6.6.103-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.6.103-rc1 review
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.103-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.103-rc1
Florian Westphal <[email protected]>
netfilter: nf_reject: don't leak dst refcount for loopback packets
Peter Oberparleiter <[email protected]>
s390/hypfs: Enable limited access during lockdown
Peter Oberparleiter <[email protected]>
s390/hypfs: Avoid unnecessary ioctl registration in debugfs
Takashi Iwai <[email protected]>
ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
Armen Ratner <[email protected]>
net/mlx5e: Preserve shared buffer capacity during headroom updates
Daniel Jurgens <[email protected]>
net/mlx5: Base ECVF devlink port attrs from 0
Hariprasad Kelam <[email protected]>
Octeontx2-af: Skip overlap check for SPI field
Hangbin Liu <[email protected]>
bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU
Aahil Awatramani <[email protected]>
bonding: Add independent control state machine
Hangbin Liu <[email protected]>
bonding: update LACP activity flag after setting lacp_active
William Liu <[email protected]>
net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
William Liu <[email protected]>
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
ValdikSS <[email protected]>
igc: fix disabling L1.2 PCI-E link substate on I226 on init
Jason Xing <[email protected]>
ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
Kanglong Wang <[email protected]>
LoongArch: Optimize module load time by optimizing PLT/GOT counting
D. Wythe <[email protected]>
net/smc: fix UAF on smcsk after smc_listen_out()
Jordan Rhee <[email protected]>
gve: prevent ethtool ops after shutdown
Yuichiro Tsuji <[email protected]>
net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
Horatiu Vultur <[email protected]>
phy: mscc: Fix timestamping for vsc8584
Qingfang Deng <[email protected]>
ppp: fix race conditions in ppp_fill_forward_path
Qingfang Deng <[email protected]>
net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
Minhong He <[email protected]>
ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
Jakub Ramaseuski <[email protected]>
net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
Chenyuan Yang <[email protected]>
drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
Dan Carpenter <[email protected]>
ALSA: usb-audio: Fix size validation in convert_chmap_v3()
Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix the hibmc loaded failed bug
Ido Schimmel <[email protected]>
mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
Sergey Shtylyov <[email protected]>
Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
Pauli Virtanen <[email protected]>
Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
Kees Cook <[email protected]>
iommu/amd: Avoid stack buffer overflow from kernel cmdline
Dan Carpenter <[email protected]>
scsi: qla4xxx: Prevent a potential error pointer dereference
Wang Liang <[email protected]>
net: bridge: fix soft lockup in br_multicast_query_expired()
Anantha Prabhu <[email protected]>
RDMA/bnxt_re: Fix to initialize the PBL array
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Fix to do SRQ armena by default
Boshi Yu <[email protected]>
RDMA/erdma: Fix ignored return value of init_kernel_qp
Nitin Gote <[email protected]>
iosys-map: Fix undefined behavior in iosys_map_clear()
Waiman Long <[email protected]>
cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key
Fanhua Li <[email protected]>
drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
Stefan Wahren <[email protected]>
spi: spi-fsl-lpspi: Clamp too high speed_hz
Tianxiang Peng <[email protected]>
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
Amit Sunil Dhamne <[email protected]>
usb: typec: maxim_contaminant: disable low power mode when reading comparator values
Amit Sunil Dhamne <[email protected]>
usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean
Weitao Wang <[email protected]>
usb: xhci: Fix slot_id resource race conflict
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: change invalid data error to -EBUSY
Andy Shevchenko <[email protected]>
iio: imu: inv_icm42600: Convert to uXX and sXX integer types
David Lechner <[email protected]>
iio: imu: inv_icm42600: use = { } instead of memset()Jonathan Cameron <[email protected]>
iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64
David Lechner <[email protected]>
iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
Jonathan Cameron <[email protected]>
iio: light: as73211: Ensure buffer holes are zeroed
Pu Lehui <[email protected]>
tracing: Limit access to parser->buffer when trace_get_user failed
Steven Rostedt <[email protected]>
tracing: Remove unneeded goto out logic
Jakub Kicinski <[email protected]>
tls: fix handling of zero-length records on the rx_list
Michal Suchanek <[email protected]>
powerpc/boot: Fix build with gcc 15
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
Jan Beulich <[email protected]>
compiler: remove __ADDRESSABLE_ASM{_STR,}() again
Timur Kristóf <[email protected]>
drm/amd/display: Don't overclock DCE 6 by 15%
Heikki Krogerus <[email protected]>
usb: dwc3: pci: add support for the Intel Wildcat Lake
Selvarasu Ganesan <[email protected]>
usb: dwc3: Remove WARN_ON for device endpoint command timeouts
Kuen-Han Tsai <[email protected]>
usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
Zenm Chen <[email protected]>
USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
Thorsten Blum <[email protected]>
usb: storage: realtek_cr: Use correct byte order for bcs->Residue
Mael GUERIN <[email protected]>
USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
Marek Vasut <[email protected]>
usb: renesas-xhci: Fix External ROM access timeouts
Xu Yang <[email protected]>
usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test
Ian Abbott <[email protected]>
comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()
Edward Adam Davis <[email protected]>
comedi: pcl726: Prevent invalid irq number
Ian Abbott <[email protected]>
comedi: Make insn_rw_emulate_bits() do insn->n samples
Miao Li <[email protected]>
usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
Thorsten Blum <[email protected]>
cdx: Fix off-by-one error in cdx_rpmsg_probe()
Miaoqian Lin <[email protected]>
most: core: Drop device reference after usage in get_channel()
David Lechner <[email protected]>
iio: proximity: isl29501: fix buffered read on big-endian systems
Salah Triki <[email protected]>
iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
Steven Rostedt <[email protected]>
ftrace: Also allocate and copy hash for reading of filter files
Xu Yilun <[email protected]>
fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
Imre Deak <[email protected]>
drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Avoid selecting states with too much latency
Christian Loehle <[email protected]>
cpuidle: menu: Remove iowait influence
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: Add a new function to simplify the code
Bjorn Helgaas <[email protected]>
mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: pm: check flush doesn't reset limits
Geliang Tang <[email protected]>
mptcp: disable add_addr retransmission when timeout is 0
Geliang Tang <[email protected]>
mptcp: remove duplicate sk_reset_timer call
Al Viro <[email protected]>
use uniform permission checks for all mount propagation changes
Ye Bin <[email protected]>
fs/buffer: fix use-after-free when call bh_read() helper
Stefan Metzmacher <[email protected]>
smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
Baokun Li <[email protected]>
ext4: preserve SB_I_VERSION on remount
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
André Draszik <[email protected]>
scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
Richard Zhu <[email protected]>
PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features
Richard Zhu <[email protected]>
PCI: imx6: Delay link start until configfs 'start' written
Geraldo Nascimento <[email protected]>
PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
Geraldo Nascimento <[email protected]>
PCI: rockchip: Use standard PCIe definitions
Dan Carpenter <[email protected]>
soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
Timur Kristóf <[email protected]>
drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
Timur Kristóf <[email protected]>
drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
Timur Kristóf <[email protected]>
drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
Timur Kristóf <[email protected]>
drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
Mario Limonciello <[email protected]>
drm/amd/display: Avoid a NULL pointer dereference
Peter Oberparleiter <[email protected]>
s390/sclp: Fix SCCB present check
Evgeniy Harchenko <[email protected]>
ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
Jinjiang Tu <[email protected]>
mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
Herton R. Krzesinski <[email protected]>
mm/debug_vm_pgtable: clear page table entries at destroy_args()
Phillip Lougher <[email protected]>
squashfs: fix memory leak in squashfs_fill_super
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
Jiayi Li <[email protected]>
memstick: Fix deadlock by moving removing flag earlier
Will Deacon <[email protected]>
KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix
Vincent Guittot <[email protected]>
sched/fair: Fix frequency selection for non-invariant case
Vincent Guittot <[email protected]>
topology: Set capacity_freq_ref in all cases
Vincent Guittot <[email protected]>
arm64/amu: Use capacity_ref_freq() to set AMU ratio
Vincent Guittot <[email protected]>
cpufreq/cppc: Set the frequency used for computing the capacity
Vincent Guittot <[email protected]>
energy_model: Use a fixed reference frequency
Vincent Guittot <[email protected]>
cpufreq/schedutil: Use a fixed reference frequency
Vincent Guittot <[email protected]>
cpufreq: Use the fixed and coherent frequency for scaling capacity
Vincent Guittot <[email protected]>
sched/topology: Add a new arch_scale_freq_ref() method
Thomas Weißschuh <[email protected]>
kbuild: userprogs: use correct linker when mixing clang and GNU ld
Damien Le Moal <[email protected]>
ata: libata-scsi: Return aborted command when missing sense and result TF
Rafael J. Wysocki <[email protected]>
PM: runtime: Take active children into account in pm_runtime_get_if_in_use()
Sakari Ailus <[email protected]>
PM: runtime: Simplify pm_runtime_get_if_active() usage
Damien Le Moal <[email protected]>
ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
Johan Hovold <[email protected]>
usb: dwc3: imx8mp: fix device leak at unbind
Anshuman Khandual <[email protected]>
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
Mikhail Lobanov <[email protected]>
wifi: mac80211: check basic rates validity in sta_link_apply_parameters
Sean Christopherson <[email protected]>
KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
Gerald Schaefer <[email protected]>
s390/mm: Remove possible false-positive warning in pte_free_defer()
Filipe Manana <[email protected]>
btrfs: send: make fs_path_len() inline and constify its argument
Filipe Manana <[email protected]>
btrfs: send: use fallocate for hole punching with send stream v2
Filipe Manana <[email protected]>
btrfs: send: avoid path allocation for the current inode when issuing commands
Filipe Manana <[email protected]>
btrfs: send: keep the current inode's path cached
Filipe Manana <[email protected]>
btrfs: send: add and use helper to rename current inode when processing refs
Filipe Manana <[email protected]>
btrfs: send: only use boolean variables at process_recorded_refs()
Filipe Manana <[email protected]>
btrfs: send: factor out common logic when sending xattrs
Qu Wenruo <[email protected]>
btrfs: populate otime when logging an inode item
David Sterba <[email protected]>
btrfs: constify more pointer parameters
Boris Burkov <[email protected]>
btrfs: fix ssd_spread overallocation
David Sterba <[email protected]>
btrfs: open code timespec64 in struct btrfs_inode
Christoph Hellwig <[email protected]>
xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
Filipe Manana <[email protected]>
btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
Filipe Manana <[email protected]>
btrfs: always abort transaction on failure to add block group to free space tree
David Sterba <[email protected]>
btrfs: move transaction aborts to the error site in add_block_group_free_space()
Filipe Manana <[email protected]>
btrfs: qgroup: fix race between quota disable and quota rescan ioctl
Filipe Manana <[email protected]>
btrfs: don't ignore inode missing when replaying log tree
Sebastian Reichel <[email protected]>
usb: typec: fusb302: cache PD RX state
Lukas Wunner <[email protected]>
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
Damien Le Moal <[email protected]>
block: Make REQ_OP_ZONE_FINISH a write operation
Christoph Hellwig <[email protected]>
block: reject invalid operation in submit_bio_noacct
Eric Biggers <[email protected]>
fscrypt: Don't use problematic non-inline crypto engines
Krzysztof Kozlowski <[email protected]>
leds: flash: leds-qcom-flash: Fix registry access after re-bind
Fenglin Wu <[email protected]>
leds: flash: leds-qcom-flash: Limit LED current based on thermal condition
Davide Caratti <[email protected]>
net/sched: ets: use old 'nbands' while purging unused classes
Eric Dumazet <[email protected]>
net_sched: sch_ets: implement lockless ets_dump()
Wang Zhaolong <[email protected]>
smb: client: fix netns refcount leak after net_passive changes
Eric Dumazet <[email protected]>
net: better track kernel sockets lifetime
Kuniyuki Iwashima <[email protected]>
net: Add net_passive_inc() and net_passive_dec().
Isaac J. Manjarres <[email protected]>
selftests/memfd: add test for mapping write-sealed memfd read-only
Isaac J. Manjarres <[email protected]>
mm: reinstate ability to map write-sealed memfd mappings read-only
Isaac J. Manjarres <[email protected]>
mm: update memfd seal write check to include F_SEAL_WRITE
Isaac J. Manjarres <[email protected]>
mm: drop the assumption that VM_SHARED always implies writable
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
Christoph Paasch <[email protected]>
mptcp: drop skb if MPTCP skb extension allocation fails
Chen Yu <[email protected]>
ACPI: pfr_update: Fix the driver update version check
Eric Biggers <[email protected]>
ipv6: sr: Fix MAC comparison to be constant-time
Jakub Acs <[email protected]>
net, hsr: reject HSR frame if skb can't hold tag
Timur Kristóf <[email protected]>
drm/amd/display: Don't overwrite dce60_clk_mgr
Michel Dänzer <[email protected]>
drm/amd/display: Add primary plane to commits for correct VRR handling
Amber Lin <[email protected]>
drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
Alex Deucher <[email protected]>
drm/amdgpu: update mmhub 3.0.1 client id mappings
Gang Ba <[email protected]>
drm/amdgpu: Avoid extra evict-restore process.
Mario Limonciello <[email protected]>
drm/amd: Restore cached power limit during resume
Ricardo Ribalda <[email protected]>
media: venus: venc: Clamp param smaller than 1fps and bigger than 240
Ricardo Ribalda <[email protected]>
media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
Jorge Ramirez-Ortiz <[email protected]>
media: venus: protect against spurious interrupts during probe
Jorge Ramirez-Ortiz <[email protected]>
media: venus: hfi: explicitly release IRQ during teardown
Vedang Nagar <[email protected]>
media: venus: Add a check for packet size after reading from shared memory
Vladimir Zapolskiy <[email protected]>
media: qcom: camss: cleanup media device allocated resource on error path
Hans de Goede <[email protected]>
media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
Zhang Shurong <[email protected]>
media: ov2659: Fix memory leaks in ov2659_probe()
Gui-Dong Han <[email protected]>
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
Ludwig Disterhof <[email protected]>
media: usbtv: Lock resolution while streaming
Sakari Ailus <[email protected]>
media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
Nicolas Dufresne <[email protected]>
media: verisilicon: Fix AV1 decoder clock frequency
Hans Verkuil <[email protected]>
media: vivid: fix wrong pixel_array control size
Haoxiang Li <[email protected]>
media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
Bingbu Cao <[email protected]>
media: hi556: correct the test pattern configuration
Dan Carpenter <[email protected]>
media: gspca: Add bounds checking to firmware parser
John David Anglin <[email protected]>
parisc: Update comments in make_insert_tlb
John David Anglin <[email protected]>
parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault()
John David Anglin <[email protected]>
parisc: Revise gateway LWS calls to probe user read access
John David Anglin <[email protected]>
parisc: Revise __get_user() to probe user read access
John David Anglin <[email protected]>
parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
Randy Dunlap <[email protected]>
parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers
John David Anglin <[email protected]>
parisc: Drop WARN_ON_ONCE() from flush_cache_vmap
John David Anglin <[email protected]>
parisc: Define and use set_pte_at()
John David Anglin <[email protected]>
parisc: Check region is readable by user in raw_copy_from_user()
Jon Hunter <[email protected]>
soc/tegra: pmc: Ensure power-domains are in a known state
Baokun Li <[email protected]>
jbd2: prevent softlockup in jbd2_log_do_checkpoint()
Chao Yu <[email protected]>
f2fs: fix to avoid out-of-boundary access in dnode page
Kathiravan Thirumoorthy <[email protected]>
phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence
Will Deacon <[email protected]>
vhost/vsock: Avoid allocating arbitrarily-sized SKBs
Will Deacon <[email protected]>
vsock/virtio: Validate length in packet header before skb_put()
Damien Le Moal <[email protected]>
PCI: endpoint: Fix configfs group removal on driver teardown
Damien Le Moal <[email protected]>
PCI: endpoint: Fix configfs group list head handling
Thomas Fourier <[email protected]>
mtd: rawnand: renesas: Add missing check after DMA map
Thomas Fourier <[email protected]>
mtd: rawnand: fsmc: Add missing check after DMA map
Gabor Juhos <[email protected]>
mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
Michael Walle <[email protected]>
mtd: spi-nor: Fix spi_nor_try_unlock_all()
Tim Harvey <[email protected]>
hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
Uwe Kleine-König <[email protected]>
pwm: mediatek: Fix duty and period setting
Uwe Kleine-König <[email protected]>
pwm: mediatek: Handle hardware enable and clock enable separately
Laurentiu Mihalcea <[email protected]>
pwm: imx-tpm: Reset counter if CMOD is 0
Johan Hovold <[email protected]>
wifi: ath11k: fix dest ring-buffer corruption when ring is full
Johan Hovold <[email protected]>
wifi: ath11k: fix source ring-buffer corruption
Johan Hovold <[email protected]>
wifi: ath11k: fix dest ring-buffer corruption
Johan Hovold <[email protected]>
wifi: ath12k: fix dest ring-buffer corruption when ring is full
Johan Hovold <[email protected]>
wifi: ath12k: fix source ring-buffer corruption
Johan Hovold <[email protected]>
wifi: ath12k: fix dest ring-buffer corruption
Nathan Chancellor <[email protected]>
wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
David Lechner <[email protected]>
iio: adc: ad_sigma_delta: change to buffer predisable
David Lechner <[email protected]>
iio: imu: bno055: fix OOB access of hw_xlate array
Marek Szyprowski <[email protected]>
zynq_fpga: use sgtable-based scatterlist wrappers
Bjorn Andersson <[email protected]>
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
Igor Pylypiv <[email protected]>
ata: libata-scsi: Fix CDL control
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Fix default runtime and system PM levels
Archana Patni <[email protected]>
scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
Damien Le Moal <[email protected]>
ata: libata-scsi: Fix ata_to_sense_error() status handling
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Fix race between config read submit and interrupt completion
Krzysztof Kozlowski <[email protected]>
dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints
Krzysztof Kozlowski <[email protected]>
dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
Emanuele Ghidoli <[email protected]>
arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
Hong Guan <[email protected]>
arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
Alexander Sverdlin <[email protected]>
arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
Naohiro Aota <[email protected]>
btrfs: zoned: fix write time activation failure for metadata block group
Zhang Yi <[email protected]>
ext4: fix hole length calculation overflow in non-extent inodes
Liao Yuanhong <[email protected]>
ext4: use kmalloc_array() for array space allocation
Theodore Ts'o <[email protected]>
ext4: don't try to clear the orphan_present feature block device is r/o
Ojaswin Mujoo <[email protected]>
ext4: fix reserved gdt blocks handling in fsmap
Ojaswin Mujoo <[email protected]>
ext4: fix fsmap end of range reporting with bigalloc
Andreas Dilger <[email protected]>
ext4: check fast symlink for ea_inode correctly
Masami Hiramatsu (Google) <[email protected]>
tracing: fprobe-event: Sanitize wildcard for fprobe event name
Namjae Jeon <[email protected]>
ksmbd: extend the connection limiting mechanism to support IPv6
Ziyan Xu <[email protected]>
ksmbd: fix refcount leak causing resource not released
Helge Deller <[email protected]>
Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
Giovanni Cabiddu <[email protected]>
crypto: qat - flush misc workqueue during device shutdown
Giovanni Cabiddu <[email protected]>
crypto: qat - lower priority for skcipher and aead algorithms
Eric Biggers <[email protected]>
lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
Myrrh Periwinkle <[email protected]>
vt: defkeymap: Map keycodes above 127 to K_HOLE
Myrrh Periwinkle <[email protected]>
vt: keyboard: Don't process Unicode characters in K_OFF mode
Youssef Samir <[email protected]>
bus: mhi: host: Detect events pointing to unexpected TREs
Alexander Wilhelm <[email protected]>
bus: mhi: host: Fix endianness of BHI vector table
Johan Hovold <[email protected]>
usb: dwc3: meson-g12a: fix device leaks at unbind
Johan Hovold <[email protected]>
usb: musb: omap2430: fix device leak at unbind
Johan Hovold <[email protected]>
usb: gadget: udc: renesas_usb3: fix device leak at unbind
Nathan Chancellor <[email protected]>
usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
Finn Thain <[email protected]>
m68k: Fix lost column on framebuffer debug console
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
Dan Carpenter <[email protected]>
cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
Yunhui Cui <[email protected]>
serial: 8250: fix panic due to PSLVERR
Frederic Weisbecker <[email protected]>
rcu: Fix racy re-initialization of irq_work causing hangs
Aditya Garg <[email protected]>
HID: apple: avoid setting up battery timer for devices without battery
Aditya Garg <[email protected]>
HID: magicmouse: avoid setting up battery timer when not needed
Pedro Falcato <[email protected]>
RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
Willy Tarreau <[email protected]>
tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
Ricardo Ribalda <[email protected]>
media: uvcvideo: Do not mark valid metadata as invalid
Vedang Nagar <[email protected]>
media: venus: Fix OOB read due to missing payload bound check
Youngjun Lee <[email protected]>
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
Breno Leitao <[email protected]>
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
Waiman Long <[email protected]>
mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
Randy Dunlap <[email protected]>
parisc: Makefile: fix a typo in palo.conf
Haiyang Zhang <[email protected]>
hv_netvsc: Fix panic during namespace deletion with VF
Sravan Kumar Gundu <[email protected]>
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
Qu Wenruo <[email protected]>
btrfs: do not allow relocation of partially dropped subvolumes
Naohiro Aota <[email protected]>
btrfs: zoned: do not select metadata BG as finish target
Filipe Manana <[email protected]>
btrfs: fix log tree replay failure due to file with 0 links and extents
Filipe Manana <[email protected]>
btrfs: clear dirty status from extent buffer on error at insert_new_root()
Naohiro Aota <[email protected]>
btrfs: zoned: do not remove unwritten non-data block group
Filipe Manana <[email protected]>
btrfs: abort transaction during log replay if walk_log_tree() failed
Johannes Thumshirn <[email protected]>
btrfs: zoned: use filesystem size not disk size for reclaim decision
Oliver Neukum <[email protected]>
cdc-acm: fix race between initial clearing halt and open
Eric Biggers <[email protected]>
thunderbolt: Fix copy+paste error in match_service_id()
Ian Abbott <[email protected]>
comedi: fix race between polling and detaching
Myrrh Periwinkle <[email protected]>
usb: typec: ucsi: Update power_supply on power role change
Ricky Wu <[email protected]>
misc: rtsx: usb: Ensure mmc child device is active when card is present
Xinyu Liu <[email protected]>
usb: core: config: Prevent OOB read in SS endpoint companion parsing
Baokun Li <[email protected]>
ext4: fix largest free orders lists corruption on mb_optimize_scan switch
Baokun Li <[email protected]>
ext4: fix zombie groups in average fragment size lists
Jason Gunthorpe <[email protected]>
iommufd: Prevent ALIGN() overflow
Nicolin Chen <[email protected]>
iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
Alexey Klimov <[email protected]>
iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
Shyam Prasad N <[email protected]>
cifs: reset iface weights when we cannot find a candidate
Jack Xiao <[email protected]>
drm/amdgpu: fix incorrect vm flags to map bo
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: replace regmap_write with regmap_update_bits
Jiasheng Jiang <[email protected]>
scsi: lpfc: Remove redundant assignment to avoid memory leak
Meagan Lloyd <[email protected]>
rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
Sergey Bashirov <[email protected]>
pNFS: Fix uninited ptr deref in block/scsi layout
Sergey Bashirov <[email protected]>
pNFS: Handle RPC size limit for layoutcommits
Sergey Bashirov <[email protected]>
pNFS: Fix disk addr range check in block/scsi layout
Sergey Bashirov <[email protected]>
pNFS: Fix stripe mapping in block/scsi layout
John Garry <[email protected]>
block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Fix uninitialized pointer error in probe()
Buday Csaba <[email protected]>
net: phy: smsc: add proper reset flags for LAN8710A
Corey Minyard <[email protected]>
ipmi: Fix strcpy source and destination the same
Yann E. MORIN <[email protected]>
kconfig: lxdialog: fix 'space' to (de)select options
Masahiro Yamada <[email protected]>
kconfig: gconf: fix potential memory leak in renderer_edited()
Masahiro Yamada <[email protected]>
kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
Breno Leitao <[email protected]>
ipmi: Use dev_warn_ratelimited() for incorrect message warnings
Artem Sadovnikov <[email protected]>
vfio/mlx5: fix possible overflow in tracking max message size
John Garry <[email protected]>
scsi: aacraid: Stop using PCI_IRQ_AFFINITY
Maurizio Lombardi <[email protected]>
scsi: target: core: Generate correct identifiers for PR OUT transport IDs
Ranjan Kumar <[email protected]>
scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
Shankari Anand <[email protected]>
kconfig: nconf: Ensure null termination where strncpy is used
Keith Busch <[email protected]>
vfio/type1: conditional rescheduling while pinning
Suchit Karunakaran <[email protected]>
kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
Jaegeuk Kim <[email protected]>
f2fs: check the generic conditions first
Yuezhang Mo <[email protected]>
exfat: add cluster chain loop check for dir
fangzhong.zhou <[email protected]>
i2c: Force DLL0945 touchpad i2c freq to 100khz
Mateusz Guzik <[email protected]>
apparmor: use the condition in AA_BUG_FMT even with debug disabled
Benjamin Marzinski <[email protected]>
dm-table: fix checking for rq stackable devices
Mikulas Patocka <[email protected]>
dm-mpath: don't print the "loaded" message if registering fails
Jorge Marques <[email protected]>
i3c: master: Initialize ret in i3c_i2c_notifier_call()
Wolfram Sang <[email protected]>
i3c: don't fail if GETHDRCAP is unsupported
Gabriel Totev <[email protected]>
apparmor: shift ouid when mediating hard links in userns
Meagan Lloyd <[email protected]>
rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
Wolfram Sang <[email protected]>
i3c: add missing include to internal header
Petr Pavlu <[email protected]>
module: Prevent silent truncation of module name in delete_module(2)
Purva Yeshi <[email protected]>
md: dm-zoned-target: Initialize return variable r to avoid uninitialized use
Charles Keepax <[email protected]>
soundwire: Move handle_nested_irq outside of sdw_dev_lock
Vijendar Mukunda <[email protected]>
soundwire: amd: serialize amd manager resume sequence during pm_prepare
Bharat Bhushan <[email protected]>
crypto: octeontx2 - add timeout for load_fvc completion poll
chenchangcheng <[email protected]>
media: uvcvideo: Fix bandwidth issue for Alcor camera
Alex Guo <[email protected]>
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
Alex Guo <[email protected]>
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
Wolfram Sang <[email protected]>
media: usb: hdpvr: disable zero-length read messages
Dave Stevenson <[email protected]>
media: tc358743: Increase FIFO trigger level to 374
Dave Stevenson <[email protected]>
media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
Dave Stevenson <[email protected]>
media: tc358743: Check I2C succeeded during probe
Cheick Traore <[email protected]>
pinctrl: stm32: Manage irq affinity settings
Damien Le Moal <[email protected]>
scsi: mpi3mr: Correctly handle ATA device errors
Damien Le Moal <[email protected]>
scsi: mpt3sas: Correctly handle ATA device errors
Abel Vesa <[email protected]>
power: supply: qcom_battmgr: Add lithium-polymer entry
Justin Tee <[email protected]>
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
Arnd Bergmann <[email protected]>
RDMA/core: reduce stack using in nldev_stat_get_doit()
Yury Norov [NVIDIA] <[email protected]>
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
Amelie Delaunay <[email protected]>
dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs
Johan Adolfsson <[email protected]>
leds: leds-lp50xx: Handle reg to get correct multi_index
Niklas Söderlund <[email protected]>
media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control
Shiji Yang <[email protected]>
MIPS: lantiq: falcon: sysctrl: fix request memory check logic
Thomas Weißschuh <[email protected]>
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
Markus Theil <[email protected]>
crypto: jitter - fix intermediary handling
Arnaud Lecomte <[email protected]>
jfs: upper bound check of tree index in dbAllocAG
Edward Adam Davis <[email protected]>
jfs: Regular file corruption check
Lizhi Xu <[email protected]>
jfs: truncate good inode pages when hard link is 0
jackysliu <[email protected]>
scsi: bfa: Double-free fix
Ziyan Fu <[email protected]>
watchdog: iTCO_wdt: Report error if timeout configuration fails
Shiji Yang <[email protected]>
MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}George Moussalem <[email protected]>
clk: qcom: ipq5018: keep XO clock always on
Florin Leotescu <[email protected]>
hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state
Sebastian Reichel <[email protected]>
watchdog: dw_wdt: Fix default timeout
Amir Mohammad Jahangirzad <[email protected]>
fs/orangefs: use snprintf() instead of sprintf()
Showrya M N <[email protected]>
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
Geraldo Nascimento <[email protected]>
phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
Chen-Yu Tsai <[email protected]>
mfd: axp20x: Set explicit ID for AXP313 regulator
Pei Xiao <[email protected]>
clk: tegra: periph: Fix error handling and resolve unsigned compare warning
Theodore Ts'o <[email protected]>
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
Zhiqi Song <[email protected]>
crypto: hisilicon/hpre - fix dma unmap sequence
Yongzhen Zhang <[email protected]>
fbdev: fix potential buffer overflow in do_register_framebuffer()
Pali Rohár <[email protected]>
cifs: Fix calling CIFSFindFirst() for root path without msearch
Aaron Plattner <[email protected]>
watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition
Mario Limonciello <[email protected]>
drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
Mario Limonciello <[email protected]>
drm/amd/display: Only finalize atomic_obj if it was initialized
Jason Wang <[email protected]>
vhost: fail early when __vhost_add_used() fails
Will Deacon <[email protected]>
vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
Joel Fernandes <[email protected]>
rcu: Fix rcu_read_unlock() deadloop due to IRQ work
Tvrtko Ursulin <[email protected]>
drm/ttm: Respect the shrinker core free target
Wayne Lin <[email protected]>
drm/amd/display: Avoid trying AUX transactions on disconnected ports
Yonghong Song <[email protected]>
selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
Ihor Solodrai <[email protected]>
bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
Jakub Kicinski <[email protected]>
uapi: in6: restore visibility of most IPv6 socket options
Emily Deng <[email protected]>
drm/ttm: Should to return the evict error
Lad Prabhakar <[email protected]>
drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
Hari Kalavakunta <[email protected]>
net: ncsi: Fix buffer overflow in fetching version id
Shannon Nelson <[email protected]>
ionic: clean dbpage in de-init
Thomas Fourier <[email protected]>
wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
Breno Leitao <[email protected]>
ptp: Use ratelimite for freerun error message
Yuan Chen <[email protected]>
bpftool: Fix JSON writer resource leak in version command
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent DIS_LEARNING access on BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
Alok Tiwari <[email protected]>
gve: Return error for unknown admin queue command
Gal Pressman <[email protected]>
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
Gal Pressman <[email protected]>
net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
Mario Limonciello <[email protected]>
drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual
Heiner Kallweit <[email protected]>
dpaa_eth: don't use fixed_phy_change_carrier
Nicolas Escande <[email protected]>
neighbour: add support for NUD_PERMANENT proxy entries
Stanislaw Gruszka <[email protected]>
wifi: iwlegacy: Check rate_idx range after addition
Mina Almasry <[email protected]>
netmem: fix skb_frag_address_safe with unreadable skbs
Thomas Fourier <[email protected]>
powerpc: floppy: Add missing checks after DMA map
Karthikeyan Kathirvel <[email protected]>
wifi: ath12k: Decrement TID on RX peer frag setup error handling
Raj Kumar Bhagat <[email protected]>
wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
Thomas Fourier <[email protected]>
wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_rx_interrupt().
Ramya Gnanasekar <[email protected]>
wifi: mac80211: update radar_required in channel context after channel switch
Wen Chen <[email protected]>
drm/amd/display: Fix 'failed to blank crtc!'
Pagadala Yesu Anjaneyulu <[email protected]>
wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
Rand Deeb <[email protected]>
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
Sarika Sharma <[email protected]>
wifi: ath12k: Add memset and update default rate value in wmi tx completion
Ilya Bakoulin <[email protected]>
drm/amd/display: Separate set_gsl from set_gsl_source_select
Jonas Rebmann <[email protected]>
net: fec: allow disable coalescing
Eric Work <[email protected]>
net: atlantic: add set_power to fw_ops for atl2 to fix wol
Aakash Kumar S <[email protected]>
xfrm: Duplicate SPI Handling
zhangjianrong <[email protected]>
net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
zhangjianrong <[email protected]>
net: thunderbolt: Enable end-to-end flow control also in transmit
Mark Brown <[email protected]>
kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
David Bauer <[email protected]>
wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
Bitterblue Smith <[email protected]>
wifi: rtw89: Disable deep power saving for USB/SDIO
Bitterblue Smith <[email protected]>
wifi: rtw89: Fix rtw89_mac_power_switch() for USB
Rob Clark <[email protected]>
drm/msm: use trylock for debugfs
Hari Chandrakanthan <[email protected]>
wifi: mac80211: fix rx link assignment for non-MLO stations
Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc().
Thomas Fourier <[email protected]>
(powerpc/512) Fix possible dma_unmap_single() on uninitialized pointer
Johannes Berg <[email protected]>
wifi: mac80211: don't complete management TX on SAE commit
Chris Mason <[email protected]>
sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
Sven Schnelle <[email protected]>
s390/stp: Remove udelay from stp_sync_clock()
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: fix scan request validation
Thomas Weißschuh <[email protected]>
um: Re-evaluate thread flags repeatedly
Miri Korenblit <[email protected]>
wifi: iwlwifi: mvm: set gtk id also in older FWs
Alok Tiwari <[email protected]>
perf/cxlpmu: Remove unintended newline from IRQ name format string
Biju Das <[email protected]>
net: phy: micrel: Add ksz9131_resume()
Alok Tiwari <[email protected]>
net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
Oscar Maes <[email protected]>
net: ipv4: fix incorrect MTU in broadcast routes
Ilan Peer <[email protected]>
wifi: cfg80211: Fix interface type validation
Matt Johnston <[email protected]>
net: mctp: Prevent duplicate binds
Paul E. McKenney <[email protected]>
rcu: Protect ->defer_qs_iw_pending from data race
Breno Leitao <[email protected]>
arm64: Mark kernel as tainted on SAE and SError panic
Leon Romanovsky <[email protected]>
net/mlx5e: Properly access RCU protected qdisc_sleeping variable
Thomas Fourier <[email protected]>
net: ag71xx: Add missing check after DMA map
Thomas Fourier <[email protected]>
et131x: Add missing check after DMA map
Bitterblue Smith <[email protected]>
wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
Alok Tiwari <[email protected]>
be2net: Use correct byte order and format string for TCP seq and ack_seq
Sven Schnelle <[email protected]>
s390/time: Use monotonic clock in get_cycles()
Johannes Berg <[email protected]>
wifi: cfg80211: reject HTC bit for management frames
Steven Rostedt <[email protected]>
ktest.pl: Prevent recursion of default variable options
Sarika Sharma <[email protected]>
wifi: ath12k: Correct tid cleanup when tid setup fails
Oliver Neukum <[email protected]>
net: usb: cdc-ncm: check for filtering capability
Anthoine Bourgeois <[email protected]>
xen/netfront: Fix TX response spurious interrupts
Zijun Hu <[email protected]>
Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
Steven Rostedt <[email protected]>
powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
Srinivas Kandagatla <[email protected]>
ASoC: qcom: use drvdata instead of component to keep id
Xinxin Wan <[email protected]>
ASoC: codecs: rt5640: Retry DEVICE_ID verification
Jonathan Santos <[email protected]>
iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
Cristian Ciocaltea <[email protected]>
ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
Christophe Leroy <[email protected]>
ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
Lucy Thrun <[email protected]>
ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
Tomasz Michalec <[email protected]>
platform/chrome: cros_ec_typec: Defer probe on missing EC parent
Kees Cook <[email protected]>
platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
Bjorn Andersson <[email protected]>
soc: qcom: mdt_loader: Actually use the e_phoff
Krzysztof Hałasa <[email protected]>
imx8m-blk-ctrl: set ISI panic write hurry level
Gautham R. Shenoy <[email protected]>
pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
Oliver Neukum <[email protected]>
usb: core: usb_submit_urb: downgrade type check
Tomasz Michalec <[email protected]>
usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
Peter Ujfalusi <[email protected]>
ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
Alok Tiwari <[email protected]>
ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
Mark Brown <[email protected]>
ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
Pawan Gupta <[email protected]>
x86/bugs: Avoid warning when overriding return thunk
Takashi Iwai <[email protected]>
ALSA: hda: Disable jack polling at shutdown
Takashi Iwai <[email protected]>
ALSA: hda: Handle the jack polling always via a work
Ulf Hansson <[email protected]>
mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
Hans de Goede <[email protected]>
mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
Zijun Hu <[email protected]>
char: misc: Fix improper and inaccurate error code returned by misc_init()
Peter Robinson <[email protected]>
reset: brcmstb: Enable reset drivers for ARCH_BCM2835
Eliav Farber <[email protected]>
pps: clients: gpio: fix interrupt handling order in remove path
Breno Leitao <[email protected]>
ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
Sebastian Ott <[email protected]>
ACPI: processor: fix acpi_object initialization
tuhaowen <[email protected]>
PM: sleep: console: Fix the black screen issue
Hsin-Te Yuan <[email protected]>
thermal: sysfs: Return ENODATA instead of EAGAIN for reads
Rafael J. Wysocki <[email protected]>
PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
Thierry Reding <[email protected]>
firmware: tegra: Fix IVC dependency problems
Zhu Qiyu <[email protected]>
ACPI: PRM: Reduce unnecessary printing to avoid user confusion
Masami Hiramatsu (Google) <[email protected]>
selftests: tracing: Use mutex_unlock for testing glob filter
Thomas Weißschuh <[email protected]>
tools/build: Fix s390(x) cross-compilation with clang
Aaron Kling <[email protected]>
ARM: tegra: Use I/O memcpy to write to IRAM
Bartosz Golaszewski <[email protected]>
gpio: tps65912: check the return value of regmap_update_bits()
David Lechner <[email protected]>
iio: adc: ad_sigma_delta: don't overallocate scan buffer
Thomas Weißschuh <[email protected]>
tools/nolibc: define time_t in terms of __kernel_old_time_t
David Collins <[email protected]>
thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
Kuninori Morimoto <[email protected]>
ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
Shubhrajyoti Datta <[email protected]>
EDAC/synopsys: Clear the ECC counters on init
Lifeng Zheng <[email protected]>
PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
Alexander Kochetkov <[email protected]>
ARM: rockchip: fix kernel hang during smp initialization
Lifeng Zheng <[email protected]>
cpufreq: Exit governor when failed to start old governor
Bartosz Golaszewski <[email protected]>
gpio: wcd934x: check the return value of regmap_update_bits()
Hiago De Franco <[email protected]>
remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
Shuai Xue <[email protected]>
ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
Maulik Shah <[email protected]>
soc: qcom: rpmh-rsc: Add RSC version 4 support
Mario Limonciello <[email protected]>
usb: xhci: Avoid showing errors during surprise removal
Jay Chen <[email protected]>
usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
Mario Limonciello <[email protected]>
usb: xhci: Avoid showing warnings for dying controller
Benson Leung <[email protected]>
usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
Cynthia Huang <[email protected]>
selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
Prashant Malani <[email protected]>
cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
Mario Limonciello <[email protected]>
platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
Su Hui <[email protected]>
usb: xhci: print xhci->xhc_state when queue_command failed
Steven Rostedt <[email protected]>
tracefs: Add d_delete to remove negative dentries
Al Viro <[email protected]>
securityfs: don't pin dentries twice, once is enough...
