6.1.150-rc1 review
Greg Kroah-Hartman
maintainercover 6.1.150-rc1 review
This is the start of the stable review cycle for the 6.1.150 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.150-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.150-rc1
Eric Sandeen <[email protected]>
xfs: do not propagate ENODATA disk errors into xattr code
Imre Deak <[email protected]>
Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
Hamish Martin <[email protected]>
HID: mcp2221: Handle reads greater than 60 bytes
Hamish Martin <[email protected]>
HID: mcp2221: Don't set bus speed on every transfer
Eric Dumazet <[email protected]>
net: rose: fix a typo in rose_clear_routes()
James Jones <[email protected]>
drm/nouveau/disp: Always accept linear modifier
Steve French <[email protected]>
smb3 client: fix return code mapping of remap_file_range
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
Shuhao Fu <[email protected]>
fs/smb: Fix inconsistent refcnt update
Shanker Donthineni <[email protected]>
dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
Alex Deucher <[email protected]>
Revert "drm/amdgpu: fix incorrect vm flags to map bo"
Minjong Kim <[email protected]>
HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
Ping Cheng <[email protected]>
HID: wacom: Add a new Art Pen 2
Qasim Ijaz <[email protected]>
HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
Qasim Ijaz <[email protected]>
HID: asus: fix UAF via HID_CLAIMED_INPUT validation
Thijs Raymakers <[email protected]>
KVM: x86: use array_index_nospec with indices that come from guest
Li Nan <[email protected]>
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
Eric Dumazet <[email protected]>
sctp: initialize more fields in sctp_v6_from_sk()
Takamitsu Iwai <[email protected]>
net: rose: include node references in rose_neigh refcount
Takamitsu Iwai <[email protected]>
net: rose: convert 'use' field to refcount_t
Takamitsu Iwai <[email protected]>
net: rose: split remove and free operations in rose_remove_neigh()
Rohan G Thomas <[email protected]>
net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
Alexei Lazar <[email protected]>
net/mlx5e: Set local Xoff after FW update
Alexei Lazar <[email protected]>
net/mlx5e: Update and set Xon/Xoff upon port speed set
Alexei Lazar <[email protected]>
net/mlx5e: Update and set Xon/Xoff upon MTU set
Moshe Shemesh <[email protected]>
net/mlx5: Reload auxiliary drivers on fw_activate
Horatiu Vultur <[email protected]>
phy: mscc: Fix when PTP clock is register and unregister
Yeounsu Moon <[email protected]>
net: dlink: fix multicast stats being counted incorrectly
Kuniyuki Iwashima <[email protected]>
atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
Pavel Shpakovskiy <[email protected]>
Bluetooth: hci_sync: fix set_local_name race condition
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
Ludovico de Nittis <[email protected]>
Bluetooth: hci_event: Mark connection as closed during suspend disconnect
Ludovico de Nittis <[email protected]>
Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
José Expósito <[email protected]>
HID: input: report battery status changes immediately
José Expósito <[email protected]>
HID: input: rename hidinput_set_battery_charge_status()
Madhavan Srinivasan <[email protected]>
powerpc/kvm: Fix ifdef to remove build warning
Rob Clark <[email protected]>
drm/msm: Defer fd_install in SUBMIT ioctl
Oscar Maes <[email protected]>
net: ipv4: fix regression in local-broadcast routes
Nikolay Kuratov <[email protected]>
vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
Trond Myklebust <[email protected]>
NFS: Fix a race when updating an existing write
Christoph Hellwig <[email protected]>
nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
Werner Sembach <[email protected]>
ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
Alexey Klimov <[email protected]>
ASoC: codecs: tx-macro: correct tx_macro_component_drv name
Paulo Alcantara <[email protected]>
smb: client: fix race with concurrent opens in rename(2)
Paulo Alcantara <[email protected]>
smb: client: fix race with concurrent opens in unlink(2)
Damien Le Moal <[email protected]>
scsi: core: sysfs: Correct sysfs attributes access rights
Tengda Wu <[email protected]>
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: xway: sysctrl: rename the etop node
Aleksander Jan Bajkowski <[email protected]>
mips: dts: lantiq: danube: add missing burst length property
Randy Dunlap <[email protected]>
pinctrl: STMFX: add missing HAS_IOMEM dependency
-------------
Diffstat:
Makefile | 4 +- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 5 +- arch/mips/lantiq/xway/sysctrl.c | 10 +- arch/powerpc/kernel/kvm.c | 8 +- arch/x86/kvm/lapic.c | 2 + arch/x86/kvm/x86.c | 7 +- drivers/acpi/ec.c | 6 + drivers/atm/atmtcp.c | 17 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 +- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 14 +- drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 + drivers/hid/hid-asus.c | 8 +- drivers/hid/hid-input-test.c | 10 +- drivers/hid/hid-input.c | 51 ++++---- drivers/hid/hid-mcp2221.c | 71 +++++++---- drivers/hid/hid-multitouch.c | 8 ++ drivers/hid/hid-ntrig.c | 3 + drivers/hid/wacom_wac.c | 1 + drivers/net/ethernet/dlink/dl2k.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 ++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 ++- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 4 - drivers/net/phy/mscc/mscc.h | 4 + drivers/net/phy/mscc/mscc_main.c | 4 +- drivers/net/phy/mscc/mscc_ptp.c | 34 +++-- drivers/net/usb/qmi_wwan.c | 3 + drivers/pinctrl/Kconfig | 1 + drivers/scsi/scsi_sysfs.c | 4 +- drivers/vhost/net.c | 9 +- fs/efivarfs/super.c | 4 + fs/nfs/pagelist.c | 86 +------------ fs/nfs/write.c | 142 +++++++++++++-------- fs/smb/client/cifsfs.c | 14 ++ fs/smb/client/inode.c | 34 ++++- fs/smb/client/smb2inode.c | 7 +- fs/xfs/libxfs/xfs_attr_remote.c | 7 + fs/xfs/libxfs/xfs_da_btree.c | 6 + include/linux/atmdev.h | 1 + include/linux/nfs_page.h | 2 +- include/net/bluetooth/hci_sync.h | 2 +- include/net/rose.h | 18 ++- kernel/dma/pool.c | 4 +- kernel/trace/trace.c | 4 +- net/atm/common.c | 15 ++- net/bluetooth/hci_event.c | 20 ++- net/bluetooth/hci_sync.c | 6 +- net/bluetooth/mgmt.c | 5 +- net/ipv4/route.c | 10 +- net/rose/af_rose.c | 13 +- net/rose/rose_in.c | 12 +- net/rose/rose_route.c | 62 +++++---- net/rose/rose_timer.c | 2 +- net/sctp/ipv6.c | 2 + sound/soc/codecs/lpass-tx-macro.c | 2 +- 57 files changed, 514 insertions(+), 302 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/50 pinctrl: STMFX: add missing HAS_IOMEM dependency
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit a12946bef0407cf2db0899c83d42c47c00af3fbc ]
When building on ARCH=um (which does not set HAS_IOMEM), kconfig reports an unmet dependency caused by PINCTRL_STMFX. It selects MFD_STMFX, which depends on HAS_IOMEM. To stop this warning, PINCTRL_STMFX should also depend on HAS_IOMEM.
kconfig warning:
WARNING: unmet direct dependencies detected for MFD_STMFX
Depends on [n]: HAS_IOMEM [=n] && I2C [=y] && OF [=y] Selected by [y]:
- PINCTRL_STMFX [=y] && PINCTRL [=y] && I2C [=y] && OF_GPIO [=y]
--- drivers/pinctrl/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/Kconfig +1 -0
@@ -438,6 +438,7 @@ config PINCTRL_STMFX tristate "STMicroelectronics STMFX GPIO expander pinctrl driver" depends on I2C depends on OF_GPIO + depends on HAS_IOMEM select GENERIC_PINCONF select GPIOLIB_IRQCHIP select MFD_STMFX
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 2/50 mips: dts: lantiq: danube: add missing burst length property
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 7b28232921782aa38048249132899c337405eaa8 ]
The upstream dts lacks the lantiq,{rx/tx}-burst-length property. Other
issues were also fixed:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'interrupt-names' is a required property
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'lantiq,tx-burst-length' is a required property
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'lantiq,rx-burst-length' is a required property
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#
--- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 3 +++ 1 file changed, 3 insertions(+)
arch/mips/boot/dts/lantiq/danube_easy50712.dts +3 -0
@@ -87,8 +87,11 @@ etop@e180000 { reg = <0xe180000 0x40000>; interrupt-parent = <&icu0>; interrupts = <73 78>; + interrupt-names = "tx", "rx"; phy-mode = "rmii"; mac-address = [ 00 11 22 33 44 55 ]; + lantiq,rx-burst-length = <4>; + lantiq,tx-burst-length = <4>; }; stp0: stp@e100bb0 {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 3/50 mips: lantiq: xway: sysctrl: rename the etop node
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 8c431ea8f3f795c4b9cfa57a85bc4166b9cce0ac ]
Bindig requires a node name matching ‘^ethernet@[0-9a-f]+$’. This patch changes the clock name from “etop” to “ethernet”.
This fixes the following warning:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): $nodename:0: 'etop@e180000' does not match '^ethernet@[0-9a-f]+$'
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#
--- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +- arch/mips/lantiq/xway/sysctrl.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/mips/boot/dts/lantiq/danube_easy50712.dts +1 -1
@@ -82,7 +82,7 @@ conf_out { }; }; - etop@e180000 { + ethernet@e180000 { compatible = "lantiq,etop-xway"; reg = <0xe180000 0x40000>; interrupt-parent = <&icu0>;
arch/mips/lantiq/xway/sysctrl.c +5 -5
@@ -479,7 +479,7 @@ void __init ltq_soc_init(void) ifccr =CGU_IFCCR_VR9 ; pcicr =CGU_PCICR_VR9 ; }else { -clkdev_add_pmu ("1e180000.etop" ,NULL ,1 ,0 ,PMU_PPE ); +clkdev_add_pmu ("1e180000.ethernet" ,NULL ,1 ,0 ,PMU_PPE ); }if (!of_machine_is_compatible ("lantiq,ase" ))
@@ -513,9 +513,9 @@ void __init ltq_soc_init(void) CLOCK_133M, CLOCK_133M);clkdev_add_pmu ("1e101000.usb" ,"otg" ,1 ,0 ,PMU_USB0 );clkdev_add_pmu ("1f203018.usb2-phy" ,"phy" ,1 ,0 ,PMU_USB0_P ); -clkdev_add_pmu ("1e180000.etop" ,"ppe" ,1 ,0 ,PMU_PPE ); -clkdev_add_cgu ("1e180000.etop" ,"ephycgu" ,CGU_EPHY ); -clkdev_add_pmu ("1e180000.etop" ,"ephy" ,1 ,0 ,PMU_EPHY ); +clkdev_add_pmu ("1e180000.ethernet" ,"ppe" ,1 ,0 ,PMU_PPE ); +clkdev_add_cgu ("1e180000.ethernet" ,"ephycgu" ,CGU_EPHY ); +clkdev_add_pmu ("1e180000.ethernet" ,"ephy" ,1 ,0 ,PMU_EPHY );clkdev_add_pmu ("1e103000.sdio" ,NULL ,1 ,0 ,PMU_ASE_SDIO );clkdev_add_pmu ("1e116000.mei" ,"dfe" ,1 ,0 ,PMU_DFE ); }else if (of_machine_is_compatible ("lantiq,grx390" )) {
@@ -574,7 +574,7 @@ void __init ltq_soc_init(void)clkdev_add_pmu ("1e101000.usb" ,"otg" ,1 ,0 ,PMU_USB0 |PMU_AHBM );clkdev_add_pmu ("1f203034.usb2-phy" ,"phy" ,1 ,0 ,PMU_USB1_P );clkdev_add_pmu ("1e106000.usb" ,"otg" ,1 ,0 ,PMU_USB1 |PMU_AHBM ); -clkdev_add_pmu ("1e180000.etop" ,"switch" ,1 ,0 ,PMU_SWITCH ); +clkdev_add_pmu ("1e180000.ethernet" ,"switch" ,1 ,0 ,PMU_SWITCH );clkdev_add_pmu ("1e103000.sdio" ,NULL ,1 ,0 ,PMU_SDIO );clkdev_add_pmu ("1e103100.deu" ,NULL ,1 ,0 ,PMU_DEU );clkdev_add_pmu ("1e116000.mei" ,"dfe" ,1 ,0 ,PMU_DFE );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 4/50 ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <[email protected]>
[ Upstream commit 4013aef2ced9b756a410f50d12df9ebe6a883e4a ]
When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition.
The issue occurs because:
CPU0 (ftrace_dump) CPU1 (reader)
echo z > /proc/sysrq-trigger
!trace_empty(&iter)trace_iterator_reset(&iter) <- len = size = 0
cat /sys/kernel/tracing/trace_pipetrace_find_next_entry_inc(&iter)
__find_next_entry
ring_buffer_empty_cpu <- all empty
return NULL
trace_printk_seq(&iter.seq)
WARN_ON_ONCE(s->seq.len >= s->seq.size)
In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate iter.seq. At this point, due to the prior trace_iterator_reset, both iter.seq.len and iter.seq.size were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered.
Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.
--- kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/trace.c +2 -2
@@ -10183,10 +10183,10 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) ret =print_trace_line (&iter);if (ret !=TRACE_TYPE_NO_CONSUME )trace_consume (&iter); + +trace_printk_seq (&iter.seq); }touch_nmi_watchdog (); - -trace_printk_seq (&iter.seq); }if (!cnt)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 5/50 scsi: core: sysfs: Correct sysfs attributes access rights
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit a2f54ff15c3bdc0132e20aae041607e2320dbd73 ]
The SCSI sysfs attributes "supported_mode" and "active_mode" do not define a store method and thus cannot be modified. Correct the DEVICE_ATTR() call for these two attributes to not include S_IWUSR to allow write access as they are read-only.
--- drivers/scsi/scsi_sysfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/scsi_sysfs.c +2 -2
@@ -265,7 +265,7 @@ show_shost_supported_mode(struct device *dev, struct device_attribute *attr,return show_shost_mode (supported_mode, buf); } -static DEVICE_ATTR(supported_mode, S_IRUGO | S_IWUSR, show_shost_supported_mode, NULL); +static DEVICE_ATTR(supported_mode, S_IRUGO, show_shost_supported_mode, NULL); static ssize_t show_shost_active_mode(struct device *dev,
@@ -279,7 +279,7 @@ show_shost_active_mode(struct device *dev,return show_shost_mode (shost->active_mode, buf); } -static DEVICE_ATTR(active_mode, S_IRUGO | S_IWUSR, show_shost_active_mode, NULL); +static DEVICE_ATTR(active_mode, S_IRUGO, show_shost_active_mode, NULL);static int check_reset_type (const char *str) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 6/50 smb: client: fix race with concurrent opens in unlink(2)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 0af1561b2d60bab2a2b00720a5c7b292ecc549ec ]
According to some logs reported by customers, CIFS client might end up reporting unlinked files as existing in stat(2) due to concurrent opens racing with unlink(2).
Besides sending the removal request to the server, the unlink process could involve closing any deferred close as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens.
Fix this by unhashing the dentry in cifs_unlink() to prevent any subsequent opens. Any open attempts, while we're still unlinking, will block on parent's i_rwsem.
--- fs/smb/client/inode.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
fs/smb/client/inode.c +14 -2
@@ -1649,15 +1649,24 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)struct cifs_sb_info *cifs_sb =CIFS_SB (sb);struct tcon_link *tlink;struct cifs_tcon *tcon; +__u32 dosattr =0 , origattr =0 ;struct TCP_Server_Info *server;struct iattr *attrs =NULL ; -__u32 dosattr =0 , origattr =0 ; +bool rehash = false;cifs_dbg (FYI ,"cifs_unlink, dir=0x%p, dentry=0x%p\n" , dir, dentry);if (unlikely (cifs_forced_shutdown (cifs_sb)))return -EIO ; +/* Unhash dentry in advance to prevent any concurrent opens */ +spin_lock (&dentry->d_lock); +if (!d_unhashed (dentry)) { +__d_drop (dentry); + rehash = true; + } +spin_unlock (&dentry->d_lock); + tlink =cifs_sb_tlink (cifs_sb);if (IS_ERR (tlink))return PTR_ERR (tlink);
@@ -1706,7 +1715,8 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)if (inode)cifs_drop_nlink (inode); }else if (rc == -ENOENT ) { -d_drop (dentry); +if (simple_positive (dentry)) +d_delete (dentry); }else if (rc == -EBUSY ) {if (server->ops->rename_pending_delete) { rc = server->ops->rename_pending_delete(full_path,
@@ -1757,6 +1767,8 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)kfree (attrs);free_xid (xid);cifs_put_tlink (tlink); +if (rehash) +d_rehash (dentry);return rc; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 7/50 smb: client: fix race with concurrent opens in rename(2)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit d84291fc7453df7881a970716f8256273aca5747 ]
Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file.
Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.
--- fs/smb/client/inode.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
fs/smb/client/inode.c +18 -0
@@ -2165,6 +2165,7 @@ cifs_rename2(struct user_namespace *mnt_userns, struct inode *source_dir,struct cifs_sb_info *cifs_sb;struct tcon_link *tlink;struct cifs_tcon *tcon; +bool rehash = false;unsigned int xid;int rc, tmprc;int retry_count =0 ;
@@ -2180,6 +2181,17 @@ cifs_rename2(struct user_namespace *mnt_userns, struct inode *source_dir,if (unlikely (cifs_forced_shutdown (cifs_sb)))return -EIO ; +/* +* Prevent any concurrent opens on the target by unhashing the dentry. +* VFS already unhashes the target when renaming directories. +*/ +if (d_is_positive (target_dentry) && !d_is_dir (target_dentry)) { +if (!d_unhashed (target_dentry)) { +d_drop (target_dentry); + rehash = true; + } + } + tlink =cifs_sb_tlink (cifs_sb);if (IS_ERR (tlink))return PTR_ERR (tlink);
@@ -2219,6 +2231,8 @@ cifs_rename2(struct user_namespace *mnt_userns, struct inode *source_dir, } } +if (!rc) + rehash = false;/* * No-replace is the natural behavior for CIFS, so skip unlink hacks. */
@@ -2277,6 +2291,8 @@ cifs_rename2(struct user_namespace *mnt_userns, struct inode *source_dir, goto cifs_rename_exit; rc =cifs_do_rename (xid, source_dentry, from_name, target_dentry, to_name); +if (!rc) + rehash = false; }/* force revalidate to go get info when needed */
@@ -2286,6 +2302,8 @@ cifs_rename2(struct user_namespace *mnt_userns, struct inode *source_dir, target_dir->i_mtime =current_time (source_dir); cifs_rename_exit: +if (rehash) +d_rehash (target_dentry);kfree (info_buf_source);free_dentry_path (page2);free_dentry_path (page1);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 8/50 ASoC: codecs: tx-macro: correct tx_macro_component_drv name
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
[ Upstream commit 43e0da37d5cfb23eec6aeee9422f84d86621ce2b ]
We already have a component driver named "RX-MACRO", which is lpass-rx-macro.c. The tx macro component driver's name should be "TX-MACRO" accordingly. Fix it.
--- sound/soc/codecs/lpass-tx-macro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/lpass-tx-macro.c +1 -1
@@ -1795,7 +1795,7 @@ static int tx_macro_register_mclk_output(struct tx_macro *tx) }static const struct snd_soc_component_driver tx_macro_component_drv = { - .name ="RX-MACRO" , + .name ="TX-MACRO" , .probe = tx_macro_component_probe, .controls = tx_macro_snd_controls, .num_controls =ARRAY_SIZE (tx_macro_snd_controls),
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 9/50 ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <[email protected]>
commit 9cd51eefae3c871440b93c03716c5398f41bdf78 upstream.
Add the TUXEDO InfinityBook Pro AMD Gen9 to the acpi_ec_no_wakeup[] quirk list to prevent spurious wakeups.
--- drivers/acpi/ec.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/ec.c +6 -0
@@ -2288,6 +2288,12 @@ static const struct dmi_system_id acpi_e DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"), } }, + { +// TUXEDO InfinityBook Pro AMD Gen9 + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GXxHRXx"), + }, + }, { }, };
Greg Kroah-Hartman
maintainerPATCH 10/50 nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit 25edbcac6e32eab345e470d56ca9974a577b878b upstream.
Fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests to prepare for future changes to this code, and move the helpers to write.c as well.
--- fs/nfs/pagelist.c | 77 ----------------------------------------------- fs/nfs/write.c | 74 +++++++++++++++++++++++++++++++++++++++++---- include/linux/nfs_page.h | 1 3 files changed, 68 insertions(+), 84 deletions(-)
fs/nfs/pagelist.c +0 -77
@@ -168,83 +168,6 @@ nfs_page_group_lock_head(struct nfs_page }/* -* nfs_unroll_locks - unlock all newly locked reqs and wait on @req -* @head: head request of page group, must be holding head lock -* @req: request that couldn't lock and needs to wait on the req bit lock -* -* This is a helper function for nfs_lock_and_join_requests -* returns 0 on success, < 0 on error. -*/ -static void -nfs_unroll_locks (struct nfs_page *head,struct nfs_page *req) -{ -struct nfs_page *tmp; - -/* relinquish all the locks successfully grabbed this run */ -for (tmp = head->wb_this_page ; tmp != req; tmp = tmp->wb_this_page) { -if (!kref_read (&tmp->wb_kref)) -continue ; -nfs_unlock_and_release_request (tmp); - } -} - -/* -* nfs_page_group_lock_subreq - try to lock a subrequest -* @head: head request of page group -* @subreq: request to lock -* -* This is a helper function for nfs_lock_and_join_requests which -* must be called with the head request and page group both locked. -* On error, it returns with the page group unlocked. -*/ -static int -nfs_page_group_lock_subreq (struct nfs_page *head,struct nfs_page *subreq) -{ -int ret; - -if (!kref_get_unless_zero (&subreq->wb_kref)) -return 0 ; -while (!nfs_lock_request (subreq)) { -nfs_page_group_unlock (head); - ret =nfs_wait_on_request (subreq); -if (!ret) - ret =nfs_page_group_lock (head); -if (ret <0 ) { -nfs_unroll_locks (head, subreq); -nfs_release_request (subreq); -return ret; - } - } -return 0 ; -} - -/* -* nfs_page_group_lock_subrequests - try to lock the subrequests -* @head: head request of page group -* -* This is a helper function for nfs_lock_and_join_requests which -* must be called with the head request locked. -*/ -int nfs_page_group_lock_subrequests (struct nfs_page *head) -{ -struct nfs_page *subreq; -int ret; - - ret =nfs_page_group_lock (head); -if (ret <0 ) -return ret; -/* lock each request in the page group */ -for (subreq = head->wb_this_page; subreq != head; - subreq = subreq->wb_this_page) { - ret =nfs_page_group_lock_subreq (head, subreq); -if (ret <0 ) -return ret; - } -nfs_page_group_unlock (head); -return 0 ; -} - -/* * nfs_page_set_headlock - set the request PG_HEADLOCK * @req: request that is to be locked *
fs/nfs/write.c +68 -6
97 lines not on this page · raw message
include/linux/nfs_page.h +0 -1
@@ -144,7 +144,6 @@ extern int nfs_wait_on_request(struct nextern void nfs_unlock_request (struct nfs_page *req);extern void nfs_unlock_and_release_request (struct nfs_page *);extern struct nfs_page *nfs_page_group_lock_head (struct nfs_page *req); -extern int nfs_page_group_lock_subrequests (struct nfs_page *head);extern void nfs_join_page_group (struct nfs_page *head,struct inode *inode);extern int nfs_page_group_lock (struct nfs_page *);extern void nfs_page_group_unlock (struct nfs_page *);
Greg Kroah-Hartman
maintainerPATCH 11/50 NFS: Fix a race when updating an existing write
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 76d2e3890fb169168c73f2e4f8375c7cc24a765e upstream.
After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group.
The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head.
So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().
--- fs/nfs/pagelist.c | 9 +++--- fs/nfs/write.c | 66 ++++++++++++++++------------------------------- include/linux/nfs_page.h | 1 3 files changed, 29 insertions(+), 47 deletions(-)
fs/nfs/pagelist.c +5 -4
@@ -233,13 +233,14 @@ nfs_page_group_unlock(struct nfs_page *rnfs_page_clear_headlock (req); } -/* -* nfs_page_group_sync_on_bit_locked +/** +* nfs_page_group_sync_on_bit_locked - Test if all requests have @bit set +* @req: request in page group +* @bit: PG_* bit that is used to sync page group * * must be called with page group lock held */ -static bool -nfs_page_group_sync_on_bit_locked (struct nfs_page *req,unsigned int bit) +bool nfs_page_group_sync_on_bit_locked (struct nfs_page *req,unsigned int bit) {struct nfs_page *head = req->wb_head;struct nfs_page *tmp;
fs/nfs/write.c +23 -43
106 lines not on this page · raw message
include/linux/nfs_page.h +1 -0
@@ -148,6 +148,7 @@ extern void nfs_join_page_group(struct nextern int nfs_page_group_lock (struct nfs_page *);extern void nfs_page_group_unlock (struct nfs_page *);extern bool nfs_page_group_sync_on_bit (struct nfs_page *,unsigned int ); +extern bool nfs_page_group_sync_on_bit_locked (struct nfs_page *,unsigned int );extern int nfs_page_set_headlock (struct nfs_page *req);extern void nfs_page_clear_headlock (struct nfs_page *req);extern bool nfs_async_iocounter_wait (struct rpc_task *,struct nfs_lock_context *);
Greg Kroah-Hartman
maintainerPATCH 12/50 vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Kuratov <[email protected]>
commit dd54bcf86c91a4455b1f95cbc8e9ac91205f3193 upstream.
When operating on struct vhost_net_ubuf_ref, the following execution sequence is theoretically possible:
CPU0 is finalizing DMA operation CPU1 is doing VHOST_NET_SET_BACKEND
// ubufs->refcount == 2
vhost_net_ubuf_put() vhost_net_ubuf_put_wait_and_free(oldubufs)
vhost_net_ubuf_put_and_wait()
vhost_net_ubuf_put()
int r = atomic_sub_return(1, &ubufs->refcount);
// r = 1
int r = atomic_sub_return(1, &ubufs->refcount);
// r = 0
wait_event(ubufs->wait, !atomic_read(&ubufs->refcount));
// no wait occurs here because condition is already true
kfree(ubufs);if (unlikely(!r))
wake_up(&ubufs->wait); // use-after-free
This leads to use-after-free on ubufs access. This happens because CPU1 skips waiting for wake_up() when refcount is already zero.
