handle_fastpath_preemption_timer (vcpu, force_immediate_exit);default :return EXIT_FASTPATH_NONE ; }
@@ -7284,7 +7286,9 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, bool force_immediate_exit)vmx_passthrough_lbr_msrs (vcpu);if (enable_preemption_timer) -vmx_update_hv_timer (vcpu); +vmx_update_hv_timer (vcpu, force_immediate_exit); +else if (force_immediate_exit) +smp_send_reschedule (vcpu->cpu);kvm_wait_lapic_expire (vcpu);
@@ -7358,7 +7362,7 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, bool force_immediate_exit)vmx_recover_nmi_blocking (vmx);vmx_complete_interrupts (vmx); -return vmx_exit_handlers_fastpath (vcpu); +return vmx_exit_handlers_fastpath (vcpu, force_immediate_exit); }static void vmx_vcpu_free (struct kvm_vcpu *vcpu)
@@ -7865,11 +7869,6 @@ static __init void vmx_set_cpu_caps(void)kvm_cpu_cap_check_and_set (X86_FEATURE_WAITPKG ); } -static void vmx_request_immediate_exit (struct kvm_vcpu *vcpu) -{ -to_vmx (vcpu)->req_immediate_exit = true; -} -static int vmx_check_intercept_io (struct kvm_vcpu *vcpu,struct x86_instruction_info *info) {
@@ -8275,8 +8274,6 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { .check_intercept = vmx_check_intercept, .handle_exit_irqoff = vmx_handle_exit_irqoff, - .request_immediate_exit = vmx_request_immediate_exit, - .sched_in = vmx_sched_in, .cpu_dirty_log_size = PML_ENTITY_NUM,
@@ -8533,7 +8530,6 @@ static __init int hardware_setup(void)if (!enable_preemption_timer) { vmx_x86_ops.set_hv_timer =NULL ; vmx_x86_ops.cancel_hv_timer =NULL ; - vmx_x86_ops.request_immediate_exit = __kvm_request_immediate_exit; } kvm_caps.supported_mce_cap |=MCG_LMCE_P ;
arch/x86/kvm/vmx/vmx.h +0 -2
@@ -343,8 +343,6 @@ struct vcpu_vmx {unsigned int ple_window;bool ple_window_dirty; -bool req_immediate_exit; -/* Support for PML */ #define PML_ENTITY_NUM 512struct page *pml_pg;
arch/x86/kvm/x86.c +1 -9
@@ -10578,12 +10578,6 @@ static void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu)static_call_cond (kvm_x86_set_apic_access_page_addr)(vcpu); } -void __kvm_request_immediate_exit (struct kvm_vcpu *vcpu) -{ -smp_send_reschedule (vcpu->cpu); -} -EXPORT_SYMBOL_GPL (__kvm_request_immediate_exit); -/* * Called within kvm->srcu read side. * Returns 1 to let vcpu_run() continue the guest execution loop without
@@ -10817,10 +10811,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) goto cancel_injection; } -if (req_immediate_exit) { +if (req_immediate_exit)kvm_make_request (KVM_REQ_EVENT , vcpu); -static_call (kvm_x86_request_immediate_exit)(vcpu); - }fpregs_assert_state_consistent ();if (test_thread_flag (TIF_NEED_FPU_LOAD ))
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 40/482 KVM: x86: Convert vcpu_run()s immediate exit param into a generic bitmap
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 2478b1b220c49d25cb1c3f061ec4f9b351d9a131 ]
Convert kvm_x86_ops.vcpu_run()'s "force_immediate_exit" boolean parameter into an a generic bitmap so that similar "take action" information can be passed to vendor code without creating a pile of boolean parameters.
This will allow dropping kvm_x86_ops.set_dr6() in favor of a new flag, and will also allow for adding similar functionality for re-loading debugctl in the active VMCS.
Opportunistically massage the TDX WARN and comment to prepare for adding more run_flags, all of which are expected to be mutually exclusive with TDX, i.e. should be WARNed on.
No functional change intended.
--- arch/x86/include/asm/kvm_host.h | 6 +++++- arch/x86/kvm/svm/svm.c | 4 ++-- arch/x86/kvm/vmx/vmx.c | 3 ++- arch/x86/kvm/x86.c | 10 ++++++++-- 4 files changed, 17 insertions(+), 6 deletions(-)
arch/x86/include/asm/kvm_host.h +5 -1
@@ -1456,6 +1456,10 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical)return dest_mode_logical ?APIC_DEST_LOGICAL :APIC_DEST_PHYSICAL ; } +enum kvm_x86_run_flags { +KVM_RUN_FORCE_IMMEDIATE_EXIT =BIT (0 ), +}; +struct kvm_x86_ops {const char *name;
@@ -1529,7 +1533,7 @@ struct kvm_x86_ops {int (*vcpu_pre_run)(struct kvm_vcpu *vcpu);enum exit_fastpath_completion (*vcpu_run)(struct kvm_vcpu *vcpu, -bool force_immediate_exit); +u64 run_flags);int (*handle_exit)(struct kvm_vcpu *vcpu,enum exit_fastpath_completion exit_fastpath);int (*skip_emulated_instruction)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +2 -2
@@ -4008,9 +4008,9 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_inguest_state_exit_irqoff (); } -static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, -bool force_immediate_exit) +static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags) { +bool force_immediate_exit = run_flags &KVM_RUN_FORCE_IMMEDIATE_EXIT ;struct vcpu_svm *svm =to_svm (vcpu);bool spec_ctrl_intercepted =msr_write_intercepted (vcpu,MSR_IA32_SPEC_CTRL );
arch/x86/kvm/vmx/vmx.c +2 -1
@@ -7204,8 +7204,9 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu,guest_state_exit_irqoff (); } -static fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,bool force_immediate_exit) +static fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,u64 run_flags) { +bool force_immediate_exit = run_flags &KVM_RUN_FORCE_IMMEDIATE_EXIT ;struct vcpu_vmx *vmx =to_vmx (vcpu);unsigned long cr3, cr4;
arch/x86/kvm/x86.c +8 -2
@@ -10591,6 +10591,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)dm_request_for_irq_injection (vcpu) &&kvm_cpu_accept_dm_intr (vcpu);fastpath_t exit_fastpath; +u64 run_flags;bool req_immediate_exit = false;
@@ -10811,8 +10812,11 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) goto cancel_injection; } -if (req_immediate_exit) + run_flags =0 ; +if (req_immediate_exit) { + run_flags |=KVM_RUN_FORCE_IMMEDIATE_EXIT ;kvm_make_request (KVM_REQ_EVENT , vcpu); + }fpregs_assert_state_consistent ();if (test_thread_flag (TIF_NEED_FPU_LOAD ))
@@ -10848,7 +10852,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)WARN_ON_ONCE ((kvm_vcpu_apicv_activated (vcpu) !=kvm_vcpu_apicv_active (vcpu)) && (kvm_get_apic_mode (vcpu) !=LAPIC_MODE_DISABLED )); - exit_fastpath =static_call (kvm_x86_vcpu_run)(vcpu, req_immediate_exit); + exit_fastpath =static_call (kvm_x86_vcpu_run)(vcpu, run_flags);if (likely (exit_fastpath !=EXIT_FASTPATH_REENTER_GUEST ))break ;
@@ -10860,6 +10864,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)break ; } + run_flags =0 ; +/* Note, VM-Exits that go down the "slow" path are accounted below. */ ++vcpu->stat.exits; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 41/482 KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 80c64c7afea1da6a93ebe88d3d29d8a60377ef80 ]
Instruct vendor code to load the guest's DR6 into hardware via a new KVM_RUN flag, and remove kvm_x86_ops.set_dr6(), whose sole purpose was to load vcpu->arch.dr6 into hardware when DR6 can be read/written directly by the guest.
Note, TDX already WARNs on any run_flag being set, i.e. will yell if KVM thinks DR6 needs to be reloaded. TDX vCPUs force KVM_DEBUGREG_AUTO_SWITCH and never clear the flag, i.e. should never observe KVM_RUN_LOAD_GUEST_DR6.
--- arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/svm/svm.c | 10 ++++++---- arch/x86/kvm/vmx/vmx.c | 10 +++------- arch/x86/kvm/x86.c | 2 +- 5 files changed, 11 insertions(+), 14 deletions(-)
arch/x86/include/asm/kvm-x86-ops.h +0 -1
@@ -47,7 +47,6 @@ KVM_X86_OP(set_idt) KVM_X86_OP(get_gdt) KVM_X86_OP(set_gdt) KVM_X86_OP(sync_dirty_debug_regs) -KVM_X86_OP(set_dr6) KVM_X86_OP(set_dr7) KVM_X86_OP(cache_reg) KVM_X86_OP(get_rflags)
arch/x86/include/asm/kvm_host.h +1 -1
@@ -1458,6 +1458,7 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical)enum kvm_x86_run_flags {KVM_RUN_FORCE_IMMEDIATE_EXIT =BIT (0 ), +KVM_RUN_LOAD_GUEST_DR6 =BIT (1 ), };struct kvm_x86_ops {
@@ -1504,7 +1505,6 @@ struct kvm_x86_ops {void (*get_gdt)(struct kvm_vcpu *vcpu,struct desc_ptr *dt);void (*set_gdt)(struct kvm_vcpu *vcpu,struct desc_ptr *dt);void (*sync_dirty_debug_regs)(struct kvm_vcpu *vcpu); -void (*set_dr6)(struct kvm_vcpu *vcpu,unsigned long value);void (*set_dr7)(struct kvm_vcpu *vcpu,unsigned long value);void (*cache_reg)(struct kvm_vcpu *vcpu,enum kvm_reg reg);unsigned long (*get_rflags)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +6 -4
@@ -4052,10 +4052,13 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)svm_hv_update_vp_id (svm->vmcb, vcpu);/* -* Run with all-zero DR6 unless needed, so that we can get the exact cause -* of a #DB. +* Run with all-zero DR6 unless the guest can write DR6 freely, so that +* KVM can get the exact cause of a #DB. Note, loading guest DR6 from +* KVM's snapshot is only necessary when DR accesses won't exit. */ -if (likely (!(vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT ))) +if (unlikely (run_flags &KVM_RUN_LOAD_GUEST_DR6 )) +svm_set_dr6 (vcpu, vcpu->arch.dr6); +else if (likely (!(vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT )))svm_set_dr6 (vcpu,DR6_ACTIVE_LOW );clgi ();
@@ -4822,7 +4825,6 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { .set_idt = svm_set_idt, .get_gdt = svm_get_gdt, .set_gdt = svm_set_gdt, - .set_dr6 = svm_set_dr6, .set_dr7 = svm_set_dr7, .sync_dirty_debug_regs = svm_sync_dirty_debug_regs, .cache_reg = svm_cache_reg,
arch/x86/kvm/vmx/vmx.c +3 -7
@@ -5530,12 +5530,6 @@ static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)set_debugreg (DR6_RESERVED ,6 ); } -static void vmx_set_dr6 (struct kvm_vcpu *vcpu,unsigned long val) -{ -lockdep_assert_irqs_disabled (); -set_debugreg (vcpu->arch.dr6,6 ); -} -static void vmx_set_dr7 (struct kvm_vcpu *vcpu,unsigned long val) {vmcs_writel (GUEST_DR7 , val);
@@ -7251,6 +7245,9 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)vmcs_writel (GUEST_RIP , vcpu->arch.regs[VCPU_REGS_RIP ]); vcpu->arch.regs_dirty =0 ; +if (run_flags &KVM_RUN_LOAD_GUEST_DR6 ) +set_debugreg (vcpu->arch.dr6,6 ); +/* * Refresh vmcs.HOST_CR3 if necessary. This must be done immediately * prior to VM-Enter, as the kernel may load a new ASID (PCID) any time
@@ -8208,7 +8205,6 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { .set_idt = vmx_set_idt, .get_gdt = vmx_get_gdt, .set_gdt = vmx_set_gdt, - .set_dr6 = vmx_set_dr6, .set_dr7 = vmx_set_dr7, .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs, .cache_reg = vmx_cache_reg,
arch/x86/kvm/x86.c +1 -1
@@ -10833,7 +10833,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)set_debugreg (vcpu->arch.eff_db[3 ],3 );/* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ if (unlikely (vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT )) -static_call (kvm_x86_set_dr6)(vcpu, vcpu->arch.dr6); + run_flags |=KVM_RUN_LOAD_GUEST_DR6 ; }else if (unlikely (hw_breakpoint_active ())) {set_debugreg (0 ,7 ); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 42/482 KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 17ec2f965344ee3fd6620bef7ef68792f4ac3af0 ]
Let the guest set DEBUGCTL.RTM_DEBUG if RTM is supported according to the guest CPUID model, as debug support is supposed to be available if RTM is supported, and there are no known downsides to letting the guest debug RTM aborts.
Note, there are no known bug reports related to RTM_DEBUG, the primary motivation is to reduce the probability of breaking existing guests when a future change adds a missing consistency check on vmcs12.GUEST_DEBUGCTL (KVM currently lets L2 run with whatever hardware supports; whoops).
Note #2, KVM already emulates DR6.RTM, and doesn't restrict access to DR7.RTM.
--- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kvm/vmx/vmx.c | 4 ++++ 2 files changed, 5 insertions(+)
arch/x86/include/asm/msr-index.h +1 -0
@@ -379,6 +379,7 @@#define DEBUGCTLMSR_FREEZE_PERFMON_ON_PMI (1UL << 12)#define DEBUGCTLMSR_FREEZE_IN_SMM_BIT 14#define DEBUGCTLMSR_FREEZE_IN_SMM (1UL << DEBUGCTLMSR_FREEZE_IN_SMM_BIT) +#define DEBUGCTLMSR_RTM_DEBUG BIT(15)#define MSR_PEBS_FRONTEND 0x000003f7
arch/x86/kvm/vmx/vmx.c +4 -0
@@ -2064,6 +2064,10 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated (host_initiated || intel_pmu_lbr_is_enabled(vcpu))) debugctl |=DEBUGCTLMSR_LBR |DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ; +if (boot_cpu_has (X86_FEATURE_RTM ) && + (host_initiated ||guest_cpuid_has (vcpu,X86_FEATURE_RTM ))) + debugctl |=DEBUGCTLMSR_RTM_DEBUG ; +return debugctl; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 43/482 KVM: VMX: Extract checking of guests DEBUGCTL into helper
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 8a4351ac302cd8c19729ba2636acfd0467c22ae8 ]
Move VMX's logic to check DEBUGCTL values into a standalone helper so that the code can be used by nested VM-Enter to apply the same logic to the value being loaded from vmcs12.
KVM needs to explicitly check vmcs12->guest_ia32_debugctl on nested VM-Enter, as hardware may support features that KVM does not, i.e. relying on hardware to detect invalid guest state will result in false negatives. Unfortunately, that means applying KVM's funky suppression of BTF and LBR to vmcs12 so as not to break existing guests.
No functional change intended.
Stable-dep-of: 7d0cce6cbe71 ("KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs")
--- arch/x86/kvm/vmx/vmx.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-)
arch/x86/kvm/vmx/vmx.c +17 -12
@@ -2071,6 +2071,19 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiatedreturn debugctl; } +static bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data, +bool host_initiated) +{ +u64 invalid; + + invalid = data & ~vmx_get_supported_debugctl (vcpu, host_initiated); +if (invalid & (DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR )) { +kvm_pr_unimpl_wrmsr (vcpu,MSR_IA32_DEBUGCTLMSR , data); + invalid &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); + } +return !invalid; +} +/* * Writes msr value into the appropriate "register". * Returns 0 on success, non-0 otherwise.
@@ -2139,19 +2152,12 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) }vmcs_writel (GUEST_SYSENTER_ESP , data);break ; -case MSR_IA32_DEBUGCTLMSR : { -u64 invalid; - - invalid = data & ~vmx_get_supported_debugctl (vcpu, msr_info->host_initiated); -if (invalid & (DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR )) { -kvm_pr_unimpl_wrmsr (vcpu, msr_index, data); - data &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); - invalid &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); - } - -if (invalid) +case MSR_IA32_DEBUGCTLMSR : +if (!vmx_is_valid_debugctl (vcpu, data, msr_info->host_initiated))return 1 ; + data &=vmx_get_supported_debugctl (vcpu, msr_info->host_initiated); +if (is_guest_mode (vcpu) &&get_vmcs12 (vcpu)->vm_exit_controls &VM_EXIT_SAVE_DEBUG_CONTROLS )get_vmcs12 (vcpu)->guest_ia32_debugctl = data;
@@ -2161,7 +2167,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) (data & DEBUGCTLMSR_LBR))intel_pmu_create_guest_lbr_event (vcpu);return 0 ; - }case MSR_IA32_BNDCFGS : if (!kvm_mpx_supported() || (!msr_info->host_initiated &&
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 44/482 KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
[ Upstream commit 095686e6fcb4150f0a55b1a25987fad3d8af58d6 ]
Add a consistency check for L2's guest_ia32_debugctl, as KVM only supports a subset of hardware functionality, i.e. KVM can't rely on hardware to detect illegal/unsupported values. Failure to check the vmcs12 value would allow the guest to load any harware-supported value while running L2.
Take care to exempt BTF and LBR from the validity check in order to match KVM's behavior for writes via WRMSR, but without clobbering vmcs12. Even if VM_EXIT_SAVE_DEBUG_CONTROLS is set in vmcs12, L1 can reasonably expect that vmcs12->guest_ia32_debugctl will not be modified if writes to the MSR are being intercepted.
Arguably, KVM _should_ update vmcs12 if VM_EXIT_SAVE_DEBUG_CONTROLS is set *and* writes to MSR_IA32_DEBUGCTLMSR are not being intercepted by L1, but that would incur non-trivial complexity and wouldn't change the fact that KVM's handling of DEBUGCTL is blatantly broken. I.e. the extra complexity is not worth carrying.
Stable-dep-of: 7d0cce6cbe71 ("KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs")
--- arch/x86/kvm/vmx/nested.c | 12 ++++++++++-- arch/x86/kvm/vmx/vmx.c | 5 ++--- arch/x86/kvm/vmx/vmx.h | 3 +++ 3 files changed, 15 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx/nested.c +10 -2
@@ -2532,7 +2532,8 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,if (vmx->nested.nested_run_pending && (vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS )) {kvm_set_dr (vcpu,7 , vmcs12->guest_dr7); -vmcs_write64 (GUEST_IA32_DEBUGCTL , vmcs12->guest_ia32_debugctl); +vmcs_write64 (GUEST_IA32_DEBUGCTL , vmcs12->guest_ia32_debugctl & +vmx_get_supported_debugctl (vcpu, false)); }else {kvm_set_dr (vcpu,7 , vcpu->arch.dr7);vmcs_write64 (GUEST_IA32_DEBUGCTL , vmx->nested.pre_vmenter_debugctl);
@@ -3022,7 +3023,8 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,return -EINVAL ;if ((vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS ) && -CC (!kvm_dr7_valid (vmcs12->guest_dr7))) + (CC (!kvm_dr7_valid (vmcs12->guest_dr7)) || +CC (!vmx_is_valid_debugctl (vcpu, vmcs12->guest_ia32_debugctl, false))))return -EINVAL ; if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&
@@ -4374,6 +4376,12 @@ static void sync_vmcs02_to_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) (vmcs12->vm_entry_controls & ~VM_ENTRY_IA32E_MODE ) | (vm_entry_controls_get (to_vmx (vcpu)) &VM_ENTRY_IA32E_MODE ); +/* +* Note! Save DR7, but intentionally don't grab DEBUGCTL from vmcs02. +* Writes to DEBUGCTL that aren't intercepted by L1 are immediately +* propagated to vmcs12 (see vmx_set_msr()), as the value loaded into +* vmcs02 doesn't strictly track vmcs12. +*/ if (vmcs12->vm_exit_controls &VM_EXIT_SAVE_DEBUG_CONTROLS )kvm_get_dr (vcpu,7 , (unsigned long *)&vmcs12->guest_dr7);
arch/x86/kvm/vmx/vmx.c +2 -3
@@ -2052,7 +2052,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu,return (unsigned long )data; } -static u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated) +u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated) {u64 debugctl =0 ;
@@ -2071,8 +2071,7 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiatedreturn debugctl; } -static bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data, -bool host_initiated) +bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data,bool host_initiated) {u64 invalid;
arch/x86/kvm/vmx/vmx.h +3 -0
@@ -442,6 +442,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,void vmx_update_cpu_dirty_logging (struct kvm_vcpu *vcpu); +u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated); +bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data,bool host_initiated); +/* * Note, early Intel manuals have the write-low and read-high bitmap offsets * the wrong way round. The bitmaps control MSRs 0x00000000-0x00001fff and
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 45/482 KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
[ Upstream commit 7d0cce6cbe71af6e9c1831bff101a2b9c249c4a2 ]
Introduce vmx_guest_debugctl_{read,write}() to handle all accesses to vmcs.GUEST_IA32_DEBUGCTL. This will allow stuffing FREEZE_IN_SMM into GUEST_IA32_DEBUGCTL based on the host setting without bleeding the state into the guest, and without needing to copy+paste the FREEZE_IN_SMM logic into every patch that accesses GUEST_IA32_DEBUGCTL.
No functional change intended.