Al Viro <[email protected]>
fix locking in efi_secret_unlink()
Wei Gao <[email protected]>
ext2: Handle fiemap on empty files to prevent EINVAL
Rong Zhang <[email protected]>
fs/ntfs3: correctly create symlink for relative path
Lizhi Xu <[email protected]>
fs/ntfs3: Add sanity check for file name
Damien Le Moal <[email protected]>
ata: libata-sata: Disallow changing LPM state if not supported
Al Viro <[email protected]>
better lockdep annotations for simple_recursive_removal()
Viacheslav Dubeyko <[email protected]>
hfs: fix not erasing deleted b-tree node issue
Sarah Newman <[email protected]>
drbd: add missing kref_get in handle_write_conflicts
Jan Kara <[email protected]>
udf: Verify partition map count
Jan Kara <[email protected]>
loop: Avoid updating block size under exclusive owner
Andrew Price <[email protected]>
gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
Keith Busch <[email protected]>
nvme-pci: try function level reset on init failure
NeilBrown <[email protected]>
smb/server: avoid deadlock when linking with ReplaceIfExists
Kees Cook <[email protected]>
arm64: Handle KCOV __init vs inline mismatches
Tetsuo Handa <[email protected]>
hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
Viacheslav Dubeyko <[email protected]>
hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
Viacheslav Dubeyko <[email protected]>
hfs: fix slab-out-of-bounds in hfs_bnode_read()
Viacheslav Dubeyko <[email protected]>
hfs: fix general protection fault in hfs_find_init()
Jakub Kicinski <[email protected]>
tls: handle data disappearing from under the TLS ULP
Jeongjun Park <[email protected]>
ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Avoid using invalid recent intervals data
Len Brown <[email protected]>
intel_idle: Allow loading ACPI tables for any family
Xin Long <[email protected]>
sctp: linearize cloned gso packets in sctp_rcv
Alok Tiwari <[email protected]>
net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
Florian Westphal <[email protected]>
netfilter: ctnetlink: fix refcount leak on table dump
Sabrina Dubroca <[email protected]>
udp: also consider secpath when evaluating ipsec use for checksumming
Maxim Levitsky <[email protected]>
KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest
Maxim Levitsky <[email protected]>
KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
Maxim Levitsky <[email protected]>
KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
Sean Christopherson <[email protected]>
KVM: VMX: Extract checking of guest's DEBUGCTL into helper
Sean Christopherson <[email protected]>
KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
Sean Christopherson <[email protected]>
KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
Sean Christopherson <[email protected]>
KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap
Sean Christopherson <[email protected]>
KVM: x86: Fully defer to vendor code to decide how to force immediate exit
Sean Christopherson <[email protected]>
KVM: VMX: Handle KVM-induced preemption timer exits in fastpath for L2
Sean Christopherson <[email protected]>
KVM: x86: Move handling of is_guest_mode() into fastpath exit handlers
Sean Christopherson <[email protected]>
KVM: VMX: Handle forced exit due to preemption timer in fastpath
Sean Christopherson <[email protected]>
KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
Sean Christopherson <[email protected]>
KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
Sean Christopherson <[email protected]>
KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs
Sean Christopherson <[email protected]>
KVM: x86: Snapshot the host's DEBUGCTL in common x86
Chao Gao <[email protected]>
KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
Sean Christopherson <[email protected]>
KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
Sean Christopherson <[email protected]>
KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
Manuel Andreas <[email protected]>
KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
Stefan Metzmacher <[email protected]>
smb: client: don't wait for info->send_pending == 0 on error
Stefan Metzmacher <[email protected]>
smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
Rafael J. Wysocki <[email protected]>
ACPI: processor: perflib: Move problematic pr->performance check
Jiayi Li <[email protected]>
ACPI: processor: perflib: Fix initial _PPC limit application
Andy Shevchenko <[email protected]>
Documentation: ACPI: Fix parent device references
Jann Horn <[email protected]>
eventpoll: Fix semi-unbounded recursion
Sasha Levin <[email protected]>
fs: Prevent file descriptor table allocations exceeding INT_MAX
Ma Ke <[email protected]>
sunvdc: Balance device refcount in vdc_port_mpgroup_check
Haoran Jiang <[email protected]>
LoongArch: BPF: Fix jump offset calculation in tailcall
Huacai Chen <[email protected]>
PCI: Extend isolated function probing to LoongArch
Trond Myklebust <[email protected]>
NFS: Fix the setting of capabilities when automounting a new filesystem
Dai Ngo <[email protected]>
NFSD: detect mismatch of file handle and delegation stateid in OPEN op
Jeff Layton <[email protected]>
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
Jens Axboe <[email protected]>
io_uring/net: commit partial buffers on retry
Xu Yang <[email protected]>
net: usb: asix_devices: add phy_mask for ax88772 mdio bus
Johan Hovold <[email protected]>
net: dpaa: fix device leak when querying time stamp info
Johan Hovold <[email protected]>
net: ti: icss-iep: fix device and OF node leaks at probe
Johan Hovold <[email protected]>
net: mtk_eth_soc: fix device leak at probe
Johan Hovold <[email protected]>
net: enetc: fix device and OF node leak at probe
Johan Hovold <[email protected]>
net: gianfar: fix device leak when querying time stamp info
Florian Larysch <[email protected]>
net: phy: micrel: fix KSZ8081/KSZ8091 cable test
Fedor Pchelkin <[email protected]>
netlink: avoid infinite retry looping in netlink_unicast()
Daniel Golle <[email protected]>
Revert "leds: trigger: netdev: Configure LED blink interval for HW offload"
David Thompson <[email protected]>
gpio: mlxbf3: use platform_get_irq_optional()
David Thompson <[email protected]>
Revert "gpio: mlxbf3: only get IRQ for device instance 0"
David Thompson <[email protected]>
gpio: mlxbf2: use platform_get_irq_optional()
Harald Mommer <[email protected]>
gpio: virtio: Fix config space reading.
Wang Zhaolong <[email protected]>
smb: client: remove redundant lstrp update in negotiate protocol
Steve French <[email protected]>
smb3: fix for slab out of bounds on mount to ksmbd
Christopher Eby <[email protected]>
ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
Vasiliy Kovalev <[email protected]>
ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
Takashi Iwai <[email protected]>
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
Takashi Iwai <[email protected]>
ALSA: usb-audio: Validate UAC3 power domain descriptors, too
Pavel Begunkov <[email protected]>
io_uring: don't use int for ABI
-------------
Diffstat:
.../bindings/display/sprd/sprd,sharkl3-dpu.yaml | 2 +- .../display/sprd/sprd,sharkl3-dsi-host.yaml | 2 +- Documentation/filesystems/fscrypt.rst | 37 +-- Documentation/firmware-guide/acpi/i2c-muxes.rst | 8 +- Documentation/networking/bonding.rst | 12 + Documentation/networking/mptcp-sysctl.rst | 2 + Documentation/power/runtime_pm.rst | 5 +- Makefile | 6 +- arch/arm/include/asm/topology.h | 1 + arch/arm/mach-rockchip/platsmp.c | 15 +- arch/arm/mach-tegra/reset.c | 2 +- arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 1 - arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 12 +- arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 4 +- arch/arm64/boot/dts/ti/k3-pinctrl.h | 15 +- arch/arm64/include/asm/acpi.h | 2 +- arch/arm64/include/asm/topology.h | 1 + arch/arm64/kernel/fpsimd.c | 4 +- arch/arm64/kernel/topology.c | 26 +- arch/arm64/kernel/traps.c | 1 + arch/arm64/mm/fault.c | 1 + arch/arm64/mm/ptdump_debugfs.c | 3 - arch/loongarch/kernel/module-sections.c | 38 +-- arch/loongarch/net/bpf_jit.c | 21 +- arch/m68k/kernel/head.S | 31 +- arch/mips/crypto/chacha-core.S | 20 +- arch/mips/include/asm/vpe.h | 8 + arch/mips/kernel/process.c | 16 +- arch/mips/lantiq/falcon/sysctrl.c | 23 +- arch/parisc/Makefile | 6 +- arch/parisc/include/asm/pgtable.h | 7 +- arch/parisc/include/asm/special_insns.h | 28 ++ arch/parisc/include/asm/uaccess.h | 21 +- arch/parisc/kernel/cache.c | 6 +- arch/parisc/kernel/entry.S | 17 +- arch/parisc/kernel/syscall.S | 30 +- arch/parisc/lib/memcpy.c | 19 +- arch/parisc/mm/fault.c | 4 + arch/powerpc/boot/Makefile | 1 + arch/powerpc/include/asm/floppy.h | 5 +- arch/powerpc/platforms/512x/mpc512x_lpbfifo.c | 6 +- arch/riscv/include/asm/topology.h | 1 + arch/s390/hypfs/hypfs_dbfs.c | 19 +- arch/s390/include/asm/timex.h | 13 +- arch/s390/kernel/time.c | 2 +- arch/s390/mm/dump_pagetables.c | 2 - arch/s390/mm/pgalloc.c | 5 - arch/um/include/asm/thread_info.h | 4 + arch/um/kernel/process.c | 18 +- arch/x86/include/asm/kvm-x86-ops.h | 2 - arch/x86/include/asm/kvm_host.h | 22 +- arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/xen/hypercall.h | 5 +- arch/x86/kernel/cpu/bugs.c | 5 +- arch/x86/kernel/cpu/hygon.c | 3 + arch/x86/kvm/hyperv.c | 3 + arch/x86/kvm/lapic.c | 19 +- arch/x86/kvm/lapic.h | 1 + arch/x86/kvm/svm/svm.c | 42 ++- arch/x86/kvm/svm/vmenter.S | 9 +- arch/x86/kvm/trace.h | 9 +- arch/x86/kvm/vmx/nested.c | 26 +- arch/x86/kvm/vmx/pmu_intel.c | 8 +- arch/x86/kvm/vmx/vmx.c | 164 ++++++---- arch/x86/kvm/vmx/vmx.h | 31 +- arch/x86/kvm/x86.c | 46 ++- block/blk-core.c | 26 +- block/blk-settings.c | 2 +- crypto/jitterentropy-kcapi.c | 9 +- drivers/acpi/acpi_processor.c | 2 +- drivers/acpi/apei/ghes.c | 13 + drivers/acpi/pfr_update.c | 2 +- drivers/acpi/prmt.c | 26 +- drivers/acpi/processor_perflib.c | 11 + drivers/ata/Kconfig | 35 +- drivers/ata/libata-sata.c | 5 + drivers/ata/libata-scsi.c | 58 ++-- drivers/base/arch_topology.c | 69 ++-- drivers/base/power/runtime.c | 59 +++- drivers/block/drbd/drbd_receiver.c | 6 +- drivers/block/loop.c | 38 ++- drivers/block/sunvdc.c | 4 +- drivers/bus/mhi/host/boot.c | 8 +- drivers/bus/mhi/host/internal.h | 4 +- drivers/bus/mhi/host/main.c | 12 +- drivers/cdx/controller/cdx_rpmsg.c | 3 +- drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_watchdog.c | 59 +++- drivers/char/misc.c | 4 +- drivers/clk/qcom/gcc-ipq5018.c | 2 +- drivers/clk/tegra/clk-periph.c | 4 +- drivers/comedi/comedi_fops.c | 38 ++- drivers/comedi/comedi_internal.h | 1 + drivers/comedi/drivers.c | 40 ++- drivers/comedi/drivers/pcl726.c | 3 +- drivers/cpufreq/armada-8k-cpufreq.c | 2 +- drivers/cpufreq/cppc_cpufreq.c | 2 +- drivers/cpufreq/cpufreq.c | 12 +- drivers/cpuidle/governors/menu.c | 98 ++---- drivers/crypto/hisilicon/hpre/hpre_crypto.c | 8 +- .../crypto/intel/qat/qat_common/adf_common_drv.h | 1 + drivers/crypto/intel/qat/qat_common/adf_init.c | 1 + drivers/crypto/intel/qat/qat_common/adf_isr.c | 5 + drivers/crypto/intel/qat/qat_common/qat_algs.c | 12 +- .../crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 16 +- drivers/devfreq/governor_userspace.c | 6 +- drivers/dma/stm32-dma.c | 2 +- drivers/edac/synopsys_edac.c | 93 +++--- drivers/firmware/tegra/Kconfig | 5 +- drivers/fpga/zynq-fpga.c | 10 +- drivers/gpio/gpio-mlxbf2.c | 2 +- drivers/gpio/gpio-mlxbf3.c | 52 +-- drivers/gpio/gpio-tps65912.c | 7 +- drivers/gpio/gpio-virtio.c | 9 +- drivers/gpio/gpio-wcd934x.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 57 ++-- drivers/gpu/drm/amd/amdkfd/kfd_module.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 9 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c | 6 +- .../gpu/drm/amd/display/dc/bios/command_table.c | 2 +- drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 1 - .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 2 - .../amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 40 ++- .../amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c | 31 +- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 11 +- drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 3 + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 + drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 37 +-- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 4 +- drivers/gpu/drm/i915/intel_runtime_pm.c | 5 +- drivers/gpu/drm/msm/msm_gem.c | 3 +- drivers/gpu/drm/msm/msm_gem.h | 6 + drivers/gpu/drm/nouveau/nvif/vmm.c | 3 +- drivers/gpu/drm/renesas/rcar-du/rzg2l_mipi_dsi.c | 3 + drivers/gpu/drm/ttm/ttm_pool.c | 8 +- drivers/gpu/drm/ttm/ttm_resource.c | 3 + drivers/hid/hid-apple.c | 13 +- drivers/hid/hid-magicmouse.c | 56 ++-- drivers/hwmon/emc2305.c | 10 +- drivers/hwmon/gsc-hwmon.c | 4 +- drivers/i2c/i2c-core-acpi.c | 1 + drivers/i3c/internals.h | 1 + drivers/i3c/master.c | 4 +- drivers/idle/intel_idle.c | 2 +- drivers/iio/adc/ad7768-1.c | 23 +- drivers/iio/adc/ad_sigma_delta.c | 6 +- drivers/iio/imu/bno055/bno055.c | 11 +- drivers/iio/imu/inv_icm42600/inv_icm42600.h | 8 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 33 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 22 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 10 +- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 6 +- drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 43 ++- drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c | 12 +- drivers/iio/light/as73211.c | 2 +- drivers/iio/pressure/bmp280-core.c | 9 +- drivers/iio/proximity/isl29501.c | 14 +- drivers/iio/temperature/maxim_thermocouple.c | 26 +- drivers/infiniband/core/nldev.c | 22 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 30 +- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 - drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 + drivers/infiniband/hw/erdma/erdma_verbs.c | 4 +- drivers/infiniband/hw/hfi1/affinity.c | 44 +-- drivers/infiniband/sw/siw/siw_qp_tx.c | 5 +- drivers/iommu/amd/init.c | 4 +- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 + drivers/iommu/iommufd/io_pagetable.c | 48 ++- drivers/leds/flash/leds-qcom-flash.c | 178 +++++++++- drivers/leds/leds-lp50xx.c | 11 +- drivers/leds/trigger/ledtrig-netdev.c | 16 +- drivers/md/dm-ps-historical-service-time.c | 4 +- drivers/md/dm-ps-queue-length.c | 4 +- drivers/md/dm-ps-round-robin.c | 4 +- drivers/md/dm-ps-service-time.c | 4 +- drivers/md/dm-table.c | 10 +- drivers/md/dm-zoned-target.c | 2 +- drivers/media/cec/usb/rainshadow/rainshadow-cec.c | 3 +- drivers/media/dvb-frontends/dib7000p.c | 8 + drivers/media/i2c/ccs/ccs-core.c | 2 +- drivers/media/i2c/hi556.c | 26 +- drivers/media/i2c/ov2659.c | 3 +- drivers/media/i2c/tc358743.c | 86 +++-- drivers/media/pci/intel/ivsc/mei_ace.c | 2 + drivers/media/pci/intel/ivsc/mei_csi.c | 2 + drivers/media/platform/qcom/camss/camss.c | 4 +- drivers/media/platform/qcom/venus/core.c | 8 +- drivers/media/platform/qcom/venus/core.h | 2 + drivers/media/platform/qcom/venus/hfi_msgs.c | 83 +++-- drivers/media/platform/qcom/venus/hfi_venus.c | 5 + drivers/media/platform/qcom/venus/vdec.c | 5 +- drivers/media/platform/qcom/venus/venc.c | 5 +- .../media/platform/verisilicon/rockchip_vpu_hw.c | 9 - drivers/media/test-drivers/vivid/vivid-ctrls.c | 3 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 4 +- drivers/media/usb/gspca/vicam.c | 10 +- drivers/media/usb/hdpvr/hdpvr-i2c.c | 6 + drivers/media/usb/usbtv/usbtv-video.c | 4 + drivers/media/usb/uvc/uvc_driver.c | 3 + drivers/media/usb/uvc/uvc_video.c | 21 +- drivers/media/v4l2-core/v4l2-common.c | 8 +- drivers/media/v4l2-core/v4l2-ctrls-core.c | 1 - drivers/memstick/core/memstick.c | 1 - drivers/memstick/host/rtsx_usb_ms.c | 1 + drivers/mfd/axp20x.c | 3 +- drivers/misc/cardreader/rtsx_usb.c | 16 +- drivers/misc/mei/bus.c | 6 + drivers/mmc/host/rtsx_usb_sdmmc.c | 4 +- drivers/mmc/host/sdhci-msm.c | 14 + drivers/mmc/host/sdhci-pci-gli.c | 35 +- drivers/most/core.c | 2 +- drivers/mtd/nand/raw/fsmc_nand.c | 2 + drivers/mtd/nand/raw/renesas-nand-controller.c | 6 + drivers/mtd/nand/spi/core.c | 5 +- drivers/mtd/spi-nor/swp.c | 19 +- drivers/net/bonding/bond_3ad.c | 224 +++++++++++-- drivers/net/bonding/bond_main.c | 1 + drivers/net/bonding/bond_netlink.c | 16 + drivers/net/bonding/bond_options.c | 29 +- drivers/net/dsa/b53/b53_common.c | 63 +++- drivers/net/dsa/b53/b53_regs.h | 2 + drivers/net/ethernet/agere/et131x.c | 36 ++ drivers/net/ethernet/aquantia/atlantic/aq_hw.h | 2 + .../aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c | 39 +++ drivers/net/ethernet/atheros/ag71xx.c | 9 + drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 8 +- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 - drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 4 +- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 14 +- drivers/net/ethernet/freescale/fec_main.c | 34 +- drivers/net/ethernet/freescale/gianfar_ethtool.c | 4 +- drivers/net/ethernet/google/gve/gve_adminq.c | 1 + drivers/net/ethernet/google/gve/gve_main.c | 2 + drivers/net/ethernet/intel/igc/igc_main.c | 14 +- drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 4 +- drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 2 + drivers/net/ethernet/mediatek/mtk_wed.c | 1 - .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 18 +- drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 2 +- .../ethernet/mellanox/mlx5/core/esw/devlink_port.c | 4 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 + drivers/net/ethernet/mellanox/mlxsw/trap.h | 1 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 7 +- drivers/net/ethernet/ti/icssg/icss_iep.c | 26 +- drivers/net/hyperv/hyperv_net.h | 3 + drivers/net/hyperv/netvsc_drv.c | 29 +- drivers/net/ipa/ipa_smp2p.c | 2 +- drivers/net/phy/micrel.c | 12 +- drivers/net/phy/mscc/mscc.h | 12 + drivers/net/phy/mscc/mscc_main.c | 12 + drivers/net/phy/mscc/mscc_ptp.c | 49 ++- drivers/net/phy/smsc.c | 1 + drivers/net/ppp/ppp_generic.c | 17 +- drivers/net/thunderbolt/main.c | 21 +- drivers/net/usb/asix_devices.c | 1 + drivers/net/usb/cdc_ncm.c | 20 +- drivers/net/wireless/ath/ath11k/ce.c | 3 - drivers/net/wireless/ath/ath11k/dp_rx.c | 3 - drivers/net/wireless/ath/ath11k/hal.c | 33 +- drivers/net/wireless/ath/ath12k/ce.c | 3 - drivers/net/wireless/ath/ath12k/dp.c | 3 +- drivers/net/wireless/ath/ath12k/hal.c | 38 ++- drivers/net/wireless/ath/ath12k/hw.c | 2 +- drivers/net/wireless/ath/ath12k/wmi.c | 5 + .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 5 +- drivers/net/wireless/intel/iwlwifi/dvm/rs.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 7 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 25 +- drivers/net/wireless/realtek/rtlwifi/pci.c | 23 +- drivers/net/wireless/realtek/rtw89/core.c | 3 + drivers/net/wireless/realtek/rtw89/fw.c | 9 +- drivers/net/wireless/realtek/rtw89/fw.h | 2 + drivers/net/wireless/realtek/rtw89/mac.c | 19 ++ drivers/net/wireless/realtek/rtw89/reg.h | 1 + drivers/net/xen-netfront.c | 5 - drivers/nvme/host/pci.c | 24 +- drivers/pci/controller/dwc/pci-imx6.c | 7 +- drivers/pci/controller/pcie-rockchip-host.c | 49 +-- drivers/pci/controller/pcie-rockchip.h | 11 +- drivers/pci/endpoint/pci-ep-cfs.c | 1 + drivers/pci/endpoint/pci-epf-core.c | 2 +- drivers/pci/pci-acpi.c | 4 +- drivers/pci/pci.c | 10 +- drivers/pci/probe.c | 2 +- drivers/perf/cxl_pmu.c | 2 +- drivers/phy/qualcomm/phy-qcom-m31.c | 14 +- drivers/phy/rockchip/phy-rockchip-pcie.c | 3 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + drivers/platform/chrome/cros_ec.c | 3 + drivers/platform/chrome/cros_ec_typec.c | 4 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 + drivers/platform/x86/thinkpad_acpi.c | 4 +- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 10 + drivers/power/supply/qcom_battmgr.c | 2 + drivers/pps/clients/pps-gpio.c | 5 +- drivers/ptp/ptp_clock.c | 2 +- drivers/ptp/ptp_private.h | 5 + drivers/ptp/ptp_vclock.c | 7 + drivers/pwm/pwm-imx-tpm.c | 9 + drivers/pwm/pwm-mediatek.c | 71 ++-- drivers/remoteproc/imx_rproc.c | 4 +- drivers/reset/Kconfig | 10 +- drivers/rtc/rtc-ds1307.c | 15 +- drivers/s390/char/sclp.c | 11 +- drivers/scsi/aacraid/comminit.c | 3 +- drivers/scsi/bfa/bfad_im.c | 1 + drivers/scsi/libiscsi.c | 3 +- drivers/scsi/lpfc/lpfc_debugfs.c | 1 - drivers/scsi/lpfc/lpfc_scsi.c | 4 + drivers/scsi/mpi3mr/mpi3mr.h | 6 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 17 +- drivers/scsi/mpi3mr/mpi3mr_os.c | 22 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 19 ++ drivers/scsi/qla4xxx/ql4_os.c | 2 + drivers/scsi/scsi_scan.c | 2 +- drivers/scsi/scsi_transport_sas.c | 62 +++- drivers/soc/qcom/mdt_loader.c | 53 ++- drivers/soc/qcom/rpmh-rsc.c | 2 +- drivers/soc/tegra/pmc.c | 51 +-- drivers/soundwire/amd_manager.c | 6 +- drivers/soundwire/bus.c | 6 +- drivers/spi/spi-fsl-lpspi.c | 8 +- drivers/staging/media/imx/imx-media-csc-scaler.c | 2 +- drivers/target/target_core_fabric_lib.c | 65 +++- drivers/target/target_core_internal.h | 4 +- drivers/target/target_core_pr.c | 18 +- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 43 ++- drivers/thermal/thermal_sysfs.c | 9 +- drivers/thunderbolt/domain.c | 2 +- drivers/tty/serial/8250/8250_port.c | 3 +- drivers/tty/vt/defkeymap.c_shipped | 112 +++++++ drivers/tty/vt/keyboard.c | 2 +- drivers/ufs/core/ufshcd-priv.h | 2 +- drivers/ufs/host/ufs-exynos.c | 4 +- drivers/ufs/host/ufshcd-pci.c | 42 ++- drivers/usb/atm/cxacru.c | 172 +++++----- drivers/usb/class/cdc-acm.c | 11 +- drivers/usb/core/config.c | 10 +- drivers/usb/core/hcd.c | 8 +- drivers/usb/core/quirks.c | 1 + drivers/usb/core/urb.c | 2 +- drivers/usb/dwc3/dwc3-imx8mp.c | 6 +- drivers/usb/dwc3/dwc3-meson-g12a.c | 3 + drivers/usb/dwc3/dwc3-pci.c | 2 + drivers/usb/dwc3/ep0.c | 20 +- drivers/usb/dwc3/gadget.c | 19 +- drivers/usb/gadget/udc/renesas_usb3.c | 1 + drivers/usb/host/xhci-hub.c | 3 +- drivers/usb/host/xhci-mem.c | 24 +- drivers/usb/host/xhci-pci-renesas.c | 7 +- drivers/usb/host/xhci-ring.c | 19 +- drivers/usb/host/xhci.c | 27 +- drivers/usb/host/xhci.h | 3 +- drivers/usb/musb/omap2430.c | 14 +- drivers/usb/storage/realtek_cr.c | 2 +- drivers/usb/storage/unusual_devs.h | 29 ++ drivers/usb/typec/mux/intel_pmc_mux.c | 2 +- drivers/usb/typec/tcpm/fusb302.c | 8 + drivers/usb/typec/tcpm/maxim_contaminant.c | 54 +++ drivers/usb/typec/tcpm/tcpci_maxim.h | 1 + drivers/usb/typec/ucsi/psy.c | 2 +- drivers/usb/typec/ucsi/ucsi.c | 1 + drivers/usb/typec/ucsi/ucsi.h | 7 +- drivers/vfio/pci/mlx5/cmd.c | 4 +- drivers/vfio/vfio_iommu_type1.c | 7 + drivers/vhost/vhost.c | 3 + drivers/vhost/vsock.c | 6 +- drivers/video/console/vgacon.c | 2 +- drivers/video/fbdev/core/fbcon.c | 9 +- drivers/video/fbdev/core/fbmem.c | 3 + drivers/virt/coco/efi_secret/efi_secret.c | 10 +- drivers/watchdog/dw_wdt.c | 2 + drivers/watchdog/iTCO_wdt.c | 6 +- drivers/watchdog/sbsa_gwdt.c | 50 ++- fs/btrfs/backref.c | 6 +- fs/btrfs/block-group.c | 61 ++-- fs/btrfs/block-group.h | 11 +- fs/btrfs/block-rsv.c | 2 +- fs/btrfs/block-rsv.h | 2 +- fs/btrfs/btrfs_inode.h | 3 +- fs/btrfs/ctree.c | 24 +- fs/btrfs/ctree.h | 6 +- fs/btrfs/delayed-inode.c | 12 +- fs/btrfs/discard.c | 4 +- fs/btrfs/extent-tree.c | 33 +- fs/btrfs/file-item.c | 4 +- fs/btrfs/file-item.h | 2 +- fs/btrfs/free-space-tree.c | 17 +- fs/btrfs/inode-item.c | 10 +- fs/btrfs/inode-item.h | 4 +- fs/btrfs/inode.c | 26 +- fs/btrfs/qgroup.c | 31 +- fs/btrfs/relocation.c | 19 ++ fs/btrfs/send.c | 361 ++++++++++++--------- fs/btrfs/space-info.c | 17 +- fs/btrfs/space-info.h | 6 +- fs/btrfs/tree-log.c | 72 ++-- fs/btrfs/tree-mod-log.c | 14 +- fs/btrfs/tree-mod-log.h | 6 +- fs/btrfs/zoned.c | 20 +- fs/btrfs/zoned.h | 4 +- fs/buffer.c | 2 +- fs/crypto/fscrypt_private.h | 16 + fs/crypto/hkdf.c | 2 +- fs/crypto/keysetup.c | 3 +- fs/crypto/keysetup_v1.c | 3 +- fs/eventpoll.c | 60 +++- fs/exfat/dir.c | 12 + fs/exfat/fatent.c | 10 + fs/exfat/namei.c | 5 + fs/exfat/super.c | 32 +- fs/ext2/inode.c | 12 +- fs/ext4/fsmap.c | 23 +- fs/ext4/indirect.c | 4 +- fs/ext4/inline.c | 19 +- fs/ext4/inode.c | 2 +- fs/ext4/mballoc.c | 69 ++-- fs/ext4/orphan.c | 5 +- fs/ext4/super.c | 8 +- fs/f2fs/file.c | 24 +- fs/f2fs/node.c | 10 + fs/file.c | 15 + fs/gfs2/meta_io.c | 2 + fs/hfs/bfind.c | 3 + fs/hfs/bnode.c | 93 ++++++ fs/hfs/btree.c | 57 +++- fs/hfs/extent.c | 2 +- fs/hfs/hfs_fs.h | 1 + fs/hfsplus/bnode.c | 92 ++++++ fs/hfsplus/unicode.c | 7 + fs/hfsplus/xattr.c | 6 +- fs/hugetlbfs/inode.c | 2 +- fs/jbd2/checkpoint.c | 1 + fs/jfs/file.c | 3 + fs/jfs/inode.c | 2 +- fs/jfs/jfs_dmap.c | 6 + fs/libfs.c | 4 +- fs/namespace.c | 34 +- fs/nfs/blocklayout/blocklayout.c | 4 +- fs/nfs/blocklayout/dev.c | 5 +- fs/nfs/blocklayout/extent_tree.c | 20 +- fs/nfs/client.c | 44 ++- fs/nfs/internal.h | 2 +- fs/nfs/nfs4client.c | 20 +- fs/nfs/nfs4proc.c | 2 +- fs/nfs/pnfs.c | 11 +- fs/nfsd/nfs4state.c | 34 +- fs/ntfs3/dir.c | 3 + fs/ntfs3/inode.c | 31 +- fs/orangefs/orangefs-debugfs.c | 2 +- fs/smb/client/cifssmb.c | 10 + fs/smb/client/connect.c | 10 +- fs/smb/client/sess.c | 9 + fs/smb/client/smb2ops.c | 11 +- fs/smb/client/smbdirect.c | 24 +- fs/smb/server/connection.c | 3 +- fs/smb/server/connection.h | 7 +- fs/smb/server/oplock.c | 13 +- fs/smb/server/smb2pdu.c | 16 +- fs/smb/server/transport_rdma.c | 5 +- fs/smb/server/transport_rdma.h | 4 +- fs/smb/server/transport_tcp.c | 26 +- fs/squashfs/super.c | 14 +- fs/tracefs/inode.c | 11 + fs/udf/super.c | 13 +- fs/xfs/xfs_itable.c | 6 +- include/linux/arch_topology.h | 8 + include/linux/blk_types.h | 6 +- include/linux/compiler.h | 8 - include/linux/cpufreq.h | 1 + include/linux/energy_model.h | 6 +- include/linux/fs.h | 4 +- include/linux/hypervisor.h | 3 + include/linux/if_vlan.h | 21 +- include/linux/iosys-map.h | 7 +- include/linux/memfd.h | 14 + include/linux/mm.h | 76 +++-- include/linux/pci.h | 10 +- include/linux/pm_runtime.h | 18 +- include/linux/sched/topology.h | 8 + include/linux/skbuff.h | 8 +- include/linux/usb/cdc_ncm.h | 1 + include/linux/virtio_vsock.h | 7 +- include/net/bond_3ad.h | 3 + include/net/bond_options.h | 1 + include/net/bonding.h | 23 ++ include/net/cfg80211.h | 2 +- include/net/mac80211.h | 2 + include/net/neighbour.h | 1 + include/net/net_namespace.h | 16 + include/net/sock.h | 1 + include/trace/events/btrfs.h | 6 +- include/trace/events/thp.h | 2 + include/uapi/linux/if_link.h | 1 + include/uapi/linux/in6.h | 4 +- include/uapi/linux/io_uring.h | 2 +- include/uapi/linux/pfrut.h | 1 + io_uring/net.c | 19 +- kernel/bpf/verifier.c | 3 +- kernel/cgroup/cpuset.c | 2 +- kernel/fork.c | 2 +- kernel/module/main.c | 10 +- kernel/power/console.c | 7 +- kernel/rcu/tree.c | 2 + kernel/rcu/tree.h | 14 +- kernel/rcu/tree_plugin.h | 44 ++- kernel/sched/cpufreq_schedutil.c | 30 +- kernel/sched/fair.c | 19 +- kernel/trace/ftrace.c | 19 +- kernel/trace/trace.c | 33 +- kernel/trace/trace.h | 10 +- mm/debug_vm_pgtable.c | 9 +- mm/filemap.c | 2 +- mm/kmemleak.c | 10 +- mm/madvise.c | 2 +- mm/memfd.c | 2 +- mm/memory-failure.c | 8 + mm/mmap.c | 12 +- mm/ptdump.c | 2 + mm/shmem.c | 2 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sock.c | 2 +- net/bridge/br_multicast.c | 16 + net/bridge/br_private.h | 2 + net/core/dev.c | 12 + net/core/neighbour.c | 12 +- net/core/net_namespace.c | 8 +- net/core/sock.c | 27 +- net/hsr/hsr_slave.c | 8 +- net/ipv4/netfilter/nf_reject_ipv4.c | 6 +- net/ipv4/route.c | 1 - net/ipv4/udp_offload.c | 2 +- net/ipv6/addrconf.c | 7 +- net/ipv6/mcast.c | 11 +- net/ipv6/netfilter/nf_reject_ipv6.c | 5 +- net/ipv6/seg6_hmac.c | 6 +- net/mac80211/cfg.c | 12 +- net/mac80211/chan.c | 1 + net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 12 +- net/mctp/af_mctp.c | 28 +- net/mptcp/options.c | 6 +- net/mptcp/pm_netlink.c | 19 +- net/mptcp/subflow.c | 5 +- net/ncsi/internal.h | 2 +- net/ncsi/ncsi-rsp.c | 1 + net/netfilter/nf_conntrack_netlink.c | 24 +- net/netlink/af_netlink.c | 12 +- net/rds/tcp.c | 8 +- net/sched/sch_cake.c | 14 +- net/sched/sch_ets.c | 36 +- net/sched/sch_htb.c | 2 +- net/sctp/input.c | 2 +- net/smc/af_smc.c | 8 +- net/sunrpc/svcsock.c | 5 +- net/sunrpc/xprtsock.c | 8 +- net/tls/tls.h | 2 +- net/tls/tls_strp.c | 11 +- net/tls/tls_sw.c | 10 +- net/vmw_vsock/virtio_transport.c | 14 +- net/wireless/mlme.c | 3 +- net/xfrm/xfrm_state.c | 74 +++-- scripts/kconfig/gconf.c | 8 +- scripts/kconfig/lxdialog/inputbox.c | 6 +- scripts/kconfig/lxdialog/menubox.c | 2 +- scripts/kconfig/nconf.c | 2 + scripts/kconfig/nconf.gui.c | 1 + security/apparmor/file.c | 6 +- security/apparmor/include/lib.h | 6 +- security/inode.c | 2 - sound/core/pcm_native.c | 19 +- sound/hda/hdac_device.c | 2 +- sound/pci/hda/hda_codec.c | 44 +-- sound/pci/hda/patch_ca0132.c | 2 +- sound/pci/hda/patch_realtek.c | 4 + sound/pci/intel8x0.c | 2 +- sound/soc/codecs/hdac_hdmi.c | 10 +- sound/soc/codecs/rt5640.c | 5 + sound/soc/fsl/fsl_sai.c | 20 +- sound/soc/intel/avs/core.c | 3 +- sound/soc/qcom/lpass-platform.c | 27 +- sound/soc/soc-core.c | 3 + sound/soc/soc-dapm.c | 4 + sound/usb/mixer_quirks.c | 14 +- sound/usb/stream.c | 25 +- sound/usb/validate.c | 14 +- tools/bpf/bpftool/main.c | 6 +- tools/include/nolibc/std.h | 4 +- tools/include/nolibc/types.h | 4 +- tools/include/uapi/linux/if_link.h | 1 + .../cpupower/utils/idle_monitor/mperf_monitor.c | 4 +- tools/scripts/Makefile.include | 4 +- tools/testing/ktest/ktest.pl | 5 +- tools/testing/selftests/arm64/fp/sve-ptrace.c | 3 +- .../selftests/bpf/prog_tests/user_ringbuf.c | 10 +- .../testing/selftests/bpf/progs/verifier_unpriv.c | 2 +- .../ftrace/test.d/ftrace/func-filter-glob.tc | 2 +- tools/testing/selftests/futex/include/futextest.h | 11 + tools/testing/selftests/memfd/memfd_test.c | 43 +++ tools/testing/selftests/net/mptcp/pm_netlink.sh | 1 + 612 files changed, 6034 insertions(+), 2714 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/587 io_uring: dont use int for ABI
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit cf73d9970ea4f8cace5d8f02d2565a2723003112 upstream.
__kernel_rwf_t is defined as int, the actual size of which is implementation defined. It won't go well if some compiler / archs ever defines it as i64, so replace it with __u32, hoping that there is no one using i16 for it.
--- include/uapi/linux/io_uring.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/io_uring.h +1 -1
@@ -46,7 +46,7 @@ struct io_uring_sqe { };__u32 len;/* buffer size or number of iovecs */ union { -__kernel_rwf_t rw_flags; +__u32 rw_flags;__u32 fsync_flags;__u16 poll_events;/* compatibility */ __u32 poll32_events;/* word-reversed for BE */
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
Quick query - should we be backporting a known regression, even if it is in mainline presently, or do we wait until the fix is applied to mainline and *then* backport both patches?
9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes")
introduces a regression which breaks IPv4 broadcast, which stops WOL working (breaking my CI system), among other things:
https://lore.kernel.org/regressions/[email protected]
This regression has *already* been backported to:
- 6.16.3
- 6.12.43
so I guess we wait for a fix for these.
However, it is not yet present in the other stable kernels. The new stable release candidates today would spread the breakage to:
- 6.6.y
- 6.1.y
- 5.15.y
- 5.10.y
Do we revert this patch in today's RCs for now, or keep it for full compatibility with mainline bugliness?
Cheers,
Brett
--
Quoted 29 lines · Brett A C Sheffield
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
Quick query - should we be backporting a known regression, even if it is in mainline presently, or do we wait until the fix is applied to mainline and *then* backport both patches?
9e30ecf23b1b("net: ipv4: fix incorrect MTU in broadcast routes")introduces a regression which breaks IPv4 broadcast, which stops WOL working (breaking my CI system), among other things:
https://lore.kernel.org/regressions/[email protected]
This regression has *already* been backported to:
- 6.16.3
- 6.12.43so I guess we wait for a fix for these.
Quoted 7 lines
However, it is not yet present in the other stable kernels. The new stable release candidates today would spread the breakage to:
- 6.6.y
- 6.1.y
- 5.15.y
- 5.10.y
oops - and 5.4.y
My goodness there are a lot of stable trees to keep track of!
Brett
Greg Kroah-Hartman
maintainerQuoted 32 lines · Brett A C Sheffield
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
Quick query - should we be backporting a known regression, even if it is in mainline presently, or do we wait until the fix is applied to mainline and *then* backport both patches?
9e30ecf23b1b("net: ipv4: fix incorrect MTU in broadcast routes")introduces a regression which breaks IPv4 broadcast, which stops WOL working (breaking my CI system), among other things:
https://lore.kernel.org/regressions/[email protected]
This regression has *already* been backported to:
- 6.16.3
- 6.12.43so I guess we wait for a fix for these.
However, it is not yet present in the other stable kernels. The new stable release candidates today would spread the breakage to:
Quoted 7 lines
- 6.6.y
- 6.1.y
- 5.15.y
- 5.10.yDo we revert this patch in today's RCs for now, or keep it for full compatibility with mainline bugliness?
Is the fix in linux-next yet? If it's there, I can queue it up everywhere, which might be best.
thanks,
greg k-h
Quoted 38 lines · Greg Kroah-Hartman
Quoted 37 lines · Brett A C Sheffield
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
Quick query - should we be backporting a known regression, even if it is in mainline presently, or do we wait until the fix is applied to mainline and *then* backport both patches?
9e30ecf23b1b("net: ipv4: fix incorrect MTU in broadcast routes")introduces a regression which breaks IPv4 broadcast, which stops WOL working (breaking my CI system), among other things:
https://lore.kernel.org/regressions/[email protected]
This regression has *already* been backported to:
- 6.16.3
- 6.12.43so I guess we wait for a fix for these.
However, it is not yet present in the other stable kernels. The new stable release candidates today would spread the breakage to:
- 6.6.y
- 6.1.y
- 5.15.y
- 5.10.y
Quoted 5 lines
Quoted 2 lines
Do we revert this patch in today's RCs for now, or keep it for full compatibility with mainline bugliness?
Is the fix in linux-next yet? If it's there, I can queue it up everywhere, which might be best.
Not yet, but I'll let you know as soon as it is. I'd suggest dropping 9e30ecf23b1b from 6.6.y 6.1.y 5.15.y 5.10.y and 5.4.y until the fix is available.
Cheers,
Brett
--
Quoted 42 lines · Brett Sheffield
Quoted 41 lines · Greg Kroah-Hartman
Quoted 39 lines · Brett A C Sheffield
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.103 release. There are 587 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 28 Aug 2025 11:08:24 +0000. Anything received after that time might be too late.
Quick query - should we be backporting a known regression, even if it is in mainline presently, or do we wait until the fix is applied to mainline and *then* backport both patches?
9e30ecf23b1b("net: ipv4: fix incorrect MTU in broadcast routes")introduces a regression which breaks IPv4 broadcast, which stops WOL working (breaking my CI system), among other things:
https://lore.kernel.org/regressions/[email protected]
This regression has *already* been backported to:
- 6.16.3
- 6.12.43so I guess we wait for a fix for these.
However, it is not yet present in the other stable kernels. The new stable release candidates today would spread the breakage to:
- 6.6.y
- 6.1.y
- 5.15.y
- 5.10.yDo we revert this patch in today's RCs for now, or keep it for full compatibility with mainline bugliness?
Quoted 6 lines
Quoted 2 lines
Is the fix in linux-next yet? If it's there, I can queue it up everywhere, which might be best.
Not yet, but I'll let you know as soon as it is. I'd suggest dropping
9e30ecf23b1bfrom 6.6.y 6.1.y 5.15.y 5.10.y and 5.4.y until the fix is available.
Hi Greg,
The fix has hit Linus' tree now with commit:
5189446ba995 ("net: ipv4: fix regression in local-broadcast routes")
This needs to be applied to all stable trees.
Cheers,
Brett
Greg Kroah-Hartman
maintainerPATCH 2/587 ALSA: usb-audio: Validate UAC3 power domain descriptors, too
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit d832ccbc301fbd9e5a1d691bdcf461cdb514595f upstream.
UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.
--- sound/usb/validate.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/usb/validate.c +12 -0
@@ -221,6 +221,17 @@ static bool validate_uac3_feature_unit(creturn d->bLength >=sizeof (*d) +4 +2 ; } +static bool validate_uac3_power_domain_unit (const void *p, +const struct usb_desc_validator *v) +{ +const struct uac3_power_domain_descriptor *d = p; + +if (d->bLength <sizeof (*d)) +return false; +/* baEntities[] + wPDomainDescrStr */ +return d->bLength >=sizeof (*d) + d->bNrEntities +2 ; +} +static bool validate_midi_out_jack (const void *p,const struct usb_desc_validator *v) {
@@ -285,6 +296,7 @@ static const struct usb_desc_validator a struct uac3_clock_multiplier_descriptor), /* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */ /* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */ + FUNC(UAC_VERSION_3, UAC3_POWER_DOMAIN, validate_uac3_power_domain_unit), { }/* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 3/587 ALSA: usb-audio: Validate UAC3 cluster segment descriptors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ecfd41166b72b67d3bdeb88d224ff445f6163869 upstream.
UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.
--- sound/usb/stream.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-)
sound/usb/stream.c +22 -3
@@ -341,20 +341,28 @@ snd_pcm_chmap_elem *convert_chmap_v3(str len =le16_to_cpu (cluster->wLength); c =0 ; - p +=sizeof (struct uac3_cluster_header_descriptor ); + p +=sizeof (*cluster); + len -=sizeof (*cluster); -while (((p - (void *)cluster) < len) && (c < channels)) { +while (len >0 && (c < channels)) {struct uac3_cluster_segment_descriptor *cs_desc = p;u16 cs_len;u8 cs_type; +if (len <sizeof (*p)) +break ; cs_len =le16_to_cpu (cs_desc->wLength); +if (len < cs_len) +break ; cs_type = cs_desc->bSegmentType;if (cs_type ==UAC3_CHANNEL_INFORMATION ) {struct uac3_cluster_information_segment_descriptor *is = p;unsigned char map; +if (cs_len <sizeof (*is)) +break ; +/* * TODO: this conversion is not complete, update it * after adding UAC3 values to asound.h
@@ -456,6 +464,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(str chmap->map[c++] = map; } p += cs_len; + len -= cs_len; }if (channels < c)
@@ -876,7 +885,7 @@ snd_usb_get_audioformat_uac3(struct snd_u64 badd_formats =0 ;unsigned int num_channels;struct audioformat *fp; -u16 cluster_id, wLength; +u16 cluster_id, wLength, cluster_wLength;int clock =0 ;int err;
@@ -1003,6 +1012,16 @@ snd_usb_get_audioformat_uac3(struct snd_ iface_no, altno);kfree (cluster);return ERR_PTR (-EIO ); + } + + cluster_wLength =le16_to_cpu (cluster->wLength); +if (cluster_wLength <sizeof (*cluster) || + cluster_wLength > wLength) { +dev_err (&dev->dev, +"%u:%d : invalid Cluster Descriptor size\n" , + iface_no, altno); +kfree (cluster); +return ERR_PTR (-EIO ); } num_channels = cluster->bNrChannels;
Greg Kroah-Hartman
maintainerPATCH 4/587 ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit b26e2afb3834d4a61ce54c8484ff6014bef0b4b7 upstream.