To prevent that use a read-side RCU critical section in vhost_net_ubuf_put(), as suggested by Hillf Danton. For this lock to take effect, free ubufs with kfree_rcu().
Message-Id: <[email protected]>
--- drivers/vhost/net.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/vhost/net.c +7 -2
@@ -95,6 +95,7 @@ struct vhost_net_ubuf_ref {atomic_t refcount;wait_queue_head_t wait;struct vhost_virtqueue *vq; +struct rcu_head rcu; };#define VHOST_NET_BATCH 64
@@ -248,9 +249,13 @@ vhost_net_ubuf_alloc(struct vhost_virtqustatic int vhost_net_ubuf_put (struct vhost_net_ubuf_ref *ubufs) { -int r =atomic_sub_return (1 , &ubufs->refcount); +int r; + +rcu_read_lock (); + r =atomic_sub_return (1 , &ubufs->refcount);if (unlikely (!r))wake_up (&ubufs->wait); +rcu_read_unlock ();return r; }
@@ -263,7 +268,7 @@ static void vhost_net_ubuf_put_and_wait(static void vhost_net_ubuf_put_wait_and_free (struct vhost_net_ubuf_ref *ubufs) {vhost_net_ubuf_put_and_wait (ubufs); -kfree (ubufs); +kfree_rcu (ubufs, rcu); }static void vhost_net_clear_ubuf_info (struct vhost_net *n)
Greg Kroah-Hartman
maintainerPATCH 13/50 net: ipv4: fix regression in local-broadcast routes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oscar Maes <[email protected]>
[ Upstream commit 5189446ba995556eaa3755a6e875bc06675b88bd ]
Commit 9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes") introduced a regression where local-broadcast packets would have their gateway set in __mkroute_output, which was caused by fi = NULL being removed.
Fix this by resetting the fib_info for local-broadcast packets. This preserves the intended changes for directed-broadcast packets.
--- net/ipv4/route.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/ipv4/route.c +7 -3
@@ -2549,12 +2549,16 @@ static struct rtable *__mkroute_output(const struct fib_result *res, !netif_is_l3_master(dev_out))return ERR_PTR (-EINVAL ); -if (ipv4_is_lbcast (fl4->daddr)) +if (ipv4_is_lbcast (fl4->daddr)) { type =RTN_BROADCAST ; -else if (ipv4_is_multicast (fl4->daddr)) + +/* reset fi to prevent gateway resolution */ + fi =NULL ; + }else if (ipv4_is_multicast (fl4->daddr)) { type =RTN_MULTICAST ; -else if (ipv4_is_zeronet (fl4->daddr)) + }else if (ipv4_is_zeronet (fl4->daddr)) {return ERR_PTR (-EINVAL ); + }if (dev_out->flags &IFF_LOOPBACK ) flags |=RTCF_LOCAL ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 14/50 drm/msm: Defer fd_install in SUBMIT ioctl
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit f22853435bbd1e9836d0dce7fd99c040b94c2bf1 ]
Avoid fd_install() until there are no more potential error paths, to avoid put_unused_fd() after the fd is made visible to userspace.
Patchwork: https://patchwork.freedesktop.org/patch/665363/
--- drivers/gpu/drm/msm/msm_gem_submit.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/msm/msm_gem_submit.c +7 -7
@@ -929,12 +929,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,if (ret ==0 && args->flags &MSM_SUBMIT_FENCE_FD_OUT ) { sync_file =sync_file_create (submit->user_fence); -if (!sync_file) { +if (!sync_file) ret = -ENOMEM ; - }else { -fd_install (out_fence_fd, sync_file->file); - args->fence_fd = out_fence_fd; - } }submit_attach_object_fences (submit);
@@ -959,10 +955,14 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, out_unlock:mutex_unlock (&queue->lock); out_post_unlock: -if (ret && (out_fence_fd >=0 )) { -put_unused_fd (out_fence_fd); +if (ret) { +if (out_fence_fd >=0 ) +put_unused_fd (out_fence_fd);if (sync_file)fput (sync_file->file); + }else if (sync_file) { +fd_install (out_fence_fd, sync_file->file); + args->fence_fd = out_fence_fd; }if (!IS_ERR_OR_NULL (submit)) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 15/50 powerpc/kvm: Fix ifdef to remove build warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madhavan Srinivasan <[email protected]>
[ Upstream commit 88688a2c8ac6c8036d983ad8b34ce191c46a10aa ]
When compiling for pseries or powernv defconfig with "make C=1", these warning were reported bu sparse tool in powerpc/kernel/kvm.c
arch/powerpc/kernel/kvm.c:635:9: warning: switch with no cases arch/powerpc/kernel/kvm.c:646:9: warning: switch with no cases
Currently #ifdef were added after the switch case which are specific for BOOKE and PPC_BOOK3S_32. These are not enabled in pseries/powernv defconfig. Fix it by moving the #ifdef before switch(){}
--- arch/powerpc/kernel/kvm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/powerpc/kernel/kvm.c +4 -4
@@ -632,19 +632,19 @@ static void __init kvm_check_ins(u32 *inst, u32 features)#endif } -switch (inst_no_rt & ~KVM_MASK_RB ) {#ifdef CONFIG_PPC_BOOK3S_32 +switch (inst_no_rt & ~KVM_MASK_RB ) {case KVM_INST_MTSRIN :if (features &KVM_MAGIC_FEAT_SR ) {u32 inst_rb = _inst &KVM_MASK_RB ;kvm_patch_ins_mtsrin (inst, inst_rt, inst_rb); }break ; -#endif } +#endif -switch (_inst) {#ifdef CONFIG_BOOKE +switch (_inst) {case KVM_INST_WRTEEI_0 :kvm_patch_ins_wrteei_0 (inst);break ;
@@ -652,8 +652,8 @@ static void __init kvm_check_ins(u32 *inst, u32 features)case KVM_INST_WRTEEI_1 :kvm_patch_ins_wrtee (inst,0 ,1 ); break; -#endif } +#endif }extern u32 kvm_template_start[];
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 16/50 HID: input: rename hidinput_set_battery_charge_status()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit a82231b2a8712d0218fc286a9b0da328d419a3f4 ]
In preparation for a patch fixing a bug affecting hidinput_set_battery_charge_status(), rename the function to hidinput_update_battery_charge_status() and move it up so it can be used by hidinput_update_battery().
Refactor, no functional changes.
Stable-dep-of: e94536e1d181 ("HID: input: report battery status changes immediately")
--- drivers/hid/hid-input-test.c | 10 +++++----- drivers/hid/hid-input.c | 38 ++++++++++++++++++------------------ 2 files changed, 24 insertions(+), 24 deletions(-)
drivers/hid/hid-input-test.c +5 -5
@@ -7,7 +7,7 @@#include <kunit/test.h> -static void hid_test_input_set_battery_charge_status (struct kunit *test) +static void hid_test_input_update_battery_charge_status (struct kunit *test) {struct hid_device *dev;bool handled;
@@ -15,15 +15,15 @@ static void hid_test_input_set_battery_charge_status(struct kunit *test) dev =kunit_kzalloc (test,sizeof (*dev),GFP_KERNEL );KUNIT_ASSERT_NOT_ERR_OR_NULL (test, dev); - handled =hidinput_set_battery_charge_status (dev,HID_DG_HEIGHT ,0 ); + handled =hidinput_update_battery_charge_status (dev,HID_DG_HEIGHT ,0 );KUNIT_EXPECT_FALSE (test, handled);KUNIT_EXPECT_EQ (test, dev->battery_charge_status,POWER_SUPPLY_STATUS_UNKNOWN ); - handled =hidinput_set_battery_charge_status (dev,HID_BAT_CHARGING ,0 ); + handled =hidinput_update_battery_charge_status (dev,HID_BAT_CHARGING ,0 );KUNIT_EXPECT_TRUE (test, handled);KUNIT_EXPECT_EQ (test, dev->battery_charge_status,POWER_SUPPLY_STATUS_DISCHARGING ); - handled =hidinput_set_battery_charge_status (dev,HID_BAT_CHARGING ,1 ); + handled =hidinput_update_battery_charge_status (dev,HID_BAT_CHARGING ,1 );KUNIT_EXPECT_TRUE (test, handled);KUNIT_EXPECT_EQ (test, dev->battery_charge_status,POWER_SUPPLY_STATUS_CHARGING ); }
@@ -63,7 +63,7 @@ static void hid_test_input_get_battery_property(struct kunit *test) }static struct kunit_case hid_input_tests[] = { -KUNIT_CASE (hid_test_input_set_battery_charge_status), +KUNIT_CASE (hid_test_input_update_battery_charge_status),KUNIT_CASE (hid_test_input_get_battery_property), { } };
drivers/hid/hid-input.c +19 -19
@@ -609,6 +609,20 @@ static void hidinput_cleanup_battery(struct hid_device *dev) dev->battery =NULL ; } +static bool hidinput_update_battery_charge_status (struct hid_device *dev, +unsigned int usage,int value) +{ +switch (usage) { +case HID_BAT_CHARGING : + dev->battery_charge_status = value ? +POWER_SUPPLY_STATUS_CHARGING : +POWER_SUPPLY_STATUS_DISCHARGING ; +return true; + } + +return false; +} +static void hidinput_update_battery (struct hid_device *dev,int value) {int capacity;
@@ -631,20 +645,6 @@ static void hidinput_update_battery(struct hid_device *dev, int value) power_supply_changed(dev->battery); } } - -static bool hidinput_set_battery_charge_status (struct hid_device *dev, -unsigned int usage,int value) -{ -switch (usage) { -case HID_BAT_CHARGING : - dev->battery_charge_status = value ? -POWER_SUPPLY_STATUS_CHARGING : -POWER_SUPPLY_STATUS_DISCHARGING ; -return true; - } - -return false; -}#else /* !CONFIG_HID_BATTERY_STRENGTH */ static int hidinput_setup_battery (struct hid_device *dev,unsigned report_type,struct hid_field *field,bool is_percentage)
@@ -656,14 +656,14 @@ static void hidinput_cleanup_battery(struct hid_device *dev) { } -static void hidinput_update_battery (struct hid_device *dev,int value) +static bool hidinput_update_battery_charge_status (struct hid_device *dev, +unsigned int usage,int value) { +return false; } -static bool hidinput_set_battery_charge_status (struct hid_device *dev, -unsigned int usage,int value) +static void hidinput_update_battery (struct hid_device *dev,int value) { -return false; }#endif /* CONFIG_HID_BATTERY_STRENGTH */
@@ -1509,7 +1509,7 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, structreturn ;if (usage->type ==EV_PWR ) { -bool handled =hidinput_set_battery_charge_status (hid, usage->hid, value); +bool handled =hidinput_update_battery_charge_status (hid, usage->hid, value);if (!handled)hidinput_update_battery (hid, value);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 17/50 HID: input: report battery status changes immediately
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit e94536e1d1818b0989aa19b443b7089f50133c35 ]
Previously, the battery status (charging/discharging) was not reported immediately to user-space.
For most input devices, this wasn't problematic because changing their battery status requires connecting them to a different bus. For example, a gamepad would report a discharging status while connected via Bluetooth and a charging status while connected via USB.
However, certain devices are not connected or disconnected when their battery status changes. For example, a phone battery changes its status without connecting or disconnecting it.
In these cases, the battery status was not reported immediately to user space.
Report battery status changes immediately to user space to support these kinds of devices.
--- drivers/hid/hid-input.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
drivers/hid/hid-input.c +10 -13
@@ -623,13 +623,19 @@ static bool hidinput_update_battery_charge_status(struct hid_device *dev,return false; } -static void hidinput_update_battery (struct hid_device *dev,int value) +static void hidinput_update_battery (struct hid_device *dev,unsigned int usage, +int value) {int capacity;if (!dev->battery)return ; +if (hidinput_update_battery_charge_status (dev, usage, value)) { +power_supply_changed (dev->battery); +return ; + } +if (value ==0 || value < dev->battery_min || value > dev->battery_max)return ;
@@ -656,13 +662,8 @@ static void hidinput_cleanup_battery(struct hid_device *dev) { } -static bool hidinput_update_battery_charge_status (struct hid_device *dev, -unsigned int usage,int value) -{ -return false; -} - -static void hidinput_update_battery (struct hid_device *dev,int value) +static void hidinput_update_battery (struct hid_device *dev,unsigned int usage, +int value) { }#endif /* CONFIG_HID_BATTERY_STRENGTH */
@@ -1509,11 +1510,7 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, structreturn ;if (usage->type ==EV_PWR ) { -bool handled =hidinput_update_battery_charge_status (hid, usage->hid, value); - -if (!handled) -hidinput_update_battery (hid, value); - +hidinput_update_battery (hid, usage->hid, value);return ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 18/50 Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovico de Nittis <[email protected]>
[ Upstream commit 2f050a5392b7a0928bf836d9891df4851463512c ]
When the host sends an HCI_OP_DISCONNECT command, the controller may respond with the status HCI_ERROR_UNKNOWN_CONN_ID (0x02). E.g. this can happen on resume from suspend, if the link was terminated by the remote device before the event mask was correctly set.