--- arch/x86/kvm/vmx/nested.c | 10 +++++----- arch/x86/kvm/vmx/pmu_intel.c | 8 ++++---- arch/x86/kvm/vmx/vmx.c | 8 +++++--- arch/x86/kvm/vmx/vmx.h | 10 ++++++++++ 4 files changed, 24 insertions(+), 12 deletions(-)
arch/x86/kvm/vmx/nested.c +5 -5
@@ -2532,11 +2532,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,if (vmx->nested.nested_run_pending && (vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS )) {kvm_set_dr (vcpu,7 , vmcs12->guest_dr7); -vmcs_write64 (GUEST_IA32_DEBUGCTL , vmcs12->guest_ia32_debugctl & -vmx_get_supported_debugctl (vcpu, false)); +vmx_guest_debugctl_write (vcpu, vmcs12->guest_ia32_debugctl & +vmx_get_supported_debugctl (vcpu, false)); }else {kvm_set_dr (vcpu,7 , vcpu->arch.dr7); -vmcs_write64 (GUEST_IA32_DEBUGCTL , vmx->nested.pre_vmenter_debugctl); +vmx_guest_debugctl_write (vcpu, vmx->nested.pre_vmenter_debugctl); }if (kvm_mpx_supported () && (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls &VM_ENTRY_LOAD_BNDCFGS )))
@@ -3404,7 +3404,7 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu,if (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS )) - vmx->nested.pre_vmenter_debugctl =vmcs_read64 (GUEST_IA32_DEBUGCTL ); + vmx->nested.pre_vmenter_debugctl =vmx_guest_debugctl_read ();if (kvm_mpx_supported () && (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls &VM_ENTRY_LOAD_BNDCFGS )))
@@ -4572,7 +4572,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,__vmx_set_segment (vcpu, &seg,VCPU_SREG_LDTR );kvm_set_dr (vcpu,7 ,0x400 ); -vmcs_write64 (GUEST_IA32_DEBUGCTL ,0 ); +vmx_guest_debugctl_write (vcpu,0 );if (nested_vmx_load_msr (vcpu, vmcs12->vm_exit_msr_load_addr, vmcs12->vm_exit_msr_load_count))
arch/x86/kvm/vmx/pmu_intel.c +4 -4
@@ -672,11 +672,11 @@ static void intel_pmu_reset(struct kvm_vcpu *vcpu)*/ static void intel_pmu_legacy_freezing_lbrs_on_pmi (struct kvm_vcpu *vcpu) { -u64 data =vmcs_read64 (GUEST_IA32_DEBUGCTL ); +u64 data =vmx_guest_debugctl_read ();if (data &DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ) { data &= ~DEBUGCTLMSR_LBR ; -vmcs_write64 (GUEST_IA32_DEBUGCTL , data); +vmx_guest_debugctl_write (vcpu, data); } }
@@ -746,7 +746,7 @@ void vmx_passthrough_lbr_msrs(struct kvm_vcpu *vcpu)if (!lbr_desc->event) {vmx_disable_lbr_msrs_passthrough (vcpu); -if (vmcs_read64 (GUEST_IA32_DEBUGCTL ) &DEBUGCTLMSR_LBR ) +if (vmx_guest_debugctl_read () &DEBUGCTLMSR_LBR ) goto warn;if (test_bit (INTEL_PMC_IDX_FIXED_VLBR , pmu->pmc_in_use)) goto warn;
@@ -769,7 +769,7 @@ void vmx_passthrough_lbr_msrs(struct kvm_vcpu *vcpu)static void intel_pmu_cleanup (struct kvm_vcpu *vcpu) { -if (!(vmcs_read64 (GUEST_IA32_DEBUGCTL ) &DEBUGCTLMSR_LBR )) +if (!(vmx_guest_debugctl_read () &DEBUGCTLMSR_LBR ))intel_pmu_release_guest_lbr_event (vcpu); }
arch/x86/kvm/vmx/vmx.c +5 -3
@@ -2027,7 +2027,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) msr_info->data = vmx->pt_desc.guest.addr_a[index /2 ];break ;case MSR_IA32_DEBUGCTLMSR : - msr_info->data =vmcs_read64 (GUEST_IA32_DEBUGCTL ); + msr_info->data =vmx_guest_debugctl_read ();break ;default : find_uret_msr:
@@ -2161,7 +2161,8 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) VM_EXIT_SAVE_DEBUG_CONTROLS) get_vmcs12(vcpu)->guest_ia32_debugctl = data; - vmcs_write64(GUEST_IA32_DEBUGCTL, data); + vmx_guest_debugctl_write(vcpu, data); + if (intel_pmu_lbr_is_enabled(vcpu) && !to_vmx(vcpu)->lbr_desc.event && (data & DEBUGCTLMSR_LBR)) intel_pmu_create_guest_lbr_event(vcpu);
@@ -4751,7 +4752,8 @@ static void init_vmcs(struct vcpu_vmx *vmx)vmcs_write32 (GUEST_SYSENTER_CS ,0 );vmcs_writel (GUEST_SYSENTER_ESP ,0 );vmcs_writel (GUEST_SYSENTER_EIP ,0 ); -vmcs_write64 (GUEST_IA32_DEBUGCTL ,0 ); + +vmx_guest_debugctl_write (&vmx->vcpu,0 );if (cpu_has_vmx_tpr_shadow ()) {vmcs_write64 (VIRTUAL_APIC_PAGE_ADDR ,0 );
arch/x86/kvm/vmx/vmx.h +10 -0
@@ -445,6 +445,16 @@ void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated);bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data,bool host_initiated); +static inline void vmx_guest_debugctl_write (struct kvm_vcpu *vcpu,u64 val) +{ +vmcs_write64 (GUEST_IA32_DEBUGCTL , val); +} + +static inline u64 vmx_guest_debugctl_read (void ) +{ +return vmcs_read64 (GUEST_IA32_DEBUGCTL ); +} +/* * Note, early Intel manuals have the write-low and read-high bitmap offsets * the wrong way round. The bitmaps control MSRs 0x00000000-0x00001fff and
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 46/482 KVM: VMX: Preserve hosts DEBUGCTLMSR_FREEZE_IN_SMM while running the guest
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
[ Upstream commit 6b1dd26544d045f6a79e8c73572c0c0db3ef3c1a ]
Set/clear DEBUGCTLMSR_FREEZE_IN_SMM in GUEST_IA32_DEBUGCTL based on the host's pre-VM-Enter value, i.e. preserve the host's FREEZE_IN_SMM setting while running the guest. When running with the "default treatment of SMIs" in effect (the only mode KVM supports), SMIs do not generate a VM-Exit that is visible to host (non-SMM) software, and instead transitions directly from VMX non-root to SMM. And critically, DEBUGCTL isn't context switched by hardware on SMI or RSM, i.e. SMM will run with whatever value was resident in hardware at the time of the SMI.
Failure to preserve FREEZE_IN_SMM results in the PMU unexpectedly counting events while the CPU is executing in SMM, which can pollute profiling and potentially leak information into the guest.
Check for changes in FREEZE_IN_SMM prior to every entry into KVM's inner run loop, as the bit can be toggled in IRQ context via IPI callback (SMP function call), by way of /sys/devices/cpu/freeze_on_smi.
Add a field in kvm_x86_ops to communicate which DEBUGCTL bits need to be preserved, as FREEZE_IN_SMM is only supported and defined for Intel CPUs, i.e. explicitly checking FREEZE_IN_SMM in common x86 is at best weird, and at worst could lead to undesirable behavior in the future if AMD CPUs ever happened to pick up a collision with the bit.
Exempt TDX vCPUs, i.e. protected guests, from the check, as the TDX Module owns and controls GUEST_IA32_DEBUGCTL.
WARN in SVM if KVM_RUN_LOAD_DEBUGCTL is set, mostly to document that the lack of handling isn't a KVM bug (TDX already WARNs on any run_flag).
Lastly, explicitly reload GUEST_IA32_DEBUGCTL on a VM-Fail that is missed by KVM but detected by hardware, i.e. in nested_vmx_restore_host_state(). Doing so avoids the need to track host_debugctl on a per-VMCS basis, as GUEST_IA32_DEBUGCTL is unconditionally written by prepare_vmcs02() and load_vmcs12_host_state(). For the VM-Fail case, even though KVM won't have actually entered the guest, vcpu_enter_guest() will have run with vmcs02 active and thus could result in vmcs01 being run with a stale value.
--- arch/x86/include/asm/kvm_host.h | 7 +++++++ arch/x86/kvm/vmx/nested.c | 3 +++ arch/x86/kvm/vmx/vmx.c | 5 +++++ arch/x86/kvm/vmx/vmx.h | 15 ++++++++++++++- arch/x86/kvm/x86.c | 14 ++++++++++++-- 5 files changed, 41 insertions(+), 3 deletions(-)
arch/x86/include/asm/kvm_host.h +7 -0
@@ -1459,6 +1459,7 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical)enum kvm_x86_run_flags {KVM_RUN_FORCE_IMMEDIATE_EXIT =BIT (0 ),KVM_RUN_LOAD_GUEST_DR6 =BIT (1 ), +KVM_RUN_LOAD_DEBUGCTL =BIT (2 ), };struct kvm_x86_ops {
@@ -1484,6 +1485,12 @@ struct kvm_x86_ops {void (*vcpu_load)(struct kvm_vcpu *vcpu,int cpu);void (*vcpu_put)(struct kvm_vcpu *vcpu); +/* +* Mask of DEBUGCTL bits that are owned by the host, i.e. that need to +* match the host's value even while the guest is active. +*/ +const u64 HOST_OWNED_DEBUGCTL ; +void (*update_exception_bitmap)(struct kvm_vcpu *vcpu);int (*get_msr)(struct kvm_vcpu *vcpu,struct msr_data *msr);int (*set_msr)(struct kvm_vcpu *vcpu,struct msr_data *msr);
arch/x86/kvm/vmx/nested.c +3 -0
@@ -4627,6 +4627,9 @@ static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu)WARN_ON (kvm_set_dr (vcpu,7 ,vmcs_readl (GUEST_DR7 ))); } +/* Reload DEBUGCTL to ensure vmcs01 has a fresh FREEZE_IN_SMM value. */ +vmx_reload_guest_debugctl (vcpu); +/* * Note that calling vmx_set_{efer,cr0,cr4} is important as they * handle a variety of side effects to KVM's software model.
arch/x86/kvm/vmx/vmx.c +5 -0
@@ -7258,6 +7258,9 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)if (run_flags &KVM_RUN_LOAD_GUEST_DR6 )set_debugreg (vcpu->arch.dr6,6 ); +if (run_flags &KVM_RUN_LOAD_DEBUGCTL ) +vmx_reload_guest_debugctl (vcpu); +/* * Refresh vmcs.HOST_CR3 if necessary. This must be done immediately * prior to VM-Enter, as the kernel may load a new ASID (PCID) any time
@@ -8197,6 +8200,8 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { .vcpu_load = vmx_vcpu_load, .vcpu_put = vmx_vcpu_put, + .HOST_OWNED_DEBUGCTL = DEBUGCTLMSR_FREEZE_IN_SMM, + .update_exception_bitmap = vmx_update_exception_bitmap, .get_msr_feature = vmx_get_msr_feature, .get_msr = vmx_get_msr,
arch/x86/kvm/vmx/vmx.h +14 -1
@@ -447,12 +447,25 @@ bool vmx_is_valid_debugctl(struct kvm_vcpu *vcpu, u64 data, bool host_initiated)static inline void vmx_guest_debugctl_write (struct kvm_vcpu *vcpu,u64 val) { +WARN_ON_ONCE (val &DEBUGCTLMSR_FREEZE_IN_SMM ); + + val |= vcpu->arch.host_debugctl &DEBUGCTLMSR_FREEZE_IN_SMM ;vmcs_write64 (GUEST_IA32_DEBUGCTL , val); }static inline u64 vmx_guest_debugctl_read (void ) { -return vmcs_read64 (GUEST_IA32_DEBUGCTL ); +return vmcs_read64 (GUEST_IA32_DEBUGCTL ) & ~DEBUGCTLMSR_FREEZE_IN_SMM ; +} + +static inline void vmx_reload_guest_debugctl (struct kvm_vcpu *vcpu) +{ +u64 val =vmcs_read64 (GUEST_IA32_DEBUGCTL ); + +if (!((val ^ vcpu->arch.host_debugctl) &DEBUGCTLMSR_FREEZE_IN_SMM )) +return ; + +vmx_guest_debugctl_write (vcpu, val & ~DEBUGCTLMSR_FREEZE_IN_SMM ); }/*
arch/x86/kvm/x86.c +12 -2
@@ -10591,7 +10591,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)dm_request_for_irq_injection (vcpu) &&kvm_cpu_accept_dm_intr (vcpu);fastpath_t exit_fastpath; -u64 run_flags; +u64 run_flags, debug_ctl;bool req_immediate_exit = false;
@@ -10838,7 +10838,17 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)set_debugreg (0 ,7 ); } - vcpu->arch.host_debugctl =get_debugctlmsr (); +/* +* Refresh the host DEBUGCTL snapshot after disabling IRQs, as DEBUGCTL +* can be modified in IRQ context, e.g. via SMP function calls. Inform +* vendor code if any host-owned bits were changed, e.g. so that the +* value loaded into hardware while running the guest can be updated. +*/ + debug_ctl =get_debugctlmsr (); +if ((debug_ctl ^ vcpu->arch.host_debugctl) & kvm_x86_ops.HOST_OWNED_DEBUGCTL && + !vcpu->arch.guest_state_protected) + run_flags |=KVM_RUN_LOAD_DEBUGCTL ; + vcpu->arch.host_debugctl = debug_ctl;guest_timing_enter_irqoff ();
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 47/482 udp: also consider secpath when evaluating ipsec use for checksumming
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 1118aaa3b35157777890fffab91d8c1da841b20b ]
Commit b40c5f4fde22 ("udp: disable inner UDP checksum offloads in IPsec case") tried to fix checksumming in UFO when the packets are going through IPsec, so that we can't rely on offloads because the UDP header and payload will be encrypted.
But when doing a TCP test over VXLAN going through IPsec transport mode with GSO enabled (esp4_offload module loaded), I'm seeing broken UDP checksums on the encap after successful decryption.
The skbs get to udp4_ufo_fragment/__skb_udp_tunnel_segment via __dev_queue_xmit -> validate_xmit_skb -> skb_gso_segment and at this point we've already dropped the dst (unless the device sets IFF_XMIT_DST_RELEASE, which is not common), so need_ipsec is false and we proceed with checksum offload.
Make need_ipsec also check the secpath, which is not dropped on this callpath.
--- net/ipv4/udp_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/udp_offload.c +1 -1
@@ -60,7 +60,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb, remcsum = !!(skb_shinfo (skb)->gso_type &SKB_GSO_TUNNEL_REMCSUM ); skb->remcsum_offload = remcsum; - need_ipsec =skb_dst (skb) &&dst_xfrm (skb_dst (skb)); + need_ipsec = (skb_dst (skb) &&dst_xfrm (skb_dst (skb))) ||skb_sec_path (skb);/* Try to offload checksum if possible */ offload_csum = !!(need_csum && !need_ipsec &&
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 48/482 netfilter: ctnetlink: fix refcount leak on table dump
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit de788b2e6227462b6dcd0e07474e72c089008f74 ]
There is a reference count leak in ctnetlink_dump_table():
if (res < 0) {
nf_conntrack_get(&ct->ct_general); // HERE
cb->args[1] = (unsigned long)ct;
...While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone.
This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0.
This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever.
This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list.
One fix would to change this to:
if (res < 0) {
if (ct != last)
nf_conntrack_get(&ct->ct_general);But this reference counting isn't needed in the first place. We can just store a cookie value instead.
A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.
--- net/netfilter/nf_conntrack_netlink.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
net/netfilter/nf_conntrack_netlink.c +13 -11
@@ -859,8 +859,6 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item)static int ctnetlink_done (struct netlink_callback *cb) { -if (cb->args[1 ]) -nf_ct_put ((struct nf_conn *)cb->args[1 ]);kfree (cb->data);return 0 ; }
@@ -1175,19 +1173,26 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data)return 0 ; } +static unsigned long ctnetlink_get_id (const struct nf_conn *ct) +{ +unsigned long id =nf_ct_get_id (ct); + +return id ? id :1 ; +} +static int ctnetlink_dump_table (struct sk_buff *skb,struct netlink_callback *cb) {unsigned int flags = cb->data ?NLM_F_DUMP_FILTERED :0 ;struct net *net =sock_net (skb->sk); -struct nf_conn *ct, *last; +unsigned long last_id = cb->args[1 ];struct nf_conntrack_tuple_hash *h;struct hlist_nulls_node *n;struct nf_conn *nf_ct_evict[8 ]; +struct nf_conn *ct;int res, i;spinlock_t *lockp; - last = (struct nf_conn *)cb->args[1 ]; i =0 ;local_bh_disable ();
@@ -1224,7 +1229,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)continue ;if (cb->args[1 ]) { -if (ct != last) +if (ctnetlink_get_id (ct) != last_id)continue ; cb->args[1 ] =0 ; }
@@ -1237,8 +1242,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)NFNL_MSG_TYPE (cb->nlh->nlmsg_type), ct, true, flags);if (res <0 ) { -nf_conntrack_get (&ct->ct_general); - cb->args[1 ] = (unsigned long )ct; + cb->args[1 ] =ctnetlink_get_id (ct);spin_unlock (lockp); goto out; }
@@ -1251,12 +1255,10 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) } out:local_bh_enable (); -if (last) { +if (last_id) {/* nf ct hash resize happened, now clear the leftover. */ -if ((struct nf_conn *)cb->args[1 ] == last) +if (cb->args[1 ] == last_id) cb->args[1 ] =0 ; - -nf_ct_put (last); }while (i) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 49/482 hfs: fix slab-out-of-bounds in hfs_bnode_read()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit a431930c9bac518bf99d6b1da526a7f37ddee8d8 ]
This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.
--- fs/hfs/bnode.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+)
fs/hfs/bnode.c +92 -0
@@ -15,6 +15,48 @@#include "btree.h" +static inline +bool is_bnode_offset_valid (struct hfs_bnode *node,int off) +{ +bool is_valid = off < node->tree->node_size; + +if (!is_valid) { +pr_err ("requested invalid offset: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off); + } + +return is_valid; +} + +static inline +int check_and_correct_requested_length (struct hfs_bnode *node,int off,int len) +{ +unsigned int node_size; + +if (!is_bnode_offset_valid (node, off)) +return 0 ; + + node_size = node->tree->node_size; + +if ((off + len) > node_size) { +int new_len = (int )node_size - off; + +pr_err ("requested length has been corrected: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, " +"requested_len %d, corrected_len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len, new_len); + +return new_len; + } + +return len; +} +void hfs_bnode_read (struct hfs_bnode *node,void *buf,int off,int len) {struct page *page;
@@ -22,6 +64,20 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)int bytes_read;int bytes_to_read; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagenum = off >>PAGE_SHIFT ; off &= ~PAGE_MASK ;/* compute page offset for the first page */
@@ -80,6 +136,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len) {struct page *page; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; page = node->page[0 ];
@@ -104,6 +174,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len) {struct page *page; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; page = node->page[0 ];
@@ -119,6 +203,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,hfs_dbg (BNODE_MOD ,"copybytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (src_node, src, len); + len =check_and_correct_requested_length (dst_node, dst, len); + src += src_node->page_offset; dst += dst_node->page_offset; src_page = src_node->page[0 ];
@@ -136,6 +224,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)hfs_dbg (BNODE_MOD ,"movebytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (node, src, len); + len =check_and_correct_requested_length (node, dst, len); + src += node->page_offset; dst += node->page_offset; page = node->page[0 ];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/482 hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2 ]
The hfsplus_bnode_read() method can trigger the issue:
[ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] <TASK> [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] </TASK> [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x320 [ 174.883144][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.883595][ T9784] hfsplus_rmdir+0x106/0x1b0 [ 174.884004][ T9784] vfs_rmdir+0x206/0x690 [ 174.884379][ T9784] do_rmdir+0x2b7/0x390 [ 174.884751][ T9784] __x64_sys_rmdir+0xc5/0x110 [ 174.885167][ T9784] do_syscall_64+0xc9/0x480 [ 174.885568][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.886083][ T9784] [ 174.886293][ T9784] The buggy address belongs to the object at ffff88810b5fc600 [ 174.886293][ T9784] which belongs to the cache kmalloc-192 of size 192 [ 174.887507][ T9784] The buggy address is located 40 bytes to the right of [ 174.887507][ T9784] allocated 152-byte region [ffff88810b5fc600, ffff88810b5fc698) [ 174.888766][ T9784] [ 174.888976][ T9784] The buggy address belongs to the physical page: [ 174.889533][ T9784] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b5fc [ 174.890295][ T9784] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 174.890927][ T9784] page_type: f5(slab) [ 174.891284][ T9784] raw: 057ff00000000000 ffff88801b4423c0 ffffea000426dc80 dead000000000002 [ 174.892032][ T9784] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 174.892774][ T9784] page dumped because: kasan: bad access detected [ 174.893327][ T9784] page_owner tracks the page as allocated [ 174.893825][ T9784] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c00(GFP_NOIO|__GFP_NOWARN|__GFP_NO1 [ 174.895373][ T9784] post_alloc_hook+0x1c0/0x230 [ 174.895801][ T9784] get_page_from_freelist+0xdeb/0x3b30 [ 174.896284][ T9784] __alloc_frozen_pages_noprof+0x25c/0x2460 [ 174.896810][ T9784] alloc_pages_mpol+0x1fb/0x550 [ 174.897242][ T9784] new_slab+0x23b/0x340 [ 174.897614][ T9784] ___slab_alloc+0xd81/0x1960 [ 174.898028][ T9784] __slab_alloc.isra.0+0x56/0xb0 [ 174.898468][ T9784] __kmalloc_noprof+0x2b0/0x550 [ 174.898896][ T9784] usb_alloc_urb+0x73/0xa0 [ 174.899289][ T9784] usb_control_msg+0x1cb/0x4a0 [ 174.899718][ T9784] usb_get_string+0xab/0x1a0 [ 174.900133][ T9784] usb_string_sub+0x107/0x3c0 [ 174.900549][ T9784] usb_string+0x307/0x670 [ 174.900933][ T9784] usb_cache_string+0x80/0x150 [ 174.901355][ T9784] usb_new_device+0x1d0/0x19d0 [ 174.901786][ T9784] register_root_hub+0x299/0x730 [ 174.902231][ T9784] page last free pid 10 tgid 10 stack trace: [ 174.902757][ T9784] __free_frozen_pages+0x80c/0x1250 [ 174.903217][ T9784] vfree.part.0+0x12b/0xab0 [ 174.903645][ T9784] delayed_vfree_work+0x93/0xd0 [ 174.904073][ T9784] process_one_work+0x9b5/0x1b80 [ 174.904519][ T9784] worker_thread+0x630/0xe60 [ 174.904927][ T9784] kthread+0x3a8/0x770 [ 174.905291][ T9784] ret_from_fork+0x517/0x6e0 [ 174.905709][ T9784] ret_from_fork_asm+0x1a/0x30 [ 174.906128][ T9784] [ 174.906338][ T9784] Memory state around the buggy address: [ 174.906828][ T9784] ffff88810b5fc580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.907528][ T9784] ffff88810b5fc600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 174.908222][ T9784] >ffff88810b5fc680: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 174.908917][ T9784] ^ [ 174.909481][ T9784] ffff88810b5fc700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 174.910432][ T9784] ffff88810b5fc780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.911401][ T9784] ==================================================================
The reason of the issue that code doesn't check the correctness of the requested offset and length. As a result, incorrect value of offset or/and length could result in access out of allocated memory.
This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfsplus_bnode_read(), hfsplus_bnode_write(), hfsplus_bnode_clear(), hfsplus_bnode_copy(), and hfsplus_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.