Add a PCI quirk to enable microphone input on the headphone jack on the HONOR BRB-X M1010 laptop.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10636,6 +10636,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x1d72 ,0x1901 ,"RedmiBook 14" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ), +SND_PCI_QUIRK (0x1ee7 ,0x2078 ,"HONOR BRB-X M1010" ,ALC2XX_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1f66 ,0x0105 ,"Ayaneo Portable Game Player" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x2014 ,0x800a ,"Positivo ARN50" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
Greg Kroah-Hartman
maintainerPATCH 5/587 ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Eby <[email protected]>
commit 0db77eccd964b11ab2b757031d1354fcc5a025ea upstream.
Framework Laptop 13 (AMD Ryzen AI 300) requires the same quirk for headset detection as other Framework 13 models.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10652,6 +10652,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0009 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0xf111 ,0x000b ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x000c ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0
Greg Kroah-Hartman
maintainerPATCH 6/587 smb3: fix for slab out of bounds on mount to ksmbd
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 7d34ec36abb84fdfb6632a0f2cbda90379ae21fc upstream.
With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below):
BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]
--- fs/smb/client/smb2ops.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/smb/client/smb2ops.c +10 -1
@@ -730,6 +730,13 @@ next_iface: bytes_left -=sizeof (*p);break ; } +/* Validate that Next doesn't point beyond the buffer */ +if (next > bytes_left) { +cifs_dbg (VFS ,"%s: invalid Next pointer %zu > %zd\n" , + __func__, next, bytes_left); + rc = -EINVAL ; + goto out; + } p = (struct network_interface_info_ioctl_rsp *)((u8 *)p+next); bytes_left -= next; }
@@ -741,7 +748,9 @@ next_iface: }/* Azure rounds the buffer size up 8, to a 16 byte boundary */ -if ((bytes_left >8 ) || p->Next) +if ((bytes_left >8 ) || + (bytes_left >= offsetof(struct network_interface_info_ioctl_rsp , Next) + +sizeof (p->Next) && p->Next))cifs_dbg (VFS ,"%s: incomplete interface info\n" , __func__); ses->iface_last_update = jiffies;
Greg Kroah-Hartman
maintainerPATCH 7/587 smb: client: remove redundant lstrp update in negotiate protocol
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Zhaolong <[email protected]>
commit e19d8dd694d261ac26adb2a26121a37c107c81ad upstream.
Commit 34331d7beed7 ("smb: client: fix first command failure during re-negotiation") addressed a race condition by updating lstrp before entering negotiate state. However, this approach may have some unintended side effects.
The lstrp field is documented as "when we got last response from this server", and updating it before actually receiving a server response could potentially affect other mechanisms that rely on this timestamp. For example, the SMB echo detection logic also uses lstrp as a reference point. In scenarios with frequent user operations during reconnect states, the repeated calls to cifs_negotiate_protocol() might continuously update lstrp, which could interfere with the echo detection timing.
Additionally, commit 266b5d02e14f ("smb: client: fix race condition in negotiate timeout by using more precise timing") introduced a dedicated neg_start field specifically for tracking negotiate start time. This provides a more precise solution for the original race condition while preserving the intended semantics of lstrp.
Since the race condition is now properly handled by the neg_start mechanism, the lstrp update in cifs_negotiate_protocol() is no longer necessary and can be safely removed.
--- fs/smb/client/connect.c | 1 - 1 file changed, 1 deletion(-)
fs/smb/client/connect.c +0 -1
@@ -3998,7 +3998,6 @@ retry:return 0 ; } - server->lstrp = jiffies; server->tcpStatus = CifsInNegotiate; server->neg_start = jiffies;spin_unlock (&server->srv_lock);
Greg Kroah-Hartman
maintainerPATCH 8/587 gpio: virtio: Fix config space reading.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Mommer <[email protected]>
commit 4740e1e2f320061c2f0dbadc0dd3dfb58df986d5 upstream.
Quote from the virtio specification chapter 4.2.2.2:
"For the device-specific configuration space, the driver MUST use 8 bit wide accesses for 8 bit wide fields, 16 bit wide and aligned accesses for 16 bit wide fields and 32 bit wide and aligned accesses for 32 and 64 bit wide fields."
--- drivers/gpio/gpio-virtio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpio/gpio-virtio.c +5 -4
@@ -539,7 +539,6 @@ static const char **virtio_gpio_get_namestatic int virtio_gpio_probe (struct virtio_device *vdev) { -struct virtio_gpio_config config;struct device *dev = &vdev->dev;struct virtio_gpio *vgpio;u32 gpio_names_size;
@@ -551,9 +550,11 @@ static int virtio_gpio_probe(struct virtreturn -ENOMEM ;/* Read configuration */ -virtio_cread_bytes (vdev,0 , &config,sizeof (config)); - gpio_names_size =le32_to_cpu (config.gpio_names_size); - ngpio =le16_to_cpu (config.ngpio); + gpio_names_size = +virtio_cread32 (vdev, offsetof(struct virtio_gpio_config , + gpio_names_size)); + ngpio =virtio_cread16 (vdev, offsetof(struct virtio_gpio_config , + ngpio));if (!ngpio) {dev_err (dev,"Number of GPIOs can't be zero\n" );return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 9/587 gpio: mlxbf2: use platform_get_irq_optional()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
commit 63c7bc53a35e785accdc2ceab8f72d94501931ab upstream.
The gpio-mlxbf2 driver interfaces with four GPIO controllers, device instances 0-3. There are two IRQ resources shared between the four controllers, and they are found in the ACPI table for instances 0 and 3. The driver should not use platform_get_irq(), otherwise this error is logged when probing instances 1 and 2:
mlxbf2_gpio MLNXBF22:01: error -ENXIO: IRQ index 0 not found
--- drivers/gpio/gpio-mlxbf2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-mlxbf2.c +1 -1
@@ -397,7 +397,7 @@ mlxbf2_gpio_probe(struct platform_device gc->ngpio = npins; gc->owner =THIS_MODULE ; - irq =platform_get_irq (pdev,0 ); + irq =platform_get_irq_optional (pdev,0 );if (irq >=0 ) { girq = &gs->gc.irq;gpio_irq_chip_set_chip (girq, &mlxbf2_gpio_irq_chip);
Greg Kroah-Hartman
maintainerPATCH 10/587 Revert "gpio: mlxbf3: only get IRQ for device instance 0"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
commit 56bdf7270ff4f870e2d4bfacdc00161e766dba2d upstream.
This reverts commit 10af0273a35ab4513ca1546644b8c853044da134.
While this change was merged, it is not the preferred solution. During review of a similar change to the gpio-mlxbf2 driver, the use of "platform_get_irq_optional" was identified as the preferred solution, so let's use it for gpio-mlxbf3 driver as well.
--- drivers/gpio/gpio-mlxbf3.c | 54 +++++++++++++++------------------------------ 1 file changed, 19 insertions(+), 35 deletions(-)
drivers/gpio/gpio-mlxbf3.c +19 -35
@@ -190,9 +190,7 @@ static int mlxbf3_gpio_probe(struct platstruct mlxbf3_gpio_context *gs;struct gpio_irq_chip *girq;struct gpio_chip *gc; -char *colon_ptr;int ret, irq; -long num; gs =devm_kzalloc (dev,sizeof (*gs),GFP_KERNEL );if (!gs)
@@ -229,39 +227,25 @@ static int mlxbf3_gpio_probe(struct plat gc->owner =THIS_MODULE ; gc->add_pin_ranges = mlxbf3_gpio_add_pin_ranges; - colon_ptr =strchr (dev_name (dev),':' ); -if (!colon_ptr) { -dev_err (dev,"invalid device name format\n" ); -return -EINVAL ; - } - - ret =kstrtol (++colon_ptr,16 , &num); -if (ret) { -dev_err (dev,"invalid device instance\n" ); -return ret; - } - -if (!num) { - irq =platform_get_irq (pdev,0 ); -if (irq >=0 ) { - girq = &gs->gc.irq; -gpio_irq_chip_set_chip (girq, &gpio_mlxbf3_irqchip); - girq->default_type =IRQ_TYPE_NONE ; -/* This will let us handle the parent IRQ in the driver */ - girq->num_parents =0 ; - girq->parents =NULL ; - girq->parent_handler =NULL ; - girq->handler = handle_bad_irq; - -/* -* Directly request the irq here instead of passing -* a flow-handler because the irq is shared. -*/ - ret =devm_request_irq (dev, irq, mlxbf3_gpio_irq_handler, -IRQF_SHARED ,dev_name (dev), gs); -if (ret) -return dev_err_probe (dev, ret,"failed to request IRQ" ); - } + irq =platform_get_irq (pdev,0 ); +if (irq >=0 ) { + girq = &gs->gc.irq; +gpio_irq_chip_set_chip (girq, &gpio_mlxbf3_irqchip); + girq->default_type =IRQ_TYPE_NONE ; +/* This will let us handle the parent IRQ in the driver */ + girq->num_parents =0 ; + girq->parents =NULL ; + girq->parent_handler =NULL ; + girq->handler = handle_bad_irq; + +/* +* Directly request the irq here instead of passing +* a flow-handler because the irq is shared. +*/ + ret =devm_request_irq (dev, irq, mlxbf3_gpio_irq_handler, +IRQF_SHARED ,dev_name (dev), gs); +if (ret) +return dev_err_probe (dev, ret,"failed to request IRQ" ); }platform_set_drvdata (pdev, gs);
Greg Kroah-Hartman
maintainerPATCH 11/587 gpio: mlxbf3: use platform_get_irq_optional()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
commit 810bd9066fb1871b8a9528f31f2fdbf2a8b73bf2 upstream.
The gpio-mlxbf3 driver interfaces with two GPIO controllers, device instance 0 and 1. There is a single IRQ resource shared between the two controllers, and it is found in the ACPI table for device instance 0. The driver should not use platform_get_irq(), otherwise this error is logged when probing instance 1:
mlxbf3_gpio MLNXBF33:01: error -ENXIO: IRQ index 0 not found
--- drivers/gpio/gpio-mlxbf3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-mlxbf3.c +1 -1
@@ -227,7 +227,7 @@ static int mlxbf3_gpio_probe(struct plat gc->owner =THIS_MODULE ; gc->add_pin_ranges = mlxbf3_gpio_add_pin_ranges; - irq =platform_get_irq (pdev,0 ); + irq =platform_get_irq_optional (pdev,0 );if (irq >=0 ) { girq = &gs->gc.irq;gpio_irq_chip_set_chip (girq, &gpio_mlxbf3_irqchip);
Greg Kroah-Hartman
maintainerPATCH 12/587 Revert "leds: trigger: netdev: Configure LED blink interval for HW offload"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <[email protected]>
commit 26f732791f2bcab18f59c61915bbe35225f30136 upstream.
This reverts commit c629c972b310af41e9e072febb6dae9a299edde6.
While .led_blink_set() would previously put an LED into an unconditional permanently blinking state, the offending commit now uses same operation to (also?) set the blink timing of the netdev trigger when offloading.
This breaks many if not all of the existing PHY drivers which offer offloading LED operations, as those drivers would just put the LED into blinking state after .led_blink_set() has been called.
Unfortunately the change even made it into stable kernels for unknown reasons, so it should be reverted there as well.
--- drivers/leds/trigger/ledtrig-netdev.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
drivers/leds/trigger/ledtrig-netdev.c +3 -13
@@ -54,7 +54,6 @@ struct led_netdev_data {unsigned int last_activity;unsigned long mode; -unsigned long blink_delay;int link_speed;u8 duplex;
@@ -70,10 +69,6 @@ static void set_baseline_state(struct le/* Already validated, hw control is possible with the requested mode */ if (trigger_data->hw_control) { led_cdev->hw_control_set (led_cdev, trigger_data->mode); -if (led_cdev->blink_set) { - led_cdev->blink_set (led_cdev, &trigger_data->blink_delay, - &trigger_data->blink_delay); - }return ; }
@@ -391,11 +386,10 @@ static ssize_t interval_store(struct dev size_t size) {struct led_netdev_data *trigger_data =led_trigger_get_drvdata (dev); -struct led_classdev *led_cdev = trigger_data->led_cdev;unsigned long value;int ret; -if (trigger_data->hw_control && !led_cdev->blink_set) +if (trigger_data->hw_control)return -EINVAL ; ret =kstrtoul (buf,0 , &value);
@@ -404,13 +398,9 @@ static ssize_t interval_store(struct dev/* impose some basic bounds on the timer interval */ if (value >=5 && value <=10000 ) { -if (trigger_data->hw_control) { - trigger_data->blink_delay = value; - }else { -cancel_delayed_work_sync (&trigger_data->work); +cancel_delayed_work_sync (&trigger_data->work); -atomic_set (&trigger_data->interval,msecs_to_jiffies (value)); - } +atomic_set (&trigger_data->interval,msecs_to_jiffies (value));set_baseline_state (trigger_data);/* resets timer */ }
Greg Kroah-Hartman
maintainerPATCH 13/587 netlink: avoid infinite retry looping in netlink_unicast()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
commit 759dfc7d04bab1b0b86113f1164dc1fec192b859 upstream.
netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has:
rmem < READ_ONCE(sk->sk_rcvbuf)
to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under:
rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)
The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as:
rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: <IRQ> dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 </IRQ> netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304
Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code.
Found by Linux Verification Center (linuxtesting.org).
--- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netlink/af_netlink.c +1 -1
@@ -1229,7 +1229,7 @@ int netlink_attachskb(struct sock *sk, s nlk =nlk_sk (sk); rmem =atomic_add_return (skb->truesize, &sk->sk_rmem_alloc); -if ((rmem == skb->truesize || rmem <READ_ONCE (sk->sk_rcvbuf)) && +if ((rmem == skb->truesize || rmem <=READ_ONCE (sk->sk_rcvbuf)) && !test_bit (NETLINK_S_CONGESTED , &nlk->state)) {netlink_skb_set_owner_r (skb, sk);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 14/587 net: phy: micrel: fix KSZ8081/KSZ8091 cable test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Larysch <[email protected]>
commit 49db61c27c4bbd24364086dc0892bd3e14c1502e upstream.
Commit 21b688dabecb ("net: phy: micrel: Cable Diag feature for lan8814 phy") introduced cable_test support for the LAN8814 that reuses parts of the KSZ886x logic and introduced the cable_diag_reg and pair_mask parameters to account for differences between those chips.
However, it did not update the ksz8081_type struct, so those members are now 0, causing no pairs to be tested in ksz886x_cable_test_get_status and ksz886x_cable_test_wait_for_completion to poll the wrong register for the affected PHYs (Basic Control/Reset, which is 0 in normal operation) and exit immediately.
Fix this by setting both struct members accordingly.
--- drivers/net/phy/micrel.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/phy/micrel.c +2 -0
@@ -372,6 +372,8 @@ static const struct kszphy_type ksz8051_static const struct kszphy_type ksz8081_type = { .led_mode_reg =MII_KSZPHY_CTRL_2 , + .cable_diag_reg =KSZ8081_LMD , + .pair_mask =KSZPHY_WIRE_PAIR_MASK , .has_broadcast_disable = true, .has_nand_tree_disable = true, .has_rmii_ref_clk_sel = true,
Greg Kroah-Hartman
maintainerPATCH 15/587 net: gianfar: fix device leak when querying time stamp info
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit da717540acd34e5056e3fa35791d50f6b3303f55 upstream.
Make sure to drop the reference to the ptp device taken by of_find_device_by_node() when querying the time stamping capabilities.
Note that holding a reference to the ptp device does not prevent its driver data from going away.
--- drivers/net/ethernet/freescale/gianfar_ethtool.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/gianfar_ethtool.c +3 -1
@@ -1468,8 +1468,10 @@ static int gfar_get_ts_info(struct net_dif (ptp_node) { ptp_dev =of_find_device_by_node (ptp_node);of_node_put (ptp_node); -if (ptp_dev) +if (ptp_dev) { ptp =platform_get_drvdata (ptp_dev); +put_device (&ptp_dev->dev); + } }if (ptp)
Greg Kroah-Hartman
maintainerPATCH 16/587 net: enetc: fix device and OF node leak at probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 70458f8a6b44daf3ad39f0d9b6d1097c8a7780ed upstream.
Make sure to drop the references to the IERB OF node and platform device taken by of_parse_phandle() and of_find_device_by_node() during probe.
--- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc_pf.c +12 -2
@@ -1179,19 +1179,29 @@ static int enetc_pf_register_with_ierb(s {struct platform_device *ierb_pdev;struct device_node *ierb_node; +int ret; ierb_node =of_find_compatible_node (NULL ,NULL ,"fsl,ls1028a-enetc-ierb" ); -if (!ierb_node || !of_device_is_available (ierb_node)) +if (!ierb_node)return -ENODEV ; +if (!of_device_is_available (ierb_node)) { +of_node_put (ierb_node); +return -ENODEV ; + } + ierb_pdev =of_find_device_by_node (ierb_node);of_node_put (ierb_node);if (!ierb_pdev)return -EPROBE_DEFER ; -return enetc_ierb_register_pf (ierb_pdev, pdev); + ret =enetc_ierb_register_pf (ierb_pdev, pdev); + +put_device (&ierb_pdev->dev); + +return ret; }static struct enetc_si *enetc_psi_create (struct pci_dev *pdev)
Greg Kroah-Hartman
maintainerPATCH 17/587 net: mtk_eth_soc: fix device leak at probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3e13274ca8750823e8b68181bdf185d238febe0d upstream.
The reference count to the WED devices has already been incremented when looking them up using of_find_device_by_node() so drop the bogus additional reference taken during probe.
--- drivers/net/ethernet/mediatek/mtk_wed.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_wed.c +0 -1
@@ -1886,7 +1886,6 @@ void mtk_wed_add_hw(struct device_node *if (!pdev) goto err_of_node_put; -get_device (&pdev->dev); irq =platform_get_irq (pdev,0 );if (irq <0 ) goto err_put_device;
Greg Kroah-Hartman
maintainerPATCH 18/587 net: ti: icss-iep: fix device and OF node leaks at probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e05c54974a05ab19658433545d6ced88d9075cf0 upstream.
Make sure to drop the references to the IEP OF node and device taken by of_parse_phandle() and of_find_device_by_node() when looking up IEP devices during probe.
Drop the bogus additional reference taken on successful lookup so that the device is released correctly by icss_iep_put().
--- drivers/net/ethernet/ti/icssg/icss_iep.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/net/ethernet/ti/icssg/icss_iep.c +18 -5
@@ -702,11 +702,17 @@ struct icss_iep *icss_iep_get_idx(structstruct platform_device *pdev;struct device_node *iep_np;struct icss_iep *iep; +int ret; iep_np =of_parse_phandle (np,"ti,iep" , idx); -if (!iep_np || !of_device_is_available (iep_np)) +if (!iep_np)return ERR_PTR (-ENODEV ); +if (!of_device_is_available (iep_np)) { +of_node_put (iep_np); +return ERR_PTR (-ENODEV ); + } + pdev =of_find_device_by_node (iep_np);of_node_put (iep_np);
@@ -715,21 +721,28 @@ struct icss_iep *icss_iep_get_idx(structreturn ERR_PTR (-EPROBE_DEFER ); iep =platform_get_drvdata (pdev); -if (!iep) -return ERR_PTR (-EPROBE_DEFER ); +if (!iep) { + ret = -EPROBE_DEFER ; + goto err_put_pdev; + }device_lock (iep->dev);if (iep->client_np) {device_unlock (iep->dev);dev_err (iep->dev,"IEP is already acquired by %s" , iep->client_np->name); -return ERR_PTR (-EBUSY ); + ret = -EBUSY ; + goto err_put_pdev; } iep->client_np = np;device_unlock (iep->dev); -get_device (iep->dev);return iep; + +err_put_pdev: +put_device (&pdev->dev); + +return ERR_PTR (ret); }EXPORT_SYMBOL_GPL (icss_iep_get_idx);
Greg Kroah-Hartman
maintainerPATCH 19/587 net: dpaa: fix device leak when querying time stamp info
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3fa840230f534385b34a4f39c8dd313fbe723f05 upstream.
Make sure to drop the reference to the ptp device taken by of_find_device_by_node() when querying the time stamping capabilities.
Note that holding a reference to the ptp device does not prevent its driver data from going away.
--- drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c +3 -1
@@ -415,8 +415,10 @@ static int dpaa_get_ts_info(struct net_dof_node_put (ptp_node); } -if (ptp_dev) +if (ptp_dev) { ptp =platform_get_drvdata (ptp_dev); +put_device (&ptp_dev->dev); + }if (ptp) info->phc_index = ptp->phc_index;
Greg Kroah-Hartman
maintainerPATCH 20/587 net: usb: asix_devices: add phy_mask for ax88772 mdio bus
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit 4faff70959d51078f9ee8372f8cff0d7045e4114 upstream.
Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.
--- drivers/net/usb/asix_devices.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/asix_devices.c +1 -0
@@ -676,6 +676,7 @@ static int ax88772_init_mdio(struct usbn priv->mdio->read = &asix_mdio_bus_read; priv->mdio->write = &asix_mdio_bus_write; priv->mdio->name ="Asix MDIO Bus" ; + priv->mdio->phy_mask = ~(BIT (priv->phy_addr) |BIT (AX_EMBD_PHY_ADDR ));/* mii bus name is usb-<usb bus number>-<usb device number> */ snprintf (priv->mdio->id,MII_BUS_ID_SIZE ,"usb-%03d:%03d" , dev->udev->bus->busnum, dev->udev->devnum);
Greg Kroah-Hartman
maintainerPATCH 21/587 io_uring/net: commit partial buffers on retry
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
Commit 41b70df5b38bc80967d2e0ed55cc3c3896bba781 upstream.
Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on retry. But on the networking side, if MSG_WAITALL is set, or if the socket is of the streaming type and too little was processed, then it will hang on to the buffer rather than recycle or commit it. This is problematic for two reasons:
1) If someone unregisters the provided buffer ring before a later retry, then the req->buf_list will no longer be valid.
2) If multiple sockers are using the same buffer group, then multiple receives can consume the same memory. This can cause data corruption in the application, as either receive could land in the same userspace buffer.
Fix this by disallowing partial retries from pinning a provided buffer across multiple executions, if ring provided buffers are used.
--- io_uring/net.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
io_uring/net.c +13 -6
@@ -351,6 +351,13 @@ static int io_setup_async_addr(struct ioreturn -EAGAIN ; } +static void io_net_kbuf_recyle (struct io_kiocb *req) +{ + req->flags |=REQ_F_PARTIAL_IO ; +if (req->flags &REQ_F_BUFFER_RING ) +io_kbuf_recycle_ring (req); +} +int io_sendmsg_prep_async (struct io_kiocb *req) {int ret;
@@ -442,7 +449,7 @@ int io_sendmsg(struct io_kiocb *req, uns kmsg->msg.msg_controllen =0 ; kmsg->msg.msg_control =NULL ; sr->done_io += ret; - req->flags |=REQ_F_PARTIAL_IO ; +io_net_kbuf_recyle (req);return io_setup_async_msg (req, kmsg, issue_flags); }if (ret == -ERESTARTSYS )
@@ -521,7 +528,7 @@ int io_send(struct io_kiocb *req, unsign sr->len -= ret; sr->buf += ret; sr->done_io += ret; - req->flags |=REQ_F_PARTIAL_IO ; +io_net_kbuf_recyle (req);return io_setup_async_addr (req, &__address, issue_flags); }if (ret == -ERESTARTSYS )
@@ -891,7 +898,7 @@ retry_multishot: }if (ret >0 &&io_net_retry (sock, flags)) { sr->done_io += ret; - req->flags |=REQ_F_PARTIAL_IO ; +io_net_kbuf_recyle (req);return io_setup_async_msg (req, kmsg, issue_flags); }if (ret == -ERESTARTSYS )
@@ -991,7 +998,7 @@ retry_multishot: sr->len -= ret; sr->buf += ret; sr->done_io += ret; - req->flags |=REQ_F_PARTIAL_IO ; +io_net_kbuf_recyle (req);return -EAGAIN ; }if (ret == -ERESTARTSYS )
@@ -1235,7 +1242,7 @@ int io_send_zc(struct io_kiocb *req, uns zc->len -= ret; zc->buf += ret; zc->done_io += ret; - req->flags |=REQ_F_PARTIAL_IO ; +io_net_kbuf_recyle (req);return io_setup_async_addr (req, &__address, issue_flags); }if (ret == -ERESTARTSYS )
@@ -1306,7 +1313,7 @@ int io_sendmsg_zc(struct io_kiocb *req,if (ret >0 &&io_net_retry (sock, flags)) { sr->done_io += ret; - req->flags |=REQ_F_PARTIAL_IO ; +io_net_kbuf_recyle (req);return io_setup_async_msg (req, kmsg, issue_flags); }if (ret == -ERESTARTSYS )
Greg Kroah-Hartman
maintainerPATCH 22/587 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit 908e4ead7f757504d8b345452730636e298cbf68 upstream.
Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF.
Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all.
In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().
--- fs/nfsd/nfs4state.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
fs/nfsd/nfs4state.c +15 -5
@@ -4282,10 +4282,16 @@ nfsd4_setclientid_confirm(struct svc_rqs } status = nfs_ok;if (conf) { - old = unconf; -unhash_client_locked (old); -nfsd4_change_callback (conf, &unconf->cl_cb_conn); - }else { +if (get_client_locked (conf) == nfs_ok) { + old = unconf; +unhash_client_locked (old); +nfsd4_change_callback (conf, &unconf->cl_cb_conn); + }else { + conf =NULL ; + } + } + +if (!conf) { old =find_confirmed_client_by_name (&unconf->cl_name, nn);if (old) { status = nfserr_clid_inuse;
@@ -4302,10 +4308,14 @@ nfsd4_setclientid_confirm(struct svc_rqs }trace_nfsd_clid_replaced (&old->cl_clientid); } + status =get_client_locked (unconf); +if (status != nfs_ok) { + old =NULL ; + goto out; + }move_to_confirmed (unconf); conf = unconf; } -get_client_locked (conf);spin_unlock (&nn->client_lock);if (conf == unconf)fsnotify_dentry (conf->cl_nfsd_info_dentry,FS_MODIFY );
Greg Kroah-Hartman
maintainerPATCH 23/587 NFSD: detect mismatch of file handle and delegation stateid in OPEN op
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
commit 9c65001c57164033ad08b654c8b5ae35512ddf4a upstream.
When the client sends an OPEN with claim type CLAIM_DELEG_CUR_FH or CLAIM_DELEGATION_CUR, the delegation stateid and the file handle must belong to the same file, otherwise return NFS4ERR_INVAL.
Note that RFC8881, section 8.2.4, mandates the server to return NFS4ERR_BAD_STATEID if the selected table entry does not match the current filehandle. However returning NFS4ERR_BAD_STATEID in the OPEN causes the client to retry the operation and therefor get the client into a loop. To avoid this situation we return NFS4ERR_INVAL instead.
--- fs/nfsd/nfs4state.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/nfsd/nfs4state.c +14 -0
@@ -5775,6 +5775,20 @@ nfsd4_process_open2(struct svc_rqst *rqs status =nfs4_check_deleg (cl, open, &dp);if (status) goto out; +if (dp &&nfsd4_is_deleg_cur (open) && + (dp->dl_stid.sc_file != fp)) { +/* +* RFC8881 section 8.2.4 mandates the server to return +* NFS4ERR_BAD_STATEID if the selected table entry does +* not match the current filehandle. However returning +* NFS4ERR_BAD_STATEID in the OPEN can cause the client +* to repeatedly retry the operation with the same +* stateid, since the stateid itself is valid. To avoid +* this situation NFSD returns NFS4ERR_INVAL instead. +*/ + status = nfserr_inval; + goto out; + } stp =nfsd4_find_and_lock_existing_open (fp, open); }else { open->op_file =NULL ;
Greg Kroah-Hartman
maintainerPATCH 24/587 NFS: Fix the setting of capabilities when automounting a new filesystem
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit b01f21cacde9f2878492cf318fee61bf4ccad323 upstream.
Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.
--- fs/nfs/client.c | 44 ++++++++++++++++++++++++++++++++++++++++++-- fs/nfs/internal.h | 2 +- fs/nfs/nfs4client.c | 20 +------------------- fs/nfs/nfs4proc.c | 2 +- 4 files changed, 45 insertions(+), 23 deletions(-)
fs/nfs/client.c +42 -2
@@ -668,6 +668,44 @@ struct nfs_client *nfs_init_client(struc }EXPORT_SYMBOL_GPL (nfs_init_client); +static void nfs4_server_set_init_caps (struct nfs_server *server) +{ +#if IS_ENABLED (CONFIG_NFS_V4 ) +/* Set the basic capabilities */ + server->caps = server->nfs_client->cl_mvops->init_caps; +if (server->flags &NFS_MOUNT_NORDIRPLUS ) + server->caps &= ~NFS_CAP_READDIRPLUS ; +if (server->nfs_client->cl_proto ==XPRT_TRANSPORT_RDMA ) + server->caps &= ~NFS_CAP_READ_PLUS ; + +/* +* Don't use NFS uid/gid mapping if we're using AUTH_SYS or lower +* authentication. +*/ +if (nfs4_disable_idmapping && + server->client->cl_auth->au_flavor ==RPC_AUTH_UNIX ) + server->caps |=NFS_CAP_UIDGID_NOMAP ; +#endif +} + +void nfs_server_set_init_caps (struct nfs_server *server) +{ +switch (server->nfs_client->rpc_ops->version) { +case 2 : + server->caps =NFS_CAP_HARDLINKS |NFS_CAP_SYMLINKS ; +break ; +case 3 : + server->caps =NFS_CAP_HARDLINKS |NFS_CAP_SYMLINKS ; +if (!(server->flags &NFS_MOUNT_NORDIRPLUS )) + server->caps |=NFS_CAP_READDIRPLUS ; +break ; +default : +nfs4_server_set_init_caps (server); +break ; + } +} +EXPORT_SYMBOL_GPL (nfs_server_set_init_caps); +/* * Create a version 2 or 3 client */
@@ -709,7 +747,6 @@ static int nfs_init_server(struct nfs_se/* Initialise the client representation from the mount data */ server->flags = ctx->flags; server->options = ctx->options; - server->caps |=NFS_CAP_HARDLINKS |NFS_CAP_SYMLINKS ;switch (clp->rpc_ops->version) {case 2 :
@@ -745,6 +782,8 @@ static int nfs_init_server(struct nfs_seif (error <0 ) goto error; +nfs_server_set_init_caps (server); +/* Preserve the values of mount_server-related mount options */ if (ctx->mount_server.addrlen) { memcpy(&server->mountd_address, &ctx->mount_server.address,
@@ -919,7 +958,6 @@ void nfs_server_copy_userdata(struct nfs target->acregmax = source->acregmax; target->acdirmin = source->acdirmin; target->acdirmax = source->acdirmax; - target->caps = source->caps; target->options = source->options; target->auth_info = source->auth_info; target->port = source->port;
@@ -1145,6 +1183,8 @@ struct nfs_server *nfs_clone_server(struif (error <0 ) goto out_free_server; +nfs_server_set_init_caps (server); +/* probe the filesystem info for this server filesystem */ error =nfs_probe_server (server, fh);if (error <0 )
fs/nfs/internal.h +1 -1
@@ -223,7 +223,7 @@ extern struct nfs_client * nfs4_find_client_sessionid(struct net *, const struct sockaddr *, struct nfs4_sessionid *, u32);extern struct nfs_server *nfs_create_server (struct fs_context *); -extern void nfs4_server_set_init_caps (struct nfs_server *); +extern void nfs_server_set_init_caps (struct nfs_server *);extern struct nfs_server *nfs4_create_server (struct fs_context *);extern struct nfs_server *nfs4_create_referral_server (struct fs_context *); extern int nfs4_update_server(struct nfs_server *server, const char *hostname,
fs/nfs/nfs4client.c +1 -19
@@ -1079,24 +1079,6 @@ static void nfs4_session_limit_xasize(st#endif } -void nfs4_server_set_init_caps (struct nfs_server *server) -{ -/* Set the basic capabilities */ - server->caps |= server->nfs_client->cl_mvops->init_caps; -if (server->flags &NFS_MOUNT_NORDIRPLUS ) - server->caps &= ~NFS_CAP_READDIRPLUS ; -if (server->nfs_client->cl_proto ==XPRT_TRANSPORT_RDMA ) - server->caps &= ~NFS_CAP_READ_PLUS ; - -/* -* Don't use NFS uid/gid mapping if we're using AUTH_SYS or lower -* authentication. -*/ -if (nfs4_disable_idmapping && - server->client->cl_auth->au_flavor ==RPC_AUTH_UNIX ) - server->caps |=NFS_CAP_UIDGID_NOMAP ; -} -static int nfs4_server_common_setup (struct nfs_server *server,struct nfs_fh *mntfh,bool auth_probe) {
@@ -1111,7 +1093,7 @@ static int nfs4_server_common_setup(struif (error <0 ) goto out; -nfs4_server_set_init_caps (server); +nfs_server_set_init_caps (server);/* Probe the root fh to retrieve its FSID and filehandle */ error =nfs4_get_rootfh (server, mntfh, auth_probe);
fs/nfs/nfs4proc.c +1 -1
@@ -3951,7 +3951,7 @@ int nfs4_server_capabilities(struct nfs_ };int err; -nfs4_server_set_init_caps (server); +nfs_server_set_init_caps (server); do { err = nfs4_handle_exception(server, _nfs4_server_capabilities(server, fhandle),
Greg Kroah-Hartman
maintainerPATCH 25/587 PCI: Extend isolated function probing to LoongArch
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit a02fd05661d73a8507dd70dd820e9b984490c545 upstream.
Like s390 and the jailhouse hypervisor, LoongArch's PCI architecture allows passing isolated PCI functions to a guest OS instance. So it is possible that there is a multi-function device without function 0 for the host or guest.
Allow probing such functions by adding a IS_ENABLED(CONFIG_LOONGARCH) case in the hypervisor_isolated_pci_functions() helper.
This is similar to commit 189c6c33ff42 ("PCI: Extend isolated function probing to s390").
--- include/linux/hypervisor.h | 3 +++ 1 file changed, 3 insertions(+)
include/linux/hypervisor.h +3 -0
@@ -37,6 +37,9 @@ static inline bool hypervisor_isolated_pif (IS_ENABLED (CONFIG_S390 ))return true; +if (IS_ENABLED (CONFIG_LOONGARCH )) +return true; +return jailhouse_paravirt (); }
Greg Kroah-Hartman
maintainerPATCH 26/587 LoongArch: BPF: Fix jump offset calculation in tailcall
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoran Jiang <[email protected]>
commit cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 upstream.
The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by
"#define jmp_offset (out_offset - (cur_offset))"
is a negative number, which is wrong. The final generated assembly are as follow.
54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c
Before apply this patch, the follow test case will reveal soft lock issues.
cd tools/testing/selftests/bpf/
./test_progs --allow=tailcalls/tailcall_bpf2bpf_1
dmesg:
watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]
--- arch/loongarch/net/bpf_jit.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-)
arch/loongarch/net/bpf_jit.c +5 -16
@@ -203,11 +203,9 @@ bool bpf_jit_supports_kfunc_call(void)return true; } -/* initialized on the first pass of build_body() */ -static int out_offset =-1 ; -static int emit_bpf_tail_call (struct jit_ctx *ctx) +static int emit_bpf_tail_call (struct jit_ctx *ctx,int insn) { -int off; +int off, tc_ninsn =0 ;u8 tcc =tail_call_reg (ctx);u8 a1 =LOONGARCH_GPR_A1 ;u8 a2 =LOONGARCH_GPR_A2 ;
@@ -217,7 +215,7 @@ static int emit_bpf_tail_call(struct jitconst int idx0 = ctx->idx;#define cur_offset (ctx->idx - idx0) -#define jmp_offset (out_offset - (cur_offset)) +#define jmp_offset (tc_ninsn - (cur_offset))/* * a0: &ctx
@@ -227,6 +225,7 @@ static int emit_bpf_tail_call(struct jit* if (index >= array->map.max_entries) * goto out; */ + tc_ninsn = insn ? ctx->offset[insn+1 ] - ctx->offset[insn] : ctx->offset[0 ]; off = offsetof(struct bpf_array, map.max_entries);emit_insn (ctx, ldwu, t1, a1, off);/* bgeu $a2, $t1, jmp_offset */
@@ -258,15 +257,6 @@ static int emit_bpf_tail_call(struct jitemit_insn (ctx, ldd, t3, t2, off);__build_epilogue (ctx, true); -/* out: */ -if (out_offset ==-1 ) - out_offset = cur_offset; -if (cur_offset != out_offset) { -pr_err_once ("tail_call out_offset = %d, expected %d!\n" , - cur_offset, out_offset); -return -1 ; - } -return 0 ; toofar:
@@ -853,7 +843,7 @@ static int build_insn(const struct bpf_i/* tail call */ case BPF_JMP |BPF_TAIL_CALL :mark_tail_call (ctx); -if (emit_bpf_tail_call (ctx) <0 ) +if (emit_bpf_tail_call (ctx, i) <0 )return -EINVAL ;break ;
@@ -1251,7 +1241,6 @@ out:if (tmp_blinded)bpf_jit_prog_release_other (prog, prog == orig_prog ? tmp : orig_prog); - out_offset =-1 ;return prog; }
Greg Kroah-Hartman
maintainerPATCH 27/587 sunvdc: Balance device refcount in vdc_port_mpgroup_check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 63ce53724637e2e7ba51fe3a4f78351715049905 upstream.
Using device_find_child() to locate a probed virtual-device-port node causes a device refcount imbalance, as device_find_child() internally calls get_device() to increment the device’s reference count before returning its pointer. vdc_port_mpgroup_check() directly returns true upon finding a matching device without releasing the reference via put_device(). We should call put_device() to decrement refcount.
As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'.
Found by code review.
--- drivers/block/sunvdc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/block/sunvdc.c +3 -1
@@ -956,8 +956,10 @@ static bool vdc_port_mpgroup_check(struc dev =device_find_child (vdev->dev.parent, &port_data, vdc_device_probed); -if (dev) +if (dev) { +put_device (dev);return true; + }return false; }
Greg Kroah-Hartman
maintainerPATCH 28/587 fs: Prevent file descriptor table allocations exceeding INT_MAX
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <[email protected]>
commit 04a2c4b4511d186b0fce685da21085a5d4acd370 upstream.
When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c:
WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288
This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN.
Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate:
- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes
- Multiple bitmaps: ~400MB
- Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647)
Reproducer:
1. Set /proc/sys/fs/nr_open to 1073741816:
# echo 1073741816 > /proc/sys/fs/nr_open
2. Run a program that uses a high file descriptor:
#include <unistd.h>
#include <sys/resource.h>
int main() {
struct rlimit rlim = {1073741824, 1073741824};
setrlimit(RLIMIT_NOFILE, &rlim);
dup2(2, 1073741880); // Triggers the warning
return 0;
}3. Observe WARNING in dmesg at mm/slub.c:5027
systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that:
1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting
2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations
3. The resulting allocations (>8GB) are impractical and will always fail
systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors.
While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue.
Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.
--- fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/file.c +15 -0
@@ -126,6 +126,21 @@ static struct fdtable * alloc_fdtable(unif (unlikely (nr > sysctl_nr_open)) nr = ((sysctl_nr_open -1 ) | (BITS_PER_LONG -1 )) +1 ; +/* +* Check if the allocation size would exceed INT_MAX. kvmalloc_array() +* and kvmalloc() will warn if the allocation size is greater than +* INT_MAX, as filp_cachep objects are not __GFP_NOWARN. +* +* This can happen when sysctl_nr_open is set to a very high value and +* a process tries to use a file descriptor near that limit. For example, +* if sysctl_nr_open is set to 1073741816 (0x3ffffff8) - which is what +* systemd typically sets it to - then trying to use a file descriptor +* close to that value will require allocating a file descriptor table +* that exceeds 8GB in size. +*/ +if (unlikely (nr >INT_MAX /sizeof (struct file *))) +return ERR_PTR (-EMFILE ); + fdt =kmalloc (sizeof (struct fdtable ),GFP_KERNEL_ACCOUNT );if (!fdt) goto out;
Re: [PATCH 6.6 028/587] fs: Prevent file descriptor table allocations exceeding INT_MAX
Hi Greg,
Quoted 93 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <[email protected]>
commit
04a2c4b4511d186b0fce685da21085a5d4acd370upstream.When
sysctl_nr_openis set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceedINT_MAX, resulting in a WARNING inmm/slub.c:WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288This happens because
kvmalloc_array()andkvmalloc()check if the requested size exceedsINT_MAXand emit a warning when the allocation is not flagged with__GFP_NOWARN.Specifically, when
nr_openis set to 1073741816 (0x3ffffff8) and a process callsdup2(oldfd, 1073741880), the kernel attempts to allocate:
- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes
- Multiple bitmaps: ~400MB
- Total allocation size: > 8GB (exceedingINT_MAX= 2,147,483,647)Reproducer:
1. Set/proc/sys/fs/nr_opento 1073741816:# echo 1073741816 > /proc/sys/fs/nr_open2. Run a program that uses a high file descriptor:
#include <unistd.h> #include <sys/resource.h> int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; }3. Observe WARNING in dmesg at
mm/slub.c:5027systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that:
1. The kernel's allocation functions still enforce
INT_MAXas a maximum size regardless of memcg accounting
2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations
3. The resulting allocations (>8GB) are impractical and will always failsystemd's algorithm starts with
INT_MAXand keeps halving the value until the kernel accepts it. On most systems, this results innr_openbeing set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors.While processes rarely use file descriptors near this limit in normal operation, certain selftests (like
tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue.Fix this by adding a check in
alloc_fdtable()to ensure the requested allocation size does not exceedINT_MAX. This causes the operation to fail with-EMFILEinstead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.Fixes 9cfe015aa424 ("get rid of NR_OPEN and introduce a sysctl_nr_open")Signed-off-by Sasha Levin <[email protected]>Signed-off-by Christian Brauner <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)fs/file.c +8
-0@@ -126,6 +126,21 @@ static struct fdtable * alloc_fdtable(unif (unlikely (nr > sysctl_nr_open)) nr = ((sysctl_nr_open -1 ) | (BITS_PER_LONG -1 )) +1 ; +/* +* Check if the allocation size would exceed INT_MAX. kvmalloc_array() +* and kvmalloc() will warn if the allocation size is greater than +* INT_MAX, as filp_cachep objects are not __GFP_NOWARN. +* +* This can happen when sysctl_nr_open is set to a very high value and +* a process tries to use a file descriptor near that limit. For example, +* if sysctl_nr_open is set to 1073741816 (0x3ffffff8) - which is what
fs/file.c static struct fdtable * alloc_fdtable(un · line 146
Quoted 10 lines
fs/file.c +7
-0+* systemd typically sets it to - then trying to use a file descriptor +* close to that value will require allocating a file descriptor table +* that exceeds 8GB in size. +*/ +if (unlikely (nr >INT_MAX /sizeof (struct file *))) +return ERR_PTR (-EMFILE ); + fdt =kmalloc (sizeof (struct fdtable ),GFP_KERNEL_ACCOUNT );if (!fdt) goto out;
I see you picked this commit for the current stable series, but TTBOMK this introduces a regression as it was as well present in 6.12.43:
https://lore.kernel.org/regressions/[email protected]/
and the current 6.12.44 contains a followup. If I'm not mistaken Sasha has picked up 1d3b4bec3ce5 ("alloc_fdtable(): change calling conventions.") to fix that.