This is a btmon snippet that shows the issue:
```
> ACL Data RX: Handle 3 flags 0x02 dlen 12
L2CAP: Disconnection Request (0x06) ident 5 len 4
Destination CID: 65
Source CID: 72
< ACL Data TX: Handle 3 flags 0x00 dlen 12
L2CAP: Disconnection Response (0x07) ident 5 len 4
Destination CID: 65
Source CID: 72
> ACL Data RX: Handle 3 flags 0x02 dlen 12
L2CAP: Disconnection Request (0x06) ident 6 len 4
Destination CID: 64
Source CID: 71
< ACL Data TX: Handle 3 flags 0x00 dlen 12
L2CAP: Disconnection Response (0x07) ident 6 len 4
Destination CID: 64
Source CID: 71
< HCI Command: Set Event Mask (0x03|0x0001) plen 8
Mask: 0x3dbff807fffbffff
Inquiry Complete
Inquiry Result
Connection Complete
Connection Request
Disconnection Complete
Authentication Complete
[...]
< HCI Command: Disconnect (0x01|0x0006) plen 3
Handle: 3 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) ncmd 1
Status: Unknown Connection Identifier (0x02)
```Currently, the hci_cs_disconnect function treats any non-zero status as a command failure. This can be misleading because the connection is indeed being terminated and the controller is confirming that is has no knowledge of that connection handle. Meaning that the initial request of disconnecting a device should be treated as done.
With this change we allow the function to proceed, following the success path, which correctly calls mgmt_device_disconnected and ensures a consistent state.
--- net/bluetooth/hci_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/hci_event.c +1 -1
@@ -2767,7 +2767,7 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)if (!conn) goto unlock; -if (status) { +if (status && status !=HCI_ERROR_UNKNOWN_CONN_ID ) {mgmt_disconnect_failed (hdev, &conn->dst, conn->type, conn->dst_type, status);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 19/50 Bluetooth: hci_event: Mark connection as closed during suspend disconnect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovico de Nittis <[email protected]>
[ Upstream commit b7fafbc499b5ee164018eb0eefe9027f5a6aaad2 ]
When suspending, the disconnect command for an active Bluetooth connection could be issued, but the corresponding HCI_EV_DISCONN_COMPLETE event might not be received before the system completes the suspend process. This can lead to an inconsistent state.
On resume, the controller may auto-accept reconnections from the same device (due to suspend event filters), but these new connections are rejected by the kernel which still has connection objects from before suspend. Resulting in errors like:
``` kernel: Bluetooth: hci0: ACL packet for unknown connection handle 1 kernel: Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection ```
This is a btmon snippet that shows the issue:
```
< HCI Command: Disconnect (0x01|0x0006) plen 3
Handle: 1 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) ncmd 2
Status: Success (0x00)
[...]
// Host suspends with the event filter set for the device
// On resume, the device tries to reconnect with a new handle
> HCI Event: Connect Complete (0x03) plen 11
Status: Success (0x00)
Handle: 2
Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
// Kernel ignores this event because there is an existing connection
with
// handle 1
```By explicitly setting the connection state to BT_CLOSED we can ensure a consistent state, even if we don't receive the disconnect complete event in time.
--- net/bluetooth/hci_event.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/bluetooth/hci_event.c +6 -0
@@ -2782,6 +2782,12 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) goto done; } +/* During suspend, mark connection as closed immediately +* since we might not receive HCI_EV_DISCONN_COMPLETE +*/ +if (hdev->suspended) + conn->state =BT_CLOSED ; + mgmt_conn =test_and_clear_bit (HCI_CONN_MGMT_CONNECTED , &conn->flags);if (conn->type ==ACL_LINK ) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 20/50 Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 15bf2c6391bafb14a3020d06ec0761bce0803463 ]
This attempts to detect if HCI_EV_NUM_COMP_PKTS contain an unbalanced (more than currently considered outstanding) number of packets otherwise it could cause the hcon->sent to underflow and loop around breaking the tracking of the outstanding packets pending acknowledgment.
--- net/bluetooth/hci_event.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
net/bluetooth/hci_event.c +11 -1
@@ -4409,7 +4409,17 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,if (!conn)continue ; - conn->sent -= count; +/* Check if there is really enough packets outstanding before +* attempting to decrease the sent counter otherwise it could +* underflow.. +*/ +if (conn->sent >= count) { + conn->sent -= count; + }else { +bt_dev_warn (hdev,"hcon %p sent %u < count %u" , + conn, conn->sent, count); + conn->sent =0 ; + }switch (conn->type) {case ACL_LINK :
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 21/50 Bluetooth: hci_sync: fix set_local_name race condition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shpakovskiy <[email protected]>
[ Upstream commit 6bbd0d3f0c23fc53c17409dd7476f38ae0ff0cd9 ]
Function set_name_sync() uses hdev->dev_name field to send HCI_OP_WRITE_LOCAL_NAME command, but copying from data to hdev->dev_name is called after mgmt cmd was queued, so it is possible that function set_name_sync() will read old name value.
This change adds name as a parameter for function hci_update_name_sync() to avoid race condition.
--- include/net/bluetooth/hci_sync.h | 2 +- net/bluetooth/hci_sync.c | 6 +++--- net/bluetooth/mgmt.c | 5 ++++- 3 files changed, 8 insertions(+), 5 deletions(-)
include/net/bluetooth/hci_sync.h +1 -1
@@ -65,7 +65,7 @@ int hci_update_class_sync(struct hci_dev *hdev);int hci_update_eir_sync (struct hci_dev *hdev);int hci_update_class_sync (struct hci_dev *hdev); -int hci_update_name_sync (struct hci_dev *hdev); +int hci_update_name_sync (struct hci_dev *hdev,const u8 *name);int hci_write_ssp_mode_sync (struct hci_dev *hdev,u8 mode); int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
net/bluetooth/hci_sync.c +3 -3
@@ -3424,13 +3424,13 @@ int hci_update_scan_sync(struct hci_dev *hdev)return hci_write_scan_enable_sync (hdev, scan); } -int hci_update_name_sync (struct hci_dev *hdev) +int hci_update_name_sync (struct hci_dev *hdev,const u8 *name) {struct hci_cp_write_local_name cp;memset (&cp,0 ,sizeof (cp)); -memcpy (cp.name, hdev->dev_name,sizeof (cp.name)); +memcpy (cp.name, name,sizeof (cp.name)); return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp,
@@ -3482,7 +3482,7 @@ int hci_powered_update_sync(struct hci_dev *hdev)hci_write_fast_connectable_sync (hdev, false);hci_update_scan_sync (hdev);hci_update_class_sync (hdev); -hci_update_name_sync (hdev); +hci_update_name_sync (hdev, hdev->dev_name);hci_update_eir_sync (hdev); }
net/bluetooth/mgmt.c +4 -1
@@ -3897,8 +3897,11 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err)static int set_name_sync (struct hci_dev *hdev,void *data) { +struct mgmt_pending_cmd *cmd = data; +struct mgmt_cp_set_local_name *cp = cmd->param; +if (lmp_bredr_capable (hdev)) { -hci_update_name_sync (hdev); +hci_update_name_sync (hdev, cp->name);hci_update_eir_sync (hdev); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 22/50 atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit ec79003c5f9d2c7f9576fc69b8dbda80305cbe3a ]
syzbot reported the splat below. [0]
When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message.
The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc.
The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer.
struct atmtcp_control {
struct atmtcp_hdr hdr; /* must be first */
...
atm_kptr_t vcc; /* both directions */
...
} __ATM_API_ALIGN;
typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t;The special message is processed in atmtcp_recv_control() called from atmtcp_c_send().
atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths:
1. .ndo_start_xmit() (vcc->send() == atm_send_aal0())
2. vcc_sendmsg()
The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control.
Let's add a new ->pre_send() hook to validate messages from sendmsg().
[0]:
Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: <TASK> vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 </TASK> Modules linked in:
--- drivers/atm/atmtcp.c | 17 ++++++++++++++--- include/linux/atmdev.h | 1 + net/atm/common.c | 15 ++++++++++++--- 3 files changed, 27 insertions(+), 6 deletions(-)
drivers/atm/atmtcp.c +14 -3
@@ -279,6 +279,19 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)return NULL ; } +static int atmtcp_c_pre_send (struct atm_vcc *vcc,struct sk_buff *skb) +{ +struct atmtcp_hdr *hdr; + +if (skb->len <sizeof (struct atmtcp_hdr )) +return -EINVAL ; + + hdr = (struct atmtcp_hdr *)skb->data; +if (hdr->length ==ATMTCP_HDR_MAGIC ) +return -EINVAL ; + +return 0 ; +}static int atmtcp_c_send (struct atm_vcc *vcc,struct sk_buff *skb) {
@@ -288,9 +301,6 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)struct sk_buff *new_skb;int result =0 ; -if (skb->len <sizeof (struct atmtcp_hdr )) - goto done; - dev = vcc->dev_data; hdr = (struct atmtcp_hdr *) skb->data;if (hdr->length ==ATMTCP_HDR_MAGIC ) {
@@ -347,6 +357,7 @@ static const struct atmdev_ops atmtcp_v_dev_ops = {static const struct atmdev_ops atmtcp_c_dev_ops = { .close = atmtcp_c_close, + .pre_send = atmtcp_c_pre_send, .send = atmtcp_c_send };
include/linux/atmdev.h +1 -0
@@ -185,6 +185,7 @@ struct atmdev_ops { /* only send is required */int (*compat_ioctl)(struct atm_dev *dev,unsigned int cmd,void __user *arg);#endif +int (*pre_send)(struct atm_vcc *vcc,struct sk_buff *skb);int (*send)(struct atm_vcc *vcc,struct sk_buff *skb);int (*send_bh)(struct atm_vcc *vcc,struct sk_buff *skb);int (*send_oam)(struct atm_vcc *vcc,void *cell,int flags);
net/atm/common.c +12 -3
@@ -635,18 +635,27 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size) skb->dev =NULL ;/* for paths shared with net_device interfaces */ if (!copy_from_iter_full (skb_put (skb, size), size, &m->msg_iter)) { -atm_return_tx (vcc, skb); -kfree_skb (skb); error = -EFAULT ; - goto out; + goto free_skb; }if (eff != size)memset (skb->data + size,0 , eff-size); + +if (vcc->dev->ops->pre_send) { + error = vcc->dev->ops->pre_send (vcc, skb); +if (error) + goto free_skb; + } + error = vcc->dev->ops->send (vcc, skb); error = error ? error : size; out:release_sock (sk);return error; +free_skb: +atm_return_tx (vcc, skb); +kfree_skb (skb); + goto out; }__poll_t vcc_poll (struct file *file,struct socket *sock,poll_table *wait)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 23/50 net: dlink: fix multicast stats being counted incorrectly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeounsu Moon <[email protected]>
[ Upstream commit 007a5ffadc4fd51739527f1503b7cf048f31c413 ]
McstFramesRcvdOk counts the number of received multicast packets, and it reports the value correctly.
However, reading McstFramesRcvdOk clears the register to zero. As a result, the driver was reporting only the packets since the last read, instead of the accumulated total.
Fix this by updating the multicast statistics accumulatively instaed of instantaneously.
Tested-on: D-Link DGE-550T Rev-A3
--- drivers/net/ethernet/dlink/dl2k.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/dlink/dl2k.c +1 -1
@@ -1094,7 +1094,7 @@ get_stats (struct net_device *dev) dev->stats.rx_bytes +=dr32 (OctetRcvOk); dev->stats.tx_bytes +=dr32 (OctetXmtOk); - dev->stats.multicast =dr32 (McstFramesRcvdOk); + dev->stats.multicast +=dr32 (McstFramesRcvdOk); dev->stats.collisions +=dr32 (SingleColFrames) +dr32 (MultiColFrames);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 24/50 phy: mscc: Fix when PTP clock is register and unregister
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit 882e57cbc7204662f6c5672d5b04336c1d790b03 ]
It looks like that every time when the interface was set down and up the driver was creating a new ptp clock. On top of this the function ptp_clock_unregister was never called.
Therefore fix this by calling ptp_clock_register and initialize the mii_ts struct inside the probe function and call ptp_clock_unregister when driver is removed.