--- fs/hfsplus/bnode.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+)
fs/hfsplus/bnode.c +92 -0
@@ -18,12 +18,68 @@#include "hfsplus_fs.h" #include "hfsplus_raw.h" +static inline +bool is_bnode_offset_valid (struct hfs_bnode *node,int off) +{ +bool is_valid = off < node->tree->node_size; + +if (!is_valid) { +pr_err ("requested invalid offset: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off); + } + +return is_valid; +} + +static inline +int check_and_correct_requested_length (struct hfs_bnode *node,int off,int len) +{ +unsigned int node_size; + +if (!is_bnode_offset_valid (node, off)) +return 0 ; + + node_size = node->tree->node_size; + +if ((off + len) > node_size) { +int new_len = (int )node_size - off; + +pr_err ("requested length has been corrected: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, " +"requested_len %d, corrected_len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len, new_len); + +return new_len; + } + +return len; +} +/* Copy a specified range of bytes from the raw data of a node */ void hfs_bnode_read (struct hfs_bnode *node,void *buf,int off,int len) {struct page **pagep;int l; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); off &= ~PAGE_MASK ;
@@ -81,6 +137,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)struct page **pagep;int l; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); off &= ~PAGE_MASK ;
@@ -109,6 +179,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len)struct page **pagep;int l; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); off &= ~PAGE_MASK ;
@@ -133,6 +217,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,hfs_dbg (BNODE_MOD ,"copybytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (src_node, src, len); + len =check_and_correct_requested_length (dst_node, dst, len); + src += src_node->page_offset; dst += dst_node->page_offset; src_page = src_node->page + (src >>PAGE_SHIFT );
@@ -187,6 +275,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)hfs_dbg (BNODE_MOD ,"movebytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (node, src, len); + len =check_and_correct_requested_length (node, dst, len); + src += node->page_offset; dst += node->page_offset;if (dst > src) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/482 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 94458781aee6045bd3d0ad4b80b02886b9e2219b ]
The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc():
[ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] <TASK> [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.152580][ T9805] [ 667.152798][ T9805] The buggy address belongs to the physical page: [ 667.153373][ T9805] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25928 [ 667.154157][ T9805] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 667.154916][ T9805] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 667.155631][ T9805] page_type: f5(slab) [ 667.155997][ T9805] raw: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001 [ 667.156770][ T9805] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 667.157536][ T9805] head: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001 [ 667.158317][ T9805] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 667.159088][ T9805] head: 00fff00000000003 ffffea0000964a01 00000000ffffffff 00000000ffffffff [ 667.159865][ T9805] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 667.160643][ T9805] page dumped because: kasan: bad access detected [ 667.161216][ T9805] page_owner tracks the page as allocated [ 667.161732][ T9805] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN9 [ 667.163566][ T9805] post_alloc_hook+0x1c0/0x230 [ 667.164003][ T9805] get_page_from_freelist+0xdeb/0x3b30 [ 667.164503][ T9805] __alloc_frozen_pages_noprof+0x25c/0x2460 [ 667.165040][ T9805] alloc_pages_mpol+0x1fb/0x550 [ 667.165489][ T9805] new_slab+0x23b/0x340 [ 667.165872][ T9805] ___slab_alloc+0xd81/0x1960 [ 667.166313][ T9805] __slab_alloc.isra.0+0x56/0xb0 [ 667.166767][ T9805] __kmalloc_cache_noprof+0x255/0x3e0 [ 667.167255][ T9805] psi_cgroup_alloc+0x52/0x2d0 [ 667.167693][ T9805] cgroup_mkdir+0x694/0x1210 [ 667.168118][ T9805] kernfs_iop_mkdir+0x111/0x190 [ 667.168568][ T9805] vfs_mkdir+0x59b/0x8d0 [ 667.168956][ T9805] do_mkdirat+0x2ed/0x3d0 [ 667.169353][ T9805] __x64_sys_mkdir+0xef/0x140 [ 667.169784][ T9805] do_syscall_64+0xc9/0x480 [ 667.170195][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.170730][ T9805] page last free pid 1257 tgid 1257 stack trace: [ 667.171304][ T9805] __free_frozen_pages+0x80c/0x1250 [ 667.171770][ T9805] vfree.part.0+0x12b/0xab0 [ 667.172182][ T9805] delayed_vfree_work+0x93/0xd0 [ 667.172612][ T9805] process_one_work+0x9b5/0x1b80 [ 667.173067][ T9805] worker_thread+0x630/0xe60 [ 667.173486][ T9805] kthread+0x3a8/0x770 [ 667.173857][ T9805] ret_from_fork+0x517/0x6e0 [ 667.174278][ T9805] ret_from_fork_asm+0x1a/0x30 [ 667.174703][ T9805] [ 667.174917][ T9805] Memory state around the buggy address: [ 667.175411][ T9805] ffff88802592f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 667.176114][ T9805] ffff88802592f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 667.176830][ T9805] >ffff88802592f400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.177547][ T9805] ^ [ 667.177933][ T9805] ffff88802592f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.178640][ T9805] ffff88802592f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.179350][ T9805] ==================================================================
The hfsplus_uni2asc() method operates by struct hfsplus_unistr:
struct hfsplus_unistr {
__be16 length;
hfsplus_unichr unicode[HFSPLUS_MAX_STRLEN];
} __packed;where HFSPLUS_MAX_STRLEN is 255 bytes. The issue happens if length of the structure instance has value bigger than 255 (for example, 65283). In such case, pointer on unicode buffer is going beyond of the allocated memory.
The patch fixes the issue by checking the length value of hfsplus_unistr instance and using 255 value in the case if length value is bigger than HFSPLUS_MAX_STRLEN. Potential reason of such situation could be a corruption of Catalog File b-tree's node.
--- fs/hfsplus/unicode.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/hfsplus/unicode.c +7 -0
@@ -132,7 +132,14 @@ int hfsplus_uni2asc(struct super_block *sb, op = astr; ip = ustr->unicode; + ustrlen =be16_to_cpu (ustr->length); +if (ustrlen >HFSPLUS_MAX_STRLEN ) { + ustrlen =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (ustr->length), ustrlen); + } + len = *len_p; ce1 =NULL ; compose = !test_bit (HFSPLUS_SB_NODECOMPOSE , &HFSPLUS_SB (sb)->flags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/482 hfsplus: dont use BUG_ON() in hfsplus_create_attributes_file()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit c7c6363ca186747ebc2df10c8a1a51e66e0e32d9 ]
When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.
--- fs/hfsplus/xattr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/hfsplus/xattr.c +5 -1
@@ -172,7 +172,11 @@ static int hfsplus_create_attributes_file(struct super_block *sb)return PTR_ERR (attr_file); } -BUG_ON (i_size_read (attr_file) !=0 ); +if (i_size_read (attr_file) !=0 ) { + err = -EIO ; +pr_err ("detected inconsistent attributes file, running fsck.hfsplus is recommended.\n" ); + goto end_attr_file_creation; + } hip =HFSPLUS_I (attr_file);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/482 arm64: Handle KCOV __init vs inline mismatches
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 65c430906efffee9bd7551d474f01a6b1197df90 ]
GCC appears to have kind of fragile inlining heuristics, in the sense that it can change whether or not it inlines something based on optimizations. It looks like the kcov instrumentation being added (or in this case, removed) from a function changes the optimization results, and some functions marked "inline" are _not_ inlined. In that case, we end up with __init code calling a function not marked __init, and we get the build warnings I'm trying to eliminate in the coming patch that adds __no_sanitize_coverage to __init functions:
WARNING: modpost: vmlinux: section mismatch in reference: acpi_get_enable_method+0x1c (section: .text.unlikely) -> acpi_psci_present (section: .init.text)
This problem is somewhat fragile (though using either __always_inline or __init will deterministically solve it), but we've tripped over this before with GCC and the solution has usually been to just use __always_inline and move on.
For arm64 this requires forcing one ACPI function to be inlined with __always_inline.
--- arch/arm64/include/asm/acpi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/acpi.h +1 -1
@@ -128,7 +128,7 @@ acpi_set_mailbox_entry(int cpu, struct acpi_madt_generic_interrupt *processor) {}#endif -static inline const char *acpi_get_enable_method (int cpu) +static __always_inline const char *acpi_get_enable_method(int cpu) {if (acpi_psci_present ())return "psci" ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/482 smb/server: avoid deadlock when linking with ReplaceIfExists
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694 ]
If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen.
ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock.
This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.
--- fs/smb/server/smb2pdu.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
fs/smb/server/smb2pdu.c +4 -12
@@ -5648,7 +5648,6 @@ static int smb2_create_link(struct ksmbd_work *work, { char *link_name = NULL, *target_name = NULL, *pathname = NULL; struct path path, parent_path; - bool file_present = false; int rc; if (buf_len < (u64)sizeof(struct smb2_file_link_info) +
@@ -5681,11 +5680,8 @@ static int smb2_create_link(struct ksmbd_work *work,if (rc) {if (rc != -ENOENT ) goto out; - }else - file_present = true; - -if (file_info->ReplaceIfExists) { -if (file_present) { + }else { +if (file_info->ReplaceIfExists) { rc =ksmbd_vfs_remove_file (work, &path);if (rc) { rc = -EINVAL ;
@@ -5693,21 +5689,17 @@ static int smb2_create_link(struct ksmbd_work *work, link_name); goto out; } - } - }else { -if (file_present) { + }else { rc = -EEXIST ;ksmbd_debug (SMB ,"link already exists\n" ); goto out; } +ksmbd_vfs_kern_path_unlock (&parent_path, &path); } - rc =ksmbd_vfs_link (work, target_name, link_name);if (rc) rc = -EINVAL ; out: -if (file_present) -ksmbd_vfs_kern_path_unlock (&parent_path, &path);if (!IS_ERR (link_name))kfree (link_name);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/482 udf: Verify partition map count
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 1a11201668e8635602577dcf06f2e96c591d8819 ]
Verify that number of partition maps isn't insanely high which can lead to large allocation in udf_sb_alloc_partition_maps(). All partition maps have to fit in the LVD which is in a single block.
--- fs/udf/super.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/udf/super.c +11 -2
@@ -1410,7 +1410,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,struct genericPartitionMap *gpm;uint16_t ident;struct buffer_head *bh; -unsigned int table_len; +unsigned int table_len, part_map_count;int ret; bh =udf_read_tagged (sb, block, block, &ident);
@@ -1431,7 +1431,16 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, "logical volume");if (ret) goto out_bh; - ret =udf_sb_alloc_partition_maps (sb,le32_to_cpu (lvd->numPartitionMaps)); + + part_map_count =le32_to_cpu (lvd->numPartitionMaps); +if (part_map_count > table_len /sizeof (struct genericPartitionMap1 )) { +udf_err (sb,"error loading logical volume descriptor: " +"Too many partition maps (%u > %u)\n" , part_map_count, + table_len / (unsigned )sizeof (struct genericPartitionMap1 )); + ret = -EIO ; + goto out_bh; + } + ret =udf_sb_alloc_partition_maps (sb, part_map_count);if (ret) goto out_bh;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/482 drbd: add missing kref_get in handle_write_conflicts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Newman <[email protected]>
[ Upstream commit 00c9c9628b49e368d140cfa61d7df9b8922ec2a8 ]
With two-primaries enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed.
In handling "superseeded" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms.
Relevance: No one should use DRBD as a random data generator, and apparently all users of "two-primaries" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node.
Which means that other than for "test cases",
this code path is never taken in real life.
FYI, in DRBD 9, things are handled differently nowadays. We still detect "write conflicts", but no longer try to be smart about them.
We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault.
--- drivers/block/drbd/drbd_receiver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/block/drbd/drbd_receiver.c +5 -1
@@ -2478,7 +2478,11 @@ static int handle_write_conflicts(struct drbd_device *device, peer_req->w.cb = superseded ? e_send_superseded : e_send_retry_write;list_add_tail (&peer_req->w.list, &device->done_ee); -queue_work (connection->ack_sender, &peer_req->peer_device->send_acks_work); +/* put is in drbd_send_acks_wf() */ +kref_get (&device->kref); +if (!queue_work (connection->ack_sender, + &peer_req->peer_device->send_acks_work)) +kref_put (&device->kref, drbd_destroy_device); err = -ENOENT ; goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/482 hfs: fix not erasing deleted b-tree node issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit d3ed6d6981f4756f145766753c872482bc3b28d3 ]
The generic/001 test of xfstests suite fails and corrupts the HFS volume:
sudo ./check generic/001
FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2> MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/001 32s ... _check_generic_filesystem: filesystem on /dev/loop50 is inconsistent (see /home/slavad/XFSTESTS-2/xfstests-dev/results//generic/001.full for details)
Ran: generic/001
Failures: generic/001
Failed 1 of 1 tests
fsck.hfs -d -n ./test-image.bin
** ./test-image.bin (NO WRITE)
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking HFS volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
Unused node is not erased (node = 2)
Unused node is not erased (node = 4)
<skipped>
Unused node is not erased (node = 253)
Unused node is not erased (node = 254)
Unused node is not erased (node = 255)
Unused node is not erased (node = 256)
** Checking catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
CBTStat = 0x0004 CatStat = 0x00000000 ** The volume untitled was found corrupt and needs to be repaired. volume type is HFS primary MDB is at block 2 0x02 alternate MDB is at block 20971518 0x13ffffe primary VHB is at block 0 0x00 alternate VHB is at block 0 0x00 sector size = 512 0x200 VolumeObject flags = 0x19 total sectors for volume = 20971520 0x1400000 total sectors for embedded volume = 0 0x00
This patch adds logic of clearing the deleted b-tree node.
sudo ./check generic/001
FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2025 MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/001 9s ... 32s
Ran: generic/001
Passed all 1 tests
fsck.hfs -d -n ./test-image.bin
** ./test-image.bin (NO WRITE)
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking HFS volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
** Checking catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
** The volume untitled appears to be OK.
--- fs/hfs/bnode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfs/bnode.c +1 -0
@@ -574,6 +574,7 @@ void hfs_bnode_put(struct hfs_bnode *node)if (test_bit (HFS_BNODE_DELETED , &node->flags)) {hfs_bnode_unhash (node);spin_unlock (&tree->hash_lock); +hfs_bnode_clear (node,0 , tree->node_size);hfs_bmap_free (node);hfs_bnode_free (node);return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/482 better lockdep annotations for simple_recursive_removal()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 2a8061ee5e41034eb14170ec4517b5583dbeff9f ]
We want a class that nests outside of I_MUTEX_NORMAL (for the sake of callbacks that might want to lock the victim) and inside I_MUTEX_PARENT (so that a variant of that could be used with parent of the victim held locked by the caller).
In reality, simple_recursive_removal()
* never holds two locks at once
* holds the lock on parent of dentry passed to callback
* is used only on the trees with fixed topology, so the depths
are not changing.
So the locking order is actually fine.
AFAICS, the best solution is to assign I_MUTEX_CHILD to the locks grabbed by that thing.
--- fs/libfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/libfs.c +2 -2
@@ -274,7 +274,7 @@ void simple_recursive_removal(struct dentry *dentry,struct dentry *victim =NULL , *child;struct inode *inode = this->d_inode; -inode_lock (inode); +inode_lock_nested (inode,I_MUTEX_CHILD );if (d_is_dir (this)) inode->i_flags |=S_DEAD ;while ((child =find_next_child (this, victim)) ==NULL ) {
@@ -286,7 +286,7 @@ void simple_recursive_removal(struct dentry *dentry, victim = this; this = this->d_parent; inode = this->d_inode; -inode_lock (inode); +inode_lock_nested (inode,I_MUTEX_CHILD );if (simple_positive (victim)) {d_invalidate (victim);// avoid lost mounts if (d_is_dir (victim))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/482 ata: libata-sata: Disallow changing LPM state if not supported
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 413e800cadbf67550d76c77c230b2ecd96bce83a ]
Modify ata_scsi_lpm_store() to return an error if a user attempts to set a link power management policy for a port that does not support LPM, that is, ports flagged with ATA_FLAG_NO_LPM.
--- drivers/ata/libata-sata.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/ata/libata-sata.c +5 -0
@@ -812,6 +812,11 @@ static ssize_t ata_scsi_lpm_store(struct device *device,spin_lock_irqsave (ap->lock, flags); +if (ap->flags &ATA_FLAG_NO_LPM ) { + count = -EOPNOTSUPP ; + goto out_unlock; + } +ata_for_each_link (link, ap,EDGE ) {ata_for_each_dev (dev, &ap->link,ENABLED ) {if (dev->horkage &ATA_HORKAGE_NOLPM ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/482 fs/ntfs3: Add sanity check for file name
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit e841ecb139339602bc1853f5f09daa5d1ea920a2 ]
The length of the file name should be smaller than the directory entry size.
--- fs/ntfs3/dir.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ntfs3/dir.c +3 -0
@@ -304,6 +304,9 @@ static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi,if (sbi->options->nohidden && (fname->dup.fa &FILE_ATTRIBUTE_HIDDEN ))return true; +if (fname->name_len +sizeof (struct NTFS_DE ) >le16_to_cpu (e->size)) +return true; + name_len =ntfs_utf16_to_nls (sbi, fname->name, fname->name_len, name,PATH_MAX );if (name_len <=0 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/482 fs/ntfs3: correctly create symlink for relative path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Zhang <[email protected]>
[ Upstream commit b1e9d89408f402858c00103f9831b25ffa0994d3 ]
After applying this patch, could correctly create symlink:
ln -s "relative/path/to/file" symlink
[[email protected]: added cpu_to_le32 macro to rs->Flags assignment]
--- fs/ntfs3/inode.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
fs/ntfs3/inode.c +18 -13
@@ -1114,10 +1114,10 @@ int inode_write_data(struct inode *inode, const void *data, size_t bytes)* Number of bytes for REPARSE_DATA_BUFFER(IO_REPARSE_TAG_SYMLINK) * for unicode string of @uni_len length. */ -static inline u32 ntfs_reparse_bytes (u32 uni_len) +static inline u32 ntfs_reparse_bytes (u32 uni_len,bool is_absolute) {/* Header + unicode string + decorated unicode string. */ -return sizeof (short ) * (2 * uni_len +4 ) + +return sizeof (short ) * (2 * uni_len + (is_absolute ?4 :0 )) + offsetof(struct REPARSE_DATA_BUFFER , SymbolicLinkReparseBuffer.PathBuffer); }
@@ -1130,8 +1130,11 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,struct REPARSE_DATA_BUFFER *rp;__le16 *rp_name;typeof (rp->SymbolicLinkReparseBuffer) *rs; +bool is_absolute; - rp =kzalloc (ntfs_reparse_bytes (2 * size +2 ),GFP_NOFS ); + is_absolute = (strlen (symname) >1 && symname[1 ] ==':' ); + + rp =kzalloc (ntfs_reparse_bytes (2 * size +2 , is_absolute),GFP_NOFS );if (!rp)return ERR_PTR (-ENOMEM );
@@ -1146,7 +1149,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname, goto out;/* err = the length of unicode name of symlink. */ - *nsize =ntfs_reparse_bytes (err); + *nsize =ntfs_reparse_bytes (err, is_absolute);if (*nsize > sbi->reparse.max_size) { err = -EFBIG ;
@@ -1166,7 +1169,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,/* PrintName + SubstituteName. */ rs->SubstituteNameOffset =cpu_to_le16 (sizeof (short ) * err); - rs->SubstituteNameLength =cpu_to_le16 (sizeof (short ) * err +8 ); + rs->SubstituteNameLength =cpu_to_le16 (sizeof (short ) * err + (is_absolute ?8 :0 )); rs->PrintNameLength = rs->SubstituteNameOffset;/*
@@ -1174,16 +1177,18 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,* parse this path. * 0-absolute path 1- relative path (SYMLINK_FLAG_RELATIVE). */ - rs->Flags =0 ; + rs->Flags =cpu_to_le32 (is_absolute ?0 :SYMLINK_FLAG_RELATIVE ); -memmove (rp_name + err +4 , rp_name,sizeof (short ) * err); +memmove (rp_name + err + (is_absolute ?4 :0 ), rp_name,sizeof (short ) * err); -/* Decorate SubstituteName. */ - rp_name += err; - rp_name[0 ] =cpu_to_le16 ('\\' ); - rp_name[1 ] =cpu_to_le16 ('?' ); - rp_name[2 ] =cpu_to_le16 ('?' ); - rp_name[3 ] =cpu_to_le16 ('\\' ); +if (is_absolute) { +/* Decorate SubstituteName. */ + rp_name += err; + rp_name[0 ] =cpu_to_le16 ('\\' ); + rp_name[1 ] =cpu_to_le16 ('?' ); + rp_name[2 ] =cpu_to_le16 ('?' ); + rp_name[3 ] =cpu_to_le16 ('\\' ); + }return rp; out:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/482 ext2: Handle fiemap on empty files to prevent EINVAL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Gao <[email protected]>
[ Upstream commit a099b09a3342a0b28ea330e405501b5b4d0424b4 ]
Previously, ext2_fiemap would unconditionally apply "len = min_t(u64, len, i_size_read(inode));", When inode->i_size was 0 (for an empty file), this would reduce the requested len to 0. Passing len = 0 to iomap_fiemap could then result in an -EINVAL error, even for valid queries on empty files.
--- fs/ext2/inode.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/ext2/inode.c +11 -1
@@ -860,9 +860,19 @@ int ext2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, u64 start, u64 len) { int ret; +loff_t i_size;inode_lock (inode); - len =min_t (u64, len,i_size_read (inode)); + i_size =i_size_read (inode); +/* +* iomap_fiemap() returns EINVAL for 0 length. Make sure we don't trim +* length to 0 but still trim the range as much as possible since +* ext2_get_blocks() iterates unmapped space block by block which is +* slow. +*/ +if (i_size ==0 ) + i_size =1 ; + len =min_t (u64, len, i_size); ret =iomap_fiemap (inode, fieinfo, start, len, &ext2_iomap_ops);inode_unlock (inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/482 fix locking in efi_secret_unlink()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 2c58d42de71f9c73e40afacc9d062892d2cc8862 ]
We used to need securityfs_remove() to undo simple_pin_fs() done when the file had been created and to drop the second extra reference taken at the same time. Now that neither is needed (or done by securityfs_remove()), we can simply call simple_unlink() and be done with that - the broken games with locking had been there only for the sake of securityfs_remove().
--- drivers/virt/coco/efi_secret/efi_secret.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-)
drivers/virt/coco/efi_secret/efi_secret.c +1 -9
@@ -136,15 +136,7 @@ static int efi_secret_unlink(struct inode *dir, struct dentry *dentry)if (s->fs_files[i] == dentry) s->fs_files[i] =NULL ; -/* -* securityfs_remove tries to lock the directory's inode, but we reach -* the unlink callback when it's already locked -*/ -inode_unlock (dir); -securityfs_remove (dentry); -inode_lock (dir); - -return 0 ; +return simple_unlink (inode, dentry); }static const struct inode_operations efi_secret_dir_inode_operations = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/482 securityfs: dont pin dentries twice, once is enough...
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 27cd1bf1240d482e4f02ca4f9812e748f3106e4f ]
incidentally, securityfs_recursive_remove() is broken without that - it leaks dentries, since simple_recursive_removal() does not expect anything of that sort. It could be worked around by dput() in remove_one() callback, but it's easier to just drop that double-get stuff.
--- security/inode.c | 2 -- 1 file changed, 2 deletions(-)
security/inode.c +0 -2
@@ -159,7 +159,6 @@ static struct dentry *securityfs_create_dentry(const char *name, umode_t mode, inode->i_fop = fops; }d_instantiate (dentry, inode); -dget (dentry);inode_unlock (dir);return dentry;
@@ -306,7 +305,6 @@ void securityfs_remove(struct dentry *dentry)simple_rmdir (dir, dentry); elsesimple_unlink (dir ,dentry ); -dput (dentry); }inode_unlock (dir);simple_release_fs (&mount, &mount_count);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/482 usb: xhci: print xhci->xhc_state when queue_command failed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 7919407eca2ef562fa6c98c41cfdf6f6cdd69d92 ]
When encounters some errors like these:xhci_hcd 0000:4a:00.2: xHCI dying or halted, can't queue_command xhci_hcd 0000:4a:00.2: FIXME: allocate a command ring segment usb usb5-port6: couldn't allocate usb_device
It's hard to know whether xhc_state is dying or halted. So it's better to print xhc_state's value which can help locate the resaon of the bug.