So unless I'm wrong, if you pick up 04a2c4b4511d ("fs: Prevent file descriptor table allocations exceeding INT_MAX"), then as well 1d3b4bec3ce5 ("alloc_fdtable(): change calling conventions.") is needed.
Regards,
Salvatore
Sasha Levin
maintainerRe: [PATCH 6.6 028/587] fs: Prevent file descriptor table allocations exceeding INT_MAX
Quoted 112 lines · Salvatore Bonaccorso
Hi Greg,
Quoted 93 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <[email protected]>
commit
04a2c4b4511d186b0fce685da21085a5d4acd370upstream.When
sysctl_nr_openis set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceedINT_MAX, resulting in a WARNING inmm/slub.c:WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288This happens because
kvmalloc_array()andkvmalloc()check if the requested size exceedsINT_MAXand emit a warning when the allocation is not flagged with__GFP_NOWARN.Specifically, when
nr_openis set to 1073741816 (0x3ffffff8) and a process callsdup2(oldfd, 1073741880), the kernel attempts to allocate:
- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes
- Multiple bitmaps: ~400MB
- Total allocation size: > 8GB (exceedingINT_MAX= 2,147,483,647)Reproducer:
1. Set/proc/sys/fs/nr_opento 1073741816:# echo 1073741816 > /proc/sys/fs/nr_open2. Run a program that uses a high file descriptor:
#include <unistd.h> #include <sys/resource.h> int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; }3. Observe WARNING in dmesg at
mm/slub.c:5027systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that:
1. The kernel's allocation functions still enforce
INT_MAXas a maximum size regardless of memcg accounting
2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations
3. The resulting allocations (>8GB) are impractical and will always failsystemd's algorithm starts with
INT_MAXand keeps halving the value until the kernel accepts it. On most systems, this results innr_openbeing set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors.While processes rarely use file descriptors near this limit in normal operation, certain selftests (like
tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue.Fix this by adding a check in
alloc_fdtable()to ensure the requested allocation size does not exceedINT_MAX. This causes the operation to fail with-EMFILEinstead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.Fixes 9cfe015aa424 ("get rid of NR_OPEN and introduce a sysctl_nr_open")Signed-off-by Sasha Levin <[email protected]>Signed-off-by Christian Brauner <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)fs/file.c +8
-0@@ -126,6 +126,21 @@ static struct fdtable * alloc_fdtable(unif (unlikely (nr > sysctl_nr_open)) nr = ((sysctl_nr_open -1 ) | (BITS_PER_LONG -1 )) +1 ; +/* +* Check if the allocation size would exceed INT_MAX. kvmalloc_array() +* and kvmalloc() will warn if the allocation size is greater than +* INT_MAX, as filp_cachep objects are not __GFP_NOWARN. +* +* This can happen when sysctl_nr_open is set to a very high value and +* a process tries to use a file descriptor near that limit. For example, +* if sysctl_nr_open is set to 1073741816 (0x3ffffff8) - which is what fs/file.c static struct fdtable * alloc_fdtable(un · line 146
Quoted 10 lines
fs/file.c +7
-0+* systemd typically sets it to - then trying to use a file descriptor +* close to that value will require allocating a file descriptor table +* that exceeds 8GB in size. +*/ +if (unlikely (nr >INT_MAX /sizeof (struct file *))) +return ERR_PTR (-EMFILE ); + fdt =kmalloc (sizeof (struct fdtable ),GFP_KERNEL_ACCOUNT );if (!fdt) goto out;I see you picked this commit for the current stable series, but TTBOMK this introduces a regression as it was as well present in 6.12.43:
Quoted 8 lines
and the current 6.12.44 contains a followup. If I'm not mistaken Sasha has picked up
1d3b4bec3ce5("alloc_fdtable(): change calling conventions.") to fix that.So unless I'm wrong, if you pick up
04a2c4b4511d("fs: Prevent file descriptor table allocations exceedingINT_MAX"), then as well1d3b4bec3ce5("alloc_fdtable(): change calling conventions.") is needed.
I've just queued it up for the rest of the trees too, thanks!
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerPATCH 29/587 eventpoll: Fix semi-unbounded recursion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit f2e467a48287c868818085aa35389a224d226732 upstream.
Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links.
Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons:
- They don't look upwards in the tree.
- If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed ("epoll: limit paths").
Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops.
A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files.
As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion problem").)
To fix it:
1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited.
2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk.
3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.
--- fs/eventpoll.c | 60 +++++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 46 insertions(+), 14 deletions(-)
fs/eventpoll.c +46 -14
@@ -217,6 +217,7 @@ struct eventpoll {/* used to optimize loop detection check */ u64 gen;struct hlist_head refs; +u8 loop_check_depth;/* * usage count, used together with epitem->dying to
@@ -1986,23 +1987,24 @@ static int ep_poll(struct eventpoll *ep, }/** -* ep_loop_check_proc - verify that adding an epoll file inside another -* epoll structure does not violate the constraints, in -* terms of closed loops, or too deep chains (which can -* result in excessive stack usage). +* ep_loop_check_proc - verify that adding an epoll file @ep inside another +* epoll file does not create closed loops, and +* determine the depth of the subtree starting at @ep * * @ep: the &struct eventpoll to be currently checked. * @depth: Current depth of the path being checked. * -* Return: %zero if adding the epoll @file inside current epoll -* structure @ep does not violate the constraints, or %-1 otherwise. +* Return: depth of the subtree, or INT_MAX if we found a loop or went too deep. */ static int ep_loop_check_proc (struct eventpoll *ep,int depth) { -int error =0 ; +int result =0 ;struct rb_node *rbp;struct epitem *epi; +if (ep->gen == loop_check_gen) +return ep->loop_check_depth; +mutex_lock_nested (&ep->mtx, depth +1 ); ep->gen = loop_check_gen;for (rbp =rb_first_cached (&ep->rbr); rbp; rbp =rb_next (rbp)) {
@@ -2010,13 +2012,11 @@ static int ep_loop_check_proc(struct eveif (unlikely (is_file_epoll (epi->ffd.file))) {struct eventpoll *ep_tovisit; ep_tovisit = epi->ffd.file->private_data; -if (ep_tovisit->gen == loop_check_gen) -continue ;if (ep_tovisit == inserting_into || depth >EP_MAX_NESTS ) - error =-1 ; + result =INT_MAX ;else - error =ep_loop_check_proc (ep_tovisit, depth +1 ); -if (error !=0 ) + result =max (result,ep_loop_check_proc (ep_tovisit, depth +1 ) +1 ); +if (result >EP_MAX_NESTS )break ; }else {/*
@@ -2030,9 +2030,27 @@ static int ep_loop_check_proc(struct evelist_file (epi->ffd.file); } } + ep->loop_check_depth = result;mutex_unlock (&ep->mtx); -return error; +return result; +} + +/** +* ep_get_upwards_depth_proc - determine depth of @ep when traversed upwards +*/ +static int ep_get_upwards_depth_proc (struct eventpoll *ep,int depth) +{ +int result =0 ; +struct epitem *epi; + +if (ep->gen == loop_check_gen) +return ep->loop_check_depth; +hlist_for_each_entry_rcu (epi, &ep->refs, fllink) + result =max (result,ep_get_upwards_depth_proc (epi->ep, depth +1 ) +1 ); + ep->gen = loop_check_gen; + ep->loop_check_depth = result; +return result; }/**
@@ -2048,8 +2066,22 @@ static int ep_loop_check_proc(struct eve*/ static int ep_loop_check (struct eventpoll *ep,struct eventpoll *to) { +int depth, upwards_depth; + inserting_into = ep; -return ep_loop_check_proc (to,0 ); +/* +* Check how deep down we can get from @to, and whether it is possible +* to loop up to @ep. +*/ + depth =ep_loop_check_proc (to,0 ); +if (depth >EP_MAX_NESTS ) +return -1 ; +/* Check how far up we can go from @ep. */ +rcu_read_lock (); + upwards_depth =ep_get_upwards_depth_proc (ep,0 ); +rcu_read_unlock (); + +return (depth+1 +upwards_depth >EP_MAX_NESTS ) ?-1 :0 ; }static void clear_tfile_check_list (void )
Greg Kroah-Hartman
maintainerPATCH 30/587 Documentation: ACPI: Fix parent device references
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit e65cb011349e653ded541dddd6469c2ca813edcf upstream.
The _CRS resources in many cases want to have ResourceSource field to be a type of ACPI String. This means that to compile properly we need to enclosure the name path into double quotes. This will in practice defer the interpretation to a run-time stage, However, this may be interpreted differently on different OSes and ACPI interpreter implementations. In particular ACPICA might not correctly recognize the leading '^' (caret) character and will not resolve the relative name path properly. On top of that, this piece may be used in SSDTs which are loaded after the DSDT and on itself may also not resolve relative name paths outside of their own scopes. With this all said, fix documentation to use fully-qualified name paths always to avoid any misinterpretations, which is proven to work.
--- Documentation/firmware-guide/acpi/i2c-muxes.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
Documentation/firmware-guide/acpi/i2c-muxes.rst +4 -4
@@ -14,7 +14,7 @@ Consider this topology:: | | | 0x70 |--CH01--> i2c client B (0x50) +------+ +------+ -which corresponds to the following ASL:: +which corresponds to the following ASL (in the scope of \_SB):: Device (SMB1) {
@@ -24,7 +24,7 @@ which corresponds to the following ASL:: Name (_HID, ...) Name (_CRS, ResourceTemplate () { I2cSerialBus (0x70, ControllerInitiated, I2C_SPEED, - AddressingMode7Bit, "^SMB1", 0x00, + AddressingMode7Bit, "\\_SB.SMB1", 0x00, ResourceConsumer,,) }
@@ -37,7 +37,7 @@ which corresponds to the following ASL:: Name (_HID, ...) Name (_CRS, ResourceTemplate () { I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED, - AddressingMode7Bit, "^CH00", 0x00, + AddressingMode7Bit, "\\_SB.SMB1.CH00", 0x00, ResourceConsumer,,) } }
@@ -52,7 +52,7 @@ which corresponds to the following ASL:: Name (_HID, ...) Name (_CRS, ResourceTemplate () { I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED, - AddressingMode7Bit, "^CH01", 0x00, + AddressingMode7Bit, "\\_SB.SMB1.CH01", 0x00, ResourceConsumer,,) } }
Greg Kroah-Hartman
maintainerPATCH 31/587 ACPI: processor: perflib: Fix initial _PPC limit application
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
commit d33bd88ac0ebb49e7f7c8f29a8c7ee9eae85d765 upstream.
If the BIOS sets a _PPC frequency limit upfront, it will fail to take effect due to a call ordering issue. Namely, freq_qos_update_request() is called before freq_qos_add_request() for the given request causing the constraint update to be ignored. The call sequence in question is as follows:
cpufreq_policy_online()
acpi_cpufreq_cpu_init()
acpi_processor_register_performance()
acpi_processor_get_performance_info()
acpi_processor_get_platform_limit()
freq_qos_update_request(&perflib_req) <- inactive QoS request
blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
CPUFREQ_CREATE_POLICY)
acpi_processor_notifier()
acpi_processor_ppc_init()
freq_qos_add_request(&perflib_req) <- QoS request activation
Address this by adding an acpi_processor_get_platform_limit() call to acpi_processor_ppc_init(), after the perflib_req activation via freq_qos_add_request(), which causes the initial _PPC limit to be picked up as appropriate. However, also ensure that the _PPC limit will not be picked up in the cases when the cpufreq driver does not call acpi_processor_register_performance() by adding a pr->performance check to the related_cpus loop in acpi_processor_ppc_init().
--- drivers/acpi/processor_perflib.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/acpi/processor_perflib.c +9 -1
@@ -174,11 +174,14 @@ void acpi_processor_ppc_init(struct cpuf {unsigned int cpu; +if (ignore_ppc ==1 ) +return ; +for_each_cpu (cpu, policy->related_cpus) {struct acpi_processor *pr =per_cpu (processors, cpu);int ret; -if (!pr) +if (!pr || !pr->performance)continue ;/*
@@ -194,6 +197,11 @@ void acpi_processor_ppc_init(struct cpufif (ret <0 )pr_err ("Failed to add freq constraint for CPU%d (%d)\n" , cpu, ret); + + ret =acpi_processor_get_platform_limit (pr); +if (ret) +pr_err ("Failed to update freq constraint for CPU%d (%d)\n" , + cpu, ret); } }
Greg Kroah-Hartman
maintainerPATCH 32/587 ACPI: processor: perflib: Move problematic pr->performance check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit d405ec23df13e6df599f5bd965a55d13420366b8 upstream.
Commit d33bd88ac0eb ("ACPI: processor: perflib: Fix initial _PPC limit application") added a pr->performance check that prevents the frequency QoS request from being added when the given processor has no performance object. Unfortunately, this causes a WARN() in freq_qos_remove_request() to trigger on an attempt to take the given CPU offline later because the frequency QoS object has not been added for it due to the missing performance object.
Address this by moving the pr->performance check before calling acpi_processor_get_platform_limit() so it only prevents a limit from being set for the CPU if the performance object is not present. This way, the frequency QoS request is added as it was before the above commit and it is present all the time along with the CPU's cpufreq policy regardless of whether or not the CPU is online.
--- drivers/acpi/processor_perflib.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/acpi/processor_perflib.c +4 -1
@@ -181,7 +181,7 @@ void acpi_processor_ppc_init(struct cpufstruct acpi_processor *pr =per_cpu (processors, cpu);int ret; -if (!pr || !pr->performance) +if (!pr)continue ;/*
@@ -198,6 +198,9 @@ void acpi_processor_ppc_init(struct cpufpr_err ("Failed to add freq constraint for CPU%d (%d)\n" , cpu, ret); +if (!pr->performance) +continue ; + ret =acpi_processor_get_platform_limit (pr);if (ret) pr_err("Failed to update freq constraint for CPU%d (%d)\n",
Greg Kroah-Hartman
maintainerPATCH 33/587 smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
commit 5349ae5e05fa37409fd48a1eb483b199c32c889b upstream.
We should call ib_dma_unmap_single() and mempool_free() before calling smbd_disconnect_rdma_connection().
And smbd_disconnect_rdma_connection() needs to be the last function to call as all other state might already be gone after it returns.
--- fs/smb/client/smbdirect.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
fs/smb/client/smbdirect.c +8 -6
@@ -282,18 +282,20 @@ static void send_done(struct ib_cq *cq,log_rdma_send (INFO ,"smbd_request 0x%p completed wc->status=%d\n" , request, wc->status); -if (wc->status !=IB_WC_SUCCESS || wc->opcode !=IB_WC_SEND ) { -log_rdma_send (ERR ,"wc->status=%d wc->opcode=%d\n" , - wc->status, wc->opcode); -smbd_disconnect_rdma_connection (request->info); - } -for (i =0 ; i < request->num_sge; i++)ib_dma_unmap_single (sc->ib.dev, request->sge[i].addr, request->sge[i].length,DMA_TO_DEVICE ); +if (wc->status !=IB_WC_SUCCESS || wc->opcode !=IB_WC_SEND ) { +log_rdma_send (ERR ,"wc->status=%d wc->opcode=%d\n" , + wc->status, wc->opcode); +mempool_free (request, info->request_mempool); +smbd_disconnect_rdma_connection (info); +return ; + } +if (atomic_dec_and_test (&request->info->send_pending))wake_up (&request->info->wait_send_pending);
Greg Kroah-Hartman
maintainerPATCH 34/587 smb: client: dont wait for info->send_pending == 0 on error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
commit 8c48e1c7520321cc87ff651e96093e2f412785fb upstream.
We already called ib_drain_qp() before and that makes sure send_done() was called with IB_WC_WR_FLUSH_ERR, but didn't called atomic_dec_and_test(&sc->send_io.pending.count)
So we may never reach the info->send_pending == 0 condition.
--- fs/smb/client/smbdirect.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/smb/client/smbdirect.c +5 -5
@@ -1338,10 +1338,6 @@ void smbd_destroy(struct TCP_Server_Infolog_rdma_event (INFO ,"cancelling idle timer\n" );cancel_delayed_work_sync (&info->idle_timer_work); -log_rdma_event (INFO ,"wait for all send posted to IB to finish\n" ); -wait_event (info->wait_send_pending, -atomic_read (&info->send_pending) ==0 ); -/* It's not possible for upper layer to get to reassembly */ log_rdma_event (INFO ,"drain the reassembly queue\n" ); do {
@@ -2053,7 +2049,11 @@ int smbd_send(struct TCP_Server_Info *se*/ wait_event (info->wait_send_pending, -atomic_read (&info->send_pending) ==0 ); +atomic_read (&info->send_pending) ==0 || + sc->status !=SMBDIRECT_SOCKET_CONNECTED ); + +if (sc->status !=SMBDIRECT_SOCKET_CONNECTED && rc ==0 ) + rc = -EAGAIN ;return rc; }
Greg Kroah-Hartman
maintainerPATCH 35/587 KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manuel Andreas <[email protected]>
[ Upstream commit fa787ac07b3ceb56dd88a62d1866038498e96230 ]
In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX allow a guest to request invalidation of portions of a virtual TLB. For this, the hypercall parameter includes a list of GVAs that are supposed to be invalidated.
However, when non-canonical GVAs are passed, there is currently no filtering in place and they are eventually passed to checked invocations of INVVPID on Intel / INVLPGA on AMD. While AMD's INVLPGA silently ignores non-canonical addresses (effectively a no-op), Intel's INVVPID explicitly signals VM-Fail and ultimately triggers the WARN_ONCE in invvpid_error():
invvpid failed: ext=0x0 vpid=1 gva=0xaaaaaaaaaaaaa000
WARNING: CPU: 6 PID: 326 at arch/x86/kvm/vmx/vmx.c:482
invvpid_error+0x91/0xa0 [kvm_intel]
Modules linked in: kvm_intel kvm 9pnet_virtio irqbypass fuse
CPU: 6 UID: 0 PID: 326 Comm: kvm-vm Not tainted 6.15.0 #14 PREEMPT(voluntary)
RIP: 0010:invvpid_error+0x91/0xa0 [kvm_intel]
Call Trace:
vmx_flush_tlb_gva+0x320/0x490 [kvm_intel]
kvm_hv_vcpu_flush_tlb+0x24f/0x4f0 [kvm]
kvm_arch_vcpu_ioctl_run+0x3013/0x5810 [kvm]Hyper-V documents that invalid GVAs (those that are beyond a partition's GVA space) are to be ignored. While not completely clear whether this ruling also applies to non-canonical GVAs, it is likely fine to make that assumption, and manual testing on Azure confirms "real" Hyper-V interprets the specification in the same way.
Skip non-canonical GVAs when processing the list of address to avoid tripping the INVVPID failure. Alternatively, KVM could filter out "bad" GVAs before inserting into the FIFO, but practically speaking the only downside of pushing validation to the final processing is that doing so is suboptimal for the guest, and no well-behaved guest will request TLB flushes for non-canonical addresses.
--- arch/x86/kvm/hyperv.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kvm/hyperv.c +3 -0
@@ -1929,6 +1929,9 @@ int kvm_hv_vcpu_flush_tlb(struct kvm_vcpu *vcpu)if (entries[i] ==KVM_HV_TLB_FLUSHALL_ENTRY ) goto out_flush_all; +if (is_noncanonical_address (entries[i], vcpu)) +continue ; +/* * Lower 12 bits of 'address' encode the number of additional * pages to flush.
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 36/587 KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit be45bc4eff33d9a7dae84a2150f242a91a617402 ]
Enable/disable local IRQs, i.e. set/clear RFLAGS.IF, in the common svm_vcpu_enter_exit() just after/before guest_state_{enter,exit}_irqoff() so that VMRUN is not executed in an STI shadow. AMD CPUs have a quirk (some would say "bug"), where the STI shadow bleeds into the guest's intr_state field if a #VMEXIT occurs during injection of an event, i.e. if the VMRUN doesn't complete before the subsequent #VMEXIT.
The spurious "interrupts masked" state is relatively benign, as it only occurs during event injection and is transient. Because KVM is already injecting an event, the guest can't be in HLT, and if KVM is querying IRQ blocking for injection, then KVM would need to force an immediate exit anyways since injecting multiple events is impossible.
However, because KVM copies int_state verbatim from vmcb02 to vmcb12, the spurious STI shadow is visible to L1 when running a nested VM, which can trip sanity checks, e.g. in VMware's VMM.
Hoist the STI+CLI all the way to C code, as the aforementioned calls to guest_state_{enter,exit}_irqoff() already inform lockdep that IRQs are enabled/disabled, and taking a fault on VMRUN with RFLAGS.IF=1 is already possible. I.e. if there's kernel code that is confused by running with RFLAGS.IF=1, then it's already a problem. In practice, since GIF=0 also blocks NMIs, the only change in exposure to non-KVM code (relative to surrounding VMRUN with STI+CLI) is exception handling code, and except for the kvm_rebooting=1 case, all exception in the core VM-Enter/VM-Exit path are fatal.
Use the "raw" variants to enable/disable IRQs to avoid tracing in the "no instrumentation" code; the guest state helpers also take care of tracing IRQ state.
Oppurtunstically document why KVM needs to do STI in the first place.
--- arch/x86/kvm/svm/svm.c | 14 ++++++++++++++ arch/x86/kvm/svm/vmenter.S | 9 +-------- 2 files changed, 15 insertions(+), 8 deletions(-)
arch/x86/kvm/svm/svm.c +14 -0
@@ -4170,6 +4170,18 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_inguest_state_enter_irqoff (); +/* +* Set RFLAGS.IF prior to VMRUN, as the host's RFLAGS.IF at the time of +* VMRUN controls whether or not physical IRQs are masked (KVM always +* runs with V_INTR_MASKING_MASK). Toggle RFLAGS.IF here to avoid the +* temptation to do STI+VMRUN+CLI, as AMD CPUs bleed the STI shadow +* into guest state if delivery of an event during VMRUN triggers a +* #VMEXIT, and the guest_state transitions already tell lockdep that +* IRQs are being enabled/disabled. Note! GIF=0 for the entirety of +* this path, so IRQs aren't actually unmasked while running host code. +*/ +raw_local_irq_enable (); +amd_clear_divider ();if (sev_es_guest (vcpu->kvm))
@@ -4177,6 +4189,8 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_inelse __svm_vcpu_run (svm, spec_ctrl_intercepted); +raw_local_irq_disable (); +guest_state_exit_irqoff (); }
arch/x86/kvm/svm/vmenter.S +1 -8
@@ -171,12 +171,8 @@ SYM_FUNC_START(__svm_vcpu_run) VM_CLEAR_CPU_BUFFERS /* Enter guest mode */ - sti - 3: vmrun %_ASM_AX 4: - cli - /* Pop @svm to RAX while it's the only available register. */ pop %_ASM_AX
@@ -341,11 +337,8 @@ SYM_FUNC_START(__svm_sev_es_vcpu_run) VM_CLEAR_CPU_BUFFERS /* Enter guest mode */ - sti - 1: vmrun %_ASM_AX - -2: cli +2: /* Pop @svm to RDI, guest registers have been saved already. */ pop %_ASM_DI
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 37/587 KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 76bce9f10162cd4b36ac0b7889649b22baf70ebd ]
Pass the target vCPU to the hwapic_isr_update() vendor hook so that VMX can defer the update until after nested VM-Exit if an EOI for L1's vAPIC occurs while L2 is active.
Note, commit d39850f57d21 ("KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update()") removed the parameter with the justification that doing so "allows for a decent amount of (future) cleanup in the APIC code", but it's not at all clear what cleanup was intended, or if it was ever realized.
No functional change intended.
--- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/lapic.c | 8 ++++---- arch/x86/kvm/vmx/vmx.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -1
@@ -1657,7 +1657,7 @@ struct kvm_x86_ops {bool allow_apicv_in_x2apic_without_x2apic_virtualization;void (*refresh_apicv_exec_ctrl)(struct kvm_vcpu *vcpu);void (*hwapic_irr_update)(struct kvm_vcpu *vcpu,int max_irr); -void (*hwapic_isr_update)(int isr); +void (*hwapic_isr_update)(struct kvm_vcpu *vcpu,int isr);bool (*guest_apic_has_interrupt)(struct kvm_vcpu *vcpu);void (*load_eoi_exitmap)(struct kvm_vcpu *vcpu,u64 *eoi_exit_bitmap);void (*set_virtual_apic_mode)(struct kvm_vcpu *vcpu);
arch/x86/kvm/lapic.c +4 -4
@@ -750,7 +750,7 @@ static inline void apic_set_isr(int vec, struct kvm_lapic *apic)* just set SVI. */ if (unlikely (apic->apicv_active)) -static_call_cond (kvm_x86_hwapic_isr_update)(vec); +static_call_cond (kvm_x86_hwapic_isr_update)(apic->vcpu, vec);else { ++apic->isr_count;BUG_ON (apic->isr_count >MAX_APIC_VECTOR );
@@ -795,7 +795,7 @@ static inline void apic_clear_isr(int vec, struct kvm_lapic *apic)* and must be left alone. */ if (unlikely (apic->apicv_active)) -static_call_cond (kvm_x86_hwapic_isr_update)(apic_find_highest_isr (apic)); +static_call_cond (kvm_x86_hwapic_isr_update)(apic->vcpu,apic_find_highest_isr (apic));else { --apic->isr_count;BUG_ON (apic->isr_count <0 );
@@ -2772,7 +2772,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)if (apic->apicv_active) {static_call_cond (kvm_x86_apicv_post_state_restore)(vcpu);static_call_cond (kvm_x86_hwapic_irr_update)(vcpu,-1 ); -static_call_cond (kvm_x86_hwapic_isr_update)(-1 ); +static_call_cond (kvm_x86_hwapic_isr_update)(vcpu,-1 ); } vcpu->arch.apic_arb_prio =0 ;
@@ -3072,7 +3072,7 @@ int kvm_apic_set_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s)if (apic->apicv_active) {static_call_cond (kvm_x86_apicv_post_state_restore)(vcpu);static_call_cond (kvm_x86_hwapic_irr_update)(vcpu,apic_find_highest_irr (apic)); -static_call_cond (kvm_x86_hwapic_isr_update)(apic_find_highest_isr (apic)); +static_call_cond (kvm_x86_hwapic_isr_update)(vcpu,apic_find_highest_isr (apic)); }kvm_make_request (KVM_REQ_EVENT , vcpu);if (ioapic_in_kernel (vcpu->kvm))
arch/x86/kvm/vmx/vmx.c +1 -1
@@ -6834,7 +6834,7 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu)kvm_release_pfn_clean (pfn); } -static void vmx_hwapic_isr_update (int max_isr) +static void vmx_hwapic_isr_update (struct kvm_vcpu *vcpu,int max_isr) {u16 status;u8 old;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 38/587 KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Gao <[email protected]>
[ Upstream commit 04bc93cf49d16d01753b95ddb5d4f230b809a991 ]
If KVM emulates an EOI for L1's virtual APIC while L2 is active, defer updating GUEST_INTERUPT_STATUS.SVI, i.e. the VMCS's cache of the highest in-service IRQ, until L1 is active, as vmcs01, not vmcs02, needs to track vISR. The missed SVI update for vmcs01 can result in L1 interrupts being incorrectly blocked, e.g. if there is a pending interrupt with lower priority than the interrupt that was EOI'd.
This bug only affects use cases where L1's vAPIC is effectively passed through to L2, e.g. in a pKVM scenario where L2 is L1's depriveleged host, as KVM will only emulate an EOI for L1's vAPIC if Virtual Interrupt Delivery (VID) is disabled in vmc12, and L1 isn't intercepting L2 accesses to its (virtual) APIC page (or if x2APIC is enabled, the EOI MSR).
WARN() if KVM updates L1's ISR while L2 is active with VID enabled, as an EOI from L2 is supposed to affect L2's vAPIC, but still defer the update, to try to keep L1 alive. Specifically, KVM forwards all APICv-related VM-Exits to L1 via nested_vmx_l1_wants_exit():
case EXIT_REASON_APIC_ACCESS: case EXIT_REASON_APIC_WRITE: case EXIT_REASON_EOI_INDUCED: /* * The controls for "virtualize APIC accesses," "APIC- * register virtualization," and "virtual-interrupt * delivery" only come from vmcs12. */ return true;
[sean: resolve minor syntactic conflict in lapic.h, account for lack of
kvm_x86_call(), drop sanity check due to lack of wants_to_run]
--- arch/x86/kvm/lapic.c | 11 +++++++++++ arch/x86/kvm/lapic.h | 1 + arch/x86/kvm/vmx/nested.c | 5 +++++ arch/x86/kvm/vmx/vmx.c | 16 ++++++++++++++++ arch/x86/kvm/vmx/vmx.h | 1 + 5 files changed, 34 insertions(+)
arch/x86/kvm/lapic.c +11 -0
@@ -803,6 +803,17 @@ static inline void apic_clear_isr(int vec, struct kvm_lapic *apic) } } +void kvm_apic_update_hwapic_isr (struct kvm_vcpu *vcpu) +{ +struct kvm_lapic *apic = vcpu->arch.apic; + +if (WARN_ON_ONCE (!lapic_in_kernel (vcpu)) || !apic->apicv_active) +return ; + +static_call (kvm_x86_hwapic_isr_update)(vcpu,apic_find_highest_isr (apic)); +} +EXPORT_SYMBOL_GPL (kvm_apic_update_hwapic_isr); +int kvm_lapic_find_highest_irr (struct kvm_vcpu *vcpu) {/* This may race with setting of irr in __apic_accept_irq() and
arch/x86/kvm/lapic.h +1 -0
@@ -124,6 +124,7 @@ int kvm_set_apic_base(struct kvm_vcpu *vcpu, struct msr_data *msr_info);int kvm_apic_get_state (struct kvm_vcpu *vcpu,struct kvm_lapic_state *s);int kvm_apic_set_state (struct kvm_vcpu *vcpu,struct kvm_lapic_state *s);enum lapic_mode kvm_get_apic_mode (struct kvm_vcpu *vcpu); +void kvm_apic_update_hwapic_isr (struct kvm_vcpu *vcpu);int kvm_lapic_find_highest_irr (struct kvm_vcpu *vcpu);u64 kvm_get_lapic_tscdeadline_msr (struct kvm_vcpu *vcpu);
arch/x86/kvm/vmx/nested.c +5 -0
@@ -4900,6 +4900,11 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 vm_exit_reason,kvm_make_request (KVM_REQ_APICV_UPDATE , vcpu); } +if (vmx->nested.update_vmcs01_hwapic_isr) { + vmx->nested.update_vmcs01_hwapic_isr = false; +kvm_apic_update_hwapic_isr (vcpu); + } +if ((vm_exit_reason !=-1 ) && (enable_shadow_vmcs ||evmptr_is_valid (vmx->nested.hv_evmcs_vmptr))) vmx->nested.need_vmcs12_to_shadow_sync = true;
arch/x86/kvm/vmx/vmx.c +16 -0
@@ -6839,6 +6839,22 @@ static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)u16 status;u8 old; +/* +* If L2 is active, defer the SVI update until vmcs01 is loaded, as SVI +* is only relevant for if and only if Virtual Interrupt Delivery is +* enabled in vmcs12, and if VID is enabled then L2 EOIs affect L2's +* vAPIC, not L1's vAPIC. KVM must update vmcs01 on the next nested +* VM-Exit, otherwise L1 with run with a stale SVI. +*/ +if (is_guest_mode (vcpu)) { +/* +* KVM is supposed to forward intercepted L2 EOIs to L1 if VID +* is enabled in vmcs12; as above, the EOIs affect L2's vAPIC. +*/ +to_vmx (vcpu)->nested.update_vmcs01_hwapic_isr = true; +return ; + } +if (max_isr ==-1 ) max_isr =0 ;
arch/x86/kvm/vmx/vmx.h +1 -0
@@ -177,6 +177,7 @@ struct nested_vmx {bool reload_vmcs01_apic_access_page;bool update_vmcs01_cpu_dirty_logging;bool update_vmcs01_apicv_status; +bool update_vmcs01_hwapic_isr;/* * Enlightened VMCS has been enabled. It does not mean that L1 has to
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 39/587 KVM: x86: Snapshot the hosts DEBUGCTL in common x86
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit fb71c795935652fa20eaf9517ca9547f5af99a76 ]
Move KVM's snapshot of DEBUGCTL to kvm_vcpu_arch and take the snapshot in common x86, so that SVM can also use the snapshot.
Opportunistically change the field to a u64. While bits 63:32 are reserved on AMD, not mentioned at all in Intel's SDM, and managed as an "unsigned long" by the kernel, DEBUGCTL is an MSR and therefore a 64-bit value.
--- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/vmx/vmx.c | 8 ++------ arch/x86/kvm/vmx/vmx.h | 2 -- arch/x86/kvm/x86.c | 1 + 4 files changed, 4 insertions(+), 8 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -0
@@ -733,6 +733,7 @@ struct kvm_vcpu_arch {u32 pkru;u32 hflags;u64 efer; +u64 host_debugctl;u64 apic_base;struct kvm_lapic *apic;/* kernel irqchip context */ bool load_eoi_exitmap_pending;
arch/x86/kvm/vmx/vmx.c +2 -6
@@ -1499,13 +1499,9 @@ void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu,*/ static void vmx_vcpu_load (struct kvm_vcpu *vcpu,int cpu) { -struct vcpu_vmx *vmx =to_vmx (vcpu); -vmx_vcpu_load_vmcs (vcpu, cpu,NULL );vmx_vcpu_pi_load (vcpu, cpu); - - vmx->host_debugctlmsr =get_debugctlmsr (); }static void vmx_vcpu_put (struct kvm_vcpu *vcpu)
@@ -7414,8 +7410,8 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu) }/* MSR_IA32_DEBUGCTLMSR is zeroed on vmexit. Restore it if needed */ -if (vmx->host_debugctlmsr) -update_debugctlmsr (vmx->host_debugctlmsr); +if (vcpu->arch.host_debugctl) +update_debugctlmsr (vcpu->arch.host_debugctl);#ifndef CONFIG_X86_64 /*
arch/x86/kvm/vmx/vmx.h +0 -2
@@ -340,8 +340,6 @@ struct vcpu_vmx {/* apic deadline value in host tsc */ u64 hv_deadline_tsc; -unsigned long host_debugctlmsr; -/* * Only bits masked by msr_ia32_feature_control_valid_bits can be set in * msr_ia32_feature_control. FEAT_CTL_LOCKED is always included
arch/x86/kvm/x86.c +1 -0
@@ -4823,6 +4823,7 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)/* Save host pkru register if supported */ vcpu->arch.host_pkru =read_pkru (); + vcpu->arch.host_debugctl =get_debugctlmsr ();/* Apply any externally detected TSC adjustments (due to suspend) */ if (unlikely (vcpu->arch.tsc_offset_adjustment)) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 40/587 KVM: x86: Snapshot the hosts DEBUGCTL after disabling IRQs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 189ecdb3e112da703ac0699f4ec76aa78122f911 ]
Snapshot the host's DEBUGCTL after disabling IRQs, as perf can toggle debugctl bits from IRQ context, e.g. when enabling/disabling events via smp_call_function_single(). Taking the snapshot (long) before IRQs are disabled could result in KVM effectively clobbering DEBUGCTL due to using a stale snapshot.
--- arch/x86/kvm/x86.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kvm/x86.c +2 -1
@@ -4823,7 +4823,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)/* Save host pkru register if supported */ vcpu->arch.host_pkru =read_pkru (); - vcpu->arch.host_debugctl =get_debugctlmsr ();/* Apply any externally detected TSC adjustments (due to suspend) */ if (unlikely (vcpu->arch.tsc_offset_adjustment)) {
@@ -10782,6 +10781,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)set_debugreg (0 ,7 ); } + vcpu->arch.host_debugctl =get_debugctlmsr (); +guest_timing_enter_irqoff ();for (;;) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 41/587 KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 9c9025ea003a03f967affd690f39b4ef3452c0f5 ]
Annotate the kvm_entry() tracepoint with "immediate exit" when KVM is forcing a VM-Exit immediately after VM-Enter, e.g. when KVM wants to inject an event but needs to first complete some other operation. Knowing that KVM is (or isn't) forcing an exit is useful information when debugging issues related to event injection.
--- arch/x86/include/asm/kvm_host.h | 3 ++- arch/x86/kvm/svm/svm.c | 5 +++-- arch/x86/kvm/trace.h | 9 ++++++--- arch/x86/kvm/vmx/vmx.c | 4 ++-- arch/x86/kvm/x86.c | 2 +- 5 files changed, 14 insertions(+), 9 deletions(-)
arch/x86/include/asm/kvm_host.h +2 -1
@@ -1624,7 +1624,8 @@ struct kvm_x86_ops {void (*flush_tlb_guest)(struct kvm_vcpu *vcpu);int (*vcpu_pre_run)(struct kvm_vcpu *vcpu); -enum exit_fastpath_completion (*vcpu_run)(struct kvm_vcpu *vcpu); +enum exit_fastpath_completion (*vcpu_run)(struct kvm_vcpu *vcpu, +bool force_immediate_exit);int (*handle_exit)(struct kvm_vcpu *vcpu,enum exit_fastpath_completion exit_fastpath);int (*skip_emulated_instruction)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +3 -2
@@ -4194,12 +4194,13 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_inguest_state_exit_irqoff (); } -static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu) +static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, +bool force_immediate_exit) {struct vcpu_svm *svm =to_svm (vcpu);bool spec_ctrl_intercepted =msr_write_intercepted (vcpu,MSR_IA32_SPEC_CTRL ); -trace_kvm_entry (vcpu); +trace_kvm_entry (vcpu, force_immediate_exit); svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX ]; svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP ];
arch/x86/kvm/trace.h +6 -3
@@ -15,20 +15,23 @@* Tracepoint for guest mode entry. */ TRACE_EVENT (kvm_entry, - TP_PROTO(struct kvm_vcpu *vcpu), -TP_ARGS (vcpu), + TP_PROTO(struct kvm_vcpu *vcpu, bool force_immediate_exit), +TP_ARGS (vcpu, force_immediate_exit),TP_STRUCT__entry ( __field( unsigned int, vcpu_id ) __field( unsigned long, rip ) +__field ( bool, immediate_exit ) ),TP_fast_assign ( __entry->vcpu_id = vcpu->vcpu_id; __entry->rip = kvm_rip_read(vcpu); + __entry->immediate_exit = force_immediate_exit; ), -TP_printk ("vcpu %u, rip 0x%lx" , __entry->vcpu_id, __entry->rip) +TP_printk ("vcpu %u, rip 0x%lx%s" , __entry->vcpu_id, __entry->rip, + __entry->immediate_exit ?"[immediate exit]" :"" ) );/*
arch/x86/kvm/vmx/vmx.c +2 -2
@@ -7312,7 +7312,7 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu,guest_state_exit_irqoff (); } -static fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu) +static fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,bool force_immediate_exit) {struct vcpu_vmx *vmx =to_vmx (vcpu);unsigned long cr3, cr4;
@@ -7339,7 +7339,7 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu)return EXIT_FASTPATH_NONE ; } -trace_kvm_entry (vcpu); +trace_kvm_entry (vcpu, force_immediate_exit);if (vmx->ple_window_dirty) { vmx->ple_window_dirty = false;
arch/x86/kvm/x86.c +1 -1
@@ -10795,7 +10795,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)WARN_ON_ONCE ((kvm_vcpu_apicv_activated (vcpu) !=kvm_vcpu_apicv_active (vcpu)) && (kvm_get_apic_mode (vcpu) !=LAPIC_MODE_DISABLED )); - exit_fastpath =static_call (kvm_x86_vcpu_run)(vcpu); + exit_fastpath =static_call (kvm_x86_vcpu_run)(vcpu, req_immediate_exit);if (likely (exit_fastpath !=EXIT_FASTPATH_REENTER_GUEST ))break ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 42/587 KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit e6b5d16bbd2d4c8259ad76aa33de80d561aba5f9 ]
Re-enter the guest in the fast path if VMX preeemption timer VM-Exit was "spurious", i.e. if KVM "soft disabled" the timer by writing -1u and by some miracle the timer expired before any other VM-Exit occurred. This is just an intermediate step to cleaning up the preemption timer handling, optimizing these types of spurious VM-Exits is not interesting as they are extremely rare/infrequent.