--- drivers/net/phy/mscc/mscc.h | 4 ++++ drivers/net/phy/mscc/mscc_main.c | 4 +--- drivers/net/phy/mscc/mscc_ptp.c | 34 ++++++++++++++++++++------------ 3 files changed, 26 insertions(+), 16 deletions(-)
drivers/net/phy/mscc/mscc.h +4 -0
@@ -474,6 +474,7 @@ static inline void vsc8584_config_macsec_intr(struct phy_device *phydev)void vsc85xx_link_change_notify (struct phy_device *phydev);void vsc8584_config_ts_intr (struct phy_device *phydev);int vsc8584_ptp_init (struct phy_device *phydev); +void vsc8584_ptp_deinit (struct phy_device *phydev);int vsc8584_ptp_probe_once (struct phy_device *phydev);int vsc8584_ptp_probe (struct phy_device *phydev);irqreturn_t vsc8584_handle_ts_interrupt (struct phy_device *phydev);
@@ -488,6 +489,9 @@ static inline int vsc8584_ptp_init(struct phy_device *phydev) {return 0 ; } +static inline void vsc8584_ptp_deinit (struct phy_device *phydev) +{ +}static inline int vsc8584_ptp_probe_once (struct phy_device *phydev) {return 0 ;
drivers/net/phy/mscc/mscc_main.c +1 -3
@@ -2326,9 +2326,7 @@ static int vsc85xx_probe(struct phy_device *phydev)static void vsc85xx_remove (struct phy_device *phydev) { -struct vsc8531_private *priv = phydev->priv; - -skb_queue_purge (&priv->rx_skbs_list); +vsc8584_ptp_deinit (phydev); }/* Microsemi VSC85xx PHYs */
drivers/net/phy/mscc/mscc_ptp.c +21 -13
@@ -1297,7 +1297,6 @@ static void vsc8584_set_input_clk_configured(struct phy_device *phydev)static int __vsc8584_init_ptp (struct phy_device *phydev) { -struct vsc8531_private *vsc8531 = phydev->priv;static const u32 ltc_seq_e[] = {0 ,400000 ,0 ,0 ,0 };static const u8 ltc_seq_a[] = {8 ,6 ,5 ,4 ,2 };u32 val;
@@ -1514,17 +1513,7 @@ static int __vsc8584_init_ptp(struct phy_device *phydev)vsc85xx_ts_eth_cmp1_sig (phydev); - vsc8531->mii_ts.rxtstamp = vsc85xx_rxtstamp; - vsc8531->mii_ts.txtstamp = vsc85xx_txtstamp; - vsc8531->mii_ts.hwtstamp = vsc85xx_hwtstamp; - vsc8531->mii_ts.ts_info = vsc85xx_ts_info; - phydev->mii_ts = &vsc8531->mii_ts; - -memcpy (&vsc8531->ptp->caps, &vsc85xx_clk_caps,sizeof (vsc85xx_clk_caps)); - - vsc8531->ptp->ptp_clock =ptp_clock_register (&vsc8531->ptp->caps, - &phydev->mdio.dev); -return PTR_ERR_OR_ZERO (vsc8531->ptp->ptp_clock); +return 0 ; }void vsc8584_config_ts_intr (struct phy_device *phydev)
@@ -1551,6 +1540,16 @@ int vsc8584_ptp_init(struct phy_device *phydev)return 0 ; } +void vsc8584_ptp_deinit (struct phy_device *phydev) +{ +struct vsc8531_private *vsc8531 = phydev->priv; + +if (vsc8531->ptp->ptp_clock) { +ptp_clock_unregister (vsc8531->ptp->ptp_clock); +skb_queue_purge (&vsc8531->rx_skbs_list); + } +} +irqreturn_t vsc8584_handle_ts_interrupt (struct phy_device *phydev) {struct vsc8531_private *priv = phydev->priv;
@@ -1608,7 +1607,16 @@ int vsc8584_ptp_probe(struct phy_device *phydev) vsc8531->ptp->phydev = phydev; -return 0 ; + vsc8531->mii_ts.rxtstamp = vsc85xx_rxtstamp; + vsc8531->mii_ts.txtstamp = vsc85xx_txtstamp; + vsc8531->mii_ts.hwtstamp = vsc85xx_hwtstamp; + vsc8531->mii_ts.ts_info = vsc85xx_ts_info; + phydev->mii_ts = &vsc8531->mii_ts; + +memcpy (&vsc8531->ptp->caps, &vsc85xx_clk_caps,sizeof (vsc85xx_clk_caps)); + vsc8531->ptp->ptp_clock =ptp_clock_register (&vsc8531->ptp->caps, + &phydev->mdio.dev); +return PTR_ERR_OR_ZERO (vsc8531->ptp->ptp_clock); }int vsc8584_ptp_probe_once (struct phy_device *phydev)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 25/50 net/mlx5: Reload auxiliary drivers on fw_activate
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit 34cc6a54914f478c93e176450fae6313404f9f74 ]
The devlink reload fw_activate command performs firmware activation followed by driver reload, while devlink reload driver_reinit triggers only driver reload. However, the driver reload logic differs between the two modes, as on driver_reinit mode mlx5 also reloads auxiliary drivers, while in fw_activate mode the auxiliary drivers are suspended where applicable.
Additionally, following the cited commit, if the device has multiple PFs, the behavior during fw_activate may vary between PFs: one PF may suspend auxiliary drivers, while another reloads them.
Align devlink dev reload fw_activate behavior with devlink dev reload driver_reinit, to reload all auxiliary drivers.
--- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/devlink.c +1 -1
@@ -108,7 +108,7 @@ static int mlx5_devlink_reload_fw_activate(struct devlink *devlink, struct netliif (err)return err; -mlx5_unload_one_devl_locked (dev, true); +mlx5_unload_one_devl_locked (dev, false); err =mlx5_health_wait_pci_up (dev);if (err)NL_SET_ERR_MSG_MOD (extack,"FW activate aborted, PCI reads fail after reset" );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 26/50 net/mlx5e: Update and set Xon/Xoff upon MTU set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb ]
Xon/Xoff sizes are derived from calculation that include the MTU size. Set Xon/Xoff when MTU is set.
If Xon/Xoff fails, set the previous MTU.
--- .../mellanox/mlx5/core/en/port_buffer.h | 12 ++++++++++++ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 ++++++++++++++++- 2 files changed, 28 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +12 -0
@@ -63,11 +63,23 @@ struct mlx5e_port_buffer {struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER ]; }; +#ifdef CONFIG_MLX5_CORE_EN_DCB int mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv,u32 change,unsigned int mtu,struct ieee_pfc *pfc,u32 *buffer_size,u8 *prio2buffer); +#else +static inline int +mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv, +u32 change,unsigned int mtu, +void *pfc, +u32 *buffer_size, +u8 *prio2buffer) +{ +return 0 ; +} +#endif int mlx5e_port_query_buffer (struct mlx5e_priv *priv,struct mlx5e_port_buffer *port_buffer);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +16 -1
@@ -42,6 +42,7 @@#include "eswitch.h" #include "en.h" #include "en/txrx.h" +#include "en/port_buffer.h" #include "en_tc.h" #include "en_rep.h" #include "en_accel/ipsec.h"
@@ -2640,9 +2641,11 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)struct mlx5e_params *params = &priv->channels.params;struct net_device *netdev = priv->netdev;struct mlx5_core_dev *mdev = priv->mdev; -u16 mtu; +u16 mtu, prev_mtu;int err; +mlx5e_query_mtu (mdev, params, &prev_mtu); + err =mlx5e_set_mtu (mdev, params, params->sw_mtu);if (err)return err;
@@ -2652,6 +2655,18 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)netdev_warn (netdev,"%s: VPort MTU %d is different than netdev mtu %d\n" , __func__, mtu, params->sw_mtu); +if (mtu != prev_mtu &&MLX5_BUFFER_SUPPORTED (mdev)) { + err =mlx5e_port_manual_buffer_config (priv,0 , mtu, +NULL ,NULL ,NULL ); +if (err) { +netdev_warn (netdev,"%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n" , + __func__, mtu, err, prev_mtu); + +mlx5e_set_mtu (mdev, params, prev_mtu); +return err; + } + } + params->sw_mtu = mtu;return 0 ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 27/50 net/mlx5e: Update and set Xon/Xoff upon port speed set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit d24341740fe48add8a227a753e68b6eedf4b385a ]
Xon/Xoff sizes are derived from calculations that include the port speed.
These settings need to be updated and applied whenever the port speed is changed.
The port speed is typically set after the physical link goes down and is negotiated as part of the link-up process between the two connected interfaces.
Xon/Xoff parameters being updated at the point where the new negotiated speed is established.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +2 -0
@@ -107,6 +107,8 @@ void mlx5e_update_carrier(struct mlx5e_priv *priv)if (up) {netdev_info (priv->netdev,"Link up\n" );netif_carrier_on (priv->netdev); +mlx5e_port_manual_buffer_config (priv,0 , priv->netdev->mtu, +NULL ,NULL ,NULL ); }else {netdev_info (priv->netdev,"Link down\n" );netif_carrier_off (priv->netdev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 28/50 net/mlx5e: Set local Xoff after FW update
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit aca0c31af61e0d5cf1675a0cbd29460b95ae693c ]
The local Xoff value is being set before the firmware (FW) update. In case of a failure where the FW is not updated with the new value, there is no fallback to the previous value.
Update the local Xoff value after the FW has been successfully set.
--- drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +2 -1
@@ -346,7 +346,6 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,if (err)return err; } - priv->dcbx.xoff = xoff;/* Apply the settings */ if (update_buffer) {
@@ -355,6 +354,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,return err; } + priv->dcbx.xoff = xoff; +if (update_prio2buffer) err =mlx5e_port_set_priority2buffer (priv->mdev, prio2buffer);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 29/50 net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <[email protected]>
[ Upstream commit 4f23382841e67174211271a454811dd17c0ef3c5 ]
Enabling RX FIFO Overflow interrupts is counterproductive and causes an interrupt storm when RX FIFO overflows. Disabling this interrupt has no side effect and eliminates interrupt storms when the RX FIFO overflows.
Commit 8a7cb245cf28 ("net: stmmac: Do not enable RX FIFO overflow interrupts") disables RX FIFO overflow interrupts for DWMAC4 IP and removes the corresponding handling of this interrupt. This patch is doing the same thing for XGMAC IP.
--- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +0 -4
@@ -199,10 +199,6 @@ static void dwxgmac2_dma_rx_mode(void __iomem *ioaddr, int mode, }writel (value, ioaddr +XGMAC_MTL_RXQ_OPMODE (channel)); - -/* Enable MTL RX overflow */ - value =readl (ioaddr +XGMAC_MTL_QINTEN (channel)); -writel (value |XGMAC_RXOIE , ioaddr +XGMAC_MTL_QINTEN (channel)); } static void dwxgmac2_dma_tx_mode(void __iomem *ioaddr, int mode,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 30/50 net: rose: split remove and free operations in rose_remove_neigh()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takamitsu Iwai <[email protected]>
[ Upstream commit dcb34659028f856c423a29ef9b4e2571d203444d ]
The current rose_remove_neigh() performs two distinct operations:
1. Removes rose_neigh from rose_neigh_list
2. Frees the rose_neigh structure
Split these operations into separate functions to improve maintainability and prepare for upcoming refcount_t conversion. The timer cleanup remains in rose_remove_neigh() because free operations can be called from timer itself.
This patch introduce rose_neigh_put() to handle the freeing of rose_neigh structures and modify rose_remove_neigh() to handle removal only.
Stable-dep-of: d860d1faa6b2 ("net: rose: convert 'use' field to refcount_t")
--- include/net/rose.h | 8 ++++++++ net/rose/rose_route.c | 15 ++++++--------- 2 files changed, 14 insertions(+), 9 deletions(-)
include/net/rose.h +8 -0
@@ -151,6 +151,14 @@ struct rose_sock {#define rose_sk (sk) ((struct rose_sock *)(sk)) +static inline void rose_neigh_put (struct rose_neigh *rose_neigh) +{ +if (rose_neigh->ax25) +ax25_cb_put (rose_neigh->ax25); +kfree (rose_neigh->digipeat); +kfree (rose_neigh); +} +/* af_rose.c */ extern ax25_address rose_callsign;extern int sysctl_rose_restart_request_timeout;
net/rose/rose_route.c +6 -9
@@ -234,20 +234,12 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh)if ((s = rose_neigh_list) == rose_neigh) { rose_neigh_list = rose_neigh->next; -if (rose_neigh->ax25) -ax25_cb_put (rose_neigh->ax25); -kfree (rose_neigh->digipeat); -kfree (rose_neigh);return ; }while (s !=NULL && s->next !=NULL ) {if (s->next == rose_neigh) { s->next = rose_neigh->next; -if (rose_neigh->ax25) -ax25_cb_put (rose_neigh->ax25); -kfree (rose_neigh->digipeat); -kfree (rose_neigh);return ; }
@@ -331,8 +323,10 @@ static int rose_del_node(struct rose_route_struct *rose_route,if (rose_node->neighbour[i] == rose_neigh) { rose_neigh->count--; -if (rose_neigh->count ==0 && rose_neigh->use ==0 ) +if (rose_neigh->count ==0 && rose_neigh->use ==0 ) {rose_remove_neigh (rose_neigh); +rose_neigh_put (rose_neigh); + } rose_node->count--;
@@ -513,6 +507,7 @@ void rose_rt_device_down(struct net_device *dev) }rose_remove_neigh (s); +rose_neigh_put (s); }spin_unlock_bh (&rose_neigh_list_lock);spin_unlock_bh (&rose_node_list_lock);
@@ -569,6 +564,7 @@ static int rose_clear_routes(void)if (s->use ==0 && !s->loopback) { s->count =0 ;rose_remove_neigh (s); +rose_neigh_put (s); } }
@@ -1301,6 +1297,7 @@ void __exit rose_rt_free(void) rose_neigh = rose_neigh->next;rose_remove_neigh (s); +rose_neigh_put (s); }while (rose_node !=NULL ) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 31/50 net: rose: convert use field to refcount_t
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takamitsu Iwai <[email protected]>
[ Upstream commit d860d1faa6b2ce3becfdb8b0c2b048ad31800061 ]
The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths.
For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues.
This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.