--- drivers/usb/host/xhci-ring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-ring.c +2 -1
@@ -4421,7 +4421,8 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,if ((xhci->xhc_state &XHCI_STATE_DYING ) || (xhci->xhc_state &XHCI_STATE_HALTED )) { -xhci_dbg (xhci,"xHCI dying or halted, can't queue_command\n" ); +xhci_dbg (xhci,"xHCI dying or halted, can't queue_command. state: 0x%x\n" , + xhci->xhc_state);return -ESHUTDOWN ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/482 cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashant Malani <[email protected]>
[ Upstream commit 0a1416a49e63c320f6e6c1c8d07e1b58c0d4a3f3 ]
AMU counters on certain CPPC-based platforms tend to yield inaccurate delivered performance measurements on systems that are idle/mostly idle. This results in an inaccurate frequency being stored by cpufreq in its policy structure when the CPU is brought online. [1]
Consequently, if the userspace governor tries to set the frequency to a new value, there is a possibility that it would be the erroneous value stored earlier. In such a scenario, cpufreq would assume that the requested frequency has already been set and return early, resulting in the correct/new frequency request never making it to the hardware.
Since the operating frequency is liable to this sort of inconsistency, mark the CPPC driver with CPUFREQ_NEED_UPDATE_LIMITS so that it is always invoked when a target frequency update is requested.
--- drivers/cpufreq/cppc_cpufreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/cppc_cpufreq.c +1 -1
@@ -809,7 +809,7 @@ static struct freq_attr *cppc_cpufreq_attr[] = { };static struct cpufreq_driver cppc_cpufreq_driver = { - .flags =CPUFREQ_CONST_LOOPS , + .flags =CPUFREQ_CONST_LOOPS |CPUFREQ_NEED_UPDATE_LIMITS , .verify = cppc_verify_policy, .target = cppc_cpufreq_set_target, .get = cppc_cpufreq_get_rate,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/482 selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cynthia Huang <[email protected]>
[ Upstream commit 04850819c65c8242072818655d4341e70ae998b5 ]
The kernel does not provide sys_futex() on 32-bit architectures that do not support 32-bit time representations, such as riscv32.
As a result, glibc cannot define SYS_futex, causing compilation failures in tests that rely on this syscall. Define SYS_futex as SYS_futex_time64 in such cases to ensure successful compilation and compatibility.
--- tools/testing/selftests/futex/include/futextest.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/testing/selftests/futex/include/futextest.h +11 -0
@@ -47,6 +47,17 @@ typedef volatile u_int32_t futex_t; FUTEX_PRIVATE_FLAG)#endif +/* +* SYS_futex is expected from system C library, in glibc some 32-bit +* architectures (e.g. RV32) are using 64-bit time_t, therefore it doesn't have +* SYS_futex defined but just SYS_futex_time64. Define SYS_futex as +* SYS_futex_time64 in this situation to ensure the compilation and the +* compatibility. +*/ +#if !defined(SYS_futex) && defined(SYS_futex_time64) +#define SYS_futex SYS_futex_time64 +#endif +/** * futex() - SYS_futex syscall wrapper * @uaddr: address of first futex
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/482 usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benson Leung <[email protected]>
[ Upstream commit af833e7f7db3cf4c82f063668e1b52297a30ec18 ]
ucsi_psy_get_current_max would return 0mA as the maximum current if UCSI detected a BC or a Default USB Power sporce.
The comment in this function is true that we can't tell the difference between DCP/CDP or SDP chargers, but we can guarantee that at least 1-unit of USB 1.1/2.0 power is available, which is 100mA, which is a better fallback value than 0, which causes some userspaces, including the ChromeOS power manager, to regard this as a power source that is not providing any power.
In reality, 100mA is guaranteed from all sources in these classes.
--- drivers/usb/typec/ucsi/psy.c | 2 +- drivers/usb/typec/ucsi/ucsi.h | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/usb/typec/ucsi/psy.c +1 -1
@@ -163,7 +163,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,case UCSI_CONSTAT_PWR_OPMODE_DEFAULT :/* UCSI can't tell b/w DCP/CDP or USB2/3x1/3x2 SDP chargers */ default : - val->intval =0 ; + val->intval =UCSI_TYPEC_DEFAULT_CURRENT *1000 ;break ; }return 0 ;
drivers/usb/typec/ucsi/ucsi.h +4 -3
@@ -313,9 +313,10 @@ struct ucsi {#define UCSI_MAX_SVID 5#define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6) -#define UCSI_TYPEC_VSAFE5V 5000 -#define UCSI_TYPEC_1_5_CURRENT 1500 -#define UCSI_TYPEC_3_0_CURRENT 3000 +#define UCSI_TYPEC_VSAFE5V 5000 +#define UCSI_TYPEC_DEFAULT_CURRENT 100 +#define UCSI_TYPEC_1_5_CURRENT 1500 +#define UCSI_TYPEC_3_0_CURRENT 3000struct ucsi_connector {int num;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/482 usb: xhci: Avoid showing warnings for dying controller
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 65fc0fc137b5da3ee1f4ca4f61050fcb203d7582 ]
When a USB4 dock is unplugged from a system it won't respond to ring events. The PCI core handles the surprise removal event and notifies all PCI drivers. The XHCI PCI driver sets a flag that the device is being removed, and when the device stops responding a flag is also added to indicate it's dying.
When that flag is set don't bother to show warnings about a missing controller.
--- drivers/usb/host/xhci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +4 -2
@@ -119,7 +119,8 @@ int xhci_halt(struct xhci_hcd *xhci) ret =xhci_handshake (&xhci->op_regs->status,STS_HALT ,STS_HALT ,XHCI_MAX_HALT_USEC );if (ret) { -xhci_warn (xhci,"Host halt failed, %d\n" , ret); +if (!(xhci->xhc_state &XHCI_STATE_DYING )) +xhci_warn (xhci,"Host halt failed, %d\n" , ret);return ret; }
@@ -178,7 +179,8 @@ int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) state =readl (&xhci->op_regs->status);if (state == ~(u32 )0 ) { -xhci_warn (xhci,"Host not accessible, reset failed.\n" ); +if (!(xhci->xhc_state &XHCI_STATE_DYING )) +xhci_warn (xhci,"Host not accessible, reset failed.\n" );return -ENODEV ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/482 usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Chen <[email protected]>
[ Upstream commit f72b9aa821a2bfe4b6dfec4be19f264d0673b008 ]
There is a subtle contradiction between sections of the xHCI 1.2 spec regarding the initialization of Input Endpoint Context fields. Section 4.8.2 ("Endpoint Context Initialization") states that all fields should be initialized to 0. However, Section 6.2.3 ("Endpoint Context", p.453) specifies that the Average TRB Length (avg_trb_len) field shall be greater than 0, and explicitly notes (p.454): "Software shall set Average TRB Length to '8' for control endpoints."
Strictly setting all fields to 0 during initialization conflicts with the specific recommendation for control endpoints. In practice, setting avg_trb_len = 0 is not meaningful for the hardware/firmware, as the value is used for bandwidth calculation.
Motivation: Our company is developing a custom Virtual xHC hardware platform that strictly follows the xHCI spec and its recommendations. During validation, we observed that enumeration fails and a parameter error (TRB Completion Code = 5) is reported if avg_trb_len for EP0 is not set to 8 as recommended by Section 6.2.3. This demonstrates the importance of assigning a meaningful, non-zero value to avg_trb_len, even in virtualized or emulated environments.
This patch explicitly sets avg_trb_len to 8 for EP0 in xhci_setup_addressable_virt_dev(), as recommended in Section 6.2.3, to prevent potential issues with xHCI host controllers that enforce the spec strictly.
--- drivers/usb/host/xhci-mem.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/host/xhci-mem.c +2 -0
@@ -1200,6 +1200,8 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud ep0_ctx->deq =cpu_to_le64 (dev->eps[0 ].ring->first_seg->dma | dev->eps[0 ].ring->cycle_state); + ep0_ctx->tx_info =cpu_to_le32 (EP_AVG_TRB_LENGTH (8 )); +trace_xhci_setup_addressable_virt_device (dev);/* Steps 7 and 8 were done in xhci_alloc_virt_device() */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/482 usb: xhci: Avoid showing errors during surprise removal
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 4b9c60e440525b729ac5f071e00bcee12e0a7e84 ]
When a USB4 dock is unplugged from a system it won't respond to ring events. The PCI core handles the surprise removal event and notifies all PCI drivers. The XHCI PCI driver sets a flag that the device is being removed as well.
When that flag is set don't show messages in the cleanup path for marking the controller dead.
--- drivers/usb/host/xhci-ring.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-ring.c +5 -2
@@ -1289,12 +1289,15 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci,*/ void xhci_hc_died (struct xhci_hcd *xhci) { +bool notify;int i, j;if (xhci->xhc_state &XHCI_STATE_DYING )return ; -xhci_err (xhci,"xHCI host controller not responding, assume dead\n" ); + notify = !(xhci->xhc_state &XHCI_STATE_REMOVING ); +if (notify) +xhci_err (xhci,"xHCI host controller not responding, assume dead\n" ); xhci->xhc_state |=XHCI_STATE_DYING ;xhci_cleanup_command_queue (xhci);
@@ -1308,7 +1311,7 @@ void xhci_hc_died(struct xhci_hcd *xhci) }/* inform usb core hc died if PCI remove isn't already handling it */ -if (!(xhci->xhc_state &XHCI_STATE_REMOVING )) +if (notify)usb_hc_died (xhci_to_hcd (xhci)); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/482 remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiago De Franco <[email protected]>
[ Upstream commit 496deecb020d14ba89ba7084fbc3024f91687023 ]
For the i.MX8X and i.MX8 family SoCs, when the Cortex-M core is powered up and started by the Cortex-A core using the bootloader (e.g., via the U-Boot bootaux command), both M-core and Linux run within the same SCFW (System Controller Firmware) partition. With that, Linux has permission to control the M-core.
But once the M-core is started by the bootloader, the SCFW automatically enables its clock and sets the clock rate. If Linux later attempts to enable the same clock via clk_prepare_enable(), the SCFW returns a 'LOCKED' error, as the clock is already configured by the SCFW. This causes the probe function in imx_rproc.c to fail, leading to the M-core power domain being shut down while the core is still running. This results in a fault from the SCU (System Controller Unit) and triggers a system reset.
To address this issue, ignore handling the clk for i.MX8X and i.MX8 M-core, as SCFW already takes care of enabling and configuring the clock.
--- drivers/remoteproc/imx_rproc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/remoteproc/imx_rproc.c +2 -2
@@ -750,8 +750,8 @@ static int imx_rproc_clk_enable(struct imx_rproc *priv)struct device *dev = priv->dev;int ret; -/* Remote core is not under control of Linux */ -if (dcfg->method ==IMX_RPROC_NONE ) +/* Remote core is not under control of Linux or it is managed by SCU API */ +if (dcfg->method ==IMX_RPROC_NONE || dcfg->method ==IMX_RPROC_SCU_API )return 0 ; priv->clk =devm_clk_get (dev,NULL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/482 gpio: wcd934x: check the return value of regmap_update_bits()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit ff0f0d7c6587e38c308be9905e36f86e98fb9c1f ]
regmap_update_bits() can fail so check its return value in wcd_gpio_direction_output() for consistency with the rest of the code and propagate any errors.
--- drivers/gpio/gpio-wcd934x.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpio/gpio-wcd934x.c +5 -2
@@ -45,9 +45,12 @@ static int wcd_gpio_direction_output(struct gpio_chip *chip, unsigned int pin, int val) {struct wcd_gpio_data *data =gpiochip_get_data (chip); +int ret; -regmap_update_bits (data->map,WCD_REG_DIR_CTL_OFFSET , -WCD_PIN_MASK (pin),WCD_PIN_MASK (pin)); + ret =regmap_update_bits (data->map,WCD_REG_DIR_CTL_OFFSET , +WCD_PIN_MASK (pin),WCD_PIN_MASK (pin)); +if (ret) +return ret; return regmap_update_bits(data->map, WCD_REG_VAL_CTL_OFFSET, WCD_PIN_MASK(pin),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/482 cpufreq: Exit governor when failed to start old governor
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 0ae204405095abfbc2d694ee0fbb49bcbbe55c57 ]
Detect the result of starting old governor in cpufreq_set_policy(). If it fails, exit the governor and clear policy->governor.
--- drivers/cpufreq/cpufreq.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/cpufreq/cpufreq.c +5 -3
@@ -2649,10 +2649,12 @@ static int cpufreq_set_policy(struct cpufreq_policy *policy,pr_debug ("starting governor %s failed\n" , policy->governor->name);if (old_gov) { policy->governor = old_gov; -if (cpufreq_init_governor (policy)) +if (cpufreq_init_governor (policy)) { policy->governor =NULL ; -else -cpufreq_start_governor (policy); + }else if (cpufreq_start_governor (policy)) { +cpufreq_exit_governor (policy); + policy->governor =NULL ; + } }return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/482 ARM: rockchip: fix kernel hang during smp initialization
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Kochetkov <[email protected]>
[ Upstream commit 7cdb433bb44cdc87dc5260cdf15bf03cc1cd1814 ]
In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect.
The patch moves SRAM initialization step to the point where all secondary CPUs are powered down.
That fixes rarely hangs on RK3188:
[ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4
--- arch/arm/mach-rockchip/platsmp.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
arch/arm/mach-rockchip/platsmp.c +9 -6
@@ -279,11 +279,6 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus) }if (read_cpuid_part () ==ARM_CPU_PART_CORTEX_A9 ) { -if (rockchip_smp_prepare_sram (node)) { -of_node_put (node); -return ; - } -/* enable the SCU power domain */ pmu_set_power_domain (PMU_PWRDN_SCU , true);
@@ -316,11 +311,19 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus) asm ("mrc p15, 1, %0, c9, c0, 2\n" :"=r" (l2ctlr)); ncores = ((l2ctlr >>24 ) &0x3 ) +1 ; } -of_node_put (node);/* Make sure that all cores except the first are really off */ for (i =1 ; i < ncores; i++)pmu_set_power_domain (0 + i, false); + +if (read_cpuid_part () ==ARM_CPU_PART_CORTEX_A9 ) { +if (rockchip_smp_prepare_sram (node)) { +of_node_put (node); +return ; + } + } + +of_node_put (node); }static void __init rk3036_smp_prepare_cpus (unsigned int max_cpus)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/482 PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 914cc799b28f17d369d5b4db3b941957d18157e8 ]
Replace sscanf() with kstrtoul() in set_freq_store() and check the result to avoid invalid input.
--- drivers/devfreq/governor_userspace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/devfreq/governor_userspace.c +5 -1
@@ -9,6 +9,7 @@#include <linux/slab.h> #include <linux/device.h> #include <linux/devfreq.h> +#include <linux/kstrtox.h> #include <linux/pm.h> #include <linux/mutex.h> #include <linux/module.h>
@@ -39,10 +40,13 @@ static ssize_t set_freq_store(struct device *dev, struct device_attribute *attr,unsigned long wanted;int err =0 ; + err =kstrtoul (buf,0 , &wanted); +if (err) +return err; +mutex_lock (&devfreq->lock); data = devfreq->governor_data; -sscanf (buf,"%lu" , &wanted); data->user_frequency = wanted; data->valid = true; err =update_devfreq (devfreq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/482 EDAC/synopsys: Clear the ECC counters on init
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <[email protected]>
[ Upstream commit b1dc7f097b78eb8d25b071ead2384b07a549692b ]
Clear the ECC error and counter registers during initialization/probe to avoid reporting stale errors that may have occurred before EDAC registration.
For that, unify the Zynq and ZynqMP ECC state reading paths and simplify the code.
[ bp: Massage commit message.
Fix an -Wsometimes-uninitialized warning as reported by
--- drivers/edac/synopsys_edac.c | 97 +++++++++++++++++------------------- 1 file changed, 46 insertions(+), 51 deletions(-)
drivers/edac/synopsys_edac.c +46 -51
@@ -333,20 +333,26 @@ struct synps_edac_priv {#endif }; +enum synps_platform_type { +ZYNQ , +ZYNQMP , +SYNPS , +}; +/** * struct synps_platform_data - synps platform data structure. +* @platform: Identifies the target hardware platform * @get_error_info: Get EDAC error info. * @get_mtype: Get mtype. * @get_dtype: Get dtype. -* @get_ecc_state: Get ECC state. * @get_mem_info: Get EDAC memory info * @quirks: To differentiate IPs. */ struct synps_platform_data { +enum synps_platform_type platform;int (*get_error_info)(struct synps_edac_priv *priv);enum mem_type (*get_mtype)(const void __iomem *base);enum dev_type (*get_dtype)(const void __iomem *base); -bool (*get_ecc_state)(void __iomem *base);#ifdef CONFIG_EDAC_DEBUG u64 (*get_mem_info)(struct synps_edac_priv *priv);#endif
@@ -721,51 +727,38 @@ static enum dev_type zynqmp_get_dtype(const void __iomem *base)return dt; } -/** -* zynq_get_ecc_state - Return the controller ECC enable/disable status. -* @base: DDR memory controller base address. -* -* Get the ECC enable/disable status of the controller. -* -* Return: true if enabled, otherwise false. -*/ -static bool zynq_get_ecc_state (void __iomem *base) +static bool get_ecc_state (struct synps_edac_priv *priv) { +u32 ecctype, clearval;enum dev_type dt; -u32 ecctype; - - dt =zynq_get_dtype (base); -if (dt ==DEV_UNKNOWN ) -return false; - ecctype =readl (base +SCRUB_OFST ) &SCRUB_MODE_MASK ; -if ((ecctype ==SCRUB_MODE_SECDED ) && (dt ==DEV_X2 )) -return true; - -return false; -} - -/** -* zynqmp_get_ecc_state - Return the controller ECC enable/disable status. -* @base: DDR memory controller base address. -* -* Get the ECC enable/disable status for the controller. -* -* Return: a ECC status boolean i.e true/false - enabled/disabled. -*/ -static bool zynqmp_get_ecc_state (void __iomem *base) -{ -enum dev_type dt; -u32 ecctype; - - dt =zynqmp_get_dtype (base); -if (dt ==DEV_UNKNOWN ) -return false; - - ecctype =readl (base +ECC_CFG0_OFST ) &SCRUB_MODE_MASK ; -if ((ecctype ==SCRUB_MODE_SECDED ) && - ((dt ==DEV_X2 ) || (dt ==DEV_X4 ) || (dt ==DEV_X8 ))) -return true; +if (priv->p_data->platform ==ZYNQ ) { + dt =zynq_get_dtype (priv->baseaddr); +if (dt ==DEV_UNKNOWN ) +return false; + + ecctype =readl (priv->baseaddr +SCRUB_OFST ) &SCRUB_MODE_MASK ; +if (ecctype ==SCRUB_MODE_SECDED && dt ==DEV_X2 ) { + clearval =ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_UE_ERR ; +writel (clearval, priv->baseaddr +ECC_CTRL_OFST ); +writel (0x0 , priv->baseaddr +ECC_CTRL_OFST ); +return true; + } + }else { + dt =zynqmp_get_dtype (priv->baseaddr); +if (dt ==DEV_UNKNOWN ) +return false; + + ecctype =readl (priv->baseaddr +ECC_CFG0_OFST ) &SCRUB_MODE_MASK ; +if (ecctype ==SCRUB_MODE_SECDED && + (dt ==DEV_X2 || dt ==DEV_X4 || dt ==DEV_X8 )) { + clearval =readl (priv->baseaddr +ECC_CLR_OFST ) | +ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_CE_ERRCNT | +ECC_CTRL_CLR_UE_ERR |ECC_CTRL_CLR_UE_ERRCNT ; +writel (clearval, priv->baseaddr +ECC_CLR_OFST ); +return true; + } + }return false; }
@@ -935,18 +928,18 @@ static int setup_irq(struct mem_ctl_info *mci, }static const struct synps_platform_data zynq_edac_def = { + .platform =ZYNQ , .get_error_info = zynq_get_error_info, .get_mtype = zynq_get_mtype, .get_dtype = zynq_get_dtype, - .get_ecc_state = zynq_get_ecc_state, .quirks =0 , };static const struct synps_platform_data zynqmp_edac_def = { + .platform =ZYNQMP , .get_error_info = zynqmp_get_error_info, .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, - .get_ecc_state = zynqmp_get_ecc_state, #ifdef CONFIG_EDAC_DEBUG .get_mem_info = zynqmp_get_mem_info, #endif
@@ -958,10 +951,10 @@ static const struct synps_platform_data zynqmp_edac_def = { };static const struct synps_platform_data synopsys_edac_def = { + .platform =SYNPS , .get_error_info = zynqmp_get_error_info, .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, - .get_ecc_state = zynqmp_get_ecc_state, .quirks = (DDR_ECC_INTR_SUPPORT | DDR_ECC_INTR_SELF_CLEAR #ifdef CONFIG_EDAC_DEBUG | DDR_ECC_DATA_POISON_SUPPORT
@@ -1393,10 +1386,6 @@ static int mc_probe(struct platform_device *pdev)if (!p_data)return -ENODEV ; -if (!p_data->get_ecc_state (baseaddr)) { -edac_printk (KERN_INFO ,EDAC_MC ,"ECC not enabled\n" ); -return -ENXIO ; - } layers[0 ].type =EDAC_MC_LAYER_CHIP_SELECT ; layers[0 ].size =SYNPS_EDAC_NR_CSROWS ;
@@ -1416,6 +1405,12 @@ static int mc_probe(struct platform_device *pdev) priv = mci->pvt_info; priv->baseaddr = baseaddr; priv->p_data = p_data; +if (!get_ecc_state (priv)) { +edac_printk (KERN_INFO ,EDAC_MC ,"ECC not enabled\n" ); + rc = -ENODEV ; + goto free_edac_mc; + } +spin_lock_init (&priv->reglock);mc_init (mci, pdev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/482 ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit f40ecc2743652c0b0f19935f81baf57c601eb7f0 ]
ASoC has 2 functions to set bias level.
(A) snd_soc_dapm_force_bias_level() (B) snd_soc_dapm_set_bias_level()
snd_soc_dapm_force_bias_level() (A) will set dapm->bias_level (a) if successed.
(A) int snd_soc_dapm_force_bias_level(...)
{
...
if (ret == 0)
(a) dapm->bias_level = level;
...
}snd_soc_dapm_set_bias_level() (B) is also a function that sets bias_level. It will call snd_soc_dapm_force_bias_level() (A) inside, but doesn't set dapm->bias_level by itself. One note is that (A) might not be called.
(B) static int snd_soc_dapm_set_bias_level(...)
{
...
ret = snd_soc_card_set_bias_level(...);
...
if (dapm != &card->dapm)
(A) ret = snd_soc_dapm_force_bias_level(...);
...
ret = snd_soc_card_set_bias_level_post(...);
...
}dapm->bias_level will be set if (A) was called, but might not be set if (B) was called, even though it calles set_bias_level() function.