--- arch/x86/kvm/vmx/vmx.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/vmx.c +9 -2
@@ -6019,8 +6019,15 @@ static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu) {struct vcpu_vmx *vmx =to_vmx (vcpu); -if (!vmx->req_immediate_exit && - !unlikely (vmx->loaded_vmcs->hv_timer_soft_disabled)) { +/* +* In the *extremely* unlikely scenario that this is a spurious VM-Exit +* due to the timer expiring while it was "soft" disabled, just eat the +* exit and re-enter the guest. +*/ +if (unlikely (vmx->loaded_vmcs->hv_timer_soft_disabled)) +return EXIT_FASTPATH_REENTER_GUEST ; + +if (!vmx->req_immediate_exit) {kvm_lapic_expired_hv_timer (vcpu);return EXIT_FASTPATH_REENTER_GUEST ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 43/587 KVM: VMX: Handle forced exit due to preemption timer in fastpath
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 11776aa0cfa7d007ad1799b1553bdcbd830e5010 ]
Handle VMX preemption timer VM-Exits due to KVM forcing an exit in the exit fastpath, i.e. avoid calling back into handle_preemption_timer() for the same exit. There is no work to be done for forced exits, as the name suggests the goal is purely to get control back in KVM.
In addition to shaving a few cycles, this will allow cleanly separating handle_fastpath_preemption_timer() from handle_preemption_timer(), e.g. it's not immediately obvious why _apparently_ calling handle_fastpath_preemption_timer() twice on a "slow" exit is necessary:
the "slow" call is necessary to handle exits from L2, which are excluded from the fastpath by vmx_vcpu_run().
--- arch/x86/kvm/vmx/vmx.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx/vmx.c +8 -5
@@ -6027,12 +6027,15 @@ static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu)if (unlikely (vmx->loaded_vmcs->hv_timer_soft_disabled))return EXIT_FASTPATH_REENTER_GUEST ; -if (!vmx->req_immediate_exit) { -kvm_lapic_expired_hv_timer (vcpu); -return EXIT_FASTPATH_REENTER_GUEST ; - } +/* +* If the timer expired because KVM used it to force an immediate exit, +* then mission accomplished. +*/ +if (vmx->req_immediate_exit) +return EXIT_FASTPATH_EXIT_HANDLED ; -return EXIT_FASTPATH_NONE ; +kvm_lapic_expired_hv_timer (vcpu); +return EXIT_FASTPATH_REENTER_GUEST ; }static int handle_preemption_timer (struct kvm_vcpu *vcpu)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 44/587 KVM: x86: Move handling of is_guest_mode() into fastpath exit handlers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit bf1a49436ea37b98dd2f37c57608951d0e28eecc ]
Let the fastpath code decide which exits can/can't be handled in the fastpath when L2 is active, e.g. when KVM generates a VMX preemption timer exit to forcefully regain control, there is no "work" to be done and so such exits can be handled in the fastpath regardless of whether L1 or L2 is active.
Moving the is_guest_mode() check into the fastpath code also makes it easier to see that L2 isn't allowed to use the fastpath in most cases, e.g. it's not immediately obvious why handle_fastpath_preemption_timer() is called from the fastpath and the normal path.
--- arch/x86/kvm/svm/svm.c | 6 +++--- arch/x86/kvm/vmx/vmx.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/x86/kvm/svm/svm.c +3 -3
@@ -4157,6 +4157,9 @@ static int svm_vcpu_pre_run(struct kvm_vcpu *vcpu)static fastpath_t svm_exit_handlers_fastpath (struct kvm_vcpu *vcpu) { +if (is_guest_mode (vcpu)) +return EXIT_FASTPATH_NONE ; +if (to_svm (vcpu)->vmcb->control.exit_code ==SVM_EXIT_MSR &&to_svm (vcpu)->vmcb->control.exit_info_1)return handle_fastpath_set_msr_irqoff (vcpu);
@@ -4315,9 +4318,6 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu,svm_complete_interrupts (vcpu); -if (is_guest_mode (vcpu)) -return EXIT_FASTPATH_NONE ; -return svm_exit_handlers_fastpath (vcpu); }
arch/x86/kvm/vmx/vmx.c +3 -3
@@ -7258,6 +7258,9 @@ void noinstr vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx,static fastpath_t vmx_exit_handlers_fastpath (struct kvm_vcpu *vcpu) { +if (is_guest_mode (vcpu)) +return EXIT_FASTPATH_NONE ; +switch (to_vmx (vcpu)->exit_reason.basic) {case EXIT_REASON_MSR_WRITE :return handle_fastpath_set_msr_irqoff (vcpu);
@@ -7468,9 +7471,6 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, bool force_immediate_exit)vmx_recover_nmi_blocking (vmx);vmx_complete_interrupts (vmx); -if (is_guest_mode (vcpu)) -return EXIT_FASTPATH_NONE ; -return vmx_exit_handlers_fastpath (vcpu); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 45/587 KVM: VMX: Handle KVM-induced preemption timer exits in fastpath for L2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 7b3d1bbf8d68d76fb21210932a5e8ed8ea80dbcc ]
Eat VMX treemption timer exits in the fastpath regardless of whether L1 or L2 is active. The VM-Exit is 100% KVM-induced, i.e. there is nothing directly related to the exit that KVM needs to do on behalf of the guest, thus there is no reason to wait until the slow path to do nothing.
Opportunistically add comments explaining why preemption timer exits for emulating the guest's APIC timer need to go down the slow path.
--- arch/x86/kvm/vmx/vmx.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/vmx.c +20 -2
@@ -6034,13 +6034,26 @@ static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu)if (vmx->req_immediate_exit)return EXIT_FASTPATH_EXIT_HANDLED ; +/* +* If L2 is active, go down the slow path as emulating the guest timer +* expiration likely requires synthesizing a nested VM-Exit. +*/ +if (is_guest_mode (vcpu)) +return EXIT_FASTPATH_NONE ; +kvm_lapic_expired_hv_timer (vcpu);return EXIT_FASTPATH_REENTER_GUEST ; }static int handle_preemption_timer (struct kvm_vcpu *vcpu) { -handle_fastpath_preemption_timer (vcpu); +/* +* This non-fastpath handler is reached if and only if the preemption +* timer was being used to emulate a guest timer while L2 is active. +* All other scenarios are supposed to be handled in the fastpath. +*/ +WARN_ON_ONCE (!is_guest_mode (vcpu)); +kvm_lapic_expired_hv_timer (vcpu);return 1 ; }
@@ -7258,7 +7271,12 @@ void noinstr vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx,static fastpath_t vmx_exit_handlers_fastpath (struct kvm_vcpu *vcpu) { -if (is_guest_mode (vcpu)) +/* +* If L2 is active, some VMX preemption timer exits can be handled in +* the fastpath even, all other exits must use the slow path. +*/ +if (is_guest_mode (vcpu) && +to_vmx (vcpu)->exit_reason.basic !=EXIT_REASON_PREEMPTION_TIMER )return EXIT_FASTPATH_NONE ;switch (to_vmx (vcpu)->exit_reason.basic) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 46/587 KVM: x86: Fully defer to vendor code to decide how to force immediate exit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 0ec3d6d1f169baa7fc512ae4b78d17e7c94b7763 ]
Now that vmx->req_immediate_exit is used only in the scope of vmx_vcpu_run(), use force_immediate_exit to detect that KVM should usurp the VMX preemption to force a VM-Exit and let vendor code fully handle forcing a VM-Exit.
Opportunsitically drop __kvm_request_immediate_exit() and just have vendor code call smp_send_reschedule() directly. SVM already does this when injecting an event while also trying to single-step an IRET, i.e. it's not exactly secret knowledge that KVM uses a reschedule IPI to force an exit.
--- arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 3 --- arch/x86/kvm/svm/svm.c | 7 ++++--- arch/x86/kvm/vmx/vmx.c | 32 +++++++++++++----------------- arch/x86/kvm/vmx/vmx.h | 2 -- arch/x86/kvm/x86.c | 10 +--------- 6 files changed, 19 insertions(+), 36 deletions(-)
arch/x86/include/asm/kvm-x86-ops.h +0 -1
@@ -102,7 +102,6 @@ KVM_X86_OP(write_tsc_multiplier) KVM_X86_OP(get_exit_info) KVM_X86_OP(check_intercept) KVM_X86_OP(handle_exit_irqoff) -KVM_X86_OP(request_immediate_exit) KVM_X86_OP(sched_in) KVM_X86_OP_OPTIONAL(update_cpu_dirty_logging) KVM_X86_OP_OPTIONAL(vcpu_blocking)
arch/x86/include/asm/kvm_host.h +0 -3
@@ -1695,8 +1695,6 @@ struct kvm_x86_ops { struct x86_exception *exception);void (*handle_exit_irqoff)(struct kvm_vcpu *vcpu); -void (*request_immediate_exit)(struct kvm_vcpu *vcpu); -void (*sched_in)(struct kvm_vcpu *kvm,int cpu);/*
@@ -2182,7 +2180,6 @@ extern bool kvm_find_async_pf_gfn(struct kvm_vcpu *vcpu, gfn_t gfn);int kvm_skip_emulated_instruction (struct kvm_vcpu *vcpu);int kvm_complete_insn_gp (struct kvm_vcpu *vcpu,int err); -void __kvm_request_immediate_exit (struct kvm_vcpu *vcpu);void __user *__x86_set_memory_region (struct kvm *kvm,int id,gpa_t gpa,u32 size);
arch/x86/kvm/svm/svm.c +4 -3
@@ -4222,9 +4222,12 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu,* is enough to force an immediate vmexit. */ disable_nmi_singlestep (svm); -smp_send_reschedule (vcpu->cpu); + force_immediate_exit = true; } +if (force_immediate_exit) +smp_send_reschedule (vcpu->cpu); +pre_svm_run (vcpu);sync_lapic_to_cr8 (vcpu);
@@ -5075,8 +5078,6 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { .check_intercept = svm_check_intercept, .handle_exit_irqoff = svm_handle_exit_irqoff, - .request_immediate_exit = __kvm_request_immediate_exit, - .sched_in = svm_sched_in, .nested_ops = &svm_nested_ops,
arch/x86/kvm/vmx/vmx.c +14 -18
@@ -49,6 +49,8 @@#include <asm/spec-ctrl.h> #include <asm/vmx.h> +#include <trace/events/ipi.h> +#include "capabilities.h" #include "cpuid.h" #include "hyperv.h"
@@ -1304,8 +1306,6 @@ void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)u16 fs_sel, gs_sel;int i; - vmx->req_immediate_exit = false; -/* * Note that guest MSRs to be saved/restored can also be changed * when guest state is loaded. This happens when guest transitions
@@ -6015,7 +6015,8 @@ static int handle_pml_full(struct kvm_vcpu *vcpu)return 1 ; } -static fastpath_t handle_fastpath_preemption_timer (struct kvm_vcpu *vcpu) +static fastpath_t handle_fastpath_preemption_timer (struct kvm_vcpu *vcpu, +bool force_immediate_exit) {struct vcpu_vmx *vmx =to_vmx (vcpu);
@@ -6031,7 +6032,7 @@ static fastpath_t handle_fastpath_preemption_timer(struct kvm_vcpu *vcpu)* If the timer expired because KVM used it to force an immediate exit, * then mission accomplished. */ -if (vmx->req_immediate_exit) +if (force_immediate_exit)return EXIT_FASTPATH_EXIT_HANDLED ;/*
@@ -7210,13 +7211,13 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx) msrs[i].host, false); } -static void vmx_update_hv_timer (struct kvm_vcpu *vcpu) +static void vmx_update_hv_timer (struct kvm_vcpu *vcpu,bool force_immediate_exit) {struct vcpu_vmx *vmx =to_vmx (vcpu);u64 tscl;u32 delta_tsc; -if (vmx->req_immediate_exit) { +if (force_immediate_exit) {vmcs_write32 (VMX_PREEMPTION_TIMER_VALUE ,0 ); vmx->loaded_vmcs->hv_timer_soft_disabled = false; }else if (vmx->hv_deadline_tsc !=-1 ) {
@@ -7269,7 +7270,8 @@ void noinstr vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx,barrier_nospec (); } -static fastpath_t vmx_exit_handlers_fastpath (struct kvm_vcpu *vcpu) +static fastpath_t vmx_exit_handlers_fastpath (struct kvm_vcpu *vcpu, +bool force_immediate_exit) {/* * If L2 is active, some VMX preemption timer exits can be handled in
@@ -7283,7 +7285,7 @@ static fastpath_t vmx_exit_handlers_fastpath(struct kvm_vcpu *vcpu)case EXIT_REASON_MSR_WRITE :return handle_fastpath_set_msr_irqoff (vcpu);case EXIT_REASON_PREEMPTION_TIMER : -return handle_fastpath_preemption_timer (vcpu); +return handle_fastpath_preemption_timer (vcpu, force_immediate_exit);default :return EXIT_FASTPATH_NONE ; }
@@ -7425,7 +7427,9 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, bool force_immediate_exit)vmx_passthrough_lbr_msrs (vcpu);if (enable_preemption_timer) -vmx_update_hv_timer (vcpu); +vmx_update_hv_timer (vcpu, force_immediate_exit); +else if (force_immediate_exit) +smp_send_reschedule (vcpu->cpu);kvm_wait_lapic_expire (vcpu);
@@ -7489,7 +7493,7 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, bool force_immediate_exit)vmx_recover_nmi_blocking (vmx);vmx_complete_interrupts (vmx); -return vmx_exit_handlers_fastpath (vcpu); +return vmx_exit_handlers_fastpath (vcpu, force_immediate_exit); }static void vmx_vcpu_free (struct kvm_vcpu *vcpu)
@@ -7988,11 +7992,6 @@ static __init void vmx_set_cpu_caps(void)kvm_cpu_cap_check_and_set (X86_FEATURE_WAITPKG ); } -static void vmx_request_immediate_exit (struct kvm_vcpu *vcpu) -{ -to_vmx (vcpu)->req_immediate_exit = true; -} -static int vmx_check_intercept_io (struct kvm_vcpu *vcpu,struct x86_instruction_info *info) {
@@ -8404,8 +8403,6 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { .check_intercept = vmx_check_intercept, .handle_exit_irqoff = vmx_handle_exit_irqoff, - .request_immediate_exit = vmx_request_immediate_exit, - .sched_in = vmx_sched_in, .cpu_dirty_log_size = PML_ENTITY_NUM,
@@ -8663,7 +8660,6 @@ static __init int hardware_setup(void)if (!enable_preemption_timer) { vmx_x86_ops.set_hv_timer =NULL ; vmx_x86_ops.cancel_hv_timer =NULL ; - vmx_x86_ops.request_immediate_exit = __kvm_request_immediate_exit; } kvm_caps.supported_mce_cap |=MCG_LMCE_P ;
arch/x86/kvm/vmx/vmx.h +0 -2
@@ -331,8 +331,6 @@ struct vcpu_vmx {unsigned int ple_window;bool ple_window_dirty; -bool req_immediate_exit; -/* Support for PML */ #define PML_ENTITY_NUM 512struct page *pml_pg;
arch/x86/kvm/x86.c +1 -9
@@ -10505,12 +10505,6 @@ static void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu)static_call_cond (kvm_x86_set_apic_access_page_addr)(vcpu); } -void __kvm_request_immediate_exit (struct kvm_vcpu *vcpu) -{ -smp_send_reschedule (vcpu->cpu); -} -EXPORT_SYMBOL_GPL (__kvm_request_immediate_exit); -/* * Called within kvm->srcu read side. * Returns 1 to let vcpu_run() continue the guest execution loop without
@@ -10756,10 +10750,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) goto cancel_injection; } -if (req_immediate_exit) { +if (req_immediate_exit)kvm_make_request (KVM_REQ_EVENT , vcpu); -static_call (kvm_x86_request_immediate_exit)(vcpu); - }fpregs_assert_state_consistent ();if (test_thread_flag (TIF_NEED_FPU_LOAD ))
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 47/587 KVM: x86: Convert vcpu_run()s immediate exit param into a generic bitmap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 2478b1b220c49d25cb1c3f061ec4f9b351d9a131 ]
Convert kvm_x86_ops.vcpu_run()'s "force_immediate_exit" boolean parameter into an a generic bitmap so that similar "take action" information can be passed to vendor code without creating a pile of boolean parameters.
This will allow dropping kvm_x86_ops.set_dr6() in favor of a new flag, and will also allow for adding similar functionality for re-loading debugctl in the active VMCS.
Opportunistically massage the TDX WARN and comment to prepare for adding more run_flags, all of which are expected to be mutually exclusive with TDX, i.e. should be WARNed on.
No functional change intended.
--- arch/x86/include/asm/kvm_host.h | 6 +++++- arch/x86/kvm/svm/svm.c | 4 ++-- arch/x86/kvm/vmx/vmx.c | 3 ++- arch/x86/kvm/x86.c | 10 ++++++++-- 4 files changed, 17 insertions(+), 6 deletions(-)
arch/x86/include/asm/kvm_host.h +5 -1
@@ -1550,6 +1550,10 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical)return dest_mode_logical ?APIC_DEST_LOGICAL :APIC_DEST_PHYSICAL ; } +enum kvm_x86_run_flags { +KVM_RUN_FORCE_IMMEDIATE_EXIT =BIT (0 ), +}; +struct kvm_x86_ops {const char *name;
@@ -1625,7 +1629,7 @@ struct kvm_x86_ops {int (*vcpu_pre_run)(struct kvm_vcpu *vcpu);enum exit_fastpath_completion (*vcpu_run)(struct kvm_vcpu *vcpu, -bool force_immediate_exit); +u64 run_flags);int (*handle_exit)(struct kvm_vcpu *vcpu,enum exit_fastpath_completion exit_fastpath);int (*skip_emulated_instruction)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +2 -2
@@ -4197,9 +4197,9 @@ static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_inguest_state_exit_irqoff (); } -static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, -bool force_immediate_exit) +static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags) { +bool force_immediate_exit = run_flags &KVM_RUN_FORCE_IMMEDIATE_EXIT ;struct vcpu_svm *svm =to_svm (vcpu);bool spec_ctrl_intercepted =msr_write_intercepted (vcpu,MSR_IA32_SPEC_CTRL );
arch/x86/kvm/vmx/vmx.c +2 -1
@@ -7345,8 +7345,9 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu,guest_state_exit_irqoff (); } -static fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,bool force_immediate_exit) +static fastpath_t vmx_vcpu_run (struct kvm_vcpu *vcpu,u64 run_flags) { +bool force_immediate_exit = run_flags &KVM_RUN_FORCE_IMMEDIATE_EXIT ;struct vcpu_vmx *vmx =to_vmx (vcpu);unsigned long cr3, cr4;
arch/x86/kvm/x86.c +8 -2
@@ -10518,6 +10518,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)dm_request_for_irq_injection (vcpu) &&kvm_cpu_accept_dm_intr (vcpu);fastpath_t exit_fastpath; +u64 run_flags;bool req_immediate_exit = false;
@@ -10750,8 +10751,11 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) goto cancel_injection; } -if (req_immediate_exit) + run_flags =0 ; +if (req_immediate_exit) { + run_flags |=KVM_RUN_FORCE_IMMEDIATE_EXIT ;kvm_make_request (KVM_REQ_EVENT , vcpu); + }fpregs_assert_state_consistent ();if (test_thread_flag (TIF_NEED_FPU_LOAD ))
@@ -10787,7 +10791,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)WARN_ON_ONCE ((kvm_vcpu_apicv_activated (vcpu) !=kvm_vcpu_apicv_active (vcpu)) && (kvm_get_apic_mode (vcpu) !=LAPIC_MODE_DISABLED )); - exit_fastpath =static_call (kvm_x86_vcpu_run)(vcpu, req_immediate_exit); + exit_fastpath =static_call (kvm_x86_vcpu_run)(vcpu, run_flags);if (likely (exit_fastpath !=EXIT_FASTPATH_REENTER_GUEST ))break ;
@@ -10799,6 +10803,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)break ; } + run_flags =0 ; +/* Note, VM-Exits that go down the "slow" path are accounted below. */ ++vcpu->stat.exits; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 48/587 KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 80c64c7afea1da6a93ebe88d3d29d8a60377ef80 ]
Instruct vendor code to load the guest's DR6 into hardware via a new KVM_RUN flag, and remove kvm_x86_ops.set_dr6(), whose sole purpose was to load vcpu->arch.dr6 into hardware when DR6 can be read/written directly by the guest.
Note, TDX already WARNs on any run_flag being set, i.e. will yell if KVM thinks DR6 needs to be reloaded. TDX vCPUs force KVM_DEBUGREG_AUTO_SWITCH and never clear the flag, i.e. should never observe KVM_RUN_LOAD_GUEST_DR6.
--- arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/svm/svm.c | 10 ++++++---- arch/x86/kvm/vmx/vmx.c | 10 +++------- arch/x86/kvm/x86.c | 2 +- 5 files changed, 11 insertions(+), 14 deletions(-)
arch/x86/include/asm/kvm-x86-ops.h +0 -1
@@ -48,7 +48,6 @@ KVM_X86_OP(set_idt) KVM_X86_OP(get_gdt) KVM_X86_OP(set_gdt) KVM_X86_OP(sync_dirty_debug_regs) -KVM_X86_OP(set_dr6) KVM_X86_OP(set_dr7) KVM_X86_OP(cache_reg) KVM_X86_OP(get_rflags)
arch/x86/include/asm/kvm_host.h +1 -1
@@ -1552,6 +1552,7 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical)enum kvm_x86_run_flags {KVM_RUN_FORCE_IMMEDIATE_EXIT =BIT (0 ), +KVM_RUN_LOAD_GUEST_DR6 =BIT (1 ), };struct kvm_x86_ops {
@@ -1600,7 +1601,6 @@ struct kvm_x86_ops {void (*get_gdt)(struct kvm_vcpu *vcpu,struct desc_ptr *dt);void (*set_gdt)(struct kvm_vcpu *vcpu,struct desc_ptr *dt);void (*sync_dirty_debug_regs)(struct kvm_vcpu *vcpu); -void (*set_dr6)(struct kvm_vcpu *vcpu,unsigned long value);void (*set_dr7)(struct kvm_vcpu *vcpu,unsigned long value);void (*cache_reg)(struct kvm_vcpu *vcpu,enum kvm_reg reg);unsigned long (*get_rflags)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +6 -4
@@ -4241,10 +4241,13 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)svm_hv_update_vp_id (svm->vmcb, vcpu);/* -* Run with all-zero DR6 unless needed, so that we can get the exact cause -* of a #DB. +* Run with all-zero DR6 unless the guest can write DR6 freely, so that +* KVM can get the exact cause of a #DB. Note, loading guest DR6 from +* KVM's snapshot is only necessary when DR accesses won't exit. */ -if (likely (!(vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT ))) +if (unlikely (run_flags &KVM_RUN_LOAD_GUEST_DR6 )) +svm_set_dr6 (vcpu, vcpu->arch.dr6); +else if (likely (!(vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT )))svm_set_dr6 (vcpu,DR6_ACTIVE_LOW );clgi ();
@@ -5021,7 +5024,6 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { .set_idt = svm_set_idt, .get_gdt = svm_get_gdt, .set_gdt = svm_set_gdt, - .set_dr6 = svm_set_dr6, .set_dr7 = svm_set_dr7, .sync_dirty_debug_regs = svm_sync_dirty_debug_regs, .cache_reg = svm_cache_reg,
arch/x86/kvm/vmx/vmx.c +3 -7
@@ -5616,12 +5616,6 @@ static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)set_debugreg (DR6_RESERVED ,6 ); } -static void vmx_set_dr6 (struct kvm_vcpu *vcpu,unsigned long val) -{ -lockdep_assert_irqs_disabled (); -set_debugreg (vcpu->arch.dr6,6 ); -} -static void vmx_set_dr7 (struct kvm_vcpu *vcpu,unsigned long val) {vmcs_writel (GUEST_DR7 , val);
@@ -7392,6 +7386,9 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)vmcs_writel (GUEST_RIP , vcpu->arch.regs[VCPU_REGS_RIP ]); vcpu->arch.regs_dirty =0 ; +if (run_flags &KVM_RUN_LOAD_GUEST_DR6 ) +set_debugreg (vcpu->arch.dr6,6 ); +/* * Refresh vmcs.HOST_CR3 if necessary. This must be done immediately * prior to VM-Enter, as the kernel may load a new ASID (PCID) any time
@@ -8337,7 +8334,6 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { .set_idt = vmx_set_idt, .get_gdt = vmx_get_gdt, .set_gdt = vmx_set_gdt, - .set_dr6 = vmx_set_dr6, .set_dr7 = vmx_set_dr7, .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs, .cache_reg = vmx_cache_reg,
arch/x86/kvm/x86.c +1 -1
@@ -10772,7 +10772,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)set_debugreg (vcpu->arch.eff_db[3 ],3 );/* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ if (unlikely (vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT )) -static_call (kvm_x86_set_dr6)(vcpu, vcpu->arch.dr6); + run_flags |=KVM_RUN_LOAD_GUEST_DR6 ; }else if (unlikely (hw_breakpoint_active ())) {set_debugreg (0 ,7 ); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 49/587 KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 17ec2f965344ee3fd6620bef7ef68792f4ac3af0 ]
Let the guest set DEBUGCTL.RTM_DEBUG if RTM is supported according to the guest CPUID model, as debug support is supposed to be available if RTM is supported, and there are no known downsides to letting the guest debug RTM aborts.
Note, there are no known bug reports related to RTM_DEBUG, the primary motivation is to reduce the probability of breaking existing guests when a future change adds a missing consistency check on vmcs12.GUEST_DEBUGCTL (KVM currently lets L2 run with whatever hardware supports; whoops).
Note #2, KVM already emulates DR6.RTM, and doesn't restrict access to DR7.RTM.
--- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kvm/vmx/vmx.c | 4 ++++ 2 files changed, 5 insertions(+)
arch/x86/include/asm/msr-index.h +1 -0
@@ -380,6 +380,7 @@#define DEBUGCTLMSR_FREEZE_PERFMON_ON_PMI (1UL << 12)#define DEBUGCTLMSR_FREEZE_IN_SMM_BIT 14#define DEBUGCTLMSR_FREEZE_IN_SMM (1UL << DEBUGCTLMSR_FREEZE_IN_SMM_BIT) +#define DEBUGCTLMSR_RTM_DEBUG BIT(15)#define MSR_PEBS_FRONTEND 0x000003f7
arch/x86/kvm/vmx/vmx.c +4 -0
@@ -2161,6 +2161,10 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiated (host_initiated || intel_pmu_lbr_is_enabled(vcpu))) debugctl |=DEBUGCTLMSR_LBR |DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ; +if (boot_cpu_has (X86_FEATURE_RTM ) && + (host_initiated ||guest_cpuid_has (vcpu,X86_FEATURE_RTM ))) + debugctl |=DEBUGCTLMSR_RTM_DEBUG ; +return debugctl; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 50/587 KVM: VMX: Extract checking of guests DEBUGCTL into helper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 8a4351ac302cd8c19729ba2636acfd0467c22ae8 ]
Move VMX's logic to check DEBUGCTL values into a standalone helper so that the code can be used by nested VM-Enter to apply the same logic to the value being loaded from vmcs12.
KVM needs to explicitly check vmcs12->guest_ia32_debugctl on nested VM-Enter, as hardware may support features that KVM does not, i.e. relying on hardware to detect invalid guest state will result in false negatives. Unfortunately, that means applying KVM's funky suppression of BTF and LBR to vmcs12 so as not to break existing guests.
No functional change intended.
Stable-dep-of: 7d0cce6cbe71 ("KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs")
--- arch/x86/kvm/vmx/vmx.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-)
arch/x86/kvm/vmx/vmx.c +17 -12
@@ -2168,6 +2168,19 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiatedreturn debugctl; } +static bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data, +bool host_initiated) +{ +u64 invalid; + + invalid = data & ~vmx_get_supported_debugctl (vcpu, host_initiated); +if (invalid & (DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR )) { +kvm_pr_unimpl_wrmsr (vcpu,MSR_IA32_DEBUGCTLMSR , data); + invalid &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); + } +return !invalid; +} +/* * Writes msr value into the appropriate "register". * Returns 0 on success, non-0 otherwise.
@@ -2236,19 +2249,12 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) }vmcs_writel (GUEST_SYSENTER_ESP , data);break ; -case MSR_IA32_DEBUGCTLMSR : { -u64 invalid; - - invalid = data & ~vmx_get_supported_debugctl (vcpu, msr_info->host_initiated); -if (invalid & (DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR )) { -kvm_pr_unimpl_wrmsr (vcpu, msr_index, data); - data &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); - invalid &= ~(DEBUGCTLMSR_BTF |DEBUGCTLMSR_LBR ); - } - -if (invalid) +case MSR_IA32_DEBUGCTLMSR : +if (!vmx_is_valid_debugctl (vcpu, data, msr_info->host_initiated))return 1 ; + data &=vmx_get_supported_debugctl (vcpu, msr_info->host_initiated); +if (is_guest_mode (vcpu) &&get_vmcs12 (vcpu)->vm_exit_controls &VM_EXIT_SAVE_DEBUG_CONTROLS )get_vmcs12 (vcpu)->guest_ia32_debugctl = data;
@@ -2258,7 +2264,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) (data & DEBUGCTLMSR_LBR))intel_pmu_create_guest_lbr_event (vcpu);return 0 ; - }case MSR_IA32_BNDCFGS : if (!kvm_mpx_supported() || (!msr_info->host_initiated &&
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 51/587 KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
[ Upstream commit 095686e6fcb4150f0a55b1a25987fad3d8af58d6 ]
Add a consistency check for L2's guest_ia32_debugctl, as KVM only supports a subset of hardware functionality, i.e. KVM can't rely on hardware to detect illegal/unsupported values. Failure to check the vmcs12 value would allow the guest to load any harware-supported value while running L2.
Take care to exempt BTF and LBR from the validity check in order to match KVM's behavior for writes via WRMSR, but without clobbering vmcs12. Even if VM_EXIT_SAVE_DEBUG_CONTROLS is set in vmcs12, L1 can reasonably expect that vmcs12->guest_ia32_debugctl will not be modified if writes to the MSR are being intercepted.
Arguably, KVM _should_ update vmcs12 if VM_EXIT_SAVE_DEBUG_CONTROLS is set *and* writes to MSR_IA32_DEBUGCTLMSR are not being intercepted by L1, but that would incur non-trivial complexity and wouldn't change the fact that KVM's handling of DEBUGCTL is blatantly broken. I.e. the extra complexity is not worth carrying.
Stable-dep-of: 7d0cce6cbe71 ("KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs")
--- arch/x86/kvm/vmx/nested.c | 12 ++++++++++-- arch/x86/kvm/vmx/vmx.c | 5 ++--- arch/x86/kvm/vmx/vmx.h | 3 +++ 3 files changed, 15 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx/nested.c +10 -2
@@ -2564,7 +2564,8 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,if (vmx->nested.nested_run_pending && (vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS )) {kvm_set_dr (vcpu,7 , vmcs12->guest_dr7); -vmcs_write64 (GUEST_IA32_DEBUGCTL , vmcs12->guest_ia32_debugctl); +vmcs_write64 (GUEST_IA32_DEBUGCTL , vmcs12->guest_ia32_debugctl & +vmx_get_supported_debugctl (vcpu, false)); }else {kvm_set_dr (vcpu,7 , vcpu->arch.dr7);vmcs_write64 (GUEST_IA32_DEBUGCTL , vmx->nested.pre_vmenter_debugctl);
@@ -3045,7 +3046,8 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,return -EINVAL ;if ((vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS ) && -CC (!kvm_dr7_valid (vmcs12->guest_dr7))) + (CC (!kvm_dr7_valid (vmcs12->guest_dr7)) || +CC (!vmx_is_valid_debugctl (vcpu, vmcs12->guest_ia32_debugctl, false))))return -EINVAL ; if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&
@@ -4435,6 +4437,12 @@ static void sync_vmcs02_to_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) (vmcs12->vm_entry_controls & ~VM_ENTRY_IA32E_MODE ) | (vm_entry_controls_get (to_vmx (vcpu)) &VM_ENTRY_IA32E_MODE ); +/* +* Note! Save DR7, but intentionally don't grab DEBUGCTL from vmcs02. +* Writes to DEBUGCTL that aren't intercepted by L1 are immediately +* propagated to vmcs12 (see vmx_set_msr()), as the value loaded into +* vmcs02 doesn't strictly track vmcs12. +*/ if (vmcs12->vm_exit_controls &VM_EXIT_SAVE_DEBUG_CONTROLS )kvm_get_dr (vcpu,7 , (unsigned long *)&vmcs12->guest_dr7);
arch/x86/kvm/vmx/vmx.c +2 -3
@@ -2149,7 +2149,7 @@ static u64 nested_vmx_truncate_sysenter_addr(struct kvm_vcpu *vcpu,return (unsigned long )data; } -static u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated) +u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated) {u64 debugctl =0 ;
@@ -2168,8 +2168,7 @@ static u64 vmx_get_supported_debugctl(struct kvm_vcpu *vcpu, bool host_initiatedreturn debugctl; } -static bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data, -bool host_initiated) +bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data,bool host_initiated) {u64 invalid;
arch/x86/kvm/vmx/vmx.h +3 -0
@@ -429,6 +429,9 @@ static inline void vmx_set_intercept_for_msr(struct kvm_vcpu *vcpu, u32 msr,void vmx_update_cpu_dirty_logging (struct kvm_vcpu *vcpu); +u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated); +bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data,bool host_initiated); +/* * Note, early Intel manuals have the write-low and read-high bitmap offsets * the wrong way round. The bitmaps control MSRs 0x00000000-0x00001fff and
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 52/587 KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
[ Upstream commit 7d0cce6cbe71af6e9c1831bff101a2b9c249c4a2 ]
Introduce vmx_guest_debugctl_{read,write}() to handle all accesses to vmcs.GUEST_IA32_DEBUGCTL. This will allow stuffing FREEZE_IN_SMM into GUEST_IA32_DEBUGCTL based on the host setting without bleeding the state into the guest, and without needing to copy+paste the FREEZE_IN_SMM logic into every patch that accesses GUEST_IA32_DEBUGCTL.
No functional change intended.
--- arch/x86/kvm/vmx/nested.c | 10 +++++----- arch/x86/kvm/vmx/pmu_intel.c | 8 ++++---- arch/x86/kvm/vmx/vmx.c | 8 +++++--- arch/x86/kvm/vmx/vmx.h | 10 ++++++++++ 4 files changed, 24 insertions(+), 12 deletions(-)
arch/x86/kvm/vmx/nested.c +5 -5
@@ -2564,11 +2564,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,if (vmx->nested.nested_run_pending && (vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS )) {kvm_set_dr (vcpu,7 , vmcs12->guest_dr7); -vmcs_write64 (GUEST_IA32_DEBUGCTL , vmcs12->guest_ia32_debugctl & -vmx_get_supported_debugctl (vcpu, false)); +vmx_guest_debugctl_write (vcpu, vmcs12->guest_ia32_debugctl & +vmx_get_supported_debugctl (vcpu, false)); }else {kvm_set_dr (vcpu,7 , vcpu->arch.dr7); -vmcs_write64 (GUEST_IA32_DEBUGCTL , vmx->nested.pre_vmenter_debugctl); +vmx_guest_debugctl_write (vcpu, vmx->nested.pre_vmenter_debugctl); }if (kvm_mpx_supported () && (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls &VM_ENTRY_LOAD_BNDCFGS )))
@@ -3433,7 +3433,7 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu,if (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS )) - vmx->nested.pre_vmenter_debugctl =vmcs_read64 (GUEST_IA32_DEBUGCTL ); + vmx->nested.pre_vmenter_debugctl =vmx_guest_debugctl_read ();if (kvm_mpx_supported () && (!vmx->nested.nested_run_pending || !(vmcs12->vm_entry_controls &VM_ENTRY_LOAD_BNDCFGS )))
@@ -4633,7 +4633,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,__vmx_set_segment (vcpu, &seg,VCPU_SREG_LDTR );kvm_set_dr (vcpu,7 ,0x400 ); -vmcs_write64 (GUEST_IA32_DEBUGCTL ,0 ); +vmx_guest_debugctl_write (vcpu,0 );if (nested_vmx_load_msr (vcpu, vmcs12->vm_exit_msr_load_addr, vmcs12->vm_exit_msr_load_count))
arch/x86/kvm/vmx/pmu_intel.c +4 -4
@@ -633,11 +633,11 @@ static void intel_pmu_reset(struct kvm_vcpu *vcpu)*/ static void intel_pmu_legacy_freezing_lbrs_on_pmi (struct kvm_vcpu *vcpu) { -u64 data =vmcs_read64 (GUEST_IA32_DEBUGCTL ); +u64 data =vmx_guest_debugctl_read ();if (data &DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ) { data &= ~DEBUGCTLMSR_LBR ; -vmcs_write64 (GUEST_IA32_DEBUGCTL , data); +vmx_guest_debugctl_write (vcpu, data); } }
@@ -707,7 +707,7 @@ void vmx_passthrough_lbr_msrs(struct kvm_vcpu *vcpu)if (!lbr_desc->event) {vmx_disable_lbr_msrs_passthrough (vcpu); -if (vmcs_read64 (GUEST_IA32_DEBUGCTL ) &DEBUGCTLMSR_LBR ) +if (vmx_guest_debugctl_read () &DEBUGCTLMSR_LBR ) goto warn;if (test_bit (INTEL_PMC_IDX_FIXED_VLBR , pmu->pmc_in_use)) goto warn;
@@ -729,7 +729,7 @@ void vmx_passthrough_lbr_msrs(struct kvm_vcpu *vcpu)static void intel_pmu_cleanup (struct kvm_vcpu *vcpu) { -if (!(vmcs_read64 (GUEST_IA32_DEBUGCTL ) &DEBUGCTLMSR_LBR )) +if (!(vmx_guest_debugctl_read () &DEBUGCTLMSR_LBR ))intel_pmu_release_guest_lbr_event (vcpu); }
arch/x86/kvm/vmx/vmx.c +5 -3
@@ -2124,7 +2124,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) msr_info->data = vmx->pt_desc.guest.addr_a[index /2 ];break ;case MSR_IA32_DEBUGCTLMSR : - msr_info->data =vmcs_read64 (GUEST_IA32_DEBUGCTL ); + msr_info->data =vmx_guest_debugctl_read ();break ;default : find_uret_msr:
@@ -2258,7 +2258,8 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) VM_EXIT_SAVE_DEBUG_CONTROLS) get_vmcs12(vcpu)->guest_ia32_debugctl = data; - vmcs_write64(GUEST_IA32_DEBUGCTL, data); + vmx_guest_debugctl_write(vcpu, data); + if (intel_pmu_lbr_is_enabled(vcpu) && !to_vmx(vcpu)->lbr_desc.event && (data & DEBUGCTLMSR_LBR)) intel_pmu_create_guest_lbr_event(vcpu);
@@ -4826,7 +4827,8 @@ static void init_vmcs(struct vcpu_vmx *vmx)vmcs_write32 (GUEST_SYSENTER_CS ,0 );vmcs_writel (GUEST_SYSENTER_ESP ,0 );vmcs_writel (GUEST_SYSENTER_EIP ,0 ); -vmcs_write64 (GUEST_IA32_DEBUGCTL ,0 ); + +vmx_guest_debugctl_write (&vmx->vcpu,0 );if (cpu_has_vmx_tpr_shadow ()) {vmcs_write64 (VIRTUAL_APIC_PAGE_ADDR ,0 );
arch/x86/kvm/vmx/vmx.h +10 -0
@@ -432,6 +432,16 @@ void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);u64 vmx_get_supported_debugctl (struct kvm_vcpu *vcpu,bool host_initiated);bool vmx_is_valid_debugctl (struct kvm_vcpu *vcpu,u64 data,bool host_initiated); +static inline void vmx_guest_debugctl_write (struct kvm_vcpu *vcpu,u64 val) +{ +vmcs_write64 (GUEST_IA32_DEBUGCTL , val); +} + +static inline u64 vmx_guest_debugctl_read (void ) +{ +return vmcs_read64 (GUEST_IA32_DEBUGCTL ); +} +/* * Note, early Intel manuals have the write-low and read-high bitmap offsets * the wrong way round. The bitmaps control MSRs 0x00000000-0x00001fff and
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 53/587 KVM: VMX: Preserve hosts DEBUGCTLMSR_FREEZE_IN_SMM while running the guest
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
[ Upstream commit 6b1dd26544d045f6a79e8c73572c0c0db3ef3c1a ]
Set/clear DEBUGCTLMSR_FREEZE_IN_SMM in GUEST_IA32_DEBUGCTL based on the host's pre-VM-Enter value, i.e. preserve the host's FREEZE_IN_SMM setting while running the guest. When running with the "default treatment of SMIs" in effect (the only mode KVM supports), SMIs do not generate a VM-Exit that is visible to host (non-SMM) software, and instead transitions directly from VMX non-root to SMM. And critically, DEBUGCTL isn't context switched by hardware on SMI or RSM, i.e. SMM will run with whatever value was resident in hardware at the time of the SMI.
Failure to preserve FREEZE_IN_SMM results in the PMU unexpectedly counting events while the CPU is executing in SMM, which can pollute profiling and potentially leak information into the guest.
Check for changes in FREEZE_IN_SMM prior to every entry into KVM's inner run loop, as the bit can be toggled in IRQ context via IPI callback (SMP function call), by way of /sys/devices/cpu/freeze_on_smi.
Add a field in kvm_x86_ops to communicate which DEBUGCTL bits need to be preserved, as FREEZE_IN_SMM is only supported and defined for Intel CPUs, i.e. explicitly checking FREEZE_IN_SMM in common x86 is at best weird, and at worst could lead to undesirable behavior in the future if AMD CPUs ever happened to pick up a collision with the bit.
Exempt TDX vCPUs, i.e. protected guests, from the check, as the TDX Module owns and controls GUEST_IA32_DEBUGCTL.
WARN in SVM if KVM_RUN_LOAD_DEBUGCTL is set, mostly to document that the lack of handling isn't a KVM bug (TDX already WARNs on any run_flag).
Lastly, explicitly reload GUEST_IA32_DEBUGCTL on a VM-Fail that is missed by KVM but detected by hardware, i.e. in nested_vmx_restore_host_state(). Doing so avoids the need to track host_debugctl on a per-VMCS basis, as GUEST_IA32_DEBUGCTL is unconditionally written by prepare_vmcs02() and load_vmcs12_host_state(). For the VM-Fail case, even though KVM won't have actually entered the guest, vcpu_enter_guest() will have run with vmcs02 active and thus could result in vmcs01 being run with a stale value.