--- include/net/rose.h | 18 +++++++++++++----- net/rose/af_rose.c | 13 +++++++------ net/rose/rose_in.c | 12 ++++++------ net/rose/rose_route.c | 33 ++++++++++++++++++--------------- net/rose/rose_timer.c | 2 +- 5 files changed, 45 insertions(+), 33 deletions(-)
include/net/rose.h +13 -5
@@ -8,6 +8,7 @@#ifndef _ROSE_H#define _ROSE_H +#include <linux/refcount.h>#include <linux/rose.h> #include <net/ax25.h> #include <net/sock.h>
@@ -96,7 +97,7 @@ struct rose_neigh {ax25_cb *ax25;struct net_device *dev;unsigned short count; -unsigned short use; +refcount_t use;unsigned int number;char restarted;char dce_mode;
@@ -151,12 +152,19 @@ struct rose_sock {#define rose_sk (sk) ((struct rose_sock *)(sk)) +static inline void rose_neigh_hold (struct rose_neigh *rose_neigh) +{ +refcount_inc (&rose_neigh->use); +} +static inline void rose_neigh_put (struct rose_neigh *rose_neigh) { -if (rose_neigh->ax25) -ax25_cb_put (rose_neigh->ax25); -kfree (rose_neigh->digipeat); -kfree (rose_neigh); +if (refcount_dec_and_test (&rose_neigh->use)) { +if (rose_neigh->ax25) +ax25_cb_put (rose_neigh->ax25); +kfree (rose_neigh->digipeat); +kfree (rose_neigh); + } }/* af_rose.c */
net/rose/af_rose.c +7 -6
@@ -170,7 +170,7 @@ void rose_kill_by_neigh(struct rose_neigh *neigh)if (rose->neighbour == neigh) {rose_disconnect (s,ENETUNREACH ,ROSE_OUT_OF_ORDER ,0 ); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour); rose->neighbour =NULL ; } }
@@ -212,7 +212,7 @@ static void rose_kill_by_device(struct net_device *dev)if (rose->device == dev) {rose_disconnect (sk,ENETUNREACH ,ROSE_OUT_OF_ORDER ,0 );if (rose->neighbour) - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);netdev_put (rose->device, &rose->dev_tracker); rose->device =NULL ; }
@@ -655,7 +655,7 @@ static int rose_release(struct socket *sock)break ;case ROSE_STATE_2 : - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);release_sock (sk);rose_disconnect (sk,0 ,-1 ,-1 );lock_sock (sk);
@@ -823,6 +823,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le rose->lci =rose_new_lci (rose->neighbour);if (!rose->lci) { err = -ENETUNREACH ; +rose_neigh_put (rose->neighbour); goto out_release; }
@@ -834,12 +835,14 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le dev =rose_dev_first ();if (!dev) { err = -ENETUNREACH ; +rose_neigh_put (rose->neighbour); goto out_release; } user =ax25_findbyuid (current_euid ());if (!user) { err = -EINVAL ; +rose_neigh_put (rose->neighbour);dev_put (dev); goto out_release; }
@@ -874,8 +877,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le rose->state =ROSE_STATE_1 ; - rose->neighbour->use++; -rose_write_internal (sk,ROSE_CALL_REQUEST );rose_start_heartbeat (sk);rose_start_t1timer (sk);
@@ -1077,7 +1078,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros GFP_ATOMIC); make_rose->facilities = facilities; - make_rose->neighbour->use++; +rose_neigh_hold (make_rose->neighbour);if (rose_sk (sk)->defer) { make_rose->state =ROSE_STATE_5 ;
net/rose/rose_in.c +6 -6
@@ -56,7 +56,7 @@ static int rose_state1_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,ECONNREFUSED , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;default :
@@ -79,12 +79,12 @@ static int rose_state2_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;case ROSE_CLEAR_CONFIRMATION :rose_disconnect (sk,0 ,-1 ,-1 ); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;default :
@@ -120,7 +120,7 @@ static int rose_state3_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;case ROSE_RR :
@@ -233,7 +233,7 @@ static int rose_state4_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;default :
@@ -253,7 +253,7 @@ static int rose_state5_machine(struct sock *sk, struct sk_buff *skb, int frametyif (frametype ==ROSE_CLEAR_REQUEST ) {rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); -rose_sk (sk)->neighbour->use--; +rose_neigh_put (rose_sk (sk)->neighbour); }return 0 ;
net/rose/rose_route.c +18 -15
@@ -93,11 +93,11 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, rose_neigh->ax25 =NULL ; rose_neigh->dev = dev; rose_neigh->count =0 ; - rose_neigh->use =0 ; rose_neigh->dce_mode =0 ; rose_neigh->loopback =0 ; rose_neigh->number = rose_neigh_no++; rose_neigh->restarted =0 ; +refcount_set (&rose_neigh->use,1 );skb_queue_head_init (&rose_neigh->queue);
@@ -255,10 +255,10 @@ static void rose_remove_route(struct rose_route *rose_route)struct rose_route *s;if (rose_route->neigh1 !=NULL ) - rose_route->neigh1->use--; +rose_neigh_put (rose_route->neigh1);if (rose_route->neigh2 !=NULL ) - rose_route->neigh2->use--; +rose_neigh_put (rose_route->neigh2);if ((s = rose_route_list) == rose_route) { rose_route_list = rose_route->next;
@@ -323,7 +323,7 @@ static int rose_del_node(struct rose_route_struct *rose_route,if (rose_node->neighbour[i] == rose_neigh) { rose_neigh->count--; -if (rose_neigh->count ==0 && rose_neigh->use ==0 ) { +if (rose_neigh->count ==0 ) {rose_remove_neigh (rose_neigh);rose_neigh_put (rose_neigh); }
@@ -375,11 +375,11 @@ void rose_add_loopback_neigh(void) sn->ax25 =NULL ; sn->dev =NULL ; sn->count =0 ; - sn->use =0 ; sn->dce_mode =1 ; sn->loopback =1 ; sn->number = rose_neigh_no++; sn->restarted =1 ; +refcount_set (&sn->use,1 );skb_queue_head_init (&sn->queue);
@@ -561,8 +561,7 @@ static int rose_clear_routes(void) s = rose_neigh; rose_neigh = rose_neigh->next; -if (s->use ==0 && !s->loopback) { - s->count =0 ; +if (!s->loopback) {rose_remove_neigh (s);rose_neigh_put (s); }
@@ -680,6 +679,7 @@ struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause,for (i =0 ; i < node->count; i++) {if (node->neighbour[i]->restarted) { res = node->neighbour[i]; +rose_neigh_hold (node->neighbour[i]); goto out; } }
@@ -691,6 +691,7 @@ struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause,for (i =0 ; i < node->count; i++) {if (!rose_ftimer_running (node->neighbour[i])) { res = node->neighbour[i]; +rose_neigh_hold (node->neighbour[i]); goto out; } failed =1 ;
@@ -780,13 +781,13 @@ static void rose_del_route_by_neigh(struct rose_neigh *rose_neigh) }if (rose_route->neigh1 == rose_neigh) { - rose_route->neigh1->use--; +rose_neigh_put (rose_route->neigh1); rose_route->neigh1 =NULL ;rose_transmit_clear_request (rose_route->neigh2, rose_route->lci2,ROSE_OUT_OF_ORDER ,0 ); }if (rose_route->neigh2 == rose_neigh) { - rose_route->neigh2->use--; +rose_neigh_put (rose_route->neigh2); rose_route->neigh2 =NULL ;rose_transmit_clear_request (rose_route->neigh1, rose_route->lci1,ROSE_OUT_OF_ORDER ,0 ); }
@@ -915,7 +916,7 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)rose_clear_queues (sk); rose->cause =ROSE_NETWORK_CONGESTION ; rose->diagnostic =0 ; - rose->neighbour->use--; +rose_neigh_put (rose->neighbour); rose->neighbour =NULL ; rose->lci =0 ; rose->state =ROSE_STATE_0 ;
@@ -1040,12 +1041,12 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)if ((new_lci =rose_new_lci (new_neigh)) ==0 ) {rose_transmit_clear_request (rose_neigh, lci,ROSE_NETWORK_CONGESTION ,71 ); - goto out; + goto put_neigh; }if ((rose_route =kmalloc (sizeof (*rose_route),GFP_ATOMIC )) ==NULL ) {rose_transmit_clear_request (rose_neigh, lci,ROSE_NETWORK_CONGESTION ,120 ); - goto out; + goto put_neigh; } rose_route->lci1 = lci;
@@ -1058,8 +1059,8 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) rose_route->lci2 = new_lci; rose_route->neigh2 = new_neigh; - rose_route->neigh1->use++; - rose_route->neigh2->use++; +rose_neigh_hold (rose_route->neigh1); +rose_neigh_hold (rose_route->neigh2); rose_route->next = rose_route_list; rose_route_list = rose_route;
@@ -1071,6 +1072,8 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)rose_transmit_link (skb, rose_route->neigh2); res =1 ; +put_neigh: +rose_neigh_put (new_neigh); out:spin_unlock_bh (&rose_route_list_lock);spin_unlock_bh (&rose_neigh_list_lock);
@@ -1186,7 +1189,7 @@ static int rose_neigh_show(struct seq_file *seq, void *v) (rose_neigh->loopback) ?"RSLOOP-0" :ax2asc (buf, &rose_neigh->callsign), rose_neigh->dev ? rose_neigh->dev->name :"???" , rose_neigh->count, - rose_neigh->use, +refcount_read (&rose_neigh->use) -1 , (rose_neigh->dce_mode) ?"DCE" :"DTE" , (rose_neigh->restarted) ?"yes" :"no" , ax25_display_timer(&rose_neigh->t0timer) / HZ,
net/rose/rose_timer.c +1 -1
@@ -180,7 +180,7 @@ static void rose_timer_expiry(struct timer_list *t)break ;case ROSE_STATE_2 :/* T3 */ - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);rose_disconnect (sk,ETIMEDOUT ,-1 ,-1 );break ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 32/50 net: rose: include node references in rose_neigh refcount
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takamitsu Iwai <[email protected]>
[ Upstream commit da9c9c877597170b929a6121a68dcd3dd9a80f45 ]
Current implementation maintains two separate reference counting
mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock.
This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented.
This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node().
These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.
--- net/rose/rose_route.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
net/rose/rose_route.c +16 -2
@@ -178,6 +178,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, } } rose_neigh->count++; +rose_neigh_hold (rose_neigh); goto out; }
@@ -187,6 +188,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, rose_node->neighbour[rose_node->count] = rose_neigh; rose_node->count++; rose_neigh->count++; +rose_neigh_hold (rose_neigh); } out:
@@ -322,6 +324,7 @@ static int rose_del_node(struct rose_route_struct *rose_route,for (i =0 ; i < rose_node->count; i++) {if (rose_node->neighbour[i] == rose_neigh) { rose_neigh->count--; +rose_neigh_put (rose_neigh);if (rose_neigh->count ==0 ) {rose_remove_neigh (rose_neigh);
@@ -430,6 +433,7 @@ int rose_add_loopback_node(const rose_address *address) rose_node_list = rose_node; rose_loopback_neigh->count++; +rose_neigh_hold (rose_loopback_neigh); out:spin_unlock_bh (&rose_node_list_lock);
@@ -461,6 +465,7 @@ void rose_del_loopback_node(const rose_address *address)rose_remove_node (rose_node); rose_loopback_neigh->count--; +rose_neigh_put (rose_loopback_neigh); out:spin_unlock_bh (&rose_node_list_lock);
@@ -500,6 +505,7 @@ void rose_rt_device_down(struct net_device *dev)memmove (&t->neighbour[i], &t->neighbour[i +1 ],sizeof (t->neighbour[0 ]) * (t->count - i)); +rose_neigh_put (s); }if (t->count <=0 )
@@ -543,6 +549,7 @@ static int rose_clear_routes(void) {struct rose_neigh *s, *rose_neigh;struct rose_node *t, *rose_node; +int i;spin_lock_bh (&rose_node_list_lock);spin_lock_bh (&rose_neigh_list_lock);
@@ -553,8 +560,12 @@ static int rose_clear_routes(void)while (rose_node !=NULL ) { t = rose_node; rose_node = rose_node->next; -if (!t->loopback) + +if (!t->loopback) { +for (i =0 ; i < rose_node->count; i++) +rose_neigh_put (t->neighbour[i]);rose_remove_node (t); + } }while (rose_neigh !=NULL ) {
@@ -1189,7 +1200,7 @@ static int rose_neigh_show(struct seq_file *seq, void *v) (rose_neigh->loopback) ?"RSLOOP-0" :ax2asc (buf, &rose_neigh->callsign), rose_neigh->dev ? rose_neigh->dev->name :"???" , rose_neigh->count, -refcount_read (&rose_neigh->use) -1 , +refcount_read (&rose_neigh->use) - rose_neigh->count -1 , (rose_neigh->dce_mode) ?"DCE" :"DTE" , (rose_neigh->restarted) ?"yes" :"no" , ax25_display_timer(&rose_neigh->t0timer) / HZ,
@@ -1294,6 +1305,7 @@ void __exit rose_rt_free(void)struct rose_neigh *s, *rose_neigh = rose_neigh_list;struct rose_node *t, *rose_node = rose_node_list;struct rose_route *u, *rose_route = rose_route_list; +int i;while (rose_neigh !=NULL ) { s = rose_neigh;
@@ -1307,6 +1319,8 @@ void __exit rose_rt_free(void) t = rose_node; rose_node = rose_node->next; +for (i =0 ; i < t->count; i++) +rose_neigh_put (t->neighbour[i]);rose_remove_node (t); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 33/50 sctp: initialize more fields in sctp_v6_from_sk()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2e8750469242cad8f01f320131fd5a6f540dbb99 ]
syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior.