We should set dapm->bias_level if we callssnd_soc_dapm_set_bias_level() (B), too.
--- sound/soc/soc-dapm.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/soc-dapm.c +4 -0
@@ -742,6 +742,10 @@ static int snd_soc_dapm_set_bias_level(struct snd_soc_dapm_context *dapm, out:trace_snd_soc_bias_level_done (card, level); +/* success */ +if (ret ==0 ) +snd_soc_dapm_init_bias_level (dapm, level); +return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/482 thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Collins <[email protected]>
[ Upstream commit f8e157ff2df46ddabd930815d196895976227831 ]
Certain TEMP_ALARM GEN2 PMIC peripherals need over-temperature stage 2 automatic PMIC partial shutdown. This will ensure that in the event of reaching the hotter stage 3 over-temperature threshold, repeated faults will be avoided during the automatic PMIC hardware full shutdown. Modify the stage 2 shutdown control logic to ensure that stage 2 shutdown is enabled on all affected PMICs. Read the digital major and minor revision registers to identify these PMICs.
--- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 43 ++++++++++++++++----- 1 file changed, 34 insertions(+), 9 deletions(-)
drivers/thermal/qcom/qcom-spmi-temp-alarm.c +34 -9
@@ -1,6 +1,7 @@// SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2011-2015, 2017, 2020, The Linux Foundation. All rights reserved. +* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include <linux/bitops.h>
@@ -18,6 +19,7 @@#include "../thermal_core.h" #include "../thermal_hwmon.h" +#define QPNP_TM_REG_DIG_MINOR 0x00#define QPNP_TM_REG_DIG_MAJOR 0x01#define QPNP_TM_REG_TYPE 0x04#define QPNP_TM_REG_SUBTYPE 0x05
@@ -33,7 +35,7 @@#define STATUS_GEN2_STATE_MASK GENMASK(6, 4)#define STATUS_GEN2_STATE_SHIFT 4 -#define SHUTDOWN_CTRL1_OVERRIDE_S2 BIT(6) +#define SHUTDOWN_CTRL1_OVERRIDE_STAGE2 BIT(6)#define SHUTDOWN_CTRL1_THRESHOLD_MASK GENMASK(1, 0)#define SHUTDOWN_CTRL1_RATE_25HZ BIT(3)
@@ -81,6 +83,7 @@ struct qpnp_tm_chip {/* protects .thresh, .stage and chip registers */ struct mutex lock;bool initialized; +bool require_stage2_shutdown;struct iio_channel *adc;const long (*temp_map)[THRESH_COUNT ][STAGE_COUNT ];
@@ -223,13 +226,13 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, {long stage2_threshold_min = (*chip->temp_map)[THRESH_MIN ][1 ];long stage2_threshold_max = (*chip->temp_map)[THRESH_MAX ][1 ]; -bool disable_s2_shutdown = false; +bool disable_stage2_shutdown = false;u8 reg;WARN_ON (!mutex_is_locked (&chip->lock));/* -* Default: S2 and S3 shutdown enabled, thresholds at +* Default: Stage 2 and Stage 3 shutdown enabled, thresholds at * lowest threshold set, monitoring at 25Hz */ reg =SHUTDOWN_CTRL1_RATE_25HZ ;
@@ -244,12 +247,12 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, chip->thresh =THRESH_MAX - ((stage2_threshold_max - temp) /TEMP_THRESH_STEP ); - disable_s2_shutdown = true; + disable_stage2_shutdown = true; }else { chip->thresh =THRESH_MAX ;if (chip->adc) - disable_s2_shutdown = true; + disable_stage2_shutdown = true;else dev_warn(chip->dev, "No ADC is configured and critical temperature %d mC is above the maximum stage 2 threshold of %ld mC! Configuring stage 2 shutdown at %ld mC.\n",
@@ -258,8 +261,8 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, skip: reg |= chip->thresh; -if (disable_s2_shutdown) - reg |=SHUTDOWN_CTRL1_OVERRIDE_S2 ; +if (disable_stage2_shutdown && !chip->require_stage2_shutdown) + reg |=SHUTDOWN_CTRL1_OVERRIDE_STAGE2 ;return qpnp_tm_write (chip,QPNP_TM_REG_SHUTDOWN_CTRL1 , reg); }
@@ -373,8 +376,8 @@ static int qpnp_tm_probe(struct platform_device *pdev) {struct qpnp_tm_chip *chip;struct device_node *node; -u8 type, subtype, dig_major; -u32 res; +u8 type, subtype, dig_major, dig_minor; +u32 res, dig_revision;int ret, irq; node = pdev->dev.of_node;
@@ -429,6 +432,11 @@ static int qpnp_tm_probe(struct platform_device *pdev)return ret; } + ret =qpnp_tm_read (chip,QPNP_TM_REG_DIG_MINOR , &dig_minor); +if (ret <0 ) +return dev_err_probe (&pdev->dev, ret, +"could not read dig_minor\n" ); +if (type !=QPNP_TM_TYPE || (subtype !=QPNP_TM_SUBTYPE_GEN1 && subtype !=QPNP_TM_SUBTYPE_GEN2 )) { dev_err(&pdev->dev, "invalid type 0x%02x or subtype 0x%02x\n",
@@ -442,6 +450,23 @@ static int qpnp_tm_probe(struct platform_device *pdev)else chip->temp_map = &temp_map_gen1; +if (chip->subtype ==QPNP_TM_SUBTYPE_GEN2 ) { + dig_revision = (dig_major <<8 ) | dig_minor; +/* +* Check if stage 2 automatic partial shutdown must remain +* enabled to avoid potential repeated faults upon reaching +* over-temperature stage 3. +*/ +switch (dig_revision) { +case 0x0001 : +case 0x0002 : +case 0x0100 : +case 0x0101 : + chip->require_stage2_shutdown = true; +break ; + } + } +/* * Register the sensor before initializing the hardware to be able to * read the trip points. get_temp() returns the default temperature
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/482 tools/nolibc: define time_t in terms of __kernel_old_time_t
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit d5094bcb5bfdfea2cf0de8aaf77cc65db56cbdb5 ]
Nolibc assumes that the kernel ABI is using a time values that are as large as a long integer. For most ABIs this holds true.
But for x32 this is not correct, as it uses 32bit longs but 64bit times.
Also the 'struct stat' implementation of nolibc relies on timespec::tv_sec and time_t being the same type. While timespec::tv_sec comes from the kernel and is of type __kernel_old_time_t, time_t is defined within nolibc.
Switch to the __kernel_old_time_t to always get the correct type.
--- tools/include/nolibc/std.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/include/nolibc/std.h +3 -1
@@ -33,6 +33,8 @@ typedef unsigned long uintptr_t;typedef signed long intptr_t ;typedef signed long ptrdiff_t ; +#include <linux/types.h> +/* those are commonly provided by sys/types.h */ typedef unsigned int dev_t ;typedef unsigned long ino_t ;
@@ -44,6 +46,6 @@ typedef unsigned long nlink_t;typedef signed long off_t ;typedef signed long blksize_t ;typedef signed long blkcnt_t ; -typedef signed long time_t ; +typedef __kernel_old_time_t time_t ;#endif /* _NOLIBC_STD_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/482 iio: adc: ad_sigma_delta: dont overallocate scan buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 5a2f15c5a8e017d0951e6dc62aa7b5b634f56881 ]
Fix overallocating the size of the scan buffer by converting bits to bytes. The size is meant to be in bytes, so scanbits needs to be divided by 8.
--- drivers/iio/adc/ad_sigma_delta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad_sigma_delta.c +1 -1
@@ -378,7 +378,7 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev)return ret; } - samples_buf_size =ALIGN (slot * indio_dev->channels[0 ].scan_type.storagebits,8 ); + samples_buf_size =ALIGN (slot * indio_dev->channels[0 ].scan_type.storagebits /8 ,8 ); samples_buf_size +=sizeof (int64_t ); samples_buf =devm_krealloc (&sigma_delta->spi->dev, sigma_delta->samples_buf, samples_buf_size,GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/482 gpio: tps65912: check the return value of regmap_update_bits()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit a0b2a6bbff8c26aafdecd320f38f52c341d5cafa ]
regmap_update_bits() can fail, check its return value like we do elsewhere in the driver.
--- drivers/gpio/gpio-tps65912.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpio/gpio-tps65912.c +5 -2
@@ -49,10 +49,13 @@ static int tps65912_gpio_direction_output(struct gpio_chip *gc, unsigned offset, int value) {struct tps65912_gpio *gpio =gpiochip_get_data (gc); +int ret;/* Set the initial value */ -regmap_update_bits (gpio->tps->regmap,TPS65912_GPIO1 + offset, -GPIO_SET_MASK , value ?GPIO_SET_MASK :0 ); + ret =regmap_update_bits (gpio->tps->regmap,TPS65912_GPIO1 + offset, +GPIO_SET_MASK , value ?GPIO_SET_MASK :0 ); +if (ret) +return ret;return regmap_update_bits (gpio->tps->regmap,TPS65912_GPIO1 + offset,GPIO_CFG_MASK ,GPIO_CFG_MASK );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/482 ARM: tegra: Use I/O memcpy to write to IRAM
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 398e67e0f5ae04b29bcc9cbf342e339fe9d3f6f1 ]
Kasan crashes the kernel trying to check boundaries when using the normal memcpy.
--- arch/arm/mach-tegra/reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-tegra/reset.c +1 -1
@@ -63,7 +63,7 @@ static void __init tegra_cpu_reset_handler_enable(void)BUG_ON (is_enabled);BUG_ON (tegra_cpu_reset_handler_size >TEGRA_IRAM_RESET_HANDLER_SIZE ); -memcpy (iram_base, (void *)__tegra_cpu_reset_handler_start, +memcpy_toio (iram_base, (void *)__tegra_cpu_reset_handler_start, tegra_cpu_reset_handler_size); err =call_firmware_op (set_cpu_boot_addr,0 , reset_address);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/482 tools/build: Fix s390(x) cross-compilation with clang
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit a40f0cdce78be8a559ee8a85c908049c65a410b2 ]
The heuristic to derive a clang target triple from a GCC one does not work for s390. GCC uses "s390-linux" while clang expects "s390x-linux" or "powerz-linux".
Add an explicit override.
--- tools/scripts/Makefile.include | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/scripts/Makefile.include +3 -1
@@ -98,7 +98,9 @@ else ifneq ($(CROSS_COMPILE),) # Allow userspace to override CLANG_CROSS_FLAGS to specify their own # sysroots and flags or to avoid the GCC call in pure Clang builds. ifeq ($(CLANG_CROSS_FLAGS),) -CLANG_CROSS_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%)) +CLANG_TARGET := $(notdir $(CROSS_COMPILE:%-=%)) +CLANG_TARGET := $(subst s390-linux,s390x-linux,$(CLANG_TARGET)) +CLANG_CROSS_FLAGS := --target=$(CLANG_TARGET) GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)gcc 2>/dev/null)) ifneq ($(GCC_TOOLCHAIN_DIR),) CLANG_CROSS_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/482 selftests: tracing: Use mutex_unlock for testing glob filter
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit a089bb2822a49b0c5777a8936f82c1f8629231fb ]
Since commit c5b6ababd21a ("locking/mutex: implement mutex_trylock_nested") makes mutex_trylock() as an inlined function if CONFIG_DEBUG_LOCK_ALLOC=y, we can not use mutex_trylock() for testing the glob filter of ftrace.
Use mutex_unlock instead.
--- .../testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc +1 -1
@@ -29,7 +29,7 @@ ftrace_filter_check 'schedule*' '^schedule.*$' ftrace_filter_check '*pin*lock' '.*pin.*lock$' # filter by start*mid* -ftrace_filter_check 'mutex*try*' '^mutex.*try.*' +ftrace_filter_check 'mutex*unl*' '^mutex.*unl.*' # Advanced full-glob matching feature is recently supported. # Skip the tests if we are sure the kernel does not support it.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/482 ACPI: PRM: Reduce unnecessary printing to avoid user confusion
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Qiyu <[email protected]>
[ Upstream commit 3db5648c4d608b5483470efc1da9780b081242dd ]
Commit 088984c8d54c ("ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context") introduced non-essential printing "Failed to find VA for GUID: xxxx, PA: 0x0" which may confuse users to think that something wrong is going on while it is not the case.
According to the PRM Spec Section 4.1.2 [1], both static data buffer address and ACPI parameter buffer address may be NULL if they are not needed, so there is no need to print out the "Failed to find VA ... " in those cases.
--- drivers/acpi/prmt.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-)
drivers/acpi/prmt.c +24 -2
@@ -85,8 +85,6 @@ static u64 efi_pa_va_lookup(efi_guid_t *guid, u64 pa) } } -pr_warn ("Failed to find VA for GUID: %pUL, PA: 0x%llx" , guid, pa); -return 0 ; }
@@ -154,13 +152,37 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)guid_copy (&th->guid, (guid_t *)handler_info->handler_guid); th->handler_addr = (void *)efi_pa_va_lookup (&th->guid, handler_info->handler_address); +/* +* Print a warning message if handler_addr is zero which is not expected to +* ever happen. +*/ +if (unlikely (!th->handler_addr)) +pr_warn ("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx" , + &th->guid, handler_info->handler_address); th->static_data_buffer_addr =efi_pa_va_lookup (&th->guid, handler_info->static_data_buffer_address); +/* +* According to the PRM specification, static_data_buffer_address can be zero, +* so avoid printing a warning message in that case. Otherwise, if the +* return value of efi_pa_va_lookup() is zero, print the message. +*/ +if (unlikely (!th->static_data_buffer_addr && handler_info->static_data_buffer_address)) +pr_warn ("Failed to find VA of static data buffer for GUID: %pUL, PA: 0x%llx" , + &th->guid, handler_info->static_data_buffer_address); th->acpi_param_buffer_addr =efi_pa_va_lookup (&th->guid, handler_info->acpi_param_buffer_address); +/* +* According to the PRM specification, acpi_param_buffer_address can be zero, +* so avoid printing a warning message in that case. Otherwise, if the +* return value of efi_pa_va_lookup() is zero, print the message. +*/ +if (unlikely (!th->acpi_param_buffer_addr && handler_info->acpi_param_buffer_address)) +pr_warn ("Failed to find VA of acpi param buffer for GUID: %pUL, PA: 0x%llx" , + &th->guid, handler_info->acpi_param_buffer_address); + }while (++cur_handler < tm->handler_count && (handler_info =get_next_handler (handler_info)));return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/482 PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 89d9cec3b1e9c49bae9375a2db6dc49bc7468af0 ]
Clear power.needs_force_resume in pm_runtime_reinit() in case it has been set by pm_runtime_force_suspend() invoked from a driver remove callback.
--- drivers/base/power/runtime.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/base/power/runtime.c +5 -0
@@ -1753,6 +1753,11 @@ void pm_runtime_reinit(struct device *dev)pm_runtime_put (dev->parent); } } +/* +* Clear power.needs_force_resume in case it has been set by +* pm_runtime_force_suspend() invoked from a driver remove callback. +*/ + dev->power.needs_force_resume = false; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/482 thermal: sysfs: Return ENODATA instead of EAGAIN for reads
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Te Yuan <[email protected]>
[ Upstream commit 1a4aabc27e95674837f2e25f4ef340c0469e6203 ]
According to POSIX spec, EAGAIN returned by read with O_NONBLOCK set means the read would block. Hence, the common implementation in nonblocking model will poll the file when the nonblocking read returns EAGAIN. However, when the target file is thermal zone, this mechanism will totally malfunction because thermal zone doesn't implement sysfs notification and thus the poll will never return.
For example, the read in Golang implemnts such method and sometimes hangs at reading some thermal zones via sysfs.
Change to return -ENODATA instead of -EAGAIN to userspace.
--- drivers/thermal/thermal_sysfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/thermal/thermal_sysfs.c +6 -3
@@ -39,10 +39,13 @@ temp_show(struct device *dev, struct device_attribute *attr, char *buf) ret =thermal_zone_get_temp (tz, &temperature); -if (ret) -return ret; +if (!ret) +return sprintf (buf,"%d\n" , temperature); -return sprintf (buf,"%d\n" , temperature); +if (ret == -EAGAIN ) +return -ENODATA ; + +return ret; } static ssize_t
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/482 PM: sleep: console: Fix the black screen issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: tuhaowen <[email protected]>
[ Upstream commit 4266e8fa56d3d982bf451d382a410b9db432015c ]
When the computer enters sleep status without a monitor connected, the system switches the console to the virtual terminal tty63(SUSPEND_CONSOLE).
If a monitor is subsequently connected before waking up, the system skips the required VT restoration process during wake-up, leaving the console on tty63 instead of switching back to tty1.
To fix this issue, a global flag vt_switch_done is introduced to record whether the system has successfully switched to the suspend console via vt_move_to_console() during suspend.
If the switch was completed, vt_switch_done is set to 1. Later during resume, this flag is checked to ensure that the original console is restored properly by calling vt_move_to_console(orig_fgconsole, 0).
This prevents scenarios where the resume logic skips console restoration due to incorrect detection of the console state, especially when a monitor is reconnected before waking up.
--- kernel/power/console.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/power/console.c +6 -1
@@ -16,6 +16,7 @@#define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)static int orig_fgconsole, orig_kmsg; +static bool vt_switch_done;static DEFINE_MUTEX (vt_switch_mutex);
@@ -136,17 +137,21 @@ void pm_prepare_console(void)if (orig_fgconsole <0 )return ; + vt_switch_done = true; + orig_kmsg =vt_kmsg_redirect (SUSPEND_CONSOLE );return ; }void pm_restore_console (void ) { -if (!pm_vt_switch ()) +if (!pm_vt_switch () && !vt_switch_done)return ;if (orig_fgconsole >=0 ) {vt_move_to_console (orig_fgconsole,0 );vt_kmsg_redirect (orig_kmsg); } + + vt_switch_done = false; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/482 ACPI: processor: fix acpi_object initialization
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Ott <[email protected]>
[ Upstream commit 13edf7539211d8f7d0068ce3ed143005f1da3547 ]
Initialization of the local acpi_object in acpi_processor_get_info() only sets the first 4 bytes to zero and is thus incomplete. This is indicated by messages like:
acpi ACPI0007:be: Invalid PBLK length [166288104]
Fix this by initializing all 16 bytes of the processor member of that union.
--- drivers/acpi/acpi_processor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpi_processor.c +1 -1
@@ -216,7 +216,7 @@ static inline int acpi_processor_hotadd_init(struct acpi_processor *pr)static int acpi_processor_get_info (struct acpi_device *device) { -union acpi_object object = {0 }; +union acpi_object object = { .processor = {0 } };struct acpi_buffer buffer = {sizeof (union acpi_object ), &object };struct acpi_processor *pr =acpi_driver_data (device);int device_declaration =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/482 mmc: sdhci-msm: Ensure SD card power isnt ON when card removed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <[email protected]>
[ Upstream commit db58532188ebf51d52b1d7693d9e94c76b926e9f ]
Many mobile phones feature multi-card tray designs, where the same tray is used for both SD and SIM cards. If the SD card is placed at the outermost location in the tray, the SIM card may come in contact with SD card power-supply while removing the tray, possibly resulting in SIM damage.
To prevent that, make sure the SD card is really inserted by reading the Card Detect pin state. If it's not, turn off the power in sdhci_msm_check_power_status() and also set the BUS_FAIL power state on the controller as part of pwr_irq handling for BUS_ON request.
--- drivers/mmc/host/sdhci-msm.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/mmc/host/sdhci-msm.c +14 -0
@@ -1560,6 +1560,7 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type) {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_msm_host *msm_host =sdhci_pltfm_priv (pltfm_host); +struct mmc_host *mmc = host->mmc;bool done = false;u32 val =SWITCHABLE_SIGNALING_VOLTAGE ; const struct sdhci_msm_offset *msm_offset =
@@ -1617,6 +1618,12 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type)"%s: pwr_irq for req: (%d) timed out\n" , mmc_hostname(host->mmc), req_type); } + +if ((req_type &REQ_BUS_ON ) && mmc->card && !mmc->ops->get_cd (mmc)) { +sdhci_writeb (host,0 ,SDHCI_POWER_CONTROL ); + host->pwr =0 ; + } +pr_debug ("%s: %s: request %d done\n" ,mmc_hostname (host->mmc), __func__, req_type); }
@@ -1675,6 +1682,13 @@ static void sdhci_msm_handle_pwr_irq(struct sdhci_host *host, int irq)udelay (10 ); } +if ((irq_status &CORE_PWRCTL_BUS_ON ) && mmc->card && + !mmc->ops->get_cd (mmc)) { +msm_host_writel (msm_host,CORE_PWRCTL_BUS_FAIL , host, + msm_offset->core_pwrctl_ctl); +return ; + } +/* Handle BUS ON/OFF*/ if (irq_status &CORE_PWRCTL_BUS_ON ) { pwr_state =REQ_BUS_ON ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/482 ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 4734c8b46b901cff2feda8b82abc710b65dc31c1 ]
When a GHES (Generic Hardware Error Source) triggers a panic, add the TAINT_MACHINE_CHECK taint flag to the kernel. This explicitly marks the kernel as tainted due to a machine check event, improving diagnostics and post-mortem analysis. The taint is set with LOCKDEP_STILL_OK to indicate lockdep remains valid.
At large scale deployment, this helps to quickly determine panics that are coming due to hardware failures.
--- drivers/acpi/apei/ghes.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/apei/ghes.c +2 -0
@@ -860,6 +860,8 @@ static void __ghes_panic(struct ghes *ghes,__ghes_print_estatus (KERN_EMERG , ghes->generic, estatus); +add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_STILL_OK ); +ghes_clear_estatus (ghes, estatus, buf_paddr, fixmap_idx);if (!panic_timeout)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/482 pps: clients: gpio: fix interrupt handling order in remove path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliav Farber <[email protected]>
[ Upstream commit 6bca1e955830808dc90e0506b2951b4256b81bbb ]
The interrupt handler in pps_gpio_probe() is registered after calling pps_register_source() using devm_request_irq(). However, in the corresponding remove function, pps_unregister_source() is called before the IRQ is freed, since devm-managed resources are released after the remove function completes.
This creates a potential race condition where an interrupt may occur after the PPS source is unregistered but before the handler is removed, possibly leading to a kernel panic.
To prevent this, switch from devm-managed IRQ registration to manual management by using request_irq() and calling free_irq() explicitly in the remove path before unregistering the PPS source. This ensures the interrupt handler is safely removed before deactivating the PPS source.