--- arch/x86/include/asm/kvm_host.h | 7 +++++++ arch/x86/kvm/vmx/nested.c | 3 +++ arch/x86/kvm/vmx/vmx.c | 5 +++++ arch/x86/kvm/vmx/vmx.h | 15 ++++++++++++++- arch/x86/kvm/x86.c | 14 ++++++++++++-- 5 files changed, 41 insertions(+), 3 deletions(-)
arch/x86/include/asm/kvm_host.h +7 -0
@@ -1553,6 +1553,7 @@ static inline u16 kvm_lapic_irq_dest_mode(bool dest_mode_logical)enum kvm_x86_run_flags {KVM_RUN_FORCE_IMMEDIATE_EXIT =BIT (0 ),KVM_RUN_LOAD_GUEST_DR6 =BIT (1 ), +KVM_RUN_LOAD_DEBUGCTL =BIT (2 ), };struct kvm_x86_ops {
@@ -1580,6 +1581,12 @@ struct kvm_x86_ops {void (*vcpu_load)(struct kvm_vcpu *vcpu,int cpu);void (*vcpu_put)(struct kvm_vcpu *vcpu); +/* +* Mask of DEBUGCTL bits that are owned by the host, i.e. that need to +* match the host's value even while the guest is active. +*/ +const u64 HOST_OWNED_DEBUGCTL ; +void (*update_exception_bitmap)(struct kvm_vcpu *vcpu);int (*get_msr)(struct kvm_vcpu *vcpu,struct msr_data *msr);int (*set_msr)(struct kvm_vcpu *vcpu,struct msr_data *msr);
arch/x86/kvm/vmx/nested.c +3 -0
@@ -4688,6 +4688,9 @@ static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu)WARN_ON (kvm_set_dr (vcpu,7 ,vmcs_readl (GUEST_DR7 ))); } +/* Reload DEBUGCTL to ensure vmcs01 has a fresh FREEZE_IN_SMM value. */ +vmx_reload_guest_debugctl (vcpu); +/* * Note that calling vmx_set_{efer,cr0,cr4} is important as they * handle a variety of side effects to KVM's software model.
arch/x86/kvm/vmx/vmx.c +5 -0
@@ -7399,6 +7399,9 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)if (run_flags &KVM_RUN_LOAD_GUEST_DR6 )set_debugreg (vcpu->arch.dr6,6 ); +if (run_flags &KVM_RUN_LOAD_DEBUGCTL ) +vmx_reload_guest_debugctl (vcpu); +/* * Refresh vmcs.HOST_CR3 if necessary. This must be done immediately * prior to VM-Enter, as the kernel may load a new ASID (PCID) any time
@@ -8326,6 +8329,8 @@ static struct kvm_x86_ops vmx_x86_ops __initdata = { .vcpu_load = vmx_vcpu_load, .vcpu_put = vmx_vcpu_put, + .HOST_OWNED_DEBUGCTL = DEBUGCTLMSR_FREEZE_IN_SMM, + .update_exception_bitmap = vmx_update_exception_bitmap, .get_msr_feature = vmx_get_msr_feature, .get_msr = vmx_get_msr,
arch/x86/kvm/vmx/vmx.h +14 -1
@@ -434,12 +434,25 @@ bool vmx_is_valid_debugctl(struct kvm_vcpu *vcpu, u64 data, bool host_initiated)static inline void vmx_guest_debugctl_write (struct kvm_vcpu *vcpu,u64 val) { +WARN_ON_ONCE (val &DEBUGCTLMSR_FREEZE_IN_SMM ); + + val |= vcpu->arch.host_debugctl &DEBUGCTLMSR_FREEZE_IN_SMM ;vmcs_write64 (GUEST_IA32_DEBUGCTL , val); }static inline u64 vmx_guest_debugctl_read (void ) { -return vmcs_read64 (GUEST_IA32_DEBUGCTL ); +return vmcs_read64 (GUEST_IA32_DEBUGCTL ) & ~DEBUGCTLMSR_FREEZE_IN_SMM ; +} + +static inline void vmx_reload_guest_debugctl (struct kvm_vcpu *vcpu) +{ +u64 val =vmcs_read64 (GUEST_IA32_DEBUGCTL ); + +if (!((val ^ vcpu->arch.host_debugctl) &DEBUGCTLMSR_FREEZE_IN_SMM )) +return ; + +vmx_guest_debugctl_write (vcpu, val & ~DEBUGCTLMSR_FREEZE_IN_SMM ); }/*
arch/x86/kvm/x86.c +12 -2
@@ -10518,7 +10518,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)dm_request_for_irq_injection (vcpu) &&kvm_cpu_accept_dm_intr (vcpu);fastpath_t exit_fastpath; -u64 run_flags; +u64 run_flags, debug_ctl;bool req_immediate_exit = false;
@@ -10777,7 +10777,17 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)set_debugreg (0 ,7 ); } - vcpu->arch.host_debugctl =get_debugctlmsr (); +/* +* Refresh the host DEBUGCTL snapshot after disabling IRQs, as DEBUGCTL +* can be modified in IRQ context, e.g. via SMP function calls. Inform +* vendor code if any host-owned bits were changed, e.g. so that the +* value loaded into hardware while running the guest can be updated. +*/ + debug_ctl =get_debugctlmsr (); +if ((debug_ctl ^ vcpu->arch.host_debugctl) & kvm_x86_ops.HOST_OWNED_DEBUGCTL && + !vcpu->arch.guest_state_protected) + run_flags |=KVM_RUN_LOAD_DEBUGCTL ; + vcpu->arch.host_debugctl = debug_ctl;guest_timing_enter_irqoff ();
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 54/587 udp: also consider secpath when evaluating ipsec use for checksumming
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 1118aaa3b35157777890fffab91d8c1da841b20b ]
Commit b40c5f4fde22 ("udp: disable inner UDP checksum offloads in IPsec case") tried to fix checksumming in UFO when the packets are going through IPsec, so that we can't rely on offloads because the UDP header and payload will be encrypted.
But when doing a TCP test over VXLAN going through IPsec transport mode with GSO enabled (esp4_offload module loaded), I'm seeing broken UDP checksums on the encap after successful decryption.
The skbs get to udp4_ufo_fragment/__skb_udp_tunnel_segment via __dev_queue_xmit -> validate_xmit_skb -> skb_gso_segment and at this point we've already dropped the dst (unless the device sets IFF_XMIT_DST_RELEASE, which is not common), so need_ipsec is false and we proceed with checksum offload.
Make need_ipsec also check the secpath, which is not dropped on this callpath.
--- net/ipv4/udp_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/udp_offload.c +1 -1
@@ -61,7 +61,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb, remcsum = !!(skb_shinfo (skb)->gso_type &SKB_GSO_TUNNEL_REMCSUM ); skb->remcsum_offload = remcsum; - need_ipsec =skb_dst (skb) &&dst_xfrm (skb_dst (skb)); + need_ipsec = (skb_dst (skb) &&dst_xfrm (skb_dst (skb))) ||skb_sec_path (skb);/* Try to offload checksum if possible */ offload_csum = !!(need_csum && !need_ipsec &&
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 55/587 netfilter: ctnetlink: fix refcount leak on table dump
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit de788b2e6227462b6dcd0e07474e72c089008f74 ]
There is a reference count leak in ctnetlink_dump_table():
if (res < 0) {
nf_conntrack_get(&ct->ct_general); // HERE
cb->args[1] = (unsigned long)ct;
...While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone.
This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0.
This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever.
This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list.
One fix would to change this to:
if (res < 0) {
if (ct != last)
nf_conntrack_get(&ct->ct_general);But this reference counting isn't needed in the first place. We can just store a cookie value instead.
A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.
--- net/netfilter/nf_conntrack_netlink.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
net/netfilter/nf_conntrack_netlink.c +13 -11
@@ -859,8 +859,6 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item)static int ctnetlink_done (struct netlink_callback *cb) { -if (cb->args[1 ]) -nf_ct_put ((struct nf_conn *)cb->args[1 ]);kfree (cb->data);return 0 ; }
@@ -1175,19 +1173,26 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data)return 0 ; } +static unsigned long ctnetlink_get_id (const struct nf_conn *ct) +{ +unsigned long id =nf_ct_get_id (ct); + +return id ? id :1 ; +} +static int ctnetlink_dump_table (struct sk_buff *skb,struct netlink_callback *cb) {unsigned int flags = cb->data ?NLM_F_DUMP_FILTERED :0 ;struct net *net =sock_net (skb->sk); -struct nf_conn *ct, *last; +unsigned long last_id = cb->args[1 ];struct nf_conntrack_tuple_hash *h;struct hlist_nulls_node *n;struct nf_conn *nf_ct_evict[8 ]; +struct nf_conn *ct;int res, i;spinlock_t *lockp; - last = (struct nf_conn *)cb->args[1 ]; i =0 ;local_bh_disable ();
@@ -1224,7 +1229,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)continue ;if (cb->args[1 ]) { -if (ct != last) +if (ctnetlink_get_id (ct) != last_id)continue ; cb->args[1 ] =0 ; }
@@ -1237,8 +1242,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)NFNL_MSG_TYPE (cb->nlh->nlmsg_type), ct, true, flags);if (res <0 ) { -nf_conntrack_get (&ct->ct_general); - cb->args[1 ] = (unsigned long )ct; + cb->args[1 ] =ctnetlink_get_id (ct);spin_unlock (lockp); goto out; }
@@ -1251,12 +1255,10 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) } out:local_bh_enable (); -if (last) { +if (last_id) {/* nf ct hash resize happened, now clear the leftover. */ -if ((struct nf_conn *)cb->args[1 ] == last) +if (cb->args[1 ] == last_id) cb->args[1 ] =0 ; - -nf_ct_put (last); }while (i) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 56/587 net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 5f1d1d14db7dabce9c815e7d7cd351f8d58b8585 ]
The variable ret in icss_iep_extts_enable() was incorrectly declared as u32, while the function returns int and may return negative error codes. This will cause sign extension issues and incorrect error propagation. Update ret to be int to fix error handling.
This change corrects the declaration to avoid potential type mismatch.
--- drivers/net/ethernet/ti/icssg/icss_iep.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/ti/icssg/icss_iep.c +2 -1
@@ -638,7 +638,8 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on)static int icss_iep_extts_enable (struct icss_iep *iep,u32 index,int on) { -u32 val, cap, ret =0 ; +u32 val, cap; +int ret =0 ;mutex_lock (&iep->ptp_clk_mutex);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 57/587 sctp: linearize cloned gso packets in sctp_rcv
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit fd60d8a086191fe33c2d719732d2482052fa6805 ]
A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs.
syzbot reported two use-of-uninitialized-memory bugs caused by this:
BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline]
and
BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline]
This patch fixes it by linearizing cloned gso packets in sctp_rcv().
--- net/sctp/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/input.c +1 -1
@@ -117,7 +117,7 @@ int sctp_rcv(struct sk_buff *skb)* it's better to just linearize it otherwise crc computing * takes longer. */ -if ((!is_gso &&skb_linearize (skb)) || +if (((!is_gso ||skb_cloned (skb)) &&skb_linearize (skb)) || !pskb_may_pull (skb,sizeof (struct sctphdr ))) goto discard_it;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 58/587 intel_idle: Allow loading ACPI tables for any family
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit e91a158b694d7f4bd937763dde79ed0afa472d8a ]
There is no reason to limit intel_idle's loading of ACPI tables to family 6. Upcoming Intel processors are not in family 6.
Below "Fixes" really means "applies cleanly until". That syntax commit didn't change the previous logic, but shows this patch applies back 5-years.
--- drivers/idle/intel_idle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/idle/intel_idle.c +1 -1
@@ -1432,7 +1432,7 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = { };static const struct x86_cpu_id intel_mwait_ids[]__initconst = { -X86_MATCH_VENDOR_FAM_FEATURE (INTEL ,6 ,X86_FEATURE_MWAIT ,NULL ), +X86_MATCH_VENDOR_FAM_FEATURE (INTEL ,X86_FAMILY_ANY ,X86_FEATURE_MWAIT ,NULL ), {} };
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 59/587 cpuidle: governors: menu: Avoid using invalid recent intervals data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit fa3fa55de0d6177fdcaf6fc254f13cc8f33c3eed ]
Marc has reported that commit 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") caused the number of wakeup interrupts to increase on an idle system [1], which was not expected to happen after merely allowing shallower idle states to be selected by the governor in some cases.
However, on the system in question, all of the idle states deeper than WFI are rejected by the driver due to a firmware issue [2]. This causes the governor to only consider the recent interval duriation data corresponding to attempts to enter WFI that are successful and the recent invervals table is filled with values lower than the scheduler tick period. Consequently, the governor predicts an idle duration below the scheduler tick period length and avoids stopping the tick more often which leads to the observed symptom.
Address it by modifying the governor to update the recent intervals table also when entering the previously selected idle state fails, so it knows that the short idle intervals might have been the minority had the selected idle states been actually entered every time.
--- drivers/cpuidle/governors/menu.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/cpuidle/governors/menu.c +17 -4
@@ -160,6 +160,14 @@ static inline int performance_multiplier(unsigned int nr_iowaiters) static DEFINE_PER_CPU(struct menu_device, menu_devices); +static void menu_update_intervals (struct menu_device *data,unsigned int interval_us) +{ +/* Update the repeating-pattern data. */ + data->intervals[data->interval_ptr++] = interval_us; +if (data->interval_ptr >=INTERVALS ) + data->interval_ptr =0 ; +} +static void menu_update (struct cpuidle_driver *drv,struct cpuidle_device *dev);/*
@@ -284,6 +292,14 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,if (data->needs_update) {menu_update (drv, dev); data->needs_update =0 ; + }else if (!dev->last_residency_ns) { +/* +* This happens when the driver rejects the previously selected +* idle state and returns an error, so update the recent +* intervals table to prevent invalid information from being +* used going forward. +*/ +menu_update_intervals (data,UINT_MAX ); } nr_iowaiters =nr_iowait_cpu (dev->cpu);
@@ -553,10 +569,7 @@ static void menu_update(struct cpuidle_driver *drv, struct cpuidle_device *dev) data->correction_factor[data->bucket] = new_factor; -/* update the repeating-pattern data */ - data->intervals[data->interval_ptr++] =ktime_to_us (measured_ns); -if (data->interval_ptr >=INTERVALS ) - data->interval_ptr =0 ; +menu_update_intervals (data,ktime_to_us (measured_ns)); }/**
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 60/587 ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit 2efe41234dbd0a83fdb7cd38226c2f70039a2cd3 ]
syzbot reported the following ABBA deadlock:
CPU0 CPU1
---- ----
n_vclocks_store()
lock(&ptp->n_vclocks_mux) [1]
(physical clock)
pc_clock_adjtime()
lock(&clk->rwsem) [2]
(physical clock)
...
ptp_clock_freerun()
ptp_vclock_in_use()
lock(&ptp->n_vclocks_mux) [3]
(physical clock)
ptp_clock_unregister()
posix_clock_unregister()
lock(&clk->rwsem) [4]
(virtual clock)Since ptp virtual clock is registered only under ptp physical clock, both ptp_clock and posix_clock must be physical clocks for ptp_vclock_in_use() to lock &ptp->n_vclocks_mux and check ptp->n_vclocks.
However, when unregistering vclocks in n_vclocks_store(), the locking ptp->n_vclocks_mux is a physical clock lock, but clk->rwsem of ptp_clock_unregister() called through device_for_each_child_reverse() is a virtual clock lock.
Therefore, clk->rwsem used in CPU0 and clk->rwsem used in CPU1 are different locks, but in lockdep, a false positive occurs because the possibility of deadlock is determined through lock-class.
To solve this, lock subclass annotation must be added to the posix_clock rwsem of the vclock.
--- drivers/ptp/ptp_private.h | 5 +++++ drivers/ptp/ptp_vclock.c | 7 +++++++ 2 files changed, 12 insertions(+)
drivers/ptp/ptp_private.h +5 -0
@@ -20,6 +20,11 @@#define PTP_BUF_TIMESTAMPS 30#define PTP_DEFAULT_MAX_VCLOCKS 20 +enum { +PTP_LOCK_PHYSICAL =0 , +PTP_LOCK_VIRTUAL , +}; +struct timestamp_event_queue {struct ptp_extts_event buf[PTP_MAX_TIMESTAMPS ];int head;
drivers/ptp/ptp_vclock.c +7 -0
@@ -154,6 +154,11 @@ static long ptp_vclock_refresh(struct ptp_clock_info *ptp)return PTP_VCLOCK_REFRESH_INTERVAL ; } +static void ptp_vclock_set_subclass (struct ptp_clock *ptp) +{ +lockdep_set_subclass (&ptp->clock.rwsem,PTP_LOCK_VIRTUAL ); +} +static const struct ptp_clock_info ptp_vclock_info = { .owner =THIS_MODULE , .name ="ptp virtual clock" ,
@@ -213,6 +218,8 @@ struct ptp_vclock *ptp_vclock_register(struct ptp_clock *pclock)return NULL ; } +ptp_vclock_set_subclass (vclock->clock); +timecounter_init (&vclock->tc, &vclock->cc,0 );ptp_schedule_worker (vclock->clock,PTP_VCLOCK_REFRESH_INTERVAL );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 61/587 tls: handle data disappearing from under the TLS ULP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 6db015fc4b5d5f63a64a193f65d98da3a7fc811d ]
TLS expects that it owns the receive queue of the TCP socket. This cannot be guaranteed in case the reader of the TCP socket entered before the TLS ULP was installed, or uses some non-standard read API (eg. zerocopy ones). Replace the WARN_ON() and a buggy early exit (which leaves anchor pointing to a freed skb) with real error handling. Wipe the parsing state and tell the reader to retry.
We already reload the anchor every time we (re)acquire the socket lock, so the only condition we need to avoid is an out of bounds read (not having enough bytes in the socket for previously parsed record len).
If some data was read from under TLS but there's enough in the queue we'll reload and decrypt what is most likely not a valid TLS record. Leading to some undefined behavior from TLS perspective (corrupting a stream? missing an alert? missing an attack?) but no kernel crash should take place.
--- net/tls/tls.h | 2 +- net/tls/tls_strp.c | 11 ++++++++--- net/tls/tls_sw.c | 3 ++- 3 files changed, 11 insertions(+), 5 deletions(-)
net/tls/tls.h +1 -1
@@ -192,7 +192,7 @@ void tls_strp_msg_done(struct tls_strparser *strp);int tls_rx_msg_size (struct tls_strparser *strp,struct sk_buff *skb);void tls_rx_msg_ready (struct tls_strparser *strp); -void tls_strp_msg_load (struct tls_strparser *strp,bool force_refresh); +bool tls_strp_msg_load (struct tls_strparser *strp,bool force_refresh);int tls_strp_msg_cow (struct tls_sw_context_rx *ctx);struct sk_buff *tls_strp_msg_detach (struct tls_sw_context_rx *ctx);int tls_strp_msg_hold (struct tls_strparser *strp,struct sk_buff_head *dst);
net/tls/tls_strp.c +8 -3
@@ -474,7 +474,7 @@ static void tls_strp_load_anchor_with_queue(struct tls_strparser *strp, int len) strp->stm.offset = offset; } -void tls_strp_msg_load (struct tls_strparser *strp,bool force_refresh) +bool tls_strp_msg_load (struct tls_strparser *strp,bool force_refresh) {struct strp_msg *rxm;struct tls_msg *tlm;
@@ -483,8 +483,11 @@ void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh)DEBUG_NET_WARN_ON_ONCE (!strp->stm.full_len);if (!strp->copy_mode && force_refresh) { -if (WARN_ON (tcp_inq (strp->sk) < strp->stm.full_len)) -return ; +if (unlikely (tcp_inq (strp->sk) < strp->stm.full_len)) { +WRITE_ONCE (strp->msg_ready,0 ); +memset (&strp->stm,0 ,sizeof (strp->stm)); +return false; + }tls_strp_load_anchor_with_queue (strp, strp->stm.full_len); }
@@ -494,6 +497,8 @@ void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh) rxm->offset = strp->stm.offset; tlm =tls_msg (strp->anchor); tlm->control = strp->mark; + +return true; }/* Called with lock held on lower socket */
net/tls/tls_sw.c +2 -1
@@ -1380,7 +1380,8 @@ tls_rx_rec_wait(struct sock *sk, struct sk_psock *psock, bool nonblock,return sock_intr_errno (timeo); } -tls_strp_msg_load (&ctx->strp, released); +if (unlikely (!tls_strp_msg_load (&ctx->strp, released))) +return tls_rx_rec_wait (sk, psock, nonblock, false);return 1 ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 62/587 hfs: fix general protection fault in hfs_find_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 736a0516a16268995f4898eded49bfef077af709 ]
The hfs_find_init() method can trigger the crash
if tree pointer is NULL:
[ 45.746290][ T9787] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KAI [ 45.747287][ T9787] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 45.748716][ T9787] CPU: 2 UID: 0 PID: 9787 Comm: repro Not tainted 6.16.0-rc3 #10 PREEMPT(full) [ 45.750250][ T9787] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 45.751983][ T9787] RIP: 0010:hfs_find_init+0x86/0x230 [ 45.752834][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc [ 45.755574][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202 [ 45.756432][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09 [ 45.757457][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8 [ 45.758282][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000 [ 45.758943][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004 [ 45.759619][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000 [ 45.760293][ T9787] FS: 00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000 [ 45.761050][ T9787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.761606][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0 [ 45.762286][ T9787] Call Trace: [ 45.762570][ T9787] <TASK> [ 45.762824][ T9787] hfs_ext_read_extent+0x190/0x9d0 [ 45.763269][ T9787] ? submit_bio_noacct_nocheck+0x2dd/0xce0 [ 45.763766][ T9787] ? __pfx_hfs_ext_read_extent+0x10/0x10 [ 45.764250][ T9787] hfs_get_block+0x55f/0x830 [ 45.764646][ T9787] block_read_full_folio+0x36d/0x850 [ 45.765105][ T9787] ? __pfx_hfs_get_block+0x10/0x10 [ 45.765541][ T9787] ? const_folio_flags+0x5b/0x100 [ 45.765972][ T9787] ? __pfx_hfs_read_folio+0x10/0x10 [ 45.766415][ T9787] filemap_read_folio+0xbe/0x290 [ 45.766840][ T9787] ? __pfx_filemap_read_folio+0x10/0x10 [ 45.767325][ T9787] ? __filemap_get_folio+0x32b/0xbf0 [ 45.767780][ T9787] do_read_cache_folio+0x263/0x5c0 [ 45.768223][ T9787] ? __pfx_hfs_read_folio+0x10/0x10 [ 45.768666][ T9787] read_cache_page+0x5b/0x160 [ 45.769070][ T9787] hfs_btree_open+0x491/0x1740 [ 45.769481][ T9787] hfs_mdb_get+0x15e2/0x1fb0 [ 45.769877][ T9787] ? __pfx_hfs_mdb_get+0x10/0x10 [ 45.770316][ T9787] ? find_held_lock+0x2b/0x80 [ 45.770731][ T9787] ? lockdep_init_map_type+0x5c/0x280 [ 45.771200][ T9787] ? lockdep_init_map_type+0x5c/0x280 [ 45.771674][ T9787] hfs_fill_super+0x38e/0x720 [ 45.772092][ T9787] ? __pfx_hfs_fill_super+0x10/0x10 [ 45.772549][ T9787] ? snprintf+0xbe/0x100 [ 45.772931][ T9787] ? __pfx_snprintf+0x10/0x10 [ 45.773350][ T9787] ? do_raw_spin_lock+0x129/0x2b0 [ 45.773796][ T9787] ? find_held_lock+0x2b/0x80 [ 45.774215][ T9787] ? set_blocksize+0x40a/0x510 [ 45.774636][ T9787] ? sb_set_blocksize+0x176/0x1d0 [ 45.775087][ T9787] ? setup_bdev_super+0x369/0x730 [ 45.775533][ T9787] get_tree_bdev_flags+0x384/0x620 [ 45.775985][ T9787] ? __pfx_hfs_fill_super+0x10/0x10 [ 45.776453][ T9787] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 45.776950][ T9787] ? bpf_lsm_capable+0x9/0x10 [ 45.777365][ T9787] ? security_capable+0x80/0x260 [ 45.777803][ T9787] vfs_get_tree+0x8e/0x340 [ 45.778203][ T9787] path_mount+0x13de/0x2010 [ 45.778604][ T9787] ? kmem_cache_free+0x2b0/0x4c0 [ 45.779052][ T9787] ? __pfx_path_mount+0x10/0x10 [ 45.779480][ T9787] ? getname_flags.part.0+0x1c5/0x550 [ 45.779954][ T9787] ? putname+0x154/0x1a0 [ 45.780335][ T9787] __x64_sys_mount+0x27b/0x300 [ 45.780758][ T9787] ? __pfx___x64_sys_mount+0x10/0x10 [ 45.781232][ T9787] do_syscall_64+0xc9/0x480 [ 45.781631][ T9787] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.782149][ T9787] RIP: 0033:0x7ffb7265b6ca [ 45.782539][ T9787] Code: 48 8b 0d c9 17 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 [ 45.784212][ T9787] RSP: 002b:00007ffc0c10cfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 45.784935][ T9787] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffb7265b6ca [ 45.785626][ T9787] RDX: 0000200000000240 RSI: 0000200000000280 RDI: 00007ffc0c10d100 [ 45.786316][ T9787] RBP: 00007ffc0c10d190 R08: 00007ffc0c10d000 R09: 0000000000000000 [ 45.787011][ T9787] R10: 0000000000000048 R11: 0000000000000206 R12: 0000560246733250 [ 45.787697][ T9787] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 45.788393][ T9787] </TASK> [ 45.788665][ T9787] Modules linked in: [ 45.789058][ T9787] ---[ end trace 0000000000000000 ]--- [ 45.789554][ T9787] RIP: 0010:hfs_find_init+0x86/0x230 [ 45.790028][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc [ 45.792364][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202 [ 45.793155][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09 [ 45.794123][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8 [ 45.795105][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000 [ 45.796135][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004 [ 45.797114][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000 [ 45.798024][ T9787] FS: 00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000 [ 45.799019][ T9787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.799822][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0 [ 45.800747][ T9787] Kernel panic - not syncing: Fatal exception
The hfs_fill_super() calls hfs_mdb_get() method that tries to construct Extents Tree and Catalog Tree:
HFS_SB(sb)->ext_tree = hfs_btree_open(sb, HFS_EXT_CNID, hfs_ext_keycmp);
if (!HFS_SB(sb)->ext_tree) {
pr_err("unable to open extent tree\n");
goto out;
}
HFS_SB(sb)->cat_tree = hfs_btree_open(sb, HFS_CAT_CNID, hfs_cat_keycmp);
if (!HFS_SB(sb)->cat_tree) {
pr_err("unable to open catalog tree\n");
goto out;
}However, hfs_btree_open() calls read_mapping_page() that calls hfs_get_block(). And this method calls hfs_ext_read_extent():
static int hfs_ext_read_extent(struct inode *inode, u16 block)
{
struct hfs_find_data fd;
int res;
if (block >= HFS_I(inode)->cached_start &&
block < HFS_I(inode)->cached_start + HFS_I(inode)->cached_blocks)
return 0;
res = hfs_find_init(HFS_SB(inode->i_sb)->ext_tree, &fd);
if (!res) {
res = __hfs_ext_cache_extent(&fd, inode, block);
hfs_find_exit(&fd);
}
return res;
}The problem here that hfs_find_init() is trying to use HFS_SB(inode->i_sb)->ext_tree that is not initialized yet. It will be initailized when hfs_btree_open() finishes the execution.
The patch adds checking of tree pointer in hfs_find_init() and it reworks the logic of hfs_btree_open() by reading the b-tree's header directly from the volume. The read_mapping_page() is exchanged on filemap_grab_folio() that grab the folio from mapping. Then, sb_bread() extracts the b-tree's header content and copy it into the folio.
--- fs/hfs/bfind.c | 3 +++ fs/hfs/btree.c | 57 +++++++++++++++++++++++++++++++++++++++---------- fs/hfs/extent.c | 2 +- fs/hfs/hfs_fs.h | 1 + 4 files changed, 51 insertions(+), 12 deletions(-)
fs/hfs/bfind.c +3 -0
@@ -16,6 +16,9 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) {void *ptr; +if (!tree || !fd) +return -EINVAL ; + fd->tree = tree; fd->bnode =NULL ; ptr =kmalloc (tree->max_key_len *2 +4 ,GFP_KERNEL );
fs/hfs/btree.c +46 -11
100 lines not on this page · raw message
fs/hfs/extent.c +1 -1
@@ -71,7 +71,7 @@ int hfs_ext_keycmp(const btree_key *key1, const btree_key *key2)* * Find a block within an extent record */ -static u16 hfs_ext_find_block (struct hfs_extent *ext,u16 off) +u16 hfs_ext_find_block (struct hfs_extent *ext,u16 off) {int i;u16 count;
fs/hfs/hfs_fs.h +1 -0
@@ -190,6 +190,7 @@ extern const struct inode_operations hfs_dir_inode_operations;/* extent.c */ extern int hfs_ext_keycmp (const btree_key *,const btree_key *); +extern u16 hfs_ext_find_block (struct hfs_extent *ext,u16 off);extern int hfs_free_fork (struct super_block *,struct hfs_cat_file *,int );extern int hfs_ext_write_extent (struct inode *);extern int hfs_extend_file (struct inode *);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/587 hfs: fix slab-out-of-bounds in hfs_bnode_read()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit a431930c9bac518bf99d6b1da526a7f37ddee8d8 ]
This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.
--- fs/hfs/bnode.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+)
fs/hfs/bnode.c +92 -0
@@ -15,6 +15,48 @@#include "btree.h" +static inline +bool is_bnode_offset_valid (struct hfs_bnode *node,int off) +{ +bool is_valid = off < node->tree->node_size; + +if (!is_valid) { +pr_err ("requested invalid offset: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off); + } + +return is_valid; +} + +static inline +int check_and_correct_requested_length (struct hfs_bnode *node,int off,int len) +{ +unsigned int node_size; + +if (!is_bnode_offset_valid (node, off)) +return 0 ; + + node_size = node->tree->node_size; + +if ((off + len) > node_size) { +int new_len = (int )node_size - off; + +pr_err ("requested length has been corrected: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, " +"requested_len %d, corrected_len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len, new_len); + +return new_len; + } + +return len; +} +void hfs_bnode_read (struct hfs_bnode *node,void *buf,int off,int len) {struct page *page;
@@ -22,6 +64,20 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)int bytes_read;int bytes_to_read; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagenum = off >>PAGE_SHIFT ; off &= ~PAGE_MASK ;/* compute page offset for the first page */
@@ -80,6 +136,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len) {struct page *page; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; page = node->page[0 ];
@@ -104,6 +174,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len) {struct page *page; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; page = node->page[0 ];
@@ -119,6 +203,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,hfs_dbg (BNODE_MOD ,"copybytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (src_node, src, len); + len =check_and_correct_requested_length (dst_node, dst, len); + src += src_node->page_offset; dst += dst_node->page_offset; src_page = src_node->page[0 ];
@@ -136,6 +224,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)hfs_dbg (BNODE_MOD ,"movebytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (node, src, len); + len =check_and_correct_requested_length (node, dst, len); + src += node->page_offset; dst += node->page_offset; page = node->page[0 ];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/587 hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2 ]
The hfsplus_bnode_read() method can trigger the issue:
[ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] <TASK> [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] </TASK> [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x320 [ 174.883144][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.883595][ T9784] hfsplus_rmdir+0x106/0x1b0 [ 174.884004][ T9784] vfs_rmdir+0x206/0x690 [ 174.884379][ T9784] do_rmdir+0x2b7/0x390 [ 174.884751][ T9784] __x64_sys_rmdir+0xc5/0x110 [ 174.885167][ T9784] do_syscall_64+0xc9/0x480 [ 174.885568][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.886083][ T9784] [ 174.886293][ T9784] The buggy address belongs to the object at ffff88810b5fc600 [ 174.886293][ T9784] which belongs to the cache kmalloc-192 of size 192 [ 174.887507][ T9784] The buggy address is located 40 bytes to the right of [ 174.887507][ T9784] allocated 152-byte region [ffff88810b5fc600, ffff88810b5fc698) [ 174.888766][ T9784] [ 174.888976][ T9784] The buggy address belongs to the physical page: [ 174.889533][ T9784] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b5fc [ 174.890295][ T9784] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 174.890927][ T9784] page_type: f5(slab) [ 174.891284][ T9784] raw: 057ff00000000000 ffff88801b4423c0 ffffea000426dc80 dead000000000002 [ 174.892032][ T9784] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 174.892774][ T9784] page dumped because: kasan: bad access detected [ 174.893327][ T9784] page_owner tracks the page as allocated [ 174.893825][ T9784] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c00(GFP_NOIO|__GFP_NOWARN|__GFP_NO1 [ 174.895373][ T9784] post_alloc_hook+0x1c0/0x230 [ 174.895801][ T9784] get_page_from_freelist+0xdeb/0x3b30 [ 174.896284][ T9784] __alloc_frozen_pages_noprof+0x25c/0x2460 [ 174.896810][ T9784] alloc_pages_mpol+0x1fb/0x550 [ 174.897242][ T9784] new_slab+0x23b/0x340 [ 174.897614][ T9784] ___slab_alloc+0xd81/0x1960 [ 174.898028][ T9784] __slab_alloc.isra.0+0x56/0xb0 [ 174.898468][ T9784] __kmalloc_noprof+0x2b0/0x550 [ 174.898896][ T9784] usb_alloc_urb+0x73/0xa0 [ 174.899289][ T9784] usb_control_msg+0x1cb/0x4a0 [ 174.899718][ T9784] usb_get_string+0xab/0x1a0 [ 174.900133][ T9784] usb_string_sub+0x107/0x3c0 [ 174.900549][ T9784] usb_string+0x307/0x670 [ 174.900933][ T9784] usb_cache_string+0x80/0x150 [ 174.901355][ T9784] usb_new_device+0x1d0/0x19d0 [ 174.901786][ T9784] register_root_hub+0x299/0x730 [ 174.902231][ T9784] page last free pid 10 tgid 10 stack trace: [ 174.902757][ T9784] __free_frozen_pages+0x80c/0x1250 [ 174.903217][ T9784] vfree.part.0+0x12b/0xab0 [ 174.903645][ T9784] delayed_vfree_work+0x93/0xd0 [ 174.904073][ T9784] process_one_work+0x9b5/0x1b80 [ 174.904519][ T9784] worker_thread+0x630/0xe60 [ 174.904927][ T9784] kthread+0x3a8/0x770 [ 174.905291][ T9784] ret_from_fork+0x517/0x6e0 [ 174.905709][ T9784] ret_from_fork_asm+0x1a/0x30 [ 174.906128][ T9784] [ 174.906338][ T9784] Memory state around the buggy address: [ 174.906828][ T9784] ffff88810b5fc580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.907528][ T9784] ffff88810b5fc600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 174.908222][ T9784] >ffff88810b5fc680: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 174.908917][ T9784] ^ [ 174.909481][ T9784] ffff88810b5fc700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 174.910432][ T9784] ffff88810b5fc780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.911401][ T9784] ==================================================================
The reason of the issue that code doesn't check the correctness of the requested offset and length. As a result, incorrect value of offset or/and length could result in access out of allocated memory.
This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfsplus_bnode_read(), hfsplus_bnode_write(), hfsplus_bnode_clear(), hfsplus_bnode_copy(), and hfsplus_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.
--- fs/hfsplus/bnode.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+)
fs/hfsplus/bnode.c +92 -0
@@ -18,12 +18,68 @@#include "hfsplus_fs.h" #include "hfsplus_raw.h" +static inline +bool is_bnode_offset_valid (struct hfs_bnode *node,int off) +{ +bool is_valid = off < node->tree->node_size; + +if (!is_valid) { +pr_err ("requested invalid offset: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off); + } + +return is_valid; +} + +static inline +int check_and_correct_requested_length (struct hfs_bnode *node,int off,int len) +{ +unsigned int node_size; + +if (!is_bnode_offset_valid (node, off)) +return 0 ; + + node_size = node->tree->node_size; + +if ((off + len) > node_size) { +int new_len = (int )node_size - off; + +pr_err ("requested length has been corrected: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, " +"requested_len %d, corrected_len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len, new_len); + +return new_len; + } + +return len; +} +/* Copy a specified range of bytes from the raw data of a node */ void hfs_bnode_read (struct hfs_bnode *node,void *buf,int off,int len) {struct page **pagep;int l; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); off &= ~PAGE_MASK ;
@@ -81,6 +137,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)struct page **pagep;int l; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); off &= ~PAGE_MASK ;
@@ -109,6 +179,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len)struct page **pagep;int l; +if (!is_bnode_offset_valid (node, off)) +return ; + +if (len ==0 ) { +pr_err ("requested zero length: " +"NODE: id %u, type %#x, height %u, " +"node_size %u, offset %d, len %d\n" , + node->this, node->type, node->height, + node->tree->node_size, off, len); +return ; + } + + len =check_and_correct_requested_length (node, off, len); + off += node->page_offset; pagep = node->page + (off >>PAGE_SHIFT ); off &= ~PAGE_MASK ;
@@ -133,6 +217,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,hfs_dbg (BNODE_MOD ,"copybytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (src_node, src, len); + len =check_and_correct_requested_length (dst_node, dst, len); + src += src_node->page_offset; dst += dst_node->page_offset; src_page = src_node->page + (src >>PAGE_SHIFT );
@@ -187,6 +275,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)hfs_dbg (BNODE_MOD ,"movebytes: %u,%u,%u\n" , dst, src, len);if (!len)return ; + + len =check_and_correct_requested_length (node, src, len); + len =check_and_correct_requested_length (node, dst, len); + src += node->page_offset; dst += node->page_offset;if (dst > src) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/587 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 94458781aee6045bd3d0ad4b80b02886b9e2219b ]
The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc():
[ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] <TASK> [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.152580][ T9805] [ 667.152798][ T9805] The buggy address belongs to the physical page: [ 667.153373][ T9805] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25928 [ 667.154157][ T9805] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 667.154916][ T9805] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 667.155631][ T9805] page_type: f5(slab) [ 667.155997][ T9805] raw: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001 [ 667.156770][ T9805] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 667.157536][ T9805] head: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001 [ 667.158317][ T9805] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 667.159088][ T9805] head: 00fff00000000003 ffffea0000964a01 00000000ffffffff 00000000ffffffff [ 667.159865][ T9805] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 667.160643][ T9805] page dumped because: kasan: bad access detected [ 667.161216][ T9805] page_owner tracks the page as allocated [ 667.161732][ T9805] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN9 [ 667.163566][ T9805] post_alloc_hook+0x1c0/0x230 [ 667.164003][ T9805] get_page_from_freelist+0xdeb/0x3b30 [ 667.164503][ T9805] __alloc_frozen_pages_noprof+0x25c/0x2460 [ 667.165040][ T9805] alloc_pages_mpol+0x1fb/0x550 [ 667.165489][ T9805] new_slab+0x23b/0x340 [ 667.165872][ T9805] ___slab_alloc+0xd81/0x1960 [ 667.166313][ T9805] __slab_alloc.isra.0+0x56/0xb0 [ 667.166767][ T9805] __kmalloc_cache_noprof+0x255/0x3e0 [ 667.167255][ T9805] psi_cgroup_alloc+0x52/0x2d0 [ 667.167693][ T9805] cgroup_mkdir+0x694/0x1210 [ 667.168118][ T9805] kernfs_iop_mkdir+0x111/0x190 [ 667.168568][ T9805] vfs_mkdir+0x59b/0x8d0 [ 667.168956][ T9805] do_mkdirat+0x2ed/0x3d0 [ 667.169353][ T9805] __x64_sys_mkdir+0xef/0x140 [ 667.169784][ T9805] do_syscall_64+0xc9/0x480 [ 667.170195][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.170730][ T9805] page last free pid 1257 tgid 1257 stack trace: [ 667.171304][ T9805] __free_frozen_pages+0x80c/0x1250 [ 667.171770][ T9805] vfree.part.0+0x12b/0xab0 [ 667.172182][ T9805] delayed_vfree_work+0x93/0xd0 [ 667.172612][ T9805] process_one_work+0x9b5/0x1b80 [ 667.173067][ T9805] worker_thread+0x630/0xe60 [ 667.173486][ T9805] kthread+0x3a8/0x770 [ 667.173857][ T9805] ret_from_fork+0x517/0x6e0 [ 667.174278][ T9805] ret_from_fork_asm+0x1a/0x30 [ 667.174703][ T9805] [ 667.174917][ T9805] Memory state around the buggy address: [ 667.175411][ T9805] ffff88802592f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 667.176114][ T9805] ffff88802592f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 667.176830][ T9805] >ffff88802592f400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.177547][ T9805] ^ [ 667.177933][ T9805] ffff88802592f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.178640][ T9805] ffff88802592f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.179350][ T9805] ==================================================================
The hfsplus_uni2asc() method operates by struct hfsplus_unistr:
struct hfsplus_unistr {
__be16 length;
hfsplus_unichr unicode[HFSPLUS_MAX_STRLEN];
} __packed;where HFSPLUS_MAX_STRLEN is 255 bytes. The issue happens if length of the structure instance has value bigger than 255 (for example, 65283). In such case, pointer on unicode buffer is going beyond of the allocated memory.
The patch fixes the issue by checking the length value of hfsplus_unistr instance and using 255 value in the case if length value is bigger than HFSPLUS_MAX_STRLEN. Potential reason of such situation could be a corruption of Catalog File b-tree's node.
--- fs/hfsplus/unicode.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/hfsplus/unicode.c +7 -0
@@ -132,7 +132,14 @@ int hfsplus_uni2asc(struct super_block *sb, op = astr; ip = ustr->unicode; + ustrlen =be16_to_cpu (ustr->length); +if (ustrlen >HFSPLUS_MAX_STRLEN ) { + ustrlen =HFSPLUS_MAX_STRLEN ; +pr_err ("invalid length %u has been corrected to %d\n" , +be16_to_cpu (ustr->length), ustrlen); + } + len = *len_p; ce1 =NULL ; compose = !test_bit (HFSPLUS_SB_NODECOMPOSE , &HFSPLUS_SB (sb)->flags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/587 hfsplus: dont use BUG_ON() in hfsplus_create_attributes_file()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit c7c6363ca186747ebc2df10c8a1a51e66e0e32d9 ]
When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.