Clear sin6_scope_id and sin6_flowinfo.
BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable addr.i.i created at:
sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930
--- net/sctp/ipv6.c | 2 ++ 1 file changed, 2 insertions(+)
net/sctp/ipv6.c +2 -0
@@ -547,7 +547,9 @@ static void sctp_v6_from_sk(union sctp_addr *addr, struct sock *sk) { addr->v6.sin6_family =AF_INET6 ; addr->v6.sin6_port =0 ; + addr->v6.sin6_flowinfo =0 ; addr->v6.sin6_addr = sk->sk_v6_rcv_saddr; + addr->v6.sin6_scope_id =0 ; }/* Initialize sk->sk_rcv_saddr from sctp_addr. */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 34/50 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit a6358f8cf64850f3f27857b8ed8c1b08cfc4685c ]
Observed on kernel 6.6 (present on master as well):
BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0
If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename:
T1 T2
lookup_open
->lookup
simple_lookup
d_add
// invalid dentry is added to hash list
lookup_open
d_alloc_parallel
__d_lookup_rcu
__d_lookup_rcu_op_compare
hlist_bl_for_each_entry_rcu
// invalid dentry can be retrieved
->d_compare
efivarfs_d_compare
// oobFix it by checking 'guid' before cmp.
--- fs/efivarfs/super.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/efivarfs/super.c +4 -0
@@ -47,6 +47,10 @@ static int efivarfs_d_compare(const struct dentry *dentry, {int guid = len -EFI_VARIABLE_GUID_LEN ; +/* Parallel lookups may produce a temporary invalid filename */ +if (guid <=0 ) +return 1 ; +if (name->len != len)return 1 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 35/50 KVM: x86: use array_index_nospec with indices that come from guest
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thijs Raymakers <[email protected]>
commit c87bd4dd43a624109c3cc42d843138378a7f4548 upstream.
min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.
--- arch/x86/kvm/lapic.c | 2 ++ arch/x86/kvm/x86.c | 7 +++++-- 2 files changed, 7 insertions(+), 2 deletions(-)
arch/x86/kvm/lapic.c +2 -0
@@ -684,6 +684,8 @@ static int __pv_send_ipi(unsigned long *if (min > map->max_apic_id)return 0 ; + min =array_index_nospec (min, map->max_apic_id +1 ); +for_each_set_bit (i, ipi_bitmap,min ((u32 )BITS_PER_LONG , (map->max_apic_id - min +1 ))) {if (map->phys_map[min + i]) {
arch/x86/kvm/x86.c +5 -2
@@ -9681,8 +9681,11 @@ static void kvm_sched_yield(struct kvm_vrcu_read_lock (); map =rcu_dereference (vcpu->kvm->arch.apic_map); -if (likely (map) && dest_id <= map->max_apic_id && map->phys_map[dest_id]) - target = map->phys_map[dest_id]->vcpu; +if (likely (map) && dest_id <= map->max_apic_id) { + dest_id =array_index_nospec (dest_id, map->max_apic_id +1 ); +if (map->phys_map[dest_id]) + target = map->phys_map[dest_id]->vcpu; + }rcu_read_unlock ();
Greg Kroah-Hartman
maintainerPATCH 36/50 HID: asus: fix UAF via HID_CLAIMED_INPUT validation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4 upstream.
After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device.
This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees.
0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection
Below is the KASAN splat after triggering the UAF:
[ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfree+0xcf/0x350 [ 21.673700] input_dev_release+0xab/0xd0 [ 21.673700] device_release+0x9f/0x220 [ 21.673700] kobject_put+0x12b/0x220 [ 21.673700] put_device+0x12/0x20 [ 21.673700] input_free_device+0x4c/0xb0 [ 21.673700] hidinput_connect+0x1862/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220
[...]
--- drivers/hid/hid-asus.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +7 -1
@@ -1117,7 +1117,13 @@ static int asus_probe(struct hid_devicereturn ret; } -if (!drvdata->input) { +/* +* Check that input registration succeeded. Checking that +* HID_CLAIMED_INPUT is set prevents a UAF when all input devices +* were freed during registration due to no usages being mapped, +* leaving drvdata->input pointing to freed memory. +*/ +if (!drvdata->input || !(hdev->claimed &HID_CLAIMED_INPUT )) {hid_err (hdev,"Asus input not registered\n" ); ret = -ENOMEM ; goto err_stop_hw;
Greg Kroah-Hartman
maintainerPATCH 37/50 HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit 0379eb8691b9c4477da0277ae0832036ca4410b4 upstream.
A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it.
Below is the KASAN splat after the out of bounds access happens:
[ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] <TASK> [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40
[...]
--- drivers/hid/hid-multitouch.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hid/hid-multitouch.c +8 -0
@@ -1448,6 +1448,14 @@ static __u8 *mt_report_fixup(struct hid_if (hdev->vendor ==I2C_VENDOR_ID_GOODIX && (hdev->product ==I2C_DEVICE_ID_GOODIX_01E8 || hdev->product ==I2C_DEVICE_ID_GOODIX_01E9 )) { +if (*size <608 ) { +dev_info ( + &hdev->dev, +"GT7868Q fixup: report descriptor is only %u bytes, skipping\n" , + *size); +return rdesc; + } +if (rdesc[607 ] ==0x15 ) { rdesc[607 ] =0x25 ; dev_info(
Greg Kroah-Hartman
maintainerPATCH 38/50 HID: wacom: Add a new Art Pen 2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping Cheng <[email protected]>
commit 9fc51941d9e7793da969b2c66e6f8213c5b1237f upstream.
--- drivers/hid/wacom_wac.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/wacom_wac.c +1 -0
@@ -679,6 +679,7 @@ static bool wacom_is_art_pen(int tool_idcase 0x885 :/* Intuos3 Marker Pen */ case 0x804 :/* Intuos4/5 13HD/24HD Marker Pen */ case 0x10804 :/* Intuos4/5 13HD/24HD Art Pen */ +case 0x204 :/* Art Pen 2 */ is_art_pen = true;break ; }
Greg Kroah-Hartman
maintainerPATCH 39/50 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjong Kim <[email protected]>
commit 185c926283da67a72df20a63a5046b3b4631b7d9 upstream.
in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has
invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger
page fault error for address(0xffffffffffffff58)
add null check logic to ntrig_report_version()
before calling hid_to_usb_dev()
--- drivers/hid/hid-ntrig.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-ntrig.c +3 -0
@@ -144,6 +144,9 @@ static void ntrig_report_version(structstruct usb_device *usb_dev =hid_to_usb_dev (hdev);unsigned char *data =kmalloc (8 ,GFP_KERNEL ); +if (!hid_is_usb (hdev)) +return ; +if (!data) goto err_free;
Greg Kroah-Hartman
maintainerPATCH 40/50 Revert "drm/amdgpu: fix incorrect vm flags to map bo"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit ac4ed2da4c1305a1a002415058aa7deaf49ffe3e upstream.
This reverts commit b08425fa77ad2f305fe57a33dceb456be03b653f.
Revert this to align with 6.17 because the fixes tag was wrong on this commit.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c +2 -2
@@ -93,8 +93,8 @@ int amdgpu_map_static_csa(struct amdgpu_ } r =amdgpu_vm_bo_map (adev, *bo_va, csa_addr,0 , size, -AMDGPU_VM_PAGE_READABLE |AMDGPU_VM_PAGE_WRITEABLE | -AMDGPU_VM_PAGE_EXECUTABLE ); +AMDGPU_PTE_READABLE |AMDGPU_PTE_WRITEABLE | +AMDGPU_PTE_EXECUTABLE );if (r) {DRM_ERROR ("failed to do bo_map on static CSA, err=%d\n" , r);
Greg Kroah-Hartman
maintainerPATCH 41/50 dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shanker Donthineni <[email protected]>
commit 89a2d212bdb4bc29bed8e7077abe054b801137ea upstream.
When CONFIG_DMA_DIRECT_REMAP is enabled, atomic pool pages are remapped via dma_common_contiguous_remap() using the supplied pgprot. Currently, the mapping uses pgprot_dmacoherent(PAGE_KERNEL), which leaves the memory encrypted on systems with memory encryption enabled (e.g., ARM CCA Realms).
This can cause the DMA layer to fail or crash when accessing the memory, as the underlying physical pages are not configured as expected.
Fix this by requesting a decrypted mapping in the vmap() call:
pgprot_decrypted(pgprot_dmacoherent(PAGE_KERNEL))
This ensures that atomic pool memory is consistently mapped unencrypted.
--- kernel/dma/pool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/dma/pool.c +2 -2
@@ -102,8 +102,8 @@ static int atomic_pool_expand(struct gen#ifdef CONFIG_DMA_DIRECT_REMAP addr =dma_common_contiguous_remap (page, pool_size, -pgprot_dmacoherent (PAGE_KERNEL ), -__builtin_return_address (0 )); +pgprot_decrypted (pgprot_dmacoherent (PAGE_KERNEL )), +__builtin_return_address (0 ));if (!addr) goto free_page;#else
Greg Kroah-Hartman
maintainerPATCH 42/50 fs/smb: Fix inconsistent refcnt update
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
commit ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e upstream.
A possible inconsistent update of refcount was identified in smb2_compound_op. Such inconsistent update could lead to possible resource leaks.
Why it is a possible bug:
1. In the comment section of the function, it clearly states that the reference to cfile should be dropped after calling this function.
2. Every control flow path would check and drop the reference to cfile, except the patched one.
3. Existing callers would not handle refcount update of cfile if -ENOMEM is returned.
To fix the bug, an extra goto label "out" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of vars, the cleanup logic between label "finished" and "out" can be safely ignored. According to the definition of function is_replayable_error, the error code of "-ENOMEM" is not recoverable. Therefore, the replay logic also gets ignored.
--- fs/smb/client/smb2inode.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/smb/client/smb2inode.c +5 -2
@@ -81,8 +81,10 @@ static int smb2_compound_op(const unsignint len; vars =kzalloc (sizeof (*vars),GFP_ATOMIC ); -if (vars ==NULL ) -return -ENOMEM ; +if (vars ==NULL ) { + rc = -ENOMEM ; + goto out; + } rqst = &vars->rqst[0 ]; rsp_iov = &vars->rsp_iov[0 ];
@@ -510,6 +512,7 @@ static int smb2_compound_op(const unsignbreak ; } +out:if (cfile)cifsFileInfo_put (cfile);
Greg Kroah-Hartman
maintainerPATCH 43/50 net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit e81a7f65288c7e2cfb7e7890f648e099fd885ab3 upstream.
Add the following Telit Cinterion LE910C4-WWX new compositions:
0x1034: tty (AT) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1034 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x1037: tty (diag) + tty (Telit custom) + tty (AT) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 15 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1037 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x1038: tty (Telit custom) + tty (AT) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1038 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/qmi_wwan.c +3 -0
@@ -1362,6 +1362,9 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1034, 2)}, /* Telit LE910C4-WWX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1037, 4)}, /* Telit LE910C4-WWX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1038, 3)}, /* Telit LE910C4-WWX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x103a, 0)}, /* Telit LE910C4-WWX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
Greg Kroah-Hartman
maintainerPATCH 44/50 smb3 client: fix return code mapping of remap_file_range
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 0e08fa789d39aa01923e3ba144bd808291895c3c upstream.
We were returning -EOPNOTSUPP for various remap_file_range cases but for some of these the copy_file_range_syscall() requires -EINVAL to be returned (e.g. where source and target file ranges overlap when source and target are the same file). This fixes xfstest generic/157 which was expecting EINVAL for that (and also e.g. for when the src offset is beyond end of file).
--- fs/smb/client/cifsfs.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/smb/client/cifsfs.c +14 -0
@@ -1363,6 +1363,20 @@ static loff_t cifs_remap_file_range(strunetfs_resize_file (&target_cifsi->netfs, new_size);fscache_resize_cookie (cifs_inode_cookie (target_inode), new_size); + }else if (rc == -EOPNOTSUPP ) { +/* +* copy_file_range syscall man page indicates EINVAL +* is returned e.g when "fd_in and fd_out refer to the +* same file and the source and target ranges overlap." +* Test generic/157 was what showed these cases where +* we need to remap EOPNOTSUPP to EINVAL +*/ +if (off >= src_inode->i_size) { + rc = -EINVAL ; + }else if (src_inode == target_inode) { +if (off + len > destoff) + rc = -EINVAL ; + } } }
Greg Kroah-Hartman
maintainerPATCH 45/50 drm/nouveau/disp: Always accept linear modifier
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Jones <[email protected]>
commit e2fe0c54fb7401e6ecd3c10348519ab9e23bd639 upstream.
On some chipsets, which block-linear modifiers are supported is format-specific. However, linear modifiers are always be supported. The prior modifier filtering logic was not accounting for the linear case.
--- drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/nouveau/dispnv50/wndw.c +4 -0
@@ -663,6 +663,10 @@ static bool nv50_plane_format_mod_supporstruct nouveau_drm *drm =nouveau_drm (plane->dev);uint8_t i; +/* All chipsets can display all formats in linear layout */ +if (modifier ==DRM_FORMAT_MOD_LINEAR ) +return true; +if (drm->client.device.info.chipset <0xc0 ) {const struct drm_format_info *info =drm_format_info (format);const uint8_t kind = (modifier >>12 ) &0xff ;
Greg Kroah-Hartman
maintainerPATCH 46/50 net: rose: fix a typo in rose_clear_routes()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 1cc8a5b534e5f9b5e129e54ee2e63c9f5da4f39a upstream.
syzbot crashed in rose_clear_routes(), after a recent patch typo.
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 UID: 0 PID: 10591 Comm: syz.3.1856 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:rose_clear_routes net/rose/rose_route.c:565 [inline] RIP: 0010:rose_rt_ioctl+0x162/0x1250 net/rose/rose_route.c:760 <TASK> rose_ioctl+0x3ce/0x8b0 net/rose/af_rose.c:1381 sock_do_ioctl+0xd9/0x300 net/socket.c:1238 sock_ioctl+0x576/0x790 net/socket.c:1359 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/rose/rose_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rose/rose_route.c +1 -1
@@ -562,7 +562,7 @@ static int rose_clear_routes(void) rose_node = rose_node->next;if (!t->loopback) { -for (i =0 ; i < rose_node->count; i++) +for (i =0 ; i < t->count; i++)rose_neigh_put (t->neighbour[i]);rose_remove_node (t); }
Greg Kroah-Hartman
maintainerPATCH 47/50 HID: mcp2221: Dont set bus speed on every transfer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hamish Martin <[email protected]>
commit 02a46753601a24e1673d9c28173121055e8e6cc9 upstream.
Since the initial commit of this driver the I2C bus speed has been reconfigured for every single transfer. This is despite the fact that we never change the speed and it is never "lost" by the chip. Upon investigation we find that what was really happening was that the setting of the bus speed had the side effect of cancelling a previous failed command if there was one, thereby freeing the bus. This is the part that was actually required to keep the bus operational in the face of failed commands.
Instead of always setting the speed, we now correctly cancel any failed commands as they are detected. This means we can just set the bus speed at probe time and remove the previous speed sets on each transfer. This has the effect of improving performance and reducing the number of commands required to complete transfers.
--- drivers/hid/hid-mcp2221.c | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-)
drivers/hid/hid-mcp2221.c +27 -14
@@ -169,6 +169,25 @@ static int mcp_cancel_last_cmd(struct mcreturn mcp_send_data_req_status (mcp, mcp->txbuf,8 ); } +/* Check if the last command succeeded or failed and return the result. +* If the command did fail, cancel that command which will free the i2c bus. +*/ +static int mcp_chk_last_cmd_status_free_bus (struct mcp2221 *mcp) +{ +int ret; + + ret =mcp_chk_last_cmd_status (mcp); +if (ret) { +/* The last command was a failure. +* Send a cancel which will also free the bus. +*/ +usleep_range (980 ,1000 ); +mcp_cancel_last_cmd (mcp); + } + +return ret; +} +static int mcp_set_i2c_speed (struct mcp2221 *mcp) {int ret;
@@ -223,7 +242,7 @@ static int mcp_i2c_write(struct mcp2221usleep_range (980 ,1000 );if (last_status) { - ret =mcp_chk_last_cmd_status (mcp); + ret =mcp_chk_last_cmd_status_free_bus (mcp);if (ret)return ret; }
@@ -290,7 +309,7 @@ static int mcp_i2c_smbus_read(struct mcpif (ret)return ret; - ret =mcp_chk_last_cmd_status (mcp); + ret =mcp_chk_last_cmd_status_free_bus (mcp);if (ret)return ret;
@@ -310,11 +329,6 @@ static int mcp_i2c_xfer(struct i2c_adaptmutex_lock (&mcp->lock); -/* Setting speed before every transaction is required for mcp2221 */ - ret =mcp_set_i2c_speed (mcp); -if (ret) - goto exit; -if (num ==1 ) {if (msgs->flags &I2C_M_RD ) { ret = mcp_i2c_smbus_read(mcp, msgs, MCP2221_I2C_RD_DATA,
@@ -399,9 +413,7 @@ static int mcp_smbus_write(struct mcp222if (last_status) {usleep_range (980 ,1000 ); - ret =mcp_chk_last_cmd_status (mcp); -if (ret) -return ret; + ret =mcp_chk_last_cmd_status_free_bus (mcp); }return ret;
@@ -419,10 +431,6 @@ static int mcp_smbus_xfer(struct i2c_adamutex_lock (&mcp->lock); - ret =mcp_set_i2c_speed (mcp); -if (ret) - goto exit; -switch (size) {case I2C_SMBUS_QUICK :
@@ -870,6 +878,11 @@ static int mcp2221_probe(struct hid_deviif (i2c_clk_freq <50 ) i2c_clk_freq =50 ; mcp->cur_i2c_clk_div = (12000000 / (i2c_clk_freq *1000 )) -3 ; + ret =mcp_set_i2c_speed (mcp); +if (ret) { +hid_err (hdev,"can't set i2c speed: %d\n" , ret); +return ret; + } mcp->adapter.owner =THIS_MODULE ; mcp->adapter.class =I2C_CLASS_HWMON ;
Greg Kroah-Hartman
maintainerPATCH 48/50 HID: mcp2221: Handle reads greater than 60 bytes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hamish Martin <[email protected]>
commit 2682468671aa0b4d52ae09779b48212a80d71b91 upstream.
When a user requests more than 60 bytes of data the MCP2221 must chunk the data in chunks up to 60 bytes long (see command/response code 0x40 in the datasheet).
In order to signal that the device has more data the (undocumented) byte at byte index 2 of the Get I2C Data response uses the value 0x54. This contrasts with the case for the final data chunk where the value returned is 0x55 (MCP2221_I2C_READ_COMPL). The fact that 0x55 was not returned in the response was interpreted by the driver as a failure meaning that all reads of more than 60 bytes would fail.
Add support for reads that are split over multiple chunks by looking for the response code indicating that more data is expected and continuing the read as the code intended. Some timing delays are required to ensure the chip has time to refill its FIFO as data is read in from the I2C bus. This timing has been tested in my system when configured for bus speeds of 50KHz, 100KHz, and 400KHz and operates well.
--- drivers/hid/hid-mcp2221.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-)
drivers/hid/hid-mcp2221.c +23 -9
@@ -44,6 +44,7 @@ enum {MCP2221_I2C_MASK_ADDR_NACK =0x40 ,MCP2221_I2C_WRADDRL_SEND =0x21 ,MCP2221_I2C_ADDR_NACK =0x25 , +MCP2221_I2C_READ_PARTIAL =0x54 ,MCP2221_I2C_READ_COMPL =0x55 ,MCP2221_ALT_F_NOT_GPIOV =0xEE , MCP2221_ALT_F_NOT_GPIOD = 0xEF,
@@ -279,6 +280,7 @@ static int mcp_i2c_smbus_read(struct mcp {int ret;u16 total_len; +int retries =0 ; mcp->txbuf[0 ] = type;if (msg) {
@@ -302,20 +304,31 @@ static int mcp_i2c_smbus_read(struct mcp mcp->rxbuf_idx =0 ;do { +/* Wait for the data to be read by the device */ +usleep_range (980 ,1000 ); +memset (mcp->txbuf,0 ,4 ); mcp->txbuf[0 ] =MCP2221_I2C_GET_DATA ; ret =mcp_send_data_req_status (mcp, mcp->txbuf,1 ); -if (ret) -return ret; - - ret =mcp_chk_last_cmd_status_free_bus (mcp); -if (ret) -return ret; - -usleep_range (980 ,1000 ); +if (ret) { +if (retries <5 ) { +/* The data wasn't ready to read. +* Wait a bit longer and try again. +*/ +usleep_range (90 ,100 ); + retries++; + }else { +return ret; + } + }else { + retries =0 ; + } }while (mcp->rxbuf_idx < total_len); +usleep_range (980 ,1000 ); + ret =mcp_chk_last_cmd_status_free_bus (mcp); +return ret; }
@@ -776,7 +789,8 @@ static int mcp2221_raw_event(struct hid_ mcp->status = -EIO ;break ; } -if (data[2 ] ==MCP2221_I2C_READ_COMPL ) { +if (data[2 ] ==MCP2221_I2C_READ_COMPL || + data[2 ] ==MCP2221_I2C_READ_PARTIAL ) { buf = mcp->rxbuf;memcpy (&buf[mcp->rxbuf_idx], &data[4 ], data[3 ]); mcp->rxbuf_idx = mcp->rxbuf_idx + data[3 ];
Greg Kroah-Hartman
maintainerPATCH 49/50 Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
This reverts commit 4f546a77671076a0a49c08b4c6a7d0888d72f7d2 which is commit a40c5d727b8111b5db424a1e43e14a1dcce1e77f upstream.
The upstream commit a40c5d727b8111b5db424a1e43e14a1dcce1e77f ("drm/dp:
Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS") the reverted commit backported causes a regression, on one eDP panel at least resulting in display flickering, described in detail at the Link:
below. The issue fixed by the upstream commit will need a different solution, revert the backport for now.
--- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/display/drm_dp_helper.c +1 -1
@@ -663,7 +663,7 @@ ssize_t drm_dp_dpcd_read(struct drm_dp_a* monitor doesn't power down exactly after the throw away read. */ if (!aux->is_remote) { - ret =drm_dp_dpcd_probe (aux,DP_LANE0_1_STATUS ); + ret =drm_dp_dpcd_probe (aux,DP_DPCD_REV );if (ret <0 )return ret; }
Greg Kroah-Hartman
maintainerPATCH 50/50 xfs: do not propagate ENODATA disk errors into xattr code
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
commit ae668cd567a6a7622bc813ee0bb61c42bed61ba7 upstream.
ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found.
However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as "attribute not found" when in fact it's an IO (disk) error.
At worst, we may oops in xfs_attr_leaf_get() when we do:
error = xfs_attr_leaf_hasname(args, &bp);
if (error == -ENOATTR) {
xfs_trans_brelse(args->trans, bp);
return error;
}because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it.
As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO.
However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later.
(Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)
--- fs/xfs/libxfs/xfs_attr_remote.c | 7 +++++++ fs/xfs/libxfs/xfs_da_btree.c | 6 ++++++ 2 files changed, 13 insertions(+)
fs/xfs/libxfs/xfs_attr_remote.c +7 -0
@@ -418,6 +418,13 @@ xfs_attr_rmtval_get( dblkcnt =XFS_FSB_TO_BB (mp, map[i].br_blockcount); error =xfs_buf_read (mp->m_ddev_targp, dblkno, dblkcnt,0 , &bp, &xfs_attr3_rmt_buf_ops); +/* +* ENODATA from disk implies a disk medium failure; +* ENODATA for xattrs means attribute not found, so +* disambiguate that here. +*/ +if (error == -ENODATA ) + error = -EIO ;if (error)return error;
fs/xfs/libxfs/xfs_da_btree.c +6 -0
@@ -2648,6 +2648,12 @@ xfs_da_read_buf( error =xfs_trans_read_buf_map (mp, tp, mp->m_ddev_targp, mapp, nmap,0 , &bp, ops); +/* +* ENODATA from disk implies a disk medium failure; ENODATA for +* xattrs means attribute not found, so disambiguate that here. +*/ +if (error == -ENODATA && whichfork ==XFS_ATTR_FORK ) + error = -EIO ;if (error) goto out_free;
Re: 6.1.150-rc1-00051 review
In reply to Greg Kroah-HartmanBroadcast regression confirmed fixed:
https://lore.kernel.org/regressions/[email protected]
# Librecast Test Results
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.1.150-rc1-00051-gcdcdd968ff27 #58 SMP PREEMPT_DYNAMIC Tue Sep 2 16:05:12 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.150 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.1:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
119 tests: 119 pass, 0 failLinux version: 6.1.150-rc1-gcdcdd968ff27
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.150 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.150 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.1.y
Best regards,
Pavel
Signature · 2 lines
In cooperation with DENX Software Engineering GmbH, HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.150 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Am 02.09.2025 um 15:20 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.150 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.150 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.1.150-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: cdcdd968ff27439390868ee985f1a70f6d6081a8
* git describe: v6.1.149-51-gcdcdd968ff27
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.149-51-gcdcdd968ff27
## Test Regressions (compared to v6.1.148-483-g3c70876950c1)
## Metric Regressions (compared to v6.1.148-483-g3c70876950c1)
## Test Fixes (compared to v6.1.148-483-g3c70876950c1)
## Metric Fixes (compared to v6.1.148-483-g3c70876950c1)
## Test result summary
total: 226941, pass: 211392, fail: 4456, skip: 10839, xfail: 254
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 133 total, 133 passed, 0 failed
* arm64: 41 total, 41 passed, 0 failed
* i386: 21 total, 21 passed, 0 failed
* mips: 26 total, 25 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 32 total, 31 passed, 1 failed
* riscv: 11 total, 11 passed, 0 failed
* s390: 14 total, 14 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 7 total, 7 passed, 0 failed
* x86_64: 33 total, 33 passed, 0 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-exec
* kselftest-fpu
* kselftest-futex
* kselftest-intel_pstate
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-mincore
* kselftest-mqueue
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-sigaltstack
* kselftest-size
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* modules
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.150 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.