--- drivers/pps/clients/pps-gpio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/pps/clients/pps-gpio.c +3 -2
@@ -206,8 +206,8 @@ static int pps_gpio_probe(struct platform_device *pdev) }/* register IRQ interrupt handler */ - ret =devm_request_irq (dev, data->irq, pps_gpio_irq_handler, -get_irqf_trigger_flags (data), data->info.name, data); + ret =request_irq (data->irq, pps_gpio_irq_handler, +get_irqf_trigger_flags (data), data->info.name, data);if (ret) {pps_unregister_source (data->pps);dev_err (dev,"failed to acquire IRQ %d\n" , data->irq);
@@ -224,6 +224,7 @@ static int pps_gpio_remove(struct platform_device *pdev) {struct pps_gpio_device_data *data =platform_get_drvdata (pdev); +free_irq (data->irq, data);pps_unregister_source (data->pps);del_timer_sync (&data->echo_timer);/* reset echo pin in any case */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/482 reset: brcmstb: Enable reset drivers for ARCH_BCM2835
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Robinson <[email protected]>
[ Upstream commit 1d99f92f71b6b4b2eee776562c991428490f71ef ]
The BRCMSTB and BRCMSTB_RESCAL reset drivers are also used in the BCM2712, AKA the RPi5. The RPi platforms have typically used the ARCH_BCM2835, and the PCIe support for this SoC can use this config which depends on these drivers so enable building them when just that arch option is enabled to ensure the platform works as expected.
--- drivers/reset/Kconfig | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/reset/Kconfig +5 -5
@@ -51,8 +51,8 @@ config RESET_BERLIN config RESET_BRCMSTB tristate "Broadcom STB reset controller" - depends on ARCH_BRCMSTB || COMPILE_TEST - default ARCH_BRCMSTB + depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST + default ARCH_BRCMSTB || ARCH_BCM2835 help This enables the reset controller driver for Broadcom STB SoCs using a SUN_TOP_CTRL_SW_INIT style controller.
@@ -60,11 +60,11 @@ config RESET_BRCMSTB config RESET_BRCMSTB_RESCAL tristate "Broadcom STB RESCAL reset controller" depends on HAS_IOMEM - depends on ARCH_BRCMSTB || COMPILE_TEST - default ARCH_BRCMSTB + depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST + default ARCH_BRCMSTB || ARCH_BCM2835 help This enables the RESCAL reset controller for SATA, PCIe0, or PCIe1 on - BCM7216. + BCM7216 or the BCM2712. config RESET_HSDK bool "Synopsys HSDK Reset Driver"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/482 mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 ]
mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl) belonging to the device being released.
If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers, the mei-client being freed might still be part of the mei_device's file_list and iterating over this list after the freeing will then trigger a use-afer-free bug.
Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed mei-client is not on the mei_device's file_list.
--- drivers/misc/mei/bus.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/misc/mei/bus.c +6 -0
@@ -1113,6 +1113,8 @@ static void mei_dev_bus_put(struct mei_device *bus)static void mei_cl_bus_dev_release (struct device *dev) {struct mei_cl_device *cldev =to_mei_cl_device (dev); +struct mei_device *mdev = cldev->cl->dev; +struct mei_cl *cl;if (!cldev)return ;
@@ -1120,6 +1122,10 @@ static void mei_cl_bus_dev_release(struct device *dev)mei_cl_flush_queues (cldev->cl,NULL );mei_me_cl_put (cldev->me_cl);mei_dev_bus_put (cldev->bus); + +list_for_each_entry (cl, &mdev->file_list, link) +WARN_ON (cl == cldev->cl); +kfree (cldev->cl);kfree (cldev); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/482 mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
[ Upstream commit 47a255f7d2eabee06cfbf5b1c2379749442fd01d ]
In the error path of sd_set_power_mode() we don't update host->power_mode, which could lead to an imbalance of the runtime PM usage count. Fix this by always updating host->power_mode.
--- drivers/mmc/host/rtsx_usb_sdmmc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/mmc/host/rtsx_usb_sdmmc.c +1 -3
@@ -1032,9 +1032,7 @@ static int sd_set_power_mode(struct rtsx_usb_sdmmc *host, err =sd_power_on (host); } -if (!err) - host->power_mode = power_mode; - + host->power_mode = power_mode;return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/482 ALSA: hda: Handle the jack polling always via a work
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 5f7e54b23e4d253eff3b10b12d6fa92d28d7dddc ]
We used to call directly hda_jackpoll_work() from a couple of places for updating the jack and notify to user-space, but this makes rather the code flow fragile. Namely, because of those direct calls, hda_jackpoll_work() uses snd_hda_power_up_pm() and *_down_pm() calls instead of the standard snd_hda_power_up() and *_down() calls. The latter pair assures the runtime PM resume sync, so it can avoid the race against the PM callbacks gracefully, while the former pair may continue if called concurrently, hence it may race (by design).
In this patch, we change the call pattern of hda_jackpoll_work(); now all callers are replaced with the standard snd_hda_jack_report_sync() and the additional schedule_delayed_work().
Since hda_jackpoll_work() is called only from the associated work, it's always outside the PM code path, and we can safely use snd_hda_power_up() and *_down() there instead. This allows us to remove the racy check of power-state in hda_jackpoll_work(), as well as the tricky cancel_delayed_work() and rescheduling at hda_codec_runtime_suspend().
--- sound/pci/hda/hda_codec.c | 41 +++++++++++++-------------------------- 1 file changed, 14 insertions(+), 27 deletions(-)
sound/pci/hda/hda_codec.c +14 -27
@@ -641,24 +641,16 @@ static void hda_jackpoll_work(struct work_struct *work)struct hda_codec *codec = container_of(work, struct hda_codec, jackpoll_work.work); -/* for non-polling trigger: we need nothing if already powered on */ -if (!codec->jackpoll_interval &&snd_hdac_is_power_on (&codec->core)) +if (!codec->jackpoll_interval)return ;/* the power-up/down sequence triggers the runtime resume */ -snd_hda_power_up_pm (codec); +snd_hda_power_up (codec);/* update jacks manually if polling is required, too */ -if (codec->jackpoll_interval) { -snd_hda_jack_set_dirty_all (codec); -snd_hda_jack_poll_all (codec); - } -snd_hda_power_down_pm (codec); - -if (!codec->jackpoll_interval) -return ; - -schedule_delayed_work (&codec->jackpoll_work, - codec->jackpoll_interval); +snd_hda_jack_set_dirty_all (codec); +snd_hda_jack_poll_all (codec); +schedule_delayed_work (&codec->jackpoll_work, codec->jackpoll_interval); +snd_hda_power_down (codec); }/* release all pincfg lists */
@@ -2922,12 +2914,12 @@ static void hda_call_codec_resume(struct hda_codec *codec)snd_hda_regmap_sync (codec); } -if (codec->jackpoll_interval) -hda_jackpoll_work (&codec->jackpoll_work.work); -else -snd_hda_jack_report_sync (codec); +snd_hda_jack_report_sync (codec); codec->core.dev.power.power_state =PMSG_ON ;snd_hdac_leave_pm (&codec->core); +if (codec->jackpoll_interval) +schedule_delayed_work (&codec->jackpoll_work, + codec->jackpoll_interval); }static int hda_codec_runtime_suspend (struct device *dev)
@@ -2939,8 +2931,6 @@ static int hda_codec_runtime_suspend(struct device *dev)if (!codec->card)return 0 ; -cancel_delayed_work_sync (&codec->jackpoll_work); - state =hda_call_codec_suspend (codec); if (codec->link_down_at_suspend || (codec_has_clkstop(codec) && codec_has_epss(codec) &&
@@ -2948,10 +2938,6 @@ static int hda_codec_runtime_suspend(struct device *dev)snd_hdac_codec_link_down (&codec->core);snd_hda_codec_display_power (codec, false); -if (codec->bus->jackpoll_in_suspend && - (dev->power.power_state.event !=PM_EVENT_SUSPEND )) -schedule_delayed_work (&codec->jackpoll_work, - codec->jackpoll_interval);return 0 ; }
@@ -3120,10 +3106,11 @@ int snd_hda_codec_build_controls(struct hda_codec *codec)if (err <0 )return err; +snd_hda_jack_report_sync (codec);/* call at the last init point */ if (codec->jackpoll_interval) -hda_jackpoll_work (&codec->jackpoll_work.work); -else -snd_hda_jack_report_sync (codec);/* call at the last init point */ +schedule_delayed_work (&codec->jackpoll_work, + codec->jackpoll_interval); +sync_power_up_states (codec);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/482 ALSA: hda: Disable jack polling at shutdown
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 1adcbdf54f76e1004bdf71df4eb1888c26e7ad06 ]
Although the jack polling is canceled at shutdown in snd_hda_codec_shutdown(), it might be still re-triggered when the work is being processed at cancel_delayed_work_sync() call. This may result in the unexpected hardware access that should have been already disabled.
For assuring to stop the jack polling, clear codec->jackpoll_interval at shutdown.
--- sound/pci/hda/hda_codec.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/hda_codec.c +1 -0
@@ -3040,6 +3040,7 @@ void snd_hda_codec_shutdown(struct hda_codec *codec)if (!codec->core.registered)return ; + codec->jackpoll_interval =0 ;/* don't poll any longer */ cancel_delayed_work_sync (&codec->jackpoll_work);list_for_each_entry (cpcm, &codec->pcm_list_head, list)snd_pcm_suspend_all (cpcm->pcm);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/482 x86/bugs: Avoid warning when overriding return thunk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
[ Upstream commit 9f85fdb9fc5a1bd308a10a0a7d7e34f2712ba58b ]
The purpose of the warning is to prevent an unexpected change to the return thunk mitigation. However, there are legitimate cases where the return thunk is intentionally set more than once. For example, ITS and SRSO both can set the return thunk after retbleed has set it. In both the cases retbleed is still mitigated.
Replace the warning with an info about the active return thunk.
--- arch/x86/kernel/cpu/bugs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/kernel/cpu/bugs.c +2 -3
@@ -70,10 +70,9 @@ void (*x86_return_thunk)(void) __ro_after_init = &__x86_return_thunk;static void __init set_return_thunk (void *thunk) { -if (x86_return_thunk != __x86_return_thunk) -pr_warn ("x86/bugs: return thunk changed\n" ); - x86_return_thunk = thunk; + +pr_info ("active return thunk: %ps\n" , thunk); }/* Update SPEC_CTRL MSR and its cached copy unconditionally */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/482 ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit c4ca928a6db1593802cd945f075a7e21dd0430c1 ]
We currently log parse failures for ELD data and some disconnection events as errors without rate limiting. These log messages can be triggered very frequently in some situations, especially ELD parsing when there is nothing connected to a HDMI port which will generate:
hdmi-audio-codec hdmi-audio-codec.1.auto: HDMI: Unknown ELD version 0
While there's doubtless work that could be done on reducing the number of connection notification callbacks it's possible these may be legitimately generated by poor quality physical connections so let's use rate limiting to mitigate the log spam for the parse errors and lower the severity for disconnect logging to debug level.
--- sound/soc/codecs/hdac_hdmi.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
sound/soc/codecs/hdac_hdmi.c +6 -4
@@ -1230,7 +1230,8 @@ static int hdac_hdmi_parse_eld(struct hdac_device *hdev, >> DRM_ELD_VER_SHIFT;if (ver !=ELD_VER_CEA_861D && ver !=ELD_VER_PARTIAL ) { -dev_err (&hdev->dev,"HDMI: Unknown ELD version %d\n" , ver); +dev_err_ratelimited (&hdev->dev, +"HDMI: Unknown ELD version %d\n" , ver);return -EINVAL ; }
@@ -1238,7 +1239,8 @@ static int hdac_hdmi_parse_eld(struct hdac_device *hdev, DRM_ELD_MNL_MASK) >> DRM_ELD_MNL_SHIFT;if (mnl >ELD_MAX_MNL ) { -dev_err (&hdev->dev,"HDMI: MNL Invalid %d\n" , mnl); +dev_err_ratelimited (&hdev->dev, +"HDMI: MNL Invalid %d\n" , mnl);return -EINVAL ; }
@@ -1297,8 +1299,8 @@ static void hdac_hdmi_present_sense(struct hdac_hdmi_pin *pin,if (!port->eld.monitor_present || !port->eld.eld_valid) { -dev_err (&hdev->dev,"%s: disconnect for pin:port %d:%d\n" , - __func__, pin->nid, port->id); +dev_dbg (&hdev->dev,"%s: disconnect for pin:port %d:%d\n" , + __func__, pin->nid, port->id);/* * PCMs are not registered during device probe, so don't
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/482 ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 87aafc8580acf87fcaf1a7e30ed858d8c8d37d81 ]
code mistakenly used a hardcoded index (codec[1]) instead of iterating, over the codec array using the loop variable i. Use codec[i] instead of codec[1] to match the loop iteration.
--- sound/pci/intel8x0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/intel8x0.c +1 -1
@@ -2252,7 +2252,7 @@ static int snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock, tmp |= chip->ac97_sdin[0 ] <<ICH_DI1L_SHIFT ;for (i =1 ; i <4 ; i++) {if (pcm->r[0 ].codec[i]) { - tmp |= chip->ac97_sdin[pcm->r[0 ].codec[1 ]->num] <<ICH_DI2L_SHIFT ; + tmp |= chip->ac97_sdin[pcm->r[0 ].codec[i]->num] <<ICH_DI2L_SHIFT ;break ; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/482 ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 2d91cb261cac6d885954b8f5da28b5c176c18131 ]
snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference.
This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system.
On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.
--- sound/soc/soc-core.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/soc-core.c +3 -0
@@ -937,6 +937,9 @@ static int soc_dai_link_sanity_check(struct snd_soc_card *card,void snd_soc_remove_pcm_runtime (struct snd_soc_card *card,struct snd_soc_pcm_runtime *rtd) { +if (!rtd) +return ; +lockdep_assert_held (&client_mutex);/* release machine specific resources */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/482 usb: typec: intel_pmc_mux: Defer probe if SCU IPC isnt present
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Michalec <[email protected]>
[ Upstream commit df9a825f330e76c72d1985bc9bdc4b8981e3d15f ]
If pmc_usb_probe is called before SCU IPC is registered, pmc_usb_probe will fail.
Return -EPROBE_DEFER when pmc_usb_probe doesn't get SCU IPC device, so the probe function can be called again after SCU IPC is initialized.
--- drivers/usb/typec/mux/intel_pmc_mux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/mux/intel_pmc_mux.c +1 -1
@@ -667,7 +667,7 @@ static int pmc_usb_probe(struct platform_device *pdev) pmc->ipc =devm_intel_scu_ipc_dev_get (&pdev->dev);if (!pmc->ipc) -return -ENODEV ; +return -EPROBE_DEFER ; pmc->dev = &pdev->dev;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/482 usb: core: usb_submit_urb: downgrade type check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 503bbde34cc3dd2acd231f277ba70c3f9ed22e59 ]
Checking for the endpoint type is no reason for a WARN, as that can cause a reboot. A driver not checking the endpoint type must not cause a reboot, as there is just no point in this. We cannot prevent a device from doing something incorrect as a reaction to a transfer. Hence warning for a mere assumption being wrong is not sensible.
--- drivers/usb/core/urb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/urb.c +1 -1
@@ -501,7 +501,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)/* Check that the pipe's type matches the endpoint's type */ if (usb_pipe_type_check (urb->dev, urb->pipe)) -dev_WARN (&dev->dev,"BOGUS urb xfer, pipe %x != type %x\n" , +dev_warn_once (&dev->dev,"BOGUS urb xfer, pipe %x != type %x\n" ,usb_pipetype (urb->pipe), pipetypes[xfertype]);/* Check against a simple/standard policy */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/482 pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit cda7ac8ce7de84cf32a3871ba5f318aa3b79381e ]
In the function mperf_start(), mperf_monitor snapshots the time, tsc and finally the aperf,mperf MSRs. However, this order of snapshotting in is reversed in mperf_stop(). As a result, the C0 residency (which is computed as delta_mperf * 100 / delta_tsc) is under-reported on CPUs that is 100% busy.
Fix this by snapshotting time, tsc and then aperf,mperf in mperf_stop() in the same order as in mperf_start().
--- tools/power/cpupower/utils/idle_monitor/mperf_monitor.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/power/cpupower/utils/idle_monitor/mperf_monitor.c +2 -2
@@ -240,9 +240,9 @@ static int mperf_stop(void)int cpu;for (cpu =0 ; cpu < cpu_count; cpu++) { -mperf_measure_stats (cpu); -mperf_get_tsc (&tsc_at_measure_end[cpu]);clock_gettime (CLOCK_REALTIME , &time_end[cpu]); +mperf_get_tsc (&tsc_at_measure_end[cpu]); +mperf_measure_stats (cpu); }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/482 platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 6418a8504187dc7f5b6f9d0649c03e362cb0664b ]
When KCOV is enabled all functions get instrumented, unless the __no_sanitize_coverage attribute is used. To prepare for __no_sanitize_coverage being applied to __init functions[1], we have to handle differences in how GCC's inline optimizations get resolved. For thinkpad_acpi routines, this means forcing two functions to be inline with __always_inline.
--- drivers/platform/x86/thinkpad_acpi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/thinkpad_acpi.c +2 -2
@@ -544,12 +544,12 @@ static unsigned long __init tpacpi_check_quirks(return 0 ; } -static inline bool __pure __init tpacpi_is_lenovo (void ) +static __always_inline bool __pure __init tpacpi_is_lenovo(void) {return thinkpad_id.vendor ==PCI_VENDOR_ID_LENOVO ; } -static inline bool __pure __init tpacpi_is_ibm (void ) +static __always_inline bool __pure __init tpacpi_is_ibm(void) {return thinkpad_id.vendor ==PCI_VENDOR_ID_IBM ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/482 platform/chrome: cros_ec_typec: Defer probe on missing EC parent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Michalec <[email protected]>
[ Upstream commit 8866f4e557eba43e991f99711515217a95f62d2e ]
If cros_typec_probe is called before EC device is registered, cros_typec_probe will fail. It may happen when cros-ec-typec.ko is loaded before EC bus layer module (e.g. cros_ec_lpcs.ko, cros_ec_spi.ko).
Return -EPROBE_DEFER when cros_typec_probe doesn't get EC device, so the probe function can be called again after EC device is registered.
--- drivers/platform/chrome/cros_ec_typec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/chrome/cros_ec_typec.c +2 -2
@@ -1194,8 +1194,8 @@ static int cros_typec_probe(struct platform_device *pdev) typec->ec =dev_get_drvdata (pdev->dev.parent);if (!typec->ec) { -dev_err (dev,"couldn't find parent EC device\n" ); -return -ENODEV ; +dev_warn (dev,"couldn't find parent EC device\n" ); +return -EPROBE_DEFER ; }platform_set_drvdata (pdev, typec);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/482 ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucy Thrun <[email protected]>
[ Upstream commit a409c60111e6bb98fcabab2aeaa069daa9434ca0 ]
The 'sprintf' call in 'add_tuning_control' may exceed the 44-byte buffer if either string argument is too long. This triggers a compiler warning.
Replaced 'sprintf' with 'snprintf' to limit string lengths to prevent overflow.
--- sound/pci/hda/patch_ca0132.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_ca0132.c +1 -1
@@ -4399,7 +4399,7 @@ static int add_tuning_control(struct hda_codec *codec, } knew.private_value =HDA_COMPOSE_AMP_VAL (nid,1 ,0 , type); -sprintf (namestr,"%s %s Volume" , name, dirstr[dir]); +snprintf (namestr,sizeof (namestr),"%s %s Volume" , name, dirstr[dir]);return snd_hda_ctl_add (codec, nid,snd_ctl_new1 (&knew, codec)); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/482 ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 92f59aeb13252265c20e7aef1379a8080c57e0a2 ]
At the time being recalculate_boundary() is implemented with a loop which shows up as costly in a perf profile, as depicted by the annotate below:
0.00 : c057e934: 3d 40 7f ff lis r10,32767
0.03 : c057e938: 61 4a ff ff ori r10,r10,65535
0.21 : c057e93c: 7d 49 50 50 subf r10,r9,r10
5.39 : c057e940: 7d 3c 4b 78 mr r28,r9
2.11 : c057e944: 55 29 08 3c slwi r9,r9,1
3.04 : c057e948: 7c 09 50 40 cmplw r9,r10
2.47 : c057e94c: 40 81 ff f4 ble c057e940 <snd_pcm_ioctl+0xee0>Total: 13.2% on that simple loop.
But what the loop does is to multiply the boundary by 2 until it is over the wanted border. This can be avoided by using fls() to get the boundary value order and shift it by the appropriate number of bits at once.
This change provides the following profile:
0.04 : c057f6e8: 3d 20 7f ff lis r9,32767
0.02 : c057f6ec: 61 29 ff ff ori r9,r9,65535
0.34 : c057f6f0: 7d 5a 48 50 subf r10,r26,r9
0.23 : c057f6f4: 7c 1a 50 40 cmplw r26,r10
0.02 : c057f6f8: 41 81 00 20 bgt c057f718 <snd_pcm_ioctl+0xf08>
0.26 : c057f6fc: 7f 47 00 34 cntlzw r7,r26
0.09 : c057f700: 7d 48 00 34 cntlzw r8,r10
0.22 : c057f704: 7d 08 38 50 subf r8,r8,r7
0.04 : c057f708: 7f 5a 40 30 slw r26,r26,r8
0.35 : c057f70c: 7c 0a d0 40 cmplw r10,r26
0.13 : c057f710: 40 80 05 f8 bge c057fd08 <snd_pcm_ioctl+0x14f8>
0.00 : c057f714: 57 5a f8 7e srwi r26,r26,1Total: 1.7% with that loopless alternative.