--- fs/hfsplus/xattr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/hfsplus/xattr.c +5 -1
@@ -172,7 +172,11 @@ static int hfsplus_create_attributes_file(struct super_block *sb)return PTR_ERR (attr_file); } -BUG_ON (i_size_read (attr_file) !=0 ); +if (i_size_read (attr_file) !=0 ) { + err = -EIO ; +pr_err ("detected inconsistent attributes file, running fsck.hfsplus is recommended.\n" ); + goto end_attr_file_creation; + } hip =HFSPLUS_I (attr_file);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/587 arm64: Handle KCOV __init vs inline mismatches
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 65c430906efffee9bd7551d474f01a6b1197df90 ]
GCC appears to have kind of fragile inlining heuristics, in the sense that it can change whether or not it inlines something based on optimizations. It looks like the kcov instrumentation being added (or in this case, removed) from a function changes the optimization results, and some functions marked "inline" are _not_ inlined. In that case, we end up with __init code calling a function not marked __init, and we get the build warnings I'm trying to eliminate in the coming patch that adds __no_sanitize_coverage to __init functions:
WARNING: modpost: vmlinux: section mismatch in reference: acpi_get_enable_method+0x1c (section: .text.unlikely) -> acpi_psci_present (section: .init.text)
This problem is somewhat fragile (though using either __always_inline or __init will deterministically solve it), but we've tripped over this before with GCC and the solution has usually been to just use __always_inline and move on.
For arm64 this requires forcing one ACPI function to be inlined with __always_inline.
--- arch/arm64/include/asm/acpi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/acpi.h +1 -1
@@ -150,7 +150,7 @@ acpi_set_mailbox_entry(int cpu, struct acpi_madt_generic_interrupt *processor) {}#endif -static inline const char *acpi_get_enable_method (int cpu) +static __always_inline const char *acpi_get_enable_method(int cpu) {if (acpi_psci_present ())return "psci" ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/587 smb/server: avoid deadlock when linking with ReplaceIfExists
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694 ]
If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen.
ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock.
This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.
--- fs/smb/server/smb2pdu.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
fs/smb/server/smb2pdu.c +4 -12
@@ -6011,7 +6011,6 @@ static int smb2_create_link(struct ksmbd_work *work, { char *link_name = NULL, *target_name = NULL, *pathname = NULL; struct path path, parent_path; - bool file_present = false; int rc; if (buf_len < (u64)sizeof(struct smb2_file_link_info) +
@@ -6044,11 +6043,8 @@ static int smb2_create_link(struct ksmbd_work *work,if (rc) {if (rc != -ENOENT ) goto out; - }else - file_present = true; - -if (file_info->ReplaceIfExists) { -if (file_present) { + }else { +if (file_info->ReplaceIfExists) { rc =ksmbd_vfs_remove_file (work, &path);if (rc) { rc = -EINVAL ;
@@ -6056,21 +6052,17 @@ static int smb2_create_link(struct ksmbd_work *work, link_name); goto out; } - } - }else { -if (file_present) { + }else { rc = -EEXIST ;ksmbd_debug (SMB ,"link already exists\n" ); goto out; } +ksmbd_vfs_kern_path_unlock (&parent_path, &path); } - rc =ksmbd_vfs_link (work, target_name, link_name);if (rc) rc = -EINVAL ; out: -if (file_present) -ksmbd_vfs_kern_path_unlock (&parent_path, &path);if (!IS_ERR (link_name))kfree (link_name);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/587 nvme-pci: try function level reset on init failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 5b2c214a95942f7997d1916a4c44017becbc3cac ]
NVMe devices from multiple vendors appear to get stuck in a reset state that we can't get out of with an NVMe level Controller Reset. The kernel would report these with messages that look like:
Device not ready; aborting reset, CSTS=0x1
These have historically required a power cycle to make them usable again, but in many cases, a PCIe FLR is sufficient to restart operation without a power cycle. Try it if the initial controller reset fails during any nvme reset attempt.
--- drivers/nvme/host/pci.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
drivers/nvme/host/pci.c +22 -2
@@ -1755,8 +1755,28 @@ static int nvme_pci_configure_admin_queue(struct nvme_dev *dev)* might be pointing at! */ result =nvme_disable_ctrl (&dev->ctrl, false); -if (result <0 ) -return result; +if (result <0 ) { +struct pci_dev *pdev =to_pci_dev (dev->dev); + +/* +* The NVMe Controller Reset method did not get an expected +* CSTS.RDY transition, so something with the device appears to +* be stuck. Use the lower level and bigger hammer PCIe +* Function Level Reset to attempt restoring the device to its +* initial state, and try again. +*/ + result =pcie_reset_flr (pdev, false); +if (result <0 ) +return result; + +pci_restore_state (pdev); + result =nvme_disable_ctrl (&dev->ctrl, false); +if (result <0 ) +return result; + +dev_info (dev->ctrl.device, +"controller reset completed after pcie flr\n" ); + } result =nvme_alloc_queue (dev,0 ,NVME_AQ_DEPTH );if (result)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/587 gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Price <[email protected]>
[ Upstream commit 5c8f12cf1e64e0e8e6cb80b0c935389973e8be8d ]
Clears up the warning added in 7ee3647243e5 ("migrate: Remove call to ->writepage") that occurs in various xfstests, causing "something found in dmesg" failures.
[ 341.136573] gfs2_meta_aops does not implement migrate_folio [ 341.136953] WARNING: CPU: 1 PID: 36 at mm/migrate.c:944 move_to_new_folio+0x2f8/0x300
--- fs/gfs2/meta_io.c | 2 ++ 1 file changed, 2 insertions(+)
fs/gfs2/meta_io.c +2 -0
@@ -93,6 +93,7 @@ const struct address_space_operations gfs2_meta_aops = { .invalidate_folio = block_invalidate_folio, .writepage = gfs2_aspace_writepage, .release_folio = gfs2_release_folio, + .migrate_folio = buffer_migrate_folio_norefs, };const struct address_space_operations gfs2_rgrp_aops = {
@@ -100,6 +101,7 @@ const struct address_space_operations gfs2_rgrp_aops = { .invalidate_folio = block_invalidate_folio, .writepage = gfs2_aspace_writepage, .release_folio = gfs2_release_folio, + .migrate_folio = buffer_migrate_folio_norefs, };/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/587 loop: Avoid updating block size under exclusive owner
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 7e49538288e523427beedd26993d446afef1a6fb ]
Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size.
Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it.
--- drivers/block/loop.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-)
drivers/block/loop.c +30 -8
@@ -1472,19 +1472,36 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg)return error; } -static int loop_set_block_size (struct loop_device *lo,unsigned long arg) +static int loop_set_block_size (struct loop_device *lo,blk_mode_t mode, +struct block_device *bdev,unsigned long arg) {int err =0 ; -if (lo->lo_state != Lo_bound) -return -ENXIO ; +/* +* If we don't hold exclusive handle for the device, upgrade to it +* here to avoid changing device under exclusive owner. +*/ +if (!(mode &BLK_OPEN_EXCL )) { + err =bd_prepare_to_claim (bdev, loop_set_block_size,NULL ); +if (err) +return err; + } + + err =mutex_lock_killable (&lo->lo_mutex); +if (err) + goto abort_claim; + +if (lo->lo_state != Lo_bound) { + err = -ENXIO ; + goto unlock; + } err =blk_validate_block_size (arg);if (err)return err;if (lo->lo_queue->limits.logical_block_size == arg) -return 0 ; + goto unlock;sync_blockdev (lo->lo_device);invalidate_bdev (lo->lo_device);
@@ -1496,6 +1513,11 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg)loop_update_dio (lo);blk_mq_unfreeze_queue (lo->lo_queue); +unlock: +mutex_unlock (&lo->lo_mutex); +abort_claim: +if (!(mode &BLK_OPEN_EXCL )) +bd_abort_claiming (bdev, loop_set_block_size);return err; }
@@ -1514,9 +1536,6 @@ static int lo_simple_ioctl(struct loop_device *lo, unsigned int cmd,case LOOP_SET_DIRECT_IO : err =loop_set_dio (lo, arg);break ; -case LOOP_SET_BLOCK_SIZE : - err =loop_set_block_size (lo, arg); -break ;default : err = -EINVAL ; }
@@ -1571,9 +1590,12 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode,break ;case LOOP_GET_STATUS64 :return loop_get_status64 (lo, argp); +case LOOP_SET_BLOCK_SIZE : +if (!(mode &BLK_OPEN_WRITE ) && !capable (CAP_SYS_ADMIN )) +return -EPERM ; +return loop_set_block_size (lo, mode, bdev, arg);case LOOP_SET_CAPACITY :case LOOP_SET_DIRECT_IO : -case LOOP_SET_BLOCK_SIZE :if (!(mode &BLK_OPEN_WRITE ) && !capable (CAP_SYS_ADMIN ))return -EPERM ; fallthrough;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/587 udf: Verify partition map count
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 1a11201668e8635602577dcf06f2e96c591d8819 ]
Verify that number of partition maps isn't insanely high which can lead to large allocation in udf_sb_alloc_partition_maps(). All partition maps have to fit in the LVD which is in a single block.
--- fs/udf/super.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/udf/super.c +11 -2
@@ -1409,7 +1409,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,struct genericPartitionMap *gpm;uint16_t ident;struct buffer_head *bh; -unsigned int table_len; +unsigned int table_len, part_map_count;int ret; bh =udf_read_tagged (sb, block, block, &ident);
@@ -1430,7 +1430,16 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, "logical volume");if (ret) goto out_bh; - ret =udf_sb_alloc_partition_maps (sb,le32_to_cpu (lvd->numPartitionMaps)); + + part_map_count =le32_to_cpu (lvd->numPartitionMaps); +if (part_map_count > table_len /sizeof (struct genericPartitionMap1 )) { +udf_err (sb,"error loading logical volume descriptor: " +"Too many partition maps (%u > %u)\n" , part_map_count, + table_len / (unsigned )sizeof (struct genericPartitionMap1 )); + ret = -EIO ; + goto out_bh; + } + ret =udf_sb_alloc_partition_maps (sb, part_map_count);if (ret) goto out_bh;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/587 drbd: add missing kref_get in handle_write_conflicts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Newman <[email protected]>
[ Upstream commit 00c9c9628b49e368d140cfa61d7df9b8922ec2a8 ]
With two-primaries enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed.
In handling "superseeded" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms.
Relevance: No one should use DRBD as a random data generator, and apparently all users of "two-primaries" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node.
Which means that other than for "test cases",
this code path is never taken in real life.
FYI, in DRBD 9, things are handled differently nowadays. We still detect "write conflicts", but no longer try to be smart about them.
We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault.
--- drivers/block/drbd/drbd_receiver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/block/drbd/drbd_receiver.c +5 -1
@@ -2500,7 +2500,11 @@ static int handle_write_conflicts(struct drbd_device *device, peer_req->w.cb = superseded ? e_send_superseded : e_send_retry_write;list_add_tail (&peer_req->w.list, &device->done_ee); -queue_work (connection->ack_sender, &peer_req->peer_device->send_acks_work); +/* put is in drbd_send_acks_wf() */ +kref_get (&device->kref); +if (!queue_work (connection->ack_sender, + &peer_req->peer_device->send_acks_work)) +kref_put (&device->kref, drbd_destroy_device); err = -ENOENT ; goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/587 hfs: fix not erasing deleted b-tree node issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit d3ed6d6981f4756f145766753c872482bc3b28d3 ]
The generic/001 test of xfstests suite fails and corrupts the HFS volume:
sudo ./check generic/001
FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2> MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/001 32s ... _check_generic_filesystem: filesystem on /dev/loop50 is inconsistent (see /home/slavad/XFSTESTS-2/xfstests-dev/results//generic/001.full for details)
Ran: generic/001
Failures: generic/001
Failed 1 of 1 tests
fsck.hfs -d -n ./test-image.bin
** ./test-image.bin (NO WRITE)
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking HFS volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
Unused node is not erased (node = 2)
Unused node is not erased (node = 4)
<skipped>
Unused node is not erased (node = 253)
Unused node is not erased (node = 254)
Unused node is not erased (node = 255)
Unused node is not erased (node = 256)
** Checking catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
CBTStat = 0x0004 CatStat = 0x00000000 ** The volume untitled was found corrupt and needs to be repaired. volume type is HFS primary MDB is at block 2 0x02 alternate MDB is at block 20971518 0x13ffffe primary VHB is at block 0 0x00 alternate VHB is at block 0 0x00 sector size = 512 0x200 VolumeObject flags = 0x19 total sectors for volume = 20971520 0x1400000 total sectors for embedded volume = 0 0x00
This patch adds logic of clearing the deleted b-tree node.
sudo ./check generic/001
FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2025 MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/001 9s ... 32s
Ran: generic/001
Passed all 1 tests
fsck.hfs -d -n ./test-image.bin
** ./test-image.bin (NO WRITE)
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking HFS volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
** Checking catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
** The volume untitled appears to be OK.
--- fs/hfs/bnode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfs/bnode.c +1 -0
@@ -574,6 +574,7 @@ void hfs_bnode_put(struct hfs_bnode *node)if (test_bit (HFS_BNODE_DELETED , &node->flags)) {hfs_bnode_unhash (node);spin_unlock (&tree->hash_lock); +hfs_bnode_clear (node,0 , tree->node_size);hfs_bmap_free (node);hfs_bnode_free (node);return ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/587 better lockdep annotations for simple_recursive_removal()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 2a8061ee5e41034eb14170ec4517b5583dbeff9f ]
We want a class that nests outside of I_MUTEX_NORMAL (for the sake of callbacks that might want to lock the victim) and inside I_MUTEX_PARENT (so that a variant of that could be used with parent of the victim held locked by the caller).
In reality, simple_recursive_removal()
* never holds two locks at once
* holds the lock on parent of dentry passed to callback
* is used only on the trees with fixed topology, so the depths
are not changing.
So the locking order is actually fine.
AFAICS, the best solution is to assign I_MUTEX_CHILD to the locks grabbed by that thing.
--- fs/libfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/libfs.c +2 -2
@@ -610,7 +610,7 @@ void simple_recursive_removal(struct dentry *dentry,struct dentry *victim =NULL , *child;struct inode *inode = this->d_inode; -inode_lock (inode); +inode_lock_nested (inode,I_MUTEX_CHILD );if (d_is_dir (this)) inode->i_flags |=S_DEAD ;while ((child =find_next_child (this, victim)) ==NULL ) {
@@ -622,7 +622,7 @@ void simple_recursive_removal(struct dentry *dentry, victim = this; this = this->d_parent; inode = this->d_inode; -inode_lock (inode); +inode_lock_nested (inode,I_MUTEX_CHILD );if (simple_positive (victim)) {d_invalidate (victim);// avoid lost mounts if (d_is_dir (victim))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/587 ata: libata-sata: Disallow changing LPM state if not supported
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 413e800cadbf67550d76c77c230b2ecd96bce83a ]
Modify ata_scsi_lpm_store() to return an error if a user attempts to set a link power management policy for a port that does not support LPM, that is, ports flagged with ATA_FLAG_NO_LPM.
--- drivers/ata/libata-sata.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/ata/libata-sata.c +5 -0
@@ -817,6 +817,11 @@ static ssize_t ata_scsi_lpm_store(struct device *device,spin_lock_irqsave (ap->lock, flags); +if (ap->flags &ATA_FLAG_NO_LPM ) { + count = -EOPNOTSUPP ; + goto out_unlock; + } +ata_for_each_link (link, ap,EDGE ) {ata_for_each_dev (dev, &ap->link,ENABLED ) {if (dev->horkage &ATA_HORKAGE_NOLPM ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/587 fs/ntfs3: Add sanity check for file name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit e841ecb139339602bc1853f5f09daa5d1ea920a2 ]
The length of the file name should be smaller than the directory entry size.
--- fs/ntfs3/dir.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ntfs3/dir.c +3 -0
@@ -304,6 +304,9 @@ static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi,if (sbi->options->nohidden && (fname->dup.fa &FILE_ATTRIBUTE_HIDDEN ))return true; +if (fname->name_len +sizeof (struct NTFS_DE ) >le16_to_cpu (e->size)) +return true; + name_len =ntfs_utf16_to_nls (sbi, fname->name, fname->name_len, name,PATH_MAX );if (name_len <=0 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/587 fs/ntfs3: correctly create symlink for relative path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Zhang <[email protected]>
[ Upstream commit b1e9d89408f402858c00103f9831b25ffa0994d3 ]
After applying this patch, could correctly create symlink:
ln -s "relative/path/to/file" symlink
[[email protected]: added cpu_to_le32 macro to rs->Flags assignment]
--- fs/ntfs3/inode.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
fs/ntfs3/inode.c +18 -13
@@ -1130,10 +1130,10 @@ int inode_write_data(struct inode *inode, const void *data, size_t bytes)* Number of bytes for REPARSE_DATA_BUFFER(IO_REPARSE_TAG_SYMLINK) * for unicode string of @uni_len length. */ -static inline u32 ntfs_reparse_bytes (u32 uni_len) +static inline u32 ntfs_reparse_bytes (u32 uni_len,bool is_absolute) {/* Header + unicode string + decorated unicode string. */ -return sizeof (short ) * (2 * uni_len +4 ) + +return sizeof (short ) * (2 * uni_len + (is_absolute ?4 :0 )) + offsetof(struct REPARSE_DATA_BUFFER , SymbolicLinkReparseBuffer.PathBuffer); }
@@ -1146,8 +1146,11 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,struct REPARSE_DATA_BUFFER *rp;__le16 *rp_name;typeof (rp->SymbolicLinkReparseBuffer) *rs; +bool is_absolute; - rp =kzalloc (ntfs_reparse_bytes (2 * size +2 ),GFP_NOFS ); + is_absolute = (strlen (symname) >1 && symname[1 ] ==':' ); + + rp =kzalloc (ntfs_reparse_bytes (2 * size +2 , is_absolute),GFP_NOFS );if (!rp)return ERR_PTR (-ENOMEM );
@@ -1162,7 +1165,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname, goto out;/* err = the length of unicode name of symlink. */ - *nsize =ntfs_reparse_bytes (err); + *nsize =ntfs_reparse_bytes (err, is_absolute);if (*nsize > sbi->reparse.max_size) { err = -EFBIG ;
@@ -1182,7 +1185,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,/* PrintName + SubstituteName. */ rs->SubstituteNameOffset =cpu_to_le16 (sizeof (short ) * err); - rs->SubstituteNameLength =cpu_to_le16 (sizeof (short ) * err +8 ); + rs->SubstituteNameLength =cpu_to_le16 (sizeof (short ) * err + (is_absolute ?8 :0 )); rs->PrintNameLength = rs->SubstituteNameOffset;/*
@@ -1190,16 +1193,18 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,* parse this path. * 0-absolute path 1- relative path (SYMLINK_FLAG_RELATIVE). */ - rs->Flags =0 ; + rs->Flags =cpu_to_le32 (is_absolute ?0 :SYMLINK_FLAG_RELATIVE ); -memmove (rp_name + err +4 , rp_name,sizeof (short ) * err); +memmove (rp_name + err + (is_absolute ?4 :0 ), rp_name,sizeof (short ) * err); -/* Decorate SubstituteName. */ - rp_name += err; - rp_name[0 ] =cpu_to_le16 ('\\' ); - rp_name[1 ] =cpu_to_le16 ('?' ); - rp_name[2 ] =cpu_to_le16 ('?' ); - rp_name[3 ] =cpu_to_le16 ('\\' ); +if (is_absolute) { +/* Decorate SubstituteName. */ + rp_name += err; + rp_name[0 ] =cpu_to_le16 ('\\' ); + rp_name[1 ] =cpu_to_le16 ('?' ); + rp_name[2 ] =cpu_to_le16 ('?' ); + rp_name[3 ] =cpu_to_le16 ('\\' ); + }return rp; out:
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/587 ext2: Handle fiemap on empty files to prevent EINVAL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Gao <[email protected]>
[ Upstream commit a099b09a3342a0b28ea330e405501b5b4d0424b4 ]
Previously, ext2_fiemap would unconditionally apply "len = min_t(u64, len, i_size_read(inode));", When inode->i_size was 0 (for an empty file), this would reduce the requested len to 0. Passing len = 0 to iomap_fiemap could then result in an -EINVAL error, even for valid queries on empty files.
--- fs/ext2/inode.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/ext2/inode.c +11 -1
@@ -895,9 +895,19 @@ int ext2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, u64 start, u64 len) { int ret; +loff_t i_size;inode_lock (inode); - len =min_t (u64, len,i_size_read (inode)); + i_size =i_size_read (inode); +/* +* iomap_fiemap() returns EINVAL for 0 length. Make sure we don't trim +* length to 0 but still trim the range as much as possible since +* ext2_get_blocks() iterates unmapped space block by block which is +* slow. +*/ +if (i_size ==0 ) + i_size =1 ; + len =min_t (u64, len, i_size); ret =iomap_fiemap (inode, fieinfo, start, len, &ext2_iomap_ops);inode_unlock (inode);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/587 fix locking in efi_secret_unlink()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 2c58d42de71f9c73e40afacc9d062892d2cc8862 ]
We used to need securityfs_remove() to undo simple_pin_fs() done when the file had been created and to drop the second extra reference taken at the same time. Now that neither is needed (or done by securityfs_remove()), we can simply call simple_unlink() and be done with that - the broken games with locking had been there only for the sake of securityfs_remove().
--- drivers/virt/coco/efi_secret/efi_secret.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-)
drivers/virt/coco/efi_secret/efi_secret.c +1 -9
@@ -136,15 +136,7 @@ static int efi_secret_unlink(struct inode *dir, struct dentry *dentry)if (s->fs_files[i] == dentry) s->fs_files[i] =NULL ; -/* -* securityfs_remove tries to lock the directory's inode, but we reach -* the unlink callback when it's already locked -*/ -inode_unlock (dir); -securityfs_remove (dentry); -inode_lock (dir); - -return 0 ; +return simple_unlink (inode, dentry); }static const struct inode_operations efi_secret_dir_inode_operations = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/587 securityfs: dont pin dentries twice, once is enough...
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 27cd1bf1240d482e4f02ca4f9812e748f3106e4f ]
incidentally, securityfs_recursive_remove() is broken without that - it leaks dentries, since simple_recursive_removal() does not expect anything of that sort. It could be worked around by dput() in remove_one() callback, but it's easier to just drop that double-get stuff.
--- security/inode.c | 2 -- 1 file changed, 2 deletions(-)
security/inode.c +0 -2
@@ -159,7 +159,6 @@ static struct dentry *securityfs_create_dentry(const char *name, umode_t mode, inode->i_fop = fops; }d_instantiate (dentry, inode); -dget (dentry);inode_unlock (dir);return dentry;
@@ -306,7 +305,6 @@ void securityfs_remove(struct dentry *dentry)simple_rmdir (dir, dentry); elsesimple_unlink (dir ,dentry ); -dput (dentry); }inode_unlock (dir);simple_release_fs (&mount, &mount_count);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/587 tracefs: Add d_delete to remove negative dentries
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit d9b13cdad80dc11d74408cf201939a946e9303a6 ]
If a lookup in tracefs is done on a file that does not exist, it leaves a dentry hanging around until memory pressure removes it. But eventfs dentries should hang around as when their ref count goes to zero, it requires more work to recreate it. For the rest of the tracefs dentries, they hang around as their dentry is used as a descriptor for the tracing system. But if a file lookup happens for a file in tracefs that does not exist, it should be deleted.
Add a .d_delete callback that checks if dentry->fsdata is set or not. Only eventfs dentries set fsdata so if it has content it should not be deleted and should hang around in the cache.
--- fs/tracefs/inode.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
fs/tracefs/inode.c +11 -0
@@ -483,9 +483,20 @@ static int tracefs_d_revalidate(struct dentry *dentry, unsigned int flags)return !(ei && ei->is_freed); } +static int tracefs_d_delete (const struct dentry *dentry) +{ +/* +* We want to keep eventfs dentries around but not tracefs +* ones. eventfs dentries have content in d_fsdata. +* Use d_fsdata to determine if it's a eventfs dentry or not. +*/ +return dentry->d_fsdata ==NULL ; +} +static const struct dentry_operations tracefs_dentry_operations = { .d_revalidate = tracefs_d_revalidate, .d_release = tracefs_d_release, + .d_delete = tracefs_d_delete, };static int trace_fill_super (struct super_block *sb,void *data,int silent)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/587 usb: xhci: print xhci->xhc_state when queue_command failed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 7919407eca2ef562fa6c98c41cfdf6f6cdd69d92 ]
When encounters some errors like these:xhci_hcd 0000:4a:00.2: xHCI dying or halted, can't queue_command xhci_hcd 0000:4a:00.2: FIXME: allocate a command ring segment usb usb5-port6: couldn't allocate usb_device
It's hard to know whether xhc_state is dying or halted. So it's better to print xhc_state's value which can help locate the resaon of the bug.
--- drivers/usb/host/xhci-ring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-ring.c +2 -1
@@ -4454,7 +4454,8 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,if ((xhci->xhc_state &XHCI_STATE_DYING ) || (xhci->xhc_state &XHCI_STATE_HALTED )) { -xhci_dbg (xhci,"xHCI dying or halted, can't queue_command\n" ); +xhci_dbg (xhci,"xHCI dying or halted, can't queue_command. state: 0x%x\n" , + xhci->xhc_state);return -ESHUTDOWN ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/587 platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 4ff3aeb664f7dfe824ba91ffb0b203397a8d431e ]
The Lenovo Yoga 6 13ACL6 82ND has a similar BIOS problem as other Lenovo laptops from that vintage that causes a rather long resume from suspend.
Add it to the quirk list that manipulates the scratch register to avoid the issue.
--- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/amd/pmc/pmc-quirks.c +9 -0
@@ -189,6 +189,15 @@ static const struct dmi_system_id fwbug_list[] = { DMI_MATCH(DMI_PRODUCT_NAME, "82XQ"), } }, +/* https://gitlab.freedesktop.org/drm/amd/-/issues/4434 */ + { + .ident = "Lenovo Yoga 6 13ALC6", + .driver_data = &quirk_s2idle_bug, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "82ND"), + } + }, /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */ { .ident = "HP Laptop 15s-eq2xxx",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/587 cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashant Malani <[email protected]>
[ Upstream commit 0a1416a49e63c320f6e6c1c8d07e1b58c0d4a3f3 ]
AMU counters on certain CPPC-based platforms tend to yield inaccurate delivered performance measurements on systems that are idle/mostly idle. This results in an inaccurate frequency being stored by cpufreq in its policy structure when the CPU is brought online. [1]
Consequently, if the userspace governor tries to set the frequency to a new value, there is a possibility that it would be the erroneous value stored earlier. In such a scenario, cpufreq would assume that the requested frequency has already been set and return early, resulting in the correct/new frequency request never making it to the hardware.
Since the operating frequency is liable to this sort of inconsistency, mark the CPPC driver with CPUFREQ_NEED_UPDATE_LIMITS so that it is always invoked when a target frequency update is requested.
--- drivers/cpufreq/cppc_cpufreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/cppc_cpufreq.c +1 -1
@@ -847,7 +847,7 @@ static struct freq_attr *cppc_cpufreq_attr[] = { };static struct cpufreq_driver cppc_cpufreq_driver = { - .flags =CPUFREQ_CONST_LOOPS , + .flags =CPUFREQ_CONST_LOOPS |CPUFREQ_NEED_UPDATE_LIMITS , .verify = cppc_verify_policy, .target = cppc_cpufreq_set_target, .get = cppc_cpufreq_get_rate,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/587 selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cynthia Huang <[email protected]>
[ Upstream commit 04850819c65c8242072818655d4341e70ae998b5 ]
The kernel does not provide sys_futex() on 32-bit architectures that do not support 32-bit time representations, such as riscv32.
As a result, glibc cannot define SYS_futex, causing compilation failures in tests that rely on this syscall. Define SYS_futex as SYS_futex_time64 in such cases to ensure successful compilation and compatibility.
--- tools/testing/selftests/futex/include/futextest.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/testing/selftests/futex/include/futextest.h +11 -0
@@ -47,6 +47,17 @@ typedef volatile u_int32_t futex_t; FUTEX_PRIVATE_FLAG)#endif +/* +* SYS_futex is expected from system C library, in glibc some 32-bit +* architectures (e.g. RV32) are using 64-bit time_t, therefore it doesn't have +* SYS_futex defined but just SYS_futex_time64. Define SYS_futex as +* SYS_futex_time64 in this situation to ensure the compilation and the +* compatibility. +*/ +#if !defined(SYS_futex) && defined(SYS_futex_time64) +#define SYS_futex SYS_futex_time64 +#endif +/** * futex() - SYS_futex syscall wrapper * @uaddr: address of first futex
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/587 usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benson Leung <[email protected]>
[ Upstream commit af833e7f7db3cf4c82f063668e1b52297a30ec18 ]
ucsi_psy_get_current_max would return 0mA as the maximum current if UCSI detected a BC or a Default USB Power sporce.
The comment in this function is true that we can't tell the difference between DCP/CDP or SDP chargers, but we can guarantee that at least 1-unit of USB 1.1/2.0 power is available, which is 100mA, which is a better fallback value than 0, which causes some userspaces, including the ChromeOS power manager, to regard this as a power source that is not providing any power.
In reality, 100mA is guaranteed from all sources in these classes.
--- drivers/usb/typec/ucsi/psy.c | 2 +- drivers/usb/typec/ucsi/ucsi.h | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/usb/typec/ucsi/psy.c +1 -1
@@ -163,7 +163,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,case UCSI_CONSTAT_PWR_OPMODE_DEFAULT :/* UCSI can't tell b/w DCP/CDP or USB2/3x1/3x2 SDP chargers */ default : - val->intval =0 ; + val->intval =UCSI_TYPEC_DEFAULT_CURRENT *1000 ;break ; }return 0 ;
drivers/usb/typec/ucsi/ucsi.h +4 -3
@@ -340,9 +340,10 @@ struct ucsi {#define UCSI_MAX_SVID 5#define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6) -#define UCSI_TYPEC_VSAFE5V 5000 -#define UCSI_TYPEC_1_5_CURRENT 1500 -#define UCSI_TYPEC_3_0_CURRENT 3000 +#define UCSI_TYPEC_VSAFE5V 5000 +#define UCSI_TYPEC_DEFAULT_CURRENT 100 +#define UCSI_TYPEC_1_5_CURRENT 1500 +#define UCSI_TYPEC_3_0_CURRENT 3000struct ucsi_connector {int num;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/587 usb: xhci: Avoid showing warnings for dying controller
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 65fc0fc137b5da3ee1f4ca4f61050fcb203d7582 ]
When a USB4 dock is unplugged from a system it won't respond to ring events. The PCI core handles the surprise removal event and notifies all PCI drivers. The XHCI PCI driver sets a flag that the device is being removed, and when the device stops responding a flag is also added to indicate it's dying.
When that flag is set don't bother to show warnings about a missing controller.
--- drivers/usb/host/xhci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +4 -2
@@ -119,7 +119,8 @@ int xhci_halt(struct xhci_hcd *xhci) ret =xhci_handshake (&xhci->op_regs->status,STS_HALT ,STS_HALT ,XHCI_MAX_HALT_USEC );if (ret) { -xhci_warn (xhci,"Host halt failed, %d\n" , ret); +if (!(xhci->xhc_state &XHCI_STATE_DYING )) +xhci_warn (xhci,"Host halt failed, %d\n" , ret);return ret; }
@@ -178,7 +179,8 @@ int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) state =readl (&xhci->op_regs->status);if (state == ~(u32 )0 ) { -xhci_warn (xhci,"Host not accessible, reset failed.\n" ); +if (!(xhci->xhc_state &XHCI_STATE_DYING )) +xhci_warn (xhci,"Host not accessible, reset failed.\n" );return -ENODEV ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/587 usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Chen <[email protected]>
[ Upstream commit f72b9aa821a2bfe4b6dfec4be19f264d0673b008 ]
There is a subtle contradiction between sections of the xHCI 1.2 spec regarding the initialization of Input Endpoint Context fields. Section 4.8.2 ("Endpoint Context Initialization") states that all fields should be initialized to 0. However, Section 6.2.3 ("Endpoint Context", p.453) specifies that the Average TRB Length (avg_trb_len) field shall be greater than 0, and explicitly notes (p.454): "Software shall set Average TRB Length to '8' for control endpoints."
Strictly setting all fields to 0 during initialization conflicts with the specific recommendation for control endpoints. In practice, setting avg_trb_len = 0 is not meaningful for the hardware/firmware, as the value is used for bandwidth calculation.
Motivation: Our company is developing a custom Virtual xHC hardware platform that strictly follows the xHCI spec and its recommendations. During validation, we observed that enumeration fails and a parameter error (TRB Completion Code = 5) is reported if avg_trb_len for EP0 is not set to 8 as recommended by Section 6.2.3. This demonstrates the importance of assigning a meaningful, non-zero value to avg_trb_len, even in virtualized or emulated environments.
This patch explicitly sets avg_trb_len to 8 for EP0 in xhci_setup_addressable_virt_dev(), as recommended in Section 6.2.3, to prevent potential issues with xHCI host controllers that enforce the spec strictly.
--- drivers/usb/host/xhci-mem.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/host/xhci-mem.c +2 -0
@@ -1182,6 +1182,8 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud ep0_ctx->deq =cpu_to_le64 (dev->eps[0 ].ring->first_seg->dma | dev->eps[0 ].ring->cycle_state); + ep0_ctx->tx_info =cpu_to_le32 (EP_AVG_TRB_LENGTH (8 )); +trace_xhci_setup_addressable_virt_device (dev);/* Steps 7 and 8 were done in xhci_alloc_virt_device() */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/587 usb: xhci: Avoid showing errors during surprise removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 4b9c60e440525b729ac5f071e00bcee12e0a7e84 ]
When a USB4 dock is unplugged from a system it won't respond to ring events. The PCI core handles the surprise removal event and notifies all PCI drivers. The XHCI PCI driver sets a flag that the device is being removed as well.
When that flag is set don't show messages in the cleanup path for marking the controller dead.
--- drivers/usb/host/xhci-ring.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-ring.c +5 -2
@@ -1338,12 +1338,15 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci,*/ void xhci_hc_died (struct xhci_hcd *xhci) { +bool notify;int i, j;if (xhci->xhc_state &XHCI_STATE_DYING )return ; -xhci_err (xhci,"xHCI host controller not responding, assume dead\n" ); + notify = !(xhci->xhc_state &XHCI_STATE_REMOVING ); +if (notify) +xhci_err (xhci,"xHCI host controller not responding, assume dead\n" ); xhci->xhc_state |=XHCI_STATE_DYING ;xhci_cleanup_command_queue (xhci);
@@ -1357,7 +1360,7 @@ void xhci_hc_died(struct xhci_hcd *xhci) }/* inform usb core hc died if PCI remove isn't already handling it */ -if (!(xhci->xhc_state &XHCI_STATE_REMOVING )) +if (notify)usb_hc_died (xhci_to_hcd (xhci)); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/587 soc: qcom: rpmh-rsc: Add RSC version 4 support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maulik Shah <[email protected]>
[ Upstream commit 84684c57c9cd47b86c883a7170dd68222d97ef13 ]
Register offsets for v3 and v4 versions are backward compatible. Assign v3 offsets for v4 and all higher versions to avoid end up using v2 offsets.
--- drivers/soc/qcom/rpmh-rsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/rpmh-rsc.c +1 -1
@@ -1075,7 +1075,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev) drv->ver.minor = rsc_id & (MINOR_VER_MASK <<MINOR_VER_SHIFT ); drv->ver.minor >>=MINOR_VER_SHIFT ; -if (drv->ver.major ==3 ) +if (drv->ver.major >=3 ) drv->regs = rpmh_rsc_reg_offset_ver_3_0;else drv->regs = rpmh_rsc_reg_offset_ver_2_7;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/587 ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
[ Upstream commit 79a5ae3c4c5eb7e38e0ebe4d6bf602d296080060 ]
If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, the CPU will take a synchronous error exception such as Synchronous External Abort (SEA) on Arm64. The kernel will queue a memory_failure() work which poisons the related page, unmaps the page, and then sends a SIGBUS to the process, so that a system wide panic can be avoided.
However, no memory_failure() work will be queued when abnormal synchronous errors occur. These errors can include situations like invalid PA, unexpected severity, no memory failure config support, invalid GUID section, etc. In such a case, the user-space process will trigger SEA again. This loop can potentially exceed the platform firmware threshold or even trigger a kernel hard lockup, leading to a system reboot.
Fix it by performing a force kill if no memory_failure() work is queued for synchronous errors.
--- drivers/acpi/apei/ghes.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/acpi/apei/ghes.c +11 -0
@@ -715,6 +715,17 @@ static bool ghes_do_proc(struct ghes *ghes, } } +/* +* If no memory failure work is queued for abnormal synchronous +* errors, do a force kill. +*/ +if (sync && !queued) { +dev_err (ghes->dev, + HW_ERR GHES_PFX "%s:%d: synchronous unrecoverable error (SIGBUS)\n", + current->comm,task_pid_nr (current)); +force_sig (SIGBUS ); + } +return queued; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/587 remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiago De Franco <[email protected]>
[ Upstream commit 496deecb020d14ba89ba7084fbc3024f91687023 ]
For the i.MX8X and i.MX8 family SoCs, when the Cortex-M core is powered up and started by the Cortex-A core using the bootloader (e.g., via the U-Boot bootaux command), both M-core and Linux run within the same SCFW (System Controller Firmware) partition. With that, Linux has permission to control the M-core.
But once the M-core is started by the bootloader, the SCFW automatically enables its clock and sets the clock rate. If Linux later attempts to enable the same clock via clk_prepare_enable(), the SCFW returns a 'LOCKED' error, as the clock is already configured by the SCFW. This causes the probe function in imx_rproc.c to fail, leading to the M-core power domain being shut down while the core is still running. This results in a fault from the SCU (System Controller Unit) and triggers a system reset.
To address this issue, ignore handling the clk for i.MX8X and i.MX8 M-core, as SCFW already takes care of enabling and configuring the clock.
--- drivers/remoteproc/imx_rproc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/remoteproc/imx_rproc.c +2 -2
@@ -1088,8 +1088,8 @@ static int imx_rproc_clk_enable(struct imx_rproc *priv)struct device *dev = priv->dev;int ret; -/* Remote core is not under control of Linux */ -if (dcfg->method ==IMX_RPROC_NONE ) +/* Remote core is not under control of Linux or it is managed by SCU API */ +if (dcfg->method ==IMX_RPROC_NONE || dcfg->method ==IMX_RPROC_SCU_API )return 0 ; priv->clk =devm_clk_get (dev,NULL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/587 gpio: wcd934x: check the return value of regmap_update_bits()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit ff0f0d7c6587e38c308be9905e36f86e98fb9c1f ]
regmap_update_bits() can fail so check its return value in wcd_gpio_direction_output() for consistency with the rest of the code and propagate any errors.
--- drivers/gpio/gpio-wcd934x.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpio/gpio-wcd934x.c +5 -2
@@ -46,9 +46,12 @@ static int wcd_gpio_direction_output(struct gpio_chip *chip, unsigned int pin, int val) {struct wcd_gpio_data *data =gpiochip_get_data (chip); +int ret; -regmap_update_bits (data->map,WCD_REG_DIR_CTL_OFFSET , -WCD_PIN_MASK (pin),WCD_PIN_MASK (pin)); + ret =regmap_update_bits (data->map,WCD_REG_DIR_CTL_OFFSET , +WCD_PIN_MASK (pin),WCD_PIN_MASK (pin)); +if (ret) +return ret; return regmap_update_bits(data->map, WCD_REG_VAL_CTL_OFFSET, WCD_PIN_MASK(pin),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/587 cpufreq: Exit governor when failed to start old governor
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 0ae204405095abfbc2d694ee0fbb49bcbbe55c57 ]
Detect the result of starting old governor in cpufreq_set_policy(). If it fails, exit the governor and clear policy->governor.
--- drivers/cpufreq/cpufreq.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/cpufreq/cpufreq.c +5 -3
@@ -2701,10 +2701,12 @@ static int cpufreq_set_policy(struct cpufreq_policy *policy,pr_debug ("starting governor %s failed\n" , policy->governor->name);if (old_gov) { policy->governor = old_gov; -if (cpufreq_init_governor (policy)) +if (cpufreq_init_governor (policy)) { policy->governor =NULL ; -else -cpufreq_start_governor (policy); + }else if (cpufreq_start_governor (policy)) { +cpufreq_exit_governor (policy); + policy->governor =NULL ; + } }return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/587 ARM: rockchip: fix kernel hang during smp initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Kochetkov <[email protected]>
[ Upstream commit 7cdb433bb44cdc87dc5260cdf15bf03cc1cd1814 ]
In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect.
The patch moves SRAM initialization step to the point where all secondary CPUs are powered down.
That fixes rarely hangs on RK3188:
[ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4
--- arch/arm/mach-rockchip/platsmp.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
arch/arm/mach-rockchip/platsmp.c +9 -6
@@ -279,11 +279,6 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus) }if (read_cpuid_part () ==ARM_CPU_PART_CORTEX_A9 ) { -if (rockchip_smp_prepare_sram (node)) { -of_node_put (node); -return ; - } -/* enable the SCU power domain */ pmu_set_power_domain (PMU_PWRDN_SCU , true);
@@ -316,11 +311,19 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus) asm ("mrc p15, 1, %0, c9, c0, 2\n" :"=r" (l2ctlr)); ncores = ((l2ctlr >>24 ) &0x3 ) +1 ; } -of_node_put (node);/* Make sure that all cores except the first are really off */ for (i =1 ; i < ncores; i++)pmu_set_power_domain (0 + i, false); + +if (read_cpuid_part () ==ARM_CPU_PART_CORTEX_A9 ) { +if (rockchip_smp_prepare_sram (node)) { +of_node_put (node); +return ; + } + } + +of_node_put (node); }static void __init rk3036_smp_prepare_cpus (unsigned int max_cpus)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/587 PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 914cc799b28f17d369d5b4db3b941957d18157e8 ]
Replace sscanf() with kstrtoul() in set_freq_store() and check the result to avoid invalid input.
--- drivers/devfreq/governor_userspace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/devfreq/governor_userspace.c +5 -1
@@ -9,6 +9,7 @@#include <linux/slab.h> #include <linux/device.h> #include <linux/devfreq.h> +#include <linux/kstrtox.h> #include <linux/pm.h> #include <linux/mutex.h> #include <linux/module.h>
@@ -39,10 +40,13 @@ static ssize_t set_freq_store(struct device *dev, struct device_attribute *attr,unsigned long wanted;int err =0 ; + err =kstrtoul (buf,0 , &wanted); +if (err) +return err; +mutex_lock (&devfreq->lock); data = devfreq->governor_data; -sscanf (buf,"%lu" , &wanted); data->user_frequency = wanted; data->valid = true; err =update_devfreq (devfreq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/587 EDAC/synopsys: Clear the ECC counters on init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <[email protected]>
[ Upstream commit b1dc7f097b78eb8d25b071ead2384b07a549692b ]
Clear the ECC error and counter registers during initialization/probe to avoid reporting stale errors that may have occurred before EDAC registration.