--- sound/core/pcm_native.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
sound/core/pcm_native.c +15 -4
@@ -24,6 +24,7 @@#include <sound/minors.h> #include <linux/uio.h> #include <linux/delay.h> +#include <linux/bitops.h> #include "pcm_local.h"
@@ -3123,13 +3124,23 @@ struct snd_pcm_sync_ptr32 {static snd_pcm_uframes_t recalculate_boundary (struct snd_pcm_runtime *runtime) {snd_pcm_uframes_t boundary; +snd_pcm_uframes_t border; +int order;if (! runtime->buffer_size)return 0 ; - boundary = runtime->buffer_size; -while (boundary *2 <=0x7fffffffUL - runtime->buffer_size) - boundary *=2 ; -return boundary; + + border =0x7fffffffUL - runtime->buffer_size; +if (runtime->buffer_size > border) +return runtime->buffer_size; + + order =__fls (border) -__fls (runtime->buffer_size); + boundary = runtime->buffer_size << order; + +if (boundary <= border) +return boundary; +else +return boundary /2 ; } static int snd_pcm_ioctl_sync_ptr_compat(struct snd_pcm_substream *substream,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/482 ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit fd3ab72e42e9871a9902b945a2bf8bb87b49c718 ]
Fix all macro related issues identified by checkpatch.pl:
CHECK: Macro argument 'x' may be better as '(x)' to avoid precedence issues
--- sound/usb/mixer_quirks.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
sound/usb/mixer_quirks.c +7 -7
@@ -2150,15 +2150,15 @@ static int dell_dock_mixer_init(struct usb_mixer_interface *mixer)#define SND_RME_CLK_FREQMUL_SHIFT 18#define SND_RME_CLK_FREQMUL_MASK 0x7#define SND_RME_CLK_SYSTEM (x) \ - ((x >> SND_RME_CLK_SYSTEM_SHIFT) & SND_RME_CLK_SYSTEM_MASK) + (((x) >> SND_RME_CLK_SYSTEM_SHIFT) & SND_RME_CLK_SYSTEM_MASK)#define SND_RME_CLK_AES (x) \ - ((x >> SND_RME_CLK_AES_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK) + (((x) >> SND_RME_CLK_AES_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK)#define SND_RME_CLK_SPDIF (x) \ - ((x >> SND_RME_CLK_SPDIF_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK) + (((x) >> SND_RME_CLK_SPDIF_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK)#define SND_RME_CLK_SYNC (x) \ - ((x >> SND_RME_CLK_SYNC_SHIFT) & SND_RME_CLK_SYNC_MASK) + (((x) >> SND_RME_CLK_SYNC_SHIFT) & SND_RME_CLK_SYNC_MASK)#define SND_RME_CLK_FREQMUL (x) \ - ((x >> SND_RME_CLK_FREQMUL_SHIFT) & SND_RME_CLK_FREQMUL_MASK) + (((x) >> SND_RME_CLK_FREQMUL_SHIFT) & SND_RME_CLK_FREQMUL_MASK)#define SND_RME_CLK_AES_LOCK 0x1#define SND_RME_CLK_AES_SYNC 0x4#define SND_RME_CLK_SPDIF_LOCK 0x2
@@ -2167,9 +2167,9 @@ static int dell_dock_mixer_init(struct usb_mixer_interface *mixer)#define SND_RME_SPDIF_FORMAT_SHIFT 5#define SND_RME_BINARY_MASK 0x1#define SND_RME_SPDIF_IF (x) \ - ((x >> SND_RME_SPDIF_IF_SHIFT) & SND_RME_BINARY_MASK) + (((x) >> SND_RME_SPDIF_IF_SHIFT) & SND_RME_BINARY_MASK)#define SND_RME_SPDIF_FORMAT (x) \ - ((x >> SND_RME_SPDIF_FORMAT_SHIFT) & SND_RME_BINARY_MASK) + (((x) >> SND_RME_SPDIF_FORMAT_SHIFT) & SND_RME_BINARY_MASK)static const u32 snd_rme_rate_table[] = {32000 ,44100 ,48000 ,50000 ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/482 iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Santos <[email protected]>
[ Upstream commit 7e54d932873d91a55d1b89b7389876d78aeeab32 ]
The SYNC_IN pulse width must be at least 1.5 x Tmclk, corresponding to ~2.5 µs at the lowest supported MCLK frequency. Add a 3 µs delay to ensure reliable synchronization timing even for the worst-case scenario.
--- drivers/iio/adc/ad7768-1.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/iio/adc/ad7768-1.c +19 -4
@@ -203,6 +203,24 @@ static int ad7768_spi_reg_write(struct ad7768_state *st,return spi_write (st->spi, st->data.d8,2 ); } +static int ad7768_send_sync_pulse (struct ad7768_state *st) +{ +/* +* The datasheet specifies a minimum SYNC_IN pulse width of 1.5 × Tmclk, +* where Tmclk is the MCLK period. The supported MCLK frequencies range +* from 0.6 MHz to 17 MHz, which corresponds to a minimum SYNC_IN pulse +* width of approximately 2.5 µs in the worst-case scenario (0.6 MHz). +* +* Add a delay to ensure the pulse width is always sufficient to +* trigger synchronization. +*/ +gpiod_set_value_cansleep (st->gpio_sync_in,1 ); +fsleep (3 ); +gpiod_set_value_cansleep (st->gpio_sync_in,0 ); + +return 0 ; +} +static int ad7768_set_mode (struct ad7768_state *st,enum ad7768_conv_mode mode) {
@@ -288,10 +306,7 @@ static int ad7768_set_dig_fil(struct ad7768_state *st,return ret;/* A sync-in pulse is required every time the filter dec rate changes */ -gpiod_set_value (st->gpio_sync_in,1 ); -gpiod_set_value (st->gpio_sync_in,0 ); - -return 0 ; +return ad7768_send_sync_pulse (st); } static int ad7768_set_freq(struct ad7768_state *st,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/482 ASoC: codecs: rt5640: Retry DEVICE_ID verification
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xinxin Wan <[email protected]>
[ Upstream commit 19f971057b2d7b99c80530ec1052b45de236a8da ]
To be more resilient to codec-detection failures when the hardware powers on slowly, add retry mechanism to the device verification check. Similar pattern is found throughout a number of Realtek codecs. Our tests show that 60ms delay is sufficient to address readiness issues on rt5640 chip.
--- sound/soc/codecs/rt5640.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/codecs/rt5640.c +5 -0
@@ -3026,6 +3026,11 @@ static int rt5640_i2c_probe(struct i2c_client *i2c) }regmap_read (rt5640->regmap,RT5640_VENDOR_ID2 , &val); +if (val !=RT5640_DEVICE_ID ) { +usleep_range (60000 ,100000 ); +regmap_read (rt5640->regmap,RT5640_VENDOR_ID2 , &val); + } +if (val !=RT5640_DEVICE_ID ) {dev_err (&i2c->dev,"Device with ID register %#x is not rt5640/39\n" , val);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/482 xen/netfront: Fix TX response spurious interrupts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthoine Bourgeois <[email protected]>
[ Upstream commit 114a2de6fa86d99ed9546cc9113a3cad58beef79 ]
We found at Vates that there are lot of spurious interrupts when benchmarking the xen-net PV driver frontend. This issue appeared with a patch that addresses security issue XSA-391 (b27d47950e48 "xen/netfront:
harden netfront against event channel storms"). On an iperf benchmark, spurious interrupts can represent up to 50% of the interrupts.
Spurious interrupts are interrupts that are rised for nothing, there is no work to do. This appends because the function that handles the interrupts ("xennet_tx_buf_gc") is also called at the end of the request path to garbage collect the responses received during the transmission load.
The request path is doing the work that the interrupt handler should have done otherwise. This is particurary true when there is more than one vcpu and get worse linearly with the number of vcpu/queue.
Moreover, this problem is amplifyed by the penalty imposed by a spurious interrupt. When an interrupt is found spurious the interrupt chip will delay the EOI to slowdown the backend. This delay will allow more responses to be handled by the request path and then there will be more chance the next interrupt will not find any work to do, creating a new spurious interrupt.
This causes performance issue. The solution here is to remove the calls from the request path and let the interrupt handler do the processing of the responses. This approch removes most of the spurious interrupts (<0.05%) and also has the benefit of freeing up cycles in the request path, allowing it to process more work, which improves performance compared to masking the spurious interrupt one way or another.
This optimization changes a part of the code that is present since the net frontend driver was upstreamed. There is no similar pattern in the other xen PV drivers. Since the first commit of xen-netfront is a blob that doesn't explain all the design choices I can only guess why this specific mecanism was here. This could have been introduce to compensate a slow backend at the time (maybe the backend was fixed or optimize later) or a small queue. In 18 years, both frontend and backend gain lot of features and optimizations that could have obsolete the feature of reaping completions from the TX path.
Some vif throughput performance figures from a 8 vCPUs, 4GB of RAM HVM guest(s):
Without this patch on the :
vm -> dom0: 4.5Gb/s
vm -> vm: 7.0Gb/s
Without XSA-391 patch (revert of b27d47950e48):
vm -> dom0: 8.3Gb/s
vm -> vm: 8.7Gb/s
With XSA-391 and this patch:
vm -> dom0: 11.5Gb/s
vm -> vm: 12.6Gb/s
v2:
- add revewed and tested by tags
- resend with the maintainers in the recipients list
v3:
- remove Fixes tag but keep the commit ref in the explanation
- add a paragraph on why this code was here
Message-ID: <[email protected]>
--- drivers/net/xen-netfront.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/net/xen-netfront.c +0 -5
@@ -637,8 +637,6 @@ static int xennet_xdp_xmit_one(struct net_device *dev, tx_stats->packets++;u64_stats_update_end (&tx_stats->syncp); -xennet_tx_buf_gc (queue); -return 0 ; }
@@ -848,9 +846,6 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev tx_stats->packets++;u64_stats_update_end (&tx_stats->syncp); -/* Note: It is not safe to access skb after xennet_tx_buf_gc()! */ -xennet_tx_buf_gc (queue); -if (!netfront_tx_slot_available (queue))netif_tx_stop_queue (netdev_get_tx_queue (dev, queue->id));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/482 net: usb: cdc-ncm: check for filtering capability
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 61c3e8940f2d8b5bfeaeec4bedc2f3e7d873abb3 ]
If the decice does not support filtering, filtering must not be used and all packets delivered for the upper layers to sort.
--- drivers/net/usb/cdc_ncm.c | 20 ++++++++++++++++---- include/linux/usb/cdc_ncm.h | 1 + 2 files changed, 17 insertions(+), 4 deletions(-)
drivers/net/usb/cdc_ncm.c +16 -4
@@ -892,6 +892,10 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ } } +if (ctx->func_desc) + ctx->filtering_supported = !!(ctx->func_desc->bmNetworkCapabilities + &USB_CDC_NCM_NCAP_ETH_FILTER ); + iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;/* Device-specific flags */
@@ -1897,6 +1901,14 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb) } } +static void cdc_ncm_update_filter (struct usbnet *dev) +{ +struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0 ]; + +if (ctx->filtering_supported) +usbnet_cdc_update_filter (dev); +} +static const struct driver_info cdc_ncm_info = { .description ="CDC NCM (NO ZLP)" , .flags =FLAG_POINTTOPOINT |FLAG_NO_SETINT |FLAG_MULTI_PACKET
@@ -1907,7 +1919,7 @@ static const struct driver_info cdc_ncm_info = { .status = cdc_ncm_status, .rx_fixup = cdc_ncm_rx_fixup, .tx_fixup = cdc_ncm_tx_fixup, - .set_rx_mode = usbnet_cdc_update_filter, + .set_rx_mode = cdc_ncm_update_filter, };/* Same as cdc_ncm_info, but with FLAG_SEND_ZLP */
@@ -1921,7 +1933,7 @@ static const struct driver_info cdc_ncm_zlp_info = { .status = cdc_ncm_status, .rx_fixup = cdc_ncm_rx_fixup, .tx_fixup = cdc_ncm_tx_fixup, - .set_rx_mode = usbnet_cdc_update_filter, + .set_rx_mode = cdc_ncm_update_filter, };/* Same as cdc_ncm_info, but with FLAG_WWAN */
@@ -1935,7 +1947,7 @@ static const struct driver_info wwan_info = { .status = cdc_ncm_status, .rx_fixup = cdc_ncm_rx_fixup, .tx_fixup = cdc_ncm_tx_fixup, - .set_rx_mode = usbnet_cdc_update_filter, + .set_rx_mode = cdc_ncm_update_filter, };/* Same as wwan_info, but with FLAG_NOARP */
@@ -1949,7 +1961,7 @@ static const struct driver_info wwan_noarp_info = { .status = cdc_ncm_status, .rx_fixup = cdc_ncm_rx_fixup, .tx_fixup = cdc_ncm_tx_fixup, - .set_rx_mode = usbnet_cdc_update_filter, + .set_rx_mode = cdc_ncm_update_filter, };static const struct usb_device_id cdc_devs[] = {
include/linux/usb/cdc_ncm.h +1 -0
@@ -119,6 +119,7 @@ struct cdc_ncm_ctx {u32 timer_interval;u32 max_ndp_size;u8 is_ndp16; +u8 filtering_supported;union {struct usb_cdc_ncm_ndp16 *delayed_ndp16;struct usb_cdc_ncm_ndp32 *delayed_ndp32;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/482 ktest.pl: Prevent recursion of default variable options
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit 61f7e318e99d3b398670518dd3f4f8510d1800fc ]
If a default variable contains itself, do not recurse on it.
For example:
ADD_CONFIG := ${CONFIG_DIR}/temp_config
DEFAULTS
ADD_CONFIG = ${CONFIG_DIR}/default_config ${ADD_CONFIG}The above works because the temp variable ADD_CONFIG (is a temp because it is created with ":=") is already defined, it will be substituted in the variable option. But if it gets commented out:
# ADD_CONFIG := ${CONFIG_DIR}/temp_config
DEFAULTS
ADD_CONFIG = ${CONFIG_DIR}/default_config ${ADD_CONFIG}Then the above will go into a recursive loop where ${ADD_CONFIG} will get replaced with the current definition of ADD_CONFIG which contains the ${ADD_CONFIG} and that will also try to get converted. ktest.pl will error after 100 attempts of recursion and fail.
When replacing a variable with the default variable, if the default variable contains itself, do not replace it.
--- tools/testing/ktest/ktest.pl | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/testing/ktest/ktest.pl +4 -1
@@ -1351,7 +1351,10 @@ sub __eval_option { # If a variable contains itself, use the default var if (($var eq $name) && defined($opt{$var})) { $o = $opt{$var}; - $retval = "$retval$o"; + # Only append if the default doesn't contain itself + if ($o !~ m/\$\{$var\}/) { + $retval = "$retval$o"; + } } elsif (defined($opt{$o})) { $o = $opt{$o}; $retval = "$retval$o";
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/482 wifi: cfg80211: reject HTC bit for management frames
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit be06a8c7313943109fa870715356503c4c709cbc ]
Management frames sent by userspace should never have the order/HTC bit set, reject that. It could also cause some confusion with the length of the buffer and the header so the validation might end up wrong.
--- net/wireless/mlme.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/wireless/mlme.c +2 -1
@@ -700,7 +700,8 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev, mgmt = (const struct ieee80211_mgmt *)params->buf; -if (!ieee80211_is_mgmt (mgmt->frame_control)) +if (!ieee80211_is_mgmt (mgmt->frame_control) || +ieee80211_has_order (mgmt->frame_control))return -EINVAL ; stype =le16_to_cpu (mgmt->frame_control) &IEEE80211_FCTL_STYPE ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/482 s390/time: Use monotonic clock in get_cycles()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Schnelle <[email protected]>
[ Upstream commit 09e7e29d2b49ba84bcefb3dc1657726d2de5bb24 ]
Otherwise the code might not work correctly when the clock is changed.
--- arch/s390/include/asm/timex.h | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
arch/s390/include/asm/timex.h +6 -7
@@ -192,13 +192,6 @@ static inline unsigned long get_tod_clock_fast(void) asmvolatile ("stckf %0" :"=Q" (clk) : :"cc" );return clk; } - -static inline cycles_t get_cycles (void ) -{ -return (cycles_t )get_tod_clock () >>2 ; -} -#define get_cycles get_cycles -int get_phys_clock (unsigned long *clock);void init_cpu_timer (void );
@@ -221,6 +214,12 @@ static inline unsigned long get_tod_clock_monotonic(void)return tod; } +static inline cycles_t get_cycles (void ) +{ +return (cycles_t )get_tod_clock_monotonic () >>2 ; +} +#define get_cycles get_cycles +/** * tod_to_ns - convert a TOD format value to nanoseconds * @todval: to be converted TOD format value
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/482 be2net: Use correct byte order and format string for TCP seq and ack_seq
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 4701ee5044fb3992f1c910630a9673c2dc600ce5 ]
The TCP header fields seq and ack_seq are 32-bit values in network byte order as (__be32). these fields were earlier printed using ntohs(), which converts only 16-bit values and produces incorrect results for 32-bit fields. This patch is changeing the conversion to ntohl(), ensuring correct interpretation of these sequence numbers.
Notably, the format specifier is updated from %d to %u to reflect the unsigned nature of these fields.
improves the accuracy of debug log messages for TCP sequence and acknowledgment numbers during TX timeouts.
--- drivers/net/ethernet/emulex/benet/be_main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/emulex/benet/be_main.c +4 -4
@@ -1466,10 +1466,10 @@ static void be_tx_timeout(struct net_device *netdev, unsigned int txqueue) ntohs(tcphdr->source));dev_info (dev,"TCP dest port %d\n" ,ntohs (tcphdr->dest)); -dev_info (dev,"TCP sequence num %d\n" , -ntohs (tcphdr->seq)); -dev_info (dev,"TCP ack_seq %d\n" , -ntohs (tcphdr->ack_seq)); +dev_info (dev,"TCP sequence num %u\n" , +ntohl (tcphdr->seq)); +dev_info (dev,"TCP ack_seq %u\n" , +ntohl (tcphdr->ack_seq)); }else if (ip_hdr (skb)->protocol ==IPPROTO_UDP ) { udphdr =udp_hdr (skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/482 wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
[ Upstream commit 671be46afd1f03de9dc6e4679c88e1a7a81cdff6 ]
This read_poll_timeout_atomic() with a delay of 1 µs and a timeout of 1000000 µs can take ~250 seconds in the worst case because sending a USB control message takes ~250 µs.
Lower the timeout to 4000 for USB in order to reduce the maximum polling time to ~1 second.
This problem was observed with RTL8851BU while suspending to RAM with WOWLAN enabled. The computer sat for 4 minutes with a black screen before suspending.
--- drivers/net/wireless/realtek/rtw89/fw.c | 9 +++++++-- drivers/net/wireless/realtek/rtw89/fw.h | 2 ++ 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw89/fw.c +7 -2
@@ -2397,13 +2397,18 @@ static int rtw89_fw_read_c2h_reg(struct rtw89_dev *rtwdev, {const struct rtw89_chip_info *chip = rtwdev->chip;const u32 *c2h_reg = chip->c2h_regs; -u32 ret; +u32 ret, timeout;u8 i, val; info->id =RTW89_FWCMD_C2HREG_FUNC_NULL ; +if (rtwdev->hci.type ==RTW89_HCI_TYPE_USB ) + timeout =RTW89_C2H_TIMEOUT_USB ; +else + timeout =RTW89_C2H_TIMEOUT ; + ret =read_poll_timeout_atomic (rtw89_read8, val, val,1 , -RTW89_C2H_TIMEOUT , false, rtwdev, + timeout, false, rtwdev, chip->c2h_ctrl_reg);if (ret) {rtw89_warn (rtwdev,"c2h reg timeout\n" );
drivers/net/wireless/realtek/rtw89/fw.h +2 -0
@@ -33,6 +33,8 @@ enum rtw89_fw_dl_status {#define RTW89_C2HREG_HDR_LEN 2#define RTW89_H2CREG_HDR_LEN 2#define RTW89_C2H_TIMEOUT 1000000 +#define RTW89_C2H_TIMEOUT_USB 4000 +struct rtw89_mac_c2h_info {u8 id;u8 content_len;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/482 et131x: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit d61f6cb6f6ef3c70d2ccc0d9c85c508cb8017da9 ]
The DMA map functions can fail and should be tested for errors. If the mapping fails, unmap and return an error.
--- drivers/net/ethernet/agere/et131x.c | 36 +++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+)
drivers/net/ethernet/agere/et131x.c +36 -0
@@ -2459,6 +2459,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) skb->data,skb_headlen (skb), DMA_TO_DEVICE); +if (dma_mapping_error (&adapter->pdev->dev, + dma_addr)) +return -ENOMEM ; + desc[frag].addr_lo =lower_32_bits (dma_addr); desc[frag].addr_hi =upper_32_bits (dma_addr); frag++;
@@ -2468,6 +2472,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) skb->data,skb_headlen (skb) /2 , DMA_TO_DEVICE); +if (dma_mapping_error (&adapter->pdev->dev, + dma_addr)) +return -ENOMEM ; + desc[frag].addr_lo =lower_32_bits (dma_addr); desc[frag].addr_hi =upper_32_bits (dma_addr); frag++;
@@ -2478,6 +2486,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb)skb_headlen (skb) /2 ,skb_headlen (skb) /2 , DMA_TO_DEVICE); +if (dma_mapping_error (&adapter->pdev->dev, + dma_addr)) + goto unmap_first_out; + desc[frag].addr_lo =lower_32_bits (dma_addr); desc[frag].addr_hi =upper_32_bits (dma_addr); frag++;
@@ -2489,6 +2501,9 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb)0 , desc[frag].len_vlan, DMA_TO_DEVICE); +if (dma_mapping_error (&adapter->pdev->dev, dma_addr)) + goto unmap_out; + desc[frag].addr_lo =lower_32_bits (dma_addr); desc[frag].addr_hi =upper_32_bits (dma_addr); frag++;
@@ -2578,6 +2593,27 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb) &adapter->regs->global.watchdog_timer); }return 0 ; + +unmap_out: +// Unmap the body of the packet with map_page +while (--i) { + frag--; + dma_addr = desc[frag].addr_lo; + dma_addr |= (u64 )desc[frag].addr_hi <<32 ; +dma_unmap_page (&adapter->pdev->dev, dma_addr, + desc[frag].len_vlan,DMA_TO_DEVICE ); + } + +unmap_first_out: +// Unmap the header with map_single +while (frag--) { + dma_addr = desc[frag].addr_lo; + dma_addr |= (u64 )desc[frag].addr_hi <<32 ; +dma_unmap_single (&adapter->pdev->dev, dma_addr, + desc[frag].len_vlan,DMA_TO_DEVICE ); + } + +return -ENOMEM ; }static int send_packet (struct sk_buff *skb,struct et131x_adapter *adapter)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/482 net: ag71xx: Add missing check after DMA map
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit 96a1e15e60216b52da0e6da5336b6d7f5b0188b0 ]
The DMA map functions can fail and should be tested for errors.
--- drivers/net/ethernet/atheros/ag71xx.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/atheros/ag71xx.c +9 -0
@@ -1234,6 +1234,11 @@ static bool ag71xx_fill_rx_buf(struct ag71xx *ag, struct ag71xx_buf *buf, buf->rx.rx_buf = data; buf->rx.dma_addr =dma_map_single (&ag->pdev->dev, data, ag->rx_buf_size,DMA_FROM_DEVICE ); +if (dma_mapping_error (&ag->pdev->dev, buf->rx.dma_addr)) { +skb_free_frag (data); + buf->rx.rx_buf =NULL ; +return false; + } desc->data = (u32 )buf->rx.dma_addr + offset;return true; }
@@ -1532,6 +1537,10 @@ static netdev_tx_t ag71xx_hard_start_xmit(struct sk_buff *skb, dma_addr =dma_map_single (&ag->pdev->dev, skb->data, skb->len,DMA_TO_DEVICE ); +if (dma_mapping_error (&ag->pdev->dev, dma_addr)) { +netif_dbg (ag, tx_err, ndev,"DMA mapping error\n" ); + goto err_drop; + } i = ring->curr & ring_mask; desc =ag71xx_ring_desc (ring, i);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/482 net/mlx5e: Properly access RCU protected qdisc_sleeping variable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 2a601b2d35623065d31ebaf697b07502d54878c9 ]
qdisc_sleeping variable is declared as "struct Qdisc __rcu" and as such needs proper annotation while accessing it.
Without rtnl_dereference(), the following error is generated by sparse:
drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: warning:
incorrect type in initializer (different address spaces)drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: expected
struct Qdisc *qdiscdrivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: got struct
Qdisc [noderef] __rcu *qdisc_sleeping
--- drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/qos.c +1 -1
@@ -362,7 +362,7 @@ void mlx5e_reactivate_qos_sq(struct mlx5e_priv *priv, u16 qid, struct netdev_quevoid mlx5e_reset_qdisc (struct net_device *dev,u16 qid) {struct netdev_queue *dev_queue =netdev_get_tx_queue (dev, qid); -struct Qdisc *qdisc = dev_queue->qdisc_sleeping; +struct Qdisc *qdisc =rtnl_dereference (dev_queue->qdisc_sleeping);if (!qdisc)return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/482 arm64: Mark kernel as tainted on SAE and SError panic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit d7ce7e3a84642aadf7c4787f7ec4f58eb163d129 ]
Set TAINT_MACHINE_CHECK when SError or Synchronous External Abort (SEA) interrupts trigger a panic to flag potential hardware faults. This tainting mechanism aids in debugging and enables correlation of hardware-related crashes in large-scale deployments.
This change aligns with similar patches[1] that mark machine check events when the system crashes due to hardware errors.
--- arch/arm64/kernel/traps.c | 1 + arch/arm64/mm/fault.c | 1 + 2 files changed, 2 insertions(+)
arch/arm64/kernel/traps.c +1 -0
@@ -911,6 +911,7 @@ void panic_bad_stack(struct pt_regs *regs, unsigned long esr, unsigned long far)void __noreturn arm64_serror_panic (struct pt_regs *regs,unsigned long esr) { +add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_STILL_OK );console_verbose (); pr_crit("SError Interrupt on CPU%d, code 0x%016lx -- %s\n",
arch/arm64/mm/fault.c +1 -0
@@ -710,6 +710,7 @@ static int do_sea(unsigned long far, unsigned long esr, struct pt_regs *regs)*/ siaddr =untagged_addr (far); } +add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_STILL_OK );arm64_notify_die (inf->name, regs, inf->sig, inf->code, siaddr, esr);return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/482 rcu: Protect ->defer_qs_iw_pending from data race
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit 90c09d57caeca94e6f3f87c49e96a91edd40cbfd ]
On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest.
In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally.
The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat:
------------------------------------------------------------------------
BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special
read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8:
rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30
write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8:
rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30
no locks held by irq_work/8/88.
irq event stamp: 200272 hardirqs last enabled at (200272): [<ffffffffb0f56121>] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [<ffffffffb25c7859>] __schedule+0x129/0xd70 softirqs last enabled at (0): [<ffffffffb0ee093f>] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0
------------------------------------------------------------------------
The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field.
This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path.
--- kernel/rcu/tree_plugin.h | 3 +++ 1 file changed, 3 insertions(+)
kernel/rcu/tree_plugin.h +3 -0
@@ -612,10 +612,13 @@ notrace void rcu_preempt_deferred_qs(struct task_struct *t)*/ static void rcu_preempt_deferred_qs_handler (struct irq_work *iwp) { +unsigned long flags;struct rcu_data *rdp; rdp = container_of(iwp, struct rcu_data, defer_qs_iw); +local_irq_save (flags); rdp->defer_qs_iw_pending = false; +local_irq_restore (flags); }/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/482 net: mctp: Prevent duplicate binds
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Johnston <[email protected]>
[ Upstream commit 3954502377ec05a1b37e2dc9bef0bacd4bbd71b2 ]
Disallow bind() calls that have the same arguments as existing bound sockets. Previously multiple sockets could bind() to the same type/local address, with an arbitrary socket receiving matched messages.
This is only a partial fix, a future commit will define precedence order for MCTP_ADDR_ANY versus specific EID bind(), which are allowed to exist together.
--- net/mctp/af_mctp.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-)
net/mctp/af_mctp.c +23 -3
@@ -73,7 +73,6 @@ static int mctp_bind(struct socket *sock, struct sockaddr *addr, int addrlen)lock_sock (sk); -/* TODO: allow rebind */ if (sk_hashed (sk)) { rc = -EADDRINUSE ; goto out_release;
@@ -550,15 +549,36 @@ static void mctp_sk_close(struct sock *sk, long timeout)static int mctp_sk_hash (struct sock *sk) {struct net *net =sock_net (sk); +struct sock *existing; +struct mctp_sock *msk; +int rc; + + msk = container_of(sk, struct mctp_sock, sk);/* Bind lookup runs under RCU, remain live during that. */ sock_set_flag (sk,SOCK_RCU_FREE );mutex_lock (&net->mctp.bind_lock); + +/* Prevent duplicate binds. */ +sk_for_each (existing, &net->mctp.binds) { +struct mctp_sock *mex = + container_of(existing, struct mctp_sock, sk); + +if (mex->bind_type == msk->bind_type && + mex->bind_addr == msk->bind_addr && + mex->bind_net == msk->bind_net) { + rc = -EADDRINUSE ; + goto out; + } + } +sk_add_node_rcu (sk, &net->mctp.binds); -mutex_unlock (&net->mctp.bind_lock); + rc =0 ; -return 0 ; +out: +mutex_unlock (&net->mctp.bind_lock); +return rc; }static void mctp_sk_unhash (struct sock *sk)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/482 wifi: cfg80211: Fix interface type validation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit 14450be2332a49445106403492a367412b8c23f4 ]
Fix a condition that verified valid values of interface types.
--- include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/cfg80211.h +1 -1
@@ -559,7 +559,7 @@ ieee80211_get_sband_iftype_data(const struct ieee80211_supported_band *sband, {int i; -if (WARN_ON (iftype >=NL80211_IFTYPE_MAX )) +if (WARN_ON (iftype >=NUM_NL80211_IFTYPES ))return NULL ;if (iftype ==NL80211_IFTYPE_AP_VLAN )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/482 net: ipv4: fix incorrect MTU in broadcast routes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oscar Maes <[email protected]>
[ Upstream commit 9e30ecf23b1b8f091f7d08b27968dea83aae7908 ]
Currently, __mkroute_output overrules the MTU value configured for broadcast routes.
This buggy behaviour can be reproduced with:
ip link set dev eth1 mtu 9000
ip route del broadcast 192.168.0.255 dev eth1 proto kernel scope link src 192.168.0.2 ip route add broadcast 192.168.0.255 dev eth1 proto kernel scope link src 192.168.0.2 mtu 1500
The maximum packet size should be 1500, but it is actually 8000:
ping -b 192.168.0.255 -s 8000
Fix __mkroute_output to allow MTU values to be configured for for broadcast routes (to support a mixed-MTU local-area-network).
--- net/ipv4/route.c | 1 - 1 file changed, 1 deletion(-)
net/ipv4/route.c +0 -1
@@ -2562,7 +2562,6 @@ static struct rtable *__mkroute_output(const struct fib_result *res, do_cache = true;if (type ==RTN_BROADCAST ) { flags |=RTCF_BROADCAST |RTCF_LOCAL ; - fi =NULL ; } else if (type == RTN_MULTICAST) { flags |= RTCF_MULTICAST | RTCF_LOCAL; if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/482 net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 53d20606c40678d425cc03f0978c614dca51f25e ]
The buffer bgx_sel used in snprintf() was too small to safely hold the formatted string "BGX%d" for all valid bgx_id values. This caused a -Wformat-truncation warning with Werror enabled during build.
Increase the buffer size from 5 to 7 and use sizeof(bgx_sel) in snprintf() to ensure safety and suppress the warning.
Build warning:
CC drivers/net/ethernet/cavium/thunder/thunder_bgx.o
drivers/net/ethernet/cavium/thunder/thunder_bgx.c: In function
‘bgx_acpi_match_id’:
drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1434:27: error: ‘%d’
directive output may be truncated writing between 1 and 3 bytes into a region of size 2 [-Werror=format-truncation=]
snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id);
^~
drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1434:23: note:
directive argument in the range [0, 255]
snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id);
^~~~~~~
drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1434:2: note:
‘snprintf’ output between 5 and 7 bytes into a destination of size 5
snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id);compiler warning due to insufficient snprintf buffer size.
--- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/cavium/thunder/thunder_bgx.c +2 -2
@@ -1428,9 +1428,9 @@ static acpi_status bgx_acpi_match_id(acpi_handle handle, u32 lvl, {struct acpi_buffer string = {ACPI_ALLOCATE_BUFFER ,NULL };struct bgx *bgx = context; -char bgx_sel[5 ]; +char bgx_sel[7 ]; -snprintf (bgx_sel,5 ,"BGX%d" , bgx->bgx_id); +snprintf (bgx_sel,sizeof (bgx_sel),"BGX%d" , bgx->bgx_id);if (ACPI_FAILURE (acpi_get_name (handle,ACPI_SINGLE_NAME , &string))) {pr_warn ("Invalid link device\n" );return AE_OK ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/482 um: Re-evaluate thread flags repeatedly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit b9e2f2246eb2b5617d53af7b5e4e1b8c916f26a8 ]
The thread flags may change during their processing.
For example a task_work can queue a new signal to be sent. This signal should be delivered before returning to usespace again.
Evaluate the flags repeatedly similar to other architectures.
--- arch/um/include/asm/thread_info.h | 4 ++++ arch/um/kernel/process.c | 20 ++++++++++++-------- 2 files changed, 16 insertions(+), 8 deletions(-)
arch/um/include/asm/thread_info.h +4 -0
@@ -68,7 +68,11 @@ static inline struct thread_info *current_thread_info(void)#define _TIF_NOTIFY_SIGNAL (1 << TIF_NOTIFY_SIGNAL)#define _TIF_MEMDIE (1 << TIF_MEMDIE)#define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT) +#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)#define _TIF_SECCOMP (1 << TIF_SECCOMP)#define _TIF_SINGLESTEP (1 << TIF_SINGLESTEP) +#define _TIF_WORK_MASK (_TIF_NEED_RESCHED | _TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL | \ + _TIF_NOTIFY_RESUME) +#endif
arch/um/kernel/process.c +12 -8
@@ -97,14 +97,18 @@ void *__switch_to(struct task_struct *from, struct task_struct *to)void interrupt_end (void ) {struct pt_regs *regs = ¤t->thread.regs; - -if (need_resched ()) -schedule (); -if (test_thread_flag (TIF_SIGPENDING ) || -test_thread_flag (TIF_NOTIFY_SIGNAL )) -do_signal (regs); -if (test_thread_flag (TIF_NOTIFY_RESUME )) -resume_user_mode_work (regs); +unsigned long thread_flags; + + thread_flags =read_thread_flags (); +while (thread_flags & _TIF_WORK_MASK) { +if (thread_flags & _TIF_NEED_RESCHED) +schedule (); +if (thread_flags & (_TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL)) +do_signal (regs); +if (thread_flags & _TIF_NOTIFY_RESUME) +resume_user_mode_work (regs); + thread_flags =read_thread_flags (); + } }int get_current_pid (void )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/482 wifi: iwlwifi: mvm: fix scan request validation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit 7c2f3ec7707188d8d5269ae2dce97d7be3e9f261 ]
The scan request validation function uses bitwise and instead of logical and. Fix it.
--- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/scan.c +1 -1
@@ -822,7 +822,7 @@ static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids, int n_channels) { return ((n_ssids <= PROBE_OPTION_MAX) && - (n_channels <= mvm->fw->ucode_capa.n_scan_channels) & + (n_channels <= mvm->fw->ucode_capa.n_scan_channels) && (ies->common_ie_len + ies->len[NL80211_BAND_2GHZ] + ies->len[NL80211_BAND_5GHZ] + ies->len[NL80211_BAND_6GHZ] <=
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 131/482 s390/stp: Remove udelay from stp_sync_clock()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Schnelle <[email protected]>
[ Upstream commit b367017cdac21781a74eff4e208d3d38e1f38d3f ]
When an stp sync check is handled on a system with multiple cpus each cpu gets a machine check but only the first one actually handles the sync operation. All other CPUs spin waiting for the first one to finish with a short udelay(). But udelay can't be used here as the first CPU modifies tod_clock_base before performing the sync op. During this timeframe get_tod_clock_monotonic() might return a non-monotonic time.
The time spent waiting should be very short and udelay is a busy loop anyways, therefore simply remove the udelay.
--- arch/s390/kernel/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/time.c +1 -1
@@ -574,7 +574,7 @@ static int stp_sync_clock(void *data)atomic_dec (&sync->cpus);/* Wait for in_sync to be set. */ while (READ_ONCE (sync->in_sync) ==0 ) -__udelay (1 ); + ; }if (sync->in_sync !=1 )/* Didn't work. Clear per-cpu in sync bit again. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 132/482 sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <[email protected]>
[ Upstream commit 155213a2aed42c85361bf4f5c817f5cb68951c3b ]
schbench (https://github.com/masoncl/schbench.git) is showing a regression from previous production kernels that bisected down to:
sched/fair: Remove sysctl_sched_migration_cost condition (c5b0a7eefc)
The schbench command line was:
schbench -L -m 4 -M auto -t 256 -n 0 -r 0 -s 0
This creates 4 message threads pinned to CPUs 0-3, and 256x4 worker threads spread across the rest of the CPUs. Neither the worker threads or the message threads do any work, they just wake each other up and go back to sleep as soon as possible.
The end result is the first 4 CPUs are pegged waking up those 1024 workers, and the rest of the CPUs are constantly banging in and out of idle. If I take a v6.9 Linus kernel and revert that one commit, performance goes from 3.4M RPS to 5.4M RPS.
schedstat shows there are ~100x more new idle balance operations, and profiling shows the worker threads are spending ~20% of their CPU time on new idle balance. schedstats also shows that almost all of these new idle balance attemps are failing to find busy groups.
The fix used here is to crank up the cost of the newidle balance whenever it fails. Since we don't want sd->max_newidle_lb_cost to grow out of control, this also changes update_newidle_cost() to use sysctl_sched_migration_cost as the upper limit on max_newidle_lb_cost.
--- kernel/sched/fair.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
kernel/sched/fair.c +16 -3
@@ -10941,8 +10941,14 @@ static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost)/* * Track max cost of a domain to make sure to not delay the * next wakeup on the CPU. +* +* sched_balance_newidle() bumps the cost whenever newidle +* balance fails, and we don't want things to grow out of +* control. Use the sysctl_sched_migration_cost as the upper +* limit, plus a litle extra to avoid off by ones. */ - sd->max_newidle_lb_cost = cost; + sd->max_newidle_lb_cost = +min (cost, sysctl_sched_migration_cost +200 ); sd->last_decay_max_lb_cost = jiffies; }else if (time_after (jiffies, sd->last_decay_max_lb_cost +HZ )) {/*
@@ -11624,10 +11630,17 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) t1 =sched_clock_cpu (this_cpu); domain_cost = t1 - t0; -update_newidle_cost (sd, domain_cost); - curr_cost += domain_cost; t0 = t1; + +/* +* Failing newidle means it is not effective; +* bump the cost so we end up doing less of it. +*/ +if (!pulled_task) + domain_cost = (3 * sd->max_newidle_lb_cost) /2 ; + +update_newidle_cost (sd, domain_cost); }/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 133/482 wifi: mac80211: dont complete management TX on SAE commit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 6b04716cdcac37bdbacde34def08bc6fdb5fc4e2 ]
When SAE commit is sent and received in response, there's no ordering for the SAE confirm messages. As such, don't call drivers to stop listening on the channel when the confirm message is still expected.
This fixes an issue if the local confirm is transmitted later than the AP's confirm, for iwlwifi (and possibly mt76) the AP's confirm would then get lost since the device isn't on the channel at the time the AP transmit the confirm.
For iwlwifi at least, this also improves the overall timing of the authentication handshake (by about 15ms according to the report), likely since the session protection won't be aborted and rescheduled.
Note that even before this, mgd_complete_tx() wasn't always called for each call to mgd_prepare_tx() (e.g. in the case of WEP key shared authentication), and the current drivers that have the complete callback don't seem to mind. Document this as well though.
--- include/net/mac80211.h | 2 ++ net/mac80211/mlme.c | 9 ++++++++- 2 files changed, 10 insertions(+), 1 deletion(-)
include/net/mac80211.h +2 -0
@@ -4011,6 +4011,8 @@ struct ieee80211_prep_tx_info {* @mgd_complete_tx: Notify the driver that the response frame for a previously * transmitted frame announced with @mgd_prepare_tx was received, the data * is filled similarly to @mgd_prepare_tx though the duration is not used. +* Note that this isn't always called for each mgd_prepare_tx() call, for +* example for SAE the 'confirm' messages can be on the air in any order. * * @mgd_protect_tdls_discover: Protect a TDLS discovery session. After sending * a TDLS discovery-request, we expect a reply to arrive on the AP's
net/mac80211/mlme.c +8 -1
@@ -3595,6 +3595,7 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,struct ieee80211_prep_tx_info info = { .subtype =IEEE80211_STYPE_AUTH , }; +bool sae_need_confirm = false;sdata_assert_lock (sdata);
@@ -3638,6 +3639,8 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, jiffies +IEEE80211_AUTH_WAIT_SAE_RETRY ; ifmgd->auth_data->timeout_started = true;run_again (sdata, ifmgd->auth_data->timeout); +if (auth_transaction ==1 ) + sae_need_confirm = true; goto notify_driver; }
@@ -3680,6 +3683,9 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, ifmgd->auth_data->expected_transaction == 2)) {if (!ieee80211_mark_sta_auth (sdata))return ;/* ignore frame -- wait for timeout */ + } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE && + auth_transaction == 1) { + sae_need_confirm = true; } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE && auth_transaction == 2) {sdata_info (sdata,"SAE peer confirmed\n" );
@@ -3688,7 +3694,8 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,cfg80211_rx_mlme_mgmt (sdata->dev, (u8 *)mgmt, len); notify_driver: -drv_mgd_complete_tx (sdata->local, sdata, &info); +if (!sae_need_confirm) +drv_mgd_complete_tx (sdata->local, sdata, &info); }#define case_WLAN (type) \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 134/482 (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit 760b9b4f6de9a33ca56a05f950cabe82138d25bd ]
If the device configuration fails (if dma_dev->device_config()), sg_dma_address(&sg) is not initialized and the jump to err_dma_prep leads to calling dma_unmap_single() on sg_dma_address(&sg).
--- arch/powerpc/platforms/512x/mpc512x_lpbfifo.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
arch/powerpc/platforms/512x/mpc512x_lpbfifo.c +2 -4
@@ -240,10 +240,8 @@ static int mpc512x_lpbfifo_kick(void) dma_conf.src_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ;/* Make DMA channel work with LPB FIFO data register */ -if (dma_dev->device_config (lpbfifo.chan, &dma_conf)) { - ret = -EINVAL ; - goto err_dma_prep; - } +if (dma_dev->device_config (lpbfifo.chan, &dma_conf)) +return -EINVAL ;sg_init_table (&sg,1 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 135/482 ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit dbd40f318cf2f59759bd170c401adc20ba360a3e ]
Since commit 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data"), every multicast resource is protected by inet6_dev->mc_lock.
RTNL is unnecessary in terms of protection but still needed for synchronisation between addrconf_ifdown() and __ipv6_dev_mc_inc().
Once we removed RTNL, there would be a race below, where we could add a multicast address to a dead inet6_dev.
CPU1 CPU2
==== ====
addrconf_ifdown() __ipv6_dev_mc_inc()
if (idev->dead) <-- false
dead = true return -ENODEV;
ipv6_mc_destroy_dev() / ipv6_mc_down()
mutex_lock(&idev->mc_lock)
...
mutex_unlock(&idev->mc_lock)
mutex_lock(&idev->mc_lock)
...
mutex_unlock(&idev->mc_lock)The race window can be easily closed by checking inet6_dev->dead under inet6_dev->mc_lock in __ipv6_dev_mc_inc() as addrconf_ifdown() will acquire it after marking inet6_dev dead.
Let's check inet6_dev->dead under mc_lock in __ipv6_dev_mc_inc().
Note that now __ipv6_dev_mc_inc() no longer depends on RTNL and we can remove ASSERT_RTNL() there and the RTNL comment above addrconf_join_solict().
--- net/ipv6/addrconf.c | 7 +++---- net/ipv6/mcast.c | 11 +++++------ 2 files changed, 8 insertions(+), 10 deletions(-)
net/ipv6/addrconf.c +3 -4
@@ -2185,13 +2185,12 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)in6_ifa_put (ifp); } -/* Join to solicited addr multicast group. -* caller must hold RTNL */ +/* Join to solicited addr multicast group. */ void addrconf_join_solict (struct net_device *dev,const struct in6_addr *addr) {struct in6_addr maddr; -if (dev->flags&(IFF_LOOPBACK |IFF_NOARP )) +if (READ_ONCE (dev->flags) & (IFF_LOOPBACK |IFF_NOARP ))return ;addrconf_addr_solict_mult (addr, &maddr);
@@ -3807,7 +3806,7 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)* Do not dev_put! */ if (unregister) { - idev->dead =1 ; +WRITE_ONCE (idev->dead,1 );/* protected by rtnl_lock */ RCU_INIT_POINTER (dev->ip6_ptr,NULL );
net/ipv6/mcast.c +5 -6
@@ -906,23 +906,22 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,static int __ipv6_dev_mc_inc (struct net_device *dev,const struct in6_addr *addr,unsigned int mode) { -struct ifmcaddr6 *mc;struct inet6_dev *idev; - -ASSERT_RTNL (); +struct ifmcaddr6 *mc;/* we need to take a reference on idev */ idev =in6_dev_get (dev); -if (!idev)return -EINVAL ; -if (idev->dead) { +mutex_lock (&idev->mc_lock); + +if (READ_ONCE (idev->dead)) { +mutex_unlock (&idev->mc_lock);in6_dev_put (idev);return -ENODEV ; } -mutex_lock (&idev->mc_lock);for_each_mc_mclock (idev, mc) {if (ipv6_addr_equal (&mc->mca_addr, addr)) { mc->mca_users++;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 136/482 drm/msm: use trylock for debugfs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 0a1ff88ec5b60b41ba830c5bf08b6cd8f45ab411 ]
This resolves a potential deadlock vs msm_gem_vm_close(). Otherwise for _NO_SHARE buffers msm_gem_describe() could be trying to acquire the shared vm resv, while already holding priv->obj_lock. But _vm_close() might drop the last reference to a GEM obj while already holding the vm resv, and msm_gem_free_object() needs to grab priv->obj_lock, a locking inversion.
OTOH this is only for debugfs and it isn't critical if we undercount by skipping a locked obj. So just use trylock() and move along if we can't get the lock.
Patchwork: https://patchwork.freedesktop.org/patch/661525/
--- drivers/gpu/drm/msm/msm_gem.c | 3 ++- drivers/gpu/drm/msm/msm_gem.h | 6 ++++++ 2 files changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_gem.c +2 -1
@@ -874,7 +874,8 @@ void msm_gem_describe(struct drm_gem_object *obj, struct seq_file *m,uint64_t off =drm_vma_node_start (&obj->vma_node);const char *madv; -msm_gem_lock (obj); +if (!msm_gem_trylock (obj)) +return ; stats->all.count++; stats->all.size += obj->size;
drivers/gpu/drm/msm/msm_gem.h +6 -0
@@ -185,6 +185,12 @@ msm_gem_lock(struct drm_gem_object *obj)dma_resv_lock (obj->resv,NULL ); } +static inline bool __must_check +msm_gem_trylock (struct drm_gem_object *obj) +{ +return dma_resv_trylock (obj->resv); +} +static inline int msm_gem_lock_interruptible (struct drm_gem_object *obj) {
Signature · 1 line
2.39.5