For that, unify the Zynq and ZynqMP ECC state reading paths and simplify the code.
[ bp: Massage commit message.
Fix an -Wsometimes-uninitialized warning as reported by
--- drivers/edac/synopsys_edac.c | 97 +++++++++++++++++------------------- 1 file changed, 46 insertions(+), 51 deletions(-)
drivers/edac/synopsys_edac.c +46 -51
@@ -332,20 +332,26 @@ struct synps_edac_priv {#endif }; +enum synps_platform_type { +ZYNQ , +ZYNQMP , +SYNPS , +}; +/** * struct synps_platform_data - synps platform data structure. +* @platform: Identifies the target hardware platform * @get_error_info: Get EDAC error info. * @get_mtype: Get mtype. * @get_dtype: Get dtype. -* @get_ecc_state: Get ECC state. * @get_mem_info: Get EDAC memory info * @quirks: To differentiate IPs. */ struct synps_platform_data { +enum synps_platform_type platform;int (*get_error_info)(struct synps_edac_priv *priv);enum mem_type (*get_mtype)(const void __iomem *base);enum dev_type (*get_dtype)(const void __iomem *base); -bool (*get_ecc_state)(void __iomem *base);#ifdef CONFIG_EDAC_DEBUG u64 (*get_mem_info)(struct synps_edac_priv *priv);#endif
@@ -720,51 +726,38 @@ static enum dev_type zynqmp_get_dtype(const void __iomem *base)return dt; } -/** -* zynq_get_ecc_state - Return the controller ECC enable/disable status. -* @base: DDR memory controller base address. -* -* Get the ECC enable/disable status of the controller. -* -* Return: true if enabled, otherwise false. -*/ -static bool zynq_get_ecc_state (void __iomem *base) +static bool get_ecc_state (struct synps_edac_priv *priv) { +u32 ecctype, clearval;enum dev_type dt; -u32 ecctype; - - dt =zynq_get_dtype (base); -if (dt ==DEV_UNKNOWN ) -return false; - ecctype =readl (base +SCRUB_OFST ) &SCRUB_MODE_MASK ; -if ((ecctype ==SCRUB_MODE_SECDED ) && (dt ==DEV_X2 )) -return true; - -return false; -} - -/** -* zynqmp_get_ecc_state - Return the controller ECC enable/disable status. -* @base: DDR memory controller base address. -* -* Get the ECC enable/disable status for the controller. -* -* Return: a ECC status boolean i.e true/false - enabled/disabled. -*/ -static bool zynqmp_get_ecc_state (void __iomem *base) -{ -enum dev_type dt; -u32 ecctype; - - dt =zynqmp_get_dtype (base); -if (dt ==DEV_UNKNOWN ) -return false; - - ecctype =readl (base +ECC_CFG0_OFST ) &SCRUB_MODE_MASK ; -if ((ecctype ==SCRUB_MODE_SECDED ) && - ((dt ==DEV_X2 ) || (dt ==DEV_X4 ) || (dt ==DEV_X8 ))) -return true; +if (priv->p_data->platform ==ZYNQ ) { + dt =zynq_get_dtype (priv->baseaddr); +if (dt ==DEV_UNKNOWN ) +return false; + + ecctype =readl (priv->baseaddr +SCRUB_OFST ) &SCRUB_MODE_MASK ; +if (ecctype ==SCRUB_MODE_SECDED && dt ==DEV_X2 ) { + clearval =ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_UE_ERR ; +writel (clearval, priv->baseaddr +ECC_CTRL_OFST ); +writel (0x0 , priv->baseaddr +ECC_CTRL_OFST ); +return true; + } + }else { + dt =zynqmp_get_dtype (priv->baseaddr); +if (dt ==DEV_UNKNOWN ) +return false; + + ecctype =readl (priv->baseaddr +ECC_CFG0_OFST ) &SCRUB_MODE_MASK ; +if (ecctype ==SCRUB_MODE_SECDED && + (dt ==DEV_X2 || dt ==DEV_X4 || dt ==DEV_X8 )) { + clearval =readl (priv->baseaddr +ECC_CLR_OFST ) | +ECC_CTRL_CLR_CE_ERR |ECC_CTRL_CLR_CE_ERRCNT | +ECC_CTRL_CLR_UE_ERR |ECC_CTRL_CLR_UE_ERRCNT ; +writel (clearval, priv->baseaddr +ECC_CLR_OFST ); +return true; + } + }return false; }
@@ -934,18 +927,18 @@ static int setup_irq(struct mem_ctl_info *mci, }static const struct synps_platform_data zynq_edac_def = { + .platform =ZYNQ , .get_error_info = zynq_get_error_info, .get_mtype = zynq_get_mtype, .get_dtype = zynq_get_dtype, - .get_ecc_state = zynq_get_ecc_state, .quirks =0 , };static const struct synps_platform_data zynqmp_edac_def = { + .platform =ZYNQMP , .get_error_info = zynqmp_get_error_info, .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, - .get_ecc_state = zynqmp_get_ecc_state, #ifdef CONFIG_EDAC_DEBUG .get_mem_info = zynqmp_get_mem_info, #endif
@@ -957,10 +950,10 @@ static const struct synps_platform_data zynqmp_edac_def = { };static const struct synps_platform_data synopsys_edac_def = { + .platform =SYNPS , .get_error_info = zynqmp_get_error_info, .get_mtype = zynqmp_get_mtype, .get_dtype = zynqmp_get_dtype, - .get_ecc_state = zynqmp_get_ecc_state, .quirks = (DDR_ECC_INTR_SUPPORT | DDR_ECC_INTR_SELF_CLEAR #ifdef CONFIG_EDAC_DEBUG | DDR_ECC_DATA_POISON_SUPPORT
@@ -1392,10 +1385,6 @@ static int mc_probe(struct platform_device *pdev)if (!p_data)return -ENODEV ; -if (!p_data->get_ecc_state (baseaddr)) { -edac_printk (KERN_INFO ,EDAC_MC ,"ECC not enabled\n" ); -return -ENXIO ; - } layers[0 ].type =EDAC_MC_LAYER_CHIP_SELECT ; layers[0 ].size =SYNPS_EDAC_NR_CSROWS ;
@@ -1415,6 +1404,12 @@ static int mc_probe(struct platform_device *pdev) priv = mci->pvt_info; priv->baseaddr = baseaddr; priv->p_data = p_data; +if (!get_ecc_state (priv)) { +edac_printk (KERN_INFO ,EDAC_MC ,"ECC not enabled\n" ); + rc = -ENODEV ; + goto free_edac_mc; + } +spin_lock_init (&priv->reglock);mc_init (mci, pdev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/587 ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit f40ecc2743652c0b0f19935f81baf57c601eb7f0 ]
ASoC has 2 functions to set bias level.
(A) snd_soc_dapm_force_bias_level() (B) snd_soc_dapm_set_bias_level()
snd_soc_dapm_force_bias_level() (A) will set dapm->bias_level (a) if successed.
(A) int snd_soc_dapm_force_bias_level(...)
{
...
if (ret == 0)
(a) dapm->bias_level = level;
...
}snd_soc_dapm_set_bias_level() (B) is also a function that sets bias_level. It will call snd_soc_dapm_force_bias_level() (A) inside, but doesn't set dapm->bias_level by itself. One note is that (A) might not be called.
(B) static int snd_soc_dapm_set_bias_level(...)
{
...
ret = snd_soc_card_set_bias_level(...);
...
if (dapm != &card->dapm)
(A) ret = snd_soc_dapm_force_bias_level(...);
...
ret = snd_soc_card_set_bias_level_post(...);
...
}dapm->bias_level will be set if (A) was called, but might not be set if (B) was called, even though it calles set_bias_level() function.
We should set dapm->bias_level if we callssnd_soc_dapm_set_bias_level() (B), too.
--- sound/soc/soc-dapm.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/soc-dapm.c +4 -0
@@ -734,6 +734,10 @@ static int snd_soc_dapm_set_bias_level(struct snd_soc_dapm_context *dapm, out:trace_snd_soc_bias_level_done (card, level); +/* success */ +if (ret ==0 ) +snd_soc_dapm_init_bias_level (dapm, level); +return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/587 thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Collins <[email protected]>
[ Upstream commit f8e157ff2df46ddabd930815d196895976227831 ]
Certain TEMP_ALARM GEN2 PMIC peripherals need over-temperature stage 2 automatic PMIC partial shutdown. This will ensure that in the event of reaching the hotter stage 3 over-temperature threshold, repeated faults will be avoided during the automatic PMIC hardware full shutdown. Modify the stage 2 shutdown control logic to ensure that stage 2 shutdown is enabled on all affected PMICs. Read the digital major and minor revision registers to identify these PMICs.
--- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 43 ++++++++++++++++----- 1 file changed, 34 insertions(+), 9 deletions(-)
drivers/thermal/qcom/qcom-spmi-temp-alarm.c +34 -9
@@ -1,6 +1,7 @@// SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2011-2015, 2017, 2020, The Linux Foundation. All rights reserved. +* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include <linux/bitops.h>
@@ -16,6 +17,7 @@#include "../thermal_hwmon.h" +#define QPNP_TM_REG_DIG_MINOR 0x00#define QPNP_TM_REG_DIG_MAJOR 0x01#define QPNP_TM_REG_TYPE 0x04#define QPNP_TM_REG_SUBTYPE 0x05
@@ -31,7 +33,7 @@#define STATUS_GEN2_STATE_MASK GENMASK(6, 4)#define STATUS_GEN2_STATE_SHIFT 4 -#define SHUTDOWN_CTRL1_OVERRIDE_S2 BIT(6) +#define SHUTDOWN_CTRL1_OVERRIDE_STAGE2 BIT(6)#define SHUTDOWN_CTRL1_THRESHOLD_MASK GENMASK(1, 0)#define SHUTDOWN_CTRL1_RATE_25HZ BIT(3)
@@ -79,6 +81,7 @@ struct qpnp_tm_chip {/* protects .thresh, .stage and chip registers */ struct mutex lock;bool initialized; +bool require_stage2_shutdown;struct iio_channel *adc;const long (*temp_map)[THRESH_COUNT ][STAGE_COUNT ];
@@ -221,13 +224,13 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, {long stage2_threshold_min = (*chip->temp_map)[THRESH_MIN ][1 ];long stage2_threshold_max = (*chip->temp_map)[THRESH_MAX ][1 ]; -bool disable_s2_shutdown = false; +bool disable_stage2_shutdown = false;u8 reg;WARN_ON (!mutex_is_locked (&chip->lock));/* -* Default: S2 and S3 shutdown enabled, thresholds at +* Default: Stage 2 and Stage 3 shutdown enabled, thresholds at * lowest threshold set, monitoring at 25Hz */ reg =SHUTDOWN_CTRL1_RATE_25HZ ;
@@ -242,12 +245,12 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, chip->thresh =THRESH_MAX - ((stage2_threshold_max - temp) /TEMP_THRESH_STEP ); - disable_s2_shutdown = true; + disable_stage2_shutdown = true; }else { chip->thresh =THRESH_MAX ;if (chip->adc) - disable_s2_shutdown = true; + disable_stage2_shutdown = true;else dev_warn(chip->dev, "No ADC is configured and critical temperature %d mC is above the maximum stage 2 threshold of %ld mC! Configuring stage 2 shutdown at %ld mC.\n",
@@ -256,8 +259,8 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, skip: reg |= chip->thresh; -if (disable_s2_shutdown) - reg |=SHUTDOWN_CTRL1_OVERRIDE_S2 ; +if (disable_stage2_shutdown && !chip->require_stage2_shutdown) + reg |=SHUTDOWN_CTRL1_OVERRIDE_STAGE2 ;return qpnp_tm_write (chip,QPNP_TM_REG_SHUTDOWN_CTRL1 , reg); }
@@ -371,8 +374,8 @@ static int qpnp_tm_probe(struct platform_device *pdev) {struct qpnp_tm_chip *chip;struct device_node *node; -u8 type, subtype, dig_major; -u32 res; +u8 type, subtype, dig_major, dig_minor; +u32 res, dig_revision;int ret, irq; node = pdev->dev.of_node;
@@ -424,6 +427,11 @@ static int qpnp_tm_probe(struct platform_device *pdev)return dev_err_probe (&pdev->dev, ret,"could not read dig_major\n" ); + ret =qpnp_tm_read (chip,QPNP_TM_REG_DIG_MINOR , &dig_minor); +if (ret <0 ) +return dev_err_probe (&pdev->dev, ret, +"could not read dig_minor\n" ); +if (type !=QPNP_TM_TYPE || (subtype !=QPNP_TM_SUBTYPE_GEN1 && subtype !=QPNP_TM_SUBTYPE_GEN2 )) { dev_err(&pdev->dev, "invalid type 0x%02x or subtype 0x%02x\n",
@@ -437,6 +445,23 @@ static int qpnp_tm_probe(struct platform_device *pdev)else chip->temp_map = &temp_map_gen1; +if (chip->subtype ==QPNP_TM_SUBTYPE_GEN2 ) { + dig_revision = (dig_major <<8 ) | dig_minor; +/* +* Check if stage 2 automatic partial shutdown must remain +* enabled to avoid potential repeated faults upon reaching +* over-temperature stage 3. +*/ +switch (dig_revision) { +case 0x0001 : +case 0x0002 : +case 0x0100 : +case 0x0101 : + chip->require_stage2_shutdown = true; +break ; + } + } +/* * Register the sensor before initializing the hardware to be able to * read the trip points. get_temp() returns the default temperature
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/587 tools/nolibc: define time_t in terms of __kernel_old_time_t
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit d5094bcb5bfdfea2cf0de8aaf77cc65db56cbdb5 ]
Nolibc assumes that the kernel ABI is using a time values that are as large as a long integer. For most ABIs this holds true.
But for x32 this is not correct, as it uses 32bit longs but 64bit times.
Also the 'struct stat' implementation of nolibc relies on timespec::tv_sec and time_t being the same type. While timespec::tv_sec comes from the kernel and is of type __kernel_old_time_t, time_t is defined within nolibc.
Switch to the __kernel_old_time_t to always get the correct type.
--- tools/include/nolibc/std.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/include/nolibc/std.h +3 -1
@@ -20,6 +20,8 @@#include "stdint.h" +#include <linux/types.h> +/* those are commonly provided by sys/types.h */ typedef unsigned int dev_t ;typedef unsigned long ino_t ;
@@ -31,6 +33,6 @@ typedef unsigned long nlink_t;typedef signed long off_t ;typedef signed long blksize_t ;typedef signed long blkcnt_t ; -typedef signed long time_t ; +typedef __kernel_old_time_t time_t ;#endif /* _NOLIBC_STD_H */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/587 iio: adc: ad_sigma_delta: dont overallocate scan buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 5a2f15c5a8e017d0951e6dc62aa7b5b634f56881 ]
Fix overallocating the size of the scan buffer by converting bits to bytes. The size is meant to be in bytes, so scanbits needs to be divided by 8.
--- drivers/iio/adc/ad_sigma_delta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad_sigma_delta.c +1 -1
@@ -378,7 +378,7 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev)return ret; } - samples_buf_size =ALIGN (slot * indio_dev->channels[0 ].scan_type.storagebits,8 ); + samples_buf_size =ALIGN (slot * indio_dev->channels[0 ].scan_type.storagebits /8 ,8 ); samples_buf_size +=sizeof (int64_t ); samples_buf =devm_krealloc (&sigma_delta->spi->dev, sigma_delta->samples_buf, samples_buf_size,GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/587 gpio: tps65912: check the return value of regmap_update_bits()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit a0b2a6bbff8c26aafdecd320f38f52c341d5cafa ]
regmap_update_bits() can fail, check its return value like we do elsewhere in the driver.
--- drivers/gpio/gpio-tps65912.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpio/gpio-tps65912.c +5 -2
@@ -49,10 +49,13 @@ static int tps65912_gpio_direction_output(struct gpio_chip *gc, unsigned offset, int value) {struct tps65912_gpio *gpio =gpiochip_get_data (gc); +int ret;/* Set the initial value */ -regmap_update_bits (gpio->tps->regmap,TPS65912_GPIO1 + offset, -GPIO_SET_MASK , value ?GPIO_SET_MASK :0 ); + ret =regmap_update_bits (gpio->tps->regmap,TPS65912_GPIO1 + offset, +GPIO_SET_MASK , value ?GPIO_SET_MASK :0 ); +if (ret) +return ret;return regmap_update_bits (gpio->tps->regmap,TPS65912_GPIO1 + offset,GPIO_CFG_MASK ,GPIO_CFG_MASK );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/587 ARM: tegra: Use I/O memcpy to write to IRAM
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 398e67e0f5ae04b29bcc9cbf342e339fe9d3f6f1 ]
Kasan crashes the kernel trying to check boundaries when using the normal memcpy.
--- arch/arm/mach-tegra/reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-tegra/reset.c +1 -1
@@ -63,7 +63,7 @@ static void __init tegra_cpu_reset_handler_enable(void)BUG_ON (is_enabled);BUG_ON (tegra_cpu_reset_handler_size >TEGRA_IRAM_RESET_HANDLER_SIZE ); -memcpy (iram_base, (void *)__tegra_cpu_reset_handler_start, +memcpy_toio (iram_base, (void *)__tegra_cpu_reset_handler_start, tegra_cpu_reset_handler_size); err =call_firmware_op (set_cpu_boot_addr,0 , reset_address);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/587 tools/build: Fix s390(x) cross-compilation with clang
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit a40f0cdce78be8a559ee8a85c908049c65a410b2 ]
The heuristic to derive a clang target triple from a GCC one does not work for s390. GCC uses "s390-linux" while clang expects "s390x-linux" or "powerz-linux".
Add an explicit override.
--- tools/scripts/Makefile.include | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/scripts/Makefile.include +3 -1
@@ -98,7 +98,9 @@ else ifneq ($(CROSS_COMPILE),) # Allow userspace to override CLANG_CROSS_FLAGS to specify their own # sysroots and flags or to avoid the GCC call in pure Clang builds. ifeq ($(CLANG_CROSS_FLAGS),) -CLANG_CROSS_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%)) +CLANG_TARGET := $(notdir $(CROSS_COMPILE:%-=%)) +CLANG_TARGET := $(subst s390-linux,s390x-linux,$(CLANG_TARGET)) +CLANG_CROSS_FLAGS := --target=$(CLANG_TARGET) GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)gcc 2>/dev/null)) ifneq ($(GCC_TOOLCHAIN_DIR),) CLANG_CROSS_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/587 selftests: tracing: Use mutex_unlock for testing glob filter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit a089bb2822a49b0c5777a8936f82c1f8629231fb ]
Since commit c5b6ababd21a ("locking/mutex: implement mutex_trylock_nested") makes mutex_trylock() as an inlined function if CONFIG_DEBUG_LOCK_ALLOC=y, we can not use mutex_trylock() for testing the glob filter of ftrace.
Use mutex_unlock instead.
--- .../testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc +1 -1
@@ -29,7 +29,7 @@ ftrace_filter_check 'schedule*' '^schedule.*$' ftrace_filter_check '*pin*lock' '.*pin.*lock$' # filter by start*mid* -ftrace_filter_check 'mutex*try*' '^mutex.*try.*' +ftrace_filter_check 'mutex*unl*' '^mutex.*unl.*' # Advanced full-glob matching feature is recently supported. # Skip the tests if we are sure the kernel does not support it.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/587 ACPI: PRM: Reduce unnecessary printing to avoid user confusion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Qiyu <[email protected]>
[ Upstream commit 3db5648c4d608b5483470efc1da9780b081242dd ]
Commit 088984c8d54c ("ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context") introduced non-essential printing "Failed to find VA for GUID: xxxx, PA: 0x0" which may confuse users to think that something wrong is going on while it is not the case.
According to the PRM Spec Section 4.1.2 [1], both static data buffer address and ACPI parameter buffer address may be NULL if they are not needed, so there is no need to print out the "Failed to find VA ... " in those cases.
--- drivers/acpi/prmt.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-)
drivers/acpi/prmt.c +24 -2
@@ -85,8 +85,6 @@ static u64 efi_pa_va_lookup(efi_guid_t *guid, u64 pa) } } -pr_warn ("Failed to find VA for GUID: %pUL, PA: 0x%llx" , guid, pa); -return 0 ; }
@@ -154,13 +152,37 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)guid_copy (&th->guid, (guid_t *)handler_info->handler_guid); th->handler_addr = (void *)efi_pa_va_lookup (&th->guid, handler_info->handler_address); +/* +* Print a warning message if handler_addr is zero which is not expected to +* ever happen. +*/ +if (unlikely (!th->handler_addr)) +pr_warn ("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx" , + &th->guid, handler_info->handler_address); th->static_data_buffer_addr =efi_pa_va_lookup (&th->guid, handler_info->static_data_buffer_address); +/* +* According to the PRM specification, static_data_buffer_address can be zero, +* so avoid printing a warning message in that case. Otherwise, if the +* return value of efi_pa_va_lookup() is zero, print the message. +*/ +if (unlikely (!th->static_data_buffer_addr && handler_info->static_data_buffer_address)) +pr_warn ("Failed to find VA of static data buffer for GUID: %pUL, PA: 0x%llx" , + &th->guid, handler_info->static_data_buffer_address); th->acpi_param_buffer_addr =efi_pa_va_lookup (&th->guid, handler_info->acpi_param_buffer_address); +/* +* According to the PRM specification, acpi_param_buffer_address can be zero, +* so avoid printing a warning message in that case. Otherwise, if the +* return value of efi_pa_va_lookup() is zero, print the message. +*/ +if (unlikely (!th->acpi_param_buffer_addr && handler_info->acpi_param_buffer_address)) +pr_warn ("Failed to find VA of acpi param buffer for GUID: %pUL, PA: 0x%llx" , + &th->guid, handler_info->acpi_param_buffer_address); + }while (++cur_handler < tm->handler_count && (handler_info =get_next_handler (handler_info)));return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/587 firmware: tegra: Fix IVC dependency problems
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thierry Reding <[email protected]>
[ Upstream commit 78eb18020a88a4eed15f5af7700ed570642ff8f1 ]
The IVC code is library code that other drivers need to select if they need that library. However, if the symbol is user-selectable this can lead to conflicts.
Fix this by making the symbol only selectable for COMPILE_TEST and add a select TEGRA_IVC to TEGRA_BPMP, which is currently the only user.
--- drivers/firmware/tegra/Kconfig | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/firmware/tegra/Kconfig +3 -2
@@ -2,7 +2,7 @@ menu "Tegra firmware driver" config TEGRA_IVC - bool "Tegra IVC protocol" + bool "Tegra IVC protocol" if COMPILE_TEST depends on ARCH_TEGRA help IVC (Inter-VM Communication) protocol is part of the IPC
@@ -13,8 +13,9 @@ config TEGRA_IVC config TEGRA_BPMP bool "Tegra BPMP driver" - depends on ARCH_TEGRA && TEGRA_HSP_MBOX && TEGRA_IVC + depends on ARCH_TEGRA && TEGRA_HSP_MBOX depends on !CPU_BIG_ENDIAN + select TEGRA_IVC help BPMP (Boot and Power Management Processor) is designed to off-loading the PM functions which include clock/DVFS/thermal/power from the CPU.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/587 PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 89d9cec3b1e9c49bae9375a2db6dc49bc7468af0 ]
Clear power.needs_force_resume in pm_runtime_reinit() in case it has been set by pm_runtime_force_suspend() invoked from a driver remove callback.
--- drivers/base/power/runtime.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/base/power/runtime.c +5 -0
@@ -1754,6 +1754,11 @@ void pm_runtime_reinit(struct device *dev)pm_runtime_put (dev->parent); } } +/* +* Clear power.needs_force_resume in case it has been set by +* pm_runtime_force_suspend() invoked from a driver remove callback. +*/ + dev->power.needs_force_resume = false; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/587 thermal: sysfs: Return ENODATA instead of EAGAIN for reads
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Te Yuan <[email protected]>
[ Upstream commit 1a4aabc27e95674837f2e25f4ef340c0469e6203 ]
According to POSIX spec, EAGAIN returned by read with O_NONBLOCK set means the read would block. Hence, the common implementation in nonblocking model will poll the file when the nonblocking read returns EAGAIN. However, when the target file is thermal zone, this mechanism will totally malfunction because thermal zone doesn't implement sysfs notification and thus the poll will never return.
For example, the read in Golang implemnts such method and sometimes hangs at reading some thermal zones via sysfs.
Change to return -ENODATA instead of -EAGAIN to userspace.
--- drivers/thermal/thermal_sysfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/thermal/thermal_sysfs.c +6 -3
@@ -39,10 +39,13 @@ temp_show(struct device *dev, struct device_attribute *attr, char *buf) ret =thermal_zone_get_temp (tz, &temperature); -if (ret) -return ret; +if (!ret) +return sprintf (buf,"%d\n" , temperature); -return sprintf (buf,"%d\n" , temperature); +if (ret == -EAGAIN ) +return -ENODATA ; + +return ret; } static ssize_t
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/587 PM: sleep: console: Fix the black screen issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: tuhaowen <[email protected]>
[ Upstream commit 4266e8fa56d3d982bf451d382a410b9db432015c ]
When the computer enters sleep status without a monitor connected, the system switches the console to the virtual terminal tty63(SUSPEND_CONSOLE).
If a monitor is subsequently connected before waking up, the system skips the required VT restoration process during wake-up, leaving the console on tty63 instead of switching back to tty1.
To fix this issue, a global flag vt_switch_done is introduced to record whether the system has successfully switched to the suspend console via vt_move_to_console() during suspend.
If the switch was completed, vt_switch_done is set to 1. Later during resume, this flag is checked to ensure that the original console is restored properly by calling vt_move_to_console(orig_fgconsole, 0).
This prevents scenarios where the resume logic skips console restoration due to incorrect detection of the console state, especially when a monitor is reconnected before waking up.
--- kernel/power/console.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/power/console.c +6 -1
@@ -16,6 +16,7 @@#define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)static int orig_fgconsole, orig_kmsg; +static bool vt_switch_done;static DEFINE_MUTEX (vt_switch_mutex);
@@ -136,17 +137,21 @@ void pm_prepare_console(void)if (orig_fgconsole <0 )return ; + vt_switch_done = true; + orig_kmsg =vt_kmsg_redirect (SUSPEND_CONSOLE );return ; }void pm_restore_console (void ) { -if (!pm_vt_switch ()) +if (!pm_vt_switch () && !vt_switch_done)return ;if (orig_fgconsole >=0 ) {vt_move_to_console (orig_fgconsole,0 );vt_kmsg_redirect (orig_kmsg); } + + vt_switch_done = false; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/587 ACPI: processor: fix acpi_object initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Ott <[email protected]>
[ Upstream commit 13edf7539211d8f7d0068ce3ed143005f1da3547 ]
Initialization of the local acpi_object in acpi_processor_get_info() only sets the first 4 bytes to zero and is thus incomplete. This is indicated by messages like:
acpi ACPI0007:be: Invalid PBLK length [166288104]
Fix this by initializing all 16 bytes of the processor member of that union.
--- drivers/acpi/acpi_processor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpi_processor.c +1 -1
@@ -250,7 +250,7 @@ static inline int acpi_processor_hotadd_init(struct acpi_processor *pr)static int acpi_processor_get_info (struct acpi_device *device) { -union acpi_object object = {0 }; +union acpi_object object = { .processor = {0 } };struct acpi_buffer buffer = {sizeof (union acpi_object ), &object };struct acpi_processor *pr =acpi_driver_data (device);int device_declaration =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/587 mmc: sdhci-msm: Ensure SD card power isnt ON when card removed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <[email protected]>
[ Upstream commit db58532188ebf51d52b1d7693d9e94c76b926e9f ]
Many mobile phones feature multi-card tray designs, where the same tray is used for both SD and SIM cards. If the SD card is placed at the outermost location in the tray, the SIM card may come in contact with SD card power-supply while removing the tray, possibly resulting in SIM damage.
To prevent that, make sure the SD card is really inserted by reading the Card Detect pin state. If it's not, turn off the power in sdhci_msm_check_power_status() and also set the BUS_FAIL power state on the controller as part of pwr_irq handling for BUS_ON request.
--- drivers/mmc/host/sdhci-msm.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/mmc/host/sdhci-msm.c +14 -0
@@ -1564,6 +1564,7 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type) {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_msm_host *msm_host =sdhci_pltfm_priv (pltfm_host); +struct mmc_host *mmc = host->mmc;bool done = false;u32 val =SWITCHABLE_SIGNALING_VOLTAGE ; const struct sdhci_msm_offset *msm_offset =
@@ -1621,6 +1622,12 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type)"%s: pwr_irq for req: (%d) timed out\n" , mmc_hostname(host->mmc), req_type); } + +if ((req_type &REQ_BUS_ON ) && mmc->card && !mmc->ops->get_cd (mmc)) { +sdhci_writeb (host,0 ,SDHCI_POWER_CONTROL ); + host->pwr =0 ; + } +pr_debug ("%s: %s: request %d done\n" ,mmc_hostname (host->mmc), __func__, req_type); }
@@ -1679,6 +1686,13 @@ static void sdhci_msm_handle_pwr_irq(struct sdhci_host *host, int irq)udelay (10 ); } +if ((irq_status &CORE_PWRCTL_BUS_ON ) && mmc->card && + !mmc->ops->get_cd (mmc)) { +msm_host_writel (msm_host,CORE_PWRCTL_BUS_FAIL , host, + msm_offset->core_pwrctl_ctl); +return ; + } +/* Handle BUS ON/OFF*/ if (irq_status &CORE_PWRCTL_BUS_ON ) { pwr_state =REQ_BUS_ON ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/587 ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 4734c8b46b901cff2feda8b82abc710b65dc31c1 ]
When a GHES (Generic Hardware Error Source) triggers a panic, add the TAINT_MACHINE_CHECK taint flag to the kernel. This explicitly marks the kernel as tainted due to a machine check event, improving diagnostics and post-mortem analysis. The taint is set with LOCKDEP_STILL_OK to indicate lockdep remains valid.
At large scale deployment, this helps to quickly determine panics that are coming due to hardware failures.
--- drivers/acpi/apei/ghes.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/apei/ghes.c +2 -0
@@ -912,6 +912,8 @@ static void __ghes_panic(struct ghes *ghes,__ghes_print_estatus (KERN_EMERG , ghes->generic, estatus); +add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_STILL_OK ); +ghes_clear_estatus (ghes, estatus, buf_paddr, fixmap_idx);if (!panic_timeout)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/587 pps: clients: gpio: fix interrupt handling order in remove path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliav Farber <[email protected]>
[ Upstream commit 6bca1e955830808dc90e0506b2951b4256b81bbb ]
The interrupt handler in pps_gpio_probe() is registered after calling pps_register_source() using devm_request_irq(). However, in the corresponding remove function, pps_unregister_source() is called before the IRQ is freed, since devm-managed resources are released after the remove function completes.
This creates a potential race condition where an interrupt may occur after the PPS source is unregistered but before the handler is removed, possibly leading to a kernel panic.
To prevent this, switch from devm-managed IRQ registration to manual management by using request_irq() and calling free_irq() explicitly in the remove path before unregistering the PPS source. This ensures the interrupt handler is safely removed before deactivating the PPS source.
--- drivers/pps/clients/pps-gpio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/pps/clients/pps-gpio.c +3 -2
@@ -206,8 +206,8 @@ static int pps_gpio_probe(struct platform_device *pdev) }/* register IRQ interrupt handler */ - ret =devm_request_irq (dev, data->irq, pps_gpio_irq_handler, -get_irqf_trigger_flags (data), data->info.name, data); + ret =request_irq (data->irq, pps_gpio_irq_handler, +get_irqf_trigger_flags (data), data->info.name, data);if (ret) {pps_unregister_source (data->pps);dev_err (dev,"failed to acquire IRQ %d\n" , data->irq);
@@ -224,6 +224,7 @@ static int pps_gpio_remove(struct platform_device *pdev) {struct pps_gpio_device_data *data =platform_get_drvdata (pdev); +free_irq (data->irq, data);pps_unregister_source (data->pps);del_timer_sync (&data->echo_timer);/* reset echo pin in any case */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/587 reset: brcmstb: Enable reset drivers for ARCH_BCM2835
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Robinson <[email protected]>
[ Upstream commit 1d99f92f71b6b4b2eee776562c991428490f71ef ]
The BRCMSTB and BRCMSTB_RESCAL reset drivers are also used in the BCM2712, AKA the RPi5. The RPi platforms have typically used the ARCH_BCM2835, and the PCIe support for this SoC can use this config which depends on these drivers so enable building them when just that arch option is enabled to ensure the platform works as expected.
--- drivers/reset/Kconfig | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/reset/Kconfig +5 -5
@@ -51,8 +51,8 @@ config RESET_BERLIN config RESET_BRCMSTB tristate "Broadcom STB reset controller" - depends on ARCH_BRCMSTB || COMPILE_TEST - default ARCH_BRCMSTB + depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST + default ARCH_BRCMSTB || ARCH_BCM2835 help This enables the reset controller driver for Broadcom STB SoCs using a SUN_TOP_CTRL_SW_INIT style controller.
@@ -60,11 +60,11 @@ config RESET_BRCMSTB config RESET_BRCMSTB_RESCAL tristate "Broadcom STB RESCAL reset controller" depends on HAS_IOMEM - depends on ARCH_BRCMSTB || COMPILE_TEST - default ARCH_BRCMSTB + depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST + default ARCH_BRCMSTB || ARCH_BCM2835 help This enables the RESCAL reset controller for SATA, PCIe0, or PCIe1 on - BCM7216. + BCM7216 or the BCM2712. config RESET_HSDK bool "Synopsys HSDK Reset Driver"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/587 char: misc: Fix improper and inaccurate error code returned by misc_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 0ef1fe4bc38673db72e39b700b29c50dfcc5a415 ]
misc_init() returns -EIO for __register_chrdev() invocation failure, but:
- -EIO is for I/O error normally, but __register_chrdev() does not do I/O.
- -EIO can not cover various error codes returned by __register_chrdev().
Fix by returning error code of __register_chrdev().
--- drivers/char/misc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/misc.c +2 -2
@@ -314,8 +314,8 @@ static int __init misc_init(void)if (err) goto fail_remove; - err = -EIO ; -if (__register_chrdev (MISC_MAJOR ,0 ,MINORMASK +1 ,"misc" , &misc_fops)) + err =__register_chrdev (MISC_MAJOR ,0 ,MINORMASK +1 ,"misc" , &misc_fops); +if (err <0 ) goto fail_printk;return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/587 mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 ]
mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl) belonging to the device being released.
If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers, the mei-client being freed might still be part of the mei_device's file_list and iterating over this list after the freeing will then trigger a use-afer-free bug.
Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed mei-client is not on the mei_device's file_list.
--- drivers/misc/mei/bus.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/misc/mei/bus.c +6 -0
@@ -1269,10 +1269,16 @@ static void mei_dev_bus_put(struct mei_device *bus)static void mei_cl_bus_dev_release (struct device *dev) {struct mei_cl_device *cldev =to_mei_cl_device (dev); +struct mei_device *mdev = cldev->cl->dev; +struct mei_cl *cl;mei_cl_flush_queues (cldev->cl,NULL );mei_me_cl_put (cldev->me_cl);mei_dev_bus_put (cldev->bus); + +list_for_each_entry (cl, &mdev->file_list, link) +WARN_ON (cl == cldev->cl); +kfree (cldev->cl);kfree (cldev); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/587 mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
[ Upstream commit 47a255f7d2eabee06cfbf5b1c2379749442fd01d ]
In the error path of sd_set_power_mode() we don't update host->power_mode, which could lead to an imbalance of the runtime PM usage count. Fix this by always updating host->power_mode.
--- drivers/mmc/host/rtsx_usb_sdmmc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/mmc/host/rtsx_usb_sdmmc.c +1 -3
@@ -1032,9 +1032,7 @@ static int sd_set_power_mode(struct rtsx_usb_sdmmc *host, err =sd_power_on (host); } -if (!err) - host->power_mode = power_mode; - + host->power_mode = power_mode;return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/587 ALSA: hda: Handle the jack polling always via a work
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 5f7e54b23e4d253eff3b10b12d6fa92d28d7dddc ]
We used to call directly hda_jackpoll_work() from a couple of places for updating the jack and notify to user-space, but this makes rather the code flow fragile. Namely, because of those direct calls, hda_jackpoll_work() uses snd_hda_power_up_pm() and *_down_pm() calls instead of the standard snd_hda_power_up() and *_down() calls. The latter pair assures the runtime PM resume sync, so it can avoid the race against the PM callbacks gracefully, while the former pair may continue if called concurrently, hence it may race (by design).
In this patch, we change the call pattern of hda_jackpoll_work(); now all callers are replaced with the standard snd_hda_jack_report_sync() and the additional schedule_delayed_work().
Since hda_jackpoll_work() is called only from the associated work, it's always outside the PM code path, and we can safely use snd_hda_power_up() and *_down() there instead. This allows us to remove the racy check of power-state in hda_jackpoll_work(), as well as the tricky cancel_delayed_work() and rescheduling at hda_codec_runtime_suspend().
--- sound/pci/hda/hda_codec.c | 41 +++++++++++++-------------------------- 1 file changed, 14 insertions(+), 27 deletions(-)
sound/pci/hda/hda_codec.c +14 -27
@@ -641,24 +641,16 @@ static void hda_jackpoll_work(struct work_struct *work)struct hda_codec *codec = container_of(work, struct hda_codec, jackpoll_work.work); -/* for non-polling trigger: we need nothing if already powered on */ -if (!codec->jackpoll_interval &&snd_hdac_is_power_on (&codec->core)) +if (!codec->jackpoll_interval)return ;/* the power-up/down sequence triggers the runtime resume */ -snd_hda_power_up_pm (codec); +snd_hda_power_up (codec);/* update jacks manually if polling is required, too */ -if (codec->jackpoll_interval) { -snd_hda_jack_set_dirty_all (codec); -snd_hda_jack_poll_all (codec); - } -snd_hda_power_down_pm (codec); - -if (!codec->jackpoll_interval) -return ; - -schedule_delayed_work (&codec->jackpoll_work, - codec->jackpoll_interval); +snd_hda_jack_set_dirty_all (codec); +snd_hda_jack_poll_all (codec); +schedule_delayed_work (&codec->jackpoll_work, codec->jackpoll_interval); +snd_hda_power_down (codec); }/* release all pincfg lists */
@@ -2920,12 +2912,12 @@ static void hda_call_codec_resume(struct hda_codec *codec)snd_hda_regmap_sync (codec); } -if (codec->jackpoll_interval) -hda_jackpoll_work (&codec->jackpoll_work.work); -else -snd_hda_jack_report_sync (codec); +snd_hda_jack_report_sync (codec); codec->core.dev.power.power_state =PMSG_ON ;snd_hdac_leave_pm (&codec->core); +if (codec->jackpoll_interval) +schedule_delayed_work (&codec->jackpoll_work, + codec->jackpoll_interval); }static int hda_codec_runtime_suspend (struct device *dev)
@@ -2937,8 +2929,6 @@ static int hda_codec_runtime_suspend(struct device *dev)if (!codec->card)return 0 ; -cancel_delayed_work_sync (&codec->jackpoll_work); - state =hda_call_codec_suspend (codec); if (codec->link_down_at_suspend || (codec_has_clkstop(codec) && codec_has_epss(codec) &&
@@ -2946,10 +2936,6 @@ static int hda_codec_runtime_suspend(struct device *dev)snd_hdac_codec_link_down (&codec->core);snd_hda_codec_display_power (codec, false); -if (codec->bus->jackpoll_in_suspend && - (dev->power.power_state.event !=PM_EVENT_SUSPEND )) -schedule_delayed_work (&codec->jackpoll_work, - codec->jackpoll_interval);return 0 ; }
@@ -3118,10 +3104,11 @@ int snd_hda_codec_build_controls(struct hda_codec *codec)if (err <0 )return err; +snd_hda_jack_report_sync (codec);/* call at the last init point */ if (codec->jackpoll_interval) -hda_jackpoll_work (&codec->jackpoll_work.work); -else -snd_hda_jack_report_sync (codec);/* call at the last init point */ +schedule_delayed_work (&codec->jackpoll_work, + codec->jackpoll_interval); +sync_power_up_states (codec);return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/587 ALSA: hda: Disable jack polling at shutdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 1adcbdf54f76e1004bdf71df4eb1888c26e7ad06 ]
Although the jack polling is canceled at shutdown in snd_hda_codec_shutdown(), it might be still re-triggered when the work is being processed at cancel_delayed_work_sync() call. This may result in the unexpected hardware access that should have been already disabled.
For assuring to stop the jack polling, clear codec->jackpoll_interval at shutdown.
--- sound/pci/hda/hda_codec.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/hda_codec.c +1 -0
@@ -3038,6 +3038,7 @@ void snd_hda_codec_shutdown(struct hda_codec *codec)if (!codec->core.registered)return ; + codec->jackpoll_interval =0 ;/* don't poll any longer */ cancel_delayed_work_sync (&codec->jackpoll_work);list_for_each_entry (cpcm, &codec->pcm_list_head, list)snd_pcm_suspend_all (cpcm->pcm);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/587 x86/bugs: Avoid warning when overriding return thunk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
[ Upstream commit 9f85fdb9fc5a1bd308a10a0a7d7e34f2712ba58b ]
The purpose of the warning is to prevent an unexpected change to the return thunk mitigation. However, there are legitimate cases where the return thunk is intentionally set more than once. For example, ITS and SRSO both can set the return thunk after retbleed has set it. In both the cases retbleed is still mitigated.
Replace the warning with an info about the active return thunk.
--- arch/x86/kernel/cpu/bugs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/kernel/cpu/bugs.c +2 -3
@@ -71,10 +71,9 @@ void (*x86_return_thunk)(void) __ro_after_init = __x86_return_thunk;static void __init set_return_thunk (void *thunk) { -if (x86_return_thunk != __x86_return_thunk) -pr_warn ("x86/bugs: return thunk changed\n" ); - x86_return_thunk = thunk; + +pr_info ("active return thunk: %ps\n" , thunk); }/* Update SPEC_CTRL MSR and its cached copy unconditionally */
Signature · 1 line
2.39.5